@Override
  public List<String> getLabels(User user, Authorizations authorizations) {
    if (authorizations != null) {
      List<String> labels = authorizations.getLabels();
      String userName = user.getShortName();
      Set<String> auths = new HashSet<>();
      auths.addAll(this.labelsCache.getUserAuths(userName));
      auths.addAll(this.labelsCache.getGroupAuths(user.getGroupNames()));
      return dropLabelsNotInUserAuths(labels, new ArrayList<>(auths), userName);
    }
    return null;
  }
This is an implementation for ScanLabelGenerator. It will extract labels from passed in
authorizations and cross check against the set of predefined authorization labels for given user.
The labels for which the user is not authorized will be dropped.
hbase-server/src/main/java/org/apache/hadoop/hbase/security/visibility/DefinedSetFilterScanLabelGenerator.java