Skip to main content
NetApp Knowledge Base

Commvault SnapDiff v3 backup fails with HTTP 403 Forbidden on ONTAP - Could not get an Access Token

  1. Last updated
  2. Save as PDF
Views:
146
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
CORE
Last Updated:

Applies to

ONTAP 9.10.1 and later

Issue

A Commvault IntelliSnap SnapDiff v3 backup or snapshot-catalog job fails with the following symptoms:

  • Commvault client log (CVLibCurl trace) reports: 
    Please set array [<data_svm_array>] to tunnel to its cluster array. And confirm the
cluster array entry has a role on the file server which allows access_tokens.
  • Commvault job error message: 
    Could not get an Access Token
  • ONTAP cluster security audit log shows the access-token REST call returning HTTP 403: 
    <cluster_name>: http :: <media_agent_ip>:<src_port> :: <data_svm>:<svm_user> ::
POST /api/cluster/licensing/access_tokens ::
{"grant_type":"client_credentials","client_id":"Commvault","client_secret":***} :: Error: Forbidden
  • Failure occurs on configurations that previously worked with SnapDiff v1 or v2 after:
    • A Commvault SP or HF upgrade that enabled SnapDiff v3
    • First-time enablement of Snapshot Cataloging or Backup Copy with SnapDiff v3

Cause

Two conditions, typically present together, produce this failure:

Cause 1 — ONTAP login is SVM-scoped; the access_tokens endpoint is cluster-scoped:

  • POST access_tokens is served only on the cluster management LIF
  • ONTAP authorizes it only against a login defined on the cluster admin vserver
  • A role created with -vserver <data_svm> cannot authorize any cluster-scoped REST call regardless of which cmddirs are granted

Cause 2 — Commvault Array Management still uses the legacy SVM-local credentials:

  • ONTAP audit log shows the connecting user as the SVM-local administrator (for example, vsadmin) instead of a dedicated cluster-level account
  • Array Management credentials must be updated independently of Cause 1

Why previously working configurations begin failing after a SnapDiff v3 upgrade:

  • SnapDiff v1 and v2 used ONTAPI (ZAPI) against the data SVM — no cluster-level authorization required
  • SnapDiff v3 is REST-only and introduces the cluster-scoped access_tokens call

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.