SR-D64566 · Issue 547515
Option added for redirect to SAML IDP on logout
Resolved in Pega Version 8.4.2
An enhancement has been added which provides a check box to choose to redirect to SAML IDP on logout from Pega.
SR-D79181 · Issue 551125
OKTA receives parameters on logout
Resolved in Pega Version 8.4.2
When using an OIDC logout endpoint with a parameter set as a data page value, the data page retrieved the ID Token from the database, but when logout was clicked the datapage name was being displayed in the browser instead of the IDToken. To resolve this, code has been added to support sending ID token parameters for logoff endpoint for OKTA logoff using OpeniD connect.
SR-D90939 · Issue 557309
Handling updated for redirect URI construction
Resolved in Pega Version 8.4.2
The redirect URI for an ODIC authorization request to IDP from Pega was truncated, resulting in an incorrect redirect URI. This was traced to the App alias feature was introduced in 8.4 which appends /app/ to the context URL. While constructing OpenID authorization request, the redirect URI was constructed from current login context. In the process of removing the app alias from the URL, a conflict was seen when the server name contained the word "app" in it. To resolve this, the app alias handling has been updated.
SR-D95501 · Issue 557684
Updated jar supporting SAML login to work with JRE11
Resolved in Pega Version 8.4.2
SO authentication was failing with the exception "Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.apache.commons.ssl.TrustMaterial". That class was packaged with Pega via the not-yet-commons-ssl.jar which is no longer being developed and only works with JRE8. This has been resolved by updating the package to the new not-going-to-be-commons-ssl.jar which has been evaluated for all supported JRE versions.
SR-D95525 · Issue 561833
CSRF validation update
Resolved in Pega Version 8.4.2
CSRF validation has been added for non-AJAX get requests which originated from a redirected post request.
SR-D96368 · Issue 555742
10 minute cap added to lockout time interval for failed logins
Resolved in Pega Version 8.4.2
After a certain number of failed attempts, there is a process that locks out the operator for a time interval. When the interval has expired and the operator is able to try again, the next "lockout" uses a time interval double the prior size. Previously, this was able to grow without any restriction. In order to improve effective requestor management, an upper limit has been added for maximum lockout period. The default has been set at 10 minutes or 600 seconds, but this may be configured using the DSS : authPolicy/delay/maxDelay in the Ruleset: Pega-Engine. The value is set in seconds: if the value specified in the DSS is greater than 600 seconds, then the maximum lockout period will fall back to 600 seconds (10 minutes).
SR-D96395 · Issue 555119
CDK key loading modified for better database compatibility
Resolved in Pega Version 8.4.2
Users were unable to log on to the system and received the error "There has been an issue; please consult your system administrator." Investigation showed the log errors stating "(dataencryption.DataKeyProvider) ERROR localhost - Could not get CDK from systemKeyManagementCache - System CDK is null". This was an issue specific to the MS SQL Server database when there were 6 or more CDKs in the database: CDK keys are loaded from database into Cache using an SQL statement which had the ORDER clause. By default, the ORDER clause treats NULL values differently on different databases, and this caused MS SQL databases to not load a necessary CDK key. To resolve this, the SQL query has been modified so the result will be the same for all supported daatbases (Oracle, Postgres & MS SQL Server).
SR-D71977 · Issue 535602
Obj-Browse will retrieve more than 50 records
Resolved in Pega Version 8.5
After performing multiple skims, a newly added property was not retrieved when an Obj-Browse was performed. In Obj-Browse action, when a class is mapped to an external table and does not contain BLOB column pzpvstream, in a specific case where pxObjClass value is a reference to a parameter, a list of properties mapped to the class explicitly by querying pr4_rule_property table using NativeSQL is fetched. This call by default returns only 50 records: in cases where there are more than 50 properties for an external class, some of the properties from the obj-browse response mapping are therefore missed. To resolve this, the limit of 50 records has been removed from this NativeSQL call.
SR-D65112 · Issue 541149
Added support for imported rules to populate bixreportpage
Resolved in Pega Version 8.5
Extract rules were not holding the filter criteria after upgrade while performing save-as (for the first time) of the imported rules from the previous version. Criteria were held when the filters were created in the new version. This was caused by BIX extracts created in earlier releases (7.x) not having bixreportpage included. When an environment was upgraded to 8.x versions, opening an extract required the bixreportpage to be populated with RD metadata including the filters defined in the actual extract. Although the filters from the original extract were converted to filters that are acceptable by ReportDefinition, they were not being added to bixreportpage on opening the extract. To resolve this, the system has been updated to copy the filters back to bixreportpage on opening the extract in the upgraded environment.
SR-D76150 · Issue 539454
Logging updated for EmailListener and Data-Agent queue items
Resolved in Pega Version 8.5
In order to avoid the pr_sys_queue_ftsindexer table being overwhelmed with Data-Admin-Connect-EmailListener and Data-Agent-Queue instances for queued items, the Data-Admin-Connect-EmailListener and Data-Agent-Queue class definitions have been modified to filter queue items to incremental indexing if updates are from system and instance type is data- .