vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Connection conn = DriverManager.getConnection( "jdbc:db2://<host_name_or_IP_address>:50001/BLUDB:user=<IBMid>;password=<password>;securityMechanism=15;pluginName=IBMIAMauth;sslConnection=true" );









 Console user experience 

The service console login page has the option to log in with your IBMid and password. After the Sign In via IBMid button is clicked, the user is directed to the IAM login page, on which the password is entered. When authentication is completed, the user is redirected back to the console. Before such login can be successful, the IBMid user must be added to each database service instance by the database administrator through the console or REST API. Just like for a non-IBMid user, a user ID for the database service instance must be entered at the same time that the IBMid user is added. The user ID needs to be unique within the database service instance. This user ID is also the authorization (AUTH) ID within the database.

To add a user with either an IBMid or a service ID by using the web console, complete the following steps:



1. Log in as a user who has administrator privileges.
2. From the right drop-down menu, select Manage Users.

Zoom

![View of the web console dashboard page and drop-down menu](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/manage_users.png)

Figure 1. Selecting Manage Users page from drop-down menu
3. With the Users tab selected, click Add.

Zoom

![View of the web console Manage Users page](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/add_users.png)
The user_id property is specified at the root of the request body, as in this example:

{
"input": {
"message_type": "text",
"text": "I want to cancel my order"
},
"user_id": "my_user_id"
}

In some older SDK versions, the user_id property is not supported as a top-level method parameter. As an alternative, you can specify user_id within the nested context.global.system object.

For more information about the user_id property, see the API reference documentation:



* [v2 stateless /message](https://cloud.ibm.com/apidocs/assistant-v2/assistant-v2messagestateless)
* [v2 stateful /message](https://cloud.ibm.com/apidocs/assistant-v2/assistant-v2message)







 If the user ID is not specified 

If you are using a custom client application and do not set a user_id value, the service automatically sets it to one of the following values:



* session_id (v2 API only): A property defined in the v2 API that identifies a single conversation between a user and the assistant. A session ID is provided in /message API calls that are generated by the built-in integrations. The session ends when a user closes the chat window or after the inactivity time limit is reached.

If you use the stateless v2 message API, you must specify the session_id with each message in an ongoing conversation (in context.global.session_id).
* conversation_id (v1 API only): A property defined in the v1 API that is stored in the context object of a /message API call. This property can be used to identify multiple /message API calls that are associated with a single conversational exchange with one user. However, the same ID is only used if you explicitly retain the ID and pass it back with each request that is made as part of the same conversation. Otherwise, a new ID is generated for each new /message API call.
Duplicate your identity provider configuration by using the GUI.
3. [Migrate your user profiles](https://cloud.ibm.com/docs/appid?topic=appid-user-admin). Known users are exported as a JSON object. Anonymous user's cannot be migrated. You can choose to import the entire object into the new instance or break it up and divide the users as you see fit if you have more than one instance. For Cloud Directory, see [Migrating users](https://cloud.ibm.com/docs/appid?topic=appid-cd-usersuser-migration). For federated identity providers, use the following steps.
4. Create application credentials to invoke the new service instance.



1. In the service dashboard, navigate to the Applications tab.
2. Click Add Application and give your application a name. Then, click Save.
3. Click View credentials in the table and copy the output.
4. Paste your new credentials into your application.



5. Update your application to use the new credentials including any URLs.
6. Depending on your configuration, you might need to redeploy or unbind and rebind your application.







 Can App ID help configure logout? 

Depending on how you configure your application, App ID can help to facilitate a log out functionality for your users. Check out the following table to see where functionality for logout is available.



Table 3. Log out functionality options

 Description 

 App ID SDKs The App ID SDKs have a built-in logout functionality. 
 Cloud Directory SSO<br><br>[1] App ID provides built in logout functionality for the Cloud Directory SSO feature. 
 Ingress Ingress provides a built in logout functionality. 
 Istio The Istio adapter is configured to provide log out functionality through OIDC. 





 Configuring logout 

To configure logout, you must configure your application to send a request to your identity provider.
For more information, see [Viewing user information](https://cloud.ibm.com/docs/appid?topic=appid-cd-userscd-user-info).





 24 April 2019 

Version 4 of the runtime APIs
: Update your apps! To further the standards on which App ID is based, we've made a few changes. With those changes, we were able to tighten interoperability within the OIDC workflow and broaden the frameworks that are able to use the service. For more information about the changes that you must make before September 2019, see the blog [IBM Cloud App ID: Updated runtime APIs](https://www.ibm.com/cloud/blog/ibm-cloud-app-id-v4-runtime-apis-update).

Cloud Directory: Single sign-on
: Provide smooth authentication experiences between multiple web apps with single sign-on (SSO) for Cloud Directory. With SSO enabled, user's are not prompted to reenter their credentials the next time they attempt to access your app. Instead, they are automatically signed in to any of your apps that are protected by the same App ID instance. For more information, see [Single sign-on](https://cloud.ibm.com/docs/appid?topic=appid-cd-sso).

Updated dashboard
: Navigate through your Cloud Directory information quickly! Using [IBM Design Thinking](https://www.ibm.com/design/thinking/), the App ID dashboard has been redesigned to give you an even better user experience.





 7 February 2019 

Cloud Directory: Multi-factor authentication - SMS
: Require users to enter a second form of authentication during sign-in to increase the security of your app. With Cloud Directory, the first factor is the user's password that they would normally use. Then, the service sends the user a one-time code through SMS that the user must enter before they can gain access to your app. For more information, see [Multi-factor authentication](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa).





 11 December 2018
App ID docs 

With IBM Cloud App ID, you can easily add authentication to your web and mobile apps with few lines of code.

 Developer tools 

[API & SDK reference](https://us-south.appid.cloud.ibm.com/swagger-ui//)[Terraform reference](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/appid_action_url)

 Recommended content 

[Add App ID Choose the type of application and authentication flow that you want to work with.](https://cloud.ibm.com/docs/appid?topic=appid-adding-overview)[Configure Cloud Directory Set up your own user registry to allow users to sign in with an email and password.](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directory)[Controlling access Define which users and applications can access specific features or perform specific actions in your apps.](https://cloud.ibm.com/docs/appid?topic=appid-access-control)

 Video library 

[!
As the account owner, you can use the GUID to identify a specific user and then you can search to see all the events that the user triggered.

The following scenario works only for Cloud Directory users. If the user is defined by an external IdP such as Google or Facebook, only that identity provider can interpret the GUID.



 Extracting user information from the GUID 

An event in the Activity Tracker console contains the following fields.



Table 3. Example fields that can be found in an event from the Activity Tracker console

 Field Value Description 

 initiator.id cb967e0d-43c1-454a-968d-0efa24766846 The tenant ID. 
 target.name cloud_directory:34e1ea6d-cc02-4941-9462-7e9c5a40b360 The user ID. 



To find the user information that aligns with the event GUID, use the following steps.



1. In the Credentials tab of the App ID dashboard, copy, and save the information in the apiKey and tenantID fields. The tenant ID should match the ID of the event. If no credentials exist, create a set.
2. Obtain an IAM token for the apiKey by inserting the key into the following command:

curl -k -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" --data-urlencode "apikey=<apiKey>" "https://iam.cloud.ibm.com/identity/token"
3. Copy the IAM token from the access_token field in the response.
4. Select a region. Learn more about the [available regions](https://cloud.ibm.com/docs/appid?topic=appid-regions-endpoints).
5. Insert the IAM token, the tenant ID, and the user ID, into the following command to obtain the user information.
[Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, click Add.
4. Select the User credentials tile.

You're all set to enter the details of your new secret. To describe and store your secret, continue to the next step.







 Step 2: Store the secret securely 

When you're working with secrets, it's important to organize them in a single location so that you help to reduce the risk of compromised credentials. By storing a secret in Secrets Manager, you can manage a secret centrally, use

secret groupsto control access, and avoid coding it directly into your apps or version control systems.

Complete the following steps to enter the details of a secret and store it securely in your instance.



1. In the Add user credentials page, add a name and description to easily identify your secret.
2. Add the secret to a group to control who on your team has access to it.

You can click Create to provide a name and a description for a new group. Later, you can assign an access policy to the group so that you control who on your team has access to its contained secret.
3. Optional: Add labels to help you to search for similar secrets in your instance.
4. Supply the username and password values that you want to associate with the secret.
5. Optional: Set an expiration date for the secret.
6. Click Add.

You did it! The username and password are now stored in your dedicated, single-tenant instance of Secrets Manager.







 Step 3: Manage its lifecycle 

After you add a secret to your instance, you can establish a regular cadence for managing its lifecycle. For example, you might need to adhere to an internal requirement or regulatory control in your business for rotating secrets every 30 days.



1.
Make a request to the [/userinfo endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Authorization_Server_V4/userInfo). If new tokens are not explicitly passed to the SDK, App ID uses the last received tokens to retrieve and validate the response. Passing an identity token is optional, but passed is used to validate the response.



* Curl
* Java
* Node
* Swift
* Swift



GET https://<region>.appid.cloud.ibm.com/oauth/v4/<tenantID>/userinfo
Authorization: 'Bearer <accessToken>'

AppID appId = AppID.getInstance();

appId.getUserProfileManager().getUserInfo(accessToken, identityToken, new UserProfileResponseListener() {
@Override
public void onSuccess(JSONObject userInfo) {
// retrieved attribute "name" successfully
}

@Override
public void onFailure(UserInfoException e) {
// exception occurred
}
});

let userProfileManager = UserProfileManager(options: options)

let accessToken = req.session[WebAppStrategy.AUTH_CONTEXT].accessToken;
let identityToken = req.session[WebAppStrategy.AUTH_CONTEXT].identityToken;

// Retrieve user info and validate against the given identity token
userProfileManager.getUserInfo(accessToken, identityToken).then(function (profile) {
// retrieved user info successfully
});

// Retrieve user info without validation
userProfileManager.getUserInfo(accessToken).then(function (profile) {
// retrieved user info successfully
});

// iOS Swift example
Next, if you want team members to help with the onboarding process, get them set up with access to your account. For example, add a technical team member to create and add your broker. [In the Assign access section, click Assign to create an access group. Then, click Let's go.]

Confirm your legal agreement with IBM. Or, you can upload your own custom agreement. [Go to the My company page to confirm your legal agreement]

Go back to the My products page and click Create. Enter the name of your product, select the product type, and click Add.

First, confirm your product's programmatic name, which is automatically generated for you. Your programmatic name must be approved in order to add a pricing plan or register your service broker. [Click Edit to change your programmatic name, save it, and click Confirm.]

After your programmatic name is approved, IBM generates a service ID, which is used to identify your service when communicating with other IBM Cloud services. You’ll need to create an API key for authentication as well.

Now you’re ready to customize your product for the catalog. The information that you provide on the Product details tab is displayed in two places: your catalog tile and your detailed product page. For your catalog entry, provide a logo and a description of your product, along with a category and keywords to help users find your product in the catalog. Next, provide the URL to the end user license agreement that users must agree to in order to use your product. Finish your product page by adding a detailed description and features that highlight your service’s attributes and the benefits to users. Finally, provide links to high-quality images or videos, and your official documentation. [Click Product details. Then, click Add logo to add a link to your logo. Then, click the Edit icon for the Short description field to enter a description of your product. Then, click Select category and select Developer tools. Click Provide the end user license agreement URL customers must agree with to use your product and enter the URL to your license agreement. Click the Edit icon for the Detailed description field and provide a more detailed description of your product.
Getting started with App ID 

Application security can be incredibly complicated. For most developers, it's one of the hardest parts of creating an app. How can you be sure that you are protecting your users information? By integrating IBM Cloud® App ID into your apps, you can secure resources and add authentication; even when you don't have a lot of security experience.

By requiring users to sign in to your app, you can store user data such as app preferences or information from the public social profiles, and then use that data to customize each experience of your app. App ID provides a framework for you, but you can also bring your own branded sign in screens when working with cloud directory.

We’d love to hear from you with feedback and questions!



* If you have technical questions about App ID, post your question on [Stack Overflow](https://stackoverflow.com) and tag your question with ibm-appid.
* Reach out directly to the development team on [Slack](https://www.ibm.com/cloud/blog/announcements/get-help-with-ibm-cloud-app-id-related-questions-on-slack)!



Getting started? Try walking through our [video tutorials](https://www.youtube.com/playlist?list=PLzpeuWUENMK2tmzSRRx7W_mplw1x4h7ch).



 Step 1: Create a service instance 

Create and bind an instance of App ID to your app to get started.



1. Check to be sure that you have the [IBM Cloud prerequisites](https://cloud.ibm.com/docs/overview?topic=overview-prereqs-platform).
2. In the IBM Cloud catalog, select App ID. The service configuration screen opens.
3. Give your service instance a name, or use the preset name.
4. Select your pricing plan and click Create.



That's it! You're ready to start configuring your application settings.





 Step 2: Configure a sample app
For more information about user roles, see [Assembling a team](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-team).





 Procedure 



1. Log in to Knowledge Studio with an administrator ID.
2. Click the Settings icon to open the Service Details page. The page lists all the user IDs that are registered as Knowledge Studio users. Each user ID has one of the following roles (in decreasing order of included permissions):



* Admin
* Project Manager
* Human Annotator



For information about user roles, see [User roles in Knowledge Studio](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-roles).
3. Verify that there is at least one user with the Admin role. A user ID with this role can create workspaces, and act as a project manager or human annotator.
4. If you have access to additional user IDs, verify that there are at least two users with the Human Annotator role.

Creating a real-life model typically involves multiple human annotators in addition to an administrator or project manager. However, for purposes of the tutorial, you can continue with a single user ID.
5. Optional: Change the role that is assigned to a user ID. From the Action column of the table, click the Edit link, an then change the assigned user role.

You can upgrade a user ID to a role with greater permissions, but you cannot downgrade a user with an Admin or Project Manager role to the Human Annotator role.









 Lesson 2: Creating a workspace 

In this lesson, you will learn how to create a workspace within Knowledge Studio.



 About this task 

A workspace defines all the resources that are required to create a machine learning model, including training documents, the type system, dictionaries, and annotations that are added by human annotators.
For example, if you know multiple users in your account need to be able to apply subscription codes, track usage, or perform other billed-related tasks, you might name your group Billing-Editor-Access.



2. Assign access to the group.



1. Click Access > Assign access.
2. Select individual services or a group of services:



* All Identity and Access enabled services: Assigns access to all catalog services that use IAM for access management.
* All Account Management services: Assigns access to manage platform services, such as billing, license and entitlements, and enterprises. For more information, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uiaccount-management-actions-roles).
* All IAM Account Management services: Assigns access to a subset of account management services that includes the IAM platform services IAM Identity, IAM Access Management, IAM User Management, IAM Groups, and future IAM services.



3. Click Next.
4. Select all roles that apply, then click Next.
5. Click Add and repeat as needed.
6. Click Assign.





See [What makes a good access group strategy?](https://cloud.ibm.com/docs/account?topic=account-account_setupresource-group-strategy) for details about how to best set-up your access groups.





 Step 8: Invite users to your account 

You're ready to invite users to your account and grant them access based on the resources they work with and the tasks they perform. If you want users to create resources from the catalog and assign the resources to a resource group, the following access is required:



* Viewer role or higher on the resource group.
* Editor or administrator role on the service.



Complete the following steps:



1. Go to Manage > Access (IAM) > Users in the IBM Cloud console.
2. Click Invite users.
3. Specify the email address of the user. If you are inviting more than one user, they are all assigned the same access.
4.
Custom attributes Custom attributes are additional information that is added to their profile or that is learned about the user's as they interact with your application. 
 Summary All the information that is associated with that user shown as a JSON object. 









 Viewing user profiles with the API 

You can use the App ID API to view details about your app users.



1. Obtain your tenant ID from your instance of the service. You can find the ID in your service or application credentials.
2. Search your App ID users with an identifying query, such as an email address, to find the user ID.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/Users?query=<identifyingSearchQuery>" -H "accept: application/json" -H "authorization: Bearer <token>"

Example:

curl -X GET https://us-south.appid.cloud.ibm.com/management/v4/e19a2778-3262-4986-8875-8khjafsdkhjsdafkjh/cloud_directory/Users?query=example@domain.com -H "accept: application/json" -H "authorization: Bearer eyJraWQiOiIyMDE3MTEyOSIsImFsZ...."
3. By using the ID that you obtained in the previous step, make a GET request to the /users endpoint to see their full user profile.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/users/<userID>/profile" -H "accept: application/json" -H "authorization: Bearer <token>"

Example response:

{
"id": "a0791903-ed4c-41cf-bd0e-a37957dad820",
"name": "David Test-user",
"email": "dave.test@domain.com",
After a successful authentication, App ID creates a session cookie with encrypted access and identity tokens that your apps can use for authentication. Another way to customize the flow is to send an access token to your browser so that any browser app can use the token in its Ajax request.







 Customizing the Login Widget 

The Login Widget is dynamic. You can customize the look and feel or identity provider configuration, and the changes are applied immediately. You do not need to update your application code or redeploy your app in any way!

Do you need more customization than the Login Widget provides? You can implement your own, fully customized UI for user sign in, sign up, reset password, and other flows to create an experience that's unique to your app. To get started, check out [branding your app](https://cloud.ibm.com/docs/appid?topic=appid-branded).

To customize the screen:



1. Open the App ID service dashboard.
2. Select the Login Customization section. You can modify the appearance of the Login Widget to align with your company's brand.
3. Upload your company's logo by selecting a PNG or JPG file from your local system. The recommended image size is 320 x 320 pixels. The maximum file size is 100 Kb.
4. Select a header color for the widget from the color picker, or enter the hex code for another color.
5. Inspect the preview pane, and click Save Changes when you are happy with your customizations. A confirmation message is displayed.
6. In your browser, refresh your login page to verify your changes.







 Displaying the Login Widget with the Android SDK 

You can call preconfigured screens with the [Android client SDK](https://github.com/ibm-cloud-security/appid-clientsdk-android).

Place the following command in your code.

LoginWidget loginWidget = AppID.getInstance().getLoginWidget();