private List<KerberosIdentityDescriptor> findIdentityReferences(AbstractKerberosDescriptorContainer root, String path) {
    if (root == null) {
      return null;
    }

    List<KerberosIdentityDescriptor> references = new ArrayList<>();

    // Process the KerberosIdentityDescriptors found in this node.
    List<KerberosIdentityDescriptor> identityDescriptors = root.getIdentities();
    if (identityDescriptors != null) {
      for (KerberosIdentityDescriptor identityDescriptor : identityDescriptors) {
        if (identityDescriptor.isReference()) {
          String reference = identityDescriptor.getReferenceAbsolutePath();

          if (!StringUtils.isEmpty(reference) && path.equals(reference)) {
            references.add(identityDescriptor);
          }
        }
      }
    }

    // Process the children of the node
    Collection<? extends AbstractKerberosDescriptorContainer> children = root.getChildContainers();
    if(!CollectionUtils.isEmpty(children)) {
      for (AbstractKerberosDescriptorContainer child : children) {
        Collection<KerberosIdentityDescriptor> childReferences = findIdentityReferences(child, path);
        if (!CollectionUtils.isEmpty(childReferences)) {
          // If references were found in the current child, add them to this node's list of references.
          references.addAll(childReferences);
        }
      }
    }

    return references;
  }
Given a root, recursively traverse the tree of {@link AbstractKerberosDescriptorContainer}s looking for
{@link KerberosIdentityDescriptor}s that declare the given path as the referenced Kerberos identity.

@param root the starting point
@param path the path to the referenced {@link KerberosIdentityDescriptor} in the {@link KerberosDescriptor}
@return a list of {@link KerberosIdentityDescriptor}s
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/KerberosIdentityDescriptor.java