NVP-vProxy: Failed to install vCenter plugin - Failed to authenticate nw credentials for administrator - Unable to find valid certification path to requested target

           

   Article Number:     502368                                   Article Version: 2     Article Type:    Break Fix 
   

 


Product:

 

NetWorker,NetWorker 9.1,NetWorker 9.1.1

 

Issue:

 

 

The NetWorker VMware Protection (NVP) integration is configured with the vProxy appliance. When attempting to install the vSphere web client plugin from the NetWorker Management Console (NMC), the plugin installation fails. During a review of various logs, it is found that there are many authentication errors that occur when installing the vCenter plugin.   
   
        

            Operation Failed. Failed to install vCenter plugin.   
   
      User-added image   
   
     
     
      A review of the NetWorker server authc-server-audit.log shows that NetWorker believes the credentials are incorrect:     
          
   
      YYYY-MM-DDTHH:MM:SS ERROR Authentication failed, user 'Administrator', error: Unauthorized access: The username or password is incorrect   
   
          
   
     
      A review of the ebr-server.log shows that NetWorker is unable to authenticate credentials:     
          
   
      YYYY-MM-DDTHH:MM:SS INFO validateAdminLogin: Testing provided credentials for nw calls     
      YYYY-MM-DDTHH:MM:SS INFO Call NW: [https://123.45.67.89:9090/nwrestapi/v2/internal/users/administrator]     
      YYYY-MM-DDTHH:MM:SS ERROR NetWorker login failed with given credentials - not admin     
      YYYY-MM-DDTHH:MM:SS ERROR Failed to authentciate nw credentials for Administrator   
   
     
     
      The restapi.log shows a failure with SSL:     
          
   
      YYYY-MM-DD HH:MM:SS DEBUG [http-nio-9090-exec-7] c.e.n.w.a.AuthcClient - Auth request: tenant 'null', domain 'null', userId 'administrator'.     
      YYYY-MM-DD HH:MM:SS WARN  [http-nio-9090-exec-7] o.a.c.p.PhaseInterceptorChain - Interceptor for {https://localhost:9090/auth-server/api/v1/sec/authenticate}WebClient has thrown exception, unwinding now     
      org.apache.cxf.interceptor.Fault: Could not send Message.     
                      at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:64) ~[cxf-core-3.1.0.jar:3.1.0]     
                      at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) [cxf-core-3.1.0.jar:3.1.0]     
                      at org.apache.cxf.jaxrs.client.AbstractClient.doRunInterceptorChain(AbstractClient.java:624) [cxf-rt-rs-client-3.1.0.jar:3.1.0]     
                      at org.apache.cxf.jaxrs.client.WebClient.doChainedInvocation(WebClient.java:1100) [cxf-rt-rs-client-3.1.0.jar:3.1.0]     
                      at org.apache.cxf.jaxrs.client.WebClient.doInvoke(WebClient.java:894) [cxf-rt-rs-client-3.1.0.jar:3.1.0]     
     
      Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://localhost:9090/auth-server/api/v1/sec/authenticate: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target     
                      at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.8.0_131]     
                      at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) ~[na:1.8.0_131]     
                      at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) ~[na:1.8.0_131]     
          
                                                             

 

 

Cause:

 

 

The NetWorker Server authentication database is corrupt.   
     
                                                           

 

 

Resolution:

 

 

Reinstall NetWorker with a fresh installation of the authentication database.   
   
    1) Uninstall NetWorker software from the NetWorker Server   
    2) Reboot NetWorker Server   
    3) Install NetWorker Server software with a fresh installation of the authentication database   
    4) Start NetWorker services   
    5) Login to NMC and install vCenter plugin   
     
                                                           

 

 

Notes:

 

 

The authc-server-audit.log logs are located on the NetWorker server at \Program Files\EMC NetWorker\nsr\authc-server\tomcat\logs on a Windows host, or /nsr/authc-server/tomcat/logs on a Linux host.   
   
    The ebr-server.log logs are located on the NetWorker server at \Program Files\EMC NetWorker\nsr\authc-server\tomcat\logs on a Windows host, or /nsr/authc-server/tomcat/logs on a Linux host.   
   
    The restapi.log logs are located on the NetWorker server at \Program Files\EMC NetWorker\nsr\logs\restapi on a Windows host, or /nsr/logs/restapi on a Linux host.   
   
   
    For more information on vProxy logs, please see Dell EMC KB article 494957:   
   
    NVP-vProxy Triage Guide: NetWorker VMware Protection vProxy Triage and Log Collection Guide   
    https://support.emc.com/kb/494957