From f1f696e86caf771d15aff04735080221acedaee1 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 1 Dec 2025 15:40:04 +0100 Subject: [PATCH 1/5] saml: update doc for elabftw/elabftw#6217 --- doc/img/saml-idp-from-url.png | Bin 0 -> 37485 bytes doc/img/sysconfig-saml-idps-xml.png | Bin 37677 -> 0 bytes doc/saml.rst | 81 ++++++++++++++++------------ 3 files changed, 46 insertions(+), 35 deletions(-) create mode 100644 doc/img/saml-idp-from-url.png delete mode 100644 doc/img/sysconfig-saml-idps-xml.png diff --git a/doc/img/saml-idp-from-url.png b/doc/img/saml-idp-from-url.png new file mode 100644 index 0000000000000000000000000000000000000000..15552655efed5f17eafd68277d8856f2ffaffd86 GIT binary patch literal 37485 zcmbrm1yGgi8wZF5sGtZElA;14DcvaD9n#Vr(v1p&(vp%#=|;LiK%~37ySrf@y#G71 zb9Z-UXZOt9!ON-dd*gY2_3}kVN*MhP{v9MFBy>>`0XZb3n`B5x*T_+?!*53ZRJFm6 zYc_JieAkAXsXgF-ZW_Lpe2s*Z7j*Yb`xgBFV_gwBNhBm^awMepUPwqM@T>PrNJw_{ zNJuMhk&rmPAtB*f#g@x*!4tQwL{w~$knUn#{dWy1Iu;LpiDD}%DTuOsml*91jelY# zeBomxQGwSAjw5U14(bnuFHyG2_&7O4urMCn3=2e;^}Qwj`y+G0pEo+M*Ybq1T>Qr0 zN%CwC?m9oIuu(HGG+eCUED+Dk z$${&=dT1dLsr>V=&#eFa+(!QA=M4JapRX#f{r&mx(*pF#ZB#E_@FD;6Ye8Y*MO}}N ziv)jPw3YmL;-7c_{^u9(9dG>e|Nr~c|2&QK@2CFf>HmJ|w)eNGsVOo)+{T7KVxk4k z{TVk-4?W5>eEt2^t4#U}3_Gj4`9or2Dh?vGax|(&Y{FFT=>fk8?bla^DZtg`aq$-Zfr)YS`*242?e6FDAk#QFOAE-@A9uY43CW^fNMYT9wLg7!0nz zKf9lw2nq@wpB}fzvKM3~>lYY5eE2X&y_(Bl?M?U3q#r-DTNm2By}cPdPDE{Yi_OPJ znt%UpZ(l#iR$E?PzW(7?f;eucY@&jKVmeKw)y3Hgv#FfCJjqQIWo702Bs^mc{oxpL z>gt5Hm+q>ns%~yo@L5%!{FfK!`uh5h{CXB%xMDv!<2Pj+^8 z%+*TD_g7hUexsTwNlLc2$FORpBr!2FM}7OYXK#(!T0b*0<8ru>oSMwc#I&@sazH}= ztD_?@dVX;+@@ssxYlH8vU%yhfx7BGKCMuo0i8vnO;!alEt-=Qp-fQgYvRZPOgwL9C zy_$>nmedoaRu`^(d>=o360C7Q$Hyn2)2bfp>Utd8I&F2ZIjXFpGVJjSNke12vcwX` zU(DB!LNZ>0Y-;z|=RQ#nD?J{!0a{RFg~w&}=JsrB1Wj*u|9W?#&xa4S+q#Vs5)#Pw zAMv3Y59Y)Tjl@VMCMDUP4rF%)V^B~~;0FjLyPoVBOG*Y5`1#GzRyrRuFg~qs=r77G zu(4NCl97=SeYZVBCXR=Oj4gBP)~$xdhDVPc!T8(JGd%H{TU;dJvU*?p7KTMmS>9!L z0Ug_=ErwOPK!dZlBM!ms!lE-Lg5xKcosgA9z28q|h>J@ufA*P)g@t&irUn*CWMU#r zw6XDW!(ChfthxF5^LJa{^YeGQHml|36eOgicw83HeCprX+CHQ`+nH~rq|?O1$8TwF zF6!;cFf6!#zU`BhwFa*ajSLl+l&pG$SNe9E??v0+-Fw6`6R?(*<>htL#pSeFK1GJ+ zG@jeVVx&~|+haDi(zG+W<9B6aWa5z~#>Nl$ zVo&zEySvNWPVEH*yfQOQHz%rkdwb&lG~TU``L<;A;Z@hEo7dwP)YMspg|=&@@1!S@!fd4TXh;vG|bD2%o$9f6vO2;KupRB`wm`(}QU~FCTE^ z?~gY9(Cw>zWnd0%oD>};<#8MOYHtahXD#ae`)=>ORP=U$Q18Hig*|OhV`f^~_ul192 zH!Z+}po{R)sh^jWlq4b|N=!`Ds&dvhFc>H>lqOIcHPEHGy8idMtP`-K(UAGAC9Z#x zO6@gb($$^)qNy3O{VQ_923L77RT?4W<#QjOi;a>pJ-47BE6dE(y~)_<`x8V2ChE=W zFIY^-HJvZ-LmB7i#J+~Rr1g>EiFw(D_34Y!7OE4 zGSS%7G%_+0+Q8*GjRrqIKU`{QDO*Islc2`c(Gp84k2eYm0;t_5tFw1y`*vezW^}s0 z1Ox7+McH zdO%S7HMgtB`Seqv*vs8cFE6jUIzDc0?pVyLi|g{PUOPg^l9%Uef_~~HKe4djd*E%o zG?1N;@DYE3^x1%1Bo58XC?@=X(Y`%nV|8^60(^X8ZdW5?W6InUOxvsMkv)GTCx^$!6GLm$*8UM!RTU5*x!U_iO${bQSwTTYt1TGQa&5Gtq$Ct8 zPD)x#qOGaPYHhrN-{+p3JA?h&5bwp2?q#)`l-o&KM#e&=6Bg`1J-t5RIZ9ucrGx|> zIh`l_PsSr~<~KGjR_4VgXB)>+(B+hrq@1>A)<;VcZvXLrRA4z-4P}g-o!!{jSW!ud z$L%Bx?l#{(d#TG+_Q8V(hnwRzb~e3(gSlyGr5>A_iyd)fljLYuleVSUNC2JIrm8Ae zqw3@_+c(Omy+z`S{;-= zQF?@jPpevabW!CZ`}Hf~Jz)(Ex2azrZj6r$`sC9`wONc;@ZP%{dcnMXkBFn~Y&lhp z)lw53RYpl^W1{L5%IjdR7M;ZR?CdJN?U@RP%|8td{ey#<8R>TGJ;_>^7c{pByfB1? z8%IV)mX?+>TErBYnO#tPNcp{|^sa9DJ&P~^SPNrfW|?U%YEI76Ul-@IjX{w;Gn2)3 zRESQkDg*SED@2cU)+p=g!`tF<;?hGJM4a~~3ob1Y&^bI@Z(oi(CcB{zGhRthcw&V2*|l8qr9#o6Gbb{H8w>mN=f-WZsQb!mH_< z31E>?R>sA`;zxDbU652#il9e25+34YYod?x!uaqC_C{!2TwHv-`|d(JykdBGR6NDO z+B%`zh>JKEn%mQ-v-_)qFf0JZnu3A?VCoo2 z3<4~hqb^ba%&$F>(=*at1e_}!c8)3&_K_>u#dY}7;@vPF1F$j5V(|-JTEv7?5lbtS~ipdAmAdS*ES4&w@ zk)4C1*g%5`KU=sn9x5dCzIO8GG&IS*%aayANxf^|`V+892?{1BT|I989gbffW4KP$ zUn3$84%XFNTwI|0L5T$tvD+L<0V@GZJR&B>WxgeRFg=}%xHCaKQZ`ZO3mG&UhmEn@ z=(j0pXcPy#@aW&ZfA!cXGr-o?7VR#&q?p(p^xKcP^gf4$Ij@gm@nvLYr13HqX{Z=X>Yw{M?+GnHiUG&_I8G@`CEO7!;IS`i6$1mqnXOQvn2#bXqAF zu)X|F8kZRjVIWv6hNc)js=t2i9%eMutZ{FDOK-nE0iBl*m6D38!hT(KW_Pi_zaPLJ zz*5*XP#gO?(@Al5ajD^|S#z}LXlYs2y0jPCqJ)Hm08PI>+>8thGcqzlJKx}Ra5$t> z&Vbr)XIF$4`UUH6@7NX^y?gsMsaI)fIVPX__?QI{x25i zzrC|_vf4am$od{J8wLRZG)GRoCXDJ=TU*oo+KDxiSAd6-l9H74wR7cH;4Y*B^78UW zss8@{OIWvgd24*C^K zPo6%RnVnI}RnavwqgLMur&3;G8u|X(GdemNZmP^>Fz4D0WJkQM_pcBlaNeLOY7?D!l;fCdyD~v0ZLES@jR|cX`RcK zVVS@{y@`#D4YR3CtCiAi#48c!TX6SkL`HZfKKuKd85vzcfTQaw%B&@Yg@wVwLGH0E z0ns7h;rj>cqaAUacY#xUhH+Z5uH)msO$xV+eQ!J>Jd}}{*}UG-)8y-5fBzRrUi-c0 z`|cS%Jv~5Zc@UPCmb|u0GA0&8F*Nu$wvNwIQc^%>@b*T2Vepn7FJZG;pB~TJ+S=?( zkw|KKI{V&+L`6lR0&0}o{vfw!c=@1uv88P+79$}g zhn6ruH#<8!Jv|B$IjA)32z5G!)$-0IFz9$jhn%7An{bQoFH?$1=!kcg9+3X-?^k4N z=i`$lpG1T5D^Q*cl|n2!Y*-O1dD|>zZ`CMn%K}DfcmDUrf=WA)z#JI zXjF7WF&Zv+^4_hdu#gX>znM_?CBDiTI3=}K@!Cj#=JD}y2o->I;~8sSlhHOB>fbyY zUnTWFmzBK{dy&v&Mv9hr{eA}Lz@@ZaUK&!mWPW#Bo7vvCmkNjMfZqE}2ObYy%?Oeh z0qC1JhfEf&P3b^r%U z3fj&e9;Afa&AF8cZVKl5TbZRVwX zh>a~SE-sh~gX+JtN62o{w>p@+IbKD8i+gwqi_Cr_X(4~uj5sLu+4jSEUCR77Kysq- z^Om7RCY7Z!Azr{&G3L`A>2@BE(VkYXFV z(r}S3T1WDEv3=^DcILkL`?q!LHg;&0K0c}8?L-Xr^oU7IceolGCfDsWBjZIzIGwLhqRN{$)T)(3EiEs2d9{ve z1IEVG`98Mq1h0f#T zR7NiejV6IN&jG5}ScQW$TQby8a`J`Ul7jT~<&O1Hl!MLGZX=t84s4f~eLkb-M4Taq z_2SR_zFAKrfV}{ftV6k{&=UA$GxMAYHYD^Fs0-2v9&9NIm>mg;zTVyfN8UGQi~;z} zz8p-#frRPV*~#P!(EG+p^UBLd#_H+@29!>O0`b`MtE(@%e(;+g~T0sw*kfEZ*L0VgLX&|T>?OMgOb1${H`;lnhR!lj}2KmmZYj+MDp zWEJ+cja5SN0MG+;3~Clhg?4pyb>AS(&FilP`&B#L`MlnLtA$d}*Cz>Bk631C@m<+$nOdp@dKj;Kr%W&`Tj?=|5 zn=gMK07j^kveGhgV3{8enTtCf_@AHz2o7gUC%yWi=h3jy%j=%*e@+l9aT2XBW=ncSZ=%QcTTPr2sj1H|0mF&|i>aps6 zuDHWpeDy-4OJ`fXS_&)scijU6_t4P7;&5b%cqsI^3I@-HCv&!_LOwagqhaIO}{qlD)uivfR!uIwUld z(QTxVPW8o*nLS`SIn0|kZ)RPtmqaW8UFg_7aKAWn8nx)((5SGOEbsRY@84bQ#HCR$ zbsc8tzRuFznh72L1+M}beRHcRd?^8|nTUkM!<2_g4;WLVwJPk*U0u(3tuHJl3YS5z zMnnY2ofRB+c~guuYL?w2WU~UbePt3@%IZK)9H*hw>(?LNQw+eoxkMDb{g9hWXBSwQ?eX(WoDTDFW8&OxvBTiLN`dgfu11Z! zTgTckg>>vuAtG0`$k(LX?cuV@NoOMgk-xw5;fC9C4_UYB5RA&$*qNHKLq=w%!}^G# zrlzKK#H+_!71r}=!(R;*2J@gP-fo}3?sgoJoFY|$hmotZn) zdN=4u#xsyTe*7IYxoGQ^IZ-fa0Bo;Fd+_q+iC+Y)4uU3EErT;&<5825v9hVI06cP{ z%0<}8nV8+VufBfPk_rvVtE{Z793~zfo=Ezbp1wZti;N#Xw!@W`svCo(qq&?KJK|`_ zx_Sn9HdbB61`iK4DhLS)57s7#aB#?#1lLAuJbt~uc6zveib;Bi0z8obAJ28U=&b#? zONnB{P_qmm1VH`!BE5JhpROk@&;|OPVf~? z-HCT`XrZr+{&eT|sejM`>t?)JJ~e_)OEVbZF}F3Hd%)LA-mpnRjR}H&1sD`Sw3itT z&hAFPF&{>lj2&&mcew7aV3R&$rJ!J8IXL}-Rr8~=YjE%|innH1+)-bjEVA`n$vz2i zt7HU!Vz-{29*}M>E-vt-T+_L-`D>kUqP@j5oFqrWD8g%mB;N#=hb8)3e#W^3eMU9N8cE8|*G5|Zhr)Oum zH`U|PnA2j6EtSWu`Y3#7v)!kdqnl^9MNvkk%WV6zum4(4vN$v!K`I1Y-Zg}}1#jxR zW5Ld`+{<#hHWVB`AjEnmCgt|y98&!C0R*gGHc=8O;1zxN@L@1X6j}vLk=9~$q3HH0 zir;V0;cV^fm`96F9hmaInU_-A+3jl+6XVjU5B+>M3l(X6eB92~wp2Z5GMq{}o@;vB z5!^@sQxTDo_tDVWI$BgqjUJFb1MavONF*FYghiVQE6^*~5|rua=#kG~pF&se?dj>b zJT|njumGuc(bVjs zAq91o6cxpB*kyp5R#ss6NW#ECNJv|II`{{_qN2jaSed-CGOPU<8*E!X5d(t-c+Kwa zZc$ND&EE8+%&Btn(07R!&^;v9V()z3Sz* zl+;WLQc^jQiL<}IV5L{w)e+`}GRDBr)Aeg=AY0AT2Mw&D2j@1xB!Rs`jRK+qQqnhO z7yGL{pOFzr%np@2F(ZS+ct=lMyp`E>z|qkWFjghib9zR`7-pB^*jRPw@ln00;I_b` zMJ}(nPs9->lo-e9qNMry$75bz3JPHuN?@JqBSpY`Ih=O%%q0Aai;DvT?*#}w^#aN* zbL)M(0i8zv9BfL@j~_ufLB3DC_R^J&^mk_`9hepxFe1vrsK-vj44~KWeb$Q?C&tyL zRSb)~az804zd+@SVn_yYizZvj2-XNy1Re058ZfNe5bl`f`hkxa7gmZ)-A)dGDtZMI z4CWpJ^kVL0Rh2LN9auM_Z+3&KUag2~L7gM@b;jqrY%1W{@-MtnC_KnBdQa6-`m6er0e}wP@?AMOoP4~cl zpG*EBxid||-u+w5SYJQ+jdm~>R`S~H1qf;j3&h;c3PMWu?a|B$4lnEKf%TDCjFj!} z=(j@10qz!+bhO00z`+WS$q0kgtNeEmg8ubR52cErUyj1s%3~*X896yjnvyGMmxU^- z8AsNNM(U-ZTmq;iDe2jb8#gl2P)lArE&%QyD}CqLxu~Y5CLO~P(5!byEiVN9y#dv= zW@k@~9+;lJrS73`c;-ZL;1&Ba>&0YuZA_HeoS)c1zw5RSe4c08b!oAFdd!V_4-ENl zFKx*8`6-K%3k{xxF7sHuwX)g*y+xH{wYRrdI*v<4LtgiLF7IwC!b|*uyrrfFp#`;B z-O}Y*qP@Q5Taq;lpym@0}Xeg}V7CoL}P_Vb^R{a`vdu!`C9bJv}u{9{mi%Z>J!9XOE z4fV`MDxC&5#=%Af$LDm4@7~&EZc2*%+)}re$0-!=0F02Y@jMXon8c!3TVL;t;}$1# z0c;o$(0)L~`6qzHqi#^y_O|PXDM0qKe*#7;^?@Fq^}m0g)z&uda$q)`PsYV{Hs2bl zPJ6iY^{F2Y-NkIz4-$_v0M!Gnt>Q%pPNhOy{z0loCL-n6CC_ge|12=H6o7P zExLXhO0C6Yv3XP14`>PdJ3Au~$$9r~`@Vdts+w95)PSj4&j=+Y8k&Pd3v!JL=Wwtb zhlfR_oj{rfv6mCn@56ZRI8Fy3)HForb4f{11+@lph*-?N4IyB^j}}`HG1{;FsP~D} zP`^jQAwZ*|rgj>{@8hmn?4Qwe+yO-VFnxW+D69tV;P0t@cexIRrXR>Ov#N%?rZWTYKf>j=xp`v1uac_!U%>_ON z25bYUIm{=`q2{B-MBMgmc@CT4CCk(zlL}CG#&FXn&L zj$7ZeVq@n56_k~)FeXU&T&{DU`AaOgh=WwW&K;lD3d-^_mHhn1;&w$0Ye5wv=3=ur zbIj8)vgcIG5LM-%b>-om9xe!{Qd%1+qN@2mC90qR5hyNhZgVrUd+_R(-q6m)#VWT7 zz2=ao!a>&f_#2Zom$f}Rkt-rP$9?)k!wvdic&HUy=;yt;+W*eCjhj)ZsDNg-0Nij} z=;VcK5{#tfbXW`i`gQo{yQidjqX+BRXb>U*dtX^PcWRuo`wKLBpek3fkdhMIQDW`r z2!>1DOv&bqS7CEe?wb?bDgJE}Zm0K1*b~5U+!)kSp^l)hf})naGrh^%{Y*SvPuu7~ zY$W8?UECD{ytZ#IXJHZ(YJ~uyzkBztWMh1^$kb3r=Si|d=^S#Qf}mfBJ9}_sBra8n zj-bfS%9vS{)BZ|7;F};K-kjuQL2T^i&=a5?u!+Y@ED?SM1@uEk>DL~s+%8nGOsaHz z`S#a)-Nqm_RaIh6=RHsC5nx78=zzmlm>yc}<2dhs*6>6n1#aW)>?UDA8=;hxZqKHxDal31sH?|DM{{(y`mHqU znwpApyZ+3})27E8ciC%dZ%>wkT#l@?0`OUwTmep8Og`^>L@QHM-*a=NQJv0?wqfu< zSAmHE4XyXcaphy};x;NN7mpUmczd*WJ!{jlt_0R#@P7P_?%uu2$jI2}{|F#Fgp4F5 zB{ZuxjhLKT9@^O0bo*#QECP&e8K5|WT}xwS1y-|^;F)Y}Y=9@J#}E}n!fS71lekfI z{}IEpi*qa|MjM+I_UgdEz~pf3IH}FIdcWV&-?@8tR!0{S7@JE=O>gO`;nK6S6Q5;l zM&OKQgi?^{|Jhpxp4!>baj{-9smHtL`jnd53_1{06Cl;#n}GL6L*xcx5=pA$YF|2* z;>#}=k4SI_fe@jfpk%y^i;QeED0qYh%WML$HzXy%Wx8mF7S67p`=Vo< z-N167HUK|peamobbNkp;P_O|f=Dl2yUtHBWxb?7b(tD`PVtliu%%YBO-GVCz^o(ul z*0a0^6RuI=UIjYgNs(z_l}kxAV|Z9X|C%huY1v%h?}mnD0z4U?3BU=CpDYf}!mHDi zHa>=}hh>Q-5k^9Op$U>@pohoAh+B}xNg=rOeE|dkwy265A6>A2eKH-Y&J)@^_pYo@ z{x!(>kWr9sMPCjNmoYL*%Z!Qn`t^ZlEgp}nBV_d!{a=3nqVS-=usxc`d<48f_mgD` zM#h4OVqvib4~3#(GsVZxoKhI0BzO?gaRs2~tQDFc^mLIQZyh3xvMG~ExUkfoo^9(w zFe~GCd1op*?X z4rdzf(ngxnS_cI8AYo+QRONVLe{cZG78)`jfv23DYC}}H$#-a;aE(Ed;8$00vz{DH z!a!GlKO{Wp0)$rQmqeI@RimP^^V~*@L3TK9i=m*RV0Gyr%s8r&k_2C3-N=l3pmTSX z?h@2=3Gz@5oNz_O4qDnyEKF2VU}^{V?qzr4G(V-P@;;7Dm^g_Dsi>%c2?KE;Ihm|z zFhs4tr|5KbU0N`&r~vDN7txsu!O^b1Bm-j;6YDbd<@)!KCJPG-OKS{Fh}!~O6#DgR z?X=Z1msweEQSg`q#LKqIpJ1TEXI?)$zhOD{*b7!9Odw-a8;SdoHn26ZmKKhY5is$w zHQtt3j89-cBs`hDkL?~KemW( z2d1Q!qDoX;ID~Gb=3}x%PWgwHejJ3Iutv7hfVW3f4<=kiPd-DQmZ(-1tZ0zz_AUrx z+9O;L0RR=KlybP-PHYW?yrav@_hxA^P{9ZrH8%b-F<`#DRPctn8%cVvv*qu&ND{E# zDftO85$J%Cw3=u7?a^0hlxS|XEYa+=Bn5djH6^7Kki^k^nMRAKLYHoc8PbjL8|wS{`5Aac#Wi#hBo2eG6O5Q$9tv2Zu~s~t z*Vk8V=l&k)eo;&=t-2OJx??Xk@GP5M3(wYB-o_Ma%)NVeKu7|-5Wc7RJj5q=cwYK= z+9!a3h3n33S-m_QTGeOH9Igr$BDq-thZ;kuVB7(Uhujo6Xe4S1fLW$196ZOyFAtGg z#$0nsSnb9`s=4JDE)z2(mlZ$E$>KpuYeg}0AWNlQk6tK{P;~r5h_$g%rt6WgRN?)I zp8N4%NSu+1@CTCE2SK0 znUGPSG?COc6@Beq9T5Q%ZqkM;Nb%tADJd#q9}veb&e}|$IU$^Oo%hz*Z5G-LT(mrj z<`F`P5WAotBZsKM$mlRT8`~HfT46znVZktjEU?tu2d5T8t$Tg9> zIslG`2}DN)KYd!AJlr;4r+JPqDK5V1lP=%T(hga+s;a7rGiIct%Rp_QM7vv#P{F^} z`v{(%V)8**euVZ1V%7qu%f+^c$8+6@U0pH|*@6a;7MW8lAg(qFl{IU&+7@;uSS|@g zWe^MyrYQz96&%jGdo#J3RWrNCP%9FQD=RDARSFisRMWG>$#Wg(>Us`4DSi=}&oU?Y zu>IXbj%B|q&QdzRy`1+U>4;^w0R-RR;nrvhNFv1>S}GvJp6($Lo&3cv0*8{B|9_n0i} z9c~cZ>!1w~BH-1o3tS&PJ=~l;dA!ma`0;r&ku1dCB1=stqIVBmNY-oaz1Z z*!z?Bjw9DJH!pc8_LCInwgO*rPvrb-;!mSVp*MlGznfr#+Y{_-2r%UO0ixpu+ zLY<6oB1^6mkuvC7rjUw%D8>HM!$ZLF=()5sbfM)qT-A((bj{xEP7+Fo`IssW@fueV zZE&Y8Ex|P{&^~tti!SX0PPQeI>(*zmQ)O#CWM#jGodfgEIc>`9r@$?a$N_D=7F-X3 z(cTr0s#}nhsWCg=felGCTH@pFg@*H}bYC*e1EMn(4jUlIl!7{CU=R@+iiJyHYG_Hv zQk@o__B8XykM0xvl;NzV=4Rvih>$Sn&57}fWvz?#k6LFg9yvKV5c&X5+uX=#>+o?xJ;Bkl@4%5mX>@8-3}$$>Ncv>K1?~A&3sd5&nUwcGK6>(@air zuVaCnBv{gr6GFZD5wsdG)%ZjxutEVYwSD6`PmN-P@HXklNgEuWXlY3Z^bN^pAQh03 z3WO367AA8)gCiyi-VfY~nS}+CwIJk_6t1kTnL#?5h$s%$@Y$K`GQp#Vgt3v4!l=!y zt$sm%r&I2Bo83=&d3kARr5rKFIPk;yWDjIDHacXwAYru3=*T0H~;3c$64-QCu< zHh*7Vs8U^1r2J`J>LN-?1EZr*WJl{X`&@Zy&bYf%6(L4Gn4<|Mzpyw8jTZ z;*;rMBF;nfXKz^^qFNdnMELkGFi_<*D`D(`Sjd8a?mo%NM9E&3mzP&q$n^YqQ@S(> z@H43V9v&XFk!nh+__mkTeg!t-rg?cqZhK1)u$ROy+deM2-2&r-JNq zb~X(SO?zu=ugPFXUERmd#nekX)By@WoAO}&DtI(7XDUNJ*+cdAS51{K1NERqffNEU zB`|*hzt<_h@R$;+e)Y?sVA#yw$?14qtpv&gBlv+0Cx+sa#LMCRjY=`?O1I?TtUyX? zYUjyv>LZ|9s)f(b+(^VJBfVLgeQGWROpC*Oal8#We?wXmeEJf1PryYkdrPDTuFOxK ze8kXs`*w?g?9<2t?V1PO=tpTUPCO|b3!rgxh?ILWON82?7F$8ser#+$HSG_ z=noDWZ{+zIqhG^HcR?!Hm<7UG9KePC$~ZO)5D|rT526A9m3eGzxOj6TGqYT9oDbG6 zxed(C)XQ`P!GC}V*Vxz?Dk(TaTy86Ut|TO|eh*)Jp6soU_NbCe$DcLUdQR9Z+OPB( z|N8YIyG+*&wi^sLr2Me>V2LZ`sxt3YYZ%_fYEdQ~ zWYyJO!Dz;&Qogg@?eykEzX`O!dK38gB>8-x|en4qPzPp_K3ef!g7-=vwS z8*HU$Cgarz8fu)?ip}aoi?=1V7h+lpR7Hhx?E}wf;^^8ZM{KQ1;egYOpdY!j(>|QK zU}JMUx2#Fe$bh1l;&C9pvAVhnSsOTzk(u+OcHSBy4;T+0GM&2BUZjm3z10^aE6C4} zrq`~U;C2CA!(q2lXm)Jfe0tsyy#(_||=yK*LB=iTo7EY_FU*L>Fn#hHnL(ZHh58cQOdpsJeQYA!r zF^Gn-E`;y_vHQjtJ8~S4`%iLFUH}u^+!K!_lBH z;9Wf{C~WUe8jHEa^$QHF_Sl^84W|Oxp%p^J7Q^{g(|n#mo9$?qVTzebPJ#ISYngmC z!SWQ+Eln-Xpdc^rK|Gd($JPiW*=)1IYoEd6QO|QdPHB$;=Ljkoh=qFQ=G6w zs8yQ{A8pT894?V!pn?M)e!dW}X40QA^zB=x`qP+p zi+Kus9;ZAgyt|cE2wsngmPv@MNFZ1OP7b9R4aJ<&8UKFIOhAwo9G3%l!CZ5e|E@PB zc1%6b5<8B^E~C9hAq3;FKPaK=%<`lYbKVs%@4Qe!Ywg`_QTQuYh#B-<^805_IAaj4^+~nkFDk|D71@XGNxsmvM0w4y!?j;S4`DL}6 zVQ1_YzW`=dR%KaPs84t9q7$*3JS3enc>BGeU^kRPnpUH7NG|2?l$x+6>>V`;baQa2ba{<9U-02g1Oot#+8KX0@E)da#TGEw@&Wp=5I?4^;A>KVgv< z8aQM?Bn=YL0H)x^;ixR=^%Wqrkn;OnMIKsPuMPl$Fyn>61Brh`jZL+yOxjR#s`5*$~%x?B(U-Q&C#lWyI91*VpOuujtvS zlLv0fd#DIp<{3KL>BUS5=#_YSH+dWTdyITl1TP!a=) zt{k+)Zusio3lngD6p-DOF9D`pbiU!H=JeR=V9qEqO-uu9d5*x&!BcYl@6aP1$m+)EdktU^eL+dN&K_ z1fZo{8vpM?4^3My6d)M^{0GX=^$(BP*`rRL3kd7#qF*G*C;XcQKo2lg&MmJbX&EzP z5cNbxzk`lWw6sCXa{lhk5D1PQu`Jo;<>lYMf1i`rA`Xv>Gl!j@mIOjl+56pVlOD;jgK;!`Yz?Z`%0L3T?g%p^$ZC+g%h|iE~fJKBE z*_xe}hI;2t21KpljA?I4E<|QC`xKU`Fxv}3j?fhjl9P7%r~W=LKjs;O7|A|iM}}f1 zJ{uuOX_Rn+xEJWvjqBH)fh2H8;n^@k>hjjgxI7=6>mD48Y@9WpDEt!5m)I?ZVCUc0 zI(dGMg2uMjNCF`SSod{@Y?7dVJ@vVdGF~$Yad;4G<+0X@2;q2Hg=2RD9QK6pyVm~& z-JUBTe$wVO+`;P9`Z?v5n|nA`25lP>mH@4;-cVwn4daj<7q|7b1BEfWFzFd7skWSM zB7pNd99Q>q_S6VO1+B#hI8zA!kUZZOCVZxcfAy4WVs+1^A1gESCoeA%`;_bd`z?R< z#J_(UAv^Ku-yl7tcmFQTe|s^~|K*Pz{PXmGPnG@qrxO0tu>XDczbC~0^Yp*x%eI2v z7O&5M2ml8_b#*%^JU$Pg5t2CXc(2h>e9ASR-?6} ztyx)7wnw@D#M-o(jykVo&EMv4tseQs`oOZwC>b4{YBuyXsfS0?Huiq1v$A?hMnckW zxmRU>li)^-*RSnQPKNegT!ecFZX;L3d%peq_9?&b-C_jz7rpaN^+_P{T9B9dR8!cob%K1V#jVdYB=pV%(bd? z;A@0w_j2vq#iXwr+WZpnPtln*JbpaKKmKh?!LfOYMwboL>wgJv6}_w6c4lxE~j>AMKNd>2I%9O^sk+q zcqN7Pi@T-q%J(uXF_lLdr=H%g=c_}Qoy;4Ohl-*)MI6nv30}_MU0hmS#^m!AZz*2m zVKewGb4lP3(H3K@XY>j+Ju5@A#yn_oi{*BN zgAYVAaULeCD>>ukh%<(8A)`2dPX7bEgnp^rmG+7}X)I;h10{JyQm@}UZtlk;+1Pg% zjZBMLonjnV*_aqPeVX+~R2=pRc?6V%Qi=nsoa+x%hhjt-lGKl!c_s7zx!}+V<3*I$W0Johul4r;u6=XQ|q z7sGDMidaM(|cPwni8ogX-3HTrk;_T$j1JANiBpgj{c zvl3yesGb-~^GxwB-=c6Iv>ePEwjYQn+2p0pP3!CJ-zMZ4N=k%?A{q1gz`0LDLo)t~ zNgy}j3HxD6@8uzVK|;RC>IU!0!NyCSG)~ea&=D6e5{UxPs{RDJ#>dWh%y#^K`Sgax z1YFFrg(ai)(D(PhDnu!BVQsk_T5aKRA>qQoy7$t*bQmC^fFB@wsdf1&ZRT=3JLLgG zO5#OnAaa~ySY}N0$Gg7vH6n|5Zj$n=&pq;=zW;PGkKGHy3Hhm!jFt-W___t2^5bvj z1I7}icj-SMg5#b&zOq;OPayth_K zOZxCvAUcY@S(l7*Xe=M|YNsZe)ylB>YAzLd00B19AvM#?ZPK}gDjyX~YuvV|V*BCi zYMHcfK=SI(F_6+x2!Fx|qsZ%Q<8;70h`;0K`_6tvG_iZlJZojhOndM+wKEhCO^8qK z&c2~ei@0C}A3}3nF)SQ2R7(~MD@4x7w%m$ZtYh>nf9DPgr)ev#K^@5g_QQy9<&;V> zQzNq^{K+qrxocS!z6*cmGg+x#WTr^RPwn;w>0@K3(jAE-CbGzB9S%tv%hWeo1Sd=* z>AJdmI2_L;_;qKuer&vG5sS=0#^h_EdU0+sM$G7%R;(IY&z>$w_N5qOlnJNc-;6UjVbc}6)NMaA(u_`nfTJ58((;p zv+Wczv(?lbN|aV7TsCRaJ~vIcSfYx)5B6HC^iY?SSE}9DId_lekq!;D>Exc(*Ep!@yLsk#}=d1=Oc>$`s9H7ZOFyV3Is=GpZW9ex4{22!olp^I+Z zH*>ur>?@7R*mv+gOnoDFR?N^6BFDv)|vjJZ7fD%Kc8ob&lbXb(fRM&;D$ydTW4 z`}uD0mj~vf-kT|bB)jx0><1KAu;P9Ei}{_FQdbSk?TM+bePXE($mK_@lO4q6eRjlB zgn4te@0=d^aJG+}5#Vy>N!S-vs`7uL|I>D}l_gB7SNW+1UG4)B{hDJJYU}(j`ag>e z=M=Y(c%3UG3K>2*&W1jGX>IgAH}XTZ=49}zr~IBD6GDj1d32hP2&nEt7-;S7;_ULl zj3Opq+K1+zffT%zRpXH65AG8<2DV^d;gRb^U7X{WZ{)Qe9Z-)zP%?Sk5k8 z%vfZDg2C(cN{=_8wc&_xuX%IrF-}*kk%^g+kvaQMNns-=FDdd(;u^j^kqm0J=|hnP zTf6iq-TfbrJYHdnn7ajM`nAJ7IY9P%{Cz+|y?kBE1RrnKLqMA+Tb<7B5J|SOpvpg_ zDofVkh~@c`n9JXz<&CWw3%>k`{U3PV z!;9WZjtuqHdbQw=vhd3bG&S{2H@4=dx&IAge+ldER}{3No2-|}$)_qsGRVEm>bu;u4Vr3+u|P{cf6h;VCCC?{HJO zQL}@h%JHeMS88SNj0=H*mF*Vs(Upt!>;Am8+7$KDJe@8GlrR@WZIs2iKe{pbi7o+^c_@o_HmVwmn91mcDOE; z3?`0v>1IO7+d9~2*f@K=LNfzNf@+<$NXx}gYG|l@F>Sc8oB)zhdX|pGkT3~BUP;5J zH_VK`61h$1hoe=7h&?4VtNr-$dOEy_gFRvc_Gu`xOzhIf+Xo^scsH9J0|~|K7!AO9^tjYp1u{UB5)`H?8K>ZL-;3ZuWk1?Gj(Z$Ce<$#KICp3KmX| zyZ%dadz;`rQ%S|G9-aPNbRgbHXFE0NDyz=rG)c)*>f@(veo9%z%u)hhVdB}Np)W`Y z6mBL|9z#BmvVfIU+YPY+v8QFtwFEb?<36@5Sh5=2ujHEpXE`yY=~VSQcxMY~5(~C3at1Gal!^=o+i1VIZ3cHShnu#Lh8lEX#O; z$4P_j&tS8E?-XUP6+0CTT2q1`` z`K7ID*o#GWZuOvTDQpN%kIqp1QqZfudMiwVM1+O)o5%Q7#7oa`>X@vdGqW{*ZL159 z_kq1tgl=0tO7AGbh&|D%kaE+hg@d1Z4yjRG;L# zJ59{6kOZJ09yY|Z`!`cVFm@5|#kP;Hsx)Wq{;LqB>zBDM#coyKv*G=LS6mX z6)`l8IEtsu+2k7_G&ApifiaI!DW&3tf!U#pln{+oB7}TX%TgmX?y?XdX~B&Jd2=%=C0E2Ft{_I#c82;>h?~|h z9JCu-QM1Cke>~~4b2gyr>U#PfyQ(1LN(kN}4^wtoNW#j-p4D}Z0{bcaUpLh&A0KsT zZFjasE6}2&9=fz7P|{Gs*82JoHS95U=PD~6jigbkf{VWGLbJX^^h*5dniTA@{(Vsa zQ33e?ehMa*B!@atxM!a-#iixtb1bwdWOQS1oTW9Cse?t=Nb~Z3j47#nCFGjls3ag7V6Nach6R{`fQ8A@c z&MWHb@7NmZSs#baOzpq0aEm+<7ZPG-j5aEch}ya!AG$6na?F%kWtK_h zO8N@5>z3=JmTonEq`Rli&j%i&#d0dj$uygrwzqaqxUBNu4ryB2>(;2GD|aUpvnld@ zl*CFsIdMYx($je3DG4UsuMshy%r0FP?C|O?hUI<+8(4v30pe{&kwJ;t=XWm3DulIv z=HWbFbvPQXSuFmuX3DcK8!I|quPL`Pq3<6Irx+7**c4)<%opN@_pz6gxXk=L@Y9ghPX4N0#YmACgk8 zpNWw|g@633`TVAqqH0gM)5# z=7YmQsVFa^unyWV`Df|Do3Eo3+p`KNag_sNvX+Jvq83rEZiTZ>nD5&95ez$21*ztl zU63JoCg=F>qZ6{9-sp{hojvgLJHcnu(=%T;G!aiQED@=HjD$p_YSOXcK%g)(C_}Ci zEK62i#Y*h?5cP0}^9#HEd15N**hq(~@C`Q-QLu35LYW^wae>k$#cRE`&o>`9pk;1s zzFb@(`GmK%W9q0r#GqCq51k4X)$YDaH0&>z=(-5xF=f@v%=B^PXk)|bxX(KaYxY;& zw`o%xJ%mZXHe-i{a*Wq$WX*2PVdFnuS-N%(%E`G!P$y3j(idQKb#aG~&FP)2ET5zh z8PzDE%dV5bn%S-+!ZhVyf*{SpS@)40Zcf|%7%6i4-VxN}lcA9TF2sIyZs76myDJRd zC)8cEg6KRpYn9POFz=$M@vaY@!#z!^c(qxu{<;=DG49B=+BCZ}M1}$GyWp?Kzj<%v zUpz0PbL&LH$KS$rAY`^tAy0V(T11D{XzQ z;$^7vPcdQ|>%tEY_!T>{HdO9Drn;#e8(b<}&%-m@Wt~jvrx2KL9*mjCo_<1Ew3vRxX7@SB zphvq)(f2iE7zg^|_0w^+mSN`FgLRT`;1G3*S>2_PnI4^!8m+6`eAUA}xQhEI{v)q* za{idjUqZ`>t+_P$xtK3R7Byzd%8_w#8j@u)pOTUl9~>T_9UdrD$8sCt9k#jSKBR+R z_~&{;>*{|MlV|xpZQv4mk}B);Hde~`~UgeTUxIM*X=!T@5<*9Gsr@J!|i|m*@;)nl_Yi@-t#U<&|vUE zA^MMl_Rr2hG$rm#<(T_r>`CIvl{6!hDb;GpLj^nahWk^}#`Z*bc7Hz2KeIMO5gQ@G z@X8=&hU@GFRI0_FhQ_~${x%^0;eNnIW8eEg-Q#Hf@2md+d;ZrC|5N||=YJ~S|1Ufj z&mDH6ss?@a!`J`4%dAHuE*xFxP5bY!mnYRzDR+NJ{*6ljZXxwQh=BiH+y6f<;Q!<2 z5S$df@J_pPBt_2&hu-9m@U1b@s#6^P31a_VhUyeor=}K^jwb784($fK^_TrSlX!T=CBk>AX?&lG4&ZbwmQilJXB_+qpz8lV{%q_Q zU3v#~GaQP$E*D@A#CgvtSS~L0X>8H{_dBxep>Dp~GxCoyO;wK8q|9rcv+N~P$xO9;{@!g`j&E2GXHrZ2zR2sj(LysFNL1srxTu?hk($i2#P((NclVt@j zAhtfRS3Pr4ZJq1(6FICn(iK6BPi!43eTZBMXqoD%dqZ<1p|@4Va%?WIE`qXid+3-N zE%|uMc}IOp{K5Ouo1FA2c{_YJ=lq|Hi`@g(G&fT|`&{Qglg{kD>iqTg){3+-IWE(` zHC(OB8z<*9ak@}?N_pOO&8~QW*nm%cI*FhkVaZjLd%Wi<73GHWn#($+dR!!0J2`iF zZbI^fOye99*JX~ayi6*Z^wIdo7g6IahWh5RV){A<+y4YP&>CBq?^!Eym{9MxuoX|& zs1xR7Ss@AiTG%a@aF=*7D{XNha^(@Ye4n~HO>XZLi{@B1rwfBu{&JX&_B+ADwc9i7 zvkRl4Q8q=1f-gc`{lXL*7KEasP4}(c(%eyxw*vzGFn#%NhKNWpeW5d^RBZU@uwQ5+ zcX`3(EH6=NXNQJZ`laPZ`^Cg**(6EQY4U~rt=B5*X}0lr2?r@*xLh&phzpTZ%GNBQ zGd*jkcQzgRv^X|}%`F*ok>C9ugr{bnI@EZRhILS$T?RQB*637m>nmQYZ8UnF>}(EH z94pvtOweKcQZqv7cA^qvX|47z~iIg95gkAK+xWdxw4@hT{{(62YEhFj5MncGGL=YTPy3Z8>Qq^kgS5S;T~{BpHzMzNqA(7c9N0^k(mx2AIa!vw zZaJJ3Vmj(;IM-Ih%nchc?P`rRGjU2yo?qLo<>w?IvaPE$*VA5Jy8eVVt}@!Tu}W5u zHHBZ6vJ$(sv6GqO$41vY|MU?<8_Cnf+CR|*_l`_PP+a#tNwP|Bc3wkegmaRxZDNpSG}?P@X7jFA z%7y)G#x~gBRCHcLjAYCrfxX^?o2VIM35-{^_d@<&~G@)m1SfC=C zKk>bobgd-oJrI6pWdFD&Eb~g}V@pb5Cae~OFJowGUE6@Nn0!jnEyAHe_lVF}!EHEo zqI^hjU}S80f#Q1`8cyhRdb%Fc9f-8Rpxk3ta;Fh#c=j_S2``Xn_Z3hB)-kn%$1{dEg#1@CQe#pElLUEMD@NVQYS;ze`l z42fvDI6dFkuz&j8OuVPV_i4Y~3fyQjY~T9>MpZU`#;3R7TRE7cO*`XHmX=&3wPE|Y zwNre_)SJcV77D6t@2cmOUGNChmqcmVZ0)R5mbNi_`$jz06QfdE`hd@Q8*Z%}aX~b- z8G2B|gXDf@8~nR6uL-a%J_ar63v{_BVOii?@CymJlIq~&V;v2X^~Oum)F5To^v*eZqI(fnEHaig;wbNm?OHsxGCsI4Q( zCZ$N&Gv(w^K4vKKrRa#+!rrjw~D3d&x077WeI5kMTHGZ0=gQO81hlh-0CY*T&G;U$`q@6Rq=jXijVTJ22 z_|#w8F_{XvSo^shobWbLPL84Cuy`>u&&y?4OfdAR$ z3w_C-D{po9nv7O++Q+eS?ZcxM>-PO%0lTmkqlcxB3z%_CHcI7q@KKg!=*g;V(;KL| z-=10>_cnXxG_0~X%aRb9s6Mr0+_^I*K&iF`D>@5kjMc&l#g(qMBOeATbLAau``C~Y zT1p;L1Ur`I)$x|>Jc&N|0qb1Pt;xQj9 z`Zc-pFZ)aE%Ow&0d8Rp1p|sS@-#PQHO+;;-L10S!C52?G@c_aX<2D`x1F+oEL`k&@WQV z-Gz9ku&i&lN_3U|R^HiU2CR6XIdR-K1Ty!I(;NVYDNrh(Q;Rnv}7i!p!2DZjONcPy%A<^yJ77&0R%(-4w_0 zXO>^f2@7-n$gp#hR#}_ni#n3upSc^FC%++8Tq9|6z`hL51Sv_S|`X9%gO&1 z4}hhqMxEEp-L#x0F3&y@XJVn3kdcs*iTS}?rhSRpwzyA5zF=?=zKYAxuj`Rp6FBg5@M}7*VekF zY*L$oKFO_VK`|SoSnQEs>(T?2>GCXgu&#*sm`X|r0-r!?g=rN~^-`7G`EogUbn9xv zP$Ms0ABBIyRc-D0dL_v`vZ71y`{U2`m#0Z*d2AwgE@?E&lQms4J1W1=cS8=jWoKMzDzg8RAp&s3utGa`$B&SJ>!JTC? z8Xk-TPwlV?^fo|$QzfseHsO4k!joAVi)fGv^Tg0*>D3^!%A#N3cBf5kvUPG~ur`h7 zzN$KApAfjVK)O%~7b$g~Pzen(2nUyB@wRbHBeHKH}wDErtvoj6S$SaCSvo zRDn;z!;5#*`G*dhmtS?4D#bCp!V0TaASQ?y8my*mr3|k}$aMTL)x%bw_=&LMvzktF z6qkLOlK*@nO{ZflnqRw6wB>fh#Nd2R+Q5|&Zu?m)g{S@=k8|{E4EnpoGl9!Pi%exN zJcmgPUei$Tr}S$zj4;S+uSZg_B7VNR&wv<|hpc~#C00^F+6dG4y5tv{;F*H6>nqX0AA?}`=jzKt9JFA&-kM)$Q|H!eqrLUjYIEhEio>3NHoFK zXzE$}$PEVhP>-;>IG>kP{gMHbH7U2N*Q@ijjpF#~ktRdGr9vxdE58_Pw)rn4gzk)0 zAp_E?8zw>%s2OZ3nG_E9ylj;u45+tG74h(LBdC<_6TY)TIk`yA-X!hj2p^ak)p|PB zDi-0_b&<1#A~Pm_lC=Ss6Ky%7ahSp3v~t|gh}Y*foH$xl_oP?85UAnJ*fe%JDv+8% zo6)xV9bX|p9Jwiis$=mj4JC{?w7q|{OS0bmciS6wGYfMoH=7RFpC3{MpU4lr zxLxDJbmVPJLLoh*sCl1gF-d6X<)ipvrq-qXe_Yimr0vM3RzKLel8e_th~3sxBi>{k z#R~Np2Ha>|FYQ33Y$Ttjx8|DqGw+aA<;wR`1lv#P`l<;w)|HtkU{>G}@srp}y*S>O zT6^QJj#+S(W*|lZJ)0v#O?8}6@3$0HDjHYSwFxmD5v_|iDihtzYn>q~%~zR~2(&Ut zbuf_3reioL$~J0j?L6yx_Rb#jd3Y6qb?`nfWJZm+gi;r;*wtyr9|@;ah{srAA2P2w zWEtm_w2rFyA6vl6fB&#dZxNq{{MDmff=W3&-m3sq0=W^MJe^!uo7_SZi10Fr50rv)Y_{yRtOatpCFqL}j_5iWa-JDtUQ)((qR*iI*?Mi}h!qJlk@-03l*d}dY4IzAs-FqnNCbvngOUq>N)58sKqUc_b0p?Gs6tP0cdhz`A8 zaV30m&8haL3|?fka%*pQ_sjTE?^S=gN^`|`QK}%X z)MgUOB8ambveq+Cb6#hs%8NvvWUgcIu87^xspmvjl1up{`?bs^8b4dxTqew&d#<%;jopQN?gdwoF6N(35YWjf5w%K`NG*8P#ekH`!1uUNtSIST>@}#gPTA z&hDyBJWnaMAouF@>hCR*+RVA)-S(+6=ha&wW*EFWU4Ooq*!%!yWWdnnFnq$vQQge~ z4?*>_G)kV7DvujY!Cs@ zSW?b0AuGufWFFol0#0X6-BV!$hn=JriE0-kT=!9WLqo?AC%2y0&MiiAG;*RN_4m9# zHf*8o+9t>pMziLJL#b=8`F`=}SgABg+yOD0cYUbC_sbRFILG>`q>Y?|U>67C+!_eZIMqZ1f>T%2e)q64xTOyK4gL`h!G zEcTIR-ossgw9C3wWd=2B6ct3Z@bi_h0I4=<@hX^a`?v= zA$#*63W(`EMCDLZ)^r9GNmV0jnlK!cUhoRXzExT_y(srCpdzaI)*yhCW9Lwx7noTVELXo&hECbe|6Gs}Al^znS z$#M9@nL?GTc%B&Qe6iF|y1t62VMJ()5fP&8IYm@iVpx_hB-D1xwZl%G3(~j@SAQZn zz%nv;+M6_X^_xvwBt)1hxPv8i`G;ZphmNbGAz?_lC9o8=3Xr8pF_3cAY6KY=IbDxq zswWf=ot2Nbo;68@_Y)V$*=`yzC}+pElw<}bGoEq zSzx$lV{+Soe(I|x+3Dl4?5RTv?horZ(mvlO_C=`wx-a~a<>XFJ6AXHObav@9U2V6qaPl1{ z)d3qJni4PRFm$~$z>)qnXxe#4FFY&^G^UPhvwBRT_L&J4msS(IRCl+Vm3wbO$d+z~ z?Emc*hm)EpD5%d^f7baI4P-E^JXzyS=pCOv>#RWW3uQaN5$ui(!WggA899tBdc+%7 z`|t2^cSN2B9}*K2OP)qqeGAWMTbIeCXPd7`n|jQi`@vRb`fA$MeRLb!qxYf`?~n?{ zHZ2r$jt^0H_fcX_mJ$mKtv!1`@d@ekcfUhABIN8GpLV+W#CNjI^Kg5ht~lHD_o7i? zZk#(l>lcjg!X#BUlQ?+8GffQ~+Ly^ca0*5PVFZ8O4)@aI!tvs6m-?=}w3TlnT2LH6 zDgkqUQ-e$Y;4?3QruLzYHPnm=TtOD+D)DL8k%8K+s zQH7YA7eZsjU%rt@bH44NBY1e>&J*W8S-7;EquPFxqgIlc=5^=ZJ-E)4h{aasH4qx9 zbJ_^^S($LxQ>$>cTgg>NB7%X?=rVKhc)EoJhrVQykSDP=TjxgrYeH05CVcwz?{P+W z`0(Civg^^BDj~h=0+*A>B7=!Ei}C6+c$+)7=77aFDYi3xW+8quLES85@!{qfe!2E; z13_2tV=Iyp_c7x${e`45jJS{28*&&>qU^00EI!QMjHx@`7DN({WBsszu9|6Lyh=){ zZc%c4A&+)!pH-`wRbESk?GJ4= zC6mpN!!a;OkUDKj&d8FVMrmeC6Fv5t_}aA>{6$?5L>lPeIcyFMH{xT{HBYkU0_mR3*Qb#P3K z_3_{Xb^P^^^fbivMpe3^oPtJ$^;VgtJy8Xs>pZ|eg1XNA!aLF2X$NszjaGeq!fb!L z$_-z9Xs|Bbps#IRHoNoqzLTWmdFGdfEvkcvz~Pr&Umf(YIP*+Sd+8%wh-FW}vIXPu$l$?hIpc03ZYW1UUs&XuGZ&O<6_7v&wYT?WvB!WzymO!!{CMK7g4dE(SnT#Tt!;@AMs7v zJhkpEjf+RdDGVz#`AVDd4(4RR!bk}_3c2O>3(E&Ta2mYP>PuAb5=C_2P+wY~=8tG1 zH@$i_Vli2Xn9I(}Lg6(WY~A$575^$diMf@^ebT+d41#PXAUYA#lSfK;?zTZHxl&K+t=@>6 zD<>KvjHu4vth3ePaXp8D4!rAMRo@~bomP&`HcNtndb|U00mNCcnw59TISnJB3GU-2 z0WK67&1jhnDhmciflnnP>Fd^Z^DH!p2_%cHLI>sD*ST(w{OQoxW)>9ebx&Q`=nH8V z;RAOSM&{})_x1~${J-#P2lP% z!!ve|5^8Qz=H_uqRA_`;5^U*)+lU8=c|m3Kb`s_UyoO6BCf9C>hLk*vtWSv;O_mSy zaA-Gp3`cttJX!+q7Zz7{&nKh>1Rga@WsD;wq%M;RRPSl_6JK8_$FO=rqR~}aH24bB zCW?)N0j2PHbRH_w@9pRDkLgH~3Y_LT21j?@IOq?yUPrxrA5fOMqVYNp?M<)xnz2Pv zigMEmVJB^kys|$AG7FQ+s-aF|f410IWTX{!l9BVPj#rmKkHA`9#y%=mV1tW?N8@kpuBys!ahKbkFF_ zV@gVxd>UYoygRHT0&58rSIkZM?+^sJpU&0;lWBa?{Ws95x2v6Cng*Z*l1WK0kWLwV z>58zY!>GYHIadzg_87YTJE{loTiN~>iS1C|8(BKK5avOv9X0a+fAf%dEiL{?`k=*4 zqJ`4pW&s$M>>Kh>EvwR7uYNC2To~;&yOE8X*iT(N>hYHMfMX;S6yM}d=t?_ zO7J(3EJJ^K?seqrbbdPRA;e-a#qGS=n2WDk_vPtD-reWlzU-VX2B_5j3eBD#5YJby ziwKr)T40iwGbLZl!^;t%ADhZ#_w2=U$y%bZzmFoSv;G6>7wC6gf*hZ4Fp%y!rpHrz zajqF5HlmN}XILken987-B=LdCXr}xnQyb|icdTQ5bnq^RZQSG-0 zi(lk>mAM}BrHcL_ZR|&$Wl4~U)(WH5wPqm9ep17=F|@}M%>ZB1_EypakdZqk41+W_d3|f zp$>H0{r7Hvjb)NY*7e-Fw? z&+na?nd$GRfBjk{_$f9vGqB10acK4Rb;~O&+LC4P&{&KQSEJU~Im#@2JiWW4n6lFU zK$Gz|Y+y(q=C=S3;|`x0ruh2$+~e&52?jHb$ezDpj!l+4RKOowB&DChpqrfD7FN+W zHR5o&2%zE1zkhFqly&o-eMwC zY(ULRZ`2WR&?R)!t6ZJSMC9#oQdsOeWL0Wn@V67YoAJF(*Puro2@QGjyn%G-&`Xn+ z%kJE?@kbv&u{01Kt#Z9FWUfmJ#ck*2w(T#vYrOBJeyZO{t4dCW4a)i$=?*@Hyw5r9 z#RYv=$2)wU2jaZ0DtETHjn)y5ki=g;HheD`=C`Qbx30OlOd&t!63*1UzmNTOu%1Q<$;VRL;h zrdH(4bo@u+^v#>zrXehU7C`ygZ%z7Qw0CuJAr^(-YW=jXeuRyknv_*#veF&82&39* zX$DF&we5R?IJf&uE*@UQH_!HgQP-)`iy@VMSL(d`PsztOOOAY9JP##@%&tw+-Y`5P z;N4essfAcIpBEF4iED|0tROnN2MscuFe znUC^pxzM$4@J2t`+oJ&4P%r{fAPkFnC9GJLG3v%hs!Q@v zWS`!yU^$A63>mtgM0kP67c+`FNKf#WI`7KOMF^)%tVE2$1owYYn}bo?1#B0X6@O}239%)JGgZIN`eM@Ck<*VbCxF)d(ID{Jb zjA=iMwyFf#J~?tPuoIzNM(8@KVQa=mT+}D2nHGKaI5GfwD2{mM@I081=e4ua;x%Z} zb|Dc5*n|-RRvEW4zP@@gw5v+S6|f^MJ#?vHK=EqTp7A7prQHWvGzcr~h;DFZeW7xE z>cikdM9uncH%LTxJ6p-i4*_gApkXeC)vda+(zzuNA74LdU=1k&Q0hSHrV=2*gi&F- zr(Z1;vsW!cEEIEX9UORUceUKyuD?EG`25+!<)H2!uvFcyui?zFQAS4l8o22ZO*cSq z-F*CXdj*u3!1(|G;1sAaEp^UzS~qS$`6>@g?gYB~2F+5V^S#?d#ZCjM;F-z@zD)Dk z96qTIw>MEMt_~y9qnGP4TMvI9R<_U4Nu>v6wappk4>&aJ16`(n&jOw5;&C8;HUQkd zM6sYJe+1BKvFb@LFpw^eFLPrOv$8G*y3MA>j+Rk3#>r$#N*qkDtXhT%Cz5^c+z)%Q zNIs25$jpD1lSr@G9e=TOSz*>M^pKEU`?NRrWI7e$i4m60J~F+o<0+zcLY40@Ww67_%M4Atv9(TN%aPGaGJRTO)b# z`&X76oGk)K(iw8V+5+qlu(nuOSj4HRv7>WNZD&9JOGP>`I?4*vcNq8YdT^NHkF(Mh zU$>i;CnGC!czEPmT?0J#WThwOdU}9&2Ov89BZxma&(-|{!{~QzeM-+X*3-kneBQot z;C{W9#;m9{IXQK8bp^C@rT3(~U+T30YCXGmT6}m2=d-165Xmnh-^Vc;$rve*K|G7W z8$@uuP#@YSEv<>zYl=X@0S?WlmW2uzM@!b2B8z2NJ1&eGPiH9}Wt+zu9`9`}U$Iw; zWOlF_po2D@18tVm{WThm4*yyoV7wgcS_HV03Ol8Y<{#;WE`OmdPNQ9%u6?m^AS^*Z zPm{I;?Yg|XMEr#g(&$K!^+_GV|Fh_`Jcf})W~N*W7x=>jx-3@VjcHH}++<(;*1iPw zNGJ)?$hFfOOq@)A`!m~deiuqb!ditrPZWih_A`d{7pPVPi1%tT*#%i3jUH%>#Eq_Q z9J7xu%i^bjz-)=REd9|gJO9wkZBAY5&{osQ?{O0og1i2E3s`w@o!I?ZVA32yD0al@ zF3{UOPftNQX9@w&sAt_Y>ry! z+ZRdz`rHKY?pTosi3|ul?_2NY-cO9^#iJu2B8m8t@^w6X!@v)*FkUD zfW^wtIJqH#n^`4l>h-|cc*Bh#dfkyu$=}Kto=^J*-_HncwZHYS4H_t(OuIw^dM$QJ zARpzwqmGWa@T)$2u77(7S$J?L>;e}TO1n;LG6g>8L;H6#Hd8N#?EW;T-xoHFltlkg z0y<>=?}VWRp|#pN;i-#6ACwUt)VKq^u+3(z%HePnq4skS3i@v@AMre#Z9;HdWimHA zKreqkiWQZ&ud0#25wH6rziqM%@53X(sAqLEcmEt?{CnzhcP#-^K5gQMWEq`LE}Xk$ z-u-jd@9*RPcEoY^Cg?fAO=Q_;VG=h|ohusZD}?jf6=S4us5?7#*h^36fm7bg0TAkb$$|Ijyb=;+zF}zn_C_iCs>5k>V+iC%%vM$cW>4Irmf?&n!j_b zKob$qX+>-eU>(`C>k5M)DRQ}PH3bFcYkyjq?;&B2vobSbeR)mc0++`pNhsj=bu{aT zKbI|x!5vcQ<33PTavQC#0BN#~N-P{4LJs?fF6we}hf|sIkICLE6*^iutBhYfF9}^- ztgu-wmW-!&vIYpMgXpRDWcmKSHBH3DL|$F#8qMD;v+LA^>-*q=90e2GYu}cInv>rE ztphMU`$che;ye)c2@|DBFx$Gi#5FYu{jnwDxu=r4PHv7Ol!&FPYwVAVRaC~IV&Ham z1Uh#8keg9(VG%QKsmo}G&gT6gyw(0~MZm(t!ER1Ro0EA}r4 z-Jd>vZa!Kb+_T~!JqX4_FzA^F2CzqYOs6NyH0uED9tg-V;Lku(TC?6u|K^RQr7dD_ z{_f@2-_yj1+C4!z+e3)vplYFEdm+Pj;`Lu9SR@G))ceLyV7kbDNpw@c9?&nCDYJ8$ zTrTIK^;!>~GYSWPkB{du=*DA@HP_VzDKwz`m8$`k& zu8V?A#p*cwk(d*lJLGPlXaN#z2m)G=AT6>^#uNctDlCk|n_isU2u#h!FOML-;PZai zH`q@>MZRh#qzG!Mo%dN`+ri_lft<6v8N34ABn+9SCnee3OxGkdcz;*}p@VAMy~OvV z2Z#GA<(5#S1BBZQNaES058iY|E^Kd4kB&NO-CRQ^Lm$bBX#4_c(X1tF2EX9$A^d`Zpie}I$$j;jO|KNR*5}*{L24FWpWe*I0}K>ZlJSCljLd?3GPJ=^e2jt>iqF*6zv^#=j&O(T0TynxR3VSc5}3#(bE%Tn<>&@ zs14@9Fo3OMJTRx^?bj~KkNOkwXydm=e-Q1tUPY7lGC`7mDG z9D|}p`w=i8C(A4}HOzBMOOG$_qU5hbiQ}@u06o439ThdK&S^d@D{G^+#$~RD;Lk0d zWe8x2<8fJDUk6qe?vp3QH+gmI#wGz@1EQm&(eXJ?N3O3RwSfXM%(Mc)>rG-Gv)Oo~ zEW9H_!7Yf_h*v0j^7$4tDI--9iUy$23Y8Qad zy`HR6Bo3xhtsI=0sj~oy->$AmWn~Zv5I_Q`5Wt)fMTm;JI(JZ_wWzx)1x0u$&UHl4 zm`&8iN~CGZL;=BS{{%E$t&-GeTIMXRXf;6_`<}-KL&G26zRj+zq_qmB4UFWfmVp`z z=nGI{7J;rXD7?PFP{>g`yBuR^5~<@SJ~JB0g+=Ni-e@dIg2`3x?%qC_@h6%;2X2o! zyw}gcPII7hkdl(h4-K{Z!or-auz?EtpIl~bz>FOaB#aD1)5>Vyz|EluGq$kE6J~SR zRs)rzdOjZ*d<9{g?3`?f5%uVmwRwL7A8*g`vW!we%Z!%#HE5kE)oKfvOLPOfwP0F@ zJ`$!k$RuN(v2ad0XzM_H$k4=u5_zV;wJIrT0sbrKY%ynR)~)pLq{ys=6S{-yk&&ga zu(9#_6$`9^9N3{iE}9J@{Ch`VuBsno0EsQX$c%}p1OlSfRYNLuiZB3NijZJJ6=L(U z9GHj_pIT9xm^7hZ zZb22Sr@x(oit0T@@a5qE;Pko~>FJ#}x)l$5ybe~<#ADg5etQmvh92QE8-8muV^=E> zp^VSlTVD6$1&W^UW3uo(rG&{jNdg`Mo)4davUV?$({Ok86r_9CC-Mk=`DK6yXK&v; zzP+)+f@nm7yligGw@Dg_2y|wFpEhq<{&QCA_H7S<`3kf_ng^67*;I+9IZJTBz@%4J zRt8uU{5<*-QbEcVEnWIEJ}T7zMnLe_1x8q4WBL2}9dAutfbfCR*LNv0Y42k}jJC$P zD+;u(@YoQJru>c2F-w(*v<61@(hNe!$f!bhO$PMKGBQMngY&H)K70tl^P)9dbQg1S zAN#~qM+9v=m&b1Uu!~F1iUHhPTkF=fJ~XNdeuyBb#njMpO}By#nz}~^Vj?1R zy(1@}vvqP(hd3()F~6V|+3UzUlS~QcWx|c@n7Wg9ig{t46Ku10oU(WWeH0 z41yS?mVj^5JP1Ohl8~X?xs@O_3OVMt(o$yoB`lL-;PtQ(s0Pgq`QAfw}kPul=`I+p900qx>o`aKCFbhxeXw}NW zEkE&}%G0b02T>oL7PRa(FftK&YSOwIb>`~O!HA}OqwaXQ3WXbaH6Ot9^@2z1{`roS z(xF`Y-v?o$Fk$6q3jAvDUGc0&G61uV*7_=#)D_QD$B{6y&2ud!t9S#!1T}RI+74@{ zF8xthCMaPb-T57!qgs$cn&*MRT-Bhrjp+-TZr2-ERex;8Kff;eRhMPkmi7VNPZ6I6 ziyktx)%0}GKsr5jtWe7Zl@f@tbgiA8*`vFlcm*h4usZPBK>*J{B0gN01lWsZ7BkJH zdPiF$JC|n%faWBBGF@%O_X2|)nU;cL|8VyWJ@c|9D^$9b5~HG2T-DXZ#6Z_%7afWG zHFeW5IP^=jN5eSVJj@`{dm6&khDLVJP;7kgfkYe zSqfC9r05xmJScr0-LqgeUfwq`G11kP1I9KpQ?%kw?ul4FGy>p#L9eYHMgB@bqM>n=Mq{$L~Unr(H3+$VGa({7o>8*i`G=v*x1-m zQcz&<0^}C@&q~Yv{W3Z_I!jn*e=q*5$2v8chH_-&txvx|af+<~V2&Wc6w7L*Z7Vl8 z$L9k#56Vbj1Au=CKAHRp@>*)DSOnEOB-fLx6G&g<@t-IxtjcMY z7Yf`lDa-tQswfDaZuSp)?s|DSS61d)kjkE&UCe-<&2_aCbW8YrP$%*~G}Pa|?{;yd zi0nmgy(kQg3*FsWa1;<> zuQJ<~550Kl=$S#a$==Sc261K$fPc^#gEmOMB$-4ED+s%9+VS(>sVlKt`~C_p(%2ZB z`EZKe`h$UVzdFK+l_&!cW>HZCCODdSPNzb<4s56dq2jWXMq-p8n*4xlC)6F~)w1Bh z$NSmC14yj~J#jT|Q|u6$+HWdtN;D!RGy~cvY4$~`r-e*fvYOu1)`Ntrat)u-rmvP{YC^9*zdmDp}yVG z(e(5*hUwpzA>RM*@xtAm+4KK3mH5-))BpFu!vAAt?*FfW#D7ln_wEG?n;IE?;{Gpp zp5+1m?{(@95y!nd?=S?U#VDt5+znpEGUj-64L9mMYi4tjmb3N9bS`K4Zd)sG9;uAUPwqM@YIJTBqZBc zNJuN1NJwnok&tjKqAR30;Dx&uZqyVSXN2hmo~$dsUgi(>q(3A#a96nLa&fxy>U*fIL&@@kKs+$Y}h2vC+7kadFN- zhCxi3O6G$*W&|zLH*e}9(_!%hi`OBehfETeE+EKA5@uEocir~oTC2(Jqfeu)H?0*6 zOqinJ;P7zaw@SOZSR|x3MF0G3;rsh5Qn2qoKX=go`8h}O_vZ(WoB#aoi2V1b3*CeK z&Rq3s-sHc({ygpN?KL)il=IK0e>VI4=l%b~uX}=a?eF*e*R%Q0(UAUgHgAZYev3nt z>TJ){O2&mt>FsC8IbXldHD>ha(W9*M?dILZ4%hf7kG6TU(Gt_c95oIiNh6PhgoNjQ zI2x5sSS0ta4${KM6)-h5HQOBIH&0?~YbzPY6(+S{Ew83_o{{9GeE;V2t9P9(zOHHT zrlFycmyy9F?8#K1y&Yqwr$?6fXHiT;!+oX5aA#*{Wn~3fhXelw2;F zzTENq{JGUXf?fc}d^MbUA%@-A$w|H3g_WIM1oE^6%j#fu)LuJt zWMm``jp_@xoAZH*wsxWg6`~DgsJgPE zV#N3-lB?@^9S*ITk1rxDT;gN_KLaVQbF$Vv?rZ+`_k3*?Wo5ImG7N{KtpeS)y}f-k zHMM|%05oE@zH;kDxMr_lR6@2-?P^Akv9Q7@5ww#5pO(fenF9n9Mc~?l>!-^OSINuo zJ(i4}TbSG1-CA1Rh>b(w5D}@%D_1zQK4gobp$d+S%t%bs)`f?uxGv+hYu9v>lR2FZ z7?|iX($YQ!1i0?ZwI*!V4sLY)s_UV9`OwwYwc_k zm5{Krv%6RrHBTqKAmVf~87Y%eoLXp)f^rZ^Z*PX6Q9~v{MMX7QS&1hhi9J8XfBaZV zmwHZzx4P@jr&w56yq^+7F>{mWf6upZI_;q^V7+|# z(houPnt|bw8%)OD6v@)kQgSaFTRXwM8&`8LwdZ27Zgyq{ndHW8)JN)e@8smL)CHe- zafnC^ba!KLo}{8~SX)_n@%gJ0b7Jzsyqcez`~Ca(g!QkJy>-#l-o(Vj%T~nBu11Z^ z^2P>@s)STVMuzM|-sOdvrzKuYOiT&F$Ry8LUkZzhXGgXCl+e@DTUdZe#=ykH#=?@8 zmd4?*^#QMOaToL9Ll{FiKyu&o`6(R2?CHxdJ}D_%oAB?CAFq>>lT+Nq79{{Db~&r-6okJKxJ1Dpcn#BKL4 zCD$iuOA-d!#>P~sGP`^G+dJDb)6!lsFu>ObeEI~F7Ote@PfJ>Q`eQB^2V=RubeYtF zjqgxkp)$hcCMUmtXXn@@pH24iQ2PWM8{5px%+k{G@#Dv86*kM=iN1-Up?w4ou1WNc1b!6Y!SuH)mdaz=Lq z%(O|vFpA~hJVAd;{lpfpDF_bgHBfC(Opa!)2Q#kTT9)EnB)>eBO?-VuWzLPZK7v5JLrsz zj4Ovn-@?M4H%lW#C@3l63GNGwyw9IMM?@&`@_q~{u!7P!S>rl-)ChAJgV)B!MmbyP zHlK`4VOEvu6ZB6x3NRqi(b3`I*!%lX0=dORRyOCuVq+&NC5g#GU$VX=3vJcPhhb5U zLd3=rk$AQ1$%ML63jTd?kqTWvr-4cdrTq5o+XlC%r<7-}kH5@BKCIuhD@ z_xLw6td<9|Gcvw7`Sb5NRA)zEdh#T8JG8fN%BRHn3TbQ4#*CJ(udV42G&3_WSd^=- zm~+JuJ08-IG;Htltw=+MDKs`BA|t!!%i(^(!A;xQ)FjBm-QuSWaibiE8JURQ_%AczAf&SlBRS?rF%2B5&{QiHQr}y^Gq>*|w^q zH_$Sl0=3rpV9i&zZN$nfRw8wEX-P+4-*>W1N?N+7e|WgNJAWNY7Xbq!V`fIiiK9cy zcTqmR`VF;8r~M6Ta&pAZk)?!0Aar~}cDrxeVIH2hlarHUSgjY1cNcwpeEOW7!@|O# zu~SpcE-j^HWkv5Cz20XVA0T5i==$MLE_oe|n25n4FC)XqNqNK%hnD}oKYSBZvP%0+ z_+M#YpoFdMe!VZ6BgaIL@!*%5hi_!X#Qp@V4svpE2Kf6!WiV5%H8V7Pc|4$fbq_w! z(xJW2SF~PiXLsKi%Z_4xES8cT&|Y=C%g4vJy1J5fU5w1SruMRZYfC7I7%Bke%a;*R zQM8JAKh~L%#lOEIdGX@K)2DS^EpNr;_OpMtw6>#y$a(NUGXjQgIymIkVwWp$ENR&n@{ zN#NR|Ut2HCiy}I_ec;^fHYZ%C69n*?Owh5r`uo)i9JY&%2OmCs2m{y0$Y5e>a^mb* z9PWkAJ2p0EWNZv&)hHvgpOGP2O|`1Jy8G&ik)}d_B3%tyBN+CtP?htq*noV$+|^9;XF=-#bPB@&6mTJ#wF^)&2)RZ^chL{qwJXq3?fy zHo()r2SNI8(Dxsl{x1;!{~K8U`|We28R_Z5l9KM)`CeXLP*Y@a{@x$`NZ-D}LCKw6 zm0GhHe>$j7p=W0uXXl6Hxmnin@wH}?H0;d|`z!r9G3@4(72ZRCzt8|B(UsgDrgOb7 z>T6v8YWK5vSVkD~n*AAaw>sm@$BJ6V#-j0dP6G+ih`An7*K6go*(^;>EwNZky>WGQ z&3|b!QN_whEnbwD6C0bDINKG^$H>6IkLmyE6SBR%Js>D;$GyG1tgP(LIPS^Lde26! zVtFbuvW1cUOqh+oDJTGv%1cQdd+}`5_asAE0cJqY^!h8o={ob|*74aaxx}joG2RyM z-9=ANPj79kM~{k%icCyRt9?=7NRLq6FV2ov@LPw)90Zcp6o66LM67g-u<$((}tkQR;;P| z@#Br+l%4}iTqiNBQ6IiOAPWPgDA&!2>VbO=+zxr}lU%62^bT87@9TYDQc$>AT56k^ zh{-A7P-a3^87(!>RW7G{{`?m86^BI{N#M-&1qw8`u)xO7o|>8}#LxeL`1K5C&iBKv z_-d#9hi;FMZvyrSBI3k*_^@YejKi(&X8umSkiUhMRl>!BRXJd@avXeofV!Rd%nx~? z%0l%SZ2T=EDY+R?XlG#oWaU#JT)<9<@)I&LAM^sPc@a|5L|O*3=$M$=SeCCRmC4ET zW98O39dX=Fb1fZel?DuWBUo4G*D?@0$hR?8&WCKdIoO%3QaUp;_y5|N1pxWuS6Y*pwR==bzZ^ zO-xK0zQ9P|ymgDS{f~*EVSY*eV@{`{xg;n(G~V9T4%@suJih?F^z;-|V@pd)ngilK9~}y1TpW z|KLv7lMl$tGuPMe?(W9K#0Ze%+ilMb7wV_ik{=&Sxf5_(KBc8KpY7y6rBws~<+RiA zIaM;QXL*mX_A)0WMG!eXEsX_c;;c~6kVy$Z4?sA%xw$zxH2eGT#*3==^&h?O17D$0 zFMFq~Y}AuK>;ITuOkCW2qUy2Rte}!oM0of>*Zcb0D0q9*PobxOZr7uK{D6VtYJ83y z99ulg%1%yB0N2n*hzSV^QB!9h9UZmGqSYGUHj><@I)@^Djufa`2_q_|J9S0V}w4L;tT@}SLf7Ko0n(N+Z0e-TnxRF`4s~dEu~+; zXJN6oiq(1nz#T1q^YHLkF^o+8@{EFhr&h5CMd!xt2W58aBYD&HFdLwex}6QZW@Ib| z2;uhW6~&7eP|)OjQ3)A}i@MUT?$p%mJV~Fp5)l!R7dl?R!p4T%_DtjVC4BV6cW-y8^sI&1D&@C!wLo%pV_Qv(8|c@ z3Qb$FM1T2mZ~FPI*Kq#6s6;R&En#Kmyp@%cGc+{3yNm7d2DE~)p&^I%Aa3a(KC$nw z;>*jGSZ*2pmV0=p`;wCKaH)It?06U8hU>{5hI739Q2;)amG4Zh6(J!Z7E>S(Ky89q z;%)Ek=;&xVQe=1usItTyhs*!hk6z}pGy46ONJ*>|92`NTWOckV zf6&f%^E!{5oSc)BQ`c}I1D@&5x0eP|S9fJ=dnXuFmaMF-Kxptzu09j>y}PhX>^H_R z7D(V=wCYuPMMaOuNW9S5+1b078zw3Tp$ORwy`s1qKQuC2tWCs=3@l;Jf@R;tq$hhju`LF@f9sy0p#wkzDG4} ziV6w}Dk_y}d3n_nj#tqa?sWKkUFJHAk!(^}p_S?)I;__SbnH8x1Z z9B77SW-03YDmyE31_n!)l99ijctN4|{mr*xWPFzdlp8uSITeM&Cb~_SieKud-__QT zv$-69!Kynv5aBFHEx?IaD%5-Y7;mD&mh#!vqoHHMt;zp!0<#nJ$f`>;&%XXaOx`r- zdVVRsm5Cjv`y~9poKTbKLYq>^TBSIMf;ty_mu;GAiQkkK6yUMjQIUAHYL3;op0<1? zy^l@x#`Mct-lI` zf2m_(D3k?g1WV{-p{yf=_I*p;pyyS)tt<2L)|uB{RDcSUp1;4p50!`FvSw}v^;_6C zWD*lpArqFU_LT4pwH1D7aZrjK%gbZf?XmI05Kzjy`}`@{~l!E2vY&wfkpRUP_7&+X;?9Vs}<{cCAL$(8NRys31q4Bzk&3`rNg$yoraDMuV9r@ zvu$;5rEaJ%vnTt98j>Dwg7>zjed63Qa&r&2w;e|(pS@n~`&?DS@}{+|ZFcv#E(i** z7@3TN$481`;koLH&8E7#y1qUJPR{e`dfz$^SRFyc+)S@t<%J(uw6HJrXDSHE^g`*u7F3y3B<`rEgr z-@kviw7`Ui;@=Dhv;XrQWMK7DGquZ$^RP!)>DtEK%_*iPrj>T>+0#H0;#TzNdpkQ;TyePx2?Zblg8n=#gG;X` z_ItKjlAfN{+dF`OQG}%`E6Zeep#^nUWqf zPf`yL;4+GeivGB-KmO8$mW*MyolsI@$Bh<*K`Ll+cC6pMb03?A!+AkWRaNz^1xO36 zN87W61cc{{o$jN$ZLO^s7wua4Ma9L?-dQcWo&dqMSCk*?$19qewQr##=RZ)nizrLB$Twx@w*%f$ua zW3hf`Y(nk$1Pw?ROy&~=&^>W*6jW9JEbhX>R8v*;K_R|qdgk?82PSgq_F^0#FE7Z2 z-rRXZLqp$V!^z~olWv#&)$Y%7q!fZBMrzc3^wB@`yrd7 zR|X9dQV&gM`el&C=Afj40y7nrm|Z?}3uw7RqobsE{}MXT>}zlzG=W63^x(GSLN4aO zVE;>sm*RW7d;x#oP;~oHxB8X`Xh6tGTwiH3pa8AucmMO*M>piQu!Zph2Er9&N&fl1 zV3hwb#sBSA{N+HP|NrBi{7c#X4~*~Mmyf7+gHuvcyzgW4kCl@W)Gh8R8bb44mcSDcGf&zI~g7_DIO6L9!|!lGci`ajYjmY_;qWic}U!( zy-W&~MhVqf6H3O1HgDfTU2OkbHc1w$4vQE04iXY{dmmm8k zi_&UT@SA=rD`Uyu0cg>iB2n$SI^a8`c16?ay1+Y>y zD`-C7)^4U9#a~3xIqv+%q6ADvgN~f0^^1q6FKxLuC0nhM>GkXF(4t8VCR32~*Hm2R z4++_Gssf)s=6cUr)xWV&`BLVdMwJ0V7=!miS^Y~iP%Ruv(1L(yil;zi!9=YewNr9)K!PAxxNE~;2AeJs&DVXtxCA? zFY|5bwTI{1zOSbAJ0pw9pS;0Eg3i*nWlkopTxRiJQ*%nCeSSB{eK^KH?@subj{e2P z=}(Uv8t>9-cWX{}+xh0^=bHnFi3te)%v+_CeEs?rmO#A^%Bggq5J-QfrltTH`tq60 z#z6f%ekz}om$wCC)+RS0S*YV#!)Mpi!_(vA7!a*)5bC?XytZYzqT17E*xS?F6GFt5 z#O0$_^@5g`d(XD;-d$8|_D5w7)4ZU}-N{HuN=k}eTeFLh#m5H+W*B4^1C7ZWchCZH zU(Y1o@_h3I8TFpiqQO@LqO`aec+bgE{z=nw9IS^Awcfwazx;U(%EG{Jlgs_VdJhlh zgAKydeuek%-`_zadK747VZq`y)3EUY6y)1C*Cxgf2#N`9^9$%+GhHClpM2l%3apGe zjF2^+{-swK$KjZemi9d|@+5YBY5XP;7sqmxc?oztm6FGNrDL7$wUW!L8*VJGwk$NK zPU76O@)cJHa;RUtKo3-_G#l^MZVso_xF|?l`gw7_UPBWneCB>8v7qg9vbgNJ*|suT znwt_n&`+s=e8v61V3;Kr3q~L=r3WTkT3XzHeH=ig`rX!6`wiOqwAT+?Y!2FUJL0Ttj10CRKuwnHllzn`*h0ZquI#8@3qqgdab;`o;(_ z38|@6rKB((KQ`3V+=}PTJXhwyC*P;y)&Ox9S}HLsZboJ%D0l2ae&8~=xL*Q3b~{sa zoelAGI^IbJP`E}19T8wDsIxgaImT{hubIfm_H7m3Bz6Nwg4dw;#l(!)4-W4%Gk_Td z<<7MS? zh7smavh#yc^BZ?iDx425qLIEl#% zMu6LR&G}S3U)?fDDbc{?cQ({+-SP%!3M6n~_2;Xd-1qO@dw_zn*b${~ViNuRJ1*Aa zbaTzEqwYjN_UXMTtSl_ZsTM19!s67~Ygt)W3aU~?Uq=TGsFP%D%IZAtTc&>XmCwQS z^YZcP>+hEuT!S_;QEEPk!hLSDH}o0^)6CI!gD)D^-25FBqP6w)>VsxtjcTW2+cs=A z&uw6TRyGwwH&<6z5mf3N#s_QAO4-=hz^{BmeK)9?9sEKu8-}>f&B@x!K}_;{ICQUH zzh+_@Xc#)$nQ!B(swNlvj*bPW7;mI*5jv!J1f77o`US93o7<$!REdI80sA*;!D#&Y^$UziusUT@#e2KDg2zs@ zC^u$jN#$)r?yJhkSa1FGSnQ0;%*>PokCUCflF@ho;KI|VPZN&j+n~$;iR4rPCBAv~ z)}349weGdaS3;R?5A$T6VwMcKWWggW4Qwn<_X|}3YrpEeWl>Z?|E}}CPlYXt%L>9< z>h&KrHEzox&ov~YafygJa?&5u>9imd6Q{qXH|%-F`>Br&XOyOnA_J%};CT^|FTjRN zC*4L9^*aaj$QfK3KEXr;vk|cSKHjUJ;0&=CtqtWbcEoM=mePhrs8(5k8dFR?$oCKv z6I8OytfX&WBMb-9dt0OuB?!3H)zrrOhaG{__FZe}CKW0uEbQ;=Ba@8K($}{Ku08Y} z_qM0y@$ay5>jgz6711U;0moygs~S}f@827~tWu8y2WG&n5l>c4Ek-fsorX(fgyYoD zYpA}no12ozhI3ZbR8;a=sxK>^($!U_q%6GE)O2#H00|t955hMrb4dd3*sovXlad%L zx_-p-`SutT!EJtk$MAxJBBQFR$}f37y4a)0;4I4 zq7R0uPX%~>fo>DAvtvAvWhi=L1SD^6&Svw%wLAD?ks~~s!1h8VYxmK(bVz_!`$~UJ zO-=k_2Ue|%h52uN3Jg5h-p{1YjVXf50Ecw5j! z5#S5tsMM-wRp~T8XCzx)U9sC72@46)GBKeVd-=|bn)&I|8BiAhgZ}#Uex)z{!R^H2 zJi~0v;IXHDk8;$i@vyO*G+%+ox4$ud8bBC1HzDFb#AN^upI7kF9WCZzn+tv*!qcqX=!=#PM+NxDhL+}9K++!ylP&1USpjKHdA!8s)XGEq&x0$STzg}A464<%`Ylq5E5!O z9W4#Q=e~HW`D2J5^vq#)7L%i6eK-_I^+0rMH^<5ycNdnHmdGVzw;ZbA+FWWKwuw&< zTo1?XB_t%kLa*B-d-hCcac&K+VK$QW< zmNtK>&nP2=yravIeJ(!T9lmpe0jS5=*S^sFqmYv zHI)1EZ1=R$4~>9hX@0&@^Of@GNdhH}ysb3OQQh$_RAl$H(Zl)zUD-PT6}7ds5!5Or z)`K)mQQ~Ue?CuvXb`l*a8g9eer<>6JQYB&%u-AB0qbHMu;g%X28NqZAL3Z3*l2TM0 z8YwomKf9<*DH7c>VS<{W*P9}~I*^Nof|cq2(f2tH2JW?XbBSe}o}P~X*7k6< zv;7T(GgNsjN(D1OXhN;6%Z7$t!Q+*7%lNo!qqXiZJg0}7xtW0wHYhVC%s8AoK2MC~F0s@k?z1flx`5%-)UjlUp}$noJZ32n!nmnJXYoV$_NWn+v&b zUlc-Z3D+Rl)YO|QIaz6MKAIa3em~abso}N1TE%;1<;cRqLY+ln!)&RoTOWV?_+dHQ zbY9?CxD_lbSo(4pt0iY~bugFy`yVx!G29k!6cp^?7=XR%cBGwm?9%UaPt%=Pq+dI0 z8UU1Pe|9hmU4Mhy;%Bl7^EAzV41T0+wzm)f9}r|g(POt+>MFO^U%|jjf0meEOrxA7 z)iy*34Kt3}?3tIzc!}w1iD`(ldTXGlk(i#2jz0n8O4oEfAPm{Gw@fS0R&yXG0fTTp zHtsF_*7!YXF=p_HIjDLCidg{jC1dI4p{A@2p6eJBj^H24hnzk!(zFzAg=JD=w7(J@ z91N29AuH}HI=ZJ`pKiGTcd&RD3?>#p&96UyeoYiyhb+x%Zta!*RWLI-GExEfPk`qd z$upAIUmLYJMI=&C=>Q`GuozVog$V;{IE&3u9^lP*&pUTXvIz%;iLRB1Ld7C_&ZlOC zBsy;I{?!qgL?1)-g` z>HrN36--3I=Njwo{wk4bZ*Pk=k(8F0$fuT5P+Ce$Nr}mY;I*`|!ecOa2WtxVfuO8x zA2e1)s&D|Usi}+g4g4!Zfs;MF$cEFqkjXJ*h+KNFVJjyG-aE9`rE-0ebj)X7F1zcc z^78T{Po0H8y|{}>1{})J$WTdH`OCz6VYQ`8vlUruYikH=rKP=)l$7M;Rv{S~witD3=@4{cb7-gw3xcV=>uc+T1Oyw6O<&>;B;H;H zRxB;!1C{RIzYidCwCp8xZ~cz%+vDF}g4NI#PRmSBAF6g?rjz8Gnp$4Y8X#!BG9o7+ zkX)QiTQQ?0M{et}Y~utI3c@$x;o%U?*bj5t*Z`U7mu6XIrA!bO8 zNzcwU)zack>;_j;TuclyDoRxHFg*9}-GfDAWo_LYNGO`v4MrXnn|()13;Jn=jtLG9 z&f@%h06ur@FU_UpWvNPPX<|s} zyq9URhB(}HS>^l0pIAoYk-l^|u_#t+J<#x#Rfrx3Xf1WcgZo!!@O9i&Wc{AbAbngX z4)V>uOAs_hdqQj7IX_{CcKenlyNCPxdU@R>)z&szgcAFLga5(;MSLxxG%5-oEC2jt z-_NZ#Tj_G7Ty!-7x)8hbK-O@f-rY^>&}#PJ=&Zb|zN@uvw>mNY=Z~16nv^L$HFZGq ztkfNP^9T5?5^q+pAwU7y98i8$)zrZ0p{J+UwKp&wRuN`2>U%*JI-D*;Zsa(zsQKZ5 zZ6@8l)O4K9d4THjcy}J_kzQv6-}>iRJw1T=c69WZl}-D{&D=2(_BJ+R!s5@po;`ma zK*-K?+)c{c0@>CWHPsRIX|)*0@K7z;oIp}zXLlFITZKI*l;gTd?mNWV)uN{RpfYOj z?s%wsSJGo?WrfXlUBopjEe+l7Hv^tHuvp%Ob*JkdKcLch1_lmsrVQq&L*#DSsyu`_ zO4>e&ftlG)u-3wz6df5l7cU=g9gX@kFNkl!uz}y-8cJ?HS|Sb!9!UlJ-``#)V6F{h zt8BL+AZO?)kqRZQaemU{h3!WzdMqqrVs~1m5@^9doCXHuZN9IjGcz$`F|PiR zn~AAbd~)LCJ=ou(Lx*qRJ(M~|X8vybg z-~ED7bCs1OM&Kg}3B2%Zg*Jbg8m!WJjY;)1sNgyp{D@HFaHd08JpS$Ewriy@8fV9g z>=+ooMMV5+F4c=ztK>{uHnMa|`FAR2ohSupHCAfPK0pZtWjpaezW^a5nCOscCS#}Y zM5&X{7gep=s6Ud?7}w?`O)8Q9Fqh70=P=ionTa6-4KdDLij5YAg~ishk#-Errl?12 zbKE#BH+74yV(f@2~k*)W+hh&)6%=_yq*Y z%geiwx3~7H0A)eOPDJFl)z{45rVx@9Trbll9{fy%Tr8T_wn3Es4uSVGd%d!@kAr_F z+SpbuEbp2E7_;_E?;v(Na(ZFF5E&jW4`Z+;@f#}n{^~#g5$6e{O4Y-@nK+y;35-fA zEiWyJ#nL73)}npQ1rgJHf+NbE{5CJCi;GVXE(R8st>&d$_vvSqC{5!2?+@si5@s;k3&ewkH`olG?Cb%4G6L+s{jp>0b0F9)9Ua4fGdvH zZXBp}ELfm``ZOx-OpO(gE?CgY`QNS#AY5198{g+JJ=rrSm*fHyKZ0H#n^v8Q zEh8&SOhptTz7l+ViC_k@^`&K{X}-b*16F!5AtOUsLFKgM7ZtnSNSPXhpBtp#Z5aE;Zi&TD%D}c;B z*jxw3E-I@D0+sjk$zziTg8U1QvTapO4M{^F{Q{3TZug5_9~7GL3aQf5(sQIA)GA4^ zDpj6YCFN{Zu4hkB4=GzimOxar4er`IW*#t=K6Ad%($Oh0Iko~X42*by_I&(A4^E%X z)EW=w2n7**_VZgE$i}xFUprVIwPJ|eX0Im8Oi1|1Hr{(MTXAr2pV=-*`o<9?4MR>h zBxgMTOw`xU0vPl5_IBaATnVFudI$<#6B!xYd9c?0W|gGZD65?hx!gAheCrL3Osc>s zg;xOr#?`n+i0S#XVErlC-P?PBin?II0yztyIkdDv=vouyyKok%l2J^cRIHDd4t^=x z13+o>k04{F7I2+e5Cng4FvIJDQJzLy+HLr2uze|fN*;pY4H)Rv&Q+*?APw%b&sp~ z0~}nsv}P?Vq~a%lUASZzR~bIO{rzm!m+9#MgdzGnJw4r5Nd=0|RggwSWpro=7Xnjo zm;t=7(9mA^%9YhsP;`OZj^Mtf(-JJ|P#LAU^x{`nmtJ9o~%FyOlv$80&ESRF;$%D_*a@j#9=Z(t`$Ns&?^8vLyTmFOz##pWTDd%s-oNG zMVd1_wtkTK0{wudRa*Z{JrMfn)Cafn_G$WOa|kBahDt735-DY`OMl&aad zxi80`@)s07RI?gBx4_3K2Iah_26n5ElRY~tFqDDm@tn9LeBAN(Qr1Mt=(iE97ELX! zkeC=whuyiG4WaqQ1_&pIPNeX0HZbuDW4V&;uwl6-NUYYV@KI7xaoB8W zj!xP?A|za2S)s7w1ijnG=t8omHysOOBI6l$fazw!`|R_I7B|5G~TrS2X3$F-E*I*FJpl_^0&Y_+`v0$-%(^CYjh!u{F7G z{cC1sjS?5u7zx-IU~g%8{C-&)GDR3%Tu_D*G#=C2t;M-tl&|>`e*;s&d9SOxdwXX` zxzvu@wsMfY3fbZ469$UvMuuD_Ub!lz@s-|lV5p}DsL245r;+iRz@K_IG%Q&Z#P<3GL+ z4EA{6>nffEH-UkU4v+hN9sZywsJo57!^kD0SzMNa0|Pq_C*390CT#62%ON8*vsoLr zvbo{l+Qc3tgOE5{oAOpz%^4aR=i|H~5S~Y1o8GH_d;Let>A@q=ih-SCn zfYJfYE4{D{oOLOdgP*@V`#e>l$$o!OA`nj@2Ac0uYqf2Dr7&b@lWoz8>)3zce@B_ z^aEiCLS@3vy((MjE^p}cV4Do4dOudSb^53`ol#$!wonirE?y)qep^|*hC|>Y#06@! zn~=?&aTyG{#y@?69U%Fb5_IaYLrlB6yUKAlkeGde+r0*uA%rNM_Lg||H6Uj!EiH}h zdReVw0^t^S_e;oW$8p=|K^{?K3 z*o546CLXoiK<*eEEMSGHL=^x5EiBvxpV4`Lh0%H->u~MkvmgU-#9;`M(~}!#w=cL{ z**G{{4px7*M3-Z~~q+kbmtr7iB`$H(H4MY_9sP>UgTDy0xUksTj~2zyRW zE@@<>B{Ft*Y$X2pw_Ij}#Irj@T+yMSSMdWdBB@mK-e_plrbemQ$%pGOlvMkfiQX{R zZkAJ5r(q`%#dtv8EWwQiK7LP<(fpHHn+`Z zTDQ3*fe28B(@yTS(So7_=F92fy0wJ`?kkHYMk(Xe8YL#MZx41M-MaoOtPQan$BF40 zNAeS~3SMxbey7`PH^on!IrkT67|1vEJE9%Yahh?E`}+G}&N`0Xx7ex;_kE)GgRqfb z$k*E&Y9P4nplQ0exL9y(lYoUB19?bjgA%Eup!U_~*u_MM# z!w)KH+38_=EwD(i(jjk{$mDhi=mSCl$rrJ#+CFQ86Ms|lPtY7SKt?B*h=%mx2}GyZ z42(CST-dB_Yd5D67aIye*JpW=Hm>j=d%JHE>U&8^$>za-qAsvUvkY1&gl^zjK>X15 zLEMW{zogNF>@MWJe0_yZJMw`nj$7mNzI9ZJ*fMu?JU+g-fB+)@qpRG-&&x==BhLM_ zmKKOEV{=Wmwi*INfC#QkZ;yPAs&D|O#ngw`oE#`qP(dJ7vvcnr-)%G^HWOSDo&UQ{ zQVwF9MyWa4P@%6=H*96lf&CXNjK*o7L3zdK$O*51PZuHP=*ZgwK3_*HXC-7|m(pHz z3phzBLZn$9Hj;qX&T73#hkKbt_TPQQhrBgWbh;q+_67Btj#l&!H#UN;(H2e(i0$Iy zB88BhMx~~zqT&S9a8Nu!dI2{UkIm*qfS^jDo;Vn?35f}?H3Eog41}aYLSUB@v;KxE z0HjvO#-=9N@RyLE-#t0$KK0=m+(%HT@{RV5AdU`L7%We)a6q*t6$*ePN6YWuC;!Ep zrBd1j!-Ls$q)$2dZ}i2bWa7~2t&!0RP~>W-_DHAz=)B-D?AzLRI_y9r{fJ&SZ-qHC zJAS&)j)ND8h&ny(h=CM7s8Vh_b9YI+Xwe~e9e~fgfoPA)&dP#hz4vlMyGrS8RJ>=l zfrB|3o1>+)0fLZqf(ly`!62-nqLL-1C)fmLnf?02`Py*dY3`=yQ!l{nATog00fB2q zIyyQ^O3@W6(5k~})L`#q8R*)&Z3s->>({SCxar2hno_w@KTLEjZSA`xE?l)~X-jYh zi>IfXBjqxpqN}BZ>{YiP9PReKOy9lQFbe@|0BqnA3Z0&O>9CZ1^8x%m56?S;mwTbG z>kS|oyYrfY#w{Y&nYA?+@T$|>hFkw+1%%zc3LtI8{pJIJ%)!YC6b=X?U;#iOz@tzD z1N*+7fDy)~q6iu?2?d1_MBl(lg^Xu!@9ul8r~CWhA6Ar=K~2Wsg(>NBdSJ@?7H}+J z*6|A4&}cOs9UZWK__?`xTY$NVvD=26td4lzMv;aXtCUoJVId{NB~S;uyCYt`{|Mup z5*`ko$0?z;2!1~;EiJeKtDHJ-`&Rkf$%TYKi31W$gIHag;Y9}A8BaEP;20Jj z4!a8__I9=DB48Op$My<-U+>G##s=AR!0>c6qv0Zd*Zk2~)uyWwV}Jj#qa&<+FLdB@ zojMPB0ZM=L{3sYm@R$&*f3i*V2|BoDVA*@ARlP+vG%+bEC`hQu$;zUNmX%~Kg}56f zDd{Ya>KGC&Eo|;!$^|!Q>c@}b)d8te5>7EONC@|3=7Yy}mjt$;)UFS0=k{yAio87k zF682J_IIQ7N=V2j+0o`_o4g#5cv*8LklQnQF&ycs;O3!EL;vJ5k7;(QGU;Bm@PYsY>NPi#2xQu!c%fvh)8*!1{h!ZgROw z#IVhSu1#3!?BsO&&K+wO0&r3yBS%KeH6Gxyyn6W(Hcy8;3GzbXQgg5)268l-`HGOx zqN1U}M!vb3R|I>l0QW*bmH;&s_A28U03isEl|Y7sC?vBUUvWa%iw~R*3kL@jaur2I z*ir;`BWxqt!e>4yudE%df^93%XrX?!3FM@K0trJK$7=1+#D?h~W*0&9lkX0iw8B4sYk*5-)0wjYHm0rK#k5-=gQ%vVjt&FtZ!s$K^=g7l1(e`+5psN!)g0ciizfKdm<(%PTHkAE;($d#WAL6o@Z>Yjv3rK1j z7#KJ>IzkRk9yIWDV+9I?aezVc{{~=m5y)m&b>+yUd&uNqv5)}@Hze1_DopX29#H&^ z{a(~_}!GHFYO}TpzWL!Om^gsPG5C3Kn|Bru{;eV8L z+~WSUeGxjf?EtL}=ysa;Kc|8~D9Fm{yuu}Zg$AS*1c#B45g7C|%fBxJqJd=!b(2o| z>tQ<|^r~R5zb|}14vt8bmEHIN zSkDC-o?U(IPko*zKQ7Lx8CUDu=P(yZ_EA)ykzBoi6i0aV*=;z;-(P<&F73-<%>DD) z7O}^F37GyL{&vTIA5<>PDEl=|>y3~;DHA4gCK{=OU^~mHp}5bjFSA|G{&)-VXOH9+ zXI0Gr*L`Jieo!3sggV4|ArPWd&_bu z?-5h^P$TN03y0BEF^?-^NGXHvaSPuCj_x9-Ukx#>bIU0u6$Ooh)ZCf@`Tp!;kYFN+ zmKb;_*LnpHF+==OP#75dq^^eYNm8BW*>G+%u1sPinYxQ(7)9voM8Dy*K%dKG+q1fm z425J}lK92N&Y1meeKiWpgo?cz(fdIahd=B)H*DC{R+>8}pGY3^#BMCHkGy??-q6q} zxwX&J59j%_HZc8xt@t;r&G2vSwQ*EW_|+wHYCSq)X6WWf;>2JdqKNW|FBe0VB|F{9 zgr^=+XGcYw!z9KRssVFnRP0AJpi$iq&n5LTQ7oQYiqmiOX=!WAy>J|zaqQKec_`CM zAF=Z%=b%K}r3wr`VC?0hgEDa(rqiY0qwEM6UGi#jIzm&2n=kI2*wx_*u}8TNxzk}1wnKf18mDUX(}Ybl!nx)C zT(tdt4ZF4O!TyMg^})Vo?#|fEjQ70;3}l|KomZY2X?7jA1@*?7sP1}3M-!0D@n~6X zHBzb!WNXqz$a>&0Es7k)6p=@Wx3|ZzM@Zn#CMKuzAj6_$-fU{%c9E5-ALw15Vy~<8 z^JWcWxusE7pkH|;&R=Y6yGT3v)-^sTX|Q z=HP4|%Wq+6#m3dXp@35e%G(s5~-nQrXw z#Z1*)hl-;>78LZkjoBQ?&^4I+rTlP1NL*zljd)qK+ae%Z!w$VxruczQD7 z*>G}l`-W>Z247WHrQ%yEM^}TP{=Gj`>hzsOiQBkw@nnLxy@LD5BNWWW+~kyV00^$k zFt~ieDfaq>lLK2>@bQ)e_{SITACXqyQTlGrW=)edCGge9Co<^pM-FO9-DiEh`Ihdv zBzd*H^P?z??tK&#y%fUYVg_%G_>{^1UmL#zM#JR#Z=X2TaPhI((>?b}($`a~v8*gA zQWce{Z|_g8b*42ce8_v`aIvlEy4G_8T&d(M5fd<%eY&@~=R+uW)YW0+LTizA6*WSS7rBSPmIn2_Wj!rj5 zP}>xg0`hz6)wOIB{_(o!_GS9i`Oz~iXa*KwCUED%M7gLzCqII zL7f_p?|8BE8WhUg#7#h`3S{)#L$c=)n_T~&(wm6 zFH3OmAACe%G+Mj<<<{2;=gs+hcLqmKr}wPlZ#Cj-#a;%Xt*vdWb^IY(vu3A{`no=2 zko$laofnZau9dIC6@ztgoZ$EXdlj}w?$EHlWYj)Od#^#Qk&v2+@3?Rs(Y%@=()h5o z^A73rhpmH@mxt|<^ER&M8c!wf3nb)|)~7vc_Zu{O>h+!KAPm2hJb=*fM=p7o2wEHq zi0Oqhg_5a~M28g5&)xoD>Y5#D&z@It+L@{?u20*sQJi#m4mIxTxm9jcKK*Jzw^CqL z7-df^o&Jql!+l$~At6Pt$$JT(P;%`oY?7|P3cE8V|2(SS^UfZ-(+RJwxLV~K-Ob!) zJosZj@QUTWm4>8!Hbzl07sR3- zxy~MJ7vcz^67HQ3*s5>j=+p2Qs<8Z~j;nf0fIb(r+=WAVA)vJvz#dP+qv4K$f%i~W zRyw1CiJm<-Eosf~lefyCyKrv;0lTZzvxmhN%0V&ZORLKV>rJ@}VsZYzp7fjKE3QQw zhGrPA%*2vC@uDl(4e6y@Y>!UxX{JnQpWFMB8%}+E()MZXtS-*|GXqo7=1`Gc)7&3yK;`-_Y<8oI+UvCHO->3V2LjDj0s8|Ekv{;$EWD|gk$%=kyHp3 zL*3ggc}35I%sQm(UO7#ve}}y>(5n1QsV?&x&$a*6*;xR^*)(xJo{iw{ED%U=cgv!| zgS)%CYgiyaun^pWI|O$K?(QDk-Tfx-`<-81)!i1A0(P_PGtW#v9=R-%(^%tIIUcDXruCKhIL<||9vf|7^o+Df33e`-S-@cLOxX;5C#HW>p)VMPcRm3vw!t7N1EAs?j# zNyI7!dj8UpU6%9!9kol;chBey@QI6p`!H}}qu z4=-Sbb-sLg&7i!?&u8VKL4e?J_J_Zz_PT?WR;flMya|agj4fja36GJUqDhA35kG{5 znUx~b5H5{xWN2C-MRMg_Tf@OcMwWU1;k{(PvAH32EQY0-MQ*y}4$nN^-n*GCx8C&bmg3pI2l8ka3E zq_@9oK(9oN3^mX%F4w=dHZJh9vFL;2QixCE!sT$QG3_0lte>n(ECT`5zNGv$^fa*M6-<;M0M8OuyzwS^jIF<_ zjDCcepo@+pTnS%6^=vI)f`!^KG^CwRv%^cIsX(M8tXQ+j2l;!iJ}lLGtCS9X%S^Gb zywrU#Du)vr;6jpmSDG}m1MW!6nKE`LvNC%0OMRMsItMjpD$R-m63UvwvI8S@ItlFF z1c5p3Tj-D-thrBnM2DIXN6n3>q@q!$f8SUCW%*lT{o}jaGTW1eIdzaL3Uvgj1P&KJ zAI}9~MN+;I771nQ>uV#@pQ>71}$swL!XE@nw# zM=HsDYt{yfOny*Ia?J)IL|6!7*Y5M38j8#(eh;X^gOlk}TsceOHPw!g|g^9U+PCb3G2SE!-GzIN+YRaU5|#Z$>q_emVG zs|zVq1V?(*MUv&9Ff;!!5*37eAj0R76g@t&RicQP*=sSeSShcZR#tO#3Cu&6Ovn-< zLygClAd+SiahrWABF!;9>srlu<64(LkqQ%);a9Y5rW28xR#t)62RhHD(EI!>kcA^h zi0-a``lm(mp0~Tdz$6S!l4VRF1OanO1(A8|VWi#D%#{}Qo?pu-FDjQxQanbKc=?wr z*%R2NrR3e@J|d~a78m1*f5H$jXt`;xbJh2=3jL6;N2V<^Pl)aY5yk?M15QOBJbjY) zEg`Af@$p(=_&1Ix9c)e=svcM6?YgfJgF)@=0HUMXq(@vtR6=4h&IPm1`q-<-1dY$V zu9wHXi64qEf$4i69}hNQTaMDQ5)w0G=bAcw{WVUmsqt~Pfdq!<&N zu!RqW_T4J=OBhs|N8QwV^)#hxMb~lyii;BX5*G&)p7)+0!_>aQr;R^;)Ob?7FDTwi z6%w);gr_K3D*V8|h>_y4y=VjIqoFi{Xo!27XgTYEKbwY*?S05;)) zQ}S_*LpYndzaKXNM*_2MC2zO>OU$R-;0;M9J4be>t#}gcE;`Dqqu(e3wf8L?qm>0W zjO;_jF_KEMnm(ONZxP(~?Qx7y!*G>gynmlmiE+ALNC`2CV5G5_75F$v)!r*xa@9!AVJ+A(o zLYJsEIi#$%IAyt_cA@L+e!smYjtm=SJNT{T2=3?4!Q+WcA@*tG#+pf%$uWM&_~A21 zYIig_By~_LYq2Pg%GgBVe3u`hL75MONS4wcjgES%FOL1jB7uL$p$2rvN<|YYrK48N zKouBD8}tEJUb4RuzHYNz&7FX+y6y+?r4=WEse!^z?aL*< zy(Qw4lpz>i+SaFw=}l>nkZq$3>LOe3wiCBwGKe9g6dIjr;by(BiKz=F5k9tcl9Z4_ z3lc1nI)|k8CEiMMc~XK8vs7;D!tF(bL|W@3LnbDNQ>?DG_-EPJ$UrBwRaYxB!%0<- z?SOag=!DL_k@)xI=+`15mvxwp2}fl6Kwmc>wo7ep+;GR5utp6EtFw1z&GgtSJ&r<) zrbRb6a$dd_8S1OYjhZveglt<&d@qF{(B<^aO7r+3{7jP%c zs`j%ojQ;NC$3df5X>v@ZYqnR7trSwpP2Z5WH#Q0dMmb&XZCwmlBHKNWZ`aNi4|M2b zkJ4L`DabpUMD^)a+B4TSiq)%1%B^k653aV_Dai7853cQ;gI}GVxn7f$WYojnqZ+KQ zR=G(^>M@bB-U~7L=CYT^1(uZgYG??o^m8HMNJIleMo0Nsi2`SHhf!s>usg_d6Y`Xq8m}<}1R&F@ zYWI#eA0;gaqQv6Z^n&VwK|LwI*1`GRROAM&ndx_rhPeO)LT_Z$z&3S4E#UXGFUNG} z_Qts9vCGs6z2hrpi_W>@iRn>u8ZX5L3ljiB>%Ifl#;rlc8msUts)!DB! z_XqM+TwJPuD9VGa{{tq$o&~+~x5x&X2(WDi3X%|}&|wA_Qun<;f^d4Se+STnqDn{6 z@TTMb{YXBXyPF1)Pq{ep@vHZb8>82g)O*|;y?a;04H&60>)gAuo911RUDm(IydRky zeRX^>K040fxSj^Cv@6vYeRw#-hICNts=t4lVQ7-7>6i0tQG+~Xds`QM*W!ieZe*1O z9Uj%mYIz^%xnB8I9e)2fz2$||oZ<21=b0H*wta5nrE=L1@r0HGQizohC~ZtOwr^@y zR;BLN7pkUtUh7pd%;1VjW+E=ew@~!W4M{T81KyxI$DL$<&hFV(i`}nKo`YNkO_lkP zmd{DQtCFOJks?LOI;FJ2yVpE53FY{3?3U-=t*L4d>{YVvgL&)h?h~A@aoJV^isK^- zhI`ib7rc~7BI0rI?yQ>49Z+)%LwZ+^p2Jf4iMidjW`5s44th*4h3I&9Tc4h0^`0W| z@0k?;VvvAl)?i5mwhruKBs0*UH2bXI%{KTohXo{+sPwhNS2%_nh zZ|(@DqTt;q#S-&SzvQs^Izob#>3&?yXqH~jm0qJbnT}mW-m@X?9MIPMTbE7^y$`d!Id|^)1=CJo%vEZh2d_&V*rU|@ z67b#WS{N``EKfDMxNgvDFfp*=a}#e8oHrcL?tMx79^y5Qg$OR;kw@go*~^C_w1Fi0 z-J}Z|I=ad6@jX)-!Xke!^`9wD;7cj^&k7TjJBj>1dEWaKZTEjcYmfd2_-;TCLdaEC ze(zhzAbB*4aPR8$P^71NfE?hXLlp0ge-o;Y9)0}}gY6OWzxh`1bld;-+@t0HAd>lu zwdslM@Y7PIOjnLlqyD}b*wximZFxwJ(nAEky|q_kw?Gd1=hu&hl_tqZ0hL#JOoWyHFMCb`RYgow3u7Tss(Z}Rq2F(aH08!q>7T#|}-RFx+l&R2q17r2xL7MJE#%K|1f=^m)-eWL<# z>{7@bYQ^3IfE4w#pn!*!_e;WHo3S+az4b>Ae_=x2q1UG;;fs`J5aq<}sz3s{g`V*s zTnd`JRLD2zEq5eu4ZmoP89n-y7Bwew-_!^K!``+?Zl#ywdKvItw=sb_@ zsxnPm`0$20Ek5-&sHjkdci)FlNVn*A#^G5V+3t_05kU)QE@JU^hywvSP(_ z>)$K!6S%8iFm;Pl*PI%u9q(;VEI85`ICM8zLl>80F}F%7`?PjUNq8WjsoFq28BkzK z^JS)W>1nNM-Oz$*YJ);bt>ulX*?ogoU&$0i1aD0jA#4yeaETD>^p1Gd*5$0};`TXX z-16-r2Ra8}{M~_i++}jiK*69V=j$EU>BX5BYI-!;h{wruk$T8kgIJ2Rs7J|j0uYZ& znGESRsD*BK?T=lNiV%Hn%b-jXc%)=HKl}dhn^5J%sWxskS)GE9LAcmMv}?nM;V)Sb z77f;kb`HvTNa=#x8RRJj$|@2~4T6woQqaTl#@{@*4YDw`~8FxS>e)?F}wUa*2 z%nqg^48za4yg$~IyxYzw*lhMeR7G#68K{ok*qI}6(q9!pICUDGfI(OepSKcntF0LF zjn1f}jJ)+av`>sX+FA~Ri0rsHMh6Le^Ehqshb`Q!i=Uo-n09b)?$*{aXf9Kxd3ho( z8$T_G&)OH;IMJUBZ-v5fpSL`9X}58Ze3CmRqU08t9jQB!1STeR#OCRvCP$3exxQ;! zrl$H3v&>I~mM|rIhqv>GLE<3f(RJzCIjI2}s`LZp&QPs!H8 z)Q{8=&cBm7Uq0ap!-`(}#Zkmu=<%3PsVAQEl8?#Ux?FXb&!6ko}U35*v#b#SKhiR z+sie2GX);-EC;xcYe&5_$pd=*-#XgsV~s5n z2TeR=MvZ?;&26ppU

&e8^imN-BS^R-d?6>kKkN#6A)eMS~ggv@zW%n7)rTS1c7L zJn=J~H`vK&ShHOeo8Uh9GNh?kpO}||*o@=4NiQ)8+ZicVm2R__@-9akNHQk3e z-?LHwb%MAnN7eY&Z(DSoZwX!bJinrNB;D*Rj1$Nq!z7<96%~BhTPSiRYpMC(L$g&g zz#NociTNskbmfRWO3nKuQ(?5QpPm3SAOU;7m&S9vP5yM}vLR0sA-F+l^ygOr!g1Ci zh^ZWnWEkcT-U18xHt2;Jt~GYw{I;tQ{`Yp%-1TFTINazen}c!Y_sik8(G$3YP4S&8 zpE7Wr69vh=X- zw-!lvYexQX@cikeQ~^@ToDV9;&)!4=r`!c~tN7|&kiC_L>PRefpN-J+&{{q*yJaD9 zS)s@=%s)W>#Q9Bf=I$WP!k?w7ec|()zAr46h`w*nsAinG7$2|$tSizCl?b_QNk%(iQKJVwnE$*L=IZ# z6PG2l7cg~%X79!DOWTzSy9=Cvxw;{63x<9`AXn!ig%EOzudDyFo~J=Up{i$mKsM6- zeUtul@9E3dmtYVzFo>W(IxXkFCs&P3PiSdT6cw3>7&fx_;p_jLJ%VkU_ByViiW)E_ z*Qe#9Nh2M;TRCE*GP^=GvC6BxNq6#6vy4FCIX?HOaqi--`^Rmk0j)1{ zR;&q5uCxoM`zt25XkU;m&sLJd-v5*KI9e}HOc1y>`(pzZm_IhoHx?$@0v=iA^YoM( zR=OC0t4y=+rSDBIeebwUo>eFmGd79!)H9IfjOHP-FiyqAHStwdYt%-(=>8o1<V#NayfE1^=$m-h}x!Ofd!uR@tk!8&Fz6lVT1!^JIq3CSyG%e+ZcI-;3M`nQU?1rXD=`Yjto+GkcR%&oY@0k54GYU|PQ1;TBm`O{cwArNQdHR9 zI^#c?YONs$lDq-UZ&}hh$5}q0f~nb8Q6Xwn$@~fqNu8<{#tX_~@#F4;C%2pGK!hNv zZsTVl8+iJ)jRL$`D#!~Z%X6Ogdtk#LVeM^ikyH-$HwDw*GB9GBnjhBtq$;09rikc! z5oz&QI9U|dRAQP)uqu&k z#y5mX8|#+O{t^AS1*Y~i>$;)-nRe|y*eBQWJZgmA5EQ(?+mahQ)Z{GpJ6G%xxeD^M zWRl-+!J1K1F*cPMJ4EXX>7A(-C$M;L>MSl9La%q-OHTgR47ug!S(ar-z6lZg+#1Hp zg0G+B1;Ub1-GNeuCYFo`dc9g61-r~LjRe8(1Nu%{?i9Fd(>WiREc*6x;=urKZntfO ze3N22FccrRoi8Y`K!tc6pIDDhlxBr1)lTKE*fivB?}sg%oOlJ8J%#G?lUN*DXXNE> zA-~$0Cy0X$r_Xd0m0r{TGX=+Kt;XZUz{WTBYf3}qdBCywG|3Sg=eMkfk_Wg7K?x3pY!#9n zE7K$>u=h=w7|?RwcWPI2-zlPA;B4AY_gD=i7D<6pMEG(Ob)%^yZn!A5PE3iXl3HFg zRk5F5!AHgk;l=u>wvAcNoShXy{tT^G#pZS@jZ=GHTE391i7=*z*D7&L3UK|MA zh)_X~lW|6zFgbTr5FAS(y)LGH#`Ae(=G?*75iw!3*B#96FnWg5k<<^@gp)_lOeD@5 z;;*Y~v(leu4&uc(T{u*v{(c4mfUg3)#HkV!HuNPRiL3ZI9Y1#15(UcK0{5gZ&iI*m zrYYG9krT*^SLO4Ve_4U>f{Y~O=X!p22=ei8<`(L!u$=_pIC>`|hWuomYdicXDFCAH zucPO_DO|9x@K*n!v*qphL=$;`esqb+Q3{j|K5s`p7#Lrja+M=B9;EM0C3;-^SK<0JHNvk+o59h75Ve zo<~dW@0}8-j=b=MG!iJtO;?Frv1jI|KdfCz|DyjqfR;I%itFZS(WM~fWFYhNbgwCC z&%?~oZqLE)alKvL}&IZE)lQtpD5bPkbBb^SMO=5C*?AX169ZRB))I7lh=a z(wuHzH9ig$ZCR4nIwN+8glZ%i=SaCObZue>$lF|f=-(xBpI_WowwzJLh9|Qz{?It7 zGuiYTj9jxljY?=J!^D8DI-Cq^VS0I49*qaZOD0P#ZkouAk7e;l?NUAzRhlc&+DV4g zv79~0m1juumZ0?t=pkSJwb#MvH8Fs*0XL+FZ z?|S*UQJ9d!7!EuDbh~Ogytr2RENom$ zn6zGLnF@Y8JrYxCtuN-9#3#RPR^M-@Yqs{e1+MU|orJTcj?+k?wPa4_T22&bIYqXy zdtb0(Nk;5wmQSZ7JsSv-6l|`F<2A#AOwb{~&O6)bspXMNlQd|}4wV?LLi%0ePr*?t ze27duQc1FJ2cyCQ^%HHviGX7>m%M|y#!C3jQSMt-Oy8@vIrhAA%Bbe`PZ=c+Ay{Jh zKN1RU${q^S&W&|cT=0s2W;$3&MWg{!Udnf7w*!468DdRUcEI#zUw%^Qe9!Fc3cV1TX zSYO`qab0bB?M$ggO-BOGC;j7j6+h~T>S&6o@c7Z*oZ_34-Su0yoEx+BFTGp}>Yv-! z-m#UjW~{Q0<~(&hdL6n@Wq2{Esf5Kps3vzc97$Tv%hLHVm~nDK*S{jJ4AVhF?A*;n z?58Op<4&9pP)H?hUD1X}N`A(o^NJmvedsOz`1D1c%XOBK{yA?||7;}^0dMV%1=#m4 zO1Yxngv@v#r+K$(pTBgj9m?S_NBoBI_z^$;acDHhY^mV#^Fi5UR@UA+(T|Yn&&*BE zQ4B2m22Zt+F_w#~=Qo1hnMWv7M;eu?;y(MLW0fpat|lMCFhlm8!RpIPnlGy1KD3Cz zuVioz|72%Nwk&;lYhSV8{*-5C?3V&Hj^%CV$zun6+SsDtPTlLKxD=xwxjG5TY2Oss zbziBGMR%>CQA=<;7?Tq6CZWezSO3%xipotRYFa)w7Sg@GjK%uvb>fYFN|MxR!wkf@ zI~Iw>_FOadqHkhf9f-VhX`iiEUr0^B)FQD!3G|cw05h&gxFZ(0GoTv{m;+qMw%d-; zPgh!2@W7?}M}u4n4lBCJgKp943mpmiI%%8q>4|OUh31FWiB?8OdX7t7F9#Lh8H_+o zgEWP=+2=s!6~z5iS_bGgGsrN!IRd&Eg)q-c_k~e?2mAp65pfqW4U7k`&wTF#RvZVzPA^XEol@Bpm2Yk-XH|u9jH>c+W?9N-Zr@`4a2UM+Ks`7ayA8y|7 z6|u4_$<~lEHL(Q%^X^4|xTk4=cf?2o!kmUWy*fY~Uvk-lKnw&S#=DPqmqN9x?r`vs)2tF)zXlCK+)=#|W$MfKr0kvP)(9`aWLywn; z>uXrbvs`MkTuPH;#PBH^njKcl<0B+n+mm>9165gDF}8@`SXzaFA#U94=J51>_ zP_LlxSz(xzZRH)K^(SqRq^Fk(U1ZMbkG6+^?=rv17LL;a4+NLKx}e^@r#vpSC^;Y$ zUkLJv?E78QEiO9aRC}vi%j#kFU@{e=ys9FrRkN;>6_AP&Xq>LE$Xp9MI4109^AEvZ zSzaRG)pPuOl%hF#QWO&Oi zSaG_keHZ$Q2RIn{YQLc$r9}{~JBv50s;rt^cA~cjLCe(wYb0ozoUeE2ZArT$=vwWL zv|6ZLTe=E;uml=CmJ78kfa2)bDw`4&DZ@Vf2Vngc5xMMn66*`~4NYSZO8-kN zG}~?Wn(@sx8hCqZ*mDVUBv8}sAtpZ9HPFptZ_NiYo*Da)P-Rh^Tgbw|y6;)MSOju| zjvkhp$;U2Vm8p|CEy$z9cw8^Ba6`^-_UcBB`gz>8otu7pOWBD^ed-?=NMg~$1%MzM zN6goLku65mwd@a`EAjrd*TZ@ghJ#wx59j?WB1m_aCkt<|=(6iwQ>Tvh8(t!Wg!C%9 zb2tzEKFp1LdV7ZqGn=sJ8l>aC-l4<9Tn|fWqq|xx1vR*J>|8?B4=ocNoa^@ljow}l z&7^U=XFvR-6chk`ckyJ@k}Rh9!SJLsN^9Zf&i{Ds*p26NaSY<#yyMngDn=+~^!UlM z0p@KoaWpJk2iWc#pYq;|7oO|JJRN<;PL4Y69-|_5I$9y2h9z1}l{s0pxV&2gf3fGF zXPuvTN?9!opMw$bIH_^I5_1t+8?6qo=OloZ>#7L43a?+(dDYq!o|NpqeQ`3}Fx$~lEb=U= z$vUuE`@Y(Y;_s1Tp+>{@bx6XIbV>*|@7qzGAAX=HMEQEU3#IrW^~aCsd&d>U)6Dlu zN?7orDTZ_+?w}e}kN&HKGtl)<>hHI;1Au;*G_l2f%~M^QL(O+Vi80iw)#ht4Z(qnM zU7SH$$#tx> zFUf-Skq|5hG(fIfYP-wD6*{@dtK@4G8KURy!l|* zF_=V89XW2BmUBzNcaizZ2#c=%uTzuI*Vn zZfk2J4M2MH>`6QA!oq?U5U&K}yy$q>Kfiq{EBSyb07(SkF)5)=$gwcdZ;yNF0EWinoD($ue-aZrzPPvm3S?4Jjn+rHHa15ypovs| z8xZ}0lvlg1jjHK3xZR-F5iq^jbe07{n=N919pK^T1LC_oxm4n1H~f_{^?CE%4S-Bo zupRgToEzvi0v&d$YHCECU|k7)B12u9vBXV7GQFV@)8mhI`LimObp2sr zN@7NS(UB`YWyq5oPiiro(*tFAT3}+LNBXN-9f}_t>!eBpfdE;AfJmf(NR@DkWgXgG z%oRUAIOY38YO~d&5Fu*6JhnAzG(ag!CYvitR_k%G06$t;prqpXu2&mNXnLIS>gmg8 zRGtT>&obo6S(sQ{tS>H{-up>V3P3bMIVTyyl}o5~=cb0M4(94?&#qHRJBu`f0I&6~ z_w89AT(glQBb0*vF8?zQfzxOF>xOdbR{`lLW4EXF9q~9ZRYxOn=J25>ZuxW?yTB;% z6k35~2M*3E&-T&@hjgUW^P6ee?xiraE7@FMOd*D-!!rMMs)B7w!s5|}FPpU>3=2j7 zLC(r>cjoY;7%2^9?DQ*qUgbGR8!6SyP%tytEy_ukRSBiafR0fV7)iv}UXQyhQY54> za1&+$pAu-E04{&8s5IS&4>;_`$Pt2^m^h%Ao!ekr9uQ{tcXz^Cy~D#dsg$S-3xEn4 zX!HY8m&LAME3~}!*4G_3C$(_ic6=Y?1--ldwGKN!%mDu$u-gC&kR1Ir7Pa!P<6ydp z#yk2bq}=M9F3_?+GQ!Bgp%TXqs8Qa(e|y}VA62VkDJeyWf@Reail?L|XLob4c=Ph* zU=mkVb`VFY+U2y*p<9O$K5UcRpm0njv{jDQO913-oh*<2J96xrNU zfNAeRs5SY@D@uzZZb}IW-FMcLd)u<#IE&ri*c79qQyvb=+TZZ)v1wb+MP4Si zK|umn;6PX`gJIeVF97@-B+wMo!Gp7#fBCMl(M8;~XgP|@&Voivb@qH6l_dL-adtsgH*2i-81aVJ+kodj&JYg zH=h1IE%y#-@6FKAR_brRlx?I{THJSx92aLx0QPt+1JCU&!Q#pxyEM`TXx_H_ zj1_>0!>xb#XP)n#dnwWe@!au4t_gt51{4!*S^d1paI)zF3A_?RVXL~}<)MR2o2ra8 z*;l4owNsx~k6$!Cf(o|iI0Qb^Ao=L<(@<%2Gp4c;k+*J!DzAJ*Ny#m(rdwWo)SleU zK~@prK$^}9qgNjSCD|uR*f^Q=eTkP4j|`)+63)+;wSOr~ii`{c00V$Pv9WO&A08ea z8zcKJ-*I05svhU9zmJd4wuEF5?N`v5kIP~DgE1nju<)AzDZKq4T+*1QPi?at>ocs%af#iOa!%irI3N8a6Bh?AkJan(hT3QtYVPy(H{uY1KL zFMNHFLEEsbr2N=aJfIU4Xyl8UOz!2?`EU9{A)x-AK}0q;qY}4RS_J#8#{rSFm9@OZ zc!r?l5E$)4k;*ZrTej>8CcxBD+ih5bK$pnD_0^3*vk(ishE0Upkc z(`==C!&1U8l=NKHv6?a?npi$M3O1#Z=>nY5lm^k*ChZa+SoiSL^TqY`FxKF~+}X;l zU+|T?k8i`>v|Oj}_4D&XeQS30u^PF>gL@m3wqsV>$(|7s_w65!k7b>z<`>QBfy{vC zMVMrWr0caSaK#Ytk-v4W*gH5xdp0IEYsV+Vd0y;cwy&ysnS6^IzEF8yO4u|~k`B_e z8HUj*n$ic*@9`?&)LHqhA$Z=+WbTQS*^9DvknWfnvj(Ryxy!G8m-ji=`33OMcSN=i_m_IumoKwQ8f{zNHXsjjY0gpfy7Mur}APJ4d*=y6r-6B84Y z(&PnV7gyDIQ&$g-dEhVrxDU6{o#;d+f})m<|iPdot+1=h!- zhCV1zd;H&b`{StysnPNAPjo4KpKmSo^{2*}5P*Po!emiS7NBF^{xTDhMr?2x?FbEI zrYSsVx;ei&XtaoF+z!UbZ&XfI$LG*hHqo){q+kDQm(}WjXw24OvDS5@YMVH?dunf$WZy4jR2@e z^UsgI@*8`5rwdq605b&(t&zh*D-oDG=Sh0Sqrt00$tL z0G@c~>-$%&mGAZ^r!_v5*{~1j)rBV~59l(Yz(CtGK(Z-Qv+|Ip10?iridK{;d1PyA zYj004;H7*;cD?)~O*i)~I3$VLWW-23MzhgA5a@NgIfD+19JY!X4*}6TF1tsMP~|=e zew05&*}i+x4dN#R#^&azKbz#axqk$ONZ=r$$msQ~3r-aVRIuFXGZF;FF!R=c_utYtqNb>UN^p{4 z=gLqC4d_=%j%@^4-5VJ}${0Fni9sDZb>lJcii0Y2P{stRQb6I1*Qs3!evEZvhAd^w z;4jt$W1SY%zyrlewsURXG^q=4YU8ps0(^WM!DYL5QAT2vH>z)>;<;6>ZU8KyE=U02 zDu6e{YP;I?`}c39z(AlcpcE>D`q~e4jcXODzKiKiFIEq1w9T9cbhrJ#TDt&732rJN z3|P(A=l<=+Gm=Wt{AImVveF6k7J=RfDk0&*WFBCkfd?3FhPb`}BtoF)A#@a;odkFm zgYi6dxw%_F8qn|g^C%1qC=?20!xLF8W&rR_o`@3z6B97Vq~bWE`VAj0Taf@OBkv0M zF92dPkiurQaC;>P3W75P9k5;55Qd$ML*u_8e;02X>8PDp9I!ih$lBC=SM*-zwmy(i z2Xk)}!!}p`M+~&+aN2w9)|NJV2xCt?%D@x>}`?naV>IF*=F?+tkmK)g1QYAE|QVD!B5A z1Nu`Vzjl7{Fn=G<(>;21?HiWvzjzg;yV4PQ7p4wpvzm9^@Oa>=IMp;Q*dO)Ma==Nd zK3h1UrlUJBRTOwO__qeq8>!Vl&4qeuV`p_&lNTfIhS}s-#61K}fQ}%3*}%_%`y+0o zM{yP}Xoo_{cR$#fX(j$!1^3}UlZO_)hLPRc%JQhBrBoA9O$m;_r_B%x4uTIFxG+II z>fgBH(d|y5ePxo7*^!&V{E4tIZ^9@U`WZQSvo8I$;1|-6nMHmlV3ltOVnHq5f8G}f z_oGF0$Q3o7UC!%Azr8Rq^T7N3^Y~wi8Qtqem3O`B(Lr1b>QEY}*S#{L7t|tNJ-cek z&H!x_e8Y|ZzU70-N?*vsN+vcw?zNWjrY7bIpRD*neiyD!DmKTp5}d>qPH&rma*0$< zX9*B24bv$=(9W3olJswZ;H@|U)w7nNU%!Bk_=5iN@Z`u%A;b6Vrf>b<#}v|dwKTAwd?aO;Fw<;XjNnM< zpBNh2JRUma{TF2L=(pSC-OX6478tm{4^Ykex8m@h$NzZMoB*c*y8S#JxUbwj6%{ed z|7jEgHIYd``F0k-{0$hV-3G5<@?&5-sa5S=u>}aBnbrbe5Df=nhff5ol$-AR;+TRK z4;JgPCA3Q10pe+}Zc&LCnfh+G46M<7a&myuOJ>fku2zl%VzRgMPK%N$tQK2FDLgK> z$_^`_!^TFhlX4vjirbp2OY|`KEaSYcyL@j>eOXTryGl^XK7- ziOP+Q6h9c$ee9poQes4tVz4l%nB)XBcz9^`8jOH0{QmCp$oNc9PY;kYZOT;#j5%O` zAmhnz;aob=^QgmNlRN$ai-dX_^C~q)M-w!nn9;AOQ#XK_bG!;D0zqL6fAK ztdExcg0Z}K>_K4mP#R~5eVViS6Y9Jsj+l8DfJg_xqSe&6 z+yJGM<8FXaOTtA)Ed_)%!kF3YA}g@5zZB^Np?tFl!9RC#Is81C+jDn)oz?j8570xo zNOpPn^QXpc!?B`rg>C;}82q6Zi1=TTfg;j(zLywYDo_9(16W>#tksP*0$zJ#pwl2o z@;OdfQ*!~xYXSkA*M0y^gpZ3GA09qrAg))U4^UO)J6l^o=Ub=y`#X^MF|n{vC}>}@ ze)i-eP`L%aj@1kS?nHCrv64kBW>W`EHqS?sKFhJ#_M1KvqWNf;tT|kozKw`9z2*LFN zxF#UJf)I-z@;B9UoGA{bC!p-*WhceO)i@0%0|jVp`d9#)X31AdVRw-QbiU4&{sgXz zsiT#bi1^lyj^`H_i>Li;+=N#5^)6t8PhhnYhA1e?tA~UZ6&9Wyo!u=5(;Z&&;iduX zI#@b&jt8NEfuG4|rly)&#w9cNvVNk@dPHp;PQUv^>icTwE97g+1z{if%YnD;BEyA@}t5BkWE}$L%jIMF8TS?bv$*F~A@5%XyzG zzrD9orr(YF#ODxD8`FiuLPG*UCc@s{R`y3yv$h~14}cO2lSg7vs{<_J!z4>$1PTE` z|B^Krn)UvaV(JetQId#69y@Yc+E7ulP#i8tz^n_xyjuJHm@o_rAD`Om1hnKTO@eWR zhjIR$qWmexgM3K2K%CIn7y^NSLH$)$<#lw+0m}gk?|5@KY0=AT_ws0HNQRp*B|Kb4 zM#g$|bGYH=oP&dl6i%yAuPh_;%jjUCRV4J+^ln#|D0~QLt=ihzdh*zB9!8J?&XO{| zlnXHkP&!w9)b!0 zjR9X|F`x&~Xlu|pkQ4xB_5~p(mXQ%}ik7BkD6(r@_|KxEVR61~iK?~W)3k;zcIk?NehYPEg9oY^k1c6P4= ziBEk4gLhG)`wIH!l!1a1|I^a2(dW(5UA}1soKe z66M!^U%={}o?(u+jS4NIjqH}E1uW+jP8VB{=L5}2f)F9CnlH%TyY)X6Yg$a#o`EqL zS5OEljfskOb#_kVak6X=!gzUpfCZ|B@qx)cCu09~6F{V^tBdZCZ@<*y2asdw5fR|s zf`dc)d;V%$Pv7rV0X!9t+kT=Kzjx`=1b|G1iC(S#En5G(2Y*3^0fp@5r!SBp&)`Gh zLox=F)VcEU$;q@4qJVdWe$g+1ng8n-Se3vDCV><3y0f!zs{>Y;hK9#PUtG{j0mrwp`ijr>btu;6j*9%DsZ#ZY1wFL zEdfCk7+7cSh1t$*4f8*1YXCatkL(Jhk|hP1H5&_p9A#v@tikTXOAb{KUrQ=FIf; z%2l2oV^=32jK0xtfdgCS?d=`Ey`AE9{VKSXMzekjsA;$Bejvi#+}Q!qJ!WvbJ|n{B zX%XTDP(`AUPW~0!_qR!jt;*31C^i7uzH5ga^kDSYe!Xj~Y%DeQJbm+vi+tqd#&)n#!!R>%bU;t}LZ4IcKnQtF= zIB4{c&9&c~sVLj%yCQ{MQZdFA0A$(e=5SCuFzEn(9uG@>{{#k|FbZZP2W45(j|P?adV1I*;u4|E{7iT+xFO7Nq&cz$J( z)LE%c*)))c3NoU8k~%a!T~m{ro1X>dKS9_(%^8pG>uf|_T{#g0>fG0Y7!59pGyuLA zoB#q1Bk%y&yPd{+PGaKUBO|uU8K2O|rM?9QPS+VpkNLd;6I$X$YhT}6C;-WTlmVdZ zgV`FN5Z~9|&qcTcGVMr&ytk&~lmevb2TuFD)sF$xx1_`b3no)hUb{82va;g_TpX~6 zU)|iGL7s7O)q#*i=hu{!^iPUVVPQ(ICi|`L{KT7v;SD3eX0vd6ULG#-@C~I0AZ5zt z9@m8U`wQ1;8bMMWG446J(`7;SKNIy8VwjVyZBJhp(1q>Wnds|+ARyeO^CBRCc|;)< ze;Pwk=C#QCz4jX94dmYckTMdsG&LQO^d90d+wjgLrgRY7kpgCkln@GvdVb zuG!WAKJ#R;79a2_mfwk^vrOlPf)TZCUje`+A%k}?V*phKXgH8s1+xiY;w{aMv6-!Z z+V%owIp9YsDJqh{DXFOH;(GJJ%&hkEdhI8xs+u>WA4sRwqhH$clRi z3z&IOjt9VZK)EHR3S@nfm#u>sn1X14yc^I%kvIBJSJXqb*YUapF)|rBx#fJNB+KyR z#tQ<9LdyYtkIGQH?>McAr-klT?z98a)O+kMOK^!S64TS)i!!ZX+q$j z0*_a>ElV;Xl#rtoxXQp~0CLA5Zw@XRFtOW%vG9ffx?6JR(jN`bi-9Z>rLfH9)fEA+ z`_$lI@jNRK@d1VxICF2Y>9wbi*A5glz^Q>bCUB5E%4|q6gL#NB{E(MzYCzH|j#tk= zF!0kw9Z-XlNMS{Q3X-8(?CnliP5s&1oA=l$&$oU@M3e$tKX9adYFQfp%mq=fsZ>asZmI59|@p$uKg?e(RjUINkF6 zO@{0iI6Rw0XilNmc>(}IV66BL9~}1yS$v4!{-!5qq~CpBj$%f|fHh5}y!qkn@LUU3 zoOqX_szjL@w*J!(FiaRs2CW;GoK2{FndcFgvN3GToY3!jcW=+xphaCu-FxEBj^9}5 zK4ZSmtGWC5(Vszwo=7d%J6W;ZtEH8c_d&}x6{^LPRfUWC&bd2R?)SgcHQi+qA9?qh zSIrJmJm9gtXsdbQ+YI)$h9=W-!@4_9#<;J@kGv~Oh`y7=(gX0c{5477Q-3j#%06B;aQ>=!Z<~6*e!l zybPX!Ks%=P9E)ecpL%3uBMm~0A@HsD-)_AB=^Orph9^w#ROS&_iFp3nicdmPf<-Xx GFaHHzSp_=) diff --git a/doc/saml.rst b/doc/saml.rst index 7a37103..7f836d0 100644 --- a/doc/saml.rst +++ b/doc/saml.rst @@ -8,22 +8,17 @@ Configure SAML2 authentication :align: center :alt: authentication -This page describes the steps necessary to setup SAML2 authentication on eLabFTW with an IDentity Provider (IDP). It assumes that you already know what we're talking about. - -The IDP can lookup identity on an LDAP directory and deal with two factors authentication. +This page describes the steps necessary to setup SAML2 authentication on eLabFTW with an Identity Provider (IdP). It assumes that you already know what we're talking about. Setup the Service Provider ========================== -The service provider is the elabftw install. Head to the Sysadmin panel, click the SAML tab. +The Service Provider (SP) is your eLabFTW instance. Head to the Sysadmin panel, click the SAML tab. -* Debug mode: Set to "No". We don't want to print errors +* Debug mode: Set to "Yes". We want to print errors during the initial setup. Once everything is working, switch it back to "No" * Strict mode: Set to "Yes". Otherwise the mechanism is not secure -* Base url: Where did you install elabftw? Example: https://elabftw.example.edu -* entityId: The same as base URL -* SAML protocol binding: basically it can be POST or HTTP-redirect. Depending on your IDP, set the correct value here -* Single Logout Service: The same as entityId -* Single Logout Service protocol binding: basically it can be POST or HTTP-redirect. Depending on your IDP, set the correct value here +* Base url: This is the base URL of your SP, so the publicly accessible URL of your eLabFTW instance. Example: https://elabftw.example.edu +* entityId: The same as base URL in most cases. * NameIDFormat: match the supported NameIDFormat of the IDP, eLabFTW doesn't use this but it needs to be specified most of the time. Example values: - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress [default] @@ -45,20 +40,46 @@ Use the content of `private.key` and `cert.crt`. Alternatively you can use `this site `_ to generate a self-signed certificate. -Setup the IDentity Provider +Setup the Identity Provider =========================== -* Name: Visible to the user logging in. Example: "Institut Curie" -* entityId: Example: https://idp1.agroparistech.fr/shibboleth -* SSO url: Single Sign On URL -* SSO binding: Example: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" -* SLO url: Single Log Out URL -* SLO binding: Example: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" -* x509 cert: the public key of the IDP +Option A: using XML file (recommended) +-------------------------------------- + +It is recommended to use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically and it's also much simpler to setup, as all metadata will be populated automagically. + + +.. figure:: img/saml-idp-from-url.png + :align: center + :alt: saml xml url config + + Use an URL pointing to XML metadata for IdPs + + +Add the URL into the input field, click Save button, then click the Refresh button so the content is processed and IdPs are added into eLabFTW's database. They will be added as disabled, you can then select the ones you wish to enable. + +Example metadata URLs: +^^^^^^^^^^^^^^^^^^^^^^ -The SLO URL that the IDP needs to know to redirect the user to would be `/app/logout.php`. +Here are some IdP metadata listing URL that you might want to use in your institution: -Attributes for the IDP +* France: Renater's federation, use: `https://metadata.federation.renater.fr/renater/main/main-idps-renater-metadata.xml`. +* Germany: DFN AAI federation: `https://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml` +* Portugal: RCTSaai exported to eduGAIN: `https://registry.rctsaai.pt/rr/signedmetadata/federation/edugain/metadata.xml` +* Microsoft's Entra ID, the URL will look like: `https://login.microsoftonline.com/183ad437-6002-47ad-8886-c5185ce9be1a/federationmetadata/2007-06/federationmetadata.xml` +* Italia: IDEM federation: `https://md.idem.garr.it/metadata/idem-metadata-sha256.xml` +* Netherlands: SurfConext: `https://metadata.surfconext.nl/idps-metadata.xml` +* Switzerland: SwithAAI: `https://metadata.aai.switch.ch/metadata.switchaai+idp.xml` +* Sweden: SWAMID: `https://mds.swamid.se/md/swamid-idp.xml` + +Option B: add IdP manually +-------------------------- + +Click "Add new IDP" button, give it a name and entityId, and configure the attributes. + +Then, from the IdPs list, add certificate(s) and endpoint(s). + +Attributes for the IdP ---------------------- We need to specify where to look in the attributes sent in the response for email, team and name of the user. You can use the FriendlyName or the Name from the table below. Note that this will depend on your IDP and using the SAML Tracer plugin (see below) to see the response will be helpful in determining what fields you want to use. @@ -111,31 +132,21 @@ How does it work? When a user successfully logins to the IDP, the email address is looked up. If it doesn't exist, the user is created. If the team doesn't exist either, it is created on the fly. You can configure this behavior from the Sysconfig panel. -Federation and metadata synchronization -======================================= - -The application allows you to fetch a list of IDPs from an URL pointing to XML content. - -.. figure:: img/sysconfig-saml-idps-xml.png - :align: center - :alt: Adding IDPs via URL - - Example of adding IDPs via URL - -After adding the URL, click the "Refresh" button so the application can synchronize the local list of IDPs with the XML content. The "Auto-refresh" toggle will trigger this synchronization every day (**WARNING**: this means that any manual change you make to the IDP will get overwritten!). Renewing certificates ===================== -IDP is changing certs +IdP is changing certs --------------------- -Go to the Sysconfig panel, edit the corresponding IDP and add the new certificate into the "x509 Certificate" field. Add the old one into "x509 Certificate (additional for rollover)" so the transition is smooth. +If the IdP has a Source URL, meaning it was added from an XML file, then the renewal should happen smoothly, especially if the IdP starts advertising the new certificate before using it at least 24 hours before the change. + +Otherwise, you can add the new cert manually by editing the corresponding IDP. You can choose to keep the old cert around if it's still in use, or delete it if you know it's not used anymore. SP is changing certs -------------------- -From the SAML tab of the Sysconfig panel, in the "Service provider" section, change "x509 Certificate in PEM format" and "x509 Certificate private key". Note from the developers: we never used the rollover thingy and have no idea if it even works. +From the SAML tab of the Sysconfig panel, in the "Service provider" section, change "x509 Certificate in PEM format" and "x509 Certificate private key". Make sure your IdPs are aware of the change. If the IdPs are consuming the SP metadata, add the new cert in the specific rollover section so they have a chance to update their metadata. Then set it in the main x509 section along with the corresponding private key to start using it. Debugging ========= From 0de6ba79e00c8c3cb580dd62559b13bf38e08c95 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Mon, 1 Dec 2025 16:08:25 +0100 Subject: [PATCH 2/5] rabbit nitpick --- doc/saml.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/saml.rst b/doc/saml.rst index 7f836d0..abc9354 100644 --- a/doc/saml.rst +++ b/doc/saml.rst @@ -46,7 +46,7 @@ Setup the Identity Provider Option A: using XML file (recommended) -------------------------------------- -It is recommended to use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically and it's also much simpler to setup, as all metadata will be populated automagically. +It is recommended to use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically and it's also much simpler to set up, as all metadata will be populated automagically. .. figure:: img/saml-idp-from-url.png From a222ed3ba8c99fe7d9c51339cad09cb36af062c1 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Tue, 2 Dec 2025 10:49:27 +0100 Subject: [PATCH 3/5] address comments from Sydney --- doc/saml.rst | 54 +++++++++++++++++++++++++++------------------------- 1 file changed, 28 insertions(+), 26 deletions(-) diff --git a/doc/saml.rst b/doc/saml.rst index abc9354..0d730e1 100644 --- a/doc/saml.rst +++ b/doc/saml.rst @@ -8,17 +8,17 @@ Configure SAML2 authentication :align: center :alt: authentication -This page describes the steps necessary to setup SAML2 authentication on eLabFTW with an Identity Provider (IdP). It assumes that you already know what we're talking about. +This page describes the steps necessary to setup SAML2 authentication on eLabFTW with an Identity Provider (IdP). Accordingly, this section is meant for users who are already familiar with the process of setting up and running an instance of eLabFTW and the basics of SAML2 authentication. Setup the Service Provider ========================== -The Service Provider (SP) is your eLabFTW instance. Head to the Sysadmin panel, click the SAML tab. +The Service Provider (SP) is your eLabFTW instance. First, head to the Sysadmin panel and click the SAML tab. -* Debug mode: Set to "Yes". We want to print errors during the initial setup. Once everything is working, switch it back to "No" +* Debug mode: Set to "Yes". We want to print errors during the initial setup. Once everything is working, switch this setting back to "No" * Strict mode: Set to "Yes". Otherwise the mechanism is not secure -* Base url: This is the base URL of your SP, so the publicly accessible URL of your eLabFTW instance. Example: https://elabftw.example.edu -* entityId: The same as base URL in most cases. +* Base url: This is the base URL of your SP, _i.e._, the publicly accessible URL of your eLabFTW instance. Example: https://elabftw.example.edu +* entityId: The same as the base URL in most cases. * NameIDFormat: match the supported NameIDFormat of the IDP, eLabFTW doesn't use this but it needs to be specified most of the time. Example values: - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress [default] @@ -40,48 +40,48 @@ Use the content of `private.key` and `cert.crt`. Alternatively you can use `this site `_ to generate a self-signed certificate. -Setup the Identity Provider -=========================== +Set up the Identity Provider +============================ -Option A: using XML file (recommended) --------------------------------------- +Option A: using an XML file (recommended) +----------------------------------------- -It is recommended to use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically and it's also much simpler to set up, as all metadata will be populated automagically. +We recommended that you use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically. It's also much simpler to set up, as all metadata will be populated automagically. .. figure:: img/saml-idp-from-url.png :align: center :alt: saml xml url config - Use an URL pointing to XML metadata for IdPs - + Use a URL pointing to XML metadata for IdPs -Add the URL into the input field, click Save button, then click the Refresh button so the content is processed and IdPs are added into eLabFTW's database. They will be added as disabled, you can then select the ones you wish to enable. +Enter the URL into the input field, click the Save button, and then click the Refresh button so that the content is processed and the IdPs are added into the eLabFTW database. The IdPs will be disabled by default, so you will need to enable them manually. Example metadata URLs: ^^^^^^^^^^^^^^^^^^^^^^ -Here are some IdP metadata listing URL that you might want to use in your institution: +Here are some IdP metadata listing URLs that you might want to use in your institution: * France: Renater's federation, use: `https://metadata.federation.renater.fr/renater/main/main-idps-renater-metadata.xml`. * Germany: DFN AAI federation: `https://www.aai.dfn.de/metadata/dfn-aai-idp-metadata.xml` * Portugal: RCTSaai exported to eduGAIN: `https://registry.rctsaai.pt/rr/signedmetadata/federation/edugain/metadata.xml` -* Microsoft's Entra ID, the URL will look like: `https://login.microsoftonline.com/183ad437-6002-47ad-8886-c5185ce9be1a/federationmetadata/2007-06/federationmetadata.xml` +* Microsoft's Entra ID, the URL will look like this: `https://login.microsoftonline.com/183ad437-6002-47ad-8886-c5185ce9be1a/federationmetadata/2007-06/federationmetadata.xml` * Italia: IDEM federation: `https://md.idem.garr.it/metadata/idem-metadata-sha256.xml` * Netherlands: SurfConext: `https://metadata.surfconext.nl/idps-metadata.xml` * Switzerland: SwithAAI: `https://metadata.aai.switch.ch/metadata.switchaai+idp.xml` * Sweden: SWAMID: `https://mds.swamid.se/md/swamid-idp.xml` -Option B: add IdP manually --------------------------- +Option B: add IdPs manually +--------------------------- -Click "Add new IDP" button, give it a name and entityId, and configure the attributes. +Click the "Add new IDP" button, give it a name and an entityId, and configure the attributes. -Then, from the IdPs list, add certificate(s) and endpoint(s). +Then, from the IdP list, add certificate(s) and endpoint(s). Attributes for the IdP ---------------------- -We need to specify where to look in the attributes sent in the response for email, team and name of the user. You can use the FriendlyName or the Name from the table below. Note that this will depend on your IDP and using the SAML Tracer plugin (see below) to see the response will be helpful in determining what fields you want to use. +We need to specify where to look in the attributes sent in the response for email, team and name of the user. You can use the FriendlyName or the Name from the table below. +Note that this will depend on your IdP. You can use the SAML Tracer plugin (see below) to see the response. This will be helpful in determining the fields that you want to use. .. list-table:: SAML attributes :widths: 25 25 25 25 @@ -130,21 +130,23 @@ Go to the Server tab of the Sysadmin panel. From there you can disable local log How does it work? ================= -When a user successfully logins to the IDP, the email address is looked up. If it doesn't exist, the user is created. If the team doesn't exist either, it is created on the fly. You can configure this behavior from the Sysconfig panel. +When a user logs in to the IdP, the application searches for an existing account with that user's email address. If that email address is not found, a new user profile is created in the system. If the user's team doesn't exist, a new team is created automatically. + +You can configure these behaviors from the Sysconfig panel. Renewing certificates ===================== -IdP is changing certs ---------------------- +What to do when the IdP changes certificates +-------------------------------------------- If the IdP has a Source URL, meaning it was added from an XML file, then the renewal should happen smoothly, especially if the IdP starts advertising the new certificate before using it at least 24 hours before the change. -Otherwise, you can add the new cert manually by editing the corresponding IDP. You can choose to keep the old cert around if it's still in use, or delete it if you know it's not used anymore. +Otherwise, you can add the new certificate manually by editing the corresponding IdP. You can choose to keep the old cert around if it's still in use, or delete it if you know it's not used anymore. -SP is changing certs --------------------- +Changing the certificate of the service provider (SP) +----------------------------------------------------- From the SAML tab of the Sysconfig panel, in the "Service provider" section, change "x509 Certificate in PEM format" and "x509 Certificate private key". Make sure your IdPs are aware of the change. If the IdPs are consuming the SP metadata, add the new cert in the specific rollover section so they have a chance to update their metadata. Then set it in the main x509 section along with the corresponding private key to start using it. From 85a2fc36de80bcd9520b6b7abbec80dcef71f662 Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Tue, 2 Dec 2025 12:05:03 +0100 Subject: [PATCH 4/5] casing --- doc/saml.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/saml.rst b/doc/saml.rst index 0d730e1..913c0a1 100644 --- a/doc/saml.rst +++ b/doc/saml.rst @@ -19,7 +19,7 @@ The Service Provider (SP) is your eLabFTW instance. First, head to the Sysadmin * Strict mode: Set to "Yes". Otherwise the mechanism is not secure * Base url: This is the base URL of your SP, _i.e._, the publicly accessible URL of your eLabFTW instance. Example: https://elabftw.example.edu * entityId: The same as the base URL in most cases. -* NameIDFormat: match the supported NameIDFormat of the IDP, eLabFTW doesn't use this but it needs to be specified most of the time. Example values: +* NameIDFormat: match the supported NameIDFormat of the IdP, eLabFTW doesn't use this but it needs to be specified most of the time. Example values: - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress [default] - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent @@ -110,17 +110,17 @@ Note that this will depend on your IdP. You can use the SAML Tracer plugin (see If you cannot have information about the team, or do not wish to use it, make sure to have the setting "Let user select a team" when the user is created during first login. -Note that the metadata.xml file (accessible at `/metadata.php`) will contain a section informing the IDP of the requested attributes. +Note that the metadata.xml file (accessible at `/metadata.php`) will contain a section informing the IdP of the requested attributes. About the Userid / Internal ID ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -If you configure the ``uid`` (Userid/Internal ID) parameter for an IDP, the value will be read from the SAML assertion and: +If you configure the ``uid`` (Userid/Internal ID) parameter for an IdP, the value will be read from the SAML assertion and: - for user creation on the fly, the ``orgid`` (Organization ID) field of the user will contain the value of the ``uid`` attribute - for an existing user logging in, the ``orgid`` will not be modified -If you enable "Fallback to internal id if existing user cannot be matched with email", then the ``uid`` will be used to try and match an existing user if, during login, the match could not be done on the ``email`` field (user changed email for instance). You can then chose to enable "If user is matched with internal id, update the email sent by IDP?" so that the email sent by the IDP is updated in the local database. +If you enable "Fallback to internal id if existing user cannot be matched with email", then the ``uid`` will be used to try and match an existing user if, during login, the match could not be done on the ``email`` field (user changed email for instance). You can then chose to enable "If user is matched with internal id, update the email sent by IdP?" so that the email sent by the IdP is updated in the local database. Disable local login/register ============================ From e840acd2befa6be7c2219c7c958c62b292684e9d Mon Sep 17 00:00:00 2001 From: Nicolas CARPi Date: Tue, 2 Dec 2025 12:12:08 +0100 Subject: [PATCH 5/5] fix grammar --- doc/saml.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/saml.rst b/doc/saml.rst index 913c0a1..0414439 100644 --- a/doc/saml.rst +++ b/doc/saml.rst @@ -46,7 +46,7 @@ Set up the Identity Provider Option A: using an XML file (recommended) ----------------------------------------- -We recommended that you use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically. It's also much simpler to set up, as all metadata will be populated automagically. +We recommend that you use a Source XML file to ingest IdP information in eLabFTW. This way, information will be refreshed automatically. It's also much simpler to set up, as all metadata will be populated automagically. .. figure:: img/saml-idp-from-url.png