Published Release Notes

Support for the JSON Web Token Bearer grant type for accessing external APIs

You can now access external APIs by using the new OAuth 2.0 JSON Web Token (JWT) Bearer grant type, in an OAuth 2.0 authentication profile. To use the JWT Bearer grant type as a client assertion, source the JWT from an active SSO session, a token profile, or a property reference. You can use JWTs that you obtain during an OpenID Connect SSO in connectors, to achieve user impersonation flows, such as the On-Behalf-Of (OBO) flow. The OAuth 2.0 type authentication profile now also supports authentication of client applications by using Private Key JWTs.

Instances of the OAuth 2.0 provider are now deprecated. As a best practice, use the new, unified authentication profile configuration instead.

For more information, see Configuring an OAuth 2.0 authentication profile.

Upgrade impact

After an upgrade to Pega Platform 8.4 and later, Authentication Profiles can take advantage of the new JWT based OAuth 2.0 grant type and client authentication features. To take advantage of this and other new security features, you must update any existing Authentication Profiles formats must to use those in Pega Platform 8.4 and later.

What steps are required to update the application to be compatible with this change?

Since these features are available only for profiles created in Pega Platform 8.4 and later, clients must open and then save existing 'Authentication Profile' instances to ensure that the configuration is compatible with the latest authentication formats.

PDF/UA support

PDF documents that you generate in Pega Platform™ are now in PDF/UA format. This enhancement improves accessibility for users who rely on assistive technology, such as screen readers.

For more information, see Setting PDF file versions.

Upgrade impact

With an upgrade to Pega Platform 8.4 and later, the underlying PD4ML library in Pega Platform changes from v3.10 to v4.x. Following an upgrade, most standard HTML-CSS conversions to PDF work seamlessly; however, if you use the following custom coding in their application to convert HTML to PDF, you may find that PDF generation works differently than expected or no longer works:

• Application layer Java in activities that directly link to the underlying PD4ML library
• A Rule Utility Function
• PD4ML tags in HTML fragments

For example, the following PD4ML proprietary CSS keywords are no longer supported in v4.x:

• pd4ml-page-break-border-top
• pd4ml-page-break-border-bottom

What steps are required to update the application to be compatible with this change?

After you upgrade to Pega Platform 8.4 and later and find your PDF generation works differently than expected or no longer works, you should consult the latest documentation available at pd[4]ml support site. You may also consider using the Compact CSS instead of the application skin for PDF generation; for details, see Creating PDF files by using a compact style sheet.

Support for character data type on local variables in activities deprecated

Support for the character data type for local variables in activities is deprecated. Use the string data type instead.

For more information about activities, see Activities.

When rule might not resolve against @baseclass

In the rare case in which a step page context is null, or the pxObjClass associated with the step page is empty, the system no longer attempts to resolve the when rule against @baseclass. As a result, you might see more rule not found errors. Check the step page context and class and ensure that they are not null or empty. In all other cases, if a when rule is not found in any other part of the class hierarchy, the system attempts to resolve it against @baseclass.

DCO Compatibility tool is deprecated

The DCO Compatibility tool has been deprecated. Use the Application Guardrails landing page to see the compliance score and any warnings for your application.

For more information, see Application Guardrails landing page.

Apache Ignite is no longer supported

Apache Ignite is no longer supported and has been replaced by Hazelcast Enterprise Edition 3.10 in embedded mode. If you used encryption with Apache Ignite, you can configure encryption on Hazelcast Enterprise Edition in the same way that you configured it for Apache Ignite.

For more information about encrypting nodes, see Enabling encrypted communication between nodes.

@java and locatable pages no longer supported

@java and locatable pages are no longer supported. Existing rules that use @java and locatable pages will continue to work; however, changes to these rules cannot be saved unless @java and locatable pages are replaced by supported functionality. Use a rule utility function (RUF) instead of an @java page, and use a data page instead of a locatable page. In addition, Pega Platform™ displays a guardrail warning when you open a rule that uses an @java page or a locatable page.

Search indexes require rebuilding after upgrading from Pega Platform 7.1.7 through 7.2.1

Pega Platform™ now supports Elasticsearch 5.6.9. If you are upgrading from Pega 7.1.7 through 7.2.1, discard your existing indexes and build new indexes in a new empty index directory. Create the search indexes by using the Search landing page or the full text indexer. If you are upgrading from Pega Platform 7.2.2 or later, no action is required. You can continue to use your existing search indexes.

For more information, see Rebuilding search indexes and Batch creation and updating of Elasticsearch index files from the command line.

Authentication profile for Connect REST might be removed after upgrade

The Use authentication check box has been removed from the Service tab on the Connect REST form. As a result, after an upgrade, the Authentication profile field might be blank even if an authentication profile was previously configured.

• If the Use authentication check box was cleared prior to upgrading and the Authentication profile field was configured with an authentication profile name, the Authentication profile field is blank. If you are using authentication, you must reenter the profile name.
• If the Use authentication check box was selected prior to upgrading and the Authentication profile field was configured with an authentication profile name, the Authentication profile field retains the previous configuration.

New roles required for system management features and APIs after upgrade

The pzSystemOperationsObserver and pzSystemOperationsAdministator privileges are no longer used for accessing system management features in Admin Studio and for system management APIs. Pega Platform™ has new privileges for individual system management functions and new roles configured with these privileges. Use the following roles to access system management features and APIs:

• PegaRULES:SysOpsAdministrator – has all administrator and observer privileges
• PegaRULES:SysOpsObserver – has all observer privileges
• PegaRULES:SysAdm4 – has all administrator and observer privileges

After upgrading, you can include one or more of these roles in your access group or create a custom role. For more information about access roles, see Access roles.