@Override
  public KerberosDescriptor getKerberosDescriptor(KerberosDescriptorType kerberosDescriptorType, Cluster cluster,
                                                  boolean evaluateWhenClauses, Collection<String> additionalServices,
                                                  boolean includePreconfigureData,
                                                  @Nullable KerberosDescriptor userDescriptor,
                                                  @Nullable Map<String, DesiredConfig> desiredConfigs)
    throws AmbariException {

    // Checking stackId for each service is too much expensive, assume that all services following the cluster desired setting
    StackId stackId = cluster.getDesiredStackVersion();
    KerberosDescriptor kerberosDescriptor = getKerberosDescriptor(kerberosDescriptorType, cluster,
            stackId, includePreconfigureData, userDescriptor);

    if (evaluateWhenClauses) {
      Set<String> services = new HashSet<>(cluster.getServices().keySet());

      if (additionalServices != null) {
        services.addAll(additionalServices);
      }

      // Build the context needed to filter out Kerberos identities...
      // This includes the current set of configurations for the cluster and the set of installed services
      Map<String, Object> context = new HashMap<>();
      context.put("configurations", calculateConfigurations(cluster, null, kerberosDescriptor,
              false, false, desiredConfigs));
      context.put("services", services);

      // Get the Kerberos identities that need to be pruned
      Map<String, Set<String>> identitiesToRemove = processWhenClauses("", kerberosDescriptor, context, new HashMap<>());

      // Prune off the Kerberos identities that need to be removed due to the evaluation of its _when_ clause
      for (Map.Entry<String, Set<String>> identity : identitiesToRemove.entrySet()) {
        String[] path = identity.getKey().split("/");
        AbstractKerberosDescriptorContainer container = null;

        // Follow the path to the container that contains the identities to remove
        for (String name : path) {
          if (container == null) {
            container = kerberosDescriptor;
          } else {
            container = container.getChildContainer(name);

            if (container == null) {
              break;
            }
          }
        }

        // Remove the relevant identities from the found container
        if (container != null) {
          for (String identityName : identity.getValue()) {
            container.removeIdentity(identityName);
          }
        }
      }
    }

    return kerberosDescriptor;
  }
Find the {@link ServiceComponentHost}s for the cluster, filtering using the
supplied "should include" command (<code>shouldIncludeCommand</code>).
<p>
If <code>shouldIncludeCommand</code> is <code>null/code>, no filtering will be performed causing
all found {@link ServiceComponentHost}s to be returned.

@param cluster              the cluster
@param shouldIncludeCommand the filtering logic
@return a list of (filtered) {@link ServiceComponentHost}s
@throws AmbariException if an error occurs
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java