From cb08cb7a93e8da2edcd8c86d474f94c7f990e504 Mon Sep 17 00:00:00 2001 From: Caleb Doxsey Date: Mon, 22 Jun 2020 14:15:49 -0600 Subject: [PATCH] docs: service account instructions for azure (#969) --- docs/docs/identity-providers/azure.md | 19 +++++++++++++++++- .../docs/identity-providers/img/azure-ids.png | Bin 0 -> 18079 bytes 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 docs/docs/identity-providers/img/azure-ids.png diff --git a/docs/docs/identity-providers/azure.md b/docs/docs/identity-providers/azure.md index 90d4ae2de..523adad81 100644 --- a/docs/docs/identity-providers/azure.md +++ b/docs/docs/identity-providers/azure.md @@ -94,7 +94,24 @@ https://login.microsoftonline.com/0303f438-3c5c-4190-9854-08d3eb31bd9f/v2.0/.wel https://login.microsoftonline.com/0303f438-3c5c-4190-9854-08d3eb31bd9f/v2.0 ``` -**Configure Pomerium** +## Service Account + +To use `allowed_groups` in a policy an `idp_service_account` needs to be set in the Pomerium configuration. The service account for Azure AD uses the same client ID and client secret configured above, as well as the directory (tenant) ID: + +![Personal Access Token](./img/azure-ids.png) + + +The format of the `idp_service_account` for Azure AD is a base64-encoded JSON document: + +```json +{ + "client_id": "...", + "client_secret": "...", + "directory_id": "..." +} +``` + +## Pomerium Configuration Finally, configure Pomerium with the identity provider settings retrieved in the previous steps. Your [environmental variables] should look something like: diff --git a/docs/docs/identity-providers/img/azure-ids.png b/docs/docs/identity-providers/img/azure-ids.png new file mode 100644 index 0000000000000000000000000000000000000000..b4c26765dcb98732c8486b59b6b298b1c93f9ba8 GIT binary patch literal 18079 zcmch;1yq&s8|QiH2I+1DM3C<84(aX^q`MnLS|p@Hx}+PVK^ml6q`MpU$A4yLXZFm_ z?w&nokH>ns_wvRQpYQj1h*VLMMnfh-hCm=_vN95?5C~KS_;)QLJouCEN!%I&!D8}O z*LGDk@t|;YcCh^L(SpL&%h7_u!t;YA1md|^@y*KpZxe3VKQmlIXlHHo?jGLNpp=u7 z8oB+PZ`YTex=cwDHG>iO_9DCwT8Hx`!2enccJE5? zuJSQjU%aht?5mn%Tj*sq4c2+jxsYM|KOs?Jn!8Qz8<*>Y$IZV3cO6tuUx)9_Ox_gKcDzZlyroT#7UZ&}!C5f(!-00-|;e;qkvmkg&*2OAlx@wL|6KT!+t)QEdzLuw7jEdt? zn}f(_Pj|}H_~O7S$|RK#2iAsHgJwk{iGyapoZbhi$O*s_y2x?1;Q9Qn^-@L|udnVU zawGVd_bP12=C|c{*=px^m&(JLWNELH^yNwll8%4T*A}MPmee;e#HTaWFUyrx)UQgV z3tlbDSG8ZQN@r8Y!onxNmnQa$X0>unL{L2DZ1#6H?@Q7&w3wOEG%_1id^l_yu53N( z7|5c_at(}BQ|5n)W@qAodBdnzZ8O?}mY!nRy0@)o-+pw>fBaa!*jj4T;h%4_VNido zE;m;{Uh4F_{@N*ug6B;sA#N0}%2^@u#Ke2f3&Fo68oV-z@%J3AyF1-v9JgZFWP)R?tz+Qn5^_6y^pad(3{L4)c7-g4t$7qX-pCxy@f& zKVL1;VD%JJJ#lyMO_qyxg>Jjq-*`=VlQ*`r z+lUtD>Ep?t7+d{#Jt|^cD+*f==EGQ*dza-D&0i<3NA!-PSIoZ36K?1s`Vce9?kD$s zl~vniw4Z;-n(<;jh`#j7_`{@-T2J3zyE{(`+5VC^f-UB#kn70q&J^ssBPXPN-CtE^ z<4{9{q&0XIu{D&9#2iR}9(*DEff1f34*o9~p?H0d1iv&M+2q7DtM9_=2ExK1&Z*(QZM6afc6(BZ=? z8euR`DvKM4{YVQ{ri)lDIuOh4_(QEed@1?CtT4oq!5p@?hTb%XX-TbH;-y^NtS4+U zq|txA3(M4d;pg*_FoD?{u7efALHh_U-a zq^uG#4@EN*`(`9Z4rCB6AMMAJ>tFL(|?|GKk4u@W8i+}lkl;!xWo2gCl zWA!ITVD|JTfge-@Mt1FRdm+m=Mhh@AM9Y=$d`oc2nkJ)~4VVLnNLOy#CIoNT zOYb{WH#@er)H{)0PW8S(^L4Q7Hg^^NGjxVf0ua7vYz)S?;k;(_wkuzg?OL3{V1e;?n(9ig$Ua~T|oLlPr zK)c~Smil%>Yi>W?uRyAmulfp#zGl!Ep*22$Y&(8YyASzOE7W)`mHd(|PbYL7?6k_q z{(2k!TTgjmi>^!xqv^N4LoB~qao zl>g3aG>G1aq2(yPPnm$*ic|b-x>_@tvcHCyc_^8cFb0JjNm{lkS>B}hwL6E-_j}V< zZ>2?^F%tdx(Znv;S93m|7+RUwe<9TQEa`e;vXR zyglZfhQIuwHY`fnGSduMoNbSDHk3wOmspyceYdLcL}n^)WsjDz~X61Jj|jV8ZT^q zP5tdJ7T)PB+c;WeF{#j6?e98qhU@MAI?kB;6Whka5?dQx4;QcP9@(O^L-c{j!9;^o z&L#CTJ;(B(0ZQQZ=vU$D&o1~j6j1Eatp;w>HP&#iV4CO0q3(}kaA%8PP`rE=`pYjN zo+8q^B6i9-`3sf1Br1q|BDOfprP=v;h9y|vFvT58h}zPYA&64bApsT?ag*_lF|9$d zxSm|kBgDbzlN^|i@bh$$4kfRmBrH8-th=9S2w9`=piXYA(e3bH|8j78(H@S(LzTL= z1r~>*_#VFhlbSGO_j(ps3LsPa>Zms=I=w`iwFuMZ=gM&R_Y;b_0s!5LXF5 zWu+UMXiw)f$>R(sQstIfJ*(&}uka_$gc15`BZZ+8HoR~UicW#?dIpr6`4(jdPs04% z(p5C04D79j{sbkDoJ!YEIA}Kh!GPy%+Bj6mh6=xFon+hr4Wch5jFrbm@O#2)u?0j4 zTAc49>8AHv=z_5bTBs+va_q3-TugnGltEufWhhd^x`+;RSJnvOArAH{yv2N*Q6>Zz zs`6Y+Qpcet=1~w?^5@Jk&})G@{mJ-q5CUT6JDP?0`Eb&v!DWg<=m=?n?KJ!7Pgi1dedRinis>C* z@*Zc9CkIjItO@p?>z4ysi}!eKWW~lrffi=6gQE6-nLkRJZ8lBB!Z{XmGG%EXmlk03 zrycY2D$WHCd-WSq@l-8|{P>-eW|F9-bTjpM#DGmas$zohFIeDcv8Vel`P}AWpzF6K zB98bhDNCO7a8VHjym{Fj`vqai=Vf9M1`(WB3u6=^$Xhg9Umsw@xm#c>Xr*5Ba+Hi> zVUod>*+iDo(qbS{F$vak{}E8U>dR=x@j;6~y&4Fk`k^V^>NR?~9WfPoqz5(g4fWx* zm6vzlH@2LF8j&b$R-0hQkE!aa17q@DN=Hu~0xpHr8?~Z@m~TIbGz@x%!367nB-~*1 zH7A}aSmiGbPS1;L!tg8^o2(a-NTB6vidt2TfOn83>CNes5c^|qGq&<Zh_2%yffQlWEKKPtf&JaVGoUl0_-3+ojmg=1uNCg`s65Vm>KB%A6)}Z z2B|2LZ_4H8ACXw@qoJ>U81ri+$k`zMq{8a`*3fuKavBwgX|ck`jcqd`co2M0mw2sB zINgD?EcpdpAcJf>5e23;JxgR@RC7HQfiO~>zg5LbTgG&Y66rhBJ~s9TB~Jn@rf;I5 z)}F>(13yt6E_J@pi?V3Z=epGq4d-&+nrQvR&?ie~!~ELq=_8fEmg8MKCbYn<$Gnmi3w6PUcU;uPk>`gjrAd;3~KNG%x0!o<1XhyyPBJYwH1NN zSgVRd2{Q^kDBuOn2(v=4lW*0e=gqcF^aXuKWDGf%jY50>c?^#s=RLz$|JN2WG{;OL zFbVu{V~TDSO_bu+1>Ngifd{6Rqi?TZ3!rA7UC|3B{~_6Y-OXX)2Tif05xVSYuFyk?WfbQ5B_7&%>5zx^OX#`LuOq2r89;$bPIM9QkwN*9k2Qz zUp~c0gwPh?Dhdup?dF zJL>4WrYXz+p))1TMS6viWQv!dmngNa8W`*SuKx@je~{rE`reYpVhchuf+dIgMo2OI z)s+opJnmsIIRSrffl#t&{bj_BjCjZ#gRc2L42)UyI_3!Sw;A+s1oq2Z_)?j3wru8( z%L)2;vMD`Yte-ajh#>QE4c`!PD0rz%E}hh7Khy~JZXk{$@4KE7?MKq?p+LE7MW~3V zOO%CHsIqn!(@4PDG!&vRc|iYm)VEL0o%Hj{jr_^8JH{g)tAeG9X0p9fc5&5@@%{#;|zTwxS1dP_yzY zu#G^uJC>oDMMi_-o)B+~K;I;e2n>09&yvM6rf#myDq?d0)0%6LV<*Xms!1xH9rc6O zcemTd)0YKvC_z7W?%n%`up(AhZD{1_>s=f=Tkh!ev_}+nmJt&e$?pnX61Mq9Ut*?| zAtZWj6V(k}P^(G~h-Ji#N$fke+>^Yqiu}J9z6m+bCSy^x+Q5%bD4F9IPcm7HjZ{U1 z;$KE;^4)m7T@e{sw5F~`WD_`&A{JU(n@CUQZ z0xww(D<}3V2^m2dPMEI7F9BiacORe`_EBd=m3nE|xfA{d>c>kiK&C4ps~I%5`8LAi zl$aAj>y(^@pMTrb&)6T#5#c>-)>L0cSM4lUDLs$z-gvCtUhv*1OXRy8XMd8~Sze0^ zKOPWh`3If%szffCuoeY4NueLa#Z_d*#s7EX2-rm#ehGpyJt8E1Mr!p`xS~;?_{@uy z@FXNj>X9XjU)h9dk}AA=3Z_Mq{T!9QuIqSeR=vOer@Snri~`X=kcXG=O^ZzAKY3&( zQ$e2NfmWZmR*ygxCbm%!RJp3pL0Yak(MfaCwI!z-~^9 zebGy4$~xC8hh5uNf~kxdp`lphOSx73%PXo@ld<+*@D3$}(9h!A0Y?O84^=XSXlO7S zGJUsHsAeV(3esX+!zo6Kf22NgGqUktZ4o3Q^Er%XgwEFbnnY|vRTkvBPM)y=#8>lh zHn;Ts4qvQ->)r4mCi?s?WmlxS$jFt z2syu)n?@&ck4s>tOzvXGm~&WW$?9Y2t2k+yfB2z8^lGa!f^>QTx1G z7VS>f?^^4)_hb3v(|nF+EfU)wh!H^F=fPd-RH%Xg`E;s9(NN27De04&Uj$P{(?5?b zYhJC*h;c8SOrkpXM830R{B7pVTw3+z52Ak;weXmvID?Y}rz^yn5J)w#L$^4kXslG6 z@a0YKpN)=F$G_ohX3-&Z7M5Kg2Ka*feL4sScRkBpeWXB2``G35D$dxLTJp!7JnTKzen8p zuLOaD_{TZotLzJD%|nC8w(Y!GI5|*?4&@*szpMj3{`yTJZDxJOcYwcuk4@L%s_eFsmiF0VIC=GkjW|Xs+J6J?@7C7& z`$2*SH$B~$`ohEdLEU|a>~iUU&rk2w)jwq`J%`Q&JfYaHwgnNgf346w(Q#-;+8W`W ztk7#jXz^F=V3w4uAj}$mr~B_3F0kPWgUhQI%_qLQAWVeE(L=TCM^4HuZh1PB$RVU0q#JqM}`h$jDMfW0_|I+=Zr( zw@B7&9exLOfzHmSua4EaULODbsEUNE%5S)@!UlmB8ddN`?GLr=45WpJjMkHUiE>M0 zv~iJ)xjjc7s?!G8| z;zvWXX+dIc5;!8r5XgRe|V$sj;s%rl^v2=vYDoIU^L~y39Nri zIPUQ0=YN3if8D!D{_oa7A^lpqH;y#Qq2sRq-b+*zs!%yS+(g{$>|w1lIye|Q{iM)- zA^7FOBbnPjeRVr9X8Trt@D`Bd%cJN;BM;}TwaRb0O(AwYJ}!)jB?_(TSd96`oP23l0f6 zD+)s)su-9l(>iPH^b2Mx(K{RECLH|57j=5-_;IZo``x>Dx7ULnDhyVpdb&iY-h$|s zz9D{l50gxc(f{=V!NKpUZ)$34a;hr&zRPxo$k238;%CL})}nn42!+}rnIz~BAu0YJ+U&u6E;6h%6oj^rX6FDd9 z%3(AU9U><$pF4NJ>i@`duof*v?dx~^PxEPhY;5=8%&lupBA{hr_tGPP>+P?yh0faD zO!Ld5r8y#k{pRN81z4&IO_U_LuvkjU;BkRvL0At%Z*Om8`+Y}u=kCm3a$l2^#i$Z~ zE)5Lae+vnL@%8mp(btbgC*_;}eRAy0^IU|E=CxN4N&n_uSLoR$i@-Z{Sy_jkg@tc% zmM_uAhfelL1VU3;_=!U)TPW;!rFC<7RPWG#U}>pLXL=?(qd@fyc%;-k8;#-LyA0hL ztC$f(BJy8~Aw{=Q(D$zHz^~_iZ^m%;f4pIZZ0WM|Jzdp|a$GkxH+L^BwJuDzwl?SH z<%yj(eo@`XhrYZZ=C;of7l8-}3Yu^bz1P$XcRyOx3GtPcMS6UCI4QY*1}_^IxIh)UXMqDnhlMDH$NSPczal7k zcXu!F&6B{{^|Kg6#8;WS%kJok%OaV&!^*&x=1u#nDk<-VUBS?+gYsu1wR;H(3T9^V zBIRs&2#5%C5&`xVoK>TGWDN}s@cnKt zr>{OmM~7B94C@wER#q05l!)r+5Zc(#^>E!&ohv9(q5tu2OT6vhGef!IlU7qpi>a7t-l#xYn*I6T zA?>?WpHH870x@PQdh$HJRNHLHMf>{0{&nWf^0uLXM<lr_+iPptHLG-DUOElPl*Na;jk^Tu z+)3;5X;?V8+|m~0@qV-jkVaqGt#n%{c1E+~zJ7Iksfni51TY9fF&4vGb)G9cyu2F) zDYT}KO|T07TewX;t;Wa8yssi9c31Nek{J!V!G$Y-Lb&c;-tNeXG}^q3a;_khM=z;< zqZZNu70Z)9^=I&R%TJEW6K>4O++zpuY)oaBtNwK_A0DE3T1`?NKHFfB%SKmAw-(^8 zO``#b;JW*x@6p`U#}q!01Y-A1=au-BG4pp{BV@&xA@2|=P-X6K-<%3#Lwj0d^@Bb) zi#I76bpBe<6KyRdHVgfcO241L_NO?Zaunb!TQmUzY_n)qbX`DR1PDz11ZE_4fV}=M z4$MD&I3s2yB5ue6ulAX^jUfPUBO_cE90czP!2|E>7k&BI|9sH@s{`|!ii^7Jx-G76 z&Mz*YAhEHrh^VL%3JR#;@ghQ4zA0$eSz}s`XQ3Gxt@+%?L`S27a8<|>_|`~btMLtv zudRlf9Dnt=`)x=y9i=sth^i`9cXu}^T;cL5?q(>r|m2SEiHUjR@SFapVm3Y7D;O1 z91|kXe7W%r38MvNMWgl?>)!?k2ghe-#_aA|(o;S8Dn9t@S9hgBtBRo^dO$z` zqkhvXUS8hY$BS`HZ0wNoaz=Fxja;koECOMFfnHOS`-<=1Vf7k5irU-1>osNVk0uPE z6c1nj83Z#pI@(wFVY+;}<7U-|fZY;|Z`J}ZVx&U4LJ&6ZcCry51gP+b^VKjQ-@`$LefdtJ zA@G99{Ax-{=wI0jH?v#adnPBVC-?MMNBhG=A-+y>A;_78r1}N7CrD7I&R-yq*ex4Y zj{wTbue%$2^j+QB4sEk**bo-)X{O6FEebt@sEbD1GX-h7Ho~niVXI{+lLE{YKa2Tu z)mPvDEf@&#YKCKUFb9npcYR0nc--<5mg#l7AjJ6-y0Y_jvLq7~#jNe@;pnc3qv)+% zsp9T!%5bsn?6mGq)3^(ZOFTXx^M)pLkPtN1P=Vl4aS+9}FA zLcH6_*uJ6m_4Q3ybL;|42)P;_AD0G^1ZrABMn?4DpiF3ZI2Yf)`$Q)|LzbgyaG;xQ z4X2p>41`K$w?aQ&ZVnOtcQ;PJVf|`(Wu@9>M@d~v%WS4pgPxgrpj4ym6%mp5xL13_ z$oM!0yCwY*e7X0(7TvIrfL+8$f>e(jM3-xP6E#za^Dx@&5q@Jl7wfBWcek#vrFw$1 zIFeA$L6){CcF6jGKGXA+w={tQ-le_=ZjlDx;~F`CmkzDeWfAv}9kJK6p{*O)I}Fv& zo`kW_)$GeSrUL)s^yYnANYw7VAdqXzwXQ}r{;na>(AuyTJSJP0gP#Pp1{jaJ;KD%% zMtr8lilo4c%2h3aK!SpTX2(IPH8nNerz%zdY?b8&4??&8n}duDA_&L#Iy#Z1r3`>} zK>O~Vp2p72%?05P4awkff)0U4tNBneQ}&OkSwGf(rG=82c^m|);M3(aBoH+A7yNkt z{yhYurKNRyceinUw8WA=3OX6Rq4(Zv9v+^b0|N+t_m^FF7dzy`nXtU1m>6}N0 zR&5k_b1s7U%~?PCCZ~kD_j%r zvddGt9zy>-HBOyUmH<+_VI0VaMc>(aTdlT>G5#jU4d~e_qd1K+O`X;!>xql&>xMgj zU0otth19?fzXxat9;3GLQ@O)h$9%I3U8P~W4H_Slg~Rjc*8V_AKHv6CF(rRe?KV-p+GLZ1#yt!AnVJ`F7$8TV%NEX*sTV- z6uxtbbt6`^G-Icy!NjIih^0z(2%3cjkLXqt&r>hC3I4dQ#l-W$bDO(9w z+>uKV4cg4-1DY$}o=Idi^zkx-ConN3Co5ahs_Nz>s;y11J(d|27zjz<1Mt=0uonB} z3szH8lksws)9K}<1c(XHnsR4sSbeTP^6>FdQBpz~w7S;|Qog38;^f2y0%mur0EN$W zm*UoUB1e?R>zoE2mB3MXcH@O3sxTz3`(>l8wIjjC@ zL;7-#ytRQjlN#+;$3;KGZ@29R#{1z!nx(@uq(5UG7m29CETEIP}MLLeG53oI}R0>TBJWpwp`O!_{VIiQcj4g67-|It4B50L!#e$xNy zzzQ}Qaj>8Ye262CDFVXAs~gY_f@`9p9KUYd2k{(4N_208%gf8dS%AcCU2`b;^-Hcb zdk(`;cYJ#K**M7+GLal>T``S>kdG4;HkWy+k>~pC>Z9Uuyi9qZtkjS_a(vCm%#8n4 zP(a}DxntpDgI++()9!tKXO${0;;-lD?z3qctjL^l%`!L(BO@cx1#6DQ3I{kHL+S-` zpefR|JCR$nr=OZjj%0`L?(W>z{_m1hJ~xI!#q{tn6nxW*?NQJ;eCt^H{oN|k zrfakrZvkvOhO0 zIj{jK_vK5lmXTk*j$ivt>&L5(=X+av9As2dJ{)kCH7^Z!naXoi3J<>)NR5*4V8Q9fSk`siy)2Lg#Hp55xTJ$6(!*Uc{&>52C zRM3%-svrE))N=5R*uJq8si~?`(WfLOA^iecr?DAQtCbB-QgmTySYD;W_patNFZ8dc zz>q&E9af^v#l}(ta1=W3*@RU89O;)wBu@R>!4;+xPmkQwO%Au6Ob0)&Tm@<5pzV^7C)#<=O@bSwH zCMIUQoZi2zuRtoIo0ynz@o$IdHhA0AFSfAr^6{Ah9-MFY@rc@{Opsas`!{rALIvO| zEG#UApkOBR1?X_f@&|y730RCFRMgbfK$f*Vo)6C&$0sB}CCR}7o+?&nu&&pQCSZkr zQP>dBz)V3!xjh>o2NemNW)OIEGu!ql85tzL&v!f8)uv%rzg!=#kD6Tfut51W^gWZ5 zke1#&-RR+Q-F;3G3bDT2#VGISNLC&Q0kB*YQIifS$q1Ms60`k zM)#r~K$Tn+q)w1IEfRi00mucscU?+?mm^ zjQ~)qk>3?Am;Lf507`m#tU^LU1e`WF=jZ1?ysvB|BqZiJdgSHga#ZNc4V*z5&v*Fo zf0cVJCMFi2o^I>W3=l==`PK}TOn{))a`C2-q3l$Yk_<{F3Ek^$yej;J{QG>xu*%5mH1h66OG<3gq^c!dK1;|-#& zp!cPSips0NmK`1Mo8uUloiUT!(+xoW?$6WBT4R>y=H_O?*RSSB!){Ja)eYs~R#T)5zgJZ? zy%3Ok|2|>eAp)JWd%oJNf;W17-MH1Q+5d?T6+Xmm1sGEJ{2s@3@1$K0-jA=Xb?O}C zuuA1m7ItQ;(&KoVTw1qIU+ylbsmvaP@dkl1h5YN1_e-gb$yibFUww!Pd0WWuuEHz% zkh7Ia!)7Xd2hz~-yNNc6itK{Oo!H$=3ybc`eZ59|q+c^L-D^d>+$HK_{>rxxUS3|o zY@-|M8b~|RE?A0!_-;pwoT^3}*IviXnBXhT`YkletAaj=HyCJM=%2TD^$o(7LJV1O zad75WRymkN4%Eu=w!gQy?orWC?@a6}D%UB*QQqt8aSnZ$BB4;^oFK7=jLIflDf;MI zkBy0B$>;M*k&|Z+&{<~+cwx;|8ua`wQL6|5cvM_bQU8uda2*#p%s7AbsaY&HP_wMw z2R~1@BD}M+Q?X_ic!|TzoxLErFmZ5T^CztnDePqcegJt2gbf^jeMAHT0|P_37g@{u zy&!`C=O!QBdR@C(@dZ#!ga7<7ZM&M)3;qej0g|-zfaP3%R$^kJ;+N*v$jHdL>H)xb zs1=p3n%g{FsMT(Dub?iN!jGpgY(oaNF{9(=Y`HZxQ!ON*PXJ^9`E3xTbblq9GFxvp5IcI` z0jdCSfUB)1^WgPTnKabYT*e(DfUCgcxDGKjGrRj_68%)FyLH@EYc-w+0F#TU1gO0X z0k0`tQ0oOM^_!ui`hrJB6u|HTsRd(tdb(m9*Y9dZ>r-rO!$T{8u&_z%ULdng*uLe= z*d%0UW3(G$H0z^BN_l+wgf{DTYzD>DaBRaTOl$4a74@Zr}PaO)h zJwVJSfI(7S9S88-I9m&_!As+Wp9z2z?W?gE20-h0_D7P2hKA$dVXn$(0JtU;Npc%I zI}ydj^k6bDVqexM#A5$nK$obUFvO64V)pG(@b~fYNfHqek(?Zb1DR~VNY{G{XP(aGud)CAxO!r9qbr;Q+Jl?fnIgdaCBI`8>%5d_i1E-5}TSWhOZ ztBFRzs}a?ud3PN=!B^ZTyPF~K3YKtO1us3I=_;;Ri?&|w-4|e}P3MUC(C=P5?1%m0 zpr5>wcTmV(E8?b_xS!{;$C92!K511E?$`bxCk#~@|O5ofnS_U{SPU?ojR{P^e zMxdiCT@WUE)Ya5NUhwSk_N+}5V1@u$+Fz(IGBh%Ba^2!KBV01?Qp{G{yc7+c*!$=6 z*K^%4*nkOn6V-}9`2S%de2mn|k|L^MrQ@M=06Bw@6p9+(U3Ydio#q%d}b#^DHT%Vnr^;HVRgC=s#bocvXh=bWk7t+xU zrheb*;E;OvNrV$&CfrTt3IMI;Xf!O{C~T0eIFo|jCnj8Ukw2gYI?&3MY=n&yXih!? z6S;a#1^;cJea&NCf813dpF$-pytW7jEUQncsRXDbJU=RR?Ac5v^CVNj&;STM@}VRP zwr?tGYSXl7gLU#bpu!y&k1sXYh3LPN788R81jS-I%Ls8>Q3lEn5e=btOrA)rp^wTIA?leWN>8L4WczCqn zztKQkh<>}?SZi`J02xsZqzK|KSA)sB=?q0}ZEn#!O{G{s?Km7o+gnFW^gf=R^9I>K zlW{%72p%8Xo8N^ElqDuQ-rfwSg!NQ=?EjWk85?bXEwCX&Dx>3x%)rQq^EFClA>mPI z)T`m<0{iP*1_oFQ!3A=8StaFM6+~fXCfu)nzP_*)X)bxZ5-ozi%>xQ}4bxm0=?CeS z^qPeC2TwHS5N}c*AE8ATzLg6rI|~&Kq{tJuiXiAV`>4=hi83U0&&}bBhoc6mmh^(E zW~XQ`1%T`D`xR4|j|qTt_tNA#C0+2a$pHd@&Q^2m>l)#cx?A(_*rT(j!EQ;nP9NM* z0CB);OJy;EmWm+?1BI^RD_D&nWMV1>X$1z3+7vV&p(e5#rnHt-&^Utizcp7vk>Vh8jT z3gQlwOp*LaV-QtMfRI3Oe(|TAHv7SKfvy0AdM^-Jt0S)Ho-gME%`g$NBNn_wj zKp-GEK=@GsNG~WT*j;Jm#=-{6DX(9@p0BY$0pElYFX~0zqY|?99^cq6H%+eB0R2Jz z_ALtV0-KADaPjdYURoy54Xb}YckntpJLhDulKxw+U)uhhz}mm)J5hSFn%kH#%kQ#{ z3dAqUH-&I;1Imp$$-tnTme1oj8br78KrE@}QT^PDeGinMc!@d{h<7llL_|mL|MFV? zhv%8;_wU~!5Mag#-S1KhT>Vz_+>GJQncf5a4IZckY9S%A|3C?^%l6N;HFD72Ux)&< zXLB~f&rwlephR>?*6Mkd$2l>Q$_iuTdjNCg!GMp7mzNOCYe7~^{!dNoa=NGf4(Sw9i2p_U+B&elZ%FEZ!L_`+44(e+ z8*AVWnDnE*MqmV0mAEci$}E38@A71A%{v%85dr}35ujN^e!7ecMu1WT4FPU!D6q+2 z?f?YnvgP$haO0sux&jlZrJ;*`;6XQr%J#ed#%b-g{~HNJDrEm0_rG|(VqkT{=}#{b zDiO!vw$7`NE=cXd^6t<)fXLm+e9wPRH{j_*$jQks_ofkc#t=lVFKNK+(4qb0EL z@QA-S2Bci9w`k}jv)|@rZg51{P>d7Kd~v4KF{1p-%S!E48C4mOCSEWeGl>(dhXX;ekpnM1oDL@Z;Oq%nU9_PA=tPZXDRX zB*PCMO4e<@c9`V+_x>*lT0O-f91O6dWN5I;4cl9W=vGTW6;nuMf%1E}hJ!F_|5(qO z^H5YA^)ny@>4pKKd%1l8C;{E8|Eas{9pZti`gDKQ131sx&RpFG$2qH+B63Y%l3~gs!rr==yw;F z48b%BusQHhB|$BwRZMdoUotA1HUZm0zUp8O8k4N~qzLuWicwH{0F9;3R3QAm+EUKo z!35)}mjxPN5`fJKPuq!7kozre2jDz_X&v0S=1=V0OwtpMCJq2uDw-hZeZJI2MdNBW zFe{u+*F|4kFfxI8?^+2ncr>EWL^@?tFmj4f!p6f3KRo;hC|vj85*RW6(Nhf{32BwH zqJRHZA4%uN0BvQZ)x)7K%&QTMD!vyMzKrD!T3kO|w~i6%UW4n*HR|*qT{Q&8UW7Jd zcu^4@6&2MF>q)9~p_^oS28Ql%vPF_o}Q37qF6ai3hGhaLvL;+5s(}8bRA5vVhC(dqZ+z?^KCo z>D*+Dc~HX~FSZrit`}`%loC@?B0yk{WD9pHz7zNI;uX4GhhfyI>D}IrXbA22QCq@> zrptk;tekiGT|~Lt^;r?F;`+$%VU94 zetE@5HPNz?L^h^rvjXs?)!XT*97$$5>xuKTGrRW_dH6w>{RzqNOx|tvmtmuJ9X_Y; z&A8G*Y6nF}N7L$=iHeHu&R0`+{Cj@jYGwqG<$1T2vg8VkmFkBp2@FN&%iZ^ftL?;Q z{m~yTx$awE)6y=sm3A_LVTb3_)!fqGqY_}Br#1P+vx4D5$itWaFKd*?kzci-0I2{% zZljBlqJH5o#9vo1L9_Ydf-0`XFV?W=H*`g@$=ufpv}#fQ+2~iI5npncc?-qkKpALV zD-!pa$Q9nbRE&YnQ7wVB;Nw8bB$qU@@a|-GDipVxxQF|aE3&KdMltsRX2poUC148t z_xddp6Xk`6{p59#_{zli-gVA{nXGK&%2w_J3aNM4v(O3|Fx0F0h3!AQtRdw6XK(a+ z5DbaBz(m&=q+`=v_M||o>t68L=765G$LP>d*G_goEbd!Pj@zf62n=cfV^tmZ`!G85 zU>{KQT?#emZa{~oa@yhrwoo=3=fmi{0rW4B*f>kGmC@mUb`J+g5v?{jm(#nN}7KTlg5RThR~B zsM>Or2-usK`!i8Du?Rmu;%$eM}BqV3K z+Dy82t<&voL^*l$%8_KJa!Ld`J~K5hz2FcqsnJJsCo;%Z{Oj~pR4C}nWERHPi~xm8 zrcvkd)*qtagXh)Ou0T7o$CsEXI0^i`vP9RmL~<;+LgTzW2xI5d*{}m$^r@%nnfh~Gc8VtCa<=R2O>@YrBtlyo;g#pkGw>CU7(hI`rhjAA) z7~Fv!M>igTVc<&%|7-YMzNi7kAIv;N^CulAY$(ATWh6ECZ(tvR?ULy5M=o(1EYAC8 z8Je1gcnK;@EG(=S*JE!lvZ;wDL(pfI*81sT?O#8@u!`}$-v0hSAZ~$W)t@UK!Qy_X zZL4MK=;&BhiIYD$Zw#?iM0muPifiCUI}$JQyXIJ*JT|S@o!>EhPkE@85>J9W+MGJt zoq;miHL+6)K=Wued#tmx^q2k9frDzPN5o&)T^D0O9EuJ0C$qp|0+Xr?*+%;n*e#GB zD8EF_A0{%?)p$AY^>O{iBDZ1PXb=d+ob6p7zJ4K*2SWK&?DOB^T^DVR0nebn->vP_ zvv#awCyjBo*R5lfl$^g_-fTIWjKvFS?Hs*si|Vm!*q|Nw}!@!-k|X(Fwnn5Spcs1>m8>EFDmZoVktJp8Y)(+4a7JC(9!L6H2c zz&!i7)PP2(lo1G~{eTVF*w{`t6f#;`( zimIof;o(|$PB2I@J6Ua?U1F~?>a@4JKXBy(D|d^_3`+!HP!5Q&yITx2dn$f@VsJ`- z1UJccUHQO?#A(5rmD@GeL5u-F#1C)DC@T+uIo>*uXJF)E))fpF>^}wO-J8Jk;PJg> z0W+DbfM+k)qs5tfFTZzhxVZ3u4XNGX%L{DC7b)X`D)BduVRo5tunj1uN19n#0IP)ARqoP1lUF*{O#YG};(~$cxl8-y?r>5P`%V##$@|O4eYiXfKI=*5 zro==A@u20^^EwV|ufzz!H^9+urJE_lIsh{zryGYYig3_iEd zYZ6@qX65hgOs&6w5$@)%q_+fI9|`!}_IvfhSo^g@7S(Skz?z;V28Lqy|FE++k6qTs zZK}Rf^0yxNZ_#@H&lUpz?^g!@^Wz+5cB}tj#JYqg#JjP;dNTwfE2$(=DP|n}zX1to BB4hvn literal 0 HcmV?d00001