Data Domain: Enable DD Boost OST Token-Based Authentication

Intermittent authentication-related failures may occur when using traditional credential authentication with DD Boost OST Plug-in versions 7.8 through 8.3 in NetBackup 10.x environments.
Backup replication jobs may report credential or authentication errors even though DD Boost replication completes successfully.
Organizations may want to proactively implement a more secure and resilient authentication method for DD Boost operations.

Earlier authentication methods rely on secure credential handling and credential decryption processes that can intermittently fail under certain conditions.
DD Boost OST Plug-in 8.4 introduces token-based authentication as an alternative authentication mechanism.

Data Domain - Enabling Token-Based Authentication introduced in DD Boost OST Plugin 8.4

Token-based authentication is controlled through a configuration file on the host system. The system reads this file at runtime to determine whether to enable token-based authentication or fall back to the standard authentication mode.

Configuration File Location 

The configuration file must be present on the system where the OST plugin is installed.

Linux: /DD_OST/dd_ost_plugin.conf 
Windows: C:\DD_OST\dd_ost_plugin.conf

Configuration File Content

To enable token-based authentication, the file should contain:

token_auth=true

To disable token-based authentication and use the default authentication method, the file should contain:

token_auth=false 

Why Use Token Authentication

Reduces dependency on credential decryption mechanisms that may intermittently fail.
Provides a more secure authentication model.
Helps improve authentication reliability for DD Boost operations.
Simplifies authentication management through a dedicated configuration setting.

Data Domain: NetBackup 10.x AIR Failures with DD Boost plug-in

Additional Information: DD Boost OST Token-Based Authentication Internals

A common question regarding DD Boost OST Token-Based Authentication is whether the setting: 

token_auth=true is the token itself.

The answer is no. The token_auth parameter is only a feature toggle that instructs the OST Plugin to use the token-based authentication workflow instead of the legacy credential encryption/decryption workflow.

How the Token Is Generated

When token authentication is enabled, the OST Plugin initially connects to the Data Domain system using the configured DD Boost credentials. After the connection is established, the plugin requests a token from the Data Domain system using the internal API:

ddp_get_token()

The token is generated automatically and returned to the OST Plugin. No manual token creation or management is required.

Token Lifecycle

A new token is generated automatically for each workflow/job. The OST Plugin does not attempt to reuse or manage previously generated tokens.

The token is configured with:

Immediate validity (relative_start_sec = 0)
Maximum supported duration (token_duration_sec = 0)
Effective validity of up to 14 days

The token is subsequently used for authentication during additional connection requests that occur throughout the workflow, particularly during NetBackup AIR operations.

Where the Token Is Stored

The token is not stored as a file within the OST Plugin installation directory.

Examples:

Linux

/DD_OST

Windows

C:\DD_OST

The only file present for token authentication is: dd_ost_plugin.conf which merely enables or disables the feature.

Instead, the generated token is stored in OST Plugin memory structures and is passed between internal OST workflows as needed. During AIR operations, the token is copied into internal credential structures and used for subsequent Data Domain connections.

Is the Token Stored on the Data Domain System?

For the non-extensible token implementation used by the OST Plugin:

The token itself is not persistently stored on the Data Domain system.
Data Domain stores a user-associated encryption key that is used to validate generated tokens.
A fresh token is generated whenever the OST Plugin requests one.
Token management is therefore not required at the OST Plugin level.

Why Token-Based Authentication Was Introduced

Token-Based Authentication was introduced to address issues associated with storing and decrypting DD Boost credentials during OST workflows, particularly NetBackup Auto Image Replication (AIR).

Prior to this enhancement, credentials were encrypted and retained for later use by asynchronous OST operations.

Intermittent failures could occur during credential decryption. By replacing stored credentials with short-lived authentication tokens, the OST Plugin no longer relies on repeated credential decryption during those workflows.

Summary

token_auth=true only enables the feature.

The authentication token is generated automatically.
Tokens are obtained through the Data Domain API during connection establishment.
A new token is generated for each workflow/job.
Tokens are stored in OST Plugin memory structures, not as files on disk.
Data Domain does not persistently store these OST tokens; only the associated user encryption key is maintained.
No manual token creation, storage, or management is required by administrators.

Frequently Asked Questions (FAQ)

Q: Is token_auth=true the authentication token?

No.

The token_auth=true setting is only a configuration flag that enables the token-based authentication workflow within the DD Boost OST Plugin. It does not contain the token itself.

Q: Is there an actual token?

Yes.

When token-based authentication is enabled, the OST Plugin obtains an actual authentication token from the Data Domain system and uses that token for subsequent authentication operations.

Q: How is the token generated?

The token is generated automatically by the Data Domain system when requested by the DD Boost OST Plugin.

No manual token creation, import, export, or administration is required.

Q: Where is the token stored?

The token is maintained within internal OST Plugin memory structures and is used during workflow execution.

The token is not stored in the configuration file and is not stored as a customer-visible file within the OST Plugin installation directory.

Q: Is the token stored in dd_ost_plugin.conf?

No.

The configuration file only determines whether token authentication is enabled or disabled.

Example:

token_auth=true enables token-based authentication.

token_auth=false disables token-based authentication and causes the plugin to use the traditional authentication mechanism.

Q: Can I view the token?

Token handling is performed automatically by the OST Plugin and Data Domain system.

Q: Is a new token generated for every job?

Yes.

The OST Plugin requests a new token for each workflow/job rather than reusing previously generated tokens.

Q: How long is the token valid?

The token is configured to become valid immediately and uses the maximum supported validity period.

Current implementation uses a validity period of up to 14 days.

Q: Does Data Domain store the generated token?

For the non-extensible tokens used by the OST Plugin, the token itself is not persistently stored on the Data Domain system.

Instead, Data Domain maintains the user-associated encryption key used for token validation.

Q: Why was token-based authentication introduced?

Token-based authentication was introduced to eliminate dependency on credential encryption and decryption operations used by previous authentication workflows.

In some environments, credential decryption could intermittently fail during NetBackup operations such as AIR replication. Token-based authentication removes that dependency and improves authentication reliability by using generated authentication tokens instead of repeatedly decrypting stored credentials.

Q: Does token-based authentication require any changes to NetBackup configuration?

No NetBackup-specific configuration changes are required beyond enabling support in the DD Boost OST Plugin and meeting the documented Data Domain prerequisites.