Community

Subscribe
Highlighted

VSC 5 - Account locked when try to access or edit Backup Jobs

Hi all,

running vSphere 5.5 and found an Issue.

when i try to access, edit a Backup Job or click the Backup Section in vSphere Web Client, the Account comes locked immediately.

this Account is a Domain Account with full Privilege to Datacenter and all Objects in vSphere Client

i was able to create Backup Jobs for any existing VM and the Jobs running fine in the Background.

Currently, i could not found what exact the Problem is.

Mysterious . . .

cheers,

Mario

Re: VSC 5 - Account blocked when try to access or edit Backup Jobs

some more Informations :

NetApp Ontap 8.2 - 7-Mode

VMware 5.5

NetApp VSC 5.0X6

Domain Account has Admin Rights to NetApp and vCenter Administrator Role.

cheers,

Re: VSC 5 - Account blocked when try to access or edit Backup Jobs

I am also seeing this issue. VSC is causing the domain account of the logged in user in the VMware Web Client to become locked out. This is a pretty big problem. Any one have a clue on what's causing this?

-Adam

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

I am working on a similar issue internally and here is what I know that might help:

Symptom: Account used to login to vCenter web GUI is locked out in AD when VSC is used.

Troubleshooting:

- Veryfy that SMVI/VSC services are using local system account to run (VSC was should be administrator@vsphere.local with vCenter)
- Stop SMVI/VSC services
- Set SVMI/VSC services to run as an AD service account
- Restart SMVI/VSC services
- Re-register VSC plugin with vCenter server with credentials for an AD account.
- If issue continues, open a case with NetApp Support and provide full AD event logs showing logins leading up to account being locked to from VSC)

This procedure is now defunct.  (5/8/14)  It's a known bug  http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=821600

Message was edited by: Jeff King

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

Hello!

I'm also having this problem. I installed the production release of vsc 5.0 earlier this week. My AD account is being locked immediately when I access the Backup Jobs section. I have full administrator privilegies in vsphere/vsc as well.  I've tried the mentioned possible solution in this post, which didn't help. Any other ideas?

cheers, Christian

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

There are no problems with lockouts when I use a @vsphere.local account instead. It only occurs with AD admin accounts.

-Christian

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

i can confirm when using the vsphere system account i can used the VM Guest Backup Section.

but this is still not working when you have setup Role based Management and give an AD Account Restore Rights to VMs.

it seems to be an permission Issue, because just the Creator (or vSphere System Account) of the Backup Jobs can execute Restores.

VM Backups running fine in the Background until they are not touched from any ohter account.

also found the same Issue when using a local Server account, it`s locked immediately too.

however, still have no solution but hope to find a solution . . .

-Mario

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

This is what my domain controller says repeatedly when I enter the VSC´s Backup Jobs with my AD domain account:

The error code 0xc00000x6a means that the validation failed because my account is using a bad password. I know for sure that the password is not bad! It works everywhere else.

It seems like a software bug to me...

Well, I´ve created a case to Netapp about this issue. Hopefully they will come up with a solution.

-Christian

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

Same issue. Any user who launches the vSphere web client and logs in using their AD account soon has their account locked. I have a ticket open with NetApp, but here's what I'm seeing in smvi.log that looks to be the culprit (%Program Files%\NetApp\Virtual Storage Console\log). AD user omitted but in bold. AD lockout times match up with log entry times.

[2014-04-21 10:52:39,210] [qtp1348652814-27] [DEBUG] inside getBackupJobCount : moref = VirtualMachine:vm-6132

[2014-04-21 10:52:39,241] [qtp1348652814-27] [DEBUG] Instantiating service url 'https://localhost:8043/smvi/services/SnapManager' for class 'com.netapp.smvi.api.SnapManagerService' using user 'USER'

[2014-04-21 10:52:39,787] [qtp1348652814-27] [DEBUG] SmviApiServiceImpl.getBackupJobCount() : Calling a backup job list web service

[2014-04-21 10:52:40,739] [qtp1348652814-27] [DEBUG] SmviApiServiceImpl.getBackupJobCount() : Job list OPERATION ID: e488c0d616e53d84118c2523fe923e83

[2014-04-21 10:52:41,987] [qtp1348652814-27] [DEBUG] result.id e488c0d616e53d84118c2523fe923e83result.state  RUNNING

[2014-04-21 10:52:43,141] [qtp1348652814-27] [DEBUG] result.id e488c0d616e53d84118c2523fe923e83result.state  COMPLETE

[2014-04-21 10:52:43,656] [qtp1348652814-27] [DEBUG] inside getBackupCount : moref = VirtualMachine:vm-6132

[2014-04-21 10:52:43,687] [qtp1348652814-27] [DEBUG] Instantiating service url 'https://localhost:8043/smvi/services/SnapManager' for class 'com.netapp.smvi.api.SnapManagerService' using user 'USER'

[2014-04-21 10:52:44,171] [qtp1348652814-27] [DEBUG] SmviApiServiceImpl.getBackupCount() moref VirtualMachine:vm-6132

[2014-04-21 10:52:44,311] [qtp1348652814-27] [DEBUG] SmviApiServiceImpl.getBackupCount() ID cd1a1669d0b021233115db2a3d98dcdd

[2014-04-21 10:52:44,701] [qtp1348652814-24] [DEBUG] inside getBackupJobCount : moref = VirtualMachine:vm-6132

[2014-04-21 10:52:44,717] [qtp1348652814-24] [DEBUG] Instantiating service url 'https://localhost:8043/smvi/services/SnapManager' for class 'com.netapp.smvi.api.SnapManagerService' using user 'USER'

[2014-04-21 10:52:45,606] [qtp1348652814-24] [DEBUG] SmviApiServiceImpl.getBackupJobCount() : Calling a backup job list web service

[2014-04-21 10:52:45,777] [qtp1348652814-27] [DEBUG] result.id cd1a1669d0b021233115db2a3d98dcddresult.state  COMPLETE

[2014-04-21 10:52:45,949] [qtp1348652814-24] [DEBUG] SmviApiServiceImpl.getBackupJobCount() : Job list OPERATION ID: 25a60a36f51b83250ebf47715eaa8c8a

[2014-04-21 10:52:47,166] [qtp1348652814-24] [DEBUG] result.id 25a60a36f51b83250ebf47715eaa8c8aresult.state  COMPLETE

[2014-04-21 10:52:47,369] [qtp1348652814-24] [DEBUG] inside getBackupCount : moref = VirtualMachine:vm-6132

[2014-04-21 10:52:47,400] [qtp1348652814-24] [DEBUG] Instantiating service url 'https://localhost:8043/smvi/services/SnapManager' for class 'com.netapp.smvi.api.SnapManagerService' using user 'USER'

[2014-04-21 10:52:47,899] [qtp1348652814-24] [DEBUG] SmviApiServiceImpl.getBackupCount() moref VirtualMachine:vm-6132

[2014-04-21 10:52:48,008] [qtp1348652814-24] [DEBUG] SmviApiServiceImpl.getBackupCount() ID 474ea80f9a442ae4cebdd4569f510032

[2014-04-21 10:52:49,319] [qtp1348652814-24] [DEBUG] result.id 474ea80f9a442ae4cebdd4569f510032result.state  COMPLETE

[2014-04-21 11:16:28,353] [qtp1348652814-23] [DEBUG] inside getBackupJobCount : moref = null

Re: VSC 5 - Account locked when try to access or edit Backup Jobs

Turning off the service NetApp SnapManager for Virtual Infrastructure seems to be the workaround for right now. I'll post any more info I get.