"SSPI authentication failed for user"
Challenge
When the Veeam Backup & Replication Configuration Database is using PostgreSQL, direct interaction with the database may fail with the error:
SSPI authentication failed for user
Interactions where this may occur include:
- Installing an update to Veeam Backup & Replication.
- Performing a configuration restore.
- Attempting to interact directly with the database (e.g., using pgAdmin or pgsql commands).
Cause
This error occurs when the account being used to perform the interaction is not authorized to access the Veeam Backup & Replication configuration database within the PostgreSQL instance.
When PostgreSQL is deployed by the Veeam Backup & Replication installer, that PostgreSQL database engine is configured to use SSPI Authentication, which allows for access authentication using Windows accounts. The pg_ident.conf file, which maps Windows accounts to the postgres root user account, is updated to add Windows accounts that should have access to the configuration database. By default, the following Windows accounts are added as authorized to access the database directly:
- The Windows account was used during the initial install.
- The NT AUTHORITY\SYSTEM account, which is the default account used by the Veeam Backup & Replication services.
Solution
Option 1: Use an Existing Authorized Windows Account
To identify which accounts are currently authorized to access the Veeam Backup & Replication configuration database, open the following file in a text editor:
C:\Program Files\PostgreSQL\15\data\pg_ident.conf
At the bottom of the file, you will find at least two uncommented lines with a format similar to this example:
veeam User@Domain postgress
Option 2: Add a Windows Account to The Authorized Users Lists
Identify Which Account Was in Use When the SSPI Error Occurred
These steps assume the SSPI error has recently occurred and is still in the latest log folder.
- Navigate to the PostgreSQL log folder.
The default PostgreSQL 15 path:
C:\Program Files\PostgreSQL\15\data\log - Sort the folder contents by last modified, and open the latest log file.
- Scroll to the end of the log file and begin scrolling up. Look for entries like this:
[user=postgres,db=VeeamBackup,app=[unknown]] LOG: no match in usermap "veeam" for user "postgres" authenticated as "pgadmin@VBR12" [user=postgres,db=VeeamBackup,app=[unknown]] FATAL: SSPI authentication failed for user "postgres"
- Take note of the account indicated in the error.
(In the example above, the account pgadmin@VBR12 is listed at the very end of line 1.)
Add Windows Account to pg_ident.conf
- Open the mappings file:
C:\Program Files\PostgreSQL\15\data\pg_ident.conf - Add a new line at the bottom of the file in the following format:
Replacing pgadmin@VBR12 with the account you identified in your logs on Step 4.
veeam pgadmin@VBR12 postgres
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.