public String translatePrincipalName(String principalName) {
    if (StringUtils.isNotEmpty(principalName) && principalName.contains("@")) {
      try {
        // Since KerberosName relies on a static variable to hold on to the auth-to-local rules,
        // attempt to protect access to the rule set by blocking other threads from changing the
        // rules out from under us during this operation.
        synchronized (KerberosName.class) {
          KerberosName.setRules(authToLocalRules);
          return new KerberosName(principalName).getShortName();
        }
      } catch (UserNotFoundException e) {
        throw new UsernameNotFoundException(e.getMessage(), e);
      } catch (IOException e) {
        String message = String.format("Failed to translate %s to a local username during Kerberos authentication: %s", principalName, e.getLocalizedMessage());
        LOG.warn(message);
        throw new UsernameNotFoundException(message, e);
      }
    } else {
      return principalName;
    }
  }
Using the auth-to-local rules stored in <code>authentication.kerberos.auth_to_local.rules</code>
in the <code>ambari.properties</code> file, translate the supplied principal name to a local name.

@param principalName the principal name to translate
@return a local username
ambari-server/src/main/java/org/apache/ambari/server/security/authentication/kerberos/AmbariAuthToLocalUserDetailsService.java