14.0 OM Web Viewer says users are revoked, but they are able to log on tso - TSS7150A SPECIFY PASSWORD FOR STC= ACID=acid

Products

• Output Management Web Viewer

Issue/Introduction

Multiple users getting the below messages when logging on.  The ID in this example is the VIEW admins ID and she has update access to everything View related. SECID=CAVIEW, SECLIST=NONE, SECTRAN=NO, and SECURITY=EXTERNAL - For all 3 View DBs

We also get a lot of users needing STC access from web viewer.  It causes an outstanding reply that is not always answered and also causes logons to fail. See the second section below for examples.

CAHVS0254E Credentials have been revoked                          
CAHVS0109I Repository returned 0 entries in 8 ms, status = ERROR  
CAHVS0260E BPX1TLS Authentication Failed:                         
Return Code: EMVSSAFEXTRERR                                                                                      
Name:        The user's access was revoked.                                                                      
Description: 0                                                                                                   
Reason Code: JROK                                                                                                
Name:        The return code value describes the error.                                                          
Description: Refer to the return code for information on the error.                                              
Action:      {6}      

CAHVS0254E Credentials have been revoked                          
CAHVS0109I Repository returned 0 entries in 9 ms, status = ERROR  
CAHVS0121I Get group name % received from <IP address>            
CAHVS0109I Repository returned 0 entries in 3 ms, status = SUCCESS   
CAHVS0260E BPX1TLS Authentication Failed:                         

TSS7150A SPECIFY PASSWORD FOR STC=         ACID=       
TSS7000I <acid> Last-Used 18 Apr 23 11:22 System=CPU1 Facility=STC
TSS7001I Count=00674 Mode=Impl Locktime=None Name=<name>    
R 774,SUPPRESSED                                                   
TSS7102E Password Missing                                          
TSS7160E Facility <STC> Not Authorized for Your Use                
R 680,SUPPRESSED                                                   
TSS7102E Password Missing                                          
TSS7160E Facility <STC> Not Authorized for Your Use                
TSS7110E Password Has Expired. New Password Missing                
TSS7150A SPECIFY PASSWORD FOR STC=         ACID=       
TSS7000I <acid> Last-Used 19 Apr 23 09:32 System=CPU1 Facility=STC
TSS7001I Count=00675 Mode=Impl Locktime=None Name=<name>   
R 775,SUPPRESSED                                                   
TSS7102E Password Missing                                          
TSS7003W Password Will Expire on 04/24/23                          
TSS7160E Facility <STC> Not Authorized for Your Use                
        

Environment

Output Management Web Viewer™ for z/OS

Resolution

TSS advised: Without a MASTFAC, Top Secret will look for the first facility whose PGM= matches or is a prefix of the program that starts the started task. If you specify PGM=********, this won't match any program. (The value specified for PGM= is a literal. It does not allow for masking characters.) 
If there is no MASTFAC on the started task acid and no facility whose PGM= matches or is a prefix of the program that starts the started task, the facility associated with the started task defaults to STC, which is what is causing the TSS7150A SPECIFY PASSWORD FOR STC= ACID=acid prompts. 

This matches what the customer reported in the log provided. To correct, you need to create a Top Secret Facility with the proper settings for Web Viewer r14 and set the MASTFAC for the ACID of the web application server that runs Web Viewer (the ACID of the STC running Tomcat). This is documented in the Web Viewer documentation Top Secret Security Requirements – Top Secret Facility.