Can access Pega without username and password
User can access Pega portal without username and password.
Right now the authentication activity in auth service is not doing any validation. User is able to pass the username and other parameters in the URL and able to connect to Pega portal without passing any password.
Submit the userid/username in the http request body if they hit the PRPC URL (“http://<host:port>/prweb/SSOServlet?<unauthenticated access group hash>/!STANDARD”) directly instead of just “http://<host:port>/prweb/SSOServlet”.
By doing so, the content in the body will be passed to the authentication activity.
Published January 31, 2016 - Updated October 8, 2020
Was this useful?
0% found this useful
Have a question? Get answers now.
Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.