From a82eb762e29975fd22d8e13a8e89913623c3fd49 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Sun, 7 Dec 2025 13:04:54 +0200 Subject: [PATCH 01/12] WIP --- .../plan/prepare-for-building.md | 2 +- docs/integrations-index.md | 14 ++-- docs/security.md | 2 +- docs/sso-rbac/ownership.md | 2 +- docs/sso-rbac/port-secrets/_category_.json | 2 +- docs/sso-rbac/sso/_category_.json | 5 ++ docs/sso-rbac/sso/self-serve-sso.md | 75 ++++++++++++++++++ .../{ => sso}/sso-providers/_category_.json | 2 +- .../_scim_functionality_list.mdx | 0 .../sso-providers/ldap/_category_.json | 0 .../{ => sso}/sso-providers/ldap/ldap.md | 0 .../sso-providers/oidc/_category_.json | 0 .../oidc/_scim_oidc_limitation.mdx | 0 .../{ => sso}/sso-providers/oidc/azure-ad.md | 4 +- .../{ => sso}/sso-providers/oidc/oidc.md | 2 +- .../{ => sso}/sso-providers/oidc/okta.md | 4 +- .../{ => sso}/sso-providers/oidc/onelogin.md | 0 .../sso-providers/saml/_category_.json | 0 .../{ => sso}/sso-providers/saml/azure-ad.md | 2 +- .../sso-providers/saml/google-workspace.md | 0 .../{ => sso}/sso-providers/saml/jumpcloud.md | 0 .../{ => sso}/sso-providers/saml/okta.md | 2 +- .../{ => sso}/sso-providers/saml/saml.md | 0 .../{ => sso}/sso-providers/sso-providers.md | 0 .../users-and-teams/manage-users-teams.md | 2 +- docs/troubleshooting.md | 2 +- .../img/sso/self-serve/sso-status-failed.png | Bin 0 -> 11058 bytes .../img/sso/self-serve/sso-status-pending.png | Bin 0 -> 12975 bytes .../img/sso/self-serve/sso-status-success.png | Bin 0 -> 13664 bytes 29 files changed, 101 insertions(+), 21 deletions(-) create mode 100644 docs/sso-rbac/sso/_category_.json create mode 100644 docs/sso-rbac/sso/self-serve-sso.md rename docs/sso-rbac/{ => sso}/sso-providers/_category_.json (66%) rename docs/sso-rbac/{ => sso}/sso-providers/_scim_functionality_list.mdx (100%) rename docs/sso-rbac/{ => sso}/sso-providers/ldap/_category_.json (100%) rename docs/sso-rbac/{ => sso}/sso-providers/ldap/ldap.md (100%) rename docs/sso-rbac/{ => sso}/sso-providers/oidc/_category_.json (100%) rename docs/sso-rbac/{ => sso}/sso-providers/oidc/_scim_oidc_limitation.mdx (100%) rename docs/sso-rbac/{ => sso}/sso-providers/oidc/azure-ad.md (98%) rename docs/sso-rbac/{ => sso}/sso-providers/oidc/oidc.md (93%) rename docs/sso-rbac/{ => sso}/sso-providers/oidc/okta.md (96%) rename docs/sso-rbac/{ => sso}/sso-providers/oidc/onelogin.md (100%) rename docs/sso-rbac/{ => sso}/sso-providers/saml/_category_.json (100%) rename docs/sso-rbac/{ => sso}/sso-providers/saml/azure-ad.md (97%) rename docs/sso-rbac/{ => sso}/sso-providers/saml/google-workspace.md (100%) rename docs/sso-rbac/{ => sso}/sso-providers/saml/jumpcloud.md (100%) rename docs/sso-rbac/{ => sso}/sso-providers/saml/okta.md (97%) rename docs/sso-rbac/{ => sso}/sso-providers/saml/saml.md (100%) rename docs/sso-rbac/{ => sso}/sso-providers/sso-providers.md (100%) create mode 100644 static/img/sso/self-serve/sso-status-failed.png create mode 100644 static/img/sso/self-serve/sso-status-pending.png create mode 100644 static/img/sso/self-serve/sso-status-success.png diff --git a/docs/guides/_implementation-guide/plan/prepare-for-building.md b/docs/guides/_implementation-guide/plan/prepare-for-building.md index 2369b753b2..6aa347bc93 100644 --- a/docs/guides/_implementation-guide/plan/prepare-for-building.md +++ b/docs/guides/_implementation-guide/plan/prepare-for-building.md @@ -32,7 +32,7 @@ Read more about roles and permissions [here](https://docs.port.io/sso-rbac/users ## Configure SSO -Select the relevant [SSO provider](/sso-rbac/sso-providers/) and follow the instructions to set it up. +Select the relevant [SSO provider](/sso-rbac/sso/sso-providers/) and follow the instructions to set it up. :::info Enterprise feature Note that SSO support is an enterprise feature. If you are using the free tier, you can skip this step. diff --git a/docs/integrations-index.md b/docs/integrations-index.md index 022611f707..31e51daeea 100644 --- a/docs/integrations-index.md +++ b/docs/integrations-index.md @@ -53,7 +53,7 @@ This page contains a list of Port's available integrations, organized by the pla ### Azure - [Azure exporter](/build-your-software-catalog/sync-data-to-catalog/cloud-providers/azure/azure.md) -- [Azure Active Directory (AD) SSO](/sso-rbac/sso-providers/oidc/azure-ad.md) +- [Azure Active Directory (AD) SSO](/sso-rbac/sso/sso-providers/oidc/azure-ad.md) - [Map resource groups, storage groups, compute resources database resources and more](/build-your-software-catalog/sync-data-to-catalog/cloud-providers/azure/resource_templates/resource_templates.md) - [Add tags to Azure resources](/guides/all/tag-azure-resource) @@ -320,12 +320,12 @@ This page contains a list of Port's available integrations, organized by the pla ## SSO -- [Okta SSO](/sso-rbac/sso-providers/oidc/okta.md) -- [OneLogin SSO](/sso-rbac/sso-providers/oidc/onelogin.md) -- [JumpCloud SSO](/sso-rbac/sso-providers/saml/jumpcloud.md) -- [Google workspace SSO](/sso-rbac/sso-providers/saml/google-workspace.md) -- [Azure Active Directory (AD) SSO OIDC](/sso-rbac/sso-providers/oidc/azure-ad.md) -- [Azure Active Directory (AD) SSO SAML](/sso-rbac/sso-providers/saml/azure-ad.md) +- [Okta SSO](/sso-rbac/sso/sso-providers/oidc/okta.md) +- [OneLogin SSO](/sso-rbac/sso/sso-providers/oidc/onelogin.md) +- [JumpCloud SSO](/sso-rbac/sso/sso-providers/saml/jumpcloud.md) +- [Google workspace SSO](/sso-rbac/sso/sso-providers/saml/google-workspace.md) +- [Azure Active Directory (AD) SSO OIDC](/sso-rbac/sso/sso-providers/oidc/azure-ad.md) +- [Azure Active Directory (AD) SSO SAML](/sso-rbac/sso/sso-providers/saml/azure-ad.md) ## StackHawk diff --git a/docs/security.md b/docs/security.md index 97226fec9a..0a47fd3821 100644 --- a/docs/security.md +++ b/docs/security.md @@ -201,7 +201,7 @@ In addition to password login and social login, multi-factor authentication (MFA ### Single sign-on (SSO) -Port integrates with all major [SSO providers](/sso-rbac/sso-providers/), allowing you to seamlessly import users and teams, and also exposing Port to your organization in a managed manner. +Port integrates with all major [SSO providers](/sso-rbac/sso/sso-providers/), allowing you to seamlessly import users and teams, and also exposing Port to your organization in a managed manner. Port supports SSO using the OIDC protocol and the SAML 2.0 protocol, and as such supports all modern Identity Providers. diff --git a/docs/sso-rbac/ownership.md b/docs/sso-rbac/ownership.md index 13455a4ad8..ad565e327b 100644 --- a/docs/sso-rbac/ownership.md +++ b/docs/sso-rbac/ownership.md @@ -1,5 +1,5 @@ --- -sidebar_position: 4 +sidebar_position: 5 --- import Tabs from '@theme/Tabs'; diff --git a/docs/sso-rbac/port-secrets/_category_.json b/docs/sso-rbac/port-secrets/_category_.json index 20a232975a..3cb61eda1d 100644 --- a/docs/sso-rbac/port-secrets/_category_.json +++ b/docs/sso-rbac/port-secrets/_category_.json @@ -1,4 +1,4 @@ { "label": "Port secrets", - "position": 4 + "position": 6 } diff --git a/docs/sso-rbac/sso/_category_.json b/docs/sso-rbac/sso/_category_.json new file mode 100644 index 0000000000..782e69cd01 --- /dev/null +++ b/docs/sso-rbac/sso/_category_.json @@ -0,0 +1,5 @@ +{ + "label": "SSO", + "position": 4 + } + \ No newline at end of file diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md new file mode 100644 index 0000000000..f8b58b10f7 --- /dev/null +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -0,0 +1,75 @@ +--- +title: "Self-serve SSO setup" +sidebar_position: 1 +description: Set up SSO for your organization without contacting Port support +--- + +# Self-serve SSO setup + +Port allows company admins to configure SSO (Single Sign-On) directly from the portal. +This self-serve flow guides you through connecting your identity provider (IdP) to Port. + +## Prerequisites + +- This feature is available for **enterprise accounts** only. +- You must be a **company admin** to configure SSO. +- You need access to your identity provider's admin console to create and configure applications. + +## Set up SSO + +Follow these steps to configure SSO for your organization: + +### Step 1: Initiate the SSO setup + +1. Go to the [Builder page](https://app.getport.io/settings) of your portal. +2. Click on **Organization settings** in the left sidebar. +3. Navigate to the **SSO** tab. +4. Click the **Setup SSO Connection** button. + +:::info URL validity +A unique setup URL will be generated for you, it will be valid for 5 hours after you first open it, or 5 days if you don't open it. You can copy and save the link to complete the setup later. +::: + +### Step 2: Configure your identity provider + +After clicking the setup button, you will be guided to configure the SSO connection using one of the following options: + +- **Pre-configured identity providers** - Select from popular IdPs such as Okta, Azure AD, Google Workspace, and others. +- **Custom SAML** - Configure a custom SAML 2.0 connection for any SAML-compatible identity provider. Refer to the [SAML documentation](/sso-rbac/sso/sso-providers/saml/saml) for more details. +- **Custom OIDC** - Configure a custom OpenID Connect connection for any OIDC-compatible identity provider. Refer to the [OIDC documentation](/sso-rbac/sso/sso-providers/oidc/oidc) for more details. + +Follow the instructions to complete the configuration in your identity provider's admin console. + +### Step 3: Monitor the connection status + +While configuring your IdP, the Port UI displays the current status of your SSO connection: + +| Status indicator | Description | +| :----------------: | ----------- | +| | The setup process is in progress or hasn't been verified yet. | +| | The SSO connection was successfully created and verified. | +| | The SSO connection setup failed. See the [troubleshooting](#troubleshooting) section below for resolution options. | + +Once you have completed the configuration in your identity provider, click the button in Port to indicate that the process is finished. + +### Step 4: Finalize your SSO settings + +After the SSO connection is successfully established: + +1. **Block social logins** (optional) - You can choose to block social login methods (such as Google or GitHub sign-in) and require all users to authenticate through your SSO provider. This setting is reversible. + +2. **Access tab enabled** - Once SSO is configured, the **Access** tab becomes available in your organization settings. This allows you to manage SSO-related access controls for your organization. + +:::info Organization-level setting +The SSO configuration and access settings apply at the organization level, not the company level. +::: + +## Troubleshooting + +If you click **Setup is Done** and encounter an error, use the following table to identify and resolve the issue: + +| Error | Cause | Resolution | +| ----- | ----- | ---------- | +| Connection not created | The SSO connection was not created in Auth0. | Click **Start Again** to generate a new setup URL and repeat the configuration process. | +| Mapping failed | The mapping between Auth0 and Port failed. | Click **Edit Connection** to review and fix the configuration. | +| Linking failed | Auth0 is connected, but linking to the company in Port failed. | Contact [Port's support team](https://www.getport.io/community) for assistance. | diff --git a/docs/sso-rbac/sso-providers/_category_.json b/docs/sso-rbac/sso/sso-providers/_category_.json similarity index 66% rename from docs/sso-rbac/sso-providers/_category_.json rename to docs/sso-rbac/sso/sso-providers/_category_.json index 28c3ce2d4e..087bef10ec 100644 --- a/docs/sso-rbac/sso-providers/_category_.json +++ b/docs/sso-rbac/sso/sso-providers/_category_.json @@ -1,4 +1,4 @@ { "label": "SSO providers", - "position": 3 + "position": 2 } diff --git a/docs/sso-rbac/sso-providers/_scim_functionality_list.mdx b/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx similarity index 100% rename from docs/sso-rbac/sso-providers/_scim_functionality_list.mdx rename to docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx diff --git a/docs/sso-rbac/sso-providers/ldap/_category_.json b/docs/sso-rbac/sso/sso-providers/ldap/_category_.json similarity index 100% rename from docs/sso-rbac/sso-providers/ldap/_category_.json rename to docs/sso-rbac/sso/sso-providers/ldap/_category_.json diff --git a/docs/sso-rbac/sso-providers/ldap/ldap.md b/docs/sso-rbac/sso/sso-providers/ldap/ldap.md similarity index 100% rename from docs/sso-rbac/sso-providers/ldap/ldap.md rename to docs/sso-rbac/sso/sso-providers/ldap/ldap.md diff --git a/docs/sso-rbac/sso-providers/oidc/_category_.json b/docs/sso-rbac/sso/sso-providers/oidc/_category_.json similarity index 100% rename from docs/sso-rbac/sso-providers/oidc/_category_.json rename to docs/sso-rbac/sso/sso-providers/oidc/_category_.json diff --git a/docs/sso-rbac/sso-providers/oidc/_scim_oidc_limitation.mdx b/docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx similarity index 100% rename from docs/sso-rbac/sso-providers/oidc/_scim_oidc_limitation.mdx rename to docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx diff --git a/docs/sso-rbac/sso-providers/oidc/azure-ad.md b/docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md similarity index 98% rename from docs/sso-rbac/sso-providers/oidc/azure-ad.md rename to docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md index bcd18680fe..9f5bacff82 100644 --- a/docs/sso-rbac/sso-providers/oidc/azure-ad.md +++ b/docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md @@ -4,8 +4,8 @@ sidebar_position: 1 description: Integrate AzureAD with Port using OIDC --- -import ScimFunctionality from "/docs/sso-rbac/sso-providers/\_scim_functionality_list.mdx" -import ScimLimitation from "/docs/sso-rbac/sso-providers/oidc/\_scim_oidc_limitation.mdx" +import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/\_scim_functionality_list.mdx" +import ScimLimitation from "/docs/sso-rbac/sso/sso-providers/oidc/\_scim_oidc_limitation.mdx" import SSOEndpoints from "/docs/generalTemplates/_sso_auth0_endpoints.md" # Entra ID (AzureAD) diff --git a/docs/sso-rbac/sso-providers/oidc/oidc.md b/docs/sso-rbac/sso/sso-providers/oidc/oidc.md similarity index 93% rename from docs/sso-rbac/sso-providers/oidc/oidc.md rename to docs/sso-rbac/sso/sso-providers/oidc/oidc.md index c747a3ec3a..974b0532ad 100644 --- a/docs/sso-rbac/sso-providers/oidc/oidc.md +++ b/docs/sso-rbac/sso/sso-providers/oidc/oidc.md @@ -24,7 +24,7 @@ In order to integrate Port with an OIDC SSO application, you will need to do the - Provide Port with the following details: - `Client ID`: The client identifier for your OIDC application. - `Client Secret`: The client secret for your OIDC application. -5. Add a custom property `email_verified` and configure the OpenID Claims in your identity provider to ensure that Port receives the value `true` for this attribute as part of the connection process. This step may be required specifically for certain identity providers such as [OneLogin](/sso-rbac/sso-providers/oidc/onelogin.md#step-4-add-email_verified-custom-property-to-all-users). +5. Add a custom property `email_verified` and configure the OpenID Claims in your identity provider to ensure that Port receives the value `true` for this attribute as part of the connection process. This step may be required specifically for certain identity providers such as [OneLogin](/sso-rbac/sso/sso-providers/oidc/onelogin.md#step-4-add-email_verified-custom-property-to-all-users). 6. Configure the Groups claim in the OpenID Connect Token settings to enable automatic groups or roles support in Port.



:::note This step is OPTIONAL and is required only if you wish to pull all of your groups or roles into Port inherently. diff --git a/docs/sso-rbac/sso-providers/oidc/okta.md b/docs/sso-rbac/sso/sso-providers/oidc/okta.md similarity index 96% rename from docs/sso-rbac/sso-providers/oidc/okta.md rename to docs/sso-rbac/sso/sso-providers/oidc/okta.md index 0c9f2b6200..eaa88f2443 100644 --- a/docs/sso-rbac/sso-providers/oidc/okta.md +++ b/docs/sso-rbac/sso/sso-providers/oidc/okta.md @@ -4,8 +4,8 @@ sidebar_position: 2 description: Integrate Okta with Port --- -import ScimFunctionality from "/docs/sso-rbac/sso-providers/_scim_functionality_list.mdx" -import ScimLimitation from "/docs/sso-rbac/sso-providers/oidc/_scim_oidc_limitation.mdx" +import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx" +import ScimLimitation from "/docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx" import SSOEndpoints from "/docs/generalTemplates/_sso_auth0_endpoints.md" import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" diff --git a/docs/sso-rbac/sso-providers/oidc/onelogin.md b/docs/sso-rbac/sso/sso-providers/oidc/onelogin.md similarity index 100% rename from docs/sso-rbac/sso-providers/oidc/onelogin.md rename to docs/sso-rbac/sso/sso-providers/oidc/onelogin.md diff --git a/docs/sso-rbac/sso-providers/saml/_category_.json b/docs/sso-rbac/sso/sso-providers/saml/_category_.json similarity index 100% rename from docs/sso-rbac/sso-providers/saml/_category_.json rename to docs/sso-rbac/sso/sso-providers/saml/_category_.json diff --git a/docs/sso-rbac/sso-providers/saml/azure-ad.md b/docs/sso-rbac/sso/sso-providers/saml/azure-ad.md similarity index 97% rename from docs/sso-rbac/sso-providers/saml/azure-ad.md rename to docs/sso-rbac/sso/sso-providers/saml/azure-ad.md index 025373b41a..02c9faa504 100644 --- a/docs/sso-rbac/sso-providers/saml/azure-ad.md +++ b/docs/sso-rbac/sso/sso-providers/saml/azure-ad.md @@ -4,7 +4,7 @@ sidebar_position: 1 description: Integrate Entra ID (AzureAD) with Port using SAML --- -import ScimFunctionality from "/docs/sso-rbac/sso-providers/_scim_functionality_list.mdx" +import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx" import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" # Entra ID (AzureAD) diff --git a/docs/sso-rbac/sso-providers/saml/google-workspace.md b/docs/sso-rbac/sso/sso-providers/saml/google-workspace.md similarity index 100% rename from docs/sso-rbac/sso-providers/saml/google-workspace.md rename to docs/sso-rbac/sso/sso-providers/saml/google-workspace.md diff --git a/docs/sso-rbac/sso-providers/saml/jumpcloud.md b/docs/sso-rbac/sso/sso-providers/saml/jumpcloud.md similarity index 100% rename from docs/sso-rbac/sso-providers/saml/jumpcloud.md rename to docs/sso-rbac/sso/sso-providers/saml/jumpcloud.md diff --git a/docs/sso-rbac/sso-providers/saml/okta.md b/docs/sso-rbac/sso/sso-providers/saml/okta.md similarity index 97% rename from docs/sso-rbac/sso-providers/saml/okta.md rename to docs/sso-rbac/sso/sso-providers/saml/okta.md index f6556789d0..dd17e86069 100644 --- a/docs/sso-rbac/sso-providers/saml/okta.md +++ b/docs/sso-rbac/sso/sso-providers/saml/okta.md @@ -4,7 +4,7 @@ sidebar_position: 2 description: Integrate Okta with Port using SAML --- -import ScimFunctionality from "/docs/sso-rbac/sso-providers/_scim_functionality_list.mdx" +import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx" import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" # Okta diff --git a/docs/sso-rbac/sso-providers/saml/saml.md b/docs/sso-rbac/sso/sso-providers/saml/saml.md similarity index 100% rename from docs/sso-rbac/sso-providers/saml/saml.md rename to docs/sso-rbac/sso/sso-providers/saml/saml.md diff --git a/docs/sso-rbac/sso-providers/sso-providers.md b/docs/sso-rbac/sso/sso-providers/sso-providers.md similarity index 100% rename from docs/sso-rbac/sso-providers/sso-providers.md rename to docs/sso-rbac/sso/sso-providers/sso-providers.md diff --git a/docs/sso-rbac/users-and-teams/manage-users-teams.md b/docs/sso-rbac/users-and-teams/manage-users-teams.md index 653e9d685c..682a4a823f 100644 --- a/docs/sso-rbac/users-and-teams/manage-users-teams.md +++ b/docs/sso-rbac/users-and-teams/manage-users-teams.md @@ -34,7 +34,7 @@ There are several ways to manage users and teams in Port: - Via the [Users & Teams page](https://app.getport.io/settings/users) in your portal. This page allows you to view/delete/invite users, assign roles, and manage teams. - Via Port's [API](https://docs.getport.io/api-reference/get-all-users-in-your-organization). -- By integrating with your [identity provider (IdP)](/sso-rbac/sso-providers/) to sync users and teams from your organization. +- By integrating with your [identity provider (IdP)](/sso-rbac/sso/sso-providers/) to sync users and teams from your organization. ## Roles & permissions diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 053eb59547..b613c8046d 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -90,7 +90,7 @@ In any case, after 7 days you will need to login again.
Answer (click to expand) -1. Set up the Application in your SSO dashboard. You can find the documentation for each supported provider [here](https://docs.port.io/sso-rbac/sso-providers/). +1. Set up the Application in your SSO dashboard. You can find the documentation for each supported provider [here](https://docs.port.io/sso-rbac/sso/sso-providers/). 2. Reach out to us with the required credentials in order to complete the set up. 3. After completing the set up, Port will provide you with the `CONNECTION_NAME`. Head back to the documentation and replace it where needed. diff --git a/static/img/sso/self-serve/sso-status-failed.png b/static/img/sso/self-serve/sso-status-failed.png new file mode 100644 index 0000000000000000000000000000000000000000..07f4f8199316073e90c13d1ad9efd58f01644a9b GIT binary patch literal 11058 zcmc(^WmH_v(l9!MYaqBog1fr~1{*vK?luqz?(R;I-~oL+sGXMZf z)dmDo2ZKN~>Mo8}Hg-?|Kp{F+2UQm`LX>Nu0Y<}(3QGBzMe~+ECBEo*cN3ft0P6Qh%syqGIEE$Kdge*z(e#AW;+eyd?3~?fR;;xMsv9N*RR)rw4Upe?Fsjw zZwsvPEZ+mKU;Y%ZJIYCaxasHSB|<|hafS`9EtDTfRFc$Y+iUc=D;IVQXL6qq&L%VxZlA7@Bf z5i@{i-l9u}mp?l+%Cpr|gLvI`K@eJF!B|W8I1Ka?mSmOC%wawJtp4*v@)PpGYo!+S zP!aQiu&5qgnT>85_d_8)HkByIMRO;cB#pK>QB(T19M0S(aAOIV(D9XXdjXAulbw`= zVYaP*yKWjaW%V_F^)OMGY{gU0O($0v&<>OALdv#+hH!U+of0um zQlAv3-r(T%&<-m+uYU$;zxnirSX=9*YX^0{8jG0cHR2~1CpiI&pGhP#SacD1q0t`A zZ;oSqH(#Ib<5Xb6dc;vTZ*A4Qls_GS-6gkjnuyVwG?02jpuF2j zcAc8Ld@)BGhZ`tC`wxWy9UU=yFI6;^v(-zztH4v?l|O%Oe(P`?3IR~X)>zkvbzo_T zlI&!FY|*!xqnOhaRjs&dS)oABJRld4sGDeT6JaS>@Dx>w21_Q`D-nwUbW*n_k{-He zDxeF9kz&?GpAE+Nfoz95W6CLnM)r9~8?w;_QB1tdtW2UzDk-rks-yDd0y7c& zptw>i2(kKDnfo;FwCJ=B85!AMvRpE5GQ7AuvTd>lewfYDA1}4vU*~^&)oXr9YRqno z^$78Zy^c{WHTeCs$9(B`@8W~~MDRrQl*0h|4Nk6Rp2{xOE7Pm?*1Hf6?fqfyM4C(* z{)uPs&7iDY6OrtgerzfI&o32PW$rQu5!%%P5Z_N8DIU4kJV(n5I}LgJiEfqdA#O4v zv2KkA*;C%b{TW2cRFGlA;iVq2zQbwy{e|6g_d0ha_nZC3z3bh*-Ijg&{fVCy)1u{n zdU|zd*(6xg8$#R@-E*$Y!p_i+(axfZY4_y}sm`{#GDdph3XXZm%(*@wZ)tUG>82BOwoAkE}zE`NC_5YrX5#Yhp@uR8Q3C zK8DEa_hIjI3yTWN<(8d_gk2~xDLzu3h}LAk&5p??%g#+`q{!j%nc1x?>=J4d-Vr%* z>J*o=R-Vf!;8w9PZk=mGGh#8SiZ4#UrV@3u+ngh=dR1lqXQE1QIm2OdnW(Ly+27;F zDZTAai>J4)Pm#CXWpmH3Z5h`zXP7sh7^2vYw}5ZwjmypGjmYj*dQ+ii{Efp&>89Oa z^w1H>&Cj7F`L()<(!TVgtiNqDO?{K&YHK>%H{GkfCR<&f0;U`!_7-RcZK8xK5a4)Q^NjdA>OLp~yHB-e=V!ts=hKHyAQ!g|jltagEWrL{AVb zZU&JOp1;nA8FTYB)|(m5kPVNaj%b`Hlh=WwJpxjhKa++PlvOIhepv(=^&({!y}RhH z42B8<%4u|hC5ak%5RZ~eRje<~4(8V72DZ-oS73o;D`gSMc_)|StwIP11PSu0`1MrM zlt-yQo(y_9QpeuoW!#>)bgom!Y38s=z4kQy_3LUP$&u3$-JCPN-;Ay*Ryt`W+Iree zVT@&o?ZdAoR+63s7+I`!R81T-jyuI%jP+Mum&NnR`}mZPOp`(up|5Jq^@jMWZ4OGV zhWoZf38T!D3b;*(pLd&B>{C~nPl#`cG>O`?a)q9LVjYoAk$&ervgXLSE8=QCjnunk zTdz!;x2hu^@05%bwO%x|bhuwi^Cr3=nmEX&=IQbQx=X=AOk%TRwTU~7GwOfXd_F6< zi=_%6J~y(jv8rjm9W*}~Fi2ZdqElK(i#KXD+e^oLKf+lID~1;5rJ<)koj+xqjCGwD z!}%48?L^m zdcV@#ZoyStkQl*8WdA#_c-g$4ZDN81c!|{66uxY?cX)g`OfZo8-0drp41Zt$! znA6;0`mjkEEedZEsmcsfB7& z4!Wf4@y=SFTF!Q^cmQn2@WQ+LLOx*qamuOZN!q`{;9%WkIY4~r?}~QduTAq!`bi~~ zqs@f`qw6-mbH%mPyz296<7Oi7?@vCxS6PA@j&4f?%YHtrH?y&;7y%DnzR#4sIZ18$ zo@2+P%N6&_$2b0z$CUCXs4I^CxHoIpp!GiM1cC$!cMc!rK*Q_)OYj6Fy>!B;$0+?d z<5qr$cfKxRc_7gCrRA*U=z{v?{H3D7T3T%f^DeeCeax7&ec@{1%3aCP?W9A{+fkyE z-P`)K>Rx>3X&whmo$HtV9DP~#Shu`W!ntm8e7SvfHGK$(Ui}^0vI171m$7@ z@N>z_@Mm`Vo5_cJ|Ih_+9zY5L0)ycgV&MXXI=Fstbn`km zS%!C@J1OY70sutx{{RrIL3awbKWn3@>!z!sEMnnk&tYciXb$D@vUmE&4nWLH1WwvR z-OOmb?Cl&}MZCn{{!2mxPXE)*`IhEiB5ohW-|DKU(|{aZpfmy;TpV0)B`|1cXvADB ztwc0rM=Z;8MC;O6Ee!pZ6B>B-^A%i-u^&B-k+EX>Kp!^y+L4wqne^>%PG^I~^! zrTrfx|F0bxsH=sGjgy;=qXW%9cFoKk-QC3BzWryQ|CIlkC)CU4e@Aj~{kL0i2RZ-Y zaB_2SasJ0PTvhC!UJ-R0FQ}cKjEy~f&ER85a0~E={Y(D;$NAq8|4UQ%zcmH^Tl2p- z|6fflSEvif(H=geo5cTy>)*=%&HT5b80SBp|JO?V&ock37rxFC7-F3NiJ1h3YG_CT zJd6}JGHRM|3{SFumG|(P2@d~YINu{>BtO4AE?m}5{$sYN=Z$Lni#JucxZSeLZdG~0B%dY{u^^*vLZ^2&M3 z@W>X^EfZO8#?)gzDrK7DZ`S)lIbqQg+`&6%ft*K00}WRfVn}G_qUCaWPp^*EfgIix z**K4UEeN^|{MDPvXriGb!k;{A$`JQ1eedGk42Rfs@ja80(*uJ|6IGWOc~wvS?5=bd z0Q^xuHAwwLq5dlhuYJEf*DDff-c%Y=aUVB%gHoTFs-n@cd)l%d<=RuUUH;of+h7{7 zp~mrzhgyq(J$6aMAld`}oJ1H11giSYYe@w8$#H;WNg6b3sy`MV zWWrT$D>+W{u{*Wo8-<8lx4+-5dUnUjC9`a-&8WPueHO?bd+!SdI+86HqTF85=&SPm z)T&`NbiW}QSdU4G8&g*X8R!6{jeBw zsd;j81i8#;A$cLM=w?wpbkCq@;|ER=b;*4tFa0~J7*nzP4PN`cjOiopIu7T}9h2>Q z>v2WJsiIOzk87-8k|};dJY-ug|5#0mYpHrO6t=N^cLar1EdRW$JqC^!j}p=piTQx{ z+TTpxmr$ZjGKi@k9*9Q=4 zhcYW^((t3PeBlZW(lj(N$twswKOGBnM-99fGc^=snx{~CT$pgU3=8i63n;x;dI_cR zQS!mIDiB_b{rPTAqcXk+Ve}^r^JK7f0QssK%hLCx&0>h-N(RQx+L~$M9g*r|ZES-q zwpE|uwvVNqV(QtiJ@Y$NgI-@`MZNEY*_Y%(PZF4N;8Y#>Oj4NGQ&_Y`z$nAiSjFP! z_pHa=$v8}Nyh)S~Wn+%2cAOPRI(XTmQAW00&^Wx}wZh>oDoNdT+mu~{P4m?)(<+X*K2U>T*zruUA<^Vz# zw-WQG)21jYTJah`=ckH5=6)!a;~Cu1N?z5=It!ipk~`U@%RV|AR=c-no6ask=4g#) zALb?^`#w%IZnl8%?|IEd^GWo6lm3!+g~-dP4S~mR1lO?0uGFZ1xCt;V7+u;ePx)HO(zB=&umb)4AdLi+8+-rhR3M{z zuFpjTS~;`BXOe&F{ zTVuU?dAr9tydL*hQ(i=)6!l<>m_jHM`N##04$%OxwDlrrtk+l!v4E4eR4zJjR(=(Y z;h{;D`N^(hNtN-$_RdS*#OxYh9I%vtZSlkKgpfZ_#AE3MYF3OG-XV0}9sa^~HY5?V zA>~AP4ao60$cb(<_DO77;$wn-e(HKj6}_J_AsDBVmz7-1sP|C%@qI3ao|2KPfwbIu zT=}nxDjkXRp9v&- zPFvkY(cyY$8c$Y7KY?Ja57v4I_J2g$tatR|)V=ylD{n4tTHD(nBqvvS!X5foQAfW{ z54TvpR{84YM$qF+V?Rsa7=!>;o?o=;Z>{Q?-054&FV*MRV>kZgGq8_@XjwEPxU z!g#fITG-ZP8Eo5gl^@ewj;Zs!HqdXb7aa}A-5XX>-^UStQZVZOZqz2woN|F(&==^X zIIooI{Z(^Yt2eXp?w2@2<3QZ52F!n}4@dGas7}X_h-rp6*yp#3V9VXbj?!|X*3oFJ zbXkNJvh{*e-@=^v>R=@)>5ok%VReW3+Txuw2kczBh%JR-k&mhyRc*&2O&@-}&7!;3 zaqiAVR(z(p=WJ!WCHq3Ahn#KGB`oQ*)?NAz1Ev}}f`y*a!3VMJmYxbx5Hs6L)G>4p zZ+pH!h=gvFr?&|PT4!{AdyAQ}-~^rjo{nw3KnrHyj+^HRsVf|kJ#0T|J*dhJpE4PJ zBK?hkZW<=cvLV5{HF}TjO~o`5ui6KHZ{DxzM0=~kL^GRTBPPeelsG%+7B92wO%W)~ zvT^7{*w648l$~(IFLBGwsy^wJp{3X=Fs^6&4bk>2qUKLK2Ff9g>zMe@h@UIm=7^D& zFBT&wH)1F>7?>4Zt$MEd_tcGh2);XdS0>3RM!oz| z9uWjZMDL1|<9`Ue(=qlgE+DVXc^K!(*94VE@a{b)-QOH7{sGhip{2*%Y7z5zv>0-a zv%tJ?ZBs>9uK412n&w{CvhD$+6L% zw6oH2%;wj~$@7&Hj98C|h#0?3vDa33@<@9>*VEA{!aoj4!KbDpd3He~ZFo>+r^B7c zfW5uxw;2;^b3Wz-Lf#3`d?!P&xa99@c>_H}GGDu$XKf!Sc z+G~X_stSV!7F;G>w3lwK1gCc{ktc{_$~E z9a5oM5QMD0jF%nuJr;BRq+d76jq@DHjJkBfMqmYa4Mn=p)9Ok2&t#|0zXD7ZA zz$uQM)X)(~uCWg|vbJqK zqle!SGx$v8)=2Oe7vE&C>QoiMk_XYH-O(<>-FPZE)7kVknx*4$bdLPjt`)7i)cv*g zraJpzb}gPKD}(;qKQcAsbiVVJB-=!j?2s0{x`(e}-lGJJ9N3R|n?4oMIaUbYx*R|JU-$$>@PHpUi=Ali&Z z6`_H-u?K{LnDidBY?Ss@J#1Vq2tTFexx?6-1&jlVH?^97S}5|D?!JyY_tb9;(IBTP z3Re$UVCAYY!?r@F-32iU72nWn#ZybJ*srt;JA)Zjs=Mbg6z_YL%hXtL*;KE``p>%eGv;_p1FpiwbN7l_QW$@&BjKG&qsCf3k}O~<&*5OjAl;iS>s+e`nwp32= zc^(#p_qMm-?PQZ;8|pUlY7Mb5S>TrYW!O5WP~<}IP|c$!+g=`x49h1hqZIN3T8nG~ zQ=TYd6F=w2mCd`IyptfFk+U9T3G3mug7&-VSCu618B$ElimD4$1SFWpX~(e11&VTA zBkoa)hF1LhC4z$TF*|R{Yp|k%pmj_ z^6TDT-F`uc*1J&JmrR*vOOW4n2WCJ1Y2Q$LL@lPtesPv4zZ}yQLvAl|*B$Jr!r3+T z4J++RJL_#KaS|x9K+s#lk29VuMnKJ_us|;n+IqqZfh72*NPunk8ecAuY}gYoWz%QI z)OTLB=0LR~0eH zpm_Nyb>|=Sd_9T??9BHf;4IZv?WyX#OFwakvyB0V`^&umH>eqK1dAEfvVJIJpeE6c zNctQ%4fgkqs@Y?6ZtKt?K?;TIaK2!d3^$mPS4}6W*a$7^0S zgLUru$>X?XXK)0)E=vxf=#eG1cKbB4cPf(3I}^L*8_0$aR4z7B(prFJgv}7KRBr>J zC#NJWNZsmW8QZ~!t|fwtX|V&s%S0Fis!w7m6gwQ@J?=I((PX$B59TZ}MH1G9m7rw@&^#_8v`K?P0Tsm4z#E%Hclg zd^nz#k8K3q0?+nJ^I(_3$X06ksMD1kla*z_292xXt(c3eFUYB|1jfpCfw-$hF)}+h zUaRq_9+^^}l-ZKxu2h0g0y!s)Y?SUJCrS;7cY*L*rI(lWUueYe3&+TRu9S{)gnuZj z5DYzxpuNVMmktX<>%e`Jsgc58C)23#=Bpwd?(4T8g(yu$tC7SziLQ^&7nD!S0l#lx zOIJBnU;ZqYPVOB&8s9Acg-uCzfj)3iNCvcP!}qR^IK&)=!;St=_wHWjTVVJRRlX5B z1{H@2Yiw+6UZBZg8G~BFZ+OZ?U;oR#&6j9;9epU%%l%aaQxngYwhlC=Y%;A-jValF zzLq{)%=vVo)Fs-J2C+%zad)S6A}Qh{ya&-kks=Su$nu$E86_x+#^o58vT( z+n;Ox%;(EJNVCtCZLOcSRBB^qz!TZ+R>btB;;SeD8XZ!XsRSx<43kd3OoWeP(2vlN zcTfSM41_n0$=|z^zMt39Hria$L6nz^psbVw&Wpo@KA3;w$OU^Nu*s(>XA_faF<>-`maIg3`n++I(*uUSpzESpP0J@YzD&rNPe_9#&G# zH9gv>KSxkGqaITSe7msPh-G_!$q! zbs4II(tCDsJ6&$IJPGjzLZP`N?GAyo_|f8u>v}TV)cVGnDm%^6bLS-`E>|@LA#^ix z6U}cfm3mDoQXw4_OaS{#)0Ess_jvyK*)IPFf$*_wS@&-azzky4`jx#>4dyrhGhwo~HYVj}wtpd|eC+sKkw8 zF_jnkaa$2G*=WCr!3D1HHz!ZgQO=y|pBv;VH@xci9loZy4?GHdN^O_ zrQC2~PhmZngYT9!W;45{nZ#KGmc6=uuxD8T147=9(lTh z$Gh>9nWcgup4fe%s5ne4(v=CgPt6Y9V!qdhnz;ya zE{8x(?|m%;+fdz}{qJ-TJr;O8TZS?mSK85Ws3nx+zSoL1Esqjflk@{dij-l_4C%i+ z179SN<$f?VUK0_)MuGTxm9Z+BOAAW!&U%z7%>9i?lQI8zQ?oLZK;75y@sCv;cUv|q z(D3yx&)RM(g1XC9(D!WIgK8uU=+b*p&*P<+L-U{%9sjM=5~EaBl}zlKPWCbI4c<6Q zdThp4dD9yR{_o4}0?oD>LqIv22mXbf`sd5i@Yy^dIgp^w()N{ILE>H3erm*>he0KL=f@>I293!Z@e zLdpygE0KY1j>Y?XJ=6e?@SVv#;wOAdB1I{B1x*GcQLb*Wz~{$$4ugn}{o3=|`UMtN zgRsgbQ=VWgD&M|6E$Y8(*R+gc^{M2Sa|ScKUR6|1r7?lcEb2p%EC|v+QwKcQw5eN= zfA4P>Y3altw~KTjCkF$q2tNej%e#=;Xy+SKEqtpD8PEZ`tRpEdmKwIfxBTG`Hz$*1 zqnASOS?N*U(S6VYdJj&t>o2Et9=1mLVwW(~?Dqq9V~IIq2xELl?anIWKmMu0hDQzy zu3d%HzK{R}NnqCUkRR&uxAdj@dC& z8&h@fG50hbu;UTRNS-$$$j~g+Dh3bDw^m5o*gt&n;9|_xqs!17`3};Cl_UrgUl|p2 z0{2Y?kQio4U{=IHput{;?~SeFQ0y)!+5KNOE@NzR24`WOlR)>C?o2_GnY947WrM7X z>#x|psIEL?Dj{I}cO$YFh^Vio5!@O8%)6B1Y2DLd_`G|59*1-9DMHi4GkUZqzROB1 zwZZ(CW9_YnZBSh|I!biLDHL?I;K3K(XBV-i`soaJb_SKpHK&p6l0q4^ES9XYD&uP!$3NmHFR_SNJK%6t%7T<8e?28DI}-2n#3iO;|CTzaW$Xj&)( zE0NQ)Bk-m3pr-2n`r*7aheEy{p~P`Vxaxy;Wa+Kz>eP~*+PSSGvU2N&^^W%|8%5Te zrsOZSUA7(HgGW9>{@(5VEk|^Hda*M7P(d&5h^>WdH`D&PES)k{Bd$ zHw1>{Z6|@q@kAZP2}NtuDc~{6Ssko>e6;V8x0_wwm@n<&LE)ll&Ja5%q|EFLLfcN4 zsx=MjAYB8ll}qA4s*61;eSjqq82OJ_ipx5(6}dA6h;-H~{T3J<2oQYCj7N2`CLZtu zBF&df_4a{RXm_W4KEEBcpR2b$ARS1&xd@H7Go2HNYxh?N@|fm_7g9l_o(mV7c|cUx zM+vGeG|F+QR{O^s53Zq;O{w^wJrqTYgRAhw`M<_|K`!8zV#2dHQHJl$0AN{FnJQ`1 GkpBlno(> zy9M|*zkA>P?s@MoczsSycUM<+&s6nPSJh0IhMGLyQ_80R002)>K}Hi@SD~Q<>k0Zg zsu0`(0N|?G0)ZNeKp?$_o3oXzgCzi<5SFNmsi)OTnrW!1h(#FsF<~T)o{{Ba0-*t5 zTb3{}<`EW4SI}28c`_2ChEP*kU8(1DPkYRO#t_SQyQP*DUw{7OBHisvBYc|-+weJo zfj3+3)2}wu!Pfgt4*@wq`uL4+27qtEKQ!6`g&%T+ zcC)#yT|V?JQ6MD8uXxr$F*@H9ijnpWSFybB36g*_dHrOKVKSuFpakm+Rk<)j7Nw}r z!5OY_v}mg&NzV;TW8427lG$bAIz=rhMe=L3Fo{(stCY%Tq4KwJS^pYoL{a>ulgO-2kCN!?WOpC$dRxWA^M;e>ffeSgKbimZVE774vP-?Yg{aEZY=NW4`VWgsAGW9m`3TZskeFhnqr>1f}#Y+}xo;gaz_dl=#7A}3%z z5=SnB%N$G;7zV9n*bnzvdv=H-D8?CT6USV;v{Uy~v0)XXH)3)pbW)9d-W%d2OzZyk zb~)fru74WcJf&Uz3Pvr#`;a~%9KlCXwe0C3;WusY1^RxfL&HRp^VfSVvWJ7jl;t@> zS{i*=UnD!BmkO#rsx=HG+NCXn(X&&h*}f;i-oeAeH!p4&r-KPe5CCB6b=emorx&F{DPzwE8tQ_Qvp4|7b!M9?8$(q<&PaOCrr78uqfa131Ry^A!}uE!J7{*E+7_r zD87t$8A^|Zoz0}u0pO7>A;j!>yh7isKu8qO!Pu)n85gGTjD?p5cTaTDNJ!}haWmTcKAj&8Hf^8X; z5!4>U=fVvkS|kjUA^jb^g>hlV%abM)UK>#xRvYd4XqB_A96 zOVO9A3E>H9eey*D6Tv88WPz0ynMQvhWSnnYbX=E`k`hUoNy$S=6nRCtL3#6L$aa3p zQ++IZX3VqdeQF#c9T5)w1Pwp`qE=uycDv1X>U-_xjd%O}mi9K|h1Qs2d>PwldVzkS zewmm4iE!Yrax)i-c#6*vyj=`kvT`+~vi%0(1uP?}#oC1snVn#rG65~02xtN{^PG2Y zVRo}R3l-yD0{P@FBNFb8*hwGt>gh-!RiV}DG3uFb6KmfcXF<(w9YZQ1%8&~bV*7k+ zd#et`f*Kqt9v3Z|YWt-($sxg>T>S|W1Ial15OjpKk98E9$ApqIqCL{_&uwmL)@zaR z&$@eaOYp=YkUo$)Q2Pnq6AwIBpiet_`*v^|-Y_{ddYookTvO<$#d=$83q`ivxm<-@ zWdwq%n(~Y?jXZ?BKSGc^i+5k(1N<`0BCX_&u+^w#AOG2##FWxE;!f9?hS7tTn?L(! z3TDKugkwt4ybS<54v?sh@7ZGJa)T8kHA~M=R>=ur^IrieG9rHCQUR zkm9tqK-y4U3xi&`BsWaed3fo0=XyDu*0%lLkO3#T4tWuYJrvvY67XrhaJ%Tc5ZO9Q zuF3I;x^OxuSaawK>)s>380nsuU#=W1XiwftLpDs*v=0xcFY9hxv@ZPut+$NbV^2k; z4KB39XqTz!352K*lQuik+C`s*J`R4A^a$~I`w`0{?MDkZ0t7?2rFi?;t~hWKH^u}) zO4|BYr%#qrxYwr+eSV4kLI!2v7kuvitQ#a5S{@xE&mSq@9TExRyHm^6&gK8f@Koj~ zXHsS%5)qb3daH%Y^Fkz_7wNj2GCfmay_VvtwF>QS3L^*wJ@XfB6Oe+B#PukssFo=D zrae!o5-BwQwS^6SVWc3SlEf^SAEQa615Q|SKPw}Z>^y_ft)n=o5kEr3>KdiM)Avgdl&VNQ)tau z;{P<$@8&PF-N`@eY2Oef2{nuR#sea|+p2lxn7G7tKz2#`p0qJ7Q|NXCcaLI};s@WJ zHCM(}?(5pa5dBMzm6D_xt4gwgX2}py>p3F}r|bD7FVYjz!JTwE-WG2Rh}6(0P#aS?9sQYa9TgIV`Ik(tBS_UF0+G9!=zr1@PVwLLhQTB3PJrQhCk2G>e+UN zlIxNj_0^5bjF#TfzFVwqb8GLz%X;CGBVnCQ@5>s7W@!OGBRMwW-72jqRXPFCsB_re*+Dj!)+ zgW{6C+4%a+(Z$xLNJtc9?!4kWaUb(0@#bDA2D*IRb{NPRA{2u1tGaew`+!`D^Un3N zf~f;_fb!;U<~OnBOq{BVsv-Vv*S5Nq`rwUsO*!mQ@1i+HCOsMtJrA&F!uI3gtaJz! z+d7!tufpO2bG4cbY)SC`=5m&L#zv;N-_WMfiC5W)yx+>7QJ1z`X;`u0&I)M3PkbJ^ zsN?^8&1{WjSXp&%Z8qBYyutTaX*n^g?6}ONmelLVt@p39G(k;g_xa}wzTWH?li^EG z{cb#c?r45x#5EXr^zTzF6kjjwU%+VgY2*(u7oA~*7t80sm3Hgs=g|@nE^ifoqw|ha z#X+s)fRP*lFRP%7x8*?iJAf>BiYv?;|&<`!c|j z_ws4D0F(U(A2V?Q#Fw}}976=Ut3e~yf0iYx{TXZciQ(g{v6IoZ7B&>$wxAz@bAZwW39j?~W6I1x znqR2db##F7$XpSqfr|&gaC*3QfbM^>)Kj!lRRz34x3K_^Fem|!(Jc%#NMKO?r!9x^ z67cXJ`~v_W#1`=A-!y9I`frIr!(X0%)eqx>0hs6>5gI(dKKKuH)z^prX_uhK08&~& zMMZS2W$tEa=>)cMcF*Llq(URGT@>`e001e=U%*h*WIjaCKWY13&s|SdMa10Mk?Vtn zvzaBAr=!c?c>rRbBIu^0rTYhZPe%tQu!yHP<3AK4==NVUHzWN&B<}X&jC!gX^gw4f zOL_sW*Icg|C7#mL(~G%TScz!L$o-og-4kcDad&qS;pX=6@Zj>`<8pSh=H?L=7Uq7< z%gxKniKgHLdpWs(@Z@v?GyQ9l|1*z_CD`1}*2Ue{*@^z|ydTV*A@1UgjDHvUPx;q< zT6)_4?@CVKe?J!b0lEK0dPfG`V8CyrR%+PB{@CfpX{X_r% zjQsD4|HY~IUz|d(|C{r_M*eS3ZLp;q(Ag2aq`Sobs_Wm(|2_C`MltTcPySz$_?MXf z!J_3X@l=faKRQEqj8o~+YNWQ6QGbuF(VOg_qJzG^M8n@24a7eRn@rK+F|n7TjMRHi zjNJ_3?;NsZ-8XeP^kQThE?zIchxUW9J6MP!I#}MgKIVB%^!`2JJE_Nbxcnn;aaAWq z^d7e1JtFB0`SgjZ_F!qMWpc?gKfkD9b8#PDm&~>0qn063ecE!T1+K3zILN%8C`=s< zYUPqL9hTWL=8Ye-<;PM9$_yxJ^-Kd-EAl? ztzjW?QQ7+ptR~IcsVV(>_~Sw?s+{;;Tlig4*@4QePbStv)NmA=D)zL;GEsGOiv@yv zM{cGdg9r9PIy!7W)UhC!GKW2^egbg|aHzi1L8%5UKDDzi;u8qFA*@~3`iYac(Ze$) zv&Hk9=DTBc*UMD?GX>X;9?qv0lUTy{K8k|12XWwu}GbUpbI}KnHt`GjT zuKeOG5MShb1)gj~DNo0-kkjdps1Lc{-RoWIa}1 z;5cja&L5ns)*f9tnIyavHezfOr9rDWXwfOQ0FSm*EBZNHPJfgP^3#W*Z*}l@fm#{? z^HPI{Gng7Yz~fkoW64$_USl~_5PcxC^?0kBM`08(d8EiX>pgv=@^TNjJS=(dOGuR5 z<#V|bqRX1;X$EvUmFNY(%ZJntl@+I-zmP8Yj-Sr0YBH;u23iVl(Iyn85wwuFyIf1l zA*c{mA13+qO&*Q_^(FU+KdTR#ehXzS`%x!Ucq!br1?y3bAr4ZrdUcB6)i{hWy4|T_#EZS4Ve- zjGtW;iCcH=3CkPKU2T;OqnXGR@*kgWz$ZldRMevL0KwghD@h zJHAI`7cfVvDq1+ONbb(Nak2c0xLEXY?k*YF_S&7RDHB-57Z&(_FADyZ7PlnQimpWYie++FXK1%lj1yX!VH4d+L} ziKJB6)UFdczswljvEiBLMEd4u>FQP0okJai&P``J4o-6-!ygXM2;g%>F#n@YvO%CK z&^Tz6l^w$78t~G#v&WatOg)H;VXmEP*|GFDE6UYv*37y`>^b~;pP*n9c<&3ug|PnQ z%zVP6iwcd+wQ_jpQF5&oL>kLt$!uL{hcY)g?5+7sCB}AP3p=q0eFWF1h&5CNewGNL zy}3BZ`YgQdiRGgZTZ>YvAl8~o!Qv!R?t9*&*Yuur57kv#At6${s&O-DTwy=!VVFrk zPFJ;;kN6>`vsJ6q-K+=bP-|djm3(IKJ}HLntL=oQFtk7A5&nyp$-xGAwrO)CV&?CZ zNqt~VGMnfX5FB@;q=jQyNxx=sUB$in|Bp!)r&dF?rs;L`m=I{UBw^&}wrO#2@ zO;^LZi?RAHzKIBb4dv5w_1fisp#Vd|tx4PCvn3pii}}eyOM9NNo`oI_=sXm=jZPFw zqwyv)st`l*+tc)3LJ(=QI<~LP z9G02&_lCtZRjd)Sub&y@diP-IK6>v{^*bG!XS}RCyWn}T;DI^!aOg7?tOY}645`-A)u*t@2!X%b(dLV2O|GdfArrPtTy3x>SipnSi^pb6hnm7Zd7h8$@$q%!nkYB$bw#Xo9iPMB49#TEZrqf>2LE}(s*PgkfbbCYU!OskO z`BPM}BW9|GV^8s(iW7b9eDu|1Syoh}`BO-Cu2`J89905-U&Ja3TZ9v3I^O3DK;NX)4FX<^CK4IotgMVsT>8(uB(=i z@pGzeAZbJ0`4}@X>tdY)C;c~FcV}R1#@$b^mVfJtC!&+*QTyPyhCrbBH{mIl zXcaPeh_^-&f5OR-D7TL;k#qxu)z$XlLc5pEF2t&vkaD#dZ4gw`6-$H#VzquIy#T)b zJlc3S+nXbK{|6ma_Cg$Iexwb2)R?VT#^yw@)jf8T52B8_*hmJM%sr0pAnj1l_&Bg} zMq=Z8I>#(cJe=%DDx1P{-p3(f9Mq+*5{vr1xb>!oszJIetp{L1)QUwWaH4b@JN+%% za#;K#9hGh*-_u4Vqb`0nUgsL~!IByk*7CWFFPJDBTaY~bQtQpcAd?{Uv)^`Ja?zBD z4<{H^%!i?&^j@*=<>*f#-rH}{*JJ9E8IfdDQd^q4^(dV2Q6XI6j-)-cicZoRNx`_0 zj?Q7Up`87N6A;cT@6i94jN;6QrcW_i{9F$*@7g`np;DSEJk(X zuE<-{Q6p0>hB6(86D%+X14v$fPlX>U2@<;3?Ys~|O~vKx1!;-O?N6^f8D9h=Zp27Za5 zPL;{8WsxH#Lul(qw>Ilqh=)k%S+92ewiQHOhXXt}4)HwbRKut`WqQy>*HW#eIgDjQ zY@8utzkrzQn5e_ZdxAX*2MjcJ@YD65)~LX*O+yCqguD}n-CcIlE)x^u$~;YmdZzvq zX>Q{)kPUYXn|6QTEqkQwjG&)VveDU8odZWLD=M@xJ9`=E9QR&*Sc8#8OWt{&N39f{ z2T(i=`ZUh-168++a0zrS;`g(PAgaqn->+Cfn`(lpI^ZSSZ`ibvq0=8*eKycjQ5!Hx zvHSKu^)11b6X9%s9>T+o&?ywcTw&-wt&kMpnlshszx1QdMEox}tDDC$;(5CJ+h;G_|5UO4u$Mq&b0&H$!8{<7`qr{ja0%qA1=+2N_9(;z zJdLgSjiO50Wo_5|^S$2)M9kVs2p#Rl5{IXoVd4Xpqn=_W^F@iO_$k4p!fv-6m-vlI zL+3~?KG=X>z2j#Kfcbt%&DkL8&swzPkj{rgsM>g9gqE?`l-$tcQT z@U@hA>sG#A6en`xY_R&IgIL`nt2t*V1$3LI?Y3)p=vW~tN>w_Ch4wd=iB*#OhMk{+QGfZ=Y4G*F-*v{^snHQRA0P9|F*9z>@lJ&>xAXc z^ZDr*!Y$uTvCfXiis^VSK&G}4^xcbIdRs2^Kr*RK})ZUkVqYlWVW*}j&TJJ0^ zb?2fSMd~2^H_g$`!5L^q?!7S!b8|3mf}(-N_>Y3BW=Iti+DcBpIJIGFRbzlm^$lDR zRTA4N7&*LC$EH3p6Wat)6_8LqzgHEOF6fxheS2FpFcEo}bUIBda$ml==yNcUo|vYF zlCVI2cnQ^JX4X_`iwmj}8{DyP%5M}<3wjdfAOAMVw0EXLe;8V&2;H4^0NT>P%0Z9` z?Fl@=dBSi~_vRwW%jLj#9xq5m_C73ciz7BiLo&^@U9Qj@kW!^QFpFGinLq1Vzto}6 z{_ur#po{`w9Fx@dRJ#DKCy0V(t5VE`N*K{2jG0&abp?vg>KDT{J!1(ktH#udFC$G2 z;|3IZLsbaoVwTs>q&zI65NyFu;8BlEW1=5sFjIiF$9|^N;5qi#RC3>J0quOR@&x9* z&G(r$hqMi|v?)LeDk&?%=HWpRS2ko9i4iY2bMa$X2P7y&$(#E2>fiWWW4f<*5e>G8L4t|F&~ zJ;Z0%oh+r$!8SV~cg8AHS>&b`EL7!w{+FOtRIUu#XREe7Aa>J;uCfQ>WA)E@da8Xp z9SZTM*ZYGLaLIxfU2{Ay0NRYR|9#Vv$e*+_9Hhsccxe}YHqHs0#cv_CzF@kbFOzIGIETE&%N^%z*AGl0Q-G%*n=&LYWx`jaB)99-@kvFCdPM@2P``C-o zv0?p%-4h|6yqHFGpCp7W4wveq0V}8S$z_4SF*P%5w;1AkJm|%vHpv&gpM!SmMuJFE z{Ovl@5-*(}64p9)Ga~39(l|Pnh)uJ&+&;Z0ww(Yt6OX5!E@;-q0kTrcz@OczD!5Q} z`h^-J(mN=as4coDdE$@2A9NoJ3bY{@2h zVD@{l|IlQ@ROIec>BuFKyDTm!IVhdu~!e4oS(V4mbB58SzP3^_>p4ezRNl z(%NtO70K8@vozq2SpPuL?q|BaaJqWt2{nBsD_954_J^jpc@iG}mh0N1E-K+}srW}q zR2wbW9fZse=vaAwEV0t{+BMiVxr-%${H``8&Za;u?|m~6l^J5gX63J_a+Ke8kz$80 z1c?u7<#Q@Q`g_5l$s3}XBk0hmY`=C5pNI0j93yrnLKg(9W~jc>~z^Z->!|JO_23T9ZuYEux+aI6_25zawFuEJZya! z7)IXB&CwUNWw#V9~F|-QPNx%DbuKF zzg;r46x0pX?Bds}eyGBkep=R@-xB};_xBkYn4tgw!RX&4++GG-46`g%u)XWYhtJzy zamfOR)=M98^mJnM=&NQqD{K{*LMdk_jmiJ+hdr0JTGc>GCRn>o!l6g7f&dmS(O*vmZkayGL3?`B}P zXHyI4RL=bE-Oa%*S-98Wn<;lz^~~M<=9~TfBtxf}lX>RC8je!e}! zdiJlCrL%;=`K(!F%}Ubi=tUb@PhNqrZkGcIpnpb2INnpRGQ@0fWw>%BcqJ@v`6fzG zWUWyaFHmo5p}KONg=r=J`n4B_?F0u6CbzuSVU~0mWsNU*+;W{jVXDS(@_H}6=xIhP zf|Ln-afpW%s}-hfl;iH~pAoccPIE(A8!Pgev#lAc8eo? zCq@`7ezRK{&ZH3eI_&nSn{EM}KpGEW#b1^VWtynI2q1%v4cUdL z#cgzspOS%mD?~l^jRyIjniu%3d?veI>(+p`vRTYdgyaUAU-VN`1ZH~9_PE~tx!TY0 zSlkxU{C#>LN_K-%0>>m?rwFjHwwwzgK_Pb5DecAiKP!u6Y+fUcz~Y)*dE?kZw1<#cE5JmOxv zMI9oxG+F1^jUxcv;@SJ!0FG)S_?@V00w0m4dzDoi_c0Z}iwq~H6x26P76=*;mazlp zw}@O-G0kK%xCAw*o0N2+xjr!Lq$9M1fwWDyNN#DS=(qJx_nj-v}$@ z4=@Dt>kQ1FCoZFkbDOUdVJ@2wdne97J>u;S(5;FfiINjO*}M(sU=CeU3P}gELe`|C zE_&P9gg3`_V_AO4i_5l!=+iyS+Dp}RAu3V+pdlmMZs+e=wIXrco0~$mf(3s2U8`&p zXVuYFALe>#Qav7`6P#LQC#}50`*GPx37;mTFuA0=ir9M#npKj_EvQ9m2xjtP*Ijot zSJQql^WX8WjaPE#yNlf*%d>dTvT3F&`ov~f2~-_ev0>AqrwL4$ory7dYFYWl!a)HI z%Isl0r3sDDR%%2_Gd{OdG+{=lEYg4(b(#?O9DeI?=m0)GGT%VZP{f*|EJlnIavOXQrCk#W$ zlVzT1*;QUHn-!Xu(Y)i0UVobkg!^Ur9xGnlUMz9@R&7wXQWL}Rq`}F7$Q0XQv8|Y? zCCY2K7Iu`$`Pr0H%PEPvB$%zgZs^O1)}r3kZsqVbX57!0J6k|W8J5Dn`8PghZ!%;b zl+Co3CrbiM(WkKGz4j2pO;>UqOK=dPEDL6de9k8*z;nCh!~8p#!(3^A`~-JH&F7#p z`Lbn6G4BlPW~Z^@m%9o29N4elDK!-4Tf|3B^K4}28jQ~Fmn@}>*1252(r;z9M)E&V zp<6ozemWBCMw^D;#D&QCJJhuzqe~_N95P8D%6Z#y`rG83;vwi(%dUSq)mZXmS{Ipu zs+`S+yL)AxN!!J33VDtWS<~1_^uONs0vEgJ=hX6dE$>-JzgXpZE@7tRK$tX*_Oq^u z8vHCdT&Mm19Ch!bCDq+%vph?-oVhACQ25+B6l zyf7Rty0MET?*6DJTnT2Z8O>0+rm-9?asB-UndW>=_whL7?Qw34$gr(HI`pQo_VXvd zyV}fpjB&&#!E%wd*ioLkP+H&*)1-fl6!(GwtjipzWQd8qbp zi0ff@a5O!-)TrdtFJl#=NOy zJ{>on4d1xqZ?M@L&g=2o`B8Ho^vOtz(s}jJN)4f%8{Cr)0|$(R1x|1A@10+*1Pxrx zzBP=>sz539>h{fN$LmF@I|#t4=G5s<8RDo4{3$@^A%8j&E1CJ@v+9+7+WMFusgJ6% zxFT1iUXs!Gc2+!gvuekWU4V!6lV79H5!ijXIJaL#UItkqwV=&1njJjPut1KMOO~%2 zsJZdQ8Fh5}DpIjzyuZ0(bzMW(YO%w+yRT-3DD~t8!BUxWhZ5)HCr@N*h9sHDnOnhm zN^D@A4cAM7(r8gB!FdxkUjsub(IA0JT*BSD z{u_jOBCm%{x3;vv?9Zc9)opUqeuF`i_CD%2SsC>FWZp)(NUq)xIzPS1^Eio4wFeeQ zEG1IczXjE(H2uNM*%eed3%*?|z_BQk*-Osl*mmEp6z-eC&HYzV147q`^bqsBacB4d z^>z(k5b~Q|!k?Iw#*si&V_LT`qEWnt!&(0{PNoB;RS6e$GSipa=osJ-q0_ z5awe=WFzP8&r>-o8u3^63e-8vngbC{IO%5;^^LFh@yiWQDojEqgj(DLnVioe2lu46 zLFb*yy+3oy>WS{hBL#;f+;E>{XL%vvupmLqwehaes16fEgkpoYqY0d8tuwM3)R!@v zeX@!lI86u_rPv6sqqdGP;d+3hZ@=*%31();Oy0Li-u1F`Fl4=ks%Fov^o_qS*yOsP z?3{s0*oFd(p?|mF+usOH8ZqJTu&Su-?4}}FoSMjtGk?6kK^)`R{ORspwUImNB=Q@J zK-J-ONwNiN~YzZA3bvMt_C zUUAutR_jKwd3=y5zhuQs$rmQoZH!MF^G&fMPUSqTGBM?LAjfIoIsB@t!x$PwtCg^J z_#r!vJVL)+sgc=X=#8T}m}(fGGrKbw8Gk-b<8QMYm)?Jz+#FS@Bp_W@H1cf5ScQyB z@vCFsNLSkMG&5WPb|y86l>yzfh}uo#u87F^mgcXdaxEZj{YD^{^_h}eNorihHftEM zvT*~^+$(8oUsVrUqEWv=L7rR9d|1&UmUy+9{MNy@QpyLCsq3JPtd1X7W+5Z<2=+~l z^Dy<2ar>)o({*RI~rq#&i^R3IJ8n5yJ;HI2c&<|+YnB*}{)wf|Di zhP@(>H;hRNTofnmP}Jf&zu^+{MEO^;IeBF%KWGTDU}TB@&saZ}b0;~R>vva-PhXzr z`u9$S)>KCh9h2_q+Csm`5iNEE%N>!78C{Tj$7B?>7WahkI8xxvRQ+A#$c~Pa@+$K? z;S4sRW^-(D0dBuEo5+#0@7K>F;4;d*b%A^q+wllX`Kat|q!3V|JJLB~ zke<0DLZvO2!lU8S%FR5|QxfSL-?HO5S~sB(C2Z?QYqM>Y*b% zv3lyJJKKe=$}q>-I5=XPJT#=^!j3hV5!HT)DQWUPzL>q-ULLQ^6OFUDe2FnMw&N=j zOE$J%`_!dlI(T@JR&dVN#1Lqc--OZc6_=4>48QlO-Dz;svE0GVi2pqO$C)^aaW6Z+ zWZ-eeLJH>D-#li&l{{DRYj)|)^*W{pg)`OMo01!=OrNeK!^L45dN)I8&u9 zCINC=-o}(7V^8^|huv3Zt9D3if=Z|IviW|zWja+MD^+dy|AeIV9>YkLPA+QS^zUC> O07Y3fnNn%fPyYjPtcEH8 literal 0 HcmV?d00001 diff --git a/static/img/sso/self-serve/sso-status-success.png b/static/img/sso/self-serve/sso-status-success.png new file mode 100644 index 0000000000000000000000000000000000000000..5b614618ff5af223bd7ea52950e3790b4eab513e GIT binary patch literal 13664 zcmcJ#WmsIzvM>rESdbw&gC-;p++pzW;=zMMkU(&^!7T)LcL?t8?lVYmcXxLf>`wOC zcb|Rl_xoGVQ>(42x~r?YyQocO5M zXdfZJej7*<5qxV2(ic}3!C!pSZy>7UWTbRdZdCQVx|*5rXfPG$bE4~^*m!j|;qcGWw?BlH0}%dbSg5i$1=s9C>Ksq{CFkH1Ao=(;)G z9(M96TwsWxFY~^6nayUxW%z|aHI7pdir*~|ZY(vvCEGai7^ODXTN!e zpO7T{JCc{cxQ|vu)*n>)IffX$il#R@B(3obF?Fh&QFrTi z_&1W0kUm_4CJi9&?-}SI`&L&K(oM@HzF(CgZS{x8enbymVFn?UbcUm7#j#W2FyzCx zGEL}ydazV(K~m@50^@sj0qn?4r(BU=p#vMGCXGmEblUiy;=n{1AZa z7YuHEcM|Hp`S$DpP=YbiC5XCtXRhEPYf39X^^MvQ$678Le<0A6m%{P$)0*#Nu6HWs z641PP9kCIh5;zFL;CUU<$dDEo`p}iUOf^J$rX5dk!+P8yem0B;tjqx^D-NQC2={^S zq~zS?8r~78mUj$CF3etKd0Ym#1&oe9&^)}K3jj3qCg=xN*33yC3Cx6XA#j7qEPA!7 za_9wWHz=+v8oTBV9-an#`Fdvm%+i(&=5{yDG!5OyHnZpnQ0vu^xGEcQY{&d5_24G* zV(YbRSJ~qXIo>$hK=CVE_Op%p0fNam2mg$CrD?|tCJOAjE-4jtPz<<;^(5jh->-9x?tF8B(G zy0iJ1=`;Spbm#>U146sMR$|IV4EKGhWG{VF(v!00(Eig&e|gS5Er`R8`vgth_EUxr z#<|(uHxCkBU-ixFJF~|(UX-U@9XNZhsedAMg?7@)QvJZq#|uF>`j!5x=NE@9ixch& zPOuo^c)%XwtpPh*Dk!uutTDJT(&guzyoc1$$7m^(52!H!x{wc4+p!_iq*CruQ0YYJ z^jzm3Sk-j%{$#T9?_>tVx7aVNFW4@OF7PfSLkRmqHpGLogFbQ4F?{0xBo`MNCqF1z z%sm}&AR1m^tW2ahROB?pF~vWn4g>;sfEhqGAa3|Qa2xo*HDb0j>!L83H9zT6tCA8^ zpH?3V{s|7f36U?*o_yM;yYhh9yJ0=yKT$lT(krc=T>E>I2xTdh`@i)sbqVwwO?^CA*t>A5aguSmJ*eNm+1uZ1I{0`nJXSKr zUp(8@tuezW#E@9`(<#a+{rdZ_bF>q*^PoKH1Bq`G=W5=$?H%nJ9b(>@&s zJ^XOkH-j~!V0C46$L-Hu$L(ynU++~vX<1@fvGDd71m*>&9x>17+*sde-o)P!kt?D) zqXzfT1l}n9Qp(85%_){xw$0_WC&wVOAV1}=N_(Fck_Jr6h^!||XLp<4tI6pAwearp zo!YhwN|?ybC1tb88R|CAwV>(H>y$_2MPgC#+gNVS5tUZ!QzI)HQm7 zZ*3D>W}BQ{HQaJtEw388#<#^B66{7?aRrbBc3rvM+i&e}2XFcIt`i$_oFi_nPYX6J zA;HjN;@dIklH^*=a6wPvaq3RXbVJYRAB8pb?c2`PZoRFJ$rtq5h}7Zb9#4ujGAaOw z>?~ooFSUpNZ4h$6>x9?!$osE9zE*v`jKK{U!7Rr*LAS$5Ca`}WhXbT&roTd2O=8)a zJ#+6C=-&C2j$Pmn^;iET98?(@CCM2s2@MR_<9L?ORn6tBe)mS~JZDC1IlMkNgYZci zlZ}QipMA&fC~0oK%49RiPI&_iZ3_kj>Am&l@8T9o9*gOhl9el!_DID~s^u#(?A}9n zp!p`nEt~LxCqL>dt};0PN**(%(b~YISlit0;98nH)>xKLc;43jWGhFRSoyUwcHY~G zm|>z+P8t5! z|GK|to1Y-aASRnlkLY=?f!->9mF|@2j!=cLH8lhDG=_OhGC@+tacshzexJ+QcowL6 z$GBdaFmGH#^ru}okl$qS+Yf8lQi3btCE@U48YO#&8={lQ$WOh{v`{soHr=G!O0($m z?E6p(FQN+_t19EF);oy7X`gn&n#>28g@g#5=I{H7xJm;oc_Vp7d6^05iBA_#NvA^{ zr`j1+tycaIA;S#840#L{6&Kp7ZCdV5>j!}rkcuL`Azkh2o9kw}!;!?M1S?Gior-U( zN)$>fja~LVgIJmL)%4}6C@Lq5rnPqakcL#TRA!r-)o%@bE;9QG0PT<3Hr5#PYI;UG zs`crOZTb(JZ%bGQLns*nK6d1}k zq@xQvob0Y;Dx_~`2zrg|e!Fz7xRmr-f1I%Gdiuw+MEh`EZ`n(5X=g>vdwkPi^W&(D z-0|i@q|Qx?$HkYm_{@rn3f)FR*Rm(K?(0;ZuQrZL_{$z{47W3(t8cs>T-=|@yVGM@ zw48@dNR~@r%O|&<HA7o;bH_H=^r3CXx7&LQc$XvfkfrdatC1l@kkwb-HvC zpOfw+cRA*3BA5HT&0m_%n~pCjUoKus>P-Go*u}UHZBHE1C23u_UbuFWv2i?Y<8ieS zYG-maIV*<=?mo=}q$x8z(w>8_iXLm0ck@}+^-iv~udfGQ+l#zZAfTv7reY%Kp1ktO zz(l~yAT7e1-tBq*SvXqzg!V{VDkOSCOa^czmfiv&xN-kh$xFnOT$xTLwh45 zYX?&s#}8;Zn(zvATPaNk1O&p5e*sbY>xVNq{~0qC4Mz<*Sw2G>E9UP%Yz&N;U94>X z@<9-A;e%(bj2ypHxma0RJMg&(zW)~nA3XoJn&my!zfc@41mA1ODN>2r*c(xCGqWAlz_oj}HwtOrs&d$!v&K%4(_9iTByu7?Dtn4i8>`ZVB zCI?q*$L}so)(+JF!{qK7`n~IR*ZO|9`anZ;$^) zsqw#*?5y1XP5ECf|9?tV2P1n?8!LF1jza&du74B%cjLba1z7${{$DfkKhylLTKGH* zy%AvfkIsbNs4>4$f~%3tOiV!qp2CgnU(esz_!Audrf?vPC>!8{TLPh$w3vvB3*u3_ zd!>%5CsZBn!%lwKFR_i@Z>BCEMABk@EDY8t_gI*_7N@_eL&7r;R6;Vqs@Eu+({PnC z=CgaHOoI9>QZV&B?RUf^`V9d28t@?^Li#AF3O!8!pZF*lT(stn)Cb<@lhg9LTcO>f z%P%)6ytlW{Wp&;bo}&xynVuu*=ZmHO`CJ61^kZts#+;pICAyMz9H&(r#(&V*bo-)@ zO--?EBLXy;c_n;1e`fWzF>$yGs>UdxXdr(vUQkEo8F>Qy+7L%r z|NN5)>D*UsS*|L4cw5jek;TK4%?oN!`cr8&zb_y2L>z z=>QYGJn0tHt%AiD1>Z7mrv#vt_x1BO_9>9 zi)W!49gPe7DRbXn$yz>EbUeGslvSB8(JAWNAj`7Td7sXfEg=*vzPWjq;lC=c-douz z)}pE64rs#xD;#0E16px(d0V{~6n8rIb8RVpvUfmdtL7--ItlJ|!7OnCT;-^ke5A$>uwPXwS6KRtbS)Uo5OA$t|(C1E%M1%-35KdMDgJzZ-B?lt8O>rXQ7__9z=D6HW{7<8eA`<-MlvUmtR_< zBK!@*uyWsgD!%KrPuvHt#i^Pi++_C|1a3aP#$U-RVN7ZZ%m73_dMJ+~8bTQ<5T3Rd zpBGZ|2YhJ30@Zz2Led13l*%+bopdFNna5x@7kyTIk5Zjbq^3dn%U%|qK&DYawL?0R z&5|$3zX8lID*Gonn;UceR$Wx7@#j^wf2=)A&aiBYRf-~oynK6`jk7fL9F2aHOflo} zV>_N|IXZn>^mOzfW1(70YRhQNz}>x0@5i#`E7AfOBt2$Nu~9Oi$d3+wuCdtIUC(-H zV|m^nZ-I?fr zs%&9jC9;h-DWhJyC{VW>d^Vk~ccp`w_ieiw^$dPo_%2WxDvTFdeCR%x8R7X;@)SM$RT4fKs?y(hGPz%~$-g5x%X<^;E%ZXn$Jm zzFYb@z78pOQXyKAT@w%0qFpodQC1nJm>Z-~0%PD{bwT>`k#qXGUY++$(Jk!Od-aw` zex11~*rYGP>FDAR$|lnWl51to z2m-Au#G+-V!enGLzU^u^du=V_%#Bnzv2!8gHq!QzH!4hZk4d(a)PM2wv`1A#iz?_I zFXu^Po#!3PMAKDx%!!cxk%fXnEbl(2k_Udd@?~!-DsR=PrcpjEhDWmw<}s1A%K@9r z3r;Gu*7*Ia8QsP5_2u=}EBP80iD~9owqN6mG;L^E;ul~+vmf4Ydi_)`Fq7P{7A*?_ zlTQz3R==eMBKb|v!?fCl*Y8n4?e7I+m_B(B%_VVm^ysUnd3>dGv0l1i@q7vK5l(pT z+V}Iar&SY!uYK|Mk zg`azzA`T>uZKGu6{y(EZe!bl5Se+H9X z^W=I%40t^-HM>Zx{bjY<1U+SOTqQ@cwy?LFEqZ43@?x9;?3t5k0o$7Np3NC|&ZtM@ z94xl0SZ%H^Lsd*1)+Q0Mg&mKJ*rkigZEqne(!|a^WCe2bW5@3y)`hMXnAo5D4vt=? zh^2>^HmpA`?@T&dJsU2Xl$o!25R7?zUo2Q$`RL?)TvO7HFDQfvosoB{LGTHrM}Jn6 zyhtiH8hQn{0P`tXD>E*1wE)RT#seo{!WG?`qy3=rWtP13EW_BC^Z}pbENF=;iUotx z+-d8}e&wQuqpK|UJ1kpEar2GPL3+|PMdukJijd4L%^G8I$=klnWxVMf zc*L%a!iyA${~?@vwNd1^R*|*WI23HLede_#w||*b8jAu_DVF%6sp{d9sq5BO8hKrJ znh_$0SP(I4<5<$LxT<=HYN`@=%Y6SCFGoJg(iTA?Wo-gkta6#rw}N z*WXD&eoaVxfFh{#KD66C)jro++}T|+9IDyOyM0Jxs**UB&eb+P$8S-btaEp!XdcFR zaL7V=bhq35r)u8ruQbX=;-eqlm1w&t7{z+O0WAw;qL@wv!WZ*CttltOnW>rnfw#z_ zPu|R^Gr9)ZcR5(a!NSn1bObze1gZyeT`+p3;*!U9|HulYhb)X0$WQYjN1$RETA>O& zp@c({UPT-@?u})UAxtItpB7z61yWWQ+VpC9B9Uo_16>JQHy;j=_fyDEJOuhq^o#RvBzd zK1GXL@gIQGf`fz41{toOFfg=b&t-j>1cX*-c=M?vKk-M=IE-hD=cfF_-^M#e=YoO` zBzHL|2l7XFsIcf3vmr#w4W9~43t5W19iAhb}x z(_3^h-_4?ej5i8G_dl=+vFm5?_2;}kfkG)s?HN&0J(#>_b)5Z?F$klw#aleto9SJi zU&b@u=w3RxoX*S zvrVpUR7OxOR~yN=Jf1_{+iURSCB)Smv5$Ks&;ae z8RqN}nNDr*zHANU@2=LM0w^q}WwoZ|SX`6$pc2eM8xRZ)eb)sMqN*%9&*sMLSSJo)J0~rt5?uaZ_jJQpRb+(@ksLO{W#Tat z(3FxxXQ-i}u0TAw-bQd$T;r0k1KB+JZn8WTAPoD*F{Fv@b2`G$v}8Q_;ao$L?3KIE!8ye-BYo=B6#&Z~0@*^0QJYuSTgp z=dckhziFW4Fg-^?z`%)+!53^Tt8(lOEzn%5J?$iTAh4yI`TBiI=6n~F5D(mS_qGrMrQx~*SHj0qI13tm7ov7xX zlDME$9-9#xUWdn~?DDmX@+darxrQC(d^TAEeNH zOe}XOueKdh=2%0(r0MzdCR0g(?YA~Y`v_>@PhNlCRv($GQSh#rCXQQkSjvg#t>MoP zPW1iYCs`?Xo=AEcWT?PY*KtynV)QE^&;`vF^c??a!dHveNMSLTq?`9 zwa~)4U=!@I#VoDmeniR4>AfPK@7CZ~kD%nF_ku#%vI*0}>HIt$EiND1Da;`1BEy6NL zCRIT=Z6r_az^}z04o*`t$4_UchDIP#7T$`p@OeK!+Mc%UdpD{;PjPx7b2d5$785|! zmT;HpFIbRG1$EPNQkF2oNN=H9oAP3Qi~Kaww(+C5XIP4b}ll|bEJp)P4yA?}Cc z45eU`Q+jOk%(x+l)ax;_PC)Ln_f!7RPFcT~$Jyq9wVv1g_TxeTGC79+jf?xblq zV~?Ese&+m)*7GLypl9T-mw$mT=RAI8nQ|a0h!{{fYxX$DOUSV38nry6%fsF|UuU82 z<=G=Q)-Y7&A3=*KjodD|eLP4EU-TmG`vewEZ2i^gWKsm5OGYZuRZ0&{YrxecN4~ z#cY6TiP}1M_{=@oV(pfoVs5*QsCu(>?jb1`Aqc-xYKP#mhP!VrMa%n~6BZ@F&OgGs zN~|d2xlUJ~w<1{`UMJ8#mK46^u=58UzQdSY$yncob&uqv?*woN0iVFM(5%y?Ic3hP zVgSp2ujo3Ws&)UfMzV&s&ExN_=p}@}Vn=CJm5_`tA6u?P6FMUMXw0q7=7I(9w_+X6 za$yNxNnJS>DWnQ7fqOjsyfo?A$BPXt6{w*U^pu1hI%{nF_h$`N_2qXWRx5CqAy4Lu zlIC1YAIDooCqG>QFCkr__NmR+vPkABK9?t?X1fU*aA3XIU3Ff$6BhZ==JlQn zqbbPv^E;CCJT^hLseagRypNI7n(zZyFB$s>L2_T(8-@8ilbBWjyGj$&=|hZMLqSD5 z%-kmB{h``*zEviA2QTO@@JDES667~>N}{eCdX*{*VOySkcE(F`2dN%SVx zet3u4ECN(5A46B%NJ)F8pci_OEM+6gT*HufO<+6NnL~UmwCcI8jf5E0{>pQH@wxcS zEnstEKRE+ie_e~7N-BRRn~-dsHC~ZtCc>iHq^5Gx{;zblso6&=tHV8>Dta_yVTn{~T4iKwVQQ&J>wBD}5>w zPyu&4WL6QN>ID+X|5zXf-G-8r2>%F(ifPk*-V@uG$vpq&{dAqnko#)v*6Ui##qHGD ztr|&n`8#nga=0TO&B2zDMW}E8gLbmk{nAA+*CTMPw|FuuLb`ID@yGs}=GF{=pYJr3 zv4t=`W%`|V@p)KeWT3WnQ{I_coq^?Khs0x7#tS^TZt1_1BJJCFKB%FRa?+wPf*6>83nX~9J zMETNx$PZLBTJ)pE=RaO#E5HU42hLg_Ety#i{bD4&ZlrfH)jS;L?if$K9@_H-m!@g(qia&R&^SM&Y!=HUxwi3xM{$xSlVl2Aev(b z03KhWb;x*@PDLjs1Se58Wl7)@HHGDWiKO_ll9X0mWbQ)hI8LP^#ICj99<-e|O0082 z^1TBWF+ZyEq^FoIk%bnfOq+FS3xZ`3#iJ>Ctb|Mmwz}c zkfS@hZ%y`OJRM5UVhs6?#*!k#`%Zj)DT+PJxo@zBr#e=IBL}dz3Rmr#k^fAw2YR5o zU5!g#rqije#OXHunEathIkYL-!KSV0K~LBQet%s5YLc!XEe5IRDE}u|I$WG;-FrId zOF^QJkJgkL)Flt9fS+NfNiHDNzoPE8n&=T!^L&=zCOjVjBRA;_Ay^L}wcaxgtm?aN zrTOw=Eyl8#^jSt3ToO3Dp;8lyn1030A~aDlpf*)JcTJO%=w&9U_glNs_It)x!!d^D z{%U`j9_)CE_8^E4%}X|MD(MPLnZYuFQ({Z!p35*p@TDR^7F&r)&1dsE##0&lqEnl)qNaMAz|hF& zV|s(8j&)j?KWzf&DkBDZ;0^z5@$y1NEeOAX24w%eWj;>luVqxmgFb}dysv$o@vevz z_q|xa)I)sL4-MRkUmttkH~wNI$x`2lekT?X_2)Ky_0LmyGnc#bZRvkWLnlKpT>)B(>k*4pQ9P^a^zwUW^8er=gb8XR+=m5((~b3bV+Xn8nkF~kN# zcBh_i7HyV8S=t*-fwUu_D?=wywl8+(=iyudxVP(plqc4$=MWOIqi)14Aw)#5=F;w(1bSU0Xp#)0yJoRE(ZNU2~)O~L}E z!HZb4G*n8DN`CL>)(63q=f}%YxPm-q?NYX{(TAajJE=A&;RC)5SO)FSu*1+-rRxG` z5XArqU4DE|GR+ynYe;v#5MhE)^v@hS>&EqfLfx|};&l=T<9w}5PGqyJgMeozTU^## z{)T50^%0eqQppUlO~oyijz@d5ml8hUcDFwUx%diC&@h*>p0ZXL8#d1y`=cPgNK|mru11Pj9xgY3B z7l}u-Ls-=GfY4N=h3rhe1{qCR>4;%M*Gg`T^Q~YbvZCfslIe??$NFTR+^n&tWNM^p z0c?ip`E1t5JASBN(&Cz)?{_o%^n|b89(IWmT}Sh%O$9^sD3(q;URIv&HX}KRt{^-T zxoi|LVi{plNzIo%3t#?ByRhUUaG~8a3By57$EAfN1bQ3{i_wz{6pGBTAuAVcq+>O< z#kyQ_7!CJTV@s>I8{!85bZ4j~Q<3xK>C26Y5{tYPA#nYTd0r0lgi0h??4H6Tbav>3 zgeZTyg(IDUebr}(lGQ0RSy0RcobDE0YX&kMuq%}A9ePQSv5|4Lf%nFFM#!C)#+SWc zp6oJ91mrfceCSPoWz}}OR>GG0J`1{>4USW|8cKYt9SY5HZGXC1OeVI1g${8VRE>jH zA_xz`lDv?<45Lbz_#0+I5A*_gxDQk9SpIa{mLJ*vl9kv57e&aT@wk35;a0$`ac7PD zoLizu(_y^NHNbLQcSDA6)534iu*P*vNo+j9Q$`%+`5a2A*Ic634HRB9m+N{o$n$I_ z7T(AK2v9HXF5J6kGHt9yw%h5ttoxt9H;v(kwhs;*J{A#HVGI?m_TUy?C_TY04oYTB zX0w#wnUJ}to7I5HHJ&o!ZgWY6_i4INfobTIG@${Mx2Fv(sVM@1#{{)UZ-*0ft9vb!seRc9`fB0;Lhml0fyb~XIG8Pr(HBR>T=FSBDdHeC$wNf$WT zix2Quug+qapO((CnTo%QVTO6%%$tz2po-@M@Oc4OoDrFurjZ(+hOMShN#03Ij)Y57 zXk;R|2>hw})9A0Woh1>jehSacFhSKt@Mf5f-NoB#G)4qKvx-ODL*+&gslwveB@A|0 z!LODE%2wFwE8J8GZ!yn{4jq4@-@lHm@2}x=Ee;V{xbjc9ay1HdxsS=L2MWRNW)-7(v0! zqXr$_qK4DmpP<9ksvbXK6dPYr>I$0(0wdRq@EkK2Yq|92uh;m5ttu_-;SNJg4fvZu z!9vMA+-_$uu@uj^>tOpObe9YK{9 zVuQfKssLNh8~8E?x1Y|~%3~Lpa{^YOnnq)s0!#usbjTa9&vag+0+)XZ3mWL?)iB#5 zIt|5~mz`!U@x~u!xotSObuq1ZyL53_dhOg)<;g^mdii-u#@0t9n^mM2c1(+Q3nh%Og ziXHTS7nuQ5VKdq`>7J-)!l5Wyz#|3Al%R21qNJokX9`Qsh=v>owx0}K*p0+2F!78# zE;4S3+TEtG?e<|o7^%u1V!mL=ySF8!d^8cNzB}tv`Hqu50qYE};g@}0xQp?DP{)fd z8t%)>Wc-Gx&EIBo4Ren3nWPNxo!!f^5~Oi5c5Xu_oWsQIhq1XZ+qB_C)WbAf>bKUGbRkRNG+%kFoSYjGncxvYsR zV_b5&-+x-qiHN`UMWsk0z>@3nD;ejxxD#)>BKnq&PkCRE;bv}EoX-puGwyYbGYJT_ zncM7lu_VDezZkc{)a_8+hx6V#OHA82XMq)?FTU;=boQDP0xpvxj>!08V|l>+f{Q+S zBSg(5HVH<~4dW&o=9JVx0hx0{vST*2`WCB$ym{I|PY<&Zp~vF-0WNIx1oX)YW^?8#A_w)fOAu_)8c&$AtBk2mA8iC=^nuwJ)iDFW(kYxb;hN+ zu?GaocGiLZ@y4luD2PF&#+T-Ad-^hWVWCxDTG<+T*L1jS53ZFGB%W||k2D6!3V3N2 zK_8NLNMLMTa@Z(D+cs_2GZXtW&1?>Km;@fo8oOotRd})M-v&91+-mH;XgCcR(ah|e zUefg`HI!#QAC5`$M4)fFatlRfMc1=w7~T0?!u?N;rS27pZ-%}91p8ZweCe94goF$i zFi(cr$;(e`*d_Hyx@FreVP9zyk~SzU<8aOJwTo6k=d?G!{lO*L@WAbmMmlc({sndF z)nL7bBB2{30r-!wJCBetuLwQdFS>>P)Nt zRLlm4SmMPqt8k7eakclExMwO6s7&`BzfS8a2h-}_l2Tt-?naTZksNw05Z6HvX(ck{ zJ}uhKNLZxRfW_)71?zr}W>GU=ti@4_D~Pg=xjX3RYpf3^c{1ydT$qMCBt(t`EGA%Z z4tcKkX?2!UiH74n_1+BQS&a}lnZ(CJf4OIHPR(KY({zZ^XC%7k z)Q(@QL|N#tmTN>)_@9DG&nl9%k${7ol?Vuw7i?dC~(+&4Ob;R0( zpDoguKH4XKzY}Eh-Z4$QtexBBV7>7Mgh#r7`u*<70t=#C3oFBGq7gIjcULDAoXBK1 zZGE`!MXrh{)^v_}I&_9#C{hkUg%Hi%M1y=cedo5-l1IRA9h)Jc4N8^GGb%yVS>JNu)B|`-2S=;T(Vf*8SOrL~vluDZ)^0E*J741x1aVan3iXtJAG$WQD&WFV+Y*uqhk{fL%A!M+xK@e-X zqBWc1E|UM;U+$U=PXKo&mae2FmqB(=GqQF})N~kX!MBbvR?asbq$MW$?BO+T<|&dx zp9PW1><*gD5)ypPQM5KylqWHnkghRnAw|3Snp!BuB&OlYa&jECm{S~Mz=DiaV>6OM zeeE literal 0 HcmV?d00001 From 1c0749acbc68e2493f8c35196e2396a323bfd2db Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Sun, 7 Dec 2025 14:02:20 +0200 Subject: [PATCH 02/12] WIP --- docs/sso-rbac/sso/self-serve-sso.md | 27 ++++++++++++++---- .../img/sso/self-serve/sso-status-success.png | Bin 13664 -> 28720 bytes 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index f8b58b10f7..db3863108a 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -1,7 +1,6 @@ --- title: "Self-serve SSO setup" sidebar_position: 1 -description: Set up SSO for your organization without contacting Port support --- # Self-serve SSO setup @@ -12,22 +11,23 @@ This self-serve flow guides you through connecting your identity provider (IdP) ## Prerequisites - This feature is available for **enterprise accounts** only. +- Your account must have migrated to [multi-organization](/sso-rbac/multi-organization). - You must be a **company admin** to configure SSO. - You need access to your identity provider's admin console to create and configure applications. ## Set up SSO -Follow these steps to configure SSO for your organization: +Follow these steps to configure SSO for your company: ### Step 1: Initiate the SSO setup -1. Go to the [Builder page](https://app.getport.io/settings) of your portal. +1. Go to the [Builder page](https://app.getport.io/settings/data-model) of your portal. 2. Click on **Organization settings** in the left sidebar. 3. Navigate to the **SSO** tab. 4. Click the **Setup SSO Connection** button. :::info URL validity -A unique setup URL will be generated for you, it will be valid for 5 hours after you first open it, or 5 days if you don't open it. You can copy and save the link to complete the setup later. +A unique SSO setup link will be generated for you, it will be valid for 5 hours after you first open it, or 5 days if you don't open it. You can copy and save the link to complete the setup later. ::: ### Step 2: Configure your identity provider @@ -64,6 +64,23 @@ After the SSO connection is successfully established: The SSO configuration and access settings apply at the organization level, not the company level. ::: +## Audit log + +Port maintains an audit log of SSO-related activities to help you track changes and monitor your SSO configuration. The audit log records events such as SSO setup attempts, configuration changes, and connection status updates. + + + +## Limitations + +- Domain verification requires DNS configuration. To add domains to your SSO connection, contact [Port's support team](hhttp://support.port.io/). +- Terraform is not supported for self-serve SSO setup. + ## Troubleshooting If you click **Setup is Done** and encounter an error, use the following table to identify and resolve the issue: @@ -72,4 +89,4 @@ If you click **Setup is Done** and encounter an error, use the following table t | ----- | ----- | ---------- | | Connection not created | The SSO connection was not created in Auth0. | Click **Start Again** to generate a new setup URL and repeat the configuration process. | | Mapping failed | The mapping between Auth0 and Port failed. | Click **Edit Connection** to review and fix the configuration. | -| Linking failed | Auth0 is connected, but linking to the company in Port failed. | Contact [Port's support team](https://www.getport.io/community) for assistance. | +| Linking failed | Auth0 is connected, but linking to the company in Port failed. | Contact [Port's support team](http://support.port.io/) for assistance. | diff --git a/static/img/sso/self-serve/sso-status-success.png b/static/img/sso/self-serve/sso-status-success.png index 5b614618ff5af223bd7ea52950e3790b4eab513e..0733c6e1302488da6d4e7bef8e818258c8be8d11 100644 GIT binary patch delta 25161 zcmYJa2UHVV_dYC_D_oVLBGLkgs8qqwYf!0*fDoiel~9xpp#(@6kxOqPNH5Z>bm_f? z-g`Gd0)!SqC&EAX{e5eF$(nVtCYf_)@9gvJ_RNZH*$M?$$XiWS+MBF5uU)%F`$|no z=h`(2Yx1G{4;A?gQ*2yWIoAvgFNO6F%4>g<&rtmL9eKR=0;>4x6?ufhT&=7e;UAsc zye%tiD!FLE6qKT3&tl%uNm7c6OT|Rd1pv#*oZ94{f<7r}{detOm> z+1$x{Czs^W^_9{KT?EB;s!y@ayYINDO!Mz9_ij$;-TX587iBcM>gh-li`fQmGv?Gn zjCI5%^RBXTR&drs$lEtHGksOv=G}*<8)?~;huN#ohdIZedjeY7eIMWdP&}n`B(SdU8f~t_sMv$wDV{AdO|XXwojlz$ywW8m2M;3`5|{|ZSXfd4jhjQK=&uc0 zgE#i|CUI|ZqI6Jo8{9b`(S&E+$YYJ5t14|4k}lRJH2P(f66e)Wi{&*xZzw1XNu(Q=;kxB+*>IJ9 z5EA{Nf@P9BC>ED8Tg|@99+hbPjFa~6?5CJPm#qEqo;F^5SaTg19d0RY^Fxv9qf&W+ zQk`Oc+wG+E4MooLk*$L3Zj~d!J$LNB03OmS8D86~lDDJ_`;{FB+!K4xQ~Z)>Mx1R2 zVEX7lYz47$;iH^QGq#+kh|9e2)3EK3E6h3T}Epa_`sG zC-HB)n2%0B)|*U=ZXr!@oBsU~bz0RT9-AU7v{`#?KK{eukEu@XrHHBym79c7|9wkl5-(ZU{Ko2?4 zVKL0t7;S2f2h2V)W3Cu71KX03Z6 zF2mj|lxBq4z07z6goqvW%n_qa??BaUWH|Pd{AhTAwXeopw*q!Qs{*1tjTh4y?9-l+ z^$8B=3kmZgu{*a?{e+mT-+VU9AC3El$G%PZWU^7+#cbZuH@a77BN7+ycWUZ(%Om53>1l9du28=u&x_%Qti`Xw%vS%>yp3l z)h4wxdEPtOTZWQsmlx^m);Li!ce-G7@)d|qt|-B@va9=1J+Dw*L-I9D%MBNM z{Zyn?jE#@S{fpzh)Qu`M#MX%5lN|Xp&7+f3H^Lh_+sGr|DD9JmGM(0Xc)}23$T8D$ z`oa=oV}3_;L=Wprh;${n6L~Km37MM}B@rT8YMW2ngs+BmS<8o0F_ZbgRSy8QztHEo zZ$yVO25yQ-m>^xb-61@Q0G4eU4AH=W)6 zbA2bI<+8WNCX;2Fom=BPoI4##&0<(eY?BUYBQ>^q%JZzi-o&@LMQk?nK_s!ddKHct zB5ys*J*3ryYJ(lZLee*Ch4jq)J6uxj0(N;p2~$`$UI(EJ|t&abk;f>gZc~Yz<9WNJy@TaeyaMn1rK*vxTU)m;h-4 z_v6Sz?+80V9mPoLL?!>JItpw96wK&tQhrrmV1_j2PO^`2->X+wH&2JYD`gh9Ue%E@WN*fmYZ4nyjFVyXz)|8CLAiGrz@Z@6^#{tF4ls^(;lw#d3Pak%#J}e9q zZhS@<#>gO3eQ{}=jQW4Z*VT`x%uIyl4ujY$3J^ywPER!+@}0;~>GRo6|vBYGK9b zEmKnGbk&cfK`|Qzbc$9fWetONy-P&BK^-_sphJ3SLS)3_x0_)wIv61o7aTnh;N8O& zq*P;i@Jj(WQz1wy{OLD^upl2$u6`W4IN4LUUA88*hmS2fH@MY4@jDBMF=pbH#O4-T z&A+k!9QN-MY0GFaLu5z@&2`+d_MQMP_l<{YR+fZK>NsLJF{#ilp@7k|?XLc1v{ttu zQ+&&@==a3pb@@XE@D7~>Gro@PfB zmi)es1JnmGbu5FQ&Hh%5V@?(X*FN}~+ASThzFu3>xU_K*Hs7+qnC2ocx}W*;Dg!aJ zIt=V?{`zaW&Kg$?ANb+;HF>KGypJjvPGy5HZ(ETjL~kdreZ790+ufxuG7O9fV5v8n z;&uT@{$YWFvKNOvt!!zelD4R^(FF0->Cckths}>{(JqdA9X{a;2^W?^u)HJ+p}&(X z=huuMt$Zb@dNd%m2ZHDtH%4-c>7$T@Ab_)fm@nq=hK@Xrv>OAFK2_xPeyxa0A`a^` z(Pfe$CIIfkNyahAY~M_Q_2)ooOC4mLfkk*eb$a_N$ttkfK~oJb7ZfA&!Z7_daxWyF z_WZQkwl%pjjs>q&floTk?Qm-eF2eFM#iaKIC-xo$+B~UW`hSe;ctGX=-F>}HOkm^yeOI7ZoPO<)OkCrnh}@2 zKe{BkwNNB2YQdl)92&ve5g5)ce^1sm`+rfH*AtPE94`;UkNldz#4GGy?N7XV9Hp1r zH(d2{gS^&VoLCN>3X#*rlRBLH6Co{3+SB%waXVmaN*{YGf7)bSny9PsOMFqnXF%6+0L*Q;R7Nub3KIN$ zD^Dm8U#B*r44BOZZO0Lz%!)$`Yp6h9OWEC|UpltbuW7l$GQ(7CnRd9@QVh~c9K{%NH5EDtpfWQ z_wd6K7vOZhz9=%A>>#sMVyLRR7>x5^k|}*m5W2OeSe+Zq28Vi7IAB-zzA$%Ke9=o^^kt<0d-D&`vu$u74fn~SfZr6ch zLf+)1`Q=j0RwoEG^M&IvUC-7uT1X47^NC4Mfs3y^VzsGl(QhR)X>jjgLjECDH)7b} z1A1|J-zc2EqIf#>18DcaIx@34=%BEdGW&B+vrZ5iNMFY~KG~ycRnF=h#GuPn!6|k} zKW@3Xrh!Asx_<h67p?cQb?AnA%eSF{|f{)>r@6YcE>W4g`_ z^!=oD8@OS5-dqEAY&yBGodaqcIC}&e|5TVdLHD%8yCqXFtHW zdFI8U40Y&}xvC`M*Ljw5a8Y1mqAQKBy5JNGv+W)JCUl>ywaE8PUD1{6^HvxMIi^=P zgEWY>CXJ@`Eej{(zD%f-1q)#LvdJW_c_IO#k*K6mBz@A9+J>_JIiAdm_u%)juQv^f zbWf|T1N-QSC=h56ux-)A3+??(_Zt3t^QZ)Ytw(r?z&+R2sZo-cii!0UK1j^!;hQY7 zW@Hq9WtvpdPd+#b<}lQyoZaD*uMdrjSvO*_6dVt+G5=WC8})MfAt0~0R(HE~mCXfY zzbtuKay2{IWwt{ST@cl^@FQ!BiDyorf3b5sS%%Kvd07QXxg#vO-VtoYNHbol&~ zZlSB{Ks9+-pI4!;x08{8r!=*=N0dfJG6?RLD^rlq03U=Hw=A1kAv3e{_b?*r0{X4(I zJwc~O*4m0ED#Y4cEm4_M*!$^ypNWPDf7fCm!NvN|$Eb(g%VtlCsK>oN^%Xbnp{(Wm z2Z#gi8u2rk=EgYhQWL~zBP^1o|6oS+Idq$?c2LVBbQYEe9D?t=k_A7|M|$T@6Nyu? zzs^0=PD3p4*wracHUG5;>FZE=k$jEm4-7xY^{XqM6C-CUzn_Iz{?JOip+2f&8m7nu zs~=FNFuj+$dcX$s4Q#+Tk}D$X_Y~~j?VO^lwcpE>bJ z=7dQYMMiP~Lk=G*-cE=gpEa`S2UNxa24`7jhB7x1^gaDL8b=HRd=iiwf(lm#j?R^Mif2^qoV z+%TrDz#%IfLH=+=(a$6EEF_%rQ_@LpF*nPBWuPRMa@OE1>PdNbzNqszmKkH77x_(LzlHF@)sy&EPm&leDehtkPf?OP4 zQO$>J8CuJyX0-9B6iip=3N%njtpTq;DY(L_EiFArEWv{#Hb10HsP}x^N09`-n|lVN z3`e-BN7u%D!tw%sA2a3^2Sh9fAruRbebR6`a2vnZ#r`ki>%^;e;81QMQRwLGr)sbpfOm(P#QFr zFw5Ix7Lk}lq{25ke+y9G%#zORNo)Ynr#dU4&2-=awHzgU8m zRWnqYwAdYlRIffN2Hur?45;VXBwQdtKHRKuBPf=cXEueYj!ytUDf~gpTPHnrFEAM5 z_Kzv1pn8pZO_j_>d|h%de8cKjGgZEu7&3gi>V2A|Fy z0Bexd$92av zZ>w&C*z&bhMBPIdVdm&3TORSF7mXWAlLXDe)P60#1somA;!${UzN| zz7m8b+T33!CbBoeaJCm_!SZ86hv98iduyKam=_3f@`9)M(4__hQ%jpugZT$EZJYba<3frF5%naefLlt#C&wR zcVm`t_~&zP6-PY&VqFH@k|l<-vhC}e|Jt2W|NTW)0KbI$E#WQydG@j2`ja2exD|wO ziG3skk=y-!ww{ zPN`PlZNp`9B%;OX~>UJH>Y_%b<~=4@f!*ww3Fq^mbx0h40Dk zA`oEebG*%Wyqnr`)hU;qy@ed{89nEFJ)4uY(MJA%7aP6cgu^_A#dkkRRcw{_#Uikc z#TsX2iV}?RX~&aO#NE#qdo6%QwouOJlQ~742VzUNg8pocz0$^#@>F)Ov9fkO&L}ih z*7JVNlDFODS4ndgSn4;6Y!>ef+f3eRKw~#RUGRg+Uh_tBnPbeJe)9n%{b(O>R^8tR z-1deGI4*pCC4sYY=#x=ZY&LORZbsROs||W-K(9hMz4j~4ZabQU-%TLnYQ_!X-1Q=s zW#xO)}t|*9&Wlu$1jgPOQwxH<%f27=j z+QR!yvCCH<7au+uO^GL)|FB}(=TWor2_{_My3A6!d82Q67?vy&>`P-3VNi0}*ckY8 zbZaskuanzOq++%@3F`_mW8y^fKdCs~*prwQhmd~LGoeB7fzXlPIF&2v7#Fe(PJJ?q zs4M>v-!?mR@!VLEqq)BfFyuZ|+7a9JpJ#{$6YJ$&jwbc>YxufB-qs!3_9%6A1k&Ak z)J(!HQkjPnecL}FvcqG^3&&`a=9Sy22}8>R`lM;#JWF%tm0$O0N(*7wjDHB#=i`Ga zdM}q2LBeyDSml!fd0L93&h~BGJo3Q(FWi-zv|${3y+>o_S83V zpBxikn<4SavGVB_1fr=E$3Jt-qDFqN-ec3X8@b-4>}PtIBaHfV$nkwu z{h*2J(?klJ{oBnh9}N|j<(o!-5r5JQ_x#i7X!J3@c=4cuKGg9e2d{Y^_`bwpPbNf1 zglQn|sZppFa6V4wv@W^T8$QvVyO_dMz{h!!@6dGy@F2y$PrXmw6(*`wJfFC8BowOY zjusu{xb2f#5~?jzT56$c(+sDoQoo$4X`WATkzuQ_mc zT(|REGoa;k+(<}XttC42l_XBtu1`i^ap^RSQz*l<;6?nXmx&rW%)2|X^gqAc zcdgLqz8ML_RD}CRT`L@}UU<#jc_X8Q2>9#!$#gpm-Rek>#)$Lo@~+}MPB%{Grkkq~ zOT@GwbsiaklSEW`jO|d^OziiX=H=)%HsBy<>Brb7CF!j)*&LzKcaWTeR>=D#IT@?x z8fORn!ow#q{q_YvbX7()Z;0J~yb%zh`7EkmuGSw;BcZ*$@$c%?Kjqa9^Ljf;ZGc-w z+1Vv5a?R6|PElYx4*#U2THFMCvwF4kxTind+Yzo+2C!jKR9^#Z;&k&LYuP( zLN9aD5jg~_jdV9f{0?Z^72R6|%m@T_9Mi?|FgE@T?I*dkEM><&nW5(8w&IqG)0bdd zl?gmeqMS^mx904K7dwt!)NoTxxNhxRPD|bb_?^GGX$nWH@U_r|az{@E08O?b17WXT z_0agHZL56QQ9~zF#bjbJr+!|{_%&8nHpQA}huxet93ShGy1jChdE~^Yx~T5+|6$Fw zoN{{g+{*hc)!|_PM_4}$MP-qpt#fbA`_RwF{vMYH>8mmn+zKx3-yhl76JZ{#bjMF& zxH->)XNF++(}#k?_U2OnrY1fC1r+=t=T4lL(@PP>BPERxk)%U&rA72Q85ab__q{=y zoE*KYD>R4?-j#~N^fyO##<*1*E^eZ4L*|SFqg>X7Q!j3Xnd)+iZ4x!$2X$*cd%P`D zK()f#iC=e~Dnh52Buz+F!W$Fr9EB{q!cbAyl2t2MUP`-m)(8+>u;x0}2-ADQ8n`O} zkXAX(LY)Ha)D(aA-YUL7F}e~VTCbEmjBg}a7;@i2KMyM28{F`bU7bruW}POdUq0rt zj;j{OS$*u2k-SygE5Ms)l=3NwI(vC9wknRO;PJV8qXEt>amT2 z8isWn7rErE%q7wi@q)e3w@Osy{uFhCHE;F3CHHp&B8Vk$O!?n~HP7z8`t-J-m6s0@ zN+-YD!`I+uOw)enmKpM^d>l!KGTgq?|25CW#q!mqDWGN3<7DbF_}S;33oFw3kP`os+{|ZuL%JRINpkC|Z_dQK)Mq6e z=5&ocX04i z`z%R8&7yasw{S$qYTbLb=>haq>gUD8?=~qQ!sROzoIM_CD2s!@mOKVgkq&pt6g~Rs zA*bd?PT6jxiNfhJ#Nit67CD~VU4`rZGP>-ENTgvIJc)bC!ftT0?8a6?;i*0Km~P;~ zYI8Z06nI~Gigo17dv5!56S#Ja$~9~zR@)sf2#Q>7^E5Uh2n=T97q|atD3r2a*8$jd zhD~EOP~?BqZwZwR4?jf;_`kV+-bU~HY}trTx`2UCBvevDc{WS4ywztR7@jCK5S0E* zqkKU{&fE0Z2|;MHU%ZwuGF!d1XR z82OHBRr;@ap+Oa~p8Z^0PcxY^nSkv0`w4Mxd#N~37?68;+nG%8I~&R(RovmfD$8K{ zbgFHiH^gvU#85N(N0b>}FEDT`j1^`hkQj|=gE2(Nkd)c=d#$+sEAQ}oq0k59$mfeh zm^-;(HTU|4apO}ih0rP7^C-GmK8cg~CWq{2+LCV5B%CMmSM6rWUe!~8Yn~^?FT?4y z0J6&MIwACnhlM?8^id_To0C&JNxq)nO4vLbc{MBHa!Zvu`*3JHl6w zhgSA31)_xn5&6S@nz3AF@$B>}6E2aQ^>$Nie(8VOE^IEd=F9dUhWoqHq zZwRa_Ik-gYY5gAuK^J$J%%0)W0biG`g1mZh|z@*SYh# zN2t>TR~|CQXN{ZFa3|@)_i;XE*LMZi#RQy|BU=(5X#rn3JbH35i#({p8P^S%&v2&9 z1e@<=fAaYkeqOoQkgusaPGfDV$e+eCYwSc@k7}o7Q{<+)*+c!rYRlGJks_|_yEBi% zm{f#K{@xY>snfW+ToKh{69*uFRr``Xg3tN!gu5HBqs7T3{PUcZu+y1r3`Van!Gj( zq7W#g(44^Ach%1gs4J31U>W7Pbjv*0h^M&uH0~RdX;l}C<%!fTelK=aRnB=M^@|I; zTy?BMb+GdNKO3qF?>CG#0wWhvf~+08oF;OMlj={Fe5Rki{IznlQh}iLsOMt?n6)Rr z_V2PetQ6ho-=u?=lzn^g&K#Y4JKThLXM}I zb2Nr}YG>wfBc*xmV-L4m=Q!J!=>@_Osfy~xrkbi(mKJmaRLFN>W-#XCpcD0WJCk)I zLtxIM=>o&x9-7EjX~iRHt*$~3=mjWsWcC>E-hGY0yxn#H?`tCw$R7oDXsh{pcRNCP z6iQHB*(Q}Er(x^LG%X#z`xPvoN9xXNY?wLDkCFL-=kor`-zkzI)O*~~!2kR!NAh8_ zQCu;F3MA5yyklp`pIo-8_|8`OIE%WdJu|_l_UDU5h3=5+!aUP}GU@%uyWHN$ zh_euZEjcDSM7rYD=2{AT$mN}rDd)?xEr;~p^xO753%q8p*FGFwSN1*|Im@BaX)M#` z{9~d=$-~j?7*8wj9*7#$V?B_^P8P3qzwtWEx);-^vmVPob}!N}+1~s|yEk$ZTA#nS z)gh<3dVc7#6W>Bwr(@{^a2G?HRjHS?xcDo-wO{@a>zzB3UyokgE!E%pyjZc?7Sdj6 zM-{}e<-M7&eE4>@OdWUm{ioYNgqOHc9T+On!P}+$%Io)}^54l7{aEmCZi((--$-h8 zK}+PRteru1g?^peyOtIlK)pNuy2BeTD<_3REchrDm*MoK7khfJHyP!uC6d6|SQ7qc0xBt!k8y6@(c zB+cc}t@Xj6OV9Kqk&fXkH*IVj6%NYm#@Bd}hj5#?SpispGd0N_Hp@J6Yw&*(K4LXU zW;3|S$lt=OXpr`yJFo?c94)7^2&-2(7V?d3i!uX=s^lTzoH}JWLVb_14}*{H9jsB=mIp-xZ!Sc_Jb6k-T2!|JI`d z%J|h7-`k4K{u|{RiN;>vgPW`Ju-I31)e5Z&v;NTmFEYvcdW$-Poc^iERc>w~lQK?v zzUMdGdr-OugyS0lED!@DhrL&yRiw>ReJg+s(iLC8RAm0sT@qLr%EkLi<^~>RM+L7-qJ2Ljp z6y!Wur{(;_FVaODr=z6VRTLI8)(}~z^m|cgiQGKYKs?i2)b~cc+)v#@;?y{ok58jp zj+XYAfEGLe3?4#3-hG(sTFA+s^tmu}WN`}Kx5Dv5zAsYEgZ(H#NC%n4Vdz2VG36Y4 zmHXSDkYJt}QOo$$AC&*RF+LXCEw|kX{iv}NNoaRZHwfKbMaIxepan`SBcxPg2~h^< zJ4H9xaMPZ)$Q4S?1Oxcg`{UhZsC^4A7jtn!0u%|uCrcF>%WWB{gjGp0Cj>dL$7BOK zS}1SIz)1&9o0+$qPnJ$C@v5ZDXpJd1;X8ervMsyv2qH|b{1VLCHDNpui8Z7^M@8KK z08SlTr~Vpu+~czvCeiCa(77}=*Mx0xJGS9qwW}AB^dR3k`xm zu08dE!U|L~ywjT~hyBygKKf;{0f_!*ZB%5GU<7qoA@ZNy%NvgsmdV>)1#>^?YtIcV zm7TK+BiX+%8Gn+yC)gsjnTBfN-SslpC-fh zcXmfff|$MA%wv3)G@9=5@okWcydHVqRsG+-t1z{^=R)(i31H$n4vs3%q-05@~U2=f$)T>ym0Nz5{3Ae z$ipC~i~G!8;`S}|3rxr|sS+LDXlW5P-3lnbKjTZqr+RX3UH5Sui0dM&h=tOCk?}fK znFnHeZ)HRk2w$7Hy(A1Gg~T633t6c$P18bhczjbN0~|uNQX=N$MX%(v*P#uTi_H&~ zGx^e1+f8{IAO{ClQo^bI5NdadZkLT8<{4w6|1l&Vll|N`@Yi=-!ev(cm%8hCwd@@#AH3fbkBzzSR zk@~TRT;wAc<&R^xAr+#+ghmyMl#S$X0#^sB=llnZPj95N5%(E1{BrtURTs{@99KaX z_h^>Cz}pW{2e3LE z0mz%#mx8{jYSZTD-DIC|8S7e5j~{~$!z9H%k}Q< z9MSL-3-#}MRooZ$d|8DzvOWb>h>M z`u(@3A;0M`H{So@Wx9$SMITho)1iU{1$^DTF~3)Ty%@LFFgJ;#Fs1JUzCsv~G zLJlq7@cN!A8J_1sjtVA|{Z~)k9h#A{nSZDP)ULb%IMVz!TE9NAsB+`0jE?^gtpb`?;XQH$c%>_XiUEpH4Y1&->n zXv3k{2$^0P)ym_)gG%ALrf3epvu8~!_P?fC8&_T#p8|SvHe`o3QN}sF2MrHNMfAAP zc9ulu{FeX>jy#mG7N3vNg49V}p00*D%vZkyobd~vJoquy#H#ERtaVk<-g3Lsm4&7p+PuP!NB=7IK%xpF1&Jc2AFB>hAevW9hJW41%;1^@n!%8&z4;$7WduYEfQ~ewO(<*g@)V~ zDPl=J=`Lm`@a3iGq_}jm;2qW9-j2zgd-1s;=_lj7t#-{%Mc-X+x$>2A zw82>3vxAdc*TOGEg(bQUjPB2%o}R+s%fawE$3I{?0)BrCul`L_cBiWF)i8!F(6-f^ zL928oT%Jcpk6jC-jjJG@)(IVGdvFe;7&Ia6g=u0R&oPU`R?jL_!<}jD$@#0wYnjpr z!xJEM`7l>f1Lpa-$G`k8Em-wwZa&b zgG@x28045w{IzC{r|*SHhdk~}**Kj3mQ+c$C!g(!^z9L0k*0~yM^tI~mb6pCH;3yp z#_Vd@*}d~H;;rL?`c>4v7EF&h?g82dEP%r|X|0)u?q&#H1MGnT2OAkD`#QH0YPyTV z_O~mCh0-n-aIXJ|D(}^H|N(FbDFLvFPHOg(v@A1ln-fMbx?-zc7slko)P7s}O z9|yQ6)1|frfsvsLx8LV$AiGOB1n;p7r*rgHb&#WH@Kz3eRdAtiARTMjE(1OXcrp-n z#+bbD!~eX|+@fT{vQ3rkGV%p=TbgOd>nyEgB@0&%_0hcT&3*^bZ!Kn-A+hp0%OZ1F);e(;82ql}ib~ zWPRu7m-IlW!_n%kS?hPeR~m7g6PbF}b-Xh_E%e^rVPf_3`a^$}rnOkJm?c=NYy^Sy zC1KeL8=bi}Mdiw%apsS{ zFU%@*H-8^vFnES>nnID9Kkq%Q~aLWi{Fs zUldF11}f~FVs!>@O*X7uT3R@&#UEzE1J@>@|U?F||bp$p?79}qGD?XthZ z9!8s#B#CLuM*chLOw;&rJ{Zo0zpP*tB_v~3Rul5WTrvgC+=>;ti(&{2UDIBq)>j^o zIXn^|xX2Q_n6x~)O4%Fu% z30+L{TiBR)cdBU@$3|4^Sxjq9xA#pfyafq%*Ue0sSvx=L^&L=4Sz_H-AUb8>C$;%e z@EbUArin;G=qr-i*{VJcPi&oD>}yR+@cyY?N86ZBH32T3bzfOfz_k8Q)$Ahgf7yG+ zsoUPTd5cf-G$;N{*Zt|_%E?)8_`qw}6dQ8SYuE?78v#*YXH};t;j>LBMeW#4@?5tY zu-mFfjQK>XCSKc+k0h@A;FFVRY29)zp{9Qv2}L(F7ezVKSkwtZEXowErX6U+ZD^yo zn;m=k_u?hUT-ksn;?KvOHO+V11?jQ z6PYOyAt*uNQ(YmayyJ~IC%-EYk>GO}yb+^YJH|&2{)&fQl9ht0uW9_4rJlGcjZ+tH zsybi7AxQUJpdfqGjj`WsN06XZ9q;KjQO=6-C&|t;hDL`+zf|O04MqT3Y1kwfgX)gB-pW;c=IG-BN&e8|wlI`}IZF?~*_`??+u^grz zk<dl8p}NJ0>tZKQ44YhF)@!a>(|SmIxDEK zpJEbQ+T&mTSBjkP>24e)cf;7)R7v_!M|}UuQ}ECA%rGI_)b3SRa0bKCt$&)nOl_iG zq8S9{V4$^NxFNE$>y%Hrd;ds$RxCbnUu=>YP&ik|7KFzt;Dc0v=`c^0Vz+`(Wi7d~ z%zY3WGq!bCL?++ux84fxERE&w zjd0wMtqp6kNF_c(O};vBI{%7R`TBy*DRJ=N9rX9GNegolrmz(Xc~1@25t~CTt^lK4 zVIJ&cj_0kp0t=Zy>5&^oK@>)+jFiB$&UY|u0gZk1xr}@q@!-|()@KT?ofj$QqjdwI zQ~wYV$jH4R2ePL?Md#WN+_?Y7R>&>#PCA)u!MCX*ZY|H6S4v1Z9ND3e7fz|y7_oBv z^VjH!0zC@;?Iq*nzC}0@A0L#q3N-IEUrY(z{18mR`6qK5VXr-1#X%MxOn1pAkLE3; zn1V^~fmcHOKz!hws2M4zs#ONS@9ZZ{6n&bwqKU96xA;ludaKqH<$d+ooOq#}_z1HF z(z^$#R1lZcvAjsTF1vLe_zNhRzrt0G*O7ALOCq~KD{j_G)(TeQqaeVe^FPwbN+4)j z;d*N!TqAp_X|>adB5>|Lv?CMDB8Q`p?1>h*b=v`&(oivL_ld|G4@Y z>uINf&~(@MpLM3@{Qx`gM`Zi-8LyCpHWm85!$!mD9f3(i`3sa|)KfFgV(K@qsmyGM zuxsjaYq3splGGnwKL<`)+7dp!*i;e2zFIb#x>_06cd(_F+0DpPGySur?|JF^IJDNT zcW1Gorgr7atwJlG-`%SZ(w?#Q@ENmpqY^5I>sJ>#%}oZPwu!%Q1$wnTP{dm(0hqga z5q)N4`>-bLa>6cHL2PWi@Glv!?#gbp!HZ{7L$zq9RZR&7Y(V)vO3=jW>mUxGrcxzp zRR(>Ry4ZO?v*(KQ+O?~zo6)zdu3dZl{=cVwcT(l6ER~PC*hIk$FQ0V1?E$s3#4rE* z`ibSuXu*o;5GAp;z3crnGz9KMZ3b;_aLlXGe@6ZpP~yJ2s_|LctCQAUZ2n^kG;NvK z4a(*X&Ej+?3rc`Ly9>>Wdudm)pTerFt~Ve5D&48NOYT4~W6p5t%X0}ej*IUXno&M> zXWtF%5ZFYUIM<=)_~r#u@6DVpGOa7FfYE1I{sd{BU`r&mkCjSk{nhO-CZ8M7riWAF zAc@DHu&=tLF@%>=+xG`*xtz+UU*zbAV;~o^!$Mbn4!|o670K6oa9>Iw_KA~)yLcA{a~{*PPK-LMoMg)RJf7QO0_ zbJAT3|HX?jJEGjAY75r2!40b+wDq^RS z{lvFx6+gR<4zdKruYH=eH74IzmAXZ<>v|t%)+YVesAN|2@tj?lz8T70w08;^IB2D$ z7j#@|loog`+*!~a#!iFSRwI2gUkF?zM0P~}y(bM?u2|h$Z`~^oC#U;+g1!ea>4LB7 zyNmWTyu7QIm_tt**NW=+b4|evxU+;?uyJa<^de4%_`KSp@aHkhFb-P-E%PT5dLPe@ z>36Mo*4f&ZGT~Le@pQgI7k@4*}bEvrSPjApP6|3754HJ^?~`Bt3{ z1DE5*+*0uaZ4M>+K+)c5A>P(-%{Y0w0PB{H$**)PGvEKfq%!yiDCy@ZPTKAirp=RZ zdnDEUyqZ)oNsvopb~Z0BYAFmU3s`mML8dZDzZ}rTDD8erI0~Hgr-yvZGBciJvvO)A zbayeBJnLBafwB zrm)L>Eev5KetW%BAGX2W77aZXoqu((c?JEp{?C6}BujsZA**lE;GH|?@p`=3l0kFW zqcLGnG_lZQDc)2-Q+VTbe&Y&z)Gow6$!S<9-8q~a*mOB4`hfr4L$T{Pu_)Ez>LKf` z^$mJi*pIb)NgbAcwt~~6LXlP;Pp)~I^{Yf$JwF>g_yBwAPIJ^2>!#5Fvm3e(zCd)| zM1L2Oh|p-Bl3Tz@2ONRKJvJ3?(1FwSto1t^BQE;AU0-ND1HG2rdk05ROdsuAoWwr` ztDW!xX^PM7A3JwHpabdno)na(fOMVBLBb|K*I~`4lR^Klx9<#VYJ2)s(ZdmurU=p^ zMLB|i5kbHZ)Tn?6sB}Y3EJvy#f`mY}iqd-#1SBdb(t-gAorshG0^!h+CM5(yO(=oT z?)JRzr~Bc(&vT#qzh76@-t*hD*32sNn@Rd=<2xxyCGAGX7iNT5NV>^cE3paR@vE)G z-7RKXeWuQz1<43qhDFWKss7OW@Qgazntjn`z!FZKt|;4@SREqoxTB|z?yVXjw&LSY z)Cb%xa1dQa2y&=BPyfuP>K3e`49x9kMOM7Qdsg93Q#tIC!i^)DG9txKxM~-(4ZfM|Oh9&R zYvh~sna9kuiI8&H!LH*GlB>-po5eNR`Y=LrMo85{@`5C{*%8^$DM5NwxOPkq8I>I~ z*EY)h^Vkf0YJ3$)OIqHas5;ekV<9{R0&KAx6k}j_xQj#Eh{~wiD`0$8?me<+>*QyN zQf`>Xz$>?bu(1 zSK}CiseaYfQ?!GF$Gpkh?4QKs$guLP?d>-0?fHL{WmEz`0|e>MtEY0=`UW~&yxE*u z+SGF(Cw=F$?b&h^MP)ubg*gJ0LjKbEF6aYI6PcPYfc9)2SmZc2t{%*h!#WifSD9OYb3-09VS zAcgg42m&y~*?Iw{@A#L^)Ni6DkbGK2`_?Pv*D0x)ykr9Xb`ZF<(0B2(KI(oDBTgS5D8zWpF>*POw~JA!+wy4*@^arO9dra3w!d zN>5=yd*9|HM%wF77A1J|W2w|EX5f4C^%^k$`t&Sh_A|PN;Fcfm0)s^8l)f(vPj+Iv zMqeu|C*ya*F%bWxmQ0{tL6x+o|B2^nVAEh^pCxMFxI5}g>8O6^1!d>j*( zV4=ZT{wl=`xdh+p*ZQL(V7jSSrs??;LEU?ZQ+4Ag0nPoO~B;=FXLEE!me11v@UkNIH6b zSLJ%3*Q7VnL>P*+Qdfk|@}1;4H_KDX>6)5cowdc;>0}R9*)EZYPdas4HtOl-#KwoDTmqK}LhbxA^azi0pR6&d)2LVtyF4hOE?z zsWR^93q$F+e|j;nM&XFZ3yLIEw}jbY*)We8*lMPt8+-t%J%^pLBm?21?`PY-fy(sq zCYFrY?y-&vak^u=QI>RB=$>qZrNB0~>Puern(jS9=v}gmHpwEqiD)jaI$1A=zeN~!umr!|%f(9X&dSlA); zaOU?0kX8MvaC|1nqm5rsR|#A)2((r*UT6k>3Og>*XzAI=3Fr@99*ShZm(~O911!$f zyY~!;L%ldTk%+Bs$Vmroj^KE#%qgCcEMb(u1~hoZ~BxApfWQ>=8C5|DwMibMz9+OdSU zr;sIGPlJu;Jjo?xk91nt=Lshx4!^k8{J9EXua&8PX#BMf*1VUIbA~CCtV z)3Vp26Seq!&-<5J*TeQQ0|(Y$G0-or#pfx%QXGNG#X#~O&m}$ivOqJ-=YH%8U9CY? znYskrBqq@4{~%heKZ3?e4&Znl0p5R<6Bs0E_6YM`cQ5c0Iu>GC^a@Z+Rp5TrxI6Wv>XFNT~dSC9w@uS`v(`?Okp>| z4C0oDrgX#NqCV;R&5pgA)lV8@Pk--QZ8qF_ZBF^ALJG;jtX%u-193BR(bpi9#tAz` z)y53FMYch)K12k#4W+1};BEC* z<=Bvg5rA>Z6aBYn0pgv+Vui-KwH#xSk=io)gRz!VwSaY4zP$-DLBFhnR1yDDEH7c> zS+ZpvK>#Umw*Q-R;T;{ia8!V-9&l&vNP>gXv zlJh+SuRJmcV3HJShw$WSq)c15jPiO*-L-&Ci$cfh3cv9%Wo`Igp>~`YJ|FVpm|fG9 zA4C{-rzW?L5M@KueU@ao*`Prnuh&6#zI4B;jkedD3qju_1qNwbH5QtQ7VqTrkdGtc z|7i5!;2?s~b${%)ML+s;r_OmF`*DXg6#3#YSqK`c?)%sxK1D9r9t6_??ioJ-=4bl9 z(k-`r+=snJ9(L{iv7+;C@{=_GI1DE~sCQH?jl*4nQ_%i6n1r4#%YP-GQwVIk4Lyv< zoc+q=5(;3WR-g-G`e>Dw2!>y6#+$T&CWG|FGm zqlh08Iyge^v4N^l={5u{cmLuWrZ&y6ysGo*TYod+V>Xsn_5_Z{%Ed(QSDev)LPhz` zC7R`zN!hr4SFn?__ptzVQ_3+s_49}OB-E#){#Y8 z85vf+fsAr=Y%(qW#ayr@d-MH=) z-9Y+asv&5xWp1dE#(BZl#U|dp#F$Qvc`if=;b5eTNXcWB~jpK;l0z06(Qy}XHM*k+x`!SI|3KUjra z5|GDDVMBv?kwFXaC1;ksD^aFiJ}jFq>B+Sx;mrt`uj9@0WYWab)4RCA+>v`fFyBE~GjOI4FMv+}kXX#Lj+1V6$`>mpzKAkyrsaZ0(MZB$_2Ze1FKW$!q&bGX`tRfHBq_`e zQMmk+?Vej~c4;gG8F#ZO$s4%kA8v7QTDM#4w(fB=TybyxCXeMUM`GX>Z8o24Z zYM}EWNYxiaiZzM zRXd-OIoqc4rya7hdRcQ6EB;%%CL+2KS&wA4R2W>{8I=vD!LF_gL}yN_Z}CvVtYAQ@ z8|zsq$`uya8&2~ugNc1nX+=_-m z-)~L1E=Hti9cXI!g#8K@6S=P;V(xZR_B^fBXkc4Li6c)2LmvL4cJRk7uhc6E2MJ() z7*c3Vhqk_66qIn4=15+t#X+iDM*6>BZna2B^?F+~HB-)=#}@D=Ru^$+ zg%hX8tN*OwU|Nw;)v@`fzZl~1P!X1ckOUGVY`4^#qY~*pH0wawboHZCBQ2k2*_h!F z$G#8;3@L#h8C4gvKf4B<_g2pcc+o&PpTAMJjQ>opoyV?#FdmK8=kLlzq{o!c9KJCe zqVF})^2SdH5*T;R-0AT@ml;3Hm>?p5*2?Y0T^TtBuqIzNCtcDavQ{x^z znyRb?X>@lnG3p2#~#Ym!YMy&x}sxbS23u2tEjJ0o=^CZU*y6?U^UOlp?hi_aP6| zYK(ujc`22UcXRBCc{w~!@Obag_q@wSYIbNDMTo8nsZTjWD-Pj1+}Po-{u9Q{wf|08 zD$04}STdGS-Pj8!%LREHiDzra8PvO9^!}?pKl}WO=tBTtj(*b3;&qy6s2SvxH8)&t zSGe!#b>OIP9*vV>3ZbEqW=!}2oe3yD={c`b(i{im9~nDhe!t!4^=d} zZ_L_vb0xRre)w@*_@CY`p9yIF_wI30UbGnanJUv_zYkePJeH zInQZY*wVD2jpVj9REB*l@WS3?_5@UZZZ)(!LoJ$j?O zSn;O|3c8ESbmz-^jPM7~SP3~q?1z0~39LzS`=Bq;>8xeAPV$0sNQ|lhT5))at>yr= z04Jpc>J8tvp2VEKaTUEJBnhY(Nrub__*f$*Dly!WEd=8UCzJs{Cie zrj_eXfp=>uF0(59iFJ&tu2tR9BVEtU$e z==}DoXW$3=?n|Ka{+r6F=F5fN?NXsRwz4bb<{sVs)=nEN+mWXZY*wBqv%>TKbdcV9 zY&e_N^F`yx+o||=+sNnCmSdzT%SiVEiVC3mKz5L_%$*WLQCjSep?VXqwfJMN1D7Xb z)8INEn4w(UEXpkKM5r8v=SG!Kz8F$@O+6#~no+pd0D#nXVN$Hv_E1gg>8(Vso`5E* zKnO9<$2B~#D<0>8PamlQ50P(vTy4F%d8;tP=YFfzIc)XKPGO~bMLTJJ$%~k14;L6y zh3XyjFx{#sxmdzx8PO^}+M+7RjxXtv+^`uK(r}1^zJ9B=>)fg)++_+XzSI6X>H#n0 zN{0wg1Yh;F^FrRTXxa<1m44Y<1M>-pqHCy(L)C^x^`)L6emCC+Z3YO=e9v7C#m(5W z>u3l=%9Y^|b>q70KvyU2=aYryDRBK{sB1!t1x3GldUb1b*HYDTF0AcvlBs75f&&H) zmfI*Q|M_GxUGl8i{#ezT*DsCYoF%0%iUGhpI$5dLgEXuCrU{o@&~iC{A}jBaXUSNe z?;>8kv=YwGM`%xRetH^I!n|nc8^*NU*P5J#BgFOkUODoSy|eUlGldukPyZgv+p*b& zd7?D*T6t~x0;PAohc4+XZ<{sv555zff^93brRC7Yi|K7XF5OK%EvD@mmN57XP;E`y z)0Zk-laUXdTo~it2QRc3h6)dmy_~2k+hKn>Tr**9Dz02Jp4G07Q{LB0%&Y)oytVpk zlm-9xAZ`$thuFq<+R|=`Q^_8{zV!bpI{If$AzbrX=IkoHXEoxm32KOq29f)AAGX@F z?-HeR96>p&hHSt)RY+wCj8Qn2X-o`}l!Bx~4UPC}R`w6_%Od~T*2l?#LId-33Omqf*S$py#<2YMH6nx-$E-~Euu%1G-#0E zg&4?Ezq_}o<0PM%sIuRef|>v=em`SWtlA(h6c||E@WZY+p7Cu)yUITpoEIq;S7f!T z?%4>nM82H#H5H09|C&^{ZRN!fc_52gV0=cG@Cs~8jSU(>Ko0+^YoU5yY`oL9-Xjmx zi|PP1)Pf6sIVDKq)O?-zpHQSJc+3UM<$)?aA3Er9Gb3-#dNgo)GPmB|_%*=|xEXa# zuF>HYzXYyypZo*-$(O(33RCu(d5h$lQ{q2tb~L|-Pu@u9t>y@xtuJkCkifA8z)r#P z4^*#rXXaiy$?|Uqux!wI)&S10BmW9Bbl4jxgPcsK5P$bv_^+O%XGV7ad()**07o4J z9Re@px7e79eezS=o??HP>v)+K9M6eY@Ux$S}k7&U(JFCv@gsy3uE z8G&m96UgTaY3!ZNMU4ys@6o>q3isI*Iy%5WrX;O&iSI5ZwA}rAM(bY(jJeY) zvC8Mxs0{h3BK`_mKECZy&Ns64FEFC+H1u>dkXEr3Wcw8Cj#vORlV4=vEybI*8Fl>& zB3Lx!3DJ(5)^+DOI`3PFTi>x5{k49w+UBobX_TkCvFF3{;bL94El-p}h0tk;)~LXy z`N-?HQBpPgcv(a^JDIWz4%tQgJLa2f9lwQIo-jwtw3~&1ZSP|q%qso_8=;n$%w49n zum5zhJOR|h$if#qhit3B)Vw31Wp|!KRbulPbw6n$%k_lGT-*m8%wdb?_G*w3>);fd zIpYPb!oO|}CD-gLzYDKY6NDD_C&1p5KU~5%u>_{`^jE=hY#~1(wR089$_-Yr2XzF>=0T0x|H4j?p!fi&Y@*hYQWWE5>Y*rUESS z4{G;aoECtA#it^ai2G5^-_J3fDG{9 z0LRc;80*B!ztUQwpt&i}eDg|R&RON1fy74x=_KEE(1x9yW3IGI{N;G%srBCBnvM{o zm0+izjL(-sH(qQe;@c(8IDZEn44Cl+W+WfuoiP5%$N}ww4=?ULa!E7+H6bo?JR))V z`e>s`^efqQpV9%l$l z%N2Rr*;o2{#9dfxx2XLgdIU962cPK;t^rG#s=e{bAFMlN|3QAWKaCU(A*_!Lk;<-a zg5_O;Q#9^WA8uf&UK=HB&Nuu%GsmibczyFCNnl!F9gI(|kGCYL{s8=UY+t6UPE7dA z{#_zJ#W%WKh4K3({q_9}z(AakR+&8U=t^sl`@Pq30$KYeEKk(K+8rO9%(FJry3qmPKRdkt2kBQ@o&KNAx*fww8@0=U%wKHi6jdEba)&iL$w9|AF*c}o+-@ncJck|^_@(vW5*v}$-3u3Eus z=3o2wUUBJf{Gv?9n3H5$!Nam+5=C=raMc*Jcbv&6lXrC7Z(1*=@dPpVjKBJ(L z|5a9lj8av@lQQ^JE*IQn@WHmBf?@Tl1p~cUn&1EKA7q?QtFu+>VB`45WXbqD#qs>~ zgxzmV;fT(W5wdXqWzS*S#gohe!Ic$;QM|U?&aYH);e`)qcX<{(&xV16P?(rERdtVj z8tk*K;N4)Gi2dcUQp3-P0Mjti-w)UdE;^hNHfa}QwJmVYGCMy9p>OVy&u15MB{l`6 zfg-QHH3xA`kz9;8H>;@InUtJvUskAiMdt}bk%EaylSR0dz3^T7E|kyRt4;1>(8W+T6=RFHd#Z{(Y7bcUWH4X9p`hAay9v%8!Kj z_;u8O&CoS=G5bX`#`9E+%w=ES#gz>ObMdCcQM2Q>lHR)D_IbLeD5yoOd%Whk~0Z1=x{)HHtkaC{nv-?dTt97sfXoln!j1mnnaoH&AWX8pMx0>NaOWr_oxtqWUj4T z=)z3LRlQyVlT6YqPHxc~iK?sM-<&MdsO-sae|hdQH3jDGPgU*m%Xp}^m*;GRT&|l< zid$>0HIj|tv4ZaLqFI$lL%oYy*69{6LQWLVejUsKpUpoSr0zyCdf9M@ zd*4i#ez%uAul^0wBB^b@S!lbM{cm^)QR1paHLtQL7pl*?Xz8n|HOx5G!=eFw_=xl` zqAQ00$m;xyci2A0KC@oq(^07Ke&TeXzH(1B;--4isMi*H=#_@ilOWE{TH7cXA_Qv} zXk~$75|x7C#BvCxI*VGGQ%!*g3jGt@{5jXWB!c^*s}-J32Kryqms3<_43 zXmM9xCps`O|7)LZFsL1xU&?-cJWUtlHVwEG%fPjSt*G$ds35^1HWyMU3_(gKey{8D zOBxL;STy$wYBtZDt)e5V<^s_?Gp<^!cH~_PX>A2+H6=B6^EtZK38_}34)5dg_3T-B z<7O~FCSN`f@cE{hYpJkoCsP~(Wf<>CuXxN#i|;=^jnQxFU%Dg&H@}dG=4SJzngS99 zTG~xMqX4@c$~U|yxBDlj`q)f|b#1WfPT7LuQ;YeQmG;XeH_yWBSad>Qb?<&y+$%|K zG-;5gpjDo)ZvTq;w(@c!uaE^kK+iEOLz_as0QW9RcV`)zi4fZZGbQ)lodU)W7QAj- zvTCF`xh<%ba~CgjEAJ${?w`CIsmhaTca7MR-*xz@qWXV{LvU}d!=)l4NFPwO*ut#M zrx#gYDF}AWDbwPU-ninWWsX*VFop>}pa$LR9-Bl_8vsfR73Rdrs9~)vg{r)c3cjd` z!Q-Q0PADuZ-5Rqp3QT4VyQS6K7w9Q)EM2ItDJFWC&~HEkalq^jOFP14R99DU-?79@ zU1bCbiIK%^;8uq&3#H<$&YXw$gDz=t_#5#crkz8A@wDBkGi!M$* zn#UPxij$l}LyB9X3X|a3XFqu#GFiEL~iZm)g^yakJ0g$phGk^ZHhZ|5_Ngj%m2_^haI z9w!#X5Q4P|~ls!CKDNranaj(1{&z4Xxl2mru$Q zhM2Z589^L~nW0>@aZ!Q@B2rVpmPq`DFdUJH7qR8CF_b}%GnN>zpMUf=h^ZpazC#~| zPj3)T>p|I|8a$vzDXOtqR}vMbDsr-?yB^^@(5BpWrDkLrBpgtRmnQ8i@2`TZP+i#? zRcd%r@Z7aVXssR7Q$jhqis905E{IRao0qI9imz?@71Tp$pYN`^xHAn@+Pa7Ce?jIS z@vF!!(vVxY3}F=j<$i)LA>FU@%0I6v+(gOQifuttgM)()dN@yS9zHZsIaKlG7KhBU zh~zLwvWfj zAc8@x?Q9q2zp*#h;1BqY_U7Ojyn0rsei3U3skjW>`%A=hlJjwI%{dkNm)~M&!}reT zlC^CFy}(yYiNT3Q4Kq?Rf^q(8t|3^Fpqt0U^nU34+_VSkkjpP*lw>uNv|6N+qRT1e=dU47FsPm-gFYn7B9wj#KyTnj zev-YuDPDtH?;wrigNpg-vTeI@eN+o#*tM@6Bxw_AZ_@anuv5)%Ndo6*xpnKo)R5z= zk!{S{Uc##YZ_uJ!B3Z({OGLH8nL7k7F=i4la-VGb`y#Kh3b7 zWS-UyxY2q!_^+|s6%?^IA-GePi$UTwW2E00c+D2Nr;QfeoO)XM?+-P4oLwJuOJd%* zgw*j#!EwH&COuW_|7~iXIe#G)oORokX~o=t-bns>gE_^Ql<>+5Ye}a!*l27eyg$z( z_LP)Yshx@AUr43nsatvSF=wb=ZSrk0-rzGpDvOU|?m;aRzr`Uw&cjC$%H$G_#pNy? zp}BfRKcJU!76tc;x-Z18G z{_fZCA5CMEQKEFryObII?>7Yi)#@kDY?>BB^Qwc*$%arF`g2{l3hCn;`M#g* zpm^8dq{J5zkW7{M@qW0Na7)9)pdm7{Hr;91E{m05$1<4!RPCPwrHzn-ZmEz6X%y12 zFK)o)gzp7z&LAjbGf|%n7@z4%_Vx;|`OlA}*wwSA0=Jj%Rjt*pot!TaB?>^!rh-O> zarNbf*j~u({fr2OU*(dr)c8ccLv7}V29m4Nygl@9ODV_A)R>*c^u@xVsTx+~@Yl@9 z2wbMTb2(m7;P%>KziAWrqlMgm)Pb0?H{7xwp(SbvcOO?Gm3mvlJKi_*vX?B6JXBI> z(TrM>VBwqS%1u>K*W&;zNLXbz;AI>=%~_CW$&%cuf7ouql|%=Q^@lTvZCV z$?07y?(*?IKzG|2`&_PG&jb>Hw0&1`iCUjOhh%pAC>ZEi3G9}Xqkl+@}5Y$zirdaU=Nc4zwg??KK3 zTD$@xk^P4K=I7Lkz~v*Y6D_?aql)u$$jJ{zj;4!h>&ZavLY*a{@QF)$RMm>ayWh?B zG9T&{e{a(XQi93L-mXy`R|<7bCF=u+0+^rTuf+ylEl|IchApwzWX~&9gjb6<4<&}r zITn;kMsxY~AIx4KEX2KLv# zR-$Hcf(l#|wY5Uhl>Tctm5FbO>}0XBJ(voXxLk>GKKPA^_euPlWt~i?eiyVMEGEJN z&)h}T@|F^XGIB6cwiqt*iCrGlme-VANZZb1Aw;&al7`+?bSMAgcdq_M;yw@~NOMNz z7{buuFM%|WzE3U)LsYKTAp^JUP;KRhWou!P|JmQ$aObiBf0cSp1JCA@;2Z10{CfId zuIUh=vHC~!Q~IC^G%-=d@pY;wx@aZ`Am!PNN3t(rEqRNW$@PA{p+9` z@h-qVUftIjI{);>9>3WX>&Q%EQa_7km@CWVxFgdi75AkBOR+dac>xFcAy+=>jWzC% z^H2sF$uEIFqnnIwH)J=J(+@uaH>bZjf8!0E`<%+Ud+xh=R^V&TeWLzN5bh$%vbADn z9qQM0WsszQIeQc=cul+5Q81bjp;)%W^##~m)LWSViHYuqay3xKC67NhC^!s@j0`fc ztIIynss3y;+9H4bH|>sC?A&(yfh=BcJ~EwVz@vAo?ID1wb(f$pkz9-|sWxH7eMtk~ zv5F?3w|-hGipzF=KyUz*0p@`lK_6k zL0D(b2j#q59r!&d&t{oPut-`s^#c!gP~*v*;>)l3iF0D_`1^} zciC@+h{TcX>AE*v0Ze0CSWF#9oA;nF*q0-FHR)w(uC;Y(0W;!!+w6!~pdLNZy(beP znlDwNU~$1GP09Mu7*^hD7CL?SIBpK{B+FA5Ys!i~%iU4@YarRTs{O*}U>d|>$6>r2V*64k{EZlf}J zy8@J<+>(tf!K2)(vLJw0OmsL_5(52rku^$I<+R%4Fm0Al?TYVr0nO*R))s~*Th7vl z<|U6?{xy(*D&xvUF^SlwZb=oL)I=4&olGrA+PY6pW$2=z+vMqbB*ue)(H0tN@ZK0a zMhQHIJ~m*KbWx$L*jYY(0UARtheB8k=)_^%#?9iA0b<8}{D3thH`+_NQM{D)F*f}yYem=4lC8>vp7 z=BURY4(Xcz0C+AWc>k!pJ&5;|oQ}XSn0JOyECtfpZCC`Acb+z~DBan~@}d%@lr^D+ zL6gf`m7%!s6Cqy6NMX0mSi#gOOICu9rGoJSp^TkDoXINMeejP15H=muYm0o8-}An~8ZPctgvzf7NGT$m(q zF(!4(A{Ka!tZN&Wi&eZ;f>gDjnC8p1ly=KpczmzWz}neEBat8Khf{LF$Pc1MBl+D5 z{fN$$+5A>eL+(m7CW{g*JnwD_KA&~A<+fVYd&_}IlkjQ_B&BoOV#SpdRfuP5v{2C@ zfutz_ED`h@a^)E^fl8%;Dr6emI=<-BXqYD1QL6z{X=TMKg{hhEfACs8L%YZ$ zNm?{=3n0S5xx0JDEP+i|gEIf6q<7(BRa}}+kyjy)UR2#nd!A4C04*X*w zTyi^;$;eQCcXPgwM3WZ9$8WZ(YSX;~l|1TVo;#g1Zt=}CW>ceH*9oF`P2%m=P@o6C zxF#4vr@5+}a+aClBB_lutn2R^#u9smoLSXktWv%9>T(;d_8LsdposOc+cT8?Tqtkz z9}8O60q}{bs|=r#qt#)!VBnMUr68s~yT(HV4Sf<`41$_64H_b`T!qFrjvhCog=O|% zY`8yP_dpBLnupm1N)UsS5TD{cRRbc$8cMtC>A*Y;yQ>LRW&89hv-VL(o_`N7p5ckc z1d-l6-jk=c8dR4XobzCT0af9-s;T%N0d7~>h~n-I7!79$+pxL>UzSm`Jb&}cEK_Pz z9zzTyiDG@LuyijCb~a7sso(COzV3B8{-FVjpUg5!mMDFnBHoa55Xv zdJ~kVh_)OEWjrM6Tb3hW_h%_E&*-3>dWi@qJ~H74PCGyRBZ<^#XfLTXA)kky zpNB^`2?TYTbJ>v%fj6>L=dB+cZZI6ZKRM9TVPbDA)EP_g&N5^KQm;~BN}kt8iL&UT z`WXj?qhST6)sLq=|9}%#sdEZG#xRTDmKJH?7X$vG1O9Zo!yrZjCZQ`1Iu!MQK?tvo zF)cC$e5gGZ`OrMaaT?C8td?VI1q5<87!z%*8U%^VvZpVR`NRI|s{`rrtn*;F zpAKJYjbpDE2xK(DtdK&GqsCG4l`0|M=N$q&g+nmlxL-I_KGAx8A0uzL#twlnee(>* z--r5rn4n7fz^KPdXeI7?F>_BZh-}i z4|jS5+6)^lD~qD7{d-I+J%%)7hvQ+&a)h^sNG9X@LY+2RNtBi9-|NrWuzG6ANc`>rt(a3!%U=O=^^j|drFP-^)ts`v1I7=Iypba8O4vO_hgz3@g^=~B( zAXYLqH`Q{D{meXe58caW#%Z?8k&Fhj+D{Anb6$Ntlj9W{wHQrzCs}(ONm9zC%`3E3 zK910(zg1WOdmFuZ4kFb_@%D1>${oDL?h;(FK&Ssn2VN*488s%l-+$jVfI1&=%(Ov2 z5JPUEyIG;BzK4YESp3!_aG`R{&u<_JT{IFFE&QdX?~37pSLYo%4+Ul zf}tCa2gI^(j7B8xu8-%Kfa~(##vg`jM>_q#J_kn%fdnc73{9VVfTf}+C=9giMY+~>jp)oXdjUX?BX0O-_FL&q4*cBz<7 zDmYVpr85t$72aT#9Thr!!?Af9S<_W1>QN8^nK=oFKk+aNb-#>Guc4K|Ao2~ZSH2$@ zGBqDp7W1u<594w5)7a8av6c2bWnwbwcs-9jaGPm5>fw9{vlPR)9BOf+Q}HDlnU7#K zKlpVfHtivqO+x8_r)9T-0TY%VjhC2b3@f42H>A(T7Vh9}&vc2+^I-qaql~9BW5G+u z1;Pv7l~>!PEj)*uokD?f@+9uG$U(=GQ0nX0>O##@5Ue?xwY&ZIwZ{z zt){YWbFPy%PlvB2h3xr-j7aQ60L*4?xy@rAkc9b7Qm-h^WnS=KIDeNcM-C7bBN; zAxJMIU$tHrw%Xh;fuYmtqZSQDJbzqRB+3$@?YFixmg6$&8@R-I51SP9d4h@yLb@FN zWf3|)P9m@UiT-6dRXgP}oleJzUF3ZLm%^h9{huH=Rc> zgj7!bA#PQF&v(*)-RC|`#`Lfc{JAXO3p;k$(4NY?oLMR^FxX!3_f?=v4v9U08Q;OJ zH#yZ~6Z*n33SP0?Dc&S?p4r~3Rwey%EJY(gnrnW^qnrQg@(FxW;^H+`^H7HLdhFmF4V#VS-KvC8BxMm41zFgC+dJ-`z zXh&TZ?Vi>4f^8`)BJR|Wh%u1@AXRPmFB}#=x{#|oq523XXS&Qy^R#j-$l*cCe(msx zH4hB6pF(%J+t55cJQ}tqF>2A?#4=wwNJw2fj$PjX6-xbmSX{VtzQO@r-L_B3k`%-eDRat##JbPJLZ&nO&^ zl~`lQ5<6oo&xT7Ny&K#rDLLP96HYaR0uL?d_X{>3LLe$3^N&sC;NHQ@?QEAJla%>2 zhQo?NWZmM$YfH2NabHtFKM|kHbd~BqZkQ-vgoTzXHS+xtSu_-M*gDmSm%n*rw4>WY zpDV(G0>4aJqrvd~RRzchsaEZqPA5h-C+hi}9Z4v>d34u{H_M;KEPd?ZH}kA?RMK_r zHe;Ds+dpRS)Tk{b&kFlUsceZU_{-bHfo8SOjX{EoD zWr&deT%OS|M>Vx^UB|?B1Wrl4lnAOl zM_p5xQPl6%Zxh-ZI*TGAy{}J3)yG*$9%$OAQal`74t(u&$gYf*r$)*L*K~;yiP8~4 zwwTjxyHZGMoq-r?)PZd{|4%uc7wJz9v?7SOFTKC-SC{pqRzId=KC)T=NzX^K?K4AN zjlgAQ996m<$|QggeJa z4g{j&9}4usmOAxYOPwjuHK;dd0XCLmY6AAQ@)%3Pi5huPl-uQgT%y09} zqL;~cAgX=eQB1Z_6S7?;IG`u_CbtY$PLnzixRo^@fk0AY&WB~Jqeq&n5bS1V%k}zC zzeo&Tcd`=Y#MVrJHAQC(<|ik>25K8TZN*o|?;57!DV@{&Ccs4Rh>INu=B2H|ozEh= zM<}ZidVo^*JVmkNna}+|;a`FS4iRc}!?f#F{LKjOV#kTMGZBXR=pFE1)ct>Z8aMlv zn=_#|)zk((Qr4;5|2ZXmx{%-l)+`c^tESNWug(Bac%(bH%m0!-DEFsFURii$6mA;% z`of61E4>QZ!B^-~`Xrxm(QsF|#jyX5F?kCN)Ae3WP!Y~v1G zM}FdXyax*PW2`>mVZ%>)shG%pKT8FVU zh&drUZ5foVB>uHif5DxP&&@R1C~%xdiNK5)=5+XQ;DEDK_&?|ul-gJfL zCa=RQJ*|=zdZi@riygP>EaT(-tO)hdTAHII-1w&?Rfzoc96f!)0vd~OKvPwfzlvmx ze~30WE#<2vP2SgEf@*?-{X?(c4PqzR(=IvN>{l|@c*e&BWd2_`{{Jzg!OD0?^leVP VKud7&)4!W%igIeQC2vf={SUs;A&39~ From fc6f5e916fc8a14aed37d82c000d109ea16bfed9 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Sun, 7 Dec 2025 14:46:52 +0200 Subject: [PATCH 03/12] WIP --- docs/sso-rbac/sso/self-serve-sso.md | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index db3863108a..021b20ceb3 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -1,6 +1,7 @@ --- title: "Self-serve SSO setup" sidebar_position: 1 +description: Set up SSO for your organization directly from the portal --- # Self-serve SSO setup @@ -17,7 +18,7 @@ This self-serve flow guides you through connecting your identity provider (IdP) ## Set up SSO -Follow these steps to configure SSO for your company: +Let's configure SSO for your company: ### Step 1: Initiate the SSO setup @@ -38,7 +39,7 @@ After clicking the setup button, you will be guided to configure the SSO connect - **Custom SAML** - Configure a custom SAML 2.0 connection for any SAML-compatible identity provider. Refer to the [SAML documentation](/sso-rbac/sso/sso-providers/saml/saml) for more details. - **Custom OIDC** - Configure a custom OpenID Connect connection for any OIDC-compatible identity provider. Refer to the [OIDC documentation](/sso-rbac/sso/sso-providers/oidc/oidc) for more details. -Follow the instructions to complete the configuration in your identity provider's admin console. +Complete the configuration in your identity provider's admin console following the on-screen instructions. ### Step 3: Monitor the connection status @@ -50,7 +51,7 @@ While configuring your IdP, the Port UI displays the current status of your SSO | | The SSO connection was successfully created and verified. | | | The SSO connection setup failed. See the [troubleshooting](#troubleshooting) section below for resolution options. | -Once you have completed the configuration in your identity provider, click the button in Port to indicate that the process is finished. +Once you have completed the configuration in your identity provider, click the **Setup is Done** button in Port to indicate that the process is finished. ### Step 4: Finalize your SSO settings @@ -58,12 +59,24 @@ After the SSO connection is successfully established: 1. **Block social logins** (optional) - You can choose to block social login methods (such as Google or GitHub sign-in) and require all users to authenticate through your SSO provider. This setting is reversible. -2. **Access tab enabled** - Once SSO is configured, the **Access** tab becomes available in your organization settings. This allows you to manage SSO-related access controls for your organization. +2. **Access tab enabled** - Once SSO is configured, the **Access** tab becomes available in your organization settings. :::info Organization-level setting The SSO configuration and access settings apply at the organization level, not the company level. ::: +## Group filters + +Once SSO is configured, you can set up group filters to control which IdP groups sync into Port teams. Click **Set Group Filters** in the SSO tab to configure this. + + + ## Audit log Port maintains an audit log of SSO-related activities to help you track changes and monitor your SSO configuration. The audit log records events such as SSO setup attempts, configuration changes, and connection status updates. @@ -78,7 +91,7 @@ Additional audit log details to be added: ## Limitations -- Domain verification requires DNS configuration. To add domains to your SSO connection, contact [Port's support team](hhttp://support.port.io/). +- Domain verification requires DNS configuration. To add domains to your SSO connection, contact [Port's support team](http://support.port.io/). - Terraform is not supported for self-serve SSO setup. ## Troubleshooting @@ -87,6 +100,6 @@ If you click **Setup is Done** and encounter an error, use the following table t | Error | Cause | Resolution | | ----- | ----- | ---------- | -| Connection not created | The SSO connection was not created in Auth0. | Click **Start Again** to generate a new setup URL and repeat the configuration process. | -| Mapping failed | The mapping between Auth0 and Port failed. | Click **Edit Connection** to review and fix the configuration. | -| Linking failed | Auth0 is connected, but linking to the company in Port failed. | Contact [Port's support team](http://support.port.io/) for assistance. | +| Connection not created | The SSO connection was not created successfully. | Click **Start Again** to generate a new setup URL and repeat the configuration process. | +| Mapping failed | The connection mapping failed. | Click **Edit Connection** to review and fix the configuration. | +| Linking failed | The SSO provider is connected, but linking to the company in Port failed. | Contact [Port's support team](http://support.port.io/) for assistance. | From 1b39a4d5ea36d5b8120f72ee68085a8f76173556 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Tue, 16 Dec 2025 18:00:28 +0200 Subject: [PATCH 04/12] WIP --- docs/sso-rbac/sso/self-serve-sso.md | 105 +++++++++++++----- .../sso/self-serve/sso-connection-ready.png | Bin 0 -> 119468 bytes 2 files changed, 77 insertions(+), 28 deletions(-) create mode 100644 static/img/sso/self-serve/sso-connection-ready.png diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index 021b20ceb3..eaa8fab452 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -4,7 +4,7 @@ sidebar_position: 1 description: Set up SSO for your organization directly from the portal --- -# Self-serve SSO setup +# Self-serve SSO Port allows company admins to configure SSO (Single Sign-On) directly from the portal. This self-serve flow guides you through connecting your identity provider (IdP) to Port. @@ -16,6 +16,10 @@ This self-serve flow guides you through connecting your identity provider (IdP) - You must be a **company admin** to configure SSO. - You need access to your identity provider's admin console to create and configure applications. +:::info SSO tab access +The **SSO** tab in organization settings is only visible to company admins with an enterprise account. +::: + ## Set up SSO Let's configure SSO for your company: @@ -55,43 +59,28 @@ Once you have completed the configuration in your identity provider, click the * ### Step 4: Finalize your SSO settings -After the SSO connection is successfully established: +After the SSO connection is successfully established, you can configure the following options: -1. **Block social logins** (optional) - You can choose to block social login methods (such as Google or GitHub sign-in) and require all users to authenticate through your SSO provider. This setting is reversible. + -2. **Access tab enabled** - Once SSO is configured, the **Access** tab becomes available in your organization settings. +1. **Set group filters** - Click `Set Group Filters` to control which IdP groups sync into Port teams. You can use regular expressions (RegEx) to define allowed and blocked group patterns. -:::info Organization-level setting -The SSO configuration and access settings apply at the organization level, not the company level. -::: + :::info Group filter playground + The group filter configuration in Port is a playground for testing your RegEx patterns. It does not modify the actual groups in your IdP - group management should always be done in your identity provider's admin console. Groups that are already synced to Port will appear by default in the playground, allowing you to test how your filters would affect them. + ::: -## Group filters +2. **Block social login for domains** - Your configured domains are displayed here. You can toggle social login blocking per domain. When enabled for a domain, users with email addresses from that domain must sign in through your SSO provider and cannot use social login methods (such as Google or GitHub sign-in). To add more domains, use `Edit Connection`. -Once SSO is configured, you can set up group filters to control which IdP groups sync into Port teams. Click **Set Group Filters** in the SSO tab to configure this. +3. **Session settings** - Click `Session Settings` to configure session timeout settings for your SSO users. - +4. **Edit connection** - Click `Edit Connection` to open the Auth0 management interface where you can modify your SSO configuration, including adding or managing domains associated with your SSO connection. -## Audit log - -Port maintains an audit log of SSO-related activities to help you track changes and monitor your SSO configuration. The audit log records events such as SSO setup attempts, configuration changes, and connection status updates. - - +:::info Organization-level setting +The SSO configuration and access settings apply at the organization level, not the company level. +::: ## Limitations -- Domain verification requires DNS configuration. To add domains to your SSO connection, contact [Port's support team](http://support.port.io/). - Terraform is not supported for self-serve SSO setup. ## Troubleshooting @@ -103,3 +92,63 @@ If you click **Setup is Done** and encounter an error, use the following table t | Connection not created | The SSO connection was not created successfully. | Click **Start Again** to generate a new setup URL and repeat the configuration process. | | Mapping failed | The connection mapping failed. | Click **Edit Connection** to review and fix the configuration. | | Linking failed | The SSO provider is connected, but linking to the company in Port failed. | Contact [Port's support team](http://support.port.io/) for assistance. | + +## FAQ + +
+Can we use multiple SSO providers (e.g., Okta and Azure)? (click to expand) + +No. Port supports only one SSO provider per company at a time. + +
+ +
+How do we switch providers (e.g., from Okta to Azure)? (click to expand) + +You must **delete** the existing connection and start the setup process from the beginning. There is no migration path between SSO providers. + +
+ +
+Can clients rotate (update) the SSO secret via API? (click to expand) + +No, you should rotate the SSO secret via the Auth0 UI. Port can provide the link to the Auth0 UI via API, but the actual rotation must be done in Auth0's interface. + +
+ +
+Does the Okta setup include SCIM? Will it work? (click to expand) + +Not until the company is set as SCIM enabled. Contact [Port's support team](http://support.port.io/) to enable SCIM for your organization. + +
+ +
+Does self-serve SSO support all protocols? (click to expand) + +No. OIDC and SAML are supported. For LDAP, refer to the [LDAP documentation](/sso-rbac/sso/sso-providers/ldap/ldap) for manual setup. + +
+ +
+ +Which IdPs were tested and verified? (click to expand) + +EntraID and JumpCloud have been fully QA tested. Other IdPs following OIDC or SAML standards should work as well. + +
+ +
+Which protocols were tested and verified? (click to expand) + +OIDC and SAML protocols have been fully QA tested. + +
+ +
+Is the manual creation flow still available? (click to expand) + +Yes. You can still request manual SSO setup by contacting [Port's support team](http://support.port.io/). + + +
diff --git a/static/img/sso/self-serve/sso-connection-ready.png b/static/img/sso/self-serve/sso-connection-ready.png new file mode 100644 index 0000000000000000000000000000000000000000..c1329467255ff1bc5bcdcc1baea367cf3938d4d8 GIT binary patch literal 119468 zcmeFZg;$i#8#fM$N+?~@f^;{MQcHudbSm8|-K8K6(nyDZv@|Rw2-4jhODaMqk)2QAB=*6){p)W znG+C1N{fQ>Sk*>a`jvvTG|ek#kfn{i1qzCMc#_T|U0@$^mVt%>I&N5C;%GVzEq!1j zu0G1HEN;?AG<5nO!8xXKBt(YIVXtL%BncNVdrhT{+$_}hD=eyVs;fDO_xsavU#9qN z`keW>Y`5QKz_&A8tPWf6qvT7|By8sCqiiUgZB{))-N)!-w$~uZL4CY~LdT^+quJXy zHin0i+yOh<9C8c%GS3>rQXT-io5^FxXAMT78N)4#BYEhG~xeG4Wtfi{H4Zc5&uqwuKEe6+fkGk4$1J&20{%JsVTn;uKN z{4-eStRN?-1brQjyC6j_#3)@bqHqUbJOiceN~hhE+``rF88_(-!Vh87;X1oh?z!Xe zYU=NJVgI_oqEFgPi~D}9e41%gly3Swe;*=C3ubA8N!XY2R~_$P z+-D2xVRnZ6yzg5kk4uVOh1d0Te6cqSH9haK!q@(XTR7|~8)uMb)1i&}W#|#)Utc`S zCKC}lx_JB|R^*!mQSY_itK9(gt>l8{f1^mkd8=x~HFKqoe9Rtoe-aeU%ww_4AuvRNog8tm2xP ztow1VMvo+-9_-;MHDSCLHth}$>(G^1|3>4sFQmt&5(YeLY-5w4(H0|aNZAD7%tBDt z7jcO|*iJ2ZG>&iWCB+RhZ2ekvlc^~yVFZ=E#KE$qw;h-7(ZAgf3Vf3IweWp04Y~Y0 zm>j&831%ck52P@^$NiS#^+UPm7nkyD{Mdx=B%a~l?;dRoL>O~31>S7GDT_#W>;x^P z>m}U*7H_oJNO z0tC!P<4I*6KmUOLKHR*_u(5#*oex*HI;ourJi> z1(oZ|+tr|(&jIPwi)6OoHPl8N&Cq@!EJ3uGM%Ikb$m@*1=lY&~@cu9|a?Nl}JNp5rp)2`y=+~NA zg?-WKD1HxTzKDbM{q=`|(Cd8v*4BvKy9%1J>B_~<71ZMw%QG{V z6FMCGLMV?!S6SD3b%vAgOR$rnWQfpe_G3*_RDf|;)8C_dWTSGS5`QE90lBvrBzXKt zlIF2Ykmtw84AMt6tHLSocV7$WqC`kC>taj?VSasJ|7hwprw}^XOI{%i|A!>s=-)nB z{7_m%AbMYH^~ujL8gz_YI^`}DZrL*2M_murXxij)@q@Z(`{c>u!{zbldC2v`5@}20 zFwMy|-c!7cp<#?WlNWKuYKnDz#u%3*k3dB0G`Dy6;)Hp~7a`DsV2GgJVsG}Ws2aWFC{f@|QjLJ0T z_=N-!7#6{q!QX><-*UR)FXM*G5RZM>LA^BP;Z7HdY>a9QZ;bVPH>>I^zfT`0|M2;v zcpT=4=QNuM5enq;KJq;ZDGHgNJXY5zIdwecKD9U{IF*Ya?v7ZO z4bKZ>;$>!K5@AwFj7(JRmn#vN`T&)VF0urYyc#HWo8+AonbaX8Bika&BI72*kA{ydkuRRJ4CAJU(Ukh;fCQtpar2vwVJ zbi}nk%>}>!Re+kPdh$B53$k?5P||@YLDFoVLxDG+ex{qJm+`-_9JlD_yWmest>71P zyn191J7lq4Jup`^CuRw-%(Yakaj4xUcb9buMaQMU{&n=-H?-+R8-J^f@_&EeePr$C56oq&h^ZoPl~gng-f?n^!sxoLZ zA~MJ_vSRBgGI_kGc53q5g_>V%3m?6069ZT&&!*;atC$&sXPeQDSd1!S3Sys7iGb`O zvm_PR6{a&o6@p8tj*und=DJ2d_sh2_%`;6NUb^0&z3k5$JH|F;T#}uJz3@fvi*9=f z__SR*U-n-L?_8ubqkZBIV2OrRq(dr-UqS2#ip)Fwv;0!;m zcyfs0g!PHYnKluZj0((h{%|Fgb7SV%r&F|ZD>xIoD5NJuCs-ovYwSlkzG%6g&}b80 zgz9Il&wSO-FlA2ir)8F+>%+5%Z-I}w8H5XYww(4;XXmP{AgNBkb@!guaGWp`ya167 z0m)CJ@xAiODrE}3>4d4Z!o_BtI~XnuhVlZ+$-)=v^_XthcSlpL$JdwI}Ie zc$LHweaC&enJ0V`j4mpcI>{#5dfE-ajKv>Yda;L=<8K8RS*&zaO&m22+eDp>^_TIA zWBBB}y-WHgp8^*wu&Yh=diW}B_6je0zi)~Vg_*|Zahs4Jb{be5l2(|HNPZG)61Svh z3Ehr9K6pC*w4C?AiX#*LnXB2KTMCh4U$)to-55K#~6X% z?55zW_i+{s7g!WzCu5}Cp5CS&4YVH_WL32|gj`1qv4*o2uvS){8fdlZ`?#$^L+yT4 z7Mlzh8&tzCz|4EYDNV@^dTK_MhAZk+>dTEC&foi=WV2MWRA@caJY2A@b=v*WkS>$X z0fMaMgpvF5Z*ER3}3GaFl9UqdLvMTQaI;JKDXYs2H2*&YfWZkj#X z*%c>Wisu|^ePr47OUn-C6TsW!%img~-D2DpU{$cB!$;Ri*LOl6-B+(Vj^DF~3WY-b zYp-}$TT_%8Y&se z17r#n`G}*E|4su?nNaTkk$(>bCDaB5?XNnj$oH?$N96O1=Fj*2_zx(Lkl*l;k7v%k zziZzI=iL80jnCFUEg@JJG#*Q*~s7R$XK|TIorH-wE;QO z{A%}&Dag%LjF$FSN54ORj?==^=AWJ%UH+ODa)O+{N;tVWxHx~ejU*NQl`H(p#?!)H zPsYXp$undh;@mtu0-}Eq{HN%jF8_yA_aD+1{CxjQ`9CH9rqpt=aFzx+Ap3L`|3_Yb z5&v)DUxcEZzoz~_toW19f8-(=EsiP5`CDk>n0Sc{zDPMz*vP19BHu_Y`}MhpbbL{m z{(S#R?|)8&pKPL_yhKruk<|1=-EZ|7wbb(4Zr){GLPwAGR0Q|w=Ch+?CQV|DLeZYn zGN}TZ=$VU@pXnyJtoLp*0iyXL)H5blEm#1OimVJo9K!sll50#GvAG?6$|y}TT->?M znfaj)n=V?{_K*CpF3*o{FXmIWy~dL`nj;PHJ_ z^p`02a05}$Xi)x4rsChbe&$;AnSuG?@4UZ?3DI!Dd}#k6V7Z6BR9vEp`JcAXjpqMp z_pdgTiBN+NHMJN+g8p3;%;E5Vjs!_j7=a??QBso7`L96+qDZ9({59Zz#txK4$raI> zQh4+CTz(hjDv|$A|25m7Vp=ZET%T{KkIXAYZ;0mN>6NOxBT3YVg#J5`TRhLJ-J+VJ zfD2_9iKNPx>5vMvgE6`CVZ=qLNv6V%>3=%C$9xaJB^I$!wNKK1bEi+#T8_Dt zZ`>g410jzYO6KxTFOgpSHxZ5GD%{unvV&S8@pfVa@xrOjqewfr0^p>E5CjbuF;g%5 zV56h{M`*nmH;@tkesVdWD!c`jDGRo)~!Rnar(mt_JBifBbKKdYKddErwF0=IℑhaCD36$$I z9^S6!EA@rP$}srf`hk9~u-Xwy)$d{E-?%;Mhp|MjL~OO4b&-`tK=+@zFLRhtqoK<` z503aQmM>;fMvae_!2$QA6U)_DB*-y_I>9ym%#?=b%EU(`Xl z1TS~6DY-HJZ7ScGFlb!m6w+(|t!uA$koGJsr~Droaw#G$T78^>{okfeDvUJVQM`nI zb&ZN16_2#j#99Tcf4B8P6={;LUC;l+oBubBf3f8M2huors@0B+Yr&)DJ5Q&9STc89xVmL&vX9XbO-AomirumJ|3E834{<9{-u11u$(dVWx ze4*?8nr1e7fiCNeC=A*ulO)p9%~5&8#f*uBYIkaHi|>)o3hN<#bbXfp)oz`|=pd$w zT=Lj{AW!~NG_s(SwKlf=V3EJ4UnBLBu1d$)%Yvbb)n)6Gm1S#~QTQUr|14crH+)ge zcb(vV^kWjdCnwa%ku6TBia5lCwH|k3)wm45U=-O(HQNe)6?$Em?#QwnHT%G=q={`rT4FVGg3+bgWu<`3J zLshjo#H>_*FDuTH;Ebw?Et&cK=?NA2h8G2}y#YuBk;P(}bwkbSo(_4no# zv_`O_wXd4jOC%fYXsu*?z7sE?Qj$is``(VM2Jmj^E5oRKR6}{X4kxoYE;zrEm0SfR zoQG`bh3rmDTbn%I-`js5vNMvlDirz>>_HTN$oJ}rctSVk2{v_oHFLebZzXmca8$?u4RRVXRPbi z)y3I3xp~S%HRpLw^L<%yOzy5`B8z*49r0twrzS0)mVYNCe>(E{?H72@DQ+t>m6MKe zKQQ66m}5f?Xh5XOP^UV1#>Of)7(0CNJ;yC?zIZ`MVX$~Vt<9)D#$dv;Tjz)F#rKx5 zoDPY$TmCiTd^WSn`n;Q>`D9DwFUoHFb)|Js881zP#46Yq2x)`Bd)|sH$R2VK$^$qp zRaZKhhR%KT-SkU$igK5E{RP+30piBgp%U7DdsG*8VeBoJMG#GY4T>Z|_|(z8Z21Vn z7omSG_pfp9xtV&z%T_efxJvIGPtei}q}j(n@?SCP*r8iYN(P*d$u*};RW&eILvua3iozzaYe9ruTk>1@)=_! zhA%0QG_41Yx|K^(2B<{x(ZxYS;+kgW{A~*WD6wL&S=ulXH|S2u*}h!SMxTe}rU@`t zWtAxkVLth+L0vxc+Rm7%M@W+jgE88>TPQJ`$+l%QDXi{hUOox1Vc(?z|9E1t(`epp zX;gnWXVQS(23MLpHDhS=J%%Sxn~1l%j%GjQj>qMptEzK?{4muVBW3lapugM$wC0>_ zeib5$g${1(?M666Bw3=!RFOYOgDRY`V0R})6lH_1yidM3+a0)438uNujXxQK&m%99v66lsOm3sl8w8Nlui*hT& zZg7LO;>LLgn*7fidZd^h9{uf&tF4o#^sfm_gca6I(rpI91|VD zW7*5f16;o7>+i~uKNb+K2h!9L&+1*gj_$!9Mij(EXQZ{ya;z(5&n5$r(vVR6w7v8i3LqQ^#`PZ+!&JU&o^5p%IOcJDyoi7SEG)g$RNW|nst$d2Y zQ!H?J)S>wzBJk!Px9K4bZg+(&e=)5NTy967eXIV6RPeyHd38ye)4e3PV*D#!spD%8 z8g9MIIifxDQkTOb1y(XnOO1E^@u%x5HdkXJD}Bj#i8*o2$s zWFT^nfn{maDS-R*y5<^m+2UEk&(yWBIp-6#31gjkAto=oMBz8R0gB%YMEzlbAUpTg zL6{f2-Cl_g`Pifq{@uH84JRcx%#=QHc><)}o(aBPJddS!lDS{ax7~)l7fL_5)NS!d zyE<`Tsecgpos;Bvcfsv{Hc_UaO5aUZ7l5-)rLmZm!e-7%tgxum4Bq9v{1V9CyXQD{ z(<1`Lr|aK6phTl4O0wpZSCdS!@XL41{NRG(CQJJSDiOhjSnnUsKDp`m6U3qRoc`;* zNk@Z%cwl21=EFqm#NN^DsMEss#1o4!DOrSHD-Nw|E00HKd1MEgts<9*q*ak} zbzdP+U1*!x(M;miPa*{^Mx&W>I^!ggGaw`Wb98=THg&u8S2n#nivUqG(KdoC=w}bp zof`vs%hC$CkSm+2f4|)vQ#DQz&(7w%P5@n1rE~A+{#T4)zP?(U$DBfWqnA#zRn*ZJ zrqkO+Q2NmI;{MnIpyf4l-D$o%gZLE?Y|(rZQK#ag?Nb$9(?1^fO0zj3{N4BpLDfN0 zw^g3{OzGjX5pJy`_ai2%&9Uk6y~XqrQE%d6KEha>Y_bb23MZomU0tIuRQ<*pa9`(t z{E@3?xUv-hXKJ7QDo4!(7I!@G63e1TVyWZj{s);ZI}f6cUS4B^5>)*%!%k*O0SOyw zQreVIVS+P$YAKyee*%EkgsB#BQeVH0j)0L`c$~202IOK8!t^De15b{_kHURFB>8eh z+n+6yWufvc2BBNrn>9C>+Pw4FPn`aZ3zG*&UR_F-iokW*t_ z-rgwm1%On}`?=`3ipl|IS#f2A8eq5UNi-XWM4gr+zIQ|q7Kz0AixsIEtUmCVa#ByE zDQotDZmG*t4BpnaADSOPSnq-7gM%CEKF!8-*A~aU zIzyNlst5#<3+C<>xMx8- z)2RxcmEF--Ijm|ORSeHt^~(mftMa=mUhhuoL^m=!xnRJ@eN9Pj2 zo@7EDTM1!#C>|A4XS^^!9w$fjiSRX<7TfiHGRS?tEYRfFa=+T^7*t@F^`=LnWHG_uw_d#E@S>+`5aTD zv$o{B{hJ{et*WD$N#BB2So+fj)@hf!NEvSO{2S(}2^eWz4#w+#$x)aPVgEQMhPG?9EinrcR+f z9Rufi7ohV+_wwnM+|H)X8x4fqGgrUmB#BMA%T(x;?&MNY8#eIZ*>aJ}bO1T)KcZa4 z@ZC3~9zc3;hC)dyIxxg-6-o0z3g?LU*{2cn>YgbYS615}k;F$s!LcN-+>JUnuJ$U` zFkiuEnBt?>zvwS8wQDth)%S*KDw)fN$U^Mxe3oVZx#iyzOxpe3I4y+R3B4$_^_PVD8WzJ9j;-E)n@1H*VKLEu&+ zYv{AF_)eM?4_j`j>-qpi(v*Nm4U8tB-^#Y8hADYd2c8sep)&NANp$PZvvAAO9eO6| z^dkhGbRcKBCsfa!S9*2MOY3WVQ`Pu|66T#Pem2P4?Pu#CS}&LVu;(|zl@k*vQ*mWX z)-s{m-%1v~M18aRNH$>67qHD@X$Mf$*=Xq9&Z1Y9@39fYU~;Zmt*^`i zsM=KfgDaqN4nF|y>>ME0Wrp;yq|KRi+j#1;^y(zFZgtE4u15IG09y2X@<~cN18{7> zn57`NVx4W^@=Hj?>ADH&j(B2K3R`#hby3++ST^a-1L;rd20K>LrPV**{&q$LFzn~5 zEpp;?!#9aowWGvDgB`!K#G}N28J`65;-k*@_7t*0Tl(cu^yIXG>_ioVoIi-#5JZWa6S%?88`-75+pl!lzH| zvE4Sae}56cqZBFGRgCOPug_ zoDZ4~iz}oYuuf#EL%1qO%Gc9yjiK@7*(>2`)NuH&-8_C0T*3IA`)}|8dFc!Z1io#= zrYK!uDzYufzjL=UvhrC~#zRG;8Kuu*9`b%hpT9eo=A|y6vQPF=`tABj*+M8bG4V8871!gm)v%>IyJmE z3=Rn4e=Gy#-T~gro%){Yi`3`t7elY27fYlwdGu3Q;|%H}?N}Z=;s(C-L30J!T86Al ziT=A69;Nq)2n z*`e{h>;}yXI<#p21KEC|4;(F*4Sw_+X8LQFPkoMrUKL8%Pci=i+5Rl5LxQz+VaI=; z27d3f2{K58RiRGS__sd%Rg{yA#O8?ceq%F#2S8rOqtm!D7T5Q({ubw7MU(h1ccy7O z@Bcer86PR_=TpR9A-{Y5llwvX$kFP{c>dk=Z$DXqHgGia^E_?kZz=s%^hyaO*B}xd z=im8U3drdtXc}w~{To5HMM~EWZw>X|`3&Jm$T{9NvgJ24^cTlovZDq&veSzGR`b8| zzdc6^OjW}nPUqiD|Gz*Ol#&juKi4DY4oOV|=N)%u{M|2UsCTu;$p3!wJ0 zvlI&~n88PO!$z705yu4ed(Id^bI*_qg_M!fx3<)~gT*?LgkITEY*Zfg-@Fgve)jcs z$2F`>JZe5c8HC!Xwb7^O%gf1@8jlI!08m`#aYUO6OtvlkL37~)p zetI#@Ld>mO%->dLt@_%D!<`=-iHvK0P($`c2cZ=4AOa@&JpOQr!AQehszT3qYu)kg z*3$VZF1W&yXMeeT#Gu%m!|U>tx~+WfcaJ#X68RiI*=$p4rOD zgc~W}q1CD{4ErkbKK#pQgS_wAztS2(r^em+6);&3hkj4e z{e%Cnuh735dt5;i@rNXk#;-tW?UH%WG}^5!h$?gVc8{b=#IUXFPvw}9eyuKEW6!)Y zo0)}K@caxJpEA&RU{LR1)$fdvZsRnaX6V<0&1-m1}N=T1ux z2|Q*ZAmc{q5z=iJ(1IDXq93ZpOgTCq%XUcNwFR@CFy|38lcXMR@6g zgNVC%v-`o8LHC)?gU^3D?`EnmIfGN!jrwbx2lvAFqmeADD5X2VZBE)vis^Nww7n`5 z$e9o5i{E9LMN6{0JS5=_H~J0aZKBoc6<)C+bs{I=9=cIajLiV{4?-%%9gdZNJNu4z zVD1`TyjDV_cTR|{iM z(lu0!k~DI>kcSet(T2^5WRKX6+RX*WX7=V=*h2M8%U0c7sQCG_6lv^hdYZV>%w!zh z`ha%zbE3nwQ0ifh_M21t+p7zg&Px3{mgbFkrD~TEF^`z$%tcQ~^sk6h3UiC#X~1ql ziY2Q~#rd#H483DJ;-b<@aPh75v$ET6vzQkQ&8zRQ6elkHL*2?KQ#}sn`KN)^hs{UJ z`vxml+Ci&PyvuQ|5XvJ`V(j(Id-u`>C6daGuKV(yS9&=hns2G$OIh!13($ctSM6r} z*{@ID;}FxsU;CR>3?Gf~oRx!aW!+c&E~8aelqOOxoT>gerJ&^Q%|;J64xk(9Ftbx4 z896M`Dc*myrTF<*ATDHf61}3U+@8~Wrot%Q$a5{kMX||o3A_(2t>jqTFj?26>tOKS zbl=YOVCb$us}8Qa8R$LgctmYTvC#WfH8CX})b`@3+?rR|ovT0rRM}*DAk>M^XGy7^B;n3RR=powBmR76dwq~H-ObO!@{Mt_7Dcwq%jMnl#QBE;>4{_SjZz3KXQ?# z5}yxLBv+4qFS%2%gN5J7Q(cFVPD{!WE_mB_%M)br~`5O}vxSxO(^f7l3# zal8qEgdx2A2c~HYoCv{HE}x^OqtT+!$@`+1krVKS77xvxZVuG28`PT*-XooeNXxSq z%W4n1)<8%dj!Nqgj)XI_=-bJj@VXG%EGZ2j+fX_sIgcb^w~fZYlYBjmH2urTpB26d z83$(73fNK&tqY@tYrs`SQGxaS)O=zUZIl6KdH6Qu$!AgQPf`I_5#+ zGDVag=6?U$%P~3Xg9uHG4P-E`2)CaMb=tZdWAO#XHlr~YGK|%A{w3N{ZT4^r!r)%+ z@)@s58e6QEbgrBngOp!loSga|xuD}<1sLig`(aY`uC z31>X;CcibWi>lCC*FI7gdg~pR^x@;q6d@ehPgyEWDqiMb{1S|!$eCK!{%lhXMosSZ zQ<)todnHxiLcJsNDSX~ntl!SKMmQVbVQtgqmwKDRK7u`P%Q4`<8@iS0*9{p;_LVu5 zlK=|>8Pxzd24c!3<0or!UiPLQiF+=$z4nSbB{yl7Y&DicX%#uGuz9<)I)6JX4^DHe z&>QM*J76|_mdc>5SS29IT;pC-<0^ugU~qWg6;2)1^7L*@`e@x)(`CzcnQ5?UCUrDg zS?fA*?sSoZ7tH8?19?<~j3ksD=lR%7_0vUM=dndC^1r)*P)m%SwGtjJfNQ-~V_BFa{;T)rEU4jc zXtXYRe9JSbhaH99Mqq5WfTjq za=o~wJNw`(Tz*K>O&9lU;`0+(DsXJf03>20hgRxRZKAs1=gMt^2hoA3+sKutn~|Mp zX(48j|D*oSFWCIIvrx@9?3^t6C92WQrv>gsD}^<~&=x)|Qb+|vPr%e}Z|h>=HWRdB zSleB~e-2@CCE+mqmO^XU^b80KLLLw~OJ*Ci>!lgr4iqmFwlpWK0YJ7GHb{2YnYgebUfU4DKlv`YB|&Icpq6 zNy7N!kx^S$Xl0 z?;htJE!_82>g7iJ9Dc%bnURkd0^icba`SY?)gB%`5{l!09E(}m-#%|xl4+Z1?n}k| zaemjKVW~~6$yJ5c7#_u$?#-UQT`3CPG~Hl2^j6Qk`JCm}AK55FhgagmJ6&{B00nS9 zcwUjXyla&ace~kuaL#V&diz7H&|#YexTJ)7CNfk%p9NL3=WO23pEHAl&Qs2cm%BmU zeSfSn-r^i1DMrYMLJ;ED67zPU-ps1r=kgH2R8P@QWnOh(J!x=T{Ibb0REiS)wsCLG z?{dk5B$Ftlb+r>`aCdN4KDf|2%lEWz4o|L(jcT-E#oq@Ha7Z>azJUB`7ewS+e|9-z zUBkdBa9VPvPMw?poQBBf2j}zQe}u~PS&Nkgmr}Q~4@8z9Ou2=dtJuNv8@MxM?56m3 zcUFe^-Sj*4PXzILh%25L_P4iT|!vhig*R|edoQm)-Pl7ZN^;1DkUa#s$l8%KUeK3kfzWOYfa(Q7w+HswQF zH!6eOBqoN+*~tMRr6e2|57oTC7fmDIZ*J$j@9?+QG9MK120=2PE7 zZbG*3k~N)h^wZEe8>LImPCsJeE&xnSz zQZTc@Bm3SP7Kg=P^|bXe62i7ccMwatrjSXI6C=nDhnqUWZaUidW+x;k%5qDWoG+_Q z%u^fPNbS8Dy7D9BR+#0TVV-N3-_%yKnO+p|)u5-Z*$+N&H|N6{1Eig$!uS5Umz&Nr z{X)@ATLTfgYnk6vy{)uU;)|cBU&OjrV#Z6hsnw%#Pr!n2zQnDi+Dz!qhQ_ES?jjry z3=gXi_&mN~OFqOe(rrrU=qbO zyrcx}?YBmo2IR9*JGleaxbJ%Ub83}8Uk$s?C8}d_E(BM^42+M}=?Nk%WH-$77^iY! z?X55$3cdNGFCY+u{f1z@S`*y!c0kDo4+!&RB8W>4trpeyzuAAZ`8|u$V)rR|v|-z2 z>z%PA*g^FGR&5xS&c)1e2$wsk*5%C@;ra^7ov*26i*2)KK!_Dh_GT?fD+&-*wrB6p z?Jm5tqCTrsd*$^83Q-I>^NMyD{CWM;*Sp5ozP+-_;R=?sVsv5ABDv#DMj`!L_>VIa zAxv>5Jq$?DN<17u){C`N9bIWE?pmQnq2N0*5Qe<8wQxo@HWYH$7zNee zW}0d%H;50B&RLhZZUwY-c7i!td{9mD468C03AJ&F$RiR+<~Yv!iCt-7_)u+(!s5t*bP_ zx!mnJU$q?9SOMl-x`VX|3EW2V6H|9$T3}ojlPM}*^5sD()XmgU3X}nNr!3;+-2)~K zKFiGt--@ELO6NTle{_1~+BtIDKUIUojz)LE+ESJ4jO_Lh%hjYB4ignaDMOQ+a9TC+ zgcM3{a}fih8*d3Xw4PscPYB+yvsL)0fC^ndveYIVI%#+1y#H->!G$`s8w3*)^;KDA zQ4?M+FCKuCEv0PQRsHCe&&YD0w^_FI^aTs9jI&DK5@k zYgPnsZHSH@z2NkCZfTP4kXVw2dTGTlYe(j)oVUr@KQq3HCWa`5W3YmzYPwHt>$j~PwcLRW2yvyU*mlSD zNv!D-(b+mpAs1c=%ajv71iBI3RMo+Q#Nl&O6V4AUW1uu+vO;6hg84!m5$YaqycYZ2 zc({BT-!m>Eq(ALb;-n$Lxv^rK;>M;aLr~lX`5g1EoI0vpFSDW1y-dNX3(&UZBcpS# z;pb6zN;S!uSu_RJdG&o$?ojuNqcvL+b3a5+m$kAo5R)HVIyUEXbYPEJi}b=e(*?>| z4D9UgO@U}F$d&jhGh4T_d?JnxS*jT5`niwZXMvX5#3mR&5O3i)iS=&#%vT>#OeGCj z%JybQ?-UBFXr0X7&VqW3Gu>NLOL(00v*22cYMj+ny@IvsMQRK&n&~EU%y$TnuItPs zvpdtz6@zi*B-YH&3V!Z4OuIPJ+A9+l$QWf@LC+lW4O^pj=0SesQVpzJrzy(CPgZ=5 z4`wBzh=(!NBQu<@ zvq4M)>8)Oz=?`~BEZS$ zM?-DtN=RI)(m~drT5rCk)MYB$_%fK%yCP2lW1l6$^`l3DIeK6=WGezKqly^J-4+K9Hh)aobs@`m3>M>_jEka1#hftsnFmtM_EznF&xZG8+eKf!- z!DHN82<<8-Il_u&MG&%SJIJNll8IL%8YummI;G}(~IHUruvkb(UtK7_PggYS=?uqRjIMjq2hA5Ov z$NTWL0ZlFshBP11{tz5IGnLWF2g9?W+V3uN?k8`jYp|19RxdTS9xJObPV)4Npt++hIW(?bGVfjiiEe}xpF%@Q zg~wq}pJr?8e0&ZV*l+kAdC78@jPMcPHy5nPe|aN?;%eJghJ#*u>Ftl>t<~pl z80(@UozA_^Z^Rg}AR+c8{x@y}V9W&-R;O(E3hG_FEpD#e8!cFM%6;uZy{hueu6l}r zqa%zFM~aZc`0mK+ZaQd#jB1ATYck}%X2fnwqDzk9I!q@~Oa10nx2MiToR=}f)3i#Y zKo|oSj>L2rb<&5d&9|3*j#vws`k}^kBtszgNX$k=K_Rpo?uu)R3 zq{r&t@=>3}pJakN-%ugAb4xFp+*^F_ZfkDk8mGGp2}*zBe`a8!*RHckw14WRTXwel z;A;i^ZGBwQ&1Zn=W(D7-8o>YjMcxb&*_z`W5ls*~?WOD90-iFuAb~GpJMYK@JVgGH zmc-c&R(GO>3iFJ0g@ZhQr@d>!>1Dcbz19!mn)%1j`#u8ZXL(wAtBF8W4uIOl(s=VB zxcPd>ApCWEx_wKEYrD;c7Nw2btoeHDXH~FYp^VLL&CBY#dSg0ce8|<(u?_r&d8KHB zj*{opXThO?q@BQ+^x7uXdFI^qQ_tB&tH<`{*pcF(&e|IQ;zX+GkUn>+Dj;q(L|aiF zBfqXjAh;q6r~c`u(_B3)nD19uF(0I8SD9}otdb+Bu*d_@;<=1>MPO2N7NIQ`u~Vw^$1PuFkc_%Ab$%QLI^C>f34lzZY8zeQ8L6O>Z3-J6fF+w`nn%FaEiA!lQb_I^(ZQd5`E+sHm_fF?{~iE)^P!3PXXKg|yRNx@2HvYsL16E6 z2g)P`%<+efYWV|OG`#AoRca1G0!oa{<_;|4O{7hx1k8S_XHtK)zf-4|6~;|P{szTJ zryNrKYzlc_KSFSm!>&*I_T_bGq3G_jo7c;`0%Ks?ss4SzGu7~HRptO#y?EOjZ8;;6 znv(bVf)oBSl52xsYTlZ(1;xAV6RB+{(7Sk)^531kk;^STOQCjsU3LGA>5OiTrKMp_ExvsUrZ@zy}6)96HLhdiawF_5%Q=t4{CEwhSEY0wltv4mWl@I;%KOhpf zHZV z759LyHyZPuo5MsXbvHK>uYJd3qb%|(II!lVU$j@vpD3Na4k$8+BHt zqEnBz)Hxh-SY4pxGB!d!4lfaLczIzj?l4!#y5QmJ7W4P-{BopU@2+>l+i0;mkiRf{ z{1PRXd^LLDeDh;D@=p=&Q{KJ6$PQB(NjJ|eJxyJm(l;Vs6Fc90M3PN@y1D7ehnD4s zfcrLVE-k5H&duk;$;K#EiWMIG8DAPD53;!CET|kO=kb+(O^u962bvoea)#R1`Psf6AkF|*>Hu#9(ZPZIMw`_p9547c0UpCRtqLW=F=G^8$^7K`uD#fHz4o^Mb z@3>p@39dNk<+;CUGuHnRVEjdr(DSdED2t(r(OquWNC8bo2;cq+oCQ^(#S8S0$*=N} zm-AL<3Jvt@)r&U_-U&7N0R6t+ioJbvS zH7oF>iBQ)`ru`X{t3aD|@G`Xf;H&cgvGty z0JW@?Cg|!|q+H%uWEqRQ>|O~evt>S}2)u*&vM}YT_Ogyrxo`rF3KkEn8Y8ZdB|Dz#xbKzo*HOL+ z)`Cj9qGLRq0Ou@K<)3(A+2Qe!Ov%TlW?(0ufu+%QgbBO2pbmvfbVkqDQ zb>0E;#`;Lm-QUb$RDcmv1{6e!QM-nbtMA=F@p~0NbM%A0ozt9u`8`m(AWnb>Mdr^JauRoVl#`!qh$``D(_~6j^6}=g#UK1@C)hL^$C=oZA$_1;y&lYBZ@18 zg69!=oul1CIKQbJEwCFh?dvUrc2<*!!Y2G^WaRsX?}5X<GkZYbS5e$ z$mklq(Yc+~jrlT74S-%)s*a92uD3zgM#j51Cz|};zxhr~?$g|U3mzD>TC*Dl+L%z# zJ__xQ1CED0EM!jio)w>4{1PD9J&mHjrH?34P#?Z$t6QnfU=frC;S?wiowlh14~*RpJ+@!*cED zDczY#h9kFnW8DYv8P%1m93T;+QbtZhK^)N|HTtdyD@f85mH^-Pc05+>N+Qpk?(vQa zO*>A3M8+$qkEhy;WpgwH zBdIkWWr`fBPXHb*?-ZAm;o$q>cB^Z>#4dGW@VL#|mr=y9D~dXQyRTf&W~ptA8$5qz z{(GU~c$Y_yO>3~+hkf)^bwtt;%wTpPd$4XGYq&&Z;0mBv zM~B(fq$IUnrdH6drskIb&GyF^29kOK?08?u7AES*KH?Mm3{7iyNfpLXV7@Sq zw215oZZE-F`Hedsr@7-{|D8+G#+h?x26f`pvaRcpvNp3b=oZ&K4*#`34L-Ze`O@B! z4NO*PXnJ(`>Z-R@n(zkS%?r>*+q<}u0tI69Kvuwt?iG`T7LlEwcCEX$zcjK%kD=WRKADuc?xKDc|9z9CSRXaJ(&iaJ;vGCuUq?i(s{R`2fF@SfC~K zP1;#BqAF%_wQL<#+AL)}Y=hZ!8lNB*ow3j}OjzXFw>Rn#`ng}?C3aK^Kdyn5OAKw& z{?YRzYN1s`0QT9HJ8%2z1|K$n6zLlew7KmsjroG*XnMGPH&MI zgD17?Ow*$^a4v18c18-xkz%elD5u0xYZTo`2HMlP<^l-1YU?gZ7SjoOpq^J(TIId9T0j3#k=m-l1y z(ci$ZYedqK2TBuMB==i>KH8vu!TUER^zT_*D3}V^E6~Taa&Dhrqk^vSh+U5W7bwt&er0U` zU?=qfY$Q*Kig45Q8n1tqe38<6WMW>!ss5g(34nMyTI75TyvhXr{zpLpKy^{_WPhV} zt``vqfFsw3-adHxU%LL6rw5RDoqQDqGP-LN=jAj{G=Rwwxdbf#(e`}_LPcGGR&0nBnAlj^bBKW6o>PjzkEP%L-EHP_-^54+YU10!9_lUjz zdhBcXYuyk4stUI3|IGZ~>-~c;BQg7MeeSq^8czfOxg{FSexZLYi|aA}f7lQmFN~_) z9;shr8$g}brxH@S^Ue6#mDcG?18UF|DLinso0eEiHwb4UlIbhwQKW8s4=y2xI$thC zRt{|@yz+~Gp~*C?{MC*B8nf0Li=6k*Pw#sJ`td~B5BqW>nB+ilzN1-^{Ql`t9l0N_tKG6M+ zOEG#%JeQ~Bpx@Ani5pFZLgM^M5Ij_d^?yvF?m3_c-d$vLS4&Jp|JINmR1jCDGSC8A z7#L?Xcyzj4V==RH{)Ml4=9h(rhn3N}&mDvF++%S_}vJUA4iQ&4t;RnGhq22`sxXYz^ z1sD&!cLTeCS)hA-n{V~G@Lp{!Uk>8Odc4CWBn2kh#W*-3}wPifj z)|E^6C|K8!k`krUSAJ%1q4cS`IkJ}V{O4S5fMz3Yq5bcI)i8Yl9%BRWQ9kc4x!8Pq zJMeYSZt??Q5gb%lcdmBN7gW_;Y)};+OkrF7{&YRPwqyPH2*$o4j9@P~ff4N-S*X=W z6~>NNI^uugXFMA^O&eP!xQ^QLz*w&_u!ye&WPqmCN0ZfeRPS@Ivb?LKW%6veczj2f z_>0rwXh9)t?bHg(MtP9ojV@tlJIU1;|Gge`kfPUHwC*ufgdyWI0o2s_@WFZu3TNhK z-icGmadP$K=y8X}*}uY~PPuH!XOFx9!Hx}PEv z&?W^Ot2OnxCxNm0Ct`@1XT99f6Q<}ANglvtCA+F5S8*o4mB|mRo4e|n$iP^mS z#ExjR9KYgx>Gvb!+M$AOuOhvq?QB>yaz}A4Zt@Y)PR4NdTpmM@Qq8G41iQ#cBYnEO zT>mP5+`e#75zl{LO(0CFBlOlwp6naTJf#LqJ>I;M-g;syV72g(W}lfAx$UHLgR{sN z6+%sC*mjlOLWdqX*g3>&An9c0Evu}-pJn|4V6#F{IG1v7ihPfuKF3HrT5b_EAE$cy z``lFuI{LBJELU8iN>W@K)kR`F>S#UwGKkAvZN89d`mATt)*Ez@wBt z@Nc*x2{H+NkD(UO(~+91FhL;|6;rx8f)q$X&4OW*d?d5aDQwSIN%&PNenr;goWyF^ z*2I7N0N*wz1(yg!i){=%Xa?FvEU9GA>jA_56rb=j)KhZ=;@?`5l|rp_4My2F znyxxl0Oo?L%GIS9pXW**Jk= z4`G_1#gUFytO81-_9z$+hlbTvd=w-ET$`ml`NK;S7YqPNFUI9&t_^+2OE}4DRT1L6 zI}|Y#jt>D->pPrutTM_VYsZDv_w@%skkTx<0q zjV*3gQpGCJLuCcqHm)DA*htsEN&s~JZGThfW3Y47@bTVCA(GgYF1%~4F=jLTeLq45 z)n6W1-a0UOfstf%Uy>RpU*<@q!LIy7$5(ZN@j_%^MI3H8)m!TU0gFp5ngzjIbmz8L z?Aqx^{>jk)E$sYH??0?@)@%h??98{jvxYA2=nasD#d89pp!`bvgVt^bd(imcY`SB* zY&9ujXwTyWxBLzxBoy_F@Z63wdu_DTu~knminHj6bY;-64;*$76N)Q$ZeTmbLhZ3cC{JuSwx_s%zac zak4D1oNlR9A~PnrdMvPGLONt&hrCKI?*k=w9(2C?KkW^5ZP+GCvy!VKo-3V7LI;-C zt{VH5wI`J#d=}#ezrMvAuuU$+X3k- ze~MjmHWvK1^8iw(he9Fw*H&7D2kwm=W#cF?B`aZGU#!t<^k2=+fiJt5v$zlQ#t)4b zoE$YJJub+f2=0w4<_9Z9S2q{y-!t|aY%yQ|52sXpk&+4BtG#kce4rvc$MFh>n?SQO z6UDX#Xwc%Q8&PXyHNWtautUnOs)eAr0##;~E9VB?A2ou05S< zc{NNtOZlbHykSbsmO}g@N@%3@hSd$sa#1wGKic{)pQS^IabKTpP|!ueTyMZ)M?dLl z&(Ri=B*}f#o1{o;*pUeD_hR%q3!q`A)D?TFbb*5_km-wGskmB=SPUMh0+Re*G&7<7LbMT_ITltRZbov9dc#$gGs?l`~U%w zNE}uvi;B=7yj673AMMfu{VQdt>%)HH(-lNIknEyM%bDP+kwn;oGyn4;&-ZtO0waD$ z`!bwH2LeZv6;`NcCNo((S}2nF@4r-d34Zmz^ocMQ@LvgWXou4V23JGAa5?f^o7BG& z`8sLrCm*{aH^WWXNB@fdytgnvZ+VXvMvb67*poYBI)QndB_xVDMl)zea1sf#3qf)tug((3KnP!p ze)juna*VdpuE>~3K{kaP|1QK+o+wm0XEn9!LFFW$F-_r7c(ubp)atLb+U7O_9-@4v518F*L9XDGdxy1S;W7wg*sN28QixJ^1TF52i42F7+T> zP(ui;6v$~kagwWnA&8wN%HhDkxwDeDGL%I7FsQ0#8aJ=mW5Lnm%;Gdi!Z5oak2uUxodD9jZKIDZBEzAk{7oB>=Wt zy5tS~X;3gt#~os)=am5XrGj(-9`D4?Q?bJ9Kjy?BFp?}eIqKf3F%d@O(5GOV&0gua z!B7*F)1FRlU!B>Hz)FVTCgJ%VTG=ouIs7JdQ*SUg-EJchi-wi~xNumfoZ`mqAS$(}c!;au4ok zXq@P5G-+`*Z+%8txi_FusaGi5pe{7uxw^RCDdW_VhhM=REzUk#-@HG~PQ0So^yXa) z18*6O?oo%I@YR7s5J*mL{wBLTu(gqTQVId#g|T|Kr)Ja1^LPPvw$L~NDR(}o(1$@{ zeSf<**~{qd=#!kNLKnY&>cAXO$fWs#p){l@hCglU{ZhgFyG;%DlD} zB`Ay7z^iy6%sGW;_1eO&2R0i$C>yosbyn<6ET>iCBAdVmux zY4I+^Pc=Yn&{DFX{>TnH8_G8_KY1E!xrDU)e~JFmSee)ru)|NV7$Vr|)=B=+ZiYaD z+!g*qLs5TQH#0x^Vvc8(&4X{No_T!bBy?@NIb3Sp5QrTThi&T zqzEff!}`Gw-=~>E&8&>#E04AoqM}OIDja97E*SqG$}YR8W!KIQL72TC$kWyioF8$H z&27&q@{4@RD84py5zEg5thfiox1(!z(^j)G5|{641_+ZXAqxbKe#zmP+oRZhqM0#s z^pA=KVC|K|2n*ITRjaMBQ{DgFkwa%5T^R!s)Finmx?>F6H*QQ^SVeeUiQxdQm`0PupIv4>N+5vKD4oQdEZbxtS0h?8o)FczN%?k8POlrdl}5ma z%gcw$;lIRB%|>=rz>t0$^z)YUxoGVPNGf4tHatFAMZVGsZJ=Wo*Ie z5u+YGmL03cI(Lbk^`zTQ`|!BqB;P`upWIO|0>1*r+W$ z`WBfN)SirQ;K7(>cl6f*9z_vm2Q`~RbINz^NfuH_3q}*AGk{a3)b6_c!~|@{r`M5O zmsxZ+MjvpeS+kcr3~>LIKDz0rncFYp2l3Oyn2n?buVc$jc16k$1h;iB?!2z>SkB7m zh=tO@uyO=We?MXc4wLVIgaLVwCFh>)`!hhnr?=d(P=6Q-*>Z9u$*aX1zvhtp_k~n? zoM1v%qzS6cn7^>|8;$d2QMljEM*=i~5q%@$r52q}|eN|tC>ty${ z-`hrqy?!u04>gI);@4pyRT~?ZmfZStpaIt&_gh8ab%4wc>Jx9eFMzk2odmc!Fe{Pf z2fP&;syoKemL$l}t1SP2Bj{U#WZ!`hwq8d!J)-5Ve~_@@X8gj9!WOl-Szy@euP~`3 z`zr0-`Kqx%`~{g}&`vTY1jE`-k#-l&Wrz+C z#QsW43a~t$6tJ5Q>^{h#Ba#X7nDV?c@2e^G22F)@RGYKg%%f$MHm|CHC&k=Dy7@w3 z_qZL?Ab1_fA6KW@WEmjvbC_b`|53p zBcW$rQHEb6!oL%g2|v|?de%kD6|O@L}8@-(-< zWLVM}113Y}iZ)+nSAl$<5||YVU!pLS2&;pH2J54J2v7V;y)PfD5C}-D8hbdGDflr3 z6SYt&+>KJlQi(E1}=J%SDD? zBpF%kVl|hBH~}nU;Q=4Ul`A6vvRRJ$4==AGp%&Uj8*Ndd!^nNIir%-W5qE%5>sEoQ zs1B=fCEGuLwHW@s#@ThN5&z(+i<`GQz)npx*%r!rIfCFLU^#qs^;g^vb?9zD*IXyi zHzdK6;N-fu+&>JkrE+i0CI5A~pErQ{dmdh;*6xqX0BX+y4eRRSkk2zuXMw&F?TZv} ztL<6&)m7!L_(khGQ`Ob--w5_bvuD$~_O$!s()xF64qsiL)Ug4FE?HrE#jBW(kJihQ z?YdsRV3Yx5SXE5q3Re&OZ!cwp{#~P#p?BdUWxx28VmudGbh|NJw z&k;B$lF7Mtfr=@?=62T*7}JZ}?h=AD-ph?-1QjtyrnAU-snxhSLjf997Kk$zO#tto zgTJ6QAS-uWvd4eyOi)J~X!o^dXn?1)tT>GYg5c>iwR^eN?SH3>(f~qay=Z`L?vE@y zohg#D+TsRyA9^_gL^Z?NDmg4rmBc~H*VC7C3jubASx-rQ`J{hW$R0o82Zq^v8jf~3 z?REVEAXx@l`W-*yOWggVNmqMvG1dj&0FPVKx9j4_-(!(oa7Dkc2>TD>kxMK6eNkXe zVy3=IMgJbF4jnLGG4%LvfB)pVLUVz0`e`hE_ew4PUNqDHJjQ>C_9Hp_cny z!jBvRzS^PI0qzliSwjNwp_DSyfYlOUem<;PN{=rfv?|jLX4>@x=c-3S00Q5OGw4c! zc?bnp9?)973b5*Wys%ZeK@OD@K<%#fNHG$L%WJ691iW#Ge6{o~+`nK~Ju#cB{I=&2 z>GRNw;Ls^?HXm=@(FcG7Gs)fogbl_(Sl)0+U9(qscd>>GKTay00<2*fm(kAC9Sov3O8>jw(*+eaXN~|6??O+0%90VKDOUUcuop?xx|^?}wg8&y!Eu zMD6HN_ZZ5aR|0oZt2l&cX@DO|Gb#J`6xkTNG`935lzL#Y?2H7cdS|_o=`JZWvg6gl zm)`K05?d!ig(=f_yr!TFk_Tx{Z#sHv zAoDw?OnOJ8pXnUrsF$D-xIin=z)Sn;U}C5gA6aS+FK;pix&;Hjyib2V+UF|6XT|dK zMa`z^HjCNpEwUf~l$T>@0MGvCg&3Y&6pwj0us&i%Q@+#hV6Rs5>Wj~Vp;j74)PcMC zTqNK5>COU|6b@}rgkOUFk-{DABWl(xrtKU|x*+uE$e+{Ub^BiRV^4?Kv4(a;rhLhQ z7b(YATJej`UAudOKHNm_d+gikP02`Lo-)gFk$t%X*~7tWFMz=b;A;r7AO`wq>{24R zaz_nWp&!}wT!60bPCv1iSf4#WWfI1G?DcK{8-;@yOrI31r=^gSAV@{MIwl6}qY^uW zD8ctXvGh($5>en1jQg}zwGqdsURN+uY> zf1H^RH8R4dwsO{H;xb!(Fkzkn;ep1*q02jL%5nYv@JcDBRWwj3MKyligsp@Gdxw@7 zYuF*R9`#M+3A!?-?*XMysXyM}2FUw zN1wXAC@1Qm%&9mjS3%=lQ%>jl#PpDb>ReJ^o)u$kruvo1=z3)A!UVLksOo;@nku(L z$=u8wBg}cJ4U+`PG#WA|QX;KksbzD-OTL+VY_| zor_ZO$AJ@b+h+m}J@XZVRG^5YZ0Zh~ZCU}FJIfX9^)fSiXKYxx0@Y0U4|5^lJIeK1 zWNYRF-8pLk8*{faiQ^h_A5@+;S91s}Iz3HG-5XKAM-X&sV!*d&TYs`= zo;o+k@0sehVkoxEs(=MSxgph-MjXE=IlrxHDQz){|8`V0Km@h{t2WXjvTIq$2J{#T z0n+Gosk;fZuq?MMhJLN8P}MC_y)-`rw@h)X){!bgY!4LppkE z*L43$MuhKC=IGq`X~yCGFh}zZ!}yuKmWgQX+O0Uu@M8`anoboVu+389o+vM_oKmVG zWyPcRObd%sW48PkOgw;q3Y7*UaL{%n1*Yq||OGCUKjZkDCWpS|q$v zn`jwpB!z1X*spUqWqN-PPFbZCO%b2YlNf0!edBUkB(28nUnwguet4L*#z9Il9G#}{ z^4Y0x6?awK8Jum;tD*Fl^67RSG!6^aUF&qPO|($qc5)cm8Ng6slH@Qw5h4I@am0Db zuQ`n9_p4p!M1-9H-36y}?!hv3Z+@4DAo(6*4Vv+&tg+NEh1GR;ET}6@k`rO{_0feE z@J5!qrVlhJ8)vyi^tE>IkBr4Z(6 za2;9do$@iBXYG%Y6Q2UnFdR7C^9=8at-oMm2I+lLehU61NfeXaok4j^I_L?lCU&R_ zK5X?}@vyFM2SV_6wx7GDjZiCX0c zq0<}wKjV4P_se=(JePj*q+t@f_-o(9Lp)BPOwUve>~pV1X~careG$O~Qonl+PN@oF zZ+c1l5lfEl#>;kZqJkSfyh%&%ev9#HXJd^EYuupJgrsJfYrXEv@?T(|kiiBHI4Y7P zzJsQN1#1usgaByqi8@%qm&<4aht#X7W&QXk{Z!l}E2YIVxYMIJeF~42c+JE(ij@|O zvbpP-C;fY;!DA&rrS@1!qhJLOrZV1aJqtfI`3Br7@E=Z*0xT5l{TfFHqC~KG*|qUC zu6gbC(8{uJ({K6Lt9CkGk@XOayUvD+`7iDXy*_RC4Vn%X{gUFU^p%!B3!mIyZi_}H zwg5`aoKX_aqR{Xw®|pm#xK0EaA1AoH=m5O|N+(X{jwS)$zUp?rIW43<^G_|cG2 zYF0q@CdYb{$jX7`Q?DK-B?q}*a%SXU-433Os@1(bm^lq z2?}C#vW)QfL^b@3T4J6h6{5E!@Kvt6qzL6Zszjp^5?hiET(}(b0GY9Ic1A?E$#?Gh ziHJzXyO4Wi=Y~qzN<@bR!S7~M4*RDN2O(&)FmC)x?nQsVJnshcKs^2mjLeoKG6YgId2%~{fmr~ichqPql z6Hlw}yW;&E2+S`>iak>F2}f5DYZWC{^hk;4 zK3-OJ4aGt&YLd#QN-uwi!U$8&$ddU=$P-ZQ8>pK8BpS}SG?hiR#A%6X=fGVpVUxMc zq%jncEM+Mag;kNARH0Bp=?vD=GuF1s$||$v45zU(V-v8o4zo_fyrmvL<{G>IbZ1hE z(1O%n$w33D<)$~jOe`Y<33`TGBJnh(%mPc)COY;>(rG`&+ao`>K93e7{^r_PC+oBk zIhyqfSDJ0<#vI-T*X&6*4QE9mun@lo8pB-Y^k*XN?EC6@{8oP+^J2@ZxXF-@WA371 zVJ&~oNhQiCZ$is1B-K^nP`r3S!L;n!-BnbM_uG;!Ny*i~oUS0EwR9q02g+jIU`~Za zQRY77HtLR;ygqb=)z5%`VUEDE&%#U^qGnvFqJ>!NO(;40^LPw8G|-T z36;wZicBMlR%zJRul2;!GNg<5)b*IQ)-uCUVZ@vvI7na9TKc9M=@YW2;jqzEMVm|M z@EitQ2k3AEN6w5wEoxj4rT=?wssZZo1Qr>w`--~kSTBEQP`D^1EGi@aY@N-;)^$*E zE2f4pOZV;!G0Pxm0&@J4eT6vt%NYV{;e~nc6c#z!VVd4CSWEmUt?gX5e!tn*Wwd9M zlml{%mP{q(ebt!5=9Xnq580SQVKmlT#AYz{cWRv_#hAiqq+Q6~sL5mcfr3g5Ac`-|*L-aRuk^(v-PrX3Y#eWn3{y zuNQqC+ML(PcUN~Cogk`WbN92O z-A8=s&dy>tM?1+KdZ>058UaxE?@OLN}!iiio+J$1fM(kR;o%O-Yn z1K6>xl$_0{kw}2$3ncoLaL4lZaj`y1%qpv3FFwjAz|evlD{GS(rtr8C|HfTxRC8`y z13p(4l*q@5F(rrL-0(=U9O+vAYeU%|Fq?EMgu6PIO@wM7+5miT7}24p7T@uCbE(0# zz#r_dbo#(=jjR8y+wn!NSoj)i@^#eIJyauaEcXF;SmC*JMHfA`EA{PA zYaIJ5CPOQQQxy!(0J1$ooxx*-k{9cMwZN7r1LFJEEtzmO7t9KO#`LEvuWCN8zLb;M z4k7{6yZ}heU*^;_(}O6(-hT+>Jf6?S4?k1q4HjaRmFX*GPI8*|v&z3XbZn)oWCa`H zVB7GiN#1wF-uV3-DtHGo!)8{>IU>fQ_0S>HzYza*VqE$Yo{n%Dd;OE{qTcjgBPEAa zmz{&g=VMA+8Dn}p&q}(27+)zmvy=`o#7RSf(VC|vhXI1NQ7Zwnq%D!J9>zr+r-7^; zRG%9-24_8jl%idAt@a*|LdOF~>b;O8(VjTzN1W}z*;>&TK`Lyd0j;Q5FjY`4vcD$ zHIe-OMgS441T2b+CBjTY=2X>fBG{5~z;$+F|K7)DK6br@ozYGkI(^19rU{;{TOYT3 zbCQ7lU}wP~fgradHK zywAjNRXXQ>*2a&PYCk_B5g!SRB1)UsB&zxE*d~KH7Jh&=L#zCb*3$F|dA?G=z~vdN zZXjt*m>y~fVay{E!;H}*;F*-+Ud4kY@Sz`+{Vb~yNjT;O)9Gh>v}`}!NTBk?Vc3>n zrV9}GD1)+Ua4n2JjGwKgv+m}bFE-^_q&G>cG}u0} z%ObC9184fQ=Ezhy5yX@di=yi?I}Gb1kJ|%9t@rqhtw&}PU2Y^7>7h#L?Pmfq(}l?A zrJQ9VUu-9_eI-2F9reJGC5xSCz~^-!OURmh)fjy&6UfLovr*9bNkA4wx#+U&_~TRI zj4CCc6q}Gmdi1`zE^r0!xdcEb5+*9r3?2iOiL8gN;lT>4plrdchYG8wY?xoOWFaaq zsoBS66QF+BJ~^zCa;X%{b*|x9QD-i_`i&$Rs^Cbmt?b^XjwK9)dw!|H4uMKG(UA^e zK34v&2}6e2Q}@On1bJxq)hyG^-T)&Ib#7f9$TfBBj$^DBASlSEg4kl3O&Zw+U# zA2k!8#w5(B8AQ#ei`uDlQhy~ZZ`Br9)B0_oSi6!yYj-Y_w&MOx>*L|dA767(XwcY` zF@3>g4P^C@rwU@y31pVCb3xp&9D?P(m_@MNOT+c_7oDF`(tE9JXoP&I8UdriJ({JXxYDEioVWL=?g)t8h7p%Vbtw z3EWPl9XCQ#%gv!gp+&K)@~InU@O_0Q=Yxh)O*ox>BSRykUYcwVVMQUxSh1M$>RFEH zRs&P%eCnQ~M?ABVhWh4F*{}`J8U%IY)qeFDc+dMy%fPRA zHc#@ylFM>snQgSfn51w5c_TefTzc;(3TUcepbh&gaAJ|L zHI9%>{o5nzna%UUgEQvnh`|Kor|~2Ypx#Ry9I`)~)G!PHHcx>9{da7N$us@mr$Sb_ zAGed-gW|9z+vrJiC?1Bk$C1Pt1UA393lh^8j8*;U^fvB2w3vfQ66dBL8yclQeasB7heOJalv_0rX6JKG>n~(OpJs@cvbL@91 zmBq-xf!Mla^v6#ym054{NW5TL4#yerYP4~8pwLY#844viqVLbKBs+S(MCO|$78`NX zr7k+Q(I$DNk>3o`-!0s}S2I|;D`6WdQZFBu5P-5^>lPVc zb8})zj+!O4%OS7m-F{K7L>d^VSz#46Td^$`(<7S}wO9b_vHRLFR~{k}-e&^ms};sR2^5=>!4mjPy^EpG+~Wr=xL0pu>i1`eWY@=-r=?g&>NwIxXkIY);DISzXOK`xNHl_;jr^1BC* zN^}GqlCtP((|(EO!msCNU6ZsA{j~9p-&oq*eU`c1T{>=YeuE`qLIFO!yhf>mmLpu} zx4s-$OwaE51M@l6@iMq}qz2hS)`~-%F%v32f$@c0zOxC_4Ksfyn9h?Rq)S1(BBq?G zx-#By7sUr>#9A^9U#j8mTaJA4Q_u}VFoS+b=J5mlpvj_weyxf?sbG~nxk`Qqaz+M3 z2#h9wx%J+9zHZi;vnI~^p^)~gWgZ6eG2^Ad9yL@{Q>q+Mac66ow(L)1GW{Y zH(Bd6(B1lGnER~*|E%V{9XE!yl87e$mY|j0A3-@JXPckaUX?=mo86^tEkfnP%W|d; z(i|g-C;#jb1+YgB$cd=<_ZTskpE^a%O^bEK2hox2o-!A|R@$nx!)Cg1{qf`nZJR$# zY+n;@caYX`z~JhJj3Y|t06|@S^4UO#h2X7#uCs6_t@hyKh|Ys>Oj)h zpJS}4YC~d;;I!S)qO!@A3qi{Of;J1O&E@=OvLDz}HR&2rE4b7dQ%cAUf=|J6(g| zUp&tu>C~IjfZ&7J{}|1J#xulimTUzULLegUc63t9aPeGSB6WUN_(U75e=qI&3sr7l zMbTEx-}A2}`1fFf_%~iwK6o=DU=|B9WW z#T-3~Zf^Y_`^{tmDCr$O-nSi~c`2RA8u#|p5dM+M@WM|1%2zAj3*!K+ zVtV;n$>_+Qd0usio7$?f|gTRNhV-rHgb1em3$3KbD))m>Q<8Mm_=XUqeRS z0J811a6&M|Au?$y1}}5;($+0}0jqfM+fE-_)dLNbfnXy0`F#jLObvEaHMx(LSekpk zrDzWC`0^qiM&1fw!hKV!`5&WQ)Z~r>>G?n3JKF|Iee5L1U7rZTVqf4cHHF`y82|Kb zg$n|3jMscr>mF%i!$1Mz9VM0$cE%NCUA`c@wrj)%2eNjbT=_vAI3R`&+&rK7x^2wo z?~RPU)2b$LbVK+FaxxH2=i9A})(mA+Ui~+j9tT{U7l2=-$C~mD@PAXA_q?Ccf9aHm zKo>6YMnxr?=L>B46jsxe))S{YkBBW~;-Mu_JQh-o_P6Gg-0L~Ha=o|JdYAcSU^^D6 z28OAA>ulUsAM`DGclJ&9T5RX}CS2NJp?>foofS4@zFUS|3J<-2y>O>Qu<3}jQiDFG z``5`Ls7&fY(J8XH_e>&|zUQOqaa|Sc7RAQe#)GGo05qNEu6BV${U&5QB^AO zS@?xGUuuJQ)Od~BXCjLKO5|{h z2|$Xdm_hTC95IJGQ`10)2!WDRo)8nH5XtF9`BGzi*C~5>(Pk?wct}JbMBwZY6PlHz zNI1J+ET#Xm{qC{Xs~v&rX~-n?(h1`F{PvL6Cw8- zk0I6Vm&>gk7s#7EzLAud9DT$gA34{$K5@Tez}@QNlFyj`nT?I~J}#(E7jT#^_nM3_ zUF9CzZa>$>?BrSfttuStwyu&xaK4J2-N|#b+0;3OdlG;&UMkZOSg1JlzgeQh;&sHWkzlRifuH>L^u?(UELG5@_Zsz%g&*DW z9HSD19nX`=F_(uxvt)__IEEToqQW4}UbkAgcG73P*G`3_W)aGYFV1}}my~|p8tclP zeN_Gc^%+$6`3?QC!n49vvF@fahH+ag^7WxmcQ4CW$B3tc-O+hO`m{530t4*Oz_}pK zi6`+zbd_#cZvzuf1ts2}M)E6{sU=UwZS{kLy1gywtZPyGWT#?ldt7YX*#ZbZ{f`M0 zB%xobl&4?woc)M^MPwEp>s1~$);uA^`lM>`@(g+8?PcLcNfN%+QGDJv=!382)F<<( zzt>r80c78;Dni_izf&&7AMLK;p5IsQWdIR@>fS_Br-eYw7{^l+x4x+Kh)I7|m=2Mv zLyM(ZzB3WXDz)5Lqf_r3Gy`6E%`E(O*Lt=EYX6O>qM5|>lZB*FJIC;Q&ArAl=7$md z3!29PNcu5{hl_U4zLIHv_O`spOMYG?Xl45P?b13*=v41oe+emz;=7b!lD|V3X9;Zz z35MPDR7}ZXZ0_N|?FD)U!Upj*iw%?s^}Oj)l9ZO9!=S?WEdCIu?H7RQXWndojsJr- ztxwj?R{L&`i5Qw-at78~`|E74_OXv81+<0h=3paQqQdGPCELPa$!w_~Ec(6=hMt^w z=NU0cJ)0AAuic~@FW6{d++;jf2<;fgTkDjf@OOSTJ!ELL%v1Whr0HQo%0{8wnTo5u z+Al9G$VhYIv(-Ym?_^S2G>DKI66AfgV$wx&%!22shxl2Ew zO&>}koT^F*Mb9HUc(?^Z+n9ra7iQv)iu=!s70|BadZWjelV2XCvU_Q~`he(46;s5QYW!jayc))O`J^L-jQtaw%`b znZsY1K_xs5?ms4{y*(B78W6r@^0zw0lWj#?NeS;|nwa1aRvOG-KaxiJW@#|}N-`fv z-SV~JP`sfmBZhd{HK1>|EMOIYYN$zhP(XVp!z@6v>1Ih>u3?h>_hAYm{l`PN@3RGd z1--Vm0QV|+;9ztAYLi-uatG^28gnm^JPf?!;(+U=NBn^D^T1HUvE&E6$+q|1=^PV9 z(Q@;%a@=xZi!ESM{iV!r_Ycbh0xe(9y=)SyXI8Cb)ZK3*$fg&S2bvQ33naat}Q~Z9^V)#^`+6}Kj z2}!WLMz~U3KXt!~4xXg~sp35jsS=t+{~sEwc{pzxIf@U~ol0ZW9=A*G7SrzMI_%*i z#ZOdQ1X3OVV8i?;qxr<%Vz;UbIPcUWa!)g((2*5A^e1pM9WThPXr}~uG0|~;k%g>P?d?hv@RF#=dTO6608gA|xP^?#Wcs-2w*Zd=Dl<)NI}zhYL-fpHbc{e2 z@lgyoGHo_B5X9D{W64iNh5KYiczu5MtbzM3;JH=rVa1di8qwaSC$DUttaf#@fl}-@ zy2wD`_^<;65MwBA8_i&ahVkF6u-zn2z_D+flC@RNFwfGd%!5#<^)TNKKqQ_DyCdW* zr%Q%JSMI)>!=`Xm0k>kguC-q1UbM#)IzH}`8SS=rh>48Hn%L6FN87W|t(cfM2Xw|? zV1`jI3htgxx=K*{zOCNZU`dOk zw;{9=O(DBy%yNdCjCdWc#ZSihf-^+@hPw$!Qp?N<~ zuFGA~OY}yDP2a_e=#$UDX^t8x2>R;-(#DytR0_X%gD^9@=6G?(B%SyqFvNTQJ!gwy zwLuPAn$2tQeSh4c0V7Yl+EcCF)Yk1-#e6Chj(pQo0?UB??3$?URHyLQfctaV-NGMf z3YnmyZe!Wg;17Wx3+3!1lqW+y-E6}U;cYf&{gG6LMu&_doN}sp?J)@J5z_Mx3GLN@ zo!3>bAD^_i6y~*d43(HeIH@*YxCQI8p7;hAR`Ipa6M+d1Mr0Bd2@Pb;2a7ln+cN1U z(E|?pl!-}_`YFeB$l%0q#s58-w<*{xm-(qB5lz-ep76Cc|eW1Ck zSYfXK`Csh4XH-*N*DfrGA}S!D0#c&VM7lI-L8TKq(u4pKiqd;8q9P(CROuoerMFO} zNC`*{y@P}jx^ze&oE@L%Ztwklxq=aZd5*!7>Tpj^w?J=j)`&H=&H|DDa^N5qCkH=bl(-Y zb1KNU@WJg%0NW+ux=LwglYuxkBJrT@M~5BXrUkI-BB+3Pcq<3}5TYVBAl_ETgw22Z zVdz%R0P>*(#CyR`K+N2PnPqrX|EDyo2kRWP0Jb4>Om&>FpSCuP{-w_=oWk zl^qXO>5pA9FJ8Ql3I2p(fHNJ0Dj`(u2pck6mX@B)B+74G&o!b`JVScf-QHSr{#d7M z9)TE`2oNV7_I)_t1ZBTe>e0u}uSlG2euwMp=Px%I zHB5-KuC_utO|F(*x|sN!wdu~Q+m4;hY9nm;h{wjUK@BG|Hv=ydnQ>qKJSJcA-5;Av zj$NEf_6}8XMULwzKkXNokaJX&G8f3#DGxpMrlc?~F-;K`WIgL3vSwD8=uaEVR9{jw zK{GSOgBH)xc-1IYF!=XKmuva~F z8t_Dq<09(!p1yK^FkFFlfu5OQuYwt_x(HnEkf*i|K^m-Ic^4+fjb0CPs~g!Sk05RT zwgg!p#MOlfOd$YTxj*kCu=<-hnbKCYiu=k*o2qC;l}s>2C0W^o-B1xGRD9%amu~^8 z*uJ1djRD^#a&*)7mvEdDa`vG_MPn=`g9V(44gtH(SV)!2>!l`VHAcWz1z~V_8`=O& zU!|#cAu;7mWbj7K?KEkscCUh`3ce+Q3|D@8)<9^`Lm&OzPQ`SPEYgU&nyN$~U-N#w zM|)e^VXiXVY2aPf$GJJ}H0;xIfOe~U)j0}ow2*&I<=W>Gc#}*})7^`Q6El@rQqAGf zV#9Jb18InqzFfOB$a|nZr||h1wj7*&$ecM9T}YC2(shu}ydBNVj`Z5A9@V~c={XI(5t^_7TVDe@zNoIAL7_J-vqzw z>(6yRIO(nI_zibLjy-4xwM?LB{@&gKnGMn9yG({qGNsX)yoHukKAaT#3hCG&9~<*v zdC8SC)2UzQ<0eXTP95hYky>)K(f7)jyQ#ZHcq|>ZQmrF((2^g^&5{PDx4}9J0A}eX!7SaPw1E+GsXuzmAjm0( zNxI%ERCdYr7#CKK3DEMxjhI}l%R!YEpE7*O-IkNz$WZ_tmpN$BTZ_t`Q76k`avDU$ zDg4?$h_l+V>SUW|v%``~wUU)iGje3oHq692tG|%%(0<`MZIg|kz3#MT^JZ_$@XV1f z<_vC({v@7g^wkiEf^&ZWVncFK?$Uq8X0LF}nOpqqkdWYJt4$>raatAA$%1(H`V>e2>uA+|L>#zoC&}c|Jwv|Co}=}dGNp!s8`HW zy?pF;2!umLtWuoh%VEffW4AK0=)?8#!TOyaTs=k5x+EHP$)zrZHR86^E%eJgWU-$!QR7!3e^s00|Isd5{3jS_2%cv#HQDTjl5%+%<}_%?C7(cHy&?vhnAlPwQJcg1xLk%jwJ)yspojS;&XM?fNaJ zV5lJhfE$W9JmWKVq-!Q!q1TILC=! zlNh94(JE|C)y9AL6N<8Ccw^UA#b> zFU>)Sg0RlTxysms8@P6P?8**orTvhHuGj>>Xkrik6-ZfO)~f7Apidl3UIZd`&&vU~ ze7|S`pr^Qh{k*O5t)s@35uiGl1^Jryv)}9-7Fm^>%?}S<^?6C0uMFtDuMzbdGp@wS zu4EdQbZaf$gp<2cUx42>%L#DQ8ofByxQKJ+WJ5)Jp~FQ*D5dr^xI_`?@5-R;E8HNl zd4Uom#R)>WhRoNuTs#~B%Js^<^-TQSaMfauLoTCLKFdXaR#>TkvmG>-#Lf-be&)5C*KZCN zU_bXkDLz_uo%{I817&nXQJ7D~1wWgsW204{xoYp}Kdqb4?|PSju}0)9tQ`#i9Cp9h zv*Crcu~$@Z@dsTr5X-kS$`8$?3Kbeh5cLJe^nSx9MBg?EUU~al5dsH&+ft_xwD^lFC&4QW<7^zFi?uCaYGhoFNm;Jpy#qSC6SCl|eijRc zO|+G}sy>#sk6lFP_vU4zcy z2cKlvE!gOdlbY@mPW&G-?UP9#KMK4IPg!|lba`O^UK}st@^^F)<(o?tH7}fhE^q6zoCOz4l#+4lzinX>M-Mu zEc`yUDvDc)nO%i@kIBtC)mNm|k_1OT_8Wh6)`5-)VB}i(9Q=X$Lp@aKu8NWo>lH%_ zZTlARbXYT7XtL=lnUXmLHcKWg`y{#6sQ^WO_IXQkr0mYc{>x9x(*}(jWHT~L;Rlw- zJ5CQxL1FsvdU{eO23rL^%L@Gm_N==1cNk82dB`T7Q_*ASIFHYt&e5#L_;#3w?}kjv+hp-=o=kOzZjtEUKh47D4_?XGh5pE9*X*uxb=%7c3~U z0J|miFlSr=v_tRT62#_>5r5loLG3awlpZu{a?w#V!#|o&2<-8KxrGR&X zhSb`_&Yz<6_6&LrFdg8JnBrXdjI<&B^zu-$f(L+)nJ#7gAnySQ3ZOks$r`;RnC!o|*@As;$~cuMLF+etF$TC!`6dreA!d0)sdbPwHQ1 zEiY`9^^;HBfk%^L(qBno->&}*H808iEwj{J;I|ENEN)c2HU~jn}}H7^|C^dgB_mN%L#O-i%hQF3es9aR1viL(5JAbr?u~Ce5oq<2XkI=-^#1o6)=rS8Ib#kND}x! z`|S0@O_5B>$9lYyMeRN^0+IbeVx&wJI{kERkH8_aJRKRSuV49=TAA>&r8+Z}!c*dW zHR7{^{Av^fh->NIzqGBhE$YHoKJ+D=a5zU5{VYpc1 zBI!h~#Q_Zhk~ZO`E{PuN~kGg_m@jz_zU9=KD&2|V6 zZs+=8RZZNZp z@l5ho*p>_W{>39}4ttC*!1=e{rGoe-1&H5VM2j6sXK4OZ2(c+(*FEa$O_e|w?Yl9r zw1Lpaxl3tl;WzaRWTj24_*q?WgPQl~Lv9gm<*u$O#bjHk+eFtPWSMsQQV@?|ZRKldVnFA} zRD;k`X~cT>=%wRwG(rtFD5S5+nA2oEKEJy!Glpoo2qZhOPp^jpSV?CqTUT{MT zZs@mvrjn_Cu__}V++voT#8_Df?Z@rWyb*wwkcnf`*n)0<*}IfSrwA{ypb$}ZgQU1f zU3e?NAAKs;-(d$~tiy8e->|R_prBKFstjWOUIJFt*D3Xa_?6lbLj6LfwW8Kf#n@%8TM zUY*SsSZR)np5Z}A`oaQM`DEu{V9OK#<=E;AG|etW-5R9+VIwY~RMr1_RaA`+wyT(E2XloL#p=D4|etT|8UN-&jnop(W+dA-=}uHcP{Gt zWoKA_UML@}$|l8f;%BYo0g?S?tp_mvV!Npgjw2SbEcLi&x6_e@dASmOMg^s!(nUFS zQ)1P6ASZgza@Zug*3uOXi*b@(yZp(_bjagkL2IcHVpTiPd>w+*w+>Lzs0=@4jSEv+ zFuvStt{p4mbHUt6BzEIIo52K<8k(T((nhhBlHq<<*k&QP9q9P`mIYY1s*rXbp~tld2p@#X~9Ek zA@)~?D*5=buT0wD6DRjhdD!b~nEEhf`eswE(+xVwh2`!Sa|cWv%h`$*x4|D+zi)n z^=&Tp%AL$=o&%1_O!e?x@`*0#`2@KdFX-~}gn-iNv&OPI^Ed0812Sk@q#m}_<=KeX z*~gyagpPgoQ=Yo)wB8!%^5QcPo1x3}Kmt-+SR!|u%@&oW_+wPw{;ms+XLPiI>cEJb zs%bvK2I?q`xRZZ+#PjIqJW?*kg0p|5jeB!Y4zV|rz}tN;#7^1yu25xYU?}zd3rwXA zukRyXN{jSUD%oGX39GB;#f=-|@%SP5j!lx@#tBlt^X!4}zbryy5 zc!y|jLd0zXhV+P@g`}?zf;WrVsCVL?Y49Xxa9?Q1X3cnNf(SEIR(P$u_dGFlMjPG$ zElbZ*0GZtF&teAWd#DI+0yF9z7eRht!)*;?uxNFYYSU2eU=zG}F#m3=g^hM1^6IXr z+3{rR{aeT+=uSCiYyKjU>xbyiV6H}qZU=?rf(qn-Tl6q`ss5hvel^$NqI@%5uZ_AGO$*a44 z6mIto&>D)sk?wv(tsOH-V9~jtrgv8Y>J=d`p$o8*uOve3*+U8xfsz-zN>!EA44pO_ z2QEM#GZTpr2?f#y`Cqzwj|6d98KbSl8YsSTgcMi0ut7%WqFK`H@2V@^G3eu2a;KkO zFN5M&$W}}S*Ls40d8)rqW~kAH1WZ?2*ZcCmfhcb=qV-#b*gIZbes_X1fb62KNg}Bm zy}}-{mo7!=@E+;$T>~V@19haYdGMvElz03#6U%vQerf2= zu9IL->7B{z@2PE9kK)e0su^2%kAHgebUY5J2`bK@oXDeGe-dEN`*ZD=21-D6IuC@i zNf~O4c-i>@vVGTdInA}1H-gW#a|1=A%V@}mw9aJP*-z)Ug(HpE4cC-!S)b`4y@f-aSI7An<~={$v8(MB zu23*Jx%(pmYaSpAnr8g4ECqNYA2BeaD86NvbKY}?+~{MuWyFA2q6^vbb-Gp?Qt=Mt z%5o;?^aUj`(@U;wGEn9Fd1178x@(S63wJw2@Km>*)0ggoCSw;`{UNk_o=&>bwk#!R zV%12QySLu3AE0RWU$i{9dEq*S5#sBigge-pZDfA5bekQ~vlc~(i_BfPnc5$3dIjoi zdTamlCQy`bLXpy+=8~BQHxw4i3vJFlK(=1A7t(Ku@e zuODYM{4`W1C8}R#npO1f-p?E6%cV;m^_@ssQC^&5~m%$pGF7UG&S?mIcxPNQ{iV_(|htf4d3#3|PuypHdWd!U< za7@`|wmON`FLu!DUD&Tol&F0EMUPp(&mASLB#4w%kzG)5V%X3z_mM0bi{A*+o81jD zUuJ_fsS<^YJ}{siyw!pcjsCJLX;;@PJVc9@Y=B~8dwsIkg7)aEWc#AeI^u!VDjNbd z3eU{z?7&tRcj+db&5Xa&^rf$gRsk;lyg*p*NyLS^hlg!wfwf#%VW>{*irYU{=bEVo zw%fb%#webpmwZKS>cZ|p6b;ZZGE4lH2p6>}>m?CN!sJZi_U)=pCgHzaI+O5HR zCV+-ix(OLK7QczHnb=iYXDMRYO%Ga}_m!wLQ(@xJ#Cu~$UfZ}P@^QWTDhh4Zbj zpI;_TUG9em)QUWC&mI+Lx45yfTT50zO*ky0zUddzy z_X#%?-$6{0+vzv%9Q&fO_pq!0-*Fy`I#b>#HdaZX$>EBbFriJyn4D1^2Cc%nl% z%7$fBk$}cr0ixZhpHdBz{!G{Wad9;gcu^vX4>}M2nAQZs^-bxypfstzhZ(6<+;E@c(A)Oz8<(jCRfP zUc%b*%MgoByK2jnL85)u3affGc9Jug0aX1`Gk~ghkwH#Wjv7z03oz+KjJW|denbf% zk}9bG@#0!%U#iEYX&XURg=&=xHqWXlC@TVs67w(&$UaF%s%U-ODnl)_EkJKUMVR!{RAQU*)B;sT7oFSxa;!JaA?;am@vAoiGYQrI2RR<9(s zfjOU@9*VNIN@n;25P6jauJXa5=>Oy<->CsETfagFmXMfix_SE=4RofEH6&5z3tKIE zVJ*sTbvXK~(}Vf|1c~qNbA%*M4y!9S{0m_Qq{N zBY}QMp}>>mpj)udwhA^00LR9P;5az=6TtcYc&9AG7;0As)B(@SH&7c#c}OOd=J3k7 zZwD52L{WMQv{y#E#ZjQaByp3?6-%P^ke+TIJC%O8Kj+u3T3a)zo9mWFzx4J@jjTbe zZ{U^(ZdY3mIq^)?CC5NE${tUrf1a=ofD%%EvK#D2NVb0U6X2ZNyYVP4B|h~72Y8MBc#5#`-)^T!f! z`0#4640qNKzE=y(S=>BnCBe$f4!Vl+M(qj%u;~GPx9}@|W;XRvfkj8O7o?ku27(6_ zKd$g0!o|ITG&PVq{TrT^kakabMg2WxJ@Oj$Ud)R&lEB$|h|>2V(U&?PI%I*tMy4Js z73=l;dpZzj9S&aDlk2z?w~Wa+6(!Kvv||go0;{|x$8cBI6fb+Na+x)mIWs%~Gk_SO zU~(Sl=;rMFdU>PDZqmJ#oD}h#MLd6wR`MpesI~M%r_C2=q5VirU$v~s=i&rR1S}RF z6^v+n>TEV`Jn)n+M%kGh=iCN+CB%}1c^6OO9Ws36yEKYg~+ zLhXrJhCG97It3Z6U`+=b)zc6%&2_;aY^CWhZo=KD9jF~Ihlr4=7q+&(7vE+-SDwpi zsCY&*~KIj&UE>(W?}t#{`cfAC~)e@l**(cx+~cvhRl0nkl5X^_cKm z-ZZd^hC3rKs z_vp}Pze8wJ={4uC?tt=#4?d9Ts6}RmuO0$8X#@2lv_H`5vsSXGFQKG;d`e4#+7|m1 z)e|AfJnj+8n$KjL;V>MnKWt@?Pt!P-a{AsqO0L2!rMJG1@hnTTKI)axZ}#5*$Cyi$ zL+n+m%bqARVp&60&(n7&jNlJAmEhEADX;D&{_t*XVlFIf|dl9FxxFI^@iKc>k41OGc>8W}5d^pu4#IN0;KjB2q-AN@fGXsCblWJCX zPu;Ga2dzJH@>Q3^etGG<=pD0=PM^IsjFpp*ErXvNn)=Y^znk2X0LO4pDTpGNXztio z(J@*XkmwjI=IoT{yk}1`yt#)-*ZgQcC%o$41a!HX)6*|(z!(kKYthtSGp`#>Ufb_3 z7-naGI-f){t(9@ZVw8GXE3Hyi561PaohRGIe8wXsbG<|N0os4W#%;d9{fk{s+WbLM zBhra;yH6Zj_1iUQS|Tupk71_dza>wb?4DR>$hBrao?i;j*<`Y_?lNS7$7V!{e!#;< zfbf?@xRX{ zirlae!Dw4JS;V@T4`*puCnU|BNh~&@UE-}QSa%9yQg9{2d<5Qtq9#k{+s#>YuT z)Xxt9@O=B*kXD5)SD>bJjRNcEj&L@1d0UPUfTng>tG4Y>(oXqeu{9Mx)<>IFnmuAK zNIhM^B}#v!a98nl7p@({hKuXom1t-wkWFLT-vTIN`y@57Pumf!eFV_KBCXtfH!#F^cmW+hN{2_o9V0U!o;kxjP$_%1^o}LeM>=k| z8M0kRPqdTByQ6Z1G8qmPYD&+lrHW!=2O9DtPZk<88LaGV>|Dx%HY7h4Y9(o=>}PiE z-LP^S_At)isyE9}xEluEz9?&t+!_e8vs0O`9-)SsFEOy#cCks*^V?;Frm`+&j~`Fv z2K z*)SBxTrk@H?DPCAsS@{ELo0gF+n$RAEWVKe;x=t}~7In-*C`R~MP zf_wvVMu>DV{(M&P@B7UY98yV_!xz6z-0!FVXAJE83V^v=zBHQg@B7_U2ktkYSf}vc zNB=nn{y;H;$^DxE{f`a#&tbT*0#h5|$TRWp`)w1@J)dfP095>6FZBC5fd!aa zm$x>k|M^b;yHtP8RN((E)gR*3^uJQ|hj^L(U!+RA$qztF-NK(Pa7ZU+R3`uT!1_nD zBcZ9}5~EAEK#$=pcI4fn?mabEpNM$?jW|+&veVVGR@^vqa)gxL9RD%=A656)UsJD3 zjKHa~XL9BMu>^FMv5o+^!Hb%bFIQzni8`fCycXk@ngY+Sb#4e`)-hhi>(&fLZR|Vz zQ}zRgS)1O@Fl6TH3YRK;uk*tlEVa_88;RdmbLEn0p99X>q2z)!4qjaXJqVgA;Ymd5 zQ2k;;)zfF5<$r93KVF4fnkaf&&)EOvp3oXxzStI@l{)UXEHOLYyT=>qrsjHur48Ll zIO5N?NIiEwoX?_}-6W}M>P-IYm42%~1TPU=eQ^WUI(cDptTa;$C|n)?-ISyDWrCt} zS^)mo{iX-5lS334!L02LAgTWnP~bXHhwayDK54R^vG*6@Gw7E0s1|FTn(LdYo$3cl z_Jj4=VirQeeYk1@==~p`l2ww9I11mhwgW>s-~hsS0_z6;4e1ZGy|6K<2QLmWy#ZB! zM(F)dTVc9MVl3rZ;d>hTtS^g~4C{8l@?*0?k8LjK=PK!?z8V z?k%rApNJy*$3!3)jBx~kTt~M zasOJpJJg;lO_US4X0y1NL&Vk^g(@;m-POcrqjCu#AitOq@RmOGY)q37I;#NxWA#jl z&$E6$be%oj^biH$y6ba7M#r*;a~OxmKqJQD?cltN%gMSO|Kq(rlNkHC?TNZkGSaP+ ze$fS^_G#luy%+R({`nq(&4gH|h)|;^ice?@yiw6i9!oRbOdfLMe*`G$9s)+x=KO-J z$J{6D{lBj?;rcTN;oHwCn1ek!y+7gb|J}TSfdnr=bHE*DS)k#9!<@$dll-p+Hg z>A$Ae)So1wZF+agr3W5xk||OuwNWuRv3TNLVNRnjMLc_kKTIaHQB?I*7h6p2=|wq- z^v%n9gcs3Fd(|dd{N-CU@sqW(9s(849Nfb!lZ}7}EXlkwm?o6J-&iA(Z1UP5)X8I@Z91h0Te|d@+kXiu6$6#BxHmK3<;t{GG=qK|lkIwxdEe zPnag8{?h+Vk(VUTzHK1{A)h*#2J-adb?*G?aqutq0?^sXgR?m89wmnWTz8K(M);2<(rCshHlOV(!1uB7oC}hfCvrkAtU(M+u90n{Lo6OEAPa|F+=$z;9C>MEM%`w06s-apiAD27e?r-M{7uGzdrrrfhN}?bf_H zMbB5j^Jf7@pv!9^_O}t(68A~rW|L$b>QN1861J*^sbsc(!~}!0OL_K-QZPWBu+g@F z0v}k?D4xGL%a?rD7)%@pR`vj8K?6+qm=Q5RDDcMZF9O>0h1ztfi{%gCnKHmLEx{I# z|Mtv3D$>}u0U4JK={bkv!M=c>8fUA)HsYw%*o3ve?L%jRw5I?ehbneJWt<|1L+k@| zivYgnAEL=cpvL_muOVmVC;WgE`Ty7tO5Or{^I^X&PaLu~mZW+~18SDHxU(a*EvJgn`J6%eHD z`2_6Pfc?>c>GcUW`O*kc`;?}$?c`CBv!9_Rw)h?^@ZgC9=y=hXn7}zPI%z!F6}j#I z>+Co{^g11y;cQ;dKl^x&RC>%8f8}t0wK0D{PXTs#JEoQ9MYc*he?N(ptWo%K3NwhU zrt*780tpAl6*X6zR?E6?u~Xq|kBJ2K@kixpc3`6#0|7M(oK-4DxoY-kfg>6CBkcE7 zzgXMs&glr(4PEd~6kMngyvl`hO#dpH*knpJwYPGXUxRZ=v)T9AX*`*JXK!lvE(&Pl zj9t?I_R|C3mt9`i#lFRGGq6X|HKbC}Tk)gvBGBsIp0{QpdVtq~;Zh(FHOf_W&Q?=# z-Ks`MECFBwYY(W~uucyl!B8ZDx>1N72(eF9ok7cr($McF(`+>!#dXP-m-)z-S1ngG zUw}y6RM^1<2RQm9laz-iHYeNz)c$!-`8r4^6ofi+7jjqK{iylixDz~_?-r}rYb~$W zyjegqZF2G}IGI6#sO+*j``qNA@8)bJILrav!W(+$+*!c!wh2SeRDk0=!>v%1>crT?1ejq++ z79=GgxDumea=JPzDjI+t%;c~G58z%VgT-rleaX1RQ5FaAx4~?JRjd`4e*MZ_f#~0~{u+$zV%H(Yt+ilr+@d`4-N7A)n6!)XtbI-Unx%C1Tg zVzW^1mF%^U?Vq1?*8&KdV3Hu{cB;`v(FVlqygQXUhK8wpHrM zm|o>jfL2E)a@J#I&y~bu(r6=82lct$IM&aQ%iaY0DhZwy=GDI9(UM4Yl$eI!iV&~r zQ}LwElC4^znPU8@-{#@@;k`|7eP}QFVEtUYo}2dfvzZ!Jo{w)_0?K;?}(funnDwe{tY6(1|c zaZ-vC(+rWPpK?-NCjpmZ-(U@ajyTJCIe5qZD>NHW@!tDC^_5+575Vg&q7S*p^?~he z-7M(sYcFJznHc}Tu1i(6 zii^S&3v!iQy{wmJ@y(zL^`1R1av9hIhXAU~XVU0{7CAY$W2v45NN?oFP&L>64jZ2B zg;TYe>1<09%-E~?SR74mNlomxXht@{ z-h2CsvDdDjwV*DT1d?2)$@^t&e)YcjB_dsa(FAW0vy}hDJ}+Cd;AyMJ2UKv=N+t+5 zY-S?)vAxc2?@NY4B}DMzSQFY-@-E#*`sNng@~TCndE7@5SCYq=xbwF+T8!-(&A}wb zd-)941ZvP!Ew%w0r`p8&$}5?|!V&WzH?8llPXkWIrC)A*zgQYbDtOCJIyT$1O6ZCf zjE~{DGVbU(@5<;6$^5<|fFEPyy-<2~Lfg=PF+kF}Q{Wuva^tqc=|;|&uu|9WVEl8F zz1)uTZZJGc1$XwOtB`;CvVb$mp}ELN%tT1 zq8+c<6QcksySa8O>tk=w^kzz$ai6+T%+WO;M4yI{jmA7fZ5!`6RXZBPvqcV!)RmFK z&Jd(s53(fad$p4coTKDvWU;?8(p}Y3HMqzn7|V!t1_ZUdrh9cqZU$)gn=PosQ<}+h z7K_mc&I&s828dOwQ7P0iUybV?V7FHDi#KmH^0TPy^k`j}Rw~g+Kn)?|_Vh&>QK78K zhyr9QQ)>VA@2X{#UeR$h0^=u5cHRJWD5kLKbHBN-*&Kelf4hPu%=H z&xO}Y=MYwXRg?5E-dK`3v4jP)uAs!zil6z_*NK%Vz!xqX@bS)&c*Ty5&W63_uhe!P z)4g??`#I!MvZ*ufz@q}Y!u8GRU6KgqtvyEZOmaz?!JkG}+d0`ChNbkg7G&$t(@2xP zF2^6==vW{d|A>jny1Q&cGFtJty$U}`HSy9tCVbv=u89&p2eOb$Ex96ZMqe`}e7P)E zg%R}}3#64oc*~x*L~lR23HuDz=Xk-Ao+5-AR`9hhmsM)pH(=g=F72%_Jtj{aRCJ5Q zo{{Rs_xBr^{Li!!?E5~)%00`iTFnyT>6yNiQkbeG!H#ewy`5WT5bW@jWE@kVq8w2=mq3;I9stEAEKNO$oXPD_Us1=06!;co()#L;RDZupQKD(a zJHo2NdS@No_49ga9VQvZ@gN)2PL-%B>c5sU5X^PjA+IkNu|pHV=_&uQOu8(~A-b~V z0m$TV*u4cK9c{*DI+)_Y#=+OdkF_bv)U&u7@}nPMNK-|UZC5(C7(J? z^J{@8?FYaxQbnnUA$6UQ*U1(`mKp(1-X=B*1e=eSz61OYzD-A zD)VG&`H2#EMs2}zqUt!!qK0}9Litvv9qR<<@qi)|o>MIR^p2?i9RufGt%JpllLo+` zP4rY6>;VQ!n`rFkRCATrZbTjj4@q2*~u(Tcx1bYbQA5`RAOx%wI^N z=~yUhLhq}&a@_6-+sry^IE0^hzIeX~bOZ(qVLvye(+2!{BSUK9uWeWX^mOKjp1FS4_)l)0#1Dz8ylb^ z#vZ5p8x1DdY!h)a&_<-r>J^{7z6N!md$dBu;6bD3Tr&&e43!!%HF7q~*Ld=NBkicQ zxM~tOzr15XWP;qA!U6#DlMQ4$#I4QW_3lgDv7XYbbnR}hJB}$cdqGP9VP)At(>L}G zVa+1OUH7oeMp4PiwicPvm1m)b`?#+#?}tXZSww>+$fMJsbb*rt}dt9A9gK5nATWJWVuwP#=yX$cA1p)Jb@N{e!GJcO| zMcL$*&&O;;C0b?D;49_Fjz>4qpem2Tc-PSVN>Ji-{mfq57`WKP|M*5>M8GZIH{t=c zOAaXMZK-wo3;c3Eu8gt<1BZ@vnSGSE^0~EDZ2WtUNfP~hwHui2n&tPyQzU0PbU@jD z6`eb+BG`cdm1T_xP2bdm%yX3;n$8v1TLwzym`=`lozPIOydq~ib>r=sYJ2OR(zh!n zC%z(iYSM_`Hx|ibf*fmt&*hJ#9(*`s#Ro42sx)R8ivvm@l_nICpA4ZH``+GM&VRr_oh4PdOG z#eLq~6>;^sY5uj-a#QamH*g!X_>BY6$s;7*>B6_j(1udQGj;!+7==!Hw&bSvZ{rb;MxYLfittQ+tS+DE!aPf^Ni*8=FdXGi1-Q8m#yZ0$=DzyXB zwdv(_?nu5j-$u#PRK-n!}V(Y)7i+W06J(g zM~^|W5`#v-4VvkqQ2qG91;5(rk=Hk&u`uGCP|regKS!s<3`V}J%aRZ!V!KP1u6MW1 zJrb8U_zLG0Alht^3xrf~x}Y4!K`~{GbWq8X@N-G8h*EXZvR}WaJK_p4GbzY-V?!o# zp8itb*FX4qDd4q2rM6=@H{DAgqmN_AQzs}`<8ncy_SzePSk})a4WIfh0K}okvFR?FUhOa4Bam+(@yte#yKPOo9-hTSuhcD!R4jzP0UT{OUZ!Fqcs>1ic`w^5)0ToabQEYu=@M)}5H?eR7rMVRZDb^%C$I;B zMMiljsROFf8(GNDkIP=DI}Z&TE8Q#qP9l{ZaCxZxf;uMq9LtDK|2yUZRqpGp3r?Kl zH#UkcH2#`5DZp83JX@w)10m4A!t6)5MzjY8IP|Z#U}$&ZBwLtqrcf-9x*t!DKQiKM z>MGketatg|>VK@br;5l|tx($0KiKvWcwdIBr0K%I#2bG0FK(^!A%@pE>`-WF`0MBw zNY*vB=^^8WPv_k?Mz#F2VX~7D2$Q<_2y&%pfe)S-f%1)cbTH)mRHO|pi`TNzF3Yqr z+|UOtbKF|9&G!vD$o4P2V1iM$UchbF8%DQ@2y`R!{4*7pZJ2hU4ctugUXN9jkxoPE zqov^GqOl0KW22=X4G(p*ZOA6uk4eEnAQs5k%)<84)e76Z@R*~!e3Q39@BJZC`z^Lo ze(@8Q23D$w#uCJK}KP=tl&Y5cOl1 zsqESU2zzk|IfLx|q!WF;t(IZmJ0rtKKkR|RLc9o6EjENZ3$ztA{m{FL|EB(~L-bwg z_gg|=zs(qSZ4HMrupCRFnP&@Qj6Rw$f6MG8buD>wn95mJb-?>YUq0>UDbq=qN8W-* zVaZ+^w#&ao;!{}g<&*wIuxC}V1LsN(qF%Ja=RJC6p8=_}Q!!LGh7I2wBONTLi)ic! z*}dT1%pcJB=s>nnNBWtwubh|P>9Y+a&*GX__X0;Hx;UrKm#r&?*{_#2X6&96mN`Ex zxHsJ>-#R<%O~OzFQ|Cab0W8-$+v1DKa7-a~y0ZJ^WtT8y*7;s#I5wg@-G*`TJj!7O z4vTFp?e@PBF-jRR18FqdE9G6~voY9{sD-BNQL%he_zKr)^RTF!umNqjZ%&Ql3%>Dv zt%X8PJCjkW?JP5c3oHuteBBbM1DekAqH>ePq{zddN_h5+w$xVr?k&8o;}_Xu04R8b z6-)}ZJBl2r*uv~Y+~1lT`SI`@Orkw^4_vZ3l+fi4-pPV{d(*WcWRg=EUUru6o;b0r#WlUU6m3HFzk#F{GU{d~hh!h!xk?Dm=(d?b5~ zN&3C)HDqTHiQ;2#if&dGc8}88XTOpYIbUSijgr5)mrU3n>W?k1Hq7Izi?+kp>wx{C zBOMjA_kY-X^KdA`FMha1Q7WZE*^-bw+4oWrLb5MoijZZjV>hFfWGiCqLiR1&U@%kJ z%D#=kSVD}!*v1S7<9&Shdaw7-_mB6zet$gIHPsf)qNF%8C1TbRxG@dA(Iu4 z!NS{SDGg%8TqPZ-w@1mIW%Nv8pr`P-_HUOq)Pf@#q~rqLu=?2-YbP;!4HMngu%KUA z9F??`&mAH=J}cTs$gBC$@zL3f{5q#Om=j1iEXDN?De4Aw`OWFuFqjWxPuVB zR%^TabX|lzl#V~>jX~A zvHtKBfD6|oK%?Tm!C6;;5`UE?I{kOP-;E7ZyFmL%i`3=Nl5QlK#pwRD5ruAKu!7)= zM-66Tk(TQPF@`<@K^xNg?hE;Yw0`t!d+ z`?@N!%pW!Lm}xQ*V>blS7~C2Gh#Le=YKz$TVM6*)z01TJb9ViiQE>5t7+oyScE6qT zT6w8jOq_O2pZ2poDN$8TlSO8jdO5W(N-d_KRZE6)KY@ooBF4+%OdOrXrs<}x!*HshP7gx{@}F2Tm&2U*~^T?*8|k2lq_ zuJ5&0o9x39)&-=Vo=~Q}$J|w%X}!;@vk(~h=v3BZgv&;2-Z| zo)<>_CeY&O31yA}(;rE3!NdKvxvp{l~+t@&HmzX}PQzSa@u7y(hQ!5hai7HBL+*>`T zE!LY`)s2hSeTW}ft%V5qZK{;O1JWdn^4G!I?gh5e$|Xr8%kW{~LX9%hltd_{Y^qqF#f@9QlV`s`zkZ)d^B za%_bCIS_ZTFDD;)@LS9%WECwH{KUZ%2JAYL18NEVs_<(f%Lwl6#BiS~eb8@;>JT zYAMrwF_*S1^Py-=^0MuzSHm$wd5SBA5GP?(XEj4-e!TOT{m~^0#Hs3mZ4jR9HRdCR zi^2Fs!=)XlBOqwF)^x|&Ojqf?iuPIWBPFlx`>&l)y)U8-)s%ik(#pHPu(f3@ z{-inGGu%y_?_$KTBsKrXnTy%}llkk{HBdi+vvTmSp|{OP-Zf6S0Q*#h)ny4XSd$JH;>8eMP1LsIRnpMQ$* zI&}oPrY^QJFKHt3rJdanWbK4FYWGycJnFFVlIU^r>ddr6eZElc0_MUE(I1_t0tiI= z>nC&;d=L>mnnC$|2J)po;qiS*TDVegXozQuLO=M-p}sdPF};G(K6>zvMV~6zp0%I^ zFpt%>)nL*IQmb~nflVN}du;uZl~FJ%h@F@A;#k|UZ#*#Qh@4xbOn2A_bu*|7WgFy> zb%isj&-YlVt79s^sKTd+*zKi`%WeH)Wm}Gzg7S+UV_^%6f-Fi7_^lFpmSiEsMiafw z@vg#4{l_^w|Ftp)aF=_wL{$%UA@wCV+p(C1pL<7O+!i!6ySQzRtHlOao?ug-0x6oo9xea-)oZNP4@{qPrDm1|H(Uq9_P_tB9|UJP?NsUmJ`f)$+I4a z@EvNkp|g&3@K#I=_DS8YR~VWpZ8_M~?{t6but3aQZ-p4jQxUEX)|UpX&DKMa*3hh? z-`PMOgvFO4{TU8& zd=a$1(?=U%p!tlC|gu74q-2GEv{G>yed@ znb^);ojAR6w9#(E?d+RPyuVP`I%h^h?%uOUJ9Z?D=gKi6tax{sZDn`$1M>uBYW&8; z6WY}L9#%414V?)fXNAteY{O9rqnXMi{~B!pzurE#W>HTCxu0`?3s!p zD!g9lEtQWEJX`yYSHyU{;i>DIXTrK?x1oG!%(SQeKzVjKL0(OND)1$y@Gi_>$Of$e z+l_;-V*N|G{lrT_%=72f#b6EkyYrQw{TfWQ;k%`wOP8j-q$m1-gjzxPO}>_+r3b!@ z$q=lZ+F&zditSYP?S?Y#sWff6ltW-f#YVT-&OzuE|I-0A_?LH+b*tTidu!=#1-@Yw0 zCw=|8;*+!^l1Hw`9*#{2(hLVZ<=bO=;C@P8+%_Ywcrp9&*3z;eW`3=yPn~vKGWZDi zt(~k}AVO=;TTyOj2A!svFUZ!tfHDoYynLrfN?*J@4n zszoV3Fy;sw-8S)=2CN@36wfv=VmTmkUXr&BWPK?ct;VOCh0)wW4XwrPE5pJQ;cIdI z!|#5sgv=qQDWX(?k;^Im@NkOGV%5|Zq4kD9%xSzJ_l`BMvd?axnHtXP%&iy|w+%fa zimf-Anqw!u_@X$rC+j?cqc&=1mF=cny{l$cL|5>aXEH{BPNRR)A`Pt7#kOJM5z6VcII4bslw6}vaL=q6)?3DfVBSZ4%cMNYs4v_JI``12~ zgR5`z(y{NL8f-UBT1R>i2rcQ{#l6KD-D~3uDUz27KrTnuu%o9;2Ge6yDB505LUP4z z=qadYdyOifzL1r!%e3T!=6Tx zzI-kF5<`s;p>vpo^dI<53x}?8nB0nNlFYhZoA?>yw2_({1?BIZ=j;@JIZ{kZ4EJ>;NUtlUCn&m-wfPg5!606bRIVOQ?a{i^G6!&!1Ov0swYVR-lE(g0*U zJ?_S0c2C1^DltU~_?%eh%YYroqAnMxaQ5OkPstL^`$phr_c8tt$JUrf?mo2CfwK2+ zv-)O@jG<##Bs0TJM;IPlIXk>`S3dt{zRBL{aTPmJfh5?qaIVcwCzFuMgzCF~l^dRz zaRBx1OAZf8o7cQ-1EALu6A#5ai~X^F|39SNV3SeQ9^hbR}6$ z1DB-H-nAQ{BZmM;=|Kp$y^PB7&g|mO;dQh}s*{79#me50LvY6D*lDI>(D9sXI?Flx9fsH-vU5d z%o>%4Yy9_Acse`9aq2t}Y*6(zOz>Byv6-e>9=1xLe_Mr~LUy2kZKePAfBz|&vD`TR zl1=QGwtDPmYJ@rPr$Lfd!_@4^7`@YafFU6bh&iA!ts4rcO*98cu{#8^?`38c-^rK+ zR{P;)eQuz~w(tLj4)wmeMPFb23?5tVdsFmJjGEX%Aokjq0AoeL`p%_Rt)ws^D_1J#p&AA@C-hzKNOK-PnQW2H?xvx*rGtfV=Ae;I1=I?0-HcKy|WgRy_Eh*{B`vTA~B^duQG!YLE>f zApqW3J02-m(g5+*{Y{8-OhBQUs!G`V4JN{s*kt%5dLz za|Ms*Qt^_4qF^^|!b?u!vd*#;i zLx+!0j;Vc9Zhb~3bgD5h1xwyI>ZcYHR5x*EkIfHbl*xHn!%v;9^xrQt%!$4oqD%l) z;CjO5WzR9(JksG5fVr8U5wxhjl`WsinI{01wsR3be1w7NU;Q&IoMakT;LNo0yHAP) z#{177mkwugT58Bk%MG#qb0+`z=TqtP-l)oRD4(#w?*DWF{CI!vEGqM$bGyGf-?f`Z zA3Ahsf8X~PgU`Qfj4d^uXs|bd5$c^kojiHH)mHN%=fmTSHm4rD>SaxDDH$5>UXzr1 z`D{YhIJLiQMg{6O{no+s8}z}c>(0kzbw+*)sqsHP^+_Z1`t_SECbtgXGch#TBu%0T ze%rXh>YjDHkmXP+NpIQaQM;YAcDuMSHwIK#BWGCn~P ztmd0jM-R>TtSh-sEnc#G-J5n%@(57!{ogGP8V~0H)rEtwilwTk6gh|vP=c9V6;(fI zul3}Q?t%E_;niP9otj>;^k*xVYWQ^|h!d%JcZ2#e^A7-|aODZ|Sbyk0C-Uz(ebGJJ z`^BEJz~ejo#A$81#m+4Em^#!#)(gnYkSm~@kP8DkSQ24+^~XqunIbt~1mQ|b^pt+T zzth@PHOlka?al2w2zmF3RI2i06N*c7R(bLD$d`YPcH;~K5;C4VRMMzilCRma44~j< z9`~P-y8;!x#-g%%3k6&b2GX&;v#N#d-*5l92+waNeQgbs`^>nEQRfEIMPO50d?gu2 ze>$E+nH+P)BTLfrQrN_Gc6dF0>6fxrg#9&gI>TVfL2`i4E%CmWaZfs~hV_!FGbq@n z&M?!ZI!DTgi;C4n)4#?X4ri$9uQ0V9dT)Ok#A60D!A1u900!;u&nAhRB_a@F|9ES4 z_ZQ|r$o2f|j}t1^B`#1fHl-d)>@Q#Ly2$a`?HP~d`vsshqWzbnJL)r(9@j#D4#{=4-vy%zdV@!;3_eNBMU!4 z7&`j%=D_{m5>`mprAt?!%qG{$i%b$_Q!U6ovhM7Re>A!EnD1QTs9e09tN#^MV`6qo zWBQo(*}6jh*KT)ovDTo|c0;Cj5(Rt_BxK}N=jjH8(|(z<6ymm8t^!l%k4!sD!0u*b1>-_!xUro=> z>m16&$6uKGYtFYGUj??KP*(B{)<4O9hylfVYu;Dj-rtiro5%zdwGYo1jC}p)R~&j# z%5WA1(mr?Q@16u-9@6l;T6lv0FaEgoN%Zjl`HX){uYDz^$H?kRWCe>kCwXp=Eo=Eu2M(%L+-=!}n;GzjVgh z#X+blw?pEFYk#S;8&V7hKzh`jp5tZaneuS)#Qb(Ub|%^$9~0Xxoxk{I>o3` z?-wp<)9tejJlFnIQEUo_eKsHy4T|F-`+M5o&Gc=}GPJ#z#x)=XUbqq~GqW!Yr6ML) zT>sGK|6#)yZ!~@Z`N(t*fZD3|M!*GqkD8J=0ebB=q$A)32>WH!O`$bJM6m*w#-Ca( zk^OKC6nmljD2s~6)n*9|dE>gdUk5c+tA8A%s2{KiB3%p~dGn{(_;TZf`4S-Ji`nXD z)Y8spa*h^+inNcVr~%sZDC>;a`F zQWsC*|B`M?7mfhu3$xKGCnL*hXRLXd-RoYGYz*EV)5ud1{DUv-L31KGt-tW+g+D}= zc`rj%?uV*4w!GM3Za`6%IBR0=&m&F*dbd?4*|Pt!TsI^bRA#+XgM0wZ?c#Z_FGX1b zamM#Qi}{b)&**&RelxS1aQU?xHgJ$qYSMH@Y5tQZM0fbuUtj0SG#0p6LiyO^iG9dy zGrth8QTSQgT+!9lQa1F@KADrBYqcC4bbRurYQLGUYT(9~8|3}Qk_D-Mz6cCncKI@n zm;v;6fV^@djaE}c-&Ap2{J+U*+WCWe(EWf_QyE!y$r9*ur3YK@eGaw9DUJS%x9@&c za<(?J(VTZ1eprTz?45o27hQX!4r$c15l4DO)GwU+fbTE5-q6B94rRKqy8fk59>^UIga%QQw7|6Oe^79<`RcO$sb0~aGEwGbwO7OY;NS#@IZQ}G_<8{V< z&C(%Cl&a|>#4Z)g-4-;|UVltc^`jrg5I}HxkgA`@h}Bl{%4{qkk>B^ATOdgU#hL z%#0c}TE2YDpu5XoBqaO)T=`_CQ$|a`hYhk9_F}V)QfhkR@X$3+o1)ez&xF`4cxVD3tHyc!`Poa?{4#8CvpH z)jy6IkJ%U!Od^cLc~+;5fz5eL>~3a#0CU;73KLZ?#{@Bcs&jJ4DzNt}@c21+_DF4epX`amo zG$%v?%>jw@_3f2E2>taLa3;em@(gGI>D&Hw1zGh&yrlCMZr86>^nDosLP;!@i9xh`i6xw`FtFxuJ{9QI}w^1G= z?6gDR-M?#D=QV3SA|Kt_ym*k+j#KMAdzBuL-3Lw!^eOAxBaY-{s5!DB%r>JVih_O+ z^VIWQ=#lcaf z(gBp8#+5k;ZzVQKafu|6-mWx1q1dM>`2RR;s~j-c$Dk$}-ai*i-V(n$@a3Fo`G9E@i}m&t!f0OAzJOezIU}F>ok%1*Ukhv zz3_BKxzXLOYd1!dXl9PV_9=nqeuiPPtQ#P?gP18e&mzcE`}L6qdPm zCr4|SO5w~hmX^AOpvep@%g^Yd6^r`seo-SHoId8S-IP6n2e{HPYMz;vJQnyhUq16^ z!6rmal}(RGRi51VN@8z=GlAkbGD-qZ!gsKQ!Q+jXh49gffdyfDIB?av7(4Hi&7Zq{Cx2i2CfyrYWhDMfPB{OC-Vk6SM4=er=puM|i$o_HfB3*43ZIk9lavNchB@az^D;gcH(T^vl`wD5b*cZgql6`jg)LFkyo`5*`Y$S z`rAL~HD-6jOhV?&3(KAv{lt6(Jom;bUGk0YdoX;LJmvcnOQt*91#VAYSwFST_(AW? z)q85_r{G!$KF#9h+@a^Wjx6pR)HK$zti3)u-fVvAf>vW)_hfNt$>^ui%>DrlVJ{sm z3cja~TSmM;*Vn}It)^3VZZVP%DUjw;WYE@8gVOgQIlWM<6LgSDUoxSiy1BKO1NVS( za9yjBQ;lGeyj;jU%1c$jRXrW8Ne-HEH=&dTM(7jsOY0}XcEY3UD%w{dVUEnd>bkb* zE663U`ShZO>RSn;xhv)C87_^=5J>%mU0205=q!$6lcS>RlV35voq)@%dnWS2yv6r( z%O=-^Q#)Io1f=fF@J_bBj@9P5Jg1OJ-m1rl(MQY8HztHq6BbRUOu}-irD)Z4D!knF zsR28ZF!}2vQ!=_F3!g83KA1{r@7aPKL`;0?Vh}Pl9?2f=9oTKqQ(mx;v0PK0K3k?F zT+PxJWfiZ7(@RHxA2!%&*P?3W@hVfeJd{0ljOa>2j-~X{?BHNfn+F-qKU z{0<4Y`jaC6`EYY6zIA(Dx&1Q7A64#R$ftUra+b{QHvYESKQ@);E|}J?4)OCIx^sV8 zZ|b7y6Wdg2kq^0bDL`J$ARV7qLn=INMjSc(c`1JAckXe$Cdn1It@18H6pCo9)|T4F zEC%60iX$a4>t;zCkKYfU?I_hSTay9HuD^3?Ka&Htj4U)hK4Q<4b93vqAcncnE5EY> zZ{J(a;}v3|s!~mJS(e2AE-L|vz53o^V1*DaGiV`Ct9qs*7IidmV4bHasU4q{OzC}! zHo_~VFTW9;x-;9w^StKmCq%02qaLJ1eyUPl43)eS+5a~6 zf+jD%Xz#j;ZF;%B?%KL<2XNgei(UZzL~F%q>1bz74asS*AU0 zQ`ajd&pRYBgC?6G2qfApe#yD0siCy<-uAnsbTeOP`Dqg!Bf`c9)is*mSn%R{{4%-p zXvJL;)hDZ%)scRIRfz&VDB2YS)y|_h7Vx<=w z#EFUtBAG?JUC>5hNsw|on78gxN}=j^UJz$`dKT?nceXFI^kV`$tG8-Be8$JAR0_0$ z_)esM;{9fiC<~gb)amigYe6alrXfbt40`7qqsqN8cpJCT%sfx<>bHUvHfT}aJ>Hbp?$t5xDvtt^%hy&Hno?;yIkpxZGY6G-ozgw;o` zsaGrJ<-w%ijxB*lmGzhanu@1mS!cG>giw1X(LPXqM-px=4u~f5$>6!%Zy3T86W05hiof=P$ z2N#RtYL>9*fe0LI!Zdil2mdxY9^IaRt0(t#kakh7Ddq&vu18a(JYP|~aku%3NTq8# zsXqYsr28iAUc%h8e><3daz$m_AsbTBx4D~IK#H--nXPChx3>|hyD|=U?+i>OncFTv zy{taws!8?a!U)*vQ~~9WNQ=464nZ3v$hT16Ztq9WW=?~v-t6`29H;u+47+wAOe@4{ zA~$(`)#p6K#5}`Hsjkt@Wi6PPN_L%2*(p-7{Y@1K0V!A9hSx(9KBQmdNYPR#wTFz$bziWu4w=(30C=*s)$TqIHJax2=|Lc)y_ z6Twx|%WYoq=GTic*ROY(OTdWzb-6bcAn|-^#TRVWj4^#|q_&$0{qdM-O^J5|Nxqz$ zwQ2&+ws3<0oyuO5K+u2}XXml}^?tyo(Y8*2Xfej4c|&Y9Yt$ZvgX#8y>W!ac#^*!;U(d~sY`*dE6jGZ?I z^+8Xpz$bl)RhU)hat!1xwy1VdVQ-K<+jkgr$`5SV7&?RwRFeA7WjI2zRI zT_=yW-wrPWSL9*}r3ZYQP=SjJhx( zmd%~x9c_gID+Es9`$xYwO+*8Z|%IRA6Peq_c>%pLb`6+oJU%0+JLP3hh=ku@Ls=qQGmK1YMK>sF1gATCu3_^A?apve4W^O@OCp|P~?_v4#HTG}M5KXNm9h~F{y5}TIL2lUR z@3h-Op?x+X7U2Zj(b4@b8y54b7M6;w8&PYiZUe7ISg2bqBCS1}AiwQb1H|Ul(jq~g zoT{t5EivFDwxf_8(4vMMw5tg@Yi|ak?!25u;>z4WJkkS01eELe8C(3@wN54X6}QQD z13wJH>WwV6ps4zFFKC*hq}SBJk=@AD%JQb|WK2wTHED0*YmbupjNNW9W-#GGYk>TC5iBHv5|>A^ z!*d1f1ckjWhP)*q2i3;uwo2XE%{Vwf$e%X&xc&Ky1CKE&!}sQq%%Hh>Uycco?B^;U zym8q3rW0OxNKFo>`>qphBuZTuuo~|BCUJRuJ?sR;_33DF`#_Zz=CyJFbFMod1RxWv#+S^0asJq2D$kl<9`&K{>ZtDY1mW|vUpJ)%rkS44onn?Y*RtjhlG46h_w za)jE}V4IAb<(%Agko6<{xKxIuU076bA0&>g4sbg5KeJo%eV><8*SbfJsl-kQp(n|&LvMERkQ`YTY0jU+Jr!E!@h3*ZkSlF-S#O}EL6(# zJLEFq1w{%^n9WXpL=4a$$;yL#J}T$osv`q-;l+05ggAVOVkOG$_n<@`-eVg+Ma}db z`fVM97LxM}U%RN~tv{X+k1oq@5O4F}Mwbn2ol5A^(cNSLGolgs+zUQW*OETT=srmE zok&=hL*OsOI9heba_cma%_yhBH(BwClXfZHTKF;jEmPQMv_5^S$c5yh zGJT+Ss{Lp~fDxmpk%0fEK9C6Kfl@B*S%{;;s6{Q;Hb^D@ZM(0e)v~n$F1OJB2i;bw?*D~|C2`~4F=la`BiUZo3>Vo z>-J4xFWWtZp2P%F-w;)P8=tWCSe~=Ry|8EZ$r4nDlojrY@x7uhuHXf!j;&%(_@GMv zjx+6<>o;ZBkye78=tG>VYgkgsTNIJ3UyxAG`{IktDLBKWZ&m4T%huEiBlH>DR7T@s zXF3ductRR$4guxG6yvq!Ttpo+@v}+;3!mGIBI1VW8ZD|4rJq%1zCQxh)pDa$YdoDQ z%7oL|s~_#eafB}?yvrVSF0LP$2qW*@BJyyMH{e7iMB>A7=kg@>O}0nn} zmRjWu0GuFaL?Dt}JLdf-pLH`u6Nz!jX_m9w8p?C{97rHvv!Dc0)D4>; zpjPc%>RJ&2`A$eiIybRu(asGA>@X@v@JWC1XkQT*$gOZhM;MOGmClNdWXkLw{kSmY zgPle=huKmmoDW|gNs=sez+aT0e{~M3@=@-x0PabCR_}TqZO?A9gl!@hVLzro`uJ;f zl;6A-zv4(S_41-p%}>ZD=!)C);x1`r7dC;1J1L*Sy8#y*ZUrf=8raf$ewf5$wJ&Lq zfLU!RP^ZVKk1vzM4N}!9HS9LVJ3qm^X&p^_v-`A-L6*{;zSJj%vX;Vsit? ztZ!m|rD46wmSd#@{w5Aot~#tfnP5KqM5nELhWGoJahTE0BYIsUpp3I2R@^OLAf2|u zwJYm#)dT%L95ZdOa^LzGTuDct%xl?PVDCuL$0w$JQGzOW2R18_izYsqF=Tm!1f*@Wfzp9khcj!R>l(5keck_?lha?Mc{JLv8Wdy1Dpk@Jp)xCm@4j2 z@jD3Jg~*nC-xnqbcc9QkL5$-xg%`6iTfhkqoasd5?;iIcm(=LNAe4oIeUlSo*8?#= zMEfYub(!NnOPm40KWcJFDK>C&%-ZgiRmGmQ>*KF4&Q&)`mHNjpCALL9Z>NvZnA&>| z5SE+Lk)Bz4r3UK524 z>Xn`&*{a=ER$!w#%)(7|_L*v|;VFEpSZLHvG&|<*y^x4-^D>c|>AGF1hQ(HJ{wzTz zdHo?rm%)WLIlfGq$wUtCg^$trIJ|vTo-hPwV55mOP+{*NdbRj|@-D6PAFn5MEUTR6 zE;@a^Y~DR(y6%y6hEXsqxVXad?AsSTZIGuk+3T@oS1%2L;f#x2Px?_&r$ZwPf z&qOyeGMWHExR^ZYl1G}wYrE>&SAaa}nTxWyPn4@nl%~(FsOwpC8F)UuGth|NwYBmZ z>mO42n7iz=-FS~+!rN|O6)$YiHX9j$O8ZSIlG*q<@FRxss9R9k8ew@~kMj8@#U%x) z>Ua(!L&!x%JsFqt^4*3Bwf3P$TvB#qxfhj;RcZ8dByZ4Sdf|;V_~Hhw8p8^18yKQX z^~_I7k~pIGe9Jqy#;J-ZF-;TN&nwFEg*@Zdzv-k&8<`w$kfbk#L3efeLHQ!*wyWC@ zG;vmb-`q`|DOexOwDDeS{L`LCY)EizD>=}EI7|#!WYnQQCU0*Y!W}i=UNq9_0QZu; zw!fLvrb}fgzt#}X6Eh&4HScB^{ln{BD>401EWGNg0HM7IDx*A4CG0vyM@h5|#ISjW zh`}k*9s3N|9+HQWR0Bk!{Gmb)B5ziqyiq}~rYAO|sky`gu^!`-x%Vul-CU%8pra!l z!8iJ852^HSYTQ&8ax=7J({6|881$47^m;Uar;T(A-mUw@df$*~c#;xFE)N+)EvJmu zlf!-M#1X^Iv`F^AyE`*W@k&P%u7(AJ*C^qHH1}fVorstf zqd-bbcUxd=Ng?7#pC`FwQL?9P3>NcaCcZtN*2`i9S~m&YTewemcwZwP5%ws>Bkis_ zSV*T02NR1Shxfb_l#oityAah}-~t%nPz4Gp#XXDoUVDn#gRlSoakQ+gt^uwK=|=v> zOUy>{tLgX-yFu!adiZo)NR_)>>bQe95*{sE?Nh@7v76YVcHKfEme`HFqtx3Ky5OW9 z66PllVSJEE%OUNKAS0}$H2!mHRDIWy52UT5Z_G-<1e`?uI?LNky}R_22Bse!R8U7% z(1um_k4fIg-f0QDGah*6-JDNqzhi0Y+(5c#tFDWc3Yb5GpY=3_D}nQS)}3_b+&2ar zSw4#5Iys67$!&sG)4QxaHGS6VJ&eKj7gyG><#Tny4Fr4V^pE}3WUi!Oi7fUT{aieG zJ|VI!dStMSUkBNCI#p(53Nh5d)^eVu>tZZv9kG{;OCUG~t(UOB=nLp#A*-kXdeA;h zO{tsE<*#O7bG*d}m2zh+b&2L&HdBql1D82+5S)>`O+B{nOLC{f58DU)OMlG)kGrW`prfp5vp z#}&2Yk-XJGpz~{&tJ88y7J*a(56Z=XG&|9_%>K8Y);6G5CJ}8AfDb~yk6kj{d&Y?m9nD?7q!a>JR`Y61C~V`_qc6&e{Kwl+ z;r6(Ik)@z}t}AGkHt#-U@TB+s8J`Pf;SFwp{UMJ$U5XUW+nEB}c)+`^&1HJf=239% z6|{TEtk z8ea;*mRlF>y^CKED4TqglA>?lhN%<>G!m8qxHwYL5NYt&4&>&{GY0{i0PQgc@`};{ zV^WZgmgzCkX$UHL7uroS+{tmY!cYl8v7>3r2o%9(N;72T#=fB7UVnmW?J`4RHop60 zCcgXGwFpBPknAxT4jqqic8M-zO9~jOOdo%i#GYq4Tp1B!o08SyqugTDtV=0!joi`h4^)`g4b{dv&}V zu7}$1lfQ96i}`DDDO>MPkhY9SBz(SCr|TVOTG^!$JhnwLKq@*wv}^uj9{Sp1hZl6< z$jlN6UiFr)=bC)LR=X&is$l6OlFDF$egXWf$I zq$s}AMis4}6NSdpUE4>VhK+t)cBhx$i*P40%3*W5BTROuT9J#v!OOJ`qo}lm^dhNL z>iA#m1XRjmj1_I<{$^`J&*2px9R*J$*d=vh!nLhND^B1Jpc!fBfv2zcO{op3w|K9EI-nh z09Z23RF8NqVB=H;a023QoTg0*ISB(#LxlB-)+vzoybC?si@Gs^VA5E}%*=?ZoyDMT z5pra(HQw#iWRAF~J~6p>TY~F?gr7q;SI&u_c z1c4jk_D&v$JO^3EouOeZ+}xiEVEjucx_Ll;5`-xBL-%Hf72TIDIY+Wvr>XJNHv6wf zbcs80deoR%QzfNI=wt;T(H2bC#@VpSqaXbuC#&7KwE~*uCdw@ znN_;>l2SdShl%Dw>yq)=P>EcV(G|9SgN@PN`y89y-L_0QW!->yS6p50 zmsg$qbK?oi!F%zDfww*r#@!>sY)uuD4*=XtXR8|E$egd_ruN#0TZe<{^3?Y(Q5Ih$ zcUsiAL1@$LX!D?&a9mf4d|re^!u8KfnsZvM260X#bF- zPzwf^wPRG_^@68$WZf9XTrO+v-{q7=-Ca2zts2*t0b`2f2dwQuB>?K+(&=g~Gu0|~ zN+@HY{H8s&H(AclhXMz+7_mSwQyn^5nDqr%gV%l?YhPfG#J?a!H|`%<7%_|~4fGw% zE`luY>i=%gl4og?VmPk%Rinm90u#pQmo};TZ0A195$^-!LtZH0yp}P}EDESg&JfMZ zd?b|aZ_5~gVhnG}icy?P+}Lnb$qss|@h^ax66GG_lUqi}mYv zmTrzm>Z`9enEdC1g(2Zq;_32;?eUxq1;!VKXK&3TjWp+x(w7T+qsZPNGx8yoK4(fo z#lSeLG>fuR3+tnwA|z1PRXz4MTq3&R*dnEmiT?t9yr?_Z8w@HbE;K<@SCBSd>I!v= zT~Meo4nOu{`+RSV6pe2#p-{+dhqYFV%ky_8c5f8d*5^c_s!`(M-Fqv4AD#_3QR zs74YfeNzRX*f*=6NvNX0yVL9gsA`wRCw-TBqW(l43nBoC(ztx!{|gm?I@WVwUEh>W zWEQpL|CY%xW48GdcKqU}0Kfxf%78yVJM-i?r+b4G43IUW@6H#RF*}*G!`+Y?en{eG z2dDaLQyOS3iCXzn*g3N7ml(}_O; zIj7zNbL77Euf`QIO$fZ{qx7g=kX2X5UcEECbZi2v3K~{|{ zgUhQ6u!ua9EF7>`frVoRC3yhF6+ep>#f;gQtSmCyZ0!bGWhBn>hL1^x z5Jk1K%$M`Cqjh=$sg;gNC%^H1A)hEl|Bl^A03a^fRhoWx1(d)6Ll#)Vl0Ry~Z1?~Y zvr)h-G5pP7?EpujjTiL$c8ri01JtQJ6Clzs-S|6Fx__|;cEC;Px0D8Yn1Ru45}Ya2k_(`HOF0K(l$Z z?F0bVQ>EYZW*~q7oL&;~f$`i3@&BNtIIbP6klw*6eK-LUe?alWo}JqXYKpQS{V9}@ zD&t-gvD4?HUWoZzq-Ex|T`@~E1Me1jFJD@Y6?$^zhS(9wU^=-!*?E3-M}6xXR8v4H zJ8u5tr}*C8R{4F1rib%ea+wJ;s(?^^%|ZMnIApm_d81wDx6Pw)m+)cr{Vkz)jcC^P zlS1`X8mQ)f%SZs;9hrQfcNGr!=*R2Q2Zk|AII|E{Cq7|i$}&&jFdz2p?`+XN6s~i3 zd}jrNIk|rewTHy_W6i)uU2ADfb!AjJUCx|*1*j*E7q&we2O;L(u3FIif|XiS1#K>o{|~ch}C)Ee`W@3 zO1|b(oGu^!0cYaPsjB{{(S059`1-c)!-ks6ZX%mhohq5r=doG0lVbt^gq7)by0Q^l zj^ttQ0PKzsVLN{Bb@=+Ov8p)=dLuuQG4)?BB!2 ziJ~Fhs_lh&*Awy6Q!M|%^Bq3`qw1eKSeHB|P*TnW=)?rxy%APF)u|`Q3sje-+;D{W zC3wdqzb<9SPQCl~UU;!E8i?O8_W^)cu+eL~go^Oj7 zD%kleK7}6S)}?q9$1O+eF2&!n#@VyOc^34s!h0 zN(GbDM6;*vFL3U|r9oOdZwx1ZJF_gMJ7F5H7Ju7Ej1KAUY|(1^RF4u;o%)eD}u>XT_yH_PzBzIW)FjR&H1EJj`2Pur_~xjeL+pVt41 z6EcW?Q%V(p%HaBJA7ts#Sue1%vqrJTP-_&Tj{N*CkZv^UEAYXV^J7f&r|EX#;^rC# zkM#5bLxphY2{XLU?Ta?dmwsxiD5`P?Z530oMMeHzItChgRyq7r*R8I(dhaXjVtp05 zElkRm7Yl8i@mUk@5p#kciZ`;;+N~N>X;N1tYg#_{o57kJZ0qdG3Xj=zW=j~a#0>vh!6r|g(-oKEGVoXK^h)u;<#d!IT2X1=GFPMiVJ6nfWSM z;3!%~&e;gozbbzw#MECg0&RWDVm=|X-SV?2To|;8E+m+$7JBv3A0?m3&O}aMX!#s+ z{d$Xw9bSe3_kXeX-a%0=(c7RRDu_ssppugyStUmSkt84zhKwYUEHI=Y83>X^7*L|* zFfd4lAu379!6669IWr8IZM?s$SL@q9wrZ<(Yxn!ZD$9H4ef#Y`-F?n;&hs37lYHco z5am#*va@!M(Ozd?VDp;htH+!xQKgIWYdu`({4WOj_+8-`e{<19*k^uRaUV*g$48|R z>ayaJu237r38CL~sSC=dLnr$mM}L^) zhQbc&JTP@?Ked`0?~sOigIugHk$yQESjY4`eY9LYhxItpW#`Gp{;iR{9Dizuw}2h~ ztgO9QaK@UnkOHM#FV0nEqMGgpFD=L{V}3NtC{g?@(oi9iz%u6B@HkRy2|lpD74B0N z%XARGU+iaB+&WQ$d8Np5)>dtp8LH$EUm7snH1=dKFk%do(^$-jM`K0E zU_nRBVuc2+AKa;0l@5L)a3u6DKuhArg*DfqodYTQrqJrD0;EAxym^S;5Kl?KW1)^; z^t+c*r&r`vkdM3zO5mSN)3cm4leFb>d&&eQ&yPaF$XQ?}_Lh44iX5)5iBZZaP^7eA z(D;ZUO^gi%0Y1bQt>>=DFNv-Osg}fcDSU$&hGRt|Mx&1Eige>4ib3Z(e@R7-p0-Ja0*W=}9}M z3_H(xn;qM_pXI>r-%4P+7jO%@RoHk(`+L(~a%uYa`fDrU3l9p|pH^&r8hhuqW1<(t zdOL^iw&KJlUnRANVJXGio|aJ-i-PM*Lzru=@0-C+k?E=)ct7-dvJ}HvDOhG{=ak6W z{IAX3d-C?w-{w2@w?QK4n($X%KcpZ0{u`K^scPa@zdM#Q`u-c-q=tmjg1K%Nx$bGc z61ZFRn-0JD#u;816s^bBoo)+-DZlka>T|xfy%i`%VA>dXyhVaiY~3(m?WW!9L{}im zYnex!$IN@aJl2g;>X7v3Lz|KvR^)L9H4#n}Psg4M`tl#= z@YAW2|BdnAVpC#*CMoU*GsPud$|dws{<$r1-`ozlh%|B+BYiLChT?mX9asGSYwR6I@K0*g>DgNq>&4~N#a-~~{jY&D6Pja%<`@>l5_Uo*Y5Z7I{wa?r`P_!) z+B6sZW7!d@4|_Ac9}+joH))qYuoXq@v^$064t~A3p#wjoIf%@|O>d3rSIDMqR8hg? z^O4`o_t|TvlZryNq@K?ixx!t$yct_P8MCR$lYcn*_E~!H@3`Xisjtg=T48@$BL7v2 zv(%pjI?BYFoJ?DBlT|7co6qhEB~>OB&R@oyc_8T*ir9M~8JLLmS(hoP3!DpJfpVpd z98hm9LoV=iMFl{JW@gZfJvV~Hlx`1%B+8FWvmqknsr?|Du=ODXW@pF(8Dh~#kJSc!_>b(KIILeVhk&l5w3 z;`$|s_iuj~s8`o&Rwsj?&1_T#($c?Y&2fOa!O*B?KL*-`2yCg0UsE|yG*ST)SNnUx zuUj}g#30)4O1!cR`FzZeXHZee*=@+UuQj1%Q+(*mxo;0Vl&EJtxOpOBi1yrDwu8vc zy`yS_fyQE!M5~LiPJ1)TdaLo=*db}!MAKhk6EEbHEC4uP|BwY9kldG+W_pvU@?D}Bhk-8+kIdh%5D~p@iGlu#4C|zS#u{G#erqaTiu(s$8#W_iD>CWo-mGbRyF*!7k|=5MQ{E7Ns8ag?VNb^9N8q7 z#)^vB%=0-~khLYWm|6AEQ~lAj0b%6fe`w8Z0jF;GX*l=)GG>OptE|MoS^)o#l0%|O z?M9<%$516Q@_+GGh_7**-4{x@6(ku$G8PAi}^1yl0SYTu+1 zu#sQt%Tq#VLF85EPdU6ey zB3;&UuQ2_b@{Q!-`n`W83NBo7B@V23wFByRicK1Wq?m;x{lOty^q=G7r?q@4!sE<_ zIl3ZX(2EPXsq@_iFQj88T3=U1$^S`ne^2morjkoJn1U-->3fq9AY#S(4WuGcdJ)5J zwm;7PF|5lU>Ud#J=78D*aR9U_6=luf$Kq8bv4~dUSq7te=HHIu=||w=#Ku+Hl(C#! zYuBUz&z<*UhiV>L7F3?k9=0a1`L%gY0f(0pq}MXO!e;<^>WIrMnFDuwdFKWW)vw+B zlOmjj>(AwAE(YH2M_@32>6}Sf|FwZX*+nu8pWHT5iih7#T!w^QV1jz^5u?KSg7W~$ zjZ3fewmp`FdHI(!@blZY=;>cpLO0%}t*}u8n%DK@N>iuar2uAF$s^5@r+-rg?^)pV z6oa`^2}VFJhARFT67sbR$Cd6^e)apP{3#Og@*6lrR?u|Pu7y;0`hI~1|4b(@u%!R} ztA7pP|8KLwtAI;8wEqOPjr36|v)i@Y|8`DNo~leNO2F3Z*|e;7jahi{+UB{QWDhZR zahDnVg@Hw;-qZDx2w7lz>sH=exR2B`o~se%WIENITLw?k0t@S}B`N8hG>gTFH-7mM2BBXbOdj zz^|L0|3&8Y;UnhB&Y2wIuJQ0(%v?)xCL|!wX(G$-_)RT{O_%znPS8ak;Axl6vQS zHUp(@3L}blvO(jeFH)TfnR&3MEOwCX&`OuBgoPx#JsZ^Gs?RXPh!U-ripWZx(b&Wx zy(&;x0j}z68?CfI8OE32)w!-!hIA6+IT^zohwJaKv!tib^F$Ra`AwGE^BbJ;@hs<0llMe4KDD#6{7 zSq<}2=aM6WM^kqs1gdu&)@bF2+!?{iN#bia#wYYAN!~@^Wr8pd79H-PhmQ34a*ss+ zu!x|?+%-2*VQWwB7{<@M?{~NP^^ny3jyxmuB05d};-5TNvX=?nag}UbikZ}hxzMK6 zjvE@cpZ0VkA|%|}eUz6FnyHyNK8yU`!>9J)N2T@M3EOJnIZ2bZ+q7n=60b3sH3) z^X>4j20GOj=1<&5L@x-K2?wM=n7t-1o}^NsHV;BipmwlH@674Xv(6!1D-(KI(pVX~ z{YT0_;+;AaP6_w>%NCMx$cow6{Sl|6gORk(7C6V!l)cxI-oiU2ZUu;um$R3OH;>0) zD-2g%7eL4R4Xhb4qA}z6tWg2N`kgQ&h-ok%;>LdFNN#QpD? z8BAe9CO7qKQa_dI3B>gM-6uYQ4q0ww5TBz$Ume}ikA#J$gM6yI3iVs!mS~=|lcnxj(KS!|q31Fpj*X^43!Xn>%hE(? zbH_?5+0u>MPHDoQcr=ndb|(V*ak-+sT9n&L+%d&F*JkbcBWh5uC)iF+00$c-<4c$5vJ$6 zl`79M-!$6qiMg4cZF>tjmEhc`Q<4xwnScw*Hq_lU?Su3GQNB8Tj;myG1tHMr6?yjYlAW2aN%ii~32Um~X4EJ=WSBnl`G%<7u+U_ds z&!cON=8B$mr$9R#Y9+g{i-1h8Sq?Jg4X+wBmK!72-x5b~1jex4XSSMQhN=k9M8T-e zKVQ)~a)@W!9jVtVlv?;^#HcX&HHAM&37>j~Ji#}8^IfEN-y^FEHd0eqi3O&)bY9zp ze+^!GO=GPPW-*h(CBltiRP+Q5r`MveF2`!S9MuEXG&)U&)7t)ztL3Q?)Q)QOl{V>) za)zY-1vKCBHGMQxPUuNm?N79$*>p{Zx@nu8L|bLEhl9S%ILF_G5LI3qls$PCd^Gq= zq~oOn>w0I|iRpfea?^&4AM zg3a`X3z|&j7e%EO`MjVOw(*_n7G-0Ehpy8EX=6a+lZE(Rtd`4s>X;gV6qb{nDA)!R z)iN)q$a4mAXCnACBrtYztOe}d>@VE`?;34baGAwnd6&h53_BZVk9=Jo(>qa8G7vn; z7yX&qlzIh$)shwts=9eLcfB+(=}7HU)4rCc=xz1z9N)q@dC`@3LRwX9^QqO`9_ln4 z;_VZm&Y(K5#3$Rf`T6oM=klck^OMg)q{HkH2tzawWZFKx<6xgjcWOA_Dg%;i8 z0@$T*p(Nv5qvP2SBdxL8EKefIyRc4cIuK-(b@|yXW1zu7I7sG8sXk;9q};SOsr=sG z5Aii4yQx+T_ZJzC_CzG3Zje%+e?r^z%0pmJ_O@#)SJ|{epUhj9I+NH4nZVSm1#h_V z1s&cJ!{;?&E)rogA#I8#`VOO8@z@+aXw!DeQ97)Yi(>CK@@U^yoJcHaK&(pEl57Y7 znR_LBmASXu#f-v!>08v5lkP4h9Xgy|_Ee$nVC}4~Pj3eYoG8MKUw6UZR-3Gx^izd- zuDg`BYfZCn9^`vFRnwz^{0xw{=;oy3+~2m~hHAoP$U3;8$$F$hwm5A2a>*Q3EDTl~ zf!z+)AgBHIZaMJlx+C#2+PC&jDi9G*-&-C&Cy_so4-50y_ zjKe&&RtQ-}K^#q@}`f#oqkGb#Op2-z+TzIzdTT=665 zm7)W=)|dO-{> z99pBw9-<2cmm|`ro&l71X3n_1MTt?(cxHc)+Xp*eif`f<+OdaO>Mmgmtq&Pq95}`s zm5=lK_t0=5$4QM%t$db4TE5t_Qo%~Q{(YM&+$)dBbzs&6TUdF_a@3mVlZ3hg3Bx}= zb~XGUU_Yu|YcjtVzK_{%4XEP%AEOHBqRH(d*9xW#R3rM_E~`L2JHqVC9LuuGe5P9W zlWb~-!m_NxJjWLko({rL#)71`nm3LP<9zKTCurQ|4_kG_nzpUN$LL}hGN@X4DU+Az z&NMvy@|feA;0&E@U`o|3Bfp6C{*k8+F&uEwjNxsWmwq;!9w8PdRm#F4Teh37LZ!ca z*eBHZ+K;Xbm!eo9(h%LU{ajs#`}_H`Z#sFqa9Th5A%)8TBY z+t{9V+k()J#y^W=D0#wmIrWix)w?J5h0P|)=AD%2AcvHJU~{&OC_;*_dtK&xvMwUg z!6DGxJ0Ls#`Nov22bm!^w;@GuFph9yQW$*keEatzo{asobsQ3L%C~qL!OlOPS#v>8 z=kxyOHbmm~+11=V>Ri*3em;O?eU3(Obf2n*z{b@(R5_xfDdP);DJq>7zG>bVM{W6J zc8;%qvm(h|ARFKE@hsGxwvw%8i{5(Q3GzFsVA-m=$aM+0SDF(wX@+HQa}=aP&eHfC zZj=n{kIYFx?3EaWY6|5x_}U;UDGH2wD&lpdi7sl)J68)Yjd#{6%(tlEOT#sBl(~l@ zgG+Z!UrfqJ35VgP_~R?xYjP{N48(O5C4-*P%q?g$&w8sB$5v?78x}onZ}WgE$;6q$ z*i#oFDj3A(w;9F(X@Tf!!2LEoxyi637I$c>`^TBLKDKtGavG5&f4FIkI8ld}=ZQKa zgi+{|?N_PZ;^JGMPKx-)*T&SVqa8ctGS5ZRe7_+;v`#6x`+B?H1E~nW8pVq%?)PD> z_-pyEpVh3=p8^3S$)eQBR34&ATb`qDQU@@?_AFV&u?4sqt9;8^DS6Y55eVLYzIOQZ zYZY_9-GsBck`~UL77f(rvNZ6MiMoY6i@qOf3@<>cMbrMWwNd(FiIzjY9&*bB-({G1jI>Mf~8R%*d>O>>Gx>Gwj_Cy$gxxK=*<~s^!W;!evJVCNw#i%jjQ&iFW&Q=l+x1|?@bb~x+5fyDJ zdNZZf5}D5=GLLSqwit0Xd~A?9PIsl}PzEF$=ltZ>LMGQ)vsrI@yIVFP2sbMy?o2H+ ziLJJ~!5EI4m*`q)dkbr~!n}vs;cF8_)%nnGWU=^X5El&)RAmKJJgS)t;jJEdjf zs;8^5lC+Uzn2-otzkBh+=tEr}%v5+f$J%b0;=C4xM$!p3kWS$ux8${CQJJi&`X#>> z{RiG!jEy+FbkQP?rvC4ZIWzrMiHoS@d$wJ!;4%gNijYBt$F=ikoD z1I#M7QI#C5^_$Q8D_OYn^a-=G-m7wS`5unw)C1phs!FvR@5d8JDlQw?WrTLwKE3;x zuJhc=P@L%FsSEE1)9^OJuq8SZ^qDcKVj++~~b=6_yz z6@94GPClwRnugyzc!hObb1BsE7wGj;fq{41by0CHN2ct!cL}``IQ}}PpRoEEe=VVG z;ArriVA@vx(LLQ-OWTq&ecO!MJl<_gPEIV(FS0ml=C^gPl&t!R$dy43U)u8#slQU> zHfnqJ}?~(FxDOdAWFPLyu!H0 z`ygKk$vf(+BMhsL;WrbetXiChdu)DIRpJp_Z0mT14ZwO!9`$xg#Cbb*62WlF7TfYD zlJ*-H(XyTSKnW_(7wO?xozP+H?X%FmvXLt1>P;9p@M|r9VkGPMm#5$|1rSI|U;gzR zxjX$|un~^gMc9pt62b}4ADx*@2-kTl@0Fl*kG`{gc2!KH)f*kq(P~I0-FVr}QMYlT zrHYyx+4|W!N2;A!FvldH-PWhLcFWyf%rSdw07$q@g4(iwn0AVY{uZIToK%6xM)li#Vl)<3Bgk>T1?gI=Gz8z#X@ zQ`s5lOoTiS-Vu7M!xeafOmDgp?9~}1el6lDq{+*UV=XxTfxB`ksh8ZkR+#v+9>Jhu zjFl97;5Z5b@mt8N%Qe8v_Dw7vvFo##uy}&#Yhj}Kk~Ur1jM9#LChcMFc8E-3($0|W z+J{7azql()LcMAiFaVok3hbiMh-CZ=9MQm~&7p8ZEhe`1ps|M@`wK^s@mtn!786Hx zziCA)t@kC3g{df1HaRV3qbueYxqn1Oa}A2q6wZ+>OrJY;60xjJQuWXRcL@;^OU{33 z?EQC7ED1{d72fEc0L$bruleUZipJF`17Lo8b<|lid~JCIy0*OCHO>B1^}CAgu-4L` zT!*S=LRE(a zKjJ@a1F2N^N|R-~rgWISV97}&%v*$~V9`lpr|(POD*?)KiTw4~r%GtbzN_?c={ODj?-qU=Fs%o9^nu$jQarhveQlbkIe%cdC2&Z z&2Xxw%{)i%=7R@$d<9i)$eJkO}~}2V0EF|23q0Pu}6*PevTMC-gN3k{4ZYs zp?`9Fsqp^9P%%#g)e*HTnI1sH??}6nwTFuRiwXaOp&Pus$L+awr!l#uVw^1utX&J< zs2ZQ(=Fk87%l=(ha44!o^#*1ig8u`+WmT5Xe_tCvANb@BKEMSr{#^-e7edf~tjQT% zN02A{Um|SuydOa3yBa1luk!R%|!0KMyQvp>1Os~4y<1YM; zEdJU3HzUClA@+Eq-)!o%|CIN=N6!j!5F}Fbv&yf3Cr1A{I3iCA-VlPmt7ZaEa{ojY z>ED8?jh#32(5;NmxBnXcH;}VjK~qV)-l5{v`s=&Do=)<8Vw8LDk86Jpzs?L)UF<9p zCX0R`yoUG{+Wqt0(_oVS?_4&3p6z3ndV$Jv&un{K?`tB7a`iUDLNf(j6x33;z(jTk zXoB_vbkQ}4rUldk$%J=}TH3x1`D0iwg^33W&6Q9`JHt!iJI(D}Mm1Fwl^~;izvr0k zR1T0TS+wP;-0#fn&$C}2Kcupb3$6szM%9FYdGJZQYAA>OPWk@KbXAZJoT_pbJyq@z zaJ?Z=1r(Rj)tReOnnHm!p;Ur>!(tt5;pV*?&2*CQPPIq#pOTGx#IxI?Uo^zs zx086Nvt>*qJpHy$xPY`;aNN_W$8+r6qr^OMCw!g)j}eDv^p@KkX{|Li7!H|qnRO(? zpQ5L{RyZsXh{i-dYPZs037z#Z=YE4!?gt4;utanbLKfja16HRHZ`7Fo_Frm?voiO- z@X;Z2X-87SC14WYGKTFcxklZlLbnu6kr4snA=iO{UH4tpk7L{Tb6XpezWs`RZdxhD zy_{w^x|Cl#rVtKABtF9|U#SP@m<9=|{+VGK{;v&w`s=oUd))Ugc1Oky7v1%60n)Dn z`w5j5%3I<<^$-tW(!)`2{>(mJj;(`3426rHNBJKlLVFYxob)fQAS+ja;_N6&igh?P zv1NOjRkDJA#O55Z+XiA(k*$dDZ$JC=l<-%eUu*YTHl>RLGVlCRocu()2jeHlS2#q7 zSc*8+2#pd~Ug_$Pic*8PP@W>T3w`Y*-y4H)UI0yHG6ia?_A=t^6k`lwmNcssonEUh zgzG?DM{6aMr3DLMR+#5etKm)|&5aK#o;yWJd7XkY>0(j+5puL2R76*bKk!j^x^r|| zBP%j?B3J@z*o230|`g*4TEw{D5X2(H-LWXES?{z5H@BNdlR`J;_C zGz12XS;wBPIu7&LCD<7T+z!Di**5P8J*-JkzD}cMnWa4Ya7!d?XWKMpxZ(G?aP8(x zAwk!{Li2^`NLAXWE{+9xeNHj#&k~yv;orY70jlcOH(Q4)&_zMaYw~K6 zeA3}G>r$4x&|dYD!CKDIrlh^+6jg8B*mlMtlq>fDF7uEXmJ)gI@g6+UH{txp`mDns z)`D9#q}ttsk{L^dN^cc7eRk{VxSOtu!bM&8Z~sVG1HHT)$W$zA4o26;Rxe)auk2CR zi85Mcyz8e{F%!F}>Kzd}8KbW^9Fcd5^1HlYXMpVtS_np~VMsnah|{FA0ATnPhsMoU z1l(D}nt`8B(*v=iSDK#V{5l9jUc4BCAAna`+{{c36Je(T#j|&t>j%1BA%RP3qJ)jd z6-fsbFP{Qw&MgkP%{jTfY`Hsb(ZSdU6DyL&1P}Ott(YWZ+iN_Gi89^jh z>hOVrp(u!dpjz+6nGm7m=5hq(MM z&HPl4=ce8ifutO?x->^DA332@BfZU%#~aQ>rV7+^GjCG9&+y>W&!j_V6n7r@VB%Y7 zg=3@+Zu8I#^E+sUmjD_9&Q$o7AW9E@^3{f`s=1LxZ>&u+jJs|yCLV|y8tx2C4Vl$~ zmRkdfR?L0$Nt=ylJuq{CW{&!nvB(>+`eWtsQxynXT2!CrY zheW;T``j&OcdFyP*iGXXS>CtgKmFjA3p!it2DwoG9pFY!1H1yhD>4(MZq-fc(U3y? z$t`e_A!wj#L+Ad3m$!|Qsd|I<6dnQG{yP&*ed7^ZV#=8i;}o_~>8~bvwfQynk|0-(bwZZ8(^6^4#b%-w6d_Viv)#@^bk5_n)1!%ib-;(m4 zTe|Fxd1Yj<#L)+W%!`HguBemG(&VU=$D~(TZj;p>%1uN?as^hus|()X+;J?Jc2nMi zZw4(y@0bd6PAW~ryDH2J;Oh)uooXmnvJ`-eH}%%^hPf}@Oxq=`IMSbnO<7mY)WtMeHOb)&vjJU;Y4cD}6;Ys9e4+LxcS25e>t}0&8ng_Hd7kqna^o z|C<7K=hQCC2^1`svTSmuQyndI^Yi}#nL~nJG^`l7j>5fxyivc-qING~2^;#;s3yb! z&P>YXI9epS?0MR0=(N)YAt#lu9np+5CCZ_IsSNqfZR647_N!kZ9MO22OK(!cBbmV}W=PSAd^QW=tZ%iJBnZ-ewpkOHB5R*t zSn7b&AXpB#md&{q)_iNfh(}RLlp{UD*pBG;twzX}j*>5VHbdo!Rja7dpxN~G^g3M_P*H(_iPao&){5p#V; zY?M`U@0%sirr`?^iiD*gq$aiQCQ;OBebE8gM`5 z|E{evA$d4K)W4??-=;Os9?C|>GPZ3+KX{8I7yWvscoFIQDPi-Sn?`vR^&$cUd`c3eAcCHwvAo2b!eLp+07?Y^XtFmU(%pNIE zT!$m7t>{+U+hr>kA5H3Z%#d*mGDzMH&NqKtp$Ty;SjGe{suthQH}wlV#xqbi{a1Cr zE(=e7pk*PUlt}XMIhPBO=<=uS_swEYvu-}yK+qk{%Q@4kEe|Ccn{&SeDQ0=lQ>Od= zyqzQ`KP6Q`x5E8h@uH2Y9hQ6Bc3Oc+BeGIAj+pJp4UYln4cHPc-l2~k>K#-N7y0N3 zcYsdZD-EbgLiPEaX2pH$lxtB*%#MVi@S`+5AxG62y8^=8TkUf<4!ygD5 z2U-(56YNY4*-b%qAoZ#soS$1R-;)>>L3;3SaQl$-EP)b_{Le-WX5ZfJ8=&f`YYtcJ zeMCW91oz4@eIjGpo09GAXzEcZ5fB^Ply*H3PN;CZ#V>;SvH;={HFf(*(0EKIIQOwz zLhIDCX9$=#S~RoxyD6n?VPjNJsB}hD4Q{k=lA$1TGB!(2JV!-OIxDHwb`f$V&=L-L zRUCyp(&WZK=Q?HrkB`sZTTpmAJJZEWj{g9jJ? z63{5QMaNIxs?DGyiE57Jw_Y@yeK!hZlFS1Rhg;aF$h2(lZ;Z@F`DD{huhB`E3>r|R zvrtVRb{HO5QXR!zYgqqJWtF+Wf9Ggp56)%PXy{P@(E!|t_32IYN1>~?(h8bo`A^v z?;LZQ;ZRgA>X(Dg5LN|<#8Fm>jX+D_htsgdf|AjK}I^vL`NK1927D342T@5FR z?PM>gJXozHYRdrrs;Dzj7HLRzMFGV1$p=4QzRL$`kt#Rl88uXB0a8!^a`tn!R`NL% zVqZeT>X`B62p2FT{oY&Ua&qDEzoM}^q+DHf#n7S?XcKj_y&qH1uo{`To#q~FkXM)s zxn?;~7(aWq)xBiKn82XDm1erq$$HAe2Lyz~1UmB%Hb?>ImeB8Lg5*7Ovb7$6jIL7W ze>(&D%haXx4TJDb!cx-=v$+@#gVJHko7>&575Q@@GIu{;q>KL$F4{6SV$6Au+!|Db zr53#PL(b}0MbHUjdL|wy)e+p?Lkp+2d%0AAe3Cm!!C>P}zTb#MoeiG$v=zrogkLuE z!xEm%Ez*#1@9k7k>}n1rgvJ2om$EaXh~xUcx}rWdMvpQBdog+V9C(GD4e@U?`RQMZ zCcU_ytIzGi@4HtzY=`I^HX1&6MTlPE-YW1+PZjcdvahpBd4M}84RoIp9Q8g}DXGIS zs#6pXJ@}0HdgX3p*BKZ8(Map70D>aLGZ4i8bs_u&Y3qcDKMeqkwRB&8K1Xh6B7iQD zq^h*vVQ0WJd_U?w(!-AC!7$r%E=R91C#dP}-m3M)t?FY(Z6`;kgZ~qBWceWuMV>!DUhmZ%vleMW zYfs#ro&VxiPx@~@naFuOJ1LOZTjPuP;GR5-kfyu$Rm z133zIfJDVfC*lQGoHNP&V%E zF$AKd9?%m<)P>wv>c8I!fRm=sI?(qfLBMY0{S|O?e!!j&j|>HESaR;zRb%@0A$ZP} z|2-*wuJ}jEm%uGbHT<~r@%5EOy63EWj8KmC8>n1{wyAyV1{EtRvwtt=e}Kb#PcGun zl2?K%c-W=+D`%U2;7XU}_y*9z*zyc21x}j=9fwF&Kf(EZVEn}23Yb3u1Sm~2rrDW+ zT}ozNi?|d({GGkzz@-#6<7|H4D)1*ncIIV*!oBKKxdzr1J|w`+5!ZRb+fy{AhBONP ztfdD{Hb&w^SMBqp=KZ55D^OD-=jqza|1eNcMf(-6-06Az-0Y1D(*4Xid8mogPIUVr z4XZ*mMC|Wdx&In(1aa47_2M;sfL@BM*PUBhk-w8@dJ}K-@(6%8Et=w&s!{tTIDex4 z_nst^K382$d!vsAVkcd?EH3;z`r=ijDBVyUc+hXA(a&Z3^a$@+x8XtxxU*Cqsv?&z zfc`RrT8!94kJaq)e2$1po58|UF@(GE!cz?le~j*vHAxq*dG#yJeByTlqh8q2CF~5h zVU?T7CBR& zRKq{Gusm9`(Nz4Yox zs=S6T6dy!NktC~05UtbvAonO(qWiubptguZ})X$+wFpN=rff*Twrk27HRo zr!)LKg#YJXe!|H2Nbb#Fi4x7e{Ks5_JxLF>Jonf0>3JUk{QTUE3j1%Q-F)4Tl7$Cw=GbZY@iJazz515Ox-5@D2Xfh z2S~{O*r4-9z<+f6za)6AgNi+`Rph>Hh^Q^+!a$zgC@nl0_XfBs@S%d9j38?qAaC*t%z#+F*+^e!@ zq;N;&&s;6>Gv>3-tJ#sN30{{-QR*2F@xjezn!5P9i|cs|brra=4nzHMk@2F>ruqnS zI*k9gcb|k@eUv%Ah(^;G?!j<@W}PMPx+9+5;<4s{_AFdXIu_`K{2H%_wh^H zhr3kC5yYsDnf+{fAiXp?SY#pi%li~3SJ$xzcT%2ht+!@_dx$xM8qdx8U(t26-MWz1-C*7_4>jY5OROd=ouVK9Nj3Z z-V9|ganI|?aeEzF#7o#!EcEUa+n*c#0TbrAcjo=IN1Mq9G}hSz%bp=+9t3usw4MZozdD{&vlSM={)OkR5OcT>TS$>8$n zaKJOT_}bvFc_jo&Mb2R|^CH)l|4jE2KVv)Vi*%xv?*IJcFW2Ut3`hYdOcA55T&VnO zq&EQ1eTh1t%bE9Y`{;UvgJ&=&E#SOz94^?Yb=_4+c-$!kc|9P~(HA3=_Z2pDrq^Ua_6nN;>h38#r>^2WfU9 zpk;3J{*Jlg?ijWv#{QsFk#kYt<|H%4Wx99Q052`tj8WaN7v`tpLF;wNn?NY z@duEA3EwK-UsZnu+k=ez;NpE}d46()4H!S16*LAN-i(1udF3>e9{^Pf_1g=*OHcXP zHz2v%B-|kPTeVE&H7^54rgrl}M^VlbU_LH^@>RP6in-I^g|E$0Zx+*Ulq6Yu+CO#T zy=j;wRT5qT@Fzv=@J8QC79XL3;u|+9O)NuYGmWc0_k-<6lCcwj3q>@3wCd_~b-QuG zZ}sIx+V}mkg2ebl(mq$;u5CZh{usldOaPnM1X*luLA@2_l`!4`T;?=p6j_JRRLFC1 z83>@h1kku>za2n(8Sn_OjL8+zER7*!j7Sq5x{eI{bq;$p9pFthl#|evLnuh|Uc^7t z_|SsL8Y!oikhzD;Oq^dn8AP8PcS(-U3(ABWhC4_oIPw-Eh4m%!UVojv7_xZV*=2qo zJ`noakS*S2$Z~juXVR_u*b@jemIYO9_bBNdEJJ}9TmJ_2l5{^Ty_kO@tL(=mSW(`^ zN&@b3dY@}O!zb%x3Tq0^q z4oUTH8{gDfyrH#LHJMGF(0{JlZNN3Dp{Ro+OZ@9i9NZQ>&;8z{j>gr7z^hw3Vm`-* z`fo-(x7zm{(lteO%by$T2&8(eFg_MXEk>MPto6WG5?mB;KesJC0a88fgNomSGT-y) z7PGBQz<1GeMV%6r9M$tJkS|8qfWm_phK^rLr@|#A_KrS!1P#4f=4x&3hac^Oiy>@K zn-aD2z=$%Qmh`cBDePI-xrox0u`tnMgK^EhLWp4OX+PPey+{UJv9p-fZ5MANeWE58Fq(lr>)dtyN=~-wuetd*0=!rD@{SS2x-MeFq1(r2-u&E zEiKBa4)C)hf(*SwuXtqts|BFAoKbVP>R!#^W@{u-dJBY6*8wxS+naP;%$qn#+9Yrm zGno^hHgO7l-dQ&IqBO@$&r-KP5o=vo#>|ExRb+%?}L-_RK=1UnDym6cX>O^cSQkD9Q9r$o3ij(54em3B^IDsvav zX+nV4v?;_h$p?c!ANxJ{e0!s2xD)kq719B-ct!BNeXB3h@aeo?0*ap?Q~174XX6tx+11qT?gbrZmUTtV!u{NSquHewstxlX<<_qc0~Zr$}_w zXs-q0pVr$h^F_v|W!V3wwUPZ4c~m%sP!F#*eC2h|LS9uV`}mykh6Zw3lSTt_U^925 zMPz=dCR4S3szJS(xuyN-;N-&gBxC0#Z3TPM@{Tl*3_%KABuv?&{8=l3Vcf2>i{Y{M5b2!!A-1 zQ9PQIaGEl5>o}2om*wG)o24#UZaJ^D+33#O%LT#9qX`2w544UokwsN?%Sng10x5p8 z8X3|Ns!){`ElbbgJ_iDqykY03)Wymhq^;}()H*d(d4Q&;`SxsDK3cOTPM4PD8K(>CFw^<%81t?gL0FC5vLBHL}_z=Sbj&$3Xr-1bUjmn1jZ8}2eHg3K6!=xML{ zJFk8MgeP+-8=iOY#@8Y~=8l@4y8d8>?0XZ@R^SNJ-OWiEOw37`t7@Z0R;VDu>v zKRoLZpxF#euW06KW6?qS=Ht%lut50xudbI+b|rWpUSX5=`WNHmz8(*5m2B!&IGT4f z+eC`Dq(0loDIaYR$O$R0%E1U8#Fom=i-d=20&~1WIE6TP@uLegj7XNc2))g&n&+7v zz`Ua5=0=h}waDLnTRdx?M-gNf zdF^FWYxN)mZ2oL}&$rG#yN3JCt*=_TWy%J=s!k?Plv6|n3ji>0|$oMP%`-o?(z(jrw1cTj36MSIBdty~{Tqc}4XN zskHF)?XaYLuOT;*at>aT+r!6pE~bmj@8@kg-v5RXze$CT#?&p*NgM3QxNwDHC*I-( z66J(1zoR?!;v^}VVXAyEDKwelLgsY)Lbd?c*v6sRR(feRU-r&N#~BZ=e(kt-UdNT0 z9bRI{VeRAP0B!`0)oo^;*p>l#sDb+oJdaJ$0_X8X^neJ56v1FE#YOaEGRS8Mh0BnQ~ZypG?J;1sQp+j=aWR({=#yjlaK#$ z>ocXD^QGn>>@yHtA3r%7F9VUWMXLws2x~lZM0B!FPa_HPHk(ck645>`sU`D!T9zRR zhnC59*9Xse8zNhIp0H@Nv80)f)wOG!u!M z9?vx9=Gh_$=RHTXRzUm88yp3gW337ii19hX5{r&*vlHJ=zvUmKG_S!7`)3U9S+!pfLv;ws*F+k585Z8stO=tm=&8`)jZ?=8k4ro*)$uZE(xRIp9zUn z2yI|}N3qicbS*<^;evhGyCelOfHm#5q-rbmFows-@Xdoc&d{O3p%QC72YVm^&?mg2 z_g0cKR1#SQC7h3!OytV=9+dAzFsMpjGHE^js_a{H|6c9UaBcfmPhXO{UZK-Q^=g3R zp)ta&0UMFTHuR2!pcklks~qJy>_n+1$ws|-Z!&2@E6e+-BA znBjlthxF8M4`%c($7I_!wM0~ zIgvuUVML5Dr?v~II%*Ld^ZY82W4;6;# z2p7~sJ1%bY8>xM&@)9j9%@x_5iViRsb{K3LpWL$*U}r9y0tpFA8g47PptmMy#rFfZ zUTp3cZ*^{&y=-{z+{cD+4X?ld02*p9F zmFW7O^|)I)(3Q07<~P}ByWo>wW?CqE<<__hjON-ftQ7xxv;8&tN)EO_yPmOg51 zCbLs|$1R-~i;PN}KM$|SX7TXYo!hr@-*=J-wWniOuTig7KMu5A#CGBt^lvGJ+s%oi z`d&kJ8k6=nRcL~FVr}L%j$cgCJ?1nx{PfJy`CP9|m=Ap+pRB-8OwCNP?I2}!V^P4Z zgWNoP1EU&Ad*{vONw1>JQJEB>WNK9}rpM{>zcjrSz#_PXWppow|YO1BWKdts}@<D(d+){ibj}#(!#m#XCx(HU`8;#Zd$!+o z-9k3Y+$!}5m|2ACXAxP6*`3@Ttt^a=IkG>Vm}_=%&W$dAJi8WAakp&f@bh*74=w(C z6|hoC6-uNO5`#K*>EXdTx}v#-r>Uwg+k7?~3Bfm2VO{J%yxFT|?ONViQ2f31C*cF3 zWf)eW1-UI8pF&=xp9pLY{L6%?ap`u6h`9_rrL0zKt8feH$)Iyfc0_lQP(2j9R!MY^ z{+^|A9~~(P)ji0IgNb^P2iJ3iOqU0zLi+W9xoK<2WRw@hH_!&wZI^SuaS7+a8BXg6 zS<33CM#O~BF-3mRsHHiHDXJt zT3nG_IT~nM49Prk)-W`! zTFBq8v2J}7F}jelXn_UiN2S>cTIj4b`>yt-xQ!lO6OWlq6f@sC5=y>rh2plRQ?Ob4 z+%94Gtp_E7t;yb!5KGcv=PWZ6T?l0npRKh*Wi7z9Nv5=HV5qQG_lzPVu15Bx%&oPj zc$%$u9ZFtB1KqZL>6%ho4`3!>!nngDspH#){q`Donu<%4RZc$9T`tq*wL?Z`R_f@7 z2^y8H?v^DiU0XYQ&us|Fo{2?~J*D71nk~ycFB3dhQ9pa(dYI6Lp{=-XN;4*3Ho=y$ z3_%SGExI0RVb=#mifOl1B|$C^dxsXm#?%(2iuV0?iFUjSYd#9m?kGYJ)TLb2Q`WLy zjW0fQBG3080lOch)&K`JJ{|f~rCo_b>HG1Gxgb#65PE*GD;e-UVW!ggA=+Xd)MbOi zdYfgpYv0QAuT(U5x4tDxqJG*W2J!Qt|4MCvM zY()eTKeQcG`QXum7xC4M?HY?t&~p5kSeDS|#rr&N^XRwTf)B1@=m8B#*s$e=7wG*b zdDcR^W>f1;Ei}i)uR~D3ylQsOEitk27=Dc9@c7<;fo1F(=8$E$MM5 z%2yC27k<3l1g3aNGx#jZr|uy)%2wTA%#8HPav~AZw$vk2Bs*Lem@|hLto>laex&shTbJR44uMCq4zoOR!}Xk0_qd0kp^W%T zesFKF4t{^jJFbgEKR=_&hTERbVO&Luj%yOMW2i1T+Mr5rcbx-kH01fVz0^fJ(;iqx zjM>^fps95M(rR}l*N(g$YFIiDqBAu?5URgfpp)OwO79Yij$={Cqgl0F`Z?+k2&t7z zof~wNFQhV_YN){xTqUMGSEqRS(hm%m^p2EuRN7_B(pyJnSU{q{_U1dXzU>z5s*Z#$7q6nbzOIDyaPZq~%goUvp=6GGG$)oq&Ebd`&E8Zy7t zjQaG4A={J`bi9i}qFEvq6k0U^o}UZv3TiDiM89AhmI^tfig`4V)*(AzZgao2ecanx z=e4a3#u2e=u2c^#fSb@Q+R3nKjKm$PJ9)L@%LxX9-68GBPf%(?fgSa{1-ug!5@X%r zaG;4Yw)HN>j$>kng>!CyZHJGokC#Yv*s2Wm^^Xl7{%izw23FhY#HSY)c_MOm%$jcM zq6fW{mqUsK=Me|VpSs%f4c*N{C!tZTgvstU{f@?WGIgGzJxKJ(Tl{d0ni+JDS#f29 z7Th0>5V>8NKa;w3r~*B4(?JG?jbGCMJsr)?EkjD!=9E{i`37S3;66MAqmrqj(PPcy zb~)$m7F#>{S8>WP=uI>PoOJgBHQ70# zW_ePr-IZcm0$0TljUw?dgxo;TBMMBfnZJD=E}DKo7DfS<6(&`*ryxB@FMA0+_Fyl& zOd)Qe?-{#|jpsHTyBHUI9u|{{719wM$24ns9kvAYv!iS^y>QvsgMQx9nxxTEv0QGZ zPIJV^E9THX_p!YC&~AbRwJJVyHcKS#q}{&1UBic_;Of>pnY^o#`|Vjbw7H;*JnTLX zcG`g5o+&3&W`&bCxHn2tE8GqozOC}0OvD?#Zd9Jr>2lhhyZlymQ2Igdj-p2u77ir> zc|iz`Uyk#1F_}&-1@9t(QyQroTbmB*1Z${qw6(=B<6(vQNOoiPSG@IU zwXgk|t7We>^gZJ=hFc50+yk{BaY7M1^L~>X@Hi>e`MU{D zVS4=2)^wM#g|?NcZtXHxL!>cc{EgI^9CZ;f6>;f@t^E!ag2Dc!yX-z3;ZV)*{oiKW zMxT#9XZN_C(G#)}p$o6DqLOe?LUD!gJ-N}wM`_2V1CEHgxxHL(7hOarJra`!*Lc!d zpu#qoU$1#heBR268&;y>ZHB_Rd|T#8VSy$TCdXy=34u}VWidClkr2J_-bb16&+r>^ z?wQrgj5aPe#*h;6*RBCc@rJCkcLVbIKqo(kLq4o6H4o6{9nW6A=^3lyHHJwq;R8#4 z*D1bCbHWN+w6(!|BycBfD_t79hPK4BhuLZyMycu+2VI%Zqzj}#sfca(A*i!UM8t{& zWDC}eIL&RBkA@jDc2c=Ly26fYcZwSsW3Vu1bQ z!9%l%is!J#v1Poc%G!8fe*&58amhnl8~1}CMe*#yqzJT0-RtoRs`>kssI}}vlS(%> zsjv#+v5g3Qv9d=Cd?(-Rn)+iI#5V9~cLr^D2hS2Lu;PlV_S(? zlnKbW<_!l`R_iVF2BW>az?H|`H!Ze4b=3-6y-j`S0@nF~;!Nu_=aQ>LO!C!3HM1&m zqoCtsrX#YL;hpyLZ$&KA3d{tii=D25O z33Vtas4moH(7;7tm-l-7IGy4?qi24)cNz9e(_OhehXi%q>fnuqCpL!RMkL4*PAp_O zx=Y#^6WS`=&EqfT)x?bjFbXt2QppyGzpp6(dhU*{=LAu7_va?&g{pBVvnBe{>;(I5 zeDLu^a$yUAgSh8g5y$$73 z=qk9VOS!Th&hQ=qx3(eA7=N3IL%RsM_PZ3UWse8)iB}+3IBBhT~5k7M^V;1n97vwTb|2W3A8fJ625_(4fHaA>v3}y7NtH2A6?mkLmA3yGK~AfzU7#vtPhQIzUz5^ z>ye(zO`A!IBlv_!QuhzG3eU1>$Bsum$L@?SN@zvChCv@&9-(;(kD|%M&s?5mGc!DY zp_K4HfBI3V@ba1ov7?5dxH8eHT0T7fhtzb|D#hu7ah+c;73E}iK1zhn^Jl*hwUb}( zMZfLMClofdKP(XnOgEs=%B`6C2ovc3vC(w@GU**wb9D+`h0j4(FG=>A!v?UIV-{0< zq;nRbRsp_V9$Kd$+m_>JU*q9Be;XJF#Y-TCX_rG`^rqPm&BPpX$=TA*P9MaaAAEuKM!)EMZguV@IA&ORYbYyZJg~iNS50n- zbGlk;_l=IGdEM&*JK8ZLigeUk$8jy{#q9u1&jAOA2-)OtF8RUsjl9p7DikZOlTZvj zU^Tx1wd*JH?Qg{uA0BEsYlwNym@jIYV;Ix1oQlSeDF{+GD$EoIx~1k;SAKdSwpDfY zh0w-n`E$E0&z%ST;xQSXk?TAzWcX4<7L}F)Z4jprZAB7G>+r6I-CbS~ZfrcFJxoR| zE=1eZLYGi-*wL=(5p3!eWYwth0(C&HCcfSDv})WBbMHiN>1!2dcDM7(wUKobt;%W6 zo_$m{HW%nZZO2*{^bAE-GAEzCk%wERr38@DvZ-bEbA-*>Y;mp;?l`cVx7xcRuC1w( zv=15mW~??Zf8+ToXEFt)%9gLL*tA_*zCM&nkD)9GUtfH5h23 zea41SiC+~cu7O3{+&$>>7g(9NlB5wHLp(AR3cF^hwad(?$ZIiZ3cI{W52r`U*-DrL z10jOYIO(p#WS#--q_xfDjvAtVhd+Z52@(3rcM&nA6&msF!~7%(m!iHa`Z+pRKQLlr zC2J16t`@SmRzP655hI#Nh_)^HiMAN>aMRD58t@XmYvgH|taVaSFId9-7bQ8k@p7Ss zvQ?IH!myT;eD&y_9YVn2FwZ3uzPyr?tagMG+ds%z&2!mzay}ebIiN;l(~=#84~JfB zsNQ|TqSMf@9f6Wjmn?TU$}bm$J_7-eb&@Lpue6?9uk`e^YjM|T2)X#qj}w5qyrfeN zdrrhIb-0R$4>SUdNTU4msNu|xC%+F~^n4EJ}UaDN_ z1NRgiwa%V1PE`QF(Uj}OeQdIgGWL=vS;<;2Er!njusUxUDT}8CRB%fQ=g{=_gsug~ zcp;1|vr`i3-}M>a1d-LLBMWJU)hL1kt8<05DIyQJnI#fu#4o-JKds?i`NuNdgZcTX zo{__pye_wjMbq-*c7>Ep)3 z%YLI??;cy9e{@%)@=naRTZ25(BknY(MeG-OytwCr%Z3>6T6Wn-=v8pm1K8wMz;_|CEdDGDcWv{OhIj@dodo1I0SGSbKtK-}5KMJnEPw0_ z?Rf6IYAOjs0EOhCeDzv*if0*m9p*YTG-7K-#}(4sBkc;Hhem)~f)QZOKms6>Vcd&% z|49>`C%$>!nKG~JRd=E&kgln!s>Q29b_w+>JX0|y&|$81z9ojxE_3q??wuMzECIkD zHD8iM9nG0^1qW{cG^B)poVMX+=K#a_<9(w42%Y|m%KJh*dN|?DM0N^Unk?{l^$i&q zp5bl*IFxm>^HC3xRW`ta1_8*7!_p6_1OHy|hWKp|Beul!m3GgAmFpK{8US})C zeL5i%A7C_n)64Uw-UEk81t}LNOL=)556E0n6Fut}^b=4-1PrE@0s27Pd6}NND3qa&O=+g8UJ9XPv6T= zfC7~y`)}p>Zxur77BGs!T$!oQygOjX0BopL@jv}r0CGGGkVn|nlji1@ z=2Rpw)(PX1H_r&=PT$2HrxnV({|awAflc1 z!v$@lwFcL{?2kG_>=!h=Pe1{=K09qj!w)uAb0<%AK>6B8azL0bJ+T`l5kMw(o@6pt zBYVN;=#B?qrZ_d5!}Rxnco|C+4LM5M90WmWgpm5;or&_~Z|z9lCp>sWzgd9{BB|>d z+cl+)$Z2!=@riW?znU4=obfzz861L&_8f;9ea&$lH?FIyrNTUt_1u1Z#$)Lh>wUN2KQd=cxjoqJb3ow1pg50bd| zQ{g9u*+3syuJsyTxXn=l=ravA^R!(7c{+Usa~JXC`a$%>?>X?|lgBKsefL$!>0&^V z*Klc+U3d5?jkPJJFh7PQnt|0qz>moL!WaM2l1^P>?wp#KCGOxrQa4F#OiRWaop zzooIg=PpDfp3D~?ULFzrqOL@*d4T|NQ;R(a6eiF2h>s-n%23S9u!5g>1+XdW6+Pb-F`}>tBzMqOU2MJUB))fx<9BqpDEG6; zb}QEccD(gvDD;Y8#Ftkd&PN~2a0`?`N~*rQseRP((y7$ltS+9^fD# za3JE)MmS`8)Q|a^+a#HA0B|bk<=k>NLgLd&(INofk76&q!i+1xiQiwka1hLA7}Id* z1)S;WSn3X5|9eUD;_a7~#S<@`Ex!%$yXQBEcLE=0x5R7!x`AYh$W^lI3U41fk}TB@ zZfNgWt8x0{)8z4wUtYS5SU6fv$&sfDD9(q8yu$rm=~ zIeDJS0*kZ*zc1;sq0KI6J6aDx7~m_xyRYdw4~f9>WRk${ssfYT9AKA0lU`5k6c7m3zA_8u6`ZD)Hz zcrQt(o~9^&ceRbVR|1Im3;3&{f0_tLKrDXEo<2w6j??A#Bu(@8z~mCX_19zE?_cDQbiPnE%*L@vd6B(?<;$g%70cEZS;7jl|KxX za(IY+r$|CJ{M>*2B|dWey&X_RDQx4@b!uU53gN^mkaSfK-0$zc0gT9oYqfLcomY`= zXdji^Qbyg0{P|s~KO`J*uFa%9NR=$;ZW4?&!m+ppi1A%GhG>~Pz`PL_{C?Jgs^;PO zH1Uw|RLlR=Wr^f1gxC-_&RhMf^m=X&-|^<2+&$<+21(%i`%F}STw4+XW}>QKRMhkw zmrx*UhtEj6SJOIGOA(c;rB}FX{r4fjCqe05&wqL?za{W}ehYmIBY+JCoJsv6u+Q`_ z`nc4*TPfQUj2XCFCt=q?^0ye`ZEcbnk~x~dp1TSOV(d-NkIzr}ab zm66gX;XN0TEBAtf`t`*1qHcmkIrS)R$SAHX;c0dCNi|04$o+$ch0Oacl%$%;iSJ1GxUi8Z%&N3Fqd%1B+ zihRr-{@QA^e0BMH9G}EulxpCz9Q}2z!&M8TWmYJI`nnFG_ePp0pt1?Xt&CJT_W%-` zQ^mxHP_nEJU=AvBa)`x7SR^_;iv@P2D4!$TNRYmL4XaXu5Kp4}LfokkG&;iueR>c8 zm`QSRL+Y!+Re%gU`K{};B>n5}%y-qzN8ZD9o}HR;R?h^|`R*qJg3*f|fFEvVp!@c> zh(Pp)o`z@@UrH@to8DAsPVqgzB^yx9D~nOp`gnbt-5fw`2Q^B#Xzk0heGn(Z7)c!z z5L$MW$|pW`ov=Pmz4F#i6(8}S&m85BeKbRNf{pt{%4zsW+gut1p;uwS4Tdt2HhR4@ zq@2GTk$hbR9(>BdPQ{W$khRN|P(+aXTZPdBa}%uZpGHbwZ6B9h5$ zY)8|kS7xc^hKb+s2Lh$TNc-fGhDE^Gn8EzVJnfOIYfqjj z1FlA&_ojV(^jU(KyxsPHUIvWi{;a-UiZD;ck`n z9hGeL_gpld_#Q2Njv$A53?!&$i)ux_fr0MM^u#Z`*KzW9)S9^A|U`b$sr4Ztl{5aBoJs|EC+!)_FKJo*`1f^9G z*_Z+P&sxitoC*b#)az$bT|cWLkQ6?i^Pe_HKTWfKJBC8H+;%B3HK`wOr%1U}6p2syQ-;s+E#clrqXa}kTa5El;i6X1?vfpEyhcE=}o1j;9-&Ud-}P&d&A z+kMBW?$;yWr9S?o483mosaJC5FbF#}RLAS?%oE6_vo;^8TEKh)>w*|taW=DNZ^VV_ zCXH-?M2=AWMvH4Ld)-s62~!Yd(S5!cZhNi|jY+s0v|W=Y3tb&8Aah?`GXw8d$j+)q zTQP{A=$ZafQM>=>MGH8~;_{{LhHQAbAh+lcm4v!v3S^0f$4PMID@6eQeo8!gf~N#+ zmuAB)7cw9ZIcM&f^zhU-B(wy;uKzm1vFJn?OfsTfDyc~(OM$Gnr#dw(WJ-r9CUcJb~;B455_!^*^EtnD$bK)Yf*H*=ua)Mp}QanBC8q7;?lC0w&)0gM@5Ai+RZ zj0bZ`ZGjElhnmTwq1$OSc1PtcU!NNVCEX7Q-S)@W%8ZxeYSzSFmfV#dpBm+2Di)#7rZjusD6~2JZ~l z*yaG!B#Lw6$)l$2tx!fX3aPC+xP6J6p))oFE|PnWYubc-y5beD=_*lhVI;5Hy~C}h z$d(|QZekzDZ=Z(g70K>;VQuaQIff@hl2YXdbv4;)M-!!D9PNZQ`f2WJ#E)!e8hVE$hBr)|%a{+$mOH~) z(DRRiTlZxH@CPX>W0EUP6E10_T~;S`1(JE|DL)P~Qf*Y5Rw?O7t+nGxp){Hc46aBL z7v<=06^^yMKx9d)ufm0s(vHqlqHE3YjPvA8A!u$N8~M%=5Zm^Ld@L!>D@iAHecg@wxsJ(2>BRNw$A3%*|wFRKD|x zy&1&Ff}7Zogcg@>-Cfuf45rBS&;+9M$uD|fErC&O?)+Nd;b5o6-O)xW+!zbK(y-BW z1o*-ZYVACK(cu!j?e?y`J;qCqzXQ#(Rmi9ei?RJUIZRq8+F3aoohit;RSaFx)xzJ- zV{p`TZ|CFf!63z^Jyr^37PPs-{5{q9Dr`S_of-t?+Z(^yY`P575GFBr(4XQvyDS^% zyJy&*;+_$6Y;|1Ku2k_cHuzIU^}gsYkB=X>{rDX3?Ov}nOcw*}Z(I04gdWA$eJ(H9 zhIdnhnYj&X9!PxX;)%+U@1m<@PH4sqj7l4BU633Gz-)}*qmuL;HmAb2HAy*@4%!Vh zl;gt(SopAwIUbWp!j#E#g%Sef6~}Up6!|H4Tfm(;gWee{RcsiJtwK4hf*nd zRV0>UunWD599z_UmYSLCQqZ|vxK9$#n~c&Z7$W(})~0)0SY#RFflnO)-(0V>q@ZIx za}RNUW~#`ZQ`LC$F0It3Dkd(Zp%~U#Z6mMY=C;($qFzBzjy>4F1e5i09kU2F48C)z@h0MF#6q6}_wy)D`CregsV}8SQMdIg z@>|bOtN1-lB9WL+J7CvIQu^t>WyPY;qOrvapL1%T8`Mx`czAi-LxFYT-Y+G$DlXN< zLe#jnE@dj4yfe4pNwvb{spWOFywplT*{R6|Vp6Dyz&o$1_;PWztlwQ+qhX^}wqZ?A z6kQ!l5f!t&jJpCr@Yq@Ys@-0FLAn*m(#x(X>wdbhwv|lT zp<^ynmlqa5*}pswln&Wd5|OkTva|Bb+&3?KX}Lr0=_M%_pk9wx|6F`=AokTP?qoWN z$9!jO&ZTU2dyTe~@%zSfsd0i)k(O&$Q)1LnR2Zh{QW(4#ezH9}HkOBebeQ`RuSJa) zqQw>axst>r*DijjfA4U}A}u}Q3yX2-+a1L)%O9x?@+`=}J@XdhBCUthxlF&v_5|h=XVgDeLyU z_m2vVnq{S{xRLHYACGoAugjS?@8MtVm27;+mZo(P4kw3SN1q^50`8+cyz@T^!Sy6- zNO^0xK_~%z&6QjqRDoG2Q}oeGb01;t82el5r2~Ksc*-P)e&TcKZeLnuN(PL3IhOLv zsh&m;`x4Pg3Z?=lyZ!+ z+ojuf&?4Ye4^CTOI>!TZSM*jo>AY{Q+9|vCn9G*yJKwA^-?^Rimeu!*$6E80*&U>} zn|z2Td7A{Es0-Gyq|uSa_fggkhnl*y;!2qj`j!5}GIflHf}OgOjVY4H^E1lP!y6m zN!EhdDagDLo@Pkjp&+QYQKENC^8>qKd~oSWa^V!iiDtK5=&-4y3KN;9sq=nXzF%WYT_%r~*#@$BX44%KY`BL6Mslh-odC_{)I^Ek4|RB)Q&oTTF)=cd$fqxhk^v(4h8%!&ig#tOxlS(r;~VbT@D4mm#Cb+?zwQmzwE zksir>Qf3ju@-_>t6lj{3+ zwSN+kJlYw+MnInGL1dkAcnFZM*WH6EV>_r_;nLiCKq>;ffYgMD4F~t)oOvmK$vTXW zS>w2RlfN&VJ4aLY{OJ=-lNXvXGxTyx50RI<>eHLTRds{*-{XqOd9dm zvD=eTy|}j7eKv2nsFVr=^GoB;^54hvs<%Gqaq)qp$F$kxHSqDhTzPf#HfAw)UNCE2 ziLn!8RgpE%7wWb!Ssm&vcB7ntI0+3KkSyO5P5b-Y8de45VA~2{mtVP$AcB2NnXMme zMa3MEuT$%86hm@Gdnj^g(cYhOx_iw$KmLRge>K~_1;p82#p{nOrAPd8;4nw1a~x}*z`pkmP&g_2$apK;a%Y;S3dN+Rjc@3+-xC(Dv2-&qLfjS%BNMrHutqUwk>0XaI?~l zx&>+dS5Vy!qPZ@n(pBU!BGVuDfuzfnV9#P?d=g0{dIL(epfYWhkd_hMV@YZ#IZ;Kr zAqn@eZ)Du8NH2N%mPW;+V}JuW1Ro3u&lypQugz?knPgieP*0X3VR-u zldmJ&9_hu&7ycx5ns`V3>s27v#+A1Cy9ty9@j$X@K5qzS-I+q-TJ*`!S_zf7-oj5K zz~w@Lgwq)5Dp@^l!)Qk{bZB;Y+4UMaZoq( zIbXJf7qveNcXR6NHRBq9b*(@2!S8!FQl;q&aE~o=9qSz`HX-FFyS3&DorX;ck3N#` z0HOI+wzPJGk?<4_uCucrxH;Hfm|xYNF*e2`qBr=w4JTd%W_ll*XF}0g@_{1+M)6CQ zMG5c4NB5UF>|lR*V>zCmOTpy*A>L*FyA%~j*0|%V0`;@jv;@goHp`Ih9p_Cxk@2Ah zg@&l0=4H8_?kd@nf{}{vCzZaA@F}9?Jzax9{C#lM!xSCQP2-YD#fw~A2qaG@*dn}$ zUw-p_3V|&&vE`)m|p>Lsup;h^peMUU4eT#yGs^tcf?yMx37RPY~EMAWzD_T zpDuAG;am2+SE?_SJx@7G*N85XkD`NR$}EL6cNpFAbizgQpDeOoC%guS?x|Dkek-Yx zG@)22`7kE5Fnl)znR2l|uRSKEWbM$1AWCy`4#KvtG|1t~7r$B!qCuO^WT3sLkKL`LeD;tL36mabzw9&)8f%Q7AAjQ74UTA&B8ms{XNeE`$x4rS zS6XZ*obY$z%c%4lP3o33Ec}OD4>y?O==a0&^+3$!OFgPq!MgJg_Igw)%EGStnsHp!c*^4EUPw>@6wmSdnM>YjbluD@p74ew7BNtDDNV&vI*;cW9Ay;*o6Yl_&$8pTRCfE;#smG&fU7@L42)I# z=*FF&(4A|4AeySlpybx7WE$#=xRqToW$`U|QSx+aKGV*H9L&8&3e160$#UJtw_sk+ zmTn^o(XAwg2`OT(<0?i9Lcd=9Xb+nSm$hj@mL==ze;d+P+wy^(JlEY=s^*7{?<@VR zziHp&y*@u(n!;VOkJA30U04eP#;&^0hofh}331O1(()*JMYs(7>EwYvyW$fHeEdM} zw=C}xOT*)Hj3jxi6nSS`xK5I#)5P$iJ{Ibby(#}KECJ>dA!sqE=!(xK}E7)$S zESFJ7qjky^h?~L^=ke;QaDZUxV$vQVDak|Z<7;( zXGHJY8+Pd~3iP5R-JL`F2E&PSp3PRJ9yV zr-nNnRHz+fUg}4kfo4t044QjiZp@nGLZD=ChkIX+rKL{EuW>;y;dWbR`$fJ=^Qmt3 zH`-q@N?Dn5bz)Mcnj!_d!+RB9A2S6VwVKyhrIJOC`x=Bb~>Yr%Ufrw zC|^wXXuS&ai5zIlErm%}85)2NH66gn6Yt4L-HSf%Iu-t1z_GsSFt~Y@k5{)|8GhvS z$-530Mao1cpT?zyqE$)Zxe-iFWo{;|?LOEw(jHbt`4L*}V#RyosK(U-b(mkkaBMZ~ zhrC8=7~HC;GI$a_FRbSJ(Uzy#X10(_i^;{(_O@>sYMfD;i zZ~Go~*uJf5E1f}I0eiZFv%D#^S;j9T2n!=Bt{fd>ZF|=A`BDKlLT6fue331*n z593zcUD8lm$FhfW(?7wCv$gyyl6;CVvyy6GEa#IiXR

cr6O4W?O<%5LiS844n&1rWgP$p};vy!u+2d=7RU>YASwJUM8wwL-va5muR zUCB!1tduS*=|)P+Yl}10q6UVbnw5L}&jL;-1Vmb4R zW#NiLZW^$E(YBf%zJ-w9NkKeWxN})+sWmKrwT!6EPL~2EakZSg%Q9s^2LEZEu58H1 z_50#{7UMxf7-fBa*%b5}tm<~LsxUDDgF^}D`+&8;D-(tApvZ_!L>Fl(I2m1WF+U+Q zzvXLH4WyEJ+GVIrKQmklG~_zlpHlyb z@?N|$vBJAnmWoc5Obw4AtMPKHfaYrM2uNa?*l_N&kCh*p;8vX!su>xjgx?$Zg|cLsHK zcX|)215SdEQ$fI?A)$pr=ltJ*;!Q^)4-O|Bp%8nrVxdQ>;(W!^s`AAURSdjh;8(_q z$Qa^seb`AAk%sJ2W3w6JpH>aYeFs~!N8)<{b<~%%dt>{#z8LV96&QvYj6@h z^96pom-FfVA7BiCVFG*YY;Ig{6#yv;fM@w!mU$OPYP>h1VQ0}wrgkMzHRhp>CaM$1$)$$LjuckSAin(qFgU$Q=j z0B&U5ORAD`m@!rWhWf1d5}=WchVsCY4QxOX$rVS1-`wC1_4$S6U4(dR`2#G-Su57L zQ(WA*7@&b(w#0Y}DwW=qc~129f%H#+^69au1u_-k3R;OLlhd;9{C<)XDxK3C_{%Dw z!V|J@&2QQG?OQuveQ%uLFAxiVM$unYP7Zg?;D-46giaA^NSO@p6-Lk&o`!~%i z;CHT}wrg|Xj=pH(l)+s3Pz)205U;p}T-;xBZ{pE=CeV~h3D6-up1uV1OnB#<6=Y09 zO&*Y5NKPf|=I>f)5L*_lr-MMOwg$&e8cMC*=UFyG0$>!#gH_sE^}Agpnmt8@JDh!| zw6=%LW4;7NAazt~E)ik1Otl9p1mtO$vrzccJwv|41F*|ciUg}Iq^eTQ#l*IZ#PWRJ z#l~IS>E(@K{yVY+%?L`#I>Q!)XV=(Si(S^ni`}+n4SuZyl1`)TUq3Rpv&tdWM z9C2@%_&F8Z7t~qw2MfhLqA4qR-zzW)qeF{vV?Bn}$#-Pp!pQZBog&_Nz)}D&OL%}; zSZXg!H)6Pb5omQh;!m=ci*k>RU4IDklJ!g-&b`g2qsCBN5LZgPVea+wv(Y-q{qUS8 z2Mnq>ek+m8r>9PlEl~xFI)vNfO2DIIs6G^XokDbg3G-`*{A7bm!RQ*t#c&KMtG~UM z&!^u>3i%g^E!nXeBk;>j;tLX>*VNHpl8)EsS|;|A_*ojNWutAT)`6pWKYzaS7p^Vw zo+mK~i@#Y2F@Vzj0}sz6g6K4e6&&D@&Ev8s_ia5eKl-Z^{U3*X=_af*v8^@woWfsO zDtoK39xfxNFdS!rM+Py#jam>@0$mNR>HkcAXTTRoY1@7Hob%7{{KIrFX`F^F=d0%b zVnr>0D4yhSm-O$ zoUN|YGoYwj!s`EezLe7>y16F&|I9f7JdD^~ps4qBx&L}T)zgSN_#pOQ)lIs-6xS66Cf9; zt&}vLOO|mK_dQSii-@s(;n!4jR~LiI&C1@2=IPCYk${VP(>+q9f2QUC{*pl!{)uD* zt^ylr?OW>&BaoR2q$vC9L#t2oz-h#pn%sGz@R(F}(uL5|GSCr?XwCO1&6ggzg7`V< zxgpuI8uw`J+J9%B{G(5J9QvhIIib1TB86;k0*fvpG3bCl^)E6jS}Ram4ewak3TG0Y zVlw|1p4`g*)D*fuVCb Date: Wed, 17 Dec 2025 11:17:42 +0200 Subject: [PATCH 05/12] Update the SS-SSO docs after the enablement --- docs/sso-rbac/sso/self-serve-sso.md | 40 ++++++++++------------------- 1 file changed, 14 insertions(+), 26 deletions(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index eaa8fab452..7f82efdd5d 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -16,11 +16,7 @@ This self-serve flow guides you through connecting your identity provider (IdP) - You must be a **company admin** to configure SSO. - You need access to your identity provider's admin console to create and configure applications. -:::info SSO tab access -The **SSO** tab in organization settings is only visible to company admins with an enterprise account. -::: - -## Set up SSO +## Setup Let's configure SSO for your company: @@ -37,11 +33,16 @@ A unique SSO setup link will be generated for you, it will be valid for 5 hours ### Step 2: Configure your identity provider -After clicking the setup button, you will be guided to configure the SSO connection using one of the following options: +After clicking the setup button, you will be guided to configure the SSO connection. The following identity providers are supported: -- **Pre-configured identity providers** - Select from popular IdPs such as Okta, Azure AD, Google Workspace, and others. -- **Custom SAML** - Configure a custom SAML 2.0 connection for any SAML-compatible identity provider. Refer to the [SAML documentation](/sso-rbac/sso/sso-providers/saml/saml) for more details. -- **Custom OIDC** - Configure a custom OpenID Connect connection for any OIDC-compatible identity provider. Refer to the [OIDC documentation](/sso-rbac/sso/sso-providers/oidc/oidc) for more details. +- Okta +- Entra ID +- Keycloak +- ADFS +- Google Workspace +- PingFederate +- [Custom SAML](/sso-rbac/sso/sso-providers/saml/) +- [Custom OIDC](/sso-rbac/sso/sso-providers/oidc/) Complete the configuration in your identity provider's admin console following the on-screen instructions. @@ -71,7 +72,9 @@ After the SSO connection is successfully established, you can configure the foll 2. **Block social login for domains** - Your configured domains are displayed here. You can toggle social login blocking per domain. When enabled for a domain, users with email addresses from that domain must sign in through your SSO provider and cannot use social login methods (such as Google or GitHub sign-in). To add more domains, use `Edit Connection`. -3. **Session settings** - Click `Session Settings` to configure session timeout settings for your SSO users. +3. **Session settings** - Click `Session Settings` to configure session timeout settings for your SSO users. You can set the following: + - **Max session TTL** - The maximum session duration in minutes. + - **Idle session TTL** - The idle timeout duration in minutes before a session expires due to inactivity. 4. **Edit connection** - Click `Edit Connection` to open the Auth0 management interface where you can modify your SSO configuration, including adding or managing domains associated with your SSO connection. @@ -105,7 +108,7 @@ No. Port supports only one SSO provider per company at a time.

How do we switch providers (e.g., from Okta to Azure)? (click to expand) -You must **delete** the existing connection and start the setup process from the beginning. There is no migration path between SSO providers. +You need to **delete** the existing connection and start the setup process from the beginning. There is no migration path between SSO providers.
@@ -130,21 +133,6 @@ No. OIDC and SAML are supported. For LDAP, refer to the [LDAP documentation](/ss
-
- -Which IdPs were tested and verified? (click to expand) - -EntraID and JumpCloud have been fully QA tested. Other IdPs following OIDC or SAML standards should work as well. - -
- -
-Which protocols were tested and verified? (click to expand) - -OIDC and SAML protocols have been fully QA tested. - -
-
Is the manual creation flow still available? (click to expand) From da70443aed137fa0bc44e3c1cb3173c873b82b1c Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 11:58:05 +0200 Subject: [PATCH 06/12] fix broken link --- docs/sso-rbac/sso/self-serve-sso.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index 7f82efdd5d..92b1c3fa47 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -129,7 +129,7 @@ Not until the company is set as SCIM enabled. Contact [Port's support team](http
Does self-serve SSO support all protocols? (click to expand) -No. OIDC and SAML are supported. For LDAP, refer to the [LDAP documentation](/sso-rbac/sso/sso-providers/ldap/ldap) for manual setup. +No. OIDC and SAML are supported. For LDAP, refer to the [LDAP documentation](/sso-rbac/sso/sso-providers/ldap/) for manual setup.
From d82fdc3d54e6048817898f786cfdab8d03b58d86 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 12:15:28 +0200 Subject: [PATCH 07/12] Add explanation about Auth0 documentation --- docs/sso-rbac/sso/self-serve-sso.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index 92b1c3fa47..a1730bd978 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -44,6 +44,8 @@ After clicking the setup button, you will be guided to configure the SSO connect - [Custom SAML](/sso-rbac/sso/sso-providers/saml/) - [Custom OIDC](/sso-rbac/sso/sso-providers/oidc/) +The setup process is fully guided by Auth0's self-service assistant, which walks you through each step including creating an application in your IdP, configuring the connection, mapping claims, and testing the SSO integration. For a detailed example walkthrough of the assistant flow, see the [Auth0 Self-Service SSO documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO#example-self-service-assistant-flow). + Complete the configuration in your identity provider's admin console following the on-screen instructions. ### Step 3: Monitor the connection status From e49844086370bbee470049efa0df7b457c0dfc69 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 15:00:01 +0200 Subject: [PATCH 08/12] Fix points discussed with Naama --- docs/sso-rbac/sso/self-serve-sso.md | 42 ++++++----------------------- 1 file changed, 8 insertions(+), 34 deletions(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index a1730bd978..6300509ad3 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -1,10 +1,10 @@ --- -title: "Self-serve SSO setup" +title: "Manage your SSO connection" sidebar_position: 1 -description: Set up SSO for your organization directly from the portal +description: Set up and manage SSO for your organization directly from the portal --- -# Self-serve SSO +# Manage your SSO connection Port allows company admins to configure SSO (Single Sign-On) directly from the portal. This self-serve flow guides you through connecting your identity provider (IdP) to Port. @@ -25,7 +25,7 @@ Let's configure SSO for your company: 1. Go to the [Builder page](https://app.getport.io/settings/data-model) of your portal. 2. Click on **Organization settings** in the left sidebar. 3. Navigate to the **SSO** tab. -4. Click the **Setup SSO Connection** button. +4. Click the **Set up SSO connection** button. :::info URL validity A unique SSO setup link will be generated for you, it will be valid for 5 hours after you first open it, or 5 days if you don't open it. You can copy and save the link to complete the setup later. @@ -60,7 +60,7 @@ While configuring your IdP, the Port UI displays the current status of your SSO Once you have completed the configuration in your identity provider, click the **Setup is Done** button in Port to indicate that the process is finished. -### Step 4: Finalize your SSO settings +## Manage the connection After the SSO connection is successfully established, you can configure the following options: @@ -80,17 +80,13 @@ After the SSO connection is successfully established, you can configure the foll 4. **Edit connection** - Click `Edit Connection` to open the Auth0 management interface where you can modify your SSO configuration, including adding or managing domains associated with your SSO connection. -:::info Organization-level setting -The SSO configuration and access settings apply at the organization level, not the company level. -::: - ## Limitations - Terraform is not supported for self-serve SSO setup. ## Troubleshooting -If you click **Setup is Done** and encounter an error, use the following table to identify and resolve the issue: +If you click `Setup is Done` and encounter an error, use the following table to identify and resolve the issue: | Error | Cause | Resolution | | ----- | ----- | ---------- | @@ -115,30 +111,8 @@ You need to **delete** the existing connection and start the setup process from
-Can clients rotate (update) the SSO secret via API? (click to expand) - -No, you should rotate the SSO secret via the Auth0 UI. Port can provide the link to the Auth0 UI via API, but the actual rotation must be done in Auth0's interface. - -
- -
-Does the Okta setup include SCIM? Will it work? (click to expand) - -Not until the company is set as SCIM enabled. Contact [Port's support team](http://support.port.io/) to enable SCIM for your organization. - -
- -
-Does self-serve SSO support all protocols? (click to expand) - -No. OIDC and SAML are supported. For LDAP, refer to the [LDAP documentation](/sso-rbac/sso/sso-providers/ldap/) for manual setup. - -
- -
-Is the manual creation flow still available? (click to expand) +Is LDAP protocol supported? (click to expand) -Yes. You can still request manual SSO setup by contacting [Port's support team](http://support.port.io/). +No. For LDAP, refer to the [LDAP documentation](/sso-rbac/sso/sso-providers/ldap/) for manual setup. -
From caeaa2221dc4a3a51efdb0679dad55495a167430 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 15:06:52 +0200 Subject: [PATCH 09/12] change setup sentence --- docs/sso-rbac/sso/self-serve-sso.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index 6300509ad3..86601670f0 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -18,7 +18,7 @@ This self-serve flow guides you through connecting your identity provider (IdP) ## Setup -Let's configure SSO for your company: +Follow these steps to configure SSO for your company: ### Step 1: Initiate the SSO setup From 727cc97a7b7f2aafd39dd4b771d51f94465bb8f1 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 15:08:24 +0200 Subject: [PATCH 10/12] remove links from the custom SAML and OIDC --- docs/sso-rbac/sso/self-serve-sso.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/sso/self-serve-sso.md index 86601670f0..cc11474fdc 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/sso/self-serve-sso.md @@ -41,8 +41,8 @@ After clicking the setup button, you will be guided to configure the SSO connect - ADFS - Google Workspace - PingFederate -- [Custom SAML](/sso-rbac/sso/sso-providers/saml/) -- [Custom OIDC](/sso-rbac/sso/sso-providers/oidc/) +- Custom SAML +- Custom OIDC The setup process is fully guided by Auth0's self-service assistant, which walks you through each step including creating an application in your IdP, configuring the connection, mapping claims, and testing the SSO integration. For a detailed example walkthrough of the assistant flow, see the [Auth0 Self-Service SSO documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO#example-self-service-assistant-flow). From 7e9f23ed8b15b6f05850af03b1a72132110601f7 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 15:39:50 +0200 Subject: [PATCH 11/12] Change the SSO hierarchy and fix broken links from it --- .../plan/prepare-for-building.md | 2 +- docs/integrations-index.md | 9 +- docs/security.md | 2 +- .../sso-providers/ldap/ldap.md => _ldap.md} | 0 docs/sso-rbac/{sso => }/self-serve-sso.md | 9 +- docs/sso-rbac/sso/_category_.json | 5 - .../sso/sso-providers/_category_.json | 4 - .../_scim_functionality_list.mdx | 16 - .../sso/sso-providers/ldap/_category_.json | 5 - .../sso/sso-providers/oidc/_category_.json | 4 - .../oidc/_scim_oidc_limitation.mdx | 5 - .../sso/sso-providers/oidc/azure-ad.md | 292 ------------------ docs/sso-rbac/sso/sso-providers/oidc/oidc.md | 33 -- docs/sso-rbac/sso/sso-providers/oidc/okta.md | 143 --------- .../sso/sso-providers/oidc/onelogin.md | 186 ----------- .../sso/sso-providers/saml/_category_.json | 4 - .../sso/sso-providers/saml/azure-ad.md | 86 ------ .../sso-providers/saml/google-workspace.md | 171 ---------- .../sso/sso-providers/saml/jumpcloud.md | 171 ---------- docs/sso-rbac/sso/sso-providers/saml/okta.md | 114 ------- docs/sso-rbac/sso/sso-providers/saml/saml.md | 48 --- .../sso/sso-providers/sso-providers.md | 9 - .../users-and-teams/manage-users-teams.md | 2 +- docs/troubleshooting.md | 2 +- 24 files changed, 7 insertions(+), 1315 deletions(-) rename docs/sso-rbac/{sso/sso-providers/ldap/ldap.md => _ldap.md} (100%) rename docs/sso-rbac/{sso => }/self-serve-sso.md (96%) delete mode 100644 docs/sso-rbac/sso/_category_.json delete mode 100644 docs/sso-rbac/sso/sso-providers/_category_.json delete mode 100644 docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx delete mode 100644 docs/sso-rbac/sso/sso-providers/ldap/_category_.json delete mode 100644 docs/sso-rbac/sso/sso-providers/oidc/_category_.json delete mode 100644 docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx delete mode 100644 docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md delete mode 100644 docs/sso-rbac/sso/sso-providers/oidc/oidc.md delete mode 100644 docs/sso-rbac/sso/sso-providers/oidc/okta.md delete mode 100644 docs/sso-rbac/sso/sso-providers/oidc/onelogin.md delete mode 100644 docs/sso-rbac/sso/sso-providers/saml/_category_.json delete mode 100644 docs/sso-rbac/sso/sso-providers/saml/azure-ad.md delete mode 100644 docs/sso-rbac/sso/sso-providers/saml/google-workspace.md delete mode 100644 docs/sso-rbac/sso/sso-providers/saml/jumpcloud.md delete mode 100644 docs/sso-rbac/sso/sso-providers/saml/okta.md delete mode 100644 docs/sso-rbac/sso/sso-providers/saml/saml.md delete mode 100644 docs/sso-rbac/sso/sso-providers/sso-providers.md diff --git a/docs/guides/_implementation-guide/plan/prepare-for-building.md b/docs/guides/_implementation-guide/plan/prepare-for-building.md index 6aa347bc93..644467f520 100644 --- a/docs/guides/_implementation-guide/plan/prepare-for-building.md +++ b/docs/guides/_implementation-guide/plan/prepare-for-building.md @@ -32,7 +32,7 @@ Read more about roles and permissions [here](https://docs.port.io/sso-rbac/users ## Configure SSO -Select the relevant [SSO provider](/sso-rbac/sso/sso-providers/) and follow the instructions to set it up. +Select the relevant [SSO provider](/sso-rbac/self-serve-sso) and follow the instructions to set it up. :::info Enterprise feature Note that SSO support is an enterprise feature. If you are using the free tier, you can skip this step. diff --git a/docs/integrations-index.md b/docs/integrations-index.md index 31e51daeea..338933defd 100644 --- a/docs/integrations-index.md +++ b/docs/integrations-index.md @@ -53,7 +53,7 @@ This page contains a list of Port's available integrations, organized by the pla ### Azure - [Azure exporter](/build-your-software-catalog/sync-data-to-catalog/cloud-providers/azure/azure.md) -- [Azure Active Directory (AD) SSO](/sso-rbac/sso/sso-providers/oidc/azure-ad.md) +- [Azure Active Directory (AD) SSO](/sso-rbac/self-serve-sso) - [Map resource groups, storage groups, compute resources database resources and more](/build-your-software-catalog/sync-data-to-catalog/cloud-providers/azure/resource_templates/resource_templates.md) - [Add tags to Azure resources](/guides/all/tag-azure-resource) @@ -320,12 +320,7 @@ This page contains a list of Port's available integrations, organized by the pla ## SSO -- [Okta SSO](/sso-rbac/sso/sso-providers/oidc/okta.md) -- [OneLogin SSO](/sso-rbac/sso/sso-providers/oidc/onelogin.md) -- [JumpCloud SSO](/sso-rbac/sso/sso-providers/saml/jumpcloud.md) -- [Google workspace SSO](/sso-rbac/sso/sso-providers/saml/google-workspace.md) -- [Azure Active Directory (AD) SSO OIDC](/sso-rbac/sso/sso-providers/oidc/azure-ad.md) -- [Azure Active Directory (AD) SSO SAML](/sso-rbac/sso/sso-providers/saml/azure-ad.md) +- [Manage your SSO connection](/sso-rbac/self-serve-sso) ## StackHawk diff --git a/docs/security.md b/docs/security.md index 0a47fd3821..e21a9c000b 100644 --- a/docs/security.md +++ b/docs/security.md @@ -201,7 +201,7 @@ In addition to password login and social login, multi-factor authentication (MFA ### Single sign-on (SSO) -Port integrates with all major [SSO providers](/sso-rbac/sso/sso-providers/), allowing you to seamlessly import users and teams, and also exposing Port to your organization in a managed manner. +Port integrates with all major [SSO providers](/sso-rbac/self-serve-sso), allowing you to seamlessly import users and teams, and also exposing Port to your organization in a managed manner. Port supports SSO using the OIDC protocol and the SAML 2.0 protocol, and as such supports all modern Identity Providers. diff --git a/docs/sso-rbac/sso/sso-providers/ldap/ldap.md b/docs/sso-rbac/_ldap.md similarity index 100% rename from docs/sso-rbac/sso/sso-providers/ldap/ldap.md rename to docs/sso-rbac/_ldap.md diff --git a/docs/sso-rbac/sso/self-serve-sso.md b/docs/sso-rbac/self-serve-sso.md similarity index 96% rename from docs/sso-rbac/sso/self-serve-sso.md rename to docs/sso-rbac/self-serve-sso.md index cc11474fdc..046f448f57 100644 --- a/docs/sso-rbac/sso/self-serve-sso.md +++ b/docs/sso-rbac/self-serve-sso.md @@ -1,6 +1,6 @@ --- title: "Manage your SSO connection" -sidebar_position: 1 +sidebar_position: 4 description: Set up and manage SSO for your organization directly from the portal --- @@ -109,10 +109,3 @@ No. Port supports only one SSO provider per company at a time. You need to **delete** the existing connection and start the setup process from the beginning. There is no migration path between SSO providers. - -
-Is LDAP protocol supported? (click to expand) - -No. For LDAP, refer to the [LDAP documentation](/sso-rbac/sso/sso-providers/ldap/) for manual setup. - -
diff --git a/docs/sso-rbac/sso/_category_.json b/docs/sso-rbac/sso/_category_.json deleted file mode 100644 index 782e69cd01..0000000000 --- a/docs/sso-rbac/sso/_category_.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "label": "SSO", - "position": 4 - } - \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/_category_.json b/docs/sso-rbac/sso/sso-providers/_category_.json deleted file mode 100644 index 087bef10ec..0000000000 --- a/docs/sso-rbac/sso/sso-providers/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SSO providers", - "position": 2 -} diff --git a/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx b/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx deleted file mode 100644 index 3173b90111..0000000000 --- a/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx +++ /dev/null @@ -1,16 +0,0 @@ -

Functionality enabled by SCIM

- -By enabling SCIM the following functionality will be enabled: - -- Automatic deprovisioning of users (for example, when a user is unassigned from the SSO application, that user will automatically lose access to Port). - -

Limitations

- -- **Does not support user provisioning** - Only deprovisioning is supported; users must be created manually or through SSO login. -- **Does not sync user attribute updates** - Changes to user profiles in your identity provider will not automatically update in Port. -- **Does not support group provisioning** - Group membership changes in your identity provider are not synchronized via SCIM. -- **Does not provide real-time sync** - SCIM operations may have delays and are not instantaneous. -- **Does not support custom user attributes** - Only standard user fields are processed during deprovisioning. -- **Only supported for customers with a single workspace** - SCIM is not available for multi-workspace setups. - -For full user and group synchronization, rely on the SSO login process rather than SCIM. diff --git a/docs/sso-rbac/sso/sso-providers/ldap/_category_.json b/docs/sso-rbac/sso/sso-providers/ldap/_category_.json deleted file mode 100644 index d9bacd0ffb..0000000000 --- a/docs/sso-rbac/sso/sso-providers/ldap/_category_.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "label": "LDAP", - "position": 3 -} - \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/oidc/_category_.json b/docs/sso-rbac/sso/sso-providers/oidc/_category_.json deleted file mode 100644 index 71cc0d062a..0000000000 --- a/docs/sso-rbac/sso/sso-providers/oidc/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "OIDC", - "position": 2 -} diff --git a/docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx b/docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx deleted file mode 100644 index e3aaf5a575..0000000000 --- a/docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx +++ /dev/null @@ -1,5 +0,0 @@ -:::info multiple SSO applications for SCIM with OIDC -Due to technical limitations, OIDC integrations do not directly support SCIM. You will be required to set up another application, which will be handle provisioning based on the SCIM protocol. - -With SCIM in place, in order to grant the user access to Port, you will need to assign the user both the primary SSO application and to the SCIM application. -::: \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md b/docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md deleted file mode 100644 index 9f5bacff82..0000000000 --- a/docs/sso-rbac/sso/sso-providers/oidc/azure-ad.md +++ /dev/null @@ -1,292 +0,0 @@ ---- -title: "Microsoft Entra ID (AzureAD)" -sidebar_position: 1 -description: Integrate AzureAD with Port using OIDC ---- - -import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/\_scim_functionality_list.mdx" -import ScimLimitation from "/docs/sso-rbac/sso/sso-providers/oidc/\_scim_oidc_limitation.mdx" -import SSOEndpoints from "/docs/generalTemplates/_sso_auth0_endpoints.md" - -# Entra ID (AzureAD) - -This guide demonstrates how to configure Single Sign-On (SSO) integration between Port and Microsoft Entra ID (AzureAD) using OIDC. - -Once implemented: -- Users can connect to Port via an AzureAD app. -- AzureAD teams will be automatically synced with Port upon user sign-in. -- You can set granular permissions in Port according to your AzureAD groups. - -## Prerequisites - -Before starting the configuration, ensure you have: - -- Access to the Microsoft Azure Portal with permissions to create and configure applications. -- Users who need access to Port must have a valid value in their `Email` field in Azure AD. -- Contact information ready to share with Port support team for the final configuration steps. - -:::info Contact us -To complete the process you will need to contact us to receive the information you require, as well as provide Port with specific application details outlined in this guide. -::: - -## Register a new application - -

Create the application registration

- -1. In the Microsoft Azure Portal, go to `Azure Active Directory`. -2. Click on `App registrations`. - - - -3. Click on `New registration` at the top of the page. - - - -4. Define the Port application settings: - - 4.1 **Name**: Insert a friendly name for the Port app, like `Port`. - - 4.2 **Supported account types**: Please select the option that is appropriate for your organization. - - For most use cases this would be **Accounts in this organizational directory only (Default Directory only - Single tenant)**. - - 4.3 **Redirect URI**: - - Set `Platform` to `Web` - - Set `URL` to `https://auth.getport.io/login/callback` - - - - - 4.4 Click `Register`. - -

Configure authentication settings

- -1. On the new Port App page, click `Authentication`. - - - -2. Add the **Front-channel logout URL**: paste the following URL: - - ```text showLineNumbers - https://auth.getport.io/logout - ``` - - Adding the front-channel logout URL will enable single sign-out, meaning when a user logs out from Port, it also logs them out from their identity provider. - - - -3. Click `Save`. - -## Configure application branding - -1. On the new Port App page, click `Branding & Properties`. - - - -2. Configure the following settings: - - 2.1 **Home page URL**: paste the following URL: - - - - We will provide your `{CONNECTION_NAME}` (Contact us using chat/Slack/mail to [support.port.io](http://support.port.io/)). - - 2.2 **Publisher domain**: Select the domain matching your user emails (for example `getport.io`). - - - -3. Click `Save`. - -## Set up application permissions - -

Add required permissions

- -1. On the Port App page, click `API Permissions`. - - - -2. Click `Add a permission`. - - - -3. On the `Microsoft APIs` tab: - - 3.1 Click on `Microsoft Graph`. - - - - 3.2 Click on `Delegate Permissions`. - - - - 3.3 Search and mark the following permissions: - - `email`, `openid`, `profile`, `User.read` - -
- - :::info AzureAD groups integration - If you wish to pull in AzureAD groups into Port, you will also need to add the `Directory.Read.All` permission. - See [Permissions required to pull AzureAD groups to Port](#enable-azuread-groups-integration) for more details. - ::: - -
- - - - 3.4 Click `Add permissions`. - - :::info Grant admin consent - (OPTIONAL) `Grant admin consent`: when users from your organization will first log in, they will be prompted to confirm the permissions specified here. You can click the `Grant admin consent for Default Directory` to automatically approve their permissions. - ::: - - - -## Configure application claims - -

Add optional claims

- -1. On the Port App page, click `Token configuration`. - - - -2. Click `Add optional claim`. - - - -3. Select `ID` as the token type and then select the `email` claim, then click `Add`. - - - - Repeat the same process for `Access` and `SAML` (3 times total). - -4. Your optional claims will look like this: - - - -## Generate application secret - -

Create client secret

- -1. On the Port App page, click `Certificates & Secrets`. - - - -2. On the `Client secrets` tab, click the `New client secret` button. - - - -3. Configure the secret: - - 3.1 **Description**: Enter a secret description, for example `Port Login Client Secret`. - - 3.2 **Expires**: Select when the secret expires. - - Be sure to mark on your calendar the expiration date of the secret. The secret needs to be replaced before its expiration, otherwise login to Port will be disabled. - - 3.3 Click `Add`. - -4. **Copy the secret immediately**: A secret will be created and its Value will appear as shown in the image below. Document the secret's value immediately because it will never appear again after you leave this page. - - - -## Provide application information to Port - -Port needs the following information to complete the integration: - -- The `Client Secret` value that you created in the previous step. -- The `Application (Client) ID`, which appears on the Port application overview page: - - - -Port will provide you the `CONNECTION_NAME` needed for the homepage URL of the App. - -## Distribute the application to users - -

Assign users and groups

- -After the app setup is complete, you can assign it to your organization's users and groups: - -1. Go to `Azure Active Directory`. - -2. Go to `Enterprise Applications`. - - - -3. Click on the Port app. - - - -4. Click on `Users and Groups`. - - - -5. Click `Add user/group`. - - - -6. Select users and groups you want to grant access to Port, then click `Assign`. - -

Make the application visible

- -1. Go to `Azure Active Directory` > `Enterprise Applications` > Port app. - -2. Click on `Properties`. - - - -3. Set the application properties: - - Mark `Enabled for users to sign-in?` as `Yes`. - - Mark `Visible to users?` as `Yes`. - -
- :::info Assignment required? - By default the `Assignment required?` flag is set to `No`, meaning any user with the Homepage URL to the Port app can access it, even if the app isn't directly assigned to them. Changing the flag to `Yes` means only users and groups the app is directly assigned to can use and access it. - ::: - -
- - - -4. You should see the Port app on the [https://myapplications.microsoft.com](https://myapplications.microsoft.com) dashboard: - - - -Users can also manually access Port by going to the App Homepage URL. - -## Multiple Azure AD SSO connections - -If you have multiple Port environments, it is possible to setup an OIDC Azure AD SSO connection for each environment. - -However, note that in this instance you **will not** be able to use Port's main login page to reliably sign in to a specific environment. When you enter your email address to login, it will take you to one of your Port environments but it is not guaranteed to take you to the same Port environment every time. - -In that case you have the following options: - -- Use the [https://myapplications.microsoft.com](https://myapplications.microsoft.com) dashboard provided by Azure AD and select the desired Port environment to connect to. -- Use the manual login URL for each environment directly, by specifying the desired environment based on its respective `CONNECTION_NAME` value. - -## Enable AzureAD groups integration - -Port can query the group membership of users who log in through the AzureAD SSO, and add their teams as team entities inside Port. This allows platform engineers to take advantage of both existing groups from AzureAD and teams created manually inside Port to manage permissions and access to resources inside Port's catalog. - -In order to import Azure AD groups into Port, Port will require the connection app to approve the `Directory.Read.All` permission. - - diff --git a/docs/sso-rbac/sso/sso-providers/oidc/oidc.md b/docs/sso-rbac/sso/sso-providers/oidc/oidc.md deleted file mode 100644 index 974b0532ad..0000000000 --- a/docs/sso-rbac/sso/sso-providers/oidc/oidc.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: "OIDC" -sidebar_position: 1 -description: Integrate any SSO with Port using OIDC application ---- - -import SSOEndpoints from "/docs/generalTemplates/_sso_auth0_endpoints.md" -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" -import DocCardList from '@theme/DocCardList'; - -This documentation describes the process of integrating an OIDC application with Port, along with some examples for specific identity providers. -In order to integrate Port with an OIDC SSO application, you will need to do the following: - -1. Create a new OIDC application in your identity provider and provide an app integration name, like `Port`. -2. Configure the application with the following details: - - Redirect URI: `https://auth.getport.io/login/callback` - - Login URI: - - :::note - We will provide your `{CONNECTION_NAME}` (Contact us using chat/Slack/mail to [support.port.io](http://support.port.io/)). - ::: -3. Expose the application to your organization by either granting access to everyone or restricting it to specific roles. -4. Share information about your SSO application: - - Provide Port with the following details: - - `Client ID`: The client identifier for your OIDC application. - - `Client Secret`: The client secret for your OIDC application. -5. Add a custom property `email_verified` and configure the OpenID Claims in your identity provider to ensure that Port receives the value `true` for this attribute as part of the connection process. This step may be required specifically for certain identity providers such as [OneLogin](/sso-rbac/sso/sso-providers/oidc/onelogin.md#step-4-add-email_verified-custom-property-to-all-users). -6. Configure the Groups claim in the OpenID Connect Token settings to enable automatic groups or roles support in Port.



- :::note - This step is OPTIONAL and is required only if you wish to pull all of your groups or roles into Port inherently. - ::: -

- diff --git a/docs/sso-rbac/sso/sso-providers/oidc/okta.md b/docs/sso-rbac/sso/sso-providers/oidc/okta.md deleted file mode 100644 index eaa88f2443..0000000000 --- a/docs/sso-rbac/sso/sso-providers/oidc/okta.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: "Okta (OIDC)" -sidebar_position: 2 -description: Integrate Okta with Port ---- - -import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx" -import ScimLimitation from "/docs/sso-rbac/sso/sso-providers/oidc/_scim_oidc_limitation.mdx" -import SSOEndpoints from "/docs/generalTemplates/_sso_auth0_endpoints.md" -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" - -# Okta - -Follow this step-by-step guide to configure the integration between Port and Okta. - -:::info Contact us -In order to complete the process you will need to contact us, the exact information we need to provide, as well as the information Port requires from you is listed in this doc. -Contact us using chat/Slack/mail to [support.port.io](http://support.port.io/). -::: - -## Port-Okta integration benefits - -- Connect to the Port application via an Okta app. -- Your Okta teams will be synced with Port, automatically upon user sign-in. -- Set granular permissions on Port according to your Okta groups. - -## How to configure the Okta app integration for Port​ - -### Step #1: Create a new Okta application - -1. In the Admin Console, go to Applications -> Applications. -2. Click `Create App Integration`. - - - -3. Create an OIDC app integration. Select **OIDC - OpenID Connect** in the Wizard. - - - -4. Choose **Single-Page application** as your application type. - - - -Click `Next`. - -### Step #2: Configure your Okta application - -Under `General Settings`: - -1. Choose an `app integration name` (a specific name that will appear on your Okta apps). - -2. Under `Grant type` mark all options. - -3. Under `Sign-in redirect URIs`, choose the value that matches your Port region: - - - EU organizations: `https://auth.getport.io/login/callback` - - US organizations: `https://auth.us.getport.io/login/callback` - - :::caution Redirect URI must match your region - Using the EU callback for a US-hosted org (or vice versa) causes a 400 error during the Okta sign-in flow. Double-check the value before saving. - ::: - - - The Sign-in redirect URI is where Okta sends the authentication response and ID token for the sign-in request. - -4. Remove the sign-out redirect URIs. - -5. Under `Assignments`: Set `Allow everyone in your organization to access`. - - - - -### Step #3: Configure OIDC settings - -Get your `Okta Domain` by clicking on your user mail at the top-right corner of the Okta management interface, hovering on the okta domain (will be in the format `{YOUR_COMPANY_NAME}.okta.com`) and clicking on `Copy to clipboard`: - - - -Under `General` tab: - -1. Copy the `Client ID` and send it to Port along with the `Okta Domain` from the previous step (using chat/Slack/mail to [support.port.io](http://support.port.io/)). - - - -2. Click on the `Edit` button on the `General Settings` tab. - - 2.1 Set the `Login initiated by` option to `Either Okta or App`: - - - - 2.2 Check all the options in `Application visibility`: - - - - 2.3 Check `Login flow` to be `Redirect to app to initiate login (OIDC Compliant)` - - 2.4 Under `initiate login URI` paste the following URI: - - - - - - - - 2.5 Click `Save` and you’re done! now you’ll have the Port app on your Okta dashboard. - - - - - - - -## How to allow pulling Okta groups to Port - -:::info Optional step -This stage is **OPTIONAL** and is required only if you wish to pull all of your Okta groups into Port inherently. - -**Benefit:** managing permissions and user access on Port. -**Outcome:** for every user that logs in, we will automatically get their associated Okta groups, according to your definition in the settings below. -::: - -To allow automatic Okta group support in Port, please follow these steps: - -1. Under the `Application` page, select Port App and go to the `Sign On` tab: - - - -2. Under `OpenID Connect Token` click `Edit`: - - - -3. Add a `Groups claim type` and choose the option `filter`, then: - - 3.1 Value = `groups` - - 3.2 Select the required regex phrase to your needs. - - :::info Importing all groups - To import all groups, insert `Matches regex` with the `.*` value. - ::: - - - - 3.3 Click `Save`. \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/oidc/onelogin.md b/docs/sso-rbac/sso/sso-providers/oidc/onelogin.md deleted file mode 100644 index 6313975f80..0000000000 --- a/docs/sso-rbac/sso/sso-providers/oidc/onelogin.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: "Onelogin" -sidebar_position: 3 -description: Integrate Onelogin with Port ---- - -import SSOEndpoints from "/docs/generalTemplates/_sso_auth0_endpoints.md" -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" - -# Onelogin - -Follow this step-by-step guide to configure the integration between Port and Onelogin. - -:::info -In order to complete the process you will need to contact Port to deliver and receive information, as detailed in the guide below. -::: - -## Port-Onelogin integration benefits - -- Connect to the Port application via a Onelogin app; -- Your Onelogin roles will be automatically synced with Port, upon user sign-in; -- Set granular permissions on Port according to your Onelogin roles. - -## How to configure the Onelogin app integration for Port​ - -### Step #1: Create a new Onelogin application - -1. In the Admin Console, go to Applications -> Applications. -2. Click `Add App`. - -![Onelogin new application wizard](/img/sso/onelogin/OneloginCreateApp.png) - -3. In the search box type **OpenID Connect**, then select `OpenId Connect (OIDC)`: - -![Onelogin new application OIDC](/img/sso/onelogin/OneloginSelectOidcFromSearch.png) - -4. Define the initial Port application settings: - - 1. `Display Name`: Insert a name of your choice for the Port app, like `Port`. - 2. Add rectangular and square icons (optional): - - ![Port's logo](/img/sso/general-assets/PortLogo.png) - - ![Port's icon](/img/sso/general-assets/PortIcon.png) - -![Onelogin initial new application](/img/sso/onelogin/OneloginInitialApp.png) - -Click `Save`. - -:::tip -Most of the following steps involve editing the initial Port app you created. Keep in mind you can always go back to it by opening the admin console and going to Applications -> Applications, the Port app will appear in the application list. -::: - -### Step #2: Configure your Onelogin application - -In the Port app, go to the `Configuration` menu and follow these steps: - -1. Under `Login URL` paste the following login URL: - - - -:::note -We will provide your `{CONNECTION_NAME}` (Contact us using chat/Slack/mail to [support.port.io](http://support.port.io/)). -::: - -2. Under `Redirect URI's` set: `https://auth.getport.io/login/callback`. - - - The Redirect URI is where Onelogin sends the authentication response and ID token for the sign-in request. - -Click `Save`. - -:::warning -Be sure to click save before moving on to the next step because without the `Redirect URI's` filled in, trying to save any other application parameter will result in an error. -::: - -### Step #3: Configure OIDC settings - -In the Port app, go to the `SSO` menu and follow these steps: - -1. Copy the `Client ID` and the `Client Secret` and send it to Port (on the slack channel). - -2. Click on the `Well-known Configuration` Link, and send the page address to Port (its format will be `https://{YOUR_DOMAIN}.onelogin.com/oidc/2/.well-known/openid-configuration`) - -3. Change the Token Endpoint - Authentication Method to `None (PKCE)`: - -![Okta app settings](/img/sso/onelogin/OneloginSSOSetting.png) - -Click `Save`. - -### Step #4: Add `email_verified` custom property to all users - -The use of OpenID requires that Onelogin passes to Port an `email_verified` field upon user login. Onelogin does not store and expose that field by default, so in this step, you are going to configure that field and apply it to all users in your Onelogin account. The steps outlined here can also be found in the [Onelogin documentation](https://developers.onelogin.com/openid-connect/guides/email-verified). - -1. In the Admin Console, go to Users -> Custom User Fields. -2. Click on `New User Field`. -3. Enter the following details: - 1. `Name`: Email Verified - 2. `Shortname`: email_verified - -![Onelogin email verified user field](/img/sso/onelogin/OneloginEmailVerifiedUserField.png) - -The custom field is `null` by default, in order to change its value to `true` you will create a custom mapping rule: - -:::note -It is also possible to manually change the value of the `Email Verified` field to `true` for each user that requires access to Port in your organization. However, granting access manually to a large number of users is not scalable. -::: - -:::tip -The mapping specified here will set the value of the `Email Verified` custom field to `true` for every user whose `Status` is `Active` in your Onelogin organization. Feel free to use a different mapping if you seek a specific mapping. -::: - -1. Go to Users -> Mappings -2. Click on `New Mapping` -3. Enter mapping details: - 1. `Name`: Insert a friendly name for the mapping, like `Set Email Verified`; - 2. `Conditions`: Set the condition: - Status - is - Active; - 3. `Actions`: Set the action: Set Email Verified - true. -4. Click `Save`. - -![Onelogin Email Verified Mapping Rule](/img/sso/onelogin/OneloginEmailVerifiedMappingRule.png) - -After creating the mapping rule, go back to Users -> Mappings and click on `Reapply All Mappings`. The new mapping might process for a few minutes before it is applied. You can check the mapping job status either by going to Activity -> Jobs or by looking at a specific user and verifying that it has the `Email Verified` field set to `true` (and not the default empty field). - -### Step #5: Configure OpenID Claims - -In the Port app, go to the `Parameters` menu and follow these steps: - -1. Click on the `+` button; -2. In the form that appears, under `Field Name` write: `openid` and click `save`; -3. In the value drop down that appears, select `OpenID name`. - -Repeat the process two more times and add the following additional parameters: - -1. `Field Name`: email, `Value`: Email -2. `Field Name`: email_verified, `Value`: Email Verified (Custom) - -At the end of the process, your `Parameters` section will look like this: - -![Onelogin App Parameters Setting](/img/sso/onelogin/OneloginParametersSetting.png) - -Click `Save`. - -### Step #6: Exposing the application to your organization - -1. In the `Application` page, select the Port app and go to the `Access` menu. -2. In the `Roles` section, select the roles you want to expose the Port app to: - - ![Onelogin Assign App Roles](/img/sso/onelogin/OneloginAssignAppRoles.png) - -3. Click `Save`. - -After completing these steps, users with roles that the Port app was assigned to, will see the Port app in their Portal and upon clicking it, will be logged in to Port: - -[Onelogin Portal With Port App](/img/sso/onelogin/OneloginPortalWithApp.png) - - - ---- - -## How to allow pulling Onelogin roles to Port - -:::note -This stage is **OPTIONAL** and is required only if you wish to pull all of your Onelogin roles into Port inherently. - -**Benefit:** managing permissions and user access on Port. -**Outcome:** for every user that logs in, we will automatically get their associated Onelogin roles, according to your definition in the settings below. -::: - -To allow automatic Onelogin roles support in Port, please follow these steps: - -1. In the `Application` page, select the Port app and go to the `Parameters` menu; - -2. Click on the `Groups` claim: - - ![Onelogin App Parameters Setting](/img/sso/onelogin/OneloginParametersSetting.png) - -3. Update the groups claim: - - 1. Change the value of `Default if no value selected` to `User Roles`; - 2. From the dropdown, select `Semicolon delimited input`: - - ![Onelogin App Groups Claim Setting](/img/sso/onelogin/OneloginGroupsClaim.png) - - 3. Click `Save`. - -4. Click `Save`. diff --git a/docs/sso-rbac/sso/sso-providers/saml/_category_.json b/docs/sso-rbac/sso/sso-providers/saml/_category_.json deleted file mode 100644 index f047448e56..0000000000 --- a/docs/sso-rbac/sso/sso-providers/saml/_category_.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "label": "SAML", - "position": 1 -} diff --git a/docs/sso-rbac/sso/sso-providers/saml/azure-ad.md b/docs/sso-rbac/sso/sso-providers/saml/azure-ad.md deleted file mode 100644 index 02c9faa504..0000000000 --- a/docs/sso-rbac/sso/sso-providers/saml/azure-ad.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: "Microsoft Entra ID (AzureAD)" -sidebar_position: 1 -description: Integrate Entra ID (AzureAD) with Port using SAML ---- - -import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx" -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" - -# Entra ID (AzureAD) - -Follow this step-by-step guide to configure the integration between Port and Azure AD using a SAML application - -:::info -In order to complete the process you will need to contact us to receive the information you require, as well as the information Port requires from you. All is elaborated below in the following section. - -::: - -## Port-AzureAd integration benefits - -- Connect to the Port application via an AzureAD app. -- Your AzureAD teams will be automatically synced with Port upon a user sign-in. -- Set granular permissions on Port according to your AzureAD groups. - -## Register a new application and generate the required credentials - -1. Head to your Azure portal and enter the Entra ID portal. -2. Click on `Enterprise Applications` and create a new application. -3. Click on `Create your own application` and select `Integrate any other application you don't find in the gallery (Non-gallery)`. -4. In the getting started section, select the `Set up Single Sign On` button, and choose the SAML method. -5. Edit the Basic SAML Configuration (step 1) and add the following information (Reach out to Port to receive your `{CONNECTION_NAME}` value): - ![AD first step](/img/sso/azure-saml/azure-saml-first-step.png) - * Identifier (Entity ID): `urn:auth0:port-prod:{CONNECTION_NAME}` - * Reply URL (Assertion Consumer Service URL): `https://auth.getport.io/login/callback?connection={CONNECTION_NAME}` - * Logout URL (This is optional): `https://auth.getport.io/logout` - -:::info -The details listed are for organizations hosted in EU. - -For US, you will need to use `https://auth.us.getport.io/login/callback?connection={CONNECTION_NAME}` and `https://auth.us.getport.io/logout`. -::: -6. In the `Single sign-on` tab, head to the 2nd section (Attributes & Claims), Click on `Edit` and add a new claim: - - `Name`: `email_verified` - - `Source attribute`: `user.accountenabled` -7. Under `SAML certificates` (step 3), Click the Edit button to expand the certificates section. Click the 3 dot icon next to the Active certificate, and choose `PEM certificate download`. - -Send the **PEM certificate file** along with the **Login URL** (Which can be found in the Single Sign-on section, Card 4 (Set up)) to Port. - - ![AD first third](/img/sso/azure-saml/azure-saml-third-step.png) - -After that, Port will provide you with a metadata XML file for your connection. - -At the top of the SAML configuration page, click on the `upload metadata file` button and upload the file provided to you by Port to complete the connection configuration. - - - -## Expose groups - -In order to expose your Azure groups to Port via the application, do the following: -1. Head to the `Single sign on` section in the application configuration, and edit the `Attributes & Claims`. -2. Press the `Add a group claim` button -3. Select `Groups assigned to the application` and in the source attribute select `Cloud-only group display names`. -4. Assign the relevant groups you want to expose to the application, these will be ingested into Port as teams you can use to manage user permissions and RBAC in your Port account. - -Alternatively, if you are syncing your groups from an on-prem AD into Entra, configure the group claim like so (sAMAccountName as source attribute, and box checked): - - - - diff --git a/docs/sso-rbac/sso/sso-providers/saml/google-workspace.md b/docs/sso-rbac/sso/sso-providers/saml/google-workspace.md deleted file mode 100644 index 7df0f19ceb..0000000000 --- a/docs/sso-rbac/sso/sso-providers/saml/google-workspace.md +++ /dev/null @@ -1,171 +0,0 @@ ---- -title: "Google Workspace" -sidebar_position: 4 -description: Integrate Google Workspace with Port using SAML ---- - -import Image from "@theme/IdealImage"; -import webAndMobile from "/static/img/sso/google-workspace/webAndMobile.png" -import addSamlApp from "/static/img/sso/google-workspace/addSamlApp.png" -import appNameAndIcon from "/static/img/sso/google-workspace/appNameAndIcon.png" -import urlAndCert from "/static/img/sso/google-workspace/urlAndCert.png" -import ACSandEntity from "/static/img/sso/google-workspace/ACSandEntity.png" -import SSOandCert from "/static/img/sso/google-workspace/SSOandCert.png" -import attributeMapping from "/static/img/sso/google-workspace/attributeMapping.png" -import userAccessInApp from "/static/img/sso/google-workspace/userAccessInApp.png" -import turnAccessOn from "/static/img/sso/google-workspace/turnAccessOn.png" -import loginUsingApp from "/static/img/sso/google-workspace/loginUsingApp.png" -import acsURLandEntityID from "/static/img/sso/google-workspace/acsURLandEntityID.png" -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" - -# Google Workspace - -Follow this step-by-step guide to configure the integration between Port and Google Workspace. - -:::info -In order to complete the process you will need to contact us to receive the information you require, as well as the information Port requires from you. All is elaborated below. - -::: - -## Port-Google Workspace integration benefits - -- Connect to the Port application via your Google Workspace Application. -- Your Google Workspace teams will be automatically synced with Port upon a user sign-in. -- Set granular permissions on Port according to your Google Workspace groups. - -## Create your Google Workspace application - -1. In the [Google Admin Console](https://admin.google.com/), in the sidebar menu, navigate to **Apps** -> **Web and mobile apps**: - -
- - - -
- -
- -2. Click on `Add app` followed by `Add custom SAML app`: - -
- - - -
- -
- -3. Define the initial Port application settings: - - 1. `App name`: Insert a name of your choice for the Port app, like `Port`. - 2. Add an `App icon` (optional): - -
- Port Logo - - ![Port's logo](/img/sso/general-assets/PortIcon.png) - -
- - 3. Press `Continue` - -
- - - -
- -
- -4. Take note of the following: - 1. Your `SSO URL`; - 2. Your `Certificate`. - -
- - - -
- -
- -Pass these to Port.
- -Press `Continue`. - -5. Configure your new application as shown below: - -- `ACS URL` - `https://auth.getport.io/login/callback?connection={CONNECTION_NAME}` -- `Entity ID` - `urn:auth0:port-prod:{CONNECTION_NAME}` - -:::note -We will provide your `{CONNECTION_NAME}` (Contact us using chat/Slack/mail to [support.port.io](http://support.port.io/)). -::: - -Press `Continue` - -
- - - -
- -
- -6. Create the following mappings (email_verified needs to be a constant for all users, with the value `true` ): - -_Google Directory attributes_: - -- **`Primary email`** -> `email` -- **`First name`** -> `name` -- **`email_verified`** -> `email_verified` - -_Google membership_ (optional): This mapping is only relevant if you wish to pass groups to Port. - -- **`Google Groups`**(list) -> `groups` - -Press `Finish` - -
- - - -
- -
- -7. Specify permissions to the application: - -After creating the app, you need to set up permissions for who has access to this application. - -Navigate to your your new application's page, and click **User access**: - -
- - - -
- -
- -Then choose from the left side menu, either to enable the app for `Everyone`, for `Groups` or for `Organizational units`. - -Make sure that for any of the options you would like to enable the app for, you check the `ON` checkbox: - -
- - - -
- -
- -7. Log in with using your new Google app: - -
- - - -
- - diff --git a/docs/sso-rbac/sso/sso-providers/saml/jumpcloud.md b/docs/sso-rbac/sso/sso-providers/saml/jumpcloud.md deleted file mode 100644 index 52d8ae810a..0000000000 --- a/docs/sso-rbac/sso/sso-providers/saml/jumpcloud.md +++ /dev/null @@ -1,171 +0,0 @@ ---- -title: "JumpCloud" -sidebar_position: 3 -description: Integrate JumpCloud with Port using SAML ---- - -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" - -# JumpCloud - -Follow this step-by-step guide to configure the integration between Port and JumpCloud. - -:::info -In order to complete the process you will need to contact Port to deliver and receive information, as detailed in the guide below. -::: - -## Port-JumpCloud integration benefits ​ - -- Connect to the Port application via a JumpCloud app; -- Your JumpCloud teams will be automatically synced with Port, upon user sign-in; -- Set granular permissions on Port according to your JumpCloud user groups. - -## How to configure the JumpCloud app integration for Port​ - -### Step #1: Create a new JumpCloud application - -1. In the Admin Portal, go to User Authentication -> SSO. -2. Click `Add New Application`. - -![JumpCloud new application wizard](/img/sso/jumpcloud/JumpcloudAddApplication.png) - -3. In the search box type **Auth0**: - -![JumpCloud new application](/img/sso/jumpcloud/JumpcloudAuth0Search.png) - -4. Define the initial Port application settings: - - 1. `Display Label`: Insert a name of your choice for the Port app, like `Port`. - 2. Add an icon (optional): - -
- Port Logo - - ![Port's logo](/img/sso/general-assets/PortLogoLarge.png) - -
- - 3. **(Optional)** In the SSO tab, change the default IDP URL suffix. - ![JumpCloud initial new application](/img/sso/jumpcloud/JumpcloudNewSSO.png) - -Click `activate`. - -5. Click on the newly created application. - - 1. Download the IDP Certificate: - ![Jumpcloud download certificate](/img/sso/jumpcloud/JumpcloudDownloadCert.png) - - 2. Copy the `IDP URL` from the SSO tab - ![Jumpcloud IDP URL](/img/sso/jumpcloud/JumpcloudIDPUrl.png) - -6. Via chat/Slack/mail to [support.port.io](http://support.port.io/), provide Port with the downloaded `certificate.pem` file, and the copied `IDP URL`. - -:::note -After providing the `certificate.pem` file and the the `IDP URL` to Port, you will be provided with you with your `{CONNECTION_NAME}`. Replace the following occurrences with the provided value. -::: - -:::tip -Most of the following steps involve editing the initial Port app you created. Keep in mind you can always go back to it by opening the admin console and going to User Authentication -> SSO, the Port app will appear in the application list. -::: - -### Step #2: Configure your JumpCloud application - -In the Port app, go to the `SSO` menu and follow these steps: - -1. Under `IdP Entity ID:` paste the following URL: `https://auth.getport.io` - -2. Under `SP Entity ID:` set: `urn:auth0:port-prod:{CONNECTION_NAME}`. - -3. Under `ACS URLs`, set: `https://auth.getport.io/login/callback?connection={CONNECTION_NAME}` - -![Jumpcloud SSO configuration](/img/sso/jumpcloud/JumpcloudConfigureSSO.png) - -Click `Save`. - -### Step #3: Add user attributes to the app configuration - -The `family_name` and `given_name` attributes are required. These are used by Port to show the full name of a logged in user. To create these attributes follow these steps: - -:::note -The `email` user attribute is created by default when creating the app. -Make sure the switch next to the `email` field is set to `on`. -::: - -1. In the Port app, go to the `SSO` tab, under the **User Attribute Mapping** section: -2. Click on `add attribute`. -3. Set the `Service Provider Attribute Name` to `given_name` -4. In the `Value` field enter the value: `firstname` -5. Click on `add attribute` again. -6. Set the `Service Provider Attribute Name` to `family_name` -7. In the `Value` field enter the value: `lastname` - -![JumpCloud user attributes](/img/sso/jumpcloud/JumpcloudAttributes.png) - - -### Step #4: Add `email_verified` constant attribute to the Port App - -The use of Auth0 requires that JumpCloud passes to Port an `email_verified` field upon user login. JumpCloud does not store and expose that field by default, so in this step, you are going to configure that field and apply it to all users in your JumpCloud account. - -1. In the Port app, go to the `SSO` tab, under the **Constant Attributes** section: -2. Click on `add attribute`. -3. Set the `Service Provider Attribute Name` to `email_verified` -4. In the `Value` field enter the value: `true` - -![JumpCloud email verified attribute](/img/sso/jumpcloud/JumpCloudEmailVerified.png) - -:::note -It is also possible to manually change the value of the `email_verified` field to `true` for each user that requires access to Port in your organization. However, granting access manually to a large number of users is not scalable. -::: - -### Step #5: Exposing the application to your organization - -1. In the Port app, go to the `User Groups` tab. -2. Select the user groups you want to expose the Port app to: - - ![JumpCloud add user groups](/img/sso/jumpcloud/JumpcloudAddUserGroups.png) - -3. Click `Save`. - -After completing these steps, users with roles that the Port app was assigned to, will see the Port app in their Portal and upon clicking it, will be logged in to Port: - -![JumpCloud Portal With Port App](/img/sso/jumpcloud/JumpcloudPortApplication.png) - - - ---- - -## How to allow pulling JumpCloud Groups to Port - -:::note -This stage is **OPTIONAL** and is required only if you wish to pull all of your JumpCloud Groups into Port inherently. - -**Benefit:** managing permissions and user access on Port. -**Outcome:** for every user that logs in, we will automatically get their associated JumpCloud Groups, according to your definition in the settings below. -::: - -To allow automatic Groups Groups support in Port, please follow these steps: - -1. In the Port app, go to the `SSO` tab, under the **Group Attributes** section - -2. Check the `include group attributes` box - -3. Set the group attributes' name: `memberOf` - -![JumpCloud Group configuration](/img/sso/jumpcloud/JumpcloudGroupConfig.png) - -4. Click `Save`. - - - \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/saml/okta.md b/docs/sso-rbac/sso/sso-providers/saml/okta.md deleted file mode 100644 index dd17e86069..0000000000 --- a/docs/sso-rbac/sso/sso-providers/saml/okta.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: "Okta (SAML)" -sidebar_position: 2 -description: Integrate Okta with Port using SAML ---- - -import ScimFunctionality from "/docs/sso-rbac/sso/sso-providers/_scim_functionality_list.mdx" -import DirectUrl from "/docs/generalTemplates/_sso_direct_url.md" - -# Okta - -Follow this step-by-step guide to configure the integration between Port and Okta using a SAML application. - -:::info Port support -To complete the process, you will need to contact us to receive the necessary information and provide the details Port requires from you. - -The Port team will provide you with your `CONNECTION_NAME`, which will be used in the SSO application's configuration. -::: - -## Port-Okta integration benefits - -- Connect to the Port application via an Okta app. -- Your Okta groups will be automatically synced with Port upon a user sign-in. -- Set granular permissions on Port according to your Okta groups. - -## Register a new application and generate the required credentials - -1. Sign in to your Okta Admin Console. - -2. Navigate to `Applications` and click on `Applications` again. - -3. Click on the `Create App Integration` button. - -4. In the pop-up, select `SAML 2.0` and click on `Next`. - -5. In the `General Settings`, enter a name for the application and click on `Next`. - -6. On the `Configure SAML` page, under `SAML Settings`, you will need to fill in some details: - - **Single sign on URL**: `https://auth.getport.io/login/callback?connection={CONNECTION_NAME}` - - **Audience URI (SP Entity ID)**: `urn:auth0:port-prod:{CONNECTION_NAME}` - -7. Scroll down to the `Attribute Statements (Optional)` section and add the following: - - `email`, with the `Value` set to `user.email` - - `given_name`, with the `Value` set to `user.firstName` - - `family_name`, with the `Value` set to `user.lastName` - - `email_verified`, with the `Value` set to `true` - -8. Click `Next` and then `Finish` to create the application. - -## Generate a Certificate and Send to Port - -To secure the SAML integration, you need to generate a certificate and send it to Port: - -1. In the Okta Admin Console, navigate to `Applications`, and select the newly created SAML application. - -2. Go to the `Sign On` tab and scroll down to the `SAML Signing Certificates` section. - -3. Click on `Generate new certificate`. - -4. In the dialog, specify the certificate details such as the name and duration, then click `Generate`. - -5. After generating the certificate, download it by clicking on the `Actions` button next to the new certificate and selecting `Download certificate`. Choose the `PEM` format. - -6. Send the **PEM certificate file** along with the **Identity Provider metadata URL** (available in the `Sign On` tab) to Port. - - - -## Expose Groups - -To expose your Okta groups to Port via the application, follow these steps: - -1. In the `General` tab of your Okta application, click `Edit`. - -2. Scroll down to the `Group Attribute Statements` section. - -3. Add a group attribute using the following settings: - - **Name**: `groups` - - **Filter**: `Regex` - - **Value**: Use a regular expression that matches the groups you wish to send to Port (e.g., `.*` for all groups or a specific pattern). - -4. Save your changes. - -These groups will be ingested into Port as teams, enabling you to manage user permissions and RBAC in your Port account. - - \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/saml/saml.md b/docs/sso-rbac/sso/sso-providers/saml/saml.md deleted file mode 100644 index f8f618b5cb..0000000000 --- a/docs/sso-rbac/sso/sso-providers/saml/saml.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: "SAML" -sidebar_position: 1 -description: Integrate any SSO with Port using SAML application ---- - - - -import DocCardList from '@theme/DocCardList'; - -This documentation will describe the process of integrating a SAML application with Port, along with some examples for specific identity providers. - -In order to integrate Port with a SAML SSO application, you will need to do the following: - -1. Create a new SAML application in your identity provider. -2. Share with us the following information about your SSO application: X509 certificate (`.pem` file) and Signin URL (as defined in the application). -3. Port will provide you with a metadata XML file that you can upload in the SAML application to complete the connection. -4. Update the application with the following attributes (Port expects the IdP to send the following attributes and their values in the authentication request, for example: `firstname` is the attribute in the IdP provider, and `given_name` is the key Port expects to receive that data in the authorization mapping): - - User attribute mappings - `target attribute name (Port)`: `source attribute name (SSO app)`: - - `email`: `email` - - `given_name`: `firstname` - - `family_name`: `lastname` - - Constant attributes: - - `email_verified`: `true` - -If your login provider does not support metadata files, use the following information: - -- IdP EntityID: `https://auth.getport.io` -- SP EntityID: The EntityDescriptor field in the XML, looks like : `urn:auth0:port-prod:{CONNECTION_NAME}` where the `{CONNECTION_NAME}` is the connection name as provided to you by Port. -- callback URL: The AssertionConsumerService binding field in the XML, looks like: `https://auth.getport.io/login/callback?connection={CONNECTION_NAME}` where the `{CONNECTION_NAME}` is the connection name as provided to you by Port. - - - - \ No newline at end of file diff --git a/docs/sso-rbac/sso/sso-providers/sso-providers.md b/docs/sso-rbac/sso/sso-providers/sso-providers.md deleted file mode 100644 index ed8fdebf8d..0000000000 --- a/docs/sso-rbac/sso/sso-providers/sso-providers.md +++ /dev/null @@ -1,9 +0,0 @@ -# SSO providers - -import DocCardList from '@theme/DocCardList'; - -Port offers several SSO integrations, allowing you to easily assign permissions and roles using your users and teams. - -In order to get started with our SSO integrations, select the one you are currently using from the list below: - - diff --git a/docs/sso-rbac/users-and-teams/manage-users-teams.md b/docs/sso-rbac/users-and-teams/manage-users-teams.md index 682a4a823f..ada067349b 100644 --- a/docs/sso-rbac/users-and-teams/manage-users-teams.md +++ b/docs/sso-rbac/users-and-teams/manage-users-teams.md @@ -34,7 +34,7 @@ There are several ways to manage users and teams in Port: - Via the [Users & Teams page](https://app.getport.io/settings/users) in your portal. This page allows you to view/delete/invite users, assign roles, and manage teams. - Via Port's [API](https://docs.getport.io/api-reference/get-all-users-in-your-organization). -- By integrating with your [identity provider (IdP)](/sso-rbac/sso/sso-providers/) to sync users and teams from your organization. +- By integrating with your [identity provider (IdP)](/sso-rbac/self-serve-sso) to sync users and teams from your organization. ## Roles & permissions diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index b613c8046d..4b0ae9317d 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -90,7 +90,7 @@ In any case, after 7 days you will need to login again.
Answer (click to expand) -1. Set up the Application in your SSO dashboard. You can find the documentation for each supported provider [here](https://docs.port.io/sso-rbac/sso/sso-providers/). +1. Set up the Application in your SSO dashboard. You can find the documentation for each supported provider [here](/sso-rbac/self-serve-sso). 2. Reach out to us with the required credentials in order to complete the set up. 3. After completing the set up, Port will provide you with the `CONNECTION_NAME`. Head back to the documentation and replace it where needed. From 6f8402018ab5d3d1dfd8caafa89cac3fd887b2e3 Mon Sep 17 00:00:00 2001 From: Sivan Elkabes Date: Wed, 17 Dec 2025 15:46:57 +0200 Subject: [PATCH 12/12] Edit specific links to the SS-SSO --- docs/guides/_implementation-guide/plan/prepare-for-building.md | 2 +- docs/troubleshooting.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/_implementation-guide/plan/prepare-for-building.md b/docs/guides/_implementation-guide/plan/prepare-for-building.md index 644467f520..2b90725f7d 100644 --- a/docs/guides/_implementation-guide/plan/prepare-for-building.md +++ b/docs/guides/_implementation-guide/plan/prepare-for-building.md @@ -32,7 +32,7 @@ Read more about roles and permissions [here](https://docs.port.io/sso-rbac/users ## Configure SSO -Select the relevant [SSO provider](/sso-rbac/self-serve-sso) and follow the instructions to set it up. +Follow the SSO configuration steps in the [manage your SSO connection](/sso-rbac/self-serve-sso) documenation to set it up. :::info Enterprise feature Note that SSO support is an enterprise feature. If you are using the free tier, you can skip this step. diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 4b0ae9317d..2690c4a64b 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -90,7 +90,7 @@ In any case, after 7 days you will need to login again.
Answer (click to expand) -1. Set up the Application in your SSO dashboard. You can find the documentation for each supported provider [here](/sso-rbac/self-serve-sso). +1. Set up the application in your SSO dashboard by following the [manage your SSO connection](/sso-rbac/self-serve-sso) documentation. 2. Reach out to us with the required credentials in order to complete the set up. 3. After completing the set up, Port will provide you with the `CONNECTION_NAME`. Head back to the documentation and replace it where needed.