@VisibleForTesting
  void validateSecurity() {
    request.getSecurity().ifPresent(requestSecurity -> {
      CHECK.checkArgument(!strictValidation() || requestSecurity.getType() == cluster.getSecurityType(),
        "Security type in the request (%s), if specified, should match cluster's security type (%s)",
        requestSecurity.getType(), cluster.getSecurityType()
      );

      boolean hasDescriptor = requestSecurity.getDescriptor().isPresent();
      boolean hasDescriptorReference = requestSecurity.getDescriptorReference() != null;
      boolean secureCluster = cluster.getSecurityType() == SecurityType.KERBEROS;

      CHECK.checkArgument(secureCluster || !hasDescriptor,
        "Kerberos descriptor cannot be set for security type %s", cluster.getSecurityType());
      CHECK.checkArgument(secureCluster || !hasDescriptorReference,
        "Kerberos descriptor reference cannot be set for security type %s", cluster.getSecurityType());
      CHECK.checkArgument(!hasDescriptor || !hasDescriptorReference,
        "Kerberos descriptor and reference cannot be both set");

      Optional<Map<?,?>> kerberosDescriptor = hasDescriptor
        ? requestSecurity.getDescriptor()
        : hasDescriptorReference
          ? loadKerberosDescriptor(requestSecurity.getDescriptorReference())
          : Optional.empty();

      kerberosDescriptor.ifPresent(descriptorMap -> {
        CHECK.checkState(state.getNewServices() != null,
          "Services need to be validated before security settings");

        KerberosDescriptor descriptor = kerberosDescriptorFactory.createInstance(descriptorMap);

        if (strictValidation()) {
          Map<String, KerberosServiceDescriptor> descriptorServices = descriptor.getServices();
          Set<String> servicesWithNewDescriptor = descriptorServices != null ? descriptorServices.keySet() : ImmutableSet.of();
          Set<String> newServices = state.getNewServices().keySet();
          Set<String> nonNewServices = ImmutableSet.copyOf(Sets.difference(servicesWithNewDescriptor, newServices));

          CHECK.checkArgument(nonNewServices.isEmpty(),
            "Kerberos descriptor should be provided only for new services, but found other services: %s",
            nonNewServices
          );
        }

        try {
          descriptor.toMap();
        } catch (Exception e) {
          CHECK.wrapInUnchecked(e, IllegalArgumentException::new, "Error validating Kerberos descriptor: %s", e);
        }

        state = state.with(descriptor);
      });
    });
  }
Create an {@link AddServiceInfo} based on the validated request.
ambari-server/src/main/java/org/apache/ambari/server/topology/addservice/RequestValidator.java