Data sources for apps in managed spaces

Managed spaces provide governed access to apps in Qlik Cloud Analytics. Apps published to a managed space keep the data loaded in the app, but do not include their data files or data connections. This enables the use of mock data in app development that is replaced with real data when the app is published without changing the load script.

Apps do not include their data sources when they are published to a managed space. The app load script remains unchanged, however. By using space-aware data sources in your load script, development data sources in personal or shared spaces can be replaced with the final data sources when the app is added to the managed space. This helps keep strict data governance for apps and their users in managed spaces.

Space-aware data sources syntax enables you to specify in the load script that the data sources exist in the current space, rather than in a specific space. The app will always look in the current space for the data sources. By using mock data sets and real data sets with the same name, published apps can seamlessly switch to the final data sources.

Space-aware data source syntax examples

This example loads the file orders.csv from the current space. If the app is moved to another space, for example, it will use the file orders.csv in the new space.

LOAD * FROM [lib://:DataFiles/orders.csv];

This example loads the table Sales_data from the DataSource data connection in the current space.

LIB CONNECT TO ':DataSource';
LOAD *;
SQL SELECT * FROM `Sales_data`;

For more information using space-aware data sources, see:

• Connect to data sources in load scripts
• Adding data from uploaded data files
• Loading data from files

Best practice workflow for governed apps and data

The following is an example best practice workflow for governed apps and data sources in managed spaces.

Mock data sources are created that share the same names as the real data sources that will be used in the managed space. These mock data sources are added to a shared space where app developers have Can manage, Can edit, or Can edit data in apps permissions. Developers reference these data sources in the load script so that the load script looks for the data sources in the current space. When the apps are ready, the app is published to the managed space, where the managed space administrator adds the real data sources. This populates the apps with sensitive data while preventing the app developers from seeing any sensitive information.

This workflow involves three primary users:

• Tenant administrator: The tenant administrator creates the managed space and then assigns users and roles to the managed space.
• Governed Manager: The user in charge of managing access to sensitive data and administering the managed spaces
• Developer: The user in change of developing apps for the managed space and publishing them to the space.

This workflow occurs in four steps:

1. Create the spaces.
2. Add mock data and develop the app.
3. Publish apps to managed space containing real data.
4. Adding app consumers to the managed space.

Creating managed space and shared spaces

First, the spaces are created and then users are added to them.

Do the following:

1. The tenant administrator creates a managed space, Secure Apps, as the destination for published governed apps.

2. The tenant administrator adds two members to Secure Apps:

   • The lead app developer, Developer, is added with Can publish permission.
   • The owner of the governed apps, Governed Manager, is made the space owner.
3. Developer creates the Develop Apps shared space for the development of the governed apps. Optionally, additional developers are added with Can edit and Can edit data in apps roles.

Developing apps with mock data

Next, mock data is added and the app is developed.

Do the following:

1. Developer adds mock testing data to the Develop Apps space. This data can be used once or in continuous deployment scenarios.

   Data can be made available to a space by adding an app and then adding the data source to the app. Once a data source has been added to an app in the space, it is available to all users with Can edit and Can edit data in apps roles in the space.

   Information noteUsers with Can consume data can also view the data sources, and they can consume the data where they have permission to create apps. They cannot add, edit, or delete data sources. They have no permissions to view, add, edit, or delete apps.
   

2. Developer develops apps in the Develop Apps space. These apps use space-aware scripting to always look for the data sources in the current space.

   For space-aware connection syntax in Data load editor, see Connect to data sources in load scripts.

   If Developer uses Data manager, they unlock the load script for editing and update the data source references to use space-aware connection syntax.

Publishing apps and adding final data

The app is published to the managed space. The real data sources are added to the managed space.

Do the following:

1. When the app is ready for release, Governed Manager adds production data to the Secure Apps space.
2. Developer publishes the app from Develop Apps to Secure Apps.
3. Governed Manager schedules reloads for the app and confirms the app can reload data without errors.

Adding app consumers to the managed space

Finally, the app consumers are added to the managed space.

Do the following:

1. Governed Manager adds Can view members to the Secure Apps managed space. These users will be able to open and create private bookmarks, snapshots and stories.
2. Governed Manager adds Can contribute members to the Secure Apps managed space. These users will be able to additionally create community sheets, stories & bookmarks, and publish community sheets in the published app.