Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Manjunatha HV (Manjunatha HV) Instellars Founder and Principal Pega Consultant
Instellars
IN
Manjunatha HV Member since 2017 4 posts
Instellars
Posted: Jan 5, 2018
Last activity: Jan 10, 2018
Posted: 5 Jan 2018 0:15 EST
Last activity: 10 Jan 2018 21:59 EST
Closed

Pega Mashup Security

Dear Team,

We have the following security requirements related to pega mashup. Kindly advise.

1. Separate different URL for Pega mashup - Our pega app server's are in Intranet zone and pega mashup gadget will be embedded in the website which is internet. How do we expose this separate URL using proxy servers ?

2. Session Management and Session time out configs - How do we manage web session (website) and Pega session created using mashup gadget ?

3. Authentication : How do we authenticate the external user from Pega. This user is not a LDAP user or not an operator ID exist in Pega.

4. Pass the Params from Mashup : We need to pass parameters like Member ID etc to create the case in Pega or pull the worklist based on this Member ID. How do we encrypt this Member ID and send to Pega and decrypt at pega side to create a case/pull a case. (Need to be encrypted, as Member ID should not be visible in the HTML source)

5. External user would be attaching a files or creating a case by filling the sensitive data. How do we encrypt and send this information or in other words how do we encrypt for both Inward and outward data ?

Thanks,

Manju

To see attachments, please log in.
Low-Code App Development Security

Posted: 6 years ago
Posted: 8 Jan 2018 23:32 EST
Anuj Kumar Srivastava (Anuj Srivastava) PEGA Senior Solutions Consultant
Pegasystems Inc.
IN

Hi Manjunath, 

Read the following tutorial about Mashup and IAC. Hope this will answer your most of the question. 

https://pdn.pega.com/creating-responsive-mashups-using-pega-web-mashup 

Please reach us if you need more information. 

To see attachments, please log in.
Posted: 6 years ago
Posted: 10 Jan 2018 21:59 EST
Manjunatha HV (Manjunatha HV) Instellars Founder and Principal Pega Consultant
Instellars
IN

Hi Sriva,

Thanks. I did go through the PDN articles. I have questions more about related to Authentitcation and Session Management ?

2. Session Management and Session time out configs - How do we manage web session (website) and Pega session created using mashup gadget ?

How do we issue the Mashup logout API to clear the session if the user is getting logged out from website ?

3. Authentication : How do we authenticate the external user from Pega. This user is not a LDAP user or not an operator ID exist in Pega.

How do we validate the Securitytoken shared by website in pega as part of IACAuthenitcation Service ?, These users are not Operators in Pega OR does not exist in LDAP or Website would not be exposing the service to pega for validating the Security token. 

 

Thanks,

Manju

 

Show More

Hi Sriva,

Thanks. I did go through the PDN articles. I have questions more about related to Authentitcation and Session Management ?

2. Session Management and Session time out configs - How do we manage web session (website) and Pega session created using mashup gadget ?

How do we issue the Mashup logout API to clear the session if the user is getting logged out from website ?

3. Authentication : How do we authenticate the external user from Pega. This user is not a LDAP user or not an operator ID exist in Pega.

How do we validate the Securitytoken shared by website in pega as part of IACAuthenitcation Service ?, These users are not Operators in Pega OR does not exist in LDAP or Website would not be exposing the service to pega for validating the Security token. 

 

Thanks,

Manju

 


Show Less
To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice