AzSKStaging.ADO

1.8.6

Framework/Helpers/ContextHelper.ps1

                                <#

.Description

# Context class for indenity details. 

# Provides functionality to login, create context, get token for api calls

#>

using namespace Microsoft.IdentityModel.Clients.ActiveDirectory

class ContextHelper {

    static hidden [Context] $currentContext;

    static hidden [bool] $IsOAuthScan;

    #This will be used to carry current org under current context.

    static hidden [string] $orgName;

    ContextHelper()

    {

        if(-not [string]::IsNullOrWhiteSpace($env:RefreshToken) -and -not [string]::IsNullOrWhiteSpace($env:ClientSecret))  # this if block will be executed for OAuth based scan

        {

            [ContextHelper]::IsOAuthScan = $true

        }

    }

    hidden static [PSObject] GetCurrentContext()

    {

        return [ContextHelper]::GetCurrentContext($false);

    }

    hidden static [PSObject] GetCurrentContext([bool]$authNRefresh)

    {

        if( (-not [ContextHelper]::currentContext) -or $authNRefresh)

        {

            $clientId = [Constants]::DefaultClientId ;          

            $replyUri = [Constants]::DefaultReplyUri; 

            $adoResourceId = [Constants]::DefaultADOResourceId;

            [AuthenticationContext] $ctx = $null;

            $ctx = [AuthenticationContext]::new("https://login.windows.net/common");

            [AuthenticationResult] $result = $null;

            $azSKUI = $null;

            if([ContextHelper]::IsOAuthScan) { # this if block will be executed for OAuth based scan

                $tokenInfo = [ContextHelper]::GetOAuthAccessToken()

                [ContextHelper]::ConvertToContextObject($tokenInfo)

            }

            else {

                if ( !$authNRefresh -and ($azSKUI = Get-Variable 'AzSKADOLoginUI' -Scope Global -ErrorAction 'Ignore')) {

                    if ($azSKUI.Value -eq 1) {

                        $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always

                        $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                        $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                    }

                    else {

                        $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto

                        $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                        $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                    }

                }

                else {

                    $PromptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto

                    $PlatformParameters = New-Object Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters -ArgumentList $PromptBehavior

                    $result = $ctx.AcquireTokenAsync($adoResourceId, $clientId, [Uri]::new($replyUri),$PlatformParameters).Result;

                }

                [ContextHelper]::ConvertToContextObject($result)

            }

        }

        return [ContextHelper]::currentContext

    }

    hidden static [PSObject] GetCurrentContext([System.Security.SecureString] $PATToken)

    {

        if(-not [ContextHelper]::currentContext)

        {

            [ContextHelper]::ConvertToContextObject($PATToken)

        }

        return [ContextHelper]::currentContext

    }

    hidden static [PSObject] GetOAuthAccessToken() {

        $tokenInfo = @{};

        try{

            $url = "https://app.vssps.visualstudio.com/oauth2/token"

            # exchange refresh token with new access token

            $body = "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=$($env:ClientSecret)&grant_type=refresh_token&assertion=$($env:RefreshToken)&redirect_uri=https://localhost/"

            $res = Invoke-WebRequest -Uri $url -ContentType "application/x-www-form-urlencoded" -Method POST -Body $body

            $response = $res.Content | ConvertFrom-Json

            $tokenInfo['AccessToken'] = $response.access_token

            $expiry = $response.expires_in

            $request_time = get-date

            $tokenInfo['ExpiresOn'] = $request_time.AddSeconds($expiry)

            $refreshToken = ConvertTo-SecureString  $response.refresh_token -AsPlainText -Force

            #Update refresh token if it is expiring in next 1 day 

            $updateTokenInKV = $false

            $secretName = "RefreshTokenForADOScan"

            $tokenSecret = Get-AzKeyVaultSecret -VaultName $env:KeyVaultName -Name $secretName

            if (-not [string]::IsNullOrEmpty($tokenSecret) -and [Helpers]::CheckMember($tokenSecret,"Expires")) {

                if ($tokenSecret.Expires -le [DateTime]::Now.AddDays(1))

                {

                    $updateTokenInKV = $true

                }

            }

            else {

                $updateTokenInKV = $true

            }

            if ($updateTokenInKV -eq $true)

            {

                $RefreshTokenExpiresInDays = [Constants]::RefreshTokenExpiresInDays;

                $ExpiryDate = [DateTime]::Now.AddDays($RefreshTokenExpiresInDays)

                Set-AzKeyVaultSecret -VaultName $env:KeyVaultName -Name $secretName -SecretValue $refreshToken -Expires $ExpiryDate | out-null

            }

        }

        catch{

            write-Host "Error fetching OAuth access token"

            Write-Host $_

            return $null

        }

        return $tokenInfo

    }

    static [string] GetAccessToken([string] $resourceAppIdUri) {

            return [ContextHelper]::GetAccessToken()   

    }

    static [string] GetAccessToken()

    {

        if([ContextHelper]::currentContext)

        {

            # Validate if token is PAT using lenght (PAT has lengh of 52), if PAT dont go to refresh login session.

            #TODO: Change code to find token type supplied PAT or login session token

            #if token expiry is within 2 min, refresh.

            if (([ContextHelper]::currentContext.AccessToken.length -ne 52) -and ([ContextHelper]::currentContext.TokenExpireTimeLocal -le [DateTime]::Now.AddMinutes(2)))

            {

                [ContextHelper]::GetCurrentContext($true);

            }

            return  [ContextHelper]::currentContext.AccessToken

        }

        else

        {

            return $null

        }

    }

    static [string] GetAccessToken([string] $Uri, [string] $tenantId) 

    {

        $rmContext = Get-AzContext

        if (-not $rmContext) {

            throw ([SuppressedException]::new(("No Azure login found"), [SuppressedExceptionType]::InvalidOperation))

        }

        if ([string]::IsNullOrEmpty($tenantId) -and [Helpers]::CheckMember($rmContext,"Tenant")) {

            $tenantId = $rmContext.Tenant.Id

        }

        $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate(

        $rmContext.Account,

        $rmContext.Environment,

        $tenantId,

        [System.Security.SecureString] $null,

        "Never",

        $null,

        $Uri);

        if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken)))) {

          throw ([SuppressedException]::new(("Unable to get access token. Authentication Failed."), [SuppressedExceptionType]::Generic))

        }

        return $authResult.AccessToken;

    }

    static [string] GetGraphAccessToken()

    {

        $accessToken = ''

        try

        {   

            #getting azure context because graph access token requires azure environment details.

            $Context = @(Get-AzContext -ErrorAction SilentlyContinue )

            if ($Context.count -eq 0)  

            {

                Write-Host "Graph access is required to evaluate some controls. Attempting to acquire Graph token." -ForegroundColor Cyan

                Connect-AzAccount -ErrorAction Stop

                $Context = @(Get-AzContext -ErrorAction SilentlyContinue)

            }

            if ($null -eq $Context)  

            {

                throw "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate."

            }

            else

            {

                $graphUri = "https://graph.microsoft.com"

                $authResult = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate(

                $Context.Account,

                $Context.Environment,

                $Context.Tenant.Id,

                [System.Security.SecureString] $null,

                "Never",

                $null,

                $graphUri);

                if (-not ($authResult -and (-not [string]::IsNullOrWhiteSpace($authResult.AccessToken))))

                {

                    throw ([SuppressedException]::new(("Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate."), [SuppressedExceptionType]::Generic))

                }

                $accessToken = $authResult.AccessToken;

            }

        }

        catch

        {

            Write-Host "Unable to acquire Graph token. The signed-in account may not have Graph permission. Control results for controls that depend on AAD group expansion may not be accurate." -ForegroundColor Red

            Write-Host "Continuing without graph access." -ForegroundColor Yellow

            return $null

        }

        return $accessToken;

    }

    hidden [OrganizationContext] SetContext([string] $organizationName)

    {

        if((-not [string]::IsNullOrEmpty($organizationName)))

              {

                     $OrganizationContext = [OrganizationContext]@{

                           OrganizationId = $organizationName;

                           Scope = "/Organization/$organizationName";

                           OrganizationName = $organizationName;

                     };

                     # $organizationId contains the organization name (due to framework).

                     [ContextHelper]::orgName = $organizationName;

                     [ContextHelper]::GetCurrentContext()                  

              }

              else

              {

                     throw [SuppressedException] ("OrganizationName name [$organizationName] is either malformed or incorrect.")

        }

        return $OrganizationContext;

    }

    hidden [OrganizationContext] SetContext([string] $organizationName, [System.Security.SecureString] $PATToken)

    {

        if((-not [string]::IsNullOrEmpty($organizationName)))

              {

                     $OrganizationContext = [OrganizationContext]@{

                           OrganizationId = $organizationName;

                           Scope = "/Organization/$organizationName";

                           OrganizationName = $organizationName;

                     };

                     # $organizationId contains the organization name (due to framework).

                     [ContextHelper]::orgName = $organizationName;

                     [ContextHelper]::GetCurrentContext($PATToken)         

              }

              else

              {

                     throw [SuppressedException] ("OrganizationName name [$organizationName] is either malformed or incorrect.")

        }

        return $OrganizationContext;

    }

    static [void] ResetCurrentContext()

    {

    }

    hidden static ConvertToContextObject([PSObject] $context)

    {

        $contextObj = [Context]::new()

        # We do not get ADO organization id as part of current context. Hence appending org name to both id and name param.

        $contextObj.Organization = [Organization]::new()

        $contextObj.Organization.Id = [ContextHelper]::orgName

        $contextObj.Organization.Name = [ContextHelper]::orgName

        if([ContextHelper]::IsOAuthScan) { # this if block will be executed for OAuth based scan

            $contextObj.Account.Id = [ContextHelper]::GetOAuthUserIdentity($context.AccessToken, $contextObj.Organization.Name)

            $contextObj.AccessToken = $context.AccessToken

            $contextObj.TokenExpireTimeLocal = $context.ExpiresOn

        }

        else {

            $contextObj.Account.Id = $context.UserInfo.DisplayableId

            $contextObj.Tenant.Id = $context.TenantId

            $contextObj.AccessToken = $context.AccessToken

            $contextObj.TokenExpireTimeLocal = $context.ExpiresOn.LocalDateTime

            #$contextObj.AccessToken =  ConvertTo-SecureString -String $context.AccessToken -asplaintext -Force

        }

        [ContextHelper]::currentContext = $contextObj

    }

    hidden static [string] GetOAuthUserIdentity($accessToken, $orgName)

    {

        $apiURL = "https://dev.azure.com/{0}/_apis/connectionData" -f $orgName

        $headers =@{

            Authorization = "Bearer $accesstoken";

            "Content-Type"="application/json"

        };

        try{

            $responseObj = Invoke-RestMethod -Method Get -Uri $apiURL -Headers $headers -UseBasicParsing

            $descriptor = $responseObj.authenticatedUser.descriptor

            $userId = ($descriptor -split '\\')[-1]

            return $userId

        }

        catch{

            return ""

        }

    }

    hidden static ConvertToContextObject([System.Security.SecureString] $patToken)

    {

        $contextObj = [Context]::new()

        $contextObj.Account.Id = [string]::Empty

        $contextObj.Tenant.Id =  [string]::Empty

        $contextObj.AccessToken = [System.Net.NetworkCredential]::new("", $patToken).Password

        # We do not get ADO organization Id as part of current context. Hence appending org name to both Id and Name param.

        $contextObj.Organization = [Organization]::new()

        $contextObj.Organization.Id = [ContextHelper]::orgName

        $contextObj.Organization.Name = [ContextHelper]::orgName 

        #$contextObj.AccessToken = $patToken

        #$contextObj.AccessToken =  ConvertTo-SecureString -String $context.AccessToken -asplaintext -Force

        [ContextHelper]::currentContext = $contextObj

        $apiURL = "https://dev.azure.com/{0}/_apis/connectionData" -f [ContextHelper]::orgName

        #Note: cannot use this WRH method below due to ordering constraints during load in Framework.ps1

        #$header = [WebRequestHelper]::GetAuthHeaderFromUri($apiURL);

        $user = ""

        $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user, $contextObj.AccessToken)))

        $headers = @{

                        "Authorization"= ("Basic " + $base64AuthInfo); 

                        "Content-Type"="application/json"

                    };

        $responseObj = Invoke-RestMethod -Method Get -Uri $apiURL -Headers $headers -UseBasicParsing

        #If the token is valid, we get: "descriptor"="Microsoft.IdentityModel.Claims.ClaimsIdentity;72f988bf-86f1-41af-91ab-2d7cd011db47\xyz@microsoft.com"

        #Note that even for guest users, we get the host tenant (and not their native tenantId). E.g., "descriptor...;72f...47\pqr@live.com"

        #If the token is invalid, we get a diff object: "descriptor":"System:PublicAccess;aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"

        $authNUserInfo = @(($responseObj.authenticatedUser.descriptor -split ';') -split '\\')

        #Check if the above split resulted in 3 elements (valid token case)

        if ($authNUserInfo.Count -eq 3)

        {

            $contextObj.Tenant.Id = $authNUserInfo[1]

            $contextObj.Account.Id = $authNUserInfo[2]

        }

    }

    static [string] GetCurrentSessionUser() {

        $context = [ContextHelper]::GetCurrentContext()

        if ($null -ne $context) {

            return $context.Account.Id

        }

        else {

            return "NO_ACTIVE_SESSION"

        }

    }

}

# SIG # Begin signature block

# MIIjkAYJKoZIhvcNAQcCoIIjgTCCI30CAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDK5wWzLuouqbXS

# nL2y/JNsGa65b+MbttjxvBlzfJEs1qCCDYEwggX/MIID56ADAgECAhMzAAAB32vw

# LpKnSrTQAAAAAAHfMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p

# bmcgUENBIDIwMTEwHhcNMjAxMjE1MjEzMTQ1WhcNMjExMjAyMjEzMTQ1WjB0MQsw

# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u

# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB

# AQC2uxlZEACjqfHkuFyoCwfL25ofI9DZWKt4wEj3JBQ48GPt1UsDv834CcoUUPMn

# s/6CtPoaQ4Thy/kbOOg/zJAnrJeiMQqRe2Lsdb/NSI2gXXX9lad1/yPUDOXo4GNw

# PjXq1JZi+HZV91bUr6ZjzePj1g+bepsqd/HC1XScj0fT3aAxLRykJSzExEBmU9eS

# yuOwUuq+CriudQtWGMdJU650v/KmzfM46Y6lo/MCnnpvz3zEL7PMdUdwqj/nYhGG

# 3UVILxX7tAdMbz7LN+6WOIpT1A41rwaoOVnv+8Ua94HwhjZmu1S73yeV7RZZNxoh

# EegJi9YYssXa7UZUUkCCA+KnAgMBAAGjggF+MIIBejAfBgNVHSUEGDAWBgorBgEE

# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUOPbML8IdkNGtCfMmVPtvI6VZ8+Mw

# UAYDVR0RBEkwR6RFMEMxKTAnBgNVBAsTIE1pY3Jvc29mdCBPcGVyYXRpb25zIFB1

# ZXJ0byBSaWNvMRYwFAYDVQQFEw0yMzAwMTIrNDYzMDA5MB8GA1UdIwQYMBaAFEhu

# ZOVQBdOCqhc3NyK1bajKdQKVMFQGA1UdHwRNMEswSaBHoEWGQ2h0dHA6Ly93d3cu

# bWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY0NvZFNpZ1BDQTIwMTFfMjAxMS0w

# Ny0wOC5jcmwwYQYIKwYBBQUHAQEEVTBTMFEGCCsGAQUFBzAChkVodHRwOi8vd3d3

# Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY0NvZFNpZ1BDQTIwMTFfMjAx

# MS0wNy0wOC5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAnnqH

# tDyYUFaVAkvAK0eqq6nhoL95SZQu3RnpZ7tdQ89QR3++7A+4hrr7V4xxmkB5BObS

# 0YK+MALE02atjwWgPdpYQ68WdLGroJZHkbZdgERG+7tETFl3aKF4KpoSaGOskZXp

# TPnCaMo2PXoAMVMGpsQEQswimZq3IQ3nRQfBlJ0PoMMcN/+Pks8ZTL1BoPYsJpok

# t6cql59q6CypZYIwgyJ892HpttybHKg1ZtQLUlSXccRMlugPgEcNZJagPEgPYni4

# b11snjRAgf0dyQ0zI9aLXqTxWUU5pCIFiPT0b2wsxzRqCtyGqpkGM8P9GazO8eao

# mVItCYBcJSByBx/pS0cSYwBBHAZxJODUqxSXoSGDvmTfqUJXntnWkL4okok1FiCD

# Z4jpyXOQunb6egIXvkgQ7jb2uO26Ow0m8RwleDvhOMrnHsupiOPbozKroSa6paFt

# VSh89abUSooR8QdZciemmoFhcWkEwFg4spzvYNP4nIs193261WyTaRMZoceGun7G

# CT2Rl653uUj+F+g94c63AhzSq4khdL4HlFIP2ePv29smfUnHtGq6yYFDLnT0q/Y+

# Di3jwloF8EWkkHRtSuXlFUbTmwr/lDDgbpZiKhLS7CBTDj32I0L5i532+uHczw82

# oZDmYmYmIUSMbZOgS65h797rj5JJ6OkeEUJoAVwwggd6MIIFYqADAgECAgphDpDS

# AAAAAAADMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMK

# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0

# IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0

# ZSBBdXRob3JpdHkgMjAxMTAeFw0xMTA3MDgyMDU5MDlaFw0yNjA3MDgyMTA5MDla

# MH4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS

# ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMT

# H01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTEwggIiMA0GCSqGSIb3DQEB

# AQUAA4ICDwAwggIKAoICAQCr8PpyEBwurdhuqoIQTTS68rZYIZ9CGypr6VpQqrgG

# OBoESbp/wwwe3TdrxhLYC/A4wpkGsMg51QEUMULTiQ15ZId+lGAkbK+eSZzpaF7S

# 35tTsgosw6/ZqSuuegmv15ZZymAaBelmdugyUiYSL+erCFDPs0S3XdjELgN1q2jz

# y23zOlyhFvRGuuA4ZKxuZDV4pqBjDy3TQJP4494HDdVceaVJKecNvqATd76UPe/7

# 4ytaEB9NViiienLgEjq3SV7Y7e1DkYPZe7J7hhvZPrGMXeiJT4Qa8qEvWeSQOy2u

# M1jFtz7+MtOzAz2xsq+SOH7SnYAs9U5WkSE1JcM5bmR/U7qcD60ZI4TL9LoDho33

# X/DQUr+MlIe8wCF0JV8YKLbMJyg4JZg5SjbPfLGSrhwjp6lm7GEfauEoSZ1fiOIl

# XdMhSz5SxLVXPyQD8NF6Wy/VI+NwXQ9RRnez+ADhvKwCgl/bwBWzvRvUVUvnOaEP

# 6SNJvBi4RHxF5MHDcnrgcuck379GmcXvwhxX24ON7E1JMKerjt/sW5+v/N2wZuLB

# l4F77dbtS+dJKacTKKanfWeA5opieF+yL4TXV5xcv3coKPHtbcMojyyPQDdPweGF

# RInECUzF1KVDL3SV9274eCBYLBNdYJWaPk8zhNqwiBfenk70lrC8RqBsmNLg1oiM

# CwIDAQABo4IB7TCCAekwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFEhuZOVQ

# BdOCqhc3NyK1bajKdQKVMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMAsGA1Ud

# DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFHItOgIxkEO5FAVO

# 4eqnxzHRI4k0MFoGA1UdHwRTMFEwT6BNoEuGSWh0dHA6Ly9jcmwubWljcm9zb2Z0

# LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y

# Mi5jcmwwXgYIKwYBBQUHAQEEUjBQME4GCCsGAQUFBzAChkJodHRwOi8vd3d3Lm1p

# Y3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dDIwMTFfMjAxMV8wM18y

# Mi5jcnQwgZ8GA1UdIASBlzCBlDCBkQYJKwYBBAGCNy4DMIGDMD8GCCsGAQUFBwIB

# FjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2RvY3MvcHJpbWFyeWNw

# cy5odG0wQAYIKwYBBQUHAgIwNB4yIB0ATABlAGcAYQBsAF8AcABvAGwAaQBjAHkA

# XwBzAHQAYQB0AGUAbQBlAG4AdAAuIB0wDQYJKoZIhvcNAQELBQADggIBAGfyhqWY

# 4FR5Gi7T2HRnIpsLlhHhY5KZQpZ90nkMkMFlXy4sPvjDctFtg/6+P+gKyju/R6mj

# 82nbY78iNaWXXWWEkH2LRlBV2AySfNIaSxzzPEKLUtCw/WvjPgcuKZvmPRul1LUd

# d5Q54ulkyUQ9eHoj8xN9ppB0g430yyYCRirCihC7pKkFDJvtaPpoLpWgKj8qa1hJ

# Yx8JaW5amJbkg/TAj/NGK978O9C9Ne9uJa7lryft0N3zDq+ZKJeYTQ49C/IIidYf

# wzIY4vDFLc5bnrRJOQrGCsLGra7lstnbFYhRRVg4MnEnGn+x9Cf43iw6IGmYslmJ

# aG5vp7d0w0AFBqYBKig+gj8TTWYLwLNN9eGPfxxvFX1Fp3blQCplo8NdUmKGwx1j

# NpeG39rz+PIWoZon4c2ll9DuXWNB41sHnIc+BncG0QaxdR8UvmFhtfDcxhsEvt9B

# xw4o7t5lL+yX9qFcltgA1qFGvVnzl6UJS0gQmYAf0AApxbGbpT9Fdx41xtKiop96

# eiL6SJUfq/tHI4D1nvi/a7dLl+LrdXga7Oo3mXkYS//WsyNodeav+vyL6wuA6mk7

# r/ww7QRMjt/fdW1jkT3RnVZOT7+AVyKheBEyIXrvQQqxP/uozKRdwaGIm1dxVk5I

# RcBCyZt2WwqASGv9eZ/BvW1taslScxMNelDNMYIVZTCCFWECAQEwgZUwfjELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9z

# b2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAxMQITMwAAAd9r8C6Sp0q00AAAAAAB3zAN

# BglghkgBZQMEAgEFAKCBsDAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgor

# BgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQg1GpJvAQ+

# ShnAUhWP4CYNkJFsf/UyoOcNOYAS2ZZqKpAwRAYKKwYBBAGCNwIBDDE2MDSgFIAS

# AE0AaQBjAHIAbwBzAG8AZgB0oRyAGmh0dHBzOi8vd3d3Lm1pY3Jvc29mdC5jb20g

# MA0GCSqGSIb3DQEBAQUABIIBAKJQ3DxGlrUa7f0TlnWbGDo4PEu6/RZ81IsUnGuh

# FnWbg0f9oUqqzjG3iLjgti5IBEo911olhzZXOY71xJ2cjrw0TsWI7+38/EU6R2Q5

# 89Fl2WHCyhqH+0oVq98FM/OQoZwpYKvPb334CcPeiNsO3zW0oAJ5BpNxCk3Z+pEZ

# 2098B86Kq6czja3oHrok6EbOAviR764oV7fJZBWLAFSriD4OBrMLUZlgGac0EUnx

# DhtCjrn/XNW2H5cJalEhM+g9w8nvppANSoYN5VCUW5yPIyT6fyowntopM/Zvalj3

# abkEjVltM1v4R8S9xVjK406RNRbb+ap0oZKSC/jx5CsUfMyhghLtMIIS6QYKKwYB

# BAGCNwMDATGCEtkwghLVBgkqhkiG9w0BBwKgghLGMIISwgIBAzEPMA0GCWCGSAFl

# AwQCAQUAMIIBVAYLKoZIhvcNAQkQAQSgggFDBIIBPzCCATsCAQEGCisGAQQBhFkK

# AwEwMTANBglghkgBZQMEAgEFAAQgEY97GDRbr7paR7Xr9Njek7PgwI24/KjTHBWx

# JXIYAqcCBmCvvXZIDxgSMjAyMTA2MTQxNTAwMzUuODdaMASAAgH0oIHUpIHRMIHO

# MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk

# bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQLEyBN

# aWNyb3NvZnQgT3BlcmF0aW9ucyBQdWVydG8gUmljbzEmMCQGA1UECxMdVGhhbGVz

# IFRTUyBFU046NjBCQy1FMzgzLTI2MzUxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1l

# LVN0YW1wIFNlcnZpY2Wggg5BMIIE9TCCA92gAwIBAgITMwAAAVosuW5ENMtvKAAA

# AAABWjANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz

# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv

# cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx

# MDAeFw0yMTAxMTQxOTAyMTZaFw0yMjA0MTExOTAyMTZaMIHOMQswCQYDVQQGEwJV

# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE

# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQLEyBNaWNyb3NvZnQgT3Bl

# cmF0aW9ucyBQdWVydG8gUmljbzEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046NjBC

# Qy1FMzgzLTI2MzUxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZp

# Y2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwvVwcVw2tJwiu9B3/

# hooejcUZdZgIcxSXaJPG7N8aSfO0zNvKxHh5GQGhPim/RovVL06UN86xFslkqSEJ

# Msb/1n9HCIQNZiTqsrttEzd5femb4M2K8zv60JT72ylu/aADuPmBbHpEAra8zPYU

# KEuQWBsD4fUM+ugbksR/UMHssDQULI5FaIpKQcZEvhF0iM6W2tmn750TF+yy3tnq

# 8nPj5T15k0jnx9VjcpHNubvc6OmV9IAHeI1KQc3TC5xwrROtmy9jztNHJgCbIrao

# GqL/t5Ra33dLDwAsExjvYsppSZW9rGr8I6kp4+UcxuEcRuq1Nou3rW50E6M0e9zh

# zBjlAgMBAAGjggEbMIIBFzAdBgNVHQ4EFgQUZHMlP/Ucj5J+0AaF2Tk0PMDeMWcw

# HwYDVR0jBBgwFoAU1WM6XIoxkPNDe3xGG8UzaFqFbVUwVgYDVR0fBE8wTTBLoEmg

# R4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWlj

# VGltU3RhUENBXzIwMTAtMDctMDEuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggrBgEF

# BQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNUaW1T

# dGFQQ0FfMjAxMC0wNy0wMS5jcnQwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggr

# BgEFBQcDCDANBgkqhkiG9w0BAQsFAAOCAQEAAABt7HxYG1IsOIFjFfFTsZWyBvwi

# DEonIg7SGZzy/ODjDeJSXleS3ia/h2AXKMea7lmZuPStvYgZib+lYlzLT/NaWGdR

# BTO99OmPsyyIf7Uue+D3lrB7zw9EDsUOBzjNhjT7xQHVL6PM+aYFf+RPpT7utblA

# iAUwxEohzvje62oKm9zBEz6kSjyzQCXCjw3GpSs55hj5Z82Oj9c6Kf+2vdFXAR0S

# ikP4U75//AvGOm/jL5OZGCYeuyjW1VXLrgVshUjGUxxnpx57h1YPbLx+/pZv1f8C

# G2VCiiSTtB0JsqHckng/ySwuzTbA2EaRTftvXS0bcdHlsmaLCZk/KimwSDCCBnEw

# ggRZoAMCAQICCmEJgSoAAAAAAAIwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYT

# AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYD

# VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBS

# b290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTEwMDcwMTIxMzY1NVoX

# DTI1MDcwMTIxNDY1NVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggEi

# MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpHQ28dxGKOiDs/BOX9fp/aZRr

# dFQQ1aUKAIKF++18aEssX8XD5WHCdrc+Zitb8BVTJwQxH0EbGpUdzgkTjnxhMFmx

# MEQP8WCIhFRDDNdNuDgIs0Ldk6zWczBXJoKjRQ3Q6vVHgc2/JGAyWGBG8lhHhjKE

# HnRhZ5FfgVSxz5NMksHEpl3RYRNuKMYa+YaAu99h/EbBJx0kZxJyGiGKr0tkiVBi

# sV39dx898Fd1rL2KQk1AUdEPnAY+Z3/1ZsADlkR+79BL/W7lmsqxqPJ6Kgox8NpO

# BpG2iAg16HgcsOmZzTznL0S6p/TcZL2kAcEgCZN4zfy8wMlEXV4WnAEFTyJNAgMB

# AAGjggHmMIIB4jAQBgkrBgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQU1WM6XIoxkPND

# e3xGG8UzaFqFbVUwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQD

# AgGGMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb

# 186aGMQwVgYDVR0fBE8wTTBLoEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29t

# L3BraS9jcmwvcHJvZHVjdHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoG

# CCsGAQUFBwEBBE4wTDBKBggrBgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQu

# Y29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwgaAGA1Ud

# IAEB/wSBlTCBkjCBjwYJKwYBBAGCNy4DMIGBMD0GCCsGAQUFBwIBFjFodHRwOi8v

# d3d3Lm1pY3Jvc29mdC5jb20vUEtJL2RvY3MvQ1BTL2RlZmF1bHQuaHRtMEAGCCsG

# AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAFAAbwBsAGkAYwB5AF8AUwB0AGEAdABl

# AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQAH5ohRDeLG4Jg/gXEDPZ2j

# oSFvs+umzPUxvs8F4qn++ldtGTCzwsVmyWrf9efweL3HqJ4l4/m87WtUVwgrUYJE

# Evu5U4zM9GASinbMQEBBm9xcF/9c+V4XNZgkVkt070IQyK+/f8Z/8jd9Wj8c8pl5

# SpFSAK84Dxf1L3mBZdmptWvkx872ynoAb0swRCQiPM/tA6WWj1kpvLb9BOFwnzJK

# J/1Vry/+tuWOM7tiX5rbV0Dp8c6ZZpCM/2pif93FSguRJuI57BlKcWOdeyFtw5yj

# ojz6f32WapB4pm3S4Zz5Hfw42JT0xqUKloakvZ4argRCg7i1gJsiOCC1JeVk7Pf0

# v35jWSUPei45V3aicaoGig+JFrphpxHLmtgOR5qAxdDNp9DvfYPw4TtxCd9ddJgi

# CGHasFAeb73x4QDf5zEHpJM692VHeOj4qEir995yfmFrb3epgcunCaw5u+zGy9iC

# tHLNHfS4hQEegPsbiSpUObJb2sgNVZl6h3M7COaYLeqN4DMuEin1wC9UJyH3yKxO

# 2ii4sanblrKnQqLJzxlBTeCG+SqaoxFmMNO7dDJL32N79ZmKLxvHIa9Zta7cRDyX

# UHHXodLFVeNp3lfB0d4wwP3M5k37Db9dT+mdHhk4L7zPWAUu7w2gUDXa7wknHNWz

# fjUeCLraNtvTX4/edIhJEqGCAs8wggI4AgEBMIH8oYHUpIHRMIHOMQswCQYDVQQG

# EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG

# A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQLEyBNaWNyb3NvZnQg

# T3BlcmF0aW9ucyBQdWVydG8gUmljbzEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046

# NjBCQy1FMzgzLTI2MzUxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNl

# cnZpY2WiIwoBATAHBgUrDgMCGgMVAMyABZi9xhx1nACWIt4WhsJaZRouoIGDMIGA

# pH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT

# B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE

# AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQAC

# BQDkcU2GMCIYDzIwMjEwNjE0MDczNzQyWhgPMjAyMTA2MTUwNzM3NDJaMHQwOgYK

# KwYBBAGEWQoEATEsMCowCgIFAORxTYYCAQAwBwIBAAICCEAwBwIBAAICEVEwCgIF

# AORynwYCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAKMAgCAQAC

# AwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQApnMld33gonFqtc19r

# GYZf+d1eGMW/CX17IC8Z0hrRdWkCGqDMeKzudIizqO6Qr2red/HmvF/RiWNsDWKN

# T/8IKEuEYlQlYSNuwakXTkcTRdoQR2ucEvI9yS6zRrELOw6aeb/yKhwDhkNUZRhm

# 9kfEOuQ/a9QxlnQPcImm07KCVzGCAw0wggMJAgEBMIGTMHwxCzAJBgNVBAYTAlVT

# MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK

# ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1l

# LVN0YW1wIFBDQSAyMDEwAhMzAAABWiy5bkQ0y28oAAAAAAFaMA0GCWCGSAFlAwQC

# AQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZIhvcNAQkE

# MSIEIAk/tHPhVizf3BINLy3UegRhZ1dt8uq4xAeubioscGLqMIH6BgsqhkiG9w0B

# CRACLzGB6jCB5zCB5DCBvQQgk/yoJnTEsuRdMMOCGq/XJn+SLN6TNIVLiCJy+W2x

# f7AwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ

# MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u

# MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAVos

# uW5ENMtvKAAAAAABWjAiBCBr3jY/BSXLQH4x/FeV0raDllPlwvFytCDgo7+cp0kk

# xDANBgkqhkiG9w0BAQsFAASCAQCMjujKPsR5A6VrafvefC2HeWbCYqzf0GuB/uOo

# 9gdu/JtVZKwqZKq1ZjXEAAyF0lUcL/OYDzvM03hNn7ojtTFKvWbvS1LkRDzvsT6W

# UsXqVvGEnxi5Iyh9z4TPseP5xQMisCpjZg6xrb2an2zm/5Ba5gz9bpgQbTia3i/y

# 8LqIfHqoFizU02GYGE4s91L33mhnO1O5g/lAgVuU78O/dfO1qVBJDQZlI9tvnPsb

# 49CUgPGI6NUB/FXT07S1FrjUQJZZra0shqeWocfA++W8UBSppcxoq2AS0j6NhJv/

# qfImjmk6MquYsRxSGKsFkyQ4aCYlHslDOmx1weOiNUoJ8cal

# SIG # End signature block