Published Release Notes

Support for the JSON Web Token Bearer grant type for accessing external APIs

You can now access external APIs by using the new OAuth 2.0 JSON Web Token (JWT) Bearer grant type, in an OAuth 2.0 authentication profile. To use the JWT Bearer grant type as a client assertion, source the JWT from an active SSO session, a token profile, or a property reference. You can use JWTs that you obtain during an OpenID Connect SSO in connectors, to achieve user impersonation flows, such as the On-Behalf-Of (OBO) flow. The OAuth 2.0 type authentication profile now also supports authentication of client applications by using Private Key JWTs.

Instances of the OAuth 2.0 provider are now deprecated. As a best practice, use the new, unified authentication profile configuration instead.

For more information, see Configuring an OAuth 2.0 authentication profile.

Upgrade impact

After an upgrade to Pega Platform 8.4 and later, Authentication Profiles can take advantage of the new JWT based OAuth 2.0 grant type and client authentication features. To take advantage of this and other new security features, you must update any existing Authentication Profiles formats must to use those in Pega Platform 8.4 and later.

What steps are required to update the application to be compatible with this change?

Since these features are available only for profiles created in Pega Platform 8.4 and later, clients must open and then save existing 'Authentication Profile' instances to ensure that the configuration is compatible with the latest authentication formats.

Sign and encrypt signatures and content with additional algorithms

You can now authenticate using JSON Web Token (JWT) token profiles to symmetrically and asymmetrically encrypt both signatures and content. All algorithms in the Nimbus JWT library are supported, including nested tokens. Custom key identifier headers (kid) are also supported. Use token profiles to securely propagate identities and transfer data between systems.

For more information, see Creating a processing JSON Web token profile.

For more information, see Creating a generation JSON Web token profile.

Custom application URL alias in the application definition

Create application URL aliases that support your ability to launch multiple Pega applications simultaneously in a single browser. This feature makes it easier for clients and your customers to log into multiple applications using the same browser and access them simultaneously. You configure your application URL alias in the application definition. For details, see Adding an application URL alias.

For more information, see Simplify access with an Application URL alias (8.4). 

Upgrade impact

After an upgrade to Pega Platform™ 8.4 and later, review to determine if and how you must update your application rules to reflect the current URL aliasing format. As part of these application rule updates, Pega also updated the URL format and value components of the clipboard property, pxRequestor.pxReqServletNameReal, which you can use to discover a servlet name. If your application uses this property to discover a servlet name, update the pxRequestor.pxReqServlet property in the application rule to use the new, required URL and value formats.

For details steps, see the section, Upgrading from Pega 8.3 or earlier: Guidelines for any required changes in your application URL aliasing, in the appropriate Pega Platform Upgrade Guide available at Deploy Pega Platform. 

What steps should the customer take to update their application?

After upgrading, you must update your JMeter test scripts. For detailed steps, see Updating JMeter test scripts after migrating to Pega 8.4.

Pega Express methodology in App Studio for successful Microjourneys

App Studio now supports the Pega Express™ methodology to help you visualize the key factors of your Microjourneys™ - case types, personas, and data objects. With Microjourneys, you can analyze and clearly communicate who the parties that interact with your cases are, what channels of communication they use, and what data they need to resolve a case. Associating personas and data objects with case types also helps you manage your development team's workload by using a list of the draft elements that they need to develop.

For more information, see Plan successful microjourneys in App Studio (8.4), Creating a microjourney for customer success.

Upgrade impact

During a Pega Infinity™ upgrade to 8.4 and later, clients using App Studio are asked to update their applications to support use of the Pega Express™ methodology. Without this application update, the Persona landing page and Data objects and integration landing page are empty. For more information, see Pega 8.4 Deep Dive: Pega Express methodology in App Studio.

What steps are required to update the application to be compatible with this change?

In order to utilize the Pega Express methodology in App Studio and use the Inventory page, click Start now to complete the update of your application and add the required rules to it. If you choose to cancel, App Studio continues to work as expected without the Pega Express methodology features; you can click Start now at the top of your application overview page at any time to install the required rules in your application.

Relationships between elements of Microjourneys in application inventory

A new Inventory page in App Studio helps you manage a delivery of your projects by giving you an overview of the elements of your application and how they interact with your Microjourneys™. The new Inventory page lists draft relationships between the case types, personas, and data objects that you want to implement through development. By checking releases that correspond to the items that you need to develop, you can prioritize your work accordingly. 

For more information, see Plan successful microjourneys in App Studio (8.4), Creating a Microjourney for customer success, Managing application inventory.

Upgrade impact

During a Pega Infinity™ upgrade to 8.4 and later, clients using App Studio are asked to update their applications to support use of the Pega Express™ methodology. Without this application update, the Persona landing page and Data objects and integration landing page are empty. For more information, see Pega 8.4 Deep Dive: Pega Express methodology in App Studio.

What steps are required to update the application to be compatible with this change?

In order to utilize the Pega Express methodology in App Studio and use the Inventory page, click Start now to complete the update of your application and add the required rules to it. If you choose to cancel, App Studio continues to work as expected without the Pega Express methodology features; you can click Start now at the top of your application overview page at any time to install the required rules in your application.

Expanded checks for Java injection vulnerabilities (8.4)

The Java injection vulnerability check feature has been enhanced in Pega Platform™ to further prevent Java injection, including Edit validate, Edit input, and JSP rules. Pega Platform reports errors at design time and run time, and does not run any rule that includes any of the following Java code:

• JavaCompiler
• new ProcessBuilder()
• org.dita.dost.invoker
• Runtime.getRuntime()

For more information, see Configuring the Java injection check.

App Studio enhancements further support Pega Express methodology

App Studio now includes improvements that you can use to plan your Microjourney™ in a more convenient way. The Overview workspace now includes a button to edit application details, such as name, description, and business objectives, without having to switch to Dev Studio. You can also access relevant information faster, because Case Designer displays additional details about channels, data objects, and attachments associated with a case type directly in a properties pane. For improved management of your features, feature categories are now available in the application inventory so that you can clearly communicate to your development team what type of features need implementation.

For more information, see:

• Editing application details in App Studio 
• Associating personas with channels 
• Adding features to application inventory 
• Creating a Microjourney for customer success

Addition of Data Access Tab to access control policy condition rules

You can now select associations and declarative index classes when creating access control policy condition rules. The Column source field in the policy condition can now accept properties from available associations and indexes. For ease of reference, the selected associations and indexes are available on the new Data Access tab. 

Using the new tab, you can build complex authorization models in which access restrictions for a class depend on the attributes present in the associated and indexed classes, along with the attributes in the current class. For example, a project management application can now separately maintain project lists for each operator and use that information to restrict read/write access to unique projects.

The information available on the new Data Access tab reflects rule form changes, which are similar to the existing functionality of the Report Definition in the Application Data Model. 

For more information, see Creating an access control policy condition.

Enhanced mapping of personas and users in App Studio

App Studio now provides a consistent and transparent experience when mapping personas to users. When you invite users to your application, you can associate each user with a run-time persona or developer role by selecting an option from a clearly organized list. For example, you can associate run-time users with a customer service representative persona, and then invite a person to help develop your application and assig them a developer role. For greater clarity, personas now replace references to roles in App Studio.

For more information, see Inviting collaborators to your application.

Tracer support for Cosmos React

The Tracer tool is now available for stateless applications, so that you can trace and debug applications that you build on Cosmos React. Because in a stateless application multiple requests can run simultaneously, to provide clarity, Tracer shows the events by request ID instead of grouping the events by the time of occurrence. For greater convenience, debugging Cosmos React applications is also available in an offline Tracer tool. As a result, you speed up the development process and deliver top-quality applications that are free of bugs.

For more information, see:

• Debug your Cosmos React applications faster with Tracer (8.6)
• Application debugging by using the Tracer tool
• Pega Digital Experience (DX) API
• Cosmos React