AzSKPreview.ADO

1.10.2

Framework/Helpers/ContextHelper.ps1

                                <#

.Description

# Context class for indenity details. 

# Provides functionality to login, create context, get token for api calls

#>

using namespace Microsoft.IdentityModel.Clients.ActiveDirectory

class ContextHelper {

    static hidden [Context] $currentContext;

    static hidden [bool] $IsOAuthScan;

    static hidden [bool] $PromptForLogin;

    #This will be used to carry current org under current context.

    static hidden [string] $orgName;

    static hidden [bool] $IsBatchScan;

    ContextHelper()

    {

        if(-not [string]::IsNullOrWhiteSpace($env:RefreshToken) -and -not [string]::IsNullOrWhiteSpace($env:ClientSecret))  # this if block will be executed for OAuth based scan

        {

            [ContextHelper]::IsOAuthScan = $true

        }

    }

    ContextHelper([bool] $IsBatchScan)

    {

        if(-not [string]::IsNullOrWhiteSpace($env:RefreshToken) -and -not [string]::IsNullOrWhiteSpace($env:ClientSecret))  # this if block will be executed for OAuth based scan

        {

            [ContextHelper]::IsOAuthScan = $true

        }

        [ContextHelper]::IsBatchScan=$true;

    }

    hidden static [PSObject] GetCurrentContext()

    {

        return [ContextHelper]::GetCurrentContext($false);

    }

    hidden static [PSObject] GetCurrentContext([bool]$authNRefresh)

    {

        if( (-not [ContextHelper]::currentContext) -or $authNRefresh -or [ContextHelper]::PromptForLogin)

        {

            $clientId = [Constants]::DefaultClientId ;          

            $replyUri = [Constants]::DefaultReplyUri; 

            $adoResourceId = [Constants]::DefaultADOResourceId;

            [AuthenticationContext] $ctx = $null;

            $ctx = [AuthenticationContext]::new("https://login.windows.net/common");

            [AuthenticationResult] $result = $null;

            if([ContextHelper]::IsOAuthScan) { # this if block will be executed for OAuth based scan

                $tokenInfo = [ContextHelper]::GetOAuthAccessToken()

                [ContextHelper]::ConvertToContextObject($tokenInfo)

            }

            else {

                if ( !$authNRefresh -and [ContextHelper]::PromptForLogin) {

                    if ([ContextHelper]::PromptForLogin) {

                        $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always

                        $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                        $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                        [ContextHelper]::PromptForLogin = $false

                    }

                    else {

                        $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto

                        $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                        $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                    }

                }

                else {

                    $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto

                    $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                    $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                }

                [ContextHelper]::ConvertToContextObject($result)

            }

        }

        return [ContextHelper]::currentContext

    }

    hidden static [PSObject] GetCurrentContext([System.Security.SecureString] $PATToken)

    {

        if(-not [ContextHelper]::currentContext)

        {

            [ContextHelper]::ConvertToContextObject($PATToken)

        }

        return [ContextHelper]::currentContext

    }

    hidden static [PSObject] GetOAuthAccessToken() {

        $tokenInfo = @{};

        try{

            $url = "https://app.vssps.visualstudio.com/oauth2/token"

            # exchange refresh token with new access token

            $body = "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=$($env:ClientSecret)&grant_type=refresh_token&assertion=$($env:RefreshToken)&redirect_uri=https://localhost/"

            $res = Invoke-WebRequest -Uri $url -ContentType "application/x-www-form-urlencoded" -Method POST -Body $body

            $response = $res.Content | ConvertFrom-Json

            $tokenInfo['AccessToken'] = $response.access_token

            $expiry = $response.expires_in

            $request_time = get-date

            $tokenInfo['ExpiresOn'] = $request_time.AddSeconds($expiry)

            $refreshToken = ConvertTo-SecureString  $response.refresh_token -AsPlainText -Force

            #Update refresh token if it is expiring in next 1 day 

            $updateTokenInKV = $false

            $secretName = "RefreshTokenForADOScan"

            $tokenSecret = Get-AzKeyVaultSecret -VaultName $env:KeyVaultName -Name $secretName

            if (-not [string]::IsNullOrEmpty($tokenSecret) -and [Helpers]::CheckMember($tokenSecret,"Expires")) {

                if ($tokenSecret.Expires -le [DateTime]::Now.AddDays(1))

                {

                    $updateTokenInKV = $true

                }

            }

            else {

                $updateTokenInKV = $true

            }

            if ($updateTokenInKV -eq $true)

            {

                $RefreshTokenExpiresInDays = [Constants]::RefreshTokenExpiresInDays;

                $ExpiryDate = [DateTime]::Now.AddDays($RefreshTokenExpiresInDays)

                Set-AzKeyVaultSecret -VaultName $env:KeyVaultName -Name $secretName -SecretValue $refreshToken -Expires $ExpiryDate | out-null

            }

        }

        catch{

            write-Host "Error fetching OAuth access token"

            Write-Host $_

            return $null

        }

        return $tokenInfo

    }

    static [string] GetAccessToken([string] $resourceAppIdUri) {

            return [ContextHelper]::GetAccessToken()   

    }

    static [string] GetAccessToken()

    {

        if([ContextHelper]::currentContext)

        {

            # Validate if token is PAT using lenght (PAT has lengh of 52), if PAT dont go to refresh login session.

            #TODO: Change code to find token type supplied PAT or login session token

            #if token expiry is within 2 min, refresh.

            if (([ContextHelper]::currentContext.AccessToken.length -ne 52) -and ([ContextHelper]::currentContext.TokenExpireTimeLocal -le [DateTime]::Now.AddMinutes(2)))

            {

                [ContextHelper]::GetCurrentContext($true);

            }

            return  [ContextHelper]::currentContext.AccessToken

        }

        else

        {

            return $null

        }

    }

    static [string] GetAccessToken([string] $Uri, [string] $tenantId) 

    {

        $rmContext = Get-AzContext

        if (-not $rmContext) {

            throw ([SuppressedException]::new(("No Azure login found"), [SuppressedExceptionType]::InvalidOperation))

        }

        if ([string]::IsNullOrEmpty($tenantId) -and [Helpers]::CheckMember($rmContext,"Tenant")) {

            $tenantId = $rmContext.Tenant.Id

        }

        $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate(

        $rmContext.Account,

        $rmContext.Environment,

        $tenantId,

        [System.Security.SecureString] $null,

        "Never",

        $null,

        $Uri);

        if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken)))) {

          throw ([SuppressedException]::new(("Unable to get access token. Authentication Failed."), [SuppressedExceptionType]::Generic))

        }

        return $authResult.AccessToken;

    }

    static [string] GetGraphAccessToken($useAzContext)

    {

        $accessToken = ''

        try

        {   

            # In CA mode, we use azure context to fetch the graph access token.

            if ($useAzContext)

            {

                #getting azure context because graph access token requires azure environment details.

                $Context = @(Get-AzContext -ErrorAction SilentlyContinue )

                if ($Context.count -eq 0)  

                {

                    Write-Host "Graph access is required to evaluate some controls. Attempting to acquire Graph token." -ForegroundColor Cyan

                    Connect-AzAccount -ErrorAction Stop

                    $Context = @(Get-AzContext -ErrorAction SilentlyContinue)

                }

                if ($null -eq $Context)  

                {

                    throw "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate."

                }

                else

                {

                    $graphUri = "https://graph.microsoft.com"

                    $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate(

                    $Context.Account,

                    $Context.Environment,

                    $Context.Tenant.Id,

                    [System.Security.SecureString] $null,

                    "Never",

                    $null,

                    $graphUri);

                    if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken))))

                    {

                        throw ([SuppressedException]::new(("Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate."), [SuppressedExceptionType]::Generic))

                    }

                    $accessToken = $authResult.AccessToken;

                }

            }

            else 

            {

                # generating graph access token using default VSTS client.

                Write-Host "Graph access is required to evaluate some controls. Attempting to acquire graph token." -ForegroundColor Cyan

                $clientId = [Constants]::DefaultClientId;          

                $replyUri = [Constants]::DefaultReplyUri; 

                $adoResourceId = "https://graph.microsoft.com/";

                [AuthenticationContext] $ctx = [AuthenticationContext]::new("https://login.windows.net/common");

                [AuthenticationResult] $result = $null;

                $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto

                $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                $accessToken = $result.AccessToken

                Write-Host "Successfully acquired graph access token." -ForegroundColor Cyan

            }

        }

        catch

        {

            Write-Host "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate." -ForegroundColor Red

            Write-Host "Continuing without graph access." -ForegroundColor Yellow

            return $null

        }

        return $accessToken;

    }

    hidden [OrganizationContext] SetContext([string] $organizationName)

    {

        if((-not [string]::IsNullOrEmpty($organizationName)))

              {

                     $OrganizationContext = [OrganizationContext]@{

                           OrganizationId = $organizationName;

                           Scope = "/Organization/$organizationName";

                           OrganizationName = $organizationName;

                     };

                     # $organizationId contains the organization name (due to framework).

                     [ContextHelper]::orgName = $organizationName;

                     [ContextHelper]::GetCurrentContext()                  

              }

              else

              {

                     throw [SuppressedException] ("OrganizationName name [$organizationName] is either malformed or incorrect.")

        }

        return $OrganizationContext;

    }

    hidden [OrganizationContext] SetContext([string] $organizationName, [System.Security.SecureString] $PATToken)

    {

        if((-not [string]::IsNullOrEmpty($organizationName)))

              {

                     $OrganizationContext = [OrganizationContext]@{

                           OrganizationId = $organizationName;

                           Scope = "/Organization/$organizationName";

                           OrganizationName = $organizationName;

                     };

                     # $organizationId contains the organization name (due to framework).

                     [ContextHelper]::orgName = $organizationName;

                     [ContextHelper]::GetCurrentContext($PATToken)         

              }

              else

              {

                     throw [SuppressedException] ("OrganizationName name [$organizationName] is either malformed or incorrect.")

        }

        return $OrganizationContext;

    }

    static [void] ResetCurrentContext()

    {

    }

    hidden static ConvertToContextObject([PSObject] $context)

    {

        $contextObj = [Context]::new()

        # We do not get ADO organization id as part of current context. Hence appending org name to both id and name param.

        $contextObj.Organization = [Organization]::new()

        $contextObj.Organization.Id = [ContextHelper]::orgName

        $contextObj.Organization.Name = [ContextHelper]::orgName

        if([ContextHelper]::IsOAuthScan) { # this if block will be executed for OAuth based scan

            $contextObj.Account.Id = [ContextHelper]::GetOAuthUserIdentity($context.AccessToken, $contextObj.Organization.Name)

            $contextObj.AccessToken = $context.AccessToken

            $contextObj.TokenExpireTimeLocal = $context.ExpiresOn

        }

        else {

            $contextObj.Account.Id = $context.UserInfo.DisplayableId

            $contextObj.Tenant.Id = $context.TenantId

            $contextObj.AccessToken = $context.AccessToken

            $contextObj.TokenExpireTimeLocal = $context.ExpiresOn.LocalDateTime

            #$contextObj.AccessToken =  ConvertTo-SecureString -String $context.AccessToken -asplaintext -Force

        }

        [ContextHelper]::currentContext = $contextObj

    }

    hidden static [string] GetOAuthUserIdentity($accessToken, $orgName)

    {

        $apiURL = "https://dev.azure.com/{0}/_apis/connectionData" -f $orgName

        $headers =@{

            Authorization = "Bearer $accesstoken";

            "Content-Type"="application/json"

        };

        try{

            $responseObj = Invoke-RestMethod -Method Get -Uri $apiURL -Headers $headers -UseBasicParsing

            $descriptor = $responseObj.authenticatedUser.descriptor

            $userId = ($descriptor -split '\\')[-1]

            return $userId

        }

        catch{

            return ""

        }

    }

    hidden static ConvertToContextObject([System.Security.SecureString] $patToken)

    {

        $contextObj = [Context]::new()

        $contextObj.Account.Id = [string]::Empty

        $contextObj.Tenant.Id =  [string]::Empty

        $contextObj.AccessToken = [System.Net.NetworkCredential]::new("", $patToken).Password

        # We do not get ADO organization Id as part of current context. Hence appending org name to both Id and Name param.

        $contextObj.Organization = [Organization]::new()

        $contextObj.Organization.Id = [ContextHelper]::orgName

        $contextObj.Organization.Name = [ContextHelper]::orgName 

        #$contextObj.AccessToken = $patToken

        #$contextObj.AccessToken =  ConvertTo-SecureString -String $context.AccessToken -asplaintext -Force

        [ContextHelper]::currentContext = $contextObj

        $apiURL = "https://dev.azure.com/{0}/_apis/connectionData" -f [ContextHelper]::orgName

        #Note: cannot use this WRH method below due to ordering constraints during load in Framework.ps1

        #$header = [WebRequestHelper]::GetAuthHeaderFromUri($apiURL);

        $user = ""

        $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user, $contextObj.AccessToken)))

        $headers = @{

                        "Authorization"= ("Basic " + $base64AuthInfo); 

                        "Content-Type"="application/json"

                    };

        $responseObj = Invoke-RestMethod -Method Get -Uri $apiURL -Headers $headers -UseBasicParsing

        #If the token is valid, we get: "descriptor"="Microsoft.IdentityModel.Claims.ClaimsIdentity;72f988bf-86f1-41af-91ab-2d7cd011db47\xyz@microsoft.com"

        #Note that even for guest users, we get the host tenant (and not their native tenantId). E.g., "descriptor...;72f...47\pqr@live.com"

        #If the token is invalid, we get a diff object: "descriptor":"System:PublicAccess;aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"

        $authNUserInfo = @(($responseObj.authenticatedUser.descriptor -split ';') -split '\\')

        #Check if the above split resulted in 3 elements (valid token case)

        if ($authNUserInfo.Count -eq 3)

        {

            $contextObj.Tenant.Id = $authNUserInfo[1]

            $contextObj.Account.Id = $authNUserInfo[2]

        }

    }

    static [string] GetCurrentSessionUser() {

        $context = [ContextHelper]::GetCurrentContext()

        if ($null -ne $context) {

            return $context.Account.Id

        }

        else {

            return "NO_ACTIVE_SESSION"

        }

    }

}

# SIG # Begin signature block

# MIIjiQYJKoZIhvcNAQcCoIIjejCCI3YCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCA2mn7zUTkAZwhg

# FTNAIDLOn18MPR40+YmJUFY4o87vHKCCDYUwggYDMIID66ADAgECAhMzAAAB4HFz

# JMpcmPgZAAAAAAHgMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjAxMjE1MjEzMTQ2WhcNMjExMjAyMjEzMTQ2WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQDRXpc9eiGRI/2BlmU7OMiQPTKpNlluodjT2rltPO/Gk47bH4gBShPMD4BX/4sg

# NvvBun6ZOG2dxUW30myWoUJJ0iRbTAv2JFzjSpVQvPE+D5vtmdu6WlOR2ahF4leF

# 5Vvk4lPg2ZFrqg5LNwT9gjwuYgmih+G2KwT8NMWusBhO649F4Ku6B6QgA+vZld5S

# G2XWIdvS0pmpmn/HFrV4eYTsl9HYgjn/bPsAlfWolLlEXYTaCljK7q7bQHDBrzlR

# ukyyryFpPOR9Wx1cxFJ6KBqg2jlJpzxjN3udNJPOqarnQIVgB8DUm3I5g2v5xTHK

# Ovz9ucN21467cYcIxjPC4UkDAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUVBWIZHrG4UIX3uX4142l+8GsPXAw

# VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh

# dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzQ2MzAxMDAfBgNVHSMEGDAW

# gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v

# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw

# MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov

# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx

# XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB

# AE5msNzmYzYbNgpnhya6YsrM+CIC8CXDu10nwzZtkgQciPOOqAYmFcWJCwD5VZzs

# qFwad8XIOrfCylWf4hzn09mD87yuazpuCstLSqfDLNd3740+254vEZqdGxOglAGU

# ih2IiF8S0GDwucpLGzt/OLXPFr/d4MWxPuX0L+HB5lA3Y/CJE673dHGQW2DELdqt

# ohtkhp+oWFn1hNDDZ3LP++HEZvA7sI/o/981Sh4kaGayOp6oEiQuGeCXyfrIC9KX

# eew0UlYX/NHVDqr4ykKkqpHtzbUbuo7qovUHPbYKcRGWrrEtBS5SPLFPumqsRtzb

# LgU9HqfRAN36bMsd2qynGyWBVFOM7NMs2lTCGM85Z/Fdzv/8tnYT36Cmbue+IM+6

# kS86j6Ztmx0VIFWbOvNsASPT6yrmYiecJiP6H0TrYXQK5B3jE8s53l+t61ab0Eul

# 7DAxNWX3lAiUlzKs3qZYQEK1LFvgbdTXtBRnHgBdABALK3RPrieIYqPln9sAmg3/

# zJZi4C/c2cWGF6WwK/w1Nzw08pj7jaaZZVBpCeDe+y7oM26QIXxracot7zJ21/TL

# 70biK36YybSUDkjhQPP/uxT0yebLNBKk7g8V98Wna2MsHWwk0sgqpkjIp02TrkVz

# 26tcF2rml2THRSDrwpBa4x9c8rM8Qomiyeh2tEJnsx2LMIIHejCCBWKgAwIBAgIK

# YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm

# aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw

# OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD

# VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG

# 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la

# UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc

# 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D

# dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+

# lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk

# kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6

# A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd

# X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL

# 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd

# sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3

# T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS

# 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI

# bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL

# BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD

# uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv

# c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3

# dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf

# MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF

# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h

# cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA

# YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn

# 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7

# v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b

# pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/

# KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy

# CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp

# mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi

# hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb

# BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS

# oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL

# gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX

# cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCFVowghVWAgEBMIGVMH4x

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p

# Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAAHgcXMkylyY+BkAAAAA

# AeAwDQYJYIZIAWUDBAIBBQCggbAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw

# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIDh2

# hRHlcfQYuGryxRyJNP7FsKNZRDP6iqyV6Nsc7ABBMEQGCisGAQQBgjcCAQwxNjA0

# oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEcgBpodHRwczovL3d3dy5taWNyb3NvZnQu

# Y29tIDANBgkqhkiG9w0BAQEFAASCAQB+zweufHEXOq/C7NaCg2x5dtK7ia++/s5+

# /qErhuZuBpWC44OYW3pmNfVK7QuwVp1CSyOvmm0negXs6kJTfkoM1ZBXDhiLzlAX

# T5yhg96X5NcTCHPo6w8pZVmw2/s/b6vdpcW4QZz/GfP5WdKklXUeNKxZdliNcfVn

# 8g2zVXXuwCdu5ES0gAiqrOMSjkkfYPU3XKHj1VxwwrUnSbauyKDrRO9ZbHZlnMV6

# ly7S+0oakGZhTZHFEjSSCfVmSt8JZy8v9PYoc8H0eGyEdOQcfVydmnNkZc2+LQAe

# ZyNf5Yzl48ZUn7qWFWaIrKl80usWurLH78bkcEbj5y54gcEHq/JRoYIS4jCCEt4G

# CisGAQQBgjcDAwExghLOMIISygYJKoZIhvcNAQcCoIISuzCCErcCAQMxDzANBglg

# hkgBZQMEAgEFADCCAVEGCyqGSIb3DQEJEAEEoIIBQASCATwwggE4AgEBBgorBgEE

# AYRZCgMBMDEwDQYJYIZIAWUDBAIBBQAEIAQOkIHOTJ2Ml7AlKooqca4wGSUFpBnN

# sgHbxOVlC9PHAgZg+YUP4qkYEzIwMjEwODE2MDU1MzQzLjEyMlowBIACAfSggdCk

# gc0wgcoxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNV

# BAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJjAkBgNVBAsTHVRoYWxl

# cyBUU1MgRVNOOkVBQ0UtRTMxNi1DOTFEMSUwIwYDVQQDExxNaWNyb3NvZnQgVGlt

# ZS1TdGFtcCBTZXJ2aWNloIIOOTCCBPEwggPZoAMCAQICEzMAAAFMxUzB0NtvP7IA

# AAAAAUwwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh

# c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD

# b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw

# MTAwHhcNMjAxMTEyMTgyNjAwWhcNMjIwMjExMTgyNjAwWjCByjELMAkGA1UEBhMC

# VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV

# BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFt

# ZXJpY2EgT3BlcmF0aW9uczEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046RUFDRS1F

# MzE2LUM5MUQxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Uw

# ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKYWBRw6zHue+jVeyBCg/4

# 5N+8T4mk43ntsyt1z/qlCaQVTGNiAsWkUYctQp8n/+b1kaZ99wZPcWxnoJ6W5KC/

# PNGzaUmerlnKc0oBQTnZjVK0wbfekVl2j2O5LVDAWRFr4kn98gldiF4FmAEBbmfb

# LEPWII6aNab1K7WqFMAI4mjON+lAlPX1tQ/pHBB9OZuIbnFmxPCVvjvW925XrYr+

# /J/nwuqCpOmkkEURS+DiYqL0vom9e+RuqUn/cA0ZPV95DuutTrQnKx2QH8HtjB1w

# z+HmXxkZLAPyL76yxTXGoyOyLek8fqJw8keYoEYvpAiaExtGFBgtVDIwitOVrQ67

# AgMBAAGjggEbMIIBFzAdBgNVHQ4EFgQUAZYepwQKXucnlUIBgPQQR95m+nwwHwYD

# VR0jBBgwFoAU1WM6XIoxkPNDe3xGG8UzaFqFbVUwVgYDVR0fBE8wTTBLoEmgR4ZF

# aHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljVGlt

# U3RhUENBXzIwMTAtMDctMDEuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggrBgEFBQcw

# AoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNUaW1TdGFQ

# Q0FfMjAxMC0wNy0wMS5jcnQwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEF

# BQcDCDANBgkqhkiG9w0BAQsFAAOCAQEATwTksPfWQ66ogGKvd+tmdx2IQYaEl7zH

# iAhvccO65afIQLZokhzyAHDO+MZH2GZ3QX9WUObp1OWJlfvzxv0LuzV/GSoJHLDV

# vFDwJ1W06UfrzZn//5F3YgyT92/FO5zM2dOaXkSjFeL1DhGA+vsMPBzUkgRI0VX2

# hEgS2d6KYz6Mc2smqKfll1OWVrZaJpd6C657ptbInE1asN9JjNo2P8CSR/2yuG00

# c87+7e59fIAf/lwv2Ef49vrSLp7Y9MS9EFBRtF7gQC/usy0grSUd+qtIT/++2bJN

# LcS/eZjXK0X0UCcuMU+ZZBiGV2wMhEIOdQRuWqJlTv9ftOb67c/KazCCBnEwggRZ

# oAMCAQICCmEJgSoAAAAAAAIwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVT

# MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK

# ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290

# IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTEwMDcwMTIxMzY1NVoXDTI1

# MDcwMTIxNDY1NVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x

# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv

# bjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggEiMA0G

# CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpHQ28dxGKOiDs/BOX9fp/aZRrdFQQ

# 1aUKAIKF++18aEssX8XD5WHCdrc+Zitb8BVTJwQxH0EbGpUdzgkTjnxhMFmxMEQP

# 8WCIhFRDDNdNuDgIs0Ldk6zWczBXJoKjRQ3Q6vVHgc2/JGAyWGBG8lhHhjKEHnRh

# Z5FfgVSxz5NMksHEpl3RYRNuKMYa+YaAu99h/EbBJx0kZxJyGiGKr0tkiVBisV39

# dx898Fd1rL2KQk1AUdEPnAY+Z3/1ZsADlkR+79BL/W7lmsqxqPJ6Kgox8NpOBpG2

# iAg16HgcsOmZzTznL0S6p/TcZL2kAcEgCZN4zfy8wMlEXV4WnAEFTyJNAgMBAAGj

# ggHmMIIB4jAQBgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQU1WM6XIoxkPNDe3xG

# G8UzaFqFbVUwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGG

# MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186a

# GMQwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3Br

# aS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsG

# AQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29t

# L3BraS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwgaAGA1UdIAEB

# /wSBlTCBkjCBjwYJKwYBBAGCNy4DMIGBMD0GCCsGAQUFBwIBFjFodHRwOi8vd3d3

# Lm1pY3Jvc29mdC5jb20vUEtJL2RvY3MvQ1BTL2RlZmF1bHQuaHRtMEAGCCsGAQUF

# BwICMDQeMiAdAEwAZQBnAGEAbABfAFAAbwBsAGkAYwB5AF8AUwB0AGEAdABlAG0A

# ZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQAH5ohRDeLG4Jg/gXEDPZ2joSFv

# s+umzPUxvs8F4qn++ldtGTCzwsVmyWrf9efweL3HqJ4l4/m87WtUVwgrUYJEEvu5

# U4zM9GASinbMQEBBm9xcF/9c+V4XNZgkVkt070IQyK+/f8Z/8jd9Wj8c8pl5SpFS

# AK84Dxf1L3mBZdmptWvkx872ynoAb0swRCQiPM/tA6WWj1kpvLb9BOFwnzJKJ/1V

# ry/+tuWOM7tiX5rbV0Dp8c6ZZpCM/2pif93FSguRJuI57BlKcWOdeyFtw5yjojz6

# f32WapB4pm3S4Zz5Hfw42JT0xqUKloakvZ4argRCg7i1gJsiOCC1JeVk7Pf0v35j

# WSUPei45V3aicaoGig+JFrphpxHLmtgOR5qAxdDNp9DvfYPw4TtxCd9ddJgiCGHa

# sFAeb73x4QDf5zEHpJM692VHeOj4qEir995yfmFrb3epgcunCaw5u+zGy9iCtHLN

# HfS4hQEegPsbiSpUObJb2sgNVZl6h3M7COaYLeqN4DMuEin1wC9UJyH3yKxO2ii4

# sanblrKnQqLJzxlBTeCG+SqaoxFmMNO7dDJL32N79ZmKLxvHIa9Zta7cRDyXUHHX

# odLFVeNp3lfB0d4wwP3M5k37Db9dT+mdHhk4L7zPWAUu7w2gUDXa7wknHNWzfjUe

# CLraNtvTX4/edIhJEqGCAsswggI0AgEBMIH4oYHQpIHNMIHKMQswCQYDVQQGEwJV

# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE

# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l

# cmljYSBPcGVyYXRpb25zMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjpFQUNFLUUz

# MTYtQzkxRDElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIj

# CgEBMAcGBSsOAwIaAxUAPZlbTgkoE2J2HRjNYygElxrg96CggYMwgYCkfjB8MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy

# b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIFAOTET48w

# IhgPMjAyMTA4MTYxMDQ0MzFaGA8yMDIxMDgxNzEwNDQzMVowdDA6BgorBgEEAYRZ

# CgQBMSwwKjAKAgUA5MRPjwIBADAHAgEAAgIFEDAHAgEAAgIRPjAKAgUA5MWhDwIB

# ADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQow

# CAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAIHjQNlrTZo1QWuIQTOiJh/WZnjM

# M/zaDD6rMu6gtRI6MbeY7MXx06IvsMCGI/Wh4Z0blMSW0xkWPSQiFS3VvdHUOEdl

# aaiaPyPUeaXQIwCDFR8/55qkpv2QhCy4Noy1exWCgjAbMhxdoJtguJqLjNO1lhNj

# YGYxbAsAPO325snGMYIDDTCCAwkCAQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAg

# UENBIDIwMTACEzMAAAFMxUzB0NtvP7IAAAAAAUwwDQYJYIZIAWUDBAIBBQCgggFK

# MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQggEu1

# 2dBLCHekI6FplPlO0qySCOU6Zrw4Rsl7Q6CxFWQwgfoGCyqGSIb3DQEJEAIvMYHq

# MIHnMIHkMIG9BCDbwqW7v1BLMtEQTCDh+k8LLYZTfdP7c9mvEGJnxK9OJTCBmDCB

# gKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNV

# BAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABTMVMwdDbbz+y

# AAAAAAFMMCIEIH+NmCIvEZ70cJmsD6BWhKVu8hbC0KCtR9F9lzivCSMEMA0GCSqG

# SIb3DQEBCwUABIIBADB1aoJ4ttySy8ljRuY0/Kp530aLQKNQWm5rmkCb0X3KA/rN

# 8PizOB1yMeun09IGixGopSSJeLO9IlPOpUeqIcATjH/10bPrPdXDDa4//7qqoTph

# 0U7cA9Bc4uDjQ1VclUkMYdth6v8mjie1NkuiplGEGikEcTwDBSU3r+TM0fnLV6oY

# BwzyLc2yP3zyej9zpCvVuXZUKEbRJYDCQi12HaqMlZ+gk8+F7rUITOJe+8nja2ML

# Gn2VeEiDzG0KRjmnqBSXka6WUhld0JkUyMHosqMcS5jUsgRNAQ/0zCHB8YmuG2gD

# Ydv3ky8MmPz9MtjgdmMvWx6fxSP9vY3PNoC6KhU=

# SIG # End signature block