@Override
  public Integer createPrincipal(String principal, String password, boolean service)
      throws KerberosOperationException {
    if (!isOpen()) {
      throw new KerberosOperationException("This operation handler has not been opened");
    }
    if (principal == null) {
      throw new KerberosOperationException("principal is null");
    }
    if (password == null) {
      throw new KerberosOperationException("principal password is null");
    }
    if (principalExists(principal, service)) {
      throw new KerberosPrincipalAlreadyExistsException(principal);
    }

    DeconstructedPrincipal deconstructedPrincipal = createDeconstructPrincipal(principal);

    String realm = deconstructedPrincipal.getRealm();
    if (realm == null) {
      realm = "";
    }

    Map<String, Object> context = new HashMap<>();
    context.put("normalized_principal", deconstructedPrincipal.getNormalizedPrincipal());
    context.put("principal_name", deconstructedPrincipal.getPrincipalName());
    context.put("principal_primary", deconstructedPrincipal.getPrimary());
    context.put("principal_instance", deconstructedPrincipal.getInstance());
    context.put("realm", realm);
    context.put("realm_lowercase", realm.toLowerCase());
    context.put("password", password);
    context.put("is_service", service);
    context.put("container_dn", this.principalContainerDn);
    context.put("principal_digest", DigestUtils.sha1Hex(deconstructedPrincipal.getNormalizedPrincipal()));
    context.put("principal_digest_256", DigestUtils.sha256Hex(deconstructedPrincipal.getNormalizedPrincipal()));
    context.put("principal_digest_512", DigestUtils.sha512Hex(deconstructedPrincipal.getNormalizedPrincipal()));

    Map<String, Object> data = processCreateTemplate(context);

    Attributes attributes = new BasicAttributes();
    String cn = null;

    if (data != null) {
      for (Map.Entry<String, Object> entry : data.entrySet()) {
        String key = entry.getKey();
        Object value = entry.getValue();

        if ("unicodePwd".equals(key)) {
          if (value instanceof String) {
            try {
              attributes.put(new BasicAttribute("unicodePwd", String.format("\"%s\"", password).getBytes("UTF-16LE")));
            } catch (UnsupportedEncodingException ue) {
              throw new KerberosOperationException("Can not encode password with UTF-16LE", ue);
            }
          }
        } else {
          Attribute attribute = new BasicAttribute(key);
          if (value instanceof Collection) {
            for (Object object : (Collection) value) {
              attribute.add(object);
            }
          } else {
            if ("cn".equals(key) && (value != null)) {
              cn = value.toString();
            } else if ("sAMAccountName".equals(key) && (value != null)) {
              // Replace the following _illegal_ characters: [ ] : ; | = + * ? < > / , (space) \
              value = value.toString().replaceAll("\\[|\\]|\\:|\\;|\\||\\=|\\+|\\*|\\?|\\<|\\>|\\/|\\\\|\\,|\\s", "_");
            }

            attribute.add(value);
          }

          attributes.put(attribute);
        }
      }
    }

    if (cn == null) {
      cn = deconstructedPrincipal.getNormalizedPrincipal();
    }

    try {
      Rdn rdn = new Rdn("cn", cn);
      LdapName name = new LdapName(principalContainerLdapName.getRdns());
      name.add(name.size(), rdn);
      ldapContext.createSubcontext(name, attributes);
    } catch (NamingException ne) {
      throw new KerberosOperationException("Can not create principal : " + principal, ne);
    }
    return 0;
  }
Creates a new principal in a previously configured KDC
<p/>
The implementation is specific to a particular type of KDC.

@param principal a String containing the principal to add
@param password  a String containing the password to use when creating the principal
@param service   a boolean value indicating whether the principal is to be created as a service principal or not
@return an Integer declaring the generated key number
@throws KerberosPrincipalAlreadyExistsException if the principal already exists
@throws KerberosOperationException
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/ADKerberosOperationHandler.java