Start a Conversation

Unsolved

G

1 Rookie

 • 

9 Posts

1453

May 1st, 2020 10:00

Isilon ansible module 1.0 documentation issue

Hi,

I was wondering if the SMB ansible module has the ability to remove a user from a share?  The command I'm trying to replicate with the module would be:

isi smb shares permission delete --wellknown=Everyone --zone

From what I can tell in the documentation, you can only add/modify a user/group permission on a share, not fully remove them.

I also noticed a documentation error in the Ansible for Dell EMC Isilon v1.0 Product Guide.  Page 38, the example for modifying an SMB share to remove group permission.  You have the variable name for the share as name: which is invalid.  It should be share_name:

 

1 Rookie

 • 

9 Posts

May 1st, 2020 14:00

Discovered another odd behavior with module.

Trying to create an SMB share using the module, I use this as the runbook:

---
- name: Create SMB share
  hosts: localhost
  connection: local
  vars_files:
          - /root/LOGIN.yml
          - /root/GLOBAL-VARS.yml
          - /root/SHARE-VARS.yml
  tasks:
          - name: create smb share for {{SHARE}}
            dellemc_isilon_smb:
                    onefs_host: "{{ONEFS_HOST}}"
                    verify_ssl: "{{VERIFY_SSL}}"
                    api_user: "{{API_USER}}"
                    api_password: "{{API_PASSWORD}}"
                    share_name: "{{SHARE}}"
                    path: '/'
                    access_zone: "{{ZONE}}"
                    file_create_mask: "{{MODEMASK}}"
                    file_create_mode: "{{MODEMASK}}"
                    directory_create_mask: "{{MODEMASK}}"
                    directory_create_mode: "{{MODEMASK}}"
             state: "present"

 

I receive the following output:

ansible-playbook test_share_create.yml

PLAY [SCreate SMB share] *************************************************************************************************************************************************************

TASK [Gathering Facts] *******************************************************************************************************************************************************************************
ok: [localhost]

TASK [create smb share for /ifs/data/test_share] ************************************************************************************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "F********iled to cre********te SMB sh********re test_sh********re with error: Inv********lid v********lue for `id`, must not be `None`"}

PLAY RECAP *******************************************************************************************************************************************************************************************
localhost                  : ok=1    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

 

with the dellemc_ansible_provisioning.log showing:

 

2020-05-01 20:47:01,313 dellemc_isilon_smb.py INFO : Got python SDK instance for provisioning on Isilon
2020-05-01 20:47:01,313 dellemc_isilon_smb.py INFO : Got instance for ProtocolsApi on Isilon
2020-05-01 20:47:01,313 dellemc_isilon_smb.py INFO : Got instance for ZonesSummaryApi on Isilon
2020-05-01 20:47:01,313 dellemc_isilon_smb.py INFO : Got instance for AuthApi on Isilon
2020-05-01 20:47:01,313 dellemc_isilon_smb.py INFO : Attempting to get access zone base path for lab
2020-05-01 20:47:01,415 dellemc_isilon_smb.py INFO : Successfully got zone_base_path for lab is /ifs/data/test_share
2020-05-01 20:47:01,485 dellemc_isilon_smb.py INFO : SMB Share test_share status is 404
2020-05-01 20:47:01,485 dellemc_isilon_smb.py INFO : SMB Details with unmodified mode/mask bits : None
2020-05-01 20:47:01,486 dellemc_isilon_smb.py INFO : Creating new SMB share test_share
2020-05-01 20:47:01,486 dellemc_isilon_smb.py INFO : Attempting to create new SMB share test_share
2020-05-01 20:47:01,486 dellemc_isilon_smb.py INFO : create new SMB , Permissions Object : None
2020-05-01 20:47:02,286 dellemc_isilon_smb.py ERROR : Failed to create SMB share test_share with error: Invalid value for `id`, must not be `None`

 

However, the share is created with the masks set.  The only thing that's there and "odd" is that "everyone" is assigned read permissions:

Permissions:
Account  Account Type  Run as Root  Permission Type  Permission
----------------------------------------------------------------
Everyone wellknown     0            allow            read
----------------------------------------------------------------
Total: 1

 

Testing through iterations of user account, group, user account and group and user account, group and wellknown, all of them generate that same error with the result being the share is created with whatever permission I assign.  The only time I actually see an ID of none set anywhere is when I specify the wellknown, then you see this in the provisioning log:

020-05-01 20:59:35,017 dellemc_isilon_smb.py INFO : create new SMB , Permissions Object : [{'permission': 'full',
 'permission_type': 'allow',
 'trustee': {'id': 'SID:S-1-5-1109',
             'name': None,
             'type': None}}, {'permission': 'full',
 'permission_type': 'allow',
 'trustee': {'id': 'SID:S-1-5-1110',
             'name': None,
             'type': None}}, {'permission': 'read',
 'permission_type': 'allow',
 'trustee': {'id': None, 'name': 'everyone', 'type': 'wellknown'}}]
2020-05-01 20:59:35,846 dellemc_isilon_smb.py ERROR : Failed to create SMB share test_share with error: Invalid value for `id`, must not be `None`

 

One final thing to note.  I found that if you did not specify the provider_type as part of the permissions block, it would randomly attempt to use local instead of AD to validate the account.  This was the playbook I used to generate that last error:

 

---
- name: Create SMB share
  hosts: localhost
  connection: local
  vars_files:
          - /root/LOGIN.yml
          - /root/GLOBAL-VARS.yml
          - /root/SHARE-VARS.yml
  tasks:
          - name: create smb share for {{SHARE}}
            dellemc_isilon_smb:
                    onefs_host: "{{ONEFS_HOST}}"
                    verify_ssl: "{{VERIFY_SSL}}"
                    api_user: "{{API_USER}}"
                    api_password: "{{API_PASSWORD}}"
                    share_name: "{{SHARE}}"
                    path: '/'
                    access_zone: "{{ZONE}}"
                    file_create_mask: "{{MODEMASK}}"
                    file_create_mode: "{{MODEMASK}}"
                    directory_create_mask: "{{MODEMASK}}"
                    directory_create_mode: "{{MODEMASK}}"
                    permissions:
                            - user_name: 'lab\test_user'
                              permission: 'full'
                              permission_type: 'allow'
                              provider_type: 'ads'
                            - group_name: 'lab\test_group'
                              permission: 'full'
                              permission_type: 'allow'
                              provider_type: 'ads'
                              - wellknown: "everyone"
                              permission: 'read'
                              permission_type: 'allow'
                              provider_type: 'ads'
                    state: "present"

 

May 6th, 2020 05:00

Hi,

I just wanted to let you know that I am reaching out to get the document changed for the issue you found on Page 38.  Great catch!

As for your issue:

  "...I was wondering if the SMB ansible module has the ability to remove a user from a share?..."

While I don't see specific example on how to remove a user from a share in the doc, I was wondering if using the the "Modify user permission for an SMB share" and just change the permission and permission type to “Full/Deny” instead off “Full/Allow” would remove the user and do what you want(?).

 

If anyone else has an idea, please feel free to reply!

 

May 6th, 2020 09:00

Additional info regarding my previous post:

 The dev time replied to me and stated that "...There is no ability to remove a user from a share. If necessary, they can do it from the UI. But the permission can be changed from ‘allow’ to ‘deny’..."

May 13th, 2020 05:00

It is my understanding that the playbook error was specific to OneFS version 8.2.0, and was not an issue with OneFS 8.1.3 or OneFS 8.2.2. While the specific issue is being looked at, an acceptable workaround was provided.

No Events found!

Top