Unable to connect to backblaze b2

fred974

Hi,

I logged a forum entry saying that I wasn't able to restore from backup and it was pointed to me that my backup remote was offline.
I tried to recoonect my Backblaze S3 remote and I keep getting this error message:

remote.test
{
  "id": "5c043aa8-8a08-4dcd-bbfb-c2aa214c34d5"
}
{
  "name": "AccessDenied",
  "$fault": "client",
  "$metadata": {
    "httpStatusCode": 403,
    "requestId": "c6fc8c7e4f7a82ab",
    "extendedRequestId": "aYyE3pDBGOcM4fGauYlRl+GaiMpQz5TPd",
    "attempts": 1,
    "totalRetryDelay": 0
  },
  "Code": "AccessDenied",
  "message": "not entitled",
  "stack": "AccessDenied: not entitled
    at throwDefaultError (/opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@smithy/smithy-client/dist-cjs/default-error-handler.js:8:22)
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@smithy/smithy-client/dist-cjs/default-error-handler.js:18:39
    at de_GetObjectLockConfigurationCommandError (/opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@aws-sdk/client-s3/dist-cjs/protocols/Aws_restXml.js:4476:12)
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@smithy/middleware-serde/dist-cjs/deserializerMiddleware.js:7:24
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@aws-sdk/middleware-signing/dist-cjs/awsAuthMiddleware.js:14:20
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@smithy/middleware-retry/dist-cjs/retryMiddleware.js:27:46
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/region-redirect-endpoint-middleware.js:14:24
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/region-redirect-middleware.js:9:20
    at /opt/xo/xo-builds/xen-orchestra-202311071630/node_modules/@aws-sdk/middleware-logger/dist-cjs/loggerMiddleware.js:7:26
    at S3Handler._sync (/opt/xo/xo-builds/xen-orchestra-202311071630/@xen-orchestra/fs/src/s3.js:452:19)"
}

I know for sure that the credental are correct but in doubt, I then created a new API credential and even with that the detrails, I keep getting the same message: "not entitled"

I am running Xen Orchestra community Xen Orchestra, commit 9dea5
Master, commit 9dea5

Could anyone please assist me ?

Thank you

olivierlambert

Hi,

Have you asked Backblaze first? It seems to be an issue with your account, so it might not be related to an XO issue (at least at first sight)

fred974

@olivierlambert said in Unable to connect to backblaze b2:

Have you asked Backblaze first?

No but I will.

fred974

@olivierlambert said in Unable to connect to backblaze b2:

Have you asked Backblaze first?

After 9 days of back and forth, I am now back to my starting point...

Backblaze is saying that there is no problem at their end so check xcp-ng...

I just woke up one morning to see that the remote was no longer working.. It has been working perfectly for almost a year... I updated Xen Orchestra community in case it was a bug but I am still not able to connect...

I am running Xen Orchestra, commit af7aa with Master, commit 03de8

Could anyone please help me?

Thank you

fred974

Here is the latest error when saving my settings

remote.test
{
  "id": "5c043aa8-8a08-4dcd-bbfb-c2aa214c34d5"
}
{
  "name": "AccessDenied",
  "$fault": "client",
  "$metadata": {
    "httpStatusCode": 403,
    "requestId": "3d7883ea3ba87dc5",
    "extendedRequestId": "aYwU3EzAZOX84u2YJYrNlIWYMMqgz7zNU",
    "attempts": 1,
    "totalRetryDelay": 0
  },
  "Code": "AccessDenied",
  "message": "not entitled",
  "stack": "AccessDenied: not entitled
    at throwDefaultError (/opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@smithy/smithy-client/dist-cjs/default-error-handler.js:8:22)
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@smithy/smithy-client/dist-cjs/default-error-handler.js:18:39
    at de_GetObjectLockConfigurationCommandError (/opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@aws-sdk/client-s3/dist-cjs/protocols/Aws_restXml.js:4476:12)
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@smithy/middleware-serde/dist-cjs/deserializerMiddleware.js:7:24
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@aws-sdk/middleware-signing/dist-cjs/awsAuthMiddleware.js:14:20
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@smithy/middleware-retry/dist-cjs/retryMiddleware.js:27:46
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/region-redirect-endpoint-middleware.js:14:24
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@aws-sdk/middleware-sdk-s3/dist-cjs/region-redirect-middleware.js:9:20
    at /opt/xo/xo-builds/xen-orchestra-202311151203/node_modules/@aws-sdk/middleware-logger/dist-cjs/loggerMiddleware.js:7:26
    at S3Handler._sync (/opt/xo/xo-builds/xen-orchestra-202311151203/@xen-orchestra/fs/src/s3.js:452:19)"
}

florent

@fred974 hi

could you try to connect with the cli aws ? you should be able to copy a file from and to your bucket

fred974

@florent said in Unable to connect to backblaze b2:

could you try to connect with the cli aws

I can try, can you please point me to some documentation? I've never done that before

florent

@fred974

backblaze has a guide : https://www.backblaze.com/docs/cloud-storage-use-the-aws-cli-with-backblaze-b2

please connevt and try to transfer a file from and to your bucket

Pete

I might be having the same issue, which only appeared when I updated XO. There appears to be an issue when you use a key that is specific to a bucket. If I use an key that has permission on all buckets you don't get the not entitled message, but obviously that is not ideal.

I have tested the bucket with the s3 aws tools and it worked without issue.

I hope this helps.

florent

@Pete Hi, that is interesting

do you have a XOA or could you install a trial XOA in a VM with your backblaze credentials ? I would like to make some tests

Pete

@florent I have the free version of XOA as well as the XO from sources. I will add the B2 credentials to XOA.

florent

@Pete it would be great if you could open a ticket and a support tunnel, I will connect tomorrow morning ( Paris time, it's 9PM here ) to look for a solution

Pete

@florent I have created a new key that is bucket specific. I added the credentials but I assume I must need premium as it says feature unauthorised. I have already used the trial up. Not sure if that is an issue.

Do you need XOA connected to a xenserver? If not I don't mind leaving the tunnel open and you can take a look when you like.

There are a few test backups in the bucket, nothing I need.

Pete

This post is deleted!

florent

@Pete thanks I will look into it . You can delete your message with the id.
I will be able to find my way ( I will install the stand alone packages @xen-orchestra/fs that contains the s3 logic )

Pete

@florent No problem.

florent

@Pete it looks like the backblaze bucket was created with an encryption key . Can you put the encryption key on the XOA ?

Pete

@florent From the XO side, yes I was testing that. I have added the key.

florent

@Pete could you tests this branch in your xo from the source ?
fix_s3_permission_object_lock` from this PR https://github.com/vatesfr/xen-orchestra/pull/7195

fbeauchamp opened this pull request in vatesfr/xen-orchestra

closed fix(s3): enable content md5 header even if user can't check it #7195

Pete

@florent I have installed the branch and that solves the problem