Index: fedd/abac-src/ttg/test/rtml/CVS/Entries
===================================================================
--- fedd/abac-src/ttg/test/rtml/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,13 @@
+/dde-client.xml/1.3/Sat Aug  9 00:46:49 2003//
+/go/1.6/Wed Jul 16 16:28:52 2003//
+/go-dde/1.2/Sat Aug  9 00:46:49 2003//
+/sadmir-dde.xml/1.1/Thu Jul 10 00:37:07 2003//
+/sadmir.txt/1.11/Sat Aug  9 00:46:49 2003//
+/sadmir.xml/1.8/Fri Jul 11 23:18:04 2003//
+/se.xml/1.2/Fri Jul 11 23:18:04 2003//
+/usn.xml/1.2/Wed Jul 16 00:09:36 2003//
+/ussh-client.txt/1.2/Sat Aug  9 00:46:49 2003//
+/ussh-dde.xml/1.1/Thu Jul 10 00:37:07 2003//
+/ussh.txt/1.8/Thu Jul 10 00:37:07 2003//
+/ussh.xml/1.9/Tue Jul  8 17:32:13 2003//
+D
Index: fedd/abac-src/ttg/test/rtml/CVS/Entries.Log
===================================================================
--- fedd/abac-src/ttg/test/rtml/CVS/Entries.Log	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/CVS/Entries.Log	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,2 @@
+A D/sadmir////
+A D/ussh////
Index: fedd/abac-src/ttg/test/rtml/CVS/Repository
===================================================================
--- fedd/abac-src/ttg/test/rtml/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+ttg/test/rtml
Index: fedd/abac-src/ttg/test/rtml/CVS/Root
===================================================================
--- fedd/abac-src/ttg/test/rtml/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+:ext:jjacobs@src.columbia.sparta.com/cvs/abac
Index: fedd/abac-src/ttg/test/rtml/dde-client.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/dde-client.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/dde-client.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demp/WEB-INF RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD02">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD01">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="needsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/go
===================================================================
--- fedd/abac-src/ttg/test/rtml/go	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/go	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,11 @@
+#!/bin/tcsh
+#
+java -Dedu.stanford.rt.SystemDomain=/home/jay/rtml/schemas/SystemSpec.xml \
+	com.nailabs.abac.test.RtmlTest ussh.txt sadmir.txt \
+        non-union
+
+# Resource Identifier Union points to role: SAdmir.getsSlocs 
+# Old command line options
+#	-server -Xrunhprof:cpu=samples -Xms6m \
+#	"FakeHashKeySAdmir: FakeHashKeySAdmir.getsSLocs <<-?- FakeHashKeyUSSH" 
+
Index: fedd/abac-src/ttg/test/rtml/go-dde
===================================================================
--- fedd/abac-src/ttg/test/rtml/go-dde	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/go-dde	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,7 @@
+#!/bin/tcsh
+#
+java -Dedu.stanford.rt.SystemDomain=/home/jay/rtml/schemas/SystemSpec.xml \
+     -DDDEStore=dde-client.xml \
+     com.nailabs.abac.credential.DDEngine
+
+
Index: fedd/abac-src/ttg/test/rtml/sadmir-dde.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir-dde.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir-dde.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demp/WEB-INF/RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD01">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="needsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/sadmir.txt
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,52 @@
+[EntityID]
+HashCode=FakeHashKeySAdmir
+ShortName=SAdmir
+
+[RTML]
+CredentialStore=/var/tomcat4/webapps/demo/WEB-INF/sadmir.xml
+#CredentialStore=sadmir.xml
+DDEStore=/var/tomcat4/webapps/demo/WEB-INF/sadmir-dde.xml
+#DDEStore=sadmir-dde.xml
+ApplicationDomain=FakeHashADSD01
+SystemDomain=/var/tomcat4/webapps//demo/WEB-INF/SystemSpec.xml
+#SystemDomain=/home/jay/rtml/schemas/SystemSpec.xml
+
+[ResourcePolicy]
+union=FakeHashKeySAdmir!SAdmir.getsSLocs
+non-union=FakeHashKeySAdmir!SAdmir.needsSLocs
+
+[PrepInfo]
+#SE!FakeHashKeySAdmir=localhost:8081/demo/se-discovery
+SE=wwinsbor1.rv.nailabs.com:8180/demo/se-discovery
+SAdmir=wwinsbor1.rv.nailabs.com:8180/demo/se-discovery
+
+[SelfReachable]
+#SE.usr <-- SAdmir
+
+[PolicyReachable]
+#SE.friendly <-- US
+#SAdmir.needsSLocs <-- SAdmir.NRetTacCom.NRetTacUsr
+#SAdmir.NRetTacCom <-- USEUCOM.NRetUSTacCom
+#SAdmir.getsSLocs <-- SE.friendly.usr ^ SAdmir.needsSLocs
+
+[IssuerTracesAll]
+#friendly
+
+[IssuerTracesDef]
+#getsSLocs
+#needsSLocs
+#NRetTacCom
+
+[SubjectTraceable]
+#usr
+#NRetTacUsr
+#NRetUSTacCom
+#assignedNRet
+
+[Strategy]
+type=default
+
+[AccessControl]
+
+[AckPolicy]
+
Index: fedd/abac-src/ttg/test/rtml/sadmir.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demp/WEB-INF/RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD01">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="needsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+	<Credential id="FakeHashCredential01">
+		<!-- SE.usr <- SAdmir-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SE"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="usr" domain="s"/>
+			<PrincipalRef shortName="SAdmir"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential02">
+		<!-- SE.friendly <- US -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SE"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<PrincipalRef shortName="US"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential03">
+		<!-- SAdmir.needsSLocs <- Sadmir.NRetTacCom.NRetTacUsr-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<LinkedContainment>
+			<HeadRoleTerm name="needsSLocs" domain="s"/>
+			<LinkedRole>
+				<RoleTerm name="NRetTacCom" domain="s"/>
+				<RoleTerm name="NRetTacUsr" domain="s"/>
+			</LinkedRole>
+		</LinkedContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential04">
+		<!-- SAdmir.NRetTacCom <- USEUCOM.NRetUSTacCom-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+			<Principal shortName="USEUCOM">
+				<KeyHash>FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="NRetTacCom" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="USEUCOM"/>
+				<RoleTerm name="NRetUSTacCom" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential05">
+		<!-- SAdmir.getsSLocs <- SE.friendly.usr ^ SAdmir.needsSLocs-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="SE"/>
+				<RoleTerm name="friendly" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<LinkedContainment>
+			<HeadRoleTerm name="friendlyUsr" domain="s"/>
+			<LinkedRole>
+				<RoleTerm name="friendly" domain="s"/>
+				<RoleTerm name="usr" domain="s"/>
+			</LinkedRole>
+		</LinkedContainment>
+		<IntersectionContainment>
+			<HeadRoleTerm name="getsSLocs" domain="s"/>
+			<Intersection>
+				<RoleTerm name="friendlyUsr" domain="s"/>
+				<RoleTerm name="needsSLocs" domain="s"/>
+			</Intersection>
+		</IntersectionContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/sadmir/CVS/Entries
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,10 @@
+/adsd.xml/1.1/Fri Mar 21 01:38:20 2003//
+/credential01.xml/1.1/Fri Mar 21 01:38:21 2003//
+/credential02.xml/1.1/Fri Mar 21 01:38:21 2003//
+/credential03.xml/1.1/Fri Mar 21 01:38:21 2003//
+/credential04.xml/1.1/Fri Mar 21 01:38:21 2003//
+/credential05.xml/1.1/Fri Mar 21 01:38:21 2003//
+/sadmir.jks/1.1/Tue Mar 25 19:49:31 2003//
+/sign/1.1/Fri Mar 21 01:50:20 2003//
+/signed-sadmir.xml/1.1/Fri Mar 21 18:01:40 2003//
+D
Index: fedd/abac-src/ttg/test/rtml/sadmir/CVS/Repository
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+ttg/test/rtml/sadmir
Index: fedd/abac-src/ttg/test/rtml/sadmir/CVS/Root
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+:ext:jjacobs@src.columbia.sparta.com/cvs/abac
Index: fedd/abac-src/ttg/test/rtml/sadmir/adsd.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/adsd.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/adsd.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD01">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="needsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
Index: fedd/abac-src/ttg/test/rtml/sadmir/credential01.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/credential01.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/credential01.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential01">
+		<!-- SE.usr <- SAdmir-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SE"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="usr" domain="s"/>
+			<PrincipalRef shortName="SAdmir"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/sadmir/credential02.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/credential02.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/credential02.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential02">
+		<!-- SE.friendly <- US -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SE"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<PrincipalRef shortName="US"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/sadmir/credential03.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/credential03.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/credential03.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential03">
+		<!-- SAdmir.needsSLocs <- Sadmir.NRetTacCom.NRetTacUsr-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<LinkedContainment>
+			<HeadRoleTerm name="needsSLocs" domain="s"/>
+			<LinkedRole>
+				<RoleTerm name="NRetTacCom" domain="s"/>
+				<RoleTerm name="NRetTacUsr" domain="s"/>
+			</LinkedRole>
+		</LinkedContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/sadmir/credential04.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/credential04.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/credential04.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential04">
+		<!-- SAdmir.NRetTacCom <- USEUCOM.NRetUSTacCom-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+			<Principal shortName="USEUCOM">
+				<KeyHash>FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="NRetTacCom" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="USEUCOM"/>
+				<RoleTerm name="NRetUSTacCom" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/sadmir/credential05.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/credential05.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/credential05.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential05">
+		<!-- SAdmir.getsSLocs <- SE.friendly.usr ^ SAdmir.needsSLocs-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="SE"/>
+				<RoleTerm name="friendly" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<LinkedContainment>
+			<HeadRoleTerm name="friendlyUsr" domain="s"/>
+			<LinkedRole>
+				<RoleTerm name="friendly" domain="s"/>
+				<RoleTerm name="usr" domain="s"/>
+			</LinkedRole>
+		</LinkedContainment>
+		<IntersectionContainment>
+			<HeadRoleTerm name="getsSLocs" domain="s"/>
+			<Intersection>
+				<RoleTerm name="friendlyUsr" domain="s"/>
+				<RoleTerm name="needsSLocs" domain="s"/>
+			</Intersection>
+		</IntersectionContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/sadmir/sign
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/sign	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/sign	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,20 @@
+#!/bin/tcsh
+java com.nailabs.abac.credential.SignDomain\
+	-i nato-adsd.xml -o signed-adsd.xml \
+	-k keystore.jks -a SAdmir -c -p secure
+java com.nailabs.abac.credential.SignCredential \
+	-i credential01.xml -o signed-credential01.xml \
+	-k keystore.jks -a -SAdmir c -p secure
+java com.nailabs.abac.credential.SignCredential \
+	-i credential02.xml -o signed-credential02.xml \
+	-k keystore.jks -a SAdmir -c -p secure
+java com.nailabs.abac.credential.SignCredential \
+	-i credential03.xml -o signed-credential03.xml \
+	-k keystore.jks -a SAdmir -c -p secure
+java com.nailabs.abac.credential.SignCredential \
+	-i credential04.xml -o signed-credential04.xml \
+	-k keystore.jks -a SAdmir -c -p secure
+java com.nailabs.abac.credential.SignCredential \
+	-i credential05.xml -o signed-credential05.xml \
+	-k keystore.jks -a SAdmir -c -p secure
+cat signed-adsd.xml signed-credential*.xml > signed-sadmir.xml
Index: fedd/abac-src/ttg/test/rtml/sadmir/signed-sadmir.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/sadmir/signed-sadmir.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/sadmir/signed-sadmir.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,300 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://crypto.stanford.edu/dc/RTMLv1.0
+  file:///home/jay/rtml/schemas/RTMLv1.0q.xsd">
+<ApplicationDomainSpecification id="bXzD+txgDphZ1Zukl3Vz1LcfCZc=" uri="" xmlns="">
+		<RoleDeclaration name="friendly" xmlns="">
+			<Plain issuerTraces="all" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs" xmlns="">
+			<Plain issuerTraces="def" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="needsSLocs" xmlns="">
+			<Plain issuerTraces="def" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom" xmlns="">
+			<Plain issuerTraces="def" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr" xmlns="">
+			<Plain issuerTraces="all" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+<Credential id="FakeHashCredential01" xmlns="">
+		<!-- SE.usr <- SAdmir-->
+		<Preamble xmlns="">
+			<ImportDomain idref="bXzD+txgDphZ1Zukl3Vz1LcfCZc=" name="s" xmlns=""/>
+			<Principal shortName="SE" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="SE" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="usr" xmlns=""/>
+			<PrincipalRef shortName="SAdmir" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">KqUXqdo2C3vP78v3z/xKHy+5aglT32wcVeTrM1vSWrojoiriTD3AUA==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:KeyValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:DSAKeyValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:P xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+/X9TgR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuA
+HTRv8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOu
+K2HXKu/yIgMZndFIAcc=
+</ds:P>
+<ds:Q xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">l2BQjxUjC8yykrmCouuEC/BYHPU=</ds:Q>
+<ds:G xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3
+zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKL
+Zl6Ae1UlZAFMO/7PSSo=
+</ds:G>
+<ds:Y xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+xF4Uj48pEzhT/4LE4/9Q44HPLsxaeR7odfq2R9jVYiF0gb6fTgWXM7RKzVbTUts8NSi/4cnDtqZg
+k3ijmv5w9VyiRFqqHSXnGdIJbZJu5TExCE6Be5AEO6JODgGDZQeO1mUTtpiiBIeqJtITBNcBSzrN
+TO5FpSka90qZybyBAMA=
+</ds:Y>
+</ds:DSAKeyValue>
+</ds:KeyValue>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential02" xmlns="">
+		<!-- SE.friendly <- US -->
+		<Preamble xmlns="">
+			<ImportDomain idref="bXzD+txgDphZ1Zukl3Vz1LcfCZc=" name="s" xmlns=""/>
+			<Principal shortName="SE" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="SE" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="friendly" xmlns=""/>
+			<PrincipalRef shortName="US" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">bxa2gtJDgTL5pwndn60Pu8lZqDsOVQnrgdFyzq7bRI39g4GkoliOBA==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC9zCCArUCBD57PNcwCwYHKoZIzjgEAwUAMGExCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJTRTEQ
+MA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEPMA0G
+A1UEAxMGU0FkbWlyMB4XDTAzMDMyMTE2MjQ1NVoXDTAzMDYxOTE2MjQ1NVowYTELMAkGA1UEBhMC
+U0UxCzAJBgNVBAgTAlNFMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYD
+VQQLEwdVbmtub3duMQ8wDQYDVQQDEwZTQWRtaXIwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9T
+gR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv
+8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HX
+Ku/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSv
+u/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64e
+K7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhQAC
+gYEAxF4Uj48pEzhT/4LE4/9Q44HPLsxaeR7odfq2R9jVYiF0gb6fTgWXM7RKzVbTUts8NSi/4cnD
+tqZgk3ijmv5w9VyiRFqqHSXnGdIJbZJu5TExCE6Be5AEO6JODgGDZQeO1mUTtpiiBIeqJtITBNcB
+SzrNTO5FpSka90qZybyBAMAwCwYHKoZIzjgEAwUAAy8AMCwCFAz1M+ewS4FufoLqCaBFGu1Pyyyo
+AhRgjQMie0z1Ol5OFNYltYRTwFiB1Q==
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential03" xmlns="">
+		<!-- SAdmir.needsSLocs <- Sadmir.NRetTacCom.NRetTacUsr-->
+		<Preamble xmlns="">
+			<ImportDomain idref="bXzD+txgDphZ1Zukl3Vz1LcfCZc=" name="s" xmlns=""/>
+			<Principal shortName="SAdmir" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="SAdmir" xmlns=""/>
+		</Issuer>
+		<LinkedContainment xmlns="">
+			<HeadRoleTerm domain="s" name="needsSLocs" xmlns=""/>
+			<LinkedRole xmlns="">
+				<RoleTerm domain="s" name="NRetTacCom" xmlns=""/>
+				<RoleTerm domain="s" name="NRetTacUsr" xmlns=""/>
+			</LinkedRole>
+		</LinkedContainment>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">i2r4gPDziHjwFuD+/pT/jUXkAz+AYLaq6ixL40Xc1NwiAEWxfqIaSA==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC9zCCArUCBD57PNcwCwYHKoZIzjgEAwUAMGExCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJTRTEQ
+MA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEPMA0G
+A1UEAxMGU0FkbWlyMB4XDTAzMDMyMTE2MjQ1NVoXDTAzMDYxOTE2MjQ1NVowYTELMAkGA1UEBhMC
+U0UxCzAJBgNVBAgTAlNFMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYD
+VQQLEwdVbmtub3duMQ8wDQYDVQQDEwZTQWRtaXIwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9T
+gR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv
+8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HX
+Ku/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSv
+u/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64e
+K7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhQAC
+gYEAxF4Uj48pEzhT/4LE4/9Q44HPLsxaeR7odfq2R9jVYiF0gb6fTgWXM7RKzVbTUts8NSi/4cnD
+tqZgk3ijmv5w9VyiRFqqHSXnGdIJbZJu5TExCE6Be5AEO6JODgGDZQeO1mUTtpiiBIeqJtITBNcB
+SzrNTO5FpSka90qZybyBAMAwCwYHKoZIzjgEAwUAAy8AMCwCFAz1M+ewS4FufoLqCaBFGu1Pyyyo
+AhRgjQMie0z1Ol5OFNYltYRTwFiB1Q==
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential04" xmlns="">
+		<!-- SAdmir.NRetTacCom <- USEUCOM.NRetUSTacCom-->
+		<Preamble xmlns="">
+			<ImportDomain idref="bXzD+txgDphZ1Zukl3Vz1LcfCZc=" name="s" xmlns=""/>
+			<Principal shortName="SAdmir" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySAdmir</KeyHash>
+			</Principal>
+			<Principal shortName="USEUCOM" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="SAdmir" xmlns=""/>
+		</Issuer>
+		<SimpleContainment xmlns="">
+			<HeadRoleTerm domain="s" name="NRetTacCom" xmlns=""/>
+			<ExternalRole xmlns="">
+				<PrincipalRef shortName="USEUCOM" xmlns=""/>
+				<RoleTerm domain="s" name="NRetUSTacCom" xmlns=""/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">UH/izCjRteS3ag9fydzC+K8dGmMR+tUEEEnvqyMI7ZVALCRyHwSnIw==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC9zCCArUCBD57PNcwCwYHKoZIzjgEAwUAMGExCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJTRTEQ
+MA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEPMA0G
+A1UEAxMGU0FkbWlyMB4XDTAzMDMyMTE2MjQ1NVoXDTAzMDYxOTE2MjQ1NVowYTELMAkGA1UEBhMC
+U0UxCzAJBgNVBAgTAlNFMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYD
+VQQLEwdVbmtub3duMQ8wDQYDVQQDEwZTQWRtaXIwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9T
+gR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv
+8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HX
+Ku/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSv
+u/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64e
+K7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhQAC
+gYEAxF4Uj48pEzhT/4LE4/9Q44HPLsxaeR7odfq2R9jVYiF0gb6fTgWXM7RKzVbTUts8NSi/4cnD
+tqZgk3ijmv5w9VyiRFqqHSXnGdIJbZJu5TExCE6Be5AEO6JODgGDZQeO1mUTtpiiBIeqJtITBNcB
+SzrNTO5FpSka90qZybyBAMAwCwYHKoZIzjgEAwUAAy8AMCwCFAz1M+ewS4FufoLqCaBFGu1Pyyyo
+AhRgjQMie0z1Ol5OFNYltYRTwFiB1Q==
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential05" xmlns="">
+		<!-- SAdmir.getsSLocs <- SE.friendly.usr ^ SAdmir.needsSLocs-->
+		<Preamble xmlns="">
+			<ImportDomain idref="bXzD+txgDphZ1Zukl3Vz1LcfCZc=" name="s" xmlns=""/>
+			<Principal shortName="SE" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="SAdmir" xmlns=""/>
+		</Issuer>
+		<SimpleContainment xmlns="">
+			<HeadRoleTerm domain="s" name="friendly" xmlns=""/>
+			<ExternalRole xmlns="">
+				<PrincipalRef shortName="SE" xmlns=""/>
+				<RoleTerm domain="s" name="friendly" xmlns=""/>
+			</ExternalRole>
+		</SimpleContainment>
+		<LinkedContainment xmlns="">
+			<HeadRoleTerm domain="s" name="friendlyUsr" xmlns=""/>
+			<LinkedRole xmlns="">
+				<RoleTerm domain="s" name="friendly" xmlns=""/>
+				<RoleTerm domain="s" name="usr" xmlns=""/>
+			</LinkedRole>
+		</LinkedContainment>
+		<IntersectionContainment xmlns="">
+			<HeadRoleTerm domain="s" name="getsSLocs" xmlns=""/>
+			<Intersection xmlns="">
+				<RoleTerm domain="s" name="friendlyUsr" xmlns=""/>
+				<RoleTerm domain="s" name="needsSLocs" xmlns=""/>
+			</Intersection>
+		</IntersectionContainment>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">OtgP4UOC/9cVGETcYVvLfOXQuZo2atbXnIu832PXBjpF8kbfvfizIg==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC9zCCArUCBD57PNcwCwYHKoZIzjgEAwUAMGExCzAJBgNVBAYTAlNFMQswCQYDVQQIEwJTRTEQ
+MA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEPMA0G
+A1UEAxMGU0FkbWlyMB4XDTAzMDMyMTE2MjQ1NVoXDTAzMDYxOTE2MjQ1NVowYTELMAkGA1UEBhMC
+U0UxCzAJBgNVBAgTAlNFMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYD
+VQQLEwdVbmtub3duMQ8wDQYDVQQDEwZTQWRtaXIwggG4MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9T
+gR11EilS30qcLuzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv
+8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oWkTL2dfOuK2HX
+Ku/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD34aCF1ps93su8q1w2uFe5eZSv
+u/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkWcSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64e
+K7OmdZFuo38L+iE1YvH7YnoBJDvMpPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhQAC
+gYEAxF4Uj48pEzhT/4LE4/9Q44HPLsxaeR7odfq2R9jVYiF0gb6fTgWXM7RKzVbTUts8NSi/4cnD
+tqZgk3ijmv5w9VyiRFqqHSXnGdIJbZJu5TExCE6Be5AEO6JODgGDZQeO1mUTtpiiBIeqJtITBNcB
+SzrNTO5FpSka90qZybyBAMAwCwYHKoZIzjgEAwUAAy8AMCwCFAz1M+ewS4FufoLqCaBFGu1Pyyyo
+AhRgjQMie0z1Ol5OFNYltYRTwFiB1Q==
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/se.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/se.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/se.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demp/WEB-INF/RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD01">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="needsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+	<Credential id="FakeHashCredential01">
+		<!-- SE.usr <- SAdmir-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SE"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="usr" domain="s"/>
+			<PrincipalRef shortName="SAdmir"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential02">
+		<!-- SE.friendly <- US -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SE"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<PrincipalRef shortName="US"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential03">
+		<!-- SAdmir.needsSLocs <- Sadmir.NRetTacCom.NRetTacUsr-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<LinkedContainment>
+			<HeadRoleTerm name="needsSLocs" domain="s"/>
+			<LinkedRole>
+				<RoleTerm name="NRetTacCom" domain="s"/>
+				<RoleTerm name="NRetTacUsr" domain="s"/>
+			</LinkedRole>
+		</LinkedContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential04">
+		<!-- SAdmir.NRetTacCom <- USEUCOM.NRetUSTacCom-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+			<Principal shortName="USEUCOM">
+				<KeyHash>FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="NRetTacCom" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="USEUCOM"/>
+				<RoleTerm name="NRetUSTacCom" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential05">
+		<!-- SAdmir.getsSLocs <- SE.friendly.usr ^ SAdmir.needsSLocs-->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD01"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="SAdmir">
+				<KeyHash>FakeHashKeySAdmir</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="SAdmir"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="SE"/>
+				<RoleTerm name="friendly" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<LinkedContainment>
+			<HeadRoleTerm name="friendlyUsr" domain="s"/>
+			<LinkedRole>
+				<RoleTerm name="friendly" domain="s"/>
+				<RoleTerm name="usr" domain="s"/>
+			</LinkedRole>
+		</LinkedContainment>
+		<IntersectionContainment>
+			<HeadRoleTerm name="getsSLocs" domain="s"/>
+			<Intersection>
+				<RoleTerm name="friendlyUsr" domain="s"/>
+				<RoleTerm name="needsSLocs" domain="s"/>
+			</Intersection>
+		</IntersectionContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2003-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/usn.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/usn.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/usn.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- edited with XML Spy v4.3 U (http://www.xmlspy.com) by Kangshi (Kangshi) -->
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demo/WEB-INF/RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD02">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+	<Credential id="FakeHashCredential04">
+		<!-- RADMSmith.NRetTacUsr <- USN.assignedNRet -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD02"/>
+			<Principal shortName="RADMSmith">
+				<KeyHash>FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+			<Principal shortName="USN">
+				<KeyHash>FakeHashKeyUSN</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="RADMSmith"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="NRetTacUsr" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="USN"/>
+				<RoleTerm name="assignedNRet" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential05">
+		<!-- US.friendly <- SE -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD02"/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="US"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<PrincipalRef shortName="SE"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/ussh-client-deter.txt
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh-client-deter.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh-client-deter.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,51 @@
+[EntityID]
+HashCode=FakeHashKeyUSSH
+ShortName=USSH
+
+[RTML]
+CredentialStore=rtml/ussh.xml
+DDEStore=rtml/ussh-dde.xml
+ApplicationDomain=FakeHashADSD02
+
+[AccessControl]
+
+[AckPolicy]
+FakeHashKeyUSN!USN.assignedNRet=FakeHashKeyUS!US.friendly.usr
+
+[ResourcePolicy]
+
+[PrepInfo]
+USN!FakeHashKeyUS=vzy:8180/demo/us-discovery
+US!FakeHashKeyUS=vzy:8180/demo/us-discovery
+USEUCOM!FakeHashKeyUSEUCOM=vzy:8180/demo/us-discovery
+RADMSmith!FakeHashKeyRADMSmith=vzy:8180/demo/us-discovery
+USN=vzy:8180/demo/us-discovery
+US=vzy:8180/demo/us-discovery
+USEUCOM=vzy:8180/demo/us-discovery
+RADMSmith=vzy:8180/demo/us-discovery
+
+[Strategy]
+type=default
+ 
+[SelfReachable]
+#USN.assignedNRet <-- USSH
+#US.usr <-- USSH
+#USEUCOM.NRetUSTacCom <-- RADMSmith
+#RADMSmith.NRetTacUsr <-- USN.assignedNRet
+
+[PolicyReachable]
+#US.friendly <-- SE
+
+[IssuerTracesAll]
+#friendly
+
+[IssuerTracesDef]
+#getsSLocs
+#NRetTacCom
+
+[SubjectTraceable]
+#usr
+#NRetUSTacCom
+#NRetTacUsr
+#assignedNRet
+
Index: fedd/abac-src/ttg/test/rtml/ussh-client.txt
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh-client.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh-client.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,51 @@
+[EntityID]
+HashCode=FakeHashKeyUSSH
+ShortName=USSH
+
+[RTML]
+CredentialStore=rtml/ussh.xml
+DDEStore=rtml/ussh-dde.xml
+ApplicationDomain=FakeHashADSD02
+
+[AccessControl]
+
+[AckPolicy]
+FakeHashKeyUSN!USN.assignedNRet=FakeHashKeyUS!US.friendly.usr
+
+[ResourcePolicy]
+
+[PrepInfo]
+USN!FakeHashKeyUS=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+US!FakeHashKeyUS=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+USEUCOM!FakeHashKeyUSEUCOM=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+RADMSmith!FakeHashKeyRADMSmith=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+USN=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+US=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+USEUCOM=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+RADMSmith=wwinsbor1.rv.nailabs.com:8180/demo/us-discovery
+
+[Strategy]
+type=default
+ 
+[SelfReachable]
+#USN.assignedNRet <-- USSH
+#US.usr <-- USSH
+#USEUCOM.NRetUSTacCom <-- RADMSmith
+#RADMSmith.NRetTacUsr <-- USN.assignedNRet
+
+[PolicyReachable]
+#US.friendly <-- SE
+
+[IssuerTracesAll]
+#friendly
+
+[IssuerTracesDef]
+#getsSLocs
+#NRetTacCom
+
+[SubjectTraceable]
+#usr
+#NRetUSTacCom
+#NRetTacUsr
+#assignedNRet
+
Index: fedd/abac-src/ttg/test/rtml/ussh-dde.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh-dde.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh-dde.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- edited with XML Spy v4.3 U (http://www.xmlspy.com) by Kangshi (Kangshi) -->
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demo/WEB-INF/RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD02">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/ussh.txt
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh.txt	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,51 @@
+[EntityID]
+HashCode=FakeHashKeyUSSH
+ShortName=USSH
+
+[RTML]
+CredentialStore=ussh.xml
+DDEStore=ussh-dde.xml
+ApplicationDomain=FakeHashADSD02
+
+[AccessControl]
+
+[AckPolicy]
+FakeHashKeyUSN!USN.assignedNRet=FakeHashKeyUS!US.friendly.usr
+
+[ResourcePolicy]
+
+[PrepInfo]
+USN!FakeHashKeyUS=localhost:8180/demo/us-discovery
+US!FakeHashKeyUS=localhost:8180/demo/us-discovery
+USEUCOM!FakeHashKeyUSEUCOM=localhost:8180/demo/us-discovery
+RADMSmith!FakeHashKeyRADMSmith=localhost:8180/demo/us-discovery
+USN=localhost:8180/demo/us-discovery
+US=localhost:8180/demo/us-discovery
+USEUCOM=localhost:8180/demo/us-discovery
+RADMSmith=localhost:8180/demo/us-discovery
+
+[Strategy]
+type=default
+ 
+[SelfReachable]
+#USN.assignedNRet <-- USSH
+#US.usr <-- USSH
+#USEUCOM.NRetUSTacCom <-- RADMSmith
+#RADMSmith.NRetTacUsr <-- USN.assignedNRet
+
+[PolicyReachable]
+#US.friendly <-- SE
+
+[IssuerTracesAll]
+#friendly
+
+[IssuerTracesDef]
+#getsSLocs
+#NRetTacCom
+
+[SubjectTraceable]
+#usr
+#NRetUSTacCom
+#NRetTacUsr
+#assignedNRet
+
Index: fedd/abac-src/ttg/test/rtml/ussh.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- edited with XML Spy v4.3 U (http://www.xmlspy.com) by Kangshi (Kangshi) -->
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="file:///var/tomcat4/webapps/demo/WEB-INF/RTMLv1.0q.xsd">
+	<ApplicationDomainSpecification uri="" id="FakeHashADSD02">
+		<RoleDeclaration name="friendly">
+			<Plain issuerTraces="all" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom">
+			<Plain issuerTraces="def" subjectTraces="none"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr">
+			<Plain issuerTraces="none" subjectTraces="all"/>
+		</RoleDeclaration>
+	</ApplicationDomainSpecification>
+	<Credential id="FakeHashCredential01">
+		<!-- USN.assignedNRet <- USSH -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD02"/>
+			<Principal shortName="USN">
+				<KeyHash>FakeHashKeyUSN</KeyHash>
+			</Principal>
+			<Principal shortName="USSH">
+				<KeyHash>FakeHashKeyUSSH</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="USN"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="assignedNRet" domain="s"/>
+			<PrincipalRef shortName="USSH"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+	<Credential id="FakeHashCredential02">
+		<!-- US.usr <- USSH -->
+		<Preamble>
+			<ImportDomain name="s" idref="FakeHashADSD02"/>
+			<Principal shortName="USSH">
+				<KeyHash>FakeHashKeyUSSH</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="US"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="usr" domain="s"/>
+			<PrincipalRef shortName="USSH"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
+</CredentialStore>
Index: fedd/abac-src/ttg/test/rtml/ussh/CVS/Entries
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/CVS/Entries	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,14 @@
+/credential01.xml/1.2/Sat Mar 29 00:25:02 2003//
+/credential02.xml/1.2/Sat Mar 29 00:25:02 2003//
+/credential03.xml/1.2/Sat Mar 29 00:25:02 2003//
+/credential04.xml/1.2/Sat Mar 29 00:25:02 2003//
+/credential05.xml/1.2/Sat Mar 29 00:25:02 2003//
+/signed-credential01.xml/1.1/Sat Mar 29 00:25:02 2003//
+/signed-credential02.xml/1.1/Sat Mar 29 00:25:02 2003//
+/signed-credential03.xml/1.1/Sat Mar 29 00:25:02 2003//
+/signed-credential04.xml/1.1/Sat Mar 29 00:25:02 2003//
+/signed-credential05.xml/1.1/Sat Mar 29 00:25:02 2003//
+/signed-ussh.xml/1.1/Sat Mar 29 00:25:02 2003//
+/signed-ussh.xml~/1.1/Sat Mar 29 00:25:02 2003//
+/ussh.jks/1.1/Tue Mar 25 19:50:17 2003//
+D
Index: fedd/abac-src/ttg/test/rtml/ussh/CVS/Repository
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/CVS/Repository	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+ttg/test/rtml/ussh
Index: fedd/abac-src/ttg/test/rtml/ussh/CVS/Root
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/CVS/Root	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,1 @@
+:ext:jjacobs@src.columbia.sparta.com/cvs/abac
Index: fedd/abac-src/ttg/test/rtml/ussh/credential01.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/credential01.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/credential01.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential01">
+		<!-- USN.assignedNRet <- USSH -->
+		<Preamble>
+			<ImportDomain name="s" 
+                                     idref="sfUaDpAeZKehc+igVGW/SulU+PY"/>
+			<Principal shortName="USN">
+				<KeyHash>FakeHashKeyUSN</KeyHash>
+			</Principal>
+			<Principal shortName="USSH">
+				<KeyHash>FakeHashKeyUSSH</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="USN"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="assignedNRet" domain="s"/>
+			<PrincipalRef shortName="USSH"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/credential02.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/credential02.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/credential02.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential02">
+		<!-- US.usr <- USSH -->
+		<Preamble>
+			<ImportDomain name="s" 
+                                     idref="sfUaDpAeZKehc+igVGW/SulU+PY="/>
+			<Principal shortName="USSH">
+				<KeyHash>FakeHashKeyUSSH</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="US"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="usr" domain="s"/>
+			<PrincipalRef shortName="USSH"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/credential03.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/credential03.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/credential03.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential03">
+		<!-- USEUCOM.NRetUSTacCom <- RADMSmith -->
+		<Preamble>
+			<ImportDomain name="s" 
+                                     idref="sfUaDpAeZKehc+igVGW/SulU+PY="/>
+			<Principal shortName="USEUCOM">
+				<KeyHash>FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+			<Principal shortName="RADMSmith">
+				<KeyHash>FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="USEUCOM"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="NRetUSTacCom" domain="s"/>
+			<PrincipalRef shortName="RADMSmith"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/credential04.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/credential04.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/credential04.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential04">
+		<!-- RADMSmith.NRetTacUsr <- USN.assignedNRet -->
+		<Preamble>
+			<ImportDomain name="s" 
+                                     idref="sfUaDpAeZKehc+igVGW/SulU+PY="/>
+			<Principal shortName="RADMSmith">
+				<KeyHash>FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+			<Principal shortName="USN">
+				<KeyHash>FakeHashKeyUSN</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="RADMSmith"/>
+		</Issuer>
+		<SimpleContainment>
+			<HeadRoleTerm name="NRetTacUsr" domain="s"/>
+			<ExternalRole>
+				<PrincipalRef shortName="USN"/>
+				<RoleTerm name="assignedNRet" domain="s"/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/credential05.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/credential05.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/credential05.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+	<Credential id="FakeHashCredential05">
+		<!-- US.friendly <- SE -->
+		<Preamble>
+			<ImportDomain name="s" 
+                                     idref="sfUaDpAeZKehc+igVGW/SulU+PY="/>
+			<Principal shortName="SE">
+				<KeyHash>FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US">
+				<KeyHash>FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer>
+			<PrincipalRef shortName="US"/>
+		</Issuer>
+		<SimpleMember>
+			<HeadRoleTerm name="friendly" domain="s"/>
+			<PrincipalRef shortName="SE"/>
+		</SimpleMember>
+		<ValidityTime>
+			<IssueTime>2002-09-01T13:20:00</IssueTime>
+			<NotAfter>2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	</Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/signed-credential01.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/signed-credential01.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/signed-credential01.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Credential id="FakeHashCredential01" xmlns="">
+		<!-- USN.assignedNRet <- USSH -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY" name="s" xmlns=""/>
+			<Principal shortName="USN" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSN</KeyHash>
+			</Principal>
+			<Principal shortName="USSH" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSSH</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="USN" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="assignedNRet" xmlns=""/>
+			<PrincipalRef shortName="USSH" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">WiN7isNRlR968uck+pYDNorfGMVKG8WunEWMx9GXJeKC6tS5C6IUcw==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC+zCCArkCBD6AqGQwCwYHKoZIzjgEAwUAMGMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdVbmtu
+b3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3du
+MQwwCgYDVQQDEwNVU04wHhcNMDMwMzI1MTkwNTA4WhcNMDMwNjIzMTkwNTA4WjBjMQswCQYDVQQG
+EwJVUzEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93
+bjEQMA4GA1UECxMHVW5rbm93bjEMMAoGA1UEAxMDVVNOMIIBuDCCASwGByqGSM44BAEwggEfAoGB
+AP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7
+gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXz
+rith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhX
+uXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o
+4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoD
+gYUAAoGBAKC9uuqy7uEA61tBQFIR6TQpNXJhe0SXk6yiduT+hetf0SsaFJ4r8sLGZFol5PEbACyR
+v/HZngOaQEO2GTzZ//Q/v1mhP3GtRV/6sKqkIteKbqqqBU58143BUtltk8FxCEHuGuCKs044pMnZ
+LjhG9WE+EW3ksK1CxOEpPCjV0TwoMAsGByqGSM44BAMFAAMvADAsAhQrONJ2jp9AE1TvYsxF83Zk
+05py6wIUSPZuM85meqe7h7+CZNLTAVIZ8vI=
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/signed-credential02.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/signed-credential02.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/signed-credential02.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Credential id="FakeHashCredential02" xmlns="">
+		<!-- US.usr <- USSH -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="USSH" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSSH</KeyHash>
+			</Principal>
+			<Principal shortName="US" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="US" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="usr" xmlns=""/>
+			<PrincipalRef shortName="USSH" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">CUMOleTexvXafsquxW0fUZKn1zVuMqFRE/sZdQ/65tVu7Y+MqQw78g==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC+TCCArcCBD6AqHIwCwYHKoZIzjgEAwUAMGIxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdVbmtu
+b3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3du
+MQswCQYDVQQDEwJVUzAeFw0wMzAzMjUxOTA1MjJaFw0wMzA2MjMxOTA1MjJaMGIxCzAJBgNVBAYT
+AlVTMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3du
+MRAwDgYDVQQLEwdVbmtub3duMQswCQYDVQQDEwJVUzCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9
+f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4Ad
+NG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864r
+Ydcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5
+lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
+rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GF
+AAKBgQCpfE80whmY35VhJRLufdz/Wjt0NTbR/Tqw04yH3BJQlE3TX+aJa0AkbsmxitRXKwm6ySox
+cE+TKHM16aHZ62/D0a0K5SkpCHD+DxSu4YVWUOwAJLV+a2P+iwPYSDEwiXQbgoP0rDCb50ha15Bl
+lDNhQErHk6vCgRu0wcL0Ms+VpTALBgcqhkjOOAQDBQADLwAwLAIUTfFudeSD58KPqSB7sLUDNbe8
+FqYCFEFFs0tBkHCeBdKszRWdVHybFx1G
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/signed-credential03.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/signed-credential03.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/signed-credential03.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Credential id="FakeHashCredential03" xmlns="">
+		<!-- USEUCOM.NRetUSTacCom <- RADMSmith -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="USEUCOM" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+			<Principal shortName="RADMSmith" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="USEUCOM" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="NRetUSTacCom" xmlns=""/>
+			<PrincipalRef shortName="RADMSmith" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">hoAe74xINpvdOzo8P//t46EY5jRjS3Stqz9b45NJRFzeif+T10vTgw==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIDDDCCAsoCBD6AqIMwCwYHKoZIzjgEAwUAMGwxEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgT
+B1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vu
+a25vd24xEDAOBgNVBAMTB3VzZXVjb20wHhcNMDMwMzI1MTkwNTM5WhcNMDMwNjIzMTkwNTM5WjBs
+MRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAw
+DgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwd1c2V1Y29tMIIBtzCC
+ASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7
+WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E
++4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUC
+gYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6Ewo
+FhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWf
+BpKLZl6Ae1UlZAFMO/7PSSoDgYQAAoGALtnRkwjZAILMKKL4USbwfTREsv3HjUw0SITuTX9kmycF
+57zzttWOpszz9HZTVvpMMCyDGr3M0US/flLBXEw4/CSzbOVy91LY2tjt+RDs88DJ8sfi3r81XksK
+BieKuVhVh8o9h+LZF8hVZcGUk5Ry6W62B4sSwVY+9rqQ9RCDnxYwCwYHKoZIzjgEAwUAAy8AMCwC
+FHkk/ZoCY+1Nps6OsbV/fFB1X0RwAhQqFKyWHJi5gay8+cZiVg4ur596sA==
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/signed-credential04.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/signed-credential04.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/signed-credential04.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Credential id="FakeHashCredential04" xmlns="">
+		<!-- RADMSmith.NRetTacUsr <- USN.assignedNRet -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="RADMSmith" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+			<Principal shortName="USN" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSN</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="RADMSmith" xmlns=""/>
+		</Issuer>
+		<SimpleContainment xmlns="">
+			<HeadRoleTerm domain="s" name="NRetTacUsr" xmlns=""/>
+			<ExternalRole xmlns="">
+				<PrincipalRef shortName="USN" xmlns=""/>
+				<RoleTerm domain="s" name="assignedNRet" xmlns=""/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">Eg5rggOp2FE3x+f5dlp4bCNJyzeJtgJmyZpQxhP2vOhrLW/Pv5L8hQ==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIDETCCAs8CBD6AqJQwCwYHKoZIzjgEAwUAMG4xEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgT
+B1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vu
+a25vd24xEjAQBgNVBAMTCVJBZG1TbWl0aDAeFw0wMzAzMjUxOTA1NTZaFw0wMzA2MjMxOTA1NTZa
+MG4xEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24x
+EDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEjAQBgNVBAMTCVJBZG1TbWl0aDCC
+AbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVd
+QCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58ao
+phUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvw
+WBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZx
+I+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf
+4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQC7vIiQvH1Eh8HfUBpE7OMm82s3t574RmlbEMPW
+taFHHS1soKbi+czvaw2A+cE7GLFTHKh8Wr8frCBYOSxBmvxzLr1VsIdDiZ3ogzZVOzpM7L0BNQmF
+T9VcaoallPlYP3u5YdBTQFsO1zUK3n2Zdh74BUolr5tlNAdTiBZkFHI9aDALBgcqhkjOOAQDBQAD
+LwAwLAIUbopgJPvB3wnA5ZrCUEP3BG70OMcCFAqcZQJKiz6CY1oFxNH7Y0uTQxxM
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/signed-credential05.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/signed-credential05.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/signed-credential05.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Credential id="FakeHashCredential05" xmlns="">
+		<!-- US.friendly <- SE -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="SE" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="US" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="friendly" xmlns=""/>
+			<PrincipalRef shortName="SE" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">lcSNxI0Z7pso9dP0zHsCoZv/65paEmzz38NPk4OBWQh30cwkaVcS9w==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC+TCCArcCBD6AqHIwCwYHKoZIzjgEAwUAMGIxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdVbmtu
+b3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3du
+MQswCQYDVQQDEwJVUzAeFw0wMzAzMjUxOTA1MjJaFw0wMzA2MjMxOTA1MjJaMGIxCzAJBgNVBAYT
+AlVTMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3du
+MRAwDgYDVQQLEwdVbmtub3duMQswCQYDVQQDEwJVUzCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9
+f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4Ad
+NG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864r
+Ydcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5
+lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
+rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GF
+AAKBgQCpfE80whmY35VhJRLufdz/Wjt0NTbR/Tqw04yH3BJQlE3TX+aJa0AkbsmxitRXKwm6ySox
+cE+TKHM16aHZ62/D0a0K5SkpCHD+DxSu4YVWUOwAJLV+a2P+iwPYSDEwiXQbgoP0rDCb50ha15Bl
+lDNhQErHk6vCgRu0wcL0Ms+VpTALBgcqhkjOOAQDBQADLwAwLAIUTfFudeSD58KPqSB7sLUDNbe8
+FqYCFEFFs0tBkHCeBdKszRWdVHybFx1G
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
Index: fedd/abac-src/ttg/test/rtml/ussh/signed-ussh.xml
===================================================================
--- fedd/abac-src/ttg/test/rtml/ussh/signed-ussh.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
+++ fedd/abac-src/ttg/test/rtml/ussh/signed-ussh.xml	(revision 8780cbecc6db2bdc2b9ef31eec6e5209ad3bff15)
@@ -0,0 +1,308 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<CredentialStore xmlns="http://crypto.stanford.edu/dc/RTMLv1.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://crypto.stanford.edu/dc/RTMLv1.0
+  file:///home/jay/rtml/schemas/RTMLv1.0q.xsd">
+<ApplicationDomainSpecification id="sfUaDpAeZKehc+igVGW/SulU+PY=" uri="" xmlns="">
+		<RoleDeclaration name="friendly" xmlns="">
+			<Plain issuerTraces="all" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="getsSLocs" xmlns="">
+			<Plain issuerTraces="def" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacCom" xmlns="">
+			<Plain issuerTraces="def" subjectTraces="none" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="usr" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetTacUsr" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="NRetUSTacCom" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="assignedNRet" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+		<RoleDeclaration name="friendlyUsr" xmlns="">
+			<Plain issuerTraces="none" subjectTraces="all" xmlns=""/>
+		</RoleDeclaration>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:Reference URI="#xpointer(/)" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:Transforms xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:Transforms>
+<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:DigestValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:Reference>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+</ds:KeyInfo>
+</ds:Signature><ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:Reference URI="#xpointer(/)" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:Transforms xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:Transforms>
+<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:DigestValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:Reference>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+</ds:KeyInfo>
+</ds:Signature></ApplicationDomainSpecification>
+<Credential id="FakeHashCredential01" xmlns="">
+		<!-- USN.assignedNRet <- USSH -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY" name="s" xmlns=""/>
+			<Principal shortName="USN" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSN</KeyHash>
+			</Principal>
+			<Principal shortName="USSH" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSSH</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="USN" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="assignedNRet" xmlns=""/>
+			<PrincipalRef shortName="USSH" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">WiN7isNRlR968uck+pYDNorfGMVKG8WunEWMx9GXJeKC6tS5C6IUcw==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC+zCCArkCBD6AqGQwCwYHKoZIzjgEAwUAMGMxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdVbmtu
+b3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3du
+MQwwCgYDVQQDEwNVU04wHhcNMDMwMzI1MTkwNTA4WhcNMDMwNjIzMTkwNTA4WjBjMQswCQYDVQQG
+EwJVUzEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93
+bjEQMA4GA1UECxMHVW5rbm93bjEMMAoGA1UEAxMDVVNOMIIBuDCCASwGByqGSM44BAEwggEfAoGB
+AP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7
+gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXz
+rith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtcNrhX
+uXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim4TwWeotUfI0o
+4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoD
+gYUAAoGBAKC9uuqy7uEA61tBQFIR6TQpNXJhe0SXk6yiduT+hetf0SsaFJ4r8sLGZFol5PEbACyR
+v/HZngOaQEO2GTzZ//Q/v1mhP3GtRV/6sKqkIteKbqqqBU58143BUtltk8FxCEHuGuCKs044pMnZ
+LjhG9WE+EW3ksK1CxOEpPCjV0TwoMAsGByqGSM44BAMFAAMvADAsAhQrONJ2jp9AE1TvYsxF83Zk
+05py6wIUSPZuM85meqe7h7+CZNLTAVIZ8vI=
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential02" xmlns="">
+		<!-- US.usr <- USSH -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="USSH" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSSH</KeyHash>
+			</Principal>
+			<Principal shortName="US" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="US" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="usr" xmlns=""/>
+			<PrincipalRef shortName="USSH" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">CUMOleTexvXafsquxW0fUZKn1zVuMqFRE/sZdQ/65tVu7Y+MqQw78g==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC+TCCArcCBD6AqHIwCwYHKoZIzjgEAwUAMGIxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdVbmtu
+b3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3du
+MQswCQYDVQQDEwJVUzAeFw0wMzAzMjUxOTA1MjJaFw0wMzA2MjMxOTA1MjJaMGIxCzAJBgNVBAYT
+AlVTMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3du
+MRAwDgYDVQQLEwdVbmtub3duMQswCQYDVQQDEwJVUzCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9
+f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4Ad
+NG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864r
+Ydcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5
+lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
+rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GF
+AAKBgQCpfE80whmY35VhJRLufdz/Wjt0NTbR/Tqw04yH3BJQlE3TX+aJa0AkbsmxitRXKwm6ySox
+cE+TKHM16aHZ62/D0a0K5SkpCHD+DxSu4YVWUOwAJLV+a2P+iwPYSDEwiXQbgoP0rDCb50ha15Bl
+lDNhQErHk6vCgRu0wcL0Ms+VpTALBgcqhkjOOAQDBQADLwAwLAIUTfFudeSD58KPqSB7sLUDNbe8
+FqYCFEFFs0tBkHCeBdKszRWdVHybFx1G
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential03" xmlns="">
+		<!-- USEUCOM.NRetUSTacCom <- RADMSmith -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="USEUCOM" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSEUCOM</KeyHash>
+			</Principal>
+			<Principal shortName="RADMSmith" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="USEUCOM" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="NRetUSTacCom" xmlns=""/>
+			<PrincipalRef shortName="RADMSmith" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">hoAe74xINpvdOzo8P//t46EY5jRjS3Stqz9b45NJRFzeif+T10vTgw==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIDDDCCAsoCBD6AqIMwCwYHKoZIzjgEAwUAMGwxEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgT
+B1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vu
+a25vd24xEDAOBgNVBAMTB3VzZXVjb20wHhcNMDMwMzI1MTkwNTM5WhcNMDMwNjIzMTkwNTM5WjBs
+MRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAw
+DgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwd1c2V1Y29tMIIBtzCC
+ASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7
+WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E
++4P208UewwI1VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUC
+gYEA9+GghdabPd7LvKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6Ewo
+FhO3zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/hWuWf
+BpKLZl6Ae1UlZAFMO/7PSSoDgYQAAoGALtnRkwjZAILMKKL4USbwfTREsv3HjUw0SITuTX9kmycF
+57zzttWOpszz9HZTVvpMMCyDGr3M0US/flLBXEw4/CSzbOVy91LY2tjt+RDs88DJ8sfi3r81XksK
+BieKuVhVh8o9h+LZF8hVZcGUk5Ry6W62B4sSwVY+9rqQ9RCDnxYwCwYHKoZIzjgEAwUAAy8AMCwC
+FHkk/ZoCY+1Nps6OsbV/fFB1X0RwAhQqFKyWHJi5gay8+cZiVg4ur596sA==
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential04" xmlns="">
+		<!-- RADMSmith.NRetTacUsr <- USN.assignedNRet -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="RADMSmith" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyRADMSmith</KeyHash>
+			</Principal>
+			<Principal shortName="USN" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUSN</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="RADMSmith" xmlns=""/>
+		</Issuer>
+		<SimpleContainment xmlns="">
+			<HeadRoleTerm domain="s" name="NRetTacUsr" xmlns=""/>
+			<ExternalRole xmlns="">
+				<PrincipalRef shortName="USN" xmlns=""/>
+				<RoleTerm domain="s" name="assignedNRet" xmlns=""/>
+			</ExternalRole>
+		</SimpleContainment>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">Eg5rggOp2FE3x+f5dlp4bCNJyzeJtgJmyZpQxhP2vOhrLW/Pv5L8hQ==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIDETCCAs8CBD6AqJQwCwYHKoZIzjgEAwUAMG4xEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgT
+B1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xEDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vu
+a25vd24xEjAQBgNVBAMTCVJBZG1TbWl0aDAeFw0wMzAzMjUxOTA1NTZaFw0wMzA2MjMxOTA1NTZa
+MG4xEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24x
+EDAOBgNVBAoTB1Vua25vd24xEDAOBgNVBAsTB1Vua25vd24xEjAQBgNVBAMTCVJBZG1TbWl0aDCC
+AbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVd
+QCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58ao
+phUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvw
+WBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZx
+I+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf
+4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQC7vIiQvH1Eh8HfUBpE7OMm82s3t574RmlbEMPW
+taFHHS1soKbi+czvaw2A+cE7GLFTHKh8Wr8frCBYOSxBmvxzLr1VsIdDiZ3ogzZVOzpM7L0BNQmF
+T9VcaoallPlYP3u5YdBTQFsO1zUK3n2Zdh74BUolr5tlNAdTiBZkFHI9aDALBgcqhkjOOAQDBQAD
+LwAwLAIUbopgJPvB3wnA5ZrCUEP3BG70OMcCFAqcZQJKiz6CY1oFxNH7Y0uTQxxM
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+<Credential id="FakeHashCredential05" xmlns="">
+		<!-- US.friendly <- SE -->
+		<Preamble xmlns="">
+			<ImportDomain idref="sfUaDpAeZKehc+igVGW/SulU+PY=" name="s" xmlns=""/>
+			<Principal shortName="SE" xmlns="">
+				<KeyHash xmlns="">FakeHashKeySE</KeyHash>
+			</Principal>
+			<Principal shortName="US" xmlns="">
+				<KeyHash xmlns="">FakeHashKeyUS</KeyHash>
+			</Principal>
+		</Preamble>
+		<Issuer xmlns="">
+			<PrincipalRef shortName="US" xmlns=""/>
+		</Issuer>
+		<SimpleMember xmlns="">
+			<HeadRoleTerm domain="s" name="friendly" xmlns=""/>
+			<PrincipalRef shortName="SE" xmlns=""/>
+		</SimpleMember>
+		<ValidityTime xmlns="">
+			<IssueTime xmlns="">2002-09-01T13:20:00</IssueTime>
+			<NotAfter xmlns="">2004-09-01T13:20:00</NotAfter>
+		</ValidityTime>
+	<ds:Signature xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:SignedInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1" xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
+</ds:SignedInfo>
+<ds:SignatureValue xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">lcSNxI0Z7pso9dP0zHsCoZv/65paEmzz38NPk4OBWQh30cwkaVcS9w==</ds:SignatureValue>
+<ds:KeyInfo xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Data xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:X509Certificate xmlns="" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+MIIC+TCCArcCBD6AqHIwCwYHKoZIzjgEAwUAMGIxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdVbmtu
+b3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3du
+MQswCQYDVQQDEwJVUzAeFw0wMzAzMjUxOTA1MjJaFw0wMzA2MjMxOTA1MjJaMGIxCzAJBgNVBAYT
+AlVTMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3du
+MRAwDgYDVQQLEwdVbmtub3duMQswCQYDVQQDEwJVUzCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9
+f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4Ad
+NG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864r
+Ydcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5
+lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCj
+rh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GF
+AAKBgQCpfE80whmY35VhJRLufdz/Wjt0NTbR/Tqw04yH3BJQlE3TX+aJa0AkbsmxitRXKwm6ySox
+cE+TKHM16aHZ62/D0a0K5SkpCHD+DxSu4YVWUOwAJLV+a2P+iwPYSDEwiXQbgoP0rDCb50ha15Bl
+lDNhQErHk6vCgRu0wcL0Ms+VpTALBgcqhkjOOAQDBQADLwAwLAIUTfFudeSD58KPqSB7sLUDNbe8
+FqYCFEFFs0tBkHCeBdKszRWdVHybFx1G
+</ds:X509Certificate>
+</ds:X509Data>
+</ds:KeyInfo>
+</ds:Signature></Credential>
+</CredentialStore>
