vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Manage ID provider users with the ID provider 

App ID creates an ID provider so you can add users directly in App ID or connect to other external ID providers. This tutorial describes how to set up your ID provider to work with users that do not have IBM Cloud accounts.

To manage users via IBM Cloud, see one of these topics:



* [Manage IBM Cloud users](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-cloud-provider-org)
* [Manage ID provider users with IBM Cloud](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-cloud-org)





 Step 1: Create an App ID instance 



1. [Open App ID from the IBM Cloud catalog](https://cloud.ibm.com/catalog/services/app-id) and log in if necessary. Specify the following values:



* For Select a location, it is recommended that you keep it in the same location as the Qiskit Runtime service, which is Washington DC (us-east).
* Select a pricing plan:



* The Lite plan is free of charge and is enough to get started. If needed, you can seamlessly upgrade to the graduated tier later.
* The Graduated tier is paid per event and per user beyond the lite tier limits. This tier supports more features such as multi-factor authentication. The Cloud administrator as the owning account of the App ID instance is charged for any fees for the graduated tier instances.



* Complete the values for Service name (the App ID instance name), Resource group (if one is being used), and any tags you want.



Zoom

![Create App ID instance](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/includes/images/org-guide-create-appid.png)

Figure 2. Create your APP ID instance
2. Read and agree to the terms and click Create.
3. On the Authentication Method screen, select OAuth 2.0 with JWT (Server Authentication) and click Next.
4. Name your app and click the Create App button. After you create your Box app, click View Your App.
5. While viewing your app, select Application access as Application. You can use your existing managed users as you continue; you are not required to create new ones.
6. Scroll down to the Application Scopes section of the page and enable the following checkboxes:



* Read and write all folders stored in Box
* Manage Users



7. Scroll down to the Advanced Features section and enable the following toggles:



* Perform Actions as Users
* Generate User Access Tokens



8. Click the Save Changes button.



The next few steps require assistance from the administrator of your organization's Box account. If you are not your organization's Box Administrator, you can identify the Administrator by opening the Box developer's console and looking under Account settings > Account details > Settings.



1. [Administrator step] Authorize your application client id at https://app.box.com/master/settings/openbox by clicking the Authorize New App button.
2. [Administrator step] Type the client ID from https://app.box.com/developers/console into the API key field and then click the Authorize button.
3. [Administrator step] Retrieve a developer token for the application. To do this, navigate to https://app.box.com/developers/console, scroll to the Developer Token section and generate your token.
4. Now that the administrator authorized the application, navigate to https://developer.box.com/referencepage-create-an-enterprise-user and create an App User using the API reference page.

Curl example to create an App User:

curl https://api.box.com/2.0/users -H "Authorization: Bearer ACCESS_TOKEN" -d '{"name": "NedStark", "is_platform_access_only": true}' -X POST
5.
When you create a user, it is assigned certain database roles and privileges. These privileges include the ability to login, create databases, and create other users. For more information, see the [Managing Users, Roles, and Privileges](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-user-management) page.



 Creating Users in the UI 



1. Navigate to the service dashboard for your service.
2. Click Service Credentials to open Service Credentials.
3. Click New Credential.
4. Choose a descriptive name for your new credential.
5. Optional Specify if the new credentials should use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings using the specified endpoint. Use of the endpoint is not enforced, it just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated database user in the PostgreSQL database are auto-generated.



The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.





 Creating Users from the CLI 

If you manage your service through the IBM Cloud CLI and the [cloud databases plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), you can create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command.

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

Once the task has finished, you can retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.





 Creating Users from the API
Manage ID provider users with IBM Cloud 

App ID creates an ID provider so you can add users directly in App ID or connect to other external ID providers. This tutorial describes how to set up your ID provider to work with IBM Cloud users, and gives instructions for users to access the environment.

To manage users in a different way, follow the instructions in one of these topics:



* [Manage IBM Cloud users](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-cloud-provider-org)
* [Manage ID provider users with the ID provider](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-org)





 Step 1: Create an App ID instance 



1. [Open App ID from the IBM Cloud catalog](https://cloud.ibm.com/catalog/services/app-id) and log in if necessary. Specify the following values:



* For Select a location, it is recommended that you keep it in the same location as the Qiskit Runtime service, which is Washington DC (us-east).
* Select a pricing plan:



* The Lite plan is free of charge and is enough to get started. If needed, you can seamlessly upgrade to the graduated tier later.
* The Graduated tier is paid per event and per user beyond the lite tier limits. This tier supports more features such as multi-factor authentication. The Cloud administrator as the owning account of the App ID instance is charged for any fees for the graduated tier instances.



* Complete the values for Service name (the App ID instance name), Resource group (if one is being used), and any tags you want.



Zoom

![Create App ID instance](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-create-appid.png)

Figure 2. Create your APP ID instance
2. Read and agree to the terms and click Create.
To log in with a federated ID, use the --sso flag. See [Logging in with a federated ID](https://cloud.ibm.com/docs/account?topic=account-federated_id) for more details.

If it's your first time using the IBM Cloud CLI, check out the [getting started tutorial](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
2. Create an access policy and assign it to a user or a service ID by using the command [ibmcloud iam user-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policy_create).
3. Assign access to All Account Management services with the Editor role:

ibmcloud iam service-policy-create name@example.com --roles Editor --account-management --api-version v2
4. Use the following example of a recurring weelky time-based policy in JSON schema to create your own conditions:

{
"type": "access",
"description": "time-based conditions policy example restricting access to the full day of 2022-12-23 UTC",
"control": {
"grant": {
"roles": [
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
]
}
},
"resource": {
"attributes": [
{
"operator": "stringEquals",
"value": "d4b763ad0cbd4dca8dd1edb427d7a77e",
"key": "accountId"
},
{
"value": "platform_service",
"operator": "stringEquals",
"key": "serviceType"
}
]
},
clientID The unique identifier for your application. You can find this value in the credentials for your app as they're listed in your Applications in the service dashboard. 
 scopesObject A JSON object of all the scopes that you want to create for your application. 
 {: caption="Table 1. Required variables to call the /scopes endpoint" caption-side="top"} 



2. Optional: Confirm that the scopes were created.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/applications/<clientID>/scopes"
-H "accept: application/json"
-H "Content-Type: application/json"







 Creating roles with the UI 

A role is a group of scopes that apply to the same type of user. For example, if you create an admin role, the scopes section might allow for that role to perform read, write, or create actions. But, if you create another role that is called viewer, the users who are assigned that role have read only access. To create a role, you can use the App ID UI.



1. Go to Profiles and roles > Roles in the App ID dashboard.
2. Click Create role to open the configuration screen.
3. Give the role a name and description.
4. By using the scopes that you created in the previous section, assign the scopes to a role by using the following format. Click the + to add the scope.

<appName>/<scope>

If you have only one application, you do not need to specify your app name. You can add the scope by itself.
5. Repeat the previous step to add more scopes.
6. Click Save.







 Creating roles with the API 

A role is a group of scopes that apply to the same type of user. For example, if you create an admin role, the scopes section might allow for that role to perform read, write, or create actions.
* UI
* CLI
* API







 Creating and working with service IDs 

A service ID identifies a service or application similar to how a user ID identifies a user. You can create a service ID and use it to enable an application outside of IBM Cloud access to your IBM Cloud services. You can assign specific access policies to the service ID that restrict permissions for using specific services, or even combine permissions for accessing different services. Since service IDs are not tied to a specific user, if a user leaves an organization and is deleted from the account, the service ID remains, ensuring that your application or service stays up and running.

When you create a service ID, you create a unique name and description that is easy for you to identify and work with in the UI. Then, you can [create API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeyscreate_service_key) specific to each service ID that your application can use to authenticate with your IBM Cloud services. The API key can be set for one-time use or unlimited use. To ensure that your application has the appropriate access for authenticating with your IBM Cloud services, you use access policies that are assigned to each service ID that you create.

The access policies that are associated with a service ID enable specific actions that can be taken when that service ID is used to access a specific service. A single service ID can have multiple policies assigned that define the level of access that is allowed when accessing multiple Identity and access-enabled services, and even different instances of a single service. For example, you have two services with two service instances each. For example, you might assign the Viewer role for all available instances of one service and assign the Editor role for only one instance of a second service. This way you can customize access to multiple services, but use a single API key for authentication to all.

All users have access to create a service ID in an account to which they are a member. However, to allow a user in an account access to view or manage a service ID that they did not personally create, they are required to have access with a role on the IAM identity service account management service.
"user_id" : "356e065e-49da-45f6-afa3-091a7b464f51"
}







 Policy: Ensure that the password does not include user name 

For stronger passwords, you might want to prevent users from creating a password that contains their username or the first part of their email address.

To set this configuration by using the GUI:



1. Go to the Cloud Directory > Password policies tab of the App ID dashboard.
2. Toggle Advanced password policy to Enabled.
3. Toggle Password should not contain user ID to Enabled.
4. Click Save.



This constraint is not case-sensitive. Users are not able to alter the case of some or all the characters to use the personal information. To configure this option, toggle the switch to on.
Now that the administrator authorized the application, navigate to https://developer.box.com/referencepage-create-an-enterprise-user and create an App User using the API reference page.

Curl example to create an App User:

curl https://api.box.com/2.0/users -H "Authorization: Bearer ACCESS_TOKEN" -d '{"name": "NedStark", "is_platform_access_only": true}' -X POST
5. Copy the newly generated id field contents and provide them to the non-administrator connecting the Box application to IBM Watson™ Discovery.
6. Once the App User is created, the folders you want to crawl need to be shared with the App User, and the App User must be given Viewer permissions on those folders. This requires the App User login name from the above curl command response. Example:"login":"AppUser_737729_jmUo@boxdevedition.com".
7. Return to the Box developer console https://app.box.com/developers/console and scroll to the Add and Manage Public Keys section. Click the Generate the public/private keypair and download your keypair file. Open the file.
8. From the keypair file, cut and paste the following fields into the Discovery tooling.



* client_id
* enterprise_id
* client_secret
* public_key_id
* private_key
* passphrase









 Setting up Enterprise level access 



1. Navigate to https://app.box.com/developers/console (use your company's Box URL) and click Create New App.
2. From the Create a New App screen, select Enterprise Integration and click Next.
3. On the Authentication Method screen, select OAuth 2.0 with JWT (Server Authentication) and click Next.
4. Name your app and click the Create App button. After you create your Box app, click View Your App.
5. While viewing your app, select Application access as Enterprise.
If you need to create a new account ID, see [How to Create a New Citrix Account ID/Org ID](https://support.citrix.com/article/CTX106671).
* Citrix API client ID - Enter your Citrix API client ID information. For more information about creating the key pair, see [Create an API client](https://developer.cloud.com/getting-started) from the Citrix Developer site.
* Citrix API client secret - Enter your Citrix API client secret key.



2. Select Validate to validate your credentials. You must have valid credentials to create an order.
3. Enter the resource location for each zone. The resource location is the name that is given for the location of resources. It is not an identifier for IBM Cloud data centers.







 Step 2 - Active Directory topology 



1. Select your Active Directory topology. You have two options:



* IBM Cloud - Deploys a new Active Directory controller on IBM Cloud.
* Extended (multisite) - You use an existing Active Directory and deploy a Domain Controller on IBM Cloud.



2. Enter an Active Directory domain name.
3. (Dedicated host only) Enter an Active Directory safe mode password.







 Step 3 - IBM Cloud account information 

Enter your specific IBM Cloud account information.



* Resource Group - The IBM Cloud resource group for your account. You can select an existing resource group, you cannot create a new one.
* API key - Your API key.







 Step 4 - Infrastructure location and sizing configuration 

All of your virtual server instances are configured identically based on your selections. Specify the:



* Location - The region and zones for this deployment.
* Size of your control plane infrastructure, either Lite, Standard, or Enterprise with Volume Worker. Lite is designed for testing and proof of concept. Enterprise includes Volume Worker, which is used for distributed identity disk creation with large machine catalogs.







 Step 5 - Dedicated Host Specifics 



 Deployment Strategy 

Select the Dedicated Host deployment strategy for your resources. When you deploy a dedicated host, all resources use the same family as the dedicated host profile family.
The email address you log in with is taken as identification for the system administrator. Use the email address and password that you configured earlier.
3. In the configuration page, enter a name (it is used for greetings), your GitHub user name and the access token that you generated before. Click on Initialize. This creates the database tables and inserts some configuration values. Finally, it creates database records for the system administrator and a tenant.

Zoom

![First Step](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution24-github-traffic-analytics/InitializeApp.png)

First Step
4. Once done, you are taken to the list of managed repositories. You can now add repositories by providing the name of the GitHub account or organization and the name of the repository. After entering the data, click on Add repository. The repository, along with a newly assigned identifier, should appear in the table. You can remove repositories from the system by entering their ID and clicking Delete repository.

Zoom

![List of repositories](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution24-github-traffic-analytics/RepositoryList.png)

List of repositories
5. For testing, click on Administration, then Collect statistics. It retrieves the traffic data on demand. Thereafter, click on Repositories and Daily Traffic. It should display collected data.

Zoom

!
* [Use a custom login page with App ID](https://www.ibm.com/cloud/blog/custom-login-page-app-id-integration)
* [Use your own provider for mail sent with App ID](https://www.ibm.com/cloud/blog/use-ibm-cloud-app-id-and-your-email-provider-to-brand-mails-sent-to-app-users)
* [Using your own SendGrid account With App ID](https://www.ibm.com/cloud/blog/using-your-own-sendgrid-account-with-app-id)
"account_id": "ACCOUNT_ID"
}'

CreateServiceIdOptions createServiceIdOptions = new CreateServiceIdOptions.Builder()
.accountId(accountId)
.name(serviceIdName)
.description("Example ServiceId")
.build();

Response<ServiceId> response = service.createServiceId(createServiceIdOptions).execute();
ServiceId serviceId = response.getResult();
svcId = serviceId.getId();
System.out.println(serviceId.toString());

service_id = iam_identity_service.create_service_id(
account_id=account_id,
name=serviceid_name,
description='Example ServiceId'
).get_result()

svc_id = service_id['id']

print(json.dumps(service_id, indent=2))

createServiceIDOptions := iamIdentityService.NewCreateServiceIDOptions(accountID, serviceIDName)
createServiceIDOptions.SetDescription("Example ServiceId")

serviceID, response, err := iamIdentityService.CreateServiceID(createServiceIDOptions)
if err != nil {
panic(err)
}
svcID = serviceID.ID
b, _ := json.MarshalIndent(serviceID, "", " ")
fmt.Println(string(b))

const params = {
accountId: accountId,
name: serviceIdName,
description: 'Example ServiceId',
};

iamIdentityService.createServiceId(params)
.then(res => {
svcId = res.result.id;
console.log(JSON.stringify(res.result, null, 2));
})
When you create a user, it is assigned certain database roles and privileges. These privileges include the ability to log in and read/write access to the entire key space. For more information, see the [Managing Users and Roles](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-user-management) page.



 Creating Users and Getting Connection Strings in the Service Credentials UI 



1. Navigate to the service dashboard for your service.
2. Click Service Credentials to open the Service Credentials panel.
3. Click New Credential.
4. Choose a descriptive name for your new credential.
5. (Optional) Specify whether the new credentials use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings using the specified endpoint. Use of the endpoint is not enforced. It just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated etcd user is auto-generated.



The new credentials appear in the table, and the connection strings are available as a JSON object in the click-to-copy field under View Credentials.





 Creating Users and Getting Connection Strings from the CLI 

If you manage your service through the IBM Cloud CLI and the [cloud databases plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), you can create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command.

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

Once the task has finished, you can retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.
All users can create service IDs. They are the administrator for those IDs, and they can create the associated API key and access policies, but only users with the operator and administrator role can create IdPs. This account management service applies to the ability to view, update, delete, and assign access to service IDs in the account created by other users.



Table 11. Roles and example actions for the IAM Identity service

 Roles Actions 

 Viewer View IDs 
 Operator Create and delete IDs and API keys<br><br>View, create, update, and delete IdPs<br><br>Update IAM account setting for service IDs and user API key creation<br><br>Delete trusted profiles 
 Editor Create and update IDs and API keys<br><br>View and update IdPs<br><br>Update IAM account setting for service IDs and user API key creation<br><br>Update trusted profiles 
 Administrator Create, update, and delete IDs and API keys<br><br>Assign access policies to IDs<br><br>View, create, update, and delete IdPs<br><br>Update IAM account setting for service IDs and user API key creation<br><br>Create trusted profiles 
 User API Key Creator Can create API keys when the account setting to restrict API key creation is enabled. 
 Service ID Creator Can create service IDs when the account setting to restrict service ID creation is enabled. 







 IBM Cloud Shell settings 

You can assign users access to view and update IBM Cloud Shell settings for the account. Only the account owner or a user with the IBM Cloud Shell administrator role can view and update the settings.



Table 12. Roles and example actions for the IBM Cloud Shell service

 Roles Actions 

 Viewer Not applicable 
 Operator Not applicable 
 Editor Not applicable 
 Administrator View and update IBM Cloud Shell settings 
 Cloud Operator Create Cloud Shell environments to manage IBM Cloud resources. 
 Cloud Developer Create Cloud Shell environments to manage IBM Cloud resources and develop applications for IBM Cloud (Web Preview enabled). 
 File Manager Create Cloud Shell environments to manage IBM Cloudresources and manage files in your workspace (File Upload and File Download enabled). 







 License and entitlement