My organization utilizes CyberArk to force expiration & reset of administrator & service account passwords on the domain. When it comes to SQL Server-related assets, I'm hitting an impasse updating a credential used by a proxy in SQL Server Agent to execute SSIS packages.
The CyberArk admin is able to update execution creds on a scheduled task. I ran a successful test with a simple .NET console app and I figure I could run a SSIS package with
dtexec in that fashion.
However, if I want to leverage SQL Server Agent jobs and keep the package execution away from the O/S layer, CyberArk needs to be able to update the password on the credential object used by the SSA proxy.
Is there a plug-in or feature that CyberArk can leverage to connect to an instance with a login that has
ALTER ANY CREDENTIAL and push a new password?Alternatively, the CyberArk admin suggested calling the REST API (CyberArk AIM) to pull the new password at regular intervals (probably using a non-expiring domain account with the same SQL privs). Has anyone attempted either method?