From d3a64c038c0363277dd1696eabb3dcea20a30b62 Mon Sep 17 00:00:00 2001
From: mamo <mamo>
Date: Thu, 7 Nov 2024 06:53:12 +0000
Subject: [PATCH] new configuration version

---
 .../k8s-nai-6ec6739e824c8e56d9633622.yaml     |   2 +-
 .../opt/nevisauth/default/conf/esauth4.xml    |  94 ++++++++++++------
 .../var/opt/nevisauth/default/plugin/.empty   |   0
 .../cossa-token-exchange-authstates.jar       | Bin 0 -> 4023 bytes
 4 files changed, 62 insertions(+), 34 deletions(-)
 delete mode 100644 DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/.empty
 create mode 100644 DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/cossa-token-exchange-authstates.jar

diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml
index 92bd3f3..b1af489 100644
--- a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml
+++ b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/etc/nevis/k8s-nai-6ec6739e824c8e56d9633622.yaml
@@ -45,7 +45,7 @@ spec:
   podDisruptionBudget:
     maxUnavailable: "50%"
   git:
-    tag: "r-60e8f94e2a0e0799466b7c8fb201c5bf13f0fb59"
+    tag: "r-381ab3bec11e417862b3e34bf6abedfee5f9346e"
     dir: "DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai"
     credentials: "git-credentials"
   keystores:
diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml
index 9443fb2..b3b7ac8 100644
--- a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml
+++ b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/conf/esauth4.xml
@@ -41,57 +41,85 @@
     <!-- source: pattern://6ec6739e824c8e56d9633622 -->
     <LocalOutOfContextDataStore reaperPeriod="60"/>
     <!-- source: pattern://6ec6739e824c8e56d9633622, pattern://b67f81a971e4c08aa79040a2 -->
-    <AuthEngine useLiteralDictionary="true" literalDictionaryLanguages="en,de,fr,it" inputLanguageCookie="LANG" compatLevel="none" addAutheLevelToSecRoles="true" classPath="/opt/nevisauth/plugin" propagateSession="false">
+    <AuthEngine useLiteralDictionary="true" literalDictionaryLanguages="en,de,fr,it" inputLanguageCookie="LANG" compatLevel="none" addAutheLevelToSecRoles="true" classPath="/var/opt/nevisauth/default/plugin:/opt/nevisauth/plugin" propagateSession="false">
         <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
         <Domain name="cossa_realm" default="false" inactiveInterval="7200" reauthInterval="0" resetAuthenticationCondition="${inargs:cancel}">
-            <Entry method="authenticate" state="cossa_realm_IdentityProviderState"/>
-            <Entry method="authenticate" state="cossa_realm_IdentityProviderState" selector="${request:currentResource:^http[s]?\u003A//[^/]+/.*$:true}"/>
+            <Entry method="authenticate" state="cossa_realm_TokenExchangeEndpoint"/>
+            <Entry method="authenticate" state="cossa_realm_TokenExchangeEndpoint" selector="${request:currentResource:^http[s]?\u003A//[^/]+/.*$:true}"/>
             <Entry method="stepup" state="cossa_realm_Selector"/>
-            <Entry method="stepup" state="cossa_realm_IdentityProviderState" selector="${request:currentResource:^http[s]?\u003A//[^/]+/.*$:true}"/>
+            <Entry method="stepup" state="cossa_realm_TokenExchangeEndpoint" selector="${request:currentResource:^http[s]?\u003A//[^/]+/.*$:true}"/>
         </Domain>
-        <AuthState name="cossa_realm_IdentityProviderState" class="ch.nevis.esauth.auth.states.saml.IdentityProviderState" final="false" resumeState="true">
-            <!-- source: pattern://da13d0fe10be58add377269b -->
-            <ResultCond name="ok" next="cossa_realm_SecurityTokenServiceClient"/>
-            <!-- source: pattern://da13d0fe10be58add377269b -->
-            <Response value="AUTH_ERROR">
-                <!-- source: pattern://da13d0fe10be58add377269b -->
-                <Gui name="AuthErrorDialog"/>
+        <AuthState name="cossa_realm_TokenExchangeEndpoint" class="ch.adnovum.cossa.TokenExchangeEndpoint" final="false" resumeState="true">
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="failed" next="cossa_realm_New_Authentication_Failed"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <ResultCond name="ok" next="cossa_realm_IdTokenVerification"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <Response value="AUTH_CONTINUE">
+                <!-- source: pattern://89578db79d2bc15d55e11141 -->
+                <Gui name="Default"/>
             </Response>
-            <!-- source: pattern://da13d0fe10be58add377269b -->
-            <property name="out.binding" value="internal-assertion"/>
-            <!-- source: pattern://da13d0fe10be58add377269b -->
-            <property name="out.attribute.email" value="marco.maurer@adnovum.ch"/>
-            <!-- source: pattern://da13d0fe10be58add377269b -->
-            <property name="out.keyobjectref" value="DefaultSigner"/>
-            <!-- source: pattern://da13d0fe10be58add377269b -->
-            <property name="acsUrlWhitelist.uris" value="DummyValue"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <property name="clientId" value="client1"/>
+            <!-- source: pattern://89578db79d2bc15d55e11141 -->
+            <property name="clientSecret" value="clientPassword"/>
         </AuthState>
-        <AuthState name="cossa_realm_SecurityTokenServiceClient" class="ch.nevis.esauth.auth.states.wstrust.SecurityTokenServiceClient" final="false" resumeState="true">
-            <!-- source: pattern://e026d017ea6658b54e0b16cc -->
-            <ResultCond name="ok" next="cossa_realm_Prepare_Done"/>
-            <!-- source: pattern://e026d017ea6658b54e0b16cc -->
+        <AuthState name="cossa_realm_New_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
+            <!-- source: pattern://72e29eb80a951e518ce123e4 -->
             <Response value="AUTH_ERROR">
-                <!-- source: pattern://e026d017ea6658b54e0b16cc -->
-                <Gui name="AuthErrorDialog"/>
+                <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+                <Gui name="Error">
+                    <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+                    <GuiElem name="info" type="error" label="error_99"/>
+                    <!-- source: pattern://72e29eb80a951e518ce123e4 -->
+                    <GuiElem name="submit" type="button" label="continue.button.label"/>
+                </Gui>
+            </Response>
+        </AuthState>
+        <AuthState name="cossa_realm_IdTokenVerification" class="ch.adnovum.cossa.IdTokenVerification" final="false" resumeState="true">
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <ResultCond name="failed" next="cossa_realm_Authentication_Failed"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <ResultCond name="ok" next="cossa_realm_Prepare_Done"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <Response value="AUTH_CONTINUE">
+                <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+                <Gui name="Default"/>
+            </Response>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <property name="Issuer" value="client1"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <property name="clientId" value="clientPassword"/>
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <property name="jwkSetURL" value="https://login.sandbox.pre.swissid.ch/idp/oauth2/connect/jwk_uri"/>
+        </AuthState>
+        <AuthState name="cossa_realm_Authentication_Failed" class="ch.nevis.esauth.auth.states.standard.AuthError" final="false">
+            <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+            <Response value="AUTH_ERROR">
+                <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+                <Gui name="Error">
+                    <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+                    <GuiElem name="info" type="error" label="error_99"/>
+                    <!-- source: pattern://a976546c6a56dc04c0d34592 -->
+                    <GuiElem name="submit" type="button" label="continue.button.label"/>
+                </Gui>
             </Response>
-            <!-- source: pattern://e026d017ea6658b54e0b16cc -->
-            <property name="queryValue" value="${request:userId}"/>
         </AuthState>
         <AuthState name="cossa_realm_Prepare_Done" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
-            <!-- source: pattern://e026d017ea6658b54e0b16cc, pattern://b67f81a971e4c08aa79040a2 -->
+            <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <ResultCond name="default" next="cossa_realm_Auth_Done"/>
-            <!-- source: pattern://e026d017ea6658b54e0b16cc, pattern://b67f81a971e4c08aa79040a2 -->
+            <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <Response value="AUTH_DONE">
-                <!-- source: pattern://e026d017ea6658b54e0b16cc, pattern://b67f81a971e4c08aa79040a2 -->
+                <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
                 <Gui name="ContinueResponse"/>
             </Response>
-            <!-- source: pattern://e026d017ea6658b54e0b16cc, pattern://b67f81a971e4c08aa79040a2 -->
+            <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <property name="script" value="file:///var/opt/nevisauth/default/conf/prepare_done.groovy"/>
         </AuthState>
         <AuthState name="cossa_realm_Auth_Done" class="ch.nevis.esauth.auth.states.standard.AuthDone" final="false">
-            <!-- source: pattern://e026d017ea6658b54e0b16cc, pattern://b67f81a971e4c08aa79040a2 -->
+            <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
             <Response value="AUTH_DONE">
-                <!-- source: pattern://e026d017ea6658b54e0b16cc, pattern://b67f81a971e4c08aa79040a2 -->
+                <!-- source: pattern://b67f81a971e4c08aa79040a2 -->
                 <Gui name="ContinueResponse"/>
             </Response>
         </AuthState>
diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/.empty b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/.empty
deleted file mode 100644
index e69de29..0000000
diff --git a/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/cossa-token-exchange-authstates.jar b/DEFAULT-ADN-POST-IAM-TKNXCHNG-PROJECT/DEFAULT-ADN-POST-IAM-TKNXCHNG-INV/nai/var/opt/nevisauth/default/plugin/cossa-token-exchange-authstates.jar
new file mode 100644
index 0000000000000000000000000000000000000000..628e34f8b58288e6fb7cc2d4187e61f2c345c746
GIT binary patch
literal 4023
zcmaKvc|4SBAI2xknCwLu6w1z65{<PayU8|^C5&yd%UH6FY$JP!GYHv|HOHE<mYl(q
zwX&3DF!nW*CELr}=WM;_J=gQO@8|yGx_<Zb*K>Wo2D+3~tN;KA1YlM|ngNbQak3rj
z^znkJ!&M>Lw=^Uv0S13FR)tWkavdAM$Ll!$rxB)lOIt(T7%l<R*o3_!=;=Zv`WbW~
zqCM|=tBs^S$V`%^NECk=#`M#zl*hyD?)~k)pDlDhEC_pd4__a*f3=?ZyVcGEg+lyK
zV0`IJ&O0Cgkj?-Ai2qXn?&0F#uKvL89>N{zpzdz(>EYz=En(-1K%r_)_x!j_&m2~W
z`<s4M@U2f^NyjL>)Tmm1AyW8|Tj%_=K~Z=3sE;RYM6EZ(LwrrNQLH|<P>HtCsXJ4!
zpoy@=jizIw8AQ!{%yJ(JPd55FbR-2o3gJueo9oHSQrrxdsa^^>*jqaStZVP9gj3<@
z`5^^;5YL(_IC-Xoi_KyFN`7Hpi`L88fGVh}zo6Gek-p%8Z(rt}LMtrMJrN={w-+nO
zc?-@!FqxxLoNSxe)^-m0QAF-iy;T$Q4g>gR1wD0u^JVAqm#3A|#9XRz(;s7G3?~C>
zH}-u^I1e6lK6E1@=+{MnOK|0o+6JSt9mG5<^1xvM)@*4urRLRLDi<^qOBG<6g|o<V
zr53jF@N=^@Xp2E%lTxp1ELI+{RV@}o)j=QmF$8JxPDFnaDN<MnjCC&uLz9+D4eZrU
z3o?Sp`Vw8;Up;I1qr^r<!}*j-9`mpbH?mMgY(2jIoDFK_Esy*3SQ#3Y54=$AsTUf!
ztm>^S`BKh73#2!tyaJ<=W$~vtE5}~ZNgFKMrpNlID_Arb8!a8`9oOYh@0`~uWI-^<
zx0#B#E?V{&Pfz^*C{k#{FtiL48#$nG7{&q>yPSL~dfTsa^Qfq+SLCgVBXN2sg2E`d
zMT(z~BFgKRuOvA%qD&&&xHOF+*7hm5(d6#!U-1{@-VXv*9Ee~&5cf_F;~m4?IKhi5
z4SjGol&fji+#GxbX1;Uf`7naCnPVuhL{n>f$2#b%&acZu&X;YxKV-6e`|kOEyHpwb
z8<?`!Ot{o*aqWtbzDYwL|Ir-P*+VZTiOFhUcD+>oGK#69ppqEKm!c&jRFUB$_nPkQ
zhSmPyH(Z&#&uueQr20U`A-&`M{x@?{JSfk!b*L<kvvZ}7B$~nw39^bzO;(+x5p3y9
zs-A!4V<x*U5E}m3#)EHMWuPsrZR0Mi8iG)GQQ~WFzgK@*wvly5Ql8GISg}gbz!hlK
zmD+DxoU5ZKzT1t`-d?~uXC<%ZNsn-<gI~R}wHdi_UW~s;2I+{ub$=0o=Z3zt@KOrt
zis<FUZh6}=Ok~o~j%cQCx7~O#2^*M*F}eaNn-VzH&QNrl)49_NKFAc=jJz90`iN0{
z-X`|+o}v&NGM@!inmKEIhGR7DUJ-G_r04zn1Blwp68$r^W_dj;WPPojv0BI5`WHBl
z66CsDlhY(Fvffk8#u}NG<13oPBSpAE=T=SjL$|sv3BS3zVA_SYPCw^W(NM)3Zr0Jb
z+8Se=gQ74kx9GO7nMtm)^!JmzNV0C0ljpVA@NQx=vnnXA>I~rcGV<_VrK1=DnWZ6y
z(Q6C>NB4vFX%$s%BuvLijffz2%>AXMb*f$^BeZ9)%!l^Rco$^mKsQKk!f^L))Vl`u
znz{bYRTcx2+yG=6bqNM#S(_p5OZw#CipaK){EbH;9o!0r&p4Tes?=O+#h(*}c8+9C
z;!W5?cGD@oNtUjuIX~OX4l}T}Xli+HlH`|LbIFfy)j(@fvB}qkbRp;$Q!%-=?e*Ys
zYV<>%0UhOi+C;;s_;^-VJBEeUyu<-3$O_jk-Ig0~yT!z{{yi1U?26{<R6Ea?{{CV$
z-~#I~Ub5~WPAXO{?mlbcyc&%izFaMpd}$vW)v6{R{WkZCyL0rt^=&rv*(m-)Q261)
zOzOQ!1x6vy3Y)na10A;Iq&qt2mizB4N(|%ex`c-l@yYU+(_oIqBdcXevP0`P`5F?6
z&Q|K0(F!%L3q7sUe>puurLj`I1kGvVc`R92-1B@$sy;#2d5*3;tHtPhFm!W-d>4)l
zq?msCMunybXN@PZu_0|X72>XdgRolMZ3wje`PZkp3mp>n{4L*rN`%)NSjbW_r8h~k
z+;}caYoU~@>(CAV8`DGAnYOp5<i-nox!%smp>?7=Yowc_bBJ>pUov;7(Ots>aU|23
zyjba`1Z!iR%gHVe5{+UucBDjnHkGt7z(?PpRx{2I13KOb;||sGYeLbKn)H@ZlfL^=
zQc{W@lV19ns!>9l1W1LJ^y@)})i0v1ZKA`mE_VV<KlUy+t&FKphxap(6Do*{oOz!i
z2LzpK8k^F41dDgpCX23Kl))nfqH6ALDjON&I>qHrL_a_*tOqT|xQ0_!T8^+DFR}tj
zd#p!q0jK6WwAnUf_?^S}_3ry*Ttj-E>6NbC1nrb>ik=SPl9VFFW@IC$SwF+S3{=uV
zM21<+1N4n^`HhWp3shl|$+zx_j`s&Ue|sJ{cpH~<E!fHY==s<rO|2=fTgaxzgXvzV
zkLJ~lX2E*@gL3!%i39dO8~&tm#iC*p1E>K27kU6d^q*Q$+y1}3c-z6t$<fIU;qBz%
z{-YDKZtt10XtEvxll4G`&aBj~=d7_0D`VDf8eACtP2w4qT`~DrSByR1NPHvLg}SYS
z@A~^A7arF=H4a&u_+T7}WEp%YGJ{1`$pp@2Hg2Q0r8kGJh3ucU0kuZ-ML05AbD*g>
zdgkRjSP7VXkfvCJd`BQi#szx=oa^8H(egF(D+Cs!_^yvTzED1lUdX%j8CC<)GGou(
zk-P^yCsbX)0Tx(*3Lt3C<i(TxL5St)VIB>xaRjvH1;j<COZIEG@@G-n&$1EieHrK6
zNx|{CLL~u}O^%MKPh7Yh<<0~evr=f@#GxMNHjk%y(~aK8PHS<TpSOp?R9wJ=<`U;v
z$Go^<+K!H80*L34ZsHucS<W==Y)-~>Z=JEhUMjpH#cCKAf$NQT%Cu?|p7{g8Bb^z?
zoK)u%b)Q1$$O2sSYI$p9Xz?rr8ZX1GjCiX4gg9KM9GiCONh6c-rQI?IF87MI$(&mZ
zRxNM(%2yNgv`Pco=TponW5pQDJ;^c=%Dyn7DAV(gysVhCj?}^@o(r-OC<i}ayMbpC
zqSZWBFij#Q+N3`s&AM_qtg~-)#pEulz!JA9*j5qc1t-Lr&4wjGMyy;*)_E&rmIH0(
z8exPLt508nNdeSn61eE2SLoRywLdJRInj=N!;;rCTt*U-xg~|#T(m)_=?PD9U6pKZ
zywseuLsn%Tb7E<Xwh>=sy1UGJW^czKo=*F6_}QP&8Y>Md>X=UUw8VtN%|(dNx1*1A
zOJ;Q|KtxJ@`BlsY9~@J$GF$%2e(as{d*29HvGEfY%s5Wn%tMGeC^@%Xt<m<QiIRzI
zZVO(j&tR{3^)!NZ@Upmwk)=zgUQgZan%yR?&Q<dDty<-<YfkAn&=enOdvP=+G&Gdi
zkvZx95j0K{o9|pULnGhJS-zG#+Gpzf)tIJePBz~F)-JskUlJp{4+rkX*NBX!Nf4%1
z;fuZu`8hJ&FH`Jld4UtyRKA>1_|$_cIF@}Y&OU)J&m5Pg?^4G%A$B7tQ|1N3){FQn
z@2Q9+`PY4B(LD)l`b31y4c}*DT&J9zKe1QQM=dSo;+}oz`$e$EwxiF$M>3rtpn79#
z%^U7ksd1J8kae+`J)8aR;*o<Km|d9W3Gur{R5oLE2GvWGo|Pf>^De_zb&!p=${#(a
zvyH-E)@fsMm77Nji*yKL&3c$xcU8kX9nMKlqT@^zp6oMx;=m8l_iG$X?W9TYebbxV
z$<A;%KP8X0fAu}BzksY~CSbwtN1tAL-p3hv9i6gzYQ<ZXGKgG6pq)uv1&(VK{d#qP
zsMG5x<sX?}G~4x};vRY1JxsYsn`L$ZydDviJ1Aob<fT--)J{<qk(?QF$w?-@YaFsZ
z(xOG6t8t%d12QH(i=|o%2(#mYj_--xa^uzbisI*4pP9SrNd#}{yAr!yXGR65By&=}
zb4+<pG~J9T<P$nmfV|51VEk#p$H5wO8Z%NV?t;RjyzHd02p$cPJjVs5u9ya|x<>*7
znMLxNgT@KEe5^_(99g^cf@M|L#5K``-uG^N(w`e|xtFDomh86_BwTIpC3ge|Ct0-G
z)kFt{Tw4vq)V&I!Gp^1$gnbEVh)f^R3Si;sI5@~^xphSM?l;P_?aK7OVCU@T4KL%E
zSU4heXa<E+H>zU@;cuaR`UoZcPSrP7f@Jk%%Qq&Lm&nXSkNyP27d%YCTSJMKt@8k#
z7<REkUBE37k)pY+oUYcBf;2Iooy?n2_hls9;R7m2C76`?Z^ciZZsEmfER^gDWGA<1
zMnINQZZfuS$HaX_)u7_;2X&~Xk{LMgH<!e?Rc-LJMaIc&t$SSM+}Gf{IeAC=R-X>`
zB@J{>QLs|}f1Er1jUS5{u%deM{sZoQj{OXGC*~6sgo+&Rf5iTRdVihpGp?Nw-4C5y
z?0bAX=DU9jobcTbodnX4kH>-EY46{HC$#rNC&9PJ$G-%Bu;0(|pV{yC0R^Go{we-1
pB>3~>pZoLA$#kH9_^|)mrUtsy$7~7!&>TM>P5}V#k0})Z_zy(2+c5wD

literal 0
HcmV?d00001