Framework/Helpers/ContextHelper.ps1
|
<#
.Description # Context class for indenity details. # Provides functionality to login, create context, get token for api calls #> using namespace Microsoft.IdentityModel.Clients.ActiveDirectory class ContextHelper { static hidden [Context] $currentContext; static hidden [bool] $IsOAuthScan; static hidden [bool] $PromptForLogin; #This will be used to carry current org under current context. static hidden [string] $orgName; static hidden [bool] $IsBatchScan; static hidden [int] $PSVersion = $null; static hidden $appObj = $null; static hidden $Account = $null; static hidden $IsPATUsed = $false; ContextHelper() { if(-not [string]::IsNullOrWhiteSpace($env:RefreshToken) -and -not [string]::IsNullOrWhiteSpace($env:ClientSecret)) # this if block will be executed for OAuth based scan { [ContextHelper]::IsOAuthScan = $true } if (![ContextHelper]::PSVersion) { [ContextHelper]::PSVersion = ($global:PSVersionTable).PSVersion.major } } ContextHelper([bool] $IsBatchScan) { if(-not [string]::IsNullOrWhiteSpace($env:RefreshToken) -and -not [string]::IsNullOrWhiteSpace($env:ClientSecret)) # this if block will be executed for OAuth based scan { [ContextHelper]::IsOAuthScan = $true } [ContextHelper]::IsBatchScan=$true; if (![ContextHelper]::PSVersion) { [ContextHelper]::PSVersion = ($global:PSVersionTable).PSVersion.major } } hidden static [PSObject] GetCurrentContext() { return [ContextHelper]::GetCurrentContext($false); } hidden static [PSObject] GetCurrentContext([bool]$authNRefresh) { if( (-not [ContextHelper]::currentContext) -or $authNRefresh -or [ContextHelper]::PromptForLogin) { [ContextHelper]::IsPATUsed = $false $clientId = [Constants]::DefaultClientId ; $replyUri = [Constants]::DefaultReplyUri; $adoResourceId = [Constants]::DefaultADOResourceId; [AuthenticationContext] $ctx = $null; $ctx = [AuthenticationContext]::new("https://login.windows.net/common"); $result = $null; if([ContextHelper]::IsOAuthScan) { # this if block will be executed for OAuth based scan $tokenInfo = [ContextHelper]::GetOAuthAccessToken() [ContextHelper]::ConvertToContextObject($tokenInfo) } else { if ([ContextHelper]::PSVersion -gt 5) { [string[]] $Scopes = "$adoResourceId/.default"; [Microsoft.Identity.Client.IPublicClientApplication] $app = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::Create($ClientId).Build(); if(![ContextHelper]::appObj) { [ContextHelper]::appObj = $app } if (![ContextHelper]::Account) { [ContextHelper]::Account = $app.GetAccountsAsync().GetAwaiter().GetResult() | Select-Object -First 1 } $tokenSource = New-Object System.Threading.CancellationTokenSource $taskAuthenticationResult=$null try { if ( !$authNRefresh -and [ContextHelper]::PromptForLogin) { if ([ContextHelper]::PromptForLogin) { $AquireTokenParameters = $app.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } else { $AquireTokenParameters = $app.AcquireTokenSilent($Scopes, [ContextHelper]::Account) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) if ($taskAuthenticationResult.exception.message -like "*errors occurred*") { $AquireTokenParameters = $app.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } } } else { if ([ContextHelper]::appObj) { $AquireTokenParameters = [ContextHelper]::appObj.AcquireTokenSilent($Scopes, [ContextHelper]::Account) } else { $AquireTokenParameters = $app.AcquireTokenSilent($Scopes, [ContextHelper]::Account) } $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) if ($taskAuthenticationResult.exception.message -like "*errors occurred*") { $AquireTokenParameters = $app.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } } } catch { $AquireTokenParameters = $app.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } if ($taskAuthenticationResult.Result) { $result = $taskAuthenticationResult.Result; } if (![ContextHelper]::Account) { [ContextHelper]::Account = $app.GetAccountsAsync().GetAwaiter().GetResult() | Select-Object -First 1 } [ContextHelper]::appObj = $app; } else { if ( !$authNRefresh -and [ContextHelper]::PromptForLogin) { if ([ContextHelper]::PromptForLogin) { $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result; [ContextHelper]::PromptForLogin = $false } else { $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result; } } else { $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result; } } [ContextHelper]::ConvertToContextObject($result) } } return [ContextHelper]::currentContext } hidden static [PSObject] GetCurrentContext([System.Security.SecureString] $PATToken) { if(-not [ContextHelper]::currentContext) { [ContextHelper]::IsPATUsed = $true; [ContextHelper]::ConvertToContextObject($PATToken) } return [ContextHelper]::currentContext } hidden static [PSObject] GetOAuthAccessToken() { $tokenInfo = @{}; try{ $url = "https://app.vssps.visualstudio.com/oauth2/token" # exchange refresh token with new access token $body = "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=$($env:ClientSecret)&grant_type=refresh_token&assertion=$($env:RefreshToken)&redirect_uri=https://localhost/" $res = Invoke-WebRequest -Uri $url -ContentType "application/x-www-form-urlencoded" -Method POST -Body $body $response = $res.Content | ConvertFrom-Json $tokenInfo['AccessToken'] = $response.access_token $expiry = $response.expires_in $request_time = get-date $tokenInfo['ExpiresOn'] = $request_time.AddSeconds($expiry) $refreshToken = ConvertTo-SecureString $response.refresh_token -AsPlainText -Force #Update refresh token if it is expiring in next 1 day $updateTokenInKV = $false $secretName = "RefreshTokenForADOScan" $tokenSecret = Get-AzKeyVaultSecret -VaultName $env:KeyVaultName -Name $secretName if (-not [string]::IsNullOrEmpty($tokenSecret) -and [Helpers]::CheckMember($tokenSecret,"Expires")) { if ($tokenSecret.Expires -le [DateTime]::Now.AddDays(1)) { $updateTokenInKV = $true } } else { $updateTokenInKV = $true } if ($updateTokenInKV -eq $true) { $RefreshTokenExpiresInDays = [Constants]::RefreshTokenExpiresInDays; $ExpiryDate = [DateTime]::Now.AddDays($RefreshTokenExpiresInDays) Set-AzKeyVaultSecret -VaultName $env:KeyVaultName -Name $secretName -SecretValue $refreshToken -Expires $ExpiryDate | out-null } } catch{ write-Host "Error fetching OAuth access token" Write-Host $_ return $null } return $tokenInfo } static [string] GetAccessToken([string] $resourceAppIdUri) { return [ContextHelper]::GetAccessToken() } static [string] GetAccessToken() { if([ContextHelper]::currentContext) { # Validate if token is PAT using lenght (PAT has lengh of 52), if PAT dont go to refresh login session. #TODO: Change code to find token type supplied PAT or login session token #if token expiry is within 2 min, refresh. ([ContextHelper]::currentContext.AccessToken.length -ne 52) if ( [ContextHelper]::IsPATUsed -eq $false -and ([ContextHelper]::currentContext.TokenExpireTimeLocal -le [DateTime]::Now.AddMinutes(2))) { [ContextHelper]::GetCurrentContext($true); } return [ContextHelper]::currentContext.AccessToken } else { return $null } } static [string] GetAccessToken([string] $Uri, [string] $tenantId) { $rmContext = Get-AzContext if (-not $rmContext) { throw ([SuppressedException]::new(("No Azure login found"), [SuppressedExceptionType]::InvalidOperation)) } if ([string]::IsNullOrEmpty($tenantId) -and [Helpers]::CheckMember($rmContext,"Tenant")) { $tenantId = $rmContext.Tenant.Id } $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate( $rmContext.Account, $rmContext.Environment, $tenantId, [System.Security.SecureString] $null, "Never", $null, $Uri); if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken)))) { throw ([SuppressedException]::new(("Unable to get access token. Authentication Failed."), [SuppressedExceptionType]::Generic)) } return $authResult.AccessToken; } static [string] GetGraphAccessToken($useAzContext) { $accessToken = '' try { Write-Host "Graph access is required to evaluate some controls. Attempting to acquire graph token." -ForegroundColor Cyan # In CA mode, we use azure context to fetch the graph access token. if ($useAzContext) { #getting azure context because graph access token requires azure environment details. $Context = @(Get-AzContext -ErrorAction SilentlyContinue ) if ($Context.count -eq 0) { Connect-AzAccount -ErrorAction Stop $Context = @(Get-AzContext -ErrorAction SilentlyContinue) } if ($null -eq $Context) { throw "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate." } else { $graphUri = "https://graph.microsoft.com" $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate( $Context.Account, $Context.Environment, $Context.Tenant.Id, [System.Security.SecureString] $null, "Never", $null, $graphUri); if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken)))) { throw ([SuppressedException]::new(("Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate."), [SuppressedExceptionType]::Generic)) } $accessToken = $authResult.AccessToken; } } else { # generating graph access token using default VSTS client. $clientId = [Constants]::DefaultClientId; $replyUri = [Constants]::DefaultReplyUri; $adoResourceId = "https://graph.microsoft.com/"; if ([ContextHelper]::PSVersion -gt 5) { $result = [ContextHelper]::GetGraphAccess() } else { [AuthenticationContext] $ctx = [AuthenticationContext]::new("https://login.windows.net/common"); [AuthenticationResult] $result = $null; $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result; } $accessToken = $result.AccessToken } Write-Host "Successfully acquired graph access token." -ForegroundColor Cyan } catch { Write-Host "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate." -ForegroundColor Red Write-Host "Continuing without graph access." -ForegroundColor Yellow return $null } return $accessToken; } static [string] GetDataExplorerAccessToken($useAzContext) { $accessToken = '' try { Write-Host "Graph access is required to evaluate some controls. Attempting to acquire graph token." -ForegroundColor Cyan # generating graph access token using default VSTS client. $clientId = [Constants]::DefaultClientId; $replyUri = [Constants]::DefaultReplyUri; $adoResourceId = "https://help.kusto.windows.net"; if ([ContextHelper]::PSVersion -gt 5) { $result = [ContextHelper]::GetGraphAccessForDataExplorer() } else { # generating data explorer token using default VSTS client. # this will generate token for local user and generates popup for user login. $clientId = [Constants]::DefaultClientId; $replyUri = [Constants]::DefaultReplyUri; $adoResourceId = "https://help.kusto.windows.net"; if ([ContextHelper]::PSVersion -gt 5) { $result = [ContextHelper]::GetGraphAccess() } else { [AuthenticationContext] $ctx = [AuthenticationContext]::new("https://login.windows.net/common"); [AuthenticationResult] $result = $null; $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result; } $accessToken = $result.AccessToken } } catch { return $null } return $accessToken; } static [string] GetLAWSAccessToken() { $accessToken = '' try { #getting azure context because graph access token requires azure environment details. $Context = @(Get-AzContext -ErrorAction SilentlyContinue ) if ($Context.count -eq 0) { Connect-AzAccount -ErrorAction Stop $Context = @(Get-AzContext -ErrorAction SilentlyContinue) } if ($null -eq $Context) { throw "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate." } else { $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate( $Context.Account, $Context.Environment, $Context.Tenant.Id, [System.Security.SecureString] $null, "Never", $null, "https://api.loganalytics.io/"); if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken)))) { throw ([SuppressedException]::new(("Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate."), [SuppressedExceptionType]::Generic)) } $accessToken = $authResult.AccessToken; } } catch { Write-Host "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate." -ForegroundColor Red Write-Host "Continuing without graph access." -ForegroundColor Yellow return $null } return $accessToken; } hidden static [PSobject] GetGraphAccess() { $rootConfigPath = [Constants]::AzSKAppFolderPath; $azskSettings = (Get-Content -Raw -Path (Join-Path $rootConfigPath "AzSKSettings.json")) | ConvertFrom-Json if ([ContextHelper]::IsPATUsed -and $azskSettings -and $azskSettings.LASource -ne "CICD") { $Context = @(Get-AzContext -ErrorAction SilentlyContinue) if ($null -eq $Context -or $Context.count -eq 0) { Connect-AzAccount -ErrorAction Stop $Context = @(Get-AzContext -ErrorAction SilentlyContinue) } if ($null -eq $Context) { throw } else { $graphUri = "https://graph.microsoft.com" $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate( $Context.Account, $Context.Environment, $Context.Tenant.Id, [System.Security.SecureString] $null, "Never", $null, $graphUri); return $authResult; } } else { $ClientId = [Constants]::DefaultClientId [Microsoft.Identity.Client.IPublicClientApplication] $appGrapth = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::Create($ClientId).Build(); if (![ContextHelper]::Account) { [ContextHelper]::Account = $appGrapth.GetAccountsAsync().GetAwaiter().GetResult() | Select-Object -First 1 } $tokenSource = New-Object System.Threading.CancellationTokenSource $taskAuthenticationResult=$null $AquireTokenParameters = $null; [string[]] $Scopes = "https://graph.microsoft.com/.default"; $AquireTokenParameters = [ContextHelper]::appObj.AcquireTokenSilent($Scopes, [ContextHelper]::Account) try { $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) if ( [Helpers]::CheckMember($taskAuthenticationResult, "exception.message") -and ($taskAuthenticationResult.exception.message -like "*errors occurred*")) { $AquireTokenParameters = $appGrapth.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } } catch { $AquireTokenParameters = $appGrapth.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } } return $taskAuthenticationResult.result; } hidden static [PSobject] GetGraphAccessForDataExplorer() { $rootConfigPath = [Constants]::AzSKAppFolderPath; $azskSettings = (Get-Content -Raw -Path (Join-Path $rootConfigPath "AzSKSettings.json")) | ConvertFrom-Json if ([ContextHelper]::IsPATUsed -and $azskSettings -and $azskSettings.LASource -ne "CICD") { $Context = @(Get-AzContext -ErrorAction SilentlyContinue) if ($null -eq $Context -or $Context.count -eq 0) { Connect-AzAccount -ErrorAction Stop $Context = @(Get-AzContext -ErrorAction SilentlyContinue) } if ($null -eq $Context) { throw } else { $graphUri = "https://help.kusto.windows.net" $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate( $Context.Account, $Context.Environment, $Context.Tenant.Id, [System.Security.SecureString] $null, "Never", $null, $graphUri); return $authResult; } } else { $ClientId = [Constants]::DefaultClientId [Microsoft.Identity.Client.IPublicClientApplication] $appGrapth = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::Create($ClientId).Build(); if (![ContextHelper]::Account) { [ContextHelper]::Account = $appGrapth.GetAccountsAsync().GetAwaiter().GetResult() | Select-Object -First 1 } $tokenSource = New-Object System.Threading.CancellationTokenSource $taskAuthenticationResult=$null $AquireTokenParameters = $null; [string[]] $Scopes = "https://help.kusto.windows.net"; $AquireTokenParameters = [ContextHelper]::appObj.AcquireTokenSilent($Scopes, [ContextHelper]::Account) try { $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) if ( [Helpers]::CheckMember($taskAuthenticationResult, "exception.message") -and ($taskAuthenticationResult.exception.message -like "*errors occurred*")) { $AquireTokenParameters = $appGrapth.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } } catch { $AquireTokenParameters = $appGrapth.AcquireTokenInteractive($Scopes) $taskAuthenticationResult = $AquireTokenParameters.ExecuteAsync($tokenSource.Token) } } return $taskAuthenticationResult.result; } hidden [OrganizationContext] SetContext([string] $organizationName) { if((-not [string]::IsNullOrEmpty($organizationName))) { $OrganizationContext = [OrganizationContext]@{ OrganizationId = $organizationName; Scope = "/Organization/$organizationName"; OrganizationName = $organizationName; }; # $organizationId contains the organization name (due to framework). [ContextHelper]::orgName = $organizationName; [ContextHelper]::GetCurrentContext() } else { throw [SuppressedException] ("OrganizationName name [$organizationName] is either malformed or incorrect.") } return $OrganizationContext; } hidden [OrganizationContext] SetContext([string] $organizationName, [System.Security.SecureString] $PATToken) { if((-not [string]::IsNullOrEmpty($organizationName))) { $OrganizationContext = [OrganizationContext]@{ OrganizationId = $organizationName; Scope = "/Organization/$organizationName"; OrganizationName = $organizationName; }; # $organizationId contains the organization name (due to framework). [ContextHelper]::orgName = $organizationName; [ContextHelper]::GetCurrentContext($PATToken) } else { throw [SuppressedException] ("OrganizationName name [$organizationName] is either malformed or incorrect.") } return $OrganizationContext; } static [void] ResetCurrentContext() { } hidden static ConvertToContextObject([PSObject] $context) { $contextObj = [Context]::new() # We do not get ADO organization id as part of current context. Hence appending org name to both id and name param. $contextObj.Organization = [Organization]::new() $contextObj.Organization.Id = [ContextHelper]::orgName $contextObj.Organization.Name = [ContextHelper]::orgName if([ContextHelper]::IsOAuthScan) { # this if block will be executed for OAuth based scan $contextObj.Account.Id = [ContextHelper]::GetOAuthUserIdentity($context.AccessToken, $contextObj.Organization.Name) $contextObj.AccessToken = $context.AccessToken $contextObj.TokenExpireTimeLocal = $context.ExpiresOn } else { if ([ContextHelper]::PSVersion -gt 5) { $contextObj.Account.Id = $context.Account.username } else { $contextObj.Account.Id = $context.UserInfo.DisplayableId } $contextObj.Tenant.Id = $context.TenantId $contextObj.AccessToken = $context.AccessToken $contextObj.TokenExpireTimeLocal = $context.ExpiresOn.LocalDateTime #$contextObj.AccessToken = ConvertTo-SecureString -String $context.AccessToken -asplaintext -Force } [ContextHelper]::currentContext = $contextObj } hidden static [string] GetOAuthUserIdentity($accessToken, $orgName) { $apiURL = "https://dev.azure.com/{0}/_apis/connectionData" -f $orgName $headers =@{ Authorization = "Bearer $accesstoken"; "Content-Type"="application/json" }; try{ $responseObj = Invoke-RestMethod -Method Get -Uri $apiURL -Headers $headers -UseBasicParsing $descriptor = $responseObj.authenticatedUser.descriptor $userId = ($descriptor -split '\\')[-1] return $userId } catch{ return "" } } hidden static ConvertToContextObject([System.Security.SecureString] $patToken) { $contextObj = [Context]::new() $contextObj.Account.Id = [string]::Empty $contextObj.Tenant.Id = [string]::Empty $contextObj.AccessToken = [System.Net.NetworkCredential]::new("", $patToken).Password # We do not get ADO organization Id as part of current context. Hence appending org name to both Id and Name param. $contextObj.Organization = [Organization]::new() $contextObj.Organization.Id = [ContextHelper]::orgName $contextObj.Organization.Name = [ContextHelper]::orgName #$contextObj.AccessToken = $patToken #$contextObj.AccessToken = ConvertTo-SecureString -String $context.AccessToken -asplaintext -Force [ContextHelper]::currentContext = $contextObj try { $apiURL = "https://dev.azure.com/{0}/_apis/connectionData" -f [ContextHelper]::orgName #Note: cannot use this WRH method below due to ordering constraints during load in Framework.ps1 #$header = [WebRequestHelper]::GetAuthHeaderFromUri($apiURL); $user = "" $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user, $contextObj.AccessToken))) $headers = @{ "Authorization"= ("Basic " + $base64AuthInfo); "Content-Type"="application/json" }; $responseObj = Invoke-RestMethod -Method Get -Uri $apiURL -Headers $headers -UseBasicParsing #If the token is valid, we get: "descriptor"="Microsoft.IdentityModel.Claims.ClaimsIdentity;72f988bf-86f1-41af-91ab-2d7cd011db47\xyz@microsoft.com" #Note that even for guest users, we get the host tenant (and not their native tenantId). E.g., "descriptor...;72f...47\pqr@live.com" #If the token is invalid, we get a diff object: "descriptor":"System:PublicAccess;aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa" $authNUserInfo = @(($responseObj.authenticatedUser.descriptor -split ';') -split '\\') #Check if the above split resulted in 3 elements (valid token case) if ($authNUserInfo.Count -eq 3) { $contextObj.Tenant.Id = $authNUserInfo[1] $contextObj.Account.Id = $authNUserInfo[2] } elseif ([Helpers]::CheckMember($responseObj.authenticatedUser,"customDisplayName")) { $contextObj.Account.Id = $responseObj.authenticatedUser.customDisplayName; } } catch { Write-Host "Organization not found: Incorrect organization name or account does not have necessary permission to access the organization. Use -ResetCredentials parameter in command to login with another account." -ForegroundColor Yellow throw [SuppressedException] "The remote server returned an error: (404) Not Found."; } } static [string] GetCurrentSessionUser() { $context = [ContextHelper]::GetCurrentContext() if ($null -ne $context) { return $context.Account.Id } else { return "NO_ACTIVE_SESSION" } } } # SIG # Begin signature block # MIInuQYJKoZIhvcNAQcCoIInqjCCJ6YCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCA6hzYXbb7MVpbS # 8a9PBkgeHqGdfnPR5mr3+heK7oPfOqCCDYEwggX/MIID56ADAgECAhMzAAACUosz # qviV8znbAAAAAAJSMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjEwOTAyMTgzMjU5WhcNMjIwOTAxMTgzMjU5WjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQDQ5M+Ps/X7BNuv5B/0I6uoDwj0NJOo1KrVQqO7ggRXccklyTrWL4xMShjIou2I # sbYnF67wXzVAq5Om4oe+LfzSDOzjcb6ms00gBo0OQaqwQ1BijyJ7NvDf80I1fW9O # L76Kt0Wpc2zrGhzcHdb7upPrvxvSNNUvxK3sgw7YTt31410vpEp8yfBEl/hd8ZzA # v47DCgJ5j1zm295s1RVZHNp6MoiQFVOECm4AwK2l28i+YER1JO4IplTH44uvzX9o # RnJHaMvWzZEpozPy4jNO2DDqbcNs4zh7AWMhE1PWFVA+CHI/En5nASvCvLmuR/t8 # q4bc8XR8QIZJQSp+2U6m2ldNAgMBAAGjggF+MIIBejAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUNZJaEUGL2Guwt7ZOAu4efEYXedEw # UAYDVR0RBEkwR6RFMEMxKTAnBgNVBAsTIE1pY3Jvc29mdCBPcGVyYXRpb25zIFB1 # ZXJ0byBSaWNvMRYwFAYDVQQFEw0yMzAwMTIrNDY3NTk3MB8GA1UdIwQYMBaAFEhu # ZOVQBdOCqhc3NyK1bajKdQKVMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cu # bWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY0NvZFNpZ1BDQTIwMTFfMjAxMS0w # Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx # MS0wNy0wOC5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAFkk3 # uSxkTEBh1NtAl7BivIEsAWdgX1qZ+EdZMYbQKasY6IhSLXRMxF1B3OKdR9K/kccp # kvNcGl8D7YyYS4mhCUMBR+VLrg3f8PUj38A9V5aiY2/Jok7WZFOAmjPRNNGnyeg7 # l0lTiThFqE+2aOs6+heegqAdelGgNJKRHLWRuhGKuLIw5lkgx9Ky+QvZrn/Ddi8u # TIgWKp+MGG8xY6PBvvjgt9jQShlnPrZ3UY8Bvwy6rynhXBaV0V0TTL0gEx7eh/K1 # o8Miaru6s/7FyqOLeUS4vTHh9TgBL5DtxCYurXbSBVtL1Fj44+Od/6cmC9mmvrti # yG709Y3Rd3YdJj2f3GJq7Y7KdWq0QYhatKhBeg4fxjhg0yut2g6aM1mxjNPrE48z # 6HWCNGu9gMK5ZudldRw4a45Z06Aoktof0CqOyTErvq0YjoE4Xpa0+87T/PVUXNqf # 7Y+qSU7+9LtLQuMYR4w3cSPjuNusvLf9gBnch5RqM7kaDtYWDgLyB42EfsxeMqwK # WwA+TVi0HrWRqfSx2olbE56hJcEkMjOSKz3sRuupFCX3UroyYf52L+2iVTrda8XW # esPG62Mnn3T8AuLfzeJFuAbfOSERx7IFZO92UPoXE1uEjL5skl1yTZB3MubgOA4F # 8KoRNhviFAEST+nG8c8uIsbZeb08SeYQMqjVEmkwggd6MIIFYqADAgECAgphDpDS # AAAAAAADMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK # V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0 # IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0 # ZSBBdXRob3JpdHkgMjAxMTAeFw0xMTA3MDgyMDU5MDlaFw0yNjA3MDgyMTA5MDla # MH4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS # ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMT # H01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTEwggIiMA0GCSqGSIb3DQEB # AQUAA4ICDwAwggIKAoICAQCr8PpyEBwurdhuqoIQTTS68rZYIZ9CGypr6VpQqrgG # OBoESbp/wwwe3TdrxhLYC/A4wpkGsMg51QEUMULTiQ15ZId+lGAkbK+eSZzpaF7S # 35tTsgosw6/ZqSuuegmv15ZZymAaBelmdugyUiYSL+erCFDPs0S3XdjELgN1q2jz # y23zOlyhFvRGuuA4ZKxuZDV4pqBjDy3TQJP4494HDdVceaVJKecNvqATd76UPe/7 # 4ytaEB9NViiienLgEjq3SV7Y7e1DkYPZe7J7hhvZPrGMXeiJT4Qa8qEvWeSQOy2u # M1jFtz7+MtOzAz2xsq+SOH7SnYAs9U5WkSE1JcM5bmR/U7qcD60ZI4TL9LoDho33 # X/DQUr+MlIe8wCF0JV8YKLbMJyg4JZg5SjbPfLGSrhwjp6lm7GEfauEoSZ1fiOIl # XdMhSz5SxLVXPyQD8NF6Wy/VI+NwXQ9RRnez+ADhvKwCgl/bwBWzvRvUVUvnOaEP # 6SNJvBi4RHxF5MHDcnrgcuck379GmcXvwhxX24ON7E1JMKerjt/sW5+v/N2wZuLB # l4F77dbtS+dJKacTKKanfWeA5opieF+yL4TXV5xcv3coKPHtbcMojyyPQDdPweGF # RInECUzF1KVDL3SV9274eCBYLBNdYJWaPk8zhNqwiBfenk70lrC8RqBsmNLg1oiM # CwIDAQABo4IB7TCCAekwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFEhuZOVQ # BdOCqhc3NyK1bajKdQKVMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1Ud # DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFHItOgIxkEO5FAVO # 4eqnxzHRI4k0MFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9jcmwubWljcm9zb2Z0 # LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcmwwXgYIKwYBBQUHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p # Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y # Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAGCNy4DMIGDMD8GCCsGAQUFBwIB # FjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2RvY3MvcHJpbWFyeWNw # cy5odG0wQAYIKwYBBQUHAgIwNB4yIB0ATABlAGcAYQBsAF8AcABvAGwAaQBjAHkA # XwBzAHQAYQB0AGUAbQBlAG4AdAAuIB0wDQYJKoZIhvcNAQELBQADggIBAGfyhqWY # 4FR5Gi7T2HRnIpsLlhHhY5KZQpZ90nkMkMFlXy4sPvjDctFtg/6+P+gKyju/R6mj # 82nbY78iNaWXXWWEkH2LRlBV2AySfNIaSxzzPEKLUtCw/WvjPgcuKZvmPRul1LUd # d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ # Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf # wzIY4vDFLc5bnrRJOQrGCsLGra7lstnbFYhRRVg4MnEnGn+x9Cf43iw6IGmYslmJ # aG5vp7d0w0AFBqYBKig+gj8TTWYLwLNN9eGPfxxvFX1Fp3blQCplo8NdUmKGwx1j # NpeG39rz+PIWoZon4c2ll9DuXWNB41sHnIc+BncG0QaxdR8UvmFhtfDcxhsEvt9B # xw4o7t5lL+yX9qFcltgA1qFGvVnzl6UJS0gQmYAf0AApxbGbpT9Fdx41xtKiop96 # eiL6SJUfq/tHI4D1nvi/a7dLl+LrdXga7Oo3mXkYS//WsyNodeav+vyL6wuA6mk7 # r/ww7QRMjt/fdW1jkT3RnVZOT7+AVyKheBEyIXrvQQqxP/uozKRdwaGIm1dxVk5I # RcBCyZt2WwqASGv9eZ/BvW1taslScxMNelDNMYIZjjCCGYoCAQEwgZUwfjELMAkG # A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx # HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9z # b2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAxMQITMwAAAlKLM6r4lfM52wAAAAACUjAN # BglghkgBZQMEAgEFAKCBsDAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgor # BgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQgz0evD1pk # iN3ReNJcKUr+SClpBpuU+wYoOtn2Hzv2te8wRAYKKwYBBAGCNwIBDDE2MDSgFIAS # AE0AaQBjAHIAbwBzAG8AZgB0oRyAGmh0dHBzOi8vd3d3Lm1pY3Jvc29mdC5jb20g # MA0GCSqGSIb3DQEBAQUABIIBADfC+Iwnm3CsD/LdzEXPyioLhqFpwNE8/p13HI3X # V8CMgjlF/PUNbCey+xKFTPMNKrXdV8ogr7aXEq5AMBajn5jn2smLmD5+Cs+XBh0d # rWsFgOgAOKvg4pfiU4QdrSz/4UB2eYVtWPXgLOEgWGyk5ubczyoHgHCwNdgL0uY4 # I90wM7j1maH+uQyCgMzSxObFWsH6I2vMCQfz9PyqBP6htao/FVhmvJ7I74nvKUOG # YVydSmhbmC49qbOl0kkdiVjg0+0+u4jfuNUCtAbGZ8u0vhHerMUzmzbuZxV0t7me # Cv/EJgryAR878s6YBt2LZz5RnC4SOM4jSj86JZjcDUVbDGyhghcWMIIXEgYKKwYB # BAGCNwMDATGCFwIwghb+BgkqhkiG9w0BBwKgghbvMIIW6wIBAzEPMA0GCWCGSAFl # AwQCAQUAMIIBWQYLKoZIhvcNAQkQAQSgggFIBIIBRDCCAUACAQEGCisGAQQBhFkK # AwEwMTANBglghkgBZQMEAgEFAAQgVUSdPSd8nHM1QG8NkOD6+7qTcXwNOqw/FI+B # EepKSxQCBmHCS8FbYBgTMjAyMjAxMTMxMjU0MDQuNTE0WjAEgAIB9KCB2KSB1TCB # 0jELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl # ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMk # TWljcm9zb2Z0IElyZWxhbmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1U # aGFsZXMgVFNTIEVTTjo4NkRGLTRCQkMtOTMzNTElMCMGA1UEAxMcTWljcm9zb2Z0 # IFRpbWUtU3RhbXAgU2VydmljZaCCEWUwggcUMIIE/KADAgECAhMzAAABjAGXYkc2 # dmY7AAEAAAGMMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD # QSAyMDEwMB4XDTIxMTAyODE5Mjc0NFoXDTIzMDEyNjE5Mjc0NFowgdIxCzAJBgNV # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29m # dCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRT # UyBFU046ODZERi00QkJDLTkzMzUxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0 # YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDTSGhM # oRP5IaxrLD70EV2b65n6S8Q8Yt3mwXxeVPdTLhgapPzr4OvwbeTqr+VFqCLFEq+f # 6DYAVEv1W5moLW5O9rt1k30KGKi0ccWbLJBk9qVd0lMLycoituBMxcDCH+ZuGeah # rGwj2MaWK9iCLkY04Tu7pNXhQ62dU/yKiFNR80wqFlol3OZYOOFYLsuM9ciFqb1C # FGRXOuTF8kpzn0CxoYPc++JGSAegbF+l1Yc89pbyKIQeNzg8OYIqW5bcn4h1Tfwf # 4yQo+Z6QLsa1FMtcoEK5YpdLxONlj/CQ1zNY0Sj6Xknc5l0d5WKDGnMKd6yRl9wd # fGsJfaG57uom9auSwVK2Rls4bshiZp9gxCtka6WXvY+dLWgh1B1idHn+eBy9JBvX # UZDSQ0wPOIqxJ37mJ9RphsktnRcTE1XiotcJLrkOP7wXKAKO02+QOIHkez0jsr3P # FmxRvt8opIYRn3IDQmBNZtwA8Jg+24AdUnxQppP3rukmbv6veGBx7fxVTf2yl54c # eBoJLi9et6VMuJQwCXQ62TmdwpApzaQae+7A/ZEJLeQQQUDGifAufynJ53Kt5lNs # ExAGp/WjeSPSKU4nv9/8/dzWudpg7TUYMmia/ui2lvnP7WGtKgizy77p6u4koJOK # F3SL/xtzrsAoXvrCla69b0GFtQxOxaTDDivjZwIDAQABo4IBNjCCATIwHQYDVR0O # BBYEFJbOU4apgiFgiHlWnT6Iyt1Ai1IjMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl # 0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0 # LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAy # MDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93 # d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1T # dGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwEwYDVR0lBAww # CgYIKwYBBQUHAwgwDQYJKoZIhvcNAQELBQADggIBANdoxUVYwgmp1uVBkrqiSztx # 0JTB48CaYQh52zK6yBQwhCVCpqN8I/2IbnzI4VJHHaTn2PaEAFJkHEWZuRWPCFgQ # LXIk9Cb3jriBTPkb645bnWLy5554HeHaL4OahY0o1K6Ug3J9IaBbo8IMKJGo7eqf # wphXMvOh6Z8+Kv9RXHkICBVwQMAy3FtGtMdcEAFfIJrppDf6O6RYHlpDMvDqqEeH # Pscg5T2r9D1jY2dUEo9/MiXA+NvY2tAZ9CddOyx8UP3w6lEerTtlTHbWDimzxXfe # FJKQna4PCG2nlW0UacX4DHMUGUK9zfcs9OZexzOXLr7JCABHCY0d40DbrZaosskz # zgjPw5LVV8TU3rJgKQuODzX7MZeyO8waaMGWLLFnBdYZYmayi8HpPqHUat+a8wq5 # 04T3YPrtJHfNPcN0DknAv1MDNfxSGLRoZi2fm41QMVvEijMhEyktWk/9g4ueD6va # /yzyXJa/Rp+PBlgcEnrgxZU3Edxo22PORi1CN1nluHKRrp1f4O1AP1uHfOOLRKWt # 9UMgvERvo6PKq18aPuJZm8mtvgCohWAdBoPOC6LERL2J60WKQd9/qn3sLmqhtNNs # rA3QAQ/erm17Ij00g5WUmXSCLkht3nweJ/cks7q+n7nIdeOhIv8yWEWa8a1piZDA # PsrNOb24AMXgHM/+bHa/MIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAAAAAA # FTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0 # aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy # b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQADggIP # ADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2AX9s # SuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpSg0S3 # po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2rrPY2 # vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k45GP # sjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSueik3 # rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09/SDP # c31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR6L8F # A6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxCaC4Q # 6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaDIV1f # MHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMURHXLv # jflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMBAAGj # ggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQqp1L+ # ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ6XIw # XAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDov # L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMBMG # A1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsG # A1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP6KJc # YmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWljcm9z # b2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIz # LmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cubWlj # cm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3J0 # MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2Pk5H # ZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03dmLq2 # HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1TkeFN1 # JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kpicO8 # F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKpW99J # o3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrYUP4K # WN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QBjloZ # kWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkBRH58 # oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0ViY1w # /ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq0Z4+ # 7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1VM1iz # oXBm8qGCAtQwggI9AgEBMIIBAKGB2KSB1TCB0jELMAkGA1UEBhMCVVMxEzARBgNV # BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv # c29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3Bl # cmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjo4NkRGLTRC # QkMtOTMzNTElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIj # CgEBMAcGBSsOAwIaAxUANKLyFOur9DyimnB4bK5ks0Qmr9WggYMwgYCkfjB8MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy # b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIFAOWKczkw # IhgPMjAyMjAxMTMxNzQ1MjlaGA8yMDIyMDExNDE3NDUyOVowdDA6BgorBgEEAYRZ # CgQBMSwwKjAKAgUA5YpzOQIBADAHAgEAAgIK+jAHAgEAAgIRSzAKAgUA5YvEuQIB # ADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQow # CAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAIOiFJNf0lXzlv6rebTpR9r8utan # jlNyaZ5h1MWnryrIxqMBtXBMo6p556yzsQ1dga8Oha3s1c6QYvaXdRnMBBt4Sb/s # h+q+P464KOh9oXaUSn/iJ8v+zNYkK4MdW/An584u+z1G+p/si7xnNDcUZps+7beM # 8HvkwVPIY5XRS1nwMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMxEzARBgNV # BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv # c29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAg # UENBIDIwMTACEzMAAAGMAZdiRzZ2ZjsAAQAAAYwwDQYJYIZIAWUDBAIBBQCgggFK # MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgqSay # 4bD2D4kw5MKpgRSKpue3b1qsX6qgyVjUnrU7ibQwgfoGCyqGSIb3DQEJEAIvMYHq # MIHnMIHkMIG9BCDVrYv4FSqQzwZ/xOYhBZ2B4pNOthcjA6h864mIGJhpnjCBmDCB # gKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH # EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNV # BAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABjAGXYkc2dmY7 # AAEAAAGMMCIEIEsFzk/mHCws+XFm55spfMW5+JrDVKqmOAz1mPlH1G82MA0GCSqG # SIb3DQEBCwUABIICAG6e4qCnKSh/PkhiLG/p6zEntROHTdJhMho9XlAh2FvKinPN # DsmAFFgbyRhl8HCAMH+uA5yJYAieC1iA1er1sSfhhpmO+OgsAi4Rhh8cTv0insa0 # 2AMC9mamu3oWnQ3zIfu0iCS8gC9i9SZRvHXNcPGN/oxXFjcn7/8ugtw62FLjgvBe # i7ceSIk1NBgj0eolJS1jw/D//mkzzDrjJBTAOVumvz8qAlmmSW2WrThhIYBwPfvi # nPpYkoCUwMOa2cUuKkejX7dmkeNKqKxncbLW6JFr2JOLN7rxypgjjMkYga6jOTRa # S4zXR00Rg9O3CR+U7PsqTkSF+WN3lKpUdQMAYR/2+abuUZKSOnCEhJconUgySkQA # 34/7+Yvg7X4INeUMFqril2ILOddV8nDnuR42Zb1GUoEFHcST8sG6AD105TLlEtCW # /xRrduxwHcXeIIF+Tn2pUMjRB5Y1MeV2hS7rtAJolu+iaVf7E482MSId01urbQBX # MpbMqcl1vK6FdhNPchRvYF4XVnGAWp+z/KRJRAhZSLImSwbVtmCnZfMR1jbdGhng # i1AU/2teU5SHl7OL6qkaEi3gMjfxqcXNCJXWNW5WxqA5OzgsH3rmLwCxO3Q31ORy # RxaRBDHvSwgG1kd+uF9Q2pvRoLemAJ1ulHiS8kjaK3N5pBHF6r9K7CPdgWW1 # SIG # End signature block |