Symantec VIP MyVIP portal will not authenticate

Products

• VIP Service

Issue/Introduction

Symantec VIP MyVIP or Self-Service portal will not authenticate against the user store, but other VIP services will (Radius, Manager IdP, EGConsole logon)

• Users are failing authentication to MyVIP/SSP portal after inputting username and password
• Error in MyVIP logs show "Could not bind to the directory server" when attempting connection to User Stores

Cause

MyVIP/SSP portal was blocked by adaptive protection mode from Symantec Endpoint Security (SES) Complete client in hybrid setup with Symantec Endpoint Protection (SEP).

• Status message in SES logs:  "Attack Chain Mitigation Detection: WMI Provider Host (Wmiprvse) creating registry items in common persistence locations (actor: Wmiprvse) (target: Registry Persistence). [MITRE: T1047 T1547.001 T1547.004 T1547.014]"

Resolution

Making an exception in the SES policy allowed the MyVIP connection to succeed.

Additional Information

Symantec Endpoint Security documentation -- Using Adaptive Protection:  https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud/Using-Adaptive-Protection.html