Index: fedd/access_to_abac.py
===================================================================
--- fedd/access_to_abac.py	(revision 353db8cf818f61d7d34c74ad0449f921d11ffa52)
+++ fedd/access_to_abac.py	(revision de7cb08505fd0e4f8a17d0caec15a1cb0a98ca75)
@@ -7,4 +7,5 @@
 from string import join
 from federation.fedid import fedid
+from federation.util import abac_split_cert, abac_pem_type
 from optparse import OptionParser, OptionValueError
 
@@ -287,4 +288,7 @@
 opts, args = p.parse_args()
 
+cert, key = None, None
+delete_certs = False
+
 if opts.file:
     args.append(opts.file)
@@ -293,4 +297,21 @@
 if len(args) < 1:
     sys.exit('No filenames given to parse')
+
+if opts.key:
+    if not os.access(opts.key, os.R_OK):
+	key = opts.key
+    else:
+	sys.exit('Cannot read key (%s)' % opts.key)
+
+if opts.dir:
+    if not os.path.isdir(opts.dir):
+	sys.exit('%s is not a directory' % opts.dir)
+    elif not os.access(opts.dir, os.W_OK):
+	sys.exit('%s is not writable' % opts.dir)
+
+if opts.delegate: delegation_link = 'acting_for'
+else: delegation_link = None
+
+mapper = opts.mapper
 
 if opts.cert: 
@@ -299,85 +320,85 @@
     except EnvironmentError, e:
 	sys.exit('Bad --cert: %s (%s)' % (e.strerror, e.filename or '?!'))
+
+    if not opts.key:
+	if abac_pem_type(opts.cert) == 'both':
+	    key, cert = abac_split_cert(opts.cert)
+	    delete_certs = True
+    else:
+	cert = opts.cert
 else: 
     print >>sys.stderr, 'No --cert, using dummy fedid'
     me = fedid(hexstr='0123456789012345678901234567890123456789')
-
-if opts.key and not os.access(opts.key, os.R_OK):
-    sys.exit('Cannot read key (%s)' % opts.key)
-
-if opts.dir:
-    if not os.path.isdir(opts.dir):
-	sys.exit('%s is not a directory' % opts.dir)
-    elif not os.access(opts.dir, os.W_OK):
-	sys.exit('%s is not writable' % opts.dir)
-
-if opts.delegate: delegation_link = 'acting_for'
-else: delegation_link = None
-
-mapper = opts.mapper
-
-# Do the parsing
-for fn in args:
-    creds = set()
-    to_id = { }
-    try:
-	f = open(fn, "r")
-	for i, l in enumerate(f):
+    cert = None
+
+# The try block makes sure that credentials split into tmp files are deleted
+try:
+    # Do the parsing
+    for fn in args:
+	creds = set()
+	to_id = { }
+	try:
+	    f = open(fn, "r")
+	    for i, l in enumerate(f):
+		try:
+		    if comment_re.match(l):
+			continue
+		    else:
+			m =  line_re.match(l)
+			if m:
+			    p, da = m.group(1, 4)
+			    gp, gu = m.group(2, 3)
+			    if gp == '<any>': gp = None
+			    if gu == '<any>': gu = None
+
+			    creds.add(credential(me, da, 
+				    [attribute(p, x, delegation_link) \
+					    for x in (gp, gu) \
+						if x is not None]))
+			    if m.group(5) and mapper:
+				mapper(m.group(5), creds, me, to_id, p, gp, gu,
+					delegation_link)
+			else:
+			    raise parse_error('Syntax error')
+		except parse_error, e:
+		    f.close()
+		    raise parse_error('Error on line %d of %s: %s' % \
+			    (i, fn, e.message))
+		    
+	    f.close()
+	except parse_error, e:
+	    print >> sys.stderr, "%s" % e
+	    continue
+
+	except EnvironmentError, e:
+	    print >>sys.stderr, "File error %s: %s" % \
+		    (e.filename or '!?', e.strerror) 
+	    continue
+
+	# Credential output
+	if opts.create_creds:
+	    if all([cert, key, opts.dir]):
+		try:
+		    create_creds([c for c in creds if c.principal == me],
+			    cert, key, opts.dir, opts.debug)
+		except credential_error, e:
+		    sys.exit('Credential creation failed: %s' % e)
+	    else:
+		print >>sys.stderr, 'Cannot create credentials.  Missing parameter'
+
+	# Local map output
+	if opts.map or opts.debug:
 	    try:
-		if comment_re.match(l):
-		    continue
+		if opts.map and opts.map != '-' and not opts.debug:
+		    f = open(opts.map, 'w')
 		else:
-		    m =  line_re.match(l)
-		    if m:
-			p, da = m.group(1, 4)
-			gp, gu = m.group(2, 3)
-			if gp == '<any>': gp = None
-			if gu == '<any>': gu = None
-
-			creds.add(credential(me, da, 
-				[attribute(p, x, delegation_link) \
-					for x in (gp, gu) \
-					    if x is not None]))
-			if m.group(5) and mapper:
-			    mapper(m.group(5), creds, me, to_id, p, gp, gu,
-				    delegation_link)
-		    else:
-			raise parse_error('Syntax error')
-	    except parse_error, e:
-		f.close()
-		raise parse_error('Error on line %d of %s: %s' % \
-			(i, fn, e.message))
-		
-	f.close()
-    except parse_error, e:
-	print >> sys.stderr, "%s" % e
-	continue
-
-    except EnvironmentError, e:
-	print >>sys.stderr, "File error %s: %s" % \
-		(e.filename or '!?', e.strerror) 
-	continue
-
-    # Credential output
-    if opts.create_creds:
-	if all([opts.cert, opts.key, opts.dir]):
-	    try:
-		create_creds([c for c in creds if c.principal == me],
-			opts.cert, opts.key, opts.dir, opts.debug)
-	    except credential_error, e:
-		sys.exit('Credential creation failed: %s' % e)
-	else:
-	    print >>sys.stderr, 'Cannot create credentials.  Missing parameter'
-
-    # Local map output
-    if opts.map or opts.debug:
-	try:
-	    if opts.map and opts.map != '-' and not opts.debug:
-		f = open(opts.map, 'w')
-	    else:
-		f = sys.stdout
-	    for k, c in to_id.items():
-		for a in set(["%s.%s" % (x.principal, x.attr) for x in c]):
-		    print >>f, "%s -> (%s)" % ( a, join(k, ', '))
-	except EnvironmentError, e:
-	    sys.exit("Cannot open %s: %s" % (e.filename or '!?', e.strerror))
+		    f = sys.stdout
+		for k, c in to_id.items():
+		    for a in set(["%s.%s" % (x.principal, x.attr) for x in c]):
+			print >>f, "%s -> (%s)" % ( a, join(k, ', '))
+	    except EnvironmentError, e:
+		sys.exit("Cannot open %s: %s" % (e.filename or '!?', e.strerror))
+finally:
+    if delete_certs:
+	if cert: os.unlink(cert)
+	if key: os.unlink(key)
