vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, and jsonpath-as-json=JSONPATH_EXPRESSION. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--password, --pw
: The password for a basic auth or registry secret. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is optional.

--password-from-file, --spf
: The path to a file containing the password for a basic auth or registry secret. The first line of the file is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. You must provide the path to the file as a value. This value is optional.

--password-from-json-file, --spfj
: The path to a JSON file containing the password for a basic auth or registry secret. The apikey field is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. You must provide the path to the file as a value. This value is optional.

--private-key-file, --pkf
: Specify a file containing the private key for a TLS secret that matches the specified certificate chain with the cert-chain-file option. You must provide the path to the file as a value. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.

--rm
: Remove an individual key-value pair in a generic secret by specifying the name of the key. This option can be specified multiple times. This value is optional.
Authentication Password A password for the user - might be shown as $PASSWORD 
 Authentication Method How authentication takes place; "direct" authentication is handled by the driver. 
 Hosts 0... A hostname and port to connect to 
 Composed 0... A URI combining Scheme, Authentication, Host, and Path 
 Certificate Name The allocated name for the self-signed certificate for database deployment 
 Certificate Base64 A base64 encoded version of the certificate. 





* 0... indicates that there might be one or more of these entries in an array.



Many Elasticsearch drivers are able to make a connection to your deployment when given the URI-formatted connection string found in the "composed" field of the connection information. For example,

https://admin:$PASSWORD@d5eeee66-5bc4-498a-b73b-1307848f1eac.8f7bfd8f3faa4218aec56e069eb46187.databases.appdomain.cloud:31821

The following example uses Java to connect.

import io.searchbox.client.JestClientFactory;
import io.searchbox.client.JestResult;
import io.searchbox.client.config.HttpClientConfig;
import io.searchbox.client.JestClient;
import io.searchbox.cluster.Health;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.ssl.SSLContextBuilder;

import javax.net.ssl.SSLContext;
import java.io.File;
import java.security.;
import java.security.cert.CertificateException;

import java.io.IOException;

public class ESConnect {

public static void main(String[] args) {

// Add CA cert to truststore using something like:
Note: Password should be at least 8 characters, must have one number, one lowercase letter, one uppercase letter, and at least one unique character. Password should not contain username. No None 
 scale_compute_cluster_gui_username GUI user to perform system management and monitoring tasks on the compute cluster. Note: Username should be at least four characters, any combination of lowercase and uppercase letters. No None 
 scale_filesystem_block_size File system [block size](https://www.ibm.com/docs/en/spectrum-scale/5.1.2?topic=considerations-block-size). Spectrum Scale supported block sizes (in bytes): 256K, 512K, 1M, 2M, 4M, 8M, 16M. No 4M 
 scale_storage_cluster_filesystem_mountpoint Spectrum Scale storage cluster (owningCluster) file system mount point. The owningCluster is the cluster that owns and serves the file system to be mounted. For more information, see [Mounting a remote GPFS file system](https://www.ibm.com/docs/en/spectrum-scale/5.1.2?topic=system-mounting-remote-gpfs-file). No /gpfs/fs1 
 scale_storage_cluster_gui_password Password for Spectrum Scale storage cluster GUI. Note: Password should be at least 8 characters, must have one number, one lowercase letter, one uppercase letter, and at least one unique character. Password should not contain username. No None 
 scale_storage_cluster_gui_username GUI user to perform system management and monitoring tasks on the storage cluster. Note: Username should be at least 4 characters, any combination of lowercase and uppercase letters. No None 
 scale_storage_image_name Name of the custom image that you would like to use to create virtual machines in your IBM Cloud account to deploy the Spectrum Scale storage cluster. By default, the automation uses a base image plus the Spectrum Scale software and any other software packages that it requires.
: Require users to enter a second form of authentication during sign-in to increase the security of your app. With Cloud Directory, the first factor is the user's password that they would normally use. Then, the service sends the user a one-time code through SMS that the user must enter before they can gain access to your app. For more information, see [Multi-factor authentication](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa).





 11 December 2018 

Cloud Directory: Multi-factor authentication - Email
: Require users to enter a second form of authentication during sign-in to increase the security of your app. With Cloud Directory, the first factor is the user's password that they would normally use. Then, the service sends the user a one-time code through the email that is registered that the user must enter before they can gain access to your app. For more information, see [Multi-factor authentication](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa).

Cloud Directory: Password policies
: Further enforce app security by specifying rules that users must adhere to when they create the password that they use to sign in. For example, you can set an advanced policy that dictates the number of times a password must change before a user can reuse a previous password. Or, you can prevent users from creating a password that contains their username or email address. For more information, see [Defining password policies](https://cloud.ibm.com/docs/appid?topic=appid-cd-strength).





 17 March 2017 

Introducing App ID
: IBM Cloud App ID allows you to easily add authentication to web and mobile apps. You no longer have to worry about setting up infrastructure for identity, ensuring geo-availability, and confirming compliance regulations. Instead, you can enhance your apps with advanced security capabilities like multifactor authentication and single sign-on.
IA-5 (1) - Password-based Authentication 



  Control requirements 

The information system, for password-based authentication:

IA-5 (1) (a)
:   Enforces minimum password complexity of [IBM Assignment: minimum length of 8 characters, cannot be a derivative of the username, and must have a combination of alpha and numeric characters];

IA-5 (1) (b)
:   Enforces at least the following number of changed characters when new passwords are created: [IBM Assignment: at least one (1)];

IA-5 (1) (c)
:   Stores and transmits only cryptographically-protected passwords;

IA-5 (1) (d)
:   Enforces password minimum and maximum lifetime restrictions of [IBM Assignment: require passwords to be changed every 90 days, temporary passwords for web applications only valid for 24 hours];

IA-5 (1) (e)
:   Prohibits password reuse for [IBM Assignment: twenty-four (24)] generations; and

IA-5 (1) (f)
:   Allows the use of a temporary password for system logons with an immediate change to a permanent password.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Consumer accounts for application provider workloads](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumer)







  NIST supplemental guidance 

This control enhancement applies to single-factor authentication of individuals using passwords as individual or group authenticators, and in a similar manner, when passwords are part of multifactor authenticators. This control enhancement does not apply when passwords are used to unlock hardware authenticators (e.g., Personal Identity Verification cards). The implementation of such password mechanisms may not meet all of the requirements in the enhancement. Cryptographically-protected passwords include, for example, encrypted versions of passwords and one-way cryptographic hashes of passwords. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. Password lifetime restrictions do not apply to temporary passwords. To mitigate certain brute force attacks against passwords, organizations may also consider salting passwords.
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.

The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|previous)$/.

--limit (int64)
: The number of locks to retrieve. By default, list operations return the first 25 items. To retrieve a different set of items, use limit with offset to page through your available resources.

Usage: If you have 20 locks associated with your secret, and you want to retrieve only the first 5 locks, use ..?limit=5.

The maximum value is 100. The minimum value is 1.

--offset (int64)
: The number of locks to skip. By specifying offset, you retrieve a subset of items that starts with the offset value. Use offset with limit to page through your available resources.

Usage: If you have 100 locks on your secret, and you want to retrieve locks 26 through 50, use ..?offset=25&limit=25.

The minimum value is 0.

--search (string)
: Filter locks that contain the specified string in the field "name".

Usage: If you want to list only the locks that contain the string "text" in the field "name", use ..?search=text.

The maximum length is 64 characters.





 Examples
If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. This value is required for basic_auth and registry secrets. This value is optional.

--password-from-file, --spf
: The path to a file containing the password for a basic auth or registry secret. The first line of the file is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. You must provide the path to the file as a value. This value is required for basic_auth and registry secrets. This value is optional.

--password-from-json-file, --spfj
: The path to a JSON file containing the password for a basic auth or registry secret. The apikey field is used for the password. If neither --password, nor --password-from-file, nor --password-from-json-file option is specified, then you are prompted for the password. You must provide the path to the file as a value. This value is required for basic_auth and registry secrets. This value is optional.

--private-key-file, --pkf
: Specify a file containing the private key for a TLS secret that matches the specified certificate chain with the cert-chain-file option. You must provide the path to the file as a value. This value is required for tls secrets. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This option applies for basic_auth, generic, registry, ssh, and tls secrets. This value is optional. The default value is false.

--server, -s
: The URL of the registry server for a registry secret. This option is required for registry secrets. This value is optional. The default value is us.icr.io.
To increase the level of security for this option, you can disable logging in to the CLI with only a username and password. This way, you require an API key to log in to the CLI or users can log in with --sso.

Starting 3 May 2023, by default CLI logins with only a username and password are disabled for all users that have MFA set to None. This applies to users in new and existing accounts. Administrators can opt-out before that date in the IBM Cloud console. For more information, see [Disabling CLI logins with only a password](https://cloud.ibm.com/docs/account?topic=account-enablemfadisabling-cli)





 MFA for users with an IBMid 

Users authenticate by using an IBMid, password, and time-based one-time passcode (TOTP). You can enable this option for all users or only nonfederated users.





 MFA for all users (IBMid and supported IdPs) 

Users authenticate by using one of the following MFA factors. This option applies to all users, including users who are using an IBMid or an external identity provider (IdP), like AppID.



* Email-based MFA: Users authenticate by using a security passcode, which is sent by email.
* TOTP MFA: Users authenticate by using a TOTP.
* U2F MFA: Users authenticate by using a physical hardware-based security key. Based on the FIDO U2F standard, this factor offers the highest level of security.









 Account-based MFA options 

Classic infrastructure

An account administrator can enable any of the following legacy MFA options to be configured and used by a user in the account. Account-based MFA options are available only with classic infrastructure accounts and only protect classic infrastructure resources. This type of MFA is tied to the account. If an administrator enables a different legacy MFA option for each account that a user is a member of, the user is prompted to authenticate a different way each time that they switch accounts.

If an account requires any ID-based MFA, that factor overrides any legacy account-based MFA options that are enabled and set up in a user's account.
lhbr_root_password This password is the IBM Cloud supplied initial root password that is provided after provisioning of the Linux bare metal server. It is used to initially connect to the server for configuration and stored in the Ansible® vault file. 
 sa_ansible_password A complex password that is stored in the Ansible vault file that is used for the sa-ansible service account on the Veeam backup server. 
 immutability_period The required immutability period for the Linux Hardened repository. For example, 30 for 30 days. 
 max_concurrent_jobs Specifies the maximum allowed number of concurrent tasks for the backup repository. For example, Veeam recommends one task = one CPU core and 2 GB RAM per core. For more information, see [Task limitation for backup repositories](https://helpcenter.veeam.com/docs/backup/vsphere/limiting_tasks.html?ver=120). 







 Isolated recovery environment planning 

The following information is needed for the isolated recovery environment planning:



Table 3. Parameters for Isolated recovery environment planning

 Parameter Description 

 <public_key> A public key for vSRX user. 
 <vSRX_private_ip> The private IP of the vSRX that is reachable from the automation server. 
 <proxy_1_ip> The IP address of the Veeam cyber-proxies in the production environment. Multiple proxies are possible. 
 <lhbr_ip> The IP address of the Linux hardened repository server. 
 <vcsa_fqdn> The FQDN or IP address of the vCenter appliance in the production environment. 
 <vcsa_user> The username of the account in vCenter appliance in the production environment. 
 <vcsa_user_password> The password for the vcsa_user. 
 <sub_domain> The subdomain of the root domain of the vCenter appliance in the production environment. 







 Related links
Where "password" is the key material you want to use.

To avoid extra characters, for example an extra new line, it is a best practice to copy the base64 to the clipboard, especially when the base64 string is going to be posted in the console.





 Using OpenSSL to create and encode new key material 

Use this process to create a random base64-encoded key material with a specific byte length. 32 bytes (256 bits) is recommended.

You would create a 16-, 24-, or 32-byte key material, for use as a standard key, if you want the standard key to have the same characteristics as a root key. A standard key is one which can leave the service. Standard keys are often used in your apps and services.



1. Download and install [OpenSSL](https://github.com/openssl/opensslfor-production-use).
2. Base64-encode your key material string by running the following command:

openssl rand -base64 <byte_length>

Replace the variable in the example request according to the following table.





Table 3. Describes the variable that is needed to create and encode new key material.

 Variable Description 

 byte_length The length of the key, measured in bytes. <br> <br>Acceptable byte lengths are 16, 24, or 32 bytes, corresponding to 128, 192, or 256 bits in length. The key must be base64-encoded. 





 Key Material Creation Examples 



1. openssl rand -base64 16 will generate a 128-bit key material.
2. openssl rand -base64 24 will generate a 192-bit key material.
3. openssl rand -base64 32 will generate a 256-bit key material.











 What's next 



* To find out more about programmatically managing your keys, [check out the Key Protect API reference doc](https://cloud.ibm.com/apidocs/key-protect).
Authentication Password A password for the user - might be shown as $PASSWORD 
 Authentication Method How authentication takes place; "direct" authentication is handled by the driver. 
 Hosts 0... A hostname and port to connect to 
 Composed 0... A URI combining Scheme, Authentication, Host, and Path 
 Certificate Name The allocated name for the self-signed certificate for database deployment 
 Certificate Base64 A base64 encoded version of the certificate. 





* 0... indicates that there might be one or more of these entries in an array.



Many RabbitMQ drivers are able to make a connection to your deployment when given the URI-formatted connection string found in the "composed" field of the connection information. For example,

amqps://$USERNAME:$PASSWORD@f08da56c-f975-4cad-98a5-633b8b5a8e79.974350db55ab4ec0983f023940bf637f.databases.appdomain.cloud:30402

Here are a few of the common RabbitMQ drivers:



* [AMQP 0-9-1 library and client for Node.JS](https://www.npmjs.com/package/amqplib)
* [RabbitMQ Java Client Library](http://www.rabbitmq.com/java-client.html)
* [Bunny RabbitMQ Ruby Client](http://rubybunny.info/)
* [Pika Python protocol](https://pika.readthedocs.io/en/stable/)







 Connecting with a STOMP client 

The information a STOMP client needs to make a connection to your deployment is in the stomp_ssl section of your connection strings. The table below contains a breakdown for reference.



Table 2. RabbitMQ/stomp_ssl connection information

 Field Name Index Description 

 Type Type of connection - for STOMP, it is stomp 
 Authentication Username The username that you use to connect. 
 Authentication Password A password for the user - might be shown as $PASSWORD
The username and password need to be separated by a :, and the password must be encrypted using the vcrypt program shipped with the Data Crawler. For example: username:[vcrypt/3]]passwordstring
* max-data-size - Maximum size of the data for a document. This is the largest block of memory that is loaded at one time. Only increase this limit if you have sufficient memory on your computer.
* filter-exact-duplicates - Internal use only.
* timeout - Internal use only.
* jdbc-class (Extender option) - When specified, this string overrides the JDBC class used by the connector when (other) is chosen as the database system.
* connection-string (Extender option) - When specified, this string overrides the automatically generated JDBC connection string. This allows you to provide more detailed configuration about the database connection, such as load-balancing or SSL connections. For example: jdbc:netezza://127.0.0.1:5480/databasename
* save-frequency-for-resume (Extender option) - Specifies the name of a column or associated label, to resume a crawl or do a partial refresh. The seed saves the name of this column at regular intervals as it proceeds with the crawl and saves it again, when the last row of your database is crawled. When resuming the crawl or refreshing it, the crawl begins with the row that is identified in the saved value for this field









 Configuring CMIS crawl options 

The CMIS (Content Management Interoperability Services) connector lets you crawl CMIS-enabled CMS (Content Management System) repositories, such as Alfresco, Documentum or IBM® Content Manager, and index the data that they contain.



 Configuring the CMIS Connector 

Following are the basic configuration options that are required to use the CMIS connector. To set these values, open the file config/connectors/cmis.conf and specify the following values specific to your use cases:



* protocol - The name of the connector protocol used for the crawl. The value to use this connector must be cmis.
In addition, you also have the option to store the password as a custom standard key in an instance of IBM® Key Protect to which you have access, and then use the CRN of this custom standard key instead of the plain text password. For more information, see [Setting up custom secrets in Key Protect](https://cloud.ibm.com/docs/sql-query?topic=sql-query-kpsetup) about how to store the password securely. This option will be deprected in the future.





 Custom API key for each data resource 

As an alternative to providing user and password combinations, in IBM Cloud you can also securely pass API keys for each resource location. Using the APIKEY keyword inside the according FROM or INTO clauses, you can pass in this information. To ensure that the passing of sensitive data is secure, first store the API key as an IAM credential in a Secrets Manager service instance to which you have access, and then use the CRN of this IAM credential instead of the plain text password. For more information, see [Creating IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials&interface=ui) on how to store the API key securely and the options for rotating the API key automatically.

You also have the option to store the API key as a custom standard key in a Key Protect service instance to which you have access, and then use the CRN of this custom standard key instead of the plain text password. For more information, see [Setting up custom secrets in Key Protect](https://cloud.ibm.com/docs/sql-query?topic=sql-query-kpsetup) on how to store the API key securely. This option will be deprected in the future.







 Supported authentication methods per data resource for Data Engine 



Table 1. Supported

 Authentication method IBM Cloud® Object Storage IBM® Db2® on Cloud IBM® Db2® Warehouse on Cloud 

 IAM SSO Yes Enterprise Enterprise 
 CRN with Service Credentials No Yes Yes 
 User and password through Secrets Manager CRN No Yes Yes 
 User and password through Key Protect CRN No Yes Yes 
 API key through Secrets Manager CRN No Enterprise Enterprise