vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Example connection details 

Use the following example credentials to query the Ops Manager user API:



* Example username that you created by using the API:



* opsmanager-123



* Example API key that is generated by using the prior steps:



* d043b2ae-bbf2-4f55-8b09-e1ce0906126f



* Example connection string obtained from the deployment dashboard Endpoints section:



* https://opsmanager-d66861a0-9ec2-4d14-9f66-15d4ad4547ac.9b48689db8eb415ca00444450bd4e589.databases.appdomain.cloud:30649





Combine to form the following example command:

curl -k --digest --user 'opsmanager-123:d043b2ae-bbf2-4f55-8b09-e1ce0906126f' 'https://opsmanager-d66861a0-9ec2-4d14-9f66-15d4ad4547ac.9b48689db8eb415ca00444450bd4e589.databases.appdomain.cloud:30649/api/public/v1.0/users/byName/opsmanager-123'







 Updating the Ops Manager user record by using the Ops Manager API 

When you create an Ops Manager user before the initial login steps previously noted, you defined the username and password as arguments. This username can't be changed by using the Ops Manager API or UI, and the password can only be changed via the UI. However, you can update these values by using the Ops Manager 'user' API.

The Ops Manager 'user' API requires several other values to be set when creating a user. These fields are set to opsmanager by default:



* firstName
* lastName
* emailAddress



With your own username and API key that is generated in the prior steps, follow this example command to update these fields:
CreateApiKeyOptions createApiKeyOptions = new CreateApiKeyOptions.Builder()
.name(apiKeyName)
.iamId(iamId)
.description("Example ApiKey")
.build();

Response<ApiKey> response = service.createApiKey(createApiKeyOptions).execute();
ApiKey apiKey = response.getResult();
apikeyId = apiKey.getId();
System.out.println(apiKey.toString());

api_key = iam_identity_service.create_api_key(
name=apikey_name,
iam_id=iam_id
).get_result()

apikey_id = api_key['id']

print(json.dumps(api_key, indent=2))

createAPIKeyOptions := iamIdentityService.NewCreateAPIKeyOptions(apikeyName, iamID)
createAPIKeyOptions.SetDescription("Example ApiKey")

apiKey, response, err := iamIdentityService.CreateAPIKey(createAPIKeyOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(apiKey, "", " ")
fmt.Println(string(b))
apikeyID = apiKey.ID

const params = {
name: apikeyName,
iamId: iamId,
description: 'Example ApiKey',
};

iamIdentityService.createApiKey(params)
.then(res => {
apikeyId = res.result.id
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err);
});





 Updating an API key
To enable the setting to restrict users from creating service IDs, you must have the following assigned access:



* An IAM policy with the Administrator, Operator, or Editor role on the [IAM Identity Service](https://cloud.ibm.com/docs/account?topic=account-account-servicesidentity-service-account-management).



Before you can set limits for login sessions by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).



To restrict who can create service IDs, use the following steps:



1. Create an argument in your main.tf file. The following example enables the restriction to create service IDs by using the ibm_iam_account_settings and iam_account_settings_instance resources.
2. Define whether or not creating a service ID restricted. Supported valid values are



* RESTRICTED - to apply access control
* NOT_RESTRICTED - to remove access control
* NOT_SET - to unset a previous set value.



resource "ibm_iam_account_settings" "iam_account_settings_instance" {
restrict_create_service_id = "RESTRICTED"
}
3. Provision the resources from the main.tf file. For more information, see [Provisioning Infrastructure with Terraform](https://www.terraform.io/cli/run).



1.
For help, check out [Validating tokens](https://cloud.ibm.com/docs/appid?topic=appid-token-validation).





 Next steps 

With App ID installed in your application, you're almost ready to start authenticating users! Try doing one of the following activities next:



* Configure your [identity providers](https://cloud.ibm.com/docs/appid?topic=appid-social)
* Customize and configure [the Login Widget](https://cloud.ibm.com/docs/appid?topic=appid-login-widget)
* Learn more about the [Node.js SDK](https://github.com/ibm-cloud-security/appid-serversdk-nodejs)
* Learn more about the [Swift SDK](https://github.com/ibm-cloud-security/appid-serversdk-swift)
If you use a federated user ID, it's important that you switch to a one-time passcode (ibmcloud login --sso), or use an API ke(ibmcloud --apikey key or @key_file) to authenticate. For more information about how to log in by using the CLI, see [General CLI (ibmcloud) commands](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) under ibmcloud login.

ibmcloud login
2. Create a Databases for Elasticsearch service instance within IBM Cloud by running a command like:

ibmcloud resource service-instance-create <INSTANCE_NAME> <SERVICE_NAME> <SERVICE_PLAN_NAME> <LOCATION> <SERVICE_ENDPOINTS_TYPE> <RESOURCE_GROUP>

The fields in the command are described in the table that follows.



Table 1. Basic command format fields

 Field Description Flag 

 NAME <br><br>Required The instance name can be any string and is the name that is used on the web and in the CLI to identify the new deployment. 
 SERVICE_NAME <br><br>Required Name or ID of the service. For Databases for Elasticsearch, use databases-for-elasticsearch. 
 SERVICE_PLAN_NAME <br><br>Required Standard plan (standard) 
 LOCATION <br><br>Required The location where you want to deploy. To retrieve a list of regions, use the ibmcloud regions command. 
 SERVICE_ENDPOINTS_TYPE Configure the [Service Endpoints](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-service-endpoints) of your deployment, either public or private. The default value is public. 
 RESOURCE_GROUP The Resource group name. The default value is default. -g 
 --parameters JSON file or JSON string of parameters to create service instance -p 



You will see a response like:

Creating service instance INSTANCE_NAME in resource group default of account USER...
OK
Service instance INSTANCE_NAME was created.
From the IBM Cloud console, go to Manage > Access (IAM), and select Roles, and then click Create.
2. Enter the name Discover HPCS for your role.
3. Enter an ID for the role. This ID is used in the CRN, which is used when you assign access by using the API. The role ID must begin with a capital letter and use alphanumeric characters only; for example, DiscoverHPCS.
4. Optional: Enter a succinct and helpful description that helps the users who are assigning access know what level of access that the role assignment gives a user. This description also shows in the console when a user assigns access to the service.
5. From the list of services, select Hyper Protect Crypto Services
6. Select Add for the hs-crypto.discovery.listservers action, and then click Create.



3. Follow the instructions in

[Setting up PKCS #11 API user types](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-access) to set up the service IDs and API keys for the normal user and anonymous user.

Do not set up the SO user type that is mentioned in the instructions. Also, in contrast to the instructions, do not assign the anonymous user service ID the Key operator custom role, but assign the Discover HPCS custom role instead.

With this setup, the anonymous user has only very limited permissions on your Hyper Protect Crypto Services instance and cannot use, create, or manage keys or EP11 keystores.
4. Save the value of the API keys for the normal user and the anonymous user for subsequent steps.
5. Follow the [instructions](https://cloud.ibm.com/hs-crypto?topic=hs-crypto-manage-ep11-keystores-uicreate-ep11-keystore-ui) to create a private EP11 keystore and note the keystore ID for subsequent steps.







 Step 2: Set up the Hyper Protect Crypto Services PKCS 11 library 



 1. Run the Db2 Community Edition container 



1.
* To use the Domino LDAP directory, set the Use remote LDAP directory switch to On. Provide details about the Domino LDAP directory. You collected this information when you performed the prerequisite step.

LDAP server URL
: The LDAP server URL to connect to. For example, ldap://<ldap_server>:<port>.

LDAP binding username
: The username to use to bind to the directory service.

LDAP binding user password
: The password that is associated with the user.

LDAP base DN
: The starting point for searching user entries in LDAP. For example, CN=Users,DC=example,DC=com.

LDAP user filter
: The filter to apply to searches for user entries in LDAP. If unspecified, the default value is (userPrincipalName={0}).

LDAP group filter
: The filter to apply to searches for group entries in LDAP.



10. Optional: In the Advanced options section, make choices about the following configuration settings:

Crawl attachments
: If you want to crawl files that are attached to HCL Notes documents, set the switcher to On.

Automatic code page detection
: If you want the encoding converter to detect the code of pages to crawl, keep the switch set to On. If you set the switcher to Off, specify values for the following fields:

Code page to use
: Specify the character encoding of the pages that you want to crawl. If unspecified, the default value of UTF-8 is used.

Notes formula
: Specify a HCL Notes formula to use to filter the data that you want to crawl. For example, SELECT @IsAvailable(Year) & Year > 2003.

For more information, see [Formula language](https://help.hcltechsw.com/dom_designer/10.0.1/basic/H_NOTES_FORMULA_LANGUAGE.html) in the HCL Notes documentation.
11. Specify the date that you want to use when you filter the documents.
Select App ID as your source service.
5. Select Key Protect as your target service.
6. Specify the scope of the access.
7. Assign the Reader role.
8. Click Authorize.



4. Create an instance of the App ID service.



1. Select your Key Protect instance.
2. Select the root key that you previously authorized.
3. Click Create.





App ID supports state changes to your key.



 Rotating your keys 

When you [rotate your KEK](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-rotation), App ID rewraps the DEKs associated with the rotated key, ensuring that your user data is always protected with your up-to-date encryption key.





 Deleting your keys 

When you [delete your KEK](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys), user data becomes inaccessible within 4 hours of deletion. Although user data is not destroyed when a key is deleted, App ID is no longer able to decrypt the user data, making it inaccessible.







 Enabling customer-managed keys for App ID by using Hyper Protect Crypto Services 

If you choose to work with a key that you manage, you must ensure that valid IAM authorization is assigned to the App ID service.



1. [Create an instance of Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-startedprovision-service).
2. [Initialize your instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm) by loading a master key from smart cards or from your workstation.
3. [Generate or import your own root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys) to your instance of Hyper Protect Crypto Services.
Create, delete, or change the password for users on your deployment.



 ibmcloud cdb deployment-user-create 

Short version - user-create

Create a user on the deployment database.

ibmcloud cdb deployment-user-create <deployment name or CRN> <newusername> <newpassword> [--nowait] [--json]

The newusername needs to be a correctly formatted username for use on the deployment's database. The newpassword needs to comply with the database's password rules and must be at least 10 characters long.



 Command options 



* --nowait or -n Do not wait for the user creation task to complete. Display the user creation task details and exit.
* --json or -j Display results as JSON.







 Examples 

Create a database user called "fred" with a password of "X1234Y5678" on the "MyPSQL" deployment.

ibmcloud cdb deployment-user-create MyPSQL fred X1234Y5678







 ibmcloud cdb deployment-user-delete 

Short version - user-delete

Removes an existing user from the specified database deployment.

ibmcloud cdb deployment-user-delete <deployment name or CRN> <username> [--nowait] [--json]



 Command options 



* --nowait or -n Do not wait for the user deletion task to complete. Display the user deletion task details and exit.
* --json or -j Display results as JSON.







 Examples 

Remove the database user called "fred" from the "MyPSQL" deployment

ibmcloud cdb deployment-user-delete MyPSQL fred







 ibmcloud cdb deployment-user-password 

Short version - user-password

Changes the password for a named user on a specified database deployment.

ibmcloud cdb deployment-user-password <deployment name or CRN> <username> <newpassword> [--nowait] [--json]



 Command options
Additional Users - Redis 6.x only 

Access to your Databases for Redis deployment is not limited to the admin user. You can create users by using the Service Credentials panel, the IBM CLI, or through the IBM Cloud Databases API.

All users on your deployment can use the connection strings, including connection strings for either public or private endpoints.



 Creating Users From the Service Credentials UI 



1. Navigate to the service dashboard for your service.
2. Click Service Credentials to open the Service Credentials panel.
3. Click New Credential.
4. Choose a descriptive name for your new credential.
5. (Optional) Specify if the new credentials should use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings using the specified endpoint. Use of the endpoint is not enforced, it just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated Databases for Redis user is auto-generated.



The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.





 Creating Users From the Command Line 

If you manage your service through the IBM Cloud CLI and the [cloud databases plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), you can create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command.

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

Once the task has finished, you can retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.





 Creating Users from the API 

The Foundation Endpoint that is shown on the Overview panel of your service provides the base URL to access this deployment through the API.
User privileges dictate what actions can be taken by a particular user account. When new users are created, they have no privileges, so in most cases privileges need to be added.



1. Go to Users and groups > Users.
2. Select the user for which you want to grant object privileges and select Object privileges from the overflow menu.
3. Select a database.
You can choose between the Global database and a specific database. Global means that the privileges are related to generic object types such as views, tables, databases, groups.
If you choose Global, the privilege is assigned globally across the system. If the user account is given Create table privileges, this user can create a table in any database.
4. Select a schema.
If you selected Global for the database in step 3, skip this step.
5. Click Edit.
6. Update, grant, or revoke object privileges by putting ticks in corresponding boxes.
7. Click Save.







 Removing users 



1. Go to Users and groups > Users.
2. Select the user that you want to remove and select Remove from the overflow menu.
In the confirmation pop up, click Remove to remove the user or Cancel to cancel this action.









 Groups 



 Creating groups 



1. Go to Users and groups > Groups.
2. Click Create group.
3. In the General settings section, select the following:



1. Name
2. Password expiration date



4. Specify resource allocation settings.
5. Specify session settings.
6. Add users.
In the Include users section, specify which users to add to the group when it's created.
7. Click Create.







 Information about groups 



Table 1. The table lists group-related values and their definitions.

 Value Description 

 Name Specifies the name of the group. 
 Owner Specifies the database user who owns the group. 
 Default priority Specifies the workload management control that specifies the default priority for queries that are run by the users in this group.
If you have a federated user ID, use the ibmcloud login --sso command to log in with your single sign-on ID.







 Creating your database 

This process creates a standard database instance in the service that you specify that might incur extra charges in your selected plan.



1. You must target a resource group, by using the following command:

ibmcloud target -g RESOURCE_GROUP



For more information, see [Working with resources and resource groups (ibmcloud resource).](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource)



1. The database can be created from the CLI by using the ibmcloud resource service-instance-create command. The command takes a service instance name, a service name, plan name, and location.
2. The service name is one of the Cloud Databases services, databases-for-datastax, databases-for-elasticsearch, databases-for-enterprisedb, databases-for-etcd, databases-for-mongodb, databases-for-postgresql, databases-for-redis, messages-for-rabbitmq, or databases-for-mysql.

ibmcloud resource service-instance-create <your_deployment_name> <service_name> standard <region>



Remember the database deployment name. Find your [region identifier here](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-allowlistingallowlist-ips).





 Configuring the Kubernetes App 



1. [Create a Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-getting-startedgetting-started). Choose the location and resource group in which you'd like to set up your cluster. Select the cluster type that you want to use. This example requires only the lite plan, which comes with one worker node. After a cluster is provisioned, you are given a list of steps to access your cluster and set the environment variables under the Access tab.
Select Resource ID as attribute type, keep string equals as operator and put the identifier of your service ID. You can find your service ID on the Details page for the service ID or in the browser URL when configuring it. Click Next.
4. In the Roles and Actions section, select Platform Operator access. Click Review
5. Click Add and then Assign.









 Step 3 Creating an API key for a service ID 

Create an API key for a service ID.



1. From the Service ID page, select API keys and then Create.
2. Enter a name and optional description for your API key and click Create.
3. Copy the API key or click download to save it.

You won’t be able to see this API key again, so be sure to record it in a safe place.



Now that you have your access policies in place for your service ID and your API key created, you can [add access to Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryadd-registry-access-ce) to pull images from your container registry.







 Authorizing access to Container Registry with the CLI 

To pull images from IBM Cloud Container Registry in a different account, you must create a service ID, create access policies for the service ID, and then create an API key to store your credentials.



1. Create an IBM Cloud IAM service ID for your project that is used for the IAM policies and API key credentials in the image pull secret with the iam service-id-create command. Be sure to give the service ID a description that helps you retrieve the service ID later, such as including the project name. For a complete listing of the iam service-id-create command and its options, see the [ibmcloud iam service-id-create](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_id_create) command.
"name": "Example Account",
"owner_iam_id": "$OWNER_IAM_ID"
}'

CreateAccountOptions createAccountOptions = new CreateAccountOptions.Builder()
.parent(parentCRN)
.name("Example Account")
.ownerIamId(enterpriseAccountIamId)
.build();

Response<CreateAccountResponse> response = service.createAccount(createAccountOptions).execute();
CreateAccountResponse createAccountResponse = response.getResult();

System.out.println(createAccountResponse);();

create_account_response = enterprise_management_service.create_account(
parent=parent_crn,
name='Example Account',
owner_iam_id=enterprise_account_iam_id,
).get_result()

print(json.dumps(create_account_response, indent=2))

createAccountOptions := enterpriseManagementService.NewCreateAccountOptions(
parentCRN,
"Example Account",
enterpriseAccountIamID,
)

createAccountResponse, response, err := enterpriseManagementService.CreateAccount(createAccountOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(createAccountResponse, "", " ")
fmt.Println(string(b))

const params = {
parent: parentCrn,
name: 'Example Account',
ownerIamId: enterpriseAccountIamId,
};

enterpriseManagementService.createAccount(params)
.then(res => {
console.log(JSON.stringify(res.result, null, 2));
})
{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users/{userid}/connections/{endpoint_type}'





 Additional Users and Connection Strings 

Access to your Databases for EnterpriseDB deployment is not limited to the admin user. You can create users by using the Service Credentials pane, the IBM CLI, or through the IBM Cloud Databases API.

All users on your deployment can use the connection strings, including connection strings for either public or private endpoints.

When you create a user, it is assigned certain database roles and privileges. These privileges include the ability to log in, create databases, and create other users. For more information, see the [Managing Users, Roles, and Privileges](https://cloud.ibm.com/docs/databases-for-enterprisedb?topic=databases-for-enterprisedb-user-management) page.



 Creating Users in the Service Credentials UI 



1. Navigate to the service dashboard for your service.
2. Click Service Credentials to open the Service Credentials pane.
3. Click New Credential.
4. Choose a descriptive name for your new credential.
5. (Optional) Specify whether the new credentials should use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings that use the specified endpoint. Use of the endpoint is not enforced, it just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated database user in the Databases for EnterpriseDB database are auto-generated.



The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.





 Creating Users from the CLI