public static boolean hasAdministratorAccess(Configuration conf, AccessControlList acl,
    HttpServletRequest request, HttpServletResponse response) throws IOException {
    // If there is no authorization, anybody has administrator access.
    if (!conf.getBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false)) {
      return true;
    }

    String remoteUser = request.getRemoteUser();
    if (remoteUser == null) {
      response.sendError(HttpServletResponse.SC_UNAUTHORIZED,
        "Unauthenticated users are not " + "authorized to access this page.");
      return false;
    }

    if (acl != null && !userHasAdministratorAccess(acl, remoteUser)) {
      response.sendError(HttpServletResponse.SC_FORBIDDEN,
        "User " + remoteUser + " is unauthorized to access this page.");
      return false;
    }

    return true;
  }
Does the user sending the HttpServletRequest has the administrator ACLs? If it isn't the case,
response will be modified to send an error to the user.
@param servletContext the {@link ServletContext} to use
@param request        the {@link HttpServletRequest} to check
@param response       used to send the error response if user does not have admin access.
@return true if admin-authorized, false otherwise
@throws IOException if an unauthenticated or unauthorized user tries to access the page
hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java