Implementing Websphere WAS 6.1 under Top Secret, getting error message SECJ6221E

Products

• Cleanup
• Datacom
• DATACOM - AD
• CIS
• COMMON SERVICES FOR Z/OS
• 90S SERVICES
• DATABASE MANAGEMENT SOLUTIONS FOR DB2 FOR Z/OS
• COMMON PRODUCT SERVICES COMPONENT
• Common Services
• CA ECOMETER SERVER COMPONENT FOC
• Easytrieve Report Generator for Common Services
• INFOCAI MAINTENANCE
• IPC
• UNICENTER JCLCHECK COMMON COMPONENT
• Mainframe VM Product Manager
• CHORUS SOFTWARE MANAGER
• CA ON DEMAND PORTAL
• CA Service Desk Manager - Unified Self Service
• PAM CLIENT FOR LINUX ON MAINFRAME
• MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME
• GRAPHICAL MANAGEMENT INTERFACE
• WEB ADMINISTRATOR FOR TOP SECRET
• Xpertware
• Top Secret
• Top Secret - LDAP
• Top Secret - VSE

Issue/Introduction

Question:

I have implemented the WAS support as indicated in the BBOWBTSS REXX made available by the Technical Document TEC440786 . When trying to get an application initiation, I receive the following error in the WAS server log:

BBOO0220E: SECJ6221E: A native credential for user "username"
cannot be recreated. The native service results related to
this failure are: WebSphere service=BBOSSNAP,
WebSphere returnCode=42, SAF service=, SAF returnCode=0,
SAF product returnCode=0, SAF product reasonCode=0.

The application does not start.

There are no violation messages registered with Top Secret. Also the TSSOERPT report does not show any specific errors connected to this.

What is wrong?

Answer:

In the above mentioned case, it was determined that the resource IBMFAC(BBO.) had erroenously not yet been owned and permitted. This command sequence had to be yet done:

TSS ADD(owneracid)  IBMFAC(BBO.)

TSS PER(WSCFGPRF) IBMFAC(BBO.TRUSTEDAPPS.T1WASC.BBOC001) ACCESS(READ) 

After these commands were done, and Websphere was refreshed, the error messages did not re-occur, and the application worked.

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component: