Index: fedd/abac-src/ttg/credential/Application.java
===================================================================
--- fedd/abac-src/ttg/credential/Application.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/Application.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,249 @@
+package com.nailabs.abac.credential;
+
+import java.io.*;
+import java.util.*;
+import java.security.*;
+import org.w3c.dom.*;
+
+import org.apache.xml.security.utils.XMLUtils;
+
+/**
+ * Generic command-line processing necessary for signing credentials and 
+ * marking adsd's with hash digests. Portions borrowed from <a href=
+ * "http://isrl.cs.byu.edu">ISRL</a> researcher, Michael Halcrow.
+ */
+public class Application {
+    /** the keystore type is "JKS" by default */
+    private static String KEYSTORE = "JKS";
+    /** 
+     * the command line arguments are not directly accessible to desecents 
+     * but may be accessed using the <CODE>flagExists()</CODE> and 
+     * <CODE>flagValue()</CODE> methods.
+     */
+    private String argv[] = null;
+
+    //
+    // Shared application fields
+    //
+    /** flag for compiling in the debugging routines */
+    protected static boolean DEBUG = true;
+    /** the application name, which should be supplied by descendents */
+    protected String name = "foobar";
+    /** parsed XML document in a DOM-structured tree */
+    protected Document doc;
+    protected Element docElement;
+    /** output stream defaults to standard output */
+    protected PrintStream out = System.out;
+
+    //
+    // Shared commmand line option fields
+    //
+    /** the XML input file */
+    protected File inXML;
+    /** the XML output file */
+    protected File outXML;
+    /** the keystore containing key material default instance JKS */
+    protected KeyStore keyStore;
+    /** the file name and path of the serialize keystore */
+    protected String keys = null;
+    /** password for keystore. <EMP>this is a BAD security practice</EMP> */
+    protected String password = null;
+    /** the alias of the signing/verifying key, if any */
+    protected String alias = null;
+    /** include transform information in XML */
+    protected boolean includeTransform = false;
+    /** include certificate in XML signature */
+    protected boolean includeCert = true;
+    /** a boolean for whether to include comments */
+    protected boolean noComments = false;
+
+    static {
+	org.apache.xml.security.Init.init();
+    }
+
+    public Application(String argv[]) {
+	this.argv = argv;
+    }
+
+    /** 
+     * command line parsing method, which searches for two choices (e.g. 
+     * <pre>flagValue("-h", "--help")</pre>)
+     * @param firstChoice the command line option search term
+     * @param secondChoice the command line option search term
+     * @returns the next string in argument list from specified flag or null
+     */
+    protected String flagValue( String firstChoice, String secondChoice ) {
+	String toReturn;
+	if( ( toReturn = flagValue( firstChoice ) ) == null )
+	    return flagValue( secondChoice );
+	else
+	    return toReturn;
+    }
+
+    /** 
+     * search the command line arguments for the specified flag 
+     * @param flag the command line option search term
+     * @returns the next string in argument list from specified flag or null
+     */
+    protected String flagValue( String flag ) {
+	for( int x = 0; x < argv.length; x++ ) {
+	    if( argv[x].equals( flag ) ) {
+		try {
+		    return argv[x+1];
+		} catch( Exception e ) {
+		    return null;
+		}
+	    }
+	}
+	return null;
+    }
+
+    /** 
+     * search command line arguments for a boolean argument.
+     * @param firstChoice usually the single dash and character form 
+     * @param secondChoice usually a GNU double dashed argument
+     * @returns true if found, false is absent
+     */
+    private boolean flagExists( String firstChoice, String secondChoice ) {
+	boolean toReturn;
+	if( flagExists( firstChoice ) )
+	    return true;
+	else
+	    return flagExists( secondChoice );
+    }
+
+    /** 
+     * search the command line argument for the specified boolean argument.
+     * @param flag the search term
+     * @returns true if found, false if not found
+     */
+    private boolean flagExists( String flag ) {
+	for( int x = 0; x < argv.length; x++ ) {
+	    if( argv[ x ].equals( flag ) ) {
+		return true;
+	    }
+	}
+	return false;
+    }
+
+    /** convenience method for constructing a file and catching exceptions */
+    private File getFile(String path) {
+	try {
+	    return new File(path);
+	} catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+	return null;
+    }
+
+    /**
+     * a generic parsing method for parsing the command line options.
+     */
+    protected void parseParameters() {
+	String inName, outName, keystore;
+
+	if( flagExists( "-h", "--help" ) ) {
+	    out.print(name);
+	    out.println(" [options]");
+	    out.println("Options:");
+	    out.print("\t-i, --input file");
+	    out.println("\tInput XML document." );
+	    out.print("\t-o, --output file");
+	    out.println("\tOutput XML document." );
+	    out.print("\t-nc, --no-comments");
+	    out.println("\tDo not include comments in the digest.");
+	    out.print("\t-nt, --notransform");
+	    out.println("\tDo not include transform in signature." );
+	    out.print("\t-c, --includeCert");
+	    out.println("\tInclude the signing certificate in signature" );
+	    out.print("\t-i, --input file");
+	    out.println("\tInput XML document." );
+	    out.print("\t-k, --keystore file");
+	    out.println("\tKey store containing the keys to sign/verify" );
+	    out.print("\t-a, --alias");
+	    out.println("\t\tthe key store alias of the signator" );
+	    out.println();
+	    System.exit(0);
+	}
+	// grab the input file
+	if((inName = flagValue("-i", "--input" )) == null) { 
+	    inName = "in.xml"; 
+	}
+	inXML = getFile(inName);
+	// grab the output file
+	if((outName = flagValue("-o", "--output")) == null) {
+	    outName = "out.xml.xml";
+	}
+	outXML = getFile(outName);
+	// grab the password for the command line, if any
+	if((password = flagValue("-p","--password")) == null) {
+	    password = "rtml";
+	}
+	// load the keystore
+	if((keys = flagValue("-k", "--keystore")) == null) {
+	    keys = "keystore.jks";
+	}
+
+	// grab the alias from the command line 
+	if((alias = flagValue("-a","--alias")) == null) {
+	    alias = "rtml";
+	}
+	includeCert = (flagExists( "-c", "--include-certs"))? true: false;
+	noComments  = (flagExists( "-nc", "--no-comments"))? true: false;
+	includeTransform = (flagExists( "-nt", "--no-transform"))? true: false;
+    }
+
+    /** 
+     * loads the keystore from a file, if specified. This method may be 
+     * overridden in sub-classes.
+     */
+    protected void getKeys() {
+	if(keys != null) {
+	    try {
+		if( DEBUG ) {
+		    System.out.println( "Loading keystore from " + keys);
+		}
+		FileInputStream fis = new FileInputStream(keys);
+		keyStore = KeyStore.getInstance("JKS");
+		keyStore.load( fis, password.toCharArray() );
+	    } catch( Exception e ) {
+		e.printStackTrace();
+		keyStore = null;
+	    }
+	}
+    }
+    
+    /** parse a file into a DOM object */
+    protected void readDoc() {
+	javax.xml.parsers.DocumentBuilderFactory dbf =
+	    javax.xml.parsers.DocumentBuilderFactory.newInstance();
+	dbf.setNamespaceAware(true);
+	try {
+	    javax.xml.parsers.DocumentBuilder db = dbf.newDocumentBuilder();
+	    try {
+		doc = db.parse(inXML);
+		docElement = doc.getDocumentElement();
+	    } catch( org.xml.sax.SAXException saxe ) {
+		saxe.printStackTrace();
+	    } catch( java.io.IOException ioe ) {
+		ioe.printStackTrace();
+	    }
+	} catch(javax.xml.parsers.ParserConfigurationException pce) {
+	    pce.printStackTrace();
+	}
+    }
+
+    /** write the dom object tree into an XML formatted file */
+    protected void writeDoc() {
+	try {
+	    FileOutputStream fos = new FileOutputStream(outXML);
+	    XMLUtils.outputDOMc14nWithComments(docElement,fos);
+	    fos.close();
+	} catch( java.io.FileNotFoundException fnfe ) {
+	    fnfe.printStackTrace();
+	} catch( java.io.IOException ioe ) {
+	    ioe.printStackTrace();
+	}
+    }
+
+}
Index: fedd/abac-src/ttg/credential/CVS/Entries
===================================================================
--- fedd/abac-src/ttg/credential/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,11 @@
+/Application.java/1.1/Wed Mar 19 02:35:23 2003//
+/DDEngine.java/1.6/Sat Aug  9 00:46:49 2003//
+/DiscoveryService.java/1.11/Fri Jul 18 23:42:43 2003//
+/RtmlCredential.java/1.7/Wed Apr  9 00:12:36 2003//
+/RtmlEngine.java/1.16/Wed Jul 16 00:07:45 2003//
+/RtmlEntity.java/1.8/Thu Jul 10 00:38:30 2003//
+/RtmlExpression.java/1.5/Thu Jul 10 00:38:30 2003//
+/RtmlFrontier.java/1.8/Thu Jul 10 00:38:30 2003//
+/SignCredential.java/1.1/Wed Mar 19 02:35:23 2003//
+/SignDomain.java/1.1/Wed Mar 19 02:35:23 2003//
+D
Index: fedd/abac-src/ttg/credential/CVS/Repository
===================================================================
--- fedd/abac-src/ttg/credential/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+ttg/credential
Index: fedd/abac-src/ttg/credential/CVS/Root
===================================================================
--- fedd/abac-src/ttg/credential/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+:ext:jjacobs@src.columbia.sparta.com/cvs/abac
Index: fedd/abac-src/ttg/credential/DDEngine.java
===================================================================
--- fedd/abac-src/ttg/credential/DDEngine.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/DDEngine.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,238 @@
+package com.nailabs.abac.credential;
+
+import com.nailabs.abac.test.RtmlTest;
+
+import edu.stanford.rt.credential.CredentialDomain;
+import edu.stanford.rt.credential.CredentialStore;
+import edu.stanford.rt.credential.HashID;
+import edu.stanford.rt.credential.RTContext;
+
+import edu.stanford.rt.parser.*;
+import edu.stanford.peer.rbtm.credential.*;
+import edu.stanford.peer.rbtm.util.ResultEvidenceMap;
+
+import java.io.*;
+import java.net.*;
+import java.util.*;
+
+/**
+ * A distributed discovery engine based on the RTML-aware GraphEngine. 
+ */
+public class DDEngine extends RtmlEngine {
+
+    protected RTParser parser;
+
+    protected RTContext context;
+
+    protected Properties lookupMap = new Properties();
+
+    static String PORT_PROPERTY = "com.nailabs.abac.discovery.port";
+
+    /**
+     * The default constructor grabs parameters from the configuration 
+     * HashMap, including [Parser] and [PrepInfo] sections. 
+     */
+    public DDEngine(HashMap config) {
+	super();
+	parser = (RTParser)config.get("DDEParser");
+	context = (RTContext)config.get("DDEContext");
+	lookupMap = (Properties)config.get("PrepInfo");
+	store = (CredentialStore)config.get("DDEStore");
+	try {
+	    if(context == null) {
+			  context = new RTContext(parser);
+	    }
+	    if(store == null) {
+			  store = (CredentialStore)config.get("CredentialStore");
+	    }
+	    if(store == null) {	    
+			  store = new CredentialStore(parser);
+	    }
+	} catch (Exception ex) {
+	    ex.printStackTrace();
+	}
+    }
+
+    protected URL createURL(String host, String operation, String expression) {
+	StringBuffer buff = new StringBuffer("http://");
+	buff.append(host).append("?");
+	buff.append(operation).append("=").append(expression);
+	try {
+	    System.out.println("Constructing url = " + buff);
+	    return new URL(buff.toString());
+	}
+	catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+	return null;
+    }
+
+
+    protected Vector parseOutput(URL url) {
+	Vector documents = new Vector();
+	StringWriter out = null;
+
+	try {
+	    URLConnection connection = url.openConnection();
+	    InputStream in = connection.getInputStream();
+	    BufferedReader buffedReader
+		= new BufferedReader(new InputStreamReader(in));
+	    out = new StringWriter();
+	    // grab the first line so we don't have an empty vector item
+	    out.write(buffedReader.readLine());
+	    while(true) {
+		String line = buffedReader.readLine();
+		if(line == null)break;
+		if(line.startsWith("<?xml")) {
+		    documents.add(out.getBuffer().toString());
+		    out = new StringWriter();
+		}
+		out.write(line);
+		out.write("\n");
+	    }
+	    
+	} catch(Exception ex) {
+	    //ex.printStackTrace();
+	}
+	if(out != null) {
+	    documents.add(out.getBuffer().toString());
+	}
+	for(int cnt = 0; cnt < documents.size(); cnt++) {
+	    try {
+		String xml = (String)documents.get(cnt);
+		if(xml.equals("null")) {
+		    documents.remove(cnt--);
+		    continue;
+		}
+		System.out.println("---------begin xml-------");
+		System.out.println(xml);
+		System.out.println("----------end xml--------");
+		InputStream in = new ByteArrayInputStream(xml.getBytes());
+		documents.set
+		    (cnt, (Object) parser.parseCredentialDomain(in,context));
+	    } catch(Exception ex) {
+		ex.printStackTrace();
+		documents.remove(cnt--);
+	    }
+	}
+	return documents;
+    }
+
+    protected String getLocation(EntityExpression expr) {
+	String base;
+	
+        if(expr instanceof Entity) {
+	    base = expr.toString();
+	} else if(expr instanceof edu.stanford.peer.rbtm.credential.Role) {
+	    base = 
+	  ((edu.stanford.peer.rbtm.credential.Role)expr).getBase().toString();
+	} else if(expr instanceof edu.stanford.peer.rbtm.credential.LinkedRole)
+	    {
+	    base = ((edu.stanford.peer.rbtm.credential.LinkedRole)expr).getFirstRole().getBase().toString();
+	} else if(expr instanceof Intersection) {
+	    base = getLocation((EntityExpression)
+			       ((Intersection)expr).getParts().next());
+	} else {
+	    base = new String();
+	}
+	System.out.println("getting url for " + base);
+	return lookupMap.getProperty(base);
+    }
+
+    protected Vector discover(String operation, EntityExpression expr) {
+	URL url = createURL(getLocation(expr), operation, 
+		      RtmlExpression.toString(expr));
+	Vector v = parseOutput(url);
+	Vector results = new Vector(v.size());
+	Iterator domains = v.iterator();
+	while(domains.hasNext()) {
+	    CredentialDomain domain = (CredentialDomain)domains.next();
+	    HashID hash = domain.getHashID();
+	    try {
+		addDomain(domain);	
+		Iterator creds = RtmlEngine.convert(domain).iterator();
+		while(creds.hasNext()) {
+		    RtmlCredential cred = (RtmlCredential)creds.next();
+		    results.add(cred);
+		    System.out.println("-----+Adding " + cred);
+		}
+	    } catch(Exception ex) {
+		System.err.println("Error with credential domain " +
+				   domain.getHashID());
+		ex.printStackTrace();
+	    }
+	}
+	return results;
+    }
+
+    synchronized public Iterator 
+    findCredentialsDefiningRole(edu.stanford.peer.rbtm.credential.Role r) {
+	return discover("Defines", r).iterator();
+    }
+
+    synchronized public Collection getCredentialsIssuedBy(Entity e) {
+	return discover("Issuer", e);
+    }
+
+    synchronized public Iterator findCredentialsBySubject(EntityExpression s) {
+	return discover("Subject", s).iterator();
+    }
+
+    public static void main(String[] args) {
+	if(System.getProperty("edu.stanford.rt.SystemDomain") == null) {
+	    System.setProperty("edu.stanford.rt.SystemDomain",
+			       "../rtml/schemas/SystemSpec.xml");
+	}
+	HashMap conf = new HashMap(6);
+	Properties prepInfo = new Properties();
+	prepInfo.setProperty("SE", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/se-discovery");
+	prepInfo.setProperty("SAdmir!FakeHashKeySAdmir", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/se-discovery");
+	prepInfo.setProperty("US", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/us-discovery");
+	prepInfo.setProperty("USEUCOM", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/us-discovery");
+	prepInfo.setProperty("USSH!FakeHashKeyUSSH", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/us-discovery");
+	prepInfo.setProperty("USN", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/us-discovery");
+	prepInfo.setProperty("RADMSmith", 
+								"wwinsbor1.rv.nailabs.com:8180/demo/us-discovery");
+	conf.put("PrepInfo", prepInfo);
+	Properties rtml = new Properties(System.getProperties());
+	if(rtml.getProperty("DDEStore") == null) {
+	    rtml.setProperty("DDEStore", "test/rtml/dde-client.xml");
+	}
+	conf.put("RTML", rtml);
+	RtmlTest.parseDiscoveryStore(conf);
+	try {
+	    DDEngine engine = new DDEngine(conf);
+	    ResultEvidenceMap map = (ResultEvidenceMap)
+			  engine.backwardSearch(new Role("SAdmir!FakeHashKeySAdmir",
+														"getsSLocs"));
+	    Collection v = map.resultSet();
+	    for(Iterator i = v.iterator(); i.hasNext(); ) {
+			  System.out.println("--------------------");
+			  Object result = i.next();
+			  System.out.println(result.toString());
+			  System.out.println(map.getResultEvidence(result).toString());
+	    }
+		 System.out.println("--------------------");
+		 map = (ResultEvidenceMap)
+			  engine.forwardSearch(new SimpleEntity("USSH!FakeHashKeyUSSH"));
+		 //engine.forwardSearch(new SimpleEntity("SAdmir!FakeHashKeySAdmir"));
+		 //engine.forwardSearch(new Role("US!FakeHashKeyUS","usr"));
+
+	    v = map.resultSet();
+	    for(Iterator i = v.iterator(); i.hasNext(); ) {
+			  System.out.println("--------------------");
+			  Object result = i.next();
+			  System.out.println(result.toString());
+			  System.out.println(map.getResultEvidence(result).toString());
+	    }
+	} catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+    }
+}
Index: fedd/abac-src/ttg/credential/DiscoveryService.java
===================================================================
--- fedd/abac-src/ttg/credential/DiscoveryService.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/DiscoveryService.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,175 @@
+package com.nailabs.abac.credential;
+
+import java.io.*;
+import java.util.*;
+import edu.stanford.peer.rbtm.credential.*;
+import edu.stanford.peer.rbtm.engine.*;
+import edu.stanford.peer.rbtm.util.*;
+import edu.stanford.rt.parser.*;
+import edu.stanford.rt.credential.*;
+ 
+/** 
+ * A service object which encapsulates the functions of a CredentialManager
+ * that are necessary for remote and local discovery.
+ */
+public class DiscoveryService {
+    /** The graphine which performs the actual searches */
+    protected RtmlEngine engine;
+    /** An RTML parser which can be shared for all discovery services */
+    protected static RTParser parser = null;
+    /** AN RTML context which can be shared across all discovery services */
+    protected static RTContext context = null;
+
+    static {
+	try {
+	    parser = new RTParser();
+	    context = new RTContext(parser);
+	} catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+    }
+
+    /** Default constructor */
+    public DiscoveryService(String storeFile) {
+	try {
+	    parser = new RTParser();
+	    context = new RTContext(parser);
+	    CredentialStore store = new CredentialStore(parser);
+	    parser.parseCredentialStore
+		(new FileInputStream(new File(storeFile)), context, store);
+	    this.engine = new RtmlEngine(store);
+	} catch (Exception ex) {
+	    //ex.printStackTrace();
+	}
+    }
+
+    /** 
+     * For each result in the map, match the RTML for the domain of the 
+     * rtml credential.
+     */
+    protected String[] soapify(ResultEvidenceMap map) {
+	Object results[] = map.resultSet().toArray();
+	int max = results.length;
+	String[] evidence = new String[max];
+	for(int i = 0; i < max; i++) {
+	    Object obj = map.getResultEvidence(results[i]);
+	    if(obj instanceof RtmlCredential) {
+		RtmlCredential cred = (RtmlCredential)obj;
+		evidence[i] = cred.toXML();
+	    } else {
+		evidence[i] = results[i] + " -" + obj.toString();
+	    }
+	}
+	return evidence;
+    }
+
+    /**
+     * Convert a collection of <CODE>RTMLCredential</CODE> instances into a 
+     * set of their <CODE>CredentialDomain</CODE> instances.
+     */
+    protected String[] soapify(Collection c) {
+	//String[] credentials = new String[c.size()];
+	HashSet credentials = new HashSet(c.size());
+	Iterator results = c.iterator();
+	String output[];
+	int i = 0;
+	
+	while(results.hasNext()) {
+	    Object obj = results.next();
+	    if(obj instanceof RtmlCredential) {
+		RtmlCredential cred = (RtmlCredential)obj;
+		//credentials[i++] = cred.toXML();
+		credentials.add(cred.toXML());
+	    } else {
+		//credentials[i++] = obj.toString();
+		credentials.add(obj.toString());
+	    }
+	}
+	output = new String[credentials.size()];
+	results = credentials.iterator(); 
+	for(i = 0; results.hasNext(); i++) {
+	    output[i] = results.next().toString();
+	}
+	return output;
+    }
+
+    /**
+     * For a specified entity name, return all <code>CredentialDomain</code>
+     * instances which were issued by the entity.
+     */
+    public String[] getCredentialsIssuedBy(String entityName) {
+	Entity e = new RtmlEntity(entityName);
+	return soapify(engine.getCredentialsIssuedBy(e));
+	//return soapify(engine.backwardSearch(e));
+    }
+
+    /**
+     * For the specified role, return all <code>CredentialDomain</code> 
+     * instances which define the specified role (entity.role).
+     */
+    public String[] findCredentialsDefiningRole(String entity, String role) {
+	Entity e = new RtmlEntity(entity);
+	edu.stanford.peer.rbtm.credential.Role r = 
+	    new edu.stanford.peer.rbtm.credential.Role(e, role);
+	Iterator results = engine.findCredentialsDefiningRole(r);
+        HashSet evidence = new HashSet();
+	StringBuffer buff = new StringBuffer("DefiningRole(");
+	buff.append(entity).append(".").append(role).append(") = ");
+        while(results.hasNext()) {
+	    Object result = results.next();
+	    //System.out.println("def result = " + result);
+	    buff.append(result.toString()).append(" ");
+	    evidence.add(result);
+        }
+	System.out.println(buff.toString());
+	return soapify(evidence);
+    }
+
+    /**
+     * For a given entity expression, find the <code>CredentialDomain</code>
+     * instances which define credentials that have the entity expression as 
+     * a subject.
+     */
+    public String[] findCredentialsBySubject(String expr) {
+	EntityExpression ee = null;
+	try {
+	    ee = StaticCredential.getEntityExpression(expr);
+	    ee = RtmlExpression.convert(ee);
+	} catch (Exception cpe) {
+	    cpe.printStackTrace();
+	}
+	Iterator results = engine.findCredentialsBySubject(ee);
+	HashSet evidence = new HashSet();
+	StringBuffer buff = new StringBuffer("BySubject(");
+	buff.append(expr).append(") = ");
+	while(results.hasNext()) {
+	    Object result = results.next();
+	    //System.out.println("subj result = " + result);
+	    buff.append(result).append(" ");
+	    if(!evidence.contains(result)) {
+		evidence.add(result);
+	    }
+	}
+	System.out.println(buff.toString());
+	return soapify(evidence);
+    }
+
+    /**
+     * Add a new <code>CredentialDomain</code> to the underlying 
+     * <code>CredentialStore</code>.
+     * @param xml an xml block which defined a <code>CredentialDomain</code>
+     */
+    public void addCredentialDomain(String xml) {
+	try {
+	    InputStream in = new ByteArrayInputStream(xml.getBytes());
+	    CredentialDomain domain = 
+		parser.parseCredentialDomain(in, context);
+	    synchronized(engine) {
+		engine.addDomain(domain);
+	    }
+	} catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+    }
+
+}
Index: fedd/abac-src/ttg/credential/RtmlCredential.java
===================================================================
--- fedd/abac-src/ttg/credential/RtmlCredential.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/RtmlCredential.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,114 @@
+package com.nailabs.abac.credential;
+
+import com.nailabs.abac.test.Debug;
+import edu.stanford.peer.rbtm.credential.*;
+import edu.stanford.rt.credential.CredentialDomain;
+import org.w3c.dom.*;
+import org.xml.sax.*;
+
+// imports for loading xml documents BEGIN
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.DocumentBuilder;
+
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerConfigurationException;
+
+import javax.xml.transform.dom.DOMSource; 
+import javax.xml.transform.stream.StreamResult; 
+
+import java.io.*;
+// imports for loading xml documents END
+
+
+/** 
+ * A credential which can handle XML persistent representations of RTML
+ * credentials. 
+ */
+public class RtmlCredential extends StaticCredential {
+    /** 
+     * the domain for this credential. note: a domain may contain multiple
+     * credentials.
+     */
+    protected transient CredentialDomain credDomain;
+    
+    /**
+     * constructor for an unparsed credential that is part of a domain.
+     */
+    public RtmlCredential(String cred, CredentialDomain domain)
+        throws CredentialParsingException {
+        super(cred);
+        credDomain = domain;
+    }
+
+    /**
+     * parsed  constructor for a static credential that is part of a domain 
+     */
+    public RtmlCredential(Role l, EntityExpression r, CredentialDomain domain){
+        super(l, r);
+        credDomain = domain;
+    }
+
+    /** public accessor for the credential domain */
+    public CredentialDomain getCredentialDomain() {
+        return credDomain;
+    }   
+
+    /** convert the DOM from the credential domain into XML */
+    public String toXML() { 
+        ByteArrayOutputStream bytesOut = new ByteArrayOutputStream();
+        PrintStream out = new PrintStream(bytesOut);
+        try {
+            // Use a Transformer for output
+            TransformerFactory tFactory = TransformerFactory.newInstance();
+            Transformer transformer = tFactory.newTransformer();
+            DOMSource source = 
+                new DOMSource(credDomain.getCredentialElement());
+            StreamResult result = new StreamResult(out);
+            transformer.transform(source, result);
+        }
+        catch (Exception ex) {
+            // Error generated by the parser
+            System.out.println ("* Transformation error");
+            System.out.println("  " + ex.getMessage() );
+            // Use the contained exception, if any
+            //Throwable x = (ex.getException() != null)? ex.getException(): ex;
+            //x.printStackTrace();
+        }
+        return bytesOut.toString();
+    }
+
+
+    /** a utility method for loading an xml credential */
+    public static org.w3c.dom.Element getDomElement(String xml) {
+        ByteArrayInputStream bias =  new ByteArrayInputStream(xml.getBytes());
+        DocumentBuilderFactory factory =
+            DocumentBuilderFactory.newInstance();
+        Document document = null;
+
+        try {
+            DocumentBuilder builder = factory.newDocumentBuilder();
+             document = builder.parse(bias);
+        }
+        catch (Exception ex) {
+            // Error generated by the parser
+            System.out.println ("* Document loading error");
+            System.out.println("  " + ex.getMessage() );
+            
+        } 
+        NodeList list = document.getElementsByTagName("Credential");
+        for(int i = 0; i < list.getLength(); i++) {
+            Node cNode = list.item(i);
+            Debug.debug("rtml", "cNode = " + cNode.getNodeName());
+            if(cNode instanceof Element) {
+                return (Element)cNode;
+            }
+        }
+        return null;
+    }
+
+}
+
+
+
Index: fedd/abac-src/ttg/credential/RtmlEngine.java
===================================================================
--- fedd/abac-src/ttg/credential/RtmlEngine.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/RtmlEngine.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,162 @@
+package com.nailabs.abac.credential;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.util.Iterator;
+import java.util.HashSet;
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Collection;
+import java.security.PublicKey;
+import edu.stanford.peer.rbtm.util.Predicate;
+import edu.stanford.peer.rbtm.credential.Entity;
+import edu.stanford.peer.rbtm.credential.EntityExpression;
+import edu.stanford.peer.rbtm.credential.Role;
+import edu.stanford.peer.rbtm.credential.RoleName;
+import edu.stanford.peer.rbtm.credential.SimpleEntity;
+import edu.stanford.peer.rbtm.credential.LinkedRole;
+import edu.stanford.peer.rbtm.credential.StaticCredential;
+
+import edu.stanford.peer.rbtm.engine.*;
+
+import edu.stanford.rt.credential.*;
+import edu.stanford.rt.parser.RTParser;
+
+/**
+ * An RTML-aware GraphEngine, formerly known as CredentialManager.
+ */
+public class RtmlEngine extends GraphEngine  {
+    /** internal store of parsed RTML */
+    protected CredentialStore store;
+
+    /** static credential to credential domain mapping */
+    protected HashMap indexByDomains = new HashMap();
+
+    /** internal cache of entity hash id to short name mapping */
+    private static Hashtable entityCache = new Hashtable(10); 
+
+    public RtmlEngine() {
+	super();
+    }
+
+    /** default constructor used for the opponents transmitted credentials*/
+    public RtmlEngine(CredentialStore store) {
+        super();
+        this.store = store;
+        importDomains(store);
+    }
+
+    /** predicated constructor used by oppo, sens, and simp frontiers */
+    public RtmlEngine(CredentialStore store, Predicate p) {
+        super(p);
+        this.store = store;
+        importDomains(store);
+    }
+
+    /** convenience method for looking up a shortname from a credential hash */
+    public static String getShortName(String hash) { 
+        return (String)entityCache.get(hash);
+    }
+
+    /** adds a new entity hash to short name (reverse) mapping */
+    public static void addEntity(String hash, String shortName) {
+        entityCache.put(hash, shortName);
+    }
+
+    /** add the static credentials which make up a credential domain */
+    public void addDomain(CredentialDomain domain) {
+        Iterator creds = convert(domain).iterator();
+	try{
+	    while(creds.hasNext()) {
+		StaticCredential cred = (StaticCredential)creds.next();
+		HashSet siblings = (HashSet)indexByDomains.get(domain);
+		//System.out.println("Adding " + cred);
+		addCredential(cred);
+		if(siblings == null) {
+		    siblings = new HashSet(1);
+		    indexByDomains.put(domain, siblings);
+		}
+		siblings.add(cred);
+	    }
+	    store.addCredentialDomain(domain.getHashID(), domain);
+	} catch(Exception ex) {
+	    //ex.printStackTrace();
+	}
+    }
+    
+    /** 
+     * removes a the domain for this credential and any othe credentials in 
+     * the same domain.
+     */
+    public void removeCredential(RtmlCredential cred) {
+	CredentialDomain domain = cred.getCredentialDomain();
+	HashSet credSet = (HashSet)indexByDomains.get(domain);
+	if(credSet != null) {
+	    super.removeCredentials((Collection)credSet);
+	}	
+    }
+
+    /** protected accessor method used for importing a set of cred domains */
+    protected CredentialStore getCredentialStore() {
+	return store;
+    }
+
+    /** importing domains is used publicly for credential discovery */
+    public void importDomains(RtmlEngine engine) {
+	importDomains(engine.getCredentialStore());
+    }
+
+    /** internal method for loading the engine from a credential store */
+    public void importDomains(CredentialStore store) {
+        HashMap domains = store.getCredentialDomains();
+        Iterator i = domains.values().iterator();
+        while(i.hasNext()) {
+	    //System.out.println("domain = " + i.next().getClass());
+            addDomain((CredentialDomain)i.next());
+        }
+    }
+    
+
+    /** convert a credential domain into a set of static credentials */
+    public static Collection convert(CredentialDomain domain) {
+        HashSet set = new HashSet();
+        Iterator roles = domain.roleDefinitionIterator();
+        int count = 0;
+        while(roles.hasNext()) {
+            //System.out.println("Role Definition # " + ++count);
+            RoleDefinition def = (RoleDefinition)roles.next();
+            Role head = (Role)
+                RtmlExpression.convert(def.getHead(), domain);
+            EntityExpression body = 
+                RtmlExpression.convert(def.getBody(), domain);
+            StaticCredential cred = new RtmlCredential(head, body, domain);
+            //System.out.println("\tcred = " + cred);
+            set.add(cred);
+        }
+        return set;
+    }
+
+    /** main method for a test application */
+    public static void main(String argv[]) {
+        if(argv.length < 1) {
+            System.out.println("java com.nailabs.abac.credential.RtmlCredential  cred_store.xml");
+            System.exit(1);
+        }
+        try {
+            RTParser parser = new RTParser();
+            //System domain is created here.
+            RTContext context = new RTContext(parser);
+            CredentialStore store = new CredentialStore(parser);
+
+            parser.parseCredentialStore(new FileInputStream(new File(argv[0])),
+                                        context, store);
+            CredentialDomain domain = 
+                store.getCredentialDomain(System.getProperty(
+                  "com.nailabs.abac.credential.Hash", "FakeHashCredential01"));
+            convert(domain);
+        } catch(Exception ex) {
+            ex.printStackTrace();
+        }
+    }
+
+}
Index: fedd/abac-src/ttg/credential/RtmlEntity.java
===================================================================
--- fedd/abac-src/ttg/credential/RtmlEntity.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/RtmlEntity.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,68 @@
+package com.nailabs.abac.credential;
+
+import edu.stanford.peer.rbtm.credential.*;
+import edu.stanford.rt.credential.Principal;
+
+/**
+ * A hybrid entity instance which is RTML aware but can also emulate a simple
+ * entity used by the RBTM package.
+ */
+public class RtmlEntity implements Entity {
+    //The entity will have either a key OR a value but not both
+    /** a base-64 encoded hash of the entity's key material */
+    protected String hashCode = null;
+
+    /** a short name used in the RTML to refer back to a Principal */
+    protected String shortName = null;
+
+    /** constructor for discovery service */
+    public RtmlEntity(String shortName) {
+	this.shortName = shortName;
+    }
+
+    public RtmlEntity(String shortName, String hashCode) {
+	this.shortName = shortName;
+	this.hashCode = hashCode;
+    }
+
+    /** default constructor */
+    public RtmlEntity(String shortName, Principal principal) {
+        this.shortName = shortName;
+        hashCode = principal.toString();
+    }
+
+    /** public accessor method for the abbreviated name of an entity */
+    public String getName() { return shortName; }
+
+    /** public accessor method for the BASE-64 encoded signature hash */
+    public String getHash() { return hashCode; }
+
+    /** public accessor method for the hash code of an entity's key material */
+    public int hashCode() { 
+	if(hashCode == null) {
+	    return shortName.hashCode();
+	}
+	return hashCode.hashCode(); 
+    }
+
+    /** 
+     * equivalency should be based on identical hash codes (but potentially
+     * short names may be desired).
+     */
+    public boolean equals(Object o) {
+	// warning this is allows an RtmlEntity to be matched by EITHER
+	// the hash or the short name. It should probably only be the hash.
+	// The RtmlEngine may need to make sure entities have proper hash
+	// codes.
+	return(o.hashCode()==hashCode() || o.hashCode()==shortName.hashCode());
+    }
+    
+    /** compare to entities based on their unique hash codes */
+    public int compareTo(Object obj) {
+        return obj.hashCode() - hashCode();
+    }
+
+    /** returns the entity's unique hash code as a string */
+    public String toString() { return shortName; }
+
+}
Index: fedd/abac-src/ttg/credential/RtmlExpression.java
===================================================================
--- fedd/abac-src/ttg/credential/RtmlExpression.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/RtmlExpression.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,172 @@
+package com.nailabs.abac.credential;
+
+import java.util.Iterator;
+import java.util.StringTokenizer;
+import edu.stanford.peer.rbtm.credential.Entity;
+import edu.stanford.peer.rbtm.credential.EntityExpression;
+import edu.stanford.peer.rbtm.credential.StaticCredential;
+import edu.stanford.peer.rbtm.credential.Role;
+import edu.stanford.peer.rbtm.credential.LinkedRole;
+import edu.stanford.peer.rbtm.credential.Intersection;
+import edu.stanford.rt.credential.*;
+
+/**
+ * An enitty expression factory which generates the appropriate entity 
+ * expression from various pieces of an RTML credential domain.
+ */
+public class RtmlExpression implements EntityExpression {
+
+    public static RtmlEntity convert(Entity expr) throws Exception {
+	StringTokenizer st = 
+	    new StringTokenizer(((Entity)expr).getName(), "!");
+	String hashCode = st.nextToken();
+	if(st.hasMoreTokens()) {
+	    String shortName = st.nextToken();
+	    return new RtmlEntity(shortName, hashCode);
+	} else {
+	    return new RtmlEntity(hashCode);
+	}
+    }
+
+    public static Role convert(Role r) throws Exception {
+	return new Role(convert(r.getBase()), r.getName());
+    }
+
+    public static LinkedRole convert(LinkedRole lr) throws Exception {
+	return new 
+	    LinkedRole(convert(lr.getFirstRole()), lr.getSecondRoleName());
+    }
+
+    public static Intersection convert(Intersection i) throws Exception {
+	Intersection intersection = new Intersection();
+	Iterator parts = intersection.getParts();
+	while(parts.hasNext()) {
+	    intersection.and(convert((EntityExpression)parts.next()));
+	}
+	return intersection;
+    }
+
+    public static EntityExpression convert(EntityExpression expr) 
+	throws Exception{
+	if(expr instanceof Entity) {
+	    return convert((Entity)expr);
+	}
+	if(expr instanceof Role) {
+	    return convert((Role)expr);
+	}
+	if(expr instanceof LinkedRole) {
+	    return convert((LinkedRole)expr);
+	}
+	if(expr instanceof Intersection) {
+	    return convert((Intersection)expr);
+	}
+	return null;
+    }
+
+    public static EntityExpression getEntityExpression(String text) 
+	throws Exception {
+	return convert(StaticCredential.getEntityExpression(text));
+    }
+    
+    /** converts a principal into an entity */
+    public static RtmlEntity convert(Principal p, CredentialDomain domain) {
+        return new RtmlEntity(domain.getPrincipal(p), p);
+    }
+
+    /** converts an rtml role into and rbtm role */
+    public static edu.stanford.peer.rbtm.credential.Role convert
+        (edu.stanford.rt.credential.Role rtmlRole, CredentialDomain domain) {
+        RtmlEntity entity = convert(rtmlRole.getPrincipal(), domain);
+        //System.out.print(entity.getName() + ".");
+        String roleName = rtmlRole.getName();
+        return new Role(entity, roleName);
+    }
+    
+    /** converts an rtml linked role into an rbtm linked role */
+    public static edu.stanford.peer.rbtm.credential.LinkedRole convert
+        (edu.stanford.rt.credential.LinkedRole rtml, CredentialDomain domain) {
+        RtmlEntity entity = convert(domain.getIssuer(), domain);
+        String primaryRole = 
+            rtml.getRoleTermAt(0).getRoleDeclaration().getName();
+        String secondaryRole = 
+            rtml.getRoleTermAt(1).getRoleDeclaration().getName();
+        return new LinkedRole(entity, primaryRole, secondaryRole);
+    }
+
+    /** converts a role intersection into an rbtm intersection */
+    public static edu.stanford.peer.rbtm.credential.Intersection convert
+        (edu.stanford.rt.credential.RoleIntersection rtml, CredentialDomain domain) {
+        System.out.println("RTML Intersection:");
+        RtmlEntity issuer = convert(domain.getIssuer(), domain);
+        Iterator parts = rtml.getParts().iterator();
+        Intersection intersect = new Intersection();
+        int pCount = 0;
+        while(parts.hasNext()) {
+            RoleTerm term = (RoleTerm)parts.next();
+            edu.stanford.peer.rbtm.credential.Role role = 
+                new Role(issuer, term.getRoleDeclaration().getName());
+            System.out.println("Part number " + ++pCount);
+            System.out.println(role);
+            intersect.and(role);
+        }
+        return intersect;
+    }
+
+    /**
+     * a polymorphic conversion method, which acts as an entity expression 
+     * factory.
+     */
+    public static EntityExpression convert(PrincipalExpression expr, CredentialDomain domain) {
+        if(expr instanceof edu.stanford.rt.credential.Principal) {
+            return convert((edu.stanford.rt.credential.Principal)expr, domain);
+        }
+        if(expr instanceof edu.stanford.rt.credential.Role) {
+            return convert((edu.stanford.rt.credential.Role)expr, domain);
+        }
+        if(expr instanceof edu.stanford.rt.credential.LinkedRole) {
+            return convert((edu.stanford.rt.credential.LinkedRole)expr, domain);
+        }
+        if(expr instanceof edu.stanford.rt.credential.RoleIntersection) {
+            return convert((edu.stanford.rt.credential.RoleIntersection)expr, 
+                           domain);
+        }
+	System.out.println("$$$ Skipping over " + expr);
+        return null;
+    }
+
+    public static String toString(Entity e) {
+	if(e instanceof RtmlEntity) {
+	    return ((RtmlEntity)e).getHash();
+	}
+	return e.toString();
+    }
+
+    public static String toString(Role r) {
+	StringBuffer buff = new StringBuffer(toString(r.getBase()));
+	buff.append(".").append(r.getName().toString());
+	return buff.toString();
+    }
+
+    public static String toString(LinkedRole r) {
+	StringBuffer buff = new StringBuffer(toString(r.getFirstRole()));
+	buff.append(".").append(r.getSecondRoleName().toString()); 
+	return buff.toString();
+
+    }
+
+    public static String toString(EntityExpression expr) {
+	    if(expr instanceof Entity) {
+		return toString((Entity)expr);
+	    } 
+	    if(expr instanceof Role) {
+		return toString((Role)expr);
+	    }
+	    if(expr instanceof LinkedRole) {
+		return toString((LinkedRole)expr);
+	    } 
+	    //we don't handle instersections since they should already be 
+	    //decomposed into expression parts, but just in case . . .
+	    return expr.toString();
+    }
+
+}
Index: fedd/abac-src/ttg/credential/RtmlFrontier.java
===================================================================
--- fedd/abac-src/ttg/credential/RtmlFrontier.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/RtmlFrontier.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,301 @@
+package com.nailabs.abac.credential;
+
+import java.util.*;
+
+import com.nailabs.abac.process.FrontierManager;
+import com.nailabs.abac.process.AckPolicy;
+import com.nailabs.abac.process.AckFact;
+import com.nailabs.abac.process.ACPolicy;
+import com.nailabs.abac.process.ResourcePolicy;
+import edu.stanford.peer.rbtm.credential.Entity;
+import edu.stanford.peer.rbtm.credential.EntityExpression;
+import edu.stanford.peer.rbtm.credential.RoleName;
+import edu.stanford.peer.rbtm.credential.SimpleRoleName;
+import edu.stanford.peer.rbtm.credential.StaticCredential;
+import edu.stanford.peer.rbtm.engine.Simp;
+import edu.stanford.peer.rbtm.engine.Sens;
+import edu.stanford.peer.rbtm.engine.Oppo;
+import edu.stanford.rt.credential.*;
+import edu.stanford.rt.parser.RTParser;
+import edu.stanford.rt.util.Constants;
+
+/** 
+ * A frontier manager class which uses the application specification 
+ * domain for determining whether a rol is issuer traces all, issuer
+ * traces def, etc.
+ */
+public class RtmlFrontier extends FrontierManager implements Constants {
+    protected HashMap discoveryConfig;
+
+    protected ApplicationDomain domain;
+
+    protected CredentialStore store;
+
+    protected RTContext context;
+
+    protected HashID id  = null;
+
+    //protected HashSet issuerTracesAll = new HashSet();
+
+    protected HashSet issuerTraces = new HashSet();
+
+    //protected HashSet issuerTracesDef  = new HashSet();
+
+    protected ResourcePolicy resourcePolicy = null;
+
+    public RtmlFrontier(HashMap config) {
+        String domainName = getApplicationDomainName(config);
+	discoveryConfig = new HashMap(2); // needed for constructing a DDEngine
+        discoveryConfig.put("DDEParser", config.get("DDEParser"));
+	discoveryConfig.put("PrepInfo", config.get("PrepInfo"));
+	discoveryConfig.put("DDEContext", config.get("DDEContext"));
+	store = (CredentialStore)config.get("CredentialStore");
+	context = (RTContext)config.get("RTContext");
+	id = new HashID(HashID.APPLICATION_DOMAIN, domainName);
+        domain = context.getApplicationDomain(id);
+	init(config);
+    }
+
+    /** specialized init method for accessing the credential store backends */
+    public void init(HashMap config) {
+        // (0) get the configurations entity identifier
+        this.self =(Entity) config.get("EntityID");
+        
+        // (1) load acknowledgement(ACK) policy
+        ackPolicy = (AckPolicy)config.get("AckPolicy");
+        
+        // (2) load access control (AC) policy 
+        acPolicy = (ACPolicy)config.get("AccessControl");
+	// (2 and 1/2) load the resource policy
+	resourcePolicy = (ResourcePolicy)config.get("ResourcePolicy");
+
+        // (3) load issuer traceable roles
+        // (4) load subject traceale roles
+        parseRoleDeclarations(config);
+
+        // (5) construct sensitive roles predicate from the ack policy
+        Sens sens = new Sens(ackPolicy.getSensitiveRoles());
+
+        // (6) construct opponent predicate from the issuer traceable roles
+        Oppo oppo = new Oppo(new Vector(issuerTracesDef));
+        oppo.addSubjects(new Vector(issuerTracesAll));
+        
+        // TBD: Does this really need to be separated into two mutually 
+        //      exclusive credential sets? And in this case we have three
+        //      credential stores (the primordial, issuer-traces, and 
+        //      subject-traces).
+        
+        // (8) separate policy reachable credentials
+        // (9) separate self reachable credentials
+        CredentialStore store = (CredentialStore)config.get("CredentialStore");
+        CredentialStore subjectStore = null, issuerStore = null;
+        try {
+            RTParser parser = new RTParser();
+            subjectStore = new CredentialStore(parser);
+            issuerStore = new CredentialStore(parser);
+            Iterator domains = 
+                store.getCredentialDomains().values().iterator();
+            while(domains.hasNext()) {
+                CredentialDomain domain = (CredentialDomain)domains.next();
+                RoleDefinition def = 
+                    (RoleDefinition)domain.roleDefinitionIterator().next();
+                RoleName roleName = 
+                    new SimpleRoleName(def.getHead().getName());
+                if(isIssuerTraceable(roleName)) {
+                    issuerStore.addCredentialDomain(domain.getHashID(),domain);
+                } else {
+		    //if(isSubjectTraceable(roleName)) {
+                    subjectStore.addCredentialDomain(domain.getHashID(),domain);
+                }
+                // It is possible that credential may fall through to here. We 
+                // propbably just remove the second if-statement...
+            }
+        } catch (Exception ex) {
+            ex.printStackTrace();
+        }
+
+        // (7) construct the frontier functions with their predicates
+	oppoLocal = new RtmlEngine(issuerStore);
+        System.out.println("------> Sensitive Graph");
+        sensFrontier = new RtmlEngine(subjectStore, sens);
+        System.out.println("------> Opponent Graph");
+        oppoFrontier = new RtmlEngine(issuerStore, oppo);
+        System.out.println("------> Simple Graph");
+        simpFrontier = new RtmlEngine(subjectStore, new Simp());
+
+	// perform credential discovery here
+	DDEngine selfTraceable = discoverSelfTraceable();
+	DDEngine policyTraceable = discoverPolicyTraceable();
+	// TBD: add backwards compatibility check in here if necessary
+	//      which would avoid discovery
+	((RtmlEngine)oppoLocal).importDomains(policyTraceable);
+	((RtmlEngine)sensFrontier).importDomains(selfTraceable);
+	((RtmlEngine)oppoFrontier).importDomains(policyTraceable);
+	((RtmlEngine)simpFrontier).importDomains(selfTraceable);
+    }
+
+
+    protected String getApplicationDomainName(HashMap config) {
+        Properties props = (Properties)config.get("RTML");
+        return props.getProperty("ApplicationDomain");
+    }
+    
+    protected OrderedMap getRoleDeclarations() {
+        try {
+	    return domain.getRoleDeclarations();
+        } catch(Exception ex) {
+            ex.printStackTrace();
+        }
+        return null;
+    }
+
+
+    public DDEngine discoverPolicyTraceable() {
+	Iterator ackValues = ackPolicy.getRequiredRoles().iterator();
+	Iterator acValues = acPolicy.getRequiredRoles().iterator();
+	Iterator resourceValues = resourcePolicy.getRequiredRoles().iterator();
+	DDEngine discoveryEngine = new DDEngine(discoveryConfig);
+	HashSet policySet = new HashSet();
+	
+	while(ackValues.hasNext()) {
+	    AckFact ackVal = (AckFact)ackValues.next();
+	    policySet.add(ackVal.getRequirement());
+	}
+	while(acValues.hasNext()) {
+	    EntityExpression acVal = (EntityExpression)acValues.next();
+	    policySet.add(acVal);
+	}
+	while(resourceValues.hasNext()) {
+	    EntityExpression resourceVal = 
+		(EntityExpression)resourceValues.next();
+	    policySet.add(resourceVal);
+	}
+	Iterator randomRoles = policySet.iterator();
+	while(randomRoles.hasNext()) {
+	    EntityExpression random = (EntityExpression)randomRoles.next();
+	    discoveryEngine.backwardSearch(random);
+	}
+	return discoveryEngine;
+    }
+
+    public DDEngine discoverSelfTraceable() {
+	HashSet selfSet = new HashSet();
+	Iterator mySensRoles = ackPolicy.getSensitiveRoles().iterator();
+	DDEngine discoveryEngine = new DDEngine(discoveryConfig);
+	//RtmlEngine local = new RtmlEngine(store);
+
+	//find all the credentials which have roles that map directly to self
+	Iterator myRoles = oppoFrontier.findCredentialsBySubject(self);
+	while(myRoles.hasNext()) {
+	    RtmlCredential cred = (RtmlCredential)myRoles.next();
+	    EntityExpression me = cred.getDefinedRole();
+	    selfSet.add(me);
+	}
+	myRoles = sensFrontier.findCredentialsBySubject(self);
+	while(myRoles.hasNext()) {
+	    RtmlCredential cred = (RtmlCredential)myRoles.next();
+	    EntityExpression me = cred.getDefinedRole();
+	    selfSet.add(me);
+	}
+	//add the sensitive roles to the initial search set
+	while(mySensRoles.hasNext()) {
+	    EntityExpression sense = (EntityExpression)mySensRoles.next();
+	    selfSet.add(sense);
+	}
+	//perform forward searches on the pseudo-random set of roles
+	Iterator randomRoles = selfSet.iterator();
+	while(randomRoles.hasNext()) {
+	    EntityExpression random = (EntityExpression)randomRoles.next();
+		discoveryEngine.forwardSearch(random);
+	}
+	return discoveryEngine;
+    } 
+
+
+    protected void parseRoleDeclarations(HashMap config) {
+	// TBD: revisit to make this more robust in case an error occurs.
+	//      it should not necessarily bail out of all role processing
+	try {
+	    OrderedMap map = getRoleDeclarations();
+	    Iterator keys = map.keyIterator();
+	    System.out.println("Frontier parsing role declaratons");
+	    while(keys.hasNext()) {
+		RoleDeclaration role = (RoleDeclaration)map.get(keys.next());
+		System.out.println("role = " + role.getName());
+		parseRoleDeclaration(role);
+		System.out.println();
+	    }
+	} catch(Exception ex) {
+	    ex.printStackTrace();
+	}
+	System.out.println("End declaration parsing!");
+	config.put("IssuerTracesAll", issuerTracesAll);
+	config.put("IssuerTracesDef", issuerTracesDef);
+	config.put("SubjectTraceable", subjectTraces);
+    }
+
+    protected void parseRoleDeclaration(RoleDeclaration declaration) {
+        int issuerValue = declaration.getIssuerTracesType();
+        int subjectValue = declaration.getSubjectTracesType();
+
+        if(issuerValue == ISSUER_TRACES_ALL) {
+            issuerTracesAll.add(declaration.getName());
+	    System.out.print("issuer_traces_all");
+        } 
+        if(issuerValue == ISSUER_TRACES_DEF) {
+            issuerTracesDef.add(declaration.getName());
+	    System.out.print("issuer_traces_def");
+        }
+        if(subjectValue == SUBJECT_TRACES_ALL) {
+            subjectTraces.add(declaration.getName());
+	    System.out.print("subject_traces_all");
+        }
+    }
+
+    private RoleDeclaration getRoleDeclaration(RoleName role) {
+        try {
+	    System.out.println("id = " + id);
+            return domain.lookupRoleDeclaration(role.getName());
+        } catch(Exception ex) {
+            ex.printStackTrace();
+        }
+        return null;
+    }
+
+    /** Is the specified credential policy traceable? */
+    public boolean isPolicyTraceable(StaticCredential cred) {
+	return isIssuerTraceable(cred.getDefinedRole().getName());
+    }
+
+    /** Can the specified credential be traced back to this negotiator? */
+    public boolean isSelfReachable(StaticCredential cred) {
+	return isSubjectTraceable(cred.getDefinedRole().getName());
+    }
+
+    public boolean isIssuerTraceable(RoleName role) {
+        int value = getRoleDeclaration(role).getIssuerTracesType();
+        return (value == ISSUER_TRACES_ALL || value == ISSUER_TRACES_DEF);
+    }
+
+    public boolean isIssuerTracesAll(RoleName role) {
+        int value = getRoleDeclaration(role).getIssuerTracesType();
+        return (value == ISSUER_TRACES_ALL);
+    }
+
+    public boolean isIssuerTracesDef(RoleName role) {
+        int value = getRoleDeclaration(role).getIssuerTracesType();
+        return (value == ISSUER_TRACES_DEF);
+    }
+
+    public boolean isSubjectTraceable(RoleName role) {
+        int value = getRoleDeclaration(role).getSubjectTracesType();
+        return (value == SUBJECT_TRACES_ALL);
+    }
+     
+    public boolean subjectTracesAll(RoleName role) {
+        int value = getRoleDeclaration(role).getSubjectTracesType();
+        return (value == SUBJECT_TRACES_ALL);
+    }
+           
+
+}
Index: fedd/abac-src/ttg/credential/SignCredential.java
===================================================================
--- fedd/abac-src/ttg/credential/SignCredential.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/SignCredential.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,107 @@
+package com.nailabs.abac.credential;
+
+import java.security.*;
+import java.security.cert.*;
+import org.w3c.dom.*;
+import org.apache.xml.security.signature.*;
+import org.apache.xml.security.exceptions.*;
+import org.apache.xml.security.transforms.Transforms;
+import org.apache.xml.security.utils.*;
+
+/**
+ * A utility for signing a credential domain document.
+ */
+public class SignCredential extends Application {
+    /** signature algorithm is set to DSA */
+    protected static String SIG_TYPE = XMLSignature.ALGO_ID_SIGNATURE_DSA;
+    /** digest algorithm is SHA-1 */
+    protected static String DIGEST_TYPE = Constants.ALGO_ID_DIGEST_SHA1;
+
+    protected static String KEY_PAIR_TYPE = "DSA";
+
+    protected PrivateKey privateKey = null;
+
+    protected PublicKey publicKey = null;
+    
+    protected X509Certificate cert = null;
+
+    /** 
+     * Constructor for the application which reads in an XML document, 
+     * parses the doc into a DOM tree, signs the document, and writes
+     * the signed tree into an XML file. Cryptographic material is supplied
+     * by a Java keystore.
+     */
+    public SignCredential(String argv[]) {
+	super(argv);
+	name = "SignCredential";
+	parseParameters();
+	getKeys();
+	readDoc();
+	signDoc();
+	writeDoc();
+    }
+
+    private void generateKeyPair() {
+	if(DEBUG) {
+	    out.println("Generating random keypair for use in signature");
+	    out.println("(useful for demo purposes only)" );
+	}
+	try {
+	    KeyPairGenerator kpg = KeyPairGenerator.getInstance(KEY_PAIR_TYPE);
+	    kpg.initialize(512);
+	    KeyPair newKeyPair = kpg.generateKeyPair();
+	    privateKey = newKeyPair.getPrivate();
+	    publicKey = newKeyPair.getPublic();
+	} catch( java.security.NoSuchAlgorithmException nsae ) {
+	    if(DEBUG)nsae.printStackTrace();
+	}
+    }
+
+    protected void getKeys() {
+	super.getKeys();       // loads the keystore to a class instance field
+	if( keys == null )
+	    generateKeyPair(); // Generate a random, one-time-use key
+	else {
+	    try {
+		cert = (X509Certificate)keyStore.getCertificate(alias);
+		publicKey = cert.getPublicKey();
+		privateKey = 
+		    (PrivateKey)keyStore.getKey(alias, password.toCharArray());
+	    } catch( Exception e ) {
+		cert = null;
+		publicKey = null;
+		e.printStackTrace();
+	    }
+	}
+    }
+
+    protected void signDoc() {
+	try {
+	    String baseURI = outXML.toURL().toString();
+	    XMLSignature sig = new XMLSignature(doc, baseURI, SIG_TYPE );
+	    docElement.appendChild( sig.getElement() );
+	    Transforms transforms = new Transforms( doc );
+	    transforms.addTransform(Transforms.TRANSFORM_ENVELOPED_SIGNATURE );
+	    transforms.addTransform( Transforms.TRANSFORM_C14N_WITH_COMMENTS );
+	    if( includeTransform ) {
+		sig.addDocument("", transforms, DIGEST_TYPE);
+	    }
+	    if( includeCert && ( cert != null ) ) {
+		sig.addKeyInfo( cert );
+	    } else if( publicKey != null )
+		sig.addKeyInfo( publicKey );
+	    sig.sign( privateKey );
+	} catch( XMLSecurityException xmlse ) {
+	    xmlse.printStackTrace();
+	} catch( java.net.MalformedURLException murle ) {
+	    murle.printStackTrace();
+	}
+    }
+
+
+    /** standard main routine for launching the application */
+    public static void main(String argv[]) {
+	SignCredential sc = new SignCredential(argv);
+    }
+
+}
Index: fedd/abac-src/ttg/credential/SignDomain.java
===================================================================
--- fedd/abac-src/ttg/credential/SignDomain.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/credential/SignDomain.java	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,95 @@
+package com.nailabs.abac.credential;
+
+import java.security.*;
+import java.security.cert.*;
+import org.w3c.dom.*;
+import org.apache.xml.security.signature.*;
+import org.apache.xml.security.exceptions.*;
+import org.apache.xml.security.transforms.Transforms;
+import org.apache.xml.security.utils.*;
+
+public class SignDomain extends Application {
+    /** signature algorithm is set to DSA */
+    protected static String SIG_TYPE = XMLSignature.ALGO_ID_SIGNATURE_DSA;
+    /** digest algorithm is SHA-1 */
+    protected static String DIGEST_TYPE = Constants.ALGO_ID_DIGEST_SHA1;
+
+    protected static String KEY_PAIR_TYPE = "DSA";
+
+    protected PrivateKey privateKey = null;
+
+    protected PublicKey publicKey = null;
+    
+    protected X509Certificate cert = null;
+
+    protected String base64Digest;
+
+    protected String hexDigest;
+
+    /** 
+     * Constructor for the application which reads in an XML document, 
+     * parses the doc into a DOM tree, signs the document, and writes
+     * the signed tree into an XML file. Cryptographic material is supplied
+     * by a Java keystore.
+     */
+    public SignDomain(String argv[]) {
+	super(argv);
+	name = "SignDomain";
+	parseParameters();
+	getKeys();
+	readDoc();
+	signDoc();
+	writeDoc();
+    }
+
+    private void signDoc() {
+	try {
+	    String baseURI = outXML.toURL().toString();
+	    XMLSignature sig = new XMLSignature( doc, baseURI, SIG_TYPE);
+	    docElement.appendChild( sig.getElement() );
+	    Transforms transforms = new Transforms( doc );
+	    transforms.addTransform( Transforms.TRANSFORM_ENVELOPED_SIGNATURE);
+	    transforms.addTransform( Transforms.TRANSFORM_C14N_WITH_COMMENTS);
+	    String referenceURI = noComments ? "" : "#xpointer(/)";
+	    sig.addDocument(referenceURI,transforms, DIGEST_TYPE);
+	    sig.addKeyInfo( publicKey );
+	    sig.sign( privateKey );
+	    
+	    //Element digestValueElem = sig.getSignedInfo().item( 0 ).getChildElementLocalName( 0, Constants.SignatureSpecNS, Constants._TAG_DIGESTVALUE );
+	    //byte[] elemDig = Base64.decode( digestValueElem );
+	    byte[] elemDig = sig.getSignedInfo().item(0).getDigestValue();
+	    base64Digest = Base64.encode( elemDig );
+	    //hexDigest = HexDump.byteArrayToHexString(elemDig);
+            hexDigest = "";
+	} catch( org.apache.xml.security.exceptions.XMLSecurityException sec) {
+	    sec.printStackTrace();
+	} catch( java.net.MalformedURLException murle ) {
+	    murle.printStackTrace();
+	} catch( Exception e ) {
+	    e.printStackTrace();
+	}
+    }
+    
+    private void printDigest() {
+	System.out.println( base64Digest );
+	System.out.println( hexDigest );
+    }
+
+    private void generateKeyPair() {
+	try {
+	    KeyPairGenerator kpg = KeyPairGenerator.getInstance( "DSA" );
+	    kpg.initialize( 512 );
+	    KeyPair newKeyPair = kpg.generateKeyPair();
+	    privateKey = newKeyPair.getPrivate();
+	    publicKey = newKeyPair.getPublic();
+	} catch( java.security.NoSuchAlgorithmException nsae ) {
+	    nsae.printStackTrace();
+	}
+    }
+
+    /** standard main routine for launching the application */
+    public static void main(String argv[]) {
+	SignDomain sc = new SignDomain(argv);
+    }
+
+}
