Anonymous Access users can't submit InfoPath 2010 form to Form Library

Question

We have a public-facing SharePoint 2010 Enterprise server hosting a Publishing Portal site running InfoPath Forms Services. We have an InfoPath Form on the server which submits to a Form Library. This works fine for logged on users, but doesn't work for anonymous access users; they can view the Form but can't submit it.

So far we have:

• Checked that Anonymous User Access is enabled on both the Farm and SiteCollection.
• Disabled Lockdown Mode.
• Changed the permissions policies of the Web Application to remove "No Write" for Anonymous Access.
• Broken inheritance and set the permissions of the Form Library so that Anonymous User Access can View (the options for them to Add, Edit and Delete were greyed out).
• Tried this hack to allow us to set the permissions so that Anonymous User Access can Add to the Form Library.
• Tried creating it as an InfoPath Library Form and publish it as a content type instead as described in another answer on this site.

Using Fiddler to sniff the http traffic we can see that the POST to /_layouts/Postback.FormServer.aspx is working OK (getting a 200 response).

We are however getting a message appear in the browser saying "The form cannot be submitted to the specified SharePoint list or document library. The SharePoint location may be read-only or you may not have permissions to access it."

We have seen a few possible solutions which suggest using custom .NET code to perform the submit either by running with elevated privileges or as a submission via a web service, but we are hoping to avoid that extra work.

What are we doing wrong? Any help greatly appreciated.

Answer 1

I know you have followed some of these steps but have you seen this post. http://claytoncobb.wordpress.com/2011/06/03/infopath-allowing-anonymous-users-to-submit-forms-in-sharepoint-2010/ I think the key here may be allowing anonymous access on the site and not just the libraries/lists, maybe you have already done this.

Answer 2

In the end we had to recreate the InfoPath forms from a SharePoint List and write a custom event receiver to run the workflow (send an email) upon creation of a new list item. This allowed us to have ViewFormPagesLockdown turned on and anonymous users still submit InfoPath forms. We'd really hoped to avoid the custom code in this. Seems like InfoPath isn't the right tool for us to use for public facing forms.

Answer 3

I see you broke inheritance on the list and allowed Anonymous Users to "view" the form & list, but you also need to give them "add" permissions so they may add an item to the list, via the form. Lockdown mode will also need to be disabled.

Answer 4

In my experience, there is no way to do this out of the box. If it were possible to open enough access (which I'm pretty sure the FormServer.aspx will disallow writing to a library anonymously anyway), it would be a huge security hole. Why? Anything could be added to the library anonymously. Script files, aspx pages, html pages, etc.

What are the alternatives then?

1. Have the form send an email to an internal user or mailbox.
2. Create a custom web-service which parses the values you need out of the form submission and then elevates privelege to add a list item to your public (or a different internal) SharePoint site.
3. Create a custom web-service which parses the values you need out of the form submission and then submits it to a database which can be read by internal users.

Answer 5

I've done this, except with the additional restriction that the site was externally hosted (very limited access for farm solutions), and although anon users were able to submit forms, they would have no access to the list once a form was submitted.

The solution was to leave all the site permissions alone - you don't want anon users having any access to forms etc. Modify the form code to run with elevated privileges for the submit. The form needs to be published (as it's a wsp effectively and can't run the sandbox). Notes are at http://mgreasly.wordpress.com/2012/02/06/anon-infopath-forms/.