PowerCommander

1.1.6

PAM/Gateway.ps1

#requires -Version 5.1

function script:formatPamTimestamp {
    Param ([long] $TimestampMs)
    if ($TimestampMs -le 0) { return '' }
    return [DateTimeOffset]::FromUnixTimeMilliseconds($TimestampMs).LocalDateTime.ToString('yyyy-MM-dd HH:mm:ss')
}

function script:getPamRouterHost {
    $routerUrl = [Environment]::GetEnvironmentVariable('ROUTER_URL')
    if (-not [string]::IsNullOrWhiteSpace($routerUrl)) {
        return $routerUrl.TrimEnd('/')
    }

    $auth = $Script:Context.Auth
    if (-not $auth -or -not $auth.Endpoint) { return $null }

    $server = $auth.Endpoint.Server
    if ([string]::IsNullOrWhiteSpace($server)) { return $null }

    $uri = $null
    if ([Uri]::TryCreate($server, [UriKind]::Absolute, [ref]$uri)) {
        $server = $uri.Host
    }
    return "https://connect.$server"
}

function script:resolvePamKsmApplication {
    Param (
        [Parameter(Mandatory = $true)][KeeperSecurity.Vault.VaultOnline] $Vault,
        [Parameter(Mandatory = $true)][string] $Identifier
    )

    $trimmed = $Identifier.Trim()
    if ([string]::IsNullOrWhiteSpace($trimmed)) {
        throw (New-Object KeeperSecurity.Plugins.PAM.PamGatewayException('--application is required'))
    }

    $applications = @($Vault.KeeperRecords | Where-Object { $null -ne $_ -and $_.Type -eq 'app' })

    foreach ($app in $applications) {
        if ([string]::Equals($app.Uid, $trimmed, [System.StringComparison]::OrdinalIgnoreCase)) {
            return $app
        }
    }

    $byTitle = @($applications | Where-Object {
            [string]::Equals($_.Title, $trimmed, [System.StringComparison]::OrdinalIgnoreCase)
        })
    if ($byTitle.Count -gt 1) {
        throw (New-Object KeeperSecurity.Plugins.PAM.PamGatewayAmbiguousException($trimmed))
    }
    if ($byTitle.Count -eq 1) {
        return $byTitle[0]
    }

    throw (New-Object KeeperSecurity.Plugins.PAM.PamApplicationNotFoundException($trimmed))
}

function script:resolvePamSingleGatewayController {
    Param (
        [Parameter(Mandatory = $true)][object] $Plugin,
        [Parameter(Mandatory = $true)][string] $Identifier
    )

    $controller = resolvePamGatewayController -Plugin $Plugin -Identifier $Identifier
    if (-not $controller) {
        throw (New-Object KeeperSecurity.Plugins.PAM.PamGatewayNotFoundException($Identifier.Trim()))
    }
    return $controller
}

function script:invokePamGatewayMutation {
    Param (
        [Parameter(Mandatory = $true)][scriptblock] $Action,
        [Parameter(Mandatory = $true)][string] $FailureMessage,
        [Parameter(Mandatory = $true)][object] $Plugin
    )

    try {
        & $Action
    }
    catch [KeeperSecurity.Plugins.PAM.PamException] {
        throw
    }
    catch {
        throw (New-Object KeeperSecurity.Plugins.PAM.PamGatewayException("$FailureMessage $($_.Exception.Message)", $_.Exception))
    }

    [void](syncPamPlugin -Plugin $Plugin -Reload $false -ThrowOnError $false)
}

function script:handlePamRouterUnavailable {
    Param (
        [ref] $RouterDown,
        [bool] $Force
    )

    $RouterDown.Value = $true
    if (-not $Force) {
        Write-Output 'Router is unavailable. Use -Force to list registered gateways without online status.'
        return $false
    }

    Write-Output 'Router is unavailable. Showing registered gateways with UNKNOWN status.'
    return $true
}

function script:buildPamGatewayJsonItem {
    Param (
        [Parameter(Mandatory = $true)][object] $Summary,
        [bool] $VerboseOutput
    )

    $controller = $Summary.Controller
    $item = [ordered]@{
        ksm_app_name       = if ($Summary.KsmAppAccessible) { $Summary.KsmAppName } else { $null }
        ksm_app_uid        = $Summary.KsmAppUid
        ksm_app_accessible = $Summary.KsmAppAccessible
        gateway_name       = $controller.ControllerName
        gateway_uid        = $controller.ControllerUid
        status             = $Summary.Status
        gateway_version    = $Summary.GatewayVersion
    }

    if ($Summary.OnlineInstanceCount -gt 1) {
        $instances = New-Object 'System.Collections.Generic.List[object]'
        $index = 1
        foreach ($instance in $Summary.OnlineInstances) {
            $instanceItem = [ordered]@{
                instance_number = $index
                status          = [KeeperSecurity.Plugins.PAM.PamGatewayStatus]::Online
                gateway_version = $instance.Version
                ip_address      = $instance.IpAddress
                connected_on    = formatPamTimestamp $instance.ConnectedOn
            }
            if ($VerboseOutput) {
                $instanceItem.os = $instance.SystemInfo.Os
                $instanceItem.os_release = $instance.SystemInfo.OsRelease
                $instanceItem.machine_type = $instance.SystemInfo.MachineType
                $instanceItem.os_version = $instance.SystemInfo.OsVersion
            }
            $instances.Add([PSCustomObject]$instanceItem)
            $index++
        }
        $item.instances = $instances
    }

    if ($VerboseOutput) {
        $item.device_name = $controller.DeviceName
        $item.device_token = $controller.DeviceToken
        $item.created_on = formatPamTimestamp $controller.Created
        $item.last_modified = formatPamTimestamp $controller.LastModified
        $item.node_id = $controller.NodeId

        if ($Summary.OnlineInstanceCount -le 1) {
            $item.os = $Summary.SystemInfo.Os
            $item.os_release = $Summary.SystemInfo.OsRelease
            $item.machine_type = $Summary.SystemInfo.MachineType
            $item.os_version = $Summary.SystemInfo.OsVersion
        }
    }

    return [PSCustomObject]$item
}

function script:getPamGatewayTableRows {
    Param (
        [Parameter(Mandatory = $true)][object[]] $Summaries,
        [bool] $VerboseOutput
    )

    $rows = New-Object 'System.Collections.Generic.List[object]'
    foreach ($summary in $Summaries) {
        $controller = $summary.Controller
        $ksmApp = if ($summary.KsmAppAccessible) {
            "$($summary.KsmAppName) ($($summary.KsmAppUid))"
        }
        else {
            "[APP NOT ACCESSIBLE OR DELETED] ($($summary.KsmAppUid))"
        }

        $isPool = $summary.OnlineInstanceCount -gt 1
        $gatewayVersion = if ($isPool) { '' } else { $summary.GatewayVersion }

        if ($VerboseOutput) {
            $systemInfo = if ($isPool) {
                New-Object KeeperSecurity.Plugins.PAM.PamGatewaySystemInfo
            }
            else {
                $summary.SystemInfo
            }
            $rows.Add([PSCustomObject]@{
                    'KSM Application Name (UID)' = $ksmApp
                    'Gateway Name'                 = $controller.ControllerName
                    'Gateway UID'                  = $controller.ControllerUid
                    'Status'                       = $summary.Status
                    'Gateway Version'              = $gatewayVersion
                    'Device Name'                  = $controller.DeviceName
                    'Device Token'                 = $controller.DeviceToken
                    'Created On'                   = (formatPamTimestamp $controller.Created)
                    'Last Modified'                = (formatPamTimestamp $controller.LastModified)
                    'Node ID'                      = $controller.NodeId
                    'OS'                           = $systemInfo.Os
                    'OS Release'                   = $systemInfo.OsRelease
                    'Machine Type'                 = $systemInfo.MachineType
                    'OS Version'                   = $systemInfo.OsVersion
                })
        }
        else {
            $rows.Add([PSCustomObject]@{
                    'KSM Application Name (UID)' = $ksmApp
                    'Gateway Name'                 = $controller.ControllerName
                    'Gateway UID'                  = $controller.ControllerUid
                    'Status'                       = $summary.Status
                    'Gateway Version'              = $gatewayVersion
                })
        }

        if ($summary.OnlineInstanceCount -gt 1) {
            $index = 1
            foreach ($instance in $summary.OnlineInstances) {
                $connectedOn = formatPamTimestamp $instance.ConnectedOn
                if ($VerboseOutput) {
                    $rows.Add([PSCustomObject]@{
                            'KSM Application Name (UID)' = ''
                            'Gateway Name'                 = " |- Instance $index (connected: $connectedOn)"
                            'Gateway UID'                  = $instance.IpAddress
                            'Status'                       = [KeeperSecurity.Plugins.PAM.PamGatewayStatus]::Online
                            'Gateway Version'              = $instance.Version
                            'Device Name'                  = ''
                            'Device Token'                 = ''
                            'Created On'                   = $connectedOn
                            'Last Modified'                = ''
                            'Node ID'                      = ''
                            'OS'                           = $instance.SystemInfo.Os
                            'OS Release'                   = $instance.SystemInfo.OsRelease
                            'Machine Type'                 = $instance.SystemInfo.MachineType
                            'OS Version'                   = $instance.SystemInfo.OsVersion
                        })
                }
                else {
                    $rows.Add([PSCustomObject]@{
                            'KSM Application Name (UID)' = ''
                            'Gateway Name'                 = " |- Instance $index (connected: $connectedOn)"
                            'Gateway UID'                  = $instance.IpAddress
                            'Status'                       = [KeeperSecurity.Plugins.PAM.PamGatewayStatus]::Online
                            'Gateway Version'              = $instance.Version
                        })
                }
                $index++
            }
        }
    }
    return $rows
}

function Get-KeeperPamGatewayList {
    <#
        .Synopsis
        List PAM gateways.

        .Description
        Lists registered PAM gateways with online status from the router when available.

        .Parameter Force
        List registered gateways when the router is unavailable. Alias: -f.

        .Parameter VerboseOutput
        Show verbose gateway and router details.

        .Parameter Format
        Output format: {table,json}.

        .Parameter Online
        Show only online gateways. Alias: -o.

        .Example
        Get-KeeperPamGatewayList
        Get-KeeperPamGatewayList -Online -Format json -VerboseOutput
        Get-KeeperPamGatewayList -Force
    #>
    [CmdletBinding()]
    Param (
        [Parameter()]
        [Alias('f')]
        [switch] $Force,

        [Parameter()]
        [switch] $VerboseOutput,

        [Parameter()]
        [ValidateSet('table', 'json')]
        [string] $Format = 'table',

        [Parameter()]
        [Alias('o')]
        [switch] $Online
    )

    $plugin = ensurePamPlugin
    if (-not $plugin) {
        Write-Error -Message "PAM plugin is not available. Enterprise admin access is required." -ErrorAction Stop
    }

    $vault = getVault
    if (-not $vault) {
        Write-Error -Message "Vault is not available. Gateway listing requires a connected vault session." -ErrorAction Stop
    }

    $auth = $Script:Context.Auth
    $routerDown = $false
    $onlineControllers = $null

    try {
        $onlineControllers = [KeeperSecurity.Plugins.PAM.RouterUtils]::GetConnectedGatewaysAsync($auth).GetAwaiter().GetResult()
    }
    catch {
        $exception = $_.Exception
        $isRouterError = ($exception -is [System.Net.Http.HttpRequestException]) -or
            ($exception -is [System.Threading.Tasks.TaskCanceledException]) -or
            ($exception.GetType().FullName -eq 'KeeperSecurity.Authentication.KeeperApiException')

        if ($isRouterError) {
            if (-not (handlePamRouterUnavailable -RouterDown ([ref]$routerDown) -Force:$Force)) {
                return
            }
        }
        else {
            throw
        }
    }

    $controllerList = getPamControllerList -Plugin $plugin
    if ($controllerList.Count -eq 0) {
        if ($Format -eq 'json') {
            [PSCustomObject]@{
                gateways = @()
                message  = 'This Enterprise does not have Gateways yet.'
            } | ConvertTo-Json -Depth 6
        }
        else {
            Write-Output 'This Enterprise does not have Gateways yet. To create a new Gateway, use: pam-gateway-new'
        }
        return
    }

    $controllers = [System.Collections.Generic.IEnumerable[KeeperSecurity.Plugins.PAM.PamController]] $controllerList
    $allSummaries = [KeeperSecurity.Plugins.PAM.GatewayUtils]::BuildGatewaySummaries(
        $controllers, $onlineControllers, $routerDown, $vault)
    $allSummaries = @($allSummaries)
    if ($allSummaries.Count -eq 0) {
        Write-Error -Message 'Failed to build gateway summaries.' -ErrorAction Stop
    }

    $total = $allSummaries.Count
    $onlineCount = 0
    $offlineCount = 0
    if (-not $routerDown) {
        $onlineCount = @($allSummaries | Where-Object { $_.OnlineInstanceCount -gt 0 }).Count
        $offlineCount = $total - $onlineCount
    }

    $displaySummaries = if ($Online) {
        @($allSummaries | Where-Object { -not $routerDown -and $_.OnlineInstanceCount -gt 0 })
    }
    else {
        @($allSummaries)
    }

    if ($Format -eq 'json') {
        $gateways = @($displaySummaries | ForEach-Object { buildPamGatewayJsonItem -Summary $_ -VerboseOutput:$VerboseOutput })
        $result = [ordered]@{ gateways = $gateways }
        if ($Online) {
            $result.gateway_counts = [PSCustomObject]@{
                online  = $onlineCount
                offline = $offlineCount
                total   = $total
            }
        }
        if ($VerboseOutput) {
            $routerHost = getPamRouterHost
            if ($routerHost) {
                $result.router_host = $routerHost
            }
        }
        $result | ConvertTo-Json -Depth 8
        return
    }

    if ($VerboseOutput) {
        $routerHost = getPamRouterHost
        if ($routerHost) {
            Write-Output ''
            Write-Output "Router Host: $routerHost"
            Write-Output ''
        }
    }

    $rows = getPamGatewayTableRows -Summaries $displaySummaries -VerboseOutput:$VerboseOutput
    $rows | Format-Table -AutoSize

    if ($Online) {
        Write-Output ''
        Write-Output "Gateways: Online: $onlineCount, Offline: $offlineCount, Total: $total"
    }
}

function New-KeeperPamGateway {
    <#
        .Synopsis
        Create a PAM gateway.

        .Description
        Creates a PAM gateway in a KSM application and returns a one-time token or initialized
        gateway configuration for deployment.

        -Name (-n)
            Gateway name.
        -Application (-a)
            KSM application UID or title.
        -TokenExpiresInMinutes (-e)
            One-time token expiration in minutes. Default 60, maximum 1440.
        -ConfigInit (-c) {json,b64}
            Initialize client config and return the configuration string instead of a raw token.
        -ReturnValue (-r)
            Return only the token or config string.

        .Parameter Name
        Gateway name. Alias: -n.

        .Parameter Application
        KSM application UID or title. Alias: -a.

        .Parameter TokenExpiresInMinutes
        One-time token expiration in minutes. Default 60, maximum 1440. Alias: -e.

        .Parameter ConfigInit
        Initialize client config and return configuration string. Values: {json,b64}. Alias: -c.

        .Parameter ReturnValue
        Return token or config only. Alias: -r.

        .Example
        New-KeeperPamGateway -Name "Prod Gateway" -Application "My KSM App"
        New-KeeperPamGateway -n "Prod Gateway" -a "My KSM App" -r
        New-KeeperPamGateway -n "Prod Gateway" -a "My KSM App" -ConfigInit json
        New-KeeperPamGateway -n "Prod Gateway" -a "My KSM App" -c b64 -r
    #>
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $true)]
        [Alias('n')]
        [string] $Name,

        [Parameter(Mandatory = $true)]
        [Alias('a')]
        [string] $Application,

        [Parameter()]
        [Alias('e', 'token-expires-in-min')]
        [int] $TokenExpiresInMinutes = 60,

        [Parameter()]
        [Alias('c', 'config-init')]
        [ValidateSet('json', 'b64')]
        [string] $ConfigInit,

        [Parameter()]
        [Alias('r', 'return_value')]
        [switch] $ReturnValue
    )

    $plugin = ensurePamPlugin
    if (-not $plugin) {
        Write-Error -Message "PAM plugin is not available. Enterprise admin access is required." -ErrorAction Stop
    }

    $vault = getVault
    if (-not $vault) {
        Write-Error -Message "Vault is not available. Gateway creation requires a connected vault session." -ErrorAction Stop
    }

    $gatewayName = $Name.Trim()
    if ([string]::IsNullOrWhiteSpace($gatewayName)) {
        Write-Error -Message "-Name is required." -ErrorAction Stop
    }

    if ([string]::IsNullOrWhiteSpace($Application)) {
        Write-Error -Message "-Application is required." -ErrorAction Stop
    }

    $tokenExpire = if ($TokenExpiresInMinutes -gt 0) { $TokenExpiresInMinutes } else { 60 }
    if ($tokenExpire -lt 1) {
        Write-Error -Message "-TokenExpiresInMinutes must be at least 1." -ErrorAction Stop
    }
    if ($tokenExpire -gt 1440) {
        Write-Error -Message "-TokenExpiresInMinutes cannot exceed 1440 minutes." -ErrorAction Stop
    }

    try {
        $ksmApplication = resolvePamKsmApplication -Vault $vault -Identifier $Application
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayAmbiguousException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }
    catch [KeeperSecurity.Plugins.PAM.PamApplicationNotFoundException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }

    $configInitValue = if ($ConfigInit) { $ConfigInit.Trim().ToLowerInvariant() } else { $null }

    try {
        $token = [KeeperSecurity.Plugins.PAM.GatewayUtils]::CreateGatewayAsync(
            $vault,
            $gatewayName,
            $ksmApplication.Uid,
            $tokenExpire,
            $configInitValue
        ).GetAwaiter().GetResult()
    }
    catch [KeeperSecurity.Plugins.PAM.PamException] {
        Write-Error -Message "Failed to create gateway: $($_.Exception.Message)" -ErrorAction Stop
    }

    [void](syncPamPlugin -Plugin $plugin -Reload $false -ThrowOnError $false)

    if ($ReturnValue) {
        Write-Output $token
        return
    }

    Write-Output "The one time token has been created in application [$Application]."
    Write-Output ''
    Write-Output "The new Gateway named $gatewayName will show up in the gateway list once it is initialized."
    Write-Output ''
    if ($configInitValue) {
        Write-Output 'Use the following initialized config in the Gateway:'
    }
    else {
        Write-Output "Following one time token will expire in $tokenExpire minutes:"
    }
    Write-Output '-----------------------------------------------'
    Write-Output $token
    Write-Output '-----------------------------------------------'
}

function Set-KeeperPamGateway {
    <#
        .Synopsis
        Edit a PAM gateway.

        .Parameter Gateway
        Gateway UID or name. Alias: -g.

        .Parameter Name
        New gateway name. Alias: -n.

        .Parameter NodeId
        Enterprise node ID or name. Alias: -i.

        .Example
        Set-KeeperPamGateway -Gateway "Prod Gateway" -Name "Production Gateway"
        Set-KeeperPamGateway -g "Prod Gateway" -i "US-East"
    #>
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $true)]
        [Alias('g')]
        [string] $Gateway,

        [Parameter()]
        [Alias('n')]
        [string] $Name,

        [Parameter()]
        [Alias('i', 'node-id')]
        [string] $NodeId
    )

    $plugin = ensurePamPlugin
    if (-not $plugin) {
        Write-Error -Message "PAM plugin is not available. Enterprise admin access is required." -ErrorAction Stop
    }

    if ([string]::IsNullOrWhiteSpace($Gateway)) {
        Write-Error -Message "-Gateway is required." -ErrorAction Stop
    }

    try {
        $controller = resolvePamSingleGatewayController -Plugin $plugin -Identifier $Gateway
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayAmbiguousException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayNotFoundException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }

    $hasName = -not [string]::IsNullOrWhiteSpace($Name)
    $hasNodeId = -not [string]::IsNullOrWhiteSpace($NodeId)
    if (-not $hasName -and -not $hasNodeId) {
        Write-Error -Message "Nothing to do. Provide -Name and/or -NodeId to edit the gateway." -ErrorAction Stop
    }

    $resolvedNodeId = $controller.NodeId
    if ($hasNodeId) {
        try {
            $node = resolveSingleNode $NodeId.Trim()
            $resolvedNodeId = $node.Id
        }
        catch {
            Write-Error -Message $_.Exception.Message -ErrorAction Stop
        }
    }

    $gatewayName = if ($hasName) { $Name.Trim() } else { $controller.ControllerName }
    $auth = getPamEnterpriseAuth

    invokePamGatewayMutation -Plugin $plugin -FailureMessage 'Failed to edit gateway:' -Action {
        [KeeperSecurity.Plugins.PAM.GatewayUtils]::EditGatewayAsync(
            $auth,
            $controller.ControllerUid,
            $gatewayName,
            $resolvedNodeId
        ).GetAwaiter().GetResult() | Out-Null
    }

    Write-Output "Gateway $gatewayName has been edited."
}

function Remove-KeeperPamGateway {
    <#
        .Synopsis
        Remove a PAM gateway.

        .Parameter Gateway
        Gateway UID or name. Alias: -g.

        .Example
        Remove-KeeperPamGateway -Gateway "Prod Gateway"
    #>
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $true)]
        [Alias('g')]
        [string] $Gateway
    )

    $plugin = ensurePamPlugin
    if (-not $plugin) {
        Write-Error -Message "PAM plugin is not available. Enterprise admin access is required." -ErrorAction Stop
    }

    if ([string]::IsNullOrWhiteSpace($Gateway)) {
        Write-Error -Message "-Gateway is required." -ErrorAction Stop
    }

    try {
        $controller = resolvePamSingleGatewayController -Plugin $plugin -Identifier $Gateway
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayAmbiguousException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayNotFoundException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }

    $auth = getPamEnterpriseAuth
    $gatewayName = $controller.ControllerName

    invokePamGatewayMutation -Plugin $plugin -FailureMessage 'Failed to remove gateway:' -Action {
        [KeeperSecurity.Plugins.PAM.GatewayUtils]::RemoveGatewayAsync(
            $auth,
            $controller.ControllerUid
        ).GetAwaiter().GetResult() | Out-Null
    }

    Write-Output "Gateway $gatewayName has been removed."
}

function Set-KeeperPamGatewayMaxInstances {
    <#
        .Synopsis
        Set maximum PAM gateway instances.

        .Parameter Gateway
        Gateway UID or name. Alias: -g.

        .Parameter MaxInstances
        Maximum number of gateway instances. Must be at least 1. Alias: -m.

        .Example
        Set-KeeperPamGatewayMaxInstances -Gateway "Prod Gateway" -MaxInstances 3
    #>
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $true)]
        [Alias('g')]
        [string] $Gateway,

        [Parameter(Mandatory = $true)]
        [Alias('m', 'max-instances')]
        [int] $MaxInstances
    )

    $plugin = ensurePamPlugin
    if (-not $plugin) {
        Write-Error -Message "PAM plugin is not available. Enterprise admin access is required." -ErrorAction Stop
    }

    if ([string]::IsNullOrWhiteSpace($Gateway)) {
        Write-Error -Message "-Gateway is required." -ErrorAction Stop
    }

    if ($MaxInstances -lt 1) {
        Write-Error -Message "-MaxInstances must be at least 1." -ErrorAction Stop
    }

    try {
        $controller = resolvePamSingleGatewayController -Plugin $plugin -Identifier $Gateway
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayAmbiguousException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayNotFoundException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }

    $auth = getPamEnterpriseAuth

    try {
        invokePamGatewayMutation -Plugin $plugin -FailureMessage 'Failed to set max instances:' -Action {
            [KeeperSecurity.Plugins.PAM.GatewayUtils]::SetGatewayMaxInstancesAsync(
                $auth,
                $controller.ControllerUid,
                $MaxInstances
            ).GetAwaiter().GetResult() | Out-Null
        }
    }
    catch [KeeperSecurity.Plugins.PAM.PamGatewayException] {
        Write-Error -Message $_.Exception.Message -ErrorAction Stop
    }

    Write-Output "$($controller.ControllerName): max instance count set to $MaxInstances"
}

New-Alias -Name pam-gateway-list -Value Get-KeeperPamGatewayList -ErrorAction SilentlyContinue
New-Alias -Name pam-gw-list -Value Get-KeeperPamGatewayList -ErrorAction SilentlyContinue
New-Alias -Name pam-gateway-new -Value New-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gw-new -Value New-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gateway-edit -Value Set-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gw-edit -Value Set-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gateway-remove -Value Remove-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gw-remove -Value Remove-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gateway-rm -Value Remove-KeeperPamGateway -ErrorAction SilentlyContinue
New-Alias -Name pam-gateway-set-max-instances -Value Set-KeeperPamGatewayMaxInstances -ErrorAction SilentlyContinue
New-Alias -Name pam-gw-set-max-instances -Value Set-KeeperPamGatewayMaxInstances -ErrorAction SilentlyContinue

if (Get-Variable -Name Keeper_KSMAppCompleter -Scope Script -ErrorAction SilentlyContinue) {
    Register-ArgumentCompleter -CommandName New-KeeperPamGateway -ParameterName Application -ScriptBlock $Keeper_KSMAppCompleter
}

# SIG # Begin signature block
# MIInvgYJKoZIhvcNAQcCoIInrzCCJ6sCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBL9uB14T6+4gtS
# 3/+d6xhDBNjlLCUofWmGqWUvs9DMuKCCITswggWNMIIEdaADAgECAhAOmxiO+dAt
# 5+/bUOIIQBhaMA0GCSqGSIb3DQEBDAUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQK
# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNV
# BAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yMjA4MDEwMDAwMDBa
# Fw0zMTExMDkyMzU5NTlaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy
# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD
# ZXJ0IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
# ggIBAL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3E
# MB/zG6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKy
# unWZanMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsF
# xl7sWxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU1
# 5zHL2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJB
# MtfbBHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObUR
# WBf3JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6
# nj3cAORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxB
# YKqxYxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5S
# UUd0viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+x
# q4aLT8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjggE6MIIB
# NjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTs1+OC0nFdZEzfLmc/57qYrhwP
# TzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAOBgNVHQ8BAf8EBAMC
# AYYweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp
# Y2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv
# bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0
# aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENB
# LmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQEMBQADggEBAHCgv0Nc
# Vec4X6CjdBs9thbX979XB72arKGHLOyFXqkauyL4hxppVCLtpIh3bb0aFPQTSnov
# Lbc47/T/gLn4offyct4kvFIDyE7QKt76LVbP+fT3rDB6mouyXtTP0UNEm0Mh65Zy
# oUi0mcudT6cGAxN3J0TU53/oWajwvy8LpunyNDzs9wPHh6jSTEAZNUZqaVSwuKFW
# juyk1T3osdz9HNj0d1pcVIxv76FQPfx2CWiEn2/K2yCNNWAcAgPLILCsWKAOQGPF
# mCLBsln1VWvPJ6tsds5vIy30fnFqI2si/xK4VC0nftg62fC2h5b9W9FcrBjDTZ9z
# twGpn1eqXijiuZQwggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0GCSqG
# SIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx
# GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRy
# dXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTlaMGkx
# CzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4
# RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEzODQg
# MjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C0Cit
# eLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce2vnS
# 1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0daE6ZM
# swEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6TSXBC
# Mo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoAFdE3
# /hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7OhD26j
# q22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM1bL5
# OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z8ujo
# 7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05huzU
# tw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNYmtwm
# KwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP/2NP
# TLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0TAQH/
# BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYDVR0j
# BBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1Ud
# JQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0
# cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0
# cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8E
# PDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVz
# dGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATANBgkq
# hkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95RysQDK
# r2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HLIvda
# qpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5BtfQ/g+
# lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnhOE7a
# brs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIhdXNS
# y0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV9zeK
# iwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/jwVYb
# KyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYHKi8Q
# xAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmCXBVm
# zGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l/aCn
# HwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZWeE4w
# gga0MIIEnKADAgECAhANx6xXBf8hmS5AQyIMOkmGMA0GCSqGSIb3DQEBCwUAMGIx
# CzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3
# dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBH
# NDAeFw0yNTA1MDcwMDAwMDBaFw0zODAxMTQyMzU5NTlaMGkxCzAJBgNVBAYTAlVT
# MRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1
# c3RlZCBHNCBUaW1lU3RhbXBpbmcgUlNBNDA5NiBTSEEyNTYgMjAyNSBDQTEwggIi
# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC0eDHTCphBcr48RsAcrHXbo0Zo
# dLRRF51NrY0NlLWZloMsVO1DahGPNRcybEKq+RuwOnPhof6pvF4uGjwjqNjfEvUi
# 6wuim5bap+0lgloM2zX4kftn5B1IpYzTqpyFQ/4Bt0mAxAHeHYNnQxqXmRinvuNg
# xVBdJkf77S2uPoCj7GH8BLuxBG5AvftBdsOECS1UkxBvMgEdgkFiDNYiOTx4OtiF
# cMSkqTtF2hfQz3zQSku2Ws3IfDReb6e3mmdglTcaarps0wjUjsZvkgFkriK9tUKJ
# m/s80FiocSk1VYLZlDwFt+cVFBURJg6zMUjZa/zbCclF83bRVFLeGkuAhHiGPMvS
# GmhgaTzVyhYn4p0+8y9oHRaQT/aofEnS5xLrfxnGpTXiUOeSLsJygoLPp66bkDX1
# ZlAeSpQl92QOMeRxykvq6gbylsXQskBBBnGy3tW/AMOMCZIVNSaz7BX8VtYGqLt9
# MmeOreGPRdtBx3yGOP+rx3rKWDEJlIqLXvJWnY0v5ydPpOjL6s36czwzsucuoKs7
# Yk/ehb//Wx+5kMqIMRvUBDx6z1ev+7psNOdgJMoiwOrUG2ZdSoQbU2rMkpLiQ6bG
# RinZbI4OLu9BMIFm1UUl9VnePs6BaaeEWvjJSjNm2qA+sdFUeEY0qVjPKOWug/G6
# X5uAiynM7Bu2ayBjUwIDAQABo4IBXTCCAVkwEgYDVR0TAQH/BAgwBgEB/wIBADAd
# BgNVHQ4EFgQU729TSunkBnx6yuKQVvYv1Ensy04wHwYDVR0jBBgwFoAU7NfjgtJx
# XWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF
# BwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln
# aWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5j
# b20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8EPDA6MDigNqA0hjJo
# dHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNy
# bDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgBhv1sBwEwDQYJKoZIhvcNAQEL
# BQADggIBABfO+xaAHP4HPRF2cTC9vgvItTSmf83Qh8WIGjB/T8ObXAZz8OjuhUxj
# aaFdleMM0lBryPTQM2qEJPe36zwbSI/mS83afsl3YTj+IQhQE7jU/kXjjytJgnn0
# hvrV6hqWGd3rLAUt6vJy9lMDPjTLxLgXf9r5nWMQwr8Myb9rEVKChHyfpzee5kH0
# F8HABBgr0UdqirZ7bowe9Vj2AIMD8liyrukZ2iA/wdG2th9y1IsA0QF8dTXqvcnT
# mpfeQh35k5zOCPmSNq1UH410ANVko43+Cdmu4y81hjajV/gxdEkMx1NKU4uHQcKf
# ZxAvBAKqMVuqte69M9J6A47OvgRaPs+2ykgcGV00TYr2Lr3ty9qIijanrUR3anzE
# wlvzZiiyfTPjLbnFRsjsYg39OlV8cipDoq7+qNNjqFzeGxcytL5TTLL4ZaoBdqbh
# OhZ3ZRDUphPvSRmMThi0vw9vODRzW6AxnJll38F0cuJG7uEBYTptMSbhdhGQDpOX
# gpIUsWTjd6xpR6oaQf/DJbg3s6KCLPAlZ66RzIg9sC+NJpud/v4+7RWsWCiKi9EO
# LLHfMR2ZyJ/+xhCx9yHbxtl5TPau1j/1MIDpMPx0LckTetiSuEtQvLsNz3Qbp7wG
# WqbIiOWCnb5WqxL3/BAPvIXKUjPSxyZsq8WhbaM2tszWkPZPubdcMIIG7TCCBNWg
# AwIBAgIQCoDvGEuN8QWC0cR2p5V0aDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQG
# EwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0
# IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0Ex
# MB4XDTI1MDYwNDAwMDAwMFoXDTM2MDkwMzIzNTk1OVowYzELMAkGA1UEBhMCVVMx
# FzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTswOQYDVQQDEzJEaWdpQ2VydCBTSEEy
# NTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVzcG9uZGVyIDIwMjUgMTCCAiIwDQYJKoZI
# hvcNAQEBBQADggIPADCCAgoCggIBANBGrC0Sxp7Q6q5gVrMrV7pvUf+GcAoB38o3
# zBlCMGMyqJnfFNZx+wvA69HFTBdwbHwBSOeLpvPnZ8ZN+vo8dE2/pPvOx/Vj8Tch
# TySA2R4QKpVD7dvNZh6wW2R6kSu9RJt/4QhguSssp3qome7MrxVyfQO9sMx6ZAWj
# FDYOzDi8SOhPUWlLnh00Cll8pjrUcCV3K3E0zz09ldQ//nBZZREr4h/GI6Dxb2Uo
# yrN0ijtUDVHRXdmncOOMA3CoB/iUSROUINDT98oksouTMYFOnHoRh6+86Ltc5zjP
# KHW5KqCvpSduSwhwUmotuQhcg9tw2YD3w6ySSSu+3qU8DD+nigNJFmt6LAHvH3KS
# uNLoZLc1Hf2JNMVL4Q1OpbybpMe46YceNA0LfNsnqcnpJeItK/DhKbPxTTuGoX7w
# JNdoRORVbPR1VVnDuSeHVZlc4seAO+6d2sC26/PQPdP51ho1zBp+xUIZkpSFA8vW
# doUoHLWnqWU3dCCyFG1roSrgHjSHlq8xymLnjCbSLZ49kPmk8iyyizNDIXj//cOg
# rY7rlRyTlaCCfw7aSUROwnu7zER6EaJ+AliL7ojTdS5PWPsWeupWs7NpChUk555K
# 096V1hE0yZIXe+giAwW00aHzrDchIc2bQhpp0IoKRR7YufAkprxMiXAJQ1XCmnCf
# gPf8+3mnAgMBAAGjggGVMIIBkTAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTkO/zy
# Me39/dfzkXFjGVBDz2GM6DAfBgNVHSMEGDAWgBTvb1NK6eQGfHrK4pBW9i/USezL
# TjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwgZUGCCsG
# AQUFBwEBBIGIMIGFMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5j
# b20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdp
# Q2VydFRydXN0ZWRHNFRpbWVTdGFtcGluZ1JTQTQwOTZTSEEyNTYyMDI1Q0ExLmNy
# dDBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGln
# aUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBpbmdSU0E0MDk2U0hBMjU2MjAyNUNBMS5j
# cmwwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEB
# CwUAA4ICAQBlKq3xHCcEua5gQezRCESeY0ByIfjk9iJP2zWLpQq1b4URGnwWBdEZ
# D9gBq9fNaNmFj6Eh8/YmRDfxT7C0k8FUFqNh+tshgb4O6Lgjg8K8elC4+oWCqnU/
# ML9lFfim8/9yJmZSe2F8AQ/UdKFOtj7YMTmqPO9mzskgiC3QYIUP2S3HQvHG1FDu
# +WUqW4daIqToXFE/JQ/EABgfZXLWU0ziTN6R3ygQBHMUBaB5bdrPbF6MRYs03h4o
# bEMnxYOX8VBRKe1uNnzQVTeLni2nHkX/QqvXnNb+YkDFkxUGtMTaiLR9wjxUxu2h
# ECZpqyU1d0IbX6Wq8/gVutDojBIFeRlqAcuEVT0cKsb+zJNEsuEB7O7/cuvTQasn
# M9AWcIQfVjnzrvwiCZ85EE8LUkqRhoS3Y50OHgaY7T/lwd6UArb+BOVAkg2oOvol
# /DJgddJ35XTxfUlQ+8Hggt8l2Yv7roancJIFcbojBcxlRcGG0LIhp6GvReQGgMgY
# xQbV1S3CrWqZzBt1R9xJgKf47CdxVRd/ndUlQ05oxYy2zRWVFjF7mcr4C34Mj3oc
# CVccAvlKV9jEnstrniLvUxxVZE/rptb7IRE2lskKPIJgbaP5t2nGj/ULLi49xTcB
# ZU8atufk+EMF/cWuiC7POGT75qaL6vdCvHlshtjdNXOCIUjsarfNZzCCB0kwggUx
# oAMCAQICEAHdzU+FVN9jCMv0HhHagNUwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UE
# BhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2Vy
# dCBUcnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENB
# MTAeFw0yNjA2MDUwMDAwMDBaFw0yNzA2MDQyMzU5NTlaMIHRMRMwEQYLKwYBBAGC
# NzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMR0wGwYDVQQPDBRQ
# cml2YXRlIE9yZ2FuaXphdGlvbjEQMA4GA1UEBRMHMzQwNzk4NTELMAkGA1UEBhMC
# VVMxETAPBgNVBAgTCElsbGlub2lzMRAwDgYDVQQHEwdDaGljYWdvMR0wGwYDVQQK
# ExRLZWVwZXIgU2VjdXJpdHkgSW5jLjEdMBsGA1UEAxMUS2VlcGVyIFNlY3VyaXR5
# IEluYy4wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCb4DRTV0sNQsa1
# 0YRh+bliabmLOVYr6S0+BSVvRJAN3SHP6x52i1Dkpki5xVDIH06ZnnsToVrgvTv+
# QxGwsn9SAPHEZ/PIJRFxbMR4ShDaptYyL4f0u4k/3HwRzIleWE4mTUonYH8BdgLw
# /F53B7wa7VTDHtxXltYTibEOwJxYCOi4Zr2FYQhjw14/CHcqS3FSMs6YYU2T56+g
# w819hQM3K0YlwTNOFoIm1v7/ZZZiJGH8uGDsvy1makh1Xyyo/wN8EbQ1nbslmePT
# roPm9w7WqiP/yiq+CZHiuTk9JK5bEgkWG3ns+v25cI251WidJx3SU7IZnX0OTd6/
# ZdKhprD5Gcfy5GBbJdcYw2WycQRW0PT5BEt55xRE0heufkpDaTUN6RdOuJdXbkl0
# hV91IZIuhueEMCk3h5mDTlU5gImxqj0R/TbAxjSSGTKCeuYFkQIRqytSabdrZZ48
# kW5hOIZMVDY1f4kpPJa8UeEvDZXT3vrtj36aSJrwez2uh4FMNlkCAwEAAaOCAgIw
# ggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBT1
# SmCYU/7Yrz1fX66Ur5nSzlSYOzA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYB
# BQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMC
# B4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0
# cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25p
# bmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRp
# Z2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNI
# QTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYY
# aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2Fj
# ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JT
# QTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUA
# A4ICAQBcavcUHNFEg872HDRq2+hRlnvaghCXv7X/6h9HSzjAQP3rt95BZty3ASqi
# 2MYyGQLGdDl4DToe/WhajtEOBOYa83agW6tBvrfcKRrDrwJOMPTbwNYvn+GuiL4T
# CKzXaytWiJJbrc5odc7Ecat2ZvJylpPmNainr4Q0LzzH23Gea/Mm/hIJTN4IGgrH
# hrXiTIIW/ZUzrY6g8b3RZB4BA497n43wNdSqP+C3ntFw6NiGB4Z25SW4YntIxYPv
# Kf37OVhF0xqxLC1sK/XxgK0EGQ6iaj8Ncpr2C5vSNZqfW2MndxOA1W67pgDpg83k
# UWG+/YJeGhqOTF82/0kIzQXeI/lIqbnL/IJAJqSm/ROSpsGUKVbzk03cpTD55ZQX
# WjM0fLirypBqY05T8gnh1L0fSwxr/SwJZ8OddivgyK1YOMn02nnsEG5kxBt9cMX4
# JCYABhypmAVDRvyYifEVdoFWv2gAXXW+PPRvlNa6E4aMCZrVcoKHiyeMAXOi1IC9
# mHvC2+foTSMFueq3AdnYfeKnZnAiKXKRhXcdHbQYcR2A7AIzIcqahPYr4FNEgb/E
# /y/kypAkf0rMHlYl1kNqLs2Nv1UnMEHYT5YmDVLO63+1Trcw4zTZ70zuqIqeID/d
# nbOlgtyG6DSRCL7f0E7kP18f4RoX5i1PkfeO4VJHsAuCeNG1qjGCBdkwggXVAgEB
# MH0waTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYD
# VQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNI
# QTM4NCAyMDIxIENBMQIQAd3NT4VU32MIy/QeEdqA1TANBglghkgBZQMEAgEFAKCB
# hDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEE
# AYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJ
# BDEiBCChbPgdY1i1w6pgoVgOoB5SuJ0yt6+jnhq+bbIhlo6kGDANBgkqhkiG9w0B
# AQEFAASCAYAll6GD6XUedzqBv3XYTy+nF6FiUSXARByCrU0zvNhtVSPSE/5ud3FD
# XbnAPc8jNgJmQJACJGdrP5+fk2ErOuordkqRIrLwtpvXlHig9bpJ5QZ25+AZsCuB
# f8fTVL/wmymAxESDzkoRTISgHkPa/7JRb/8kdozrLKdOkRgIshTcVE3Xh5iKxstA
# YCQc24XNlHlKF6qCq07AbrQiAvY33fAthkbaA13R/rf0pNvYdpztPuv3M3z4s0R9
# sv3HEqM+sWVo148g5idAZR+HVjqIBPp0ZQhv+gk406BRJ9gzHaqRnoSDeRHAD3JW
# BpDqKbwfcnZOkEMX35+d/T5ChivMy2tnrkoz9dfhotIB4mZi5GFZk1T/ML3cDRbB
# 52ET/xzIyZp9xWCe4Gqrtkr+8a+TQ6uCjszsn73/3xtKb94DZmohDJMGRxvteJZt
# OpP0AwgP0Np4Q/57HNDHllpIKxjrxl5pY9YJwoir0TVL3au3I/o8yT5e7Mim0hH8
# rdQvm/TfG7ihggMmMIIDIgYJKoZIhvcNAQkGMYIDEzCCAw8CAQEwfTBpMQswCQYD
# VQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lD
# ZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQwOTYgU0hBMjU2IDIwMjUg
# Q0ExAhAKgO8YS43xBYLRxHanlXRoMA0GCWCGSAFlAwQCAQUAoGkwGAYJKoZIhvcN
# AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjYwODE0MjExOTIxWjAv
# BgkqhkiG9w0BCQQxIgQgJJbKGsPFEiG1/oHAub5GzSryNfZlbJiYh7RmHzcWyjgw
# DQYJKoZIhvcNAQEBBQAEggIAsKMu41QApoOw1sJdcEj96JUBUuoa1QgvGIdJ1UBQ
# LTvk1+KU5LrrnSPsaQCrpLQkGQBAyeateRZYE/DjjvaIOkfKMNlH+bf2unmWDtXT
# ZM319e8+GOYNOmV6MRiFUinfWla5MnonPsSWST0D2ch/mepW1QJo4jDlQQHVzvdi
# Wd0jRe0+GfUZfu6dha6dByKer4D3BHAoUbeLqDpRXOoriyeKUPovkJmP4kcy7L7z
# sVTOc21DOZOXK5lM+YLh43yAxvxSLNt60nzI59GCr7PTI+FfUO66bBnJSYR8o9OE
# vAr1su+CPIhRZvDtuONg5F5qHzild8vlLP9U56ZI6y7sQ1LDSdmcWRtl+J6SCXh2
# Goj3oL7F75zgNoVI5KSm+VVEJOsBTixSqNHhlU6pkbsg8aHXZfxdi+4rbjw5XwYH
# Xo3A08C9bmMPbejWdkYHrc1WAXxutwydGbNPWRz/yZGPcBaA1adT1iaZavwcwZIs
# rOVMuXbzUFIfvx+Rq3gv9FPEFVSYOCR4Sx5SVWPcEzMqFUMitAohR0b67mYAsTGP
# yY+6U/hSh3vw8QIMnAGbPlWuqqysmYMAibV2nDKCumykPMYOH21UJH5CEhT6y6JX
# 1Axc13dz17NeJ7/BxFxVAkH57AIX8wz0VP/PsUTj6oOSeDFOz6LMI1NTC+T4ll6f
# olw=
# SIG # End signature block