How To: Check if a user is part of a SharePoint group in InfoPath

Earlier this week a colleague sent out an email with the following problem:

“My client wants to hide certain fields and sections in an InfoPath form if a user is not part of a specific SharePoint group. The InfoPath form should not use code as the client declines solutions with code behind.”

This email got send around and a couple of people replied that custom code in form of a web service will need to be used. Not quite what my colleague’s client wanted.

One of the responses was to use the GetUserCollectionFromGroup method from the UserGroup web service (one of SharePoint’s out of the box web services), wrap it in a custom web service and verify the group membership in the custom web service. The reason for this suggestion was that the returned result set in InfoPath doesn’t get interpreted correctly. It basically can’t be used and the custom web service can be used to transform the results and do the verification within the web service.

I am a BIG fan of SharePoint’s out of the box web services and I was sure that the web service still can be used to get users of a certain SharePoint group. This could then be used to determine if the user is part of the group. My first thought was to save the InfoPath form as source files and modify the XML schema of that web service somehow. A bit of googeling later I had a solution ready to go thanks to Ian’s Blog entry here. It describes exactly what needs to be modified in the XML schema. Great post! And here is my solution with Ian’s help:

• First we design a new InfoPath form (I am using InfoPath 2010 and I recommend you do the same…it is just so much better than InfoPath 2007 J)
  
• Create two text fields:
  
  • CurrentUserAccountName
    
  • IsGroupMember
    

    
    

• Next we will create a data source to get the account name of the user that opens the form. We will utilise the SharePoint UserProfileService web service:
  
  • Click on Data Connections under the Data tab and select Add
    
  • Create a new connection to receive data
    
  • Select the SOAP Web service option
    
  • For the location  of the web service type: http://[YourServerURL]/_vti_bin/UserProfileService.asmx
    
  • Select the GetUserProfileByName method and click Next
    
  • Use the default settings in the next screen and click Next again
    
  • Click Next
    
  • Use the default settings, click Finish and close the dialog window
    
• Right click the CurrentUserAccountName field and select Properties:
  
  • In the property window select the formula button for the default value
    
  • Select Insert Group or Field
    
  • From the drop down select the GetUserProfileByName data source
    
  • Expand the dataFields group as shown in the screenshot and select Value
    

    
    

  • Select Filter Data and add a new filter
    
  • In the first drop down select “Select a field or group”
    
  • Select the “Name” field as shown in the screenshot
    

    
    

  • Back in the filter conditions dialog select “Type text” in the third drop down and type AccountName
    

At this stage the form queries the current user’s account name and stores it in the CurrenUserAccountName field on form open. Next we will query the UserGroup web service to get us a list of users in a specific SharePoint group:

• The UserGroup web service contains a method “GetUserCollectionFromGroup” which we will use in our setup:
  
  • Click on Data Connections under the Data tab and select Add
    
  • Create a new connection to receive data
    
  • Select the SOAP Web service option
    
  • For the location  of the web service type: http://[YourServerURL]/_vti_bin/UserGroup.asmx
    
  • Select the GetUserCollectionFromGroup method and click Next
    
  • In the next screen select Set Sample Value and provide InfoPath with the name of the group you want to query (e.g. if your user is in a SharePoint group “Test” put in “Test“)
    
  • Click Next
    
  • Provide InfoPath with the same group name in the next screen and click Next again
    
  • Click Next
    
  • Use the default settings, click Finish and close the dialog window
    

Now the tricky part. We need to save our form and then use the Export Source Files option under “Publish“.

Once that is done, close the form and navigate to the location where you exported your form to. There should be at least one file named “GetUserCollectionFromGroup.xsd“. (In case there are more, use the largest one) This file defines the XML schema. Open the file in a text editor and copy the below into the file. (These steps can be found in Ian’s blog. Thanks again!) Just insert the code within the comments.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

<schema elementformdefault="qualified" targetnamespace="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/" xmlns:s="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/" xmlns:tns="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"> <complextype name="GetUserCollectionFromGroupType"> <sequence> <element maxoccurs="1" minoccurs="0" name="Users"> <complextype> <sequence> <element maxoccurs="unbounded" name="User"> <complextype> <attribute name="Notes" type="s:string"></attribute> <attribute name="Name" type="s:string"></attribute> <attribute name="IsSiteAdmin" type="s:string"></attribute> <attribute name="Sid" type="s:string"></attribute> <attribute name="ID" type="s:string"></attribute> <attribute name="LoginName" type="s:string"></attribute> <attribute name="Email" type="s:string"></attribute> <attribute name="IsDomainGroup" type="s:string"></attribute> </complextype> </element> </sequence> </complextype> </element> </sequence> </complextype> <element name="GetUserCollectionFromSite"> <complextype></complextype> </element> </schema>

Also replace this

1 2 3 4 5 6 7

<s:element name="GetUserCollectionFromGroup"> <s:complexType> <s:sequence> <s:element minOccurs="0" maxOccurs="1" name="groupName" type="s:string"></s:element> </s:sequence> </s:complexType> </s:element>

with this:

1	<s:element name=“GetUserCollectionFromGroup” type=“tns:GetUserCollectionFromGroupType” />

We are almost there J Now save the file and open the manifest.xsf by right clicking it and select Design.

If you have a look at your GetUserCollectionFromGroup data source and its fields, you will notice that it has changed from this:

to this:

Now the last thing we need to do is setup the IsGroupMember field. We want it to return a 1 if the user is in the group and a 0 if the user is not in the group.

• Right click the IsGroupMember field and select Properties:
  
  • In the property window select the formula button for the default value
    
  • Select Insert Function
    
  • Select the Count function
    
  • Double click “Double click to insert field”
    
  • Select the GetUserCollectionFromGroup data source
    
  • Expand the dataFields group and select “LoginName”
    
  • Select Filter Data and add a new filter
    
  • Leave the first drop down as is (It should show “LoginName“)
    
  • Select “Select a field or group” in the third drop down
    
  • Select the “Main” data source
    
  • Select the “CurrentUserAccountName” field
    
  • Confirm all open windows by clicking on “OK”
    

We are done. You can now use the “IsGroupMember” field to hide and show different sections and fields in your form based on if the user is a member of the configured SharePoint group.

One thing to be aware of though is, that whenever you change the “GetUserCollectionFromGroup” data source, you will need to go through the setup process again for this data source.

Happy InfoPath-ing

*****UPDATE*****
Thanks to Phillip for the hint. Apparently you have to make sure that all users have read permissions to the SharePoint group you want to check. Otherwise it will come up with the common 5566 error that indicates that there are problems accessing the datasource. To give users read permissions on the group follow the steps below:

1. Go to Site Actions -> Site Settings -> People and Groups
2. Click on the “Groups” heading on the left
3. Locate the group your users need to have read access to
4. Click on the Edit button next to it
5. Make sure that in the Group Settings section of the following page, for the first question (“Who can view the membership of the group?”) the option “Everyone” is selected
6. Click OK

Thanks again to Phillip for pointing this out! Much appreciated.