After upgrading vCenter to 7.0 U3h, configuring backup fails with error "Access to backup server is denied. Check your credentials"

Products

• VMware Cloud Foundation
• VMware vCenter Server

Issue/Introduction

• Post upgrading VC to 7.0 U3h, when trying to configure the backup on VAMI it fails with the error "Access to backup server is denied. Check your credentials"

• vCenter - /var/log/vmware/applmgmt/applmgmt.log
  
  2023-02-24T00:00:03 AM AEDT [3096]INFO:plugins.SMBClientStorageIOLib:Running Command: ['/usr/bin/smbclient', '//backupserver.vsphere.local/backup_share/', '-A', '/dev/shm/smbCredentialFile8begk_do', '--send-bu ffer', '100M', '-c', 'cd files/backup/vxrail/vCenter/vcsa1.vsphere.local/; ls'] 2023-02-24T00:00:04 AM AEDT [3096]ERROR:plugins.SMBClientStorageIOLib:Command failed with error: NT_STATUS_LOGON_FAILURE 2023-02-24T00:00:04 AM AEDT [3096]ERROR:vmware.appliance.backup_restore.archive_impl:Failed to enumerate archive info. Url smb://backupserver.vsphere.local/backup_share/files/backup/vxrail. Err [Failure instance: Traceback: <class 'plugins.StorageIOErrorsLib.PluginError'>: Plugin error occurred. ErrCode: 1, Args: () /usr/lib/python3.7/threading.py:926:_bootstrap_inner /usr/lib/python3.7/threading.py:870:run /usr/lib/python3.7/site-packages/twisted/_threads/_threadworker.py:46:work /usr/lib/python3.7/site-packages/twisted/_threads/_team.py:190:doWork

• Backup using IP fails with same UI error and NT_STATUS_LOGON_FAILURE in the vCenter - /var/log/vmware/applmgmt/applmgmt.log
  
  

Environment

VMware vCenter Server 7.0.3

Cause

Starting with vCenter 7.0 Update 3h build 20395099, the backup architecture has been changed to 'smbclient' from 'cifs'. Limitation of samba client being kerberos DNS TXT packets that are needed for kerberos authentication are not supported.

This causes specific failure in environments where Domain-based DFS namespace is used for the target backup location.

Resolution

Configure the VCSA to backup by using the DFS UNC path instead of the DFS referral path.

Example
All VCSAs are configured to use backup path //backupserver.vsphere.local/imsshare/files/backup/vxrail which is a DFS path that points to a cluster of DFS shares which has been working fine until the the VCs are upgraded to 7.0.3.01000.

Change the backup path to the direct UNC path i.e. //server01.vsphere.local/server01/Files/Backup/VxRail.

Additional Information

This could also be caused by an invalid or missing NTP configuration in vCenter. Configure NTP on the vCenter to match the server hosting the SMB share.