There is a member authority at the sub-SA that hands out funny credentials
If you use the wrong URL for the MA:
https://www.emulab.net:12369/protogeni/xmlrpc/project/ig-control-of/geni-ma/2
There is really something there, which hands out user credentials. They look sortof weird, where the owner is:
urn:publicid:IDN+emulab.net+user+nbastin
But the target is:
urn:publicid:IDN+emulab.net:ig-control-of+authority+geni-ma
Which I suspect isn't right - I can't actually use this credential, but I can't use credentials I think are valid either, so I'm not sure where things break down.