We currently have large holes in the test coverage of HBase with security enabled. Two recent examples of bugs which really should have been caught with testing are
HBASE-7771 and HBASE-7772. The long standing problem with testing with security enabled has been the requirement for supporting kerberos infrastructure.
We need to close this gap and provide some automated testing with security enabled, if necessary standing up and provisioning a temporary KDC as an option for running integration tests, see
HADOOP-8078 and HADOOP-9004 where a similar approach was taken.