vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can add more users and groups by creating more LDIF files and by using the ldapadd command to import them into the directory.





 Step 2: Create a user group in OLDAP directory 

Now that the OpenLDAP server is configured, you need to create a user group in the OLDAP directory, which consists of users who are supposed to get access to the LSF cluster.



1. To create a group, use the ldapadd command to add an LDIF entry for the group to the LDAP directory. For example, to create groups called "LSFadministrators" and "LSFconsumers", you can create an LDIF file with the following contents:

 create an organizational unit for groups
dn: ou=groups,dc=ibmlsf,dc=com
objectClass: organizationalUnit
ou: groups

 create a group called "LSFadministrators"
dn: cn=LSFadministrators,ou=groups,dc=ibmlsf,dc=com
objectClass: top
objectClass: posixGroup
gidNumber: 1001
cn: LSFadministrators
description: LSFadministrators group

 create a group called "LSFconsumers"
dn: cn=LSFconsumers,ou=groups,dc=ibmlsf,dc=com
objectClass: top
objectClass: posixGroup
gidNumber: 1002
cn: LSFconsumers
description: LSFconsumers group
Show more

In this example, the first entry creates an organizational unit called "groups". The next two entries create groups that are called "LSFadministrators" and "LSFconsumers".

Each group entry specifies the objectClass "top" and "posixGroup" to define the group's schema. The gidNumber attribute specifies the group's unique identifier, while the cn attribute specifies the group's common name. Finally, the description attribute provides a brief description of the group.
2.
From the CLI/ODBC Settings window, on the Data Source tab, enter the user ID and password from the [connection information](https://cloud.ibm.com/docs/Db2onCloud/connecting?topic=Db2onCloud-db_details_cxn_creds) that you collected beforehand.

e. On the Advanced Settings page, for each of the following parameters, click Add to open the Add CLI Parameter window to begin the step, and click OK to return to the Advanced Settings page:



* Select the Database parameter, then click OK to open the CLI/ODBC Settings window. In the Pending Value field, enter the database name from the connection information that you collected beforehand.
* Select the Hostname parameter, then click OK to open the CLI/ODBC Settings window. In the Pending Value field, enter the host name from the connection information that you collected beforehand.
* Select the Port parameter, then click OK to open the CLI/ODBC Settings window. In the Pending Value field, enter the port number from the connection information that you collected beforehand.
* Select the Protocol parameter, then click OK to open the CLI/ODBC Settings window. Select TCP/IP.



f. Click OK to return to the ODBC Data Source Administrator window.

g. On the User DSN tab, select the data source name, then click Configure.

h. On the CLI/ODBC Settings window, click Connect to test the connection.



* If the connection is successful, click OK to return to the ODBC Data Source Administrator window, and then click OK to exit the window.
* If the connection is not successful, note and correct any errors before you test the connection again.
Whenever you want to perform admin tasks, return to the "Services" page to open the administration console.





 Step 2. Configure user access 

In API Connect V10 Reserved, user access is managed with the IBM Cloud Identity and Access Management (IAM) service. Create an API Connect provider organization that will represent a set of users, and use the IAM service to define access groups with roles that grant permission for users to work with API Connect features.

For details on configuring user access for API Connect, see [Managing users](https://cloud.ibm.com/docs/apiconnect?topic=apiconnect-ri-mng-users).
For more information, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile).



 Federated users 

Your users might already have identities outside of IBM Cloud in your corporate directory. If your users need to work with IBM Cloud resources or work with applications that access those resources, then those users also need IBM Cloud credentials. You can use a trusted profile to specify permissions for users whose identity is federated from your organization or an external IdP. By using your IdP, you can provide a way for users in your company to use single sign-on (SSO). To connect your federated users with IBM Cloud resources, see [Federating users to IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-iamoverviewfederation-iam).



* Video transcript

We are excited to introduce the latest and greatest identity type: IBM Cloud trusted profiles. You expect the most reliable and efficient way to manage access to your account, so let’s learn about how you can use trusted profiles.

Previously, organizing identities and assigning access was limited to access groups, where each user is added to the account manually.

As an account owner, you can save time and automatically grant federated users access to your accounts by leveraging the attributes that already exist in your corporate directory.

Simply add conditions based on SAML attributes to define which federated users can apply a profile. This way, changes in your directory immediately affect access to resources.

As a federated user, you might have the option to apply one of many trusted profiles. After you log in, you can apply a profile, or continue to the console.

Imagine a scenario where you want to complete developer-related tasks, like working with the service instances from your application components. You can select the Developer profile when logging in to ensure that you have the access you need.

Similarly, if you want to complete an administrator-related task, you can select the Admin profile that has privileged permissions. This way, you reduce the risk of taking privileged actions by mistake.

You also have the option to log in to the account without applying a profile by continuing to the console.
Inviting users to your Planning Analytics as a Service environment 

You can use IBM Planning Analytics® as a Service to invite additional users to access your service instance. You must first invite users into your IBM Cloud account using Identity Access Management (IAM) and then add the same users to Planning Analytics Workspace.



 Inviting users to your service instance 

To invite users using IAM into your IBM Cloud account, complete the following steps:



1. In the Manage dropdown menu, click Access(IAM).
2. Click Invite Users in the Manage access and users dashboard.
3. In the text box, enter the email adresses of the users you want to invite to your IBM Cloud account.
4. Configure the users’ access policy.



* If you have created an access group with defined access for the service, click Access groups then select the group to which you want to assign the invited users. For more information on access groups, see [Assigning access to resources by using access groups](https://cloud.ibm.com/docs/account?topic=account-access-getstarted).



or



1. Click Access policy to define access for the users you are inviting.
2. Select the service for which you want to define access: Planning Analytics for a production environment or Planning Analytics Dev for a development environment.
3. Click Next.
4. Specify the Resources for which you want to grant access, then click Next .
5. Specify the levels of Resource group access you want to assign, then click Next. You can select a level to view a definition of the access that is provided by the level.
6. Under Service access, select the Planning Analytics User role to allow users to log into your Planning Analytics service instance(s).
7. Under Platform access, selct the appropriate level of platform access required for the Planning Analytics User. You can select a level to view a definition of the access that is provided by the level.



5. Click Review.
6. Once the process is reviewed, click Add to move your desired access to the Access summary pane.
7. Click Invite.
Communities 

There are user-driven communities that you can join for information, tutorials, discussions, and help from professional Db2 users. And they're all free to join!



*  [International Db2 Users Group (IDUG)](https://www.idug.org/) IDUG® is an independent, not-for-profit, user-run organization whose mission is to support and strengthen the information services community. It provides the highest-quality education and services that are designed to promote the effective use of Db2.
*  [Db2 Community on IBM Communities](https://community.ibm.com/community/user/hybriddatamanagement/communities/community-home?CommunityKey=1feb44c5-c839-437b-8e7a-f85d61d4136b) A Db2 developer community.
*  [Stack Overflow](https://stackoverflow.com/users/login?ssrc=anon_ask&returnurl=https%3a%2f%2fstackoverflow.com%2fquestions%2fask%3ftags%3ddashdb) A support forum and community for developers.
After the organization admin has been registered, repeat this same process for the identity of the ordering service (also using the Ordering Service CA). For the ordering service node identities, give an enroll ID of OS1 and a secret of OS1pw. This is a node identity, so select orderer as the Type. You can ignore the Maximum enrollments field and, on the next panel, do not assign any Attributes, as before.





 Task: Create a CA and register users 



Table 10. Create a CA and register users

 Field Description Enroll ID Secret Type 

 Create CA Ordering Service CA admin adminpw client 
 Register users Ordering Service admin OSadmin OSadminpw admin 
 Ordering Service node identity OS1 OS1pw orderer 



For the purpose of this tutorial, we are only creating one node identity. This identity will be used by the one node that we will deploy to create the ordering service. While you would not want to do this in a multi-organizational ordering service, it is acceptable given that all of the ordering nodes are owned by the same organization.







 Creating the ordering service organization MSP definition 

Create your ordering service organization MSP definition and specify the admin identity for the organization. After we have registered the ordering service admin and ordering service users, we need to create the MSP ID and enroll the OSadmin user that we registered as the admin of our organization.



1. Navigate to the Organizations tab in the left navigation and click Create MSP definition.
2. Enter Ordering Service MSP as the organization MSP display name and osmsp and as the MSP ID. If you want to specify your own MSP ID in this field, make sure to review the instructions in the tool tip.
3. Under Root Certificate Authority details, specify the CA you used to register the identities in the previous step, Ordering Service CA.
4. The Enroll ID and Enroll secret fields below this will auto populate with the enroll ID of your CA admin: admin. However, using this identity would give your organization the same admin identity as your CA, which for security reasons is not recommended.
Go to this website to generate a passcode for your user ID:

https://iam.cloud.ibm.com/identity/passcode
2. If a VPN server certificate was ordered from a public Certificate Authority (CA), save the client profile (<vpn_server>.ovpn) on your system, and then update the <ca> section with the public CA certificate. If you configured a client certificate, skip this step.

For example:

<ca>
----BEGIN CERTIFICATE-----
MIID......................
..........................
..........................
..........................
----END CERTIFICATE-----
</ca>
3. Open the OpenVPN UI and import the file.

Do not select Save password.

OpenVPN Connect example:



* In the OpenVPN Connect client, enter your IAM username, then click CONNECT.

Zoom

![Imported Profile window](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-c2s-imported-profile.png)

Imported Profile window
* Add the one-time passcode generated in step 1, then click OK.

Zoom

![Enter password window](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/images/vpn-c2s-enter-password.png)

Enter password window
2. Navigate to your volume mount path that you defined earlier and list the files in your volume mount path.

cd <volume_mountpath> && ls

Example output

binding

The binding file includes the service credentials that you stored in the Kubernetes secret.
3. View the service credentials. The credentials are stored as key value pairs in JSON format.

cat binding

Example output

{"apikey":"<API_key>","host":"<ID_string>-bluemix.cloudant.com","iam_apikey_description":"Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloudantnosqldb:us-south:a/<ID_string>:<ID_string>::","iam_apikey_name":"auto-generated-apikey-<ID_string>","iam_role_crn":"crn:v1:bluemix:public:iam::::serviceRole:Writer","iam_serviceid_crn":"crn:v1:bluemix:public:iam-identity::a/<ID_string>::serviceid:ServiceId-<ID_string>","password":"<ID_string>","port":443,"url":"https://<ID_string>-bluemix.cloudant.com","username":"123b45da-9ce1-4c24-ab12-rinwnwub1294-bluemix"}
4. Configure your app to parse the JSON content and retrieve the information that you need to access your service.









 Referencing the secret in environment variables 

You can add the service credentials and other key value pairs from your Kubernetes secret as environment variables to your deployment.



1. List available secrets in your cluster and note the name of your secret. Look for a secret of type Opaque. If multiple secrets exist, contact your cluster administrator to identify the correct service secret.
Validate your identity with two different verification methods.
3. Click Show accounts.
4. Take note of the Authentication setting for each account.



1. If the account uses MFA for IBMid users, work with the [IBMid help desk](https://www.ibm.com/ibmid/myibm/help/us/helpdesk.html) to reset your authentication factors.
2. If the account uses MFA for All users, you can add new authentication factors on the Verification methods and authentication factors page and remove the old ones.
"parent_document_id":"8b152926-e9f5-4f34-940a-c02da7ef3af4",
"customer_id":"customer_header_123"
},
"extracted_metadata":{
"sha1":"CEC7C1D3423C7D4ED58FC448F52681ECA93CED8A",
"numPages":"1",
"filename":"Simple.pdf",
"author":[
"Simple Man"
],
"subject":"Simple Metadata",
"file_type":"pdf",
"title":"Simple Title",
"publicationdate":"2016-10-05"
}
}
Show more

If your documents are already ingested, you must reingest them to add the X-Watson-Metadata header and customer_id.

Restrictions:



* The value of the X-Watson-Metadata header cannot exceed 4 KB of text.
* The X-Watson-Metadata header must contain a semicolon-separated list of field=value pairs. The field and value must not contain semicolons (;) or equals signs (=).
* customer_ids are unique within each Discovery instance. They are NOT unique per project or collection.
* A customer_id cannot be more than 256 characters in length.
* If a customer_id contains only white space or is empty, it is treated as though the customer_id was not provided at all, and no error messages are returned.





 Labeling data in the product user interface 

Data can be labeled by using the Discovery product user interface, or by using the API. For more information about labeling with the API, see [Labeling data](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-information-securitylabeling).

To label data with the product user interface:



1. Open the Projects page by selecting My Projects.
2. Select Data usage and GDPR.
3.
Communities 

There are user-driven communities that you can join for information, tutorials, discussions, and help from professional Db2 users. And they're all free to join!



*  [International Db2 Users Group (IDUG®)](https://www.idug.org/) IDUG is an independent, not-for-profit, user-run organization whose mission is to support and strengthen the information services community. It provides the highest-quality education and services that are designed to promote the effective use of Db2.
*  [Db2 Community on IBM Communities](https://community.ibm.com/community/user/hybriddatamanagement/communities/community-home?CommunityKey=1feb44c5-c839-437b-8e7a-f85d61d4136b) A Db2 developer community.
*  [Stack Overflow](https://stackoverflow.com/users/login?ssrc=anon_ask&returnurl=https%3a%2f%2fstackoverflow.com%2fquestions%2fask%3ftags%3ddashdb) A support forum and community for developers.
});
Show more
4. In your onLoad event handler, use the [on()](https://web-chat.global.assistant.watson.cloud.ibm.com/docs.html?to=api-instance-methodson) instance method to subscribe to the customResponse event, registering the carouselCustomResponseHandler() function as the callback.

instance.on({
type: 'customResponse',
handler: (event, instance) => {
if (event.data.message.user_defined && event.data.message.user_defined.user_defined_type === 'carousel') {
carouselCustomResponseHandler(event, instance);
}
},
});

In this example, we are checking the custom user_defined_type property of the custom response, and calling the carouselCustomResponseHandler() function only if the specified type is carousel. This is an optional check that shows how you might use a custom property to define multiple different custom responses (each with a different value for user_defined_type).



For complete working code, see the [Content carousel for Watson Assistant web chat](https://github.com/watson-developer-cloud/assistant-toolkit/tree/master/integrations/webchat/examples/content-carousel) example.
If you want to use virtual machines, use a worker node with 16 vCPU and 64 GB memory or more, such as b3c.16x64. Virtual machines with a flavor of b3c.4x16 or u3c.2x4 don't provide the required resources for Portworx to work properly.
3. Minimum number of workers: Two worker nodes per zone across three zones, for a minimum total of six worker nodes.



2. VPC and non-SDS classic worker nodes only: [Create raw, unformatted, and unmounted block storage](https://cloud.ibm.com/docs/containers?topic=containers-utilitiesmanual_block).
3. For production workloads, create an [external Databases for etcd](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_kv_store) instance for your Portworx metadata key-value store.
4. Optional[Set up encryption](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_encryption).
5. [Install Portworx](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_deploy).
6. Maintain the lifecycle of your Portworx deployment in your cluster.



1. When you update worker nodes in [VPC](https://cloud.ibm.com/docs/containers?topic=containers-storage_portworx_updateportworx_vpc_up) clusters, you must take additional steps to re-attach your Portworx volumes. You can attach your storage volumes by using the API or CLI.



* [Attaching Block Storage for VPC volumes with the CLI](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_storage_att_cr).
Managing multiple Virtuozzo hardware nodes through a single interface 

Managing multiple nodes is done through the PIM interface. You use PIM to have a controller server with multiple workers. A worker is managed by only a single controller. It cannot be a part of alternative groups that are managed by a separate controller.

Follow these steps to manage multiple hardware nodes:



1.  Go to Infrastructure.
2.  In the second tab, click Hardware Nodes > New Hardware Node
3.  Click Register.



You can now manage both the controller and the worker through the same PIM interface.
The worker nodes need be configured to grant proper execution of SAP Data Intelligence - see also the documentation at [Red Hat's SDI Node Configurator](https://github.com/redhat-sap/sap-data-intelligence/tree/master/node-configurator) on GitHub.



1. First set security context constraints to the sdi-node-configurator service account:

oc adm policy add-scc-to-user -n sdi-observer privileged -z sdi-node-configurator
2. Copy the template from GitHub:

curl -O https://raw.githubusercontent.com/redhat-sap/sap-data-intelligence/master/node-configurator/ocp-template.json
3. Create the objects directly from the downloaded template

oc process NAMESPACE=sdi-observer -f ./ocp-template.json | oc create -f -







 Preparing IBM Cloud Object Storage for SAP Data Intelligence 

For production environments, storage for backup&restore as well as Semantic Data Lake (SDL) Connections must be set up. Follow these instructions to set up IBM Cloud Object Storage and to define the parameters that will be handed over to the installation dialog.

For ad hoc small term test and evaluation environments, you may skip this topic and go directly to the [Installing the Software Lifecycle Container Bridge (SLCB)](https://cloud.ibm.com/docs/sap?topic=sap-rhos-di-dataintelligencerhos-di-install-slcb) section.



 Before you begin 

Review [Getting started with IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage) for general information on IBM Cloud Object Storage.





 Provisioning Object Storage 

Use the steps in [Provision storage](https://cloud.ibm.com/docs/services/cloud-object-storage/basics?topic=cloud-object-storage-provision) to provision your Object Storage.

The service instance name for the following example is sdi_cos_k8.
If you want to use virtual machines, use a worker node with 16 vCPU and 64 GB memory or more, such as b3c.16x64. Virtual machines with a flavor of b3c.4x16 or u3c.2x4 don't provide the required resources for Portworx to work properly.
3. Minimum number of workers: Two worker nodes per zone across three zones, for a minimum total of six worker nodes.



2. VPC and non-SDS classic worker nodes only: [Create raw, unformatted, and unmounted block storage](https://cloud.ibm.com/docs/openshift?topic=openshift-utilitiesmanual_block).
3. For production workloads, create an [external Databases for etcd](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_kv_store) instance for your Portworx metadata key-value store.
4. Optional[Set up encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_encryption).
5. [Install Portworx](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_deploy).
6. Maintain the lifecycle of your Portworx deployment in your cluster.



1. When you update worker nodes in [VPC](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_updateportworx_vpc_up) clusters, you must take additional steps to re-attach your Portworx volumes. You can attach your storage volumes by using the API or CLI.



* [Attaching Block Storage for VPC volumes with the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_storage_att_cr).
Updating maximum number of worker nodes 

Complete the following steps if you want to update the maximum number of worker nodes.



1.  Update the file ibmcloudgen2_templates.json in $LSF_ENDIR/resource_connector/ibmcloudgen2/conf. A typical HPC cluster that is installed on IBM Cloud® would have this file in /opt/ibm/lsf/conf/resource_connector/ibmcloudgen2/conf.
2.  Update the value for field maxNumber to the number of your choice. See the following sample code for an example:

{
"templates": [
{
"templateId": "<TemplateID>",
"maxNumber": 200,
"attributes": {
"type": "String", "X86_64"],
"ncores": "Numeric", "1"],
"ncpus": "Numeric", "1"],
"mem": "Numeric", "1024"],
"icgen2host": "Boolean", "1"]
},
"imageId": "<IMAGE_ID>",
"subnetId": "<SUBNET_ID>",
"vpcId": "<VPC_ID">,
"vmType": "cx2-2x4",
"securityGroupIds": "<SECURITY_GROUP_ID>"],
"sshkey_id": "<SSH_KEY_ID>",
"region": "us-south",
"zone": "us-south-2"
}
]
}

Make sure that the value for maxNumber is within the range that your specific subnet can accommodate. You can check the available IPs in the subnet page in the IBM Cloud console, or you can check by running the following command in the IBM Cloud CLI:

ic is subnet <SUBNET_ID> --output JSON | jq .available_ipv4_address_count
3.  Run the following command to apply the changes of the file into the cluster:

badmin reconfig