vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Click Add user.
6. Click the user name field to see a list of the people you can add.

The users you added in the previous steps are listed. Select a name, choose their access role, and then click Add.

If you aren't connecting to an existing user registry and enabling single sign-on, then temporary passwords are created for the users you add and are sent to them by way of the email addresses you specified.







 Scaling Deployments and StatefulSets 



 Deployments 



 Component Deployment name Pod name Default number of replicas 

 WKS Front-end {release_name}-ibm-watson-ks {release_name}-ibm-watson-ks-xxxxxxxxxx-xxxxx 2 
 SIREG {release_name}-sire-training-sireg-{lang} {release_name}-sire-training-sireg-{lang}-xxxxxxxxxx-xxxxx 2 
 SIRE Job queue {release_name}-sire-training-jobq {release_name}-sire-training-jobq-xxxxxxxxxx-xxxxx 2 
 SIRE Train Facade {release_name}-sire-training-facade {release_name}-sire-training-facade-xxxxxxxxxx-xxxxx 2 
 MMA {release_name}-ibm-watson-mma-prod-model-management-api {release_name}-ibm-watson-mma-prod-model-management-api-xxxxxxxxxx-xxxxx 2 
 Watson Add-on {release_name}-wcn-addon-addon {release_name}-wcn-addon-addon-xxxxxxxxxx-xxxxx 2 
 PostgreSQL {release_name}-ibm-postgresql-proxy {release_name}-ibm-postgresql-proxy-xxxxxxxxxx-xxxxx 2 
 PostgreSQL {release_name}-ibm-postgresql-sentinel {release_name}-ibm-postgresql-sentinel-xxxxxxxxxx-xxxxx 2 





* {release name} is the Helm release name of your installation.
As the dialog asks for and gets information from the user, it can keep track of the information and reference it later in the conversation.

For example, in one node you might ask users for their name, and in a later node address them by name.

![Shows an introductions node that asks the user for their name, and stores it as a context variable. The next node refers to the user by name by using the $username context variable.](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/set-context-username.png)

In this example, the system entity @name is used to extract the user's name from the input if the user provides one. In the JSON editor, the username context variable is defined and set to the @name value. In a subsequent node, the $username context variable is included in the response to address the user by name.





 Defining a context variable 

Define a context variable by adding the variable name to the Variable field and adding a default value for it to the Value field in the node's edit view.



1. Click to open the dialog node to which you want to add a context variable.
2. Go to the Assistant responds section and click the menu icon ![overflow menu icon](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/more-icon.png).

If you're using multiple conditioned responses, you must click the Customize response icon ![gear icon](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/customize-response-icon.png) to see the menu that is associated with the response.
3. Click Open context editor.
Adding users from this menu enables them to read, write, and manage all assistants in the service instance.
4. Click Submit.



After you click Submit, any user that you invite receives an email to access the instance. After they accept the invite, they can open the service instance and manage all assistants.





 Managing access with Identity and Access Management 

Another way to add users to your assistants is using Identity and Access Management (IAM). If you want to add users, and you don't want them to have full Manager access, use IAM to add them. From IAM, you can also manage access roles of those users that are already added to your assistants.



 Opening Identity and Access Management 



1. Open the Manage menu. ![Manage menu](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/user--avatar.svg)
2. Click Manage users.
3. In Access and permissions, click Identity and Access Management in step 2.

Zoom

![Access and permissions](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/access-control-manage-users-modal.png)

Access and permissions







 Adding users in Identity and Access Management 



1. In IAM, click Invite users.
2. Enter the email address of the person who needs access.
3. In How do you want to assign access?, choose Access policy.

Zoom

![Access policy](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/access-policy.png)

Access policy
4.
Open the App ID instance page from the [resource list](https://cloud.ibm.com/resources) Services and software section.
2. Go to Manage Authentication → Cloud Directory → Users, and click Create User. Enter the user details.







 Step 6: Create or modify users' project assignments 

If the IDP administrator will assign users to projects, you can define project values in the user's attributes.



1. Open the App ID instance page from the [resource list](https://cloud.ibm.com/resources) Services and software section.
2. Go to Manage Authentication → Cloud Directory → Users, and click a user to open it.
3. Scroll down to Custom Attributes, and click Edit.
4. Enter a key value pair that can will checked by the dynamic rules of the access groups, then click Save. You can add several values in the same string (for example, {"project":"ml finance"}); the contains qualifier of the dynamic rule detects a match of a substring. For our example, add:

{"project":"ml"}

The value project corresponds to the convention defined in the planning section. ml is the project that the user belongs to.

This check is done on every login, so changes in the ID provider user attributes will be effective when a user next logs in.







 User flow 



1. A user is sent the ID provider URL for the IBM Cloud account.

The administrator can always go to [Manage → Access (IAM) → Identity providers](https://cloud.ibm.com/iam/identity-providers) to look up the ID provider URL.
2. To work with Qiskit Runtime serive instances, users must create an API key by going to ([Manage → Access (IAM) → API keys](https://cloud.ibm.com/iam/apikeys)).
3. For further information, users can review [Getting started, Step 2](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-get-startedinstall-packages).







 Example scenario
As the dialog asks for and gets information from the user, it can keep track of the information and reference it later in the conversation.

For example, in one node you might ask users for their name, and in a later node address them by name.

![Shows an introductions node that asks the user for their name, and stores it as a context variable. The next node refers to the user by name by using the $username context variable.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/set-context-username.png)

In this example, the system entity @sys-person is used to extract the user's name from the input if the user provides one. In the JSON editor, the username context variable is defined and set to the @sys-person value. In a subsequent node, the $username context variable is included in the response to address the user by name.





 Defining a context variable 

Define a context variable by adding the variable name to the Variable field and adding a default value for it to the Value field in the node's edit view.



1. Click to open the dialog node to which you want to add a context variable.
2. Go to the Assistant responds section and click the menu icon ![overflow menu icon](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/more-icon.png).

If you're using multiple conditioned responses, you must click the Customize response icon ![gear icon](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/customize-response-icon.png) to see the menu that is associated with the response.
3.
Be sure that you have [set the identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-ca-identity) to a CA admin that has the ability to register new users before you attempt this task. In general, this is your admin user. If the button is gray, you have either not set an identity, or that the identity cannot create new identities.

Clicking Register user opens a series of side panels:



1. On the first side panel, enter the Enroll ID and Enroll Secret of the new identity. Save these values, as they are not stored by the console.
2. Select the identity Type. The drop-down list contains the list of types that the CA supports. If you are registering an identity that will serve as an admin of a node, select type admin. If you are registering a peer identity select peer and likewise for an ordering node identity select orderer. When you need to register an identity for a client application select the type client.
3. You can associate an affiliation with the user. Check the Use root affiliation checkbox for the user if you want them to have the root affiliation and be able to see all other users registered with this CA. When you deselect Use root affiliation, you can select a specific affiliation from the list to associate with this user. The platform includes the default affiliation ibp.
4. Enter the Maximum Enrollments allowed for this identity. If not specified, the value defaults to unlimited enrollments.
5. On the last side panel, add the Attributes of the identity you are creating.



After you click Register, the new identity will be added to the list of Authenticated users that have been created by your CA. The identities are listed by their Enroll ID, along with their Type and Affiliation. Clicking on an identity in the table opens a side panel that displays the number of Maximum Enrollments and Attributes that were created during registration.

Deleting a user
If you need to delete a registered user, click the action menu next to any user and select Delete user.
: In addition to tagging resources, you can now attach user tags and access management tags on service IDs. User tags help you group service IDs for usage reports, and you can use access management tags to control access to your service IDs. For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui).

Specifying a user onboarding strategy
: If you’re [Enabling and connecting your identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integrationidp-console), you can now specify how you want to onboard users to the account upon first-time login. This way, you can add each user to your account when they log in the first time, add users to your account only if they log in and don't select a trusted profile, or never add users to your account and provide access only by using trusted profiles. For more information about trusted profiles, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile).





 02 September 2022 

Increased policy limit
: The shared limit for IAM policies and context-based restrictions has increased from 2010 to 4020 so that you don't need to [request an increase to the limit in your account](https://cloud.ibm.com/docs/account?topic=account-account-limits&interface=clilimit-increase) as you grow your organizational capacity. For more information, see [Known issues and limitations](https://cloud.ibm.com/docs/account?topic=account-known-issuesiam_limits).







 August 2022 



 31 August 2022 

Choose from dark or light themes in the console
: Enjoy a customized experience in the console that matches your preferences. By default, the console uses the mode that you already have set for your device. We'd like you to be able to experience IBM Cloud using a theme of your choosing. Use the Avatar icon from the console menu bar to find the options for changing your theme.







 July 2022 



 21 July 2022
[More menu](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/cp4d-sideways-kebab.png), and then choose Manage Access.
5. Click Add user.
6. Click the user name field to see a list of the people you can add.

The users you added in the previous steps are listed. Select a name, choose User or Admin as their access role, and then click Add.

If you aren't connecting to an existing user registry and enabling single sign-on, then temporary passwords are created for the users you add and are sent to them by way of the email addresses you specified.
7. Repeat the access management steps on the Discovery instance.

Before people can create search skills in Watson Assistant, they need to have access to a Discovery instance. Add to the Discovery instance those people who need to be able to add new data collections to or query from existing collections by using a search skill.
For more information, see [Giving users access to a Watson Discovery instance](https://www.ibm.com/docs/SSQNUZ_4.6.x/svc-discovery/discovery-admin-add-users.html).
3. Enable document-level security for the data source when you connect to it.





 Creating users for document-level security 

You must create users that match the users available on the source system that Discovery is connecting to so that they can query with document-level security enabled.



1. Log in to Discovery as an administrator.
2. Create users who match the users available on your source or who are connected to the identity provider that your source system uses. If you create users for document-level security, keep the following points in mind:



* Optional: For each user that you want to have access to query results, you must add users. The username must match the username that the source uses. This option is only for development and testing purposes. To create users individually, see [Managing users](https://www.ibm.com/docs/SSQNUZ_4.6.x/cpd/admin/users.html).
* To connect to an identity provider that the source is using, see [Connecting to your identity provider](https://www.ibm.com/docs/SSQNUZ_4.6.x/cpd/admin/ldap.html).





Discovery does not synchronize changes that are made to the users in the identity provider with the user list for the service. Discovery administrators must ensure that the user list is current and remove any noncurrent users.
Select the users that you want to add from the list, and click Add to group.







 Add a service ID to the access group 

Complete the following steps to add a service ID:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click the Service IDs tab, and click Add service ID.
4. Select the IDs that you want to add from the list, and click Add to group.
You can add an authentication context by adding a class array and comparison string to your code. BE sure to update both the class and comparison parameters with your values. For example, a class parameter might look similar to urn:oasis:names:tc:SAML:2.0:ac:classes:YourChosenClassValue. 
 Optional: signRequest The signRequest flag provides the capability to send a signed SAML request to an identity provider that is signed by using the tenant's SAML signing private key. To configure your SAML identity provider to receive a signed request, you need the signing certificate from the metadata file that you can download in the KeyDescriptor use="signing" field. By default, request signing is set to off. 
 Optional: encryptResponse The encryptResponse flag allows for you to receive an encrypted response from your identity provider as part of the authentication request. To configure your SAML identity provider to send an encrypted response, you need the encryption certificate that can be found in the metadata file in the KeyDescriptor use="encryption" field. By default, response encryption is set to off. 



3. Make a PUT request to the [/saml API endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Identity%20Providers/mgmt.set_saml_idp) to provide the configuration that you created in step 2 to App ID. Check out the following example to see what your request might look like.

curl --request PUT https://us-south.appid.cloud.ibm.com/management/v4/<tenantID>/config/idps/saml --header Accept: application/json --data {
"isActive": true,
"config": {
"entityID": "https://example.com/saml2/metadata/706634",
"signInUrl": "https://example.com/saml2/sso-redirect/706634",
Create a file that is named ldapuser.ldif by using an editor, such as VI, and add the following lines to it (replace with your own required domain name in the "dc=,dc=" section):

dn: uid=symphonyuser03,ou=People,dc=ibmsymphony,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: symphonyuser03
sn: Linux
userPassword: {SSHA}+A6gC87JU5ugW6qthWL2HGYzsQIdN1EN
loginShell: /bin/bash
uidNumber: 1003
gidNumber: 1003
homeDirectory: /home/symphonyuser03
dn: cn=symphonyuser03,ou=Group,dc=ibmsymphony,dc=com
objectClass: posixGroup
cn: symphonyuser03
gidNumber: 1003
memberUid: symphonyuser03
Show more

Replace the {SSHA} value with the password hash that you generated earlier.
13. Apply the changes by running the following command:

ldapadd -x -D cn=Manager,dc= ibmsymphony,dc=com -W -f ldapuser.ldif
14. To verify whether users have been created as mentioned in the previous steps, use the following command:

ldapsearch -x -LLL -b "ou=People,dc=ibmsymphony,dc=com" "(objectClass=posixAccount)" uid cn



The OpenLDAP server is now configured and ready to use. You can add more users and groups by creating more LDIF files and by using the ldapadd command to import them into the directory.





 Step 2: Create a user group in OLDAP directory 

Now that the OpenLDAP server is configured, you need to create a user group in the OLDAP directory, which consists of users who are supposed to get access to the LSF cluster.



1.
* UI
* API







 Managing users 

With Cloud Directory, you can manage your users in a scalable registry by using a pre-built functionality that enhances security and self-service.

A Cloud Directory user is not the same thing as an App ID user. Users can sign up for your app by using the different identity provider options that you configured, or you can add them to your directory. The users that are mentioned in the following sections are the users who are associated with Cloud Directory as an identity provider.



 Viewing user information 

You can see all the information that is known about all your Cloud Directory users as a JSON object by using the APIs or by using the dashboard.



 Viewing user information with the UI 

You can use the App ID dashboard to view details about your app users.



1. Go to the Cloud Directory > Users tab of your App ID instance.
2. Look through the table or search by using an email address to find the user that you want to see the information for. The search term must be exact.
3. In the overflow menu in the user's row, click View user details. A page opens that contains the user's information. Check out the following table to see what information you can see.



Table 1. The details that you can see about your users by looking in the App ID dashboard

 Detail Description 

 User identifier The user identifier is dependant upon the type of user sign-up that you configured. For example, if you have an email and password flow, the identifier is the user's email. If you use the username and password flow, the identifier is the username that is given at sign-up. 
 Email The primary email address that is attached to the user. 
 First name and surname Your user's first name and surname as they provided during the sign-up process. 
 Last Login The timestamp of the last time that the user logged in to your application. Note: If you added your user through the dashboard, the login is blank until the user themselves signs in to your app. When sign-in occurs, they also become an App ID user.
"id": "f1772fcc-ff70-4d88-81a0-07dd7a3d988f",
"status": "CONFIRMED",
"idpType": "cloud_directory"
}
}
]
}

To see the full user data set that App ID supports, check out [the SCIM core schema](https://datatracker.ietf.org/doc/html/rfc7643section-8.2).









 Adding users 

When a user signs up for your application, they are added as a user. For test purposes, you can add a user through the App ID dashboard or by using the API.

When a user signs up for your application, they do so through a self-service workflow that automatically triggers emails such as a welcome or verification request. When you, as an administrator, add a user to your app a self-service workflow is not initiated, which means that users do not receive any emails from your application. If you want your users to still be notified that they're added, you can trigger the messaging flows through the [App ID management API](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.set_cloud_directory_email_dispatcher).

If you disable self-service sign-up or add a user on their behalf, the user does not receive a welcome or verification email when they're added.



 Adding users with the UI 



1. Go to the Cloud Directory > Users tab of the App ID dashboard.
2. Click Add user. A form opens.
3. Enter a First name, Last name, Email, and Password. Be sure that the email that you try to register is not already taken by another user. To be sure that you typed your password correctly, confirm it by entering it in the Reenter Password field.
4. Click Save. A Cloud Directory user is created.







 Adding users with the API 



1. Obtain your tenant ID from your application or service credentials.
2.
5. Select the service role Manager.
6. Click Assign.









 Step 3. Add a user or service ID to the access group 

Continue to set up your group by adding users or service IDs.



 Add a user to the access group 

Complete the following steps to add a user:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Add users on the Users tab.
4. Select the users that you want to add from the list, and click Add to group.







 Add a service ID to the access group 

Complete the following steps to add a service ID:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click the Service IDs tab, and click Add service ID.
4. Select the IDs that you want to add from the list, and click Add to group.