From 47943e315bd2e389e4a95f01c7eb7b68a5268a9b Mon Sep 17 00:00:00 2001
From: fred_the_tech_writer <69817454+fschillingeriv@users.noreply.github.com>
Date: Tue, 27 Apr 2021 15:48:10 -0400
Subject: [PATCH] HiFi Auth0 SAML Integration (#563)
* HiFi Auth0 SAML Integration
* typo fix
---
_articles/login-with-sso/saml-auth0.md | 146 ++++++++++++++++--
.../saml-auth0/auth0-advancedsettings.png | Bin 0 -> 33893 bytes
.../saml-auth0/auth0-certificate.png | Bin 0 -> 86469 bytes
.../saml-auth0/auth0-createapp.png | Bin 0 -> 67050 bytes
.../saml-auth0/auth0-endpoints.png | Bin 0 -> 39547 bytes
.../cheatsheets/saml-auth0/auth0-login.png | Bin 0 -> 27337 bytes
.../cheatsheets/saml-auth0/auth0-settings.png | Bin 0 -> 64424 bytes
images/sso/sso-saml1.png | Bin 0 -> 47169 bytes
8 files changed, 135 insertions(+), 11 deletions(-)
create mode 100644 images/sso/cheatsheets/saml-auth0/auth0-advancedsettings.png
create mode 100644 images/sso/cheatsheets/saml-auth0/auth0-certificate.png
create mode 100644 images/sso/cheatsheets/saml-auth0/auth0-createapp.png
create mode 100644 images/sso/cheatsheets/saml-auth0/auth0-endpoints.png
create mode 100644 images/sso/cheatsheets/saml-auth0/auth0-login.png
create mode 100644 images/sso/cheatsheets/saml-auth0/auth0-settings.png
create mode 100644 images/sso/sso-saml1.png
diff --git a/_articles/login-with-sso/saml-auth0.md b/_articles/login-with-sso/saml-auth0.md
index 4b4b2d36..87358f5f 100644
--- a/_articles/login-with-sso/saml-auth0.md
+++ b/_articles/login-with-sso/saml-auth0.md
@@ -1,25 +1,149 @@
---
layout: article
-title: Auth0 SAML Implementation
-categories: []
+title: Auth0 SAML Configuration
+categories: [login-with-sso]
featured: false
popular: false
hidden: true
-tags: [sso, saml, aws]
+tags: [sso, saml, auth0]
order:
---
-This article contains sample configurations for Bitwarden **Login with SSO** (SAML 2.0) implementations with Auth0.
+This article contains **Auth0-specific** help for configuring Login with SSO via SAML 2.0. For help configuring Login with SSO for another IdP, refer to [SAML 2.0 Configuration]({{site.baseurl}}/article/configure-sso-saml/).
-Use this as reference material for the [Configure Login with SSO (SAML 2.0)]({% link _articles/login-with-sso/configure-sso-saml.md%}) article.
+Configuration involves working simultaneously within the Bitwarden [Business Portal]({{site.baseurl}}/article/about-business-portal/) and the Auth0 Portal. As you proceed, we recommend having both readily available and completing steps in the order they're documented.
-## Azure Single Sign-on Portal
+## Open the Business Portal
-The following is a sample SAML 2.0 implementation with Bitwarden in the Auth0 Portal:
+If you're coming straight from [SAML 2.0 Configuration]({{site.baseurl}}/article/sso-configure-saml/), you should already have an [Organization ID created](https://bitwarden.com/help/article/configure-sso-saml/#step-1-enabling-login-with-sso) and the SSO Configuration screen open. If you don't, open your [Business Portal]({{site.baseurl}}/article/about-business-portal/) and navigate to the SSO Configuration screen:
+{% image sso/sso-saml1.png SAML 2.0 Configuration %}
+
+You don't need to edit anything on this screen yet, but keep it open for easy reference.
+
+## Create an Auth0 Application
+
+In the Auth0 Portal, use the Applications menu to create a **Regular Web Application**:
+
+{% image sso/cheatsheets/saml-auth0/auth0-createapp.png Auth0 Create Application %}
+
+Click the **Settings** tab and configure the following information, some of which you'll need to retrieve from the Bitwarden Business Portal:
+
+|Auth0 Setting|Description|
+|-------------|-----------|
+|Name|Give the application a Bitwarden-specific name.|
+|Application Type|Select **Regular Web Application**.|
+|Token Endpoint Authentication Method|Select **Post** (HTTP Post), which will map to a **Binding Type** attribute you will [configure later](#identity-provider-configuration).|
+|Application Login URI|Set this field to the pre-generated **SP Entity ID** retrieved from the Bitwarden SSO Configuration screen.
For Cloud-hosted customers, this is always `https://sso.bitwarden.com/saml2`. For self-hosted instances, this is determined by your [configured server URL]({{site.baseurl}}/article/install-on-premise/#configure-your-domain), for example `https://your.domain.com/sso/saml2`.|
+|Allowed Callback URLS|Set this field to the pre-generated **Assertion Consumer Service (ACS) URL** retrieved from the Bitwarden SSO Configuration screen.
For Cloud-hosted customers, this is always `https://sso.bitwarden.com/saml2/your-org-id/Acs`. For self-hosted instances, this is determined by your [configured server URL]({{site.baseurl}}/article/install-on-premise/#configure-your-domain), for example `https://your.domain.com/sso/saml2/your-org-id/Acs`.|
+
+#### Grant Types
+
+In the **Advanced Settings** → **Grant Types** section, ensure that the following Grant Types are selected (they may be pre-selected):
+
+{% image sso/cheatsheets/saml-auth0/auth0-advancedsettings.png Application Grant Types %}
+
+#### Certificates
+
+In the **Advanced Settings** → **Certificates** section, copy or download up your Signing Certificate. You won't need to do anything with it just yet, but you'll need to [reference it later](#identity-provider-configuration).
+
+{% image sso/cheatsheets/saml-auth0/auth0-certificate.png Auth0 Certificate %}
+
+#### Endpoints
+
+You don't need to edit anything in the **Advanced Settings** → **Endpoints** section, but you'll need the SAML Endpoints to [reference later](#identity-provider-configuration).
+
+{% callout success %}
+In smaller windows, the **Endpoints** tab can disappear behind the edge of the browser. If you're having trouble finding it, click the **Certificates** tab and hit the Right Arrow key (→).
+{% endcallout %}
+
+{% image sso/cheatsheets/saml-auth0/auth0-endpoints.png Auth0 Endpoints %}
+
+## Configure Auth0 Rules
+
+Create rules to customize the SAML response behavior of your application. While Auth0 provides [a number of options](https://auth0.com/docs/protocols/saml-protocol/customize-saml-assertions#saml-assertion-attributes){:target="\_blank"}, this section will focus on only those that map to specifically to Bitwarden options. To create a Custom SAML Configuration ruleset, use the **Auth Pipeline** → **Rules** menu to {% icon fa-plus %} **Create** Rules:
+
+{% image sso/cheatsheets/saml-auth0/auth0-settings.png Auth0 Rules %}
+
+You may configure any of the following:
+
+|Key|Description|
+|---|-----------|
+|`signatureAlgorithm`|Algorithm Auth0 will use to sign the SAML assertion or response. By default, `rsa-sha1`, however you can set this value to `rsa-sha256`.
If you change this value, you must:
-Set `digestAlgorithm` to `sha256`.
-Set (in Bitwarden) the **Minimum Incoming Signing Algorithm** to `rsa-sha256`.|
+|`digestAlgorithm`|Algorithm used to calculate digest of SAML assertion or response. By default, `sha-1`. If you change `signatureAlgorithm`, you should also set this value to `sha256`.|
+|`signResponse`|By default, Auth0 will sign only the SAML assertion. Set this to `true` to sign the SAML response instead of the assertion.|
+|`nameIdentifierFormat`|By default, `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`. You can set this value to [any SAML NameID format](https://docs.oracle.com/cd/E19316-01/820-3886/ggwbz/index.html){:target="\_blank"}. If you do, change the SP **Name ID Format** field to the corresponding option (see [here](#service-provider-configuration)).|
+
+Implement these rules using a **Script** like the one below. For help, refer to [Auth0's Documentation](https://auth0.com/docs/protocols/saml-protocol/customize-saml-assertions#customize-saml-assertions-with-rules){:target="\_blank"}.
+
+```
+function (user, context, callback) {
+ context.samlConfiguration.signatureAlgorithm = "rsa-sha256";
+ context.samlConfiguration.digestAlgorithm = "sha256";
+ context.samlConfiguration.signResponse = "true";
+ context.samlConfiguration.nameIdentifierFormat = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+ context.samlConfiguration.binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+ callback(null, user, context);
+}
+```
+
+## Back to the Business Portal
+
+At this point, you've configured everything you need within the context of the Auth0 Portal. Jump back over to the Bitwarden Business Portal to complete configuration.
+
+The Business Portal separates configuration into two sections:
+
+- **SAML Service Provider Configuration** will determine the format of SAML requests.
+- **SAML Identity Provider Configuration** will determine the format to expect for SAML responses.
+
+### Service Provider Configuration
+
+Unless you've configured [custom rules](#configure-auth0-rules), your Service Provider Configuration will already be complete. If you configured custom rules or want to make further changes to your implementation, edit the relevant fields:
+
+|Field|Description|
+|-----|-----------|
+|Name ID Format|[NameID Format](https://docs.oracle.com/cd/E19316-01/820-3886/ggvxx/index.html){:target="\_blank"} to specify in the SAML request (`NameIDPolicy`). To omit, set to **Not Configured**.|
+|Outbound Signing Algorithm|Algorithm used to sign SAML requests, by default `rsa-sha256`.|
+|Signing Behavior|Whether/when Bitwarden SAML requests will be signed. By default, Auth0 will not require requests to be signed.|
+|Minimum Incoming Signing Algorithm|The minimum signing algorithm Bitwarden will accept in SAML responses. By default, Auth0 will sign with `rsa-sha1`, so choose that option from the dropdown unless you've configured a [custom signing rule](#configure-auth0-rules).|
+|Want Assertions Signed|Whether Bitwarden wants SAML assertions signed. By default, Auth0 will sign SAML assertions, so check this box unless you've configured a [custom signing rule](#configure-auth0-rules).|
+|Validate Certificates|Check this box when using trusted and valid certificates from your IdP through a trusted CA. Self-signed certificates may fail unless proper trust chains are configured within the Bitwarden Login with SSO docker image.|
+
+When you're done with the Service Provider Configuration section, **Save** your work.
+
+### Identity Provider Configuration
+
+Identity Provider Configuration will often require you to refer back to the Auth0 Portal to retrieve application values:
+
+|Field|Description|
+|-----|-----------|
+|Entity ID|Enter the **Domain** value of your Auth0 application, prefixed by `urn:`, for example `urn:bw-help.us.auth0.com`.|
+|Binding Type|Select **HTTP POST** to match the [Token Endpoint Authentication Method](#create-an-auth0-application) value specified in your Auth0 application.|
+|Single Sign On Service URL|Enter the **SAML Protocol URL** (see [Endpoints](#endpoints)) of your Auth0 application. For example, `https://bw-help.us.auth0.com/samlp/HcpxD63h7Qzl420u8qachPWoZEG0Hho2`.|
+|Single Log Out Service URL|Login with SSO currently **does not** support SLO. This option is planned for future development, however you may pre-configure it if you wish.|
+|Artifact Resolution Service URL|Enter the **SAML Metadata URL** (see [Endpoints](#endpoints)) of your Auth0 application. For example, `https://bw-help.us.auth0.com/samlp/metadata/HcpxD63h7Qzl420u8qachPWoZEG0Hho2`.|
+|X509 Public Certificate|Paste the retrieved [Signing Certificate](#certificates), removing `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.
Extra spaces, carriage returns, and other extraneous characters **will cause certifiation validation to fail**.|
+|Outbound Signing Algorithm|By default, Auth0 will sign with `RSA-SHA1`, so choose that option from the dropdown unless you've configured a [custom signing rule](#configure-auth0-rules).|
+|Allow Unsolicited Authentication Response|Login with SSO currently **does not** support unsolicited (IdP-Initiated) SAML assertions. This option is planned for future development.|
+|Disable Outbound Logout Requests|Login with SSO currently **does not** support SLO. This option is planned for future development.|
+|Want Authentication Requests Signed|Whether Auth0 expects SAML requests to be signed.|
+
+When you're done with the Identity Provider Configuration section, **Save** your work.
+
+## Test the Configuration
+
+Once your configuration is complete, test it by navigating to [https://vault.bitwarden.com](https://vault.bitwarden.com) and selecting the **Enterprise Single Sign-On** button:
+
+{% image /sso/sso-button-lg.png Enterprise Single Sign-On button %}
+
+Enter the [configured Organization Identifier](#) and select **Log In**. If your implementation is successfully configured, you'll be redirected to the Auth0 login screen:
+
+{% image sso/cheatsheets/saml-auth0/auth0-login.png Auth0 Login %}
+
+After you authenticate with your Auth0 credentials, enter your Bitwarden Master Password to decrypt your Vault!
+
+
+{% comment %}
{% image sso/cheatsheets/saml-auth0/saml-auth01.png %}
-## Bitwarden Business Portal
-
-The following is a sample SAML 2.0 implementation with Auth0 in the Bitwarden Business Portal:
-
{% image sso/cheatsheets/saml-auth0/saml-auth02.png %}
+{% endcomment %}
diff --git a/images/sso/cheatsheets/saml-auth0/auth0-advancedsettings.png b/images/sso/cheatsheets/saml-auth0/auth0-advancedsettings.png
new file mode 100644
index 0000000000000000000000000000000000000000..1a030ab1278171bab6e4ff545c50c3c35f4a22a5
GIT binary patch
literal 33893
zcmeFZbx>W)_AW{S0fGeg;O+!>hu}_d2rdg)1b0FR?iO4^a3@&s1cJLe1lI+@b-|sS
zbN1fkzIy-t-m817PO2zodd}`1J?7{+#^~{VgsLdLMnxh-f`NfSm6efHgMop?fPr~3
zj0g|3Fb!y-!@wYIT1!Z%$Vy0%sW^fytZmI5S-Ic+eOoGK6732MOee+5;Y0^D411|Aq9~d4
z7cjeUtJ8WZEUD{Wh~qzH{1KxS99OZw(4LH}7Nl_FVBxNYR=$F9$4p~Zf_rZkez`-C
zE=h$(k76uOu0Ukz&j;&nQ~QZLazYg%;6U`>WtiX(hp?Y_o)=b~-M_JfqltZ@O`vyQ`74
zPzETj&$-6ZO)Fk^^y0p_{u3pOsKJw!&ujz0|$GQdqSGWNxsjRX6KxJ
zle0?Q&TXNBr&)6+9@Qg1l)dwVq%VI)=mI}U2KBo3
zz!yC|UA-r49>E2q;q~O|Zdhu30(u-wd*Q54v+40*CK0NIp)D{fF*l<#
zU9n*t`9A7ysIVbD^ZxJ??{P<9yS~3Hnk3SD~65;JNlO37mTos)UM(4srQj&
zcjuE15
zj))JkY^YNoQCF_mU@h98IN D}B`ZuH*2c8I{GqWTnG_(wn3e-mL@rTizYznTjJF
zPQr`6mz|;>IUiJB6~ZOp*S<&$W{}qWva8Bm_+o-sL&OH|?0KY=`lxda-y8uX_{D3d
z5yp|d5xr6K?SO4*XMyV%o-jgTcR}Q)oNN~Ov?$0}fwDhKf3BN^y}Eft`wH*XVlw%F
z7ZYyD2d;Mhx6sPb8LEAo{Wtq0wybAih2p)Qi^>-AlSrbc}n<dF6N|eKmhvK?fK1
zBv4jIx;F<~JxbkPO&S{!DF`VO$u`ghX#=SM+Y_e?yD02Um{?d*m>v!qy`idi`A2nj
zjpH|~3>$QlbOtJfxjBWN8p;g8jiHUvp0WIr9b*wzOuCrNS*{Ce%F$#
zF|}UztFFIp{2ZlAO=Hou$ywsA*CcCk^g!OAOJ;vc8qdYd0s>)WP?2;D=K`?Ly>Cx`T0s@A=$Q%G1vC%k|tf^4awE^o|G{89p1zC43VqKZ-Cu
zA%QfZJ-02pw|%b7Pxe0cVh&F$1#VXkLt}kA?`b$tJDV)`tf^x^Hg_$@M%t&eCC-4s
z{XsYjuYtx*<4wLHtf7+3X^;}TWvXTJbPAewp*EbZnI5N3b83Z%h=uQu+o-E$CJ2){
z(}m8t4!zEmp1EGFc1sm^?WT5;-f}JZ{N+q(y>*?39mt};dJ*I`9A#5KVqa~Lwy5QW
z;8o?*0<8>al}MKelwb|$LbR|o*LVHN>&aX0CJ4Fg?Omc@+({lM9oih~9STm*VrA3)
zu2%{EksV%+JfGK>x14xDxOM#n)Rq=SG+#Cc32n+0nD%MA;mCi^5$chA)z>j5vHxyt
zEubKNOLzDUYeG_mR;E@#eVp4jx0DN0QiCkXEdDH2BZ1|~)-qrGHkh`jZHAv{!aIu1
zBd-N6E6%`ZWY0drCp;5;&WVbRP{;HU@0xX?;r9wffKF
zrg#XfEJnASKN-vvWnR;9IeTn>9=R|kF`n0)3qgxDj17#1s-AqA
zk~Ro`6OAj$)BVeY!sNU=g89hsE2vkc)WFu>c3AC8Udbmzo%~iN^VyV*gpK`;?lrb|
zvG0OcTPp)*Cikn{-*`*i(sjpIr=7&@4Kc62IMH_xY_@#P@;vbQFqQ$P8_kQ8#mmlH
z4F7^`h2Q+WtVQfQ5{@dz{_CL$JqbY?-ZuKX^q=F{bY?R16YChtSjXN5C9JU0}ZQYZrvU|5-ziPj8a2NMI
zZc`09Mx1BVcWJ)3L9&60Lx`itAiTeF(9kmN1NO-
z4IAsMxNR?a%bXf-BaTxbmZ6qTLrUrW{5(?(HpF~c?!J|F9(v1xg~)F6c=c|EDBs+#
z;)e5(i3g&bk_=d~T34MnCN#Sy^Fim+gcb7!A|4$FUA;;-LtSYvc+$XpOEx>YBQEE4
z^NPr-#7%Ds8=uv1-s=X
zX)n~^=psz3t3v5^<*xf|v~cwE^y)MgxUN;x%j;JLq^YjzS5^0+`f{{i&rRX^(J$Jr
zf~euxtgOh2+YdKt$CK-z{`&V|G+H%U8cEw%UUEp;F;8fzV194H%+&-{$C+VYDF)L*3B
zWjFU@Ya*6xIzMs;?r&~s&!vd^9Nw9nH<{ovgslX1=Uuz)(}x
z8rsgn9jzUlt-xA9wzl@!vf)oy;92z;-}KXW@VJ`=8E_Z~pHc|23t~KT~pYb3C5%
z(VhSF6l8r^`6EsITh0G!1@tV8B*^;rI}=87_Y8ak10xC}D=DVo{$xMnS+i#6c{d)l
z+87yG2qGN?1;bl6#ya69ta(e3H61@6R|Ho#H&aGBZMqPDiky!*2{H@!xA0rv_|jW1
z(!ExjF7=0Iy@oS|PBLbzr&DV!viLQXQ2b%w$Y7ozio!fae-B*7koz|hIiPbs{?lmxV)?%E88WV!6N5GRV^RDmC{*h04M0oY^m{X(Tez&pcuV3Y
ziyY&63E0V6UkXh%Iv<#o>DAYGp6!}D5?Vjj9*jQ)6`S9kcN+g0&yDdd++M9obSX+`
zL}W;nk)P#Yl8psqu9jXL4*U7Pwf&!Ydjh}b%Bt^Qh~(=h56m9m`lC@A5UQ{6RT0uZI{B|s|L<2Sj-_P8OTMue{M%$+(6j0OLV`gO
z_g_zpDnhYn^UJ0uiq!2EzP&r2HuB3;)WdqNBzPn#uo^;XL&13bXnW8-eM$|I9LN$`
zzP>mFFE+YVI}P#CnkJ~{D;&Z9{P-M;UAO=n(-)Ya)sVwtKt^{#;IMfd{>97f2D|2?
zuDUTf#@Sy#0+{h|m;LTrd@dHiD_yyNsA#2r7%<~C#<=JMB6S;aEB$Z=@?Z~V%
z{s<&iPFq8R#n=d>-j$G+i>2`NlX-C4EUuodagx4cFU5_K&zU9>x9tqY&CKIv8aymh
z@Ot~pRG}&*F#eiC-yW!<<&!ESpeWie&KsY$?`{t3ahY{znCllz((D_H?7sHWEEUc;
zbfC6e{5lyH8P-cA;<2|?Oy%s=yE8-iXE&;7Kc%*oR7m3<BP
zb@&aymwG0WXK5Q}(-(R@`#G4z#_#URl4-G2r`k4{*j1a!@IC-dxKbUs%71#yVSYe884W(F37L|l{e(Gjz7cG|0Tpe>b=?q
zf_CiBR@;r`%7(veyu03me2Er5-gu6nmbe1FSiW!}7V&LX%oLpU6Z!QXw%L->oyKe=
zw0k4T=%8AoXTtXeg7@{pF7A1Sy}HuI|cC6*qTEWjem=loS5j_j4z9ALAHF9i14
zybfC~ybaYtE|&fL#^(Yj-{=hz@f63mM|~&|z1nX&Y(4)KfOhS9*nBc{{u4|25~A&o
z={;+aW@kH;&R2J}ndWsE*+;(i*?zHc>Z`dtXe3)q+T3cfv9_&zhRb$l#E+Ei?R%rN
zoHN`wSIFEIRLJZ6bbi_UB+}<>QtPhiu0KJ`TWFFc$lK7yxJPbheV$#@XMyV2Xw!PX&s&F(!Z96Qj9y<2e<_Jj(ytvVyNnAb~;26GyI1LN&
zP!%~M$NLDsCU!|!#_MzJBCz~9#%tP@wS|J&HcY_gE0EenK-gMt@+;wNreTzI=(5le
zL|)82^A^^xb!->hJu24{{(G{{gP5IHzvhuP5$!N}H+MvVU=}U3Aj25|@xxZ_V
zlV`C`v#U#i)Ql_n#yZ^ACVm6H!&S|Rh7_g}m{TU(c514jET=EbKN+uCoSOF597wE4
zV3ujc{A`P4Xf+fbUB0J3ef?Qpt-aP>lw6;v(S_g|*;t)D(@fG#Ey!wV@+vb->#HYA
z^#FUgz8Xknt{x25^`q!e1!p=MQjdext(f8e35smOMcH8~@L%NF$|NLUkPm-Yz0Z@$
z^u68*KSk(VF!I<)%&+I(Nk-;5?#|QCbRLtfs?m)hX0?$azzA#b1MIowHF>k*cI(Z-
zNoFXT$n6N@%Fx*w&g7-wnBB$pXa}ta;Ky3rB#2l9yIFasbf4m7u2189^!`9A?(!x>
z+#}~q7u<5@?MU$anmNcU#|7{oRlJlv&9=sJ+%NJqL6Z9Vm-y0>E=2w(e+BY|-2U!pl09trn8r;L!t#9~
zBeo5=OijF($pvIE)B7!YSjNi2SGgIEee|1C5|_^gkbFkx6V~lUK3G9bT$)dJ#=CRZ
z_s$AD!&MQ@)f&0&=8{nmm?t!QMkLULu+^K_PGoD#q<(1``P61nCrxJq9@ur-!0oD%
z0{Wp&5**gJnF`up@;W?|Ym7i9KtFEn>517AU3$t)^~s!3$`G6}Ccf_;EnmZ=_EnP>
zFJQ|LOWebGe`Yk;yvUH9Vcod521TxbjRHFLu@7g7B2Q|=q{wwFEv2SM=d)CUjJHr?
zw0MQMyLQh>rq{udvCgsRcBB?NyV+0YoiS>v$M%cl?;IrFxK^vSjl!zS)8Q-?%k+`m
z4sfmEiLb-Hu5RHRlKK+sgzf8s$~GhtPJ^fk&^46a}TE;>1vFqIKfc*eS2DNNdGp{RRLqb7^Gn<
zbBRs;s>Xt6rYMzDeiyUSj^WV%TmU
zso(8NhrJmSRljnDpJqcM4c)-eG<2sROQEY*O`aLYk8YvOflx0uT=i?wx1`S0L9A=d0PX-|6QzWB2w9h(RIwZ#*{!X7Z6v*@p+H%`d
z9PPfPsxW-nLv&<*&8sZu$KPqxS9zxv8u8v%3b~;coe!%w7bRsqUY@Y!iM)skEt;CP
zGZkyR@3;iHx+<*r6=*Sd$u;orNZ<+LdX}gZKE_pd4~|Xhd*2vk5W^|xmo7>L4Ec{4=Lh%
zoPIe1>02xox6(hFMt?85f%!e8aG|bX^Knkv6AC1XN;ABFB;NlO^uHSYuZ{k-A^!(9
z6NT7(+gS&8({(^q6=gy5ZAxT1FLRxNx{=}4IbPFc#w)Hw1J$jQQRTMT`=#=T#wlls
z^^*IdbYvjm=@zk=Cw1DKa;}2RFI&v@vijMKZw-_jHHY(cGyvJ(FvlH}6~?fqPeNoS
zdrS88z?sR()^I(Lrl$(W9+R_K-aWlp0ZNQp&2yk>Jb0hA%k9N2MByE(cvuoqI
z^CTQDjf*Ec7p)3AW4>z%!vso2kS6DFXW8)8Z}6>eQCL(f%9)poi^_KU?y}CbYBqE^
zi(CmnIrp7-;$0mn6_H=bNqsMWU00Nxh5XL%I)9$ERAhe&Cj=(ntqUWT^60PC7B~Oq5
z^mM$;=VmvuqIZ|yZjSS2HJsJ<;rM|m^c)K0)!`5{fhFG?ySm^4MR_fa%kWju4%%A_qUEa~Ki>ftA87KHNZnSKQVsRqbal!>
zD`}1R>n7Jd->JqU%qpkVwrvtC-xaK*Cg?fye3`x1=}z2l?cxm2E~e?PveKs7#onvY
z)P#qp3VWwoUoLa0o635lk(XZDxp@l?(F~`r?N!O$Y`XStmdrF7%&qHJD9k|4N4$Io
z7CiFIOZ$Y=QaMuT!5vT~t_7VjKasQj}&jYL%9Vwo+EBKCkk&ru((
zfKsw;y6*`IU!NuSFW{16@SeK*r#3W`gDR%@AhyYRJj
zs&yT2kC%v2t?FR2#$bBvD
z{bamqJhw-0S@}qMYX#(7-RQD=xfOJ6>LO)$+ufS1vS`aI^2|SulcLoXsgfj@2TgZT
z_+6H%+|S6Y9AcYWm2v9bd0U=skyZVVM~-X3%QJFzNny(w(~!VjHA7a_k`x|il8_;J
zt~!z-0sWHw?(*3V8ver>p0**TE($!C
zl)K?TRhgnjaFV~TqeNd~bCU95Lljz|x8tdDc!E(psQ|x}wE&Ol&0AE(kJu+du0T$$
z0~C1ddSb|@O0-x(3*V~F_NIry{SrsOIT&+$0Xh-0UR@24&s?@iM-u7;z@wVX&l&L`
zAF7b|r5%ELwv#UQ7mw6UlE$cd4jA3)&J~H~yken;0+c3D^Lh6*_d<>kgbO2KZXGhT
zV`2Lb`-%nl78LAioOhDIfvtXeteo7>Z|5dV3<*wxQB2oys+-f
zw&*o?M|AhUy^jjyF{vN0v$)?z+??T`d$=6ETjn&+0*_O-FnV!FKg
zE0)JVNf@1@tuPBru@~y;zG1omxXT*=z{CzR_qWEX!zU^An6{!wtuaXZ1YdJjd1*
z-kTCQ{G0}3FZ9bwh`F+x>Id?in^&;gUJQP6KIl4Z=~u2M)eG^zpSe%UHe7XV8jB?H;nxy)9Z(T^O3YZi9i7C6jZ_{9^VM9`f*TFc>Dw8T7PspOspwlum~%Y4u^Czl!~yMe0}A{n@k;BrnPE7+wN;9WLz1Ie)(%uRI6jdFd1GtD&^}i*C!c
zL8wI6(5-Z*D7(5@i+`OVk9?LW15$ipIGf+Uei-)NpU;CKz)5Kha5O!|(y)%1Cg}0i
zuBsE)btMpQuB?8^=3>DqdN75f`*3f(AlkrlC+~@MpYle*sVZxi@Xh{O3ynde^U<{6
zUTO9Ig41yAb1a&f-I9ufHn)R?*{u@C!hPU~G>Xe^ZsL3n#44~~*-;vmX0FMbG<0*l
zSJ5)+cslxe9;gVUe-#YmEhKm=w8lvScyeQ*phnB6_M`lPRMYF$A|fy9#^4J>bDjH^
z&rS6k9{4rwBBr;Ypo+Jz8!hc!s3+a?y+nuMgu-#8U2b)SO8tqZb11-jd56B{gnFmV
z-+*J!ve$e0+^)MQ^Ltfj%|~ChGP`>A>UNTTr+nJKDyu52K3TFkmQsr!KC~i6Ix-k0
z6e?Kjs52i}Z0k>Lg-YPW#FS+vWOrI3R
zagn=ZHWk?PX$;FahmkHM6>Yaa!%s13%G
zHV$>#LpE7C?wzr0<*&BXU+obvIN9~*xar#^(RA$fhs@0C^v7j*GOs1R>s)+xHQHb{
z>>3bmp|dRDZYt0bm~^`}IShG)r%NX5Cb*6zjPoIvS2;Ann}Fs5A~@n9KE=iy)jB40
zN}X!gd>v5H!gU{}j+jT+|6w}d?wt7ghLhd(VD8=fEY_4=rr(DP0Y(&g#*BF9l~F`L
zmqpA>1t#c+@EV3n(^PY6*r~8f=*&-ec^oo!6FP@8z9!4$zI@>-9Y5t}^&QQzT3z&%
zEF^kTWUY4CXS);ipv%X(z7`^1P$;`2|K{AxWzt0>38KF}MWYn@@}S-8+{i@-4|Em%
zBZu>b-_+*Wv~bqTsube&gdNIEk`xnrWaGCH$W1
z9jwqfMKq5^*m6eCQJ;(D>9*g{Lq#oNf;TrJuNH>It!Zp5@$dwe^CqiG>U1ZS+%8Io
zv<7M=56;Dg@QDw_1Mk4&i4X^^198^3=g&fK4w1VRbGV*|nlaZKNgKozWIP#dA3QDF
z5!Bpk>P088QyQ)o^odG24kisa-yWY;GPHaaA6tC0=3IY3(_?<iO
zGjHf%jJRvb{yj_#yDyh_i)%`o@=ZEW-0=!D>T}(jDl?V-3B)Ly9T{elJ)o)|@I*7_
zNd^`ox4#2~&Sy*?Dk@$bzgjMEgPeLr@i{Ca9x4N_Ymq#uf+VcXzdtMjHITZsC;?A%
zBa)z!iq^R(zRl#BvvHrD`TB}BC7FWXjP&=g@F>5fL(A#ENNuRPPc1Y!L4b3`v+z#5
zZw{h?R)fha33!%2Z!g;J&s;o!t?uLcP!X_ez1kFR8&?t-RN~vfPUEC+im6j6PrcJX
z>=hUaN!m`KG}nXb?twp8t~6P5K%HdbU#MLv=@u09V%1MES6n@-@>J^GMg-k^ThQN)
zf6H@7`Hk0}KNe}}nJ*%8ZdtJ|yn*8AGu?hbma0Q~J0K&lB*eJP`&L4)ONhr6DsXOS
zI!2Z))3H2oDQvm`no?Ts7TW$n=r1ka9(vFnamYU3Vo6+shp_%L?v?{fERA1MR
zBD5*?BZYVEM^#PXD3?hmx%A2exJB0=DfFW}U2_fE>_l#U1UmJOyY{G)cCNh@h!X83
zz|eI#X(6KH>}Q>=(t0i8U=_r|@U=M43iNB_Y1!gphZd4vjB~d{<930C1=s}{pLNE}
zyr8i5)Gu`wk!2!rfiTkYLbrQ4Vle%9W}3b|RrM1EL3?mxt?h0Han9B5O@{rec--~A
zo|q4;7nK&9!IBFhsdfz$^jZAno$HQ5jBmJN2i(xunQ6xMV^&{MS1%5_6{st1#Ky*A
zNS+ZMuejB@Ewe0*lcR+vT+l8I&Qr9SfXa60p}2vYS6psDHAD-YCcN^#(*C6mnADb5cQP|k^br|&&>{s*G
z!{^4nMqh7lTTqMLb4?2Adm&~0?`kW;gbJ6gLqdDh;3>(T`A>FPG86Vk(-U=qAqe~x
z@$Idr4q8OJ{zv8N`kVp6KZV?#ZJ7(+_K%}WN+;ub47otxNC%<}s=l^AIP{OnuM_rj
zLu#^kw}z)2eB86gDRg{ZawDRL-$(UK!7v+QU~u5Zk)IOM%(E-dn0XMrZT5aOG!IU0
zXSV+=11&?V7+(@TKs*4u9eW+98dm$mB6Qv5kUaIE&egAI*i4-&)?_5&w2CnRiWPN0
zq3#L-)DCCESzGbH9%mI~dKRAnbqMY`D@r}f443_QW#KBIaF`+p+jx$|So-#u%!~o>
zt^q){s(cO{`Ch97)eq~#!H_AjzP4r@pxW6CR8j9wx*~Aj`ThQZkY9^`bJ*5~7OO^}
zk-wGcH8eQHQYmtG*+E1M)JIP|T93MjrgA#lp9d)PCsjDJ<8r2Czmm!9^z~Ez*fRs2
zY5A;TI(u`VGw-&uXN<&bu4h9hTNXI-;EXT{hkDVjm)+tFG#_zApaIm6{^6{H_#
za%xVq#Rslxcja73-cNZ$G<>KMEbeo6FsFH@KwC6Nm0r>-uc%>zqTH=ytZpL^dJ6Nf
zAH5oqm;Jts`@h()PtW2#m~BikX!I~54a^ZvRNxtTwK1M6<^wuxoJXJ;GzZl)S~GjA@)qyL{x
z7=cH>yc;9NsrS+%B2B=2>!{j@j0fL70)pdm;x8e&fY;U
z6Zvx4T~gv_}d-=LMXv@XYZM
z!*jYvU8;AxxDoUdQa;LiDC;&!^4tst21Ih$gq5wxI-`8-f?96-ldY<<)A!D(wQHfQ
zcTQlsA#GSY3RR<+Dw}I3AR1`8S*m@#2tqb5G@qx%G@$g&(uUi)s~6Bks=M|VKQq&S
z*Wq)_Dr#GHq84@|=eB13o0Ma}C9Uqr7(sJor@wFE#Plv6Ssz7oFVqI;p
zEVSK=1{J0^>{y)1J)<*;k!gpfZ)?xgfAIPaA6p_aJA*!ky{q2Wl3-cpqivlRXk38A
z)A;KHvNy&8?hlgTkP*JP~|K_-#mB)iLH|8FImvB36=IpsPx*d|ld6}-IfpL}6
zf4W*+NpqmC%
zg}7k^0FUS*;?{L2|6OE)zL*6`|6I(42L5(L#$-QfmYyks#N|EgQ8&Fe<{G{~9
zjx5o_msc-fq|@LGL4jAy4}A5?=3{|pe&9*G&(!IOz^u!0tr6rd4;idTML0i^uU4vF
zE6dB%$GKlJRFH`}8e_Wyn{-FKTO=G4X&+OpTnMb}Hl{%2xPn@XZucFFWE77;o_$Lk
zJ4Nnyk<~YI;4O>kjeI0Eb7F`p&zBPXRW@G9#ZS;^26y`7LoOi
zcvy8wEf+hLf>ES7U#$W|fo9nEta`^zJS=iLK!IG}=FkLh@aN7-$+IbTU(NvE`4=GG
z!|(0WPy1lWOyzQZml@inUB$3ZGV@yndFJo=tuD0_d_}T+PSK$NuiI?9f+FuxlmoKC
zb{%hTF_7uAW$~f7BMhy>N|f3$8?o}w5G3n8FdlU7lgKBaEJIVHOIX#!D!Y<#hIm8b
zUr|x6IN~W`x8ruynql{G6yU!LU9F$IOOrArC`0&$@-w&%|ImnWu~5ul8J-+%Fuk}U
zH{Q&4JR|9F&7jHkEWD_q?as3a$bFz2W>nkCUEhOAeYY*wCHPkHIQx5M0KiD|D)Yu|
z2xSzatZA0&7s|ToRHGUtv5MTuR1^ZSql(bPAK9I=arEl>GXOXT%4n=9?LkofZ8dC$
zC==T?FNQXB%65CQuI>InTyfcNIar6@Th1`SBnDLO?ssyyuC&j87l7(Hk3VI*QCH9G}xXqks*J^ro?xmOY}Q}Umx6|!i<
zCV^ts@cbcDie(2hh2`%mQc-hwo^Uyt<~B3OHO5xGn&eDpYJ3G4N(r=XcO}%hypS-pxBm;R6|Kr$vJvXMI8ali1{$WuxhHcpVD!yqJ4Qm)NHEseiZ
z@7#3G{foArufJG0t-os6E_;9m7&1i|$i
z)R@;ruE|BV#v&E^mWv`euTvdd9DW_Qkl=|~UP_vIcyrFVv7cp8lyR{*`
z&2FQowNL};AHb&>T+w_SM(lTcl+T6v!(F9Exp@?wxxzQbes`kCSFAR{3F;cq?#GT3
zC@kxr^i>!%C319}lFpiE7}ka>#@I~Xnyy>&*^|yM(6V=JtjP^bnv?gN%0pShwaje>
zfYJEKd}^jcTDu0kL7B(NX5Ex7XckkRDYkyOw;bbg()5J->#)KD)5WwO>SSn*?eEU;ns>;T&9aKRIOtsn
z)rbAouEaZ6I&w}18a@o0p7--*u
zOMQRR+?|0_&z8S-kNK{=(}t_w4c8r1RRcdma6hZsWRk;0h%`Nt
zh7#q%LPMQ(ZqJB-Hy^`MVH7<^XxUx9YIBuHcosGPlZ1
zWP$>-G!o{+7MUaxKILYlA8UMqb5STY`XdJLy(TZGUBJp#+ZL2KH>Be2&O)^-SO?_!
zU$+PG_%G;rDw(&E88?m0ReO|Qg<=bLJ}GHk>E1j|!yu=UMH6D~5;-l3F5Ti{b+7ms
zQO2=2@EV<OkzX`er7|>50N&=8|ODI+*dc8W>Y3ze#%M)1;9suz5|AyVmV_stmlp|b$LWW0$
zxVIeh^^`b>fZrgaUdj+Rv0kUz!nFgHXC{<3bGrqvcrQQA-sZTFj#GY*CraRe7o0$M
zYW;wu3H0bR`odjjF8Oi?H(5?LX^hkiww^^COThDub(|PQ)`ulI*P5HMkXnN_Ex$?a
z9Lx8HPGt~%>P7ebBWo}o|H7=VzUP7M1|N46RbR%TtaE+FHUeKV!8AD4l3-mh0K
z6UPPi7$nLb!@(_=GQfvVm*W|kC*~S0c}`cRr8r4D!MYBax-7Gd%8d5hlsxoTp%K0(
zSLtryS|c5YW82Fvg#RQ%91#_52nT7}}7)sChqbo4!zmgdxWRBR8ul^M2Jo@02Fa_C_*C
za14^Ragg$S-13G^s^y8KTy?Xmr}?k-c!Vo4p>^_#P}_%yiF#`1bYp;c*ixZ$H?dnX?i++yJh2r`T|wrT=6m!pe>nT@x*O#B1cOLpxm@i?rzdDNH>EPI%qO-FwPEn;UXZHyRHtoms=3dj-
zx4ST`a6F)b1Tkhg-&RJ%F>5He2`<*E(Z6pXL~qOw;_Zx?`eX$!ILqXo!=6`MVzCiV
zfZoTbM@c_fiw{*e
zhDr*>?lAE-^GAx^O+U{dxSj23K!w$XI}L{w_As)PD)a}t-j7^`ePOM6LQZWIo&`Yp
zeqSDljeL?Ze4lp_G(ploc!1asbaeZ$lSIg5;Z
z0YfCz*97D$QE==2BWb+4{92wA^)7rb5ZS37+RC89QTOZv
zPf4X14$;z)If*HXmD2`@+ljLPypZwpp23&C-i4J~n>Of|!J;?kko(z?oBYmkeDrrJ
zGXRT*Ax>1bWwn+ErE2Tk3mgg5dc&vmJ6}-AFMJUWfc}cUpdFk@qUbIqGJa@RZ>%A
z*a(mDSDi`#{%S@qSafcrw(US=&gvDwQ7QZG4F
zdpjcN0jfQgO=|uN68gYmPzieA@KmZ6
zVLsOPu`Gay`|qIt!#d5*jSRUu*_!_uie~Uo#x%Aj_--~_}l_kUgaOkxUxR5%4
zhB42-S8CegdG-|`a?Er^65$o;`nCdS5>TNfPS7}+zm|VWkw4qlSV1d35j2Io@a1M{JfQAPsnF;Edgi=31bIW>ddyyZT
z5w%42dPE3gMe|rNtI*}IfVw`068Dk4indmly{W+$LZ>QT`&Hfh?_poirNC!rKVA$S
z*HdboAx@WF4X>TNB-?@v*DwO~CzlTaL;Zqd_}SsI$o^NLn%HFzklW`0q`%MhIKYuO
zl*m*PfjaAf%4%)5GThF)ONxtc`HZ}e0w0Qr=MR-hpwf6aJlcRoqfiNiBUh$!CjevN
z^6&@IXNZC8Y^UeN0pz4*Jx-o!oq!R==#Os;4V+wG$U}vqn+2Av2gs;xmVGWV?)B^&
zHcA!KxL0B#i3O$rU_1L^9`AaLL@5A7cm44U@A7xSL)n4|3D3y83YCa^AnOFcc3e9R
z30>&V+mw{;17e*6N3zL;+_qK^bqSa4kstgnyX$Re_-x;^+I1=bSKj%o<`Bcj?JtGecUJp;P=dUQMI3^g37IdIa`zp!TxA7A;cuz!l0C3)nAjIyeSV
zoEqftNcP4QsTV|{RmUNicH(H&OqJ=~tlj?cS$3pUQOgVgI2~ShfY&fDC5A^Mu?0Zs
zpYGLpRhwl#qp8&&wC`qm?iNkegN+0L+`ht%#ZWpy+@&%BiCE1P1wN~>(W!b@=d5Lx
z9i?n%`7XLb-Cht-4LGY>P8K`-i
zSxKy>Ze{yRblusM-Y_E+aKjF~H9ZAOtqF2Dd&Fi;JvVILmkvby&V^`6o`At9tf(PA
z{*d*>ipmmT923%UT6aYd2-nDTeQZVtBGfbp0MQp7pwpy$AYHM#zd?*|M$?5MJ`9v`
zX^lDq!0t8Qt^@H5D*-I@=;lC*si(jMunyaYB6XV{Ii(~C(jWNV4VmoR2t=;$grHJm
zWx=D57s6JtHNHfv#U|W
zo9SL|n~9!asos*$P^3UL#EIC~Bq@q@xqs~NUi88>aVOl?WlqJ|U{q3T*y{`V_~Odo
zt)UDMz^khQ>iBc4wnL}856H6%?1`HCx5w+f!pm>Ubj@|K#~yow?5XEwC3{H|^C_!4
zHZ1{$4XI_hdM7b|XFr<(PTixLiH66g{wS$rX-8owXYc=)dLF)=ako%MFU<WGSgF15O|+Ijz(dg20p}?yi@vrVBF0g
zXx~h!v2uTyhXY`WNZqN7e;7E^gMmwNs6GEj6@Y<90rt6~?L_^!G2t0t^P
z_6LUeOHeu7aYN&B
z7hgB!NlAWqijggXhv*!rA9SZdj%q+NSsHq$OGDS!O6X3pnyMYPZQ<5p-3H~G-kmJN
za!VNW#y|(X!t<&Xs}pZBmybBTq7wBRqFwCkPrK9buruuAD!2Dz-e}a)ojsELS^G^8
zy~M@VdQq3V>c*AitsNmxg!~T+VMK)#uI?dsyM$p~yWhXcK^86qbIibBZW!Wta_yA)
zL`(bpv;Yb88?(aRNt+Cknj9L*smWQgWFJZv2@(VZL_jh~&M>F-
zy-!|EP1V%QpQ)+uAKl!0``&Z**?sofYprHXYEEZeF6_6{rl0W>B1#vXC$zg_rr=fZ
z?lIRit7c8}>t{o3B@4F+pDR!gi!CsT;mC=7G(YC&$_*K?1L}{g|M{F;a84CCrwEz%
zmMOR8{EXyLgK1jYn6Wt@duo`u3$}J(JtrN$;Ijl`FOORE(|I=vu~y8R|5q3N_5xDS
z&gHTj->L4>-oZ+_YaH9t`7`$>#lyo(uk($M_6m*JDvOD`L%96u#p+2x@O6oTK|Lkc
z93Wj#iX9vqB*hv9m0L&ZsFArv`kmu#-_WqYNS{z(pT@x_R6?V6O9J8z?PFfmpzYJk
zp}oA&d*v@Z?pqn6>hh|pD%WP^y`SYI_n$bTg$QsP@zu?o%YU-$SK{`nQ%f6O@3Zrt
z>lxaV^FB>BXo`I;c#=P$lYA&n>jnaOlvj5J&;KqWf99EnsUaRq@u%lR-S6#(CcQ9R
zmI?Q*o~8?qKR%XWB(h9Osmax1FQz^(5PLn&3%ezcCk7V~K8t0_~I?SotSS5qE7|1Au(rPoj)mI_6B!8?s8X-)y!ZFHk
z(D#owT>2Pu0vO3IV1sl>%%|0~^-1tL_U1m7R5+ET=*f1>6i4O^AOawj;7;S*Kd#sa
zJR%smaqr7J%qJBkbSNKzvcYIx7--!2bN0e#F
z#t%Szet7-&W@%k=TSPoi53Dw
z+7(-JoV8h+rxoft81eahk63q3V@%Z(_k){4Kg9&+P^!_4y_U_PDH1myeCRbYaOh;5
zB;EqdCv8yltr(mg#&z;Wg$!mvlDcu0CEOp3`C%&9Mp
z9;<^f&~z6}eb#av2*tZYKjr7cy4fp2JC*y=x=J^;0X`eFim9utmf)l@O3p_yV!-6U
ztr}E?7`eF_SL1fH$NqGn%YY2?!MqIQN`xDLJUBJ#X=3yd|sh*QXNoDMUal^*D
z{WO?Fj5ZPIgR^<~POnQa)wjYnsM+lW)OJys0YeX1V
zjTdel{-DjQH+2=!HSUNpJ^;5wAgIKv1Zs^6%i%Q)Usd$%nAb&qwW;Uc`2Of2hR+t2
z;8HaT0)A~PcJq#{JydgvxnH!Z*aX-aFwKZn)L`FniuC%)%r^Dp#e^w*`&AZOgt%n%
z5aTRegilL&324(&-hY-Z6Qw-ioRS&-kd=%gQ#nXgNqA^abK+7WW86g|m~0oO4z?~T
z3&414kI@FL*SpZ%)ULUaOGJ<$%p*cF_ljftHY0=0lX^cF==
zi7XUVV*zUFa+S=-2qR!Rk?8@rI81FBTOjP9WRlb=Byjsg1&WBvP3H`ysrsi_|M
zH7)YKILoeMM&)4a1R4;IXCr7yTrZspvmT?PS%p!MX*_D3@f&`&;EE_5du>+cHy5Nv
zo9u*z_p`3ME*G0)n$YepjP*}cPh_rUuT2B-dM_w+O^S7@$^prDjKu0oo%3?*KCGSn
zj+(S$`H{v6WB)!{+Z7?g0L(NRQ#^J@Pu;eg<-177_R%4nnz$T4^
ziPe}Ces-|MNpItQ0a?5;PO~@AWRWPPyQvFPb-b&-dC4|n*m>nFfb&h1sJdvlZfjgQ
zgQ;r87?5V9?NM0}4AZ9fG4w1Q&x@XI@DI@n0+*4}XHQ;E`=7qOO4=&kCMQiPL~Wk@
zJb*@;Bp@Aoexsd+M)eEdI}2qs=~t+LPbq>&Lj2EO*A1G~10bQNCgeUeS;p=#&xq}n
zZ5Im4ZQ{TYV*5VehOko4F*T5XH*3a9+s?Oo8!!f`3i(Iz^P?buOcd+zaHcad%}2
z@mwYvYBktjKO5{-Cqp=*A^t9LPh2)Ul#YfBNPTIqzzli6qesn
zG~26`gwzGdX}}Un&Yy~VHE7}$z8Q%v{diH9t=I%S&Q2;kOd@e7Zkl=S0Qev5RWvS1
zV2EI=)#G+$O;l4fLk6?Y$AHXb6&RiDwLMq<$;VcVBnoq@%Mr?;81ZGOXKvY0OQTp<
zvqL-u1@-gN4_%QF25wny+9y&tc>@7kL_-3h{XCvS`20+A`C*es`CV!s+pP*jp=1We
ztpNL|)p8!n1uhDOt-DenwB((q3cMI83`lSg!`kKt4g4it1mUtdb8yOLz>t{iYXn;J
zGZ#2kIgp~kY9r6N#WB&
zg@j$Vf68W>@tfSY(8Y({(AZ?S-2aW1%g<~-i{Y`cqD10C?x&%T?Lf)ByfwIzVbnMC
z{`qTtSIbg9ztL$}g;c+L$f6tFm;xSYd+E;`J(p!hqs!tH`5X%pCK+FAwcsy+Z-d|z
zG`T*xwd=l>*%Hu~ZMA1@v!-h4;|u%oOXOgqshu8WIa%M+_n>2y(F*R9Q-ETO~B^Dm`^0%tIL`;Q+HAcdS5kHaVMbYQw&kw
z$x_6l=n3NKmjz0(y1{XHuL10I^jvW-5O0GPzR4G0^;pwGBf6mJVF|a+Ozx%-a2aYS
z&)+|VN4f7YPmDx6?YXe(FRqQlW>;^+1-%1jvPH4q*`--qCh9HlF)Qx
z_2zKrtJ2e=yCPvqu4EQp`>XiLEUQJO>zcBhcx;?$@=LpEM?7NJ4hjii3MC!)?WdX=
zX+CH6zIx_?I8=MAFt{M1o?`WoonJ4ccYsN`xiZASJzFzAdRVaIGXb8zJ0$@+o!koQ
zNp#~T#Yd0>f7I|_;!x?3$$T7kym!~aN&=r>_-m%&T@jU8Q7CSg>SGy#8?ZTuzmmkf;`vqPQU26U|(LKuITuz~zkFu#s3E5_P@rH1Tw{`>5|(?v+6g
zg2eH%SgZnMWvlV1gr5z_FwMzm#92%hWVYzRktL*42Bh;P%Gk(5$3cRa{zCFu+J^@E
zw9wW^17$di!P6DWC)zQW;hcQ$^T}1hu5TL2%r-__yyg!YQ^axQLGox&c1UC?_s}lU
zz?b-rO5;RW+#PG@UT@JU^)H(YM2M$uq_NhZ$`5zW5JIf%YWhvIiIy52D7;+S{G~!S
zhKG;k@=*?CB!iJsWu9bc(a!Wi2BcY!pwmJmaj?^#E$0a&$ss?C|Ftw<+d@;27jN{g
z|Gee)gN7Cywhv3m1zi5H4QHexQ2^gYn(Jhqfi;|Edkbb<6N>F`Xc?9y)Zl8jP|u`B
za1D0-m{<1k-lniQ7LLlHt5s}DQ%157?ux>mv4hT~4DIAR!>Fw*(aEBEW&Tm
z=)c&4sJ(fp864=kFCg*puUqawTUBt1LvP$b5&1uYrrv)Te{hL$-vF#eJDb|-OkTxJ
zYH5|YmV$eI5`2fd+47S%BvZQ=o5$EGD6&sBVSc-xtEmY(VId}SlOt?iuQu{46MbUK
z^L8i`%is-eOwlq3^fFQO9Mo8BgseADrBL~94_?0
zL)GcsMeLVc`d>6<)BG2Dztc%-O>!Zbpr0PhQ_--}H5uh`OY)X%7)OcH{pHnvnpY+{
zS(kT_QZdS0yrRKMqLE2MUz5Dj%1fr)4U(L;q#B@tK4RLwlTwJJ@NetrM&G5}d9St;
z%dL~blg(;R7fy;6&5y7UQd>w2tH`n
zKS8BZs&1GP#hyf+MVcH)px5*`Ph<$M>rByw<6Ix2sLImhD#U=8cUvt`{tF6zQZBg3RJc>#{~CY2hTM-mH}}IBDPeGbf|f<_hf)
z;^bLctT}qi!rQEdJCABNl|av7{gdYCpuwDfe`p!rU5Gr>kYE^;YcBh6Vn;hGwEM?w_+&YKPWzu<84Y%J5z<+|Ez<>O8F7u5>NgWz4e4
zbEw$9&SB`shWHM%|F9LI+kPV!`KeAEy2`^SRnei*ekfx05oV7_qz{R6fC5N6dzi|i
z+MxG6rdbfdwpnR`rhoZZy?22URq#0uF6`yJ4t1BK^FDl%Zt^%m$b_{JO>B~Eji!C6
zMTBK!-U_@SIwU?zVe2)v@uyJ->4lVz8u#omYVnM+)%H{;AwW7XHQ=R$tE
z9Jn=iI7pj!Ow2I`a>*)h+A5QzW^fQm@ymV@^4mnMVb)}thD16Hw~VacKS(4WkWeqH
zT7*4cvZ9|WtyX3)A`ue)I)D_9-F6{F$nY6wi?%v;)6*&W4QqF>M5<(9KZ^uYq=*nd
zomLG=*?FpZvK^`Fg}NnmqR(L-5QkqKS1xe#WggPUIbzY`S
zdr@Y43oR;BtA5s>R5)lpxV9v*31iUFy3@-ta-?A#NJeEn-OR-NoiWbA5)UpK-L5|q
zky>^5Su5LksXKADU#ql}ai@ZIXi+XdwYlzf%Z;JZR#i)4B;F0-knLRlTLpn+0rUhx
z%*yRO11H2YL|%O5!Z!QTlzpPl149_Pmq)}=8J$-mjvjtI?hPj&F`b~>BF-7o3A(w)
zUt;{^r7F|rZbqks9M1#M7(TdJ_I~&6NO(5+*f+(VS@-OyarI#1LFc5!+Qosn76Zf&
z2mP|@Bs&=>lU16SX9o2Lh~o_UKgzrS6Sv9
ziBG}z4en*oPdDf-Cl$EYZsX3ybt9@K(wyvb^n3h!8s
zxmcIjHkYi6l(vO>G!3Ey>D2cfSTajWe~vA{RPMj-H0M0wjB)SgSDaO>laN$-^~2OWON4mvRcvARow(vzo;-86F!3y|VV4+(RAddU
z>SMUK6_4l>0m^LFreuEYRC%pz*9%NM?C80nB%^|@>UazNgH!zyP>@NLpB9pTc9&uD
zVC%1P6y{RVuc`$IPRv@5)1Enx$U%d>BUH28Jm)YtbjBpQv-8$FmnEAlejTO{
zofi6%4Kg%?c*vG0vIp(_jar;#<1U=kI*pgymQ(a%ZPUn*Ct%?OB|Lv0H9+i)N9sr3
zEOyLekqv3rzi@B}6DZC;
zgh}-O3-S)dw1mpkS%}X=-of$USqTMhN}jXr@fPC-sf*>;bDRUcS&YCVNq)Uga^pN^
z-HKsE+}8Ey`4_w&1hAeD{EC@}J4K5`JGNa#51vbX`6zJlU-&W;z?TK4ySma&)wEZi
zEL9aNdU5R3X~GYVb}V(eCn)(1FNLPs7ON`ENpoX@#R^{>(W~?QGkcr
zR@6^!ySW+cMfdDm>+9j%+j=BMeT|%e-t(|WfAYmi5!a)7)38wDO=*B?O1&kG=Re8E
zqHOdl)SEcfX;CkIi=IISS#NsY(Rs;OJr{k$=G3>~ZKlnS5O1xJTD)uj8%X)G+Jnxl
zf%gFsl^0KrOr!biErT=g5QS9a=ej9s3_eDE&nq}Cr3MAB6sS?0AKh9Eo||&VT>Lz{
z1_B0G&7?xr@;p>M3y3(77cR-y&o@MZ89*RJ^(bclt3`w%4SgMb&U8KwSffE4NZu2S
z{THac213TcyglJxK)Eys1Jcoz|MMG7_gu?;y`BJ?W^XoT+Q%y`KimA}du2|ypQuzD
z*qIhfhL8={I+|OLRaz=mWfWJmU)@_tc>ee~K_0S6mx@1w1amu9Y2b$SD5dj{f!Smc
zsHlc3%#{i?OEJ?N;{Of<`T}67sS$MkW2)#L>CO*FKkE&nG#?W2S=yZ#E4|40i=`t3
zNLs*flL8^PZIG){o!SY)%t8z30WL4DYR!`
zFu&inzHymO{<(6nyXtCe_ZaC|o$C$UJJU1@cO)Ckwoe4ZF71s?e^UQDc00jc3ZE^84-h02p1k+v{&ws|YNl2bmEBHH{(
zNqRW-Pdh+mM5L0~_Q@ABU$>s0sRH(?fc;_$bW8GS(||2xfdPklOi~Rwamm=SN
z$0wTndNSpr%Rga*V%>iH1PQLR=s3K2KOuBG+=B*a20hMB_C#a=5?d@6$5}n)c{B=O
zaX0pTLk3!#FxA!O)*D3M%0FEf;UU-C(p&9e*WY6a`Ht-t5@^3LJvl
zsXew;(i#*~9##Wix^ayCt`s#Q3wWL0{cID=nsQt3#e{P;K(2KGPsaUZX{gW~5R@Dy
zfzGjJDly&@h=X@QgGQ&uZej(fVSXA91JcM-0MOeG@Z^02vVp)9u*)vv_d&Gmb52td{V?WV0;2>|g=0VEe-c#w3UTo6SsHKuKzVwyNNj+jreKJ}f|
zvc5bx4B+Y5M$km428a_U{3iJmc*piFhB1K_5f9F)L3mkDhD4z2dz0;jev$Q5VYjyM
z4O6;{+?ZC=DoRzcte}9kcM-rYZ@_GgayIRMkN&`5oOf>)AoCR%Cxx4U?*hQ;E%~b$
zy^qC+o@1EDW+$`fN^}$(roCbF?VZmqfU&;-e0+Vc^BV$q$`k{{j%gif^8EwSbHEUQ
zdX>P?cGLuq?)L-U$MWMP4R;PRkdZY6z;ZG0E2{nlelPr_r3Oa8Q#Al)LoiD7dOWfN
zoPyHOlJYKAmzL|y`+?Qri+WInMz_6cFJKp(B6LJr8++@ExM|8g0#xxvMQR|fU4b#ob
zBH$T|R{-~Id;HKIaKNg1MUFmF@=65Ym0|i`PH7l@$tkrug#zuuWCIAclM{|tQf<9M
zng**iz&lqWW+Pr6wF^-E%^fOWz$<`iIY}z|+Ql~dlBhAfjT~`j))Y0OcA}bkcSw@@
zURg|>JW#GO^d$0!tj5%+LnP?7&7XtL+h>fC_C3$zmtM(dzY<{jZx+JCbxn)_Wr8yG
z^-l166{$OOu}2tSl5HO}!3vw3zNck>wZ3`;{F=*v1fP_n5P$bC1B1oV#$BDX*JotRw5A3Df6-9Sg+cKbf!a
z2H{CSYjJ!qF0={|8PE2-&ddQxtr{%JNstAEkAQf1c`w8n?IwfW
zD|+U>+@A@EOd?+?so^DztK&5h;PvC^IgX2f?9C0P9&sqbH)|On=6e>r_wK|Rz>yEU)x2{&@9mJvQGm>ka
z>}FARKLPEMrQVVE29N#B6rJz1`pIpmz4YB(e*0-i1WL_T^v1Us=^l1)!@Z%G4d-FK4kJBS@s7r9>R!adb?jiVZ=ITJ#ylJiEZ$dM*Zu
zu|Kf~4o2Hv7^EJj$gChr^18IljgS*lT2au>^4!(SC%Ko`MBPAw^Z5YuEj&6D%H3r4
z27w9he3)HTuF+xk@iKMvEitqEQ-6j@!
z!i+pmXZfS396xf4_*sC6*&PSXNA#ZGe%RZywWcGxal^nn$Bl&&o3c$HdyAZz%qiYW
zg;l(6SAq13L;5|7Uv$7sBK>ybA37K8edv4-z4x20NAemJ2rZi>{e@6Pec-koS9urC
ziw-7#-2(0PM&Ux4f#ggLkDzOAZx?
zQWjodR!UuoWrk|HzL&iVsbtZ4>}w|XYC)&}?xk3TtA4O)LRp%y);RG11}0jG=fJaj
z!xlOxvs&U|M76`?SCQ>)rSb6i$|do3(k_N(}B#ix#u%nw~!j$Pm5tV*5x{TEl%P-
z_F1b~@F;Jiu-G7_Yr
z_u&v!gqh-8=K^r)!M7dwSSW5~q9>gY>%eOK2(2yQ&vrQ~niN*nE6eqs;bXehJyIEY
zv8%uc=uU$}KDlvgJDZ|Dq*t|}Lrku+PtCTF;C7EMw#pIfili;!6Zbpenwz-|ygUR%
zNIcsKUL7}DrPMVfkj*lZ&%(X4zcwE(6`oSZKsfCKNZkE#m-GjGjmVj0*(AjEVMx5V
z1rJEJ&T86{2<~!%ljpXct(4^6^hIo{Z&RCO6Q%3?WZlNbe~ipVZGoN%&7vSm@y8)~6dp*YaO;6;7Q>{$2Y>K5Lt
zuNHr0Pg2K9XW_9F(fd8?_!j99%D_Z`cLj<7`=a_i5&w~cu6G@3B;lF^Iw>^;d-j`o1u`*I6GY+c(81zpD4VYZBrudF5y8$YI^!@AKkSwS7y6XJk
z+on_&!%A1Z$$D8C#36GAyuLbWY}w*Cp(ME3KqEGBoF;Sw4&VL}LkoXgSpt;Sumg*$
zzj}`2i3h{gB>3cHi3vjwI>m3G^g~3eE&!%0&0YpA_~H??h6wevp5X@gwrFN~7lcVz
zXx*>g*A7`zsRJnmGQBLb6Tm@!8^=dtfH-oKOUZAtGK-&a^IAY;nc7}7-b?>)3)C?q
zip!L~%!+h!0+TN@SIgR|n=WiZSU*TlMt*CJky63UcRqtQ$Wr4Wh@3?ki4ep)8d-e?
zyTF^@kD4{5&`sT|E_I3dJ$&x>*nCJMIZ!eTSu(&$!{tIm?!k6c;;DaogJ(;nhbMtH
zW7e1RMKX@c)z*u02R)B(3Lk5wxp#zVnmX#R+dB6~n3C*C>ie7E-sC6F8|~cxN$QN<
zLvq!hg|j>KUN+TY-J?zg=jf8$)@eA4FB-+_QEpsYsmnR9R#RNy=2?C?GJL9c`-g*~
zbFKQ`v57msaT>c5`%q(+8>~%&XHIl(QbKPqs8CbH!NU}gpA3I%
zdO#sK3<{8>ZGB70v~J@F(YYH)`3ls<3`YjK2>D*dC#wY4R$;ogUWZX}D5&{2X_|rFn;Al$
zz`n~>Z(}Za@WI%2sL6xJWs%K|9RH!zJS%?I{`J1$s?U#~mEKv?BmIqNM23Q|A`_GH
zuUw4gKMAqT5oDcmQ5Qg+SA6w+ork>k4Ji%t_xN2c{*7jc!9n>T)Bo%o3BUn5_@k^x0BgXH_a&jeDOUzX6A-|2y=eL2s_zj%#-5qLV2+`v9xBVYKtK>d4A
z|Dm!*qCk;Ml?XbJV*p#2*)7-pczICYs>a5@`qS$#=*8(K7W``2K(P{!8Ye4h8BEa%
z{IYiwHBYxe-A0Z7_=Nn;BNU7
z<)mW|b&YU8zZVv;OIAO+TrmE^y7?*!GdN-!K&v7o2@Q|t1D0+8{4kzrkJ#&41U$Lm
z%%>91UHq-%j?J5bOp&-;Ikb?!H@|86c`Qk@yK%2mkTUy2!%@(2QNKyQ5fM22_c1|4
z$`CX|58XenY5QPeNQ-g{?(3LK{yGMBorO>(`p17>6IejfVSL(^@xMP7a}4@2Du_kK
z@z-tqI){%?8Is7ZBmeiUf%jCfWMQbR2Y=2+s%&$xSdPI~r5h0`H%|GWbfy>57hRFQq5&t_ZVA_2CJ1m$5@!x0xE9d|5MP#E6
z2@el%TV1tPb2*nlj!Ut&>;%`});CtO65`Vc-KG)ITQOTf{7Fmh8c!!}=kL6z8PQ<;
zzHHw_F>gP)_P;)25nrjzK+`KivpH@3$NB3V%RQa6oS$%+eE!01Vtmy{NhvMt7MCY^
zTwL7D(R$OJ2KSwyvwGRuP_HKRrJL~xbU~NeaZV3=>mS$&n3?h8Qtk3#>=Z-*;+}~f8XZ(yS`Jau6
z_q%d$qB8j(H~t*vipxUSxW^^@PhPp;V|tO%DB&aJpC{cWQ--*%8@T>i;@w!XA9xZ3
z{%pqS}Yw=I^WCtJJZ8G_1ywYpH*3j*2
hfcQUWX_4(?Uo}X-BUu<)jQJ&F8A(N0iTG3B{{e=Ec;o;8
literal 0
HcmV?d00001
diff --git a/images/sso/cheatsheets/saml-auth0/auth0-certificate.png b/images/sso/cheatsheets/saml-auth0/auth0-certificate.png
new file mode 100644
index 0000000000000000000000000000000000000000..a692215bb15a2be84c7020bceb8156298c22a459
GIT binary patch
literal 86469
zcmeFZWmFwcvp0%+aKgqm?jC|W1Sfa`1b27aKyY_L&;$)Gf#B`|!iJ#1-GaLZyTkLG
z=lsLD_v`)euJ^EJ7DLT+b$3locge4aP*IY3hDMAA0|WC+PWF`=3=BLL3=C`t3KBqR
zwj36RfkFFiB`K*QCn-sx;_P53=U3B!XeNVP8Lc%27zOOHQhRfXIQ5%1HpG2rt~g
z!K}$L;gC`hj~bCm=tX~odUWQXWK@>=n{rJ^uGRge&gBoB0I=uTL1ddSzQsV5*q9qOaQ56>oL!A=zi~Yb=Uy)*f1=8m>Bc6aX`5z8NSpX@+MJU9oWjKD_DeR=bH~Ef!c_Ki^em&;
z?_B1gjkXmqGqZ_O0bJ=6M@Ic8dDUI!sr1K~8AeX;!fh)MD(PK9XI5u?^7~g_h-URA
zYz(i4NewxMQW%e7C?rV2o0|xk`BuJs^;T4QYnQXRBChOGqu<~U!8cQz@oOXBs>PY=
z^V8tLne+q(Z9Cn}luKL11{VFq1IjstL|m4r&HO9qZ9=rl%&hDBO1d5ii(ofRo!=2g
z5K0HaWC!dtthX3)jz98uG5=et*1XfV`N}-&X>?G0blmH0S32iih--4Z31^(Wos}J8
z$2wW2FUw-6;=*g$jlD8{<)Q!h-_t(qD
z&7CEV)bzLOkr`LlEZ+$55r@mL+-NKS*H{4%;ZP
zs6v4cCnf2mLPZmtH$rTQmxx6mVWvW$fqsXP5jZ5Nna#E(@)G8mq(k;F2O3@HOD#N}
z;LUD~R8-^+qa!sw9DP`ePW~gF288lZtnQd2&nx2jXP4dVE1dXZ{W%&c0t_zr@EZ|m
z5EQ9@9o?%0B%-7CKw&G`s*v14Nt`ZiYOox+?p9qXMW8{#1REj)|F
zhe2_j=*Kfx#BCLDZR
zOz1b2tPrpT|<
zC`Y79!2n`{FnuGKWK3jESKE36QqN<0$B4vOz-0eMC=Via+=#2xuhOp*QJR>mk?SgM
z6(9L!M^(6(bcb$7WJhWT`NVo2;BUX`nrg+$d5al~eA5kw
zB)bXY^WNECpG@@ZeWpTf*G#Gx3ub=TeobQ?cCXkM7A#qiX#VML=Wei1w%2oUe$kEj
z2h$0Y0J9Z?m^!sG$!P{>ZEK}r@wjGZ(D~YtV3rTVh~#s
zn{5hHimzsqP5N$J`JKIhy=}d9J^g{#f$rtq!Eh?wAkA;1-^^GFSe1Qpaafs3nKr^Y
ztt$F$`kwk3i}H&ri)M>)KCV8vK0EKFefHmL-qigux`n$%yY2wvg{#Lu=W>;7g#&c9cZo~kJwaUX*i8sn>fJWgoqO%NOk&v`EjT(-JDHsHlFTH}gv=cBNZDKWj}Fenb6sT|dbl;7
zG_KAs{v7(u+%DtCe%0m@^)q>lb?KzRQ}dMdH0re7cEh&yPtXJwt*D}{!t`Y0g73{D
z*)&-fnJ}U~A~HGwdNmrd2iyFN)+=@>vsb;%bvbiST~AVTM00-gjRKs)Cxvqbk3?U_
zwG_7$??he=OAXuNt8Zb=n-}_*t>;OflCG1o{P1rf70~*U%GqyC4M;j4RZm?FzPH6@
zfkY<`G?%j4A9i6^0`7w-k>_m4tZlHYNN4qtr{s1+vHHMmZr^uhU0OYT-UP`@-m5xl
zc%AhOJBePBqVr9(Ge*V4e9aQCy||sfsc|>)p}6k(X7a~&ty|~i
znxX9zE~rIa7H#HFenBU;-FdCjBDeMTtJj@%8+JZ~U)bjD4CWU-IhR*A6huVBWTE15%oABR(}VXJ0?Obll{!
z&9-|`dmy!-C%htj>1E=5bLey^+@9t9a2^zmyyim!HU|F|R)c8VYOOh)SJ1WdoXuTk
z5gidX+|!)NEm2q;Z8#(>wP9=s(TcMA7TlFxG@hT1cZ+n_>$7-ro~fNVzo)tM=viXc
zCu$cs4!a?rlF5}0(~mMxZkhS>c7H#>qwa9FH?R-fuIwXvPkER-+ZU7t$`TNf@%80t
zJ3&8C=-2#M!MX(3CY&ytk&0c}v&YEjFM*UE57Y4(K3qB$$=?edW;MYoM%ZlR%%c-O
z;NknYz}l6n2P
z5fSy_Y<&bUN418=#x3T?t2WQnY{_B1rj5_~ju~Sw*qVsS`3TPQ`uk1S96Tt*J*0P<
zB7S`FaCn*piXd5*Y>Qt24BxkAT5{&EU&Al~*C;TsVOB5*z!fZT5(6h-BPWEyAOpW~
zf%8>1+<)%EV`ant=NdNT@j-EQNjW*-x4Mb5nVG$drGsnFDSrXLYSKzW%T?>OqJW8m
z9h;Gb2XxX*xA~<2tb6X{`G_aaQ#STr=s}RBd#{WR9df9
zC?p-6%_z9pUb1meiJ(zXPzX7jnhU7ClK!vez+b{tmaeXj0_^M_9v*BSTx<@`7VMn-
z{QT@3FW6taU<2RhPcuk1
z2l=^pyIg1`C}D9ao*cXgR82F(3p8SIPmXNV5y*1L{~#{oz!GDDjf|=O2M=Pb79?4J
zguf3VDzUXrYDL9YPuYsC1x&%9#{Yfz%OF?^L4qS9{%#IjTM8W!KOHLWQ8-KtavTRI
z&QlHmQ6K)v=*8f`IN8U`ICOMWPbP~SzV|G!+2gRkeUlyf^K<|tpax68
zDQAf!m1pd>1HYe6!AAi7mN(C!PSZgJj-jL#{zxSiX=%SPkdi{m?=1V7$Bu@9MJYpomR>0x#g(n5
z{{ywmdRGW~K%K*Ejof5~0l6iK=HCl!7dU{!MyO1uUTGu<%x$fqU1b^}7^C!R_g9lg~A3j
z$!z+YQ9xaVe(SqBhb8d;XJ@y!r^C3^(iq#nia&~3=~bJ@$edBX3SU-jI!d;jEYrpn
z^?jcvGoK@!2V*Z_eS-w$j8;5sNMLii~Tudw4a^)@xGfw8DrVv@cl{5DF*=t
zwbn`dx>_CANEjdrmFW+^7d)0G&cD$~da1zpE`xzU~+)`
z{ZYV$DM%Rsga7F2&u)cVGD?is!`B8?D;q_bpt%4OKx4k1df(qRMw9R=okBB(
zn-iHel{Os&i3tCB)f9=?siJ;u%j_%)sV~9Vzo-X)XLu}r2u8(|?@yqu-Gl|BlwuIQ
zcom9C#w3?OGa3qyKh)-PGnqfQYEN1wQI=%CEyER;~mieX(SvQy&UX)PywA
zn)M%U4%@Rz(*iS@D*{=u_68Ce$6YphM&?8wZe22vePfFBJz8IfXl}nANM;@1y}P;O
zmCG!J?Gwmy-=E#KD`4^Yb5@zJDjhANL`3EF`GxLT6L-uD4p+TSF~;pWldtH|El7E<
zfDpTSL9__i>NthhVQ~|WUa5xmJP$**tVLuviN4pJ^mzxVCsQ}mh0Xk!r6BoVinZ*9o675uIr-tpM$b3HtV*=Lu*r9Q#5l(D
z9p>QgYKvj;LQpK&PPWN)+crmGt1*mJ2%^GqqdZaa=3Jyz^)5_>empA9F8r=f%iqBF
zT54H)y1^-zf(4CI3Og7R_$uXnAMQNJdV^07rz<6wVH>{~L>8
z8FCBRm1F~s5Up%nC3X-pRoCafHSiEql_8(yawjTC|3>%55G6-&iNSi_;Xs8*Pn
zQlS5HC>nf4@d_2n+lxq{QCddq5g>{OM$AR+4Wc*u_WO=$pd7+qYO(XH7(N5nL@|L@
zfevH<7lgwl$H<oU$7R`P;
zoZmUm@HyR{x{;KZXd?7rp?Pl1IJ>qr8`emOqQDo}4rYT4&5{3X7iQJauMUeo{DRgy
zA6p_$h+ui_0z1v99FN0dSu2s2su75eJR1eaE_q5LOY_jw#gSDwN_*TsK_cp*hIuEz({XPVk9NPxR-Gjy+8RnR5j6o6fb=
zD#Fbk3Kx{#aQ`SYyxilXl9-M)x&L@4`f2{HeVwM37%0`?x4zwp$Nq~>7_Z(s9q@S&E)(bh3!iZuV&&bRAy_Zg*!Qv^HR(q%3#H!b
z_XtEJc%)^jmzKcJ%o8#vLaw9Spb6Ra|93p|JdL*Y4^koku$7#nY_s9F}4a#eZ)lfw3Ge<8I3#p3P?
z6?PEbQ4!=FQl4Z3b{j!}bDDMzhZZTzs8XsGYETM}1U`Oc1^tP5coHf+m*-GAzj~NK
z=bArJnW1h6MD8=sSGlggHJ24(o(SdOqCHunncwOa?~UYyJzkYYwfWB!C?X=!@p1Sj
zuK`ymoKBe*Cs|}L(MLl*!x9Y{xDBFE_-MrO+&I@%O4Qw@_op%X(ueiiA3PG{s_i&H
z+3UG7de1JzIqyMu#(6eV~{GljPz)8PD
zUR;OR-NfptHK>U62})kS4X&c7q4zvl7iVKMKH}tNY-2nwao(L|CDVte?$q{8?IqZd
zCeCG;%eq|hdmsSOI<58AE^WAy{fu!C&h`K=BHwU=CgFt{gSdSh*}7FauFxS|D*Ecm
z!FioQfv`)HRVKEm1*=kCc!31z8%Fy7cv0AysF0G~u;Op|**sc~3?C<*;KW(O_%Wev
zf+6Jc9QV4YiGB`<@HLzr(|E^u7@6yMi7!(}(a4j7`hH;01!|%$t&3SEPB@C)gQfyz
zN*Vs)EC$y`y-e5}ba=#RVSv*ScE({2XK>g{;W0QE%)t&(N)O4rE@2r=`O9CY@PG87
zQF9VtdcPSKFe_$6IVe-?VXP4!N$oEm(S$(dt5yE#02}(~{cSv3AMWYa!WvWy5&dh=
zjPKZ`$1X6}@w#i!g8OH&1U&g81Gtyq+xmTNm#5@NpzjJt&cCfX7}P6vAk=U_cTvXw
zm$3(f3X$^f4bp5#P5o=|{s^}z0E-7Z@5%Hh}bD7-qPskOIE;Je;-p422?*lHtqTO!z(^InMV|*hdD&oJ_
zphx4Z!w-<*(Ndko&!=Q&Kt?THJ>UP4HsDV!w*xG$9OkNjKP3|YGSXi$HhwD4{}uB;
z*6;s{`ET9$KUJGaYwkkFHBHazsOyAXHXWuXgKUf@j-y_wQ**NkBSCoq;p3a6F&~U>ly!oTu!3ePY%KSf;~Df+oEf+I6;RtPkFo2mOG(Xa>X(Pjp*9K6;8bmxuNH
zn-W{p*!*V%{nfZW&1-sg&ZDgxwBm?ECdg%SC$^R`XxUo4j<)5BT#3*4g$s^IaEJp|+Xp#|yO22ySk^&N*%Gl3FI3qPDs)ft`6h8Q*dP4`#*$?=}ZA-zU|R7EI?W;!8Bmwj61+tsbaHenqhmnL_hJc$&
z^|F%^3go`mIiYiRR_G>+D}l>Ox3i+c%HX}b
zL^^Vd_N7CCVuP`Zn<>(E8kzEi%B4Nm1=X1hI?PZqt_KlX1BMVG7P&V3V;~3WU5a+1
zy}fsGxPPMt8MD^*+c{y@q~DOlgS>VSk$33dviX6
z?_WCb)AZO>@3e}I0L5bymHB2xoB6I=z>MS7hnUFi#&U;&%R~Ic5ac1bq%;x)XxN)c
z26%EPm+3~O!la&kiibf1rQ4>h(`UAqv{##BuNgVbzP|WEH9$_Dm=v{O^8;$0zi~7n
zsOCLn9yVOO%+SvKR!4+|onGM0xL+1NlqMuG(020pGn3MlDu%F;wlq<$h5f>KrtC+s
z{uNE-mwtnX#rWnp0|9+gAnGyet%W)_V{%etP
zU#F}N!^-=K!DQ$JC1u<2=;^^O)HBcKm{+2OrA@#H2>F@L)>w^I7>Hi)RH{yreeAtvW0@G1
z%ZYB^`?hNK4dInxlLTtH`INdFXG#B0>jPXZi!Hf~aqwP@)eIHgf-`E+FPD)DAAUvT
z#qBI$#Z+Can-v#&^}JT*hAviGKIgA!G3qP79?~Nt)<%#?YtvZ4RVnZ-(Rt-zEmj;@
z?`)NeE3oc#-026Ofs_G0WI`-1*vZMjQzWCvxdxNe+-Lj#9xT>;<{t@~qF!H>
z%)a*aM~K*a31h_8RkQnFhi+V?M*p;(P1*L;THW>^qh)ZClvF!Vfym5$z7D$X0eN7
zYWHiL@9ndLl))6Xudwb8+aK6WdZRyBPn5_7BB0jP8v&t6TrP9PG!Y*!Z0Ga6c))Au
zA1_pE>WDO$%S@wuKp0y4
zFtBops~Lh?%b2J=`+O)*dDXt%M-KY>PV!I6Fk}80-K4N7ih5dM;)#|jwcG+}@f(P`
zxmzs5ACB+3U;4=5XsbT&r16!tJVUYYZ)tY~l;-~0N$Ts%+Y%`6o#-LF7rS@GY^fx!
z+V@yC)|0{%_Ykh#6i{M}Xkr)g<^8XP!WtW_R`B$pEVjtFY@<*6n^1{0UV{cd<;4d2
zcJgM1?nN(kq+6#BcZM#OZz2{;L}bYmuWk2iJ5y7xw5>91KKSZ)wVsBb+93aq;0FUa;UL2R
zKK*w$>g3z6(fxTD#<6P>rT!0MZa=f@3D(S((;AAPvA_t28uUe=S>jDaJoE2=m$<4<
z_3d0LpeHi@NRWJhx^4ud8MLQDT<%tg;VxTC3VHQzQ^(qMm5LMiuN6`a_x9S~>tG8Q
zdUYrieM>=Ku$EPH)01pzq^n{!!H*2BU4UB1G9CV0Vj_8?Y>GiJvO=
z`PQs&aROxx?0(bg7GhfAEL7x{L30cOm6c@_EwYecJx3SEI(RYB7L{ZK3*UY}|1}Vs
zef$E2yps=qK37`ar(LPSL3IjE;wQFd>H8RIrGhIiN`@{Wa%c+0c;E25u0>_
z#-_10O{7=3Hsa#M%4e+Iqn9o0BhuQqJH-CPne~gMJvg+`RY#Z_^rgC&X?+wo2csY{mx7-0M_mM6J2z^OHlb8$R
zO4SQvf0gU$cykzHW03Nxv|X*Dw^m4oVd4sVxoTG$hnyWQ89YWro*{u);=Rsyi@BZ>sibF`
z*s|dM#$ApxdUTk;4kBD}hH&lMuCGS07D>Cc6<$Tznr;I!8~Jf))YnTpex?Cvl>QBK
z6?oeBl0`VHe3U8&M)9{Ah2baf@$oUdz{UC(*k^39i|!g>RA1F1Dez4(O1jYR!`_9s
z5`*~1msrbgWXc!4Y3P5Ulf#+il%P2<XFF$Fc+0qK9je(k}PdsGYx#p4RkRX5TCJ2
zTbOyg)l5frD=yZrAxJ!FkPJC~Is91(>8qbn5yfjRvsY$s_D?VAlh!5kU-?zJ7QW5?
z!)Qj>TDgS?PtSnH0s6$4`z4n+sH)kGR<0O4UF2;^7)|Lf(V$%U9TYUn^lLqtSm@Sf
zE#ZX(qtsH-?(aU~LN}q~Yr)If0Mnh9l0=w%;MMJOA&aFr
ziCB5#(7uY)nF=qXrf3(&X@L;w`hKDtJ*2v32O*%c?#F6cgX3lnCOPN!vG*2~^$x>2
zRj0K~!IS`0*dQwMX3aV}dfHj*Pts3D=1<9EQ$!dQBNPt|CP*p%Nmxi*lAXN<38|wr
zzBT^S5TQ+T#t`;TYE-``nCX%dFAJ8)Z#II7k!zJg1Ybi0+uPobet_%bu2bF+^}SI|
z``Q9hpKy6TT+r{Ap~87Oq`e)acN>Nocc=lDUf%A#3lvCok#LgooGf)-A^s|gHFfBc
zaw%|v{&k8I8ak5y8VU)^X3aLu9ReAc2%*y3&rcjuy7F{@0x6M)bt?O9&Ja)`%AM03
zCO59;Z1>$R=tecahl6Dry)#!bFyki5nxxDkUVN{_kR19kCb^mavr2DFyOkM-Ddk-&
z?@qA=hJchJ37gPSg`#(TJeYTTFXQ(fS@`CR)VW9~!sX4}FUmY$Al=4*h=%V75nwn<
zVtO-n!=~Fn0Yvr_-d~^e18KH=-@88ow?BfpDPLLvq13TLW%7V3%%Jtp4sD}-K#t>$
zbR3u!=hqElU
zh%w9ePca*ER~L|*-1SIWL=va+6-ls>kw<~F&rCs@R+!vKYbm|7iE7zMQq1|Baccgf
zK^TZ*!Kh}6*g9d{TBkiHH4F6TVmcr~mAz5wz|1Q-=oLrcV$zEI_IF}>sRc_+x=a>=|sY-Tch%2_+fj{@bCgJ;uW0!JRxZnx(*DJcgtg;UtZSx
zs(Km_QBKD?B13o#WkcLyMH%Et-t2Km?9Jjsi@f_rB(?Qhe0tp}5>XO_li1hPJl16n@VgOh=
zGKTs2#V5yK_7|Jq1%yIb6H`!E^dQB#&y*SAy{gr;ModJCrF~l~Qq{^JlJ6h2=3|K6f7LINBv3ms&?I*
zR-03rIE&NgM#eai#0JSiuS#Bk^+H(?ZJ(>Eiy
z@7B`(noMHn63A!cGAG~k3v*yn+0Qr3Hp2`{0LjyuuGmFC>Ytx^Qyw#1CJ3J9KR>-W
z?7Bj&wjHAqLPHZl5Wbs^6OH!f2y_BHBjHKhnJ85#P)s|6IY{Ssfu8S9(aI+>%u>Tr
zBW(t%!uOEh#4AUGIB9@XvKNtlB4C{Bd(#{KGNj;b!Q&uamI}~>hg(Cq?wY<{2_skJ
zyt0v5?)f-kFJq|}G6frSaCE{Mn8H)1<6Y-G+jF+I0#pA5$K&R;z%G0AbA|PZrozuq%EL*WfrHj5r%
zu~4`Df=oE3FFaj3IGt@WqshdMYV7%e-ODUGyB-P4&pBN>vps&PVMdO%52FsNu{}sPU2$%_Ag-x^-
zwp%!0cbI9?14TgY2rTdw19R|beNP|j=M?7-QmkB3KqTigzoJdpXjK$}m7{xc*_G!T
z{cK4*hRut`_mU)^F<(Foq)RqQg}79vk1?3|tdiO;K7iMV*v^ZrFq5)K@W&5n=0YEy
z>k1E#toUz!JolB9!Ml$pZT6KhX4ZqH%#k)^$j19Ag!i?#zSQFr|Kf~;V|#l>MxW+f
zP6IhV?$v_nPzdbsRTL?I)!Uj;g*ez@=@D;oZfpNd?76XmXY<=;V~FR3P~oneXv5wD
z01C15W)M3h?elW&BXnbZC_~4g?`3stuL?yls&p_vID+%zFCdS6#*XCFZQ0UzHfya!f|-85KC`xw~qpQ75c-Q
z@8~kl3D>YGEE22izyd#z59aB1DEVKV*BJVgq9sXSuuH^ZmN>#IBea@coT_JOM$((#
z`d2;cO#GAy#dE8c9AOU9|8nRK)^wU7-1ry>8%YH|l1?bTa+1~I_Jvbdkmw+mC&TwB
zO_4a%cxWtPMw&8eiFi}ik|WmX)?Q@fv@jmxnu(=O%c(#U_GOkQmY>xe;6H`IvLAj`7Tm^#DpBy%cg<=<@rY+oZX-WTncY}upeu)Ic@YOHL@0fsdut|G2BYE@hdB{e1ST|!);+9y
z^QeGLC-9;)oj;8Se8duP?D)-xU|~G!4n^nq6`;Qzgn`>bKbt`-N+`820-aP5HTn`c
z)hfwC^+?a7gFO&&M^9{B&y~g_^lk~~4;=^#Px{${X(?YJ8_8@f@WLI!^>RF7AEaZ5
zX(RCHCo_?Qv4{e`*prnS>hW0VZvdW9p7X(c)TMAVVf5>cj)Si{_11?S%A$99eFhY_
z(1|^H2GJJGAf#ti1gO=*JrQ^^23aUEfye&eN*Y}@(I!`WL9(J4Ywai!$X--4#k@@&;Ea?8wK^MKz4%kP{Pjw}}B9_=(>oumdXeqj*sPAH~yl
zi9JoM`KeKyh+EH#h*dl_iSKwJvmioQczD=Flm<_nb^xg=vmsx8u_m1nl3UeW!mMAn
zo8%lOK7`F6dXxIN?eKEI|@&$btZc4ORIxRBEM+b04Hn``!_Qt3H@V
zya=m+|5fu{i4Y%0Y}=BjT6@FDcqn#su(dlOMxD$ZPN{*>tQV0b5jvciSsw?Z`<#if
zcGoL;v8@>?VM1Sl37y4q*$#A~?kR~eq}X$Hal6zQme;Q5S_{SjXd5yM0++Ncwb
zY#-htC3K5L0h>QltajO3h0z%eL6p3(Iy|?~l@X
zVmT-yK8#u4yx6D|dA|{xDEm>%q1WHTal6z!N%F_@MFEgu^bP2;;25LBB=(!mEzx0P
z|I|zc5K)kr>+sAb-owBmncY_B?nOStqfRX{%xR*};mwA({q)HaA;%fwAc(7Z_)_Lj
z%m& |