vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The master and all the components that run inside the master are dedicated to your Satellite location only and are managed by IBM in an IBM-owned IBM Cloud account.

One of the components that is set up in the Satellite control plane master is an etcd database where IBM stores personal and sensitive data of the customer account that created the location. The etcd database is not shared across locations or with other IBM customers. For more information, see [What information is stored with IBM when using Satellite?](https://cloud.ibm.com/docs/satellite?topic=satellite-data-securitysat-sensitive-data) and [How is my information stored and encrypted?](https://cloud.ibm.com/docs/satellite?topic=satellite-data-securitysat-data-encryption).





 Workload isolation in your Satellite location 

Because you manage the host infrastructure that you bring to your Satellite location, you are responsible to isolate app workloads that run on your infrastructure. If you host and run IBM Cloud services in your location, such as Red Hat OpenShift on IBM Cloud, you can leverage the tools and features that this service provides to isolate your workloads. For more information about available options, see the service documentation.
The IBM Data Processing Addendum (Addendum) applies to the processing of client's personal data by IBM on behalf of client in order to provide IBM standard services.
[IBM DPA](https://www.ibm.com/support/customer/zz/en/dpa.html)

Messages for RabbitMQ processes limited client Personal Information (PI) in the course of running the service and optimizing the user experience.

Messages for RabbitMQ provides a [Data Sheet Addendum (DSA)](https://www.ibm.com/software/reports/compatibility/clarity-reports/report/html/softwareReqsForProduct?deliverableId=040987F07A6111E89D57EFEED3CB8BE9) with its policies as a Data Processor regarding content and data protection.





 HIPAA 

Messages for RabbitMQ meets the required IBM controls that are commensurate with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security and Privacy Rule requirements. These requirements include the appropriate administrative, physical, and technical safeguards required of Business Associates in 45 CFR Part 160 and Subparts A and C of Part 164. HIPAA must be requested at the time of provisioning and requires a representative to sign a Business Associate Addendum (BAA) agreement with IBM.





 PCI DSS 

{{site.data.keyword.databases-for-rabbitmq}} are compliant with the Payment Card Industry Data Security Standard (PCI DSS). IBM Cloud completes annual PCI DSS assessments by using an approved Qualified Security Assessor (QSA), and the resulting Attestations of Compliance (AOCs) and Service Responsibility Matrix (SRM) guides are available upon customer request. Auditors reviewed {{site.data.keyword.databases-for-rabbitmq}} for compliance under PCI DSS version 3.2.1 at Service Provider Level 1.

Customers are responsible for the storing, processing, and transmission of their cardholder data, and can create cardholder data environments (CDEs) that can store, transmit, or process cardholder data by using {{site.data.keyword.databases-for-rabbitmq}}.
* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.8control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.8nist-supplemental-guidance)



[SC-7 (10) - Prevent Unauthorized Exfiltration](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10sc-7.10)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10control-requirements)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10implementation-guidance)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.10nist-supplemental-guidance)



[SC-8 - Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8sc-8)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8control-requirements)
In-flight encryption All access to Schematics is encrypted by using HTTPs. 
 Public Endpoints All Schematics instances are provided with [external endpoints](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datapi-location) that are publicly accessible. 
 Private Endpoints Allows clients to connect to a Schematics instance through the internal IBM Cloud network to avoid upstream application traffic from going over the public network and incurring bandwidth charges. For more information, see [Service Endpoint](https://cloud.ibm.com/docs/schematics?topic=schematics-private-endpoints), and also see [enabling Service Endpoints](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-datapi-location) for your IBM Cloud account. 
 IP allows lists You can allow the list of the Schematics IP addresses in their firewall. For more information, see [Opening wanted IP addresses](https://cloud.ibm.com/docs/schematics?topic=schematics-allowed-ipaddresses) for IBM Cloud® Schematics in your firewall.
(https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-security-wks)
* [How can you ensure that the sensitive data used by the Terraform automation, do not leak in the logs or outputs?](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-security-leak-log)
* [How can you protect the access to workspaces and its data?](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-security-wks-data)
* [How does Schematics protect the workspace data through Terraform state file, or log files?](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-protect-data)



* [Best practices of managing Schematics Actions](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-actions)



* [What are the best practices that you must follow in creating an action for the Ansible template?](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-security-ansible)
* [How can you protect the access to actions and its data?](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-security-action-data)
* [How does Schematics protect the action data through input credentials state file, or log files?](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-security-protect)



* [Protecting data of Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-bp-secure-objectsbp-protect)
"user_defined": {
"carousel_data":
{
"alt": "everyday card",
"url": "lendyr-everyday-card.jpg",
"title": "The Everyday Card",
"description": "$300 bonus plus 5% gas station cash back offer. Earn 2% cash back on all other purchases."
},
{
"alt": "preferred card",
"url": "lendyr-preferred-card.jpg",
"title": "The Preferred Card",
"description": "$300 bonus plus 5% gas station cash back offer. Earn 5% cash back on all other purchases."
},
{
"alt": "topaz card",
"url": "lendyr-topaz-card.jpg",
"title": "The Topaz Card",
"description": "$90 Annual fee. Earn 120,000 bonus points. Earn additional points on every purchase."
}
],
"user_defined_type": "carousel"
},
"response_type": "user_defined"
}
]
}
Show more

In this example, we are including the carousel data inside the user_defined response. Depending on the design of your assistant, another option would be to store the data in skill variables that can be accessed by web chat from the context object.
2. Create a handler for the [customResponse](https://web-chat.global.assistant.watson.cloud.ibm.com/docs.html?to=api-eventscustomresponse) event. This handler renders the content carousel, using the styles defined by the Swiper library. (You can see the definitions of these styles in the [full example](https://github.com/watson-developer-cloud/assistant-toolkit/tree/master/integrations/webchat/examples/content-carousel).)
Some integration channels do not display the description.
8. Optional: If you want to indicate a preference for how the options are displayed, as buttons or in a list, you can add a preference property for the response.

To do so, open the JSON editor for the response, and then add a preference name and value pair before the response_type name and value pair. You can set the preference to dropdown or button.

{
"output": {
"generic": [
{
"title": "Insurance types",
"options":
{
"label": "Boat",
"value": {
"input": {
"text": "I want to buy boat insurance."
}
}
},
{
"label": "Car",
"value": {
"input": {
"text": "I want to buy car insurance."
}
}
},
{
"label": "House",
"value": {
"input": {
"text": "I want to buy house insurance."
}
}
}
],
"preference": "dropdown", //add this name and value pair
"description": "Which of these items do you want to insure?",
"response_type": "option"
}
]
}
}
Show more

When you define an options list with only 3 items, the options are typically displayed as buttons. When you add a preference property that indicates dropdown as the preference, for example, you can see in the "Try it out" pane that the list is displayed as a drop-down list instead.

![Shows a small options list in the Preview that is displayed as a drop-down menu.]
[Upload Image](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/34-image.png)

If you want to remove the image, click Remove.
![Upload Image](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/35-uploaded-image.png)
5. Click Save to save your changes.



--------------------





 Customize the theme for your developer portal 

The developer portal allows you to modify the theme to change its look and feel.



1. To modify the theme, select Appearance from the menu, then select Settings > IBM API Connect Theme. This is the default theme for the developer portal. ![IBM API Connect Theme](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/41-APIC-theme.png)

The Standard Layout tab allows you to modify the layouts for devices with large screens, such as desktops. The Tablet Layout tab allows you to modify the layouts used on tablet devices. The Smalltouch Layout tab allows you to modify the layouts used on smaller devices such as smartphones.

The default theme supports the use of Gpanels, or Responsive Panels, if you install the Panels module. Panels let you define settings that control the panels layout on standard, tablet, and small touch devices. !
initiator.authnId crn-crn:v1:bluemix:public:containers-kubernetes:satloc_wdc_c8gfp9ow)1il4mg:a/a319e5b2c84429a9a2ece7a7c9a8807:c8jrclfw0 
 initiator.authnName sat-kp-c8gfp9ow0gavb01il4mg:ibm-kp:default:key-management-crypto-7797c45798-mlbck 
 logsourceCRN crn:v1:bluemix:public:cloud-object-storage:global:a/59bcbfa6ea2f006b4ed7094c1a08dcdd:1a0ec336-f391-4091-a6fb-5e084a4c56f4:: 



A federated user that's applying trusted profile fed-user-profile-1 has the following identifying attributes:



Table 2. Sample trusted profile attributes and values in Activity Tracker

 Attribute Value 

 action iam-identity.user-authcode 
 initiator.name fed-user-profile-1 
 initiator.id IBMid90101838 
 initiator.typeURI service/security/account/profile 
 initiator.credential.type profile 
 initiator.authnId IBMid11118967 
 initiator.authnName addison.martin@ibm.com 



For more information, see [IAM Identities (Mapping to Activity Tracker fields)](https://cloud.ibm.com/docs/observability?topic=observability-scenario-iam-identitiestrusted-profile)
Allow from env=let_api_token_in
Allow from env=let_sys_token_in
Allow from env=let_csrf_token_in
Satisfy Any
LogLevel debug
</LocationMatch>
OIDCSSLValidateServer Off
OIDCOAuthSSLValidateServer Off
RequestHeader unset X_REMOTE_USER
RequestHeader set X_REMOTE_USER %{OIDC_CLAIM_PREFERRED_USERNAME}e env=OIDC_CLAIM_PREFERRED_USERNAME
RequestHeader set X_EXTERNAL_AUTH_ERROR %{EXTERNAL_AUTH_ERROR}e env=EXTERNAL_AUTH_ERROR
RequestHeader set X_REMOTE_USER_EMAIL %{OIDC_CLAIM_EMAIL}e env=OIDC_CLAIM_EMAIL
RequestHeader set X_REMOTE_USER_FIRSTNAME %{OIDC_CLAIM_GIVEN_NAME}e env=OIDC_CLAIM_GIVEN_NAME
RequestHeader set X_REMOTE_USER_LASTNAME %{OIDC_CLAIM_FAMILY_NAME}e env=OIDC_CLAIM_FAMILY_NAME
RequestHeader set X_REMOTE_USER_FULLNAME %{OIDC_CLAIM_NAME}e env=OIDC_CLAIM_NAME
RequestHeader set X_REMOTE_USER_GROUPS %{OIDC_CLAIM_GROUPS}e env=OIDC_CLAIM_GROUPS
RequestHeader set X_REMOTE_USER_DOMAIN %{OIDC_CLAIM_DOMAIN}e env=OIDC_CLAIM_DOMAIN
Show more



1. Create a file named: im-oidc-secret.yaml based on the example template. Replace the values in the example template with the actual values based on your installation.

Note: Use the same values from the previous step for the registration.json file.



* <YOUR_CLIENT_ID> Your base64 encoded character string.
* <YOUR_CLIENT_SECRET> Your base64 encoded character string.
In the Decoded section, verify that you can see the food preference.

{
"iss": "https://us-south.appid.cloud.ibm.com/oauth/v4/39a37f57-a227-4bfe-a044-93b6e6050a61",
"exp": 1551903163,
"aud": [
"968c2306-9aef-4109-bc06-4f5ed6axi24a"
],
"sub": "2b96cc04-eca5-4122-a8de-6e07d14c13a5",
"email_verified": true,
"amr": [
"cloud_directory"
],
"iat": 1551899553,
"tenant": "39a37f57-a227-4bfe-a044-93b6e6050a61",
"scope": "openid appid_default appid_readprofile appid_readuserattr appid_writeuserattr appid_authenticated"
"food-preference": "vegetarian, gluten-free"
}







 Next steps 

Nice work! You completed the tutorial. Next, you can try configuring [multi-factor authentication](https://cloud.ibm.com/docs/appid?topic=appid-cd-mfa) or setting up [your own branded GUI](https://cloud.ibm.com/docs/appid?topic=appid-branded).
{"attrs":{"hf.Affiliation":"org1.department1","hf.EnrollmentID":"user1","hf.Type":"client"}}
Signature Algorithm: ecdsa-with-SHA256
30:44:02:20:1a:38:64:47:69:6b:31:e4:96:bc:52:06:71:75:
9e:01:57:a4:bd:b0:15:f0:19:c4:23:37:29:14:b1:66:e3:ce:
02:20:7a:34:af:7b:fb:65:6c:b8:22:a2:39:78:5d:30:5c:3c:
b0:9b:0e:14:d8:76:78:9a:34:2b:bb:d2:97:d4:ce:81
Show more
curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"abcuser","ibmid":"abcuser@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"

Because the user ID (abcuser) remains the same for the new IBMid for that user, the granted database permissions for the user remain unchanged. If a list of existing non-IBMid database users needs to be migrated to make them IBMid users, you are required to run the previous pair of API calls for each user.
* To add many new IBMid users at one time, create a batch file that lists the following example API calls, one for each user:

curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid1>","ibmid":"<userid1>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"
curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid2>","ibmid":"<userid2>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"
.
.
.
curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid>","ibmid":"<userid>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"

The userid value for "id" cannot match the full email ID. It can match the first part of the email ID, but that is not necessary. The two different IDs are not linked together in any way. For example, if your "ibmid" is abc@us.ibm.com, then you could specify abc as the ID, or you could specify def for example, but you cannot specify abc@us.ibm.com.
* To migrate an existing non-IBMid database user (for example, abcuser) and make them an IBMid user, first delete the non-IBMid user ID by running the following example API call:

curl --tlsv1.2 -X DELETE "https://<IPaddress>/dbapi/v3/users/abcuser" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json"

Next, re-add the user with an IBMid that is the same as the previous user ID (abcuser) by running the following example API call:

curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"abcuser","ibmid":"abcuser@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"
"food-preference": "vegetarian, gluten-free"
}
}



Great work!





 Step 3: Injecting attributes into tokens 

Becoming more popular, you decide to implement a "deal-of-the-day". You want the first thing that the user sees when they sign in to your application to be a coupon for something that matches their dietary preferences. You can achieve this goal by injecting the attributes that are stored in their profiles into their tokens. By having the information available at run time, you can have your application make a custom decision on the spot about which deal to show.

[Token configuration](https://cloud.ibm.com/docs/appid?topic=appid-customizing-tokenscustomizing-tokens) is global, which means that it applies to every user with the same attribute.



1. Make a request to the token configuration endpoint.

curl --request PUT https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/config/tokens --header 'Authorization: Bearer <IAMToken>' --header 'Content-Type: application/json' -d '{
"access": {
"expires_in": 3601
},
"refresh": {
"enabled": false,
"expires_in": 2592001
},
"anonymousAccess": {
"expires_in": 2592001
},
"accessTokenClaims": [
{
"source": "attributes",
"sourceClaim": "food-preference"
}
]
}'
Show more



Table 1. Token configuration variables

 Variable Description 

 tenantID A tenant ID is how your instance of App ID is identified in the request. You can find your ID in the Service credentials tab of the dashboard. If you don't have a set, you can follow the steps in the GUI to create credentials.
curl --tlsv1.2 -X DELETE "https://<IPaddress>/dbapi/v3/users/abcuser" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json"

Next, re-add the user with an IBMid that is the same as the previous user ID (abcuser) by running the following example API call:

curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"abcuser","ibmid":"abcuser@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"

Because the user ID (abcuser) remains the same for the new IBMid for that user, the granted database permissions for the user remain unchanged. If a list of existing non-IBMid database users needs to be migrated to make them IBMid users, you are required to run the previous pair of API calls for each user.
* To add many new IBMid users at one time, create a batch file that lists the following example API calls, one for each user:

curl --tlsv1.2 "https://<IPaddress>/dbapi/v3/users" -H "Authorization: Bearer <access_token>" -H "accept: application/json" -H "Content-Type: application/json" -d "{"id":"<userid1>","ibmid":"<userid1>@<email_address_domain>","role":"bluadmin","locked":"no","iam":true}"
* entity: 'urn:oasis:names:tc:SAML:2.0:nameid-format:entity',
* kerberos: 'urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos',
* persistent: 'urn:oasis:names:tc:SAML:1.1:nameid-format:persistent',
* unspecified: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
* windowsDomainQualifiedName:'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName',
* x509SubjectName: 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName',



When creating a case requesting your SAML SSO setup please include one of the above User Identifiers in the case details.

MAS User and Identity Details:

[https://www.ibm.com/docs/en/mas85/8.5.0?topic=administering-configuring-suite#users-id-section](https://www.ibm.com/docs/en/mas85/8.5.0?topic=administering-configuring-suiteusers-id-section)

MAS SAML Authentication:

[https://www.ibm.com/docs/en/mas86/8.6.0?topic=administering-configuring-suite#sa](https://www.ibm.com/docs/en/mas86/8.6.0?topic=administering-configuring-suitesa)





 LDAP user registry synchronization 

User registry synchronization simplifies Maximo Application Suite user management by synchronizing users and groups between an LDAP server and your local Maximo Application Suite user registry. To initiate the LDAP Authentication setup you will need to submit a case to the IBM Support Community with the following details.

Configuration parameters

LDAP domain attributes:
curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/users/<userID>/profile" -H "accept: application/json" -H "authorization: Bearer <token>"

Example response:

{
"id": "a0791903-ed4c-41cf-bd0e-a37957dad820",
"name": "David Test-user",
"email": "dave.test@domain.com",
"picture": "https://platform-lookaside.fbsbx.com/platform/profilepic/?asid=11122233344455566&height=50&width=50&ext=1569429199&hash=AaAaAAAAAaAAAaaA",
"identities": [
{
"provider": "facebook",
"id": "11122233344455566",
"idpUserInfo": {
"id": "11122233344455566",
"name": "David Test-user",
"picture": {
"data": {
"height": 50,
"is_silhouette": false,
"url": "https://platform-lookaside.fbsbx.com/platform/profilepic/?asid=11122233344455566&height=50&width=50&ext=1569429199&hash=AaAaAAAAAaAAAaaA",
"width": 50
}
},
"first_name": "David",
"last_name": "Test-user",
"email": "dave.test@domain.com",
"idpType": "facebook"
}
}
],
"attributes": {
"role": "admin"
}
}
reason The reason for an MFA failure. For example, user locked out - exceeded maximum number of verification attempts. 
 device_type The type of device with which your user accesses your application. Options include: web, mobile. 
 source_ip The IP address of the device that makes the request to your app. For example, 127.0.0.1. 
 headers The information that is returned by the browser when a user attempts to sign in to your app. The header looks similar to {"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0"}. 
 tenant_id Your application's tenant ID. 
 client_id Your application's client ID. 
 user_id The ID of the user that makes the authentication request. 
 username The username of the user that makes the authentication request. For example, testuser@email.com. 
 application_type The type of your application. For example, if your application is a single page JavaScript web app, browserapp is returned. Options include: browserapp, serverapp, and mobileapp. 
 first_name The users given name. 
 last_name The users surname. 



2. Register your extension with your instance of App ID by making a PUT request to config/cloud_directory/mfa/extensions/postmfa. The configuration includes your extension's URL and any authorization information that is needed to access the endpoint. For development purposes, isActive is set to false. Be sure to test your configuration before you enable it.

curl -X PUT https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/config/cloud_directory/mfa/extensions/postmfa' --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization: Bearer <IAMToken>' -d '{
"isActive": false,
"config": {
"url": "<extensionsURL>",