Getting 403 errors what is wrong?

Getting 403 errors what is wrong?

Users are seeing a Jetty 403 forbidden error from webNetwork, when launching a webApp.

Things to check:
  1. The DNS Name field on the relay object is blank.
  2. The External port set in the webApp is not already used on the relay.  Usually only applies to Dedicated Port webApps.
  3. The Virtual DNS name is not already used by another map/webApp/virtual host (requires restarting webNetwork after making Virtual DNS name unique).
  4. Had various webApps at one time using same virtual DNS name, that have since been removed.  Server is now confused and requires a restart to clear out all the previous old webApp configurations from memory.  Related to #3.
  5. The link was created using the Access Control option of webApp.
    (if you have a custom link, you still need a web application link to give user rights)
  6. User has been assigned the webApp's link.
  7. WebApp is assigned to the relay(s).
  8. Relay can communicate to the webApp's host address on the port specified.
  9. Created a custom web page to launch webApp, but user is not assigned the webApp generated link.
  10. If you have multiple relay servers, check if it is just one relay server that has error.
  11. webApp's Virtual DNS name is not in same domain as the relay's DNS name.
  12. If using clustering, check cluster is up for all nodes.  Also check there are no cluster communication issues between the loaders.
  13. If launching webApp from custom link, be sure case is correct.  Our web server uses case sensitive URLs.
  14. Check that the Virtual DNS name for the webApp is resolvable by the relay and the client machine.
  15. Check to make sure you do not have any leading or trailing spaces on the DNS name in host or webApp objects.
  16. Make sure that if you are using SecureByIP option on webApp, that you are using a valid login policy to login with.
  17. Make sure you are accessing the portal using a DNS name and NOT an IP number.
  18. Remove any underscores from the Virtual DNS name. Underscores are not good to use because not all browsers and systems handle them the same way.
  19. Check other browsers, if it is just IE, check the Trusted internet zones / Trusted intranet zone and Trusted sites. You should have *.domain in the Intranet zone. This can cause the cstonesessionid cookie to not be sent and thus a 403 error because you are not authenticated.
  20. Turn on Anonymous access for the webApp temporarily. If it works then the stoneware cookie is not being sent.
  21. If using a load balancer, and your loaders are not clustered, make sure the load balancer is sending all communication back to the same relay.
  22. The "Rights URL" field, on the link, contains a valid URL.

Keywords: webapp 403 external dns