private Map<String, Set<String>> processWhenClauses(String currentPath, AbstractKerberosDescriptorContainer container, Map<String, Object> context, Map<String, Set<String>> identitiesToRemove) throws AmbariException {

    // Get the list of this container's identities.
    // Do not filter these identities using KerberosIdentityDescriptor#shouldInclude since we will do
    // that later.
    List<KerberosIdentityDescriptor> identities = container.getIdentities(true, null);

    if ((identities != null) && !identities.isEmpty()) {
      Set<String> set = null;

      for (KerberosIdentityDescriptor identity : identities) {
        if (!identity.shouldInclude(context)) {
          if (set == null) {
            set = new HashSet<>();
            identitiesToRemove.put(currentPath, set);
          }

          set.add(identity.getName());
        }
      }
    }

    Collection<? extends AbstractKerberosDescriptorContainer> children = container.getChildContainers();
    if (children != null) {
      for (AbstractKerberosDescriptorContainer child : children) {
        identitiesToRemove = processWhenClauses(currentPath + "/" + child.getName(), child, context, identitiesToRemove);
      }
    }

    return identitiesToRemove;
  }
Recursively walk the Kerberos descriptor tree to find all Kerberos identity definitions and
determine which should be filtered out.
<p>
No actual filtering is performed while processing since any referenced Kerberos identities need
to be accessible throughout the process. So a map of container path to a list of identities is
created an returned

@param currentPath
@param container
@param context
@param identitiesToRemove
@return
@throws AmbariException
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java