vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you add PII or other sensitive information in the name or the description of a service instance, you might be disclosing sensitive data to others in the same account.

When you define your auditing instances names, do not add sensitive information in the name or in the description.





 Service plan 

The service plan that you choose determines the number of days that data is available for search. For more information, see [Service plans](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_plan).

Choose your plan based on the number of days that you need to be able to search data online through the web UI.

The HIPAA plan has a maximum of 25 users. If you need to grant permissions to more than 25 users, [open a support ticket](https://cloud.ibm.com/docs/get-support).





 Tags 

A tag is a label that you assign to a resource for easy filtering of resources in your resource list.



* You can use tags to organize your resources and easily find them later.
* You can also use tags to help you with identifying specific team usage or cost allocation when you view your [exported usage report](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-viewingusageexport-csv).



Use tags to organize your resources and track usage costs.

Tags are case-sensitive, and the maximum length of a tag is 128 characters.



* The characters that are permitted to name tags are A-Z, 0-9, spaces, underscore, hyphen, period, and colon.
* Colons turn the tag into a string where you can isolate two logical parts, like a key:value pair. You can't use a colon in a tag without creating this pairing.
* A comma separates tags and can't be used within the tag name itself.



If you add PII information in the name, you might be disclosing sensitive data to others in the same account.

When you define your tags, do not add sensitive information in the tag name.

Tags are visible to all members of an account.
However, if you have access to only a single user ID, you can still simulate most parts of the process.

For more information about user roles, see [User roles in Knowledge Studio](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-roles).







 Results 

After completing this tutorial, you will have a custom machine learning model that you can use with other Watson services.





 Lesson 1: Adding documents for annotation 

In this lesson, you will learn how to add documents to a workspace in Knowledge Studio that can be annotated by human annotators.



 About this task 

For more information about adding documents, see [Adding documents to a workspace](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-documents-for-annotationwks_projadd).





 Procedure 



1. Download the [documents-new.csv](https://watson-developer-cloud.github.io/doc-tutorial-downloads/knowledge-studio/documents-new.csv) file to your computer. This file contains example documents suitable for uploading.
2. Within your workspace, click Assets > Documents.
3. On the Documents page, click Upload Document Sets.
4. Upload the documents-new.csv file from your computer. The uploaded file is displayed in the table.









 Lesson 2: Pre-annotating with a dictionary-based annotator 

In this lesson, you will learn how to use a dictionary-based annotator to pre-annotate documents in Knowledge Studio.



 About this task 

Pre-annotating documents is an optional step. However, it is a worthwhile step because it makes the job of human annotators easier later.

For more information about pre-annotation with dictionaries, see [Pre-annotating documents with a dictionary](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-preannotationwks_preannot).





 Procedure 



1.
User's that are stored in Cloud Directory can take advantage of the functionality such as signing up or resetting their password directly in the Login Widget. Check out the following table to see which screens you can display for each type of identity provider.



Table 1. The Login Widget screens that each identity provider can display

 Login Widget screen Social identity provider Enterprise identity provider Cloud Directory 

 Sign in ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Sign up ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Forgot password ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Change password ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 Account details ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 







 Customizing an SSO login flow 

After a successful authentication, App ID creates a session cookie with encrypted access and identity tokens that your apps can use for authentication. Another way to customize the flow is to send an access token to your browser so that any browser app can use the token in its Ajax request.







 Customizing the Login Widget 

The Login Widget is dynamic. You can customize the look and feel or identity provider configuration, and the changes are applied immediately.
{region}.databases.cloud.ibm.com/v5/ibm/deployments/{id}/users/admin -H Authorization: Bearer <> -H Content-Type: application/json 
-d {"password":"newrootpasswordsupersecure21"}







 Managing Users and Roles through the UI 



1. Go to the service dashboard for your service.
2. Click Service Credentials to open the Service Credentials section.
3. Click New Credential.
4. Choose a descriptive name for your new credential.
5. (Optional) Specify whether the new credentials use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings that use the specified endpoint. Use of the endpoint is not enforced. It just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated MongoDB user is auto-generated.



The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.

Creating a user from the CLI or API doesn't automatically populate that user's connection strings into Service Credentials. If you want to add them there, you can create a new credential with the existing user information. Enter the username and password in the JSON field under Add Inline Configuration Parameters. For example, {"existing_credentials":{"username":"Robert","password":"supersecure"}}. Basically, you send in the username and password, and Service Credentials generates the connection strings with the credentials filled in.

Generating credentials from an existing user does not check for or create that user.
Step 1 - Creating an IAM access management tag in the UI 

In the console, complete the following steps.



1. Go to Manage > Account, and then select Tags.
2. Click the Access management tags tab. Add a tag name in the field. Access management tags require a key:value format.
3. Click Create Tags.







 Step 1 - Creating an IAM access management tag with the API 

With the [Global Search and Tagging API](https://cloud.ibm.com/docs/account?topic=account-tag&interface=apicreate-access-api), make a POST/ tags call to [create an access management tag](https://cloud.ibm.com/apidocs/taggingcreate-tag). Specify the tag in the tag_names property. For an example, see [Creating access management tags by using the API](https://cloud.ibm.com/docs/account?topic=account-tag&interface=apicreate-access-api).





 Step 2 - Adding an access management tag to a volume 

Add an access management tag to an existing volume or when you [create a volume](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage). To add access management tags to an existing volume, complete the following steps.



1. Go to the list of Block Storage for VPC volumes. In [IBM Cloud console)](https://cloud.ibm.com/login), go to menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. Locate the volume from the list.
3. In the tags column, click Add tags.
4. In the Add tags menu, enter the access management tags in the access management tag field. Tags that you created display as you type.
5. Click Save.







 Step 3 - Assigning access and users
From the list of registered apps, select the application that you added in the previous step. The row expands to show your credentials.







 With the API 



1. Make a POST request to the [/management/v4/<tenantID>/applications endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Applications/mgmt.registerApplication).

curl -X POST https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/applications/ -H 'Content-Type: application/json' -H 'Authorization: Bearer <IAMToken>' -d '{"name": "<applicationName>"}'

Example response:

{
"clientId": "c90830bf-11b0-4b44-bffe-9773f8703bad",
"tenantId": "b42f7429-fc24-48fa-b4f9-616bcc31cfd5",
"secret": "YWQyNjdkZjMtMGRhZC00ZWRkLThiOTQtN2E3ODEyZjhkOWQz",
"name": "testing",
"oAuthServerUrl": "https://us-south.appid.cloud.ibm.com/oauth/v4/b42f7429-fc24-48fa-b4f9-616bcb31cfd5",
"profilesUrl": "https://us-south.appid.cloud.ibm.com",
"discoveryEndpoint": "https://us-south.appid.cloud.ibm.com/oauth/v4/b42f7429-fc24-48fa-b4f9-616bcb31cfd5/.well-known/openid-configuration"
}









 Obtaining an access token
Users that are created directly from the CLI do not appear in Service Credentials, but you can add them.

If you manage your service through the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command:

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

When the task finishes, retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.

MongoDB centralizes user data in the admin database. List all users and their roles and database permissions [in the mongo shell](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-mongo-shell) by using the show users command.

ibmcloud cdb deployment-connections --start -u admin mongodb-production
Database Password>>
MongoDB shell version v4.0.3
connecting to: mongodb://....
....
replset:PRIMARY> use admin
switched to db admin
replset:PRIMARY> show users





 Managing Users and Roles through the API 

Users that are created in the API are given the roles [readWriteAnyDatabase](https://docs.mongodb.com/manual/reference/built-in-roles/readWrite) and [dbAdminAnyDatabase](https://docs.mongodb.com/manual/reference/built-in-roles/dbAdmin).

If you need users to have a different role, use the admin user to change their role.

Users that are created directly from the API do not appear in Service Credentials, but you can add them.

The Foundation Endpoint that is shown on the Overview section of your service provides the base URL to access this deployment through the API.
Or, you can give users access by adding trusted profiles to your access groups. For more information, see [What makes a good trusted profiles strategy?](https://cloud.ibm.com/docs/account?topic=account-account_setuptrustedprofiles_strategy) and [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile).





 Setting up your access groups by using the CLI 

To assign access, run the [ibmcloud iam user-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policy_create) command.



 Administrator access by using the CLI 

Run the following command to assign administrator access:

ibmcloud iam user-policy-create USER_NAME --roles Administrator --service-name globalcatalog-collection





 Editor access by using the CLI 

Run the following command to assign editor access:

ibmcloud iam user-policy-create USER_NAME --roles Editor --service-name globalcatalog-collection





 Viewer access by using the CLI 

Run the following command to set viewer access:

ibmcloud iam user-policy-create USER_NAME --roles Viewer --service-name globalcatalog-collection







 Add users to your access groups by using the CLI 

To add users to an access group by using the CLI, run the [ibmcloud iam access-group-user-add](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_user_add) command.

ibmcloud iam access-group-user-add GROUP_NAME USER_NAME [USER_NAME2...]

For example the following command adds user name@example.com to the example_group access group.

ibmcloud iam access-group-user-add example_group name@example.com

Or, you can give users access by adding trusted profiles to your access groups.
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">JohnDoe@gmail.com</saml:NameID>
</saml:Subject>
<saml:Conditions NotBefore="2018-01-29T12:59:58Z" NotOnOrAfter="2018-01-29T13:05:58Z">
</saml:Conditions>
</samlp:Response>





 What types of algorithms are supported by App ID? 

App ID uses the [RSA-SHA256](http://www.w3.org/2001/04/xmldsig-morersa-sha256) algorithm to process XML digital signatures.







 Configuring SAML identity providers to work with App ID 

You can configure SAML identity providers to work with App ID by providing metadata from App ID to your identity provider, and metadata from your identity provider to App ID.



 Providing metadata to your identity provider 

To configure your app, you need to provide information to a SAML compatible identity provider. The information is exchanged through a metadata XML file that also contains configuration data that is used to establish trust.

You cannot enable SAML until after you configure it as an identity provider.



1. In the Manage tab of the App ID dashboard, click Edit in the SAML row to configure your settings.
2. Click Download SAML Metadata file. Your identity provider expects the following information from the file.



Table 1. The information that is found in your metadata file

 Variable Description 

 EntityID The identifier that lets the identity provider know that App ID issued the SAML request. 
 Location URL The location that the identity provider sends the SAML assertions after successfully authenticating a user. 
 Binding The instructions on how the identity provider must send the SAML response. 
 NameID Format How the identity provider knows that which identifier format it needs to send in the subject of an assertion and how App ID identifies users.
* UI
* Terraform







 Creating dynamic rules for access groups 

You can create dynamic rules to automatically add federated users to access groups based on specific identity attributes. When your users log in with a federated ID, the data from the identity provider (IdP) dynamically maps your users to an access group based on the rules that you set.

Users already have specific identity information within your company's domain, and when they log in with a federated ID, this data can be passed through by using SAML assertions. The SAML assertions or attribute statements that are configured within the IdP provide the data that is used to create each rule. For example, you might have a true or false attribute statement that defines users as a manager. This information can be used to add all users who are managers to a specific access group for managers that you created in your IBM Cloud® account. For more information, see the tutorial about how to [Control access to cloud resources](https://developer.ibm.com/tutorials/use-iam-access-groups-to-effectively-manage-access-to-your-cloud-resources/) and an [Example rule](https://cloud.ibm.com/docs/account?topic=account-rulesexample).

Only users who are already invited to the account can be mapped to access groups by using dynamic rules.



 Setting up rules by using the console 

Dynamic rules are created by setting conditions that must be matched by the data that is configured within the IdP and passed in with a user's federated ID during login. You can add more than one condition for a rule. All conditions set in the rule must be met for a user to be added to an access group.

To create a rule, follow these steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the access group that you want to create a rule for. This action opens the group Details page.
3. Select Dynamic rules.
4. Click Add rule.
5. Enter the information from your IdP that is dynamically provided for you on the Add rule page.
* [Service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids): Similar to how a user ID identifies a user, a service ID can identify a specific service or application, even a task. The service ID could be considered a "technical user". You can assign privileges to a service ID. Moreover, a service ID has its own IAM API keys to authenticate. Thus, a service ID can be used instead of a regular user ID, thereby simplifying resource management and increasing security. [To avoid deleting a service ID by mistake, you can lock them](https://cloud.ibm.com/docs/account?topic=account-serviceids&interface=uilock_serviceid).
* [Access groups with access policies](https://cloud.ibm.com/docs/account?topic=account-groups): To simplify management of privileges (authorization), you can group user IDs and service IDs into access groups. You create an access group for a purpose, e.g., to administrate the application or a component. Then, you create access policies for that group to assign privileges and add the related user IDs and service IDs.
* [Trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile): Using a trusted profile, you can automatically grant access to your account in a defined context and with a set of defined privileges. You can define such a context for either federated users based on properties in the enterprise directory, e.g., for users labeled as administrators or project members. Or you can allow access for [compute identities](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profilecreate-profile-compute-ui), i.e., specific computing resources like a virtual server instance (VSI).
Copy the skill ID and paste it somewhere that you can access it from later.



2. Click the User ![User](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/user-icon2.png) icon in the page header.
3. Make a note of the current instance name, and then click Manage Users.

You are directed to the IBM Cloud® Identity and Access Management (IAM) page.
4. Click Invite users, and then enter the email addresses of the people to whom you want to grant access.

If you plan to grant specific resource-level access to different team members, then add one person at a time.
5. Expand Assign users additional access, and then click IAM services.
6. In the Which service do you want to assign access to? field, choose Watson Assistant.
7. Optionally select a specific region and service instance to share with this user.

Otherwise, the user access you define is applied to all of your services instances in all data center locations where you have instances.

Remember, you made a note of the name of the current service instance in an earlier step.
8. Optionally, indicate that you want to give this user access to a specific skill or assistant only by selecting an option from the Resource Type field. And then paste the associated ID (that you copied in an earlier step) into the Assistant or Skill ID field.
9. Assign the person to the following role types for the service instance:



* Platform
* Service



For help, see [Popular role assignments](https://cloud.ibm.com/docs/assistant?topic=assistant-access-controlaccess-control-recommendations). For a description of all your options, see [Understanding roles](https://cloud.ibm.com/docs/assistant?topic=assistant-access-controlaccess-control-iam-roles).
10.
Complete the following steps to add a credential to a service that is managed by IAM:



1. From the Resource list page, select the name of the service to open the service details page. Then, select the Credentials tab, and click New Credential.
2. From the Add New Credential dialog, provide a Name.
3. Specify the role. This value sets the IAM service access role. For more information, see [IAM Access](https://cloud.ibm.com/docs/account?topic=account-userroles).
4. Optionally, you can provide a Service ID by either allowing IAM to generate a unique value for you, or by providing an existing Service ID. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids).
5. Optionally, you can provide more parameters as a valid JSON object that contains service-specific configuration parameters, provided either inline or in a file.

Most services don't require extra parameters, and for services that do, each service defines its own unique list of parameters. For a list of supported configuration parameters, see the documentation for the particular service offering.
6. Click Add to generate the new service credential.





 Creating a service credential without an IAM service role 

Services managed by IAM that generate new credentials can assign an IAM Service access role. This role grants access to the entire service instance. For services with fine-grained resource access, you might want to grant access only to a subresource, such as a Cloud Object Storage bucket. In this case, you can choose to continue without selecting a role so that the new credential is created without an IAM Service role. This way, you can manage the fine-grained access by creating an IAM policy that you scope to a specific resource, like a bucket. To create the credential without an IAM service role, complete the following steps:



1. From the Resource list page, select the name of the service to open the service details page.
* Attach files and resources to provide more details about the issue you're experiencing.
* If you'd like a user in you account to be updated about the case, add them by using the Contact watchlist. For more information about assigning users access to your account, see [Adding users to your case management access group](https://cloud.ibm.com/docs/get-support?topic=get-support-accessadd-user-access-group).
* Select Email me updates about this case to receive support case notifications.



7. Click Next, review your case summary, and click Submit case. After you receive email verification for the case, follow the instructions for further communication on the issue.



After your support case is created, you can follow its progress on the [Manage cases page](https://cloud.ibm.com/unifiedsupport/cases).





 Creating a support case by using the API 

You can programmatically open a support case by calling the Case Management API as shown in the following sample requests. For more information about the API, see [Case Management](https://cloud.ibm.com/apidocs/case-managementcasemanagement-createcase).



* Curl
* Java
* Python
* Go
* Node



curl --location --request POST 'support-center.cloud.ibm.com/case-management/v1/cases' --header 'Content-Type: application/json' --header 'Content-Type: text/plain' --data-raw '{ "type": "technical",
"subject": "Case subject",
"description": "Case description",
"severity":4,
"offering": {
"name": "Cloud Object Storage",
"type": {
"group": "crn_service_name",
"key": "cloud-object-storage",
"kind": "service",
"id": "dff97f5c-bc5e-4455-b470-411c3edbe49c"
}
},