diff --git a/manilaclient/v2/shares.py b/manilaclient/v2/shares.py
index 48bd2a4..0b034b5 100644
--- a/manilaclient/v2/shares.py
+++ b/manilaclient/v2/shares.py
@@ -16,6 +16,7 @@

 import collections
 import re
+import string
 try:
     from urllib import urlencode  # noqa
 except ImportError:
@@ -54,9 +55,15 @@ class Share(common_base.Resource):
         """Delete the specified share ignoring its current state."""
         self.manager.force_delete(self)

-    def allow(self, access_type, access, access_level):
+    def allow(self, access_type, access, access_level,
+              valid_access_types=()):
         """Allow access to a share."""
-        self._validate_access(access_type, access)
+        if not valid_access_types:
+            # Access types that are valid since API version 1.0,
+            # so set them as default.
+            valid_access_types = ('ip', 'user', 'cert')
+        self._validate_access(access_type, access, valid_access_types)
+
         return self.manager.allow(self, access_type, access, access_level)

     def deny(self, id):
@@ -67,21 +74,25 @@ class Share(common_base.Resource):
         """Deny access from IP to a share."""
         return self.manager.access_list(self)

-    def _validate_access(self, access_type, access):
-        if access_type == 'ip':
-            self._validate_ip_range(access)
-        elif access_type == 'user':
-            self._validate_username(access)
-        elif access_type == 'cert':
-            # 'access' is used as the certificate's CN (common name)
-            # to which access is allowed or denied by the backend.
-            # The standard allows for just about any string in the
-            # common name. The meaning of a string depends on its
-            # interpretation and is limited to 64 characters.
-            self._validate_common_name(access.strip())
+    def _validate_access(self, access_type, access, valid_access_types):
+        if access_type in valid_access_types:
+            if access_type == 'ip':
+                self._validate_ip_range(access)
+            elif access_type == 'user':
+                self._validate_username(access)
+            elif access_type == 'cert':
+                # 'access' is used as the certificate's CN (common name)
+                # to which access is allowed or denied by the backend.
+                # The standard allows for just about any string in the
+                # common name. The meaning of a string depends on its
+                # interpretation and is limited to 64 characters.
+                self._validate_common_name(access.strip())
+            elif access_type == 'cephx':
+                self._validate_cephx_id(access.strip())
         else:
-            raise exceptions.CommandError(
-                'Only ip, user, and cert types are supported')
+            msg = ('Only following access types are supported: %s' %
+                   ', '.join(valid_access_types))
+            raise exceptions.CommandError(msg)