Publisher_acl configuration not work

Description of Issue

when i try to use publisher_acl to control what the minion can run modules, i failed, it can not work. only the publisher_acl_blacklist configuration working.

I find the source code and then i got it:

 def publish(self, clear_load):
        '''
        This method sends out publications to the minions, it can only be used
        by the LocalClient.
        '''
        extra = clear_load.get('kwargs', {})

        publisher_acl = salt.acl.PublisherACL(self.opts['publisher_acl_blacklist'])

        if publisher_acl.user_is_blacklisted(clear_load['user']) or \
                publisher_acl.cmd_is_blacklisted(clear_load['fun']):
            log.error(
                '%s does not have permissions to run %s. Please contact '
                'your local administrator if you believe this is in '
                'error.\n', clear_load['user'], clear_load['fun']
            )
            return {'error': {'name': 'AuthorizationError',
                              'message': 'Authorization error occurred.'}}

        # Retrieve the minions list
        delimiter = clear_load.get('kwargs', {}).get('delimiter', DEFAULT_TARGET_DELIM)

and

class PublisherACL(object):
    '''
    Represents the publisher ACL and provides methods
    to query the ACL for given operations
    '''
    def __init__(self, blacklist):
        self.blacklist = blacklist

    def user_is_blacklisted(self, user):
        '''
        Takes a username as a string and returns a boolean. True indicates that
        the provided user has been blacklisted
        '''
        return not salt.utils.stringutils.check_whitelist_blacklist(user, blacklist=self.blacklist.get('users', []))

    def cmd_is_blacklisted(self, cmd):
        # If this is a regular command, it is a single function
        if isinstance(cmd, six.string_types):
            cmd = [cmd]
        for fun in cmd:
            if not salt.utils.stringutils.check_whitelist_blacklist(fun, blacklist=self.blacklist.get('modules', [])):
                return True
        return False

    def user_is_whitelisted(self, user):
        return salt.utils.stringutils.check_whitelist_blacklist(user, whitelist=self.blacklist.get('users', []))

    def cmd_is_whitelisted(self, cmd):
        # If this is a regular command, it is a single function
        if isinstance(cmd, str):
            cmd = [cmd]
        for fun in cmd:
            if salt.utils.stringutils.check_whitelist_blacklist(fun, whitelist=self.blacklist.get('modules', [])):
                return True
        return False

the publisher_acl never be used.

Versions Report

Salt Version:
           Salt: 2018.3.4

Dependency Versions:
           cffi: 1.12.2
       cherrypy: unknown
       dateutil: Not Installed
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.10
        libgit2: 0.26.6
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: 2.17
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: 0.26.3
         Python: 3.7.3 (default, Mar 27 2019, 22:11:17)
   python-gnupg: Not Installed
         PyYAML: 5.1
          PyZMQ: 18.0.1
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.1

System Versions:
           dist: centos 7.5.1804 Core
         locale: UTF-8
        machine: x86_64
        release: 3.10.0-862.el7.x86_64
         system: Linux
        version: CentOS Linux 7.5.1804 Core

Start by locating the publish method and PublisherACL class shown in the issue, then trace how publisher_acl_blacklist is loaded and used. Compare that path with the publisher_acl configuration and confirm that allowed and denied users or modules behave as documented; add or update regression coverage if the surrounding tests identify a suitable location.