INC-163791 · Issue 704028
Simplified default reference time calculations
Resolved in Pega Version 8.6.4
After a job scheduler was configured to run at Start time = 21:00:00 for Time zone = Europe/London, the scheduler determined 20:00:00 as the next start time. This was due to the calculation for the next start time using the time zone offset calculation pattern for the date and time stored in System-Runtime-Context.pxCreateDateTime, which had difficulty with changes to the time zone definition implemented in the time between the given date and today (meaning the current time) such as daylight savings time. To resolve this, the default reference time from System Runtime Context will be 'now' instead of Date(0).
INC-184798 · Issue 703268
PRconfig added for JVM user/password
Resolved in Pega Version 8.6.4
The setting Dcom.sun.management.jmxremote.local.only=true has been added for use when JMX authentication is enabled by providing jmxuser/password through prconfig.
INC-184964 · Issue 705934
TextMask_Encrypted rule added for use with Oracle
Resolved in Pega Version 8.6.4
When a property was being encrypted by propertyEncrypt access control policy and masked by propertyRead access control policy, it showed a "@@getMaskedValueOfText" error. This has been resolved with the addition of a new rule pxTextMask_Encrypted for Oracle product type which will remove extra spaces from the SOURCE string to handle ORACLE specific usecases.
INC-195580 · Issue 684493
Delay Factor updated to allow values < 1.0
Resolved in Pega Version 8.6.4
After modifying the "Delay factor" parameter on a queue processor rule and and clicking the "Save" button, refreshing the page caused the value of the "Delay factor" parameter to change. This has been resolved by updating the delay calculation strategy to support factors < 1.0.
INC-196447 · Issue 684645
Enhancements added for external Kafka Stream Service
Resolved in Pega Version 8.6.4
To ensure data privacy when using multi-tenant Stream Service hosted on a single Kafka cluster, access will be authorized based on ACLs when a tenant sends direct requests to Kafka. In addition, all Kafka resources (topics and consumer groups) are now able to contain a prefix naming convention which can be used for tenants. This is handled through using a <env name="services/stream/name/pattern" value="{tenant.name}-{environment}-{stream.name}"/> prconfig setting to set the stream name pattern. For example, if the tenant.name is resolved into "companyname", environment into "prod1", and the stream dataset name is pyFTSIncrementalIndexer, then the Topic name created on the external Kafka will be companyname-prod1-pyFTSIncrementalIndexer.
INC-200030 · Issue 698956
Handling added for external Kafka authorization exception
Resolved in Pega Version 8.6.4
When using external Kafka for stream service, the dataflow was failing with the error 'QueueProcessorDataSubscriberException' when topic create permission was missing. As a workaround, the topics could be pre-created, though a "Topic already exists" warning was generated. To resolve this, the cluster-wide right that a producer needs, IdempotentWrite, has been added. For more information please refer to the link https://docs.confluent.io/platform/current/kafka/authorization.html
INC-202865 · Issue 709919
Shared partition operations performance improvements
Resolved in Pega Version 8.6.4
A significant performance degradation was seen in queue processor overhead related to maintaining the partition table. This has been resolved by adding an update which will improve partition operations in a shared context.
INC-206288 · Issue 705269
Addressed intermittent Issues with OAuth2
Resolved in Pega Version 8.6.4
Issues with logging in to a node by way of the access token endpoint were related to the error "JSON web token is rejected during signature verification due to bad signature". This has been resolved by adding clock skew value to the JWT processor bean during validation.
INC-206636 · Issue 703942
Log4j file security vulnerability issue addressed
Resolved in Pega Version 8.6.4
A zero-day vulnerability was identified in the Apache Log4j logging software which could potentially allow malicious actors to take control of organizational networks. Pega has immediately and thoroughly addressed this issue. More information can be found at https://docs.pega.com/security-advisory/security-advisory-apache-log4j-zero-day-vulnerability .
INC-207307 · Issue 709714
Corrected OAuth jar version for custom Keystore rule
Resolved in Pega Version 8.6.4
Attempting to create a custom JKS and Keystore rule so it could be pointed to the Pega cipher and use the encrypt and decrypt functionalities failed with an error indicating it was not a valid KMS keystore. This was traced to an issue with a jar version mismatch: upon checking the dependencies for the nimbus-oauth-sdk jar, even though version 6.18.1 was specified the system picked the 8.27 version through transitive dependencies, and the 8.27 version doesn't have the needed CommonContentTypes class. This has been resolved by reducing the version to 6.18.1 in conflicting build.gradle.