InfoPath Dev

I have InfoPath 2010 web forms that submits via qRules 4.2 to DBXL 2.6. I, as a DBXL administrator, can submit forms. Users are not able to submit forms. They receive the following error, where "author" is the user's account name:

Action: SubmitToDbxl. Arguments: submit: SubmitDocumentToDBXL doctype: fundingForm name: 2012-11-16T09-50-54[XXXXX_XXXX] author: XXXX . Details: I0033Access denied. Stack:    at Qdabra.Utilities.SubmitDocument(String docType, String name, String author, String description, SubmitDocument submitDocument, XPathNavigator xml, String& docId, String& refId)    at Qdabra.Tools.RulesLibrary.Commands.SubmitToDbxl()    at Qdabra.Tools.RulesLibrary.Commands.ExecuteCommand()

In DAAT, under Permissions > Document Type Level Permissions I have granted the Active Directory group that the users are members of Add and Write permissions. The box for Enforce Permissions is checked. The assigned name is "DDE Users" and Role Name domain\group name where domain is our domain and group name is the AD group containing the users.

The form has another from embedded with its own document type. Both document types have been assigned the same permission settings.

I've tried following the guidance in How to Configure Permissions (DBXL 2.5) and the thread http://www.infopathdev.com/forums/p/17596/61449.aspx.

Hi-

Could I suggest a workaround? Modify permissions so that everyone (NT AUTHORITY\Authenticated Users) is allowed to Add.

This is necessary because, when using sandbox, users authenticate as the service account, so the service account needs permissions to add.

Let us know whether this helps. Thanks.

Question for Ernesto, what sandbox are you speaking of? I'm not using a SharePoint sandboxed solution.

Granting NT AUTHORITY\Authenticated Users permissions works. It's not ideal since it negates the entire security feature of permissions- if I have to grant everyone permission then why pretend there is security.

Sorry if I misunderstood.

My understanding was that you have an InfoPath 2010 browser form that submits via qRules 4.2. If it's a browser form then it must be published to SharePoint and if it has qRules, then it's either using the sandbox or it's admin deployed.

Do you have a SharePoint mapping in the SharePoint tab?

The form is admin deployed. The main (parent) form is mapped to SharePoint while the embedded (child) form is not.

See attached.

If you enabled for all authenticated users, you can query the Document table in the QdabraDBXL database, you should see the CreatedBy/ModifiedBy.   Are these showing the user id you expect?

You can also look at the IIS logs to see what user account is used for authentication.  It sounds like a possible authentication issue between IIS and domain.  Is it a simple single-domain forest, or multi-domain or multi-forest AD environment?

Jim, I am seeing the user's ID in the Author column and domain\user ID in the CreatedBy and ModifiedBy.

I will try granting the user specific permissions in DBXL and if that works then I will look to see if there is an issue with the AD group.

There was a problem with the Active Directory group being used. It was recreated in AD and DBXL is working fine. Jim, thanks for the troubleshooting suggestions.