vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.





 Creating Users From the CLI 

If you manage your service through the IBM Cloud CLI and the [cloud databases plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), you can create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command.

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

Once the task has finished, you can retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.





 Creating Users with the API 

The Foundation Endpoint that is shown on the Overview panel of your service provides the base URL to access this deployment through the API. To create and manage users, use the base URL with the /users endpoint.

curl -X POST 'https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"username":"jane_smith", "password":"newsupersecurepassword"}'

To retrieve a user's connection strings, use the base URL with the /users/{userid}/connections endpoint.





 Adding users to Service Credentials in the UI 

Creating a new user from the CLI doesn't automatically populate that user's connection strings into Service Credentials. If you want to add them there, you can create a new credential with the existing user information.

Enter the username and password in the JSON field Add Inline Configuration Parameters, or specify a file where the JSON information is stored. For example, putting {"existing_credentials":{"username":"Robert","password":"supersecure"}} in the field generates Service Credentials with the username "Robert" and password "supersecure" filled into connection strings.
* [Technical white paper](https://www.ibm.com/cloud/blog/ibm-cloud-app-id-technical-white-paper-now-available)



Be sure that you're using version 4 of the [runtime APIs](https://www.ibm.com/blogs/cloud-archive/2019/04/ibm-cloud-app-id-v4-runtime-apis-update/).





 Securing apps 

Have a specific use case? Check out the available blogs and samples to find out how to get started.



* [Securing Angular + Node.js applications by using App ID](https://www.ibm.com/cloud/blog/securing-angularnode-js-applications-using-app-id)
* [Securing single page apps with App ID](https://www.ibm.com/cloud/blog/securing-single-page-apps-app-id-service)
* [Creating Spring Boot applications with App ID](https://www.ibm.com/cloud/blog/creating-spring-boot-applications-app-id)
* [Using App ID with Python](https://github.com/mnsn/appid-python-flask-example)
* [Using Python Flask-pyoidc with App ID](https://github.com/IBM-Cloud/github-traffic-stats)
* [Securing a VueJS app by using App ID](https://github.com/ibmresearchuk/appid-vue-client)
* [Creating Go applications with App ID](https://www.ibm.com/cloud/blog/creating-go-applications-with-app-id)
* [Sign in your app users with any identity provider by using App ID](https://www.ibm.com/cloud/blog/app-id-integrate-custom-identity)
* [Authenticating web users with OpenID and JWT](http://heidloff.net/article/authenticating-web-users-openid-connect-jwt/)
* To create a policy for users, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).
* To create a policy for service IDs, run the ibmcloud iam service-policy-create command or use the IBM Cloud console to bind roles to your service IDs. To create policies, you must have the Administrator role. You automatically have the Administrator role on your own account. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceidsserviceids) and [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).



For an example of useful access policies for IBM Cloud Container Registry, see [Granting access to Container Registry resources tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_access).
But rather than creating users, this tutorial will create a service ID in each team's access group. You are the administrator and will become a member of the different access groups by using the api key for the service ID for the team. The service ID names are ${basename}-x where x is network, shared, application1 and application2. Later you will populate a local.env file in each team's directory with contents similar to this:

export TF_VAR_ibmcloud_api_key=0thisIsNotARealKeyALX0vkLNSUFC7rMLEWYpVtyZaS9

In each step when you cd into a team directory you will be reminded to execute: source local.env

Terraform will be used to create the resources. Open admin/main.tf and notice the provider ibm clause and the reference to the ibmcloud_api_key initialized from the environment variable:

provider ibm {
ibmcloud_api_key = var.ibmcloud_api_key initialized with the TF_VAR_ibmcloud_api_key
}

If you need to use the ibmcloud cli as a team member:

ibmcloud login --apikey $TF_VAR_ibmcloud_api_key







 Step 2: Create the IAM-enabled resources (Admin Team) 

The admin team will need to have Admin access to the IAM-enabled resources in the account used in this tutorial. See [How do I assign a user full access as an account administrator?](https://cloud.ibm.com/docs/account?topic=account-iamfaqaccount-administrator). The admin team will be responsible for creating the IAM resources. The instructions below use the ibmcloud iam api-key-create command to create an API key for the admin. The api key will be used by terraform to perform tasks on your behalf.

The api keys are the same as a passwords to your account. Keep the api keys safe.



1. Initialize and verify the basename shell variable.
* To complete the steps to manage access to the service, your user ID needs administrator platform permissions to manage the IBM Cloud Activity Tracker service. You may have to contact a account administrator. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).
* Your user ID needs to be configured with the service access writer role at a minimum to create and manipulate buckets.



When naming buckets or objects, be sure to avoid the use of Personally Identifiable Information (PII). PII is information that can identify any user (natural person) by name, location, or any other means.





 Step 1: Create a new bucket 

Navigate to your Object Storage instance, and click on the Create bucket button.

![Navigate to COS](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/at-tut-1-create-bucket.png)





 Step 2: Create a custom bucket 

We're going to want to create a custom bucket in order to provision our new Activity Tracker instance, so click on the Customize your bucket tile.

![Create a custom bucket](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/at-tut-2-custom-bucket.png)





 Step 3: Name the new bucket 

Give the bucket a memorable name. In this case the new bucket will be called tracked-files and it's being created in the us-east region.

!
Where org_id is the ID of your Watson IoT Platform organization.
2. In the Overview dashboard, from the menu pane, select Devices and then click Add Device.
3. Create a device type for the device that you are adding.

Each device that is connected to the Watson IoT Platform must be associated with a device type. Device types are groups of devices that share common characteristics.



1. Click Create device type.
2. Enter a device name, such as my_device_type, and a description for the device type.

> Note: The device type name must be no more than 36 characters and can contain only alphanumeric characters (a-z, A-Z, 0-9) and any of the following characters: _, ., and -.
3. Optional: Enter device type attributes and metadata.

You can add and edit attributes and metadata later.



4. Click Next to begin the process of adding your device with the selected device type.
5. Enter a device ID, for example my_first_device.

The device ID is used to identify the device in the Watson IoT Platform dashboard and is also a required parameter for connecting your device to Watson IoT Platform.

> Note: The device type name must be no more than 36 characters and can contain only alphanumeric characters (a-z, A-Z, 0-9) and any of the following characters: _, ., and -.

For network connected devices, the device ID could be the device MAC address without any separating colons.
6. Click Next to complete the process.
7. Provide an authentication token or accept an automatically generated token. If you choose to create your own token, make sure that it is between 8 and 36 characters long and consists only of alphanumeric characters and the following characters: _, ., !, &, @, ?, *, +, (, ), and -.

The token must not contain repeated character sequences, dictionary words, user names, or other predefined sequences.
8. Verify the summary information is correct and then click Add to add the connection.
9. In the device information page, copy and save the following details:
* [ Step 2: Create service IDs and API keys for the SO user, normal user, and anonymous user](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-accessstep2-create-service-id-api-key)
* [Step 3: Assign IAM roles to the service IDs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-accessstep3-assign-iam-roles)
* [ What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-accesspkcs11-best-practices-next)







 Privately connecting to Hyper Protect Crypto Services 

[Using virtual private endpoints for VPC to privately connect to Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpcvirtual-private-endpoints-for-vpc)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpcvirtual-private-endpoints-for-vpc-prereqs)
* [Setting up a VPE for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpcvirtual-private-endpoints-for-vpc-setup)
* [Using your VPE for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpcuse-vpe-for-hpcs)
Assign the custom roles to the SO user service ID 

To assign the custom roles that are defined in [Step 1](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-accessstep1-create-custom-roles) to the SO user service ID, follow these steps:

To assign access to the keystores for the SO user, follow these steps:



1. From the menu bar, click Manage > Access (IAM), and select Service IDs to browse the existing service IDs in your account.
2. Hover your mouse over the SO user service ID, and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options.
3. From the options menu, click Assign access.
4. Click Access policy.
5. Under Service, select Hyper Protect Crypto Services and click Next.
6. Under Resources, select Specific resources.
7. Select the Service Instance ID attribute type, enter the Hyper Protect Crypto Services service instance ID that you want to grant access to, and click Next.
8. Under Roles and actions, check the boxes for the following roles and click Next:



* Keystore operator
* Key operator



9. (Optional) Under Conditions (optional), click Review to check the access policy.
10. After confirmation, click Add > Assign.







 2. Assign the custom roles to the normal user service ID 

To assign the custom roles that are defined in [Step 1](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-accessstep1-create-custom-roles) to the normal user service ID, follow these steps:

To assign access to the keystores for the normal user, follow these steps:



1.
Don't have an app that you can try out the flow with? No problem! App ID provides a [simple Liberty for Java sample app](https://github.com/ibm-cloud-security/appid-video-tutorials/tree/master/02d-simple-liberty-backend-app).





 Before you begin 

Before you get started with App ID in your Liberty for Java back-end application, you must have the following prerequisites:



* An instance of [the App ID service](https://cloud.ibm.com/catalog/services/app-id)
* [The IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started)
* [Apache Maven 3.5+](https://maven.apache.org/download.cgi)
* [Java 8+](https://www.java.com/en/download/)







 Step 1: Obtain your credentials 

You can obtain your credentials in one of two ways.



* By navigating to the Applications tab of the App ID dashboard. If you don't already have one, you can click Add application to create a new one.
* By making a POST request to the [/management/v4/<tenantID>/applications endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui/!/Applications/registerApplication).

Request format:
 {: codeblock}
curl -X POST https://us-south.appid.cloud.ibm.com/management/v4/<tenantID>/applications/ 
-H 'Content-Type: application/json' 
-H 'Authorization: Bearer <IAMToken>' 
-d '{"name": "ApplicationName"}'

Example response:
 {: screen}
{
  "clientId": "xxxxx-34a4-4c5e-b34d-d12cc811c86d",
[https://www.ibm.com/mysupport](https://www.ibm.com/mysupport)
2. Click the Open a case button on top right of page.
3. Sign in with valid IBMid:

Please note: If you do not have an IBMid, or your IBMid has not been registered with a valid product and customer account, go to the following link(s):

[How to Create An IBMid](https://cloud.ibm.com/docs/mas-saashow-to-create-an-ibmid)

[Register for Maximo Application Suite Support](https://cloud.ibm.com/docs/mas-saashow-to-register-for-mas-support)
4. On the following page, populate all required (*) fields ensuring Maximo Application Suite on Cloud is selected for Product and click on the Submit Case button.
5. Case Creation will be confirmed and case number referenced:

Note: Cases are nine digit numbers preceded with “TS”.

You will also receive an email confirming the Case number.
6. Click Back to all cases (in the upper left hand corner) or go to [https://www.ibm.com/mysupport/s/my-cases](https://www.ibm.com/mysupport/s/my-cases) to see a full list of your cases.







 Next steps 



1. Designate member(s) of your staff to subscribe to the [Client Communications Center (CCC)](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-client-communications-center) to receive important information and notifications regarding your environment(s):

[https://status.suite.maximo.com](https://status.suite.maximo.com)
2. Add additional users to your account. Login to Maximo Application Suite, click the administration icon in the menu bar, and select Administration > Users.
3.
Changing a user's IBMid 

As an account owner, you can update a user's IBMid. The new IBMid that you use to replace the current IBMid must already exist.

The IBMid you're replacing is removed from the account. If you need the existing IBMid to continue to be a member of the account, you must invite the user again and reestablish their access.

Account owners can't change their own IBMid.



  Before you begin 

To change an IBMid, the replacement ID must already exist. If you're not sure if the new IBMid exists, users can go to [My IBM](https://myibm.ibm.com) and click Create an IBMid. If you enter an email address that corresponds to a federated identity provider (IdP) domain, IBMid redirects you to that IdP's login page. First-time logins to IBM® using a federated IdP triggers the creation of a new IBMid. Otherwise, follow the steps to create the ID. The email address that is used becomes the user's new replacement IBMid.

After the user ensures that the new IBMid exists, complete the following steps:



1.  Go to Manage > Access (IAM) > Users in the IBM Cloud® console, and select the user whose IBMid you want to update.
2.  Click Details, and select Update IBMid.
3.  Enter the new IBMid, and click Update.



The user can now log in to ibm.com with their new IMBid and continue working in the IBM Cloud account with the access assigned to their previously used IBMid.
* To complete the steps to manage access to the service, your user ID needs administrator platform permissions to manage the IBM Cloud Activity Tracker service. You may have to contact a account administrator. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).
* Your user ID needs to be configured with the service access writer role at a minimum to create and manipulate buckets.



When naming buckets or objects, be sure to avoid the use of Personally Identifiable Information (PII). PII is information that can identify any user (natural person) by name, location, or any other means.





 Step 1: Create a new bucket 

Navigate to your Object Storage instance, and click on the Create bucket button.

![Navigate to COS](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/mon-tut-1-create-bucket.png)





 Step 2: Create a custom bucket 

We're going to want to create a custom bucket in order to provision our new Monitoring instance, so click on the Customize your bucket tile.

![Create a custom bucket](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/mon-tut-2-custom-bucket.png)





 Step 3: Name the new bucket 

Give the bucket a memorable name. In this case the new bucket will be called monitored-files and it's being created in the us-east region.

!
ibmcloud is instance-create $NAME $VPC $ZONE $PROFILE $SUBNET --image-id $IMAGE --key-ids $SSHKEY --user-data @example.ign

Use the following example to create a local user.



1. Write the Butane config in the YAML format.

Butane config

variant: fcos
version: 1.4.0
passwd:
users:
- name: demouser
2. Use Butane to convert the Butane config into an Ignition config.

Ignition config

"ignition": {
"version": "1.4.0"
},
"passwd": {
"users": [
{
"name": "demouser"
}
]
}
}



Use the following sample user data shows how to add an SSH key for a local user.



1. Write the Butane config in the YAML format.

Butane config

variant: fcos
version: 1.4.0
passwd:
users:
- name: demouser
ssh_authorized_keys:
- <ssh public key>
2. Use Butane to convert the Butane config into an Ignition config.

Ignition config

"ignition": {
"version": "1.4.0"
},
"passwd": {
"users": [
{
"name": "demouser",
"sshAuthorizedKeys":
"<ssh public key>"
]
}
]
}
}



For more Fedora Core OS user data examples and information, see [Fedora Project documentation](https://docs.fedoraproject.org/en-US/fedora-coreos/producing-ign/).





 Next steps 

After you choose a profile, it's time to plan for and create an instance.
* You must have an application.
* Make sure you have an understanding of how each type of role and scope can impact your application. Because you're granting access, you want to be sure that you're granting it to only the people that need it.
* Be aware of the [limits](https://cloud.ibm.com/docs/appid?topic=appid-known-issues-limits) that are in place.







 Creating scopes with the UI 

A scope is a runtime action in your application that can be taken by users who are granted the required permissions to complete them. Scopes are created when you register your application with App ID. If your app is already registered, you can edit it to include scopes.

The values of scope names must meet the following requirements:



* Be alphanumeric
* Be lowercase
* Not start with appid or openid
* Not contain special characters other than periods (.) or underscores (_)
* Be fewer than 50 characters.



To create a scope, you can use the App ID UI.



1. Go to Applications in the App ID dashboard.
2. Click Add application to open the configuration screen. If you already have credentials that you want to use, click Edit from the Actions menu in the row that you want to update.
3. Give your app a name, and select the type of application that you have.
4. Enter a value for your custom scope, and click the plus symbol (+). An example scope value might be read or write.
5. Repeat the previous step until you add all your scopes to the app.
6. Click Save.







 Creating scopes with the API 

A scope is a runtime action in your application that can be taken by users who are granted the required permissions to complete them. Scopes are created when you register your application with App ID. If your app is already registered, you can edit it to include scopes.

The values of scope names must meet the following requirements:



* Be alphanumeric
* Be lowercase
* Not start with appid or openid
* Use social identity providers.
* Add a date picker to the statistics page to filter displayed data.
* Use a custom login page for App ID.







 Related Content 

Here are links to additional information on the topics covered in this tutorial. The app itself is available in this [GitHub repository](https://github.com/IBM-Cloud/github-traffic-stats).

Documentation:



* [App ID documentation](https://cloud.ibm.com/docs/appid?topic=appid-getting-started)
* [Db2 on Cloud](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-about)
sudo -i -u ${sid}adm -- hdbsql -i ${INSTNO} -d SYSTEMDB -u SYSTEM

Create a user.

CREATE USER HA_HOOK PASSWORD <Password> no force_first_password_change;

Grant the required privileges to the user.

Grant privilege INIFILE ADMIN to allow for changes of profile parameters.

GRANT INIFILE ADMIN TO HA_HOOK;

Verify the HA_HOOK user.

sudo -i -u ${sid}adm -- hdbsql -d SYSTEMDB -u SYSTEM select * from users where user_name = 'HA_HOOK';
2. Add the user credentials to the secure user store hdbuserstore.

On both nodes, run the following command. Use the password that you set in the previous step.

sudo -i -u ${sid}adm -- hdbuserstore SET HA_HOOK_KEY localhost:3${INSTNO}13 HA_HOOK <Password>

Check the update to the hdbuserstore.

sudo -i -u ${sid}adm -- hdbuserstore list

On the primary instance, test the connection with the stored user key.

sudo -i -u ${sid}adm -- hdbsql -U HA_HOOK_KEY select * from m_inifiles;







 Creating the hook script 

Python sample files for creating hook scripts are delivered as part of the SAP HANA installation. The samples are located in directory $DIR_INSTANCE/exe/python_support/hdb_ha_dr.

The target directory /hana/shared/myHooks was already created for hook SAPHanaSR.py. Create a HA/DR provider hook in /hana/shared/myHooks. The following hook script is based on the HADRdummy.pysample.

On NODE2, edit the file /hana/shared/myHooks/SAPHanaCostOptSR.py and add the following content.

"""
Sample for a HA/DR hook provider.