private Map<String, Set<String>> getIdentityProperties(AbstractKerberosDescriptorContainer container, Map<String, Set<String>> identityProperties) {
    if (container != null) {
      if (identityProperties == null) {
        identityProperties = new HashMap<>();
      }

      // Process the Kerberos identities - principal and keytab file properties.
      List<KerberosIdentityDescriptor> identityDescriptors;
      try {
        // There is no need to resolve references since we just need to get the set of configurations that can be changed.
        identityDescriptors = container.getIdentities(false, null);
      } catch (AmbariException e) {
        LOG.error("An exception occurred getting the Kerberos identity descriptors.  No configurations will be identified.", e);
        identityDescriptors = null;
      }

      if (identityDescriptors != null) {
        Map<String, Map<String, String>> identityConfigurations = kerberosHelper.getIdentityConfigurations(identityDescriptors);

        if (identityConfigurations != null) {
          for (Map.Entry<String, Map<String, String>> entry : identityConfigurations.entrySet()) {
            Map<String, String> properties = entry.getValue();
            if (properties != null) {
              Set<String> configProperties = identityProperties.computeIfAbsent(entry.getKey(), k -> new HashSet<>());
              configProperties.addAll(properties.keySet());
            }
          }
        }
      }

      // Process any auth-to-local rule properties
      Map<String, Set<String>> authToLocalProperties = kerberosHelper.translateConfigurationSpecifications(container.getAuthToLocalProperties());
      if (authToLocalProperties != null) {
        for (Map.Entry<String, Set<String>> entry : authToLocalProperties.entrySet()) {
          String configType = entry.getKey();
          Set<String> propertyNames = entry.getValue();

          if (propertyNames != null) {
            Set<String> configProperties = identityProperties.computeIfAbsent(configType, k -> new HashSet<>());
            configProperties.addAll(propertyNames);
          }
        }
      }

      // Process the children...
      Collection<? extends AbstractKerberosDescriptorContainer> childContainers = container.getChildContainers();
      if (childContainers != null) {
        for (AbstractKerberosDescriptorContainer childContainer : childContainers) {
          getIdentityProperties(childContainer, identityProperties);
        }
      }
    }

    return identityProperties;
  }
Recursively processes a Kerberos descriptor container and it children to find the
Kerberos identity-related properties.
<p>
Kerberos identity-related properties are those that contain the following information:
<ul>
<li>principal names</li>
<li>keytab file paths</li>
<li>auth-to-local rules</li>
</ul>

@param container          the AbstractKerberosDescriptorContainer to process
@param identityProperties a map of config-types to sets of property names to append data
@return a map of config-types to sets of property names
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/AbstractPrepareKerberosServerAction.java