Exclude users or service accounts from MFA - Symantec VIP

Products

• VIP Service

Issue/Introduction

Need to exclude Service Accounts from VIP Microsoft Credential Provider (MCP) or VIP Pluggable Authentication Module (PAM) for MFA verification. CyberArk CPM utilizes the Service Account to rotate passwords and needs access to preform functions.

Environment

VIP Enterprise Gateway

CyberArk CPM

Resolution

A "no2fa" group needs to be setup on each local host machine running the VIP Module, and then the Service Account needs to be added to that "no2fa" group.

Microsoft Credential Provider

1. Create a group named no2fa (all lowercase) on the host computer using Local Users and Groups.
2. Add the Service Account to that group.
   • Note: The users can be local users or they can belong to the domain.

Pluggable Authentication Module

1. Create a vrsn_otp file under /etc/raddb (or /etc/freeradius/3.0 for Ubuntu Server 22, 24, or 25) and copy
   the appropriate sample contents to this file. (Refer to PAM integration guide for example script)
2. Optionally, to disable the two-factor authentication for certain local groups, add the group name to no2fa. (For example,
   no2fa groupname1:groupname2:groupname3)
3. Set file permission as 0600 to the vrsn_otp file.

Additional Information

MCP and PAM integration guides can be accessed on the VIP Documentation site here:  https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip/cloud/Related-Documents.html