5.4 Mandatory Account Properties, Account Types & Linked Accounts

5.4 Mandatory Account Properties, Account Types & Linked Accounts

Quick Answer: Every managed account in CyberArk requires three mandatory properties: Address (the network hostname, IP, or domain of the target), UserName (the account name on the target endpoint), and Platform ID (the governing policy defining rotation rules and plugin mechanics). Beyond standard account classifications (Local, Domain, Database, Cloud), CyberArk uses a Linked Accounts architecture to resolve complex operational constraints. This architecture includes Logon Accounts (for navigating SSH/RDP environments that prohibit direct privileged login), Enable Accounts (for network appliances requiring secondary privilege elevation), and Reconciliation Accounts (for resetting out-of-sync credentials without knowing the existing password).

---

Mandatory Account Properties: The Triad of Managed Accounts

When onboarding an account into CyberArk—whether through the PVWA web portal, Discovery rules, REST API payloads, or PACLI scripts—the Digital Vault enforces three mandatory attributes. Together, these form the fundamental identity triad of any managed credential:

1. Address

• Definition: The network address used by the Central Policy Manager (CPM) and Privileged Session Manager (PSM) to locate and establish communication with the target system.
• Permitted Formats: IPv4 address (192.168.10.50), Fully Qualified Domain Name (app01.corp.internal), or NetBIOS name (APP01).
• Domain vs. Local Scoping: For local accounts, Address points directly to the target server hosting the local SAM database or /etc/passwd. For Active Directory domain accounts, Address points to the Active Directory domain FQDN (e.g., corp.internal) or a specific domain controller.

2. UserName

• Definition: The literal account logon name configured on the target operating system, database, or directory (e.g., Administrator, root, oracle, svc_backup).

3. Platform ID

• Definition: The unique string identifier linking the account to its governing target platform (e.g., WinServerLocal, UnixSSH, OracleDB, AWSConsole).
• Functional Role: The Platform ID dictates all policy parameters: password complexity rules, rotation frequency, CPM plugin execution binaries (.dll or .exe), process/prompts script references, PSM connection components, and Dual Control settings.

Optional & Custom Properties (File Categories)

Safes store additional optional properties defined by the platform or created as custom categories:

• Port: Overrides default connection ports (e.g., targeting SSH on port 2222 or MS SQL on port 14333).
• Database / ServiceName: Specifies the database instance or Oracle SID/Service Name.
• Business Metadata: Custom attributes such as Department, AssetOwner, EnvironmentTier, or ChangeTicket used for search indexing and reporting.

---

Target Account Classifications

Understanding target account classifications is essential for selecting appropriate platforms and scoping CPM communication paths:

---

Linked Accounts Architecture

In enterprise environments, security policies, network barriers, and target OS constraints often prevent CyberArk from directly authenticating with the target account. CyberArk overcomes these challenges by establishing relationships between credential objects using Linked Accounts.

A Linked Account is an auxiliary account object (stored in the same Safe or an isolated administrative Safe) associated with a target account at the platform or account level.

1. The Logon Account

• Operational Problem: Enterprise OS hardening commonly disables direct remote administrative logins over SSH or RDP (e.g., PermitRootLogin no in /etc/ssh/sshd_config, or disabling direct RDP as Administrator).
• Architectural Solution: A non-privileged personal account or dedicated machine user is designated as the Logon Account and linked to the target privileged account (root).
• Workflow:
  1. When PSM initiates an SSH session or CPM triggers a password rotation, it first connects to the target machine using the Logon Account credentials.
  2. Once the unprivileged shell session is established, CyberArk's terminal automation script issues an elevation command (su - or sudo su -).
  3. When prompted for the target credential, CyberArk injects the password of the target privileged account, seamlessly transitioning the session into the elevated administrative context.

2. The Enable Account

• Operational Problem: Enterprise network appliances (Cisco routers, switches, firewalls) enforce two distinct authentication tiers: a user-level login credential to access the unprivileged CLI terminal, followed by an enable secret required to enter privileged EXEC mode (Router#).
• Architectural Solution: The Enable Account stores the secondary enable secret and is linked to the network device account.
• Workflow: When CPM rotates the device credential or PSM brokers an administrative session, CyberArk logs in using the primary target credentials, issues the enable command, and injects the password stored inside the linked Enable Account when prompted.

3. The Reconciliation Account

• Operational Problem: If a target account password is changed out-of-band (e.g., an administrator manually resets it locally during a disaster recovery outage), the Vault credential falls out of sync. When CPM performs its scheduled verification (Verify), authentication fails. A standard CPM Change command also fails because standard changes require authenticating with the existing password before issuing the replacement.
• Architectural Solution: A Reconciliation Account is linked to the target account. This account possesses elevated rights on the target system (e.g., Domain Admin in Active Directory, or an account with sudo passwd rights on Linux) permitting it to override and reset passwords for other accounts.
• Workflow:
  1. CPM detects that the target account is out of sync (LastCPMStatus: Verification Failed).
  2. CPM authenticates directly to the target system using the Reconciliation Account.
  3. Operating under the administrative authority of the Reconciliation Account, CPM issues a force-reset command (e.g., passwd <username> on Linux or Set-ADAccountPassword on Windows), applying a newly generated random password to the target account.
  4. CPM writes the new password to the Vault object, releasing the operational lock and restoring synchronization without human intervention.

---

Comparison of Linked Account Types