Index: libabac/abac.c
===================================================================
--- libabac/abac.c	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac.c	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -3,5 +3,8 @@
 #include <assert.h>
 #include <err.h>
-#include <glob.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <dirent.h>
 
 #include "abac.h"
@@ -11,5 +14,11 @@
 #include "abac_verifier.h"
 
+int debug=0;
+abac_id_cert_t **abac_context_principals(abac_context_t *ctx);
+void abac_context_id_credentials_free(abac_id_cert_t **id_credentials);
+
 struct _abac_context_t {
+/* list of principal id credentials, abac_id_cert_t */
+    abac_list_t *id_certs;
     abac_graph_t *graph;
 };
@@ -45,4 +54,5 @@
     abac_context_t *ctx = abac_xmalloc(sizeof(abac_context_t));
     ctx->graph = abac_graph_new();
+    ctx->id_certs=abac_list_new();
     return ctx;
 }
@@ -53,7 +63,13 @@
 abac_context_t *abac_context_dup(abac_context_t *ctx) {
     assert(ctx != NULL);
-
+   
     abac_context_t *dup = abac_xmalloc(sizeof(abac_context_t));
     dup->graph = abac_graph_dup(ctx->graph);
+    dup->id_certs=abac_list_new();
+
+    abac_id_cert_t *id_cert;
+    abac_list_foreach(ctx->id_certs, id_cert,
+        abac_list_add(dup->id_certs, abac_id_cert_dup(id_cert));
+    );
 
     return dup;
@@ -67,4 +83,10 @@
 
     abac_graph_free(ctx->graph);
+
+    abac_id_cert_t *id_cert;
+    abac_list_foreach(ctx->id_certs, id_cert,
+        abac_id_cert_free(id_cert);
+    );
+    abac_list_free(ctx->id_certs);
     free(ctx);
 }
@@ -75,5 +97,5 @@
 int abac_context_load_id_file(abac_context_t *ctx, char *filename) {
     assert(ctx != NULL); assert(filename != NULL);
-    return abac_verifier_load_id_file(filename);
+    return abac_verifier_load_id_file(ctx->id_certs,filename);
 }
 
@@ -83,5 +105,5 @@
 int abac_context_load_id_chunk(abac_context_t *ctx, abac_chunk_t cert_chunk) {
     assert(ctx != NULL);
-    return abac_verifier_load_id_chunk(cert_chunk);
+    return abac_verifier_load_id_chunk(ctx->id_certs,cert_chunk);
 }
 
@@ -96,5 +118,5 @@
     assert(ctx != NULL); assert(filename != NULL);
 
-    ret = abac_verifier_load_attribute_cert_file(filename, cred_list);
+    ret = abac_verifier_load_attribute_cert_file(ctx->id_certs, filename, cred_list);
 
     if (ret == ABAC_CERT_SUCCESS) {
@@ -122,5 +144,5 @@
     assert(ctx != NULL);
 
-    ret = abac_verifier_load_attribute_cert_chunk(cert_chunk, cred_list);
+    ret = abac_verifier_load_attribute_cert_chunk(ctx->id_certs, cert_chunk, cred_list);
     if (ret == ABAC_CERT_SUCCESS) {
         int size = abac_list_size(cred_list);
@@ -141,43 +163,38 @@
 #define ATTR_PAT "/*_attr.xml"
 
+static int is_regular_file(char *filename)
+{
+   struct stat sb;
+   if(stat(filename,&sb) == -1)
+       return 0;
+   if((sb.st_mode & S_IFMT) == S_IFREG)
+       return 1;
+   return 0;
+}
+
 /**
  * Load a directory full of certs.
  */
 void abac_context_load_directory(abac_context_t *ctx, char *path) {
-    char *glob_pat;
-    glob_t glob_buf;
-    int i, ret;
-
-    assert(ctx != NULL); assert(path != NULL);
-
-    int dirlen = strlen(path);
-    glob_pat = abac_xmalloc(dirlen + sizeof(ID_PAT));
-    memcpy(glob_pat, path, dirlen);
-
-    // first load ID certs
-    memcpy(glob_pat + dirlen, ID_PAT, sizeof(ID_PAT));
-    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        char *cert_file = glob_buf.gl_pathv[i];
-
-        ret = abac_context_load_id_file(ctx, cert_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load ID cert %s", cert_file);
-    }
-    globfree(&glob_buf);
-
-    // then load attr certs
-    memcpy(glob_pat + dirlen, ATTR_PAT, sizeof(ATTR_PAT));
-    glob(glob_pat, 0, NULL, &glob_buf); // TODO check for error
-    for (i = 0; i < glob_buf.gl_pathc; ++i) {
-        char *cert_file = glob_buf.gl_pathv[i];
-
-        ret = abac_context_load_attribute_file(ctx, cert_file);
-        if (ret != ABAC_CERT_SUCCESS)
-            warnx("Couldn't load attribute cert %s", cert_file);
-    }
-    globfree(&glob_buf);
-
-    free(glob_pat);
+    DIR *dp;
+    struct dirent *ep;
+     
+    dp = opendir (path);
+    if (dp != NULL) {
+        while (ep = readdir (dp)) {
+            if(is_regular_file(ep->d_name)) {
+                int ret = abac_context_load_id_file(ctx, ep->d_name);
+                if (ret == ABAC_CERT_SUCCESS) {
+                    if(debug) fprintf(stderr,"abac_context_load_directory, found an id %s\n",ep->d_name);
+                    continue;
+                }
+                ret = abac_context_load_attribute_file(ctx, ep->d_name);
+                if (ret == ABAC_CERT_SUCCESS) {
+                    if(debug) fprintf(stderr,"abac_context_load_directory, found an attr %s\n",ep->d_name);
+                }
+            }
+        }
+        (void) closedir (dp);
+    } else fprintf(stderr, "abac_load_directory, Couldn't open the directory\n");
 }
 
@@ -247,4 +264,5 @@
 }
 
+
 /**
  * A NULL-terminated array of all the credentials in the context.
@@ -267,6 +285,43 @@
     abac_list_free(cred_list);
 
+    if(debug) {
+        abac_id_cert_t **ilist=abac_context_principals(ctx);
+        abac_id_cert_t *cert;
+        if (ilist != NULL)
+            for (i = 0; ilist[i] != NULL; ++i) {
+                cert = ilist[i];
+                printf("id[%d] %s\n",i, abac_id_cert_keyid(cert));
+            }
+        abac_context_id_credentials_free(ilist);
+    }
+
     return credentials;
 }
+
+/**
+ * A NULL-terminated array of all the principals in the context.
+ */
+abac_id_cert_t **abac_context_principals(abac_context_t *ctx)
+{
+    abac_id_cert_t **principals = NULL, *cur;
+    assert(ctx != NULL);
+
+    int size = abac_list_size(ctx->id_certs);
+
+    // make the array (leave space to NULL terminate it)
+    //      n.b., even if the list is empty, we still return an array that
+    //            only contains the NULL terminator
+    principals = abac_xmalloc(sizeof(abac_id_cert_t *) * (size + 1));
+    int i = 0;
+    abac_id_cert_t *id_cert;
+    abac_list_foreach(ctx->id_certs, id_cert,
+        principals[i]=abac_id_cert_dup(id_cert);
+        i++;
+    );
+    principals[i] = NULL;
+
+    return principals;
+}
+
 
 /**
@@ -283,2 +338,19 @@
     free(credentials);
 }
+
+/**
+ * Frees a NULL-terminated list of id credentials 
+ */
+void abac_context_id_credentials_free(abac_id_cert_t **id_credentials) {
+    int i;
+
+    if (id_credentials == NULL)
+        return;
+
+    for (i = 0; id_credentials[i] != NULL; ++i) {
+        abac_id_cert_free(id_credentials[i]);
+    }
+    free(id_credentials);
+}
+
+
Index: libabac/abac.h
===================================================================
--- libabac/abac.h	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac.h	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -7,4 +7,5 @@
 typedef struct _abac_context_t abac_context_t;
 typedef struct _abac_credential_t abac_credential_t;
+typedef struct _abac_id_cert_t abac_id_cert_t;
 typedef struct _abac_role_t abac_role_t;
 
@@ -212,8 +213,8 @@
 
 // load a list of attr cert from file (aborts on fail)
-ABAC_LIST_T *abac_attribute_certs_from_file(char *);
+ABAC_LIST_T *abac_attribute_certs_from_file(ABAC_LIST_T *,char *);
 
 // load a list of attr cert from chunk (aborts on fail)
-ABAC_LIST_T *abac_attribute_certs_from_chunk(abac_chunk_t);
+ABAC_LIST_T *abac_attribute_certs_from_chunk(ABAC_LIST_T *,abac_chunk_t);
 
 	// get the attribute role string
Index: libabac/abac_attribute.c
===================================================================
--- libabac/abac_attribute.c	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac_attribute.c	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -38,5 +38,5 @@
 
 char *abac_attribute_role_string(abac_attribute_t *attr);
-extern abac_id_t *abac_verifier_lookup_id(char *keyid);
+extern abac_id_t *abac_verifier_lookup_id(abac_id_cert_t *, char *keyid);
 static char *_validate_principal(char *keyid);
 
@@ -269,5 +269,5 @@
 
 
-static abac_attribute_t *_load_attr(char *rstring, char *xml)
+static abac_attribute_t *_load_attr(abac_list_t *id_certs,char *rstring, char *xml)
 {
     /* make a copy of rle_string */
@@ -282,5 +282,5 @@
 
     char *keyid=get_keyid_from_xml(xml);
-    abac_id_t *issuer_id=abac_verifier_lookup_id(keyid);
+    abac_id_t *issuer_id=abac_verifier_lookup_id(id_certs,keyid);
 
     long validity=get_validity_from_xml(xml);
@@ -303,5 +303,5 @@
 }
 
-abac_list_t *abac_attribute_certs_from_file(char *filename)
+abac_list_t *abac_attribute_certs_from_file(abac_list_t *id_certs,char *filename)
 {
     libabac_init();
@@ -310,5 +310,5 @@
     char *rt0=NULL;
 
-    char **rt0s=my_read_credential(filename, &xml);
+    char **rt0s=my_read_credential((void *)id_certs,filename, &xml);
     if(rt0s == NULL) return alist;
     if(xml == NULL || strlen(xml)==0) return alist;
@@ -320,5 +320,5 @@
         rt0 = rt0s[i]; 
         if(rt0 == NULL) break;
-        attr=_load_attr(rt0, xml);
+        attr=_load_attr(id_certs,rt0, xml);
         if(attr)
             abac_list_add(alist, attr);
@@ -333,5 +333,5 @@
 }
 
-abac_list_t *abac_attribute_certs_from_chunk(abac_chunk_t chunk) {
+abac_list_t *abac_attribute_certs_from_chunk(abac_list_t *id_certs,abac_chunk_t chunk) {
     libabac_init();
 
@@ -340,5 +340,5 @@
     if(chunk.len==0) return alist;
 
-    char **rt0s=get_rt0_from_xml(xml);
+    char **rt0s=get_rt0_from_xml((void *) id_certs,xml);
     char *rt0=NULL;
     if(rt0s==NULL) return alist;
@@ -349,5 +349,5 @@
         rt0 = rt0s[i]; 
         if(rt0 == NULL) break;
-        attr=_load_attr(rt0, xml);
+        attr=_load_attr(id_certs,rt0, xml);
         if(attr)
             abac_list_add(alist, attr);
Index: libabac/abac_id.c
===================================================================
--- libabac/abac_id.c	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac_id.c	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -59,4 +59,5 @@
 
     X509 *cert = abac_load_id_from_fp(fp);
+    /* try to see if private key is also in here .. */
     fclose(fp);
 
@@ -64,5 +65,9 @@
         return NULL;
 
-    return _id_from_cert(cert);
+    abac_id_t *id=_id_from_cert(cert);
+    if(abac_id_privkey_from_file(id, filename)==ABAC_SUCCESS) {
+        if(debug) fprintf(stderr,"abac_id_from_file:found a combo file!!! %s\n", filename);
+    }
+    return id;
 }
 
@@ -151,5 +156,9 @@
         return NULL;
 
-    return _id_from_cert(cert);
+    abac_id_t *id=_id_from_cert(cert);
+    if(abac_id_privkey_from_chunk(id, chunk)==ABAC_SUCCESS) {
+        if(debug) fprintf(stderr,"abac_id_from_chunk:found a combo chunk!!!\n");
+    }
+    return id;
 }
 
Index: libabac/abac_verifier.c
===================================================================
--- libabac/abac_verifier.c	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac_verifier.c	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -6,13 +6,10 @@
 #include "abac.h"
 #include "abac_list.h"
-#include "uthash.h"
 #include "abac_util.h"
 
-typedef struct _abac_id_cert_t {
+struct _abac_id_cert_t {
     char *keyid; // using cert's keyid
     abac_id_t *cert;
-
-    UT_hash_handle hh;
-} abac_id_cert_t;
+};
 
 struct _abac_credential_t {
@@ -24,7 +21,4 @@
     int refcount;
 };
-
-/* hash table of all the principal id credentials */
-abac_id_cert_t *id_certs = NULL;
 
 extern int abac_id_pass_privkey_from_id(abac_id_t *to_id, abac_id_t *from_id);
@@ -71,21 +65,24 @@
  */
 void abac_verifier_deinit(void) {
-    abac_id_cert_t *id;
-
-    while ((id = id_certs) != NULL) {
-        HASH_DEL(id_certs, id);
-
-        free(id->keyid);
-        abac_id_free(id->cert);
-        free(id);
-    }
     deinit_xmlsec();
     deinit_openssl();
 }
 
+static abac_id_cert_t *_lookup_cert(abac_list_t *id_certs, char *keyid)
+{
+    abac_id_cert_t *id_cert=NULL;
+    if(id_certs != NULL) {
+        abac_list_foreach(id_certs, id_cert,
+            if(strcmp(keyid,id_cert->keyid)==0)
+               return id_cert;
+        );
+    }
+    return NULL;
+}
+
 /**
  * Load an ID certificate.
  */
-static int _load_id(abac_id_t *cert) {
+static int _load_id(abac_list_t *id_certs, abac_id_t *cert) {
     abac_id_cert_t *id_cert = NULL;
     char *keyid = NULL;
@@ -98,5 +95,6 @@
 
     // if we already have this cert 'error' with success
-    HASH_FIND_STR(id_certs, keyid, id_cert);
+    id_cert=_lookup_cert(id_certs, keyid);
+
     if (id_cert != NULL) {
         /* special case, if
@@ -122,5 +120,5 @@
     id_cert->keyid = abac_xstrdup(keyid);
     id_cert->cert = cert;
-    HASH_ADD_KEYPTR(hh, id_certs, id_cert->keyid, strlen(id_cert->keyid), id_cert);
+    abac_list_add(id_certs, id_cert); 
 
     return ABAC_CERT_SUCCESS;
@@ -131,8 +129,7 @@
 }
 
-abac_id_t *abac_verifier_lookup_id(char *keyid)
+abac_id_t *abac_verifier_lookup_id(abac_list_t *id_certs, char *keyid)
 {
-    abac_id_cert_t *id_cert;
-    HASH_FIND_STR(id_certs, keyid, id_cert);
+    abac_id_cert_t *id_cert=_lookup_cert(id_certs,keyid);
     if(id_cert == NULL) return NULL;
     return id_cert->cert;
@@ -142,5 +139,5 @@
  * Load an ID cert from a file.
  */
-int abac_verifier_load_id_file(char *filename) {
+int abac_verifier_load_id_file(abac_list_t *id_certs,char *filename) {
     // load the cert
     abac_id_t *cert = abac_id_from_file(filename);
@@ -149,5 +146,5 @@
         return ABAC_CERT_INVALID;
 
-    return _load_id(cert);
+    return _load_id(id_certs,cert);
 }
 
@@ -155,5 +152,5 @@
  * Load an ID cert from a chunk.
  */
-int abac_verifier_load_id_chunk(abac_chunk_t chunk) {
+int abac_verifier_load_id_chunk(abac_list_t *id_certs,abac_chunk_t chunk) {
 
     // load the cert
@@ -162,5 +159,5 @@
     if (cert == NULL)
         return ABAC_CERT_INVALID;
-    return _load_id(cert);
+    return _load_id(id_certs,cert);
 }
 
@@ -169,5 +166,7 @@
  * this is called from parse_privilege(..)
  */
-int abac_verifier_load_id_chars(char *naked_pem) {
+int abac_verifier_load_id_chars(void *id_certs,char *naked_pem) {
+    /* if id_certs is NULL, don't even try to load it */
+    if(id_certs == NULL) return ABAC_CERT_SUCCESS;
     /* make a well formed pem from this */
     char *new_naked_pem=abac_xstrdup(naked_pem);
@@ -176,5 +175,5 @@
     abac_chunk_t chunk = { pem, len }; 
     free(new_naked_pem);
-    return abac_verifier_load_id_chunk(chunk);
+    return abac_verifier_load_id_chunk((abac_list_t *)id_certs,chunk);
 }
 /**
@@ -183,5 +182,5 @@
  * authority.
  */
-static int _load_attribute_cert(abac_attribute_t *cert, abac_credential_t **cred_ret) {
+static int _load_attribute_cert(abac_list_t *id_certs,abac_attribute_t *cert, abac_credential_t **cred_ret) {
     abac_role_t *head_role = NULL;
     abac_role_t *tail_role = NULL;
@@ -220,5 +219,5 @@
 
     char *principal = abac_role_principal(head_role);
-    HASH_FIND_STR(id_certs, principal, issuer);
+    issuer=_lookup_cert(id_certs,principal);
     if (issuer == NULL) {
         ret = ABAC_CERT_MISSING_ISSUER;
@@ -257,5 +256,5 @@
 }
 
-static int _load_attribute_certs(abac_list_t *attr_list, abac_list_t *cred_list) {
+static int _load_attribute_certs(abac_list_t *id_certs,abac_list_t *attr_list, abac_list_t *cred_list) {
 
     int sz=abac_list_size(attr_list);
@@ -264,5 +263,5 @@
     if(sz) { 
         abac_list_foreach(attr_list, attr,
-            int ret=_load_attribute_cert(attr, &cred_ret);
+            int ret=_load_attribute_cert(id_certs, attr, &cred_ret);
             if(ret==ABAC_CERT_SUCCESS) {
                 abac_list_add(cred_list, cred_ret);
@@ -276,13 +275,13 @@
  * Load an attribute cert from a file.
  */
-int abac_verifier_load_attribute_cert_file(char *filename, abac_list_t *cred_list) {
+int abac_verifier_load_attribute_cert_file(abac_list_t *id_certs,char *filename, abac_list_t *cred_list) {
 
     // load the cert
-    abac_list_t *attr_list = abac_attribute_certs_from_file(filename);
+    abac_list_t *attr_list = abac_attribute_certs_from_file(id_certs,filename);
 
     if (abac_list_size(attr_list) == 0)
         return ABAC_CERT_INVALID;
 
-    int ret=_load_attribute_certs(attr_list, cred_list);
+    int ret=_load_attribute_certs(id_certs,attr_list, cred_list);
 
     if(ret) return ABAC_CERT_SUCCESS;
@@ -293,13 +292,13 @@
  * Load an attribute cert from a chunk.
  */
-int abac_verifier_load_attribute_cert_chunk(abac_chunk_t chunk, abac_list_t *cred_list) {
+int abac_verifier_load_attribute_cert_chunk(abac_list_t *id_certs,abac_chunk_t chunk, abac_list_t *cred_list) {
 
     // load the cert
-    abac_list_t *attr_list = abac_attribute_certs_from_chunk(chunk);
+    abac_list_t *attr_list = abac_attribute_certs_from_chunk(id_certs,chunk);
 
     if (abac_list_size(attr_list) == 0)
         return ABAC_CERT_INVALID;
 
-    int ret=_load_attribute_certs(attr_list,cred_list);
+    int ret=_load_attribute_certs(id_certs,attr_list,cred_list);
 
     if(ret) return ABAC_CERT_SUCCESS;
@@ -348,4 +347,15 @@
 }
 
+abac_id_cert_t *abac_id_cert_dup(abac_id_cert_t *id_cert) {
+    assert(id_cert != NULL && id_cert->keyid!=NULL);
+
+    abac_id_cert_t *new_cert = abac_xmalloc(sizeof(abac_id_cert_t));
+    new_cert->keyid=abac_xstrdup(id_cert->keyid);
+    new_cert->cert=abac_id_dup(id_cert->cert);
+ 
+    return new_cert;
+}
+
+
 /**
  * Decrease the reference count of a credential, freeing it when it reaches 0.
@@ -366,2 +376,24 @@
     free(cred);
 }
+
+/**
+ * remove an id cert, (not reference counted, so abac_id_certs are 
+ * deep-copied)
+ */
+void abac_id_cert_free(abac_id_cert_t *id_cert) {
+    if (id_cert==NULL)
+        return;
+
+    abac_id_free(id_cert->cert);
+    if(id_cert->keyid) free(id_cert->keyid);
+    free(id_cert);
+}
+
+char *abac_id_cert_keyid(abac_id_cert_t *id_cert)
+{
+    assert(id_cert);
+    return id_cert->keyid;
+}
+
+
+
Index: libabac/abac_verifier.h
===================================================================
--- libabac/abac_verifier.h	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac_verifier.h	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -4,12 +4,19 @@
 #include "abac.h"
 #include "uthash.h"
+#include "abac_verifier.h"
 
 void abac_verifier_init(void);
 void abac_verifier_deinit(void);
 
-int abac_verifier_load_id_file(char *filename);
-int abac_verifier_load_id_chunk(abac_chunk_t chunk);
-int abac_verifier_load_attribute_cert_file(char *filename, abac_list_t *clist);
-int abac_verifier_load_attribute_cert_chunk(abac_chunk_t chunk, abac_list_t  *clist);
+int abac_verifier_load_id_file(abac_list_t*,char *filename);
+int abac_verifier_load_id_chunk(abac_list_t *,abac_chunk_t chunk);
+int abac_verifier_load_attribute_cert_file(abac_list_t *,char *filename, abac_list_t *clist);
+int abac_verifier_load_attribute_cert_chunk(abac_list_t *,abac_chunk_t chunk, abac_list_t  *clist);
+
+void abac_id_cert_insert_cert(abac_list_t *, abac_id_cert_t *id_cert);
+void abac_id_cert_delete_cert(abac_list_t *, abac_id_cert_t *id_cert);
+abac_id_cert_t *abac_id_cert_dup(abac_id_cert_t *id_cert);
+int abac_id_cert_count(abac_id_cert_t *);
+char *abac_id_cert_keyid(abac_id_cert_t *);
 
 #endif /* __VERIFIER_H__ */
Index: libabac/abac_xml.c
===================================================================
--- libabac/abac_xml.c	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac_xml.c	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -28,5 +28,5 @@
 #include <openssl/sha.h>
 
-extern int abac_verifier_load_id_chars(char*); 
+extern int abac_verifier_load_id_chars(void *, char*); 
 extern void* abac_get_sha_from_nake_pem(char *npem, char **sha1);
 extern void abac_split(char *string, char *delim, char **ret, int *num);
@@ -469,5 +469,5 @@
  * return value is an array of strings, zero-terminated (like argv) that holds
  * the RT0 strings.  It is NULL on failure. */
-static xmlChar **parse_privilege(xmlDocPtr doc) {
+static xmlChar **parse_privilege(xmlDocPtr doc, void *ctxt_id_certs) {
     xmlNodePtr root = NULL;	/* XML root node */
     xmlNodePtr node = NULL;	/* XML scratch node */
@@ -578,5 +578,5 @@
     if(ncred !=1) {
         /* load  issuer_ptr */ 
-        if(issuer_ptr && abac_verifier_load_id_chars(issuer_ptr) != 0 /*ABAC_CERT_SUCCESS*/)
+        if(issuer_ptr && abac_verifier_load_id_chars(ctxt_id_certs, issuer_ptr) != 0 /*ABAC_CERT_SUCCESS*/)
             goto fail;
     }
@@ -624,5 +624,5 @@
  * that), and return the RT0 it encodes as the only entry in an NULL-terminated
  * array of strings (just like parse_privilege). On failure return NULL. */
-xmlChar **parse_abac(xmlDocPtr doc) {
+xmlChar **parse_abac(xmlDocPtr doc, void *ctxt_id_certs) {
     xmlNodePtr root = NULL;	/* XML root node */
     xmlNodePtr node = NULL;	/* XML credential node */
@@ -672,5 +672,5 @@
     /* extract issuer pem and insert */
     xmlChar *issuer_ptr=get_issuer(doc);
-    if(issuer_ptr && abac_verifier_load_id_chars(issuer_ptr) != 0 /*ABAC_CERT_SUCCESS*/) {
+    if(issuer_ptr && abac_verifier_load_id_chars(ctxt_id_certs,issuer_ptr) != 0 /*ABAC_CERT_SUCCESS*/) {
         goto fail;
     }
@@ -690,5 +690,5 @@
  * NULL. Demultiplexed to parse_privilege or parse_abac to do the parsing and
  * uses check_signature to confirm the sig. */
-static xmlChar **read_credential(char *infile, xmlChar **xml) {
+static xmlChar **read_credential(void *ctxt_id_certs, char *infile, xmlChar **xml) {
     xmlDocPtr doc = xmlParseFile(infile);   /* Parse the document */
     xmlNodePtr node = NULL;		    /* XML scratch node */
@@ -711,7 +711,7 @@
     /* Demux on type */
     if ( !strcmp((char *) text, "privilege")) {
-	rv = parse_privilege(doc);
+	rv = parse_privilege(doc, ctxt_id_certs);
     } else if ( !strcmp((char *) text, "abac")) {
-	rv = parse_abac(doc);
+	rv = parse_abac(doc, ctxt_id_certs);
     } else { 
 	goto fail;
@@ -1014,6 +1014,6 @@
 
 /* to cast the parameters */
-char **my_read_credential(char *infile, char **xml) {
-    return (char **)read_credential(infile, (xmlChar **)xml);
+char **my_read_credential(void *ctxt_id_certs, char *infile, char **xml) {
+    return (char **)read_credential(ctxt_id_certs, infile, (xmlChar **)xml);
 }
 
@@ -1071,5 +1071,5 @@
 
 /* parse xml structure and extract the attribute rules */
-char **get_rt0_from_xml(char *xml) {
+char **get_rt0_from_xml(void *ctxt_id_certs,char *xml) {
     xmlDocPtr doc=xmlParseMemory(xml,strlen(xml));
     xmlNodePtr node = NULL;                 /* XML scratch node */
@@ -1092,7 +1092,7 @@
     /* Demux on type */
     if ( !strcmp((char *) text, "privilege")) {
-        rv = parse_privilege(doc);
+        rv = parse_privilege(doc,ctxt_id_certs);
     } else if ( !strcmp((char *) text, "abac")) {
-        rv = parse_abac(doc);
+        rv = parse_abac(doc, ctxt_id_certs);
     } else {
         goto fail;
Index: libabac/abac_xml.h
===================================================================
--- libabac/abac_xml.h	(revision 3ed053d9bd03c87f220684b9fbd8c1f473ac0947)
+++ libabac/abac_xml.h	(revision bec30b5ab9c079bfa792531837b13442d03db10c)
@@ -9,7 +9,7 @@
 extern int init_xmlsec();
 extern int deinit_xmlsec();
-extern char **my_read_credential(char *infile, char **xml);
+extern char **my_read_credential(void *id_certs, char *infile, char **xml);
 
-extern char **get_rt0_from_xml(char *xml);
+extern char **get_rt0_from_xml(void *id_certs,char *xml);
 extern char *get_keyid_from_xml(char *xml);
 extern long get_validity_from_xml(char *xml);
