Manila - Manage rule for CIFS share updates status from "error" to "active" for invalid users

[Naval Gupta]

Pre-conditions:
Devstack with manila plugin is up and running.
HP 3PAR file services backend details are present in /etc/manila/manila.conf and all manila services working.

Steps:
1. Login to Horizon with admin credentials
2. Create a Share type with extra specs as below
snapshot_support=True
share_backend_name=UNITY
thin_provisioning=True
driver_handles_share_servers=False

*UNITY is HPE 3PAR file services backend.

3. Create a share with above share type and CIFS share protocol.
4. Go to project > share > actions from dropdown and select manage rules for created share.
5. Add a IP access rule for share access.
6. Add a user access rule for a HPE 3PAR user but not from users in file store group. (invalid user)
7. Observe that status for all share access rules changes from 'active' to 'error'.
8. Add a user access rule for user from file store group on HPE 3PAR.(valid user)
9. Observe that status for all share access rules remains as "error".
10. Delete the user access rule for valid user added in step7.
11. Observe that status for all share access rules changes from 'error' to 'active' including for rule for invalid user.

Expected Behavior:
1. After adding a user access rule for invalid user (not from file store group), status for all access rules should not change to 'error'.
2. When there are share access rules for both valid and invalid users, after deleting rule for valid user, rule for invalid user changes from "error" to "active".

Note - Please find screenshot and m-shr.log as attached.

[Naval Gupta (naval-gupta)]

Attached screenshot for UI.

[Valeriy Ponomaryov (vponomaryov)]

It looks like "Manila" bug, not "Manila UI".

[Ravichandran Nudurumati (ravichandrann)]

I am unable to delete user access rule for valid user if access rule for invalid user is present.
I am sharing the error message below.

oslo_messaging.rpc.server ShareBackendException: Share backend error: Failed to change (+) access to FPG/share ###_FPG/#### for user invalidUserName rw: ['Failure on Modify Share: osf-####: ERROR_NO_SUCH_USER during Modify SMB share osf-####.\r', 'Review current share permissions and remove any unresolved users.\r']

[Shashi (sonawane-shashikant)]

Tried reproducing using command line and below are the findings.

Created CIFS share.
Added access rule which added valid user.
stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$ manila access-allow myCIFS_Share2 user Guest
stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$ manila access-list myCIFS_Share2 +--------------------------------------+-------------+-----------+--------------+--------+------------+
| id | access_type | access_to | access_level | state | access_key |
+--------------------------------------+-------------+-----------+--------------+--------+------------+
| 77a7d557-cfc1-43dd-9142-4d7940bcdfcf | user | Guest | rw | active | None |
+--------------------------------------+-------------+-----------+--------------+--------+------------+

Then I added a rule which added a invalid user to see state as error for both the access rules.

stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$ manila access-allow myCIFS_Share2 user 3parbrowse
+--------------+--------------------------------------+
| Property | Value |
+--------------+--------------------------------------+
| access_key | None |
| share_id | 47610cc7-a656-4bbc-81c8-c9f14b6006b3 |
| access_type | user |
| access_to | 3parbrowse |
| access_level | rw |
| state | new |
| id | b490106a-6981-47a6-8879-e0885c647069 |
+--------------+--------------------------------------+
stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$ manila access-list myCIFS_Share2
+--------------------------------------+-------------+------------+--------------+-------+------------+
| id | access_type | access_to | access_level | state | access_key |
+--------------------------------------+-------------+------------+--------------+-------+------------+
| 77a7d557-cfc1-43dd-9142-4d7940bcdfcf | user | Guest | rw | error | None |
| b490106a-6981-47a6-8879-e0885c647069 | user | 3parbrowse | rw | error | None |
+--------------------------------------+-------------+------------+--------------+-------+------------+
stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$

Next I removed the access rule for invalid user.

stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$ manila access-deny myCIFS_Share2 bb0f69a4-6643-4d65-865e-cefd2d7d267c
stack@cld4b11:/opt/stack/manila/manila/share/drivers/hpe$ manila access-list myCIFS_Share2 +--------------------------------------+-------------+-----------+--------------+--------+------------+
| id | access_type | access_to | access_level | state | access_key |
+--------------------------------------+-------------+-----------+--------------+--------+------------+
| 77a7d557-cfc1-43dd-9142-4d7940bcdfcf | user | Guest | rw | active | None |
+------------...

[Goutham Pacha Ravi (gouthamr)]

This behavior with access rules was fixed in the ocata release of openstack [1]. The changes were not back ported to newton or prior releases since it changes the API and the database schema in significant backwards-incompatible ways.

Sadly, the user experience with access rules prior to [1] was that if any incorrect rules are added, the whole rule set will be set to "error" state, and the only way to recover is to remove the incorrect rule. If a bulk operation was made or if access rules were added in quick succession, it's hard to pin point which specific rule caused the access rules to all be set to "error". This was acknowledged as bad user experience. Please upgrade and use newer versions of manila.

[1] https://review.openstack.org/#/c/369668/