Support for encrypted traffic in a cluster
Valid from Pega Version 7.3
The Pega 7 Platform includes the Ignite platform, which supports encryption for intra-cluster communications. You can now configure encryption for intra-cluster traffic for compliance with regulatory or organizational security requirements.
For more information, see Enabling encrypted traffic between nodes.
Batch database processing improvements
Valid from Pega Version 7.3
Batch database processing has been enhanced to ensure that a constraint violation does not occur when you save transactions to a table with a foreign key dependency. Because batch processing changes the order of save operations, it is disabled for transactions with foreign key dependencies. Disabling batch processing ensures that a record with a foreign key dependency on another record will not be written before the record on which it is dependent.
For more information about how batch database processing works and how to enable and disable it, see Batch processing during database write operations.
Improve cluster security by limiting concurrent operator sessions
Valid from Pega Version 7.3
You can increase the security of a Pega® Platform cluster by limiting the number of concurrent sessions allowed for each operator. Because operators typically do not require multiple concurrent sessions for performing their work, limiting the number of sessions reduces the chance that an unknown or untrusted person could access systems in the cluster. Use the new setting Number of concurrent sessions allowed for each operator on the Production tab of the System Data Instance form to configure the number of concurrent sessions for operators. You must restart your system when you change this setting. You can also create a list of operators by using the presence/maxsessions/operators/whitelist Dynamic System Setting, to which the maximum number of concurrent sessions setting will not apply.
For more information, see System form - Completing the Production tab.
Monitor standard and custom security events
Valid from Pega Version 7.3
From the new Security Event Configuration landing page, you can select the standard and custom security events that you want the Pega 7 Platform to log automatically for every user session. The security events are grouped into the following types:
- Authentication
- Data access
- Security administration
- Custom
The API logCustomEvent() is provided so that you can create custom security events that are specific to your applications and that can be monitored by the Pega 7 Platform. For more information, see Security Event Configuration.
SAML configuration supports global resource settings
Valid from Pega Version 7.3
In the SAML Authentication Service form, you can now use global resource settings, which allow greater flexibility for values that change compared to using fixed text values. Apply global resource settings, which are dynamic values, in the Identity Provider (IdP) information section and the Service Provider (SP) settings section of the form.
For more information, see Authentication Service form - Completing the SAML 2.0 tab.
Restrict visibility of scalar property values for certain users
Valid from Pega Version 7.3
You can use the Access Control Policy rule to mask individual scalar property values from specified users. You can restrict visibility for the following property types:
- DateTime
- Integer
- Text
For more information, see Masking property visibility for users.
New System Queue Management landing page
Valid from Pega Version 7.3
You can manage your system queues from the new System Queue Management landing page. You can use this landing page to quickly and efficiently debug applications without exiting Designer Studio. In addition to viewing items in a queue, you can defer, remove, and requeue items in a queue, stop items in progress, and view an item's XML.
As a result of this enhancement, the Broken Queue landing page has been removed.
For more information, see System Queue Management landing page.
Data encryption across search nodes
Valid from Pega Version 7.3
You can now encrypt communication among search nodes. Encryption secures the data that is transferred across nodes so that it cannot be accessed by unauthorized hosts. Encryption is enabled by default for new installations and upgrades from Pega® 7.1.6 or earlier to Pega 7.3. Encryption is not enabled by default for upgrades from Pega 7.1.7 or later to Pega 7.3. You can enable and disable search encryption from the Search landing page or by using the indexing/distributed/enable_inter_node_encryption Dynamic System Setting.
For more information, see Enabling and disabling encryption for communication among search nodes.
Disable inactive operators
Valid from Pega Version 7.3
As a system administrator, you can control access to an application by disabling Operator IDs. To disable an Operator ID, you can use one of the following options in Designer Studio:
- Call the Service REST: user.
- Change settings on the Operator Access tab on the System Settings landing page or on the Security tab on the Operator ID form.
- Define the number of inactive days in the security policies before an Operator ID is automatically disabled.
For more information, see System Settings - Operator Access tab, Enabling Security Policies, Security tab on the Operator ID form.
Security landing pages and features require privileges
Valid from Pega Version 7.3
Security-related landing pages and features are no longer visible and accessible to every user. To view and configure the following security features, you must have the appropriate privileges:
- Attribute-based access control (ABAC) policies require the pzCanManageSecurityPolicies privilege.
- The Authentication Services landing page requires the pzCanCreateAuthService privilege.