INC-213808 · Issue 710298
Stability enhancement to improve platform reliability and resiliency
Resolved in Pega Version 8.6.4
During a NBA campaign run, the data flow partition became stuck in the in-progress status and the campaign run did not complete. NoClassDefFoundException errors were logged, indicating a connectivity issue with the database after which the node was not able to recover successfully. This has been resolved by adding an enhancement to better handle situations where a database outage is detected.
INC-164432 · Issue 696294
Global obfuscation key initialized on first requestor call
Resolved in Pega Version 8.6.4
When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.
INC-182827 · Issue 691528
URL security updated
Resolved in Pega Version 8.6.4
Security has been updated for URL tampering defense and Rule Security Mode.
INC-209298 · Issue 704141
Added security tokens to Worklist assignment error wizard
Resolved in Pega Version 8.6.4
After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.
INC-211426 · Issue 706061
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.6.4
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-215343 · Issue 711141
Security updates
Resolved in Pega Version 8.6.4
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.
INC-176138 · Issue 723084
Performance improvements for save-as
Resolved in Pega Version 8.8
Performance issues were seen when using save-as for rules such as Declare expression, When rules, activity, etc. This was traced to a very large number of extra database queries that were being executed while building the Declarative Cache. To resolve this, an update has been made so the queries used for the Declarative Cache will only be executed when required.
INC-187857 · Issue 700855
Added debug logging and exception recovery for unexpected data object
Resolved in Pega Version 8.8
When rules were complied in lower environment and deployed into production, they later became corrupted and system behavior changed. The error "Java generation failed: caught exception while expanding property pyGetCasePredictionsByClassName on page CurrentRecord" was generated. Investigation showed the auto-populate property pyGetCasePredictionsByClassName was attempting to get the metadata property "pzDataObjectParams": this was a string value in this scenario instead of the expected java object, and caused the exception. To resolve this, a debugger has been added which will check if the property is a java object or not. If it is not, the system will skip the processing and then display an error message with a stack trace.
INC-189772 · Issue 718591
Prconfig added to control declarative behavior during page merge/copy
Resolved in Pega Version 8.8
Declare-on change was getting triggered multiple times even though there was no change in the watched property. Investigation showed this happened when properties had the same value in source and target page. To resolve this, a prconfig has been added which may be used to disable declaratives while performing page merge operations for these properties. The setting name is clipboard/putAllKeepNew/doNotFireDeclaratives: when true, it will disable declaratives when there is no change in property value while performing page merge/copy operation with merge strategy PUTALL_KEEPNEW. The default value is false.
INC-193485 · Issue 695841
REST authentication settings use fully qualified name for resolution
Resolved in Pega Version 8.8
The application setting used in REST connectors for authentication was resolving to similarly-named rules instead of matching the exact name of the rule. This has been resolved by enhancing pzGetSettingID to use both parts of the fully qualified name (name and category) provided by the pzSettingsORA control when determining which setting from the report to return.