private boolean shouldRemove(String hostname,
                                 ResolvedKerberosKeytab resolvedKerberosKeytab,
                                 ResolvedKerberosPrincipal resolvedPrincipal,
                                 Map<String, ? extends Collection<String>> serviceComponentFilter) {
      ResolvedKerberosKeytab existingResolvedKeytab = kerberosKeytabController.getKeytabByFile(resolvedKerberosKeytab.getFile());

      if (existingResolvedKeytab == null) {
        return true;
      }

      Set<ResolvedKerberosPrincipal> principals = existingResolvedKeytab.getPrincipals();
      for (ResolvedKerberosPrincipal principal : principals) {
        if (hostname.equals(principal.getHostName()) && principal.getPrincipal().equals(resolvedPrincipal.getPrincipal())) {
          Multimap<String, String> temp = principal.getServiceMapping();

          // Make a local copy so we do not edit the stored copy, since we do not know how it is stored...
          Map<String, Collection<String>> serviceMapping = (temp == null) ? new HashMap<>() : new HashMap<>(temp.asMap());

          // Prune off the services in the filter, or all if the filter it none.  If there are no
          // service mappings left, this keytab file can be removed...
          if (serviceComponentFilter == null) {
            serviceMapping.clear();
          } else {
            for (Map.Entry<String, ? extends Collection<String>> entry : serviceComponentFilter.entrySet()) {
              String service = entry.getKey();
              Collection<String> components = entry.getValue();

              if (serviceMapping.containsKey(service)) {

                if (CollectionUtils.isEmpty(components) || CollectionUtils.isEmpty(serviceMapping.get(service))) {
                  // Remove all entries for the service...
                  serviceMapping.remove(service);
                } else {
                  Collection<String> leftOver = new HashSet<String>(serviceMapping.get(service));
                  leftOver.removeAll(components);

                  if (CollectionUtils.isEmpty(leftOver)) {
                    serviceMapping.remove(service);
                  } else {
                    serviceMapping.put(service, leftOver);
                  }
                }
              }
            }
          }

          // There are still service mappings for this keytab files, we cannot remove it.
          if (serviceMapping.size() > 0) {
            return false;
          }
        }
      }

      return true;
    }
Determines if the keytab file for a given Kerberos identitiy should be removed from the target
host.
<p>
This is determined by comparing the service/component filter with the metadata about the relavent
Kerberos identity. If it is determined that more components than the ones specified in the filer
are linked to the identity, than the keytab file will not be flagged for removal.

@param hostname               the target hostname
@param resolvedKerberosKeytab the relevant keytab file details
@param resolvedPrincipal      the relevant principal details
@param serviceComponentFilter the filter used to determine if the current Kerberos identity
                              should be processed
@return <code>true</code>, if this keytab file should be removed; <code>false</code>, otherwise
ambari-server/src/main/java/org/apache/ambari/server/events/publishers/AgentCommandsPublisher.java