HTTP Error 403 - Forbidden: Access is denied - IIS6 & Tomcat 6.0 Connector

Discussion:

Anthony Tuffour

2010-11-08 13:46:15 UTC

Hi all,

I managed to setup IIS ISAPI redirect successfully to feed a Geoserver
wms to IIS web application.
I used the configuration guide below to do the set up;
http://tomcat.apache.org/connectors-doc-archive/jk2/jk/iishowto.html
http://tomcat.apache.org/connectors-doc/reference/iis.html
http://tomcat.apache.org/tomcat-3.3-doc/tomcat-iis-howto.html

My system setup is Windows 2003 Server, IIS 6.0, Tomcat 6.0 and the
Connector version is 1.2.31.
Everything was working successfully and tested it for almost 2days. But
all of a sudden the application went down with the following error
message:

Service Temporary Unavailable!
The server is temporarily unable to service your request due to
maintenance downtime or capacity problems. Please try again later.
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297)

I changed the application pool to a different one and I am getting the
error message "You are not authorized to view this page. HTTP Error 403
- Forbidden: Access is denied. "

The error below is from ISAPI_Redirect.log;

[Mon Nov 08 12:04:17.363 2010] [4604:3188] [info]
init_jk::jk_isapi_plugin.c (2562): Starting
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297)[Mon Nov 08 12:04:17.379
2010] [4604:3188] [warn] jk_map_handle_duplicates::jk_map.c (446):
Duplicate key '/geoserver/*' detected - previous value 'worker1' will be
overwritten with 'worker1;fail_on_status=-404,-500,503'.[Mon Nov 08
12:04:17.379 2010] [4604:3188] [warn] jk_map_handle_duplicates::jk_map.c
(446): Duplicate key '/geoserver/*' detected - previous value
'worker1;fail_on_status=-404,-500,503' will be overwritten with
'worker1;use_server_errors=400'.[Mon Nov 08 12:04:17.410 2010]
[4604:3188] [warn] jk_map_handle_duplicates::jk_map.c (446): Duplicate
key '/geoserver/*' detected - previous value
'worker1;use_server_errors=400' will be overwritten with
'worker1;use_server_errors=500'.[Mon Nov 08 12:04:17.441 2010]
[4604:3188] [error] ajp_validate::jk_ajp_common.c (2622): worker worker1
can't resolve tomcat address www.map.hackney.gov.uk:8080[Mon Nov 08
12:04:19.722 2010] [4604:3188] [error] ajp_validate::jk_ajp_common.c
(2622): worker worker2 can't resolve tomcat address otherhost[Mon Nov 08
12:04:19.738 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'myworker' in uri map post processing. [Mon Nov 08
12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'defworker' in uri map post processing.
[Mon Nov 08 12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'defworker' in uri map post processing.[Mon Nov 08
12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'wlb' in uri map post processing.[Mon Nov 08 12:04:19.754
2010] [4604:3188] [error] uri_worker_map_ext::jk_uri_worker_map.c (506):
Could not find worker with name 'wlb' in uri map post processing.[Mon
Nov 08 12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'wlb' in uri map post processing.[Mon Nov 08 12:04:19.754
2010] [4604:3188] [error] uri_worker_map_ext::jk_uri_worker_map.c (506):
Could not find worker with name 'jkstatus' in uri map post
processing.[Mon Nov 08 12:04:19.754 2010] [4604:3188] [info]
init_jk::jk_isapi_plugin.c (2741): Jakarta/ISAPI/isapi_redirector/1.2.31
(1026297) initialized[Mon Nov 08 12:04:23.629 2010] [4604:2720] [info]
TerminateFilter::jk_isapi_plugin.c (2271):
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297) stopping
I have tried changing the permissions but not luck. Under IIS ISAPI
filters, the ISAPI redirector is loaded and the green arrow is pointing
upwards and priority is high.
Accessing the same URL from port 8080 displays the page without any
problems.

Is there anything that needs to get back to normal and searched and
tried everything in the book without success.

Any help will be welcomed.

Thank you.

Anthony.

Hackney Council may exercise its right to intercept any communication, the only exception to this would be confidential survey data, with any employee or agent of the Council using its telephony or data networks. By using these networks you give your consent to Hackney Council monitoring and recording your communication.

If you have received this e-mail in error please delete it immediately and contact the sender.

For further information about Hackney Council policies please contact Hackney Service Centre on: 020 8356 3000

**********************************************************************

London Borough of Hackney may exercise its right to intercept any communication on its networks - for more information see

http://www.hackney.gov.uk/email_disclaimer.html

**********************************************************************

This message has been scanned for malware by Websense. www.websense.com

Nick Beare

2010-11-08 14:17:43 UTC

Permalink

Hi Anthony,

Is IIS service running on your server? If so, can you see the the
default/home/index.html page on your IIS site. I have set up an index.html
on mine so I can navigate there to check IIS operating correctly before
setting up/checking out the redirect link.
Have you checked your Event logs for any errors? I found them illuminating
when I had a bad dll.
Have you looked in your W3SVC logs (typically in
C:\WINDOWS\system32\LogFiles)?

Now perhaps you can help me? I have never been able to get any output logged
to the ISAPI redirect log. I have been using 1.2.30.0 dll.
I posted a question earlier today, but have had no response.
You are using an almost identical setup to ourselves and you have manage to
get output in your redirect log.
I have set logging level to debug (log_level key = registry set to 'debug')
I have set the log_file key to 'C:\Program Files\Apache Software
Foundation\Jakarta Isapi Redirector\log\isapi_redirect.log'
Permissions on the directory are set to all except special, for the
administrator, and 'read and execute', 'list folder contents', 'Read' and
'Write' for the Internet Guest Account.
I have not created an empty log file (i.e. have left it to the dll to create
the log in the first instance.

Regards
Nick

On Mon, Nov 8, 2010 at 1:46 PM, Anthony Tuffour <

Post by Anthony Tuffour
Hi all,
I managed to setup IIS ISAPI redirect successfully to feed a Geoserver
wms to IIS web application.
I used the configuration guide below to do the set up;
http://tomcat.apache.org/connectors-doc-archive/jk2/jk/iishowto.html
http://tomcat.apache.org/connectors-doc/reference/iis.html
http://tomcat.apache.org/tomcat-3.3-doc/tomcat-iis-howto.html
My system setup is Windows 2003 Server, IIS 6.0, Tomcat 6.0 and the
Connector version is 1.2.31.
Everything was working successfully and tested it for almost 2days. But
all of a sudden the application went down with the following error
Service Temporary Unavailable!
The server is temporarily unable to service your request due to
maintenance downtime or capacity problems. Please try again later.
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297)
I changed the application pool to a different one and I am getting the
error message "You are not authorized to view this page. HTTP Error 403
- Forbidden: Access is denied. "
The error below is from ISAPI_Redirect.log;
[Mon Nov 08 12:04:17.363 2010] [4604:3188] [info]
init_jk::jk_isapi_plugin.c (2562): Starting
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297)[Mon Nov 08 12:04:17.379
Duplicate key '/geoserver/*' detected - previous value 'worker1' will be
overwritten with 'worker1;fail_on_status=-404,-500,503'.[Mon Nov 08
12:04:17.379 2010] [4604:3188] [warn] jk_map_handle_duplicates::jk_map.c
(446): Duplicate key '/geoserver/*' detected - previous value
'worker1;fail_on_status=-404,-500,503' will be overwritten with
'worker1;use_server_errors=400'.[Mon Nov 08 12:04:17.410 2010]
[4604:3188] [warn] jk_map_handle_duplicates::jk_map.c (446): Duplicate
key '/geoserver/*' detected - previous value
'worker1;use_server_errors=400' will be overwritten with
'worker1;use_server_errors=500'.[Mon Nov 08 12:04:17.441 2010]
[4604:3188] [error] ajp_validate::jk_ajp_common.c (2622): worker worker1
can't resolve tomcat address www.map.hackney.gov.uk:8080[Mon Nov 08
12:04:19.722 2010] [4604:3188] [error] ajp_validate::jk_ajp_common.c
(2622): worker worker2 can't resolve tomcat address otherhost[Mon Nov 08
12:04:19.738 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'myworker' in uri map post processing. [Mon Nov 08
12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'defworker' in uri map post processing.
[Mon Nov 08 12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'defworker' in uri map post processing.[Mon Nov 08
12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'wlb' in uri map post processing.[Mon Nov 08 12:04:19.754
Could not find worker with name 'wlb' in uri map post processing.[Mon
Nov 08 12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'wlb' in uri map post processing.[Mon Nov 08 12:04:19.754
Could not find worker with name 'jkstatus' in uri map post
processing.[Mon Nov 08 12:04:19.754 2010] [4604:3188] [info]
init_jk::jk_isapi_plugin.c (2741): Jakarta/ISAPI/isapi_redirector/1.2.31
(1026297) initialized[Mon Nov 08 12:04:23.629 2010] [4604:2720] [info]
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297) stopping
I have tried changing the permissions but not luck. Under IIS ISAPI
filters, the ISAPI redirector is loaded and the green arrow is pointing
upwards and priority is high.
Accessing the same URL from port 8080 displays the page without any
problems.
Is there anything that needs to get back to normal and searched and
tried everything in the book without success.
Any help will be welcomed.
Thank you.
Anthony.
Hackney Council may exercise its right to intercept any communication, the
only exception to this would be confidential survey data, with any employee
or agent of the Council using its telephony or data networks. By using these
networks you give your consent to Hackney Council monitoring and recording
your communication.
If you have received this e-mail in error please delete it immediately and
contact the sender.
For further information about Hackney Council policies please contact
Hackney Service Centre on: 020 8356 3000
**********************************************************************
London Borough of Hackney may exercise its right to intercept any
communication on its networks - for more information see
http://www.hackney.gov.uk/email_disclaimer.html
**********************************************************************
This message has been scanned for malware by Websense. www.websense.com

Anthony Tuffour

2010-11-08 14:35:20 UTC

Permalink

Nick,

Thanks for the quick response. IIS service is running on the server and
is on the same server as the Apache Tomcat 6.0. There are other websites
running in IIS on the same server and they are working correctly without
any errors.

Initially nothing was logged into ISAPI redirect log. It was set to Info
in the registry and I changed it to debug and I saw that it has been
updated. Initially, I was worried it was not logging anything? Since the
first log, nothing has been updated.

You have to create the log file to the same as found in the registry
value of the log file otherwise it will not work.

Have you got your ISAPI Redirector working and for how long? How stable
is it? I need to get it working again badly. My application was suppose
to go live this evening and for some unknown reason is crashed on me.

Thanks.

Anthony

-----Original Message-----
From: Nick Beare [mailto:***@gmail.com]
Sent: 08 November 2010 14:18
To: Tomcat Users List
Subject: Re: HTTP Error 403 - Forbidden: Access is denied - IIS6 &
Tomcat 6.0 Connector

Hi Anthony,

Is IIS service running on your server? If so, can you see the the
default/home/index.html page on your IIS site. I have set up an
index.html
on mine so I can navigate there to check IIS operating correctly before
setting up/checking out the redirect link.
Have you checked your Event logs for any errors? I found them
illuminating
when I had a bad dll.
Have you looked in your W3SVC logs (typically in
C:\WINDOWS\system32\LogFiles)?

Now perhaps you can help me? I have never been able to get any output
logged
to the ISAPI redirect log. I have been using 1.2.30.0 dll.
I posted a question earlier today, but have had no response.
You are using an almost identical setup to ourselves and you have manage
to
get output in your redirect log.
I have set logging level to debug (log_level key = registry set to
'debug')
I have set the log_file key to 'C:\Program Files\Apache Software
Foundation\Jakarta Isapi Redirector\log\isapi_redirect.log'
Permissions on the directory are set to all except special, for the
administrator, and 'read and execute', 'list folder contents', 'Read'
and
'Write' for the Internet Guest Account.
I have not created an empty log file (i.e. have left it to the dll to
create
the log in the first instance.

Regards
Nick

On Mon, Nov 8, 2010 at 1:46 PM, Anthony Tuffour <

12:04:17.379

Post by Anthony Tuffour
Duplicate key '/geoserver/*' detected - previous value 'worker1' will be
overwritten with 'worker1;fail_on_status=-404,-500,503'.[Mon Nov 08
12:04:17.379 2010] [4604:3188] [warn]

jk_map_handle_duplicates::jk_map.c

Post by Anthony Tuffour
(446): Duplicate key '/geoserver/*' detected - previous value
'worker1;fail_on_status=-404,-500,503' will be overwritten with
'worker1;use_server_errors=400'.[Mon Nov 08 12:04:17.410 2010]
[4604:3188] [warn] jk_map_handle_duplicates::jk_map.c (446): Duplicate
key '/geoserver/*' detected - previous value
'worker1;use_server_errors=400' will be overwritten with
'worker1;use_server_errors=500'.[Mon Nov 08 12:04:17.441 2010]
[4604:3188] [error] ajp_validate::jk_ajp_common.c (2622): worker worker1
can't resolve tomcat address www.map.hackney.gov.uk:8080[Mon Nov 08
12:04:19.722 2010] [4604:3188] [error] ajp_validate::jk_ajp_common.c
(2622): worker worker2 can't resolve tomcat address otherhost[Mon Nov 08
12:04:19.738 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'myworker' in uri map post processing. [Mon Nov 08
12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'defworker' in uri map post processing.
[Mon Nov 08 12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'defworker' in uri map post processing.[Mon Nov 08
12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'wlb' in uri map post processing.[Mon Nov 08 12:04:19.754
Could not find worker with name 'wlb' in uri map post processing.[Mon
Nov 08 12:04:19.754 2010] [4604:3188] [error]
uri_worker_map_ext::jk_uri_worker_map.c (506): Could not find worker
with name 'wlb' in uri map post processing.[Mon Nov 08 12:04:19.754
Could not find worker with name 'jkstatus' in uri map post
processing.[Mon Nov 08 12:04:19.754 2010] [4604:3188] [info]

Jakarta/ISAPI/isapi_redirector/1.2.31

Post by Anthony Tuffour
(1026297) initialized[Mon Nov 08 12:04:23.629 2010] [4604:2720] [info]
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297) stopping
I have tried changing the permissions but not luck. Under IIS ISAPI
filters, the ISAPI redirector is loaded and the green arrow is

pointing

Post by Anthony Tuffour
upwards and priority is high.
Accessing the same URL from port 8080 displays the page without any
problems.
Is there anything that needs to get back to normal and searched and
tried everything in the book without success.
Any help will be welcomed.
Thank you.
Anthony.
Hackney Council may exercise its right to intercept any communication, the
only exception to this would be confidential survey data, with any employee
or agent of the Council using its telephony or data networks. By using these
networks you give your consent to Hackney Council monitoring and recording
your communication.
If you have received this e-mail in error please delete it immediately and
contact the sender.
For further information about Hackney Council policies please contact
Hackney Service Centre on: 020 8356 3000
**********************************************************************
London Borough of Hackney may exercise its right to intercept any
communication on its networks - for more information see
http://www.hackney.gov.uk/email_disclaimer.html
**********************************************************************
This message has been scanned for malware by Websense.

www.websense.com
Hackney Council may exercise its right to intercept any communication,
the only exception to this would be confidential survey data, with any
employee or agent of the Council using its telephony or data networks.
By using these networks you give your consent to Hackney Council
monitoring and recording your communication.

If you have received this e-mail in error please delete it immediately
and contact the sender.

For further information about Hackney Council policies please contact
Hackney Service Centre on: 020 8356 3000

Click
https://www.mailcontrol.com/sr/bkBxrrLK+KDTndxI!oX7UoH9GbmNk6!Rg93qEsa+G
Q+XEh+Oah0M8XQ12V4Asf2FnU+VexpeXXg5ky06sDJQ0Q== to report this email as
spam.

Nick Beare

2010-11-08 14:45:24 UTC

Permalink

I have managed to get several installations working (although none are
actually live - all are proof of concept installs).

Perhaps you could paste your mapping file and worker properties file into an
email to the user list so I can take a look.

Looking more closely at your log file, it hints that it is attempting to
redirect through port 8080, which seems surprising (or the examples use 8009
for AJP - which is what I use). This should just be the Tomcat (or in our
case JBoss port).
Have you used the default website on your IIS server for redirection, or
have you used a new one?
What URL are you typing into your browser address window?

Regards
Nick

Post by Nick Beare
Hi Anthony,
Is IIS service running on your server? If so, can you see the the
default/home/index.html page on your IIS site. I have set up an index.html
on mine so I can navigate there to check IIS operating correctly before
setting up/checking out the redirect link.
Have you checked your Event logs for any errors? I found them illuminating
when I had a bad dll.
Have you looked in your W3SVC logs (typically in
C:\WINDOWS\system32\LogFiles)?
Now perhaps you can help me? I have never been able to get any output
logged to the ISAPI redirect log. I have been using 1.2.30.0 dll.
I posted a question earlier today, but have had no response.
You are using an almost identical setup to ourselves and you have manage to
get output in your redirect log.
I have set logging level to debug (log_level key = registry set to 'debug')
I have set the log_file key to 'C:\Program Files\Apache Software
Foundation\Jakarta Isapi Redirector\log\isapi_redirect.log'
Permissions on the directory are set to all except special, for the
administrator, and 'read and execute', 'list folder contents', 'Read' and
'Write' for the Internet Guest Account.
I have not created an empty log file (i.e. have left it to the dll to
create the log in the first instance.
Regards
Nick
On Mon, Nov 8, 2010 at 1:46 PM, Anthony Tuffour <

Nick Beare

2010-11-08 14:52:51 UTC

Permalink

Anthony

One further thought for your problem.

By default the redirector uses port 8009 for redirecting using AJP protocol.
Has something else on your server started using that port? Or have you
inadvertently removed/disabled the setting in your server.xml file

On Mon, Nov 8, 2010 at 1:46 PM, Anthony Tuffour <

Rainer Jung

2010-11-08 21:43:34 UTC

Permalink

Lots of errors above, like e.g.

worker worker2 can't resolve tomcat address otherhost

which means you configured "otherhost" as worker address and this canot
be resolved to an IP address.

Maybe time to present your complete configuration?

Regards,

Rainer

odeneho

2010-11-10 17:36:09 UTC

Permalink

My website has crashed again and coming up with the following error when the
website and jakarta virtual directories are set up to use the same
application pool:
Service Temporary Unavailable!
The server is temporarily unable to service your request due to maintenance
downtime or capacity problems. Please try again later.
Jakarta/ISAPI/isapi_redirector/1.2.31 (1026297)

isapi_redirect.log is no longer logging anymore and when I try to change the
application pool for jakarta virtual directory in IIS, I get the following
error message;
Re: HTTP Error 403 - Forbidden: Access is denied - IIS6 & Tomcat 6.0
Connector.

My workers.properties and uriworkersmap.properties are configured as follows
respectively:
#uriworkmap.properties - IIS
# An entry that lists all the workers defined
workers.tomcat_home=C:\Program Files\Apache Software Foundation\Tomcat 6.0
#workers.java_home=C:\Program Files\Java\jdk1.6.0_22
#workers.java_home=C:\Program Files\Java\jre6
workers.java_home=C:\Program Files\Java\jrockit-R28.0.1-jre1.6.0_20
worker.list=worker1
# Entries that define the host and port associated with these workers
worker.worker1.host=www.map.hackney.gov.uk:8080
#worker.worker1.host=localhost:8080
worker.worker1.port=8009
worker.worker1.type=ajp13
worker.worker1.lbfactor=1
worker.worker1.connection_pool_timeout=600
worker.worker1.socket_keepalive=1
worker.worker1.socket_timeout=120

#uriworkmap.properties - IIS
#
#This file provides sample mappings for example wlb
#worker defined in workmap.properties.minimal
#The general syntax fro this file is:
#[URL]=[worker name]

/geoserver/*=worker1
/geoserver/*=worker1;fail_on_status=-404,-500,503
# Use web server error page for all errors
/geoserver/*=worker1;use_server_errors=400
# Use web server error page only for technical errors
/geoserver/*=worker1;use_server_errors=500

/www.map.hackney.gov.uk/geoserver/*=worker1

/jkmanager=jkstatus

System Environment:
Windows 2003 Server
Tomcat 6.0
IIS 6.0
isapi_redirector 1.2.31

Can somebody please, tell me why my application works for a while and
crashes using the above settings?
Any help will be appreciated.
Thanks.
Anthony.

--
View this message in context: http://old.nabble.com/HTTP-Error-403---Forbidden%3A-Access-is-denied---IIS6---Tomcat-6.0-Connector-tp30160779p30182687.html
Sent from the Tomcat - User mailing list archive at Nabble.com.