Microsoft.PowerPlatform.EnterprisePolicies

0.19.0

Private/AuthenticationOperations.ps1

                                <#

SAMPLE CODE NOTICE

THIS SAMPLE CODE IS MADE AVAILABLE AS IS. MICROSOFT MAKES NO WARRANTIES, WHETHER EXPRESS OR IMPLIED,

OF FITNESS FOR A PARTICULAR PURPOSE, OF ACCURACY OR COMPLETENESS OF RESPONSES, OF RESULTS, OR CONDITIONS OF MERCHANTABILITY.

THE ENTIRE RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS SAMPLE CODE REMAINS WITH THE USER.

NO TECHNICAL SUPPORT IS PROVIDED. YOU MAY NOT DISTRIBUTE THIS CODE UNLESS YOU HAVE A LICENSE AGREEMENT WITH MICROSOFT THAT ALLOWS YOU TO DO SO.

#>

function Connect-Azure {

    param(

        [Parameter(Mandatory, ParameterSetName = 'ByEndpoint')]

        [ValidateNotNullOrEmpty()]

        [PPEndpoint]$Endpoint,

        [Parameter(Mandatory, ParameterSetName = 'ByEnvironment')]

        [ValidateNotNullOrEmpty()]

        [AzureEnvironment] $AzureEnvironment,

        [Parameter(Mandatory=$false, ParameterSetName = 'ByEndpoint')]

        [Parameter(Mandatory=$false, ParameterSetName = 'ByEnvironment')]

        [string]$TenantId = $null,

        [Parameter(Mandatory=$false, ParameterSetName = 'ByEndpoint')]

        [Parameter(Mandatory=$false, ParameterSetName = 'ByEnvironment')]

        [string]$AuthScope = $null,

        [Parameter(Mandatory=$false, ParameterSetName = 'ByEndpoint')]

        [Parameter(Mandatory=$false, ParameterSetName = 'ByEnvironment')]

        [switch]$Force

    )

    if($PSCmdlet.ParameterSetName -eq 'ByEndpoint') {

        $AzureEnvironment = switch ($Endpoint) {

            ([PPEndpoint]::china) { "AzureChinaCloud" }

            ([PPEndpoint]::dod) { "AzureUSGovernment" }

            ([PPEndpoint]::usgovhigh) { "AzureUSGovernment" }

            Default { "AzureCloud" }

        }

    }

    # When re-authentication is not forced, honor a cached service principal auth

    # configuration and prioritize that flow over the default interactive login.

    if(-not($Force)) {

        $servicePrincipalConfig = Get-CachedServicePrincipalAuth

        if($null -ne $servicePrincipalConfig) {

            return Connect-AzureWithServicePrincipal -Config $servicePrincipalConfig -AzureEnvironment $AzureEnvironment -TenantId $TenantId

        }

    }

    $context = Get-AzContext -ListAvailable

    $foundContext = $false

    if(-not($Force) -and [string]::IsNullOrWhiteSpace($AuthScope) -and $null -ne $context) {

        if([string]::IsNullOrWhiteSpace($TenantId)) {

            $matchedContext = $context | Where-Object { $_.Environment.Name -eq $AzureEnvironment } | Select-Object -First 1

            if($matchedContext) {

                Set-AzContext -Context $matchedContext

                Write-Host "Already connected to Azure environment: $AzureEnvironment with account $($matchedContext.Account.Id) with tenants [$($matchedContext.Account.Tenants -join ",")]" -ForegroundColor Yellow

                $foundContext = $true

            }

        }

        else {

            # Prioritize the home tenant if it exists

            $homeTenantContext = $context | Where-Object { $_.Environment.Name -eq $AzureEnvironment -and $_.Tenant.TenantCategory -eq "Home" -and $_.Tenant.Id -eq $TenantId } | Select-Object -First 1

            if($homeTenantContext) {

                Set-AzContext -Context $homeTenantContext

                Write-Host "Already connected to Azure environment: $AzureEnvironment with account $($homeTenantContext.Account.Id) with home tenant Id $TenantId" -ForegroundColor Yellow

                $foundContext = $true

            }

            else {

                $tenantContext = $context | Where-Object { $_.Environment.Name -eq $AzureEnvironment -and $_.Account.Tenants -contains $TenantId } | Select-Object -First 1

                if ($tenantContext) {

                    Set-AzContext -Context $tenantContext

                    Write-Host "Already connected to Azure environment: $AzureEnvironment with account $($tenantContext.Account.Id) with tenant Id $TenantId" -ForegroundColor Yellow

                    $foundContext = $true

                }

            }

        }

    }

    if ($foundContext) {

        return $true

    }

    Write-Host "Logging In..." -ForegroundColor Green

    $connectParameters = @{

        Environment = $AzureEnvironment        

    }

    if(-not([string]::IsNullOrWhiteSpace($TenantId))) {

        $connectParameters['Tenant'] = $TenantId

    }

    if(-not([string]::IsNullOrWhiteSpace($AuthScope))) {

        $connectParameters['AuthScope'] = $AuthScope

    }

    $connect = Connect-AzAccount @connectParameters

    if ($null -eq $connect)

    {

        Write-Host "Error connecting to Azure Account" -ForegroundColor Red

        return $false

    }

    Write-Host "Logged In..." -ForegroundColor Green

    return $true

}

function Resolve-CertificateThumbprint {

    param(

        [Parameter(Mandatory)]

        [ValidateNotNullOrEmpty()]

        [string]$SubjectName

    )

    $stores = @("Cert:\CurrentUser\My", "Cert:\LocalMachine\My")

    foreach ($store in $stores) {

        $cert = Get-ChildItem -Path $store -ErrorAction SilentlyContinue |

            Where-Object { $_.Subject -eq $SubjectName -or $_.Subject -like "*CN=$SubjectName*" } |

            Sort-Object -Property NotAfter -Descending |

            Select-Object -First 1

        if ($null -ne $cert) {

            return $cert.Thumbprint

        }

    }

    throw "Could not find a certificate with subject name '$SubjectName' in the CurrentUser or LocalMachine 'My' store."

}

function Connect-AzureWithServicePrincipal {

    param(

        [Parameter(Mandatory)]

        [object]$Config,

        [Parameter(Mandatory)]

        [ValidateNotNullOrEmpty()]

        [string]$AzureEnvironment,

        [Parameter(Mandatory=$false)]

        [string]$TenantId = $null

    )

    $method = $Config.Method

    if ([string]::IsNullOrWhiteSpace($method)) {

        throw "Service principal auth configuration is missing the 'Method' property. Expected 'ManagedIdentity' or 'Certificate'."

    }

    $clientId = $Config.ClientId

    $effectiveTenantId = if (-not [string]::IsNullOrWhiteSpace($TenantId)) { $TenantId } else { $Config.TenantId }

    # Reuse an existing matching context when one is already available.

    $existingContexts = Get-AzContext -ListAvailable | Where-Object {

        $_.Environment.Name -eq $AzureEnvironment -and $_.Account.Id -eq $clientId

    }

    if (-not [string]::IsNullOrWhiteSpace($effectiveTenantId)) {

        $existingContexts = $existingContexts | Where-Object {

            $_.Tenant.Id -eq $effectiveTenantId -or $_.Account.Tenants -contains $effectiveTenantId

        }

    }

    $existingContext = $existingContexts | Select-Object -First 1

    if ($existingContext) {

        Set-AzContext -Context $existingContext

        Write-Host "Already connected to Azure environment: $AzureEnvironment with service principal $($existingContext.Account.Id)" -ForegroundColor Yellow

        return $true

    }

    $connectParameters = @{

        Environment = $AzureEnvironment

    }

    switch ($method) {

        "ManagedIdentity" {

            $connectParameters['Identity'] = $true

            if (-not [string]::IsNullOrWhiteSpace($clientId)) {

                $connectParameters['AccountId'] = $clientId

            }

            if (-not [string]::IsNullOrWhiteSpace($effectiveTenantId)) {

                $connectParameters['Tenant'] = $effectiveTenantId

            }

            Write-Host "Logging in with managed identity..." -ForegroundColor Green

        }

        "Certificate" {

            if ([string]::IsNullOrWhiteSpace($clientId)) {

                throw "Service principal auth configuration for 'Certificate' requires a 'ClientId'."

            }

            if ([string]::IsNullOrWhiteSpace($effectiveTenantId)) {

                throw "Service principal auth configuration for 'Certificate' requires a 'TenantId'."

            }

            $thumbprint = $Config.CertificateThumbprint

            if ([string]::IsNullOrWhiteSpace($thumbprint) -and -not [string]::IsNullOrWhiteSpace($Config.CertificateSubjectName)) {

                $thumbprint = Resolve-CertificateThumbprint -SubjectName $Config.CertificateSubjectName

            }

            if ([string]::IsNullOrWhiteSpace($thumbprint)) {

                throw "Service principal auth configuration for 'Certificate' requires either 'CertificateThumbprint' or 'CertificateSubjectName'."

            }

            $connectParameters['ServicePrincipal'] = $true

            $connectParameters['ApplicationId'] = $clientId

            $connectParameters['Tenant'] = $effectiveTenantId

            $connectParameters['CertificateThumbprint'] = $thumbprint

            Write-Host "Logging in with certificate-based service principal..." -ForegroundColor Green

        }

        default {

            throw "Unknown service principal auth method '$method'. Expected 'ManagedIdentity' or 'Certificate'."

        }

    }

    $connect = Connect-AzAccount @connectParameters

    if ($null -eq $connect) {

        Write-Host "Error connecting to Azure with service principal" -ForegroundColor Red

        return $false

    }

    Write-Host "Logged In..." -ForegroundColor Green

    return $true

}

function Get-PPAccessToken {

    param(

        [Parameter(Mandatory)]

        [ValidateNotNullOrEmpty()]

        [PPEndpoint]$Endpoint,

        [Parameter(Mandatory=$false)]

        [string]$TenantId = $null

    )

    $resourceUrl = Get-PPResourceUrl -Endpoint $Endpoint

    return Get-AccessToken -Endpoint $Endpoint -ResourceUrl $resourceUrl -TenantId $TenantId

}

function Get-PPAPIAccessToken {

    param(

        [Parameter(Mandatory)]

        [ValidateNotNullOrEmpty()]

        [PPEndpoint]$Endpoint,

        [Parameter(Mandatory=$false)]

        [string]$TenantId = $null

    )

    $resourceUrl = Get-APIResourceUrl -Endpoint $Endpoint

    return Get-AccessToken -Endpoint $Endpoint -ResourceUrl $resourceUrl -TenantId $TenantId

}

function Get-AccessToken {

    param(

        [Parameter(Mandatory)]

        [ValidateNotNullOrEmpty()]

        [PPEndpoint]$Endpoint,

        [Parameter(Mandatory)]

        [ValidateNotNullOrEmpty()]

        [string]$ResourceUrl,

        [Parameter(Mandatory=$false)]

        [string]$TenantId = $null

    )

    $token = Get-AzAccessToken -ResourceUrl $resourceUrl -AsSecureString -ErrorAction SilentlyContinue

    if ($null -eq $token) {

        $tokenError = $global:Error[0]

        if($tokenError.Exception.AuthenticationErrorCode -eq "failed_to_acquire_token_silently_from_broker")

        {

            Write-Host "Failed to acquire token silently. Please log in interactively." -ForegroundColor Red

            Connect-Azure -AuthScope $resourceUrl -Endpoint $Endpoint -TenantId $TenantId

        }

        elseif($null -ne $tokenError.Exception.AuthenticationErrorCode)

        {

            Write-Host "Failed to acquire access token: $($tokenError.Exception.AuthenticationErrorCode)" -ForegroundColor Red

            Connect-Azure -AuthScope $resourceUrl -Endpoint $Endpoint -TenantId $TenantId -Force

        }

        else {

            Write-Host "Failed to acquire access token: $($tokenError.Exception.Message)" -ForegroundColor Red

            Connect-Azure -AuthScope $resourceUrl -Endpoint $Endpoint -TenantId $TenantId -Force

        }

        $token = Get-AzAccessToken -ResourceUrl $resourceUrl -AsSecureString

        if($null -eq $token) {

            throw "Failed to acquire access token. Please check your Azure login and try again."

        }

    }

    return $token.Token

}

function ConvertFrom-SecureStringInternal {

    param (

        [Parameter(Mandatory)]

        [System.Security.SecureString]$SecureString

    )

    try{

        $ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecureString)

        $plainText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)

        return $plainText

    }

    catch {

        throw "Failed to convert SecureString to plain text: $_"

    }

    finally {

        if ($ptr) {

            [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)

        }

    }

}

# SIG # Begin signature block

# MIInbgYJKoZIhvcNAQcCoIInXzCCJ1sCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCeydohT2+U3yHp

# c828cX04jOI7DEUmSfa6cYzaNla1X6CCDMkwggYEMIID7KADAgECAhMzAAACHPrN

# xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD

# b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1

# OTQxWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYD

# VQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IB

# DwAwggEKAoIBAQDVsZfgOKmM31HPfoWOoNEiw0SlCiIxUMC0I9NMWbucKOw/e9lP

# oAoehQVu6SG65V4EPzrYsnBnFPNoi4/HoOdjhz1qkrEt4I6tEcxXU6oOeY9zGveC

# /3iBeuhLYxM3M/PkcUoebF+Nednm8OkdSPoDu8imViHPQq/8CQUu0WRR4rE+dMRf

# rpVqfmNi2qWCX94T4MsepijGVkwE//tJg0ryAiYdHT34LSnlG/RSBZmQRGWZ5g8j

# qnKjRParSqMft1gvjuUTVgtWNZfgcLFSK5Wa0myrq8OPcgTGGsRgun+tnSS+IxDT

# xVsAPH1OzvPjwomguByhUe/OcvUN0D5Wmp7xAgMBAAGjggGqMIIBpjAOBgNVHQ8B

# Af8EBAMCB4AwHwYDVR0lBBgwFgYKKwYBBAGCN0wIAQYIKwYBBQUHAwMwHQYDVR0O

# BBYEFNoH7a2YDjOSwpkp6DHcmUS7J+0yMFQGA1UdEQRNMEukSTBHMS0wKwYDVQQL

# EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxFjAUBgNVBAUT

# DTIzMDAxMis1MDc1NjkwHwYDVR0jBBgwFoAUf1k/VCHarU/vBeXmo9ctBpQSCDEw

# YAYDVR0fBFkwVzBVoFOgUYZPaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9w

# cy9jcmwvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmclMjBQQ0ElMjAyMDI0LmNy

# bDBtBggrBgEFBQcBAQRhMF8wXQYIKwYBBQUHMAKGUWh0dHA6Ly93d3cubWljcm9z

# b2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQ29kZSUyMFNpZ25pbmcl

# MjBQQ0ElMjAyMDI0LmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IC

# AQAUnEqhaRXe0T3hIJjvdQErEkrA/7bByjn6t5IArODkkRjzkYwtKMc2yYj2quaN

# rLutWw2YZcngKPy1b71YyDJQTy4NDRwaSh9Tw5thrk3NmcPrAHia5vtcBJ1CgtKK

# 7mQbIcQ22d/N3813ayCDDFewu1+jsZmX+r/aTEqaOM4TVxVtRSkuCy8nAXKuChOK

# Li/zA4XuH8iEYqIsj2YoNaeSxVmeGiERXpKdo3dDmYi0kO5w2D8VS4c3+9h6gElY

# BaAAg/dYErBg27qT3vv0zRDJhJufvCNylA8S7/+8H5E/PV5cng6na9VV/w9OV3qu

# uND6zdGa2EX38Glp50F9AIQk3p2xXmcvorDeM4XJ7UlWYBi6g80J1SSOQnInCYFE

# msfUNn3+1AaTJKSJL83quKArTac2pKhu0Yzzzrzo6HrsRiQKzpnRBb1/dMa6P3hz

# 75XbMRBctNsFhZC07WCmjExdLg2eHW5uV0TY8D5+6wozJf7vF3+WHkYPO85Z+BC6

# U4FkNbYNycZ9cE4j1tXRdyDCfml6c0HWPHjNVDObrv9lKt3qUqFpX38VCqVCyNOO

# 1UcXfQiVjJw32U2WUKZjt/neJKHEBsm9kFsLuWzkQ53+qcaSaytmsCnk2gOglrlD

# 5d3kKyvvAw+rzm0lT8K38P6PLxfZQHhu4W8dV7Av8N2ZmDCCBr0wggSloAMCAQIC

# EzMAAAA5O7Y3Gb8GHWcAAAAAADkwDQYJKoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYT

# AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS

# b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDExMB4XDTI0MDgwODIwNTQxOFoX

# DTM2MDMyMjIyMTMwNFowVzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m

# dCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9zb2Z0IENvZGUgU2lnbmluZyBQ

# Q0EgMjAyNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANgBnB7jOMeq

# lRYHNa265v4IY9fH8TKhemHfPINe1gpLaV3dhg324WwH06LcHbpnsBukCDNitryo

# 0dtS/EW6I/yEL/bLSY8hKpbfQuWusBPr9qazYcDxCW/qnjb5JsI1s8bNOg3bVATv

# QVL4tcf03aTycsz8QeCdM0l/yHRObJ9QqazM1r6VPEOJ7LL+uEEb73w6QCuhs89a

# 1uv1zerOYMnsneRRwCbpyW11IcggU0cRKDDq1pjVJzIbIF6+oiXXbReOsgeI8zu1

# FyQfK0fVkaya8SmVHQ/tOf23mZ4W9k0Ri22QW9p3UgSC5OUDktKxxcCmGL6tXLfO

# GSWHIIV4YrTJTT6PNty5REojHJuZHArkF9VnHTERWoTjAzfI3kP+5b4alUdhgAZ7

# ttOu1bVnXfHaqPYl2rPs20ji03LOVWsh/radgE17es5hL+t6lV0eVHrVhsssROWJ

# uz2MXMCt7iw7lFPG9LXKGjsmonn2gotGdHIuEg5JnJMJVmixd5LRlkmgYRZKzhxS

# CwyoGIq0PhaA7Y+VPct5pCHkijcIIDm0nlkK+0KyepolcqGm0T/GYQRMhHJlGOOm

# VQop36wUVUYklUy++vDWeEgEo4s7hxN6mIbf2MSIQ/iIfMZgJxC69oukMUXCrOC3

# SkE/xIkgpfl22MM1itkZ35nNXkMolU1lAgMBAAGjggFOMIIBSjAOBgNVHQ8BAf8E

# BAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFH9ZP1Qh2q1P7wXl5qPX

# LQaUEggxMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMB

# Af8wHwYDVR0jBBgwFoAUci06AjGQQ7kUBU7h6qfHMdEjiTQwWgYDVR0fBFMwUTBP

# oE2gS4ZJaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv

# TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNybDBeBggrBgEFBQcBAQRSMFAw

# TgYIKwYBBQUHMAKGQmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMv

# TWljUm9vQ2VyQXV0MjAxMV8yMDExXzAzXzIyLmNydDANBgkqhkiG9w0BAQwFAAOC

# AgEAFJQfOChP7onn6fLIMKrSlN1WYKwDFgAddymOUO3FrM8d7B/W/iQ6DxXsDn7D

# 5W4wMwYeLystcEqfkjz4NURRgazyMu5yRzQh4LqjA4tStTcJh1opExo7nn5PuPBY

# nbu0+THSuVHTe0VTTPVhily/piFrDo3axQ9P4C+Ol5yet+2gTfekICS5xS+cYfSI

# vgn0JksVBVMYVI5QFu/qhnLhsEFEUzG8fvv0hjgkO+lkpV9ty6GkN4vdnd7ya6Q6

# aR9y34aiM1qmxaxBi6OUnyNl6fkuun/diTFnYDLTppOkr/mg5WSfCiDVMNCxtj4w

# PKC5OmHm1DQIt/MNokbbH3UGsFP1QbzsLocuSqLCvH09Io3fDPTmscR9Y75G4qX7

# RTX8AdBPo0I6OEojf39zuFZt0qOHm65YWQE69cZM2ueE1MB05dNNgHK9gTE7zKvK

# /fg8B2qjW88MT/WF5V5uvZGtqa9FSL2RazArA+rDPuf6JGYz4HpgMZHB4S6szWSK

# YBv0VisCzfxgeU+dquXW9bd0auYlOB58DPcOYKdc3Se94g+xL4pcEhbB54JOgAkw

# YTu/9dLeH2pDqeJZAABVDWRQCaXfO5LgyKwKCLYXpigrZYCjUSBcr+Ve8PFWMhVT

# Ql0v4q8J/AUmQN5W4n101cY2L4A7GTQG1h32HHAvfQESWP0xghn7MIIZ9wIBATBu

# MFcxCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x

# KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc

# +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwG

# CisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZI

# hvcNAQkEMSIEILNFleENbeSMlS+g7iOwLlZqcW1J3pcmoIyEW+QShpPMMEIGCisG

# AQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3

# Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAhi83qHrbbIbaq+jAk4qS

# MXqhViVrjYy2gieKzo6ARk1KdTHdzlkTwJMO+6BcXTxEXZG3l/YJ1CrGfhCqIH15

# cbjA33Py23J1XSLwCs0y8P3UfvxRT1FSqtF44+gZ7UQhVYClZS0vY/EvG775zMPf

# ytv6MDO9p3o9pE6PP+cMEmGKMr7fuMQ3AS0WlnlgUJBGkrzrhal3awDzMdmWtQUE

# wfOW1msxqyLdQKcHAY4vJqbH6DFVACKh9jmDPbp5eAZmYZDSn35Y+UffCRp+zguF

# XLI+YNmesvmzmoOPK6qnVSKQie12j3H9ovrX5nPsSz/DaqxAkpJXIw3Ho7RdZXoI

# haGCF60wghepBgorBgEEAYI3AwMBMYIXmTCCF5UGCSqGSIb3DQEHAqCCF4YwgheC

# AgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG9w0BCRABBKCCAUkEggFFMIIB

# QQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCAZUmFQNbsZH69CCbJn

# zix9P20Y+Fk210xNdLL/2oQQygIGamOFlKTiGBMyMDI2MDgwMzE0MzUxMi4xODJa

# MASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv

# bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0

# aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0

# ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo0QzFBLTA1RTAtRDk0NzElMCMG

# A1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEfswggcoMIIFEKAD

# AgECAhMzAAACGCXZkgXi5+XkAAEAAAIYMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNV

# BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w

# HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m

# dCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgyNVoXDTI2MTExMzE4

# NDgyNVowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD

# VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTAr

# BgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEnMCUG

# A1UECxMeblNoaWVsZCBUU1MgRVNOOjRDMUEtMDVFMC1EOTQ3MSUwIwYDVQQDExxN

# aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEAsdzo6uuQJqAfxLnvEBfIvj6knK+p6bnMXEFZ/QjPOFywlcjD

# fzI8Dg1nzDlxm7/pqbvjWhyvazKmFyO6qbPwClfRnI57h5OCixgpOOCGJJQIZSTi

# Mgui3B8DPiFtJPcfzRt3FsnxjLXwBIjGgnjGfmQl7zejA1WoYL/qBmQhw/FDFTWe

# bxfo4m0RCCOxf2qwj31aOjc2aYUePtLMXHsXKPFH0tp5SKIF/9tJxRSg0NYEvQqV

# ilje8aQkPd3qzAux2Mc5HMSK4NMTtVVCYAWDUZ4p+6iDI9t5BNCBIsf5ooFNUWtx

# CqnpFYiLYkHfFfxhVUBZ8LGGxYsA36snD65s2Hf4t86k0e8WelH/usfhYqOM3z2y

# aI8rg08631IkwqUzyQoEPqMsHgBem1xpmOGSIUnVvTsAv+lmECL2RqrcOZlZax8K

# 0aiij8h6UkWBN2IA/ikackTSGVRBQmWWZuLFWV/T4xuNzscC0X7xo4fetgpsqaEA

# 0jY/QevkTvLv4OlNN9eOL8LNh7Vm0R65P7oabOQDqtUFAwCgjgPJ0iV/jQCaMAcO

# 3SYpG5wSAYiJkk4XLjNSlNxU2Idjs1sORhl7s7LC6hOb7bVAHVwON74GxfFNiEIA

# 6BfudANjpQJ0nUc/ppEXpT4pgDBHsYtV8OyKSjKsIxOdFR7fIJIjDc8DvUkCAwEA

# AaOCAUkwggFFMB0GA1UdDgQWBBQkLqHEXDobY7dHuoQCBa4sX7aL0TAfBgNVHSME

# GDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5odHRw

# Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUaW1l

# LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsG

# AQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01p

# Y3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMB

# Af8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIHgDAN

# BgkqhkiG9w0BAQsFAAOCAgEAnkjRhjwPgdoIpvt4YioT/j0LWuBxF3ARBKXDENgg

# raKvC0oRPwbjAmsXnPEmtuo5MD8uJ9Xw9eYrxqqkK4DF9snZMrHMfooxCa++1irL

# z8YoozC4tci+a4N37Sbke1pt1xs9qZtvkPgZGWn5BcwVfmAwSZLHi2CuZ06Y0/X+

# t6fNBnrbMVovNaDX4WPdyI9GEzxfIggDsck2Ipo4VXL/Arcz7p2F7bEZGRuyxjgM

# C+woCkDJaH/yk/wcZpAsixe4POdN0DW6Zb35O3Dg3+a6prANMc3WIdvfKDl75P0a

# qcQbQAR7b0f4gH4NMkUct0Wm4GN5KhsE1YK7V/wAqDKmK4jx3zLz3a8Hsxa9HB3G

# yitlmC5sDhOl4QTGN5kRi6oCoV4hK+kIFgnkWjHhSRNomz36QnbCSG/BHLEm2GRU

# 9u3/I4zUd9E1AC97IJEGfwb+0NWb3QEcrkypdGdWwl0LEObhrQR9B1V7+edcyNms

# X0p2BX0rFpd1PkXJSbxf8IcEiw/bkNgagZE+VlDtxXeruLdo5k3lGOv7rPYuOEao

# ZYxDvZtpHP9P36wmW4INjR6NInn2UM+krP/xeLnRbDBkm9RslnoDhVraliKDH62B

# xhcgL9tiRgOHlcI0wqvVWLdv8yW8rxkawOlhCRqT3EKECW8ktUAPwNbBULkT+oWc

# vBcwggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3DQEB

# CwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE

# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD

# VQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAxMDAe

# Fw0yMTA5MzAxODIyMjVaFw0zMDA5MzAxODMyMjVaMHwxCzAJBgNVBAYTAlVTMRMw

# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN

# aWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0

# YW1wIFBDQSAyMDEwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5OGm

# TOe0ciELeaLL1yR5vQ7VgtP97pwHB9KpbE51yMo1V/YBf2xK4OK9uT4XYDP/XE/H

# ZveVU3Fa4n5KWv64NmeFRiMMtY0Tz3cywBAY6GB9alKDRLemjkZrBxTzxXb1hlDc

# wUTIcVxRMTegCjhuje3XD9gmU3w5YQJ6xKr9cmmvHaus9ja+NSZk2pg7uhp7M62A

# W36MEBydUv626GIl3GoPz130/o5Tz9bshVZN7928jaTjkY+yOSxRnOlwaQ3KNi1w

# jjHINSi947SHJMPgyY9+tVSP3PoFVZhtaDuaRr3tpK56KTesy+uDRedGbsoy1cCG

# MFxPLOJiss254o2I5JasAUq7vnGpF1tnYN74kpEeHT39IM9zfUGaRnXNxF803RKJ

# 1v2lIH1+/NmeRd+2ci/bfV+AutuqfjbsNkz2K26oElHovwUDo9Fzpk03dJQcNIIP

# 8BDyt0cY7afomXw/TNuvXsLz1dhzPUNOwTM5TI4CvEJoLhDqhFFG4tG9ahhaYQFz

# ymeiXtcodgLiMxhy16cg8ML6EgrXY28MyTZki1ugpoMhXV8wdJGUlNi5UPkLiWHz

# NgY1GIRH29wb0f2y1BzFa/ZcUlFdEtsluq9QBXpsxREdcu+N+VLEhReTwDwV2xo3

# xwgVGD94q0W29R6HXtqPnhZyacaue7e3PmriLq0CAwEAAaOCAd0wggHZMBIGCSsG

# AQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYEFCqnUv5kxJq+gpE8RjUpzxD/

# LwTuMB0GA1UdDgQWBBSfpxVdAF5iXYP05dJlpxtTNRnpcjBcBgNVHSAEVTBTMFEG

# DCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jvc29m

# dC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wEwYDVR0lBAwwCgYIKwYB

# BQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMA8G

# A1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186aGMQw

# VgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9j

# cmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsGAQUF

# BwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Br

# aS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwDQYJKoZIhvcNAQEL

# BQADggIBAJ1VffwqreEsH2cBMSRb4Z5yS/ypb+pcFLY+TkdkeLEGk5c9MTO1OdfC

# cTY/2mRsfNB1OW27DzHkwo/7bNGhlBgi7ulmZzpTTd2YurYeeNg2LpypglYAA7AF

# vonoaeC6Ce5732pvvinLbtg/SHUB2RjebYIM9W0jVOR4U3UkV7ndn/OOPcbzaN9l

# 9qRWqveVtihVJ9AkvUCgvxm2EhIRXT0n4ECWOKz3+SmJw7wXsFSFQrP8DJ6LGYnn

# 8AtqgcKBGUIZUnWKNsIdw2FzLixre24/LAl4FOmRsqlb30mjdAy87JGA0j3mSj5m

# O0+7hvoyGtmW9I/2kQH2zsZ0/fZMcm8Qq3UwxTSwethQ/gpY3UA8x1RtnWN0SCyx

# TkctwRQEcb9k+SS+c23Kjgm9swFXSVRk2XPXfx5bRAGOWhmRaw2fpCjcZxkoJLo4

# S5pu+yFUa2pFEUep8beuyOiJXk+d0tBMdrVXVAmxaQFEfnyhYWxz/gq77EFmPWn9

# y8FBSX5+k77L+DvktxW/tM4+pTFRhLy/AsGConsXHRWJjXD+57XQKBqJC4822rpM

# +Zv/Cuk0+CQ1ZyvgDbjmjJnW4SLq8CdCPSWU5nR0W2rRnj7tfqAxM328y+l7vzhw

# RNGQ8cirOoo6CGJ/2XBjU02N7oJtpQUQwXEGahC0HVUzWLOhcGbyoYIDVjCCAj4C

# AQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv

# bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0

# aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0

# ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo0QzFBLTA1RTAtRDk0NzElMCMG

# A1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsOAwIa

# AxUAnWtGrXWiuNE8QrKfm4CtGr57z+mggYMwgYCkfjB8MQswCQYDVQQGEwJVUzET

# MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV

# TWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1T

# dGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIFAO4aiX0wIhgPMjAyNjA4MDMw

# MzI5MDFaGA8yMDI2MDgwNDAzMjkwMVowdDA6BgorBgEEAYRZCgQBMSwwKjAKAgUA

# 7hqJfQIBADAHAgEAAgIOXjAHAgEAAgISnTAKAgUA7hva/QIBADA2BgorBgEEAYRZ

# CgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYagMA0G

# CSqGSIb3DQEBCwUAA4IBAQBmv80PjLPKGF82iVOmlW2VbYF9uPdCCHPN0yqMzFFg

# CJ1fLFe/Quu6uzR5iBJE7jfZk8d1EPfjuXr3wwVs7UsL3u1o/kR5eic4N4WQIQST

# h0KCnHdoDZ7kj+VjJ1k44z78iPH9ZWQ1d9uC+zwNX0n2zVPftGwif/zxHZBBoAQT

# L1IkYp8lW/2z7uwT1tMbojpTs4hlWhiC5zLf+OLg5t6BNgt+eVIZenZ7zkjJc9/R

# NPbnEN9ou6yQhD1dOpD7t8FBCQsXR8VE9dt0OwewpP1LLh1itybJPyABudbjd/Ej

# XS9vezO9+mpdlsxP/dndfgmGx4YTqYv7nWhEX+HKReauMYIEDTCCBAkCAQEwgZMw

# fDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1Jl

# ZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMd

# TWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIYJdmSBeLn5eQAAQAA

# AhgwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRAB

# BDAvBgkqhkiG9w0BCQQxIgQgS+tBvDRHGofvd6dMcK8jdJwcUsmZUNvd22hUaSNx

# IUEwgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCCZE9yJuOTItIwWaES6lzGK

# K1XcSoz1ynRzaOVzx9eFajCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI

# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv

# ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD

# QSAyMDEwAhMzAAACGCXZkgXi5+XkAAEAAAIYMCIEICZUhkhpAQl+0OzfpJR3rkN2

# HdHEQn99MVqtAb8faWqSMA0GCSqGSIb3DQEBCwUABIICAEQ3UFnS12fvvGtd+bdi

# a/ytfP9/uhMdYFhtJOTiizcOnj/0vWYjlyS5cPU3C9ZmeSakE7G5MRTlgVp8ddVn

# 4/rGgRWtlYM+Q8X6ghxrv5F0TYY/5+/b+YCLJrCb/0hy9EodASbr7zp1FTYjeX/r

# WS1kVjx+PQLwAuPy0eUnqMN3qx9G9j/6UZ5gkyqzwOzABzUeYhcfUVn2TFY+GKUF

# yuByAGno2YhQ/AF5XlEV2E3HjMUOgbAlh6IquQ/4NC8OAow5sn9LQQcBqhQ7Brdf

# c9Lh+67YWMH4ozDCwcU4olr/8+FRP/WEOI0sKXz9sGUHfbzLGeS25AzIxIm6dAkc

# MFWJavC0x2yocInPUtjdTwmRbW5wzubxEecJuVK1uFmxH0Air/FP7axoTdkBz9lY

# QgJotLMwd10jmxwUrQVygczC1u10aQMeBSciLJvlZVBbbHbBgqFAo/44x80TSYZH

# A19G4mQRl/gVHybook09tDUusk9AMJ0nPjOlyTNOicjIl8B8O+USTBxY73UMLg3e

# cLvVCdmPuhnppxRPbPssPB/G/hdizqxVWJ9l008KukrUNjs30UArGEuFZjLvzZlM

# TfqUT/26XvHO5XKm99pm5yWEjWnRup8SNH/Ho2zURzQI24zQaFwmyfe2eVBPZiB+

# 4+nQy3haRzcLKldMSD7LgQD3

# SIG # End signature block