Index: examples/python_tests/leader_rt1/README
===================================================================
--- examples/python_tests/leader_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/README	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,68 @@
+#!/bin/sh
+#
+# This example shows a way to allow an user with multiple keyid identities 
+# to be 'reasoned' as one within a single scope.  There are 4 principals 
+# Geni, Bob, Jack, and Joe. Bob and Joe are actually the same person but 
+# not Jack.
+#
+# Credentials 1 is the policy that says a principal is a group leader
+# at Geni if it is equivalent to another principal who is a group 
+# leader at Geni. 
+#
+# Credentials 2 establishes Bob as a group leader at Geni while
+# credential 3 and 4 are the equivalent rules between Bob and Joe.
+#
+# The attached ./run_query file asks if Joe is also an group leader which
+# he is because there is a equivalent rule from Bob to him. It also asks
+# if Jack is a group leader which he isn't because there is no equivalent
+# rule from Bob to him.
+
+# leader_rt1_typed
+
+# [keyid:geni].role:leader <-?- [keyid:Bob] (yes)
+# [keyid:geni].role:leader <-?- [keyid:Jack] (no)
+# [keyid:geni].role:leader <-?- [keyid:Joe] (yes)
+
+creddy --generate --cn Geni
+creddy --generate --cn Bob
+creddy --generate --cn Jack
+creddy --generate --cn Joe
+
+geni_keyid=`creddy --keyid --cert Geni_ID.pem`
+bob_keyid=`creddy --keyid --cert Bob_ID.pem`
+jack_keyid=`creddy --keyid --cert Jack_ID.pem`
+joe_keyid=`creddy --keyid --cert Joe_ID.pem`
+
+leader_qP="equivalent([principal:?P[keyid:$geni_keyid].role:leader])"
+equivalent_bob="equivalent([keyid:$bob_keyid])"
+equivalent_joe="equivalent([keyid:$joe_keyid])"
+
+# [keyid:geni].role:leader 
+#         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
+# Credential 1
+/home/mei/Deter/abac/creddy/creddy --attribute \
+       --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
+       --subject-cert Geni_ID.pem --subject-role "$leader_qP" \
+       --out geni_leader__geni_leader_qP_attr.der
+
+# [keyid:geni].role:leader <- [keyid:bob]
+# Credential 2
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "leader" \
+        --subject-cert Bob_ID.pem \
+        --out geni_leader__Bob_attr.der
+
+# [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
+# Credential 3
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_bob" \
+        --subject-cert Joe_ID.pem \
+        --out geni_equivalent_Bob__Joe_attr.der
+
+# [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
+# Credential 4
+creddy --attribute \
+        --issuer Geni_ID.pem --key Geni_private.pem --role "$equivalent_joe" \
+        --subject-cert Bob_ID.pem \
+        --out geni_equivalent_Joe__Bob_attr.der
+
Index: examples/python_tests/leader_rt1/attr.py
===================================================================
--- examples/python_tests/leader_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/attr.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,151 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./attr.py 
+"""
+
+import os
+import ABAC
+
+keystore=os.environ["keystore"]
+
+ctxt = ABAC.Context()
+print "ABAC version %s" % ctxt.version()
+
+ctxt.load_directory(keystore)
+
+out = ctxt.context_principals()
+print "...initial principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n" 
+
+out = ctxt.context_credentials()
+print "...initial policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+geniID=ABAC.ID("Geni_ID.pem");
+geniID.id_load_privkey_file("Geni_private.pem");
+geni=geniID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+jackID=ABAC.ID("Jack_ID.pem");
+jackID.id_load_privkey_file("Jack_private.pem");
+jack=jackID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.id_load_privkey_file("Joe_private.pem");
+joe=joeID.id_keyid()
+
+################################################
+# [keyid:geni].role:leader
+#         <- [keyid:geni].role:equivalent([principal:?P[keyid:geni].role:leader])
+head=ABAC.Role(geni,"leader")
+condoset=ABAC.Role(geni,"leader")
+cond=ABAC.Constraint(condoset)
+param=ABAC.DataTerm("principal","P", cond)
+tail = ABAC.Role(geni,"equivalent")
+tail.role_add_data_term(param)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_leader__geni_leader_qP_attr.der")
+ctxt.load_attribute_file("geni_leader__geni_leader_qP_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:leader <- [keyid:bob]
+head=ABAC.Role(geni,"leader")
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_leader__Bob_attr.der")
+ctxt.load_attribute_file("geni_leader__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:equivalent([keyid:bob]) <- [keyid:Joe]
+param=ABAC.DataTerm(bobID)
+head = ABAC.Role(geni,"equivalent")
+head.role_add_data_term(param)
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_equivalent_Bob__Joe_attr.der")
+ctxt.load_attribute_file("geni_equivalent_Bob__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:equivalent([keyid:Joe]) <- [keyid:Bob]
+param=ABAC.DataTerm(joeID)
+head = ABAC.Role(geni,"equivalent")
+head.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("geni_equivalent_Joe__Bob_attr.der")
+ctxt.load_attribute_file("geni_equivalent_Joe__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:niceCoworker <- [keyid:Maryann])
+head = ABAC.Role(bob,"niceCoworker")
+tail = ABAC.Role(jack)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_nicecoworker__Maryann_attr.der")
+ctxt.load_attribute_file("Bob_nicecoworker__Maryann_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:geni].role:evaluatorOf([keyid:Joe]) <-[keyid:Bob]
+param=ABAC.DataTerm(joeID)
+head = ABAC.Role(geni,"evaluatorOf")
+head.role_add_data_term(param)
+tail = ABAC.Role(bob)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Alpha_evaluator_j__Bob_attr.der")
+ctxt.load_attribute_file("Alpha_evaluator_j__Bob_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+#################################################
+# [keyid:Bob].role:goodPerformance <- [keyid:Joe])
+head = ABAC.Role(bob,"goodPerformance")
+tail = ABAC.Role(joe)
+attr=ABAC.Attribute(head, 1800)
+attr.attribute_add_tail(tail)
+attr.attribute_bake()
+attr.attribute_write_cert("Bob_goodperformance__Joe_attr.der")
+ctxt.load_attribute_file("Bob_goodperformance__Joe_attr.der")
+print attr.string() 
+print attr.typed_string()
+print "\n"
+
+
+ctxt.dump_yap_db()
+##
Index: examples/python_tests/leader_rt1/leader.save
===================================================================
--- examples/python_tests/leader_rt1/leader.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/leader.save	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,33 @@
+% Restoring file /usr/local/lib/Yap/startup.yss
+
+===good============ geni.leader <- Bob
+YAP query succeed
+pGeni.leader <- pBob
+
+===bad============ geni.leader <- Jack
+YAP query failed
+
+===good============ geni.leader <- Joe
+YAP query succeed
+pGeni.leader <- pGeni.equivalent(P:pGeni.leader)
+pGeni.leader <- pBob
+pGeni.equivalent(pBob) <- pJoe
+
+...final principal set...
+(pBob,keyid,y) 
+(pGeni,keyid,y) 
+(pJack,keyid,y) 
+(pJoe,keyid,y) 
+
+
+
+...final policy attribute set...
+pGeni.evaluatorOf(pJoe) <- pBob
+pBob.goodPerformance <- pJoe
+pBob.niceCoworker <- pJack
+pGeni.equivalent(pBob) <- pJoe
+pGeni.equivalent(pJoe) <- pBob
+pGeni.leader <- pBob
+pGeni.leader <- pGeni.equivalent(P:pGeni.leader)
+
+
Index: examples/python_tests/leader_rt1/query.py
===================================================================
--- examples/python_tests/leader_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/query.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,83 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./query.py 
+cmd2: env ABAC_CN=1 keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# print "ABAC version %s" % ctxt.version()
+
+keystore=os.environ["keystore"]
+
+ctxt.load_directory(keystore)
+
+geniID=ABAC.ID("Geni_ID.pem");
+geniID.id_load_privkey_file("Geni_private.pem");
+geni=geniID.id_keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.id_load_privkey_file("Bob_private.pem");
+bob=bobID.id_keyid()
+
+jackID=ABAC.ID("Jack_ID.pem");
+jackID.id_load_privkey_file("Jack_private.pem");
+jack=jackID.id_keyid()
+
+joeID=ABAC.ID("Joe_ID.pem");
+joeID.id_load_privkey_file("Joe_private.pem");
+joe=joeID.id_keyid()
+
+##########################################################################
+# role=[keyid:geni].role:leader 
+# p=[keyid:Bob]
+role = ABAC.Role(geni,"leader")
+p = ABAC.Role(bob)
+print "\n===good============ geni.leader <- Bob"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:geni].role:leader 
+# p=[keyid:Jack]
+role = ABAC.Role(geni,"leader")
+p = ABAC.Role(jack)
+print "\n===bad============ geni.leader <- Jack"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+##########################################################################
+# role=[keyid:geni].role:leader 
+# p=[keyid:Joe]
+role = ABAC.Role(geni,"leader")
+p = ABAC.Role(joe)
+print "\n===good============ geni.leader <- Joe"
+out = ctxt.query(role, p)
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+
+
+##########################################################################
+# dump the loaded principals/policies
+#
+out = ctxt.context_principals()
+print "\n...final principal set..."
+for x in out[1]:
+    print "%s " % x.string()
+print "\n"
+out = ctxt.context_credentials()
+print "\n...final policy attribute set..."
+for c in out[1]:
+    print "%s <- %s" % (c.head_string(), c.tail_string())
+print "\n"
+
+
Index: examples/python_tests/leader_rt1/run_test
===================================================================
--- examples/python_tests/leader_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/run_test	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,38 @@
+#!/bin/sh 
+
+ABAC_PROVER_PATH="/home/mei/Deter/abac/libabac"
+export ABAC_PROVER_PATH
+
+
+rm -rf *der *pem
+
+echo '---setup principals'
+env keystore=`pwd` ./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+env keystore=`pwd` ./attr.py 1>/dev/null 2>& 1
+
+echo '---run queries'
+
+# Make prover queries
+g_cmd_sha=`grep "cmd1:" query.py |sed "s/cmd1://g" `
+g_cmd_cn=`grep "cmd2:" query.py |sed "s/cmd2://g" `
+
+echo '...with sha'
+eval $g_cmd_sha 2>/dev/null 1 > leader.sha
+
+echo '...with cn'
+eval $g_cmd_cn 1>leader.cn 2>&1
+
+result=`diff leader.cn leader.save 2>/dev/null`
+if [ $? -eq 0 ]; then
+    if [ "$result" = "" ]; then
+       echo "   PASSED"
+    else
+       echo "   ERROR:leader_rt1 test result differs!!!"
+    fi
+else
+    echo "   ERROR:leader_rt1 test result differs!!!"
+fi
+
+
Index: examples/python_tests/leader_rt1/setup.py
===================================================================
--- examples/python_tests/leader_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
+++ examples/python_tests/leader_rt1/setup.py	(revision 7211a95f1601147c8c72a41f8043ef08062de055)
@@ -0,0 +1,28 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+geniID=ABAC.ID("Geni", 0)
+geniID.id_write_cert("Geni_ID.pem")
+geniID.id_write_privkey("Geni_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.id_write_cert("Bob_ID.pem")
+bobID.id_write_privkey("Bob_private.pem")
+
+jackID=ABAC.ID("Jack", 0)
+jackID.id_write_cert("Jack_ID.pem")
+jackID.id_write_privkey("Jack_private.pem")
+
+joeID=ABAC.ID("Joe", 0)
+joeID.id_write_cert("Joe_ID.pem")
+joeID.id_write_privkey("Joe_private.pem")
+
