public static boolean canUserModifyUI(HttpServletRequest req, ServletContext ctx,
    Configuration conf) {
    if (conf.getBoolean("hbase.master.ui.readonly", false)) {
      return false;
    }
    String remoteUser = req.getRemoteUser();
    if (
      "kerberos".equalsIgnoreCase(conf.get(HttpServer.HTTP_UI_AUTHENTICATION))
        && conf.getBoolean(CommonConfigurationKeys.HADOOP_SECURITY_AUTHORIZATION, false)
        && remoteUser != null
    ) {
      return HttpServer.userHasAdministratorAccess(ctx, remoteUser);
    }
    return false;
  }
Returns true if and only if UI authentication (spnego) is enabled, UI authorization is enabled,
and the requesting user is defined as an administrator. If the UI is set to readonly, this
method always returns false.
hbase-http/src/main/java/org/apache/hadoop/hbase/http/InfoServer.java