Info Path Forms Using SharePoint Web Services Over SSL

I recently upgraded a client's MOSS 2007 farm to SharePoint Server 2010. The web application in question was using SSL. We had installed a wildcard cert and everything was working properly.

Part of the migration process included upgrading their Info Path forms to 2010 and making sure that everything worked properly. Upgrading the forms involved little more than downloading the xsn and republishing the forms to the new libraries.

One of the forms used a web service call to the User Profile Service to extract information about the currently logged in user. When I opened the form I received the following error:

You do not have permissions to access a Web service that provides data required for this form to function correctly.


Further digging in the Server Event Viewer produced the following:

An operation failed because the following certificate has validation errors:\n\nSubject Name: CN=, OU=<*****>, O=<*****>, L=<****>, S=<*******>, C=<******t>\nIssuer Name: CN=<******>, O="<*****>", C=US\nThumbprint: \n\nErrors:\n\n The root of the certificate chain is not a trusted root authority..


Further research pointed to the fact that although the SSL certificate was functioning properly in IIS, SharePoint requires that the SSL certificate be imported into the SharePoint Trusted Root Store in order for the SharePoint web services to function properly.

In short, I had to export the cert and then import it.

To export the cert, open the site in your browser, click on the lock icon to the right of the address bar, and choose "View Certificates" :

Next, select "Details" tab and choose "Copy to File". Save the file to your selected location.

Next step is to import the cert into the SharePoint Trusted Root Authority. This is done using the Power Shell script below, making sure you reference the correct cert. 

$cert = New-Object 

System.Security.Cryptography.x509Certificates.x509Certificate2("<path to cert file exported above>"); New-SPTrustedRootAuthority –Name “<pick a name for your cert>” –Certificate $cert;

Do an IIS Reset and test your form. It should be able to communicate with the SharePoint web services successfully now. 

The only gotcha I have encountered is that if there are multiple certs, or a chain of certs; you'll have to repeat this process for them all. 

The Quick and Dirty Guide to Recreating the User Profile Service

It's no secret that the User Profile Service is probably the most fragile aspect of a SharePoint Server 2010 installation. It's been my experience that you either get it right the first time - or you have a difficult road ahead of you. 

It goes without saying that when implementing the User Profile Service, you should read, re read and then follow Spencer Harbar's definitive  Rational Guide to implementing SharePoint Server 2010 User Profile Synchronization. 

However, in my work I often encounter client installations that were done improperly or the environment itself has issues. In that case I've found that it is often quicker and easier to simply delete the User Profile Service and recreate rather than attempt to troubleshoot it. 

What follows is my quick and dirty guide to deleting and recreating it. 

When deleting and recreating the User Profile Service the following steps should be performed:

• Stop the User Profile Synchronization Service from within Central Administration.

• Stop the User Profile Service within Central Administration.

• Check the Timer Jobs and make sure that the setup synchronization job is not hung. If so delete it.

• Open the MMC and add the certificates snap in as detailed here. 

• Delete all Forefront Identity management certificates you can find. They are under the Trusted Root, Trusted People and one other place. Delete them all.

• Make sure both FIM services are disabled in the services console.

• Create a new User Profile Service.

• Make sure that you create a new application pool each time you create the service!

• Make sure it is running under the farm account, and that the farm account is a member of the admin group on the server.

• Go to 'Manage Services on Server' in Central Administration.

• Start the User Profile Service in Central Administration.

• Start the User Profile synchronization service in Central Administration.

• Open the Services console and watch and see if the 2 FIM services change state. 

• Open the certificate snap in and make sure certs have been created properly.

• Wait a long time.
• When the User Profile Synchronization Service shows 'started' instead of 'starting', open the services console and make sure that both FIM services show enabled and automatic.
• Do an IIS reset.
• See if you can now open and manage the User Profile Service.