vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [IAM Identity service](https://cloud.ibm.com/docs/account?topic=account-account-servicesidentity-service-account-management).







 Establishing trust with federated users in the console 

Complete the following steps to define which federated users can access specific resources:



1. [Enable authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).
2. In the IBM Cloud console, click Manage > Access (IAM), and select Trusted profiles.
3. Click Create profile.
4. Describe your profile by providing a name and a description, then click Continue.

In the description, provide a list of actions available for this trusted profile.
5. You can create the trusted profile before adding details by selecting Decide later. Or, establish trust by completing the following steps:



1. Select Federated users as a trusted entity type from the list.
2. Select Users federated by IBMid or Users federated by IBM Cloud AppID as the authentication method and input the default identity provider (IdP) you enabled in step 1.

If the users that you are creating a trusted profile for use IBM Cloud App ID, create the trusted profile as an App ID user, and likewise for IBMid. This way, your own SAML attributes can give you an idea of how to structure the trusted profile conditions. Other users with the same IdP can have different SAML attributes. Use your own attributes only as a hint. To use attributes in a claim that are different than your own, input them manually.
3. Add conditions based on your IdP data to define how and when federated users can apply the profile.



* By clicking Add a condition, you can define multiple conditions. Federated users must meet all the conditions to be included in the trusted profile. For more information about the fields that are used to create conditions, see [IAM condition properties](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties).
* Replace <anonymous_user_api_key> with the respective API key of the anonymous user



iamcredentialtemplate: &defaultiamcredential
enabled: true
endpoint: "https://iam.cloud.ibm.com"
 The Universally Unique IDentifier (UUID) of your Hyper Protect Crypto Services instance.
instance: "<instance_id>"

tokens:
0:
grep11connection:
 The EP11 endpoint address starting from 'ep11'. For example: "ep11.us-south.hs-crypto.cloud.ibm.com"
address: "<EP11_endpoint_URL>"
port: "<EP11_endpoint_port_number>" The EP11 endpoint port number
tls:
enabled: true EP11 requires TLS connection.
mutual: false
storage:
remotestore:
enabled: true
users:
 The Security Officer (SO) user
0: The index of the Security Officer (SO) user MUST be 0.
 The name for the Security Officer (SO) user. For example: "Administrator":
name: "Administrator"
iamauth: defaultiamcredential
 The normal user
1: The index of the normal user MUST be 1.
 The name for the normal user. For example: "Normal user":
name: "Normal user"
 The 128-bit UUID of the private keystore which you created previously
tokenspaceID: "<private_keystore_id>"
iamauth: defaultiamcredential
 The anonymous user
2: The index of the anonymous user MUST be 2.
 The name for the anonymous user. For example: "Anonymous":
name: "Anonymous"
 The public keystore will not be used with this setup.
 Specify an arbitrary 128-bit UUID below, e.g.:
tokenspaceID: "12345678-1234-1234-1234-1234567890AB"
iamauth:
<<: defaultiamcredential
After you click Register, the new identity will be added to the list of Authenticated users that have been created by your CA. The identities are listed by their Enroll ID, along with their Type and Affiliation. Clicking on an identity in the table opens a side panel that displays the number of Maximum Enrollments and Attributes that were created during registration.

Deleting a user
If you need to delete a registered user, click the action menu next to any user and select Delete user. If that option is not available, it can be enabled on your CA by overriding the CA configuration. See an example of how to enable this feature in [Modifying a CA configuration after deployment](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-ca-modify-json). Note this action does not revoke the associated certificates for the user. If you need to do that you would need to insert the associated signed certificate into the organization MSP under the "revocation_list": section. And then update that MSP definition everywhere that it occurs on the network.



 Creating new CA admins 

By default, only the CA admin that is created during deployment has the ability to register new identities. You can create identities with the ability the register new users by using the Attributes panel of the registration process.

On the second side panel, click the Add Attribute button. Provide an attribute name of hf.Registrar.Roles. Enter an attribute value of . You can also use this panel to create an identity that can register only certain identity types, such as clients or peers, or within a certain affiliation. You can also create an identity that has the ability to revoke an identity and all the certificates that the identity has been issued. You can see a full list of the attributes in the [Registering a new identity](https://hyperledger-fabric-ca.readthedocs.io/en/release-1.4/users-guide.htmlregistering-a-new-identity) section of the Fabric CA users guide.







 Enrolling an identity
The endpoint that you choose to call can vary depending on your use case.

Not sure which one works best? Join our [Slack channel](https://www.ibm.com/cloud/blog/announcements/get-help-with-ibm-cloud-app-id-related-questions-on-slack) and get advice directly from our development team.

If you need to work with an API, check out the following image and corresponding information to see how the information is pulled.

Zoom

![App ID user profile endpoint options](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/user-profile-endpoints.png)

Figure 2. Endpoint options that can be used to access user information

/oauth/v4/<tenantID>/token
: After a successful authentication, you receive access and identity tokens that contain the most common user information - a name, picture, or email for example. If you want to add additional information, you can use [custom claims-mapping](https://cloud.ibm.com/docs/appid?topic=appid-customizing-tokens) to configure App ID to inject the information to the token before it is returned to you.

/oauth/v4/<tenantID>/userinfo
: If you need to see an in-depth view of the user profile information that is returned by an identity provider, you can call the [/userinfo endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Authorization_Server_V4/userInfo). It's recommended to use this endpoint only if the information cannot be mapped to the token as it requires extra network calls.

/api/v1/attributes
: If your application requires reading and updating custom profile attributes for a currently logged in user, then you can use the /attributes endpoint. For example, the user wants to update a food preference.
If you want to build a model that is optimized for your data, but do not want to upload the data as-is to Knowledge Studio for privacy reasons, you can strip the documents of any personally identifiable information (PII) first, and then use those anonymized documents to train the model. Do not redact the information or replace it wholesale with variables. For best results, replace the real information with fake information of the same type.

For example, if the PII that you want to protect is client names, then instead of redacting each name or replacing each name with a variable, such as USER_NAME, replace each name with a fake name that uses a variety of typical name syntax styles, such as Jane Doe, Mr. Smith, Dietrich, or Dr. Jones, PhD. Consider writing a script that concatenates a variety of first and last names, and titles and last names, and adds last names alone to create fake names that can be inserted into the document to replace instances of real user names. The goal is to simulate as closely as possible real values in the source documents. If the same text (USER_NAME) is used in the documents or text is redacted, you will basically be training the model to expect all names to have that same value or be redacted. When the model is used at runtime on new documents, and encounters never-seen-before names in all their variability, you want it to be able to recognize them as names.







 Adding documents to a workspace 

To train a model, you must add documents that are representative of your domain content to your workspace.



 About this training task 

As a best practice, start with a relatively small collection of documents. Use these documents to train human annotators (if your workspace involves human annotation) and to refine the annotation guidelines. Small documents can help human annotators identify coreference chains throughout the document. As annotation accuracy improves, you can add more documents to the corpus to provide greater depth to the training effort.





 Procedure 

To add documents to a workspace:



1. Log in as a Knowledge Studio administrator or project manager, and select your workspace.
2. Select the Assets> Documents > Documentation sets tab.
3.
The new user's IBMid. This will be the new user's username when they login to the Self-Service Portal. <br>If the user does not have an IBMid, they can create one [here](https://myibm.ibm.com)) 
 First Name The user's First Name 
 Last Name The user's Last Name 
 Primary Email The email for contacting the new user. This is where the new user will receive initial login instructions for the Self-Service Portal. 
 Role The role for the new user: <br>STD_USER = Standard User <br>MANAGER = Manager 
 Managing Customer ** This will be set to the customer you are assigned to manage if the user role is set to "MANAGER". 
 Customer Access List ** A row will be added to this list with the customer you are assigned to manage once the user is activated. 



![SSP-AM-Create-User-3](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Create-User-3.png)
5. Save the record.

![SSP-AM-Create-User-4](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Create-User-4.png)
6. The new user will be created once the backend processing is completed. You will know the new user was successfully created when the user status changes to "ACTIVE". The new user will receive an email with instructions on how to login to the Self-Service Portal once their user is activated.







 How to Approve / Reject an Access Request 

Managers in the Access Management application are responsible for approving/rejecting access requests submitted by users assigned to their customer/vendor.
You can create and apply [user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-about-user-tags) and [access management tags](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-about-mgt-tags) to file shares to better control and organize your file storage resources across the VPC. User tags can be added from the file service UI, CLI, or API. To apply access management tags to file shares, you must use the GhoST API.



 User tags for file shares 

You can create new user tags or add existing tags when you provision a new file share or update an existing file share. You can create, view, and manage tags from the UI, CLI, or API, and remove then at any time.

User tags are uniquely identified by a Cloud Resource Name (CRN) identifier. When you create a user tag, you provide a unique name within your billing account. You can define user tags in label or key-value format. Behind the scenes, the file service sends and receives tags directly to the GhoST service. GhoST stores its key attributes and the array of tags. GhoST also stores user resource information, so you can view, tag, and search for resources that you own.

For more information, see [Add user tags to file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=uifs-add-user-tags) and [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui).





 Access management tags for file shares 

Access management tags help organize access control by creating flexible resource groupings, enabling your file storage resources to grow without requiring updates to IAM policies.

You can create access management tags and then apply them to new or existing file shares and replica file shares. Use the IAM UI or the Global Search and Tagging API to create the access management tag. Then, from the VPC UI or API, add the tags to a file share.
You can create and apply [user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=uifs-about-user-tags) and [access management tags](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=uifs-about-mgt-tags) to file shares to better control and organize your file storage resources across the VPC. User tags can be added from the file service UI, CLI, or API. To apply access management tags to file shares, you must use the GhoST API.



 User tags for file shares 

You can create new user tags or add existing tags when you provision a new file share or update an existing file share. You can create, view, and manage tags from the UI, CLI, or API, and remove then at any time.

User tags are uniquely identified by a Cloud Resource Name (CRN) identifier. When you create a user tag, you provide a unique name within your billing account. You can define user tags in label or key-value format. Behind the scenes, the file service sends and receives tags directly to the GhoST service. GhoST stores its key attributes and the array of tags. GhoST also stores user resource information, so you can view, tag, and search for resources that you own.

For more information, see [Add user tags to file shares](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-managing&interface=uifs-add-user-tags) and [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui).





 Access management tags for file shares 

Access management tags help organize access control by creating flexible resource groupings, enabling your file storage resources to grow without requiring updates to IAM policies.

You can create access management tags and then apply them to new or existing file shares and replica file shares. Use the IAM UI or the Global Search and Tagging API to create the access management tag.
[Image showing the location of the User credentials tab](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_admin_access_user_perms_tab.png)
6. Click Add.
7. Enter the user's Email address.
8. Click Generate MQ username.

A unique administrator username will be auto-generated for the user. You can edit the text-box to change this to the preferred username. It must have a maximum of 12 characters and be lower case a-z or 0-9. It must also be unique within your IBM MQ service instance.
9. Click Add credentials.



The user that was added will now have permissions to access queue managers within your IBM MQ service instance. The user can view their Administrator username and obtain their Administrator API key by following the instructions for administering a queue manager (see Next step).





 Next steps 

Administer a queue manager, using one of the [queue manager administration options](https://cloud.ibm.com/docs/services/mqcloud?topic=mqcloud-mqoc_admin_qm)
If you want to use a trusted profile ID, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=ui).







 Using an IBM Cloud API key 

You can add a target account by using an API key. Alternatively, if you would like to add a trusted profile ID, see [Using a trusted profile](https://cloud.ibm.com/docs/account?topic=account-catalog-cross-validatione&interface=uitarget-trusted-profile).



1. In the IBM Cloud console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_hamburger.svg) > Manage > Catalogs > Private catalogs to access your private catalogs.
2. Select the private catalog that you want add a target account to.
3. Click Actions... > Edit catalog details > Add to add a target account.
4. Select IBM Cloud API key as the method.
5. Create a programmatic name of the target account.
6. Create a display name for the target account. The display name appears as a target account option for users that are onboarding products.
7. Enter the API key for the target account. If you need an API key, see [Create an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=uicreate_user_key).
8. Click the checkbox to indicate that you set you service authorization for Schematics and Catalog management.
9. Click Add > Update.



Users can now use the added target account to validate and add scans to any product version in the private catalog.





 Using a trusted profile 

If you want to use a trusted profile, you need to update your trusted profile to include the private catalog's CRN as a trust relationship.
In addition to the following message types, you can also take advantage of the [MFA](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa) templates.

For further customization, you can use parameters in your messages. Check out the following table to see the parameters that you can use in all the message types.



Table 1. The parameters that you can use in your messages to users

 Parameter Description 

 %{display.logo} Displays the image that you configured for your Login Widget. 
 %{user.displayName} Displays the screen name a user chose to use when interacting with the app. 
 %{user.email} Displays the user's registered email address. 
 %{user.username} Displays the user's specified username when the authentication method is set to username and password. 
 %{user.firstName} Displays the user's specified given name. 
 %{user.formattedName} Displays the user's full name. 
 %{user.lastName} Displays the user's specified surname. 





 Email: Welcome 

When a user signs up for your application, you might want to send them a message that welcomes them to your app.



1. Go to the Cloud Directory > Email templates > Welcome email tab of the service dashboard.
2. Set Welcome email to Enabled.
3. Customize the content of your message. You can add parameters and insert images by using the UI. To change the [language](https://cloud.ibm.com/docs/appid?topic=appid-cd-typescd-languages) of the message, you can use [the APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.updateLocalization) to set the language. However, you are responsible for the content and conversion of the message. Check out the following table to see the list of tables that you can use in this message and all the other messages that you can send.
* To update a service ID API key, the action is iam-identity.account-serviceid.update.



The following fields include extra information:



* The initiator.name field includes information about who has requested to update the API key.
* The target.name field includes information about the API key that is changed.
* The initiator.host.agent field indicates if the request comes from the UI or the CLI. When the field is set to Not Set, the request originates in the UI. When the field is set to IBM Cloud CLI, the request originates at the command line.





 Lock and unlock a service ID 

The following field includes extra information:



* In requestData, the lock field is set to true when the API key is locked, and to false when it is unlocked.







 Add or modify a description 

When a request to change a description generates an event, the following fields include information that can help you determine this action:



* In requestData, the lock field is set to false.
* In requestData, the prev_instance_name field and the instance_name field are set to the same value.







 Change the name of a service ID 

The following fields include extra information:



* In requestData, the lock field is set to false.
* In requestData, the instance_name field includes the new name of the API key.
* In requestData, the prev_instance_name field includes the name of the API key before it was changed.











 Analyzing events that fail 



 Initiator not authorized. Request to update an API key or service ID fails 

For example, when a user logs into your account using an API key, the user is authenticated to access your account. However, this API key may not have permissions to run actions to modify API keys or service IDs in the account. When this happens, you get one of the following messages:



* IAM Identity Service: update user-apikey APIKeyName -failure
* IAM Identity Service: update account-serviceid ServiceIDName -failure
attributes: accountIdResourceAttribute, serviceNameResourceAttribute],
},
];
const params = {
type: 'access',
subjects: policySubjects,
roles: policyRoles,
resources: policyResources,
};
iamPolicyManagementService.createPolicy(params)
.then(res => {
examplePolicyId = res.result.id;
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err)
});





 Granting users access to tag classic infrastructure resources 

The taggable resources for classic infrastructure are Virtual Guest, Virtual Dedicated Host, Network Application Delivery Controller, Gateway Member, Subnet, VLAN, and VLAN Firewall (Dedicated). Complete the following steps to assign the Manager service access role for a user to tag classic infrastructure services:



1. Click Manage > Access (IAM), and select Users.
2. Click the user's name from the table.
3. Click Classic infrastructure.
4. From the Permissions tab, expand the Devices category.
5. Select View Hardware Details and View Virtual Server Details. If you need to assign access to Cloud Object Storage S3, File Storage, or Evault Backup, assign the Storage manage permission. If you need to assign access to Content Delivery Network, assign the Manage CDN Account permission.
6. Click Save.
7. Click the Devices tab.
8. Select All bare metal servers or All virtual servers, depending on the resource that you want the user to be able to tag.







 Granting users access to tag service IDs 

Complete the following steps to assign the administrator role on the IAM Identity Service for a user:



1. Click Manage > Access (IAM), and select Users.
2. Click the user's name from the table.
3. Select the IAM Identity service and click Next.
4.