vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Multifactor authentication (MFA) 

With Cloud Directory for IBM Cloud® App ID, you can require multiple authentication factors during your application sign-in flow. A second authentication factor increases the security of your application by not only confirming that a user possesses the knowledge of their credentials but also has access to their registered email or phone number. Extending the MFA flow, you can configure pre-MFA and post-MFA extensions to make custom decisions at run time about which users must complete the second factor or provide you analytical information about your sign-in flow.

App ID MFA is supported as part of the OAuth 2.0 authorization code flow for Cloud Directory users through the Login Widget. If you're using enterprise sign-in with SAML 2.0 or social login, you can enable MFA through that identity provider.

Check out the following diagram to see how the MFA flow works for email or SMS.

Zoom

![MFA flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/mfa.png)

Figure 1. Cloud Directory MFA flow



1. When a user successfully signs in to your application, they complete the first authentication factor. Then, based on your MFA configuration, the user is sent either an email or SMS that contains a 6-digit code.

When MFA is enabled, the App ID Login Widget requires a second form of verification every time a user attempts to sign in, unless an [extension is configured](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfacd-mfa-extensions).
2. A user is expected to look in their phone or email to obtain the code and then enter it into the provided screen.
3. If the code they input matches the code that they were sent, the user is redirected back to your application and is signed in. If they enter the code incorrectly, the second authentication factor fails and users are not able to access your resources.



If email verification is not configured, App ID validates the MFA channel in the background.
[Role_information](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/console-iam-changes-role-cos.png)

Figure 1. Example actions per Content Reader role

Note that leaving the Resource Type or Resource fields blank will create an instance-level policy.





 Create a new policy for a user 

From a terminal run the following command:

ibmcloud iam user-policy-create <user-name> --roles <role> --service-name cloud-object-storage --service-instance <resource-instance-id> --resource-type bucket --resource <bucket-name>

To list existing policies:

ibmcloud iam user-policies <user-name>

To edit an existing policy:

ibmcloud iam user-policy-update <user-name> <policy-id> --roles <role> --service-name cloud-object-storage --service-instance <resource-instance-id> --resource-type bucket --resource <bucket-name>









 Granting access to a Service ID 

If you need to grant access to a bucket for an application or other non-human entity, use a Service ID. The Service ID can be created specifically for this purpose, or can be an existing Service ID already in use.



 Create a new policy for a user 



1. Navigate to the Access (IAM) console from the Manage menu.
2. Select Service IDs from the left navigation menu.
3. Select a Service ID to view any existing policies, and assign a new policy or edit an existing policy.
4. Select the service instance, service ID, and desired role.
5. Enter bucket in the Resource Type field and the bucket name in the Resource field.
6. Click Submit



Note that leaving the Resource Type or Resource fields blank will create an instance-level policy.





 Create a new policy for a Service ID 

From a terminal run the following command:
Update your spam filters to allow emails from this address.
* Investigate whether corporate spam filters that are outside of the user's control are blocking the email. Ask the user to log in to the Git Repos and Issue Tracking user interface and send you their user ID. You can add the user to the GitLab project by using their user ID.







 When I use Terraform to update the configuration of an existing Git tool integration, why does the configuration fail? 

The Git tool integration resource specifies a type of clone, fork, or new, and it specifies an existing target repo.

 What’s happening 

When you use Terraform to update a Git tool integration, the configuration fails with the The nonempty repository _REPO-URL_ already exists. Either delete the repository or change the Repository Type to 'Existing' error message, where REPO-URL is the URL of the target repo.

 Why it’s happening 

This error is often caused by the following actions:



* Your Git tool integration Terraform resource specifies a type of clone, fork, or new. You changed the repo_url within the initialization block of the resource to the URL of a repo that exists.
* Your Git tool integration Terraform resource specifies a type of clone, fork, or new. You did not change the repo_url, but you changed one or more other arguments within the initialization block of the resource. In this situation, the repo exists because it was created when the Git tool integration resource was previously applied by Terraform.



The clone, fork, and new types instruct the Git tool integration to create the target repo (repo_url) on the premise that this repo does not exist. If the tool integration finds the target repo, it fails by design.

 How to fix it 

Change the type from clone, fork, or new to clone_if_not_exists, fork_if_not_exists, or new_if_not_exists. These types instruct the Git tool integration to create the target repo if it does not exist, or to use the target repo as-is if it does exist.
Assigning separate user access to dedicated hosts and dedicated groups 

This tutorial demonstrates how to use resource groups and access groups to give users access to resources on dedicated hosts without allowing them to see or interact with these hosts directly.

The fictional user profile Employee Example is used to show how to give a user access to resources in a dedicated host group without giving them the ability to interact directly with the dedicated hosts in the group. For example, users can provision an instance on the dedicated host group, and the instance is automatically assigned to a dedicated host within the group. However, in this example of resource group configuration, users don't have authority to create or delete a dedicated host.



 Objectives 



* Create two separate resource groups, Admin resources and Users resources.
* Create a dedicated host in the Admin resources resource group.
* Create the dedicated host's associated dedicated host group in the Users resources resource group.
* Create an access group to assign the Operator role to the resource group, Users resources.
* Invite your user, Employee Example, to the access group so that they can provision instances to the dedicated host group.
* Restrict Employee Example from interacting directly with the dedicated hosts by excluding Employee Example from access to the Admin resources resource group.







 Before you begin 

This tutorial requires the following prerequisites.



* An IBM Cloud billable account.
* Active IBM Cloud accounts for users who are to receive access.
* An existing SSH Key







 Step 1: Create resource groups 

You can use resource groups to organize dedicated hosts and dedicated host groups. The first step in our example is to create two separate resource groups. The first resource group is for the dedicated host. The second resource group is for the dedicated host group.



 Creating a dedicated host resource group 

Complete the following steps to create a resource group for the dedicated host.



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/login).
2. Click Manage > Account.

Zoom

!
Users create Service IDs and bind them to scopes, like a IBM Cloud Platform account, a CloudFoundry organization, or a CloudFoundry space. It is best to bind Service IDs to a IBM Cloud Platform account. This binding is done to give the Service ID a container to live in. This container also defines who can update and delete the Service ID and who can create, update, read, and delete API Keys that are associated to that Service ID. It is important to note that a Service ID is NOT related to a user.





 Key rotation 

API keys can be regularly rotated to prevent any security breaches caused by leaked keys.







 Access Management 

IAM Access Control provides a common way to assign user roles for IBM Cloud resources and controls the actions that the users can take on those resources. You can view and manage users across the account or organization, depending on the access options that you have been given. For example, account owners are automatically assigned the account Administrator role for Identity and Access Managemement, which enables them to assign and manage service policies for all members of their account.



 Users, roles, resources, and policies 

IAM Access Control enables the assignment of policies per service or service instance to allow levels of access for managing resources and users within the assigned context. A policy grants a user a role or roles to a set of resources by using a combination of attributes to define the applicable set of resources. When you assign a policy to a user, you first specify the service then a role or roles to assign. Extra configuration options might be available depending on the service you select.

While roles are a collection of actions, the actions that are mapped to these roles are service specific. Each service determines this role to action mapping during the onboarding process and this mapping effects all users of the service. Roles and access policies are configured through the Policy Administration Point (PAP) and enforced through the Policy Enforcement Point (PEP) and Policy Decision Point (PDP).

See [Best practices for organizing users, teams, applications](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-users-teams-applications) to learn more.
For example, you might have a greeting action that collects basic information about the customer and stores the responses in session variables, which any action can then access.

A session variable that you create persists only during a single session. At the end of the session, the variable's value is cleared. How long a session lasts depends upon how your customers access your assistant, and how your assistant is configured.





 Creating a session variable 

To add a session variable that can be accessed by any action:



1. From the Actions page, click Variables > Created by you. The list shows all session variables that you created for your assistant.
2. Click New variable.

You can also create a new session variable from the step editor. For more information, see [Storing a value in a session variable](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-manage-infostore-session-variable).
3. In the Name field, type a name for the session variable.

As you add the name, an ID is generated for you. Any spaces in the name are replaced with underscores (_) in the ID.
4. Optional: Add a type to set the response type of the variable. (For more information about response types, see [Choosing a response type](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infochoosing-a-response-type).)

From this field, you can also select any of the saved responses that you created. For more information about saved responses, see [Saving and reusing customer responses](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infosaved-customer-responses).

In addition to the listed types, a variable can also be created as an array. To create an array variable, select Any as the type, and in the next step, define an initial value that uses the expression [] to represent an empty array.
5. Optional: Add an initial value to set the starting value for the variable at the beginning of each user session.
In this case, select UTC+1 so that the date and time range that you select next is enforced at the right time for that location.



1. Select the days of the week that you want the condition to grant access.



* (Optional) Set the All day toggle to No to specify a timeframe for the days that you select.



2. Click Create.
3. Click Review.
4. Click Add to add your policy configuration to your policy summary.
5. Click Assign.



For more information about time-based conditions for access policies, see [Conditions in access policies](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uipolicy-condition-properties).





 Creating a recurring time-based condition by using the CLI 

You can assign recurring access at a weekly cadence. You might want to give users access to account resources during only their working hours.

The following example shows you how to create a recurring time-based condition for a user. The policy assigns access during working hours Monday through Friday as an Editor for all Account Management Services.



1. Log in to IBM Cloud® CLI. If you have multiple accounts, you are prompted to select which account to use. If you do not specify a region with the -r flag, you must also select a region.

ibmcloud login

If your credentials are rejected, you might be using a federated ID. To log in with a federated ID, use the --sso flag. See [Logging in with a federated ID](https://cloud.ibm.com/docs/account?topic=account-federated_id) for more details.

If it's your first time using the IBM Cloud CLI, check out the [getting started tutorial](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
2.
* When you configure archiving, the Log Analysis instance and the IBM Cloud Object Storage (COS) instance must be provisioned in the same account.
* The credential that Log Analysis uses to write data into a COS bucket must have writer role.







 Monitor archiving 

To monitor archiving, you can use the following services:



* IBM Cloud Monitoring service:

IBM Cloud Object Storage is integrated with the Monitoring service. Monitoring provides a default template that you can customize to monitor the bucket that you configure to store data for long term.

For more information, see [Monitoring archiving by using IBM Cloud Monitoring](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-archiving-monitor).
* IBM Cloud Activity Tracker:

You can monitor archiving of a Log Analysis instance by monitoring the service ID that is used to write data into IBM Cloud Object Storage (COS).

For more information, see [Configuring an alert to monitor archiving](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-archiving-at-monitor).







 IAM permissions to configure archiving 

To configure archiving, you need the following permissions:



 IBM Log Analysis service 

The following table lists the minimum roles that a user must have to be able to launch the IBM Log Analysis web UI, and configure archiving through the UI or by using the API:



Table 1. IAM roles

 Role Permission granted 

 Platform role: Viewer Allows the user to view the list of service instances in the Observability dashboard. 
 Service role: Manager Allows the user to launch the web UI and configure archiving through the web UI or by using the API. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/log-analysis?topic=log-analysis-iam_view_logsiam_view_logs).





 IBM Cloud Object Storage service
[Component overview on the IBM Cloud](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/Log-Analysis-04-Windows.svg)

Figure 1. Component overview

In this tutorial, you will learn how to configure a Windows client system to forward logs to an IBM Log Analysis instance.



 Before you begin 

Before you begin, make sure you have an IBM Log Analysis instance configured.



 Make sure you have an ID with the proper permissions 

Use a user ID that is a member or an owner of an IBM Cloud account. To get an IBM Cloud user ID, go to: [Registration](https://cloud.ibm.com/login).

[Your IBMID must have assigned IAM policies for each of the following resources](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-work_iam). For example, to work in the US-south region and in the default resource group, you need the following permissions:



Table 1. List of IAM policies

 Resource Scope of the access policy Role Region Information 

 Resource group Default Resource group Viewer us-south This policy is required to allow the user to see service instances in the Default resource group. 
 IBM Log Analysis service Resource group Editor us-south This policy is required to allow the user to provision and administer the IBM Log Analysis service in the Default resource group. 







 Provision an IBM Log Analysis instance 

To provision a service instance of IBM Log Analysis through the IBM Cloud console, see [Provisioning an instance](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-provision).







 Install NXLog 

Follow these steps to install NXLog.

You will need to run as a Windows Administrator for all command prompt or PowerShell steps.



1. The [Chocolately package manager](https://chocolatey.org/) is used to install NXLog.
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a auditing instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keys).





 Rotating the service key by using the API 

If the service key is compromised or you have a policy that requies renewal of a key after a number of days, you can generate a new key and delete the old one.

To rotate a key, complete the following steps:



1. Get the details of the key that you want to rotate.

You can list all service keys to obtain the ID of the key that you want to rotate. For more information, see [Listing all service keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keysservice_keys_api_list).

If you know the Key ID, skip to the next step.
2. Create a new key. For more information, see [Creating an service key](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keysservice_keys_api_create).
3. Delete the old key. Make sure you use the ID of the key that you identified previously. For more information, see [Deleting a key](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keysservice_keys_api_delete).
4. After you rotate the service key, you must update any operation processes where the service key is used with the new value.
Setting Azure AD authentication 

Set your authentication method to AzureAD with the [REGISTER EXTERNAL AUTHENTICATION SYSTEM SQL statement](https://www.ibm.com/docs/en/netezza?topic=reference-register-external-authentication).

Two factor authentication is not supported with an external authentication system.



 Syntax 

REGISTER EXTERNAL AUTHENTICATION SYSTEM 'AzureAD' with clientid 'AZURE CLIENT ID' tenantid 'AZURE TENANT ID'



* For clientid, see [How to: Get an Azure Application ID](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/msipcthin2/application-id?).
* For tenantid, see [How to find your Azure Active Directory tenant ID](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-to-find-tenant).







 Setting Azure AD authentication with the web console 



1. [Log in to the web console](https://cloud.ibm.com/docs/netezza?topic=netezza-getstarted-console) as an admin user.
2. Go to the Query editor.
3. Register an Azure AD external authentication system. Specify the clientid and tenantid parameters.

REGISTER EXTERNAL AUTHENTICATION SYSTEM 'AzureAD' with clientid 'AZURE CLIENT ID' tenantid 'AZURE TENANT ID';
SET VARIABLE
4. Create a user or users with the external authentication method set to AzureAD as desribed in [Creating users](https://cloud.ibm.com/docs/netezza?topic=netezza-users-groupscreate-users).
5. Verify whether the user was created successfully.



1. Go to Users and groups > Users.
2. Locate the user.
3. Check the Authentication type section for the user.









 Setting Azure AD authentication with the command-line 



1. [Connect to Netezza Performance Server](https://cloud.ibm.com/docs/netezza?topic=netezza-connecting-overview) as an admin user.
<br>Note: Database user account passwords expire every 90 days. Passwords can be reset through the Access Management Tool. <br>For details on how to request a Database User Account, see [How to Request a Database User Account](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-request-ccc-access) 
 Reset Database Account Password Issues a request to reset the password for the selected Database User or Service Account. The new password will be made available in the access record when the request is completed. Additionally the Database SSL certificate information will be refreshed to ensure it is current with that is on the system. <br>For details on how to Reset a Database Account Password, see [How to Reset a Database Account Password](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-reset-database-password) 
 MAS Object Storage File Access Not yet available. <br>For details on how to request MAS Object Storage File access, see [How to Request MAS Object Storage File Access](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-request-cos-file-access) 
 MAS Object Storage Log Access Not yet available. <br>For details on how to request MAS Object Storage Log access, see [How to Request MAS Object Storage Log Access](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-ssphow-to-request-ccc-access) 





 How to Request CCC Access 

Follow the steps below to request access to the Client Communications Center Dashboard for your organization. For more information on the Client Communications Center, navigate to the [Client Communications Center](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-client-communications-center) page.



1. Sign into the Self-Service Portal with your IBMid:

[https://devops.maximo.com](https://devops.maximo.com)
Granting access to all keys in an instance 

You can grant access to keys within a Hyper Protect Crypto Services service instance by using the IBM Cloud console.

Review [roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) to learn how IBM Cloud IAM roles map to Hyper Protect Crypto Services actions.

To assign access:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select the user, and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for that user.
3. From the options menu, click Assign access.
4. Click Access policy.
5. Under Service, select Hyper Protect Crypto Services and click Next.
6. Under Resources, select Specific resources.
7. Select the Service Instance ID attribute type, enter the [instance ID that is retrieved](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID) and click Next.
8. Under Roles and actions, choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessroles) to assign access for the user and click Next.
9. (Optional) Under Conditions (optional), click Review to check the access policy.
10. After confirmation, click Add > Assign.







 Granting access to a single key in an instance 

You can also assign access to a single key in a Hyper Protect Crypto Services service instance.



 Step 1. Retrieve the key ID 

Retrieve the unique identifier that is associated with the key that you want to grant someone access to.