InfoPath Dev

Just wondering what is the best practices regarding the used of electronic signature. I know Qdabra has a pin/image template but wanted to something simpler: We wanted to do the username/pwd verification against AD and populate a read-only field. I am not even sure if that is the best practice. The only reason is so that the user signing on the computer doesn't have to log off for the approver to approve the form and without the need of an image signature. I was wondering if SP UserProfileService will allow you to check for the username and password inherently? Since, another user can log on and off the SP site while someone else is logged onto the computer. Essentially, allowing infopath client to use or check the SP identity rather than the identity of the person logging into the computer (I am assuming that Infopath username() is taken from the person logged into the computer). Or is there a template exist that checks username/pwd against AD? I assume there isn't one since there is an encryption issue. Has anyone done anything similar to this...?

Hi Mikeng,

Electronic Signatures are not Digital Signatures. The latter is required for legally certifiable document signing. That's because with e-sig you can't prove the document didn't change after it was signed. With digi-sig you can.

If you're using signature more as a form of confirmation and communication (and not for a legally sensitive processes), e-sig is sufficient and much easier to set up.

Your variation of e-sig - to use AD or UserProfileService - is a common one. We have customers who use our e-sig template and configure it that way. That saves you the trouble of the PIN, but you still need some kind of user confirmation action to add the wet signature, so a PIN is useful there. Or, you could have them type in their name exactly as they see it and click a button. Then the section would change to be read-only so they couldn't modify further.

Correct, username() is not what you want. UserProfileService is good. AD is also good. You don't check username/pwd against AD. If they are logged in, you can just get the AD credentials. Our AD Web Service provides that info, but so does UserProfileService - see Clayton Cobb's nice howto on that.

We do have the ability to have people validate by retyping their username and password - that requires a full trust form, and we typically use it for laptops and kiosk applications.

Hope this was a wee bit helpful...

Good luck!

Patrick, we wouldn't want the complication of having them add a pin and wet signature (atleast in our current scenario). Does the e-sig verify identity against who is logged onto the computer domain or whoever is logged onto the Sharepoint site? Since SharePoint allow a user to log into the site other than the person logged into the computer. Can the e-sig be configured to verify the username/pass (besides using the pin) word of the current signer rather than whoever is logged into the computer? I was trying to get around the fact that the user has to be logged into the computer. I was trying to see if it's typical for someone else to be logged in and then a supervisor going on the same computer and approve the form, having first be verified with the username/pass. It sounds like we can't do it unless it's a full trust form is what I am gathering.