vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Specify a rule for including users to a segment in the Include user attributes in segment. For further details about adding users to a segment, refer [here](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-segmentsadding-users-to-segment).



4. Click Create.







 Adding user in a segment 

Attributes specify the context of a request that you want to be evaluated as part of a decision. For more information, see [here](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-overviewac-attribute). You can add user attributes in a segment by defining rules. You can define more than one rule.

To define a rule, at the time of creating or editing a segment, in Include user attributes in segment, add the following details:



1. Add an Attribute name. For example, the attribute may be email or part of user name.
2. Select an operator to be used for the evaluation from the list.



* starts with
* ends with
* is
* contains
* greater than
* greater than and equals
* less than
* less than and equals



3. Enter values for the operator selected.
4. Click Save rule.
dn: uid=Lsfclusteruser,ou=People,dc=ibmlsf,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: Lsfclusteruser
sn: Linux
userPassword: {SSHA}+A6gC87JU5ugW6qthWL2HGYzsQIdN1EN
loginShell: /bin/bash
uidNumber: 1003
gidNumber: 1003
homeDirectory: /home/Lsfclusteruser
dn: cn=Lsfclusteruser,ou=Group,dc=ibmlsf,dc=com
objectClass: posixGroup
cn: Lsfclusteruser
gidNumber: 1001
memberUid: Lsfclusteruser
Show more

Replace the {SSHA} value with the password hash that you generated earlier.
13. Apply the changes by running the following command:

ldapadd -x -D cn=Manager,dc=ibmlsf,dc=com -W -f ldapuser.ldif
14. To verify whether users have been created as mentioned in the previous steps, use the following command:

ldapsearch -x -LLL -b "ou=People,dc=ibmlsf,dc=com" "(objectClass=posixAccount)" uid cn



The OpenLDAP server is now configured and ready to use. You can add more users and groups by creating more LDIF files and by using the ldapadd command to import them into the directory.





 Step 2: Create a user group in OLDAP directory 

Now that the OpenLDAP server is configured, you need to create a user group in the OLDAP directory, which consists of users who are supposed to get access to the LSF cluster.



1. To create a group, use the ldapadd command to add an LDIF entry for the group to the LDAP directory.
Complete the following steps to add information to your product's About page:



1. Click Actions... > Edit product page.
2. Add or edit the following information:



* Click Description. Using common language, provide a unique description that includes the benefits and what your product can do for potential users. This description helps users understand why and how they can use your product.
* Click Features. Showcase your product’s attributes that deliver value and differentiate it in the market. You want the information to be visually scannable by providing a descriptive title and one or two sentences for each feature.
* Click Media. Add links to high-quality images or videos that show off your product. For example, provide an introductory walkthrough video or an illustration that shows user benefits or differences between certain features. The supported options are images, videos in MP4 or WebM file format, and videos hosted on YouTube or Vimeo.



3. Click Update.
For users, search action:iam-identity.user-authcode OR action:iam-identity.user-identitycookie.login.



* action:iam-identity.user-authcode indicates a login that is initiated by the user.
* action:iam-identity.user-identitycookie.login indicates an authentication that is based on a browser cookie.



2. For compute resources, search action:iam-identity.computeresource-token.login.



5. Select an event to view the fields that have identifying information:



* The Initiator.authnId and Initiator.authnName attributes contain the details for the authenticated user that applies a profile.
* The Initiator.id and Initiatior.name attributes contain the details of the profile that is applied.







 Examples 

A compute resource that's applying trusted profile compute-profile-1 has the following identifying attributes:



Table 1. Sample trusted profile attributes and values in Activity Tracker

 Attribute Value 

 action iam-identity.computeresource-token.login 
 initiator.name compute-profile-1 
 initiator.id IBMid08348934 
 initiator.typeURI service/security/account/profile 
 initiator.credential.type profile 
 initiator.authnId crn-crn:v1:bluemix:public:containers-kubernetes:satloc_wdc_c8gfp9ow)1il4mg:a/a319e5b2c84429a9a2ece7a7c9a8807:c8jrclfw0 
 initiator.authnName sat-kp-c8gfp9ow0gavb01il4mg:ibm-kp:default:key-management-crypto-7797c45798-mlbck
* UI
* API







 Managing profiles 

With IBM Cloud® App ID, you can compile information about the individual users of your application into a profile. The information in the profile can be learned about your users by the way that they interact with your app or added by you on their behalf. By storing the information, you can access it to help create personalized experiences of your app for your users.

Looking for information about your Cloud Directory users? Check out [managing users](https://cloud.ibm.com/docs/appid?topic=appid-cd-users).



 Viewing user profiles with the UI 

To see the data that is available for your app users, you can use the App ID UI.



1. Navigate to the User Profiles > Profiles tab of your App ID instance.
2. Look through the table or search by using an email address to find the user that you want to see the information for. The search term must be exact.
3. In the overflow menu of the user's row, click View user profile. A page opens that contains the user's information. Check out the following table to see what information you can see.



Table 1. User details as shown in the App ID dashboard

 Detail Description 

 IdP identifier The IdP identifier is issued by the provider that your user chose to sign in to your application with. 
 Email The primary email address that is attached to the user. 
 Name Your user's first and surname as issued by the identity provider. 
 Identity provider The provider that your user chose to sign in with. 
 ID The ID that is assigned to the user by App ID. 
 Custom attributes Custom attributes are additional information that is added to their profile or that is learned about the user's as they interact with your application. 
 Summary All the information that is associated with that user shown as a JSON object. 









 Viewing user profiles with the API 

You can use the App ID API to view details about your app users.



1. Obtain your tenant ID from your instance of the service. You can find the ID in your service or application credentials.
2.
Add conditions based on your IdP data to define how and when federated users can apply the profile.



* By clicking Add a condition, you can define multiple conditions. Federated users must meet all the conditions to be included in the trusted profile. For more information about the fields that are used to create conditions, see [IAM condition properties](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties).
* Click View identity provider (IdP) data to search attribute names and values in your own personal data from your IdP. For more information, see [Using IdP data to build trusted profiles](https://cloud.ibm.com/docs/account?topic=account-idp-integrationtrusted-profiles-idp-data).



4. Define the session duration for how long a user can apply the profile before they must reauthenticate.



6. Click Continue.
7. (Optional) [Assign access to the trusted profile](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profiletp-access).
8. Or, click Create without assigning any access.



For more information about the fields that are used to create conditions for trusted profiles, see [IAM condition properties](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties).





 Establishing trust with compute resources in the console 

Complete the following steps to set up better control over granting access to compute resources.

IBM Cloud Kubernetes Service supports only trusted profiles for versions 1.21 and newer. Free IBM Cloud Kubernetes Service clusters create only earlier versions. You have the choice to create clusters with an earlier version with the standard plan, so be sure to select version 1.21 or newer.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Trusted profiles.
2. Click Create profile.
3. Describe your profile by providing a name and a description, and click Continue.
4. You can create the trusted profile before adding details by selecting Decide later.
* Select reader to grant permissions to view data only.



[Learn more about the roles that you need](https://cloud.ibm.com/docs/monitoring?topic=monitoring-iam).
8. Click Assign.









 Step 4. Add a user or service ID to the access group 

You can add users or service IDs to an existing access group.



 Add a user to the access group 

Complete the following steps to add a user:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Add users on the Users tab.
4. Select the users that you want to add from the list, and click Add to group.







 Add a service ID to the access group 

Complete the following steps to add a service ID:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click the Service IDs tab, and click Add service ID.
4. Select the IDs that you want to add from the list, and click Add to group.
This username can't be changed by using the Ops Manager API or UI, and the password can only be changed via the UI. However, you can update these values by using the Ops Manager 'user' API.

The Ops Manager 'user' API requires several other values to be set when creating a user. These fields are set to opsmanager by default:



* firstName
* lastName
* emailAddress



With your own username and API key that is generated in the prior steps, follow this example command to update these fields:

curl -H "Content-Type:application/json" -XPATCH -k --digest --user 'opsmanager-123:d043b2ae-bbf2-4f55-8b09-e1ce0906126f' 'https://opsmanager-d66861a0-9ec2-4d14-9f66-15d4ad4547ac.9b48689db8eb415ca00444450bd4e589.databases.appdomain.cloud:30649/api/public/v1.0/users/5f07020545a4e8013688627a' -d '{"firstName": "your first name", "lastName": "your last name, "emailAddress": "your e-mail"}'





 After a restore 

After a restore completes, you will see the source formation replica set in the Ops Manager interface.
"id": "123454231-1234-1234-3334-12345687012",
"name": "developer",
"description": "Can perform administrative tasks.",
"access":
{
"application_id": "de33d272-f8a7-4406-8fe8-ab28fd457be5",
"scopes":
"write",
"read"
]
}
]
}
]
}







 Assigning roles to users with the UI 

After you create roles, you can assign them to your user's profile. You can also assign roles when you create a future user.



1. Go to Profiles and roles > User profiles in your App ID dashboard.
2. From the Actions menu in the row of the specific user you're assigning a role to, click Assign role.
3. Select the role or roles that you want to add from the list of available roles.
4. Optional: If you don't see the role that you're looking for, click Create role and provide the information to add another option.
5. Click Save.







 Assigning roles to users with the API 

After you create roles, you can assign them to your user's profile. You can also assign roles when you create a future user.



1. Get your user ID by searching your App ID users with an identifying query, such as an email address.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/Users?query=<identifyingSearchQuery>" -H "accept: application/json" -H "authorization: Bearer <token>"

Example:

curl -X GET https://us-south.appid.cloud.ibm.com/management/v4/e19a2778-3262-4986-8875-8khjafsdkhjsdafkjh/cloud_directory/Users?query=example@domain.com
You can create and apply [user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about&interface=uistorage-about-user-tags) and [access management tags](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-about&interface=uistorage-about-mgt-tags) to volumes to better control and organize your Block Storage for VPC resources across the VPC.



 User tags for Block Storage for VPC volumes 

User tags are uniquely identified by a Cloud Resource Name (CRN) identifier. When you create a user tag, you provide a unique name within your billing account. You can define user tags in label or key-value format.

You can [add user tags](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storage&interface=uiadd-user-tags-volumes-ui) when you create a Block Storage for VPC volume or when you update an existing volume. You can also add tags to a boot or data volume during [instance creation](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=uicreate-from-vsi). For boot volumes, you edit the boot volume to add tags. For data volumes, you can add tags when you create and attach them to the instance, or add them to existing data volumes. Volume user tags are also used by [backup policies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about) to create automatic backup snapshots of the volume. Create, view, and manage user tags from the UI, CLI, API, or Terraform, and remove then at any time.





 Access management tags for Block Storage for VPC volumes
* [Skills](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-skill-addskill-add-limits)
* [Versions](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-versionsversions-limits)







 User information 

A unique user is recognized by the user ID that is associated with the person that interacts with your assistant. It is your responsibility to pass the user ID information to the service. Watson Assistant checks for the following information from API requests in this order:

1. user_id: A property defined in the API that is sent in the context object of a /message API call. Using this property is the best way to ensure that you accurately attribute /message API calls to unique users. For more information about the user ID property, see the API reference documentation:

- context.global.system.user_id: [v2 API](https://cloud.ibm.com/apidocs/assistant-data-v2message)
- context.metadata.user_id: [v1 API](https://cloud.ibm.com/apidocs/assistant-data-v1message)

1. session_id (v2 only): A property defined in the v2 API that identifies a single conversation between a user and the assistant. A session ID is provided in /message API calls that are generated by the built-in integrations. The session ends when a user closes integration or after the inactivity time limit is reached.

If you use the stateless v2 /message API, you must specify the session_id with each message in an ongoing conversation (in context.global.session_id).
{: note}

1. conversation_id (v1 only): A property defined in the v1 API that is stored in the context object of a /message API call. This property can be used to identify multiple /message API calls that are associated with a single conversational exchange with one user. However, the same ID is only used if you explicitly retain the ID and pass it back with each request that is made as part of the same conversation.
Navigate to the SAML 2.0 tab of the App ID dashboard.
2. Add the Provider name. The default name is SAML.
3. Enter the following metadata that you obtained from the identity provider in the Provide Metadata from SAML IdP section.



Table 2. The information that must be provided to App ID

 Variable Description 

 Sign-in URL The URL that the user is redirected to for authentication. It is hosted by your SAML identity provider. 
 Entity ID The globally unique name for a SAML identity provider. 
 Primary certificate The certificate issued by your SAML identity provider. It is used for signing and validating SAML assertions. All providers are different, but you might be able to download the signing certificate from your identity provider. The certificate must be in .pem format. 



4. Optional: Provide a Secondary certificate that is used if signature validation fails on the primary certificate. If the signing key remains the same, App ID does not block authentication for expired certificates.
5. Click Save.



Want to set an authentication context? You can do so through the API.





 Configuring IdP-initiated login with the UI 

Optionally, if you want to log in to your applications on IBM Cloud from your identity provider's UI, you can enable IdP-initiated login.

Follow steps 1 - 4 in the [Providing metadata with the UI](https://cloud.ibm.com/docs/appid?topic=appid-enterprisesaml-provide-appid-gui) section. Then, complete the following process.



5. Enable the IdP initiated login.
6. Enter the IdP redirect URL.
7. Click Save.







 Providing metadata with the API 



1.
Any user that signs in by using an email that is registered to a future user must verify their email address before they are granted access to your app. To complete the verification requirements, you can send an email to have the user verify or manually verify their address on their behalf. To allow for self-verification, set Email verification to On in the Cloud Directory tab of the service dashboard. This sends an email to the user to request verification on their initial sign-in. To verify users manually, you must be an administrator. Make a request to the Cloud Directory [management APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Cloud%20Directory%20Users/mgmt.createCloudDirectoryUser) to set the status field in the payload to CONFIRMED.



If a future user is added by you and signs in to your app without verifying their email, their custom attributes are deleted and the profile is created from scratch.





 Is there anything special that I need to do when I use a custom identity provider? 

When you add user information to your application in advance, you can use any unique identifier that is provided by the authentication flow. The identifier must exactly match the sub of the signed JSON Web Token that is sent during the authorization request. If the identifier does not match, then the profile that you want to add is not linked successfully.







 Adding a future user 

Now that you've learned about the process and considered your security implications, try adding a user.

A user's predefined attributes are empty until their first authentication. Although they're empty, the user is still fully authenticated. You can use their profile ID just as you would someone who has already signed in. For instance, you can modify, search, or delete the profile.



 Before you begin 

Before you get started, you must have the following information:



* Which identity provider that the user will sign in with.
If a question mark icon does not pop up in the IBMid field, the user does not exist yet. Follow the steps in the [How to Create a New User](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-sspcreate-new-user-am-tool) document to create the new user. The process of creating a new user will also grant the user access to the customer you are managing.



 Value Description 

 IBMid The user's IBMid (email address) 
 First Name The user's First Name 
 Last Name The user's Last Name 



![SSP-AM-Grant-User-Customer-3](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Grant-User-Customer-3.png)
5. Select the question mark (?) icon. A message will pop up asking if you want to grant the user access to the customer you are managing. Select “Yes”.

![SSP-AM-Grant-User-Customer-4](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Grant-User-Customer-4.png)
6. Return to the List View without saving.

![SSP-AM-Grant-User-Customer-5](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Grant-User-Customer-5.png)
7. The user should now be viewable in your List View and have access to the customer you are managing.
A human annotator can revise, delete, and add annotations to these documents, or you can bypass human annotation and use these files to create training, test, and blind document sets for evaluating and improving the model performance. For more information about how to create these files and requirements for uploading them, see [Uploading pre-annotated documents](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-preannotationwks_uima).





 Anonymizing data 

If you want to build a model that is optimized for your data, but do not want to upload the data as-is to Knowledge Studio for privacy reasons, you can strip the documents of any personally identifiable information (PII) first, and then use those anonymized documents to train the model. Do not redact the information or replace it wholesale with variables. For best results, replace the real information with fake information of the same type.

For example, if the PII that you want to protect is client names, then instead of redacting each name or replacing each name with a variable, such as USER_NAME, replace each name with a fake name that uses a variety of typical name syntax styles, such as Jane Doe, Mr. Smith, Dietrich, or Dr. Jones, PhD. Consider writing a script that concatenates a variety of first and last names, and titles and last names, and adds last names alone to create fake names that can be inserted into the document to replace instances of real user names. The goal is to simulate as closely as possible real values in the source documents. If the same text (USER_NAME) is used in the documents or text is redacted, you will basically be training the model to expect all names to have that same value or be redacted. When the model is used at runtime on new documents, and encounters never-seen-before names in all their variability, you want it to be able to recognize them as names.







 Adding documents to a workspace 

To train a model, you must add documents that are representative of your domain content to your workspace.



 About this task 

As a best practice, start with a relatively small collection of documents.