vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Adding user credentials with the API 

You can store a username and password programmatically by calling the Secrets Manager API.

The following example shows a query that you can use to create a username and password secret. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.

curl -X POST
-H "Authorization: Bearer {IAM_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
"name": "example-username-password-secret",
"description": "Description of my user credentials secret",
"secret_type": "username_password",
"secret_group_id": "bfc0a4a9-3d58-4fda-945b-76756af516aa",
"labels": [
"dev",
"us-south"
],
"username": "example-username",
"password": "example-password",
"rotation": {
"auto_rotate": true,
"interval": 10,
"unit": "day"
},
"custom_metadata": {
"metadata_custom_key": "metadata_custom_value"
},
"version_custom_metadata": {
"custom_version_key": "custom_version_value"
}
}'
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets"





 Adding user credentials with Terraform 

You can store a username and password programmatically by using Terraform for Secrets Manager.
In the description, provide a list of actions available for this trusted profile.
3. Create conditions for your trusted profile. For federated users, set the type attribute to Profile-SAML. The realm-name is the IdP URL. For more information, see the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-api).

curl -X POST 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID/rules' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{
"type": "Profile-SAML",
"realm_name": "https://www.example.org/my-nice-idp",
"expiration": 43200,
"conditions": [
{
"claim": "groups",
"operator": "EQUALS",
"value": ""cloud-docs-dev""
}
]
}'

There is a limit of 20 claim rules per trusted profile.
4. Create an access policy. For more information, see [IAM Policy Management API?](https://cloud.ibm.com/apidocs/iam-policy-management).

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME's RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
accessTokenUri: <oauthServerURL>/token
userAuthorizationUri: <oauthServerURL>/authorization
resource:
userInfoUri: <oauthServerURL>/userinfo



For a step-by-step example, check out [this blog](https://www.ibm.com/cloud/blog/creating-spring-boot-applications-app-id){: external!







 Using App ID with other languages 

With an OIDC-compliant client SDK, you can use App ID with other languages. Check out the list of [certified libraries](https://openid.net/developers/certified/) for more information.





 Next steps 

With App ID installed in your application, you're almost ready to start authenticating users! Try doing one of the following activities next:



* Configure your [identity providers](https://cloud.ibm.com/docs/appid?topic=appid-social)
* Customize and configure [the Login Widget](https://cloud.ibm.com/docs/appid?topic=appid-login-widget)
* Learn more about the [Node.js SDK](https://github.com/ibm-cloud-security/appid-serversdk-nodejs)
Selecting Manage Users page from drop-down menu
3. With the Users tab selected, click Add.

Zoom

![View of the web console Manage Users page](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/add_users.png)

Figure 2. Clicking Add to create a user
4. Select Add IBMid user.

Zoom

![View of the web console Add IBMid user page](https://cloud.ibm.com/docs-content/v1/content/2a59ee244ed61eb35ab50e45757b42d22f720132/Db2onCloud/images/add_ibmid_user.png)

Figure 3. Creating an IBMid user
5. Enter a User ID and an IBMid in the provided fields. Click Create.

The IBMid field can be used to specify either an IBMid or a service ID for the user.







 REST API experience 

The Db2 on Cloud REST API was enhanced to also accept an IAM access token for the functions that previously accepted a database service-generated access token.



* To add a new IBMid user, run the following example API call:

curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid>","ibmid":"<userid>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"

The userid value for "id" cannot match the full email ID. It can match the first part of the email ID, but that is not necessary. The two different IDs are not linked together in any way.
To add users to an access group by using the CLI, run the [ibmcloud iam access-group-user-add](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_user_add) command.

ibmcloud iam access-group-user-add GROUP_NAME USER_NAME [USER_NAME2...]

For example the following command adds user name@example.com to the example_group access group.

ibmcloud iam access-group-user-add example_group name@example.com

Or, you can give users access by adding trusted profiles to your access groups. For more information, see [What makes a good trusted profiles strategy?](https://cloud.ibm.com/docs/account?topic=account-account_setuptrustedprofiles_strategy) and [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=cli).





 Setting up your access groups by using the API 

To assign access, call the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-management?code=gocreate-policy) as shown in the follwing example. Replace the role_id vaiable with the role you want to assign: Viewer, Editor, or Administrator.



* Curl
* Java
* Python
* Go
* Node



curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}
],
"roles":[
* Add users to access groups. Click Add for each access group that you want the users to belong to.
* Manually assign users access. Expand the section to assign individual IAM access policies or classic infrastructure permissions.



* Select Classic infrastructure, and then choose from the three permission sets.
* Select a group of services like All Identity and Access enabled services, All Account management services, and All IAM Account Management services, or a specific service. Next, you can scope the access to the entire account or just one resource group. Then, select all roles that apply. To view what actions are mapped to each role, click the numbers listed next to each role.

Some services support the use of advanced operators to grant access to resources that satisfy specific naming conventions. See [Assigning access by using wildcard policies](https://cloud.ibm.com/docs/account?topic=account-wildcard) for more information.
* Select Account management, and then choose from the all account management services option or select a specific service. Then, select all roles that apply.





5. Select Add to save the access assignment to the invitation.
6. After you add all the necessary access assignments, click Invite.



You can cancel an invitation for any users that are shown in a Processing or Pending state in the Status column of the [Users page](https://cloud.ibm.com/iam/users). If an invited user did not receive an invitation, you can resend the invitation to any user in a Pending state. You can add more policies and permissions only after a user accepts the invitation.





 Adding VPN-only users 

Any user with the following permissions can add a VPN-only user:



* For classic infrastructure, you must have the Manage Users permission on the account.
* For IAM access, you must have the Administrator or Editor role on the user management account management service.



To add a VPN-only user, use the following steps:



1. On the Users page, click Add VPN-only user.
2. Enter the personal information details for the user.
3. Click Save.







 Inviting users by using the CLI
: If you need to see an in-depth view of the user profile information that is returned by an identity provider, you can call the [/userinfo endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Authorization_Server_V4/userInfo). It's recommended to use this endpoint only if the information cannot be mapped to the token as it requires extra network calls.

/api/v1/attributes
: If your application requires reading and updating custom profile attributes for a currently logged in user, then you can use the /attributes endpoint. For example, the user wants to update a food preference.

/management/v4/<tenantID>/users
: If you're building administrative interfaces or processes that might apply to multiple users, you can use the App ID management API. Specifically, you can use the /users endpoint.

The easiest ways to work with user information are by using the GUI or an SDK. With those options, all the API calls are done behind the scenes for you.







 Accessing attributes at run time 

After successful user authentication, your app receives access and identity tokens from App ID. The service automatically injects a subset of attributes into your access and identity tokens. If the information isn't in the token, you can use any of the following endpoints to find the information.



 Accessing the /userinfo endpoint 

To see the information about your users that is provided by your configured identity providers, you can access your predefined attributes.



1. Be sure that you have a valid access token with an openid scope. You can verify that your token is valid by using the /introspect endpoint.
2. Make a request to the [/userinfo endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Authorization_Server_V4/userInfo). If new tokens are not explicitly passed to the SDK, App ID uses the last received tokens to retrieve and validate the response. Passing an identity token is optional, but passed is used to validate the response.



* Curl
You can use the /resend/<templateName> to resend an email when a user does not receive it for some reason.

Supply the following data in the request body:



* The tenantID.
* The template name
* The Cloud Directory user UUID.







 Change details 

When a user is signed in to your app, they can update some of their information. You can use the /Users/<userID> to get and update their information.

When the user details are updated, the endpoint gets the updated user data in the request body in [SCIM format](https://datatracker.ietf.org/doc/html/rfc7628). Be sure that you change only the relevant details.

Their email address cannot be changed.
[View of the web console dashboard page and drop-down menu](https://cloud.ibm.com/docs-content/v1/content/68e10678b2f8b8694884ecb5442c326c9b60a3fb/Db2whc/images/manage_users.png)

Figure 1. Selecting Manage Users page from drop-down menu
3. With the Users tab selected, click Add.

Zoom

![View of the web console Manage Users page](https://cloud.ibm.com/docs-content/v1/content/68e10678b2f8b8694884ecb5442c326c9b60a3fb/Db2whc/images/add_users.png)

Figure 2. Clicking Add to create a user
4. Select Add IBMid user.

Zoom

![View of the web console Add IBMid user page](https://cloud.ibm.com/docs-content/v1/content/68e10678b2f8b8694884ecb5442c326c9b60a3fb/Db2whc/images/add_ibmid_user.png)

Figure 3. Creating an IBMid user
5. Enter a User ID and an IBMid in the provided fields. Click Create.

The IBMid field can be used to specify either an IBMid or a service ID for the user.







 REST API experience 

The Db2 Warehouse on Cloud REST API was enhanced to also accept an IAM access token for the functions that previously accepted a database service-generated access token.



* To add a new IBMid user, run the following example API call:
You can define such a context for either federated users based on properties in the enterprise directory, e.g., for users labeled as administrators or project members. Or you can allow access for [compute identities](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profilecreate-profile-compute-ui), i.e., specific computing resources like a virtual server instance (VSI).



To learn more about the above concepts and how to use them in your development project, see the tutorial [Best practices for organizing users, teams, applications](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications). Moreover, regularly cleaning up inactive identities is important to reduce security risks. The blog post [Cloud Security: Identify Inactive Identities](https://www.ibm.com/cloud/blog/cloud-security-identify-inactive-identities) discusses your options available on IBM Cloud.





 Conclusions 

In this tutorial, you learned how to increase application security by moving from standard to advanced capabilities. The journey included the isolation of compute, network and data resources, and also included asserting greater control over encryption keys. Security by design is not a hollow phrase, it means to assess security requirements early on and take them into account when designing a solution. As you have seen, IBM Cloud provides the building blocks for different security requirements and types of applications. Now you are recommended to combine the blocks for your secure cloud application. And don't forget to check out the next section with links to further security-related resources.





 Related content 

The following resources provide additional insights to security on IBM Cloud.



* Tutorial: [Apply end to end security to a cloud application](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-cloud-e2e-security)
* Tutorial: [Best practices for organizing users, teams, applications](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications)
* Blog: [Cloud App Security: What Makes a Secure App?]
Zoom

![Create Dynamic Rule](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-create-dynamic-rule1.png)

Figure 9. Create Dynamic Rule
3. Click Add a condition, complete the following values, then click Add.



* In the Allow users when field, enter the attribute key that is used by the IDP administrator in the ID provider user attributes, such as project (this string is a convention that is defined during planning).
* Select Contains as the Qualifier.
* In Values, enter the value, such as ml. This is the same value that the IDP administrator uses in the IDP user profile definition. It is typically the project name.
* You might want to increase the Session duration to increase the period before users must log back in. Logged-in users keep their access group membership for that period, and reevaluation takes place on the next login.



Zoom

![Add Condition to Dynamic Rule](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-create-dynamic-rule2.png)

Figure 10. Add Condition to Dynamic Rule







 Step 5: Add users 

When you use App ID as ID provider with the Cloud directory, you can create users in the Cloud user interface.



1. Open the App ID instance page from the [resource list](https://cloud.ibm.com/resources) Services and software section.
2. Go to Manage Authentication → Cloud Directory → Users, and click Create User. Enter the user details.







 Step 6: Create or modify users' project assignments 

If the IDP administrator will assign users to projects, you can define project values in the user's attributes.



1.
Personally Identifiable Information (PII): When creating buckets or adding objects, please ensure to not use any information that can identify any user (natural person) by name, location or any other means in the name of the bucket or object.

Syntax

PUT https://{endpoint}/{bucket-name} path style
PUT https://{bucket-name}.{endpoint} virtual host style

Example request

This is an example of creating a new bucket called 'images'.

PUT /images HTTP/1.1
Authorization: Bearer {token}
Content-Type: text/plain
Host: s3.us.cloud-object-storage.appdomain.cloud
ibm-service-instance-id: {ibm-service-instance-id}

Example request

PUT /images HTTP/1.1
Authorization: 'AWS4-HMAC-SHA256 Credential={access-key}/{date}/{region}/s3/aws4_request,SignedHeaders=host;x-amz-date;,Signature={signature}'
x-amz-date: {timestamp}
Content-Type: text/plain
Host: s3.us.cloud-object-storage.appdomain.cloud

Example response

HTTP/1.1 200 OK
Date: Wed, 24 Aug 2016 17:45:25 GMT
X-Clv-Request-Id: dca204eb-72b5-4e2a-a142-808d2a5c2a87
Accept-Ranges: bytes
Server: Cleversafe/3.9.0.115
X-Clv-S3-Version: 2.5
x-amz-request-id: dca204eb-72b5-4e2a-a142-808d2a5c2a87
Content-Length: 0

--------------------





 Create a bucket with a different storage class
let userInfo = userInfo, err == nil {
return
}
}

Example output:

"sub": "cad9f1d4-e23b-3683-b81b-d1c4c4fd7d4c",
"name": "John Doe",
"email": "john.doe@gmail.com",
"picture": "https://lh3.googleusercontent.com/-XdUIqdbhg/AAAAAAAAI/AAAAAAA/42rbcbv5M/photo.jpg",
"gender": "male",
"locale": "en",
"identities": [
{
"provider": "google",
"id": "104560903311317789798",
"profile": {
"id": "104560903311317789798",
"email": "john.doe@gmail.com",
"verified_email": true,
"name": "John Doe",
"given_name": "John",
"family_name": "Doe",
"link": "https://plus.google.com/104560903311317789798",
"picture": "https://lh3.googleusercontent.com/-XdUIqdbhg/AAAAAAAAI/AAAAAAA/42rbcbv5M/photo.jpg",
"gender": "male",
"locale": "en",
"idpType": "google"
}
}
]
3. Verify that the sub claim exactly matches the sub claim in the identity token. If these do not match, do not use the returned information.
- - 0717-c034f0f9-2269-44e4-a76a-4f4ad8c47b65 my-vol-att1





 Creating an instance template and add user tags to volumes from the CLI 

You can specify user tags for boot and data volumes when you create an instance. Run the instance-template-create command and specify user tags in the user_tags parameter.

In the following example, the command adds two user tags to the instance template that are to be applied to the volumes.

ibmcloud is instance-template-create my-tpl-1 my-vpc-2 us-south-1 bx2-2x8 cli-subnet-1 --image ibm-centos-7-9-minimal-amd64-6 --keys my-keys4 --boot-volume '{"name": "boot-vol-1", "volume": {"name": "my-boot-vol-1", "profile": {"name": "general-purpose"},"user_tags": ["env:test1", "env:dev1"]}}' --volume-attach '[{"name": "my-vol-att", "volume": {"name":"my-vol-1", "profile": {"name": "general-purpose"}, "capacity": 10 ,"user_tags": "env:test1", "env:dev1"] }}]'

Creating instance template my-tpl-1 under account vpcdemo as user myuser@mycompany.com...

ID 38ef87e9-3a4d-4d72-8450-86c16b76ae0d
Name my-tpl-1
CRN crn:v1:bluemix:public:is:us-south-1:a/7f75c7b025e54bc5635f754b2f888665::instance-template:38ef87e9-3a4d-4d72-8450-86c16b76ae0d
Creating a new user from the CLI or API doesn't automatically populate that user's connection strings into Service Credentials. If you want to add them there, you can create a new credential with the existing user information.

Enter the username and password in the JSON field Add Inline Configuration Parameters, or specify a file where the JSON information is stored. For example, {"existing_credentials":{"username":"Robert","password":"supersecure"}}. The resulting connection strings have the specified username and password that is filled in.

Generating credentials from an existing user does not check for or create that user.







 Connection String Breakdown 



 The grpc Section 

The "grpc" section contains information that is suited to applications that make connections to etcd.



Table 1. etcd/URI connection information

 Field Name Index Description 

 Type Type of connection - for etcd, it is "uri" 
 Scheme Scheme for a URI - for etcd, it is "https" 
 Path Path for a uri 
 Authentication Username The username that you use to connect. 
 Authentication Password A password for the user - might be shown as $PASSWORD 
 Authentication Method How authentication takes place; "direct" authentication is handled by the driver. 
 Hosts 0... A hostname and port to connect to 
 Composed 0... A URI combining Scheme, Authentication, Host, and Path 
 Certificate Name The allocated name for the self-signed certificate for database deployment 
 Certificate Base64 A base64 encoded version of the certificate. 





* 0... indicates that there might be one or more of these entries in an array.







 The CLI Section 

The "CLI" section contains information that is suited for connecting with etcdctl .



Table 2. etcdctl/cli connection information

 Field Name Index Description 

 Bin The recommended binary to create a connection; in this case, it is etcdctl. 
 Composed A formatted command to establish a connection to your deployment. The command combines the Bin executable, Environment variable settings, and uses 
 Environment A list of key/values you set as environment variables. 
 Arguments 0...
Variable Description 

 EntityID The identifier that lets the identity provider know that App ID issued the SAML request. 
 Location URL The location that the identity provider sends the SAML assertions after successfully authenticating a user. 
 Binding The instructions on how the identity provider must send the SAML response. 
 NameID Format How the identity provider knows that which identifier format it needs to send in the subject of an assertion and how App ID identifies users. The ID must take the following form: <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">. 
 WantAssertionsSigned The way that an identity provider checks to see whether it needs to sign the assertion. The service expects that the assertion is signed, but does not support encrypted assertions. 
 KeyDescriptor The SAML signing and encryption certificates that can be used to configure your identity provider to verify the signed SAML request and encrypt the response. 



3. Provide the data to your identity provider. If your identity provider supports uploading the metadata file, you can do so. If it doesn't, configure the properties manually. Not every identity provider uses the same properties, so you might not use all of them.

The property names might differ between identity providers.
4. Toggle SAML 2.0 Federation to Enabled.







 Providing metadata to App ID 

You can obtain data from your identity provider and provide it to App ID. You can initiate login to your applications from IBM Cloud or your identity provider.



 Providing metadata with the UI 

To log in to your applications from the IBM Cloud UI, follow these steps.



1. Navigate to the SAML 2.0 tab of the App ID dashboard.
2. Add the Provider name. The default name is SAML.
3. Enter the following metadata that you obtained from the identity provider in the Provide Metadata from SAML IdP section.



Table 2. The information that must be provided to App ID

 Variable Description 

 Sign-in URL The URL that the user is redirected to for authentication.