SharePoint is great for 2 things: Rendering Infopath Forms and federate Identity with offshore Providers… But, it doesn't know how to do both of them very well!!

If you try to call UserProfileService.asmx web service from a claims-enable SharePoint web app, you will receive this Ugly 5566 Infopath error.

I do not understand what is going wrong, but if you look at the IIS logs, you'll see that userprofileservice.asmx is requested by a user "InfopathDA", and this call generates a 403 error (or sometime a 500 error) :

I never seen the InfopathDA account before, I'd love to know where its coming from, but I could not find any info about it. Anyway, I manage to find a Walkaround: If I can't request my Claims web Application, then all I have to do is to query a plain NTLM-based Web App, such as my Central Admin (or any WebApp).

To do this, I'll use a UCDX Data connexion file, here is How to do.

1. First, create a Data Connection Library into your site collection (Check http://msdn.microsoft.com/en-us/library/ms772101.aspx to see how), that's where you connection file will be stored.
2. From infopath, convert the Data Connection to userProfileService.asmx in a connection file inside the library you previously created (Infopath>Data connections>UserProfileService>Convert to Connection File choose a relative to site collection, and specify URL)
3. Download the UDCX file you just created, and edit it, here come the tricky part.

This file details how to query the webService. So now, you have to specify the new URL to query and account to use for this query.

Update <udc:ServiceUrl> section to target a NTLM based web app, (such as your central Administration, if you don't have any other webApp). DO NOT touch the <udc:WsdlUrl>, the only URL to update is <udc:ServiceUrl>

Right, now User Identity.

By default, there is a <udc:Authentication> section (which is commented) where you specify how to authenticate the query. Delete this section and set this authentication parameter to use a NTLM account:

    <udc:Authentication>

            <udc:UseExplicit CredentialType="NTLM">

            <udc:UserId>DOMAIN\ACCOUNT</udc:UserId>

            <udc:Password>PASSWORD</udc:Password>

            </udc:UseExplicit>

    </udc:Authentication>

UCDX can also specify a Secure Store Service Application entry, more info here: http://blogs.msdn.com/b/infopath/archive/2006/10/30/the-anatomy-of-a-udc-file.aspx

1. Upload the new UDCX file into connection library, approve IT, and update the Form Template, it should works

By default, UserProfileService return info from user that sending the query. But since we are using a data connection file, the query is not displayed as coming from current user, but coming from user defined in UDCX file. So you have to update your form, to set the AccountName parameter of GetUserProfileByName WebMethod and re-query the data source. To do this you have 2 choices depending on the version of your SharePoint farm:

• You deployed SP1+ June 2011 CU, so you can use the username() infopath function.
• You don't have SP1+ June 201 CU, so username() function do not work with claims authentication. You have to be smart to find a way to get username from a way or another. Personally, as soon as the form is open I save it in a temporary library, then I query that library to find the author of the last form, this is the current user….Actually, deploying SP1 and June 2011 CU seems to be waaaay much easier!

Figure 1: I know, I have to make an English version of this screenshot

1. Now that you set the AccountName parameter, all you have to do is to query datasource again, and you're done!!

If it doesn't work, mind to check that:

• SSL is not required to query data sources (Central Admin>General Application Settings>Configure Infopath form services)
  
• You enabled Infopath Proxy on Web application that host the Form AND the web application you query for UserProfileService.asmx(Central Admin>General Application Settings>Configure InfoPath Forms Services Web Service Proxy)
  
• The user you query has a profile in UPS (UserProfileService.asmx fails if it do not find a profile matching to this UserName)
• The webApp you are querying has not anonymous mode enabled

Feel free to comment this.

Edit. You will find a zip file that include demo form and a demo UDCX file here

Romain K