@Test
  public void testPassiveGrantRevoke() throws Exception {

    // Add a test user

    User tblUser =
      User.createUserForTesting(TEST_UTIL.getConfiguration(), "tbluser", new String[0]);

    // If we check now, the test user have permissions because authorization is disabled

    AccessTestAction checkTableRead = new AccessTestAction() {
      @Override
      public Void run() throws Exception {
        checkTablePerms(TEST_UTIL, testTable.getTableName(), TEST_FAMILY, null,
          Permission.Action.READ);
        return null;
      }
    };

    verifyAllowed(tblUser, checkTableRead);

    // An actual read won't be denied

    AccessTestAction tableRead = new AccessTestAction() {
      @Override
      public Void run() throws Exception {
        try (Connection conn = ConnectionFactory.createConnection(TEST_UTIL.getConfiguration());
          Table t = conn.getTable(testTable.getTableName())) {
          t.get(new Get(TEST_ROW).addFamily(TEST_FAMILY));
        }
        return null;
      }
    };

    verifyAllowed(tblUser, tableRead);

    // Grant read perms to the test user

    grantOnTable(TEST_UTIL, tblUser.getShortName(), testTable.getTableName(), TEST_FAMILY, null,
      Permission.Action.READ);

    // Now both the permission check and actual op will succeed

    verifyAllowed(tblUser, checkTableRead);
    verifyAllowed(tblUser, tableRead);

    // Revoke read perms from the test user

    revokeFromTable(TEST_UTIL, tblUser.getShortName(), testTable.getTableName(), TEST_FAMILY, null,
      Permission.Action.READ);

    // Now the permission check will indicate revocation but the actual op will still succeed

    verifyAllowed(tblUser, checkTableRead);
    verifyAllowed(tblUser, tableRead);
  }
Test grants and revocations with authorization disabled
hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestWithDisabledAuthorization.java