public void addFinalizeOperationStage(Cluster cluster, String clusterHostInfoJson,
                                          String hostParamsJson, ServiceComponentHostServerActionEvent event,
                                          File dataDirectory, RoleCommandOrder roleCommandOrder,
                                          RequestStageContainer requestStageContainer,
                                          KerberosDetails kerberosDetails)
      throws AmbariException {

      // Add the finalize stage...
      Map<String, String> commandParameters = new HashMap<>();
      commandParameters.put(KerberosServerAction.DEFAULT_REALM, kerberosDetails.getDefaultRealm());
      commandParameters.put(KerberosServerAction.KDC_TYPE, kerberosDetails.getKdcType().name());
      commandParameters.put(KerberosServerAction.AUTHENTICATED_USER_NAME, ambariManagementController.getAuthName());
      if (dataDirectory != null) {
        commandParameters.put(KerberosServerAction.DATA_DIRECTORY, dataDirectory.getAbsolutePath());
      }
      int timeout = configuration.getKerberosServerActionFinalizeTimeout();
      Stage stage = createServerActionStage(requestStageContainer.getLastStageId(),
        cluster,
        requestStageContainer.getId(),
        "Finalize Operations",
        "{}",
        hostParamsJson,
        FinalizeKerberosServerAction.class,
        event,
        commandParameters,
        "Finalize Operations", timeout);

      RoleGraph roleGraph = roleGraphFactory.createNew(roleCommandOrder);
      roleGraph.build(stage);

      requestStageContainer.addStages(roleGraph.getStages());
    }
Send a custom command to the KERBEROS_CLIENT to check if there are missing keytabs on each hosts.
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java