INC-142223 · Issue 598648
Handling added for new case type using reuse case life cycle
Resolved in Pega Version 8.4.4
Creating a new Case Type in a branch ruleset using the 'Reuse case life cycle' option was not working, and the error "branch rulseset not a candidate" was generated. pxCreateCaseDataPages that are called as part of creating a case rely on Param.RuleSetName; generally this parameter is set in the param page when other assets are created. When Reuse case life cycle was selected, other assets were not created and param.RuleSetname was not set. This affected pxCreateCaseDataPages when branch parameter was provided. This was a missed use case, and has been resolved by setting param.RuleSetName from param.ruleset to fix the issue.
INC-148154 · Issue 602922
Hot Fix Manager updated to use installation order for schema import
Resolved in Pega Version 8.4.4
Schema changes were not being imported during the hot fix manager DL import process. Investigation showed this was due to hotfixes in the DL being iterated over from newest to oldest, causing older hotfixes to replace the value added to a map by the newer. To resolve this, the system has been updated to use hotfix install order, which considers selected and dependent hotfixes, rather than ordering newest to oldest. This ensures that newer table representations will override older rather than the other way around.
INC-217974 · Issue 715427
Handling added BIX extraction failure when called from custom activity
Resolved in Pega Version 8.7.2
After update, BIX extraction was failing but email from the schedulers indicated success. Investigation showed that when extract was called from a custom activity by calling pxExtractDataWithArgs, the stepStatusFail 'when' rule in the custom activity was not capturing all the exceptions specific to database extracts. This has been resolved by adding the necessary handling.
INC-215343 · Issue 711087
Security updates
Resolved in Pega Version 8.7.2
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.
INC-209387 · Issue 706151
Security updates
Resolved in Pega Version 8.7.2
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.
SR-A101242 · Issue 270252
STS Policy parsing fixed for Apache Rampart
Resolved in Pega Version 7.2.2
Changes to the Apache Rampart code in Pega 7 introduced an error with parsing the the Web-Service-Policy with a PRCustom activity that writes the SAML token to the requestor during login with an STS / SSO context. This has been rectified by creating an object of com.pega.apache.ws.secpolicy.model.HttpsToken class and setting values based on the parameters set in the received policy assertion.
SR-A24408 · Issue 248682
Page clearing added for AuthReqContex
Resolved in Pega Version 7.2.2
The page "AuthReqContex" was loaded up during SAML authentication and then passivated, but the pages were retained in the clipboard and improperly activated by an unknown thread, causing an error. This has been resolved by adding Page-Remove steps wherever needed in auth activity and logout activity (AuthReqContext, LoginInfo, ReqInfo, RelayStateInfo, and SessionInfo) to remove the pages that are no longer needed.
INC-211426 · Issue 706060
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.7.2
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-216053 · Issue 716444
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.7.2
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
SR-A94633 · Issue 261954
Mouse clicks work on touchscreen/mouse combo devices
Resolved in Pega Version 7.2.2
When using Google Chrome with a touchscreen and mouse combination, some click events such as Calendar date picker were not working when using the mouse. This was due to MenuSystem not using the generic isTouchable API, and this has been updated.