INC-207693 · Issue 700542
Documentation updated for large attachments permissions error
Resolved in Pega Version 8.7.2
When using the Microsoft Graph API to send an email which contained an individual attachment 3MB or larger, the error "The token contains no permissions, or permissions can not be understood" was generated. Because the Microsoft Graph API has an attachment size limitation, the Microsoft Graph API send email flow will switch to using the Office 365 Exchange Online API when that size limit is hit. The documentation for this has been updated to explicitly reflect that Office 365 Exchange Online API permissions must be enabled in the Azure Active directory app settings.
INC-217942 · Issue 716931
BIX article updated for XML extract rules
Resolved in Pega Version 8.7.2
The BIX article "Creating and running an Extract rule" has been updated to reflect that the "Get all properties" option fetches basic properties only, and that properties must be selected manually for non-BLOB tables.
INC-182827 · Issue 691527
URL security updated
Resolved in Pega Version 8.7.2
Security has been updated for URL tampering defense and Rule Security Mode.
INC-186897 · Issue 705203
DSS DisableAutoComplete setting honored
Resolved in Pega Version 8.7.2
Setting DisableAutoComplete DSS was not working as expected. This was traced to the system not being able to read the DSS value due to timing related to database startup, and has been resolved by directing the system to read the setting in PREnvironment.java instead of from the prconfig.
INC-198571 · Issue 708633
SSO update
Resolved in Pega Version 8.7.2
In order to ensure shared SSO direct links are used as intended, an update has been made which will explicitly require re-authentication for each use of a direct link.
INC-202702 · Issue 713724
Ruleset creation process updated to maintain thread scope
Resolved in Pega Version 8.7.2
On creating a ruleset, the system generated the error "There has been an issue. Please consult your system administrator." If browser cookies and site settings were cleared and the browser was relaunched before logging in and creating a ruleset, the issue did not occur. Investigation showed that the Application page was at the Requestor scope for some of the threads due to handling in the ruleset creation process that removed the Application page and recreated it in the default scope of the thread with the latest state. To resolve this, the process for deleting the Application page and recreating it on the Requestor page has been removed.
INC-211426 · Issue 706060
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.7.2
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-212265 · Issue 714013
at+jwt header type support added
Resolved in Pega Version 8.7.2
After upgrading from Pega 7 to Pega 8, using JWT validation in the REST service package with type "at+jwt" resulted in the JSON web token being rejected during signature verification with the error "header "typ" (type) "at+jwt" not allowed". Pega uses the third-party Nimbus jar to generate and verify JWT tokens, and this issue was traced to a difference in the versions of that jar: Pega 7.3 uses the nimbus-jose-jwt 5.1 version jar, while Pega 8.6+ uses the 8.20 jar version. Nimbus rejects at+jwt header types by default from the 8.0 jar version. To resolve this and improve backwards compatibility, at+jwt header type support has been added.
INC-215343 · Issue 711087
Security updates
Resolved in Pega Version 8.7.2
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.
INC-216053 · Issue 716444
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.7.2
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.