Installing DSpace

Installation Overview

As of version 7 (and above), the DSpace application is split into a "frontend" (User Interface) and a "backend" (Server API).  Most institutions will want to install BOTH.  However, you can decide whether to run them on the same machine or separate machines.

• The DSpace Frontend consists of a User Interface built on Angular.io.  It cannot be run alone, as it requires a valid DSpace Backend to function.  The frontend provides all user-facing functionality
• The DSpace Backend consists of a Server API ("server" webapp), built on Spring Boot.  It can be run standalone, however it has no user interface.  The backend provides all machine-based interfaces, including the REST API, OAI-PMH, SWORD (v1 and v2) and RDF.

We recommend installing the Backend first, as the Frontend requires a valid Backend to run properly.

Installing the Backend (Server API)

Backend Requirements

<settings>
  .
  .
  <proxies>
   <proxy>
      <active>true</active>
      <protocol>http</protocol>
      <host>proxy.somewhere.com</host>
      <port>8080</port>
      <username>proxyuser</username>
      <password>somepassword</password>
      <nonProxyHosts>www.google.com|*.somewhere.com</nonProxyHosts>
    </proxy>
  </proxies>
  .
  .
</settings>

Backend Installation

1. Install all the Backend Requirements listed above.

2. Create a DSpace operating system user (optional) .  As noted in the prerequisites above, Tomcat (or Jetty, etc) must run as an operating system user account that has full read/write access to the DSpace installation directory (i.e. [dspace]).  Either you must ensure the Tomcat owner also owns [dspace], OR you can create a new "dspace" user account, and ensure that Tomcat also runs as that account:

   useradd -m dspace

   The choice that makes the most sense for you will probably depend on how you installed your servlet container (Tomcat/Jetty/etc).  If you installed it from source, you will need to create a user account to run it, and that account can be named anything, e.g. 'dspace'.  If you used your operating system's package manager to install the container, then a user account should have been created as part of that process and it will be much easier to use that account than to try to change it.

3. Download the latest DSpace release from the DSpace GitHub Repository. You can choose to either download the zip or tar.gz file provided by GitHub, or you can use "git" to checkout the appropriate tag (e.g. dspace-7.0) or branch.
4. Unpack the DSpace software. After downloading the software, based on the compression file format, choose one of the following methods to unpack your software:
   

   1. Zip file. If you downloaded dspace-7.0.zip do the following:

      unzip dspace-7.0.zip

   2. .gz file. If you downloaded dspace-7.0.tar.gz do the following:

      gunzip -c dspace-7.0.tar.gz | tar -xf -

      For ease of reference, we will refer to the location of this unzipped version of the DSpace release as [dspace-source] in the remainder of these instructions. After unpacking the file, the user may wish to change the ownership of the dspace-7.x folder to the "dspace" user. (And you may need to change the group).

5. Database Setup
   
   • PostgreSQL:
     

     • Create a dspace database user (this user can have any name, but we'll assume you name it "dspace"). This is entirely separate from the dspace operating-system user created above:

       createuser --username=postgres --no-superuser --pwprompt dspace

       You will be prompted (twice) for a password for the new dspace user.  Then you'll be prompted for the password of the PostgreSQL superuser (postgres).

     • Create a dspace database, owned by the dspace PostgreSQL user. Similar to the previous step, this can only be done by a "superuser" account in PostgreSQL (e.g. postgres):

       createdb --username=postgres --owner=dspace --encoding=UNICODE dspace

       You will be prompted for the password of the PostgreSQL superuser (postgres).

     • Finally, you MUST enable the pgcrypto extension on your new dspace database.  Again, this can only be enabled by a "superuser" account (e.g. postgres)

       # Login to the database as a superuser, and enable the pgcrypto extension on this database
       psql --username=postgres dspace -c "CREATE EXTENSION pgcrypto;"

       The "CREATE EXTENSION" command should return with no result if it succeeds. If it fails or throws an error, it is likely you are missing the required pgcrypto extension (see Database Prerequisites above).

       • Alternative method: How to enable pgcrypto via a separate database schema. While the above method of enabling pgcrypto is perfectly fine for the majority of users, there may be some scenarios where a database administrator would prefer to install extensions into a database schema that is separate from the DSpace tables. Developers also may wish to install pgcrypto into a separate schema if they plan to "clean" (recreate) their development database frequently. Keeping extensions in a separate schema from the DSpace tables will ensure developers would NOT have to continually re-enable the extension each time you run a "./dspace database clean". If you wish to install pgcrypto in a separate schema here's how to do that:

         # Login to the database as a superuser
         psql --username=postgres dspace
         # Create a new schema in this database named "extensions" (or whatever you want to name it)
         CREATE SCHEMA extensions;
         # Enable this extension in this new schema
         CREATE EXTENSION pgcrypto SCHEMA extensions;
         # Grant rights to call functions in the extensions schema to your dspace user
         GRANT USAGE ON SCHEMA extensions TO dspace;
         
         
         # Append "extensions" on the current session's "search_path" (if it doesn't already exist in search_path)
         # The "search_path" config is the list of schemas that Postgres will use
         SELECT set_config('search_path',current_setting('search_path') || ',extensions',false) WHERE current_setting('search_path') !~ '(^|,)extensions(,|$)';
         # Verify the current session's "search_path" and make sure it's correct
         SHOW search_path;
         # Now, update the "dspace" Database to use the same "search_path" (for all future sessions) as we've set for this current session (i.e. via set_config() above)
         ALTER DATABASE dspace SET search_path FROM CURRENT;

   • Oracle:
     

     • Setting up DSpace to use Oracle is a bit different now. You will need still need to get a copy of the Oracle JDBC driver, but instead of copying it into a lib directory you will need to install it into your local Maven repository. (You'll need to download it first from this location: http://www.oracle.com/technetwork/database/enterprise-edition/jdbc-112010-090769.html.) Run the following command (all on one line):

       mvn install:install-file
           -Dfile=ojdbc6.jar
           -DgroupId=com.oracle
           -DartifactId=ojdbc6
           -Dversion=11.2.0.4.0
           -Dpackaging=jar
           -DgeneratePom=true
       

     • You need to compile DSpace with an Oracle driver (ojdbc6.jar) corresponding to your Oracle version - update the version in [dspace-source]/pom.xml  E.g.:

       <dependency>
         <groupId>com.oracle</groupId>
         <artifactId>ojdbc6</artifactId>
         <version>11.2.0.4.0</version>
       </dependency>
       

     • Create a database for DSpace. Make sure that the character set is one of the Unicode character sets. DSpace uses UTF-8 natively, and it is required that the Oracle database use the same character set. Create a user account for DSpace (e.g. dspace) and ensure that it has permissions to add and remove tables in the database.

     • NOTE: You will need to ensure the proper db.* settings are specified in your local.cfg file (see next step), as the defaults for all of these settings assuming a PostgreSQL database backend.

       db.url = jdbc:oracle:thin:@host:port/SID
       # e.g. db.url = jdbc:oracle:thin:@//localhost:1521/xe
       # NOTE: in db.url, SID is the SID of your database defined in tnsnames.ora
       # the default Oracle port is 1521
       # You may also use a full SID definition, e.g.
       # db.url = jdbc:oracle:thin:@(description=(address_list=(address=(protocol=TCP)(host=localhost)(port=1521)))(connect_data=(service_name=DSPACE)))
       
       # Oracle driver and dialect
       db.driver = oracle.jdbc.OracleDriver
       db.dialect = org.hibernate.dialect.Oracle10gDialect
       
       # Specify DB username, password and schema to use
       db.username =
       db.password =
       db.schema = ${db.username}
       # For Oracle, schema is equivalent to the username of your database account,
       # so this may be set to ${db.username} in most scenarios

     • Later, during the Maven build step, don't forget to specify mvn -Ddb.name=oracle package

6. Initial Configuration (local.cfg):  Create your own [dspace-source]/dspace/config/local.cfg configuration file.  You may wish to simply copy the provided [dspace-source]/dspace/config/local.cfg.EXAMPLE. This local.cfg file can be used to store any configuration changes that you wish to make which are local to your installation (see local.cfg configuration file documentation). ANY setting may be copied into this local.cfg file from the dspace.cfg or any other *.cfg file in order to override the default setting (see note below).  For the initial installation of DSpace, there are some key settings you'll likely want to override.  Those are provided in the [dspace-source]/dspace/config/local.cfg.EXAMPLE. (NOTE: Settings followed with an asterisk (*) are highly recommended, while all others are optional during initial installation and may be customized at a later time.)
   
   • dspace.dir* - must be set to the [dspace] (installation) directory  (NOTE: On Windows be sure to use forward slashes for the directory path!  For example: "C:/dspace" is a valid path for Windows.)
   • dspace.server.url* - complete URL of this DSpace backend (including port and any subpath).  Do not end with '/'.  For example: http://localhost:8080/server
   • dspace.ui.url* - complete URL of the DSpace frontend (including port and any subpath). REQUIRED for the REST API to fully trust requests from the DSpace frontend.  Do not end with '/'. For example: http://localhost:4000
   • dspace.name - Human-readable, "proper" name of your server, e.g. "My Digital Library".
   • solr.server* - complete URL of the Solr server. DSpace makes use of Solr for indexing purposes.  http://localhost:8983/solr unless you changed the port or installed Solr on some other host.
   • default.language - Default language for all metadata values (defaults to "en_US")
   • db.url* - The full JDBC URL to your database (examples are provided in the local.cfg.EXAMPLE)

   • db.driver* - Which database driver to use, based on whether you are using PostgreSQL or Oracle

   • db.dialect* - Which database dialect to use, based on whether you are using PostgreSQL or Oracle
   • db.username* - the database username used in the previous step.
   • db.password* - the database password used in the previous step.
   • db.schema* - the database schema to use (examples are provided in the local.cfg.EXAMPLE)
   • mail.server - fully-qualified domain name of your outgoing mail server.
   • mail.from.address - the "From:" address to put on email sent by DSpace.
   • mail.feedback.recipient - mailbox for feedback mail.
   • mail.admin - mailbox for DSpace site administrator.
   • alert.recipient - mailbox for server errors/alerts (not essential but very useful!)

   • registration.notify- mailbox for emails when new users register (optional)

     Your local.cfg file can override ANY settings from other *.cfg files in DSpace

     The provided local.cfg.EXAMPLE only includes a small subset of the configuration settings available with DSpace. It provides a good starting point for your own local.cfg file.

     However, you should be aware that ANY configuration can now be copied into your local.cfg to override the default settings.  This includes ANY of the settings/configurations in:

     • The primary dspace.cfg file ([dspace]/config/dspace.cfg)
     • Any of the module configuration files ([dspace]/config/modules/*.cfg files)
     • Any of the Spring Boot settings ([dspace-src]/dspace-server-webapp/src/main/resources/application.properties)

     Individual settings may also be commented out or removed in your local.cfg, in order to re-enable default settings.

     See the Configuration Reference section for more details.

7. DSpace Directory: Create the directory for the DSpace backend installation (i.e. [dspace]). As root (or a user with appropriate permissions), run:

   mkdir [dspace]
   chown dspace [dspace]

   (Assuming the dspace UNIX username.)

8. Build the Installation Package: As the dspace UNIX user, generate the DSpace installation package.

   cd [dspace-source]
   mvn package
   

   Building with Oracle Database Support

   Without any extra arguments, the DSpace installation package is initialized for PostgreSQL. If you want to use Oracle instead, you should build the DSpace installation package as follows:
   mvn -Ddb.name=oracle package

9. Install DSpace Backend: As the dspace UNIX user, install DSpace to [dspace]:

   cd [dspace-source]/dspace/target/dspace-installer
   ant fresh_install

   To see a complete list of build targets, run: ant help The most likely thing to go wrong here is the test of your database connection. See the Common Installation Issues Section below for more details.

10. Initialize your Database: While this step is optional (as the DSpace database should auto-initialize itself on first startup), it's always good to verify one last time that your database connection is working properly.  To initialize the database run:

    [dspace]/bin/dspace database migrate

11. Deploy Server web application: The DSpace backend consists of a single "server" webapp (in [dspace]/webapps/server).  You need to deploy this webapp into your Servlet Container (e.g. Tomcat).  Generally, there are two options (or techniques) which you could use...either configure Tomcat to find the DSpace "server" webapp, or copy the "server" webapp into Tomcat's own webapps folder.

    • Technique A. Tell your Tomcat/Jetty/Resin installation where to find your DSpace web application(s). As an example, in the directory [tomcat]/conf/Catalina/localhost you could add files similar to the following (but replace [dspace]with your installation location):

      DEFINE A CONTEXT PATH FOR DSpace Server webapp: server.xml

      <?xml version='1.0'?>
      <Context
      	docBase="[dspace]/webapps/server"/>

      The name of the file (not including the suffix ".xml") will be the name of the context, so for example server.xml defines the context at http://host:8080/server.  To define the root context (http://host:8080/), name that context's file ROOT.xml.   Optionally, you can also choose to install the old, deprecated "rest" webapp if you

    • Technique B. Simple and complete. You copy only (or all) of the DSpace Web application(s) you wish to use from the [dspace]/webapps directory to the appropriate directory in your Tomcat/Jetty/Resin installation. For example:
      cp -R [dspace]/webapps/* [tomcat]/webapps* (This will copy all the web applications to Tomcat).
      cp -R [dspace]/webapps/server [tomcat]/webapps* (This will copy only the Server web application to Tomcat.)

      To define the root context (http://host:8080/), name that context's directory ROOT.

12. Optionally, also install the deprecated DSpace 6.x REST API web application.  If you previously used the DSpace 6.x REST API, for backwards compatibility the old, deprecated "rest" webapp is still available to install (in [dspace]/webapps/rest). It is NOT used by the DSpace frontend.  So, most users should skip this step.

13. Copy Solr cores:  DSpace installation creates a set of four empty Solr cores already configured. 

    1. Copy them from [dspace]/solr to the place where your Solr instance will discover them. For example:

       cp -R [dspace]/solr/* [solr]/server/solr/configsets
       chown -R solr:solr [solr]/server/solr/configsets

    2. Start (or re-start) Solr.  For example:

       [solr]/bin/solr restart

       


    3. You can check the status of Solr and your new DSpace cores by using its administrative web interface.  Browse to http://localhost:8983/ to see if Solr is running well, then look at the cores by selecting (on the left) Core Admin or using the Core Selector drop list.

14. Create an Administrator Account:  Create an initial administrator account from the command line:

    [dspace]/bin/dspace create-administrator

    
    

15. Initial Startup!  Now the moment of truth! Start up (or restart) Tomcat/Jetty/Resin.
    
    1. REST API Interface - (e.g.)  http://dspace.myu.edu:8080/server/
    2. OAI-PMH Interface - (e.g.)  http://dspace.myu.edu:8080/server/oai/request?verb=Identify
    3. For an example of what the default backend looks like, visit the Demo Backend: https://api7.dspace.org/server/
16. Production Installation (adding HTTPS support): Running the DSpace Backend on HTTP & port 8080 is only usable for testing/demo environments.  If you want to run DSpace in Production, you MUST run the backend with HTTPS support (otherwise logins will not work outside of your local domain).
    1. For HTTPS support, we recommend installing either Apache HTTPD or Nginx, configuring SSL at that level, and proxying all requests to your Tomcat installation.  Keep in mind, if you want to host both the DSpace Backend and Frontend on the same server, you can use one installation of Apache HTTPD or Nginx to manage HTTPS/SSL and proxy to both.
    2. These instructions are specific to Apache HTTPD, but a similar setup can be achieved with Nginx
       1. Install Apache HTTPD, e.g. sudo apt install apache2
       2. Install the mod_proxy and mod_proxy_ajp modules, e.g. sudo en2mod proxy; sudo a2enmod proxy_ajp

          1. Alternatively, you can choose to use mod_proxy_http to create an http proxy.  A separate example is commented out below

       3. Restart Apache to enable

       4. For mod_proxy_ajp to communicate with Tomcat, you'll need to enable Tomcat's AJP connector in your Tomcat's server.xml:

          <Connector protocol="AJP/1.3" port="8009" redirectPort="8443" URIEncoding="UTF-8" />

       5. Now, setup a new VirtualHost for your site (using HTTPS / port 443) which proxies all requests to Tomcat's AJP connector (running on port 8009)

          <VirtualHost _default_:443>
              .. setup your host how you want, including log settings...
          
              SSLEngine on
              SSLCertificateFile [full-path-to-PEM-cert]
              SSLCertificateKeyFile [full-path-to-cert-KEY]
          
              # Proxy all HTTPS requests to "/server" from Apache to Tomcat via AJP connector
              ProxyPass /server ajp://localhost:8009/server
              ProxyPassReverse /server ajp://localhost:80009/server
          
              # If you would rather use mod_proxy_http as an http proxy to port 8080
              # then use these settings instead
              #ProxyPass /server http://localhost:8080/server
              #ProxyPassReverse /server http://localhost:8080/server
              # When using mod_proxy_http, you need to also ensure the X-Forwarded-Proto header is sent
              # to tell DSpace it is behind HTTPS, otherwise some URLs may continue to use HTTP 
              # (requires installing/enabling mod_headers)
              #RequestHeader set X-Forwarded-Proto https
          </VirtualHost>

    3. After switching to HTTPS, make sure to go back and update the URLs (e.g. dspace.server.url) in your local.cfg to match the new URL of your backend.  This will require briefly rebooting Tomcat.

Installing the Frontend (User Interface)

Frontend Requirements

Frontend Installation

1. First, install all the Frontend Requirements listed above & verify the backend/REST API is publicly accessible.
2. Download the latest dspace-angular release from the DSpace GitHub repository. You can choose to either download the zip or tar.gz file provided by GitHub, or you can use "git" to checkout the appropriate tag (e.g. dspace-7.0) or branch.

3. Install all necessary local dependencies by running the following from within the unzipped "dspace-angular" directory

   # change directory to our repo
   cd dspace-angular
   
   # install the local dependencies
   yarn install

4. Create a Production Configuration file at [dspace-angular]/src/environments/environment.prod.ts. You may wish to use the environment.template.ts as a starting point. This environment.prod.ts file can be used to override any of the default configurations specified in the environment.common.ts (in that same directory).  At a minimum this file MUST include the "ui" and "rest" sections similar to the following (keep in mind, you only need to include settings that you need to modify): 

   export const environment = {   
     // The "ui" section defines where you want Node.js to run/respond. It may correspond to your primary URL, but it also may not (if you are running behind a proxy).
     // In this example, we are setting up our UI to just use localhost, port 4000. 
     // This is a common setup for when you want to use Apache or Nginx to handle HTTPS and proxy requests to Node on port 4000
     ui: { 
         ssl: false,
         host: 'localhost',
         port: 4000, 
         // NOTE: Space is capitalized because 'namespace' is a reserved string in TypeScript
         nameSpace: '/' 
     },
     // This example is valid if your Backend is publicly available at https://api.mydspace.edu/server/
     // The REST settings MUST correspond to the primary URL of the backend. Usually, this means they must be kept in sync
     // with the value of "dspace.server.url" in the backend's local.cfg
     rest: { 
         ssl: true, 
         host: 'api.mydspace.edu',
         port: 443, 
         // NOTE: Space is capitalized because 'namespace' is a reserved string in TypeScript
         nameSpace: '/server' 
     }
   };

   1. HINT #1: In the "ui" section above, you may wish to start with "ssl: false" and "port: 4000" just to be certain that everything else is working properly.  With those settings, you can quickly test your UI by running "yarn start" and trying to access it via http://[mydspace.edu]:4000/ from your web browser.  KEEP IN MIND, we highly recommend always using HTTPS for Production.
   2. HINT #2: If Node throws an error saying "listen EADDRNOTAVAIL: address not available", try setting the "host" to "0.0.0.0" or "localhost".  Usually that error is a sign that the "host" is not recognized.
   3. If there are other settings you know you need to modify in the default environment.common.ts configuration file you can also copy them into this same file.

5. Build the User Interface for Production. This uses your environment.prod.ts and the source code to create a compiled version of the UI in the [dspace-angular]/dist folder

   yarn run build:prod

   1. HINT: if you change/update your environment.prod.ts, then you will need to rebuild the UI application (i.e. rerun this command).

6. Assuming you are using PM2, create a JSON configuration file describing how to run our UI application.  This need NOT be in the same directory as the dspace-angular codebase itself (in fact you may want to put the parent directory or another location). Keep in mind the "cwd" setting (on line 5) must be the full path to your [dspace-angular] folder.

   dspace-angular.json

   {
       "apps": [
           {
               "name": "dspace-angular",
               "cwd": "/home/dspace/dspace-angular",
               "script": "yarn",
               "args": "run serve:ssr",
              "interpreter": "none"
           }
       ]
   }

7. Now, start the application using PM2 using the configuration file you created in the previous step

   # In this example, we are assuming the config is named "dspace-angular.json"
   pm2 start dspace-angular.json
   
   # To see the logs, you'd run
   # pm2 logs
   
   # To stop it, you'd run
   # pm2 stop dspace-angular.json

   1. For more PM2 commands see https://pm2.keymetrics.io/docs/usage/quick-start/
   2. HINT: You may also want to install/configure pm2-logrotate to ensure that PM2's log folder doesn't fill up over time.
8. At this point, the User Interface should be available at the URL you configured in your environment.prod.ts
   
   1. For an example of what the default frontend looks like, visit the Demo Frontend: https://demo7.dspace.org/ 
9. For HTTPS (port 443) support, you have two options
   1. (Recommended) You can install either Apache HTTPD or Nginx , configuring SSL at that level, and proxy requests to PM2 (on port 4000).  This is our current recommended approach. Plus, as a bonus, if you want to host the UI and Backend on the same server, you can use just one Apache HTTPD (or Nginx) to proxy to both. These instructions are specific to Apache.
      1. Install Apache HTTPD, e.g. sudo apt install apache2
      2. Install the mod_proxy and mod_proxy_http modules, e.g. sudo en2mod proxy; sudo a2enmod proxy_http
      3. Restart Apache to enable

      4. Now, setup a new VirtualHost for your site (preferably using HTTPS / port 443) which proxies all requests to PM2 running on port 4000.

         <VirtualHost _default_:443>
             .. setup your host how you want, including log settings...
         
             SSLEngine on
             SSLCertificateFile [full-path-to-PEM-cert]
             SSLCertificateKeyFile [full-path-to-cert-KEY]
         
             # Proxy all HTTPS requests from Apache to PM2 on port 4000
             # NOTE that this proxy URL must match the "ui" settings in your environment.*.ts
             ProxyPass / http://localhost:4000/
             ProxyPassReverse / http://localhost:4000/
         </VirtualHost>

   2. (Alternatively) You can use the basic HTTPS support built into dspace-angular node server.  (This may currently be better for non-Production environments as it has not been well tested) 
      1. Create a [dspace-angular]/config/ssl/ folder and add a key.pem and cert.pem to that folder (they must have those exact names)
      2. Enable "ui.ssl" (set to true)
      3. Update your "ui.port" to be 443
         1. In order to run Node/PM2 on port 443, you also will likely need to provide node with special permissions, like in this example.
      4. Rebuild and then restart the app in PM2
      5. Keep in mind, while this setup is simple, you may not have the same level of detailed, Production logs as you would with Apache HTTPD or Nginx
10. Additional UI configurations are described in the environment.common.ts and at https://github.com/DSpace/dspace-angular/blob/main/docs/Configuration.md  (More documentation will be coming soon)

What Next?

After a successful installation, you may want to take a closer look at

• Scheduled Tasks via Cron : Several DSpace features require that a command-line script is run regularly via cron.
• Configuration Reference : Details on the configuration options available to the Backend
• Handle Server installation: Optionally, you may wish to enable persistent URLs for your DSpace site using CRNI's Handle.Net Registry
• Statistics and Metrics: Optionally, you may wish to configuration one (or more) Statistics options within DSpace, including Google Analytics and (internal) Solr Statistics 
• Multilingual Support: Optionally, you may wish to enable multilingual support in your DSpace site.
• Using DSpace : Various other pages which describe usage and additional configurations related to other DSpace features.
• System Administration: Various other pages which describe additional backend installation options/configurations.

If you've run into installation problems, you may want to...

• Review Commons Installation Issues (see below)
• Ask for Support via one of the support options documented on that page

Common Installation Issues

Troubleshoot an error or find detailed error messages

See the Troubleshoot an error page, look for the section on "DSpace 7.x".  This will provide you hints on locating error messages both in the User Interface (frontend) and in the REST API (backend)

"CORS error" or "Invalid CORS request"

If you are seeing a CORS error in your browser, this means that you are accessing the REST API via an "untrusted" client application.  To fix this error, you must change your REST API / Backend configuration to trust the application.

• By default, the DSpace REST API / Backend will only trust the application at dspace.ui.url.  Therefore, you should first verify that your dspace.ui.url setting (in your local.cfg) exactly matches the primary URL of your User Interface (i.e. the URL you see in the browser).  This must be an exact match: mode (http vs https), domain, port, and subpath(s) all must match.
• If you need to trust additional client applications / URLs, those MUST be added to the rest.cors.allowed-origins configuration. See REST API for details on this configuration.
• Also, check your Tomcat (or servlet container) log files. If Tomcat throws a syntax or other major error, it may return an error response that triggers a CORS error.  In this scenario, the CORS error is only a side effect of a larger error.

If you modify either of the above settings, you will need to restart Tomcat for the changes to take effect.

"403 Forbidden" error with a message that says "Access is denied. Invalid CSRF Token"

First, double check that you are seeing that exact error message.  A 403 Forbidden error may be thrown in a variety of scenarios. For example, a 403 may be thrown if a page requires a login, if you have entered an invalid username or password, or even sometimes when there is a CORS error (see previous installation issue for how to solve that). 

If you are seeing the message "Invalid CSRF Token" message (especially on every login), this is usually the result of a configuration / setup issue.

Here's some things you should double check:

1. If you need to be able to login to the REST API from other domains, then your Backend must be running HTTPS.  
   1. If the REST API Backend is running HTTP, then it will always send the required DSPACE-XSRF-COOKIE cookie with a value of SameSite=Lax.  This setting means that the cookie will not be sent (by your browser) to any other domains. Effectively, this will block all logins from any domain that is not the same as the REST API (as this cookie will not be sent back to the REST API as required for CSRF validation).  In other words, running the REST API on HTTP is only possible if the User Interface is running on the exact same domain. For example, running both on 'localhost' with HTTP is a common development setup, and this will work fine.
   2. In order to allow for cross-domain logins, you MUST enable HTTPS on the REST API. This will result in the DSPACE-XSRF-COOKIE cookie being set to SameSite=None; Secure.  This setting means the cookie will be sent cross domain, but only for HTTPS requests. It also allows the user interface (or other client applications) to be on any domain, provided that the domain is trusted by CORS (see rest.cors.allowed-origins setting in REST API)
2. Verify that your User Interface's "rest" section matches the value of "dspace.server.url" configuration on the Backend.  This simply ensures your UI is sending requests to the correct REST API.  Also pay close attention that both specify HTTPS when necessary (see previous bullet).
3. Verify that your "dspace.server.url" configuration on the Backend matches the primary URL of the REST API (i.e. the URL you see in the browser).  This must be an exact match: mode (http vs https), domain, port, and subpath(s) all must match, and it must not end in a trailing slash (e.g. "https://api7.dspace.org/server" is valid, but  "https://api7.dspace.org/server/" may cause problems).
4. Verify that your "dspace.ui.url" configuration on the Backend matches the primary URL of your User Interface (i.e. the URL you see in the browser). This must be an exact match: mode (http vs https), domain, port, and subpath(s) all must match, and it must not end in a trailing slash (e.g. "https://demo7.dspace.org" is valid, but "https://demo7.dspace.org/" may cause problems).
5. Verify that nothing (e.g. a proxy) is blocking Cookies and HTTP Headers from being passed between the UI and REST API.  DSpace's CSRF protection relies on the client (User Interface) being able to return both a valid DSPACE-XSRF-COOKIE cookie and a matching X-XSRF-TOKEN header back to the REST API for validation. See our REST Contract for more details https://github.com/DSpace/RestContract/blob/main/csrf-tokens.md
6. If you are running a custom application, or accessing the REST API from the command-line (or other third party tool like Postman), you MUST ensure you are sending the CSRF token on every modifying request.  See our REST Contract for more details https://github.com/DSpace/RestContract/blob/main/csrf-tokens.md

For additional information on how DSpace's CSRF Protection works, see our REST Contract at https://github.com/DSpace/RestContract/blob/main/csrf-tokens.md

Using a Self-Signed SSL Certificate causes the Frontend to not be able to access the Backend

If you setup the backend to use HTTPS with a self-signed SSL certificate, then Node.js (which the frontend runs on) may not "trust" that certificate by default.  This will result in the Frontend not being able to make requests to the Backend.

One possible workaround (untested as of yet) is to try setting the NODE_EXTRA_CA_CERTS environment variable (which tells Node.js to trust additional CA certificates).

Another option is to avoid using a self-signed SSL certificate. Instead, create a real, issued SSL certificate using something like Let's Encrypt (or similar free services)

My REST API is running under HTTPS, but some of its "link" URLs are switching to HTTP?

This scenario may occur when you are running the REST API behind an HTTP proxy (e.g. Apache HTTPD's mod_proxy_http, Ngnix's proxy_pass or any other proxy that is forwarding from HTTPS to HTTP).

The fix is to ensure the DSpace REST API is sent the X-Forwarded-Proto header (by your proxying service), telling it that the forwarded protocol is HTTPS

X-Forwarded-Proto: https

In general, when running behind a proxy, the DSpace REST API depends on accurate X-Forwarded-* headers to be sent by that proxy.

Database errors occur when you run ant fresh_install

There are two common errors that occur.

• If your error looks like this:

  [java] 2004-03-25 15:17:07,730 INFO
  	    org.dspace.storage.rdbms.InitializeDatabase @ Initializing Database
  [java] 2004-03-25 15:17:08,816 FATAL
  	    org.dspace.storage.rdbms.InitializeDatabase @ Caught exception:
  [java] org.postgresql.util.PSQLException: Connection refused. Check
  	    that the hostname and port are correct and that the postmaster is
  	    accepting TCP/IP connections.
  [java]     at
  	    org.postgresql.jdbc1.AbstractJdbc1Connection.openConnection(AbstractJd
  bc1Connection.java:204)
  [java]     at org.postgresql.Driver.connect(Driver.java:139)

  it usually means you haven't yet added the relevant configuration parameter to your PostgreSQL configuration (see above), or perhaps you haven't restarted PostgreSQL after making the change. Also, make sure that the db.username and db.password properties are correctly set in [dspace]/config/dspace.cfg. An easy way to check that your DB is working OK over TCP/IP is to try this on the command line:

  psql -U dspace -W -h localhost

  Enter the dspace database password, and you should be dropped into the psql tool with a dspace=> prompt.

• Another common error looks like this:

  [java] 2004-03-25 16:37:16,757 INFO
  	    org.dspace.storage.rdbms.InitializeDatabase @ Initializing Database
  [java] 2004-03-25 16:37:17,139 WARN
  	    org.dspace.storage.rdbms.DatabaseManager @ Exception initializing DB
  	    pool
  [java] java.lang.ClassNotFoundException: org.postgresql.Driver
  [java]     at java.net.URLClassLoader$1.run(URLClassLoader.java:198)
  [java]     at java.security.AccessController.doPrivileged(Native
  	   Method)
  [java]     at
  	   java.net.URLClassLoader.findClass(URLClassLoader.java:186)

  This means that the PostgreSQL JDBC driver is not present in [dspace]/lib. See above.