Skip Ribbon Commands
Skip to main content

Laura Rogers @WonderLaura

:

Quick Launch

Laura Rogers @WonderLaura > Posts > InfoPath User Roles in Browser-Based Forms- Another Way (Part 1 of 2)
Hi everyone,
My blog now has a new URL!
You can now find me at http://www.wonderlaura.com
August 08
InfoPath User Roles in Browser-Based Forms- Another Way (Part 1 of 2)

This blog post applies to both InfoPath 2007 and 2010, and both SharePoint 2007 and 2010, in MOSS and SharePoint Server 2010 (not WSS or Foundation).

There’s a concept in InfoPath called “User Roles”.  You can set up these roles, and when a person opens theimage form, the form knows if they belong to a certain role, and you can set up certain objects to hide or show in the form based on the user’s role, or switch to a view based on a role, etc.  Each role that you set up can be defined by specific user names, Active Directory groups, or a person’s name from within the form, like this:

UNFORTUNATELY, there are a couple of limitations of this functionality in InfoPath. 

  • User roles are NOT available when creating browser-based forms.  Therefore, if your form absolutely requires these, then all users who ever fill out this form will need to have the InfoPath software installed on their computers.  This is a huge limitation in a lot of cases.
  • User roles cannot be created based on SharePoint Groups, only AD groups.

 

There’s a blog post out there, that describes a a way to get around this limitation, and emulate user roles in a browser based form.  BUT this method entails manually keeping up a separate SharePoint list where you define all of the users and their roles. 

Today, I’m going to tell you about another way of using the currently logged in user’s information instead of roles, and this can be used in a browser-based form.  This can be used with SharePoint groups, where the built in user roles cannot.  The trick is a built in SharePoint web service called the user profile service.  Lori Gowin blogged a while back about how to use this web service in order to auto-populate text boxes in any SharePoint form, with information about the current logged in user.  My method entails using that same web service.  Clarification: This doesn’t refer to ANY SharePoint group, this is only the “members” group that exists on each SharePoint site.  There is another web service that can be used, UserGroup.asmx, in order to get the info about SharePoint groups in general, on a site.

There are a couple of very useful operations in the UserProfileService.asmx web service, so I’ll show you a couple of options (2 parts to this blog).  In this example, you have a change request form.  Site visitors fill out the form, and after they’ve filled it out, people in the IT department will have additional fields to fill in.  We don’t want non-IT staff to see these additional fields, though.  We will create another view in the form.  This view will contain all of the original fields that were filled in by the originator, plus the additional IT fields.  When the form is opened, we want it to automatically switch to this IT view when the logged in user is an IT person.  The prerequisite is that there is a SharePoint group on your site called IT Group, and you are a member of it.  Also, you’ll need a form with 2 views, one of them called IT Dept.

  1. Create a new data connection in the InfoPath form, to receive data.  The source is a web service.  (In SharePoint 2010, pick SOAP web service.)  Click NEXT.
  2. Type the URL of the userprofileservice.asmx file.  This is at the root of your SharePoint site, under the _vti_bin folder.  Click Next.
    image
  3. For the operation, click GetUserMemberships, and click NEXT.
    image
  4. On the Parameter screen, just leave the default and click NEXT.
  5. Leave “store a copy of the data…” unchecked, and click NEXT.
  6. Leave “Automatically retrieve data when form is opened CHECKED, and click FINISH.
  7. Now, when someone opens my form, I want the form to automatically switch to the IT view if the user is in a SharePoint group called “IT Group”. 
    • In InfoPath 2010, click the Data tab in the ribbon, and click the Form Load button, which will bring up the Rules pane on the right.
    • In InfoPath 2007, click the Tools menu and choose Form Options.  Click the Rules button on the Open and Save section.
  8. Define the rule as so:
    The condition is: Click the first drop-down box (the field name).  Click “Select Field or Group”.  In the drop-down for the data source, select GetUserMemberships, which was the first data connection that you created.  Expand several levels and select the DisplayName field.  Click OK.
    image
  9. For the value, click “type text” and type IT Group, as so.  Click OK.
    image
  10. Click to add the Action.  The action will be just to switch views.
    image
  11. The action is just to switch views, so you’re done with the form open rules now.
  12. Now try it out.  Publish the form.  If you’re a member of the IT Group (SharePoint group), the form will now automatically switch to the IT Dept view when it opens.

 

 

 

 

 

 

Stay tuned for part 2 of this blog post, for another way to go about accomplishing something similar with this same web service.

Testing:  This GetUserMemberships operation returns a list of all groups that the current user is a member of, SharePoint and Active Directory.  In order to see exactly what is returned from this operation, here’s how you can do this.  In the data source pane on the right side of InfoPath, click the Main drop-down box at the top of it and change the data source to GetUserMemberships.  This will show all the fields.  Expand several levels until you get to the one called MembershipData.  Drag this whole group of fields onto your form, as a repeating table.  Preview your form.  This will show you a list of all the groups that you are a member of.  You may need to increase the width of the Display name field, so that you can see all the values.  You’ll also notice that there is a field called Source that shows whether each one is a SharePoint group (“SharePointSite”) or a Distribution list.

Comments

Bil Simser

Clayton Cobb actually blogged about this exact thing last year:   http://claytoncobb.wordpress.com/2009/07/19/infopath-user-roles-in-browser-enabled-forms-using-groups/   Maybe he had the same dream as you?
Shane YoungNo presence information on 8/8/2010 1:29 PM

Cole Shiflett

Great post, Laura.   I blogged on a similar topic for InfoPath 2007.  Perhaps it will be helpful to someone.  http://coleshiflett.wordpress.com/2010/04/26/using-the-usergroup-web-service-and-infopath-2007/
Shane YoungNo presence information on 8/9/2010 6:49 AM

Andrius Mazeika

Laura,  thanks for sharing this. It looks like it might help solve some of my problems with regards to protecting some of the fields depending on which groups user belongs to.  However, when setting this up I ran into a problem. GetUserMemberships method returns the list of sites that the user is a member of. What I need is for the web service to return the list of SharePoint groups that the user is a member of on this Site Collection (or site). Is there a way to do that? I tried using the UserGroup.asmx, but no luck.
Shane YoungNo presence information on 8/10/2010 10:04 AM

patenik2@yahoo.com

Does this really work with the SharePoint Security Groups in the SharePoint 2010? I have followed your steps but it doesn't seem like working at all...
Shane YoungNo presence information on 9/15/2010 1:33 PM

Nik Patel

Does User Profile Sync Service needs to run to use this in SharePoint 2010? Or, should User Profile Service would be enough?
Shane YoungNo presence information on 9/16/2010 9:38 AM

Beth

I don't understand whta you mean by Clarification: This doesn’t refer to ANY SharePoint group, this is only the “members” group that exists on each SharePoint site. I created a group called "Legal" instead of "IT" and gave them the Contribute permission level. I also have the default "Demo Members" group that was created when the site was created. So will this process not work if I'm using both groups?
Shane YoungNo presence information on 9/22/2010 9:37 PM

Paul

I keep getting 500 internal server error.  I tried to put this in the data connection in CA but sill no luck.  I have a large farm but can't figure out why it won't work. Works in INFO Path Client
Shane YoungNo presence information on 10/7/2010 1:55 PM

Laura

Beth, This method will only work with that "members" group (yours is called Demo Members).  Paul, Could be that your firewall doesn't like the web service call.  Not sure.
Laura RogersNo presence information on 2/22/2011 10:55 AM

dslay@comframe.com

I foloowed these steps and I am not getting any returned results from the service.  Any ideas why nothing is coming back?
Shane YoungNo presence information on 2/22/2011 11:40 AM

Laura

Hey Doug, Not sure, it could be a network or firewall issue.  See if you get to this URL directly on the server, and then try it on your client machine and see if there's a difference? http://yoursiteurl/_vti_bin/userprofileservice.asmx
Laura RogersNo presence information on 2/22/2011 8:21 PM

cally

hi Laura  I tried the above, but I am getting the error 5566..  any idea..why..
Shane YoungNo presence information on 6/13/2011 7:54 AM

Joey Ridley

I do not get the option to change views in the drop down.
Shane YoungNo presence information on 6/15/2011 10:12 AM

Aaron Hamilton

Thanks for this post--very helpful, but I do have a question:   Managers are both approvers AND claimants. How will the form know which view to display?   Idea: perhaps the rule should also check for the status of the workflow? If it's waiting for approval, then show the approval view.  P.S. I'm using SharePoint 2010 / InfoPath 2010
Shane YoungNo presence information on 6/21/2011 10:31 AM

Laura

Cally, I don't know what that error is.  Joey, What step are you on, did you already create multiple views, and what version of infopath are you using?  Aaron, Sure, there is an endless plethora of different ways to go about this.  Good idea!
Laura RogersNo presence information on 6/22/2011 1:36 PM

spoorthi

laura, Thanks for the article.In this you have mentioned that it will work only for "members" group and also you mentioned that   there is a SharePoint group called IT Group.so the users have to added to both of the groups? 
Shane YoungNo presence information on 7/8/2011 5:03 PM

N03L

Hi Laura. Long time listener first time caller!!!  I've implemented this and I get everything. It's quite easy really but; as the SharePoint admin with membership of a number of SP groups and a rediculous number of DL's in AD, when I drag the 'MembershipData' group onto my form to view the resulting memberships, I only see one. Any ideas? I did this because the girls that need the view switching to be automated see the same as everyone else and they're the only members of the DL that I've used in my 'Form Load' condition...  Thanks in advance. (You're cool)
Shane YoungNo presence information on 7/15/2011 10:41 AM

Laura

Hi No3L, You're probably seeing this behavior because it's looking to see if you're in the "members" group in any sites.  Since you're the admin, you probably have full control of most everything, so you're not in most "members" groups.
Laura RogersNo presence information on 7/22/2011 9:10 PM

Kizzie

Hi Laura, i am trying in vain to get this to work on the site, but cant.  I have an infopath form, with several views, I have a test user as a member in a SP group called "group a". I have set up the infopath form to switch to one of the views when a person in "group a" views the form, but the view is not changing, its still showing the default view, not the view I requested and furthermore when that person opens the form they get a drop down to change to any view they want (which I dont want). can you help. I notice when i try to use your "Test" option, i dont get anything returned at all Please Help!
Shane YoungNo presence information on 8/22/2011 1:17 PM

Himanshu

i want to know that how can i enable the "User Role" button on the infopath 2010 ribbon under "Data" Tab.
Shane YoungNo presence information on 8/23/2011 11:20 PM

Debraj

Can we have more than one member group in the same site collection. I have a requirement where we need to have 3 views of the same form for differenet deparments. How to create separate member groups for each of the so that the getUserMemberships web method returns the correct groups in te respective cases?
Shane YoungNo presence information on 8/27/2011 11:31 AM

Laura

Kizzie, It has to be the members group on the site, and there is only one members group. In sp2010, there's actually an option to "set as default group", which will let you pick a specific group to be the members group.  Himanshu, This setting is disabled in browser-based forms.  Debraj, Yes, each site can have a member group. Per site, not per site collection.  I recommend using the Department field that already exists in the user profile.  You can use the userprofileservice.asmx and pick the get user profile by name operation.   then you'll be able to look at the department field of the currently logged in user, and not have to worry about sharepoint groups.
Laura RogersNo presence information on 9/3/2011 8:04 PM

Aleds

Hi Laura.  I use the getuserprofilebyname.asmx but i obtain the sharepoint site name. I want to obtain the active directory group name from the user logged on.  Any idea??  Greetings and thanks for your help
Shane YoungNo presence information on 9/21/2011 12:06 PM

WebDBApps

Thanks for this blog post.  I want to implement it, but we have AD setup on our domain controller, and are using SP2010 on a virtualized server separate from the DC.  Can this approach be used?  That is, can the AD groups from the domain controller be "seen" by SP2010?
Shane YoungNo presence information on 10/26/2011 6:02 PM

jenny

hi, i am getting error "  An error occurred accessing a data source.  An entry has been added to the Windows event log of the server.  Log ID:5566 " any idea how to resolve?
Shane YoungNo presence information on 11/8/2011 1:17 AM

Laura

Aleds, That's an awesome idea, but I don't know of any way to do that. WebDBApps, I don't know as much about troubleshooting that end of it, such as the communications between servers.  www.toddklindt.com may be a better person to ask that. Jenny, Can you access it via your: http://yoursiteurl/_vti_bin/userprofileservice.asmx ? There are many many reasons why your InfoPath may not see the ups data.  One I've seen recently was that anonymous authentication was enabled on the web app.
Laura RogersNo presence information on 11/11/2011 7:30 PM

Beau Cameron

How will this work with permissions? I'm pretty new to infopath, but wouldn't the form need to run at Full-Trust for the webservice to run no matter the user opening the form? You can't run Browser based forms, full trust can you?
Shane YoungNo presence information on 12/8/2011 8:41 AM

Beau Cameron

Aleds & Laura... Here is a post by clayton, about leveraging AD groups in browser based forms. I haven't tried it out, but maybe this would help.  http://claytoncobb.wordpress.com/2009/07/19/infopath-user-roles-in-browser-enabled-forms-using-groups/
Shane YoungNo presence information on 12/9/2011 9:22 AM

Laura

Beau, Thanks, that link is also in the very first comment in this blog.  I've never gotten that method to work, though.
Laura RogersNo presence information on 12/19/2011 10:01 AM

DaveJ

Hi guys
I have the same problem as Joey. The pull down for Add actions in the Rules is missing Switch Views option although I have created 2 views in my form. I'm using InfoPath 2010.
 on 3/22/2012 9:34 PM

Clayton Cobb

DaveJ, where are you trying to add the switch view action?  It can only be done in Form Load rules or in a button.  It can't be done on a regular field.

Beau, it isn't related to permissions.  Full Trust is not needed.  Yes, you can create Full Trust browser forms.

Btw, everyone, this method (and mine) does not work for AD Security Groups in SharePoint 2010.  I have a huge thread on the MSDN forums explaining why, and I have it submitted as a change request to Microsoft, which they acknowledge and will be doing.  Until then, AD SGs do not show up in the UserProfileService.asmx, though Distribution Lists do work.
 on 4/12/2012 6:52 PM

Benjoe

I am following the above for an urgent project I am working on  using SharePoint 2010. Data-->Form Load. I set rules but switching is not working. My form is a browser based form. Any help Please
 on 4/30/2012 12:15 PM

Laura

Benjoe,
For troubleshooting, go to the Fields pane, take that whole membership table from step 8 and drag it onto the form.  That way you can see exactly what the data is.  If your view is not switching, then most likely your condition is not being met.  I recommend troubleshooting the condition itself and taking a look at the values that it is comparing to make sure they do in fact match.
lauraNo presence information on 5/3/2012 10:39 PM

Milissa

Laura, I've followed your steps and to troubleshoot, I dragged in the MembershipData as a repeating table at the bottom of my form.  The Display Name column doesn't show the name of the membership group, instead it shows the site name.  In face, logged in as someone who should have very limited access, my list still shows a long list of sites that this user does not have access to.  Any ideas?
 on 5/23/2012 4:28 PM

Laura

Milissa,
Unfortunately, this solution appears to work differently in each different client environment that I work in.  I guess it's not the most reliable solution, which is frustrating.
lauraNo presence information on 6/13/2012 10:33 PM
​I have disabled any new comments on this, because my blog has moved to a new site.  Please go here: http://www.wonderlaura.com
RSS FeedFacebookYouTube
 

 Our Books for End Users