Overview
This guide outlines the steps to create a report that helps you determine the number of user accounts configured to use Basic Credentials Authentication, and their corresponding last login dates.
Background
Basic Credentials Authentication relies on potentially reused passwords, making it easier to compromise accounts, and it increases the difficulty of monitoring and detecting unauthorized access. To reduce these risks and enhance control and compliance requirements, transition user accounts that are configured to use Basic Credentials Authentication to Single Sign-on (SSO).
Beginning with release of Pega Infinity ‘24.2, Pega has deprecated Basic Credentials Authentication. This should only be used for non-personal operator records, such as [email protected], in emergency situations.
Action to take
Pega Platform has two 2 options to help you follow industry best practices. You can configure an external Identity Provider (IDP) using either option:
- SAML 2.0 Configuring SSO login authentication with a SAML identity provider
- OIDC 2.0 Configuring SSO login authentication with an OpenID Connect identity provider .
Utilizing an external IDP improves your security and will help meet compliance requirements for your Pega applications.
How to create a report?
1. Create a report on the 'Data-Admin-Operator-ID' class within your ruleset.
2. Select the following columns for your query:
- .pyUserIdentifier: Operator ID
- .pyLastSignon: Operator last sign-on time
- .pyUserName: Full Name
- .pyAccessGroup: Default Access Group
3. Sort the results by 'pyLastSignon':
4. Add the following filter conditions:
- .pyImportedUser: False
- .pyOperatorIsDeactivated: False. Additionally, enable the 'Use null if empty' condition for this filter.
5. Apply an 'AND' condition for both filters.
6. Save and run the report.
