403 error when registering application in Pega Process Fabric Hub

General
,
1

Hello Everyone,

When I try to register my application in Pega Process Fabric Hub, I’m encountering a response code of 403

Failed to connect - the HTTP response code of 403 indicated a client error.
The response may contain a reason. // The body of the service’s response,
which is set up for mapping in the Connector rule, was empty for this service call.

Environment:

  • Pega Platform Infinity '25.1.3
  • Pega Process Fabric Hub Connector component: ProcessFabricHubConnector_3-1-3_25-1-0

I’ve already verified against the troubleshooting document:

  • Connector component version is compatible with my Platform version per the official document
  • Component is present in Application Definition
  • OAuth 2.0 Client Registration is configured as documented:
    • Type of client = Confidential
    • Supported grant type = JWT bearer only
    • Identity mapping = PPFConnect

Has anyone encountered this issue before or have any suggestions on what else I should verify?

2

We have seen this initially.

A 403 in this scenario generally indicates an authorization/configuration issue, not an invalid OAuth client secret. Verify the configuration on both the Process Fabric Hub and the application being registered.

verify below configurations-

  • AllowedRegistrationAccessGroups DSS → check if the access group assigned to the PPFConnect service requestor is included in the AllowedRegistrationAccessGroups DSS on the application being registered. Check the exact access group name, including the application prefix and version. An access group mismatch can result in a 403 even though OAuth authentication succeeds.
  • PPFConnect service package → ppfconnect service package sjpuld have OAuth enabled, service access group that belongs to the application being registered. Also make sure the AG has the required permissions to invoke the PPF Connect REST services.
    The service package access group is important because Pega uses it to establish the security context for the incoming call. It should not simply be any operator access group.
  • Component availability in the application hierarchy → Process Fabric Hub Connector component is present not only in the top-level application definition, but also in all relevant built-on application layers.
  • PPFConnect identity mapping and token profile → OAuth client registration uses the expected identity mapping, PPFConnect, and that the identity mapping resolves to an operator with the intended access group. Also verify the related PPFConnect token profile, keystore, truststore, and PPFToRemoteTokenGeneration configuration.
  • PegaProcessFabricSvcURL points to the correct Process Fabric Hub URL