private void validateAuthorizationToModifyConfigurations(Cluster cluster, String configType,
                                                           Map<String, String[]> propertyChanges,
                                                           Map<String, Set<String>> changesToIgnore,
                                                           boolean isServiceConfiguration)
      throws AuthorizationException {
    // If the authenticated user is authorized to update cluster-wide/service-level configurations
    // there is nothing to check, else ensure no (relevant) configurations are being changed - ignoring
    // the specified configurations which may fall under a special category.
    // For example cluster-env/recovery_enabled requires a special permission - CLUSTER.MANAGE_AUTO_START
    if ((propertyChanges != null) && !propertyChanges.isEmpty()) {
      boolean isAuthorized = (isServiceConfiguration)
          ? AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, cluster.getResourceId(), RoleAuthorization.SERVICE_MODIFY_CONFIGS)
          : AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, cluster.getResourceId(), RoleAuthorization.CLUSTER_MODIFY_CONFIGS);

      if (!isAuthorized && changesToIgnore != null) {
        Set<String> relevantChangesToIgnore = changesToIgnore.get(configType);
        Map<String, String[]> relevantPropertyChanges;

        // If necessary remove any non-relevant property changes.
        if (relevantChangesToIgnore == null) {
          relevantPropertyChanges = propertyChanges;
        } else {
          relevantPropertyChanges = new HashMap<>(propertyChanges);

          for (String propertyName : relevantChangesToIgnore) {
            relevantPropertyChanges.remove(propertyName);
          }
        }

        // If relevant configuration changes have been made, then the user is not authorized to
        // perform the requested operation and an AuthorizationException must be thrown
        if (relevantPropertyChanges.size() == 0) {
          return;
        }
      }
      if (!isAuthorized) {
        throw new AuthorizationException(String.format("The authenticated user does not have authorization to modify %s configurations",
          (isServiceConfiguration) ? "service" : "cluster"));
      }
    }
  }
Validates that the authenticated user can modify configurations for either a service or the
cluster.
<p>
Since some properties have special meaning, they may be ignored when perfoming this authorization
check. For example, to change the cluster's overall auto-start setting (cluster-env/recovery_enabled)
requires a specific permission that is not the same as the ability to set cluster-wide properties
(in general).  Because of this, the <code>cluster-env/recovery_enabled</code> propery should be
ignored in this check since permission to change it is expected to be validated elsewhere.

@param cluster                the relevant cluster
@param configType             the changed configuration type
@param propertyChanges        a map of the property changes for the relevant configuration type
@param changesToIgnore        a map of configuration type names to sets of propery names to be ignored
@param isServiceConfiguration <code>true</code>, if the configuration type is a service-level configuration;
                              <code>false</code>, if the configuration type is a cluster-level configuration
@throws AuthorizationException if the authenticated user is not authorized to change the requested configuration
ambari-server/src/main/java/org/apache/ambari/server/controller/AmbariManagementControllerImpl.java