Index: fedd/access_to_abac.py
===================================================================
--- fedd/access_to_abac.py	(revision c324ad3254730c1436e8bd4ac106e49dd7195996)
+++ fedd/access_to_abac.py	(revision d894c213ff791f1f84c94d7ebc22bd2e90bd6ab7)
@@ -4,9 +4,13 @@
 import re
 import subprocess
+import os.path
 
 from string import join
+from optparse import OptionParser, OptionValueError
+from tempfile import mkdtemp
+
 from federation.fedid import fedid
+from federation.authorizer import abac_authorizer
 from federation.util import abac_split_cert, abac_pem_type
-from optparse import OptionParser, OptionValueError
 
 
@@ -179,4 +183,43 @@
 # internal plug-ins have no local attributes.
 def parse_internal(l, creds, me, to_id, p, gp, gu, lr): pass
+
+
+def parse_access(fn, mapper):
+    """
+    Parse the access file, calling out to the mapper to parse specific
+    credential types.  Mappers are above this code.
+    """
+    creds = set()
+    to_id = { }
+    f = open(fn, "r")
+    for i, l in enumerate(f):
+	try:
+	    if comment_re.match(l):
+		continue
+	    else:
+		m =  line_re.match(l)
+		if m:
+		    p, da = m.group(1, 4)
+		    gp, gu = m.group(2, 3)
+		    if gp == '<any>': gp = None
+		    if gu == '<any>': gu = None
+
+		    creds.add(credential(me, da, 
+			    [attribute(p, x, delegation_link) \
+				    for x in (gp, gu) \
+					if x is not None]))
+		    if m.group(5) and mapper:
+			mapper(m.group(5), creds, me, to_id, p, gp, gu,
+				delegation_link)
+		else:
+		    raise parse_error('Syntax error')
+	except parse_error, e:
+	    f.close()
+	    raise parse_error('Error on line %d of %s: %s' % \
+		    (i, fn, e.message))
+    f.close()
+
+    return creds, to_id
+
 
 
@@ -233,4 +276,6 @@
 		help='do not accept delegated attributes with the ' +\
 			'acting_for linking role')
+	self.add_option('--auth', action='store_true', dest='create_auth', 
+		default=False, help='create a full ABAC authorizer')
 	self.add_option('--debug', action='store_true', dest='debug', 
 		default=False, help='Just print actions')
@@ -273,4 +318,9 @@
 		raise credential_error("%s: %d" % (join(cmd), rv))
 
+def clear_dir(dir):
+    for path, dirs, files in os.walk(dir, topdown=False):
+	for f in files: os.unlink(os.path.join(path, f))
+	for d in dirs: os.rmdir(os.path.join(path, d))
+
 # Regular expressions and parts thereof for parsing
 comment_re = re.compile('^\s*#|^$')
@@ -290,4 +340,5 @@
 cert, key = None, None
 delete_certs = False
+delete_creds = False
 
 if opts.file:
@@ -315,4 +366,12 @@
 	sys.exit('%s is not writable' % opts.dir)
 
+if opts.create_auth:
+    creds_dir = mkdtemp()
+    delete_creds = True
+    auth_dir = opts.dir
+else:
+    creds_dir = opts.dir
+    auth_dir = None
+
 if opts.delegate: delegation_link = 'acting_for'
 else: delegation_link = None
@@ -341,35 +400,6 @@
     # Do the parsing
     for fn in args:
-	creds = set()
-	to_id = { }
 	try:
-	    f = open(fn, "r")
-	    for i, l in enumerate(f):
-		try:
-		    if comment_re.match(l):
-			continue
-		    else:
-			m =  line_re.match(l)
-			if m:
-			    p, da = m.group(1, 4)
-			    gp, gu = m.group(2, 3)
-			    if gp == '<any>': gp = None
-			    if gu == '<any>': gu = None
-
-			    creds.add(credential(me, da, 
-				    [attribute(p, x, delegation_link) \
-					    for x in (gp, gu) \
-						if x is not None]))
-			    if m.group(5) and mapper:
-				mapper(m.group(5), creds, me, to_id, p, gp, gu,
-					delegation_link)
-			else:
-			    raise parse_error('Syntax error')
-		except parse_error, e:
-		    f.close()
-		    raise parse_error('Error on line %d of %s: %s' % \
-			    (i, fn, e.message))
-		    
-	    f.close()
+	    creds, to_id = parse_access(fn, mapper)
 	except parse_error, e:
 	    print >> sys.stderr, "%s" % e
@@ -386,9 +416,10 @@
 		try:
 		    create_creds([c for c in creds if c.principal == me],
-			    cert, key, opts.dir, opts.debug)
+			    cert, key, creds_dir, opts.debug)
 		except credential_error, e:
 		    sys.exit('Credential creation failed: %s' % e)
 	    else:
-		print >>sys.stderr, 'Cannot create credentials.  Missing parameter'
+		print >>sys.stderr, 'Cannot create credentials.  ' + \
+			'Missing parameter'
 
 	# Local map output
@@ -403,7 +434,31 @@
 			print >>f, "%s -> (%s)" % ( a, join(k, ', '))
 	    except EnvironmentError, e:
-		sys.exit("Cannot open %s: %s" % (e.filename or '!?', e.strerror))
+		sys.exit("Cannot open %s: %s" % (e.filename or '!?', 
+		    e.strerror))
+
+	# Create an authorizer if requested.
+	if opts.create_auth:
+	    clear_dir(auth_dir)
+	    try:
+		# Pass in the options rather than the potentially split key
+		# because abac_authorizer will split it and store it
+		# internally.  The opts.cert may get split twice, but we won't
+		# lose one.
+		a = abac_authorizer(key=opts.key, me=opts.cert, 
+			certs=creds_dir, save=auth_dir)
+		a.save(auth_dir)
+	    except EnvironmentError, e:
+		sys.exit("Can't create or write %s: %s" % (e.filename, e.strerror))
+	    except abac_authorizer.bad_cert_error, e:
+		sys.exit("Error creating authorizer: %s" % e)
+
 finally:
-    if delete_certs:
-	if cert: os.unlink(cert)
-	if key: os.unlink(key)
+    try:
+	if delete_certs:
+	    if cert: os.unlink(cert)
+	    if key: os.unlink(key)
+	if delete_creds and creds_dir:
+	    clear_dir(creds_dir)
+	    os.rmdir(creds_dir)
+    except EnvironmentError, e:
+	sys.exit("Can't remove %s: %s" % ( e.filename, e.strerror))
