Index: libabac/abac_attribute.c
===================================================================
--- libabac/abac_attribute.c	(revision 4e10a0f5824985b912ab4ba775e110f14dbbeb3e)
+++ libabac/abac_attribute.c	(revision 02036f4809f34fff881b74d5d3198537af37154a)
@@ -268,6 +268,8 @@
 
 
-static abac_attribute_t *_load_attr(char *role_string, char *xml)
-{
+static abac_attribute_t *_load_attr(char *rstring, char *xml)
+{
+    /* make a copy of rle_string */
+    char *role_string=abac_xstrdup(rstring);
 
 if(debug) fprintf(stderr,"loading -> %s \n", role_string);
Index: libabac/abac_id.c
===================================================================
--- libabac/abac_id.c	(revision 4e10a0f5824985b912ab4ba775e110f14dbbeb3e)
+++ libabac/abac_id.c	(revision 02036f4809f34fff881b74d5d3198537af37154a)
@@ -17,4 +17,6 @@
 #define KEY_SUFFIX  "_private.pem"
 #define CERT_SUFFIX "_ID.pem"
+
+static int debug=0;
 
 // ID object
@@ -65,4 +67,48 @@
 
     return _id_from_cert(cert);
+}
+
+/* for some reason, there might be beginning and trailing spaces 
+in pem, zap the end with \0 and skip the spaces at the start*/
+char *zap_spaces(char *string)
+{
+   int space=0;
+   int total=strlen(string);
+   int i=0;
+   char *ptr=string;
+   while(string[i]==' ' && i<total) {
+       i++;
+       ptr++;
+   }
+   for(;i<total; i++) {
+       if(string[i]==' ') {
+         space++;
+         string[i]='\0';
+       } 
+   }
+   return ptr;
+}
+
+/* return a void ptr to the x509 structure made from the
+   naked pem structure */
+void *abac_get_sha_from_nake_pem(char *npem, char **sha1) {
+    abac_chunk_t chunk;
+    char *start="-----BEGIN CERTIFICATE-----";
+    char *end="-----END CERTIFICATE-----";
+    char *pem=NULL;
+    char *ptr=zap_spaces(npem);
+    asprintf(&pem,"%s%s%s",start,ptr,end);
+    chunk.ptr=(unsigned char *)pem;
+    chunk.len=strlen(pem);
+    X509 *cert=abac_load_id_from_chunk(chunk.ptr,chunk.len);
+    *sha1=NULL;
+    if(cert) {
+        *sha1 = abac_xstrdup(abac_get_keyid(cert));
+        if(debug) fprintf(stderr,"sha1 found is %s\n", *sha1);
+        } else {
+            *sha1=NULL;
+            fprintf(stderr,"can not make cert from pem blob!!\n");
+    }
+    return (void *) cert;
 }
 
Index: libabac/abac_xml.c
===================================================================
--- libabac/abac_xml.c	(revision 4e10a0f5824985b912ab4ba775e110f14dbbeb3e)
+++ libabac/abac_xml.c	(revision 02036f4809f34fff881b74d5d3198537af37154a)
@@ -1,3 +1,2 @@
-
 /* abac_xml.c, specifically for GENI */
 
@@ -28,4 +27,7 @@
 
 #include <openssl/sha.h>
+
+extern void* abac_get_sha_from_nake_pem(char *npem, char **sha1);
+static int debug=0;
 
 /* from Ted's reader */
@@ -316,4 +318,14 @@
 }
 
+/* Extract a sha from PEM blob */
+static void extract_owner_sha1(xmlChar *pem, xmlChar **sha1) {
+    void *x509=abac_get_sha_from_nake_pem((char *) pem, (char **)sha1); 
+    if(debug) fprintf(stderr,"owner sha1 is (%s)..\n", *sha1);
+}
+static void extract_target_sha1(xmlChar *pem, xmlChar **sha1) {
+    void *x509=abac_get_sha_from_nake_pem((char *) pem,(char **)sha1); 
+    if(debug) fprintf(stderr,"group sha1 is (%s)..\n", *sha1);
+}
+
 /* Parse the content of the expires field and compare it to the time passed in
  * n.  If expires is earlier, return false, else true.  If n is null, compare
@@ -359,6 +371,8 @@
     if (!(newrv = realloc(rv, (base + newc) * sizeof(xmlChar *))))
 	goto fail;
-    for ( i = 0; i < base +newc; i ++) 
-	newrv[i] = (i < base) ? rv[i] : NULL;
+
+    for ( i = base; i < base +newc; i ++) { 
+	newrv[i] = NULL;
+    }
 
     /* So fail works */
@@ -430,4 +444,6 @@
     xmlChar keyid[SHA_DIGEST_LENGTH];	/* Issuer key SHA1 */
     xmlChar text_keyid[2*SHA_DIGEST_LENGTH+1];/* Issuer keyid as text */
+    xmlChar *owner_sha1 = NULL;         /* owner gid as text */
+    xmlChar *target_sha1 = NULL;        /* target gid as text */
     xmlChar **newrv = NULL;	/* Used to realloc rv to add the NULL
 				   terminator*/
@@ -462,7 +478,9 @@
     if ( !(owner = xmlSecFindNode(node, (xmlChar *) GENI_owner_gid, NULL)))
 	goto fail;
+    extract_owner_sha1(get_element_content(owner),&owner_sha1);
 
     if ( !(target = xmlSecFindNode(node, (xmlChar *) GENI_target_gid, NULL)))
 	goto fail;
+    extract_target_sha1(get_element_content(target),&target_sha1);
 
     if ( !(privs = xmlSecFindNode(node, (xmlChar *) GENI_privileges, NULL)))
@@ -508,5 +526,5 @@
 	if ( name && delegate != -1 ) {
 	    add_privilege_credential_string(text_keyid, 
-		    (xmlChar *) "owner-sha1", (xmlChar *) "target-sha1", name,
+		    (xmlChar *) owner_sha1, (xmlChar *) target_sha1, name,
 		    delegate, &rv, &ncred);
 	    if ( !rv ) goto fail;
@@ -515,11 +533,9 @@
 
     /* Add the terminating NULL */
-    if (!(newrv = realloc(rv, ncred+1)))
-	goto fail;
-
-    for ( i = 0; i < ncred+1; i ++) 
-	newrv[i] = (i < ncred) ? rv[i] : NULL;
-
-    return rv;
+    if (!(newrv = realloc(rv, sizeof(xmlChar*)*(ncred+1))))
+	goto fail;
+
+    newrv[ncred] = NULL;
+    return newrv;
 
 fail:
