private static boolean isReferredServiceInstalled(KerberosIdentityDescriptor identity, Map<String, Object> contextForFilter) {
    if (contextForFilter == null || !(contextForFilter.get("services") instanceof Collection)) {
      return true;
    }
    Set<String> installedServices = Sets.newHashSet((Collection) contextForFilter.get("services"));
    return identity.getReferencedServiceName().transform(contains(installedServices)).or(true);
  }
Returns a List of KerberosIdentityDescriptors contained within this
AbstractKerberosDescriptorContainer.
<p/>
If resolveReferences is true, a "detached" set of KerberosIdentityDescriptors are returned.
Any KerberosIdentityDescriptor that implies it references some other KerberosIdentityDescriptor
in the hierarchy will be resolved. Meaning, if the name of the KerberosIdentityDescriptor
indicates a path to some other KerberosIdentityDescriptor (i.e, /spnego, /HDFS/NAMENODE/nn, etc...)
the referenced KerberosIdentityDescriptor is found, detached (or copied), and updated with
the information from the initial KerberosIdentityDescriptor.  Because of this, all of the
KerberosIdentityDescriptors to be included are copied into the resulting list, and dissociating
them with the rest of the hierarchy such that changes to them will not be reflected within the
entire KerberosDescriptor tree.
<p/>
If resolveReferences is false, the raw List of KerberosIdentityDescriptors are returned. This
data is not manipulated by resolving references and therefore it may be missing data, however
this List is of "attached" descriptors, so changes will be reflected within the KerberosDescriptor
hierarchy.

@param resolveReferences a Boolean value indicating whether to resolve references (true) or not
                         (false)
@return a List of the requested KerberosIdentityDescriptors
ambari-server/src/main/java/org/apache/ambari/server/state/kerberos/AbstractKerberosDescriptorContainer.java