From ab0b674b80a6ac4bb3eb3bacad3be41e733340cd Mon Sep 17 00:00:00 2001 From: Alex Fornuto Date: Fri, 11 Feb 2022 11:06:54 -0600 Subject: [PATCH] update Enterprise docs for 0.16.0 (#2993) * update Enterprise docs for 0.16.0 * Update docs/enterprise/upgrading.md Co-authored-by: Travis Groth * more docs, plus cross-links Co-authored-by: Travis Groth --- docs/docs/topics/device-identity.md | 3 +- docs/enterprise/console-settings.yaml | 30 ++++++++++++++ docs/enterprise/img/console-devices.png | Bin 0 -> 34313 bytes docs/enterprise/img/new-enrollment.png | Bin 0 -> 21017 bytes docs/enterprise/pomerium-console_serve.yaml | 5 +++ docs/enterprise/reference/config.md | 12 ++++++ docs/enterprise/reference/manage.md | 41 ++++++++++++++++++++ docs/enterprise/upgrading.md | 4 +- 8 files changed, 93 insertions(+), 2 deletions(-) create mode 100644 docs/enterprise/img/console-devices.png create mode 100644 docs/enterprise/img/new-enrollment.png diff --git a/docs/docs/topics/device-identity.md b/docs/docs/topics/device-identity.md index e57e8e9a8..c288fb263 100644 --- a/docs/docs/topics/device-identity.md +++ b/docs/docs/topics/device-identity.md @@ -58,7 +58,8 @@ Pomerium supports policies that use device identity since version [0.16.0](/docs To get started, review the following pages: - [Pomerium Policy Language](/docs/topics/ppl.md) to learn how to build policies that use device ID. -- [Enroll a Device](/guides/enroll-device.md) to teach end-users how to enroll devices on Pomerium. +- **End Users** should review [Enroll a Device](/guides/enroll-device.md) to learn how to enroll devices on Pomerium. In Enterprise environments, self-enrollments must be approved by an admin in the Enterprise Console. +- **Enterprise Administrators** can review the [Devices](/enterprise/reference/manage.html#devices) reference material to create pre-approved enrollment links for users. - [pomerium/webauthn](https://github.com/pomerium/webauthn) on GitHub, our implementation of the WebAuthn specification. ## Looking Ahead: Device Posture diff --git a/docs/enterprise/console-settings.yaml b/docs/enterprise/console-settings.yaml index a585d1257..14ce40cbf 100644 --- a/docs/enterprise/console-settings.yaml +++ b/docs/enterprise/console-settings.yaml @@ -170,6 +170,36 @@ settings: - **CORS Preflight**: Allow unauthenticated HTTP OPTIONS requests as per the CORS spec. - **Public Access**: This setting allows complete, unrestricted access to an associated route. Use this setting with caution. - name: "Certificates" + - name: "Devices" + doc: | + Introduced in v0.16.0, the **Manage Devices** page lets administrators manage user devices for policy-based authorization. + settings: + - name: "Manage Devices" + doc: | + From this page, administrators can manage new and existing device enrollments. + Device enrollment let's you create [policies](/docs/topics/ppl.html#device-matcher) that use [device identity](/docs/topics/device-identity.md). + - Users can [self-enroll](/guides/enroll-device.md) devices, which must then be approved in the **Devices List** for policies requiring approved devices. + - Administrators can use the **New Enrollment** button to create a link for the user to enroll a device as pre-approved. + + - name: "Devices List" + doc: | + Displays the currently enrolled devices for each user, along with their current approval status. + Administrators can inspect, approve, or delete registered devices from this table. + + ![List of user devices](../img/console-devices.png) + - name: "New Enrollment" + doc: | + The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved. + This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use). + + ![Example device enrollment](../img/new-enrollment.png) + settings: + - name: "Search Users" + doc: "New Enrollment URLs are only valid for the specified user." + - name: "Redirect URL" + doc: "**Required**: The URL the user will be taken to after device enrollment is successful." + - name: "Enrollment Type" + doc: "Specify if the user can enroll any device identity, or restrict it to a [secure enclave](/docs/topics/device-identity.md#secure-enclaves)." - name: "Configure" settings: - name: "Settings" diff --git a/docs/enterprise/img/console-devices.png b/docs/enterprise/img/console-devices.png new file mode 100644 index 0000000000000000000000000000000000000000..3e9de4bae6bd1d8b7dff7a68089b083d8d42ee41 GIT binary patch literal 34313 zcmd43byQSs+c#{12!e!kiK8GQAl;yVgD4@0bSNzy(y4$T=>USXh=kJJphyf|(hUPh z4joeOf!BRM_wzpQTHpKq_kFH)t!rSIJ$s+~IFIvJ=YID@L52{Y2LH^NGla4arIpW| zIX`md%vn;rbMPDe2&M5eXZ*TkrSGda53eNndyzjouJt+zy#DCfy*pXwKL5UrSCO+i zt*`M)MsKc<$s#29L>?SQ2mjVErT#NAm9vXtW>vhROFmis0{iOoo_$ zzhNyYD=Vv{q;&uOeNWHh)W^{qrypkW&Cvh!1AX^VFjY#EQwKUID2P+9Mh?HAu#ks` zr!z^y>(AE03EAI+d=7k#i}-nqOFx(a(VVfd!neVumXjAZI;y?%2!Btp(7Rf<(lJ}* z?}-H5#-$0qoKmk4rex$xZCS&P)KyXO-7_&V>c0A1vB2h^v#W9py^+#_$1@x(s+NbM zq@XD9v7hhIt8!N2;P`uX(!889AG?h))P6a45hhwfLPC3|rykk*&sAOU;YW1ddbO;4 zeDdaEruy!|Y-{v~@_*i|Keu7wQ*A(3vvG3HYW6ars!;m4?LS{@b?GV%3Yl(D-p%t3 zm9i5P6GO?VtMV5A@4L2{*Lr^QD(fH-oE#h_Q!^DGp8j)1+};mIyf@;+(?ttV^Yim2 zhK88Ax!Y|24EQZt_)LiAL;)%~GIDa`WY_B?oyhK=uWPw19HNrakGGRe?V_ZF3UO6p z{^zTd7?wNQCjD~`YXf#)85*V0%7<&@w@vmbs{-XI2_3wH>Q2z5< zB*%YV{Zj|Q+Q@&#+&5VJ?*-#gyL{l;I3Y+5lENbwOSWh64NNRMKd*q)o4BnUnK?wxPYv=~b^U82ekZ&aT|GkWeN$Fr8ZZr>h>5%;Kw>l!MT*R+|gf2Wj! z+{R9L?JN)Z`T4cTGOY?D^lClDZ0$M|#Y!u#KkyvPdm-Yq`l~zwr8c;&^W=%mgvajD zX41)4hx^`?zgDqXsxwo)Wws`R>+fWOB_xd4uFiEP z=~cUKA9&7`&nKpMvJzI;aBylK>g-^9Nk%pO%a^-e z135Z!iZR?b|9#{g+r?k3=1K$Ko)J)1ENtA_*`H4uc?Ea=584RhG>k5_o=}kATq&Jc zov59t?2i|+$GuE-*Yj|%txYbjdCO_SL*`s#Fm;MLLZvve9c@|EtSE6*WY%}vn#6vy z)N%wVZ?pAV$(TX-m1%tdNpo{^YZSY|Yg43^k^NYOgM|$Sjbc$u#AvbA6&kl!*v$rZ zjIn1+s;XtGw&OG}FE58l96K)$=EoOYkvM#BVLej9&SKu1Chz`u=XmYs6~pcNcVxZ2 zy)k4pAFV%KV{+PCn>tIP4%M)qY^Zcu&v^>x_+)P;%<6c1X<#5%Pr`ZadEg68O&a@9 zdXfGVnJW}-J3}Uxyps(;Z=L2SK}_k1GO+x^zx}dlHW>r1H0Kkj%6+8c0b-Tb|W4;o&_2{ zvq^Utk*)JrM4#m9R`Zy247vx#IV?VRsCQ-aX{5ETQc_o^>P8O*vG4m!945Qsjchzs z6l;*f7nxF;UyU;DO(WFsSGT{e9q~4e#3W?@ki`wP3~ekEt5fuaguLb>)}$F3LL;`> z#?yU0kC=M{|F!bYq|X(rv5F5H+Z`g=F<*yotsnm@Nc2w2|dZ^hY-u08aN!PcIL z^UQZ7JdT>4h9UJ@EuUYWHh8M%b+rBUY5G-j-)~Xs!H3N(Nz2&Rb2%}*IXkVKwRx9+ z#DAefp81l#-)Y+i`gFag?)vN-&*J4{p(u_L1*T5Bf$*)p-$N zRImNsqoR}OMI4{tjue}ln1ynTQmlume#%#pQN9_PLInUy}ez4XKa%GJ+X+-|95R$?<--y2%#hVAdJ zWMLc}4sBn&U?R)f zSUa(U`Au8=`4%*QdMivfGTRx8E@GgZaIcKBX$qyc%1@V+=CQLLGW3k&x3q9QIX-e< zo~W(u&{^)XSsctqlvpx;eZuImrS!(I%nYW;Fz!ZQhLX?Id)pSZxBgIMs^yMD4K0^+ z%J6Kg;bj#t8)9ZJcE0TT^!n(V;?@BsLeb)oL9cqFg-v>H?b&DQeW>D(RD5QUS{s?U zHToS3z3CpWqu;b0o*wD^=^d=h!K&$bd>F1HhcTd=fWT?cFHU`OV#rV!sK92vUf399_jl~dmO{}O(fye2TTw9;~;UmW=X!D)A z+&Z69*Leyh!;oK7RPDCAL5^hLI+vMs30heG4>w=c-GeV2}dh2Ff zziE|nkjqs%u9R`S6wxiSd7V4%y2MV~+mrg3lE%JFkY~Ov=4V@D2rXjzv`WWziFKC< zlE2NSAr+Pxe!uAc{D6x_h*8gd{ehdVj6V_m;;*lp&}df2t1H`(iShArbn1D}f6PF~ z-s)96ZHoizDfaW+zF%WNIlI-rAGO206_vob=a3Aa?i zXK2-~I^VVLOMlSV*LLiP+K>SOWrYuVnX2r! zec&WNvh~bG7-+vBq~*tao7NY0-^*)HAGU(agb^&;drL&`x-!g1UH+s`85dED_1Zt& z>@?uDV@sTKi5wM}aPMVsQ87j^LdV+f8ZI^`Ia1SgF=_}T&*C;{yqr)OfSH}$ULK0T zB_~WylaKQ}SSj7vYVPSGQ_CoCel~q${&$3;IFmuM+->Lhk>Jr%b(l}aieEecI0&U@ zYnAf<`}!{~r@Cy;ISQ1Zl9CjKJpL@C$GH6NV$$q(zfqxVk?m8!yQO-K;!~UB%5a}K zCeq{jy_v?4OAEY(a61iJVbZvL(r!hwZEv&texsQ6=|~`!e31L?6gA{nGpTI(!Y^*S zO8yH^Nt08&qAvf7wTZd^1qlr?|9SNfAVUK-`1h-SWBAtpiRKZ}|8H>IKj@9=e*(P! z;spPGWKdcY1K8{QW61gzdq=j8^KdS)9vJ1-BF)^}g5(%oVY% zE}tvn=o8IiGqHo^!guf9VU&mXKSV|C)RQS{m)T6EJzgEm_mTU^Z4_wjiA2KM%|}W~ zYE@A@J*{6t?8zS#7zP`VX0i^e;qUbmB_EGFLljEeS(5z#K5 zY?6B~aq$X+1pu1}X89K8*(^S@Um4-y;Zz}X4m<3lnQEMKaj1*d?6D{}l;gaa(x8)blvl$-alky*Ca2W@b+Dz&kRQaUP`S6vnIOaK`U&)I9x4 z^d~eV{xW{TmsIZ zNUxi~Sl&)nq1rPJ-{7in8X=BVt1ZJiS(jOXjU>-MUtj!u%kKdI`gDbc*&inU$23XY zW9_+dj!tFCvrN_c-6(b~J5%Vr5}dkK=tG01P+L=21o7n9RI~1tnFAxKa9A3vbn>Sa zI?%~`em?~nlB2!9EzqP}?OJ_ue2^gQz>T;v9!tF+e)I7$u#2hnFD8KgN)nnF+$?^+ zC6rt1`yv|w-EW}EWfSW32(b2Te#rp*D{+kOYxk9vd$Mumg6yz02OO;erd{5%?>vn$ zPt)XFj2>WZ0meS#&rFS8Dir2~++cbTUv zY5SMan(G#!j1q~6>CE&bPnx*S)>eBx`6TfpXr?Y0l+518q@;;zH>c3Zt=i2FkrF=? zLZ-xWq<_V<&i9ga)p{f0mGQjS=b2O`051b_VoOIEjHgr{|Bz>nL?G#uO@his9d=GzfZiqY~3Xh&VCQNN(2?I5j-uCqyTV za_$cNTu3k&kzLuqrbcXx)lE1YCxuC((QGKx%mhC@CFSm1oHaku3uWE?kofP9@ZXid zaxFaqbBd(@-8Nl7AB76(74f}m+f6W_ca6_&QR=x*IhYpExTV!SKf4&7p6Gh}Giq~% zfV1izn&T+j#~nsy3dvw=ZjABWJAaYrDg^}*V3qwetS+KyFN{&5gICKqjGx_?n4FY9 zSG&9bU?4D(wRP3=%-bYC0t1>ZEIBR@qE>uqUFscHqTRmzQ>uUid2nz!DEZyn~bK0)UABF7afG1=Typ_5pXfMr=PPafFCxtKR)yC!< ztmGc`vxzdV@Hu=OmT=MzqvP4=E99u$7dwe6Uu`g(OW__*@FSy=7srQP;QtayK{ThQ}=6l&wze3>OSpKtj2<9shz3|``Pp2r4A)43( zv)o#V8L_UF*Q%>aa~i$2koz<}^ypl(+R>lw!hL{VbyfCu$C-II1o`+rymK0NF#&ui zN1P8c+5rg6OjDSf*Js1Cm&IdIWZxOrh#48NTGuR}k>Jt|To=ok4XF*~Ox;}Hnj+=d zz}6h+q7+x7MZRKlk*kf7Qepftw3J6?m=ZwJzT*rCJ?+6+MS);CN|WieP&PLKio(wc zIncC+y6l;xU(R9?yEVAz;L!`!8?-{PL1!m^<35zTK_Rg+HRaE!ps1K0elKNgW2D3~ zMf3L2ge^1X%(KTZ?=;vBV{Uh#zlP|#E~I|>@&z!vW(cY6uSa_@u+<*p7B&DN#Su;t zVUqCK>_lS8fIz}HBfO7yu&;(pVdW}A$!H6Rh*ScBy&x>=IaTK;yk7YeLA{#?osQojChs7&adNg4U^o8TI<@jk{>syT&6{0teTTgS`w37n}gjO zKj|IhJr2zE+HWE_D7|_R?B3UQLS0-J=p%99;N7+Ly4=D=({8m2%P|z+t#i^YQ@U2m zle5SaJgs1NY_XGWP3W-_ZN%(dH*;nbnh2%lX{>nsun!un=^2aBGL(>W z)vobvQf*^It@H6>ZS09!N=VVO2ML<#DZ|e8?wMPJ1XiO7E;d^0l%0BlE}!ayt7PKZ zX54b`o}^LBjr5iVuY0ui)McKOdoDhg1u!re>d}xEK5XRRCias(xT~r7 zp+sKs-f(fxj9X5g6Mv2!(<;@w1m*+n(WCVb!J-A0m1k#jTB~|!gu3_FrhWopY3Nmy zuewu=|WfjpeHm@EEIj1hW*JK?1)2Lp|YriT0dvwl?jdx=64 zmpgx!lO2aoHHI2s9<$7P4eU>t@>+QqHW9k*P`kV|MehkNxJuyv?4r^Y$1J~+m3d-XcSQ67#9l;wq`m&aS#$%mg(X5k`LTtl^V+9gt1tV2Bn%FKI36r!=4#87 zaelr&{UwU9;D*_%>$68*ZZq|t?)xkwUj97R$bzOZ=mia?mB;Mn8Bi7WsrLVr<5XDr zb!sDynSS4~QKNEM-ZaA0(zs}AYp-!j2HYl?lfIXyHSHUK0{-d*)R&ic@`jjLHNdRW zSC?=y@)Rqv9EOaNshBx4|nO`(`QW@?H#mkRvTh!xkXMTYZBCb zAKbnyjm^|(U1imP!F@RAagSY{1F=m|dI0ZNre2h7Mn51QSkM1SA)^(X+t#|T=ki4x zse2Y_rFi|6T3zn}==JN@FIdy*g@}u&fKh;)=5EFE#D+eQa4CQa-5k62H|IfvJcb2S2obhd zF$B{PCQtO+)p_&rs{PS&`wt9L#vQEr;zIyJ7li-U zP#Ds8oY92th4hBG$= zJe*-fpb|1Z6aRqAwwX5AK>;US+V7Oq9@h*>v!CC)cY&5Ahh(RD`MflXbzq5 zhzPZ8&1W4Vjh=W)$G#sTBezyYoM4IWrnr`1YiqkYE;s{44M4tFo~OIq-sIS6W!T}n z_gMl;jw<(kyYCE5!PKV?gX=``kMWiJ-6XrSJ7~2jAJoRi#-PLZ^ISRF<&t$E*v}<2 zk4J=u_w@99&OTLy3jAhhxDC|6AiDA6W}HqigP1TAQ!@OK#S7purLOB34Cd8RfBV?CGUs)DtYy&n3_c^R*sI@N zAa%OT%f$=Y&bEAzbB9$CXv;eC0(XQ5S3+D|Yw3-TM+H^wRjCAFPbbBa=>|a2%YGau zb*f-%&1I-%soOrbHfEKen*o{oYsR(+DKWm)J6JjZ0YBM-lBIl7biVA>0x9cMtwJF2 zkFtEW{Hm=cLe;M~el{6lp5cgQ!Ag>Gn_SM;b{!-yuCPmF%!j&2g>yu7f|KGoTBV_d zstkyE1esc{Zi7g=Lc%b}jAvMz@P;O#Kw6(;R8p54M7)j<_uH;`O4C~{x*ct=&ot$W zeYrcm@%tqRt%C>xi^06tH$ia7;xN(EmEtQ;H>>@M`uPTj0A{LD@4+q>3-B3)sos%N z>n3yC-owMgH*em6N}4>!;iX^YjDB{Zv@V2hWo}JgTTnTwX#cK$J)YwarjM~;HjOSi zpk3y>mX(u@8bSqy(}tK?To-y$4MkRxUZ1~cN3p8@vc01tN24&!?M8W7W=MQpv2i;M zzY&rl+Z5EK40YBk3<1-L&gw(DgRF?!-5)(wrO_YWy7G!REUF|1-ws2inCIuxR-)Wi zy2ib!+R-fXvC=vLe@4SmPOGCXP+_q0yyEFD11slw#t)?D-r5VgfstHMZ~|j^Opsch z;6>#`$Ku{|cdy#EOeq9+swQU@L|Emf-G$zH&^^aG^wAmVMtE(THtLf83o$G3Age45Z7)$X|cQ$NGNl^rniKSYejeKXH>mHL_&eu zw;#8;H*TN(fNv`?EJd3&E#$g&Ynsn$w5;dJ#i=ZfLf5U|uQQmgmzS597$T9l9DUIF z6UE#()bq}S*{UWaCW^amnMRf7w#C?R7kxCsC8UXrj4ZO5k~~=O0y}PpFY=?OmS_;M~)X?tDZNM>f z=i1LKeH2J&n9Enx`Ywzf$kvkilYmOedz!8=`znu8A=SZGq!0As-2$W5(K33&STdE8 zpr%RusVW4;jZSmSm$M(R)Ng_dy001CwNs@Nw7K>&O=xOGh*=BmGJ(BpF~QcWtq}jH z2YKEn%W=Np$nbt!W+cX`zV^|EAvv{6-}Lv_=j&%D1O1;oHY{zr5eDSDC6e_al>@G8 z$mL{dppSwa4E917nB`6RVJ^2kAb&&4WMZ1r-qeh@l$M+o%3V>Tb=Wr|vl<-V)yeye zviRyYWA?e8C%A}opUr%o-RZLp8g1zsks7R<-2RbP|q>i1-;k z-XNx< zTno)Hb@?NTj0;bL*NPQ;0Y6YQl~vRAu0@V+rg(XHwc<9{bzH5vUU3u3$ZPuCIf{Au zXM1FAnd|P#AMgta4HZZRJR%xCTF{bGvKOck&F?idtmaN13a6P7+!GPP(?xpv2ah_4 z=?m?}FFAc7daknw$_792SDo5`cV9L5KD?$)ut=y;xnx1XLM!fG78mAJp~)1BVkDe$ z{NX70VU}wnz~2ICl_-r?PgB)!U;#~O^id78oc0KX9iazSF=3`2nd9dIlR)4(y zc?VP9VjiJ2pl#uoiJH>yw;9fKygZZMG%QPM5)+blzp`$7E#jLohD7QIa2GBEg17c_ zZR=y#NrO=Sl$M<6{0~M35F#+fP;G)$q+<~N*)Xg%_#;E?=momil>PnvtBTfSzXGT% zgoI<4R+$%oWNDUv`d$76mw9QCnR43kIhHYG9jic8g+i&FxrK9|e>fpjbsg^VaMRJj zZVEz{A%h`<6t79#dL~7KPmd&_I`c_80HUEX9P6gez4aNNka%fuS0mWB@b4E~p%+%c zMKtBXl26Sp6_1L3i~JdJI|(JCg|o<$Ni@dL?n9y>Hz52ig<8lTo81UNGGh{DS2Dvr z>RC0%wlU;dJ18DFH-4&& zeEMbIr$JN9C>j8n#D9E!;>OWC!U*%r?kyM~Y(I1)XN@Ray1=-k)d(;oaB!y49s zp>dwXr8)fOxX=z>&>Dm3RURg$A0kEhpFVm2uCkp$^8Ol;32iJFx1;r5RcZE|-W?mE z3_{J=kTJ{Ug&H28G9e3ON9eg#x@{UEH(5Ekc$DdBcl6&FtS1~j zM`;JffM@v*THu!{f@ zde0!F24H8&kcGTxm*n8a3> z<#TnQHN5-QA20M5~>CDH}JZFnTmHc@P@<_+b)s;+;ai;%fEg#Ey#rjRJw zTr|c!JBGO1yZt~2(PS$WRcO+w{L?mAMYASHwZuEE^7#2T-lb3@Jr@@jD{T?2lph8o zL-__5%{3&7)J%j39+p=&{elMn2hFw={t_V*`pUq6Fw0zIWwg9k?8pXKZ{F;Orx`$n6kM`J`MB-FTHP~%wH&}&E^H~;>n2&(yuCEyj;{zrYM z>%#XI?rzrMduwM9VX8&dHhxd}U&mR6%{MG`S7lY z{uG2&cveOp*FO(hO_>8=yGxiLnI2Zagl$h>P_dFra=>!S(gh+%30Rl2C58 z$c}Jz?tQ6MThlM~<``9ia22fOo1F`^ZgPaQ`5vg?Q-SKz9l4_w;kN6G7Gi_A`ceTzjgQ4n3R8`@S9%hzre}(MnipKaosrRKp_EI@4owFQ<3%u zyzf9G(wZ0sB^R!}uaNobj8JsWn-vE8;FB2RI|tT6tHU;+0qTv3#gYfA^q9ZH52muG z;*(9!qd$Hp$Bw1xCO{*p%8xcwRaAIQI_R(g(o7(qoceX23-Ta+2@$!8u28pYVo-*U z<>ZQ*YN1tBFa^MIPK{%wa+^|;34;a5_AP?y9}y7&tM53(zFv(Ucyj&wP^V7zf5iw- zRe`@r$p5(D|9SOKMDjm=IIJ`Oimv{DW|n)S2PCNhqV@0Ruc+kej-^4KPJ50p zEj9Ht14zlC9bmf;WER9^H$ocT=e3Y6NEC6h5(>)z%y{x=pjJiHm$)?UG!fMX5(PH! zm-z0eJt%Em8f20xObE^sZl}c47~bUf*RvBuLZToJfR3O}0ji{Dwq`LhnCgDR+xpHp zfh&B9va;oU2}F$IRi8fHgWFUVahZlU1B^k=>aFn8kwxS#BWnOs^Duo2Ks71AKQR2F z?r2OWl*3=0y2yrx^)(4#g>OKl_vzn5@V@N1!N*q&Dh)Uv;V|Ncm=C|uwzf_wEMy8T zY_+Jk8DK=~#RIy)z3A=Xh})2@?90(Pc*m0Xd#G?88ln0eBy5H%95S=*Kq5Rfsaj6e z-{`P5?RS-uAbq$=b)tE#F5 z#+_&4tZQsHPotV4j1tEX6}VO-1`TC>ef`eN^zGL{Wi4vH1tbWhcBLb`K3dFn`T|qw z=_M@$jZVW2;-n2bWO)jb({x_h%SC3wv0OtzLsBS$(+C3Q>e7 zV6~XE$KHg=pz;9GRBI{B!LbUlFblf6FNaoK8?f+nXOy|`b2}hGtA<(f41&)aq+2qf zbj|uY6|WW`Sdd)+M+WOL@MZ!kVx&y)84eGNLOi;(MvVF9O^@UK`LnWh*+Y_#9^s1^ zA%6N_F&O}P#b^dnd|z_@K$`Ti)Qq9K2PVsCMm>~HXan+E3Q6KRsSog!@`;a5MNj56 zEXWNpT5+fWP|TzZHTW*q5ypjVFg5D>kQOmfj08I*+9UY(c7@cpL2WyX%Lmc|3}z7PMNAKU+eu z>cU;fjz$BRdA2$OQA7rUbqJwqNf28dwXo%u;S5GUvqRe16*w^a(Ygdtu#f6Pp5SPs zmGhYRn^tlBa6q+F16D6Mi+N7YTwDOS3{=(vA`0eET>=iF-hLPxpH4ragMP=OH$ z^kA!eE?nE&a~2SDTvo@{K?Fm_k39!?{6KqWOH0AvEI~QMVK}y^Ludu~KVYFFLtNn_ zBwX9!d}F?kK?txr-75wBaL(Gpg7#8eAD=T2{hl75JRDk9oS^wL%yTK^o7dct0kd8+ z`f$uSajc&iGV6dI3WB$r34^Hfd)E%?@?8dbJutRvAoxHMGFlmRI+j!JFvsApy!Hg3 z?fvk&o=#mZaDn90o+CsXDb!5bK2FtK{{y{dWE)laerX9&3%O9KD`JN05uXCp;qqe1 zVT*zV>$`K9 zYL8Z|t@JK5L$~t;w|fV5R~;H7gwG3sYlg066NbH-L6f|yvjYe(n+${7^qH~bT5hgb z#B;Isq#C}++9Gxt&uH;Etp-fouRo#axmGk{q{QjMzK$8j@u~^~)eczVVxaw*VAjA< zP(D)6m0LIo)%+0-oJ^LltIXD50-GKRp`DnPIdGpF^G-IRYbTE&XC7pV!GkuQ0(o6Y zoxyL}C42BWG0#uu(Tv88tdlKwRm9G|y2WRgVE3yacjpPJs( z5=Rb)MggYN>zL<$7St&CeuYn{8SEftF`lC%QquM5{`r#NST}=Mv5yVy`6k)KNf3Ay zKJ6`D5DS!kz5|92k9Pdq*KqB*<;X*+E{(~YyBmY^t!OWYQzK*2$d~w8ROM22*mT-+ z%y=?usLcw6p zTdKIJqf=9CPW~usqEqnXOSU%N1SSGBgdA9~!IL@wCE~G^)a0^KZ^s&FpQhMm(o?Tx zJ9KkGWOH)77u*%kv{lMOE?XNcYwnM@$ctNPt!OMaf^!5cv~TymyD{!NAMUO9bp4cK zbp6egR#;H*Q4s7qb{>yEuduCokg=1#kXb@xofL|g9zV!+{LiH^CoR zkD~c$YFMlbMwB3-CG51SP2;-t1Wpgs{LE87UMA94i*Gj6E zW2s6S5eC3jwY-VN# z_x^NW#9wFYbBJj9O~h`9^WRUM;-9!jLge4Dx{6HF&t}rF9>K;Kh-77eND9Texw-k* z#0sV*(tWGMmPKk?9~6AZaTns40e*2cyIisV|21>&RMtQett(lIjEu~Ol8uAo7-s5V z16VZGl?WC{9acezX0p%T-o6&vEG!L9OZ}Fx)dt)){u7XfC64zDV3`~G1q^uyJ7K*E z?gl+0;{@x4iSXt-FZFb)T^-h^8{(x^nPyk1U4AS>_6&&Om=tUUu!A&I=>pBn4ZAeY z{aMNbbs!Bu$9;V-bhMV)&fNOQpA-ojNZKo}4;9$Wwgf(E1T(RjF}LG1%8;loIbMMp z0??NP8V;D!t>jei=aI(7%>E^CMIui%oAY5+QdU}Wx}iV#4h8fshiULl!_8ZY2WD{7 zpc@2v>_gACe?ewb_7PSGtz&#tcDbF$(_0!>*8oB&s} zJ)he?3}UXIzNy^Zn+3~9srkQKKH1jsIUm~5`=)h)A@T{r#ZW8x4~5#pAv_aDBlMvj z63ITLepn)wIfJ$Bw}b|suxBZ4?pHs*7ieVx;%_<}Z8Q$W#l*(ULsX14G&FwI?>rIJ z!f~3nm=1F0FK~mcbCdO)nneNUF~l32o18iokx^0oz?V*whIP65Z{D1X#b0ji8|5)> zn;aA>q!SUkXE518C3FW;-(Yp}%Rjxy$wVlQNEhtly*c#5#p=C5|C!43seF*q0R+j# zUn+f**Y2XyE*gbT72^uIQa#kA(6*~TVXp?U*25D}f&-Mm{jW(CBhBKs8dc{3^K*$)H ze(*!}S*|l%lu9G8F3N|vLyP#BdhmOMo{!Lq(sB%%8p^p;l#)dmw))lcy3S`~aEa&w zI1aM%dAIIVL16-f_$6dyywV8Kq(RMlEn%=>2!cd<<}Bc{!^dmr*dzo6_V2Zf-Crk( z$a`6JL8ROOsX){#dQIZx$`*EF;%4(K1ar+#cUpMn21Lyh4LfH|Gicueo3;mS;6J8> zdHHKUcGfpqYq$e8c2!+zt-Xm5h~m^+y)!Dpj-Yh9_kVMRm`PTW302qW#9SjkioiyX zIbgpXv3x-lzG!jCzQZmdEp7zjy!rh(;vpOYiZ;mPYw*Pif+uu8# z2;g&Th5z8D;2EjOXh#z*FbK7)w>LW_3h%o87y%(kgC8+b>BKow6nkxYbB1^pV1VUN zfggD_Qh^&(RUiu+z%14*UuK*nehELL3?|XHwK3EK6=&lLNTjilp@q4dgpIOer&5;m zo$~mWBpYdfB8A+CxEAXu5p24$=FocbyETYV@+b+NLccU&EfAzQTk`0m?t%vCl8VM>M-0sK3Z;l*~@N-NjBb88WwQ8Q({buVw) zq3o+41oQvWwis;)1b3VG66{c|PB_=y@`(!w#M*VmsEWHfWzGq&$KDOZ@!TDA;%6NB zX<+e-JClqsA+tR}WI)SO5RqP?Ptz-@{PiT@-IwIcNQLUU+x6Nxz5xjwU!qp$rHEF z^Go{CTls6Z3Epb7VB|7Z%{TifuT)&f(R|Nk=v;Zz1$ml9hQ+&~p$-UfKe7*{TsPto z-*m$*J6b9*<)!P5@2J3odFC6yD)Ry-yroTy#rIK=DCQ3<;gRqZkDV$LO8dc=l{60w z=EkMT+xnbx>XagST1d!K!^MdYQ zqoE1?B4-1&Q{U@jRR0Weru$?S_NB|mA(>_o935)XdEh{G+2CW}2Y&4Qb^q5Z=;FL? zg2_;6H>l6P&>l_wGzK{ODxcF#E18HqvY*X9mi;SNs84N#&m?T-M5D((Ju@S4?{MfL zo>Pxrlh32&HGRKiZg{SVJ2TDB&cHF7EddX0{8iz-kU-M=`Nc3(q$jWMh#z4$M;J;* z)bO(edDv0j5})1NNEwNb*>~ZFpCO}T4W|6dLp~{nuWc6|ifZWiM}60)?tmKtex}=Z8jN4xd2F z0~Hd)u5Lz#OR3e^ttxP*)444C^kKEE(IPq*9G}^ZlWN-i_A$wW5(28)BInfCv^(7ul^M3WYA14c)LP(*i`xCX zth7sa?MNYGB3JUf7_T{vhRp|+^3Cd#-<8k&#YB%5OJ;)Ob2Ee>vtx<1=pV-P(*7y8|9+86hG&)3lZ=6{YE?(YD&u$Pj!my}*PH1NYpR-uTi=mo zu)~YLqYzX4RiCo7)?skC%3KLjA;3XNJQZ?+r!}=vHiIk6({cWI}I6nP{DNr36QZJ-MjwT^V~Q zD^Ul+Y7a$&nB0p9(TZ3Ref40vl+dkrX|&N;`uq8yMq(Ao?#yH}pgEi%PUhY6!2@OC zboBJai1la8utDZ?PAkMc-7t>77>R=F=}X?9;YBwlvd>L{7p zEz7yNWqsAiwzpEn!{SJ_=+x>!=$Flv++}xlj2THsNtUD5mRN1-X2@(#FYZp2Y%-H0 z(HU3D`xwpEI^r#w1YL39#qPwDyI+-&s})L*y((Y!;1h()yql>FdYMmEz8m$yw7bzg z+WGMdr%q`*rd#^dTdOELX<{3J6Do@k16$;({!94En*+m*Q^?h$l}yRtct^ior`y(y zLPk;3)*2p=7&XCMH6hvuVt-gV$7}oDPegQlH%|SYIN6y?KFa~d-XWfs@Mdlkfw#bx z(@ef$u}nxSrP`InB=uHZhjg`)KU9>3r3py^Ok?84NF!=QYRkAIURKb42EA_vjMpN@ znv04yf%G{>u8>lIzmZyqAW!(kz*`d#d1j-6B zMat6m!fta~WZjgFcRp?T>=k}lViWTsHk+27iNq3x@P}98#$cCd-0YpfAIkYmvspn# z+!I>^=Kk(}7s{l*UwO#HcfpOxZ@C*cFGoH9+}Yyxw@%{`XG)S7^?_QbNUkDziQdaK zE`KGGO&*hP;FrBkco(}yJ|eQDJca6nE?PRy*S|5xvQ0gN4$W#erX+2Be>tj@r-MRJ z{kBBZ{95@#^&T_53Be6;QHJ{Jx|IkGMzmS1=!7aKrJu&x{jl*v5O$znZj`HDcW|#y zXAHlM?{(r8Owt4aFk3CzhlGoP>WF< zG0HdBqwX{EI$atDzl{Y|f8lc6h7s$fu+$Wpu#$Xx->X$I@AXl=xLG2Fwe(1Z{%+HW zqL*Z|(Z;y`a#426k>-x_i8jIY7w1F}oP;4MGwOFLG*8amjO=-I^TF2I(Ha$d61z6f zlpCu|(OnLBiip~cH1VCnG1wPvBiNg=MrGNlnJj+oj(*7Mea#Ew9nv!5QG$8YT)E#)r=pb0R{ z^Mi~St+&GU70;(WxfU*NbC)hkzFCnK6tChFFo`iHKPYB*OB#WvB5)N%uDpL9%hsQR z=hctT{GwBnNfA6jI=u9@;8BkAw=LZCNXe_H%f)UribQ!=k0|cfRE-rF5i}b-?cRvT z$>{JHd;fWnN(kr2byB~ej|)fnL4rS@QC6YASEaDD7`Xb(x^4aKr?{y59BRDL6vZDn zH5($ObLIn(3RkbI=YOnjZ2dsPFS#LTLwnOsBp4Qd3uE+qre(i3VL|r6{W3KGbLNQq zE)vl>uT9?1J$*cgt@ikU#@%-0N7<6Sw?8gmHiM~oJ`PnnSufHkQ^ST zIp0}2(wZUjHJ{kebbA&g*q2uM-qhK-eXrE+wIrYj)+@bZdsQ}%j+s}_z^eP8w{_?t zJQ<^@-0~IylP&mxgXJ{ir^mX*35=DB$2j2l+PxUr$B$`+Uu9I|aq{tP*ZC2&=z?AKzwed(ZyRg>c?0i% zI*k9eBLgaX|Fx@@nEcJ3f4wXtI6!}J`ri-vUz=V3AHHk$1#n;xr{+9f=bZ^!IK1?a z&FRw63*yLu{u$PR|Ll96uld;h@1G#?>m>v>)YnJy^4lGUy-CNs293eo*7nedEDB5f zYfp}_6*hjvP9p!c_Z28JI8yo$Dz(i4f8Fwyc-oOxXg%c8w+|ph zgWP~%XU{$t;tu{W@OzG06cD3tbzw)L)cf$f24?x#FG2FK|Eqy&AA(k$z8M(g_{=yXIQHPlGA=MLwAKgn4V-!Y*`^5zTSKI{QA;Ek4r0za`rJyT zV82@3#lYa|b8VO=_fft+f3CO_4W0c2#PQQz>0jpI=@&mgav8v`&JEblpnM-51H}gR zL=id2eKRvNLOsF`i|-AhG?!#Gz;x9@aNVgj>13E=VPP3bCh5F1S%HBr9^H*zw~h-9 z3UULuOzVG_HP;uZK!0!9SRbGzUJj2MrHz2)unIU>7otT+!R%`V0m^$Hwj1i|>t82> z$Bf(vJ>aKpM}N&%N7-nrs|!LT`P?g2)u@#mkSr{QJPc*v5eg=*0R1dl(hxL4WbxVn z%0S$ceDJ?&JL|A2*KXb0h$tx_DKH6X38hn*fFPv;(%p@KbW6uX=}<5LQMyxl(jX!! z2uwn0kW%7|>9^Lm_x{e=d!OsX`fpv!wbq3BKF>SGxbOQnN=!S6KY0UlWATNbFX-KW zvaI}AbQGbV!yIIMhiu;eYQniLQ-%8hrj$$%u&M`H39Z)(4@Wxg zmsLPpOyCM^g)KwSxM%~C2`R}pjijNfz=En^zHu#D)Yx)I_M5*XjXefbn-i!tQ`&Q! zmf%_VR3i%`vyfNMoZmuZ0INd`X5YAR<69V@BF;lN8^Ah=7yO5%J||R&4(j+|%@f@= z7&r;$3`|UI3w%v-RODJ?QFSmJ{7Z67O;$E+YxF@L56WGyHYpyTE%ZBLCt2bqN;f=$ zV0v8T3^;YfR|3ZIgbLtaQC5!8iHhi0yJ6-IA9Y)U3KSp5>p(Ozqqz18^~~Ic^P0rT zp$mxjpYK6rfDlnBB4V{$X*=c&)7hTZD3o$#4-9=DotkTXhkC&Ob%CTX)AI)_GbGIR zfutfF%`8lxhfSgBWj}@x`eZ}VHsn|LiNjHR(;?HKKwb#da5#sL|9J*^43L~ErcT1( ziMLKRpZvBkok2JRpKKj*nw!Ld+Cm*dQ9UL~x9lzI^Q#OLjz5PU+sYT7=0ynPeXvCW zdjlJMtu~OxEdiNb9Km8L@oVXo%E<*{P|3Ny2sn*Zlv>5NKz7bvpAv$|0>E)9L~O2A z)q6?&Lmn8MK`Lv-T4G+0)&2rU{K4(IF}h$vFdwhyk|KC`Q06B?v==o%gVib*SR!iJ zc%p-~0Zeh0!5a`Fc?D@18G6uVLjV4<0@`(3(29(Vj3C3f3@$V6`t6{zu2m>6f?)Gb zxQi#{cmwK;gKjhkxX5p3%SQH~Rni4#5<9-xeTx9llV!R@8rHXJ;KiJ!w$oqd*Mnh) zgcturd!L=8$4A~q1n8(l0iSkWX}yTJ;`ehG<#jzueyI_n7T+CwFrd)KevzZK$IR$) zubA~D^Sm+I!#xnMu@35aO=`q9)_1fweO>Xo5GfUDGWL~I*@si6(S186y#@nk4Sc8& zrxWyXb8}lkV!Z&z^W1(4Dk}YGv|-L?6?4qFJ)G;_j^G8+Xc-gSf@>{)0aSKzAT~?| z2!L~_7^zI{wNl&>XE^%<8vup}1`;S2w92Cq>+s*#(9ke9H-~T-Xi>)eTX3=5vK+vU z@J@$w#G>E_cIZUg9b<11&|;~Qk9+v~RatSa3E@DgqBp(zPWr*sNZ--Gx`th)z#V?S zUtd&@KUGj4=>1A|AbsYbzAVC!#*O_2Oc7xc2GB4A`tn+V#Gs$&VKaPeRm$&=*s-sJ z@v=NIL}Fpr;d@dyDOc%X=~f9)-djBxw9BPdcVhhxgIpm3AqrM?FnXk*u$MEf2ZpF* zL_H*9o72j$6Dm#DI6Qj$7pSD;-S?!elz#W*<%^7lP9IHz!P*D>5UXPxa4@NF8cIg} z2~aTazXNwxt5KQw;ls;=Q-oJvp{Ds&r{AH5RKsIq3pERAGmnmcuTL0mo0n)iPDHDzdt)zY(W?{fXXb`2pBNa343gMoZW{RP4A-tV*tla}2)n*}RBAr& z*O5c`P_Cl`Ux(U`r-7Gy(Qh8*OyP0)=3s7-#RjXiAV{)POul{>S9?>pYN+c zD0!b2{_)25DyrwRRK7I$cn_pmx$6_8SlyrOcYQU&q}{0bMn8$_SflOzdk$uNT2aex2#eH%y5Dt&KKSB=|4I-o?2g{oX#2kn!JTX55}4H? zC7>2m1ycmHDHM%cQE#PlTNlhJpdymR107~buQ~#yzi8$aMUT;sPSv|(am^0C$8q@4Qc_S*G|WS!A*lZ|yaKeMPS~DS zMo`rfcPsi$8YbN3^@hxANEEe4{k>aXXo{$3-{LJp1h(S|T;0$ks$>Y0A}+^m0gX^& ztiea5d=7Xmxo6+UBmC9xse7nq6x~lWvgzsX>oZSf3s{8?)F^Rg7vA(4Zf%fq0CIzAjxi{EMG>z(CXxG~NcY++xcoGVg73 z3yLtjd*}k~@(50^Xm3z}O^>1K80BSMWamA2OTmB;sQLuC&F{1dTx&?g350Px_txtD zPJFwVchtZvNA#-ad>#MKOjgR(V8ICDH&jkhUl4?drZ?h=Efy5b%uPe$WaQ*?Lt3u( z_65E4XKsel@YGulGR&Tm;+BxOKBAg_;+7BW?Dki z+Gdjq)`9`uVh?XxGOhYg)!;%~|4sfXZx_B+V;<)p;|Mw5`kdBZ-Sxwq22PJpe~5$< z>h0UNHL)P$X5KUkbPoW;pBYdxImn7j#>%XoEoU}9v^@25WsD@>G35?t8-1-OC0fP( z@oD&dk?%c4-N&JSJ7pc#yzCj-t@<&5to9(+Rk*dIBgsYezGGhO=0a3W9MC$vpRubGr9%bzzXJOF_UHnIwb>Ao$Pa=-QiuU*CEgk=D6qN&-g#rJLzMT?Fbb4Xrr z_IKlWpa^GTk177pbYu`ez=eFHMIevqMP6fGdoz0)bdD}>Rjt!1@YmtSE4t^EVR{No zVJ1Af0qO2YWztdjwOZys;S25#;_GV=6y76|@<%;mpUhalxMf3T5xu%UE;O4du(hGshWWHSq)R&0 z@%!m|LN%+cuJiuDkQN&g0rg2%!5NZgzk_ z!->weDSCJ_BL)Txj+eBa-j|$cr|@udyFG>`Qu{sdiSD$nmu`S=sJ(078J4d#=5U;Q zot*9=ZNJH0PH07PZGnHY*69{MC1?D^je8pOI)QVhOy>^V7HBpL<3%6I0>$>kA>mnS zs&#o}!b9rrh5J`ow;>*$oO@J<=I04~sqp>EP3JSA=f$I*9hKZ1jB8ffD3`zYnr@fK z|Ds2$)bo+RTS#S9$$>}7rbP(j6eicT$!fDD1j|4i2&2nQuG|N7&(qe@+Xwx%Krk#!YU$%_|nMzz>-S2X`FIIIr&(3Lozmc zXVE($YqyN#cP`1$p7vEVKa@cLji)iINOl|^wdT-`G3y1Lu;LpS{r^TRGQLZ1y(Vy8Qyb{lDhA}#=UnYlAQ zz`U$-h3i`rGR6wU)>UQ0$u|f%A&``uGM-(tnbod(buo^(YXlOF^-dg#>g(CUX4E{r z-QA_6;TxFnE8>9GeVQm}j*9ycB>1u6;yPK&pFE6ql2mKQX%bf}J{kV4jkyv>r~3$; zOB{Bz_yf@ukcgJM98ZnE8GNldLTR*Erl;jp*a5Y8s3cd`xT)romo2Zy#EVh3EWMwz z%rT~jl>Xv4+;qHDJGXB=Dg0LP%Vb&AVM{I?)F@n%q!)#IY;+HtcgN^L6{r_hp2?HZ zohYznrCAkR3G{GGe_!@rO1PxvnCE3{jYej}##}qm0_N3PD^H7OV`T1Bveu=4AaZ*} zQO#bNdvlw0imRE}vS+le@u!)o>FBD|IYH^7D}ojH#3RGn$_Ro!>Roh0uD#FK9vR_J z-|<7wmd#KwCVaaE_h#!zjj4P^<=ta2`?W-iJ}JHyosRhNvr%h=TzCQ`jZgi>hKCQ7 zxk6JEK9;lbWuxwse$XmzPN}b44vFaX#i8?<%Fx!l?s}Q$>+`QRn3WKc=)7%Ga#B~( zh;Q$ZN%ZgS#dt1Qy^Sx*@Z2-I6Liy=xh`QE2Jd!DtAm6E`QhFEvkuj(c8PKI-eoq! zUfI>htdzDXHPcCzGQ`0_t+h5=12aKVA zn$XZcZ(Fgr-V?R4)F7Kt{kT_m(EW9~*1gp5iK$taA$5n)*jyqlAS+B(%Irg-?IGfh zi~n3OqBLCaW1|OZ>gPnPYTjBAsVZDE~-QS_xI_-SMS)9%st44{!&!T0OuhG@l?*RuP}IklzM>f+d_P!#wFK_s=;$si&uTpd?;g}yK2 zcXf-|MV%sp7OxOGiruMnOCMldAS8l|Ug%m6!q5W-Z>y!O-{;8q`x2ZM2DGu9M7-qFFlyMY zN76d#3alb3Z~MEuQhBV?{4l?J*Y+}gJcd3e`PnQ@;cRz{&KZ;4sqH!CfJz4Q@$*b8 z=_WIyLfnik57ohwUxsH01HyuG7qAg+#kClbIBj~T*U^ahi7Qg|FE~h$VOxW+J^wHIN z*LW=}pOjsMAutv}N=FpTH|)e5V{V2Ub18i0x;@p-DVeaq=Zu&7g=YCm?`a>*AQ@gm z=};yw8R3<@@AWjAZ}DHp33e-c9bP!-benua(5>aL^DHjT@z+nQ_3GW>J5!}CT$71H z$k|#k%cwJ9ZNH)>cMvs~=_l_CROz!@hZrK<>*Ft2bXc1yUn;S$os;P34!Jrd*QYch zw`Mn?HLX(iA`>QbWw^iT%GA)x-W3(y6qH9UBlhNv_|bmOQ<-1P z995^XwlCnX(ik*Ap_;F&>hcM>_GoD?N(3R-pulJp?fT(E0#P$1)dLIDszOB(<6Mp_ zSH#Oq_NMyh{*l#;c=t5wa8JP5`uq<9uM*mLIaI~8ezz^=fv9cV4M~2+A8K2xnsqSO zpp1d8ZD$j%i1HmZ>mRrCG0BZKBV5xp;PIhv1-kL{g;Xrt*3(;obQm}E`veUYz1Ra> z(~GXScvS^4P#I3hOWigjV2%`w5jBKEH_BM zB8iNB*tr^1n_5p}bxo9h+jnmp&7l=oCW@VIfllaArWo?EEn$JCfAwsssfTGQgVNH= zrtgztRsQ$gkTKLLl>i%knUPdim_ZURgF zb{j43{>s-(IV+XfOBdrCoG=Akc>OJ>uni1U)r6Nj)kU22rQAuWM^0VgQzj!lO<{)Y zV|}a8UM}~h-Bq4&`#8>~(YNY%q@{zSf4UqQ^K8h8{575j#Bq6hon!`u!O@7EDaJ9z zpm%KFkj(Ueuboasg*MXPfaMBTj>53^jW5}UBnIzMdgci3BM5@p#u47RXF^GCh-sD4 zO~f3$=A5Mp6jXor0=$-0ncuLwG0vGM^m)*_zn4A7$XpYU#W-=>tg3@qRS$L9>keUL zHMv+EJ-odtI-Cq01_7~Clstk~^z#b1SZ(BvY~MOVbmm5igVif_-0L!0l)IOuvMcsR zV!=XCW5~^wbt&qIld-|2gGuUmLhEY9-0Fl2h4dvr!B|%c#2GS*jH0WRa~t7oB5Tqy%mXAC+jJ%VMtR6~$UCxpLHtC(Sbio@&6rBrEQgj-mI*C_fd7iocG z!Ky#!4YYTm0GUm9SZKAc&h$#EJT%jmKQw-c@*z-;J^8II>`WPo1Lz0A+*%J))TJt_ zXx6_K-G55Ge?HFtZt~PU{Qq6fbp0~q8$Gbvnt=U#64t-4#*MKt)3D3oa3mbyR3Hq) zrUSW-VJYmAjpqUX$~pEBdOR7G9-BbV4&#>{sAt3>XbN4E?Nl9>fe;ZHc{b6Y*3Aw^ zZ(XJSSO6~|U5~OtY2T^6y3h@|x*6!+Yf3^06R5MlU}4FA#^&%uL3gfBpSDUF7!LD= z2G9;kOM1a*O{51Le@)!d;=kgmT@`D9{$yR{-nD$@A-H;178B29P5&+)<>l3p6)!JD ztP8OtNLJS!!YBiL0IvcMu$1yBtVG=PBMSU3Fxv&gxCN-aHC6B-CeiLIqfO_AyFj*v zkQXX3Q6m5e-h~EGdNk$L1?(r~OS2#w39wd(+YlVA%mOUVMNU8UdGefjA8n$*LE2X}JueBHwx8Vy5i^#FuMa%?8eI|cum75=AZ~26IXmEgG&!i zz2GDeSpAL0pkU+5{LY90fqv4jU0(1D^R_ui43q2;oyO~ zI?+8+qW!;E$JrrE;2waB>0jx_d5=mLuqavh(9V=X3t~0PjdnHDUXPX+$f^z${Q8|E zqnDD!7AHjcwjQxI(w>k1S}ZFZujf4f6m?Saeqf<6-M9J#=S0taW>oR4L<4Gg=mJK0 zZO`UBPnLU(9ZPw4W0G>0J0375{lqUpr292;ZP;n~>U5ol3sZIVGkGipTJHBQjDSJy zULMXTH=?=45>ISbkIc--xF^{D?va0&e^AMf;PbSArhA8-JZ}xJjFrMK;}`-5)1T1+ zskrs#fp-JjPo;5ka8UCYpW7}iu@6=>XJ%&RmBI_C$>RUn!o#I}BomldgB6x1u5KNH zO0E__diAR6L_LI7L6SFvzYk=c#mSvz489SBGN^XOrd2`T_-5iL$_Qc3 zi&8QlxEuDHh3Ud%wFF7tPry!s3KDw^(MT`Ig)>+va=?yp4G@tUY2BX90Uqtgmk){z zAeTr+yFd~%r#bf!Ku?7s7gS5nlN%1&SJc70Tcif^;%Vv=nxOicrd61>686ev*Z)O9 zW*){7YLB2kW8FtI=1^n?tBaoNp8Oh)qOtK?t<<04u`0}K0rc#gCngzHnCUv!yM9pF z<0?UxjCwJ;w|w&_+&AreT~6J$`s!%?WWl2H^WZS+cPhFo{T1S z!DXRIhUlmRg5nD6++l2FqzFlKXC+nM?B_%G{#HW-yld~Jw)*`Ji)lRCozO?H#F*6E zdmN?}>FDbAoLL(=WdhmGM{Zv@5>)OPfhKTfs9o78Pbm= zDxyueX84|VVoIL{J}Z2AC%0`8S^cKlaP~;}np7^v5X>W+LeRL>S%)BUyKF(wNt( zU*M=2P47z@*UFldiGbm@m*vRy$LFzXmmHsAm{_D;C(Oo1=Ar85laefWnEwTS2ncN+ zLz29P>5=~_+FrEP8_{p{;^I@4lH>0fE(;dOdg^vl`2lHuaqfEylR0ME=g0u@Vv^fk zecB*;GMY7%){a+z>(?;aPL^*Aw_Xg{P*v3Z!v2~NS6}N4jpnXBhq`5lK##FY+C4X(5nE z&&=#Q)3ax90mCmWwjQ*KePvH9T>&1i;ECU)oYa~s16%Y2^~>?apG{#5#&qR@d5;m^ zgKJY|Myu5L27nlt!ha2~G6=<1cf}LVYD7w=alHc(iuJhQ2T6a{_ z{-c6qn7NTQD_QObxfe3Ly>7I4QojSvJx?r;^?uT^l6T}%+Nba8H|?8Z7o>1=tJR(N zYy6#)1Tl%7c#4B4sm5KSq^kxeTe0N34y?Nr2k%l&_^d-nar}0dPi1{S>oT@ghMDx3 z)+-SLR(o2k{fwW5?(m&!Z5f#VIT`-Y3gIrSEI(f7!RLndD@C@{-kjF>eD5denda5n z(rxhMojU^U4U7m98z0Y7NAAqRME)Sk8vyZBq1LFDFJ{I*7)U9)8Zfc2%uNg2+JYyC zq83C`tOS^)X|<)U!+!Sp!oWnrUY{M#phe~cB~3Zu$Ur~DPY|6`a+U|P4qJEhAO zmT??Tms-SjRS;$$B54T;>fLKZ@-qQyp~zj2`Gro|2T1ib>}3PXi2NiDFwbPFA!sI7 zN8|?+WF@bK5u^8#yqqE#REBNw^T zMOBTFQ?KqVY}RWgpA79CWEfNz7xkmJOA1|WQ4MBRGs7pk60SwByKN|JI~t7dE3B5( z)Mw6+A(!T~Utb^9_FmQgzA2_TDng}MP3Ru=cc%T_4@x1m_A)A$=>3E%)P-e>!#%fn zcs9W#0jQzI!!1R?FM{pKr=eK`^4JwVzunFVkhYk_iY@SMt*qFZ6L&m<_j)9DH4x07 z?M_?22b5;YOI=k}!#ON75Ee$|5m;WJ8-vqMe;TZN4)wALE-(}a2{~0jt7>Qd*==Yb z)s-`fK{r$0g!%l~2*`tX@64gWytEBc$;3^$cQ|B4(SUo*0TtEL;vHdjc9bX`Ewaq| ze;f9EZUdfyv`Zs^4+Pu;=$VW`DXn)t8Ft4-fxqGm_wf8O{p626^jT?s@QuF#fmcOr z=Xvz~>tcTzb=)@10$qAP!C+ph1K1}}CpOl2+gBRVUCG7WitgC!IWT%c+n2GCbXmZS z8et&JdQ#hWf_&w)j1aLOE$v4`BD=lOLn41p@q76C)HTbsntF%Jx*nXbVsrLrv|cVw z^EP^Jwl}ZssydMuFNJcVmu>nPwN$o&JwDHE*NvKf6MLY+bHH5QfG9b5ID*D~^+kks zQ)ijA5VH{4=mroBUnOr?k_P68A5S^8)6I_mO5y+UjM$!L5R7DEWE_p)*Z^M_fR0{* z>EeN&Qmuiq57OS@VjviT;(s)WT#dh>GB5Mt&OYT2+^eI@TZ0hUAT()Pq^)QrN^BD?C%-QOs+0Cto7>wyB1?%EPu#E|?B2y)P zukclzUniRPYdZ5e+A=j@e$nwi3E(^saa#KtvKuJ=KJ1f=ByxItLiWmddlvl+;=1!8H3 z(AGf71<HQVl4N?m^+|`~xpQb};R7;6C2F>54*kl9Jvg@u3ygr?2~IqA`v!!R=gPDH z1682ZLWo4^7%)UNX3#iN0aEpNmJ>Qq@&AS}t^XYcmw}-tmQ@g^w~RF+k`9A43gh>s zz}z_v{$Q`0ArwN_;XSWU>G^W;4uM!JctFWW*6{1#tXEnNN_zm*xyf+&%gpMKlgy;Z z$Dr5*-7YhXK!*ZR=)4!B^* zO}Mo`_ZNwvhCCZS3pAJyZ(pL9Ib~lL;ZSsUQZ7%xer-jRiACf^qj(mJcZZ*-uZ-l@uz?CY9WTy@kvR019u2KrqcnAa33tr*kbL!wd`OKvVV7f~9(HO0!+oIC zn8~}9WgLS&)X6Aa!tWTan+C3aY*vQ71VL+f3LNl8BYI-cw1gf23Q?=f5~X7c?=vtR zdQU(f1EghGN@G*_5$-dvJ~!eILInsm0|kXXEZ0+iKvQXe8BR38 zBBnpIodMmG0x)SlJ>A`DFrS6?wbpeRzRN0DJFr3HlozLmDfQuCV}p5xhP3n>la0%aC8Z;R%v(lK1f@TY**Ae*{@n}t;E(m-b zhiR4kwG-Ev;EkE~g4V51*9ElR#9zJ+1`$$_GbGLYZ>cw_ih*Ot8LUnhC)dp|jHgaq zuEQI6QRW>?1Lc^(F&yz5uDZXW1jODvNW^rpNoZw1Z+nLG>#{(tx5m-b`S>qllO|d| zoId+9!x5T;VA5XL!od`8F(2sq^(YWLo4OaEuB^{PEiNp;kIN%ybR%Rv;OI5ZM3F#F zyh+))PeViXc(C{)$wUB=6VQ5Y6}cNy4kst-e$bLvl7;v|r?I4kNH?Fu;ZlpBwNp;>gKcV;+Q5Cy`V?BE@U;UdPD~60+z@-h`B>P%=OU;YwQQr1%Ct~~@J*tF z-0!Z|LRQ3Z`oj%`JGHpCAap01*yo_*DXUjB2$gZRyUHS*qv&Fs^_J4JyURzbAsL`& z4$Y6k6%QaHue}ehakb*k8tcRPNqb^5{G{H!r_$4&GJSWi=xR1`3e;7%yjMs5NW~ zgojHczumrA?DuLyVNd6P{pAF+jhhc*Q`=1=wOPc^Ram%J%otTYxBCHJSaYLYULdPO z<`;s`@Kkr-PWkv0Auh27lLGKoO+Yk>-7|X9J?e`y-D$=IeyvpS15(!AcPPc4Zg_boJpaiR*#M++ZJF26{8*sK0y!xuAUP6#*7C^ecFw%< z4+kGq{Nf6VuX(51YKU2&1_@E)#Z*Rpr$LwrxWn{8cSg5gS5#NlUZFtPz%MkmJBhp2 z?JeY4ub6d>ATkpZkwygWo&}}_M)6XgOVo7Cu}?6xEQ^*`hu{<#G!1f`4Ebol4}aaq|y6M# z8XdOjvNMrW;?5SB2l7gYKs5C~q0}KC**-Jr;!efb;p8!8d}h!`5J(`s$KO2jzPN^P z7jbn#LmXQesK*b1^(zpRv#_AU5vSYR(<9TXpcIAd8@v2OsbK`&Yuqap^c%gmGB&r0 zuo$1e5DJSAe;NdR%a$!5r*{2lqWjQJ2)Yk3=`Wfx)O zb$x4&^6X5pfVKy{@YpIlM~`>v`$RtJ2e${-0CX0STDv(9D{T05SVWJJl8nZVu_chuPfYYGk+zu=-C9oLxj0`y z2`5ADPL*B}jk1|Xl;|w|{c!bZ2)RwTrK51DO(>$$MNPSZ=Le;9o*a0u7VTHFm3MYs z5UCt1QR(&WCs#)D$ZAowA|jn0%6B>3-N1hv9R*_r=Ww>^j9a_`z1qw#7p6SNouh73 zk=TxTwstaEVB8L{pUZ2ZidiMI4xUj;p94Ju zEi*9zzx;*$_py5iu%Y`qv+T{q?xc?|1+}8<^WW=Mf1>94h*rP=#coWxkdW~=)XtC% z!Gx!B&u*&Q4JZQ$t$regZ_D2#stxTUf*p9lya0?-+zPjMTQbg6#5UJxb22f7a6U=O zv3e|m{LmWT?1&I3Uhp2&-gXPt>Ds);k$Aq2K+#DEInJz zz|H4ReHkpczj&?QaxUp}jhN`1FPTZ@d9!<4QOgVy?2$jzF8Oq2T5`s^F^En>N&0CxAdkNW3UIHC-=MFnX0&rvwX?W&TBYXL?aQJ+!GQm z3zvrqT4L`%b=1^@_jH6-9e75$cRE9jZv zqR-*qoNg;i`%(2(ZY^UB45lQy?mK|S5}Yu18f?5&(Ho7GR^ZhWSWPcojt#(DDH_Em}l}8oAp}TQ3z!4 z7S!BocEFgvwhZGDwjiiQiQj$&%yhQ3QMb2ZQNC~rMUM#ROVyi4>=Ovyy>N(>->2C9<`8M)dI8y=qvBkYs1-)2pp=$fIer{^t-(2 zCdIYo*%Tg%1Q&ZAI^93TDGYkawkVCg5K zA&x3{5!7YW=zUf^Rr<8*nc@ms`<`2M$z{!|=-_a3j9Y|IY(wZ~H(FK(vFOZjZV*%2 zkz6ApSiO5gRrhesj+ScV+TOg`Tozqfp`VDggSg1wYy?}@erCBb_bV*0 z(oX0j8uboxMKIjz^woAn_Ho^mR+kSc2KAmT0UX=9|26`9@mdovy!Koim}4(a z?18546*aZksfw7LeBD|TbH+`Z((_RIi2?bTahGLt4b<0;G_O}>Dkj)n9W^MGIeK;n z4cz(6$^_1NL{F|onYxOQ@sEr-`lI9&v+NwPNmloA@y-PX3h@5#y9o}y9#|xsX=Dqg z66$Lzm&2zcQF3HOD&=S+%yZ93 zc^O>ew|kk25u%)*((FT*hiEx>%0mGISDVZ0j6r`BIH&gWMkz@BHaAOe{XT!0pdwEB zGlQY$pQLXv^SV5-mmwZsc>bCi+tdI#t=FrBB=!DhFGrb~6#qg<&)!y7TW9(}SQjfm zWEP}BGHb7*S`8Bj75D20b2eLWAz>i;0b$ zZuFDT2r$Aft%T;Wi_9rsl^FI8dB?K87affrnfI$lbwy%B;aK?cgtWFc7I?RMUMnvz z4{*z>nPEB*4QUgLuOlu2Q^0zD`2&4W)c?6n`5)2ke>wsF{s;f5MWD6b=C1^K*d-~* wdj8>4PlotlxZ5a4J01)y9MgRZ+ literal 0 HcmV?d00001 diff --git a/docs/enterprise/img/new-enrollment.png b/docs/enterprise/img/new-enrollment.png new file mode 100644 index 0000000000000000000000000000000000000000..99de9ce65dcce97ed0243469f78a96eddab7ef04 GIT binary patch literal 21017 zcmd43WmHvRxGriU5=%f@>F$(RbV>+FceivmNG`fdQo6faDFNwjq`NykAMU;H**C_x z=ZyR3{$WfOlW%_U#`C`Oc~;P8>5s?=xCl?4JV6#06PA1OY-cz!hFck> zBP~4U3t3r#rvfji*ly(FHESz&-G?lwyXP@7 zJzwTB9gh~zawiWx!sqKZ+Z(>t59oi#<9x97GYtvO_ooi)N+P1JfO;erI$V^1ab(il z^_oJthC_YL~5!WjJcqI7JFP{Gii{MK?w9PSyZsOmEf)V77Qk6aKFDkJ_|_ zCAuIy5gqcDRmukeKM0o0`ZjrlW?gBTbHnhgP~{0vjV8{7zZ9H!ENBN+-dQ4miK z27cxX?L>kz$#}dA<-c7fLtt+byO0II^vIrL2*Owzh#se9jyGujp_%V-=xoE?@_!fq z`HaZM-SYDCqvtfY7yCt)X>)Z}`T;V0_ti|rg>`k8ucU44?A+Qum`|1B6{5a-N5iZ4 zgn%iUPabT_Gw9xQ#cGxDP*O0Y?crwEd!pQCRrGN(`5n+56eN7^X}t>8*Ld_Q<=;mR zLXEz6tgRW0w68E=B{EQ-R)@g5Fls$gLKB*et| zLV|%IKm1u5jg*arL+95r+L5m22%%@r>Uj8ko*MSwj0_Au!{{_%6w)c*!B*7tL5f&2 z_XIzEN$eZ;*%9|NbqL#?7hM8EDmdo$GOX!S`^r8j8cBr>D1u zbFk0^WAHrg!gBN|$H&Ll%WyQNxja~)xiQ}rfwc=gheP^dEhjg6wml|06v2D5m6z^$ za(vu7G~|@hpxx$)J=oWGa(;flo}k?wj#rejd9wc7>;8PIZpjm|PS-F`Dmj2o{uQ3( zLL-L0Qi+-&EAI1W&l;T$!%L^6I2D1I-s$A4qDT69|SfFZ0N&NtX;H#;xa7vnm4 z>+~lwsSw-p#`IRZT^=m9xUJT2#>nvEu$ilfi3Qq9v$NMxGkjL7HOKk83ATV)ucK)= zw?o&eM5snBtQNn+gvo52$e!6`nDBUEi1!xhguf$f`3>Kl_4&?(t$vs|_P5ALLNC

9Z5uju5l#CT#N_K3h2M(m^GwcZ%VS@kL-Ueeb;F&7y4>0^b&I}nFjg{S9Njx;c zosq!9F8}l5j?vN4!`54fzT@7sY$`}alR0U=Vouw@c3$*=;G z8!UQ_z^B*q6S-2!M>YrZ4W(Nslka6Qz`@#&F9Yk@Ltw%U6VwMTRh5i$oxadd{Ne26 zq_C2gSVVrOQv}a(XI#8&YA%k=`A8=U%0&;~fJZK{R@0bcAMuZI|UnW+rhHXV?)DpvFRAu*!&vF`pC4mxe3!<6UF0l z+?#Kx>e3t8wnq^K=K29w>V5}BvBdUE0=;JJ1qMsjvv9lMxUlf>(#n+QuOQQ@6Lzw& zY1i-^7gtw3v=gIW;)13pVHq{EFISorwX#TW!s5>JKrFP{Zl97qY;~@K?kO)p{o-5y zKDgOngl0iR+U-v_q?9p_|NMO3fA@>PtGTq^QK9uMzeefx(Xvof1cZRMxqI|WQOAzu zRgoM_ad3~D3%#;T$Pr#dF;A#iKMYztL65T3Wm_O5DE7SmGycqxXt5XGGuE0+JU;ua z&vBcO1P1K`mG2`a?k8*F5)#4OqVuXFjSjo>^YhZFP!AAhPeh=wHw2=byOSmA4YoNa z=7w3L%hMJ5sVQ9O3BJ@;zs<1mCcj{PhWSOpIWFHauW*eJeRWvdtfO*pKA7jU>CiAT zGK!lS?TI3ZBUxBj=rUwp@#J!8=7_txJ#4$&9((n?53~7ri;;svW!`U7rKP-_vEp1# zUjCg53~W`+1UMJWJm=R$ot!XbEUt!d1vb47?(BWd?axIM!HBr~_JL>88rLWLbxT@J zj#3)C+Db|Ra9FB3;E49|Ly2cCKecNk(NJUzV8nP{Ex%Hxo?opF2R-8gatxJl&@k>8XD;^l7C zVG=oLm)L>o3%XbtPpdP+FR9TnFltQ4L_ft@oxi=hz77&BZ1&8C;x(T5p^PvwerH8~Xebh_?D|#b*Dv(*>ucpp=J|u8=!+5KH?02oK~zkR8f*U|d;Pm%E@|8W6e(LcZh zK*S@Udc;ouE`=wT?JeOSfu1^S44Clav;G_A`tNA!zX2tTo(P)Abv6wgzC{)dlM!}%(Vx7@Nst& zJSAMF={U4ng;MYzo{vSR3zLJb=T6P@JOX@^p0BRB36O8-%wUXFkDQ<|5tuy@0RD_g z)u_7y|8)%#suGM_yGMr+JJiS;|G327q+;0r-vGk0n`Tl=60kk;$9agJZZVfMLFkNf z1OENh{dH!8u7isHm&EuJ_ko>r-&e@@4^0H92bNWg0k=WmIoM&00>w>`)G0XPySBf# zKj;ZXLN`nG9w*Ng7BH64a92Y^-^t&3J|~7Cl1mw3?-6H@Yd7qF5 z#gYg7;qkCa!SE&JwCwu#kl$kUJ5JZZXvC?5qmRAdVaNmy&ZACv4qMrI z=nrpaJHF~)7WAOvQ7B@;h62J8Ypzbh++@b8tmcCVR=1mMZ;5syALn>Jr>*u857%Kr zseQpBJ_ddGTH#k>qrv{5{?C(Nk?$@8>Rr}1P4k5ww^#uyQsMdbaPKW*)SZCygyshl z+h0F@0~+fks+29X6g{9%kv74iy;?C{nBKZhDv5XPnFR2ixnwl$2;>w}^=3I{T}B5xXh#mfJr;12@Y~Ht!?P z*8Hb#@UAjX1;P3I>i);n#mR(a3SxdsiFg%+6ul7Q$3SG?YevJ7k1SJ^7F-Mv|2U}S zl9U#ca$`I8@K%45exQ%KJG)9(b{H-+@tXFpbiY2O^-#G_mJfR)0rtN9=~Ns8lA!pV-gmjvdFiW1pQl1+aa=Mar7`rWi4dh!=gctW znolJJ>-sR7LO`&GR`I2pp_|ul%>=4QzZwSAxnpL;C5OkpX?KSz_p3#JiUSTLH6s^iadU5oUMfs_jhm<2oW>*IK^#xz zk}4bjo$4{K!`9k-#ypQeavEG&FuNU6-cpgEeO$*Lw;K+9$$rrJ zTc4TvbWppcg;j?D-I;5nqS>VBW^)}(Lup&{*MH7o2oKs&sUZEdOX{-Sz3&#HDT55` zUO+6$iJ(`%`pZ~80v`QLGgd(~cR_V${i%v|-x%$Po6D7XBDd*w{Qbl>iU{W+t%C@x zyzJK2%fhsQ8;;lyBI0Fq6sMkGH6KGk^i#8K6C3W2twE^>!c00sP+A z<_Tr|h^;QBc2LnIdJLS->6ds=FX}K_5mKL(KHPN{$*xpvdR$p~JtU-7xHG1S6^GEkr zdNsXZvK$P_i5uuqt+^kbZfH&XY4Ppvx8Y>NU<29KUHy}G#o;t=D)x_bmeoI~X*Jqd zmThv~v;6gqO&$Cnb4>?5?m+?T2i~gj268h);YV|4T-}L{%ELKGwb%)IVvfL_@opZzv&Fs7PDGET&o@~dTyZB9J@V= zQ#v@aIb{t$!i-VU$Bx1Osd@6>(*6J2Wu#MyQ0k;DL-F2L(#i*UgpKpx4!dbQSu{cj zb(S-r%HeS}8oHx19z5i68%go)VcWv%yirZZ($eq?nCb#cfw`WjOIwurKiF^p|3%t=`QxGqlKou#Wrgk*d-tO|4-07{zBQ7Rj+Fs#R z7dxfVPjA*5l@Q;p6!FlL@2xl|oBs1E0qgLbYIa+(exk}c2KHrP+-D*NAwJ@_HZ${^ zrq^6%T1)es9=1m3eaBnhRu@U$wOQXBSY|QuUE-8_*}$m=u6!~1}j&)daa+rk(saBAxu2iPC#{9&tEhPE8v8vg_maY6)Ce$S_YnV}9h8M^0Ta z5idef(997=J{H;c6!zKHA}@1fTBhq(i*32iR-A5Uv*v>6N~PD6ql@EG;qXPdl8W+;q3+cXY|8YD$G zO73X97TR8#SUb_ta@RLsT?L@6Q6{{JBOdU9AJNKs2@{kfz#c_IikuHYUoB#lR|=rw z8jC&ckG-9by=;%YtmHn-Svf?MKR`4^dv;35Xy+JkMz>d>9LPHMJ1;k(pc|_|&U+|* znmhP}CB{#HEJ!a%!nY5tBr;w~Q%=P&9?dKn`O!?yB?hJAG5vm^<%oS~ML!;ABc%3i z8KPVdX#-D_>Vs9rr zwS?$;E_4_uk)wYPQ7f;0Bz zsvQ@yrK2?JanutMwM{jawg##sbM(wKAG?z$1bD~}d80HCwe?6kw#0-g2BHpE_+Q8g z=LRl#vmOuktt^BD*SfX`7CuIn@Lp}!PtXXCy0X|Uk_9XZRO9i9Kn}KcKGb(4f=RWI zk@{i((!7AGDBOoA-*|K!I5ow#-k0wd6u2tt^ zwI6`=2k8naKpyMchb|+jAk`wagg9baL)?(k!XM72g{%>*Rdf>BhnaqIs3LOth&hq| zUs&?xGC7remE!X~6jY>YYfv0*T2(pJXMMf1M&XcbkVM>2M$Aj^mx4F?dLS_ULdt}zE(Z1T=aNzEt zLF~-9%^{(Hk=Rc7adk5vcUE%V9>mED6(rjWKHQkTe9SuMR0taC?vAintVQm;u!da8 z;7Jlq{u`f9@W||;&xC#$3@1yQjU=cdK|=(rn1UG<2ry1{jJ9boywMi@l&Ix{cSzNA zKZp5Nn=ewk>T@t9mpk~E53uQ~CuB}3X}QK_lvFAixz$Y36&H~x3BP~wBjGd0cwh-K z!wSlaSHwXhH`BX~b6CGiUy0-8QLrbxS0h^wd|IWr`#{I97Qs_*U0(9rKDXxgnFX5g zh*{r7U}SEgkQSHxZdJevLQ;kcFzB-DCY>0V{dIpvTvuLgz7Ql{G-YJ5NiN>`qwVtV zJh@jSl{l<3CY?lZCZBqS460*EJ_Sz6#Y*Zb2{*ha=cMi9e;wDZgQ!eaI37pK>Az{N zT|jFd^HaBBP)L=mNlmdd(W8fD3nQcGj80Z&{C#HEhJSlSYLvvvACk+4@wlWYlTWQ> zUf8-UEB-t=6m0SDHDp5-@ZAOut>(mq3x1zP1iz>_!Rg$VTbq7aR!o$Qv%^TUAUx4f zD0J;J+S;J?+%6%sTuXqZMyJSlxs^=h*JMJ)f`DMc4}VF?U5Fi$spGhn)RHc$748-tF{EjqQVG! z(5sj~ff!D~6!2=fQ5~zV6hCH=L{Da4lUSMZ15g4S@!n! z(N>aP;b2#qTm=416}78G%d1U#ywp0iln>Rp0eN*|3DLk>JgkK-Nhgo)f|xG-UxzWv zVP-R!l$H2Yd=nZ?UdI#GMBeGQb~J3wQk$SNm{Pl^E*RMn5tEfCPA#PEp&lA!G$h4| zIoQ!J-6kIT!azXVmDc_++fZ&D(?ll_doWO!CZM3Dw=?gLA$wl7zBQ{?E8)jVhL`!x z@m|YqN!CR<{L7tj{u)ye#kzjz;Z`$r+Hh`O@VFU`lQFkKTYi>h&e6+%iwcj1=PNl# z4?`=&tX`Xr5(Uc(p9_*%@1syl%Bl0-n<69`Rgd)azZbbu6SkMpPy;dAQe4<4(9iRCir_ZViuN^#l*#nMUIq1? z_M&y~r|c8u7k<7?R}~VIA6;%KXP$~faaHjx`z{sr>%9gM-m_QzN)rN%M+B`!+{);- z-_JA?`?K=wo3+&yN$TD{H?a_jNNF4ntsb(H@UG7tH?FsTT*yLOHDym5=}I-*p$I4L zIyla|g!N4A>f-TGMWGcvQv-|DcNK~sTBBXxMF*xi-tu{i6SXNqS49yeaO_`y^iZWD5&LgcqUY+L%Wvd=SD}E2M z@`MggsKWGql&IHU{+UN?nwXV44cLCEg)tSY=RDWk{`_}{j3vE`z2slw3BONd9|phE zSE`~=`Sj}8Wps^xbu{%>kjBjMG_A6ylvgtstyD==Pm3}UUI~A3yu&mwv;XDp%E=8Y z2=NPu&X@Sn>}~1pH;l%jmlB0`vD#r!11~BfDREfolD0Sb^HW3;d^Od*d?5oJw*+*} zS?%D0D$n1lyh=MC7npw;^$oBnUIp40isHFm^a^nK+d8^nH8|CU{p{b(!`M?(aW+bJ zz0Az~qxmH^qK$$*?$3ApQ-0~hk6Nkwr#WdV@Ap<2szFZodz$@BG5#AX7m23k9)lZYB)?L@@M`5|sp{uU%SM_(6C)i}P zx#%$Cy5DB9T{I3Zx#A5hD|Q{RPQsf~;_4X?aSnaz zAt4g4Ome5pL7FADlDS|f!fSBtKa;h+*R}v#DFG}N1 z1lIyhoc^Ru#E{wrCSdFQu(I{e(q>9_)*dRL8*Pawc!SK50@E3e{rEWYzS9jfgEg@F(4|vH#J8wUYiDQ@F3N9Vu?}6!P?)xbr=IL zSW+RsFcF;c70bR*)qB3I|cnQW{OJCtsfH=dXk35`#B1@xT{%3TLbjs8fa zu@8J98z=ujJ#fZ47#XkAX%zt4)zD%|V=CMFsYx@5sBQrYY|Q(dN=Ot^#x~VkndM5j zB>eub;(7w%33D8d@$J^c+U|A?Rp;UZg0Kvj1b7>Et2yDn@$2&J-9pYwyyL2E#*@%V zS=dC}VIibR5~=|uCopR?Fi5-4VSP%L@Fu=ngU0u6cth{p#+{HpN5IIuDaM;~<#sru z^;2V#=oaI7#u=@=!G1J^J$_G{dLgte4Ya^N!|1gnvij%~4%zutiZ^u#->JfSh9Z$( z-#ef6zve4I)=)=s;g4DQIovQLb+x4d`z&o5g<}!VkzUvD8h`Mhm`Vfn%gNRnBf*u0 z*vhNIP|ylDv)!j00u`I;Wl~T0wb#Qiu`c5lk>l*INV|`SyYlIoL*CJa!iAV5eIsWx zktq;qL`Ho_@JnbK^}4LDLcZKA67Ng!z_jWwcCn${8Rm~g2<_&uE;v&m z6VZvnO6N_828R~7^WuJ`Eb8qt#5vUKHX>MfEdD-umsi7(E|^$G6!aUG9b<=$!kM|p zLXj|{t=+{^D?l2SChF5R*g zturqZXxMZt)b%j%%fHYf*fzZEn>+G#DwJinDUiJ((YNtdAlPQR3w|NXwz4~AW%Gu& zK)|=QgnA*`YM-hL^)(w8Iy_!38FnNsZ_tO7B|4r$iwGH1M*>IU@UYGzx(yYAPpi&` zR94l5+23}DPHYpQf9m%}%awe2ak)mq%(I zs1_$hckqc*&14l1!ju$Cna`i|!KI4M+JG3fLP~!@azX3qW?WkkQ5>%Y-`uO|pIUEk zpLQ9^-K8(Nv=v#m{C1QWygGwbf0*JIY#6HB+9z1{&~Wv0+O8o)Hb}9S{L88ZetV$V z*7O+Fm!#ooza4lhV0La_T}S|%tbF^EI&D%(Ygw@5Y)$Tc)LILpsueUAe=STXKGJtI zISoQfGt1jH>=l6U(R77sak}Kh?dx?Uo1j`eMEewVQL`$FT*>89w?zA>y6?g#uZLy! zR=G1qGRN%8NeP2<^rF3r+OZGCbqi+SlyG8d>z@@m{OxO{8+Z00LJ!T~*6ZFymGC)5 z;xrm68amymufrwNx^d7l&qj!96VzUmdf2^r2tKwd&H9$({7XJnvnNeXFew{y?UU!~ za?gO)*&-SIY$`5gj%eYlGmFYQH>m`BWoF{pmHExl)n-YA?5PO}x$)^mauc`XjEq?< z>bR-1(jeT$Hxq;m1NkS&7>C&siuB{lVVKjkhPc~by#hTrg$#WHyY0KK?rQ#`o2L~3n0fRkc;$Q8sM}ZFPS7*EZ0}pK+KE2g z9Yf1zCln0sL655Z5hCKU-t|(hLsN~^FbvcWVpI}2?2LhP><+le3=WE|d5Z@Y=Z=TP zPDdsU6}Y}ico$YP4i8`4^y74`j~X*>lu@RzM{Ltuy_{^vX0331AGX~B&c|6e7TaCRK%&7$Rl%M*|8g|E+vyf3V>HuqH ze99-#o1iijo-662|H$U+s9|f+n%#>QM>pImDQi%Zi;_2y8qK?pL@nYkT!Vq;(DfZc z^oazf5m=&f?ShySU&$V#q?9G+u~(Q~99N{vgPUJ{CTH4}v;Uda;=Or(ru#PGa~SS) zIYW99=oe8{z?om%D(5t#&~vxtp?{>F=4!&kT$z5ksKzS|HQVC;P^|dp@`oj`?^?*y z@GMi|1T^7wvfP!VBqEpAtn8S;-CT(}qJy(&SE+~+8qO*y4;yVN+?5`dXmn64L{gD2 zMl~ni3`ahQ$&tv3PNNR6CyneOy|qnBG0sidRFapdjCBtp=UuvCeNI(ba?l@jMuo## z*Z%!_)R3e->x*ipe<^l#aQQ%1tp_3*JdO~zT!rAoOF1#b0d{p79W0D;%L_ANESV4zQx9_oG*DJ^W&17A70IQ%op&*)TR;&hhm;3dRUVdvzk}B$1CJI+`OR zH?oADmKEDH{2q5iI}StrxL$H435}>9k*Wdh;W{VOq(47uqR~f)N#v1uia}F+N1(+; z+U-^k$2P%DHyTgBgG``XgxF)80(5bI#yXLzlB+)N`y@Kg&Yuz(`zo3@>Pg1A7p@h* zs9uao=0uhwTHKkc?r=3bXMSLzRJS1A$_%!+l z30c{1!lrB)7se4Zg=d}dD2PqJeX!!H9~9j`)eMkqV1?Au@rbKoDiO>*oqLhIHDckR z;YWYb7>g?U(yT0fSjS9zTHci!(6V&?j%MO%`O9g+V@da4)}%3aY88!3sZEVXP7R`r zayw9tc4nCcyTCm6L#O$$X1b%JTz>yrFH2MSivGfMrPjs22@7LiTgl$Qfe8(rb->su ze?(LpN?3qOMKYRj6r)BO9%W4SkvOBlL4bKZRZ>nECe|mM`P^)=P0sOeAw8Up)Fq+D z<)46qLPyV!@jV8S=fG;MI zlc7S3xEmh!_n@;1cPN)WLrvxnQ^GtvrkZ7|1MPqNgyp_A^Ms*5 z`2agt$%u>sb#|%;fg`K-Y+xG2Lf+D50yLpsSO4*HB?qsFBS=M8*Z@1tOH6r^_C4u> zhxgiZ)6Au%m%Dl5?As*r^V^DnqSrrcx5e|kcO`u8B&99sIa?INicyg-uNQK#F5ZK1IHqPAh@*aZ z6FOs{q4f3n9OgS5;`ye|By=@`qL76Oy=MDX>k$-nElT{}jYh;{hOb^P?zsM>KZ{$o zGln;%`k%a(|3-27|L0{#fX-O1)KD4^4JGB#`S}NIBxG&x{QUeF3Yim%M;eYU&u0yd zz3uG=qXAq#zBa`orGcgw=UqB*s!PQPHl?BeDo|H#h4je`7K?tlSWt*>`a4|pkGq+GUGYoTsw zS^9Zudn_-3PCbAW&33llhQwY)NvYO)S@6@q;9vmZP&(h6j2-*N@o|OzuVrQGb@WV3 zvgm11QOk#iZF*e@p`RoqsOjiLWbHQkf0|RyVBpbfHD3WvWg;ILng8S2>>QhPk(IXOK(M&&7@jzduE!d}Z-*`+svg<#S_?KVESxNtrak}@D>aO7iOYE)HK z0VUQnj!7~1`}Zffi16?#O^$T7W%czOq1>)#lqa=c5x&zqBYMSY|LVVj-=tG1e?p+$ z>fT_`i^fC+h2n0+w1sCzA`%zPH93_nj1uV|J8=D3n4VU-UImojD8T+c=hb8x2)Iu;wm9^7IWl71yj4SVQSk)fXD~v&#`=PuU=_4+KX?Y(5wspJ32Zz-=`KF z3eUtpL_#vORo~I?p!oUu!RwQelG186qQ@{IF&r$l5j@`skffLj z@mGzBiD62Kj`qpa5l*xk$rLFlD8T-fo*ogESW;YU4rr>GpUB?ebE{Mt0p?x1wWA~3 zm&B+j0YE?#V|g;bK{~+?^>Z`pN5pf0*Sx*Dg4YN3s6SI_NTXCdU1cmIE*{i_DwD#o zyt^9`wK;hh@m>7^bZY!&j|vu}er$Hj_g?OUobFfF zzryhv@E)DE2Kq=rKGBp^3@^YU2NZjU9R;Rllk2S;Ryh9$8WOSi;+`nQ6eVMRR4#b%d@LPfy*epri<0onqFV~Jcq zHTL-a9sCT}7nZykli?E)5jo$TdLwZQ80Db6b3PWNCn&%-GMOsX1W{%ki&N?w^Lhl| zL*(Y`H*c&K8f%<8^u)z`KN5J5ZlFuXYNM`iYy?C^;Papnw6wIW3;Ou@xSsF$=Ma{3 zUI9w*N4%Z$o3MB64`BGj62J>ruQg}FMzX~lOy`RjovpL_JE5#SkjyTlAR7DU;GorH zggEqYIHLow;nTTYY%lg^@OfNyJStEJQ@Qfa8q?F40PFs%;uR1HIPT9X8iuPIT7Yc| zlk!9Bw@bOx2Au9Y0Ai|IDr+YoP0J5^h?uI-2%r;80M`s{v;yze&Dxsb)Q4DI@@Bl z+WQGHG4b%3v7uo`i|8)7z0WhE^07P_K93vpo1ZC}7Mg9I_jlK)>(K841RU1iv0I&w zi8V5nilio|^d70cA0zPNV6y6zQvEX}>g+ZR10XyyQ86;2_fiyz9!Itd9hx7h#EKBaEkI7)4&Do)*%jO5Lf_m5UFEQu$QNzB@ z8LJ(zHx&z*3|gU$U7ejsxU5@4e1Fm79a=00onqu*SM;oKB4lJ_x+7Ia13p}Fzu4RT z6JJSs>AXDsUJC+jqJoA7pf%pVd4;KhLfx#}0Y|Is$wIahu!>*I1(Es;FVQW4Jqdq4 z@}))vRYBa`5qRGfzI~vOGiOkP>pAs{_?Q?H-b~Y~UEG>?;Kk!9EFgfICHs+YzyEz0 zX`X!1@QshJFYrFR-6vgw@p{P#Q0x! z(mVd=CQV;`F0(!4Kk9ShdTuUfVB5#UA&3Ap9zSX==Dv$^*1>@&`6CKeFNVO!mL1S% zm7!Fg+e~$Yif^bd0Jg)^o{|~u={OmyJPlqSU8N2XLV!Tf&MzxF0>lYKK~W?hfm}xM z;6lM?^0VbzUBhg|J~+JI`2=mxpktG$sNrVUbA*$xwvji1$H0Z#r*!?x&VSU88JO$KQpe zwNGY9?R{`!)kGZq(GkAAt-hZzPS1E@^D%hW!LBtq7V1}GGo4Wk=-~UgpT1?@5$}}i z{|cvO-vBa=xc29O?%kCcMIS%D@UE@v=SR{uEr7y$H_n?vqw5r5VNgHeZDb*d2m_xM> zXmbG5OG*yLF$xP?SzV1HR^WsSQwB_a5hCm$Hq@DSyc?UF$<%{*k3gdLXN}p^@aJH| z5}@k>X(+ePc<_^AYVNa#hX)nmzYq88NN5Ce)u!?)DwN%XbRBYz2lGKWKz@{EHdR__ zAJ_g>d6+((#|?9Cv)vyNgrP9^Xrv9HZ^`Ud0V(Yr9d1B&mG$urSH@)i`>1!i3k+J# zfg*vDLL#dW20<1hQdd7?QGF~N*ZL+%B&S1sT{)~kY0>eZ zs3jo;zy#Ba>BQ6OeBu;8A};mHtM-Pvl> zmEc7AJZT4@(V5pg+L@qf+LQR&jkUVY`rCxn^L#?N&+l~#hs_F5yLHI5-X3tlEAomf zf!4jr!7)1_A-_vj7XaD1@Uc$}LF&|Y$@1TYb_Nr=+&|nN%0ed9CZE`c?BCs8+fme{ z^0=|R-*e7-nd|D}@|Zmm3Epv%k-gL_@`a@CkvF}gv;M)P*9pIeMT_nxp`iqnKeIWK z2^cg=JzR!BD3?zp90;Yfs^+)k0qEGhuJ0WkApMJ-x*Kh)Fa8Xh#Keii7Txe>Qz)Pu z6?1(1D6usE&njYO@Sn2se@%TLr49pmK(W;?6(B2@Hb8WI#BPakab$dp|HQJ~{4$S( zaiAt?Z&4uygbV0M)kOh1K-F{|~bUF8bovAPRH)L9~`xm*~ zfDs}?c&6rFA;Sd16SYSXsRk5COEp2hhf+~eQab;h-8#Q{!+S-@!Xl4vaz!_qCqqyH z&F2T=)GljV+mj}BJ&kNg8V&o5HkEz?o*tZgXj8#zSv;um5+M5e`nz>($ORoB#%s5@ zPV^#ayB~J}g!WE{K%tKi!aZ9*TO=;Y z*F@R9Tc1s6X=#gr|F_+pNCJJ?>gwwHF_66hQ5OL~z}?w-c@YGB532xG0Bp#^1G>^7 zMPo$4z*WY+K7HP3zdZ_qd{0jgK+YFiBhS}Ck-)?-im>T&COd2kQL1VLE*Yzvf%M?y3Je|_V$GYW&wm+N*!5(&i?T?5dWK~C8Q zkRwn~buazBKlB26!$$Y(O73?7Ou0Z6na{alQ^^#UFbc1gjh&vSfJVxY1GFpTxgDq^ zqOtK3E$$#cdi(YL{@vxAxP7rdhZ~j)B*436Z6LYP1uR!l$>#!0)D!ftCIBS_T1S)9 zVYe+2ONo+Mg$k&yK6o@LxWq}kM0`xqd1Hpg#&6!SeKPPIo&ezb1y|C5k-{p7JT^{F zSc>Nt7mhq!{X;{)Yzg>0X?X!CMo)XYUT3+0i!17(rOu^8W zKCk-~kY1&6Ih8gV&McTbg_KhAmN!q+e^?6xI_Xhthd_nBF$CdoGFD7fRH6-U(xc<+ z(@j0@dBScIO<&ygOu{a(u3ueUK(Q7m-(R3q#Ka3Eo$k$cn~+aI-r#hA#VOD;e)xbf zAw)Ecal*$T7up8U|K*aG_A5LeP`VAJa$!9mwg&T(PUoew4@8%DL6+s`{{d8LOh@20 zlDybo1WBB_vMR!Wp*4DsXwAIT#i?mZuz0$tEzg$YCmCkdxiDZ-E%?<-INP@&A{GfE8jHvq! zi8{@w2G#P8JvKIW{x}h>NuH1aY$Z1PNvThrU+JF=YKMB0k<3{w2^RC|a*%0AkQW;4 z^00kR_9vaLPu79{5p{;hDE?PMTpZEsQk$X^)J3rSKK3dqD$_vc#>dAO$jHUzw$d2{ z0JWFqeM1MXL%v+W=RZK!Cn+I;fPnBlQ?<&7b7~m~Lj#a-o=G;8b^y6KK-+gf!;ESy zs;!)odk5W{ju~=`qsL!5dTniFhB=W9<-#)ge$-cGq$arf{DAeQ)jLRA%Q5>`U-90E(7h`_g$m zT&K%*K_CT?%m@-%J5zr++7`q$-{bk zd$$pQ>KV5Uvb+aCJ-tRfBPr?Hqr4S@cLM?y@BP`>(UJ9IlLBhQ1k(@II=slW6AS&AG8Y! zOYy}_0w8#^75X0y!hjV>iit&1EVQ^ejpxe}c-=9PhvD-;$;m}SAI}a1m;%}tAx9S% z-9JF>r@N$HXNio>_y?4WWj3flfo$lwJxT^lNK$}^l0bj00Q3t0M!N?Mknd!lPA)HD zVeh4?KtBOAXNbdY51J0+0d&Ol8(;?QjrGdU?Vx^Sij0qE1HcCe=Zha9(FMI`me_oP4!1)+FtVd+oJz6hOi1$1-K4@h63C` zA&kNq6C+YzDzr@Mj1C8NIa&J)MEL&x{y_!uxt|2^F@bkuVPT=8pFK7t()pI8VZ<q0l;JZJJ1;5y*ug%4MmcTwUz^4dZ46)sljVHN*Z_vTBGmSEzQSr2mBGS z_NW6mnYqsR+mQ(jOfip{VzY-^ayu*53c|eZwf)&tlMn zvPbn`hANl@LoKq)xbavpv03d#t{$m0jXcu5LVVeiNiLldD4yFC*s9HQC{&2hh&F?JY)6cx2qMwc^GexXz~!N(sibl9x2o&Sl${V2bswW3>N9`0qL+gnIo>u}hs)Z?Q z2B_iC;?k<|(tZH1L+m`o_B2KwTPcw^;L9V9k5_+zey56)Dh${eafgs?K+f9Q8a$q$ zk)y+4e}A?5i{c2{F{ZJX4Gj&`JtqwvJ3CfRKA-{ZoA~yfal7AZ5dD|E&;frHd!zyJ zoixm3YvfNF=+S6d>*^Ar6WeouuhPg6f>BGoo&Z&$jHaS7l^+FElHFp~PvP}?&x*i> zd@3ZBc4gned3Tad87dj|KYBUSc&OJljwgzuNgK^{97PJnWS2vop&1iKjBPAUgcOH} zu}cgl#~$H?Bzs1TH4aJC*v2x+R(O(qVvsF^&i$Wyao#=8tLN>1|9|fLzOMUPe&3N| z0!{ldf6*zHQBGBndGQ8Vs>al#yup%@rX!OfX6D}2F9%0?cv>Vus@@)yb=1_(E`v#2 z$;{Hrodr613Wd%u9w-clw+5fq#+s;IkC8W3b8wo;xtwTQ0$k8(U>nfr6Dz20cc;-u=nOxpdY>u{~gTiZY^wgng<+4=dB zvKgN;0bMb3ztOBi8TSC2Blz1y3JQfH{6-K5^;p@5d2mf%cTjKu!QAJuvAViCNLrr@ zrL!Xx2w_ySai^p2O0G44B?WSHNb4#g6Ixkp04*nn?_pyEpoZ)LNs=*uj#xzhQ3UMK z`vOn;F}Zm5^$$a0_W>V9DesdP!N{l-6hYRX;L=oY=Fy|!*_txDP!a*G?kwJ<^NwwY zCsZ=eje(sc=t{P3DM%XC@R_#(aD|H-)7fB42BIhtlcIN7U(o|IrEU34^?p0BkLa7H zh~K^E6}-8qd(t~r%?enUClS(oEJfELWoes2opJX8#f8kJA$SYnv{s68`SoDEw( zjSN>>J#fde;${y(%H-7H0CMLix#qtowE-PNJ=;YU5}qB6QT?I9J%`YPiUL?q$Z`DC zbN{d55h#=VTL%9Bx@}A->J6SqbW=vG_}4%8AS0eWE|8lwfSiA!c*l+MM%$JyxjlOV z51hLgv{=wF*wEm`O4iDD$rkM0OVZf~I?zQ(7>02$RmFu(0S zi@g%v`o^kPKM$%AVD%05R$9$Ho`B;zLt{fKU)9zHJ>s5df9;@nLS`AhLWRFD3hSD7 zid66;AfZRzFOshd&~jO2Bhz98(Y7)35l;0n2cS~JEtyotq^^P=qbt1ZK!RjnO@9*P ztwllrtirjHQ5aXzMl_+?4?m|u6rvn77^X+`N+lJdC0PYZxP+O8RHi9c5B_a*X}H#a z`@{oa@+ciVN3UiN563!-XeteMUTN0GP?xt__tqMs%a(qVm($Z4=D^a=T zaEa2F1Q+iAAB)D=x6jB_uB3Ecp<8ildm~T!S)y@m)M8^z|4Ezu%%p-240*z`%p>t{ zz32weR3B7haDJ*#ZuT^7w-6uO)ViYthY{4yuWXKBi3pWmZ6GVq`bn|%kC2&&awUT$ zO;*0h7fTz5ZcAYh8S5QtQt0=pe5Tna>VkvD%#UoCU({5*2AV9d<^C0@JLR|98Zss1 z9|fAF5v29?$HeGmL~2w*oEyvWeWUA{?KX?M9&1k}OuGyzOTCBE^q7Z)NH3+te>|-) zr%A&`H!;~(z1l=BIBchy0n+^{Mc_MJw)|UVfKS?N856hv_VgFL4*g3h(d+(eZVhNv zgGx4j+Ub%hbqtLuh_;&U#)YTj&4(|HN^D+LQMhKf543*Tv-C#7VF$QK1pn?&br(H9 zOOPf`=`*ixf$pt&E$95EUA%V^*(}hlAZ_OJHC@EfJSQUWopmq2#o-@S(-IgOWDk7q zR%?7W`&Oi!_(J||4U92S(ylDRmz?%(KpYBHJ{JEMQ#7)Z(o0 z;D?Vd&o9Asea}d?9`(bVk*E0y6AOP|$J;1ocfg$1I%{53AC~z~$2HHSXHn|KxEHzf z^~5y2g#>76Gkr+{qE=^1wzls|=Ce?Uo-RLkN006HJ02m?0w7QWt&j7M z)$T^}2b;$>?_^zuW(l@wrW9t8d?C8KKF}F7x{lWCswU;hE9-MW@&zOx}Kf+#+J>0~`QtHY;z=1uYk#5G} zfbULrYtltnxRs69pS@@|_o1TR+}-zA2g|$!xA-fOD%36dVk)>QIrHmUoRryB_rIC1l1{L6QXLnOP+)b{*#uFa~ih;zdv(#cJbaF4$xD zahN)^n$)I|-Z;7!gfO?gG=^cBy*Jpe#q{wm0a561m=i>*U~Vd;F+e~uBFRjn3DUd? zx>OnN;8_`*GWk+0sua+0Gg&_UJ!e-Rj76x9fdUq+e&cl-c>A#wrqimk8zy~_t!+#xk>t$Q8-%UP&MBXm9z zx65T&Ri4`YDHEEe6=x+M8RR{9@ZiIzEB!A{cTV^5u^Xq8!yjdD69lR4*0n~=pBG{! zL5888c+JKpePeuZQ7rPVTioRS%Zt-1bqPZ>YmwQAA67ORx;3iWCksc>`JQfE-Hr!l z2{efzVlXinkibn%NlD4b*eaui)@DT%oOX`V=uZ*2X3f@yJHO9Lvnu}76$+Sa)WhMT z?Zv5xGf(|rhptFz^PChoQiT}mn!BZUDwxYLITe50bimm+IIc7v>jnb@B$rsKpI~HH zl)&r6DH)_QARe3J&OO@U#hCr8zbJXBmgGSalr?*xd;s*4`@JSZ zUA$bZT;R#b@;tdI40I{;-u7`+fe|xH1?6?oQ}GAAuAOI$3=XHkq$FXFK>f&T!~=R$ z_>KuwV0Y%i6CA~!(s4||Hksb*SSJP26WDV8GV;>#3)8?FVTH8-E3U@26M;woXTEx$ zaNy_OhogLskc&UmY)saqtgPKTH|PS*Ov{~(D9`v|>DKV7USZiVSiOT-EL`z6AlEf< z0))2hWr5TQd}oKc=aM2HKLh1$^jMoh)D!EZSM-plVt>_i8h>S}!|7Z|tyNye^Rc^6 zgR65wTAnDy1*d4c3jd-ma2zde1P2oJind^A6LgcM1G#QHav zjaie!hQhBA-m=D481t@7JoZ9p>XZC!{N}!Y(-TXrf$Dv-`Go2Ecb-%+lJvae1_vM? OcU(prUV5%=8~P6|B~c*& literal 0 HcmV?d00001 diff --git a/docs/enterprise/pomerium-console_serve.yaml b/docs/enterprise/pomerium-console_serve.yaml index 78439c0ea..b2f117c74 100644 --- a/docs/enterprise/pomerium-console_serve.yaml +++ b/docs/enterprise/pomerium-console_serve.yaml @@ -7,6 +7,8 @@ options: - name: audience default_value: '[]' usage: A list of audiences for verifying signing key +- name: authenticate-service-url + usage: URL for the authenticate service - name: bind-addr default_value: :8701 usage: the address to listen on @@ -22,6 +24,9 @@ options: - name: databroker-service-url default_value: http://localhost:5443 usage: the databroker service url +- name: debug-config-dump + default_value: "false" + usage: dump databroker configuration - name: disable-validation default_value: "false" usage: disable config validation diff --git a/docs/enterprise/reference/config.md b/docs/enterprise/reference/config.md index fda89f07f..e1335a9bb 100644 --- a/docs/enterprise/reference/config.md +++ b/docs/enterprise/reference/config.md @@ -23,6 +23,12 @@ A list of audiences for verifying signing key **Default value:** `[]` +## authenticate-service-url + +URL for the authenticate service + +**Default value:** `none` + ## bind-addr the address to listen on @@ -55,6 +61,12 @@ the databroker service url **Default value:** `http://localhost:5443` +## debug-config-dump + +dump databroker configuration + +**Default value:** `false` + ## disable-validation disable config validation diff --git a/docs/enterprise/reference/manage.md b/docs/enterprise/reference/manage.md index 30f7fc4f7..01bc4d62c 100644 --- a/docs/enterprise/reference/manage.md +++ b/docs/enterprise/reference/manage.md @@ -389,6 +389,47 @@ certificate_key: "$HOME/.acme.sh/*.example.com/*.example.com.key" **Note:** Pomerium will check your system's trust/key store for valid certificates first. If your certificate solution imports into the system store, you don't need to also specify them with these configuration keys. +## Devices + +Introduced in v0.16.0, the **Manage Devices** page lets administrators manage user devices for policy-based authorization. + + +### Manage Devices + +From this page, administrators can manage new and existing device enrollments. +Device enrollment let's you create [policies](/docs/topics/ppl.html#device-matcher) that use [device identity](/docs/topics/device-identity.md). +- Users can [self-enroll](/guides/enroll-device.md) devices, which must then be approved in the **Devices List** for policies requiring approved devices. +- Administrators can use the **New Enrollment** button to create a link for the user to enroll a device as pre-approved. + + +### Devices List + +Displays the currently enrolled devices for each user, along with their current approval status. +Administrators can inspect, approve, or delete registered devices from this table. + +![List of user devices](../img/console-devices.png) + + +### New Enrollment + +The **New Enrollment** button allows administrators to create a custom link for a specific user to use to register a new device, which will automatically be approved. +This scheme is known as [Trust on First Use (TOFU)](https://en.wikipedia.org/wiki/Trust_on_first_use). + +![Example device enrollment](../img/new-enrollment.png) + + +#### Search Users + +New Enrollment URLs are only valid for the specified user. + +#### Redirect URL + +**Required**: The URL the user will be taken to after device enrollment is successful. + +#### Enrollment Type + +Specify if the user can enroll any device identity, or restrict it to a [secure enclave](/docs/topics/device-identity.md#secure-enclaves). + [route-concept]: /enterprise/concepts.md#routes [route-reference]: /enterprise/reference/manage.md#routes [namespace-concept]: /enterprise/concepts.md#namespaces diff --git a/docs/enterprise/upgrading.md b/docs/enterprise/upgrading.md index dda1a8c8a..26e342a87 100644 --- a/docs/enterprise/upgrading.md +++ b/docs/enterprise/upgrading.md @@ -14,7 +14,9 @@ When new version of Pomerium Enterprise are released, check back to this page be ## Before You Upgrade -- Configuring `signing-key` has been replaced by setting `authenticate-service-url`. The [signing key] will be automatically retrieved by Pomerium Enterprise Console. `signing-key` will continue to work, however `authenticate-service-url` is required for device enrollment. +- The [`signing-key`](/enterprise/reference/config.md#signing-key) has been replaced with [`authenticate-service-url`](/enterprise/reference/config.md#authenticate-service-url). Instead of manually setting the signing key in the Enterprise Console to match the Authenticate Service, we specify the trusted URL of the Authenticate Service to pull the signing key from. + + The `signing-key` key will continue to work for existing configurations, but [device enrollment](/enterprise/reference/manage.md#new-enrollment) will not work until it is replaced by `authenticate-service-url`. ## 0.15.0