vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. Locate the volume from the list that you want to add user tags.
3. In the tags column, click Add tags.
4. In the Add tags menu, enter the user tags that you want to apply to this volume. Tags display as you type.

You can also add access management tags to a volume from the Add tags menu. For more information about creating and adding access management tags, see [Apply access management tags to a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storage&interface=clistorage-add-access-mgt-tags).
5. When you're done adding tags, click Save. When you refresh the screen, the list of Block Storage for VPCshows the number of tags that are added in the Tags column.



You can also add tags from the volume details page. To do so, follow these steps.



1. Go to the list of Block Storage for VPC volumes.
2. On the volume details, click Add tags next to the volume name.
3. In the Add tags menu, enter the user tags that you want to apply to this volume. When finished, click Save.







 Adding user tags that are associated with a backup policy to a volume in the UI 

You can add user tags that are associated with a backup policy to a Block Storage for VPC volume. Backup policies schedule automatic creation of backup snapshots. When one volume tag matches a backup policy tag for target resources, it triggers a backup of the volume contents. A backup policy defines a backup plan that schedules when backup snapshots are taken.

From the [volume details](https://cloud.ibm.com/docs/vpc?topic=vpc-viewing-block-storage&interface=uiview-vol-details-ui) page, you can view the backup policies that are applied to the volume and add user tags that are associated with a backup policy.
Member group cpu must be >= 3 and <= 28 in increments of 1. 
 users A list of users that you want to create on the database. Multiple blocks are allowed. 
 Nested scheme for users: 
 name - The user ID to add to the database instance. The user ID must be in the range 5 - 32 characters. 
 password - The password for the user ID. The password must be in the range 10 - 32 characters 
 auto_scaling - Configure rules to allow your database to automatically increase its resources. Single block of autoscaling is allowed immediately. 
 Nested scheme for auto_scaling: 
 Nested scheme for disk: 
 <br><br> * capacity_enabled - Auto scaling scalar enables or disables the scalar capacity.<br><br><br> 
 <br><br> * free_space_less_than_percent - Auto scaling scalar capacity free space less than percent.<br><br><br> 
 <br><br> * io_above_percent - Auto scaling scalar I/O utilization above percent. -> [Average Memory utilization]<br><br><br> 
 <br><br> * io_over_period - Auto scaling scalar I/O utilization over period. -> [Average Disk IO utilization for this period]<br><br><br> 
 <br><br> * io_enabled - Auto scaling scalar I/O utilization enabled.<br><br><br> 
 <br><br> * rate_increase_percent - Auto scaling rate increase percent. -> [Scale up by rate_increase_percent]<br><br><br> 
 <br><br> * rate_limit_mb_per_member - Auto scaling rate limit in megabytes per member.-> [Scale up by rate_increase_percent<br><br><br> 
 <br><br> * rate_period_seconds - Auto scaling rate period in seconds. -> [Scale up by rate_increase_percent every rate_period_seconds]<br><br><br>
For example, when a user logs into your account using an API key, the user is authenticated to access your account. However, this API key may not have permissions to run actions to modify API keys or service IDs in the account. When this happens, you get one of the following messages:



* IAM Identity Service: update user-apikey APIKeyName -failure
* IAM Identity Service: update account-serviceid ServiceIDName -failure



To look for information about the user that has requested a change to an API key or to a service ID, look at the initiator fields in the event.

When a user does not have permissions to run this action in your account, you get a failure event:



* The initiator.name field is empty. This information is not available at the time the event is generated.
* The user ID has been authenticated in your IBM Cloud account.
* The action targets your account.
* The user ID is not authorized to run this action in your account.



To find out the user who has tried to modify an API key or a service ID, complete the following steps:



1. Copy the value of the initiator.id. This field includes the ID of the user that is trying to run this action in your account.
2. Get the email address that is associated with the user. To complete this step, you must have administrator permissions in the account. Run the following command:

ibmcloud iam users --output json | grep -A 1 InitiatorID

Where InitiatorID is the value of the field initiator.id, and has the format IBMid-XXXXXXXXXX.

The output of this command returns 2 fields. The ibmUniqueId field shows the ID of the user that matched the event initiator.name field. The email field shows the email address associated with that ID.



To get the API key on which the action has been requested and failed, see the field prev_instance_name in requestData.





 Resource is locked. Request to update Service ID or API key fails 

When a service ID or an API key are locked, you cannot change any of its attributes.
[root@sdb192 ] cat /etc/iscsi/initiatorname.iscsi
InitiatorName=iqn.2005-05.come.softlayer:SL01SU276540-H986345

An existing entry might have to be replaced in /etc/iscsi/initiatorname.iscsi.



2. Add the following lines to the end of /etc/iscsi/iscsid.conf:



[root@sdb192 ] tail /etc/iscsi/iscsid.conf
 it continue to respond to R2Ts. To enable this, uncomment this line
 node.session.iscsi.FastAbort = No
node.session.auth.authmethod = CHAP
node.session.auth.username = SL01SU276540-H896345
node.session.auth.password = EtJ79F4RA33dXm2q
discovery.sendtargets.auth.authmethod = CHAP
discovery.sendtargets.auth.username = SL01SU276540-H896345
discovery.sendtargets.auth.password = EtJ79F4RA33dXm2q



3. Replace the username and password values in step 2 with th values that you noted during step 5 of Authorizing hosts.
4. Discover the iSCSI target by entering the following lines.



[root@sdb192 ] iscsiadm -m discovery -t sendtargets -p "10.2.62.78"
10.2.62.78:3260,1031 iqn.1992-08.com.netapp:tor0101
10.2.62.87:3260,1032 iqn.1992-08.com.netapp:tor0101



5. Set the host to automatically log in to the iSCSI array.



[root@sdb192 ] iscsiadm -m node -L automatic



6. Install and start the multipath daemon.
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Administrator"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

Show more

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value("EXAMPLE_USER_ID")
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();

PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:iam::::role:Administrator")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
.value(exampleAccountId)
.operator("stringEquals")
.build();

ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
.name("serviceName")
.value("service")
.operator("stringEquals")
.build();
You can specify the ID of the access group on the access_group_id option. For more information, see the argument reference details on the [Terraform Identity and Access Management (IAM)](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_access_group_policy) page.
2. After you finish building your configuration file, initialize the Terraform CLI. For more information, see [Initializing Working Directories](https://www.terraform.io/cli/init).

terraform init
3. Provision the resources from the main.tf file. For more information, see [Provisioning Infrastructure with Terraform](https://www.terraform.io/cli/run).



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply









 Actions and roles for account management services 

The following tables outline the actions that users can take when they are assigned a specific role for each account management service. Review the information to ensure that you are assigning the correct level of access to your users.



 All Account Management services 

To quickly give users a wide-ranging set of account management access, you can assign a policy on all account management services. When a user is assigned a role on All Account Management services, they can complete all of the actions that are associated with that role for each individual service.

The group of All Account Management services includes the following services:



* IAM Access Groups
* IAM Identity service
* IAM Access Management



* Role management



* User Management
* Billing
* Catalog management
* Context-based restrictions
* Enterprise
* Global catalog
* IBM Cloud shell settings
* License and entitlement
* Partner Center
* Partner Center - Sell
* Projects
* Security and Compliance Center
* Software instance
* Support center





Table 1. Roles and example actions for a policy on account management services

 Roles Actions
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Edit next to the access policy you want to update.
4. To assign new access policies, click Assign.



You can select your resources based on resource attributes and assign any combination of roles.





 Assigning access groups 



1. Click the name of the trusted profile that you want to update.
2. Click Access
3. To edit existing access group membership, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Edit next to the access group you want to update.
4. To add the trusted profile to a new access group, click Assign group.
5. Select the access groups to which you want to add the trusted profile and click Add. You can assign users to only the access groups that you have access to manage.
6. Click Assign.









 Updating session duration 



1. Click the name of the trusted profile that you want to update.
2. In the federated users section, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) for the identity provider (IdP) that you want to update.
3. Select Edit
4. In hours, enter how long federated users can use this profile before their session expires.
5. Click Save.









 Updating trusted profiles by using the CLI
[menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. Locate the volume from the list that you want to add user tags.
3. In the tags column, click Add tags.
4. In the Add tags menu, enter the user tags that you want to apply to this volume. Tags display as you type.

You can also add access management tags to a volume from the Add tags menu. For more information about creating and adding access management tags, see [Apply access management tags to a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storage&interface=uistorage-add-access-mgt-tags).
5. When you're done adding tags, click Save. When you refresh the screen, the list of Block Storage for VPCshows the number of tags that are added in the Tags column.



You can also add tags from the volume details page. To do so, follow these steps.



1. Go to the list of Block Storage for VPC volumes.
2. On the volume details, click Add tags next to the volume name.
3. In the Add tags menu, enter the user tags that you want to apply to this volume. When finished, click Save.







 Adding user tags that are associated with a backup policy to a volume in the UI 

You can add user tags that are associated with a backup policy to a Block Storage for VPC volume. Backup policies schedule automatic creation of backup snapshots. When one volume tag matches a backup policy tag for target resources, it triggers a backup of the volume contents. A backup policy defines a backup plan that schedules when backup snapshots are taken.

From the [volume details](https://cloud.ibm.com/docs/vpc?topic=vpc-viewing-block-storage&interface=uiview-vol-details-ui) page, you can view the backup policies that are applied to the volume and add user tags that are associated with a backup policy.
You can choose the combination of the screens that you'd like your users to be able to interact with. For a detailed example, [check out this blog](https://www.ibm.com/cloud/blog/use-branded-ui-user-sign-app-id).



 Sign in 



1. Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI.
2. Add the following code to your application. The sign-in flow is triggered when a user clicks sign in on your custom screen. You get access, identity, and refresh tokens by supplying the user's username and password.

AppID.getInstance().signinWithResourceOwnerPassword(getApplicationContext(), username, password, new TokenResponseListener() {
@Override
public void onAuthorizationFailure (AuthorizationException exception) {
//Exception occurred
}

@Override
public void onAuthorizationSuccess (AccessToken accessToken, IdentityToken identityToken, RefreshToken refreshToken) {
//User authenticated
}
});









 Branding your app with the iOS Swift SDK 

With Cloud Directory enabled, you can call your own branded screens with the [iOS Swift SDK](https://github.com/ibm-cloud-security/appid-clientsdk-swift).



 Sign in 



1. Configure your Cloud Directory [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings) in the GUI.
2. Place the following code in your application. When a user attempts to sign in, your customized screen is called and the authorization and authentication process starts with your customized sign-in page.

class delegate : TokenResponseDelegate {
For more information on the tasks that a user can do based on which account management service they have a policy on and which role they are assigned, see [Example platform management roles and actions for account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-actions-roles). For more information about this new feature, see the [Introducing More Flexibility and Control for IBM Cloud Account Management Services Access](https://www.ibm.com/cloud/blog/announcements/introducing-more-flexibility-and-control-for-ibm-cloud-account-management-services-access) blog post.







 July 2018 



 17 July 2018 

Searching for resources
: You can search for resources from anywhere in the IBM Cloud console. Type the name of a resource in the search field in the console menu bar. Press the Forward Slash key (/) to activate the search.





 12 July 2018 

Dynamically add federated users to access groups
: You can create dynamic rules to automatically add federated users to access groups based on specific identity attributes. When your users log in with a federated ID, the data from the identity provider dynamically maps your users to an access group based on the rules that you set. For more information, see [Creating dynamic rules for access groups](https://cloud.ibm.com/docs/account?topic=account-rules).







 June 2018 



 01 June 2018 

Protect your service IDs and API keys
: To avoid a situation where your service ID or API key is deleted causing an outage or disruption, you can lock service IDs and API keys by using the UI or CLI. Locking a service ID also prevents any access policies from being changed, deleted, or assigned as well as any API keys associated with the service ID from being created or deleted. For more information, see [Locking a service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeyslockkey) and [Locking an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey).







 May 2018 



 31 May 2018
You can use trusted profiles to give a service ID cross-account access and access to call classic infrastructure services. Complete the following steps to define how a service ID can access specific resources in your account:



1. Ask an administrator in the other account for the service ID value that identifies the service ID.

An administrator can find the service ID value by going to Manage > Access (IAM) > Service IDs, and selecting the service ID that you want to target. Click Details and copy the ID that begins with ServiceId.
2. In the IBM Cloud console, click Manage > Access (IAM), and select Trusted profiles.
3. Click Create profile.
4. Define your profile by providing a name and a description, and click Continue.

In the description, provide a list of actions that are available for this trusted profile.
5. You can create the trusted profile before adding details by selecting Decide later. Or, establish trust by completing the following steps:



1. Select Service IDs
2. Enter the service ID value that the administrator provided to you.



6. Click Continue.
7. (Optional) [Assign access to the trusted profile](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profiletp-access).
8. Or, click Create without assigning any access.



Service IDs are static identities that don't use conditions to establish trust. Instead, you establish trust by using the ID value of the service ID's metadata to create a direct link with the trusted entity.





 Assigning access to the trusted profile 

After you establish trust with federated users, compute resources, an IBM Cloud service, or a service ID, you can assign access.

You can assign classic infrastructure access only if your account is linked to a Softlayer account.



1. Assign access.



* Assign access to the trusted profile by adding it to one or more access groups. This way, you can use the policies that exist in the access groups you've created.



1. Select Access groups and select all the groups that you want to add the trusted profile to.
Connection conn = DriverManager.getConnection( "jdbc:db2://<host_name_or_IP_address>:50001/BLUDB:user=<IBMid>;password=<password>;securityMechanism=15;pluginName=IBMIAMauth;sslConnection=true" );









 Console user experience 

The service console login page has the option to log in with your IBMid and password. After the Sign In via IBMid button is clicked, the user is directed to the IAM login page, on which the password is entered. When authentication is completed, the user is redirected back to the console. Before such login can be successful, the IBMid user must be added to each database service instance by the database administrator through the console or REST API. Like for a non-IBMid user, a user ID for the database service instance must be entered at the same time that the IBMid user is added. The user ID needs to be unique within the database service instance. This user ID is also the authorization (AUTH) ID within the database.

To add a user with either an IBMid or a service ID by using the web console, complete the following steps:



1. Log in as a user who has administrator privileges.
2. From the right drop-down menu, select Manage Users.

Zoom

![View of the web console dashboard page and drop-down menu](https://cloud.ibm.com/docs-content/v1/content/68e10678b2f8b8694884ecb5442c326c9b60a3fb/Db2whc/images/manage_users.png)

Figure 1. Selecting Manage Users page from drop-down menu
3. With the Users tab selected, click Add.

Zoom

!
Manage IBM Cloud users 

This tutorial how to use IBM Cloud to enable users who have IBM Cloud accounts and gives instructions for users to access the environment.

To manage ID provider users instead, follow the instructions in one of these topics:



* [Manage ID provider users with the ID provider](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-org)
* [Manage ID provider users with IBM Cloud](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-cloud-org)





 Step 1: Invite users 



1. Ensure that the users that you want to invite have IBM Cloud accounts.
2. Go to Manage → Access (IAM) and click [Invite users](https://cloud.ibm.com/iam/users/invite_users).
3. Enter the email addresses of users to be added.
4. Select the access group or groups of the projects that the users will be part of. These assignments can be changed later.
5. Click Add to confirm the access group selection.
6. Click Invite to send the invitation to the users.

Users cannot be managed until they accept the invitation and log in at least once.







 Step 2: Optional: Modify users' project assignments 



1. Go to [Manage → Access (IAM) → Users](https://cloud.ibm.com/iam/users) and click the user.

Zoom

![Change User Access](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-manage-user.png)

Figure 11. Change User Access
2. Add access groups with Assign group or remove the user from an access group by clicking the three dot menu and choosing Remove user.







 Step 3: User Flow 



1.
Must be viewed from the API. 
 appid.ui-languages.update Update your supported languages. Must be updated through the API. 
 appid.saml-metadata.read View the App ID SAML metadata. Can be found in the Identity Providers > SAML 2.0 Federation tab. 
 ppid.cloud-directory-user.read View a Cloud Directory user. Can be found in the Cloud Directory > Users > View user details tab. 
 appid.cloud-directory-user.update Update a Cloud Directory User. Can be updated in the Users tab. 
 appid.cloud-directory-user.delete Delete a Cloud Directory user. Must be deleted through the API. 
 appid.user.delete Delete a Cloud Directory user and profile. Must be deleted through the API. 
 appid.cloud-directory-users.read View a list of your Cloud Directory users. Can be found in the Cloud Directory > Users tab. 
 appid.cloud-directory-user.update Update your list of Cloud Directory users. Can be updated in the Cloud Directory > Users tab. 
 appid.cloud-directory-user.delete Delete a list of Cloud Directory users. Must be deleted through the API. 
 appid.users.bulkdelete Delete a list of Cloud Directory users and profiles. Must be deleted through the API. 
 appid.cloud-directory-users.get Export Cloud Directory users. Must be done through the API. 
 appid.cloud-directory-users.import Import Cloud Directory users. Must be done through the API. 
 appid.cloud-directory-user-sso.set-off Invalidate all SSO sessions of the user. Must be done through the API. 
 appid.email-dispatcher.read View the email dispatcher configurations. Can be found in the Cloud Directory > Email Templates tab. 
 appid.email-dispatcher.update Update the email dispatcher configurations. Can be found in the Cloud Directory > Email Templates tab. 
 appid.email-dispatcher-test.send Test the email dispatcher. Can be found in the Cloud Directory > Email Templates tab.