If the InfoPath documents are stored in an InfoPath forms library, the
template file (xsn) is stored in the forms subfolder. It's downloaded and
cached on your local machine, and opens in the InfoPath application on your
client. So any connections to databases are made in the security context of
your local client. Obviously this can be a problem if your systems are
distributed. What I've done is create a web service that handles all the
interactions with a single form. The form is served either from SharePoint
or directly from my web service (which can also get it from SharePoint). If
you're integrating with SharePoint, it's simplest if the web service is
hosted under the same host header as the SharePoint portal (avoiding
cross-domain data access security issues). Of course you can set a domain
policy to trust the various hosts that the form needs to interact with, or
you can make the form fully trusted.
When the form needs to interact with a data source, it does it through the
web service. All interactions with other data sources are aggregated by the
web service. The web service knows who you are (we use Windows
Authentication), and the database calls are made in the context of the
appropriate service account. Client role checking is done by the web
service. The part I like about this is you never exceed one hop that way,
the server hosting the web service has the opportunity to do server-side
validation of the data (using the schema that was created when the infopath
form was designed), and the client-side script is kept to a minimum.
In my case, the form is submitted to the web service when complete.
Depending on configuration, the web service can push the completed form to a
SharePoint forms library.
There is one other advantage to this model. In SharePoint, the security
settings aren't granular enough to accomodate the situation where you want
people to submit forms to a forms library, but not be able to read them (for
privacy reasons, perhaps). The web service checks the role of the user
(makes sure they're authorized to submit), then using a domain service
account, it PUTs the form into a forms library that a different group
(reviewers, perhaps) can access.
The combination of web services and WebDAV with InfoPath and SharePoint is
very compelling, IMHO!
Regards,
Mike Sharp
