This KB describes a scenario when a dynamic vlan sessions created on a particular physical interface need to be moved to a VRF without performing actual authentication on the Radius server. 

Dynamic vlan sessions created on a particular physical interface need to be moved to a VRF without performing actual authentication on the Radius server. Authentication should be performed for subscriber sessions created on all other physical interfaces.

Usually Radius profile is used to move subscriber session to VRF, however, it's also possible to move it without creating additional profiles on the Radius server using the domain map configuration. Domain map uses username that is usually supplied during the authentication phase, and it's important to provide it even if there is no intention to perform authentication on a particular interface. This task could be accomplished in many ways, and one of possible solutions is provided below.

The following configuration could be used for access interfaces where authentication should be performed:

user@device> show configuration interfaces ps0
anchor-point {
    lt-0/0/0;
}
flexible-vlan-tagging;
auto-configure {
    stacked-vlan-ranges {
        dynamic-profile auto-stacked-pwht {
            accept [ pppoe dhcp-v4 dhcp-v6 ];
            ranges {
                any,any;
            }
        }
        authentication {
            password password;
            username-include {
                user-prefix vlan_pd_vrf;
            }
        }
    }
    remove-when-no-subscribers;
}
mtu 2022;
no-gratuitous-arp-request;
unit 0 {
    encapsulation ethernet-ccc;
}

And the following configuration could be used for access interfaces where RADIUS authentication will not be performed:

user@device> show configuration interfaces ps4
anchor-point {
    lt-0/0/0;
}
flexible-vlan-tagging;
auto-configure {
    stacked-vlan-ranges {
        dynamic-profile auto-stacked-pwht {
            accept [ pppoe dhcp-v4 dhcp-v6 ];
            ranges {
                any,any;
            }
        }
        authentication {
            password password;
            username-include {
                user-prefix "user@move_to_vrf"; <=== specific domain name
            }
        }
        access-profile no-auth;                 <=== separate access profile
    }
    remove-when-no-subscribers;
}
mtu 2022;
no-gratuitous-arp-request;
unit 0 {
    encapsulation ethernet-ccc;
}

Access profile:

access {
    profile no-auth {
        authentication-order none;
    }
}

Domain map:

access {
    domain {
        map move_to_vrf {
            target-routing-instance SUBSCRIBERS;
        }
    }
}

VRF configuration:

user@device> show configuration routing-instances SUBSCRIBERS
instance-type vrf;
system {
    services {
        dhcp-local-server {
            dhcpv6 {
                group dhcp6-ls {
                    access-profile no-auth;             <=== no authentication
                    overrides {
                        delegated-pool PREFIX-DELEGATION;
                        delete-binding-on-renegotiation;
                    }
                    interface demux0.0;
                    interface ps0.0;
                    interface ps4.0;
                }
            }
        }
    }
}

Let's see how it works:

user@device> clear network-access aaa statistics authentication

user@device> show network-access aaa statistics authentication
Authentication module statistics
  Requests received: 0
  Accepts: 0
  Rejects: 0
  Challenges: 0
  Timed out requests: 0

user@device> show subscribers
Total subscribers: 0, Active Subscribers: 0
  
user@device> show subscribers
Interface                       IP Address/VLAN ID                      User Name                      LS:RI
ps4.3221225524                  0x8100.4 0x8100.1                       user@move_to_vrf          default:SUBSCRIBERS 
ps4.3221225524                  2001:db8:1000:1000::8                                             default:SUBSCRIBERS
*                               2001:db8:aaaa::/64

user@device> #<=== Both dynamic vlan and DHCP subscriber sessions are placed in the correct VRF

user@device> show subscribers summary port
Interface           Count
ps4: lt-0/0/0       1

Total Subscribers: 1

user@device> show network-access aaa statistics authentication
Authentication module statistics
  Requests received: 0                <=== authentication wasn't performed
  Accepts: 0
  Rejects: 0
  Challenges: 0
  Timed out requests: 0

Mapping Subscriber Domains to Access and Session Options