Permission denied for accessing file through restful api
<p>In my web application, I implemented a method to download file in my controller:</p>

<pre><code>@RequestMapping(
        value = "/ristore/foundation/xml/{filename}",
        method = RequestMethod.GET,
        produces = "application/xml")
public ResponseEntity&lt;byte[]&gt; downloadXMLFile(@PathVariable String filename) throws IOException {
    FileSystemResource xmlFile = new FileSystemResource("/rsrch1/rists/moonshot/data/prod/foundation/xml/" + filename + ".xml");
    byte [] content = new byte[(int)xmlFile.contentLength()];
    IOUtils.read(xmlFile.getInputStream(), content);

    return ResponseEntity.ok()
        .contentType(MediaType.parseMediaType("application/octet-stream"))
        .contentLength(xmlFile.contentLength())
        .body(content);
}
</code></pre>

<p>I hardcoded the path to the files in the method. It is the path to the directory where all the files live on the server where Tomcat instance is running. </p>

<p>I deployed the war on the tomcat server. The web app is owned by the user <code>risdev</code>. <a href="https://i.stack.imgur.com/DaalF.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DaalF.png" alt="enter image description here"></a></p>

<p>However when I try to retrieve the file I got 500. In catalina.out, it shows the error as follows:</p>

<pre><code>[/ristore/foundation/xml/TRF174146_09092016230414] due to exception [/rsrch1/rists/moonshot/data/prod/foundation/xml/TRF174146_09092016230414.xml (Permission denied)]
</code></pre>

<p>The admin of the server grant <code>risdev</code> access to the folder. When I log in the server as <code>risdev</code>, I can read that exact file without any problem.<a href="https://i.stack.imgur.com/dJpT3.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dJpT3.png" alt="enter image description here"></a> </p>

<p>So why don't I have permission to read it through api? Who is user that is actually getting the file? </p>

<p><strong>EDIT:</strong>
I found a tomcat process that is associated with the folder where my war is deployed. It is indeed run by risdev who is supposed to have permission to the files. </p>

<p><strong>EDIT #2</strong>
Just confirmed with the admin who installed tomcat on this server. He indeed used <code>risdev</code> to install tomcat instance and run <code>startup.sh</code> after installation. So tomcat is owned and run by <code>risdev</code> for sure. On the same server, <code>risdev</code> definitely has read permission to access files in that folder as confirmed by command line (ls and less). It is just that permission is denied while access the file through tomcat.</p>

<p><a href="https://i.stack.imgur.com/kYpjk.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kYpjk.jpg" alt="enter image description here"></a></p>