private void installAmbariIdentities(KerberosDescriptor kerberosDescriptor,
                                       KerberosOperationHandler kerberosOperationHandler,
                                       Map<String, String> kerberosEnvProperties,
                                       Map<String, Map<String, String>> configurations,
                                       KerberosDetails kerberosDetails) throws AmbariException {

    // Install Ambari's identities.....
    List<KerberosIdentityDescriptor> ambariIdentities = getAmbariServerIdentities(kerberosDescriptor);

    if (!ambariIdentities.isEmpty()) {
      String ambariServerHostname = StageUtils.getHostName();

      for (KerberosIdentityDescriptor identity : ambariIdentities) {
        if (identity != null) {
          KerberosPrincipalDescriptor principal = identity.getPrincipalDescriptor();
          if (principal != null) {
            boolean updateJAASFile = AMBARI_SERVER_KERBEROS_IDENTITY_NAME.equals(identity.getName());
            Keytab keytab = createIdentity(identity, principal.getType(), kerberosEnvProperties, kerberosOperationHandler, configurations, ambariServerHostname);
            installAmbariIdentity(identity, keytab, configurations, ambariServerHostname, kerberosDetails, updateJAASFile);

            if (updateJAASFile) {
              try {
                KerberosChecker.checkJaasConfiguration();
              } catch (AmbariException e) {
                LOG.error("Error in Ambari JAAS configuration: " + e.getLocalizedMessage(), e);
              }
            }
          }
        }
      }
    }
  }
Install identities needed by the Ambari server, itself.
<p>
The Ambari server needs its own identity for authentication; and, if Kerberos authentication is
enabled, it needs a SPNEGO principal for ticket validation routines.
<p>
Any identities needed by the Ambari server need to be installed separately since an agent may not
exist on the host and therefore distributing the keytab file(s) to the Ambari server host may
not be possible using the same workflow used for other hosts in the cluster.

@param kerberosDescriptor       the Kerberos descriptor
@param kerberosOperationHandler the relevant KerberosOperationHandler
@param kerberosEnvProperties    the kerberos-env properties
@param configurations           a map of config-types to property name/value pairs representing
                                the existing configurations for the cluster
@param kerberosDetails          a KerberosDetails containing information about relevant Kerberos
                                configuration
@throws AmbariException
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java