@Override
  public void postModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
    TableName tableName, TableDescriptor oldDescriptor, TableDescriptor currentDescriptor)
    throws IOException {
    try (Table aclTable =
      ctx.getEnvironment().getConnection().getTable(PermissionStorage.ACL_TABLE_NAME)) {
      if (
        needHandleTableHdfsAcl(currentDescriptor, "modifyTable " + tableName)
          && !hdfsAclHelper.isAclSyncToHdfsEnabled(oldDescriptor)
      ) {
        // 1. Create table directories used for acl inherited
        hdfsAclHelper.createTableDirectories(tableName);
        // 2. Add table users HDFS acls
        Set<String> tableUsers = hdfsAclHelper.getUsersWithTableReadAction(tableName, false, false);
        Set<String> users =
          hdfsAclHelper.getUsersWithNamespaceReadAction(tableName.getNamespaceAsString(), true);
        users.addAll(tableUsers);
        hdfsAclHelper.addTableAcl(tableName, users, "modify");
        // 3. Record table user acls are synced to HDFS in acl table
        SnapshotScannerHDFSAclStorage.addUserTableHdfsAcl(ctx.getEnvironment().getConnection(),
          tableUsers, tableName);
      } else if (
        needHandleTableHdfsAcl(oldDescriptor, "modifyTable " + tableName)
          && !hdfsAclHelper.isAclSyncToHdfsEnabled(currentDescriptor)
      ) {
        // 1. Remove empty table directories
        List<Path> tableRootPaths = hdfsAclHelper.getTableRootPaths(tableName, false);
        for (Path path : tableRootPaths) {
          hdfsAclHelper.deleteEmptyDir(path);
        }
        // 2. Remove all table HDFS acls
        Set<String> tableUsers = hdfsAclHelper.getUsersWithTableReadAction(tableName, false, false);
        Set<String> users =
          hdfsAclHelper.getUsersWithNamespaceReadAction(tableName.getNamespaceAsString(), true);
        users.addAll(tableUsers);
        hdfsAclHelper.removeTableAcl(tableName, users);
        // 3. Remove namespace access HDFS acls for users who only own permission for this table
        hdfsAclHelper.removeNamespaceAccessAcl(tableName,
          filterUsersToRemoveNsAccessAcl(aclTable, tableName, tableUsers), "modify");
        // 4. Record table user acl is not synced to HDFS
        SnapshotScannerHDFSAclStorage.deleteUserTableHdfsAcl(ctx.getEnvironment().getConnection(),
          tableUsers, tableName);
      }
    }
  }
Provider for mapping principal names to Users
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java