Index: fedd/access_to_abac.py
===================================================================
--- fedd/access_to_abac.py	(revision b90c44de3c94a1ca48415a0aa1582578554a9f57)
+++ fedd/access_to_abac.py	(revision 6843d144b2c7abcb80649c8e635aff2a93441570)
@@ -69,37 +69,10 @@
 # attributes mapping and the global one creates the access policy credentials.
 
-#  All the local parsing functions get 
-#    * the unparsed remainder of the line in l.  This is everything on the
-#       input line from the first comma after the -> to the end of the line.
-#    * the current list of credentials to be issued.  This is a list of
-#      credential objects assigned from this principal (me) to principals
-#      making requests.  They are derived from the three-name and delegation
-#      credentials.  This routine adds any credentials that will be mapped to
-#      local access control information to creds.
-#    * me is this princpal - the access controller
-#    * to_id is a dict that maps the local name access control information into
-#      a list of credentials that imply the principal should be mapped to them.
-#      For example, parse_emulab is assigning (project, user, cert, key) to
-#      principals.  The key of to_id is that tuple and it maps to a list of
-#      ABAC attributes.  If an access controller wants to see if a caller can
-#      use a 4-tuple of credentials, it tries to prove that the caller has one
-#      of those attributes.
-#    * p is the principal that assigned the project and group.  It is the name
-#       of an external experiment controller.
-#    * gp is the group asserted by the experiment controller
-#    * gu is the user asserted by the experiment controller
-#    * lr is the linking role used for delegation.  If present credentials
-#    should be created with it.  If it is None the credential construator will
-#    ignore it.  It is hard to go wrong just passing it to the credential
-#    constructor.
-#
-# These functions map an assertion of (testbed, project, user) into the
-# local parameters (local project, password, etc.) that triple gives the caller
-# the caller to.  These local parameters are parsed out of l.  Those
-# credentials are the keys to the to_id dict that will become the abac map.
-# The c = credential... and creds.add(c)  lines
-# in parse_emulab can be taken as boilerplate for creating ABAC credentials.
-# Each ABAC credential created by that boilerplate should be added to to_id,
-# keyed by the local credentials.
+#  All the local parsing functions get the unparsed remainder of the line
+#  (after the three-name and the attribute it maps to), the credential list to
+#  add the new ABAC credential(s) that will be mapped into the local
+#  credentials, the fedid of this entity, a dict mapping the local credentials
+#  to ABAC credentials that are required to exercise those local rights and the
+#  three-name (p, gp, gu) that is being mapped.
 def parse_emulab(l, creds, me, to_id, p, gp, gu, lr):
     '''
@@ -207,5 +180,28 @@
     else:
 	raise parse_error("Badly formatted local mapping: %s" % l)
-
+def parse_starbed(l,creds,me, to_id,p,gp, gu, lr):
+	'''
+	Parse the starbed credientials
+	'''
+	right_side_str = '\s*,\s*\(\s*(%s)\s*,\s*(%s)\s*,\s*(%s)\s*\)' % \
+		(id_str,id_str,id_str)
+	m = re.match(right_side_str,l)
+	if m:
+		user,passwd,project = m.group(1,2,3)
+		if gp and gu:
+			a = 'project_%s_user_%s' % (gp, gu)
+		elif gp:
+			a = 'project_%s' % gp
+		elif gu:
+			 a = 'user_%s' % gu
+		else:
+			raise parse_error("No mapping for %s/%s!?" % (gp, gu))
+		c = credential(me, a, 
+			[attribute(p, x, lr) for x in (gp, gu) if x is not None])
+		creds.add(c)
+		if (user,passwd,project) in to_id: to_id[(user,passwd,project)].append(c)
+		else: to_id[(user,passwd,project)] = [ c ]
+	else:
+		raise parse_error("Badly formatted local mapping: %s" % l)	
 # internal plug-ins have no local attributes.
 def parse_internal(l, creds, me, to_id, p, gp, gu, lr): pass
@@ -263,4 +259,5 @@
 	    'skel': parse_skel,
 	    'protogeni': parse_protogeni,
+	    'starbed' : parse_starbed,
 	    }
 
Index: fedd/federation/emulab_segment.py
===================================================================
--- fedd/federation/emulab_segment.py	(revision b90c44de3c94a1ca48415a0aa1582578554a9f57)
+++ fedd/federation/emulab_segment.py	(revision 6843d144b2c7abcb80649c8e635aff2a93441570)
@@ -46,4 +46,10 @@
 
 	# Script the filesystem changes
+        
+	# Set umask to 007.  Since we are operating
+        # within /proj, we want to permit all proj users
+        # read and write.  This is especially necessary
+	# since creating directory hierarchy (mkdir -p).
+	print >>scriptfile, "umask 007"
 	print >>scriptfile, "/bin/rm -rf %s" % proj_dir
 	# Clear and create the software directory
