protected void validateAuthorizationToUpdateServiceUsersAndGroups(Cluster cluster,
                                                                    String configType,
                                                                    Map<String, String[]> propertyChanges)
      throws AuthorizationException {

    if ((propertyChanges != null) && !propertyChanges.isEmpty()) {
      // If the authenticated user is not authorized to set service users or groups, make sure the
      // relevant properties are not changed. However, if the user is authorized to set service
      // users and groups, there is nothing to check.
      if (!AuthorizationHelper.isAuthorized(ResourceType.CLUSTER, cluster.getResourceId(),
          RoleAuthorization.SERVICE_SET_SERVICE_USERS_GROUPS)) {

        Map<PropertyInfo.PropertyType, Set<String>> propertyTypes = cluster.getConfigPropertiesTypes(configType);

        //  Create a composite set of properties to check...
        Set<String> propertiesToCheck = new HashSet<>();

        Set<String> userProperties = propertyTypes.get(PropertyType.USER);
        if (userProperties != null) {
          propertiesToCheck.addAll(userProperties);
        }

        Set<String> groupProperties = propertyTypes.get(PropertyType.GROUP);
        if (groupProperties != null) {
          propertiesToCheck.addAll(groupProperties);
        }

        // If there are no USER or GROUP type properties, skip the validation check...
        for (String propertyName : propertiesToCheck) {
          String[] values = propertyChanges.get(propertyName);
          if (values != null) {
            String existingValue = values[0];
            String requestedValue = values[1];

            // If the properties don't match, so thrown an authorization exception
            if ((existingValue == null) ? (requestedValue != null) : !existingValue.equals(requestedValue)) {
              throw new AuthorizationException("The authenticated user is not authorized to set service user and groups");
            }
          }
        }
      }
    }
  }
Validates that the authenticated user can set a service's (run-as) user and group.
<p/>
If the user is authorized to set service users and groups, than this method exits quickly.
If the user is not authorized to set service users and groups, then this method verifies that
the properties of types USER and GROUP have not been changed. If they have been, an
AuthorizationException is thrown.

@param cluster         the relevant cluster
@param configType      the changed configuration type
@param propertyChanges a map of the property changes for the relevant configuration type
@throws AuthorizationException if the user is not authorized to perform this operation
ambari-server/src/main/java/org/apache/ambari/server/controller/AmbariManagementControllerImpl.java