vania-janet/multiturn-rag-retrieval-data huggingface dataset:
2. Your IBM Blockchain Platform service instance is visible under the Services twistie. Locate and click the IBM Blockchain Platform service instance that you deployed.
3. On the Welcome Back panel, click Refresh cluster. The operation could take a few minutes while it re-establishes connectivity to your Kubernetes cluster and refreshes the management console.
4. Click Launch IBM Blockchain Platform again.



Your console opens in your browser.





 Adding and removing users from the console 

Every user that accesses the console must be assigned an access policy with an IBM Cloud® Identity and Access Management (IAM) user role defined. The policy determines what actions the user can perform within the console. The IBM® Blockchain Platform console is provisioned with the email address of the IBM Cloud owner as the console administrator. By default, this IBM Cloud user is given the Manager role for the IBM Blockchain Platform service in IAM. The console administrator can then grant other users access to the console by using the IAM UI. For more information about IAM，see [What is IAM](https://cloud.ibm.com/docs/account?topic=account-iamoverview).

For instructions on how to add new user see [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv) with the following additional details:



* Under Assign users additional access, click IAM services.
* Under What type of access to you want to assign?, type Blockchain Platform.
* Under Service Instance Name, select the service instance where you want to add the user.
* Under Service access you can click each pill to see the specific actions associated to each role, similar to the table in the next section.





 Role to permissions mapping table 



Table 1. Role to permissions mapping table

 Role Permissions 

 Manager As a Manager, you have permissions beyond the Writer role.
When the web app strategy detects unauthorized attempts to access a protected resource, it automatically redirects a user's browser to the authentication page, which can be provided by App ID. After successful authentication, the user is returned to the web app's callback URL. The web app strategy obtains access and identity tokens and stores them in an HTTP session under WebAppStrategy.AUTH_CONTEXT. It is up to the user to decide whether to store access and identity tokens in the app database.





 Redirect URIs 

App ID uses a list of fully qualified, approved URIs to redirect your users after an interaction with your app. For example, if the user successfully signs in, App ID redirects the user to the home page of your app or to another page that you specify. The format of your URI might change depending on your application. Check out [Adding redirect URIs](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpadd-redirect-uri) for more information.





 JSON Web Key Set (JWKS) 

A JWKS represents a set of cryptographic keys. App ID uses a JWKS to verify the authenticity of the tokens that are generated by the service. By using the key ID to verify the signature, we can ensure that the token was issued by a trusted source - App ID. We can also ensure that the information within the token was never changed.
vCenter Single Sign On 

VMware vCenter Single Sign-On (SSO) is an authentication broker and security token exchange infrastructure, which allows vSphere components to communicate with each other through a secure token mechanism and uses the following services.



* Security Token Service (STS)
* SSL for secure traffic
* Authentication of users by using an identity source such as Active Directory™ or OpenLDAP



Review the following vSphere SSO flow.



1. A user logs in to the vSphere Client with a username and password to access vCenter or a vCenter service.
2. The vSphere Client passes the login information to the SSO service, which checks the SAML token of the vSphere Client. If the vSphere Client has a valid token, SSO checks:



* If the user ID is @vsphere.local, then it checks the user against the local SSO domain.
* If the user ID is @DOMAIN, then SSO uses the identity source to check that domain.



3. If authentication is successful SSO returns a token that represents the user to the vSphere Client.
4. The vSphere Client passes the token to vCenter.
5. vCenter checks with SSO that the token is valid and is not expired.
6. The user can view and modify any objects that the user's role has privileges for.



The vSphere SSO domain is used as the initial authentication mechanism it is also serves to connect an instance or multiple linked instances to the AD servers in the IBM Cloud® for VMware Solutions infrastructure domain. In the IBM Cloud for VMware Solutions vCenter Server design, the following SSO configuration is applied:



* The SSO domain of vsphere.local is always used.
* The SSO site name equals the <root_domain> captured during the ordering process.
* An identity source, the IBM Cloud for VMware Solutions infrastructure domain, <root_domain>, is configured.
* The VSPHERE.LOCALAdministrator user is configured as an Administrator role.
* The following groups are configured with Administrator roles:



* <root_domain>ic4v-vCenter
(https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/orderer-admin-nodesv2.png)


[View certificate expiration date](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-renewal)

[Enroll a new identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-enroll)

[Register a new user and enroll a new identity](/docs/blockchain?topic=blockchain-cert-mgmtibp-console-identities-expired-certs-admin)

[Update MSP](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-msp)

[Associate admin identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-node-identity)

[Associate admin identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-node-identity)

[Update OS admin on system channel](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-os-admin)

[Share MSP with consortium members (out of band)](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-export-msp)

[Import MSP JSON](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-import-msp)

[Update orderer member MSP on channel](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel)
The smaller the value, the more protection that you have in cases of token theft. The value is provided in seconds and can be any whole number in range 86400 and 7776000. The default value is 2592000 (30 days). 
 anonymousAccess The length of time for which an anonymous token is valid. Anonymous tokens are assigned to users the moment they begin interacting with your app. When a user signs in, the information in the anonymous token is then transferred to the token associated with the user. The value is provided in seconds and can be any whole number in range 86400 and 7776000. The default value is 2592000 (30 days). 
 accessTokenClaims An array that contains the objects that are created when claims that are related to access tokens are mapped. You might want to include information about roles or specific attributes that are returned by a user's identity provider of choice. Note: If you're already using a custom claim with the title "roles" from your identity provider, be sure to use a destination claim to see both values. 
 idTokenClaims An array that contains the information that is present in tokens when you map claims to identity tokens. Depending on your configuration, you might also choose to have "roles" be present in your identity token. 



You must set the token lifetime in each request that you make. If a value is not set, then the default is used. Each customization request overwrites what is previously configured. Note that the lifetime configuration specifications are different in the API than they are in the service dashboard.
5. After the token is returned and you [decode](https://cloud.ibm.com/docs/appid?topic=appid-token-validation) it, you see a result similar to the following example:

{
"sub" : "1234567890",
"name" : "John Doe",
"exp" : 1564566,
"roles" : ["admin", "manager"],
"id": "<nameIDFromSaml>",
"attributes.uid": "<uidFromSaml>"
![Add a Configuration window](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-c2s-ok.png)

Add a Configuration window
* Select Only Me and provide your system username and system password. This is typically your IBMid and password. Then, click OK.

Zoom

![Install Configuration For All Users window](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-c2s-only-me.png)

Install Configuration For All Users window



5. If you are only configuring a client certificate, skip to [Step 3: Connect to the VPN server](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-vpn-clientconnect-vpn-server). If you are also configuring a user ID and passcode, complete the steps in the next section.







 Configure a user ID and passcode 

If your administrator configured user ID and passcode authentication on the VPN server, follow these steps:

Your VPN server administrator invites you to the account that the VPN server resides in so that you can connect to the VPN server. Your administrator already assigned your ID an IBM Cloud Identity and Access Management (IAM) permission.



1. Go to this website to generate a passcode for your user ID:

https://iam.cloud.ibm.com/identity/passcode
2. If a VPN server certificate was ordered from a public Certificate Authority (CA), save the client profile (<vpn_server>.ovpn) on your system, and then update the <ca> section with the public CA certificate. If you configured a client certificate, skip this step.

For example:
Social 

With IBM Cloud® App ID, you can configure social identity providers to set up a single sign-on experience for your app. By allowing a user to sign in with their social profiles, they no longer have to remember several different passwords for different applications.



 Default configuration 

App ID provides a default configuration to help you get up and running quickly with the service.

Data is used when you engage in the Permitted Uses of the Service. By using the Service, you agree to adopting the policy for the collection and use of information in accordance with the outlined [privacy policy](https://cloud.ibm.com/docs/appid?topic=appid-privacy-policy).

When you configure App ID, Facebook, Google, and Cloud Directory are automatically enabled as identity providers. You can change the configuration at anytime. There are default credentials in place for Facebook and Google, but they are IBM credentials and should be used for testing whether to use the service only. Before you publish your app, update the configuration to your own credentials.

You are limited to 20 authentications with the default credentials per instance, per day. If you exceed this limit, error_description=MaxNumberOfDefaultKeysUsageExceeded appears at the end of the authentication process.





 Configuring Facebook 

You can configure the App ID service to use Facebook as an identity provider.



 Getting an app ID and secret from Facebook 

To use Facebook as an identity provider, you must add and configure the website platform on your Facebook application.



1. Log in to your account on the [Meta for Developers site](https://developers.facebook.com/docs/development).
2. Make note of the Facebook application ID and secret in the Basic section of the Settings menu. These values are needed to configure your web project for authentication in your service dashboard.
3. From the products list, select Facebook Login.
4. Select the platform and enter the site URL.
5. On the Facebook Login settings page, enter the authorization server callback endpoint URL in the Valid OAuth redirect URIs field.
6.
Click Associate identity and then select the Multiregion OS MSP Admin and click Associate identity.
4. Click the Ordering nodes tab where you can see the two ordering nodes contributed by the console in Region 1. Click Add another node to add a new node from Region 2.
5. Click Create an ordering node and Next.
6. Provide a name for this ordering node, OS3-Region2.
7. Again you can click the advanced deployment option that is labeled Deployment zone selection if you want to choose the zone where this node is deployed. Otherwise, you can leave it unchecked and let the system choose for you. Click Next.
8. On the Add ordering service page



* Select Multiregion OS CA as your CA.
* Then, select os1 as the enroll ID for the node identity.
* Enter the associated secret, os1pw.
* Select your MSP, Multiregion OS MSP from the drop-down list.
* For purposes of this tutorial, you can skip the TLS CSR hostname option.
* Select the latest available Fabric version from the drop-down list, as it will contain the latest bug fixes and click Next.



9. Review the Summary page and click Add another node.





 Task: Add third ordering node 



Table 8. Create third ordering node

 Display name MSP Enroll ID Secret 

 Create ordering node os3-Region2 Multiregion OS MSP 
 CA Multiregion OS CA 
 Ordering Service Identity os1 os1pw 



To complete the process of adding the node to a system channel, you need to add it to the consenter set of the system channel.







 Add the OS3-Region2 node to the orderer system channel 

If your cluster does not use a system channel, skip this step. To verify if a cluster uses a system channel, click the cluster tile and check the Orderer Type.

Just as when we performed these steps in the console in Region 1, a new tile with the name of OS3-Region2 appears on the Multiregion Ordering Service page with the label "Requires attention".
Golang smart contracts that are currently running on a Fabric v1.4 peer need to be upgraded if you plan to run them on a Fabric v2.x peer. See this [topic](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-smart-contracts-v2ibp-console-smart-contracts-v2-write-package-vendor) on vendoring the shim for more information.
* Click Next.



7. The last side panel asks you to Associate an identity to make it the admin of your peer. For the purpose of this tutorial, make your organization admin, Org2 MSP Admin, the admin of your peer as well. It is possible to register and enroll a different identity with the Org2 CA and make that identity the admin of your peer, but this tutorial uses the Org2 MSP Admin identity.
8. Review the summary and click Add peer. The Edit configuration JSON button allows you to override configuration settings for the peer. For this tutorial, the default settings are sufficient. See [Customizing a peer configuration](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-peer-create-json) to learn more about the options that are available.



Task: Deploying a peer



Table 7. Deploying a peer

 Display name MSP ID Enroll ID Secret 

 Create Peer Peer Org2 org2msp 
 CA Org2 CA 
 Peer Identity peer2 peer2pw 
 Administrator certificate org2msp 
 Associate identity Org2 MSP Admin 



In a production scenario, it is recommended to deploy three peers to each channel. This is to allow one peer to go down (for example, during a maintenance cycle) and still maintain highly available peers. To deploy more than one peer for an organization, use the same CA you used to register your first peer identity. In this tutorial, that would be Org2 CA. Then, register a new peer identity using a distinct enroll ID and secret.
Operator Not applicable 
 Editor View, create, edit, and delete groups<br><br>Add or remove users from groups 
 Administrator View, create, edit, and delete groups<br><br>Add or remove users<br><br>Assign access to a group<br><br>Manage access for working with access groups<br><br>Enable or disable public access to resources at the account level 







 IAM Access Management service 

You can give users access to manage access policies and custom roles.



Table 10. Roles and example actions for the IAM Access Management service

 Roles Actions 

 Viewer View access policies and custom roles 
 Operator View access policies and custom roles 
 Editor View and edit custom roles<br><br>View IAM insights, policies, and settings 
 Administrator View, create, edit, and delete custom roles<br><br>View and update IAM settings<br><br>Assign access to a group<br><br>View, create, edit, and delete access policies 





 Role Management 

You can give users access to create, update, and delete custom roles for services in the account.



Table 11. Roles and example actions for the Access management service

 Roles Actions 

 Viewer View custom roles 
 Operator Not applicable 
 Editor Edit and update custom roles in an account 
 Administrator Create, edit, update, and delete custom roles in an account 









 IAM Identity service 

You can give users access to manage service IDs and identity providers (IdPs) by using the IAM Identity service. These actions apply to service IDs and IdPs within the account that the user didn't create. All users can create service IDs. They are the administrator for those IDs, and they can create the associated API key and access policies, but only users with the operator and administrator role can create IdPs. This account management service applies to the ability to view, update, delete, and assign access to service IDs in the account created by other users.



Table 12. Roles and example actions for the IAM Identity service

 Roles Actions 

 Viewer View IDs
Operator Not applicable 
 Editor View, create, edit, and delete groups<br><br>Add or remove users from groups 
 Administrator View, create, edit, and delete groups<br><br>Add or remove users<br><br>Assign access to a group<br><br>Manage access for working with access groups<br><br>Enable or disable public access to resources at the account level 







 IAM Access Management service 

You can give users access to manage access policies and custom roles.



Table 9. Roles and example actions for the IAM Access Management service

 Roles Actions 

 Viewer View access policies and custom roles 
 Operator View access policies and custom roles 
 Editor View and edit custom roles<br><br>View IAM insights, policies, and settings 
 Administrator View, create, edit, and delete custom roles<br><br>View and update IAM settings<br><br>Assign access to a group<br><br>View, create, edit, and delete access policies 





 Role Management 

You can give users access to create, update, and delete custom roles for services in the account.



Table 10. Roles and example actions for the Access management service

 Roles Actions 

 Viewer View custom roles 
 Operator Not applicable 
 Editor Edit and update custom roles in an account 
 Administrator Create, edit, update, and delete custom roles in an account 









 IAM Identity service 

You can give users access to manage service IDs and identity providers (IdPs) by using the IAM Identity service. These actions apply to service IDs and IdPs within the account that the user didn't create. All users can create service IDs. They are the administrator for those IDs, and they can create the associated API key and access policies, but only users with the operator and administrator role can create IdPs. This account management service applies to the ability to view, update, delete, and assign access to service IDs in the account created by other users.



Table 11. Roles and example actions for the IAM Identity service

 Roles Actions 

 Viewer View IDs
This enables [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-coskp-cos-how) for IBM Cloud Object Storage buckets. With this change, Key Protect is now available in the London region. For more information, see [Regions and locations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regions). Also, Cloud Identity and Access Management roles, which determine the actions that you can perform on Key Protect resources, have changed.



* Administrator is now Manager
* Editor is now Writer
* Viewer is now Reader



For more information, see [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).







 September 2017 



 19 September 2017 

Introducing Key Protect
: IBM® Key Protect for IBM Cloud® is a full-service encryption solution that allows data to be secured and stored in IBM Cloud using the latest envelope encryption techniques that leverage FIPS 140-2 Level 3 certified cloud-based hardware security modules. You can use Cloud Identity and Access Management to set and manage access policies for your Key Protect resources. For more information, see [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).
* (Optional) In the CSR Hostname field, enter the Subject Alternative Names (SAN) to embed in the generated certificate. Specify the host names or custom domain name where the certificate is valid. You can specify a comma separated list of hosts as well as include a wildcard in the domain. For example, 'host1, host2, .example.com. If you leave this field blank, the SAN inside the generated certificate is empty.
* On the next step, the generated keys are displayed.



* The signing certificate is displayed in the Certificate field. This certificate is also referred to as your enrollment certificate, signing certificate, or signCert.
* You can find the corresponding private key in the Private Key field. Again, you need to export the private key to your local system for use with a client application created with the VS Code extension.
* The certificate and private key that are created by clicking Enroll Identity is only generated once and not stored by the console or your browser. Clicking the Enroll Identity button is counted against the maximum number of enrollments that you set for the identity. You should store the signing certificate and private key by downloading the identity to your local file system or adding it to your console wallet. Enter a new name for this signing certificate and private key into the Name field in order to retrieve them.



* Important: Click Export identity to download the certificate and key to your local file system as a single file in JSON format. You are responsible for securing and managing these keys.
* Click Add identity to wallet to add these certificates to the console wallet. You can then find the name and keys of this identity in a new tile in your [wallet tab](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-wallet)



You can also use the Fabric CA client or Fabric SDKs to enroll the identities you create in the console. The console provides you with all of the information that need to compete these steps. Ensure that you have saved the Enroll ID and Enroll secret that you specified during registration.





 Using your TLS CA 

The communication within your network is secured by TLS certificates.
"sub": "2b96cc04-eca5-4122-a8de-6e07d14c13a5",
"email_verified": true,
"amr": [
"cloud_directory"
],
"iat": 1551899553,
"tenant": "39a37f57-a227-4bfe-a044-93b6e6050a61",
"scope": "openid appid_default appid_readprofile appid_readuserattr appid_writeuserattr appid_authenticated"
}





 Identity tokens 

Identity tokens represent authentication and contain information about the user. It can give you information about their name, email, gender, and location. A token can also return a URL to an image of the user. The token is formatted as [JSON Web Tokens](https://jwt.io/introduction/) are signed with a JSON Web Key that uses the RS256 algorithm.

Example token:

Header:
{
"alg": "RS256",
"typ": "JWT",
"kid": "appId-39a37f57-a227-4bfe-a044-93b6e6050a61-2018-08-02T11:57:43.401",
"ver": 4
}
Payload:
{
"iss": "https://us-south.appid.cloud.ibm.com/oauth/v4/39a37f57-a227-4bfe-a044-93b6e6050a61",
"aud": [
"968c2306-9aef-4109-bc06-4f5ed6axi24a"
],
"exp": 1551903163,