vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You must provide the details about the LDAP directory you want to use.

LDAP server URL
: The LDAP server URL to connect to. For example, ldap://<ldap_server>:<port>.

LDAP binding username
: The username to use to bind to the directory service.

LDAP binding user password
: The password that is associated with the binding username.

LDAP base DN
: The starting point for searching user entries in LDAP. For example, CN=Users,DC=example,DC=com.

LDAP user filter
: The user filter to search user entries in LDAP. If empty, the default value is (userPrincipalName={0}).
12. If you want the crawler to extract text from images in documents, expand More processing settings, and set Apply optical character recognition (OCR) to On.

When OCR is enabled and your documents contain images, processing takes longer. For more information, see [Optical character recognition](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionsocr).
13. Click Finish.



The collection is created quickly. It takes more time for the data to be processed as it is added to the collection.

If you want to check the progress, go to the Activity page. From the navigation pane, click Manage collections, and then click to open the collection.



 Enabling TLS for an existing collection 

To ensure that all traffic that is sent between the Windows Agent service and the crawler is sent over the transport layer security (TLS) protocol, enable TLS support.

This capability is available starting with version 4.7. Do not complete this task until after you upgrade your service software to 4.7.

After you enable TLS for the Windows Agent service, any existing collections in deployments with earlier versions of Discovery will not be able to connect to this Windows Agent service.

To add TLS support to an existing collection, complete the following steps:



1. Open the Processing settings page for the existing Window File System collection.
2.
Supply the following data in the request body:



* Your tenantID.
* Cloud Directory user data with the following required attributes. See [SCIM Full User Representation](https://datatracker.ietf.org/doc/html/rfc7643section-8.2) for more details.



* A password attribute.
* An emails array with at least one email address and a primary attribute that is set to true.





Depending on your [email configuration](https://cloud.ibm.com/docs/appid?topic=appid-cd-types), a user might receive a request for verification, an email that welcomes them when they sign up for your app, or both. Both types of emails are triggered when a user signs up for your app. The verification email contains a link that the user can click to confirm their identity; a screen is displayed, that thanks them for verifying or confirms that their verification is complete.

To present your own post verification page:



1. Navigate to the Cloud Directory identity provider in the App ID dashboard.
2. Click the Email verification tab.
3. In the custom verification page URL, enter the URL for your landing page.



When this value is provided, App ID calls the URL along with a context query. When you call the /sign_up/confirmation_result endpoint and pass the received context parameter, the result tells you whether your user verified their account. If they have, then you can display your custom page.





 Forgot password 

You can use the /forgot_password endpoint to allow users to recover their password if they forget it.

Supply the following data in the request body:



* Your tenant ID.
* The email of the Cloud Directory user.



When the endpoint is called, a reset password email is sent to the user. The email contains a Reset button. After they press the button, a screen is displayed by App ID where they can reset their password.

You can present your own post reset password page:



1.
Do not put personal information in your namespace names.

After you set your first namespace, you are assigned to the free IBM Cloud Container Registry service plan unless you [upgrade your plan](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_plan_upgrade).



 User permissions for working with namespaces 

You can control which users can work with namespaces by using IAM roles.



* To add, assign, and remove namespaces, you must have the Manager role in the IBM Cloud Container Registry service at the account level, see [Access roles for configuring IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_configure).



* To add and assign namespaces, you must also have the Viewer platform role for the resource group in which you want to create the namespace. To assign the Viewer role for a resource group to a user, run the following [ibmcloud iam user-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policy_create) command, where <user> is the name of the user and <resource_group_id> is the resource group ID:

ibmcloud iam user-policy-create <user> --roles Viewer --resource-type resource-group --resource <resource_group_id>



* To view and analyze namespaces, you must have the Reader or Manager role in the IBM Cloud Container Registry service, see [Access roles for using IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).



For more information about user roles, [Defining IAM access policies](https://cloud.ibm.com/docs/Registry?topic=Registry-useruser).







 Setting up a namespace 

You must create a namespace to store your Docker images in IBM Cloud Container Registry.

Before you begin, complete the following tasks:
Associating the identity of the CA admin 

Before you can create identities, you need to associate the identity of the CA admin. Open your CA on the Nodes tab. If you are using the CA for the first time, you can click the Associate identity button to generate the CA admin identity and import it into your console wallet. On the Associate identity side panel, provide the Enroll ID and Enroll secret of the CA admin that you provided when you created the CA.

You can view the enroll ID of the associated admin on the left side of the CA panel, below the CA name, Node location, and Fabric version. You can use this identity to create other identities by using the Register button. The CA admin also allows you to get the list of registered identities, and then use these identities to generate certificates by using the Enroll button.

To use a different identity as the CA admin, click the identity that is associated with the CA admin. This opens the Associate identity side panel. You can use the Enroll an identity tab to provide the enrollID and secret of another CA admin. You can specify an identity that exists in the wallet by using the Select an existing identity tab.

You can only use admin identities to register new users. You can create new admins with restrictions on the type of users they are allowed to create. As a result, you can let another user operate your CA by providing them an admin that is not able to create admins or deploy nodes. This allows other members or departments of your organization to access your CA without compromising your network. For more information, see [Creating new CA admins](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-ca-admin).





 Registering identities 

The first step in creating an identity is known as registration. During registration, an enroll ID and secret are created which can be used by a node or an org administrator to enroll this identity by generating a signing certificate and private key.

You need to enter the following information when you register a new identity with your CA.
This tutorial does not configure attributes on identities, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register) if you want to learn more. Click Register user.
4. After the organization admin has been registered, repeat this same process for the identity of the peer (also using the Org1 CA). For the peer identity, give an enroll ID of peer1 and a secret of peer1pw. This is a node identity, so select peer as the Type. You can ignore the Maximum enrollments field and, on the next panel, do not assign any Attributes, as before.
5. You can also register identities of type orderer with the TLS CA. Completing this optional step for your orderer's admin identity allows viewing additional channel details for the orderer nodes that use this identity. Repeat steps 1-2 above, changing the Certificate Authority drop-down selection from Root Certificate Authority to TLS Certificate Authority.



Registering these identities with the CA is only the first step in creating an identity. You will not be able to use these identities until they have been enrolled. Enrollment is the process that generates the certificate and private key for the registered user. For the org1admin identity, this will happen during the creation of the MSP, which we will see in the next step. In the case of the peer1 identity, it happens during the creation of the peer.

Task: Register users



Table 4. Using your CA to register users

 Field Description Enroll ID Secret Type 

 Create CA CA admin admin adminpw client 
 Register users Org1 admin org1admin org1adminpw admin 
 Peer identity peer1 peer1pw peer 







 Creating the peer organization MSP definition 

Now that we have created the peer's CA and used it to register identities for the Org1 admin and for the Org1 peer, we need to create a formal definition of the peer's organization, which is known as an MSP. Note that many peers can belong to an organization. You do not need to create a new organization every time you create a peer.
Managing access 

If you need to collaborate with others on your assistants, you can quickly add users to your service instance from the Manage menu. Or to tailor specific access to your assistants, use the [Identity and Access Management (IAM) page](https://cloud.ibm.com/iam/users) in IBM Cloud.



 Adding users from the Manage menu 

In the new Watson Assistant, each assistant contains all the draft and live resolution methods (actions and search integration) and channels you add (such as web chat, Facebook, or Slack). The simplest way to provide access is to add users to your Watson Assistant service instance with manager access to all assistants. Users get all the privileges that they need to build and deploy any assistant.

To quickly add users with manager access to all assistants, complete the following steps:



1. Open the Manage menu. ![Manage menu](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/user--avatar.svg)
2. Click Add users.
3. Enter the email addresses of the users that you want to provide full access to. Separate email addresses with commas, spaces, or line breaks.

Zoom

![Add users](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/add-users.png)

Add users

Adding users from this menu enables them to read, write, and manage all assistants in the service instance.
4. Click Submit.



After you click Submit, any user that you invite receives an email to access the instance. After they accept the invite, they can open the service instance and manage all assistants.





 Managing access with Identity and Access Management 

Another way to add users to your assistants is using Identity and Access Management (IAM).
Marla and half of the team members are based in the Ireland, and the other half are based in the United States.



1. For trusted entity type, select Federated users.
2. For authentication method, select Users federated by IBM Cloud App ID from the list.

If the users that you are creating a trusted profile for use IBM Cloud App ID, you should create the trusted profile as an App ID user, and likewise for IBMid. This way, your own SAML attributes can give you an idea of how to structure the trusted profile conditions. Other users with the same IdP can have different SAML attributes and you should use your own only as a hint. To use attributes in a claim that are different than your own, input them manually.
3. Select the default identity provider (IdP) you created.
4. Click View your identity provider (IdP) data. Marla uses this in the following steps to see which attributes she can leverage to create conditions.
5. Click Add a condition.
6. Click Filter attributes and select country.



* These are the attributes available from personal data.



7. Set Qualifier to Equals.
8. For the Value, click Add manually and enter us. This way, Marla can enter attribute values that she isn't assigned in the personal identity provider data.
9. Click Add a condition and repeat steps 6-8. Instead of us, enter ire.
10. Click Add a condition again and click Add manually.



1. Let's say there's an attribute that is called team in the corporate user directory that identifies an employee's team by manager. Enter the condition team equals marla.



11. Click Add a condition again and click Add manually.



1. Let's say there's an attribute that is called job-role in the corporate user directory that identifies an employee's job role. Enter the condition job-role equals dev.



12. Set the session duration to 8 hours.
13. Click Continue.
Note that the person you invite will be able to access any skill or assistant in this service instance.



1. Click the User ![User](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/user-icon2.png) icon in the page header.
2. Make a note of the current service instance name, and then select Manage Users from the drop-down.
3. From the navigation pane, click Users.

If you gave someone access to a service instance previously, then the person might be listed as an invited user already. To change the person's level of access to the instance, click the menu next to their name, choose Assign access, and then click Assign access to resources.
4. Click Invite users.
5. Add the email address of the person with whom you want to share the instance. You can add more than one person.
6. Expand the Assign users additional resources section, and then click IAM Services.
7. In the No access field, choose Watson Assistant.

The Account resource group is used unless you change it.
8. Select at least one region and at least one service instance to share with this user.

Remember, you made a note of the name of the current service instance in an earlier step. You can select it from the list of service instances if you want to give the person access to that service instance only.
9. Give this user the following assignments at a minimum:



* Platform access roles: Viewer
* Service access roles: Writer



For more information about roles, see [Understanding roles](https://cloud.ibm.com/docs/assistant?topic=assistant-access-controlaccess-control-iam-roles).
10. Click Add.

You can repeat the previous step to invite other users and apply different roles to them.
11. Click Invite to finish the process.

If you are editing access for an existing user, click Assign access.
Set a sign-in endpoint that always redirects a browser to the Login Widget. Be sure to add a success redirect option so that you don't end up in an endless authentication loop.

app.get('/appid/login', passport.authenticate(WebAppStrategy.STRATEGY_NAME, {
successRedirect: '/',
forceLogin: true
}));







 Step 5: Personalize your app 

You can pull information that is provided by your identity providers to personalize your app experience.



1. Configure your application to obtain user information. protected is a place holder variable that you can change to match the endpoint for your application.

app.get("/protected_resource", passport.authenticate(WebAppStrategy.STRATEGY_NAME), function(req, res){
res.json(req.user);
});

For example, in the sample application you can see how to obtain the users name to personalize your application.

app.get('/api/user', (req, res) => {
// console.log(req.session[WebAppStrategy.AUTH_CONTEXT]);
res.json({
user: {
name: req.user.name
}
});
});







 Step 6: Test your configuration 

To test your authorization configuration, navigate to the URL that your server is listening on as defined in your application. Try signing in, try signing out. Ensure that the configuration is working as you expected.

When you're ready to move to the next step, you can try enabling [multifactor authentication for Cloud Directory](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa) or adding [custom attributes](https://cloud.ibm.com/docs/appid?topic=appid-profiles) to further personalize your app.
Ask an administrator in the other account for the service ID value that identifies the service ID.

An administrator can find the service ID value by going to Manage > Access (IAM) > Service IDs, and selecting the service ID that you want to target. Click Details and copy the ID that begins with ServiceId.
2. In the IBM Cloud console, click Manage > Access (IAM), and select Trusted profiles.
3. Click Create profile.
4. Define your profile by providing a name and a description, and click Continue.

In the description, provide a list of actions that are available for this trusted profile.
5. You can create the trusted profile before adding details by selecting Decide later. Or, establish trust by completing the following steps:



1. Select Service IDs
2. Enter the service ID value that the administrator provided to you.



6. Click Continue.
7. (Optional) [Assign access to the trusted profile](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profiletp-access).
8. Or, click Create without assigning any access.



Service IDs are static identities that don't use conditions to establish trust. Instead, you establish trust by using the ID value of the service ID's metadata to create a direct link with the trusted entity.





 Assigning access to the trusted profile 

After you establish trust with federated users, compute resources, an IBM Cloud service, or a service ID, you can assign access.

You can assign classic infrastructure access only if your account is linked to a Softlayer account.



1. Assign access.



* Assign access to the trusted profile by adding it to one or more access groups. This way, you can use the policies that exist in the access groups you've created.



1. Select Access groups and select all the groups that you want to add the trusted profile to. You can assign users to only the access groups that you have access to manage.
2. Click Add.



* Assign access to the trusted profile with an access policy.



1. Select Access policy.
How to add the App Configuration instance ID to ServiceNow system property for the webhook script? 

Follow these steps:



1. Login to your ServiceNow instance as an administrator.
2. Click the All tab and search for sys_properties.LIST and press Enter. Alternately, you can go to https://{{instanceid}}.service-now.com/sys_properties_list.do, where instanceid is your ServiceNow instance ID.

Zoom

![ServiceNow All tab](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/ac-sn-04.png)

Figure 17. ServiceNow - All tab
3. The System properties details gets displayed.

Zoom

![System properties](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/ac-sn-05.png)

Figure 18. ServiceNow - System properties
4. Click New to create a new system property.

Zoom

![New system property](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/ac-sn-18.png)

Figure 19. ServiceNow - New system property
5. Add the App Configuration instance ID. Use the password2 type to store the key. This type will encrypt the data and can only be decrypted with the ServiceNow instance.

Zoom

!
You can still create and manage all other API keys. For example, service ID API keys.

To create a user API key, your IAM ID and the IAM ID of the user that's requesting the user API key must be the same. When you apply a trusted profile, you take on the IAM ID of that profile. To create a user API key for your identity, log out of IBM Cloud and log back in without applying a trusted profile.
* How can I check whether a user can apply a trusted profile?

To check whether a user qualifies to apply a trusted profile by using the IBMid identity provider (IdP), the user and the administrator must complete specific steps.



1. The user must go to [IBM Cloud User Claims](https://iam.cloud.ibm.com/identity/claims).
2. From here, the claims are displayed.
3. The user must provide the claims to the administrator.
4. As the administrator, compare the claims of the user with the conditions set for the trusted profile. To view the conditions for a trusted profile, go to Manage > Access (IAM) > Trusted profiles in the IBM Cloud console.
5. Click the profile and view the Conditions column.
6. If the user's claims satisfy all of the conditions, the user can apply the profile.



If you are using a different IdP, check the user's claims in your corporate directory. Then, compare the claims of the user with the conditions set for the trusted profile. If the claims and the rules match, the user can apply the profile.
* How do I establish trust with the Kubernetes service in a trusted profile?

In Kubernetes, a service account provides an identity for processes that run in a Pod, and namespaces provide a mechanism for isolating groups of resources within a single cluster. All Kubernetes clusters have a default namespace, and each namespace has a default account.

When you establish trust with the Kubernetes service in a trusted profile, you are required to enter information in the namespace and service account fields. You can enter default for both.
Click on the additional access you would like to assign (clicks Classic infrastructure tile, selects Super user radio button), and then click on the blue “Add” button (then, clicks "Invite" button).

You can manage existing users and their access from the users menu. Click on “Users” in the Access (IAM) left menu. From here, you can see all of the users in your account.

To manage access for existing users, simply click on the user’s name and you will have access to their user details, access groups, access policies, classic infrastructure, and Cloud Foundry access. From here, you can make changes to access permissions as needed (Clicks "Assign access" button from the Access policies tab to show how additional IAM access can be assigned for the selected user).







 Before you begin 

To invite users and manage outstanding invitations, you must have at least one of the following types of access. Only users can invite others. If you use a service ID to authenticate, you can't invite new users to the account.



* Account owner
* An IAM access policy with the Editor role or higher on the user management account management service
* The Manage Users classic infrastructure permission to add users



Depending on your access level, you can invite new users and assign all or just some types of access.

Before you can invite users by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).







 Inviting users in the console