vania-janet/multiturn-rag-retrieval-data huggingface dataset:
CRN crn:v1:bluemix:public:iam-identity::a/1a1111aa2b11111aaa1a1111aa2aa111::serviceid:ServiceId-a1a11111-bb11-1111-a11b-1111111a11bb
Version 1-bb11aa11a0aa1a11a011a1aaaa11a1bb
Locked false
5. Create an API key for your service ID. Replace <api-key-name> with a name for your API key and replace <service_ID_name> with the name of the service ID that you created. Be sure to save your API key as it can't be retrieved later. This API key is stored in a Kubernetes secret in your cluster in a later step.

ibmcloud iam service-api-key-create <api_key_name> <service_ID_name>
6. Retrieve a list of IAM-enabled services in your account and note the name of the Key Protect instance that you created.

ibmcloud resource service-instances
7. Retrieve the GUID of your Key Protect instance. The ID is used to create an IAM service policy for your service ID.

ibmcloud resource service-instance "<instance_name>" | grep GUID
8. [Create an IAM service policy](https://cloud.ibm.com/docs/cli/reference/ibmcloud?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_policy_create) to grant your service ID access to your Key Protect instance. The following command grants your service ID Reader access to your Key Protect instance. The Reader access role is the minimum service access role that your service ID must have to retrieve Key Protect keys. For more information, see [Managing user access for Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).
{ "token_endpoint_auth_method":"client_secret_basic", "client_id": "N3NzNVFsSjlLVkl6Zk5hZ01MRzJVaVdnbFcxNGl5cnQK", "client_secret": "VWNVNzF4ZUxNSVBQUHZHdG1xQmNsTTFOWmNUUGlnYUkK", "scope":"openid profile email", "grant_types":[ "authorization_code", "client_credentials", "password", "implicit", "refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer" ], "response_types":[ "code", "token", "id_token token" ], "application_type":"web", "subject_type":"public", "post_logout_redirect_uris":[" [https://icp-console.apps.test.ibm.com](https://icp-console.apps.test.ibm.com)"], "preauthorized_scope":"openid profile email general", "introspect_tokens":true, "trusted_uri_prefixes":[" [https://icp-console.apps.test.ibm.com/](https://icp-console.apps.test.ibm.com/)"], "redirect_uris":[" [https://icp-console.apps.test.ibm.com/auth/liberty/callback","https://www.cf-dev.test.ibm.com/oidc_login/redirect_uri](https://icp-console.apps.test.ibm.com/auth/liberty/callback%22,%22https://www.cf-dev.test.ibm.com/oidc_login/redirect_uri)"] }

1. Create a file named: 'registration.json based on the example template.
ibmcloud iam role-create PreviewCDCI --display-name "Preview Toolchains" --service-name toolchain --actions toolchain.dashboard.view --output JSON

Create a role that has a description:

ibmcloud iam role-create ServiceIDCreator --display-name "Service ID Creator" --service-name iam-identity --actions iam-identity.serviceid.create --description "Can only create service keys"







 ibmcloud iam access-policies 

List all access policies under the current account:

ibmcloud iam access-policies [-t, --type user | service_id | access_group | trusted_profile] [--sort-by id | type | href | created_at | created_by_id | last_modified_at | last_modified_by_id | state ] [--output FORMAT] [-q, --quiet ] [--api-version v1 | v2]



 Command options 

-t, --type ACCESS_POLICY_TYPE
: List all access policies under current account filtered by policy type. Valid options are: user | service_id | access_group | trusted_profile

--sort-by ATTRIBUTE
: Sort the policies based on attributes. Valid options are: id | type | href | created_at | created_by_id | last_modified_at | last_modified_by_id | state. Prepend a minus (for example, -id, -type) for reverse sorting.

--output FORMAT
: Specify output format. Only 'JSON' is supported.

-q, --quiet
: Suppress verbose output.

--api-version
: Version of the access policy API.





 Examples 

List all access policies under the current account:

ibmcloud iam access-policies

List all user access policies under the current account:

ibmcloud iam access-policies --type user

List all service ID access policies under the current account:

ibmcloud iam access-policies --type service_id

List all access group access policies under the current account:
host: f6cf0c55-48ea-4908-b441-a962b27d3bb6-bluemix.cloudant.com
iam_apikey_description: Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloudantnosqldb:us-south:a/b42116849bb7e2abb0841ca25d28ee4c:ee78351d-82bf-4e80-bc22-825c937fafa3::
iam_serviceid_crn: crn:v1:bluemix:public:iam-identity::a/b42116849bb7e2abb0841ca25d28ee4c::serviceid:ServiceId-53f9e2a2-cdfb-4f90-b072-bfffafb68b3e
password: 581138...7d48d61
Show more
3. Populate the URL with the internal endpoint, and create the credentials by using a command similar to the following example.

ibmcloud resource service-key-create creds_for_cs20170517a Manager --instance-name cs20170517a -p '{"service-endpoints":"internal"}'
4. Review the request response in a message similar to the following example.

Creating service key in resource group default of account John Does's Account as john.doe@email.com...
OK
Service key crn:v1:bluemix:public:cloudantnosqldb:us-south:a/b42223455bb7e2abb0841ca25d28ee4c:ee78351d-82bf-4e80-bc22-825c937fafa3:resource-key:621ffde2-ea10-4318-b297-d6d849cec48a was created.

Name: creds_for_cs20170517a
Command examples 



* ibmcloud is vpn-server-create --subnet 0726-a7191f77-7c87-4ad4-bb11-a37f9e9fc0f0,0736-4b871e22-e819-4f87-bb17-e457a88246a2 --cert crn:v1:bluemix:public:secrets-manager:us-south:a/aa5a471f75bc456fac416bf02c4ba6de:aace9348-39da-4498-b132-e5ab918237f4:secret:e3bd96ce-1e4c-f642-d1f2-0d0ab025f510 --client-ip-pool 192.168.0.0/20 --client-auth-methods certificate --client-ca crn:v1:bluemix:public:secrets-manager:us-south:a/aa5a471f75bc456fac416bf02c4ba6de:aace9348-39da-4498-b132-e5ab918237f4:secret:e3bd96ce-1e4c-f642-d1f2-0d0ab025f514
$ KEY_ID=$(ibmcloud kp key create credentials-key -i $KP_INSTANCE_ID --key-material $ENCODED --standard-key --output json | jq -r '.["id"]')

{
"id": "8480e26f-3add-4fff-bca7-8cf908894b7c",
"name": "credentials-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": true,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:8480e26f-3add-4fff-bca7-8cf908894b7c",
"deleted": false
}

 retrieve the base64-encoded payload
$ ibmcloud kp key show $KEY_ID --output json

 OR... CAPTURE THE PAYLOAD
$ PAYLOAD=$(ibmcloud kp key show $KEY_ID --output json | jq -r '.["payload"]')

{
"id": "8480e26f-3add-4fff-bca7-8cf908894b7c",
"name": "credentials-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-08-18T16:13:08Z",
* ibmcloud is instance-create my-instance-name 72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 us-south-1 bx2-2x8 72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 --image r123-72b27b5c-f4b0-48bb-b954-5becc7c1dcb8 --network-interface '[{"name": "secondary-nic", "allow_ip_spoofing": true, "subnet": {"id":"72b27b5c-f4b0-48bb-b954-5becc7c1dcb3"}, "security_groups": {"id": "72b27b5c-f4b0-48bb-b954-5becc7c1dcb8"}, {"id": "72b27b5c-f4b0-48bb-b954-5becc7c1dcb3"}]}]' Create instance that is attached to secondary network interface.
* Go
* Node



curl -X POST 'https://iam.cloud.ibm.com/v1/apikeys' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json' -d '{
"name": "Service-apikey",
"description": "my service key",
"iam_id": "IBMid-123WEREW",
"account_id": "ACCOUNT_ID"
"store_value": false
}'

CreateApiKeyOptions createApiKeyOptions = new CreateApiKeyOptions.Builder()
.name(apiKeyName)
.iamId(iamId)
.description("Example ApiKey")
.build();

Response<ApiKey> response = service.createApiKey(createApiKeyOptions).execute();
ApiKey apiKey = response.getResult();
apikeyId = apiKey.getId();
System.out.println(apiKey.toString());

api_key = iam_identity_service.create_api_key(
name=apikey_name,
iam_id=iam_id
).get_result()

apikey_id = api_key['id']

print(json.dumps(api_key, indent=2))

createAPIKeyOptions := iamIdentityService.NewCreateAPIKeyOptions(apikeyName, iamID)
createAPIKeyOptions.SetDescription("Example ApiKey")

apiKey, response, err := iamIdentityService.CreateAPIKey(createAPIKeyOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(apiKey, "", " ")
fmt.Println(string(b))
apikeyID = apiKey.ID

const params = {
The following table summarizes the options that are used with the iam service-policy-create command in this example. For more information about the command and its options, see the [ibmcloud iam service-policy-create](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_policy_create) command.



Table 5. iam service-policy-create command components

 Option Description 

 <service_ID> Required. Replace with the codeengine-<project_name>-id service ID that you previously created. 
 --roles <platform_access_role> Required. Enter the platform access role that you want to scope the service ID access to. Possible values are Administrator, Editor, Operator, and Viewer. Your service ID requires Operator or higher. 
 --service-name <iam-identity> Required. Enter iam-identity to create an IAM policy for IAM identify services. 



4. Create an API key for the service ID with the iam service-api-key-create command. For a complete listing of the iam service-api-key-create command and its options, see the [ibmcloud iam service-api-key-create](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_api_key_create) command. Name the API key similar to your service ID, and include the service ID that you previously created, codeengine-<project_name>-id. Be sure to give the API key a description that helps you retrieve the key later.

For example, the following command creates a key that is called codeengine-myproject-key for the codeengine-myproject-id service ID with a description of API key for service ID codeengine-myproject-id for Code Engine myproject:
ibmcloud iam api-key-create <API_key_name>
[-d, --description <description>]
[--file <API_key_file_name>]

Specify the API key a unique name with the <API_key_name> parameter. Make sure to save your API key for later use by either using the <API_key_file_name> parameter or copying the API key value from the command response.
* If you want to retrieve an access token for an application, create a service ID API key by completing the following steps:



1. Create a [service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidscreate_serviceid) for your application with the following command:

ibmcloud iam service-id-create <service_ID_name>
[-d, --description <description>]

Specify the service ID a unique name with the <service_ID_name> parameter.
2. Create a service ID API key with the following command:

ibmcloud iam service-api-key-create <API_key_name> <service_ID_name>
[-d, --description <description>]
[--file <API_key_file_name>]

Specify the API key a unique name with the <API_key_name> parameter and replace <service_ID_name> with the unique alias that you assigned to your service ID in the previous step. Make sure to save your API key for later use by either using the <API_key_file_name> parameter or copying the API key value from the command response.





4. [Assign the user or the service ID the appropriate access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources) to your Hyper Protect Crypto Services instance based on your access policy.

To learn how the IAM access roles map to specific Hyper Protect Crypto Services service actions, see [Roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessroles).
5.
Manager <br><br> * All Writer actions.<br> * Export your Cloud Directory users and their data from your App ID instance.<br> * Import your Cloud Directory users into a new instance of App ID.<br> * Export all the user profiles in an instance of App ID.<br> * Import all the user profiles that you exported into a new instance of App ID.<br><br><br> 



For more information about assigning user roles in the UI, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).
Establishing trust with federated users by using the CLI 

Complete the following steps to define which federated users can access specific resources:



1. [Enable authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).
2. Create a trusted profile by running the following command:

ibmcloud iam trusted-profile-create my-profile -d "sample trusted profile"

For more information, see the [CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_create).
3. To create conditions for your trusted profile, run the ibmcloud iam trusted-profile-rule-create command:

ibmcloud iam trusted-profile-rule-create my-profile --name my-rule --type Profile-SAML --conditions claim:cn,operator:EQUALS,value:my_user --realm-name https://w3id.sso.ibm.com/auth/sps/samlidp2/saml20 --expiration 1200

For more information, see the [CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_rule_create).
4. Create an access policy with the Viewer role for all resources in the account by running the following command:

ibmcloud iam trusted-profile-policy-create --roles Viewer

For more information, see the [CLI reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_trusted_profile_policy_create).







 Establishing trust with compute resources by using the CLI 

Complete the following steps to set up better control over granting access to compute resources.

IBM Cloud Kubernetes Service supports only trusted profiles for versions 1.21 and newer. Free IBM Cloud Kubernetes Service clusters create only earlier versions.
-H "Authorization: Bearer <IAM_Token>"
-H 'Content-Type: application/json'
-d '{
"parent": "crn:v1:bluemix:public:enterprise::a/$ENTERPRISE_ACCOUNT_ID::enterprise:$ENTERPRISE_ID",
"name": "Example Account Group",
"primary_contact_iam_id": "$PRIMARY_CONTACT_IAM_ID"
}'

CreateAccountGroupOptions createAccountGroupOptions = new CreateAccountGroupOptions.Builder()
.parent(parentCRN)
.name("Example Account Group")
.primaryContactIamId(enterpriseAccountIamId)
.build();

Response<CreateAccountGroupResponse> response = service.createAccountGroup(createAccountGroupOptions).execute();
CreateAccountGroupResponse createAccountGroupResponse = response.getResult();

System.out.println(createAccountGroupResponse);

create_account_group_response = enterprise_management_service.create_account_group(
parent=parent_crn,
name='Example Account Group',
primary_contact_iam_id=enterprise_account_iam_id,
).get_result()

print(json.dumps(create_account_group_response, indent=2))

createAccountGroupOptions := enterpriseManagementService.NewCreateAccountGroupOptions(
parentCRN,
"Example Account Group",
enterpriseAccountIamID,
)

createAccountGroupResponse, response, err := enterpriseManagementService.CreateAccountGroup(createAccountGroupOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(createAccountGroupResponse, "", " ")
version_crn="crn:v1:bluemix:public:globalcatalog-collection:global::1082e7d2-5e2f-0a11-a3bc-f88a8e1931fc:version:00111601-0ec5-41ac-b142-96d1e64e6442-global/ec66bec2-6a33-42d6-9323-26dd4dc8875d-global"







 Create an instance 

Create an instance in the newly created subnet. Pass in your public SSH key so that you can log in after the instance is provisioned. Run one of the following API calls based on the image you plan to use.



* Select a stock image or a custom image from your account for your instance.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
"name": "my-instance",
"zone": {
"name": "us-south-3"
},
"vpc": {
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"image": {
"id": "'$image_id'"
}
}'
Show more
* Create an instance using a private catalog image from the latest version of a catalog product offering.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
"name": "my-instance",
"zone": {
role_id: 'crn:v1:bluemix:public:iam::::serviceRole:Reader',
},
];
const accountIdResourceAttribute = {
name: 'accountId',
value: exampleAccountId,
operator: 'stringEquals',
};
const serviceNameResourceAttribute = {
name: 'serviceName',
value: exampleTargetServiceName,
operator: 'stringEquals',
};
const serviceInstanceResourceAttribute = {
name: 'serviceInstance',
value: exampleTargetServiceInstanceId,
operator: 'stringEquals',
};
const resourceTypeResourceAttribute = {
name: 'resourceType',
value: exampleResourceType,
operator: 'stringEquals',
};
const resourceResourceAttribute = {
name: 'resource',
value: exampleResourceId,
operator: 'stringEquals',
};

const policyResources = [
{
attributes:
accountIdResourceAttribute,
serviceNameResourceAttribute,
serviceInstanceResourceAttribute,
resourceTypeResourceAttribute,
resourceResourceAttribute,
],
},
];
const params = {
type: 'authorization',
subjects: policySubjects,
roles: policyRoles,
resources: policyResources,
};

iamPolicyManagementService.createPolicy(params)
.then(res => {
examplePolicyId = res.result.id;
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
Subscriber Functions 

create_subscription

Arguments:
subscription_name Unique name to create the subscription channel with
host_ip Publisher hostname or public IP address
port Port number publisher is running on
username admin user created on the publisher
password Password of the admin user on the publisher
db_name The name of the database to be replicated
publisher_name The name of publisher channel on the publisher

Usage:
exampledb=> SELECT create_subscription('subs1','130.215.223.184','5432','password','admin','exampledb','my_publication');

delete_subscription

Arguments:
subscription_name Name the subscription channel to delete
db_name The name of the replicated database

Usage:
exampledb=> SELECT delete_subscription('subs1', 'exampledb');

list_subscriptions

Arguments:
None

Usage:
exampledb=> SELECT * FROM list_subscriptions();

disable_subscription

Arguments:
subscription_name Name the subscription channel to disable
db_name The name of the replicated database

Usage:
exampledb=> SELECT disable_subscription('subs1','exampledb');

enable_subscription

Arguments:
subscription_name Name the subscription channel to enable
db_name The name of the replicated database

Usage:
exampledb=> SELECT enable_subscription('subs1','exampledb');

refresh_subscription

This function is used to refresh a subscription on the subscriber after changes are made on the publisher, like adding or removing a table.

Arguments:
subscription_name Name the subscription channel to refresh
db_name The name of the replicated database

Usage:
exampledb=> SELECT refresh_subscription('subs1','exampledb');







 Setting up Logical Replication on the Publisher 

To configure your external PostgreSQL as a publisher,



* Edit your local pg_hba.conf and add the following
"implicit",
"refresh_token",
"urn:ietf:params:oauth:grant-type:jwt-bearer"
],
"response_types":[
"code",
"token",
"id_token token"
],
"application_type":"web",
"subject_type":"public",
"post_logout_redirect_uris":["https://cp-console.apps.mycluster.os.fyre.ibm.com"],
"preauthorized_scope":"openid profile email general",
"introspect_tokens":true,
"trusted_uri_prefixes":["https://cp-console.apps.mycluster.os.fyre.ibm.com/"],
"redirect_uris":["https://cp-console.apps.mycluster.os.fyre.ibm.com/auth/liberty/callback","https://inframgmtinstall.apps.mycluster.os.fyre.ibm.com/oidc_login/redirect_uri"]
}
Show more



1. Create a file named: registration.json based on the example template. Replace the values in the example template payload registration with the actual values based on your installation.



* <YOUR_CLIENT_ID> Your base64 encoded character string.
* <YOUR_CLIENT_SECRET> Your base64 encoded character string.

Note: The <YOUR_CLIENT_ID> and <YOUR_CLIENT_SECRET> were generated in [Generate client ID and client secret](https://cloud.ibm.com/docs/cloud-pak-multicloud-management?topic=cloud-pak-multicloud-management-getting-started-deploying-infrastructure-management-as-a-containerized-deployment-podifiedgen-client-id-and-client-secret).
ibmcloud iam service-id-create NAME [-d, --description DESCRIPTION] [--lock]



 Command options 

NAME (required)
: Name of the service.

-d, --description
: Description of the service ID.

--lock
: Lock the service ID during creation.





 Examples 

Create a service ID with service name sample-test and description hello, world!:

ibmcloud iam service-id-create sample-test -d 'hello, world!'

Create a locked service ID with service name sample-test and description hello, world!:

ibmcloud iam service-id-create sample-test -d 'hello, world!' --lock







 ibmcloud iam service-id-update 

Update a service ID:

ibmcloud iam service-id-update (NAME|UUID) [-n, --name NEW_NAME] [-d, --description DESCRIPTION] [-f, --force]



 Command options 

NAME (required)
: Name of the service, exclusive with UUID.

UUID (required)
: UUID of the service, exclusive with NAME.

-n, --name
: New name of the service.

-d, --description
: New description of the service.

-f, --force
: Update without confirmation.





 Examples 

Rename service ID sample-test to sample-test-2 without confirmation:

ibmcloud iam service-id-update sample-test -n sample-test-2 -f

Update description of service sample-test:

ibmcloud iam service-id-update sample-test -d 'hello, friend!'

Rename service ID ServiceId-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976 to sample-test-3 with new description:

ibmcloud iam service-id-update ServiceId-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976 -n sample-test-3 -d 'hello, my friends!'
"AccessGroupId--3087-4395-a382-a8e8ff9ccc23"
]
}'

InviteUser inviteUserModel = new InviteUser.Builder()
.email(memberEmail)
.accountRole("Member")
.build();

Role roleModel = new Role.Builder()
.roleId(viewerRoleId)
.build();

Attribute attributeModel = new Attribute.Builder()
.name("accountId")
.value(accountId)
.build();

Attribute attributeModel2 = new Attribute.Builder()
.name("resourceGroupId")
.value("")
.build();

Resource resourceModel = new Resource.Builder()
.addAttributes(attributeModel)
.addAttributes(attributeModel2)
.build();

InviteUserIamPolicy inviteUserIamPolicyModel = new InviteUserIamPolicy.Builder()
.type("access")
.addRoles(roleModel)
.addResources(resourceModel)
.build();

InviteUsersOptions inviteUsersOptions = new InviteUsersOptions.Builder()
.accountId(accountId)
.addUsers(inviteUserModel)
.addIamPolicy(inviteUserIamPolicyModel)
.addAccessGroups(accessGroupId)
.build();

Response<InvitedUserList> response = adminService.inviteUsers(inviteUsersOptions).execute();
InvitedUserList invitedUserList = response.getResult();

System.out.println(invitedUserList);

invite_user_model = {
'email': member_email,
'account_role': 'Member'
}

role_model = {'role_id': viewer_role_id}