Index: java/net/deterlab/abac/Context.java
===================================================================
--- java/net/deterlab/abac/Context.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
+++ java/net/deterlab/abac/Context.java	(revision 3f928b090233cb75969af03571c6316ffdf53a80)
@@ -506,4 +506,5 @@
         derived_edges = new HashSet<Credential>();
     }
+
     /**
      * Put the Identity into the set of ids used to validate certificates.
@@ -515,8 +516,6 @@
      */
     protected void addIdentity(Identity id) { 
-	if (m_identities.contains(id)) {
-	    //XXX keep more recent
+	if (m_identities.contains(id)) 
 	    return;
-	}
 	m_identities.add(id);
 	if (id.getName() != null && id.getKeyID() != null) {
Index: java/net/deterlab/abac/Identity.java
===================================================================
--- java/net/deterlab/abac/Identity.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
+++ java/net/deterlab/abac/Identity.java	(revision 3f928b090233cb75969af03571c6316ffdf53a80)
@@ -25,4 +25,6 @@
  */
 public class Identity implements Comparable {
+    /** Default validity period (in seconds) */
+    static public long defaultValidity = 3600L * 24L * 365L;
     /** The underlying X509 certificate. */
     protected X509Certificate cert;
@@ -33,4 +35,6 @@
     /** The keypair, if any, used to sign for this Identity */
     protected KeyPair kp;
+    /** The expiration for this Identity */
+    protected Date expiration;
 
     /** Make sure BouncyCastle is loaded */
@@ -100,4 +104,5 @@
 	    keyid = Context.extractKeyID(cert.getPublicKey());
 	    cn = cert.getSubjectDN().getName();
+	    expiration = cert.getNotAfter();
 	    /// XXX: better parse
 	    if (cn.startsWith("CN=")) cn = cn.substring(3);
@@ -107,4 +112,5 @@
      * Construct from a string, used as a CN.  Keys are generated.
      * @param cn a String containing the menomnic name
+     * @param validity a long containing the validity period (in seconds)
      * @throws IOException reading or writing problems
      * @throws CertificateEncodingException Problem creating certificate
@@ -117,5 +123,5 @@
      * @throws SignatureException if the signature creation fails
      */
-    public Identity(String cn) throws
+    public Identity(String cn, long validity) throws
 	    CertificateException, NoSuchAlgorithmException,InvalidKeyException,
 	    NoSuchProviderException, SignatureException, IOException {
@@ -125,6 +131,6 @@
 	gen.setIssuerDN(new X500Principal("CN=" + cn));
 	gen.setSubjectDN(new X500Principal("CN=" + cn));
-	gen.setNotAfter(new Date(System.currentTimeMillis() 
-		    + (3600L * 1000L * 24L * 365L)));
+	gen.setNotAfter(new Date(System.currentTimeMillis() +
+		1000L * validity));
 	gen.setNotBefore(new Date(System.currentTimeMillis()));
 	gen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
@@ -136,4 +142,23 @@
 
 
+    /**
+     * Construct from a string, used as a CN.  Keys are generated.
+     * @param cn a String containing the menomnic name
+     * @param validity a long containing the validity period (in seconds)
+     * @throws IOException reading or writing problems
+     * @throws CertificateEncodingException Problem creating certificate
+     * @throws InvalidKeyException if none of the Identities can sign the
+     *				    certificate
+     * @throws NoSuchAlgorithmException if the credential uses an unknown
+     *				    signature algorithm
+     * @throws NoSuchProviderException if the provider of the signature
+     *				    algorithm is unavailable
+     * @throws SignatureException if the signature creation fails
+     */
+    public Identity(String cn) throws
+	    CertificateException, NoSuchAlgorithmException,InvalidKeyException,
+	    NoSuchProviderException, SignatureException, IOException {
+	this(cn, defaultValidity);
+    }
 
     /**
@@ -321,4 +346,11 @@
      */
     public X509Certificate getCertificate() { return cert; }
+
+    /**
+     * Return the expiration time of the Identity
+     * @return a Date the expiration time of the Identity
+     */
+    public Date getExpiration(){ return expiration; }
+
     /**
      * Return a simple string rep of the Identity.
