cifs ad without machine account creation permissions

[Maurice Escher]

Description
===========
I'm running in DHSS=True mode with the NetApp driver.

To create a share with protocol CIFS my users configured an active directory security service and added this to their share network. Share creation fails and the user message produced is not helping my users to help themselves.

Steps to reproduce
==================

* create a share with protocol CIFS (select a share network that has a security service assigned but with invalid domain join credentials)

Expected result
===============
A) A user message tells me: ERROR - "create: the user supplied via security service has insufficient privilege. Please double check you user, password, ou, domain configuration etc." or something like that

Actual result
=============
* share ends up in error state
* user message is produced ERROR - "create: Could not find an existing share server or allocate one on the share network provided. You may use a different share network, or verify the network details in the share network and retry your request. If this doesn't work, contact your administrator to troubleshoot issues with your network."

As a cloud administrator I clearly see what went wrong in the logs, but my customers don't have access. Some examples:

* insufficient privilege: http://paste.openstack.org/show/799227/
* wrong password: http://paste.openstack.org/show/799228/

Environment
===========
1. Manila on Train Release (with some unrelated changes in a custom fork (https://github.com/sapcc/manila/tree/stable/train-m3)

2. NetApp Ontap Release 9.6P9 backend

3. DHSS=true (neutron bind)

Best regards,
Maurice

[Vida Haririan (vhariria)]

Additional comments http://eavesdrop.openstack.org/meetings/manila/2020/manila.2020-11-05-15.01.log.html

[Goutham Pacha Ravi (gouthamr)]

Patch proposed to openstack/manila:
    Add exception for insufficient priveleges when using security services
    https://review.opendev.org/c/openstack/manila/+/764489

[kiran pawar (kpdev)]

Seems like NetApp driver is not raising the error "SecurityServiceFailedAuth". We need to fix NetApp driver.

[Goutham Pacha Ravi (gouthamr)]

Ah, yes - https://review.opendev.org/c/openstack/manila/+/764489 was a partial fix. I'm re-opening this so we can tag the whole fix/..

[Vida Haririan (vhariria)]

Discussed this bug in detail, see comments here: https://meetings.opendev.org/meetings/manila/2021/manila.2021-10-14-15.01.log.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/manila/+/881770

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/manila/+/881770
Committed: https://opendev.org/openstack/manila/commit/81126d97e38cf7fb3bfcf4a7c2fd38b6a2da622b
Submitter: "Zuul (22348)"
Branch: master

commit 81126d97e38cf7fb3bfcf4a7c2fd38b6a2da622b
Author: Helena Dantas <email address hidden>
Date: Thu Apr 27 17:14:18 2023 +0000

    [NetApp] Add exception for insufficient privilege or incorrect credentials

    When creating a share using CIFS protocol users can face errors related
    with incorrect credentials or insufficient privileges which have not been properly described by the exception error message.

    This patch add a more clearer error message to address this kind of
    error to the user.

    Closes-Bug: #1900755
    Change-Id: I589c218f2c1072e17e76a6a8d8d81541d5072ad1

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/manila 18.0.0.0rc1 release candidate.