Published Release Notes

DCO

This release focused on improving the user experience of creating new rules and tightening up the use of specifications in the Case Designer.  The layout of the New and Save As forms were made more intuitive and intelligent.  Specification actions were made to be more consistent across various aspects of the Case Designer.

• After removing specification references, users can create and save a new specification.
• Developers may now choose either an existing specification or create a new one for subflows and Split-For-Each shapes.
• If a specification is not associated with flow shapes such as sub flows, Utilities, or Split-For-Each, it is possible to import speciications with the same names, and the flow shapes will default to using those imported specs.
• In the outline view, specification changes will be preserved when switching from tab to tab.
• The View Full Details functionality from either Configure Step or the Outline View will display all details, including the specification requirement links.

All search data is encrypted

All search data in Pega Cloud deployments is now encrypted, both at rest and in transit. The encryption of search data makes search compliant with regulatory requirements.

For more information about search, see Full-text search.

Authentication service for basic credentials

A new type of authentication service is available for authenticating operators by using basic credentials (user ID and password). The default Pega Platform™ login is now an instance of this type of authentication service. All basic credentials authentication services include mobile authentication with the OAuth 2.0 protocol and Proof Key for Code Exchange (PKCE). You no longer have to create a custom authentication service to support mobile applications.

For more information, see Configuring a basic authentication service.

Unauthenticated sessions transition seamlessly to authenticated

A new authentication service type allows a guest user to use an application without logging in, and to be prompted to authenticate later in the session. This enhancement supports scenarios such as online shopping portals where a user can browse for items and load a shopping cart as a guest but be prompted for credentials at checkout.

For more information, see Configuring an anonymous authentication service.

Create single sign-on authentication services from App Studio

You can create and enable single sign-on (SSO) authentication services from a new landing page in App Studio. From this new landing page you can also configure new SAML and OpenID Connect authentication services to provision users. For more information, see Creating a SAML SSO authentication service and Creating an OIDC SSO authentication service.

Protect against insecure deserialization

Deserialization is the process of rebuilding a data stream into a Java object. The Open Web Application Security Project (OWASP) has identified insecure deserialization as one of the top 10 security vulnerabilities for web applications. Pega Platform™ protects against this vulnerability by using filters that prevent deserialization of suspect data streams. You can configure these filters from the Deserialization Blacklist landing page.

For more information, see Configuring the deserialization filter.