Plan for user form templates (SharePoint Server 2010)

Article
10/18/2016

Applies to: SharePoint Server 2010

This article describes the settings that are specific to user form templates and help you plan which InfoPath Forms Services features to enable for user form templates.

The Sandbox Solution framework provides a mechanism for executing user-provided code outside of the IIS worker process. The Sandbox Solution framework should not be used as a mechanism for enforcing security boundaries when executing user code. Sandbox Solutions are not supported as a security boundary with user code, especially code of unknown origin. We advise against executing Sandbox Solutions of unknown origins.

In this article:

About user form templates
Browser-enabled user forms
Plan external data access
Data connection library

About user form templates

Form templates can be divided into three categories depending on how they are deployed: user form templates, administrator-approved templates, and form templates as sandboxed solutions. User form templates are form templates that are deployed by a non-administrator, for example, a form designer. They can be deployed by any user who has the Design permission-level on the site. User form templates can be published to a list or a form library.

Administrator-approved form templates are form templates that must be deployed by a farm administrator. Administrator-approved form templates may contain code or business logic that requires additional permission levels. In order for an administrator-approved form template to be available widely, it must be uploaded to the Central Administration site by a farm administrator and then activated by a site collection administrator.

Form templates as sandboxed solutions are form templates that have code and that are published to form libraries as sandboxed solutions. This lets a form designer who is a site collection administrator publish forms without requiring farm administrator approval. The sandboxed solutions run in an environment that has access to a subset of the server object model. A farm administrator can set usage limits to protect the server from malicious code. For more information about sandboxed solutions, see Sandboxed solutions planning (SharePoint Server 2010) and Enable sandboxed solutions on the farm (SharePoint Server 2010).

For more information about forms and form templates, see About forms in SharePoint Server 2010.

Browser-enabled user form templates

By default, when form designers create a form template, the form template is browser-enabled so that users can fill it out in a Web browser. This enables users to fill out the forms when they do not have Microsoft InfoPath Filler 2010 installed on their computers. You must decide the following:

Note

These settings apply only to user form templates that are published to form libraries. Workflow form templates and list form templates are not affected.

Do you want to allow users to publish browser-enabled user form templates? You can decide whether to allow form designers to publish browser-enabled form templates to the SharePoint Server farm. If form designers cannot publish browser-enabled form templates, they must ask farm administrators to publish any browser-enabled form templates for them. Restricting the ability to publish Web browser forms to administrators gives you tighter control over the availability of Web browser forms.
Do you want to render browser-enabled user form templates? You can decide whether users can use a Web browser to fill out browser-enabled user forms. If you decide not to render browser-enabled user form templates, the forms will open in InfoPath Filler 2010 if InfoPath is installed on the user's computer.

By default, browser-enabled user form templates are published and rendered. For more information about how to change these settings, see the Configure browser-enabled user form templates section in "Configure InfoPath Forms Services".

Plan external data access

A user form template can access data from external sources such as a database, a Web service, or a SharePoint list. This section summarizes the settings that affect external data access that you must consider when you plan to deploy user form templates.

Cross-domain access
InfoPath Forms Services Web service proxy
Authentication information in data connection files

Cross-domain access

By default, user form templates cannot make cross-domain connections. That is, any external data connections must reside within the same domain as the SharePoint Server farm where the user form template is published. If you have user form templates that must access data that is in a different domain, you can enable cross-domain access for user form templates.

For more information about how to change the cross-domain access setting, see the Configure authentication and data connection settings for InfoPath Forms Services section in "Configure InfoPath Forms Services".

InfoPath Forms Services Web service proxy

Form templates can use the InfoPath Forms Services Web service proxy to connect to a Web service. The InfoPath Forms Services Web service proxy forwards SOAP requests to a Web service to enable authorization. The InfoPath Forms Services Web service proxy uses a Secure Store Service application ID that is contained in a data connection file for authentication. Using the InfoPath Forms Services Web service proxy makes possible the following two scenarios that are not otherwise achievable with forms that are running in a Web browser:

Authentication to a Web service on a third tier when Windows NTLM authentication would typically prevent re-use of user credentials.
Symmetrical authentication between a form in InfoPath Filler and the same form that is running in a Web browser.

By default, user form templates cannot use the InfoPath Forms Services Web service proxy. For more information about how to enable user form templates to use the InfoPath Forms Services Web service proxy, see Configure Web service proxy for InfoPath Forms Services (SharePoint Server 2010).

Authentication information in data connection files

Form templates can use data connection (.udcx) files to specify data connection settings for forms. A data connection is a dynamic link between a form template and a data source that stores or provides data for the form template. Data connection files can include alternate authentication information such as a Secure Store Service application ID. By default, user form templates cannot use authentication information in a data connection file. You must enable user form templates to use authentication information in data connection files if you have the following scenarios:

You want user form templates to be able to use the InfoPath Forms Services Web service proxy for authentication.
You have Web browser user forms that require multi-tier authentication. For example, if you have a Web browser user form that has to access a database server, you may encounter multi-tier authentication problems. In this scenario, a user's Windows credentials would have to be passed from the Web browser to the server that InfoPath Forms Services is running on and then to the database server. This kind of delegation is not allowed in the NTLM authentication system that is used by Microsoft Windows. Multi-tier authentication problems occur more frequently with Web browser forms because forms that are opened in InfoPath Filler can authenticate directly with the data source.

By default, user form templates cannot use authentication information in a data connection file. For more information about how to change this setting, see the Configure authentication and data connection settings for InfoPath Forms Services section in "Configure InfoPath Forms Services".

Data connection library

SharePoint Server provides a centrally managed data connection library that enables farm administrators to manage the data connection files that are used by administrator-approved form templates. You should consider creating a data connection library that can be used by user form templates. A data connection library is a specific kind of library that is used to store data connection files.

A data connection library provides the following benefits:

Connection settings can be shared across multiple forms and multiple forms designers.
If a data connection setting has to be changed, you can update the data connection file without modifying the form templates that use that data connection file.
By default, approval is required before a data connection file can be used by everyone. This enables the site collection administrator (and any designated approvers) to control the kinds of connections to allow.

To effectively plan for a data connection library, consider the following:

How many data connection libraries do you need? The files in the data connection library can be used by forms and form templates that are in the same site collection as the data connection library.
Who should be able to upload data connection files? Users with the Contributor permission-level can upload data connection files to the library.
Who should be able to approve the data connection files? When a data connection file is uploaded, the owner of the file can use the file. However, approval is required before the data connection file can be used by anyone else. Users with the Design permission-level can approve data connection files.

For more information about data connection libraries, see How to: Create and Use a Data Connection Library (https://go.microsoft.com/fwlink/p/?LinkId=188117).