ADFSToolkit

2.1.0

config/default/get-ADFSTkLocalManualSPSettings-dist.ps1

                                
function get-ADFSTkLocalManualSPSettings

{

# HOW TO USE THIS FILE

#

# To see examples:

# dot source this file from the location:

#  . c:\ADFSToolkit\<version>\config\get-ADFSTkLocalManualSPSettings.ps1

#

# To see examples invoke Powershell get-help: 

#   get-help get-ADFSTkLocalManualSPSettings -Examples

# This file exists as a template in the Module with a runtime instance in: 

#     c:\ADFSToolkit\<version>\config\get-ADFSTkLocalManualSPSettings.ps1  

#To get help with wich attributes that are available, run the following commands:

#(you can select the lines between <# and #> and press F8 to run them

<#

    $md = Get-Module -Name ADFSToolkit

    . (join-path $md.ModuleBase "Private\Get-ADFSTkTransformRule.ps1")

    . (join-path $md.ModuleBase "Private\Import-ADFSTkAllTransformRules.ps1")

    $AllTransformRules = Import-ADFSTkAllTransformRules

#>       

#region Helper Objects

    #Helper objects, do not remove!

    $SecureHashAlgorithm = @{

            SHA1 = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'

            SHA256 = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'

        }

    # Hashtable that we will return at the end of the function (ok to be empty, but MUST exist)

    $IssuanceTransformRuleManualSP = @{}

    # Hashtable containing all settings to set or override on a SP

    # Copy this to all SP's you want to configure

    #$ManualSPSettings = @{

    #    TransformRules = [Ordered]@{}

    #    AuthorizationRules = @{}

    #    HashAlgorithm = $SecureHashAlgorithm.SHA1

    #    ApplyMFAConfiguration = @{AzureMFA = @{ 

        #     phoneconfirmation = $false      # Call to phone

        #     phoneotp = $false               # Click on number on phone

        #     phoneappnotification = $false   # Push to phone app

        #     smsotp  = $false                # OTP from SMS

        #     otp  = $true                    # OTP from phone app

        # }}

    #    EntityCategories = @("http://www.geant.net/uri/dataprotection-code-of-conduct/v1")

    #    SamlResponseSignature = 'MessageAndAssertion' #Valid SamlResponseSignatures: AssertionOnly, MessageAndAssertion, MessageOnly

    #}

#endregion

    <#

    ### Attribute release for ALL SP:s

    $ManualSPSettings = @{

        TransformRules = [Ordered]@{}

    }

    $ManualSPSettings.TransformRules = [Ordered]@{}

    $ManualSPSettings.TransformRules.norEduPersonNIN = $AllTransformRules.norEduPersonNIN

    $IssuanceTransformRuleManualSP["urn:adfstk:allsps"] = $ManualSPSettings

    ### Attribute release for all SP:s for one institution

    $ManualSPSettings = @{

        TransformRules = [Ordered]@{}

    }

    $ManualSPSettings.TransformRules = [Ordered]@{}

    $ManualSPSettings.TransformRules.norEduPersonLIN = $AllTransformRules.norEduPersonLIN

    $IssuanceTransformRuleManualSP["urn:adfstk:entityiddnsendswith:swamid.se"] = $ManualSPSettings

    ### Attribute release for one specific SP

    $ManualSPSettings = @{

        TransformRules = [Ordered]@{}

    }

    $ManualSPSettings.TransformRules.schacPersonalUniqueCode = [PSCustomObject]@{

        Rule=@"

        @RuleName = "compose schacPersonalUniqueCode for [entityID]"

        c:[Type == "urn:schac:personalUniqueCode", Value ~= "^only_release_values_starting_with_this_string"] 

         => issue(Type = "urn:oid:1.3.6.1.4.1.25178.1.2.14", 

         Value = c.Value, 

         Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"] = "urn:oasis:names:tc:SAML:2.0:attrname-format:uri");

"@

        Attribute="urn:schac:personalUniqueCode"

        AttributeGroup="ID's"

    }

    $IssuanceTransformRuleManualSP["entityID"] = $ManualSPSettings

    #>

    # see below documentation for example Powershell code blocks to copy and paste here

    ######BEGIN Specific SP Attribute Release Settings

    # If this section is empty, there are no overrides for SPs yet -- see help above for examples

    ######END Specific SP Attribute Release Settings

    # Manditory: this returns the settings to whomever invoked this function

    $IssuanceTransformRuleManualSP

<#

.SYNOPSIS

This is the file that site admins edit to locally control per Relying Party/Service provider attribute release.

ADFSToolkit attempts to detect the presence of variable ADFSTkSiteSPSettings and then ingest it to control specific rules.

This file, minus the digital signature, is usually used in c:\ADFSToolkit\sync-ADFSTkAggregates.ps1 

ExecutionPolicy: Can execute without being signed as it is locally executed. It is the site admin's discretion to permit/allow this. 

.DESCRIPTION

This file allows a site admin to configure per RP/SP attribute release policies for ADFSToolkit.

ADFSToolkit's default behaviour for Entity Categories such as Research and Scholarship are handled elsewhere in the ADFSToolkit Module.

How this Powershell Cmdlet works:

Creation of this file: 

Usually created from invocation of get-ADFSTkConfiguration or created by hand and placed in c:\ADFSToolkit\ to be dot sourced.

In the file:

For each entity we want to change the attribute handling policy of ADFS, we:

   -  create an empty TransformRules Hashtable

   -  assign 1 or more specific transform rules that have a corelating TransformRules Object

   -  When all transform rules are described, the set of transforms is inserted into the Hashtable we return

    Clever transforms can be used as well to supercede or inject elements into RP/SP settings. Some are detailed in the examples.

    To see example code blocks invoke detailed help by: get-help get-ADFSTkManualSPSettings -Detailed

.INPUTS

none

.OUTPUTS

a Powershell Hashtable structured such that ADFSToolkit may ingest and perform attribute release.

.EXAMPLE

### CAF test Federation Validator service attribute release

# $IssuanceTransformRuleManualSP = @{} uncomment when testing example. Needed only once per file to contain set of changes

$TransformRules = [Ordered]@{}

$TransformRules.givenName = $AllTransformRules.givenName

$TransformRules.sn = $AllTransformRules.sn

$TransformRules.cn = $AllTransformRules.cn

$TransformRules.eduPersonPrincipalName = $AllTransformRules.eduPersonPrincipalName

$TransformRules.mail = $AllTransformRules.mail

$TransformRules.eduPersonAffiliation = $AllTransformRules.eduPersonAffiliation

$TransformRules.eduPersonScopedAffiliation = $AllTransformRules.eduPersonScopedAffiliation

$IssuanceTransformRuleManualSP["https://validator.caftest.canarie.ca/shibboleth"] = $TransformRules

.EXAMPLE

### Lynda.com attribute release

# $IssuanceTransformRuleManualSP = @{} uncomment when testing example. Needed only once per file to contain set of changes

$TransformRules = [Ordered]@{}

$TransformRules.givenName = $AllTransformRules.givenName

$TransformRules.sn = $AllTransformRules.sn

$TransformRules.cn = $AllTransformRules.cn

$TransformRules.eduPersonPrincipalName = $AllTransformRules.eduPersonPrincipalName

$TransformRules.mail = $AllTransformRules.mail

$TransformRules.eduPersonScopedAffiliation = $AllTransformRules.eduPersonScopedAffiliation

$IssuanceTransformRuleManualSP["https://shib.lynda.com/shibboleth-sp"] = $TransformRules

.EXAMPLE

### advanced ADFS Transform rule #1 'from AD'    

# $IssuanceTransformRuleManualSP = @{} uncomment when testing example. Needed only once per file to contain set of changes

$TransformRules = [Ordered]@{}

$TransformRules."From AD" = @"

 c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", 

 Issuer == "AD AUTHORITY"]

  => issue(store = "Active Directory", 

 types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", 

 "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", 

 "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", 

 "http://liu.se/claims/eduPersonScopedAffiliation", 

 "http://liu.se/claims/Department"), 

 query = ";userPrincipalName,displayName,mail,eduPersonScopedAffiliation,department;{0}", param = c.Value);

 "@

$IssuanceTransformRuleManualSP."advanced.entity.id.org" = $TransformRules

.EXAMPLE

### advanced ADFS Transform rule #2 

# $IssuanceTransformRuleManualSP = @{} uncomment when testing example. Needed only once per file to contain set of changes

$TransformRules = [Ordered]@{}

$TransformRules.mail = [PSCustomObject]@{

Rule=@"

@RuleName = "compose mail address as name@schacHomeOrganization"

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", Value !~ "^.+\\"]

=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Value = c.Value + "@$($Settings.configuration.StaticValues.schacHomeOrganization)");

"@

Attribute="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"

     }

$IssuanceTransformRuleManualSP["https://advanced.rule.two.org"] = $TransformRules

.EXAMPLE

### verify-i.myunidays.com

# $IssuanceTransformRuleManualSP = @{} uncomment when testing example. Needed only once per file to contain set of changes

$TransformRules = [Ordered]@{}

$TransformRules.eduPersonScopedAffiliation = $AllTransformRules.eduPersonScopedAffiliation

$TransformRules.eduPersonTargetedID = $AllTransformRules.eduPersonTargetedID

$IssuanceTransformRuleManualSP["https://verify-i.myunidays.com/shibboleth"] = $TransformRules

.EXAMPLE

### Release just transient-id

# $IssuanceTransformRuleManualSP = @{} uncomment when testing example. Needed only once per file to contain set of changes

$TransformRules = [Ordered]@{}

$TransformRules.'transient-id' = $AllTransformRules.'transient-id'

$IssuanceTransformRuleManualSP["https://just-transientid.org"] = $TransformRules

.NOTES

Details about Research and Scholarship Entity Category: https://refeds.org/category/research-and-scholarship

#>

}

# SIG # Begin signature block

# MIIn1AYJKoZIhvcNAQcCoIInxTCCJ8ECAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCsfODlzvKFv88l

# nOWfnuplQw6d2pSSLUdC0Ir/moDptqCCIN0wggXfMIIEx6ADAgECAhBOQOQ3VO3m

# jAAAAABR05R/MA0GCSqGSIb3DQEBCwUAMIG+MQswCQYDVQQGEwJVUzEWMBQGA1UE

# ChMNRW50cnVzdCwgSW5jLjEoMCYGA1UECxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9s

# ZWdhbC10ZXJtczE5MDcGA1UECxMwKGMpIDIwMDkgRW50cnVzdCwgSW5jLiAtIGZv

# ciBhdXRob3JpemVkIHVzZSBvbmx5MTIwMAYDVQQDEylFbnRydXN0IFJvb3QgQ2Vy

# dGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMjAeFw0yMTA1MDcxNTQzNDVaFw0zMDEx

# MDcxNjEzNDVaMGkxCzAJBgNVBAYTAlVTMRYwFAYDVQQKDA1FbnRydXN0LCBJbmMu

# MUIwQAYDVQQDDDlFbnRydXN0IENvZGUgU2lnbmluZyBSb290IENlcnRpZmljYXRp

# b24gQXV0aG9yaXR5IC0gQ1NCUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK

# AoICAQCngY/3FEW2YkPy2K7TJV5IT1G/xX2fUBw10dZ+YSqUGW0nRqSmGl33VFFq

# gCLGqGZ1TVSDyV5oG6v2W2Swra0gvVTvRmttAudFrnX2joq5Mi6LuHccUk15iF+l

# OhjJUCyXJy2/2gB9Y3/vMuxGh2Pbmp/DWiE2e/mb1cqgbnIs/OHxnnBNCFYVb5Cr

# +0i6udfBgniFZS5/tcnA4hS3NxFBBuKK4Kj25X62eAUBw2DtTwdBLgoTSeOQm3/d

# vfqsv2RR0VybtPVc51z/O5uloBrXfQmywrf/bhy8yH3m6Sv8crMU6UpVEoScRCV1

# HfYq8E+lID1oJethl3wP5bY9867DwRG8G47M4EcwXkIAhnHjWKwGymUfe5SmS1dn

# DH5erXhnW1XjXuvH2OxMbobL89z4n4eqclgSD32m+PhCOTs8LOQyTUmM4OEAwjig

# nPqEPkHcblauxhpb9GdoBQHNG7+uh7ydU/Yu6LZr5JnexU+HWKjSZR7IH9Vybu5Z

# HFc7CXKd18q3kMbNe0WSkUIDTH0/yvKquMIOhvMQn0YupGaGaFpoGHApOBGAYGuK

# Q6NzbOOzazf/5p1nAZKG3y9I0ftQYNVc/iHTAUJj/u9wtBfAj6ju08FLXxLq/f0u

# DodEYOOp9MIYo+P9zgyEIg3zp3jak/PbOM+5LzPG/wc8Xr5F0wIDAQABo4IBKzCC

# AScwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0lBBYw

# FAYIKwYBBQUHAwMGCCsGAQUFBwMIMDsGA1UdIAQ0MDIwMAYEVR0gADAoMCYGCCsG

# AQUFBwIBFhpodHRwOi8vd3d3LmVudHJ1c3QubmV0L3JwYTAzBggrBgEFBQcBAQQn

# MCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLmVudHJ1c3QubmV0MDAGA1UdHwQp

# MCcwJaAjoCGGH2h0dHA6Ly9jcmwuZW50cnVzdC5uZXQvZzJjYS5jcmwwHQYDVR0O

# BBYEFIK61j2Xzp/PceiSN6/9s7VpNVfPMB8GA1UdIwQYMBaAFGpyJnrQHu995ztp

# UdRsjZ+QEmarMA0GCSqGSIb3DQEBCwUAA4IBAQAfXkEEtoNwJFMsVXMdZTrA7LR7

# BJheWTgTCaRZlEJeUL9PbG4lIJCTWEAN9Rm0Yu4kXsIBWBUCHRAJb6jU+5J+Nzg+

# LxR9jx1DNmSzZhNfFMylcfdbIUvGl77clfxwfREc0yHd0CQ5KcX+Chqlz3t57jpv

# 3ty/6RHdFoMI0yyNf02oFHkvBWFSOOtg8xRofcuyiq3AlFzkJg4sit1Gw87kVlHF

# VuOFuE2bRXKLB/GK+0m4X9HyloFdaVIk8Qgj0tYjD+uL136LwZNr+vFie1jpUJuX

# bheIDeHGQ5jXgWG2hZ1H7LGerj8gO0Od2KIc4NR8CMKvdgb4YmZ6tvf6yK81MIIG

# gzCCBGugAwIBAgIQNa+3e500H2r8j4RGqzE1KzANBgkqhkiG9w0BAQ0FADBpMQsw

# CQYDVQQGEwJVUzEWMBQGA1UECgwNRW50cnVzdCwgSW5jLjFCMEAGA1UEAww5RW50

# cnVzdCBDb2RlIFNpZ25pbmcgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAt

# IENTQlIxMB4XDTIxMDUwNzE5MTk1MloXDTQwMTIyOTIzNTkwMFowYzELMAkGA1UE

# BhMCVVMxFjAUBgNVBAoTDUVudHJ1c3QsIEluYy4xPDA6BgNVBAMTM0VudHJ1c3Qg

# RXh0ZW5kZWQgVmFsaWRhdGlvbiBDb2RlIFNpZ25pbmcgQ0EgLSBFVkNTMjCCAiIw

# DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL69pznJpX3sXWXx9Cuph9DnrRrF

# GjsYzuGhUY1y+s5YH1y4JEIPRtUxl9BKTeObMMm6l6ic/kU2zyeA53u4bsEkt9+n

# dNyF8qMkWEXMlJQ7AuvEjXxG9VxmguOkwdMfrG4MUyMO1Dr62kLxg1RfNTJW8rV4

# m1cASB6pYWEnDnMDQ7bWcJL71IWaMMaz5ppeS+8dKthmqxZG/wvYD6aJSgJRV0E8

# QThOl8dRMm1njmahXk2fNSKv1Wq3f0BfaDXMafrxBfDqhabqMoXLwcHKg2lFSQbc

# CWy6SWUZjPm3NyeMZJ414+Xs5wegnahyvG+FOiymFk49nM8I5oL1RH0owL2JrWwv

# 3C94eRHXHHBL3Z0ITF4u+o29p91j9n/wUjGEbjrY2VyFRJ5jBmnQhlh4iZuHu1gc

# pChsxv5pCpwerBFgal7JaWUu7UMtafF4tzstNfKqT+If4wFvkEaq1agNBFegtKzj

# bb2dGyiAJ0bH2qpnlfHRh3vHyCXphAyPiTbSvjPhhcAz1aA8GYuvOPLlk4C/xsOr

# e5PEPZ257kV2wNRobzBePLQ2+ddFQuASBoDbpSH85wV6KI20jmB798i1SkesFGaX

# oFppcjFXa1OEzWG6cwcVcDt7AfynP4wtPYeM+wjX5S8Xg36Cq08J8inhflV3ZZQF

# HVnUCt2TfuMUXeK7AgMBAAGjggErMIIBJzASBgNVHRMBAf8ECDAGAQH/AgEAMB0G

# A1UdDgQWBBTOiU+CUaoVooRiyjEjYdJh+/j+eDAfBgNVHSMEGDAWgBSCutY9l86f

# z3Hokjev/bO1aTVXzzAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6

# Ly9vY3NwLmVudHJ1c3QubmV0MDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly9jcmwu

# ZW50cnVzdC5uZXQvY3NicjEuY3JsMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAK

# BggrBgEFBQcDAzBEBgNVHSAEPTA7MDAGBFUdIAAwKDAmBggrBgEFBQcCARYaaHR0

# cDovL3d3dy5lbnRydXN0Lm5ldC9ycGEwBwYFZ4EMAQMwDQYJKoZIhvcNAQENBQAD

# ggIBAD4AVLgq849mr2EWxFiTZPRBi2RVjRs1M6GbkdirRsqrX7y+fnDk0tcHqJYH

# 14bRVwoI0NB4Tfgq37IE85rh13zwwQB6wUCh34qMt8u0HQFh8piapt24gwXKqSwW

# 3JwtDv6nl+RQqZeVwUsqjFHjxALga3w1TVO8S5QTi1MYFl6mCqe4NMFssess5DF9

# DCzGfOGkVugtdtWyE3XqgwCuAHfGb6k97mMUgVAW/FtPEhkOWw+N6kvOBkyJS64g

# zI5HpnXWZe4vMOhdNI8fgk1cQqbyFExQIJwJonQkXDnYiTKFPK+M5Wqe5gQ6pRP/

# qh3NR0suAgW0ao/rhU+B7wrbfZ8pj6XCP1I4UkGVO7w+W1QwQiMJY95QjYk1Rfqr

# uA+Poq17ehGT8Y8ohHtoeUdq6GQpTR/0HS9tHsiUhjzTWpl6a3yrNfcrOUtPuT8W

# ku8pjI2rrAEazHFEOctAPiASzghw40f+3IDXCADRC2rqIbV5ZhfpaqpW3c0VeLED

# wBStPkcYde0KU0syk83/gLGQ1hPl5EF4Iu1BguUO37DOlSFF5osB0xn39CtVrNlW

# c2MQ4LigbctUlpigmSFRBqqmDDorY8t52kO50hLM3o9VeukJ8+Ka0yXBezaS2uDl

# UmfN4+ZUCqWd1HOj0y9dBmSFA3d/YNjCvHTJlZFot7d+YRl1MIIGrjCCBJagAwIB

# AgIQBzY3tyRUfNhHrP0oZipeWzANBgkqhkiG9w0BAQsFADBiMQswCQYDVQQGEwJV

# UzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQu

# Y29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQwHhcNMjIwMzIz

# MDAwMDAwWhcNMzcwMzIyMjM1OTU5WjBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMO

# RGlnaUNlcnQsIEluYy4xOzA5BgNVBAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNB

# NDA5NiBTSEEyNTYgVGltZVN0YW1waW5nIENBMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEAxoY1BkmzwT1ySVFVxyUDxPKRN6mXUaHW0oPRnkyibaCwzIP5

# WvYRoUQVQl+kiPNo+n3znIkLf50fng8zH1ATCyZzlm34V6gCff1DtITaEfFzsbPu

# K4CEiiIY3+vaPcQXf6sZKz5C3GeO6lE98NZW1OcoLevTsbV15x8GZY2UKdPZ7Gnf

# 2ZCHRgB720RBidx8ald68Dd5n12sy+iEZLRS8nZH92GDGd1ftFQLIWhuNyG7QKxf

# st5Kfc71ORJn7w6lY2zkpsUdzTYNXNXmG6jBZHRAp8ByxbpOH7G1WE15/tePc5Os

# LDnipUjW8LAxE6lXKZYnLvWHpo9OdhVVJnCYJn+gGkcgQ+NDY4B7dW4nJZCYOjgR

# s/b2nuY7W+yB3iIU2YIqx5K/oN7jPqJz+ucfWmyU8lKVEStYdEAoq3NDzt9KoRxr

# OMUp88qqlnNCaJ+2RrOdOqPVA+C/8KI8ykLcGEh/FDTP0kyr75s9/g64ZCr6dSgk

# Qe1CvwWcZklSUPRR8zZJTYsg0ixXNXkrqPNFYLwjjVj33GHek/45wPmyMKVM1+mY

# Slg+0wOI/rOP015LdhJRk8mMDDtbiiKowSYI+RQQEgN9XyO7ZONj4KbhPvbCdLI/

# Hgl27KtdRnXiYKNYCQEoAA6EVO7O6V3IXjASvUaetdN2udIOa5kM0jO0zbECAwEA

# AaOCAV0wggFZMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLoW2W1NhS9z

# KXaaL3WMaiCPnshvMB8GA1UdIwQYMBaAFOzX44LScV1kTN8uZz/nupiuHA9PMA4G

# A1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDCDB3BggrBgEFBQcBAQRr

# MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEF

# BQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3Rl

# ZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNl

# cnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcmwwIAYDVR0gBBkwFzAIBgZn

# gQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEBCwUAA4ICAQB9WY7Ak7ZvmKlE

# IgF+ZtbYIULhsBguEE0TzzBTzr8Y+8dQXeJLKftwig2qKWn8acHPHQfpPmDI2Avl

# XFvXbYf6hCAlNDFnzbYSlm/EUExiHQwIgqgWvalWzxVzjQEiJc6VaT9Hd/tydBTX

# /6tPiix6q4XNQ1/tYLaqT5Fmniye4Iqs5f2MvGQmh2ySvZ180HAKfO+ovHVPulr3

# qRCyXen/KFSJ8NWKcXZl2szwcqMj+sAngkSumScbqyQeJsG33irr9p6xeZmBo1aG

# qwpFyd/EjaDnmPv7pp1yr8THwcFqcdnGE4AJxLafzYeHJLtPo0m5d2aR8XKc6UsC

# Uqc3fpNTrDsdCEkPlM05et3/JWOZJyw9P2un8WbDQc1PtkCbISFA0LcTJM3cHXg6

# 5J6t5TRxktcma+Q4c6umAU+9Pzt4rUyt+8SVe+0KXzM5h0F4ejjpnOHdI/0dKNPH

# +ejxmF/7K9h+8kaddSweJywm228Vex4Ziza4k9Tm8heZWcpw8De/mADfIBZPJ/tg

# ZxahZrrdVcA6KYawmKAr7ZVBtzrVFZgxtGIJDwq9gdkT/r+k0fNX2bwE+oLeMt8E

# ifAAzV3C+dAjfwAL5HYCJtnwZXZCpimHCUcr5n8apIUP/JiW9lVUKx+A+sDyDivl

# 1vupL0QVSucTDh3bNzgaoSv27dZ8/DCCBsYwggSuoAMCAQICEAp6SoieyZlCkAZj

# OE2Gl50wDQYJKoZIhvcNAQELBQAwYzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRp

# Z2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdpQ2VydCBUcnVzdGVkIEc0IFJTQTQw

# OTYgU0hBMjU2IFRpbWVTdGFtcGluZyBDQTAeFw0yMjAzMjkwMDAwMDBaFw0zMzAz

# MTQyMzU5NTlaMEwxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j

# LjEkMCIGA1UEAxMbRGlnaUNlcnQgVGltZXN0YW1wIDIwMjIgLSAyMIICIjANBgkq

# hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuSqWI6ZcvF/WSfAVghj0M+7MXGzj4CUu

# 0jHkPECu+6vE43hdflw26vUljUOjges4Y/k8iGnePNIwUQ0xB7pGbumjS0joiUF/

# DbLW+YTxmD4LvwqEEnFsoWImAdPOw2z9rDt+3Cocqb0wxhbY2rzrsvGD0Z/NCcW5

# QWpFQiNBWvhg02UsPn5evZan8Pyx9PQoz0J5HzvHkwdoaOVENFJfD1De1FksRHTA

# MkcZW+KYLo/Qyj//xmfPPJOVToTpdhiYmREUxSsMoDPbTSSF6IKU4S8D7n+FAsmG

# 4dUYFLcERfPgOL2ivXpxmOwV5/0u7NKbAIqsHY07gGj+0FmYJs7g7a5/KC7CnuAL

# S8gI0TK7g/ojPNn/0oy790Mj3+fDWgVifnAs5SuyPWPqyK6BIGtDich+X7Aa3Rm9

# n3RBCq+5jgnTdKEvsFR2wZBPlOyGYf/bES+SAzDOMLeLD11Es0MdI1DNkdcvnfv8

# zbHBp8QOxO9APhk6AtQxqWmgSfl14ZvoaORqDI/r5LEhe4ZnWH5/H+gr5BSyFtaB

# ocraMJBr7m91wLA2JrIIO/+9vn9sExjfxm2keUmti39hhwVo99Rw40KV6J67m0uy

# 4rZBPeevpxooya1hsKBBGBlO7UebYZXtPgthWuo+epiSUc0/yUTngIspQnL3ebLd

# hOon7v59emsCAwEAAaOCAYswggGHMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8E

# AjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMCAGA1UdIAQZMBcwCAYGZ4EMAQQC

# MAsGCWCGSAGG/WwHATAfBgNVHSMEGDAWgBS6FtltTYUvcyl2mi91jGogj57IbzAd

# BgNVHQ4EFgQUjWS3iSH+VlhEhGGn6m8cNo/drw0wWgYDVR0fBFMwUTBPoE2gS4ZJ

# aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5

# NlNIQTI1NlRpbWVTdGFtcGluZ0NBLmNybDCBkAYIKwYBBQUHAQEEgYMwgYAwJAYI

# KwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBYBggrBgEFBQcwAoZM

# aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNB

# NDA5NlNIQTI1NlRpbWVTdGFtcGluZ0NBLmNydDANBgkqhkiG9w0BAQsFAAOCAgEA

# DS0jdKbR9fjqS5k/AeT2DOSvFp3Zs4yXgimcQ28BLas4tXARv4QZiz9d5YZPvpM6

# 3io5WjlO2IRZpbwbmKrobO/RSGkZOFvPiTkdcHDZTt8jImzV3/ZZy6HC6kx2yqHc

# oSuWuJtVqRprfdH1AglPgtalc4jEmIDf7kmVt7PMxafuDuHvHjiKn+8RyTFKWLbf

# OHzL+lz35FO/bgp8ftfemNUpZYkPopzAZfQBImXH6l50pls1klB89Bemh2RPPkaJ

# FmMga8vye9A140pwSKm25x1gvQQiFSVwBnKpRDtpRxHT7unHoD5PELkwNuTzqmkJ

# qIt+ZKJllBH7bjLx9bs4rc3AkxHVMnhKSzcqTPNc3LaFwLtwMFV41pj+VG1/calI

# GnjdRncuG3rAM4r4SiiMEqhzzy350yPynhngDZQooOvbGlGglYKOKGukzp123qlz

# qkhqWUOuX+r4DwZCnd8GaJb+KqB0W2Nm3mssuHiqTXBt8CzxBxV+NbTmtQyimaXX

# FWs1DoXW4CzM4AwkuHxSCx6ZfO/IyMWMWGmvqz3hz8x9Fa4Uv4px38qXsdhH6hyF

# 4EVOEhwUKVjMb9N/y77BDkpvIJyu2XMyWQjnLZKhGhH+MpimXSuX4IvTnMxttQ2u

# R2M4RxdbbxPaahBuH0m3RFu0CAqHWlkEdhGhp3cCExwwggbzMIIE26ADAgECAhAW

# dy8OxRnHb5IdXyBiye3RMA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNVBAYTAlVTMRYw

# FAYDVQQKEw1FbnRydXN0LCBJbmMuMTwwOgYDVQQDEzNFbnRydXN0IEV4dGVuZGVk

# IFZhbGlkYXRpb24gQ29kZSBTaWduaW5nIENBIC0gRVZDUzIwHhcNMjIwMzI5MjAx

# ODAzWhcNMjMwMzI5MjAxODAzWjCBozELMAkGA1UEBhMCQ0ExEDAOBgNVBAgTB09u

# dGFyaW8xDzANBgNVBAcTBk90dGF3YTETMBEGCysGAQQBgjc8AgEDEwJDQTEUMBIG

# A1UEChMLQ0FOQVJJRSBJTkMxHTAbBgNVBA8TFFByaXZhdGUgT3JnYW5pemF0aW9u

# MREwDwYDVQQFEwgyOTAyMDgtNzEUMBIGA1UEAxMLQ0FOQVJJRSBJTkMwggIiMA0G

# CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC7QrVGr/0GFSjOKBtAIfg420mYYBts

# T/eqfZigZeS4ZW6sykAZBX71qiU+1SqfMpfU+GY2oQAvGGq/1kBaKTukhT+wwEAH

# 90wJeaMSzAhpl9Q8vSx0xRfXmKfxGG8cn6kuq9DZb9kKeKP2qWSFPJyS2y0F5pVh

# Sp8hDvZxAeAKNAjoTDip55kMJm14/CkqU2biZ35prXMDMh7/29YWuFWX55zKOxEf

# VWbbsRKGladcYtKXu1oqSh0XEhhFB1BLXBw1YdN2RgjXAIMxrsvNjQ7q8ZWHEMrg

# vA/50X59x9vxQLS4ivT8RRLic+EW6BMoQ7tqlUwedFSLRsGRxs+7tLwt0FYjQQEY

# ZEbqUpLCcrdco9QEWSI/xaY4sl7FS/F6HdISYpyeBlKjcsHVy5Cj7azh8UXVZYa4

# k+AeEseIB21/MQpynet1S1EuifGHMs0Zh8axQAbJ+rDlupWsRiO63WTAPt5OsL/u

# EH20xZ/50m8sidF9tIZ1QrsLq8JFi99Zm+OncY3ysG2mQAgcsz3x7254Q2mHOSuD

# WKDDXx6VCZ7ihmAEtnUbL1rCngdf4evV71tVyhf+4KTebjk03t6mpqYvjO3W7yuO

# bH8NOVaAcYgOjUi0G9AN/vYwBZHfBAhikGO8pKxW6U/Krc2oQWaKpmGzKK1OpSVi

# 5VZuB6has6Mm3wIDAQABo4IBYDCCAVwwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU

# EB15NHKwwcMjbBDrbk8UA+4uHyswHwYDVR0jBBgwFoAUzolPglGqFaKEYsoxI2HS

# Yfv4/ngwZwYIKwYBBQUHAQEEWzBZMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5l

# bnRydXN0Lm5ldDAyBggrBgEFBQcwAoYmaHR0cDovL2FpYS5lbnRydXN0Lm5ldC9l

# dmNzMi1jaGFpbi5wN2MwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovL2NybC5lbnRy

# dXN0Lm5ldC9ldmNzMi5jcmwwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG

# AQUFBwMDMEsGA1UdIAREMEIwNwYKYIZIAYb6bAoBAjApMCcGCCsGAQUFBwIBFhto

# dHRwczovL3d3dy5lbnRydXN0Lm5ldC9ycGEwBwYFZ4EMAQMwDQYJKoZIhvcNAQEL

# BQADggIBAIXuiHbQsWUCEhlA76KAYJCAbtiCXDerGtT1z27L+7/TcVUBOv2luPJ9

# C9qXVuQIwa0CTYNQ/kDKSkhWCJxivk4OPaGi5yONchUlHsLQFXQOLDvSFbIYjeUv

# LAvOp30NgLyy7/Sw3SQsiSKmuLrKfSbNTqj0Lf48W+TQk5YD0TzDSSQG8+J4oVfY

# yyFxoo4C9kAoh7gTjwtj01p5QLKeLYJG5lpH6EomLDftK9Pe0woz46smPdL+d9df

# vA51O3jS/xHt4kBpqWcWOZ2C5ZGxydU6Ru+U7NVlHATRzAM/dxGJGqFCeTs1CpQF

# 9vykl8iiSpPjzJ+CdrJbQ8gA0kCa+G7CagqQ3bkSMvRQllexC5HW6CiUKc8rJfZs

# CGOpEqtrfuxbiUUZ2og8BOliaFHKZENurT73LtMNygx+yMcbaJkpfEheDJuGK82a

# vSh9HFkyuJD3MI2MafN2OtyXyO/MsseiqHwpcRdwDZr0mkOrN9y1YOo62BYRVDVU

# ep9X5lQ/MEA9c6iMgrQ4/E8kk4JoLC7pe21qAP1ICIbjS7g5t4cbPfeFBtvSZeMA

# NKmlDXQkedoGOOnOxqCuhxc3a0LXB746Q/VF6hookZlTqDXuu6aeIdD3tpLt0Dx8

# D69FY2Si/eMdn6dKDsT7CXYFve0S1DDwrqhTIXI9wPojPbu8ZXPzMYIGTTCCBkkC

# AQEwdzBjMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE8MDoG

# A1UEAxMzRW50cnVzdCBFeHRlbmRlZCBWYWxpZGF0aW9uIENvZGUgU2lnbmluZyBD

# QSAtIEVWQ1MyAhAWdy8OxRnHb5IdXyBiye3RMA0GCWCGSAFlAwQCAQUAoIGEMBgG

# CisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcC

# AQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIE

# ICVXUHcC72fM6NCwt7rv6NQBAyrHQcHwZnCh7flmcKizMA0GCSqGSIb3DQEBAQUA

# BIICAHAUq7t93/ClYeUJuuD8moEhyF7PGNUR7ypnipflWNF0KOKavcpUU3F5BvUb

# 2K6IFCY1ly1eKCKEbSXN1IZbClZzDFf6TM6FGwyoIKcuaPtSceRd2/iSm6g9I21k

# 6fOia2OkHreJJhZ60dR5X4FWupJpQz9XbWXIR6OsBW6lLq8eTLbv9yqJA4F1oHOt

# jzb/9CK620nB3xRVBIf4REqQDN27Dy+hzCFC9blgAsfJv4M/zNI6qXT+bNldL96G

# nu1LFErxMzZyYyvlQpUbj4PhgNo6fL61BaKVfa7w3Z7tWVvdJIYnE1n3bMP9GAg/

# W5I5IcurbiEeILDi/2M+7Io8ObZmdEp0SzLbcMSFiiqfxp+VDo0EvWfLpgYwOQtx

# Um7VfZ2b1A60Z/mst851gVTrsuxY7F5sXCOFiCcrXNJy/wjjw8SI0H1Bdtu7NXAb

# snv+3vkSZ8nbZopTHYyyblXWvWYRB7lHggZ+hu4I8Btkfn1ejejjH69mMCAa9guo

# +qFBP4Cl7dYJt5H2LzuhApwKezXo/ccKXW18ESOa7w9fc02d1tOx/LQhegWEOQ+W

# 5y8OJO5wzRaTvpxkyCJHqgtqmjT6YWL603zr/2YxES0s/dWvTj1iy5f86QymvnM6

# EhH0fqwUuroDjY19PuS7Bscn6T56Roude3VWfn2wsJsvyF2OoYIDIDCCAxwGCSqG

# SIb3DQEJBjGCAw0wggMJAgEBMHcwYzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRp

# Z2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdpQ2VydCBUcnVzdGVkIEc0IFJTQTQw

# OTYgU0hBMjU2IFRpbWVTdGFtcGluZyBDQQIQCnpKiJ7JmUKQBmM4TYaXnTANBglg

# hkgBZQMEAgEFAKBpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN

# AQkFMQ8XDTIyMDUxOTE1NDYxNVowLwYJKoZIhvcNAQkEMSIEIGchUQXHGldRUoYF

# hn5T70Z7R0D4W4H8qPAoPlS9eqAtMA0GCSqGSIb3DQEBAQUABIICAFB0Vt50/Quf

# 3DSqy/SDC6o+Lw+NJ3B88n5RljKGg2qDrMABalb4RuOUVNCAx9gAuJOAblcYCRGn

# AxiT3e20mX7XbTqRlI83fyoY7zPKWxNzBdjtiAOdGq1CSAuRegakQEbaH04hRBFX

# f9vTvtcEcJKZF512VaJy6I4yFg7cFYc9gela21Ds5rUFZPajFUMmjCAxvQ798Puj

# Vme8hrPPnAWQry0msd1AsM7qupDYifr5YugIKWm5r+kvdj+5DnVL03el8ZN5TUM+

# 4aH0j4jQcw0gLkVTZ6KkViVHtONANZsoOSPhQleANW7Ok/ov1jD3nRpDEDhkOKF6

# hbSUoYg5r3EzpdgyZPg6rZIsqI+D94WlR9vfJbip70lVK3MIJhft3Zjgiznq2KxR

# LECJHvtc+z62uxmEThGGza16jsf8i+hfxKoZfslqAsClpvRvK1oAxpbv+D0aT/sW

# QBtlu7iS9kQTEzEFrtIEBOhGNlYsk680ek26x67MirpHF14yPiCYiKukc630StMP

# jyAQ7M/3o7KaE02JJQvPrkYSSLwRCnvvrhKA31TYjKK8cBzsz+RId1K9eXdH0IEy

# xmL8VqFsMgyG9cMUdGyquG/20FjEn3dLgVXO2a5Dbi/2oEzoagw07Qm2/nXgta8b

# CNv57+OmztiH79rTrNJatqqe++g9HyOV

# SIG # End signature block