Your client is not allowed to access the requested object

jkm

Env TS 6.7.2 + Solaris 10 + SunOne

We are getting the above given error when we try to preview the file in one of our directories in teamsite.

Path of the file is

/iwmnt/default/main/XYZ/WORKAREA/content/content/x/y/z/abc.html

Directory x has only read and write access for admin user and one of the teamsite groups.

This does not have access for any other users.

When user who is part of the group try to preview the file, he gets the 403 error.

We tried to run proxy in debug mode and we are getting below errors in the proxy logs

[Access control not enabled in iwproxy_access_control_enabled for url
/iw-mount/default/main/XYZ/WORKAREA/content/content/x/y/z/abc.html]
[Suppressing injection because of status code: 403]

When we change the permissions for others then it works fine. This is definitely a permissions issue but it is not clear why it is giving error to the user who is already part of the group or even the owner of the file + directory.

Adam Stoller

Env TS 6.7.2 + Solaris 10 + SunOne We are getting the above given error when we try to preview the file in one of our directories in teamsite. Path of the file is /iwmnt/default/main/XYZ/WORKAREA/content/content/x/y/z/abc.html Directory x has only read and write access for admin user and one of the teamsite groups. This does not have access for any other users.

Are you saying that nobody has execute permissions on the directory? I.e. chmod 660? or did you just not mention it - i.e. chmod 770?

When user who is part of the group try to preview the file, he gets the 403 error. We tried to run proxy in debug mode and we are getting below errors in the proxy logs [Access control not enabled in iwproxy_access_control_enabled for url /iw-mount/default/main/XYZ/WORKAREA/content/content/x/y/z/abc.html] [Suppressing injection because of status code: 403] When we change the permissions for others then it works fine. This is definitely a permissions issue but it is not clear why it is giving error to the user who is already part of the group or even the owner of the file + directory.

You need to provide access for the "anonymous" user that TS will use to perform the operations necessary during preview - I believe this would be either "iwui" or "iwts" - so try adding one, the other, or both to the group you originally provided access for and remove the access for "everyone" - and see if that works.