vania-janet/multiturn-rag-retrieval-data huggingface dataset:
username (recommended) preferred_username if present, otherwise sub Mapped from SAML assertion "preferred_username", "username", "user_name" or "userName" if available. Otherwise, the App ID generated "sub" claim is used When you work with the CLI, APIs, or the IBM Cloud Kubernetes Service, the username displays. A username is often an email address, but can also be a different value. If the username is not provided by App ID, IAM uses the identifier instead. 
 firstname (recommended) given_name if available, otherwise "notset" as default Mapped from SAML assertion "given_name", "givenname", "givenName", "first_name", "firstname" or "firstName" if available, otherwise IAM uses the constant "notset" The first name of the user that logs in. 
 lastname (recommended) family_name if available, otherwise "notset" as default Mapped from SAML assertion "family_name", "familyname", "familyName", "last_name", "lastname" or "lastName" if available, otherwise IAM uses the constant "notset" The last name of the user that logs in. 
 name (optional) name if present, otherwise built by the firstname, a space, and the last name There is no automatic mapping from SAML Full name, including middle initial, title, or anything that is not covered by first name and last name 



When a user authenticates successfully by using the App ID service instance in the IBM Cloud account, the user is automatically added to the account. Added users don't get any access policies assigned by default. However, by using [access groups](https://cloud.ibm.com/docs/account?topic=account-groups) and [dynamic rules](https://cloud.ibm.com/docs/account?topic=account-rules), you can set up automatically assigned access policies.







 Enabling and connecting your identity provider 

If you haven't configured any IAM IdP references before in your account, you must enable the login setting for your account first.



1. Enable the login settings for your account.
When you tag a service ID, all policies that have resources that are scoped to your access management tag include access to this service ID.





 Attaching tags to a service ID by using the CLI 

The allowed values for the tag_type query parameter are: user for user tags and access for access management tags. The following example shows how to attach an access management tag that is called project:myproject to a service ID.

To add a tag to a service ID, complete the following steps:



1. Choose to attach an access management tag or a user tag.



* If you want to attach an access management tag, you must first create the tag. For more information, see [Creating tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=clicreate).
* If you want to attach a user tag, you don't need to create the user tag to attach it to resources or service IDs. Attaching the tag also creates it.



2. To attach the tag to your service ID, use the tag-attach command. For more information, see the [CLI command reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource).

ibmcloud resource tag-attach --tag-names project:myproject --resource-name 'ServiceIdName' --tag-type access



When you tag a service ID, all policies that have resources that are scoped to your access management tag include access to this service ID.





 Attaching tags to a service ID by using the API 

To add a tag to a service ID, complete the following steps:



1. Choose to attach an access management tag or a user tag.



* If you want to attach an access management tag, you must first create the tag. For more information, see [Creating tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=clicreate).
* If you want to attach a user tag, you don't need to create the user tag to attach it to resources or service IDs. Attaching the tag also creates it.
You can create or delete an App ID instance. 
 Administrator All management actions for all services in the account. You can perform all operator actions and the ability to assign policies to other users. 







 Service access roles 

The following table details actions that are mapped to service access roles. Service access roles enable users to access App ID and to call the App ID API.



Table 2. Service roles and the actions that the role can take

 Service role Example actions 

 Reader <br><br> * View the post-authentication redirect URLs that are configured in your instance.<br> * View the identity provider configuration or a view the configuration for a single identity provider.<br> * View the overview page of your app.<br> * View the current configuration of the Login Widget including the logo, color, and language.<br> * View the current configuration of your tokens.<br> * View the action URLs that are configured for Cloud Directory.<br> * View a single action URL that is configured for Cloud Directory.<br> * View advanced password policy configurations.<br> * View a Cloud Directory password policy in regex form.<br> * View the current email template configuration.<br> * View Cloud Directory email sender details.<br> * View user information from your app configuration.<br> * View your Cloud Directory users and their data.<br> * View a user profile.<br> * Search all your user profiles and get a count of any anonymous users.<br> * View all the apps that are registered with your instance of App ID.<br> * View a specific app that is registered with App ID.<br> * View the email provider configuration.<br> * View a JSON object that contains the auditing status of the tenant.<br> * View all the MFA channels.<br> * View an MFA channel.<br> * View the current MFA configuration.<br> * View the Cloud Directory SSO configuration.<br> * View a Cloud Directory user and their information.<br> * View your rate limit configuration.<br> * View the roles that are associated with a scope.<br> * View the roles that are assigned to a specific user.<br> * View a registered extension's configuration.<br><br><br>
For more information, see [Using the Login Widget](https://cloud.ibm.com/docs/appid?topic=appid-login-widget).

In the Cloud Directory dashboard, you can [configure the level of self-service](https://cloud.ibm.com/docs/appid?topic=appid-cd-users) you want to allow in your application. You can use the Cloud Directory APIs and dashboard to allow users to change their account details and password through App ID's prebuilt screens for those functions. You can update the settings at any time without needing to change your code or redeploy your application.





 Brand your app with custom UIs and flows 

You can [replace the default App ID sign-in](https://www.ibm.com/blogs/cloud-archive/2018/06/custom-login-page-app-id-integration/) and sign-up UIs and flows with customized options to support your brand recognition and policies. For more information, see [Branding your app](https://cloud.ibm.com/docs/appid?topic=appid-branded). When a user signs up to use your app, you can customize the flow in various ways. For example, you can add extra fields to the flow (for example, phone number), validate the [password length by policy](https://cloud.ibm.com/docs/appid?topic=appid-cd-strength), and accept only specific email addresses or check emails against a blocklist.

You can customize the sign-in flow by [configuring the forgot password process](https://cloud.ibm.com/docs/appid?topic=appid-cd-strength). Additionally, you can [enable single sign-on (SSO)](https://cloud.ibm.com/docs/appid?topic=appid-cd-sso) to provide your users a smooth authentication experience between multiple web apps. App ID provides SSO for Cloud Directory users. Therefore, if enabled, your users do not need to reenter their credentials every time they sign-in.
Can be found in the Profiles and roles > User Profiles tab. 
 appid.users.create Create pre-registered user profile. Can be found in the Profiles and roles > User Profiles tab. 
 appid.users.get Export user profiles. Must be done through the API. 
 appid.refresh-token.revoke Revoke all the refresh tokens that are issued for the user. Must be done through the API. 
 appid.users.import Import user profiles. Must be done through the API. 
 appid.user-profile.read View a user profile. Can be found in the Profiles and roles > User Profiles tab. 
 appid.user-profile.update Update a user profile. Can be found in the Profiles and roles > User Profiles tab. 
 appid.user-profile.bulkdelete Delete a list of user profiles. Can be found in the Profiles and roles > User Profiles tab. 
 appid.user-roles.read View the user roles. Can be found in the Profiles and roles > User Profiles tab. 
 appid.user-roles.update Update the user roles. Can be found in the Profiles and roles > User Profiles tab. 
 appid.roles.read View the roles list. Can be found in the Profiles and roles > Roles tab. 
 appid.roles.create Create a role. Can be found in the Profiles and roles > Roles tab. 
 appid.role.read View the role. Can be found in the Profiles and roles > Roles tab. 
 appid.role.update Update the role. Can be found in the Profiles and roles > Roles tab. 
 appid.applications.read View the applications list. Can be found in the Applications tab. 
 appid.applications.create Create an application. Can be found in the Applications tab. 
 appid.application.read View the application. Can be found in the Applications tab. 
 appid.application.update Update the application. Can be found in the Applications tab. 
 appid.application-scopes.read View the application scopes. Can be found in the Applications tab.
Leave the "name" fields as given in the example, and enter certain "value" fields as follows.<br><br><br><br> * For "accountId": Enter your IBM Cloud account ID that you previously retrieved.<br> * For "serviceName": Leave the service name as given: containers-kubernetes.<br> * For "serviceInstance": Enter your cluster ID. For multiple clusters, separate with a comma. To get your cluster ID, run ibmcloud ks cluster ls.<br> * For "namespace": Enter a Kubernetes namespace in your cluster. To list the namespaces in your cluster, run kubectl get namespaces.<br><br><br><br>To assign the access policy to all namespaces in a cluster, remove the entire {"name": "namespace", "value": "<namespace_name"} entry. 



3. Apply the IBM Cloud IAM policy to an individual user or access group.



* For individual users

ibmcloud iam user-policy-create <user@email.com> --file <filepath>/policy.json
* For access groups

ibmcloud iam access-group-policy-create <access_group> --file <filepath>/policy.json



4. If you assigned only service access roles to users, the users must [launch the Kubernetes dashboard from the CLI](https://cloud.ibm.com/docs/containers?topic=containers-deploy_appdb_cli) instead of the IBM Cloud console. Otherwise, [give the users the platform Viewer role](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users_cli_platform).
5. Optional: After a couple minutes, verify that the user is added to the corresponding [RBAC role binding or cluster role binding](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-rbac).



Users must run the ibmcloud ks cluster config command for their role changes to take effect.
<br><br> * Invite users to your account<br><br><br> Users are invited to an account and given access to the resources. Use IAM to invite users, cancel invitations, or resend a pending invitation. You can invite a single user or multiple users. Start [inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv). 
 <br><br> * Set up trusted profiles<br><br><br> Trusted profiles are used to automatically grant federated users access to your account with conditions based on SAML attributes from your corporate directory. Trusted profiles can also be used to set up fine-grained authorization for applications that are running in compute resources. This way, you aren't required to create service IDs or API keys for the compute resources. Learn more about [creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile). 
 <br><br> * Create service IDs<br><br><br> A service ID identifies a service or application similar to how a user ID identifies a user. You can create a service ID and use it to enable an application outside of IBM Cloud access to resources in your account. Learn more about [creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids&interface=ui). <br>If you have configured a Secrets Manager instance as described in [Encrypt and protect your data](https://cloud.ibm.com/docs/overview?topic=overview-get-started-checklistsecuring), you can use that instance to dynamically generate a service ID and an API key each time a protected resource is read or accessed. For more information, see [Creating IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials&interface=ui).
If you want to learn more about enrollments, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register). Click Next.
3. This tutorial does not configure attributes on identities. Click Register user.
4. After the organization admin has been registered, repeat this same process for the identity of the ordering nodes. Use the information in the table below to register the ordering node user for the ordering nodes with an Enroll ID of os1 and secretos1pw. This is an ordering node identity, so be sure to select orderer from the Type drop-down list.
5. You can also register identities of type orderer with the TLS CA. Completing this optional step for your orderer's admin identity allows viewing additional channel details for the orderer nodes that use this identity. Repeat steps 1-2 above, changing the Certificate Authority drop-down selection from Root Certificate Authority to TLS Certificate Authority.





 Task: Create a CA and register users 



Table 3. Register users with CA

 Field Description Enroll ID Secret Type 

 Create CA Multiregion OS CA admin adminpw client 
 Register users Ordering Service admin osadmin osadminpw admin 
 Ordering Service node 1 identity os1 os1pw orderer 



You could register a new user for each ordering node, but to keep things simple we will reuse the same user enroll ID and secret for each ordering node. Reusing the enroll ID is acceptable in this case because a unique certificate is generated when the ordering node is created and the identity is enrolled. But it is important to ensure that you have not restricted the maximum enrollments for the user when it is initially registered so that a new certificate can be generated when the user is enrolled when each ordering node is created. The default value of maximum enrollments is unlimited.







 Create the ordering service organization MSP definition 

Create your ordering service organization MSP definition and specify the admin identity for the organization.
Remember that nodes have identities just as admins and users do. So we'll use peer1 and peer1pw as the enroll id and secret of the peer. This is a peer so we need to use the “peer” type, again using default affiliations and ignoring enrollments and attributes.

So now that we have registered the two identities we can create the definition of org1, which is represented by an MSP. We do that through the Organizations tab. Click create. We’ll use an msp display name of Org1 MSP and an mspid of org1msp. Then specify org1 CA. You’ll see some values in the fields below. They’re the enroll ID and secret you entered when creating the admin of the CA. You don't want to use them as the admin of org1 as well. You want to create separate identities for the admins of your components. In this case that means using the identity you registered to be the admin of org1, org1admin and org1adminpw, and giving this identity the name Org1 MSP Admin. Then click generate. This will enroll the identity and put it in your wallet. Then export it. A JSON representing the Org1 Admin will be downloaded to your system. Make sure you always export your identities and MSPs as they’re only stored in the browser. If you switch to a different browser or a different machine, you won’t be able operate your components without uploading the admin of that component. When that is done, we can create this MSP definition. After which, we check our wallet and see that the Org1 Admin is there.

Now we can create the peer. Let’s give this peer a display name of Peer Org1. Again this is a display name for the UI. If you do not check any of the boxes below, default values for the various options will remain selected. To inspect these values, for example the default resources that will be allocated to the peer, click the box. You will also have a chance to review these values on the summary screen. For now, accept the defaults by leaving these boxes deselected.
You can add a service such as Personality Insights to help understand your app's user by completing the following steps:



1. Create an instance of the service by calling [Resource Controller API](https://cloud.ibm.com/apidocs/resource-controller/resource-controller?code=gocreate-resource-instance) as shown in the following example request:



* Curl
* Java
* Python
* Go
* Node



curl -X POST https://resource-controller.cloud.ibm.com/v2/resource_instances -H 'Authorization: Bearer <>' -H 'Content-Type: application/json' -d '{
"name": "my-instance",
"target": "bluemix-global",
"resource_group": "5g9f447903254bb58972a2f3f5a4c711",
"resource_plan_id": "0be5ad401ae913d8ff665d92680664ed",
"tags": [
"my-tag"
]
}'

CreateResourceInstanceOptions createResourceInstanceOptions = new CreateResourceInstanceOptions.Builder()
.name(resourceInstanceName)
.target(targetRegion)
.resourceGroup(resourceGroup)
.resourcePlanId(resourcePlanId)
.build();

Response<ResourceInstance> response = service.createResourceInstance(createResourceInstanceOptions).execute();
ResourceInstance resourceInstance = response.getResult();

System.out.printf("createResourceInstance() response:n%sn", resourceInstance.toString());

resource_instance = resource_controller_service.create_resource_instance(
name=resource_instance_name,
target=target_region,
resource_group=resource_group,
resource_plan_id=resource_plan_id
).get_result()
* [How to create an SAP S-user ID](https://www.youtube.com/watch?v=4wICiRTP8u0) Note that only super administrators or S-users with the required authorization are allowed to create S-user IDs for your company's SAP Customer Number (SCN)
* The [Guide Finder for SAP NetWeaver and ABAP Platform](https://help.sap.com/viewer/nwguidefinder) to search for SAP NetWeaver-related documentation, including installation guides.
* Applicable [installation guides](https://support.sap.com/en/my-support/software-downloads.html); requires an SAP S-user ID.
* SAP release notes, which can be found in the application help of the relevant SAP product documentation on the [SAP Help Portal](https://help.sap.com/viewer/index); requires an SAP S-user ID.
* [SAP HANA Help](https://help.sap.com/viewer/product/SAP_HANA_PLATFORM)
* [SAP NetWeaver Help](https://help.sap.com/viewer/product/SAP_NETWEAVER/ALL/en-US)
* [SAP HANA Installation Guide](https://www.sap.com/products/hana/technical.html)
* [SAP Product Availability Matrix (PAM)](https://support.sap.com/en/release-upgrade-maintenance.htmlsection_1969201630); requires an SAP S-user ID.
* [SAP Notes](https://support.sap.com/en/my-support/knowledge-base.html); requires an SAP S-user ID.
* Third-party documentation







 Selecting your SAP-certified infrastructure 

The below expands on the introducton [Comparing the different SAP-certified IaaS offerings](https://cloud.ibm.com/docs/sap?topic=sap-overviewiaas-offerings-compare-summary), which summarises the benefits of each different Infrastructure option.

You are ready to define the number of host servers and size of those hosts after:



* the business has defined their requirements
* decided which SAP applications to use
* Assign access to the trusted profile by adding it to one or more access groups. This way, you can use the policies that exist in the access groups you've created.



1. Select Access groups and select all the groups that you want to add the trusted profile to. You can assign users to only the access groups that you have access to manage.
2. Click Add.



* Assign access to the trusted profile with an access policy.



1. Select Access policy. Based on your level of access, you can assign IAM policies and classic infrastructure permissions.
2. Select a single service or a group of services, like All Identity and Access enabled services, All Account Management services, or All IAM Account Management services. Then, click Next.
3. Scope the access to All resources or Specific resources based on selected attributes. Then, click Next.
4. Select any combination of roles and permissions to define the scope of access, and click Review.
5. Click Add to add your policy configuration to your summary.
6. You can assign Classic infrastructure access by selecting a user, device, or service, then any combination of granular permissions.





2. Click Create.







 Establishing trust with federated users by using the CLI 

Complete the following steps to define which federated users can access specific resources:



1. [Enable authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).
2. Create a trusted profile by running the following command:

ibmcloud iam trusted-profile-create my-profile -d "sample trusted profile"

For more information, see the [CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_create).
3. To create conditions for your trusted profile, run the ibmcloud iam trusted-profile-rule-create command:
To add a custom resolver location using the API, follow these steps:



1. Set up your API environment with the correct variables.
2. Store the following values in variables to be used in the API command:



* instance_id, which is the unique identifier of a service instance.
* resolver_id, which is the unique identifier of a custom resolver.
* X-Correlation-ID, which is a string that uniquely identifies a request.



3. When all variables are initiated, get the details of your custom resolver:

{
"subnet_crn": "crn:v1:bluemix:public:is:us-south-1:a/01652b251c3ae2787110a995d8db0135::subnet:0716-b49ef064-0f89-4fb1-8212-135b12568f04",
"enabled": false
}
To enable user group administrators, specify users or user groups in the GROUP_ADMIN column, separate users and user groups with spaces, and enclose each GROUP_ADMIN entry in brackets.
5. Save your changes.
6. Run badmin ckconfig to check the new user group definition. If any errors are reported, fix the problem and check the configuration again.
7. Run badmin reconfig to reconfigure the cluster.







 Manage the LSF cluster 

After you log in, you can use the EGO commands to manage the LSF cluster, such as egosh resource, egosh job, egosh host, and so on (as shown in the following example).

To complete the following steps, you need to use an LSF user account with high privileges. Only an account with high privileges can add the users to LSF cluster and then assign roles to them. Howvever, if the newly added user is assigned CLUSTER_Admin role, then that user can also complete the following steps for subsequently added users.



1. To add the existing user, "user1lsf", that was created in the OLDAP server to the LSF cluster, you need to log in as the cluster administrator, and then run the following commands:

[root@icgen2host-172-19-1-69 ] su Lsfadmin
bash-4.4$ egosh user logon -u Admin -x Admin
Admin@HPCCluster> user add
user account: user1lsf
password:
password(type again, please):
User account < user1lsf > added successfully
Admin@HPCCluster>@HPCCluster> user logoff
Logged off successfully
2. Log in with the user that was added in the previous setp to the LSF cluster by running the following commands:

[root@icgen2host-172-19-1-69 ] su user1lsf
bash-4.4$ egosh user logon -u user1lsf -x welcome@31!
Logged on successfully
bash-4.4$ egosh