vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can't change your IBMid, but you can create a new one if appropriate. The [IBMid worldwide help desk](https://www.ibm.com/ibmid/myibm/help/us/helpdesk.html) is available to help with general ID questions that aren't specific to your IBM Cloud account.





 Can I change my account language? 

The language that is used is based on your web browser settings. To view content in your native language, update your browser's language settings. The language for specific pages must be the same language that is selected for the browser's settings.





 Does IBM Cloud support batch registration of users? 

When you register users for IBM Cloud, you must register each user individually. IBM Cloud doesn't support batch registration of users.





 What are tags? 

Tags are key:value pairs that you use to organize your resources and service IDs or control access to them.



* You can use user tags to organize and view resources and service IDs across your account and help you track usage costs.
* You can limit access to specific resources and service IDs in your account by using access management tags.



For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).





 What access is required to create access management tags? 

You must be the account owner or have the following roles:



* Administrator on all account management services
* Administrator on the tagging service



For more information, see [Granting users access to tag resources](https://cloud.ibm.com/docs/account?topic=account-access).





 What access is required to attach or detach tags? 



* To manage user tags on a resource, you must have at least the editor role for IAM-enabled resources.
* To manage user tags on a service ID, you must have at least the editor role on the IAM Identity service.
* To manage access management tags, you must have the administrator role on the targeted resource.
* To manage access management tags on service IDs, you must have the administrator role on the IAM Identity service.
ibmcloud account space-users ORG_NAME SPACE_NAME [-r, --region REGION]



 Command options 

ORG_NAME (required)
: The name of the organization.

SPACE_NAME (required)
: The name of the space.

-r, --region REGION (optional)
: Region name. Default to current region if not specified.







 ibmcloud account space-roles 

Get all space roles of current user under specific org:

ibmcloud account space-roles ORG [-r, --region REGION]



 Command options 

ORG (required)
: The name of the organization.

-r (optional)
: Region name. Default to current region if not specified.







 ibmcloud account space-role-set 

Assign a space role to a user. This operation can be run only by a space manager.

ibmcloud account space-role-set USER_NAME ORG_NAME SPACE_NAME SPACE_ROLE [-r, --region REGION]



 Command options 

USER_NAME (required)
: The name of the user to be assigned.

ORG_NAME (required)
: The name of the organization this user is assigned to.

SPACE_NAME (required)
: The name of the space this user is assigned to.

SPACE_ROLE (required)
: The name of the space role this user is assigned to. For example:

SpaceManager: This role can invite and manage users, and enable features.

SpaceDeveloper: This role can create and manage apps and services, and see logs and reports.

SpaceAuditor: This role can view logs, reports, and settings for the space.

-r, --region REGION (optional)
: Region name. Default to current region if not specified.





 Examples 

Assign user Mary to the organization IBM and space Cloud as SpaceManager role:

ibmcloud account space-role-set Mary IBM Cloud SpaceManager







 ibmcloud account space-role-unset 

Remove a space role from a user. This operation can be run only by a space manager.
A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

For example, to list all the service keys that are available in an instance in US South, you can run the following request:

curl https://api.us-south.logging.cloud.ibm.com/v1/config/keys?type="service" -H "content-type: application/json" -H "servicekey: xxxxxxxxx"





 Get details on a key 

To get information on an service key, you can run:

curl -X GET https://API_ENDPOINT/v1/config/keys/KEY_ID
-H 'content-type: application/json' -H 'servicekey: SERVICE_KEY'

Where:

API_ENDPOINT
: Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).

KEY_ID
: ID value of the service key for which you want to get details.

SERVICE_KEY
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

For example, to get information on an service key that is available in an instance in US South, you can run the following request:
After the product is published, users within the enterprise can create an instance of the product.

ibmcloud catalog offering publish enterprise [--catalog CATALOG]



 Command options 

--catalog CATALOG
: The catalog name or ID.

--offering OFFERING
: The product name or ID.







 ibmcloud catalog offering suspend-offering 

Run the following command to suspend a product from the catalog. You can suspend it for a short time without permanently deleting or deprecating it. Suspending a product can be useful if, for example, you discover a bug or a vulnerability in your product that must be investigated before more customers install it.

ibmcloud catalog offering suspend-offering [--catalog CATALOG]



 Command options 

--catalog CATALOG
: The catalog name or ID.

--offering OFFERING
: The product name or ID.







 ibmcloud catalog offering version suspend-version 

Run the following command to suspend a version of a product from the catalog. You can suspend the version for a short time without permanently deleting or deprecating it.

ibmcloud catalog offering version suspend-version [--version-locator VERSION_NUMBER]



 Command options 

--version-locator VERSION_NUMBER
: To get the version locator for this offering, run ibmcloud catalog offering list and locate the version that you want to use.







 ibmcloud catalog offering workspaces 

Run the following command to get the Schematics workspaces for a product version.

ibmcloud catalog offering workspaces [--version-locator VERSION_NUMBER] [output FORMAT]



 Command options 

--version-locator VERSION_NUMBER
: To get the version locator for this offering, run ibmcloud catalog offering list and locate the specified version that you want to use.

--output FORMAT (optional)
: Specifies output format. Default is terminal compatible and the only supported alternative is JSON. For example, --output json.







 ibmcloud catalog install 

Run the following command to install a software version from the IBM Cloud catalog.
* To get the CRN of a VPC or Direct Link, select the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the upper left, then click Resource list. Expand Networking to list your networking resources, then locate the service that you are looking for. Next, click anywhere in the service's table row (except for the Name link). From the side panel that appears, copy the CRN and paste it into the Add connection pane.



7. Complete any remaining fields, then click Add. The network connection now shows the Pending approval status in the gateway owner's account.

For the Classic infrastructure connection, the ID number is for your IBM Cloud account, not for a SoftLayer account.

The network owner's account then receives a notification of the request. If the network owner rejects the cross-account connection, no connectivity is established and the connection shows a status of Rejected. You can delete this connection at this point. If the cross-account connection is not explicitly approved, it expires after 72 hours.

Connection requests can be resubmitted if they expire or are rejected.
8. A user with the [necessary IAM permissions](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-iam) in the network owner's account can see the gateway and the details of all other connections attached to it in View only mode. From the network owner's account, go to the Transit Gateway page and click the gateway name in the table.
9. In the Connections section, see Action required to view the incoming network connection request. A user with the [necessary additional IAM permissions](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-iam) can then click Approve to approve the request.

After the network owner's account ensures that the connection request is from a legitimate source and approves it, the system establishes routes to and from all other networks connected to the same transit gateway.
{
"output": {
"generic": [
{
"response_type": "stop_activities",
"activities":
{
"type": "speech_to_text_recognition"
}
],
"channels":
{
"channel":"voice_telephony"
}
]
}
]
}
}
Show more







 start_activities 

Sends a command to a channel integration to start one or more activities that are specific to that channel. You can use this response type to restart any activity you previously stopped using the stop_activities response type.

Currently, only the phone integration supports the start_activities response type.



 Fields 



 Name Type Description Required? 

 response_type string start_activities Y 
 activities list A list of objects identifying the activities to start. Y 
 activities[].type string The name of the activity to start. Y 



Currently, the following activities for the phone integration can be started:



* speech_to_text_recognition: Starts recognizing speech. Streaming audio to the Speech to Text service is resumed.
* dtmf_collection: Starts processing of inbound DTMF signals.







 Example 

This example uses the start_activities response type to restart recognizing speech. Because this command is specific to the phone integration, the channels property specifies voice_telephony only.

{
"output": {
"generic": [
{
"response_type": "start_activities",
"activities":
{
"type": "speech_to_text_recognition"
}
],
"channels":
{
"channel": "voice_telephony"
}
]
}
]
}
}
Show more







 text_to_speech 

Sends a command to the Text to Speech service instance used by the phone integration. These commands can dynamically change the configuration or behavior of the service during a conversation.



 Fields 



 Name Type Description Required? 

 response_type string text_to_speech Y
Service role: Manager Allows the user to launch the web UI and configure archiving through the web UI or by using the API. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/log-analysis?topic=log-analysis-iam_view_logsiam_view_logs).





 IBM Cloud Object Storage service 

The following table lists the roles that a user can have to complete the actions required to configure the IBM Cloud Object Storage service:



Table 2. Roles and actions

 Service Roles Action 

 Cloud Object Storage Platform role: Administrator Allows the user to assign policies to users in the account to work with the IBM Cloud Object Storage service. 
 Cloud Object Storage Platform role: Administrator <br>or <br>Platform role:Editor Allows the user to provision an instance of the IBM Cloud Object Storage service. 
 Cloud Object Storage Platform role: Administrator <br>or <br>Platform role:Editor <br>or <br>Platform role: Operator Allows the user to create a service ID. 
 Cloud Object Storage Service role: writer Grants permissions to create, modify, and delete buckets. In addition, grants permissions to upload and download the objects in the bucket. 



For more information on how to configure policies for a user, see [Grant IAM policies to a user to work with IBM Cloud Object StorageD](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-archivingarchiving_step1).





 Service ID 

The service ID that you must create for an IBM Cloud Object Storage instance is used by IBM Log Analysis to authenticate and access the IBM Cloud Object Storage instance. This service ID must have the writer role. This role grants permissions to upload archive files in the bucket.

When the service credential is rotated, make sure the [API Key is updated with the new API Key.](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-archivingarchiving_step8) Archiving will stop if the API Key is not updated.







 Activity Tracker logs
For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iam_view_eventsiam_view_events).





 IBM Cloud Object Storage service 

The following table lists the roles that a user can have to complete the actions required to configure the IBM Cloud Object Storage service:



Table 2. Roles and actions

 Service Roles Action 

 Cloud Object Storage Platform role: Administrator Allows the user to assign policies to users in the account to work with the IBM Cloud Object Storage service. 
 Cloud Object Storage Platform role: Administrator <br>or <br>Platform role:Editor Allows the user to provision an instance of the IBM Cloud Object Storage service. 
 Cloud Object Storage Platform role: Administrator <br>or <br>Platform role:Editor <br>or <br>Platform role: Operator Allows the user to create a service ID. 
 Cloud Object Storage Service role: writer Grants permissions to create, modify, and delete buckets. In addition, grants permissions to upload and download the objects in the bucket. 



For more information on how to configure policies for a user, see [Grant IAM policies to a user to work with IBM Cloud Object StorageD](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-archivingarchiving_step1).





 Service ID 

The service ID that you must create for an IBM Cloud Object Storage instance is used by IBM Cloud Activity Tracker to authenticate and access the IBM Cloud Object Storage instance. This service ID must have the writer role. This role grants permissions to upload archive files in the bucket.

When the service credential is rotated, make sure the [API Key is updated with the new API Key.](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-archivingarchiving_step8) Archiving will stop if the API Key is not updated.







 Activity Tracker events 

The following Activity Tracker events are generated when you configure archiving:



Table 3. Archiving Activity Tracker events
Why does my app fail with a group ID error for NFS file storage permissions? 

Classic infrastructure

 What’s happening 

After you [create](https://cloud.ibm.com/docs/openshift?topic=openshift-file_storageadd_file) or [add existing](https://cloud.ibm.com/docs/openshift?topic=openshift-file_storageexisting_file) NFS storage to your cluster, your app's container deployment fails. You see group ID (GID) error messages.

 Why it’s happening 

When you create a container from an image that does not specify a user and user ID (UID), all instructions in the Dockerfile are run by the root user (UID: 0) inside the container by default.

However, when you want to mount an NFS file share to your container, the user ID 0 inside the container is mapped to the user ID nobody on the NFS host system. Therefore, the volume mount path is owned by the user ID nobody and not by root. This security feature is also known as root squash. Root squash protects the data within NFS by mounting the container without granting the user ID root permissions on the actual NFS host file system.

 How to fix it 

Use a Kubernetes [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) to enable root permission to the storage mount path on all your worker nodes for NFSv4 file shares.

To allow root permission on the volume mount path, you must set up a ConfigMap on your worker node. The ConfigMap maps the user ID nobody from the NFS host system to the root user ID 0 in your container. This process is also referred to as no root squash. An effective way of updating all your worker nodes is to use a daemon set, which runs a specified pod on every worker node in your cluster. In this case, the pod that is controlled by the daemon set updates each of your worker nodes to enable root permission on the volume mount path.
Why does my app fail with a group ID error for NFS file storage permissions? 

Classic infrastructure

 What’s happening 

After you [create](https://cloud.ibm.com/docs/containers?topic=containers-file_storageadd_file) or [add existing](https://cloud.ibm.com/docs/containers?topic=containers-file_storageexisting_file) NFS storage to your cluster, your app's container deployment fails. You see group ID (GID) error messages.

 Why it’s happening 

When you create a container from an image that does not specify a user and user ID (UID), all instructions in the Dockerfile are run by the root user (UID: 0) inside the container by default.

However, when you want to mount an NFS file share to your container, the user ID 0 inside the container is mapped to the user ID nobody on the NFS host system. Therefore, the volume mount path is owned by the user ID nobody and not by root. This security feature is also known as root squash. Root squash protects the data within NFS by mounting the container without granting the user ID root permissions on the actual NFS host file system.

 How to fix it 

Use a Kubernetes [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) to enable root permission to the storage mount path on all your worker nodes for NFSv4 file shares.

To allow root permission on the volume mount path, you must set up a ConfigMap on your worker node. The ConfigMap maps the user ID nobody from the NFS host system to the root user ID 0 in your container. This process is also referred to as no root squash. An effective way of updating all your worker nodes is to use a daemon set, which runs a specified pod on every worker node in your cluster. In this case, the pod that is controlled by the daemon set updates each of your worker nodes to enable root permission on the volume mount path.

The deployment is configured to allow the daemon set pod to run in privileged mode, which is necessary to access the host file system.
You can grant access to a key ring within a Key Protect instance by using the IBM Cloud console, [IAM API](https://cloud.ibm.com/apidocs/iam-policy-managementcreate-policy), or [CLI](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policy_create){ :external}.

Review [roles and permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access) to learn how IBM Cloud IAM roles map to Key Protect actions.

To assign access to a key ring with the console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select a table row, and click the ⋯ icon to open a list of options for that user.
3. From the options menu, click Assign access.
4. Click Assign users additional access.
5. Click the IAM services button.
6. From the list of services, select Key Protect.
7. Select Services based on attributes.
8. Select the Instance ID attribute and select the instance in which the key ring resides.
9. Select the Key Ring ID attribute and enter the ID associated with the key ring.
10. Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) to assign access for the user.
11. Click Add.
12. Continue to add platform and service access roles as needed and when you are finished, click Assign. Note that the user must be assigned at least Reader access to the entire instance in order for them to list, create and delete key rings within the instance.



Zoom

![The image shows an example of how to grant user access to a key ring.]
Quick start: Node.js web apps 

With App ID, you can easily protect your Node.js front-end web applications. With this guide, you can quickly get a simple authentication flow up and running in less than 20 minutes.

Check out the following diagram to see the Authorization Code OAuth 2.0 workflow.

Zoom

![Node.js application authorization flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/node_web.png)

Figure 1. Node.js application flow



1. A user attempts to gain access to your protected web application but they are unauthorized.
2. Your application redirects the user to App ID.
3. App ID shows a sign-in screen that the user can use to authenticate.
4. They input their credentials such as a username and password. App ID validates the credentials.
5. App ID redirects the user back to your application with a grant code.
6. By using the grant code, your application makes a request to App ID to ensure that the user is validated. For more information about obtaining access tokens, see [Obtaining tokens](https://cloud.ibm.com/docs/appid?topic=appid-obtain-tokens).
7. App ID returns access and identity tokens for the validated user.
8. The user is then granted access to your application.





 Video tutorial 

Check out the following video to see how you can use App ID to protect a simple Node.js web application. All the information that is covered in the video can also be found in written form on this page.

Don't have an app that you can try out the flow with? No problem!
[Quick start: Node.js web apps](https://cloud.ibm.com/docs/appid?topic=appid-web-node)Quick start: Node.js web apps

With App ID, you can easily protect your Node.js front-end web applications. With this guide, you can quickly get a simple authentication flow up and running in less than 20 minutes.

App ID



* 20 minutes
* 2022-09-21



[Customizing your user experience](https://cloud.ibm.com/docs/appid?topic=appid-tutorial-attributes)Customizing your user experience

In a world with everything at our finger tips, people expect their experiences to be tailored to them. Whether we're having an in-person conversation or shopping online, we want to see only the things that apply to us. By using this step-by-step guide, you can learn how to harness the power of user attributes and really capture your users attention with App ID.

App ID



* 20 minutes
* 2022-09-15



[Setting up a bastion host that uses Teleport](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion-tutorial-teleport)Setting up a bastion host that uses Teleport

This tutorial shows you one way that can be used to meet the IBM Cloud Framework for Financial Services requirements that are related to bastion host. There are various ways to implement a compliant bastion solution, but we show you how to configure a bastion host in your VPC by using Teleport Enterprise Edition, along with Object Storage and App ID for enhanced security. You will learn how to set up a Teleport-based solution that meets the previously described IBM Cloud Framework for Financial Services requirements.

Object Storage App ID

+2

Virtual Private Cloud (VPC),IBM Cloud Framework for Financial Services



* 2 hours
* 2023-05-11