Support for SSO/AAD-SAML Authentication in the Decipher VBO Product and Version Blue Prism Enterprise Decipher IDP 2.4 Decipher VBO 1.1 Description: Customer is currently migrating from Decipher 1.2 to Decipher IDP 2.4. The Decipher web application is configured to use Single Sign-On based on AAD/SAML. Users can successfully authenticate to the Decipher web interface via SSO. However, authentication fails when configuring a connection through the Decipher VBO in Blue Prism Enterprise. The Decipher server is reachable through the configured hostname or IP address and port. Invalid usernames are correctly rejected, and the valid user account is recognized. However, authentication fails with an “Invalid Password” or similar authentication error when the Windows credentials of the SSO user are used. The same user can successfully log in to the Decipher web interface via SSO.  Current Behavior: A connection to the Decipher server can be established. The configured server and port are reachable. Invalid usernames are rejected with an appropriate error message. The valid user account is recognized. Authentication through the Decipher VBO fails with a password or authentication error. The same user can successfully authenticate to the Decipher web interface via SSO. Expected Behavior: The Decipher VBO should support authentication against Decipher environments configured for AAD-/SAML-based SSO. If SSO authentication is not supported by the Decipher VBO, Blue Prism should provide clear, documented, and security-compliant guidance on the officially supported integration approach. This guidance should specify: which authentication method is supported by the Decipher VBO, which credentials must be provided in the VBO, whether a dedicated non-federated service account is required, whether any additional configuration is necessary, which limitations apply to Decipher IDP 2.4. Business and Security Benefits: Support for SSO/AAD-based authentication in the Decipher VBO is a specific customer requirement but for sure relevant for other Enterprise Customers.. This requirement is primarily driven by security and compliance obligations, as well as the strategic preference to manage access exclusively through centrally controlled Single Sign-On wherever possible. The current dependency on native Decipher credentials or separate non-federated service accounts represents a limitation in SSO-centric environments. This limitation must currently be explained and justified to internal stakeholders from both a security and compliance perspective. Native SSO support in the Decipher VBO, or alternatively a clearly documented and officially supported workaround, would: support compliance with security and regulatory requirements, reduce the number of separately managed credentials, lower administrative overhead, simplify the integration of Blue Prism and Decipher in AAD-/SAML-based environments, improve the suitability of Decipher for organizations with mandatory SSO policies. ... View more

Description The column order in the Sessions view has changed. Previously, the Digital Worker column was positioned closer to the beginning of the grid. It now appears that the Digital Worker and Failure Reason columns have changed positions. This change makes it more difficult for administrators and support teams to quickly identify on which Digital Worker a process is running or has failed. As a result, monitoring and troubleshooting robot processes has become less efficient. Requested Change Be able to change the column order so that the Digital Worker column for instance is displayed before the Failure Reason column. Business Impact Faster identification of the Digital Worker involved in a process. Improved efficiency when monitoring active and failed sessions. Better usability and readability of the Sessions overview. Reduced effort and time required for troubleshooting and operational support. Current Behavior Open the Sessions view. The Digital Worker column is positioned further to the right than before. The Failure Reason column appears before the Digital Worker column. Expected Behavior Open the Sessions view. The Digital Worker column is able to be displayed before the Failure Reason column. Users can immediately identify which Digital Worker is executing or has failed a process without additional scrolling or searching. Acceptance Criteria The Digital Worker column is able to displayed before the Failure Reason column in the Sessions view. The updated column order is visible to all users of the Sessions screen. Existing filtering and sorting functionality continues to work as expected. Monitoring and troubleshooting activities become more efficient due to improved visibility of the Digital Worker information. Priority Medium (Usability / Operational Efficiency) Justification A recent change in the column order has reduced the usability of the Sessions view for operational support and monitoring activities. Changing the column order to place Digital Worker before Failure Reason will improve visibility and help users identify the affected Digital Worker more quickly when reviewing active or failed sessions. ... View more

  During webhook integration testing in BPE 7.5.1, i noticed that platform currently supports only Basic Authentication ( user name, Password ).  This idea is to support other method as well -> Client ID / Client Secret authentication Bearer Token authentication others Webhooks #Webhooks #7.5.1 ... View more

I am reaching out regarding our administrative automation roadmap for Chorus. Currently, our team manually executes routine user-management tasks every week through the AWD/Chorus Admin Workplace UI. These manual tasks include: Creating new user accounts Disabling/deactivating inactive users Deleting offboarded users Updating Last Name of current users Updating the BA/Work Group of a User Adjusting user roles and entitlements via Security Group Maintenance We have successfully built an integration service leveraging the Chorus 25.1 REST API, and our goal is to eliminate these recurring manual touchpoints by driving them programmatically through API calls. We reviewed the 25.1 & 26.1 OpenAPI specification.  Our analysis determine that endpoints likely didn't exist for most of the basic user-management functions listed above.  Attached is an image that outlines our assessment of availalble/missing endpoints for each of the functions we do manually.  ... View more

Currently, workflow execution is limited to a maximum of 10 minutes, excluding any wait time.   This idea is to increase this execution time limit to a higher value.   WorkHQ  ... View more

Currently, we're limited to a fairly flat folder structure in WorkHQ. For organization purposes, I'd like to suggest that we add the ability to have in-depth folder structures, such as User\Accounts\Account1, User\Accounts\Account2, etc. Further, I believe it critical that we have RBAC (Roles Based Access Control) on all Folders and Subfolders for security purposes. ... View more

The Chorus AWDCSRFFilter uses a custom HTTP request header named csrf_token to validate POST requests. The underscore character in the header name causes silent interoperability failures when Chorus is deployed behind proxies and load balancers that enforce HTTP header naming standards.  Chorus should be enhanced to allow the token name to be modified.  ... View more

Within Chorus, it would be helpful if there was a pre-built connector that would give access to all endpoints within Investor Self-Service and Participant Self-Service API sets.  This would streamline the ability to create true straight-through processing for GIDS clients when APIs are available and reduce the friction of needing to create connectors for these APIs.  Same for WorkHQ. ... View more

As an enterprise, we're standardizing on Prisma browser (eliminating Chrome, Edge). Need RPA compatibility with Prisma ... View more

Hi, This feature (filtering process, objects, queues etc)  would be of great help if this has not been included in any of the recent Blue Prism updates then it should be considered for future releases, Best Regards, ... View more

Apex Australia have used Chorus masking/redaction functionality to mask all PII data on all images.  Masking level is set to highest (999) at end of the process and no user has security level of 999.  However, they have stated this does not satisfy local regulations as a) it is still possible (by accident or otherwise) for a user to have a security level of 999 and thereby having access to many years worth of PII data, and b) a document can be downloaded without the masking (noted that ability to download a document can be turned-off/restricted, however if an email is encrypted or password protected, the document needs to be downloaded). The requirement is for all masking/redactions in Chorus to be permanent, burnt-in redaction so that there is no opportunity for a user to view PII data once redacted. ... View more

Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to craft the input in a form that is not expected by the rest of the application. This will lead to parts of the system receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution. We acknowledge that scrips are not being executed however from the below screenshot it appers that the input special characters or tags are not encoded. If possible implement input validation to allow only required characters payload such as <script>alert(123)</script> is stored and subsequently displayed as text suggests that the application may still be accepting arbitrary input that falls outside the expected data format. It is recommended to implement allow-list input validation strategy throughout the application, allowing only the required characters. ... View more

Multiple clients have asked for the following enhancements/features to be added, would be very helpful for us internally as well. thanks! Ability to sort the date and time when you open items in view history Expanded search capabilities including wildcard search functionality Restored ability to search for work items associated with a tracking number Simplified process for attaching documents to a work item Default Date Range Start Time – 60 days ... View more

Hi, I would like to suggest a simple way to disable Parameter logging across all stages on the entire platform. Maybe a settings somewhere that will disable this feature in the logs entirely.  Cheers, Liam ... View more

Hi Everyone,  This suggestion is to add Python as a language in WorkHQ.  I can see that it was in Blue Prism Enterprise so not sure why it's been removed for WorkHQ. This is a very useful language for working with data which is something you do in WorkHQ/Design Studio regularly. A bit of Python code can replace pages and nest of collection manipulation and loop stages in a process.  Hoping this can be added as soon as possible. I'm sure many would benefit from this.  Thank you!  ... View more

Currently, the Submit button on UXB forms does not support configurable actions such as executing a service or invoking a custom function. This prevents developers from implementing additional business validations or pre-submission logic beyond the built-in Validate Data Inputs action, often requiring an extra standard button and additional user clicks. Enhance the Submit button to support configurable actions similar to other button types, and allow the default Submit Form action to execute conditionally based on the outcome of a custom function or service call. This would simplify form design, reduce unnecessary user interactions ... View more

UXB tables currently display number-type fields without thousands separators (e.g., commas). Since these fields often represent amounts or other large numeric values, users find it difficult to read and interpret when the digits are not grouped. Enhance the formatting of number-type fields in UXB tables to display values with thousands separators (e.g., 1,234,567). This will improve readability, reduce the misinterpretation of large numbers, and provide a more user-friendly experience. ... View more

While testing the Webhook feature in BPE version 7.5.1, I noticed that the current view does not include a column for the Item Key. In environments where hundreds of webhook entries are generated, it becomes very challenging to identify and correlate records with the corresponding Work Queue and Item Key. The absence of this information makes searching, troubleshooting, and tracking specific queue items significantly more time-consuming. It would be great if an Item Key column could be added to the Webhook view.    #webhook #7.5.1 ... View more

Customers/tenants able to define their WorkHQ User Inactivity Timeout. Customers' needing to define their own timeout parameters in conjunction with their company rules and practice, should be able to change the platform default of 30 minutes to what their company requires. ... View more