Permissions for Running Express Server

To run Express Server, you must configure permissions for your web server service and for LizardTech services.

The user that runs each service must have:

• Read permissions to all Express Server directories.

• Read permissions for the image directories that you want to host on Express Server. If the image directories that you want to access are on a network, you may have to add the users that run the LizardTech Express Server Tomcat service and the IIS Web Server service to the list of domain users.

  NOTE: If you want to use LizardTech GeoExpress software to save imagery directly to Express Server catalogs, then each user must also have write permissions for the image directories.

• Read, write, and delete permissions for the working directory. The working directory is the location where Express Server stores information about image catalogs, including indexes, catalog overviews, the configuration archive, and catalog configuration files. For more information about the working directory, see The Working Directory. The following directory is the default working directory:

  <Express Server Installation Directory>/Express Server/ImageServer/var/data

The following list describes the services and users that need the above permissions.

• LizardTech Express Server Tomcat service or daemon. Grant permissions to the user that runs the Tomcat service or daemon. On Windows, the Tomcat service runs on the NetworkService account by default. You can view the account that runs the Tomcat service in the Windows Services utility. On Linux, the Tomcat daemon, also known as lttomd runs on the account specified during the installation of Express Server.
• LizardTech Express Server Admin Backend service or daemon. Grant permissions to the user that runs the Admin Backend service or daemon. On Windows, the service runs on the Local System account by default. You can view the account that runs the Admin Backend service in the Windows Services utility. On Linux, the Admin Backend daemon, also known as ltagentd, runs as root so that you can start and stop the web server from the Express Server Manager.
• IIS Web Server service. For Windows only, grant permissions to user that runs the IIS service. By default, the IIS service runs on the anonymous IUSR account. You can view the account that runs the IIS service in the IIS Manager. Additionally, the IIS service runs an Express Server-specific application pool called LTESAppPool as the NetworkService user. On Linux, the Apache service does not access imagery directly and therefore does not require special permissions.

NOTE: For most standard installations of Apache and IIS, the correct permissions are configured for each user and service by default. In Windows, if you change the user to a domain user, make sure to change it in the following locations: LizardTech Express Server Tomcat Service, LTESAppPool, and Anonymous Authentication. See Specifying a Domain User Account for Windows.