Support Article
Can access Pega without username and password
SA-7755
Summary
User can access Pega portal without username and password.
Right now the authentication activity in auth service is not doing any validation. User is able to pass the username and other parameters in the URL and able to connect to Pega portal without passing any password.
Resolution
Submit the userid/username in the http request body if they hit the PRPC URL (“http://<host:port>/prweb/SSOServlet?<unauthenticated access group hash>/!STANDARD”) directly instead of just “http://<host:port>/prweb/SSOServlet”.
By doing so, the content in the body will be passed to the authentication activity.
Published January 31, 2016 - Updated October 8, 2020
Have a question? Get answers now.
Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.