Index: fedd/fedd_to_abac.py
===================================================================
--- fedd/fedd_to_abac.py	(revision 547aa3b9b8fd95ca15f626fe93d5f87978d48c40)
+++ fedd/fedd_to_abac.py	(revision 725c55dbbc695aca2d5a5fd8a55113b262182405)
@@ -10,4 +10,6 @@
 from string import join
 from optparse import OptionParser
+
+from federation.util import abac_pem_type, abac_split_cert
 
 class Parser(OptionParser):
@@ -46,17 +48,12 @@
 parser = Parser()
 opts, args = parser.parse_args()
+cert, key = None, None
+delete_certs = False
 
-if any([ x is None for x in (opts.cert, opts.dir, opts.key)]):
-    print >>sys.stderr, "Need all of --dir, --cert, and --key to create certs"
-    print >>sys.stderr, "Reverting to debug mode"
-    debug = True
-else:
-    debug = opts.debug
 
-if opts.cert and not os.access(opts.cert, os.R_OK):
-    sys.exit('Cannot read %s (certificate file)' % opts.cert)
 
-if opts.key and not os.access(opts.key, os.R_OK):
-    sys.exit('Cannot read %s (key file)' % opts.key)
+if opts.key:
+    if os.access(opts.key, os.R_OK): key = opts.key
+    else: sys.exit('Cannot read %s (key file)' % opts.key)
 
 if opts.dir:
@@ -73,47 +70,68 @@
 	    sys.exit('%s is not writable' % opts.dir)
 
+if opts.cert:
+    if os.access(opts.cert, os.R_OK):
+	if not key:
+	    if abac_pem_type(opts.cert) == 'both':
+		key, cert = abac_split_cert(opts.cert)
+		delete_certs = True
+	else:
+	    cert = opts.cert
+    else:
+	sys.exit('Cannot read %s (certificate file)' % opts.cert)
+
+if any([ x is None for x in (cert, opts.dir, key)]):
+    print >>sys.stderr, "Need output dir, certificate and key to make creds"
+    print >>sys.stderr, "Reverting to debug mode"
+    debug = True
+else:
+    debug = opts.debug
 
 roles = { }
+try:
+    for fn in args:
+	try:
+	    f = open(fn, "r")
+	    for l in f:
+		id = None
+		for r in (comment_re, single_re, double_re):
+		    m = r.match(l)
+		    if m: 
+			if m.groups():
+			    g = m.groups()
+			    id = g[0]
+			    r = [ bad_role.sub('_', x) for x in g[1:] ]
+			break
+		else:
+		    print 'Unmatched line: %s' % l 
+		if id:
+		    # New and create are implicit.  >sigh<
+		    r.extend(('new', 'create'))
+		    if id in roles: roles[id].add_roles(r)
+		    else: roles[id] = identity(r[0], r)
 
-for fn in args:
-    try:
-	f = open(fn, "r")
-	for l in f:
-	    id = None
-	    for r in (comment_re, single_re, double_re):
-		m = r.match(l)
-		if m: 
-		    if m.groups():
-			g = m.groups()
-			id = g[0]
-			r = [ bad_role.sub('_', x) for x in g[1:] ]
-		    break
+	except EnvironmentError, e:
+	    print >>sys.stderr, 'Cannot open file (%s): %s' % \
+		    (e.filename, e.strerror)
+
+    if not roles:
+	print >>sys.stderr, "No roles found.  Did you specify a configuration?"
+
+    for k, id in roles.items():
+	for i, r in enumerate(id.roles):
+	    cmd = ['creddy', '--attribute', 
+		    '--issuer=%s' % (cert or 'cert_file'),
+		    '--key=%s' % (key or 'key_file'), '--role=%s' % r,
+		    '--subject-id=%s' % k,
+		    '--out=%s/%s%03d_attr.der' % \
+			    (opts.dir or 'new_cert_dir', id.name, i)]
+	    if debug:
+		print join(cmd)
 	    else:
-		print 'Unmatched line: %s' % l 
-	    if id:
-		# New and create are implicit.  >sigh<
-		r.extend(('new', 'create'))
-		if id in roles: roles[id].add_roles(r)
-		else: roles[id] = identity(r[0], r)
-
-    except EnvironmentError, e:
-	print >>sys.stderr, 'Cannot open file (%s): %e' % e
-
-if not roles:
-    print >>sys.stderr, "No roles found.  Did you specify a configuration?"
-
-for k, id in roles.items():
-    for i, r in enumerate(id.roles):
-	cmd = ['creddy', '--attribute', 
-		'--issuer=%s' % (opts.cert or 'cert_file'),
-		'--key=%s' % (opts.key or 'key_file'), '--role=%s' % r,
-		'--subject-id=%s' % k,
-		'--out=%s/%s%03d_attr.der' % \
-			(opts.dir or 'new_cert_dir', id.name, i)]
-	if debug:
-	    print join(cmd)
-	else:
-	    rv =  subprocess.call(cmd)
-	    if rv != 0:
-		sys.exit('%s failed: %d' % (join(cmd), rv))
-
+		rv =  subprocess.call(cmd)
+		if rv != 0:
+		    sys.exit('%s failed: %d' % (join(cmd), rv))
+finally:
+    if delete_certs:
+	if cert: os.unlink(cert)
+	if key: os.unlink(key)
