Index: fedd/federation/experiment_control_legacy.py
===================================================================
--- fedd/federation/experiment_control_legacy.py	(revision 1d73342ee48b9cba4e12b13df91bffcab18df434)
+++ fedd/federation/experiment_control_legacy.py	(revision 1d73342ee48b9cba4e12b13df91bffcab18df434)
@@ -0,0 +1,200 @@
+#!/usr/local/bin/python
+
+import os,sys
+
+import re
+import random
+import string
+import subprocess
+import tempfile
+import copy
+import pickle
+import logging
+import signal
+import time
+
+import traceback
+# For parsing visualization output and splitter output
+import xml.parsers.expat
+
+from threading import Lock, Thread, Condition
+from subprocess import call, Popen, PIPE
+from string import join
+
+from urlparse import urlparse
+from urllib2 import urlopen
+
+from util import *
+from fedid import fedid, generate_fedid
+from remote_service import xmlrpc_handler, soap_handler, service_caller
+from service_error import service_error
+from synch_store import synch_store
+from experiment_partition import experiment_partition
+from authorizer import abac_authorizer
+from thread_pool import thread_pool, pooled_thread
+
+import topdl
+import list_log
+from ip_allocator import ip_allocator
+from ip_addr import ip_addr
+
+
+class experiment_control_legacy:
+    """
+    This contains the legacy access control requests that can be included in
+    the experiment control component.  This will eventually be completely
+    removed.  It is also only functional in the context of an experiment
+    control object.
+    """
+
+    def get_legacy_access(self, tb, tbparam, access_user, masters, tbmap):
+        """
+        Get access to testbed through fedd and set the parameters for that tb
+        """
+	def get_export_project(svcs):
+	    """
+	    Look through for the list of federated_service for this testbed
+	    objects for a project_export service, and extract the project
+	    parameter.
+	    """
+
+	    pe = [s for s in svcs if s.name=='project_export']
+	    if len(pe) == 1:
+		return pe[0].params.get('project', None)
+	    elif len(pe) == 0:
+		return None
+	    else:
+		raise service_error(service_error.req,
+			"More than one project export is not supported")
+
+        uri = tbmap.get(testbed_base(tb), None)
+        if not uri:
+            raise service_error(service_error.server_config, 
+                    "Unknown testbed: %s" % tb)
+
+	export_svcs = masters.get(tb,[])
+	import_svcs = [ s for m in masters.values() \
+		for s in m \
+		    if tb in s.importers ]
+
+	export_project = get_export_project(export_svcs)
+
+        # Tweak search order so that if there are entries in access_user that 
+	# have a project matching the export project, we try them first 
+	if export_project: 
+	    access_sequence = [ (p, u) for p, u in access_user \
+		    if p == export_project] 
+	    access_sequence.extend([(p, u) for p, u in access_user \
+		    if p != export_project]) 
+	else: 
+	    access_sequence = access_user 
+
+	for p, u in access_sequence: 
+            self.log.debug(("[get_access] Attempting access from (%s, %s) " + \
+                    "to %s") %  ((p or "None"), u, uri))
+
+            if p:
+                # Request with user and project specified
+                req = {\
+			'credential': [ "project: %s" % p, "user: %s"  % u],
+                    }
+            else:
+                # Request with only user specified
+                req = {\
+			'credential': [ 'user: %s' % u ],
+                    }
+
+	    # Make the service request from the services we're importing and
+	    # exporting.  Keep track of the export request ids so we can
+	    # collect the resulting info from the access response.
+	    e_keys = { }
+	    if import_svcs or export_svcs:
+		req['service'] = [ ]
+
+		for i, s in enumerate(import_svcs):
+		    idx = 'import%d' % i
+		    sr = {'id': idx, 'name': s.name, 'visibility': 'import' }
+		    if s.params:
+			sr['fedAttr'] = [ { 'attribute': k, 'value': v } \
+				for k, v in s.params.items()]
+		    req['service'].append(sr)
+
+		for i, s in enumerate(export_svcs):
+		    idx = 'export%d' % i
+		    e_keys[idx] = s
+		    sr = {'id': idx, 'name': s.name, 'visibility': 'export' }
+		    if s.params:
+			sr['fedAttr'] = [ { 'attribute': k, 'value': v } 
+				for k, v in s.params.items()]
+		    req['service'].append(sr)
+            try:
+                if self.local_access.has_key(uri):
+                    # Local access call
+                    req = { 'RequestAccessRequestBody' : req }
+                    r = self.local_access[uri].RequestAccess(req, 
+                            fedid(file=self.cert_file))
+                    r = { 'RequestAccessResponseBody' : r }
+                else:
+                    r = self.call_RequestAccess(uri, req, 
+                            self.cert_file, self.cert_pwd, self.trusted_certs)
+            except service_error, e:
+                if e.code == service_error.access:
+                    self.log.debug("[get_access] Access denied")
+                    r = None
+                    continue
+                else:
+                    raise e
+
+            if r.has_key('RequestAccessResponseBody'):
+                # Through to here we have a valid response, not a fault.
+                # Access denied is a fault, so something better or worse than
+                # access denied has happened.
+                r = r['RequestAccessResponseBody']
+                self.log.debug("[get_access] Access granted")
+                break
+            else:
+                raise service_error(service_error.protocol,
+                        "Bad proxy response")
+        
+        if not r:
+            raise service_error(service_error.access, 
+                    "Access denied by %s (%s)" % (tb, uri))
+
+	tbparam[tb] = { 
+		"allocID" : r['allocID'],
+		"uri": uri,
+		}
+
+	# Collect the responses corresponding to the services this testbed
+	# exports.  These will be the service requests that we will include in
+	# the start segment requests (with appropriate visibility values) to
+	# import and export the segments.
+	for s in r.get('service', []):
+	    id = s.get('id', None)
+	    if id and id in e_keys:
+		e_keys[id].reqs.append(s)
+
+	# Add attributes to parameter space.  We don't allow attributes to
+	# overlay any parameters already installed.
+	for a in r.get('fedAttr', []):
+	    try:
+		if a['attribute'] and \
+			isinstance(a['attribute'], basestring)\
+			and not tbparam[tb].has_key(a['attribute'].lower()):
+		    tbparam[tb][a['attribute'].lower()] = a['value']
+	    except KeyError:
+		self.log.error("Bad attribute in response: %s" % a)
+
+
+    def get_legacy_access_to_testbeds(self, testbeds, access_user, allocated, 
+	    tbparams, masters, tbmap):
+	"""
+	Request access to the various testbeds required for this instantiation
+	(passed in as testbeds).  User, access_user, expoert_project and master
+	are used to construct the correct requests.  Per-testbed parameters are
+	returned in tbparams.
+	"""
+	for tb in testbeds:
+	    self.get_access(tb, tbparams, access_user, masters, tbmap)
+	    allocated[tb] = 1
+
