How To Troubleshoot UserProfileService Access Warning For Some Users When Using UDC

Question

Problem: Some users see a form warning on form load that calls the User Profile Service while the form works correctly for other users.

Suspected Issues:

• The users seeing the form warning must not have necessary access permission for one of the services/libraries/lists
• Cross-domain requests (form in sub site making request to another site)

Questions:What might be other ideas to troubleshoot an access warning that happens for ONLY some users when a InfoPath form is using an UDC to connect to the User Profile Service?

Setup Details:

• Admin-approved InfoPath 2010 form having Full Trust security level uploaded via Central Administration
• Data Connections now in UDC files hosted in Data Connections Library (DCL) in top-level site
• Form hosted in a sub site of the top-level site (different from DCL location)
• Users seeing the warning have Contribute permissions on the sub site, form library and DCL

Warning Messages:

Generic Form Warning: 

There has been an error while processing the form…
An error occurred while trying to connect to a Web service
An entry has been added to the Windows event log of the server.
Log ID:5566
Correlation ID:…

SharePoint Event Log Warning:

The following query failed: GetUserProfileByName (User: DOMAIN\Username,
Form Name:InfoPathFormName, IP: ,
Connection Target: http://beta/Data Connections/UserProfileByName.udcx,
Request: http://beta/_layouts/FormServer.aspx?XsnLocation=http://beta/FormServerTemplates/InfoPathFormName.xsn...,
Form ID: urn:schemas-microsoft-com:office:infopath:InfoPathFormName:-myXSD-2011-11-08T22-38-28
Type: DataAdapterException,
Exception Message: The remote server returned an error: (500) Internal Server Error.
Server was unable to process request. ---> Attempted to perform an unauthorized operation.
The remote server returned an error: (500) Internal Server Error.)

Related links I’ve considered:

Similar warning message described in these forum entries:

• UserProfile Service error in InfoPath 2010 when using SSL
• GetUserProfileByName fails for most users

Below are suggested possible causes mentioned in these forums that I’ve reviewed:

• Incorrect UDC syntax
• Change "UseFormsServiceProxy" to "true" for udc:ServiceUrl tag in the UDC file
• Inconsistent URL's for WsdlUrl and ServiceUrl
• Authentication loopback check not disabled
• Missing IIS entry in NLB nodes & host file entry referencing 127.0.0.1
• Form load inconsistency due to network latency, VPN authentication issue, service timeout
• Kerbeors and SPN name problem

Answer 1

I found that making a permissions change resolved this issue. I see that in order for a user to use a web-based InfoPath form that accesses the User Profile Service on a SharePoint site, they need at least "View Only" access. It looks like a user/group with only "Limited Access" does not have adequate permissions to consume the User Profile Service.

Permissions changes:

• Team Site:
  • WAS: Limited Access
  • NOW: Limited Access, View Only
• Form library in Team Site
  • No Change: Contribute
• Data Connections Library (In top-level Site Collection)
  • WAS: Contribute
  • NOW: View Only