InfoPath Dev

I have an infopath web enabled form that collects info from a user and send it off for a 5-level approval process and then ends up with a committee after everyone approves it. The approvers are manually entered by submitter using a "domain\firstname.lastname" format and they are promoted to sharepoint list. I use those fields to send out emails/assign tasks etc through a workflow. I want to set up the permissions in such a way that only the submitter, approvers and everyone in the committee group have access to the form. Setting manual permissions would not be a feasible choice as the library is expected to grow quite large over time.

I would want to use a no code solution to be able to achieve this.

Thanks!!

Try my blog except use the pre-defined names in the form to do your conditional formatting unless these names/groups are defined elsewhere:

User Roles in Browser-Enabled InfoPath Forms

I'm talking about a sharepoint group which is regularly synched with AD group. I have a group called "SYS-ADM" and want all the users who are members of this group to be able to access this form in addition to the peple entered manually by users in text box. I can't maintain another contact list for the form.

I also have a method for that but just haven't finished writing the blog.  You need to use the UserProfileService to get to the GetCommonMemberships method, which is able to check the AD group memberships (but not SharePoint groups) of the current user, and you can match that against your conditional logic.

In the end, this only affects use of the form within the form.  If you need to dynamically set permissions in the form library on an item-by-item basis AFTER submission of the form, then you'll need to write code to do that.

I just checked with our AD guys and the group i need is a distribution list that is synced to a sharepoint group (not sure how exactly they work that), So i'll need to check against sharepoint group. I was advised to use "GetUserCollectionFromGroup" webservice to achieve this but when i make a connection to the webservice, it returns only a groupname rather than all the other details. Can you help me out with that or if you have any other alternatives.

Security inside form only is enough for our needs.

I really appreciate your help. Thanks!

Ok, sharePoint doesn't use distribution lists.  It only uses Security Groups, which many people mistake for distribution lists, because they behave like DLs (they can have email addresses and users).  The "sync" with SharePoint groups is nothing more than adding an AD group to a SharePoint group.  That way, the AD group gets whatever permissions the SharePoint group gets, so when you add or remove someone from the AD group, it carries through to SharePoint. 

So, you can still use the AD group.  Both the web services we're talking about actually come from SharePoint anyway and are populated by the SSP profile import, which pulls its data from AD.  You can probably use that other web service, but I don't know how to leverage.  I _do_ know how to leverage the one I mentioned.  if you go try it, you'll see how easy it is.  It gives a lot of info about the current user's memberships.  It gives sharepoint site memberships, but those aren't group memberships, so don't get confused by those.  Only worry about the ones that say DistributionList even though they are actually Security Groups.  Confusing, huh?

I tried the GetCommonMembership service but couldn't quite get it to work for me. It wasn't populating any data for me. Could you please give me a little info on how to work with that please.

Thanks!

You connect to it the same way as the GetUserProfileByName method as explained in my blog.  You choose this method instead, and it returns a much more friendly node structure.  To test it and see the data, you just drag the repeating group to the canvas - the group that contains all the field nodes of that web service.  Preview the form, and it will send your Windows ID to the web service (your username), which will then return a bunch of info regarding your group memberships.

What happens when you do that?  Are you for sure logged into your machine as a user that's in the SSP profile database?

I've tried that and dropped the repeating table to the canvas. On priev, all the fields are just blank. I even tried publishing it to a spp library and opening it. It given me an error and says logged to windows event log and then the form shows up with blank fliends. I've attached the screenshot for preview.

Screenshot for my datasource and dropped section.

So you don't get a data access error (5566) when opening the form, but yet you get no data in the web service?  I haven't seen that before.  Typically, if the web service doesn't work, then it's due to an error of some sort that is detected on form load.  When you created this data connection, did you set it to automatically retrieve data when the form opens?

What user are you logged in with to your machine?  If you place a plain text box on the canvas and set it's default value to userName(), what do you get?  If you browse to the URL of the UserProfileService with that user, what do you get?  If you set the accountName field of the queryfield group of that method to a known username, then query the service, do you get any data in this repeating table?

Oh, is it a data access error?  When you show details, is it 5566?  Do you have an SSP configured, and in the Personalization Services Permissions, do you have your current user account added (individually or through a group) with the Personal Features permission?  Is your web application of this site set to allow anonymous access (check in IIS and/or in Central Admin)?

Yes...it is the 5566 error and Anonymous access is not allowed. Regarding SSP, i'm not too sure. Its our service department that manages it and chances are, it the configuartion won't change. If all users who access this form need to be added to that to user the service, i don't think that would be possible.

Then you'll never be able to use that web service, nor will SharePoint be very useful in terms of people information.  Personal Features is a very standard permission in the SSP and is given to all authenticated users by default, so it probably IS still there, atlhough someone may have removed it without understanding it (or without realizing the effect on other things).

Be sure to try everything and look at all the questions posed.

I'll try to check with them to see which features are enabled. Also, I've been able to access other services such as GetUserProfileByName earlier, i belive that service is also dependent on the same feature. Correct me if i am wrong !!