Skip to main content

Resolved Issues

View the resolved issues for a specific Platform release.

Go to download resolved issues by patch release.

Browse release notes for a selected Pega Version.

NOTE: Enter just the Case ID number (SR or INC) in order to find the associated Support Request.

Please note: beginning with the Pega Platform 8.7.4 Patch, the Resolved Issues have moved to the Support Center.

SR-113624 · Issue 167070

Enabling out-of-the-box Security Policies now redirects immediately

Resolved in Pega Version 7.1.7

When enabling out-of-the-box Security Policies, it was not immediately redirecting to the change password screen but instead requiring the timeout interval to expire before redirect happened. This has been corrected.

SR-118880 · Issue 172588

Change Password redirect loop fixed

Resolved in Pega Version 7.1.7

When URLEncryption is enabled along with Security Policies, redirection to the Change Password screen caused the browser to loop into an endless redirect (HTTP 302 loop). This was caused by Incorrect (un-obfuscated) data being used internally when obfuscation was enabled, and has been fixed.

INC-155276 · Issue 622816

Null check added for step page

Resolved in Pega Version 8.3.6

After creating and adding new Access Roles and application 'Access When' to the privileges instead of Production level, during run time the error "runtime.IndeterminateConditionalException: Trying to evaluate Rule-Access-When conditions L:IsProdAccess when there is no page to evaluate them against" appeared for the specific privileges. This was traced to a missed use case where the system falls back to the step page if the page for evaluating the 'when' condition is null, which did not account for scenarios where the step page can be null. To resolve this, a null check has been added which will fetch the primary page if the step page for the access 'when' condition is null.

INC-156647 · Issue 626293

Improved disconnected requestor cleanup for FieldService

Resolved in Pega Version 8.3.6

A large number of requestors from FieldService with the status as 'Disconnected' were accumulating and causing performance issues. This was traced to the requestors not getting passivated due to users not logging out and new requestors being created for the same users next time, and was caused by the value of the DSS Initialization/PersistRequestor being set as "OnTimeout". When the DSS prconfig/timeout/browser/default is not configured, the default browser requestor timeout is 60 minutes. In this scenario, requestors were not passivating as the requestor passivation timeout was set to the refresh token lifetime for mobile users, which was very large and overwrote the DSS value. This has been resolved by removing the code which set the passivation timeout to the OAuth2 refresh token lifetime.

INC-118838 · Issue 560694

OKTA receives parameters on logout

Resolved in Pega Version 8.4.2

When using an OIDC logout endpoint with a parameter set as a data page value, the data page retrieved the ID Token from the database, but when logout was clicked the datapage name was being displayed in the browser instead of the IDToken. To resolve this, code has been added to support sending ID token parameters for logoff endpoint for OKTA logoff using OpeniD connect.

INC-118927 · Issue 571492

Resolved OAuth2 mobile app loop

Resolved in Pega Version 8.4.2

When a Pega OAuth2 authorize endpoint was invoked and the redirect URI contained "app", a loop was created where the system attempted to fetch the app alias from the state parameter value and was redirected back to itself. This could sometimes result in inconsistent mobile app styling. Investigation showed that a certificate with keyword app that was picked for the redirect URI could have the key word assumed to be the app alias context, so a workaround was to remove the app keyword. To resolve the issue, the system has been updated to look for the app alias only in the state parameter rather than perform a string contains check on the entire query string.

INC-125095 · Issue 560831

SAML authreqcontext duplicate key exception logging changed to debug

Resolved in Pega Version 8.4.2

As part of work done to improve the performance of the pr_data_saml_authreqcontext table during the SAML flow, the duplicate key exception handing was creating a large number of unique constraint log messages while saving sessionInfo to the database during SAML authentication if ADFS was used because the ADFS provider session Info is always blank. This has been resolved by changing the log statement in the duplicate key exception handling to debug.

INC-125429 · Issue 561892

OKTA receives parameters on logout

Resolved in Pega Version 8.4.2

When using an OIDC logout endpoint with a parameter set as a data page value, the data page retrieved the ID Token from the database, but when logout was clicked the datapage name was being displayed in the browser instead of the IDToken. To resolve this, code has been added to support sending ID token parameters for logoff endpoint for OKTA logoff using OpeniD connect.

INC-126640 · Issue 572264

Updated LDAP operator authentication handling

Resolved in Pega Version 8.4.2

After setting up LDAP authentication in an environment using Robotics which runs on Kerberos and configuring LDAP AD integration with a sAMAccountName [specific to Microsoft AD] attribute for the login, two operators were being created for a single user. Investigation showed this was caused by the operator's pyUserIdentifier being mapped in the LDAP service mapping attribute while the operator ID was using a different attribute (userPrincipalName) which was mapped to .pyUserIdentifier because the Kerberos authentication was done via userPrincipalName. For the first login, an operator was created as per the Search filter field. The next time the user logged in with the same ID, another operator was created using the userPrincipalName as per the mapping defined under the mapping tab. This has been resolved by updating LDAP handling. As part of the resolution, a precedence rule has been introduced which will give the highest precedence to a mapped pyUserIDentifier, then logged in operator name. If pyUserIdentifier is not mapped in authservice, the operator name will be the LDAP login operator name. If pyUserIdentifier is mapped in authservice, the operator name will be the LDAP attribute value which is mapped to pyUserIdentifier. If the mapped ldap attribute name is empty, login will fail. In addition, debugging logs have been added to aid in troubleshooting LDAP issues.

INC-126975 · Issue 574805

BrowserFingerprint generation timing updated

Resolved in Pega Version 8.4.2

When trying to 'Show Conflicts' on any Circumstance Template with CSRF enabled, there was an error on screen, the requestor was killed, and the PDC Client displayed a 'Browser fingerprint: undefined' error. Investigation showed that at the time the request was fired, the browserfingerprint had not yet been generated and hence was returned as undefined. This has been resolved by adding the code to generate the fingerprint before the request is invoked.

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us