Merge branch 'master' into senslab2

[sfa.git] / sfa / trust / credential.py

diff --git a/sfa/trust/credential.py b/sfa/trust/credential.py
index bd7e7f1..ad2d201 100644 (file)
--- a/sfa/trust/credential.py
+++ b/sfa/trust/credential.py
@@ -26,25 +26,32 @@
 # Credentials are signed XML files that assign a subject gid privileges to an object gid
 ##
 
 # Credentials are signed XML files that assign a subject gid privileges to an object gid
 ##
 

-import os
+import os,sys

 from types import StringTypes
 import datetime
 from StringIO import StringIO
 from tempfile import mkstemp
 from xml.dom.minidom import Document, parseString
 from types import StringTypes
 import datetime
 from StringIO import StringIO
 from tempfile import mkstemp
 from xml.dom.minidom import Document, parseString

-from lxml import etree

 
 

-from sfa.util.faults import *
+HAVELXML = False
+try:
+    from lxml import etree
+    HAVELXML = True
+except:
+    pass
+
+from xml.parsers.expat import ExpatError
+
+from sfa.util.faults import CredentialNotVerifiable, ChildRightsNotSubsetOfParent

 from sfa.util.sfalogging import logger
 from sfa.util.sfatime import utcparse
 from sfa.util.sfalogging import logger
 from sfa.util.sfatime import utcparse

-from sfa.trust.certificate import Keypair

 from sfa.trust.credential_legacy import CredentialLegacy
 from sfa.trust.credential_legacy import CredentialLegacy

-from sfa.trust.rights import Right, Rights
+from sfa.trust.rights import Right, Rights, determine_rights

 from sfa.trust.gid import GID
 from sfa.trust.gid import GID

-from sfa.util.xrn import urn_to_hrn
+from sfa.util.xrn import urn_to_hrn, hrn_authfor_hrn

 
 # 2 weeks, in seconds 
 
 # 2 weeks, in seconds 

-DEFAULT_CREDENTIAL_LIFETIME = 86400 * 14
+DEFAULT_CREDENTIAL_LIFETIME = 86400 * 31

 
 
 # TODO:
 
 
 # TODO:


@@ -153,8 +160,10 @@ class Signature(object):
 
 
     def get_refid(self):
 
 
     def get_refid(self):

+        #print>>sys.stderr," \r\n \r\n credential.py Signature get_refid\ self.refid %s " %(self.refid)

         if not self.refid:
             self.decode()
         if not self.refid:
             self.decode()

+            #print>>sys.stderr," \r\n \r\n credential.py Signature get_refid self.refid %s " %(self.refid)

         return self.refid
 
     def get_xml(self):
         return self.refid
 
     def get_xml(self):


@@ -174,7 +183,11 @@ class Signature(object):
         self.gid = gid
 
     def decode(self):
         self.gid = gid
 
     def decode(self):

-        doc = parseString(self.xml)
+        try:
+            doc = parseString(self.xml)
+        except ExpatError,e:
+            logger.log_exc ("Failed to parse credential, %s"%self.xml)
+            raise

         sig = doc.getElementsByTagName("Signature")[0]
         self.set_refid(sig.getAttribute("xml:id").strip("Sig_"))
         keyinfo = sig.getElementsByTagName("X509Data")[0]
         sig = doc.getElementsByTagName("Signature")[0]
         self.set_refid(sig.getAttribute("xml:id").strip("Sig_"))
         keyinfo = sig.getElementsByTagName("X509Data")[0]


@@ -199,17 +212,19 @@ class Signature(object):
 # not be changed else the signature is no longer valid.  So, once
 # you have loaded an existing signed credential, do not call encode() or sign() on it.
 
 # not be changed else the signature is no longer valid.  So, once
 # you have loaded an existing signed credential, do not call encode() or sign() on it.
 

-def filter_creds_by_caller(creds, caller_hrn):
+def filter_creds_by_caller(creds, caller_hrn_list):

         """
         Returns a list of creds who's gid caller matches the
         specified caller hrn
         """
         if not isinstance(creds, list): creds = [creds]
         """
         Returns a list of creds who's gid caller matches the
         specified caller hrn
         """
         if not isinstance(creds, list): creds = [creds]

+        if not isinstance(caller_hrn_list, list): 
+            caller_hrn_list = [caller_hrn_list]

         caller_creds = []
         for cred in creds:
             try:
                 tmp_cred = Credential(string=cred)
         caller_creds = []
         for cred in creds:
             try:
                 tmp_cred = Credential(string=cred)

-                if tmp_cred.get_gid_caller().get_hrn() == caller_hrn:
+                if tmp_cred.get_gid_caller().get_hrn() in caller_hrn_list:

                     caller_creds.append(cred)
             except: pass
         return caller_creds
                     caller_creds.append(cred)
             except: pass
         return caller_creds


@@ -263,7 +278,17 @@ class Credential(object):
     def get_subject(self):
         if not self.gidObject:
             self.decode()
     def get_subject(self):
         if not self.gidObject:
             self.decode()

-        return self.gidObject.get_subject()   
+        return self.gidObject.get_printable_subject()
+
+    # sounds like this should be __repr__ instead ??
+    def get_summary_tostring(self):
+        if not self.gidObject:
+            self.decode()
+        obj = self.gidObject.get_printable_subject()
+        caller = self.gidCaller.get_printable_subject()
+        exp = self.get_expiration()
+        # Summarize the rights too? The issuer?
+        return "[ Grant %s rights on %s until %s ]" % (caller, obj, exp)

 
     def get_signature(self):
         if not self.signature:
 
     def get_signature(self):
         if not self.signature:


@@ -348,7 +373,7 @@ class Credential(object):
     # Expiration: an absolute UTC time of expiration (as either an int or string or datetime)
     # 
     def set_expiration(self, expiration):
     # Expiration: an absolute UTC time of expiration (as either an int or string or datetime)
     # 
     def set_expiration(self, expiration):

-        if isinstance(expiration, (int,float)):
+        if isinstance(expiration, (int, float)):

             self.expiration = datetime.datetime.fromtimestamp(expiration)
         elif isinstance (expiration, datetime.datetime):
             self.expiration = expiration
             self.expiration = datetime.datetime.fromtimestamp(expiration)
         elif isinstance (expiration, datetime.datetime):
             self.expiration = expiration


@@ -357,9 +382,10 @@ class Credential(object):
         else:
             logger.error ("unexpected input type in Credential.set_expiration")
 
         else:
             logger.error ("unexpected input type in Credential.set_expiration")
 

+

     ##
     # get the lifetime of the credential (always in datetime format)
     ##
     # get the lifetime of the credential (always in datetime format)

-    #
+

     def get_expiration(self):
         if not self.expiration:
             self.decode()
     def get_expiration(self):
         if not self.expiration:
             self.decode()


@@ -419,12 +445,18 @@ class Credential(object):
         doc = Document()
         signed_cred = doc.createElement("signed-credential")
 
         doc = Document()
         signed_cred = doc.createElement("signed-credential")
 

-# PG adds these. It would be nice to be consistent.
-# But it's kind of odd for PL to use PG schemas that talk
-# about tickets, and the PG CM policies.
-# Note the careful addition of attributes from the parent below...
-#        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")
-#        signed_cred.setAttribute("xsinoNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")
+# Declare namespaces
+# Note that credential/policy.xsd are really the PG schemas
+# in a PL namespace.
+# Note that delegation of credentials between the 2 only really works
+# cause those schemas are identical.
+# Also note these PG schemas talk about PG tickets and CM policies.
+        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")
+        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.planet-lab.org/resources/sfa/credential.xsd")
+        signed_cred.setAttribute("xsi:schemaLocation", "http://www.planet-lab.org/resources/sfa/ext/policy/1 http://www.planet-lab.org/resources/sfa/ext/policy/1/policy.xsd")
+
+# PG says for those last 2:
+#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")

 #        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")
 
         doc.appendChild(signed_cred)  
 #        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")
 
         doc.appendChild(signed_cred)  


@@ -461,13 +493,34 @@ class Credential(object):
             # If the root node is a signed-credential (it should be), then
             # get all its attributes and attach those to our signed_cred
             # node.
             # If the root node is a signed-credential (it should be), then
             # get all its attributes and attach those to our signed_cred
             # node.

-            # Specifically, PG adds attributes for namespaces (which is reasonable),
+            # Specifically, PG and PLadd attributes for namespaces (which is reasonable),

             # and we need to include those again here or else their signature
             # no longer matches on the credential.
             # We expect three of these, but here we copy them all:
 #        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")
             # and we need to include those again here or else their signature
             # no longer matches on the credential.
             # We expect three of these, but here we copy them all:
 #        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")

-#        signed_cred.setAttribute("xsinoNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")
+# and from PG (PL is equivalent, as shown above):
+#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")

 #        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")
 #        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")

+
+            # HOWEVER!
+            # PL now also declares these, with different URLs, so
+            # the code notices those attributes already existed with
+            # different values, and complains.
+            # This happens regularly on delegation now that PG and
+            # PL both declare the namespace with different URLs.
+            # If the content ever differs this is a problem,
+            # but for now it works - different URLs (values in the attributes)
+            # but the same actual schema, so using the PG schema
+            # on delegated-to-PL credentials works fine.
+
+            # Note: you could also not copy attributes
+            # which already exist. It appears that both PG and PL
+            # will actually validate a slicecred with a parent
+            # signed using PG namespaces and a child signed with PL
+            # namespaces over the whole thing. But I don't know
+            # if that is a bug in xmlsec1, an accident since
+            # the contents of the schemas are the same,
+            # or something else, but it seems odd. And this works.

             parentRoot = sdoc.documentElement
             if parentRoot.tagName == "signed-credential" and parentRoot.hasAttributes():
                 for attrIx in range(0, parentRoot.attributes.length):
             parentRoot = sdoc.documentElement
             if parentRoot.tagName == "signed-credential" and parentRoot.hasAttributes():
                 for attrIx in range(0, parentRoot.attributes.length):


@@ -477,9 +530,9 @@ class Credential(object):
                     # Below throws InUse exception if we forgot to clone the attribute first
                     oldAttr = signed_cred.setAttributeNode(attr.cloneNode(True))
                     if oldAttr and oldAttr.value != attr.value:
                     # Below throws InUse exception if we forgot to clone the attribute first
                     oldAttr = signed_cred.setAttributeNode(attr.cloneNode(True))
                     if oldAttr and oldAttr.value != attr.value:

-                        msg = "Delegating cred from owner %s to %s over %s replaced attribute %s value %s with %s" % (self.parent.gidCaller.get_urn(), self.gidCaller.get_urn(), self.gidObject.get_urn(), oldAttr.name, oldAttr.value, attr.value)
-                        logger.error(msg)
-                        raise CredentialNotVerifiable("Can't encode new valid delegated credential: %s" % msg)
+                        msg = "Delegating cred from owner %s to %s over %s replaced attribute %s value '%s' with '%s'" % (self.parent.gidCaller.get_urn(), self.gidCaller.get_urn(), self.gidObject.get_urn(), oldAttr.name, oldAttr.value, attr.value)
+                        logger.warn(msg)
+                        #raise CredentialNotVerifiable("Can't encode new valid delegated credential: %s" % msg)

 
             p_cred = doc.importNode(sdoc.getElementsByTagName("credential")[0], True)
             p = doc.createElement("parent")
 
             p_cred = doc.importNode(sdoc.getElementsByTagName("credential")[0], True)
             p = doc.createElement("parent")


@@ -538,18 +591,23 @@ class Credential(object):
     
     def updateRefID(self):
         if not self.parent:
     
     def updateRefID(self):
         if not self.parent:

-            self.set_refid('ref0')
+            self.set_refid('ref0') 
+            #print>>sys.stderr, " \r\n \r\n updateRefID next_cred ref0 "

             return []
         
         refs = []
 
         next_cred = self.parent
             return []
         
         refs = []
 
         next_cred = self.parent

+       

         while next_cred:
         while next_cred:

+          

             refs.append(next_cred.get_refid())
             if next_cred.parent:
                 next_cred = next_cred.parent
             refs.append(next_cred.get_refid())
             if next_cred.parent:
                 next_cred = next_cred.parent

+                #print>>sys.stderr, " \r\n \r\n updateRefID next_cred "

             else:
                 next_cred = None
             else:
                 next_cred = None

+                #print>>sys.stderr, " \r\n \r\n updateRefID next_cred NONE"

 
         
         # Find a unique refid for this credential
 
         
         # Find a unique refid for this credential


@@ -638,13 +696,19 @@ class Credential(object):
 
         # Is this a signed-cred or just a cred?
         if len(signed_cred) > 0:
 
         # Is this a signed-cred or just a cred?
         if len(signed_cred) > 0:

-            cred = signed_cred[0].getElementsByTagName("credential")[0]
+            creds = signed_cred[0].getElementsByTagName("credential")

             signatures = signed_cred[0].getElementsByTagName("signatures")
             if len(signatures) > 0:
                 sigs = signatures[0].getElementsByTagName("Signature")
         else:
             signatures = signed_cred[0].getElementsByTagName("signatures")
             if len(signatures) > 0:
                 sigs = signatures[0].getElementsByTagName("Signature")
         else:

-            cred = doc.getElementsByTagName("credential")[0]
+            creds = doc.getElementsByTagName("credential")

         
         

+        if creds is None or len(creds) == 0:
+            # malformed cred file
+            raise CredentialNotVerifiable("Malformed XML: No credential tag found")
+
+        # Just take the first cred if there are more than one
+        cred = creds[0]

 
         self.set_refid(cred.getAttribute("xml:id"))
         self.set_expiration(utcparse(getTextNode(cred, "expires")))
 
         self.set_refid(cred.getAttribute("xml:id"))
         self.set_expiration(utcparse(getTextNode(cred, "expires")))


@@ -662,7 +726,7 @@ class Credential(object):
                 # Convert * into the default privileges for the credential's type
                 # Each inherits the delegatability from the * above
                 _ , type = urn_to_hrn(self.gidObject.get_urn())
                 # Convert * into the default privileges for the credential's type
                 # Each inherits the delegatability from the * above
                 _ , type = urn_to_hrn(self.gidObject.get_urn())

-                rl = rlist.determine_rights(type, self.gidObject.get_urn())
+                rl = determine_rights(type, self.gidObject.get_urn())

                 for r in rl.rights:
                     r.delegate = deleg
                     rlist.add(r)
                 for r in rl.rights:
                     r.delegate = deleg
                     rlist.add(r)


@@ -704,6 +768,7 @@ class Credential(object):
     # . That the issuer of the credential is the authority in the target's urn
     #    . In the case of a delegated credential, this must be true of the root
     # . That all of the gids presented in the credential are valid
     # . That the issuer of the credential is the authority in the target's urn
     #    . In the case of a delegated credential, this must be true of the root
     # . That all of the gids presented in the credential are valid

+    #    . Including verifying GID chains, and includ the issuer

     # . The credential is not expired
     #
     # -- For Delegates (credentials with parents)
     # . The credential is not expired
     #
     # -- For Delegates (credentials with parents)


@@ -723,15 +788,15 @@ class Credential(object):
             self.decode()
 
         # validate against RelaxNG schema
             self.decode()
 
         # validate against RelaxNG schema

-        if not self.legacy:
+        if HAVELXML and not self.legacy:

             if schema and os.path.exists(schema):
                 tree = etree.parse(StringIO(self.xml))
                 schema_doc = etree.parse(schema)
                 xmlschema = etree.XMLSchema(schema_doc)
                 if not xmlschema.validate(tree):
                     error = xmlschema.error_log.last_error
             if schema and os.path.exists(schema):
                 tree = etree.parse(StringIO(self.xml))
                 schema_doc = etree.parse(schema)
                 xmlschema = etree.XMLSchema(schema_doc)
                 if not xmlschema.validate(tree):
                     error = xmlschema.error_log.last_error

-                    message = "%s (line %s)" % (error.message, error.line)
-                    raise CredentialNotVerifiable(message)        
+                    message = "%s: %s (line %s)" % (self.get_summary_tostring(), error.message, error.line)
+                    raise CredentialNotVerifiable(message)

 
         if trusted_certs_required and trusted_certs is None:
             trusted_certs = []
 
         if trusted_certs_required and trusted_certs is None:
             trusted_certs = []


@@ -747,10 +812,12 @@ class Credential(object):
                     # Failures here include unreadable files
                     # or non PEM files
                     trusted_cert_objects.append(GID(filename=f))
                     # Failures here include unreadable files
                     # or non PEM files
                     trusted_cert_objects.append(GID(filename=f))

+                    #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs %s" %(GID(filename=f).get_hrn())

                     ok_trusted_certs.append(f)
                 except Exception, exc:
                     logger.error("Failed to load trusted cert from %s: %r", f, exc)
             trusted_certs = ok_trusted_certs
                     ok_trusted_certs.append(f)
                 except Exception, exc:
                     logger.error("Failed to load trusted cert from %s: %r", f, exc)
             trusted_certs = ok_trusted_certs

+            #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs elemnebts %s" %(len(trusted_certs))

 
         # Use legacy verification if this is a legacy credential
         if self.legacy:
 
         # Use legacy verification if this is a legacy credential
         if self.legacy:


@@ -763,7 +830,7 @@ class Credential(object):
         
         # make sure it is not expired
         if self.get_expiration() < datetime.datetime.utcnow():
         
         # make sure it is not expired
         if self.get_expiration() < datetime.datetime.utcnow():

-            raise CredentialNotVerifiable("Credential expired at %s" % self.expiration.isoformat())
+            raise CredentialNotVerifiable("Credential %s expired at %s" % (self.get_summary_tostring(), self.expiration.isoformat()))

 
         # Verify the signatures
         filename = self.save_to_random_tmp_file()
 
         # Verify the signatures
         filename = self.save_to_random_tmp_file()


@@ -771,12 +838,13 @@ class Credential(object):
             cert_args = " ".join(['--trusted-pem %s' % x for x in trusted_certs])
 
         # If caller explicitly passed in None that means skip cert chain validation.
             cert_args = " ".join(['--trusted-pem %s' % x for x in trusted_certs])
 
         # If caller explicitly passed in None that means skip cert chain validation.

-        # Strange and not typical
+        # - Strange and not typical

         if trusted_certs is not None:
             # Verify the gids of this cred and of its parents
             for cur_cred in self.get_credential_list():
                 cur_cred.get_gid_object().verify_chain(trusted_cert_objects)
         if trusted_certs is not None:
             # Verify the gids of this cred and of its parents
             for cur_cred in self.get_credential_list():
                 cur_cred.get_gid_object().verify_chain(trusted_cert_objects)

-                cur_cred.get_gid_caller().verify_chain(trusted_cert_objects)
+                cur_cred.get_gid_caller().verify_chain(trusted_cert_objects)        
+                #print>>sys.stderr, " \r\n \t\t\t credential.py verify cur_cred get_gid_object hrn %s get_gid_caller %s" %(cur_cred.get_gid_object().get_hrn(),cur_cred.get_gid_caller().get_hrn()) 

 
         refs = []
         refs.append("Sig_%s" % self.get_refid())
 
         refs = []
         refs.append("Sig_%s" % self.get_refid())


@@ -784,7 +852,7 @@ class Credential(object):
         parentRefs = self.updateRefID()
         for ref in parentRefs:
             refs.append("Sig_%s" % ref)
         parentRefs = self.updateRefID()
         for ref in parentRefs:
             refs.append("Sig_%s" % ref)

-
+            #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs refs",  ref 

         for ref in refs:
             # If caller explicitly passed in None that means skip xmlsec1 validation.
             # Strange and not typical
         for ref in refs:
             # If caller explicitly passed in None that means skip xmlsec1 validation.
             # Strange and not typical


@@ -795,6 +863,7 @@ class Credential(object):
 #                (self.xmlsec_path, ref, cert_args, filename)
             verified = os.popen('%s --verify --node-id "%s" %s %s 2>&1' \
                             % (self.xmlsec_path, ref, cert_args, filename)).read()
 #                (self.xmlsec_path, ref, cert_args, filename)
             verified = os.popen('%s --verify --node-id "%s" %s %s 2>&1' \
                             % (self.xmlsec_path, ref, cert_args, filename)).read()

+            #print>>sys.stderr, " \r\n \t\t\t credential.py verify filename %s verified %s " %(filename,verified)             

             if not verified.strip().startswith("OK"):
                 # xmlsec errors have a msg= which is the interesting bit.
                 mstart = verified.find("msg=")
             if not verified.strip().startswith("OK"):
                 # xmlsec errors have a msg= which is the interesting bit.
                 mstart = verified.find("msg=")


@@ -803,15 +872,17 @@ class Credential(object):
                     mstart = mstart + 4
                     mend = verified.find('\\', mstart)
                     msg = verified[mstart:mend]
                     mstart = mstart + 4
                     mend = verified.find('\\', mstart)
                     msg = verified[mstart:mend]

-                raise CredentialNotVerifiable("xmlsec1 error verifying cred using Signature ID %s: %s %s" % (ref, msg, verified.strip()))
+                raise CredentialNotVerifiable("xmlsec1 error verifying cred %s using Signature ID %s: %s %s" % (self.get_summary_tostring(), ref, msg, verified.strip()))

         os.remove(filename)
         os.remove(filename)

-
+        
+        #print>>sys.stderr, " \r\n \t\t\t credential.py HUMMM parents %s", self.parent

         # Verify the parents (delegation)
         if self.parent:
             self.verify_parent(self.parent)
         # Verify the parents (delegation)
         if self.parent:
             self.verify_parent(self.parent)

-
-        # Make sure the issuer is the target's authority
-        self.verify_issuer()
+        #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs parents" 
+        # Make sure the issuer is the target's authority, and is
+        # itself a valid GID
+        self.verify_issuer(trusted_cert_objects)

         return True
 
     ##
         return True
 
     ##


@@ -829,31 +900,67 @@ class Credential(object):
         return list
     
     ##
         return list
     
     ##

-    # Make sure the credential's target gid was signed by (or is the same) the entity that signed
-    # the original credential or an authority over that namespace.
-    def verify_issuer(self):                
+    # Make sure the credential's target gid (a) was signed by or (b)
+    # is the same as the entity that signed the original credential,
+    # or (c) is an authority over the target's namespace.
+    # Also ensure that the credential issuer / signer itself has a valid
+    # GID signature chain (signed by an authority with namespace rights).
+    def verify_issuer(self, trusted_gids):

         root_cred = self.get_credential_list()[-1]
         root_target_gid = root_cred.get_gid_object()
         root_cred_signer = root_cred.get_signature().get_issuer_gid()
 
         root_cred = self.get_credential_list()[-1]
         root_target_gid = root_cred.get_gid_object()
         root_cred_signer = root_cred.get_signature().get_issuer_gid()
 

+        # Case 1:
+        # Allow non authority to sign target and cred about target.
+        #
+        # Why do we need to allow non authorities to sign?
+        # If in the target gid validation step we correctly
+        # checked that the target is only signed by an authority,
+        # then this is just a special case of case 3.
+        # This short-circuit is the common case currently -
+        # and cause GID validation doesn't check 'authority',
+        # this allows users to generate valid slice credentials.

         if root_target_gid.is_signed_by_cert(root_cred_signer):
             # cred signer matches target signer, return success
             return
 
         if root_target_gid.is_signed_by_cert(root_cred_signer):
             # cred signer matches target signer, return success
             return
 

-        root_target_gid_str = root_target_gid.save_to_string()
-        root_cred_signer_str = root_cred_signer.save_to_string()
-        if root_target_gid_str == root_cred_signer_str:
-            # cred signer is target, return success
-            return
+        # Case 2:
+        # Allow someone to sign credential about themeselves. Used?
+        # If not, remove this.
+        #root_target_gid_str = root_target_gid.save_to_string()
+        #root_cred_signer_str = root_cred_signer.save_to_string()
+        #if root_target_gid_str == root_cred_signer_str:
+        #    # cred signer is target, return success
+        #    return
+
+        # Case 3:
+
+        # root_cred_signer is not the target_gid
+        # So this is a different gid that we have not verified.
+        # xmlsec1 verified the cert chain on this already, but
+        # it hasn't verified that the gid meets the HRN namespace
+        # requirements.
+        # Below we'll ensure that it is an authority.
+        # But we haven't verified that it is _signed by_ an authority
+        # We also don't know if xmlsec1 requires that cert signers
+        # are marked as CAs.
+
+        # Note that if verify() gave us no trusted_gids then this
+        # call will fail. So skip it if we have no trusted_gids
+        if trusted_gids and len(trusted_gids) > 0:
+            root_cred_signer.verify_chain(trusted_gids)
+        else:
+            logger.debug("No trusted gids. Cannot verify that cred signer is signed by a trusted authority. Skipping that check.")

 
 

-        # See if it the signer is an authority over the domain of the target
+        # See if the signer is an authority over the domain of the target.
+        # There are multiple types of authority - accept them all here

         # Maybe should be (hrn, type) = urn_to_hrn(root_cred_signer.get_urn())
         root_cred_signer_type = root_cred_signer.get_type()
         # Maybe should be (hrn, type) = urn_to_hrn(root_cred_signer.get_urn())
         root_cred_signer_type = root_cred_signer.get_type()

-        if (root_cred_signer_type == 'authority'):
-            #sfa_logger.debug('Cred signer is an authority')
+        if (root_cred_signer_type.find('authority') == 0):
+            #logger.debug('Cred signer is an authority')

             # signer is an authority, see if target is in authority's domain
             # signer is an authority, see if target is in authority's domain

-            hrn = root_cred_signer.get_hrn()
-            if root_target_gid.get_hrn().startswith(hrn):
+            signerhrn = root_cred_signer.get_hrn()
+            if hrn_authfor_hrn(signerhrn, root_target_gid.get_hrn()):

                 return
 
         # We've required that the credential be signed by an authority
                 return
 
         # We've required that the credential be signed by an authority


@@ -875,26 +982,27 @@ class Credential(object):
     # . The expiry time on the child must be no later than the parent
     # . The signer of the child must be the owner of the parent        
     def verify_parent(self, parent_cred):
     # . The expiry time on the child must be no later than the parent
     # . The signer of the child must be the owner of the parent        
     def verify_parent(self, parent_cred):

+        #print>>sys.stderr, " \r\n\r\n \t verify_parent parent_cred.get_gid_caller().save_to_string(False) %s  self.get_signature().get_issuer_gid().save_to_string(False) %s" %(parent_cred.get_gid_caller().get_hrn(),self.get_signature().get_issuer_gid().get_hrn())

         # make sure the rights given to the child are a subset of the
         # parents rights (and check delegate bits)
         if not parent_cred.get_privileges().is_superset(self.get_privileges()):
         # make sure the rights given to the child are a subset of the
         # parents rights (and check delegate bits)
         if not parent_cred.get_privileges().is_superset(self.get_privileges()):

-            raise ChildRightsNotSubsetOfParent(("Parent cred ref %s rights " % self.parent.get_refid()) + 
-                self.parent.get_privileges().save_to_string() + (" not superset of delegated cred ref %s rights " % self.get_refid()) +
+            raise ChildRightsNotSubsetOfParent(("Parent cred ref %s rights " % parent_cred.get_refid()) +
+                self.parent.get_privileges().save_to_string() + (" not superset of delegated cred %s ref %s rights " % (self.get_summary_tostring(), self.get_refid())) +

                 self.get_privileges().save_to_string())
 
         # make sure my target gid is the same as the parent's
         if not parent_cred.get_gid_object().save_to_string() == \
            self.get_gid_object().save_to_string():
                 self.get_privileges().save_to_string())
 
         # make sure my target gid is the same as the parent's
         if not parent_cred.get_gid_object().save_to_string() == \
            self.get_gid_object().save_to_string():

-            raise CredentialNotVerifiable("Target gid not equal between parent and child")
+            raise CredentialNotVerifiable("Delegated cred %s: Target gid not equal between parent and child. Parent %s" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))

 
         # make sure my expiry time is <= my parent's
         if not parent_cred.get_expiration() >= self.get_expiration():
 
         # make sure my expiry time is <= my parent's
         if not parent_cred.get_expiration() >= self.get_expiration():

-            raise CredentialNotVerifiable("Delegated credential expires after parent")
+            raise CredentialNotVerifiable("Delegated credential %s expires after parent %s" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))

 
         # make sure my signer is the parent's caller
         if not parent_cred.get_gid_caller().save_to_string(False) == \
            self.get_signature().get_issuer_gid().save_to_string(False):
 
         # make sure my signer is the parent's caller
         if not parent_cred.get_gid_caller().save_to_string(False) == \
            self.get_signature().get_issuer_gid().save_to_string(False):

-            raise CredentialNotVerifiable("Delegated credential not signed by parent caller")
+            raise CredentialNotVerifiable("Delegated credential %s not signed by parent %s's caller" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))

                 
         # Recurse
         if parent_cred.parent:
                 
         # Recurse
         if parent_cred.parent:


@@ -934,7 +1042,7 @@ class Credential(object):
     # only informative
     def get_filename(self):
         return getattr(self,'filename',None)
     # only informative
     def get_filename(self):
         return getattr(self,'filename',None)

- 
+

     ##
     # Dump the contents of a credential to stdout in human-readable format
     #
     ##
     # Dump the contents of a credential to stdout in human-readable format
     #


@@ -965,6 +1073,6 @@ class Credential(object):
 
         if self.parent and dump_parents:
             result += "\nPARENT"
 
         if self.parent and dump_parents:
             result += "\nPARENT"

-            result += self.parent.dump(True)
+            result += self.parent.dump_string(True)

 
         return result
 
         return result