vania-janet/multiturn-rag-retrieval-data huggingface dataset:
![IAM access control in an account](https://cloud.ibm.com/docs-content/v1/content/814aeaf04800bb4f74ea1c057d4abb166a5f357a/account/images/tp-in-ag-access-diagram.svg)

Figure 1. How IAM access works in an account by using access groups

For classic infrastructure that doesn't support the use of IBM Cloud IAM policies for managing access, you can use the [classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfra) documentation.



 What features are provided? 

IBM Cloud IAM provides a wide range of features for your identity and access management needs.



 User management 

With unified user management, you can add and delete users in an account for both platform and classic infrastructure services. You can organize a group of users in an access group to make assigning access for more than one user or service ID at a time a quick and easy task.





 Fine-grained access control 

Access for users, service IDs, access groups, and trusted profiles are defined by a policy. Within the policy, the scope of access can be assigned to a set of resources in a resource group, a single resource, or account management services. After the target is set, you can define what actions are allowed by the subject of the policy by selecting access roles. Roles provide a way to tailor the level of access that is granted for the subject of the policy to perform actions on the target of policy, whether it is platform management tasks within the account or accessing a service's UI or completing API calls.

You can also add time-based conditions to a policy that defines when the policy grants access, whether you want to grant temporary access to resources in your account or allow access during recurring time windows. For more information, see [Limiting access with time-based conditions](https://cloud.ibm.com/docs/account?topic=account-iam-time-based).





 Access groups for streamlined access management
}'

For more information, see the [Microsoft documentation](https://docs.microsoft.com/en-us/graph/api/site-post-permissions?view=graph-rest-1.0&tabs=http).









 Connecting to a SharePoint Online data source 

From your Discovery project, complete the following steps:



1. From the navigation pane, choose Manage collections.
2. Click New collection.
3. Click SharePoint Online, and then click Next.
4. Name the collection.
5. If the language of the documents in SharePoint is not English, select the appropriate language.

For a list of supported languages, see [Language support](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-language-support).
6. Optional: Change the synchronization schedule.

For more information, see [Crawl schedule options](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionscrawlschedule).
7. In the Authentication method section, specify the principal type you want to use when you authenticate with SharePoint from the following options:



* User: A user in your Active Directory organization.

In the Enter your credentials section, complete the following fields:

Username
: The username of the SharePoint user with access to all sites and lists that need to be crawled and indexed, for example crawl_username@company.onmicrosoft.com.

Password
: The password of the SharePoint user.

This value is never returned and is used only when you create or modify credentials.
* Service: A security identity used by user-created apps, services, and automation tools to access specific Azure resources. It is like a user identity (verified with a certificate) that has a specific role, and tightly-controlled permissions.

Support for using a service principal was added with version 4.0.3.

In the Enter your credentials section, complete the following fields:

Tenant name
: The tenant where the data resides. For example, ibm.onmicrosoft.com.
Save the following code block as enrollUser.js in the /magnetocorp/application directory:

'use strict';

const FabricCAServices = require('fabric-ca-client');
const { FileSystemWallet, X509WalletMixin } = require('fabric-network');
const fs = require('fs');
const path = require('path');

const ccpPath = path.resolve(__dirname, '../gateway/connection.json');
const ccpJSON = fs.readFileSync(ccpPath, 'utf8');
const ccp = JSON.parse(ccpJSON);

async function main() {
try {

// Create a new CA client for interacting with the CA.
const caURL = ccp.certificateAuthorities['<CA_Name>'].url;
const ca = new FabricCAServices(caURL);

// Create a new file system based wallet for managing identities.
const wallet = new FileSystemWallet('../identity/user/isabella/wallet');

// Check to see if we've already enrolled the admin user.
const userExists = await wallet.exists('user1');
if (userExists) {
console.log('An identity for "user1" already exists in the wallet');
return;
}

// Enroll the admin user, and import the new identity into the wallet.
const enrollment = await ca.enroll({ enrollmentID: '<app_enroll_id>', enrollmentSecret: '<app_enroll_secret>' });
const identity = X509WalletMixin.createIdentity('<msp_id>', enrollment.certificate, enrollment.key.toBytes());
await wallet.import('user1', identity);
: With the latest updates and improvements, IBM Cloud account owners or administrators can now use a new unified access control UI to take advantage of the following capabilities:



* Manage users' fine-grained access to Kubernetes services and other services as they adopt the new access control features
* Assign service policies and Cloud Foundry roles to users within their organizations



Additionally, IBM Cloud platform users can create, delete, and list API keys associated with their user IDs. And platform users can use those API keys to authenticate when using APIs or CLIs.

Lastly, we enhanced our unified user management capability to ensure that in a linked IaaS-PaaS account, users are managed in a unified way with no need to add users separately in the SoftLayer Customer Portal or the IBM Cloudconsole.

For more information, check out the [Introducing Identity & Access Management](https://www.ibm.com/blogs/bluemix/2017/05/introducing-identity-access-management/) blog post.







 April 2017 



 13 April 2017 

Navigation design changes for IBM Cloud docs
: With this navigation update, we think you'll understand how content is better organized throughout our docs, and will be able to find relevant content more efficiently. With fewer nested layers of content, you won't have to dig around to find the documentation you need to be successful with IBM Cloud.
Invoking IBM Cloud service APIs 

To invoke an IBM Cloud® service through an API, pass your credentials to the service's API to authenticate your user identity and your access to perform actions within the context of the service.

You can identify the caller in one of the following ways:



* IBM Cloud Identity and Access Management (IAM) token
* IBM Cloud API key or service ID API key



[IBM Cloud API keys](https://cloud.ibm.com/docs/account?topic=account-userapikeymanage-user-keys), [service ID API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys), and IAM tokens uniquely identify the caller’s identity. The caller identity is either an IBM Cloud user or a service ID that was created in an IBM Cloud account.

The API keys are credentials that consist of a long series of random characters or numbers. An IBM Cloud identity can have multiple API keys. Each of these API keys can be managed independently, meaning if this API key is used by your service only, you can delete the API key without disrupting some other component.

You can use API keys to [log in to the IBM Cloud command-line interface (CLI)](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) or to [generate IAM tokens](https://cloud.ibm.com/docs/account?topic=account-iamtoken_from_apikey). While it is not recommended for production use, you can also send API keys to IBM Cloud services.



 Passing an IBM Cloud IAM token to authenticate with a service's API 

To retrieve an IAM access token, the API client must first invoke an IBM Cloud IAM API to authenticate and retrieve that token. The preferred way for IBM Cloud service API clients is to use an IBM Cloud API key to get an IAM access token.
app.use(passport.session());
passport.serializeUser((user, cb) => cb(null, user));
passport.deserializeUser((user, cb) => cb(null, user));
passport.use(new WebAppStrategy({
tenantId: "<tenantID>",
clientId: "<clientID>",
secret: "<secret>",
oauthServerUrl: "<oauthServerURL>",
redirectUri: "<redirectURI>"
}));
Show more

You must configure the middleware with the proper session storage for production environments. For more information, see the [express.js docs](https://github.com/expressjs/session).







 Step 4: Protect your application 

Now that you have App ID installed, you're ready to protect your application. You can choose to protect your entire application or only specific resources by defining a web app strategy.



1. Configure the callback endpoint. The callback finishes the authorization process by retrieving access and identity tokens from App ID and redirecting the user to one of the following locations:



* The original URL of the request that triggered the authentication, as persisted in the HTTP session as WebAppStrategy.ORIGINAL_URL.
* Specifying a redirect in the event of a successful authentication.
* The application root (/) as shown in the next step.



app.get(CALLBACK_URL, passport.authenticate(WebAppStrategy.STRATEGY_NAME));
2. Set a sign-in endpoint that always redirects a browser to the Login Widget. Be sure to add a success redirect option so that you don't end up in an endless authentication loop.

app.get('/appid/login', passport.authenticate(WebAppStrategy.STRATEGY_NAME, {
successRedirect: '/',
forceLogin: true
}));
Single sign-on (SSO) 

With Single sign-on (SSO) for Cloud Directory, you can provide a smooth authentication experience between multiple web apps. If SSO is turned on when a user initially signs in, they are not required to reenter their credentials the next time they sign-in. Instead, they are automatically signed in to any of your apps that are protected by the same App ID instance.

App ID provides SSO for Cloud Directory users. If you use a social or federated SAML identity provider SSO is managed by that provider and App ID respects it.



 How it works 

Check out the following diagram to see SSO in action.

Zoom

![SSO diagram](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/sso.png)

Figure 1. Cloud Directory SSO flow



1. A Cloud Directory user signs in to your app for the first time.
2. They are asked to authenticate by providing either a username or email and password.
3. If the credentials are valid, a user is signed in to your app. At the same time, App ID, creates a session and sets a cookie on the user's browser.
4. If a user attempts to sign in to one of your other applications, App ID detects the session cookie and automatically signs the user into your app. App ID session cookies are instance-specific and are signed by the instance's unique private key.



Currently, Cloud Directory SSO is configured to work when Cloud Directory is the only enabled identity provider. If your instance of App ID is configured to use multiple identity providers, enabling SSO has no effect on the sign-in flow. Users are prompted to enter their Cloud Directory credentials or choose one of the other providers at every sign-in.





 Configuring SSO 

You can configure single sign-on by using the App ID dashboard or by using the APIs.



 With the GUI 

You can configure the SSO through the GUI.
2018/06/18 16:53:00 INFO] Configuration file location: /fabric-ca-platform/admin/fabric-ca-client-config.yaml
2018/06/18 16:53:00 INFO] TLS Enabled
2018/06/18 16:53:00 INFO] ! ! ! ! ! ! ! TLS Enabled
Password: peerpw
<-- </ol> --><-- </section "id="section-ibp-v2-apis-config-register-component" "> --><-- <section "id="section-ibp-v2-apis-config-register-admin" "> --> Registering your organization administrator You also need to create an admin identity that you can use to operate your network. You use this identity to operate specific components, such as by installing a smart contract on your peer. You can also use this identity as an administrator of your organization and use it to create and edit channels.You need to register this new identity with your CA, and use it to generate an MSP folder. You can make this identity an organization administrator by adding its signCert to your organization MSP. You also need to add the signCert to your configuration file so that it can be made the admin cert of the ordering node or peer during deployment. You need to create only one admin identity for your organization. As a result, you need to complete these steps only once. You can use the signCert that you generated to deploy many peers or ordering nodes.Ensure that your $FABRIC_CA_CLIENT_HOME is set to the path to the MSP of your CA Admin. echo $FABRIC_CA_CLIENT_HOME
$HOME/fabric-ca-client/ca-admin
Identity and access management (IAM) on IBM Cloud 

Identity and access management (IAM) enables you to securely authenticate users for platform services and control access to resources consistently across the IBM Cloud platform. For example, with only a single login to IBM Cloud with your IBMid, you have access to any of your service consoles and their applications without having to log in to each of them separately.



 Features of IBM Cloud IAM 

The following IAM features are implemented for the Db2 Warehouse on Cloud managed service with two types of supported identities:



 IBMid 

Users with an IBMid must be added to each database service instance by the database administrator through the console or REST API before these users can connect to the particular database service instance. Like for a non-IBMid user, a user ID for the database service instance must be entered at the same time that the IBMid user is added. This user ID needs to be unique within the database service instance. This user ID is also the authorization (AUTH) ID within the database. The database administrator can grant and revoke permissions based on the AUTH ID.





 Service IDs 

A service ID identifies a service or application similar to how a user ID identifies a user. The service IDs are IDs that can be used by applications to authenticate with an IBM Cloud service. A service ID represents a separate entity from the owning IBMid. Therefore, different authorities and permissions can be granted specific to the service ID within the database. Service IDs do not have passwords. An API key must be created for each service ID for the service ID to connect to the database service instance. For more information about service IDs, see: [Introducing IBM Cloud IAM Service IDs and API Keys](https://www.ibm.com/blogs/bluemix/2017/10/introducing-ibm-cloud-iam-service-ids-api-keys/) and [Increase Information Security for Db2 on IBM Cloud](https://www.ibm.com/cloud/blog/increase-information-security-for-db2-on-ibm-cloud).







 Roles and actions 

Every user that accesses the Db2 Warehouse on Cloud service in your account must be assigned an access policy with an IAM role.
You can then find the name and keys of this identity in a new tile in your [wallet tab](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-wallet)



You can also use the Fabric CA client or Fabric SDKs to enroll the identities you create in the console. The console provides you with all of the information that need to compete these steps. Ensure that you have saved the Enroll ID and Enroll secret that you specified during registration.





 Using your TLS CA 

The communication within your network is secured by TLS certificates. TLS encrypts the communication between your nodes and between your nodes and your applications. Using TLS prevents attackers from disrupting the communication between your nodes or reading the transactions that are submitted from your applications. The keys and certificates that are used for TLS are different than the certificates used to sign and validate your transactions and are issued by a separate Certificate Authority.

Each CA created by the IBM Blockchain Platform console contains a root CA and a TLS CA. Both of these CAs use the same database and share the list of registered users. As a result, each identity that is registered with your root CA is automatically registered with your TLS CA as well. The CA admin of your root CA is also the admin for your TLS CA.

You can use each identity in the Registered Users table to generate TLS certificates. Follow the same process as you used to [enroll an identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-enroll) by using your root CA. However, on the Enroll identity panel, select the TLS Certificate Authority from the Certificate Authorities drop-down list.

Each peer or orderer node that you deploy needs to generate a public TLS certificate. When you create peer or orderer nodes, you can use the same enroll ID and secret that you used to generate the peer or orderer identity as the TLS enroll ID and secret because the TLS CA uses the same user repository as the organization CA. The node then uses this identity to generate its TLS certificate during deployment.
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
],
"comparison": "exact"
}
}
}
2. Create your SAML configuration by replacing the values in the following example with the information from your provider. The values that are shown in the example are required, but you can choose to include more information as shown in the table.

"config": {
"authnContext": {
"class": [
"urn:oasis:names:tc:SAML:2.0:ac:classes:YourChosenClassValue",
"urn:oasis:names:tc:SAML:2.0:ac:classes:YourOtherChosenClassValue"
],
"comparison": "sampleComparisonValue"}
"entityID": "https://example.com/saml2/metadata/706634",
"signInUrl": "https://example.com/saml2/sso-redirect/706634",
"certificates": [
"primary-certificate-example-pem-format"
"secondary-certificate-example-pem-format"
],
"displayName": "my saml example",
"signRequest": true ,
"encryptResponse": true
}



Table 3. SAML configuration variables

 Variable Description 

 signInUrl The URL that the user is redirected to for authentication. It is hosted by your SAML identity provider. 
 entityID The globally unique name for a SAML identity provider. 
 displayName The name that you assign to your SAML configuration. 
 primary-certificate-example-pem-format The certificate that is issued by your SAML identity provider. It is used for signing and validating SAML assertions. All providers are different, but you might be able to download the signing certificate from your identity provider. The certificate must be in .pem format.
Managing user access 

Use [IBM Cloud® Identity and Access Management](https://cloud.ibm.com/docs/account?topic=account-iamoverview) to grant permissions to Schematics Workspaces and actions.

As the IBM Cloud® account owner, you need to ensure that you control user access to Schematics Workspaces and the Actions in your account. IBM Cloud Schematics integrate with IBM Cloud® Identity and Access Management (IAM) to securely authenticate users for platform services and control access to the resources. IAM uses the concept of resource groups, access groups, roles, and access policies to manage the access to IBM Cloud® resources. For more information about how IAM works and how you can use resource groups, access groups, and access policies to organize Schematics access for a team, see [What is IBM Cloud® Identity and Access Management?](https://cloud.ibm.com/docs/account?topic=account-iamoverview)



 Overview of Schematics service access roles and required permissions 

Grant access to IBM Cloud Schematics by assigning IBM Cloud® Identity and Access Management (IAM) service access roles to your users.

Who must grant access to IBM Cloud Schematics?

As the account owner or an authorized account administrator, you can assign IAM service access roles to your users. The IAM service access roles determine the actions that you can perform on an IBM Cloud Schematics resource, such as a workspace or an action. To avoid assigning access policies to individual users, consider creating [IAM access groups](https://cloud.ibm.com/docs/account?topic=account-groups).

Is access to IBM Cloud Schematics sufficient to manage IBM Cloud resources?

No. If you are assigned an IBM Cloud Schematics service access role, you can view, create, update, or delete workspaces and actions in IBM Cloud Schematics. However, to manage other IBM Cloud resources with Schematics, you must be assigned the IAM platform or service access role for the individual IBM Cloud resource that you want to work with.
App ID returns access and identity tokens for the validated user.
8. The user is then granted access to your application.





 Video tutorial 

Check out the following video to see how you can use App ID to protect a simple Node.js web application. All the information that is covered in the video can also be found in written form on this page.

Don't have an app that you can try out the flow with? No problem! App ID provides a [simple Node.js web sample app](https://github.com/ibm-cloud-security/appid-video-tutorials/tree/master/02a-simple-node-web-app).





 Before you begin 

Before you get started with App ID in your Node.js web applications, you must have the following prerequisites.



* An instance of [the App ID service](https://cloud.ibm.com/catalog/services/app-id)
* [NPM version 4+](https://docs.npmjs.com/getting-started)
* [Node version 6+](https://nodejs.org/en/download/)



This SDK uses the log4js package for logging. By default, the logging level is set to info. To create your own logging configuration, add a log4js.json file and set the process.env.LOG4JS_CONFIG environment variable to your JSON file.





 Step 1: Register your redirect URI 

A redirect URI is the callback endpoint of your app. During the sign-in flow, App ID validates the URIs before clients are allowed to participate in the authorization workflow, which helps to prevent phishing attacks and grant code leakage. By registering your URI, you're telling App ID that the URI is trusted and it's OK to redirect your users.



1. Click Manage Authentications > Authentication Settings.
2. In the Add web redirect URI field, type the URI.