Index: fedd/federation/access.py
===================================================================
--- fedd/federation/access.py	(revision b16cfc062bf2ad22389b652f4a534664ab49abb5)
+++ fedd/federation/access.py	(revision c65b7e44d76ff77acd3472ac8e4e61d96efa62f5)
@@ -233,4 +233,44 @@
                 self.log.warning(("[read_state]: No saved state: " + \
                         "Unpickling failed: %s") % e)
+
+    def append_allocation_authorization(self, aid, attrs, 
+	    need_state_lock=False, write_state_file=False, state_attr='state'):
+	"""
+	Append the authorization information to system state.  By default we
+	assume this is called with the state lock and with a write of the state
+	file in the near future, need_state_lock and write_state_file can
+	override this.  The state_attr is the attribute in the access class
+	that holds the per allocation information.  Some complex classes use
+	different names for the dict.
+	"""
+
+	for p, a in attrs:
+	    self.auth.set_attribute(p, a)
+	self.auth.save()
+
+	if need_state_lock: self.state_lock.acquire()
+	d = getattr(self, state_attr)
+	if aid in d and 'auth' in d[aid]:
+	    d[aid]['auth'].update(attrs)
+	if write_state_file: self.write_state()
+	if need_state_lock: self.state_lock.release()
+
+    def clear_allocation_authorization(self, aid, need_state_lock=False,
+	    write_state_file=False, state_attr='state'):
+	"""
+	Attrs is a set of attribute principal pairs that need to be removed
+	from the authenticator.  Remove them and save the authenticator.  See
+	append_allocation_authorization for the various overrides.
+	"""
+
+	if need_state_lock: self.state_lock.acquire()
+	d = getattr(self, state_attr)
+	if aid in d and 'auth' in d[aid]:
+	    for p, a in d[aid]['auth']:
+		self.auth.unset_attribute(p, a)
+	    d[aid]['auth'] = set()
+	if write_state_file: self.write_state()
+	if need_state_lock: self.state_lock.release()
+	self.auth.save()
 
     def lookup_access(self, req, fid, filter=None, compare=None): 
Index: fedd/federation/deter_internal_access.py
===================================================================
--- fedd/federation/deter_internal_access.py	(revision b16cfc062bf2ad22389b652f4a534664ab49abb5)
+++ fedd/federation/deter_internal_access.py	(revision c65b7e44d76ff77acd3472ac8e4e61d96efa62f5)
@@ -166,9 +166,9 @@
 	self.state[aid]['owners'] = owners
 	self.state[aid]['vlan'] = None
+	self.state[aid]['auth'] = set()
+	self.append_allocation_authorization(aid, 
+		((fid, allocID),(allocID, allocID)))
 	self.write_state()
 	self.state_lock.release()
-	self.auth.set_attribute(fid, allocID)
-	self.auth.set_attribute(allocID, allocID)
-	self.auth.save()
 
 	try:
@@ -209,4 +209,5 @@
 	if self.state.has_key(aid):
 	    self.log.debug("Found allocation for %s" %aid)
+	    self.clear_allocation_authorization(aid)
 	    del self.state[aid]
 	    self.write_state()
Index: fedd/federation/dragon_access.py
===================================================================
--- fedd/federation/dragon_access.py	(revision b16cfc062bf2ad22389b652f4a534664ab49abb5)
+++ fedd/federation/dragon_access.py	(revision c65b7e44d76ff77acd3472ac8e4e61d96efa62f5)
@@ -149,9 +149,9 @@
 	self.state[aid]['user'] = found
 	self.state[aid]['owners'] = owners
+	self.state[aid]['auth'] = set()
+	self.append_allocation_authorization(aid, 
+		((fid, allocID),(allocID, allocID)))
 	self.write_state()
 	self.state_lock.release()
-	self.auth.set_attribute(fid, allocID)
-	self.auth.set_attribute(allocID, allocID)
-	self.auth.save()
 
 	try:
@@ -191,4 +191,5 @@
 	if self.state.has_key(aid):
 	    self.log.debug("Found allocation for %s" %aid)
+	    self.clear_allocation_authorization(aid)
 	    del self.state[aid]
 	    self.write_state()
Index: fedd/federation/emulab_access.py
===================================================================
--- fedd/federation/emulab_access.py	(revision b16cfc062bf2ad22389b652f4a534664ab49abb5)
+++ fedd/federation/emulab_access.py	(revision c65b7e44d76ff77acd3472ac8e4e61d96efa62f5)
@@ -254,5 +254,4 @@
 		    'Bad mapping (unbalanced parens or more than 1 comma)')
 
-
     # RequestAccess support routines
 
@@ -384,4 +383,5 @@
 	self.state_lock.acquire()
 	self.allocation[aid] = { }
+	self.allocation[aid]['auth'] = set()
 	try:
 	    pname = ap['project']['name']['localname']
@@ -511,10 +511,8 @@
 	for k, v in svc_state.items():
 	    self.allocation[aid][k] = v
+	self.append_allocation_authorization(aid, 
+		set([(o, allocID) for o in owners]), state_attr='allocation')
 	self.write_state()
 	self.state_lock.release()
-	# Give the owners the right to change this allocation
-	for o in owners:
-	    self.auth.set_attribute(o, allocID)
-	self.auth.save()
 	try:
 	    f = open("%s/%s.pem" % (self.certdir, aid), "w")
@@ -591,4 +589,5 @@
 	if aid in self.allocation:
 	    self.log.debug("Found allocation for %s" %aid)
+	    self.clear_allocation_authorization(aid, state_attr='allocation')
 	    for k in self.allocation[aid]['keys']:
 		kk = "%s:%s" % k
Index: fedd/federation/protogeni_access.py
===================================================================
--- fedd/federation/protogeni_access.py	(revision b16cfc062bf2ad22389b652f4a534664ab49abb5)
+++ fedd/federation/protogeni_access.py	(revision c65b7e44d76ff77acd3472ac8e4e61d96efa62f5)
@@ -275,9 +275,9 @@
 	# The list of owner FIDs
 	self.allocation[aid]['owners'] = owners
+	self.allocation[aid]['auth'] = set()
+	self.append_allocation_authorization(aid, 
+		((fid, allocID), (allocID, allocID)), state_attr='allocation')
 	self.write_state()
 	self.state_lock.release()
-	self.auth.set_attribute(fid, allocID)
-	self.auth.set_attribute(allocID, allocID)
-	self.auth.save()
 
 	try:
@@ -319,4 +319,5 @@
 	if self.allocation.has_key(aid):
 	    self.log.debug("Found allocation for %s" %aid)
+	    self.clear_allocation_authorization(aid, state_attr='allocation')
 	    del self.allocation[aid]
 	    self.write_state()
Index: fedd/federation/skeleton_access.py
===================================================================
--- fedd/federation/skeleton_access.py	(revision b16cfc062bf2ad22389b652f4a534664ab49abb5)
+++ fedd/federation/skeleton_access.py	(revision c65b7e44d76ff77acd3472ac8e4e61d96efa62f5)
@@ -194,11 +194,11 @@
 	self.state[aid]['user'] = found
 	self.state[aid]['owners'] = owners
+	self.state[aid]['auth'] = set()
+	# Authorize the creating fedid and the principal representing the
+	# allocation to manipulate it.
+	self.append_allocation_authorization(aid, 
+		((fid, allocID), (allocID, allocID)))
 	self.write_state()
 	self.state_lock.release()
-	# Authorize the creating fedid and the principal representing the
-	# allocation to manipulate it.
-	self.auth.set_attribute(fid, allocID)
-	self.auth.set_attribute(allocID, allocID)
-	self.auth.save()
 
 	# Create a directory to stash the certificate in, ans stash it.
@@ -249,4 +249,5 @@
 	if aid in self.state:
 	    self.log.debug("[ReleaseAccess] Found allocation for %s" %aid)
+	    self.clear_allocation_authorization(aid)
 	    del self.state[aid]
 	    self.write_state()
