private Keytab createIdentity(KerberosIdentityDescriptor identityDescriptor,
                                KerberosPrincipalType expectedType, Map<String, String> kerberosEnvProperties,
                                KerberosOperationHandler kerberosOperationHandler,
                                Map<String, Map<String, String>> configurations, String hostname)
    throws AmbariException {

    Keytab keytab = null;

    if (identityDescriptor != null) {
      KerberosPrincipalDescriptor principalDescriptor = identityDescriptor.getPrincipalDescriptor();

      if (principalDescriptor != null) {
        // If this principal type is expected, continue, else skip it.
        if (expectedType == principalDescriptor.getType()) {
          String principal = variableReplacementHelper.replaceVariables(principalDescriptor.getValue(), configurations);

          // Replace _HOST with the supplied hostname is either exist
          if (!StringUtils.isEmpty(hostname)) {
            principal = principal.replace("_HOST", hostname);
          }

          // If this principal is already in the Ambari database, then don't try to recreate it or it's
          // keytab file.
          if (!kerberosPrincipalDAO.exists(principal)) {
            CreatePrincipalsServerAction.CreatePrincipalResult result;

            result = injector.getInstance(CreatePrincipalsServerAction.class).createPrincipal(
              principal,
              KerberosPrincipalType.SERVICE.equals(expectedType),
              kerberosEnvProperties,
              kerberosOperationHandler,
              false,
              null);

            if (result == null) {
              throw new AmbariException("Failed to create the account for " + principal);
            } else {
              KerberosKeytabDescriptor keytabDescriptor = identityDescriptor.getKeytabDescriptor();

              if (keytabDescriptor != null) {
                KerberosPrincipalEntity principalEntity = kerberosPrincipalDAO.find(principal);
                keytab = injector.getInstance(CreateKeytabFilesServerAction.class).createKeytab(
                  principal,
                  principalEntity,
                  result.getPassword(),
                  result.getKeyNumber(),
                  kerberosOperationHandler,
                  true,
                  true,
                  null);

                if (keytab == null) {
                  throw new AmbariException("Failed to create the keytab for " + principal);
                }
              }
            }
          }
        }
      }
    }

    return keytab;
  }
Creates the principal and cached keytab file for the specified identity, if it is determined to
be of the expected type - user (headless) or service.
<p/>
If the identity is not of the expected type, it will be skipped.

@param identityDescriptor       the Kerberos identity to process
@param expectedType             the expected principal type
@param kerberosEnvProperties    the kerberos-env properties
@param kerberosOperationHandler the relevant KerberosOperationHandler
@param configurations           the existing configurations for the cluster
@param hostname                 the hostname of the host to create the identity for (nullable)
@return the relevant keytab data, if successful; otherwise null
@throws AmbariException
ambari-server/src/main/java/org/apache/ambari/server/controller/KerberosHelperImpl.java