vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Setting up a virtual machine network 

The network configuration on your new virtual machine (VM) is done in a few steps. You need a separate portable IP block for both the public and private network. It is likely that your virtualization offering requires a secondary VM. The secondary VM should be on a VLAN broadcast domain and should not routed to a VLAN subnet that does not have an associated network id, gateway, or broadcast address. If you do not plan to use the Private network on your virtual machine, you need only the Public subnet. Portable IP blocks can be ordered directly through the portal at [Sales->Add IP Addresses ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/classic/network/subnet/provision) or from the [Public Network IP Manager ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://cloud.ibm.com/classic/network/subnets).

After you obtain your IP blocks, you can configure networking on the virtual machine. If the virtual machine is not installed, you can configure your public network block through the Operating System installation process. This process is the quickest method to configure your public network. All network configuration steps assume that the first network interface is the private network and the second network interface is the public network.

Configuring your network is different for each OS. You can find detailed information on configuring your network for the following Operating Systems. Note: Operating Systems that are grouped have the same network configuration.



* Windows 2008 Server Core
* Windows 2003 Standard and Enterprise
* Windows 2008 Web, Standard, Enterprise, and Datacenter
* RedHat, Fedora and, CentOS
* Ubuntu and Debian



Network configuration requires the following information for both your Public and Private IP blocks. The information can be found in the portal for Public IP blocks under [Public Network -> IP Manager !
For example, the endpoint for an instance that is available in us-south is the following: https://us-south.monitoring.cloud.ibm.com
4. Add the following entries to your Python script:

from sdcclient import IbmAuthHelper, SdMonitorClient

URL = <MONITORING_ENDPOINT>
 For example: URL = 'https://us-south.monitoring.cloud.ibm.com'

APIKEY = <IAM_APIKEY>

GUID = <GUID>

ibm_headers = IbmAuthHelper.get_headers(URL, APIKEY, GUID)
sdclient = SdMonitorClient(sdc_url=URL, custom_headers=ibm_headers)

Where

<MONITORING_ENDPOINT> must be replaced with the endpoint where the monitoring instance is available.

<IAM_APIKEY> must be replaced with a valid IAM API key. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userapikey).

<GUID> must be replaced with the GUID of the monitoring instance that you obtain in the previous step.



You can now use the sdclient to perform actions that will be authenticated by using IAM.

If you get the error 400 Client Error: Bad Request for url: https://iam.cloud.ibm.com/identity/token, check the API key. The value that you are passing is not valid.





 Option 2. Authenticate by using the Monitoring API token 

You must specify a Monitoring endpoint, and the Monitoring API token that is associated to the team that you want to manage with the Python client.

Complete the following steps from a terminal:



1. [Get the Monitoring API token](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_tokenapi_token_get).
2. Get the endpoint for the region where the monitoring instance is available.
Note: If running inside of Git sh on Windows, prefix the above command with MSYS_NO_PATHCONV=1. In this case insert this inside the brackets, e.g. $(MSYS_NO_PATHCONV=1 ibmcloud is ...).
4. To show details for each BMS, you can use the following commands, swapping out the bare metal variable:

ibmcloud is bm $VMWARE_BMS001

Host provisioning will typically take 10-15 minutes, and you can continue the next steps after the provisioning is completed, and the Bare Metal Servers for VPC Status shows running.





 Obtain Bare Metal Servers for VPC Credentials 



1. Once the hosts have been provisioned, get the credentials for root user for each BMS. You need the SSH key for decrypting the passwords, and you can use the following commands for this.

ibmcloud is bm-init $VMWARE_BMS001 --private-key @/.ssh/id_rsa

ibmcloud is bm-init $VMWARE_BMS002 --private-key @/.ssh/id_rsa

ibmcloud is bm-init $VMWARE_BMS003 --private-key @/.ssh/id_rsa
2. Record the passwords for future use.







 Obtain the Bare Metal Servers for VPC IP Details 



1. Get the IP addresses of the servers and record them for future use into a variable.

VMWARE_BMS001_MGMT_IP=$(ibmcloud is bm $VMWARE_BMS001 -output json | jq -r '.primary_network_interface.primary_ip.address')
echo "VMWARE_BMS001 IP : "$VMWARE_BMS001_MGMT_IP

VMWARE_BMS002_MGMT_IP=$(ibmcloud is bm $VMWARE_BMS002 -output json | jq -r '.primary_network_interface.primary_ip.address')
The application is still accessible from other applications within the project.

You can [deploy your application with a private endpoint](https://cloud.ibm.com/docs/codeengine?topic=codeengine-vpeusing-vpes-app) so that the app is only exposed through the IBM Cloud private network and not exposed to the external internet. The application is still reachable through shared components from within the internal network and the application endpoint needs to be secured.

With the CLI, set the endpoint visibility for your app so that it is deployed with a private endpoint by using the --visibility=private option on the [app create](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-create) or [app update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-update) command. You can obtain the available URLs for your app that reflect your endpoint definition by using the [app get](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-get) command.

From the console, set the visibility of endpoints for your app by using the Endpoints setting when you create your app. After your app is deployed, you can view and modify these system domain mapping settings on the Domain mappings tab on your application page.

For more information about connecting over private networks, see [Using Virtual Private Endpoints with Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-vpe).





 Deploying your app with a project endpoint 

You can set the endpoint visibility for your app such that it is deployed with an internal (project) endpoint. Setting a project-only endpoint means that your app is not accessible from the public internet and network access is only possible from other Code Engine components that are running within the same Code Engine project. This endpoint is always enabled. Applications are still accessible through shared components and therefore need to be secured.
When you create a VPN server, you can specify either high-availability or stand-alone mode.



* If you select high-availability mode, you must deploy the VPN server across two subnets in different zones. Use this mode for production deployments. Best for multi-zone deployments and solutions where client VPN access is critical.
* If you select stand-alone mode, you deploy the VPN server in a single subnet and zone. Use this mode for a pilot, non-production deployment where multi-zone resiliency is not required.







 VPN server authentication 

You must specify a VPN server certificate during provisioning. You can create a certificate using the IBM Cloud Secrets Manager, or use one of your own.

If using the CLI or API, you must specify the certificate's CRN. To obtain the certificate CRN, see [Locating the certificate CRN](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-authenticationlocating-cert-crn).

If the VPN server is using user ID and passcode authentication only, you only need to specify the VPN server certificate, which includes the public/private key and CA certificate. The VPN service gets the public and private keys from the certificate instance and stores them in the VPN server. This CA certificate is also copied in the client profile so that the client can use the CA certificate to verify the VPN server.

If certificate authentication is enabled, you must specify the client CA certificate. The public key and private key are not required. The VPN service gets the client CA certificate from the certificate manager. In turn, the client presents its public key when it connects with the VPN server, and the VPN server uses the CA certificate to verify the public key.

If the client and VPN server certificate are signed by the same CA, then the administrator can use the same certificate instance when they provision the VPN server.

For more information, see [Setting up client-to-server authentication](https://cloud.ibm.com/docs/vpc?topic=vpc-client-to-site-authentication).





 VPN client authentication
6. You can create DNAT rules on T0 Gateway to access your workloads from IBM Cloud private networks.
7. You can use IP addresses from IBM Cloud private portable subnet that is deployed for NSX-T Edge Uplinks for the NAT.







 Public connectivity 

When you deploy a vCenter Server instance in your IBM Cloud classic infrastructure, you obtain the default public network topology as presented in the following diagram.

Zoom

![Access to IBM Cloud Public network](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/arch-pattern-nsx-t-public.svg)

Figure 5. Access to IBM Cloud Public network

Public connectivity pattern is summarized as follows:



1. The automation deploys an NSX-T Tier 0 (T0) Gateway in the NSX-T workload edge cluster. The T0 gateway provides connectivity to IBM Cloud public network.
2. The deployed T0 gateway has a default route 0.0.0.0/0 to the internet with FCR as a next-hop.
3. The automation deploys an example NSX-T overlay topology with a Tier 1 (T1) Gateway and a few example segments attached both to the T1 and T0 Gateways. You might customize the topology based on your needs.
4. You can use IP addresses from IBM Cloud private portable subnet that is deployed for NSX-T Edge Uplinks for NAT or for NSX-T network services (for example IPSec VPN).
5. The automation deploys example SNAT rules for outbound internet access. You can customize and delete these rules based on your needs.
6. You can configure DNAT rules to access your workloads that are attached to NSX-T segments through internet. You can use the Edge.
7.
Creating and importing a Windows-managed desktop custom image for Citrix-DaaS 

You can create your own custom Windows desktop-based image to import the custom image into IBM Cloud® Virtual Private Cloud. You can then use the custom image to deploy a virtual server or bare metal server in the IBM Cloud® Virtual Private Cloud infrastructure.



 Creating a Windows desktop image for Citrix-DaaS 

All custom images must meet the following requirements：



* Contain a single file or volume
* Is in qcow2 or vhd format
* Is cloud-init enabled
* Size doesn't exceed 250 GB
* The minimum size is 10 GB. For any image that is less than 10 GB, the size is rounded up to 10 GB.



You can't create an image from an encrypted boot volume (image from a volume) that is not 100 GB. The operation is blocked.

Use the following steps to create a Windows custom image to deploy in the IBM Cloud VPC infrastructure environment. The procedure encompasses these high-level tasks:



* Use VirtualBox to create a Windows image in VHD format.
* Customize the image with virtIO drivers and Cloudbase-init.
* Upload the image to IBM Cloud Object Storage.





 Before you begin 

As part of creating the VPC image, you must ensure that:



* All drives that are mounted are properly disconnected before you run the final sysprep step.
* The local admin account is enabled and the original user is deleted so that when cloud init runs you are not left with an account you cannot log in to and another account that is some other user.



Obtain the required virtio-win drivers by [provisioning](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers) or accessing an existing Red Hat Enterprise Linux virtual server in IBM Cloud VPC. Then, install the virtio-win package on the server. Finally, copy the virtio-win ISO file, for example, virtio-win-1.9.15.iso, to use for your Windows custom image.



1.
Ordering external authentication MFA for a user 

As a master user of a legacy classic infrastructure account, you can order external authentication and enable the multifactor authentication (MFA) option for a user's login. You are charged a monthly fee for the external authentication option.

Unlike ID-based MFA, external authentication is account-based and require MFA for the user's login only for the account where the setting is enabled. For more information, see [Types of multifactor authentication](https://cloud.ibm.com/docs/account?topic=account-types).

As of 27 May 2021, phone-based authentication is deprecated. Any related billing for previously set up phone-based authentication is removed for all users in the account, and IBM Cloud replaces this feature with Symantec. To set up your account to use Symantec, complete the following steps.



 Ordering external authentication 

You can order external authentication for a user if you are the master user of the account. To order external authentication, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. Select a user from the list.
3. From the User details page, select Order external authentication in the Manage user's login section.
4. Select Symantec identity protection.

The user must download the [Symantec VIP](https://vip.symantec.com/) app and obtain a credential ID to continue with the ordering process.
5. Follow the prompts to review the price and terms before you place the order.
6. Click Order to finalize your selection.



After Symantec authentication is ordered, you can turn on the option for the user from the User details page.





 Setting up external authentication 

To find out whether external authentication is enabled, go to Avatar icon !
When you provision an instance of the Enterprise plan, select private endpoints and want to further restrict access to only known VSIs with specific VPCs, you can add an IP allowlist by using the CLI and appending as follows:

ibmcloud resource service-instance-create <instance-name> <plan-name> <region> --service-endpoints private -p '{"private_ip_allowlist":["CIDR1","CIDR2"]}' "

where CIDR1, 2 are IP addresses of the form a.b.c.d/e

Alternatively, to update the IP allowlist for an existing service instance, complete the following steps:



1. Obtain the original IP allowlist applied on the instance:

$ibmcloud es init -i <instance-name>
API Endpoint:		https://mh-cktmqpdbvkfczhmn.us-south.containers.appdomain.cloud
Service endpoints:	public-and-private
Private IP allowlist:	"10.243.0.8/32","10.243.128.8/32","10.243.64.4/32"
Storage size:		4096 GB
Throughput:		300 MB/s
OK
2. Add CIDRs into or delete CIDRs from the Private IP allowlist.
3. Run the following command to update the service instance with a new list:

ibmcloud resource service-instance-update <instance-name> --service-endpoints private -p '{"private_ip_allowlist":["CIDR1","CIDR2"]}'

where CIDR1, 2 are IP addresses of the form a.b.c.d/e



If the private endpoint is enabled by using the CLI, the next time you update the private IP allowlist, you can omit --service-endpoints private.

Switching IP allowlists disable any allowed IP address not in the new list. Applications accessing the cluster from those addresses lose access to the cluster.





 Retrieving endpoint information
webAppStrategy.logoutSSO(req,res, { "redirect_uri": "https://my-app.com/after_logout" });
});









 Ending all sessions for a user 

As an administrator, you can end all SSO sessions for any user by using the App ID admin APIs. The APIs are protected by a Cloud IAM token.

Example API request:

POST https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/cloud_directory/Users/<userID>/sso/logout
Headers:
Authorization: Bearer <IAMToken>
Content-Type: application/json



Table 3. Variables that are needed to end all SSO sessions for a user

 Variable Value 

 Content-Type The content type of your request. The accepted value is application/json. 
 region The region in which your instance of App ID is provisioned. Learn more about the [available regions](https://cloud.ibm.com/docs/appid?topic=appid-regions-endpoints). 
 tenantID The unique identifier for your instance of App ID. You can find this value in the Service Credentials tab of the App ID dashboard. If you do not have a set of service credentials, you can create one and take the value from there. 
 userID The unique identifier for a Cloud Directory user. You can obtain the ID by using the [Cloud Directory Users APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//), or by viewing the user's identity token. 



When you invoke this API, all the specified user's SSO sessions are invalidated. This means that the next time that the user attempts to sign in to any of your apps, from any device or browser, they are required to reenter their credentials.
The user must download the [Symantec VIP](https://vip.symantec.com/) app and obtain a credential ID to continue with the ordering process.
5. Follow the prompts to review the price and terms before you place the order.
6. Click Order to finalize your selection.



After Symantec authentication is ordered, you can turn on the option for the user from the User details page.





 Setting up external authentication 

To find out whether external authentication is enabled, go to Avatar icon ![Avatar icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/i-avatar-icon.svg) > Profile, and select Login settings.



 Setting up Symantec authentication 

If your account administrator chooses to order Symantec identity protection, you must work with your administrator to help them complete the order by providing your credential ID:



1. Go to [Symantec VIP](https://vip.symantec.com/).
2. Click Download.
3. Get your credential ID and provide the ID to your administrator to complete the order.



After your administrator orders and enables the option, you can use the app for login authentication.







 Disabling external authentication 

You can disable Symantec or phone-based MFA for a user at any time.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. Select a user from the list.
3. From the User details page, set the Symantec authentication to off.







 Cancelling external authentication 

You can cancel your order for external authentication at any time, if you have the correct access. You can choose to cancel immediately without any refund, or you can choose to cancel it at the one year mark from when you ordered it.

To cancel an order for external authentication, you must be an account owner or have all of the following access:



* Manage users classic infrastructure permission
* To crawl a specific user, enter box://app.box.com/user/USER'S_ACCOUNT_ID/.



9. Optional: If you are using a proxy server to access the data source server, then in the Proxy settings section, set the Enable proxy settings switch to On. Add values to the following fields:

Username
: Optional. The username that you use to authenticate, if the proxy server requires authentication. If you do not know your username, you can obtain it from the administrator of the proxy server.

Password
: Optional. The password that you use to authenticate, if the proxy server requires authentication. If you do not know your password, you can obtain it from the administrator of the proxy server.

Proxy server host name or IP address
: The hostname or the IP address of the proxy server.

Proxy server port number
: The network port that you want to connect to on the proxy server.
10. Optional. If you want to activate document-level security, in the Security section, set the Enable Document Level Security switch to On.

When this option is enabled, your users can crawl and query the same content that they can access when they are logged in to Box. For more information, see [Supporting document-level security](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collection-typesconfiguredls).
11. If you want the crawler to extract text from images on the site, expand More processing settings, and set Apply optical character recognition (OCR) to On.

When OCR is enabled and your documents contain images, processing takes longer. For more information, see [Optical character recognition](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionsocr).
12. Click Finish.



The collection is created quickly. It takes more time for the data to be processed as it is added to the collection.

If you want to check the progress, go to the Activity page. From the navigation pane, click Manage collections, and then click to open the collection.
Optional: If you are using a proxy server to access the data source server, then in the Proxy settings section, set the Enable proxy settings switch to On. Add values to the following fields:

Username
: Optional. The proxy server username to authenticate, if the proxy server requires authentication. If you do not know your username, you can obtain it from the administrator of your proxy server.

Password
: Optional. The proxy server password to authenticate, if the proxy server requires authentication. If you do not know your password, you can obtain it from the administrator of your proxy server.

Proxy server host name or IP address
: The hostname or the IP address of the proxy server.

Proxy server port number
: The network port that you want to connect to on the proxy server.
10. Optional: If you want to activate document-level security, in the Security section, set the Enable Document Level Security switch to On.

When this option is enabled, your users can crawl and query the same content that they can access when they are logged in to SharePoint. For more information, see [Supporting document-level security](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collection-typesconfiguredls).

User principal only: When you enable this option, you must add the Azure ID that was assigned to the application upon registration to the Application ID field.

To enable document-level security, you must register your application with SharePoint. For more information, see the prerequisite steps for the principal type you are using.
11. If you want the crawler to extract text from images on the site, expand More processing settings, and set Apply optical character recognition (OCR) to On.

When OCR is enabled and your documents contain images, processing takes longer. For more information, see [Optical character recognition](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-collectionsocr).
12. Click Finish.



The collection is created quickly. It takes more time for the data to be processed as it is added to the collection.