From a05ac8c25e6fa5bcf1a7a7df43f1901bd526194b Mon Sep 17 00:00:00 2001 From: "selvi.j" Date: Wed, 7 Jun 2023 11:41:45 +0000 Subject: [PATCH 1/2] Added the user management enhancement user guide --- 06-osm-platform-configuration.md | 71 +++++++++++++++++++++++++++ 12-osm-nbi.md | 3 ++ assets/800px-OSM_User_Management.png | Bin 0 -> 62949 bytes 3 files changed, 74 insertions(+) create mode 100644 assets/800px-OSM_User_Management.png diff --git a/06-osm-platform-configuration.md b/06-osm-platform-configuration.md index 69968be..d55edc7 100644 --- a/06-osm-platform-configuration.md +++ b/06-osm-platform-configuration.md @@ -52,6 +52,11 @@ Usage: osm user-update [OPTIONS] USERNAME REMOVE_PROJECT: deleting mappings for project/role(s) ADD_PROJECT_ROLE: adding mappings for project/role(s) REMOVE_PROJECT_ROLE: removing mappings for project/role(s) + CHANGE_PASSWORD: user current password to change + NEW_PASSWORD: user new password to update in expiry condition + UNLOCK: unlock user + RENEW: renew user + Options: --password TEXT user password @@ -60,9 +65,75 @@ Options: --remove-project TEXT removes project from user: 'project' --add-project-role TEXT adds project,role(s) mapping: 'project,role1,role2,...' --remove-project-role TEXT removes project,role(s) mapping: 'project,role1,role2,...' + --change_password TEXT user current password + --new_password TEXT user new password to update in expiry condition + --unlock unlock user + --renew renew user -h, --help Show this message and exit. ``` +### Usage of enable option to Enforce Password Change On First Login and User Management Enhancements + +This enables password change policy for OSM user's account. If user logins into OSM for the first time or if the password of the user expires after preset number of days, user will be prompted to change the password. + +#### Enabling steps + +- Configure NBI to enable password expiry and enhancement configuration, by modifying `nbi env`: + + **Important note:** This configuration is True by default + + - Set environment variable `OSMNBI_USER_MANAGEMENT` as `True` in the nbi deployment file using the following command: + + ```bash + kubectl edit deployment nbi -n osm + ``` + ```yaml + name: OSMNBI_USER_MANAGEMENT + value: "True" + ``` +![OSM RBAC Options](assets/800px-OSM_User_Management.png) + +#### Testing + +- Ensure users are enabled with `/admin/v1/users/ID` (rbac: `users:id:patch`) permission. + +- To change the default password or expired password of an user, execute the following command through CLI. + + ```bash + osm --user --password user-update --change_password --new_password + ``` + + Example: + + ```bash + osm --user test_user --password Test@123 user-update test_user --change_password Test@123 --new_password New@1234 + ``` + +- If the user account is locked after exceeding the count of multiple tries, execute the following command to unlock the user through CLI + + ```bash + osm user-update --unlock + ``` + + Example: + ```bash + osm user-update test_user --unlock + ``` + +- If the user account is expired, execute the following command to renew the user account through CLI + + ```bash + osm user-update --renew + ``` + Example: + ```bash + osm user-update test_user --renew + ``` + +**Important note:** +- User Management check is excluded for the default "admin" user +- Only an user with system_admin role persmission will have the privilege to perform unlock and renew actions + ## Project management Projects can be managed through the UI, by selecting Admin --> Projects on the menu to the left, or using the OSM CLI: diff --git a/12-osm-nbi.md b/12-osm-nbi.md index 42fb216..1dd708e 100644 --- a/12-osm-nbi.md +++ b/12-osm-nbi.md @@ -263,6 +263,9 @@ Header field name Reference Example Descriptions - Add role R1, projects P1: `'{add_project_role_mappings: [{project: role: R1}, ...]}'` - Remove role R1, project P1 from user: `{remove_project_role_mappings: [{project: P1, role: R1}]}'` - Remove a project 'P1' (all roles) from user: `{remove_project_role_mappings: [{project: P1}]}'` + - Enforce password change on first login or password expiry: `'{old_password: , password: }'` + - Unlock user: `'{system_admin_id: , unlock: true}'` + - Renew user: `'{system_admin_id: , renew: true}'` - DELETE: Removes user. diff --git a/assets/800px-OSM_User_Management.png b/assets/800px-OSM_User_Management.png new file mode 100644 index 0000000000000000000000000000000000000000..04c3fb97233963f486f53e4354e8886d771127c0 GIT binary patch literal 62949 zcma&NbyOWq*FBg7cXxMpcemgY+=3I_og3WUJwR}W;Bav+?(XjHekafKzTbSmnSW;1 z>Rw&lRjcZB*Q!&y_dX{=MM(w;9v}YGr%y<7vXW|_K0%Ov`t+F*_RHTVf0RY-{$4)2 zsL6E2sTQcT0s z@N6CGC!y2|>sFIfvzvz;H-X1ayy(xZ>O=4|(cvIm$(o->wqu}8c>AaY)pBKfdrW&1 zc)lUYSWerR46ZEf`z*H*2iN*H2d!_5zXT^KP$9+s9(e^5XovMQh8{5Fkg*_agMCra z0m&nXt}c(h4h7aIMdlDv*g#U)mpMnlN#`viSLX+gKnYx>Cyh^twg1)x7DK$acf&$3 z{?jb*mo@Z%OVz9$Ka27Bar585^UKa~j!NMSa<}Xl(01?e0Z8}Yrt5Sdx2;x=kwUDw zxl#VH1oaLMtz|ik41B5M9Z-4MeVmSNurnULD^TrFuk7rs3TflV^nS=>T1F3@>i(`q8Y2rG< zh8ldybUEVY^h3*Vog%cvyF$; z3ouqr$0}%9^6#c68;a^Ii+Y*ztIh876M21|xEJx=cbOyi*YLW7eb<(lDawaEv+ z;dR^-xs~Wlte6c;R8Wn5=6-(*=gmEs=IvCIHWnAc3X?5D=OYt@gH$uA)218j8I?Di zsgyLR*W|~Ocf!p@FBxYYR%MOZa?nP$XKuuAvuvY7HhOv*7xC$N(=#U0$eIj_Vebd?%%A?m3y$_`OM zOebai)9FK-uKIFr?wx6(qj?mX!b<^ot-0{rjfesH`>mD>t}6rEj~NiYbqH^FiwJ{@ zY`?HkUA&K1-71pqp%+jXmcm7a$PrEk@G9oyz6`Qlc<)9K#DSlIEG*olEq7^~K(|X} z`?cp$pAT4c-|6pwQ(KZ&q8?qScw%8 z^xfHvd$X|fRlaPAYIEI#`DeDL8pHOB_}YetUsgh6x;A`TirxeA99~_X`}cYoV>F3l zB4NLf5a55DoZ2b--4B{@DX|j<$@^bj(L2cZ^*T8Cn?gR1hjx50Zw6LIhh#*wdS9Pl zc}W#h3LV=VBNaZqLi6sUq2`Sc*2^qk)HI+EyGdzf-TYF=-8 z@+KuTZR<$M zf1haF<9yVf+hplkVOCw#ClW%Fx9fPx(X++Ma(av_ewUH9e|lgL@vbtzW?D=GTO=92 zE#r4!{p-Zy;zTKks)vU|q7F&G_jUw_V{0F;ul|3i-JHLttzwDO6yj)nHCFUt@Cc0t z`&vm;D!8yG2+Iq3Y@8(lT5cZ{mOY0&3LHv}EpEnbX7kn!&FRNpXR54YxXzWL)1zw& z0Mr#eo~bgw$#?pfLya_Fo8IoHMXKkBg#|>%BIOq{bDuxX!N9I1+xuO9PITD&2k+n& z2EeuLKlk(;cnhOl-Y;9bM{qEM?xKi+j6BRTaK zPWJ7H=-`Oen$h;EB}o~WZp#9I*bh7Jr&x6ny$06LJ`V#FHo)d{93TFIQL=wM_{L|N z7ifMT69~Lt=pk7_XDOh6`Vwu0wFk>}v#db8f z0M+dhL%OU+Z>fR2OQHKwJz`q68~?+Fp4u)4lPP;Y;MzncljXTEWYmRHq~NWzxr2!u z=zt|}`8ntGDYxXoBbe@FG|rY0e1ERY$aZF%!|Pvfn@mJ9%)W+2(Z`D^)MK{ zd_)#`FPQ}J%rdneGJSJjsJYDSX(#IP?EJ`Q*?d;)GHbSCaL@?@uevY2tKjt z+sPB;M;CD+qYx-rxZW6FMSHNR$Oz8w>BZxk6*zFJ31+1JS;^06#6okPc3<$o%Bo+%Xr1m z;Gj>vZPAbutTbFW?%0#hFF4{<6I(M*0>s+WWUe0PzrzLb1|N5JwfpP_+Oqoed_wru z1oVEwk%1l)j*Jh7zh(b;jX6cw*@IQK-}Jr%`MjL_C&mvu7z(|18R^6C47I86Z~7Hh z4d8c6?odU^8@{dl02n;S0BoKXnlE2w3e0NTq$(WuUjPyJta-D8c z{@wrE7W4(XzZ9@xk6OF7r4->Yz~2eI7s_OTUdF{FB~eLvztqLBCJKPaXg&GU_jzN@ zJyE^BTmA7#oSKJ&Y9N)2h&2ugED5mdri=};n;4LuCfn_?ftzi)vaLPJQHHtQqFXZq z&=3lyMNQBUo;LEWV`e6pL^A#ScSpZ3{4yVJyLHP}-|6q|jIN0D}0sn^Ap#)7y@<^t(6*k+ihQ9l=D8E70 z-Gu))JjJsm5B`4+@xO!pf0i86q5t)Y%mk=mj?-u|rnhe>_ zWn&M;l7q6NlkMOeEt{Yh~{$E*KACkj0I{&5s47=N4z$>m7ABD^T6}cvrwp>ZmP)ow3%h*tG-YBx)G2}4`1*0v-XUo z3rrFF^1uV)U(@{tAq@^5fYYi`c56QfxCA^S^eHev3kHZXT-?pq&N*LiHnMJ*11xaA z(A17h-IkglU2ycv$H&ta891I7dU#ZVF~Ivdb;;gNg_Q8PMg7x z&Rv%fCw=-9Eq7y}W+_?sw2^_GYX(hcSQUS6|el|P{VqKsb%_-CabuTkv}gaUq7+E`Dk+!wJ`yo*qSLMty7mWFI$ zo6K2D;T0!y$My|0+~AD~c9Q%{#LK3bbHHt5b8Mr+MBdWJ3`?H(%P|I%Ad9RoR_zySR8~r(qi<^J*?>kjqy9?o37KDhbK=5rt z!7@h6P=o4KgPjZ%P3ew-&Y)}xb$#F3%WG0oW z(I7NoAtK=NlHvFSd|m~o7g47IE`VY(s2vgswNPZyz1wcO>tx$m9C1h}nK?-W;UTT%q|`2i3-9Si+-`1rGr#|J{7gs38;u0k(*XIjMZ#*`B^~4~UDeA0x!1C6 zdn?tg*Z$;b?fEqkH=>qvl%qHQr@0l27nAt2&nt}W2WvVc4z_Xg_bvuWcq4P(Bc$2h zp1tdqV2r36_s2jcv6jKsH6?a@EGWO~Pf*3=eh@(z8;`zmg0f3MI3HVNF;Vu%7=#9Y zmra1-vVWV6LUD|dO5*VI`$p}R!Hw(EHny-^xA`$XexY!$9Q;4a3zs%hcD}d4 zUNBYmzums)K%D zW-!#8rmyXxpAcmFzuX!*thOE=Dt}1hPM=WhdWG(zM@DYET+GadjU4#Drz{%*t|M}Y zI8w(aHBB%_DUL#-icl6MwF!-QZ7*?u%Qo`vgAV}b&<0O+65s`^q&#My6?6SZS8Hoq z0Z2T%inlJUSXZQILIwxf3^s)3KW`^S?W?cQ%9_nyZx_W)XcYp#=0@92_38*o!IN=$C4Z6cL2!KmpOCX@TG(e#{=mDbg)h2`cs<+fzO4_=B;Z>&#VliW~cJ6eR1@tD&|OQRONEdjgM4Q6}=kr)Y9Y82FT z0BedI_RP#XC9CK~Y60oWvszimAyB~?PLhD#n?r|Rj;=8 z#t)2!qfVo=UjHQx{8SNeE#v=r|sKbgY|qeUhu_q0%!(T&Wn zew!n$$xFk+@rfyw=Rzwen5$g#99!96WM-5_jBDgvYGnAz(NbG7DKR-AA7$rGW_L~m z06cWDXK+#ojel;@cd?voGp6c?;YJHQiZD$eSV*fTJwxz!9YXsp9)7WC)WWP4LE*aB zzdT`@!<>IXwIcmALEVdjW4vv0Z+Cop!I9$6aT&WW#}BDBLN0`o@-9U2T6c(3<$Xv% zLUe>QiowG?PI7WW1t;fVDwNrH6c%Sdf`4wN@Enq9ESdCpb>A?VUAcfc8HUH8mV5VSet9mLBQ&s^Y%cWn*i;wV)5ku ziw7dT=D6Uazv$2T0=ci&BI-Tn%um;c+|xmB`+dKcmgm1xzu)LRo(x~R3oya+uD*oo zh5DihJ%~aJU2VP_@T|8wH3jf%F3PlxcZ%J603RITMK;(cs&)Bq13zQ`q*J@fmZ{wn z2%o75cbl%()ejeZ$2936g5$nP%pec4b{G$QAZ!Up_ei+$JvNE|R6b^cs-g{>%?u72Ol_8iFiF*Oq9Kc%9 zQ;H&<%FJ^D;@XHisIT=K;>D5gSV4Pg%&7Ko) zzDyo%?yM9N4-3Ep@Z)>Ux^88;6`?`1yCL9li0N@HA%uTqm9V0k!Meg)fpM(7s+z~# z!fk%xGzw?Ej<@K*EQQy@z3D>#{2wNcbDeNk$Wm9Pz1_!#V6|<$Cu4xlZN4hXq3baJ z{R4%&Lz36-?{s>a-OH7bjOp1xyx5~-O*+K{`5xY@88V|n&;*A zDj*sQ?_TDk4i0EaXlODyBR#P5(-3QeMJ~3RF5-zHwSPArR!aS`)oh#O=EoJ4cVWRY z9>%)Sa{yj%v|qIBHtAh-zQz{xenE>heS(4?D!c31;q~|J^=b3V#*mXuHEmUq+U=H? z(KTYR+0^2}-VQlBF}?4BZ+p$-z1DaLpjr5fishCc56{5sw|<>G$$~46pavF3?T1`u zJ2f=nmBog4&q9jcYmI*50uJ^WM}?+iAk2lKChP`dWWZ!Z5KsSAJ(avgCV|qWpiqag zKid8S$M?%DJrpj!1j(vspzLCy@q5p7&8EP|Ig5ZlSZMU{694_&NP-zq+m=!3JAEI= zG`3Z?6+G3!1?Ou|jb8gi{@lv91%b0yl4J-9U(brqq?fLhT6B2n4Q)kFZeCr(q#l(` zh9Zn5?aSu(J`-(V8u(S;=3CsK%nN5SV^bG};;S4-41dwi*WrWr&ELrEacygZB@siD zI7uG+T^0D^a}&ezHBrqpi#&Sv7@>8X#X-crc#r=Jhehf^8Shu(=6cbv+DdI|E^DkZ z>oRISn@9Dn(obxhp%`)zaJcf)vTfV0`wt_Ae%aGD9^uh)IzQMv9ny~am0!;QzSWgi z5xa{b>dj}1=0>c+}NG$8gS8ovsw@hB-bxXqBEss~r-%&!)Xu~&p zrhgAJPV7`UobhF`*`)Fd0xvZz2geE^>4e$1|C~CGhYJK6*F!~FguJfsTFr^tx2a;yp&? z0d8x$ym!)!TIWkq8wAB+8~HG4HF|VW(|*8pHlYyqxL?K| zOK)TqskYkA1T7vA3V7ait`H;OD&#H`Y0CibHLP&aEk{Q^Mrao!Q;SgZz9}&_Xuv)yZ`+>iDE#lT|g@&E@#FXthF8%2S87 z{FWhh14a0-PNSo`QnK(h&! zRf)ibChYE2rdCCyNMdmOVpQ+F-b~VY+_wDe0WKqAVU|+_;G89K6DG0jV;_I|9Qu?b37{MRe*>gsz0Uw?f8_+Q^6>obZ2B*>s zSS41LZHzj+pKUQVIlrbIQ2v=)6p*A-_Vt<_gY@DRr{8I4Xf#{Yu631OaCGs@F}NFN zS>sy8@;YjQg0qrpH-FD*UTtwH1$5Of_{doBT=6T8Z&q#}g% zakdD5f`OK1%*a`pS)x)N9gdy-N@cZ?4Ylcgw%{gjnew~b^zt7v{RI-1XM8%EM;0bX z%!qZ2jWqkq;)?h)%^L!BFp_Kyk7y8sDd`KPiY^*^h!~ybK#8E^WHDC*hjSuQ$-{Y- zTY2u&3dHElwYr;-`bo|Q@>UU@?okj`42woEe_Xa*dHM11&{(d%4;$a|veEm_p)I$M zi@N-Gu?Yq0uiE4l@0mNjj3?K+q?2nxvwwuV<(QS)_3Fya~fH& z3@e5&6UGSSsbt2=q#6)_5PDjN&bW3S)7+EJW-}9bwprax$CkEH<-&;NXC9`Ja$zrL zfK*V<^hS%j>K8P6ky*l2+2@}|NvSD$gmEx-$=o*YYh%g3pRTkwV@)j?2w>Em5uDK* zFQX7BVnx7|?0fyc)yPPpP`2O0&7x`!`5CMnUp9zZ zj_M@#=Pf9&fr=G}2h`DxJhnn=^QMOjHF^p<(h+lbC~K?@2cCGaNQa==*I2E*>Pzx{ zxKpk1Mpv#gKHX*WSX^`r?6iZBV_*J0vSVs*}J z*VBVRHa=8XCRB&hX4C5rov@*<*6b|Dl=`Z5MuYSD2%?jGS3?VJpP*oZ zu1b1pdOSH53ULj6&3P?HJy%8QU+kmznDZBt4<)}8MOn~qc)%iYHw#_0;i-l@BK}5d znGvPP9l9yPL(i(<5@%Ek1Ne{K0P>8i1Q)O9(oA#46=}-#Z2dL!va@R>R_*QrXM8Ed zP@W=Q7g;nMx3_Dbim{5I@mAJ1ynhueAFZP-W+Uj>Z)x@EPnC$er(ohFnR6a9UnDfI3jOvB$?lju7 zaQP@Xbr=fG@Bq#BXYP1SBXfBT{0}tj^tw`VIZ9NRKEg}j|KgIn0N;nY>hF4Xb_UPO zgBX^&o{gDqt?0Lr^@@qWT>su=HWm=)#=29zwP=Nw6z%j|E0hWK+zMN|VZE_|wX>bn z{zj7JNn7RM-5ONuO2hsyWauMCh3XV%cexbN|+^~{YQ@pnAzuq%0mx4`zhElz}4 zm;}Ff7P%^q-U9^fi=9+jlH-2Y$42?zyb`qIFJ}rbddU+cd7g6={yCrfa}8<@fc#vZxJ*ykBuzHwk#w zu`lDEV%;g}_p?3BuMTgcdIRMYN;k-ojeHY@t{)xqbi%2el3otM5qg+*zxMfR7Gvb+ zzn0OSdFZW+N%;2e(Gs~*^4dR^HhOn{#fE>vtxZrMg!iPCEdLgsjqDRog}xh2j%a(_ z+!6?1^aaG)D1MzgBAR;>9Je+Qt?{eBT>!eyzyFEj*`TY#m{Bx|4D~fKg+EDc?*^KS zpD2J`7(i)e{k(3Iljrj`=vg%OYZl%3G9X-y4kisvE#vE#4WwQ#eImZ?lOjT~(u+PL->M-bm3_eI4fb%`;}DAuiBXYaTp1OobR&Vg8hwW>kk~33yNS zGNw_WWZk~{nsUN>{#-7A8X3x{l&4T8t|MJN9j-cI+r*mA$!CZnjEi-n+xc6pq?q<= zm6|E-<>M=*GpZt79{rKq@_X`zvC1g3ce&_aW|f3QKC~nM$Zu^Ly#JMt2pNrC z38m8Erwj0219I3EntqNY?Y=O5g}KJWK)iTAUnju9`MF#Mtxf7DmjChqd!@S7Y7zmN zmdp`X`;lCK? zx&FKl5N7TEA{sp~h4^KI61Is~DV(1Tk&KmmrCq3LS_Y-|moma6TMsNnnp`&yj-IRA z)-dd_X|RT%pBTYEt3Jd18>F`S-Crf7-jDLgL?v2fq)1E873vpy8K$(>Kbrac`L2fG z^|bUn?SJ`p$ebYf_gG=^cq+k=-O0t+?oSARtqJ@!ddTka&HJ)qa#9(sOj3bVJZuQ% z-WX#03DW$#_ZhOx63l1MUuJaus#XRo{WB+_iOUYcN%2AO|)6DqbLTmr6 zM};)t?v=eF#cn0+fej64xk!RPGybnM!#QqDM`mr*!deL$O)Jhn|1l`~OgS{@>!u zuek6-k>1IwKIXW;B%q-9qIG(bK2$NjFdF$zQ-D$4!Qm(9BVsUcgW+VGnj~{^F~D?t?wDV0(P;eKGSBN z1gA9>mHe|yLi3odzpocYazOai8{|vY9>M8LcT{zzeL)}c$vFz8jdjCV8R9QS)appJ zZ>h0){_j42892z|F#Nc;Gm>_(0Jd*=ttzXRxFV{C9&Z}wrKf6CMMY&dI9*S#dOk{> z*E^#|{yQx17YHRfMz_aF;}mrn2-YjFFE!xS#}T3MYG*>M^6GLS9Ygg^%T^6?7hn#H zQ1kiNQR{MdSrC?K8Y2FKAb3oqX~7u{)PwO2C~AD#06y8@Ihd5Css12S(Vo%rE8aFU z_ftI7ww;#h__$;7e~&XT4@2=iT~%I)UGaF^^>ENY?qA4J@7x7+0rs_Rq1zB!5~?3C zQjlmS{P+X;Xys~T z-?TkIb&)ToSWLhu>foP`h#zlRA^>}>=Y=$*r=7Tu<6LoDF-1=B9!U8f#-!o$`{^;S z>by$|w02)k6%7M{vL>KA0XjJB6!_R*W5mBkm<0&SG+=o@S$>BlsTNcdzIaCM87e^p z+ziv0CZ$O}Gt$Irak>6g(e)^t+)^Ivcxq^AS6^O?443BTE_HZ$ZpVP<4(EI~D_JnM zJ+jXiOf2W+YzLUXkFIYF96lau9PV36y^2~rZ7sEU@=X7f7t?eb^G>GQ*_TO|sE3=L zZj1}e%=6NJj9vo0-tVJMkk6urI1S8U3^%+v3lxz(a$k0h3CO zC?Qc#HmACw*}r9j+ifRM>A$j>&^BjmP2^!Q#xhuItU%+o+ z06XDnld-V^mQLE$!Hs>m!p0+ zuH*TQ1H3Mbnm9J3a^ZRLyx2^FCxcj|<5Z{B9_W-HN+in(BWGONXJI)I$=i8D9)a!s zkypd`zJmh1J!0~9HdfY=a4}FmtnDnNY~CMg0(91vcrj*II)5AjU{+wp`IGYR@8mYp znI0d3EswVT#oJQ{iyzM;Kw%!93ffx^)D*+Ar|XUC1|kdMzA}~W6J%;ikX$VS&7-HX z1WDFonvt*n_=$M~M^VlD(&Y6zUUaF`*U4wenGga- zn@u&N42iF8fJe|_IsZ8n)j(47*ZXeKIw&h8Vz8~x2RZNJzIJ9t|2!4^@w!<< zg!EOBgFPljrV0FUsYlQzL*=x5nu={`Cq-{_aVflRFYTC(2+3Hj^7U)SQ$dR0+cL%L zWb_k-*hO1P!vO7!X5A$Uz^|-eHlg(H{c>J{sPlc~k02Jwa5f*sjK{-b*Yjde+ePwQ zM!Dl=1K9txyQlB9;tg;H3dhC56D5|NmiNb!mI17FWrzzXEX6e35{ozv3 zsk!1|iU6yx&d*@~%SF6Gp|Tt&HPs+qib*rLzzvr+G(qff_+CL5#pq?C*lzl6ZIR>(xxQ+FH!~qY z6=D4HmS&dwV~jB+;FrgBDW0_!$`B#pKfBHCJ`aO5BgOLRd3qs<+^c|<-% z3|aA3mv|DnEjdPyZmNv3c*k7j{tB%huN;WQF{fg0f*19nw#c)u%nOIjB8ys^>oRqQgY3^)3fo*f#yv_n(P2tVaL6RwoP)7v5)p7O}=mAEtE1YJG zigF;xfrE+4kV5($=kiT-Yf1J!0@QWa=R@+oT_$Gl-gXz)^)?>&;b1v&re^5@G8P3F zv8->jUB(#9pDUJR(PZbY)Z^*g?&#uGRsdK z?_3cC##2i4)|po$BAezPg$1=ZUuHH=7}_UtZ$ew1f}iFnO@Dmt2;A!1j+!gH+PgaP zoEgjLZAq$6HWI$y6Q^)FlU?t~;wf6G_|Up|d*czd6lk!!y&gPKzsHNxs*yD{^t@2n z?hW}BuG3lY=OrfX6e0qAnSiyQWwhSvak%NuxpDv0d3%F+rm;d*!^wCK$1b-eD~}n= zSrz>F!lDZrhGvwp0d>8cv(U`Gk3$%)th|jy?b{IhR%&p+^wtHq-QIHC${&^t+bD4% zK5&9RNU{z$--pf{k^z1%&mRFFHyoym>)w_>egnV}p%kl4jS1IAZI*I=_Zd!`$@tVI z)5#Ewxx1drp|2$2F7tN6E0M-66Uo1R6ShBUt-L9~66)cq@;exQbOZ*^^-D!X%HMEE zni*Re2j1v3*$Z5lNd6whTV4FdOveM*pP4B_kni4YD{?t7J2qw5fRUrEFM5_Py`h5(Vvme{w4ZeQxdyF~~v^?{O?4PDiP2z{HE zI_434xHt0Kt*+!v`D!Dp%+zuGqJt!Zl1sdmmTWO#2=U@cN#8fN)1f29M1!csfm5JGDhrhnlWM;vx`o7gj@*45os}&o?#Zh4KGnI zX04zgzaZCxaepmGN~kHo@ z6<}G?7(Itk%AxiDNV2$F? zrpNc;(5||auHz#o>}97c9)EdvxUk7q)uoThwZ{#O7$8TK;tEYJ8ptT}axybxziTsz zXt?d}A(8*X$59_ce;l&O8i@`$p=CMZg32LYa+TBebPo5{V4Eb=>q1 z<92Zo)M&L4(=HRX5w9?X&2>j_#<6sw8Fr;k5fU=6rKrt#;morUb>BbpFZ2#TjmoF1 z6W(QrGuT|8k|?n9xgXXIJ3BRMZ72N(7s!J8vkoz8O5gR%ckR$!)*@ZHc^bj1rS&+W zTL0}c8)oV)TwS}7=jXVt`=m>NouV~=>`zP+Yy9Z}0{vYI2;%yNPMowKRJ!-@DdlL`IH)Zz(?N%Nv%>d9j_)ch{0@ zsiq)$ccSt&pWit7Fm9NOO> z8l}->f*L-3e>(E|1ldt-49U3NLkKYekDrZ0IJ*6#P}=ls+iAcmv5#lpOolZlRPLj- zk%6BXTJ!x;tK@1Ucy9RR<7$Apq;Gfg^36Um9uI7$L z4SI$SGBXWe=&3R67VB1=JdViIEOr6|*Lpaxf-Y(s568f-Cn%>f5XSOXY%$UiYI&}Q z?^(i+-QyMT{aMZ5COge%-)*8`At@nb)Y0Pma5Z*<&vs-;I(N4P7FlvKb~12D9zA84 zCgPl7Zp}dn=SW-v4|(!``nF`-txCYo`v-{kJLEhu<77p^u(@Zj_ ze28#R9j@_^VKL$*65_cJY+x%(%XoEbGZV7HeYE`8IOHaG6qZ%jLkgbX4qkS8Y3H-R zNsE)u*z_skI+0xC+FqCUQsj`sjM*t8(eE!FESxdH%Rf<4WV^oyT$O4tVk;q&{Q%)q zcGhW}e9Y$MzHTo3$Za|LHf@O&xov{x4a_4)L6@Poz!UcWSUE)}2Rt3K7%>ubna@I} zz(&N6-RNBm!6JWbA0HZS%*G49w)tS&_`h`0~_x`z#J?U&LOfP)Q0CY?n z_h^ny#+_rnc%{R@4US5b`}%g%NT(5eNUO?Lt_@Zia&Su+-DU6rceOt`e`qXoDz?Oz{7x;}D5 zI9rh(4Mlh;n694=s&)(dT@%h(l)F>}&X5yaoi&>pfzDbn=G$l45G;bPck9!2DV{ScS)(K*d+vJTdS0ki3K`R$KGCl{cX6U$))3{GT>&For9$!^Mok6_bTM8;K?T?P7sbbZnj; zZ?%&+Q=qXc#h??VWv8Ek{ql?gc)#sBr#Aph)(7&62dfh%wtrVA=KeS{GV-)`Xf(p? z@)bMT)-rm1tcFIjgfIY(o+7TuC$nUb=9aQ#>q~wOe^(Uj~%HPbb5~bsE0+ zQra!Hn#a+YOi%V~;*50kISJM6vN?XgF7IHQj;mMgJDtwgQ8rVV5Td1b7A8|a&dWsJ z-m4m*)%Ddh%bO4H7--tMKbwxxwpxCh=<>gvV*$H(E-N;hr6-f(9O!J*qRa0)(c6MX zYk(bHd^VcaB-z!Nvl)QP@b+e8>tx=m8Hd#PYUcmIa6 zjjQU@atShLiIc#X)Y~A-LK?z0m^4gF_DnC?PVL59#X#ctKk$eUDFUCH^Yq}b+X&q| zr!iN%PbIPVTUCrH%%%p=bz32C`Krk6-munRZ|TkO&TR1RnY1;^JI%8DRK63ZMLJ@B z4Ua#nR*N4`O=rQdRsOX2?l6;((B#Y^QG3L&O>S9&F- zjKn%1-Q4B5yO%P=y|&0toXJ(u{S@%1$NIS0sd_}RfXht?0$NNkflg0o%(N9mufzLo* zaY@O^FB7*5Mjy*rwFeRH^1n^Ugm?My2P9!Zq@*B;5D9@Dms<2raq?^v-~My*0q7WU zPv&&2NK8mf9Ky-(#y+{*Xo&g+3e}w^*WZ=D88q{ARZvo-S{sQ^nMzU znh8D8|Ky7>BcQ4u-+Py7;O_jB4Tk~sKbe3iQk3Z5dqwmACxrUfG4$(y0;VAqIsS(n z{Xa?#DAOCd6C$P1Bd%W8>!i{kCujhyw7syHudGz)cV(#cf}shc=8*muJgY1bhfl_oh`<*c z)~xVtv`}-=ZSo}f5>L@2OsQE!+3&a}1{vLtvK*D-%sCy$#}IXl1c(XZY>r5W)|BHz zl;jbfBT%0~ucBg(NNKsGBcJdB6sS{C$;npQEdE+_10!KFy+`JD{zb}`6f;q-2=cl| zid}Y5l#~(*Eh9XfDX^Lqu`je2Ek#W@MNCdS0d|t?7j5LYQN@@1+VE~F6DQk`L_y$B z&8p~eQLW#oauKYyk;};}xQX3?KMy;5e(6&86+7BNb3ed{!)IXjYt>0D(#MJXN*ui^ zGnn${R=C$C?B7~^l7spg#qH>*z(xsWi5*D6>tD6tu8-8+9JGzg+hls123f#RhdVeD zuE7W$U~PL4)IEJy4X+MP<&6!3`rJaCv_+n|Z}PX<2txeuuUb-3RMbokb@@M&(PjRp zf=?*uGYA4{n7)*R^?dpPtXMgnpA=w+jp1DOzu@gZ*MwQ(#f=_cK{Dq;T;amI$Ze;` zDw4s z{sSX_kz}gW_?rkivU&?F21c-XX^GtuMbb_HYLZ9=r36cqofER`k_s<*+TSsrwCas% z8Iy*2XExW?&JP`<$(-EQvhj54AHSIfF%_Z1RVJG8F{6`VIqOgw*Vy20QIg00HvhYG zhtSnAZG1i;&;tJb+-%Y5x)@|{;xtmS@B^$7uq0LvM6L#65i9%Spt<4hRv33PVm&l6{!Se6J?$8O{YOh;U7^r*Ij$+wvfYcq4i z__;mETxkijo#l~S;c$EJU0uUc;25wcf%eb7RMs{}nc-EhqJqmjg4nUFbvmK=xVf-K z_2X>l@F6<6=DmHU?xBZv2N4s%ga9_sH#Z|}cwtXCh*BAEP0a`RQ0x-tEx7J6NNKOnQPm>Y#aUq=5xLY`@A+2#|Z* zD#mNuSU-AsQ+GpPg)m`T1V2#WM*M{d;a=Xvnptr3Y4avgsI~L`Vi2H$>>WtO4N|TH zuF5)@%b1xBsXjNL+ld!s-#!(;=y;||QI(I){qCrg>>AxhN&2utuOpO^7H5u|r1`^V zf}WvI?;5%H?%y>^Kw8*}E)}|Nn8zaN%xK4gDlM zQ9drp(0B(g<2regWB(6iKKiIBZ7aM z+eu_~!m#zxOw;9>ADAK!aGbLEH_Zhx-eZ_+rE;$S?2lw8;UjdP@pnpGcy&g+*r%TF zh_R-LP=_Jn%oMD`gos|gAF$)>8vXnCGA@FSUsUaDRHRuCO)Jv7kx|Kygm$P4>zyN8;wBxM|27+>qaIUAG+!2f)1ISpQLD;;5c-O5;|0|6-dyhQbCa&pT&sn ztj9>j^%()g{&Vto9G3AlEQ{6%UCpY@?ewd=7yB0OpBF27LEayQd=r0@jfHxCZLV|h z9?;N*ja#^dNeEAt&SSvAz<~bd-!uUO^TQ>pqo3BrnZHbl@r0CPl8{rWGV-4xh6ZLs z#s&A7=P`&%e*p%d2}sSFnp%)3zP=g8Q$ejaImxi1-ymfeAmS0@H$YST@v`mRq4C0m znzWStVKql+qFph6a5J!hcDMa2Ty0DsJ7Acvd7VO&wyJIcG7MgU+ z#1;rNK0$iy#5cYX53<0+^^h9c>Ml)*hQfgD3qDs8LAa5@q;MQN^k{n{MRkeQ?!d$& z#BX+?d3V)xCsAR7_J0h-8jX4AR9fvWYz`RzprUH zvPa)@1DpIdM+KBytTpM;(OO`W@!LJleD}urYku+hQQMKl5+{3+kJRDOH=;)%LRz8dV>6!1l13T95;E46ll9?U#Gy^DS@Gx zxog0^+A@oS91<$Sv{m18;hZGMBg}1o4JqC;HI>e!Fq2vbhawlFoZb@>GI^fvIM{ZV zzx``~;K9e&Z?{Q>lAWD>+fU%B?X6qqmx{cv(&AowjAs=mwYpLx!e^3L75o%@1v##l zH4O-ohsRiL(Mr7Q*HCJGOe{RS#!y*rPuE^$cJ7Mt6Sx2bKFkjK$#&7669kyI4YZ2? zi?4T#uB;2cJ*z6Vom6bwNhLY4ZQHggwyl$j?TT&Nwry3CKJWeC9=Au29{p{9+h?r3 z&cZY2{5@fY!a>GOL?ikVUSq9GreM{He`)&ocY)amE&Lr1zE$P9#4kzm0ytS6WQqBO ziO(F#cL{&8FhDn-eYZFVcY^9ATF}V?Ks>b36)si)8$t>x(jgSm*5Tr&^V7H5`$*V*zSts-KTmAn1DjrN3^6Im6n5h+V=K&HgJrNmAO@cfcW~@EOgNDxQsuW}47;JD zkd|jVVV7zJ1S+A(RV_)2>eV0-n>czk3R8SHw7W3*FDq`l*Z(U{I$`tn8%$c@I(@3I8M`#@( z)3TKIFa&D!D_DsV;w1`{qqv*XV&mqa{(UzNj6i%>kP&<5%htgvN%Gp%YX#sN#s7Wq zIK^-a{QWP-5StlVc+f>!x_kbb@Qe`OHCUF~(XsqF*3hxn2P_5eq2uzAUo{pwNnfE< zOqlmcoxc0D7~SdNK|^EkRnwMbQ;owa^J``;yB-Wf3B$2?*nOK|Sz0FuO~a=+F}37y zLXvgB4N6xc7+zfBu1TA7%XPS_*}jdNoLsYJUaANS+a%ab6CVQ0SD9ym;Uz>YFyLDd zO_5RjqNIsa6*?hKLzzs3qgBNAaoTVO>O*<_c8~!oGUso;+z0VJ<)m7P84=P5F${6Y zAAe;c6AckL&)BSrRLFD!0=;&w3fIj!ffN89!4~T%}OEhXWSeO?ss+IvGOO^qYRmq{>lb9$KXpi-^ z+fWRL2v#9FG=?N7iSc9-5#PiH%0&Ck+o4U6Y{8Vwo1NqQbyk9)`V^=*TpH%l5IR6)sKL<6fsN776{@WX-!^u8A*Blg z@{Ta&5%P1PhhPa8FhU(svFstu@^n&Yr8qaDWYXXC&1v4lDYIMIDoT!KyO=7=Hjwfa zxw*uf7==)fvQtyC@~hT>duMg9$LzP>du|+%qkNl-j0XP@TC&L2{F!LO_Qz+@Y3;K7*&|OpaS$c+ zx^5Z#sOI?5;b2(`POGPN8ipn>ua;Q0vLtKlz8Rg)N9VAeT<^acJ6@Kn#`TNc*w9o& zZ$Na=I4ZbthGB)^9=?FqD(TXw&Ay0|ayh(+Ih|%J*?dnysl-FZB?hmrLS&&uq*;$Y z8yai~^F44pAh(T?Nco?^0)i39QO@|#DpCh z7dqG%-k!x`kSa_R4U+F2Ryq&vn)-w1{h>)i~_ z&UV6;09-IM!t$jW1Ht5n>kQHddRnO~+w!T|-X4M47nj8jHWLDy?`=^fM51eb51vYQ)egs~hyp6>8F&Cgi1Bp&8!@xiev zvrfN>LpL*`T-6VW?dMXoWZU6EB!Uv=io!mn7nV4)G zF;fhR^2ren?qOdyaTBB^n0_ccY&f3{ZY~rqp)j5XTna)s586l}oH~_UK|rFOB_tI95J6Yq$EakJW|g^iq@ zo0eXvKnW{#LPm)>ucATZ3F=KlHkc|_n#?F7od|&1s6&wunSvV;TcU_e_22!>ggUXV(O{?*4;vS?+p6Zu%)$3%xoV8_Nm7*y^88FbgVc#UO40=}F; zgi?4MRtcWAZxkQ8lc`glfM$p+ffKETv+L;1R5tc!IovbTL@`H>JSh;63XsssTf|L9 z)uHJ1RHIWqOWtz`RaJZZo` zcxk{I6g!px26&y`Nh*f9^F|ESlJ3{W8lT5;{qQP}+_-H(_&#{310C(gb--P?N*Rk~ zGAv9lF*pw5t`bZDN-rb&=z?jH9SqL7bxIisF!5sIgQ~O3iXLJE(qhH zCG;}jZ#3JXdCU8Dis4y-cCTYCMGhepEr-8k+6bowtj=Gf;~KUey0AT>xdUzmDREvj zC!6#i2^J52qzZqN(1~Lo?G345b<%WVKHvm=L1{M8kdW(h-j^nM7ks+$7jQ!+oTA*u zXc=rMIMEW8Qhw0S;4{RhbMSSg|3K|gk&dEm@OqkmHk40@bCVinZ|lRy))mS%C8>M4 z^x8O~3$N}8R!C#D8U zB8Kg+-fbXKLk=fPEPL8br-KHhGhw^i%(91qX+rf&kQ?1LE_{bexB3n7n?3~3qNL-) z93k@e{eJ(GW7iVerBo=aU^M&S+sOT|tvBLz3_;~zUb5UjF#!1@%y~PN0p>j^Frr+k z%2XyhD&h36M72aczg)Nv4>G~gE=kGO%zMJ1|AQt7pvQLtSh3Sbbw+0_FCdVFW<387 zfMQuEh2VeuiL^LBL65 zesC^q+@#3=xFFNma1=&OSP~?#8-9W+X#dMZ336Hz{=eaA|4+~5e?YajQjget9FVqh zb(zcF1^v?oGs{O1NNP#(WWpq?=QIAi%gu2Y%kNAl!fa!6gdf{JgSX!bE!k}jF&-fQ z1N0hMu$57QK!N=lxS~q4Yp>kkr<>k|8`4g5!58bPlRd^+I_T$|-F07;5>g|mPWF1q)9*uDd@8w` zEcS|iEPhuMJ44Fi?JWcEYLnrU@{uiWgaQP6iU6}V)5{-&2egU-lf!t|o3(sA|CvaA z>1rY20*j-`p`gON#pwziRD}__%Ni@x`5fM5;pP_gYNm~HP6%-uUW1trxOn(j_|^o? zjFC+WYy6Xy1f1R>#$csZe(n_5(x=@~D|Ha7Eh{BkPY)uSk-r;%O{-M8YOx4SRLXy^?*Z8kGa z!Bo9-9BJ*Tme>f^4<+>5IF`Zn*bPqo_C3_i>f5$s1$@RYe0k%nSmz)!dDFH&Ze$2> zoj~@bFdl-798NmEPIqTnro;PY`dDSD0{e9Cj<0m73T%?a=Nh1@qe(Z$Y%N1Wp37k- zJOp*BG&6`{M8LXabMPjYhA~WFN zKk;WeJ*{MX?T3W_{LaPU4O#TjG6YxFTug!fmrq5ASt6D3EWS~z_gZ3!sZ#(o_; z=8RrQj*~{)7v|pzX6HmN*OI$xAfEsdFp7|m0qgmF%QKoMm#$a*T1@(L94obpQx`9{ zFS9&{FGa`xtk12^YVr^HUIE#gLi? zu}_2ql7;O`WpFip3;Z)3Tq*v=&vgL+5Uwchp^30?*3fL+9}v{7#({I72+u6ksz{57 z$cpE#qESFI$1!zil&h7(vhL|3B7szCVeB@nVTDlmX0|2O=EpT3vX;;U+}JAT?vII5!Y2KNhUeT1UjT2wKW?tthZc&Dq5j8w)(0%F9Lb8g&;L_ zs;)Az6{e%}pN)w1G~l-|0GrTl)j_wfqo@K^!nqrPFX5OAc+bn*=H>nNF4r8RB=nq6 z-t@V(btD8e6u-I24@SJ2xtg&@!JcSMnF=B~N$m0^)A+9MYXs9qB_}r?# zQ&0cxx`*{epZi?!aqs8!a+`)1<|F(L3iswB7>0@#k|Z3|^CL40bzO(%A;E!GTQ+uh z)4J9|SZ>+3AQar)K&U5zQkzR2C0-4c?4g8!@`lDL*~U#h5=KpKJ4a~@C7y%Zkl;W< ztljTvtMsw75v&u`(X@;eHdf_ZPA#b^<`k&LVOCmk9M6;#MHq!8ajrSGcGfm7(vkOf zsf?N(gb0E~P!Gy1KGyIoQ?Jr351ae?8%|+9~<65*Aw|HqJ>z)XM^!;zya`xmSGG2O2_Zf3nfRc0lJOXU4 zZ@%wH-V%*ML^&1x6b}#6$)WjyIgRK}V(6*WwNr3iV4qHbF#0XGme(-(T1&=igu&*3 zf_*M|dTLgdp~8S3#x7;(+qwK-!cf2hrb}E?25(3A4$O-oU0}J>FPjwtfl|lfz8FCBcUwAUb>i z6wxxC?g-ShK1T(f4YHH)Wr8{34>O%q2)2Iq8a*CBg2D)kiG**MIAXye9>HbiIzmRF#N?A7r&8b#VKWEa(TiQgD-8VpVC=)dt@(Nn zzuwmCAHw*$<{(OE_@r5x{V8!#8~Vp93rbZP*V<{S8F@#A<+}a3x94~stL&t)kfmOx zVf`Oy?oj=8ztZBOs$y%B5++`zjhDWs`p~7Py4pe}RacX1V81JYDMn*kwh`LZ=QP|p zZrl4g?~sx+3kK+fD-yP`SW@Ax-eh`wJPK2Mcao>8YTM{a-@!pFibZcn^;Op&hP3!M zO?9zi?oOuT(BJ;T+TyzUvf13Ucr>3E$3n2-Rl!x)*SR^0aWt|<(A8snG;}Q#Q!Xp9 zJPC$3L%@Gk^BhT$>&cCI)R}KQ63O;s>x1U2qR}k6M}tV%86LW0ua-pW% zJ4%3MO917FDzrdTu5^6wmkfnW5LD={Mx_%RxFLMMBiW=P9TWxA!#|pDbfc29f-P-a z9A61O;ooQvaCw!sPIgU4A;~@L=^M@QAPH2s;xlrMFE39|3D44R$j=8U$ERcffK$h_ zKjT8w(e?3-)&pxB8=_K;jx>@s`pfXk7SEq|8~}3`>YhXPWi9n}76V5QQc;L9wEfh8 zr=_*oU!jsJh^R5Cg*d7LC1A5d#6R07*%kfTf)sxPvhe3Y`{ez=xS16+%MAAcMpSM4 z($UxJRfgm&rpT1(`}=2;{`KkkBQu=yV}9JG(zi}!vYpDxa-`8jDVB$&-S1jS@s{Ad z0nO!ZKD&EH)KWQB){o#p5tB)6>b$NS*PD5+n>R1cFvZbO!>muR!*;S2kveb=kzt;BVp^~w>W|blO z6^G-#gRwKS0=W$~VgFMgo;j6{H&2-`0?sVPMyp$ZeeF;*g?U!+%cv#J&&D?bA*-Y4 zAKd%bjq&cA^-UUhTq{R8S!LyRcCrJ9qDxMO;JlXvB|T z6%DBq)9ubebHAQjl2Cq7gNBH%yO8P>j&mBQpZwQLu6Prz-b>`zxDvE(FsMX15hqVK zeQ1c>UgURWqQw+kE!}}N+TB)~`1Ht(nQY{34r3dak1akm_!Ce8l~jh3M6i40nBv%`!td@s zDU_UKKBx2r-094(qNnObVmRiQ7X*KXN3$(<`B@nlN^Ss~pI(i5gNROSLkkZ|y6UGs zhk~xst~?LxRzn~oY%OkpxtBfN9v4~m2;9`4JGUHzomuw()F0ysV|SQrH4v$F+k&wx zstBUOL-P28=PdG@qy&s3AVqx8J}{>|-sd*fLa#RQw9xyZA+E<`n?Q z;oi^H2L=Tj3vNXkNf>wAN*c}){?w;NF$BZBK9FUdwc+9{9#Cj{{+uX zGLAJRIhL)NPF8F=m7d7KN=eMmOGJ@4K}|0yJ4G#l3?cAT zimHw!>NAw7S@t2qk!srC)$=DutJOu$%1%))G22+v)5*=!tM8&?qVV7^TW1-W<|%vv zxR3$W7+O6!oHUve3u_~)zKuCD_~3t-V?>V6m%(yMV8z>(v+B0r?!>O$@a|dwy)HTp zT7lBuY?k@rKg0fjY15QkoGlLM={!r)zr%ND2+J72YCbfv2#WxK>Qiu93N*y)$Vp3I za(Y(o6(`cG;a7h1Ete40fl-l;@cX7nEYs;D1XWw-cIfy)gS0sX*%8B3vMYjSR#qmh z7UaCsJl;CzTLCD<;Alx+ro=q?+eui$=mtUt5@HG1#uDYC zn{acFL=`$#$dZwM+p&Kp+=6yMz@G##ijb4_*zf~arw68R;=s0qW=?5^V+_{iP^q#c zoBMuep>1ZGRz8`_+8tuuscAwO&0f z3OlbPEaJbR`X1DM@iHV$-*1f4%(+7dCnh0=S)!dp`L)kFthc4pwNAOMK-HKr?ElZ~ z@qQSToX5u>FbJc96(Gc=IEDIh*{S&AyPH=prwSe1ngwvtgGx281p8s~%|qnm=H%rd z507GSVX(eZK`%y(!_qB03J)_E7$1STg0uDama;eq;;kWlop!jnq|#+l(^R<<%Zdfoiz z%hI!cXvY;k}huWn2PsxrHF;7URp9FCHfPamnE6gH;CgRy=-502vlF8Ms)DRrZ?Uu(q^+>Fwyt%8--tq>P*gJpp&zGTo;5;W$<@% zXdH`kJZY(M&2GAq8t)gMMkv$kEw3S`>m1Gzp+a^J3&X__RKQPf#{}_m(M4AQBmQ__uVSMCj9j)n~j3w_gipA?c)N=(!6+&d|Ytha-M_+d$G5)P>mjf_czpAN-J zHxBLpjrce6(H4q;K3oqL<{b|&53hIC6*O&@ZoGoug@oqnX?4W6G14SUh#$_7;3Y(} z*u=BH#$fzI*udZlU~o1uz=eJ{HeSwhiVcGG~4?a*!o#3 zLrt_(1ON(7H5$D9xTpJI~$FepOS1m(>3l}buxzO{5L%roy z*vSs2!jqzs=2+_I_xL{$c&){vrSiKPohJwwXvVBcOS#n4g7D@LI<60^#19=E`w0jx zNfEPeZ8sac%e(SSqq8#bu)KADABXHg$Qam2%N}l(5BXBI-A6Ud*7`n=dhwX}e@-Ty z6@o&3Q&Rzsi4Qj0t~WBelfMAjSyon+{PWhg%j(%SwSS!E)VAj?Q78|ngx|;To>Ouc zOOB}pW;4I-W~cIX&>SBuDL4Of+#VwA(hC?8tbF=eXZ3aa7-Rp>WkoAX}e_!AKbvox-IuaxMurBYqWDDw%`Y)&)l~k7sUh7_KklZmuUKLej(zTHXV0;L!}0e|>hD%}XCK zBT0Ym$5!V1LhL_6;KxRqnm{8Dc@x1yonk^fZ4VhV!Maey4(ezTJv}|n;Qc-Z*Xgr| zhGd5tw7F+yy~htn3jT`|L?**-(m;xnskmG6W-u-couFUe#<|NiOL zPK?}8<+J5jr=SJ<0-4*>e(chRVejuJK1!_*q>~07nvh4}c$sYA6NSJzM@VI58Ns(r z1T85TX=N(j#ahP-h#^GkWW=#-{_8C{|L< zn=r5I`aw=m6q8YDZ2v*iRzr;o0aGPVlcLMaN(1odMr-W4aaS?eO=bTDXI9^4wkjfX zW?8fia?8-l$Oo(s|061m>>4TR2@oTOZVLqrL1BJ&RFemjTr)OXGBgsEUBImhewaUI zfjxvOZO;4|R>=0;v36F?{WU4*@{>x)KpfIyt<(LFBC;_vexz}*gDp9H%{N3|rqKWo zG#O-Uj#a8)Lj!5}Unrrm9DaLT0RfkuH%J%!1vx7vdpJ6}JE|Ki2p7pR zle_jyAQM^lDBNWsbW3Qa7u+ARL?qM#s~;aS;yFYqUw3}gba!5P=$b$OS&UCFL{?-^ zQ7zGaYoq_{d!Th^a^XOwvUU$8*XV%dq}hICDvbzVw;n?O@^LB7geCY1ZLg#KvR2Sw zk}LDyI7L_gk?->kv;3uqKQVyFp>hHp3)8vK+c$dnn~6T!^f7kzBysfgq~1No#nm$R zj0pkRWfG2%Tg@`P)#4KVvQ8Oc_xGhrmS=CG=h}{eX$`9YyYp*bt95G1NX9qfG+z3B zHTm$u(t834lvp}J-Q0BbHb1$y)3FAj(8_9SX&O4}Ic3vF-#$n>k-6l4yQWu*ZeOE~ zOG;{1M((>g(jH*ma8rmA9`Mh4@2EmD>zcU!c-Bm+@iuj&CFj53H9ruQ>eY5}FMz(ENzQ1Ow)UDn052vy7H9j#m_tr6h=3w@JXa;36 zmeU0k`x$~i2wqj&r>K_jmR^?=8-;a_NP$u8Rz)NB4SNyNbJ6&+OF7j3*6Y>gO{v4c z7|H7H*QM24l7{)3B`ai>y`s8*6D=JZ6Y40Do7v;&-s&=;z z=l4-)d2AON8uU8|i5ozK!~rfLkJH{u1EY<=qAk5n%jZ^6hFTP!I+Y4|Zm2op)!Nfi!2Xx7sdieHkWayMcb)V4RVU+B1#yaGuK$i128N3`a*h;@VktV+ z-V>x}f|j!=5@fU$`&^;{(d>|I6#QdKO!zK#Q$~XH{P?hJb zV#~6FA9j<}ILU?bK>+iowLy@Z7fhzM)M6@86=}O$aUT~iFC$(MJ37|xxHg)->3LTw z2YgsV40|#7n5irs`x4JUwl!|E$xl-8$8as5R5G2;)6Qm=OsV+>jvNb(c<4JGPw1i- zf9TCw@PjO8Rj0qGqP{!hiuugGh3)xMo)deZL%PLiWFyk1fAbh8*ADCv=5+V_k}G+{ zKu>tVu1rj|$!o#$7FCm*D{s1m{5tSSF;}r7{?r99qqn?domWWB#1cSs;`DCwfbbu$ zLsoXB^Xp+n1gWz79oV=(8DkeIu0V`tV5x+y1a<(OOgKPG-dbjW+wT~H9!#TD1&;F* zkCwKk+?Mbu(M0Mhy8XIqmUY4GiIwCB7z*yRGF!j6gvm5KeW#fKgA*T2#0r)N0s%P!Ysr+Gcy1Q^rzAAS1iRW4bo z;=-)22rMitm9SVTp*Erg`GR3OdrxDB&e%j+1eSx66Bi=Wvn8N!JUSf=!yH@U_#ke2wK8m5N~(uxW``MblPJX! zwvNQ;TA9|VAigjCQh#rWdI%vcYlR@UtP?Uy|J_;H#5#Zmx@wi2nSMWhSzQv+D$Eu% z4;2bUaQW+|5h&HlMeiLtx4mrzqliMo%-YR1FY#uh8pBTvnZ@m`*9N2$T%D3cMopjx z3Q7;YpX096`*Dy{+Pj68br(5u4T%5vtjxHF+cPDQbp^8%1FHv})iqDsmew+bI5E;v zyGn^{jY=ExmWfr*F{f$Oc4XA0t>f4WW2H5?rLie-L2V)K>OFdKJ&nF`+aV-?~5 z?>LAhWES-QBu0vH{!i-U|MzJX;)=v1U*QD}_&@5YGNchrf<*8>S9;g4-=gB6h7SKr zbG118B}1Md!GQa}(%Nrc%D`!&xN7M)P_=yhQ?)MTw^SRbd+<7QS?J*g|`lCF_}l_=BgO-4LbHVk7}&zb#(tDN6nMrQ<$T_5Zjd0&Mqq$|3GVBXq)y2dkR>zp z7hO4<&8fI74Y9q6uv9oDvUm*5wcv9%HnacHSklYpD}eM#;sNGIadq_)s)>=aV(QjV zj`>^Sej(J;1>xPG8Ukm^rF|p$c>=#TqNhjU(aonBC$KuIqvOy5S;&STp@z_U0S|!% zg)1$n-R-BFp;XAr<^9^6=KIBY7$u2~%}=3FEo)v|Ly8jtz4>xANflV(mRyZ*HH{#J zy%^y?`Lhg`7mAaxoK$f&(zOD1aiX{2&`i*HjApHtDL341#UB0&Imo9|_f_r?p`drYRiBqOS$FGxw+v>vz_qW(?y;~ghxOZKz2pPN z$ryFhLUNwA^4wJ=-4>fo0$RAkbY$Z?q2n!MbH1*T{B=%@kunfYY2AbStO28{wG$xl zxd8;aj!Qq>!rao_dbn=}v@s_RUw7;efv>iPgC^jKlgFdSx;=+_0g+fMzKD|(K4Th+ zzn9P9+A2<+C?U+}L6ZCs1!(^Ur>M1Ej~IO3aQ4M*zckUW7ZRqPx6?~;zk69-sKieJ z7f+u_C_fU7!YZGgIW5lX*vsxc8X}fzDy0f@L9}1@AES`c5#;SWyAdM0ZsScg``i3n za(Ki=K{sx%QE(f(AgdsKWU`>H^7qkATNHTZ0EBO)m;0h|agc$v; zu$z8Di(I8WCO2+>UMfpO-2kJ1RP!0_=$QSSJ>;y4KpU(t3}r1b!6_<_S5C@0ui;&a z#PItphCt)LOf3AT!p_aHYihAPTYq%1SGiSv8`E4lUJU8>kbmC*pCsRX=c%(q6f#yc z+oS|CT+l9kxt!mmkK+&#Y~7T6IlT3yIySQ-ds@gkULg3A{V#nhI41bw(_r-~i1DYT zxT8$*!b_-@-jTn0$XO21HdjR(gu07=us8`19IO*D8uh%)l$@fjp{6@gxXBjQ;=QAfF zXVc;mqJpE;#?jMyRji_SDUl#SM+SO9pdn5j%l_5+Qk8CN)53sz41}{%VOI0cjZG$E zqkh*#)9J3Jnn_e-fv1!)OG}@Jo4ES8e`H@X&FTcN@?p=HL+a3h)oxVbvID^q!TQxu z9db%6bqS3kwhX{*6X3nTt2 z!34+y=c2`-x!6@{-fp|4ZLWE6Q_nf6H87$UndKrZ<8x}66bW)i%ac&T&82}u)F2T^ z3rZP52{zVD-AnMKUH19-#4{@_Oqq~qh>q6S{B*3)E=hTQKn!~3FhW2E-zBix(B2Fq zDx8;((!8d9*S_wu?x(+>w*au&&yLmbwK$3eI^8wsL|7c#4*NgWHx3U%W=A(qbbJlf zAKR$dkb?`Ux6|$pzX^Qu{+0~}Ny9Brj(SH2P5Ybl_CHG}s5Co>#)*bzmqOQ+A2-XR^D$mWK_R8H`lLpFGXNPQ9bJ6z zkerG;7ua73TMdpHkJ{F=l~oS9x}8vNO~AvyRLR;*))LxtZ`s!(>3g(AqobKT<&tw= zX?0zF6QvB7fzka#1mj&0^D-mZ#{F5s%5e68KA;7}X39=a&BS+Hy~m`Z8j&L?tKeGO zm?rj7GP5)5C@-lyT3JODHM@QDe9hk(m>NUWr|OB^mvWX#6SQwHoCQ{G|GfG&-~`?u zEUg=TBSr!1GJbS2we1BXG^2XK$ZP#U3>)`E-bu$5I{u%|^=8bD()S-{P1kg6>eEs6 zSrb4OGkK5S$0A7kF9^o4OWZ#=*_rW8TDS-7CjX;324i;r6S_?ZLmM%N8*q#;qxAtwhV=7?8@8COeqiu8#?x; z@k6&a!IYozeA71_QdRNNOo#)@$7m`V{S9<4Q<|wFjZ&@2zj`3+T+FeAEox|VQWV-DV*k7U*p=TZtYRLZrVK}4@YsdLGBFhjWw750U9TDvX6wI1<<+JU^ zbCs#!wDi}URxX+r-BzRE=5WX3vd_}7Ppr=2Xd?GsZQEnvSNIWPY{v>^3Uo>%4{++M zZZEW_}PfyzT!0ieqfsqUTrkpPTn#tkTD4S`!vx@}KwUSi5S`;wMOhKuXeTvIoA>99X`mU*s5TG)f}T$Ir;uDj;5yX)2c zFf5NHEWK)UJ`hvb~jedk~XcXx16M(P3!w!VHSI_ zqQwz8G0lq4>+r{MV0LL{Cymk+JJ`^)c>FyJS_plRd0^?w_fT%)L#zOUlqruV(1a^< zUxS0ZY9~*$JacUa>1*4|)FR)QZ$Qx?MIkrj4?`W)ei#X&1*nO{>;U$;KFGYaXtVp~>jeTn0G@;5ScjTLIFJ;}Kq zK5}~Ha>>VEd_3dGk5i-&TLt=(*SV?8-^FMIpNd-Q`sxG+2jA+fSqdN{ZLHnRng}$3 zZsQLoj%A5+iGgo!MAD!pnS60OfE9}WhOwEnp!meNSr-2J@vb;KD|Na6@|T%`1R9kjtJWba~{3}Kw@bh+E9XcOv?F0I{sU$+prX+Zr-Bw{I6Y>4}tP%MW) z4(?$P-YW*57nt*u3jdefz`AB4kxL*foW!$UXEs~)+M&R zfCD>sQCU~L-md?w)iTA@-1XKfDy_x(qaJ)p(=zWKfyL41sN9pht5+F^)=i0 zlW5WYb~;0yj`Rbevq{@dkCQS&P|28qTCTL}GIgJ?WKyHM1#os*>2BF@NbIxJWWAkGyc_s$p|^NV07=*RELk5VjR zW@(HaoUEV%Vgz$}URN(Mo0}-E)*A>jUC{VZd_ZO`Zrkvx(~l;y?sIjf9QO5kcO|4> znZf8hbdf@y@ka#*W)$`@yq|y>;Ez34i22TS8nax(hC1>R%*rejN41Z2Nc(&x;Nlgn z$waDlNVoHoHu4FENu1v7jtUp%D=u8*ykN)ihlH&J4a4c-7YO@%IV*spK13C$V; zsM+F>#X7l!_etuo2c4y{szx{iWY&bnl^)Mlouxw0Xudj&yoLhjEW5o^kGVvYtOi)1 z6RkR$)iaYzF{EF5Myk(xJy}`B&uMvt!>#|8*!5%~mw2|rLI|y8wl`+93K!|CY(;yH zMBvkAEh_@q5hYBp2+Ce>3b!{Ra1(`% zUx!FoIJ4XTm}lV_mAvrdIbd$rZ#aE&l{sLeDW8o}@?&s#nT|Dq!0oD8U#k;<@s-n_ zHUcK(sI&BJPy1_%T{S42hE~Y=sRl`|<1=NsyPH|ARE_)Hy;Lch~#Nm(fw$*Z_@@t!=rd3eh+z5ZpNM%eqF-mY^B)M|L|co>VTFQ0~1 zBUAokFgr|O5w(*HOg5N$O#S|q-*+QUb%@WmVx-^P0?>%GUari{BFSqLH^#bD?3fv) zcmtpi8~xj_A+*(Pb;1e9u7@?l9vIon`uTZ!eC6?wS|n1%&Ox)JtmOeYEafs{wS>TuqzkV$W>)A|Hv)`UiCgdJ-w}X0MW)>EorKq7j)M5f%=(2j%?*J?Us@O zt7rMA@vOfMu=Uyu6xFgTo2v7gd?ld2r~eu*HJ7u)?F-e)(w=5}0yrQ`I#ME~;YFE| z)4)9GV6pv@;6!J3U*_;uT~2}S-z3g_d8Cy}sWk3kS%ssIGz<2^`%XdPu&l7Y`_rla z?niuN5&5eVd@sh@dFqsWD%4sSz5!_+k756rr&Dh0@Fe*WhPma;oAK~yVIMdIE_5g< zU!ZY%W6f@*tjh;TKH7VQGSbA9kM*{wtGjb~ufzPpvIB-p$W9s#eKj^8LHTcZeK5u~ z#f4rn)L3&Nli*}XHaMo<>H7*L-^sO(YjwnL@ zN^YgGw;v?ZO{9P_Bzl1cVH9dq#{k&`U$l3* zC2@^i9S|nad_-b>6|EDPTv+Illiu&(fI8pj83c3LIop8v4lS;CvE@A{9^|KtK3udsMZ7riET13Oa> zjDS9s=>-dJ9-S&*2r~qZKl8@oY0x=)rbsJY%rQo)Y?(^4rm9XJ+6Tjlx!)=BL>MOk zejx=RYL0_`46H)Msc#?UtXJnV96%;!v3^793;Fwxiu9q#Bt6}&&^b1R zuEpku@PWJNjKL1;KHQ3(bPi!)tfaKlo_tEK+s=?pPB^G#$JL7VdRjJUe3S$FkZgV! zLErpr#KoZE=*@b_dhckVmIRx_QZGy4X%r45x>Oy`Dc{ICG6{^A2vE?=+c5DZBTpa= zn2q(7t$w%fmWv=wot^z2C2uT|kwJ1!=xIad8@sNi_M56Nmnob{tnLsl_=490< z*1>nY=ZcjaXgSzG+LHgljLCpPP>I*^S)x5m;Fo8&Z@lgO@>4l>8N0Z=yxw+3X3s;% zXfK~n*;?G+US9hC51h^*a{5gU#u2V!h9sPk&CL{w3Sk;k0g*DLs)S>8T`_~BSOU$# z1uj9AwS|*HaAVD(gKP=w&hp7$r!o?QtIH<+SyFL-aM&Um144T{+jDntY`rcQyQ5LC zcO*joE!(0VPDyAKtZ+JJ6b7F%qHkbdf!%#+(E&jKjR>?^S7dNe*T!y7`}aJ>_@u}K zXol}tcC%sV6L%etVUO}(1^#4B)DJK_!cCm+KR3F+kjti}lE$T+ljJV=-F9|hpcwk| zTd`KeT10{ILnVb6W)zmLbJcHSnMZ>wt8sr})sJ@?vk{>B)@kM}vs*ooypSN0As9kLi)9@m1)$@E5&)%krl_U(Ky zq$|A9M4o4SvqR4l1ux-I#Njr#E1FV~g7d`C*sO9stsA|1MjX*{5-$WbmE0OfX|S(2Huza;{~2m?-Ye0h~ngL@NOq$P`NyD2MGTVr-n%%p9R2D<}O?di*s%yWb~tp zQh+4>uG6P%pbS;ngz~qcXL3@^3!mX;QDigTg5h@Fzq$*`%UOr}C zx&4SL6_l9UmT)M!eEC`L}ly5<&5> z*cBR3TZ+GrG58aaj-aVMPIeSNX90WPuJ zY$I(ZpFB6ej`-j)@|UTG%O(unJV^!snDH42G9Fh()skdllg0B+?wK2UX_w{?Y`DT%h8oYM0D~ zx8*I(P(XY1_-u}1q8bU6$Jh5WR?LdoC8FLo4Ii@&;q25T3CBtFnY+4^uu8D2p`<1i zB(6;!#4u*0CX3u&uAYj-9S5Mx4g?&O5JT)t)*!Gg?b{Ob%K zI5V@4>|qu$Vhb}uf&G$K>9<)JE*+I}FY(WYpe__yIRVabz_`@`I#3T^R*w0Q2q{pC zmC5iqG?*hOvRD%<{KmVLV4-uQf8PUp7={JbwQ^z495F{)CL*=bpNONOjuIXL!pifC zlqe$`MZSYKO61z5vx?qUO;Rc=&FVV6EfRs=$G*Fy}`SMa6$ zH@y}~FcKy?Y+E0+z*XOa0ZUzkVS!I9B(8WrK!}D2$hiDdDWKVv!m>aOsDbi+8QN2x z%Yno|tb+sEF1GmfwtOb*CIdCi7JTpfnLPSD3V&dFw(XoO2W9A~H-0{YzaQ^eAAtOmLOVyuOsac`#K3$+c@P9o z3lu4)ZA#LJehQ5$r+KE{dukm7GVoe(3s19)fj6Lp+U)2Req2mRWq5`oK~Y$Tc29n~6G zTzU)i*3^sD?ymS&8XgbTt<%hx+-kxJIfbUCN9G;8O>w3wNvdTL=-yv|U|CgF*9d zBnn~s)oHvSFlyI*JLq`f=gHwqq6%MG3v4ET{Le^V=Ns%C+w;BCl7qnJ_;nVrB_49M z-0cPb$So`rgmqc=dSm5ktA=C@aYEXVIN@b9B++|-~qNe z;o;o}h3QIT+2G(?RS7KcrE}W77aBlr?-m`yMI49CA;ALva!?5}e8d$nN(1S8=$}p` zkQvy9&Ty}9I4L_#cVgS?`szD!e^{0ov_EdAq=z6g;_v8YTy46_0h^@YNGJ0=O%X6SqGDR~TEqn!0skM={ zFK(;j`cTm>2F|{^6`ICetKV_Er;Tn*G;uu&WtiWR%^s6CdfklHEYnu$)Rt7$!jsOBPCqJ5&E* zA-=U1b2qhtu;K=HC9rV~&w^ZTuN}wFMWYEvzP$}DU1-G0%4i+Vkfmz!+asQ_gKNTR zw;3}ALllBm2{VDk*$DM$i$0VrtV%-xjNK8ymWz3Ky~POQst26FO8s8I6>4O4TEmAN zRNB26Wq}g_=CrT;swnU2AD<|{OTq7T9o+9K86g*;=J)w1laD_Hx+~9JB!yhru=@@N zbbSHj#7Zu2E=ZarogyDtloO-4i>rIB82@TPtW)`XT{`nYdUarDhDRmHz%48LSwCn# zN3TrXdUP|Z;+o!^H!#6>dJXtzAR9W|Px4aLH1uGs3N7n;Q6o-JC|fqKR4OKLhm z&sn%ts%I-AQlv(lP7~P~`f?vVlpY_odtyUS#e0>tZjfm5QB?QTN5_Sa$Kpm~Has>_ zP|lm4Ln#$7IUe^~b9Gys5hG#cdC1TQ7X|=DZ|UJsRmPLW>SImRB>J>mAG)<{pN+ZA0M^XEOff+c$8RsF81sfl@nm-Q@=@l`a8(Yw}R zjGgxKP!biD>``h{ViF0`sRm_%)K_XP5t>$|m|GY$4w#&m0cYo7Vr-WP3+4>Gm71myL_ ztPRVh8ta*JAvxC}PDGXB6-sL9Sm~x@qgOwaqJ3>7*|8Be@w1>4HGCc7b6mG^9ma=2 zA_V6f8Y1Qm2u^_|AHbWBIY68%^qkv^2N}r-t2&WT%lQfRU#I?bQk1H>?SXi=vSIz2dvY#I}14X4L{y+Y=O zp0ha8G&YU>Y4R}A%E>v)O?L>A#1)4`rmCf9k$5%G``2g?{%?Xsb&M=MxST47DOMvZ z!)4S16Fr)Ae0ilr(qpV$g7)+rub~JH!`#ZWes{hvjm;lALOP|&%0s7asOs{Qq!F97d#6wWcChI9w4SnfaObi4X(j=#gk4oUGlfCYAvCj2fuGZSZFDAFjifB;tG) z$T0&;+Ek0bvF>zcDMIY_KCpp+yPZ_Y|2dK=G4}>i-B!ei0>`t>?Lso0`hvSn(etVm zAEfP;Us?}J$E%j<+PNomVXYDn1P1Qa+al@tF~o*IFGWjl<8g;$^|YDLv*u63@(9yu z)s6&=mG551SF4&>q=73>*P44}F^_KcVh%rZQvNq#r6SP1NQ)k}Wq4Se8nb4b9fNwc z7GK!rzUS>Z+)`1MEJgdSp&mFK98xUL*XVP(K1OyhVpD$j-a3-wV+qWZQf3lXjFHn* zN}~IXbRnX?K|H3h)tTclNvNZT11!KSx6cHdUk|xkLJEjQRWh&HMjG`Rw-W+;W`8YCDbW9NpWo3zz3 zvM9tzei8`@)S`&VYGgwS@=1l~!I^(k zBW%q$5lfGoRgLD84lk<*wS0;jD;z@eZE}^rDD1_|)FvB)9+=2Av1D0bWyR=o`JcC6 zTS5TrUa(Hum&>9nRV<6k{2gbz@#?WxP?};Gg%(%GSD`IcK5yaK{1cA`6H9w_K*U&U z%O9)pbzp6xHrEQC6u)ihMM6`!t+f);9mzZ(3mNEyvmqv)rl>mWuoPC6(=#|a3+%jvsM`0N($_%K2WpoC4I z!RPTb5jV|IW92s$#q1>!nK&X2Fe;dHXBAUI4KR9~Phc5mPE=NINNR#DbTnHQ8|sSu zs#7WFc{!XriM1`GuUXg33?@Mh+p*6IWmMsnL%eejFj8Q4KHE2yPIK0-u9C3)SL@-e zOixgXnPK#LP7+J-F+N8pwO5!SfOvgk`*|?@H+w)4n&ekE-AwBz><1XIoH6l2GhDnM zQuXzIf8Nx>3L!q;NCkl+`E&1-*>hd0g%<8$uQysnsu3rX^p~`JaWOR7eW!fTcH3B& z&2&lR7wk6(kpazLh+1lB_KeW{l|tX_Tw`91o5L%>AdN=c@F`%GOGq$GocH#az#=}s6b%PB<{ChlGB-G1Zo ztKDu^9WmNUmGi>`^%WV!aqHr*HbpGJ7Du}c^j_rev@st>Ud%>Q8uqFMYPFQVgr^Ue z1afY{1z<5gW-IQn!-u6-JzbU7rXR-s|L4`^U_K$W+s_Oen8(?I96XB}ZSOKMQAjJ= z$m`8z1$>sco&(S_N|cYX>k~pp0k=xn?ZLNnSmue?FH<)%OAXTQcpzs&^D<4zO6YUuTUdZ|Eo!#Vx z5+ARBRDo}xIKX`D)ivX{a61+ZvrODg!ON$|GH4t4EW|@oY-m&>1pA@xSATu-UF?x! zH~4MvuBKy@tY!%vApFln&@fV|A?-UCgitI`DV--n*8XnSyZoycl8j?Ngq+KVo-;Tt zLp$%@p!Bx?HUW$O?xn3WxP3JEbu?ey;pcTR4k%T(+j8KNKoSby+Z>ug&6MCju$3X3 z*T7lGiZX>iYGw@5FFj6IonE%zll1)naA-+y;CT@|GcB4f{lmn7jS9+ z;f$W(GTr-&`9`u|q^)IWY~u=RoM4#YZXW?d6n0(~H;o80aD@Z(PTD;BF$z<}Zwx;3 zZ^sd{)3Td2vJiNG2#S6bDyJ0BjuQm!G;^{WNAjorsyp~i*}xn|SpRp!`axl03P*sR z8!0G( zCnO6Gloyxc`22 zIU!`B5A~UE5b=Jo82)@N7C3ZBzjEWr)3l+LX13M}ArhqmOHJS1_*>cEDM2Wv#F`Rc zpctvZ_|2iYwth1tyhCha)aoT(Y+2}DOp_bC+maq?edpZmZTj(?Gt+!{-;Sf*A)!Ny zcHg80_gx68wY<4=gIw-hu;XnHWH^Njrkk}g-uB1t{}v-f=p}j{-dHZLT~>c{ay73d zMJmUCJ6!mE%}Qr)-*rc8IXIG8puJQX`#mpInz}SY6G0BGWtQ&ra*EqfPPKg(>=hyg zwr*^<&E}6ya!`XU*Kapwo3VB+@}g-dTWIMG@XmUB*h9f-ZGEr%M1xAdG{cIi0Wr*I=VX7f2+e^}UinZje*bUV5Z ziEoTRbQvk9kiSA8KHv-Z@P)8kRfBRZk%62X;yn3ap4nyFtD>6G>Zgk6INfCTtX~i= zqZbD%KI?pY!GSt<_ZKPpJ~qz`-c7;xtg&VnCyE&{#mkhZY+rzx7S$T_6HhbqDp<^i z8wh_UH*$!FkmW_Ldvilu>8B+=(_DuVD;!}bnkre$yo@yx zvZBT{+YYIU6la&Gr+ArAM97I^*v`}JO>lB_zZ#j9st!o96H#IqbIQMsTCx<%*v`ne zE-wc%;IyS0AHBKfmmNCo21b-E*py7#dcOg29!wFK!*`J##V1hr!y=d*c_#+|8G*UPpa6}nCy$1#PBfz?kQ@Ov|*J7XL zx?fxQ-Ve4&T=2qsSiYrEgxkcrpsmHm`G7 zOG-tom9rn}X+cw4M?dkc!bJYXt*6;3L3ws|E(K=-Y$x01SnFCkf?%dkHD>BepTD-y zf;G3UT9uuc-#bFx@cDGC25O$y;gC@k&9AkzsbbQ^LC;|wc#GY2btPjwiu4O6W+&R+ zhnegOi_->&t!qGjF7KCL#9-v^sOOE?y3VMWKxc~UcI_@=CVYRyV9OeGu#m=Ph7OtX zJlE1?UsQ0+I#Bv8fL z(akVo2|A;>GHjk>X4Sna%|{7#dd%;)@K^&FGm{%WEFp$&a!N6`Ka}#iYGgtTw0xvO zs6?UmyMr91J;a#z3EzLw^1xr0PfMO%o=da*v4daj0UT~uB%PMS*Tz5Xw_muepf=>} zwYLe<{9d-x)=#MI@hzn2?T{I-CdkatRtiVNs3@Ce7s)Y9TaG1ubZnzoyW21^r)cPUKbb%Ve6x_8IuQALQMN zT;*s*5S<6CpYk)lzt&SqmyamJcI&k7yD^q8wNu{*mOtXA_)+rgVP%(nShRvUX+(jt zqdo-TS($*mn-PslWP>f~&tCa#%W)~TB(x%J@y<8h$(Hr3{u;STzxuCb3tP>0N?R7M z_y%5OGqn&!2>`t8P#d@O_fXaX*V0warRWDHUTJj;erdK79ZCiDvzd`kPQVU^<=P#@U<=Ck z{-~VI`!>2l%kRnvv--{btUlP(LHVe3mdJ%y2Xw(O!1h`}g_Pr;A}8|0bUZe%@H>D1 z*=%);FqM!ewq!?sXlOP@Ej=a91+RxK1lx>z=oB71Vf(wBEuJQC()~0sG{Rql$fzK` z%1IPRgwCFVXD!f(?4qStDtZ|@nTkae7;?Goh{$J+(KN|qXW+qB4@!53fOrK$qCGvS z;5|ZCBgXiFB4v>PhxP!NVN^>hJU9pxsC2NZiGRZbm;pG-tRVO~>RM_k`FcH(B0*h% z;lCc9`&$bbZ?ycjjRY7m4_n9akt>-q>;N$0__xgL@l9fqi;g*-31K7Phs zZI9r95e)^^M5mi-MBI|X(JXZx_fjSzznlCmPyPmzOr)}TG9Z9rkAa*dL?3|?(g4>9 zEm)4t!a($TCUsl1X8lGKD}d({a6J ztV^e(B>7d@>9oza1DGy2zEDLDn*V%gViliTTccS#I>AD-ESAYvAO^vY9c{ko zV}#You$YH&nN+gc5mFRQW<18!k6Nn&6f?H7+C}Hjudm;$Bs-fD=o{!L;NoSqga-CI zSoPU8GrcY9U^!IU(X-V4CQlkCGinx-e7S(9}6bzgN%0p;K*frL9BxtCf_GA{ z)figGEjL=DC)_6oG3a4``?SV7(@hqND;pBvz_G8f2a}ZD?Va)mt>L#@6{*(_WRO?t z&F%#tIi-x!`B(A?(+|-T`=s2iD;$WJ$5D=t&7@y9U$&x2%kl;^?uV{zLMIltjA15F z)RBZ2cniPMwPeNLhobBICf=pvD;BGQuGHa#{oW5?X1~zt9Thsx~j5L}#Ooel;8{zU6EoD<=I3Cr@)$cp^=UtsD5c1~d8wW5 zX~kGcxkPR9uSIZEZX0`sx|&u}#Q@?+l71bhI}fnGQ*QG53hrXc6~PlNEw~Ei+aD|% zOGPr8mK^xD<&a-g(NM&^6O@>*oVsBJAQ)3NfJ8VlmSKz`9pDFvBK&7@QVp(n&5{Yz zFP1V%A{^7UoK}t2kTWaQ_>4B;QLRD}{VD{B4E0Xwd<3Fe9`BJY$Y{{~UL+MQNA1|Y zmG{pvR1yo4;dj~-VZ8{=016@Vp-_ap+I0hMBup`Jy$V?(bdYztP)cfUqsQQJ>T}YF zkqG6054ikag)&pJ;b5x>W)Yg&U$S4Bi#t4K)YL!46|0!4%BiWRXGa62Z}hL$o`&YE zp@>n(Zrc!0yB$I!kt2UgEG@ZjRa5b44K|bFoL)UJ6*PT#(;hxJ#$Sg*q0PJhlF( z19ntINT(0{`uVS@2l3Za53oh>+B1mqt8%AXpiK*(yKi8anA`ox%*{~ObduR4Kfl>y zR_0(;!TcdSQdUpOY<`T?XwF*yT}MMBnV$a(@Or@URzMr093P3npl^#8kEQe&($zux z)f}=M8J!Iv{7D~j4O7sY_xn(Uc2x2s+J&s~6AuGtou@R_-T6|@c(8aGn7E+`6|B`= zcBW;eU_#3=yMm)#+w{05?0{HJ?`8#*)HH<8q4;ro@dVr<_F(pdyYUMJQ3&4t6Nvdb z95uTbFPJU;p~EwZ;^3i0k9?a34K0F+M}(=YYTwB?7dBrfIn@ImdDXr~D zkRN1X6^;qt2S`y;EU=GaJpBD^rMaTvzt;&GmG42YC%ovL9RAsu<+ z-g(=71k2Y<%vUOF7RzS#XzFwOiLtebE%R@ig+NysEQVqLLsD58mb$#|Xg*!f%cQRQ zX^WoWS8P5=Y1IN0ziirW`0|$J{mY3oQQ$lQHtxm?)DML((CzL(NV;E(R0H0 zyP^-j@2^I#a(To@?(=l-#?f|TkAXwcr~A8()~nXy_QS;U3_W8-7pt(Sp{x1A5{Dee z*@JYE_3h*9g*1|_u0lxQJsd10Yl)8PCB{uoC+B4)&8tZ01xX#DXM(ql`gMDvEW`If za_!e{AdbV;1lF8B{Qb`Bjef`D4*c?|L*q`mzTVyX&qSHY69{hsZvHR*?+s}>zvn1h z&ktQEA)2ED%<%(5PW|b_1-`(YVQ~G-BD^tBqP$7bVkn#hMd@A(tL5oppP6LUJe=;jJK#QT9e(iOJj!jA*V55+*xJGIv-vF z2nc|^)cWF42EQ8})~H>ArFyh~+oZ`?rtVGyO6 z#ga8Z^0#5ehZ-S077A?G)3 zA5sWNFL!Yo6o z+K*L|u{^>lgFTUeLka|p)n9NCmB~ec129SN0Y?VAD4ux)v?)hDC1Dt`iDUFE8nzUW zc(R0+!HC6F`e3A3$e(?Az7pP+Aug6Lod6B8r|D7wHI zY(U;ld7jTlwKQLmg2UtOwoY_iZ*{%t0G+~VE?1W@i43bw5BqMIg)G+$t_FjoyL?vl zNwGTKx(YE!DGMIgXFs@f*jRZPPe;%0*J&UB{8pj@ZuJp%>W`e@`UlxT!vH$XPD3}3 z;{=aW=L^iXq^%Y=H`R`U?)sk5{nU!6&}X}a25GwX)Uceeu(9pY8>;Ks7EP-#m{O<5$?|^E zk!CD2HSed^0?rmGnZ$8&Z;Y8_bK6IEwLbem&jt~&i(KgC_>C99*DgGJgNVhcD`3An z42zE`Y9y9Qe+cy*K!E~?u7BD~Jw^3OC@d6@b6PM`zhTQ&lVHxRrZ!kY_y0>3nh z_5d%-pyK))nJcUO$Z*pxGxPf2<4zt4eOK||iJvxl|^#aD_au+Wvq$%On#N6WG@v#~N9ii>f` z=1~LFFf+0qMADj2b&2KNZ5F-(*Xak*g$4wHgN<`}K!0R8x5*cKe0fU5@iw?qrR2-m z)u^e=f8#PwnxirLR}mxLiRc&sP|(beG2k#^S4rjR%>BZunSOv5O6mb5BtSfYE&Aj< zA*3g3-zH=LJ~VY=DrGnaPDiF4;05dQ+IWlR`4L>`r_}T`PXR1>;_bY$3)P59AgXTN zI!5ZIV!()fO$1~RKQH$xyV1nN_|ycWEF3I^W>;Q;k*@63wBy3RB3059LP+JE*>p`6 z`VqzOv=axe>Y6y20dadB!aO|JPJxgJ@UY3Ghs{LsUT+H;W2{Rz9$o$h>#4UBz%pzT z+q?UD6{@DI+^-NL;-43FJiJI!R45we;tML#n^PNj@Lx-Ze$cVsZHrb+TmbQu*t|3thceZ=~Ti`~kwY<1? zC@pP-KWu=U$kkr~%9L9YMcX}l(s*zBuqO`;Jf^RMPRlNWq>zHx4A}>0 zHrt9uzlm#V*7}UaUHP95 zn~`lg#AL*gH{U^jLt>^Aq?<>{Uu}Ck`w04d6OIuIA+<8#j%qTyH`EigGD5o-O_ehUNWm!1mc*4Zcu`yzCh1M1ZLM3PR4z(Dc1R*5zCu~yS!XA!+Sp#Gg1xAu zRNmPoqf~5NoQ{@$N&$MkQ`~&imVsF+5RBgyLU6Wlzn8yNkn-5m8}a^b=MzHb+S0kf z4!=fEa%vPjmpCXdRLs4$IRmD0qG56Ko%`SHe02_%teUM2{4-?E4*LRcOPaQlR!T|4 zdy3hhhGYnTJN76)-#iP3PNQMAWJusdW4(V*`j4KT8Wp);Hoo7RS<0EZD#^v^nV9K1 z5zMIR2Cv#2E0$nGR~y1VWm|c$9HqZL4vj86XS7EtNz#9!IX9z zB^f+382^PCRD%9*{6!_~Hu3)i1Z$c8Z)C>*--_T47y+V4DoL&{4)=ec88ALnL}e&2 z5Zn_z@1R8vD7u*GDAfG(>!XlcuHC0HS>b%ih#!+21P~H) z7Imp|eV5Er_V>ziM@WrZgU|Ot%4xLB!+NBKv1nZ5`zZwQrI|`UOo?V-IQlq-(;Y*Z zkXoUqiSi#G0`?yt@(J;Bscg=`G2?Eu2`TK^?N8bN^oM!V(Tb6nTP0J=uX%2YuzRZd zQ#u?Z(WvfoWM*dbJVR$c1)@#$W1{kh^}o02u@FghL|B9ty&El|mPJ%)_X!px=2LE; z?#j9jr9YGJi{)5r zozhFa+`h6k@~RfF8yC>2!nD+fA4l!S=6c?q`DX>1ig)hOcOPfcO!y4_(p;|g)s)8` zH&U@;h)5|nt2xE+v{5=2+4Wxa>b;(6m2lEp%+DOK4CEI5jq=wCVB}xtPuCUWRRIIz zPjp&0{AJPcgD#y7r-DFAM~&5z>RPB4xCZ` zOm4!OMg@F;Ku^bK`xO~YB0su&Bw_%5ip%bDK$l~+zoStH2-y{Ru=cVVrW*n{MUx&H3opGl|7etj3jN>=*Bznf5x&Bdxp*_= z2tO*kKdYsmEVMN1{X4vy%f04xTYYtVa(3qUY-JYY;ow&-TwLPmkt6asV?+7oYn}2) zdQOK#25^K-r9Q58Re_c--}v7*rP(zKjDo-s@XZ%W1d^}(Dh`F-nsQG79Awh%(%y8Xh))nh0C!8o!vRn**y(8pevfh5!dR=UzsL|lsRcg)Ftor-&9;ZdAZRZ`HeF_oX|#<8_fMy5@$jY3Q6&R! zOF8Rc-Ykww`x%$xIGgoz^wfHglFL|`Na{kgO=JzhYL=OwQi@+Opk!CgSjTXhICG5 z{wT36PW zI3h}Bz28YJGD)HZamWaW$%*F4_k%uhesVkTN!#{e+75=b0v;vu^DyOU(WQrwvmzeY z{seP%)cF|NFAEyGOR4p*gM6OeYU~v8H5QeS3!}mRLJX%?t_7nRDIkJQJx*gy6QLu* zrSn;Uk{mB-&}mnpMv8PGCsM(lhwD%wTc4l1DH-Zyua1XmqapAYp*9k-`AozYYOpd6 z<{!p%OY01o(gT?SMg#^JNRbL53#LN_X*$-?#mnr%&8v#0Psp|bKl9TlQ=xzSK>KPtIzmB5ulE6#Fz)c7#>n)!%E@U{a;=)4ao`bQLH zsKuCIy%F&V?ilvb-iyvQe})1%nd|@IWWKPP`#~@x#^hJL2e4^Z|KS0XWU#*FzXzUN z`REg?q8ed^Pm$vP2VBW@^UGz?*>K7*Lj;;o8<-l+OA&&SE3v{H z@8!0AQesgcSpVz%2sEZSAebn{#h(}96s&?3rorqLkoXR%O9>M{I2>pB0R9K0dl`=8 z*xgPJ{~BP&fD?lZBCheDEW4VIe?ZdH1nx2&>mfuxde%JNqlT~HDAdUPqv(+twSWKY zU?#)9mC?2~bo2;J8oW+(a!ekZ8GAQ?V5&sOx8Tv3oH;+>GtT!MC~+v9_6}k`*NTohgVARHw3DkCWhnrJtPr!GK=18BiQaA zGHhc(6~_P7&RfJp)fwdf9yrZR-B3*F(%H$-R4%@q`N&PI#>DTPV^USiSa80Z%%izx zLTFi=(;|6&dtZUXy*axyS=1yi{!t|-3d&)(&FPyjo1&UgatM(s=I2?!=a1N9z`JCE z`p~EU(`Uc>nbsl4rooSzoPmAsCbw-jiei0(TUC=x>#o}}c>1E$civ)0E47!Cqw^3U z(eT~Ne8bUd#iH%A3VTOo#_v7V32Vtkj7pur>Fw$JVHwk>4(RQ5E$+BprIyMN54o6I zYtB63w73b1ThqShR^v)y{Wu<7Gf<(lqj7OJ%{63alMS_eSibFXl9V|R+Of_Dk{$2( zvG2_jvp`43m$3=b9JgV&+G)QxkgOa%Xqs7J0?EAOb0M-pDjX7snqs)olUTb*YMHBlTkP~T6IF^y>G!U4p2{R06?Gh& zK}IvN^K1*S0Y8mq&$H+-x$wEvUwB3AKMg-lka1{l)hhTcsNjyrwKl=iZx2P zn#fSY~d<0EEjC-Nwv$!_ezzJB%0Mvg&ilNGh>Io&g5V$PTX?M3V9rquwh`PwcdwPGG45El~b^=Y%_&OLPEU)d2z+0R_PXRH5ja0{C4WCwSIghjzD*yX z#e}a>34j|_9i2*1@BcwHA|g!nY^7hn*!YkF}W?B`{?e@C)dK{XekLCkxE_?)kxoVSMI(Ql<%~)aq zAoaam7gVGx-As)U!L|a!+3tlIOuk;Ws{G#cGi;h)y5Y&Zn+Ov5?s6AnyUE!lC7-i1 zMP@Ar6~~!5F!rxu;~!wA-Ty5J;H-NX)NZmldVNikWV1#@!~rf+eIFOxJaK8BhwsNN zIg-s74NpuYTG-JZUZ9$_z)C7jKPbsJx_ugX8EeMI<+x#wQF*wIV;_V%=7yMlFD#X%xI=eSNTvR6C-z##MDZ} z+xW6-2WCLEdd|?~RrXKPeV0{~`>o9JYX&AeH#ig2N?C>^D<_k~bQp|xz67|}h@+*W^TnzU6(j=fFQ8!A zHXYOVv)XODook%9f(=a*+ea#2Z+6-HU>~yHSQdI@bns`K38|n`&u`YoHd1v8q5bJ& z!<(2XRm^Tjl$@A0PxL~UHL8iiTx5Feg5Vt^$ z-cFLwq4sb<|6OYasOqpLclDdy*EuBj(nIzEiQj!SXl(JHSZjLQ?qwIxU+<9^m2pGk zQ!*KbFbk|HE4_RCUsn%)pG}e!2iWe_6``?y3N^ye_DcSKioQ=B*eky`c&1>MmPGwM zA_s2-Jn{_(&@`RF$t-P51*h+a4;_a$ZsFPoP#PFE|t1 zk4pmEkScMO5|S(>e>cgLNuuKk8;-G0n0OUM70HR!u#@*yPiqJQdNhc$F|PbR@h;r- zGQW*)JzVzWzx%!fzDn(eewmSxi{`WiX^)zO2{l0CgQe%$;-uYv9V zebz@z*;b}@CwfK>hx5d))BP67(wfDzHo<`Jb#zw9a5dhx#jT+4cNMK1J#8{kd7Md? zu}_T^!lbicV(X-1*zZV&dzNj@j-pMISPxHLt*x(Zn-DFl)jo%oXR`MNaq3w4eR@=? z|2n@w?(DFLKZm`LL>xzMDCjWvHs4iVZ>T3FSWJD3V3%c^?ns5|-6IkICr(S8`!gX* zD3DZeej;CJ^$Px>_-rgQtuoRSONLM~bx-*Lz@%MOK$vVwDU#5_qz?d$O&mxYCWtVi z(oiuZD)t}T@08vy7J&5A3=ozU^nfs5VtE`9fayAXBXc|5s1Qc03sjf5m2n#u*Dn;sV4 zc^(h5a9wS}+cw=%FWM^%xR)UX8gp#TrlT^0KGeZst zfb;??0pn1sg(K2&jE7TEbyOnbd=nH=L}P!y#B5TBljnQW#c`yAoa7%U1Q!1w z1Q8?S0KJ}LU*>-JHtmwp0L6pd1^MXB7+tT0*Yn8hGw|=;&$Roue<`h?wcjv!WCs|& zsAq1qRj@ur2iXN)_UbR=XP-d20^HFhHewR|&9c9Z?r6IqwI1U|`m@5mT45wy=IJz!)?1I#a6t zKdqfrR9gYNU|U>^J4J%KQ=H=N?(XhTtOVEM?(P(KLUDo>FH+pyT_*kS+%+>#GY^xe zth}6+tgPgm^X+f%A!J@l$GfR=&JM;{@9AUsu~ioqyX-7{NMfw_1Fh%RgwYvnQJ-TX zU-ZZ>RA^q+N*41eT5-qd>eb;_s(T}!2>xK!TN>C7zS)Db|qE1I<#&2_dDnxS% z(*B$}hSd4Ljj{M`UveR3l=A3B#Yc(@1j%X?RP>+`!Ve7%`QrAbj_$Q&TrI=XuL;32 ziYaG#Y3%3kEcRT_X}Mh{gTc1RpCYks2z4A?CKp@GO;9LyuF-|yVEQ7LXf<_fB$_Je zQP($3y#?gSdSO=k!x{8o+VJH@K=Zvf&@hX?ci|T7K zO(NL?(LxI9dWZX#X%Yt%vp^e(UoZPcgVQ7T^%YMPbs2D-*JrhD8~zPiL|OHr?*~OJ zWG_52a98d zFCF03Ar31={lkJszjy~GVInkkwu`{C)(^1h^10fXe%m{{(P9aIkCEEi@%OTb+W(wO z^H?bvw0Zi@=qR^h)UO6yL$Ee~lL`^%L))x8b0@=2k1JO@(bB7lPayw0@I?DTYG$7~ zrY0qad~LqUD2xG9>za^H!UDEtu}o&IQ3lFY{qH{hvbt=Wyz-TwxQtjoW8Y44IOL+b zm~>_~+!rAiqJ@=QQ=k7{ZzW~P%0+oqkBXF+1i>~n@aWt(KD8wmcGy$N;bQMJaE`p| zv@awBVHNdj&-3oFBE8x7_j^8tUAv%2#d~{!Y6?BuKcXX1o6@#$^17RiKpHuM)eFGgZx0eRfU?t;*;DrzumW1cf;=WhHmKVeSRM2G^Py$8zxFtpDE8iWc4LI zZ_0Szq>QBnc$CsrRZh}=$`gWg<&!5XCR?ZGTji4=cW8n`$6pPE1*grc*Q^KPd-T3^ z=pS@U=;aA^>@WSDPf5Y?Ah?RK7-5>AonPw|d$0H)Lay{=?g7pkb`pABS0s4`tqX5s z3RyA^o1fxP#$)|YLuf6p3*Q+ICI`Kn@s4MD$=b_?D#3w!Sk8Icw|hsR|VZSV&} zBXEneZKSnnl~bEBk|@EMHo^zjX?gth0y><s!mtx2KL1^uyr%s@#Hu#N{;sH8in5- z^X-VYflToqRXA(eUnYFPQR^%F_L`&$L)+NY2BVJ&-kjj8Pyo7K0plnc8J{skrfxj; zOB0hQa^OLqRNOPN>c91_?=`DDu0Y(D( z0qrFx7+MYp_(;qhwuvZVD)b2{89x+Ewb5#f2vwa>EiUfTE{^c_AjYN&z!3KSqwT!& z*p)Joh**oB7S($sFQ6DLzVYyT(^-`4V-RQShlm&a7#3L)hD0*->?xx){VSr&-Y-hRTkXHFj zHpP@J%v&rUX2={MkeV+-fHIT!LHNB}cyitPe=-%n13$pJvcX{0U|%q{fj5vt8FcW+ z1~8MAo3goFzNW%6bAMIrV1HA=$JN($Id0^{DbucZ-ql4nw?c_pr-S1mgNI9NCCy+P zz*Rdk3#P*ixmm4>-zIC>r_L83L0A^H<=3aaquWWY3Quphcr6mP#MJ)+ zWJo&u_%T)e_4+>D=w<)wJ}q?{mht6W7)Y?B5-2$M_4od0I6vVopUnn+UaFfMx+!&4 zUZMg7K(hcWQlnak80S{U=sH48YS=qB_Og#*dLPLuM7Gx^AFC zNS&e61(JeP>*8p_MyTAES591jH;aJp*HH4=V5V5JAO*da)QX6wxB}Kl#F5`2@XyN( z;dA#E?Ct=8KVMi+#Pa?$%DmBO-34Mct)IN4k zC|AClq0My_Y>8JhsQ|!9MpGM%tiMTzXIGss^%f!NpyBIsz%KL`DiU6@)~8qk%?1}( zujUT+$&W>79_>hwf$~l?hOyv`7YyXqEl}2WtN|`-`FMqqw_S&Bs44i^wX@TA2pZUj z?IU^ELBYkF?@U7=Uxy(-sYBtYqtH|1j7KjtmWey8$ZsoHbI2fA5QQ5f z7TH3y0s(O_(O~T2;ag2iRCpmwB-M&xtS2W7m&71_!3rr|x#9iXn#Wy_kRGRiu#+1j za|?=IG!k;ub%S4=k5_V4MEgoXq&9s&M#JW^g2OankvdsQL`KA^-^$6t1Q9x)`Z{lW zON(lRvl6Mo4GQ3?3z!Y{S(w!(7Zp)`#nWC`KW*Bt5o^4=((65|2hX?{}=^s@twbLkt zhW*vFiqAYaCd$?$JR!QIv<48SXVj;Ik7OZ)Pl9sIz#JW1OvHEN2|EJoY!f4a5y4Dm z4CG{6)V?I5;x6Uv=$#?S;hC$bUf!wO_SA@}DHgKjY$ge6$M+90KmXA-&h08dh!yK3 z7#(|&@-6A{#t>ptF=F%+*lN0Aq5>??eW|UQz|QURM&32+?oYjH)>!_t3d%jITTvej zfx>3yj)=(mYvyk5!Z_ksat8tAl*hIXm1iVvK6^+S$x52ZsJZ`IKeOzJ<-jC z_oSb-umkV^F-U*T`KVgWo}MkDtDtQ;zP+b|M|g1~!)Qde(cgf2jl-UWR^Cm=A+ws@ z#<|dgZznTHJjP--^Wfd*SaT^%H$VX2DwF`uP)rR?>?xf1ruLSqaAdrKc`E2{vne*l zs5ow;j;*{Hgrh0opdUoQv_90Yu3>md<~I+6%;QdHI2%+tmFkl5)iGbsUy3v$IA-UB zy)EoKqg?;ZEPbdBh2woV_am3A*ZMs zDb~&YqSQH>xFt}ta~AAV?PI!1Qj9Ezq-L%!3`MfyC+f&a2gBSsXphE@AlIlZ;^JvM zd9-VYp;Tb1;~|q9V&^@{tm|Ov-=P}ufXh_mX6Ub}Xi|w(fMsT;MlP?Sl_?YUw_i;T zreB$}hRZV9()Mr5l8Z0)$t2nK@Qb3Iy0WpZ4^l$h^H=K#x~APn0#WAjD0z8!*K2t% z+l7Ck5+#`bjq5=B4ta?T;r~W+{4eU`AJ-v*4uQ%3Pp%_Wlz4xw@BzYgMATY8xm{?o z|Cbd-3O=IZ!SBuKzgs`~N>DAoAP4+^IOfAWWL-W*1OfQwA96pJVV9$JH&@L#WX9{! zUJ_{PX>9Gj+@EZD2+yxK^#$#TKtwUh*5`6GsMdrgC8y9-G!83G*VNQMQx>L_-zr?{ zRXbC+q3aJj;DE=gq{0eZtDvBP;KQJXVeaC2BYz#w%q7M=U^)E6!s)prDsP#YD<##r zymHJhDHcIHmanh#MDhEym9V>zv*=`vJ4oC3a%O&SQYH&*tRCq@K0LsWw=#??hSOe} zLiL}|_``p!7XaqG9{QS9?{fWbTjNXxY|l$&cc7cOGgrZ(v@rp-zd4R?Ra57>Cr+IX zvCh#_pJ`Z{GP_M+Wc2w0c?-dn($eBP)1Pqr>5HcRTy^q@r^)6f>_ONtM`qqb)>$x>6n+GOGr^=Kh73bzk9Y5FVpLMy$XQNb$A!EDG2y@JgJC?n7n8M>SY~L}L zm_~2j->AhFnlSBxtm=mG-emA?5;09X2{(UoxqtPCzRb%r05$MIlsi@?f41J{Z%xqi z{HXnNIT#smE;`4p5QACoKfebOmdpDwf2`5#6B{CC!2Vyo=R6@4D8^xTr6K|! z$9F`|utn>xYB!P~hCobCOl7e3Jo5 ziaN2hnAH~0l+Q%r4stR@Z^cs++hp^tIm}e@LgSLBI6~_zmuP8vm9_If%KbtY`LB ztMV50TWn_w((rrF+FLlwIY(yfaZnXxs=W}qhxw@kNp)7~kF zr-S{ezE>{T3mkv~+fEDKEqq*Af?q8kx=GyHihLT;t;O?et2N z9dJZbR8mrG2T*FKTO3$(Qft}u+5+m)rPxBKsKeoF*GZ6*Xl24O;q<3K7k{dz?6XNe z=Mj_g`R-cQ4YH^l+l^gcF)-kWTQ9F3ZtQlw3={~KJmvnv`1u*+Q5?W{Iq(*X&^H9= zDc!q^Bd^o`if{~ z*Mk6G%nUzny8dzSyYDm>)yPTW5nkSEYdz%{S$>D4rJ$QyfP7^NxSymf&-7GIE?pVd zO>eD=ROsc8Vh+0ax1PPb>Aq$UDoGPcS*ujdu7{o4j>1BkPv=Y%zefh!)FHBPZhG&R z=9MoFjItaR^>S8|Yb~L#ih40DiYjHl6|Yqpr)LFgCq^g6YP>Hm1?^nhv@bAlxM&;$ zvSOLZdBQemF*`)L1Jj<0GsqzjGZOLhNiY`ibFmlArW)is5`XcMcvGO~0Ij$)I_yd7 zU2fqysjQw>fc@Ra){K5HlYfOXQLi(=&Lm12pa!;ZC1=(==D0c1=3(SWzmau_0~oFg zP|gs}aIo9Ta^%b=iN&Q)=X362SC1{OJD%ZtG)Ub!X+)3!n^1G^&0pLnlF z_+iZ<;Z!9y0ZITQqtlKUy?w^9j~-rvhi9g)Fi2c7AyC2*+YbN|JK5UpBpk zNh;dudwEG;A_TMrPFOGbv=UP4aNMfG|EA935jx&XU~46hddpwmGIYmz_gVB<#MLs$%AKWR zwJ5zz{7|x}sYrq^GX(u%_-J!LvQTVMF}TX){Ve|89w!rX)BJ;3BhB1nooC&Grf@Rj zBfL&VQbSj$#%A8(`=%1JmDYTTbo)S_@3qyrQUSbOW7>WIIp{GPk zlwJ5nHi6JID_LK~@kDoMipARWT_d!o$-p!pR^^0RkJpwT0+!;fS34{pg-zhGZL4_5 z-?Ia?JzVRM(crxdVXyi()iLwIQhGYz_)T;6Y4e3h{@?|BjBc%p$jprQ{(8@>dV9|& zHupPB^h{bVN=y`DHH*hI(15;q&ZA03d7CzMVLa+m_@}L-CX^JO_MrL8 z<5q-UusCvZwcWSNX(0uH4lSmBF|z3L$>s=|{MUgo!P$5O`O-_DzUV(Xm0O#M8D3Q$ulY;KyF&oi%X z)`zR4xu;#KHchX4{nD96=hVoD;rEH)$}E3T87bHtO@u8>PuCL(&e9Uu*g1j(x0&e1 z-6!NR2-TeZ@-3{}y3MRtrL@e~4`(6Q9sJ&*EXGH=$ruGk!9b>WK=rE6mv9pq7T%j5 z^2w4ea4B`a)Z7By4$)qR2MUG8Rz=0l%SYxYQ%ma7pZx{Hw4s=HA3 z#fL|q-h7MzEDWIxe+aniAPc@^zBZQFD#ayL?WW$N9r3z7CjK%c9h_U3R_$Tmu3A1X z>*nx&>(oog#gQ5a|FW38hseC%ppm+ZotCPxXZ6h3Pp;z`CyAh`gkG#zcH5TYGf3si zXz4cWb+V?NP+@zPp<|T)?cO#}$AmgeIjwFLvvNMe2NsSE;#AN`$g{{Jz^RO^S61JDJU;H~j&i}qi zJ+HBZ(V?kocW$DGP48zVnL|MF^=nvwC-H57^PQ)xBe$?AXxV8R@v(ikBzd-! zL9er*>3egmH}+vdK`Oy`e34d-o|aB}&Cy{tcp9T z7{GUPIKbeUX>K)jgNx@S8HL|`4idAV%bA`7>vMCILt96@y=os@yA*T_^swvH<`h3+2e zX=Yf5Pua8>iODF3x`|{HHAo_~ZQ?Onynf_mQzY-UAMJ2bHo7a|+&|QK{hnkQOLziA zWTS}^$`AFsWZ2$6x&D+tuc-%Sik9eCko~1m^kXH~teeuSh)J%x(UC+Qniu(rK)uvd z|7kp(B!|5?!#UFOS+{mS`LPF=+Ri|sgSc2HpH1PBlD%N;RRcVQxqvg z--aIR8Zin~&t3L*^DHd9n61^F8!e@YMhnKVr8qYF06!rhR5Lc3eBon1z_)?nw=EaG zn>(#2Osg#zLg{~AI`jOV$PZu2e(kC$iB4Ho-oR;~5NhuhQY{_yL?=H)l}EE_0@ZG# zhDz(4Aare7Ko?4*azJo??39C#Li=T>hEpS%9_5J>^;4X#t9oz0K=fVMaoSpk&^TEp z)A3jnl=)9z)|xIpjlLqA0riGbYK=JY6EPAIi&Xl~riNa!X?%s~qMY|9r~PIs3%Ht? z81WZu%($VVAT*GesfUX&C)3m3LiHkx`-{2Z+XU){T*=#19q!x7Ky2RqBdDJF^d
+qtn1?mU8~wZEVyrxQQnN!b1ICfR^8gK zKb*8h*Mj9r@ChXbEO?I=h88YMU?gVo^U_k%STF|a4DI~hCB0aGfl=F81l(9ZBY%pU zXy#rMaO+-?BbV-b|D~tJaCgp;&jYOG%rNyp(EY}u~Q zN%y7}sXqBBv4H^_d+sM2rLr);X4RTh%64Bp^#Y=Pw;Z(cW}}S6s$Jy@drD6|4O<$x zmPi6HU6~4#rqY3eSK5JcAdmZmVWU54U%t#>>C6LhVYJ)S4a#>>W2SDH1{PAS$gx9Z z)vDBd_MO}ry#bVnGr(Ou9NCPKK{+iJZdA%%UBvfs)h57~&*V_Ci%z-KpwAyx3X80m zThp9Y^U<$W+#i*xeu%qT|2&LR(r7D);I~evf30F6p-+5Vp+2`ehXqdXSGJx!KGj1T zecO~VH5tGyjg|DD<94>8v_&uSbQ-aBb3?8#*xt`%XmMKn{vdDn8>#&}d71m)DwY$E zA2+@(uWOhS8I4**PZNdwXcqyp)|mDuvY;9t@6CtK#k}`T zR43qZ9y%fhC1ly{>Q?gQBr+iq<64HaqgHg|`iVJi{63v&qb}*WyPbhEIlN%o?QG)x zF(;63*8k%Dt@jAY|Elzo^a}C~4TJay(D*QDwCVXQTpanGy#s5mRztbJKl>|xzbl&@j-g(8j^tf2viA6~qhsVo2ViAyv!0f48>2_CXiYF=4% zT2s%c7)tcPmq`-TW)U!dJTj)O1^X3<$MA zg=zKNf%pX!llUdr6bX+#)cog<{i_UFsip9QVfF}s8R>fEoj01&w$DsxR4;DBS$lCL zf2*))ps6o5<+y9EqsM5!=)!tJ0*TH$FkzB@na zA9(h=g*mNVo;^OEHl*!^iUYo(CW@>+L6M6 z#euq=_1dJjWpxY+RKb~reO%;x%vuZ@uJJN&OJ6-DnXU-HBKFB-OEeY{9<|~fHFftLiUgMPS*QhzD#xB@oWZVzL zNHPUBoApcO$q$f{;HS4RL%OfyeMcVcg-=9GY8=;->G`z+vpx9q3?pRyYwhTUDNZ+k z_Ata+7*7h_ZDz_zRSwykOvg@4C1u`n!l%g(?mthzDY)MFtCNYid>kQB!8T9dfQIXZ z_0RUuFZR*%smK6%`9LO}j3=$n8JS0bl^yw|RENXFksZIn%EI4VT%6n>W4F*|n?tw& zP9Tx%jcI{0OcZAi!nutjQBKzVwR-25R5=(ZRxW{+SI4wj+Ww)k{lfI>7S5Vi%ax5} zt|C{p_5}auSIHpV^ZH4h)#(>|F(;|#2%j~H3N!}>nYCHD!U*0@28Oz?Lq(4I9h;Ko z#ep{7Go`B6iiW3#dTOZ|xv7q_gM~rkQJG!XCU$0H537FSywd5lYmPi-;l+agCht&=fxp$ zt$=US>NwGqw6ATsQ;y@kCfC%sn zoZpNQ*KZ*Ow&|s=X1y`B46k)iidttW=Sp&FBH{J7%GNmyH-j>#&KO&J_dfY(@oNJn zj;(B0i>;Si&+B9z$hb1CCia~9VQK;CtS;r8cgVssT3Hk`$-*Z%4G^A1wRFaR(iM45Ku64sA6HbfK=cab)6 zs>7=1UAik+MVa8GJx|FdHuUri?X?9|z-=ix4(FASkJsQ&lgvd%9%w!8dJEf@h~QOkAUc8sK6uECtZWBNsGLccJR_c+EYp_!fh-4~)VzdN z;yZRCd%OIHt4(i|k3OuV6kGMqKoz=@(bI+m<#cf$`XyT-RCv~n1Lbn@5$MQG#1MQr z2}DhZMujq{I~rCXd3abSQS_m&Q^~9Wg;rR?^h{@>(>gI`2#b=38HFKUdKX|QKp2@A zAxQ@t_>v$UlHcA*io*PxZU80YLINS%82nJd{WjV z&K3ZJ$2u z78_Yo0+TI|{1t+P$tp+b!-(;es>!DF{MrxzN{gGuXwoE^R*&IDHntf~-iK}Fqo-b} z7=`$y>jhQKpy8fCIyoemSU)iQT(0P@`K+r0gh;z=fTA#?CvZEJWDKy-n33v? zZNj|wW|7`dI1y*QMjTiOAwB@a5f>f$%^&edB`0U#{9+NCZ|8^%$lM{#_QFt z8x@W6i}6eYZPnD6fb~%-S@f31}#x2uN2+R*ELB0Lox!zfI7VXv*zTAjtN336ouwE#0p5if3T zn7KzfuMTy$7_Z!;^y!Qloa*=0K_X-mMt+W6N6d~R79WqniYmXu9w=FH&N_3 z)h~{m%$QyI7Huxh%!)%Pwx4-O)snY(u$(GE+*p!-$`|oWlyjZ0OJkdt_{?{8X?L32 zSq!>wqSayz2{S(1J7wHes;p-m=UnE$>W^thsmyscuYp|^Oj7kpgoyZj>e+x7*q8~T zRKweMAMLDNEDvJ6rj))(zn}DG#L3X1c|cs$PhSG&g7P+710d5~A-DekAN_-05>JU3 z7M=c9Me$mm8mim+9YwxAUrA_nl%}N}5Va;JJ39@?(dl1@vj{#ftMM0_`M<`M#Ko<> zO&p7LNra6A*G>L$0KQeju~N@0xqd8X zi^K>>c%^%58(iN#>l+229 z^MrG%LVc8-8wJ+2W`yd6@uk)&p*YP`=k$1p5|PsBdTiKuSC9CjG} z4uzcl(yH5L%X~kC$&mMJ;NXVbS(FM&pAy@md|dL6hoOVAc`%3ki6eaDv45z^Bc*9T z@|dP-C40AnXQ;~&KHjT9TvUB)@y}|U500gQ_vT`8n1CJA4RbUi&;@f#OWDu08ZCiV zD|%PI&bB8w+aRq8;lAuG<`IKDe1cT$9*U`}nzT=ZUEBuDm9@pXv~riHwE{gU>9r_6 zx+y=LrlAF~IvzZ=2e@p?Wkn~ny$(CAfte>=#+j;D-rE*d+zQr>;tOILqHcBOSdRB? zWl@7qyN^LP8V$SlXbz02!HXpt9c?z)la*X{aiv?bHW^O!==mQ3H!d%jX)+s-5X9Mt|z`YWWv z98ECc`{Ln`2<%MtX6%!ZU3Xa1Cf%x8Fih=W3G2jdC$&n|v^A@^vw>VW>bI2ibFWV4 zP+Uqh`_-O<(g)KsoF{}WH~v>d&4`9d?4lhGI~61m^c#tP;fR0S2&A*KV*Fo1ks9{@ i)`k3ke?|}U`2I0C7fpB6Z^7dO Date: Wed, 21 Jun 2023 15:21:12 +0000 Subject: [PATCH 2/2] Update 06-osm-platform-configuration.md --- 06-osm-platform-configuration.md | 63 +++++++++++++++++++------------- 1 file changed, 37 insertions(+), 26 deletions(-) diff --git a/06-osm-platform-configuration.md b/06-osm-platform-configuration.md index d55edc7..0dc426a 100644 --- a/06-osm-platform-configuration.md +++ b/06-osm-platform-configuration.md @@ -1,6 +1,6 @@ # OSM platform configuration -## Role-based Access Control (RBAC) +## Explanation about OSM Role-based Access Control (RBAC) Role-Based Access Control (RBAC) is available in OSM to bring different users and projects a controlled access to resources. Authorization is granted if a user has the necessary role to perform an action. For achieving this, two backends are available: @@ -25,7 +25,9 @@ By default, OSM starts with the following users, projects and roles pre-created: The configuration can be extended to cover more users, projects and role combinations, following the next sections. -## User management +## OSM User Management + +### Explanation about OSM User Management Users can be managed through the UI, by selecting Admin --> Users on the menu to the left, or using the OSM CLI: @@ -52,12 +54,11 @@ Usage: osm user-update [OPTIONS] USERNAME REMOVE_PROJECT: deleting mappings for project/role(s) ADD_PROJECT_ROLE: adding mappings for project/role(s) REMOVE_PROJECT_ROLE: removing mappings for project/role(s) - CHANGE_PASSWORD: user current password to change + CURRENT_PASSWORD: user current password to change NEW_PASSWORD: user new password to update in expiry condition UNLOCK: unlock user RENEW: renew user - Options: --password TEXT user password --set-username TEXT change username @@ -65,48 +66,57 @@ Options: --remove-project TEXT removes project from user: 'project' --add-project-role TEXT adds project,role(s) mapping: 'project,role1,role2,...' --remove-project-role TEXT removes project,role(s) mapping: 'project,role1,role2,...' - --change_password TEXT user current password + --current_password TEXT user current password --new_password TEXT user new password to update in expiry condition --unlock unlock user --renew renew user -h, --help Show this message and exit. ``` -### Usage of enable option to Enforce Password Change On First Login and User Management Enhancements +### How to enable user management enhancements to enforce password best practices + +If a user logins into OSM for the first time or a user account is not accessed after several days, you might want OSM to request the user to change its password. -This enables password change policy for OSM user's account. If user logins into OSM for the first time or if the password of the user expires after preset number of days, user will be prompted to change the password. +By default, user management enhancements to enforce password best practices is enabled in OSM. It includes the following best practices: -#### Enabling steps +- Password expires after 30 days, and it will have to be renewed. +- Account expires after 90 days after the user is created, and it will have to be renewed by a system admin. +- The number of consecutive failed login attempts in OSM is 5. After that, if a user fails to login, the account will be locked. -- Configure NBI to enable password expiry and enhancement configuration, by modifying `nbi env`: +If you want to enable/disable this behaviour, just set environment variable `OSMNBI_USER_MANAGEMENT` as `True` or `False` in the nbi configmap file using the following command: - **Important note:** This configuration is True by default +```bash +kubectl -n osm edit configmap nbi +``` - - Set environment variable `OSMNBI_USER_MANAGEMENT` as `True` in the nbi deployment file using the following command: +```yaml +OSMNBI_USER_MANAGEMENT: True|False +``` - ```bash - kubectl edit deployment nbi -n osm - ``` - ```yaml - name: OSMNBI_USER_MANAGEMENT - value: "True" - ``` ![OSM RBAC Options](assets/800px-OSM_User_Management.png) -#### Testing +### How to check that user management enhancements are applied + +Ensure RBAC permissions for the user include rbac: `users:id:patch` permission. + +``` +osm user-show +osm role-show +# The role should include the permission "users:id:patch" set to true +``` -- Ensure users are enabled with `/admin/v1/users/ID` (rbac: `users:id:patch`) permission. +### How to manage user password updates and user locks -- To change the default password or expired password of an user, execute the following command through CLI. +- To change the default password or expired password of a user, execute the following command through CLI. ```bash - osm --user --password user-update --change_password --new_password + osm --user --password user-update --current_password --new_password ``` Example: ```bash - osm --user test_user --password Test@123 user-update test_user --change_password Test@123 --new_password New@1234 + osm --user test_user --password Test@123 user-update test_user --current_password Test@123 --new_password New@1234 ``` - If the user account is locked after exceeding the count of multiple tries, execute the following command to unlock the user through CLI @@ -131,10 +141,11 @@ This enables password change policy for OSM user's account. If user logins into ``` **Important note:** + - User Management check is excluded for the default "admin" user -- Only an user with system_admin role persmission will have the privilege to perform unlock and renew actions +- Only a user with system_admin role persmission will have the privilege to perform unlock and renew actions -## Project management +## OSM Project management Projects can be managed through the UI, by selecting Admin --> Projects on the menu to the left, or using the OSM CLI: @@ -904,4 +915,4 @@ To associate the K8s cluster with a Distributed VCA, follow these steps: 2. Associate the VCA with a VIM account. For more details, see [this](#associate-a-vca-with-a-vim-account) section. 3. Register your K8s cluster associating it to the VIM account added in step 2. For more details, see [this](#management-of-k8s-clusters) section. - Note: if you are not using an actual VIM, in the step 2, set the VIM account type to `dummy` with the following flag: `--account_type dummy`. \ No newline at end of file + Note: if you are not using an actual VIM, in the step 2, set the VIM account type to `dummy` with the following flag: `--account_type dummy`. -- GitLab