Merge pull request #706 from GSA/local-saml

make saml works for local

.env

@@ -149,8 +149,36 @@ CKANEXT__SAML2AUTH__USER_LASTNAME=last_name
 # Corresponding SAML user field for email
 CKANEXT__SAML2AUTH__USER_EMAIL=email
 
+### saml2 Optional:
+
+# List of email addresses from users that should be created as sysadmins (system administrators)
+# [email protected]
+
+# Indicates that attributes that are not recognized (they are not configured in attribute-mapping),
+# will not be discarded.
+# Default: True
+CKANEXT__SAML2AUTH__ALLOW_UNKNOWN_ATTRIBUTES=true
+
 # Indicates if CKAN should auto create a user for a new SAML login
 # If set False, a new user must be manually created in CKAN before they can log in using SAML
 # If set False, existing user must be in active state to able to log in.
 # Default: True
 CKANEXT__SAML2AUTH__CREATE_USER_VIA_SAML=false
+
+# A list of string values that will be used to set the <NameIDFormat> element of the metadata of an entity.
+# Default: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
+CKANEXT__SAML2AUTH__SP__NAME_ID_FORMAT=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent urn:oasis:names:tc:SAML:2.0:nameid-format:transient urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress
+
+CKANEXT__SAML2AUTH__ENTITY_ID=urn:gov:gsa:SAML:2.0.profiles:sp:sso:gsa:inventory-dev
+
+CKANEXT__SAML2AUTH__WANT_RESPONSE_SIGNED=false
+CKANEXT__SAML2AUTH__WANT_ASSERTIONS_SIGNED=false
+CKANEXT__SAML2AUTH__WANT_ASSERTIONS_OR_RESPONSE_SIGNED=true
+CKANEXT__SAML2AUTH__KEY_FILE_PATH=/srv/app/saml2/pki/mykey.pem
+CKANEXT__SAML2AUTH__CERT_FILE_PATH=/srv/app/saml2/pki/mycert.pem
+# CKANEXT__SAML2AUTH__ATTRIBUTE_MAP_DIR=/srv/app/saml2/attributemaps
+CKANEXT__SAML2AUTH__ENABLE_CKAN_INTERNAL_LOGIN=true
+# Ask for a PIV card https://developers.login.gov/oidc/#aal-values
+CKANEXT__SAML2AUTH__REQUESTED_AUTHN_CONTEXT=http://idmanagement.gov/ns/assurance/aal/3?hspd12=true
+# Comparison could be one of this: exact, minimum, maximum or better
+CKANEXT__SAML2AUTH__REQUESTED_AUTHN_CONTEXT_COMPARISON=exact

Dockerfile

@@ -33,3 +33,5 @@ COPY config/server_start.sh $CKAN_CONFIG/
 
 # Custom prerun script for Solr 8
 COPY config/GSA_prerun.py ${CKAN_HOME}/
+
+COPY config/saml2 ${CKAN_HOME}/saml2

config/saml2/idp.xml

@@ -0,0 +1,64 @@
+<EntityDescriptor ID="_e476abad-9e72-4c04-b2a6-ca4adfd96305"
+  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+  xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://idp.int.identitysandbox.gov/api/saml">
+  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+    <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
+      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod>
+      <ds:Reference URI="#_e476abad-9e72-4c04-b2a6-ca4adfd96305">
+        <ds:Transforms>
+          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform>
+          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
+        </ds:Transforms>
+        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod>
+        <ds:DigestValue>lueHEVMBJFpFx61XPyeIy9OqQZt/FnY34BjceSJhdEg=</ds:DigestValue>
+      </ds:Reference>
+    </ds:SignedInfo>
+    <ds:SignatureValue>fggtNDXqdKVDn8WR2sKC0HPwJ1JLEOcvBcDvx9t0wVecxVMrVPfX0Wm8xhme8s2oCy9WIxPSvyxdT3PG89n/XYgy8IlDtRP9S0jP2+q8YVW+5NhIFBXPfomc7RWovQwNKVPFJ9lMvkpFhhyNL8gNnS6xaHaqBtyiRDXDlvGJRqC7dM+Mc7WqU9p6xOas06Y3K6phTByWLSUITjoz/suXic64w9gBl31rg29rkpjs3o9S5t4sAfyDenhBjIBHBGB0nhLgOQgT3h3t9a8tDe2XRh3KsK/Mw4GcHK47rrTPRwO5G8hDG96JmafhMxZ6WE0XbqATyU2rJAosnXrvY+xOtw==</ds:SignatureValue>
+    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+      <ds:X509Data>
+        <ds:X509Certificate>MIID7TCCAtWgAwIBAgIUYePi2i1UjRg3fIK0FG15rZaSOvAwDQYJKoZIhvcNAQELBQAwgYUxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UEBwwKV2FzaGluZ3RvbjEMMAoGA1UECgwDR1NBMRIwEAYDVQQLDAlMb2dpbi5nb3YxIDAeBgNVBAMMF2ludC5pZGVudGl0eXNhbmRib3guZ292MB4XDTI0MDExNjIwMTEyMloXDTI1MDQwMTIwMTEyMlowgYUxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UEBwwKV2FzaGluZ3RvbjEMMAoGA1UECgwDR1NBMRIwEAYDVQQLDAlMb2dpbi5nb3YxIDAeBgNVBAMMF2ludC5pZGVudGl0eXNhbmRib3guZ292MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0K9gJdCDRwndI+Gd44cugWK3VWKgPV/oZU74KqYxJOomJUgLLYMHskS3RDlOla+k25SvBLWFlT9Y10RAnWo6ZDquY+/BaedyoTaoLf/5K/JxXz8th00aIll4ym3CLE/ac9B7s/apACdpH63XwAlaRC3A4Hbq1DWXd2Hcuw0B9pRpMKFd6i/kVvAsNH7tNn5gBL9hckiPxR4FD8/VysnVmXpNNFyKNEUQi6iqKVbUhzB+4WZMB/qBnnIEeSuUpHfQCUJR3SjRYzBLR+iVAXKeNCg7CENZbu02AY32kyO6QStQnGItTi355p4VFumA4dQS2MZsXYAPo+QP+qe6rguXaQIDAQABo1MwUTAdBgNVHQ4EFgQUGbZYf4tPIbZxRYwemr7iRXcS8jUwHwYDVR0jBBgwFoAUGbZYf4tPIbZxRYwemr7iRXcS8jUwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAtPlcy1eToYc2B0+zg4DdGQDZQA897Z7oLX0nfpf4Bsx1sQzqhEd1iBPh4/g0wO45T4c0aOdH+bdv8UC9NWupKdIrz9VGY3XD5ef8ydTWAzcN9k+gTZmPQ506SRqI6GlWy8QDuPX+sK7apOkd/TUILAeoA9on+v8qg52jU1E4e8La8Kd8PPNWbAbLew2lp/ANRYbtcPmVbJYOlY8nBOZadzL3LPwWkPJII78hmSc2eV4UqyTVbJ/k15i+tx+8GALx1LHMri11fvcFhJUx/qfGU6X7xnI32eZtmOH7Y+Xi9dxh560ohSgP3m4xv2YKsVjm2tPZGfZvpOGNEYTvdaXaAA==</ds:X509Certificate>
+      </ds:X509Data>
+    </KeyInfo>
+  </ds:Signature>
+  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIID7TCCAtWgAwIBAgIUYePi2i1UjRg3fIK0FG15rZaSOvAwDQYJKoZIhvcNAQELBQAwgYUxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UEBwwKV2FzaGluZ3RvbjEMMAoGA1UECgwDR1NBMRIwEAYDVQQLDAlMb2dpbi5nb3YxIDAeBgNVBAMMF2ludC5pZGVudGl0eXNhbmRib3guZ292MB4XDTI0MDExNjIwMTEyMloXDTI1MDQwMTIwMTEyMlowgYUxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UEBwwKV2FzaGluZ3RvbjEMMAoGA1UECgwDR1NBMRIwEAYDVQQLDAlMb2dpbi5nb3YxIDAeBgNVBAMMF2ludC5pZGVudGl0eXNhbmRib3guZ292MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0K9gJdCDRwndI+Gd44cugWK3VWKgPV/oZU74KqYxJOomJUgLLYMHskS3RDlOla+k25SvBLWFlT9Y10RAnWo6ZDquY+/BaedyoTaoLf/5K/JxXz8th00aIll4ym3CLE/ac9B7s/apACdpH63XwAlaRC3A4Hbq1DWXd2Hcuw0B9pRpMKFd6i/kVvAsNH7tNn5gBL9hckiPxR4FD8/VysnVmXpNNFyKNEUQi6iqKVbUhzB+4WZMB/qBnnIEeSuUpHfQCUJR3SjRYzBLR+iVAXKeNCg7CENZbu02AY32kyO6QStQnGItTi355p4VFumA4dQS2MZsXYAPo+QP+qe6rguXaQIDAQABo1MwUTAdBgNVHQ4EFgQUGbZYf4tPIbZxRYwemr7iRXcS8jUwHwYDVR0jBBgwFoAUGbZYf4tPIbZxRYwemr7iRXcS8jUwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAtPlcy1eToYc2B0+zg4DdGQDZQA897Z7oLX0nfpf4Bsx1sQzqhEd1iBPh4/g0wO45T4c0aOdH+bdv8UC9NWupKdIrz9VGY3XD5ef8ydTWAzcN9k+gTZmPQ506SRqI6GlWy8QDuPX+sK7apOkd/TUILAeoA9on+v8qg52jU1E4e8La8Kd8PPNWbAbLew2lp/ANRYbtcPmVbJYOlY8nBOZadzL3LPwWkPJII78hmSc2eV4UqyTVbJ/k15i+tx+8GALx1LHMri11fvcFhJUx/qfGU6X7xnI32eZtmOH7Y+Xi9dxh560ohSgP3m4xv2YKsVjm2tPZGfZvpOGNEYTvdaXaAA==</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.int.identitysandbox.gov/api/saml/auth2024"/>
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.int.identitysandbox.gov/api/saml/auth2024"/>
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=""/>
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location=""/>
+  </IDPSSODescriptor>
+  <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIID7TCCAtWgAwIBAgIUYePi2i1UjRg3fIK0FG15rZaSOvAwDQYJKoZIhvcNAQELBQAwgYUxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UEBwwKV2FzaGluZ3RvbjEMMAoGA1UECgwDR1NBMRIwEAYDVQQLDAlMb2dpbi5nb3YxIDAeBgNVBAMMF2ludC5pZGVudGl0eXNhbmRib3guZ292MB4XDTI0MDExNjIwMTEyMloXDTI1MDQwMTIwMTEyMlowgYUxCzAJBgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UEBwwKV2FzaGluZ3RvbjEMMAoGA1UECgwDR1NBMRIwEAYDVQQLDAlMb2dpbi5nb3YxIDAeBgNVBAMMF2ludC5pZGVudGl0eXNhbmRib3guZ292MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0K9gJdCDRwndI+Gd44cugWK3VWKgPV/oZU74KqYxJOomJUgLLYMHskS3RDlOla+k25SvBLWFlT9Y10RAnWo6ZDquY+/BaedyoTaoLf/5K/JxXz8th00aIll4ym3CLE/ac9B7s/apACdpH63XwAlaRC3A4Hbq1DWXd2Hcuw0B9pRpMKFd6i/kVvAsNH7tNn5gBL9hckiPxR4FD8/VysnVmXpNNFyKNEUQi6iqKVbUhzB+4WZMB/qBnnIEeSuUpHfQCUJR3SjRYzBLR+iVAXKeNCg7CENZbu02AY32kyO6QStQnGItTi355p4VFumA4dQS2MZsXYAPo+QP+qe6rguXaQIDAQABo1MwUTAdBgNVHQ4EFgQUGbZYf4tPIbZxRYwemr7iRXcS8jUwHwYDVR0jBBgwFoAUGbZYf4tPIbZxRYwemr7iRXcS8jUwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAtPlcy1eToYc2B0+zg4DdGQDZQA897Z7oLX0nfpf4Bsx1sQzqhEd1iBPh4/g0wO45T4c0aOdH+bdv8UC9NWupKdIrz9VGY3XD5ef8ydTWAzcN9k+gTZmPQ506SRqI6GlWy8QDuPX+sK7apOkd/TUILAeoA9on+v8qg52jU1E4e8La8Kd8PPNWbAbLew2lp/ANRYbtcPmVbJYOlY8nBOZadzL3LPwWkPJII78hmSc2eV4UqyTVbJ/k15i+tx+8GALx1LHMri11fvcFhJUx/qfGU6X7xnI32eZtmOH7Y+Xi9dxh560ohSgP3m4xv2YKsVjm2tPZGfZvpOGNEYTvdaXaAA==</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <Organization>
+      <OrganizationName xml:lang="en">login.gov</OrganizationName>
+      <OrganizationDisplayName xml:lang="en">login.gov</OrganizationDisplayName>
+      <OrganizationURL xml:lang="en">https://login.gov</OrganizationURL>
+    </Organization>
+    <ContactPerson contactType="technical"></ContactPerson>
+    <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.int.identitysandbox.gov/api/saml/attributes"/>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+  </AttributeAuthorityDescriptor>
+  <Organization>
+    <OrganizationName xml:lang="en">login.gov</OrganizationName>
+    <OrganizationDisplayName xml:lang="en">login.gov</OrganizationDisplayName>
+    <OrganizationURL xml:lang="en">https://login.gov</OrganizationURL>
+  </Organization>
+  <ContactPerson contactType="technical"></ContactPerson>
+</EntityDescriptor>

config/saml2/pki/mycert.pem

@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGJjCCBA4CCQCn8miIZxsChTANBgkqhkiG9w0BAQsFADCB1DELMAkGA1UEBhMC
+VVMxHTAbBgNVBAgMFERpc3RyaWN0IG9mIENvbHVtYmlhMRMwEQYDVQQHDApXYXNo
+aW5ndG9uMSgwJgYDVQQKDB9HZW5lcmFsIFNlcnZpY2VzIEFkbWluaXN0cmF0aW9u
+MSowKAYDVQQLDCFUZWNobm9sb2d5IFRyYW5zZm9ybWF0aW9uIFNlcnZpY2UxIjAg
+BgkqhkiG9w0BCQEWE2RhdGFnb3ZoZWxwQGdzYS5nb3YxFzAVBgNVBAMMDmxvY2Fs
+aG9zdDo4NDQzMB4XDTIxMDMyMzIwNTg1OFoXDTMxMDMyMTIwNTg1OFowgdQxCzAJ
+BgNVBAYTAlVTMR0wGwYDVQQIDBREaXN0cmljdCBvZiBDb2x1bWJpYTETMBEGA1UE
+BwwKV2FzaGluZ3RvbjEoMCYGA1UECgwfR2VuZXJhbCBTZXJ2aWNlcyBBZG1pbmlz
+dHJhdGlvbjEqMCgGA1UECwwhVGVjaG5vbG9neSBUcmFuc2Zvcm1hdGlvbiBTZXJ2
+aWNlMSIwIAYJKoZIhvcNAQkBFhNkYXRhZ292aGVscEBnc2EuZ292MRcwFQYDVQQD
+DA5sb2NhbGhvc3Q6ODQ0MzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+AMeDVrbOAbgGAWLIajoXG7WEWFBfNYirVA70BL5Pwa6010xu3mf9A6Eb6bF/VMNK
+uCICZS1j0H3WjOpGegMPS3DrNp5oatbjkUaeHQwlJVmK6YDO5pbwZnSrUbR7OTaM
+TH4j5juuG9Eu26CR95jm11HRtb7iAu3MdL+C8ztrhfs1ZL7MTALEWXX92t2Q3BED
+bgDUHuZWOCYHY/HOAqvHS/2SrJCkQ9LxOyxtnmUxk6cPPUcYWBo4XGKecvWkvi1m
+eaG66vdL8kNcZp93+6SULX8O0IpjN+I1gyuWSj1nUiBvbE3jV/0lS1Ctl7ir7k53
+hIRTbcybGV1UJKVnLtxeBTEqBPkJounrcXzdFv8cmuK99ASt0e6C1MxZcUBRBbjW
+fuVKxC8Tt87/u0GFLZObI5lOOBNbc/179TLTjl077JAzdZ2Gi38r5QMsFuNgkAZu
+rwpxeusmzaSyZTT2YesFSqQJuqSB3eCepqIJKDmRsWRm3VO7ilaNJpQfnDexbCCL
+FsAmTd7ZNe5+Lhwslm58OGzqllPIia1J8sLH1hanh/NCPeSH7lZ5ZS5gdHiVA1I9
+1mz1uvNoZD+n3gTyKgh1ZJksikNZWhSrWpBCor6IP14+LUDgl0M7ux0zePGUvDH2
+2IT90b9lklLLidYQ1UffSPCnnmLyiXzqzCx6MaNB5daRAgMBAAEwDQYJKoZIhvcN
+AQELBQADggIBAMJwZbNR0pSFGGhD4ZEL4NQONd/mMc1tBjDOaTpYZtCU+Z0v2ZuM
+194NolgpN8vDyTLLzqUOXyN/l0ZuscJbGHRyCsU4d2oY8dgd2ww6Fsj3uolXVgbu
+uXdlx21CDQwEltynSibdcjsiPXqjNKXQAvlbkUk7lVfrGmM0+GAt3DvHk/1FMlW6
+aRXDPkmO0LdzDlFeoLzAqbUP0A1LGsgSxEl8MOd8j8LH02/2r1NVi7dzIhn0X41P
+PuQOUY7EEp5ucnmmT6ap9t7evPM9S/SjyRFBE/m31uKNdftGT0/4VSLsDP0Q3GQv
+dNu7nzniGJOGsnqWHca7HnRUBRy7tUWyIdvGFcEYAJjAMHtOiJsv5OdGuUMQDsyV
+OGSjzFGFf2qGKNhe+jmXrbGX6btmYtITc9nyeaGPyvO5b7M5XLVPZbQzsygcqHc4
+gWJgEqffMeR2x5lujlOlEBguRuhDyLgFrc3kMbXPEk8sMQLl6mWDFPVTgGW190zX
+4m19gxAscAymOJmxETCb3XIyNP7x8foonutr9cBoyCcHcxHHiu6bpBF+qwbxZkKe
+ozBuKxgLNwGBVUtXRbeYSgopz3QV3Y+ciVMr+ZUzaC6qPCsSURuieujO3ywzQc0n
+QYxaLjiPzx1sujleukgF7SCq2KrdtvVl9c4UWw4L81DKGVACqgamoUOO
+-----END CERTIFICATE-----

config/saml2/pki/mykey.pem

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDHg1a2zgG4BgFi
+yGo6Fxu1hFhQXzWIq1QO9AS+T8GutNdMbt5n/QOhG+mxf1TDSrgiAmUtY9B91ozq
+RnoDD0tw6zaeaGrW45FGnh0MJSVZiumAzuaW8GZ0q1G0ezk2jEx+I+Y7rhvRLtug
+kfeY5tdR0bW+4gLtzHS/gvM7a4X7NWS+zEwCxFl1/drdkNwRA24A1B7mVjgmB2Px
+zgKrx0v9kqyQpEPS8TssbZ5lMZOnDz1HGFgaOFxinnL1pL4tZnmhuur3S/JDXGaf
+d/uklC1/DtCKYzfiNYMrlko9Z1Igb2xN41f9JUtQrZe4q+5Od4SEU23MmxldVCSl
+Zy7cXgUxKgT5CaLp63F83Rb/HJrivfQErdHugtTMWXFAUQW41n7lSsQvE7fO/7tB
+hS2TmyOZTjgTW3P9e/Uy045dO+yQM3Wdhot/K+UDLBbjYJAGbq8KcXrrJs2ksmU0
+9mHrBUqkCbqkgd3gnqaiCSg5kbFkZt1Tu4pWjSaUH5w3sWwgixbAJk3e2TXufi4c
+LJZufDhs6pZTyImtSfLCx9YWp4fzQj3kh+5WeWUuYHR4lQNSPdZs9brzaGQ/p94E
+8ioIdWSZLIpDWVoUq1qQQqK+iD9ePi1A4JdDO7sdM3jxlLwx9tiE/dG/ZZJSy4nW
+ENVH30jwp55i8ol86swsejGjQeXWkQIDAQABAoICAGGl+q8GLPkwl0UN6k/8N2ek
+GsVblAwMLtwSuq+awaUMhcO3D8u9niUgUES7mXTsAStEGNkaXVT5yYZwcA9HURk3
+RkhJuuDqCJSTlov3MkydHKQan+mIR90abKb1GI+GI3opf+n90UeUs5HnX1PKx+AX
+z+hZHi3dP9br9LhEbBMDkwd/XkSMbWy+jnybBdqd3x0wtN7vnBOg0l3rAouow5yc
+STGR9FAuGVQpYrkMhsPhRZCibZyHsU/jVUi9FQeLfESYA6B931jwxJmQU+29SHdD
+fPX+kb95iXWv3S4of524az3D47DWrAIUtImCPOTSwl0xqC/YSZXQNQ9vbRQWQFtu
+UHo0gZODk+WbYlPEG03ykMIN8RqNzIh1MNRPS/tVLcaXp5PzkVod7THaSuoo2Sx6
+QfFBGdNZSxrXb4mpNg3AJD7YRyYnYQAndDSYpp8ZWQt6f/jirhPOcufSSGfNCxLl
+M9Jyk0tgA8zh1M/k7ivz2fmkYreklQPEBBmxOawgzkETEUiUhC8puLkMUJElxwvW
+2o3Z9rikKe5EBZPK8MWsrfmS8zl3/UhHIW/Hqu/Haj7jqevFVVtS2QqTuaqQe3kv
+95hwb5OBhD9Dia5w3LhXgW6EWtdyLffy6W6/4goBRkuPswoawaLJpmMtF8gh2U40
+5dOSROAghyEWEk7WZPqxAoIBAQDsMmq6HyDwPAhHiWtSvn1ju4fAvD0FMhDSPuAI
+VBpMMJkseXL8f7h7ihYUioDOYl7vSaK0hiadMof6zRKTLCvChQdc8d/DDONC0BHu
+Fovj1PVOF3NOkHrEUMayOPI/0whOiVv2AH/kIXTkPU3hBWo2jjuPrpcRGapLam52
+uUbayqGR1ZnaWXf13eRGVVBZkGRTK+DjfZy5txAWZ6DsqqOhndwb2jECgk4GA6aw
+DftnRR0MxmUNAeVb/20Aliqx+0Iqze3ZxIeku4Gm/bIQ12Qrxy9ZSbVJh8EdHDsz
+zVQBqAM6w9Gg8wbwWU272M5xEyH9dnjPGqA8UT1gWSBXpDlvAoIBAQDYPY/FcceZ
+bgP+S/raLn0OonB8blfCuhVA01uXELt8eU0QjBYwA4b9s3Q7MJb3wxGsCnku9yAs
+089AfVklk810RqFdHBv9TGVwP8tf7s1ScNJrmv08Evjbu9Kws1CE9RpO8qajwxaz
+se1IZ2EX5emixhBc7EjT9uIH+gA5XOZPlHoAEUDEZuOJ0JA5sPfnRp63OaGQUNcs
+Mbfhkwvlq5ml5Tn+OKHhE3Z9SckK5P+aPycgqBH8fxx1JQHEJcX+nVS+n/M8SbMS
+HbGtrKGACEpcAHAKsSjVhXvQHjENgkcfGoEjszfBBFLy9rYVXqGkV5Um0c+0VVXi
+8ATdGU9qbu//AoIBAQDi2R01+rWo5Q9SnYHNK5TEF5UvH9s/RTFwq+CBPz0ulbJX
+S6GLLqOhSyMfwVIqZcIl8cPpu7oUWjbNQu4nGVJB9X/33Xn6HEOcpLfDwjXCsIKU
+6OLevtaZ+7aJ7zWC5QziWPxQjXRHR3a7ysEkcA3trbc4rQb77nlnCyZislmBwwFg
+ThUA59LV+bHHdyK/knU4iDjqZHcEyvQRgJ/HDbAwhaujuHA/p6SGFDWgex1Mts1K
+urTMxFhjfjNTT+ZboCSRdcyNzTo1lbzVBG1jzWqwvRIVoDwUDeUEL1wQyZB4MsQ/
+SVjpSuAMMMj+tCC56xVHGOS4jCr/I0teYNs2MUzTAoIBAQDQnKtr5vWRnmI53SEX
+hcvd53YvhOAjmxPP41ez6E+HqRpgwVTSY0TC0nJqe9jZE5aj68K3PXAL7xc9dvAe
+4XVPHKilw+14s1AVN2ZDmYT5aKCHcRGm+AKfMZb0Izml2zPTQCLlT9tB5oAs3pb7
+0DFSeFPm4Yjs/HtZCKVYsbf6xBnioMJj94LCPLQ3A/RVaXrK9s1YBbVgDGMCOrM6
+kg77zaXiDM6W7gjcm+dZHE0+iHh998bKWfKhTN9kVLCrjyrncDXfTpZz/rOgAjAX
+7WeXVFDC7+CeBVXKFKZsCugEKLS3NTmvezVu8fX9rbqxalEZD0abCcx+z+FRUA6e
+doIPAoIBAACbwNg5KH8c7pVPOB3uLPGWIWw5EsdfV1kjXhff6L+eNGs55mRdJKHP
+uSwMUiz8HWd5Lbz1Kz8NlcHfMDkgcGKoGV9K1M1n2fTI+ppZEqIWgT4Q75nV7P0S
+qvWeusPN5uG8f77TIN+oTi70zloqDm9dO3Zv7yERDirXT6hHkium8KTSYMT/bRIj
+8/W0FOdcqg2yPKzT+ChPBqYRZhRkjjYDGgsT94tR+2xuLBcL06N2KFbqILHj2IO1
+jv2qqdCVvfg7KjxD7oR3/Du+I8KS8oygAMm+Ymzq0gaplYvH8JeoivwxsUzkHTiR
+D8JZryY0UsNKUWyTDZy8Zg6qpiyUuwY=
+-----END PRIVATE KEY-----