Index: examples/creddy_prover_tests/README
===================================================================
--- examples/creddy_prover_tests/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,55 @@
+
+This directory contains various ABAC scenarios that exercise
+various feature of the current RT2 implmentation using YAP prolog.
+
+The frontend query client is abac_prover_yap. 
+
+Each subdirectory has a README script which includes a description
+of the scenario, and creddy calls that generate the needed credentials. 
+There is a run_query script which sets up and runs couple of typical 
+query using abac_prover_yap.
+
+runall, is the top level script that will cleanup and setup the
+credentials needed in each subdirectories 
+
+runcheck, is the top level script that initiates the run_query scripts
+within each subdirectory with ABAC_CN mode (see below); captures the
+result and compares with the baseline result stored in allout.save. 
+runcheck also makes a complete run_query run without ABAC_CN enabled as
+a round of regression testing.
+
+abac_prover_yap
+
+Usage: abac_prover_yap 
+        --keystore <keystore> 
+        --role <keyid.role> --principal <keyid>
+        --oset <keyid.oset> --object <otype>
+    loads the keystore and runs the query role <-?- principal
+                                the query oset <-?- object
+        --dump <file> 
+    extracts all credentials from the prolog db
+
+keystore is the location where the prover will search to load credentials.
+All accessible identity credentials and attribute credentials will be 
+picked up one file at a time.
+
+role, oset, principal, and object are specified with principal's SHA1 
+value extracted from the credentials that are loaded from keystore location
+using creddy. Example can be found in the run_queryscript.
+
+An actual example from balltime_rt2_typed,
+
+abac_prover_yap --keystore /home/mei/Deter/abac/examples/balltime_rt2_typed 
+  --role [keyid:212146063d65264e8f27c31f0da592e386fc59aa].role:stadium
+                 ([string:'access'],[boolean:true],[time:20120228T130000]) 
+  --principal [keyid:49bdcd1278fce71d7c5cb3ee9138c22f7379e8e0]
+
+One useful environment variable,
+
+ABAC_CN, use CN instead of SHA1 value for identifying the principals. This
+is useful for debugging purpose but will not resolve conflict when CN is not
+uniquely associated with each principal's SHA1 value.
+
+env ABAC_CN=1 runall run
+
+
Index: examples/creddy_prover_tests/access_rt2/README
===================================================================
--- examples/creddy_prover_tests/access_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/access_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,103 @@
+#!/bin/sh
+
+#####################################################################
+# This example demonstrates using an oset (object set) to control access
+# to files based on the attributes of the principals.  The script creates
+# three principals Alpha, Bob and Joe and sets out the access policy.
+# 
+# files are named by URNs and are not principals.
+# 
+# A principal's access rights are controlled by the Alpha principal.  If a 
+# principal has the role role::aceess(string:'Read', urn:filename) that 
+# principal can Read filename.  
+# The policy names 2 teams, proj1 and proj1.  A principal is on proj1 if it
+# has the role team(string:'proj1') defined by Alpha (written
+# [keyid:Alpha}.role:team(string:'proj1')).  Each project has an associated set
+# of files, defined by object sets.  A file is in proj1's documents if it is in
+# the oset of documents('proj1') defined by Alpha, written
+# [keyid:Alpha].oset:documents(string:'proj1'))
+# 
+# The example below lays out the policy that members of a given project can
+# Read the documents of that project in Credential 1 and adds file://fileA to
+# the document set for proj1 in Credential 2 - note that no principal is
+# required for fileA.  Credentials 3 & 4 add Bob to proj1 and Joe to proj2.
+#
+# The attached ./run_query file runs 3 queries.  First it confirms that Bob can Read
+# fileA, then it confirms that Joe cannot.  Finally it confirms that Joe is in
+# proj2.
+
+# access_rt2_typed
+
+# alpha.access(Read,fileA)<-?-bob  good
+# [keyid:Alpha].role:access([string:'Read'],[urn:'file//fileA']) <-?- [keyid:Bob] (yes)
+
+creddy --generate --cn Alpha
+creddy --generate --cn Bob
+creddy --generate --cn Joe
+
+alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+access_qFqP="access([string:'Read'],[urn:?F[keyid:$alpha_keyid].oset:documents([string:?P])])"
+team_qP="team([string:?P])" 
+
+#[keyid:alpha].role:access([string:'Read'],
+#                    [urn:?F[keyid:alpha].oset:documents([string:?P])])
+#                                     <- [keyid:alpha].role:team([string:?P]) 
+# Credential 1
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role "$access_qFqP" \
+       --subject-cert Alpha_ID.pem --subject-role "$team_qP" \
+       --out Alpha_access_qFqP__alpha_team_qP_attr.der
+
+
+# Credential 2
+#[keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] 
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem \
+        --oset "documents([string:'proj1'])" \
+        --subject-obj "[urn:'file//fileA']" \
+        --out Alpha_documents_proj1__fileA_attr.der
+
+# Credential 3
+# [keyid:alpha].role:team([string:'proj1'])<-[keyid:Bob]
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem \
+        --role "team([string:'proj1'])" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_team_proj1__Bob_attr.der
+
+# Credential 4
+# [keyid:alpha].role:team([string:'proj2'])<-[keyid:Joe]
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem \
+        --role "team([string:'proj2'])" \
+        --subject-cert Joe_ID.pem \
+        --out Alpha_team_proj2__Joe_attr.der
+
+
+#####################################################################
+# alpha.access(Read,?F:alpha.documents(?proj)) <- alpha.team(?proj)
+# [keyid:alpha].role:access([string:'Read'],
+#                    [urn:?F[keyid:alpha].oset:documents([string:?P])])
+#                                     <- [keyid:alpha].role:team([string:?P]) 
+# 
+# [keyid:alpha].role:access([string:'Read'], [urn:?F])<- [principal:?B] 
+#                [keyid:alpha].oset:documents([string:?P]) <- [urn:?F]
+#                [keyid:alpha].role:team([string:?P]) <- [principal:?B]
+# 
+# 
+# alpha.documents(proj1)<-fileA
+# [keyid:alpha].oset:documents([string:'proj1'])<-[urn:'file//fileA'] 
+# isMember('file//fileA', oset(alpha,documents,'proj1'))
+# 
+# alpha.team(proj1)<-bob
+# [keyid:alpha].role:team([string:'proj1'])<-[keyid:bob]
+# isMember(bob,role(alpha,team,'proj1'))
+# 
+# query,
+# alpha.access(Read,fileA)<-?-bob  good
+# [keyid:alpha].role:access([string:'Read'],[urn:'file//fileA']) <- [keyid:bob]
+# isMember(bob, role(alpha, access, 'Read', 'file//fileA')).
+# 
Index: examples/creddy_prover_tests/access_rt2/run_query
===================================================================
--- examples/creddy_prover_tests/access_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/access_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,40 @@
+
+
+# access_rt2_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+alpha=`creddy --keyid --cert $keyloc/Alpha_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+
+bob_prin="[keyid:$bob]"
+
+access_fileA="[keyid:$alpha].role:access([string:'Read'],[urn:'file//fileA'])"
+team_proj2="[keyid:$alpha].role:team([string:'proj2'])"
+bob_prin="[keyid:$bob]"
+joe_prin="[keyid:$joe]"
+
+## dump all credentials 
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+# double check
+#creddy  --roles --cert Alpha_access_qFqP__alpha_team_qP_attr.der
+
+#[keyid:Alpha].role:access([string:'Read'],[urn:'file//fileA']) <-?- [keyid:bob] (yes)
+echo " "
+echo "===good============ Alpha.access(Read,fileA)<-?-Bob"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$access_fileA" --principal "$bob_prin"
+
+echo " "
+echo "===bad============ Alpha.access(Read,fileA)<-?-Joe"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$access_fileA" --principal "$joe_prin"
+
+echo " "
+echo "===good============ Alpha.team(proj2)<-?-Joe"
+#[keyid:alpha].role:team([string:'proj2'])<-[keyid:Joe]
+$eloc/abac_prover_yap  --keystore $keyloc --role "$team_proj2" --principal "$joe_prin"
+
Index: examples/creddy_prover_tests/acme_friend_rt1/README
===================================================================
--- examples/creddy_prover_tests/acme_friend_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/acme_friend_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,57 @@
+#!/bin/sh
+#
+# This example shows how a parameterized role can be used to infer a role and
+# that the same role can also be directly assigned.  The example has 4
+# principals, the Acme company, a Coyote, a RoadRUnner and a Jackrabbit.
+#
+# The policy of the Acme company is that anyone the Acme company thinks is a
+# friend of the Roadrunner is a preferred customer.  A friend of the roadrunner
+# has the [keyid:Acme}.role:friendOf([keyid:Roadrunner]) role, and a preferred
+# customer has the [keyid:Acme].role:preferred_customer role.
+#
+# This script creates the 4 and 3 credentials.  Credential 1 lays out the rule
+# that friends of the Roadrunner are preferred customers.  Credential 2
+# directly makes the Coyote a preferred customer.  Credential 3 recognizes that
+# Acme thinks that the Jackrabbit is the Roadrunner's friend.
+# 
+# The attached ./run_query script tests whether the coyote is a friend of the
+# Roadrunner (which fails), whether the Jackrabbit is a friend of teh
+# Roadrunner (which succeeds), whether the Jackrabbit is a preferred customer
+# (which succeeds), whether the Coyote is a prefered customer (succeeds for a
+# different reason) and whether the system fails to load a bad certificate (it
+# does).
+
+# acme_friend_rt1_typed
+
+#[keyid:Acme].role:friendof([keyid:Roadrunner]) <-?- [keyid:Coyote] (no)
+#[keyid:Acme].role:preferred_customer <-?- [keyid:Jackrabbit] (yes)
+
+creddy --generate --cn Acme
+creddy --generate --cn Coyote
+creddy --generate --cn Roadrunner
+creddy --generate --cn Jackrabbit
+
+roadrunner_keyid=`creddy --keyid --cert Roadrunner_ID.pem`
+friendof_roadrunner="friendOf([keyid:$roadrunner_keyid])"
+
+#[keyid:Acme].role:preferred_customer <- [keyid:Acme].role:friendOf([keyid:Roadrunner])
+# Credential 1
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Acme_ID.pem --subject-role  $friendof_roadrunner \
+       --out Acme_preferred_customer__Acme_friendof_Roadrunner_attr.der
+
+#[keyid:Acme].role:prefered_customer <- [keyid:Coyote]
+# Credential 2
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Coyote_ID.pem \
+       --out Acme_preferred_customer__Coyote_attr.der
+
+#[keyid:Acme].role:friendOf([keyid:Roadrunner]) <- [keyid:Jackrabbit]
+# Credential 3
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role $friendof_roadrunner \
+       --subject-cert Jackrabbit_ID.pem \
+       --out Acme_friendof_Roadrunner__Jackrabbit_attr.der
+
Index: examples/creddy_prover_tests/acme_friend_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/acme_friend_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/acme_friend_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,48 @@
+
+# acme_friend_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+roadrunner=`creddy --keyid --cert $keyloc/Roadrunner_ID.pem`
+acme=`creddy --keyid --cert $keyloc/Acme_ID.pem`
+coyote=`creddy --keyid --cert $keyloc/Coyote_ID.pem`
+jackrabbit=`creddy --keyid --cert $keyloc/Jackrabbit_ID.pem`
+
+friendof_roadrunner="[keyid:$acme].role:friendOf([keyid:$roadrunner])"
+coyote_prin="[keyid:$coyote]"
+badcoyote_prin="[keyid:bad]"
+preferred_customer="[keyid:$acme].role:preferred_customer"
+jackrabbit_prin="[keyid:$jackrabbit]"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Acme].role:friendof([keyid:Roadrunner]) <-?- [keyid:Coyote]
+echo "  "
+echo "===bad============ Acme.friendOf(Roadrunner) <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$friendof_roadrunner" --principal "$coyote_prin"
+
+#[keyid:Acme].role:friendof([keyid:Roadrunner]) <-?- [keyid:Jackrabbit]
+echo "  "
+echo "===good============ Acme.friendOf(Roadrunner) <- Jackrabbit"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$friendof_roadrunner" --principal "$jackrabbit_prin"
+
+#[keyid:Acme].role:preferred_customer <-?- [keyid:Jackrabbit]
+echo "  "
+echo "===good============ Acme.preferred_customer <- Jackrabbit"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$preferred_customer" --principal "$jackrabbit_prin"
+
+#[keyid:Acme].role:preferred_customer <-?- [keyid:Coyote]
+echo "  "
+echo "===good============ Acme.preferred_customer <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$preferred_customer" --principal "$coyote_prin"
+
+#[keyid:Acme].role:preferred_customer <-?- [keyid:badCoyote]
+echo "  "
+echo "===bad============ Acme.preferred_customer <- badCoyote"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$preferred_customer" --principal "$badcoyote_prin"
+
+
Index: examples/creddy_prover_tests/acme_rockets_intersection_rt0/README
===================================================================
--- examples/creddy_prover_tests/acme_rockets_intersection_rt0/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/acme_rockets_intersection_rt0/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,71 @@
+#!/bin/sh
+#
+# This example demonstrates intersections.  An intersection is a logical and of
+# roles or osets.  An intersection succeeds if the principal is in the
+# intersection of the sets defined by the roles.
+#
+# The policy set by Acme is that a character must both a preferred customer and
+# a WarnerBrothers character to buy rockets.  Each of those attributes is
+# specified by a role.
+#
+# This example defines 4 principals, Acme, WarnerBrothers, Coyote and Batman.
+# Credential 1 defines the policy requiring both roles to get the buy_rockets
+# role.  Credential 2 gives the Coyote a preferred_customer role.  Credential 3
+# gives Batman the preferred_customer role and Credential 4 recognizes the
+# Coyote as a Warner Brothers character.
+#
+#In order to buy rockets from Acme, you must be BOTH a preferred customer
+#AND a WarnerBros character. In this example, the following query will be
+#successful:
+#
+#    Acme.buy_rockets <-?- Coyote
+#
+#The following query will fail (because Batman does not have the
+#attribute WarnerBros.character):
+#
+#    Acme.buy_rockets <-?- Batman
+# 
+# The attached ./run_query file carries out these queries.  As well as 2 queries for
+# non-existant certificates (which fail).
+#
+#Acme.buy_rockets <- Acme.preferred_customer & WarnerBros.character
+#Acme.preferred_customer <- Coyote
+#Acme.preferred_customer <- Batman
+#WarnerBros.character <- Coyote
+#
+
+# acme_rockets_intersection_rt0_typed
+
+creddy --generate --cn Acme
+creddy --generate --cn WarnerBros
+creddy --generate --cn Coyote
+creddy --generate --cn Batman
+
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer & [keyid:WarnerBros].role:charater
+# Credential 1
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role buy_rockets \
+       --subject-cert Acme_ID.pem --subject-role preferred_customer \
+       --subject-cert WarnerBros_ID.pem --subject-role character \
+       --out Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.der
+
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+# Credential 2
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Coyote_ID.pem \
+       --out Acme_preferred_customer__Coyote_attr.der
+
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+# Credential 3
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Batman_ID.pem \
+       --out Acme_preferred_customer__Batman_attr.der
+
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
+# Credential 4
+creddy --attribute \
+       --issuer WarnerBros_ID.pem --key WarnerBros_private.pem --role character \
+       --subject-cert Coyote_ID.pem \
+       --out WarnerBros_character__Coyote_attr.der
Index: examples/creddy_prover_tests/acme_rockets_intersection_rt0/run_query
===================================================================
--- examples/creddy_prover_tests/acme_rockets_intersection_rt0/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/acme_rockets_intersection_rt0/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,51 @@
+
+# acme_rockets_intersection_rt0_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+acme=`creddy --keyid --cert $keyloc/Acme_ID.pem`
+batman=`creddy --keyid --cert $keyloc/Batman_ID.pem`
+coyote=`creddy --keyid --cert $keyloc/Coyote_ID.pem`
+
+buy_rockets="[keyid:$acme].role:buy_rockets"
+coyote_prin="[keyid:$coyote]"
+batman_prin="[keyid:$batman]"
+bad_buy_rockets="[keyid:$acme].role:bad_buy_rockets"
+bad_buy_rockets2="[keyid:99$acme].role:buy_rockets"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Acme].role:buy_rockets <-?- [keyid:Coyote]
+#isMember(pCoyote, role(pAcme,buy_rockets), C).
+echo "  "
+echo "===good============ Acme.buy_rockets <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc \
+              --role "$buy_rockets" --principal "$coyote_prin"
+
+#[keyid:Acme].role:bad_buy_rockets <-?- [keyid:Coyote]
+#isMember(pCoyote, role(pAcme,bad_buy_rockets), C).
+echo "  "
+echo "===bad============ Acme.bad_buy_rockets <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc \
+              --role "$bad_buy_rockets" --principal "$coyote_prin"
+
+#[keyid:Acme99].role:buy_rockets <-?- [keyid:Coyote]
+#isMember(pCoyote99, role(99pAcme,buy_rockets), C).
+echo "  "
+echo "===bad============ 99Acme.buy_rockets <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc \
+              --role "$bad_buy_rockets2" --principal "$coyote_prin"
+
+#Acme.buy_rockets <-?- Batman
+#[keyid:Acme].role:buy_rockets <-?- [keyid:Batman]
+#isMember(pBatman, role(pAcme,buy_rockets), C).
+echo "  "
+echo "===bad=============== Acme.buy_rockets <- Batman"
+$eloc/abac_prover_yap  --keystore $keyloc \
+              --role "$buy_rockets" --principal "$batman_prin"
+
+
Index: examples/creddy_prover_tests/acme_rockets_rt0/README
===================================================================
--- examples/creddy_prover_tests/acme_rockets_rt0/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/acme_rockets_rt0/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# The example makes use of 2 principals, Acme and Coyote.
+#
+# This example shows a very simple delegation of roles by Acme.  Acme's
+# buy_rockets role includes all of Acme's preferred customers.  The example
+# creates the principals and 2 credentials.  Credential 1 encodes the policy
+# that all of Acme's preferred customers can buy rockets from Acme and
+# Credential 2 defines the Coyote as an Acme preferred customer.
+
+# The ./run_query script issues queries to show that the Coyote is both a preferred
+# customer and can buy rockets.  Two invalid queries are also made, checking if
+# Acme is the Coyote's friend, which it isn't and whether a query about
+# something other than a principal works (it doesn't).
+
+# acme_rockets_rt0_typed
+
+creddy --generate --cn Acme
+creddy --generate --cn Coyote
+
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+# Credential 1
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role buy_rockets \
+       --subject-cert Acme_ID.pem --subject-role preferred_customer \
+       --out Acme_buy_rockets__Acme_preferred_customer_attr.der
+
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+# Credential 2
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role preferred_customer \
+       --subject-cert Coyote_ID.pem \
+       --out Acme_preferred_customer__Coyote_attr.der
+
Index: examples/creddy_prover_tests/acme_rockets_rt0/run_query
===================================================================
--- examples/creddy_prover_tests/acme_rockets_rt0/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/acme_rockets_rt0/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,48 @@
+
+# acme_rockets_rt0_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+acme=`creddy --keyid --cert $keyloc/Acme_ID.pem`
+coyote=`creddy --keyid --cert $keyloc/Coyote_ID.pem`
+
+preferred_customer="[keyid:$acme].role:preferred_customer"
+buy_rockets="[keyid:$acme].role:buy_rockets"
+coyote_prin="[keyid:$coyote]"
+friend="[keyid:$acme].role:friend"
+acme_prin="[keyid:$acme]"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Acme].role:preferred_customer <-?- [keyid:Coyote]
+#isMember(pCoyote, role(pAcme,preferred_customer), C).
+echo "  "
+echo "===good============ Acme.preferred_customer <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc \
+      --role "$preferred_customer" --principal "$coyote_prin"
+
+#[keyid:Acme].role:buy_rockets <-?- [keyid:Coyote]
+#isMember(pCoyote, role(pAcme,buy_rockets), C).
+echo "  "
+echo "===good=============== Acme.buy_rockets <- Coyote"
+$eloc/abac_prover_yap  --keystore $keyloc \
+        --role "$buy_rockets" --principal "$coyote_prin"
+
+## this is not suppose to work
+#[keyid:Acme].role:buy_rockets <-?- [keyid:Acme].role:preferred_customer
+echo "  "
+echo "===bad=============== Acme.buy_rockets <- Acme.preferred_customer"
+$eloc/abac_prover_yap  --keystore $keyloc \
+        --role "$buy_rockets" --principal "$preferred_customer"
+
+#[keyid:Coyote].role:friend <-?- [keyid:Acme]
+#isMember(pAcme, role(pCoyote,friend), C).
+echo "  "
+echo "===bad=============== Coyote.friend <- Acme"
+$eloc/abac_prover_yap  --keystore $keyloc \
+        --role "$friend" --principal "$acme_prin"
+
Index: examples/creddy_prover_tests/alice_rt1/README
===================================================================
--- examples/creddy_prover_tests/alice_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alice_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,172 @@
+#!/bin/sh
+
+## trying out different data param types
+
+# alice_rt1_typed
+
+creddy --generate --cn Alice
+creddy --generate --cn Hatter
+creddy --generate --cn MarchHare
+creddy --generate --cn Dormouse
+creddy --generate --cn Tea
+creddy --generate --cn Party 
+
+alice_keyid=`creddy --keyid --cert Alice_ID.pem`
+party_keyid=`creddy --keyid --cert Party_ID.pem`
+tea_keyid=`creddy --keyid --cert Tea_ID.pem`
+hatter_keyid=`creddy --keyid --cert Hatter_ID.pem`
+marchhare_keyid=`creddy --keyid --cert MarchHare_ID.pem`
+dormouse_keyid=`creddy --keyid --cert Dormouse_ID.pem`
+
+friendof_alice="friendOf-alice([keyid:$alice_keyid])"
+friendof_marchhare="friendOf([keyid:$marchhare_keyid])"
+guestof_marchhare="guestOf([keyid:$marchhare_keyid])"
+
+about_party="about([keyid:$tea_keyid],[time:20101010T],[boolean:true],[integer:4],[float:-200.0],[float:8],[time:20120205T182930],[string:'guest list'],[urn:'file://usr/local/party/~teaparty'])"
+
+about_other_party="about_other_party([keyid:$tea_keyid],[?],[integer:99],[time:?AAA],[integer:?BBB],[boolean:true],[integer:?])"
+
+about_time="about_time([time:20201101T])"
+about_another_time="about_another_time([time:20201101T182930])"
+about_key="about_key([keyid:$tea_keyid])"
+about_boolean="about_boolean([boolean:true])"
+about_integer="about_integer([integer:4])"
+about_another_integer="about_another_integer([integer:-7])"
+about_float="about_float([float:-200.0])"
+about_another_float="about_another_float([float:8])"
+about_third_float="about_another_float([float:0.22])"
+about_urn="about_urn([urn:'file://user/local/party/~sillyparty'])"
+about_string="about_string([string:'a confused party'])"
+about_string2="about_string([string:'a mangled \'string\''])"
+
+
+#[keyid:Party].role:about([keyid:tea],[time:201010],[string:'guest list'],[boolean:true],[integer:4]) <- [keyid:Party].role:guestOf([keyid:MarchHare])
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_party\" --subject-cert Party_ID.pem --subject-role  \"$guestof_marchhare\" --out party_about_party__guestof_marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_party" \
+       --subject-cert Party_ID.pem --subject-role  "$guestof_marchhare" \
+       --out party_about_party__guestof_marchhare_attr.der
+#echo "  "
+#echo "double checking with creddy --roles -certs party_about_party__guestof_marchhare_attr.der"
+#creddy --roles --cert party_about_party__guestof_marchhare_attr.der
+
+#[keyid:Party].role:about_other_party([keyid:$tea_keyid],[time:?],[boolean:true]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_other_party\" --subject-cert MarchHare_ID.pem --out party_about_other_party__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_other_party" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_other_party__marchhare_attr.der
+
+#[keyid:Party].role:about_string([string:'a confused party']) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_string\" --subject-cert MarchHare_ID.pem --out party_about_string__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_string" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_string__marchhare_attr.der
+
+#[keyid:Party].role:about_string2([string:'a mangled \'string\'']) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_string2\" --subject-cert MarchHare_ID.pem --out party_about_string2__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_string2" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_string2__marchhare_attr.der
+
+#[keyid:Party].role:about_urn([urn:'file://user/local/party/~sillyparty']) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_urn\" --subject-cert MarchHare_ID.pem --out party_about_urn__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_urn" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_urn__marchhare_attr.der
+
+#[keyid:Party].role:about_third_float([float:0.22]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_third_float\" --subject-cert MarchHare_ID.pem --out party_about_third_float__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_third_float" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_third_float__marchhare_attr.der
+
+#[keyid:Party].role:about_another_float([float:8]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_another_float\" --subject-cert MarchHare_ID.pem --out party_about_another_float__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_another_float" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_another_float__marchhare_attr.der
+
+#[keyid:Party].role:about_float([float:-200.0]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_float\" --subject-cert MarchHare_ID.pem --out party_about_float__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_float" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_float__marchhare_attr.der
+
+#[keyid:Party].role:about_another_integer([integer:-7]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_another_integer\" --subject-cert MarchHare_ID.pem --out party_about_another_integer__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_another_integer" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_another_nteger__marchhare_attr.der
+
+#[keyid:Party].role:about_integer([integer:4]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_integer\" --subject-cert MarchHare_ID.pem --out party_about_integer__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_integer" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_integer__marchhare_attr.der
+
+#[keyid:Party].role:about_boolean([boolean:true]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_boolean\" --subject-cert MarchHare_ID.pem --out party_about_boolean__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_boolean" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_boolean__marchhare_attr.der
+
+#[keyid:Party].role:about_key([keyid:$tea_keyid]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_key\" --subject-cert MarchHare_ID.pem --out party_about_key__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_key" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_key__marchhare_attr.der
+
+#[keyid:Party].role:about_another_time([time:20201101T182930]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_another_time\" --subject-cert MarchHare_ID.pem --out party_about_another_time__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_another_time" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_another_time__marchhare_attr.der
+
+#[keyid:Party].role:about_time([time:20201101T]) <- [keyid:MarchHare]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$about_time\" --subject-cert MarchHare_ID.pem --out party_about_time__marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$about_time" \
+       --subject-cert MarchHare_ID.pem \
+       --out party_about_time__marchhare_attr.der
+
+#[keyid:Party].role:guestof([principal:?V]) <- [keyid:Party].role:friendOf([principal:?V])
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role 'guestOf([principal:?V])' --subject-cert Party_ID.pem --subject-role 'friendOf([principal:?V])' --out party_guestof_qV__party_friendof_qV_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role 'guestOf([principal:?V])' \
+       --subject-cert Party_ID.pem --subject-role  'friendOf([principal:?V])' \
+       --out party_guestof_qV__party_friendof_qV_attr.der
+
+#[keyid:Party].role:guests <- [keyid:Party].role:friendOf([keyid:MarchHare])
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role guests --subject-cert Party_ID.pem --subject-role  \"$friendof_marchhare\" --out party_guests__party_friendof_marchhare_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role guests \
+       --subject-cert Party_ID.pem --subject-role  "$friendof_marchhare" \
+       --out party_guests__party_friendof_marchhare_attr.der
+
+#[keyid:Party].role:friendOf([keyid:MarchHare]) <- [keyid:Dormouse]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$friendof_marchhare\" --subject-cert Dormouse_ID.pem --out party_friendof_marchhare__dormouse_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$friendof_marchhare" \
+       --subject-cert Dormouse_ID.pem \
+       --out party_friendof_marchhare__dormouse_attr.der
+
+#[keyid:Party].role:friendOf([keyid:Alice]) <- [keyid:Hatter]
+#echo "creddy --attribute --issuer Party_ID.pem --key Party_private.pem --role \"$friendof_alice\" --subject-cert Hatter_ID.pem --out party_friendof_alice__hatter_attr.der"
+creddy --attribute \
+       --issuer Party_ID.pem --key Party_private.pem --role "$friendof_alice" \
+       --subject-cert Hatter_ID.pem \
+       --out party_friendof_alice__hatter_attr.der
+
+
Index: examples/creddy_prover_tests/alice_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/alice_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alice_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,32 @@
+
+# alice_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+alice=`creddy --keyid --cert Alice_ID.pem`
+party=`creddy --keyid --cert Party_ID.pem`
+tea=`creddy --keyid --cert Tea_ID.pem`
+hatter=`creddy --keyid --cert Hatter_ID.pem`
+marchhare=`creddy --keyid --cert MarchHare_ID.pem`
+dormouse=`creddy --keyid --cert Dormouse_ID.pem`
+
+party_guests="[keyid:$party].role:guests"
+dormouse_prin="[keyid:$dormouse]"
+hatter_prin="[keyid:$hatter]"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Party].role:guests <-?- [keyid:dormouse]
+echo "  "
+echo "===good============ Party.guests <- dourmouse"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$party_guests" --principal "$dormouse_prin"
+
+#[keyid:Party].role:guests <-?- [keyid:hatter]
+echo "  "
+echo "===bad============ Party.guests <- hatter"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$party_guests" --principal "$hatter_prin"
+
Index: examples/creddy_prover_tests/allout.save
===================================================================
--- examples/creddy_prover_tests/allout.save	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/allout.save	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,317 @@
+
+ ==> RUN on access_rt2
+ 
+===good============ Alpha.access(Read,fileA)<-?-Bob
+YAP query succeed
+prover success!!
+credentials needed :
+ pAlpha.access('Read',F:pAlpha.documents(P))  <- pAlpha.team(P) 
+ pAlpha.documents('proj1')  <- 'file//fileA' 
+ pAlpha.team('proj1')  <- pBob 
+ 
+===bad============ Alpha.access(Read,fileA)<-?-Joe
+YAP query failed
+prover failed!!
+ 
+===good============ Alpha.team(proj2)<-?-Joe
+YAP query succeed
+prover success!!
+credentials needed :
+ pAlpha.team('proj2')  <- pJoe 
+
+ ==> RUN on acme_friend_rt1
+  
+===bad============ Acme.friendOf(Roadrunner) <- Coyote
+YAP query failed
+prover failed!!
+  
+===good============ Acme.friendOf(Roadrunner) <- Jackrabbit
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.friendOf(pRoadrunner)  <- pJackrabbit 
+  
+===good============ Acme.preferred_customer <- Jackrabbit
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.preferred_customer  <- pAcme.friendOf(pRoadrunner) 
+ pAcme.friendOf(pRoadrunner)  <- pJackrabbit 
+  
+===good============ Acme.preferred_customer <- Coyote
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.preferred_customer  <- pCoyote 
+  
+===bad============ Acme.preferred_customer <- badCoyote
+yyerror: encountered an invalid SHA id(bad)
+prover failed!!
+
+ ==> RUN on acme_rockets_intersection_rt0
+  
+===good============ Acme.buy_rockets <- Coyote
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.buy_rockets  <- pAcme.preferred_customer & pWarnerBros.character 
+ pAcme.preferred_customer  <- pCoyote 
+ pWarnerBros.character  <- pCoyote 
+  
+===bad============ Acme.bad_buy_rockets <- Coyote
+YAP query failed
+prover failed!!
+  
+===bad============ 99Acme.buy_rockets <- Coyote
+yyerror: encountered an invalid SHA id(994956018dbb522c97da1e0f19d7713510b14eb712)
+prover failed!!
+  
+===bad=============== Acme.buy_rockets <- Batman
+YAP query failed
+prover failed!!
+
+ ==> RUN on acme_rockets_rt0
+  
+===good============ Acme.preferred_customer <- Coyote
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.preferred_customer  <- pCoyote 
+  
+===good=============== Acme.buy_rockets <- Coyote
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.buy_rockets  <- pAcme.preferred_customer 
+ pAcme.preferred_customer  <- pCoyote 
+  
+===bad=============== Acme.buy_rockets <- Acme.preferred_customer
+fail, a.o <- b.o and a.r <- a.r query is not implemented yet !!!
+  
+===bad=============== Coyote.friend <- Acme
+YAP query failed
+prover failed!!
+
+ ==> RUN on alice_rt1
+  
+===good============ Party.guests <- dourmouse
+YAP query succeed
+prover success!!
+credentials needed :
+ pParty.guests  <- pParty.friendOf(pMarchHare) 
+ pParty.friendOf(pMarchHare)  <- pDormouse 
+  
+===bad============ Party.guests <- hatter
+YAP query failed
+prover failed!!
+
+ ==> RUN on alumni2_rt1
+ 
+===good============ stateU.foundingAlumni <- Bob
+YAP query succeed
+prover success!!
+credentials needed :
+ pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1963,1961,1960]) 
+ pStateU.diploma('mathmatics',1961)  <- pBob 
+ 
+===bad============ stateU.foundingAlumni <- Maryann
+YAP query failed
+prover failed!!
+ 
+===bad============ stateU.foundingAlumni <- Joe
+YAP query failed
+prover failed!!
+
+ ==> RUN on alumni3_rt1
+ 
+===good============ stateU.foundingAlumni <- Bob
+YAP query succeed
+prover success!!
+credentials needed :
+ pStateU.foundingAlumni  <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960]) 
+ pStateU.diploma('mathmatics',1961)  <- pBob 
+ 
+===bad============ stateU.foundingAlumni <- Mark
+YAP query failed
+prover failed!!
+ 
+===bad============ stateU.foundingAlumni <- Joe
+YAP query failed
+prover failed!!
+ 
+===bad============ stateU.foundingAlumni <- Maryann
+YAP query failed
+prover failed!!
+ 
+===good============ stateU.foundingAlumni <- Jan
+YAP query succeed
+prover success!!
+credentials needed :
+ pStateU.foundingAlumni  <- pStateU.diploma(D:['psychology','mathmatics'],Year:[1963,1961,1960]) 
+ pStateU.diploma('psychology',1960)  <- pJan 
+
+ ==> RUN on alumni_rt1
+ 
+===bad============ stateU.foundingAlumni <- Bob
+YAP query failed
+prover failed!!
+ 
+===good============ stateU.foundingAlumni <- Maryann
+YAP query succeed
+prover success!!
+credentials needed :
+ pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1955..1958]) 
+ pStateU.diploma('psychology',1956)  <- pMaryann 
+ 
+===good============ stateU.foundingAlumni <- Joe
+YAP query succeed
+prover success!!
+credentials needed :
+ pStateU.foundingAlumni  <- pStateU.diploma(_,Year:[1955..1958]) 
+ pStateU.diploma('zoology',1955)  <- pJoe 
+
+ ==> RUN on balltime_rt2
+ 
+===good============ league.stadium(access,true,20120128T130000)<-?-john
+YAP query succeed
+prover success!!
+credentials needed :
+ pLeague.stadium('access',true,F:pLeague.gametime(T))  <- pLeague.players(T) 
+ pLeague.gametime('north')  <- time(2012,02,28,13,00,00) 
+ pLeague.players('north')  <- pJohn 
+ 
+===bad============ league.stadium(access,true,20120128T110000)<-?-mark
+YAP query failed
+prover failed!!
+ 
+===good============ league.stadium(access,true,20120128T080000)<-?-mark
+YAP query succeed
+prover success!!
+credentials needed :
+ pLeague.stadium('access',B:[true],F:[20120228T080000..20120228T090000])  <- pLeague.players(T) 
+ pLeague.players('south')  <- pMark 
+
+ ==> RUN on evaluator_rt1
+ 
+===good============ USC.evaluatorOf(Maryann) <- John
+YAP query succeed
+prover success!!
+credentials needed :
+ pUSC.evaluatorOf(K)  <- pUSC.managerOf(K) 
+ pUSC.managerOf(K)  <- pISI.managerOf(K) 
+ pISI.managerOf(pMaryann)  <- pJohn 
+ 
+===good============ ISI.managerOf(Maryann) <- John
+YAP query succeed
+prover success!!
+credentials needed :
+ pISI.managerOf(pMaryann)  <- pJohn 
+ 
+===good============  USC.employee <-?- John
+YAP query succeed
+prover success!!
+credentials needed :
+ pUSC.employee  <- pISI.employee 
+ pISI.employee  <- pJohn 
+
+ ==> RUN on experiment_create_rt0
+ 
+===good=============== Globotron.admin <- Alice
+YAP query succeed
+prover success!!
+credentials needed :
+ pGlobotron.admin  <- pAlice 
+ 
+===bad=============== Globotron.admin <- Bob
+YAP query failed
+prover failed!!
+ 
+===good=============== Acme.experiment_create <- Bob
+YAP query succeed
+prover success!!
+credentials needed :
+ pAcme.experiment_create  <- pAcme.partner.experiment_create 
+ pAcme.partner  <- pGlobotron 
+ pGlobotron.experiment_create  <- pGlobotron.admin.power_user 
+ pGlobotron.admin  <- pAlice 
+ pAlice.power_user  <- pBob 
+
+ ==> RUN on file_read_rt2
+ 
+===good============ alpha.read(fileA) <- Bob
+YAP query succeed
+prover success!!
+credentials needed :
+ pAlpha.read(F)  <- pAlpha.managerOf(E:pAlpha.ownerOf(F)) 
+ pAlpha.ownerOf('file://fileA')  <- pJoe 
+ pAlpha.managerOf(pJoe)  <- pBob 
+ 
+===bad============ alpha.read(fileA) <- Maryann
+YAP query failed
+prover failed!!
+
+ ==> RUN on fruits_rt2
+ 
+===good============ mary.what2eat <- navel orange
+YAP query succeed
+prover success!!
+credentials needed :
+ pMary.what2eat  <- pRalphs.fruitprice(P:[..2.00]) 
+ pRalphs.fruitprice(0.50)  <- 'navel orange' 
+ 
+===good============ mary.what2eat <- kiwi
+YAP query succeed
+prover success!!
+credentials needed :
+ pMary.what2eat  <- pRalphs.fruitprice(P:[..2.00]) 
+ pRalphs.fruitprice(1.50)  <- 'kiwi' 
+ 
+===bad============ bob.what2eat <- navel orange
+YAP query failed
+prover failed!!
+ 
+===good============ ralphs.fruitprice(1.50) <- apple
+YAP query succeed
+prover success!!
+credentials needed :
+ pRalphs.fruitprice(1.50)  <- 'apple' 
+ 
+===bad============ ralphs.fruitprice(1.50) <- green apple
+YAP query failed
+prover failed!!
+
+ ==> RUN on leader_rt1
+ 
+===yes============ geni.leader <- Bob
+YAP query succeed
+prover success!!
+credentials needed :
+ pGeni.leader  <- pBob 
+ 
+===no============ geni.leader <- Jack
+YAP query failed
+prover failed!!
+ 
+===yes============ geni.leader <- Joe
+YAP query succeed
+prover success!!
+credentials needed :
+ pGeni.leader  <- pGeni.equivalent(P:pGeni.leader) 
+ pGeni.leader  <- pBob 
+ pGeni.equivalent(pBob)  <- pJoe 
+
+ ==> RUN on payraise_rt1
+ 
+===bad============ alpha.payRaise <- Joe
+YAP query failed
+prover failed!!
+ 
+===good============ alpha.payRaise <- Maryann
+YAP query succeed
+prover success!!
+credentials needed :
+ pAlpha.payRaise  <- pAlpha.evaluatorOf(This).goodPerformance & pAlpha.managerOf(This).niceCoworker 
+ pAlpha.evaluatorOf(pMaryann)  <- pBob 
+ pBob.goodPerformance  <- pMaryann 
+ pAlpha.managerOf(Z)  <- pAlpha.evaluatorOf(Z) 
+ pBob.niceCoworker  <- pMaryann 
Index: examples/creddy_prover_tests/alumni2_rt1/README
===================================================================
--- examples/creddy_prover_tests/alumni2_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alumni2_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,69 @@
+#!/bin/sh
+#
+# This example shows an example of reasoning about a role's parameters.  There
+# are 4 principals StateU, Bob, Maryann, and Joe.  StateU wants to establish a
+# set of founding alumni based on the year of graduation.  On graduation each
+# alum has previously been issued a credential parameterized with their major
+# and graduation year.  StateU sets up a policy that says that a principal is a
+# founding alum if they graduated in 1960, 1961, or 1963 no matter what major
+# the principal had.  One assumes there was some kind of NCAA suspension in
+# 1962.  This policy is expressed in Credential 1.
+#
+# Credentials 2, 3, and 4 each assign a diploma credential to Bob (a 1961
+# mathematics degree), Joe (a 1955 zoology degree) and Maryann (a 1962
+# psychology degree).
+#
+# The attached ./run_query file asks if each of these principals are favored
+# alums, and only Bob is.
+
+# alumni2_rt1_typeD
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+
+creddy --generate --cn StateU
+creddy --generate --cn Bob
+creddy --generate --cn Maryann
+creddy --generate --cn Joe
+
+stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+diploma_q_qY="diploma([?], [integer:?Year:[1960,1961,1963]])"
+
+diploma_m="diploma([string:'mathmatics'],[integer:1961])"
+diploma_z="diploma([string:'zoology'],[integer:1955])"
+diploma_p="diploma([string:'psychology'],[integer:1962])"
+
+# [keyid:stateU].role:foundingAlumni 
+#                   <- [keyid:stateU].role:diploma([?], [integer:?Year:[1960,1961,1963]])
+# Credential 1
+creddy --attribute \
+       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
+       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
+       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
+
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
+        --subject-cert Bob_ID.pem \
+        --out StateU_diploma_m__Bob_attr.der
+
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
+# Credential 3
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
+        --subject-cert Joe_ID.pem \
+        --out StateU_diploma_m__Joe_attr.der
+
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
+# Credential 4
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
+        --subject-cert Maryann_ID.pem \
+        --out StateU_diploma_m__Maryann_attr.der
+
Index: examples/creddy_prover_tests/alumni2_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/alumni2_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alumni2_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,42 @@
+
+# alumni2_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+stateU=`creddy --keyid --cert $keyloc/StateU_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+maryann=`creddy --keyid --cert $keyloc/Maryann_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+
+stateU_foundingAlumni="[keyid:$stateU].role:foundingAlumni"
+bob_prin="[keyid:$bob]"
+maryann_prin="[keyid:$maryann]"
+joe_prin="[keyid:$joe]"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+echo " "
+echo "===good============ stateU.foundingAlumni <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$bob_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# asking, isMember(pMaryann,role(pStateU,foundingAlumni),C).
+echo " "
+echo "===bad============ stateU.foundingAlumni <- Maryann"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$maryann_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+echo " "
+echo "===bad============ stateU.foundingAlumni <- Joe"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$joe_prin"
+
+
Index: examples/creddy_prover_tests/alumni3_rt1/README
===================================================================
--- examples/creddy_prover_tests/alumni3_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alumni3_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,90 @@
+#!/bin/sh
+#
+# This example shows an example of reasoning about a role's parameters.  There
+# are 4 principals StateU, Bob, Mark, Maryann, Joe, and Jan.  StateU wants to
+# establish a set of founding alumni based on the year of graduation.  On
+# graduation each alum has previously been issued a credential parameterized
+# with their major and graduation year.  StateU sets up a policy that says that
+# a principal is a founding alum if they graduated in 1960, 1961, or 1963 in
+# either mathematics or psychology.  One assumes there was some kind of NCAA
+# suspension in 1962.  This policy is expressed in Credential 1.
+#
+# Credentials 2, 3, 4, 5, and 6 each assign a diploma credential to Bob (a 1961
+# mathematics degree), Mark (a 1965 mathematics degree), Joe (a 1961 zoology degree), Maryann (a 1962 psychology degree), and Jan (a 1960 psychology degree)
+#
+# The attached ./run_query file asks if each of these principals are favored
+# alums, and only Bob and Jan are.
+
+# alumni3_rt1_typed
+
+rm -rf *.der *.pem
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+
+creddy --generate --cn StateU
+creddy --generate --cn Bob
+creddy --generate --cn Mark
+creddy --generate --cn Joe
+creddy --generate --cn Maryann
+creddy --generate --cn Jan
+
+stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
+
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+mark_keyid=`creddy --keyid --cert Mark_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+jan_keyid=`creddy --keyid --cert Jan_ID.pem`
+
+diploma_q_qY="diploma([string:?D:['mathmatics','psychology']], [integer:?Year:[1960,1961,1963]])"
+
+diploma_m="diploma([string:'mathmatics'],[integer:1961])"
+diploma_mm="diploma([string:'mathmatics'],[integer:1965])"
+diploma_z="diploma([string:'zoology'],[integer:1961])"
+diploma_p="diploma([string:'psychology'],[integer:1962])"
+diploma_pp="diploma([string:'psychology'],[integer:1960])"
+
+# [keyid:stateU].role:foundingAlumni 
+#                   <- [keyid:stateU].role:diploma([string:?D:['mathmatics','psychology']], [integer:?Year:[1960,1961,1963]])
+# Credential 1
+creddy --attribute \
+       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
+       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
+       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
+
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1961]) <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
+        --subject-cert Bob_ID.pem \
+        --out StateU_diploma_m__Bob_attr.der
+
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1965]) <- [keyid:mark]
+# Credential 3
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_mm" \
+        --subject-cert Mark_ID.pem \
+        --out StateU_diploma_mm__Mark_attr.der
+
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1961]) <- [keyid:joe]
+# Credential 4
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
+        --subject-cert Joe_ID.pem \
+        --out StateU_diploma_z__Joe_attr.der
+
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1962]) <- [keyid:maryann]
+# Credential 5
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
+        --subject-cert Maryann_ID.pem \
+        --out StateU_diploma_p__Maryann_attr.der
+
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1960]) <- [keyid:jan]
+# Credential 6
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_pp" \
+        --subject-cert Jan_ID.pem \
+        --out StateU_diploma_pp__Jan_attr.der
+
Index: examples/creddy_prover_tests/alumni3_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/alumni3_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alumni3_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,58 @@
+
+# alumni3_rt1_typed  
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+stateU=`creddy --keyid --cert $keyloc/StateU_ID.pem`
+
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+mark=`creddy --keyid --cert $keyloc/Mark_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+maryann=`creddy --keyid --cert $keyloc/Maryann_ID.pem`
+jan=`creddy --keyid --cert $keyloc/Jan_ID.pem`
+
+stateU_foundingAlumni="[keyid:$stateU].role:foundingAlumni"
+bob_prin="[keyid:$bob]"
+maryann_prin="[keyid:$maryann]"
+joe_prin="[keyid:$joe]"
+mark_prin="[keyid:$mark]"
+jan_prin="[keyid:$jan]"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Mark] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Jan] (yes)
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (yes)
+echo " "
+echo "===good============ stateU.foundingAlumni <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$bob_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Mark] (no)
+echo " "
+echo "===bad============ stateU.foundingAlumni <- Mark"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$mark_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (no)
+echo " "
+echo "===bad============ stateU.foundingAlumni <- Joe"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$joe_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (no)
+# asking, isMember(pMaryann,role(pStateU,foundingAlumni),C).
+echo " "
+echo "===bad============ stateU.foundingAlumni <- Maryann"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$maryann_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Jan] (yes)
+echo " "
+echo "===good============ stateU.foundingAlumni <- Jan"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$jan_prin"
+
+
Index: examples/creddy_prover_tests/alumni_rt1/README
===================================================================
--- examples/creddy_prover_tests/alumni_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alumni_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,90 @@
+#!/bin/sh
+#
+# This example shows an example of reasoning about a role's parameters.  There
+# are 4 principals StateU, Bob, Maryann, and Joe.  StateU wants to establish a
+# set of founding alumni based on the year of graduation.  On graduation each
+# alum has previously been issued a credential parameterized with their major
+# and graduation year.  StateU sets up a policy that says that a principal is a
+# founding alum if they graduated in 1955 through 1958 inclusive no matter what
+# major the principal had.  This policy is expressed in Credential 1.
+#
+# Credentials 2, 3, and 4 each assign a diploma credential to Bob (a 1960
+# mathematics degree), Joe (a 1955 zoology degree) and Maryann (a 1956
+# psychology degree).
+#
+# The attached ./run_query file asks if each of these principals are favored
+# alums and Joe and Maryann are.
+
+# alumni_rt1_typed
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (yes)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (yes)
+
+creddy --generate --cn StateU
+creddy --generate --cn Bob
+creddy --generate --cn Maryann
+creddy --generate --cn Joe
+
+stateU_keyid=`creddy --keyid --cert StateU_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+diploma_q_qY="diploma([?], [integer:?Year:[1955..1958]])"
+
+diploma_m="diploma([string:'mathmatics'],[integer:1960])"
+diploma_z="diploma([string:'zoology'],[integer:1955])"
+diploma_p="diploma([string:'psychology'],[integer:1956])"
+
+# [keyid:stateU].role:foundingAlumni 
+#                   <- [keyid:stateU].role:diploma([?], [integer:?Year:[1955..1958]])
+# Credential 1
+creddy --attribute \
+       --issuer StateU_ID.pem --key StateU_private.pem --role "foundingAlumni" \
+       --subject-cert StateU_ID.pem --subject-role "$diploma_q_qY" \
+       --out StateU_foundingAlumni__stateU_diploma_q_qY_attr.der
+
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1960]) <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_m" \
+        --subject-cert Bob_ID.pem \
+        --out StateU_diploma_m__Bob_attr.der
+
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
+# Credential 3
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_z" \
+        --subject-cert Joe_ID.pem \
+        --out StateU_diploma_m__Joe_attr.der
+
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1956]) <- [keyid:maryann]
+# Credential 4
+creddy --attribute \
+        --issuer StateU_ID.pem --key StateU_private.pem --role "$diploma_p" \
+        --subject-cert Maryann_ID.pem \
+        --out StateU_diploma_m__Maryann_attr.der
+
+
+#####################################################################
+# stateU.foundingAlumni <- stateU.diploma(?, ?Year:[1955..1958])
+# [keyid:stateU].role:foundingAlumni 
+#                <- [keyid:stateU].role:diploma([?], [integer:?Year:[1955..1958]])
+# 
+# stateU.diploma(mathmatics,1960)<-bob
+# [keyid:stateU].role:diploma([string:'mathmatics'],[integer:1960]) <- [keyid:bob]
+# 
+# stateU.diploma(zoology,1955)<-joe
+# [keyid:stateU].role:diploma([string:'zoology'],[integer:1955]) <- [keyid:joe]
+#
+# stateU.diploma(psychology,1956)<-maryann
+# [keyid:stateU].role:diploma([string:'psychology'],[integer:1956]) <- [keyid:maryann]
+#
+# query,
+# stateU.foundingAlumni<-?-bob  bad
+# [keyid:stateU].role:foundingAlumni <- [keyid:bob]
+# 
+# stateU.foundingAlumni<-?-maryann  good
+# [keyid:stateU].role:foundingAlumni <- [keyid:maryann]
+#
Index: examples/creddy_prover_tests/alumni_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/alumni_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/alumni_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,41 @@
+
+# alumni_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+stateU=`creddy --keyid --cert $keyloc/StateU_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+maryann=`creddy --keyid --cert $keyloc/Maryann_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+
+stateU_foundingAlumni="[keyid:$stateU].role:foundingAlumni"
+bob_prin="[keyid:$bob]"
+maryann_prin="[keyid:$maryann]"
+joe_prin="[keyid:$joe]"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (no)
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (yes)
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Bob] (no)
+echo " "
+echo "===bad============ stateU.foundingAlumni <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$bob_prin"
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Maryann] (yes)
+# asking, isMember(pMaryann,role(pStateU,foundingAlumni),C).
+echo " "
+echo "===good============ stateU.foundingAlumni <- Maryann"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$maryann_prin"
+
+
+# [keyid:stateU].role:foundingAlumni <-?- [keyid:Joe] (yes)
+echo " "
+echo "===good============ stateU.foundingAlumni <- Joe"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stateU_foundingAlumni" --principal "$joe_prin"
+
Index: examples/creddy_prover_tests/balltime_rt2/README
===================================================================
--- examples/creddy_prover_tests/balltime_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/balltime_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,121 @@
+#!/bin/sh
+#
+#####################################################################
+# This example demonstrates using an oset (object set) to control access
+# to files based on the attributes of the principals.  The script creates
+# three principals League, John and Mark and sets out the access policy.
+# 
+# files are named by URNs and are not principals.
+# 
+# A principal's access rights are controlled by the League principal.  If a 
+# principal has the role role::stadium(string:'access',boolean:true,time:now)
+# that  principal can go into stadium if principal's team has a scheduled 
+# gametime.  A principal is in team's roster if it is in
+# the oset of players(team) defined by League, written
+# [keyid:League].oset:players(string:'north'))
+# 
+# The example below lays out the policy that players of a given team can
+# go to the stadium when it is their team's gametime -- credential 1.
+# or any player of a team that is controlled by the League principal can
+# go to the stadium during stadium's free for all time -- credential 2.
+#
+# Credentials 3 & 4 establish the afernoon gametimes for team(north) 
+# and for team(south)
+# Credentials 5 & 6 establish John as player of team(north) and Mark as
+# a player for team(south)
+#
+# The attached ./run_query file runs 3 queries.  First it confirms that John can 
+# go to stadium at his team's gametime, then it confirms that Mark cannot
+# go because it is not his gametime, but Mark can go to the stadium during
+# stadium's free-for-all early morning time
+
+# balltime_rt2_typed
+
+creddy --generate --cn League
+creddy --generate --cn John
+creddy --generate --cn Mark
+
+league_keyid=`creddy --keyid --cert League_ID.pem`
+john_keyid=`creddy --keyid --cert John_ID.pem`
+mark_keyid=`creddy --keyid --cert Mark_ID.pem`
+
+stadium_qFqT="stadium([string:'access'],[boolean:true],[time:?F[keyid:$league_keyid].oset:gametime([string:?T])])"
+stadium_qR="stadium([string:'access'],[boolean:?B:[true]],[time:?F:[20120228T080000..20120228T090000]])"
+
+players_qT="players([string:?T])" 
+
+#[keyid:league].role:stadium([string:'access'],[boolean:true],
+#          [time:?F:[keyid:league].oset.gametime([string:?T])])
+#                <-[keyid:league].role:players([string:?T])
+# Credential 1
+creddy --attribute \
+       --issuer League_ID.pem --key League_private.pem --role "$stadium_qFqT" \
+       --subject-cert League_ID.pem --subject-role "$players_qT" \
+       --out League_access_qFqT__League_players_qT_attr.der
+
+#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true],
+#              [time:?F:[20120228T080000..20120228T090000]])
+#               <- [keyid:league].role:players(string:?T) 
+# Credential 2 
+creddy --attribute \
+       --issuer League_ID.pem --key League_private.pem --role "$stadium_qR" \
+       --subject-cert League_ID.pem --subject-role "$players_qT" \
+       --out League_access_qR__League_players_qT_attr.der
+
+
+# [keyid:league].oset:gametime([time:20120228T130000])
+#                    <- [keyid:league].oset:players([string:'north') 
+# Credential 3
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --oset "gametime([string:'north'])" \
+        --subject-obj "[time:20120228T130000]" \
+        --out League_gametime_north__timeT_attr.der
+
+# [keyid:league].oset:gametime([time:20120228T140000])
+#                    <- [keyid:league].oset:players([string:'south') 
+# Credential 4 
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --oset "gametime([string:'south'])" \
+        --subject-obj "[time:20120228T140000]" \
+        --out League_gametime_south__time2T_attr.der
+
+# [keyid:league].role:players([string:'north'])<-[keyid:John]
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --role "players([string:'north'])" \
+        --subject-cert John_ID.pem \
+        --out League_players_north__John_attr.der
+
+# [keyid:league].role:players([string:'south'])<-[keyid:Mark]
+creddy --attribute \
+        --issuer League_ID.pem --key League_private.pem \
+        --role "players([string:'south'])" \
+        --subject-cert Mark_ID.pem \
+        --out League_players_south__Mark_attr.der
+
+#####################################################################
+#league allows member of a team to access stadium at their team's designed time
+#
+#[keyid:league].role:stadium([string:'access'],[boolean:true],
+#          [time:?F:[keyid:league].oset.gametime([string:?T])])
+#                <-[keyid:league].role:players([string:?T])
+#
+#[keyid:league].role:stadium([string:'access'],[time:?Tm]) <- [principal:?P]
+#[keyid:league].oset:gametime(string:?Team) <- [time:?Tm]
+#[keyid:league].role:player(string:?Team) <- [principal:?P]
+#
+#
+#league.stadium(access,?Time:league.gametime(?Team)) <- league.players(?Teams)
+#              league.player(north) <- john
+#              league.player(south) <- mark 
+#              league.gametime(north) <- [time:'20120228T130000']
+#              league.gametime(south) <- [time:'20120228T140000']
+#
+#league.statdium(access,?FreeTime:[20120228T080000..20120228T090000]) 
+#                  <- league.players(_).
+#
+#[keyid:league].role:stadium([string:'access'],[boolean:?B:[true]],
+#              [time:?F:['20120228T080000'..'20120228T090000']])
+#               <- [keyid:league].role:players(string:?T) 
Index: examples/creddy_prover_tests/balltime_rt2/run_query
===================================================================
--- examples/creddy_prover_tests/balltime_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/balltime_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,37 @@
+
+# balltime_rt2_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+league=`creddy --keyid --cert $keyloc/League_ID.pem`
+john=`creddy --keyid --cert $keyloc/John_ID.pem`
+mark=`creddy --keyid --cert $keyloc/Mark_ID.pem`
+
+stadium_accessT="[keyid:$league].role:stadium([string:'access'],[boolean:true],[time:20120228T130000])"
+stadium_accessT2="[keyid:$league].role:stadium([string:'access'],[boolean:true],[time:20120228T110000])"
+stadium_accessT3="[keyid:$league].role:stadium([string:'access'],[boolean:true],[time:20120228T080000])"
+
+john_prin="[keyid:$john]"
+mark_prin="[keyid:$mark]"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:$league].role:stadium([string:'access'],[boolean:true],[time:20120228T130000]) <-?- [keyid:john] (yes)
+echo " "
+echo "===good============ league.stadium(access,true,20120128T130000)<-?-john"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stadium_accessT" --principal "$john_prin"
+
+#[keyid:$league].role:stadium([string:'access'],[boolean:true],[time:20120228T110000]) <-?- [keyid:mark] (no)
+echo " "
+echo "===bad============ league.stadium(access,true,20120128T110000)<-?-mark"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stadium_accessT2" --principal "$mark_prin"
+
+#[keyid:$league].role:stadium([string:'access'],[boolean:true],[time:20120228T080000]) <-?- [keyid:mark] (yes)
+echo " "
+echo "===good============ league.stadium(access,true,20120128T080000)<-?-mark"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$stadium_accessT3" --principal "$mark_prin"
+
Index: examples/creddy_prover_tests/evaluator_rt1/README
===================================================================
--- examples/creddy_prover_tests/evaluator_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/evaluator_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,76 @@
+#!/bin/sh
+#
+# This example demonstrates linking parameterized roles and delegating across
+# institutions.  There are 4 principals USC, ISI, John, and Maryann.  USC and
+# ISI are companies, and USC owns ISI.  USC sets the policy that the manager of
+# a principal (an employee) has the role of evaluating that employee (and no
+# others).  That policy is expressed in Credential 1.  Credential 2 says that
+# ISI's assignment of manager roles is accepted by USC.  Similarly Credential 4
+# says that any ISI employee is a USC employee.
+#
+# Credential 3 encodes ISI asserting that John is the manager of Maryann and
+# credentials 5 and 6 idicate that John and Maryann are ISI employees.
+# 
+# the attached ./run_query script queries that USC grants John the role of evaluator
+# of Maryann, that ISI asserts John is Maryann's manager and that John is an
+# ISI employee.
+
+# evaluator_rt1_typed
+
+#[keyid:USC].role:employee <-?- [keyid:John]
+#[keyid:USC].role:evaluatorOf([keyid:Maryann])<-?- [keyid:John]
+
+creddy --generate --cn ISI
+creddy --generate --cn USC
+creddy --generate --cn Maryann
+creddy --generate --cn John
+
+isi_keyid=`creddy --keyid --cert ISI_ID.pem`
+usc_keyid=`creddy --keyid --cert USC_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+john_keyid=`creddy --keyid --cert John_ID.pem`
+
+managerof_maryann="managerOf([keyid:$maryann_keyid])"
+
+#[keyid:USC].role:evaluatorOf([principal:?K])<-[keyid:USC].role:managerOf([principal:?K])
+# Credential 1
+creddy --attribute \
+       --issuer USC_ID.pem --key USC_private.pem --role 'evaluatorOf([principal:?K])' \
+       --subject-cert USC_ID.pem --subject-role 'managerOf([principal:?K])' \
+       --out USC_evaluatorof_qK__USC_managerof_qK_attr.der
+
+#[keyid:USC].role:managerOf([principal:?K])<-[keyid:ISI].role:managerOf([principal:?K])
+# Credential 2
+creddy --attribute \
+       --issuer USC_ID.pem --key USC_private.pem --role 'managerOf([principal:?K])' \
+       --subject-cert ISI_ID.pem --subject-role 'managerOf([principal:?K])' \
+       --out USC_managerof_qK__USC_employee_attr.der
+
+#[keyid:ISI].role:managerOf([keyid:Maryann]) <- [keyid:John]
+# Credential 3
+creddy --attribute \
+       --issuer ISI_ID.pem --key ISI_private.pem --role "$managerof_maryann" \
+       --subject-cert John_ID.pem \
+       --out ISI_manageof_Maryann__John_attr.der
+
+#[keyid:USC].role:employee <- [keyid:ISI].role:employee
+# Credential 4
+creddy --attribute \
+       --issuer USC_ID.pem --key USC_private.pem --role employee \
+       --subject-cert ISI_ID.pem --subject-role employee \
+       --out USC_employee__ISI_employee_attr.der
+
+#[keyid:ISI].role:employee  <- [keyid:Maryann]
+# Credential 5
+creddy --attribute \
+       --issuer ISI_ID.pem --key ISI_private.pem --role employee \
+       --subject-cert Maryann_ID.pem \
+       --out ISI_employee__Maryann_attr.der
+
+#[keyid:ISI].role:employee <- [keyid:John]
+# Credential 6
+creddy --attribute \
+       --issuer ISI_ID.pem --key ISI_private.pem --role employee \
+       --subject-cert John_ID.pem \
+       --out ISI_employee__John_attr.der
+
Index: examples/creddy_prover_tests/evaluator_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/evaluator_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/evaluator_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,39 @@
+
+# evaluator_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+isi=`creddy --keyid --cert ISI_ID.pem`
+usc=`creddy --keyid --cert USC_ID.pem`
+maryann=`creddy --keyid --cert Maryann_ID.pem`
+john=`creddy --keyid --cert John_ID.pem`
+
+usc_employee="[keyid:$usc].role:employee"
+usc_eval_maryann="[keyid:$usc].role:evaluatorOf([keyid:$maryann])"
+isi_manager_maryann="[keyid:$isi].role:managerOf([keyid:$maryann])"
+john_prin="[keyid:$john]"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:USC].role:evaluatorOf([keyid:Maryann]) <-?- [keyid:John]
+echo " "
+echo "===good============ USC.evaluatorOf(Maryann) <- John"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$usc_eval_maryann" --principal "$john_prin"
+
+#[keyid:ISI].role:managerOf([keyid:Maryann]) <-?- [keyid:John]
+echo " "
+echo "===good============ ISI.managerOf(Maryann) <- John"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$isi_manager_maryann" --principal "$john_prin"
+
+
+#[keyid:USC].role:employee <- [keyid:John]"
+#USC.employee <-?- John
+echo " "
+echo "===good============  USC.employee <-?- John"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$usc_employee" --principal "$john_prin"
+
+
Index: examples/creddy_prover_tests/experiment_create_rt0/README
===================================================================
--- examples/creddy_prover_tests/experiment_create_rt0/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/experiment_create_rt0/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,64 @@
+#!/bin/sh
+#
+#
+#Acme runs a testbed. They've delegated the authority to create
+#experiments to all their partners. The Globotron company is one such
+#partner.
+#
+#    Acme.experiment_create <- Acme.partner.experiment_create
+#
+#Globotron has delegated the authority to anyone an admin thinks is a
+#'power user'.
+#
+#    Globotron.experiment_create <- Globotron.admin.power_user
+#
+#Alice is an admin, and her friend Bob is a power user:
+#
+#    Globotron.admin <- Alice
+#    Alice.power_user <- Bob
+#
+#From these credentials, it is possible to construct a proof graph
+#showing that Acme.experiment_create <- Bob.
+#
+#Note that there is a one-to-one correspondence with each credential
+#above and the attribute certificates below.
+#
+
+# experiment_create_rt0_typed 
+
+creddy --generate --cn Acme
+creddy --generate --cn Globotron
+creddy --generate --cn Alice
+creddy --generate --cn Bob
+
+#[keyid:Acme].role:experiment_create <- [keyid:Acme].role:partner.role:experiment_create
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role experiment_create \
+       --subject-cert Acme_ID.pem --subject-role partner.experiment_create \
+       --out Acme_experiment_create__Acme_partner_experiment_create_attr.der
+
+#[keyid:Acme].role:partner <- [keyid:Globotron]
+creddy --attribute \
+       --issuer Acme_ID.pem --key Acme_private.pem --role partner \
+       --subject-cert Globotron_ID.pem \
+       --out Acme_partner__Globotron_attr.der 
+
+#[keyid:Globotron].role:expriment_create <- [keyid:Globotron].role:admin.role:power_user
+creddy --attribute \
+       --issuer Globotron_ID.pem --key Globotron_private.pem --role experiment_create \
+       --subject-cert Globotron_ID.pem --subject-role admin.power_user \
+       --out Globotron_experiment_create__Globotron_admin_power_user_attr.der
+
+#[keyid:Globotron].role:admin <- [keyid:Alice]
+creddy --attribute \
+       --issuer Globotron_ID.pem --key Globotron_private.pem --role admin \
+       --subject-cert Alice_ID.pem \
+       --out Globotron_admin__Alice_attr.der
+
+#[keyid:Alice].role:power_user <- [keyid:Bob]
+creddy --attribute \
+       --issuer Alice_ID.pem --key Alice_private.pem --role power_user \
+       --subject-cert Bob_ID.pem \
+       --out Alice_power_user__Bob_attr.der
+
+
Index: examples/creddy_prover_tests/experiment_create_rt0/run_query
===================================================================
--- examples/creddy_prover_tests/experiment_create_rt0/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/experiment_create_rt0/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,43 @@
+
+# experiment_create_rt0_typed 
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+acme=`creddy --keyid --cert $keyloc/Acme_ID.pem`
+alice=`creddy --keyid --cert $keyloc/Alice_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+globotron=`creddy --keyid --cert $keyloc/Globotron_ID.pem`
+
+glob_admin="[keyid:$globotron].role:admin"
+alice_prin="[keyid:$alice]"
+bob_prin="[keyid:$bob]"
+experiment_create="[keyid:$acme].role:experiment_create"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Globotron].role:admin <-?- [keyid:Alice]
+#isMember(pAlice, role(pGlobotron,admin), C).
+echo " "
+echo "===good=============== Globotron.admin <- Alice"
+$eloc/abac_prover_yap  --keystore $keyloc \
+             --role "$glob_admin" --principal "$alice_prin"
+
+#[keyid:Globotron].role:admin <-?- [keyid:Bob]
+#isMember(pBob, role(pGlobotron,admin), C).
+echo " "
+echo "===bad=============== Globotron.admin <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc \
+             --role "$glob_admin" --principal "$bob_prin"
+
+#[keyid:Acme].role:experiment_create <-?- [keyid:Bob]
+#isMember(pBob, role(pAcme,experiment_create), C).
+echo " "
+echo "===good=============== Acme.experiment_create <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc \
+             --role "$experiment_create" --principal "$bob_prin"
+
+
Index: examples/creddy_prover_tests/file_read_rt2/README
===================================================================
--- examples/creddy_prover_tests/file_read_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/file_read_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,96 @@
+#!/bin/sh
+#
+#####################################################################
+# This example demonstrates using a parameters to control access to files based
+# on the attributes of the principals.  The script creates three principals
+# Alpha, Bob, Maryann and Joe and sets out the access policy.
+# 
+# files are named by URNs and are not principals.
+# 
+# A principal's access rights are controlled by the Alpha principal.  If a
+# principal has the role role::read(urn:filename) that
+# principal can read filename.  The policy is that the manager of the owner of
+# a file can read it. (Presumably the owner can, too, but that is not encoded
+# here.)
+# 
+# The example below lays out the policy that the manager of the owner of a file
+# can read it in Credential 1. Credential 2 establishes Bob as the manager of
+# Joe. and Credential 3 establishes Joe as the owner of the file.
+#
+# The attached ./run_query file runs 2 queries.  First it confirms that Bob can read
+# fileA, then it confirms that Maryann cannot. 
+
+# file_read_rt2_typed
+
+# alpha.read(fileA) <-?- Bob
+#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Bob] (yes)
+#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Maryann] (yes)
+
+creddy --generate --cn Alpha
+creddy --generate --cn Bob
+creddy --generate --cn Maryann
+creddy --generate --cn Joe
+
+alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+read_fileA="read([urn:'file://fileA'])"
+managerof_joe="managerOf([keyid:$joe_keyid])"
+ownerof_fileA="ownerOf([urn:'file://fileA'])"
+managerof_qE="managerOf([principal:?E[keyid:$alpha_keyid].role:ownerOf([urn:?F])])"
+
+# alpha.read(?F) <- alpha.managerOf(?E:alpha.ownerOf(?F))
+# [keyid:alpha].role:read([urn:?F])<-
+#    [keyid:alpha].role:managerOf([principal:?E[keyid:alpha].role:ownerOf([urn:?F])]
+# Credential 1
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role "read([urn:?F])" \
+       --subject-cert Alpha_ID.pem --subject-role "$managerof_qE" \
+       --out Alpha_read_qF__alpha_managerof_qE_attr.der
+
+# Credential 2
+#[keyid:Alpha].role:managerOf([Keyid:Joe]) <- [keyid:Bob]
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$managerof_joe" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_managerof_Joe__Bob_attr.der
+
+# Credential 3
+#[keyid:Alpha].role:ownerOf([urn:'file://fileA']) <- [keyid:Joe]
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$ownerof_fileA" \
+        --subject-cert Joe_ID.pem \
+        --out Alpha_ownerof_fileA__Joe_attr.der
+
+####################################################################################
+# note:
+# 
+# alpha.read(?F) <- alpha.manager(?E:alpha.owner(?F))
+# [keyid:alpha].role:read([urn:?F])<-
+#       #[keyid:alpha].role:manager([principal:?E[keyid:alpha].role:owner([urn:?F])])
+# 
+# alpha.read(?F) <- alpha.manager(?E) 
+# and alpha.owner(?F) <- ?E
+# 
+# [keyid:alpha].role:read([urn:?F])<-[keyid:?M]
+#     [keyid:alpha].role:manager([principal:?E])<-[keyid:?M]
+#     [keyid:alpha].role:owner([urn:?F])<-[keyid:?E]
+# 
+# isMember(M,role(alpha,read,F)) :-
+#       isMember(M, role(alpha,manager,E)),
+#       isMember(E, role(alpha,owner,F))  <-- constraining rule
+# 
+# alpha.read(?F) <- alpha.manager(?E)
+# alpha.owner(?F) <- ?E
+# 
+# condition like this,
+#          ?E:A.r  needs to be translate into constraining rule,  A.r<-?E
+# 
+# query,
+# alpha.read(fileA) <-?- Bob
+# needs
+# alpha.manager(Joe)<-Bob
+# alpha.owner(fileA)<-Joe
+
Index: examples/creddy_prover_tests/file_read_rt2/run_query
===================================================================
--- examples/creddy_prover_tests/file_read_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/file_read_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,30 @@
+
+# file_read_rt2_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+alpha=`creddy --keyid --cert $keyloc/Alpha_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+maryann=`creddy --keyid --cert $keyloc/Maryann_ID.pem`
+alpha=`creddy --keyid --cert $keyloc/Alpha_ID.pem`
+
+read_fileA="[keyid:$alpha].role:read([urn:'file://fileA'])"
+bob_prin="[keyid:$bob]"
+maryann_prin="[keyid:$maryann]"
+
+## dump all credentials -- 
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Bob] (yes)
+echo " "
+echo "===good============ alpha.read(fileA) <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$read_fileA" --principal "$bob_prin"
+
+#[keyid:Alpha].role:read([urn:'file://fileA']) <-?- [keyid:Maryann] (no)
+echo " "
+echo "===bad============ alpha.read(fileA) <- Maryann"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$read_fileA" --principal "$maryann_prin"
+
Index: examples/creddy_prover_tests/fruits_rt2/README
===================================================================
--- examples/creddy_prover_tests/fruits_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/fruits_rt2/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,111 @@
+#!/bin/sh
+#
+# This demonstrates assigning objects to object sets (osets) based on their
+# membership in other sets.  In this case there are 3 prinicpals. Mary and Bob
+# are encoding what fruits they are willing to eat in the oset Bob.what2eat and
+# Mary.what2eat.  Ralphs is defining the prices of the fruits it sells by
+# assigning them to osets parameterized by price.
+#
+# Credential 1 lays out Mary's policy - she will eat fruits that cost less that
+# or equal to 2.00.  Bob will eat fruits that cost between 1.00 and 5.00, as
+# laid out in Credential 2.  Strictly speaking Bob and Mary's ruls apply to
+# prices assigned by Ralphs.  Credentials 3-6 are Ralph's price assignments:
+# 
+# Fruit               Price      Credential
+# apple               1.50       3
+# kiwi                1.50       4
+# black rsaberry      2.50       5
+# navel ornage        0.50       6
+#
+# The attached ./run_query file proves that Mary will eat a naval orange and a kiwi,
+# and that Bob will not eat a navel orange (too cheap).  It also proves a apple
+# is priced at 1.50 and that it cannot prove that a green apple is priced at
+# 1.50 (we don't know anything about green apples).
+
+# fruits_rt2_typed
+
+# mary.what2eat<-?-navel orange  good
+# mary.what2eat<-?-kiwi  good
+# bob.what2eat<-?-navel orange  bad
+# ralphs.fruitprice(1.50)<-?-apple   good
+# ralphs.fruitprice(1.50)<-?-green apple   bad
+
+creddy --generate --cn Mary
+creddy --generate --cn Bob
+creddy --generate --cn Ralphs
+
+mary_keyid=`creddy --keyid --cert Mary_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+ralphs_keyid=`creddy --keyid --cert Ralphs_ID.pem`
+
+fruitprice_qP="fruitprice([float:?P:[..2.00]])"
+fruitprice_qP_2="fruitprice([float:?P:[1.00..5.00]])"
+
+# [keyid:mary].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
+# Credential 1
+creddy --attribute \
+       --issuer Mary_ID.pem --key Mary_private.pem --oset "what2eat" \
+       --subject-cert Ralphs_ID.pem --subject-oset "$fruitprice_qP" \
+       --out mary_what2eat__ralphs_fruitprice_qP_attr.der
+
+# [keyid:bob].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
+# Credential 2
+creddy --attribute \
+       --issuer Bob_ID.pem --key Bob_private.pem --oset "what2eat" \
+       --subject-cert Ralphs_ID.pem --subject-oset "$fruitprice_qP_2" \
+       --out bob_what2eat__ralphs_fruitprice_qP_2_attr.der
+
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
+# Credential 3
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:1.50])" \
+        --subject-obj "[string:'apple']" \
+        --out Ralphs_fruitprice__apple_attr.der
+
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'kiwi']
+# Credential 4
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:1.50])" \
+        --subject-obj "[string:'kiwi']" \
+        --out Ralphs_fruitprice__kiwi_attr.der
+
+
+# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
+# Credential 5
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:2.50])" \
+        --subject-obj "[string:'black rasberry']" \
+        --out Ralphs_fruitprice__black_rasberry_attr.der
+
+# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
+# Credential 6
+creddy --attribute \
+        --issuer Ralphs_ID.pem --key Ralphs_private.pem \
+        --oset "fruitprice([float:0.50])" \
+        --subject-obj "[string:'navel orange']" \
+        --out Ralphs_fruitprice__navel_orange_attr.der
+
+#####################################################################
+# mary.what2eat <- ralphs.fruitsprice(?P:[..2.00])
+# [keyid:mary].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[..2.00]])
+#
+# bob.what2eat <- ralphs.fruitsprice(?P:[1.00..5.00])
+# [keyid:bob].oset:what2eat 
+#      <- [keyid:ralphs].oset:fruitprice([float:?P:[1.00..5.00]])
+# 
+# ralphs.fruitprice(1.50)<-apple
+# [keyid:ralphs].oset:fruitprice([float:1.50]) <- [string:'apple']
+#
+# ralphs.fruitprice(2.50)<-black rasberry
+# [keyid:ralphs].oset:fruitprice([float:2.50]) <- [string:'black rasberry']
+#
+# ralphs.fruitprice(0.50)<-navel orange
+# [keyid:ralphs].oset:fruitprice([float:0.50]) <- [string:'navel orange']
+# 
+
Index: examples/creddy_prover_tests/fruits_rt2/run_query
===================================================================
--- examples/creddy_prover_tests/fruits_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/fruits_rt2/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,45 @@
+
+# fruits_rt2_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+ralphs=`creddy --keyid --cert $keyloc/Ralphs_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+mary=`creddy --keyid --cert $keyloc/Mary_ID.pem`
+
+mary_what2eat="[keyid:$mary].oset:what2eat"
+bob_what2eat="[keyid:$bob].oset:what2eat"
+ralphs_apple="[keyid:$ralphs].oset:fruitprice([float:1.50])"
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+# [keyid:mary].oset:what2eat <-?- [string:'navel orange'] (yes)
+echo " "
+echo "===good============ mary.what2eat <- navel orange"
+$eloc/abac_prover_yap  --keystore $keyloc --oset "$mary_what2eat" --object "[string:'navel orange']"
+
+# [keyid:mary].oset:what2eat <-?- [string:'kiwi'] (yes)
+echo " "
+echo "===good============ mary.what2eat <- kiwi"
+$eloc/abac_prover_yap  --keystore $keyloc --oset "$mary_what2eat" --object "[string:'kiwi']"
+
+# [keyid:bob].oset:what2eat <-?- [string:'navel orange'] (no)
+echo " "
+echo "===bad============ bob.what2eat <- navel orange"
+$eloc/abac_prover_yap  --keystore $keyloc --oset "$bob_what2eat" --object "[string:'navel orange']"
+
+# [keyid:$ralphs].oset:fruitprice([float:1.50]) <-?- [string:'apple'] (yes)
+echo " "
+echo "===good============ ralphs.fruitprice(1.50) <- apple"
+$eloc/abac_prover_yap  --keystore $keyloc --oset "$ralphs_apple" --object "[string:'apple']"
+
+# [keyid:$ralphs].oset:fruitprice([float:1.50]) <-?- [string:'green apple'] (no)
+echo " "
+echo "===bad============ ralphs.fruitprice(1.50) <- green apple"
+$eloc/abac_prover_yap  --keystore $keyloc --oset "$ralphs_apple" --object "[string:'green apple']"
+
+
Index: examples/creddy_prover_tests/leader_rt1/README
===================================================================
--- examples/creddy_prover_tests/leader_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/leader_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,68 @@
+#!/bin/sh
+#
+# This example shows a way to allow an user with multiple keyid identities 
+# to be 'reasoned' as one within a single scope.  There are 4 principals 
+# Geni, Bob, Jack, and Joe. Bob and Joe are actually the same person but 
+# not Jack.
+#
+# Credentials 1 is the policy that says a principal is a group leader
+# at Geni if it is equivalent to another principal who is a group 
+# leader at Geni. 
+#
+# Credentials 2 establishes Bob as a group leader at Geni while
+# credential 3 and 4 are the equivalent rules between Bob and Joe.
+#
+# The attached ./run_query file asks if Joe is also an group leader which
+# he is because there is a equivalent rule from Bob to him. It also asks
+# if Jack is a group leader which he isn't because there is no equivalent
+# rule from Bob to him.
+
+# leader_rt1_typed
+
+# [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
+# [keyid:geni].role:leader <-?- [keyid:Jack] (no)
+# [keyid:geni].role:leader <-?- [keyid:Joe] (yes)
+
+creddy --generate --cn Geni
+creddy --generate --cn Bob
+creddy --generate --cn Jack
+creddy --generate --cn Joe
+
+geni_keyid=`creddy --keyid --cert Geni_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+jack_keyid=`creddy --keyid --cert Jack_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+leader_qP="equivalent([principal:?P[keyid:$geni_keyid].role:leader])"
+equivalent_bob="equivalent([keyid:$bob_keyid])"
+equivalent_joe="equivalent([keyid:$joe_keyid])"
+
+# [keyid:geni].role:leader 
+#         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
+# Credential 1
+/home/mei/Deter/abac/creddy/creddy --attribute \
+       --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
+       --subject-cert Geni_ID.pem --subject-role "$leader_qP" \
+       --out geni_leader__geni_leader_qP_attr.der
+
+# [keyid:geni].role:leader <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
+        --subject-cert Bob_ID.pem \
+        --out geni_leader__Bob_attr.der
+
+# [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
+# Credential 3
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_bob" \
+        --subject-cert Joe_ID.pem \
+        --out geni_equivalent_Bob__Joe_attr.der
+
+# [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
+# Credential 4
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_joe" \
+        --subject-cert Bob_ID.pem \
+        --out geni_equivalent_Joe__Bob_attr.der
+
Index: examples/creddy_prover_tests/leader_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/leader_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/leader_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,43 @@
+
+# leader_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+geni=`creddy --keyid --cert $keyloc/Geni_ID.pem`
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+jack=`creddy --keyid --cert $keyloc/Jack_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+
+geni_leader="[keyid:$geni].role:leader"
+bob_prin="[keyid:$bob]"
+jack_prin="[keyid:$jack]"
+joe_prin="[keyid:$joe]"
+
+# [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
+# [keyid:geni].role:leader <-?- [keyid:Jack] (no)
+# [keyid:geni].role:leader <-?- [keyid:Joe] (yes)
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+#double checking 
+#creddy --roles --cert geni_leader__geni_leader_qP_attr.der
+
+# [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
+echo " "
+echo "===yes============ geni.leader <- Bob"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$geni_leader" --principal "$bob_prin"
+
+# [keyid:geni].role:leader <-?- [keyid:Jack] (no)
+echo " "
+echo "===no============ geni.leader <- Jack"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$geni_leader" --principal "$jack_prin"
+
+# [keyid:geni].role:leader <-?- [keyid:Joe] (yes)
+echo " "
+echo "===yes============ geni.leader <- Joe"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$geni_leader" --principal "$joe_prin"
+
Index: examples/creddy_prover_tests/payraise_rt1/README
===================================================================
--- examples/creddy_prover_tests/payraise_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/payraise_rt1/README	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,125 @@
+#!/bin/sh
+
+#####################################################################
+# This example demostrates how to use 'this' as a data term of a RT1 
+# policy credential where it is implicitly translated to a variable.
+#
+# Credential 1 is the policy credential with 2 intersecting rules.
+# A employee is up for a pay raise if the evaluator of the employee 
+# affirms his/her good performance and the manager of the employee 
+# affirms his/her pleasantness.
+#
+# Credential 2 is the policy credential that states an evaluator of
+# an employee is also the manager of the employee.
+#
+# Credential 3, 4 and 5 state Bob is the evaluator of Maryann and she
+# is showing good performance and is a nice coworker. Credential 6 and
+# 7 state Bob is also the evaluator of Joe and he is showing good
+# performance. But, there is no fact that says Joe is a nice coworker.
+#
+# The attached ./run_query file asks if a given principal is
+# entitled to a pay raise. Maryann is but not Joe, because his manager
+# did not affirm his pleasantness(but neither did he deny it)
+
+rm -rf *der *pem
+
+# [keyid:Alpha].role:payRaise <-?- [keyid:Maryann] (yes)
+# [keyid:Alpha].role:payRaise <-?- [keyid:Joe] (no)
+
+creddy --generate --cn Alpha
+creddy --generate --cn Bob
+creddy --generate --cn Maryann
+creddy --generate --cn Joe
+
+alpha_keyid=`creddy --keyid --cert Alpha_ID.pem`
+
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+maryann_keyid=`creddy --keyid --cert Maryann_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+performance_qT="evaluatorOf([principal:?this]).goodPerformance"
+niceguy_qT="managerOf([principal:?this]).niceCoworker"
+
+manager_qZ="managerOf([principal:?Z])"
+evaluator_qZ="evaluatorOf([principal:?Z])"
+
+evaluator_m="evaluatorOf([keyid:$maryann_keyid])"
+evaluator_j="evaluatorOf([keyid:$joe_keyid])"
+
+# [keyid:alpha].role:payRaise <-
+#           [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
+#           [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
+# Credential 1
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role payRaise \
+       --subject-cert Alpha_ID.pem --subject-role "$performance_qT" \
+       --subject-cert Alpha_ID.pem --subject-role "$niceguy_qT" \
+       --out Alpha_payraise__Alpha_performance_qT_niceguy_qT_attr.der
+
+# [keyid:alpha].role:managerOf([principal:?Z])<-
+#           [keyid:alpha].role:evaluatorOf([principal:?Z])
+# Credential 2
+creddy --attribute \
+       --issuer Alpha_ID.pem --key Alpha_private.pem --role "$manager_qZ" \
+       --subject-cert Alpha_ID.pem --subject-role "$evaluator_qZ" \
+       --out Alpha_manager_qZ__Alpha_evaluator_qZ_attr.der
+
+# [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
+# Credential 3
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$evaluator_m" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_evaluator_m__Bob_attr.der
+
+# [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
+# Credential 4 
+creddy --attribute \
+        --issuer Bob_ID.pem --key Bob_private.pem --role goodPerformance \
+        --subject-cert Maryann_ID.pem \
+        --out Bob_goodperformance__Maryann_attr.der
+
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+# Credential 5 
+creddy --attribute \
+        --issuer Bob_ID.pem --key Bob_private.pem --role niceCoworker \
+        --subject-cert Maryann_ID.pem \
+        --out Bob_niceworker__Maryann_attr.der
+
+# [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+# Credential 6
+creddy --attribute \
+        --issuer Alpha_ID.pem --key Alpha_private.pem --role "$evaluator_j" \
+        --subject-cert Bob_ID.pem \
+        --out Alpha_evaluator_j__Bob_attr.der
+
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
+# Credential 7 
+creddy --attribute \
+        --issuer Bob_ID.pem --key Bob_private.pem --role goodPerformance \
+        --subject-cert Joe_ID.pem \
+        --out Bob_goodperformance__Joe_attr.der
+
+
+#####################################################################
+# 
+# alpha.payRaise <- alpha.evaluatorOf(this).goodPerformance & 
+#                   alpha.managerOf(this).niceCoworker
+# [keyid:alpha].role:payRaise <-
+#           [keyid:alpha].role:evaluatorOf([principal:?this]).role:goodPerformance &
+#           [keyid:alpha].role:managerOf([principal:?this]).role:niceCoworker
+#
+# alpha.managerOf(this) <- alpha.evaluatorOf(this)
+# [keyid:alpha].role:managerOf([principal:?this])<-
+#           [keyid:alpha].role:evaluatorOf([principal:?this])
+#
+# alpha.evaluatorOf(Maryann)<-Bob
+# [keyid:alpha].role:evaluatorOf([keyid:Maryann]) <-[keyid:Bob]
+# Bob.goodPerformance<-Maryann
+# [keyid:Bob].role:goodPerformance <- [keyid:Maryann])
+# Bob.niceCoworker<-Maryann
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+#
+# alpha.evaluatorOf(Joe)<-Bob
+# [keyid:alpha].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+# Bob.goodPerformance<-Joe
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
Index: examples/creddy_prover_tests/payraise_rt1/run_query
===================================================================
--- examples/creddy_prover_tests/payraise_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/payraise_rt1/run_query	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,37 @@
+
+# raise_rt1_typed
+
+pwd=`pwd`
+
+eloc=${ABAC_PROVER_PATH}
+keyloc=$pwd
+
+alpha=`creddy --keyid --cert $keyloc/Alpha_ID.pem`
+
+bob=`creddy --keyid --cert $keyloc/Bob_ID.pem`
+maryann=`creddy --keyid --cert $keyloc/Maryann_ID.pem`
+joe=`creddy --keyid --cert $keyloc/Joe_ID.pem`
+
+alpha_payRaise="[keyid:$alpha].role:payRaise"
+
+bob_prin="[keyid:$bob]"
+maryann_prin="[keyid:$maryann]"
+joe_prin="[keyid:$joe]"
+
+# [keyid:alpha].role:payRaise <-?- [keyid:Maryann] (yes)
+# [keyid:alpha].role:payRaise <-?- [keyid:Joe] (yes) 
+
+## dump all credentials
+$eloc/abac_prover_yap  --keystore $keyloc --dump creds_dump
+
+# [keyid:alpha].role:payRaise <-?- [keyid:Joe] (no)
+echo " "
+echo "===bad============ alpha.payRaise <- Joe"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$alpha_payRaise" --principal "$joe_prin"
+
+# [keyid:alpha].role:payRaise <-?- [keyid:Maryann] (yes)
+echo " "
+echo "===good============ alpha.payRaise <- Maryann"
+$eloc/abac_prover_yap  --keystore $keyloc --role "$alpha_payRaise" --principal "$maryann_prin"
+
+
Index: examples/creddy_prover_tests/runall
===================================================================
--- examples/creddy_prover_tests/runall	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/runall	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,34 @@
+#!/bin/sh 
+
+# format,
+#   runall clean
+#   runall setup
+#   runall run
+
+progname=$(basename $0)
+
+if [ $# -eq 0 ]; then
+    echo "Usage: $progname (clean|setup|run)" >&2;
+    exit 1
+fi
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+for i in `ls -1 `; do
+   if ( file $i | grep -Fq directory ); then
+       cd $i;
+       if [ "$1" = "clean" ]; then
+           rm -rf ../allout.sha ../allout.cn
+           printf "\n ==> CLEANING on %s\n" "$i" >& 2 ;
+           rm -rf *.der *.pem creds_dump
+       elif [ "$1" = "setup" ]; then
+           printf "\n ==> SETUP on %s\n" "$i"  >& 2;
+           ./README
+       elif [ "$1" = "run" ] ; then
+           printf "\n ==> RUN on %s\n" "$i" ;
+           ./run_query 
+       fi 
+       cd ..;
+   fi
+done
Index: examples/creddy_prover_tests/runcheck
===================================================================
--- examples/creddy_prover_tests/runcheck	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
+++ examples/creddy_prover_tests/runcheck	(revision 5110d428b9de9f6ec063a033dfe605950456dc4f)
@@ -0,0 +1,19 @@
+#!/bin/sh 
+
+rm -rf allout.cn allout.sha
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+echo 'running ABAC testing...'
+echo '  ---with sha'
+env ./runall run 1> allout.sha 2>/dev/null
+echo '  ---with cn'
+env ABAC_CN=1 ./runall run 1> allout.cn 2>/dev/null
+result=`diff allout.cn allout.save`
+
+if [ "$result" = "" ]; then
+   echo "   PASSED"
+else
+   echo "   ERROR:got changes!!!"
+fi
