Question
Virtusa Corportaion
US
Last activity: 14 Sep 2016 11:43 EDT
Authentication: External assignment fails after upgrade to 7.2.1
After upgrading to 7.2.1, existing and new external assignment links do not properly authenticate. pzSignature seems to be ignored. Clicking the link just renders the login screen. No errors visible to the users. In the background, the tracer yields a PRRuntime error with minimal details:
<EventKey>RULE-DECLARE-PAGES DECLARE_AUTHPOLICIES #20130919T004035.555 GMT</EventKey><StepMethod>Data page instance found</StepMethod><mStepStatus>FAIL</mStepStatus><mStepStatusInfo>** PRRuntimeException</mStepStatusInfo><PrimaryPageName>Declare_AuthPolicies</PrimaryPageName><PrimaryPageClass>Data-Admin-System-AuthPolicies</PrimaryPageClass>
Complete tracer export attached.
***Updated by Moderator: Vidyaranjan. Removed user added Ask the Expert tag. Apologies for confusion, shouldn't have been an end-user option***
Accepted Solution
Virtusa Corportaion
US
We eventually learned that our use of added parameters in the DWA link (e.g., "?pyActivity=...") was never intended and changes in 7.2.1 brought this exploit of the DWA URL to light. We changed our configuration to use a REST interface instead (based on the /assignment PegaAPI call, but with HTML returned to the user to confirm the action).
Pegasystems Inc.
IN
Hi JRwells,
I would like to confirm about the "External assignment " that you have mentioned. Are you talking about DWA (Directed web access) which is used to route an assignment to the external non PRPC users to perform action as part of the case?
Let me know if my understanding is right.
Regards,
Ravi
Pegasystems Inc.
IN
Hi JRwells,
Could you please check if public link URL has been updated in the URL landing page to point out to your current application, after upgrade. If not, please update that , logoff and login back to the application and see if it works for you.
Regards,
Ravi
Accepted Solution
Virtusa Corportaion
US
We eventually learned that our use of added parameters in the DWA link (e.g., "?pyActivity=...") was never intended and changes in 7.2.1 brought this exploit of the DWA URL to light. We changed our configuration to use a REST interface instead (based on the /assignment PegaAPI call, but with HTML returned to the user to confirm the action).