public void performOnSuperuser(String request, User caller, String userToBeChecked)
    throws IOException {
    List<String> userGroups = new ArrayList<>();
    userGroups.add(userToBeChecked);
    if (!AuthUtil.isGroupPrincipal(userToBeChecked)) {
      for (String group : getUserGroups(userToBeChecked)) {
        userGroups.add(AuthUtil.toGroupEntry(group));
      }
    }
    for (String name : userGroups) {
      if (Superusers.isSuperUser(name)) {
        AuthResult result = AuthResult.deny(request,
          "Granting or revoking superusers's or supergroups's permissions is not allowed", caller,
          Action.ADMIN, NamespaceDescriptor.SYSTEM_NAMESPACE_NAME_STR);
        logResult(result);
        throw new AccessDeniedException(result.getReason());
      }
    }
  }
Check if caller is granting or revoking superusers's or supergroups's permissions.
@param request         request name
@param caller          caller
@param userToBeChecked target user or group
@throws IOException AccessDeniedException if target user is superuser
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessChecker.java