private Set<ResolvedKerberosKeytab> getFilteredKeytabs(Map<String, ? extends Collection<String>> serviceComponentFilter,
                                                        Set<String> hostFilter, Collection<String> identityFilter) {
    if (serviceComponentFilter == null && hostFilter == null && identityFilter == null) {
      return getAllKeytabs();
    }
    List<KerberosKeytabPrincipalDAO.KerberosKeytabPrincipalFilter> filters = splitServiceFilter(serviceComponentFilter);
    for (KerberosKeytabPrincipalDAO.KerberosKeytabPrincipalFilter filter : filters) {
      filter.setHostNames(hostFilter);
      filter.setPrincipals(identityFilter);
    }

    Set<ResolvedKerberosPrincipal> filteredPrincipals = fromPrincipalEntities(kerberosKeytabPrincipalDAO.findByFilters(filters), false);
    HashMap<String, ResolvedKerberosKeytab> resultMap = new HashMap<>();
    for (ResolvedKerberosPrincipal principal : filteredPrincipals) {
      if (!resultMap.containsKey(principal.getKeytabPath())) {
        resultMap.put(principal.getKeytabPath(), getKeytabByFile(principal.getKeytabPath(), false));
      }
      ResolvedKerberosKeytab keytab = resultMap.get(principal.getKeytabPath());
      keytab.addPrincipal(principal);
    }
    return Sets.newHashSet(resultMap.values());
  }
Returns keytabs with principals filtered by host, principal name or service(and component) names.

@param serviceComponentFilter service-component filter
@param hostFilter host filter
@param identityFilter identity(principal) filter
@return set of keytabs found
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/stageutils/KerberosKeytabController.java