EntraProvisionOnDemand

1.0.2

Public/Connect-EntraProvisioning.ps1

                                function Connect-EntraProvisioning {

    <#

    .SYNOPSIS

        Connects to Microsoft Graph API for Entra provisioning operations.

    .DESCRIPTION

        Authenticates to Microsoft Graph API using either device code flow (interactive),

        client secret, or client certificate. Stores the access token for subsequent

        Graph API calls by other module cmdlets.

    .PARAMETER TenantId

        The Azure AD/Entra ID tenant ID or domain name.

    .PARAMETER ClientId

        Application (client) ID for authentication. If not specified, uses the

        Microsoft Graph PowerShell public client ID for device code flow.

    .PARAMETER ClientSecret

        Client secret for application authentication (client credentials flow).

    .PARAMETER ClientCertificate

        X509 certificate for application authentication.

    .PARAMETER CertificateThumbprint

        Thumbprint of certificate in certificate store for application authentication.

    .PARAMETER Scopes

        OAuth scopes to request. Defaults to required provisioning scopes.

    .PARAMETER DeviceCode

        Use device code flow for interactive authentication (default if no credentials provided).

    .EXAMPLE

        Connect-EntraProvisioning -TenantId "contoso.onmicrosoft.com"

        Connects using device code flow with interactive browser authentication.

    .EXAMPLE

        Connect-EntraProvisioning -TenantId "contoso.onmicrosoft.com" -ClientId "app-id" -ClientSecret $secret

        Connects using client credentials with a secret.

    .EXAMPLE

        Connect-EntraProvisioning -TenantId "contoso.onmicrosoft.com" -ClientId "app-id" -CertificateThumbprint "ABC123"

        Connects using client credentials with a certificate.

    .OUTPUTS

        None. Sets module-scoped authentication context.

    #>

    [CmdletBinding(DefaultParameterSetName = 'DeviceCode')]

    param(

        [Parameter(Mandatory = $true)]

        [string]$TenantId,

        [Parameter(Mandatory = $false)]

        [string]$ClientId,

        [Parameter(Mandatory = $true, ParameterSetName = 'ClientSecret')]

        [SecureString]$ClientSecret,

        [Parameter(Mandatory = $true, ParameterSetName = 'Certificate')]

        [System.Security.Cryptography.X509Certificates.X509Certificate2]$ClientCertificate,

        [Parameter(Mandatory = $true, ParameterSetName = 'CertificateThumbprint')]

        [string]$CertificateThumbprint,

        [Parameter(Mandatory = $false)]

        [string[]]$Scopes,

        [Parameter(Mandatory = $false, ParameterSetName = 'DeviceCode')]

        [switch]$DeviceCode

    )

    # Set default client ID if not specified

    if (-not $ClientId) {

        $ClientId = $script:GraphSettings.DefaultClientId

    }

    # Set default scopes if not specified

    if (-not $Scopes) {

        $Scopes = $script:RequiredScopes

    }

    $tokenEndpoint = "$($script:GraphSettings.LoginUri)/$TenantId/oauth2/v2.0/token"

    $deviceCodeEndpoint = "$($script:GraphSettings.LoginUri)/$TenantId/oauth2/v2.0/devicecode"

    try {

        switch ($PSCmdlet.ParameterSetName) {

            'DeviceCode' {

                Write-Host "Initiating device code authentication..." -ForegroundColor Cyan

                # Request device code

                $deviceCodeBody = @{

                    client_id = $ClientId

                    scope     = ($Scopes -join ' ') + ' offline_access'

                }

                $deviceCodeResponse = Invoke-RestMethod -Uri $deviceCodeEndpoint -Method POST -Body $deviceCodeBody -ContentType 'application/x-www-form-urlencoded'

                # Display user instructions

                Write-Host ""

                Write-Host "To sign in, use a web browser to open the page " -NoNewline

                Write-Host $deviceCodeResponse.verification_uri -ForegroundColor Yellow -NoNewline

                Write-Host " and enter the code " -NoNewline

                Write-Host $deviceCodeResponse.user_code -ForegroundColor Green -NoNewline

                Write-Host " to authenticate."

                Write-Host ""

                # Copy code to clipboard if possible

                try {

                    Set-Clipboard -Value $deviceCodeResponse.user_code

                    Write-Host "(Code copied to clipboard)" -ForegroundColor Gray

                }

                catch {

                    # Clipboard not available, ignore

                }

                # Poll for token

                $pollInterval = $deviceCodeResponse.interval

                $expiresIn = $deviceCodeResponse.expires_in

                $startTime = Get-Date

                $tokenBody = @{

                    grant_type  = 'urn:ietf:params:oauth:grant-type:device_code'

                    client_id   = $ClientId

                    device_code = $deviceCodeResponse.device_code

                }

                while ((Get-Date) -lt $startTime.AddSeconds($expiresIn)) {

                    Start-Sleep -Seconds $pollInterval

                    try {

                        $tokenResponse = Invoke-RestMethod -Uri $tokenEndpoint -Method POST -Body $tokenBody -ContentType 'application/x-www-form-urlencoded'

                        # Success - store token

                        $script:AuthContext.AccessToken = $tokenResponse.access_token

                        $script:AuthContext.TokenExpiry = (Get-Date).AddSeconds($tokenResponse.expires_in - 300)

                        $script:AuthContext.TenantId = $TenantId

                        $script:AuthContext.ClientId = $ClientId

                        $script:AuthContext.AuthMethod = 'DeviceCode'

                        if ($tokenResponse.refresh_token) {

                            $script:AuthContext.RefreshToken = $tokenResponse.refresh_token

                        }

                        Write-Host ""

                        Write-Host "Successfully connected to Microsoft Graph for tenant: $TenantId" -ForegroundColor Green

                        return

                    }

                    catch {

                        $errorResponse = $_.ErrorDetails.Message | ConvertFrom-Json -ErrorAction SilentlyContinue

                        if ($errorResponse.error -eq 'authorization_pending') {

                            # Still waiting for user to authenticate

                            continue

                        }

                        elseif ($errorResponse.error -eq 'slow_down') {

                            # Increase poll interval

                            $pollInterval += 5

                            continue

                        }

                        elseif ($errorResponse.error -eq 'expired_token') {

                            throw "Device code expired. Please try again."

                        }

                        else {

                            throw "Authentication failed: $($errorResponse.error_description ?? $_.Exception.Message)"

                        }

                    }

                }

                throw "Device code authentication timed out."

            }

            'ClientSecret' {

                Write-Verbose "Authenticating with client secret..."

                $secretPlain = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto(

                    [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($ClientSecret)

                )

                $tokenBody = @{

                    grant_type    = 'client_credentials'

                    client_id     = $ClientId

                    client_secret = $secretPlain

                    scope         = 'https://graph.microsoft.com/.default'

                }

                $tokenResponse = Invoke-RestMethod -Uri $tokenEndpoint -Method POST -Body $tokenBody -ContentType 'application/x-www-form-urlencoded'

                $script:AuthContext.AccessToken = $tokenResponse.access_token

                $script:AuthContext.TokenExpiry = (Get-Date).AddSeconds($tokenResponse.expires_in - 300)

                $script:AuthContext.TenantId = $TenantId

                $script:AuthContext.ClientId = $ClientId

                $script:AuthContext.AuthMethod = 'ClientSecret'

                $script:AuthContext.RefreshToken = $null  # No refresh token in client credentials flow

                Write-Host "Successfully connected to Microsoft Graph for tenant: $TenantId" -ForegroundColor Green

            }

            'Certificate' {

                Write-Verbose "Authenticating with client certificate..."

                $token = Get-TokenWithCertificate -TenantId $TenantId -ClientId $ClientId -Certificate $ClientCertificate

                $script:AuthContext.AccessToken = $token.access_token

                $script:AuthContext.TokenExpiry = (Get-Date).AddSeconds($token.expires_in - 300)

                $script:AuthContext.TenantId = $TenantId

                $script:AuthContext.ClientId = $ClientId

                $script:AuthContext.AuthMethod = 'ClientCertificate'

                $script:AuthContext.RefreshToken = $null

                Write-Host "Successfully connected to Microsoft Graph for tenant: $TenantId" -ForegroundColor Green

            }

            'CertificateThumbprint' {

                Write-Verbose "Authenticating with certificate thumbprint..."

                # Find certificate in store

                $cert = Get-ChildItem -Path "Cert:\CurrentUser\My\$CertificateThumbprint" -ErrorAction SilentlyContinue

                if (-not $cert) {

                    $cert = Get-ChildItem -Path "Cert:\LocalMachine\My\$CertificateThumbprint" -ErrorAction SilentlyContinue

                }

                if (-not $cert) {

                    throw "Certificate with thumbprint '$CertificateThumbprint' not found in certificate store."

                }

                $token = Get-TokenWithCertificate -TenantId $TenantId -ClientId $ClientId -Certificate $cert

                $script:AuthContext.AccessToken = $token.access_token

                $script:AuthContext.TokenExpiry = (Get-Date).AddSeconds($token.expires_in - 300)

                $script:AuthContext.TenantId = $TenantId

                $script:AuthContext.ClientId = $ClientId

                $script:AuthContext.AuthMethod = 'ClientCertificate'

                $script:AuthContext.RefreshToken = $null

                Write-Host "Successfully connected to Microsoft Graph for tenant: $TenantId" -ForegroundColor Green

            }

        }

    }

    catch {

        $script:AuthContext.AccessToken = $null

        throw "Failed to connect to Microsoft Graph: $_"

    }

}

function Get-TokenWithCertificate {

    <#

    .SYNOPSIS

        Internal function to get access token using client certificate.

    #>

    [CmdletBinding()]

    param(

        [Parameter(Mandatory = $true)]

        [string]$TenantId,

        [Parameter(Mandatory = $true)]

        [string]$ClientId,

        [Parameter(Mandatory = $true)]

        [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate

    )

    $tokenEndpoint = "$($script:GraphSettings.LoginUri)/$TenantId/oauth2/v2.0/token"

    # Create JWT assertion

    $now = [DateTime]::UtcNow

    $jwtHeader = @{

        alg = 'RS256'

        typ = 'JWT'

        x5t = [Convert]::ToBase64String($Certificate.GetCertHash()) -replace '\+', '-' -replace '/', '_' -replace '='

    }

    $jwtPayload = @{

        aud = $tokenEndpoint

        iss = $ClientId

        sub = $ClientId

        jti = [Guid]::NewGuid().ToString()

        nbf = [int]($now - [DateTime]::UnixEpoch).TotalSeconds

        exp = [int](($now.AddMinutes(10)) - [DateTime]::UnixEpoch).TotalSeconds

    }

    $headerJson = $jwtHeader | ConvertTo-Json -Compress

    $payloadJson = $jwtPayload | ConvertTo-Json -Compress

    $headerBase64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($headerJson)) -replace '\+', '-' -replace '/', '_' -replace '='

    $payloadBase64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($payloadJson)) -replace '\+', '-' -replace '/', '_' -replace '='

    $dataToSign = "$headerBase64.$payloadBase64"

    $dataBytes = [Text.Encoding]::UTF8.GetBytes($dataToSign)

    # Sign with certificate

    $rsa = $Certificate.PrivateKey

    $signature = $rsa.SignData($dataBytes, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1)

    $signatureBase64 = [Convert]::ToBase64String($signature) -replace '\+', '-' -replace '/', '_' -replace '='

    $clientAssertion = "$dataToSign.$signatureBase64"

    # Request token

    $tokenBody = @{

        grant_type            = 'client_credentials'

        client_id             = $ClientId

        client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

        client_assertion      = $clientAssertion

        scope                 = 'https://graph.microsoft.com/.default'

    }

    $response = Invoke-RestMethod -Uri $tokenEndpoint -Method POST -Body $tokenBody -ContentType 'application/x-www-form-urlencoded'

    return $response

}

# SIG # Begin signature block

# MIIoYgYJKoZIhvcNAQcCoIIoUzCCKE8CAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDr8VLxm6DpVi44

# dd7jtpWUDcJxV1RsSnFZjwqpPWZ2taCCIV8wggWNMIIEdaADAgECAhAOmxiO+dAt

# 5+/bUOIIQBhaMA0GCSqGSIb3DQEBDAUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQK

# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNV

# BAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yMjA4MDEwMDAwMDBa

# Fw0zMTExMDkyMzU5NTlaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy

# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD

# ZXJ0IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC

# ggIBAL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3E

# MB/zG6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKy

# unWZanMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsF

# xl7sWxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU1

# 5zHL2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJB

# MtfbBHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObUR

# WBf3JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6

# nj3cAORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxB

# YKqxYxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5S

# UUd0viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+x

# q4aLT8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjggE6MIIB

# NjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTs1+OC0nFdZEzfLmc/57qYrhwP

# TzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAOBgNVHQ8BAf8EBAMC

# AYYweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp

# Y2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv

# bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0

# aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENB

# LmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQEMBQADggEBAHCgv0Nc

# Vec4X6CjdBs9thbX979XB72arKGHLOyFXqkauyL4hxppVCLtpIh3bb0aFPQTSnov

# Lbc47/T/gLn4offyct4kvFIDyE7QKt76LVbP+fT3rDB6mouyXtTP0UNEm0Mh65Zy

# oUi0mcudT6cGAxN3J0TU53/oWajwvy8LpunyNDzs9wPHh6jSTEAZNUZqaVSwuKFW

# juyk1T3osdz9HNj0d1pcVIxv76FQPfx2CWiEn2/K2yCNNWAcAgPLILCsWKAOQGPF

# mCLBsln1VWvPJ6tsds5vIy30fnFqI2si/xK4VC0nftg62fC2h5b9W9FcrBjDTZ9z

# twGpn1eqXijiuZQwggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0GCSqG

# SIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx

# GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRy

# dXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTlaMGkx

# CzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4

# RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEzODQg

# MjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C0Cit

# eLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce2vnS

# 1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0daE6ZM

# swEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6TSXBC

# Mo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoAFdE3

# /hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7OhD26j

# q22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM1bL5

# OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z8ujo

# 7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05huzU

# tw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNYmtwm

# KwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP/2NP

# TLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0TAQH/

# BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYDVR0j

# BBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1Ud

# JQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0

# cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0

# cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8E

# PDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVz

# dGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATANBgkq

# hkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95RysQDK

# r2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HLIvda

# qpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5BtfQ/g+

# lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnhOE7a

# brs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIhdXNS

# y0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV9zeK

# iwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/jwVYb

# KyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYHKi8Q

# xAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmCXBVm

# zGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l/aCn

# HwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZWeE4w

# gga0MIIEnKADAgECAhANx6xXBf8hmS5AQyIMOkmGMA0GCSqGSIb3DQEBCwUAMGIx

# CzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3

# dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBH

# NDAeFw0yNTA1MDcwMDAwMDBaFw0zODAxMTQyMzU5NTlaMGkxCzAJBgNVBAYTAlVT

# MRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1

# c3RlZCBHNCBUaW1lU3RhbXBpbmcgUlNBNDA5NiBTSEEyNTYgMjAyNSBDQTEwggIi

# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC0eDHTCphBcr48RsAcrHXbo0Zo

# dLRRF51NrY0NlLWZloMsVO1DahGPNRcybEKq+RuwOnPhof6pvF4uGjwjqNjfEvUi

# 6wuim5bap+0lgloM2zX4kftn5B1IpYzTqpyFQ/4Bt0mAxAHeHYNnQxqXmRinvuNg

# xVBdJkf77S2uPoCj7GH8BLuxBG5AvftBdsOECS1UkxBvMgEdgkFiDNYiOTx4OtiF

# cMSkqTtF2hfQz3zQSku2Ws3IfDReb6e3mmdglTcaarps0wjUjsZvkgFkriK9tUKJ

# m/s80FiocSk1VYLZlDwFt+cVFBURJg6zMUjZa/zbCclF83bRVFLeGkuAhHiGPMvS

# GmhgaTzVyhYn4p0+8y9oHRaQT/aofEnS5xLrfxnGpTXiUOeSLsJygoLPp66bkDX1

# ZlAeSpQl92QOMeRxykvq6gbylsXQskBBBnGy3tW/AMOMCZIVNSaz7BX8VtYGqLt9

# MmeOreGPRdtBx3yGOP+rx3rKWDEJlIqLXvJWnY0v5ydPpOjL6s36czwzsucuoKs7

# Yk/ehb//Wx+5kMqIMRvUBDx6z1ev+7psNOdgJMoiwOrUG2ZdSoQbU2rMkpLiQ6bG

# RinZbI4OLu9BMIFm1UUl9VnePs6BaaeEWvjJSjNm2qA+sdFUeEY0qVjPKOWug/G6

# X5uAiynM7Bu2ayBjUwIDAQABo4IBXTCCAVkwEgYDVR0TAQH/BAgwBgEB/wIBADAd

# BgNVHQ4EFgQU729TSunkBnx6yuKQVvYv1Ensy04wHwYDVR0jBBgwFoAU7NfjgtJx

# XWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF

# BwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln

# aWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5j

# b20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8EPDA6MDigNqA0hjJo

# dHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNy

# bDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgBhv1sBwEwDQYJKoZIhvcNAQEL

# BQADggIBABfO+xaAHP4HPRF2cTC9vgvItTSmf83Qh8WIGjB/T8ObXAZz8OjuhUxj

# aaFdleMM0lBryPTQM2qEJPe36zwbSI/mS83afsl3YTj+IQhQE7jU/kXjjytJgnn0

# hvrV6hqWGd3rLAUt6vJy9lMDPjTLxLgXf9r5nWMQwr8Myb9rEVKChHyfpzee5kH0

# F8HABBgr0UdqirZ7bowe9Vj2AIMD8liyrukZ2iA/wdG2th9y1IsA0QF8dTXqvcnT

# mpfeQh35k5zOCPmSNq1UH410ANVko43+Cdmu4y81hjajV/gxdEkMx1NKU4uHQcKf

# ZxAvBAKqMVuqte69M9J6A47OvgRaPs+2ykgcGV00TYr2Lr3ty9qIijanrUR3anzE

# wlvzZiiyfTPjLbnFRsjsYg39OlV8cipDoq7+qNNjqFzeGxcytL5TTLL4ZaoBdqbh

# OhZ3ZRDUphPvSRmMThi0vw9vODRzW6AxnJll38F0cuJG7uEBYTptMSbhdhGQDpOX

# gpIUsWTjd6xpR6oaQf/DJbg3s6KCLPAlZ66RzIg9sC+NJpud/v4+7RWsWCiKi9EO

# LLHfMR2ZyJ/+xhCx9yHbxtl5TPau1j/1MIDpMPx0LckTetiSuEtQvLsNz3Qbp7wG

# WqbIiOWCnb5WqxL3/BAPvIXKUjPSxyZsq8WhbaM2tszWkPZPubdcMIIG7TCCBNWg

# AwIBAgIQCoDvGEuN8QWC0cR2p5V0aDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQG

# EwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0

# IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0Ex

# MB4XDTI1MDYwNDAwMDAwMFoXDTM2MDkwMzIzNTk1OVowYzELMAkGA1UEBhMCVVMx

# FzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdpQ2VydCBTSEEy

# NTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjUgMTCCAiIwDQYJKoZI

# hvcNAQEBBQADggIPADCCAgoCggIBANBGrC0Sxp7Q6q5gVrMrV7pvUf+GcAoB38o3

# zBlCMGMyqJnfFNZx+wvA69HFTBdwbHwBSOeLpvPnZ8ZN+vo8dE2/pPvOx/Vj8Tch

# TySA2R4QKpVD7dvNZh6wW2R6kSu9RJt/4QhguSssp3qome7MrxVyfQO9sMx6ZAWj

# FDYOzDi8SOhPUWlLnh00Cll8pjrUcCV3K3E0zz09ldQ//nBZZREr4h/GI6Dxb2Uo

# yrN0ijtUDVHRXdmncOOMA3CoB/iUSROUINDT98oksouTMYFOnHoRh6+86Ltc5zjP

# KHW5KqCvpSduSwhwUmotuQhcg9tw2YD3w6ySSSu+3qU8DD+nigNJFmt6LAHvH3KS

# uNLoZLc1Hf2JNMVL4Q1OpbybpMe46YceNA0LfNsnqcnpJeItK/DhKbPxTTuGoX7w

# JNdoRORVbPR1VVnDuSeHVZlc4seAO+6d2sC26/PQPdP51ho1zBp+xUIZkpSFA8vW

# doUoHLWnqWU3dCCyFG1roSrgHjSHlq8xymLnjCbSLZ49kPmk8iyyizNDIXj//cOg

# rY7rlRyTlaCCfw7aSUROwnu7zER6EaJ+AliL7ojTdS5PWPsWeupWs7NpChUk555K

# 096V1hE0yZIXe+giAwW00aHzrDchIc2bQhpp0IoKRR7YufAkprxMiXAJQ1XCmnCf

# gPf8+3mnAgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTkO/zy

# Me39/dfzkXFjGVBDz2GM6DAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK4pBW9i/USezL

# TjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwgZUGCCsG

# AQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5j

# b20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdp

# Q2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYyMDI1Q0ExLmNy

# dDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGln

# aUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2MjAyNUNBMS5j

# cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB

# CwUAA4ICAQBlKq3xHCcEua5gQezRCESeY0ByIfjk9iJP2zWLpQq1b4URGnwWBdEZ

# D9gBq9fNaNmFj6Eh8/YmRDfxT7C0k8FUFqNh+tshgb4O6Lgjg8K8elC4+oWCqnU/

# ML9lFfim8/9yJmZSe2F8AQ/UdKFOtj7YMTmqPO9mzskgiC3QYIUP2S3HQvHG1FDu

# +WUqW4daIqToXFE/JQ/EABgfZXLWU0ziTN6R3ygQBHMUBaB5bdrPbF6MRYs03h4o

# bEMnxYOX8VBRKe1uNnzQVTeLni2nHkX/QqvXnNb+YkDFkxUGtMTaiLR9wjxUxu2h

# ECZpqyU1d0IbX6Wq8/gVutDojBIFeRlqAcuEVT0cKsb+zJNEsuEB7O7/cuvTQasn

# M9AWcIQfVjnzrvwiCZ85EE8LUkqRhoS3Y50OHgaY7T/lwd6UArb+BOVAkg2oOvol

# /DJgddJ35XTxfUlQ+8Hggt8l2Yv7roancJIFcbojBcxlRcGG0LIhp6GvReQGgMgY

# xQbV1S3CrWqZzBt1R9xJgKf47CdxVRd/ndUlQ05oxYy2zRWVFjF7mcr4C34Mj3oc

# CVccAvlKV9jEnstrniLvUxxVZE/rptb7IRE2lskKPIJgbaP5t2nGj/ULLi49xTcB

# ZU8atufk+EMF/cWuiC7POGT75qaL6vdCvHlshtjdNXOCIUjsarfNZzCCB20wggVV

# oAMCAQICEAnI7Fw0fQcgWcyoNeinb/gwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UE

# BhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2Vy

# dCBUcnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENB

# MTAeFw0yMzAzMjkwMDAwMDBaFw0yNjA2MjIyMzU5NTlaMHUxCzAJBgNVBAYTAkFV

# MRgwFgYDVQQIEw9OZXcgU291dGggV2FsZXMxFDASBgNVBAcTC0NoZXJyeWJyb29r

# MRowGAYDVQQKExFEYXJyZW4gSiBSb2JpbnNvbjEaMBgGA1UEAxMRRGFycmVuIEog

# Um9iaW5zb24wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDHrKfntVGe

# XaDp6S/nqZuiKuhmIqivGTXM9VwXuzO3gV8FcuLWD+QciGujTkWBLHpVViPV5jtT

# PnD0uo0TK6WW/cbVB/jaSmTvnkrYYEwLZxDtXVmgCumOwB/2VY5oDk1mVwVYm4wB

# PyUCiH2cseB5uRTh+oat27JQPkVEKaNzUMTb9gLs3JCkMG1uwKFyDbnY9HbmAog2

# LIZ//Zh884C9FaTWEaZoBGu1loHNSR9e1fkmJWn+qjFqWKFrjg8Lg5bUh9qee6gC

# Nv+Ceq1GBL57O0GfbICFHRpVK+fen6dGOI7sqclRhO0a9GvD7Qci1lLqcle2eZCj

# 6/zEY3q1wJgZ3+gHYSN5GOho89+en2ZDwOPVLgiFxYMk2U/OAKOipcPtEaie9CQ7

# eOPVJMu4XWvofIdj4lHX+610Gplee5mOufpRwJnOPlIE7lrJ6cJ07jZZG2cUZwsN

# g/lt6raNmgYQ3m3Iimc4r34gFpVn03B7QqcveoDOS/jgeOXsw6VOigB9YcEUozkV

# JVucqBU11Gz1AUX5VNztm2dMHQCXslGGh1gGsjaMhX7ina5gi7SMe9ujtOnc/SoP

# nCX/tWXSeynFL2YEdnfBdfRVeRtQlTJzs4TGUdnZyHieYdBIHDijR5d4TChXVUce

# JYVvLXK0EDeGU9hIBnyPXwXNItxl0xQNMQIDAQABo4ICAzCCAf8wHwYDVR0jBBgw

# FoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFAUxVql07mJzafndN3rN

# ijPSXRlIMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYD

# VR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNl

# cnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBT

# oFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0

# Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwPgYDVR0gBDcwNTAz

# BgZngQwBBAEwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20v

# Q1BTMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Au

# ZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2Vy

# dC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQy

# MDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQBYQAlozzK3

# Gn8A32eZnv51K5L+MmICIud+XHXTwJv9rMBg07s0lQVRyDAafC1i5s1zwNRm8QTp

# gOC/L7w4IxKUBfSPT4eTDWIGIYNMUqQCKffygKHODkJ8JckRjzfgo2smONMcU8+P

# 4R6IVoOK5yTCLlRI5DLSpzHU26Z6lPOcO/AEJXw+/b/4FkNnS9U959fBzhI07fFU

# rq8ZBIUOSN0h/Aq/WIVL/eDm1iFGzilLeUhu5v3fstpn5CkUjpkZbi0qGCz1m8d+

# aQK7GJGj6Y3+WJeY4iT2NxkMxFP0kVVtK68AwG7SkjdIClrWcYozw27PGkFGAoox

# X43ujlhheEZ5j0kIdBX/AMsz0HMfS40P/Fu4FBC7BOiBblz+W49ouoHi8uuS0XuO

# kGZWA6v2zGs1KGUE5Y3v4bOqZDi+H9Sr+7WyWZjBDVVVESTZng0Xo7zZYh2mhhAL

# /4hdGaO6ar4+MAgghht4/7DUeVkkWJ8X+cUOK/YvYGapOMo8JPwyQltq5ijQlKMT

# SGVodhCJTEg88NwzCpNspWXYmPywIuRpmwshi7erE8/yBNcNTWMK6f8+r+CPdZQ4

# HV4Pn05IYcbeO4VpozDg92WFUhc0JoPGpdYkP/ukWCoH7MMOuLSJMvCTjmV/97LP

# 7ocSlIzycWCZDsEMFMqAGM43LvwBOwctKzGCBlkwggZVAgEBMH0waTELMAkGA1UE

# BhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2Vy

# dCBUcnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENB

# MQIQCcjsXDR9ByBZzKg16Kdv+DANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3

# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG

# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCC7238WcXES

# uX37TsNSVv5emapnNPgPX3d1coyuDlpUejANBgkqhkiG9w0BAQEFAASCAgCQYpj5

# if6pFfskR+31jWwul9aKM5ffZiWbezSX5BisCQ8/5xqMD80nSaVxbfB3aU/kohiK

# /DTCc1htWDOqwmtspUOKeSCPy6hrxECyMdr6QosUSJhAUtkrsHO8rKpOFl6ccNXw

# vCFTvWI2Bgpj3YzMugc//PFOlte9OoE7Cegb2Bx0Z1pu3F4ZPExE8S9CuaZDQYfY

# 0aUGMffIUZAOErRRMw90J4U45L+eK64E8jawm37b0NTtjCmQ2P8BdZI+4H3/hjNG

# XIzY0BsN5W+TRKPIO4u1yr4pk0PeMAyDk8epgt9XdOjU53Q+r3CxP6yrqJOAXlMr

# FiMLibkBEPJ3B+o0bTJGioVcMHiYcdN6ddTt4ACknmW3eh7d9Yla9ZhU0iT11HN2

# gPFt8y7G/SPq+YGyfQ9AEMTbZMzePyRBrWM+Qs0rkUI+vmiaC6Onayz48I9UwNA6

# SqxfF0A3STKPu7z6wy6DUY7nRHz5BFB9yH6PnTMhh4Fy5s+QfMqUUVY3oTQphhnH

# 8lFXcbxHUlyxOEE2QufM90xYaNTEsMJWBOczd6KiYBp8vJ8hiso1G9aEtfGvwjCF

# w8S7k9m0sIJOL/SivC4JOuuXq8GkRLb+ZAUb9gFM837NoPgrCewSz1uqkSKQgTqP

# pohVV0HPrkMcujHMVar4QNjgyzWCuZKmudDfGqGCAyYwggMiBgkqhkiG9w0BCQYx

# ggMTMIIDDwIBATB9MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwg

# SW5jLjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBUaW1lU3RhbXBpbmcg

# UlNBNDA5NiBTSEEyNTYgMjAyNSBDQTECEAqA7xhLjfEFgtHEdqeVdGgwDQYJYIZI

# AWUDBAIBBQCgaTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJ

# BTEPFw0yNjAyMjUwNTIzMTFaMC8GCSqGSIb3DQEJBDEiBCBGqwGrxey1dwOLdbh/

# Fg++RT3OUtEiBAwe+dZ9yrIxFzANBgkqhkiG9w0BAQEFAASCAgAGCqzYYXiDuvug

# GNd0BHZPYSScIwXHee4iODtXOcWoItdsFY/Ycn78BZAEbpfVYztAKxyFbAk6/0r2

# VKf6u9YInOu1q7C5SpsgN7XiYxThVAX1KffbpxAIpTAQEwClMj6t34en0PopLMI/

# uH1yn9lEBuAmcmJYQSGl6qEeAsl7tQ7J8WzWylCF8ERH/7viBTsNy/Mth6xYMmsB

# ZB/UTf6/7fRez30TbAZu8b/OjzB/FBEjS2f8lrr3HljpFNGVEMclztRODKaa8jw6

# nl0AyOrli+V6DO6DbOGpE3dX1WGZPnsD1aCa5LqD+RCDs2IW0KLzwm5K40s+hB2N

# mVgm8b46z2Tw+nDzF3r8sE7up1ehEZ9Cw4hE+2O+QNASzgYvv8OZ/i9y6PRf+WrP

# KJ2LsozFdwjR4RfpQ+lfW4u7eLPJJvRXtsyd7AmAO32yURO51uxYJZRYC0SHDo3+

# 5EGjfG6msd+8dUAwa8J0p8WDOchyCipNXTyNvaWEmdd+wbq2TH+ASG5FLvVFttXD

# BaPLDUKJXgN3eF6rHqOMuJ+ZVQIH1xSzO8O82UmnWF3DGAKA3Q5rbglEQtBlbtBX

# XNpWoNRYmsSGOAugOqaHdw3wZZj6iOdrqkePYuWMqJA84wU94M+Cj+JQieGGv8Fb

# tj3rEX3Kaq+WE6R+suJAsRlKIZuT2A==

# SIG # End signature block