fix speaks for auth

diff --git a/sfa/trust/abac_credential.py b/sfa/trust/abac_credential.py
new file mode 100644 (file)
index 0000000..8f957ec
--- /dev/null
+++ b/sfa/trust/abac_credential.py
@@ -0,0 +1,278 @@
+#----------------------------------------------------------------------\r
+# Copyright (c) 2014 Raytheon BBN Technologies\r
+#\r
+# Permission is hereby granted, free of charge, to any person obtaining\r
+# a copy of this software and/or hardware specification (the "Work") to\r
+# deal in the Work without restriction, including without limitation the\r
+# rights to use, copy, modify, merge, publish, distribute, sublicense,\r
+# and/or sell copies of the Work, and to permit persons to whom the Work\r
+# is furnished to do so, subject to the following conditions:\r
+#\r
+# The above copyright notice and this permission notice shall be\r
+# included in all copies or substantial portions of the Work.\r
+#\r
+# THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS\r
+# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\r
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\r
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\r
+# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\r
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\r
+# OUT OF OR IN CONNECTION WITH THE WORK OR THE USE OR OTHER DEALINGS\r
+# IN THE WORK.\r
+#----------------------------------------------------------------------\r
+\r
+from sfa.trust.credential import Credential, append_sub\r
+from sfa.util.sfalogging import logger\r
+\r
+from StringIO import StringIO\r
+from xml.dom.minidom import Document, parseString\r
+\r
+HAVELXML = False\r
+try:\r
+    from lxml import etree\r
+    HAVELXML = True\r
+except:\r
+    pass\r
+\r
+# This module defines a subtype of sfa.trust,credential.Credential\r
+# called an ABACCredential. An ABAC credential is a signed statement\r
+# asserting a role representing the relationship between a subject and target\r
+# or between a subject and a class of targets (all those satisfying a role).\r
+#\r
+# An ABAC credential is like a normal SFA credential in that it has\r
+# a validated signature block and is checked for expiration. \r
+# It does not, however, have 'privileges'. Rather it contains a 'head' and\r
+# list of 'tails' of elements, each of which represents a principal and\r
+# role.\r
+\r
+# A special case of an ABAC credential is a speaks_for credential. Such\r
+# a credential is simply an ABAC credential in form, but has a single \r
+# tail and fixed role 'speaks_for'. In ABAC notation, it asserts\r
+# AGENT.speaks_for(AGENT)<-CLIENT, or "AGENT asserts that CLIENT may speak\r
+# for AGENT". The AGENT in this case is the head and the CLIENT is the\r
+# tail and 'speaks_for_AGENT' is the role on the head. These speaks-for\r
+# Credentials are used to allow a tool to 'speak as' itself but be recognized\r
+# as speaking for an individual and be authorized to the rights of that\r
+# individual and not to the rights of the tool itself.\r
+\r
+# For more detail on the semantics and syntax and expected usage patterns\r
+# of ABAC credentials, see http://groups.geni.net/geni/wiki/TIEDABACCredential.\r
+\r
+\r
+# An ABAC element contains a principal (keyid and optional mnemonic)\r
+# and optional role and linking_role element\r
+class ABACElement:\r
+    def __init__(self, principal_keyid, principal_mnemonic=None, \\r
+                     role=None, linking_role=None):\r
+        self._principal_keyid = principal_keyid\r
+        self._principal_mnemonic = principal_mnemonic\r
+        self._role = role\r
+        self._linking_role = linking_role\r
+\r
+    def get_principal_keyid(self): return self._principal_keyid\r
+    def get_principal_mnemonic(self): return self._principal_mnemonic\r
+    def get_role(self): return self._role\r
+    def get_linking_role(self): return self._linking_role\r
+\r
+    def __str__(self):\r
+        ret = self._principal_keyid\r
+        if self._principal_mnemonic:\r
+            ret = "%s (%s)" % (self._principal_mnemonic, self._principal_keyid)\r
+        if self._linking_role:\r
+            ret += ".%s" % self._linking_role\r
+        if self._role:\r
+            ret += ".%s" % self._role\r
+        return ret\r
+\r
+# Subclass of Credential for handling ABAC credentials\r
+# They have a different cred_type (geni_abac vs. geni_sfa)\r
+# and they have a head and tail and role (as opposed to privileges)\r
+class ABACCredential(Credential):\r
+\r
+    ABAC_CREDENTIAL_TYPE = 'geni_abac'\r
+\r
+    def __init__(self, create=False, subject=None, \r
+                 string=None, filename=None):\r
+        self.head = None # An ABACElemenet\r
+        self.tails = [] # List of ABACElements\r
+        super(ABACCredential, self).__init__(create=create, \r
+                                             subject=subject, \r
+                                             string=string, \r
+                                             filename=filename)\r
+        self.cred_type = ABACCredential.ABAC_CREDENTIAL_TYPE\r
+\r
+    def get_head(self) : \r
+        if not self.head: \r
+            self.decode()\r
+        return self.head\r
+\r
+    def get_tails(self) : \r
+        if len(self.tails) == 0:\r
+            self.decode()\r
+        return self.tails\r
+\r
+    def decode(self):\r
+        super(ABACCredential, self).decode()\r
+        # Pull out the ABAC-specific info\r
+        doc = parseString(self.xml)\r
+        rt0s = doc.getElementsByTagName('rt0')\r
+        if len(rt0s) != 1:\r
+            raise CredentialNotVerifiable("ABAC credential had no rt0 element")\r
+        rt0_root = rt0s[0]\r
+        heads = self._get_abac_elements(rt0_root, 'head')\r
+        if len(heads) != 1:\r
+            raise CredentialNotVerifiable("ABAC credential should have exactly 1 head element, had %d" % len(heads))\r
+\r
+        self.head = heads[0]\r
+        self.tails = self._get_abac_elements(rt0_root, 'tail')\r
+\r
+    def _get_abac_elements(self, root, label):\r
+        abac_elements = []\r
+        elements = root.getElementsByTagName(label)\r
+        for elt in elements:\r
+            keyids = elt.getElementsByTagName('keyid')\r
+            if len(keyids) != 1:\r
+                raise CredentialNotVerifiable("ABAC credential element '%s' should have exactly 1 keyid, had %d." % (label, len(keyids)))\r
+            keyid_elt = keyids[0]\r
+            keyid = keyid_elt.childNodes[0].nodeValue.strip()\r
+\r
+            mnemonic = None\r
+            mnemonic_elts = elt.getElementsByTagName('mnemonic')\r
+            if len(mnemonic_elts) > 0:\r
+                mnemonic = mnemonic_elts[0].childNodes[0].nodeValue.strip()\r
+\r
+            role = None\r
+            role_elts = elt.getElementsByTagName('role')\r
+            if len(role_elts) > 0:\r
+                role = role_elts[0].childNodes[0].nodeValue.strip()\r
+\r
+            linking_role = None\r
+            linking_role_elts = elt.getElementsByTagName('linking_role')\r
+            if len(linking_role_elts) > 0:\r
+                linking_role = linking_role_elts[0].childNodes[0].nodeValue.strip()\r
+\r
+            abac_element = ABACElement(keyid, mnemonic, role, linking_role)\r
+            abac_elements.append(abac_element)\r
+\r
+        return abac_elements\r
+\r
+    def dump_string(self, dump_parents=False, show_xml=False):\r
+        result = "ABAC Credential\n"\r
+        filename=self.get_filename()\r
+        if filename: result += "Filename %s\n"%filename\r
+        if self.expiration:\r
+            result +=  "\texpiration: %s \n" % self.expiration.isoformat()\r
+\r
+        result += "\tHead: %s\n" % self.get_head() \r
+        for tail in self.get_tails():\r
+            result += "\tTail: %s\n" % tail\r
+        if self.get_signature():\r
+            result += "  gidIssuer:\n"\r
+            result += self.get_signature().get_issuer_gid().dump_string(8, dump_parents)\r
+        if show_xml and HAVELXML:\r
+            try:\r
+                tree = etree.parse(StringIO(self.xml))\r
+                aside = etree.tostring(tree, pretty_print=True)\r
+                result += "\nXML:\n\n"\r
+                result += aside\r
+                result += "\nEnd XML\n"\r
+            except:\r
+                import traceback\r
+                print "exc. Credential.dump_string / XML"\r
+                traceback.print_exc()\r
+        return result\r
+\r
+    # sounds like this should be __repr__ instead ??\r
+    # Produce the ABAC assertion. Something like [ABAC cred: Me.role<-You] or similar\r
+    def get_summary_tostring(self):\r
+        result = "[ABAC cred: " + str(self.get_head())\r
+        for tail in self.get_tails():\r
+            result += "<-%s" % str(tail)\r
+        result += "]"\r
+        return result\r
+\r
+    def createABACElement(self, doc, tagName, abacObj):\r
+        kid = abacObj.get_principal_keyid()\r
+        mnem = abacObj.get_principal_mnemonic() # may be None\r
+        role = abacObj.get_role() # may be None\r
+        link = abacObj.get_linking_role() # may be None\r
+        ele = doc.createElement(tagName)\r
+        prin = doc.createElement('ABACprincipal')\r
+        ele.appendChild(prin)\r
+        append_sub(doc, prin, "keyid", kid)\r
+        if mnem:\r
+            append_sub(doc, prin, "mnemonic", mnem)\r
+        if role:\r
+            append_sub(doc, ele, "role", role)\r
+        if link:\r
+            append_sub(doc, ele, "linking_role", link)\r
+        return ele\r
+\r
+    ##\r
+    # Encode the attributes of the credential into an XML string\r
+    # This should be done immediately before signing the credential.\r
+    # WARNING:\r
+    # In general, a signed credential obtained externally should\r
+    # not be changed else the signature is no longer valid.  So, once\r
+    # you have loaded an existing signed credential, do not call encode() or sign() on it.\r
+\r
+    def encode(self):\r
+        # Create the XML document\r
+        doc = Document()\r
+        signed_cred = doc.createElement("signed-credential")\r
+\r
+# Declare namespaces\r
+# Note that credential/policy.xsd are really the PG schemas\r
+# in a PL namespace.\r
+# Note that delegation of credentials between the 2 only really works\r
+# cause those schemas are identical.\r
+# Also note these PG schemas talk about PG tickets and CM policies.\r
+        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")\r
+        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.geni.net/resources/credential/2/credential.xsd")\r
+        signed_cred.setAttribute("xsi:schemaLocation", "http://www.planet-lab.org/resources/sfa/ext/policy/1 http://www.planet-lab.org/resources/sfa/ext/policy/1/policy.xsd")\r
+\r
+# PG says for those last 2:\r
+#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")\r
+#        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")\r
+\r
+        doc.appendChild(signed_cred)\r
+\r
+        # Fill in the <credential> bit\r
+        cred = doc.createElement("credential")\r
+        cred.setAttribute("xml:id", self.get_refid())\r
+        signed_cred.appendChild(cred)\r
+        append_sub(doc, cred, "type", "abac")\r
+\r
+        # Stub fields\r
+        append_sub(doc, cred, "serial", "8")\r
+        append_sub(doc, cred, "owner_gid", '')\r
+        append_sub(doc, cred, "owner_urn", '')\r
+        append_sub(doc, cred, "target_gid", '')\r
+        append_sub(doc, cred, "target_urn", '')\r
+        append_sub(doc, cred, "uuid", "")\r
+\r
+        if not self.expiration:\r
+            self.set_expiration(datetime.datetime.utcnow() + datetime.timedelta(seconds=DEFAULT_CREDENTIAL_LIFETIME))\r
+        self.expiration = self.expiration.replace(microsecond=0)\r
+        if self.expiration.tzinfo is not None and self.expiration.tzinfo.utcoffset(self.expiration) is not None:\r
+            # TZ aware. Make sure it is UTC\r
+            self.expiration = self.expiration.astimezone(tz.tzutc())\r
+        append_sub(doc, cred, "expires", self.expiration.strftime('%Y-%m-%dT%H:%M:%SZ')) # RFC3339\r
+\r
+        abac = doc.createElement("abac")\r
+        rt0 = doc.createElement("rt0")\r
+        abac.appendChild(rt0)\r
+        cred.appendChild(abac)\r
+        append_sub(doc, rt0, "version", "1.1")\r
+        head = self.createABACElement(doc, "head", self.get_head())\r
+        rt0.appendChild(head)\r
+        for tail in self.get_tails():\r
+            tailEle = self.createABACElement(doc, "tail", tail)\r
+            rt0.appendChild(tailEle)\r
+\r
+        # Create the <signatures> tag\r
+        signatures = doc.createElement("signatures")\r
+        signed_cred.appendChild(signatures)\r
+\r
+        # Get the finished product\r
+        self.xml = doc.toxml("utf-8")\r

diff --git a/sfa/trust/auth.py b/sfa/trust/auth.py
index 0dffa08..f60f408 100644 (file)
--- a/sfa/trust/auth.py
+++ b/sfa/trust/auth.py
@@ -16,6 +16,7 @@ from sfa.trust.credential import Credential
 from sfa.trust.trustedroots import TrustedRoots
 from sfa.trust.hierarchy import Hierarchy
 from sfa.trust.sfaticket import SfaTicket
+from sfa.trust.speaksfor_util import determine_speaks_for
 
 
 class Auth:
@@ -44,38 +45,27 @@ class Auth:
             return error
 
         valid = []
-        speaking_for = options.get('geni_speaking_for', None)
-        speaks_for_cred = None
-
         if not isinstance(creds, list):
             creds = [creds]
-        logger.debug("Auth.checkCredentials with %d creds"%len(creds))
-        for cred in creds:
-            try:
-                self.check(cred, operation, hrn)
-                valid.append(cred)
-            except:
-                # check if credential is a 'speaks for  credential'
-                if speaking_for:
-                    try:
-                        speaking_for_xrn = Xrn(speaking_for)
-                        speaking_for_hrn = speaking_for_xrn.get_hrn()     
-                        self.check(cred, operation, speaking_for_hrn)
-                        speaks_for_cred = cred
-                        valid.append(cred)    
-                    except:
-                        error = log_invalid_cred(cred)
-                else:
+
+        # if speaks for gid matches caller cert then we've found a valid
+        # speaks for credential      
+        speaks_for_gid = determine_speaks_for(logger, creds, self.peer_cert, \
+                                              options, self.trusted_cert_list)
+        if self.peer_cert and \
+           self.peer_cert.is_pubkey(speaks_for_gid.get_pubkey()):
+            valid = creds
+        else:
+            for cred in creds:
+                try:
+                    self.check(cred, operation, hrn)
+                    valid.append(cred)
+                except:
                     error = log_invalid_cred(cred)
-                continue
-            
-        if not len(valid):
-            raise InsufficientRights('Access denied: %s -- %s' % (error[0],error[1]))
-        
-        if speaking_for and not speaks_for_cred:
-            raise InsufficientRights('Access denied: "geni_speaking_for" option specified but no valid speaks for credential found: %s -- %s' % (error[0],error[1]))
+                
+            if not len(valid):
+                raise InsufficientRights('Access denied: %s -- %s' % (error[0],error[1]))
             
-        
         return valid
         
         

diff --git a/sfa/trust/credential.py b/sfa/trust/credential.py
index ac8e5b7..070b71b 100644 (file)
--- a/sfa/trust/credential.py
+++ b/sfa/trust/credential.py
@@ -1,1085 +1,1147 @@
-#----------------------------------------------------------------------
-# Copyright (c) 2008 Board of Trustees, Princeton University
-#
-# Permission is hereby granted, free of charge, to any person obtaining
-# a copy of this software and/or hardware specification (the "Work") to
-# deal in the Work without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense,
-# and/or sell copies of the Work, and to permit persons to whom the Work
-# is furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be
-# included in all copies or substantial portions of the Work.
-#
-# THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 
-# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
-# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT 
-# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 
-# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 
-# OUT OF OR IN CONNECTION WITH THE WORK OR THE USE OR OTHER DEALINGS 
-# IN THE WORK.
-#----------------------------------------------------------------------
-##
-# Implements SFA Credentials
-#
-# Credentials are signed XML files that assign a subject gid privileges to an object gid
-##
-
-import os
-from types import StringTypes
-import datetime
-from StringIO import StringIO
-from tempfile import mkstemp
-from xml.dom.minidom import Document, parseString
-
-HAVELXML = False
-try:
-    from lxml import etree
-    HAVELXML = True
-except:
-    pass
-
-from xml.parsers.expat import ExpatError
-
-from sfa.util.faults import CredentialNotVerifiable, ChildRightsNotSubsetOfParent
-from sfa.util.sfalogging import logger
-from sfa.util.sfatime import utcparse
-from sfa.trust.credential_legacy import CredentialLegacy
-from sfa.trust.rights import Right, Rights, determine_rights
-from sfa.trust.gid import GID
-from sfa.util.xrn import urn_to_hrn, hrn_authfor_hrn
-
-# 2 weeks, in seconds 
-DEFAULT_CREDENTIAL_LIFETIME = 86400 * 31
-
-
-# TODO:
-# . make privs match between PG and PL
-# . Need to add support for other types of credentials, e.g. tickets
-# . add namespaces to signed-credential element?
-
-signature_template = \
-'''
-<Signature xml:id="Sig_%s" xmlns="http://www.w3.org/2000/09/xmldsig#">
-  <SignedInfo>
-    <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
-    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
-    <Reference URI="#%s">
-      <Transforms>
-        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
-      </Transforms>
-      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
-      <DigestValue></DigestValue>
-    </Reference>
-  </SignedInfo>
-  <SignatureValue />
-  <KeyInfo>
-    <X509Data>
-      <X509SubjectName/>
-      <X509IssuerSerial/>
-      <X509Certificate/>
-    </X509Data>
-    <KeyValue />
-  </KeyInfo>
-</Signature>
-'''
-
-# PG formats the template (whitespace) slightly differently.
-# Note that they don't include the xmlns in the template, but add it later.
-# Otherwise the two are equivalent.
-#signature_template_as_in_pg = \
-#'''
-#<Signature xml:id="Sig_%s" >
-# <SignedInfo>
-#  <CanonicalizationMethod      Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
-#  <SignatureMethod      Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
-#  <Reference URI="#%s">
-#    <Transforms>
-#      <Transform         Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
-#    </Transforms>
-#    <DigestMethod        Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
-#    <DigestValue></DigestValue>
-#    </Reference>
-# </SignedInfo>
-# <SignatureValue />
-# <KeyInfo>
-#  <X509Data >
-#   <X509SubjectName/>
-#   <X509IssuerSerial/>
-#   <X509Certificate/>
-#  </X509Data>
-#  <KeyValue />
-# </KeyInfo>
-#</Signature>
-#'''
-
-##
-# Convert a string into a bool
-# used to convert an xsd:boolean to a Python boolean
-def str2bool(str):
-    if str.lower() in ['true','1']:
-        return True
-    return False
-
-
-##
-# Utility function to get the text of an XML element
-
-def getTextNode(element, subele):
-    sub = element.getElementsByTagName(subele)[0]
-    if len(sub.childNodes) > 0:            
-        return sub.childNodes[0].nodeValue
-    else:
-        return None
-        
-##
-# Utility function to set the text of an XML element
-# It creates the element, adds the text to it,
-# and then appends it to the parent.
-
-def append_sub(doc, parent, element, text):
-    ele = doc.createElement(element)
-    ele.appendChild(doc.createTextNode(text))
-    parent.appendChild(ele)
-
-##
-# Signature contains information about an xmlsec1 signature
-# for a signed-credential
-#
-
-class Signature(object):
-   
-    def __init__(self, string=None):
-        self.refid = None
-        self.issuer_gid = None
-        self.xml = None
-        if string:
-            self.xml = string
-            self.decode()
-
-
-    def get_refid(self):
-        if not self.refid:
-            self.decode()
-        return self.refid
-
-    def get_xml(self):
-        if not self.xml:
-            self.encode()
-        return self.xml
-
-    def set_refid(self, id):
-        self.refid = id
-
-    def get_issuer_gid(self):
-        if not self.gid:
-            self.decode()
-        return self.gid        
-
-    def set_issuer_gid(self, gid):
-        self.gid = gid
-
-    def decode(self):
-        try:
-            doc = parseString(self.xml)
-        except ExpatError,e:
-            logger.log_exc ("Failed to parse credential, %s"%self.xml)
-            raise
-        sig = doc.getElementsByTagName("Signature")[0]
-        self.set_refid(sig.getAttribute("xml:id").strip("Sig_"))
-        keyinfo = sig.getElementsByTagName("X509Data")[0]
-        szgid = getTextNode(keyinfo, "X509Certificate")
-        szgid = "-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----" % szgid
-        self.set_issuer_gid(GID(string=szgid))        
-        
-    def encode(self):
-        self.xml = signature_template % (self.get_refid(), self.get_refid())
-
-
-##
-# A credential provides a caller gid with privileges to an object gid.
-# A signed credential is signed by the object's authority.
-#
-# Credentials are encoded in one of two ways.  The legacy style places
-# it in the subjectAltName of an X509 certificate.  The new credentials
-# are placed in signed XML.
-#
-# WARNING:
-# In general, a signed credential obtained externally should
-# not be changed else the signature is no longer valid.  So, once
-# you have loaded an existing signed credential, do not call encode() or sign() on it.
-
-def filter_creds_by_caller(creds, caller_hrn_list):
-        """
-        Returns a list of creds who's gid caller matches the
-        specified caller hrn
-        """
-        if not isinstance(creds, list): creds = [creds]
-        if not isinstance(caller_hrn_list, list): 
-            caller_hrn_list = [caller_hrn_list]
-        caller_creds = []
-        for cred in creds:
-            try:
-                tmp_cred = Credential(string=cred)
-                if tmp_cred.get_gid_caller().get_hrn() in caller_hrn_list:
-                    caller_creds.append(cred)
-            except: pass
-        return caller_creds
-
-class Credential(object):
-
-    ##
-    # Create a Credential object
-    #
-    # @param create If true, create a blank x509 certificate
-    # @param subject If subject!=None, create an x509 cert with the subject name
-    # @param string If string!=None, load the credential from the string
-    # @param filename If filename!=None, load the credential from the file
-    # FIXME: create and subject are ignored!
-    def __init__(self, create=False, subject=None, string=None, filename=None):
-        self.gidCaller = None
-        self.gidObject = None
-        self.expiration = None
-        self.privileges = None
-        self.issuer_privkey = None
-        self.issuer_gid = None
-        self.issuer_pubkey = None
-        self.parent = None
-        self.signature = None
-        self.xml = None
-        self.refid = None
-        self.legacy = None
-
-        # Check if this is a legacy credential, translate it if so
-        if string or filename:
-            if string:                
-                str = string
-            elif filename:
-                str = file(filename).read()
-                
-            if str.strip().startswith("-----"):
-                self.legacy = CredentialLegacy(False,string=str)
-                self.translate_legacy(str)
-            else:
-                self.xml = str
-                self.decode()
-
-        # Find an xmlsec1 path
-        self.xmlsec_path = ''
-        paths = ['/usr/bin','/usr/local/bin','/bin','/opt/bin','/opt/local/bin']
-        for path in paths:
-            if os.path.isfile(path + '/' + 'xmlsec1'):
-                self.xmlsec_path = path + '/' + 'xmlsec1'
-                break
-        if not self.xmlsec_path:
-            logger.warn("Could not locate binary for xmlsec1 - SFA will be unable to sign stuff !!")
-
-    def get_subject(self):
-        if not self.gidObject:
-            self.decode()
-        return self.gidObject.get_subject()
-
-    # sounds like this should be __repr__ instead ??
-    def get_summary_tostring(self):
-        if not self.gidObject:
-            self.decode()
-        obj = self.gidObject.get_printable_subject()
-        caller = self.gidCaller.get_printable_subject()
-        exp = self.get_expiration()
-        # Summarize the rights too? The issuer?
-        return "[ Grant %s rights on %s until %s ]" % (caller, obj, exp)
-
-    def get_signature(self):
-        if not self.signature:
-            self.decode()
-        return self.signature
-
-    def set_signature(self, sig):
-        self.signature = sig
-
-        
-    ##
-    # Translate a legacy credential into a new one
-    #
-    # @param String of the legacy credential
-
-    def translate_legacy(self, str):
-        legacy = CredentialLegacy(False,string=str)
-        self.gidCaller = legacy.get_gid_caller()
-        self.gidObject = legacy.get_gid_object()
-        lifetime = legacy.get_lifetime()
-        if not lifetime:
-            self.set_expiration(datetime.datetime.utcnow() + datetime.timedelta(seconds=DEFAULT_CREDENTIAL_LIFETIME))
-        else:
-            self.set_expiration(int(lifetime))
-        self.lifeTime = legacy.get_lifetime()
-        self.set_privileges(legacy.get_privileges())
-        self.get_privileges().delegate_all_privileges(legacy.get_delegate())
-
-    ##
-    # Need the issuer's private key and name
-    # @param key Keypair object containing the private key of the issuer
-    # @param gid GID of the issuing authority
-
-    def set_issuer_keys(self, privkey, gid):
-        self.issuer_privkey = privkey
-        self.issuer_gid = gid
-
-
-    ##
-    # Set this credential's parent
-    def set_parent(self, cred):
-        self.parent = cred
-        self.updateRefID()
-
-    ##
-    # set the GID of the caller
-    #
-    # @param gid GID object of the caller
-
-    def set_gid_caller(self, gid):
-        self.gidCaller = gid
-        # gid origin caller is the caller's gid by default
-        self.gidOriginCaller = gid
-
-    ##
-    # get the GID of the object
-
-    def get_gid_caller(self):
-        if not self.gidCaller:
-            self.decode()
-        return self.gidCaller
-
-    ##
-    # set the GID of the object
-    #
-    # @param gid GID object of the object
-
-    def set_gid_object(self, gid):
-        self.gidObject = gid
-
-    ##
-    # get the GID of the object
-
-    def get_gid_object(self):
-        if not self.gidObject:
-            self.decode()
-        return self.gidObject
-            
-    ##
-    # Expiration: an absolute UTC time of expiration (as either an int or string or datetime)
-    # 
-    def set_expiration(self, expiration):
-        if isinstance(expiration, (int, float)):
-            self.expiration = datetime.datetime.fromtimestamp(expiration)
-        elif isinstance (expiration, datetime.datetime):
-            self.expiration = expiration
-        elif isinstance (expiration, StringTypes):
-            self.expiration = utcparse (expiration)
-        else:
-            logger.error ("unexpected input type in Credential.set_expiration")
-
-
-    ##
-    # get the lifetime of the credential (always in datetime format)
-
-    def get_expiration(self):
-        if not self.expiration:
-            self.decode()
-        # at this point self.expiration is normalized as a datetime - DON'T call utcparse again
-        return self.expiration
-
-    ##
-    # For legacy sake
-    def get_lifetime(self):
-        return self.get_expiration()
- 
-    ##
-    # set the privileges
-    #
-    # @param privs either a comma-separated list of privileges of a Rights object
-
-    def set_privileges(self, privs):
-        if isinstance(privs, str):
-            self.privileges = Rights(string = privs)
-        else:
-            self.privileges = privs        
-
-    ##
-    # return the privileges as a Rights object
-
-    def get_privileges(self):
-        if not self.privileges:
-            self.decode()
-        return self.privileges
-
-    ##
-    # determine whether the credential allows a particular operation to be
-    # performed
-    #
-    # @param op_name string specifying name of operation ("lookup", "update", etc)
-
-    def can_perform(self, op_name):
-        rights = self.get_privileges()
-        
-        if not rights:
-            return False
-
-        return rights.can_perform(op_name)
-
-
-    ##
-    # Encode the attributes of the credential into an XML string    
-    # This should be done immediately before signing the credential.    
-    # WARNING:
-    # In general, a signed credential obtained externally should
-    # not be changed else the signature is no longer valid.  So, once
-    # you have loaded an existing signed credential, do not call encode() or sign() on it.
-
-    def encode(self):
-        # Create the XML document
-        doc = Document()
-        signed_cred = doc.createElement("signed-credential")
-
-# Declare namespaces
-# Note that credential/policy.xsd are really the PG schemas
-# in a PL namespace.
-# Note that delegation of credentials between the 2 only really works
-# cause those schemas are identical.
-# Also note these PG schemas talk about PG tickets and CM policies.
-        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")
-        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.planet-lab.org/resources/sfa/credential.xsd")
-        signed_cred.setAttribute("xsi:schemaLocation", "http://www.planet-lab.org/resources/sfa/ext/policy/1 http://www.planet-lab.org/resources/sfa/ext/policy/1/policy.xsd")
-
-# PG says for those last 2:
-#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")
-#        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")
-
-        doc.appendChild(signed_cred)  
-        
-        # Fill in the <credential> bit        
-        cred = doc.createElement("credential")
-        cred.setAttribute("xml:id", self.get_refid())
-        signed_cred.appendChild(cred)
-        append_sub(doc, cred, "type", "privilege")
-        append_sub(doc, cred, "serial", "8")
-        append_sub(doc, cred, "owner_gid", self.gidCaller.save_to_string())
-        append_sub(doc, cred, "owner_urn", self.gidCaller.get_urn())
-        append_sub(doc, cred, "target_gid", self.gidObject.save_to_string())
-        append_sub(doc, cred, "target_urn", self.gidObject.get_urn())
-        append_sub(doc, cred, "uuid", "")
-        if not self.expiration:
-            self.set_expiration(datetime.datetime.utcnow() + datetime.timedelta(seconds=DEFAULT_CREDENTIAL_LIFETIME))
-        self.expiration = self.expiration.replace(microsecond=0)
-        append_sub(doc, cred, "expires", self.expiration.isoformat())
-        privileges = doc.createElement("privileges")
-        cred.appendChild(privileges)
-
-        if self.privileges:
-            rights = self.get_privileges()
-            for right in rights.rights:
-                priv = doc.createElement("privilege")
-                append_sub(doc, priv, "name", right.kind)
-                append_sub(doc, priv, "can_delegate", str(right.delegate).lower())
-                privileges.appendChild(priv)
-
-        # Add the parent credential if it exists
-        if self.parent:
-            sdoc = parseString(self.parent.get_xml())
-            # If the root node is a signed-credential (it should be), then
-            # get all its attributes and attach those to our signed_cred
-            # node.
-            # Specifically, PG and PLadd attributes for namespaces (which is reasonable),
-            # and we need to include those again here or else their signature
-            # no longer matches on the credential.
-            # We expect three of these, but here we copy them all:
-#        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")
-# and from PG (PL is equivalent, as shown above):
-#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")
-#        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")
-
-            # HOWEVER!
-            # PL now also declares these, with different URLs, so
-            # the code notices those attributes already existed with
-            # different values, and complains.
-            # This happens regularly on delegation now that PG and
-            # PL both declare the namespace with different URLs.
-            # If the content ever differs this is a problem,
-            # but for now it works - different URLs (values in the attributes)
-            # but the same actual schema, so using the PG schema
-            # on delegated-to-PL credentials works fine.
-
-            # Note: you could also not copy attributes
-            # which already exist. It appears that both PG and PL
-            # will actually validate a slicecred with a parent
-            # signed using PG namespaces and a child signed with PL
-            # namespaces over the whole thing. But I don't know
-            # if that is a bug in xmlsec1, an accident since
-            # the contents of the schemas are the same,
-            # or something else, but it seems odd. And this works.
-            parentRoot = sdoc.documentElement
-            if parentRoot.tagName == "signed-credential" and parentRoot.hasAttributes():
-                for attrIx in range(0, parentRoot.attributes.length):
-                    attr = parentRoot.attributes.item(attrIx)
-                    # returns the old attribute of same name that was
-                    # on the credential
-                    # Below throws InUse exception if we forgot to clone the attribute first
-                    oldAttr = signed_cred.setAttributeNode(attr.cloneNode(True))
-                    if oldAttr and oldAttr.value != attr.value:
-                        msg = "Delegating cred from owner %s to %s over %s:\n - Replaced attribute %s value '%s' with '%s'" % (self.parent.gidCaller.get_urn(), self.gidCaller.get_urn(), self.gidObject.get_urn(), oldAttr.name, oldAttr.value, attr.value)
-                        logger.warn(msg)
-                        #raise CredentialNotVerifiable("Can't encode new valid delegated credential: %s" % msg)
-
-            p_cred = doc.importNode(sdoc.getElementsByTagName("credential")[0], True)
-            p = doc.createElement("parent")
-            p.appendChild(p_cred)
-            cred.appendChild(p)
-        # done handling parent credential
-
-        # Create the <signatures> tag
-        signatures = doc.createElement("signatures")
-        signed_cred.appendChild(signatures)
-
-        # Add any parent signatures
-        if self.parent:
-            for cur_cred in self.get_credential_list()[1:]:
-                sdoc = parseString(cur_cred.get_signature().get_xml())
-                ele = doc.importNode(sdoc.getElementsByTagName("Signature")[0], True)
-                signatures.appendChild(ele)
-                
-        # Get the finished product
-        self.xml = doc.toxml()
-
-
-    def save_to_random_tmp_file(self):       
-        fp, filename = mkstemp(suffix='cred', text=True)
-        fp = os.fdopen(fp, "w")
-        self.save_to_file(filename, save_parents=True, filep=fp)
-        return filename
-    
-    def save_to_file(self, filename, save_parents=True, filep=None):
-        if not self.xml:
-            self.encode()
-        if filep:
-            f = filep 
-        else:
-            f = open(filename, "w")
-        f.write(self.xml)
-        f.close()
-
-    def save_to_string(self, save_parents=True):
-        if not self.xml:
-            self.encode()
-        return self.xml
-
-    def get_refid(self):
-        if not self.refid:
-            self.refid = 'ref0'
-        return self.refid
-
-    def set_refid(self, rid):
-        self.refid = rid
-
-    ##
-    # Figure out what refids exist, and update this credential's id
-    # so that it doesn't clobber the others.  Returns the refids of
-    # the parents.
-    
-    def updateRefID(self):
-        if not self.parent:
-            self.set_refid('ref0')
-            return []
-        
-        refs = []
-
-        next_cred = self.parent
-        while next_cred:
-            refs.append(next_cred.get_refid())
-            if next_cred.parent:
-                next_cred = next_cred.parent
-            else:
-                next_cred = None
-
-        
-        # Find a unique refid for this credential
-        rid = self.get_refid()
-        while rid in refs:
-            val = int(rid[3:])
-            rid = "ref%d" % (val + 1)
-
-        # Set the new refid
-        self.set_refid(rid)
-
-        # Return the set of parent credential ref ids
-        return refs
-
-    def get_xml(self):
-        if not self.xml:
-            self.encode()
-        return self.xml
-
-    ##
-    # Sign the XML file created by encode()
-    #
-    # WARNING:
-    # In general, a signed credential obtained externally should
-    # not be changed else the signature is no longer valid.  So, once
-    # you have loaded an existing signed credential, do not call encode() or sign() on it.
-
-    def sign(self):
-        if not self.issuer_privkey:
-            logger.warn("Cannot sign credential (no private key)")
-            return
-        if not self.issuer_gid:
-            logger.warn("Cannot sign credential (no issuer gid)")
-            return
-        doc = parseString(self.get_xml())
-        sigs = doc.getElementsByTagName("signatures")[0]
-
-        # Create the signature template to be signed
-        signature = Signature()
-        signature.set_refid(self.get_refid())
-        sdoc = parseString(signature.get_xml())        
-        sig_ele = doc.importNode(sdoc.getElementsByTagName("Signature")[0], True)
-        sigs.appendChild(sig_ele)
-
-        self.xml = doc.toxml()
-
-
-        # Split the issuer GID into multiple certificates if it's a chain
-        chain = GID(filename=self.issuer_gid)
-        gid_files = []
-        while chain:
-            gid_files.append(chain.save_to_random_tmp_file(False))
-            if chain.get_parent():
-                chain = chain.get_parent()
-            else:
-                chain = None
-
-
-        # Call out to xmlsec1 to sign it
-        ref = 'Sig_%s' % self.get_refid()
-        filename = self.save_to_random_tmp_file()
-        command='%s --sign --node-id "%s" --privkey-pem %s,%s %s' \
-            % (self.xmlsec_path, ref, self.issuer_privkey, ",".join(gid_files), filename)
-#        print 'command',command
-        signed = os.popen(command).read()
-        os.remove(filename)
-
-        for gid_file in gid_files:
-            os.remove(gid_file)
-
-        self.xml = signed
-
-        # This is no longer a legacy credential
-        if self.legacy:
-            self.legacy = None
-
-        # Update signatures
-        self.decode()       
-
-        
-    ##
-    # Retrieve the attributes of the credential from the XML.
-    # This is automatically called by the various get_* methods of
-    # this class and should not need to be called explicitly.
-
-    def decode(self):
-        if not self.xml:
-            return
-        doc = parseString(self.xml)
-        sigs = []
-        signed_cred = doc.getElementsByTagName("signed-credential")
-
-        # Is this a signed-cred or just a cred?
-        if len(signed_cred) > 0:
-            creds = signed_cred[0].getElementsByTagName("credential")
-            signatures = signed_cred[0].getElementsByTagName("signatures")
-            if len(signatures) > 0:
-                sigs = signatures[0].getElementsByTagName("Signature")
-        else:
-            creds = doc.getElementsByTagName("credential")
-        
-        if creds is None or len(creds) == 0:
-            # malformed cred file
-            raise CredentialNotVerifiable("Malformed XML: No credential tag found")
-
-        # Just take the first cred if there are more than one
-        cred = creds[0]
-
-        self.set_refid(cred.getAttribute("xml:id"))
-        self.set_expiration(utcparse(getTextNode(cred, "expires")))
-        self.gidCaller = GID(string=getTextNode(cred, "owner_gid"))
-        self.gidObject = GID(string=getTextNode(cred, "target_gid"))   
-
-
-        # Process privileges
-        privs = cred.getElementsByTagName("privileges")[0]
-        rlist = Rights()
-        for priv in privs.getElementsByTagName("privilege"):
-            kind = getTextNode(priv, "name")
-            deleg = str2bool(getTextNode(priv, "can_delegate"))
-            if kind == '*':
-                # Convert * into the default privileges for the credential's type
-                # Each inherits the delegatability from the * above
-                _ , type = urn_to_hrn(self.gidObject.get_urn())
-                rl = determine_rights(type, self.gidObject.get_urn())
-                for r in rl.rights:
-                    r.delegate = deleg
-                    rlist.add(r)
-            else:
-                rlist.add(Right(kind.strip(), deleg))
-        self.set_privileges(rlist)
-
-
-        # Is there a parent?
-        parent = cred.getElementsByTagName("parent")
-        if len(parent) > 0:
-            parent_doc = parent[0].getElementsByTagName("credential")[0]
-            parent_xml = parent_doc.toxml()
-            self.parent = Credential(string=parent_xml)
-            self.updateRefID()
-
-        # Assign the signatures to the credentials
-        for sig in sigs:
-            Sig = Signature(string=sig.toxml())
-
-            for cur_cred in self.get_credential_list():
-                if cur_cred.get_refid() == Sig.get_refid():
-                    cur_cred.set_signature(Sig)
-                                    
-            
-    ##
-    # Verify
-    #   trusted_certs: A list of trusted GID filenames (not GID objects!) 
-    #                  Chaining is not supported within the GIDs by xmlsec1.
-    #
-    #   trusted_certs_required: Should usually be true. Set False means an
-    #                 empty list of trusted_certs would still let this method pass.
-    #                 It just skips xmlsec1 verification et al. Only used by some utils
-    #    
-    # Verify that:
-    # . All of the signatures are valid and that the issuers trace back
-    #   to trusted roots (performed by xmlsec1)
-    # . The XML matches the credential schema
-    # . That the issuer of the credential is the authority in the target's urn
-    #    . In the case of a delegated credential, this must be true of the root
-    # . That all of the gids presented in the credential are valid
-    #    . Including verifying GID chains, and includ the issuer
-    # . The credential is not expired
-    #
-    # -- For Delegates (credentials with parents)
-    # . The privileges must be a subset of the parent credentials
-    # . The privileges must have "can_delegate" set for each delegated privilege
-    # . The target gid must be the same between child and parents
-    # . The expiry time on the child must be no later than the parent
-    # . The signer of the child must be the owner of the parent
-    #
-    # -- Verify does *NOT*
-    # . ensure that an xmlrpc client's gid matches a credential gid, that
-    #   must be done elsewhere
-    #
-    # @param trusted_certs: The certificates of trusted CA certificates
-    def verify(self, trusted_certs=None, schema=None, trusted_certs_required=True):
-        if not self.xml:
-            self.decode()
-
-        # validate against RelaxNG schema
-        if HAVELXML and not self.legacy:
-            if schema and os.path.exists(schema):
-                tree = etree.parse(StringIO(self.xml))
-                schema_doc = etree.parse(schema)
-                xmlschema = etree.XMLSchema(schema_doc)
-                if not xmlschema.validate(tree):
-                    error = xmlschema.error_log.last_error
-                    message = "%s: %s (line %s)" % (self.get_summary_tostring(), error.message, error.line)
-                    raise CredentialNotVerifiable(message)
-
-        if trusted_certs_required and trusted_certs is None:
-            trusted_certs = []
-
-#        trusted_cert_objects = [GID(filename=f) for f in trusted_certs]
-        trusted_cert_objects = []
-        ok_trusted_certs = []
-        # If caller explicitly passed in None that means skip cert chain validation.
-        # Strange and not typical
-        if trusted_certs is not None:
-            for f in trusted_certs:
-                try:
-                    # Failures here include unreadable files
-                    # or non PEM files
-                    trusted_cert_objects.append(GID(filename=f))
-                    ok_trusted_certs.append(f)
-                except Exception, exc:
-                    logger.error("Failed to load trusted cert from %s: %r"%( f, exc))
-            trusted_certs = ok_trusted_certs
-
-        # Use legacy verification if this is a legacy credential
-        if self.legacy:
-            self.legacy.verify_chain(trusted_cert_objects)
-            if self.legacy.client_gid:
-                self.legacy.client_gid.verify_chain(trusted_cert_objects)
-            if self.legacy.object_gid:
-                self.legacy.object_gid.verify_chain(trusted_cert_objects)
-            return True
-        
-        # make sure it is not expired
-        if self.get_expiration() < datetime.datetime.utcnow():
-            raise CredentialNotVerifiable("Credential %s expired at %s" % (self.get_summary_tostring(), self.expiration.isoformat()))
-
-        # Verify the signatures
-        filename = self.save_to_random_tmp_file()
-        if trusted_certs is not None:
-            cert_args = " ".join(['--trusted-pem %s' % x for x in trusted_certs])
-
-        # If caller explicitly passed in None that means skip cert chain validation.
-        # - Strange and not typical
-        if trusted_certs is not None:
-            # Verify the gids of this cred and of its parents
-            for cur_cred in self.get_credential_list():
-                cur_cred.get_gid_object().verify_chain(trusted_cert_objects)
-                cur_cred.get_gid_caller().verify_chain(trusted_cert_objects)
-
-        refs = []
-        refs.append("Sig_%s" % self.get_refid())
-
-        parentRefs = self.updateRefID()
-        for ref in parentRefs:
-            refs.append("Sig_%s" % ref)
-
-        for ref in refs:
-            # If caller explicitly passed in None that means skip xmlsec1 validation.
-            # Strange and not typical
-            if trusted_certs is None:
-                break
-
-#            print "Doing %s --verify --node-id '%s' %s %s 2>&1" % \
-#                (self.xmlsec_path, ref, cert_args, filename)
-            verified = os.popen('%s --verify --node-id "%s" %s %s 2>&1' \
-                            % (self.xmlsec_path, ref, cert_args, filename)).read()
-            if not verified.strip().startswith("OK"):
-                # xmlsec errors have a msg= which is the interesting bit.
-                mstart = verified.find("msg=")
-                msg = ""
-                if mstart > -1 and len(verified) > 4:
-                    mstart = mstart + 4
-                    mend = verified.find('\\', mstart)
-                    msg = verified[mstart:mend]
-                raise CredentialNotVerifiable("xmlsec1 error verifying cred %s using Signature ID %s: %s %s" % (self.get_summary_tostring(), ref, msg, verified.strip()))
-        os.remove(filename)
-
-        # Verify the parents (delegation)
-        if self.parent:
-            self.verify_parent(self.parent)
-
-        # Make sure the issuer is the target's authority, and is
-        # itself a valid GID
-        self.verify_issuer(trusted_cert_objects)
-        return True
-
-    ##
-    # Creates a list of the credential and its parents, with the root 
-    # (original delegated credential) as the last item in the list
-    def get_credential_list(self):    
-        cur_cred = self
-        list = []
-        while cur_cred:
-            list.append(cur_cred)
-            if cur_cred.parent:
-                cur_cred = cur_cred.parent
-            else:
-                cur_cred = None
-        return list
-    
-    ##
-    # Make sure the credential's target gid (a) was signed by or (b)
-    # is the same as the entity that signed the original credential,
-    # or (c) is an authority over the target's namespace.
-    # Also ensure that the credential issuer / signer itself has a valid
-    # GID signature chain (signed by an authority with namespace rights).
-    def verify_issuer(self, trusted_gids):
-        root_cred = self.get_credential_list()[-1]
-        root_target_gid = root_cred.get_gid_object()
-        root_cred_signer = root_cred.get_signature().get_issuer_gid()
-
-        # Case 1:
-        # Allow non authority to sign target and cred about target.
-        #
-        # Why do we need to allow non authorities to sign?
-        # If in the target gid validation step we correctly
-        # checked that the target is only signed by an authority,
-        # then this is just a special case of case 3.
-        # This short-circuit is the common case currently -
-        # and cause GID validation doesn't check 'authority',
-        # this allows users to generate valid slice credentials.
-        if root_target_gid.is_signed_by_cert(root_cred_signer):
-            # cred signer matches target signer, return success
-            return
-
-        # Case 2:
-        # Allow someone to sign credential about themeselves. Used?
-        # If not, remove this.
-        #root_target_gid_str = root_target_gid.save_to_string()
-        #root_cred_signer_str = root_cred_signer.save_to_string()
-        #if root_target_gid_str == root_cred_signer_str:
-        #    # cred signer is target, return success
-        #    return
-
-        # Case 3:
-
-        # root_cred_signer is not the target_gid
-        # So this is a different gid that we have not verified.
-        # xmlsec1 verified the cert chain on this already, but
-        # it hasn't verified that the gid meets the HRN namespace
-        # requirements.
-        # Below we'll ensure that it is an authority.
-        # But we haven't verified that it is _signed by_ an authority
-        # We also don't know if xmlsec1 requires that cert signers
-        # are marked as CAs.
-
-        # Note that if verify() gave us no trusted_gids then this
-        # call will fail. So skip it if we have no trusted_gids
-        if trusted_gids and len(trusted_gids) > 0:
-            root_cred_signer.verify_chain(trusted_gids)
-        else:
-            logger.debug("No trusted gids. Cannot verify that cred signer is signed by a trusted authority. Skipping that check.")
-
-        # See if the signer is an authority over the domain of the target.
-        # There are multiple types of authority - accept them all here
-        # Maybe should be (hrn, type) = urn_to_hrn(root_cred_signer.get_urn())
-        root_cred_signer_type = root_cred_signer.get_type()
-        if (root_cred_signer_type.find('authority') == 0):
-            #logger.debug('Cred signer is an authority')
-            # signer is an authority, see if target is in authority's domain
-            signerhrn = root_cred_signer.get_hrn()
-            if hrn_authfor_hrn(signerhrn, root_target_gid.get_hrn()):
-                return
-
-        # We've required that the credential be signed by an authority
-        # for that domain. Reasonable and probably correct.
-        # A looser model would also allow the signer to be an authority
-        # in my control framework - eg My CA or CH. Even if it is not
-        # the CH that issued these, eg, user credentials.
-
-        # Give up, credential does not pass issuer verification
-
-        raise CredentialNotVerifiable("Could not verify credential owned by %s for object %s. Cred signer %s not the trusted authority for Cred target %s" % (self.gidCaller.get_urn(), self.gidObject.get_urn(), root_cred_signer.get_hrn(), root_target_gid.get_hrn()))
-
-
-    ##
-    # -- For Delegates (credentials with parents) verify that:
-    # . The privileges must be a subset of the parent credentials
-    # . The privileges must have "can_delegate" set for each delegated privilege
-    # . The target gid must be the same between child and parents
-    # . The expiry time on the child must be no later than the parent
-    # . The signer of the child must be the owner of the parent        
-    def verify_parent(self, parent_cred):
-        # make sure the rights given to the child are a subset of the
-        # parents rights (and check delegate bits)
-        if not parent_cred.get_privileges().is_superset(self.get_privileges()):
-            raise ChildRightsNotSubsetOfParent(("Parent cred ref %s rights " % parent_cred.get_refid()) +
-                self.parent.get_privileges().save_to_string() + (" not superset of delegated cred %s ref %s rights " % (self.get_summary_tostring(), self.get_refid())) +
-                self.get_privileges().save_to_string())
-
-        # make sure my target gid is the same as the parent's
-        if not parent_cred.get_gid_object().save_to_string() == \
-           self.get_gid_object().save_to_string():
-            raise CredentialNotVerifiable("Delegated cred %s: Target gid not equal between parent and child. Parent %s" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))
-
-        # make sure my expiry time is <= my parent's
-        if not parent_cred.get_expiration() >= self.get_expiration():
-            raise CredentialNotVerifiable("Delegated credential %s expires after parent %s" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))
-
-        # make sure my signer is the parent's caller
-        if not parent_cred.get_gid_caller().save_to_string(False) == \
-           self.get_signature().get_issuer_gid().save_to_string(False):
-            raise CredentialNotVerifiable("Delegated credential %s not signed by parent %s's caller" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))
-                
-        # Recurse
-        if parent_cred.parent:
-            parent_cred.verify_parent(parent_cred.parent)
-
-
-    def delegate(self, delegee_gidfile, caller_keyfile, caller_gidfile):
-        """
-        Return a delegated copy of this credential, delegated to the 
-        specified gid's user.    
-        """
-        # get the gid of the object we are delegating
-        object_gid = self.get_gid_object()
-        object_hrn = object_gid.get_hrn()        
- 
-        # the hrn of the user who will be delegated to
-        delegee_gid = GID(filename=delegee_gidfile)
-        delegee_hrn = delegee_gid.get_hrn()
-  
-        #user_key = Keypair(filename=keyfile)
-        #user_hrn = self.get_gid_caller().get_hrn()
-        subject_string = "%s delegated to %s" % (object_hrn, delegee_hrn)
-        dcred = Credential(subject=subject_string)
-        dcred.set_gid_caller(delegee_gid)
-        dcred.set_gid_object(object_gid)
-        dcred.set_parent(self)
-        dcred.set_expiration(self.get_expiration())
-        dcred.set_privileges(self.get_privileges())
-        dcred.get_privileges().delegate_all_privileges(True)
-        #dcred.set_issuer_keys(keyfile, delegee_gidfile)
-        dcred.set_issuer_keys(caller_keyfile, caller_gidfile)
-        dcred.encode()
-        dcred.sign()
-
-        return dcred
-
-    # only informative
-    def get_filename(self):
-        return getattr(self,'filename',None)
-
-    ##
-    # Dump the contents of a credential to stdout in human-readable format
-    #
-    # @param dump_parents If true, also dump the parent certificates
-    def dump (self, *args, **kwargs):
-        print self.dump_string(*args, **kwargs)
-
-
-    def dump_string(self, dump_parents=False, show_xml=False):
-        result=""
-        result += "CREDENTIAL %s\n" % self.get_subject()
-        filename=self.get_filename()
-        if filename: result += "Filename %s\n"%filename
-        result += "      privs: %s\n" % self.get_privileges().save_to_string()
-        gidCaller = self.get_gid_caller()
-        if gidCaller:
-            result += "  gidCaller:\n"
-            result += gidCaller.dump_string(8, dump_parents)
-
-        if self.get_signature():
-            print "  gidIssuer:"
-            self.get_signature().get_issuer_gid().dump(8, dump_parents)
-
-        if self.expiration:
-            print "  expiration:", self.expiration.isoformat()
-
-        gidObject = self.get_gid_object()
-        if gidObject:
-            result += "  gidObject:\n"
-            result += gidObject.dump_string(8, dump_parents)
-
-        if self.parent and dump_parents:
-            result += "\nPARENT"
-            result += self.parent.dump_string(True)
-
-        if show_xml:
-            try:
-                tree = etree.parse(StringIO(self.xml))
-                aside = etree.tostring(tree, pretty_print=True)
-                result += "\nXML\n"
-                result += aside
-                result += "\nEnd XML\n"
-            except:
-                import traceback
-                print "exc. Credential.dump_string / XML"
-                traceback.print_exc()
-
-        return result
+#----------------------------------------------------------------------\r
+# Copyright (c) 2008 Board of Trustees, Princeton University\r
+#\r
+# Permission is hereby granted, free of charge, to any person obtaining\r
+# a copy of this software and/or hardware specification (the "Work") to\r
+# deal in the Work without restriction, including without limitation the\r
+# rights to use, copy, modify, merge, publish, distribute, sublicense,\r
+# and/or sell copies of the Work, and to permit persons to whom the Work\r
+# is furnished to do so, subject to the following conditions:\r
+#\r
+# The above copyright notice and this permission notice shall be\r
+# included in all copies or substantial portions of the Work.\r
+#\r
+# THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS \r
+# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF \r
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND \r
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT \r
+# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, \r
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, \r
+# OUT OF OR IN CONNECTION WITH THE WORK OR THE USE OR OTHER DEALINGS \r
+# IN THE WORK.\r
+#----------------------------------------------------------------------\r
+##\r
+# Implements SFA Credentials\r
+#\r
+# Credentials are signed XML files that assign a subject gid privileges to an object gid\r
+##\r
+\r
+import os\r
+from types import StringTypes\r
+import datetime\r
+from StringIO import StringIO\r
+from tempfile import mkstemp\r
+from xml.dom.minidom import Document, parseString\r
+\r
+HAVELXML = False\r
+try:\r
+    from lxml import etree\r
+    HAVELXML = True\r
+except:\r
+    pass\r
+\r
+from xml.parsers.expat import ExpatError\r
+\r
+from sfa.util.faults import CredentialNotVerifiable, ChildRightsNotSubsetOfParent\r
+from sfa.util.sfalogging import logger\r
+from sfa.util.sfatime import utcparse\r
+from sfa.trust.credential_legacy import CredentialLegacy\r
+from sfa.trust.rights import Right, Rights, determine_rights\r
+from sfa.trust.gid import GID\r
+from sfa.util.xrn import urn_to_hrn, hrn_authfor_hrn\r
+\r
+# 2 weeks, in seconds \r
+DEFAULT_CREDENTIAL_LIFETIME = 86400 * 31\r
+\r
+\r
+# TODO:\r
+# . make privs match between PG and PL\r
+# . Need to add support for other types of credentials, e.g. tickets\r
+# . add namespaces to signed-credential element?\r
+\r
+signature_template = \\r
+'''\r
+<Signature xml:id="Sig_%s" xmlns="http://www.w3.org/2000/09/xmldsig#">\r
+  <SignedInfo>\r
+    <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>\r
+    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>\r
+    <Reference URI="#%s">\r
+      <Transforms>\r
+        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />\r
+      </Transforms>\r
+      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>\r
+      <DigestValue></DigestValue>\r
+    </Reference>\r
+  </SignedInfo>\r
+  <SignatureValue />\r
+  <KeyInfo>\r
+    <X509Data>\r
+      <X509SubjectName/>\r
+      <X509IssuerSerial/>\r
+      <X509Certificate/>\r
+    </X509Data>\r
+    <KeyValue />\r
+  </KeyInfo>\r
+</Signature>\r
+'''\r
+\r
+# PG formats the template (whitespace) slightly differently.\r
+# Note that they don't include the xmlns in the template, but add it later.\r
+# Otherwise the two are equivalent.\r
+#signature_template_as_in_pg = \\r
+#'''\r
+#<Signature xml:id="Sig_%s" >\r
+# <SignedInfo>\r
+#  <CanonicalizationMethod      Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>\r
+#  <SignatureMethod      Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>\r
+#  <Reference URI="#%s">\r
+#    <Transforms>\r
+#      <Transform         Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />\r
+#    </Transforms>\r
+#    <DigestMethod        Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>\r
+#    <DigestValue></DigestValue>\r
+#    </Reference>\r
+# </SignedInfo>\r
+# <SignatureValue />\r
+# <KeyInfo>\r
+#  <X509Data >\r
+#   <X509SubjectName/>\r
+#   <X509IssuerSerial/>\r
+#   <X509Certificate/>\r
+#  </X509Data>\r
+#  <KeyValue />\r
+# </KeyInfo>\r
+#</Signature>\r
+#'''\r
+\r
+##\r
+# Convert a string into a bool\r
+# used to convert an xsd:boolean to a Python boolean\r
+def str2bool(str):\r
+    if str.lower() in ['true','1']:\r
+        return True\r
+    return False\r
+\r
+\r
+##\r
+# Utility function to get the text of an XML element\r
+\r
+def getTextNode(element, subele):\r
+    sub = element.getElementsByTagName(subele)[0]\r
+    if len(sub.childNodes) > 0:            \r
+        return sub.childNodes[0].nodeValue\r
+    else:\r
+        return None\r
+        \r
+##\r
+# Utility function to set the text of an XML element\r
+# It creates the element, adds the text to it,\r
+# and then appends it to the parent.\r
+\r
+def append_sub(doc, parent, element, text):\r
+    ele = doc.createElement(element)\r
+    ele.appendChild(doc.createTextNode(text))\r
+    parent.appendChild(ele)\r
+\r
+##\r
+# Signature contains information about an xmlsec1 signature\r
+# for a signed-credential\r
+#\r
+\r
+class Signature(object):\r
+   \r
+    def __init__(self, string=None):\r
+        self.refid = None\r
+        self.issuer_gid = None\r
+        self.xml = None\r
+        if string:\r
+            self.xml = string\r
+            self.decode()\r
+\r
+\r
+    def get_refid(self):\r
+        if not self.refid:\r
+            self.decode()\r
+        return self.refid\r
+\r
+    def get_xml(self):\r
+        if not self.xml:\r
+            self.encode()\r
+        return self.xml\r
+\r
+    def set_refid(self, id):\r
+        self.refid = id\r
+\r
+    def get_issuer_gid(self):\r
+        if not self.gid:\r
+            self.decode()\r
+        return self.gid        \r
+\r
+    def set_issuer_gid(self, gid):\r
+        self.gid = gid\r
+\r
+    def decode(self):\r
+        try:\r
+            doc = parseString(self.xml)\r
+        except ExpatError,e:\r
+            logger.log_exc ("Failed to parse credential, %s"%self.xml)\r
+            raise\r
+        sig = doc.getElementsByTagName("Signature")[0]\r
+        ref_id = sig.getAttribute("xml:id").strip().strip("Sig_")\r
+        # The xml:id tag is optional, and could be in a \r
+        # Reference xml:id or Reference UID sub element instead\r
+        if not ref_id or ref_id == '':\r
+            reference = sig.getElementsByTagName('Reference')[0]\r
+            ref_id = reference.getAttribute('xml:id').strip().strip('Sig_')\r
+            if not ref_id or ref_id == '':\r
+                ref_id = reference.getAttribute('URI').strip().strip('#')\r
+        self.set_refid(ref_id)\r
+        keyinfos = sig.getElementsByTagName("X509Data")\r
+        gids = None\r
+        for keyinfo in keyinfos:\r
+            certs = keyinfo.getElementsByTagName("X509Certificate")\r
+            for cert in certs:\r
+                if len(cert.childNodes) > 0:\r
+                    szgid = cert.childNodes[0].nodeValue\r
+                    szgid = szgid.strip()\r
+                    szgid = "-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----" % szgid\r
+                    if gids is None:\r
+                        gids = szgid\r
+                    else:\r
+                        gids += "\n" + szgid\r
+        if gids is None:\r
+            raise CredentialNotVerifiable("Malformed XML: No certificate found in signature")\r
+        self.set_issuer_gid(GID(string=gids))\r
+        \r
+    def encode(self):\r
+        self.xml = signature_template % (self.get_refid(), self.get_refid())\r
+\r
+\r
+##\r
+# A credential provides a caller gid with privileges to an object gid.\r
+# A signed credential is signed by the object's authority.\r
+#\r
+# Credentials are encoded in one of two ways.  The legacy style places\r
+# it in the subjectAltName of an X509 certificate.  The new credentials\r
+# are placed in signed XML.\r
+#\r
+# WARNING:\r
+# In general, a signed credential obtained externally should\r
+# not be changed else the signature is no longer valid.  So, once\r
+# you have loaded an existing signed credential, do not call encode() or sign() on it.\r
+\r
+def filter_creds_by_caller(creds, caller_hrn_list):\r
+        """\r
+        Returns a list of creds who's gid caller matches the\r
+        specified caller hrn\r
+        """\r
+        if not isinstance(creds, list): creds = [creds]\r
+        if not isinstance(caller_hrn_list, list): \r
+            caller_hrn_list = [caller_hrn_list]\r
+        caller_creds = []\r
+        for cred in creds:\r
+            try:\r
+                tmp_cred = Credential(string=cred)\r
+                if tmp_cred.get_cred_type() != Credential.SFA_CREDENTIAL_TYPE:\r
+                    continue\r
+                if tmp_cred.get_gid_caller().get_hrn() in caller_hrn_list:\r
+                    caller_creds.append(cred)\r
+            except: pass\r
+        return caller_creds\r
+\r
+class Credential(object):\r
+\r
+    SFA_CREDENTIAL_TYPE = "geni_sfa"\r
+\r
+    ##\r
+    # Create a Credential object\r
+    #\r
+    # @param create If true, create a blank x509 certificate\r
+    # @param subject If subject!=None, create an x509 cert with the subject name\r
+    # @param string If string!=None, load the credential from the string\r
+    # @param filename If filename!=None, load the credential from the file\r
+    # FIXME: create and subject are ignored!\r
+    def __init__(self, create=False, subject=None, string=None, filename=None):\r
+        self.gidCaller = None\r
+        self.gidObject = None\r
+        self.expiration = None\r
+        self.privileges = None\r
+        self.issuer_privkey = None\r
+        self.issuer_gid = None\r
+        self.issuer_pubkey = None\r
+        self.parent = None\r
+        self.signature = None\r
+        self.xml = None\r
+        self.refid = None\r
+        self.legacy = None\r
+        self.cred_type = Credential.SFA_CREDENTIAL_TYPE\r
+\r
+        # Check if this is a legacy credential, translate it if so\r
+        if string or filename:\r
+            if string:                \r
+                str = string\r
+            elif filename:\r
+                str = file(filename).read()\r
+                \r
+            if str.strip().startswith("-----"):\r
+                self.legacy = CredentialLegacy(False,string=str)\r
+                self.translate_legacy(str)\r
+            else:\r
+                self.xml = str\r
+                self.decode()\r
+\r
+        # Find an xmlsec1 path\r
+        self.xmlsec_path = ''\r
+        paths = ['/usr/bin','/usr/local/bin','/bin','/opt/bin','/opt/local/bin']\r
+        for path in paths:\r
+            if os.path.isfile(path + '/' + 'xmlsec1'):\r
+                self.xmlsec_path = path + '/' + 'xmlsec1'\r
+                break\r
+        if not self.xmlsec_path:\r
+            logger.warn("Could not locate binary for xmlsec1 - SFA will be unable to sign stuff !!")\r
+\r
+    def get_cred_type(self): \r
+        return self.cred_type\r
+\r
+    def get_subject(self):\r
+        if not self.gidObject:\r
+            self.decode()\r
+        return self.gidObject.get_subject()\r
+\r
+    # sounds like this should be __repr__ instead ??\r
+    def get_summary_tostring(self):\r
+        if not self.gidObject:\r
+            self.decode()\r
+        obj = self.gidObject.get_printable_subject()\r
+        caller = self.gidCaller.get_printable_subject()\r
+        exp = self.get_expiration()\r
+        # Summarize the rights too? The issuer?\r
+        return "[ Grant %s rights on %s until %s ]" % (caller, obj, exp)\r
+\r
+    def get_signature(self):\r
+        if not self.signature:\r
+            self.decode()\r
+        return self.signature\r
+\r
+    def set_signature(self, sig):\r
+        self.signature = sig\r
+\r
+        \r
+    ##\r
+    # Translate a legacy credential into a new one\r
+    #\r
+    # @param String of the legacy credential\r
+\r
+    def translate_legacy(self, str):\r
+        legacy = CredentialLegacy(False,string=str)\r
+        self.gidCaller = legacy.get_gid_caller()\r
+        self.gidObject = legacy.get_gid_object()\r
+        lifetime = legacy.get_lifetime()\r
+        if not lifetime:\r
+            self.set_expiration(datetime.datetime.utcnow() + datetime.timedelta(seconds=DEFAULT_CREDENTIAL_LIFETIME))\r
+        else:\r
+            self.set_expiration(int(lifetime))\r
+        self.lifeTime = legacy.get_lifetime()\r
+        self.set_privileges(legacy.get_privileges())\r
+        self.get_privileges().delegate_all_privileges(legacy.get_delegate())\r
+\r
+    ##\r
+    # Need the issuer's private key and name\r
+    # @param key Keypair object containing the private key of the issuer\r
+    # @param gid GID of the issuing authority\r
+\r
+    def set_issuer_keys(self, privkey, gid):\r
+        self.issuer_privkey = privkey\r
+        self.issuer_gid = gid\r
+\r
+\r
+    ##\r
+    # Set this credential's parent\r
+    def set_parent(self, cred):\r
+        self.parent = cred\r
+        self.updateRefID()\r
+\r
+    ##\r
+    # set the GID of the caller\r
+    #\r
+    # @param gid GID object of the caller\r
+\r
+    def set_gid_caller(self, gid):\r
+        self.gidCaller = gid\r
+        # gid origin caller is the caller's gid by default\r
+        self.gidOriginCaller = gid\r
+\r
+    ##\r
+    # get the GID of the object\r
+\r
+    def get_gid_caller(self):\r
+        if not self.gidCaller:\r
+            self.decode()\r
+        return self.gidCaller\r
+\r
+    ##\r
+    # set the GID of the object\r
+    #\r
+    # @param gid GID object of the object\r
+\r
+    def set_gid_object(self, gid):\r
+        self.gidObject = gid\r
+\r
+    ##\r
+    # get the GID of the object\r
+\r
+    def get_gid_object(self):\r
+        if not self.gidObject:\r
+            self.decode()\r
+        return self.gidObject\r
+            \r
+    ##\r
+    # Expiration: an absolute UTC time of expiration (as either an int or string or datetime)\r
+    # \r
+    def set_expiration(self, expiration):\r
+        if isinstance(expiration, (int, float)):\r
+            self.expiration = datetime.datetime.fromtimestamp(expiration)\r
+        elif isinstance (expiration, datetime.datetime):\r
+            self.expiration = expiration\r
+        elif isinstance (expiration, StringTypes):\r
+            self.expiration = utcparse (expiration)\r
+        else:\r
+            logger.error ("unexpected input type in Credential.set_expiration")\r
+\r
+\r
+    ##\r
+    # get the lifetime of the credential (always in datetime format)\r
+\r
+    def get_expiration(self):\r
+        if not self.expiration:\r
+            self.decode()\r
+        # at this point self.expiration is normalized as a datetime - DON'T call utcparse again\r
+        return self.expiration\r
+\r
+    ##\r
+    # For legacy sake\r
+    def get_lifetime(self):\r
+        return self.get_expiration()\r
+ \r
+    ##\r
+    # set the privileges\r
+    #\r
+    # @param privs either a comma-separated list of privileges of a Rights object\r
+\r
+    def set_privileges(self, privs):\r
+        if isinstance(privs, str):\r
+            self.privileges = Rights(string = privs)\r
+        else:\r
+            self.privileges = privs        \r
+\r
+    ##\r
+    # return the privileges as a Rights object\r
+\r
+    def get_privileges(self):\r
+        if not self.privileges:\r
+            self.decode()\r
+        return self.privileges\r
+\r
+    ##\r
+    # determine whether the credential allows a particular operation to be\r
+    # performed\r
+    #\r
+    # @param op_name string specifying name of operation ("lookup", "update", etc)\r
+\r
+    def can_perform(self, op_name):\r
+        rights = self.get_privileges()\r
+        \r
+        if not rights:\r
+            return False\r
+\r
+        return rights.can_perform(op_name)\r
+\r
+\r
+    ##\r
+    # Encode the attributes of the credential into an XML string    \r
+    # This should be done immediately before signing the credential.    \r
+    # WARNING:\r
+    # In general, a signed credential obtained externally should\r
+    # not be changed else the signature is no longer valid.  So, once\r
+    # you have loaded an existing signed credential, do not call encode() or sign() on it.\r
+\r
+    def encode(self):\r
+        # Create the XML document\r
+        doc = Document()\r
+        signed_cred = doc.createElement("signed-credential")\r
+\r
+# Declare namespaces\r
+# Note that credential/policy.xsd are really the PG schemas\r
+# in a PL namespace.\r
+# Note that delegation of credentials between the 2 only really works\r
+# cause those schemas are identical.\r
+# Also note these PG schemas talk about PG tickets and CM policies.\r
+        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")\r
+        # FIXME: See v2 schema at www.geni.net/resources/credential/2/credential.xsd\r
+        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.planet-lab.org/resources/sfa/credential.xsd")\r
+        signed_cred.setAttribute("xsi:schemaLocation", "http://www.planet-lab.org/resources/sfa/ext/policy/1 http://www.planet-lab.org/resources/sfa/ext/policy/1/policy.xsd")\r
+\r
+# PG says for those last 2:\r
+#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")\r
+#        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")\r
+\r
+        doc.appendChild(signed_cred)  \r
+        \r
+        # Fill in the <credential> bit        \r
+        cred = doc.createElement("credential")\r
+        cred.setAttribute("xml:id", self.get_refid())\r
+        signed_cred.appendChild(cred)\r
+        append_sub(doc, cred, "type", "privilege")\r
+        append_sub(doc, cred, "serial", "8")\r
+        append_sub(doc, cred, "owner_gid", self.gidCaller.save_to_string())\r
+        append_sub(doc, cred, "owner_urn", self.gidCaller.get_urn())\r
+        append_sub(doc, cred, "target_gid", self.gidObject.save_to_string())\r
+        append_sub(doc, cred, "target_urn", self.gidObject.get_urn())\r
+        append_sub(doc, cred, "uuid", "")\r
+        if not self.expiration:\r
+            self.set_expiration(datetime.datetime.utcnow() + datetime.timedelta(seconds=DEFAULT_CREDENTIAL_LIFETIME))\r
+        self.expiration = self.expiration.replace(microsecond=0)\r
+        if self.expiration.tzinfo is not None and self.expiration.tzinfo.utcoffset(self.expiration) is not None:\r
+            # TZ aware. Make sure it is UTC\r
+            self.expiration = self.expiration.astimezone(tz.tzutc())\r
+        append_sub(doc, cred, "expires", self.expiration.strftime('%Y-%m-%dT%H:%M:%SZ')) # RFC3339\r
+        privileges = doc.createElement("privileges")\r
+        cred.appendChild(privileges)\r
+\r
+        if self.privileges:\r
+            rights = self.get_privileges()\r
+            for right in rights.rights:\r
+                priv = doc.createElement("privilege")\r
+                append_sub(doc, priv, "name", right.kind)\r
+                append_sub(doc, priv, "can_delegate", str(right.delegate).lower())\r
+                privileges.appendChild(priv)\r
+\r
+        # Add the parent credential if it exists\r
+        if self.parent:\r
+            sdoc = parseString(self.parent.get_xml())\r
+            # If the root node is a signed-credential (it should be), then\r
+            # get all its attributes and attach those to our signed_cred\r
+            # node.\r
+            # Specifically, PG and PLadd attributes for namespaces (which is reasonable),\r
+            # and we need to include those again here or else their signature\r
+            # no longer matches on the credential.\r
+            # We expect three of these, but here we copy them all:\r
+#        signed_cred.setAttribute("xmlns:xsi", "http://www.w3.org/2001/XMLSchema-instance")\r
+# and from PG (PL is equivalent, as shown above):\r
+#        signed_cred.setAttribute("xsi:noNamespaceSchemaLocation", "http://www.protogeni.net/resources/credential/credential.xsd")\r
+#        signed_cred.setAttribute("xsi:schemaLocation", "http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd")\r
+\r
+            # HOWEVER!\r
+            # PL now also declares these, with different URLs, so\r
+            # the code notices those attributes already existed with\r
+            # different values, and complains.\r
+            # This happens regularly on delegation now that PG and\r
+            # PL both declare the namespace with different URLs.\r
+            # If the content ever differs this is a problem,\r
+            # but for now it works - different URLs (values in the attributes)\r
+            # but the same actual schema, so using the PG schema\r
+            # on delegated-to-PL credentials works fine.\r
+\r
+            # Note: you could also not copy attributes\r
+            # which already exist. It appears that both PG and PL\r
+            # will actually validate a slicecred with a parent\r
+            # signed using PG namespaces and a child signed with PL\r
+            # namespaces over the whole thing. But I don't know\r
+            # if that is a bug in xmlsec1, an accident since\r
+            # the contents of the schemas are the same,\r
+            # or something else, but it seems odd. And this works.\r
+            parentRoot = sdoc.documentElement\r
+            if parentRoot.tagName == "signed-credential" and parentRoot.hasAttributes():\r
+                for attrIx in range(0, parentRoot.attributes.length):\r
+                    attr = parentRoot.attributes.item(attrIx)\r
+                    # returns the old attribute of same name that was\r
+                    # on the credential\r
+                    # Below throws InUse exception if we forgot to clone the attribute first\r
+                    oldAttr = signed_cred.setAttributeNode(attr.cloneNode(True))\r
+                    if oldAttr and oldAttr.value != attr.value:\r
+                        msg = "Delegating cred from owner %s to %s over %s:\n - Replaced attribute %s value '%s' with '%s'" % (self.parent.gidCaller.get_urn(), self.gidCaller.get_urn(), self.gidObject.get_urn(), oldAttr.name, oldAttr.value, attr.value)\r
+                        logger.warn(msg)\r
+                        #raise CredentialNotVerifiable("Can't encode new valid delegated credential: %s" % msg)\r
+\r
+            p_cred = doc.importNode(sdoc.getElementsByTagName("credential")[0], True)\r
+            p = doc.createElement("parent")\r
+            p.appendChild(p_cred)\r
+            cred.appendChild(p)\r
+        # done handling parent credential\r
+\r
+        # Create the <signatures> tag\r
+        signatures = doc.createElement("signatures")\r
+        signed_cred.appendChild(signatures)\r
+\r
+        # Add any parent signatures\r
+        if self.parent:\r
+            for cur_cred in self.get_credential_list()[1:]:\r
+                sdoc = parseString(cur_cred.get_signature().get_xml())\r
+                ele = doc.importNode(sdoc.getElementsByTagName("Signature")[0], True)\r
+                signatures.appendChild(ele)\r
+                \r
+        # Get the finished product\r
+        self.xml = doc.toxml("utf-8")\r
+\r
+\r
+    def save_to_random_tmp_file(self):       \r
+        fp, filename = mkstemp(suffix='cred', text=True)\r
+        fp = os.fdopen(fp, "w")\r
+        self.save_to_file(filename, save_parents=True, filep=fp)\r
+        return filename\r
+    \r
+    def save_to_file(self, filename, save_parents=True, filep=None):\r
+        if not self.xml:\r
+            self.encode()\r
+        if filep:\r
+            f = filep \r
+        else:\r
+            f = open(filename, "w")\r
+        f.write(self.xml)\r
+        f.close()\r
+\r
+    def save_to_string(self, save_parents=True):\r
+        if not self.xml:\r
+            self.encode()\r
+        return self.xml\r
+\r
+    def get_refid(self):\r
+        if not self.refid:\r
+            self.refid = 'ref0'\r
+        return self.refid\r
+\r
+    def set_refid(self, rid):\r
+        self.refid = rid\r
+\r
+    ##\r
+    # Figure out what refids exist, and update this credential's id\r
+    # so that it doesn't clobber the others.  Returns the refids of\r
+    # the parents.\r
+    \r
+    def updateRefID(self):\r
+        if not self.parent:\r
+            self.set_refid('ref0')\r
+            return []\r
+        \r
+        refs = []\r
+\r
+        next_cred = self.parent\r
+        while next_cred:\r
+            refs.append(next_cred.get_refid())\r
+            if next_cred.parent:\r
+                next_cred = next_cred.parent\r
+            else:\r
+                next_cred = None\r
+\r
+        \r
+        # Find a unique refid for this credential\r
+        rid = self.get_refid()\r
+        while rid in refs:\r
+            val = int(rid[3:])\r
+            rid = "ref%d" % (val + 1)\r
+\r
+        # Set the new refid\r
+        self.set_refid(rid)\r
+\r
+        # Return the set of parent credential ref ids\r
+        return refs\r
+\r
+    def get_xml(self):\r
+        if not self.xml:\r
+            self.encode()\r
+        return self.xml\r
+\r
+    ##\r
+    # Sign the XML file created by encode()\r
+    #\r
+    # WARNING:\r
+    # In general, a signed credential obtained externally should\r
+    # not be changed else the signature is no longer valid.  So, once\r
+    # you have loaded an existing signed credential, do not call encode() or sign() on it.\r
+\r
+    def sign(self):\r
+        if not self.issuer_privkey:\r
+            logger.warn("Cannot sign credential (no private key)")\r
+            return\r
+        if not self.issuer_gid:\r
+            logger.warn("Cannot sign credential (no issuer gid)")\r
+            return\r
+        doc = parseString(self.get_xml())\r
+        sigs = doc.getElementsByTagName("signatures")[0]\r
+\r
+        # Create the signature template to be signed\r
+        signature = Signature()\r
+        signature.set_refid(self.get_refid())\r
+        sdoc = parseString(signature.get_xml())        \r
+        sig_ele = doc.importNode(sdoc.getElementsByTagName("Signature")[0], True)\r
+        sigs.appendChild(sig_ele)\r
+\r
+        self.xml = doc.toxml("utf-8")\r
+\r
+\r
+        # Split the issuer GID into multiple certificates if it's a chain\r
+        chain = GID(filename=self.issuer_gid)\r
+        gid_files = []\r
+        while chain:\r
+            gid_files.append(chain.save_to_random_tmp_file(False))\r
+            if chain.get_parent():\r
+                chain = chain.get_parent()\r
+            else:\r
+                chain = None\r
+\r
+\r
+        # Call out to xmlsec1 to sign it\r
+        ref = 'Sig_%s' % self.get_refid()\r
+        filename = self.save_to_random_tmp_file()\r
+        command='%s --sign --node-id "%s" --privkey-pem %s,%s %s' \\r
+            % (self.xmlsec_path, ref, self.issuer_privkey, ",".join(gid_files), filename)\r
+#        print 'command',command\r
+        signed = os.popen(command).read()\r
+        os.remove(filename)\r
+\r
+        for gid_file in gid_files:\r
+            os.remove(gid_file)\r
+\r
+        self.xml = signed\r
+\r
+        # This is no longer a legacy credential\r
+        if self.legacy:\r
+            self.legacy = None\r
+\r
+        # Update signatures\r
+        self.decode()       \r
+\r
+\r
+    ##\r
+    # Retrieve the attributes of the credential from the XML.\r
+    # This is automatically called by the various get_* methods of\r
+    # this class and should not need to be called explicitly.\r
+\r
+    def decode(self):\r
+        if not self.xml:\r
+            return\r
+        doc = parseString(self.xml)\r
+        sigs = []\r
+        signed_cred = doc.getElementsByTagName("signed-credential")\r
+\r
+        # Is this a signed-cred or just a cred?\r
+        if len(signed_cred) > 0:\r
+            creds = signed_cred[0].getElementsByTagName("credential")\r
+            signatures = signed_cred[0].getElementsByTagName("signatures")\r
+            if len(signatures) > 0:\r
+                sigs = signatures[0].getElementsByTagName("Signature")\r
+        else:\r
+            creds = doc.getElementsByTagName("credential")\r
+        \r
+        if creds is None or len(creds) == 0:\r
+            # malformed cred file\r
+            raise CredentialNotVerifiable("Malformed XML: No credential tag found")\r
+\r
+        # Just take the first cred if there are more than one\r
+        cred = creds[0]\r
+\r
+        self.set_refid(cred.getAttribute("xml:id"))\r
+        self.set_expiration(utcparse(getTextNode(cred, "expires")))\r
+\r
+#        import traceback\r
+#        stack = traceback.extract_stack()\r
+\r
+        og = getTextNode(cred, "owner_gid")\r
+        # ABAC creds will have this be None and use this method\r
+#        if og is None:\r
+#            found = False\r
+#            for frame in stack:\r
+#                if 'super(ABACCredential, self).decode()' in frame:\r
+#                    found = True\r
+#                    break\r
+#            if not found:\r
+#                raise CredentialNotVerifiable("Malformed XML: No owner_gid found")\r
+        self.gidCaller = GID(string=og)\r
+        tg = getTextNode(cred, "target_gid")\r
+#        if tg is None:\r
+#            found = False\r
+#            for frame in stack:\r
+#                if 'super(ABACCredential, self).decode()' in frame:\r
+#                    found = True\r
+#                    break\r
+#            if not found:\r
+#                raise CredentialNotVerifiable("Malformed XML: No target_gid found")\r
+        self.gidObject = GID(string=tg)\r
+\r
+        # Process privileges\r
+        rlist = Rights()\r
+        priv_nodes = cred.getElementsByTagName("privileges")\r
+        if len(priv_nodes) > 0:\r
+            privs = priv_nodes[0]\r
+            for priv in privs.getElementsByTagName("privilege"):\r
+                kind = getTextNode(priv, "name")\r
+                deleg = str2bool(getTextNode(priv, "can_delegate"))\r
+                if kind == '*':\r
+                    # Convert * into the default privileges for the credential's type\r
+                    # Each inherits the delegatability from the * above\r
+                    _ , type = urn_to_hrn(self.gidObject.get_urn())\r
+                    rl = determine_rights(type, self.gidObject.get_urn())\r
+                    for r in rl.rights:\r
+                        r.delegate = deleg\r
+                        rlist.add(r)\r
+                else:\r
+                    rlist.add(Right(kind.strip(), deleg))\r
+        self.set_privileges(rlist)\r
+\r
+\r
+        # Is there a parent?\r
+        parent = cred.getElementsByTagName("parent")\r
+        if len(parent) > 0:\r
+            parent_doc = parent[0].getElementsByTagName("credential")[0]\r
+            parent_xml = parent_doc.toxml("utf-8")\r
+            if parent_xml is None or parent_xml.strip() == "":\r
+                raise CredentialNotVerifiable("Malformed XML: Had parent tag but it is empty")\r
+            self.parent = Credential(string=parent_xml)\r
+            self.updateRefID()\r
+\r
+        # Assign the signatures to the credentials\r
+        for sig in sigs:\r
+            Sig = Signature(string=sig.toxml("utf-8"))\r
+\r
+            for cur_cred in self.get_credential_list():\r
+                if cur_cred.get_refid() == Sig.get_refid():\r
+                    cur_cred.set_signature(Sig)\r
+                                    \r
+            \r
+    ##\r
+    # Verify\r
+    #   trusted_certs: A list of trusted GID filenames (not GID objects!) \r
+    #                  Chaining is not supported within the GIDs by xmlsec1.\r
+    #\r
+    #   trusted_certs_required: Should usually be true. Set False means an\r
+    #                 empty list of trusted_certs would still let this method pass.\r
+    #                 It just skips xmlsec1 verification et al. Only used by some utils\r
+    #    \r
+    # Verify that:\r
+    # . All of the signatures are valid and that the issuers trace back\r
+    #   to trusted roots (performed by xmlsec1)\r
+    # . The XML matches the credential schema\r
+    # . That the issuer of the credential is the authority in the target's urn\r
+    #    . In the case of a delegated credential, this must be true of the root\r
+    # . That all of the gids presented in the credential are valid\r
+    #    . Including verifying GID chains, and includ the issuer\r
+    # . The credential is not expired\r
+    #\r
+    # -- For Delegates (credentials with parents)\r
+    # . The privileges must be a subset of the parent credentials\r
+    # . The privileges must have "can_delegate" set for each delegated privilege\r
+    # . The target gid must be the same between child and parents\r
+    # . The expiry time on the child must be no later than the parent\r
+    # . The signer of the child must be the owner of the parent\r
+    #\r
+    # -- Verify does *NOT*\r
+    # . ensure that an xmlrpc client's gid matches a credential gid, that\r
+    #   must be done elsewhere\r
+    #\r
+    # @param trusted_certs: The certificates of trusted CA certificates\r
+    def verify(self, trusted_certs=None, schema=None, trusted_certs_required=True):\r
+        if not self.xml:\r
+            self.decode()\r
+\r
+        # validate against RelaxNG schema\r
+        if HAVELXML and not self.legacy:\r
+            if schema and os.path.exists(schema):\r
+                tree = etree.parse(StringIO(self.xml))\r
+                schema_doc = etree.parse(schema)\r
+                xmlschema = etree.XMLSchema(schema_doc)\r
+                if not xmlschema.validate(tree):\r
+                    error = xmlschema.error_log.last_error\r
+                    message = "%s: %s (line %s)" % (self.get_summary_tostring(), error.message, error.line)\r
+                    raise CredentialNotVerifiable(message)\r
+\r
+        if trusted_certs_required and trusted_certs is None:\r
+            trusted_certs = []\r
+\r
+#        trusted_cert_objects = [GID(filename=f) for f in trusted_certs]\r
+        trusted_cert_objects = []\r
+        ok_trusted_certs = []\r
+        # If caller explicitly passed in None that means skip cert chain validation.\r
+        # Strange and not typical\r
+        if trusted_certs is not None:\r
+            for f in trusted_certs:\r
+                try:\r
+                    # Failures here include unreadable files\r
+                    # or non PEM files\r
+                    trusted_cert_objects.append(GID(filename=f))\r
+                    ok_trusted_certs.append(f)\r
+                except Exception, exc:\r
+                    logger.error("Failed to load trusted cert from %s: %r", f, exc)\r
+            trusted_certs = ok_trusted_certs\r
+\r
+        # Use legacy verification if this is a legacy credential\r
+        if self.legacy:\r
+            self.legacy.verify_chain(trusted_cert_objects)\r
+            if self.legacy.client_gid:\r
+                self.legacy.client_gid.verify_chain(trusted_cert_objects)\r
+            if self.legacy.object_gid:\r
+                self.legacy.object_gid.verify_chain(trusted_cert_objects)\r
+            return True\r
+        \r
+        # make sure it is not expired\r
+        if self.get_expiration() < datetime.datetime.utcnow():\r
+            raise CredentialNotVerifiable("Credential %s expired at %s" % (self.get_summary_tostring(), self.expiration.isoformat()))\r
+\r
+        # Verify the signatures\r
+        filename = self.save_to_random_tmp_file()\r
+        if trusted_certs is not None:\r
+            cert_args = " ".join(['--trusted-pem %s' % x for x in trusted_certs])\r
+\r
+        # If caller explicitly passed in None that means skip cert chain validation.\r
+        # - Strange and not typical\r
+        if trusted_certs is not None:\r
+            # Verify the gids of this cred and of its parents\r
+            for cur_cred in self.get_credential_list():\r
+                cur_cred.get_gid_object().verify_chain(trusted_cert_objects)\r
+                cur_cred.get_gid_caller().verify_chain(trusted_cert_objects)\r
+\r
+        refs = []\r
+        refs.append("Sig_%s" % self.get_refid())\r
+\r
+        parentRefs = self.updateRefID()\r
+        for ref in parentRefs:\r
+            refs.append("Sig_%s" % ref)\r
+\r
+        for ref in refs:\r
+            # If caller explicitly passed in None that means skip xmlsec1 validation.\r
+            # Strange and not typical\r
+            if trusted_certs is None:\r
+                break\r
+\r
+#            print "Doing %s --verify --node-id '%s' %s %s 2>&1" % \\r
+#                (self.xmlsec_path, ref, cert_args, filename)\r
+            verified = os.popen('%s --verify --node-id "%s" %s %s 2>&1' \\r
+                            % (self.xmlsec_path, ref, cert_args, filename)).read()\r
+            if not verified.strip().startswith("OK"):\r
+                # xmlsec errors have a msg= which is the interesting bit.\r
+                mstart = verified.find("msg=")\r
+                msg = ""\r
+                if mstart > -1 and len(verified) > 4:\r
+                    mstart = mstart + 4\r
+                    mend = verified.find('\\', mstart)\r
+                    msg = verified[mstart:mend]\r
+                raise CredentialNotVerifiable("xmlsec1 error verifying cred %s using Signature ID %s: %s %s" % (self.get_summary_tostring(), ref, msg, verified.strip()))\r
+        os.remove(filename)\r
+\r
+        # Verify the parents (delegation)\r
+        if self.parent:\r
+            self.verify_parent(self.parent)\r
+\r
+        # Make sure the issuer is the target's authority, and is\r
+        # itself a valid GID\r
+        self.verify_issuer(trusted_cert_objects)\r
+        return True\r
+\r
+    ##\r
+    # Creates a list of the credential and its parents, with the root \r
+    # (original delegated credential) as the last item in the list\r
+    def get_credential_list(self):    \r
+        cur_cred = self\r
+        list = []\r
+        while cur_cred:\r
+            list.append(cur_cred)\r
+            if cur_cred.parent:\r
+                cur_cred = cur_cred.parent\r
+            else:\r
+                cur_cred = None\r
+        return list\r
+    \r
+    ##\r
+    # Make sure the credential's target gid (a) was signed by or (b)\r
+    # is the same as the entity that signed the original credential,\r
+    # or (c) is an authority over the target's namespace.\r
+    # Also ensure that the credential issuer / signer itself has a valid\r
+    # GID signature chain (signed by an authority with namespace rights).\r
+    def verify_issuer(self, trusted_gids):\r
+        root_cred = self.get_credential_list()[-1]\r
+        root_target_gid = root_cred.get_gid_object()\r
+        if root_cred.get_signature() is None:\r
+            # malformed\r
+            raise CredentialNotVerifiable("Could not verify credential owned by %s for object %s. Cred has no signature" % (self.gidCaller.get_urn(), self.gidObject.get_urn()))\r
+\r
+        root_cred_signer = root_cred.get_signature().get_issuer_gid()\r
+\r
+        # Case 1:\r
+        # Allow non authority to sign target and cred about target.\r
+        #\r
+        # Why do we need to allow non authorities to sign?\r
+        # If in the target gid validation step we correctly\r
+        # checked that the target is only signed by an authority,\r
+        # then this is just a special case of case 3.\r
+        # This short-circuit is the common case currently -\r
+        # and cause GID validation doesn't check 'authority',\r
+        # this allows users to generate valid slice credentials.\r
+        if root_target_gid.is_signed_by_cert(root_cred_signer):\r
+            # cred signer matches target signer, return success\r
+            return\r
+\r
+        # Case 2:\r
+        # Allow someone to sign credential about themeselves. Used?\r
+        # If not, remove this.\r
+        #root_target_gid_str = root_target_gid.save_to_string()\r
+        #root_cred_signer_str = root_cred_signer.save_to_string()\r
+        #if root_target_gid_str == root_cred_signer_str:\r
+        #    # cred signer is target, return success\r
+        #    return\r
+\r
+        # Case 3:\r
+\r
+        # root_cred_signer is not the target_gid\r
+        # So this is a different gid that we have not verified.\r
+        # xmlsec1 verified the cert chain on this already, but\r
+        # it hasn't verified that the gid meets the HRN namespace\r
+        # requirements.\r
+        # Below we'll ensure that it is an authority.\r
+        # But we haven't verified that it is _signed by_ an authority\r
+        # We also don't know if xmlsec1 requires that cert signers\r
+        # are marked as CAs.\r
+\r
+        # Note that if verify() gave us no trusted_gids then this\r
+        # call will fail. So skip it if we have no trusted_gids\r
+        if trusted_gids and len(trusted_gids) > 0:\r
+            root_cred_signer.verify_chain(trusted_gids)\r
+        else:\r
+            logger.debug("No trusted gids. Cannot verify that cred signer is signed by a trusted authority. Skipping that check.")\r
+\r
+        # See if the signer is an authority over the domain of the target.\r
+        # There are multiple types of authority - accept them all here\r
+        # Maybe should be (hrn, type) = urn_to_hrn(root_cred_signer.get_urn())\r
+        root_cred_signer_type = root_cred_signer.get_type()\r
+        if (root_cred_signer_type.find('authority') == 0):\r
+            #logger.debug('Cred signer is an authority')\r
+            # signer is an authority, see if target is in authority's domain\r
+            signerhrn = root_cred_signer.get_hrn()\r
+            if hrn_authfor_hrn(signerhrn, root_target_gid.get_hrn()):\r
+                return\r
+\r
+        # We've required that the credential be signed by an authority\r
+        # for that domain. Reasonable and probably correct.\r
+        # A looser model would also allow the signer to be an authority\r
+        # in my control framework - eg My CA or CH. Even if it is not\r
+        # the CH that issued these, eg, user credentials.\r
+\r
+        # Give up, credential does not pass issuer verification\r
+\r
+        raise CredentialNotVerifiable("Could not verify credential owned by %s for object %s. Cred signer %s not the trusted authority for Cred target %s" % (self.gidCaller.get_urn(), self.gidObject.get_urn(), root_cred_signer.get_hrn(), root_target_gid.get_hrn()))\r
+\r
+\r
+    ##\r
+    # -- For Delegates (credentials with parents) verify that:\r
+    # . The privileges must be a subset of the parent credentials\r
+    # . The privileges must have "can_delegate" set for each delegated privilege\r
+    # . The target gid must be the same between child and parents\r
+    # . The expiry time on the child must be no later than the parent\r
+    # . The signer of the child must be the owner of the parent        \r
+    def verify_parent(self, parent_cred):\r
+        # make sure the rights given to the child are a subset of the\r
+        # parents rights (and check delegate bits)\r
+        if not parent_cred.get_privileges().is_superset(self.get_privileges()):\r
+            raise ChildRightsNotSubsetOfParent(("Parent cred ref %s rights " % parent_cred.get_refid()) +\r
+                self.parent.get_privileges().save_to_string() + (" not superset of delegated cred %s ref %s rights " % (self.get_summary_tostring(), self.get_refid())) +\r
+                self.get_privileges().save_to_string())\r
+\r
+        # make sure my target gid is the same as the parent's\r
+        if not parent_cred.get_gid_object().save_to_string() == \\r
+           self.get_gid_object().save_to_string():\r
+            raise CredentialNotVerifiable("Delegated cred %s: Target gid not equal between parent and child. Parent %s" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))\r
+\r
+        # make sure my expiry time is <= my parent's\r
+        if not parent_cred.get_expiration() >= self.get_expiration():\r
+            raise CredentialNotVerifiable("Delegated credential %s expires after parent %s" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))\r
+\r
+        # make sure my signer is the parent's caller\r
+        if not parent_cred.get_gid_caller().save_to_string(False) == \\r
+           self.get_signature().get_issuer_gid().save_to_string(False):\r
+            raise CredentialNotVerifiable("Delegated credential %s not signed by parent %s's caller" % (self.get_summary_tostring(), parent_cred.get_summary_tostring()))\r
+                \r
+        # Recurse\r
+        if parent_cred.parent:\r
+            parent_cred.verify_parent(parent_cred.parent)\r
+\r
+\r
+    def delegate(self, delegee_gidfile, caller_keyfile, caller_gidfile):\r
+        """\r
+        Return a delegated copy of this credential, delegated to the \r
+        specified gid's user.    \r
+        """\r
+        # get the gid of the object we are delegating\r
+        object_gid = self.get_gid_object()\r
+        object_hrn = object_gid.get_hrn()        \r
+ \r
+        # the hrn of the user who will be delegated to\r
+        delegee_gid = GID(filename=delegee_gidfile)\r
+        delegee_hrn = delegee_gid.get_hrn()\r
+  \r
+        #user_key = Keypair(filename=keyfile)\r
+        #user_hrn = self.get_gid_caller().get_hrn()\r
+        subject_string = "%s delegated to %s" % (object_hrn, delegee_hrn)\r
+        dcred = Credential(subject=subject_string)\r
+        dcred.set_gid_caller(delegee_gid)\r
+        dcred.set_gid_object(object_gid)\r
+        dcred.set_parent(self)\r
+        dcred.set_expiration(self.get_expiration())\r
+        dcred.set_privileges(self.get_privileges())\r
+        dcred.get_privileges().delegate_all_privileges(True)\r
+        #dcred.set_issuer_keys(keyfile, delegee_gidfile)\r
+        dcred.set_issuer_keys(caller_keyfile, caller_gidfile)\r
+        dcred.encode()\r
+        dcred.sign()\r
+\r
+        return dcred\r
+\r
+    # only informative\r
+    def get_filename(self):\r
+        return getattr(self,'filename',None)\r
+\r
+    ##\r
+    # Dump the contents of a credential to stdout in human-readable format\r
+    #\r
+    # @param dump_parents If true, also dump the parent certificates\r
+    def dump (self, *args, **kwargs):\r
+        print self.dump_string(*args, **kwargs)\r
+\r
+\r
+    def dump_string(self, dump_parents=False, show_xml=False):\r
+        result=""\r
+        result += "CREDENTIAL %s\n" % self.get_subject()\r
+        filename=self.get_filename()\r
+        if filename: result += "Filename %s\n"%filename\r
+        result += "      privs: %s\n" % self.get_privileges().save_to_string()\r
+        gidCaller = self.get_gid_caller()\r
+        if gidCaller:\r
+            result += "  gidCaller:\n"\r
+            result += gidCaller.dump_string(8, dump_parents)\r
+\r
+        if self.get_signature():\r
+            result += "  gidIssuer:\n"\r
+            result += self.get_signature().get_issuer_gid().dump_string(8, dump_parents)\r
+\r
+        if self.expiration:\r
+            result += "  expiration: " + self.expiration.isoformat() + "\n"\r
+\r
+        gidObject = self.get_gid_object()\r
+        if gidObject:\r
+            result += "  gidObject:\n"\r
+            result += gidObject.dump_string(8, dump_parents)\r
+\r
+        if self.parent and dump_parents:\r
+            result += "\nPARENT"\r
+            result += self.parent.dump_string(True)\r
+\r
+        if show_xml and HAVELXML:\r
+            try:\r
+                tree = etree.parse(StringIO(self.xml))\r
+                aside = etree.tostring(tree, pretty_print=True)\r
+                result += "\nXML:\n\n"\r
+                result += aside\r
+                result += "\nEnd XML\n"\r
+            except:\r
+                import traceback\r
+                print "exc. Credential.dump_string / XML"\r
+                traceback.print_exc()\r
+\r
+        return result\r

diff --git a/sfa/trust/credential.xsd b/sfa/trust/credential.xsd
index a57b94c..c5f22f4 100644 (file)
--- a/sfa/trust/credential.xsd
+++ b/sfa/trust/credential.xsd
@@ -1,214 +1,290 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  
-  GENIPUBLIC-COPYRIGHT
-  Copyright (c) 2008-2009 University of Utah and the Flux Group.
-  All rights reserved.
-  
--->
-<!--
-  PlanetLab credential specification. The key points:
-  
-  * A credential is a set of privileges or a Ticket, each with a flag
-    to indicate delegation is permitted.
-  * A credential is signed and the signature included in the body of the
-    document.
-  * To support delegation, a credential will include its parent, and that
-    blob will be signed. So, there will be multiple signatures in the
-    document, each with a reference to the credential it signs.
-  
-  default namespace = "http://www.planet-lab.org/resources/ext/credential/1"
--->
-<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" xmlns:sig="http://www.w3.org/2000/09/xmldsig#">
-  <xs:include schemaLocation="protogeni-rspec-common.xsd"/>
-  <xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="sig.xsd"/>
-  <xs:import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>
-  <xs:group name="anyelementbody">
-    <xs:sequence>
-      <xs:any minOccurs="0" maxOccurs="unbounded" processContents="skip"/>
-    </xs:sequence>
-  </xs:group>
-  <xs:attributeGroup name="anyelementbody">
-    <xs:anyAttribute processContents="skip"/>
-  </xs:attributeGroup>
-  <!-- This is where we get the definition of RSpec from -->
-  <xs:element name="privilege">
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element ref="name"/>
-        <xs:element name="can_delegate" type="xs:boolean"/>
-      </xs:sequence>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="name">
-    <xs:simpleType>
-      <xs:restriction base="xs:string">
-        <xs:minLength value="1"/>
-      </xs:restriction>
-    </xs:simpleType>
-  </xs:element>
-  <xs:element name="privileges">
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element minOccurs="0" maxOccurs="unbounded" ref="privilege"/>
-      </xs:sequence>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="capability">
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element ref="name"/>
-        <xs:element name="can_delegate">
-          <xs:simpleType>
-            <xs:restriction base="xs:token">
-              <xs:enumeration value="0"/>
-              <xs:enumeration value="1"/>
-            </xs:restriction>
-          </xs:simpleType>
-        </xs:element>
-      </xs:sequence>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="capabilities">
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element minOccurs="0" maxOccurs="unbounded" ref="capability"/>
-      </xs:sequence>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="ticket">
-    <xs:complexType mixed="true">
-      <xs:sequence>
-        <xs:element name="can_delegate" type="xs:boolean">
-          <xs:annotation>
-            <xs:documentation>Can the ticket be delegated?</xs:documentation>
-          </xs:annotation>
-        </xs:element>
-        <xs:element ref="redeem_before"/>
-        <xs:group ref="anyelementbody">
-          <xs:annotation>
-            <xs:documentation>A desciption of the resources that are being promised</xs:documentation>
-          </xs:annotation>
-        </xs:group>
-      </xs:sequence>
-      <xs:attributeGroup ref="anyelementbody"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="redeem_before" type="xs:dateTime">
-    <xs:annotation>
-      <xs:documentation>The ticket must be "cashed in" by this date </xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="signatures">
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element maxOccurs="unbounded" ref="sig:Signature"/>
-      </xs:sequence>
-    </xs:complexType>
-  </xs:element>
-  <xs:complexType name="credentials">
-    <xs:annotation>
-      <xs:documentation>A credential granting privileges or a ticket.</xs:documentation>
-    </xs:annotation>
-    <xs:sequence>
-      <xs:element ref="credential"/>
-    </xs:sequence>
-  </xs:complexType>
-  <xs:element name="credential">
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element ref="type"/>
-        <xs:element ref="serial"/>
-        <xs:element ref="owner_gid"/>
-        <xs:element minOccurs="0" ref="owner_urn"/>
-        <xs:element ref="target_gid"/>
-        <xs:element minOccurs="0" ref="target_urn"/>
-        <xs:element ref="uuid"/>
-        <xs:element ref="expires"/>
-        <xs:choice>
-          <xs:annotation>
-            <xs:documentation>Privileges or a ticket</xs:documentation>
-          </xs:annotation>
-          <xs:element ref="privileges"/>
-          <xs:element ref="ticket"/>
-          <xs:element ref="capabilities"/>
-        </xs:choice>
-        <xs:element minOccurs="0" maxOccurs="unbounded" ref="extensions"/>
-        <xs:element minOccurs="0" ref="parent"/>
-      </xs:sequence>
-      <xs:attribute ref="xml:id" use="required"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="type">
-    <xs:annotation>
-      <xs:documentation>The type of this credential. Currently a Privilege set or a Ticket.</xs:documentation>
-    </xs:annotation>
-    <xs:simpleType>
-      <xs:restriction base="xs:token">
-        <xs:enumeration value="privilege"/>
-        <xs:enumeration value="ticket"/>
-        <xs:enumeration value="capability"/>
-      </xs:restriction>
-    </xs:simpleType>
-  </xs:element>
-  <xs:element name="serial" type="xs:string">
-    <xs:annotation>
-      <xs:documentation>A serial number.</xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="owner_gid" type="xs:string">
-    <xs:annotation>
-      <xs:documentation>GID of the owner of this credential. </xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="owner_urn" type="xs:string">
-    <xs:annotation>
-      <xs:documentation>URN of the owner. Not everyone can parse DER</xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="target_gid" type="xs:string">
-    <xs:annotation>
-      <xs:documentation>GID of the target of this credential. </xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="target_urn" type="xs:string">
-    <xs:annotation>
-      <xs:documentation>URN of the target.</xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="uuid" type="xs:string">
-    <xs:annotation>
-      <xs:documentation>UUID of this credential</xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="expires" type="xs:dateTime">
-    <xs:annotation>
-      <xs:documentation>Expires on</xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="extensions">
-    <xs:annotation>
-      <xs:documentation>Optional Extensions</xs:documentation>
-    </xs:annotation>
-    <xs:complexType mixed="true">
-      <xs:group ref="anyelementbody"/>
-      <xs:attributeGroup ref="anyelementbody"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="parent" type="credentials">
-    <xs:annotation>
-      <xs:documentation>Parent that delegated to us</xs:documentation>
-    </xs:annotation>
-  </xs:element>
-  <xs:element name="signed-credential">
-    <xs:complexType>
-      <xs:complexContent>
-        <xs:extension base="credentials">
-          <xs:sequence>
-            <xs:element minOccurs="0" ref="signatures"/>
-          </xs:sequence>
-        </xs:extension>
-      </xs:complexContent>
-    </xs:complexType>
-  </xs:element>
-</xs:schema>
+<?xml version="1.0" encoding="UTF-8"?>\r
+<!--\r
+  \r
+  Copyright (c) 2014 Raytheon BBN Technologies\r
+ \r
+  Permission is hereby granted, free of charge, to any person obtaining\r
+  a copy of this software and/or hardware specification (the "Work") to\r
+  deal in the Work without restriction, including without limitation the\r
+  rights to use, copy, modify, merge, publish, distribute, sublicense,\r
+  and/or sell copies of the Work, and to permit persons to whom the Work\r
+  is furnished to do so, subject to the following conditions:\r
+\r
+  The above copyright notice and this permission notice shall be\r
+  included in all copies or substantial portions of the Work.\r
+ \r
+  THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS\r
+  OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\r
+  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\r
+  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\r
+  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\r
+  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\r
+  OUT OF OR IN CONNECTION WITH THE WORK OR THE USE OR OTHER DEALINGS\r
+  IN THE WORK.\r
+\r
+  Portions have this copyright:\r
+\r
+  GENIPUBLIC-COPYRIGHT\r
+  Copyright (c) 2008-2009 University of Utah and the Flux Group.\r
+  All rights reserved.\r
+  \r
+-->\r
+<!--\r
+  GENI credential and privilege specification. The key points:\r
+  \r
+  * A credential is a set of privileges or a Ticket, each with a flag\r
+    to indicate delegation is permitted. Or an ABAC RT0 statement.\r
+  * A credential is signed and the signature included in the body of the\r
+    document.\r
+  * To support delegation, a credential will include its parent, and that\r
+    blob will be signed. So, there will be multiple signatures in the\r
+    document, each with a reference to the credential it signs.\r
+  \r
+  Default namespace = "http://www.geni.net/resources/credential/2"\r
+-->\r
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" xmlns:sig="http://www.w3.org/2000/09/xmldsig#">\r
+  <xs:include schemaLocation="protogeni-rspec-common.xsd"/>\r
+  <xs:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="sig.xsd"/>\r
+  <xs:import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>\r
+  <xs:group name="anyelementbody">\r
+    <xs:sequence>\r
+      <xs:any minOccurs="0" maxOccurs="unbounded" processContents="skip"/>\r
+    </xs:sequence>\r
+  </xs:group>\r
+  <xs:attributeGroup name="anyelementbody">\r
+    <xs:anyAttribute processContents="skip"/>\r
+  </xs:attributeGroup>\r
+  <!-- This is where we get the definition of RSpec from -->\r
+  <xs:element name="privilege">\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+        <xs:element ref="name"/>\r
+        <xs:element name="can_delegate" type="xs:boolean"/>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="name">\r
+    <xs:simpleType>\r
+      <xs:restriction base="xs:string">\r
+        <xs:minLength value="1"/>\r
+      </xs:restriction>\r
+    </xs:simpleType>\r
+  </xs:element>\r
+  <xs:element name="privileges"> <!-- For type 'privilege' only -->\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+        <xs:element minOccurs="0" maxOccurs="unbounded" ref="privilege"/>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="capability">\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+        <xs:element ref="name"/>\r
+        <xs:element name="can_delegate">\r
+          <xs:simpleType>\r
+            <xs:restriction base="xs:token">\r
+              <xs:enumeration value="0"/>\r
+              <xs:enumeration value="1"/>\r
+            </xs:restriction>\r
+          </xs:simpleType>\r
+        </xs:element>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="capabilities"> <!-- For type 'capability' only -->\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+        <xs:element minOccurs="0" maxOccurs="unbounded" ref="capability"/>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="ticket"> <!-- For type 'ticket' only -->\r
+    <xs:complexType mixed="true">\r
+      <xs:sequence>\r
+        <xs:element name="can_delegate" type="xs:boolean">\r
+          <xs:annotation>\r
+            <xs:documentation>Can the ticket be delegated?</xs:documentation>\r
+          </xs:annotation>\r
+        </xs:element>\r
+        <xs:element ref="redeem_before"/>\r
+        <xs:group ref="anyelementbody">\r
+          <xs:annotation>\r
+            <xs:documentation>A desciption of the resources that are being promised</xs:documentation>\r
+          </xs:annotation>\r
+        </xs:group>\r
+      </xs:sequence>\r
+      <xs:attributeGroup ref="anyelementbody"/>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="redeem_before" type="xs:dateTime">\r
+    <xs:annotation>\r
+      <xs:documentation>The ticket must be "cashed in" by this date </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <!-- Elements used for type 'abac'. See http://groups.geni.net/geni/wiki/TIEDABACCredential -->\r
+  <xs:element name="ABACprincipal">\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+       <xs:element name="keyid" type="xs:string"/> <!-- SHA1 hash of the principal's public key -->\r
+       <xs:element name="mnemonic" type="xs:string" minOccurs="0" maxOccurs="1"/> <!-- EG principal's URN -->\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <!-- A single rt0 element is required for creds of type 'abac'. Must have a single 'head'\r
+       and at least one 'tail'. -->\r
+  <xs:element name="rt0">\r
+    <xs:annotation>\r
+      <xs:documentation>An ABAC RT0 statement, used only for type 'abac'.</xs:documentation>\r
+    </xs:annotation>\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+       <xs:element name="version" type="xs:string" /> <!-- 1.1 for this schema -->\r
+       <xs:element name="head">\r
+         <xs:complexType>\r
+           <xs:sequence>\r
+             <xs:element ref="ABACprincipal"/> <!-- Matching the cred signer -->\r
+             <xs:element name="role" type="xs:string"/>\r
+           </xs:sequence>\r
+         </xs:complexType>\r
+       </xs:element>\r
+       <xs:element name="tail" minOccurs="1" maxOccurs="unbounded">\r
+         <xs:complexType>\r
+           <xs:sequence>\r
+             <xs:element ref="ABACprincipal"/>\r
+             <xs:element name="role" type="xs:string" minOccurs="0" maxOccurs="1"/>\r
+             <xs:element name="linking_role" type="xs:string" minOccurs="0" \r
+                         maxOccurs="1"/>\r
+           </xs:sequence>\r
+         </xs:complexType>\r
+       </xs:element>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="abac">\r
+    <xs:annotation>\r
+      <xs:documentation>An ABAC assertion containing a single RT0 statement, used only for type 'abac'.</xs:documentation>\r
+    </xs:annotation>\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+       <xs:element minOccurs="1" maxOccurs="1" ref="rt0"/>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+\r
+  <xs:element name="signatures">\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+        <xs:element maxOccurs="unbounded" ref="sig:Signature"/>\r
+      </xs:sequence>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:complexType name="credentials">\r
+    <xs:annotation>\r
+      <xs:documentation>A credential granting privileges or a ticket or making an ABAC assertion.</xs:documentation>\r
+    </xs:annotation>\r
+    <xs:sequence>\r
+      <xs:element ref="credential"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+  <xs:element name="credential">\r
+    <xs:complexType>\r
+      <xs:sequence>\r
+        <xs:element ref="type"/>\r
+        <xs:element ref="serial"/>\r
+        <xs:element ref="owner_gid"/>\r
+        <xs:element minOccurs="0" ref="owner_urn"/>\r
+        <xs:element ref="target_gid"/>\r
+        <xs:element minOccurs="0" ref="target_urn"/>\r
+        <xs:element ref="uuid"/>\r
+        <xs:element ref="expires"/>\r
+        <xs:choice>\r
+          <xs:annotation>\r
+            <xs:documentation>Privileges or a ticket or an ABAC assertion</xs:documentation>\r
+          </xs:annotation>\r
+          <xs:element ref="privileges"/>\r
+          <xs:element ref="ticket"/>\r
+          <xs:element ref="capabilities"/>\r
+         <xs:element ref="abac"/>\r
+        </xs:choice>\r
+        <xs:element minOccurs="0" maxOccurs="unbounded" ref="extensions"/>\r
+        <xs:element minOccurs="0" ref="parent"/>\r
+      </xs:sequence>\r
+      <xs:attribute ref="xml:id" use="required"/>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="type">\r
+    <xs:annotation>\r
+      <xs:documentation>The type of this credential. Currently a Privilege set or a Ticket or ABAC.</xs:documentation>\r
+    </xs:annotation>\r
+    <xs:simpleType>\r
+      <xs:restriction base="xs:token">\r
+        <xs:enumeration value="privilege"/>\r
+        <xs:enumeration value="ticket"/>\r
+        <xs:enumeration value="capability"/>\r
+        <xs:enumeration value="abac"/>\r
+      </xs:restriction>\r
+    </xs:simpleType>\r
+  </xs:element>\r
+  <xs:element name="serial" type="xs:string">\r
+    <xs:annotation>\r
+      <xs:documentation>A serial number.</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="owner_gid" type="xs:string">\r
+    <xs:annotation>\r
+      <xs:documentation>GID of the owner of this credential. </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="owner_urn" type="xs:string">\r
+    <xs:annotation>\r
+      <xs:documentation>URN of the owner. Not everyone can parse DER</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="target_gid" type="xs:string">\r
+    <xs:annotation>\r
+      <xs:documentation>GID of the target of this credential. </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="target_urn" type="xs:string">\r
+    <xs:annotation>\r
+      <xs:documentation>URN of the target.</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="uuid" type="xs:string">\r
+    <xs:annotation>\r
+      <xs:documentation>UUID of this credential</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="expires" type="xs:dateTime">\r
+    <xs:annotation>\r
+      <xs:documentation>Expires on in ISO8601 format but preferably RFC3339</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="extensions">\r
+    <xs:annotation>\r
+      <xs:documentation>Optional Extensions</xs:documentation>\r
+    </xs:annotation>\r
+    <xs:complexType mixed="true">\r
+      <xs:group ref="anyelementbody"/>\r
+      <xs:attributeGroup ref="anyelementbody"/>\r
+    </xs:complexType>\r
+  </xs:element>\r
+  <xs:element name="parent" type="credentials">\r
+    <xs:annotation>\r
+      <xs:documentation>Parent that delegated to us</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  <xs:element name="signed-credential">\r
+    <xs:complexType>\r
+      <xs:complexContent>\r
+        <xs:extension base="credentials">\r
+          <xs:sequence>\r
+            <xs:element minOccurs="0" ref="signatures"/>\r
+          </xs:sequence>\r
+        </xs:extension>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+  </xs:element>\r
+</xs:schema>\r

diff --git a/sfa/trust/credential_factory.py b/sfa/trust/credential_factory.py
new file mode 100644 (file)
index 0000000..2fe37a7
--- /dev/null
+++ b/sfa/trust/credential_factory.py
@@ -0,0 +1,110 @@
+#----------------------------------------------------------------------\r
+# Copyright (c) 2014 Raytheon BBN Technologies\r
+#\r
+# Permission is hereby granted, free of charge, to any person obtaining\r
+# a copy of this software and/or hardware specification (the "Work") to\r
+# deal in the Work without restriction, including without limitation the\r
+# rights to use, copy, modify, merge, publish, distribute, sublicense,\r
+# and/or sell copies of the Work, and to permit persons to whom the Work\r
+# is furnished to do so, subject to the following conditions:\r
+#\r
+# The above copyright notice and this permission notice shall be\r
+# included in all copies or substantial portions of the Work.\r
+#\r
+# THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS\r
+# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\r
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\r
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\r
+# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\r
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\r
+# OUT OF OR IN CONNECTION WITH THE WORK OR THE USE OR OTHER DEALINGS\r
+# IN THE WORK.\r
+#----------------------------------------------------------------------\r
+\r
+from sfa.util.sfalogging import logger\r
+from sfa.trust.credential import Credential\r
+from sfa.trust.abac_credential import ABACCredential\r
+\r
+import json\r
+import re\r
+\r
+# Factory for creating credentials of different sorts by type.\r
+# Specifically, this factory can create standard SFA credentials\r
+# and ABAC credentials from XML strings based on their identifying content\r
+\r
+class CredentialFactory:\r
+\r
+    UNKNOWN_CREDENTIAL_TYPE = 'geni_unknown'\r
+\r
+    # Static Credential class method to determine the type of a credential\r
+    # string depending on its contents\r
+    @staticmethod\r
+    def getType(credString):\r
+        credString_nowhitespace = re.sub('\s', '', credString)\r
+        if credString_nowhitespace.find('<type>abac</type>') > -1:\r
+            return ABACCredential.ABAC_CREDENTIAL_TYPE\r
+        elif credString_nowhitespace.find('<type>privilege</type>') > -1:\r
+            return Credential.SFA_CREDENTIAL_TYPE\r
+        else:\r
+            st = credString_nowhitespace.find('<type>')\r
+            end = credString_nowhitespace.find('</type>', st)\r
+            return credString_nowhitespace[st + len('<type>'):end]\r
+#            return CredentialFactory.UNKNOWN_CREDENTIAL_TYPE\r
+\r
+    # Static Credential class method to create the appropriate credential\r
+    # (SFA or ABAC) depending on its type\r
+    @staticmethod\r
+    def createCred(credString=None, credFile=None):\r
+        if not credString and not credFile:\r
+            raise Exception("CredentialFactory.createCred called with no argument")\r
+        if credFile:\r
+            try:\r
+                credString = open(credFile).read()\r
+            except Exception, e:\r
+                logger.info("Error opening credential file %s: %s" % credFile, e)\r
+                return None\r
+\r
+        # Try to treat the file as JSON, getting the cred_type from the struct\r
+        try:\r
+            credO = json.loads(credString, encoding='ascii')\r
+            if credO.has_key('geni_value') and credO.has_key('geni_type'):\r
+                cred_type = credO['geni_type']\r
+                credString = credO['geni_value']\r
+        except Exception, e:\r
+            # It wasn't a struct. So the credString is XML. Pull the type directly from the string\r
+            logger.debug("Credential string not JSON: %s" % e)\r
+            cred_type = CredentialFactory.getType(credString)\r
+\r
+        if cred_type == Credential.SFA_CREDENTIAL_TYPE:\r
+            try:\r
+                cred = Credential(string=credString)\r
+                return cred\r
+            except Exception, e:\r
+                if credFile:\r
+                    msg = "credString started: %s" % credString[:50]\r
+                    raise Exception("%s not a parsable SFA credential: %s. " % (credFile, e) + msg)\r
+                else:\r
+                    raise Exception("SFA Credential not parsable: %s. Cred start: %s..." % (e, credString[:50]))\r
+\r
+        elif cred_type == ABACCredential.ABAC_CREDENTIAL_TYPE:\r
+            try:\r
+                cred = ABACCredential(string=credString)\r
+                return cred\r
+            except Exception, e:\r
+                if credFile:\r
+                    raise Exception("%s not a parsable ABAC credential: %s" % (credFile, e))\r
+                else:\r
+                    raise Exception("ABAC Credential not parsable: %s. Cred start: %s..." % (e, credString[:50]))\r
+        else:\r
+            raise Exception("Unknown credential type '%s'" % cred_type)\r
+\r
+if __name__ == "__main__":\r
+    c2 = open('/tmp/sfa.xml').read()\r
+    cred1 = CredentialFactory.createCred(credFile='/tmp/cred.xml')\r
+    cred2 = CredentialFactory.createCred(credString=c2)\r
+\r
+    print "C1 = %s" % cred1\r
+    print "C2 = %s" % cred2\r
+    c1s = cred1.dump_string()\r
+    print "C1 = %s" % c1s\r
+#    print "C2 = %s" % cred2.dump_string()\r

diff --git a/sfa/trust/speaksfor_util.py b/sfa/trust/speaksfor_util.py
new file mode 100644 (file)
index 0000000..bd12195
--- /dev/null
+++ b/sfa/trust/speaksfor_util.py
@@ -0,0 +1,466 @@
+#----------------------------------------------------------------------\r
+# Copyright (c) 2014 Raytheon BBN Technologies\r
+#\r
+# Permission is hereby granted, free of charge, to any person obtaining\r
+# a copy of this software and/or hardware specification (the "Work") to\r
+# deal in the Work without restriction, including without limitation the\r
+# rights to use, copy, modify, merge, publish, distribute, sublicense,\r
+# and/or sell copies of the Work, and to permit persons to whom the Work\r
+# is furnished to do so, subject to the following conditions:\r
+#\r
+# The above copyright notice and this permission notice shall be\r
+# included in all copies or substantial portions of the Work.\r
+#\r
+# THE WORK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS\r
+# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\r
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\r
+# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\r
+# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\r
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\r
+# OUT OF OR IN CONNECTION WITH THE WORK OR THE USE OR OTHER DEALINGS\r
+# IN THE WORK.\r
+#----------------------------------------------------------------------\r
+\r
+import datetime\r
+from dateutil import parser as du_parser, tz as du_tz\r
+import optparse\r
+import os\r
+import subprocess\r
+import sys\r
+import tempfile\r
+from xml.dom.minidom import *\r
+from StringIO import StringIO\r
+\r
+from sfa.trust.certificate import Certificate\r
+from sfa.trust.credential import Credential, signature_template, HAVELXML\r
+from sfa.trust.abac_credential import ABACCredential, ABACElement\r
+from sfa.trust.credential_factory import CredentialFactory\r
+from sfa.trust.gid import GID\r
+\r
+# Routine to validate that a speaks-for credential \r
+# says what it claims to say:\r
+# It is a signed credential wherein the signer S is attesting to the\r
+# ABAC statement:\r
+# S.speaks_for(S)<-T Or "S says that T speaks for S"\r
+\r
+# Requires that openssl be installed and in the path\r
+# create_speaks_for requires that xmlsec1 be on the path\r
+\r
+# Simple XML helper functions\r
+\r
+# Find the text associated with first child text node\r
+def findTextChildValue(root):\r
+    child = findChildNamed(root, '#text')\r
+    if child: return str(child.nodeValue)\r
+    return None\r
+\r
+# Find first child with given name\r
+def findChildNamed(root, name):\r
+    for child in root.childNodes:\r
+        if child.nodeName == name:\r
+            return child\r
+    return None\r
+\r
+# Write a string to a tempfile, returning name of tempfile\r
+def write_to_tempfile(str):\r
+    str_fd, str_file = tempfile.mkstemp()\r
+    if str:\r
+        os.write(str_fd, str)\r
+    os.close(str_fd)\r
+    return str_file\r
+\r
+# Run a subprocess and return output\r
+def run_subprocess(cmd, stdout, stderr):\r
+    try:\r
+        proc = subprocess.Popen(cmd, stdout=stdout, stderr=stderr)\r
+        proc.wait()\r
+        if stdout:\r
+            output = proc.stdout.read()\r
+        else:\r
+            output = proc.returncode\r
+        return output\r
+    except Exception as e:\r
+        raise Exception("Failed call to subprocess '%s': %s" % (" ".join(cmd), e))\r
+\r
+def get_cert_keyid(gid):\r
+    """Extract the subject key identifier from the given certificate.\r
+    Return they key id as lowercase string with no colon separators\r
+    between pairs. The key id as shown in the text output of a\r
+    certificate are in uppercase with colon separators.\r
+\r
+    """\r
+    raw_key_id = gid.get_extension('subjectKeyIdentifier')\r
+    # Raw has colons separating pairs, and all characters are upper case.\r
+    # Remove the colons and convert to lower case.\r
+    keyid = raw_key_id.replace(':', '').lower()\r
+    return keyid\r
+\r
+# Pull the cert out of a list of certs in a PEM formatted cert string\r
+def grab_toplevel_cert(cert):\r
+    start_label = '-----BEGIN CERTIFICATE-----'\r
+    if cert.find(start_label) > -1:\r
+        start_index = cert.find(start_label) + len(start_label)\r
+    else:\r
+        start_index = 0\r
+    end_label = '-----END CERTIFICATE-----'\r
+    end_index = cert.find(end_label)\r
+    first_cert = cert[start_index:end_index]\r
+    pieces = first_cert.split('\n')\r
+    first_cert = "".join(pieces)\r
+    return first_cert\r
+\r
+# Validate that the given speaks-for credential represents the\r
+# statement User.speaks_for(User)<-Tool for the given user and tool certs\r
+# and was signed by the user\r
+# Return: \r
+#   Boolean indicating whether the given credential \r
+#      is not expired \r
+#      is an ABAC credential\r
+#      was signed by the user associated with the speaking_for_urn\r
+#      is verified by xmlsec1\r
+#      asserts U.speaks_for(U)<-T ("user says that T may speak for user")\r
+#      If schema provided, validate against schema\r
+#      is trusted by given set of trusted roots (both user cert and tool cert)\r
+#   String user certificate of speaking_for user if the above tests succeed\r
+#      (None otherwise)\r
+#   Error message indicating why the speaks_for call failed ("" otherwise)\r
+def verify_speaks_for(cred, tool_gid, speaking_for_urn, \\r
+                          trusted_roots, schema=None, logger=None):\r
+\r
+    # Credential has not expired\r
+    if cred.expiration and cred.expiration < datetime.datetime.utcnow():\r
+        return False, None, "ABAC Credential expired at %s (%s)" % (cred.expiration.isoformat(), cred.get_summary_tostring())\r
+\r
+    # Must be ABAC\r
+    if cred.get_cred_type() != ABACCredential.ABAC_CREDENTIAL_TYPE:\r
+        return False, None, "Credential not of type ABAC but %s" % cred.get_cred_type\r
+\r
+    if cred.signature is None or cred.signature.gid is None:\r
+        return False, None, "Credential malformed: missing signature or signer cert. Cred: %s" % cred.get_summary_tostring()\r
+    user_gid = cred.signature.gid\r
+    user_urn = user_gid.get_urn()\r
+\r
+    # URN of signer from cert must match URN of 'speaking-for' argument\r
+    if user_urn != speaking_for_urn:\r
+        return False, None, "User URN from cred doesn't match speaking_for URN: %s != %s (cred %s)" % \\r
+            (user_urn, speaking_for_urn, cred.get_summary_tostring())\r
+\r
+    tails = cred.get_tails()\r
+    if len(tails) != 1: \r
+        return False, None, "Invalid ABAC-SF credential: Need exactly 1 tail element, got %d (%s)" % \\r
+            (len(tails), cred.get_summary_tostring())\r
+\r
+    user_keyid = get_cert_keyid(user_gid)\r
+    tool_keyid = get_cert_keyid(tool_gid)\r
+    subject_keyid = tails[0].get_principal_keyid()\r
+\r
+    head = cred.get_head()\r
+    principal_keyid = head.get_principal_keyid()\r
+    role = head.get_role()\r
+\r
+    logger.info('user keyid: %s' % user_keyid)         \r
+    logger.info('principal keyid: %s' % principal_keyid)       \r
+    logger.info('tool keyid: %s' % tool_keyid)         \r
+    logger.info('subject keyid: %s' % subject_keyid) \r
+    logger.info('role: %s' % role) \r
+    logger.info('user gid: %s' % user_gid.dump_string())\r
+    f = open('/tmp/speaksfor/tool.gid', 'w')\r
+    f.write(tool_gid.dump_string())\r
+    f.close()  \r
+\r
+    # Credential must pass xmlsec1 verify\r
+    cred_file = write_to_tempfile(cred.save_to_string())\r
+    cert_args = []\r
+    if trusted_roots:\r
+        for x in trusted_roots:\r
+            cert_args += ['--trusted-pem', x.filename]\r
+    # FIXME: Why do we not need to specify the --node-id option as credential.py does?\r
+    xmlsec1_args = [cred.xmlsec_path, '--verify'] + cert_args + [ cred_file]\r
+    output = run_subprocess(xmlsec1_args, stdout=None, stderr=subprocess.PIPE)\r
+    os.unlink(cred_file)\r
+    if output != 0:\r
+        # FIXME\r
+        # xmlsec errors have a msg= which is the interesting bit.\r
+        # But does this go to stderr or stdout? Do we have it here?\r
+        mstart = verified.find("msg=")\r
+        msg = ""\r
+        if mstart > -1 and len(verified) > 4:\r
+            mstart = mstart + 4\r
+            mend = verified.find('\\', mstart)\r
+            msg = verified[mstart:mend]\r
+        if msg == "":\r
+            msg = output\r
+        return False, None, "ABAC credential failed to xmlsec1 verify: %s" % msg\r
+\r
+    # Must say U.speaks_for(U)<-T\r
+    if user_keyid != principal_keyid or \\r
+            tool_keyid != subject_keyid or \\r
+            role != ('speaks_for_%s' % user_keyid):\r
+        return False, None, "ABAC statement doesn't assert U.speaks_for(U)<-T (%s)" % cred.get_summary_tostring()\r
+\r
+    # If schema provided, validate against schema\r
+    if HAVELXML and schema and os.path.exists(schema):\r
+        from lxml import etree\r
+        tree = etree.parse(StringIO(cred.xml))\r
+        schema_doc = etree.parse(schema)\r
+        xmlschema = etree.XMLSchema(schema_doc)\r
+        if not xmlschema.validate(tree):\r
+            error = xmlschema.error_log.last_error\r
+            message = "%s: %s (line %s)" % (cred.get_summary_tostring(), error.message, error.line)\r
+            return False, None, ("XML Credential schema invalid: %s" % message)\r
+\r
+    if trusted_roots:\r
+        # User certificate must validate against trusted roots\r
+        try:\r
+            user_gid.verify_chain(trusted_roots)\r
+        except Exception, e:\r
+            return False, None, \\r
+                "Cred signer (user) cert not trusted: %s" % e\r
+\r
+        # Tool certificate must validate against trusted roots\r
+        try:\r
+            tool_gid.verify_chain(trusted_roots)\r
+        except Exception, e:\r
+            return False, None, \\r
+                "Tool cert not trusted: %s" % e\r
+\r
+    return True, user_gid, ""\r
+\r
+# Determine if this is a speaks-for context. If so, validate\r
+# And return either the tool_cert (not speaks-for or not validated)\r
+# or the user cert (validated speaks-for)\r
+#\r
+# credentials is a list of GENI-style credentials:\r
+#  Either a cred string xml string, or Credential object of a tuple\r
+#    [{'geni_type' : geni_type, 'geni_value : cred_value, \r
+#      'geni_version' : version}]\r
+# caller_gid is the raw X509 cert gid\r
+# options is the dictionary of API-provided options\r
+# trusted_roots is a list of Certificate objects from the system\r
+#   trusted_root directory\r
+# Optionally, provide an XML schema against which to validate the credential\r
+def determine_speaks_for(logger, credentials, caller_gid, options, \\r
+                             trusted_roots, schema=None):\r
+    logger.info(options)\r
+    logger.info("geni speaking for:%s " % 'geni_speaking_for' in options)  \r
+    if options and 'geni_speaking_for' in options:\r
+        speaking_for_urn = options['geni_speaking_for'].strip()\r
+        for cred in credentials:\r
+            # Skip things that aren't ABAC credentials\r
+            if type(cred) == dict:\r
+                if cred['geni_type'] != ABACCredential.ABAC_CREDENTIAL_TYPE: continue\r
+                cred_value = cred['geni_value']\r
+            elif isinstance(cred, Credential):\r
+                if not isinstance(cred, ABACCredential):\r
+                    continue\r
+                else:\r
+                    cred_value = cred\r
+            else:\r
+                if CredentialFactory.getType(cred) != ABACCredential.ABAC_CREDENTIAL_TYPE: continue\r
+                cred_value = cred\r
+\r
+            # If the cred_value is xml, create the object\r
+            if not isinstance(cred_value, ABACCredential):\r
+                cred = CredentialFactory.createCred(cred_value)\r
+\r
+#            print "Got a cred to check speaksfor for: %s" % cred.get_summary_tostring()\r
+#            #cred.dump(True, True)\r
+#            print "Caller: %s" % caller_gid.dump_string(2, True)\r
+            logger.info(cred.dump_string())\r
+            f = open('/tmp/speaksfor/%s.cred' % cred, 'w')\r
+            f.write(cred.xml)\r
+            f.close()\r
+            # See if this is a valid speaks_for\r
+            is_valid_speaks_for, user_gid, msg = \\r
+                verify_speaks_for(cred,\r
+                                  caller_gid, speaking_for_urn, \\r
+                                      trusted_roots, schema, logger=logger)\r
+            logger.info(msg)\r
+            if is_valid_speaks_for:\r
+                return user_gid # speaks-for\r
+            else:\r
+                if logger:\r
+                    logger.info("Got speaks-for option but not a valid speaks_for with this credential: %s" % msg)\r
+                else:\r
+                    print "Got a speaks-for option but not a valid speaks_for with this credential: " + msg\r
+    return caller_gid # Not speaks-for\r
+\r
+# Create an ABAC Speaks For credential using the ABACCredential object and it's encode&sign methods\r
+def create_sign_abaccred(tool_gid, user_gid, ma_gid, user_key_file, cred_filename, dur_days=365):\r
+    print "Creating ABAC SpeaksFor using ABACCredential...\n"\r
+    # Write out the user cert\r
+    from tempfile import mkstemp\r
+    ma_str = ma_gid.save_to_string()\r
+    user_cert_str = user_gid.save_to_string()\r
+    if not user_cert_str.endswith(ma_str):\r
+        user_cert_str += ma_str\r
+    fp, user_cert_filename = mkstemp(suffix='cred', text=True)\r
+    fp = os.fdopen(fp, "w")\r
+    fp.write(user_cert_str)\r
+    fp.close()\r
+\r
+    # Create the cred\r
+    cred = ABACCredential()\r
+    cred.set_issuer_keys(user_key_file, user_cert_filename)\r
+    tool_urn = tool_gid.get_urn()\r
+    user_urn = user_gid.get_urn()\r
+    user_keyid = get_cert_keyid(user_gid)\r
+    tool_keyid = get_cert_keyid(tool_gid)\r
+    cred.head = ABACElement(user_keyid, user_urn, "speaks_for_%s" % user_keyid)\r
+    cred.tails.append(ABACElement(tool_keyid, tool_urn))\r
+    cred.set_expiration(datetime.datetime.utcnow() + datetime.timedelta(days=dur_days))\r
+    cred.expiration = cred.expiration.replace(microsecond=0)\r
+\r
+    # Produce the cred XML\r
+    cred.encode()\r
+\r
+    # Sign it\r
+    cred.sign()\r
+    # Save it\r
+    cred.save_to_file(cred_filename)\r
+    print "Created ABAC credential: '%s' in file %s" % \\r
+            (cred.get_summary_tostring(), cred_filename)\r
+\r
+# FIXME: Assumes xmlsec1 is on path\r
+# FIXME: Assumes signer is itself signed by an 'ma_gid' that can be trusted\r
+def create_speaks_for(tool_gid, user_gid, ma_gid, \\r
+                          user_key_file, cred_filename, dur_days=365):\r
+    tool_urn = tool_gid.get_urn()\r
+    user_urn = user_gid.get_urn()\r
+\r
+    header = '<?xml version="1.0" encoding="UTF-8"?>'\r
+    reference = "ref0"\r
+    signature_block = \\r
+        '<signatures>\n' + \\r
+        signature_template + \\r
+        '</signatures>'\r
+    template = header + '\n' + \\r
+        '<signed-credential '\r
+    template += 'xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.geni.net/resources/credential/2/credential.xsd" xsi:schemaLocation="http://www.protogeni.net/resources/credential/ext/policy/1 http://www.protogeni.net/resources/credential/ext/policy/1/policy.xsd"'\r
+    template += '>\n' + \\r
+        '<credential xml:id="%s">\n' + \\r
+        '<type>abac</type>\n' + \\r
+        '<serial/>\n' +\\r
+        '<owner_gid/>\n' + \\r
+        '<owner_urn/>\n' + \\r
+        '<target_gid/>\n' + \\r
+        '<target_urn/>\n' + \\r
+        '<uuid/>\n' + \\r
+        '<expires>%s</expires>' +\\r
+        '<abac>\n' + \\r
+        '<rt0>\n' + \\r
+        '<version>%s</version>\n' + \\r
+        '<head>\n' + \\r
+        '<ABACprincipal><keyid>%s</keyid><mnemonic>%s</mnemonic></ABACprincipal>\n' +\\r
+        '<role>speaks_for_%s</role>\n' + \\r
+        '</head>\n' + \\r
+        '<tail>\n' +\\r
+        '<ABACprincipal><keyid>%s</keyid><mnemonic>%s</mnemonic></ABACprincipal>\n' +\\r
+        '</tail>\n' +\\r
+        '</rt0>\n' + \\r
+        '</abac>\n' + \\r
+        '</credential>\n' + \\r
+        signature_block + \\r
+        '</signed-credential>\n'\r
+\r
+\r
+    credential_duration = datetime.timedelta(days=dur_days)\r
+    expiration = datetime.datetime.now(du_tz.tzutc()) + credential_duration\r
+    expiration_str = expiration.strftime('%Y-%m-%dT%H:%M:%SZ') # FIXME: libabac can't handle .isoformat()\r
+    version = "1.1"\r
+\r
+    user_keyid = get_cert_keyid(user_gid)\r
+    tool_keyid = get_cert_keyid(tool_gid)\r
+    unsigned_cred = template % (reference, expiration_str, version, \\r
+                                    user_keyid, user_urn, user_keyid, tool_keyid, tool_urn, \\r
+                                    reference, reference)\r
+    unsigned_cred_filename = write_to_tempfile(unsigned_cred)\r
+\r
+    # Now sign the file with xmlsec1\r
+    # xmlsec1 --sign --privkey-pem privkey.pem,cert.pem \r
+    # --output signed.xml tosign.xml\r
+    pems = "%s,%s,%s" % (user_key_file, user_gid.get_filename(),\r
+                         ma_gid.get_filename())\r
+    # FIXME: assumes xmlsec1 is on path\r
+    cmd = ['xmlsec1',  '--sign',  '--privkey-pem', pems, \r
+           '--output', cred_filename, unsigned_cred_filename]\r
+\r
+#    print " ".join(cmd)\r
+    sign_proc_output = run_subprocess(cmd, stdout=subprocess.PIPE, stderr=None)\r
+    if sign_proc_output == None:\r
+        print "OUTPUT = %s" % sign_proc_output\r
+    else:\r
+        print "Created ABAC credential: '%s speaks_for %s' in file %s" % \\r
+            (tool_urn, user_urn, cred_filename)\r
+    os.unlink(unsigned_cred_filename)\r
+\r
+\r
+# Test procedure\r
+if __name__ == "__main__":\r
+\r
+    parser = optparse.OptionParser()\r
+    parser.add_option('--cred_file', \r
+                      help='Name of credential file')\r
+    parser.add_option('--tool_cert_file', \r
+                      help='Name of file containing tool certificate')\r
+    parser.add_option('--user_urn', \r
+                      help='URN of speaks-for user')\r
+    parser.add_option('--user_cert_file', \r
+                      help="filename of x509 certificate of signing user")\r
+    parser.add_option('--ma_cert_file', \r
+                      help="filename of x509 cert of MA that signed user cert")\r
+    parser.add_option('--user_key_file', \r
+                      help="filename of private key of signing user")\r
+    parser.add_option('--trusted_roots_directory', \r
+                      help='Directory of trusted root certs')\r
+    parser.add_option('--create',\r
+                      help="name of file of ABAC speaksfor cred to create")\r
+    parser.add_option('--useObject', action='store_true', default=False,\r
+                      help='Use the ABACCredential object to create the credential (default False)')\r
+\r
+    options, args = parser.parse_args(sys.argv)\r
+\r
+    tool_gid = GID(filename=options.tool_cert_file)\r
+\r
+    if options.create:\r
+        if options.user_cert_file and options.user_key_file \\r
+            and options.ma_cert_file:\r
+            user_gid = GID(filename=options.user_cert_file)\r
+            ma_gid = GID(filename=options.ma_cert_file)\r
+            if options.useObject:\r
+                create_sign_abaccred(tool_gid, user_gid, ma_gid, \\r
+                                         options.user_key_file,  \\r
+                                         options.create)\r
+            else:\r
+                create_speaks_for(tool_gid, user_gid, ma_gid, \\r
+                                         options.user_key_file,  \\r
+                                         options.create)\r
+        else:\r
+            print "Usage: --create cred_file " + \\r
+                "--user_cert_file user_cert_file" + \\r
+                " --user_key_file user_key_file --ma_cert_file ma_cert_file"\r
+        sys.exit()\r
+\r
+    user_urn = options.user_urn\r
+\r
+    # Get list of trusted rootcerts\r
+    if options.cred_file and not options.trusted_roots_directory:\r
+        sys.exit("Must supply --trusted_roots_directory to validate a credential")\r
+\r
+    trusted_roots_directory = options.trusted_roots_directory\r
+    trusted_roots = \\r
+        [Certificate(filename=os.path.join(trusted_roots_directory, file)) \\r
+             for file in os.listdir(trusted_roots_directory) \\r
+             if file.endswith('.pem') and file != 'CATedCACerts.pem']\r
+\r
+    cred = open(options.cred_file).read()\r
+\r
+    creds = [{'geni_type' : ABACCredential.ABAC_CREDENTIAL_TYPE, 'geni_value' : cred, \r
+              'geni_version' : '1'}]\r
+    gid = determine_speaks_for(None, creds, tool_gid, \\r
+                                   {'geni_speaking_for' : user_urn}, \\r
+                                   trusted_roots)\r
+\r
+\r
+    print 'SPEAKS_FOR = %s' % (gid != tool_gid)\r
+    print "CERT URN = %s" % gid.get_urn()\r