vania-janet/multiturn-rag-retrieval-data huggingface dataset:
: If you have an IBM Cloud infrastructure without an IBM Cloud account, create an IBM Cloud [Pay-As-You-Go](https://cloud.ibm.com/docs/account?topic=account-accountspaygo) or [Subscription](https://cloud.ibm.com/docs/account?topic=account-accountssubscription-account) account. You have two separate IBM Cloud infrastructure accounts and billing. By default, your new IBM Cloud account uses the new infrastructure account. To continue using the previous classic infrastructure account, manually set the credentials. You can manually set credentials for only classic clusters, not VPC clusters.





 Accessing the infrastructure portfolio with your IBM Cloud Pay-As-You-Go or Subscription account 

IBM Cloud Pay-As-You-Go and Subscription accounts are automatically set up with an IBM Cloud infrastructure account that allows access to classic infrastructure resources. The API key that you set is used to order infrastructure resources from this infrastructure account, such as new worker nodes or VLANs.

You can find the current API key owner by running [ibmcloud oc api-key info --cluster <cluster>](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_api_key_info). If you find that you need to update the API key that is stored for a region, you can do so by running the [ibmcloud oc api-key reset --region <region>](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_api_key_reset) command. This command requires the Red Hat OpenShift on IBM Cloud admin access policy and stores the API key of the user that executes this command in the account.

Be sure that you want to reset the key and understand the impact to your app. The key is used in several different places and can cause breaking changes if it's unnecessarily changed.

Before you begin:
Locking a service ID also prevents any access policies from being changed, deleted, or assigned as well as any API keys associated with the service ID from being created or deleted. For more information, see [Locking a service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeyslockkey) and [Locking an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey).







 May 2018 



 31 May 2018 

Upgrade your Lite account to a Subscription account
: You can now upgrade your Lite account to a Subscription account directly from the IBM Cloud console. With a Subscription account, you can use both platform and infrastructure offerings, and take advantage of discounted pricing by making a monthly spending and term commitment. You can also avoid surprises with fixed billing on a monthly payment schedule, but with the flexibility to order more or less based on your needs. For more information, see [FAQS for billing and usage](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-billusagefaqs).





 15 May 2018 

IBM Cloud CLI rebranding
: The IBM Cloud CLI commands changed from bluemix and bx to ibmcloud. However, you can still use the bluemix and bx CLI commands until they are removed later. There is no short name now, just the full name ibmcloud.





 02 May 2018 

Multi-factor authentication for your account
: Multi-factor authentication (MFA) adds an extra layer of security to your account by requiring all users to provide a time-based one-time passcode in addition to their standard IBMid and password during login. This is also commonly known as two-factor authentication (2FA). MFA is enabled per account, and once it is turned on, all users in the account are required to log in by using the extra security measure. For more information, see the [IBM Cloud Platform now adds support for Multi-Factor Authentication](https://www.ibm.com/cloud/blog/ibm-cloud-platform-now-adds-support-multi-factor-authentication) blog post.







 April 2018
What's in an account? 

Your IBM Cloud® account includes many interacting components and systems for resource, user, and access management. Concepts like how certain components are connected or how access works help you in understanding how to set up your account.

The following diagram contains two main concepts for the components in the account hierarchy that are important to understand. The use of the solid lines and the dotted lines help illustrate that some components are contained within others, for example, users are added to access groups. However, some components interact with others for providing access instead of membership. For example, users are given access to resource groups but are not members of a resource group the same way they are for access groups.

Zoom

![A diagram that shows the components in an account, including services, users, and the subcomponents of each.](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/account_diagram.svg)

Figure 1. A diagram that shows the components in an account, including services, users, and the subcomponents of each.

Users
: Users are invited to the account and given access to the resources in the account.

Service IDs
: A service ID identifies a service or application similar to how a user ID identifies a user. You can use a service ID that you create to enable an application outside of IBM Cloud access to your services. You can assign specific access policies to the service ID that restrict permissions for using specific services, or even combine permissions for accessing different services. Since service IDs are not tied to a specific user, if a user happens to leave an organization and is deleted from the account, the service ID remains, ensuring that your application or service stays up and running. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids).

Trusted profiles
When you are invited to work in an account that is different from the default account that is associated with your IBMid, an event with action user-management.user.create is generated and available in the account where you are invited to work. Users in the account with permissions to monitor Activity Tracker Event Routing events can monitor these events through the IBM Cloud Activity Tracker instance in Frankfurt (eu-de).

For a user to log in successfully to your account:



1. First, the credentials of the user or service are validated in IBM Cloud.
2. If the credentials are validated and the user or service is authorized to work in the IBM Cloud, a token is issued by the IAM Identity service.

Depending on the way that the user logs in, an account might be pre-selected, the account might be embedded in the API key, or the user might have to select one account after the credentials are validated. Therefore, the token might include account details or not.
3. [User log in request only] If account information is not included, the user must select or switch to the desired account.



An Activity Tracker Event Routing event is generated and available in your account after the credentials are validated in the IBM Cloud, and account details are available.

As the owner or person responsible of the account access management, you can expect an event in your account in any of the following scenarios:



* User logs in from the UI: You get a log in event after the user's log in credentials (IBMid) are validated in IBM Cloud and the user switches to work with your account.
* User logs in from the CLI by using a user ID and password, or a one-time passcode: You get a log in event after the user's log in credentials (IBMid) are validated in IBM Cloud and the user selects your account.
* User logs in from the CLI by using an API key: You get a log in event after the user's log in credentials (IBMid) are validated in IBM Cloud. The account details are included in the key.
* Service logs in by using a service ID: You get a log in event after the credentials (API key of a service ID) are validated in IBM Cloud. The account details are included in the API key.
The following example shows the output of the previous request.

{
"next_url": null,
"total_results": 5,
"resources": [ !!!!!!!!
{
"metadata": {
"guid": "<account_ID>",
"url": "/coe/v2/accounts/<account_ID>",
"created_at": "2016-09-29T02:49:41.842Z",
"updated_at": "2018-08-16T18:56:00.442Z",
"anonymousId": "1111a1aa1a1111a1aa11aa11111a1111"
},
"entity": {
"name": "<account_name>",
3. Generate a new IBM Cloud IAM token that includes your IBM Cloud credentials and the account ID that you want to work with.
If you use an IBM Cloud API key, you must use the IBM Cloud account ID the API key was created for. To access clusters in other accounts, log in to this account and create an IBM Cloud API key that is based on this account.

POST https://iam.cloud.ibm.com/identity/token

Header
: <-- <ul> -->

* Content-Type: application/x-www-form-urlencoded
* Authorization: Basic Yng6Yng=Yng6Yng= equals the URL-encoded authorization for the username bx and the password bx.

<-- </ul> -->

Body for IBM Cloud username and password
: <-- <ul> -->

* grant_type: password
* response_type: cloud_iam uaa
* username: Your IBM Cloud username.
* password: Your IBM Cloud password.
* uaa_client_ID: cf
* uaa_client_secret: Add the uaa_client_secret key with no value specified.
When a user [logs in with a federated ID by using trusted profiles](https://cloud.ibm.com/docs/account?topic=account-federated_id), you get an event in the account with action iam-identity.trustedprofile-apikey.login.





 Failed log in actions 

When a user logs in to the IBM Cloud, the user ID (IBMid) and credentiasls are validated first. At this point, the user has not selected an account. Notice that a user can belong to multiple accounts.

After the user ID is authenticated successfully in the IBM Cloud, the user can choose an account. It is at this point in the process that an account is associated to the log in request, and an event with action iam-identity.user-refreshtoken.login, or iam-identity.user-apikey.login is generated in your account.

In Activity Tracker, you can see events that are associated to your account. Failed log in actions do not generate an event that you can monitor in your account.







 Logout events 

When a user logs out of the IBM Cloud, the iam-identity.user.logout event is generated.





 Update an account service ID 

A service ID identifies a service or application similar to how a user ID identifies a user. [Learn more](https://cloud.ibm.com/docs/account?topic=account-serviceids).

When an action to update a service ID is requested, you get an event in the account with action iam-identity.account-serviceid.update.

The following fields include extra information:



* The initiator.name field includes information about who has requested to update the service ID.
* The target.name field includes information about the service ID that is changed.
* The initiator.host.agent field indicates if the request comes from the UI or the CLI. When the field is set to Not Set, the request originates in the UI. When the field is set to IBM Cloud CLI, the request originates at the command line.





 Lock and unlock a service ID 

The following field includes extra information:
To use a different classic infrastructure account for classic clusters, [manually set IBM Cloud infrastructure credentials for your IBM Cloud account](https://cloud.ibm.com/docs/containers?topic=containers-access-credscredentials). You can't set up your IBM Cloud account to use the VPC infrastructure of a different account.

Subscription
: Subscription accounts come with access to the infrastructure portfolio. You can create standard clusters. Use an API key to set up infrastructure permissions for your clusters.

To use a different classic infrastructure account for classic clusters, [manually set](https://cloud.ibm.com/docs/containers?topic=containers-access-credscredentials) IBM Cloud infrastructure credentials for your IBM Cloud account. You can't set up your IBM Cloud account to use the VPC infrastructure of a different account.

IBM Cloud infrastructure accounts
: If you have an IBM Cloud infrastructure without an IBM Cloud account, create an IBM Cloud [Pay-As-You-Go](https://cloud.ibm.com/docs/account?topic=account-accountspaygo) or [Subscription](https://cloud.ibm.com/docs/account?topic=account-accountssubscription-account) account. You have two separate IBM Cloud infrastructure accounts and billing. By default, your new IBM Cloud account uses the new infrastructure account. To continue using the previous classic infrastructure account, manually set the credentials. You can manually set credentials for only classic clusters, not VPC clusters.





 Accessing the infrastructure portfolio with your IBM Cloud Pay-As-You-Go or Subscription account 

IBM Cloud Pay-As-You-Go and Subscription accounts are automatically set up with an IBM Cloud infrastructure account that allows access to classic infrastructure resources. The API key that you set is used to order infrastructure resources from this infrastructure account, such as new worker nodes or VLANs.

You can find the current API key owner by running [ibmcloud ks api-key info --cluster <cluster>](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_api_key_info).
If you have a pay-as-you-go account, you can use IBM® Key Protect to create an event. If you don't have a pay-as-you-go account, provisioning any of the available lite services triggers an event.



1. From the [IBM Cloud catalog](https://cloud.ibm.com/catalog), select the category Security.
2. Select the Key Protect service.
3. (Optional) [Provision an instance of the Key Protect service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorialgetting-started-tutorial).







 Launch the web UI 

Complete the following steps to launch the web UI:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. In the navigation menu, select Observability.
3. Select Activity Tracker.

The list of instances that are available on IBM Cloud is displayed.
4. Select the instance that is located in Frankfurt. Then, click Open Dashboard.

Global events, such as provisioning a service, are available through the global domain instance that is located in Frankfurt.



The web UI opens.





 View events 

The IBM Cloud Activity Tracker service captures activity data that is related to API calls and other actions that are made to selected cloud services in the IBM Cloud.



* Events are collected automatically.
* Events that are collected in IBM Cloud Activity Tracker comply with the Cloud Auditing Data Federation (CADF) standard. The CADF standard defines a full event model that includes the information that is needed to certify, manage, and audit security of applications in cloud environments.
* IBM Cloud Activity Tracker stores and groups events by location.
* Events that report on global IBM Cloud account actions, are collected and stored in Frankfurt (EU-DE).
* The service plan that you select for your IBM Cloud Activity Tracker instance sets the number of days that events are available for search through the web UI.
Setting up your IBM Cloud account 

This tutorial walks you through the steps for setting up an account in IBM Cloud®. By completing this tutorial, you learn how to set up account authentication, manage your account settings, effectively organize resources in your account, and control access to resources.

This tutorial focuses on how to set up a Pay-As-You-Go account. For more information about setting up accounts in an enterprise hierarchy, see [Setting up an enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-tutorial).



 Step 1: Create your account 

First, create an account by using your existing IBMid or a new IBMid. If your company is registered to use a federated ID for single sign-on (SSO), you can use your federated ID instead.



Table 1. ID options for creating an account

 Login ID Details 

 Existing IBMid If you already have an IBMid, sign up for IBM Cloud with your existing credentials that you use for other IBM® products and services. 
 New IBMid If you don't yet have an IBMid, you can create one when you sign up. With an IBMid, you can use one username to log in to all IBM products and services, including IBM Cloud. 
 Federated ID If your company already requested to register the user credentials from your company's domain with IBM, you can sign up for IBM Cloud by using the credentials that you already use for your company's login. You must enter a phone number when you sign up. 





 Using your IBMid 

If you're not a part of a company that uses a federated ID, use your IBMid to create your account.



1. Go to the [IBM Cloud login page](https://cloud.ibm.com/), and click Create an IBM Cloud account.
2. Enter your IBMid email address. If you don't have an existing IBMid, an ID is created based on the email that you enter.
3. Complete the remaining fields with your information.

You are prompted for your credit card information to verify your identity and secure your account.
You can link this infrastructure account to your IBM Cloud account by using the [ibmcloud ks credential set](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_credentials_set) command. The IBM Cloud infrastructure credentials are used instead of the default Pay-As-You-Go or Subscription account's credentials that are stored for the region.

You can manually set infrastructure credentials to a different account only for classic clusters, not for VPC clusters.

The IBM Cloud infrastructure credentials that are set by the ibmcloud ks credential set command persist after your session ends. If you remove IBM Cloud infrastructure credentials that were manually set with the [ibmcloud ks credential unset --region <region>](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_credentials_unset) command, the credentials of the Pay-As-You-Go or Subscription account are used instead. However, this change in infrastructure account credentials might cause [orphaned clusters](https://cloud.ibm.com/docs/containers?topic=containers-cluster_infra_errors).

Before you begin:



* If you are not using the account owner's credentials, [ensure that the user whose credentials you want to set for the API key has the correct permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsowner_permissions).
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



To set infrastructure account credentials to access the IBM Cloud infrastructure portfolio:



1. Get the infrastructure account that you want to use to access the IBM Cloud infrastructure portfolio. You have different options that depend on your [current account type](https://cloud.ibm.com/docs/containers?topic=containers-access-credsunderstand_infra).
2.
* User logs in from the CLI by using an API key: You get a log in event after the user's log in credentials (IBMid) are validated in IBM Cloud. The account details are included in the key.
* Service logs in by using a service ID: You get a log in event after the credentials (API key of a service ID) are validated in IBM Cloud. The account details are included in the API key.



You only get Activity Tracker Event Routing events for successful log in requests to your account.



 User logs in through the IBM Cloud UI 

When a user successfully logs in to your account through the IBM Cloud UI, the following steps are taken:



1. To initiate the log in requests, the user must launch the [IBM Cloud UI](https://cloud.ibm.com/login).
2. After the user enters the IBMid credentials into the browser, the data is forwarded to the IAM Identity Service.
3. If the credentials are validated and the user is authenticated to work in the pre-selected account, the IAM Identity Service returns an access token and a refresh token. These tokens are bounded to the default account and include information to allow the user to choose other accounts where the user is a member.

By default, an account is pre-selected. This account is the one that is associated to the user's IBMid.
4. At this point in the process, the IAM Identity Service generates an Activity Tracker Event Routing event with action iam-identity.user-refreshtoken.login. This event is available in the user's default account, that is the account where the user is account owner.
5. Next, the user switches account and selects a different account.

An account is preselected by the UI during login. After a user is logged in, the dashboard has an option to switch accounts. Selecting a different account generates additional access and refresh token events.
6. The IAM Identity Service checks the current tokens. If the user is authorized to work in the new account, the IAM Identity Service returns a new access token and a new refresh token that are bound to the new account.
Consumer accounts for application provider workloads 

You must have a system for authentication and authorization of the consumer organization's users when they connect to your application workloads through a web app or API. As the best practice for [enabling a zero trust environment](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-zero-trust) says, you need to provide proper role-based access control (RBAC) for these users.

You can use [App ID](https://cloud.ibm.com/docs/appid?topic=appid-about) to secure your apps, back-end resources, and APIs by using standards-based authentication. App ID makes it easy to add an authentication step to your applications with a few lines of code. You can add email or username, social, or enterprise sign in to your apps with APIs, SDKs, prebuilt UIs, or your own branded UIs.

You can choose between several identity providers. For more information, see [Managing authentication](https://cloud.ibm.com/docs/appid?topic=appid-managing-idp). The two most likely options that you would use for IBM Cloud for Financial Services are:



* [Security Assertion Markup Language (SAML)](https://cloud.ibm.com/docs/appid?topic=appid-enterpriseenterprise) - You can create a single sign-on experience for your users by integrating with the consumers identity provider.
* [Cloud Directory](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directory) - You can maintain your own user registry in the cloud. When a user signs up for your app, they are added to your directory of users. This option gives your users more freedom to manage their own account within your app.





 App ID integrations with IBM Cloud services 

You can use App ID with other IBM Cloud offerings. For example, if you're using Red Hat OpenShift on IBM Cloud, you can configure Ingress in your cluster to secure your apps at the cluster level.