InfoPath Dev

Hi All,

I have an InfoPath form published in a SharePoint list which is connecting to UserProfileService.asmx to auto populate some user properties. It works fine in my stage server but when i moved it to development and production environment it gives me unauthorized 401 error while connecting to web service -

Error Log-

The following query failed: GetUserDetails (User: domain\username, Form Name: Template, IP: , Connection Target: , Request:http://sitename/Lists/newlist/AllItems.aspx?View={88B0F3FB-4C19-4711-8A3C-491DEB51C5A0}, Form ID: urn:schemas-microsoft-com:office:infopath:list:-AutoGen-2012-05-26T10:48:21:36Z Type:DataAdapterException, Exception Message: The remote server returned an error:(401) Unauthorized.

**GetUserDetails is the data connection created in InfoPath which is connecting to http://app-domain/_vti_bin/userprofileservice.asmx and using its GetUserProfileByName method.

Few strange observations-

1. One side it is giving me 'Unauthorized error', but on other it works sometimes (with same browser, on same machine). This is driving me crazy because if some is unauthorized then how come he is able to connect sometimes.
2. It works fine in preview mode in InfoPath but gives error after publishing it to SharePoint site.

Few things that I ensured-

1. I updated the web service url in data connection file.
2. Anonymous access is not enabled in central administration.
3. App Pool Identity has invoke permissions for user profile service in central administration.
4. I have tried giving explicit credentials in my data connection file.

Note - I am using Windows Server 2008 R2 Standard edition and using NTLM authentication for my application.

Servers in Farm-

Stage - 1 WFE server + 1 App server - Works fine
Devlopment - 1 WFE Server + 1 App Server - Getting Error
Production - 3 WFE + 2 App Server + 1 index server - Getting Error

I am getting this error while browsing from any machine i.e server and other local machines.

Please suggest me something. Thanks.

Hi Kamal,

UserProfileService doesn't work for Office 365 / SharePoint Online, so my first question is whether you are using that or not?

If this is a standard SharePoint 2010 install, and you are using UDCX files, you shouldn't have to give explicit credentials. So long as the connection is to the same site, it should work fine. If it's cross-site, you will need explicit credentials or better yet, SSO config.

NTLM is relevant for InfoPath filler forms, but not for browser-based forms.

Thanks for the reply Patrick.

I am not using Office 365/Sharepoint online. Yes it is a standard Sharepoint 2010 install. I am not using explicit credentials, though i tried using that once just to make myself sure that i not missing something very simple. Thanks for explaining the need for explicit credentials. I tried the same to connect my dev infopath to connect to stage server web service and it works fine but it is not connecting to dev server web service.

I am not aware of the the authentication types, just wrote it as part of my configuration settings if there is something to relate with my error.

Please suggest something, what could be the cause? I have also disbaled the loopback check.

Thanks,

Kamal

Kamal_Kochar:

I have an InfoPath form published in a SharePoint list which is connecting to UserProfileService.asmx

Are you using client or browser-based forms?   
  
You should use either client (Infopath Filler 2010) forms or, if you use browser forms, then through the web proxy service for Infopath Form Services accessing while  a web service cross-domain.
This is because Infopath browser-enabled forms communicate through stateless XMLHTTP protocol while Infopath client forms are using NTLM.
So, with Infopath browser-based form you have classic double hop authentication problem when the data connections/sources are in different other machines

Kamal_Kochar:

It works fine in my stage server but when i moved it to development and production environment it gives me unauthorized 401 error while connecting to web service

Are your stage servers on the same machine?  

Kamal_Kochar:

1. One side it is giving me 'Unauthorized error', but on other it works sometimes (with same browser, on same machine)

What do you mean  under the "One side" and the "other side". Your "other side" sounds to me like having no remote sides at all 

"it works sometimes (with same browser, on same machine)" sounds like typical double hop authentication problem.  
See my explanations above

Kamal_Kochar:

This is driving me crazy because if some is unauthorized then how come he is able to connect sometimes.

"Some" probably doesn't connect at all but sees cached data.

Kamal_Kochar:

2. It works fine in preview mode in InfoPath but gives error after publishing it to SharePoint site

This is because preview mode (and client forms) is connecting through NTLM while run-time browser forms through XMLHTTP.
The latter has double hop problem and the former does not.

Kamal_Kochar:

4. I have tried giving explicit credentials in my data connection file

Once more, you should use the web proxy service while connecting to other servers (on other machines) from browser forms or connect from client (Infopath Filler 2010) to avoid double hop problem.

Kamal_Kochar:

Note - I am using Windows Server 2008 R2 Standard edition and using NTLM authentication for my application

How have you configured and checked this?
You might want to use Wireshark or Fiddler to check authentication mechanism and how credentials are really passed

Kamal_Kochar:

I am getting this error while browsing from any machine i.e server and other local machines

This is not only you, Everybodу else has the same issues and should configure their environment.
See my explanations above 

Hi,

Thanks for the reply.

My Self The Enemy:

Are you using client or browser-based forms? 

I am using browser based forms.

My Self The Enemy:

if you use browser forms, then through the web proxy service for Infopath Form Services accessing while  a web service cross-domain.

I didn't understand it. Can you please tell, how can i achieve this?

My Self The Enemy:

Are your stage servers on the same machine?

If i got you right, below is what you are looking from me-

Stage Environment - I have 1 WFE Server + 1 App Server + 1 DB Server (All different machines). But development environment also has the same server structure.

My Self The Enemy:

What do you mean  under the "One side" and the "other side". Your "other side" sounds to me like having no remote sides at all 

I really didn't meant anything by sides. Sorry for the confusion.

My Self The Enemy:

"Some" probably doesn't connect at all but sees cached data.

I clear cache all the time. Anyhow it shouldn't come in cache if someone never connected.

How can i resolve this if it is double hop authentication problem? Please help.

Many Thanks,

Kamal

 

 I would have checked that WebDAV is enabled on your server. 

 Also, InfoPath Form Services does not support claims based authentication (that's what MS Support told us, as well as it is written in msdn article Building SharePoint Applications with InfoPath 2010 (Part 2 of 2) (MSDN refresh)    in context of using GetUserProfileByName SOAP service:

•   "the web application that hosts this SharePoint application must be configured to use classic-mode authentication"

 

You've probably resolved this already, but if not...

I had similar issues. My issues were caused by inconsistencies in server-level configuration. This might help: http://sharepointotoole.wordpress.com/2012/04/26/rodgers-discount-double-hop/

...let me know if you have any follow up questions.

Patrick