@Override
  public boolean ensureHeadlessIdentities(Cluster cluster, Map<String, Map<String, String>> existingConfigurations, Set<String> services)
    throws KerberosInvalidConfigurationException, AmbariException {

    KerberosDetails kerberosDetails = getKerberosDetails(cluster, null);

    // Only perform this task if Ambari manages Kerberos identities
    if (kerberosDetails.manageIdentities()) {
      KerberosDescriptor kerberosDescriptor = getKerberosDescriptor(cluster, false);

      Map<String, String> kerberosDescriptorProperties = kerberosDescriptor.getProperties();
      Map<String, Map<String, String>> configurations = addAdditionalConfigurations(cluster,
        deepCopy(existingConfigurations), null, kerberosDescriptorProperties, null);

      Map<String, String> kerberosConfiguration = kerberosDetails.getKerberosEnvProperties();
      KerberosOperationHandler kerberosOperationHandler = kerberosOperationHandlerFactory.getKerberosOperationHandler(kerberosDetails.getKdcType());
      PrincipalKeyCredential administratorCredential = getKDCAdministratorCredentials(cluster.getClusterName());

      try {
        kerberosOperationHandler.open(administratorCredential, kerberosDetails.getDefaultRealm(), kerberosConfiguration);
      } catch (KerberosOperationException e) {
        String message = String.format("Failed to process the identities, could not properly open the KDC operation handler: %s",
          e.getMessage());
        LOG.error(message);
        throw new AmbariException(message, e);
      }

      // Create the context to use for filtering Kerberos Identities based on the state of the cluster
      Map<String, Object> filterContext = new HashMap<>();
      filterContext.put("configurations", configurations);
      filterContext.put("services", services);

      for (String serviceName : services) {
        // Set properties...
        KerberosServiceDescriptor serviceDescriptor = kerberosDescriptor.getService(serviceName);

        if (serviceDescriptor != null) {
          Map<String, KerberosComponentDescriptor> componentDescriptors = serviceDescriptor.getComponents();
          if (null != componentDescriptors) {
            for (KerberosComponentDescriptor componentDescriptor : componentDescriptors.values()) {
              if (componentDescriptor != null) {
                List<KerberosIdentityDescriptor> identityDescriptors;

                // Handle the service-level Kerberos identities
                identityDescriptors = serviceDescriptor.getIdentities(true, filterContext);
                if (identityDescriptors != null) {
                  for (KerberosIdentityDescriptor identityDescriptor : identityDescriptors) {
                    createIdentity(identityDescriptor, KerberosPrincipalType.USER, kerberosConfiguration, kerberosOperationHandler, configurations, null);
                  }
                }

                // Handle the component-level Kerberos identities
                identityDescriptors = componentDescriptor.getIdentities(true, filterContext);
                if (identityDescriptors != null) {
                  for (KerberosIdentityDescriptor identityDescriptor : identityDescriptors) {
                    createIdentity(identityDescriptor, KerberosPrincipalType.USER, kerberosConfiguration, kerberosOperationHandler, configurations, null);
                  }
                }
              }
            }
          }
        }
      }

      // create Ambari principal & keytab, configure JAAS only if 'kerberos-env.create_ambari_principal = true'
      if (kerberosDetails.createAmbariPrincipal()) {
        installAmbariIdentities(kerberosDescriptor, kerberosOperationHandler, kerberosConfiguration, configurations, kerberosDetails);
      }

      // The KerberosOperationHandler needs to be closed, if it fails to close ignore the
      // exception since there is little we can or care to do about it now.
      try {
        kerberosOperationHandler.close();
      } catch (KerberosOperationException e) {
        // Ignore this...
      }

    }

    return true;
  }
If property is marked with delete flag in recommendedConfigPropertyAttributes map and is not found in
ignoreProperties, nor in kerberosConfigProperties but exits in existingConfigProperties add to
propertiesToRemove map.
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java