My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse updating a credential used by a proxy in SQL Server Agent to execute SSIS packages.

The CyberArk admin is able to update execution creds on a scheduled task. I ran a successful test with a simple .NET console app and I figure I could run a SSIS package with dtexec in that fashion.

However, if I want to leverage SQL Server Agent jobs and keep the package execution away from the O/S layer, CyberArk needs to be able to update the password on the credential object used by the SSA proxy.

Is there a plug-in or feature that CyberArk can leverage to connect to an instance with a login that has ALTER ANY CREDENTIAL and push a new password?Alternatively, the CyberArk admin suggested calling the REST API (CyberArk AIM) to pull the new password at regular intervals (probably using a non-expiring domain account with the same SQL privs). Has anyone attempted either method?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.