INC-162434 · Issue 640052
LookUpList correctly executes during SSO login with model operator
Resolved in Pega Version 8.5.4
After configuring SSO to create operators on fly using a model operator, a new user logging in for the very first time had their operator ID created using the model operator, but after upgrade new users logging in to the system received the error "Only authenticated client may start this activity: RULE-OBJ-ACTIVITY @BASECLASS LOOKUPLIST". This was due to the methods used for additional security on the activity @baseclass LookUpList which allows it to only be run by authenticated users, and has been resolved.
INC-163201 · Issue 646911
BrowserFingerprint updated
Resolved in Pega Version 8.5.4
Security improvements have been added to the browser fingerprint process.
INC-168837 · Issue 646973
CSRF token updated for use with OKTA login
Resolved in Pega Version 8.5.4
An issue seen while connecting via OKTA has been resolved by updating the CSRF token validation for use with IDP initiated SSO login.
INC-169310 · Issue 649713
Cache check added for SQL queries
Resolved in Pega Version 8.5.4
When performing load testing, a high number of gets were seen for some SQL Queries. In order to improve performance, a check has been added in GlobalTrustStoreCacheImpl.java to assess whether the cache has been initialized or not.
INC-169332 · Issue 648298
Added check for blank username in password reset form
Resolved in Pega Version 8.5.4
The "Forgot password?" screen was allowing the form to be submitted with an empty username so it proceeded to the next screen (verification code). This has been resolved by adding a check for a blank username with the appropriate related error message.
INC-170423 · Issue 648984
Added catch for SAML WebSSO duplicate key exception
Resolved in Pega Version 8.5.4
After logging in from SSO, closing the Pega window and opening it again resulted in the error "Unable to process the SAML WebSSO request : Violation of PRIMARY KEY constraint. Cannot insert duplicate key in object." This has been resolved by updating the session index handling and adding a catch for the duplicate key exception.
INC-173294 · Issue 650236
Mobile "Forgot Password" supports circumstanced rule
Resolved in Pega Version 8.5.4
An enhancement has been added to support a circumstanced rule for the "Forgot Password" flow on mobile.
INC-173466 · Issue 651456
Operator security enhancements
Resolved in Pega Version 8.5.4
It was possible to enable an operator from the operator access landing page even when write access was denied in the data admin operator class. This has been corrected.
INC-159834 · Issue 632248
StackOverFlow logging improved
Resolved in Pega Version 8.5.4
Enhanced diagnostic logging information has been added to help find issues when StackOverFlow errors occur.
INC-161984 · Issue 638857
Web Tier busy threads released on timeout
Resolved in Pega Version 8.5.4
Tomcat Web Tier Busy Threads were not being correctly released, causing stability and performance problems that included health check pings not receiving a thread to service the request so the node was marked as bad, users were quiesced, and the node replaced. Investigation showed the 'put' on the blocking queue did not time out when the queue was full and waited indefinitely, keeping the thread blocked. To resolve this, the system will use 'offer' on the blocking queue instead of 'put' to force thread release on timeout. In addition, debug logs have been added to understand when the offer (or Put) does not succeed and the state of the queue that is causing this issue; the debug logs for class com.pega.pegarules.session.internal.serverpush.RoboticAutomationImpl should be enabled only if the thread busy issue is observed and for limited time window while actively debugging.