SR-113624 · Issue 167070
Enabling out-of-the-box Security Policies now redirects immediately
Resolved in Pega Version 7.1.7
When enabling out-of-the-box Security Policies, it was not immediately redirecting to the change password screen but instead requiring the timeout interval to expire before redirect happened. This has been corrected.
SR-118880 · Issue 172588
Change Password redirect loop fixed
Resolved in Pega Version 7.1.7
When URLEncryption is enabled along with Security Policies, redirection to the Change Password screen caused the browser to loop into an endless redirect (HTTP 302 loop). This was caused by Incorrect (un-obfuscated) data being used internally when obfuscation was enabled, and has been fixed.
SR-131072 · Issue 203709
Requestor token creation added for PRExternal authentication
Resolved in Pega Version 7.1.9
When using a PRExternal authentication scheme, the csrfsession requestor token was not created. This caused a heavy volume of INFO logging messages in production due to the null token. This authentication path has now been added and the token will be correctly created for use.
SR-131691 · Issue 202207
Improved performance for incorrect password handling
Resolved in Pega Version 7.1.9
When the operator entered the wrong password in the login screen, numerous "Stream Overwritten" alerts appeared the Alert log. There was no workflow problem involved, but the logging indicated that there was an additional unnecessary call being made to Stream Web-Login, and that unneeded call has been removed to improve system performance and remove the error being logged.
SR-A4056 · Issue 211550
Corrected validation error for Extract rule field length
Resolved in Pega Version 7.1.9
A validation error noting that the field length of the table was limited to 30 characters was occurring when trying to check in an Extract rule even if the field value had been shortened. While checking in the extract rule, a block of code in the Rule-Utility-Function validateTreeProperties was recomputing the pagelist's table name instead of using the one provided by the user. The Rule-Utility-Function validateTreeProperties function has been modified to fix the issue.
INC-179761 · Issue 684676
Basic Access Control (BAC) now available in production level 2+
Resolved in Pega Version 8.6.3
An enhancement has been added to enable the Basic Access Control (BAC) feature for production levels 2 or greater. This is a change from being available previously only in levels 4 and 5, and will facilitate diagnosing access control issues earlier in the development process.
INC-182530 · Issue 695761
SAML datapages cleared before new authentication
Resolved in Pega Version 8.6.3
If a previous user had not logged out or timed out when using SAML authentication, a second person using the same device/browser would end up in the first user's session after performing their own authentication. Investigation showed the second login D_SAMLAssertionDataPage was not getting refreshed with the current user login details; this has been resolved by explicitly deleting the SAML Datapages before processing a new login if the session has not timed out.
INC-183485 · Issue 685270
Performance improvement for offline mobile app
Resolved in Pega Version 8.6.3
Performance issues on an offline mobile app were traced to an empty browser fingerprint caused by a declared variable which was not assigned a value. This has been resolved by adding a !pega.offline check for fireDeferredAsyncRequests.
INC-185251 · Issue 674907
Locking APIs updated to handle CDK key rotation
Resolved in Pega Version 8.6.3
it was not possible to save cases for several hours following the CDK key rotation. This was traced to an exception that caused the system to attempt to acquire a lock on the CDK key instance, and normal save behavior would resume after the default sys lock time out period expired. This has been resolved by updating the system to use LockManager APIs to perform a database save with locks.
INC-186395 · Issue 677206
Updating handling for for Pega-supplied operators with MFA
Resolved in Pega Version 8.6.3
When a site is blocking prweb and using prweb/PRAuth for login with MFA enabled, admin user id logins failed and MFA showed the error screen for Pega-supplied users. This was due to MFA verification not being configured for Pega-supplied operators, and has been resolved by adding an Adminstrator condition to skip MFA for for Pega-supplied operators.