vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Experimental and beta features should not be used when implementing a solution that requires the labeling and deletion of data.



 Specifying a customer ID 

To associate a customer ID with data, include the X-Watson-Metadata header with the request that passes the information. You pass the string customer_id={id} as the argument of the header.

A customer ID can include any characters except for the ; (semicolon) and = (equals sign). Specify a random or generic string for the customer ID; do not specify a personally identifiable string, such as an email address or Twitter ID. You can specify different customer IDs with different requests. A customer ID that you specify is associated with the instance of the service whose credentials are used with the request; only credentials for that instance of the service can delete data associated with the ID.



 Supported methods 

You can use the X-Watson-Metadata header with the following methods:



* With WebSocket requests:



* /v1/recognize



You specify the customer ID with the x-watson-metadata query parameter of the request to open the connection. You must URL-encode the argument to the query parameter, for example, customer_id%3dmy_customer_ID. The customer ID is associated with all data that is passed with recognition requests sent over the connection.
* With synchronous HTTP requests:



* POST /v1/recognize



The customer ID is associated with the data that is sent with the individual request.
* With asynchronous HTTP requests:



* POST /v1/register_callback
* POST /v1/recognitions



The customer ID is associated with the allowlisted callback URL or with the data that is sent with the individual recognition request.
* With requests to add corpora, custom words, or grammars to custom language models:



* POST /v1/customizations/{customization_id}/corpora/{corpus_name}
* POST /v1/customizations/{customization_id}/words
* PUT /v1/customizations/{customization_id}/words/{word_name}
You can attach the attributes of only one anonymous profile to the user's identity that is stored in App ID. For example, say that a user browses your application anonymously in two separate browser tabs. The user adds a t-shirt to the shopping cart on the first tab and a pair of shorts to the cart on the second tab. App ID creates two separate anonymous profiles to track the interactions of the user with your application on each tab.

If the user chooses to sign in from the first tab, then they have access only to the t-shirt they added to their cart before they signed in. In this case, App ID attaches only the attributes of the anonymous profile on the first tab to the user's identity. The service does not merge the anonymous profile that is created on the second tab to the user's identity stored in App ID. But the user can still access the shorts anonymously on the second tab because they are still accessible with the anonymous profile that was created on the second tab. While you develop your app, you can configure how to attach anonymous attributes to identified user profiles.



 What does the progressive authentication flow look like? 

In the following image, you can see the direction of communication that defines the progressive authentication flow between the user, your application, App ID, and the identity provider.

Zoom

![The path to becoming an identified user when they start as anonymous](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/auth-anon-user.svg)

Figure 1. Progressive authentication flow of anonymous user



1. The user interacts with areas of your app that do not require authentication.
2. Your application notifies App ID that the user wants to interact with your app as an anonymous user.
3. App ID creates an ad hoc user profile and calls the OAuth login that issues anonymous tokens for the anonymous user.
4. Using the anonymous tokens from App ID, you can create, read, update, and delete the attributes that are stored in the anonymous user profile.
[More options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon on the General_About_You node, and then select Add child node.
8. In the If assistant recognizes field of this node, enter true.
9. Add the following message in the response text field:

Hello, <? input.text ?>! It's lovely to meet you. How can I help you today?
10. To capture the name that the user provides, add a context variable to the node. Click the More![More options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon, and select Open context editor.
11. Enter the following context variable name and value pair:



User name context variable details

 Variable Value 

 username <? input.text ?> 



The context variable value (<? input.text ?>) is a SpEL expression that captures the user name as it is specified by the user, and then saves it to the $username context variable.
12. Click ![Close](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/close.png) to close the edit view.



If, at run time, the user triggers this node and provides a name, then you will know the user's name. If you know it, you should use it! Add conditional responses to the greeting dialog node you added previously to include a conditional response that uses the user name, if it is known.





 Add the user name to the greeting
dn="cn=Manager,dc=ibmsymphony,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=ibmsymphony,dc=com" write by * read
Show more

Replace the {SSHA} value with the password hash that you generated in the previous step.
9. Apply the changes by running the following command:

ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
10. Create a file that is named basedomain.ldif and add the following lines to it:

dn: dc=ibmsymphony,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: WES Migration
dc: ibmsymphony
dn: cn=Manager,dc=ibmsymphony,dc=com
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=People,dc=ibmsymphony,dc=com
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=ibmsymphony,dc=com
objectClass: organizationalUnit
ou: Group
Show more
11. Apply the changes that are made in the previous step by running the following command:

ldapadd -x -D cn=Manager,dc= ibmsymphony,dc=com -W -f basedomain.ldif
12. Create a file that is named ldapuser.ldif by using an editor, such as VI, and add the following lines to it (replace with your own required domain name in the "dc=,dc=" section):

dn: uid=symphonyuser03,ou=People,dc=ibmsymphony,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: symphonyuser03
* store deployment
* ui deployment











 To view logs 

Consider using [Cognos Dashboards](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=services-cognos-dashboards) to identify patterns in your data.





 Managing user access 

After you provision an instance, you can share the URL for the product user interface with other users. However, those users can only log in to the product user interface if you give them access.

If you plan to use SAML for single sign-on (SSO), complete [Configuring single sign-on](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.0?topic=client-configuring-sso) before you add users. If you add users before you configure SSO, you will need to re-add the users with their SAML ID to enable them to use SSO.



1. From the web client menu, click Administer > Manage users.
2. Click New user, and specify the user's full name, user name, and email address. Set the user's permissions, and then click Save.
3. From the web client menu, select My Instances.
4. Find your Watson Assistant instance, hover over the last column to find and click the menu ![More menu](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/cp4d-sideways-kebab.png), and then choose Manage Access.
5. Click Add user.
6. Click the user name field to see a list of the people you can add.

The users you added in the previous steps are listed. Select a name, choose User or Admin as their access role, and then click Add.
Email The primary email address that is attached to the user. 
 First name and surname Your user's first name and surname as they provided during the sign-up process. 
 Last Login The timestamp of the last time that the user logged in to your application. Note: If you added your user through the dashboard, the login is blank until the user themselves signs in to your app. When sign-in occurs, they also become an App ID user. 
 ID The ID that is assigned to the user by App ID. In the UI, it isn't shown but you can copy the value and paste it in a text editor to see the value. 
 Predefined attributes Predefined attributes are things that are known about a user based on SCIM. 
 Custom attributes Custom attributes are additional information that is added to their profile or that is learned about the user's as they interact with your application. 
 Summary All the attributes are compiled to form one profile that gives you a complete overview of your Cloud Directory user. For more information, see [user profiles](https://cloud.ibm.com/docs/appid?topic=appid-profiles). 









 Viewing user information with the API 

You can use the App ID API to view details about your app users.



1. Obtain your tenant ID from your instance of the service.
2. Search your App ID users with an identifying query, such as an email address, to find the user ID.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/cloud_directory/Users?query=<identifyingSearchQuery>" -H "accept: application/json" -H "authorization: Bearer <token>"

Example:

curl -X GET https://us-south.appid.cloud.ibm.com/management/v4/e19a2778-3262-4986-8875-8khjafsdkhjsdafkjh/cloud_directory/Users?query=user@domain.com
-H "accept: application/json"
* If you want to attach an access management tag, you must first create the tag. For more information, see [Creating tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=clicreate).
* If you want to attach a user tag, you don't need to create the user tag to attach it to resources or service IDs. Attaching the tag also creates it.



2. Find the unique identifier for your service ID by calling the [IAM Identity Services](https://cloud.ibm.com/apidocs/iam-identity-token-apilist-service-ids) with the following command:



* Curl
* Java
* Python
* Go
* Node



curl -X GET 'https://iam.cloud.ibm.com/v1/serviceids?account_id=ACCOUNT_ID&name=My-serviceID' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json'

ListServiceIdsOptions listServiceIdsOptions = new ListServiceIdsOptions.Builder()
.accountId(accountId)
.name(serviceIdName)
.build();

Response<ServiceIdList> response = service.listServiceIds(listServiceIdsOptions).execute();
ServiceIdList serviceIdList = response.getResult();

System.out.println(serviceIdList);

service_id_list = iam_identity_service.list_service_ids(
account_id=account_id,
name=serviceid_name
).get_result()

print(json.dumps(service_id_list, indent=2))

listServiceIdsOptions := iamIdentityService.NewListServiceIdsOptions()
listServiceIdsOptions.SetAccountID(accountID)
listServiceIdsOptions.SetName(serviceIDName)
Adding App ID overview 

You can quickly add authentication and authorization to your application by integrating App ID. Regardless of the type of flow that you use, you can securely authenticate users to your app. With authentication in place, you can provide personalized user experiences across all types of devices.

Check out the following table to see how App ID fits into each type of application.



Table 1. The different ways in which you can secure your applications with App ID

 Type of authentication flow Description 

 [Single-page](https://cloud.ibm.com/docs/appid?topic=appid-single-page) You can use the single-page flow to securely authenticate users to your applications. An SPA runs entirely in your browser and does not require that the page be reloaded while the application is in use. 
 [Web](https://cloud.ibm.com/docs/appid?topic=appid-web-apps) You can use the web flow to securely authenticate users to your application and protect your server-side resources. If your application has a backend that you manage, it's recommended that you use the web flow. 
 [Mobile](https://cloud.ibm.com/docs/appid?topic=appid-mobile-apps) The App ID mobile flow is most helpful when you're developing applications that are made to be installed on a user's device as a native application. 
 [Backend](https://cloud.ibm.com/docs/appid?topic=appid-backend) You can protect your development resources and API endpoints from unauthorized access and ensure the security of your app by using the backend flow. 
 [Custom](https://cloud.ibm.com/docs/appid?topic=appid-custom-auth) Already have your own custom flow? No problem. You can use the custom identity flow to integrate App ID with your app. 
 [Anonymous](https://cloud.ibm.com/docs/appid?topic=appid-anonymous) With App ID, you can begin tracking a users activity before their initial sign-in to your app by using anonymous authentication.
If you cannot run the kubectl command, see [Enabling access to the Kubernetes command-line interface](https://www.ibm.com/support/knowledgecenter/SSQNUZ_2.1.0/com.ibm.icpdata.doc/zen/install/kubectl-access.html){: external}.
{: note}

- Test Helm (helm):

 {: pre}
helm version --tls

Show more





 Managing user access 

After you provision an instance, you can share the URL for the product user interface with other users. However, those users can only log in to the product user interface if you give them access.

If you plan to use SAML for single sign-on (SSO), complete [Configuring single sign-on](https://www.ibm.com/support/knowledgecenter/SSQNUZ_2.1.0/com.ibm.icpdata.doc/zen/admin/saml-sso.htmlsaml-sso) before you add users. If you add users before you configure SSO, you will need to re-add the users with their SAML ID to enable them to use SSO.



1. From the web client menu, click Administer > Manage user.
2. Click Add user, and specify the user's full name, user name, and email address. Set the user's permissions, and then click Add.
3. From the web client menu, select My Instances.
4. Find your Knowledge Studio instance, click the more (...) menu, and then choose Manage Access.
5. Click Add user.
6. Click the user name field to see a list of the people you can add.

The users you added in the previous steps are listed. Select a name, choose their access role, and then click Add.

If you aren't connecting to an existing user registry and enabling single sign-on, then temporary passwords are created for the users you add and are sent to them by way of the email addresses you specified.
To maintain security, do not include any personal information, sensitive data, or device or service credentials in case responses. For example, don't include passwords, API keys, secrets, or credit card information.
6. The following steps are optional:



* Attach files and resources to provide more details about the issue you're experiencing.
* If you'd like a user in you account to be updated about the case, add them by using the Contact watchlist. For more information about assigning users access to your account, see [Adding users to your case management access group](https://cloud.ibm.com/docs/get-support?topic=get-support-accessadd-user-access-group).
* Select Email me updates about this case to receive support case notifications.



7. Click Next, review your case summary, and click Submit case. After you receive email verification for the case, follow the instructions for further communication on the issue.



After your support case is created, you can follow its progress on the [Manage cases page](https://cloud.ibm.com/unifiedsupport/cases). For more information, see [Managing your support cases](https://cloud.ibm.com/docs/get-support?topic=get-support-managing-support-cases).
GET /resource HTTP/1.1
Host: server.example.com
Authorization: Bearer <accessToken> <optionalIdentityToken>







 Next steps 

With App ID installed in your application, you're almost ready to start authenticating users! Try doing one of the following activities next:



* Configure your [identity providers](https://cloud.ibm.com/docs/appid?topic=appid-social)
* Customize and configure [the Login Widget](https://cloud.ibm.com/docs/appid?topic=appid-login-widget)
* Learn more about the [Android SDK](https://github.com/ibm-cloud-security/appid-clientsdk-android)
* Learn more about the [iOS Swift SDK](https://github.com/ibm-cloud-security/appid-clientsdk-swift)
"id": "1439d777-185d-4be1-8f4a-c4e8142b87ea",
"name": "{{site.data.keyword.appid_short_notm}} Facebook User profile",
"email": "mail@mail.com",
"identities":
{
"provider": "facebook",
"id": "100195207128541",
"picture": {
"data": {
"height": 50,
"width": 50,
"url": "https://url-to-idp-profile-picture.com"
}
},
"first_name": "AppID",
"last_name": "Development"
}
],
"attributes": {
"points": 250
},
"roles": "admin"] ! ! ! !
}
}
<-- </ol> --><-- </section "class="ph" id="section-exporting-profiles" "> --><-- <section "class="ph" id="section-importing-profiles" "> --> Importing user profiles Now that you have a list of exported user profiles, you can import them into the new instance.<-- <ol> -->1. Be sure that you are assigned the ManagerIAM role]] for both the instance of App ID.2. If your users are assigned roles]] , be sure to create the roles and scopes in your new instance of App ID.
The roles and scopes must be created exactly as they were in the previous instance with the same spellings.
3. Import the users to your new instance of the service.
(https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/gs-ass-mcr-add-response.png)
4. Click Add response.
5. In the If assistant recognizes field, type $username, and in the Respond with field, add a new response:

Good day to you, $username!
6. Click the up arrow for response number 2 to move it so it is listed before response number 1 (Good day to you!).

![Shows the existing response is now part of a table of responses.](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/gs-ass-mcr-response-added.png)
7. Click ![Close](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/close.png) to close the edit view.







 Test personalization 

Test whether your assistant can recognize and save a user's name, and then refer to the user by it later.



1. Click the ![Try it](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/ask_watson.png) icon to open the "Try it out" pane.
2. Click Clear to restart the conversation session.
3. Enter, Who are you?

Your assistant recognizes the General_About_You intent. Its response ends with the question, What should I call you?
4. Enter, Jane.
Only users who have an IBMid associated with their email address are included in the list of initially provisioned users.

To log on to your IBM Cloud Pak for Security as a Service deployment, use the URL included in the welcome email, select Enterprise SAML as the authentication method, and then click Sign in with IBMid.





 Creating users in IBM Cloud Pak for SaaS 

Users who are listed as provisioned in the Welcome email can create additional users.





 Before you begin 



* You must have the Welcome email with details of your provisioned deployment for IBM Cloud Pak for Security as a Service.
* To create new users, you must be listed in the Welcome email as a provisioned user.
* The new users that you want to create must have an email address and an IBMid associated with their email address. Users can create an IBMid from [https://ibm.com/account](https://ibm.com/account).





 Create new users 



1. Log on to your IBM Verify instance by using the URL provided in the Welcome email and select Sign in with IBMid.
2. Enter your IBMid login credentials.
3. Add the new user in IBM Verify, as follows:



1. Click your profile in the top right of the page and select Switch to admin.
2. From the menu, select Users & groups. The Users tab is selected by default.
3. Click Add user.
4. From the Identity source drop-down menu, select IBMid.
5. Enter a given name and scroll down and enter a surname, user name, and email address. The other fields are optional.
6. Click Save.



4. Log on to IBM Cloud Pak® for Security as a Service by using the deployment URL provided in your Welcome email.
5. From the IBM Cloud Pak® for Security as a Service Homepage, click Settings > Manage users.



1. From the Manage users page, click Add user.
2. In the Name or Email address field, enter or select the user's email address.
3. Click Add user.
[List of actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) for the row of the IdP reference you need a URL for.
2. Select View IdP URL.
3. Copy the IdP URL link to give to users to log in.







 Using App ID instances to build dynamic rules in access groups 

In addition to the required and recommended attributes, you can pass any kind of information with your SAML assertion. These attributes are available for you to use in [dynamic rules in access groups](https://cloud.ibm.com/docs/account?topic=account-rules).

To successfully build a dynamic rule, the following information is required:



* Identity provider: Use the prefix appid:// and the realm ID from the IAM IdP. For example, appid://A1B2C3D4 if the realm ID of the user was A1B2C3D4.
* Add users when: Use the name of the additional SAML assertion. This property is passed through unchanged.
* If you are using the Cloud Directory option or the SAML federation option in App ID, notice that you can add custom attributes to each user's profile. You can use those properties for dynamic rules too. However, if you have the same property as a custom attribute and as a SAML assertion, then the custom attribute from the SAML assertion is used.



The IBM Cloud Kubernetes Service up to release 1.18 relies on unique usernames in an account. To work correctly, you must ensure that all usernames are unique across all IdPs. This means that you must make sure that the usernames that are onboarded to your account from IBMid and users that are onboarded to your account by an IAM IdP don't overlap. Otherwise, the IBM Cloud Kubernetes Service RBAC rules might get confused and give incorrect permissions.