vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Application identity and authorization 

With IBM Cloud® App ID, you can secure applications using the application identity and authorization flow by leveraging OAuth2.0 capabilities.



 Understanding the communication flow 

There are several reasons that you might want one application to communicate with another service or app without any user intervention. For example, a non-interactive app that needs to access another application to perform its work. This could include processes, CLIs, daemons, or an IoT device that monitors and reports environment variables to an upstream server. The specific use case is unique to each application, but the most important thing to remember is that the requests are exchanged on behalf of the app, not on an end user, and it is the app that is authenticated and authorized.



 How does the flow work? 

App ID leverages the OAuth 2.0 client credentials flow to protect communication. After an app registers with App ID, the app obtains a client ID and secret. With this information, the app can request an access token from App ID and be authorized to access a protected resource or API. In the application identity and authorization flow, the application is granted only an access token. It does not obtain an identity token or a refresh token. For more information about tokens, see [Understanding tokens](https://cloud.ibm.com/docs/appid?topic=appid-tokens).

This workflow is meant to be used only with trusted applications where there is no risk of the secret being misused or leaked. The application always holds the client secret. It will not work for mobile apps.





 What does the flow look like? 

In the following image, you can see the direction of communication between the service and your application.

Zoom

![App ID application identity and authorization flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/app-to-app-flow.png)

Figure 1. Application identity and authorization flow



1.
Create a Terraform configuration file 

Next, create a Terraform configuration file that is named main.tf. In this file, you add the configuration to create a Log Analysis instance and to assign a user an access policy in Identity and Access Management (IAM) by using HashiCorp Configuration Language (HCL). For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).

The following code shows a sample configuration file to provision an instance. To retrieve the ID of the default resource group, the ibm_resource_group data source is used. The region is retrieved from the terraform.tfvars file that you created in step 1. Then, the user user@ibm.com is assigned the Manager role in the IAM access policy for the namespace for a particular region.

data "ibm_resource_group" "group" {
name = var.resource_group_name
}

locals {
instance_name = "${var.name}-${var.location}"
}

// Create an auditing instance

resource "ibm_resource_instance" "resource_instance" {
name = local.instance_name
service = var.service_type
plan = var.plan
location = var.location
resource_group_id = data.ibm_resource_group.group.id
tags = ["auditing", "public"]
}

// Create the resource key that is associated with the {{site.data.keyword.la_short}} instance

resource "ibm_resource_key" "resourceKey" {
name = var.key_name
role = "Manager"
resource_instance_id = ibm_resource_instance.instance.id
}

// Add a user policy for using the resource instance

resource "ibm_iam_user_policy" "policy" {
ibm_id = "user@ibm.com"
roles = ["Manager", "Viewer"]

resources {
service = "logdnaat"
[Change User Access](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-manage-user.png)

Figure 11. Change User Access

If you don't see the user that you want to manage, verify that they logged in to IBM Cloud at least once. See step 1 in the [User flow](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-cloud-orguser-org).
2. Add access groups with Assign group or remove the user from an access group by clicking the three dot menu and choosing Remove user.







 User flow 



1. A user is sent the ID provider URL for the IBM Cloud account. They use this URL and the login information to access the system. The user should change their password after they log on.

The administrator can always go to [Manage → Access (IAM) → Identity providers](https://cloud.ibm.com/iam/identity-providers) to look up the ID provider URL.
2. To work with Qiskit Runtime and access service instances, users need to create an API key from ([Manage → Access (IAM) → API keys](https://cloud.ibm.com/iam/apikeys)).
3. For further information, users can review [Getting started, Step 2](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-get-startedinstall-packages).







 Example scenario 

In our example, we want to create the following setup:



* We have two projects, ml and finance.



* The ml project needs access to the service instances QR-ml and QR-common.
* The finance project should have access to the service instances QR-finance and QR-common.



* We have three users:



* Fatima needs access to the ml project.
Assign the Viewer role or higher on the resource group itself to ensure that a user can access the resource.





 Assigning access within a resource group in the console 

To assign access to all resources in a resource group or to just one service within a resource group, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to assign access.
2. Click on the user or service ID that you want to assign access, then click Access > Assign access.
3. Select a group of services or a sinlge service. Then, click Next.
4. Scope the access to Specific resources, then select the Resource group attribute. By selecting a resource group, you can select roles for access to manage the resource group as well.
5. Click Next.
6. Select the access roles to manage the resource group. Then, click Next.
7. Select any combination of roles to assign, and click Review.
8. Click Add to add your policy configuration to your policy summary.
9. Click Assign.







 Assigning access to manage a resource group 

You can assign access to view or manage a resource group without assigning service access.

As an administrator, you might want to create an access group with the Viewer role on all resource groups. This way, when you assign access to service resources you don’t have to create additional policies for viewing resource groups. The Viewer role on a resource group is required for a user to create a service instance in that resource group.

To assign access to a resource group without assigning service access, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to assign access.
2. Click on the user or service ID that you want to assign access, then click Access > Assign access.
3. Select Resource group only.
4. Select Add a condition.
5. Select the Resource group attribute type and enter a resource group.
6. Click Next.
7.
<br> <br>Resources <br><br><br><br> * null_resource<br> * ibm_service_instance<br> * ibm_service_key<br> * ibm_app_route<br> * ibm_app<br> * ibm_function_package<br> * ibm_function_action<br> * ibm_function_trigger<br> * ibm_function_rule<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-function-cloudant-trigger) 







 Identity & Access (IAM) templates 



 Name Description and resources Code 

 ibm-iam-custom-role Create a custom role in IBM Cloud Identity and Access Management (IAM) for IBM Key Protect. <br> <br>Resources <br><br><br><br> * ibm_iam_custom_role<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-iam-custom-role) 
 ibm-iam-policy Create an access policy in IBM Cloud Identity and Access Management (IAM) to grant permissions for a resource group to a user. <br> <br>Resources <br><br><br><br> * ibm_iam_user_policy<br><br><br> [View code snippet](https://github.com/IBM-Cloud/terraform-provider-ibm/tree/master/examples/ibm-iam-policy) 
 ibm-iam-policy Create an access group in IBM Cloud Identity and Access Management and assign this access group permission to a resource group. Then, you add users to your access group and assign these users access to IBM Cloud Kubernetes Service, classic IBM Cloud infrastructure, and Cloud Foundry.
The user chooses an identity provider to authenticate with and completes the sign-in process.
5. The identity provider redirects to the client app with the authorization code.
6. The App ID SDK exchanges the authorization code for access, identity, and optional refresh tokens from the App ID service.
7. The tokens are saved by the App ID SDK and a redirect to the client application occurs.
8. The user is granted access to the app.







 Configuring the Node.js SDK 

You can configure App ID to work with your Node.js web applications.



 Before you begin 

You must have the following prerequisites:



* An instance of the App ID service
* A set of service credentials
* NPM version 4 or higher
* Node version 6 or higher
* Your redirect URI set in the App ID service dashboard



Check out the following video to learn about protecting Node applications with App ID. Then, try it out yourself by using a [simple Node sample app](https://github.com/ibm-cloud-security/appid-video-tutorials/tree/master/02a-simple-node-web-app).





 Installing the Node.js SDK 



1. By using the command line, change to the directory that contains your Node.js app.
2. Install the App ID service.

npm install --save ibmcloud-appid







 Initializing the Node.js SDK 



1. Add the following require definitions to your server.js file.

const express = require('express');
const session = require('express-session')
const passport = require('passport');
const WebAppStrategy = require("ibmcloud-appid").WebAppStrategy;
const CALLBACK_URL = "/ibm/cloud/appid/callback";
2. Set up your express app to use express-session middleware.

const app = express();
Identity Org1 CA Admin Org1 CA admin identity 
 Identity Org1 MSP Admin Org1 admin identity 
 Identity Ordering Service CA Admin Ordering Service CA admin identity 









 Using your CA to register ordering service node and ordering service admin identities 

As we did with the peer, we need to register two identities with our ordering service CA. After selecting your CA, you will need to register an admin for our ordering service organization and an identity for the ordering service itself.

After you have associated the CA admin, you can use the CA tile to create these identities by completing the following steps:



1. Click the Ordering Service CA tile in the Nodes tab and ensure the admin identity that you created for the CA is visible in the table. Then click the Register user button.
2. First we'll register the organization admin, which we can do by giving an Enroll ID of OSadmin and a secret of OSadminpw. Then set the Type for this identity as admin. You can ignore the Maximum enrollments field. If you want to learn more about enrollments, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register). Click Next.
3. This tutorial does not configure attributes on identities, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register) if you want to learn more. Click Register user.
4. After the organization admin has been registered, repeat this same process for the identity of the ordering service (also using the Ordering Service CA). For the ordering service node identities, give an enroll ID of OS1 and a secret of OS1pw. This is a node identity, so select orderer as the Type. You can ignore the Maximum enrollments field and, on the next panel, do not assign any Attributes, as before.





 Task: Create a CA and register users 



Table 10. Create a CA and register users

 Field Description Enroll ID Secret Type
Cloud Identity and Access Management is built into IBM Cloud and is used for authenticating and authorizing administrative and developer users that need to configure and manage their IBM services. Users who need access to the Watson IoT Platform dashboard are authenticated by using Cloud Identity and Access Management. The source of identity for Cloud Identity and Access Management can be registered IBMid users, or it can be a customer’s directory service that supports SAML.

Watson IoT Platform also supports authenticating users through App ID. App ID is used for authenticating users who need access to applications that are hosted in the IBM Cloud. App ID users do not typically perform administrative or development activities on a cloud service. For more information, see [App ID Authentication for Watson IoT Platform ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://www.ibm.com/support/knowledgecenter/SSQP8H/iot/platform/app_id.htmlapp_id).

IAM enables users to obtain an IAM OAuth token and use it to authenticate API calls. For example, a user with the Kubernetes Service CLI installed might use the following command:

bx iam oauth-tokens

The command returns the logged-in user's IAM token in the following format:

IAM Token: Bearer <some token>

A user can also use the IAM token endpoint to log in and retrieve their IAM token, as shown in the following example: curl -s 'https://iam.cloud.ibm.com/identity/token?grant_type=urn:ibm:params:oauth:grant-type:apikey&response_type=cloud_iam&apikey=<apikey>' -H'Content-Type:x-www-form-urlencoded' -XPOST

This API example uses an IAM API key to request the IAM token and returns the Bearer <token>.

Then, when a user calls a Watson IoT Platform API, they can provide the authorization header Authorization: Bearer <token> in their API calls.
You can ignore the Advanced deployment options, they are not relevant to this tutorial.
6. Review the Summary page, then click Add Certificate Authority.



Depending on your cluster type, deployment of the CA can take up to ten minutes. When the CA is first deployed, the status indicator box in the CA tile is a flashing gray box. When the CA is successfully deployed and is running, this box turns green, indicating that it is "Running" and can be operated from the console. Before proceeding with the steps below, you must wait until the CA status is "Running". If the gray box stops flashing, try reloading the page in your browser to refresh the status.





 Associate the CA admin identity 

Each CA node is created with a CA admin identity. You use the admin identity to register new users with your CA and generate certificates. Before you can use the console to operate your CA, you need to associate the CA admin identity with the CA node itself.

After the CA is running, as indicated by the green box in the tile, complete the following steps:



1. Click the Multiregion OS CA tile in the Nodes tab. Then, click Associate identity on the CA overview panel.
2. On the side panel that opens, provide the Enroll ID of admin and Enroll secret of adminpw that you specified in the preceding section. For the Identity display name, you can use the default value of Multiregion OS CA Admin.
3. Click Associate identity to add the identity into your console Wallet and associate the admin identity with your CA.





 Task: Associate identity 



Table 1. Associate CA admin identity

 Field Display name Enroll ID Secret 

 Enroll ID Multiregion OS CA Admin admin adminpw 



You should be able to see the CA admin in your Wallet.





 Task: Check your Wallet 



Table 2. Check your Wallet

 Field Display name Description 

 Identity Multiregion OS CA Admin Multiregion OS CA admin identity 









 Use your CA to register identities 

Each ordering node in the ordering service needs a certificate and private key to participate in the blockchain network.
You need to create only one admin identity for your organization. As a result, you need to complete these steps only once. You can use the signCert that you generated to deploy many peers or ordering nodes.Ensure that your $FABRIC_CA_CLIENT_HOME is set to the path to the MSP of your CA Admin. echo $FABRIC_CA_CLIENT_HOME
$HOME/fabric-ca-client/ca-admin
Register the component admin identity with the CA by running the following command: fabric-ca-client register --caname <ca_name> --id.name <name> --id.affiliation org1.department1 --id.type admin --id.secret <password> --tls.certfiles <ca_tls_cert_path>
Create a new user identity name and secret for the admin. Make sure to use different values than for the peer or ordering node identity that you registered. The command looks similar to the following example: fabric-ca-client register --caname ca --id.name peeradmin --id.affiliation org1.department1 --id.type admin --id.secret peeradminpw --tls.certfiles $HOME/fabric-ca-client/catls/tls.pem
Make a note of this information.
Click Export identity to download the certificate and private key.

Task: Check your Wallet



Table 3. Check your Wallet

 Field Display name Description 

 Identity Org2 CA Admin Org2 CA admin identity 







 Using your CA to register identities 

Each node or application that you want to create needs certificates and private keys to participate in the blockchain network. You also need to create admin identities for these nodes so that you can manage them from the console. We will create one CA and use it to create two identities:



* An organization admin: This identity allows you to operate nodes using the platform console.
* A peer identity: This is the identity of the peer itself. Whenever a peer performs an action (for example, endorsing a transaction) it will sign using its certificate.



Once you have associated the CA admin, you can use the CA tile to create these identities by completing the following steps:



1. Click the Org2 CA tile and ensure the admin identity that you created for the CA is visible in the table. Then click the Register user button.
2. First we'll register the organization admin, which we can do by giving an Enroll ID of org2admin and a secret of org2adminpw. Then set the Type for this identity as admin. You can ignore the Maximum enrollments field. If you want to learn more about enrollments, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register). Click Next.
3. This tutorial does not configure attributes on identities, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register) if you want to learn more. Click Register user.
4. After the organization admin has been registered, repeat this same process for the identity of the peer (also using the Org2 CA). For the peer identity, give an enroll ID of peer2 and a secret of peer2pw.
If you change browsers, you will need to import this identity into your Wallet to be able to operate the CA. Click Export identity to download the identity along with its certificate and private key.





 Using your CA to register identities 

Each node or application that you want to create needs a certificate and private key to participate in the blockchain network. You also need to create admin identities for your nodes so that you can manage them from the console. We will use our peer organization CA to register two identities:



* An organization admin: This identity allows you to operate nodes using the platform console.
* A peer identity: This is the identity of the peer itself. Whenever a peer performs an action (for example, endorsing a transaction) it will sign using its certificate.



Once you have associated the CA admin, you can use the CA tile to create these identities by completing the following steps:



1. Click the Org1 CA tile and ensure the admin identity that you created for the CA is visible in the table. Then click the Register user button.
2. First we'll register the organization admin, which we can do by giving an Enroll ID of org1admin and a secret of org1adminpw. Then set the Type for this identity as admin. You can ignore the Maximum enrollments field. If you want to learn more about enrollments, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register). Click Next.
3. This tutorial does not configure attributes on identities, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register) if you want to learn more. Click Register user.
4. After the organization admin has been registered, repeat this same process for the identity of the peer (also using the Org1 CA). For the peer identity, give an enroll ID of peer1 and a secret of peer1pw.
The platform attempts to automatically renew the enrollment certificates of the peer and ordering nodes 30 days before they expire, but you are responsible for manually renewing the organization admin certificates for your nodes, system channels and application channels. It is recommended that you review the topic on [managing certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmt) to learn more about what is required.





 Storing identities in your console wallet 

The wallet stores the identities and keys that the IBM Blockchain Platform console uses to operate the nodes of your network. You need to add your peer, orderer, and organization admins to this wallet before you can use the console to work with channels and smart contracts. You can also use the wallet to conveniently store the identities you use for your applications. You can use the wallet to export them at any time. Use the left navigation to browse to the wallet overview panel. You can add, update, and export identities from this wallet by using the overview panel.

The wallet is a component of the console and not a separate service. It stores your keys in the local storage of the browser that you use to access the console instead of your local file system. If you access your console from a different browser, or start a private browsing session, you will not be able to access the identities stored in the wallet. It is recommended that you export your admin identities from the console and store them in a safe place.



 Adding identities 

You can add an admin identity to your wallet when you [create your organization MSP](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-create-msp). A CA managed by the console can also add an identity to your wallet during the [enrollment process](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-enroll).

You can use the Add identity button on the overview panel to import an identity directly into the wallet. Clicking this button opens up a side panel that allows you to add an identity's signing certificate and private key.