Troubleshooting issues with multifactor authentication
This topic provides information on troubleshooting issues that are specific to multifactor authentication in NetBackup.
For more information on multifactor authentication, see the NetBackup Web UI Administrator's Guide.
Table:
Sr. No. | Issue | Possible reason | Resolution |
|---|---|---|---|
1. | You attempt to log in to the NetBackup web UI but instead you land on the page to configure multifactor authentication. | NetBackup administrator has enforced multifactor authentication in the domain, however you have not configured it for your user account. | As multifactor authentication is enforced, you must configure multifactor authentication for your user account. |
2. | During multifactor authentication configuration, you are not able to scan the QR code using multifactor authentication configuration UI. | There maybe some issue with the QR code or the QR code scanner. | If you are not able to scan the QR code from the multifactor authentication configuration UI, you can copy or see the secret key, and can manually insert the secret key in the authenticator application. |
3. | During multifactor authentication configuration, the user is not able to see or copy the secret key from the multifactor authentication configuration UI. | There maybe some issue with the hide / show option or the copy option in the UI. | From the authenticator application, you can scan the QR code. |
4. | During configuration of multifactor authentication, after specifying the correct one-time password and clicking , the following error is displayed: Failed to validate one-time password. | There is a time difference between your handheld device and the NetBackup primary server or the specified one-time password is wrong. | Ensure that the time of your handheld device matches that of the primary server. Enter the correct one-time password before it expires. |
5. | During multifactor authentication configuration, when you scan the QR code and try to overwrite the existing security information in the authenticator application, an error is displayed. | Authenticator application is not able to overwrite the security information. | Before scanning the QR code, ensure that a duplicate entry is not present. |
6. | If multifactor authentication is configured, but the security entry in the authentication application is not present. As a result, you cannot see the one-time password and cannot authenticate. | One-time password cannot be generated in the authenticator application. The smart device is lost. | You must contact the NetBackup administrator to reset your multifactor authentication configuration. After the successful reset, reconfigure multifactor authentication for your user account. |
7. | You are a NetBackup administrator and have configured multifactor authentication for your own user account, however one-time password is not available. | Security information is deleted from the authenticator application or the handheld device is lost. | You can request another administrator to reset your multifactor authentication configuration and then you can reconfigure multifactor authentication for your user account. Alternatively, you can request the OS Administrator to reset your multifactor authentication configuration using the following command: nbseccmd -resetMFA -userinfo <domain type>:<domain name>:<user name> |
8. | The bpnbat -login CLI shows the following error: AT authentication failed | You have configured multifactor authentication for your user account, however the login type 'AT' does not support multifactor authentication. | Use the bpnbat -login -logintype WEB command if multifactor authentication is configured for your user account. It is recommended that you use the interactive mode (bpnbat -login (-Interactive | -i )) to login if multifactor authentication is configured. |
9. | You have not configured multifactor authentication for your user account and bpnbat -login fails. | NetBackup administrator must have enforced multifactor authentication for all users in the domain. | If multifactor authentication is enforced, you have to configure it for your user account and run the bpnbat -login (-Interactive | -i ) command to login. |
10. | During the bpnbat -login operation, you have specified the correct username and password to logon to the NetBackup host that is earlier than 10.3, but authentication fails. | You have configured multifactor authentication for your user account. | You must provide the one-time password after the password when you run the bpnbat -login command. |
11. | During the bpnbat -login operation, the cred file (-cf ) is used, but login failed. | You have configured multifactor authentication for your user account. | You must use the bpnbat -login (-Interactive | -i ) command to login when the cred file is used. |
12. | During bpnbat -login, you have provided the correct user name, password, and one-time password, but authentication failed. | There is a time difference between your handheld device and the NetBackup primary server or the specified one-time password is wrong. | Ensure that the time of your handheld device matches that of the primary server. Enter the correct one-time password before it expires. |
13. | During the NetBackup Administration Console login, the following error is displayed: "Failed to check whether multifactor authentication is enabled for the user account or not." | The web service is down or the it is unable to process the request. | Ensure that the web service up and running. Check the following logs: bpjava logs: /usr/openv/netbackup/logs/bpjava-msvc web service logs: /usr/openv/logs/nbwebservice |
14. | During the NetBackup Administration Console login, the following error is displayed even when the correct username and password are specified: "Invalid username or password." | You have configured multifactor authentication for your user account. | You should provide the one-time password after the password. |
15. | In the NetBackup Administration Console, the following error is displayed: Failed to validate the one-time password. | There is a time difference between your handheld device and the NetBackup primary server or the specified one-time password is wrong. | Ensure that the time of your handheld device matches that of the primary server. Enter the correct one-time password before it expires. |
16. | When setting up trust between NetBackup primary server using nbseccmd, authentication failed. | You have configured multifactor authentication for your user account. | You should provide the one-time password after the password. |
17. | The nbdeployutil --gather command failed for one or more primary servers. | You have configured multifactor authentication for your user account in a failed primary server. | Run the following command: Run the nbdeployutil --gather CLI with the --apikey-file option. The format of apikey key file should be NetBackup Primary hostname : APIKey For multiple NetBackup domains, ensure that apikeys are provided for all primary server hosts. |
18. | When setup trust between primary servers fails from the NetBackup web UI, NetBackup Administration Console, or nbseccmd CLI | You have configured multifactor authentication for your user account. | If the user account is configured for multifactor authentication on the target host, append appropriate one-time password to the password. |
19. | The following error is displayed when you use the validate OTP API: The multifactor authentication request ID does not exist. | The specified request ID does not exist. | Specify a valid request ID while using the validate OTP API. |
20. | The following error is displayed when you use the validate OTP API: The multifactor authentication request is not valid. | The JWT token that is used for the subsequent API call is different than the earlier one. | Use the same JWT token for both the API calls. |
21. | The following error is displayed when you change the NetBackup configuration: The configuration cannot be changed using this host. | Multifactor authentication is configured for the user account, however this host does not support multifactor authentication. | Use the NetBackup web UI to perform the operation. |
22. | The following error is displayed when you execute the nbcertcmd or nbseccmd command: EXIT STATUS 3676: invalid error number | Multifactor authentication is configured for the user account, however this host does not support multifactor authentication. | Use the NetBackup web UI to perform the operation. |
28. | The following error is displayed while you modify global security settings, create API keys, or run the nbcertcmd or nbseccmd command: The multifactor authentication request has timed out. | There was a delay in entering the one-time password. | During multifactor authentication, ensure that you enter the one-time password within 180 seconds. When you use APIs, ensure that you call the successive 'validate OTP' API within 180 seconds. |