INC-196414 · Issue 684239
OAuth token refreshed when revoked on source
Resolved in Pega Version 8.6.3
When an OAuth token was used to authorize the APIs in the system, revoking the token at the source, i.e. from the Service side, did not automatically refresh the token and a logoff/logon was required before a fresh token was generated. This has been resolved by adding an update to explicitly purge revoked tokens.
INC-196431 · Issue 684887
Refresh assignment checks updated
Resolved in Pega Version 8.6.3
Additional privilege checks have been added to refresh assignment.
INC-196839 · Issue 695282
Removed duplicate clipboard page creation
Resolved in Pega Version 8.6.3
An out of memory exception occurred due to the pyInstanceInfoForUpdate clipboard page having 6.5M Embed-InstanceInfo entries. This was traced to the ClientUpdateRequestHandler.getInstanceInfoPage method continuously appending to the ClipboardProperty instanceInfoPage. This has been resolved by removing the extra creation of instance pages within the loop.
INC-200303 · Issue 692846
OIDC authentication service token reload updated
Resolved in Pega Version 8.6.3
The exception “PRSecurityException: Invalid State Parameter received" was generated along with "Unable to execute OIDC flow : Caught exception while parsing the id token”. The issue was identified in the Keystore cache refresh strategy for the 'reload once per interaction' option. While the Refresh interval was one minute for reload once per interaction, if there was a login request/keystore request in that one minute then the refresh interval was pushed to one minute again from that timestamp. The system was also maintaining the cache refresh interval as one minute. That meant if there were continuous requests, then the refresh interval was pushed to one minute for each request. As a result, the Refresh interval was repeatedly extended until the exception occurred. To resolve this, the Refresh token will happen if there are no requests for a period of one minute, and the cache refresh interval for "Reload once per iteration" has been removed completely.
INC-200877 · Issue 693824
Functions supported in Authorization Service
Resolved in Pega Version 8.6.3
An enhancement has been added to support operator page context evaluation with a Rule-Utility-Function during property mapping evaluation.
INC-201573 · Issue 694750
Client secret made optional for JWT Bearer Grant type
Resolved in Pega Version 8.6.3
After update, trying to connect a REST API using OpenAM as the provider for OAuth and using JWT Bearer as Grant type was resulting in an error indicating the request was not reaching the destination. This was traced to the client secret being designated a mandatory field when it should be optional in this case as the required key store was already configured with a JWT token profile. To resolve this, an update has been made which will make the client secret optional when the authentication scheme is JWT Bearer. In addition, the blank value caused a null pointer error when the client secret was not passed. This has been handled with a check.
INC-204045 · Issue 694323
Signature map updated for fetching keys
Resolved in Pega Version 8.6.3
MFA login worked with SAML 2.0 when the certificate was disabled but failed when the certificate was enabled in Auth Service. The error " "Signature algorithm is null" appeared. This has been resolved by updating the signature map to ignore case sensitivity while fetching keys.
INC-204897 · Issue 696148
Log4j file security vulnerability issue addressed
Resolved in Pega Version 8.6.3
A zero-day vulnerability was identified in the Apache Log4j logging software which could potentially allow malicious actors to take control of organizational networks. Pega has immediately and thoroughly addressed this issue. More information can be found at https://docs.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability .
INC-145293 · Issue 610933
Additional diagnostic logging added for ElasticSearch startup issues
Resolved in Pega Version 8.6.3
The PyIndexerState was stuck in Starting status during node initialization. This issue could occur if the filesystem became hung due to network level issue while scanning entries from /etc/mtab, resulting in a lock which was not released correctly. In order to better determine which node entry in a cluster may be responsible for the hang, an update has been made which will use a temporary virtual environment to repeat the part of the initialization phase responsible and generate additional logs for debugging. To activate this, the PegaSearch.Diagnostics logger must be set in DEBUG mode. This duplicated virtual initialization will not interrupt the normal initialization.
INC-153849 · Issue 641923
Updated replica management for search clusters
Resolved in Pega Version 8.6.3
When using a cluster with two Universal nodes in the cluster, a daily restart process where the second node was not started until the first was fully up resulted in Search initialization failing for the first node while becoming active on the second node. This was traced to the methods used in increasing and decreasing replicas. This has been resolved by revising the handling of ElasticSearch node lifecycle and replicas through a new option "Dindex.searchNodeCount " which includes a specification for the number of expected search nodes. If this option is not present, the old method will be used.