private void validateKDCCredentials(KerberosDetails kerberosDetails, Cluster cluster) throws KerberosMissingAdminCredentialsException,
    KerberosAdminAuthenticationException,
    KerberosInvalidConfigurationException,
    AmbariException {

    if (kerberosDetails == null) {
      kerberosDetails = getKerberosDetails(cluster, null);
    }

    if (kerberosDetails.manageIdentities()) {
      PrincipalKeyCredential credentials = getKDCAdministratorCredentials(cluster.getClusterName());
      if (credentials == null) {
        throw new KerberosMissingAdminCredentialsException();
      } else {
        KerberosOperationHandler operationHandler = kerberosOperationHandlerFactory.getKerberosOperationHandler(kerberosDetails.getKdcType());

        if (operationHandler == null) {
          throw new AmbariException("Failed to get an appropriate Kerberos operation handler.");
        } else {
          boolean missingCredentials = false;
          try {
            operationHandler.open(credentials, kerberosDetails.getDefaultRealm(), kerberosDetails.getKerberosEnvProperties());
            // todo: this is really odd that open doesn't throw an exception if the credentials are missing
            missingCredentials = !operationHandler.testAdministratorCredentials();
          } catch (KerberosAdminAuthenticationException e) {
            throw new KerberosAdminAuthenticationException(
              "Invalid KDC administrator credentials.\n" +
                "The KDC administrator credentials must be set as a persisted or temporary credential resource." +
                "This may be done by issuing a POST (or PUT for updating) to the /api/v1/clusters/:clusterName/credentials/kdc.admin.credential API entry point with the following payload:\n" +
                "{\n" +
                "  \"Credential\" : {\n" +
                "    \"principal\" : \"(PRINCIPAL)\", \"key\" : \"(PASSWORD)\", \"type\" : \"(persisted|temporary)\"}\n" +
                "  }\n" +
                "}", e);
          } catch (KerberosKDCConnectionException e) {
            throw new KerberosInvalidConfigurationException(
              "Failed to connect to KDC - " + e.getMessage() + "\n" +
                "Update the KDC settings in krb5-conf and kerberos-env configurations to correct this issue.",
              e);
          } catch (KerberosKDCSSLConnectionException e) {
            throw new KerberosInvalidConfigurationException(
              "Failed to connect to KDC - " + e.getMessage() + "\n" +
                "Make sure the server's SSL certificate or CA certificates have been imported into Ambari's truststore.",
              e);
          } catch (KerberosRealmException e) {
            throw new KerberosInvalidConfigurationException(
              "Failed to find a KDC for the specified realm - " + e.getMessage() + "\n" +
                "Update the KDC settings in krb5-conf and kerberos-env configurations to correct this issue.",
              e);
          } catch (KerberosLDAPContainerException e) {
            throw new KerberosInvalidConfigurationException(
              "The principal container was not specified\n" +
                "Set the 'container_dn' value in the kerberos-env configuration to correct this issue.",
              e);
          } catch (KerberosOperationException e) {
            throw new AmbariException(e.getMessage(), e);
          } finally {
            try {
              operationHandler.close();
            } catch (KerberosOperationException e) {
              // Ignore this...
            }
          }

          // need to throw this outside of the try/catch so it isn't caught
          if (missingCredentials) {
            throw new KerberosMissingAdminCredentialsException();
          }
        }
      }
    }
  }
Validate the KDC admin credentials.

@param kerberosDetails the KerberosDetails containing information about the Kerberos configuration
                       for the cluster, if null, a new KerberosDetails will be created based on
                       information found in the associated cluster
@param cluster         associated cluster
@throws AmbariException if any other error occurs while trying to validate the credentials
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java