@Test
  public void testHBaseMasterServerZNodeACL() throws Exception {
    if (!secureZKAvailable) {
      return;
    }

    List<ACL> acls =
      zkw.getRecoverableZooKeeper().getZooKeeper().getACL("/hbase/master", new Stat());
    assertEquals(2, acls.size());

    boolean foundWorldReadableAcl = false;
    boolean foundHBaseOwnerAcl = false;
    for (int i = 0; i < 2; i++) {
      if (acls.get(i).getId().getScheme().equals("world") == true) {
        assertEquals("anyone", acls.get(0).getId().getId());
        assertEquals(ZooDefs.Perms.READ, acls.get(0).getPerms());
        foundWorldReadableAcl = true;
      } else {
        if (acls.get(i).getId().getScheme().equals("sasl") == true) {
          assertEquals("hbase", acls.get(1).getId().getId());
          assertEquals("sasl", acls.get(1).getId().getScheme());
          foundHBaseOwnerAcl = true;
        } else { // error: should not get here: test fails.
          assertTrue(false);
        }
      }
    }
    assertTrue(foundWorldReadableAcl);
    assertTrue(foundHBaseOwnerAcl);
  }
When authentication is enabled on ZooKeeper, /hbase/master should be created with 2 ACLs: one
specifies that the hbase user has full access to the node; the other, that it is
world-readable.
hbase-server/src/test/java/org/apache/hadoop/hbase/zookeeper/TestZooKeeperACL.java