vania-janet/multiturn-rag-retrieval-data huggingface dataset:
resource_group_id Optional. The resource group where you want to organize and manage your service instance. If you do not specify the value, the default resource group is Default. 
 signature_threshold Required. The number of administrator signatures that is required to execute administrative commands. The valid value is in the range 1 - 8. You need to set it to at least 2 to enable quorum authentication. 
 revocation_threshold Required. The number of administrator signatures that is required to remove an administrator after you leave imprint mode. The valid value is in the range 1 - 8. 
 admins Required. The list of administrators for the instance crypto units. You can set up to eight administrators and the number needs to be equal to or greater than the thresholds that you specify. The following values need to be set for each administrator:<br><br>name: <br>The name of the administrator. It needs to be no more than 30 characters in length.<br><br>key:<br><br><br><br> * If you are using signature key files on the local workstation that are created by the TKE CLI plug-in and are not using a third-party signing service, specify the absolute path and file name of the signature key file that is to be used.<br> * If you are using a signing service to provide signature keys, specify the name of the signature key depending on the signing service definition.
Types of multifactor authentication 

Multifactor authentication (MFA) adds an extra layer of security to your account by requiring all users to authenticate by using another authentication factor beyond an ID and password. MFA is also commonly known as two-factor authentication (2FA).

The following two types of MFA options might be enabled for your account:

ID-based MFA
: ID-based MFA is the preferred method for requiring MFA in an account. This type of MFA is associated with each users' ID and authenticates them across all accounts that they are a member of, so they authenticate only one time. This type of MFA overrides the legacy account-based MFA options.
: ID-based MFA applies to all resources in any type of account. When ID-based MFA is enabled, a user is prompted to provide a unique identifier (such as a username or email) and a one-time password (OTP) generated by an authenticator app or a hardware token. After the correct OTP is entered, access is granted to the requested resource. This type of MFA is much more secure than account-based MFA because it is not limited to classic infrastructure resources and applies to all resources within the account. It also reduces the risk of a breach because of a weak password or the use of the same password across multiple accounts.

Account-based MFA
:
Classic infrastructure

Account-based MFA applies only to classic infrastructure and not to other resources in your account. Unlike with ID-based MFA, legacy MFA options, such as security questions, are enforced only on the specific account where the MFA is enabled. If you have a different legacy MFA option set up for each account that you are a member of, you must authenticate in a different way each time that you switch accounts.

Legacy account-based MFA was available to accounts with classic infrastructure prior to the release of ID-based MFA. This legacy offering continues to work for accounts with classic infrastructure and requires the user to provide a secondary authentication input when logging in or switching to accounts with classic infrastructure. Non-classic resources are not secured by this legacy offering. ID-based MFA is for customers that want to implement MFA to secure the full range of IBM Cloud offerings.



 ID-based MFA options
For a complete list of the options and setup information, see [Advanced password management](https://cloud.ibm.com/docs/appid?topic=appid-cd-strengthcd-advanced-password). 



These features are available only to those instances that are on the graduated tier pricing plan and that were created after 15 March 2018.





 When am I charged? 

Your first 1000 authentication events and 1000 authorized users per service instance are free of charge. You are charged monthly for any additional authentication events and authorized users, as well as any advanced security features that are enabled for each service instance.





 How do I stop getting charged for App ID? 

If you no longer want to be charged for authentication events and authorized users, you need to ensure that no user can authenticate by using App ID. You must remove the App ID configuration from your app code or confirm that your users are not able to use the configuration to log in to your app. To stop getting charged for advance security features, you must disable them on the Manage Authentication > Authentication Settings page of the service dashboard.
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--secret-version-prototype ([SecretVersionPrototype](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-version-prototype-example-schema))
: Specify the properties for your new secret version. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-version-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-version-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --secret-version-prototype='{"payload": "updated secret credentials", "custom_metadata": {"anyKey": "anyValue"}, "version_custom_metadata": {"anyKey": "anyValue"}}'







 ibmcloud secrets-manager secret-versions 

List the versions of a secret.

A successful request returns the list of versions of a secret, along with the metadata of each version.

ibmcloud secrets-manager secret-versions --secret-id SECRET-ID



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters.
ibmcloud secrets-manager secret-versions --secret-type SECRET-TYPE --id ID



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.





 Examples 

ibmcloud secrets-manager secret-versions --secret-type=arbitrary --id=exampleString







 ibmcloud secrets-manager secret-version 

Get a version of a secret by specifying the ID of the version or the alias previous.

A successful request returns the secret data that is associated with the specified version of your secret, along with other metadata.

ibmcloud secrets-manager secret-version --secret-type SECRET-TYPE --id ID --version-id VERSION-ID



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.
Each region has its own root-of-trust key that is stored in [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial), which is backed up by HSM. Each service instance (tenant) has its own data encryption and token signature keys, which are encrypted by using the region's root-of-key trust. 
 What is the key strength that you use? The service uses 16 bytes. 
 Do you invoke any remote APIs that expose encryption capabilities No, we do not. 



* What clock synchronization does App ID use?

App ID runs in IBM Cloud, which uses an internal NTP server: servertime.service.softlayer.com.

Synchronizing your application with App ID's time source depends on which environment that you're using to run your application.



* If your application is running in IBM Cloud Classic Infrastructure, set your NTP servers to servertime.service.softlayer.com.
* If your application is running in IBM Cloud VPC Infrastructure, set your NTP servers to time.adn.networklayer.com.
* If your application is not running in IBM Cloud, you do not have access to these time servers. In this case, set your NTP servers to time-a.nist.gov or time-b.nist.gov.



* What is the difference between App ID and Keycloak?

Both App ID and Keycloak can be used to add authentication to applications and secure services. The main difference between the two offerings is how they're packaged.

Keycloak is packaged as software, which means that you, as the developer, are responsible for maintaining functionality of the product after you download it. You're responsible for hosting, high-availability, compliance, backups, DDoS protection, load balancing, web firewalls, databases, and more.

App ID is a fully managed offering that is provided "as-a-service". This means that IBM takes care of the operation of the service, handles compliancy, availability in multiple zones, SLA, and more.
"md5": {
"type": "text"
}
}
}
}'
Show more

The URL is the https[connection string](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-connection-strings) from your deployment.

To use the index, encode the file contents as base64. To encode an example file README.md in bash, ENC=$(base64 -w 0 README.md). Then, build a checksum over the content, HASH=$(md5sum README.md).

The download function compares the hash values on each sync run and if the values are unchanged since the last sync, no new download is attempted. If any document in the index has no md5 value, all downloads are attempted again.

Next, upload the document to the index. Note that the file name is supplied in the URL as well.

For Elasticsearch 6:

curl -X PUT "https://user:password@host:port/ibm_file_sync/files/README1.md" -H 'Content-Type: application/json' -d'
{
"name": "README1.md",
"blob": '""$ENC""',
"md5": '""$HASH""'
}'

For Elasticsearch 7 (note only the URL is changed):

curl -X PUT "https://user:password@host:port/ibm_file_sync/_doc/README1.md" -H 'Content-Type: application/json' -d'
{
"name": "README1.md",
"blob": '""$ENC""',
"md5": '""$HASH""'
}'

You can verify the uploaded data.

For Elasticsearch 6:

curl https://user:password@host:port/ibm_file_sync/files/README.md?pretty
For production environments, it is recommended that you assign the Reader access role, and then use the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-managementcreate-policy) to control specific domains. For more information, see the [docs](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificatesauthorize-specific-domains).

The maximum length is 128 characters. The minimum length is 4 characters. The value must match regular expression /(.?)/.

--cloud-internet-services-crn (string)
: A CRN that uniquely identifies an IBM Cloud resource.

The maximum length is 512 characters. The minimum length is 9 characters. The value must match regular expression /^crn:v[0-9](:([!A-Za-z0-9-._$&'()+,;=@/]|%[0-9A-Z]{2})){8}$/.

--classic-infrastructure-username (string)
: The username that is associated with your classic infrastructure account.

In most cases, your classic infrastructure username is your <account_id>_<email_address>. For more information, see the [docs](https://cloud.ibm.com/docs/account?topic=account-classic_keys).

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.?)/.

--classic-infrastructure-password (string)
: Your classic infrastructure API key.

For information about viewing and accessing your classic infrastructure API key, see the [docs](https://cloud.ibm.com/docs/account?topic=account-classic_keys).

The maximum length is 128 characters. The minimum length is 2 characters. The value must match regular expression /(.?)/.

--max-ttl (string)
The following steps provide generic guidelines to ensure proper security:



* The default host root UID passwords are stored and encrypted in the IBM Cloud. You can have them with the SSH key that you must provide by provisioning the bare metal server. It is recommended to change all host root IDs passwords after you finish the provisioning activities and configurations.
* Review password policies, such as complexity and expiration period, across all components.
* Review encryption settings across all components.
* Plan and implement appropriate physical or virtual firewall solutions, such as VPC subnet ACLs and Security Groups, and also NSX-T East-West and North-South firewalls.
* Plan and implement appropriate application load balancing and security solutions.
* Plan and implement appropriate security information and event management (SIEM) solutions.
* Plan and implement appropriate vulnerability scanning.







 Active Directory 

Complete the following steps to ensure proper Single Sign On (SSO) configuration and management:



* If you deployed your Active Directories in VPC or into the VMware vSphere® cluster, configure the Active Directory™ (AD) server update and restart schedule.
* If you choose the option to deploy AD servers into the VMware vSphere cluster, provide Microsoft® Windows® licensing and activation for the servers to ensure compliance and availability.
* Establish mutual trust between the instance and your on-premises AD server.
* Integrate NSX-T, if applicable, with your AD SSO.
* Integrate VMware ESXi hosts with your AD SSO.







 Maintenance planning 

Complete the following steps to ensure proper planning for software maintenance:



* [Set up VMware Update Manager (VUM)](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-intro) through a Public Gateway to obtain VMware updates.
* If applicable, set up vSAN through a proxy to maintain the vSAN Hardware Compatibility List (HCL) database.
* Plan regular maintenance for VMware components that are not supported by VUM. For example, VMware vCenter, PSC, and NSX.
The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--secret-version-action-prototype ([SecretVersionActionPrototype](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-secret-version-action-prototype-example-schema))
: The request body to specify the properties of the action to create a secret version. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --secret-version-action-prototype=@path/to/file.json.





 Example 

ibmcloud secrets-manager secret-version-action-create --secret-id=0b5571f7-21e6-42b7-91c5-3f5ac9793a46 --id=eb4cf24d-9cae-424b-945e-159788a5f535 --secret-version-action-prototype='{"action_type": "private_cert_action_revoke_certificate"}'





 Example output 

The request body of the action to revoke private certificate versions.

{
"action_type" : "private_cert_action_revoke_certificate",
"revocation_time_seconds" : 1667982994
}









 Secret locks 

Secure your secret data by attaching a lock to a secret version and preventing any modification or deletion.



 ibmcloud secrets-manager secrets-locks 

List the secrets and their locks in your Secrets Manager instance. Note: If the --all-pages option is not set, the command will only retrieve a single page of the collection.
Each region has its own root-of-trust key that is stored in [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial), which is backed up by HSM. Each service instance (tenant) has its own data encryption and token signature keys, which are encrypted by using the region's root-of-key trust. 
 What is the key strength that you use? The service uses 16 bytes. 
 Do you invoke any remote APIs that expose encryption capabilities No, we do not. 







 What clock synchronization does App ID use? 

App ID runs in IBM Cloud, which uses an internal NTP server: servertime.service.softlayer.com.

Synchronizing your application with App ID's time source depends on which environment that you're using to run your application.



* If your application is running in IBM Cloud Classic Infrastructure, set your NTP servers to servertime.service.softlayer.com.
* If your application is running in IBM Cloud VPC Infrastructure, set your NTP servers to time.adn.networklayer.com.
* If your application is not running in IBM Cloud, you do not have access to these time servers. In this case, set your NTP servers to time-a.nist.gov or time-b.nist.gov.







 What is the difference between App ID and Keycloak? 

Both App ID and Keycloak can be used to add authentication to applications and secure services. The main difference between the two offerings is how they're packaged.

Keycloak is packaged as software, which means that you, as the developer, are responsible for maintaining functionality of the product after you download it. You're responsible for hosting, high-availability, compliance, backups, DDoS protection, load balancing, web firewalls, databases, and more.

App ID is a fully managed offering that is provided "as-a-service". This means that IBM takes care of the operation of the service, handles compliancy, availability in multiple zones, SLA, and more.
fast_io_fail_tmo 5
}
blacklist {
wwid "SAdaptec"
devnode "^hd[a-z]"
devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st)[0-9]"
devnode "^cciss."
}
devices {
device {
vendor "NETAPP"
product "LUN"
path_grouping_policy group_by_prio
features "3 queue_if_no_path pg_init_retries 50"
prio "alua"
path_checker tur
failback immediate
path_selector "round-robin 0"
hardware_handler "1 alua"
rr_weight uniform
rr_min_io 128
}
}
Show more
* Update your CHAP settings /etc/iscsi/iscsid.conf by adding the username, and password.

iscsid.startup = /etc/rc.d/init.d/iscsid force-start
node.startup = automatic
node.leading_login = No
node.session.auth.authmethod = CHAP
node.session.auth.username = <user name value from the console>
node.session.auth.password = <password value from the console>
discovery.sendtargets.auth.authmethod = CHAP
discovery.sendtargets.auth.username = <user name value from the console>
discovery.sendtargets.auth.password = <password value from the console>

Use uppercase for CHAP names. Leave the other CHAP settings commented. IBM Cloud® storage uses only one-way authentication. Do not enable Mutual CHAP.



3. Restart iscsi and multipathd services.

/etc/init.d/iscsi restart

/etc/init.d/multipathd restart
4.
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.

The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|previous)$/.

--metadata ([CollectionMetadata](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-collection-metadata-example-schema-v1))
: The metadata that describes the resource array. Required.

--resources ([UpdateSecretVersionMetadata]](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli-v1cli-update-secret-version-metadata-example-schema-v1))
: A collection of resources. Required.





 Examples 

ibmcloud secrets-manager secret-version-metadata-update --secret-type=arbitrary --id=exampleString --version-id=exampleString --metadata='{"collection_type": "application/vnd.ibm.secrets-manager.secret+json", "collection_total": 1}' --resources='[{"version_custom_metadata": {"anyKey": "anyValue"}}]'







 ibmcloud secrets-manager secret-metadata 

Get the details of a secret by specifying its ID.
"payload_available" : true
} ]
}







 ibmcloud secrets-manager secret-version-locks-bulk-delete 

Delete all the locks or a subset of the locks that are associated with the specified version of a secret.

To delete only a subset of the locks, add a query param with a comma to separate the list of lock names:

Example: ?name=lock-example-1,lock-example-2.

Note: A secret is considered unlocked and able to be deleted only after all of its locks are removed. To determine whether a secret contains locks, check the locks_total field that is returned as part of the metadata of your secret.

ibmcloud secrets-manager secret-version-locks-bulk-delete --secret-id SECRET-ID --id ID [--name NAME]



 Command options 

--secret-id (string)
: The ID of the secret. Required.

The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--id (string)
: The ID of the secret version. Required.

The maximum length is 36 characters. The minimum length is 7 characters. The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|current|previous)$/.

--name ([]string)
: Specify the names of the secret locks to be deleted.

The list items must match regular expression /^[a-zA-Z]{1}[a-zA-Z0-9-_.]{1,63}$/. The maximum length is 1000 items. The minimum length is 1 item.
: The password that is associated with the username.

NTLM domain name
: The NTLM domain name of the user that is authenticating with the site.

NTLM host name
: The hostname of the NTLM server.
* For a website that requires form-based authentication, choose how you want to access the site from the following options:



* Direct access: Submits the form without getting the login page.

Form action URL
: The URL to send the form data to when the form is submitted. For example, /action_page.php.

Required fields
: Find out the field values that must be provided in the form.
* Indirect access: Fetches the login page and fills in the form fields. Make a note of the following information so you can provide it later:

Form login URL
: URL of the website's login page.

Form name
: Name of the login form.

Required fields
: Find out the field values that must be provided in the login form.









 Connecting to a web crawl data source 

If you want to crawl a group of URLs that includes some websites that require authentication and some that don't, consider creating a different collection for each authentication type.

From your Discovery project, complete the following steps:



1. From the navigation pane, choose Manage collections.
2. Click New collection.
3. Click Web crawl, and then click Next.
4. Name the collection.
5. If the language of the website is not English, select the appropriate language.

For a list of supported languages, see [Language support](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-language-support).
6. Optional: Change the synchronization schedule.

The Web crawl data source is designed to be used with websites that change only once or twice a week. To ensure that your collection captures all website updates, schedule the crawl to occur weekly.