@Override
  public Map<String, Collection<KerberosIdentityDescriptor>> getActiveIdentities(String clusterName,
                                                                                 String hostName,
                                                                                 String serviceName,
                                                                                 String componentName,
                                                                                 boolean replaceHostNames,
                                                                                 Map<String, Map<String, Map<String, String>>> hostConfigurations,
                                                                                 KerberosDescriptor kerberosDescriptor,
                                                                                 @Nullable Map<String, DesiredConfig> desiredConfigs)
    throws AmbariException {

    if ((clusterName == null) || clusterName.isEmpty()) {
      throw new IllegalArgumentException("Invalid argument, cluster name is required");
    }

    Cluster cluster = clusters.getCluster(clusterName);

    if (cluster == null) {
      throw new AmbariException(String.format("The cluster object for the cluster name %s is not available", clusterName));
    }

    Map<String, Collection<KerberosIdentityDescriptor>> activeIdentities = new HashMap<>();

    // Only calculate the active identities if the kerberos-env configuration is available.  Else
    // important information like the realm will be missing (kerberos-env/realm)
    Config kerberosEnvConfig = cluster.getDesiredConfigByType(KERBEROS_ENV, desiredConfigs);
    if (kerberosEnvConfig == null) {
      LOG.debug("Calculating the active identities for {} is being skipped since the kerberos-env configuration is not available",
        clusterName, cluster.getSecurityType().name(), SecurityType.KERBEROS.name());
      return activeIdentities;
    }

    Collection<String> hosts;
    String ambariServerHostname = StageUtils.getHostName();
    boolean ambariServerHostnameIsForced = false;

    if (hostName == null) {
      Map<String, Host> hostMap = clusters.getHostsForCluster(clusterName);
      hosts = (hostMap == null) ? Collections.emptySet() : hostMap.keySet();

      if (!hosts.contains(ambariServerHostname)) {
        Collection<String> extendedHosts = new ArrayList<>(hosts.size() + 1);
        extendedHosts.addAll(hosts);
        extendedHosts.add(ambariServerHostname);
        hosts = extendedHosts;
        ambariServerHostnameIsForced = true;
      }
    } else {
      hosts = Collections.singleton(hostName);
    }

    if (null == hostConfigurations) {
      hostConfigurations = new HashMap<>();
    }

    if (hosts.isEmpty()) {
      return activeIdentities;
    }

    if (null == kerberosDescriptor) {
      kerberosDescriptor = getKerberosDescriptor(cluster, false);
    }

    if (kerberosDescriptor == null) {
      return activeIdentities;
    }
    Set<String> existingServices = cluster.getServices().keySet();

    for (String host : hosts) {
      // Calculate the current host-specific configurations. These will be used to replace
      // variables within the Kerberos descriptor data
      Map<String, Map<String, String>> configurations = hostConfigurations.get(host);
      if (configurations == null) {
        configurations = calculateConfigurations(cluster,
                (ambariServerHostnameIsForced && ambariServerHostname.equals(host)) ? null : host,
                kerberosDescriptor,
                false,
                false,
                desiredConfigs);

        hostConfigurations.put(host, configurations);
      }

      // Create the context to use for filtering Kerberos Identities based on the state of the cluster
      Map<String, Object> filterContext = new HashMap<>();
      filterContext.put("configurations", configurations);
      filterContext.put("services", existingServices);

      Map<String, KerberosIdentityDescriptor> hostActiveIdentities = new HashMap<>();
      List<KerberosIdentityDescriptor> identities = getActiveIdentities(cluster, host,
        serviceName, componentName, kerberosDescriptor, filterContext);


      if (host.equals(ambariServerHostname)) {
        // Determine if we should _calculate_ the Ambari service identities.
        // If kerberos-env/create_ambari_principal is not set to false the identity should be calculated.
        if (createAmbariIdentities(kerberosEnvConfig.getProperties())) {
          List<KerberosIdentityDescriptor> ambariIdentities = getAmbariServerIdentities(kerberosDescriptor);
          if (ambariIdentities != null) {
            identities.addAll(ambariIdentities);
          }
        }
      }

      if (!identities.isEmpty()) {
        for (KerberosIdentityDescriptor identity : identities) {
          KerberosPrincipalDescriptor principalDescriptor = identity.getPrincipalDescriptor();
          String principal = null;

          if (principalDescriptor != null) {
            principal = variableReplacementHelper.replaceVariables(principalDescriptor.getValue(), configurations);
          }

          if (principal != null) {
            KerberosKeytabDescriptor keytabDescriptor = identity.getKeytabDescriptor();
            String keytabFile = null;

            if (keytabDescriptor != null) {
              keytabFile = variableReplacementHelper.replaceVariables(keytabDescriptor.getFile(), configurations);
            }

            if (replaceHostNames) {
              principal = principal.replace("_HOST", host);
            }

            String uniqueKey = String.format("%s|%s", principal, (keytabFile == null) ? "" : keytabFile);

            if (!hostActiveIdentities.containsKey(uniqueKey) ||
                    (StringUtils.isNotBlank(hostActiveIdentities.get(uniqueKey).getReference()) && StringUtils.isBlank(identity.getReference()))) {
              KerberosPrincipalType principalType = principalDescriptor.getType();

              // Assume the principal is a service principal if not specified
              if (principalType == null) {
                principalType = KerberosPrincipalType.SERVICE;
              }

              KerberosPrincipalDescriptor resolvedPrincipalDescriptor =
                new KerberosPrincipalDescriptor(principal,
                  principalType,
                  variableReplacementHelper.replaceVariables(principalDescriptor.getConfiguration(), configurations),
                  variableReplacementHelper.replaceVariables(principalDescriptor.getLocalUsername(), configurations));

              KerberosKeytabDescriptor resolvedKeytabDescriptor;

              if (keytabFile == null) {
                resolvedKeytabDescriptor = null;
              } else {
                resolvedKeytabDescriptor =
                        new KerberosKeytabDescriptor(
                                keytabFile,
                                variableReplacementHelper.replaceVariables(keytabDescriptor.getOwnerName(), configurations),
                                variableReplacementHelper.replaceVariables(keytabDescriptor.getOwnerAccess(), configurations),
                                variableReplacementHelper.replaceVariables(keytabDescriptor.getGroupName(), configurations),
                                variableReplacementHelper.replaceVariables(keytabDescriptor.getGroupAccess(), configurations),
                                variableReplacementHelper.replaceVariables(keytabDescriptor.getConfiguration(), configurations),
                                keytabDescriptor.isCachable());
              }

              hostActiveIdentities.put(uniqueKey, new KerberosIdentityDescriptor(
                      identity.getName(),
                      identity.getReference(),
                      resolvedPrincipalDescriptor,
                      resolvedKeytabDescriptor,
                      identity.getWhen()));
            }
          }
        }
      }

      activeIdentities.put(host, hostActiveIdentities.values());
    }

    return activeIdentities;
  }
Find the {@link ServiceComponentHost}s for the cluster, filtering using the
supplied "should include" command (<code>shouldIncludeCommand</code>).
<p>
If <code>shouldIncludeCommand</code> is <code>null/code>, no filtering will be performed causing
all found {@link ServiceComponentHost}s to be returned.

@param cluster              the cluster
@param shouldIncludeCommand the filtering logic
@return a list of (filtered) {@link ServiceComponentHost}s
@throws AmbariException if an error occurs
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java