From ffaf25b76a167cd9e0260175181314db2d735ce0 Mon Sep 17 00:00:00 2001 From: Achilleas Pipinellis Date: Sat, 3 Dec 2016 11:28:19 +0100 Subject: [PATCH] Add Okta authentication documentation --- doc/administration/auth/README.md | 3 +- .../auth/img/okta_admin_panel.png | Bin 0 -> 26164 bytes .../auth/img/okta_saml_settings.png | Bin 0 -> 25470 bytes doc/administration/auth/okta.md | 160 ++++++++++++++++++ 4 files changed, 162 insertions(+), 1 deletion(-) create mode 100644 doc/administration/auth/img/okta_admin_panel.png create mode 100644 doc/administration/auth/img/okta_saml_settings.png create mode 100644 doc/administration/auth/okta.md diff --git a/doc/administration/auth/README.md b/doc/administration/auth/README.md index 07e548aaabe..2fc5d0355b5 100644 --- a/doc/administration/auth/README.md +++ b/doc/administration/auth/README.md @@ -7,5 +7,6 @@ providers. and 389 Server - [OmniAuth](../../integration/omniauth.md) Sign in via Twitter, GitHub, GitLab.com, Google, Bitbucket, Facebook, Shibboleth, Crowd and Azure -- [SAML](../../integration/saml.md) Configure GitLab as a SAML 2.0 Service Provider - [CAS](../../integration/cas.md) Configure GitLab to sign in using CAS +- [SAML](../../integration/saml.md) Configure GitLab as a SAML 2.0 Service Provider +- [Okta](okta.md) Configure GitLab to sign in using Okta diff --git a/doc/administration/auth/img/okta_admin_panel.png b/doc/administration/auth/img/okta_admin_panel.png new file mode 100644 index 0000000000000000000000000000000000000000..12e219567158d918c4aac56b6c28e80360418de4 GIT binary patch literal 26164 zcmbTd1ymc%5-3ayEtD2opjdGz8l-58mtw^|cqkIw-Jww2iUfBE8rW2?=={4f(Ogj({fV zF+njBk`Y2eDvNk|tNZM+{KQUC{0ma?5b^e7KGj57&0bALnn&Ntf?3zVN)OEJY+?Nf zg@nZC%=4JF0Nd-5J6o7r+VME^Q~nKt=Q00BH47#A-$3lm_$k$7e=PA+8r$1j^RTcuIXN*qu`^rQ8nLi)b91wNU}IrpV|s*O zvU9Pt*L7yHw4?g7lfU;P0=Cn)HLi@)K{qW)6Q2(XrFH}C3KUVNBEBcdMf2)0@mjF5+%Rgu@fQ~Gp@#=9;k>sV7MG*+Z z@y!haad>}!4+4Si?(S}GZck259v&VR78XVh5s0gE#QDe>0s#V9Sb#u>hlhy6U(k`m z!>N2H5NIUJBHs#Rkv)2TbO-`D9qu1)BM`bNBZo(4Vx^IYvq!M(!!yKVH)$h>AaK3~ z$l_qUaH_yr9|T&tM09j?mN0CCbjJ>{?>|8z$tr^#`30waC8x-E6pEZ7nIEv5(CH^`bIlFd-jn&K? z{@OvbMSMG-&cEL42^-rxn=KtUyw(9FrVVWM$Lb^2n?RtngPF4I=@b2mV#ML1Yie6; z1!Q^W&@!f`(i2qm`%=8JdZxq$MI~lMj2t&I%d_$ z^KFT_iT>{8Q7!9;k&Yv3UJ91@_hYP(r zQGG3wn;|W$`E@-xj-XP1P(i5a)_7fCbKc1K$VglD^3vGR<(6JzZ-4*b@_6@7Z+u*F z3&^>|pmngo6XXOk1X(8*r)7b_?$GpFeUN^2S`f%8YyJ}93Mo3-8=M%gw{vqD7+X4A znF=i(l581*gj&107&!IKjO3ZeBY?OAxN!~ zNPs7g=^uDcU_T(~Dpx<0&n>xCC`z$wy$cGMQ#2*x1{l;{Xnj76mFm;D@Q1YG0v#Lls`9t}TL=KBiMB<0gcQAKj;PWD? zRVSKjG1o0QR>INlh8UVc5UqY>xt*AcoeU=>PDsoSa?M-tJByCIHh6#`Sm=zUBPM+* z?AxUxcA&o$AbOh$)58uZZyvcKSlXD7!?mI|m+mbuI@6F%oOR)43f0KXd37BC2ESh@ zkOTf&M-Iw2g@wAvD#R*L0f-WTEx0nd%m7Wtkz$tDqs1el{ll@UElm&PBXO|P@P@Z@ z4=soEC5tpXy!ct$T)>^Aj(!o5Zu5k*VU4|yC5IQXgVk>20PfEq&CCL&1zOhgyyOP6 z!^N-7Stul5=Lz-vpl*n>z0gf&r4?58-bIHAaF`7wynHxXp z-(+oz0Ub@QIpG|lW3nUS;O*x9bC{W-~D9K))qWl@kOuAZS26`+9w2U%RS zkJ0!TySu(ZR+q;(FqQ^|4MJB2c6^yFTPDdP*mkZ<~f%=1|^}_ zNBG%dD$7G+*bh>%p>7)_z6Y}1@h5Sr6a(#HPf%NP3yujxL%;sEaUG57ksb07n+Wua93)94Mk{RMop!|M|^-T;g+ z?d+JywQzkUP#D=-XCNgtn7E61r8H6LLZU9YVj@UWoj|6oYoyL^3cO1hnnR>cpV)W? z>O1);ocgTKfCIq{+MW66E#OR0m~wS>bN>~?ZR`sZ)>|FsFA(8{2Kt1PfnpK*a7 zIIFOOqkA2o3l2du67}*j4;x#17~~3O2yXzA@S13-zTs?(lZ`A+DAeCZ2cJX&f_4o9j66-I?_5DUuorj}jl+CU2D_m-+l;ZA-;-WLN zmivT8sl*1VwTY^5x^BCV^GY?W6e(gLwA+}@#kFV~f^_ep_7@XnSW6o;GiN_e|}@Y`bKvoYU3LMB&`PHlAVZ*$A6o z4LjIz{jJ^gL{dwc)|=-*+ikdIDR!kF1krvpGnnKOJy6lm_drZ9yz%q)ttN~S*BqP* zCK5E!sJ^46x59&=SbT%l*|Im#GSJKzS$qB%m|OnjyL-aiTZO5V@JLxrSQ`Lnh*rkK z-%kMyehLaK1ezkA_BUqBAS?T&#QM0@5GYc zw1g6|(Q~hNlu~ZX*nhyiqM*3+FlZuG#ebY)e54R+<^R8(`nSCX`iPIg+Xw1SD*WF; zc-9>f5`Yvwu)#B~P9tW!13E$8Pwok5m&eC1qERopoxM>j%MXPp-yItgb3a(2+1Yn& z7DL1m1NAPp@c1T0N=F5+Y%X;^ZJBaCJ8|5^0eTgu7d5Tq3A=l1UPUYrLG7-ZZx?6H zZ_?c^(Cr4?t?ow1yqa%8O-Yl}h3o3vu>|!WFS*+1N8q|=bv>@L=J&O6rJ};VudNzy z-7V-TqPkN)IT>^jlpV1}#O_o6FneOl*;RbK>fov~?z9o!;c_D_XZDsUpGVlNKFUhG zmXcR^qSdqZ>nrV1dxKmLa+-@>C^W0P7pUQuN{u(ao5PlNVct9KwzN9wWmKW>_{-7E z<4}xK7Im}2mcixvh1s3S!YapnHylwZK3mCgJcwZRqHvXiaYeH7^z^R*s^3r>S})|S z;fUILgL-uXOz;u1G?oceZgL+^L^)yXvSkjjz~{5DSNF=!2~T+gA@}-z5%!EyeEh=A zOGgLgIVct6xwR&tGAwI5{X1WubRGaXuXo5sb9zC|IGK0`Js_Zu6eK? zYch}6a($Pqz%7K%F^T!xN5SRZkT(u+E7(De2(4n*GVbkoR69@T-sQQC`e0Ms2_%q+ z8Ga>8%EC}<=3hK)nFw9anj9x93i#FJ!J6R1ay`+fw45lkgN2T5;7H%}CF>(LRATB1 zHcobCS5;^Tjv49f8N=Lge%CZV03U4*XkPAb1qzIf%^l6ERnW%;(ETi8%!*pUW!*`s zy&SN(-q`hSt&OMcq7z&y?l#AosAz+KI+@_a5rsBF~q3#h=MOE)M%ixYJzQM_L3}H7UfIru`69xmSPpq`C3SLgnS`0ynCw4s^ z^bhBKGwTmNd2S3La&HXcz;Vx#w^sCDFa}cikRxLnAG6XaguZb&iky`YvvyYwCBU^H z31k&W&y!gR9WxFck)FMtR1RYg;^OS)NiZ0X|3pYuCc}Fzeyy6@vQ+03_iTh?q<3-u z@)WiHa^CLX{G@Jk-foI}$+O>%ryP^9)KKjCYK-DJC7RuzT$dgwOUezsC++O4R!edhKve z!o+-iFYNkzfr?58Jh^Lj&%CK@Yb>y)`J@hdro3hj1U}E>wda0#4+B-(hOQ>zuCKe} zlTw{W5li(-BHZ3V`Xpao`rm%;j(%^^vXnQFrF;Lh`kZlLl6^8NGKh_a^1^rvM?cjN zu;pY%^jUv(PXYi|QA)Q%lFQ81pW8K{J`|;L&N>}1$}&d5UwOaeHtusVI%Z#nZs{%$ zBULHx*HhT2ySrB_UQks}s1mF+&5zgl1-ehv`l50^++U9Tdol)MK#=y7B=m7*Vz4-! zhq2L`mXz1=4M7*_6$Q$uqlIE()~pM<3YrXAvQ&$(WF}RTO$muurmp~!ub)$??GgAOp(3lAFs`oGsE+23+~z%J01oYJ4A zp^!Dt?MW!0O?AE<+@au8P)wT&8k&UpL-2mP@_(i-c-B8Ih>FQQ%`4zcuPI>!b<0%^ zt3GL*RV4IyXJfb?=zINnw`O1%s0Xo#)``0^PR4V~UsJj>gl@)bFpbe-x~w^rk6K~* zmQTdoELhx*2GYpP=mJ8jt$p+Ln8ETCvYkuDe%4~nbVn=(?nl~c!BK7-D(8CB8iI&BSyT)+nx#EUM?cO1*;83blT&C1c}o5O-j}WHInA< zk`yMZ7x)M>xUp*9r0z?{mN)D9io%#`h1hdQPV*f{JPEJe-^yv*GV;wu;=mHNzjz2N zEis=>c1qGO(RehS6k?dK6Epngo(gYGPIq@Jg<9!)(~3Z|K-1QdLz05>RR!=Nyys%0 z<^eP^uKEhO$2RjGHDmh?iTR`P_7|rC3)<_ z_2iwsw8$wXL(%6+{XDk^AB8&tUh+$4iDsWERE4oriP#2%XixA2M9n?RDmb&6k7Mbi zAlYYF3(Z<)Bg2n_uZh_Ei>GL;afl>qnz$pou$-h`7k%J|3=w7)B1-P80>)_vSfqzf`)oyM7Hv{(1i{u|S z%13*@lIH#Uc}NuwNPe&QEh$MAB>}{5H|LuR>5+WVz`Bau%haI7HS}vrKkcak#<@6# zPpaQll?O4@L+hE1GzN6A*7oD!a1j?oukI$j+ow>fx(GU+K^L0F(M-wTtg%{a-Vusb z&MmQhKpGxKF>QW5+G?T2@IF}ffpzbUH)*j_by!@)Aekv(M#k#}BVem{HgmF`>9=sK(b1LOeK5IIkGaSC@s!WYGwYN>;pa76_nZD>7N^SE(*=`9awj#-Ne`$= zw43d~9(+yVn{Hb}5hI;G2Md}~Y!_ad3dQwLJHL7GQ;1BW!(jIJQT0I*LE+S(hhW^) zcJyn$LEVIn_;wN@U)N#-fQq(~T2Ld2ojSK!I1J0Rb|{P#2D>&Cb;Cj3vf12H8w6G# z?;Pn*OR7w5c$~def4RbnAojB$m}m%04@@Ch@3Vr2uT(n2MWbF11&X^zah52$N}1 z+mfiRq?9=P*aiM#kF-}C_(px=IG_tgq0$l;HTgv@z`=Gd9WHr+)&i`_iQnW*c_jP7$z5w6@BL1CQ{@ZqV^mhE^ z_V^d`<1ahp*pQl*`@9klEcZmd&nW=D1z3VkcYK%c^RPZ|L)OfXN-n5p#xvvRY0gEW zv(UZJ-bJN3e%Dg`tsV;v>hcnq)kX9m=_&Qkr?~n+8hC#VChx?%ZieG7Nx>>V6IY~| zU-)F}Pcgks8!0L4J{0_j#${~es+mLkF`DJ9_wy#_a~0q0+dRDN&v$b4@*&AD_X3g? z!*KwWM*4PXO_3_3Q{LCd0j68D{+` zC^;X)*k5T@eDLLO87AkAAx;tQmF2A2k&aEPVuzVR{QJ)ihUJ?sLCd}fyC zmTlB6G?VNPK(#{}{~?{0xbMyoie22&O|_mdYyC(pVU|nU`#+*9PW;`v*7u~ z{NkNQoq!HT3s7!LKqNOiemR)@8T<$Ee(8-Sy?j#S(`W5xKc7yF0_f$Jc-^~jOHbU~ z21q}nzlDVgX}m#x_LoWfhfD2Wcp6YD4A)!K2N771VZXGvVEMgO}z8E5UV>&GeO<@_DTpO&(Dqh<|G#VRatZH zROQP!>8VqfP$*uQd+K7Q)2U#FkdY|p!aS0MS>*^N~dQzt1W@V)%8f6TMhs)0Gu z@QrBzv<0}74dbKkftE6tx2Qfs=Qiw1V%$z<4MBsiIQOHrp(hBcmL#YZT;5|n zNqnk*R*H;S8)rT~rsC>Xfj+98h6S~65<{|O)hR@~t>3PxnelLWQfzy7U~`+v^Q4jF z>*a@{@rzA^T1lFBz>QHVny_Vqb%5Gb393FN{@WGv~ZtKH9zx znt{(b>aXZ(+cUA-dU7IBg51Q!4yn$utYbFZ}K|E?x!Yq$+m9TT~fey|Wma%aG6WJqJ}jSC#t> z)S!ZKXa=Yg%6=j2B6K%++|`cCQBk9ca^}(QuKV47k7y!fKKw4=GuYjMa6vAapaQQIf6R$1SG-SP*70X_f|HztYruPUZm+=dnWN69MS- zku3A4s;W1(NqRPu&*ZPIAN^K@sc!{SOi(Gl>w1~5!A}j-a+cjVbqQC4#|-0bXT4lI z7J1mfkZKRZI2^;i@7OV=rA#xjFCwmc&=7ucg`h@ zV5(}*@oo)eaTqhha)k3DCIJ@U@X-=9yEP_kd&KN5a)$*5KPm)7_V>qMLQZlk)W2l= zfB2gIx4Ho6{x9$NBkIwEx=Cav z28hHnp(e~Hj&iXY5hZ;XJdd`4jp1bSgw%haL6Ym@sK$5Vnb-Cx=rzd`>og$G*6dVI z(fi7`kvxEH*JQlntZ$C9kJ6{yC@LS(DH=JDh2mMu?;amUtgn;lPw18+E;4}mAcI4w z6oH-AK7sW58yHhRY?3-wADFq#b>GD-DH&(-gwL?hgCa8TW$Ip2=KxS{7Ej?OR@3B4 z(%?uM{hfN&A(}pC<+4LJi2nVFIo(^Rbywsp!4&d*4a5-(9qa1X?9YW&mXr-E(uVWT z7kGVnVky>uVdVqUM;5D*a~czitI7I!`N1nUy&=m=d|B9XEoa%Zd-VRR{qASKz!?*Z zeu1y2oqy|+FA$P5{@t;Deo01xbJTS5egQSjH2}up;5tsIrMzBZ?WU=bjKH;w*j~QW z*+c6s3FB4I&l&L;+s{&>9^wI>b||KWcD&Jhj8*vCd&5H@a#tiBx-VAHe@)c9I($pK_XJg}Y7X zprQYg8Ld_az+!bkb9g|hBYc-ofoBOFtdA_Zd^dqa+67;U@PmN#7pu>tnDeO`T9iBE z6&z-HpVWOLO2P5{?Pl*b?6@S2RS{h$QcTS&XsSrG>gs({SuQ3$5Z6F}Q<&m^^{y}P z;Fv&1@u{AQTtth&qIJK`7C2En`MDbNYfx`T;`&-jVY_Pw;Ks4P%cL- zm8|T4|NOdq^hX5Y_k;h?Jpa?F`ae|9AMZf_cn|thd3lEyadZW_dX?!P&QP+&(29M) z^LQop3;s%>VCrXrbqSsXRt6s>*k_A$aHh_sKQBz0l0}I|)?FV>s4-CXQI}R7G9mgzi!{FCGXKGsvNl4&; z1nI{K^~KR5K0*H?4k#uX;H59q-5vCxBUB~|SZj1VoGh9RT|-!CYy_!}{lEf^3c4 zH4u0b*m8a4MUwEGNwFE8{#Yve!z*DZDU5MiEV?QtMF=4Gry`&>hrWYTO=8GW;{*>c z8(qB;7?5Q8-h(^7ZYxyA7PP)D`;lazWLbP(lIy|Q(wmGn&IrukM4S5YJEXp}Tui%H z+2nCck;`XH@JBNBs+0sYEm#TQ9cmH>r4yJnQ4e;`eh`hP!_JEBaC=j5kR4VbhUUyY zo>>ggfM()|urbd!A2`d*sEO()HU+1^KAeBoV&`RbRdt;a3g+w=IR5Cm7v1&Zw(nC= z+4-7|rdDKu8vRKDymKZ6{=Bnb$rcbjI&Y7HzTE|<_3NGMdn?<_CKKvR&~3^4e>FY- z=QZtr*`AL#yuT|Lxo`-jBrPWYb9*op8_KSGvARS%!+t=b?RVnMQ$8v*B}-hBT46jx z8U$BmGNskpR^Y~G-&3yCEnNG!BqMb)KxT1-n!UHx2Pf`kLtP^k(2FfEqGZkWpA3fA z{H7eMNp@#sf>WFR9IJkVn=7IpQ9INJyDOic!@`^$u`O)BTvB6)jZdk$xHecx07!a0 z_q)8*`(rJO9OXOYmNGH@Mx;optAYStJgB`Y5^S0x|P zf-uVvW-)n%G9q5+t&;re^pbl{7MaztocF`F+hl`y0cU&_>YEs%J29X3qql&Xac%n+ zCN>-5tLv-!cc@l9?5aM4JSkODVyLPosxNZN5qu4rb$#`boJgA$Q^;|pq`&-raczm#-tKC7o4c^7Tp%nVu zmm~m=)-6ldt6~+ta-hhY$H*rxBkOJ5tA|c!7(e6sksJT!Rx9W%_N;f}Q}m!=28Cn(yN&8Ph={GgM6wk^5arh1^L=9d|S04r+J9^72{wL%p%U zNxiBpaX>)tkzjbFP1!8dMb*H&syt)Xq6eqUdUg~OdrRoH%{>a+pp02Qday_eB!XMY zs4-mD8&a&zJmvFyX(ysNMH0&UA~ZKy7ZeKWaGR@f5Z3pfJ(TiX!CCsW=GAQGV8ZL1AEFj*T;1HO)ga=G_*rb5Jxy=we8(>qKvV7kq$mjPJS~~u$4)!E3p847dvl4G*b0?4 zrKAZ32aWc8G)MaeZy_OpTrXo|@(T)NGeAk&xTtX`@VYho%(lw!j5)FO$cs1yvk`t7YJaa=RY(!Lb9%_#$!wyxm*$!8R0G`-;@>vLG}rYv0I3sM?3fuJ~RUmNAh zM6Nf*8h4-Y=aQJ+3W6{r-2|p!p32qz=LS3eCG~g6ku9_u6^rkwd0c!_#sj z)_u2CnmYctEB2)o1=DXe&%93NvaZURl_eRHQ4_!Pm)c#p#qAMy{w<{W1|r) z{hd@Jc(Q93CeES6$2zc!m$iM8<}{Y4{I{tG!zawYQ?@V*Wi5K2?8hIZ3{$ITZU7mO zLzCVkJSgB(5lI7CTcq8?`dhYReT%UbxwrK_YCTC3YBOUvSyj~0tq6*xxyn>M` z{Bd2EuOPQ9(E}$xT5IfBd!7m6m#geIuI7aW|IWSONJ|%|5b>sX zdH>mP6)lw`bej+&E8e+b&m*3=Bvf%R!Soz3VO&pbd(~DjTbKFi+d=+3i}Mhh7H03du=?oHrD*+VNr+amuYfqnu?pEXF?@v*6xq^+SGosBsWZaJsd2CSD3hv zqVcZfB4!Vl6=rnaoB`&mNhzpZWs>=#i@yhNRO5ta)5Mi?UlQ+H={q(j_StO|{GBO- zIXi_WEzG(qyXld!iaiCpnvO;rvn%d`g+Ye2al_82#&C>EcM)ZLm8ISG>agH1eF7Dc zA&OGu;`F|4FDS%xFoSls8mREr9PI6TtFu=8xY9W}lHVqGkRWz<-2zU4Yl9;-Uty{nI?FII-9Z0p$p zFHjpb!6P>*jdKH#vq_>|CG92dSS$S5p#c5+)eU*MDWWJ<0w9$c^^dT8^PT+IRT})a z$wpgcw=-R~TzT9ywhCFUy+B?+BY`L!NRKl^VZa?vMTKEmOsC_Tj@JV2i}+>|!)imV z&;2JgHEt>@HzT$mX1=&F?)GWbRs5)${U-hz|4g-kpJwhn(f!8$P@i#C;#f`HzNt96 zJ1#BzXf{8pEb!=@rkJrv?6r22>$$#d|85kv%Uwo&V(JH@Ba>nWqn06arRBAZ;!})Bq#MUZJWv#Twq#bvbTxV=n~{G;8k+n9RX(9854Ih^orbDB z^HYz3pAmPKPRHH4+iZY7ge9f}+@hqy=^A>sIiwxbAX;^s$(c|8n?k=aFG_XZ>qDw3 zLrTZNi&D<_%FLNno6IAIFMd(hJJWpX%48D@^P{DDa+ zlLiAH8gd_B27OO)rr)76@Y19zhA2hou*?fpHLO8(xmb$&A38sVKFtbxw{A;AFrm2) z$(Z+P;%&5cD(q?Lhy21i@miBBc6<*x=@~ui{Rn9|{^BA1eqH%Fx*$J|MvIzC8HKaG zx`&PS@nWZIk2#|R%yDC^yS~2Scu;C;%*Lp=sotuf8cO$Gm3KCF)TwRqXDEb(gj<&S z@=Zxqn0pC@OBuE8UJ$Pn_uXtna`0R+5{=A4bC^~3D~`SFwxV>hVn<5HviNs#Cr(FX z#mly&NPvY&arrP)oSc(ooZCK4s@KOqO}4+>uv!QyKyVV}(cfxO5ET5y-$iL|RY z9z0Zf66yX22U~_~vvVtSvZxnv^P|plw9@gep2qE8{CyDYfN=D%ls9%Y*{<)fJUO#Ls}|0w>gWhL-Y z-wWN-GSoedDd3L1SrtvUt?N`7BA-*sNhKct`NflqL1kucR_r&r;pGH#BJ zPA0GcI2T#Sv<(vR;DXc)3SH3X38kW^Zn(uxUvS!aoVam(bM{qDoJ6!Rw74f0565k| zUDx}^Ff+Ga{a!8Epi^qJdwZ3Q459vVJ9*r><{Sha!g33eGzyfZd~kw@n4+b~;ji|* zg-nP9^fHO@PUp2^r{YVN^xD<^D1v3Cy5FwMcmw)hSTd59@2+;HRXv#mJll-do61g zqh~x_Xc?Qf;n5PxZuAcE9mQ(lg+%n1xnXzVi1L1kc3)8;uAXj!u2&i!&Kj&S5{_3O zJCS2D%99~GR(Z;Mc^%31>z8bGesh|jdCJY_-;0lq+*JMT%ao>4%TCODAINcyE%Q<; zpuzcyGt2H%hi~ym%gvd5$M1>U7Iuw%w%>CXlPF}lw^=sKH|v+*q$-qqz8vNJ90oK+bZ2K)2+zGE2=E{KZlemSV-9M%Gf z6qk6vB=Bd4;%29 z9wr3(;8VBzXMU_`Cixw4t!WevQ8JoBZe6A#)5g3;yXU67owof;KUuC6keijUS3RbAysjZ(L1q%1hAbO@xLuNY`8 z-0~-N$&Dnj_j1g3qY3GgYb{XIP#2Y2g1#MWa5^sV#l)ORFhMz(KN+oSNj-BY=nND! zs%ckz8vy*$L9G57U)zDeSMs|5M zqwM4N-jIEH7`SlVd8*utK<}_T4AVm{jS0#`DN>IPkit`*xg?D_WT#Z!+!Iv~V z_(emmNzjpr&;{)h#M{c4>MhNYr2%S*DmQnpxNbs-%|oan=inf+qX7st@n6ixG~ zAB(_xi0z4bA4?`fi-C_W6zf<`>*yU5hI+zcza+#h3JGZYX=WNf=Xq-W9=c&t*wTr? zFpq&h0nR{`E9rVs$K_fMI0Q_s4PhC>Xqb<{;>!W%jMPO^v5Zwlf2_(W4`MLrL7QjY zV{rAz4 zlKt+tPkiGuLH{t;F&irO7>qPjSB#LakenbQm5u~%sPt#8J@baJR@+uRc(^o3`bIae z-J((bG2%$$Xhnv|Lkv|3_Z&S(QS#2_rWt?k&KhpLOSRGhT)f|D+~v!VIbZVY@-RuR z2F8q;aLLu6Ra_hA;szqQ7%(B_&Z1>TTHi+^8B-J^0EsN-7$Cln>gxU=yUrGcY$`u& z%Q50~v%Mg`_?2I*UFH|Z$|HDP*%=Oqa3{&uPR4lsAj+LH)<`U;CI}m^e5RPv;d!hC zR!`xK>^XCV0@iyCwquvnw2yoVEJbTG;c9Zt?%Z=3CVHaY=8lc3-Cc09A?4ggzb{0Q zDe?H!?DPDeP*w%k6~g3eMyvU9ZEaKnR{ZRm`1;fcpS~`DxDKx5L0VCNIwG7obcEU> zy5Oj($zFB=qmgpY|E~|I|KHr$%i;#>l3B)(-Ze^I?j5CJ_fHId;)VG(0WTl?`hpm2 zp+=Nf$hTxg#GX-sH2c^q>h&pIP%nfX8)O0+m+%g=3I~^XJQn|g%jzL7FsExtCCF>O z40Z*=;^*eBi%8W!<7-mIt$T7rdjJHEoCkn%bb?sPaE!Rtk2g&PWeQI5-c3TDvpmLj zs{w!uZ!=uM1$fIp+77H$T9qYP4?Wf@RQp=Xp2c2)BK3-88|kD5HZ;6-2ar4KsBTwSwXo(I(q0O&{gmrtlw-V22+Td4mEw}Z^%$*) zG`noMJMO9;OeN6;gsG(xwM7l7aCkbqM&80dFkF|o=PyskTxs;J3?7GCK9smM?NM6A zSjLesF73>BaszF1FQ{w$=ABx>-#^==?Z5Kc70&D-9-7V0uvcD#XjMG~3GiZpp`Y9l zfO-!p4U>n2c#8__p`hEu56+nt*V|Ld$ytxb-uvX^4PS;;pY=4f7y~REmK-!wO-OkU z+@Z1!5uacZWWa1uw;A9!9L51|a@b6>YaD1f@#N#mLJv&S&H61mCex3VFC56|0H4cx^7i)SZvbPrp3pMc|Z+7M?I0y7H)L2R2Ko4qb&|%}-slLEXXYkYYHe z7^B>7PcdiQ1lm1K#By@E>K1d3^J7R{<}X>PnW5L9i*Z$^WJN5FqJdao4htc-?KG!a z0s+ub`3U|ivxo!4h3CAJ##A129k(O1xtn%HZUW*O-ecZzJ@B@)?w8cYIRI?!?$pfpnjR3?1iy7$+&4% zhe_JDzk$Z=I_r$$g-+#soAzk!AV>ALtfomFsI)Yf*}_A3L%7b$dg2!jcBOgN^Iw;| zB7C`bj9DrNS?G5B5R{fMx3*_t=$GcHFQ>jASCMku7>SQ(&dxd~5i>J%H(J)(!D{HV zQ1bC-;t&lpcR^OXpg4va(RD+A7=&W_lw2d<^LwLFw(J(IG?JbX7?t_M*H8cPi1pu* z82_(=h!+oMqvqeM>LI+YnO0~R7Ji?F_6vf!;8ca-OlL-{F3^PCcf!fni4(>x0*E(v!~a6!Mwf`%(w;SFPSX*T#y>M8V@ z3l3DDVyg~}E|s}(KtiIgf*`ePpz2KQNp2l^Nj7M;+9Nqu0=w6Vbf_1QT`^TMlIHzfTuCSwGNUMW1zB^Bu zv3Sk8aLd&nel}r6_qdXiN*9^LSmoz<72AehcmCw}#hOV|Joc;szsa_WJLYj+XcKg} zn^7Mao#*SBW}Yo^Ug^o&_Acab<_8f66{-F>J&0%SiD~lN(}LK~&!~1rxyf|9*k#0W z;&QeVSJU=cR*(|Md9Vnce|=N&w#o72t4cT`MMYz#j=`UR8|ejw&vxslVD`$xu*400 zyf>5~Gm!-=>v|_Yrw|lNGT=9>&l=;`2}wERQcUF*pH!)()B&Co>^x;z*k8eEdyGW3 zF%#gsM}t32w|x>*mxT7vgU?J%s4AeFs= z#@C8b8>NIB@XLWCO@&tYDo+M-+5#>&#Zb+k}_DZ za#*!&_;Lwg;b^~F0gS9kpbK>cF6$5B%{!?a8TZ6^3gODA zjiD)WFK7+oJx(sA33Y}|IKS`8(D>QgGO++PD3)kHzuQ3MhcHPTOI)zJ7{mkY`sAim z)xvh8=T@TTu+r+8P8<8&0u!I|BpN%J1o&iJ9ta|CZFmE47SL%clLMQ8i4?d4E9n%) z!sKRFD!1=|7-$M$^L%ISi4ZlV!YyuzI9lOF5(X+GOEQ+b2QD9d?PB}+wl;R(-=C!% zRoEOqU+r@gZQ$(adOPsV3iXp$pYW$N3>f%ZhC1REvKgB^$@Qq&5;1GbIfWAdCD_Rt z`{Vs1e=6ZG9|b##q`5fHiz!E4%NqVz4Hw9M=#vke>ig9?*7auJIHjy?G#0hw_q0Uf zVTFdXKUvxvUl;vmpMK$G>*3$lABvW z<-Ly#l*Cq$P>y;`9!pq|_m8E219^n}A8n5ykLdr>rsx_u&g}eaPrA+cJ-hRL&bOBP zVT$4696k$EZ0Q+zApCo9z%g-bYmCse{8Lu9!}PiXV14@NsWt3-LT0LLDI;SJ%&bum z&iA%}G0fvhJ`nP=tsC8>QXxp9KLMMh&~@|<4s$#>OEXb>cexsbbMArg96OqvD#YeR zmEZktrUTj0cb}M>5qtkuEF@olQ^i6LkHp}Uy?NKifqlJ>_JDpexWU2l)JcK7-fEmE zc!SxyDZAdWsUiu`7Kztb)h6KCI{=>f}tzCOG=ew0oGoiuU^L4 zIBRj*lPOIgC~-=s%UX5pb4!XlmNT69`7((bY@UgA`bo8w$-7+FmFoBx(|y0q+s0r5 z!gXczu2l3;Go2?wi8s;DF1#X1HL)=^Pa`E^3N$I{_FT0JX-^K5ukuFqEFQ+s2_4H{ z@ob1eGPY6r!}(msXAYv7>m$46me5c0BrD_L;e3$Rmd&M$;=AY?q60^6OeXYKY=m}) zi>MDsTZDG+!L^PFr&M-YBybO6KzxC_Hz)NY4PCP8>Sp4T^ylGmwK2rM@0Ia;b^BKY zgS(^&_Klm|5k%W{>;g%?zBTR*CKi@lFGIP6tFZSgr5IE+vr7yqsl(ECvRz^-F2oBF{;OyDg5PAt{gv)VX z7Es$;H|!&%{x`>}`tsJK_@%ugY0-5Sf|dD6_DD;~8sJJutBqRL{h46Ds&yE=gWx6W zHVRbOTH}gIrwwC2ngu^NiYOX8LVV(R`ZEKVY0xgjdN=zxnle8IPbs<($Vx{XW2 z;dr^p=QRsN0LNZ(d8M;cLg$(x&5H0vfKuj(R}MB);wMN|Gu!OQeA@g-c(!fdvkAbg zkcc1h<0a@8Ip^W?ZCHO%jT4f{dI8Q8&vEJOAIH&#q)>I~KI4GPXEr=aJOj&q1pD)E z&n?P2B&b&bpLjJ}VBewji!_pAtPl|T#YNf+ukL)8G#urmvxFD2MDoJd1I{EzXY8J% z;V;L2sE1v#)$|R%{NN_eFyhzu0d>LBZENoy|I2zmx$aWumtNx^e?P>OkEi$XWdF<2 z{I7HV50C*c#me7f0se)=i!!KE9A5WJB_f(Ho> z!L4zIeBXRC@66m;>#lo$on5u}sXAxZvsbNk&VF`{ZFbwMXN`!S>uUB;V*d3L5(NqN z&W+OT;wMlC{UjC(@;=1Y**#skrJ)xT9>p~otn}~U z6ayDt?Idexdh+Zs=JMb;#>_mOXFIk3R@N@iQsFA)s8ILCUHj8v@YS#KZ1nq4qTJ=j zw$j$0Lthv!wMghK_O)?!Ol}P5S_KK_xCl!g`%AiBMQI;E3eNB|qfQM*zr%fkCD>SF zfs|hz?-slD3ne$tB@y2S3?i$c`Uw^7l$w*@{0<9&OJYq)9{`clj-+oaNoIdrG+_`Y zJ76!5T-KVu`|IIWD?^FQc=h}Ux87nnj5NA930A8c%B71l^+X5!{JmeL>j6UOmi{r6 zDP<$`PzP5L&5->w@X+&fJG;P!pz*cl5utl2OmVV#2(Ht9p>oS%^f~6{=h{6AC0>9w z-npHW-Wi__W3qhx9kpWZKCFnfCs9*Hi(TQR6o6NWNk%Q9Bc=3QS4NeD!AVLcd>}BV zf;;Acr69dzpxvsw|vHQo-(3Eaze$~}KnLaxlOauc! z_ODVy0aYO+%};MsYr|(!8rW>H2A*^kQ#RDT*0IY@!uayz2VhLeJP711gJN%Bw^NFt z4|Y!+>H7Uu#pbSAx>zjvjsI1R8OM!FCkHEy4ED{rHCES8QEE-A7!yE#vXZfRTAN^y zfkAGfeNEqC)w!0_5hkNlL7i+lfFlQPp@H9Zp{@tvXA9?--I@3uLEEB_r~6#4lvx~z zlif?=O5Dgaw~OsQs?b?~>8!|MXqc+tOHezChq-cDWWXsGo!3RXyDw+B`V zs|oD4LOD-}5>VKK-o6QbSQvxu*G_xk*Yo@=1J=S}eK<=)g`6d!d%8tS$U!z?Sq)P5 z8RPE*hyZ(_{I&QGMZmA8SQ!b5(w!OLg8<7DK@qF>gg4I0rO2+GM28ko`(_HgddZF} zoHKkd6O-gblv|*f4TiT-ImYIH(_ezx&6&szXyiWG|5;MpT_oXvxfkppYI~;>m+;)@ zK;@cg&CBJ)+PfIFQ#HY9*idkg!*itmo81f2wVr#7;}?f)k=?m@h_i&Tk;^`@h4(00 z;i(qD;RXr^t&Bp^`%X0b+AM}(g zs$H!L>GaT%6kzH4=N<3QN4g|Vki0-&Jfer$ZMYg2Z8HqP;TZay`Ej9s-089$CSz(!Jx-^cvPQemKBahSs2)U1x8& z(;1?n*pBsBxL22R!wZSc3%HF$hfy?I`@;gQ09;#vI`pQUr9|-Ew&OvrqwM*3 zxk|#d566(&^WR@=sMIeE&r(#RK1#0(ozAEn(Zrn^Exl=MP|MsPD4`6fk!;jPyeJ?F zc?(dJXM7f-nHLATZ)xVK-nU9*a^pZR)jz+bgR&G5mB`#*{><(65|TLl+c8U?bQF#d`;=AEkXl~qH`>>A#IOT%3YaYMa1Q%a$NF~(BqIfdDl z%lF)4)yzbsRFNR)~71ix#@3wIw(+9|_<0+4q`4 zdR3yS&^5;N2F-}Lz9(0QM@Vpzy_2*weDr%WPC_m%)6D#EjX+NCWH>{ZCTP|{!7@Dj zC*gAXj))_t<|F8iy5$SRd(BXQitY;j zszvj;8E@K>#~S^cJX&C(^CScZJ9MmDYhLAs`-&l z81o6`H(h<~N2j?+RWPPo!A_ixO>+fD8+DjU1Lgs>TNY>>nu40;y?KB>jjC>iCDQjk zrP3F?^Kw{d*W?)V8C05|xYNG17Y466pc{UU!&+1D0IL2#$QUPkzfj$MGW-}+Fvjk^ ztu)-0+Wj+E6XE_qFQGC6TS_m_8CF!eYLHn+HQMvulAGA?onbQiQ5%nNKX>g7!e>OA zN!s2zJ{_d$D>@8}2Pv?=gOFU8`mqFtz0vU)0uDH|aG{gTPDZdf!W-qlOqZ&N1~L$% z0(^#iB1E<7>mF25?%n)>nh~4SNmuSboHa|*M$hJNN8e5X^<+VK>U9O&EMndrCpM0 z|5NYBn2OX&l1`t}8?94bGW4w<2Er@mlODd5Ut1}T%1!p9kHq_@-kfFJ{H$|znB&t| zCT7N@P3(R?nWwsf7S)k)$X>Or_gm`p$27gyk>?m#&w13Q3w*jnMt(ugV9@(LG<)ZE zSc(^)Tx`Wzr-onULKqiz7;I25zdVt;o4};}2G9-(wiRoB|9gox@`sEg42Pg9e}*av z40s2Cc24gMkkWofPe?g;GS@905X11O_?nz1@IjS3JQ^a={%Hav!KXySW$g?GR1V4Z zK7BoJ_QU6shR5lk1knc@Pe+>|D}7n@EAGHnY1>H=ueHH1#V+kFHMy*1mci=68ADO} zUyb)G{UKCT%z~T7%HwQe#~PEv)@PEE_Uh5iRjVVRMWQ4E%mNQnmnX=e02&^JtzDAy z*+c(Yk3A{1KUoU3E>fOrY-zf7C_{Ku>z(XeGqE6@i z`F-mi!v^%ujEg_Ivys5MO>noU%J~PivQl1lE4h^W?M+Wu{N+V;VK)N)TH?!Y&*YSC z(%W*M*_6)B&dJ~VzGkMO;6cN0g^c+jf+o9fd7Xr*r|EH<86Jvlmh%pg22!N3Zv4moU<0v7ts%oyKti z>f`$~0NPoyUJFXJ#JnJsd@=5nLU(X{a8CBHU7bZ2);HvRnNoUF={{|m&h~|z6jFjJ zRP%d!N3KM0kZq7?{v}I(u_B$?)FfHh;X(T>_Z=zNj}8^pLdYj|fo97RS!bS~Popg- zD@ts9$`C5RisKQA@psbtKZ>pWGe!GHoXXE-?A%bd&|)rKVJ@qjUingT>($KR8;2h;%^y#ZD5w57^dYwG zd$OpxcofY_R`hrg04%4Y*i=VEkDq|pd`-%J3>BV?vin9}eA-bKcp$E)(k-Um_8a2y zY1mwY941>30tz^f>@&jgr?LhX`DVrm=DSK-@LCCaMvt9nvELCM8Np8GB8HqDQ-N^> z^tM&2kF&Sk#!(~icQ~1+qwOK*6bMV73Asi-bsGPkk1_fsU1L}_6+Z5I^?UM4q=uSj zN5V&mwW)HgbC5c5l?7dfotsCxnZ*S8KwhMzV2GS$0XscBCUM09wmY0jbyBdmVs=!{ zQp%8i?WUy;nmK{JUGR>8^RUX&9^-?8Alx2_-&6fF8a`xxb}(G2qkgf>fbyfQ(DSWL z50-0@R^b6cbuKY<`w>~XWK{O_s8Ouu>7QgPf^=lDPd%@;g4(xcyykb{ueVJ2Z|ZX9 zYkXQ_mo^rgEav3e%o`6))xL*x?dr?BA_F~Yp)K$8WPz{_M|mgC&75>ysqVEw$iKi=Pm?3*Dql%GkT>R5@{u_kD3}3CAE@}v>w*)Uh#c= zM{Roisob;wR|F)uSq050M~w9$1-BJ}B=^TB2>X z^#}s{WiHMd#qNEP4mk>`u(6!k^DVgerfQq!LK5Fu6nvNkL@Bp<|AKA1GSAeq=bJn$ z(IL)MM;MLD9n8x6en-(4bbxCa&TE@>q}=>JUX~?+b)6jTRw581eM5iHQEsuZyyGDH zkx?{;6UsSE5bk1`8I+X@v;OV&;+{&`rLjlSJBKuIHwBNCUrC6!=Cd4YCk?MY8U)hZ z#ot%sA+cF@TJ1P0rMhe}^@`hX+I0?cZv?H(5ML;qO2CEbL4{v3UDR%NS^C0X<&9;!Ze2%dPX zYR?*Q`Sg^4_s*QPp2u7ghLibj4&TnvZ3NYi<8!4bWe!VmZP68f@FNYBLv47sIZd!B z+_{s|a{P9Ebj?AM6mYw$sHcIr1@yB>lJJ2+3ccG;b0+m3o`zq_6{S3TA-EeeI-f@n z+k0^Hye(=s0<&=rXLcYzum{AtrE@>5-uoPCHUF$;gZL~8y@o=eO0jn_1qf<=lPkun zA74zW)t{vYw$2sx^Uvfn{xQ$ zZNgKPv17mM<;ads_VznM{hz^ zZH&w^3zNqiidbhscx!p3)wkwOYpU-&EXx!;3VPCe%58vuX6?C*ZG}pc&5K!G%13iX z>yOHP*j@dnHH3U9_{SJ)-A-uA%X=E+Vp=g+O>O!Uc7>?F?Z{Gs2px1C1O^uZW^NAr@04=o(+MzvgYxhC;fXn9%f zqH+CULhI=Eg>T=Sq44Y6j#f)`V<$;nLzHE>3(m*A)v>k((rS2ar;)5H3?{y}8Yg{3 zp-(e5r4Jp68@g&ZnudUozaYo^RQL*en<^aqYiQ=M;H0!JC($ct+X9?Iy24c)U?|uk zx}YN8mn-5eX>a59*_e%eX}(%w|BI1@ah3Akqh{S^u$3$Oh7*Mnn8UPOPUzSAS=k=s zB}tqJ6ISwamw2^jVi9VHL_1<3p6iyWV$myBzhBa7o3J-IMvlzaZAM6~LkW;Ps6@ zFrzCBpX}vEEvuwlo%1v9lZN&#B(VT*q-513L-X;O=kCW>`r<+sYj6?o=xk`4#9!cY z3sHR!PZN`zxovV%hk7(~m9V0^olV6FE-v3R#l_fqMdDbQ@E{1av}EqhP(NmA&BmNx zwi?;35O1)PF#J>&80MkftM6&IT+!V)lieHW)zM5Fw%Qy5`p5WI<*qNJ7ne+=U)9!h zEDSl=CY9~bqybZ*LEXz^uj}I`ew5NUT4q}34D7yMXml>>Wz|pRy{}9|xmR6;1mo{3 z``DU0kr~cV-7LI#(DoO+4J>W}t0&0O0+zQjUt~#k;7>CdO1F!3R_i*HpSJI2daG(~ zy!wXvDeS*%=&q|{>iN`&tLj&E&M!tL8&8>TES5kP(hh8@I^=UjT$`l4?+N7QU-=0} z)K(bY0f{LfT!l>CcBLzd`EUrOK0n+xvv8|UArX$e~ z8tg|hLP#d;^N(O3EnU*xmh?QiU1GU*ne%C=Enp&&TRU1g?kMv#s5H3fHg0R`dj)XB z8dk>cMCA)ZA#dHd+PvG3;1#2W`9=0v8B9yU-d)}wmqOB(F%A2?uB=C5ZN|^)+AOy@ zFX=qa&SHVF7?hcGZC;O`L<8p#k=lv2nXP{R7#yELuITgBQIXqA)VGI6jgmp=%Ai9- zpcFoyo1cA{d~fGpmhU%H?gWFGrQ4T-`n(Sce)Xxkk4=?p(!j+x%Uhi~1RH=hcSwSr z#g-tn8C6u6em|E3V<)%;p&%ICu#q9+1-1q-o_?!M8xBPcQ{eCcykqxZu%T9IF zVc}k5jP4n;SP5x71AXK}VoAgp6v}$ei&^mT*TN6+DefX#H7_g$KYH6oyD{;48QtD$%a!TCu9|| z8EVG}@!>_3&BdL&s&dBy!{+rLa6RKTb~3u1d@AxiVu2JRHiF?=!O_vNIZSU0V8w2n zMhPbG2id*ZHN)Gj>|QI)R~NMSFaer9=j$|{Tw7lt-QsHLLzdwW3X)|9?F&==($Iz| zC8Ko3Cy}DPitHFffeFp5K?F62=yd71V>?c{7^!4m)lx{tDt|t z{6CTT2e9{8{x6n)ApRd%M~6Yb%q$+(+=hHLT~v~KX?wPmz(I`0yjk6$`RThNUo@J! zNB302hn2XCf?Xd?;B*yepfvdE+V6tsnufy3aEb+O7GCpwp(JbW18$5v)-vJrs~W#urBVZlBJL{@ z2NAY3er*v_jXwFcv+kLmhXWiVl5T`1 z`K?goB$*T3RAvyI8gh{R#7i2>W`QfqpY6+#J~rX?&2I8ezrI@CV~6(d+A!3QvF*FF z+>e$b?DQR(+Ot2|&Kl?yyX%`EqdN9fy{;7}+gJ?+-Rh1rsB32^ekJG02k>Az&PiVy~U zmBm@29BDmF^g*3`z28!w-GtSl1|9q7!9>(rFjdZNUc{Pv#Dh1DeGmyDEaRkez}iPs z7(T$k)MBlG6cfM)9Ei+48*){ls7e{esV4&E^(%j54Iaq+X!#Y&7#Z{>mga5=MhCXT znTIe=zYqb*zVV#EOoUHQ)c!tkgbTP?UDhz4AYND|bRrKP0Q1#vCTC@k{@N#b{iBi7 z^oQ$jQe2O`+?Vamyj#6LO)No&sS{^XcH3hG9#NaN>;sNoF#Y(-O;$1zXN0S4T zzCvB@a)Me?u!uH9d4w_?$9Nk0O<{TL1wXY{5V%JEwYFyV2D1fr_BStR%frFul6RU` zj-;8FfokW0l(B9WmYrtJR%?;TKX9|YzBagtr@RyBV-Crf%ALv4f6enrSu_gd1>{g_ zg0%Yd*OxtxSAC9t#pg)a`#ycwqBY=i`)>NKSdN5Ee`g=76d&b-2wiz*ro|b<@AoI0 zJpOY=0Pg4GM=#(r!|#_9FZATPdevU^fqLK854+o`&?-?VSzXJCv^nDDOuq;`xFnOI z=(eaN%w5w8>pvXj!rLgjsi@*IC_|+-GjCVbyi0%90Sjk}6!0q(mwQf_ zH2?ey^rUJyz*|zU-0`x6rrD@@muUMl!Emk6B5%yg!wB38EsW=)U* z<#Y2R<&*c0cra=KN&pGV-KftnG|Q*%{dw znaKo@Nl8ih>06h*}T-Tay2C;R5$V8g@2^3%x0^gouY z?Ef9sbAU{LYM20w%uIjles0S5hsz^x>SAP}E@EnFWM%(sLx2mw$@iE1|55WFi~ne; z@t>BQ?5zK6`Hz}^x8!5`6Tm+L`d7C8;y$NK0GW^J@6-z*XJou$eePB`d1+gJCzo#@F3vA+)~*%`8>f#m$4+){@9y?T<_azQkM6T=fY0tv zWts!c@@Fq@N9yv9XUlc%i*`=VfkrvCc{v8ZCvtM@Jb=LS`$rHEcskp1Fj|{aH!|7= zIhoG8y_&r_T3R`{zB=BSo|=X|?&KQ-?_sc+?Te%H=UDE=D#{0YyT=!|%5!thCo;Y3 zGk`!)ZbfI;zywe?uyo-PGI7+gbQ#*Vsa6(Q**S5u-WQ|`oH&Ek*ERH1=e2eYJwBYJ zgMhHRB}irT_9N`~)FsfPvb1}7aB3B(7q#9Jx;)u;v)baCKYo9H+Ov5(xqc*8mUOW- zom)~jJT$zvzPdhC4|MpodGruJXxbd*CvZEW^FxK5VUJf2iG-<3X8dx}ps+-;#&OKThgv0Wq8b|doI}z)S{qGl%(^mtr}Aoiyxo(# zMgj(w8X)#vO_fG2KB=j{b_QAvYV(`wqQ7;F0@7zpletJ9)c# zo8MWR;su=XFq!fTIOf-IxbUs*oW_wH14(KvChpK}*uziufTlVu&$CT-sMkU#cS&*z zE4EU3QoO)9JjlW(ZNeersTc7=I}`qB+TG3E^%Q-W4~n*Lg<2KJv$}XGS64Vbj)AkB zsnmU)q1K!U#Wi!;uO3ob;3^O>AFVS5KlZ40dwUz?>Eq1YQ4^OY>EOFKgNaU*6B>6+ zoORyHInCn+h}j48S`6FIQY)#o5lQuzyHM0`_L~k+W$lU~=GtEzE~|c3SZ$c*W#|1V z9hzv_(dQJTET2tVQ)dnC@_=|9GeizGN+}dFm3nuL2z+U^HWfVr@0}m0Lo(y4OKURI z`MbJHKDg;g2g?~}WUKLH&YEVl=ku^{uKE6Ev1O$dxPQ+;H0jvj3JkGAe3Z@jtT<0A zD^>N2emE8MOE%bXZsOSFA8R_2`O?cyQO0ko+}8qfmZ-x@CdVlB^ZZJ)yo8fsz^#VGOxyb?F=0FeHIe zzu+!?%1#Rv;o;uU4uTCiLEB~A5LqlM%14AcWD;88oJIx#^VsWJQ*iC@$v2bOp#54~ z^?Z!!Z$#@~qgv@}JrLh;dK1oO@ zpl{DkbL=8$Rn75nNeA~NjPn?kxi~9}Xe*arSRT=#f&twA(}`fDE{)qL8V^Z)>)nr= zA>wPh6;r~dMT|X%UOIU59QmwX36qJRtJ$#BdcwoLM(q?T;|RxM9r6t~SSq3}uO21% z(!|MolE@&HT}i4e04$EzdTBpKwkxqf>$Ue-xzBbQyAs_T7GHgn&WwqoOf?^}F|P|> zrm>E+-#zJxK?5bpeNNmVtV|iJD!(*tM1+1dsb^%piexsH!b-^nQv8ZRF6MkOlgQ>Dw|8=oCUZL7H)@NM31Fi$ zpNg**=Z$?K{_x&4kP*Dv2Pb4PFMf01Ekle)o;PXog#O_p7)drFbFv*5nL?r*u(zmS z_qs^HRnJAo43Yz-ki#cOhB3&+xpO3><7U_|L;T6Sy_5P0ts3dJ*;m^k`VvhN98}>A zV&AR8`wldl=mv9f$x%4{L}WRs2DuiTgT;K1cIw}9oae}*9rb;q0^3TE;k^d@*o2Kry@@ za+z8wiZA$yNgLo_Bfr322M$sNN1BQFRl<6FM;vid0kq_ej@z7^b?m=`38VxHY-hBg zBWO*$=h|O=`*GKs=kO!3YiF;U_1a=BSL^Wf4W)H1ub!Z0k=@exUtDFxz31gD)S8mV zT#Uh{!2rI72l=1uKdiRCWzaSN8B0agZc_%yK?m#}pC`YW0Y+G={oQQ1jsygb%oF?|H2uqbutXiN-3#auFzOv=^G@sm>^gA`5evttUpJJbM8h_I^w^XK3XY4cb zfhfMj^Su*$M*@mkF04Dl?PU}wjiZ_O#r&wG#!^R_&C5CE1S0nR*;~)0O5>@*?f!hViD=!Cddl`O8$@ z-?J^sjK&qf@T!vVU=PfwF{38g>qd=wU{p9Je8VR=y<(K-WeVHcsK*+MU4&`UIZ zI2XP?gaHdMNj~ED?o;3Y4(QpDzvH`hcSMAS~8Lcgn}vS1jW zE<8xlKi9;Hllvu*voXJJyo1uG^6H^{2Qa_>{>nnyVqW3FnH3IXY$~0Y0KmRvwx5&j zBISSF2<80M1_w?c4J*^qI%cWfPod>4NmT0nC0OQ5H;ELN7=#Va3>6is8WEnf639+5 zmiDI~$B)h5yV798g;;~)20EKCrAzsRmgWc_WEVGyq=F^m2L|l%?I#K85#z}|N-NCW z+=RY3+jgP}DITcr;n9@J7a*4ZpzMGe`rO+g@Ylhyi1k3DLoX&x%z+$$)LOOfTNISW zEB7u4&Gzj=OXKMhNuw!BgTfQdlD5f#JG5Cf1#9a4R`7%I>?^fDS7fR2N`cy-hT=P1j#W|r4V@; zg7d8pydAj2j8)oSi67UcXY3i1Ue?_7L=zz(H@Dvquk(bt8vfKhDE&8?}c(VYiLDMYu{v*%ljT zI#dQ-uvy*~NNzD-SX%DK_s*j{$r2|1M9GNEj2&S^&80yIq0<2S6+uEF_e`rfn8iK8NGR-Yxb= z33X(8&Ui4rmbANW*Fe78)nn_&&3*XeZLibA+wRcW z2LTeVKwTl2z;(z_KWq)h7_RX%XhL%hrz?rdRP>aA;9P6T`BWnmkc8Nx91=h5nw#qx zusnR4Mt)DldCe(Qy^E@5`uw0Auni1tF|ejG-PXmigVnj7SnuU<;2N~PWvA*u{Q0p$ zW9H#t3Sih?ZMo|WHno_iY>JHU&IrEU;<{)1;(HHj z{Uo=9eZ4>1)|7s4n+}Nnph~&B>wvR!NwRV!O8T<87;em5r_NnXNE*2=V7# zuJWr4qV36TE>8{$UdSxTg-LgzwZl~RPxcCrlPZc=f^G2{8)J1Ddl*N z;bI;GKo1g*Kl-K8ob-RZ{w?9U+2)LL2|K!n#W6RRjP48?G$KvD%6NEfGGVY zFhFsg*|=pK;>pKJZu;Y!c&PvwJ^fTEYRdo$vD&-3ckyym%zk1m3YC}xfi0z7gajbc z;ecj5p5mYIE>y&u7Bi)*xgfAa)uzSZEJyPXz}{io%oqHf(lf;UE?jiv(X%ApQ}nzg z$_AJBU7w;PXb+9T5=u^aQsSweJC2MWdh>0vgu$i|)F?F#sPs}$t;OD;orm0+UIq_r zo-rA2`NB00Kq+|WCdY*Fz7RL|V$kmZ{NvB70r!{t%LwM_6uFTstk4mIT%&M~t)>rZ zPwBGV>3At}IBq6AEpr-a9be&qcA#QO?)j=2OTjBCQ_)e!u=^HbhOZwjrE_JokCHW% znWCx?qW@@#7Z)Dx+d4+GZ{7rd6jHP=k`NdcjIOs2*!s~SP}a(8lG!Bta>Xbu_MMEO z>JwYwi8~y3e@X1*1Ks1926(<34=Hy%ryKW_x|+1^pl_MOAN7jSZq*~2xRC;OBS`h|}xS8rO=Xd@$dR-ZQ5%6hqO?BhCl!<1qZbkQL;-AI_rnWy@Z zq&S)TxFc1iSXmQ$z!+#Qkf)tB5%~cY(46!7T;!^_NsKcb`8di+lb?LI6N_oFOXJGJ z4s<)guB=7b{RA^}BYPD#64u95!RguCKk-(M(=;1AZ>k{ z=oNAk=G!pg-H#;_KYykE>Jv0S_ei@46k|A!JDpplSz>FL1*P+HV?xF%tP}Gx%g8#c zbQ4pRMKR&lPf>pgoQrB^HNPRsawz#@Pq2k1&i@;2i z>6NjlUGGFYf#AsUHp<*G z6?6`tIDGP0V98LB2Jv7n@9Pp*Y}h*+EcVxa_lr99iK`8b&c1SNHXjC0(^sDkE8zFq zipV&VS9$6hkk`e>uXn0S^2!ZNKnFh@_j7|j4%`lgb;?JS1+qX1hWDLye-llA*(2WF za|l;H>YoTd8|82jj0wxt@)ao915ILOZjcxVHlt#d;2S6R!vFcD)l#4 zS_-eguTVfQ8fQ-5yl}dLw+v!ULA-2>{j`i3>5%SkGYS^5pV@D8wm2L&51XipgUChb z+t+j($XG5NDEiWd?&xIB38w-1HEuQM8-+XhN_&zDV#bI33FN7K)O#Vo z&^-A^>ncww!DN>T3Sk&8B?daOvO|)j)DO2KXX%NWaq(GN$%sVcqp{wx`Bh*+XE`!g zr>s(l`uAq8A8rMxA#|7_+3!_dBbvue&H9w`CEfg5;sst(^C>G>v%dposLJz)Ub-eb zA(I=r8@~An;yHrszO*1-W3hf=D@s)67IfrlGxQk7tiV+R33I?v)JN zy%}9Upnz06OGykm)4QUzPD66;lXIQvo3xj3Ay_809ZnDq{yicrN)x;{-`G8WJpd${ z?)?Cfh;nBSm@;_|YMXyH8Ut^KB=d8Wp2c~}s#bBx=lM1A2o@gWAU`IcLi z!}(UCWQey&S9d}*h7%fp*D)AMCK~H8cU}1sj|pk4IDA4$Vw#Dsih{)HQ?40_Y)!O8 zNnfC&)Vp+T#N&=ndmIM`H`4tH-?q$>jWn$T-*Sq$?2#@Pq@diJ%8$zGIP~-(aPG41 z>XsM$uJ=IQ?wB_xA_vhph~5jCHAL!MS=wz*0x>x;#RXG(Gxo_+#7)u%nhNLGm|Afc zgUpJw2-Y4WG4G06cZhWNK)LHLHChG26zcTB79AQeY_FfPxa% zZoW5W4^I1>SJ|turaxRBc~rI%v21IrvnNz6gq&^2d%C&!Xs+`w4;C?@HiY3_eqx4? zh!Pin?YgPy)#Aq*%RSS+DNNuR&gGx(ql8b3d3?tf_i6e5inP}+`(_>OO`*^hO(97_ z*$c~L)&Ql)Z>GnczV1E+3@Y&_k|N)J;h4&>>_|8iOAgQO*qO?csB1mia;gck$>2rm z+00YfEE*M(CrI6JJ@m@h%(c3F*EtzRC|RgYkXLAkJ&*OU5r&y{cO$*)8byk+l$tND zn_XP=-0$b|XDS+*%Au?^2mz7iuSETJt;Kk65l?N)Pc7c}5~Er8o1_C~@z*fgF`57m z6LDfWRPnILV~1FV4!pi-%@w!V-WaHOvM-R zdZ^dMzMRt|1cdyKRmx+EoN|8ic&V6sRYtfbCdJB!XN1@mMbwwD!)VOmayG?inV2G> z=N%j_wXyE%NXvCTLYNQ75LTU+%;^g7D^E7o;(E+0eaBxk`lX|hsrDIfv)XcQz4hzL zk>6TH|M1l(VwH8aq_9UK2@tI7b#Kd9w{CVsk&Vqtm;%T)C(Aj63~?o`?;!M5XIW17 z#MG~c;bpBF5sV_5_>$p!gn<;ZG-e4iwQ1gwtV2HWtteg^N5|Tp#u}cxnJ8QUUtjmiW4Uwm7!!xl#FZ-^o@`t&<%(eQ(5DFsD1?QVCQy= z6i=IyAJ`K4PD6yWs6rPSk-+2e;Rj9SGoP6oya~&~R__!V@)h`MaWKLnPmHy@N6`x0evh0gb z10v3DFM7zi#~cR`3N;=c^;k`&e#Rcn%Og}SCwq3M-cdnsxIe#r`D8Vu9uBK7i%RP$ zn#{y@F?M44S)SZD)*`*EOH(9s80)Xo4Vh!KjFT>h2VsMf*qv^?ykd$0vmJfDgPV4+ zk%6&IGgo;@?CycMWo@gQ^^8(zZsAki#u9V*m1B`gF^^+EdsDRwa8xHXC1 zvtOub*+nZXujXorWlCL8MT^AySXnb;iD}2r6*2oAaKvA-nwO*Ynv9Uadrf?Wc&;kMH4v%U`Zd60bWyMLG9NCq%6c zZ)?_2y1V9!K3Xk7``wqO=m=Dfw)3`5pz|rRV%-$?ZRVrUm(HCXty2s{o%wZ;8&P%H zo3*5Y71S{oXreaZzGzR9v=4DFdGXQv~9LFY@Z&Cu;)81vt###JU zc5Uge=$19@(S>=<9`iS4XA3xo7C5amsxt+xKO%2*7UTKo9`O&m#FtK{E@Lzk64yscdqgt zq~ccq4v&K5G&_;^9wd$j-F-ndk7IzY?`0iTzpqIbf?CpqINB!svUkfk$E$W|_eu$p zJb_~MHxo00)Qn?Zt+}#Zw6^fKOAHpTBVVWqAf*=Gxe?lvUDY;)nW%OF&N=!+`z8_8 z<~JbKUqy`ZfsXjrTEwmY(eqHKtLs^Hur(4UV};jb+`ZwJBxFeHCFe(7z_SWb(hL7t z@KgIr)t$ce{$Xsd!Ja=MvG-~#D&EyD(XF8(~NDLMo*C(bg=sgG$Pru+X`)(_-Vzl6=m7_CZwU`_s3vIuIxtZ|5=ZOrK9U zW=nn;&lc9qx-+AimaFAQy%os{Ds$I1!c&rpgWoIFsyqRr!&Ub4m2usxabIysE~Z9E4oHyfrTe z!qMr!k&`NyisI>H8Zjm?!d$zQ2)OAgBD_I(&O|0i)|Wrbz6$%LS6fW7@8hZ$4ww;b zC4~OdS#s3ocbh61h@GB!3ofksz5@CMPLQ1JBW%yj3VJpkAi|ZbW zXYoo(SAEZ@;D6o)2uOog$tP}~f9|Au+f2~mwpwzapF-_mFH1?2N9jc_KTYYCu@i&1 z-dU2L5yt)M>L#Usa%g=w`ULdLF{`Ito4Sr<>sV#oQqwG= zpd6gR_MaToXEKSQ6_+$6Qy%^`(qPV_ouv~TC^vC=bX>F8|AbTi)%9s65vK$ ziVa>7-O<`@>evi$9Xhvud+l*rVKCJdl|?IAJ4dmFZ(DtVg)Z@&m7n_7#ac@ie$~j? z;LW!dZ%Y9iQC!a}FF)h2ceDkz>iE<$a`ru&XBM;u(XW;rC3L~0$qe5j`WYqm&{`sh z0-k$)SxhVXIUgNz%z`QWLsaExpE;7AUicStb2RfBMH;^JP}&mI*CbEYc(yEX&-{Lx zC2t;I8M~6bYKOS zGAm5s8EyA)Va zH;EUC1NJoT&V&yw-=nAf>J99+*!>{pSY6Dbl{O8)VeibZ$O`#C{OHd8r*rw%a{$`d zJ?XrPusZC_@wT6aM1047vHZ5ev3n?7TZuRb@eTEi2tx6<0gH`QnEv|j8f_R+n3BRt zQHDFhQce`}v9m4P6D4XfN3M_CQ%=I}#2u@NK!rc*lbr}zvHkb=^=~>oHp43c{sFvB zjhb9kNK6TSyc@J%4KS8RkCal3x)FAZi(zHX)nzg|CUDhb9Ml5kIsp$Sm71zVauw-& zve;$m6xs|%zG#)Nu_#lg!caL)V;K5KH7kWxF<#9vkIB#rvfOGCY?$O9l%REUrZw_FZwFg{m_HKkNKA^HO;kwDsQonBlewsimwYRff~;DQ zl;WVg(;*B=eHJ`CyI(4)hARXHd}=hBvH+cpZp~~{{Qh1QyN&pKB$z$G_#VL@UbH&p zL>dn?Q0m4i2HziFDh!2$6>h#&@0f+Lh{bWCn~d+r7`8s>qh(AM}2I)YTCSUgGptbx5MH(nn4yvj}lEyBH% z0d^|TrT|HWy^6;7KR$q$nKsoG6xypFBTYe)?v~MP<>>vC`{*FPPni#A8WrGE1bXLH zgLwlr|5!n+dH`AQA)16sHaN1^`e$eO>idEYlX*&wPx|>qelu(KcHr1S;}q@k$wKGy zSp$vZ8KnLwd)1SlC|H$%X1|ug%*=tbQWFo7bpnnABd#>SOVt1XG@9XR3ygjSHMEbc zzAYcuTwOmE5+Yc?6u}VgTu-@8Y3WunSe7q8!ByhpX#U(ru%7aiqtEdL71y2!WZX6a z4;=svfFGkYP7sUqHO^k)!+!_h!s9-l11xEc_Qt9b z^I)X{9(gOLR=vXqzPVK@S`$KuR3>rF!z;NOhNT+4_Mdj&Cl+k)I$iJwxw(o|#ml%? zn8R1V#WexgW0^=E=DCTMxF<0zZdBHSxE0K&y3G_DbX?nUzO-0Qb!YR?q;*5CGIRv* z4vyVC3yVJqOdcnG0c5|RcL((~q*NM|_wCr@%*V{Z+K{{pcrfOuTum-&DdHH&4Zx4e zwP?}?8*(}~(hHFgw^PL%SV4Qb$s+R?^W3wwYnaja0^+4~;n(l=6r30Z7+4;jc zPX~~SqgBnSqX663r(Y72Dm@!k%+SuL&4R^zi_$^Z7-bU=i51UH7`^$@5-#r?u9Blw zlQF{m$+e`T>Va}^N!NrxlNP%LI4^p&ifoct0PFjvm9(p4PBXRrgKjMUXl#@eG5>YE z?on=vskBU112B)}lXow}t<8Ab&V5?T0}yoZv2643^2osGV%J_1wT_7Id`k-^t&$|0 z{^|Ng3iBA{Ju``3otn`iDmUHEN6>(u7pD!a;Ho`zL-j_5K%96)#tIv-I+nTws6EW7 z2gDtj=hGf1Xzqrm76m4~zuFTd%$?>2B}dcr>m`&twCL2G#_}{xnLZx@sT3-j8Ab1* zlq8yiHM*5|tzuE*uQFZpBGo|Tjz?}&P8ZJ7>_f)8&!Jy;J_~5)S0$ePR`*V$H;5X< zFo%q+rWrP;nt>giQcTU?EEfQy3CEdlW&<|}+{b5$v*GErK#5tB`8N(C`MHKo8ow&5 zNs3fPrDVIZrcx&FiYlt|&E)p$W8E4g2vrRHDIm+a+AcCiH8-S?tD1&|&Wz^!?8-(0 z&i5%d*$6;1P-fV^0&3#1;IR=;s~x*B_SFREg;2@x;%Sq>qgg+DN6Ag{^qiWkH?pym zi~L>%%k1@>?09r`$+zBp>DM%9Agd^oq1~f>@mC3NzXRTv=m-qhzXog23;ArL{5?DW z*ZlvB{DTVrg$Ms2|1pc1*i+Fy63kedqXa2hzj=vRhvp6`3suz&{R7a>8cv@j=t|=Jt(&<_B}k z*7g@A0oxq>w>|9Q=BuZjkR(nqv+|W%^)W$#gfCzTra6dVUGqcP6pPjm>Xgv@youEm z$rQO=o5pMw!O$P>Rn7E6g-){h6Y+x60j~$1Zk2~$f)t|XnnvVB?*(R0cs(u9p~?dV zDmrS~nOa&(UT?t~6#`C04IJImEn+rWx9@ z?!+0F_~5-}xyC+YLL+;5Y=CN3C}2>@y77@@xnu&UV}3AI>cpjsvMZ3r^DKGq$FUbTs{yUl2&szp2zF33{PzBRNpy1oVEv>ZyqC9*Hh z+-iFAL?kAN44aR^pD%^2RIAxRxtO+(+%D=uEUmici;tbHR)p!s{E?v0xtnZ;MpTbmuXrG}FG{HQy%qe?SGhtbzdnM<@maM_Fg`FSJfLkop_H&2JZ#x~r(@EZk4}E;CNT{urn0#}lA=(*d-K&LYt8%-1 z`^u5%27<^(VKJAbPC%HTN{+f7Q%W3`cF=@y+3$Win~0z4zX<{_<|@fn@cH7M^tHTe zTNxx@$w7Mxc$D9UU>tntJjsFri#8IczT8CRxX6U6Q%yncfIDaxqO33Zeer)lxUV7; zeI3V-jD72PwPr1Mg$&rDXNpX(-$_^8iSB5ktP={9Xcq+UoVb3Uy-6R%e7Q}``Wnk! zg=%|9p1|@$kdHzhk*Z0bUa`NTx40o6msp22uU`tE+)l2{>>He%8%>dcAL!&Pu-bW6 z%yUXHoCi21SZY1e>k?%Hgh=O zg#G(l5o#vP*s6VAo6!;20T!_V-7CqxR)&|CNS!DE4lrWdpd>D#ME`?|HIc!fZRf?x zRic0-c!sgO=19fi(87caP>97e>AFyMuJTe+^Jn->cxpJ>y2^C+MkkHs-G1qvsaWm0 ztBS$aT=;XpZXM+%Y%I15n7XS2I=}Jcd+cw-h&jz4)YAJUk{3~-ksH$qgE@#BzOe~Q zf9`~wRs}+S&VFL0IP7S=?jx=9@L232v@C2WFFiQ~P6foMhu&GhQ~M7N4c%3^`u~{k zui&&Fh&aZbUGJCnjAd}eyaOkHj6^Y~sVsXNyN-ex+ZJu0wJN+BQPPsKxX?JK;RsZ! zKsHFkf6yiQrssO8R20xsUuaAU`qi-Mg^EjDtbK^(I)FgnfmlN=neX?>)l=762Pf#! zrU7*dVK6X9|JT{Dn2!g>{Z|x4Gh@`>g8~*xtU*mz1C?G09E{MwZcWw9-IJY*)oNK2 zAC}Ge`1A2YuakR{@XA}3ApwI?Rc^qfX24_u3j{Il>9r*Jx{sITV;`RU;lvkTt)nmB z33dD3>L7s{a0bk;lb{33JPZ^>H3`()QegdP0{PlHAss+t;TpNNTDBWjEbhWt8Ir-# zigDz`TMG-n&l`IUYj@_eySK!$3q9ao5LVB+z64K6OcI`4)GZ+QVd>4OC`hCz@1tA- z9PW~}-a(L-pRim6ZmV1kK6r-}%P1MJ3@;>oOEW|CQ>0#W1Mt1)bLbNEQX$(0Q!WR8 z)JNvg(J?aFoFwR!?Ys3p!vj`zUgAbm^_tT%X^T%tHw=NG-f^W}vqtZzbkr(I@#zg> z1CBdMY5UhB?u;TkgS*Q2=B%&GZy0Gp!Q!)lk9|`IHdR8Dzo#H&;eSFFn;7sWyGq^a zlxmd9_L^l;J6I%Ke0wxLsoN>|^Jm#lQ&SwweLUnYB81EEvv4CE*Y%$`(QNhA?@MYT z2oT2i41!h2+dho8SKjRTf3W=mIG><1*pSz(R2!}c9~~_Z38Hc>d7I(%R>!{KC%=>w zroZaRdBCrfJ2th-$vXQ4s@G^`xOm~;lq>9WOBs6~_MV5LOFRl33k!FVix^vi>W}D< z{S=5yT!H%$i}=S|IS-eHAMhzxkclD!9Vm_x*N?4O>=kY*`kL*a$^GJ%ZasE;2Fwk|!5qRGk0 zqc1#-C`3>^J4lewzjQ`KpaCeJNu*~&Sh(|<5J7n^{VDv1`$yK;X4#61E6ScXaAtFtO zR$*B7=2^=>wEe9X_SPU%_t`3}yYnkLZ6cn{sxH$!w^th_WjyB1KJ9&acL7~={;NUH zAkpDb?Q)|etVVBXx8KjIq=V7PH}7~>Y-LK8v8}2oo#&mVn${BT;uB-wMhm_uz9d74!!s8jeowkC9I%&G!$$*6t?wM~i^vR!2qr?YVMKZL3}e@6Dt z*B+zPCC{xa(?{11)mU-pk3|DzLzxSS+eUKQ&|pZd^r5&+Fxt8A4xxkfvu+auKLUas zu5-|Cg<@@?3kP{gW%-|eo8`Un7Lh~Eb}jN!FsFVFGLsol9{)iqH6e~LFSGB%>thDw zs*Q{Ht@#~1nM>H(Aij*1DVV@ZTjd%VGtSo(ysZdxilx=u-;S0@tF+wM49sRocT~JL zP`-}gXyoFt-8)ODN|jMe5;}&~dBd57=|A|->5ntgHvMjoHP=La9a5$FJaD4xJHLv) zgJ0QR8KG2B>(iWKJglEGYsjqGbPB&>|BaYI2=o29D>WX9*bwIwdugM|1^8`z;T}Yu ziIK5PDzUn!m+-u*4uHPnPL$%m0sxh&q1X?oQwD46?Cf#M8-Y*}1~UIZ34pCuxu<8Z|idss7EcIR)|X_!fG`~OS{zv4D+q(TDi8d%Wr?hbJGZoq3pjh zyIpS(%U-5@YhZ{M7->Wy)*__J&JFOiDIJQ*;>ey1M*fpKVgTsKJy`L1 zL{Fk_{WIFevQg_7g)csnxM(?}ZHFJY?U*S7BXjaGf?nKCX%Ky+T7*#dM|8Vrh!X<7 z9ajn@VPeuvnV~-qQ98_u?D$(A1Vqb&_TV9fmGn?<(ii$aBA$PZUo28krI)+CV&JuD z(5*U5>SIb6sP0Cbce#O5c*$x zxxVUaTjEWcK`oaAtA+%AG*C>y?RiABW9BjMjpP)XaJt zzS3JNQ>;&a;sp=7e(D&S?G|w~deK;xt!A~bm}khUK%L1tJ{VJL`)-Kb1M-Rtxsqsr ze#FojT|8n3Lsf`O(Fe&l*dS>BjoGhGN{_EW%2-(u>L7DLDh!4qslF)=h$Oi84snb_ z2Wio0xbC`{vtvZn!U=OG6?3)O{itc%%f;(B`CfVe&VW9mz!PGM=4+~!->~MmqXFZ) zI#>$i5?Zu_x2w54Zu_#f_H77LA$;-9i#!{OB^OF&5D0OVkuEI^R4?a3A!+|nCEnhF zBS=e378hcG9v4f9Gj`oq1d|0C+p=L|j#2O_zXfdl`bX2>6~dL9%1guq}3HFoeb zf53y(*!||^3n~v@S8Q}v)Ig0&BYjfLW+U`}ll4Xkt{;2K8KinEp56Y8qJ`hg?Dzdy zD$4??$8aY+bAm-Yaa08y+tygg*a zHM z{Op0-D{BrKPlh z#Ix(s^CFT^VCh@)ZttH(k5VIMupQUznoGhn)SQYKHF4Bm(|hY~)n96`l2z!xRcP;w z5{;~Pnz))R<_z!>s5>DFTyd7B4jJ*D&<^9j5|VuW)0e2pAmYg3=UDGP580;n`*S+4 zVYM~CrfYf=mS~+%Jfn2Q4~2L&OdglDw{RE3dHcH}vA~yrDF%5}Lh=5C9VGR|NKp0M zg`TDNm#ZMV%})LlV|B^*#TA0%%;V!_d$o085^v>e1X5hD;1U%cH%BlxkHzaQ8MY=| zc?9PRhiU0!I5$XGwtJ&}9uJl8mBRCPcGW$5Jp5PV>?_LFKc0tuAWE3>Dnl84Xyjuy z_s;qxN7ym&TV&t>cillhmEC|-#&j+-F7vFo8gR2|KJ~#RyX>m({%*N-Mh1BHdRwEBa$0j&j8Bjp_ZOC(V5+%Dm@b5VqSV#4~-8lwcn2#ixECHn-m;7AXyizj03hS%%1LIpAbq>G|)cP%Jxgg`J=xC1WaysGM&_?o@ z@P_8lTh5iA zCo@(B17zMcwYNF(v}GD<2$Cw;85Ga#U5b7 z*AXa&z7UI!v}}cVitz!Zt?t*`XkS+WXZNcg>tBjb*X+TQt^0y>?@#5cW~w~lKg%KI z*SEgli*5fryJoggIgX&M9y9 zX}Vy#e;WkWnKyKvi-L@#f)NEvs>CLF^(feA9cSBln_IjQr~T8HPWH>04@h0W zc%qy$xYxBtJ1!rfDhnNWtCVpz7>Ol@EbBK5YYxHz7=Yh^|F5&N4vMQ=7JYyKNpPPq zSn%KjBrs@#1=rv{xCeI#5E2Lj1a}DT5Q2LG!{E*g65QPfm&*TumfZHwZ=|9r8< z&KN)FB>a^6s$GZg^9^`H5j0W_2>2ZN8v3E&+CMHZlLOgZMe2&$vcm2vOP&_~(1JfLm*tVt zdmRDT8Z6pxv{*^h{*nFJ7~B@q9VX*J79NwY43(V|@g>-w?G6H@(PPz)#wP2?;ePAB z{L+X9!R1SS7}WroIH`z?fh}@R8xv|UPWr?}aI%qHrCYxxG>e15FvG&*q|r6how-P6`%loCVmV!Oz<6_#jiLuycvL&885@d*$Q%N3RpZVq(JvW z;5aU%z}?87r|SDl9{hpCK3(bA=X_yrxg&|Q>R_crM!zo0QAs7PU2}I1qU_^#^hbxR z5WV0waerUO>8Q&h%SFBDX4%BA`j&u%pj-3s<|w$cn}N*(_a3L1}~xtjAh_(X3R*ILVcTVKAMrSj|| zz(bH7f1D=lF|u3|56R^x*K`zJ(q*YLbRN(b!6W)5xr*yrJ^Zdqi-j4rC=NW_`AG-g z8*FIav;O>u1#yhqjGLHy8FJcgskyP8-_pHmymHO3PvvJ_TIBumKu`)+K3)n0pvh_0HK8ed-Gxbh`C-+#8;(|wpva&XhryT!o~aH zYPX5Kmxc}8XeIJuK3As|w5+D3Ipe#fS#h&rxWJv(Bbrs85Kjox5{3WBCE;O|^LqwN z65_UIzU>@1rDQf52HctiPS6&uL@uUHr4K6|6zq2(lxv1Mh5O(XZjxaJ<=+Nz)|On0~uh~p@)WqbN`{% zjd?j9WRpUBcp>vB`@(c8TfWBN4a=;mKFoLIxHr;MjdTwpA0HCG}Qv2zSSKuf5%Hrs9k0oJH)oYV3Cm zLihZRy3?%P#tjO=(caBVOeiwX+w{9PgI@g+AzAR0IHLJg1pmwkWrp#n@70XARlXlkVe(Lj{5KT-p9UVR{{S_iXnz_0hHC!P@Gn?X1#mRmLwUji zz__dYblH0m^NRWInw5|8BVeuZ8t23s{^)Q3?f-&3AF8W=qsjiJ{=ZziEw-^<0xDd|j$$_8DYu z?waiMm8Cvs!x0_~yy`{qvwdt!j#7Y?Y`d;ZW?_7;FpwEXsGgxtW(l8FlN@$xHxHSI z>#u{|#bPXtckmGu@|UVv6RRqYu|W#lOKjC!K3a4vxkolz-EnPgT;mhS@xY%kEmu=`~b2V`C4 zv2WjmIfKZFcIFnm$iChkx%bMFs=78vBKK&vUvG6FP?j;*yVY4&mgs&)mt_EnLR0GG z$Aaa6I`#lrJlw~3)1GtszK4#wQu-3Xw|6ldop872eiHb~RIm;|*55w{5Bfhy_5aP~ z{r?!>u}l3|ufl)O>ks;HFz9HyY9bA0*24|pOP(8R^hkzuFKwLxCEJb|2MFgC_B7tv znw^pNpOsx}3Vl12@+doJf4NrdT*E%59~tS%Fqi3V#xbv;UWad`c*TGHT35JeBJt`o zt3%OCK(>QiTl`sP?zw_O_ps$m)~^6ghi~_-C#E5@^i-ElMX|BA6k~V~RZU9SG#ef9 zL+Ry;yaf$0Bi27jH3JpU>H2u}lcY4tVx3)ut7{>(0D9D-&NX)6_u+OqJ*@&;+9|hu zMQOG`yAZ-JZ9g<3^5kh^1zf0}?M~^yxg(X*_nTwM)t0iUT?IJPR4;SAit=tjyLLCF zrYNFV6W(-++s?33VsM%Xl0OJ8ZqZM4W)YXuJL5upFKhO2_bh4}ImUBl(NPVYplvLh8vo?W`SzLo0ScG_g>-V7;ufBsk* zL|eQTv&?A^6=+Y@&eF(w(f*zR7gg7wtP|x_w^7g+*puMsB*tlLFzZmL;6ST+ZJ?#l zC{=WuD3hk&s-^n4#PQv-SU!A;HyyKkP5A}y+NFG!qP`uw{Posc=kdZr!{j)EKBIJh zofb7KC}gG{!?)J8d?GF+w@{W?$abI1W~aI5ce`BvDN@d}Y0RSB?3`x!wKsoNsTT{T zn0vlrbldox`pHpHr9~-&Ax-Nay5VRs4%Zeun^Jh7((BR9Yl!V&juUV-)7UtE>9Z$( ze=4)B`Pq_`<{%q8#N0Oj&?(dz-k!1dHBZ-iH3GX5QJi+efU}js+;y*DBD#f5urpPQj z8}HyT|2yM)dfqVpu2ogJt?MvDI82_BQa&yc@(jv4DTqf*A1-^q&iLbLc#>w(`s z`23dPxtpWUS>e+6UQ%L`py_HnuPK{@`B>3~CGKJmoRn@|Cn4$EvGGx1vbr$JSm{p# z+p-o;TU^4!QE4f#)w-en?i`_2*)K5|Yn2mxu&j16pp zTUF~UPm391E9;?nuWMIo-}!wWV78W$1)e1HF z#t1*aE1tLxfv@cwwI7{ zwrOngvF)ecQj(A~Ialt+HkZjY{tmbv#GK3+B?O^zKAXm6w#28=-94)$`F0SpDePr( zsBgCfAMW7!o@KUeYijXw*63-q_K;UNz}I#3pO|86X(bYdKpsDj62>T=Lq)u5~xsjS$i)oxIg2mn!t zLcks;=)#UN#2VVbR=S_8dZZVR#+gurLgiP0I9!nyEh5meh9Y<(Zo?zbca=xagwzs1+ct9L~1%Uo0{s+&$;{FHEzrz3a%$s&Q{j*B9J+CC~ zm4$8b+q7KaxwNq4CfMGedQ*#g0$Q!-J4fvw5N!JJ#ZlSOsDlD z?Bn*$63ok}A!fO_M+7oo*Ph>hd{$Ru74-O&e3aXTfX(7nCBHo5wqI|e;6;Qc$5w54 z>^6$qq@nYEn?28yQZ}z_el$HD6W~W(MK?DQ)}QiT@?p<f zWHqkPH5G=?2RKnQKfW^|iIhCPMCkWz;OR8Fd$!9!Js1v7(zVi%bOid=(%GJ=*)Sbk z2Rh4Vw8?|yB2UpFWwpSr8_mTrcwz*6JUsfU%%-s zWbdH)1WViv=1H!4z|)HR4-Zo-UPY;cJU0)?UbN*Hc{X%GI(wsM8;T}g;J3*Z2mO?0 zmX0j6!0;zMVf)$ER7q2t@O}`tymom;Z8Ypasm^%T7YhHC1}=A#tk89%k)4yQ&-Zk&(g9o z>7Gp+Ez7vX4O|{|Q9zGnd?50e8)6VzlH-hR1j&BMhR1CB1}Ztgz5YF)7wRb_kwe8z zOIxVtV-hP+)<0pNL;wu41WZIo9Pl%QgKOs;Hz(>&lXXR_MXZTQSaZ7sP4T)z$37nj zzg+qJ>IRg9u)9V#P;u7%G3H6=I_6TWe95<$b~44A?3tBVtl}X`un?Lp?YG@UnVh*O zvG5tl=K$y_Q!S}Mdp}h`cSXun7Lmaqlbj#4iUZ#9&m*e#Pa=`tj~$P0l0| zDsXI3mh(;!DI$dyr!;3|(=+71afJC!VH79$iX+rsJN-@boAnv*+dW6l`AdT#lm~^J z_}0rQcNzoJSy%#SZgAbG^1g*0RD}#7IAUVbZcoBkhoHb_HD4e3VZHBw%lLw14Z!lh$o$JQ-XIvn)~bNj7S&~I}`%Q z;2c5jpGjZO`i}Iv67-j~PuJowAj5hP^d5$sj$kVf%$Y-|*DQ!oXWxcU{4(G(dJ3vQ z;|RvJL^ydwh0ZB>;e5;%O*Q!CTJMNuofWR>X!E3MxRxaQS?Vwd75-}#jgy;}v*T`g z`SzhiTH@~OE*T37Ggl#?1*ZeW)VcnKu7F1`mo#u< zg2h0gM;*ep>}T_b*dHi(%EA}XRi`)Izt%-BC5wk^H}Y(y%mgL@de7a7F1lI~&4h}< zO+H;2lLXc6_7ZT!H*C6EY;__*mFIR}Xa$I0{O%ba2D#;OEnTfn{MJK&aWA#r4U^;+ zd8Sr@K7ae&z6FanGjedp-Gs4T+ve?158jK}GCw2k(>5%b>_* zKakSXwuqR9>4hVCq%xl%d`bYG-1O;cemIbm4>vLyZ4ebfEi8Iuj-W{HDtjU0O{?)u ztcxLuaXtRenuUSUolqacx!3i_D6yve1D6H z4_9HH&!y3s-MVWCZw7EX5}lGK;mUAspS(R|wv6eZ$jiSTxhWSIaHh;P>mA8d7wcb_ zSn;FI(rh~?3_4oUCuO=^J1)}>mZejE&0ROF**aR300(G9rJxU-=9z5`v>@k5>%nYLwcI;hz2f6FbV~Pgy)E zYyH%tmh@`87uaYvWEn8;e|ycorG&D+Mt1xjY|pHN3%aXG!B=Bx1AR0$q&J#boW300Sz^50e)coAU8bDBy}tx6 zP^9OkcE~a_woBS|)}_fuo4ITx*(Re~3NAIOW0s?yFF91^m|#JwE9?WBbn%AzH#WG) zADEER#Pu3Fct(0gsJj7DVg_FL4pRP#L;Ey226z3@ZSnbF`2KkwJJXRn z+&wAX`RC8aeEyA=P3D4yeZ^##eURuXHHuonZMUtxhXl`J+N8OJx~)DimnGh`)yAC@ zk@9j=^og)yyB^3G*DgGYxl8R}M~^A`VTNo++v?`Prc#-LkHA|e`x&p?H|u>(i3-XS z@+ZxoU>lmj%~!P?Dz&ZQ7SAETl{)P4&8Obm5k^_~`tM?m#K@)1zLGwiNLCyoL%>O* z@4o1dp<~9}T2uY7vr8U!`7zp$&T?R2?DzP3H?O; zds^estMkiT*%s1MwVCt1BwK$=;b}ixAK|9=KSlLi(ERx~EZT!< zeYCCR`eN)qBjvXl5T5lzHWItY&^K2fQNVu#XZ}h{{U3_vpR0dyHvd@t&G|n-od1=B z3GOd3NN5vMrN2y^4wgW^g_>YtX-+Az1J-WmEPfF>p`HKH;`KNM^8HlEe Xxt4U;N5AsdpE2a5m8B{qOoIOl**Notes:** + >- Change the value for `assertion_consumer_service_url` to match the HTTPS endpoint + of GitLab (append `users/auth/saml/callback` to the HTTPS URL of your GitLab + installation to generate the correct value). + >- To get the `idp_cert_fingerprint` fingerprint, first download the + certificate from the Okta app you registered and then run: + `openssl x509 -in okta.cert -noout -fingerprint`. Substitute `okta.cert` + with the location of your certificate. + >- Change the value of `idp_sso_target_url`, with the value of the + **Identity Provider Single Sign-On URL** from the step when you + configured the Okta app. + >- Change the value of `issuer` to a unique name, which will identify the application + to the IdP. + >- Leave `name_identifier_format` as-is. + + **For Omnibus GitLab installations** + + ```ruby + gitlab_rails['omniauth_providers'] = [ + { + name: 'saml', + args: { + assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', + idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', + idp_sso_target_url: 'https://gitlab.oktapreview.com/app/gitlabdev773716_gitlabsaml_1/exk8odl81tBrjpD4B0h7/sso/saml', + issuer: 'https://gitlab.example.com', + name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' + }, + label: 'Okta' # optional label for SAML login button, defaults to "Saml" + } + ] + ``` + + **For installations from source** + + ```yaml + - { + name: 'saml', + args: { + assertion_consumer_service_url: 'https://gitlab.example.com/users/auth/saml/callback', + idp_cert_fingerprint: '43:51:43:a1:b5:fc:8b:b7:0a:3a:a9:b1:0f:66:73:a8', + idp_sso_target_url: 'https://gitlab.oktapreview.com/app/gitlabdev773716_gitlabsaml_1/exk8odl81tBrjpD4B0h7/sso/saml', + issuer: 'https://gitlab.example.com', + name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' + }, + label: 'Okta' # optional label for SAML login button, defaults to "Saml" + } + ``` + + +1. [Reconfigure][reconf] or [restart] GitLab for Omnibus and installations + from source respectively for the changes to take effect. + +You might want to try this out on a incognito browser window. + +## Configuring groups + +>**Note:** +Make sure the groups exist and are assigned to the Okta app. + +You can take a look of the [SAML documentation][saml] on external groups since +it works the same. + +[okta-sso]: https://www.okta.com/products/single-sign-on/ +[saml]: ../../integration/saml.md#external-groups +[reconf]: ../restart_gitlab.md#omnibus-gitlab-reconfigure +[restart]: ../restart_gitlab.md#installations-from-source