title: Client denied by server configuration with tomcat
body: <p>I have found at least a dozen entries for this error even in this forum, and many outside. All are basically saying that inside <code>&lt;Directory&gt;&lt;/Directory&gt;</code>, I have "deny all" directive, and no "allow" directive.</p>
  
  <p>I cannot write a fixed directory to match because it is created on the fly by a backend tomcat server. </p>
  
  <p>When I entered "myUrl/test/request/user1/1234567890/download", I get</p>
  
  <blockquote>
    <p>403 Forbidden: You don't have permission to access /test/request/user1/1234567890/download.</p>
  </blockquote>
  
  <p>httpd error log shows: </p>
  
  <pre><code>[error] [client xxx.xx.xx.xxx] client denied by server configuration: /data/test, referer: myUrl/test/request/user1/1234567890
  </code></pre>
  
  <p>The part beginning with "test" is created by the backend tomcat, in which "user1" and "1234567890" vary, while the other parts of the directory structure remain fixed.</p>
  
  <p>In my httpd.conf, I do have:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;    
      DocumentRoot /data
      ---
      ---
      RewriteRule ^/test - [L]
      ---
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>How do I solve this? Even if  I create a different  and create another document root, I will need a regex. Somewhere outside , I tried this:</p>
  
  <pre><code>&lt;Directory "/data/test/request/*/*/download"&gt;
      Options -Indexes -FollowSymLinks
      AllowOverride None
      Order allow,deny
      Allow from all
  &lt;/Directory&gt;
  </code></pre>
  
  <p>But no success.</p>
  
  <p>I am using "ajp" to talk to backend tomcat and have necessary module in place and I can telnet the backend tomcat server (on 8009) . So it should not be ajp communications problem.</p>
  
  <p>The "test" piece in above url is actually a "context" inside /webapps directory of tomcat. Owner in that "test" context is tomcat, but I have added read permission for everyone. </p>