private void addIdentitiesToFilter(List<KerberosIdentityDescriptor> identityDescriptors,
                                     Collection<String> identityFilter, boolean skipReferences) {
    if (!CollectionUtils.isEmpty(identityDescriptors)) {
      for (KerberosIdentityDescriptor identityDescriptor : identityDescriptors) {
        if (!skipReferences || !identityDescriptor.isReference()) {
          String identityPath = identityDescriptor.getPath();

          if (!StringUtils.isEmpty(identityPath)) {
            identityFilter.add(identityPath);

            // Find and add the references TO this identity to ensure the new/updated keytab file is
            // sent to the appropriate host(s)
            addIdentitiesToFilter(identityDescriptor.findReferences(), identityFilter, false);
          }
        }
      }
    }
  }
Add the path of each identity in the collection of identities to the supplied identity filter
if that identity is not a reference to another identity or if references are allowed.

@param identityDescriptors the collection of identity descriptors to process
@param identityFilter      the identity filter to modify
@param skipReferences
ambari-server/src/main/java/org/apache/ambari/server/serveraction/kerberos/PrepareKerberosIdentitiesServerAction.java