Sounds like a pretty comprehensive test plan to me.
I see that impersonation tests cover the Oozie case scenarios. Did you test DistCp with hftp and without? I believe the WebUI cases should cover that, but worth asking. Please comment if you did try it.
The benchmarks look really good. I remember seeing similar numbers when security was first tested in then 0.20 branch.
Good job fixing findbugs. I agree the remaining few are just the specific use cases.
I am +1 on the changes overall and will be glad to start committing soon if there are no objections.