Authorization check fails if you change the user after installation or upgrade in an NBAC-enabled setup
Authorization check fails if you change the user after NetBackup installation or upgrade in an NBAC-enabled setup.
For more information on the service user (non-privileged or non-root user), refer to the NetBackup Security and Encryption Guide.
The following error message is displayed during installation or upgrade:
bprd failed to grant authorization check permission to host 'host1' 118-VxSS authorization failed: Please make sure NBAC-Authorization is properly configured and running and you have necessary permissions to do these operations.
The issue occurs because the new service user is not part of the Security Administrator group.
Workaround:
To resolve the issue, you should add the new service user to the Security Administrator group (or remove the older one) using one of the following scenarios.
Authorization check fails in one of the following cases:
The root (UNIX) or Local System (Windows) user is changed to a new service user using the nbserviceusercmd -changeUser command.
The NetBackup 9.1 upgrade is performed with the service user other than the root or Local System user.
To resolve the authorization check failure:
After changing the user, ensure that all NetBackup services are up and running.
Run the following command to add the new service user to the Security Administrator group:
vssaz addazgrpmember --azgrpname "Security Administrators" --prplinfo ATP,atdomain,new service user
The directory path to the vssaz command is as follows:
On UNIX: /usr/openv/netbackup/sec/az/bin
On Windows: <install_path>\sec\az\bin
Authorization check fails when one service user is changed to another service user using the nbserviceusercmd -changeUser command.
To resolve the authorization check failure:
After changing the user, ensure that all NetBackup services are up and running.
Run the following command to remove the older service user principle from the Global Security Administrator group.
vssaz removeazgrpmember --azgrpname "Security Administrators" --prplinfo ATP,atdomain,older user
Run the following command to add the new service user to the Security Administrator group:
vssaz addazgrpmember --azgrpname "Security Administrators" --prplinfo ATP,atdomain,new service user
The directory path to the vssaz command is as follows:
On UNIX: /usr/openv/netbackup/sec/az/bin
On Windows: <install_path>\sec\az\bin
If the service user is changed to the root (UNIX) or Local System (Windows) user using the nbserviceusercmd -changeUser command, for example, after the NetBackup 9.1 fresh installation. It's recommended to remove the old service user from the Security Administrator group for increased security.
To eliminate the security vulnerability that may be introduced because of the stale entry of the old service user in the group:
After changing the user, ensure that all NetBackup services are up and running.
Run the following command to remove the older service user principle from the Global Security Administrator group.
vssaz removeazgrpmember --azgrpname "Security Administrators" --prplinfo ATP,atdomain,older user