InfoPath Forms Services

InfoPath Forms that utilize InfoPath Forms Services (IPFS) require the use of an IPFS Web service proxy to execute external data source Web services from claims authentication sites.

The following steps will enable InfoPath Forms Services Web service proxy in your environment.

Enable InfoPath Form Services Web Service Proxy

Via PowerShell

Start SharePoint 2010 Management Shell
Replace {WebAppURL} in the script below with the URL to the claims authentication web application
Run the script

Copy Script
Add-PsSnapin Microsoft.SharePoint.PowerShell Set-SPInfoPathWebServiceProxy -Identity {WebAppURL} -AllowWebServiceProxy $true Set-SPInfoPathWebServiceProxy -Identity {WebAppURL} -AllowForUserForms $true

Via Central Administration

Navigate to Central Administration > General Application Settings > Configure InfoPath Forms Services Web Service Proxy
- Web Application: {select the appropriate web application}
- Enable InfoPath Forms Services Web service proxy: Checked
- Enable InfoPath Forms Services Web service proxy for user forms: Checked

Register Claims Web Site Certificates

InfoPath Forms Services Web service proxy must have access to the certificates utilized by the web application using claims authentication’s web site when it is enabled for SSL.

NOTE: All the certificates in the Certification Path must be registered.

The following steps will register a certificate with one parent certificate in the certification path. Adjust the scripts based on the certification path.

Retrieve the required certificates in the DER encoded binary X.509 (CER) file format for import into SharePoint 2010. The method required to export the certificates may vary depending on environment. Steps 1 a-g will illustrate how to export the certificates for a claims authentication web site on IIS 7.
1. Start Internet Information Services (IIS) Manager
2. Select Server Certificates from the Features View
3. Select the certificate associated with the web site enabled for claims authentication and select View…
4. Select the Details tab for the certificate and click the Copy To File… button
5. The Certificate Export Wizard will start. Navigate through the wizard using the following values.
  - Export Private Key: No, do not export the private key
  - Export File Format: DER encoded binary X.509 (CER)
  - File to Export: Specify a {CertificateFilePath}
6. Once the file has been exported, select the Certification Path tab
7. Double click on any other certificates in the certification path and repeat steps 1.d and 1.e for each one.
Start SharePoint 2010 Management Console
Replace {CertificationFilePath} and {CertificationParentFilePath} in the script below with the path to the claims authentication site certificates.

Copy Script
# Register the claims site certificates for IPFS Web services proxy calls $root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("{CertificationFilePath}") New-SPTrustedRootAuthority -Name "Claims Site Certificate Parent" -Certificate $root $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("{CertificationParentFilePath}") New-SPTrustedRootAuthority -Name "Claims Site Certificate" -Certificate $cert iisreset

Copy Script

# Register the claims site certificates for IPFS Web services proxy calls
$root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("{CertificationFilePath}")
New-SPTrustedRootAuthority -Name "Claims Site Certificate Parent" -Certificate $root

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("{CertificationParentFilePath}")
New-SPTrustedRootAuthority -Name "Claims Site Certificate" -Certificate $cert

iisreset

K2 Form Client Options

InfoPath client applications cannot use a data connection (UDCX) that is configured to use the Web service proxy – this only works for IPFS forms. Unfortunately, the UDCX does not support the option to use the Web service proxy from IPFS and not use the proxy from InfoPath Client – it is locked to one or the other. Therefore, the option that K2 integration provides, which is to enable the Form Client to utilize “InfoPath, Web browser if InfoPath not available”, cannot be used for InfoPath forms on claims authentication sites. This issue has been logged with Microsoft but a resolution is outstanding.

If this option is selected, the data connection will be configured to only support InfoPath client when deploying to a claims authentication site. The form will not function properly if opened in the browser. If browser support is desired on a claims authentication site, you must select Web browser and redeploy your solution.