NetWorker: commands fail "Failed to validate security token" or "Security token has expired"
Summary: nsr commands fail while logged as root, or when running nsr commands from an Administrator command prompt.
Symptoms
nsr commands fail while logged as root, or when running nsr commands from an Administrator command prompt.
nsr commands after logging in with nsrlogin works fine.
NetWorker commands produce the following errors.
Cannot connect to resource database: Unable to set user privileges based on user token for <user> on <NetWorker server>: Failed to validate security token. Unable to set user privileges based on user token for <user> on <NetWorker server>: Security token has expired.
Similar errors may be observed in the NetWorker server's daemon.raw log:
- Linux:
/nsr/logs/daemon.raw - Windows (Default):
C:\Program Files\EMC NetWorker\nsr\logs\daemon.raw - NetWorker: How to use nsr_render_log to render .raw log files
Cause
This is expected behavior.
A user issued a NetWorker authentication token using the nsrlogin previously without running nsrlogout. The nsrlogin tokens expire every eight hours. If nsrlogout is not used to close the session, the token expires and stale tokens from the previous nsrlogin session are present in /nsr/tmp/sec/tokens on the NetWorker server.
Reauthenticating with nsrlogin may issue a new token; however, if nsrlogout is not used the same problem appears when the new token expires.
Resolution
Whenever using nsrlogin command to authenticate a command or shell prompt with NetWorker authentication, you must run nsrlogout when you have completed performing NetWorker tasks.
nsrlogout clears the AUTHC token, thereby preventing stale tokens.
The order of operations is:
- Authenticate a NetWorker user account:
nsrlogin -u USERNAME - Perform NetWorker commands from the command prompt or shell.
- Close the AUTHC session:
nsrlogout
nsrlogin. These elevated prompts are already OS privileged, and NetWorker commands operate using elevated OS privileges. nsrlogin can be used to authenticate an unelevated user prompt with NetWorker accounts. This grants the user access to perform NetWorker tasks when they are permitted to manage NetWorker, but do not have access to elevated OS prompts. The tasks permitted in NetWorker depend the NSR Usergroup that user is defined in.