diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/AdminService.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/AdminService.java
index 9dda57e2d22..bcf7309f883 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/AdminService.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/AdminService.java
@@ -572,6 +572,15 @@ private synchronized void refreshServiceAcls(Configuration configuration,
 
   @Override
   public String[] getGroupsForUser(String user) throws IOException {
+    String operation = "getGroupsForUser";
+    UserGroupInformation ugi;
+    try {
+      ugi = checkAcls(operation);
+    } catch (YarnException e) {
+      // The interface is from hadoop-common which does not accept YarnException
+      throw new IOException(e);
+    }
+    checkRMStatus(ugi.getShortUserName(), operation, "get groups for user");
     return UserGroupInformation.createRemoteUser(user).getGroupNames();
   }