SR-D23239 · Issue 499595
Support added for multi-operator SAML logins
Resolved in Pega Version 8.3.1
When a SAML user is logged in by Single Sign-On (SAML), the system processes the login to portal as a different operator if there was a function on the Attribute field under Operator identification in the SAML authentication service. In this scenario, using an expression for operator provisioning did not work because all SAML login sessions resolved to the same first operator due to parseAndEvaluateExpression() in ExpressionHelper.java ignoring new expression arguments if the expression page already existed. To support the use of multiple operator logins in this format, the system has been updated to clone a new expression page for every session and update it with the correct expression arguments.
SR-D47611 · Issue 513113
HTTPS login path issue resolved
Resolved in Pega Version 8.3.1
When using iOS, entering wrong credentials for a login with an https endpoint converted the URL to http. This was traced to a case where the resourcePath was coming as http in SSL enabled system, but the reqURI was still https. To correct this, the system has been updated so that if the reqContextURI starts with https and the requestURL starts with http, then the requestURL will be converted to https.
INC-118838 · Issue 560691
OKTA receives parameters on logout
Resolved in Pega Version 8.2.7
When using an OIDC logout endpoint with a parameter set as a data page value, the data page retrieved the ID Token from the DB, but when logout was clicked the datapage name was being displayed in the browser instead of the IDToken. To resolve this, code has been added to support sending ID token parameters for logoff endpoint for OKTA logoff using OpeniD connect.
SR-D95148 · Issue 557483
Port validation updated for redirect URI
Resolved in Pega Version 8.2.7
When an offline app for windows client was generated, trying to login via SSO resulted in the error "invalid redirect_uri". This was traced to the system validating the whole loopback redirection URL, e.g. "http://127.0.0.1:1234/redirection", including the port number. To enhance flexibility, an update has been made so that the port number will not be validated, allowing the client to establish it based on availability at the moment of the request to the authorization service. NOTE: As a best practice, a loopback URL should not be configured as a redirect URI. If a loopback URL is configured, then at run time the port number will not be validated, and the client application can use any available port on the system including ports that may not be intended for use.
INC-179761 · Issue 684676
Basic Access Control (BAC) now available in production level 2+
Resolved in Pega Version 8.6.3
An enhancement has been added to enable the Basic Access Control (BAC) feature for production levels 2 or greater. This is a change from being available previously only in levels 4 and 5, and will facilitate diagnosing access control issues earlier in the development process.
INC-182530 · Issue 695761
SAML datapages cleared before new authentication
Resolved in Pega Version 8.6.3
If a previous user had not logged out or timed out when using SAML authentication, a second person using the same device/browser would end up in the first user's session after performing their own authentication. Investigation showed the second login D_SAMLAssertionDataPage was not getting refreshed with the current user login details; this has been resolved by explicitly deleting the SAML Datapages before processing a new login if the session has not timed out.
INC-183485 · Issue 685270
Performance improvement for offline mobile app
Resolved in Pega Version 8.6.3
Performance issues on an offline mobile app were traced to an empty browser fingerprint caused by a declared variable which was not assigned a value. This has been resolved by adding a !pega.offline check for fireDeferredAsyncRequests.
INC-185251 · Issue 674907
Locking APIs updated to handle CDK key rotation
Resolved in Pega Version 8.6.3
it was not possible to save cases for several hours following the CDK key rotation. This was traced to an exception that caused the system to attempt to acquire a lock on the CDK key instance, and normal save behavior would resume after the default sys lock time out period expired. This has been resolved by updating the system to use LockManager APIs to perform a database save with locks.
INC-186395 · Issue 677206
Updating handling for for Pega-supplied operators with MFA
Resolved in Pega Version 8.6.3
When a site is blocking prweb and using prweb/PRAuth for login with MFA enabled, admin user id logins failed and MFA showed the error screen for Pega-supplied users. This was due to MFA verification not being configured for Pega-supplied operators, and has been resolved by adding an Adminstrator condition to skip MFA for for Pega-supplied operators.
INC-186395 · Issue 697875
Updating handling for for Pega-supplied operators with MFA
Resolved in Pega Version 8.6.3
When a site is blocking prweb and using prweb/PRAuth for login with MFA enabled, admin user id logins failed and MFA showed the error screen for Pega-supplied users. This was due to MFA verification not being configured for Pega-supplied operators, and has been resolved by adding an Adminstrator condition to skip MFA for for Pega-supplied operators.