vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* persistent: 'urn:oasis:names:tc:SAML:1.1:nameid-format:persistent',
* unspecified: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
* windowsDomainQualifiedName:'urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName',
* x509SubjectName: 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName',



Note: When creating a case requesting your SAML SSO setup please include one of the above User Identifiers in the case details.

MAS User and Identity Details:

[https://www.ibm.com/docs/en/mas85/8.5.0?topic=administering-configuring-suite#users-id-section](https://www.ibm.com/docs/en/mas85/8.5.0?topic=administering-configuring-suiteusers-id-section)

MAS SAML Authentication:

[https://www.ibm.com/docs/en/mas86/8.6.0?topic=administering-configuring-suite#sa](https://www.ibm.com/docs/en/mas86/8.6.0?topic=administering-configuring-suitesa)





 LDAP user registry synchronization 

User registry synchronization simplifies Maximo Application Suite user management by synchronizing users and groups between an LDAP server and your local Maximo Application Suite user registry. To initiate the LDAP Authentication setup you will need to submit a case to the IBM Support Community with the following details.

Configuration parameters

LDAP domain attributes:



* URL – ldaps://hostname:port
* Bind DN
* Bind Password
* Base DN
* User ID map



User synchronization:



* User Base DN
* User ID map
* User filter



Group synchronization:
* The ml access group can access QR-ml and QR-common. This access group needs a dynamic rule for the App ID IDP that accepts users whose project attribute contains ml.
* The finance access group can access QR-finance and QR-common. This access group needs a dynamic rule for the App ID IDP that accepts users whose project attribute contains finance.



5. The IDP administrator uses the App ID instance that the Cloud administrator created and defines the three users:



* For Fatima, the custom attributes contain {"project":"ml"}.
* For Ravi, the custom attributes contain {"project":"finance"}.
* For Amyra, the custom attributes contain {"project":"ml finance"}.



6. Users can log in through the ID provider URL, create API keys, and work with their projects' service instances.







 Next steps 



* For more information, see [additional considerations](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-considerations-org).
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:container-registry::::serviceRole:Manager"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "container-registry"
}
]
}
]
}

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value("IBMid-123453user")
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();

PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:container-registry::::serviceRole:Manager")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
.value("ACCOUNT_ID")
.operator("stringEquals")
.build();

ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
.name("serviceName")
.value("container-registry")
.operator("stringEquals")
.build();

PolicyResource policyResources = new PolicyResource.Builder()
"originalId": "3f3f6779-7978-4383-926f-a43aef3b724b",
"name": {
"givenName": "John",
"familyName": "Doe",
"formatted": "John Doe"
},
"displayName": "John Doe",
"emails":
{
"value": "user@example.com",
"primary": true
}
],
"status": "PENDING"
},
"displayName": "Jane-Doe",
"emails":
{
"value": "jdoe@example.com",
"primary": true
}
],
"status": "PENDING"
},
"passwordHash": "<passwordHashHere>",
"passwordHashAlg": <passwordHashAlgorithm>,
"profile": {
"attributes": {}
},
"roles": ]
}
]}'
Show more







 Migration script for smaller exports and imports 

App ID provides a migration script that you can use through the CLI that can help speed up the migration process when you use the export or import API endpoints. Alternatively, to make the migration process even more efficient, you can use the [export/all](https://cloud.ibm.com/docs/appid?topic=appid-cd-userscd-export-all) and [import/all](https://cloud.ibm.com/docs/appid?topic=appid-cd-userscd-import-all) API endpoints.



1. Clone the [repository](https://github.com/ibm-cloud-security/appid-sample-code-snippets/tree/master/export-import-cloud-directory-users).
"iam_id": "$SERVICE_ID",
"status_code": 400,
"trace": "12345678-abcd-1a2b-a1b2-1234567890ab",
"errors":
{
"code": "error_occurred",
"message": "The service id is missing or incorrect"
}
]
}
]
}

{
"members": [
{
"iam_id": "$IBM_ID",
"type": "user",
"created_at": "2019-01-01T01:01:00Z",
"created_by_id": "CREATOR_ID",
"status_code": 200
},
{
"iam_id": "$SERVICE_ID",
"status_code": 400,
"trace": "12345678-abcd-1a2b-a1b2-1234567890ab",
"errors":
{
"code": "error_occurred",
"message": "The service id is missing or incorrect"
}
]
}
]
}







 Add users to your access groups by using Terraform 

Before you can add users to your access groups by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language.
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:11:0c:c9:9e:47:d8:38:aa:c7:24:65:90:98:a3:
42:a8:b0:18:3e:03:43:13:ae:64:6a:18:93:6e:06:
23:30:09:c1:93:66:5f:0d:d6:37:1b:a0:c4:e9:cb:
9b:70:63:9a:af:08:20:f2:96:b8:de:3b:c5:6e:58:
a9:9e:fa:d6:de
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
E4:86:14:C1:58:21:D8:6F:B4:79:E5:41:3B:14:9B:3D:C6:36:87:36
X509v3 Authority Key Identifier:
keyid:70:CA:7D:2E:5A:75:A2:90:27:8C:5D:7D:C7:AF:F1:2C:E1:25:59:70

1.2.3.4.5.6.7.8.1:
{"attrs":{"hf.Affiliation":"org1.department1","hf.EnrollmentID":"user1","hf.Type":"client"}}
Signature Algorithm: ecdsa-with-SHA256
30:44:02:20:1a:38:64:47:69:6b:31:e4:96:bc:52:06:71:75:
7. Enter the profile ID of the trusted profile. If you do not have the profile ID, see [Updating a trusted profile](https://cloud.ibm.com/docs/account?topic=account-catalog-cross-validatione&interface=uiupdate-create-profile).
8. Click the checkbox to indicate that you set you service authorization for Schematics and Catalog management.
9. Click the checkbox to indicate that you created a trusted profile and added the catalog CRN as a trust relationship.
10. Click Add > Update.



Users can now use the added target account to validate and add scans to any product version in the private catalog.
When a user signs up for your app, they are added to your directory of users. This option gives your users more freedom to manage their own account within your app.





 App ID integrations with IBM Cloud services 

You can use App ID with other IBM Cloud offerings. For example, if you're using Red Hat OpenShift on IBM Cloud, you can configure Ingress in your cluster to secure your apps at the cluster level. For more details, see [Setting up Ingress](https://cloud.ibm.com/docs/openshift?topic=openshift-ingress-roks4) and [App ID authentication Ingress annotation](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationsapp-id-authenticationh) to get started.





 Related controls in IBM Cloud Framework for Financial Services 

The following IBM Cloud Framework for Financial Services controls are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you have met the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Access Control (AC) [AC-2 Account Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2) <br>[AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5) <br>[AC-6 Least Privilege](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6)
"value": "<instance-id>"
}
]
}
],
"roles": [
{
"role_id": "crn:v1:bluemix:public:iam::::serviceRole:Reader"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "<account-id>"
},
{
"name": "serviceName",
"value": "<service-name>"
},
{
"name": "serviceInstance",
"value": "<instance-id>"
},
{
"name": "resourceType",
"value": "<resource-type>"
},
{
"name": "resource",
"value": "<id>"
}
]
}
]
}'

SubjectAttribute accountSubjectAttribute = new SubjectAttribute.Builder()
.name("accountId")
.value(exampleAccountId)
.build();

SubjectAttribute serviceNameSubjectAttribute = new SubjectAttribute.Builder()
.name("serviceName")
.value(exampleSourceServiceName)
.build();

SubjectAttribute serviceInstanceSubjectAttribute = new SubjectAttribute.Builder()
.name("serviceInstance")
.value(exampleSourceServiceInstanceId)
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(accountSubjectAttribute)
.addAttributes(serviceNameSubjectAttribute)
.addAttributes(serviceInstanceSubjectAttribute)
.build();
For any additional members of your IBM Cloud account, you have the option to use normal or federated IBMid users as IBM Cloud account members. Alternatively, you can connect your IdP to your IBM Cloud account by using an IBM Cloud App ID service instance. All users that log in through that IBM Cloud App ID service instance are added to your account automatically, so you don't need to invite those users.





 How do you onboard IBM Cloud account members? 

IBM Cloud accounts have access to all IBMid users, federated and non-federated. IBMid users must be invited to your IBM Cloud account. As a consequence, the same IBMid user can be member of multiple IBM Cloud accounts at the same time. In the IBM Cloud console, the IBMid user can select the account in which this user is working.

During configuration of your IBM Cloud App ID service instance, you connect the service instance with your IBM Cloud account. Therefore, users that log in by using this service instance can be member of this only one account. Those users will be automatically added to your IBM Cloud account when they authenticate the first time.





 Comparing federation options 

The following table compares characteristics of each federation option. In both cases, the assumption is that the customer connects either an IBMid or an IBM Cloud App ID instance with their IdP with SAML.



Table 1. Compare characteristics of the federation options, IBMid and App ID.

 IBMid App ID 

 Email address Users must have a globally unique email address. For example, [firstname.lastname@example.com](mailto:firstname.lastname@example.com). If your company's email domain is already federated, you can start configuring access to your account. If it's not already federated, a manual process with the IBMid federation team is required to establish federation. During the federation setup process, the customer collaborates with the IBMid federation team to define which email pattern matches with the IdP users. The decision to federate to your company's own user directory needs to involve the person in your company that can make company-wide decisions when it comes to connecting to external parties for identity services. You need to ensure that this person is included in the process.
issuerIdentifier="<region>.appid.cloud.ibm.com/oauth/v4/<tenantID>"
signatureAlgorithm="RS256"
audiences="{client-id}"
sslRef="oidcClientSSL"
/>



Table 1. OIDC element variables for Liberty for Java apps

 Variable Description 

 id The name of your application. 
 inboundPropagation To propagate the information received in the token, the value must be set to "required". 
 jwkEndpointUrl The endpoint that is used to obtain keys in to validate the token. Learn more about the [available regions](https://cloud.ibm.com/docs/appid?topic=appid-regions-endpoints). You can find your tenant ID in the credentials that you previously created. 
 issuerIdentifier The issuer identifier defines your authorization server. Learn more about the [available regions](https://cloud.ibm.com/docs/appid?topic=appid-regions-endpoints). You can find your tenant ID in the credentials that you previously created. 
 signatureAlgorithm Specified as "RS256". 
 audiences By default, the token is issued for your App ID client ID that can be found in your application credentials. 
 sslRef The name of the SSL configuration that you want to use. 



5. Define your special subject type as ALL_AUTHENTICATED_USERS.

<application
id="simple-liberty-backend-app"
location="location-of-your-war-file"
name="simple-liberty-backend-app"
type="war">

<application-bnd>
<security-role name="myrole">
<special-subject type="ALL_AUTHENTICATED_USERS"/>
</security-role>
</application-bnd>
</application>







 Step 3: Configure your web.xml fileweb.xml file
,
"addressType": "IPv4"
},
"credential": {
"type": "token"
}
},
"target": {
"id": "crn:v1:bluemix:public:user-management:global:a/account1234:::",
"typeURI": "user-management/user",
"name": "IBMid-12345",
"host": {
"address": "user-management.cloud.ibm.com"
}
}





 Restrict IP addresses 

When you configure IP address restrictions from the IP address restrictions section, you get 1 event with action user-management.user-setting.update.

For example, see the requestData field for the event user-management.user-setting.update:

{
"action": "user-management.user-setting.update",
"message": "IAM User Management: update user-setting user@company.com",
"requestData": {
"totalNumberChanges": 1,
"update": [
{
"ips_added":
{
"address": "241.211.116.250",
"addressType": "IPv4"
},
{
"address": "89.78.194.127",
"addressType": "IPv4"
},
{
"address": "40.190.11.111",
"addressType": "IPv4"
},
{
"address": "246.140.117.83",
"addressType": "IPv4"
},
],
"updateType": "allowed_ip_addresses changes"
}
]





 Manage user's login 

When you modify information about a user's login from the Manage > Access IAM > Users > User Details section, you get 1 event with action user-management.user-setting.update.
auth_request_set $_oauth2_<App_ID_service_instance_name>_upstream_1 $upstream_cookie__oauth2_<App_ID_service_instance_name>_1;
auth_request_set $access_token $upstream_http_x_auth_request_access_token;
auth_request_set $id_token $upstream_http_authorization;
access_by_lua_block {
if ngx.var._oauth2_<App_ID_service_instance_name>_upstream_1 = "" then
ngx.header["Set-Cookie"] = "_oauth2_<App_ID_service_instance_name>_1=" .. ngx.var._oauth2_<App_ID_service_instance_name>_upstream_1 .. ngx.var.auth_cookie:match("(; .)")
end
if ngx.var.id_token = "" and ngx.var.access_token = "" then
ngx.req.set_header("Authorization", "Bearer " .. ngx.var.access_token .. " " .. ngx.var.id_token:match("%sBearer%s(.)"))
end
}
...
Show more



4. Optional: If your app supports the [web app strategy](https://cloud.ibm.com/docs/appid?topic=appid-key-conceptsterm-web-strategy) in addition to or instead of the [API strategy](https://cloud.ibm.com/docs/appid?topic=appid-key-conceptsterm-api-strategy), add the nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2-<App_ID_service_instance_name>/start?rd=$escaped_request_uri annotation.
This access group nees a dynamic rule for the App ID IDP that accepts users whose project attribute contains finance.



5. The ID provider administrator defines the three users in the IBM Cloud user interface.
6. Users log in at least once.
7. The cloud administrator assigns access by adding users to the access groups that give them access to the projects:



* Fatima is given access to the ml project.
* Ravi is given access to the finance project.
* Amyra is given access to the ml and finanace projects.



8. Users can log in through the ID provider URL, create API keys, and work with their projects' service instances.







 Next steps 



* For more information, see [additional considerations](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-considerations-org).
"hf.GenCRL": true,
"hf.Registrar.Attributes": "",
"hf.AffiliationMgr": true
}
}
]
},
"affiliations": {
"ibp": []
},
}
}
Show more

You can insert additional fields or modify the JSON that is visible in the Configuration JSON box. For example, if you want to deploy a CA and override only the csr names values, you can edit the values in the JSON. But if you wanted to change the value of the passwordattempts field you would insert it into the JSON as follows:

{
"ca": {
"csr": {
"cn": "<COMMONNAME>",
"keyrequest": {
"algo": "ecdsa",
"size": 256
},
"names": [
{
"C": "US",
"ST": "North Carolina",
"L": "Location",
"O": "Hyperledger",
"OU": "Fabric"
}
],
"hosts": [
"<HOSTNAME>"
],
"ca": {
"expiry": "131400h",
"pathlength": 1024
}
},
"debug": false,
"registry": {
"maxenrollments": -1,
"identities": [
{
"name": "<ADMIN_ID>",
"pass": "<ADMIN_PWD>",
"type": "client",
"attrs": {
"hf.Registrar.Roles": "",
"hf.Registrar.DelegateRoles": "",
"hf.Revoker": true,
"hf.IntermediateCA": true,
This way, your own SAML attributes can give you an idea of how to structure the trusted profile conditions. Other users with the same IdP can have different SAML attributes and you should use your own only as a hint. To use attributes in a claim that are different than your own, input them manually.

The conditions that you create filter out or allow federated users to apply the trusted profile depending on which attributes the federated users are assigned in your corporate user directory. When you create a trusted profile, you can view IdP data to see your own user claims from your organizations corporate user directory.

Let's say there is an attribute that is called groups that identifies departments, teams, and more granular internal organizations within your company. If there are developers in the US on the finance team that need the same level of access for a project, you might create a trusted profile the following conditions:



* Allow users when groups equals finance-dev
* Allow users when country equals us



To make sure that your conditions allow only the federated users you intend to grant access to, contact your corporate directory architect for more information on available attributes.

For more information about the fields that are used to create conditions, see [IAM condition properties](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties).

It is recommended to create narrow conditions. You share the same IdP URL as everyone in your organization, so if a claim rule is too open, you might let users apply a trusted profile with access to your account unintentionally.
"address": "246.140.117.83",
"addressType": "IPv4"
},
],
"updateType": "allowed_ip_addresses changes"
}
]





 Manage user's login 

When you modify information about a user's login from the Manage > Access IAM > Users > User Details section, you get 1 event with action user-management.user-setting.update.

See the sample of the requestData field when the User-managed login property is disabled:

{
"action": "user-management.user-setting.update",
"message": "IAM User Management: update user-setting user@company.com",
"requestData": {
"totalNumberChanges": 1,
"update": [
{
"initialValue": true,
"newValue": false,
"updateType": "self_manage update"
}
]
}

See the sample of the requestData field when the User one-time passcode authentication property is enabled. The requestData.2FA field is set to true.

{
"action": "user-management.user-setting.update",
"message": "IAM User Management: update user-setting user@company.com",
"requestData": {
"totalNumberChanges": 1,
"update": [
{
"initialValue": false,
"newValue": true,
"updateType": "2FA update"
},
]
}

See the sample of the requestData field when the Require MFA security questions at login: property is enabled. The requestData.security_questions_setup field is set to true.

{
"action": "user-management.user-setting.update",
"message": "IAM User Management: update user-setting user@company.com",
"requestData": {
"totalNumberChanges": 1,
entityID The globally unique name for a SAML identity provider. 
 displayName The name that you assign to your SAML configuration. 
 primary-certificate-example-pem-format The certificate that is issued by your SAML identity provider. It is used for signing and validating SAML assertions. All providers are different, but you might be able to download the signing certificate from your identity provider. The certificate must be in .pem format. 
 Optional: secondary-certificate-example-pem-format The backup certificate that is issued by your SAML identity provider. It is used if signature validation fails with the primary certificate. Note: If the signing key remains the same, App ID does not block authentication for expired certificates. 
 Optional: authnContext The authentication context is used to verify the quality of the authentication and SAML assertions. You can add an authentication context by adding a class array and comparison string to your code. BE sure to update both the class and comparison parameters with your values. For example, a class parameter might look similar to urn:oasis:names:tc:SAML:2.0:ac:classes:YourChosenClassValue. 
 Optional: signRequest The signRequest flag provides the capability to send a signed SAML request to an identity provider that is signed by using the tenant's SAML signing private key. To configure your SAML identity provider to receive a signed request, you need the signing certificate from the metadata file that you can download in the KeyDescriptor use="signing" field. By default, request signing is set to off. 
 Optional: encryptResponse The encryptResponse flag allows for you to receive an encrypted response from your identity provider as part of the authentication request. To configure your SAML identity provider to send an encrypted response, you need the encryption certificate that can be found in the metadata file in the KeyDescriptor use="encryption" field. By default, response encryption is set to off. 



3.
kituraCredentials.register(plugin: webappKituraCredentialsPlugin)



4. By using the attributes endpoint, make a PUT request.



* Curl
* Java
* Node
* Swift
* Swift



curl -X PUT "https://<region>.appid.cloud.ibm.com/api/v1/attributes/<attributeName>" -H "Authorization: Bearer <token>" -d "<attributeValue>"

appId.getUserProfileManager().setAttribute(name, value, useThisToken, new UserProfileResponseListener() {
@Override
public void onSuccess(JSONObject attributes) {
// attributes received in JSON format on successful response
}

@Override
public void onFailure(UserAttributesException e) {
// exception occurred
}
});

const userProfileManager = require("ibmcloud-appid").UserProfileManager;
userProfileManager.init();

var accessToken = req.session[WebAppStrategy.AUTH_CONTEXT].accessToken;

userProfileManager.setAttribute(accessToken, name, value).then(function (attributes) {
// attributes returned as dictionary
});

// iOS Swift example

AppID.sharedInstance.userProfileManager?.setAttribute("key", "value") { (error, result) in
guard let result = result, error == nil else {
return // an error has occurred
}
// attributes recieved as a Dictionary
})

// Server-side Swift

let userProfileManager = UserProfileManager(options: options)
let accesstoken = "access token"