vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you use a federated user ID, it's important that you switch to a one-time passcode (ibmcloud login --sso), or use an API ke(ibmcloud --apikey key or @key_file) to authenticate. For more information about how to log in by using the CLI, see [General CLI (ibmcloud) commands](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) under ibmcloud login.

ibmcloud login
2. Create a Databases for MongoDB service instance within IBM Cloud by running a command like:

ibmcloud resource service-instance-create <INSTANCE_NAME> <SERVICE_NAME> <SERVICE_PLAN_NAME> <LOCATION> <SERVICE_ENDPOINTS_TYPE> <RESOURCE_GROUP>

The fields in the command are described in the table that follows.



Table 1. Basic command format fields

 Field Description Flag 

 NAME <br><br>Required The instance name can be any string and is the name that is used on the web and in the CLI to identify the new deployment. 
 SERVICE_NAME <br><br>Required Name or ID of the service. For Databases for MongoDB, use databases-for-mongodb. 
 SERVICE_PLAN_NAME <br><br>Required Standard plan (standard) or Enterprise plan (enterprise) 
 LOCATION <br><br>Required The location where you want to deploy. To retrieve a list of regions, use the ibmcloud regions command. 
 SERVICE_ENDPOINTS_TYPE Configure the [Service Endpoints](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-service-endpoints) of your deployment, either public or private. The default value is public. A MongoDB deployment cannot have both public and private endpoints simultaneously. This parameter cannot be changed after provisioning. 
 RESOURCE_GROUP The Resource group name. The default value is default. -g 
 --parameters JSON file or JSON string of parameters to create service instance -p
* The account owner will need to set [unrestricted visibility of the user list in the account](https://cloud.ibm.com/docs/account?topic=account-iam-user-settinguserlistview)





1. Log in to the IBM Cloud console to view the dashboard.
2. In the Resource summary panel click Services.
3. In the Offering filter box type MQ.
4. Locate and click on your IBM MQ service instance, found under the 'Services' heading.
5. Once in the MQ on Cloud service, click the Application credentials tab.

![Image showing the location of the Application credentials tab](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_app_access_tab.png)
6. Click Add.
7. Enter a Name and Description that will help you identify the application.
8. A unique application username will be generated for you.



* Note: You can edit the text-box to change this to your preferred username. It must have a maximum of 12 characters and be lower case a-z or 0-9. It must also be unique within your IBM MQ service instance.



9. Click Add and Generate API key.
10. Click Show to display the API key to copy and save it for later, or click Download to store the API Key in a file.
11. Click Close.



For security reasons, the API key is only available to be copied or downloaded at the time of creation. If the API key is lost, you must create a new API key.

The application that was added will now have permissions to access queue managers within your IBM MQ service instance. You have now obtained the application username and API key for this application.





 Next step
Navigate to https://app.box.com/developers/console (use your company's Box URL) and click Create New App.
2. From the Create a New App screen, select Enterprise Integration and click Next.
3. On the Authentication Method screen, select OAuth 2.0 with JWT (Server Authentication) and click Next.
4. Name your app and click the Create App button. After you create your Box app, click View Your App.
5. While viewing your app, select Application access as Enterprise. You can use your existing managed users as you continue; you are not required to create new ones.
6. Scroll down to the Application Scopes section of the page and enable the following checkboxes:



* Read and write all folders stored in Box
* Manage Users
* Manage Enterprise Properties



7. Scroll down to the Advanced Features section and enable the following toggles:



* Perform Actions as Users
* Generate User Access Tokens



8. Click the Save Changes button.



If you change your Box App settings, Reauthorize your App so the changes take effect.

The next few steps require assistance from the administrator of your organization's Box account. If you are not your organization's Box Administrator, you can identify the Administrator by opening the Box developer's console and looking under Account settings > Account details > Settings.



1. [Administrator step] Authorize your application client id by navigating to Admin console > Enterprise settings > Apps and scrolling to Custom applications. Example URL:https://app.box.com/main/settings/openbox.
2. [Administrator step] Type the client ID from https://app.box.com/developers/console into the API key field and then click the Authorize button.
3. Return to the Box developer console https://app.box.com/developers/console and scroll to the Add and Manage Public Keys section. Click the Generate the public/private keypair and download your keypair file. Open the file.
4. From the keypair file, cut and paste the following fields into the Discovery tooling.
<service_id>.user-password.update A user's password was updated. A "-failure" flag is included in the message if the attempt to update a user's password failed. 
 <service_id>.user.create A user was created. A "-failure" flag is included in the message if the attempt to create a user failed. 
 <service_id>.user.delete A user was deleted. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.table.delete A table was deleted. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.token.create A token was created. A "-failure" flag is included in the message if the attempt to create a user failed. 
 <service_id>.token.delete A token was deleted. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.privilege.update A privilege was granted. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.privilege.revoke A privilege was revoked. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.database-connection.list Lists active database connections. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.database-connection.stop Terminates a database connection. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.lock.enable Locks a user account indefinitely. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.lock.disable Unlocks a user account. A "-failure" flag is included in the message if the attempt to delete a user failed. 
 <service_id>.policy.list Lists available policies.
You can also create an identity that has the ability to revoke an identity and all the certificates that the identity has been issued. You can see a full list of the attributes in the [Registering a new identity](https://hyperledger-fabric-ca.readthedocs.io/en/release-1.4/users-guide.htmlregistering-a-new-identity) section of the Fabric CA users guide.







 Enrolling an identity 

You can generate the signing certificate and private key for each user that is registered with your CA. If you registered additional admin identities with your CA, you can generate the certificate and key for the admin identity and then include the certificate when you [create your organization MSP](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-create-msp).

Before you enroll an identity, you need to [Associate the identity of the CA admin](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-ca-identity) to be able to operate the CA. If the identity is not set, you will not be able to view the Registered Users table on the CA panel. In the Registered users table, navigate to the action menu ![action menu](https://cloud.ibm.com/docs-content/v1/content/icons/overflow-menu.svg) for the user and click Enroll identity to generate the certificate and key for any user registered with the CA.



* Under the Certificate Authorities dropdown, select Root Certificate Authority.
* Enter the user's Enroll secret.
* (Optional) In the CSR Hostname field, enter the Subject Alternative Names (SAN) to embed in the generated certificate. Specify the host names or custom domain name where the certificate is valid. You can specify a comma separated list of hosts as well as include a wildcard in the domain. For example, 'host1, host2, .example.com. If you leave this field blank, the SAN inside the generated certificate is empty.
You can secure your apps, back-end resources, and APIs easily by using the standards-based authentication provided by App ID. 
 You want to build personalized app experiences for your users. With App ID, you can [store user data](https://cloud.ibm.com/docs/appid?topic=appid-profiles) such as app preferences or information from their public social profiles, and then use that data to customize each experience of your app. 
 You want to manage users in a scalable way. With App ID you can create a [Cloud Directory](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directory), which makes it possible for you to add user sign-up and sign-in to your apps. Cloud Directory provides you with the framework to maintain a user registry that can scale with your user base. With the pre-built functionality for self-service, such as email verification and password resets, you can be sure that your app is authenticating users securely. 







 How it works 

With App ID, you can add a level of security to your apps by requiring users to sign in. You can also use the server SDK or APIs to protect your back-end resources.

Zoom

![App ID architecture diagram](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/appid_architecture1.png)

Figure 1. How App ID works

Application
: Server SDK: You can protect your back-end resources that are hosted on IBM Cloud and your web apps by using the server SDK. It extracts the access token from a request and validates it with App ID. Client SDK: You can protect your mobile apps with the Android or iOS client SDK. The client SDK communicates with your cloud resources to start the authentication process when it detects an authorization challenge.

IBM Cloud
: App ID: After successful authentication, App ID returns access and identity tokens to your app.
6. Click Create.



After you create the account, the account owner can log in to the account to invite other users and manage their access.





 Creating accounts by using the CLI 



1. If you want to add the account to an account group, find the names and IDs of existing account groups.

ibmcloud enterprise account-groups --recursive
2. Create the account by running the following command. If you don't specify a parent account group, the account is added directly under the enterprise. To make a different user the account owner, specify their IBMid on the --owner option.

ibmcloud enterprise account-create NAME
[--parent-account-group ACCOUNT_GROUP_NAME] [--owner USER_ID]







 Creating accounts by using the API 

To create a new account in the enterprise, call the Enterprise Management API as shown in the following sample request, replacing the IAM token and ID variables with the values from your enterprise. For detailed information about the API, see [Enterprise Management API](https://cloud.ibm.com/apidocs/enterprise-apis/enterprisecreate-a-new-account-in-an-enterprise).



* Curl
* Java
* Python
* Go
* Node



curl -X POST "https://enterprise.cloud.ibm.com/v1/accounts
-H "Authorization: Bearer <IAM_Token>"
-H 'Content-Type: application/json'
-d '{
"parent":
"crn:v1:bluemix:public:enterprise::a/$ENTERPRISE_ACCOUNT_ID::account-group:$ACCOUNT_GROUP_ID",
"name": "Example Account",
"owner_iam_id": "$OWNER_IAM_ID"
}'

CreateAccountOptions createAccountOptions = new CreateAccountOptions.Builder()
.parent(parentCRN)
.name("Example Account")
.ownerIamId(enterpriseAccountIamId)
.build();
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value(EXAMPLE_USER_ID)
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();

PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:iam::::role:Viewer")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
.value(exampleAccountId)
.operator("stringEquals")
.build();

ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
.name("serviceType")
.value("service")
.operator("stringEquals")
.build();
For example: "Normal user".
name: "<normal_user_name>"
 The 128-bit UUID of the private keystore. For example: "f00db2f1-4421-4032-a505-465bedfa845b".
tokenspaceID: "<private_keystore_spaceid>"
iamauth: defaultiamcredential
sessionauth:
enabled: false Enable this option on both keystores to encrypt and authenticate the keystores.
 Authenticated keystore password; must be 6-8 characters in length
 The authenticated keystore password must be identical to the anonymous user's tokenspaceIDPassword.
tokenspaceIDPassword: "<private_keystore_password>"
2: The index of the anonymous user MUST be 2.
 The name for the anonymous user. For example: "Anonymous".
name: "<anonymous_user_name>"
 The 128-bit UUID of the public keystore. For example: "ca22be26-b798-4fdf-8c83-3e3a492dc215".
tokenspaceID: "<public_keystore_spaceid>"
iamauth:
<<: defaultiamcredential
 The API key for the anonymous user. All other users can specify API key using the C_Login command.
apikey: "<apikey_for_anonymous_user>"
sessionauth:
enabled: false Enable this option on both keystores to encrypt and authenticate the keystores.
 The authenticated keystore password must be identical to the Normal user's tokenspaceIDPassword.
tokenspaceIDPassword: Authenticated keystore password; must be 6-8 characters in length.

logging:
 Set the logging level.
 The supported levels, in an increasing order of verboseness: 'panic', 'fatal', 'error', 'warning'/'warn', 'info', 'debug', 'trace'. The Default value is 'warning'.
* Viewer role or higher on the resource group.
* Editor or administrator role on the service.



Complete the following steps:



1. Go to Manage > Access (IAM) > Users in the IBM Cloud console.
2. Click Invite users.
3. Specify the email address of the user. If you are inviting more than one user, they are all assigned the same access.
4. Add the user to one or more of the access groups that you created in the previous step.
5. Click Invite.



To learn more about the invitation flow and how users can accept invitations, see [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv).

You can also give users access to your account by using trusted profiles. For more information, see [What makes a good trusted profiles strategy?](https://cloud.ibm.com/docs/account?topic=account-account_setuptrustedprofiles_strategy).





 Step 9: Explore your support options 

You can use the Support Center to get help with any issues that you might encounter. To access the Support Center, click the Help icon ![Help icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/help.svg) > Support center from the console menu bar.



* The Help just for you section features links to common tasks, troubleshooting, and FAQs specific to the resources in your account.
* The Featured FAQs section provides FAQs related to platform tasks, for example, resetting your password, IAM, and upgrading your account.
* The Contact support section provides the options for getting in touch with a support representative: start a live chat, contact by phone, or create a support case.
[Create an access group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag) for the users and service IDs that you want to give access to and add those users to the group.

For example, you might have a group of security admins that might need the same level of access.
2. After you create a group and add users, go to Manage > Access (IAM) > Access Groups.
3. Select a table row, and click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg) to open a list of options for that access group.
4. Click Assign access.
5. From the list of services, select Secrets Manager and click Next.
6. In the Resources section, select Specific resources. Choose a region and Secrets Manager service instance. Then, click Next.

If you choose not to provide a specific instance, access is assigned for all instances of the service within the region that you selected. If you choose not to select a region, access is granted for all instances of the service in your account.
7. Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to assign access for access group.
8. Review your selections and click Add.
9. Click Assign.

Now you can add users and service IDs to the access group so that you can assign access to Secrets Manager with a single access policy. For more information, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).







 Assigning access to a secret group 

You can further narrow the scope of access to secrets in your instance by creating and managing

secret groups.



 Assigning access to a secret group in the service UI
Go to the [IBM Cloud login page](https://cloud.ibm.com/), and click Create an IBM Cloud account.
2. Enter your IBMid email address. If you don't have an existing IBMid, an ID is created based on the email that you enter.
3. Complete the remaining fields with your information.

You are prompted for your credit card information to verify your identity and secure your account. You can [try out IBM Cloud for free](https://cloud.ibm.com/docs/overview?topic=overview-tutorial-try-for-free) and pay only for the billable services that you choose to use, with no long-term contracts or commitments.
4. Click Create account.
5. Confirm your account by clicking the link in the confirmation email that's sent to your provided email address.



See [Account types](https://cloud.ibm.com/docs/account?topic=account-accounts) to compare and choose an account type.





 Personal use availability 





 Personal use availability 

The following table shows the countries where personal use of our platform that is not related to business, trade, craft, or professional purposes are not supported

Africa

Asia

Europe



Table 2. Countries in Africa that are not supported

 Country 

 Algeria 
 Cameroon 
 Canary Islands 
 Egypt 
 Ghana 
 Ivory Coast 
 Kenya 
 Mauritania 
 Nigeria 
 Seychelles 
 Tanzania 
 Uganda 



IBM® Norway and IBM® Switzerland are able to contract with local customers to offer personal use accounts.

To work with a local Business Partner, go to the [IBM Business Partner Directory](https://www.ibm.com/partnerworld/bpdirectory/). Customers are not required to have a VAT ID to work with a local Business Partner.





 Using a federated ID 

A federated ID is an ID within a company's domain that is registered with IBM so that the domain and user credentials can be used to access IBM web applications. You can sign up for IBM Cloud with a federated ID only if your company is already registered with IBM.
Users that are created in the API are given the roles [readWriteAnyDatabase](https://docs.mongodb.com/manual/reference/built-in-roles/readWrite) and [dbAdminAnyDatabase](https://docs.mongodb.com/manual/reference/built-in-roles/dbAdmin).

If you need users to have a different role, use the admin user to change their role.

Users that are created directly from the API do not appear in Service Credentials, but you can add them.

The Foundation Endpoint that is shown on the Overview section of your service provides the base URL to access this deployment through the API. To create and manage users, use the base URL with the [/users endpoint](https://cloud.ibm.com/apidocs/cloud-databases-apicreates-a-database-level-user).

The command looks like:

curl -X POST 'https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"username":"jane_smith", "password":"newsupersecurepassword"}'

To retrieve a user's connection strings, use the base URL with the /users/{userid}/connections endpoint.





 MongoDB-created users and roles 

If the built-in users and roles do not suit your environment, [create users and roles](https://docs.mongodb.com/manual/tutorial/manage-users-and-roles/create-a-user-defined-role) directly in MongoDB. The admin user for your deployment has the power to create any role or set of privileges for use on your deployment.

Users and roles that are created directly in MongoDB do not appear in Service Credentials and are not integrated with your IBM Cloud account or [IAM](https://cloud.ibm.com/docs/databases-for-mongodb?topic=cloud-databases-iam).
Depending on your workflow, instead of creating a service-level credential (step 4), you can use a personal IAM API key, as detailed in [Creating an API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key).

You can also complete these steps on the command line by using the [IBM Cloud CLI tool chain](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).





 Generating a bearer token to authenticate against the IBM Cloudant API 

In step 4.b., you wrote down the apiaccess key. Use that key now:

curl -k -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" --data-urlencode "apikey=aSCsx4...2lN97h_2Ts" "https://iam.cloud.ibm.com/identity/token"

The apiaccess key returns the following information (abbreviated):

{
"access_token": "eyJraWQiOiIyMDE5MD...tIwkCO9A",
"refresh_token": "ReVbNrHo3UA38...mq67g",
"token_type": "Bearer",
"expires_in": 3600,
"expiration": 1566313064,
"scope": "ibm openid"
}

Create an environment variable to save some typing by using the value under the access_token key in the response data:

export TOK="Bearer eyJraWQiOiIyMDE5MD...tIwkCO9A"





 Creating the _replicator database on the Source side 

URL is the Source instance URL that you previously wrote down in step 4.b.