0

After installing QGIS Server and the Lizmap Webclient I am encountering the error

Forbidden
You don't have permission to access this resource.

when trying to access http://serverip/lizmap.

My Setup:

  • Ubuntu 20.04 with php 7.4 and the current apache2 webserver
  • QGIS-Server in the current ltr version (3.22.10)
  • Lizmap Webclient 3.5.5 downloaded from github release and installed according to the instructions

QGIS-Server:

My QGIS-Server is up and I get the following xml message, so I am assuming its functional:

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<WMS_Capabilities xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sld="http://www.opengis.net/sld" xmlns="http://www.opengis.net/wms" xmlns:qgs="http://www.qgis.org/wms" xsi:schemaLocation="http://www.opengis.net/wms http://schemas.opengis.net/wms/1.3.0/capabilities_1_3_0.xsd http://www.opengis.net/sld http://schemas.opengis.net/sld/1.1.0/sld_capabilities.xsd http://www.qgis.org/wms http://serverip/cgi-bin/qgis_mapserv.fcgi?SERVICE=WMS&REQUEST=GetSchemaExtension" version="1.3.0">
<Service>
<Name>WMS</Name>
<Title>Untitled</Title>
<KeywordList>
<Keyword vocabulary="ISO">infoMapAccessService</Keyword>
</KeywordList>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi" xlink:type="simple"/>
<Fees>None</Fees>
<AccessConstraints>None</AccessConstraints>
</Service>
<Capability>
<Request>
<GetCapabilities>
<Format>text/xml</Format>
<DCPType>
<HTTP>
<Get>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi?" xlink:type="simple"/>
</Get>
</HTTP>
</DCPType>
</GetCapabilities>
<GetMap>
<Format>image/jpeg</Format>
<Format>image/png</Format>
<Format>image/png; mode=16bit</Format>
<Format>image/png; mode=8bit</Format>
<Format>image/png; mode=1bit</Format>
<Format>application/dxf</Format>
<DCPType>
<HTTP>
<Get>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi?" xlink:type="simple"/>
</Get>
</HTTP>
</DCPType>
</GetMap>
<GetFeatureInfo>
<Format>text/plain</Format>
<Format>text/html</Format>
<Format>text/xml</Format>
<Format>application/vnd.ogc.gml</Format>
<Format>application/vnd.ogc.gml/3.1.1</Format>
<Format>application/json</Format>
<Format>application/geo+json</Format>
<DCPType>
<HTTP>
<Get>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi?" xlink:type="simple"/>
</Get>
</HTTP>
</DCPType>
</GetFeatureInfo>
<sld:GetLegendGraphic>
<Format>image/jpeg</Format>
<Format>image/png</Format>
<Format>application/json</Format>
<DCPType>
<HTTP>
<Get>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi?" xlink:type="simple"/>
</Get>
</HTTP>
</DCPType>
</sld:GetLegendGraphic>
<sld:DescribeLayer>
<Format>text/xml</Format>
<DCPType>
<HTTP>
<Get>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi?" xlink:type="simple"/>
</Get>
</HTTP>
</DCPType>
</sld:DescribeLayer>
<qgs:GetStyles>
<Format>text/xml</Format>
<DCPType>
<HTTP>
<Get>
<OnlineResource xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://serverip/cgi-bin/qgis_mapserv.fcgi?" xlink:type="simple"/>
</Get>
</HTTP>
</DCPType>
</qgs:GetStyles>
</Request>
<Exception>
<Format>XML</Format>
</Exception>
<sld:UserDefinedSymbolization RemoteWFS="0" UserLayer="0" SupportSLD="1" UserStyle="1" RemoteWCS="0" InlineFeature="0"/>
<Layer queryable="0">
<Title>Untitled</Title>
<KeywordList>
<Keyword vocabulary="ISO">infoMapAccessService</Keyword>
</KeywordList>
<CRS>CRS:84</CRS>
<CRS>EPSG:4326</CRS>
<CRS>EPSG:3857</CRS>
<EX_GeographicBoundingBox>
<westBoundLongitude>-0.000001</westBoundLongitude>
<eastBoundLongitude>0.000001</eastBoundLongitude>
<southBoundLatitude>-0.000001</southBoundLatitude>
<northBoundLatitude>0.000001</northBoundLatitude>
</EX_GeographicBoundingBox>
<BoundingBox maxy="0.001" miny="-0.001" maxx="0.001" CRS="EPSG:3857" minx="-0.001"/>
<BoundingBox maxy="0.000001" miny="-0.000001" maxx="0.000001" CRS="EPSG:4326" minx="-0.000001"/>
</Layer>
</Capability>
</WMS_Capabilities>

Lizmap

I followed the instruction in the lizmap documentation for the apache2 configuration with slight modification for php7.4 and then installed lizmap from the .zip file as described there.

I haven't installed PostgreSQL, pure-ftpd and Spatialite as the documentation states that these are optional.

I also assigned the rights for the webdirectory (/var/www/lizmap/..) as described in the documentation.

After I encountered the issue I realized I hadn't setup a vhost file for lizmap since this is not stated in the official documentation. I found this French site and created + activated the vhost file according to the instructions. Then I repeated the whole right assignment section.

However, the issue still persists.

Lizmap vhost - lizmap.conf:

<VirtualHost *:80>
        ServerName lizmap
        DocumentRoot /var/www/thermodata/lizmap/www
        <Directory /var/www/thermodata>
                AllowOverride All
                Require all granted
        </Directory>
        ErrorLog ${APACHE_LOG_DIR}/error_lizmap.log
        CustomLog ${APACHE_LOG_DIR}/access_lizmap.log combined
        #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

QGIS-Server vhost:

<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin/">
        Options ExecCGI FollowSymLinks
        Require all granted
        AddHandler fcgid-script .fcgi
        </Directory>


        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Apache2

I assume that this is an apache2 issue, however when I followed the instruction on https://www.tecmint.com/forbidden-you-dont-have-permission-to-access-on-this-server-error/ nothing changed and the config file has the correct content.

Apache2 config file:

# Global configuration
#

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# NOTE!  If you intend to place this on an NFS (or otherwise network)
# mounted filesystem then please read the Mutex documentation (available
# at <URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex>);
# you will save yourself a lot of trouble.
#
# Do NOT add a slash at the end of the directory path.
#
#ServerRoot "/etc/apache2"

#
# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
#
#Mutex file:${APACHE_LOCK_DIR} default

#
# The directory where shm and other runtime files will be stored.
#

DefaultRuntimeDir ${APACHE_RUN_DIR}

#
# PidFile: The file in which the server should record its process
# identification number when it starts.
# This needs to be set in /etc/apache2/envvars
#
PidFile ${APACHE_PID_FILE}

#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 5


# These need to be set in /etc/apache2/envvars
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

#
# HostnameLookups: Log the names of clients or just their IP addresses
#
HostnameLookups Off

# ErrorLog: The location of the error log file.
#
ErrorLog ${APACHE_LOG_DIR}/error.log

#
# LogLevel: Control the severity of messages logged to the error_log.
#
LogLevel warn

# Include module configuration:
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf

# Include list of ports to listen on
Include ports.conf


# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

#<Directory /srv/>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#</Directory>
# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#
AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>


#
# The following directives define some format nicknames for use with
# a CustomLog directive.
#
# These deviate from the Common Log Format definitions in that they use %O
# (the actual bytes sent including headers) instead of %b (the size of the
# requested file), because the latter makes it impossible to detect partial
# requests.
#
# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
# Use mod_remoteip instead.
#
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent



# Include generic snippets of statements
IncludeOptional conf-enabled/*.conf

# Include the virtual host configurations:
IncludeOptional sites-enabled/*.conf

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
<IfModule mpm_worker_module>
StartServers       4
MinSpareThreads    25
MaxSpareThreads    100
ThreadLimit          64
ThreadsPerChild      25
MaxClients        150
MaxRequestsPerChild   0
</IfModule>

What else could I do?

1 Answer 1

0

I solved the issue myself, I just ran sudo for every command in the installation documentation and that solved it. I can access the Lizmap interface now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.