Configuration Restore using a Veeam admin user without OS logon permissions

[matsusan]

[Background and Environment]
To strictly adhere to the principle of least privilege, we separate the Windows OS logon account from the Veeam administrator account
on our Veeam Backup & Replication (VBR) server.
This ensures our backup data remains protected even if one of these accounts is compromised.
Our specific environment setup is as follows:
- OS Logon User: <OS_ADMIN_USER> (used only for Windows OS access)
- Veeam Admin User: <VEEAM_ADMIN_USER> (assigned the Veeam Administrator role, but has no Windows interactive logon or RDP permissions)

[Our Goal]
We'd like to perform a Veeam Configuration Restore.
Since we are logged into the Windows OS as <OS_ADMIN_USER>, we'd like to specify the credentials of <VEEAM_ADMIN_USER> in the restore wizard to authenticate with the PostgreSQL database.

[The Issue]
In the "Target Database" step of the Configuration Restore wizard,
we select "Native authentication using the following credentials" and enter the <VEEAM_ADMIN_USER> credentials.
However, we cannot complete the restore due to database authentication errors.
(such as "Unable to authenticate because native authentication is disabled on the database server" or "Role ... does not exist")

[Questions]
1. Is it possible to perform a Configuration Restore using a Veeam administrator account that does not have Windows OS logon permissions?
2. If yes, what is the recommended PostgreSQL (pg_hba.conf / pg_ident.conf) and restore wizard configuration to support this scenario?

Thanks,
Ryoma

[vnikiforov]

Hello, Ryoma,

First of all if you receive error messages with the product, I recommend you to open Veeam support cases, that forum is intended as a direct communication line with Veeam R&D and Product Management.

It's not possible to tell for sure without any logs, but I may guess something like that is happening:

The credentials the Target Database step asks for are PostgreSQL database credentials, not Veeam Backup & Replication ones. The Veeam Administrator role assigned to <VEEAM_ADMIN_USER> exists only inside the Veeam Backup & Replication configuration database, PostgreSQL has no such knowledge, so I believe it rejects that account with "Role does not exist". The second error comes from the default setup of the PostgreSQL instance our installer deploys: it accepts Windows (SSPI) authentication only, see KB4818 for the default pg_hba.conf.

Your account separation should still work. Configuration restore can only be started from the backup server itself. The OS logon account performs it in any case, and <VEEAM_ADMIN_USER> stays out of the process entirely.

The recommended setup keeps SSPI: map <OS_ADMIN_USER> to the postgres role in pg_ident.conf as described in KB4542 and select Windows authentication in the wizard. You can remove the mapping line once the restore completes. If you prefer password-based authentication, KB4818 also covers switching pg_hba.conf to scram-sha-256 and setting a password for the postgres role. In that case specify postgres in the wizard, not <VEEAM_ADMIN_USER>.