diff --git a/hbase-common/src/main/java/org/apache/hadoop/hbase/security/User.java b/hbase-common/src/main/java/org/apache/hadoop/hbase/security/User.java
index e2cac4b6b567..22a79adb95f2 100644
--- a/hbase-common/src/main/java/org/apache/hadoop/hbase/security/User.java
+++ b/hbase-common/src/main/java/org/apache/hadoop/hbase/security/User.java
@@ -270,20 +270,28 @@ public static boolean shouldLoginFromKeytab(Configuration conf) {
   public static final class SecureHadoopUser extends User {
     private String shortName;
     private LoadingCache<String, String[]> cache;
+    /**
+     * Cache value of this instance's {@link #toString()} value. Computing this value is expensive.
+     * Assumes the UGI is never updated. See HBASE-27708.
+     */
+    private final String toString;
 
     public SecureHadoopUser() throws IOException {
       ugi = UserGroupInformation.getCurrentUser();
       this.cache = null;
+      this.toString = ugi.toString();
     }
 
     public SecureHadoopUser(UserGroupInformation ugi) {
       this.ugi = ugi;
       this.cache = null;
+      this.toString = ugi.toString();
     }
 
     public SecureHadoopUser(UserGroupInformation ugi, LoadingCache<String, String[]> cache) {
       this.ugi = ugi;
       this.cache = cache;
+      this.toString = ugi.toString();
     }
 
     @Override
@@ -320,6 +328,11 @@ public <T> T runAs(PrivilegedExceptionAction<T> action)
       return ugi.doAs(action);
     }
 
+    @Override
+    public String toString() {
+      return toString;
+    }
+
     /**
      * Create a user for testing.
      * @see User#createUserForTesting(org.apache.hadoop.conf.Configuration, String, String[])