vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you want to assign a different user as the account owner, enter their IBMid in the Owner field. The account owner has full access to manage the account.
5. Select Marketing as the parent of this account.
6. Click Create.



After you create the account, the account owner can log in to the account to invite other users and manage their access.

Repeat the steps to create more accounts. As an example, the Example Corp enterprise has the following child account and parent account group hierarchy.



Table 1. Child account and parent account group hierarchy

 Child Parent 

 Print Marketing 
 Frontend Engineering 
 Backend Engineering 
 Direct Sales 
 Online Sales 
 Enablement Sales 







 Step 5: Explore subscriptions 

You can explore subscriptions in the enterprise from the enterprise dashboard. Any existing subscriptions from accounts that are imported into the enterprise are moved to the enterprise account and added to the enterprise [credit pool](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-enterprisecredit-pool).



1. Go back to the Enterprise dashboard by clicking Dashboard. In the Billing section, you can view available credit, remaining credit, and subscription expiration dates.
2. To view details about all subscriptions in the enterprise, click View subscriptions.

In the Platform subscription section, you can view the subscription start date, end date, starting credit and available credit. To add more credit, you can purchase additional subscriptions and apply the subscription code.







 Step 6: Invite users to manage your enterprise 

In a large organization like Example Corp., there are likely other people who you want to give access to manage the enterprise so they can do their jobs. In this case, you want to give department leads of the Marketing, Development, and Sales account groups access to manage their accounts and resource usage, and you want the Example Corp. financial officer to have access to view the entire enterprise's billing and usage. To give other users access, you invite them to the enterprise account and assign them the appropriate access.

First, invite the department leads and assign them access.



1. Go to the Enterprise dashboard by clicking Manage > Enterprise in the IBM Cloud console.
10. From the Peer administrator identity drop-down list, select the organization admin identity that you imported into the wallet.
11. Review the details on the Summary panel and click Add peer.







 Deploy ordering service 



1. From the Nodes tab, click Add ordering service > Create ordering service.
2. Provide a name for your ordering service and select the number of ordering nodes that you want to deploy.
3. Under Advanced deployment options, check Use your own CA certificate and private key and click Next.
4. In the Certificate field, click Add certificate and browse to the peer enrollment certificate .pem file. This is certificate 1 in the Node certificates table.
5. In the Private key field, click Add certificate and browse to the peer enrollment private key .pem file. This is certificate 2 in the Node certificates table.
6. In the MSP drop-down list, select the MSP that you imported into the console.
7. Select a Fabric version for your peer and click Next.
8. Provide the TLS certificate and key for the node. In the Certificate field, click Add certificate and browse to the peer TLS certificate .pem file. This is certificate 3 in the Node certificates table.
9. In the Private key field, click Add certificate and browse to the peer TLS private key .pem file. This is certificate 4 in the Node certificates table. Click Next.
10. From the Orderer administrator identity drop-down list, select the organization admin identity that you imported into the wallet.
11. Review the details on the Summary panel and click Add ordering service.



Instead of creating an ordering service, if you prefer to contribute a single ordering node to an existing Raft ordering service, open the ordering service and click the Ordering nodes tab. Click Add ordering node, give it a name then and following the preceding steps.

It takes several minutes for peer and ordering node deployment to complete. When it is successful, you can see a green box on the node tile in the console. You might need to refresh your browser for the box to turn from gray to green.







 Next steps
You can also check if a transfer is queued for processing by calling the onQueue method on the AsperaTransaction. onQueue will return a Boolean with true indicating that the transfer is queued.

Future<AsperaTransaction> asperaTransactionFuture = asperaTransferMgr.downloadDirectory(bucketName, directoryPrefix, outputDirectory, includeSubDirectories);
AsperaTransaction asperaTransaction = asperaTransactionFuture.get();

while (!asperaTransaction.isDone()) {
System.out.println("Directory download is in queueing: " + asperaTransaction.onQueue());

//pause for 3 seconds
Thread.sleep(1000 * 3);
}

To check if a transfer is in progress call the progress method in AsperaTransaction.

Future<AsperaTransaction> asperaTransactionFuture = asperaTransferMgr.downloadDirectory(bucketName, directoryPrefix, outputDirectory, includeSubDirectories);
AsperaTransaction asperaTransaction = asperaTransactionFuture.get();

while (!asperaTransaction.isDone()) {
System.out.println("Directory download is in progress: " + asperaTransaction.progress());

//pause for 3 seconds
Thread.sleep(1000 * 3);
}

Every transfer by default will have a TransferProgress attached to it. The TransferProgress will report the number of bytes transferred and the percentage transferred of the total bytes to transfer. To access a transfer’s TransferProgress use the getProgress method in AsperaTransaction.
* [Creating an access group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag).
* [Assigning access to a group](https://cloud.ibm.com/docs/account?topic=account-groupsaccess_ag).







 Managing access by assigning policies directly to users 

To manage access or assign new access for users by using IAM policies, you must be the account owner, administrator on all services in the account, or an administrator for the particular service or service instance.

Choose any of the following actions to manage IAM policies in the IBM Cloud:



* To grant permissions to a user, see [Assigning access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesassign_new_access).
* To revoke permissions, see [Removing access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesremoving_access).
* To review a user's permissions, see [Reviewing your assigned access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesreview_your_access).







 Managing access through trusted profiles 

[Trusted profiles](https://cloud.ibm.com/docs/account?topic=account-identity-overviewtrustedprofiles-bestpract) are supported.





 IBM Cloud platform roles 

The following tables detail actions that are mapped to platform roles.

Platform roles enable users to perform tasks on service resources at the platform level, for example, assign user access for the service, create or delete instances, and bind instances to applications.

Review the following tables that outline what types of tasks each role allows for when you're configuring Activity Tracker Event Routing in your account.

Use the following table to identify the Account managementActivity Tracker Event Routing platform role that you can grant a user in the IBM Cloud to run any of the following platform actions:



Table 1. IAM platform roles for Activity Tracker Event Routing
Descriptions of the actions in the service that are permitted for the listed platform management role.
If you want to specify your own MSP ID in this field, make sure to review the instructions in the tool tip.
3. Under Root Certificate Authority details, specify the CA you used to register the identities in the previous step, Ordering Service CA.
4. The Enroll ID and Enroll secret fields below this will auto populate with the enroll ID of your CA admin: admin. However, using this identity would give your organization the same admin identity as your CA, which for security reasons is not recommended. Instead, select the enroll ID you created for your organization admin from the drop-down list, OSadmin, and enter its associated secret, OSadminpw. Then, give this identity a display name, Ordering Service MSP Admin. Note: the default display name for this identity is the name of your MSP and the word "Admin". If you select a different name for your MSP, that will be reflected in the default.
5. Click the Generate button to enroll this identity as the admin of your organization and export the identity to the Wallet.
6. Click Export to export the admin certificates to your file system. As we said above, this identity is not stored in your console or managed by IBM. It is only stored in local browser storage. If you change browsers, you will need to import this identity into your Wallet to be able to administer the peer.
Exporting your organization admin identity is important because you are responsible for managing and securing these certificates. If you export the ordering service and the ordering service MSP definition, they can be imported into another console where another operator can create new channels on the ordering service or join peers to the channel.
7. Click Create MSP definition.
8. After the MSP has been created, click on the tile representing it. Then download the MSP to your local filesystem. You will need to send this MSP to all of the organizations in the channels you join.





 Task: Create the ordering service organization MSP definition 



Table 11. Create the ordering service organization MSP definition

 Display name MSP ID Enroll ID Secret 

 Create Organization Ordering Service MSP osmsp 
 Root CA Ordering Service CA
Organizing IBM Cloud accounts and resources 

After you complete your [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup), consider the best practices for organizing your accounts and resources. The choices you make have a significant impact as you set up [access management](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-access-management) in later steps, as well as how well your organization can scale over time.

Each deployment of one of the reference architectures is single tenant, meaning the deployment is intended to be used by a single consumer. We recommend creating a new account for each deployment. If you have multiple consumers, then you need multiple accounts. Multiple individual accounts might quickly become unwieldy, so we recommend that you use an [enterprise account](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organizationenterprises).

Within an account, all resources managed by [IBM Cloud Identity and Access Management (IAM)](https://cloud.ibm.com/docs/account?topic=account-access-getstarted) are placed into resource groups for access control and billing purposes.

For more information, see:



* [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup)
* [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs)





 Organization for a single deployment within an account 



 VPC reference architecture 

For the VPC reference architecture, it is recommended that you use two resource groups for each deployment:



* Management - Holds all of the resources that are needed by your management VPC
* Workload - Holds all of the resources that are needed by your workload VPC



This creates a clean separation between the layers. The following diagram shows such a layout.

Zoom

!
Then select External Certificate Authority configuration and click Next.
5. Click Add file to upload the JSON file that contains all of the certificates.
6. Select the Organization MSP definition that you imported.
7. Because you are using a paid cluster, on the next panel, you have the opportunity to configure resource allocation for the nodes. The selections that you make here are applied to all five ordering nodes. If you want to learn more about how to allocate resources to your node, see this topic on [Allocating resources](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-allocate-resources).
8. Review the summary and click Add ordering service.
9. After you have created the ordering service, you can upload the orderer admin identity to the IBM Blockchain console. On the Wallet tab, click Add identity:



* In the Name field, enter an identity name that is used for your reference only.
* In the Certificate field, upload a file that contains the admin identity's signing certificate (in base64 or PEM format).
* In the Private Key field, upload a file that contains the admin identity's private key (in base64 or PEM format).

After you upload the certificate and private key of the identity to the console, you can use the console associate the identity with your ordering node.









 What's next 

You have gathered all of your peer or ordering service certificates from your third-party CA, created their corresponding organization MSP definition and created a peer or ordering service. If you are following along in the tutorials, you can return to the next step.



* If you created the peer node, the next step is to [Create the node that orders transactions](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-build-networkibp-console-build-network-create-orderer).
If you are the orderer admin, you will need to collect the MSP definitions of all the organizations who have been invited to the consortium and import the MSPs into the console. You can then add the MSPs to the ordering service, by using the orderer node.

After an administrator creates an MSP definition, they can use the Organizations tab to download the MSP in JSON format to their local file system. They can then send you the MSP JSON file in an out of band operation. Navigate to the Organizations tab and use Import MSP Definition to import the MSP file into your console. Once an MSP definition is visible in the Available organizations section, you can then navigate to your orderer node to [add the organization to the consortium](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-add-consortium).





 Adding an organization to a consortium 

The consortium of organizations is hosted by the ordering service.

If you are the administrator of the ordering service, you can use the console to add an organization to the consortium. Navigate to the Nodes tab and click the ordering service. On the ordering service panel, under Consortium members, click Add organization. A side panel opens where you can select from the list of available MSP definitions that you [imported into your organizations tab](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-import-msp). You can also use the Upload JSON option to import the MSP definition file created by another org directly.





 Creating and editing a channel 

After an organization is added to the consortium, the organization can use the ordering service to create a new channel or can be added to an existing channel. The information that allows you to participate in a channel, such as joining your peers to the channel, instantiating smart contracts, and submitting transactions, is provided by using the MSP definitions.

After your organization is added to a consortium, you can create a channel by using the following steps:



1. Import the ordering service that hosts the consortium into your console.
Note: the default display name for this identity is the name of your MSP and the word "Admin". If you select a different name for your MSP, that will be reflected in the default.
5. Click the Generate button to enroll this identity as the admin of your organization and export the identity to the Wallet, where it will be used when creating the peer and creating channels.
6. Click Export to export the admin certificates to your file system. As we said above, this identity is not stored in your console or managed by IBM. It is only stored in local browser storage. If you change browsers, you will need to import this identity into your Wallet to be able to administer the peer. Click Next.
Exporting your organization admin identity is important because you are responsible for managing and securing these certificates. If you switch browsers, you will need to import this admin identity otherwise you will not be able to operate Org2.
7. On the Review MSP information panel, make sure you have entered the correct information. When you are satisfied, click Create MSP definition.
8. After the MSP has been created, click on the tile representing it. Then download the MSP to your local filesystem. You will need to send this MSP to all of the organizations in the channels you join.



Task: Create the peer organization MSP definition



Table 5. Create the peer organization MSP definition

 Display name MSP ID Enroll ID Secret 

 Create Organization Org2 MSP org2msp 
 Root CA Org2 CA 
 Org Admin Cert org2admin org2adminpw 
 Identity Org2 MSP Admin 



After you have created the MSP, you should be able to see the peer organization admin in your Wallet, which can be accessed by clicking on the Wallet in the left navigation.

Task: Check your Wallet



Table 6. Check your Wallet

 Field Display name Description 

 Identity Org2 MSP Admin Org2 identity
For more information about the access management, see Managing user access [for the standard plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) or [for the Unified Key Orchestrator plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access).
* Configure all crypto units in the service instance the same.



Key objects in the in-memory keystore are not automatically rotated after the master key rotation. If PKCS #11 keystores are enabled in your service instance, you need to restart all active PKCS #11 applications to clear the in-memory keystore after the master key rotation is complete. For more information, see

[PKCS #11 implementation components](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-pkcs11-introuko-pkcs11-components).



 Before you begin 

Before you start, make sure that you have done the following:



1. The new master key parts are prepared for rotation. For information on how to create a new master key part, see [Generate the signature keys and master key parts](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilitiesstep1-generate-keys-management-utilities).
2. Open the Trusted Key Entry application on your workstation and click the Crypto units tab. Check and make sure that true is displayed as the value of the SELECTED column for all crypto units in the service instance where you want to rotate the master key. If any crypto units in the service instance are not selected, select the crypto units by clicking the Add crypto units button and following the prompts.

You can work with only one service instance at a time. If any crypto units in other service instances are selected, click the Remove crypto units button to unselect.







 Rotating master keys using smart cards and the Management Utilities 

To rotate the master key, follow these steps:
[Slot and token management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) C_GetTokenInfo Yes Obtains information about a particular token. 
 [Slot and token management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) C_WaitForSlotEvent No Waits for a slot event (token insertion, removal, and so on) to occur. 
 [Slot and token management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) C_GetMechanismList Yes Obtains a list of mechanisms that are supported by a token. 
 [Slot and token management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) C_GetMechanismInfo Yes Obtains information about a particular mechanism. 
 [Slot and token management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) C_InitToken Yes Initializes a token. 
 [Slot and token management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) C_InitPIN Yes Initializes the normal user’s PIN.
[tab icon](https://cloud.ibm.com/media/docs/images/homepage/account.svg) Manage your account
* ![tab icon](https://cloud.ibm.com/media/docs/images/homepage/ibm-cloud--security-compliance-center.svg) Security and compliance
* ![tab icon](https://cloud.ibm.com/media/docs/images/homepage/development.svg) Get developing
* ![tab icon](https://cloud.ibm.com/media/docs/images/homepage/continuous-deployment.svg) DevOps
* ![tab icon](https://cloud.ibm.com/media/docs/images/homepage/deploy.svg) Start deploying
* ![tab icon](https://cloud.ibm.com/media/docs/images/homepage/help-desk.svg) Get support



 Take a tour 

Familiarize yourself with the IBM Cloud console and the latest features so you can get productive in no time.

Learn how to navigate through the IBM Cloud console. IBM Tech Now has the latest and greatest news and announcements!

 Manage your account 

Get started by setting up your IBM Cloud account.

[Setting email preferences for notifications ](https://cloud.ibm.com/docs/account?topic=account-email-prefs)

IBM Cloud users can choose to receive email notifications about IBM Cloud platform-related items.

[Setting up access groups ](https://cloud.ibm.com/docs/account?topic=account-groups)

Access groups are assigned policies that grant roles and permissions to the members of that group.

[Inviting users to your account ](https://cloud.ibm.com/docs/account?topic=account-iamuserinv)

Use IAM to invite users, cancel invitations, or resend a pending invitation.

[Managing resource groups ](https://cloud.ibm.com/docs/account?topic=account-rgs)