private void updateUsers(Set<UserRequest> requests) throws AmbariException, AuthorizationException {
    boolean asUserAdministrator = AuthorizationHelper.isAuthorized(ResourceType.AMBARI, null,
        RoleAuthorization.AMBARI_MANAGE_USERS);
    String authenticatedUsername = AuthorizationHelper.getAuthenticatedName();

    for (final UserRequest request : requests) {
      String requestedUsername = request.getUsername();

      // An administrator can modify any user, else a user can only modify themself.
      if (!asUserAdministrator && (!authenticatedUsername.equalsIgnoreCase(requestedUsername))) {
        throw new AuthorizationException();
      }

      UserEntity userEntity = users.getUserEntity(requestedUsername);
      if (null == userEntity) {// Only an user with the privs to manage users can update a user's active status
        continue;
      }

      boolean hasUpdates = false;
      if (isValueChanged(request.isActive(), userEntity.getActive())) {
        // If this value is being set, make sure the authenticated user is an administrator before
        // allowing to change it. Only administrators should be able to change a user's active state
        if (!asUserAdministrator) {
          throw new AuthorizationException("The authenticated user is not authorized to update the requested user's active property");
        }

        hasUpdates = true;
      }

      // Only an user with the privs to manage users can update a user's local username
      if (isValueChanged(request.getLocalUserName(), userEntity.getLocalUsername())) {
        // If this value is being set, make sure the authenticated user is an administrator before
        // allowing to change it. Only administrators should be able to change a user's active state
        if (!asUserAdministrator) {
          throw new AuthorizationException("The authenticated user is not authorized to update the requested user's local username property");
        }

        hasUpdates = true;
      }

      hasUpdates = hasUpdates || isValueChanged(request.getDisplayName(), userEntity.getDisplayName());

      if (hasUpdates) {
        users.safelyUpdateUserEntity(userEntity,
            new Users.Command() {
              @Override
              public void perform(UserEntity userEntity) {
                if (isValueChanged(request.isActive(), userEntity.getActive())) {
                  userEntity.setActive(request.isActive());
                }

                if (isValueChanged(request.getLocalUserName(), userEntity.getLocalUsername())) {
                  userEntity.setLocalUsername(request.getLocalUserName());
                }

                if (isValueChanged(request.getDisplayName(), userEntity.getDisplayName())) {
                  userEntity.setDisplayName(request.getDisplayName());
                }
              }
            });
      }

      // Only an user with the privs to manage users can update a user's roles
      if (null != request.isAdmin()) {
        // If this value is being set, make sure the authenticated user is an administrator before
        // allowing to change it. Only administrators should be able to change a user's administrative
        // privileges
        if (!asUserAdministrator) {
          throw new AuthorizationException("The authenticated user is not authorized to update the requested resource property");
        }

        if (request.isAdmin()) {
          users.grantAdminPrivilege(userEntity);
        } else {
          users.revokeAdminPrivilege(userEntity);
        }
      }

      // Setting/Changing a user's password here is for backward compatibility to maintain API V1 contract
      if (request.getPassword() != null) {
        addOrUpdateLocalAuthenticationSource(asUserAdministrator, userEntity, request.getPassword(), request.getOldPassword());
      }

      if (request.getConsecutiveFailures() != null) {
        if (!asUserAdministrator) {
          throw new AuthorizationException("The authenticated user is not authorized to update the requested resource property");
        }
        users.safelyUpdateUserEntity(userEntity, user -> user.setConsecutiveFailures(request.getConsecutiveFailures()));
      }
    }
  }
Updates the users specified.

@param requests the users to modify
@throws AmbariException          if the resources cannot be updated
@throws IllegalArgumentException if the authenticated user is not authorized to update all of
                                 the requested properties
ambari-server/src/main/java/org/apache/ambari/server/controller/internal/UserResourceProvider.java