vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You should use the customization scripts to configure the new cluster exactly like the previous production cluster.
* How is user management done in IBM Analytics Engine?

How do I add more users to my cluster?

All clusters in IBM Analytics Engine are single user, in other words, each cluster has only one Hadoop user ID with which all jobs are executed. User authentication and access control is managed by the IBM Cloud Identity and Access Management (IAM) service. After a user has logged on to IBM Cloud, access to IBM Analytics Engine is given or denied based on the IAM permissions set by the administrator.

A user can share his or her cluster’s user ID and password with other users; note however that in this case the other users have full access to the cluster. Sharing a cluster through a project in Watson Studio is the recommended approach. In this scenario, an administrator sets up the cluster through the IBM Cloud portal and associates it with a project in Watson Studio. After this is done, users who have been granted access to that project can submit jobs through notebooks or other tools that require a Spark or Hadoop runtime. An advantage of this approach is that user access to the IBM Analytics Engine cluster or to any data to be analyzed can be controlled within Watson Studio.
* How is data access control enforced in IBM Analytics Engine?

Data access control can be enforced by using IBM Cloud Object Storage ACLs (access control lists). ACLs in IBM Cloud Object Storage are tied to the IBM Cloud Identity and Access Management service.

An administrator can set permissions on a Object Storage bucket or on stored files. Once these permissions are set, the credentials of a user determine whether access to a data object through IBM Analytics Engine can be granted or not.

In addition, all data in Object Storage can be cataloged using IBM Watson Knowledge Catalog. Governance policies can be defined and enforced after the data was cataloged. Projects created in Watson Studio can be used for a better management of user access control.
* Can I run a cluster or job for a long time?

Yes, you can run a cluster for as long as is required.
[Manual certificate renewal](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-enroll-tls-ordering-node) 







 Peer admin certificate 

The following diagram summarizes the process for updating peer admin certificates on your network. Click a circle to view the instructions.

![Peer admin certificate renewal process.](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/peer-admin-nodes.png)


[View certificate expiration date](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-renewal)

[Enroll a new identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-enroll)

[Register a new user and enroll a new identity](/docs/blockchain?topic=blockchain-cert-mgmtibp-console-identities-expired-certs-admin)

[Update MSP](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-msp)

[Associate admin identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-node-identity)

[Associate admin identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-node-identity)

[Update MSP on application channel](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel-peer)

[Share MSP with consortium members](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-export-msp)
After you establish trust with federated users, compute resources, an IBM Cloud service, or a service ID, you can assign access.

You can assign classic infrastructure access only if your account is linked to a Softlayer account.



1. Assign access.



* Assign access to the trusted profile by adding it to one or more access groups. This way, you can use the policies that exist in the access groups you've created.



1. Select Access groups and select all the groups that you want to add the trusted profile to. You can assign users to only the access groups that you have access to manage.
2. Click Add.



* Assign access to the trusted profile with an access policy.



1. Select Access policy. Based on your level of access, you can assign IAM policies and classic infrastructure permissions.
2. Select a single service or a group of services, like All Identity and Access enabled services, All Account Management services, or All IAM Account Management services. Then, click Next.
3. Scope the access to All resources or Specific resources based on selected attributes. Then, click Next.
4. Select any combination of roles and permissions to define the scope of access, and click Review.
5. Click Add to add your policy configuration to your summary.
6. You can assign Classic infrastructure access by selecting a user, device, or service, then any combination of granular permissions.





2. Click Create.







 Establishing trust with federated users by using the CLI 

Complete the following steps to define which federated users can access specific resources:



1. [Enable authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).
2. Create a trusted profile by running the following command:

ibmcloud iam trusted-profile-create my-profile -d "sample trusted profile"
ABAC helps reduce security risks by providing fine-grained access control and is typically more complex, especially during initial setup.
* Role-based access control (RBAC) uses a mapping from an identity, such as a user or service ID, to a role. The RBAC role defines the type of access that an identity with the RBAC role can take against a resource. Typically access can be granted for a resource type or a grouping of resources. RBAC roles are usually defined based on job responsibilities within an organization. The RBAC role grants the access that is needed for an identity to do its job. This is a simple model because IAM administrators manage the mapping of RBAC roles to an identity. RBAC roles setup can be simpler than ABAC initial setup.



IBM Cloud IAM uses an ABAC model by using identity and resource attributes. IBM Cloud IAM uses access policies to store the attribute information that is needed by the IAM access decision engine. And, the access policies tell the IAM decision engine, which attributes the author of the policy requires to grant access to a resource.

The supported attributes for identities are iam_id and access group ID. The supported attributes for resources belong to one of the following categories:



* Fields defined in the resource [CRN](https://cloud.ibm.com/docs/account?topic=account-crn), for example the service name.
* System-wide defined resource attributes, such as resource groups.
* Service-specific resource attributes such as namespaces or buckets.



Each service defines the supported attributes for resources it manages. For more information, see the documentation for the service you're using.

A best practice in IBM Cloud IAM is to use access groups to manage access for identities. After the access group access policies are defined, granting, and revoking access is simply a matter of adding and removing identities to or from access groups. A user or service ID can belong to as many access groups as the administrator wants, and the members of the group inherit all access that is assigned to the access group. This approach provides the fine-grained access benefits of ABAC with the simplicity of RBAC.
* Service: A security identity used by user-created apps, services, and automation tools to access specific Azure resources. It is like a user identity (verified with a certificate) that has a specific role, and tightly-controlled permissions.

Support for using a service principal was added with version 4.0.3.

In the Enter your credentials section, complete the following fields:

Tenant name
: The tenant where the data resides. For example, ibm.onmicrosoft.com.

Application ID
: The ID of your app. For example, 19ce9f74-cd14-4b68-8dfc-4bcc75ed2fe9.

Upload the following files:

Certification file
: The certification file that you created in SharePoint. For example, myinfo.crt.

Private key file
: The private key file that you created in SharePoint. For example, private.app.key.

If a private key password is required, specify the password.

If this crawler has permissions to access the specified site collection only, set the Azure Access Control Service switch to On, and then provide the following values:



* Client ID
* Client secret





8. In Specify what you want to crawl section, add values to the following fields:

Site Collection Url
: The SharePoint web service URL. For example, https://organization_name.com.

User principal only
: In the Site Collection Name field, specify the name that the site collection uses. Get the name from the site collection settings.
9. Optional: If you are using a proxy server to access the data source server, then in the Proxy settings section, set the Enable proxy settings switch to On. Add values to the following fields:

Username
: Optional. The proxy server username to authenticate, if the proxy server requires authentication. If you do not know your username, you can obtain it from the administrator of your proxy server.

Password
: Optional. The proxy server password to authenticate, if the proxy server requires authentication.
Managing user access 

The IBM Cloud® Hyper Protect Virtual Servers service provides you with virtual servers on a highly secure stack with an Ubuntu Linux operating system.

A good practice is to have different operating-system-based users for each person or application, which is using the virtual server, having different permissions. Investigate which is the most suitable way for you to manage users and permissions.

Another good practice is to add users to your IBM Cloud® account and grant permissions to them. This method provides the added users with capabilities within IBM Cloud®. For example, with specially granted permissions, a user can view the virtual server dashboards or manage (for example, delete) virtual servers in specific resource groups or within your account.

Access to Hyper Protect Virtual Servers service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM) as described [here](https://cloud.ibm.com/docs/services/hp-virtual-servers?topic=hp-virtual-servers-iam-hpvs).
Using IAM permissions with IBM Cloud Transit Gateway 

IBM Cloud® Transit Gateway uses the IBM Cloud Identity and Access Management (IAM) platform access roles to manage access to the service's resources. IAM access roles allow account administrators to assign different levels of permission for using the service. The following tables provide the list of actions that you can take against the IBM Cloud Transit Gateway service and its resources depending on a user's assigned roles.



 Platform-access roles 

IBM Cloud Transit Gateway supports Administrator, Editor, Operator, and Viewer platform-access roles.



Table 1. IAM platform-access user roles and actions

 Role Description of Actions Actions 

 Administrator Can perform all actions, including managing gateways and connections, and assign IBM Cloud Transit Gateway IAM access policies to other users. Create gateways <br>Delete gateways <br>Edit gateways <br>Add or remove gateway connections <br>Accept or reject a cross account connection request <br>Edit gateway connections <br>Update user access policies for the service 
 Editor Can perform all actions, including managing gateways and connections, but cannot assign IBM Cloud Transit Gateway IAM access policies to other users. Create gateways <br>Delete gateways <br>Edit gateways <br>Add or remove gateway connections <br>Accept or reject a cross account connection request <br>Edit gateway connections 
 Operator and Viewer Can only perform actions that don't change the state of resources. List gateways <br>Get gateways <br>List a gateway's connections <br>View a gateway's connections <br>View incoming connection requests 



To add or remove connections to VPCs, or to accept or reject a cross account connection request, you must also have Administrator or Editor platform-access role permission to the VPC being connected to. See [VPC: Getting started with IAM](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started) for more information.

To add or remove connections to Direct Links, you must also have Administrator or Editor platform-access role permission to the Direct Link being connected to.
To initiate the LDAP Authentication setup you will need to submit a case to the IBM Support Community with the following details.

Configuration parameters

LDAP domain attributes:



* URL – ldaps://hostname:port
* Bind DN
* Bind Password
* Base DN
* User ID map



User synchronization:



* User Base DN
* User ID map
* User filter



Group synchronization:



* Group Base DN
* Group filter
* Group ID map
* Group member ID map



Other:



* Synchronization schedule
* Identity provider
* Default permissions



Note: typically a site-to-site VPN is required to make a connection from the MAS-Dedicated environment to your LDAP server.

Additional details on LDAP user registry synchronization can be found here: [https://www.ibm.com/docs/en/mas86/8.6.0?topic=access-administering-ldap-user-registry-synchronization](https://www.ibm.com/docs/en/mas86/8.6.0?topic=access-administering-ldap-user-registry-synchronization)





 SMTP Setup 



 MAS SMTP Configuration 

To enable outbound emails from your Maximo Application Suite Manage environment from the provided SMTP relay, you must raise an IBM Support case to configure SMTP Domain Authentication. Completing this configuration will allow you to send email from hosted Manage environment as your %CUSTOMERNAME% domain email addresses. If you plan to use your own SMTP host, this process will not apply.

In the case, please include:



* Case title: SMTP / outbound email activation
* Case description: Please initiate domain authentication for customerdomain.com. This domain should align with the email addresses used in Manage. Please provide contact details / email address of a person who has access to add DNS records for the domain(s) you specify. With these details the IBM SRE Team can generate the DKIM / Domain Authentication records which will be sent to the contact you specify (which has access to add DNS records).
Reusing the enroll ID is acceptable in this case because a unique certificate is generated when the ordering node is created and the identity is enrolled. But it is important to ensure that you have not restricted the maximum enrollments for the user when it is initially registered so that a new certificate can be generated when the user is enrolled when each ordering node is created. The default value of maximum enrollments is unlimited.







 Create the ordering service organization MSP definition 

Create your ordering service organization MSP definition and specify the admin identity for the organization. After we have registered the ordering service admin and ordering service users, we need to create the MSP ID and enroll the osadmin user that we registered as the admin of our organization.



1. Navigate to the Organizations tab in the left navigation and click Create MSP definition.
2. Enter Multiregion OS MSP as the organization MSP display name and mrosmsp and as the MSP ID. Click Next.
3. Under Root Certificate Authority details, specify the CA you used to register the identities in the previous step, Multiregion OS CA, and click Next.
4. Under Enroll ID and Enroll secret, select osadmin, and enter its associated secret, osadminpw.
5. Click the Generate button to enroll this identity as the admin of your organization and export the Multiregion OS MSP Admin identity to the Wallet.
6. Click Export to export the admin certificates to your file system and then click Next.
7. Review the information on the Summary panel and click Create MSP definition.
8. After the MSP is created, click on its tile and then click Export![export icon](https://cloud.ibm.com/docs-content/v1/content/icons/download.svg) to download the Multiregion OS MSP to your local filesystem as a JSON file. You will need to send this MSP to all operators of the blockchain consoles in other regions.





 Task: Create the ordering service organization MSP definition 



Table 4. Create the ordering service organization MSP definition

 Display name MSP ID Enroll ID Secret 

 Create Organization Multiregion OS MSP mrosmsp
Follow the [Terraform on IBM Cloud getting started tutorial](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started) to install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. The plug-in abstracts the IBM Cloud APIs that are used to create, update, or delete continuous-delivery service instances and toolchain resources.
2. Create a Terraform configuration file that is named main.tf. In this file, add the configuration to create a Continuous Delivery service instance and to assign a user an access policy in Identity and Access Management (IAM) for that instance by using HCL. You also add the configuration to create a basic toolchain resource in the same resource group and region as the Continuous Delivery service instance, and to assign a user an access policy in IAM for that resource. The toolchain and the Continuous Delivery service instance that governs usage of the toolchain are in the same resource group and region. For more information about working with the Terraform configuration file, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).

The Continuous Delivery service instance in the following example is named my_cd. It is created with the professional pricing plan in the default resource group and in the us-south region. The user user1@ibm.com is assigned the Manager role in the IAM access policy for the service instance.

The toolchain resource is named my_toolchain. It is created in the default resource group and in the region that is specified in the provider "ibm" block in your provider.tf file. For this example, the region in provider.tf is set to us-south. The user user2@ibm.com is assigned the Editor role in the IAM access policy for the toolchain resource.

data "ibm_resource_group" "default_rg" {
name = "default"
}

resource "ibm_resource_instance" "cd_instance" {
name = "my_cd"
If a federated user leaves your company, you can simply delete their corporate identity in your directory, which then also removes access to IBM Cloud. Time-based access with trusted profiles allows frequent authentication checks for reduced security risks.

Use the following table to understand the differences between using access groups and trusted profiles to make the best decision for your use case.



Table 1. Compare access groups and trusted profiles

 Access group Trusted profile 

 IAM access control Yes Yes 
 Inviting users to the IBM Cloud account required Yes No 
 Access can be defined before user is added to the account Yes, by using dynamic rules Yes 
 Federated users Yes Yes 
 Non-federated users Yes No 
 Service ID Yes No 
 Compute resource identities No Yes 
 User management is primarily done in IBM Cloud account Corporate user directory 



Access groups and trusted profiles can be used separately or hand-in-hand for user and access management, depending on your organization's needs.

For example, for the CustApp project, you might choose to create an IAM Admin trusted profile with the following policies:



* Administrator for access groups CustApp-Dev/Test/Prod. This way, the administrator can grant and revoke access to users by adding them to and removing them from access groups.
* Administrator for IAM Identity account management service. This way, the administrator can manage service IDs, trusted profiles, rules, and so on.
* Editor for User Management account management service. This way, the administrator can invite users to the account, view users in account, and so on.



With this trusted profile, the administrator can add developers to an access group with broad access policies to complete day-to-day actions and tasks in the development and test environments. Access for operations on the production environment can be set up in a trusted profile named Operator-Profile. This way, the developer can change job roles by logging in and applying the Operator-Profile when they need to take any operation actions on the CustApp in production.

If you have administrator access through a trusted profile, it is not recommended to invite users to an account while the profile is applied. Users should be invited by true account owners or administrators, or an error might occur.
Since we have two organizations, select and add Org1 MSP (org1msp) and then Org2 MSP (org2msp). After clicking Add, you can assign an organization a role on the channel. Because each channel must have at least one operator, make both organizations Operator.
6. Next, choose a Update policy for the channel. This is the policy that will dictate how many organizations will have to approve updates to the channel configuration. As this channel includes two organizations, this policy should be 2 out of 2, meaning both organizations have to approve updates to the channel. As you add organizations to the channel, you should change this policy to reflect the needs of your use case. A sensible standard is to use a majority of organizations. For example, 3 out of 5.
7. On the next page, select the Organization creating channel. Because the console allows multiple organizations to be owned by a single user, it is necessary to specify which organization is creating the channel. Because this tutorial is limited to the creation of a single organization, choose Org2 MSP (org2msp) from the drop-down list. Likewise, choose Org2 MSP Admin as the identity submitting the channel creation request.
8. On the Review channel information page, make sure you have entered the correct values in the correct fields. If a required field is missing, you will see an error notification relating to the field or value that must be corrected.



When you are ready, click Create channel. You will be taken back to the Channels tab and you can see a pending tile of the channel that you just created.

Task: Create a channel



Table 8. Create a channel

 Field Name 

 Channel name channel2 
 Ordering Service Ordering Service 
 Organizations Org2 MSP 
 Channel update policy 2 out of 2 
 Access control list None 
 Channel creator MSP Org2 MSP 
 Identity Org2 MSP Admin 



The next step is to join a peer to this channel. Click the pending tile and select the organization peers to be added to the channel.







 Next steps