vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[menu icon](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/icons/overflow-menu.svg) next to the user and then click Enroll identity.
3. On the side panel that opens, select TLS Certificate Authority from the Certificate Authority list.
4. Enter the Enroll secret that is associated with the Enroll ID for the user and click Next.
5. Provide a display name for the identity and then Export the identity to your file system.
6. Click Add identity to Wallet.



The TLS certificate now exists in your console wallet and you are ready to customize the node logging.





 Customize logging 

The process to customize the log settings is the same for a peer or ordering node. Open the node and click the Settings![gear](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/gear.svg) icon. Click Log settings to open the panel.

Zoom

![Log settings panel](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/log-settings.png)

Figure 1. Log settings

If you prefer a different default logging level than Information for all loggers on the node, select a new logging level (Fatal, Panic, Error, Warning, Information, Debug) from the Default logging level list. All loggers for the node will use use the selected default log level unless overridden on this panel by providing the specific log levels for the loggers that you need for debugging. There is no “master list” of loggers, and this panel does not validate whether the loggers exist.
Automatic identity sync can only be performed by the user or service ID being synced. If the user whose identity is used by the subscription makes a change, their identity syncs automatically to affected clusters. If a user different from the subscription identity makes a change, the subscription identity cannot sync automatically.

As a result, sometimes the identities that are synced to each cluster might become incorrect.



* If a different user or service ID modifies the subscription's cluster groups, the subscription's identity cannot automatically sync to any new clusters.
* If a different user changes the membership of the cluster groups, the subscription's identity cannot sync automatically to any new clusters.



If the identity used is not available on the Location cluster, potentially causing rollout failure, you can resolve this problem in three ways:



1. The user associated with the subscription can explicitly request re-sync of their identity. This sync can be done from the IBM Cloud console (a subscription action) or CLI (ibmcloud sat subscription identity set).
2. A different user can edit the Subscription to use their identity, also triggering the sync of their identity to appropriate clusters. This sync can be done from the IBM Cloud console (a subscription action) or CLI (ic sat subscription identity set).
3. The user associated with the subscription can trigger sync of their identity to a single cluster by running ibmcloud ks cluster config or connecting to the cluster's dashboard from the IBM Cloud console.
Virtual Server on classic infrastructure View virtual server details and access to a specific set of services or all virtual servers 
 Cloud Object Storage S3 on classic infrastructure Storage manage permission 
 File Storage on classic infrastructure Storage manage permission 
 Evault backup on classic infrastructure Storage manage permission 
 Content Delivery Network on classic infrastructure Manage CDN account permission 
 Direct Link on classic infrastructure Account member 
 Hardware Firewall Manage Firewalls 
 FortiGate Security Appliance Manage Firewalls 
 IBM Cloud Load Balancer Manage Load Balancers 
 Gateway Appliance Manage Network Gateways 
 Service IDs To attach or detach user tags, editor or administrator on the IAM Identity service <br>To attach or detach access management tags, administrator on the IAM Identity service 







 Granting users access to tag IAM-enabled resources 

Complete the following steps to assign the editor role for a user to tag IAM-enabled resources:



1. From the IBM Cloud console, click Manage > Access (IAM), and select Access groups.
2. Click Create.
3. Enter a group name and description, and click Create.
4. Add users to the access group by clicking Add users, selecting one or more users from the table, and clicking Add to group.
5. Click Access > Assign access.
6. Select All Identity and Access enabled services or a specific service.
7. Select a specific location.
8. Select Editor from the list of platform access roles, and click Review.
9. Click Add to add your policy configuration to your policy summary.
10. Click Assign.







 Granting users access to tag IAM-enabled resources by using the API 

To assign the editor role for a user to tag IAM-enabled resources, call the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-management) as shown in the following example request. Replace variables with your target service and resource name.



* Curl
* Java
* Python
* Go
* Node
When the identity provider authenticates a user, it creates SAML tokens that contain information about the user such as how they authenticated, attributes that are associated with them, or authorization parameters. Check out the following table for examples.



Table 1. Understanding the types of information returned in a SAML token

 Type of information Examples 

 Authentication Users might authenticate with a password, by using MFA, or another way. 
 Attributes Any attributes such as groups that they belong to or a preference of some kind. 
 Authorization decisions Occasionally users might be granted more or less permissions than others. 





 What does the flow look like? 

Although the SAML framework is used to authenticate the user, App ID still uses a more modern OIDC protocol to exchange security tokens with your application. Check out the following image to see a detailed flow of information.

Zoom

![SAML enterprise authentication flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid//images/ibmid-flow.png)

Figure 1. How an enterprise SAML authentication flow works



1. A user accesses the login page or restricted resource on their application, which initiates a request to the App ID /authorization endpoint through either an App ID SDK or API. If the user is unauthorized, the authentication flow begins with a redirect to App ID.
2. App ID generates a SAML authentication request (AuthNRequest) and the browser automatically redirects the user to the SAML identity provider.
3. The identity provider parses the SAML request, authenticates the user, and generates a SAML response with its assertions.
4. The identity provider redirects the user and the response back to App ID with the SAML response.
5. If the authentication is successful, App ID creates access and identity tokens that represent a user's authorization and authentication and returns them to the app. If the authentication fails, App ID returns the identity provider error code to the app.
6.
The identity provider parses the SAML request, authenticates the user, and generates a SAML response with its assertions.
4. The identity provider redirects the user and the response back to App ID with the SAML response.
5. If the authentication is successful, App ID creates access and identity tokens that represent a user's authorization and authentication and returns them to the app. If the authentication fails, App ID returns the identity provider error code to the app.
6. The user is granted access to the app or the protected resources.







 How does SSO change the flow? 

The workflow for SSO is similar. The only deviation from the described workflow is in step 3 of the previous section. With SSO enabled, before a user is asked to authenticate, the identity provider checks whether a user already has an established authentication session. If yes, the user is not asked to authenticate and the flow continues as usual. If an SSO session is unavailable, then the user is redirected to a log in page. They might also be redirected if your identity provider can't match the authentication requirements that are defined in App ID's request with what it uses to establish SSO. For example, if your identity provider establishes a user SSO session by using biometrics, then App ID's default authentication must be changed. By default, App ID expects users to be authenticated by password over HTTPS: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport.







 Understanding assertions 

When the SAML assertion is returned to App ID, the service federates the user identity and generates the appropriate tokens. If the SAML assertion corresponds to one of the standard OIDC claims, it's automatically added to the identity token. The assertions that don't have a match, are ignored by default. If your SAML provider returns other assertions, it's possible to configure App ID to [inject the information into your tokens](https://cloud.ibm.com/docs/appid?topic=appid-customizing-tokenscustomizing-tokens).
Enter the User ID for the console instance.
6. Enter the Password for the console instance.
7. Select Proceed without certificate verification, or Cancel if you're planning to add the CA certificates to the operating systems trusted CA certificate store.
8. Enter a name for your environment.
9. Select the CAs and peers that belong to your organization, along with the ordering nodes of your channels, click OK when done.



In steps 5 and 6, you can alternatively enter an API key and secret that you generate using the [IBM Blockchain Platform REST APIs](https://cloud.ibm.com/docs/blockchain-sw-254?topic=blockchain-sw-254-ibp-v2-apisconsole-icp-manage-create-api-key).

You also need to import your admin identities into the wallet pane and associate them with your nodes. You need to associate an admin identity with your peers, CA, and an ordering node before you can connect with your network.



1. Click on the environment that you created in the Fabric Environments pane.
2. You can see an Alert sign next to the peer and ordering node. Click on the alert to associate an admin identity with the node.
3. Select Add a new wallet.
4. Select Create a new wallet.
5. Enter a name for your wallet to identify the orderer or peer admin of your network.
6. Select Add a new identity.
7. Enter name for your peer or orderer admin identity.
8. Select Provide a JSON identity file from the IBM Blockchain Platform and then browse to the admin identity that you exported from your console. If the identity is the administrator of multiple nodes in your network, you can associate the identity with multiple nodes.



When you have associated an admin identity with your peers, CA, and an ordering node, you can connect to your network and use the extension to deploy smart contracts.







 Adding wallets and users 

Use the following steps to create a new wallet by using a certificate and private key:



1.
Syncing subscription identity 

After you create a Satellite configuration, you might need to sync the subscription identify for the rollout to be successful. The subscription identity is the user or service ID that is used by the subscription.

When Kubernetes resources are applied by Satellite Config to managed clusters, they are applied by a different identity depending on how the cluster was attached.



* For clusters that are manually registered with Satellite Config, Kubernetes resources are always applied to the cluster by the razeedeploy-sa service account.
* Clusters in a Satellite Location are automatically configured for use by Satellite Config. Kubernetes resources are applied to the cluster by the identity (user or service ID) that created the Subscription.



In short, if a user creates a subscription to apply Kubernetes resources, the Location clusters resources are applied as that user and following that user's permissions on each cluster. If that user does not have permissions to create certain resources in certain namespaces, the rollout might fail.

The subscription identity is shown in the Subscription details page in the UI and is also retrievable through the CLI by using the ibmcloud sat subscription get** command.

Identity sync is triggered and usually happens automatically.



* When a user creates a subscription, all the clusters in the subscription's groups automatically sync.
* When a user modifies the membership of a cluster group and that user's identity is used by any subscriptions that are applied to the group, all the clusters in that group sync automatically.
* When a user logs into the cluster by running ibmcloud ks cluster config or by launching the cluster dashboard from the IBM Cloud UI, that cluster does not sync automatically.



Automatic identity sync can only be performed by the user or service ID being synced. If the user whose identity is used by the subscription makes a change, their identity syncs automatically to affected clusters. If a user different from the subscription identity makes a change, the subscription identity cannot sync automatically.

As a result, sometimes the identities that are synced to each cluster might become incorrect.



* If a different user or service ID modifies the subscription's cluster groups, the subscription's identity cannot automatically sync to any new clusters.
* Ordering node TLS certificate expired - If the ordering node TLS certificate has expired then the Enroll button is blocked. Open a support ticket to address the problem.









 Renew MSP Admin certificate 

Use the following steps to renew an MSP admin certificate.



 Step one: Enroll new identity 

Before an organization admin certificate expires, you must enroll the identity again to generate a new certificate and public key by using the associated CA. These instructions assume that you have the original enroll ID and secret that was specified when the user was originally registered. If the certificates were generated with the console, you can use the following instructions:



1. Open the CA tile. *
2. Locate the enroll ID for the identity in the table and click Enroll identity from the action menu.
3. After you verify that you have selected the correct CA, Root Certificate Authority, or TLS Certificate Authority, according to the type of certificate that you are renewing, provide the enroll ID and secret that was specified when the user was initially registered. If the enroll ID and secret are not available, follow the same steps for an expired [admin certificate](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtibp-console-identities-expired-certs-admin).
4. Because the certificate and private key are never stored by the console, you must download them and store them securely and export the identity.
5. Click Add identity to wallet. Wallet identities cannot be replaced, you need to either delete the existing wallet identity or give this one a different name.



If the certificates were generated from the Fabric CA client or Fabric SDKs, then they need to be renewed where they were generated. You can now use the updated certificates when you follow instructions in subsequent steps.

If you reach the enrollment limit for an identity, simply use the console to register a new user and enroll an identity and then use the generated certificate in subsequent steps.

If the CA admin identity expires, you are not able to update any of the identities in the CA table. And when you open the CA node, there is a message that indicates the users cannot be listed.
Managing verification methods and MFA factors 

You can add and delete your verification methods and authentication factors on the [Verification methods and authentication factors](https://iam.cloud.ibm.com/mysecurity) page. You might want to update these settings if an email address or phone number that you use to verify your identity or authenticate to IBM Cloud® changes or becomes inaccessible.

You can view a log of recent changes to your verification methods and authentication factors by clicking Show events on the Verification methods and authentication factors page.



 Accessing your verification methods and authentication factors 

Verification methods and authentication factors add an extra layer of security to accounts. To view and modify your verification methods and authentication factors, complete the following steps:



1. Go to the [Verification methods and authentication factors](https://iam.cloud.ibm.com/mysecurity) page.
2. Validate your identity with two different verification methods. You must verify your identity each time that you access the Verification methods and authentication factors page.
3. Enter the one-time password (OTP) that is sent to the method you choose, and click Verify. Complete this step for each method.







 Managing methods for verifying your identity 

You can add and remove the verification methods that identify you as a user in the account. Make sure that you add backup verification methods in case one of them becomes inaccessible. Verification methods are used each time that you access the Verification methods and authentication factors page. If a verification method is not in use, remove it.

If one or more verification methods are inaccessible, and you are unable to verify your identity, you can open a [support case](https://cloud.ibm.com/unifiedsupport/supportcenter) to reset these methods.



 Adding a verification method 

To add a verification method, complete the following steps:



1. From the Verification methods and authentication factors page, click Manage verification methods.
2. Click Add.
3. Select a new verification method.
4. Name the verification method.
5. Enter the phone number or email address.
6. Click Send OTP.
7.
The following table lists the permissions to set for a User principal authentication method.



1. Register your app.

For more information, see the [Microsoft documentation](https://docs.microsoft.com/en-us/graph/auth-register-app-v2).
2. Configure API permissions.





User principal API configuration

 API Permissions Type 

 Microsoft Graph (Groups) Group.Read.All or Group.ReadWrite.All Delegated 
 Microsoft Graph (Directories) Directory.AccessAsUser.All or Directory.Read.All or Directory.ReadWrite.All Delegated 
 SharePoint Online User.Read.All or User.ReadWrite.All Delegated 







 Prerequisite steps when using a service principal 

A service principal is a security identity that is used by user-created apps, services, and automation tools to access specific Azure resources. It is like a user identity (verified with a certificate) that has a specific role, and tightly-controlled permissions. If you connect to SharePoint Online as a service principal user, you can access your data without disabling multifactor authentication.

To prepare to connect as a service principal, complete the following steps:



1. [Create a certification file](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-online-cp4dservice-principal-cert-file).
2. [Register an application with SharePoint Online](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-online-cp4dregister).
3. [Add a certificate](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-online-cp4dadd-certificate).
4. [Configure API permissions](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-online-cp4dapi-permissions).
5.
Enroll ID Multiregion OS CA Admin admin adminpw 



You should be able to see the CA admin in your Wallet.





 Task: Check your Wallet 



Table 2. Check your Wallet

 Field Display name Description 

 Identity Multiregion OS CA Admin Multiregion OS CA admin identity 









 Use your CA to register identities 

Each ordering node in the ordering service needs a certificate and private key to participate in the blockchain network. You also need to create an admin identity for the ordering service organization that you can use to manage the ordering service. We use the CA to register these identities:



* An organization admin: This identity allows you to operate the ordering nodes from the console.
* ordering node user: This is the registered user that each ordering node will use. When the ordering node is subsequently created, this user is enrolled, meaning that a certificate and private key are generated for the node.



Because you have already associated the CA admin identity, you can now use the CA tile to create these identities by completing the following steps:



1. Click the Multiregion OS CA tile in the Nodes tab and ensure the admin identity that you created for the CA is visible in the table. Then click the Register user button.
2. First we'll register the organization admin, which we can do by giving an Enroll ID of osadmin and a secret of osadminpw. Then, use the Type drop-down to set the type for this identity as admin. You can ignore the Maximum enrollments field. If you want to learn more about enrollments, see [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register). Click Next.
3. This tutorial does not configure attributes on identities. Click Register user.
4. After the organization admin has been registered, repeat this same process for the identity of the ordering nodes. Use the information in the table below to register the ordering node user for the ordering nodes with an Enroll ID of os1 and secretos1pw.
* UI
* API







 SAML 

If you're using a SAML-based identity provider, you can configure App ID to initiate a single sign-on (SSO) experience. In this type of flow, App ID acts as a service provider and provides security tokens for your authorized users.

Working with a specific SAML identity provider? Try out one of the following blogs to help you set up App ID with [Reusing Existing Red Hat SSO and Keycloak for Applications That Run on IBM Cloud with App ID](https://www.ibm.com/cloud/blog/reusing-existing-red-hat-sso-and-keycloak-for-applications-that-run-on-ibm-cloud-with-app-id), [an Azure Active Directory](https://www.ibm.com/cloud/blog/setting-ibm-cloud-app-id-azure-active-directory), or [Protecting Your Cloud Applications with App ID and an Existing IBM Cloud Identity User Repository](https://www.ibm.com/cloud/blog/protecting-your-cloud-applications-with-app-id-and-existing-ibm-cloud-identity-user-repository).



 Understanding SAML 

Security Assertion Markup Language (SAML) is an open standard that is used to exchange authentication and authorization data between the provider that asserts an identity and a provider that consumes the identity information. SAML 2.0 is based in XML and is a well-established framework for authentication and authorization standards.

The SAML protocol provides a bridge between App ID (service provider) and your identity provider. When the identity provider authenticates a user, it creates SAML tokens that contain information about the user such as how they authenticated, attributes that are associated with them, or authorization parameters. Check out the following table for examples.



Table 1. Understanding the types of information returned in a SAML token

 Type of information Examples 

 Authentication Users might authenticate with a password, by using MFA, or another way. 
 Attributes Any attributes such as groups that they belong to or a preference of some kind. 
 Authorization decisions Occasionally users might be granted more or less permissions than others. 





 What does the flow look like?