@Test
  public void testHBaseRootZNodeACL() throws Exception {
    if (!secureZKAvailable) {
      return;
    }

    List<ACL> acls = zkw.getRecoverableZooKeeper().getZooKeeper().getACL("/hbase", new Stat());
    assertEquals(1, acls.size());
    assertEquals("sasl", acls.get(0).getId().getScheme());
    assertEquals("hbase", acls.get(0).getId().getId());
    assertEquals(ZooDefs.Perms.ALL, acls.get(0).getPerms());
  }
Create a node and check its ACL. When authentication is enabled on ZooKeeper, all nodes (except
/hbase/root-region-server, /hbase/master and /hbase/hbaseid) should be created so that only the
hbase server user (master or region server user) that created them can access them, and this
user should have all permissions on this node. For /hbase/root-region-server, /hbase/master,
and /hbase/hbaseid the permissions should be as above, but should also be world-readable. First
we check the general case of /hbase nodes in the following test, and then check the subset of
world-readable nodes in the three tests after that.
hbase-server/src/test/java/org/apache/hadoop/hbase/zookeeper/TestZooKeeperACL.java