"User authentication failed" when trying to add storage account to VBR

[lolcathost]

Hi,

case #07709816.

Support can't figure it out atm, so posting here.

Scenario:
- VBR server running latest 12.3.1
- VBA in Azure running latest 8 (upgraded from VBR)

VBA is mapped without issues in on-prem VBR. I can take backups of Azure VMs in VBA no issues.

In the VBA wizard in VBR, when you add the VBA to VBR, at the end it finds the storage accounts currently in VBA and ask to add credentials so they can be added as external repos in VBR.

And this is where the issues is - if i try to add the storage account VBR throws a "Failed to connect to repository backups: user authentication failed".

But the credentials are correct as in the same server I have installed azure storage explorer, and from there i can add and browse the same storage account without issues, so it is definitely VBR.

Time on the server is correct.

Connection to VBA is direct via VPN to Azure.

Thanks

[nielsengelen]

Hi,

I notice support asked for logs and is assisting you at the moment. Please continue working with support as we'll need insight from logs most likely to understand what causes the error.

[sandsturm]

maybe my forum post can help you as well:
microsoft-azure-f59/backup-of-azure-sto ... 90686.html

[lolcathost]

Thanks both.

The other linked discussion does not really apply to us, but thanks for checking.

I will continue to work with support, just wanted to check if anybody had something obvious to point out.

[lolcathost]

For future readers, fixed by adding the following to the VBR server's registry

ObjectStorageCRLCheckMode value set to 3

in HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication\

(Type: REG_DWORD
Default value: 1
Description: this key controls SSL certificate checks. It has four different modes :
0 - all issues with certificates will abort the job
1 - default; OfflineRevocation status is ignored, all other errors = failure
2 - ignore OfflineRevocation and WarningRevocationStatusUnknown errors
3 - ignore all above + PartialChain error.)

Now this is in theory caused by the certificate chain being broken by a proxy but we dont use proxy, the traffic is going direct to the storage account via VPN from VBR, with no HTTPS inspection, so not sure what is happening, but that "fixed" it as VBR now ignores the cert chain.

Thanks