vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"appRegion":"Region where service hosted",
"clientSecret":"push app client secret",
"websitePushIDSafari": "website Push ID for safari",
"deviceId":"Optional deviceId for device registration",
"applicationServerKey":"VAPID key",
}
bmsPush.initialize(params, callback)

// with this

var enPush = new ENPush()

function callback(response) {
alert(response)
}

var initParams = {
"instanceGUID": "<IBM-Cloud-en-instance_guid>",
"apikey": "<IBM-Cloud-en-instance-apikey>"; ,
"region": "<IBM cloud region>",
"chromeDestinationId": "<IBM-Cloud-en-instance-chrome-destination-id>",
"chromeApplicationServerKey": "<IBM-Cloud-en-instance-chrome-vapid>",
"firefoxDestinationId": "<IBM-Cloud-en-instance-firefox-destination-id>",
"firefoxApplicationServerKey": "<IBM-Cloud-en-instance-firefox-vapid>",
"safariDestinationId": "<IBM-Cloud-en-instance-safari-destination-id>",
"websitePushIdSafari": "<safari-web-push-id>"
}

enPush.initialize(initParams, callback)

Show more
3. Change the device registration step



* If you are registering without userID

// Replace this
bmsPush.register(function(response) {
alert(response.response)
})

// with this
enPush.register(function(response) {
alert(response)
})
* If you are using user ID for registration

// Replace this
Allows the browser to access data from this server during CORS,
 only if the request comes from a web page from the following origin
add_header 'Access-Control-Allow-Origin' 'https://www.example.com';

 Allows only GET requests
add_header 'Access-Control-Allow-Methods' 'GET';

 Allows the following headers in the browser's request headers
 that may have been added by anything other than what the browser had added automatically
add_header 'Access-Control-Allow-Headers' 'pragma';

 Specifies to the browser how long it should cache this preflight response
add_header 'Access-Control-Max-Age' 1728000;

 HTTP 204 response code means success,
 but also that it should expect no content from this (preflight) response
return 204;
}

 more location context configs

 If it is not a complex CORS situation requiring a preflight response,
 then finally attempt to serve the file whose path falls under this location block's URI path match

 If no such file is found, then present an HTTP 404 code (not found)
try_files $uri =404;
}

 more server context configs
}

 more http context configs
}

Generally, the browser should freely load content when it sees a Access-Control-Allow-Origin: * in the server's CORS response headers according to the [w3 specification regarding that wildcard value](https://www.w3.org/TR/cors/security). However, not all browsers support Access-Control-Allow-Origin: .

If the server must support access from multiple web pages, each served from a different origin, a single origin value for Access-Control-Allow-Origin should be dynamically generated per request. The following is a basic example of such a use case for an Nginx server:

http {
 some http context config


 Input from $http_origin, the value in Origin HTTP header
 Output to $cors_allowed_origin, a string

 Full string match on the Origin header value
CORS and CORS requests through your CDN 

Cross Origin Resource Sharing (CORS) is a mechanism that is used by browsers, primarily to validate permissions for access to content from a different origin.



 What is CORS? 

When a browser loads a web page, it enforces the Same-origin Policy, which means that it only allows content to be fetched from the same origin as the web page. However, in some cases, a web page might need access to assets from multiple origins that trust that website. This is where CORS comes in.

This security mechanism exists only if an application has or is an HTTP client, and if that application implements CORS. Nearly all modern browsers, such as Chrome, Firefox, and Safari, implement CORS.

To clarify, an origin with respect to CORS does not have to be the same as a CDN origin. An origin in CORS is defined by a URI scheme, domain, and any possible port number. For example, https://www.example.com:1443 is a different origin than http://www.example.com. And so, a CDN can also be considered as a CORS origin from a browser's perspective.





 How CORS works 

CORS can handle two types of requests: simple requests and preflighted requests, which are more complex.



 Simple requests 

First request (resource access):

Zoom

![cors-simple](https://cloud.ibm.com/docs-content/v1/content/006fd22ab2811b7d19804c763a00568b3da4c03a/CDN//images/cors-simple.svg)

Figure 1: First request (resource access)

[Simple requests](https://www.w3.org/TR/cors/simple-cross-origin-request) through CORS are either GET or POST requests from the web page of one origin that's attempting to gain access to the URL of another origin for resources.

When making such a request, the browser automatically sets CORS request headers.
Why can't a user I gave access work with a resource from the Resource list page? 

Users in your account must have access to the service or service instance and the containing resource group to access the instance from the Resource list page.

A user has an access policy on a specific resource or a service in the account, but they can't access the service from the Resource list page.

  What’s happening 

When the user selects the service name, the following error message is displayed:

> You do not have access to any organizations, spaces, or resource groups in this region. Check that you have the appropriate access with your account owner or administrator.

  Why it’s happening 

In addition to access to the type of service or specific resource, the user must also be assigned access to the resource group or space that contains the resource. To access the resource instance within a specific account, a user must be assigned at least the Viewer role or higher on the resource group itself.

  How to fix it 



1.  In the IBM Cloud console, go to Manage > Access (IAM), and select the user's name from Users page.
2.  From the row for the user that you want to assign access, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg), and click Assign access.
3.  Select the service. Then, click, Next.
4.  Scope the access to a specific resource group to which you want to allow access. Then, click, Next.
5.  Select the resource group access. The Viewer role is sufficient to enable the user to access the resource. Then, click, Next.
6.  Select the roles that you want the user to have.
7.  Click Review.
8.  Click Add to add the access to the access summary.
9.  Click Assign.
Leave the field for Service account as is to go with the default.
* Finish by clicking Continue.



5. Next, click on Access policy. In the list of services, select All Identity and Access enabled services and click Next. Go with All resources, click Next again, then select Viewer, and again click on Next. In the section Roles and actions, select Reader for Service access and Viewer for Platform access. When done, click Next and finally Add.
6. Review the Summary on the right side, then Create the trusted profile with the shown trust relationship and the listed access privileges. Leave the browser tab open for later.



[Utilizing an access group to assign access is best practices](https://cloud.ibm.com/docs/account?topic=account-account_setuplimit-policies). For the sake of simplicity, we opted for assigning read-only access through a direct access policy. The recommendation is to create an access group with assigned privileges, then make the trusted profile a member of it.





 Step 4: Deploy the app 

With the Kubernetes cluster and the trusted profile in place, it is time to deploy a simple test app. The source code for the app and the configuration is in the [GitHub repository trusted-profile-enterprise-security](https://github.com/IBM-Cloud/trusted-profile-enterprise-security) You don't need it for the deployment, but might be interested in how it works nonetheless.



1. In the browser tab cluster overview, check that the cluster has been fully deployed. You might want to refresh the browser and check that all checkmarks are green. If this is the case, click on Kubernetes dashboard and a new browser tab opens (Kubernetes dashboard).
2. In the top left, find the namespace selector and switch to All namespaces.
3. On the upper right, click on + to create a new resource. Paste the following content into the text form Create from input.

apiVersion: v1
kind: Namespace
metadata:
name: tptest
labels:
name: tptest
---
You can test the web action by using one of the following methods.



* Testing the web action by using a cURL command.

curl https://<apihost>/api/v1/web/<namespace_ID>/demo/hello.json?name=Jane -X GET -H "X-Require-Whisk-Auth: <my-secret>"
* Testing the action by using a wget command.

wget https://<apihost>/api/v1/web/<namespace_ID>/demo/hello.json?name=Jane -X GET -H "X-Require-Whisk-Auth: <my-secret>"









 Testing to see if your web action is secure 

Test the hello web action without setting the X-Require-Whisk-Auth parameter to verify that authentication is required. Using the actions that you created in the previous sections, this test results in an error.

You can get the URL of your web action by running ibmcloud fn action get hello --url. You can use the URL to test the web action by using one of the following methods.



* Testing the web action by using a cURL command.

curl https://<apihost>/api/v1/web/<namespace_ID>/demo/hello.json?name=Jane
* Testing the web action by using a wget command.

wget https://<apihost>/api/v1/web/<namespace_ID>/demo/hello.json?name=Jane



Example output

{
"code": "4c4423556547f6ac764ee192d4ed27a6",
"error": "Authentication is possible but has failed or not yet been provided."
}

The invocation fails because the X-Require-Whisk-Auth value was not provided.







 Raw HTTP handling
"source": "https://example.com/image.jpg",
"title": "Example image",
"description": "An example image returned as part of a multimedia response."
}
]
}
}







 video 

Displays a video specified by a URL.



 Fields 



 Name Type Description Required? 

 response_type string video Y 
 source string The https: URL of the video. The URL can specify either a video file or a streaming video on a supported hosting service. For more information, see [Adding a Video response type](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-overviewdialog-overview-add-video). Y 
 title string The title to show before the video. N 
 description string The text of the description that accompanies the video. N 
 alt_text string Descriptive text that can be used for screen readers or other situations where the video cannot be seen. N 
 channel_options.chat.dimensions.base_height string The base height (in pixels) to use to scale the video to a specific display size. N 







 Example 

This example displays an video with a title and descriptive text.

{
"output": {
"generic":[
{
"response_type": "video",
"source": "https://example.com/videos/example-video.mp4",
"title": "Example video",
"description": "An example video returned as part of a multimedia response."
}
]
}
}







 audio 

Plays an audio clip specified by a URL.



 Fields 



 Name Type Description Required? 

 response_type string audio Y 
 source string The https: URL of the audio clip. The URL can specify either an audio file or an audio clip on a supported hosting service. For more information, see [Adding an Audio response type](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-overviewdialog-overview-add-audio).
Content in an embedded iframe is useful for displaying third-party content, or for content from your own site that you do not want to reauthor using the [user_defined](https://cloud.ibm.com/docs/assistant?topic=assistant-api-dialog-responsesapi-dialog-responses-user-defined) response type.





 Pause 

The pause response type instructs the application to wait for a specified interval before displaying the next response:

{
"output": {
"generic":[
{
"response_type": "pause",
"time": 500,
"typing": false
}
]
},
"user_id": "faf4a112-f09f-4a95-a0be-43c496e6ac9a"
}

This pause might be requested by the dialog to allow time for a request to complete, or simply to mimic the appearance of a human agent who might pause between responses. The pause can be of any duration up to 10 seconds.

A pause response is typically sent in combination with other responses. Your application should pause for the interval specified by the time property (in milliseconds) before displaying the next response in the array. The optional typing property requests that the client application show a "user is typing" indicator, if supported, in order to simulate a human agent.





 Option 

The option response type instructs the client application to display a user interface control that enables the user to select from a list of options, and then send input back to the assistant based on the selected option:

{
"output": {
"generic":[
{
"response_type": "option",
"title": "Available options",
"description": "Please select one of the following options:",
"preference": "button",
"options":
{
"label": "Option 1",
"value": {
"input": {
"text": "option 1"
}
}
},
{
When you specify a URL to crawl, the final / determines the subtree to crawl. For example, if you enter the URL https://www.example.com/banking/faqs.html, all URLs that begin with https://www.example.com/banking/ are crawled, and the input of https://www.example.com/banking crawls all URLs that begin with https://www.example.com/. If you would like to restrict the crawl to a specific URL, such as https://www.example.com/banking/faqs.html, enter that URL in the URL group to sync field, and then set the Maximum hops to 0.

The web crawler does not crawl dynamic websites that use JavaScript to render content. You can confirm the use of JavaScript by viewing the source code of the website in your browser.

The number of web pages crawled is limited to 250,000, so the web crawler might not crawl all the specified websites and might reach the maximum number of hops.

The crawler has a limit of 10,000 child URLs per URL that is crawled. If the number of child URLs within any crawled URL exceeds 10,000, the crawler cannot process any of the content in the child URLs.

If you require different Crawl settings for other URLs, click Add URL group and create a new group. You can create as many URL groups as you need.





 SharePoint OnPrem 

To connect to SharePoint OnPrem, you must first install and configure IBM® Secure Gateway for IBM Cloud®. For more information about installing IBM® Secure Gateway for IBM Cloud®, see [Installing IBM Secure Gateway for on-premises data](https://cloud.ibm.com/docs/discovery?topic=discovery-sourcesgateway).

You can use this connector to crawl a SharePoint 2013, 2016, or 2019 on-premises data source. The crawler supports Windows New Technology LAN Manager (NTLM) v1 authentication only. It does not support NTLM v2 or Security Assertion Markup Language (SAML) authentication.

Complete the following fields to connect to the data source.
For all new and existing service instances in other regions, you continue to use service credentials ({username}:{password}) for authentication.

When you use any of the Watson SDKs, you can pass the API key and let the SDK manage the lifecycle of the tokens. For more information and examples, see [Authentication](https://cloud.ibm.com/apidocs/assistant/assistant-v2authentication) in the API reference.

If you are not sure which type of authentication to use, view the Watson Assistant credentials by clicking the service instance from the Services section of the [IBM Cloud Resource List](https://cloud.ibm.com).





 25 May 2018 

New sample workspace
: The sample workspace that is provided for you to explore or to use as a starting point for your own workspace has changed. The Car Dashboard sample was replaced by a Customer Service sample. The new sample showcases how to use content catalog intents and other newer features to build a bot. It can answer common questions, such as inquiries about store hours and locations, and illustrates how to use a node with slots to schedule in-store appointments.

HTML rendering was added to Try it out
: The "Try it out" pane now renders HTML formatting that is included in response text. Previously, if you included a hypertext link as an HTML anchor tag in a text response, you would see the HTML source in the "Try it out" pane during testing. It used to look like this:

Contact us at <a href="https://www.ibm.com">ibm.com</a>.

Now, the hypertext link is rendered as if on a web page. It is displayed like this:

Contact us at[ibm.com](https://www.ibm.com).

Remember, you must use the appropriate type of syntax in your responses for the client application to which you will deploy the conversation. Only use HTML syntax if your client application can interpret it properly. Other integration channels might expect other formats.

Deployment changes
: The Test in Slack option was removed.





 11 May 2018 

Information security
: The documentation includes some new details about data privacy.
Now, visit the browser tab Kubernetes dashboard and check the container log. The app prints details on the [JWT access token](https://www.ibm.com/cloud/blog/json-web-tokens-as-building-blocks-for-cloud-security) it uses to authenticate for listing the resources. Examine the individual key/value pairs, including sub (subject) twice. They relate to the trusted profile and the compute resource.
6. Switch to the browser tab IAM trusted profile with the configuration for TPwithCR. In the form, click on the Access tab, then on the three dot menu for All Identity and Access enabled services, select Edit. Now, it should show Edit policy for TPwithCR. Click on Edit for Resources and select Specific resources. Pick Region as Attribute type and as Value, for example, Frankfurt. Finish by pressing Save.
7. Move back to the browser tab container shell and run this command again to list resources:

curl -s localhost:8080/api/listresources?tpname=TPwithCR | jq

The result can be different from above, depending on where you deployed other resources in your account. Revisit the Activity Tracker logs and Kubernetes dashboard browser tabs for new log activity.
8. You might want to go back to step 6 and edit the access policy again, then retest with step 7. Some ideas for editing the access policy would be to add regions or restrict to specific services instead of All Identity and Access enabled services.







 Remove resources 

When you are done testing the above scenario with trusted profiles and compute resources, you can remove the resources by following these steps:



1. To delete the Kubernetes cluster, click on Actions in the top right in the browser tab cluster overview, then Delete cluster.
2. In the tab IAM trusted profiles with the trusted profile TPwithCR, click on Actions and Remove to delete the trusted profile.



Depending on the resource it might not be deleted immediately, but retained (by default for 7 days). You can reclaim the resource by deleting it permanently or restore it within the retention period.
Why is the Create button not shown or disabled on the [Content Delivery Network](https://cloud.ibm.com/catalog/infrastructure/cdn-powered-by-akamai) page? 

If you are the account's Master user, you must upgrade the account for the Create button to appear or be enabled on this page. From the IBM Cloud console page, follow these steps as the account's Master user:



* Open the navigation pane by clicking the triple bar icon in the upper left of the web page.
* Select Classic Infrastructure.
* Click the Upgrade Account button and follow the instructions.



If you are one of the account's secondary users, the account's Master user must give you the Add/Upgrade Services permission for the Create button to appear or be enabled on this page. From the IBM Cloud console page, the account's Master user can follow these steps to edit your permissions:



* Select the Manage tab.
* Select Access (IAM).
* Click the Users tab from navigation pane.
* Click the wanted User.
* Select the Classic infrastructure tab.
* From the Permissions tab, expand the Account category.
* Select Add/Upgrade Services.
* Click the Save button.







 Why am I unable to reach my web page through my CDN after configuring Hotlink Protection with protectionTypeALLOW? 

Let's consider an example in which your website's domain for users is configured to be your CDN's domain/hostname: cdn.example.com. When someone attempts to reach a web page by navigating directly from the browser's navigation bar, the browser typically does not send Referer headers in its HTTP request. For example, when you directly navigate in this way to https://cdn.example.com/, your CDN considers that the request contains a non-match against the specified refererValues. When the CDN evaluates the appropriate effect or response through your Hotlink Protection, it determines that a non-match occurred. Therefore, your CDN denies access, rather than 'ALLOW'.





 Can I use private endpoint of object storage in CDN settings? 

No, CDN can only connect to object storage on public endpoints.
router.all(middleware: apiCreds)

// create protected API
router.get("/protectedendpoint") { request, response, next in

response.headers["Content-Type"] = "text/html; charset=utf-8"
do {
if let userProfile = request.userProfile {
try response.status(.OK).send(
"<!DOCTYPE html><html><body>" +
"Welcome " + userProfile.displayName +
"! You are logged in with " + userProfile.provider + "." +
"</body></html>nn").end()
next()
return
}
try response.status(.unauthorized).send(
"<!DOCTYPE html><html><body>” + “You are not authorized!" +
"</body></html>nn").end()
}
catch {}
next()
}

// Start server
Kitura.addHTTPServer(onPort: 8090, with: router)

Kitura.run()
}
Show more





 Protecting resources manually 

To secure your backend apps and protected resources, you need to validate a token. When a client sends a request to your resource, you can verify that the token meets the defined specifications. The token might include identifying information, scope, or any other configuration that you have in place. You can validate App ID access and identity tokens in several ways. For help, check out [Validating tokens](https://cloud.ibm.com/docs/appid?topic=appid-token-validation).





 Next steps 

With App ID installed in your application, you're almost ready to start authenticating users! Try doing one of the following activities next:



* Configure your [identity providers](https://cloud.ibm.com/docs/appid?topic=appid-social)
How do I use the ICOS default index page with CDN? 

The CDN does not support the default index page for the ICOS objects because the ICOS S3 endpoint does not have the default index. You must specify the complete request path in the browser's address bar (for example, www.example.com/index.html). If you want the CDN to automatically access the default index page of the ICOS, create a CDN with Server type of origin instead of an Object Storage type. For example, if you have a ICOS with static website hosting endpoint xyz-bucket-name.s3-web.us-south.cloud-object-storage.appdomain.cloud, you can create a CDN www.example.com with server type of origin xyz-bucket-name.s3-web.us-south.cloud-object-storage.appdomain.cloud in path /, when a user opens the CDN URL www.example.com, the CDN edge server retrieves the content from xyz-bucket-name.s3-web.us-south.cloud-object-storage.appdomain.cloud/, and ICOS will return your default index page.



* For my CDN, what is the difference between HTTPS with a Wildcard certificate and HTTPS with SAN certificate?

With Wildcard certificates, all customers use the same certificate that is deployed on the vendor's CDN networks. The CNAME, including the IBM suffix .cdn.appdomain.cloud., must be used for access to the service. For example, https://www.example-cname.cdn.appdomain.cloud

In the case of SAN certificate, multiple customer domains share a single SAN certificate by adding their domain names into the SAN entries. The service can then be accesses using the hostname, for instance https://www.example.com
* How is Domain Validation with redirect accomplished?

It depends on your server.