@Test
  public void testVerifyAccessDeniedForInvalidUserAuths() throws Exception {
    PrivilegedExceptionAction<VisibilityLabelsResponse> action =
      new PrivilegedExceptionAction<VisibilityLabelsResponse>() {
        @Override
        public VisibilityLabelsResponse run() throws Exception {
          try (Connection conn = ConnectionFactory.createConnection(conf)) {
            return VisibilityClient.setAuths(conn, new String[] { TOPSECRET }, USER.getShortName());
          } catch (Throwable e) {
          }
          return null;
        }
      };
    SUPERUSER.runAs(action);
    final TableName tableName = TableName.valueOf(TEST_NAME.getMethodName());
    Admin hBaseAdmin = TEST_UTIL.getAdmin();
    TableDescriptor tableDescriptor = TableDescriptorBuilder.newBuilder(tableName)
      .setColumnFamily(ColumnFamilyDescriptorBuilder.newBuilder(fam).setMaxVersions(5).build())
      .build();
    hBaseAdmin.createTable(tableDescriptor);
    try {
      TEST_UTIL.getAdmin().flush(tableName);
      PrivilegedExceptionAction<Void> actiona = new PrivilegedExceptionAction<Void>() {
        @Override
        public Void run() throws Exception {
          try (Connection connection = ConnectionFactory.createConnection(conf);
            Table table = connection.getTable(tableName)) {
            Put p = new Put(row1);
            p.setCellVisibility(new CellVisibility(PUBLIC + "&" + TOPSECRET));
            p.addColumn(fam, qual, 125L, value);
            table.put(p);
            Assert.fail("Testcase should fail with AccesDeniedException");
          } catch (Throwable t) {
            assertTrue(t.getMessage().contains("AccessDeniedException"));
          }
          return null;
        }
      };
      USER.runAs(actiona);
    } catch (Exception e) {
      throw new IOException(e);
    }
  }
Test visibility by setting 'hbase.security.visibility.mutations.checkauths' to true
hbase-server/src/test/java/org/apache/hadoop/hbase/security/visibility/TestVisibilityWithCheckAuths.java