@Test
  @ConnectionConfiguration(user = "super-user", password = "1234567")
  public void testNoAccessWithWhoever() throws Exception {
    MBeanServerConnection con = connectionRule.getMBeanServerConnection();
    assertThatThrownBy(
        () -> con.createMBean("FakeClassName", new ObjectName("GemFire", "name", "foo")))
            .isInstanceOf(SecurityException.class);

    assertThatThrownBy(() -> con.unregisterMBean(new ObjectName("GemFire", "name", "foo")))
        .isInstanceOf(SecurityException.class);

    // user is allowed to create beans of other domains
    assertThatThrownBy(
        () -> con.createMBean("FakeClassName", new ObjectName("OtherDomain", "name", "foo")))
            .isInstanceOf(ReflectionException.class);
  }
No user can call createBean or unregisterBean of GemFire Domain
geode-core/src/integrationTest/java/org/apache/geode/management/internal/security/MBeanSecurityJUnitTest.java