403 Forbidden Error

Discussions related to HTTPAPI (An HTTP Client Package for RPG programming.) http://www.scottklement.com/httpapi/
Post Reply
dave.c.hanneman
Posts: 2
Joined: Mon Nov 15, 2021 5:42 pm

403 Forbidden Error

Post by dave.c.hanneman »

Here is my error log from a POST operation.

Code: Select all

HTTPAPI Ver 1.42 released 2020-10-12
NTLM Ver 1.4.0 released 2014-12-22
OS/400 Ver V7R3M0

New iconv() objects set, PostRem=819. PostLoc=0. ProtRem=819. ProtLoc=0
https_init(): entered
QSSLPCL = *TLSV1.2
SSL version 2 support disabled
SSL version 3 support disabled
Old interface to TLS version 1.0 support disabled
TLS version 1.0 support disabled
TLS version 1.1 support disabled
TLS version 1.2 support enabled
initializing GSK environment
GSK Environment now available
-------------------------------------------------------------------------------------
Dump of local-side certificate information:
-------------------------------------------------------------------------------------
http_persist_open(): entered
http_long_ParseURL(): entered
DNS resolver retrans: 2
DNS resolver retry  : 2
DNS resolver options: x'00000136'
DNS default domain: RRD.COM
DNS server found: 10.79.131.126
DNS server found: 172.24.8.126
DNS server found: 172.24.14.21
Nagle's algorithm (TCP_NODELAY) disabled.
SNI hostname set to: 10.79.190.14
-------------------------------------------------------------------------------------
Dump of server-side certificate information:
-------------------------------------------------------------------------------------
Cert Validation Code = 0
-----BEGIN CERTIFICATE-----
MIIDozCCAougAwIBAgIHYY6omwNpsDANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQG
EwJVUzEMMAoGA1UECBMDQW55MSUwIwYDVQQKExxJQk0gV2ViIEFkbWluaXN0cmF0
aW9uIGZvciBpMS8wLQYDVQQDFCZjb3JwZGV2Mi5ycmQuY29tX0NFUlRJRklDQVRF
X0FVVEhPUklUWTAeFw0yMTExMTExNzQ3MDdaFw0yMjExMTIxNzQ3MDdaMF0xCzAJ
BgNVBAYTAlVTMQwwCgYDVQQIEwNBbnkxJTAjBgNVBAoTHElCTSBXZWIgQWRtaW5p
c3RyYXRpb24gZm9yIGkxGTAXBgNVBAMTEGNvcnBkZXYyLnJyZC5jb20wggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCob1t6KbVHRxpf/GC1lDk17j1b4mmF
fJSFBgabd1yDJFkoGsa84MSJyG2W8cMywrimsmXpu1vrBWOFYJDkyUOwX9mLuGPv
AcmpQZ+qBZZ8QPt8iOYHKpdT6HkJB2Xf9mtUeZgtTYEBYjmmYtZoNV83p6Sf0o4x
MsMOqUWnTTTkH8HecHNSmRvoaYF6tsyaQjRtIIbURVnNlgf8n7R/GeylypK2MrsY
1LOa/uVzo0CdFoYkVJ8mcu6UlMepuTo6O04wZU8BeBX+2OHycwF31lC9NaHvVUjI
0YurTi5TJKDKhreS0rFUAm85ca+0ejfuTyoXm6paIGUe4udEwDp+8FsNAgMBAAGj
UjBQMB0GA1UdDgQWBBThGMsMq1L022T4hjIr7TDd/QRSFTAfBgNVHSMEGDAWgBQr
9LI7vOWTkJEvY7JaphZHGPeUAzAOBgNVHQ8BAf8EBAMCA+gwDQYJKoZIhvcNAQEL
BQADggEBAMl2OvpJ6X0e+X3Z7awHe2xpALkDwCjqVWd6kqAVgv5XxENNRPxkSdSO
04p42Zs+MWH9oNCa1MzOJS2q6qgRXsUWKd3HBpoKVlUDjqqEcaHdM2j/arQv2FZF
vuMvA/27GCwau7WI//VwULk2L3LZq/GSF6CN+ra3xxPSIgAwYFkHIsU3hX38JpJU
xmnS0ABKYv8vL/74Qoh55jAgV2XAuYOuLFfUf+iNpyVaGVQSPD+l/88g/aquiT5a
eWeUl4a1XjscvTirfBzyzpURdhCGdyiAprJSZPUmLCI5f/iay8jpVCvgFyCwRJhu
OwdaGjot9fmF4JSAClqrkHzQkZ/oaJ8=
-----END CERTIFICATE-----
Serial Number: 61:8E:A8:9B:03:69:B0
Common Name: corpdev2.rrd.com
Country: US
State/Province: Any
Org Unit: IBM Web Administration for i
Issuer CN: corpdev2.rrd.com_CERTIFICATE_AUTHORITY
Issuer Country: US
Issuer State/Province: Any
Issuer Org: IBM Web Administration for i
Version: 3
not before: 20211111114707
Unknown Field: 11:47:07 11-11-2021
not after: 20221112114707
Unknown Field: 11:47:07 12-11-2022
pub key alg: 1.2.840.113549.1.1.1
signature algorithm: 1.2.840.113549.1.1.11
Unknown Field: 0382010F003082010A0282010100A86F5B7A29B547471A5FFC60B5943935EE3D5BE269857C948506069B775C832459281AC6BCE0C489C86D96F1C332C2B8A6B265E9BB5BEB0563856090E4C943B05FD98BB863EF01C9A9419FAA05967C40FB7C88E6072A9753E879090765DFF66B5479982D4D81016239A662D668355F37A7A49FD28E3132C30EA945A74D34E41FC1DE707352991BE869817AB6CC9A42346D2086D44559CD9607FC9FB47F19ECA5CA92B632BB18D4B39AFEE573A3409D168624549F2672EE9494C7A9B93A3A3B4E30654F017815FED8E1F2730177D650BD35A1EF5548C8D18BAB4E2E5324A0CA86B792D2B154026F3971AFB47A37EE4F2A179BAA5A20651EE2E744C03A7EF05B0D0203010001
Unknown Field: 2048
Unknown Field: E81C6520A315DC00A58DD7F200E37145
Unknown Field: 1.2.840.113549.2.5
Unknown Field: C370C6DEE65E89A43F58D10BFD054D2BE3E8C4EC
Unknown Field: BD83A55B3D4619B47D9909EA9DFE3A3A5B5EEF6140EFD0EC4A026D57394C0D4E
Unknown Field: 23

Protocol Used: TLS Version 1.2
http_persist_post(): entered
http_persist_req(POST) entered.
http_long_ParseURL(): entered
http_long_ParseURL(): entered
do_oper(POST): entered
There are 0 cookies in the cache
POST /wbspgm/setliblt HTTP/1.1
Host: 10.79.190.14:443
User-Agent: http-api/1.43
Content-Type: application/json
SOAPAction:  
Content-Length: 312


senddoc(): entered
{"request": {    "signature":          "STSS",    "msg_no":             "1012",    "weight":             "2.45",    "length":             "0.00",    "width":              "5.25,      "height":             "0.05",    "package_type":       "0",    "system_id":          "1",    "package_id_barcode": "4453741799"}}
recvresp(): entered
HTTP/1.1 403 Forbidden
Date: Mon, 15 Nov 2021 16:30:26 GMT
Server: Apache
Content-Length: 199
Content-Type: text/html; charset=UTF-8


SetError() #13: HTTP/1.1 403 Forbidden
recvresp(): end with 403
recvdoc parms: identity 199
header_load_cookies() entered
recvdoc(): entered
SetError() #0:
recvdoc(): Receiving 199 bytes.
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>403 Forbidden</TITLE>
</HEAD><BODY>
<H1>Forbidden</H1>
<p>You don't have permission to access this resource.</p>
</body></html>

SetError() #13: HTTP/1.1 403 Forbidden
http_close(): entered
Here are my directives

Code: Select all

# Configuration originally created by Create HTTP Server wizard on Thu Nov 11 12:56:39 CST 2021
LoadModule ibm_ssl_module /QSYS.LIB/QHTTPSVR.LIB/QZSRVSSL.SRVPGM
Listen *:443 https
DocumentRoot /www/jkltest/htdocs
TraceEnable Off
Options -FollowSymLinks
LogFormat "%h %T %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%{Cookie}n \"%r\" %t" cookie
LogFormat "%{User-agent}i" agent
LogFormat "%{Referer}i -> %U" referer
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog logs/access_log combined
LogMaint logs/access_log 7 0
LogMaint logs/error_log 7 0
DefaultFsCCSID 37
DefaultNetCCSID 819
SetEnvIf "User-Agent" "Mozilla/2" nokeepalive
SetEnvIf "User-Agent" "JDK/1\.0" force-response-1.0
SetEnvIf "User-Agent" "Java/1\.0" force-response-1.0
SetEnvIf "User-Agent" "RealPlayer 4\.0" force-response-1.0
SetEnvIf "User-Agent" "MSIE 4\.0b2;" nokeepalive
SetEnvIf "User-Agent" "MSIE 4\.0b2;" force-response-1.0
SetEnv HTTPS_PORT 443
SSLEngine On
SSLAppName QIBM_HTTP_SERVER_JKLTEST
SSLCacheEnable
SSLVersion TLSV1.2_TLSV1.3
SSLProtocolDisable SSLv3 TLSv1 TLSv1.1
SSLClientAuth Optional

<Directory />
   Require all denied
</Directory>
<Directory /www/jkltest/earnings>
   AllowOverride None
   Require all granted
</Directory>

<Directory /www/jkltest/profiles>
   AllowOverride None
   Require all granted
</Directory>

<Directory /www/jkltest/htdocs>
   Require all granted
</Directory>

Alias /profiles/ /www/jkltest/profiles/

Alias /earnings/ /www/jkltest/earnings/

ScriptAliasMatch /wbspgm/([a-z0-9]+) /qsys.lib/w2gent.lib/$1.pgm

<Directory /qsys.lib/w2gent.lib>
   order allow,deny
   allow from all
</Directory>

<VirtualHost 10.79.190.14:443>
</VirtualHost>
Top
Scott Klement
Site Admin
Posts: 872
Joined: Sun Jul 04, 2021 5:12 am

Re: SSL problem

Post by Scott Klement »

Hi Dave,

Is your question related to Frank's? Or, if not, can you tell us what your question is? You've provided a lot of information that we could use to investigate a problem, but you haven't told us what problem we should be investigating.
Top
dave.c.hanneman
Posts: 2
Joined: Mon Nov 15, 2021 5:42 pm

Re: SSL problem

Post by dave.c.hanneman »

Scott,

Yes, I am getting a persistent 403 error from the http server. I have directives for the program and data libraries in the http.conf
Top
Scott Klement
Site Admin
Posts: 872
Joined: Sun Jul 04, 2021 5:12 am

Re: SSL problem

Post by Scott Klement »

I see. So it seems you added this onto Frank's "SSL problem" thread by mistake, since it doesn't seem to be related to SSL problems or Frank's post in any way. I will move it to a new thread for you.

You are connecting with HTTPAPI to an Apache HTTPD aand this is the URL you are submitting:

Code: Select all

/wbspgm/setliblt
And if I'm reading it correctly, it is meant to match these directives:

Code: Select all

ScriptAliasMatch /wbspgm/([a-z0-9]+) /qsys.lib/w2gent.lib/$1.pgm

<Directory /qsys.lib/w2gent.lib>
   order allow,deny
   allow from all
</Directory>
However, thi s is using the old-school "order allow,deny" and "allow from all" directives, but the remainder of the config file using the newer syntax "Require all granted". I do not recommend mixing these two syntaxes... I would recommend changing it to this:

Code: Select all

ScriptAliasMatch /wbspgm/([a-z0-9]+) /qsys.lib/w2gent.lib/$1.pgm

<Directory /qsys.lib/w2gent.lib>
  Require all granted
</Directory>
Make sure you fully stop/start the HTTP server so that it picks up the changes.
Top
Post Reply

Return to “HTTPAPI”