vania-janet/multiturn-rag-retrieval-data huggingface dataset:
const rsaKey = new RSA(process.env.PUBLIC_IBM_RSA_KEY);

/
* Returns a signed JWT. Optionally, adds an encrypted user payload in stringified JSON.
/
function mockLogin() {
const payload = {
sub: 'L12345', // Required
iss: 'www.example.com' // Required
};
const token = jwt.sign(payload, process.env.YOUR_PRIVATE_RSA_KEY, { algorithm: 'RS256', expiresIn: '10000ms' });
return token;
}
Show more

After you set the value of the sub claim to be the user's userID, you cannot change the claim to another user. The userID that you specify with this method is used for billing purposes and can be used to delete customer data upon request.

The userID is stored in the context object as context.global.system.user_id.

The user ID that is specified in the sub claim is also sent in the customer_id section of the X-Watson-Metadata HTTP header. The customer_id can be used to make requests to delete user data. Because the ID is sent in a header field, the syntax must meet the requirements for header fields as defined in [RFC 7230](https://tools.ietf.org/html/rfc7230section-3.2) (all visible ASCII characters). For more information about deleting user data, see [Labeling and deleting data](https://cloud.ibm.com/docs/assistant?topic=assistant-information-securityinformation-security-gdpr-wa).



If you disable security, then you can use the instance.updateUserID() method to specify user IDs. For more information, see [Adding user identity information](https://cloud.ibm.com/docs/assistant?topic=assistant-web-chat-configweb-chat-config-userid).







 Logging out
Required access for managing service ID API keys 

All users can create service IDs in an account, and they are the administrator for those IDs and can create the associated API key and access policies. However, account owners and users assigned the Administrator role on the IAM Identity service can manage the API keys for all service IDs in an account. Users can also be given access to a single service ID only, if the ID is specified when the administrator assigns the access.

If you are a user with the required access, you can view, update, and delete API keys for any service ID in the account. Go to the API keys page, and select the All service ID API keys option in the View menu to find an API key that you want to view details for, update, or delete.





 Creating an API key for a service ID 

Create an API key to associate with a service ID in the console:



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Service IDs.
2. If you don't have a service ID created, create the service ID.
3. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Manage service ID.
4. Click API keys.
5. Click Create.
6. Add a name and description to easily identify the API key.
7. Click Create.
8. Save your API key by copying or downloading it to secure location.



For security reasons, the API key is only available to be copied or downloaded at the time of creation. If the API key is lost, you must create a new API key.





 Creating an API key for a service ID by using the CLI
Granting Customized User Group to Access a Customized Image Group 

This method can define a group users to access a group of images. It can be useful when you have a special image or images, and only want them to be used by a restricted group of users (e.g. a class).



1. Manually create an user group or create user group by institution federated system.

If you want to manually create an user group:



* Create an user group by clicking on Manage Groups, then click Add new User Group.



![group1](https://cloud.ibm.com/docs-content/v1/content/b6c5dbb443b797203b2824b05472cac5ae8635da/cloud-for-education/images/userGroup.png)



* Choose the user group name and its privilege, then click Add Group.
* Click Edit to add any user to that group by users’ school ID.



If you want to create user group by institution federated system, contact your IT department, and add the user group in its system, the user group will be automatically created when the first user login.
2. Add Image Group by clicking Add New Resource Group.



![image1](https://cloud.ibm.com/docs-content/v1/content/b6c5dbb443b797203b2824b05472cac5ae8635da/cloud-for-education/images/imageGroup.png)



1. Choose Image as Type, and input the name you like.



![image2](https://cloud.ibm.com/docs-content/v1/content/b6c5dbb443b797203b2824b05472cac5ae8635da/cloud-for-education/images/imageType.png)



1.
About App ID 

Application security can be incredibly complicated. For most developers, it's one of the hardest parts of creating an app. How can you be sure that you are protecting your user's information? By integrating IBM Cloud® App ID into your apps, you can secure resources and add authentication - even when you don't have much security experience.

What can App ID do for you? Check out the following video to learn more.



* Video transcript

The following section provides the transcript for the introduction to App ID video for users who might need an alternative format or a translated version.

Wouldn't it be awesome if the barista at your local coffee shop remembered your name and your usual brew. If you're building an application, you might want to build that kind of tailored experience for your users to make them feel special or save them time. Of course, no matter how great your idea is, the success of your app depends on your ability to build trust with your users - which comes down to securing your users data and protecting the systems that your app accesses. Knowing who is using your app is a key part of this. It starts with adding sign in functionality. But, as a lot of developers know, adding authentication and authorization to your app is both risky and complex. That's why we built App ID on IBM Cloud. App ID helps developers to easily add authentication to their mobile and web apps and hosts user data in the cloud that developers can use to build custom app experiences.

To make the sign-in experience easy for your users, with App ID, you can let users sign in directly from your app and then sign in with their email and password. Or, you can let users sign in through their Facebook or Google accounts with credentials they already know. Once your users authenticate, you can authorize access to backend resources that your app uses.

App ID also helps you deliver tailored experiences for your users based on a variety of factors. In App ID you can store information about your users and let developers use this information for their apps. App ID is available for iOS, Android, and the web. And of course, it's built with open standards like OAuth 2.0 and OIDC.
For example, you might assign the Viewer role for all available instances of one service and assign the Editor role for only one instance of a second service. This way you can customize access to multiple services, but use a single API key for authentication to all.

All users have access to create a service ID in an account to which they are a member. However, to allow a user in an account access to view or manage a service ID that they did not personally create, they are required to have access with a role on the IAM identity service account management service. For more information, see [IAM identity service](https://cloud.ibm.com/docs/account?topic=account-account-servicesidentity-service-account-management).

You can assign any identity access to view or manage a service ID by using access management tags. For more information, see [Attaching tags to a service ID](https://cloud.ibm.com/docs/account?topic=account-attaching-and-detaching-tags-on-a-resource&interface=uiam-tags-serviceid-ui).

If the Restrict service ID creation IAM account setting is enabled, then everyone in the account, including account owners, is blocked from creating service IDs unless they are assigned explicit access. For more information, see [Restricting users from creating service IDs](https://cloud.ibm.com/docs/account?topic=account-restrict-service-id-create).



 Creating a service ID 

To create a service ID, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Service IDs.
2. Click Create.
3. Follow the process to create a name and description for your service ID.
4. Click Create.



Then, hover on the row of a service ID to click the Actions icon !
Use of the endpoint is not enforced. It just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username and password, and an associated database user in the MySQL database are auto-generated.



The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.





 Creating Users from the command line 

If you manage your service through the IBM Cloud CLI and the [cloud databases plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), you can create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command.

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

Once the task finishes, you can retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.





 Creating Users from the API 

The Foundation Endpoint that is shown on the Overview panel Deployment details of your service provides the base URL to access this deployment through the API. To create and manage users, use the base URL with the /users endpoint.

curl -X POST 'https://api.{region}.databases.cloud.ibm.com/v4/ibm/deployments/{id}/users' -H "Authorization: Bearer $APIKEY" -H "Content-Type: application/json" -d '{"username":"jane_smith", "password":"newsupersecurepassword"}'

Once the task has finished, you can retrieve the new user's connection strings, from the /users/{userid}/connections endpoint.





 Adding users to Service Credentials 

Creating a new user from the CLI doesn't automatically populate that user's connection strings into Service Credentials. If you want to add them there, you can create a new credential with the existing user information.
If you manage your service through the IBM Cloud CLI and the [cloud databases plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli), you can create a new user with cdb user-create. For example, to create a new user for an "example-deployment", use the following command.

ibmcloud cdb user-create example-deployment <newusername> <newpassword>

Once the task has finished, you can retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.

ibmcloud cdb deployment-connections example-deployment -u <newusername> [--endpoint-type <endpoint type>]

Full connection information is returned by the ibmcloud cdb deployment-connections command with the --all flag. To retrieve all the connection information for a deployment named "example-deployment", use the following command.

ibmcloud cdb deployment-connections example-deployment -u <newusername> --all [--endpoint-type <endpoint type>]

If you don't specify a user, the deployment-connections commands return information for the admin user by default. If you don't specify an endpoint type, the connection string returns the public endpoint by default. If your deployment has only a private endpoint, you must specify --endpoint-type private or the commands return an error. The user and endpoint type is not enforced. You can use any user on your deployment with either endpoint (if both exist on your deployment).





 Creating Users and Getting Connection Strings from the API 

The Foundation Endpoint that is shown on the Overview panel of your service provides the base URL to access this deployment through the API. To create and manage users, use the base URL with the /users endpoint.

curl -X POST 'https://api.
* The iam-identity.profile.create and iam-identity.profile.linkToResource actions for the [IAM identity service](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsiam-identity-service).







 Creating an IAM trusted profile for your cluster in the API 

As an account administrator, create a trusted profile in IBM Cloud Identity and Access Management. For more information, see the [IAM documentation](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=ui).

Before you begin: Verify that you meet the [prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-prereqs).

[Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster).



1. Create an [IAM trusted profile](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile) in IBM Cloud Identity and Access Management. Note the uuid (profile ID) in the output.



* Replace <access_token> with your IBM Cloud token. To get this token from the command line, log in and run ibmcloud iam oauth-tokens.
* Enter a <profile_name> and optional <description> for the IAM trusted profile.
* Replace <account_id> with the ID of your IBM Cloud account. To get this ID from the command line, run ibmcloud account show.

curl -L -X POST 'https://iam.cloud.ibm.com/v1/profiles' -H 'Accept: application/json' -H 'Authorization: Bearer <access_token>' -H 'Content-Type: application/json' --data-raw '{
"name": "<profile_name>",
"description": "<description>",
Defining password policies 

Password policies, such as strength requirements, help you to enforce more secure applications. By defining advanced policies, you can define the rules that a user must conform to when they set their password or attempt to sign in to your app. For example, you can set the number of times that a user can try to sign in before they are locked out of their account.



 Policy: password strength 

A strong password makes it difficult, or even improbable for someone to guess the password in either a manual or automated way. To set requirements for the strength of a user's password, you can use the following steps.

To set this configuration by using the GUI:



1. Go to the Cloud Directory > Password policies tab of the App ID dashboard.
2. In the Define password strength box, click Edit. A screen opens.
3. Enter a valid regex string in the Password strength box.

Examples:



* Must be at least 8 characters. (^.{8,}$)
* Must have one number, one lowercase letter, and one capital letter. (^(?:(?=.d)(?=.[a-z])(?=.[A-Z]).)$)
* Must have only English letters and numbers. (^[A-Za-z0-9]$)
* Must have at least one unique character. (^(w)w?(?!1)w+$)



4. Click Save.



Password strength can be set in the Cloud Directory settings page in the App ID dashboard, or by using [the management APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.set_cloud_directory_password_regex).



 Setting a custom error message 

If you set your own password regex policy and a user chooses a password that does not meet your requirements, the default message is The password doesn't meet the strength requirements.
IA-5 (4) - Automated Support for Password Strength Determination 



  Control requirements 

IA-5 (4) - 0
:   The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  Check whether App ID advanced password policies are enabled
*  IBMid employs automated tools to determine if password authenticators satisfy IBMid password requirements
*  Check whether IBMid password may contain only printable ASCII characters (in the range 33 - 126)
*  Check whether App ID password strength regex is configured
*  Check whether IBMid password policy policy contains spaces or any of the following characters: ;:("?)<>
*  Check whether VPN for VPC authentication is configured with a strong pre-shared key with at least # characters
*  Check whether IBMid password policy requires at least one uppercase letter
*  Check whether IBMid uses a password meter that coaches users to create strong passwords that exceed the minimum requirements







  NIST supplemental guidance 

This control enhancement focuses on the creation of strong passwords and the characteristics of such passwords (e.g., complexity) prior to use, the enforcement of which is carried out by organizational information systems in IA-5 (1).
Password strength can be set in the Cloud Directory settings page in the App ID dashboard, or by using [the management APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.set_cloud_directory_password_regex).



 Setting a custom error message 

If you set your own password regex policy and a user chooses a password that does not meet your requirements, the default message is The password doesn't meet the strength requirements. You can also choose to set your own message by using the [/management/v4/{tenantId}/config/cloud_directory/password_regex endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.set_cloud_directory_password_regex).







 Advanced password policies 

You can enhance the security of your application by enforcing password constraints.

You can create an advanced password policy that consists of any combination of the following five features:



* Lockout after repeated wrong credentials
* Avoid password reuse
* Password expiration
* Minimum period between password changes
* Ensure that the password does not include user name



When you enable this feature, extra billing for advanced security capabilities is activated. For more information, see [how does App ID calculate pricing](https://cloud.ibm.com/docs/appid?topic=appid-pricing).



 Policy: Avoid Password Reuse 

You might want to prevent your users from choosing a recently used password when they attempt to create a new one. If they try to set their password to one that was recently used, an error is shown in the default Login Widget GUI and the user is prompted to enter another option. This setting allows for you to choose the number of passwords that a user must have before they're able to repeat a previously used password.

To set this configuration by using the GUI:



1. Go to the Cloud Directory > Password policies tab of the App ID dashboard.
2. Toggle Advanced password policy to Enabled.
3.
Another part of the hardening is that the server is configured in such a way that the password expires after 90 days. After your password expires, you have 30 days to change it. If you don't change your password within the 30 days, your account becomes inactive and it is no longer possible to log in with SSH even if you are using SSH-keys. This restriction also includes system-accounts, for example, accounts created by using the command, useradd --system.



 Monitoring a virtual server 

It is best practice to:



* Monitor your virtual server instance resource usage, such as CPU, memory, and storage.
* Configure alerts that warn you if a resource is exhausted or almost exhausted.



Monitoring your server ensures that it has sufficient resources available to keep it running. For example, if you have no storage alerts configured and your boot disk (25 GB) is full, you can't restart your server. You can't recover your server because your boot disk can't be resized.





 File system characteristics 

The Hyper Protect Virtual Servers file system layout consists of one file system for the root and one file system for the /data mount points.

If the file system is full, your instance can break, which means you can no longer log on to your instance. The Hyper Protect Virtual Servers do not come with swap space configured, and it is not supported to add swap to the system.

Within /tmp is a tmpfs, which can use a large volume of RAM. Use /var/tmp for your applications when you need large volumes of temporary storage. Insufficient RAM can cause your system to behave unpredictably.



 Configuring logging for the Ubuntu server 

You must manually configure logrotate and journald to leave a small percentage of the file systems free. To do this, configure SystemKeepFree=15% in /etc/systemd/journald.conf.

Check regularly that a percentage of the file system is still free. For the logrotatation configuration, make sure that your log files do not get too large. Compress and remove log files (or move them to your data volume) before they break your system.
encrypted-password "$6$5gPuIk9u$JPzyjh5zVz0tf4P3.POWv4UWGDfowbzirGmnpiBUW0tDWLf1ZfvP.YwN88Mc8.cyOIvgDMrksbCYsmZxf4f3p."; SECRET-DATA
}
}
}
root-authentication {
encrypted-password "$6$q9tQzuqT$/TFQLkHK.woO.Qv9YcZ1nnJqZqhLBqXeg7L3xkUWXVmq8fn4N7mClTpckoCKhombXucxU6StRKOiHTDUeTdd91"; SECRET-DATA
}
services {
ssh {
root-login allow;
}
netconf {
ssh {
port 830;
}
}
web-management {
http {
interface fxp0.0;
}
https {
port 8443;
system-generated-certificate;
interface [ fxp0.0 ae0.0 ae1.0 ge-0/0/0.0 ge-0/0/1.0 ];
}
session {
session-limit 100;
}
}
}
host-name asloma-swap-18-1g-sa0-vsrx-vSRX;
name-server {
10.0.80.11;
10.0.80.12;
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
ntp {
server 10.0.77.54;
}
}
chassis {
aggregated-devices {
ethernet {
device-count 10;
}
}
}
security {
log {
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--locks ([]string)
: A comma-separated list of locks to delete.

The list items must match regular expression /^(\w(([\w-.]+)?\w)?|[])$/.





 Examples 

ibmcloud secrets-manager secret-unlock --secret-type=arbitrary --id=exampleString --locks=exampleString







 ibmcloud secrets-manager secret-version-locks 

List the locks that are associated with a specified secret version.

ibmcloud secrets-manager secret-version-locks --secret-type SECRET-TYPE --id ID --version-id VERSION-ID [--limit LIMIT] [--offset OFFSET] [--search SEARCH]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.