Nginx + Drupal 8 403 forbidden error

[Olivier Leroux]

When I request http://mywebsite.com/simplesaml/, I i get 403 Forbidden.

I put www-data as ownership of simplesamlphp folder as Nginx is running

See my below my site config in Nginx

server {

    server_name mywebsite.com;

    root /var/www/drupal-8.1.8; ## <-- Your only path reference.

    location = /favicon.ico {

        log_not_found off;

        access_log off;

    }

    location = /robots.txt {

        allow all;

        log_not_found off;

        access_log off;

    }

    # Very rarely should these ever be accessed outside of your lan

    location ~* \.(txt|log)$ {

        allow 192.168.0.0/16;

        deny all;

    }

    location ~ \..*/.*\.php$ {

        allow all;

    }

    location ~ ^/sites/.*/private/ {

        return 403;

    }

    # Allow "Well-Known URIs" as per RFC 5785

    location ~* ^/.well-known/ {

        allow all;

    }

    # Block access to "hidden" files and directories whose names begin with a

    # period. This includes directories used by version control systems such

    # as Subversion or Git to store control files.

    location ~ (^|/)\. {

        return 403;

    }

    location / {

        # try_files $uri @rewrite; # For Drupal <= 6

        try_files $uri /index.php?$query_string; # For Drupal >= 7

    }

    location @rewrite {

        rewrite ^/(.*)$ /index.php?q=$1;

    }

    # Don't allow direct access to PHP files in the vendor directory.

    location ~ /vendor/.*\.php$ {

        deny all;

        return 404;

    }

    # In Drupal 8, we must also match new paths where the '.php' appears in the middle,

    # such as update.php/selection. The rule we use is strict, and only allows this pattern

    # with the update.php front controller.  This allows legacy path aliases in the form of

    # blog/index.php/legacy-path to continue to route to Drupal nodes. If you do not have

    # any paths like that, then you might prefer to use a laxer rule, such as:

    #   location ~ \.php(/|$) {

    # The laxer rule will continue to work if Drupal uses this new URL pattern with front

    # controllers other than update.php in a future release.

    location ~ \.php$|^/update.php {

        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;

        #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

        include fastcgi_params;

        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        fastcgi_param PATH_INFO $fastcgi_path_info;

        fastcgi_intercept_errors on;

        fastcgi_pass unix:/var/run/php5-fpm.sock;

    }

    # Fighting with Styles? This little gem is amazing.

    # location ~ ^/sites/.*/files/imagecache/ { # For Drupal <= 6

    location ~ ^/sites/.*/files/styles/ { # For Drupal >= 7

        try_files $uri @rewrite;

    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {

        expires max;

        log_not_found off;

    }

    # Including simple SAML PHP, for authentication

    include simplesamlphp.conf;

}

I put simplesalphp.conf in nginx root directory as advised in this post https://github.com/perusio/drupal-with-nginx/issues/232

location ^~ /simplesaml {

    alias /var/www/drupal-8.1.8/modules/simplesamlphp_auth/vendor/simplesamlphp/simplesamlphp/www; 

    location ~ ^(?<prefix>/simplesaml)(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {

      include fastcgi_params;

      fastcgi_pass unix:/var/run/php5-fpm.sock;

      fastcgi_param SCRIPT_FILENAME $document_root$phpfile;

      fastcgi_param PATH_INFO       $pathinfo if_not_empty;

      fastcgi_index index.php;

      allow all;

    }

}

Can somebody help me fast, I am blocked for few weeks with this issue ?

[Peter Schober]

* Olivier Leroux <olil...@gmail.com> [2016-09-14 11:48]:

> Can somebody help me fast, I am blocked for few weeks with this issue ?

Funny. You've spent weeks on that (or waited weeks until you asked)
and now everyone else has to hurry to fix your problem?

Anyway, I don't speak Nginx and there's nothing specific to SSP here,
AFAICT. I.e., the same problem would occur if you put
<?php echo "Hello, World!"; ?>
in an index.php at a referenced directory (SSP's "www" directory), no?

-peter

[Olivier Leroux]

Yes of course it is not specific to SSP but SSP site doesn't document configuration for a Nginx server and  for Apache it is.

Same problem occurs if I change index.php to <?php echo "Hello, World!"; ?> 

[lionel....@gmail.com]

I had the same issue, I fixed it by just adding this line in my server block:

index index.php;