VBR9 EM doesn't allow Quick Backups for non-admins

[TomF]

Since upgrading to B&R v9, our users (with Portal User rights) can't start any Quick Backups using the vCenter Plugin.
Portal Adminstrators are still able to do this.

Error message from the plugin is:

Code: Select all

Server error: Failed to GET resource. Access denied. URL: /api/lookup

When trying this manually in the API (via https://<vbrmachine>:9398/web/#/api/lookup), it returns

Code: Select all

Current user does not have permissions to perform 'Lookup' operation.

for any non-admin Enterprise Manager user.

An admin user receives:

Code: Select all

The request must contains either of these parameters: host or hierarchyRef

indicating sufficient permissions.
FWIW, Restore Operators fail as well, at the "/api/query" operation.

Veeam B&R and EM version is 9.0.0.902. vCenter is a VCSA, VBR a Win2012 VM.
In v8, starting Quick Backups or VeeamZIPs worked fine for Portal Users.

I'm opening this thread in the hopes of receiving more than the generic response I received, see case ID #01681845. There you'll also find screenshots of the problem.

[foggy]

Hope this will be a less generic response. This looks like a bug, we're currently trying to reproduce this, I will let you know once I get more info from QA. Thanks.

[TomF]

Thanks for looking into it. I posted some logs to the case, let me know if I can help you with debugging.

[foggy]

Following up on this, actually the user with Portal User role shouldn't be able to perform any type of backup, v9 has more valid behavior (looks like v8 simply lacked the corresponding permissions check). So VeeamZIP will also fail in the future versions.

[TomF]

In this case, what is the correct permission to allow other users to perform Quick Backups (since Restore Operators fail as well) ? Alternatively, how can I assign backup permissions to that role ?
If this currently isn't possible at all, I'd like to post this as a feature request.

[Gostev]

I will look into this change, as it was not planned. vCenter has its own permissions which already enable delegating users ability to manage only specific VMs, so I don't see why we need complicate things by adding yet another permission system on top of this. Thanks!