INC-186897 · Issue 681031
DSS DisableAutoComplete setting honored
Resolved in Pega Version 8.6.3
Setting DisableAutoComplete DSS was not working as expected. This was traced to the system not being able to read the DSS value due to timing related to database startup, and has been resolved by directing the system to read the setting in PREnvironment.java instead of from the prconfig.
INC-188127 · Issue 678351
Updated cache key generation for ROPC
Resolved in Pega Version 8.6.3
After configuring outbound email functionality using MSGraph with OAuth 2.0, sending the emails failed consistently following passivation. Running "Test connectivity" in the Email Account data instance then seemed to restart the functionality and the automation "Create And Send Email" subsequently worked. This was traced to a missing username in the cache key generation for the Resource Owner Password Credentials (ROPC), which caused the same token to be fetched when attempting to dynamically generate different usernames, and has been resolved.
INC-188128 · Issue 671828
Refresh assignment checks updated
Resolved in Pega Version 8.6.3
Additional privilege checks have been added to refresh assignment.
INC-188162 · Issue 673508
RSA-PSS signature support added for for SAML SSO
Resolved in Pega Version 8.6.3
The XML security jars have been updated to incorporate RSA-PSS signature algorithm support.
INC-188889 · Issue 675581
New application wizard security updated
Resolved in Pega Version 8.6.3
Security around displaying and running the new application wizard has been enhanced.
INC-189989 · Issue 675573
Refresh assignment checks updated
Resolved in Pega Version 8.6.3
Additional privilege checks have been added to refresh assignment.
INC-190384 · Issue 676574
URL validation updated to handle custom token endpoints
Resolved in Pega Version 8.6.3
While saving an authentication profile with OAuth details, validation was failing for a valid URL given in the access token endpoint and revoke token endpoint fields. This was traced to the use of the Apache URL validator, which considered some domains to be invalid. To resolve this, the urlvalidator constructor has been updated to include a custom RegexValidator for access token and refresh token URLs.
INC-193561 · Issue 680428
Client secret made optional for JWT Bearer Grant type
Resolved in Pega Version 8.6.3
After update, trying to connect a REST API using OpenAM as the provider for OAuth and using JWT Bearer as Grant type was resulting in an error indicating the request was not reaching the destination. This was traced to the client secret being designated a mandatory field when it should be optional in this case as the required key store was already configured with a JWT token profile. To resolve this, an update has been made which will make the client secret optional when the authentication scheme is JWT Bearer. In addition, the blank value caused a null pointer error when the client secret was not passed. This has been handled with a check.
INC-194865 · Issue 695621
Corrected report definition save-as-image option
Resolved in Pega Version 8.6.3
Attempting to save a report definition as an image resulted in an access denied error stating "Browser fingerprint validation failed : A request was received with an invalid or missing browser fingerprint. The request was denied", and the user session was closed. The security SECU0017 alert is generated when a request is sent to a Pega application and the browser fingerprint is either missing or does not match the expected value. The system tries to check the type of request for every requestor ID and fetch the CSRF token, but in this case it was not matching with the token present on the requestor thread. This has been resolved by adding scripts to send the hidden input value needed.
INC-196414 · Issue 684239
OAuth token refreshed when revoked on source
Resolved in Pega Version 8.6.3
When an OAuth token was used to authorize the APIs in the system, revoking the token at the source, i.e. from the Service side, did not automatically refresh the token and a logoff/logon was required before a fresh token was generated. This has been resolved by adding an update to explicitly purge revoked tokens.