@Override
  public void postCompletedDeleteTableAction(ObserverContext<MasterCoprocessorEnvironment> ctx,
    TableName tableName) throws IOException {
    if (!tableName.isSystemTable() && checkInitialized("deleteTable " + tableName)) {
      /*
       * Remove table user access HDFS acl from namespace directory if the user has no permissions
       * of global, ns of the table or other tables of the ns, eg: Bob has 'ns1:t1' read permission,
       * when delete 'ns1:t1', if Bob has global read permission, '@ns1' read permission or
       * 'ns1:other_tables' read permission, then skip remove Bob access acl in ns1Dirs, otherwise,
       * remove Bob access acl.
       */
      try (Table aclTable =
        ctx.getEnvironment().getConnection().getTable(PermissionStorage.ACL_TABLE_NAME)) {
        Set<String> users = SnapshotScannerHDFSAclStorage.getTableUsers(aclTable, tableName);
        if (users.size() > 0) {
          // 1. Remove table archive directory default ACLs
          hdfsAclHelper.removeTableDefaultAcl(tableName, users);
          // 2. Delete table owner permission is synced to HDFS in acl table
          SnapshotScannerHDFSAclStorage.deleteTableHdfsAcl(aclTable, tableName);
          // 3. Remove namespace access acls
          Set<String> removeUsers = filterUsersToRemoveNsAccessAcl(aclTable, tableName, users);
          if (removeUsers.size() > 0) {
            hdfsAclHelper.removeNamespaceAccessAcl(tableName, removeUsers, "delete");
          }
        }
      }
    }
  }
Provider for mapping principal names to Users
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/SnapshotScannerHDFSAclController.java