private Collection<String> updateIdentityFilter(KerberosDescriptor kerberosDescriptor,
                                                  Collection<String> identityFilter,
                                                  Map<String, ? extends Collection<String>> serviceComponentFilter) {

    Set<String> updatedFilter = (identityFilter == null) ? new HashSet<>() : new HashSet<>(identityFilter);

    Map<String, KerberosServiceDescriptor> serviceDescriptors = kerberosDescriptor.getServices();

    if (serviceDescriptors != null) {
      for (KerberosServiceDescriptor serviceDescriptor : serviceDescriptors.values()) {
        String serviceName = serviceDescriptor.getName();

        if (serviceComponentFilter.containsKey("*") || serviceComponentFilter.containsKey(serviceName)) {
          Collection<String> componentFilter = serviceComponentFilter.get(serviceName);
          boolean anyComponent = ((componentFilter == null) || componentFilter.contains("*"));

          // Only include the service-wide identities if the component filter is null contains "*", which indicates
          // that all component for the given service are to be processed.
          if (anyComponent) {
            addIdentitiesToFilter(serviceDescriptor.getIdentities(), updatedFilter, true);
          }

          Map<String, KerberosComponentDescriptor> componentDescriptors = serviceDescriptor.getComponents();
          if (componentDescriptors != null) {
            for (KerberosComponentDescriptor componentDescriptor : componentDescriptors.values()) {
              String componentName = componentDescriptor.getName();
              if (anyComponent || (componentFilter.contains(componentName))) {
                addIdentitiesToFilter(componentDescriptor.getIdentities(), updatedFilter, true);
              }
            }
          }
        }
      }
    }

    return updatedFilter;
  }
Iterate through the identities in the Kerberos descriptor to find the relevant identities to
add to the identity filter.
<p>
The set of identities to include in the filter are determined by whether they are explicit
identities set in a component or service in the supplied service/component filter.

@param kerberosDescriptor     the Kerberos descriptor
@param identityFilter         the existing identity filter
@param serviceComponentFilter the service/component filter
@return a new collection of paths (including any existing paths) to act as the updated identity filter
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/PrepareKerberosIdentitiesServerAction.java