InfoPath Dev

We have faced security issue with code-behind InfoPath forms in one of our new environment in which is running in Windows 2008, IIS7 and SharePoint 2007 with kerberos enabled.

The symptom are as follows:

• Right after the application pool refresh, first Normal user who tried to access the InfoPath form is unable to launch it, then all other user and even admin users cannot launch it from that point forward.
• Right after the application pool refresh, first Admin user is able to launch the InfoPath form, and from this point forward other users can launch the form as well.
• Error message shown in the MOSS logs:
• Business logic failed due to an exception. (User: xxx\xxxx, Form Name: xxxxx, IP: , Request: http://xxxxxx/_layouts/FormServer.aspx?XsnLocation=http://xxxxx/FormServerTemplates/template_-myXSD-2011-04-06T14-10-31_xxxxx.xsn&SaveLocation=http://xxxxxx&Source=http://xxxxx/Form%2520Library/Forms/AllItems.aspx&DefaultItemOpen=1, Form ID: urn:schemas-microsoft-com:office:infopath:xxxxx:-myXSD-2011-04-06T14-10-31, Type: FileLoadException, Exception Message: Could not load file or assembly 'xxxxx, Version=1.0.4085.18451, Culture=neutral, PublicKeyToken=a5605202c40f6fbd' or one of its dependencies. Access is denied.)
  

What we have done so far:

• Give authenticated users access to 12\Template\Features\ with read/write access, No Go
• Give authenticated users access to \inetpub\<WebApp>\ read/write access, still No Go
• Also did the same for c:\inetpub\temp, still No Go
• Tried to use the impersonate account in IIS, works but all users have the welcome system account in the Login screen. Revert back to authenticated user settings in IIS.
• Run process monitor and we noticed there are some registry items that it requires permission, this doesn’t apply to administrator account as it have full rights

In summary, by giving every authenticated users server admin rights, it will work but it's not the right way ahead.

Does anyone has experience using Windows 2008, IIS7 for MOSS2007? Any special steps for authorization setup? Thanks in advance.

Is the assembly one that you control?  It sounds as if the assembly is executing some code during initialization which requires administrative access.  It could be a log file is being created, or some other resource is being accessed requiring elevated permissions.  If this is the case, once the assembly is initialized, other users don't see a problem until the app pool is recycled.

 The assembly is the code-behind for InfoPath form so it's done automatically by Forms Service when the cache is empty especially after a AppPool recycle, so it will regenerate the cache.

We have created a sample IP form with code-behind from scratch and still facing the error. Likely due to an infrastructure configuration issue.

It's working perfectly fine on our previous environment Win 2003, IIS6 and MOSS 2007. Does Win 2008 and IIS 7 do things very differently?

We have seek assistance from Microsoft Support and they recommend us to drop the IP DLL into GAC and add a line to web.config. It's not really acceptable as it's part of Microsoft technology stack.