[attributs, objets] Affinage des permissions sur les certificats

attributs.py

@@ -1447,36 +1447,43 @@ class machineAlias(boolAttr):
 @crans_attribute
 class issuerCN(Attr):
     ldap_name = "issuerCN"
+    can_modify = [nounou]
 
 @crans_attribute
 class serialNumber(Attr):
     ldap_name = "serialNumber"
     python_type = int
+    can_modify = [nounou]
 
 @crans_attribute
 class start(intAttr):
     ldap_name = "start"
+    can_modify = [nounou]
 
 @crans_attribute
 class end(intAttr):
     ldap_name = "end"
+    can_modify = [nounou]
 
 @crans_attribute
 class crlUrl(Attr):
     ldap_name = "crlUrl"
     optional = True
+    can_modify = [parent, nounou]
 
 @crans_attribute
 class revocked(boolAttr):
     ldap_name = "revocked"
     singlevalue = True
     optional = True
+    can_modify = [nounou]
 
 @crans_attribute
 class certificat(Attr):
     ldap_name = "certificat"
     binary = True
     python_type = str
+    can_modify = [parent, nounou]
 
     def __init__(self, *args, **kwargs):
         super(certificat, self).__init__(*args, **kwargs)
@@ -1491,8 +1498,9 @@ class certificat(Attr):
             name_type = name.getName()
             if name_type == 'dNSName':
                 altName.append(unicode(name.getComponent()))
-            else:
-                raise ValueError("Seulement les dNSName sont supporté pour l'extension de certificat SubjectAltName")
+# Cacert met des othername, du coup, on ignore juste
+#            else:
+#                raise ValueError("Seulement les dNSName sont supporté pour l'extension de certificat SubjectAltName (et pas %s)" % name_type)
         return altName
 
     def _format_cert(self, certificat):
@@ -1556,16 +1564,19 @@ class certificat(Attr):
 class certificatUsage(intAttr):
     ldap_name = "certificatUsage"
     singlevalue = True
+    can_modify = [parent, nounou]
 
 @crans_attribute
 class selector(intAttr):
     ldap_name = "selector"
     singlevalue = True
+    can_modify = [parent, nounou]
 
 @crans_attribute
 class matchingType(intAttr):
     ldap_name = "matchingType"
     singlevalue = True
+    can_modify = [parent, nounou]
 
 @crans_attribute
 class xid(intAttr):
@@ -1573,6 +1584,7 @@ class xid(intAttr):
     category = 'id'
     unique = True
     singlevalue = True
+    can_modify = []
 
 
 @crans_attribute