public Keytab createKeytab(String principal, KerberosPrincipalEntity principalEntity, String password,
                             Integer keyNumber, KerberosOperationHandler operationHandler, boolean checkCache,
                             boolean canCache, ActionLog actionLog) throws AmbariException {

    LOG.debug("Creating keytab for {} with kvno {}", principal, keyNumber);
    Keytab keytab = null;

    // Possibly get the keytab from the cache
    if (checkCache) {
      // Attempt to pull the keytab from the cache...
      String cachedKeytabPath = (principalEntity == null) ? null : principalEntity.getCachedKeytabPath();

      if (cachedKeytabPath != null) {
        try {
          keytab = Keytab.read(new File(cachedKeytabPath));
        } catch (IOException e) {
          LOG.warn("Failed to read the cached keytab for {}, recreating if possible - {}", principal, e.getMessage());
        }
      }
    }

    // If the keytab was not retrieved from the cache... create it.
    if (keytab == null) {
      try {
        keytab = operationHandler.createKeytab(principal, password, keyNumber);

        // If the current identity does not represent a service, copy it to a secure location
        // and store that location so it can be reused rather than recreate it.
        if (principalEntity != null) {
          if (canCache) {
            File cachedKeytabFile = cacheKeytab(principal, keytab);
            String previousCachedFilePath = principalEntity.getCachedKeytabPath();
            String cachedKeytabFilePath = (cachedKeytabFile.exists()) ? cachedKeytabFile.getAbsolutePath() : null;

            if (previousCachedFilePath == null || !previousCachedFilePath.equals(cachedKeytabFilePath)) {
              principalEntity.setCachedKeytabPath(cachedKeytabFilePath);
              kerberosPrincipalDAO.merge(principalEntity);
            }

            if (previousCachedFilePath != null) {
              if (!new File(previousCachedFilePath).delete()) {
                LOG.debug("Failed to remove orphaned cache file {}", previousCachedFilePath);
              }
            }
          }
        }
      } catch (KerberosOperationException e) {
        String message = String.format("Failed to create keytab file for %s - %s", principal, e.getMessage());
        if (actionLog != null) {
          actionLog.writeStdErr(message);
        }
        LOG.error(message, e);
      }
    }

    return keytab;
  }
Creates the keytab or gets one from the cache for a principal.

@param principal        the principal name for the Keytab to create
@param password         the password for the Keytab to create
@param keyNumber        the key number for the Keytab to create
@param operationHandler the KerberosOperationHandler for the relevant KDC
@param checkCache       true to check the cache for an existing Keytab; otherwise false
@param canCache         true to cache the resulting keytab (if generated); otherwise false
@param actionLog        the logger (may be null if no logging is desired)
@return a Keytab
@throws AmbariException
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/CreateKeytabFilesServerAction.java