HTTP Server - Forbidden Rule

[gofightwinmsu]

I'm attempting to provide an RPG REST Web Service for the first time. Fun stuff! I've created the standard IBM HTTP server using Scott Klement's guide (thank for all that you do Scott). The HTTP server is running and seems to be functioning. I created/copied a very basic example RPG program for the web service to return customer name and address (again copying Scott's examples). When testing the web service, I'm getting a "forbidden - by rule" error that states that I don't have permission to access /zappix/MEIGR on this server. I don't understand why MEIGR appears as part of the folder, when MEIGR is the parameter that I'm passing (like a customer #) as part of the URL. Since I'm getting a authority issue, this doesn't seem to be a firewall/network issue. I'm sure I'm doing something stupid, but I don't what it is, any advice anyone can provide would be greatly appreciated.

I've copied the HTTP server configuration file below.

1	# Configuration originally created by Create HTTP Server wizard on Thu Aug 17 08:56:12 EDT 2017
2	Listen *:8008
3	DocumentRoot /www/susezappix/htdocs
4	TraceEnable Off
5	Options -ExecCGI -FollowSymLinks -SymLinksIfOwnerMatch -Includes -IncludesNoExec -Indexes -MultiViews
6	LogFormat "%h %T %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"" combined
7	LogFormat "%{Cookie}n "%r" %t" cookie
8	LogFormat "%{User-agent}i" agent
9	LogFormat "%{Referer}i -> %U" referer
10	LogFormat "%h %l %u %t "%r" %>s %b" common
11	CustomLog logs/access_log combined
12	LogMaint logs/access_log 7 0
13	LogMaint logs/error_log 7 0
14	SetEnvIf "User-Agent" "Mozilla/2" nokeepalive
15	SetEnvIf "User-Agent" "JDK/1\.0" force-response-1.0
16	SetEnvIf "User-Agent" "Java/1\.0" force-response-1.0
17	SetEnvIf "User-Agent" "RealPlayer 4\.0" force-response-1.0
18	SetEnvIf "User-Agent" "MSIE 4\.0b2;" nokeepalive
19	SetEnvIf "User-Agent" "MSIE 4\.0b2;" force-response-1.0
20	<Directory />
21	Order Deny,Allow
22	Deny From all
23	</Directory>
24	<Directory /www/susezappix/htdocs>
25	Order Allow,Deny
26	Allow From all
27	</Directory>
28
29	# SUSE RESTFUL Web Services
30
31	# Alias tells Apache how to call zappixws program
32	ScriptAliasMatch /zappix /qsys.lib/zappixrest.lib/zappixws.pgm
33	<Directory /qsys.lib/zappixrest.lib>
34	Order Allow,Deny
35	Allow From all
36	</Directory>

The HTTP server was created using IBM Web Administrator for I. I've verified that a folder susezappix was created in the IFS under www folder and the susezappix folder contains 3 other folders conf, htdocs, & logs. The HTTP configuration file says to "allow from all", I've checked the permissions on the susezappix folder in IFS and QTMHTTP as read, write, & execute. The URI that I'm using is http://name.com:8008/zappix/MEIGR. I've tested this using SOAPUI, POSTMAN, and directly from IE browser and get the same error FORBIDDN - by rule. Forbidden

Forbidden - by rule.
You do not have permission to access /zappix/ on this server.

[Scott Klement]

Wow is that hard to read. Not sure what you were going for wtih the formatting, here... but just posting the contents of the config file with code tags (use the # button in the forum editor) would be much easier to read.

But, it looks like vou'ce coded this line wrong:
[code]
ScriptAliasMatch /zappix /qsys.lib/zappixrest.lib/zappixws.pgm
[/code]

ScriptAliasMatch is for regular expressions (similar to "wildcards"), and is not needed here at all. Instead, use ScriptAlias.

ScriptAliasMatch /zappix /qsys.lib/zappixrest.lib/zappixws.pgm

Or, if you need to use ScriptAliasMatch because you're doing something more sophisticaed, the syntax would look like this:

ScriptAliasMatch /zappix/(.*) /qsys.lib/zappixrest.lib/zappixws.pgm

Here the regular expression matches the extra bits you've added to the end of the URL. Not necessary if you use ScriptAlias, but it is if you use ScriptAliasMatch.

The other thing that confuses me is that you're referring to SUSE in the comments. My articles and presentations are for IBM i, not SUSE. The Apache syntax in SUSE (or any other flavor of Unix/Linux) would be similar, but would not use /qsys.lib, but instead would point to whereever you put the binaries for your web service programs. Maybe you'd create a directory like /usr/local/wsbin or something? I guess that's up to you.... but /qsys.lib is an IBM i thing.