In-platform consumer applications

Workshop, Slate, and Carbon applications can all be configured as consumer applications with restricted platform access. These applications enable fast iteration on custom applications, allowing you to deploy to customers with minimal maintenance burden.

This guide will focus on Workshop applications that are ideal for the following use cases:

• Rapid application development with a low-code building experience.
• Interactive data applications requiring rich user interfaces.
• Dashboards and analytics with complex visualizations.
• Decision support tools that combine data analysis with actions.

All in-platform applications use the interactive login flow, which can be configured to automatically redirect to configured identity providers. This provides a seamless authentication experience for consumer users. See the default authentication provider setup for configuration details.

Prerequisites

This guide requires experience with building applications in Workshop. Before publishing a in-platform application for consumer mode, ensure that you have completed the configuration of consumer mode in Foundry.

Setup

There are two approaches for deploying consumer products:

1. [Recommended] Use Marketplace, and create separate environments to isolate building and testing from production.
2. Build and edit products directly in the consumer space.

In this, guide we will buld and edit products directly in the consumer space. However, we recommend using release management for a more robust release management process. Review our DevOps release management documentation for more information.

Step 1: Build a consumer application

1. Create a project from a template: Use the consumer project template to create a new project. Ensure that proper role assignments are applied automatically.
2. Configure object types and actions:
   • Create object types with consumer-appropriate properties.
   • Configure actions with minimal required permissions.
   • Set up data sources with proper consumer access controls.
3. Develop a Workshop application: Create a new Workshop application in the project using the configured objects and actions.

Step 2: Configure a consumer home page

1. Navigate to Control Panel > Platform experience.
2. Select your consumer organization.
3. View the Default application for your consumer.
4. Configure the Home page URL to direct users to the application.

Step 3: Configure permissions

1. Add a consumer organization to the project: Navigate to your consumer project. From the Accesstab of the right side panel, add a consumer organization with the Consumer role.
2. Configure backing dataset permissions: For each backing dataset of the object types used in your consumer application, perform the following:
   • Add the consumer organization to the dataset's project permissions.
   • If the backing dataset is not located in the consumer space, move it to a project in the consumer space.
   • Configure row-level security using restricted views if needed, then update the object configuration to use the restricted view.
3. Configure ontology permissions: Wrap functions in actions to make them easier to permission. For all actions used in the application, add the consumer organization group to the action submission criteria.

Validate consumer user experience

After deploying your application, validate the consumer user experience with the following steps.

1. Test consumer user login: Log in using a test consumer account.
2. Verify automatic redirect: Confirm that users are directed to the correct application after login.
3. Check application functionality: Ensure that all features work correctly.
4. Test permission boundaries: Verify that consumer users cannot access internal resources.
5. Validate data access: Confirm that users can only see the appropriate data through configured restrictions.

Verify project access

From the file view of the consumer project, open the Access tab from the right side panel. Then, select Check access to verify the following:

• Consumer users have the necessary permissions to access the application.
• Consumer users cannot access internal projects or datasets.
• Role assignments are working as expected.

Security best practices

Follow these recommendations to help protect users and data:

• Separate users into a different organization for strict isolation.
• Enable private organizations to prevent user discovery.
• Use separate roles for consumers, builders, and administrators.
• Regularly review organization and application permissions.

Troubleshooting

A user cannot access the application

Verify that the user was assigned to the correct consumer organization and confirm that the consumer user has the appropriate roles in the project.

Application features are not working

Ensure that the consumer organization has access to all required object types. Verify that consumer users can submit the required actions, and that backing datasets are accessible to consumer user groups.

Platform access is not restricted

Review platform access restrictions in Control Panel and ensure that the home page URL is configured correctly. Verify custom domain settings if you are using external domains.