vania-janet/multiturn-rag-retrieval-data huggingface dataset:
When you use the SDK, the endpoint URLs are built automatically.





 Tokens 

The service uses three different types of tokens. Tokens are set in the Identity Providers > Manage of the App ID dashboard. For more information about tokens and how they're used in App ID, check out [Managing tokens](https://cloud.ibm.com/docs/appid?topic=appid-tokens).



* Access tokens: Represent authorization and enable communication with protected [backend resources](https://cloud.ibm.com/docs/appid?topic=appid-backend). The resources are protected by authorization filters that are set by App ID.
* Identity tokens: Represent authentication and contain information about the user.
* Refresh tokens: Can be used to obtain a new access token without reauthenticating the user. By using refresh tokens, users can allow their information to be remembered by the application, which means that they can stay signed in.







 API Strategy 

The API strategy expects requests to contain an authorization header with a valid access token. The request can also include an identity token, but it is not required. If a token is invalid or expired, the API strategy returns an HTTP 401 error that contains the following HTTP header:

Www-Authenticate=Bearer scope="<scope>" error="<error>"

If the request returns a valid token, control is passed to the next middleware and the appIdAuthorizationContext property is injected into the request object. This property contains original access and identity tokens, and decoded payload information as plain JSON objects.





 Web app strategy 

When the web app strategy detects unauthorized attempts to access a protected resource, it automatically redirects a user's browser to the authentication page, which can be provided by App ID. After successful authentication, the user is returned to the web app's callback URL. The web app strategy obtains access and identity tokens and stores them in an HTTP session under WebAppStrategy.AUTH_CONTEXT. It is up to the user to decide whether to store access and identity tokens in the app database.





 Redirect URIs
Why is my user not redirected to my app? 

When a user signs into your app by using IBM Cloud® App ID, they are redirected back to your application, but occasionally a redirect might fail.

If your redirect URL is rejected by the service when you enter it in the UI, be sure that it is a valid URL that is formatted correctly. [Learn more](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpadd-redirect-uri).



 Why isn't a user redirected to my application after they sign-in by using an identity provider? 

 What’s happening 

A user signs in to your application through an identity provider's sign in page, and either nothing happens or the sign-in fails.

 Why it’s happening 

Sign-in might fail for the following reasons:



* Your redirect URL was not properly added to [the allow list](https://cloud.ibm.com/docs/appid?topic=appid-faqfaq-redirect).
* The user is not authorized.
* The user tried to sign in with the wrong credentials.



 How to fix it 

For a redirect to occur:



* Verify that your redirect URL is correct. It must be exact for the redirect to work.
* Be sure that your user is signing in with the correct credentials
* Check that they're configured in your identity provider user settings.







 Why isn't a user redirected to an identity provider when they try to sign-in? 

 What’s happening 

A user tries to sign in to your application, but the sign-in page doesn't display when prompted.

 Why it’s happening 

The identity provider can fail for several reasons:



* The redirect URI that is listed in App ID is written incorrectly.
* The identity provider doesn't recognize the authentication request.
* The identity provider expects HTTP-POST binding.
* The identity provider expects a signed AuthnRequest.



 How to fix it 

You can try some of these solutions:
Managing permissions 

To enable your users to view direct links, you must add the correct IBM Cloud Identity and Access Management (IAM) permissions. After you grant account permissions, your users can view direct link details by using the IBM Cloud® console. The information or actions that are shown depend on your account's permissions.

To grant a user permission to view direct link details, follow these steps:



1.  Log in to the [Access (IAM)](https://cloud.ibm.com/iam/users) page in the IBM Cloud® console.
2.  Select the user's name that you want to update permissions for.
3.  Click the Access groups tab, then select the Add cases and view orders and View cases groups.
4.  Click the Classic infrastructure tab, then from the Permissions tab, expand the Account category.
5.  Select the Add/Upgrade Services checkbox, then click Save.
A domain is a repository for users and groups that the vCenter SSO can use for user authentication. vCenter SSO has the following domains that are configured after the vCenter Server instance deployment.



* Local OS - Local operating system users are local to the operating system where the vCenter Single Sign-On server is running. The local operating system identity source exists only in basic vCenter SSO deployments and is not available in deployments with multiple vCenter SSO instances. Only one local operating system identity source is allowed. Shown as locals in the vSphere Client.
* vsphere.local – Enables administrator@vsphere.local to be authenticated.
* IBM Cloud for VMware Solutions infrastructure domain – This domain is the <root_domain> configured on the AD DNS server based on the parameters that are collected during the ordering process. This process allows the user automation@<root_domain> to be authenticated.



Users can log in to vCenter Server only if they are in a domain that is added as a vCenter SSO identity source. You add more identity sources to give your AD or LDAP users access if required.





 vSphere SSO configuration 

The following sections provide the settings that are configured in vSphere SSO.



 Token trustworthiness 



Table 1. Token trustworthiness

 Parameter Value 

 Clock tolerance 600000 milliseconds 
 Maximum token renewal count 10 
 Maximum token delegation count 10 
 Maximum bearer token lifetime 300 seconds 
 Maximum holder-of-key token lifetime 2592000 seconds 







 Lockout policy 

For more information about the lockout policy, see [Policy configurations](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_compl_infovc_compl_info-default-policy-config).





 Password policy 



Table 2. Password policy

 Parameter Value 

 Maximum lifetime Password must be changed every 90 days 
 Restrict reuse Users cannot reuse any previous five passwords 
 Maximum length 20 characters 
 Minimum length 15 characters
* The SSO domain of vsphere.local is always used.
* The SSO site name equals the <root_domain> captured during the ordering process.
* An identity source, the IBM Cloud for VMware Solutions infrastructure domain, <root_domain>, is configured.
* The VSPHERE.LOCALAdministrator user is configured as an Administrator role.
* The following groups are configured with Administrator roles:



* <root_domain>ic4v-vCenter
* vsphere.localAdministrators





After deployment, the administrator@vsphere.local user has administrator access to both SSO and vCenter Server. This user can manage identity sources and default domains, specify password policies, and perform other administrative tasks in the vsphere.local domain. However, this user is integral to the VMware vSphere® and VMware NSX® infrastructure authentication they are not part of AD but created automatically when vSphere is deployed. As this account is not part of AD, they can be used in situations when AD is not working correctly.

As the customer, you have full access to manage the vSphere SSO users and groups as needed. For more information about changing these policies, see [Managing vCenter Single Sign-On users and groups](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.psc.doc/GUID-31F302A6-D622-4FEC-9007-EE3BA1205AEA.html).



 Identity sources 

Identity sources are used to attach one or more domains to vCenter SSO. A domain is a repository for users and groups that the vCenter SSO can use for user authentication. vCenter SSO has the following domains that are configured after the vCenter Server instance deployment.



* Local OS - Local operating system users are local to the operating system where the vCenter Single Sign-On server is running. The local operating system identity source exists only in basic vCenter SSO deployments and is not available in deployments with multiple vCenter SSO instances. Only one local operating system identity source is allowed.
Next, click Enroll Identity and select the TLS Certificate Authority from the CA drop-down list. Enter the Enroll ID and Secret that you specified in the previous step. When you click Next, the subsequent panel contains the certificates generated for your new user identity.

Enter an Identity display name. Click Add identity to Wallet to store the keys in your console wallet. These certificates are stored in the browser and are not saved by IBM Blockchain Platform. It is your responsibility to manage the certificates and keep them secure—click Export identity to save the identity to your file system for importing back into the wallet, as needed. Export the Certificate and Private key to the file system.

If you have multiple components with certificates issued by the same CA, it is not necessary to create a new identity for each component—the certificates generated for the identity will be valid for all of these components. To collect metrics for components with certificates issued by a different CA, repeat the previous steps (create a new identity) for this other CA.





 Step two: Provision an IBM Cloud Monitoring instance 

In this step you will provision an IBM Cloud Monitoring instance, which collects and displays metrics for Kubernetes clusters, including IBM Blockchain Platform Prometheus metrics.

Navigate to the Catalog from your IBM Cloud dashboard and search for IBM Cloud Monitoring. Platform Metrics does not have to be enabled for Prometheus metrics to work. Furthermore, you can choose any region to locate the instance—the region will not affect the setup.

Once your IBM Cloud Monitoring instance is provisioned, navigate to Get Started > Install the agent > Add Sources. This will redirect you to the command for installing sysdig agents on your Kubernetes cluster. Log in to your cluster using the CLI and run the Public Endpoint curl command to install the agents, if necessary.





 Step three: Configure the TLS secret 

Configuring Sysdig created the ibm-observe namespace in your Kubernetes cluster. You will repeat this configuration for Prometheus by editing the associated daemonset and configmap. First, store the downloaded TLS certs in a Kubernetes secret by logging into the cluster (via the CLI) and running the following commands.
To import a new identity, open the Wallet tab and click Add identity. If you want to upload .pem certificates manually, click New identity and use the fields under Manual entry to give the identity a name and to upload the signing certificate and private key of the identity. If you have a JSON that was exported from another console, click Upload JSON and then Add files, then select the appropriate JSON from your local file system and click Add identity. While you will have this option between entering certificates manually or using a JSON for each node, in this topic it is assumed that you have the relevant JSON handy.

After you complete the Add identity panel, you can view the new admin identity in your Wallet and select this identity when importing any nodes it is associated with. You will also be able to use this identity when creating new MSPs and components.







 Importing an organization MSP definition 

Because MSPs define an organization, they are required when creating channels, creating nodes (to identify which organization the node will belong to), and validating signatures. For the latter reason, your MSP must be known (in other words, exported and then imported) by every member of every channel you belong to unless your organization will not be involved in validation or endorsement.

To act as an administrator for an organization, you must have an identity in your Wallet listed in the MSP as an admin of the organization. This means either importing the identity listed in the MSP or by following the process listed in [Updating an organization MSP definition](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsibp-console-govern-update-msp). This MSP can then be exported to the console where the added identity was created, making the exported identity able to act as an admin of the organization.

The exports and imports of MSPs are performed in the Organizations tab.

To export your MSP:



1. Navigate to the Organizations tab and click your organization MSP tile.
2. In the tile that opens, click the Export icon.

Zoom

!
"operations_url": "https://169.46.208.93:32101"
}

{
"short_name": "Orderer_0",
"name": "Orderer",
"url": "https://169.46.208.93:31612",
"type": "fabric-orderer",
"msp_id": "orderermsp",
"operations_url": "https://169.46.208.93:30115"
}



* client-tls-cert and client-tls-key

You can find the certificate and private key of the TLS CA in the console.



1. Click the peer or orderer's CA node in the Node tab.
2. On the CA tab, click the actions menu next to the admin user and click Enroll identity.
3. On the side panel that opens, select TLS Certificate Authority from the Certificate Authority drop-down list.
4. Enter the Enroll secret for the admin user and click Next.
5. Enter an Identity display name and click Add identity to Wallet.
6. Open the Wallet tab and click the identity you just created.
7. Click Export identity to download the Certificate and Private key to a JSON file.
8. Open the exported JSON file.
9. Find the private key that is the value of the private_key parameter in the JSON file. This is your client-tls-key for use in the commands below.
10. Find the TLS CA certificate that is the value of the cert parameter in the JSON file. This is your client-tls-cert for use in the commands below.



* peer tls-ca cert or orderer tls-ca cert

You can find the TLS CA certificate of the peer or orderer in the console.



1. Click the peer or orderer's node in the Node tab.
2. Click the Settings icon beside the node name.
3.
They can also invite and remove users from the account, including other users with the administrator role.



 Assigning access to resources in the console 

To assign access to an individual resource in the account or access to all resources in the account, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to assign access.
2. Click the Actions icon ![List of actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Assign access for the user or service ID that you want to assign access.
3. Select a group of services or a single service. Then, click Next.
4. Scope the access to the all resources in the account, or select specific resources based on attributes.
5. Click Next.
6. Select any combination of roles to assign, and click Review.
7. Click Add to add your policy configuration to your policy summary.
8. (Optional) Add users or service IDs to Access groups.



1. Select the access groups that you want the user or service ID to belong to.
2. Click Add



9. Click Assign.



If a user doesn't have a role on the resource group that contains the resources, they can see the resources, but can't access the resources by going to the Resource list page in the account to start working with them. Assign the Viewer role or higher on the resource group itself to ensure that a user can access the resource.





 Assigning access within a resource group in the console 

To assign access to all resources in a resource group or to just one service within a resource group, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to assign access.
2.
Some action names were changed as part of an alignment to new guidelines. [Learn more](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-eventaction_field).



Table 1. Actions that you can take that are tracked by Activity Tracker

 Action Description GUI action 

 appid.recent-activity.read View recent activity. Can be found in the Activity Log box on the Overview tab. 
 appid.idp-config.read View the identity provider configuration. Can be found in the Manage authentication > Identity Providers tab. 
 appid.idp-config.update Update the identity provider configuration. Can be updated in the Manage authentication > Identity Providers tab. 
 appid.tokens-config.read View the token expiration configuration. Can be found in the Manage authentication > Authentication Settings tab. 
 appid.tokens-config.update Update the token expiration configuration. Can be found in the Manage authentication > Authentication Settings tab. 
 appid.redirect-uris.read View the current redirect URI configuration. Can be found in the Manage authentication > Authentication Settings tab. 
 appid.redirect-uris.update Update the redirect URI configuration. Can be updated in the Manage authentication > Identity Providers tab. 
 appid.is-profiles-active.read View the user profile storage configuration. Can be found in the Profiles and roles > User Profiles tab. 
 appid.is-profiles-active.update Update your user profile storage configuration. Can be found in the Profiles and roles > User Profiles tab. 
 appid.users.read Search user profiles. Can be found in the Profiles and roles > User Profiles tab. 
 appid.users.create Create pre-registered user profile. Can be found in the Profiles and roles > User Profiles tab. 
 appid.users.get Export user profiles. Must be done through the API. 
 appid.refresh-token.revoke Revoke all the refresh tokens that are issued for the user. Must be done through the API. 
 appid.users.import Import user profiles.
If you're using a browser-based application, you can use the [Open ID Connect (OIDC)](https://openid.net/specs/openid-connect-core-1_0.html) / OAuth 2.0 authorization_grant flow to authenticate your users. When an unauthenticated user is detected, they are automatically redirected to the authentication page. When the authentication completes, the browser is redirected to an implicit /oidc/callback endpoint where the Adapter intercepts the request. At this point, the Adapter obtains tokens from the identity provider and then redirects the user back to their originally requested URL.

To view the user session information, including the session tokens, you can look in the Authorization header.

Authorization: Bearer <accessToken> <IDToken>

You can also log out authenticated users. When an authenticated user accesses any protected endpoint with oidc/logout appended as shown in the following example, they are logged out.

https://myhost/path/oidc/logout

If needed, a refresh token can be used to automatically acquire new access and identity tokens without your user's needing to reauthenticate. If the configured identity provider returns a refresh token, it's persisted in the session and used to retrieve new tokens when the identity token expires.





 Protecting backend apps 

The Adapter can be used in collaboration with the OAuth 2.0 [JWT Bearer flow](https://datatracker.ietf.org/doc/html/rfc6750) to protect service APIs by validating JWT Bearer tokens. The Bearer authorization flow expects a request to contain an Authorization header with a valid access token and an optional identity token. The expected header structure is Authorization=Bearer {access_token} [{id_token}]. Unauthenticated clients are returned an HTTP 401 response status with a list of the scopes that are needed to obtain authorization.
How to fix expired organization admin certificates 

If the peer or orderer organization admin certificates have expired, you need to generate certificates for a new admin identity. The overall process depends on whether Node OU is enabled for the MSP that the admin certificate belongs to.

Register a new user and enroll the identity for a new peer organization or orderer organization admin identity with the same CA that the existing peer or orderer organization admin was registered with.



1. Open the peer or orderer organization CA.
2. Click Register user and specify a new enroll ID and secret.
3. Select a Type of admin.
4. Configure the rest of the settings as you did for the original admin identity and click Register user.
5. Right-click the action menu for the new user and select Enroll identity.
6. Ensure the Root Certificate Authority is selected and provide the enroll ID and secret that you specified when you registered the new user.
7. Specify a unique display name for this new identity and export the identity to your wallet.
8. If Node OU support was not enabled when the identity was originally enrolled, then you should use the new exported certificate and follow the manual update steps [2](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-msp) - [7](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel) to update the admin certificate in the MSP, peer, orderer, and channel. Before attempting these steps, review the next section that describes the ordering node override that needs to be configured if any of the channel member or channel orderer organization admin certs have expired.





 Override orderer configuration to allow expired certs for channel updates 

After the admin certificate is updated in the MSP, any channels that the MSP belongs to also have to be updated manually.
You [enable the metadata service](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-get-metadataimd-metadata-service-enable) by setting a toggle in the VPC UI, CLI, or API. You can enable the service when you create an instance or update an existing instance.

The metadata service intercepts all requests to the service's IP, and then routes them to the specific services to handle these requests. As part of the request to the metadata service, you have to include the instance identity access token.



 Compute resource identities 

Through IAM, you can also assign access rights to instances by creating a [compute resource identity](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-trusted-profile-metadata), and then configure access rights to IBM-enabled services that are using that identity.

The compute resource identity service creates a trusted profile, against which you can assign access rights to enable the instance to call IAM-enabled services, such as IBM Cloud Object Storage and IBM Key Protect for IBM Cloud. You create a trusted profile within the virtual server instance. Trusted profiles define authorization for all applications that are running on the instance.





 User data 

The metadata that you access from the instance includes user data. The user data is data that you specified when you provisioned the instance, and that is available when you provision another instances. (It's the same user data that is available from cloud-init for VPC instances.) For example, information to load database software, custom software for worker nodes, or information to make decisions about how to initialize the instance are provided in user data. For more information, see the topic on [User data](https://cloud.ibm.com/docs/vpc?topic=vpc-user-data).

The metadata that you access from within the instance is not protected by any encryption method. Any user with access to the instance and metadata service can potentially see the metadata. As a precaution, do not store sensitive data, such as passwords or customer encryption keys, as user data.









 Scenarios for using the metadata service