def create_top_level_auth_records(self, hrn):
        """
        Create top level records (includes root and sub authorities (local/remote)
        """
        urn = hrn_to_urn(hrn, 'authority')
        # make sure parent exists
        parent_hrn = get_authority(hrn)
        if not parent_hrn:
            parent_hrn = hrn
        if not parent_hrn == hrn:
            self.create_top_level_auth_records(parent_hrn)

        # create the authority if it doesnt already exist 
        if not self.AuthHierarchy.auth_exists(urn):
            self.logger.info("Import: creating top level authorities")
            self.AuthHierarchy.create_auth(urn)
        
        # create the db record if it doesnt already exist    
        auth_info = self.AuthHierarchy.get_auth_info(hrn)
        table = SfaTable()
        auth_record = table.find({'type': 'authority', 'hrn': hrn})

        if not auth_record:
            auth_record = SfaRecord(hrn=hrn, gid=auth_info.get_gid_object(), type="authority", pointer=-1)
            auth_record['authority'] = get_authority(auth_record['hrn'])
            self.logger.info("Import: inserting authority record for %s"%hrn)
            table.insert(auth_record)

def get_sfa_peer(api, hrn):
    # return the authority for this hrn or None if we are the authority
    sfa_peer = None
    slice_authority = get_authority(hrn)
    site_authority = get_authority(slice_authority)

    if site_authority != api.hrn:
        sfa_peer = site_authority

    return sfa_peer

    def get_sfa_peer(self, xrn):
        hrn, type = urn_to_hrn(xrn)

        # return the authority for this hrn or None if we are the authority
        sfa_peer = None
        slice_authority = get_authority(hrn)
        site_authority = get_authority(slice_authority)

        if site_authority != self.api.hrn:
            sfa_peer = site_authority

        return sfa_peer

    def call(self, cred, record_dict, origin_hrn=None):
        user_cred = Credential(string=cred)

        #log the call
        if not origin_hrn:
            origin_hrn = user_cred.get_gid_caller().get_hrn()    
        self.api.logger.info("interface: %s\tcaller-hrn: %s\ttarget-hrn: %s\tmethod-name: %s"%(self.api.interface, origin_hrn, None, self.name))

        # validate the cred
        self.api.auth.check(cred, "register")

        # make sure this is a peer record
        if 'peer_authority' not in record_dict or \
           not record_dict['peer_authority']: 
            raise SfaInvalidArgument, "peer_authority must be specified" 

        record = SfaRecord(dict = record_dict)
        type, hrn, peer_authority = record['type'], record['hrn'], record['peer_authority']
        record['authority'] = get_authority(record['hrn'])
        # verify permissions
        self.api.auth.verify_cred_is_me(cred)

        # check if record already exists
        table = SfaTable()
        existing_records = table.find({'type': type, 'hrn': hrn, 'peer_authority': peer_authority})
        if existing_records:
            for existing_record in existing_records:
                if existing_record['pointer'] != record['pointer']:
                    record['record_id'] = existing_record['record_id']
                    table.update(record)
        else:
            record_id = table.insert(record)
 
        return 1

    def get_slice_and_slivers(self, slice_xrn, login=None):
        """
        Returns a dict of slivers keyed on the sliver's node_id
        """
        slivers = {}
        sfa_slice = None
        if not slice_xrn:
            return (sfa_slice, slivers)
        slice_urn = hrn_to_urn(slice_xrn, 'slice')
        slice_hrn, _ = urn_to_hrn(slice_xrn)
        slice_name = slice_hrn

        slices = self.driver.GetSlices(slice_filter= str(slice_name), \
                                                slice_filter_type = 'slice_hrn', login=login)
        
        logger.debug("Slabaggregate api \tget_slice_and_slivers \
                        sfa_slice %s \r\n slices %s self.driver.hrn %s" \
                        %(sfa_slice, slices, self.driver.hrn))
        if not slices:
            return (sfa_slice, slivers)
        #if isinstance(sfa_slice, list):
            #sfa_slice = slices[0]
        #else:
            #sfa_slice = slices

        # sort slivers by node id , if there is a job
        #and therfore, node allocated to this slice
        for sfa_slice in slices:
            try:
                node_ids_list =  sfa_slice['node_ids']  
            except KeyError:
                logger.log_exc("SLABAGGREGATE \t \
                                        get_slice_and_slivers KeyError ")
                continue
                                        
            for node in node_ids_list:
                sliver_xrn = Xrn(slice_urn, type='sliver', id=node)
                sliver_xrn.set_authority(self.driver.hrn)
                #node_id = self.driver.root_auth + '.' + node_id
                sliver = Sliver({'sliver_id':sliver_xrn.urn, 
                                'name': sfa_slice['hrn'],
                                'type': 'slab-node', 
                                'tags': []})
                
                slivers[node] = sliver
          
        
        #Add default sliver attribute :
        #connection information for senslab
        if get_authority (sfa_slice['hrn']) == self.driver.root_auth: 
            tmp = sfa_slice['hrn'].split('.')
            ldap_username = tmp[1].split('_')[0]
            vmaddr = 'ssh ' + ldap_username + '@grenoble.senslab.info'
            slivers['default_sliver'] =  {'vm': vmaddr , 'login': ldap_username}
            
        #TODO get_slice_and_slivers Find the login of the external user

        logger.debug("SLABAGGREGATE api get_slice_and_slivers  slivers %s "\
                                                             %(slivers))
        return (slices, slivers)

 def get_peer(self, xrn):
     hrn, hrn_type = urn_to_hrn(xrn)
     #Does this slice belong to a local site or a peer senslab site?
     peer = None
     
     # get this slice's authority (site)
     slice_authority = get_authority(hrn)
     site_authority = slice_authority
     # get this site's authority (sfa root authority or sub authority)
     #site_authority = get_authority(slice_authority).lower()
     logger.debug("SLABSLICES \ get_peer slice_authority  %s \
                 site_authority %s hrn %s" %(slice_authority, \
                                     site_authority, hrn))
     #This slice belongs to the current site
     if site_authority == self.driver.root_auth :
         return None
     # check if we are already peered with this site_authority, if so
     #peers = self.driver.GetPeers({})  
     peers = self.driver.GetPeers(peer_filter = slice_authority)
     for peer_record in peers:
       
         if site_authority == peer_record.hrn:
             peer = peer_record
     logger.debug(" SLABSLICES \tget_peer peer  %s " %(peer))
     return peer

    def import_site(self, hrn, site):
        shell = self.shell
        plc_auth = self.plc_auth
        urn = hrn_to_urn(hrn, 'authority')
        self.logger.info("Import: site %s"%hrn)

        # create the authority
        if not self.AuthHierarchy.auth_exists(urn):
            self.AuthHierarchy.create_auth(urn)

        auth_info = self.AuthHierarchy.get_auth_info(urn)

        table = SfaTable()
        auth_record = SfaRecord(hrn=hrn, gid=auth_info.get_gid_object(), type="authority", pointer=site['site_id'])
        auth_record['authority'] = get_authority(auth_record['hrn'])
        existing_records = table.find({'hrn': hrn, 'type': 'authority', 'pointer': site['site_id']})
        if not existing_records:
            table.insert(auth_record)
        else:
            self.logger.info("Import: %s exists, updating " % hrn)
            existing_record = existing_records[0]
            auth_record['record_id'] = existing_record['record_id']
            table.update(auth_record)

        return hrn

    def import_slice(self, parent_hrn, slice):
        slicename = slice['name'].split("_",1)[-1]
        slicename = _cleanup_string(slicename)

        if not slicename:
            self.logger.error("Import: failed to parse slice name %s" %slice['name'])
            return

        hrn = parent_hrn + "." + slicename
        self.logger.info("Import: slice %s"%hrn)

        pkey = Keypair(create=True)
        urn = hrn_to_urn(hrn, 'slice')
        slice_gid = self.AuthHierarchy.create_gid(urn, create_uuid(), pkey)
        slice_record = SfaRecord(hrn=hrn, gid=slice_gid, type="slice", pointer=slice['slice_id'])
        slice_record['authority'] = get_authority(slice_record['hrn'])
        table = SfaTable()
        existing_records = table.find({'hrn': hrn, 'type': 'slice', 'pointer': slice['slice_id']})
        if not existing_records:
            table.insert(slice_record)
        else:
            self.logger.info("Import: %s exists, updating " % hrn)
            existing_record = existing_records[0]
            slice_record['record_id'] = existing_record['record_id']
            table.update(slice_record)

    def testRegister(self):
        authority = get_authority(self.hrn)
        auth_cred = self.client.GetCredential(authority, 'authority')
        auth_record = {'hrn': '.'.join([authority, random_string(10).lower()]),
                       'type': 'authority'}
        node_record = {'hrn': '.'.join([authority, random_string(10)]),
                       'type': 'node',
                       'hostname': random_string(6) + '.' + random_string(6)}
        slice_record = {'hrn': '.'.join([authority, random_string(10)]),
                        'type': 'slice', 'researcher': [self.hrn]}
        user_record = {'hrn': '.'.join([authority, random_string(10)]),
                       'type': 'user',
                       'email': random_string(6) +'@'+ random_string(5) +'.'+ random_string(3),
                       'first_name': random_string(7),
                       'last_name': random_string(7)}

        all_records = [auth_record, node_record, slice_record, user_record]
        for record in all_records:
            try:
                self.registry.Register(auth_cred, record)
                self.registry.Resolve(self.credential, record['hrn'])
            except:
                raise
            finally:
                try: self.registry.Remove(auth_cred, record['type'], record['hrn'])
                except: pass

 def get_pis (self):
     # don't ruin the import of that file in a client world
     from sfa.storage.alchemy import dbsession
     from sfa.util.xrn import get_authority
     authority_hrn = get_authority(self.hrn)
     auth_record = dbsession.query(RegAuthority).filter_by(hrn=authority_hrn).first()
     return auth_record.reg_pis

def update_cert_records(gids):
    """
    Make sure there is a record in the registry for the specified gids. 
    Removes old records from the db.
    """
    # import db stuff here here so this module can be loaded by PlcComponentApi
    from sfa.storage.alchemy import dbsession
    from sfa.storage.model import RegRecord
    if not gids:
        return
    # get records that actually exist in the db
    gid_urns = [gid.get_urn() for gid in gids]
    hrns_expected = [gid.get_hrn() for gid in gids]
    records_found = dbsession.query(RegRecord).\
        filter_by(pointer=-1).filter(RegRecord.hrn.in_(hrns_expected)).all()

    # remove old records
    for record in records_found:
        if record.hrn not in hrns_expected and \
            record.hrn != self.api.config.SFA_INTERFACE_HRN:
            dbsession.delete(record)

    # TODO: store urn in the db so we do this in 1 query 
    for gid in gids:
        hrn, type = gid.get_hrn(), gid.get_type()
        record = dbsession.query(RegRecord).filter_by(hrn=hrn, type=type,pointer=-1).first()
        if not record:
            record = RegRecord (dict= {'type':type,
                                       'hrn': hrn, 
                                       'authority': get_authority(hrn),
                                       'gid': gid.save_to_string(save_parents=True),
                                       })
            dbsession.add(record)
    dbsession.commit()

 def testUpdate(self):
     authority = get_authority(self.hrn)
     auth_cred = self.client.GetCredential(authority, 'authority')
     records = self.registry.Resolve(self.credential, self.hrn)
     if not records: assert False
     record = records[0]
     self.registry.update(auth_cred, record) 

    def get_auth_cred(self, xrn, kind="authority"):
        hrn, type = urn_to_hrn(xrn) 
        auth_info = self.get_auth_info(hrn)
        gid = auth_info.get_gid_object()

        cred = Credential(subject=hrn)
        cred.set_gid_caller(gid)
        cred.set_gid_object(gid)
        cred.set_privileges(kind)
        cred.get_privileges().delegate_all_privileges(True)
        #cred.set_pubkey(auth_info.get_gid_object().get_pubkey())

        parent_hrn = get_authority(hrn)
        if not parent_hrn or hrn == self.config.SFA_INTERFACE_HRN:
            # if there is no parent hrn, then it must be self-signed. this
            # is where we terminate the recursion
            cred.set_issuer_keys(auth_info.get_privkey_filename(), auth_info.get_gid_filename())
        else:
            # we need the parent's private key in order to sign this GID
            parent_auth_info = self.get_auth_info(parent_hrn)
            cred.set_issuer_keys(parent_auth_info.get_privkey_filename(), parent_auth_info.get_gid_filename())

            
            cred.set_parent(self.get_auth_cred(parent_hrn, kind))

        cred.encode()
        cred.sign()

        return cred

    def get_auth_ticket(self, xrn):
        hrn, type = urn_to_hrn(xrn)
        auth_info = self.get_auth_info(hrn)
        gid = auth_info.get_gid_object()

        ticket = SfaTicket(subject=hrn)
        ticket.set_gid_caller(gid)
        ticket.set_gid_object(gid)
        ticket.set_delegate(True)
        ticket.set_pubkey(auth_info.get_gid_object().get_pubkey())

        parent_hrn = get_authority(hrn)
        if not parent_hrn:
            # if there is no parent hrn, then it must be self-signed. this
            # is where we terminate the recursion
            ticket.set_issuer(auth_info.get_pkey_object(), hrn)
        else:
            # we need the parent's private key in order to sign this GID
            parent_auth_info = self.get_auth_info(parent_hrn)
            ticket.set_issuer(parent_auth_info.get_pkey_object(), parent_auth_info.hrn)
            ticket.set_parent(self.get_auth_cred(parent_hrn))

        ticket.encode()
        ticket.sign()

        return ticket

    def _process_ldap_info_for_one_user(self, record, result_data):
        """

        Put the user's ldap data into shape. Only deals with one user
        record and one user data from ldap.

        :param record: user record
        :param result_data: Raw ldap data coming from LdapSearch
        :returns: user's data dict with 'type','pkey','uid', 'email',
            'first_name' 'last_name''serial''authority''peer_authority'
            'pointer''hrn'
        :type record: dict
        :type result_data: list
        :rtype :dict

        """
        #One entry only in the ldap data because we used a  filter
        #to find one user only
        ldapentry = result_data[0][1]
        logger.debug("LDAP.PY \t LdapFindUser ldapentry %s" % (ldapentry))
        tmpname = ldapentry['uid'][0]

        tmpemail = ldapentry['mail'][0]
        if ldapentry['mail'][0] == "unknown":
            tmpemail = None

        parent_hrn = None
        peer_authority = None
        if 'hrn' in record:
            hrn = record['hrn']
            parent_hrn = get_authority(hrn)
            if parent_hrn != self.authname:
                peer_authority = parent_hrn
            #In case the user was not imported from Iotlab LDAP
            #but from another federated site, has an account in
            #iotlab but currently using his hrn from federated site
            #then the login is different from the one found in its hrn
            if tmpname != hrn.split('.')[1]:
                hrn = None
        else:
            hrn = None

        results = {
            'type': 'user',
            'pkey': ldapentry['sshPublicKey'],
            #'uid': ldapentry[1]['uid'][0],
            'uid': tmpname,
            'email': tmpemail,
            #'email': ldapentry[1]['mail'][0],
            'first_name': ldapentry['givenName'][0],
            'last_name': ldapentry['sn'][0],
            #'phone': 'none',
            'serial': 'none',
            'authority': parent_hrn,
            'peer_authority': peer_authority,
            'pointer': -1,
            'hrn': hrn,
                    }
        return results

def CreateSliver(client):
    # register a slice that will be used for some test
    authority = get_authority(client.hrn)
    auth_cred = client.GetCredential(authority, 'authority')
    slice_record = {'hrn': ".".join([authority, random_string(10)]),
                    'type': 'slice', 'researcher': [client.hrn]}
    client.registry.Register(auth_cred, slice_record)
    return  slice_record

 def get_pis (self):
     from sqlalchemy.orm import sessionmaker
     Session=sessionmaker()
     dbsession=Session.object_session(self)
     from sfa.util.xrn import get_authority
     authority_hrn = get_authority(self.hrn)
     auth_record = dbsession.query(RegAuthority).filter_by(hrn=authority_hrn).first()
     return auth_record.reg_pis

def __get_registry_objects(slice_xrn, creds, users):
    """

    """
    hrn, type = urn_to_hrn(slice_xrn)

    hrn_auth = get_authority(hrn)

    # Build up objects that an SFA registry would return if SFA
    # could contact the slice's registry directly
    reg_objects = None

    if users:
        # dont allow special characters in the site login base
        #only_alphanumeric = re.compile('[^a-zA-Z0-9]+')
        #login_base = only_alphanumeric.sub('', hrn_auth[:20]).lower()
        slicename = hrn_to_pl_slicename(hrn)
        login_base = slicename.split('_')[0]
        reg_objects = {}
        site = {}
        site['site_id'] = 0
        site['name'] = 'geni.%s' % login_base 
        site['enabled'] = True
        site['max_slices'] = 100

        # Note:
        # Is it okay if this login base is the same as one already at this myplc site?
        # Do we need uniqueness?  Should use hrn_auth instead of just the leaf perhaps?
        site['login_base'] = login_base
        site['abbreviated_name'] = login_base
        site['max_slivers'] = 1000
        reg_objects['site'] = site

        slice = {}
        
        # get_expiration always returns a normalized datetime - no need to utcparse
        extime = Credential(string=creds[0]).get_expiration()
        # If the expiration time is > 60 days from now, set the expiration time to 60 days from now
        if extime > datetime.datetime.utcnow() + datetime.timedelta(days=60):
            extime = datetime.datetime.utcnow() + datetime.timedelta(days=60)
        slice['expires'] = int(time.mktime(extime.timetuple()))
        slice['hrn'] = hrn
        slice['name'] = hrn_to_pl_slicename(hrn)
        slice['url'] = hrn
        slice['description'] = hrn
        slice['pointer'] = 0
        reg_objects['slice_record'] = slice

        reg_objects['users'] = {}
        for user in users:
            user['key_ids'] = []
            hrn, _ = urn_to_hrn(user['urn'])
            user['email'] = hrn_to_pl_slicename(hrn) + "@geni.net"
            user['first_name'] = hrn
            user['last_name'] = hrn
            reg_objects['users'][user['email']] = user

        return reg_objects

    def import_tenants(self, existing_hrns, existing_records):
        # Get all tenants
        # A tenant can represent an organizational group (site) or a
        # slice. If a tenant's authorty/parent matches the root authority it is
        # considered a group/site. All other tenants are considered slices.
        tenants = self.shell.auth_manager.tenants.list()
        tenants_dict = {}
        for tenant in tenants:
            hrn = self.config.SFA_INTERFACE_HRN + '.' + tenant.name
            tenants_dict[hrn] = tenant
            authority_hrn = OSXrn(xrn=hrn, type='authority').get_authority_hrn()

            if hrn in existing_hrns:
                continue

            if authority_hrn == self.config.SFA_INTERFACE_HRN:
                # import group/site
                record = RegAuthority()
                urn = OSXrn(xrn=hrn, type='authority').get_urn()
                if not self.auth_hierarchy.auth_exists(urn):
                    self.auth_hierarchy.create_auth(urn)
                auth_info = self.auth_hierarchy.get_auth_info(urn)
                gid = auth_info.get_gid_object()
                record.type='authority'
                record.hrn=hrn
                record.gid=gid
                record.authority=get_authority(hrn)
                dbsession.add(record)
                dbsession.commit()
                self.logger.info("OpenstackImporter: imported authority: %s" % record)

            else:
                record = RegSlice ()
                urn = OSXrn(xrn=hrn, type='slice').get_urn()
                pkey = Keypair(create=True)
                gid = self.auth_hierarchy.create_gid(urn, create_uuid(), pkey)
                record.type='slice'
                record.hrn=hrn
                record.gid=gid
                record.authority=get_authority(hrn)
                dbsession.add(record)
                dbsession.commit()
                self.logger.info("OpenstackImporter: imported slice: %s" % record) 

        return tenants_dict

def get_peer(pldriver, hrn):
    # Because of myplc native federation,  we first need to determine if this
    # slice belongs to out local plc or a myplc peer. We will assume it
    # is a local site, unless we find out otherwise
    peer = None

    # get this slice's authority (site)
    slice_authority = get_authority(hrn)

    # get this site's authority (sfa root authority or sub authority)
    site_authority = get_authority(slice_authority).lower()
    # check if we are already peered with this site_authority, if so
    peers = pldriver.shell.GetPeers( {}, ['peer_id', 'peername', 'shortname', 'hrn_root'])
    for peer_record in peers:
        names = [name.lower() for name in peer_record.values() if isinstance(name, StringTypes)]
        if site_authority in names:
            peer = peer_record['shortname']

    return peer