INC-188676 · Issue 696580
Improvements for Report Definition OperatorID filtering
Resolved in Pega Version 8.5.6
Report Definition filters were not working as expected when data from the OperatorID page was used and authentication was enabled. This was traced to the OperatorID page not being correctly populated. To resolve this, the authentication logic has been modified to always create the OperatorID page at requestor level, and the HTTP API layer has been updated to remove the thread level OperatorID page if exists. In addition, an enhancement has been added for improved debugging on log appenders provided by log4j which allows log filtering based on the requestor and thread for a given appender at a specific log level.
INC-188889 · Issue 675579
New application wizard security updated
Resolved in Pega Version 8.5.6
Security around displaying and running the new application wizard has been enhanced.
INC-190368 · Issue 673966
JWT access token key rotation handling updated
Resolved in Pega Version 8.5.6
When using the JWT token, REST services were randomly failing with the error message "Error in Processing JWT". Investigation showed the JWT access token key rotation data which was generated was not propagated to all the nodes. This has been resolved by updating the ORDER BY applied on KEYPAIR_CREATE_TIME_PROP. In addition, the default key pair rotation time has been increased from 15 to 90.
INC-190384 · Issue 676572
URL validation updated to handle custom token endpoints
Resolved in Pega Version 8.5.6
While saving an authentication profile with OAuth details, validation was failing for a valid URL given in the access token endpoint and revoke token endpoint fields. This was traced to the use of the Apache URL validator, which considered some domains to be invalid. To resolve this, the urlvalidator constructor has been updated to include a custom RegexValidator for access token and refresh token URLs.
INC-191726 · Issue 678353
JWT access token key rotation handling updated
Resolved in Pega Version 8.5.6
When using the JWT token, REST services were randomly failing with the error message "Error in Processing JWT". Investigation showed the JWT access token key rotation data which was generated was not propagated to all the nodes. This has been resolved by updating the ORDER BY applied on KEYPAIR_CREATE_TIME_PROP. In addition, the default key pair rotation time has been increased from 15 to 90.
INC-194865 · Issue 695619
Corrected report definition save-as-image option
Resolved in Pega Version 8.5.6
Attempting to save a report definition as an image resulted in an access denied error stating "Browser fingerprint validation failed : A request was received with an invalid or missing browser fingerprint. The request was denied", and the user session was closed. The security SECU0017 alert is generated when a request is sent to a Pega application and the browser fingerprint is either missing or does not match the expected value. The system tries to check the type of request for every requestor ID and fetch the CSRF token, but in this case it was not matching with the token present on the requestor thread. This has been resolved by adding scripts to send the hidden input value needed.
INC-196121 · Issue 687343
Added max records DSS to Purge Agent
Resolved in Pega Version 8.5.6
An issue with nodes going down and jobs failing was traced to high heap consumption by OAuth tokens occupying the clipboard. To resolve this, a DSS setting has been added for purging Max Records of tokens.
INC-196414 · Issue 684237
OAuth token refreshed when revoked on source
Resolved in Pega Version 8.5.6
When an OAuth token was used to authorize the APIs in the system, revoking the token at the source, i.e. from the Service side, did not automatically refresh the token and a logoff/logon was required before a fresh token was generated. This has been resolved by adding an update to explicitly purge revoked tokens.
INC-196839 · Issue 695280
Removed duplicate clipboard page creation
Resolved in Pega Version 8.5.6
An out of memory exception occurred due to the pyInstanceInfoForUpdate clipboard page having 6.5M Embed-InstanceInfo entries. This was traced to the ClientUpdateRequestHandler.getInstanceInfoPage method continuously appending to the ClipboardProperty instanceInfoPage. This has been resolved by removing the extra creation of instance pages within the loop.
INC-199271 · Issue 699654
SAML-based SSO security updated
Resolved in Pega Version 8.5.6
Security updates have been made relating to SAML-based SSO code.