General

Re: Trying to resolve 'user lookup' issue, running into security problems

Petronomicon — Fri, 08 May 2009 15:37:07 GMT

I use a code-signing certificate to sign my InfoPath forms. Any user opening a form signed by your code signing cert would receive a one-time-for-all security warning. They simply get a Security Warning window, check the "Always allow" check box and click "open". This allows ALL forms you've signed to run on their computer without the users ever seeing the Security Warning window again. (Until your cert expires)

I'm sorry I can't help you with how you obtain a code signing cert, but once you get it, it is very slick.

Re: Trying to resolve 'user lookup' issue, running into security problems

bluevolume — Wed, 07 May 2008 20:58:01 GMT

Thank you for the reply. For the forms that I have already deployed, I setup a group of fields along with a data connection to a web service to provide 'lookup' functionality. A search box and a button, followed by a drop-down containing the resultant user names. When the user selects a name in the drop-down, I run another data connection query to bring back the user's full details (the first query that fills the dropdown only brings back user ID and DisplayName to improve performance).

This works OK if I only need to select users in one area of the form. But on forms where I have say a "requester" and an "approver", both selectable, I'm now building more sets of fields and data connections; becomes cumbersome quickly. And how about cases where there is a repeating "user" node, I have no solution for that, other than to have one "lookup" and use a "set" button on each row in the repeating node (very ugly).

I do not fully understand the digital certificate stuff; I definitely need more info on that. I was under the impression that we install the cert on everyone's machine and that would be it. Any future IP forms would be signed with that same cert and no warnings would come up. From the above reply, I'm guessing that I had that wrong.

Re: Trying to resolve 'user lookup' issue, running into security problems

Clay Fox — Wed, 07 May 2008 19:18:44 GMT

Yah this would be a nice to have.

We usually get around it with an employee database and then use web services to search and query it. That gets away from any trust issues and performance problems.

We also have an active directory webservice which allows you to wquery the data but not browse, you have to know whom to query.

Ideally you need your winform to run on the server and then use a webservice to connect then there would not be a client trust issue.

Full Trust is apain because each form must be signed and then installed on each PC. And then if you have to change or update it you have to repeat the whole process. So it gets to be painful to manage.

So I would look at moving the data out of an Address book or setting up a regular export so that you could have one central datasource or you need to use Visual Studio to setup full trust.

Trying to resolve 'user lookup' issue, running into security problems

bluevolume — Wed, 07 May 2008 15:08:40 GMT

I'm having a real problem with InfoPath, based around the need to be able to select users from an address book, and use that data on my form. I've gone through many different scenarios using data connections and tying them to drop-down fields, but nothing is really adequate. I find this to be a HUGE shortcoming in the product, and I'm very suprised that everyone else isn't screaming about this (I understand that this is somewhat solved in IP 2007 with a MOSS control added, but that's not an option for me). We have 3000+ users, so I am not able to just add them all to a drop-down like others have suggested.

To get past this, I decided to create an "address book" WinForm in C#. I am able to get the information I need, through an interface that is acceptable to the customer, and return that data to the correct fields in InfoPath. The problem is that once I publish this form, the WinForm is not able to run its webservice queries due to a security violation (I think its System.Web.Webpermission). Apparently this can be resolved by attaching a digital cert.

Am I going down the wrong path? Is getting the cert the right thing to do? It wouldn't be a problem to get the customer to buy it as long as the cost isn't outrageous, but at this point I'm not sure its the right solution.