Index: fedd/federation/skeleton_access.py
===================================================================
--- fedd/federation/skeleton_access.py	(revision a0e20ac9b983ad9453dac1479b7e33a36fcbab73)
+++ fedd/federation/skeleton_access.py	(revision b7a61ac1c0824517cb25f8f1628595b8ee50e799)
@@ -11,5 +11,5 @@
 from util import *
 from fedid import fedid, generate_fedid
-from authorizer import authorizer
+from authorizer import authorizer, abac_authorizer
 from service_error import service_error
 from remote_service import xmlrpc_handler, soap_handler, service_caller
@@ -64,5 +64,5 @@
 	here.
 
-	The access database maps users to a simple string.  Use the sample at.
+	The access database maps users to a simple string.
         """
 
@@ -74,45 +74,67 @@
 	# The available integers
 	self.available_ints = set(range(0,self.maxint))
-	# This will contain the local data from a successful access request.
-	# Keys are the valid three-names, and values are the locally
-	# interpreted data.
-        self.access = { }
-	# Read the access values.  We read the accessDB in the derived class so
-	# that the derived class can specialize the reading of access info.  In
-	# this case, we gather the strings in the access db into self.access
-	# using the translator above.
-        if config.has_option("access", "accessdb"):
-	    try:
-		self.read_access(config.get("access", "accessdb"), 
-			self.parse_access_string)
-	    except EnvironmentError, e:
-		self.log.error("Cannot read %s: %s" % \
-			(config.get("access", "accessdb"), e))
-		raise e
-
-	# The base class initializer has read the state dictionary from the
-	# state file, if there is one.  The state variable includes information
-	# about each active allocation, keyed by the allocation identifier.
-	# This loop extracts the owners stored with each allocation and
-	# associates an access attribute with them.  Each owner is allowed to
-	# access each thing they own.  This is a specialization of the state
-	# handling.
+
+	# authorization information
+	self.auth_type = config.get('access', 'auth_type') \
+		or 'legacy'
+	self.auth_dir = config.get('access', 'auth_dir')
+	accessdb = config.get("access", "accessdb")
+	# initialize the authorization system.  In each case we make a call to
+	# read the access database that maps from authorization information
+	# into local information.  The local information is parsed by the
+	# translator above.
+	if self.auth_type == 'legacy':
+	    self.access = { }
+	    if accessdb:
+		try:
+		    self.legacy_read_access(accessdb, self.parse_access_string)
+		except EnvironmentError, e:
+		    self.log.error("Cannot read %s: %s" % \
+			    (config.get("access", "accessdb"), e))
+		    raise e
+	    # The base class initializer has read the state dictionary from the
+	    # state file, if there is one.  The state variable includes
+	    # information about each active allocation, keyed by the allocation
+	    # identifier.  This loop extracts the owners stored with each
+	    # allocation and associates an access attribute with them.  Each
+	    # owner is allowed to access each thing they own.  This is a
+	    # specialization of the state handling.  ABAC records this
+	    # information explicitly so this loop only executes for legacy
+	    # code.
+	    self.state_lock.acquire()
+	    for k in self.state.keys():
+		# Add the owners
+		for o in self.state[k].get('owners', []):
+		    self.auth.set_attribute(o, fedid(hexstr=k))
+		# The principal represented by the allocation itself is also
+		# allowed to make accesses.
+		self.auth.set_attribute(fedid(hexstr=k),fedid(hexstr=k))
+	    self.state_lock.release()
+	    # This access controller does not specialize the process of looking
+	    # up local information.  This aliases the lookup_access method to
+	    # be easier to read.
+	    self.lookup_access = self.legacy_lookup_access_base
+	elif self.auth_type == 'abac':
+	    #  Load the current authorization state
+	    self.auth = abac_authorizer(load=self.auth_dir)
+	    self.access = [ ]
+	    if accessdb:
+		try:
+		    self.read_access(accessdb, self.parse_access_string)
+		except EnvironmentError, e:
+		    self.log.error("Cannot read %s: %s" % \
+			    (config.get("access", "accessdb"), e))
+		    raise e
+	else:
+	    raise service_error(service_error.internal, 
+		    "Unknown auth_type: %s" % self.auth_type)
+
+	# Clean the state
 	self.state_lock.acquire()
 	for k in self.state.keys():
-	    # Add the owners
-	    for o in self.state[k].get('owners', []):
-		self.auth.set_attribute(o, fedid(hexstr=k))
-	    # The principal represented by the allocation itself is also
-	    # allowed to make accesses.
-	    self.auth.set_attribute(fedid(hexstr=k),fedid(hexstr=k))
 	    # Remove any allocated integers from the available ones
 	    if 'integer' in self.state[k]:
 		self.available_ints.discard(self.state[k]['integer'])
 	self.state_lock.release()
-
-	# This access controller does not specialize the process of looking up
-	# local information.  This aliases the lookup_access method to be
-	# easier to read.
-	self.lookup_access = self.lookup_access_base
 
 	# These dictionaries register the plug-in's local routines for handline
@@ -158,5 +180,5 @@
 	# exception denying access that triggers a fault response back to the
 	# caller.
-	found, match = self.lookup_access(req, fid)
+	found, match, owners = self.lookup_access(req, fid)
 	self.log.info(
 		"[RequestAccess] Access granted to %s with local creds %s" % \
@@ -170,5 +192,5 @@
 	self.state[aid] = { }
 	self.state[aid]['user'] = found
-	self.state[aid]['owners'] = [ fid ]
+	self.state[aid]['owners'] = owners
 	self.write_state()
 	self.state_lock.release()
@@ -177,4 +199,5 @@
 	self.auth.set_attribute(fid, allocID)
 	self.auth.set_attribute(allocID, allocID)
+	self.auth.save()
 
 	# Create a directory to stash the certificate in, ans stash it.
