vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Adding users to an access group maps them to the provider organization that is associated with that access group, and determines their permissions in API Connect when they log in with that provider organization.



1. On the page for your access group, click the Users tab.
2. On the "Users" tab, click Add users.

The names of all of the users who belong to your company's IBM Cloud account display.
3. Select users to be added to the access group.

You can quickly add all of the users in the list by clicking the checkbox next to Users at the beginning of the table.
4. At the beginning of the table, click Add to group.









 Notifying users that the provider organization is available 

When you set up IAM access for your users, there is no automatic notification. After you finish configuring access for a provider organization, you should notify its members so they can start working with API Connect. For example, you could send an email or post a message where your users will see it. You should tell users the following information:



* The name of the Reserved instance (especially if you provisioned more than one)
* The name of the provider organization that the user is assigned to
* Where to find documentation: [https://cloud.ibm.com/docs/apiconnect](https://cloud.ibm.com/docs/apiconnect)



Each user must log out from IBM Cloud and then log in again for the permission changes to take effect. ![IBM Cloud log out](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/cloud_logout.png)





 Managing provider organizations 

Use IAM to add and remove users, and to manage their permissions.



 Assign ownership of a provider organization 

Instead of managing all provider organizations yourself, you can designate other users as owners and give them the appropriate access.
An identity provider creates and manages information about an entity such as a user, a functional ID, or an application. The provider verifies the identity of the entity by using credentials, such as a password. Then, the IdP sends the identity information back to App ID, which authorizes the user and then grants access to your app.



1. Navigate to your service dashboard.
2. In the Identity Providers section of the navigation, select the Manage page.
3. On the Identity Providers tab, set the providers that you want to use, to On.
4. Optional: Decide whether to turn off Anonymous users, or leave the default, which is On. When set to On, user attributes are associated with the user from the moment they begin interacting with your app. For more information about the path to becoming an identified user, see [Progressive authentication](https://cloud.ibm.com/docs/appid?topic=appid-anonymousprogressive).



App ID provides default credentials to help with your initial setup of Facebook and Google+. You are limited to 20 uses of the credentials per instance, per day. Because they are IBM credentials, they are meant to be used only for development. Before you publish your app, update the configuration to your own credentials.





 Adding redirect URIs 

Your application redirects users to App ID for authentication. After authentication completes, App ID redirects users back to your application. In order for App ID to be able to redirect users back to your app, you need to register the redirect URI. During the sign-in flow, App ID validates the URIs before it allows clients to participate in the authorization workflow, which helps to prevent phishing attacks and grant code leakage. By registering your URI, you're telling App ID that the URI is trusted and it's OK to redirect your users.



1. Click Authentication Settings to see your URI and token configuration options.
2. In the Add web redirect URI field, type the URI.
From the API, make a GET /iam-identity.profile.get call.

If you need to update your profile, make these calls:



* POST /iam-identity.profile.update
* POST /iam-identity.profile.linkToResource



For more information, see the [IAM API reference](https://cloud.ibm.com/apidocs/iam-identity-token-apicreate-link-permissions).





 Using trusted profiles for compute resource identities 

The general procedure and context for using trusted profiles are described in Table 1.

You can streamline the process by setting up dynamic rules in the first step to link the trusted profile automatically to new instances.

The IAM token is obtained by exchanging the instance identity access token that was acquired through the metadata service with an IAM token.



Table 1. Procedure for using a trusted profile

 Step Context Service Called User Action 

 1 IBM Cloud IAM [Create an IAM trusted profile](https://cloud.ibm.com/docs/account?topic=account-trustedprofile-compute-tutorial). 
 2 IBM Cloud IAM Assign access rights to the IAM trusted profile. 
 3 IBM Cloud VPC API or UI With the API, make a call to create a new instance, configured with the [metadata service](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-service) enabled. Specify any user data and the default trusted profile. Specify to link the trusted profile in the same call. <br>In the UI, [create an instance](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers) and select a trusted profile and link it to the instance. You can also [enable an existing instance to use the metadata service](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-serviceimd-metadata-service-enable).
[Create App ID instance](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-create-appid.png)

Figure 2. Create your APP ID instance
2. Read and agree to the terms and click Create.







 Step 2: Configure the ID provider 

We will use the Cloud Directory capability to add users to the ID provider. Refer to the [App ID documentation](https://cloud.ibm.com/docs/appid) for instructions how to integrate other ID providers into App ID.



1. Open the [IBM Cloud resource list](https://cloud.ibm.com/resources), expand the Services and software section, find your App ID instance and click its name to view its details.
2. Click Manage Authentication and deselect any login options that you don't need, such as Facebook and Google.
3. Go to Manage Authentication → Cloud Directory → Settings and choose whether user logins should use email or usernames.
4. Optionally go to Manage Authentication → Cloud Directory → Password Policies to define the password strength.
5. Optionally open Login Customization and customize the appearance of the login page.







 Step 3: Integrate the App ID instance as the ID provider for the administrator's account 



1. Go to [Manage → Access (IAM) → Identity Providers](https://cloud.ibm.com/iam/identity-providers). For Type, choose IBM Cloud App ID, then click Create.
2. Specify a name and select the App ID instance from the drop-down list.
3. Select the checkbox to enable the ID provider.

Zoom

!
[Create App ID instance](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/includes/images/org-guide-create-appid.png)

Figure 2. Create your APP ID instance
2. Read and agree to the terms and click Create.







 Step 2: Configure the ID provider 

We will use the Cloud Directory capability to add users to the ID provider. Refer to the [App ID documentation](https://cloud.ibm.com/docs/appid) for instructions how to integrate other ID providers into App ID.



1. Open the [IBM Cloud resource list](https://cloud.ibm.com/resources), expand the Services and software section, find your App ID instance and click its name to view its details.
2. Click Manage Authentication and deselect any login options that you don't need, such as Facebook and Google.
3. Navigate to Manage Authentication → Cloud Directory → Settings and choose whether user logins should use email or usernames.
4. Optional: Open Manage Authentication → Cloud Directory → Password Policies to define the password strength.
5. Optionally open Login Customization and customize the appearance of the login page.







 Step 3: Integrate the App ID instance as the ID provider for the administrator's account 



1. Go to [Manage → Access (IAM) → Identity Providers](https://cloud.ibm.com/iam/identity-providers). For Type, choose IBM Cloud App ID, then click Create.
2. Specify a name and select the App ID instance from the drop-down list.
3. Select the checkbox to enable the ID provider.

Zoom

!
3. Create service IDs and API keys for the anonymous user 

To create a service ID for the anonymous user and the corresponding API key, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Service IDs.
2. To create the service ID for the anonymous user, follow these steps:



1. Click Create.
2. Create a name Anonymous user and description for the anonymous user service ID.
3. Click Create.



3. To create an API key for the service ID, follow these steps:



1. Click the API keys tab on the Anonymous user service ID page.
2. Click Create.
3. Add a name and description to easily identify the API key, for example, Anonymous user API key.
4. Click Create.
5. Save your API key by copying or downloading it to secure location.



The API key is to be used as the PIN for the anonymous user logins, and cannot be retrieved. Make sure to make a copy of it in this step.



For more information about creating services IDs, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids). For detailed instructions on creating service ID API keys, see [Managing service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys).







 Step 3: Assign IAM roles to the service IDs 

You can grant access to service IDs within a Hyper Protect Crypto Services service instance by using the IBM Cloud console.



 1. Assign the custom roles to the SO user service ID 

To assign the custom roles that are defined in [Step 1](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-accessstep1-create-custom-roles) to the SO user service ID, follow these steps:

To assign access to the keystores for the SO user, follow these steps:



1.
For more information about trusted profiles, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile).



If you have onboarding set to Static and the user selects a trusted profile when they log in the first time, the user is still added to the account.
5. Then, select the following settings (Optional):



* Enable for account login?: Enable your IdP references to be used for users to log in to your account. This option is set by default when you first create an IdP reference.
* Set as the default?: Users can use the default IdP reference URL that you created when you enabled this feature to log in to your account. You can have only one default IdP reference. For all other IdP references that you create, users must use the realm IDs to log in.



6. Click Create.



Your IdP reference is now available on the Identity providers list and the realm ID is generated automatically as the value that represents your IAM IdP in IBM Cloud.





 Logging in with external identity provider credentials 

After your App ID instance is connected to your IdP, and your App ID instance is integrated with IAM, your users can start logging in to your account. If the IdP reference is set as the default, then you can share the Default IdP URL for your account.

However, since you can have only one set as the default, but you can have up to five set up in your account, you might need to get the URL for another IdP reference:



1. From the Identity provider pages, click the Actions icon ![List of actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) for the row of the IdP reference you need a URL for.
2. Select View IdP URL.
3. Copy the IdP URL link to give to users to log in.







 Using App ID instances to build dynamic rules in access groups
The General_About_You intent that is provided with the General content catalog serves a similar function, but its user examples are designed to focus on queries about the assistant as opposed to the business that is using the assistant to help its customers. So, you will add your own intent.



 Add the about_restaurant intent 



1. From the Intents tab, click Create intent.

![Shows the the Create intent button on the Intents page.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-intent-add.png)
2. Enter about_restaurant in the Intent name field, and then click Create intent.

![Shows the #about_restaurant intent being added.](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/gs-ass-add-intent.png)
3. Add the following user examples:

Tell me about the restaurant
i want to know about you
who are the restaurant owners and what is their philosophy?
What's your story?
Where do you source your produce from?
Who is your head chef and what is the chef's background?
How many locations do you have?
do you cater or host functions on site?
Do you deliver?
Are you open for breakfast?
4. Click the Close![Close arrow](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/close_arrow.png) icon to finish adding the about_restaurant intent.



You added an intent and provided examples of utterances that real users might enter to trigger this intent.
Adding users 



  Overview 

Data Security Broker Manager supports multiple users who can access the Manager console. All users on Data Security Broker Manager automatically have administrative privileges, so that they can enroll databases and applications, modify them, and deploy policies. However, only a user with Super Admin privileges can add, invite, and delete new users. A Data Security Broker Manager is limited to have only one Super Admin.





  Adding a user to the Data Security Broker Manager 

Complete the following steps to add a new user to the Data Security Broker Manager:



1.  As a Super Admin, navigate to the Users tab in the left navigation menu. Click Add Users + in the top right corner. Enter an email address to send an invite.

Zoom

![Users](https://cloud.ibm.com/docs-content/v1/content/57ab3ec034294d8a6de510b97bec3035d4654761/security-broker/images/add_user.svg)

Users

You must have configured the SMTP server to send an invite through email. Go the Settings page to configure the SMTP server details. Alternatively, you may select Get invite link to generate a URL that can be sent through any messaging platform.
2.  Copy and paste the invite link in a browser to start the new user registration.

This invite link expires within 24 hours.
3.  Data Security Broker Manager displays a confirmation message, that an invitation has been sent successfully. In the Users dashboard, the user details is displayed with the user's email.







  Creating a new user profile in Data Security Broker Manager 



1.  Click the invite link. The Data Security Broker Manager opens a user creation console.
2.  Enter the details for the user profile namely, First name, Last name, and provide a password and re-enter the password in the Confirm password field to complete the user registration.
3.  Upon completion, Data Security Broker Manager redirects you to a sign-in page.
4.  Log into the Data Security Broker Manager with your credentials.
5.  Navigate to the Profile section in the left navigation menu to see the list of user profiles created in the Data Security Broker Manager.
A CA managed by the console can also add an identity to your wallet during the [enrollment process](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-enroll).

You can use the Add identity button on the overview panel to import an identity directly into the wallet. Clicking this button opens up a side panel that allows you to add an identity's signing certificate and private key.



* Name: Enter an identity name that is used for your reference only.
* Certificate: Upload a file that contains the identity's signing certificate (in base64 or PEM format) that you generated by using your CA.
* Private Key: Upload a file that contains the identity's private key (in base64 or PEM format) that you generated by using your CA.



You can also add an identity by uploading a JSON file in the format below. You can also use the Upload JSON button to upload multiple identities at once.

{
"name": "peerAdminCerts",
"private_key": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tDQpNSUdIQWdFQU1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhCRzB3YXdJQkFRUWdIVk5Kc0tHYnl6eTVZWEQ2DQovaEhKOVZlR0QrZVhmenpxUi9PQWVZYnY5UWloUkFOQ0FBUmZ1WlB1OTRzNnJQSEVCMjJlWFhpSWozd0lKYkg4DQpRYVpaRkJlNFp5SnU5UllHbkxQWUdLRnhETkRVMUZkU1NxUGNLcnczUXpxT3hXNU1NZDVWbEtVdw0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQ0K",
"cert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tDQpNSUlCNURDQ0FZdWdBd0lCQWdJVUhhUFNNdlcxOEwyaGNTeGlJK1ZqT1d0WnlyZ3dDZ1lJS29aSXpqMEVBd0l3YTHJNM1o5TUZicGt3SGthYnB0MmZBekFLQmdncWhrak9QUVFEQWdOSEFEQkVBaUFmdUhjY2R6WExqZ3BLDQplVFhnNmNNcnRzRUs4ZVlKTVFMNlZLU0xwUXIvN3dJZ1hyK2ZuVjUrb2RHWnNRUU94SjZ1aDVTV0tJVkdZQ2ZGDQp1Ykw4VmJNdnRRZz0NCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0NCg=="
}

If you did not enroll an identity from the console, but instead by using the Fabric CA client or the Fabric SDKs, your keys need to be converted from PEM format into base64 format. You can convert certificates into base64 format by running the following command on your local machine:

export FLAG=$(if [ "$(uname -s)" == "Linux" ]; then echo "-w 0"; else echo "-b 0"; fi)
cat $HOME/<path-to-certificate>/cert.pem | base64 $FLAG





 Viewing and updating identities 

From the Wallet tab, click a tile to view, update, or remove an identity from the wallet. It might be necessary to update your identities if their certificates have expired, and they need to be issued new keys from the CA. You can also use this tab to delete keys from your console and your local system.

Clicking an identity opens a side panel that displays its certificates and private keys in base64 format.
Enter a User ID and an IBMid in the provided fields. Click Create.

The IBMid field can be used to specify either an IBMid or a service ID for the user.







 REST API experience 

The Db2 Warehouse on Cloud REST API was enhanced to also accept an IAM access token for the functions that previously accepted a database service-generated access token.



* To add a new IBMid user, run the following example API call:

curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid>","ibmid":"<userid>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"

The userid value for "id" cannot match the full email ID. It can match the first part of the email ID, but that is not necessary. The two different IDs are not linked together in any way. For example, if your "ibmid" is abc@us.ibm.com, then you could specify abc as the ID, or you could specify def for example, but you cannot specify abc@us.ibm.com.
* To migrate an existing non-IBMid database user (for example, abcuser) and make them an IBMid user, first delete the non-IBMid user ID by running the following example API call:

curl --tlsv1.2 -X DELETE "https://<IPaddress>/dbapi/v3/users/abcuser" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json"

Next, re-add the user with an IBMid that is the same as the previous user ID (abcuser) by running the following example API call:
Or, if users can bring their own licenses, you can provide that URL as well.



1. Click Add license agreements > Add.
2. Enter the name and URL, and click Update.
3. After entering all additional license agreements, click Next.







 Step 6: Review your readme file 

When users access your Operator from your account, they can select the link to your readme file in your private catalog to view product information. The readme file information is automatically generated from the details in your TGZ or CSV file.



1. From the Edit readme tab, click the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/edit-tagging.svg).
2. Preview how the information in the readme file will be displayed to users when they install the Operator.
3. If you need to make changes, edit the information in your source and import the updated software to your private catalog.
4. Click Next.







 Step 7: Validate the Operator 

To publish the Operator to your account, you're required to validate that it can be successfully installed on the target Red Hat OpenShift cluster.



1. From the Validate product tab, select the target cluster and project, and click Next.
2. Enter the name of your Schematics workspace, select a resource group, select a Schematics region, and click Next.

In the Tags field, you can enter a name of a specific tag to attach to your Operator. Tags provide a way to organize, track usage costs, and manage access to the resources in your account.
3. Click Validate.







 Step 8: Manage compliance 

Controls are safeguards that are used to meet security and compliance requirements. Only controls that are supported by Security and Compliance Center, formatted correctly, and validated by Code Risk Analysis and Security and Compliance Center scans appear in the catalog.
However, by using [access groups](https://cloud.ibm.com/docs/account?topic=account-groups) and [dynamic rules](https://cloud.ibm.com/docs/account?topic=account-rules), you can set up automatically assigned access policies.







 Enabling and connecting your identity provider 

If you haven't configured any IAM IdP references before in your account, you must enable the login setting for your account first.



1. Enable the login settings for your account. You can skip this step if you've already enabled this setting.



1. Go to Manage > Access (IAM) > Identity providers in the IBM Cloud console, and click Enable.
2. Enter an alias for the default account URL, which you provide to users to log in to your account.



Since you're sharing the URL with external users, make sure that the alias is unique and simple. A common format might be to use your company name or a variation of it.
2. Click Create to create your IdP reference.
3. Enter a name for the IdP reference, and select the App ID instance that you want to connect.
4. Select how you want to onboard users:



* Static: (Default) Add each user to your account when they log in the first time.
* Dynamic: Add users to your account only if they log in and don't select a trusted profile.
* Never: Users aren't added to your account but can access your account by using trusted profiles. For more information about trusted profiles, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile).



If you have onboarding set to Static and the user selects a trusted profile when they log in the first time, the user is still added to the account.
5. Then, select the following settings (Optional):



* Enable for account login?: Enable your IdP references to be used for users to log in to your account. This option is set by default when you first create an IdP reference.