Index: examples/python_tests/experiment_create_rt0/README
===================================================================
--- examples/python_tests/experiment_create_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,43 @@
+#
+#Acme runs a testbed. They've delegated the authority to create
+#experiments to all their partners. The Globotron company is one such
+#partner.
+#
+#    Acme.experiment_create <- Acme.partner.experiment_create
+#
+#Globotron has delegated the authority to anyone an admin thinks is a
+#'power user'.
+#
+#    Globotron.experiment_create <- Globotron.admin.power_user
+#
+#Alice is an admin, and her friend Bob is a power user:
+#
+#    Globotron.admin <- Alice
+#    Alice.power_user <- Bob
+#
+#From these credentials, it is possible to show that 
+#    Acme.experiment_create <- Bob.
+#
+#In query.py, it checks if Alice is a admin of Globotron which is true;
+#and if Bob is an admin of Globotron which is not true; and also show
+# that Bob can create experiment at Acme
+#
+# experiment_create_rt0 
+
+# Credential 1
+#[keyid:Acme].role:experiment_create 
+#                 <- [keyid:Acme].role:partner.role:experiment_create
+
+# Credential 2
+#[keyid:Acme].role:partner <- [keyid:Globotron]
+
+# Credential 3
+#[keyid:Globotron].role:expriment_create 
+                 <- [keyid:Globotron].role:admin.role:power_user
+
+# Credential 4
+#[keyid:Globotron].role:admin <- [keyid:Alice]
+
+# Credential 5
+#[keyid:Alice].role:power_user <- [keyid:Bob]
+
Index: examples/python_tests/experiment_create_rt0/attr.py
===================================================================
--- examples/python_tests/experiment_create_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,91 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd: ./attr.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.load_privkey("Bob_private.pem");
+ctxt.load_id_chunk(bobID.cert_chunk())
+bob=bobID.keyid()
+
+aliceID=ABAC.ID("Alice_ID.pem");
+aliceID.load_privkey("Alice_private.pem");
+ctxt.load_id_chunk(aliceID.cert_chunk())
+alice=aliceID.keyid()
+
+globotronID=ABAC.ID("Globotron_ID.pem");
+globotronID.load_privkey("Globotron_private.pem");
+ctxt.load_id_chunk(globotronID.cert_chunk())
+globotron=globotronID.keyid()
+
+################################################
+# Credential 1, Anyone who is allowed to create experiment by Acme's
+#               partners can create experiment at Acme
+# [keyid:Acme].role:experiment_create 
+#           <- [keyid:Acme].role:partner.role:experiment_create
+
+# compose the policy attribute
+attr = ABAC.Attribute(acmeID, "experiment_create", 0)
+# creating a linking role
+tail = attr.linking_role(acme,"partner","experiment_create")
+# finalize the policy
+attr.bake()
+
+# write out the policy to an external file
+attr.write_file("Acme_experiment_create__Acme_partner_experiment_create_attr.xml")
+# load the policy into the context by accessing that external file
+ctxt.load_attribute_file("Acme_experiment_create__Acme_partner_experiment_create_attr.xml")
+
+#################################################
+# Credential 2
+# [keyid:Acme].role:partner <- [keyid:Globotron]
+#
+attr = ABAC.Attribute(acmeID, "partner", 0)
+attr.principal(globotron)
+attr.bake()
+attr.write_file("Acme_partner__Globotron_attr.xml")
+ctxt.load_attribute_file("Acme_partner__Globotron_attr.xml")
+
+#################################################
+# Credential 3
+# [keyid:Globotron].role:expriment_create 
+#           <- [keyid:Globotron].role:admin.role:power_user
+attr = ABAC.Attribute(globotronID, "experiment_create", 0)
+attr.linking_role(globotron,"admin","power_user")
+attr.bake()
+attr.write_file("Globotron_experiment_create__Globotron_admin_power_user_attr.xml")
+ctxt.load_attribute_file("Globotron_experiment_create__Globotron_admin_power_user_attr.xml")
+
+#################################################
+# Credential 4,
+# [keyid:Globotron].role:admin <- [keyid:Alice]
+attr = ABAC.Attribute(globotronID, "admin", 0)
+attr.principal(alice)
+attr.bake()
+attr.write_file("Globotron_admin__Alice_attr.xml")
+ctxt.load_attribute_file("Globotron_admin__Alice_attr.xml")
+
+#################################################
+# Credential 5, 
+# [keyid:Alice].role:power_user <- [keyid:Bob]
+attr = ABAC.Attribute(aliceID, "power_user", 0)
+attr.principal(bob)
+attr.bake()
+attr.write_file("Alice_power_user__Bob_attr.xml")
+ctxt.load_attribute_file("Alice_power_user__Bob_attr.xml")
+
Index: examples/python_tests/experiment_create_rt0/query.py
===================================================================
--- examples/python_tests/experiment_create_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,92 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd: env keystore=`pwd` ./query.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.load_privkey("Bob_private.pem");
+ctxt.load_id_chunk(bobID.cert_chunk())
+bob=bobID.keyid()
+
+aliceID=ABAC.ID("Alice_ID.pem");
+aliceID.load_privkey("Alice_private.pem");
+ctxt.load_id_chunk(aliceID.cert_chunk())
+alice=aliceID.keyid()
+
+globotronID=ABAC.ID("Globotron_ID.pem");
+globotronID.load_privkey("Globotron_private.pem");
+ctxt.load_id_chunk(globotronID.cert_chunk())
+globotron=globotronID.keyid()
+
+##########################################################################
+# dump the loaded attribute policies
+#
+print "\n...policy attribute set..."
+credentials = ctxt.credentials()
+for credential in credentials:
+    print "context: %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# is alice a admin at Globotron ?
+# role=[keyid:Globotron].role:admin 
+# p=[keyid:Alice]
+
+print "\n===good=============== Globotron.admin <- Alice"
+(success, credentials) = ctxt.query("%s.admin" % globotron, alice)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# is bob a admin at Globotron ?
+# role=[keyid:Globotron].role:admin 
+# p=[keyid:Bob]
+
+print "\n===bad=============== Globotron.admin <- Bob"
+(success, credentials) = ctxt.query("%s.admin" % globotron, bob)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can bob create experiment at Acme ?
+# role=[keyid:Acme].role:experiment_create 
+# p=[keyid:Bob]
+
+print "\n===good=============== Acme.experiment_create <- Bob"
+(success, credentials) = ctxt.query("%s.experiment_create" % acme, bob)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
Index: examples/python_tests/experiment_create_rt0/run_test
===================================================================
--- examples/python_tests/experiment_create_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,21 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+./attr.py 1>experiment.log 2>& 1
+
+echo '---run queries'
+env keystore=`pwd` ./query.py 1>experiment.out 2>& 1
+
+good=`grep success experiment.out |wc -l`
+bad=`grep failure experiment.out |wc -l`
+if [ "$good" = "2" -a "$bad" = "1" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:experiment_create_rt0 test result differs!!!"
+fi
+
Index: examples/python_tests/experiment_create_rt0/setup.py
===================================================================
--- examples/python_tests/experiment_create_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates principals
+used by the example.
+"""
+import os
+import ABAC
+
+acme=ABAC.ID("Acme", 0)
+acme.write_cert_file("Acme_ID.pem")
+acme.write_privkey_file("Acme_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.write_cert_file("Bob_ID.pem")
+bobID.write_privkey_file("Bob_private.pem")
+
+aliceID=ABAC.ID("Alice", 0)
+aliceID.write_cert_file("Alice_ID.pem")
+aliceID.write_privkey_file("Alice_private.pem")
+
+globotronID=ABAC.ID("Globotron", 0)
+globotronID.write_cert_file("Globotron_ID.pem")
+globotronID.write_privkey_file("Globotron_private.pem")
+
+
