SR-D37872 · Issue 507340
prproductmigration build.gradle updated for new mime4j asset name
Resolved in Pega Version 8.3.1
While running the getMigrationLog for ProductMigration script provided in the Pega 8.2.2 media files, errors appeared referencing "NoClassDefFoundErrors when running getLogs". This was caused by the referenced class not being found on the classpath: the version of the included jar did not include the class needed due to Praxiom's default version being updated to use a new version of mime4j that required an asset name change. To resolve this, the mime4j asset name in prproductmigration build.gradle has been updated to pick up the correct version of the dependency for Praxiom.
SR-D41637 · Issue 512268
Mashup URLs will include thread name for better passivation recovery
Resolved in Pega Version 8.3.1
Mashup screens were distorted after keeping the screen idle for more than 1 hour and then trying to switch between accounts. Investigation showed that during SSO authentication the relaystate generated without including thread name in the URL, leading to the threadname not being passivated or made available during reactivation. To resolve this, the thread name will now be included in the URL.
SR-D42602 · Issue 511583
PRCipher class references updated
Resolved in Pega Version 8.3.1
After upgrade, starting Tomcat resulted in the error "java.lang.ClassCastException: com.pega.platform.securitycore.encryption.internal.CipherDefault cannot be cast to com.pega.pegarules.exec.external.util.crypto.PRCipher"This was traced to an issue with the references for PRCipher: cipher was moved to be a security-core component, but the class structure changes were not fully updated. This has been corrected.
SR-D44307 · Issue 509000
Refined dependency checking for Hotfix Manager
Resolved in Pega Version 8.3.1
The logic in Hotfix Manager was changed in 8.3 to include all Strategic Application hotfixes in the Catalog for platform versions 7.4+. However, because there are some edge cases where multiple hotfixes for different strategic application products have been shipped with the same rule changes, it was found that a DL packaged for one application could pick up hotfixes intended for another app. This prevented the DL from installing on systems where both apps were not installed. To avoid picking up these additional hotfixes, while the catalog shipped in the DL will continue to contain all apps, the system has been updated to use only a list of selected products when generating a catalog for calculating dependencies.
INC-157095 · Issue 638808
Enhancement added for tenant-level authentication
Resolved in Pega Version 8.7
In a multi-tenant PDC with a few tenants that utilize their own custom SSO, a pre-authentication activity inside a tenant that should block community access was also affecting tenants that did not have that pre-auth activity set. This was a missed use case and has been resolved by adding a tenantId hash in SchemePRAuth.makeUniqueSchemeName() to create the authServiceName.
INC-162434 · Issue 640051
LookUpList correctly executes during SSO login with model operator
Resolved in Pega Version 8.7
After configuring SSO to create operators on fly using a model operator, a new user logging in for the very first time had their operator ID created using the model operator, but after upgrade new users logging in to the system received the error "Only authenticated client may start this activity: RULE-OBJ-ACTIVITY @BASECLASS LOOKUPLIST". This was due to the methods used for additional security on the activity @baseclass LookUpList which allows it to only be run by authenticated users, and has been resolved.
INC-163201 · Issue 646910
BrowserFingerprint updated
Resolved in Pega Version 8.7
Security improvements have been added to the browser fingerprint process.
INC-163914 · Issue 668846
Improved Agile Studio passivation recovery
Resolved in Pega Version 8.7
When an Agile Studio session was passivated, the error "SECU0008 : CSRF Detected and Blocked" was seen. Reactivating the session resulted in a blank page. This was traced to the clearing of requestor level registrations added for that particular thread, and has been resolved by adding a new flag to identify if a thread is passivated along with the necessary structure for the conditionalized clearing of requestor level registrations based on this flag.
INC-164336 · Issue 634151
URL validation updated to handle custom token endpoints
Resolved in Pega Version 8.7
While saving an authentication profile with OAuth details, validation was failing for a valid URL given in the access token endpoint and revoke token endpoint fields. This was traced to the use of the Apache URL validator, which considered some domains to be invalid. To resolve this, the urlvalidator constructor has been updated to include a custom RegexValidator for access token and refresh token URLs.
INC-168837 · Issue 646972
CSRF token updated for use with OKTA login
Resolved in Pega Version 8.7
An issue seen while connecting via OKTA has been resolved by updating the CSRF token validation for use with IDP initiated SSO login.