Index: examples/python_tests/Makefile
===================================================================
--- examples/python_tests/Makefile	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/Makefile	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,30 @@
+
+DIRECTORY= acme_rockets_intersection_rt0 basic_attribute experiment_create_rt0 acme_rockets_rt0 basic_id         
+
+.PHONY : setup runcheck clean 
+runcheck: $(DIRECTORY)
+
+clean:
+	@for i in $(DIRECTORY); do \
+	here=`pwd`; \
+	cd $$i; \
+	rm -rf *.xml *.pem *.out *.log; \
+	cd $$here; \
+	done 
+	@rm -rf result
+
+runcheck: 
+	@echo 'running libabac PYTHON testing...' 
+	@rm -rf result
+	@for i in $(DIRECTORY); do \
+	here=`pwd`; \
+	cd $$i; \
+	printf "\n ==> RUN on %s\n" "$$i" >> ../result; \
+	./run_test >> ../result 2>/dev/null; \
+	cd $$here; \
+	done
+	@if test -f result && test `cat result|wc -c` -eq 444 ; \
+	then echo "   PASSED"; \
+	else echo "   ERROR:got changes!!!"; \
+	fi
+
Index: examples/python_tests/acme_rockets_intersection_rt0/README
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,39 @@
+#
+# This example demonstrates intersections.  An intersection is a logical-AND of
+# roles or osets.  An intersection succeeds if the principal is in the
+# intersection of the sets defined by the roles.
+#
+# The policy set by Acme is that a character must both a preferred customer and
+# a WarnerBrothers character to buy rockets.  Each of those attributes is
+# specified by a role.
+#
+# This example defines 4 principals, Acme, WarnerBrothers, Coyote and Batman.
+# Credential 1 defines the policy requiring both roles to get the buy_rockets
+# role.  Credential 2 gives the Coyote a preferred_customer role.  Credential 3
+# gives Batman the preferred_customer role and Credential 4 recognizes the
+# Coyote as a Warner Brothers character.
+#
+#In order to buy rockets from Acme, you must be BOTH a preferred customer
+#AND a WarnerBros character. In this example, the following query will be
+#successful:
+#
+#    Acme.buy_rockets <-?- Coyote
+#
+#The following query will fail (because Batman does not have the
+#attribute WarnerBros.character):
+#
+#    Acme.buy_rockets <-?- Batman
+# 
+# acme_rockets_intersection_rt0
+
+# Credential 1
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+                                    & [keyid:WarnerBros].role:charater
+# Credential 2
+# [keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+
+# Credential 3
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+
+# Credential 4
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
Index: examples/python_tests/acme_rockets_intersection_rt0/attr.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,88 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd1: ./attr.py 
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.load_privkey("Coyote_private.pem");
+ctxt.load_id_chunk(coyoteID.cert_chunk())
+coyote=coyoteID.keyid()
+
+warnerbrosID=ABAC.ID("WarnerBros_ID.pem");
+warnerbrosID.load_privkey("WarnerBros_private.pem");
+ctxt.load_id_chunk(warnerbrosID.cert_chunk())
+warnerbros=warnerbrosID.keyid()
+
+batmanID=ABAC.ID("Batman_ID.pem");
+batmanID.load_privkey("Batman_private.pem");
+ctxt.load_id_chunk(batmanID.cert_chunk())
+batman=batmanID.keyid()
+
+
+################################################
+# Credential 1, establish the intersection rule on who can buy
+# rockets from Acme
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+#                                    & [keyid:WarnerBros].role:charater
+attr = ABAC.Attribute(acmeID, "buy_rockets", 0)
+
+# to add intersection, just add multiple roles
+attr.role(acme,"preferred_customer")
+attr.role(warnerbros,"character")
+
+# finalize the rule
+attr.bake()
+
+# create a policy file at the file system
+attr.write_file("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.xml")
+
+# load the policy into current context by with the newly created policy file
+ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_and_WarnerBros_character_attr.xml")
+
+#################################################
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+attr = ABAC.Attribute(acmeID, "preferred_customer", 0)
+attr.principal(coyote)
+attr.bake()
+
+attr.write_file("Acme_preferred_customer__Coyote_attr.xml")
+ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.xml")
+
+#################################################
+# Credential 3
+#[keyid:Acme].role:preferred_customer <- [keyid:Batman]
+attr = ABAC.Attribute(acmeID, "preferred_customer", 0)
+attr.principal(batman)
+attr.bake()
+
+attr.write_file("Acme_preferred_customer__Batman_attr.xml")
+ctxt.load_attribute_file("Acme_preferred_customer__Batman_attr.xml")
+
+################################################
+# Credential 4
+#[keyid:WarnerBros].role:character <- [keyid:Coyote]
+attr = ABAC.Attribute(warnerbrosID, "character", 0)
+attr.principal(coyote)
+attr.bake()
+
+attr.write_file("WarnerBros_character__Coyote_attr.xml")
+ctxt.load_attribute_file("WarnerBros_character__Coyote_attr.xml")
+
+# demonstrate how attribute can be load from structure insted of a file
+ctxt.load_attribute_chunk(attr.cert_chunk())
+
Index: examples/python_tests/acme_rockets_intersection_rt0/query.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,74 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd:env keystore=`pwd` ./query.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+acme=acmeID.keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.load_privkey("Coyote_private.pem");
+coyote=coyoteID.keyid()
+
+warnerbrosID=ABAC.ID("WarnerBros_ID.pem");
+warnerbrosID.load_privkey("WarnerBros_private.pem");
+warnerbros=warnerbrosID.keyid()
+
+batmanID=ABAC.ID("Batman_ID.pem");
+batmanID.load_privkey("Batman_private.pem");
+batman=batmanID.keyid()
+
+##########################################################################
+# dump the loaded principals/policies
+#
+print "\n...policy attribute set..."
+credentials = ctxt.credentials()
+for credential in credentials:
+    print "context: %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can coyote buy rockets from Acme ?
+# role = "[keyid:Acme].role:buy_rockets"
+# p = "[keyid:coyote]" 
+
+print "\n===good============ Acme.buy_rockets <- Coyote"
+(success, credentials) = ctxt.query("%s.buy_rockets" % acme, coyote)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can batman buy rockets from Acme ?
+# role = "[keyid:Acme].role:buy_rockets"
+# p = "[keyid:batman]" 
+
+print "\n===bad============ Acme.buy_rockets <- Batman"
+(success, credentials) = ctxt.query("%s.buy_rockets" % acme, batman)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
Index: examples/python_tests/acme_rockets_intersection_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,20 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+./attr.py 1>intersect.log 2>& 1
+
+echo '---run queries'
+env keystore=`pwd` ./query.py 1>intersect.out 2>& 1
+
+good=`grep success intersect.out |wc -l`
+bad=`grep failure intersect.out |wc -l`
+if [ "$good" = "1" -a "$bad" = "1" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:acme_rockets_intersection_rt0 test result differs!!!"
+fi
Index: examples/python_tests/acme_rockets_intersection_rt0/setup.py
===================================================================
--- examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_intersection_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,28 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates four principals used
+by the example.
+
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+acme=ABAC.ID("Acme", 0)
+acme.write_cert_file("Acme_ID.pem")
+acme.write_privkey_file("Acme_private.pem")
+
+coyote=ABAC.ID("Coyote", 0)
+coyote.write_cert_file("Coyote_ID.pem")
+coyote.write_privkey_file("Coyote_private.pem")
+
+warnerbros=ABAC.ID("WarnerBros", 0)
+warnerbros.write_cert_file("WarnerBros_ID.pem")
+warnerbros.write_privkey_file("WarnerBros_private.pem")
+
+batman=ABAC.ID("Batman", 0)
+batman.write_cert_file("Batman_ID.pem")
+batman.write_privkey_file("Batman_private.pem")
+
Index: examples/python_tests/acme_rockets_rt0/README
===================================================================
--- examples/python_tests/acme_rockets_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,23 @@
+#
+# The example makes use of 2 principals, Acme and Coyote.
+#
+# This example shows a very simple delegation of roles by Acme.  Acme's
+# buy_rockets role includes all of Acme's preferred customers.  The setup.py
+# creates the principals and the attr.py creates 2 policy credentials.  
+# Credential 1 encodes the policy that all of Acme's preferred customers 
+# can buy rockets from Acme and
+# Credential 2 defines the Coyote as an Acme preferred customer.
+
+# The ./run_query script issues queries to show that the Coyote is both a preferred
+# customer and can buy rockets.  Two invalid queries are also made, checking if
+# Acme is the Coyote's friend, which it isn't and whether a query about
+# something other than a principal works (it doesn't).
+
+# acme_rockets_rt0
+
+# Credential 1
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer 
+
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+
Index: examples/python_tests/acme_rockets_rt0/attr.py
===================================================================
--- examples/python_tests/acme_rockets_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,70 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd: ./attr.py 
+"""
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.load_privkey("Coyote_private.pem");
+ctxt.load_id_chunk(coyoteID.cert_chunk())
+coyote=coyoteID.keyid()
+
+bigbirdID=ABAC.ID("Bigbird_ID.pem");
+bigbirdID.load_privkey("Bigbird_private.pem");
+ctxt.load_id_chunk(bigbirdID.cert_chunk())
+bigbird=bigbirdID.keyid()
+
+################################################
+# Credential 1, only preferred_customer of Acme can buy_rockets
+#[keyid:Acme].role:buy_rockets <- [keyid:Acme].role:preferred_customer
+
+# compose the attribute of a basic rt0 role rule
+attr = ABAC.Attribute(acmeID, "buy_rockets", 0)
+attr.role(acme,"preferred_customer")
+
+# finalize the policy
+attr.bake()
+
+# create a policy file at the file system
+attr.write_file("Acme_buy_rockets__Acme_preferred_customer_attr.xml")
+
+# load the policy into current context by with the newly created policy file
+ctxt.load_attribute_file("Acme_buy_rockets__Acme_preferred_customer_attr.xml")
+
+#################################################
+# Credential 2
+#[keyid:Acme].role:preferred_customer <- [keyid:Coyote]
+attr = ABAC.Attribute(acmeID, "preferred_customer", 0)
+attr.principal(coyote)
+attr.bake()
+
+attr.write_file("Acme_preferred_customer__Coyote_attr.xml")
+ctxt.load_attribute_file("Acme_preferred_customer__Coyote_attr.xml")
+
+#################################################
+# Credential 3
+#[keyid:Coyote].role:friend <- [keyid:Bigbird]
+attr = ABAC.Attribute(coyoteID, "friend", 0)
+attr.principal(bigbird)
+attr.bake()
+
+attr.write_file("Coyote_friend__Bigbird_attr.xml")
+ctxt.load_attribute_chunk(attr.cert_chunk())
+
+#################################################
+credentials = ctxt.credentials()
+for credential in credentials:
+    print "context: %s <- %s" % (credential.head().string(), credential.tail().string())
Index: examples/python_tests/acme_rockets_rt0/query.py
===================================================================
--- examples/python_tests/acme_rockets_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,99 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd: env keystore=`pwd` ./query.py
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+acme=acmeID.keyid()
+
+coyoteID=ABAC.ID("Coyote_ID.pem");
+coyoteID.load_privkey("Coyote_private.pem");
+coyote=coyoteID.keyid()
+
+bigbirdID=ABAC.ID("Bigbird_ID.pem");
+bigbirdID.load_privkey("Bigbird_private.pem");
+bigbird=bigbirdID.keyid()
+
+##########################################################################
+# dump the loaded attribute policies
+#
+print "\n...policy attribute set..."
+credentials = ctxt.credentials()
+for credential in credentials:
+    print "context: %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# is coyote a preferred_customer of Acme ?
+# role=[keyid:Acme].role:preferred_customer
+# p =[keyid:coyote]
+
+print "\n===good============ Acme.preferred_customer <- Coyote"
+(success, credentials) = ctxt.query("%s.preferred_customer" % acme, coyote)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can coyote buy rockets from Acme ?
+# role=[keyid:Acme].role:buy_rockets
+# p =[keyid:coyote]
+
+print "\n===good============ Acme.buy_rockets <- Coyote"
+(success, credentials) = ctxt.query("%s.buy_rockets" % acme, coyote)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# is Acme a friend of coyote ?
+# role=[keyid:Coyote].role:friend
+# p=[keyid:Acme] 
+
+print "\n===bad=============== Coyote.friend <- Acme"
+(success, credentials) = ctxt.query("%s.friend" % coyote, acme)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# using complex role to ask a question.. expecting to fail 
+# role=[keyid:Acme].role:buy_rockets 
+# p=[keyid:Acme].role:preferred_customer
+
+print "\n===bad?=============== Acme.buy_rockets <- Acme.preferred_customer"
+(success, credentials) = ctxt.query("%s.buy_rockets" % acme, "%s.preferred_customer" % acme)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
Index: examples/python_tests/acme_rockets_rt0/run_test
===================================================================
--- examples/python_tests/acme_rockets_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,22 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+./attr.py 1>rocket.log 2>& 1
+
+echo '---run queries'
+env keystore=`pwd` ./query.py 1>rocket.out 2>& 1
+
+good=`grep success rocket.out |wc -l`
+bad=`grep failure rocket.out |wc -l`
+if [ "$good" = "3" -a "$bad" = "1" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:acme_rockets_rt0 test result differs!!!"
+fi
+
+
Index: examples/python_tests/acme_rockets_rt0/setup.py
===================================================================
--- examples/python_tests/acme_rockets_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/acme_rockets_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics. 
+sets up 2 (Acme, Coyote) principal ID credentials
+"""
+import os
+import ABAC
+
+acme=ABAC.ID("Acme", 0)
+acme.write_cert_file("Acme_ID.pem")
+acme.write_privkey_file("Acme_private.pem")
+
+coyote=ABAC.ID("Coyote", 0)
+coyote.write_cert_file("Coyote_ID.pem")
+coyote.write_privkey_file("Coyote_private.pem")
+
+bigbird=ABAC.ID("Bigbird", 0)
+bigbird.write_cert_file("Bigbird_ID.pem")
+bigbird.write_privkey_file("Bigbird_private.pem")
+
Index: examples/python_tests/basic_attribute/README
===================================================================
--- examples/python_tests/basic_attribute/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_attribute/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,22 @@
+#####################################################################
+# This example demonstrates various ways to create and access
+# ID attribute using libabac api
+#  
+
+case 1: make attribute rule
+        writing attribute cert file
+        load attribute cert
+
+case 2: make attribute rule
+        load attribute
+
+case 3: make attribute rule  -- not in RT0
+        retrieve attribute cert chunk
+        make new attribute with cert chunk
+        load new attribute
+
+case 4: make attribute rule
+        retrieve attribute cert chunk
+        load attribute cert chunk directly into context
+
+
Index: examples/python_tests/basic_attribute/attr.py
===================================================================
--- examples/python_tests/basic_attribute/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_attribute/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd1:env keystore=`pwd` ./attr.py 
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+def print_a(ctxt, msg, dotdot):
+    print "%s rule set..." % msg
+    credentials = ctxt.credentials()
+    for credential in credentials:
+        print "%s:%s<-%s" % (dotdot,credential.head().string(), credential.tail().string())
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+else:
+    print("keystore is not set...")
+    exit(1) 
+
+superKID=ABAC.ID("SuperK_ID.pem");
+superKID.load_privkey("SuperK_private.pem");
+ctxt.load_id_chunk(superKID.cert_chunk())
+superK=superKID.keyid()
+
+jackID=ABAC.ID("Jack_ID.pem");
+jackID.load_privkey("Jack_private.pem");
+ctxt.load_id_chunk(jackID.cert_chunk())
+jack=jackID.keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.load_privkey("Bob_private.pem");
+ctxt.load_id_chunk(bobID.cert_chunk())
+bob=bobID.keyid()
+
+maryID=ABAC.ID("Mary_ID.pem");
+maryID.load_privkey("Mary_private.pem");
+ctxt.load_id_chunk(maryID.cert_chunk())
+mary=maryID.keyid()
+
+#case 1:
+#Only employee of SuperK can park
+#[keyid:SuperK].role:park <- [keyid:SuperK].role:employee
+attr = ABAC.Attribute(superKID, "park", 0)
+attr.role(superK,"employee")
+attr.bake()
+attr.write_file("SuperK_park__SuperK_employee_attr.xml")
+ctxt.load_attribute_file("SuperK_park__SuperK_employee_attr.xml")
+print_a(ctxt,"case1","..")
+
+#case 2:
+#Jack is an employee of SuperK
+#[keyid:SuperK].role:employee <- [keyid:Jack]
+attr = ABAC.Attribute(superKID, "employee", 0)
+attr.principal(jack)
+attr.bake()
+# create a policy file at the file system
+attr.write_file("SuperK_employee__Jack_attr.xml")
+ctxt.load_attribute_chunk(attr.cert_chunk());
+print_a(ctxt,"case2","....")
+
+#case 3:
+#Bob is an employee of SuperK
+#[keyid:SuperK].role:employee <- [keyid:Jack]
+attr = ABAC.Attribute(superKID, "employee", 0)
+attr.principal(bob)
+attr.bake()
+#chunk=attr.cert_chunk()
+#nattr=ABAC.Attribute_chunk(chunk)
+#ctxt.load_attribute(nattr);
+#print_a(ctxt,"case3", "....")
+
+#case 4:
+#Mary is an employee of SuperK
+#[keyid:SuperK].role:employee <- [keyid:Mary]
+attr = ABAC.Attribute(superKID, "employee", 0)
+attr.principal(mary)
+attr.bake()
+chunk=attr.cert_chunk()
+ctxt.load_attribute_chunk(chunk);
+print_a(ctxt,"case4","......")
Index: examples/python_tests/basic_attribute/run_test
===================================================================
--- examples/python_tests/basic_attribute/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_attribute/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,17 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>attr.log 2>&1
+
+echo '---run command '
+env keystore=`pwd` ./attr.py > attr.out 2>&1
+
+result=`cat attr.out |wc -l`
+if [ "$result" = "9" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:basic_attribute test result differs!!!"
+fi
+
Index: examples/python_tests/basic_attribute/setup.py
===================================================================
--- examples/python_tests/basic_attribute/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_attribute/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates principals
+using ID and write out the credential file pair, cert/privkey
+"""
+import os
+import ABAC
+
+jackID=ABAC.ID("SuperK", 0)
+jackID.write_cert_file("SuperK_ID.pem")
+jackID.write_privkey_file("SuperK_private.pem")
+
+jackID=ABAC.ID("Jack", 0)
+jackID.write_cert_file("Jack_ID.pem")
+jackID.write_privkey_file("Jack_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.write_cert_file("Bob_ID.pem")
+bobID.write_privkey_file("Bob_private.pem")
+
+maryID=ABAC.ID("Mary", 0)
+maryID.write_cert_file("Mary_ID.pem")
+maryID.write_privkey_file("Mary_private.pem")
+
Index: examples/python_tests/basic_id/README
===================================================================
--- examples/python_tests/basic_id/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_id/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,43 @@
+#####################################################################
+# This example demonstrates various ways to create and access
+# ID credentials using libabac api
+#  
+
+case 1: make ID  -- not in RT0
+        writing cert file
+        writing key file
+        load cert, key file
+
+case 2: make ID  -- not in RT0
+        load ID
+
+case 3: make ID  -- not in RT0?
+        write key to combo file
+        write cert to combo file
+        load combo file
+
+case 4: make ID
+        write key to unconventional name
+        write cert to unconventional name
+        load unconventional filename
+        
+case 5: make ID
+        write cert to combo file
+        load combo file
+
+case 6: make ID
+        write key to combo file
+        load combo file
+
+case 7: make ID
+        extract id chunk cert from ID
+        make another ID with the chunk cert
+        load new ID(as chunk)
+
+case 8: make ID
+        extract id cert chunk from ID
+        load the cert chunk directly into context
+
+case 9: load unknown combo file
+
+
Index: examples/python_tests/basic_id/id.py
===================================================================
--- examples/python_tests/basic_id/id.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_id/id.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,103 @@
+#!/usr/bin/env python
+
+"""
+  to test with python
+
+cmd:env keystore=`pwd` ./id.py 
+
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+#    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1) 
+
+## case 1
+## creating and writing out using libabac ID
+id=ABAC.ID("Mary", 0)
+print "adding -> %s(Mary/good)" % id.keyid()
+id.write_cert_file("Mary_ID.pem")
+id.write_privkey_file("Mary_private.pem")
+## load principal with id/key file pair
+## note, with this, we do not have handle on the keyid
+## to Mary but it will be in the db
+#XXX# ctxt.load_id_files("Mary_ID.pem","Mary_private.pem")
+
+## case 2
+## creating principal using ID
+id2=ABAC.ID("Jack2", 0)
+print "adding -> %s(Jack2/good)" % id2.keyid()
+## load principal directly with the ID, no external
+## credential files were created
+#XXX# ctxt.load_id(id2)
+
+## case 3
+## creating principal using ID
+id3=ABAC.ID("Mark", 0)
+print "adding -> %s(Mark/good)" % id3.keyid()
+## write cert and key content to a combo file. One is appended
+## after another
+id3.write_privkey_file("Mark_IDKEY.pem")
+id3.write_cert_file("Mark_IDKEY.pem")
+## load principal in with the combo file with the tandem format
+ctxt.load_id_file("Mark_IDKEY.pem")
+
+## case 4
+## creating principal using ID
+id4=ABAC.ID("John", 0)
+print "adding -> %s(John/good,invisible)" % id4.keyid()
+id4.write_cert_file("John_other.pem")
+## load id without the key file
+ctxt.load_id_file("John_other.pem")
+
+## case 5
+## creating principal using ID
+id5=ABAC.ID("Lori", 0)
+print "adding -> %s(Lori/good,nokey)" % id5.keyid()
+## write just cert into the combo file
+id5.write_cert_file("Lori_IDKEY.pem")
+##load principal from a combo file that only contains cert part
+ctxt.load_id_file("Lori2_IDKEY.pem")
+
+## case 6
+## creating principal using ID
+id6=ABAC.ID("Tom", 0)
+print "adding -> %s(Tom/bad,nocert)" % id6.keyid()
+## write just key into the combo file
+id6.write_privkey_file("Tom_IDKEY.pem")
+## load principal from combo file that only contains key part
+ctxt.load_id_file("Tom_IDKEY.pem")
+
+## case 7
+## creating ID using chunk
+## this already created a Tim with private key and
+## stored in the master list
+id7=ABAC.ID("Tim", 0)
+chunk=id7.cert_chunk() 
+id77=ABAC.ID(chunk)
+## load principal from new id
+ctxt.load_id_chunk(id77.cert_chunk())
+
+## case 8
+## load directly using chunk
+## this already created a Stanley with private key
+## and stored in the master list
+id8=ABAC.ID("Stanley", 0)
+chunk=id8.cert_chunk() 
+## load principal as chunk
+ctxt.load_id_chunk(chunk)
+
+## case 9
+## failure case, loading a non-existing combo file
+print "adding -> Casper(bad,unknown file)"
+ctxt.load_id_file("Casper_IDKEY.pem")
+
Index: examples/python_tests/basic_id/id_ctxt.py
===================================================================
--- examples/python_tests/basic_id/id_ctxt.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_id/id_ctxt.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,47 @@
+#!/usr/bin/env python
+
+"""
+  to test when an id gets loaded into the session
+vs when it gets loaded into a context
+
+cmd:env keystore=`pwd` ./id_ctxt.py 
+
+"""
+
+import os
+import ABAC
+
+def pSZ(CTXT,msg):
+   psz= CTXT.principal_count()
+   csz= CTXT.credential_count()
+   print "context [%s] %d principals, %d credentials" % (msg,psz,csz)
+
+ctxtA = ABAC.Context()
+ctxtB = ABAC.Context()
+
+ABAC.dump_debug_info("first")
+pSZ(ctxtA, "A")
+pSZ(ctxtB, "B")
+
+## creating and writing out using libabac ID
+id=ABAC.ID("Ella", 0)
+print "adding -> %s(good) to session" % id.id_name()
+id.id_write_cert("Ella_ID.pem")
+id.id_write_privkey("Ella_private.pem")
+
+ABAC.dump_debug_info("second")
+pSZ(ctxtA, "A")
+pSZ(ctxtB, "B")
+
+## load principal with id/key file pair
+## note, with this, we do not have handle on the keyid
+## to Ella but it will be in the db
+print "loading -> %s to ctxtA" % id.id_name()
+ctxtA.load_id_files("Ella_ID.pem","Ella_private.pem")
+
+print "loading -> Bob to ctxtB"
+ctxtB.load_id_files("Bob_ID.pem","Bob_private.pem")
+
+ABAC.dump_debug_info("third")
+pSZ(ctxtA, "A")
+pSZ(ctxtB, "B")
Index: examples/python_tests/basic_id/run_test
===================================================================
--- examples/python_tests/basic_id/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_id/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,21 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>id.log 2>&1
+
+echo '---run id.py '
+env keystore=`pwd` ./id.py > id.out 2>&1
+
+#echo '---run id_ctxt ' -- not in RT0
+#env keystore=`pwd` ./id_ctxt.py >> id.out 2>&1
+
+good=`grep adding id.out |wc -l`
+bad=`grep "terminate called" id.out |wc -l`
+if [ "$good" = "6" -a "$bad" = "1" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:basic_id test result differs!!!"
+fi
+
Index: examples/python_tests/basic_id/setup.py
===================================================================
--- examples/python_tests/basic_id/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/basic_id/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,31 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates principals
+using ID and write out the credential file pair, cert/privkey
+"""
+import os
+import ABAC
+
+jackID=ABAC.ID("Jack", 0)
+jackID.write_cert_file("Jack_ID.pem")
+jackID.write_privkey_file("Jack_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.write_cert_file("Bob_ID.pem")
+bobID.write_privkey_file("Bob_private.pem")
+
+markID=ABAC.ID("Mark2", 0)
+markID.write_privkey_file("Mark2_IDKEY.pem")
+markID.write_cert_file("Mark2_IDKEY.pem")
+
+johnID=ABAC.ID("John2", 0)
+johnID.write_cert_file("John2_other.pem")
+
+tomID=ABAC.ID("Tom2", 0)
+tomID.write_privkey_file("Tom2_IDKEY.pem")
+
+loriID=ABAC.ID("Lori2", 0)
+loriID.write_cert_file("Lori2_IDKEY.pem")
+
+
Index: examples/python_tests/experiment_create_rt0/README
===================================================================
--- examples/python_tests/experiment_create_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/README	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,43 @@
+#
+#Acme runs a testbed. They've delegated the authority to create
+#experiments to all their partners. The Globotron company is one such
+#partner.
+#
+#    Acme.experiment_create <- Acme.partner.experiment_create
+#
+#Globotron has delegated the authority to anyone an admin thinks is a
+#'power user'.
+#
+#    Globotron.experiment_create <- Globotron.admin.power_user
+#
+#Alice is an admin, and her friend Bob is a power user:
+#
+#    Globotron.admin <- Alice
+#    Alice.power_user <- Bob
+#
+#From these credentials, it is possible to show that 
+#    Acme.experiment_create <- Bob.
+#
+#In query.py, it checks if Alice is a admin of Globotron which is true;
+#and if Bob is an admin of Globotron which is not true; and also show
+# that Bob can create experiment at Acme
+#
+# experiment_create_rt0 
+
+# Credential 1
+#[keyid:Acme].role:experiment_create 
+#                 <- [keyid:Acme].role:partner.role:experiment_create
+
+# Credential 2
+#[keyid:Acme].role:partner <- [keyid:Globotron]
+
+# Credential 3
+#[keyid:Globotron].role:expriment_create 
+                 <- [keyid:Globotron].role:admin.role:power_user
+
+# Credential 4
+#[keyid:Globotron].role:admin <- [keyid:Alice]
+
+# Credential 5
+#[keyid:Alice].role:power_user <- [keyid:Bob]
+
Index: examples/python_tests/experiment_create_rt0/attr.py
===================================================================
--- examples/python_tests/experiment_create_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/attr.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,91 @@
+#!/usr/bin/env python
+
+"""
+See README in this directory for the semantics of the example.  This file
+constructs the credentials described and puts copies into this directory
+
+cmd: ./attr.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.load_privkey("Bob_private.pem");
+ctxt.load_id_chunk(bobID.cert_chunk())
+bob=bobID.keyid()
+
+aliceID=ABAC.ID("Alice_ID.pem");
+aliceID.load_privkey("Alice_private.pem");
+ctxt.load_id_chunk(aliceID.cert_chunk())
+alice=aliceID.keyid()
+
+globotronID=ABAC.ID("Globotron_ID.pem");
+globotronID.load_privkey("Globotron_private.pem");
+ctxt.load_id_chunk(globotronID.cert_chunk())
+globotron=globotronID.keyid()
+
+################################################
+# Credential 1, Anyone who is allowed to create experiment by Acme's
+#               partners can create experiment at Acme
+# [keyid:Acme].role:experiment_create 
+#           <- [keyid:Acme].role:partner.role:experiment_create
+
+# compose the policy attribute
+attr = ABAC.Attribute(acmeID, "experiment_create", 0)
+# creating a linking role
+tail = attr.linking_role(acme,"partner","experiment_create")
+# finalize the policy
+attr.bake()
+
+# write out the policy to an external file
+attr.write_file("Acme_experiment_create__Acme_partner_experiment_create_attr.xml")
+# load the policy into the context by accessing that external file
+ctxt.load_attribute_file("Acme_experiment_create__Acme_partner_experiment_create_attr.xml")
+
+#################################################
+# Credential 2
+# [keyid:Acme].role:partner <- [keyid:Globotron]
+#
+attr = ABAC.Attribute(acmeID, "partner", 0)
+attr.principal(globotron)
+attr.bake()
+attr.write_file("Acme_partner__Globotron_attr.xml")
+ctxt.load_attribute_file("Acme_partner__Globotron_attr.xml")
+
+#################################################
+# Credential 3
+# [keyid:Globotron].role:expriment_create 
+#           <- [keyid:Globotron].role:admin.role:power_user
+attr = ABAC.Attribute(globotronID, "experiment_create", 0)
+attr.linking_role(globotron,"admin","power_user")
+attr.bake()
+attr.write_file("Globotron_experiment_create__Globotron_admin_power_user_attr.xml")
+ctxt.load_attribute_file("Globotron_experiment_create__Globotron_admin_power_user_attr.xml")
+
+#################################################
+# Credential 4,
+# [keyid:Globotron].role:admin <- [keyid:Alice]
+attr = ABAC.Attribute(globotronID, "admin", 0)
+attr.principal(alice)
+attr.bake()
+attr.write_file("Globotron_admin__Alice_attr.xml")
+ctxt.load_attribute_file("Globotron_admin__Alice_attr.xml")
+
+#################################################
+# Credential 5, 
+# [keyid:Alice].role:power_user <- [keyid:Bob]
+attr = ABAC.Attribute(aliceID, "power_user", 0)
+attr.principal(bob)
+attr.bake()
+attr.write_file("Alice_power_user__Bob_attr.xml")
+ctxt.load_attribute_file("Alice_power_user__Bob_attr.xml")
+
Index: examples/python_tests/experiment_create_rt0/query.py
===================================================================
--- examples/python_tests/experiment_create_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/query.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,92 @@
+#!/usr/bin/env python
+
+"""
+Run the queries described in README
+
+cmd: env keystore=`pwd` ./query.py 
+"""
+
+import os
+import ABAC
+
+ctxt = ABAC.Context()
+
+# Keystore is the directory containing the principal credentials.
+# Load existing principals and/or policy credentials
+if (os.environ.has_key("keystore")) :
+    keystore=os.environ["keystore"]
+    ctxt.load_directory(keystore)
+else:
+    print("keystore is not set...")
+    exit(1)
+
+# retrieve principals' keyid value from local credential files
+acmeID=ABAC.ID("Acme_ID.pem");
+acmeID.load_privkey("Acme_private.pem");
+ctxt.load_id_chunk(acmeID.cert_chunk())
+acme=acmeID.keyid()
+
+bobID=ABAC.ID("Bob_ID.pem");
+bobID.load_privkey("Bob_private.pem");
+ctxt.load_id_chunk(bobID.cert_chunk())
+bob=bobID.keyid()
+
+aliceID=ABAC.ID("Alice_ID.pem");
+aliceID.load_privkey("Alice_private.pem");
+ctxt.load_id_chunk(aliceID.cert_chunk())
+alice=aliceID.keyid()
+
+globotronID=ABAC.ID("Globotron_ID.pem");
+globotronID.load_privkey("Globotron_private.pem");
+ctxt.load_id_chunk(globotronID.cert_chunk())
+globotron=globotronID.keyid()
+
+##########################################################################
+# dump the loaded attribute policies
+#
+print "\n...policy attribute set..."
+credentials = ctxt.credentials()
+for credential in credentials:
+    print "context: %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# is alice a admin at Globotron ?
+# role=[keyid:Globotron].role:admin 
+# p=[keyid:Alice]
+
+print "\n===good=============== Globotron.admin <- Alice"
+(success, credentials) = ctxt.query("%s.admin" % globotron, alice)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# is bob a admin at Globotron ?
+# role=[keyid:Globotron].role:admin 
+# p=[keyid:Bob]
+
+print "\n===bad=============== Globotron.admin <- Bob"
+(success, credentials) = ctxt.query("%s.admin" % globotron, bob)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
+
+##########################################################################
+# can bob create experiment at Acme ?
+# role=[keyid:Acme].role:experiment_create 
+# p=[keyid:Bob]
+
+print "\n===good=============== Acme.experiment_create <- Bob"
+(success, credentials) = ctxt.query("%s.experiment_create" % acme, bob)
+if success:
+    print "success!"
+else:
+    print "failure!"
+for credential in credentials:
+    print "credential %s <- %s" % (credential.head().string(), credential.tail().string())
Index: examples/python_tests/experiment_create_rt0/run_test
===================================================================
--- examples/python_tests/experiment_create_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/run_test	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,21 @@
+#!/bin/sh 
+
+rm -rf *.pem *.xml *.log *.out
+
+echo '---setup principals'
+./setup.py 1>/dev/null 2>& 1
+
+echo '---setup attributes'
+./attr.py 1>experiment.log 2>& 1
+
+echo '---run queries'
+env keystore=`pwd` ./query.py 1>experiment.out 2>& 1
+
+good=`grep success experiment.out |wc -l`
+bad=`grep failure experiment.out |wc -l`
+if [ "$good" = "2" -a "$bad" = "1" ]; then
+    echo "   PASSED"
+else
+    echo "   ERROR:experiment_create_rt0 test result differs!!!"
+fi
+
Index: examples/python_tests/experiment_create_rt0/setup.py
===================================================================
--- examples/python_tests/experiment_create_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
+++ examples/python_tests/experiment_create_rt0/setup.py	(revision be6cb41674f39a7d7d384be53bbceed738eb6eae)
@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+
+"""
+See README for the semantics.  This creates principals
+used by the example.
+"""
+import os
+import ABAC
+
+acme=ABAC.ID("Acme", 0)
+acme.write_cert_file("Acme_ID.pem")
+acme.write_privkey_file("Acme_private.pem")
+
+bobID=ABAC.ID("Bob", 0)
+bobID.write_cert_file("Bob_ID.pem")
+bobID.write_privkey_file("Bob_private.pem")
+
+aliceID=ABAC.ID("Alice", 0)
+aliceID.write_cert_file("Alice_ID.pem")
+aliceID.write_privkey_file("Alice_private.pem")
+
+globotronID=ABAC.ID("Globotron", 0)
+globotronID.write_cert_file("Globotron_ID.pem")
+globotronID.write_privkey_file("Globotron_private.pem")
+
+
