From c3cb8a5b093f2c270894b7aa0fce7c396b775d45 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 26 Jun 2024 18:51:05 +0000 Subject: [PATCH] Add oidc docker example with keycloak #1566 (#7372) * adding oidc docker example with keycloak #1566 Signed-off-by: AntonEliatra * Update openid-connect.md Signed-off-by: AntonEliatra * Apply suggestions from code review Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Signed-off-by: AntonEliatra * Update openid-connect.md Signed-off-by: AntonEliatra * Apply suggestions from code review Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Nathan Bower Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> --------- Signed-off-by: AntonEliatra Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Nathan Bower (cherry picked from commit 962d0ee6ff669332b756788db5f694443d876779) Signed-off-by: github-actions[bot] --- .../authentication-backends/openid-connect.md | 18 ++++++++++++++++++ assets/examples/oidc_example.zip | Bin 0 -> 19096 bytes 2 files changed, 18 insertions(+) create mode 100644 assets/examples/oidc_example.zip diff --git a/_security/authentication-backends/openid-connect.md b/_security/authentication-backends/openid-connect.md index 8fc29e262f..8efb66fbb6 100755 --- a/_security/authentication-backends/openid-connect.md +++ b/_security/authentication-backends/openid-connect.md @@ -413,3 +413,21 @@ config: authentication_backend: type: noop ``` + +## Docker example with Keycloak + +The following steps use Docker and [Keycloak IdP](https://www.keycloak.org/) to set up a basic authentication backend: + + +1. Download and unzip the [example OpenID Connect zip file]({{site.url}}{{site.baseurl}}/assets/examples/oidc_example.zip) +2. Update the `.env` file with a strong password for the `admin` user. +3. Substitute the `{IP}` placeholders in `config.yml` and `opensearch_dashboards.yml` with the IP of the local machine. +4. Review the following files: + - `docker-compose.yml` defines a single OpenSearch node, OpenSearch Dashboards, and Keycloak server. + - `new-realm.json` specifies the details of the [realm](https://www.keycloak.org/docs/latest/server_admin/#core-concepts-and-terms). In this example, the realm is named `new`. + - `config.yml` configures `basic_internal_auth_domain` and `oidc_auth_domain`. + - `opensearch_dashboards.yml` should point to Keycloak for authentication. Make sure that the `opensearch_security.openid.connect_url` setting points to the URL of the realm. +5. At the command line, run `docker-compose up`. +6. Access OpenSearch Dashboards at `http://localhost:5601` and log in with username `testuser` and password `testpassword` configured in the `new-realm.json` file. + +After logging in, the `testuser` receives the backend role `admin` from Keycloak, which is mapped to the `all_access` OpenSearch role. These backend roles can be managed using the Keycloak Administrative Console at http://localhost:8080, using username `admin` and password `admin`. diff --git a/assets/examples/oidc_example.zip b/assets/examples/oidc_example.zip new file mode 100644 index 0000000000000000000000000000000000000000..e2d3cbf951f76a2054e7f23088de68f3efb3aa6d GIT binary patch literal 19096 zcmc({1yG(@7A=Z4{ za^)KHL=1Fi9WcNbF>r{~dNh0U*G<1|{5MG5uD@9a1Qh@P<&V~(;+N5ov9++)`vp;F zmXUs2w2}VX=RcU~D8Bu32MwxU8Xqiz@ zCBz9hhUNCm1jKjjOtgrY^NCF94y7*LCORLTDdkl4aLGJ$Jx(O_8N45_Rm|i{ZA2Bjsfp;i_AR;AhU+s z<_XN=?+e274Vgx5_iaz$5YT~bER3(ac-zTudvx^cSA6}!FM|7u0OyZ^V`OftXKk)! zs$plNXKh2}WM=wH1Q8$@=oi06&)e${5u_H*W70tb<9Bk0{A0k5(!N&jwuVL&G6o)s z{qlW`vdNHgZgq0eP-&V>uO|Dxo3o_kRS?iV2=3x=7LVeGUiMG+;;90Y4#f{u4-Mg& zW+`B?1cnmRp{c;F?O}AyDB!v)w>Sp&zx`7BpU4V*~goz zH)9O4dZ?TChj@as;9oc#yi=UEgbSZb)%HpK>c7e!%=sb0 zvMZXRS-pVoG)Ui+d`F{%`rlP#ytv6Oeg{jm^Py(CTE<_=?Ba&w_G8AHG(M2;PWsw2 zPh?pXTN2!n8Lr1}3A5y|%IWA&t*MMFU+paGtVKz)!`vM9FmD;}!a?>40aQsH5atJ}y7Ff{X`|Oh#8)>~qM~{T+C5Q>GXlHf{{*5Ny zu1z+Vjv`vjaBhq+1xWZqPIMWR5}swoz>lQM$ZfZq&yKZeF$nlZr8;$F3M#WIF#0ai zEa@S2Cxiwm!)k?+>)n+LASm77hU&#sU2Qxz@>Vra`Z#yd(V>^&1K+-C2r z33hnZ8`FS85nAWKQWOnUA3jY%Jm3V!K#pG}s5QM5V)U-nag znVedJQkNFYC6SqS5GYK^D6)fqrdZ`wQak{^#SomMU;XH7{JcfVe~zJr*9fD1jiG<{ zqCeD#|1O;VrbVuD8;A(On4YM z7r?-JG*o_seW>8`0qKkP7f~{3#x8Ud+`)A6DKX$t6|7H5vg*77h zytZB&IV)`KbSRRxjZtLGQyMxT+6D}erKE5~@L`9Qmi298uKL7mW*|an9jJzI8*x!c zOu>G2mtbgV33Z-~Amq}aI+j9=GRBYRmL)KsNjdJsYHBV3r>LhYDjETpKQ2^$X(5zg z_h5*!kg~(vd_0p~j>pzm&=lZ%sjx1q>C)zWbGwVikYL~|v^RMF893K#P*DAi+y4t2 z{4YMIrJ*?oGQv$8OZ6gIMScGsM9a%=5pZ3XfpGAP6(AT`{^p}-Uj`T26%b)ddYVAI&7Xq6`h$Lsm#mwla1_v(DGU}n zYGUjDJsI_5^>)K#|4D!69XJ*Z9SuRTD2=@>Y!mFONx&icsB9*4U(NGoh~G@4_)}*} zef=%=A7jJX!c@;j!%WN4(#YK4-;HSx{x2Jo-q&*24qO<1hn64OBjb@8`DB~j6552Q zzD8NkZXd<`%^h-GsEN!`F}WX5U{_5zXWz%+HQaNKD1A`c=$j%i@eHsL7O};R4L#^X z(roXjqfUY^Uw#U`7#2ONfCbS6@__Vr9hjzQyO_GjZG5KsrE~DE7CT$M?*0wIf5!Hf z5u|_P{=bL$zjz+-|7EtD>W;r=`*G>{CeWX=UDF3U?a$f%^9WD-iW=dM9;MPVxBvIV zeepWR|A*<~0?zUZ+TISv`a1CD@&e|}_A0lUm#?}1=oq#+nt zgSrT_yYfj%g9!8c0o%X0BzyUSkFxkSEOu^U2C6bg1nO$i2t|oeih%4(R`p-oor#Ex z4h4-c(}|Jxl2MctP%x1WGn0~0QAv!D(NQsc1~sOl6q%?lV`5;UrDLeAqH$uRrGKYu zxkHN`@d0%f)j2hwvx0!dY_=88?0}%M*dq{{$oAAoW+poLK%34V1~S@#Y81nM6WE%X`C&8LDZs&APlNV{d_}NixyXupGg1pC&@aB?&aMpSef7qhM}G6w@lOwctRVk-YWrP-)Uhzv zH~Os*aR2pqRV-6(zCZ)N^n?sOjdX^d ziYI;6u6>=$&F%4?$PtM)BXFP^A2QPX#k_g&WN)l95#+QDD08Kf`IX@W?Qzkum?v8| zkpe((YGaCp&kv^QU{r-LaZnRmFEH_y8GKj2c4Ix(D4K>Qokv*8@W4wHP|BJhpWt-^ zZ+M|X+V`JSd{-nT!%qu$02i~m;I%e=m^h{mnBMiUKGkya z0LQ^WU*FdpggDxlWaBZ*7c&hVP2}&*<9tV2 zBP%|-j^zhzpO?EqA-HE6V%$Zz7;#(S>ZHWk(jp&nr>zc^zTg*Sq~X3CZKI%a?Lu{N zFBdo0e=3y=XJ`@Ls zFtfC<(ffBdMEk!*^gk5RV%Y_W4H|g25d}rJ@6<^uh4QA~g^_W~KNt#(saGirbfX1+ ztZA%4>|H5UOYA<%$$%>qmUrDA>@qma=O!a_^uF(C$>o-h@f7{!+xfl@h(hETIuRi) z1V-D08^SS`a};RV9^#IKX4IGu&E2=tN?r5}gg<~X3dY+Jm7kmqK~<-pCkL~Vl8e|V zI$E?H&2lM+P#~Y7w~bBG-fgD)-CXy+evJ|Zb!KoNlr9#DC&iH8_&!#A4s3sZPMt7X z&BA2VvQ6^`UUJGaI?XoUq6yxJouD{EQpOE zFyGP?9wt;+V?gy}3kC5JC&5f>AV|-?BX0I!;P%kj08lLsGd-ReGGLz6RVfk%M|l}P zRJd%ym|zlX5hC$r#Z>&tRt2Ajy(Gp094hX6mYm74L@+?k}m z#MHs&L11ib6Qgx{-LYkxu{`7s#Sf(IXc$aT?_I9nPYi(=d_Cvrw&hf#Xc;l5#*`Nd zU}?G?$Mgr4?8hA4Endht>VP1vBs+mmfq1vT9NX_qN;2cs?|^3)-Qetqi6!*9n-eVz zdY)G20D|Kub=DTU$j#9(;&;Z#TaWh{H-J|#Q$?KR4 zDkqRYQP7jE4UI_wIbCkH_6(oOS?TB(M)$@nQ>Ikko9o;7g@C-npCZVC;Wx7G!4US2 zo2-Hk{WM~vc4K()Nukgz_Ujq-TLCz-t%1%40swf6``-${&l&Mn0LcEP0Q^I8{Qp)6 z>WE*5Wu(0e-&1cxK`^irOZ>eR1M?BUUkX8mm`m563xV=aPfSa<000=Tuz%MD&Gj58 zt@X4_&8UoREX;qIrat}klhTpfUi3O!#mUVbd0;Sx)rt!yROM`&_##|4lcv4tH3lIvT2>$ z+-;d6mM$Qvd)DlpBeYe;AY&FDfH-6V`z_=$7^+@%-eV$W+i3ZB0w}tT>AR_tY9V=) zVg?`Ui%hEWJj;uKmdf3{d9Q+jmp>`K8L2%3BxR zp4v(q5b=Yl;yfc~l&zXtRCUZ?J+6XhI?h7sp_ByK1DdNQGX< zb^G=@l&rs4AOR#vY&7!X`P?WAvg&&xEtltGAQ^Qm@1i}Bu9I!FDsZjxoqoyBAFwn; zv{pcorc;N<%s{4W z3i^*Q%A7{qhFH*yJ-?e|#8#2Q6ISf!;R~VE0M=0L;CX;PHHzz`F#!fpEdd)>p)yxBJjYf!3*6&;9 z5s}>tF)xmuuv%-8Kkt;r zJz+mxJ=yf_G$5)+kI02d26rnaFoU20;eUXV1TAMk>}9=@#Fbe2o@#gLK9d~ON}PX! zcLRF347$2B-N6Hq5KvcqCfPTM)gcOW2Ga$CS_)!2HCW~QrKqAH2A(ruDi~K`8{wmZ zTCqGU%oa@%1rV&IpYDgnI4P*;KK1ZPsJb$Na9h{lXZMxdFE^}8aRRe=bDXzCoqk-{ zKbDr7G%Cq?H^E3ed>;tzW^`Gw1v6R>eJYCGP$K|USodFkk&dyohnK~j~0!Rd9kx>i~+)vg9 zY^QaD2S+T$H2sRqNH2m+NOmsATLjbpK|qPeVL=GVmM`|j1Adb;VaX8+y!xWt zug2D21EOTqBxL@si`!0y)?GHT!&C!NKc8b1e2NV3)fOS#fY;%uN4EZ@eYTW;FP{xt?H2a-L5wb&gpGX9` z#Ao1y#IMpNf3W$dCo#dF5e#>PozD5DB{fiyem@C$D4pm@rATPVE;YrJ2zq?>QL?-6 z&eH;-L51@vl`?SlysS#W}V@IKRKw<19YP5+&ovP79lburDij<#5D~iUQ>8lb#yFlpV zm)sgPWs5pNy2O3Q_zn(ks1#kaS@a1u@n!;8-a^nc71*Yf55^~wA@PA&Ol%ru%Fad( zmsYMpS%I~fnBbrl@oNGsAT;>xNs!=@Han2Vd^!i**~{5U#NmP;FmzJp0-{V%;Nw;~ zn*reM7Jqv{D{!!Doj_^;Cod-%Db9pan9=_G&JgM;-3V9f-c|&elbf7%EAWsQO1`yK zRI%il4C!OuHXbOYTtE)-0VQsl_8=EUE>jb}cE8B`1k40Wh?%H}fkn3P z4F{N2aZOl;Ez6Gbvy^R@6oBGzBI}%8ocMHe`@m$DFE$57K_^L|MQec8NkrgMRsrzn zATJ5P*w!xL{g#f3_*Ouc8MNex_eMVwCm6ol+U?Qlu8f%OzqXT)f{)pvN|#=x?O@#% zb(R`BW}euYPemYpoIUH#_IOSldTG4x0tZ+^u$7rwE%ryhc_*@3dKvL1p*40}bzliV zBHd2&_;DAsXmk+_>#8O;RGx?@5Al2@gosPVPT!)|xDtPP;eC20-;J?kdnbjHIukgS z1&+;Vi(fjh$v^frBPF!D1hl>sI9+bVA*6rAtjVx>ivhC1=sgw1nA-$A;xjFRhj^y~ z4MJ|@)GXAhk|)~}j7kOxcXV4N)S(?qzBANfZ|h2GC)OG}^0T_$ybnv-cPsum2O;`V z%-!H5OI-DnzCvYQX(c3UtMdB1*<|$h$#gAW2O=~H#rhZnZC0OWYGZTFDjwwNi0+UsiIw`{brdPq+vsp7U07W!m|B`*No$ zcH`63N#goRC?96l154M`BGxQv$knDF?iBG8K>vjrqJgdvvV<4p;B!|K>}W(pCRkUz;0lUXiFRIg~C;k(rw6u29B9I=@aVdYrE*0c_K ztTSSn&WnxeS%14WOX4RZ|MlHA(Rfkgo6(q(lWxU4y~( zrXXPCajf2#0hp_bX~lUm`lDjAJ9lQ?`v`00J&Os9di*ON{+f^ zyO*etN;iv8ld#HI5XOP;6P@u0VkikW7fcHhqL>?K%YLIEa0N*shw|3U@R#YLar z5=2bxmt%q z^Qn3B2Hy*3@`3Vj&q9I2O$E*oYaT?xrHzho>$X+EwN=&h#Hbpm=kQ|^@@y1L@}S;# zoH(yLx))*&h2Gm8z3-sCZ8<9P+eqcl9`rS-UcTQpSr5a@tw5T|ztYD=6Dkls!R` zaKLz9J3{~Xo!GW9BJIPA+X-O-sVZc{wYGbw!o5%t4YM<0;`y_0Fw0rP}j}Sw*h28cE%=hYL8{Ta8l9Bie8Rmiyw~=_OEhloLDPZ+cO(r1?t81&^1W>ju~1 zkq%mWC$y=L2_j9phoIBu9izk$QakbI5~G#hU1L>rL@RuN`P-!=w|=ZFXf zrP=4}2HUPpA<0p4@^(fKk7Hn@Uv|)OKJlH;y=3_EexzE zbI+){X9b#1U!#1y8%sIa8@}7xdOYXsQQyHYoMn!~wdmIEqZ;MxzIft~K8rO~zNWr# z@!@n+sJ+QEY1?_KtzlIVchCB2E_af&F{6wj@=QQiH4AMaojGJ@aM<+dbx~V&2K_Aa661RFFllU z;;nGp%N%BLflqZ-H55*#hu!s6wuC+pJ0m3{iA!ve_8X5%UpOuHu@AwS*pwH6l2P}> zT(#%m(){HFLC&6zo{#R%wB~YWc@KjkW^0YLLOP<;63vayjqUJsY}IRvX^92$cVvhj z{2}e=zr}aCOnRm#*>dI7&t-fee;i~TK%#pw0@S-od+GPpcx>#aRADZja7bCmkZja@XiAhNR0|AWmI zxI_#MOSCR>As$PnFKgWT#Po`=9&Bx?EFKYGy*vr{6Q?c)Bx;2`zt5{ang_Kt1|v>NHRV~@IK4S&k?TLYtq~%?VCDK2tzspa5cv>E zUkb4z5*WUE!iRLUWO*Y;YwWufxG{BFr$7&hPffMKf9W-~s`=lxBoP%mMqo+rR+ z<{;#E{hkx;?&O>tYA=w-0gU6Q)@9mv9_gGBPW~~)mZxNvdS@8C~pKvYF< zTsQc~fxSHxN3bldGmq;TbGo(&R>;K%c6pB-^4wLU{7D)r`}Xvf!uT#u@)Oait^`Vm>ZuHcAu5K<%%W{s zo!TV5`a4{WUT3ulSwmft<0LV_N|Hu?GnJ(?TmQ09x6GAp`;DNg-SO-4iP4H^v+_VR zfl_X4qCnaOQ}M2-!U5Nb;zqv>cf&~6S`8)m>L?{sGFPAVUL%`I%W#uKqHvC<1jfqH zY#P-0i!S{ky|HCX!l|eQ4#juTyt)z!yI$*IM?pu2a{}dyU0b5|sN2RZC)m2$i`P{25BsjekZ=$w8wi90n6L<_nju zi%_Mah89ZYq$qe>SV462E-ZHq$+gHJx_-|Erx26iw5=7YUMQ7^ZPNCb?P<0#+H#xV zl9XOWRc-|xeYJA4GLi8>3-h4KJN>}VR)xz-RqTxvDscttUlCj|x{>E-7j&|(^r`br zf+J9nT7<5VhmT2pj5BkmkH*e>KY+X0_1h<1J8zay_!@mA)GH%^$TyXhAF7{8mJ}`~ zrrsv&lLM2c7sJe!pOa~*2q+@)KA}7`Gvcw|o`*Ue?@urn8sLb}taeFj;3?GYcvpXFyTvEe@1d4Su<@=s*u!hHFDT?JRXV^ar zEmL-0o?Nx->^y0&ModLTayAZC?)6`m{(?K9f@2pby~zk1Od1uHS)MdR>oFmZspj6H z!kEUuuAN&Z?}?bMLCoo|9VZNDhRzascU-yo9Nn4DLy}xOxzxv&0JsyeX(Z!gjkb6Z$r*ffv)sH=40viWjw1Esbc-WY ziQ#DIi;)H}I#;s1P)Y*>9#pcqLqN^+x8bcOl|kv$n(Tv(Y0XMqt4xZ??W}~A^o-Td zCP`afz(ZTuk<}82DqC>L%!HtJhv&;*jxw&CuRKSp>Sg9Puk5O&Qr^LPvA~=7USQf& zNjgsB-6NF`>L6M;nr_7lWu#<-X3%_N5W7NH9TE)RpV_})t;BX>Z=NEDf!$(EH*|8^ zb1rM1%;1Rx4VhpEDz4#5h<-FMNUCnxOZ_v^h z5WU80D7mk+j7Z3)0)Q7zCMGdLn2)w^C!OeOPxStmOsXa zpi7a$2G{V-RzI!7_b1?v^5GAw?NZEwxpnYe5cUt6>x+3;JPvc_}_&o@QdK*e1I-n2ue3r+l~pl=lDU1OFZ zRWyE`?273fj+?GM4itJp*HZmUUq1wZwvc?y-EdCg%(zCC3eeQZ8~xl|EeMqoRzF|* zu(VhHB|1z<7Hnauis-98yN}Sj^r$oi%N{GDB&lM4%Gixz9WfyG_lM6h2D_|`JXI-U z1_x1u@y_?Aeib^YD@LDK(Q0~%e!K%4J{(;#kt>-W90`z}K2VYGi)$cUrK-zk)Vh53 zJs7wHBoygb)}rrRJeNJ|pYtYxL)X`9)G!18l-Gb|p&vSTEs-ibTf{_C)+L(Ryha$Z z+pz0DuabnXd8gM%RM#UFKyK%MZ%M-sTF<#?938wQ6^FrV5^tFg-u$i~UuZPvK+O3F z%5B%l_5eTG*G;2G1#jUSavs=dL-tYXZql5H*%JC#*P(fGE%UBbE3X1u_m}xHnW(#l zbewbB08_K2XQXRsa2mf);WeuOr7GE~!|t)Tkz=Wg zAp-fBh+&`@8wR9nn}uhVo(mh;T(>BhP-9&L(a)2TkCn}jM){?ysfdrPvaLu+U znvvNNn?xp`WO%Wl{TEXP!g_9pb7i%X>FN8iPcSGo$|xqCgCq<3j7c*XjnDE~Fa@HR z3#4~)CWMW~tMt#iyGfaY`KijR%D_xXJq!k&(@cJx zsRE!(Tqs80cE5^ccL2@KRo5YHM=Mu0<|!@po6poJ_j+Vsy=U`wZn}qztvFq+@&ld* zKHkSFz;RHhtw3cglim^o@>FMsBQq>fCGo<1lwqh|2Y{$v){U)v^!}knSM*uZr6JB$gZF( zKPPPex{d7E@pggyazXn{Q*IKwzOzSZq-5#_83naj!mX}inu2r2*m|La0%{Ul)?YZh zUw#qFAFDQjEh+!A1O5c#ST))>n-Qzb>Ox%o0InEt-SKGR zhT&lqn^}bYRIfGg`O3kMOnYCVptxzD>P*v{ zLp#oAwhRk@?bUNuQ@_as&F!68(l6nM8KNMXpE05eWNcjw4OTb*xc zofrR;K&OZ=vv5pmrJ6D+T9aX+n`rDHUPsXf#P&nFqjs(M6y}2oy0IfVXjSxmzoIaT zEi(arVmeZF*=-LP06R7d}g#iFW;Z-sYnLUWI3>(X`I?E6OmH z6#7)`5aa4o`VU9S6C_TQzNuDD3M!_kbRiV`QSav@}Y4m3n-?b|+xOWvIFnU9%UrmI0 zHh5;$Em-Nd-K=G)_EINpSs;xlm9a0o!sG?ezcn|IVqt0XkJ+&lcWmQvEJ(yM?x8R@ zj_cL{rF4ulK=V1rb7kQ3no|hx9@2H_JqH%SUIQTNA~}TB0jpX}E=3r}YRQ@Oj-|<5(xVWj za@%Dq`DP|rp@k1eP>hB6lE?Oxuphvg^z^f<#ig{J{NhxK(nG)n@jr4?%2xK+X-j;t zA6U+D-yLTg@4nKAqFud?ml_)7koPE>bKr#eq&%#7 z&9rM~rO-}AzWHgQ%xEIT_zCM2<-}fSjHnLuZJ*&lv0}BzL0J1$m}a`jJL@j551*V0 zBp<&LYdj>UHuZfYe?96Ct>W!ax35`g9v_aRW1mIYFm>Bkvd`E>SxxzVl)Y^79-&x! z2rruWq4?c&G+AejW9NOr_t}B&HcHxybNPe1iHcsPsde82C(w!-lcXOt>r~w`xdeMU z`T@NgclOF^lUM!b1%uPoJgr2>$t4GRCOPt2t$mOgF}K5GN{&xv zZi*j8g$wm+%Zqbmst?n7X4(sc3khB5(U{5P-8VzYC6*b7+8t|Et)Z#dzcc%3*KofJ zI|?SOg`0iu4X#ic%-HC6^uHw1b($>qT=0>u&}*g8%EDt1FY-GF)#p%z zMRVy3L#ZmU4|J_ z!q#%e{)pMf-bM%W=Fp$RTnNOosq9P*)JTq$#muA+F?*`}uJfj$hR2KS8V*NEt6(?F zM|Ce6U4iEgG%EzZ`s-lA`upI8R!`a)=ZR4bB7_)^>hZ!C1er0xmSdPx>Mki(qdX!p zhD}Pe3A&D15lCXPT`iTVMGKi|PfaIA6H(bJX*KQXG_I@Wo$K=KnV+j>#r^O9la#Mn^q0(lZfniC$r zM;bdBLC*vw+;ICr%)xt=YJrxD`bX>dc+zK%o3W9qs#|L@8NY`g9g>Pr=F=>?d5Vv; zHMe~Jfb~^%sn~kgco9rqitvy_^an|sE{6WqAMfYd4YfTNzh4r7)hQyTAO;CzJXS-Iv_V>$qd=~3ZM@*^~w zE%pQegh=G3xdqihud%oLdY>tqweqAb4|FYiHYr127z&7z>tTH$cnvy5Kvmq-mO`qj zc7#$qaQRO1ogKNSx~>+oT^pb?jJRGjjquVm$Ngh~Iv7 z5F8^^dH`NqLHyAgJ7i{+=m9vB&Fle}k5FH`eF#wI>?@0S%hH_u-alF>M25$aTA!1% zJW*=X45|x$;mpZb9A;w#%*2Bi4R=n~Cb-C~l_d@*QK$tnomw0ZM=`*gG{ zsQQ>h+aK<=lVtNk7wui!fYl6)AUZ_6Fjs*C-P%SEtt_I0OW$E(1_p6`MihtN1G2^Y z9?H66?}kxb&Ihlu+>~QdAB_f!4YC?zm_G(OP5gt%N*T!=Dgg{lDB1xQ0t1T@Z3Sg- z4jmkgPj;YCRk1A%xuq6;C*IAQnfsAA4z^Tt#4|+5_i`#;F*r;uExBDOE;ngis4+YZ zEWh)+Jwq z-EO6is8yW8h}F*@!S?q`>`j}vFd1m zz0&L>kIqRf9SbgI7JOC08$9d^;m>T{zuslWY=59fg4)}-a~>(q7rLF#6h6{nC3^`b zRW;0~Z(qOWIIy(3K}6&Tia~QkzxvW{KX~QwAFiJ5>9jIDwx^|E&qeXwdIbf9Ns4WQw5|6B9&)r z^KF1b&E|LOokD*0y|x*^&lbuux9|)E^26e*{cRy>cTSd56oWC14a_$(8{0C++D#R@ z4=85BgR=}=)Zb*LE(Z1B*)B(KIt9G>BlTDz92cUgQ2|}JOYjrm-UElE6 z_#BQhEJ059g0Xt9_0Vb*3Ab#r!|aqh&5=N4L??pl_C7277?hqRj|vX8hgtXxxvUwt z%T_W6{SF&Q9OW(;3DNh1^kwvOm=zUam*onFHB!s1>p7TUW}^w~n$Mieh(I!qCiS%x zXEN8N#Ts0gUb0q4`yB_Ws}m0B12TOdjRd%{3eAlV+OY+p20Ylnr7EfyygvZeqhu6z z5oGUn-^#U{o0x)Evjm8tYvNi5T%d?$EaG&7xgWW`#-c%epXTv;-(IPyoZGN_d&5Sl z;)+Mw-Y7ZI3+T?~7H%8!?1vZLei-<#F8Y35E=w>1Fi+%MK6>Av4QkKsREJlzrOxhU zO|6R$yYpvf)`!h8Rl~lyhQ(g8y8gIgRrGh2_{;@#GGU>6`P{X%w*QR2T#UkxEO_}G zjn%%sV^gQUAD`DBXXjkF>5^fxZUZs~wVz_{#Wwdn3DN(aNdjbuh`JWGLn!)V^#_&~ zH4qjYO9@Y=h7~j}wf!{Pev6OW`><;&&1^Xd*bnbcqE{q{{F}A)V8o}O;)Wyy*Ox0g z#J0RJz-v8x%h$tcn9!nb6YiNhmF$@`d&yIY06)=nT;f{y4W~#ilcbN2(ENZww~cQY z=$V4PuALQ*KNF{Y)ui)-tA2A;{+YQ3=PB~~^`MIVDX)li z^hPHj8i7VCRQ>9jJ(|T7)S=MqDZt5s8)bv+6K0Xax-N>8ZUS^LwEl72rC`47a_4X# zsqA|=zNMX`tY?w)8PsN_9*p{uXNZ}#UX)KJHOzI7!QP9W7@mJeY5cLBx z_iL%Mu_9gJIXTP3!G(GQBm^I48Mvg>{NjBP!PY-bi6J?fz+(C>WIc_^r0TjVS1q^( zoLdh(Z9nKpdJo#zNz6i-NKAOrU9Y%$U-R30IqjybR7gwYjE!&~z3a^u5E^+viqy?m z!6b4e0Sx2>Q?}kT0UI8vt#)PNYFKH&gM8dEf>2aZPzM}X{b5ZDQZK;l8|oE?c%(7B zZoMX^vkR%2j5ftVyA?7X721@7(U2J24?yf_q@{_$zX(VSN85x-)S`e5izR=^j{-e% znpT$U#(l#Q8tqCw>>;;5jxW*6iq0NQNBchQncWKKb4zHSlN|NI_w`BP{g-=ykuH3B-hcVF`YWUbyoAbr#}}$a8^*|j`5HoeMKaA zpltfQ&SjR7l5E8wm!D*)&=YN*E1ghQ#kHPby+w!wkp@!NgGvv?gK4Lb zaVFBvfa%(!%~{_$a?RJazdUa|a6SJ*ev(W8kx?cC0C+p7`rFCfpO3JQESbJ+S`Ur423p z&>qG0RMqE=bhOVpx|+huv6_dwn2uP#9QXaquD4wGdXD+`B)I&aNN`QBw)zvV{}*=H zzmNO7|1~SST55rGLE);^#XR-Y$dqRgS#GUcdZzZ2oUoL;Sk`HzjY^GyHr0RL{;1<;j{ngNzT91 z^1ojr@UyZvrv19>;ct7LgazcPb+&4<{uX5xy4Dr`^{|nv! z0QQaR`!iGajqCfXWO;J81qc7vaQ;HyKY)5;6aCCH`h7Kfe%1H8Z2Jd7(LaED zQ}#2v=Z(7bt7Lh>zqY);s?`6W_a8vM4PHNwWN+M|UnR>69Qh9*|7Q032Y_#iex7H3 zU#|PP{u^1iv!2Q>A(-$$&*HRAvfb{wn@LB{Pc;3GIKM&Ff A%m4rY literal 0 HcmV?d00001