Public/Reportings/New-EntraOpsAccessPackageFlowData.ps1
|
<# .SYNOPSIS Generate live Microsoft Graph enrichment data for the Access Package Flow report. .DESCRIPTION Recovers information omitted by Tenant Governance snapshots: groupMembers user-set IDs, access package resource-role scopes, and current package assignments. The generated data is merged with the snapshot-only Configuration Analyzer dataset by the static report. #> function New-EntraOpsAccessPackageFlowData { [CmdletBinding(SupportsShouldProcess = $true)] param ( [Parameter(Mandatory = $false)] [System.String]$RepoRoot, [Parameter(Mandatory = $false)] [System.String]$SnapshotPath, [Parameter(Mandatory = $false)] [System.String]$AppRoot, [Parameter(Mandatory = $false)] [System.String]$OutFile, [Parameter(Mandatory = $false)] [System.Nullable[bool]]$ResolveRequestorApproverTiers, [Parameter(Mandatory = $false)] [switch]$PassThru ) $ModuleRoot = $MyInvocation.MyCommand.Module.ModuleBase if ([string]::IsNullOrWhiteSpace($ModuleRoot) -and -not [string]::IsNullOrWhiteSpace($PSScriptRoot)) { $ModuleRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot) } if ([string]::IsNullOrWhiteSpace($ModuleRoot)) { throw "Unable to resolve the EntraOps module location. Import the module with 'Import-Module <path-to-EntraOps> -Force' and try again." } $RepositoryRoot = Split-Path -Parent $ModuleRoot if ([string]::IsNullOrWhiteSpace($RepoRoot)) { $RepoRoot = $RepositoryRoot } if ([string]::IsNullOrWhiteSpace($SnapshotPath)) { $SnapshotPath = Join-Path $RepoRoot 'TenantGovernance/Snapshots' } if ([string]::IsNullOrWhiteSpace($AppRoot)) { $AppRoot = Join-Path $RepoRoot 'Reports/AccessPackageFlow' } if ([string]::IsNullOrWhiteSpace($OutFile)) { $OutFile = Join-Path $AppRoot 'data/access-package-assignments-data.js' } if (-not (Test-Path -LiteralPath $SnapshotPath -PathType Container)) { throw "Tenant Governance snapshot folder not found: $SnapshotPath. Run a successful Save-EntraOpsTenantGovernanceSnapshotJson capture first." } if (-not $PSBoundParameters.ContainsKey('ResolveRequestorApproverTiers')) { $ResolveRequestorApproverTiers = $true $ConfigFilePath = Join-Path $RepoRoot 'EntraOpsConfig.json' if (Test-Path -LiteralPath $ConfigFilePath -PathType Leaf) { try { $Config = Get-Content -LiteralPath $ConfigFilePath -Raw | ConvertFrom-Json if ($null -ne $Config.ConfigurationAnalyzer -and $null -ne $Config.ConfigurationAnalyzer.ResolveGroupMembersForPrivilegedAssets) { $ResolveRequestorApproverTiers = [bool]$Config.ConfigurationAnalyzer.ResolveGroupMembersForPrivilegedAssets } } catch { Write-Warning "Failed to read ConfigurationAnalyzer settings from ${ConfigFilePath}: $($_.Exception.Message). Group tier resolution remains enabled." } } } $PolicyIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) foreach ($SnapshotFile in @(Get-ChildItem -LiteralPath $SnapshotPath -Recurse -File -Filter '*.json' | Where-Object { $_.Name -notmatch '^\.' })) { try { $SnapshotResource = Get-Content -LiteralPath $SnapshotFile.FullName -Raw | ConvertFrom-Json -AsHashtable if ("$($SnapshotResource.resourceType)".ToLowerInvariant() -ne 'microsoft.entra.entitlementmanagementaccesspackageassignmentpolicy') { continue } $PolicyId = "$($SnapshotResource.properties.Id)" if (-not [string]::IsNullOrWhiteSpace($PolicyId)) { [void]$PolicyIds.Add($PolicyId) } } catch { Write-Verbose "Skipped unreadable snapshot resource $($SnapshotFile.FullName): $($_.Exception.Message)" } } # Rank values are purely relational (comparisons/sorting) - canonical Enterprise Access Model # order: ControlPlane < ManagementPlane < WorkloadPlane < UserAccess. $TierRank = @{ ControlPlane = 0; ManagementPlane = 1; WorkloadPlane = 2; UserAccess = 3 } $TierByObjectId = @{} if ($ResolveRequestorApproverTiers) { $PrivilegedEamPath = Join-Path $RepoRoot 'PrivilegedEAM' if (Test-Path -LiteralPath $PrivilegedEamPath -PathType Container) { $PrivilegedEamObjects = @(Get-EntraOpsPrivilegedEamDashboardObjects -ImportPath $PrivilegedEamPath) foreach ($Object in $PrivilegedEamObjects) { $ObjectId = "$($Object.objectId)" if (-not $ObjectId) { continue } $ObjectTierNames = @("$($Object.objectAdminTierLevelName)") + @($Object.classification | ForEach-Object { "$($_.adminTierLevelName)" }) + @($Object.roleAssignments | ForEach-Object { $_.classification } | ForEach-Object { "$($_.adminTierLevelName)" }) foreach ($TierName in $ObjectTierNames | Where-Object { $TierRank.ContainsKey($_) }) { if (-not $TierByObjectId.ContainsKey($ObjectId) -or $TierRank[$TierName] -lt $TierRank[$TierByObjectId[$ObjectId]]) { $TierByObjectId[$ObjectId] = $TierName } } } } else { Write-Warning "Group tier resolution was requested, but the Privileged EAM export was not found at $PrivilegedEamPath." } } $PolicyRequestorApprovers = [ordered]@{} $PackageIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) $GroupIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) foreach ($PolicyId in $PolicyIds) { try { $Policy = Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackageAssignmentPolicies/$PolicyId" -OutputType PSObject -ThrowOnFailure if ($null -eq $Policy) { continue } $Requestors = @($Policy.requestorSettings.allowedRequestors) $Approvers = @($Policy.requestApprovalSettings.approvalStages | ForEach-Object { $_.primaryApprovers }) $PolicyRequestorApprovers[$PolicyId] = [ordered]@{ accessPackageId = "$($Policy.accessPackageId)" scopeType = "$($Policy.requestorSettings.scopeType)" requestors = $Requestors approvers = $Approvers } if ($Policy.accessPackageId) { [void]$PackageIds.Add("$($Policy.accessPackageId)") } foreach ($UserSet in @($Requestors) + @($Approvers)) { if ("$($UserSet.'@odata.type')" -eq '#microsoft.graph.groupMembers' -and $UserSet.id) { [void]$GroupIds.Add("$($UserSet.id)") } } } catch { Write-Warning "Could not resolve access package assignment policy ${PolicyId}: $($_.Exception.Message)" } } $Packages = [ordered]@{} $Assignments = [System.Collections.Generic.List[object]]::new() $CatalogResourcesByCatalogId = @{} $CatalogNamesById = @{} foreach ($PackageId in $PackageIds) { try { $Package = Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackages/$PackageId" -OutputType PSObject -ThrowOnFailure $CatalogId = "$($Package.catalogId)" if ($CatalogId -and -not $CatalogNamesById.ContainsKey($CatalogId)) { try { $Catalog = Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackageCatalogs/${CatalogId}?`$select=id,displayName" -OutputType PSObject -ThrowOnFailure $CatalogNamesById[$CatalogId] = "$($Catalog.displayName)" } catch { Write-Warning "Could not resolve access package catalog ${CatalogId}: $($_.Exception.Message)" $CatalogNamesById[$CatalogId] = '' } } if ($CatalogId -and -not $CatalogResourcesByCatalogId.ContainsKey($CatalogId)) { $CatalogResourcesByOriginId = @{} try { $CatalogResources = @(Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackageCatalogs/${CatalogId}/accessPackageResources?`$select=id,displayName,resourceType,originId,originSystem" -OutputType PSObject -ThrowOnFailure) foreach ($CatalogResource in $CatalogResources | Where-Object { $_.originId }) { $CatalogResourcesByOriginId["$($CatalogResource.originId)"] = $CatalogResource } } catch { Write-Warning "Could not resolve catalog resources for access package catalog ${CatalogId}: $($_.Exception.Message)" } $CatalogResourcesByCatalogId[$CatalogId] = $CatalogResourcesByOriginId } $ResourceRoleScopes = @() try { $HydratedPackage = Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackages/${PackageId}?`$expand=accessPackageResourceRoleScopes(`$expand=accessPackageResourceRole,accessPackageResourceScope)" -OutputType PSObject -ThrowOnFailure $ResourceRoleScopes = @($HydratedPackage.accessPackageResourceRoleScopes) } catch { Write-Verbose "Nested access package scope expansion failed for ${PackageId}; querying the resource-role-scope collection instead." $ResourceRoleScopes = @(Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackages/${PackageId}/accessPackageResourceRoleScopes?`$expand=accessPackageResourceRole,accessPackageResourceScope" -OutputType PSObject -ThrowOnFailure) } $Targets = @( foreach ($Scope in $ResourceRoleScopes) { $ResourceScope = $Scope.accessPackageResourceScope $ResourceRole = $Scope.accessPackageResourceRole $OriginId = "$($ResourceScope.originId)" $CatalogResource = if ($CatalogId -and $CatalogResourcesByCatalogId.ContainsKey($CatalogId)) { $CatalogResourcesByCatalogId[$CatalogId][$OriginId] } else { $null } $ResourceDisplayName = "$($CatalogResource.displayName)" if (-not $ResourceDisplayName) { $ResourceDisplayName = "$($ResourceScope.displayName)" } if ("$($ResourceScope.originSystem)" -eq 'AadGroup' -and $OriginId) { [void]$GroupIds.Add($OriginId) } [ordered]@{ originId = $OriginId displayName = $ResourceDisplayName role = "$($ResourceRole.displayName)" roleOriginId = "$($ResourceRole.originId)" originSystem = "$($ResourceScope.originSystem)" resourceType = if ($CatalogResource.resourceType) { "$($CatalogResource.resourceType)" } else { "$($ResourceScope.originSystem)" } } } ) $Packages[$PackageId] = [ordered]@{ displayName = "$($Package.displayName)" catalogId = $CatalogId catalogName = if ($CatalogId) { "$($CatalogNamesById[$CatalogId])" } else { '' } targets = $Targets } try { $PackageAssignments = @(Invoke-EntraOpsMsGraphQuery -Uri "/beta/identityGovernance/entitlementManagement/accessPackageAssignments?`$filter=accessPackageId eq '${PackageId}'&`$expand=target" -OutputType PSObject -ThrowOnFailure) foreach ($Assignment in $PackageAssignments) { $Target = $Assignment.target $Assignments.Add([ordered]@{ id = "$($Assignment.id)" accessPackageId = "$($Assignment.accessPackageId)" assignmentPolicyId = "$($Assignment.assignmentPolicyId)" state = "$($Assignment.state)" status = "$($Assignment.status)" target = [ordered]@{ objectId = "$($Target.objectId)" displayName = "$($Target.displayName)" principalName = "$($Target.principalName)" subjectType = "$($Target.subjectType)" } }) } } catch { Write-Warning "Could not resolve current assignments for access package ${PackageId}: $($_.Exception.Message)" } } catch { Write-Warning "Could not resolve access package ${PackageId}: $($_.Exception.Message)" } } if ($ResolveRequestorApproverTiers -and (Test-Path -LiteralPath $PrivilegedEamPath -PathType Container)) { try { $ScopeClassifications = @(Get-EntraOpsIdGovScopeClassification -EntraOpsEamFolder $PrivilegedEamPath) foreach ($ScopeClassification in $ScopeClassifications | Where-Object { $_.ScopeType -eq 'AccessPackage' -and $_.ScopeId -match '^/AccessPackage/' }) { $ClassifiedPackageId = "$($ScopeClassification.ScopeId)" -replace '^/AccessPackage/', '' if (-not $Packages.Contains($ClassifiedPackageId)) { continue } foreach ($Target in @($Packages[$ClassifiedPackageId].targets)) { $MatchedDetails = @($ScopeClassification.ClassifiedResources | Where-Object { ($Target.originId -and "$($_.ResourceId)" -ieq "$($Target.originId)") -or ($Target.roleOriginId -and "$($_.ResourceId)" -ieq "$($Target.roleOriginId)") }) if ($MatchedDetails.Count -eq 0) { continue } $BestTier = @($MatchedDetails.EAMTier | Where-Object { $TierRank.ContainsKey("$_") } | Sort-Object { $TierRank["$_"] } | Select-Object -First 1)[0] if (-not $BestTier) { continue } $Target['tierName'] = "$BestTier" $Target['classificationReason'] = @($MatchedDetails | Where-Object { "$($_.EAMTier)" -eq "$BestTier" } | ForEach-Object { "$($_.Reason)" } | Select-Object -Unique) -join '; ' } } } catch { Write-Warning "Could not resolve access package target classifications: $($_.Exception.Message)" } } $ResolvedGroupTiers = [ordered]@{} if ($ResolveRequestorApproverTiers) { foreach ($GroupId in $GroupIds) { try { $Group = Invoke-EntraOpsMsGraphQuery -Uri "/v1.0/groups/${GroupId}?`$select=id,displayName" -OutputType PSObject -ThrowOnFailure $Members = @(Get-EntraOpsPrivilegedTransitiveGroupMember -GroupObjectId $GroupId | Where-Object { $null -ne $_ }) $PrivilegedMembers = @($Members | Where-Object { $TierByObjectId.ContainsKey("$($_.Id)") }) $BestTier = @($PrivilegedMembers | ForEach-Object { $TierByObjectId["$($_.Id)"] } | Sort-Object { $TierRank[$_] } | Select-Object -First 1)[0] if (-not $BestTier) { $BestTier = 'UserAccess' } $MemberTiers = @( foreach ($Member in $Members) { if (-not $Member.Id) { continue } [ordered]@{ id = "$($Member.Id)" displayName = "$($Member.DisplayName)" tierName = if ($TierByObjectId.ContainsKey("$($Member.Id)")) { $TierByObjectId["$($Member.Id)"] } else { 'UserAccess' } } } ) $ResolvedGroupTiers[$GroupId] = [ordered]@{ tierName = $BestTier displayName = "$($Group.displayName)" totalMembers = $Members.Count privilegedMemberCount = $PrivilegedMembers.Count members = $MemberTiers } } catch { Write-Warning "Could not resolve transitive members of access package group ${GroupId}: $($_.Exception.Message)" } } } $Payload = [ordered]@{ generatedAt = (Get-Date).ToUniversalTime().ToString('o') policyRequestorApprovers = $PolicyRequestorApprovers packages = $Packages resolvedGroupTiers = $ResolvedGroupTiers assignments = @($Assignments) } $Content = "// Auto-generated by New-EntraOpsAccessPackageFlowData - do not edit by hand.`nwindow.ENTRAOPS_ACCESSPACKAGE_ASSIGNMENTS = $($Payload | ConvertTo-Json -Depth 20 -Compress);`n" if ($PSCmdlet.ShouldProcess($OutFile, 'Write Access Package Flow enrichment dataset')) { Save-EntraOpsReportDataFile -Content $Content -LiteralPath $OutFile } if ($PassThru) { [pscustomobject]$Payload } } # SIG # Begin signature block # MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDUqgunmS98h/Lx # /xPlC4l4NKQa8icA/K4C3g4bzccTyqCCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j # AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK # ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy # dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l # dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG # A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl # BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb # Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC # Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC # 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va # qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ # 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet # /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe # GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV # WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl # s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb # MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc # noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl # jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA # AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8 # +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud # DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w # bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v # c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np # dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG # CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM # BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1 # BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR # mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl # lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs # NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv # n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC # XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB # c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp # Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ # MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ # BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy # MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt # MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A # DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg # HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet # 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr # onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl # 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc # 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt # 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9 # cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM # BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu # Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr # BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB # BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy # MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH # MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3 # AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG # A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF # AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1 # DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea # P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN # F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk # 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs # thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x # GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr # z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo # qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR # qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc # w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD # AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT # AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT # G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z # NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0 # YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO # STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF # snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw # NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9 # eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O # E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP # +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8 # MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx # cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm # x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J # qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he # Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI # KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj # YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC # MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv # Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E # BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O # BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb # rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L # xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL # RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z # J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY # Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj # vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT # j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT # j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb # aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy # g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz # pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK # JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG # A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt # IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl # ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW # MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu # MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG # SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r # Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52 # NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q # gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX # IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx # F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj # zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad # PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t # 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl # ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK # mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH # mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU # 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc # ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud # HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI # KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0 # dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv # Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0 # cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q # KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3 # Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL # qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY # zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb # QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI # P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS # WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/ # DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8 # X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh # o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q # EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO # S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE # ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl # cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO # ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw # CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw # IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3 # DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4 # YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W # ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz # Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv # 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x # 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg # WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a # cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf # SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg # zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV # ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z # EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC # L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6 # Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp # MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB # BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru # Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov # L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH # CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli # G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f # KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee # hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4 # FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9 # sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E # hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh # oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf # 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF # 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA # Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC # UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb # Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G # CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI # hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC # ARUwLwYJKoZIhvcNAQkEMSIEIOmOoPpP2cyJJDOJt0uyAadigVSsLFlIr39d+Snr # dGXvMA0GCSqGSIb3DQEBAQUABIIBgBc3YxoWA0NCACTz5BPfkbo/bU0MS1fGcsdq # KYHzvrTpO1M3RBv8Ei8pm9k4lYdqeYDvt5VZregX08s+Id9r00Xn8ODTsrsdAnvv # C0MNEdhHhUe0PuL5bQWdoGH0HqxkwTZkLDytflN2GxMkGbTuRQVdAUSA3IvTJTPa # Lh1XkakdKislxdBW5bo8IM1BfAx7zG9JQwZqzl1bvyQ3YEMhzUwdfAyd87irhj3R # EU8NxVAazpVe8MFPT4gRpnUBAxSteF+1WdwFf9Vu0TUhhCpf6j5y0zyR6CF6kaAH # 3KynrpEGzIIpZOGI196pO+nnaDGE4+rNedrwePH/zy4yyB1GxAMzeoxcvEesa3O0 # DoLxeNoygE46XhruiWLUtQS20qloA21etPUtoQ4vDk/9DtGxjGbZbadpZNCdzwa4 # ObnY11wSz0qiuyAmXa6AWthuqFMbddV1SLgZnIdc7Xv56YdIiAD82Is3kEsthU86 # zq1sggpC9e4SysF8qzXzjxVgWnNGtKGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID # 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0 # ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ # KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD # MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQxNDlaMDcG # CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY # 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDDTbaBy6cqAtgvYDPYZQYFN3sUbxv3ppZHG # Tn4j/K5XTHDrSx5H7qKTStdyjxfp3K0wgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ # MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh # MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0 # dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI # hvcNAQEBBQAEggIAV56RVQ/jcPjwXLfsiPG+jubzRNQPctEEfzDEGMdvsfgX7QG6 # /I/S0CrAaMd3BQGoX0cQmB1AxCFvwGhye3EeRqOTGhUATwM/VtRSqM0bCsBAli6m # 7Ce/XcLFhHVVqbb1FJKEU9Zqt6lnQ0uAcOZkPQfyCUZ3weuVBLWKPQigkuq5wRta # hvjtCuJZJcd9YAHUHh/vTOHdTmBDEyC1z5ivYQv+dwNVK/EH3oU8UBuCkJfafjrQ # IavQ5/zdxLNNb+uXS6XahWWnNAJJ0FxoK/kTPAXfuhVDKh3oPptHb1qtG2YIi5UW # 7C5+SFdDOQKDyBzKIcaOZ8Wf8Om2E47KRaShEoRnhmnIdlhE2yvAGUwHpnzW35Eq # lSYfUsgU+4rBDp6vdSnD4JcnlnISGbVAR2RnoBs5fGb1TlMbQOn7zSAi4tOIJKhb # moacPPR7MOW3KrlFDFL/IsFQ2WjYz/6bF+Nv7pH26BPNJO7nOKPKr+shNXcHKWIo # IVGmnc9/E46d0F58Fu86TzA3OPFpoLGKmoD4mvMsqFbj4usgfx+edH4zNzA7HFrb # NSfdO92IEN3Bq0NXpze6sRz1ZqG9SGwyfFK9xrlri5FXh2NoVZsVBO94VPY+hYa0 # JaU2QsiCG/dWVjufleVj3T5rStWq0YhVUKY9E55+duJFkp74Eg9CCe6gYmY= # SIG # End signature block |