vania-janet/multiturn-rag-retrieval-data huggingface dataset:
-H "authorization: Bearer eyJraWQiOiIyMDE3MTEyOSIsImFsZ...."
2. Get the role ID.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/roles" -H "accept: application/json" -H "authorization: Bearer <token>"
3. Make a request to the /roles endpoint that contains a JSON object of the roles that you want to assign. This request replaces current roles with the provided role IDs. Be sure that you're assigning the correct roles.

curl -X PUT "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/applications/<clientID>/roles"
-H "accept: application/json"
-H "Content-Type: application/json"
-d "{ "roles": { "ids": [ "<roleIDs>" ] }}"
-H "authorization: Bearer <token>"



To remove a role from a user, make the PUT request again, but remove the role ID.





 Controlling access at run time 

When a user or application attempts to access one of your protected resources, tokens are created and returned by App ID. Any scopes that a user or application is assigned are returned in the access token. You can use the access token to make decisions at run time. Depending on the strategy that you're using to protect your applications, how you verify that scopes can differ.



 When using web app strategy 

You can use [web app strategy](https://cloud.ibm.com/docs/appid?topic=appid-key-conceptsterm-web-strategy) to check whether a request contains any scopes by using the hasScope method. When a user with an assigned role signs in, they are granted access by an App ID token that contains all the scopes that are defined in the role. For example, if you're working with the Node.js SDK, your code snippet would look similar to the following:
Review [roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) to learn how IBM Cloud IAM roles map to Hyper Protect Crypto Services actions.



 Granting access to key rings with the console 

To assign access to a key ring with the console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select a table row, and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for that user.
3. From the options menu, click Assign access.
4. Click Access policy.
5. Under Service, select Hyper Protect Crypto Services and click Next.
6. Under Resources, select Specific resources.
7. Select the Service Instance ID attribute type and enter the [instance ID that is retrieved](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID).
8. Click Add a condition, select the Key Ring ID attribute to enter the ID associated with the key ring, and click Next.
9. Under Roles and actions, choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessroles) to assign access for the user and click Next.
10. (Optional) Under Conditions (optional), click Review to check the access policy.
11. After confirmation, click Add > Assign.
* If a user has a policy granting the Reader role on a service instance and the Writer role on a single bucket, both policies are enforced and the more permissive Writer role will take precedence for the individual bucket.



If it is necessary to restrict access to a single bucket (or set of buckets), ensure that the user or Service ID doesn't have any other instance level policies by using either the console or CLI.



 Create a new policy for a user 

To create a new bucket-level policy:



1. Navigate to the Access IAM console from the Manage menu.
2. Select Users from the left navigation menu.
3. Select a user.
4. Select the Access Policies tab to view the user's existing policies, assign a new policy, or edit an existing policy.
5. Click Assign access to create a new policy.
6. Choose Assign access to resources.
7. First, select Cloud Object Storage from the services menu.
8. Then, select the appropriate service instance. Enter bucket in the Resource type field and the bucket name in the Resource IDfield.
9. Select the wanted service access role. Selecting the lozenge with the number of actions show the actions available to the role, asexemplified for "Content Reader" in Figure 1.
10. Click Assign



Zoom

![Role_information](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/console-iam-changes-role-cos.png)

Figure 1. Example actions per Content Reader role

Note that leaving the Resource Type or Resource fields blank will create an instance-level policy.





 Create a new policy for a user 

From a terminal run the following command:
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keys).







 Rotating the ingestion key by using the API 

If the ingestion key is compromised or you have a policy that requies renewal of a key after a number of days, you can generate a new key and delete the old one.

To rotate a key, complete the following steps:



1. Get the details of the key that you want to rotate.

You can list all ingestion keys to obtain the ID of the key that you want to rotate. For more information, see [Listing all ingestion keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ingestion_keyingestion_key_api_list).

If you know the Key ID, skip to the next step.
2. Create a new key. For more information, see [Creating an ingestion key](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ingestion_keyingestion_key_api_create).
3. Delete the old key. Make sure you use the ID of the key that you identified previously. For more information, see [Deleting a key](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ingestion_keyingestion_key_api_delete).
4. After you rotate the ingestion key, you must update the ingestion key for any sources that you have configured to forward logs to this Activity Tracker instance.

For example, if you have configured streaming to an Activity Tracker instance, and you rotate the service key of the destinaltion Activity Tracker instance, you need to reconfigure streaming to continue streaming data.
"source": "attributes",
"sourceClaim": "food-preference"
}
]
}'
Show more



Table 1. Token configuration variables

 Variable Description 

 tenantID A tenant ID is how your instance of App ID is identified in the request. You can find your ID in the Service credentials tab of the dashboard. If you don't have a set, you can follow the steps in the GUI to create credentials. 
 source For both accessTokenClaim and idTokenClaims set the source to attribute. 
 sourceClaim The specific attribute that you want to map to your token. In this case, food-preference. 
 expires_in This value applies to each token type and must be set in each request. If you previously set the value in the GUI, and then run this request, then the values in the request override the previously set values. Be sure to set the expiration to the correct value for your configuration. 



Successful response output:

{
"access": {
"expires_in": 3601
},
"refresh": {
"enabled": false,
"expires_in": 2592001
},
"anonymousAccess": {
"expires_in": 2592001
},
"accessTokenClaims": [
{
"source": "attributes",
"sourceClaim": "food-preference"
}
]
}







 Step 4: Viewing the access token 

Optionally, you can verify that step 4 was successful by viewing an access token.



1. For testing purposes, create a Cloud Directory user by using the App ID GUI.



1. In the Users tab, click Add User. A form displays.
2. Enter a first and surname, an email, and password.
3. Click Save.



2. Encode your client ID and secret.



1. In the Service Credentials tab of the App ID GUI, copy your client ID and Secret.
2.
A typical scenario is for an [enterprise project to deploy an architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-project).







 Establish trust 

As outlined in the overview, there are different options available on how to establish trust, how an entity can assume the identity of a trusted profile.



 Federated identity 

[Users that utilize a corporate or enterprise single sign-on ID to log in to IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-federated_id) are called federated identities. The single sign-on (SSO) provider acts as identity provider (IdP). A great advantage of utilizing federated identities is that [users do not need new credentials to use with IBM Cloud and can continue to use their companies' IdP for authentication](https://cloud.ibm.com/docs/account?topic=account-account-getting-startedsignup-federated).

Federated identities can be used with trusted profiles and [in dynamic rules of IAM access groups](https://cloud.ibm.com/docs/account?topic=account-rules).





 Compute resource 

Instead of through user properties supplied by an identity provider, in this case, trust is established through [attributes of compute resources](https://cloud.ibm.com/docs/account?topic=account-iam-condition-propertiescr-attribute-names). You can configure to only trust an app running in, e.g., a specific namespace and pod in a Kubernetes cluster, or a virtual server instance in a VPC with a specific combination of values for resource group, region, subnet, and zone. That trusted app can assume the identity of the trusted profile and perform tasks with the assigned privileges.

The benefit of utilizing a trusted profile based on a compute resource is that this solution avoids using an API key. Thus, there are no requirements and challenges on how to create, store and protect any shared API key, how to assign and manage privileges. The app which assumes the identity of a trusted profile simply fetches a special compute resource token, then turns it into a regular IAM access token for the trusted profile.
MA-4 - Nonlocal Maintenance 



  Control requirements 

The organization:

MA-4 (a)
:   Approves and monitors nonlocal maintenance and diagnostic activities;

MA-4 (b)
:   Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system;

MA-4 (c)
:   Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;

MA-4 (d)
:   Maintains records for nonlocal maintenance and diagnostic activities; and

MA-4 (e)
:   Terminates session and network connections when nonlocal maintenance is completed.





  NIST supplemental guidance 

Nonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. Local maintenance and diagnostic activities are those activities carried out by individuals physically present at the information system or information system component and not communicating across a network connection. Authentication techniques used in the establishment of nonlocal maintenance and diagnostic sessions reflect the network access requirements in IA-2. Typically, strong authentication requires authenticators that are resistant to replay attacks and employ multifactor authentication. Strong authenticators include, for example, PKI where certificates are stored on a token protected by a password, passphrase, or biometric. Enforcing requirements in MA-4 is accomplished in part by other controls.
bootstrap_vsi_profile The virtual server instance profile type name used to create the bootstrap node. For more information, see [Instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). No bx2-8x32 
 compute_cluster_filesystem_mountpoint Compute cluster (accessingCluster) file system mount point. The accessingCluster is the cluster that accesses the owningCluster. For more information, see [Mounting a remote GPFS file system](https://www.ibm.com/docs/en/spectrum-scale/5.1.4?topic=system-mounting-remote-gpfs-file). No /gpfs/fs1 
 compute_cluster_gui_password Password that is used for logging in to the compute cluster through the GUI. The password should contain a minimum of eight characters. For a strong password, use a combination of uppercase and lowercase letters, one number, and a special character. Make sure that the password doesn't contain the username. Yes None 
 compute_cluster_gui_username GUI username to perform system management and monitoring tasks on the compute cluster. The username should be at least four characters (any combination of lowercase and uppercase letters). Yes None 
 compute_cluster_key_pair Name of the SSH key configured in your IBM Cloud account that is used to establish a connection to the compute cluster nodes. Make sure that the SSH key is present in the same resource group and region where the cluster is provisioned. The solution supports only one SSH key that can be attached to compute nodes. If you do not have an SSH key in your IBM Cloud account, create one by using the [SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) instructions. Yes None 
 compute_vsi_profile The virtual server instance profile type name used to create the compute cluster nodes.
storage_bare_metal_server_profile Specify the bare metal server profile type name to be used to create the bare metal storage nodes. For more information, see [Bare metal server profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-bare-metal-servers-profile). No cx2d-metal-96x192 
 storage_cluster_filesystem_mountpoint Spectrum Scale storage cluster (owningCluster) file system mount point. The owningCluster is the cluster that owns and serves the file system to be mounted. For more information, see [Mounting a remote GPFS file system](https://www.ibm.com/docs/en/spectrum-scale/5.1.4?topic=system-mounting-remote-gpfs-file). No /gpfs/fs1 
 storage_cluster_gui_password Password that is used for logging in to the storage cluster through the GUI. The password should contain a minimum of 8 characters. For a strong password, use a combination of uppercase and lowercase letters, one number, and a special character. Make sure that the password doesn't contain the username. Yes None 
 storage_cluster_gui_username GUI username to perform system management and monitoring tasks on the storage cluster. The username should be at least four characters (any combination of lowercase and uppercase letters). Yes None 
 storage_cluster_key_pair Name of the SSH key configured in your IBM Cloud account that is used to establish a connection to the storage cluster nodes. Make sure that the SSH key is present in the same resource group and region where the cluster is provisioned. The solution supports only one SSH key that can be attached to the storage nodes. If you do not have an SSH key in your IBM Cloud account, create one by using the [SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys) instructions. Yes None 
 storage_type Select the Spectrum Scale file system deployment method.
Why am I receiving an “VPN username/password incorrect” error when attempting to log in to the SSL VPN? 

User is unable to connect due to an incorrect username, password, or both.

 What’s happening 

User is receiving an error that their username or password is incorrect and are prompted to set a new password.

 Why it’s happening 

There are a few possible causes for this issue:



1. The permissions might have not been set for a new use to be allowed to SSL VPN.
2. Password might have not been set correctly.
3. Password might include too many special characters that our system cannot properly use. ## This requires review as we don't have documentation on what characters can cause issues.
4. Our authentication servers might need a synch to occur to correctly authenticate the user.



 How to fix it 

To resolve this issue, follow these steps:



1. Ensure that SSL VPN access is enabled for your user. For more information, see [Activating or deactivating SSL VPN access for a user](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-activate-or-deacivate-ssl-vpn-access-for-a-user).
2. Update your SSL VPN password. For more information, see [Updating a user's SSL VPN password](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-update-users-ssl-vpn-password).
3. Ensure that you are using the latest version of MotionPro. For more information, see [Prerequisities](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-standalone-vpn-clientsstandalone-prereqs).
4. Toggle your SSL VPN access from on to off, then off to on.
5. Try three different VPN endpoints in different regions.
For more information, see the [CLI command reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-referenceinstance-initialization-values).

The following command shows example usage for the instance-initialization-values command where 0xx4e27x-33xx-4e7x-a08b-bexx2ac3xx0c is the instance ID and /.ssh/id_rsa is the location of the user's private key file:

ibmcloud is instance-initialization-values 0xx4e27x-33xx-4e7x-a08b-bexx2ac3xx0c --private-key @/.ssh/id_rsa

You can also use the API to get the encrypted password, which returns the decoded and decrypted password. For more information, see [Retrieve configuration that is used to initialize the instance API](https://cloud.ibm.com/apidocs/vpcretrieve-configuration-used-to-initialize-the-inst).
3. After you obtain your instance password, you can optionally associate a floating IP address to your Windows instance so you can connect to it from an internet location. Run the following command to associate a floating IP address to your instance, where NIC is the ID or Name of the target network interface (for example, eth0).

ibmcloud is floating-ip-reserve <FLOATING_IP_NAME> --nic <NIC>
4. You now have what you need to connect to your Windows instance: a decrypted password and a floating IP address. Use your preferred Remote Desktop client to connect to your instance. To connect to your instance, provide the floating IP address and the decrypted password. The username is Administrator by default. If you're connecting from a client that is running the Windows Administrator account, use .administrator as the user ID to log on to RDP.







 Next steps
The <break> element inserts a pause into the spoken text. It has the following optional attributes:



* strength specifies the length of the pause in terms of varying strength values:



* none suppresses a break that might otherwise be produced during processing.
* x-weak, weak, medium, strong, or x-strong insert increasingly stronger breaks.



* time specifies the length of the pause in terms of seconds or milliseconds. Valid value formats are {integer}s for seconds or {integer}ms for milliseconds.



Break size <break strength="none"/> no pause
Break size <break strength="x-weak"/> x-weak pause
Break size <break strength="weak"/> weak pause
Break size <break strength="medium"/> medium pause
Break size <break strength="strong"/> strong pause
Break size <break strength="x-strong"/> x-strong pause
Break size <break time="1s"/> one-second pause
Break size <break time="1500ms"/> 1500-millisecond pause





 The <desc> element 

The <desc> element can occur only within an <audio> element. Because the <audio> element is not supported, neither is the <desc> element.





 The <emphasis> element 

The <emphasis> element is supported for use only with the expressive neural voices.

With the expressive neural voices, you can use the <emphasis> element to emphasize or de-emphasize one or more words of the input text. The element supports an optional level attribute that accepts one of the following values:



* none - Prevents the service from emphasizing text that might otherwise be emphasized.
* moderate - Provides a noticeable amount of emphasis to the text. This level is the default if you omit the level attribute.
* strong - Provides a more significant amount of emphasis to the text than the moderate level provides.
* reduced - De-emphasizes the text by tending to reduce its significance in the audio. This level is the opposite of stressing the text.



The following example applies the moderate level to the word give:
You now have what you need to connect to your Windows instance: a decrypted password and a floating IP address. Use your preferred Remote Desktop client to connect to your instance. To connect to your instance, provide the floating IP address and the decrypted password. The username is Administrator by default. If you're connecting from a client that is running the Windows Administrator account, use .administrator as the user ID to log on to RDP.







 Next steps 

After you connect to your instance, you can [manage your instances](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-virtual-server-instances).
Why is my IBMid or email not recognized when I try to log in to the console? 

To successfully log in to the IBM Cloud® console, make sure that you have IBMid authentication for each account.

  What’s happening 

When you log in to the console, the following message is displayed:

> We didn't recognize this IBMid or email.

  Why it’s happening 

You tried to log in to the console, but didn't use a valid IBMid. For example, you didn't enter a fully qualified email address for the IBMid, or you tried to use a previous user name and password.

  How to fix it 

You must have a valid IBMid and password to log in to IBM Cloud. Enter a fully qualified email address for the IBMid.
* For language modeling, IBM leverages a neural network-based language model to generate training text ([Suzuki and others, 2019](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-referencessuzuki2019)).
* For acoustic modeling, IBM uses a fairly compact model to accommodate the resource limitations of the cloud. To train this compact model, IBM uses "teacher-student training / knowledge distillation." Large and strong neural networks such as Long Short-Term Memory (LSTM), VGG, and the Residual Network (ResNet) are first trained. The output of these networks is then used as teacher signals to train a compact model for actual deployment ([Fukuda and others, 2017](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-referencesfukuda2017)).



To further push the envelope, IBM also focuses on end-to-end modeling. For example, it has established a strong modeling pipeline for direct acoustic-to-word models ([Audhkhasi and others, 2017](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-referencesaudhkhasi2017), and [Audhkhasi and others, 2018](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-referencesaudhkhasi2018)) that it is now further improving ([Saon and others, 2019](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-referencessaon2019)). It is also making efforts to create compact end-to-end models for future deployment on the cloud ([Kurata and Audhkhasi, 2019](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-referenceskurata2019)).