From 85c454add9f2ab51faff3c5d7994c41ec6f13c31 Mon Sep 17 00:00:00 2001 From: dklement Date: Fri, 7 Mar 2025 11:07:16 +0100 Subject: [PATCH 001/183] Rework First steps methodology introduction to make it more to the point and easier to digest --- midpoint/methodology/first-steps/index.adoc | 248 +++++++------------- 1 file changed, 79 insertions(+), 169 deletions(-) diff --git a/midpoint/methodology/first-steps/index.adoc b/midpoint/methodology/first-steps/index.adoc index 223dc56ef..c7386ab0a 100644 --- a/midpoint/methodology/first-steps/index.adoc +++ b/midpoint/methodology/first-steps/index.adoc @@ -5,204 +5,114 @@ == Introduction -Evolveum has created a simplified midPoint deployment methodology, which will guide you through the quick deployment of simple midPoint configurations in three steps. +This is a guide to a simplified midPoint deployment that will help you get up and running quickly and see tangible results quickly. -The methodology aims to start an _iterative_ identity governance program providing value early, in a series of small steps of connecting new systems, cleaning up data, and automating processes. -At the same time, the methodology ensures a _safe_ midPoint deployment by preventing unexpected changes or deletions of existing identity data, thanks to the simulations. -This combination makes it ideal for fast and safe midPoint deployment even in environments where data quality suffers. +We believe the best way to get started is to use an _iterative, cyclic approach_. +Start with a series of *small steps that will deliver value early on*, and then repeat those steps to refine your solution. +The steps in this cycle consist of connecting new systems, cleaning up the data, and automating the processes. +Each step should take a few months at most. This allows for manageable effort and reasonable budget allocation. -This document is a blueprint to the initial identity management deployment modelling a common organization. -The methodology includes: +While learning to use midPoint, you can *feel safe thanks to xref:midpoint/reference/simulation/[simulations]*. +Before making any changes that could potentially damage your data, you can test them to see if you get the expected results. -* adaptation of the midPoint deployment to your existing IT applications environment -* connecting and integrating first source and target systems using smart correlation -* account attribute mappings -* orphaned accounts detection and handling -* identity lifecycle management -* automation of Joiner-Mover-Leaver (JML) processes -* identity management with scope limited to identities and their accounts with ability to cover _birthright_ permissions in target systems -* data override capability for incorrect source system data +However, no matter how safe midPoint is, it's still a good idea to *back up your data regularly*. -This methodology will guide you on your identity management journey towards identity governance. +=== The Concept of an Iterative Cyclic Approach -Evolveum introduced the First Steps methodology also in https://www.youtube.com/watch?v=suo775ym_PE[First Steps Methodology Webinar] video, feel free to watch the recording to familiarize yourself with the approach and see live demonstration. +The main concept behind this whole guide is the iterative cyclic approach. +This approach enables you to reach your desired solution in a series of small steps. +Each step brings new value and improves the overal solution. -video::suo775ym_PE[youtube,title="First Steps Methodology Webinar Video",width="852",height="480"] +image::first-steps-idea.png[steps in the iterative cyclic IGA implementation approach] +* *Connect* a new system to the solution. +At this step, you give midPoint the option to _read_ the data from the system and analyze them, possibly comparing them to what midPoint already has its database. +* *Clean-up* step is aimed at improving data quality. +Data in disconnected systems may often be in a poor state. +Accounts have to be correlated, orphaned accounts disabled, data errors corrected. +MidPoint is built to help with that. -== Audience +* *Automate* step focuses on speeding up the processes and improving efficiency. +Manual work can be automated, making the process faster, cheaper, and more reliable. +On-boarding (_joiners_) and off-boarding (_leavers_) employees are the usual candidates for automation. -This guide is targeted at small and mid-size organizations that are starting with identity management. -Most concepts, however, can be applied also for other organizations, given more time and effort. +Repeat these steps as long as they bring you a tangible value. +In every loop, you connect more systems with more data, align the data, automate the process, and thus make your organization more resilient to usual human errors. -Please see xref:audience.adoc[] for more detailed information. +You can repeat the iterations as many times as you need, with as big or small a scope as you need. +The goal is to bring these things together: the data, the processes, and the policies. -== The Idea +The number of iterations you perform during the first deployment is finite because your time and budget are finite. +However, the first go-live is not the end. +Your policies evolve, you implement new systems, your IT ecosystem develops. +That means the cycles of connect—clean-up—automate _will_ repeat over and over, endlessly. +But, on the bright side, they're going to cost you significantly less than those first ones during the initial deployment. -The idea is to start an iterative _identity management program_. -The program allows you to reach your desired solution in a series of small steps. -Each step bringing value, improving the solution. +image::first-steps-big-picture.png[Iterative midPoint deployment process big picture] -Simply speaking, the program repeats three steps: Connect -> Clean-up -> Automate. +When it comes to identity management, *one size does not fit all*. +Some organizations need strict policies, perfect visibility, or high degree of automation. +Other organizations are perfectly happy with just basic integration and automation, as long as the cost is reasonable. -image::first-steps-idea.png[] +It's virtually impossible to plan an ideal identity management project right of the bat, in all its width and depth. +Hence, the iterative approach. +You repeat a series of small steps, focusing on areas that need to be improved at that particular point. +This is the way to satisfy the requirements while keeping the costs reasonable. -Each of the steps have a slightly different goal: +== Outline of This Guide -* *Connect* step is aimed at connecting new systems to the solution. -MidPoint platform will be able to _read_ the data from the system and analyze them. +To safely deploy midPoint on your actual company data, you'll go through the following steps: -* *Clean-up* step is aimed at improving data quality. -Data in disconnected systems are often in quite a poor state. -Accounts have to be correlated, orphaned accounts have to be disabled, data errors have to be corrected. -MidPoint can help with that. - -* *Automate* step is aimed at speeding up the processes and improving efficiency. -Manual work can be automated, making the process faster, cheaper and more reliable. -On-boarding (_joiners_) and off-boarding (_leavers_) processes are the usual candidates for automation. - -The steps are repeated as long as they bring tangible value. - -When it comes to identity management, one size does *not* fit all. -Some organizations need strict policies, perfect visibility or high degree of automation. -Yet other organizations can be perfectly happy with just basic integration and automation, as long as the cost is reasonable. -It is almost impossible to plan an ideal identity management project beforehand, in all its width and depth. -Hence the iterative approach. -Series of small steps is iterated, focusing on areas that need to be improved at that particular point. -This is the way to satisfy the requirements, while keeping the costs reasonable. - -== Big Picture - -The _Connect -> Clean-up -> Automate_ approach outlined above is a useful abstraction. -It illustrates the overall approach quite well. -However, practical projects and programs are slightly more complex. -They have to _start_ somewhere, set up the team, there should be checkpoints, stop/go decisions and so on. -Therefore, we propose a series of very practical steps to bootstrap the iterative approach. - -We propose to proceed in following steps: - -. *xref:kick-off/[Kick-off]*: Start the project. -Set goals. -Identify crucial data sources and targets. -Make a plan. -Secure budget. -+ -xref:kick-off/[Read more about kick-off step] - -. *xref:assessment/[Assessment]*: Set up midPoint. -Load data from the source. -Compare the data with the target. -Assess data quality. -Decide next steps. -+ -xref:assessment/[Read more about assessment step] - -. *xref:automation/[Automation]*: Automate management of identities (to a reasonable degree). -Speed up on-boarding processes. -Make off-boarding process more reliable, improving security. -Keep data up to date. -+ -xref:automation/[Read more about automation step] - -These three steps start up a *program*, a never-ending process to maintain and expand the solution. -The progress of the program may be as fast or as slow as you need. -It is an endless iteration of several on-demand activities, executed as needed: - -* *Connect* new systems. -Add more systems to your solution, much like you did in the _assessment_ step before. -This is increasing _breadth_ (scope) of your solution. - -* *Clean-up* the data. -Your data were created and maintained manually. -They often do really match exactly between systems, the data are often out of date, there are inaccuracies and errors. -Manual processes can often tolerate quite a high degree of data disorganization. -However, increased automation heavily relies on accurate data. -There is a constant need to monitor and improved data quality, correct errors, resolve inaccuracies and inconsistencies. -This is increasing _quality_ of your solution. - -* *Automate*. -Add automated data mappings, processes and basic policies. -Your processes will run faster, more reliably, with less manual steps. -This is increasing _depth_ of your solution. - -The iterations can be repeated as many times as needed, with as big or as small scope as needed. -The overall goal of the program is to bring convergence: convergence of the data, processes and policies. - -image::first-steps-big-picture.png[Process big picture] - -There is no pre-determined number of iterations. -The iterations should be executed as long as they bring sufficient value. -However, as the business and IT environment is ever-changing, it is very likely that at least some part of the program will become part of ordinary operational routine. - -Once the first steps are complete, data are reasonably reliable, important systems are covered and processes are automated to appropriate degree, it is time to move to the next steps. -The next logical step is to focus on identity _governance_, managing entitlements, identity-related policies and business processes. - -=== Iterations - -You can use as many iterations as you need; while the iterations bring you sufficient value. -You need to take into account that a complete perfection cannot be always achieved, or it would be too expensive. -After all, you are deploying a real project with limited scope and budget, not an academic exercise. - -This does not mean that the iterations would ever stop. -New systems are added all the time, they have to be connected. -Yet, not all systems have to be necessarily connected to identity management. -Data are changing all the time, they have to cleaned up. -Yet, the data quality does not need to be perfect. -Most important of all, the amount of automation should be very reasonable. -Automation may be expensive to set up, yet it is even more expensive to maintain. - -Organizational complexity has its cost, cost that is reflected in all the systems and applications. -The combined cost of organizational complexity on the entire IT infrastructure is enormous. -Try to reduce organizational complexity as much as you can. -However, chances are that this not in your hands. -Maybe all you can do is to handle the complexity. -Once again, iterations will help you to manage effort, time and costs. +. Decide what is it exactly that you need. + ** Which systems do you need to connect to identity management (IDM)? + ** What level of security do you need? + ** Consider your budget for long-term IDM expenses. +. Connect and integrate your first source and target systems using smart correlation. +. Map account attributes. +. Clean up the data by fixing inconsistencies and handling orphaned accounts. +. Automate some processes, such as the joiner-mover-leaver (JML) process. -== Why MidPoint? +You can also watch this video to learn more about the approach and see a live demonstration: + +// video::suo775ym_PE[youtube,title="First steps methodology webinar video",width="100%",height="350"] -Why we think midPoint is the best tool for this kind of approach? +== Who Is This Guide For? -* MidPoint is open source platform. -There is a very little up-front investment. -There are no licence costs that need to be paid before project starts. +This guide is meant to help small and mid-size organizations. +Typically, such organizations handle hundreds or lower thousands of identities, most of the processes are manual, and the IT staff doesn't have a lot of knowledge about identity management. +We expect that there's an HR system serving as a source of the identity data, as is usual for midium-sized businesses, smaller government offices, or academic institutions. -* MidPoint is completely open. -All the software is publicly available as well as all the documentation. -The very first steps (e.g. prototyping) can be done by internal staff, without a need for expensive consulting services. +Nevertheless, most concepts in this guide are applicable to organizations of any size and type. +Even if your organization manages a considerably larger number of identities, the deployment process is the same, but it will likely require you to spend more time and money. -* MidPoint is available immediately. -Just https://evolveum.com/download/[download it] and try it out. -No need to do any paperwork, no need to sign any contracts, no need to request access to software. -You do not even have to register, or agree to unintelligible terms of use. -Just go ahead, click the link and try it now. -* Professional support. MidPoint is an OSS product with a dedicated team of professional developers and engineers ready to provide support whenever you need it. -https://evolveum.com/services/[Contact us] to discover more about our services and the exclusive benefits available to our subscribers. -+ -Evolveum's network of https://evolveum.com/partners/find-a-partner/[official partners] is ready to deliver dedicated local support to your project as well. +=== Key Challenges and Requirements +These are the usual challenges you may be facing: -== How to Use This Methodology +* Your identity data is of low quality because it's maintained manually without automatic validation. +* You need more people to manage identities. +* You want to get tangible results quickly. +* The implementation can't be a "big bang" effort because your IT staff must also continue performing their regular duties. + +By going through this guide, you'll learn how you can deploy midPoint iteratively and get first results in a matter of weeks, even if you face all the challenges mentioned above. + +== Why MidPoint? -Before midPoint 4.8, we recommended our users and customers to review our samples and base their midPoint configuration on them. -These samples represented a sample _final_ configuration. -They were written in midPoint XML language and any customization required our users to understand the midPoint language. +Here are some pointers as to why midPoint is worth your attention when looking for an IDM solution: -Since midPoint 4.8, the recommended way of starting with midPoint is using GUI wizards and following this methodology. -The advantage of this approach is obvious: administrators can configure midPoint features and try them without learning another language such as midPoint XML object language. -*One significant burden is removed.* -New features such as xref:/midpoint/reference/admin-gui/simulations/[] can be used right from the beginning. -Exceptions using xref:/midpoint/reference/concepts/mark/[] can be defined directly in GUI. -This all helps to achieve a safe environment to try midPoint and avoid any unexpected modifications or even deletes in the target systems. +- MidPoint is an open-source software (OSS) that requires a minimal initial investment and no licensing fees before the project begins. -But there is also a small disadvantage: when using interactive wizards such as resource wizard, it's hard to prepare _complete_ examples for learning purposes. -Having a ready-to-use example in _final state_ or even for each step of the interactive process would not be efficient and would beat the purposes of the interaction entirely. +- The software and documentation are open, meaning they're freely available. +You don't have to spend money on consulting services to get started. +You can do the first steps (like prototyping) yourself. -As the initial state for this methodology is basically an empty midPoint, we have decided to document the methodology by following the interactive wizards. -Therefore, be prepared that connecting and configuring a new system is an iterative and interactive _process_. -If you get lost, do not hesitate to watch the video mentioned in the <> chapter. +- MidPoint is available now. +No paperwork, contracts, or registration required. +Just https://evolveum.com/download/[download midPoint] and try it out. -== What's Next +- MidPoint is an OSS product with a dedicated team of professionals ready to provide support. +https://evolveum.com/services/[Contact us] to discover more about our services and benefits. -Where does it lead? -> IGA (Set up roles and policies, manage applications, entitlements, organizational structure, etc.) ... once the solution is mature enough +- Evolveum's network of official partners is ready to deliver dedicated local support to your project as well. \ No newline at end of file From ce31026298d260f189ed06cfa0cc7a401ebac117 Mon Sep 17 00:00:00 2001 From: dklement Date: Fri, 7 Mar 2025 11:11:17 +0100 Subject: [PATCH 002/183] Rework First steps methodology planning stage to make it shorter and easier to digest --- .../methodology/first-steps/kick-off.adoc | 284 +++++++++--------- 1 file changed, 147 insertions(+), 137 deletions(-) diff --git a/midpoint/methodology/first-steps/kick-off.adoc b/midpoint/methodology/first-steps/kick-off.adoc index 49837100b..f475d2d88 100644 --- a/midpoint/methodology/first-steps/kick-off.adoc +++ b/midpoint/methodology/first-steps/kick-off.adoc @@ -1,5 +1,5 @@ -= Methodology: First Steps With MidPoint: Kick-Off -:page-nav-title: 'Kick-Off' += Make a Deployment Plan +:page-nav-title: 'Make a Plan' :page-display-order: 100 :page-toc: top :experimental: @@ -12,161 +12,171 @@ Make a rough plan. Get long-term support from management. Secure budget. -You have to start somewhere. -At this point, you probably have a very rough idea what you want to achieve. -However, all the details are missing. -The goal of this step is to fill some details in, make a plan, set up project structure and secure necessary resources. +Now that you have a rough idea what's an IDM project about, it's time to make a plan. + +Before you involve a broader spectrum of people in your organization, devise a rough idea of what you want to achieve and how does it help your organization. +Prepare a pitch-talk making it clear why it's a good idea to implement an IDM solution. +Be also ready to explain why midPoint is your solution of choice. + +The sections below contain guidance on how to select your advisory team, what questions to ask, and what to take care of. + +== Pick the Team Members Start with a brainstorming or "kick-off" meeting. -Gather all the people in your organization interested in identity management. -This does not have to be a formal team. +Bring together all the people in your organization who’re interested in identity management. +This doesn’t have to be a formal team. The project is not formally established anyway. -Gather all the people that have something to say. -You will probably need to engage following persons: +Here are some tips on whom to invite: -* Senior IT engineer or an architect. -Identity management is touching many things, you want someone with broad perspective and IT experience. +* A *senior IT engineer* or an architect. +Identity management is related to many different areas. +You need someone who can see the big picture and understands IT. -* Active Directory administrator, or an administrator of a critical IT systems that you want to manage. +* *Administrator of a critical IT systems* with which you want to integrate midPoint. -* Someone from HR, or any person that is somehow familiar with HR practices. -HR is going to be your information source, you need someone that can help you assess impact of HR practices on your project. +* A *member of HR* familiar with HR practices. +Since HR is going to be your information source, you need someone that can help you assess the impact of HR practices on your project. -* Security professional. -Identity management is intimately related to information security. -There may be policies, constraints and goals given by company security policy, which you should definitely consider in your plans. +* A *security professional*. +Identity management is closely related to information security. +There may be policies, limits, and goals given by company security policy that you should definitely consider in your plans. -In fact, especially in smaller organizations, this can a "meeting" of just a couple of people over the cup of coffee. -This can be a series of meetings. +In smaller organizations, this can be a meeting of just a couple of people over coffee. +It could be a series of meetings. Do whatever suits your organizational culture the best. -[TIP] -==== -The paragraphs below contain a lot of questions. -It is not an exhaustive list; there may be others. -You do not need to know all the answers before starting the project. -The questions are provided as starting points for discussion. -Yet, you need to know there will be questions that need to be answered eventually, in one of the iterations. -The answers to the questions (or lack of them) may influence the speed and quality of the project. -==== - -// TODO: should these questions be in Kick-off step or in Assessment? Or perhaps between them? When we iterate, we need to get back to the questions and try again, but the Big Picture does not go back to Kick-off step... - -// TODO: maybe we could provide explanation WHY we ask these questions. -// E.g. We ask about the situation with returning former employees so that we know if they are considered as complete new entities or if they should be "resurrected". - -The results of the initial meeting/kickoff/brainstorming should be: - -* Identify *data source*, which will probably be HR system. -Discuss the data the HR has, their scope and quality. -Do they have data on all employees? -Do they have also a data on contractors? -How and how often are the data updated and maintained. -E.g. how are records of new employees enrolled? -How are data of former employees handled? -Are the records deleted, marked as inactive, set a lay-off date or something else? -What is the unique identifier of HR record? -Is its uniqueness guaranteed? -What happens if former employees return to the organization again? Are they considered new record with new identifiers or are their original HR records reused? - -+ -You will probably get CSV export of HR data, or perhaps a database table/view. -Both are perfectly fine, at least for now. -Request a sample data from the HR people, to make sure data formats will work for you. -If possible, request several sample data exports from HR (e.g. daily, weekly) to see the trends in data (e.g. if it contains also former employees, approximate number of changes etc.) - -* Identify *data target*, which will probably be Active Directory (AD). -Discuss the structure of AD users with the administrator. -Are all the users in a single organizational unit in the AD? -Are there several organizational units? -How is the AD username created? -Are there any conventions to generate username? -Are there exceptions to these conventions? -Is there a reliable identifier stored somewhere in the user account? -Maybe an employee number is conveniently stored in `employeeNumber` attribute? -Have a look at live AD data, selecting few examples (such as your own account), roughly assessing the situation. -Compare that with the HR data sample. This may help you to see how much HR data is actually part of AD attributes, and you should have at least some data transformation ideas. -+ -Discuss the practices of creating an AD account. -Are there any special procedures or manual steps that take place? -How is the initial password set, how is it delivered to the user? -Is there a need to create a home directory, file share, mailbox? -What is the procedure to delete/archive account? -Discuss which steps would be nice to automate, and which are best left for manual action. - -* Discuss *security*. -Discuss the limitations, requirements and wishes given by the information security policies. -+ -Do not overdo it. -This is very important. -Security professionals tend to provide long lists of non-negotiable security requirements that need to be satisfied right now. -Do not get distracted to theoretical discussions of information security. -Discuss the practice, the current state, the day-to-day reality. -Be honest to yourself. -Do not pretend that you have perfect security while the reality is vastly different. -+ -Goal of identity management is to _improve real security_, not to pretend that the security is perfect while it is not. -Do not try to satisfy all the security requirements and requests immediately. -Make a plan to address the requirements in iterations. -It is too early to focus solely on security at this point. -Basing security on wrong data is no security anyway, it is just false sense of security. -You need to put your data back in line first, then built up from there. - -* Discuss other data targets (optional). +== Topics for Dicussion + +Here is a list of topics you should discuss with your team. +You probably won't have all the answers after the first session. +That's OK. +It's just important to know that these questions are there to be answered eventually. +The sooner you find the answers, the faster your progress will be. + +=== What Are Your Data Sources? + +Data source is a system you can consider authoritative and from which you can pull data _into_ midPoint. + +You probably have many systems with identity data, yet only some of them can be considered authoritative. +The HR system is likely your first choice here because its data usually _is_ correct and authoritative. + +[CAUTION] +-- +*Do you have other reliable source systems?* +If so, could their data be in conflict? +For example, one system might say that an employee's name is "John", while another system says it is "Johannes". +In that case, which system do you trust? +-- + +==== Questions Regarding Data Handling + +* How do you add records about new employees? +* What happens with data on former employees? + ** Are the records deleted? Or do you keep them marked as inactive? Or maybe you only set a lay-off date? +* What's the unique identifier of each HR record? + Is it guaranteed to be unique? + Do all your systems share the identifier? +* What happens if a former employee comes back to the organization? +Do you start over with a new ID or can you reuse the old records? + +Ask the HR department for some sample data to make sure the data formats will work for you. +If you can, ask for a few sample data exports (like daily or weekly) to see the trends in the data. +For example, if the exports include former employees, an approximate number of changes, etc. + +=== What Data Targets Do You Need to Synchronize? + +As opposed to data sources, data targets are systems that hold identity data but aren’t authoritative. +Your goal is to _push_ data from midPoint to target systems to ensure identity data consistency. + +The usual setup is that you mostly write to target systems and use the authoritative source systems to overwrite any conflicting data. +Of course, this depends on your situation. +A system may be both source and target. +You'll see further down the lane in this guide how you can temporarily use a target system also as a source for a select attribute. + +In this guide, we use an Active Directory (LDAP) server as an example target system. +Whatever target systems you have, discuss their internal data structure with their administrators so that you know what you're going to work with in midPoint. + +For example, in the case of an AD/LDAP server: + +* How are users distributed among *organizational units*? +* How are *usernames* created? + Are there conventions for the process? + Any exceptions to these conventions? +* Is there a reliable *unique identifier* of user accounts? + Maybe an employee that number is conveniently stored in the `employeeNumber` attribute? + +Look at live AD data, select a few samples (such as your own account), and roughly assess the situation. +Then, compare the sample with a record of the same account in the HR system. +This will help you see the common attributes and figure out how to map the accounts. + +Discuss *other data targets*. What other systems would you like to connect to your identity management deployment in the future? Consider just the big picture for now. -You do not need to go to all the details. +You don’t need to go into all the details. Just roughly set the scope, listing and prioritizing the systems. -Although this kind of perspective is completely optional, it is a huge benefit for planning and budgeting. +Although this step is completely optional, it helps a lot with planning and budgeting. + +=== How Much Security Do You Require? + +What security measures do you need to implement? +Discuss the limitations, requirements, and wishes given by your information security authorities. + +It's important to distinguish _requirements_ and _wishes_. + +Your security official will likely give you a long list of _hard requirements_ that _must_ be implemented _right now_. +That's understandable and all right. +However, in this phase, it's important that you don't get distracted by theoretical discussions of information security. + +You're doing this whole activity to improve _real_ security, clean up your data, and automate processes. +Not to implement false sense of security on data that are wrong and insecure anyway. +Discuss the practice, the current state, the day-to-day reality. +Be honest with yourself. + +Hear the long-term requirements, make a plan to address them, and focus on what's non-negotiable and _possible to implement_ right now. +The rest comes later. + +=== Plan your budget + +Discuss *resources, timing, and rough plan*. + +Keep your plan realistic. +Identity management requires: + +* Systematic approach +* Time +* Money +* A lot of patience -* Discuss *resources, timing and rough plan*. -Keep you plan realistic. -Identity management requires systematic approach, time and a lot of patience. Too many projects have failed due to unrealistic plans and expectations. -Plan modest results, delivered in few weeks. -*Start with connecting your first source and target system(s) to achieve first results in days.* + +Set modest goals that you can achieve in a few weeks. +*Start by connecting your first source and target systems to get first results in days.* Then proceed in iterations, delivering improvements every few weeks. -Prepare for a long run. -This is not a project, with a specific start and end. -This is a _program_. -It starts now, yet it has no end. -Discuss who will lead the program, what people will need to be involved, other resource that you will need. -* Discuss *money*. +Discuss who will lead the project, who needs to be involved, what other resources you need. + +And most importantly, *prepare for a long run*. +This project doesn't have specific start and end dates. +It will be with you *from now to eternity*. + +Last but certainly not least, *discuss money*. + You will need money, even if you plan to do most of the work internally. You will need training, assistance and support. -Plan a recurring budget, sustainable funding for many years to come. -Having a modest budget every year can lead to a successful identity management program. -Having a generous budget for year one and no budget after that is a certain way to an expensive failure. - -As we mentioned, you do not need to have all the answers to all the questions at this point. -We will get to that later. -What you need is an _overview_ of your situation. -It is perfectly OK to leave a lot of blank spaces in your plan now. -The important thing is to know that you have a lot of black spaces that need to be filled in later. - -Maybe you will need some time to get your plan straight. -Take your time. -Learn and explore in the meantime. -Do some read-up on identity management. -Watch videos. -Download midPoint and have some fun. -If you are a hands-on type, create a small prototype. -All of that will help you better understand your problems, and also the tools that you have at hand. -Gather your collaborators again, update your plan as necessary. - -Now comes the most important step. -*Talk to your management*. -Make sure that the management understands importance of identity management for your organization. -As identity management touches many parts of the IT infrastructure as well as business processes and organizational procedures, support from your management is critical for success. -You will also need time and money. -Make sure there are human resources and appropriate budget allocated for your project. -Do not exaggerate, do not oversell. + +.Plan for recurring budget +NOTE: Having a modest budget every year can lead to a successful identity management program. +Having a generous budget for the first year and no budget after that is a certain way to an expensive failure. + +== Get a Buy-In From Your Management + +Once you develop a rough plan and estimates regarding required money and time, *go talk to your management*. +It's crucial to get their buy-in, get them to believe that your identity management mission is meaningful and that it makes sense to invest money in it. + +Don't oversell and exaggerate. Provide honest plan and estimates, set realistic expectations. Identity management is a long run, any kind of hype or exaggeration is very likely to backfire in the future. -Get a green light - for a long program, not just for a short project. - -Now, you are ready to go. +Get a green light—for a long program, not just for a short project. -You can continue to xref:assessment/[Assessment] step. \ No newline at end of file +And with that, you’re ready to go. From 618fefa29a9c5e164d074bd41b04ef7d04071e67 Mon Sep 17 00:00:00 2001 From: dklement Date: Sun, 9 Mar 2025 11:08:38 +0100 Subject: [PATCH 003/183] Rework the first two chapters of Methodology first steps. Add related guides for near-future use. WIP --- ...eate-resource-select-unique-attribute.webp | Bin 0 -> 11414 bytes .../manage-resources/create-resource.adoc | 74 ++++++++++++ midpoint/guides/manage-resources/index.adoc | 18 +++ .../intro-to-resource-configuration.adoc | 55 +++++++++ .../view-resource-details.adoc | 40 +++++++ .../methodology/first-steps/assessment.adoc | 110 +++++++++++++----- midpoint/methodology/first-steps/index.adoc | 2 +- 7 files changed, 267 insertions(+), 32 deletions(-) create mode 100644 midpoint/guides/manage-resources/create-resource-select-unique-attribute.webp create mode 100644 midpoint/guides/manage-resources/create-resource.adoc create mode 100644 midpoint/guides/manage-resources/index.adoc create mode 100644 midpoint/guides/manage-resources/intro-to-resource-configuration.adoc create mode 100644 midpoint/guides/manage-resources/view-resource-details.adoc diff --git a/midpoint/guides/manage-resources/create-resource-select-unique-attribute.webp b/midpoint/guides/manage-resources/create-resource-select-unique-attribute.webp new file mode 100644 index 0000000000000000000000000000000000000000..bcfb1af8151a0e6c57af63a7cafffff6ae4bede3 GIT binary patch literal 11414 zcmeHtgtgx+Db_K|mIE>6Gs7FkpAtrF$vqMkOQ_l@ts*1Vp5yL8Jtc6e(#0 zX@z^>(dYTz`}+Rw{R8eZ`#L-CnR$Oc^O^U|95`pzNK;KMK>z^ERh10P3?wZ`0RRAt zKp-B#gac?QD;wnCf<*u~#~J0~g|7erF0NQlBXuPX3ri~wqGbRNAOSzP02cz~<*sO8 zpmWCl?`dxoz&UFfhMxKQ@0|a!mfRNYg#rK^4v?XMa`(i7*apPnzF7A&{1C)+D0_r0 zh>Jli;0Xo@;<2-OIqd!eBmV=V>^)sTjwr~vZ0q6* z`p32S3)`OIz%%UP>k8@8?f8_xH-Xs7tyZ&SEmIDBiyI}qOf9fu00{~?t0MxYoQ-^#2 z0JSjy!1&o6;fXl!2M_$l#b5wn`#AuRTLJ*>0059)|4TQp?W`Sm`UwC`K&^E803hQL z0Pxs>zHj^w<0b|T{?_gP%K5DyxN>z4SO7pMP+1Kyz4x`og*D)`F6FA=W~{-Nn)p2U z<`?>h&He5xF-;0=K;90C>zB9vO+KAL*x|<7bh^T&I~f~~S3}7aJq(8==glT+bVxVA z#6Yd6qt}xQAblaez9;OyzP^^=<+~pOJ-C%mC)92HD34V7Ax$mi4I{@bT-m9cyci>^ zAxQAs=sV>D0Xb3Rxm4P40p#EUBaH&50`{8XgsIXsBwAh zW9D2GRpT;(Xnz+X0s>_Ffi!o{X?wV5*hm^fj6Co0=Tv9aE(`pyj zCyCa~CidRP4?`%!m?#LNbM|k<9NLA3aT1d?M{y}o{m9v$Mi8sxDd98Z;6Z&b3Y($1 zVHcZQ^)5eKLDd_S`iXpAR>;t0qrb;*gAy;V(7G>N@FFbt5!H@d z&r4F12=kR5gA3Qp8eiU^o>rY`%WBmT-zI>iYD+v=wps5o`D!)B;7-S9evt;!6-7Fu zlXTbpz4*LkO1Jj=d7h75C434L8E@AWiUzc)d+$S3jTVgy^0W+I6VZ3I(-8m`Lpp&R zKEA8s6ZO}n_eXsb-Dz+B^649Uf`fdI>p({`Q3G{QYZBt%l>Yd6Y`y2??aJ#ygj=cVm77)s5b-vcbz%Vs$xcKL+~)WN z@PfUc4Ap5v*{H|UX9H8lbWcrrS07t@5$8}et=vNgW3Osyb-io8H=uAQAuKLB2#W5{ zUO8Rb>U-k6c4s?`r}z1+chSnw=n0F84tb&#&qdsXr1YwJCLA$Y63sq*Ru*%;6w-G# zn73hy3SE*HO{UZzT7JK%gELzq+mfT8bhPEH&QXr)UG5Wg^c&|Fqu;_V`2^ofxP@0r zu!h^{_jAV9Nxwc;z}jzxVvRMrRLwQ#n-^61!l0q0VQt~8rM;u)$(CojEGNPEGq2QU zi(rft;brW@Wu{2Ry$`~vYwL3zCs1ie3tf-*6RTpiBD3$dG8wYyMZ$o`t}oqk0en_b z63I6qyIre8ZGQH`B$B_aq>JavqY_l{c`os8=xGmH=R$2PF)WeSYmrfJcN8YA%LxU3wDlUmwUK0K=S2UH=n=7M0Ad8*2pvW3`GOwik zhB&XM!6)#3bG{Efc^v&?lGqD<$DSv};;QKJ#g0(zp4MY2Wa7~5DjT}_p(|EQn7Gku zdc^4p;S(~QaOmRlJ9rK(EntJ-4l*^CadYTRtFX)vT_GPeDhVdZ)9TXd^tr^XAzHJ` zGng(q6HymSfVBFNq#H-1)FIWh7>2d$p9-@PSgozru%Vr^>32<#%zH2K=wwIHgj}zy zGHBuCmeg7j>q;io!rYIw;j*rbPVxMouV`!rdBg-Zjr+{M<<~PqSPrW_b|pD8jD@a0 zB!%%C1!;VJbiYEkh<~wtI(k5f;BQh+U(3_4x$Y_2k`u~h z-AJ;VI3BO&-z<<7QDvaXZJWR&5#FZB{$R~USkmls`QS@)Mzn&qQsEuV@)6#rR>}Bd zKD~jBx7DPy3@=G*(U-mmyxA!h$ChTInL)B8VN7&^Z-qK3<3l6E4(qk{>ego;Bj)`- z$?V+v+He;Wyi+t%mi6F>-C9k-vHwR*s9m&p6@Fr=S%`+9*b+*hz8zk9!S9lL+Mr(7 zcAdWQL_vYKhrP{S!BhdK&G>N^yJ5F0p_nX%Uf(IBwVu;qvVUN>e4bs6`A|u)5^1cS z*3rUd9!j*RyY=Undj{%oBWY#`k;72?jzkQl2T-1WohKr$klmS>+lEFs!QWKqu{=+z zG3HJ047)3DWisQ{ZhlVj#BV$1Wo`L=?5A#oD}j-BbUd3h94 zCazuo$c=4HSGAQHXBye!fK|xKze#RyF~8R~nt$)UhfpD#NF~Xeb)T97ha+nJjc%*u zNcB7)_tBDr4vao8BhDz>@XSJx(_u*{*XFbbISOjrLvlg2%(*PzX)ba_^3A}H`Jadd zf%yALgkP2NRh|U-u&y6PjVigRJ9ntYiQ4<50_0H`t*$Pw!eDXrpt#R8ZgZK80r@Wo z#hxr%=ncPHE5#A<%~t>o^HrccwmB)6MahleJZ)Bt_;NL+52Il3cD<4x_RxD1-`#h7 zIg7CIeCZW@@X>qkvz_{#(YFMxUE*7%ovQ0UQJYqkg$erG4wNcWUy9WStJjmB+Mo?H z_O2zm*aXj*<*#+b%)s$uA1bJ|e!$$ROfCk zV3Ia3RV`^{O6FOnWM!IkOY%!)5(WZ*W=I_)b1aSB!H<9cT_TD{Yi>U5b7^RdVv1~I z^DIA3_sC(yYF&wQWSsV`ohK5I-2@T^op!GYXRB9XFI%3X#jF#88EI~%+ZzzRy1_ps z`(a1oZ6F73!i&$sIcS!lb9r>b#EoI;W*BO~z49q=F@bq<%o$8t!z= z)a!d}?H^3xyJ5~7ndI6{uj)lE|MZaW{W&`MeDxaP)aa^+`T#GBn5@$S<_FFJEFE|$ zYM);?2Us88;_SVndgJL@d676_giCTJ74Kt+ce)4K9CwhupZe~m2dqWeTnaeevWljo zUUW+#j%uV5!_%c*xEHv3MACajma62el;Yk!ix!owRC8e3Eq9dz1iv!QG|*`tm;}&_ zDU>2UPF2xd&1oOKmO4$mn@TvpN;un?Rz*fR)n%;iSv%i3cS>+Mzre2}H@cyh+qCrl-_ZqoggXq=N=Li=Nd8}N3xQYIqNl^PMc@LF<-cnS6qbqe)dj=XF=3~ z85z+{H6^@nWATZ#zr=@a67N02cPEWWxe|5MR~>u6`{P}Z=eId~^6}8RqwgG@*%#yP zT54~7kWP2M$VQA=OiSN{Eva3Gw-n7;&QEgdlvfFOlGQ(~-5{OS+gY!vaS-{W9134V zBsNfp>&3*RmC0VE@4qb-$mM<8r7YZQr-3XekuQ_o`CGAh9?jkuIp85y@QeCJQ{} znk0TAn`J`vHL~V{X4^rVcPs4`$^-@hDFqs-9RmFuR~Y*Rs7OR-#qF3sk#yo!c711Q zH&q2*M34?v0m zi62u63Jlfzb*boZoo~;`ZW;15GJhsv@c)vFabJ~?zG_8%``|_#xezqXGY_dOBs)9K zOJ#aDbZCfiyyO;&*RiVU)9&2PS10Oi+n$I-G3Dz`gUh{&l$09oh3_9n7Cg2YsNRJg zWgjK4lvG~~vY^|rj3mxb+0q$rb5Jvu_oG^${)0+tYjyl_Cv~OShERw+$&FVD%~VO;j5{H? zz!V$^@{8R*I6h|iX*ZBnVIe;t7^MDGPI)@qUjIvo)T=97Gf!GVSdKZejc<I`{Dqaloa@ke?G`XBE-*L@mkKdH;wSB7Nn^6PN zmsFzs#DW9Ea<&HP`^6JCf4NPMjC;qEDt*Ijj&1fE&#X<%%vu)l@#Gn*6_Q8v*0`m` z2+!K%JrLWV@ZMj!kG9km?$IdGv>82mTKMpelMX-Uo{UnkQy(Gjphj6C;kHHB+-$s` z>=)8>L_xS(w$Vav2jlBb!*(8I@Z5%hdF`^kP5&Jk+kv?n;qtxwEH`Q-pUl3c8Fl)1Fx*}2>MviObV=a4eWWD-_K@cBt z$IOmZj6e@RO@!sDekmmxZ+e{C%R;+&UZ=!&InmXD+ICiWEVz?GA5S{ukB(|nQ(wZO zhu%G)K75cCUvxSWJh!^Dtp9L$c58r{{&rKATxwX{q!`8fCygQ=Tpmh%Z2>yFbeZdpJJyoun;Ff`fYmiojV>ay(e{FiduA@q9F>cspPy#F2~P?O zr^@SZ9k-f#bWz0*QYTaU-T%`iI455!;9~#%(T)`^3-7fJV~VoA!}zBPxEdF@6)##H zd0o>!AjCoxoHZycb3`L+x0eD(k5~roklx{tn~xTzn(lafdO}E#()#2R?7_)x8=+*t zfF)ah8x_hO7$G&tNn#uN)_~42ye2o|`Rh~id6n>k`^=sS)Vvhc3ayN@f>8pqEN$Pf zr{K1cMN`orFZ5JSf6#hwr2HhlfP>Q{Ea~)CclOBkqIZKom)qbcOOorjMoU+1@y9mH zE>GTgMExpxRvqH2_f=61k5D7&47q76t}pQv6V&2p70j}-~Qdu(rm;R z$+n6J1{l6sOk6mrJBIaVU3a)d=kdGCV-+6=pEdX8=8y?-B#0fbv`WYI*=SxJyF$De zI!o@vb^-PNQHU{-Kxov*2Ap;8mQCe=TX6>`1k@3y;(MId`wO(}UN!?Z{&36S@?l9M zYp&P?ZfReK-ph2loXR-&*4gAUgDmwiNo7qnnySOrXqD*5IK{)&XDR&GS~70oXb|LT z`C5O+g{v&iTry<$pN?vO&inugL!TB%#ChE;rsRO#5`e;?+lGD@2t8%laJj*Nmr zxQLbDh8SxgZYtI7H`e!(nlw<90i#*KY014 zyuglePnzC#%a2ubc~+bC#~oG3MLMC>ZZ_#rilX73l+g#Kq{(Ie*e)aGQ`>FTpf_Gr zzgQsnsE!f(PDbmWj^=#49%{Za(~jO|Evcn3_g~F^+7~wx+))mt-?IzJ6!C`&(8l9b z@aW%p-qc;*+M`(?bY=Jovh-v%r%645D0dikvpkpXWWw>YTOU$%QguF&_GSipx zE~ttWSKjhO?J-$^?=DTgMNE;4Zye(KxVz-Gb6uXB{^cI1e7rd>K<0eH66Yy|8wk-4LyL`{^H*#MZabR`Zh4&MP z%&(TcwhY$d#4CR%x?*R2$2%rk7)dZZw3KHl!{n`ltJ7AOSZWcK8XuNuZU$++2w39> z96;Lbygs|#_};)>^g=ipdzqk)U~w5Rd&KkW#?uwE;j-%nLU4?6mI%j%85zmQ#_Veg zqel3(E0Zq;-XItBDZ8vCGR(Hv-};^MbkfaBNPc{%)sbA94>3>j#|eGa#r>&NK%fr& zz&k;z=GDB-cI?2<%$b0ATk7T{%(_e(IUkp?@Tt@b;j($?^!|@^b-@$}9-oQfGuz2` zU%HLB5*3Rp@6(aeyQr*mD@ym3ROrvPf8%6#;I^Hw5}oRvJ)Gc4S$oGPqc7pc^s5F} z^eXEi^~|YgX1kqk{@Tv9ZmB1sF@5bnd`^zpZ%6VIs_Pp`7^P}!LXvZmLI*K8bu5NH z5A<3zp(U=+N}`emzMD-Mku?#+&_;@?rwe?WB+-3Z*PHxp&B$?eM?2>TDauv_uXc%% zO~iC0Sfy~ekM(4Vl9|x4*Dv|IOb0H6r@qpe;*D!{SMj$h5DY20Y`usHg+Ie)*wq}a zhnWi6^$aJ$ZZ1dH%ws|k^>#jUs4?n`BD;5b7x3%YY>2l%O5P~lStFrM>2|-;+`KjU zPzO`~0G}~juE8IC1=jyXKH`*&nG*>AkZL$SbB9a%`;ol4RDTF6G*ZW5qjEYgeBYxt zcCtXf4mSF!1pPT+)QNvFs(~Kwfs1%daH!O5G(bul>e;nL*bomBm^>A=JAK z-IV3fPcI2)x-sC(!FhP3u5~Qa&85Ri5qB}kQp(Ph^qD&O&yCZOo6#7bsn?aH^={h^ zrH8V)Pwsw>-dFpqda>9@QRx_`c3^vfc*1Xw;uTgV8@CrcXY+XnA{=(xbug z3tz;~NGBa=NOenh!=u)0?K6DtMs^wd?U#A1VQhIsw_6WC7uWTUlr zH`W3n5kb7sd;4iMEVtrTK6VLEQ7Zr3B**duAxgsRRF&$pd?|f&I7*j3EK=7wh{o;G z(vh}zf6oOSm+|V>u>K&-uJGP?{_Kq_vpe^AbTwfX{fpU!@^8M%PchJ8@|q8v^3=!} z2-7qlIE#O#Q=I26z%@AMHhFrHxZl`gzGSeKw4&m@S1?f>0|oE91^+Tj0jDKm)T^S@)*A(B!K39c*C6Tc4@{zi{(<<2|p&F+7EinrGG4A6KS?3Vh zhvfwYdaYz9_f|jSQ>tj#OK=>E*nfSfEaHWgk4Np)l$jbS@CRjQu_Y?ix<0c>q|Y1- z+{HU(W{J;iQV;4lYx0Y8vgHaNekkDHyGz<_LFhg&F;BxLR}00&UiR(nXl+CIS7qsL zxxX?NKlolqeXCX7Z$XaW7yq?R9FuQyrwk$N3JX=?w@%h^#eRAlxK5TCK>EQW0-Te# z+a;szR#Bj>LL~6`a{uMAR}Q3e39*JwhI}hjY5k6-#V!T8aSEYH-@X?GR48Rp@eT+; zro7x*OOuqg5v^rE+#Z0&ut;FIxnAOmtaMs=kp*P?d*$M@yayW=XuE`pPofPZjBSg8 zC6Ru_esA`#j`%EtIw+_63)U%~zD>R;kW?p~NgDL3UOCtevsDSFd{AA3HjRm#a9ke5 zr&Kqybn}Dv-q%7#6}Q)2bE@+d`$YffUZ!VLaD3H*x>s5=Od#f$@e*I|OK-b3j#Khm z9U?Z&x5ZoV23-a#^q?sp?221xxv5=7qP0cSUta9@c0P7womu+zB-K=!mC0M<*H~c% zb3olb@8s!r%VtT9c0Z5b7nV`XR(4AW;VIKkyRDfH-ONe35SBfo5(PhvZv#img2fi9 zR^LW8oP##g8ujB7$U~g^Ux|m0ks`nG8p2{Ex2F$+-#85ObgT2N9aUIXsW}^l9_DIi zaiyQ|Zl>Jj-w0ZlWd3D1UqUf}L$Jr+yd?X|A=cB~ykEaW#d z4qbgFi&LX~dizyc3ey5t*DKN0_7{pSXnNK66@g+6lWGk5eZ<5Kv;uPn(!*tcPK1a27U&5FDjFe|B_f)%Uq-|qkEqEPpS zKwz*=d*5e$@sBGjnup21`VG-$Z?)*szttD<*eGma{p#vnwr$GzXY@ZW$dAg*5c8c(kh)h<9Cq%xd3<`T$m)Z9 zW+d(A|G=HhXK#Gt@bT>(B}Mi;$PY(f@qO$KqK-f*hTdaDm|!Pw2ZPsQO21=hw!mQ+ z(-jMx9i;~pJYP7nZV}nUq@|EEstgA&w|a94h&xF0(FH17Z1{P^v042XzGuFsWy`he zyhtv``z;Jy55@QLnH(1~$6kKF&0_b_ZXO>fsG6g@W!YQ2RK6u_(26Ip&-UXMm!--* zlsO^oDqhKTmazR6_b2K_w2}`GI6K$f5x;Sap6e;}D$ZabTI{H%);B>o9Bkzv=3=@q zU3X=)y@SSWPqguEJrmSzCzO;eME)9wte>=>i@OUNi{S8cad!2R_LGAkY~7G(X%L@P z3qd%}DOe{t$XQp)Zk}ikQ9)5b7*y5I!ABSZ`tY>HNE@lB{q_Ksi+H6)l2X^OhJ^Ji;y3}T?j4+6LN7mi}sxDg;n(djem#nU)f$J{_bcY zBea*BwVtO0a{V#4Mg48-?(OM(J^)*k5ZW2-0@A#|-r#?Cbv9{#v(E->=iuUg zZUHL$Hw){4`A3%jEuOQM^YH(44x0V#?|)4JO07J)^mAh2lA*WX*z7*{S~Jd!Ut^&`CSSApvBb=4eoPrt^GxF_%HJ*iV>ECiHabgNMVF9 zR1_sD43$KPi9z8g5eadGtt}EJf&63d<%YrfB0SNGcAzw%0^rg*zbkR@o=eX6hv#dL zKGPG_016WU7us(P;IQ8s2!Zhnoo(g6h9dNTj`F# g1^!jwUj_bE;9mv)|5M Resources, click *New Resource*. +. Click *From Scratch*. +. Select a connector. To read a CSV file, use *CsvConnector*. + +Now, you'll configure the resource on several screens. + +=== 1. Basic Information +. Type *Name* and *Description* of the resource. For example, + * Name: _HRIS_ + * Description: _CSV exports from the HR system_ +. Keep the *Lifecycle state* as _Proposed_. + +=== 2. Establish a Connection + +For CSV connector, the only configuration is a path to the source CSV file. +The exact path depends on your midPoint instance configuration as defined in `docker-compose.yml`. + +Look for the `volumes:` configuration to figure you the right path to use here. +It could be, for example: + +* `/opt/midpoint/var/resources/export.csv` +* `/home/myname/midpoint-tests/midpoint_home/hrexport.csv` + +[TIP] +-- +MidPoint validates the path when you try to get to the next step, ie., _Discovery_. +If the path is OK, it lets you proceed. +If it's not OK, midPoint will tell you and won't let you go on. +-- + +=== 3. MidPoint Discovery + +Use this screen to tell midPoint about your data structure. +Refer to the information tooltip icons to learn about the purpose of the individual fields. + +In the case of CSV, make sure you set the delimiter and quotes right. + +Importantly, you need to select a *name of the unique attribute*, .ie., an attribute that uniquely identifies each entry in your database. + +Conveniently, midPoint suggests the field names so that you don't need to type them manually. + +.Automatic suggestion of fields discovered in the resource +image::create-resource-select-unique-attribute.webp[Discovered fields selector] + +=== 4. Schema of Object Types + +In the final screen, you select the schema of the object types that are in the resource. + +If you're connecting an HR or similar resource where the objects are people (users), *use the pre-selected _AccountObjectClass_ schema*. + +Otherwise, you need to extend the schema or create a custom one. Refer to the xref:/midpoint/reference/resources/resource-schema/[resource schema documentation] for details. + +Click *Create Resource* to finish the configuration. + +== What's next? + +With the resource created, there are two things to do next: + +. Preview the resource data. Use this to confirm midPoint gets from the resource the data correctly. +. Configure object types. You need to do this to tell midPoint what the objects in the resource contain and how to work with them. diff --git a/midpoint/guides/manage-resources/index.adoc b/midpoint/guides/manage-resources/index.adoc new file mode 100644 index 000000000..24c60b13d --- /dev/null +++ b/midpoint/guides/manage-resources/index.adoc @@ -0,0 +1,18 @@ += Manage Resources in midPoint +:page-nav-title: 'Manage Resources' +:page-display-order: 110 +:page-toc: top +:experimental: + +// WIP - just a copypasta run thru AI + +Resources represent applications and information systems connected to midPoint, where resource accounts should be managed. + +To create, modify, or delete resources: + +* Click the _Resources - List resources_ tab. + A list of resources is displayed in a table with some basic attributes: Name (in midPoint), Connector type, Version (of the connector), and the basic options icons. + +You can sort the resource list by name by clicking on the table column header. If you click the same column again, you can select whether the sorting should be ascending or descending. + +For more information, refer to the xref:/connectors/[Resource and Connector Reference] chapter. \ No newline at end of file diff --git a/midpoint/guides/manage-resources/intro-to-resource-configuration.adoc b/midpoint/guides/manage-resources/intro-to-resource-configuration.adoc new file mode 100644 index 000000000..c866bde44 --- /dev/null +++ b/midpoint/guides/manage-resources/intro-to-resource-configuration.adoc @@ -0,0 +1,55 @@ += Introduction To Resource Configuration +:page-nav-title: 'Resource Configuration Overview' +:page-display-order: 110 +:page-toc: top +:experimental: + +// WIP - just a copypasta run thru AI + +== Resource Definition + +Resource definition is perhaps the most important part of midPoint configuration. It configures connection to a resource, resource object classes and attributes (resource schema), mapping of these attributes to the midPoint object model, resource capabilities, password policies, etc. + +Resource definition is an ordinary XML object in midPoint repository. Therefore it has its OID and a name that must be unique across all defined resources. +You can check this by clicking through the path Configuration-Resources from List objects - a resource of your choice from the list of available resources. + +=== Resource Configuration Object Composition + +* *Connector Reference*: Refers to the specific connector used for accessing the resource. Either an OID reference to a connector object or a smart reference to a connector type is required. + The list of available connectors is in xref:/connectors/connectors/[Identity Connectors] chapter. This list is not closed; we can produce a proper connector tailored for your target systems. + +* *Resource Configuration*: The connector specified by resource `connectorRef` is just code. For the connector to work properly, it needs configuration. + Such configuration includes details like the name of the host where the resource resides, TCP/IP port number, technical account used to connect, password for that account, database table name, directory root, filenames, etc. + Configuration properties vary by connector type. + +* *Schema Configuration*: Resource schema (attributes) can be defined statically or generated automatically when the connector initializes and if the resource supports getting schema. Most resources support this, e.g., LDAP, Database Table, CSV file, Active Directory. + The resource schema differs for each connector and/or resource (e.g., two LDAP-based resources can use the same connector but have different attributes). + +* *Schema Handling*: Specification of handling objects defined in the resource schema. For example, read-only or read-write attributes, account object classes, expressions to determine values, etc. + Schema handling specifies how an IDM administrator should use the resource schema, e.g., what object types to use for accounts, attribute setup, password management, etc. + It is where resource behavior customization occurs and influences how the resource will be presented in the GUI. + +* *Resource Capabilities*: Resource capabilities can configure special features of the resource. If this section is used, it overrides connector's capabilities. This configuration can simulate capabilities if the connector does not support them or hide native connector capabilities for a specific resource. + For example, account de/activation: which attribute stores the account status and what values represent activated/deactivated accounts. + +* *TODO Scripts (Before/After Actions)*: Scripts can run custom actions before/after connector operations. For instance, creating a home directory for users and setting access rights. + Not all connectors support scripts; language and script arguments are specific to each connector. + +* *Synchronization*: Synchronization enables you to sync changes from the resource to midPoint. Changes like account creation, modification, and deletion can be synchronized if the resource and connector support it or by using other synchronization methods. + +== XML Namespaces + +Several XML namespaces are used within the resource object. Refer to the chapter xref:/midpoint/devel/xml-namespace-list/[XML Namespace List] for details. +In examples, we use these prefixes: + +* *icfc*: Connector schema namespace (attributes common for all ICF connectors) +* *icfs*: Resource schema namespace (attributes common for all ICF connectors) +* *icfcconnector*: Connector schema for each connector type (attributes only for this connector type) +* *ri*: Resource instance (attributes only for this resource instance) +* *c*: MidPoint's common schema (attributes common for all midPoint objects) + +For more details and example code, refer to the _Resource Configuration_ chapter xref:/midpoint/reference/resources/resource-configuration/[Resource Configuration]. + +To use the resource samples documented in the xref:/connectors/[Resource and Connector Reference] chapter: +* Each resource sample is documented inline. + Follow the inline documentation for guidance. \ No newline at end of file diff --git a/midpoint/guides/manage-resources/view-resource-details.adoc b/midpoint/guides/manage-resources/view-resource-details.adoc new file mode 100644 index 000000000..c50b01bf8 --- /dev/null +++ b/midpoint/guides/manage-resources/view-resource-details.adoc @@ -0,0 +1,40 @@ += View Resource Details in MidPoint +:page-nav-title: 'View Resource Details' +:page-display-order: 110 +:page-toc: top +:experimental: + +// WIP - just a copypasta run thru AI + +To display resource details, list resource objects, or import resource objects: + +* Click the resource name in the resource list (available under Resources tab). + A new page will be displayed for the selected resource. + +The information is organized as follows: Details, Defined Tasks, Accounts, Entitlements, Generics, Uncategorized, Connector. + +At the bottom of each section are buttons: +* Back to go back to the resource list. +* Test Connection to check if the connection to the Resource system is successfully established. +* Refresh Schema to refresh changes in schema. +* Edit Configuration to modify configuration properties. +* Show Using Wizard to display resource definition in wizard format. +* Edit Using Wizard to modify resource definition through a wizard. +* Edit XML to edit the resource definition in XML format using an embedded editor. + +The Details pane displays basic information about the resource: +* Connector name, status, and version +* Basic information about resource configuration and objects that can be managed on this resource (e.g., accounts, groups, LDAP object classes). + +The Defined Tasks pane displays tasks related to that resource. + +The Accounts section lists accounts in the repository and on the resource system with a summary table. +It also offers options for filtering accounts according to any attribute and executing account operations such as Import, Delete, Enable/Disable account, and Remove/Change owner. +At the bottom of this section are options for creating tasks. + +The Entitlements pane and Generics pane contain similar sections as the Accounts pane but for other objects (groups, projects, etc.). +Objects in these panes are categorized by intent. + +The Uncategorized pane offers an option to filter Repository/Resource objects according to Object Class. + +The Connector pane displays information about the used connector. \ No newline at end of file diff --git a/midpoint/methodology/first-steps/assessment.adoc b/midpoint/methodology/first-steps/assessment.adoc index dba433c8f..67188ee1d 100644 --- a/midpoint/methodology/first-steps/assessment.adoc +++ b/midpoint/methodology/first-steps/assessment.adoc @@ -1,9 +1,57 @@ -= First Steps With MidPoint: Assessment -:page-nav-title: 'Assessment' += Connect the Source and Target Systems +:page-nav-title: 'Connect Source and Target' :page-display-order: 110 :page-toc: top :experimental: +.Goal +[TIP] +-- +Now that you know what systems you need to manage, it's time to connect them to midPoint and assess the quality of data you're dealing with. +This step enables you to identify serious security risks, such as orphaned accounts. +You'll also get to know how consistent your data is across the systems. +You can use the knowledge you gain to improve your plan based on _real_ data. +-- + +== Considerations before you connect the source system + +In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as Active Directory using LDAP. + +In reality, however, it's not so straightforward. + +* Firstly, there are almost certainly errors in the HR data. + They're managed manually with no automatic validation. + Having nothing to compare the data with makes it impossible to assess its quality. + +* Secondly, the Active Directory data is managed by different people and also manually. + There may be outdated information, such as old names of people who changed their names. + More serious issues like orphaned accounts of former employees can occur. + These issues are fairly easy to fix through synchronization with the HR resource, though. + +* Thirdly, not all Active Directory accounts need to exist in the HR system. + Your AD admins may have created some service accounts. + These aren’t employees and therefore aren't in the HR system. + That means an HR-based synchronization without proper planning would delete these potentially business-critical accounts. + +Overal, when you integrate an IDM solution on top of existing account data, *you need to be vigilant*: + +* You can't change *usernames* carelessly. + Many systems in your organization may use them as the primary ID of the accounts. + +* You mustn't delete any *accounts* unless you're absolutely sure it's the desired action. + +* You have to keep *passwords* as they are. + Otherwise, you'd lock people out of the systems across your organization. + +== Connect the HR system + + + + + +--- +--- + .Goal TIP: Asses the _real_ data quality, determine practical next steps. At this point we know what we _really_ have, what we can build on, what needs to be improved. @@ -20,7 +68,7 @@ Mistakes in the data might be buried deep, surviving undetected for decades. Having nothing to compare the data with, there is no telling how good or bad the data are. Secondly, the data in your target systems (especially Active Directory) certainly leave a lot to be desired. -These were managed manually for years, with no automatic way to make sure they are correct. +These were managed manually for years, with no automatic way to make sure they’re correct. There will be account belonging to people that left your organizations years ago. There will be accounts using maiden names of women that are married now. There will be strange accounts and identifiers that originated ages ago when your organization was still small and system administration was fun. @@ -29,8 +77,8 @@ There may be all kinds of weirdness and historical baggage frozen in time becaus In general, when deploying identity management system to an existing environment, we need to take extra care of the following: . *usernames*: midPoint usernames should be the same as for the principal authentication system. In this methodology, we assume that company's Active Directory or LDAP which will be connected as the first target system is used as the source of usernames. -. *accounts*: we should not harm any existing accounts in an unexpected way -. *passwords*: we should not alter (e.g. re-generate) any existing account password +. *accounts*: we shouldn’t harm any existing accounts in an unexpected way +. *passwords*: we shouldn’t alter (e.g. re-generate) any existing account password Taking HR data and simply forcing them to Active Directory will never work. We need much smarter approach. @@ -106,10 +154,10 @@ When finished, switch the HR resource to `Active` lifecycle state. * xref:/midpoint/reference/admin-gui/resource-wizard/#how-to-use-lifecycle-state[Resource wizard - part How to use lifecycle state] -WARNING: Make sure you have selected the proper archetype for users before importing them. Change of archetype is not supposed to be a straightforward process as archetypes are expected to work as object classes in the future. +WARNING: Make sure you’ve selected the proper archetype for users before importing them. Change of archetype is not supposed to be a straightforward process as archetypes are expected to work as object classes in the future. Now you can import the HR data, creating user objects in midPoint. -As we are working with simple data for now, the import should go well. +As we’re working with simple data for now, the import should go well. .User lifecycle [NOTE] @@ -118,7 +166,7 @@ This is where user lifecycle management starts. We need at least some basic framework for user lifecycle management at this point. -If we can identify inactive (former) HR persons, we can utilize this information when checking for accounts in target systems that should not be there (if we do not import inactive users from HR, we will see their accounts in target systems as simply orphaned). +If we can identify inactive (former) HR persons, we can utilize this information when checking for accounts in target systems that shouldn’t be there (if we don’t import inactive users from HR, we will see their accounts in target systems as simply orphaned). ==== Instead of setting user's `administrativeStatus`, we recommend to set midPoint user's `lifecycleState` property based on HR data as either: @@ -130,9 +178,9 @@ Instead of setting user's `administrativeStatus`, we recommend to set midPoint u .If you have imported users with incorrect archetype [NOTE] ==== -If you have managed to import users from source system with an incorrect archetype, please do the following: +If you’ve managed to import users from source system with an incorrect archetype, please do the following: -. Delete all imported users from midPoint (make sure you do not delete `administrator` user) +. Delete all imported users from midPoint (make sure you don’t delete `administrator` user) .. midPoint will attempt to delete the source accounts in HR as well, if you have disabled `Create`, `Update` and `Delete` operations in resource capabilities, errors will be displayed (this is expected) . Re-configure HR resource to use a correct archetype for user creation. . Re-run the import task from HR resource. @@ -154,13 +202,13 @@ You can see this step in action in the First Steps Methodology webinar video: video::suo775ym_PE[youtube,title="Step 4: Connect Target System",start="1898"] -Set up outbound mappings for the small data set that you have (given name, username and so on) and keep them in `Draft` lifecycle state (effectively disabled). +Set up outbound mappings for the small data set that you’ve (given name, username and so on) and keep them in `Draft` lifecycle state (effectively disabled). Configure correlation rules for AD accounts. Configure synchronization configuration in `Proposed` lifecycle state. -We do not want to change any data in Active Directory yet. +We don’t want to change any data in Active Directory yet. .Please refer to the following documentation: @@ -211,10 +259,10 @@ Of course, if the correlation is not able to use the personal/employee numbers, Let's leave that for later. For now just focus on correlating the bulk of users. -If you get 80-90% users to correlate well, you are done here. +If you get 80-90% users to correlate well, you’re done here. There will be also orphaned accounts (`Unmatched` synchronization situation). -Based on your resource configuration, midPoint may report they will be deactivated (but we are still in `Proposed` lifecycle state - just simulating). +Based on your resource configuration, midPoint may report they will be deactivated (but we’re still in `Proposed` lifecycle state - just simulating). We will analyze the accounts here, but we will take final decision later in <> to not stop us from progressing. @@ -223,14 +271,14 @@ TIP: You can analyze/clean up the data in several iterations. The orphaned accounts generally fall into the following categories: . *Obviously orphaned accounts*: -Review the list of orphaned accounts (the accounts in Active Directory not having an owner in midPoint which should mean they are not related to HR data on which midPoint data is based) one by one and make sure these are _not_ system accounts (see the _System (service) accounts_ category). +Review the list of orphaned accounts (the accounts in Active Directory not having an owner in midPoint which should mean they aren’t related to HR data on which midPoint data is based) one by one and make sure these aren’t_ system accounts (see the _System (service) accounts_ category). + -Be careful if your HR system does not contain/export former employees data; in such situation you will not have the former employees in midPoint as users and their Active Directory accounts will be also considered orphaned. +Be careful if your HR system doesn’t contain/export former employees data; in such situation you will not have the former employees in midPoint as users and their Active Directory accounts will be also considered orphaned. + -If you are absolutely sure the accounts should be deactivated, you do not need to mark them and leave them to their (later) fate. +If you’re absolutely sure the accounts should be deactivated, you don’t need to mark them and leave them to their (later) fate. . *Orphaned accounts of unclear origin*: -Review the list of orphaned accounts (the accounts in Active Directory not having an owner in midPoint which should mean they are not related to HR data on which midPoint data is based) one by one and make sure these are _not_ system accounts (see the _System (service) accounts_ category). +Review the list of orphaned accounts (the accounts in Active Directory not having an owner in midPoint which should mean they aren’t related to HR data on which midPoint data is based) one by one and make sure these aren’t_ system accounts (see the _System (service) accounts_ category). + xref:/midpoint/reference/concepts/mark/[_Mark_ the undesired ones as Decommission later] to be deactivated eventually (but not yet). @@ -240,7 +288,7 @@ For all accounts that are crucial for Active Directory, we need a different deci xref:/midpoint/reference/concepts/mark/[_Mark_ the system accounts as Protected in midPoint] to keep track of them, but ignore them otherwise by midPoint. . *Accounts unmatched because of data inconsistencies.* -Review the rest of accounts which have not been matched or decided in the previous steps. +Review the rest of accounts which haven’t been matched or decided in the previous steps. This is the time to take care of the Smiths, Johnsons and Browns if no reasonably unique attribute could have been used for their correlation. If possible, update your correlation configuration to use more attributes to find matching users (e.g. Given name, Family name, Location, ...). + @@ -251,20 +299,20 @@ Or you can mark specific accounts as "Correlate later" to ignore them now and re If you did the previous steps well, there should be just a handful of them. + Sometimes there are several accounts (or groups of accounts) which need to be reviewed in more detail and remedied. -To avoid getting stuck in this phase, you may simply mark these accounts for later review ("Do not touch") and ignore any provisioning for them fow now. +To avoid getting stuck in this phase, you may simply mark these accounts for later review ("Don’t touch") and ignore any provisioning for them fow now. (This is actually similar to the concepts of protected accounts, but having a different mark allows us to differentiate the accounts. We want them marked only temporarily, and they will be reported.) TIP: We recommend to *review the accounts marked in previous iterations* to avoid a constant increase of their numbers. -After you have finished marking of your accounts, you can run the simulated _reconciliation_ task with _Development_ configuration again. -Your marked accounts should not be reported to be deactivated anymore. -Orphaned accounts which are not marked should be still reported as to be deactivated. +After you’ve finished marking of your accounts, you can run the simulated _reconciliation_ task with _Development_ configuration again. +Your marked accounts shouldn’t be reported to be deactivated anymore. +Orphaned accounts which aren’t marked should be still reported as to be deactivated. Switch the resource, object type configuration and all synchronization actions except for `Unmatched` situation to `Active` lifecycle state. Switch the synchronization action for `Unmatched` situation to `Draft` lifecycle state (to keep the reaction temporarily disabled), and: . Run the simulated _reconciliation_ task on AD resource using _Production_ configuration. -. Then have a look at the simulation results in midPoint GUI (interactively). Orphaned accounts should not be touched anymore - we will resolve them later, the synchronization configuration for them won't be used now (just in simulations). +. Then have a look at the simulation results in midPoint GUI (interactively). Orphaned accounts shouldn’t be touched anymore - we will resolve them later, the synchronization configuration for them won't be used now (just in simulations). Correlate the majority of your accounts now: @@ -273,8 +321,8 @@ Correlate the majority of your accounts now: . Majority of your accounts should be linked to their midPoint owners. -Of course, you are doing this for the first time. -Chances are that you have not got all your configuration exactly right at the first try. +Of course, you’re doing this for the first time. +Chances are that you haven’t got all your configuration exactly right at the first try. You may even need to update your HR resource configuration (e.g. if you forgot to import employee number) and reimport HR data. Therefore, we assume you will work in iterations. Simulations will guide you all the way. @@ -346,7 +394,7 @@ video::suo775ym_PE[youtube,title="Step 6.1: Clean Up Orphaned Accounts",start="2 You are ready for clean up procedure: . re-configure synchronization action for `Unmatched` situation: set it to `Active` lifecycle state. -. run _reconciliation_ task with Active Directory with _Production_ configuration to see what would happen one last time. If the simulation results correspond to what you have seen earlier with _Development_ configuration, continue. +. run _reconciliation_ task with Active Directory with _Production_ configuration to see what would happen one last time. If the simulation results correspond to what you’ve seen earlier with _Development_ configuration, continue. . run _reconciliation_ task with Active Directory . unmarked orphaned accounts should be deactivated . additionally, the policy for orphaned accounts is set from now on, but the marked accounts will not be harmed. @@ -357,7 +405,7 @@ You can see this step in action in the First Steps Methodology webinar video: video::suo775ym_PE[youtube,title="Step 6.2: Correlation with Operator Confirmation",start="2833"] -You should periodically review your xref:/midpoint/reference/concepts/mark/[marked accounts], especially those "temporary" states such as "To be decommissioned", "Do not update" and "Correlate later". +You should periodically review your xref:/midpoint/reference/concepts/mark/[marked accounts], especially those "temporary" states such as "To be decommissioned", "Don’t update" and "Correlate later". You should also periodically run reconciliation task with your Active Directory to detect and deactivate any future orphaned accounts. Unmarking those accounts and running _reconciliation_ task with Active Directory will remove them. @@ -374,7 +422,7 @@ Simply speaking: you may think that your data is good, but it is not. == Prepare Active Directory for Provisioning Before turning on automation, we need to ensure the provisioning configuration for Active Directory resource is correct. -Especially if you are preparing the configuration in iterations, you need to make sure you are going right direction. +Especially if you’re preparing the configuration in iterations, you need to make sure you’re going right direction. Simulations will guide you all the way. .Please refer to the following documentation: @@ -426,7 +474,7 @@ Then you can start your simulations: .. escalate the situation to let someone help (or decide) . Repeat the process until all simulated changes make sense and can be executed for real -*When all the inconsistencies are resolved, you are prepared.* +*When all the inconsistencies are resolved, you’re prepared.* You can turn on the provisioning: . Set all required outbound mappings including the mappings for activation and credentials to `Active` lifecycle state @@ -437,7 +485,7 @@ You can turn on the provisioning: Your Active Directory resource is now configured. Data inconsistency has been fixed. Policy is defined, applied and will be followed from now on. -There is no automation between HR and midPoint yet, but we are already prepared for it. +There is no automation between HR and midPoint yet, but we’re already prepared for it. .Simulation notes [NOTE] diff --git a/midpoint/methodology/first-steps/index.adoc b/midpoint/methodology/first-steps/index.adoc index c7386ab0a..3c9869eeb 100644 --- a/midpoint/methodology/first-steps/index.adoc +++ b/midpoint/methodology/first-steps/index.adoc @@ -12,7 +12,7 @@ Start with a series of *small steps that will deliver value early on*, and then The steps in this cycle consist of connecting new systems, cleaning up the data, and automating the processes. Each step should take a few months at most. This allows for manageable effort and reasonable budget allocation. -While learning to use midPoint, you can *feel safe thanks to xref:midpoint/reference/simulation/[simulations]*. +While learning to use midPoint, you can *feel safe thanks to xref:/midpoint/reference/simulation/[simulations]*. Before making any changes that could potentially damage your data, you can test them to see if you get the expected results. However, no matter how safe midPoint is, it's still a good idea to *back up your data regularly*. From 0e38ba38d7cdf612c1f879dae46c59fc2fd3644b Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 10 Mar 2025 10:01:32 +0100 Subject: [PATCH 004/183] Polish language and content --- .../manage-resources/create-resource.adoc | 48 +++++++++++-------- 1 file changed, 28 insertions(+), 20 deletions(-) diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/guides/manage-resources/create-resource.adoc index 82764df97..b0b290dd5 100644 --- a/midpoint/guides/manage-resources/create-resource.adoc +++ b/midpoint/guides/manage-resources/create-resource.adoc @@ -4,42 +4,49 @@ :page-toc: top :experimental: -Every system you want to connect to midPoint is represented as a resource in midPoint. To connect a system, you need to create a resource for it first. This guide shows you how to create a new resource in midPoint and configure to access the resource. +Every system you want to connect to midPoint is represented as a resource in midPoint. +To connect a system, you need to create a resource for it first. +This guide shows you how to create a new resource in midPoint and configure to access the resource. -In this guide, we assume you have no templates from which to create a resource. +In this guide, we assume you don't have any templates from which to create a resource. -To start simple, you'll learn how to connect a CSV resource. That is, to read data from a CSV file saved in the midPoint home directory. - -== Create new resource +== Create New Resource . In Administration > Resources, click *New Resource*. . Click *From Scratch*. -. Select a connector. To read a CSV file, use *CsvConnector*. +. Select a connector. + For example, to read a CSV file, use the *CsvConnector*. Now, you'll configure the resource on several screens. === 1. Basic Information -. Type *Name* and *Description* of the resource. For example, +. Type *Name* and *Description* of the resource. + For example, * Name: _HRIS_ * Description: _CSV exports from the HR system_ . Keep the *Lifecycle state* as _Proposed_. === 2. Establish a Connection -For CSV connector, the only configuration is a path to the source CSV file. +Now, you need to provide information on how to connect to the resource. + +In case of the CSV connector, the only configuration required is a path to the source CSV file. The exact path depends on your midPoint instance configuration as defined in `docker-compose.yml`. -Look for the `volumes:` configuration to figure you the right path to use here. +Look for the `volumes:` configuration to figure out the right path to use here. + It could be, for example: * `/opt/midpoint/var/resources/export.csv` -* `/home/myname/midpoint-tests/midpoint_home/hrexport.csv` + +For remote resources such as LDAP servers, the configuration is more complex. +Refer to the documentation of the particular connector you're using. [TIP] -- -MidPoint validates the path when you try to get to the next step, ie., _Discovery_. -If the path is OK, it lets you proceed. -If it's not OK, midPoint will tell you and won't let you go on. +MidPoint validates the configuration before you can get to the next step. +If the configuration is correct, you can proceed. +If midPoint can't connect to the resource, it'll tell you and won't let you continue. -- === 3. MidPoint Discovery @@ -47,13 +54,11 @@ If it's not OK, midPoint will tell you and won't let you go on. Use this screen to tell midPoint about your data structure. Refer to the information tooltip icons to learn about the purpose of the individual fields. -In the case of CSV, make sure you set the delimiter and quotes right. - -Importantly, you need to select a *name of the unique attribute*, .ie., an attribute that uniquely identifies each entry in your database. +Importantly and regardless of the resource type, you need to select a *name of the unique attribute*, i.e., an attribute that uniquely identifies each entry in your database. Conveniently, midPoint suggests the field names so that you don't need to type them manually. -.Automatic suggestion of fields discovered in the resource +.Automatic suggestion of the available attributes discovered in the resource. Here, they're columns in a CSV. image::create-resource-select-unique-attribute.webp[Discovered fields selector] === 4. Schema of Object Types @@ -66,9 +71,12 @@ Otherwise, you need to extend the schema or create a custom one. Refer to the xr Click *Create Resource* to finish the configuration. -== What's next? +== Next Steps With the resource created, there are two things to do next: -. Preview the resource data. Use this to confirm midPoint gets from the resource the data correctly. -. Configure object types. You need to do this to tell midPoint what the objects in the resource contain and how to work with them. +. Preview the resource data. + Use this to confirm midPoint gets from the resource the data correctly. + +. Configure object types. + You need to do this to tell midPoint what the objects in the resource contain and how to work with them. From 77566cc4544142a8cb8566379234c4af745b82c7 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 10 Mar 2025 22:27:01 +0100 Subject: [PATCH 005/183] Adjust header; add more specific guiding points to the Next steps; --- .../guides/manage-resources/create-resource.adoc | 14 +++++++++----- .../first-steps/{assessment.adoc => connect.adoc} | 0 2 files changed, 9 insertions(+), 5 deletions(-) rename midpoint/methodology/first-steps/{assessment.adoc => connect.adoc} (100%) diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/guides/manage-resources/create-resource.adoc index b0b290dd5..ad70e1f86 100644 --- a/midpoint/guides/manage-resources/create-resource.adoc +++ b/midpoint/guides/manage-resources/create-resource.adoc @@ -1,8 +1,7 @@ = Create a New Resource in MidPoint :page-nav-title: 'Create New Resource' -:page-display-order: 110 +:page-display-order: 10 :page-toc: top -:experimental: Every system you want to connect to midPoint is represented as a resource in midPoint. To connect a system, you need to create a resource for it first. @@ -75,8 +74,13 @@ Click *Create Resource* to finish the configuration. With the resource created, there are two things to do next: -. Preview the resource data. - Use this to confirm midPoint gets from the resource the data correctly. +. *Preview the resource data*. + Use this to confirm midPoint gets from the resource the data correctly. + + If you need to access the resource configuration later: + .. Go to Administration > Resources > All resources. + .. Select the resource + .. Use the resource-specific left-side navigation to find the configuration options: + *** *Basic*, *Connector configuration*, and *Resource objects* will interest you the most in the beginning. -. Configure object types. +. xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[*Configure object types*]. You need to do this to tell midPoint what the objects in the resource contain and how to work with them. diff --git a/midpoint/methodology/first-steps/assessment.adoc b/midpoint/methodology/first-steps/connect.adoc similarity index 100% rename from midpoint/methodology/first-steps/assessment.adoc rename to midpoint/methodology/first-steps/connect.adoc From 31d9ce44bbc7739ca536a069dda6ba84d9f09d8f Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 10 Mar 2025 22:28:12 +0100 Subject: [PATCH 006/183] Polish with the help of an LLM --- .../methodology/first-steps/kick-off.adoc | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/midpoint/methodology/first-steps/kick-off.adoc b/midpoint/methodology/first-steps/kick-off.adoc index f475d2d88..524688b02 100644 --- a/midpoint/methodology/first-steps/kick-off.adoc +++ b/midpoint/methodology/first-steps/kick-off.adoc @@ -56,32 +56,41 @@ The sooner you find the answers, the faster your progress will be. === What Are Your Data Sources? -Data source is a system you can consider authoritative and from which you can pull data _into_ midPoint. +A data source is a system you can consider authoritative and from which you can pull data _into_ midPoint. -You probably have many systems with identity data, yet only some of them can be considered authoritative. -The HR system is likely your first choice here because its data usually _is_ correct and authoritative. +You probably have many systems with identity data, but only some can be considered authoritative. +The HR system is likely your first choice because its data usually _is_ correct and authoritative. [CAUTION] -- *Do you have other reliable source systems?* If so, could their data be in conflict? -For example, one system might say that an employee's name is "John", while another system says it is "Johannes". + +For example, one system might say that an employee's name is "John," while another system says it is "Johannes." + In that case, which system do you trust? -- ==== Questions Regarding Data Handling * How do you add records about new employees? + * What happens with data on former employees? - ** Are the records deleted? Or do you keep them marked as inactive? Or maybe you only set a lay-off date? + ** Are the records deleted? + ** Do you keep them marked as inactive? + ** Or do you only set a layoff date? + * What's the unique identifier of each HR record? - Is it guaranteed to be unique? - Do all your systems share the identifier? + ** Is it guaranteed to be unique? + ** Do all your systems share the identifier? + * What happens if a former employee comes back to the organization? -Do you start over with a new ID or can you reuse the old records? +Do you start over with a new ID, or can you reuse the old records? + +Ask the HR department for some sample data to ensure the data formats will work for you. + +If you can, request a few sample data exports (like daily or weekly) to see trends in the data. -Ask the HR department for some sample data to make sure the data formats will work for you. -If you can, ask for a few sample data exports (like daily or weekly) to see the trends in the data. For example, if the exports include former employees, an approximate number of changes, etc. === What Data Targets Do You Need to Synchronize? From de461d7768b188db57395d5663238b239098d551 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 10 Mar 2025 22:30:02 +0100 Subject: [PATCH 007/183] Rename to more fitting name; add section on connecting the HR resource; prepare ground for importing users; --- midpoint/methodology/first-steps/connect.adoc | 50 +++++++++++++++++-- 1 file changed, 47 insertions(+), 3 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 67188ee1d..981aa77c2 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -13,7 +13,7 @@ You'll also get to know how consistent your data is across the systems. You can use the knowledge you gain to improve your plan based on _real_ data. -- -== Considerations before you connect the source system +== Considerations Before You Connect the Source System In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as Active Directory using LDAP. @@ -33,7 +33,7 @@ In reality, however, it's not so straightforward. These aren’t employees and therefore aren't in the HR system. That means an HR-based synchronization without proper planning would delete these potentially business-critical accounts. -Overal, when you integrate an IDM solution on top of existing account data, *you need to be vigilant*: +Overall, when you integrate an IDM solution on top of existing account data, *you need to be vigilant*: * You can't change *usernames* carelessly. Many systems in your organization may use them as the primary ID of the accounts. @@ -43,11 +43,55 @@ Overal, when you integrate an IDM solution on top of existing account data, *you * You have to keep *passwords* as they are. Otherwise, you'd lock people out of the systems across your organization. -== Connect the HR system +== Connect the HR System +You now know what to be careful about and what your nearest goals are. +Let's say that the way to get data out of your HR system is via a CSV export. +=== 1. Create a Resource for the HR System + +A CSV file can be a resource like any other. +To get users from CSV to midPoint, use the CSV Connector and configure it according to the structure of the CSV export. + +*Refer to the xref:/midpoint/guides/manage-resources/create-resource/[guide on connecting a resource to midPoint].* + +=== 2. Configure Resource Object Types + +The next step after connecting the CSV resource is to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[configure the resource object types]. +In your case, each resource object represents a user in the HR system. + +After saving the new resource object type, click *Preview data* to view what you're getting from the resource. + +=== 3. Filter Out Irrelevant HR Entries + +// This should be a separate short tutorial that elaborates a bit more on the topic. TBD + +When you preview the data, you may see some accounts that you don't want or need to manage using midPoint. + +These may be people who manage your office greenery or AC technicians—people who don't have any IT infrastructure accounts. +While their work is indispensable, they simply have no accounts to manage. + +. Find a common pattern these entries in the HR system have. + + It may be that their employee numbers start with a different digit or their employment type is different from others… + +. Go back to the resource object type configuration. + +. In the *Specify the resource data* screen, enter the *Filter* field. + +. Type a filter to exclude these accounts. + + For instance, if their `employeeNumber` starts with `8`, unlike anyone else's: `attributes/employeeNumber not startsWith "8"`. + +. Save the object and go back to the resource objects listing. + +. Click *Reclassify* at the bottom of the list and then confirm they no longer appear listed among the resource objects. + +Now, you're ready to import users from the HR system to midPoint. + +== Import users from the HR System + +// This is covered in [First Steps With MidPoint: Assessment - Evolveum Docs](https://docs.evolveum.com/midpoint/methodology/first-steps/assessment/) but we need this for GUI --- --- From 93a59726e65a792f3b6c4dc4f10ca858f5641e33 Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 11 Mar 2025 10:07:10 +0100 Subject: [PATCH 008/183] Polish wording --- .../guides/manage-resources/create-resource.adoc | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/guides/manage-resources/create-resource.adoc index ad70e1f86..b86300f2e 100644 --- a/midpoint/guides/manage-resources/create-resource.adoc +++ b/midpoint/guides/manage-resources/create-resource.adoc @@ -29,14 +29,11 @@ Now, you'll configure the resource on several screens. Now, you need to provide information on how to connect to the resource. -In case of the CSV connector, the only configuration required is a path to the source CSV file. +In the case of the CSV connector, the only configuration required is the path to the source CSV file. The exact path depends on your midPoint instance configuration as defined in `docker-compose.yml`. Look for the `volumes:` configuration to figure out the right path to use here. - -It could be, for example: - -* `/opt/midpoint/var/resources/export.csv` +It may be, for example, `/opt/midpoint/var/resources/export.csv`. For remote resources such as LDAP servers, the configuration is more complex. Refer to the documentation of the particular connector you're using. @@ -45,15 +42,15 @@ Refer to the documentation of the particular connector you're using. -- MidPoint validates the configuration before you can get to the next step. If the configuration is correct, you can proceed. -If midPoint can't connect to the resource, it'll tell you and won't let you continue. +If midPoint can't connect to the resource, it'll tell you so and won't let you continue. -- === 3. MidPoint Discovery Use this screen to tell midPoint about your data structure. -Refer to the information tooltip icons to learn about the purpose of the individual fields. +Refer to the information tooltip icons to learn about the purpose of each field. -Importantly and regardless of the resource type, you need to select a *name of the unique attribute*, i.e., an attribute that uniquely identifies each entry in your database. +Importantly and regardless of the resource type, you need to *select a name of the unique attribute*, i.e., an attribute that uniquely identifies each entry in your database. Conveniently, midPoint suggests the field names so that you don't need to type them manually. @@ -84,3 +81,5 @@ With the resource created, there are two things to do next: . xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[*Configure object types*]. You need to do this to tell midPoint what the objects in the resource contain and how to work with them. + +Once you configure the object type, you can import users from the resource to midPoint. \ No newline at end of file From 66baae4233a3942b08ca7a2499ebe1b0bf5ed011 Mon Sep 17 00:00:00 2001 From: dklement Date: Sun, 23 Mar 2025 18:50:41 +0100 Subject: [PATCH 009/183] scattered improvements to wording, linking, formatting all over the place --- .../manage-resources/create-resource.adoc | 19 ++++----- midpoint/methodology/first-steps/connect.adoc | 42 +++++++++++++------ 2 files changed, 38 insertions(+), 23 deletions(-) diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/guides/manage-resources/create-resource.adoc index b86300f2e..c7b6f9447 100644 --- a/midpoint/guides/manage-resources/create-resource.adoc +++ b/midpoint/guides/manage-resources/create-resource.adoc @@ -11,7 +11,7 @@ In this guide, we assume you don't have any templates from which to create a res == Create New Resource -. In Administration > Resources, click *New Resource*. +. In Resources, click *New Resource*. . Click *From Scratch*. . Select a connector. For example, to read a CSV file, use the *CsvConnector*. @@ -19,11 +19,11 @@ In this guide, we assume you don't have any templates from which to create a res Now, you'll configure the resource on several screens. === 1. Basic Information -. Type *Name* and *Description* of the resource. +. Type *Name* and *Description* of the resource. + For example, * Name: _HRIS_ * Description: _CSV exports from the HR system_ -. Keep the *Lifecycle state* as _Proposed_. +. Keep the *Lifecycle state* as _Proposed_ until you finish and test the configuration of the resource. === 2. Establish a Connection @@ -52,9 +52,7 @@ Refer to the information tooltip icons to learn about the purpose of each field. Importantly and regardless of the resource type, you need to *select a name of the unique attribute*, i.e., an attribute that uniquely identifies each entry in your database. -Conveniently, midPoint suggests the field names so that you don't need to type them manually. - -.Automatic suggestion of the available attributes discovered in the resource. Here, they're columns in a CSV. +.Conveniently, midPoint suggests the field names so that you don't need to type them manually. Here, they're columns found in a CSV file. image::create-resource-select-unique-attribute.webp[Discovered fields selector] === 4. Schema of Object Types @@ -74,12 +72,11 @@ With the resource created, there are two things to do next: . *Preview the resource data*. Use this to confirm midPoint gets from the resource the data correctly. + If you need to access the resource configuration later: - .. Go to Administration > Resources > All resources. - .. Select the resource - .. Use the resource-specific left-side navigation to find the configuration options: - *** *Basic*, *Connector configuration*, and *Resource objects* will interest you the most in the beginning. + .. In Resources > All resources, select the resource. + .. In the left-side resource navigation, these are the sections you'll use the most in the beginning: + + *Basic*, *Connector configuration*, and *Resource objects*. . xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[*Configure object types*]. You need to do this to tell midPoint what the objects in the resource contain and how to work with them. -Once you configure the object type, you can import users from the resource to midPoint. \ No newline at end of file +Once you configure the object type, you can import users from the resource to midPoint. diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 981aa77c2..fe03d8a5a 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -55,40 +55,58 @@ Let's say that the way to get data out of your HR system is via a CSV export. A CSV file can be a resource like any other. To get users from CSV to midPoint, use the CSV Connector and configure it according to the structure of the CSV export. -*Refer to the xref:/midpoint/guides/manage-resources/create-resource/[guide on connecting a resource to midPoint].* +*Use the xref:/midpoint/guides/manage-resources/create-resource/[guide on connecting a resource to midPoint] to help you with the configuration.* === 2. Configure Resource Object Types -The next step after connecting the CSV resource is to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[configure the resource object types]. +The next step after connecting the CSV resource is to configure the resource object types. In your case, each resource object represents a user in the HR system. -After saving the new resource object type, click *Preview data* to view what you're getting from the resource. +*Use this guide for xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[instructions on object type configuration].* + +After you save your object type, you can preview the resource data to see what you're getting from there. + +[#_get-back-to-config-wizard] +[TIP] +==== +If you close the resource wizard too soon, don't worry. You can get back to it any time: + +In *Resources* > *All resources* > , open the object type for editing via *Schema handling* > *Object types*. +==== === 3. Filter Out Irrelevant HR Entries // This should be a separate short tutorial that elaborates a bit more on the topic. TBD +// There's a hint on this at /midpoint/reference/master/admin-gui/resource-wizard/object-type/#specify-the-resource-data -When you preview the data, you may see some accounts that you don't want or need to manage using midPoint. +When you preview the resource objects, you may realize there are some accounts that you don't want or need to manage using midPoint. -These may be people who manage your office greenery or AC technicians—people who don't have any IT infrastructure accounts. -While their work is indispensable, they simply have no accounts to manage. +These may be AC technicians or people who manage your office greenery. +While their work is indispensable, they simply have no IT accounts to manage. -. Find a common pattern these entries in the HR system have. + - It may be that their employee numbers start with a different digit or their employment type is different from others… +To prevent these accounts from being imported to midPoint: -. Go back to the resource object type configuration. +. Find a common pattern these entries have in the HR system. + + It may be that their employee numbers start with a different digit or their employment type is different from others… -. In the *Specify the resource data* screen, enter the *Filter* field. +. link:#_get-back-to-config-wizard[Go back to the resource object type configuration] and select the *Basic* tile. -. Type a filter to exclude these accounts. + +. In the *Specify the resource data* screen, type a filtering condition to the *Filter* field.+ For instance, if their `employeeNumber` starts with `8`, unlike anyone else's: `attributes/employeeNumber not startsWith "8"`. -. Save the object and go back to the resource objects listing. +. Save the object and view the resource objects again. . Click *Reclassify* at the bottom of the list and then confirm they no longer appear listed among the resource objects. Now, you're ready to import users from the HR system to midPoint. +[TIP] +==== +Up until now, you didn't import anything to midPoint. +When you viewed the resource objects, you were looking at real data at the remote end of the connector (i.e., the CSV file). +That's why it's called preview and why it's important to preview the data before you import them to avoid needless clean-up maintenance later on. +==== + == Import users from the HR System // This is covered in [First Steps With MidPoint: Assessment - Evolveum Docs](https://docs.evolveum.com/midpoint/methodology/first-steps/assessment/) but we need this for GUI From 6c65dab7a8ef8b038d1a3cfd67dd427a67b1b33e Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 24 Mar 2025 09:59:14 +0100 Subject: [PATCH 010/183] Align with the Manual of Style, add reference to XML config guide, polish phrasing here and there --- .../manage-resources/create-resource.adoc | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/guides/manage-resources/create-resource.adoc index c7b6f9447..0f137c930 100644 --- a/midpoint/guides/manage-resources/create-resource.adoc +++ b/midpoint/guides/manage-resources/create-resource.adoc @@ -2,20 +2,27 @@ :page-nav-title: 'Create New Resource' :page-display-order: 10 :page-toc: top +:experimental: -Every system you want to connect to midPoint is represented as a resource in midPoint. +Every system you to connect to midPoint is represented as a resource in midPoint. To connect a system, you need to create a resource for it first. -This guide shows you how to create a new resource in midPoint and configure to access the resource. +This guide shows you how to create a new resource in midPoint via the web GUI and configure it to access the resource. -In this guide, we assume you don't have any templates from which to create a resource. +[NOTE] +==== +See xref:/midpoint/reference/resources/resource-configuration/[] for advanced configuration options and explanations outside the realm of GUI. +==== == Create New Resource -. In Resources, click *New Resource*. +. In *Resources*, select *New Resource*. . Click *From Scratch*. -. Select a connector. +. Select a connector. + For example, to read a CSV file, use the *CsvConnector*. +// TODO: Create a guide for templates in GUI and link it here. +Before you continue, you can have a look at xref:/midpoint/reference/resources/resource-configuration/inheritance/[] to learn about template configuration. + Now, you'll configure the resource on several screens. === 1. Basic Information @@ -30,9 +37,9 @@ Now, you'll configure the resource on several screens. Now, you need to provide information on how to connect to the resource. In the case of the CSV connector, the only configuration required is the path to the source CSV file. -The exact path depends on your midPoint instance configuration as defined in `docker-compose.yml`. +The exact path depends on your midPoint instance configuration. -Look for the `volumes:` configuration to figure out the right path to use here. +If you use Docker, open the `docker-compose.yml` and look for the `volumes:` configuration to figure out the right path to use here. It may be, for example, `/opt/midpoint/var/resources/export.csv`. For remote resources such as LDAP servers, the configuration is more complex. @@ -41,7 +48,6 @@ Refer to the documentation of the particular connector you're using. [TIP] -- MidPoint validates the configuration before you can get to the next step. -If the configuration is correct, you can proceed. If midPoint can't connect to the resource, it'll tell you so and won't let you continue. -- @@ -59,11 +65,11 @@ image::create-resource-select-unique-attribute.webp[Discovered fields selector] In the final screen, you select the schema of the object types that are in the resource. -If you're connecting an HR or similar resource where the objects are people (users), *use the pre-selected _AccountObjectClass_ schema*. +If you're connecting a resource with only one type of objects, such as users, *use the pre-selected _AccountObjectClass_ schema*. -Otherwise, you need to extend the schema or create a custom one. Refer to the xref:/midpoint/reference/resources/resource-schema/[resource schema documentation] for details. +In more advanced configurations, you may want to refer to xref:/midpoint/reference/resources/resource-schema/[] and xref:/midpoint/reference/resources/shadow/kind-intent-objectclass/#object-class[]. -Click *Create Resource* to finish the configuration. +Click btn:[Create Resource] to finish the configuration. == Next Steps From 03449473769360155485e1ba697aa208576df872 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 24 Mar 2025 09:59:47 +0100 Subject: [PATCH 011/183] move higher in the left-side navi, remove TOC --- midpoint/guides/manage-resources/index.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/midpoint/guides/manage-resources/index.adoc b/midpoint/guides/manage-resources/index.adoc index 24c60b13d..752feb53b 100644 --- a/midpoint/guides/manage-resources/index.adoc +++ b/midpoint/guides/manage-resources/index.adoc @@ -1,7 +1,7 @@ = Manage Resources in midPoint :page-nav-title: 'Manage Resources' -:page-display-order: 110 -:page-toc: top +:page-display-order: 10 +// :page-toc: top :experimental: // WIP - just a copypasta run thru AI @@ -15,4 +15,4 @@ To create, modify, or delete resources: You can sort the resource list by name by clicking on the table column header. If you click the same column again, you can select whether the sorting should be ascending or descending. -For more information, refer to the xref:/connectors/[Resource and Connector Reference] chapter. \ No newline at end of file +For more information, refer to the xref:/connectors/[Resource and Connector Reference] chapter. From 91df08bb9a47093a6248941535eae833eb54f777 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 24 Mar 2025 16:23:13 +0100 Subject: [PATCH 012/183] write basic guide for task creation via GUI; prepare section for more guides on tasks --- midpoint/guides/tasks/import-tasks.adoc | 58 +++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 midpoint/guides/tasks/import-tasks.adoc diff --git a/midpoint/guides/tasks/import-tasks.adoc b/midpoint/guides/tasks/import-tasks.adoc new file mode 100644 index 000000000..6f4dd3538 --- /dev/null +++ b/midpoint/guides/tasks/import-tasks.adoc @@ -0,0 +1,58 @@ += Import objects to midPoint with import tasks +:page-nav-title: 'Import tasks' +:page-display-order: 1 +:page-toc: top +:experimental: +:icons: font +:icon-set: fas + +Import tasks in midPoint are essential for synchronizing data from external resources into the midPoint system. +This article is here to guide you through creating import tasks, simulating their execution, and deploying them in a production environment. + +Import tasks are mostly useful when you connect a new resource to midPoint. +Especially if it's the first resource, you want to import the resource objects to create their respective focal objects and set the stage for later when you eventually reconcile data from various other resources. + +[NOTE] +==== +See xref:/midpoint/reference/tasks/[] for advanced configuration options and explanations outside the realm of GUI. +==== + +== Create an Import Task + +To create the simplest import task, you only need to: + +* Pick a resource from which to import object. +* Specify the kind and intent of the imported objects. +* Select the execution mode. + +Everything beyond that is optional. + +*You have two ways to create tasks:* + +* Open your resource from which you want to import via icon:database[] *Resources* > icon:database[] *All resources* and create the import task from there. +* Use the main task configuration in icon:tasks[] *Server tasks*. + +=== From the Corresponding Resource + +This is the most straighforward way to create tasks in general. + +. Open the resource from which you want to import via icon:database[] *Resources* > icon:database[] *All resources*. +. Select the icon:male[] btn:[Accounts] screen. +. Click icon:tasks[] btn:[Tasks] dropdown menu and select icon:plus-circle[] btn:[Create task]. +. Toggle the *Simulate task* switch to *on* and select *Import task*. +. Name the task and go through the wizard keeping the Resource, Kind, and Intent to defaults. +. Click icon:check[] btn:[Save & Run] or icon:save[] btn:[Save settings] based on whether you want to run the task immediately. + +=== Using the Main Task Configuration Section + +This way gives you full control over the settings of the task. + +. In icon:tasks[] *Server tasks* > icon:upload[] *Import tasks*, click icon:upload[role="green"] btn:[New import task]. +. In the form that appears, specify the basic parameters of the imported objects on the icon:briefcase[] *Work* screen: + ** *Resource*: Click btn:[Edit] to select the resource from which you want to import. + ** *Kind*: Select the appropriate kind based on what you've used for the objects in the resource. + ** *Intent*: Leave blank unless you use multiple intents on the same resource. +. Switch to the icon:gears[] *Execution* screen using the left-side menu: + ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* for real production import. + ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* for real product or leave undefined. +. Click icon:save[] btn:[Save]. From 0b444289bf0788a20800bf66e5811b7c62826382 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 24 Mar 2025 16:24:03 +0100 Subject: [PATCH 013/183] 2frame animation for import-preview of single account --- .../first-steps/import-preview.webp | Bin 0 -> 139528 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 midpoint/methodology/first-steps/import-preview.webp diff --git a/midpoint/methodology/first-steps/import-preview.webp b/midpoint/methodology/first-steps/import-preview.webp new file mode 100644 index 0000000000000000000000000000000000000000..b5043ada4abcc41c0aded432a3b7443bf23bf91c GIT binary patch literal 139528 zcmaHSbyOX}v*rbYOK=at-Ccq^T>Rqh?k>UI-QAtwPH=a32=4Admi*qHef!70tuyl7 z>iVj?s(a2%&6%qxDJBLW0tcvy3dyU;bE?4s008>W-31ch4*`%A7M9Ni|NIF6&$TkN zcKjj$09e~NIVg$?5vr+c5JDdVAOPq9L;x9pN8ixVPEcMR_|N+PEf0$TuzxLcbpL$) zzis|UEuxXJqagqQM)+wVU})#y^ojL8F}tgi-9McAiO~(s^o>4o(}vW@+UCV)Z9X-Q0L9OC zq5px8`yamiC(GcIWeza>WQYK40oDNh|L_6-=HS!jQ~o=*jwUS3|51S<2mt_)n;##y zWB>qk0s!z9`|Z>|3!ZkSKP|H<3`*XDocPf%7;2I`aa@hJd+psbA8!OXv2|H*%?<#}t__;#zuPJ5*^e`;hyZys@Egt^G=Ti;649Qd47xx|Gs)fru1QImLVu z(&K2Tx=k|Jn08NE&XmInsJbo56Zc3a*)JP3cy+`6HuR9N($Lf693DP%8(ERGS&i`$ zdp_Z7b=Gt2%}L%9>4#JS6f1E**6I#=j1i0Cjnw1WK<0H-?%Af6zf8(Nb!>^G6|9MD zYVmAei$0Y}#k2AbBXukrkIveUw|tlXwna~#x&SXa?f?XPCClNf+`(f^DA=ze#u|d5 z$q2HH8piNk!T}2bc&$Cb2=SgO0v7ARim@UJ#k9ZHzty;p7{wC>8z5FU;oi%GlZp6C z;P9!@K_}AgQS_?%{Cggo{TSz*1I(ph#m$8L;6vM2phcQ~tor2|glizVpkdp1gvx zzDJ+W?*8%_gLL{;IF_^cqX1} zJ-6CqozdC6`S(Z7ZomCzq!k{SKA6xh6>EN-t^I=%7BiN9SIIj@8b zv&s@lo+3v20e4HI2E}p3htruvKqyr>b0hZZ;-`a^Tgr=4A})g&_iLxagL#dllmeET zmY@Y#1dlDO*IsdcMgs%(5b{d%axjl0x0+a)q9YJ#u#}tdr$5DU>;`pWlw~}R;WyATGtSjV5c)szz%^tF%=DAMk>?^4-FaGb@m+R6!;X%P^&O;Y22BwrNfV&kJI$ zkGpAQWsyFCyD?#-s39wnT{>d{WKaDUK2=#oL)pa~Z=u1laEG6^MD_-ryNUkXsmXfH zq$oy@A}h;Vj?dScM_pV6BiTjD@=$F76h}MUB(s)gS@mYMCiZWHpWBbWEKSxtkL$}W z^pkm2=Q%`@FG0-20qWLxIO-N_i+0voD@}5bNDsINcGhbLkZ1L#Vjo0=@#jrxB*dun zF?ZCbKUL3GKYm}tIfQ6o)`}bKUR+%8*-t(7v*4<`e!T6wXMcS32%qjJFRueOxwOEO zr1?X_g-?I!{JEfCNNg$DL|vk$Lnz;aj$PQx`s4zyZR<1z=eFjs8c-8yE&;> zBr)XGa47E2n$1ddv+;GdEh*Hp%yV)rX|SnUKTC^tXn+3fR)dSC748hKxL2FL$GYf1 z-hCjiFeiRi`Zuzxf4lLdlhSY#03ccM;nPu|@3OTLv>}=D69!DvX@h8{sj9e9=k0?5 z9v{>%HBB>s>R%e0{Vr@kA{n>0S}@>Ehwu$pE}IVm%OxI(`(`*c{!b$BecsBE-h`b6 z`f&A1Pbpy%{n{E5+(LatA z2a#FKe}{$ESC%8Ch7SXr+0_#}TR^Tj#B#U%NiGJ~}Rs`AQ}$(r!e;6LD5c zJCu|f+90C@8wp3oryarYoXw`iss!SQLmc5FHiD(QgR-N6HG)-4Ygsrv3S+63X-Qo7 zdc~HU)`MQ|&hTTg+;|KD-28Ea%V9z#$;?CLNaN{89JQGBj)(;k&A*gO&2D8i%3A}g zWtOsVyveDU8--ZRYVs;3Y-H;2)6ggB8YIg*11Gs}AQ8%Bt4p(_oAvHh%90C*u_Z@` zP{d914WSlpbo>kEpzi5_Noh^i<2fP<=eVhaW^3$7J}!N=Z|E;_V98cA&W%m-Gi}*t z5E3~2{jSkJ6m{-Ce2UFpey{B?&c!C z^Jz5F%$4JpWBCeg7|U~_!<#MOr3TV0zzfv+NphkekT7-n@%)j}ms-qXM~*8IOzOLX zBCqvR;RIGR3v2f@^(M6`wo2cF%X7|Wjpi+PldhMMCkcOYt@Kb)=ioy0ArdqUG?Fsr z@mff#fi&x+?9*_M%%u)RR~+Gxxpt*If8?zI0m3rWAqEf$b|t-uv~zf=^Y46&5>hzpC!QUx0(+K`|WWP_kXJxowGb3IRgUo?o(I&xm1>TutfX}!j& zsS|PqvRIXmXXCAtxkWtqVSM|7YLzCWBAt!2Z{0p6Xt##eA}GhE`OCQ~*HrDRoawAt zy^_}#d*XayzCnn4JEfBrN9fSdQc~hycC+#pn3tdDL90Ll4|Il7Qxk%JMGanjE9HkM&UG)d-(gtV2fe<4Dg1$bUBL1ipv+RcHY zpvUkivhS;4E1L8>rm>uw+9YX#JJXmznmx>{KTQ11La3Pr&1GP5X0)C(n>RL8%-uIu zbDaZ|1cmsr0A@=vm@Go{R#MDIEu{ zaGAj|jO@y?^dE@9q3(mH#5Y#yC9j{YQ^lPjTNzQ}G3c+3)?RSq?KW|Q}>~>J4audhX#Re2kwxv8Mu@XuUUDP98)_U1y z{uU{q#<~8nM(Wmg2?d{(AVeo#0Y>=9sEK{^=mGyYxO~LDm0j#gMj)BdvKq}sBH#}S zZGsPINOao9>KPSd2@ExRL{Dp}!mvWo_(Gcs;X4oE9P!-I?~v};5m8-8ek`5`p}XjC zO5glrX|y1k_u`J-DWG_hJf!}<(W%1u1EeOAFY2Pso?R=QYexOYy)ND*U{oN=4&2M52XHTkme3|Gi6 zqeJzxn^PN^3a=$MzYtH(7D@0WQ2!KqJ+)Hg@oFCfSY4!rCB{8B z2Ad*j@Il|2MS8rtZ((hm;35*`OI6LdVH6O!gsc*)`s=-uV~a&&iY0L80Ca44G&8DBnUIx#GsS0e{=1M{wB{OrndBQ>W8VRmCwUY zzEmizVK_J@Xn?zZ_s}RqU51{7J@<6HBO|KjuHjO?A3Z)(#wGiUA-eIk3aQ};I2NM6 z04m$JCc%BbOVxKIH7SWUBF?Ya(*GDGA{JE$gS&L-xTy}Cn(9f&>W(2Ihq_{iWlEHk zCd!Y4Ej+RG$D=AQe$UEP=4hnDwoF}k(6@s{DJvf(^`v*J{pu1HdIamN2+o@xYL@vS zCMYBVbQ!HX)mhqOBE{Z(S6)9TS*FH5M?4W%qM1a*z^l+@)7AMZyMwIvR}!5d4^Z& zhn}5Kh9j?3j*x5&Ybt@1lZ+cm7$ zC~IJ|5diYE|{kw6UOQ5_$w8|N27WV4r1mxZ4kz&mYRV7C1DP6cj? z7qg~Usv7j&xnkep%_N`)0cWdZ9nG-XLs6UvZz?ebLZiiwO}x;+kV~^ll_dh>9f>^f z%O7cSPNV~w1xL=soq(4cLJAGO9_XxH!Qu(F3OZ@Crz`KpHkU$!yes-<4^E`Q(S{YK zNr4FNjdB(xhcug`Shyod&d)W9B|l-oQh1aD8&A5Y>^TckOyv0)xdgDggb^h|DfgHj z`qBA?81H-h(6j`(V#4t$o;va(?G>tWo;p9m`|~{}jFU>|f*uUoupj#U^FRp+S z?SXD~6~mu%%Q0T2%krhPU+?T6*pDZwLym3n5tD4_<6$=l)EKdnDzaxbuu^twC#Wxe zIZkYK;WvlYkB=!oaxxygOa^aPj(hkQ-rhu$rZf%pNX(nw`S;6lv}=>K$uF|=r^G*A zbd^6EuU04^oY(Z1uov1t?_Wb4I4hhb5&^Q=_xLq2xM4B&ynRTeGBNgV+ZV*~uY*$H zsb1d}F@NVMV)mV$PbM_qjgt{Bqw#e@rj2gZhy@2GbKsB1f=dcfB82%>hn> zGr@1@U|>UDX|5VpQ@yQ1p^DVV*|UXz!x1vCk+{gH#W!}IMv}t=+i>Ca*b@R@neYvo z<&DKoc+ZVIB)Sd%OaeowZWK5IxuRE5Jz5UrC`@HP-D4uj^MlbLY(Es2 z1QPvTDHnT`JKythhmx0|50&W@h_E~L?7fQj(PT&DY8^FXMmmfD-LwxIQUGyh9ic{s zx;Q1y0afWe9d?a6`Q$%0ebc=<*?;E6q;ocLH=OMz&#QZX!s+m6GTfIz6kImMA?#&g zz^gk9b85(qwEE|Z-eRWe+y!TPvi$h2i5Gq5ZXWcxZeS$8HNv^TW0qW@Yi-(i3FYuF)z{qoswx%ml$ zd=ml|*ijoHt&V`Ab$i2Ev975I>S?YI5wKNyGPS||4-B`(Sq{Y}bNVSK#XzM~+3QrQuI_qW$OA%ij z0$>jk=E=?e3V$188d@$cD3bW&Bu)B!WT9DYdKvffG0gO*h629~epUHu37eYDM(0st zt$4Gwih%8EMcvf?;lbSMD%v7rMQ1GqkP-T;K|0rXXe|>COz~W*!rc-9NMd2DHAq_!#Xq5 z4boUM{623+FsZ}bhErPoQ>p0LQ}=N`*r(OqevRj&IOn6Ji#O~2029G}*!v+-A;yOq ze9KZck!kI3%gOIVb^@9rkbF5Ux^% zbhp9)B_}!FMWE5oQbz4J4qK($Y^MX|^Tx1+;+YSe$0@-#GNW<#sIqThQdQfsT3DH#dNZTEPcKeJ)VakrF( zt@?8ZQ=32$73Gx8E2>h?l!>0bFkq<1HbJtUEfvO*L^OuRAfT0Za2`NhWujbQh^%*A z^Ya|00T{a=C@D-<*;e+`RT^c)gM>)*Es-^T!G6%=q4Ve~UM~w8Ll;iyZ!dH%4(MWe zMnjp3LbbQMd^FB~^M1=3oK{l%JTry0`1`$K$Sow2#QtNkYHeqBQFq}*Q7ziN>$?jW zO{M7lAV1~J>q-5Mxpm8-a(lnGEliN!Pnq@|ueW=w;Ps@6YtBkK)2Vc~tQ-PslxE$1 zV44FC?nI^fFkL)$&IePlYmt9dM4lISm`pLzAQR*C?uI zJ8&n@eNPgM=?a?@blz{fdj3h-&b0AHk+Qi>!N0DF@(vhAzpzvwzmsvyrq~TEv4rPE z(wybxa$qi{xrF_UR-0Yu1!^BJAqgEnRv*sIwJGwp?_**Ut8ma*_6_YV($xd`X4({D zB?iTWXzr(xkj*2l#7-&XB66kB-m%u#& z(t`>01GI}R%Bd?NXiZ3}B8zIU9+?z~Q+Zwti14vyS$2Q4Nr~5u2B1_&8`hy4;a##I zY*T2{(RC1HUAg_7eCrf-jY$siJ~?ZfWl5Wt1+3wk7&iuYE#+hwH$H?0#>J7oa%}c3 z%T5u|c5SRCRHBxI<{ZliRXI+7e7cuVrrepxU?-n78}6~aea7{IG5A|hs~=vV%o3L$ z%sMt&&jJxC?^9%8s9o9~At?XTg33aupOQbzEmsU}65E4eJMQ?FYfC%@JX;Rwi^VgH z5K&F83MS!A(U%0i6Dqf@F#VlF{=|S(+0hw>%&aJR9)~R)a^Qh-He9q`Ew@@mZkDJik`Ed z^`|$I`mjX$lP>}Bl_KB8VU2N0_GFb_MzNK9n8)W^h8Yc#-2L z2+Q_e7TvlgCAiyFvWMe}cXb7RM9C{GsTa!G(AOCPEU-a|UUerkXmmy8jr|D`;I&Td zUGSyDQtrW1ER+hdVkj$dz9JYG7shnW{z9bZi)UCcKm;k?SW!|^<*yS*6HPuCfX~|Y zjEr9wOEWa~Dk4N=0uI$rnuCv&=%AJt9IR#&af9Mpic%rKZl-nSLWuwwR+c)~Q$%Fr zHc1msSm4q;1!PtEUTUxlC^J=^;F!@#BY9zNNLiAM9Izzg{bGums>H+|h7y?- zsrZ%15j|LkOKb4Fn~gKmmyQTO?a=Z)zH1dYjs+dwafuzJ>tRTMIH6(HO@WnZhu6&v ze{2;8AMUNgU&;>Mc~6)nwG{A++VI~q+>o%c9zuRVIs^prpK;j_7sfpAPQ3mZGj`I6 z0sl>xFqOnRdCTgl1vcZhzl+-;e7@wf55-^VyXj>x)YWsYLxWcT`#pxQOj%O`IOY}> zzHgUTQliJ=he<&yBUQSrwhw1JXP60RmiiR*Wtrfl0z4KWVGjcS@}}|!1m1H4CU9PD z#O%sJ7rZYxonW-5Z5*Z$!789UUg&M$4o?;Jjt=^OK}Ym*aVs?$vu@}dYd@4KiDWPS<^MHHzM=&OE-wUixj4~ z^_ooIfS_w_M^whyXYo%0ZE+g}(0LanA9|Jt4?0cG>_u+Q=lEUvajRH0JxF-7Zn=qf z4&laW4mdDuZ|qKkcI6K#qGebYHi%~#IU_XF-$rqWM-Sr`wIex_#xLlUXfHFI&M1~l zRuvk2$dl_!X93+RO$iN>s{BPBO-we60bA+|@0MsKWGzoKt^+@;Wbm*;!j=4v*QKze z)@_^X8wgTa2!l{A4Edfn{%z%(^!d{Z=?s&)d>Ao4 zwOXDTE_Sfp4;4iD3*N%NS#o4|8&emcl-*tCr%4Lyb+lNjz!7p;<$$GHeCh2&F}EN{ zQ9sa$AO%~Yu zW`B=tD3=MZrLv(hv@Qb&tltE9FeIlV*6GKCxJx-|+=43~u_geIzdiN^{<~`|pLwUM zv}h6ta|wNGmwN4pQQx#83XgcD1_AZ`!W7h}vj-2%T#YFt*$)3hNy}_wQIa^Sida~Y zI8lzoll0&V&)9c1r~HLSIgZiFWs7G~7(;SDjDFx&qb5p_8i{Y?jGJUiR{%efm2BPlXW>9DC;5CMZ@X`pX9v~Ny~q$opNHb@W-{FdUL5^aqyUGOiW6x zq3K>J?wDK$n4CQn8jmw30|k?!sw6qAy{f4t@FF64;tKw`SpcwQGvlY zqj+^+!&U#UZ`!=tNoB z>O6N*7hGsKFedsZj*@|#4Es&;v=P39`17#5>UEMsxE|IHWzE#TR@Sqm)(x;OFtU@{^c*$cl}|lMVu#x zdsl!K#(s6%OdjrCM(9bYQhy@N4e=z%dY|*tK>o8tTUJx;aLyt}EW`12BTmt=_=py< zlA0BywS~33woD{1eHI^hvN^kiQ}`S0KPn!aZ;_Mm^m06TaXu%Vgm#YT(vSY5Yc(+( zE5@hj>_$-ODwmUQRB)fSblok~xWZC|b@VY~%;3q1p(KFftrMlj`0GGY(j#>8Uat_6 zzWqb>^-HB=wuM(;W0s<<4c@7@8MN8SFJ%tr#7Cz4&2_HkA2~9s3x?~R$0f_vO)iyl z!OMw-0nU~HV-l&c90gM-QtB*4d)}d<3}wZkZ@wCGX(boC(=rQHCg98c<`7|N&FXcs z2zXRo4D`m-gE03(tyVXauVv0MZCATFldMGIaR@kO;b(OXeZqNP)m;|QoR3dro#cX9 zW-L@T(n7uO00gG_Dms;roY``gX;!*Ys%fh+%Vts6PL?&(#;ZrP#3u${gT{+V_bgI@ zG7;eZ@r*?QvC2%X#R?NAvj~dI{jxi_QL56Qg41~*QD@?8<8OsNG45rW{JXt+?`t#B zi2Jd_$M<7ciRs)5Q44bC90 z378u&@TfR9!YFmGn&gR17MAW_045&b=ou~}E4_TL5xG4Ug{3mDNzJOd%{cT<8QI}& zZDt^-GSt=)pd}SiMvI5*{6f@0Q=oX)kn;QYH+hcZtX6!%%wmF?n1Y~ImZSK1&)F>! z*;rEzDINAgtv~v`7EQTiK%m&f>uoYOfeYCcB)_>G@)jiI&XUpdC+^}u(HRO>AV zXDYwhtFW1w862EzbJqPTV`3~}LI=68`!OZBeb3BHe_KU#2dFy6w$ej4|F}&qJuaxt z8rTm~Ik%6X#bRj`P_=s^=awvR*EG;JU8KIX~m$=S_~6xK#IEHGSPF zDvhtJzcECQ*sVA;|M}x+6*39|B?+|ZLst>h8c@u{akb%2rA#Jr1zU~RInRNHB2yb8 zM5Wu-WSMO@ScHV7;5ryv0`J59(hnTBkuhN7GC!L$-o-h@KIWw9tlhs<)9pqo&G+{B zVqe}?>fs=I%YZuTXf~Vecx0|Y`AeRq4Xj&-vD6`-bqic2B5!v_u|3J>nz*MXTk=9Z zZez0iyT7c<13V)`+JonGV~P14bpDm_%TnxvGOVYQ)`+S`A-Xq|6GOB#6z@5x_;cDi_CkH`(wf}icPN7f;+#%ci zwSPz8ldYj~oD4WLm6oMcmVTR_O;amGF9SP_H-dUBEX; zxLk9cW>%$=5;p@L6B$q#u7l~ObWzM|x-6I`*Dk6{ssIgis6SA%a0le6Vz$Yf+Kzcg z7O`MGa@Q9>FY^nPOHPx9Ag9MSE=qwzTldT4Y`BbFIW)R~ZMsYSc;t1W;Mu}*qUsj| zh|`nynPVL=DYt-QWb3YOG6m8b~_;~T9b#L6h9*n;T!nZ@ND zDf?SlQu~EBV3+J{mz(o8KA3+?sh>!h*<#!^99qLyr<5>9W2Gk6@v=2e@~*N(ND~y} zeL)3`&Wf1fYZd!`sIA!r8hIzzHH!ql9ccsVa7`KyGk4pmk`*CkGF4*Z!$0`mGkK2! z)b(%c=JhP*m0N(V%AS=2ZV6TKMNM@GgubTo1}tA5(T%}J)M#;r(a#0(g^}w4-Qjq? z?H-~(JgQ!eE@0*EX->IDr4Hfa(-d1&xW0zuHJN|`7!k{7j#M%~IvEEARWnl0H^MGl zO98U&p?N}+wFqqsKe5${wWwNnPSCDY=oj*+T^$#eW?PAeG)MM%qQs&y-_6M>ouOit zxem(V2#Wct|AI1V;3vODbz6lAR#enPd4?y$ezj1g-x40t>eGyJ9$2H6H_4Iv<`>VM z>cuao5D3KV+YK54fiY)9&~|!ef-o2~#WoUqCYe+LSE>BGmjhfQbrg-lHHHLB6Ebvk z1s)e4+usz82mS*SPwHIkE%B2{;sVXryZ=NFLl(n)Ot@;_q!RC$ev8AwbTCBs3ov$!+o;jNdK+M@7Tw@zQ=ap2ey*YaSlH)(&Av}~cKCkW*?3B? zoC&y~d%in1mB3Qdg8*=CyWxqHf?M zHi=hB^AsnYnECf*{b!4(l7j_r8raF?H@)^HEs&w4RW6^$BrkvSMrMY$l8-2!%Pu5{ zW};yxGJ*k+UqRi(G#!gguUWWqLE}^yXl@nv5CC5QVdUQh3caRdjaU>Xi2VE#?ZY1y z%Vl?o>|Qvu>bygv9Rk@bgNs>DV+jP(V*6e3UdRAnSyIhKRRF*jp^4M?192x6Pw-Ag z5T-Vn)KfrluA<3p4Qx8=LHg@9lo5!)a^JeTB{^X-k#)l}o!-m85Z854bDZ@`4<6+1 z58;)~m_J$!CR=3c{kXRl=^ z=jH_Xg0Ym_DlCM#*=;0UzyaL184&H+LWJ=3d@bZqp*eO??v{@gQ%N6=m0nAkx*kBRfMdB0pmF9|m@X=$%w))OF*l_LEawiSpSXf?TZdhL z`np}aG~;#j=ytLdMZhcI0QuH-b%MJielc3oKaxPeGI>y2Ti}D|(bRjmrs4`dY)P;! z4>0qO`6gF?N+HwLBH~EU&2Tgln!DFa0)lZ!VfI{~nxyZTtPcCZWAlKUr#O7K_C28$ zJ*oI%j<yK@S|o>ZbqqKtjGYc|G|dQY7mhQjxrG>`e7O^$_~Gqmcbo9i~> z_m}p6JAGKE!#rQivF@$ONhMoGM?ggd?$&mwL~+GodF0xm0;t1kzAXnqR8yeDs7DM1NwCeF*tT7&KICs*B$Yj6HMVQT zszaEQYlS{3D*ddQK(E6#q?&m_?XqCFMXecAl4kdoq8F4+a+y9%FDLfA{xaHtHK`<# zyO#!Ed(rTsgg}4TfgWg?p28SmpzKJ=tb950e4;$&j9O*}JU?OW@jy$XJ*=4L#I$eK z!)YPpUJxOu@DIDKj41LS#scm*xw{mpPF@zqu3JtKp*cv4`!86CPMyjWEEs?ydRa20 zQy6o!RAYJi_e2lL{(zW9*pk?9mCYUqJ(PbzO}W>mKCYXlk)_=Jh! z$ub^aoEK$sX3V~T=48ihk|7C)P-8R?yqc_}@HcyzWiaG2DfSCfVg7zu?`0%SbI7*h z#y&J9QEOc+L4FltJhy200RW)N=4ekdcMGk*e2EoIP=jOHOj*PLRI1bAjj+;nSRg)^ zoVrAU>EMs(Md2bhXw8s{pkevfk?V|*9@!}RVE`x%57;sRI;?zHF2h-{C=QMe6ZO1= z#5uSC2QU%bsJj)BBw2rWHbIj`3=rE0mmIjNu+chdMyj+5f=Iwg>?OW=%U zp4TVjfY>c?z;XlWl8fckHf4?pbZ}64rlRw%8_VBhM+c59%KS-gFf$JlNLE|XT_gh^ z4%vb!)&A76rx5?lQ37M`uVQd0d~!NS z3sCBvo|g_g>*NS0BRVn66vW8D0gOMKatnxp!yFS`1j`_k0 zz&gGDK~b>@Mp)f!aI!yf0tJ=2bZ(^1If%;ufIo51b?cy~hXpf#kwV{x<(FvL>w3}*#%Na_a$Ag65zexGy5!YkR+up#Vof(W~AM4JP?gq~M1 z`EFLM!PW{H2jSrV`c*=92(qXbe_I3-4Qk$+zhF530M1mgA8}q zclG)=^mxOa=r=P`$Mt$~p9&*h?}~k`np3bB{M~ol+^ZMTXnbyP#u~^|5_)YzK&aih z(=7aUrM@m8Hc$mY0R0qApe35Hr+M(C10uZ|d-Hx)a9)vdJVhF?EPjCG!7;VOCm>gC zk!E)h)uS+ei3IC=2!$FG^}vBnN+2|s9FDdSUe4t9{*xAdS{a1xkS_{A_)~a93_a2s z1eV|LA)N~A1*08;10jvU<3g21(O>aA)?+Gm-U4CQolfN=TGpM zbpUzrVGno+000k;f}C$lZAzDz0>d&pwe~54p;GBxCc_h#oiScY%Z$pLRU%`-1zT$CLf82HbZaP}>&C5TB4FMZp$mqVQX-9G-d z6Pr~Do0*1IK);Tlv?A2PYyVAGc%oo+loLzz&WyJv^#?0zFS?d3oQvtVKuXR_9Fx1% z@9B7e<65THW4<4c(q1sUH*2CT6O4IrA+dI>$^6B@`CRc56d8mqfrU9vzK~z3*zjEv z^P%kk7{?%X(_=9G%^fl8q8#w?MDW9t)qM^sjNp%6HdO<5#ECC)gf=52o$k)7>%!$7)b#_7| zU-Ja`5yrl|E;mOmYfR}4i<-`SJalhA@xM^M`Oo&r%b5j`p3Xra^b@}EzqGwR!n`M} zJq0IimK{agh_&zL*Bxr|ZWlT_qSnJLKM5ND?JBwD=)oTO3KhW|79RIXyRAldF{Yhz ziKtzCwkAww%eJrMF08-Pz*B9FwM$^GR-92=pOB+NPOp1sIBOh z`5uZrF@=C>8Xt^32EWs}?)PXb0nH`3pPPp{Mt!iL0k(- z^L-~H-zy%e+Q!+&lna50X0v0}$QjTfiC@`eR;y)Es?p-EU;(u(w31_A?M?)A8s>O0 zRGGm~*?k$7WmSbR|9GzFkIjo11Rf*;Hd-DCRt~LS>z=Kz$b$?pqm0#9#Uxdh<(b(~ zf6Edgch2`UKX;Y&m`xb;qIk+U0z4g69cvu|R$x&+YT4A@Gc_gNw@ z(+IsdMWG;$iI`Eu!bC<00qTi1#m~CL(0@s$O+nciRZogQm`!z&!-FviqklmF`JQcLnp5j|=V_MY##As5nYUi5v=Cxw zM5L#SWCV6s#z}4B`v!}(-397*5GT};*2NU>R}nmG7E{3Wsz`&N`H+?~`kuuB<>QDE zR-*vRii`uWlotOR6;c|DG+JO7l$GE>fvjJyq4sFOErM)E8#SwhC~F3vTSio%!Rn z`ih#EjAJxtM?v+Kon7}iIJ~jLX*8lRXu2_(y)Pp6S<2i*R9Ug(L4i_O*(Mq`>r+ko zO081L-AJ>>?RenRx0F?;Xw!6K}(+ zo$(M!lyz8L+4E=XdRPRSe0(k)p)S*3eUwCZcZQU%b zOPqQBHri`oA2NH~f9F|4dQ_38yNmU{P@5&i6UqL~>Ao%ku1hYdh!pRbXb7w_Y>6X^ z+bauIgrGW`L4=-mUeP_bvbpLXbCS+xnOda@&p-vyDSxT`#al^}MB)Xk&3sBTYq{ZC zL5^lh!0~PWO9acL-e0k`DS|&2_Bb5l8!D?YoOd!E<7Qk!A!Q%W`PdT=|&Q5=4L8HOwZ@+)6`E;aUOUR&aDDQI+lHCU@?zR$HQGam53rU%m z7>Kb5C1SQwUek7AeXGxE%qDllsZ#!7J1b8(A?AQrU0pL2 z9C+@Wt>{JJ9B))@6sywo#lScMx*i9tEXIhwEFk<;7|ks{gIjGM%>z}<@X2WM8-8?P z602iXaLN(MTlF_ZEw~ zbS>)Kpz920lfFvfD#(kRR-<&?6cOQJrpy9V=3AlSn-Q;>b4eAh{gMK7$4Q85b?Pe& z5*oNULNf$J*fiCMS5bpl0~?JGNHa)GscTshS$Ka?XLXL)g%y@2)-Tmd_k0T$AtTnM z6)e0U&uke+i?Z5TyfHIhdtn(=aDt7gO^gUA;fhP}W~#0UR2l`IkW{^dDS-B&?DZ*N zN-dFf{;o%Pg$aZcHA0hc5B|_Vk{<8c9yA+f>Kus>F9}bLZtb2YjxF3puZc|a z=rJCAnG@+W=byJkW(yO7J&&1PStibQNtoez6GuybG$zXp4ZJF_E z-XYgW+Wd#xfVhCFq6k4HIAapQgheRQY|*+--9o4)_<_xp_-lSgH_q6Elr0@}ToMAY zh`Ehx6-NRJh$d8nhJx7a=Z5=)kj$P@7X|JO3KK$rYv`A#QO55QX zGx_WN!8~4lxXH|)GMR`{oj(aRrxmB`2pt_y`TR)Qt_@~!XH>I*96&l5c~Gvx7B&d_J)&A~)53&nSI#@IkDA_x z8D)ZzU|ruO1|}aE+$^=)!?>ev&u46{i90>Ret5}QVEi;nKnhS+(H}R|Y8N)DhCng?oA;6Z?b8MC9(( zaJ^_fYCjw}7NxgT=vVEA!PUkT(cDxI(baXu^t1E{ciBr@U!hRo7* zh5;*MG6Rbr8XDnVp8MG%R@y7+-=oVJ2V#Rovf@KcmP|e`z7{6!5NWI6ZR&=2lQI*S z9T-I0qqHbm7uG(H23l)&gPtgtQN=@a$}IhKx3uXT=hqhmpH9#r{^`B z$~@)s@1~{)?ccJsEp!5vl*Lt@Bf`^!3-Tv$rmc~T^B2SvpT$@StFEmTEM(awb?!jG zy%hcp=7e@j>tGxPZxJU;9MiG43`DyUq^%M(8!^+bTu+Rk2u$-PW!c`|UgGgYt=eg! ze-oh`s%NEaLTVr`)<@4cQ)O{|o-HKeo;XUas0|k-ECISJA6$O#`S+VF{_ ztGwE!7XJ(0Kq0?$Ik?iSFGx8vbvq_E3q5-Sjw01XFh?+zzzl_%ITzLt-6lFLEI=08 z0#n0bsUMb#TW~Mlqu4A0i33H5E`$MLVdow#l;D`ut?Z!2A~n>zl9{b5tT{-L(L9Ms zo4qj_ZYEfnMvn0nMQC^{$vdsVYZPiYxw~jr0nUAJ!QTnWd>TkWE`{cD6MT*#Ey!P`>ydrG~TD0q^?9XgVdLKxU|2&7?*f* z%YpW@>M}$%v9;ziJ+oMG+>>jhbSLW4om5MW2hk7|Y-Dt=Tx&s@Bxs&QAPRnN!pvfT zXZ`=a^T4hQl^{>T&duH=Z6G7q}Dtsvj83V@<2lI=u)J~`? z7f6whxiK1W%%u|eTnZvIyp<#bO)CMYFX<%Un!RUtD)}^Br1Z&WeLPJWWil9Rpzxk)UV}B!o@dBXT#Ln3?wQJwc%5d+5fi(UoJZ>W zn#l+*7dz_1xP|SWl+#>>N##~Id!n?^n#|5fvva)R9_ZDG_?=)*(~GR7wp9%VQEGAJ z^%C2_gOVMN4*Kc*XtbZ6vZ}uS0jQEEKiB1!kw}Q5386D_+8R#No z%43O&?oM=(_S1xFw(m;rmAZV91VM$%sm9I}wRoBCS-;M;Bl6W{h`@5;*(k~*IlZh# zAW^vNjH$O%U5mMRl;p2)@0!|B?Q?yYK^j=m%3ef7u%zmR$W+AF?r}TKEXjLB^$Z^~ zC)pe!c7}4$sA*@m&#K7eh|c6$Mdl+gQNB#6MC2Pq8c^5qL~P<5*`ul4^_*HzE-n#hucx?7O6+zIM zckuLJ9t6x7)A8%Gled?P>EnAdwKWt-@A;n0WQ^1_a0O9Cy@W9Rz3>S_r*YBO$;u1d zY_lA0U4%qR;9Dc}EWM3d;~JX0^6j!X0r28m!rqw4$lc{he7nNz0|ZBT<@i5ot9Xylchvrm$n z^09N0%@JT{D341ys(k85G144W%+hWF$$WPlD3u9~7Oz&GY~nn71g7SolG*5+y5mjr z7LWREDdod{4%8I@DRQwlMgvYfsf1N(Wlj40OYo>}zb%Ml;rzv4;Z)}z?;VAUxGjj< zDv3HH*l}_hVMHmgUz%lIr14HqU{?J7cU(c_#13{nvk9J=b>$km|9;>0_}9W9GxqrU zHe{-c>lIs)bLsG#lE)U7P()ikGxbZ3jtmH|e73Pr=_1RBL^;h(vo`J)(sMr71(BR| zKPLLfs0lJaHaL0OF?6%Vi{#2z>Gvd>T`5+!Bo7@{qTU`#X@iph000KlA0||7%_NZr zT~`z7_599L0RaI+;0a37@$LL7E`~}kufB=@UW^|{_zsF(ay5}2gv54(0ylmjVl*#E z-qz^6N4%H2o6ik*K&L<1(x+Zco0T^lCeEi`tw4z*%g(i2>YeW{%2nc@nn+yvt$VM^ z!#|4TIK~<*3X;Y^QI^X{lj&}`*JbqlXD_>qmOp!$p)heS^UilK5c^3ZD?9L`gl=hM zpfN^fx22KT?il50`fn5eZQ{R8{Fm-OLj*H!6xS!me385fOTmvi0< z=R8(#g4#|pS{sH~RkWNmC7}mgg(fujGX16}xvWAl=O}=>vnuX5e|G)awcT#&4y+iz zR&O15bkc2taue@I0${pUs8L+9>Chy}I{Q_R*113l(8?m* z+;U?Nlxglrxb3tr$FNs2C;;;~T!JF-Dz&tOwR!hTq!E-Ti*PG}r4m{#!y3}X7F9Y;*;~u@qsH)Vz2k&I%2{xQnBQ$P9^E?cAT=(KRVW)t zcwIga&I&}MO^alJw{>`_$yTGq<1PeXl5>e(U6Yzl({)A-sm`~_ItR|atj!xdgT@3r zbIy};kPq<{PbnvB)B?8GC~Dle-BoL`yGIvF(9}YJmaqUVXF;P;9Kk}Vr)UnMLrpkr z%{y~XCz!NgfIUZm7~YM9m$RU$_5rJLft*5}cRUcy=!gG)+{0cN5LjD>ci(v7xTD`6 z&;?{uqEk15o#t9R3`45(ZHpn#ZLhSM7e9mlTd`xIF`8pA=pTepm)hBmeMa>fD3 zs|*p3?w*bR|huX4Ia*2Np75n3&B9wf8I$1r%EZ;5(+3%^yKL<9Obu-AVzdQXsi za#7PV(8T}zfOnq1HNpO;A%wQqJexhk+smO$BZ+HgH*Lz z$0MYU6U4W8p%@v6W=d+IrRK~JLYLx7M6=Y+I1qD|ke|?mqD)S%^`MN5DLD$961pSL zP@vU^yPBSd^Wu^+RuJWB?QVN@RM%bVy8?nr6)T+P7hoVW)~GSSLd~u$rNuWa$d6cF zgI*qsUO0PE4{edqZwE|g97xCHbljv|CUWB^?vlGAigX4ZQ9Y`EmtLMRD)?R_zkGF} zhMoyP4K9XD9%bU|D}q9^30k%|tznv(*;T4rNO4NJwtRM;N(V@5S0+SrLo z>NTjUcD)fZ%{XhWk)vSZN=gofv1AAY8{#B?y~7Z;%Hp#2`Vg*ljzFoQOqZI@O``PN?HIw>l~{{oe1BHB{R1<`#CNAM7$3^b^1ujb@LKb|l&)m`ba*%JAw4uBLW%=k~{oJks_fY)x%n670AzF?`r z09^i7^Ggz<#x8OZ07kB~_Bm*N4_|s98RJv+jTXTy%2xqcbX*C1N&%)FYBH;A*oy?P zs|x0+U$ivw6iug?{Kc%b<8m>k&uIbGY&0ZTW~2L;Zx zpT+xkR+rcf6Yu+T&?Fe4*aq?nd8_AAV~x91(;fV-aSw5|PT|!~3yU(8BJT(!31*i3 z2=sWb=si5AVRd6QB1nz>0ia> zo=g`Sr2D(pY(g{aO@bM9KLR~n0DxXPVDsY>M<82M#d^EM`qTYp5m7Qbr$>_@7TZ8h zA^P!c@tpagCj%Jm0RWHUeVHj!<4?O7yeA`^L<1Q!O%zdczdxQm9(+*`!qFp8&+P_0 z<2=Bqh8Uc*^2#z#$KS>0Q0D?EuI27)55V~Cm?5C%VW&R?vSjO%YOG=ZG6+@G-C-m9 zZ>Yh=_Gmpv)yu%DnO$RO2qPZt2NmkyZxGy~aINVk&^QTHR`TJIbLO@df#1386>!b3xM5zn2V`69q?gg+ej zN5@3-Hi-jSUwxUnQ*(Y~CVjNzSU#k zrEiF3aM~8gns4_9jVop{BUgIT$zn8GUN{O79aB7AC@Yb8BO_14F0iKwZZmhWZh!Wg zjDRQx=uH9<=;;Cg_R>K>lq4YA`O|@IKIp=p)&C}jCP6H=ft*4vvRxfBt#=_67j|E) z$-QMM#etMjW-HHW6V;&T$q<8voY9TCVvfMjXqIObZuP)>XB_y|HnA+%*8vb2;e30- zB?~n>mM?MMwIT0H59QVQq)U`jLi4Jz-xslnxofy~+{{9(e|Qj!oV19;6c@q=dzzr{ z6lL9@ZVvL6s8S~|>c&>!egt~DfHO)WHa|%tknIxH%Fg6AN<#PR1WkfmYy&xk2}U7i znWxq@Oz5X^E$(c_8mz+THfeEOmNK-?oNbnPTtr{}{CgO+!osqK7vGb#Wscs$Vnf~q zmiRcplc7`TFDz<^)2^%NB z)+b|q-{V2-_U^vdc-9gB(DFEV@xx>=&Q5ZcE!4}JZveDy78;SQ$bFo^$WC%=X(Gbz zGT&S!9?M`BDsB~dNmt7Qhn=j=OCA*m97KVEkt=PUEXv5mN>jRJ=%LmJTX{CZN#jwN z`}kLEykZKyMN-{dU0Z>4Ju-pqCCnevGPqbpe>IXaBl#^pp`FDcPSfGzns{4Gc#t zo_2FZvGR*aIYnR-jp#|q&P%%-!frA{>^exF+Oi3r=DiY2x*uB~H-^bG$G?1SPR57z%&kj zU92n_&d9itDxuP?<+88y`=4@D%*f;56pJgTbXqQo(>3d!5Ptt;M~y~9 zMu(|{7j;jn=4~a@d-{pX{a1O@kZIGk;Mu3b+ue$_tkwD?CY@^mAT_!b{>F%rJKQ~X zNm5CIY1*OjXtmDkRuAS-RbQtLTIv7S@>*nH-`dxa3@t{vF|uz9kjS!#1|qUI?i##@ zCRFpbqcy3?rl%cqT@DGM-K|*5TD?WKQhRF)fYj*LrRRSp7kR_=u}hLn@(DfH7i#IV zsRuUloFG8IICW2@r5$Ut}9o0?Oxijf>Y#R{*f1i{9)wPdt7v2V#Qfo@sm;G zpHR))?e^^rU?~zpyIb*=wMHf`EWI0;5ow<*c1hAnPIE(Vn$$aue5Z||KWU^rKhj4R zi-{FyT`;~BNY%XUW@{jU(C${GWvv8+Mz`*eS3U`_OOj5~`gENb+zYvs^}Vm&&QTFf zzYc12Q{sXP9~UE4^EO#$VoYWY!H@s|Sj$>*ghsd4!<`DSOHv?7lj|R+@p|NZ4&En6 zA_zz2RDgVvJ$biBsOIfJ1GfdRkladHy@c1a2( z2>`D?m8|bwq+2SS9Emz@Nw7Xeek?*YZ(aCED_MLJ?}Bafd||lMk|w4iw7V5=S?hI@ zP49F%08*n{Un}4oA-1_Rc1e;+ZvS8lx$wSSdEcA&zYO^~$u26g3GRbit%}Fnp@h0TpN@$5;Z`DV4@;qn5$;D9Tg$NTs6BZ8n31rP`nPod{iM45Up2ey@_*Ir_FC=ijp@%J`&l)+12FwM3>8<+ z?g-H&>u5yxmb~F-O@G_d+(}Hpd=ag)Sw)IY*eVG(F}3yp?lgdNAqjlq1`75W(gi+! zI=})8#GXK>3*2XVi#4`?pyoS*M9Xb!y8{KG1r``UNGDxDX5AL!9PwI`H(X8<+?!spaWOdCah<>SYB_|8zzLH=7w_R;JEe`d<1})l0p$K4?N8h7E~{-tdrSh zQCu!KOmyvVbtCYJ8;E3qTO9KinS+1$1p$pAd6F|G%LacJ#OI6%i>@qzM~=4u-HTe8 zjDcqFzF*mke!EwKgv#f+#VwAR9$*?V(+H|O%w^N@+1ht#0^9|C~?|# z-2mC)&(z-H7Q21~vWfp%#LvAtEP4yD_bZQ{I_yQgOvXU67-Q+!!`wCuz?TVVjIj4E znPJh5*O0u+t%=}YIu3#`aRZT$PMmxVfIqR=86d*Fr}rTGgaH;6{CR#(E`ry2#I#^9 zYGyJ9dIH&tCs2avzYPEwha65kTa$x6;x`n*5-ArT`}6*H1YzO^BCC8lW+~G)-#h{U zBvCT2$!ANq-c2#njSu)PPXh>8U-^^vq9-O}AbFKnd36AQ^+2nz>oIAdScc2SoEr%mga--w1 z4;&8s`W~|^k7T?H;Ds8dw=3T}bp2}I{*#=K?PV-4f+*LpgD7kDt#x`6s zYfFdH>c%%zm<{B_YF#awysTOj{HVKH(psHOU~*2AN*GvDFN1SuCD#mz^po~j6__`~ z7!!qFwb!NGbHRy(kdpcuz8t*teQ71sj1@JeTDv=P!Y*T3Hh$7}Dnf`x5=@!gQ*54u zDHJ)HrIvKg9;k~V#t2zAD=^03RvrqeMd9OjH920(^UBopaFnl3C(%>OYISfXEcG?c z);}|rF2M9LRknAS+a1?7g9RllsF0MB1zF>v8Oy2>2}dT7iV7-zs+%=8HP+?38%Lmr zBY535YVz1jP^W`4A&)XXO#d8=B@+Lc4_f^FH>ql0i0`Z2OWR&h+>lT_NPoX@4Rgiw zY(9EqvHP|;d_JV{6_pu%a4C?wQ|qLesoNCvbks3b;1b7X zf?6G%2`T%^n0gvll^qWXHmAz(*k*W|hWU)hLaNBK<3gHE3v3vhq>K5}aGrJr*095o zLw3^+azVop13`W&K3aW0M8^*KEpvx&p|6KXs79s1z z4$>Z`y@N2rQ+=%jx-fW#SiT2i^+A+o45Yum;AA#H|HWo}|6PYsn-$X6`t``H$h=~$7GQ&ot6>3NERQ0xKD8XjThN@7syUQW z+SuI!Zz&dCUmL>^4BdjOLr5ao=p}sG_Y8)5O)y7%f!96PlD7Yb}sh?Y9qu{Cc~^B_bl)DaI@6-PYIeXou^3 z8w?Nm7>j>R*x8_qN(*}dFsh7)}8h4bsyN^)0HeNac zBneUZD5iIBbN0};@z@s)WojatIzBD+^pyWVj>+B7bo9hz4DP^BaRCMNrrg85a|ga^8D-Ez5kK4H zm`Jwe)?FrMukw|J6tiLxk%xvoda#BAwhW-n)=a+uN9%QIqS{P?dh5IcaL$$?Ot{_w zpsAZfps3*O@VSK+ptRY$u_#G3s|3l?%ZPx4v6tr1Bt-prscr%QxVE?;n%V4|DFBG+ z=%vXRsPk4$74X`))DxZ6u@yZZKeTG^cVizkM9qY&*JFt_O;N>}6a(X!)%D^whcGo_ zxJ(_lUgFVxIj88y+cTKc97fG9ghBEQ76(}QT2rp6dX-ouXrfBp5 zVCyvVHXM4k;8||MC}tvXw2$8ABiKRi0YDM{aOd=wqN*(Y=>jv(gc)KG!y`|vdlb~H zE!+?M{H`%tJpx2LVL6V|MRZ5AofXawQJ@eJohQ(1bnjcZ3rW;J*PIqZnI1MjMQd86 z{(a}JqZp<7p`~|508k-1$qd^@Pm)uUj0?lj!wROK1uC0pM?K%N418v=)JzJZJqP{1 zm#^~nCb>rR>Xb0x_X-$` z`vg7?ja9-l3F}#~a0ukDDWn)4$Iu50@O-kd^?FhhQr<79fgVI440l3?C zD0S5)rLn&|ucBHQ$}SaSdH~qLY!2xVv&}Z!kl@_BMmumDwFA0rGYSG2Ddu<24)%_> z*opFNU=K6codrJT`}#~oTM@wXwE@y}#}<8AyPkvg2LKSEw;6+u1z@j-A%?j^1oV7R zSnbPa%5Eq^mccq4al+oROQ10DK55Y7NubS&nx#7Mu!+*AYb$XiDywc&G6aw5Ft=g) z5SBs65GPS&mqlmJ)CHRz**)h?p6#BZ zQP*`g948$G6^=CE?5K-V=3saaLn8PNC@}j?qs{_jU+2Um?Fp)w0N@al0dzR;e0hdC z@5J`zGI=!+AmQy$Q4bsmF`RcxjaLXt1W*auj+f;~QgOdJ005Sbo|%k+Od{t3aJFvd z{lY&h^4ai`)=dyH;dJ-K&%I<-1U??R(y4Gf`eTDhqK+B&+m}BN=6PBu8t-ZM^;vMn z7qmXuLf%XgNh4aD%bU_}_@Py|5_a*pe0-OnF}h0(?~VkJse^t@1mnr6!)BX-kIW#= zG68^G1EpCf9|_Im-YoA8Alrlv`n0xAFx^+DuF6IVic6QK;r3DIol_>E(b#ky0RVK0 zEi^{!4FT|xr^%~;!oYijkVA5?FvIS+XXIeHK};-%#56M40d~;fdEv`83(&@ntJ`tj zAa=g~COSf$cjoiupMZw8bF;}&81KE6 zRkss7h`b|gAx8Y#s7b?&oT=i%J_90!GXVlI?{p(_1Awv^5(#vN&cQM4 z7r5}?w|T2|AMnkGw8p%XwX!L5j&~H^<)zOtQ|JWmks>=%g_SRyo6opKK-098#N~0h z7c-V!^}8m%&e~2%O!RbsllQL^BqPmu7xTd#b@AkW&ZRnu*zbS>*l!w%CKQ|K3H6Q$ zWnknx&`w0K@txS-3Mhj8r0oJ^oE~ubBS4C3x3Rxl=>%Aq#`AV4h(k9tz-e{|0QCx7 zhsFVX>-aQyW7<6`mta=c6acVv^u%NgRKg4Z5WRaU! zSbAhA5%Y>BfTjcH0oZ>(T*3sa*6ah6JoB!Qqp?cZ8Eo`4se5|>i_l~}#AuXS!$<-q z0DdW56whHUihg`IIT($qAYl;zPD$xVWH+b&(4%!A>h_F1SAhU}_lGW+gy@~tc}FoB zIL*P~`T=9ldj`PH2Q6D_0PNLU0w!q&U`vxI!s8h{S28*EdPu(a#zj;n>`Lyn$o~qduHUWh&Qlz!#Pe}wA1$>M~Q{N>UFZ3g%nWuC~1eynaMn*Coo| z@UH0f&wwSCQ`y`TPy&(lyqxJ8)dg@pPx5M3t?Q)77-4;u#?VZeVS49k?VL% zJ*{X8o4FGVO-Gd{V;~8}K5{Jp)~D>s3bDJZ(DE#3N$aqaJobxYC%HcF=?UEd03_;c zAD|qRVK{2cE?*qY%u;C;5UN`VyBbcH;NxqI3mYkPI{>iBQ$*?&{W$#+q|Z)i&Z`9YH^|uQSR7dkZJw&=!Mnf{yM#++D{_7+Bc8xba01J_!T>kR_XWYinV_&2 zt<)MsR3^gnb8G+7r-+E;Jj%fDyrTEYAgkE_RM!ii58eC}Guqv@a0NVaXyu+8sX}FE z;kb}?T!y1ULqiXE+U&i2J&AfctYV!!`AhP}oE>#>#kxqubb{Xj1!li#gs0l>_D#tN zz?jr<&ih^gG-hf!io*ta1`?BRouFoS!czl)OF9QY`G}%lsPMSl5o3Nge(h!ed-mlp ze595g9w9o`US`@3=?q?LNUK=hG5 zKN4ID4!>uB)Kk>OQ5(Z^06+$*e>7nEf?@kBdxccH5Jh4mYGj)uyl^)0- zGFAGFP!;h6Zh{kdRMK1!gbHVZ;%=!9Bp7R$6_2Yj_he&>>o{ASqkkqYtlIzDZY(L=~ebUT17bkc@jk=N}wpY&ieb0ovG|$2#u_`X3Ddx;-#lV9M?t z4dov_UvW4t-LCxS(zx}HW=V2fv$|nSm3y{tHv>6S@G9MHA9*DoCmhy(x*%U&oZ9yq zV;K!2;?4l9?W7BW$7b6m!<-+(2n7xfa~nIJ48fk;jlmPU1Q*i>TT4?NCs+uR0gPJX zJAc^82y;3kR7E_2o8SZVO4{J0W;7WC{lL>{J71Ny5Ws8g&FR5YN_>O{ zw4`-JYt-@urxW1+B40)hOB%S+^l25!Avssc0DA7<6^%tVu%h2DYxH#S(Gg7yxfuI}^l0MmNu9snBcz=dfG69wJQjOh8G zU~udCmZ1R6k|e@7J~MZe>lLhp&O*x28WSZAQW=CcXs^teXF@-f!T1fV@FnD}2|7=Z z`{#k>D75R1an=yxGsDUeIO0TL@Wd_wmcq1%UF@e>YcyPYWM7q4w=qCP#1ps)PT(=2 zl{kvOn#P4oF2|tBhqMMKuiB>qdQo|vXS@onh}PTr&=!;{yw3-+^Q@^)Sqv9h%n;Yv zCn{>t>1hT^+T@T#g=XQnI}6!(_860#S27v{S+2zI5KJWmF=_bVj=H$-z{*NaMwbe{ z0}AYZ(BBvAIR!xZFdlb|vf+$1_b6D5HmfuM!P0jrJ%WDlq~zU%6owR=J01IH{w1*}S>|axwAeUF6$*cJ1!jx8m0QN{-l|3VR0w@PlnpeSd2uo>T005KJTspUj zAVrm?=!)u#OIK0-(+pC?km#Vs9f#%;^o5t;*|#>Rw6e91$JFL_em!=Mak+;ZS|-8^ zii;EQ&4e_S$r#9hE=iU2b>qZ5Iv;?yGt(%YI0yUw+MEvHG?dO~V}fQ1C{g+YXn_ve zSToS?4ydcXKrl9?hd6uFotV+xhN5;s<9G`TJvnl@n6G^p1DxL#?aQ#@XSf;IxuCQ@ z(u+j41_0GeC!n+gpOhZ{)Bw)Ybt$EB=u+zHW&jaRgXRMt^lAhDs4DN4P41g?NavLz^pcrEcnuoFBBTr7SG!bL+PmYIvH}mdDiesrdi7AY=lUx?9 z7K`uASm&Jc^(A#o*E_0{%N08q%c6NAR920<`BO91Bblb#2jM)EMh7gGIa%5d9fGHqSV(6LZgWaD9qLiiZ=+X(Q4(ba6GjU_<}0id;vSk-?nWjr5e_=Am?CnkHByKAbso zHh($>b(ZWyLg}%2@qmkzM0!PkU8-BQz17_^-Y6rDAk1jpQQ|Z-T~7g9a4^=$3P>V| zd9Ij2+a%+~4Z_iEj9snG3#)Ezb)H-yzaiYn?&uF`DPWb%KJp=KC=cx*=6fQ>rVq-P zCo;w^x&B7IvTZrN;tfGZ`uc)h*HgAueEgweeND(|iP@aYxGR)ZKg#pfFtf>9Ee};X zU$2)X%Ytk6iAqGtu<6*}G*#k9iCN7X)Ei!T$azE9QK&AYr3`gEn!>n`t)KHojInw4 z6!41Qw;i^4;;x51+3DOvoNf`rJt{ZiB<%hN^U%vaJ65ygEw{WO^r+ftPZ65O8RtCm zK>FruLD+735W$C*1tUeM#`&g~yWHi1E~$@tasa`H%zi^pefc=QwmU&a@L|zw8B#lt zLCi*d%@KqMS%8#ID6n5j-6Y?*p6_O(@073oaSp5pNM4Q+e#TAugB znnnDyeC5+|iN@V{#Z&qC;c2o%Kn*wB#RKC%zww@Lh1THhoG9aw z*w1|UT8aPk2XAY!V*63#rcS4v=8{Lo>SDhe`(V3U-KL;v#Bcq+{GAhJOuzXLEEcpx zy9qkUXHc4fz}dNDR3ksy)d*w6bhv=!PI0?_>>+DBq@Lfq?+9#rdty!Ho`7*l{HH(o zms&1J;7Q7DF7q9zi|(o-C2#<)`sSmgxg#rZK*AU?9gbh;cFvW(#zU%b>o4UomRZJv z0RRAZhl+eB0KmtHsbFImur(f1=IMpyHIpjy?F~hTYI~i}Z$LT-M*Y`YipVi83$46- zbZUB`;)ygyOo!tEKo{0{NR@4LtE@|-e$?qQN6=)gu4cm61+m_u0bon!Ey*tdpsTb) z2V9Ny{gi3_y80 z%c_K^`Ly2ji{fL%6hRmdrh0#OL&JYtoFgJStOG>K@;{xEOKG8FyE*u%GlBs_dUp8i zO%`Ei69Aahg3dy|ZYaRUh$%`J)_6$OZFH;cdN!wQK5m^SDAFm;(Oti)8GXX)W<|<+ zUOopcEm=6eQ;bRO=K$;veq6qE+c`0sVlz^~T?LQrbJfh-%=Y675kV1F)T*(hl9Q5y ze##E01n!_O2S7kgDt(Sc>=(F{_jJI>&NCvt z+8pXqVWBJrrABqVeS(?qn20*=DC0DSEmrhIy1>n$l-bI(Rq{ z57W?i1@9vqT&f=b-YmaXiJ=~AA=3NQu>*xV=z;xD1jjZeJfpHpXHZ(m^G%TRyIlgj zNa2qE;5&g|wXG&26s8oSsDBy!`a9s&(Eih?N23e?b5Aw`&~zQAl;)Xiqtgx#{{w3~ zr$~oi2MiJ~$US8w6R^$fKJIt_?t500Ne&;^#spASxfwX#eF19O0dO}PX?7rF1hBYv zo0~epuPQPHu#U5TcVYbKitD^y)xY2P^WYfBZ|geIv~iG#(Y(EH)X!ZHtZe`-rs7L# zI?p#<8Tt<=lR+HV+S#VdEp9RQx1t?@!+oPo?GTuh)-+d-V?3i@vc+F@fNgq1KgMt9 z4RB5V2kPH4e+ob;|Mu8vMn;_FOtg@+7^*nlCp0wlW4;8bff`umj=|7-IN37t0tKsA z0Vuslu=uWcP!mE@sG@$60$pnfz`^m8n0%sT4a>;pY21-u<2#stH2aSmL0_><;eY>H z!WKxBQsD!l8@%?JB?8fgxO{t zJJ9H`h!-h67@HKE94sj!Z zUpW=fNIb<3C|eGZ;k5>(rDR^UpO})=h&ejIVj3|@@O;&O^^t!`JplQ>7VJVL_;=Na zM9+J|Z7pv6iSLuk$Leu>m5rzXC58M|i1gSwyjxxYFwuVPZEf)^fMx_mCFB0#O6p&T z0-HMpxjBC9YySX!0qL8D`&xj0eU2bb)@${+qJlBEUvP5%Dc|}M=9HErU-BV5>qf8wuXHx-{izm5 zDlHeU8?uWH6%}QzKDHApK{>^|Jn~A#V%eGsQSPMlT2L5%kHr;`YY3TRC>0MmXT@jb z8M;?xny>S!(Bjv7AZ1*SNJ9@NQxoa(6XUT@Nsk}-dW^9VnDPuJ$=0MJo6n8tC zf}{4zR*Wwligq5!U#zblR=7Pwu7@4oEhAl*ZZ8?F=H^Orv4x`%gq1W^=NN}w6b}tG zGM^yGG6B%u|qJ2V2oY$BZSW z9D=3azBgm+#Kk~6K9)rC3)(AVcTK=yjHT2(oFEXA3z8Ed9YV$|=oet3B?o7$Gu|0V zE2Azt@%mRaUn=708snyXjBU5-h5jIE)@ z;IlHu=6p-!s}XDs-uBpvei&oPrERdAhIHo4nTNn*@ZbbDJ&GVN(uDY78p#>SiI5JS zF+rE^&gIEsJZZ-`G%q$>hE0b}a0038@&z_;a5kNqdhcawpgX1hzrR&4{oQ}LuUvlb zjT-FPCdTAJq~#R4AX~{Y!4z6!BC?zMLh@RX&nji&l|-bR2EC}(r|WJV(rN7$1?>i?%}QvURLdo zv8e{$-2V4jE@oT%_$Ck3yoc~%rw?*^9G(-FjsohBMjL3JcI+^=IJXoW?dgh`w4Iwa zIfi@Akn17Bu8aH(V-b011@rmI?w#y%dd6%{i>*m@ma0?JqzLxp38W$S_COu85%$@- z*oPSVkJI%q8#_kVPTXIN5nwrC=_s<0q`L&?J}%GL1Fc?dVyLMww|DF0$qZog^OLV6_r?eGK8t-qc{&8HgSDVyH@2K|1-J zBD_tvVqFq>eFEXj-rP{=8Hf|`V(5xj!Ry()&4W!mdvM#2Z4gkmHr-mu9fM9(dS^2R zolps93|8%YoxrvBgIB#UaIFKKVAak&JBuoGw%_9HtZyg$Ym<$Fh{=@e;J*ixc-9+@ zZpFiP!YsZ)j#8?f0lL$4FJJJfo3TR6u8{LX^sVDlWcz$n$sB&ra zVJ&gJ1{b0n zgw7j2`1%rwtqGC0;+*?|&2eu4dBB{2=8nx=wkp-=R=i6RkFOz8sk_Dn@%-KjTmEXu zi2s=tWMiF0y040?6Z$#GI%bgKk-ek0UfMh@3Tuh0@$R_`Z})Qtoi}`N*qRV&??U0c znG&G6V>6enDz*L+^AfiFwNXIH$ZUV@q{iQCPcR1N{QGnT-V8moOZTw z7<}fkRjo$1VqR7a01?XE%nIJNkE1NMnb-yagz*gma?Yn5(B)dZr2$ASalLZut5+uh zXLA4$)|W_pO^9sk<(F8=#tDv217=bVh{0zrTh(fGE5_w-7o3q2q0Fr!$z6W|?%C0v z08IQwE*#58UxKHy@A>vW#3WkEqYoFuvnQ7{4gM|H&b-P;!To&ee?~U4^!z&j{A*+* z%Rqkth~addU$NDdI`<2*CNGlpSPl7M^!endKf~=6gQfNRrG_kOJQ>MR-JG<5ReVRT zYdqV2go<9243$vPi;~g$4H8MHP(4Vda(6gAV(b{+O+eFuq9Bg9)KdVM-mI>d6jdPu zRk=AQG^6WC8JX!%#-_`v&}}+ohjUM@VoqEm#<~#!d+SX(k5-f3mHR)>#a~+YgubOo z{+HkDC?x07tP>qdQl;h2068QyiU|}`Q#wQoVg|abIGl_dn{Jdz%btbtXhOd=a-|g0 zA5GZ>Br{!8Xq~hdhi;s@>rv;`yIzb^>a&4PbVT{LsSX|wC1Oh7Sj8+_=&z70HW*{U zZOlm6(P=RlJ*DnMtHtT=yooLq^d3_n4R}>-96~ZTxdwfmz0rBV9)z6&Ug7tt9?L;d zu0^(XwpZx{kYhp<){qRO?+PVrpNipgYPfdc5COooqQ13A%uKf|MUlv*Q4$lCWacfZ zcS`dM3Uf-A)y><~MC$QiGKn<|260(8IfnP;mI!-%KOBkZ)T(A37K8B^eU@GiUp9V> z5p*QdsH67U_^6`}uTM~+eLZb;F6<=z;$?mjYPSUaH(xuTvhr+~*gt|e(fZpQ1&wAk zt4=#SQUf(S`XoD`T(=Jc&X$)b3&+(=%)Wu28+5&MkR?yhHhKm-wr6&1?AW$#@63*E z+uE^h?%1|%+qQkr?|r`;@x_g}|D4kiU6q}gRh6C5_0*H`%k~Do&)~;M*fCi<8M^mc zR9J+pDK2;RRiPuz0xiYkLLj$bVGX^1ERG=#>yV;9K~ zPS=4=EXSarlLp+-Wz>WdQbrc2bdQu-5@WHvLfR*a7Ql#ttbf~Wn1=N6p5WzM`ZGqn zcNg3Ybo;7>%6Y&ZSQv3)0%4_1uBXOm?I4vBLXvnq<}M@qDTU{L~%Y#ZIB zH32>d(n=CB);Q}WZ8H0t!HqGA(sGtu4AgEy$h{CZ5BF|}LPP~hTdJ?0$wbF2dqBdB z=$F&V88{vMPXq_m(S zqUa35E9@kzI+fuQfXEn>6wBUC?EE*uqq0dpZ|33J=Oa#3DA{Z(in6F{zl zf(8;dZhMegur(K~l&jO9$Tm=9-o*R}fF2K?Hn7y};uE3uD{~@a2@f~aUZol4qIqOn zopxQ2QgYOD`Kz)r33o2WjylqZH2 zg8)EkT7Dv%4Hj_84eHDC2flq=BuE9C{nwMk%#Y`R+QzUMu4ubPKu2|b49LL=K7mAG zrUAoNMas3xxzjh)B=SH85tbMGy{?O+i4L(BQnf*m0h;k__R7(~()NZ^_C4+7gC;h6 z5aQhv`O&>6nP>3!^YfR1<@b{k8nF6Cr-M|ke_rNzczSN`?2JGC-}QFXX-IN%EIC*f z>YkMVd@2<4_JC%v(v&s@q%U9qAp8d1TTVAG$rE&EG`yM&r_`M&5BMH*WHE>yvQXSstm12GstpAt=e#^6GGI-pyMI#^1n;6lWKDM>>=v=AZQle|xdCG>~@w*Hdef z{e81AzY232LX#pC86@{*nOr(;cuu=vHNoe)XSP(XNJ$?Z36LN#)Y!ToF$9IkO@{j% z+h&Q<0+ThCsWevIhEAb*Houa+!h6CsrTa}w+u5%i9d zb}q}XNSQBgV~m{>qR4PjgSklX2<&7Zw2b+x#2Tkr1oeL_mhn_%3Z&Rs))a_)S}7Wz z4GsxQcNDs(D}AH96h0gJvB)F2?)p_n)I(F00JU7rxPV~xy%Q7Zr0j7oO2rF2r!r`E z1%f{O(^`?*^CYWjwVzvA{r{an3U{D9c?@P;j(w<1V4>QantNy@HPvWQA@HM%uxAxm zksKYI0dCCT^)?f&GAL|e>bFXaZE1%Qfs8}x+r~OJgxqJ3@4>1JBNN{rkbjg>Kok364~mH0v`DUd3QYQ_HtCwT*b8;Bz8!x?$0BNQwf`5(d7kb;N3 zrxH)-vwwVkqo)Tf8sAP1TKME~ZT5nyF%WSA1 zN`R(BnRNk<_e5=Eav2WqX>ZL8JnrW9gBL!a} z5j>TO_?|yXQygFT7y#vGm}{(Z2SXGyBLZ z=JQR}*{+wr4mF`!~qsoIg$O zv#?Sc_j~8jrWEPtQ!bb^i2rMMow~s45L_qiA{-?RS6e|fHn~SNw;xoy(#%(QU#AYI zhF$Z#TaHz$4>-P~OaNC0hmT;@I?u3Eu94lBkB+D9KS85kt%@Fw9IQp}ASfS0i(vYZ zhyBhifl}n47hkFZes;epi&ln@gRiVG-{~4?L>}Fv#mMSIPsv?d_Oo?cfhP)Y1AtLN zKL)%ggEDN79?AZ8Oi;OqdF@qGL5d2ZfTaUFAZ~+pMeT%h^hU5FA~`~lXH@>I59Kyd zh)Jb?(174?Ib?t+{g{iCjARMKJ_e<`{y;cg_4036gE2z-CuNQ<`fiYV&PoOb43o__ zXEiu6^B@zbWStlSPWwR%SrM#(a*Z;q&4;lShjR7lIl~R}*wls`tM<1a6zj$N7q?lH z9j#gtb9oOqp7@6dksEb1xSo5m48vfKzi{~L@+QwevK=xJfH0dA>BK03^vl2Me3l%~ zC~8gbcV{6(GFm&5$!F;IW26}r=M*H)vR{vZdzfnMZ66+x9iK(oWRmeZviy))83{y! zA<%x~#}4zMNMwf{H6XUN-_1C1$&#>}Q8RA-H>B&=b zx@6Ag5uHu2ovZU%0Pp= zou8jO{oz1tCi4PIhFho#B3+)olz_cW=ot_koJ2-EL2;(;gQcC!_6wg~uej%UQ(R63 zwqa9J*cKkjcTlxp6TbU(_m&=UO;coNnMjJ-XkOsvmiT+FUd?}uOmO@SWp||w{BKLA zTKbHGbB1C+1IHx$U|bx&7zR#BWVO-(&3)_Nic_&u)|u}g5hSU3GHP~9W7BkZi9 zL^coi!5Eha-EGB%YU($we-M4NCL3-ckOGR6c9{1oZnec8kPAFe0h?>k0`rv!50ea; zZZ4U{FUquMcR9u1#p4p;%7+y0Rq$wCY>%2otxC3T2h^@;$_z)GOCcq{Nzd&a*Pjb4z2Xi?hM?8kJ1~9K(_3%#^*34@&Vv?G z+;t9EJ;Oyh`zvyj^r$0Rb>r=KxYqamRI=JiRA9Y#bZCe2CW2h19J3b@B|!yUsZVtj z7C2f&6JQrm(T_mlNXkSB)3Phfy@FIR#hnp&9$euiKGFBdH+YY?8527Iahs#Ni5HLQ zypwCT5D}ZzQuBDVFcNU~ye3iLhp4~C3hL)9LA<;5!%~reX(T_Mn&Z|WHtjh>R;cpys>=8s4@; znCUW>eFe#KK~^`9!ez0g@>v6QEV|jeK`p!RjWe|>@-iCy%I8?b(VT5Ta$_b%XV;e; z@fzW-eg_IFOkvK_hliP|Ir_H(H5iacfZiG5jQvg=BZxh^w@+@(yl~%XVpO9wVV>6K z%1+F1U+J%f&tLFixRiDe%Fm8>2{}BIg89CSi0PMN$luHl!c-uregVl%pp77eCUnG^0MMTrz!y3bqXkk-m?PC+0{a<& zJo}9_<=v$f5o~JkJ$k6y>3r7L9=cR&L|W+As_jK#`Tn6&PWzQK&*Qs|QP-vKagX4` z)m!@U&yx~lyckS|9NQ|=1pa$1#LxMML9l5*P|0_HH$OtNClULz;tL4C3IBAgbeQz= z#5!GZSL->d3JVDMntV195iQ&1Xn7jojldK0sDVwJ!QW(HsbJe5!jEsytsLo+t%)7h zqO`A9J!6#|5VyDZWVXX9Pegx2JGdJJ<6ca5Ce~&8;_Ile^-wb9yWW{S;a}u&9#^n6 z+sjOz^x{6)=~Dp)`E3C?Ywqf6NDO&=gB#eKbor$!xaaU!_$`k?AOj?E??8y~`KU+y zWJGEHX*2iRZX6r3_^8prE~sGx`UgwNkb7!75MhtYW_kU?Y+9tD?93(Ih8uqq!zwEp zX}_Jfe|7V^Pe54I!}_4Xg*=^D4nv7p<+PFTK~S3sjuI<&#_zzA{K-`w8t|CRFZ_*N z4EQ-3R*XOZ4su=~J&W2bC%;NXs-vJp8@VS)p=CJ@UdBsr z!f=w}L4FuswUdRb^W`fB*=ZQSf12(A{8H}0B1Q1>I%fA6(0Hi|Dtvq)$xeZB2H#!N5D4-5kO6&lXesi- zF{eo1%Dmbgevn^SOv8&dG;|=duEju(Qe>2Y$5jEYUKgPWlBU>sC4UC$ElU!aAR2!; zBL+8GDArj^66RBc#hxZYn2%j5oO7&LenPusRxAa~PBx`wVZ>2=5=nw0XxkMP0u;?C zIZ$*^iym-+nUyQI!+LkZbX2_LUb(YL8&ylqvQ8UaJ^qc-JW|94s}NbjRuUi?+>luf zB?);w^ERri4gqzB?(RYJJP{|kZxc0_pZCTCXs~I8MK^Hc{07qjhgHb1Dy+ zS3y@@UL5*W=&{omK@2F({|yA!04eF`sr`PjAx3>CnjU&hPkmqLyiFe&nr6*+LrA5s zo|FKOm@HL40}Fxho)7+7c>H6or4MS$xeQC9I$ORG2x|1K&i zu=P1TZG9E3M^fwUDni1^|lrw6z;lm@M-ble5PHzyOfP z&LqMn^=nx_)XU+s744#v;?Pg~Re86Z%A=yP4>(0ATqx>RkC!R7UB5M0Gy zdl=Dez+^+!_Mcf!Wh$^5SNkJ>vIb1pvMy4i_wRQ*)-bh9*6|q7D8@R?=a+Qfm+=zv z6@MnzlQgDjK@p%99U#`9zX;*S-Q8xO>3k~fKr=B8QD1qt;VoUI@a*@Qpz$ZD7^J?xau5ymX(KNH!Lm`l<$a%%opJWuIf#cQ~) zN-xeV<QWawBewHS3^57Z8J*`Y`l|osS)S&z!1oElw&p(T z>OsCp+V^WwY5wbJYR;wOcUFp>Z+TjjJYq51ACsxviWGlemdfhZ9A?gKdg>rI zHCaq6xvExlUs|xlkWkS;$|a^olbuDiIMWKDxhIJ+&55?+gv-Ws%mY%g@8a!XwYW8x7;4|l*`ATRreC@`C(3b) zdQ1xSyu99Mj)a-}V|22W$aT?V)A*hT(ELghnz%tDPT9=LfzpvUDM( ztdkhVd97r|*4DM{3`Ayag_gKvI*qPO*-GJhm3J~(J%%SD<9MhGeY~i1N#$f>u!CMp zMHWa>A_KZm`iE!#5ntSp0r8qgh15ZjC1VZoQ`p+^+of1LLewD3S9?HJ{Hyrl90n-J z)>AWV!~f*68VCdq0h+RXv_yhEBz3AAL)kPOq3 zXL}*(&u42k^gcBV(}QSPCX z*#4CWH6A^|`g$8nx&F;%9L2iff?y1fyK9R>_ZSuGZf|);5^Ae(Hcz*DcZ%y`y>%15 z`@dpe

{j>+c}}DcXmTc@g5Zp6O#Fb_bmO8o-S2QJHl;uu+_E1*tE!2oV9l>}~xt z|9L&e+pRLAfBFjr7&+@KiM+^9f_Nw4Q=_Xm3O~o}Wf#pDp2fcI!jDzV>?GVWucxB5 zX95Umi+u6yFarwiG|vNQp0}}bEHBRkNnIy+MZEXw34U+x$LX#)Ns2O`FXI7r6sD2A z`DeD)Z$=FzRNgxgRONV&cLqDA=Mhx6!_K1w|7P**1?gp^#nx}R^ZRPpxz9cAjE-+s zKa4ju*@qG3q9qN#{qM=s4H9`_4@9dSpf?_8Sw&QjtC>C@F0HyhY9~Lr1w>yH8u-75 z>az>$KClI>-M7lVh?q=o$@14pz z6*8^va_%OHeB`NSDC#$TkZme+d#Q5onIbW@0`Ho6<@?Got?o0>b?NH*@$NnKu~)*C z$q`QQ%w)CT|1zg)nbJZ5`YOKS;w+kf)m(_qx8ygw^v4-E+X8!n7P~z6C{P4Tv!RB{)&-n8v4(sf6a@2n^9x_0!LcVbW9|HF4*$mbe+&Oz4C zT3vm_xqDFUMFUKtKpURc^Wcj zJ%nQ|?a)vI;0*S>v2Pa60r z$Z2iZme+~Gz*#L068if-C|+9&Wedq@4|IusgY!yFu4Ndw3g0=4@>0yDNRiu~y zTd4o2F?8`ECuCoL@$v0Y=n$CTQ6Qd8PS}FF&LSe-y3+k#o1md`;^SgL<&WY1#@u8c z7VSax+bQSi=k7}LdvvB6Oul*8zr}eh({k0xO3Sc+oAac=OL*X=40~dDJ5=4yY?Eul zk3b-o3~>Q0lmCKzId*fL(^>r2!)p~0)2ag9)68S($(hPhV`vj8u-d56B5na?rhdBK zY?&rZ+2enW7WEw?HZvv|lLPigi=pTiPo866*&=I`QxUpxD!;pXm6hSu()q@PgK(d= zrLL9A3yd-0psggTq!0&Ht!Q*&1(hdex zNLf6E3pj15GGiL>j-vPPRWyU42mc-vbQ=5HMOpVk7`;X+$H?%w6GABWU0}*so$U2* zQL<%gKv9MK^ID{kx-5sV_zu*J<1yf*SiS;K#NZ9c2y2L1rSK!lQEEml(SJIWGfA56 zVG{9D2|F}t8PB`9ZCm5L4TRIY#OfsBMwElE95muU<2jT&jN-d9m6S$Z<;5e`7b+lLSpd&ELvRmOL{p6uj~lNmNUqBmvfSe7XNhTkAY?OXp?`Ayh>O&_k!Bt zGDX;+(-L)t7E$jCt!SL8cgQ2}T_L7>f&@z`*Gxrw$OxN#49}@3smW_j)tP_~FuY$^ zVX9&#C>MIwD?=iuji=ZUHAC5@k217{NYFcMGWG=^xUKdR8QmVDE##nX#<_aA67T7tQ|i2D15NE6(RPqNpP@ATP$r}WXj!u$r1DsM;TitTd0;&} znVr0!ElhypvW$eiL|9~Xl_YSG?y~C6_G~oXcZ&f;X5*D?5W%3F;4q%I9rCUG09ImW zYi6Jh_bgG8gLaY>*@LigiD-RB+137af=}hpJOnDpqWSFed>;CP!{=uG0u#qrxYGe~ zx%~(ctSU0Q!5ixZM4d1DnXWcRS3g=y_6<0HnAVd&sBuaV!9{_19>UP)hBw7FJVbRi z7c4DG$&bK$Q_PK2xsEEp29i@f8`v-~nPlI#4LCU9aK@--j9UiQo^DP2r^?w*Kv0V~ zl_KJ~DV1bYW0pg?G}O+DwJnI;DoyCb@JOMqf!;IS=(=O9r~*78<-gonK%3>9_ttHj zx3y_jZQ0fYg$?yE-$fL!-ZsU;eM6*wzGc`O5^w{p7VOLplp{*{Z#IB%p9Osxu)!+w z);C*M13amzG*VZ-Rqd_3dE824%g){$w5c3~z=%%mSwX);V()|X0|o{>J+@p9)nPwh z$+7`<`z4kXh_MHY(x(LSTYAfnWBqCi343jU*a^AuNyUW=KzA$Cx33Ab4d^ycKIf``1`V zm*&vDG9K>%vDOuf{>6ezKT!Urt{{qnM^AeoorYo)8n3ktU}5k4>i13aZ1@AR$NF2A zPtSZv0fEKR1q?4X&zut;)!lJL!X8ruy+@rOF|AjhR5 zY~_Sh706j9gs)a-`i|MJ-kn!jnp(A=L{W&SrSRTgp zcfK&tw+g)gJ&#KAJr}asO?PoiBk3Ol& z+leQI5wAJ)*-^%g4Bjb;V`&^Y@#80(6e~;!TW?aobSxH05#+h2KRYU2X7PZC{;JHM z4Un?&S6X7&A|Z1nlpSX^v{3)8m?(;TN@-6D`(-3|D;z+@9}gEW;A%c)kV$o~t_?*M zpxFKQ*zC@qd)7k;j4bc!atDyy>^wA=H+DF#@Uz3I^RzH+^r*VL?wD5m&hW^%C?L9E z^cM&KakjEx!333~=xaPQes|l8xP%tqJ1&{qAM@F@`Vk!BzKUq>07#eJkDd$MI0wG_ zH8~u}C)YZX%rn{J%Og^ZtW97py3c|}a!7NxO2&pFa_n2#`+#V3aKOmW~$B`XWK zpKxPuQ)^xRqRxM|3TzO!FW!U0hLDX1WrRQO=)@ln$on1aXv3&h8YIM&Vn!Evl+8T@jJTz$RwwHeYOXx3K|tb95lZv3kN z$d22pNq0Iiym#Uh7Fb0UhvG;Row1~3A@ntyhc({jjvjJ6J(W^gheNxx{FjK#ScF{| zKg0_dr_gjIZ=*VMDX4pDfdtNGng;|atZ^}?0 zGdS!={uAvtt;XkZO?V%6^U8tQ06#^92SrMfl7 z!}(+C^*L#;7c6Iw8V;!b$6uzQ8%@~IllQ%OB8079GItvh`{cttK&-GP45-i-a=VE^ zkjv1(WNavrehiQKfvu@WN&w@~it2ghy*2zO=XQos)>6-=33mT^`^rAbQ9U!G*HRx* zIz$eF{f)^Vlw&pA2U5vG6B8An*D) zU5`0Pdi@IR=2GWbAHrl0=YR64S+zh5JY(xZd4ZZ*svxyGqXA{Oh z^PM5ZHhCGgjF;a2fTT$?+@&|s;l^|vhWt`wPfxg~GD$Kq#CNZkskkP_7&NeP>@%g! z3~|?slno}73FUBQ&DgtXMTh(YR;gA$2L<(7Vu&NCGk}Q?(1zZJ0;+`vChwSmg zLltjThvsD(uRE(d-ymqZ^*sh z5q>N0v%JLV>f%uxHU+W$OKn?}d;VjV@U~^0ctVTgf;fT8k~SycKkZ-AQAQ>Hn*+3& zeWPu2M`=*is3h%DByx1kyoH64bg{ru-Sox@K(%wr0EtHRGlr!Vf~xU!P2;I zqW5|de*JlSHqn=I`7P1CcZBG5gCL}S@#zh z0u0zox+{duw|$i5PpG7-)weSwt`C>pbuJ)vKbtRa2**G6duO--%!$xrylMf!^QVMGz1;_D^18?}L3vh}kOSgxbl zSr=*19Qd97Xb_HfeHL9%K*@Qn5^c_iF%5`^C@kOsf`#yEP97eMddPMD1&Lxi4@^LG zqROZ`d>sAnpia>VJpDAbTiXkC0=AsM=qz8qdqFv?9738TPd4n+2Au(DNIe<0iw|r=au{0Rg4#Kj9#lY zyrOqCGO7M*OHUEFWbM4YnQiRaIXS29?+pv%li2l{XE40pkfb6j_xQAan?UlDZp4~C zDZBa}Fb9%Lw&^S%2$*UM3%I95!2u}Y&)p3miZ6MByO`r%V57chx_$H5*ZzLCYA%}Q zr=2wGdQ1g2A2c+D^mRBwKBn*WmECJ%y$xMT2nT!E&62(*xs2|?Fp0JdMlPwr&AZ@7 z8m~9;847;CJ;S)*fjulrYOlljwKn!n|4Zo?3LQ?WjXvt%?G=s@_!QN?Dy{t+s|WnN zGU=>niR;3a#vuwh65??%D$I+WMyvlqBhBn@v>J1^m(G-g@6Ls5wEerf9#o*NLdvVa zhJ)TCa;B!M=jdQ`rdT|iKkm5IF)3!RWJ zCblbL>C!>cb<|jCq5lkAT;;;|-_JK=Nsgj(V5JlW;d;S@M4cgbn$g0P{Y?HQgEeTk zwx`Xh^|C5t-e3k4}mvd409@KYq@ldDm*tUxHE$snW576ZHX0J|z7jY8)H zi=G9W&M>hlX|P$EWh4X%I~MLyX;{)~zF5l9F;ZQ&)S_f>P9M@`=wYvHVqghVq^d5= zS&ISpG(CpIJc#+7*!Ixs-x99QtWs9NBQwk;UN^en?Fol4c%4=mLGP9plw)`BI56r6u8vl{wOaMB#dZ~VB?{A2En&?cu(tA^Hy+orZlClrc^peoohg}a~ zEon((_mhTj$EaRm?DMMJUbNpCG5vD_ULS$ubxKyv$!GY!q2Ryu`X#A6 zVUd0mgRr1bM+HKa^RsY!EwhTrL$M!X?$Fzb`ne?A<3RF>@&G;YJg>#oA2*Jonok{0 zAP~C)7>|2x6t`e7^U+N&e+>_|U?zlV*25QsJ{*UOUf}4qP#L;-AyM0nZX6(CacgZy zI$sos^pK~js$kF>#%#j8LHh0Mr7;XvWDgGK1s6a=y+-y-4{K~(J*8fqh3F~CK8`5I z>9S3`u{we~h-6R2wt|5MKIcj@t+-PYc$W;IO+9a|{t!ROyr&Yn`<o0vUeE~W>isk5nY!#qMmRU%)K3VT}1%Y*bMLX#IYCn=KUvEu5iQ=7W= z2}vzQx5*w~kro*Db8E7$_)ekr!gy$z6f3!j!QOHu=VrFS7qB`r18S=eLhl{xJ{_lG zD6-UFDw)~E6)QkfL`d>cC#W?)vr$xiys%g1VY;B|yH8YG41>Xqe>qiDCqU4`FmFaT zZQPD~Dhc!6HDsssZ*S`@UvG_}f!m8@BVgROE9SQpZw<4hBBqndes!iek8@5p|EcHN z{iqT_&!u4;lJl|3YfO$uZ&3ko^;Sr&@K@&mxx#hA^@3|ZX$CHvQmIAUOKr15=4;-J~%X=5nsOO>3RRA8m~HT%wNIsB*Flp`D@G5dSx zwJA;KRi~;ia59t8*inIG>8p`-pdfzi>;}d%+^4-8YJjl^Kw1pc2DK>vy-h-3DTle} z`yF?!3=f}9N?c4FsZPNGu137%92UtR#0*1luWcbCgwr+EmSHRm4spO--aqay zTskQ$;iJhcDc&PV67Vn0?h`BEtP7X}JMiA{$~ak{aYM@Fj=;2qoQ&30$2xRvOF$=} zJHgLRhW@#$O%oNPo&@Yr;+WPWi-t(0oMzyptY1IpG?d$Rwxi3qd=_gnhp4y&P1{DS z&t=$rZhVM5h0&`1^kMq5E8BcT(PXPQU%OMR4Pqrp-wuKQZev@I48qj)5J~YgxRvnb zz;5@Ro@t;i8-)ICIK4yhi%<`0H{b*7Ji`j!k($}}gNcgXNW*Tv5^%BK%ygk)?(ya_ z=(!rV`{rS-441eX(~uTsDLmCBwbYs<^W2Uf+EizZ6^mEEtG1};hMANW%}9l4@<07+ z;t*NdwE*B4aks;ML^%HMqRvevgw0`&5H$A!ix}5fm;>WVsbH0VGE1e*s8RY9i&<1e_h=(A@tyG( zke5O1)aa3m`onS47*Xx0+->T$2kB;19cM{@aiJMKbz@##gO-1&u0CxExm%fc;1k`b zRkoR_m~Vg$;qz&*=}y%+;n>1a9$O%}d{(8)_XL?-tGv61hFi??RI8zEYi}AGzYa&R z>sVhsYSd;gbC;-Owl}Hrvaihr^%xG36JA8?Alz~#iLCz^E+$CHH(nb8v0oMDEOqx! znvOD4DDayeSu-4dNIBX9W51z!eo=MVN(8ETixe~-GtUgMc6{?|tOP<~6d!4q@lDTK zYBE2(|NmX3m~@Lk5}0+A?Sfd;^07%{ktE-?){fFUd7-tt=;qSvkAG|BITamO zZ|K!3u!kP<6+acTE$|-lf2uC>q*Z}GAa1szsD^6Q1SC!~_Jh&ak-29eQXTo(J`mkn z{c!uqe5|K3P4}xPGP=T$<-K{l0;0=TOPWrUX|F-mMvj!ea_-u`u{yzhU||}wa~*d$XBo6!OtvbS%mq z`slb0Ghi2SWql=+t#R$nqyW1!TByi342Re;l6+vzSC|UsUVzBC%2GPcF7)f6=nn;% z)5MLyUn|M2BVl6Bu$e|Olx-$Aed~z<7;p0xNs#{rZ@U$YwCTUmBX+V59{>)r#!u#1 zA-%EF(lpG>h2>w`Vrdvx? z3nE-RX(#NhMd(Yc256iqq;guUKd}uW&9Q#HJ~na1X&ps7PEw5-xP`7cSP3BqC*WG! zwT#pWMx|Fg;Bgrt*%y}9sq!<0xv4~>I%9eC6_KWv%zzAIv1bn`y`jauKmAd#kavlw z6(TViI{i#(k`;VgWe%+Mm}SslVD1~OR2hLVxMrv+)iH#&ezshuVfz(gmYB;%e3YO0 zrAQjRt1D&bDc!f;zS{*PK&1ZWuZGm$8r7=0q15b&My^`Gu|fZ7ISq$UJvX-Nuc@GM zjeb+3v?-R+H}Xfj`XEj8C3IJ0fs=$1&mc#W_D$TGyO%nvxJ1;jv+#JJfl|^FT^67! zKiX2YyzjoKi>NH%eeCAsOu8);8t<^rqBDJK$(uJN;F>>HY~u~Rm}^mfk#|F-$I+HO zYjtB!AWRzMIf+4AmzqFuqQHp2YO2c9+QOHkFx=BvsHFK%B@oKpE@A}5T>%Fj)3O$I zEP$7(O0L`%u5{6Yf~VvvRnc`~MFlEhzgihgVs5;?HpR03x4LW6-+1+cJ-+ZO5v@&B z(Kw^VC!MDQ^}iffyGbXvro(iSARS&0aoX9Q2|i1(C5J}eF11(=uYj{WHj6-?plsrA~R`3JL;H(*_87AhY&eS|uxQLe?L zS&U)mwLoKfN2kn-YPbAtHH_@(#?2*=7QptTHtF#8i1w;OS#FFQwZ;c4`=L$eER^k- zB^$LYQ!#Wc8#&1-WMc#|-Hsh71VLhB*(i$|j4EhBGSvIY@-RZtb#LS?`Cg;U z;J)yl{wmt-Csqdq3vggYj8MwbKa!n}IT}J=(EJ+|)9gb-XYyjNceNB+A*1q3iTRyW zcRx*~LUYZ)aR7vvpMXdY34%_2Eq7vI55ZqSz< z8yhR(pfC3jZ6725bKwXjU&pHIA|M5E{%GrE&H^(^{@K4_4Z6C*+TGQ8+KMp~dDold zQ58~B;5}NavdE;QX#bz9gH8TZVW;#Aqje@9G~=^%1N_jP+OMT1evx@O?cdEMi^-9u zW_CUFj51}8;zM$Y^L9tb zp~PsOP!1Rv`C+9Kzd2FlpK$8cZc5QoHDs)tG3W;};w_|^PFfJ)$Wm0R7TBFXKQtmf zObu6}$gsOJqSQQk=|-C}yMkTa?GruR4t`HWz806~*j1Z}c^=-t`4E^D@7G1^0-6+A z{cb9FX#D4NQ3*O-!@V~tRk85c`4Dp9J%{NOdr=M0Tw?FYNr_KI7CFzP)c=hc=~oEf zT@;$SJ;_XVv6f#_Zp>RWu06JxbFLv4e3!cP@r=!z+wurw*SnOgBhL$e_*AN8sM}XJ z*6zEnYgMvkH`AD3#}|eeqaETHXqgvDAjHU@FX3NKXjLv<$*ehQBkW}F8-*}B3hJGkHYKtte)uq!6R=%dr5s7qF)2-q5<%Q<)$gami6cjefReNCA_}4YTRDB1bA|jr@@&7obRblOy&r9|VS%cPPzTh9jbUa>5y>}?!p6~T9_l!MLb&1_;Bn+lIC$~(YsBa9I1jpszG|C$(Nc?nImL7 z>AJ(+Ic=Q$x?NVhr_f`N^UWxi;RoMLBvniF)C7|mqr1fx3vLcx#NxzT2}f$D?l%f? zsVUAh=`DLHjJX6&!`bmu+zlxsEfq1X-z6?ZBgxHe?YzevvNq?@Y&`b^%;?O7)Z4N6 zS@XG&!Y(Ptt75~NQ`SU6@Rm~h??(fSeqEpu&iC|=*9&hVc8qTU&xoJ<43f*=!;SLo z(d^|4{Zr6S%l)HsK9tjV zt9i-7?Qzv3-0O@igLGrmkRDwFf)2i!igV-vs>_=m_Tk4n>H`eP-!#~=pSc-~?+A)W z5v@b(d3YRD=rcK&`-EQ?{MbW={JfB1hm1&biE8`NG%73!$%W;{_FPn5^)-%j2}e%U z=hwdUDFok7*v^F%p001F04 zBUYby%33@3eBA}lEhQ3ZC!>TTo>QQ%Vyi}E>9?WU`+eX)UfEt)iYJtrwu$^S0_GZV zTUXA9_F_8)#=AA{&oQZT=(rZxOT#{*M7O|NJC`JGN?NRF z8ij}=T~#BqO%E-yHmqg-%<*?+nkO3Zc_;1n&fJ8dxXgOr9wnA^4@e{4Dn6UfdLr|3 z)qr%xJ=ozSXIJZqT^KJ+r2COa4)=T>SQc4lf+O@o7t0Lv3u3jaKyP3$l0ogLo^m-^ zQ6MZ?;e%vD183@)PxnnKB|$`;nzXK-n}Y+r(Y|Jx-$hcdLvZsVtA)P3PR5RAMJ%RI z3kfNI?J1AIs3M$^J{1tKMVQo?X7oVvllE-s3p(Yr$6+41$*;y(+J( z_NJbb!f^NL)!|TV<}XNy^SR|4W4vdG&kY*CgMfUkeY0AXEx9@T+*9w$n;vI~QwDZWf?JIR_tZ;l?JS?rg@e;ue(`CcE#j@*fN8{8KncHgb) zGC814Q%Zd*xf`J}$u_K&PaPIPRX}DZ@^GSqeX?vhV3F^Uu1S8`w>z?zCxsLhFotbE zWffkL@;$Xb(xBPWSKM|?RX1zh@uPpf=cvA1`>KuDev#G_dGG2ORk1<+VyW^>??}*n`Skkq$Kt5 z(f7UXWYGa!K<`Ll{{s@6`~*$@h^ zxWv{uSoD5-GGu-{dY7%v?>{5ldY|@;KfGR;kRp=FR3WR*y{js#XR2#7r0{&>NY05L zQxrYHcq!^Wv}l+*Pua(SRo%A#ZF;=c!ep@etbt6JY&>jxQrQa)HpF8G(bUXC~A{Qjt+n;&ZF&XOnr=A72I)M%aSy=Y*{Px^1)id_h37iQGnf zua^0TphLq1@VZQrgd{lsQgWoS{qiBZGJ7l{`+Z!F3h%a?qUObgP)QE7OkGTt^^IoH z_lBxse#ls@Di6F8QYytQtGem$dM?K5I<)u?8pwzR3DbAzy+=S}0`&09!GQG749SIzp|%1UB;s)U^`7lToKZvNow(t3W% ztaI8^crt5wFMTn=kUUMpgm~Ike2l2O#b8vIv`|U)V!t!ZhO>XMx+J8f@Qlva-(V#W zJs0xtxhYR3)!kw+s?SZ^zH_^Mv3@MACiRQ$+oqpWcrLOkjpt5Cm)cV2JVy1wb+s6b z>JoI#aC)a4k@o7en6yV6Q(mW`=}19sR(Ll(eyJ@jDDHK&7>w$ZuGvG*g??|^O!^m` zA-krhs3^Xh2f0+n3M$Co>uxa^WtG3A7o4dfPspV*_MK*FlIeCa7)>ejX*DnntDj8-W-pSAhaNtW|g&=f3ApFa6?Nzps9Sw~u1`4mas z6CsI0rVorR98xYT8{|7ROw3~a*mpXZYz@J;81IF0n;aM!nJo!{Y*h5+Gd9mi{+xT| z&G(j&3@+&;#AZk`#F@=TMwX{&8ab#hz%?-F*%Qo+O|Vk&=y5fa(YMAuT1 zYsnB5KKV`?OL$7(AES`1yx)C>?_i-`TM)!s60MCA2j9MZ?^{&F&Sz*gI{nxCK9W(U z^Y{KHahBqDjEr{szkKTEhgzMCjLs7`ywtrXDdNo-8Lbb0IYIpOxehEC z1=%+;I<4;?BE$#gi7MSm1YW}eOk!lTjv{`A`mCQS$rcg)cEQ7EH6tE=-$IW29$N3J z5h?{+v&_Ye_n1z3j1mUl^Ae4;zc_0nMHc4uJ&8_~c*1f#bCUJ`vP4ExCRoJ(guGsN zMjs*J1NVyfz?ac8Co%teaA{?;yoJX%c40q~@)U9UTyEPX*vd2eo3uh6^c1UZ1ee1t8(%@c2jj$gMgpz}myWs# zjy}zh@Au$RBL(C6eJ50ZMf@ur?fFiwHj?m-k1NC$jn)nSO;e#h;!9%km_K=60XG&HUE|ez5 z8HN5o_V@4Xbt^_K|GOU;O=xd4y#O zhEvmj>HfnH(tUHLu^!TWvcV`{owDvYm)km40e8@q{cC-9^1gFbS*??O&bD9o|2nIKYuzb} zJ8h?ZXDc#V-GS)W>tK@Qcg0n+v^F2_-wf8G?R2wR)|~i4@G_w|VPG%Z1t0tHr(U!@ z+qSe?Z0E`NWA&KqSTp~jZP#SdFhsXyy4A8{YHXB0xnYk59`Wv~Fix=qem+A)l7e0* zx)XomZxct+D9p)ksl&L%ih{d{M<_6VEgItovuzD?vZ=nU5T+~wK*q@D_;bvj_}gab zke(wV<}ZO`STDTI)=2O?C;xJLmly{XoVo*_CgcOnJeFd#c+U%h22& zaZJIti~A`tdo3E*2Un`+Y@6&<-`ZzH#LyYx(q_ZliNEDAe+eAxHK%*s9i|`TwOBu5 z$ZKZ=FIcy`UMOK#zVWW8>J)6H$ z!K}}!#O$?b?AkP$5$lNURWOu*iNEDAe+e9qgu&p{BF7ebZKZ{DQL7a0f;CZl;Yyj~$TD345_^C5V zlS!*^^Y3}1<46Q0;vj62J!VP3#NTq5zXXnNA7F86u}~ebFVPloza|m596|-12G(d3 zy%YofWS=M)0jlWCioXf{7Y3u_5x}@)3wLmg&qiw-;pm|~KpU;FrV$ZU2O1MCvY4@! zT~b7_Jrs68<&>74W6UanQp`>rGMUp16w2H&mBny!e7d2`r?o!1mkG`gTFtC6Ketj0 zvhr->Aj!n+UJHs#^;OOKe`K!%@NNE{pZpbH^!INCy>k6-uI&%MV7r60o!Om_g|oVK z+YUT-&6V$BdEuU>zeE4gn6IrDs3H##r200|RfxVGA{tVHj3%IY)D^qn1Z)R0g5g&$ zHbuw#0j$=F$~~;Y)1vDHUQGsYdyh$NW7p1b1X%A3#!5p7eU?XTI51MQ*HZ)AlK|Ue zJ6*Xs*h{87ov9>J6wJMB03#b&#lcQ*T89?ju$}i5-K?lj42@z6!)F1U3uvrN;gCzn z#NX<{MydFS`AgvVo+1JmCWXSCAgf(T4tJqJ%n{j$YV=;}X`Uil!hL3j057^>`sWIt~7mmKF$(6r4U{`L+4|nVKhq{UC_J^S+h=M&N z2M;~Axq*73G+i%8VH<_@d>2JeS19^R0lnsAdt_tCB;2bl*=l~iq@Wadq3!ST{&mMK zvD;Sq$2Pg>%Ehwz0bsnZq~!}Vy=Jm7?^=_=&TWI$brT-3b5FgOB8D#6j%Bp`cfk>p z=~nA@_*$fOBu5;Of76eP<4|J$S~UJ|Urzg8*JHt22 zT5;vmGq3cWhpZMe$yUB`ckYPn$wy@Q7Y$5bU#4N*LreH?qA|OmnZKjKFg}S^^#EnT zP5Vsf_P{3XGtft`ju4&0-*J>%y}8tiKOv9)Cp5s_>`ViYYffqVFu^P0w7Oa08u}8L+MAt_{<&Tn8ROREH&V2Dl4p^@AD^59+Yp z1$YE?1EYuF^xYmn+pJ`P{tf_F0Kg1A2lGb(pq|{aS>fFVSWg0QWd_Qmf#i(Gkm`F5 zMmzwHcBXy&_5o2@#y-K_DK_ki%wLPfc*L@;;Vzu1zC9MmeFQ5(6Mwt7&vs>rFOq;I zaGZB2TKwwr^N`hICfUk2?hZ&!E=yvGOp2Is5Zx2Vr3wtw$mq@xIl3sbj+nSi1_89P zW!yfCXi909461~dOJ(`ADiiMS@BcAW9bT1MV>+&&STrFjfl>r0jFN~Tr${La$FW@) z&=@dL7DHjq)EjLG{zm-w`y;^oPvGCJ+vCFvx^;{25;e+qVN!%vY63QCT9>&C;zVvU zRRodKV>4yP$~=@Vqix{Ya@<6502N``>u`(4IAoif>3*n>l|RWqj)(K2X1;%&=NUf& zK%0INTifLUqsnJ5?`MW0Is}x`naQ3h$OpXY4pGnsO<5%n;fu3{k4@3j{)cve0`XEK zxahOZEd(NjT%q&I%RHyFg~_aZwGEvU8f$_t&wNG8$O(gqqC5b98DJ}#s&FmgpaL(w z8VKEGa^AZVGt<#>Mf%Q(G!$sRR4as7%XcTrq6pso>i__72B@dy=^-}_Qz!IXx};+r zGLI!!JG5@(5shGz+z(k_9n2Efrp6I_J8_#^G zj~nfp_}t52XzT(UH!$Qf;&9e82w-|@I<0{=~!=5UI~nheiEmPKms zrEcJiTqFC|5k~ATkDwN_=w10(q;=M{0Xxu3EomtLSRD%hl2M#pU|mq z4L$dhX)dOneS`Bl#)+cbU4qkO>jrR4inkN`Z8xT+Vn zx<*8MV=o?I{p^4$Xf#IN$5}bLfm*ti2EK15U7Oho5XTLbwQuWS~>C)%iFZQYEAHU~9{Z75MJUJGxcs1Yr zJ)hGm@~|*{Zrv)G8a(ox!rEEzv|UU~`hY{p1MZmTPPi*>0HZrD?C6F47JUBJu$06H&y9THBYoA}YMiFG@X72ft0K*jP5i zyAx5v#pEe0Y$0jc`Wh0o2($z0OCH0}w0|A6T|UW&{(RqfVXXZWx5itRr*SdnC9B)t|(Po79I|ON>7@ysh9Uj zQdM;sMwPcS((kB%0(yspHKQtXdze1aRomXbckR^w;to4>du{AvB&R2b zF?w?Dv9(T;W7{_3W8@gIlbxKLIQwL0Cp+1D$KU>vjg|L(p67kP?|a|pd*1hba`$DX zwQ+4T(++LhcDrjk>zvVD2fv{B1#V{N+BRkx)wXThwyn{b)l>KS-rBa?gS}R5+qR8e zyCXBJQ#W1LndOY@=F}bCQLS`n+r7+Mm$hvT_0{(9BBvPHdTQ&Uwyn`!DYGu;UFof7 zXIx!n)Q))4SyxB4n~qMe|3HVf+g%$M)7lx`)uc9PQQLOBvECm=QrpAYcDwC;Xxp~! zeP&~9+pg`7jU=7+&!7CkhxesLYun*wd+@$9$;7p7B-PaZZQD4rZ6DgUZL9rk);6Ld zDU#_w1<1DRw#`1#krYQmIqAPv@E$;b*2Qewvb~j~DKj%O+aZSyF(zg^%!wiBBu<<- z;CLm5tbo~xDUKmzha6_M!(>{=lcx*_vKsphGDlb43TG*nYrE?9!pWb zGBY!yrA4yJ6gkRYO0qS~U^(Sx4Ns(htvz0An6~m4{&E{H$us)8WXW1W1%>3i|AF{yH;DM*L*lUh4DMpf{NVemd5n27JXi!-HVL_5)C8~zeK_b>9NZUX~h;%gkiYIjh`|XZ9}BdKPA8X3j2mkHgus zX8LG_nUmFN7|YDGd&@Dsz~#CoVGv)`ZH;+y+-0T4lzo46DrS&bZ7BztE#Hhf`)| z=JrhYNgt&uZ+yBaurDb35z4zXG?@fE}z4zXG?|t|An{!lB>SQbb5!Y%1wE>Yf8OahAyfY)z z?2tso65Rz9x*M=!8dnQQqz#M{)3_XSVA};WYL-Y53c(!j-F1S8G!hf(4P46x2^G6` z16~WbNGwrCD8$BILkks4qzFZhO;igQD|XOzVmYohaP0;>OgK2lZQ#0sA{~(tVo8dQ zL&cH^iD}#hgf9D$LSi|t7a&v%C{#?S7a&xuQIcYbIwC_XQPJ@;VrRS&6wwC8E}*Z4 zBE5le+CZUVIev;7NZTg&ulZ~Ap8{;#aogtn4-o)q8cg?Al8KU8#%}iij~hAV4{u;; z25x9U??LY^u!JM9JObp>59k15X8!BF-bUWL4s47^jd%_KE5ue0rS)|qMy z#n7Z*P^4HXZriq``2+-8!ufUl|Ht=Bbvng~Im*PCT}x{=yf4{*M{FZ0l6!fNnXz6C zY;;q);o-mA^u1z{SWGtt;^I){qOO2*fw@#6={yu@dDSCwib4KkJr(n&T-y1Q4S9i$ zi!PxTh@6Of^Q`3fNBOMv!%PWi2yDDoA{JVSaDQ1nNLhA!9IH{JKg<1kzI1&*n!X-Q za-a96?`PALy^;3!H9N66X@+yy7zjg#J&UQG|>2@By^8+wqljb7F z)=$ZJ82OjLr}om7JcE+4uVTU0I1sf>?ui?>X!Aa4-Xn>L&3U9DouvZ2Le6UP<0+sL z-c+kdYcw^aGsbj%+DSSxM)*1)Z!M2?qyCdo|35z3|2NVvMN2;RWAeA~FjX!_`6nVI z+Junlu)8`;0#+L3m+ah9fES`Xl?j@(*}T^Dj$_z`%pxR1qW60n@w7cJQ17xbQA3W_ zN#OE!mn(VpVYoVj1V`HmAdejC>D(jC%@P2HuhYiNo$8ogS=s(wGd6Rjojf*p0~EF3 zii@2oGE@<7YZ-DU5bsI}Xc(j{NALVxS7BVz5rL?ObFW-whzrTNRKf*X3^3Ku7Zq`a zw9joxSg2A`bMiHwADxM>|Up;YR7?n`-p59;0MFU{M9;UF1#y zLajxJ9Ew=z@!W%3H6$Qhqy`VwHM??>NAW+M=mM8o#w(lhKeelRE1h^}1JK=RD3$mk z_#o7{y*~{A(g(El>Yk@9tIw=^=917*(?Fyh-xaXd#-jGL;};S`e)131I(lO3oL+Yx zp-FuUSN%MjVv)bDcX6JSs_)A-6Ihk3*xBd$76htM@m+e#Fs;ehgEU_ z+ZL-MCdk@@MGx)xQOe-O4_jxpaP)C+8AtCJ{8LB)B~i7k$hkm5XWRK5`N|;Qg{o0i z)r#8b`^~yr_WL@!c#BlR_|96OM!plg}6_!NdKj}<`*S3<85D>3Qz+TB^`BI;cHo4H3PV1vYG-UE+-(~`dV!Pap!&Vu9 z5!>{Crz6cITxjTT4h4lBlan)NxL=?Mwfx?OLAPee(=g<@%H7lox&LBj(5(}4e-tVK z-@>GfSn>>eHM#t;eG@e{yYdu_Z_t&3e_;T)+hGQK7XYMGK znd*c!wGtx6mIP2BFO+`}oFpe`p+u( zG?_26;(Kue0QgdThpPnu<4)E)KYc0R1eOZLlQY)BS;_i6H^rC9zlNm5*NC;~gmdJ} zOZH!U&%Q?14)$2z2Wa+c#{aP`1C0AHvOT`qyot2j$utjaH%sm{%j`8v?>3KawLDL? z*$nOCsRcJ01U>JeM$n@f^k@V;So_~>7;rtu;dLdk&*yjXGAW zbi0?~PTO|Yt3Uy0y-2uR6j&J{E|pS3s5cJZWC*h!!ZC65_eLor)MwB5}xs?cpJX$(Om@`4SA@{C@iN<2qJ~NVA%bMhZ`SZVJuHz6W zD6|;XLdd{f{+9AeghH!vN^rp*UM;uty5!&MqJIw-UG#4)ZxR>m(pB>Z{^GmYDCl}} zx8**LclwiP2r686((d}U_#3K!(24-;&j=h@pTe3u9tYcHcdL77j8xLHT zkWhdNFb0&R2QELxge^w;rOZ$|kvwBv9bpN^9^mVl{o3r1Gn?X2Le{r97N?l2Zi^gH z64>Cjc>xLFV@c#A8G?O!a40xHUO@nWs{pB>;36A&euc4>awAPJU7V3G@++{iFd*%b zRLekjTZ#@nRB^U_G|gHIt@=Ee&i~?OynAjn_5HXKu{5Q&Sw94J?X7?Far~Q)126yP zzsU%0+;w8f3l`7vTfbMuR|y~XoU`M@vDP9}z75Bx$p~W6wWQB?|4M;WkOC`j#;hmy~7rW`I%iOmt%Kv%;NFfSrVGk7o_l@d-lp)>)l!B6K6PoE?ZsFDM8c z?(SvAW&=e6njZY&?q*4cz3s=k3XJzU^))Yn!LRot&uv-0AWX-_Ux}wpZpv%(@O#S9 zz^ZO$t%aSR+AMvxf}w`r_Y|~)?i=3C8#WBMG((;nK7|`r3k6jEfS6eFz&W0uN8?N6 zdd}4B!~=G)SL5^Vc|SiN(Tr{P7X(lOoo?o`XkP*v;$FgZ)nJ*gB$ba?t4!1F@GMn zvm0KJ%xlAicLRPo#Zu+y&ywNo$(L!7CF$MNnlj-LfSzE#cSiP>{|DaoSlk0q(|IyU zxmPFP{p7WSZmi#v`~086=l>My1-yAVi0RAidlpw;^`aFth_+nXjj#%1>yyqkV}UU0 zKT!pOq$w5P%*a?hKAIegWhaE+NZLARnn7_Gt%h_)o);ts+%A}8TGN+9`*cJ}FPU3$ z6#7Kd&UUHbU-Z8yw-7RK_vhggjv;%Lkg;T_!}S6V<*E;nM?swc4q?IAYnQyiS_?Wn zjBoO2ge5`%vwkq!e>WpJLNTnh*rspY5~S4y=nqW)C?#zI2q6UHIxzLabQaUFrY%nQ zlQCzKY@BsbLYlUFoLuM7W#lM?VYkDqV_C*}6TtL-kleDX7M1W!z(zovTb1G1eVC3< zk_&#aCB*odB;Wyd4o+GeJ25s7e@S-HEj{gPVLAK!gADjF2Q;ecxpjz z`A-#0t$JoOwDbSnTGQ40v%Z`S-#UK$-(cI4z%%0vzG0joUc2Y%m1~x`5)o7592v32 z^UUfuhCeyH3LFUu>s4^%*Qv-j6pYa>9PGxttp4lLesDxS&XES5855kHI7uT61fG795HP=Xiq z5aaz#?v3}rlwYM5>L#qWAv~sbD`|W-vDe}=A9=&mbW|SqU}LPG19H*~xHUtbMnRWm z(DTV(pc{1luAl!$p%-%fn|V1%_iuOO&Zw=(fOF*|Vy{NL?`_0av0+@QKp5qpptT55 z(9xe5y2=?39jsOgk}d%aFEaXlrX#l`NWqsVp#=UPt%)4H%#M(D0m|i^OUXIVPu486 z-BpS51CnE0DiI48te7`xz)gl`Ll{_y*#+DNfiIAzpq^841+JR3DQWV^nz7j~dE>yS zFLRO@DuL(g0p;yeM_kJg8bNVLK=*nWopRvhpYX)&{*;R5Za4=d>`gyNLieWRJefBj z6h+p>scuCr?etY12@?YDY*}3}>)aS~BFloug9Sp?s{q~YyFK9{b?;^srJl#;zC5znB^yeCMBZX)UgCYO=SS%6>egpW7WAGlO?^K}dN-waWMHj@UB66+GflITeDFK0 zYu!K(ySueqJhEK=E9tmtcI)A+L_7TCcmdVT5 zyfXU_MB%w1?1N%z-GE`L?8Y%P*IY!g9i+=_(id%hX- zMir&3KfMDpf1O0B`S2E!rqAv2&hcl_e_PNab2c<{mEo*+0s7o2UnJ2I@Ne(39e$az z5Ew4%SqAMiea_5Jk|+)W6a%v(4^4MkidyelNQ2%J#^7L&*jpFK`{mUC;#UZmu_;yUYfJA9lMIz zv6KWsi^_gN5zSrROMJujK-DyT`;%VN+i2!J4or(9iUV#s;Q3WN9AAygip=aDn!xRi zE6^+U!C12k4_Wu3Pr@_X=d3ruSs%rh>PLST5gxDn(*nfAOEsQQE~Z6htH(D#c!|an z!a7LJy%U?EogXKS`1U8hU3WvY^tr1(_fOKSZ65ssVKD)->D;wnc_UcJd;A_pq_94W zR8G%BzLE!eeZCVHpw>WS;IN?q7*wnXyne%m+SH{K&unP(VBr=n?$>88fFnjQW z;*iK%80DX+(~`%Ybw~LT03iJJZjWR8>3X-C2fV(;kqYpMnzZP+4Qi|{2$DBYif3N^ zL)G`?uLl1VP1v-if%yL9`&DAW76S61h72}t(=L5ee|c?<*#kLLxv0UU`Qj)H#0v_| zon$0^z~fgLl;9TY$E+U%z##IHlH6K-|JpQtz~jRVO0LGM;RQ5(V9JLX3EllI56t)| zg;J|2Di*xsx%X$^vV+LBj`q#bG|gGbM?TYLA?+@(UM30Lvu7!2nl^j!E%mKX#A#YJ z%rs5Q2zpPL*6*W6JK3hG?~Td7VLci{e>JV_8C|DaTO*_%G3UZR;ZAmwu*=@{+kN#t zF5TdUym%1j_IVNs*f1bKqCym(RdXs?XYjC4pz%PFsm`$v;$l9+rT-97Iu8yCJd?gQ9 zE`5u!@gm5fMcPS>fwPj?@WL2Z=lVcWx}flUutR2R5B}2WW+smfO4!~}|9M@dq+(;M zRb}?VME@!g3uA`3SRGxlU;!y`RdUGr(CW(&&44g?qvlRDZuXuoJ-A1Up@~I8M{_Ig37tqV#H%0+lJQwZ`%LFg?HiA@QPbE8FU)X<0$< z5$mmwe`^uUw%SdY*kZ5v6}NIETb$J2E;rE7_nW)tDB7yR!9LxytZA%lt*8 z!=}C6^MsvCf0b_E{fNA6nVsjOR~YPGh?r`V8}JVLXg3^fa?iZo9_EvrJOFz&y6Q{s z66N&TciP78@cF{;qa1S_zB_FFlbyX5>-(ee4ZZf**Q^a=0>0yB=PA|4M-` zObfdwIAAu}*v&3?^5Lvrhim&eHg8;imYjmKjC>^zJm1xew)iUMD!`5t^!su%&QFCf z1GBJarxK*39E{E0t}WXr75`R-w7(SG@eWHk~IJ!Lyl+lYHw@m77#@nbI z+K=?3Up!a9d zw5*`_glX#iLDIV^wR2N42C@HYj~DM*W^7L_*d>o`5aCtOpOn}>%m%pR!FfSM5gh^Z zuhR2=X1hlkSEE9j%bqzcZT2F!Wm%s>0bht+@q=ral)%v)o@Cd3Z{XFih$=b~;aj}O ztbSwqI3p{BI~Oxs%Pe0p{RI)X^lT0%-viRlS#&ott9^EyK4@4|ia~7pdd|vWhcj@A?5WX~fUM@3pZarooP+`K-5rJ3Q~(Kza>sqgPXHfrY9G z4xCNwSMiyTyu4c?s!FW{bIyTJPG%~Fe1*<~GVqIhT!@M!mc8rB3jo%Sb3t2*_$oG0 zh#udmc;po^c9Ckq?I>u(oKpI6bcXhrlTR`#T+i$zDwlCHUMjD#yoM;ce(j)z>YQCY zoO^^-6_Sp-Dn&PGQ=J@PEE_|9ixSY_X&nW3Irna7Lz4j_L0+`hedUwDeP>Ad=ZLxagV(8 z&P7u;HOfB$II=OOyWEX7cjU*+uS4}~N2$a|MH5=`aYzY?RwGm<>GRb(dYqhJfBYa1~bjT0GYdXVBu303ouN6p58&sW-HXXxg~WqIuhE3yp!7dPjX<$&jhX|%a; zQJ@!)$8G!IN7g{wV^gMH`+ zq9kMf{Cma^jDXv)tk`IpBXbB_5El7j;9UZWP`tp)vHz%?et*E966y0n<^KOYKTwq z{VHW$m8>#G!J{+YVAcheD(u=8jWlikJmvSqfs&BK-xj)PlE5unV338jdbF2eV-lsk zE?EPHy&5)u>!uG3z31fakhN)PR29N1(_lR012!N2nnS)&gD0T z%LcTAZnES;3FWh{zpR$R1pp;DZ+E$l`_r;$pRY9HZPeV!NsgSbB!prsGDc|Ab)(oF zJ$^}0HnbqT3TrJo?~5?nfCA2ZWnHlRN}J;6M~TR+C`RJIjE|Ej0U|}qxe@iUFv7X? zkvlN#>pT)BM6CHrf|=pdEIcvru0(6wde=64u@$?j$c7dhP<&cg<#lN0ok}FoXb@k( zdKI9%-rq`gi?X3*01KZVRBbuYqBR&N>077FG=1*EyHS*aDZIH)PP*Bv5!Wa4^49Dq zM~1d|mJ40cq6~=Ttrn%F%g%Kv0Rf-auq@lif~Jc`i{;B;@1LA~>{e^L{WwkUd^C*< zS3)Vlo}GsYo$n^n{^HP*4=)J~Kc%V_RoDC~!ahN80C>c6O6Z0B|N4G*qDX=06GMG- zA)p|`YVN}1M5#LhDPZSzPLI>?-NeWK7@sH$hso%A4u!Yh$tA8yNzi65(mpS(f-H$Z zY$!ZxpKy?)X}iY>U%MeSO-o3S0<$YgtVdXX0d4UtIrFU}Iv~nypa{YS!`z^f6u&%J zEhZQLWJ!!OnIuSn*!eio;nabLW&S+9eAz0aO>GNR9w0+WdK9+L|lc zFGA`lA7??T!jJr5Zk+DxFmhovvZU9&e$Ed?0TmB!+_ z2%jtLx>Iqse(fZNwGdBFHcPM}omDRCwBwuTFh$a@v{$~t+#+-%=eB9U9XD~A)O+C6 z;Gtr=(U+OosHF#o@^I@ko3togE|ub9m?|qw0c85u3h=4r5HlTi5yrzK>^wNM5G=iE zn!^RFl$r+Oz3}O`Oz8dIG9HSMoywwod+FM+$;zgEp6t0>2~pz~T>!1d=n=rgCrSnQ zLfge2bq-$&Ma)JW3lB_QIc?H(+Jw-2P6^`-lYwIdTkuIc5VQqB!fEbY>*!&6(xx1m z)#qV0dk=4(x@`y&EWDAXN(Gbfy{F|Er$&q)MDj%SzJK4<96xb(C6fBMSlA?VMBFALKylFjxRm$4r;WfnQ7>!xG zQ>`lNnq86m?nV^7%rfyoqJT22KXIvMJZNhVw%$yZEZ(lzAEW*(Pk!Hxb7%B%t&NGi zzqA~nV~|7h)G@tCdw!YrGfmU`6bA%;zDOr>$H=*sI>%MA-@Yu$e}B6fe|4WZwj;-g z=?+3pL7n68|^XMK$OJ^%>DktfAJ_VccB1X?a6uE z0nB#{_sar%_>q=Eok82NmwpV-2xaSf^WBYd%xlo6yikBS77kt6lk?ED-{+wnUs21N{yD>ox zV|yx&Dq`h=3uZ+wof+8)nO2F#lrCLR=pwj8a#C2&9-{=-k;;jPNAj1&WJ0zhwnZKW z*#?vTu83%C#a}WY$A;K8H9fF?l3)E)6UTJh z*7TH$lhF#HC$uN7AaoH{r2P=RsI|}PjmG+VGzOy6BZ)-vl`P2i$gz}I;F`&=&?N z%I(BG8br$33GwXUn#5eoyo!&&AC4$K+cGy%Lp)=6Fh>#{6_O%R3G4-NTRxt?e_0;0 z0-Av3u0jdop}xhA3Yqqn`Vcv$0JmV_EZSny_`vg&6yH&Tbk>j9xk5?%kDNtHMB@_U zNx*XV2sI(&Y&V^IwlP#g$VCg5lw&)IVIyI6Fr_5d4iaf>ko+!*?Zn^SwL~HV2Mk|E_4srOuCP8T?cH1J+cl3hK;&w#(8b5Dy;IjP0 zgR?~d`TY!5oTMS0!OS|}w`V`!Sk4RVEvQRzjk+hssVb6ZHPRkx_TDDZU!7qosi8d> zt-PLI%aAWs`{cGJlJp@nS4->eho7WywK7}0q8+|%iXX4rq0_}!w8|X}h+tNu87@W& z)~=?qT9Z`6Nj03(XfTE)asQMdE+WO@L12Yh4X3(=MY;HBtNqlwVm7(Mr6!pA!NFzo ze`VN6OqlBMgbvTfAME){if@Jb2I^d{%{~wO;dJ{b?3KtAPTrkP*-C_O6El^;A7V?y z!nt=b7$+uq$`a5JH*i@!XQg!~GBAGl_;F(T$(rg_5wlS;&_)c40)xKFDPqbX-=>{y zq&8iMi1v(+*vWUlZDKtgeDnJ-Z`x~c}+2&!9=4hp*j2^zw5VQp|nOOFGz>O$MN zIm)kqP|Rr#@2=@`ktQYekit+yj1@5wycBu^nWUcz$i%Q2(6qDp<|#I6$;T!(1G4>#r7}@BWH83< z6u!nsJYkU0+s|KD-2%QJpXp`3902!vTVI<@NrtQ0a;NWdTW1DFzA+LH(#}@s0~=!u&#SgwV5vOG=E! zl9EsjHx7D(*DdOtUO?iyF6OLbdcjOVVCe@NRHLeMm?&txNJk-tp0E9uaW@Q^3G&&0 zyhnIfCw#N3_W#ExlIss2znQc8s)PLVxRhkOd_WL73~BBQKG@!umPApK4sDz_(;i2` zq?h?xjo=O6NuzZr;@&l%7&B|Ze`nTA@e4NdrH~kbLL)o#9RruFw1y(uiW*vsfr&g_ z5tLxPhf9A%ktKv#^tPN=&-;9B_DZrwE^kGP)c7bFc`X$|vyoHhRqDwd+v@!4Fj8wF zuD_%nixO-Q)J^yrU)TSNkN*vQ6IZ#UKfKhMsTeR)o3@{>56(JFm09vn>-qHm?!N!& z#|`k;=T-ar^E0WA4*B@Jh6B0-h*8)BK#zeY!Ee^nQBc*;K!DRJ`j~g z-Mrnd>t{JrBgnmYATz85PwjjOInmU$QeC9IDO0NB85b7&9=Rg*vRLtkwmxu zsHdn5*43#dF#7c#Lcx3*B$u)l_0`YastsDJ)%w`~DXyGbk3CD6%v>jrc2ltN_X-v) zSPtzQ)EJtyX;A^3Br*V|S|%q_0e(Rbk9NQer?M#x{xBu01?K>)ZUj4J3kEP3Awk zy!nX`FrP-WQZOO>+z%WX5<$Y24T=?m!L+C_x7Yz9zA?;^6YWARRNy5c}HiC|HrlmL#@SfX_b}nYt z#M}zrgvFX&XC6d0+_0K?zxcO!Rt%CTavX#=H^+1eZWi0P?Gwn3_k5eFq!4C3@Hfh} z{eKBga8S6SaAJ>S%9~teK0On814J>_teV?Ryc~{rVVv82ZjF&ho6fx1*{%`b&+$xd z!p)YHHUasFwyWQ|D~62_M7JX9lvDZyj3@?SinuyN(`m}#v>SYGLFRE|&CKC2Me=E{ zYilEzVNN^i8f`h$FVZ~Qho9V}ua-q^%NN=#&ae`q`N+wMz~pnCKf#VxzFk@*9rHGS zjJmyVrCe@$5b{q5*6><7eSOu-?b{#u`+H zCq?&NcbbB~XEEP9K--<+TvsG*!^&E)H%+*EdfdMiJ6Qii*3gAM-7RG{`c_wE_2L$n z6Thg4Qq=8zYb5^R*E4kqdzrGTwJ#8UsmQ-IOm1k;g-}_P8~v>{HLzj0UxqT2c($m% z!(?;%pB$>WS#|doOr44|C=DT4BrwP0;_C&HDI!xhdAN!2ui^-6-N8HZcWvq$IXMwZ z)GV2sx&?Iu_cx=@dvY)k5lepc(>fLZZe`km)QB=Dv!wIcS!zWaZN3-?-kn<4lc=db z_nwCpLHX0??(;Q?POE5sg8u{DZ~W26 z`$h9B!u!+CNzhlyZ)%l`Y~C6tJ3YpYw@{BcEaK4sdYe6ENhlKg4s zCh98^uiV4P6w6>}OP|cET2^ry;^ThLjGgHdlgZ##?S+4D1;WLCFN~elo=EbmpB1am zQ&#?taVC*2>+g$W{LDFqx8T(Ls1;d+u?&Bd89Rehu~eYt^XKGpNx3D;My-eP#UOsZ zvOK3so|NzLvE>Qz_SoZnDUYOzs6%VnaY}4lUM3e5VmE0}ZfB}E#Lp6$*FZ%(^Ka}? zZ;vg8Zc6O!kLvd0XXY=O{OYF%*N^>#CeXh)W;gu{rpyK|vquJxTP~M$(*$(+f3J)F zlQFUwT zUCFHakE^3jk1^&s6vtqsjH?3MOWM}7irDOF(`LthzTK9r2vBESC7vH9+J&SW^8bXxrZa(01Y3qmM?*&RY^8DH(j zw-4q9dTx~0?>#4!Ib*eg~|6}5(A;=U^p}Yjo7o}Hk>qzxAl)BtiMF;A+q!r1Um?_E%@KTEBD68KeS^0vT1G)ArfAgC%B@{!Z8TTi@PG0EEuFC zSRzctLrfyz@hMV5qh%062#e8z5JCtcEEa3Uk^5@O%I)5aG|69Gan=zvK7D@Xvvzq; z<-u*U=K62NTOTLfp!Y1_m@6AYN|s_$1S-m1W%HS9YroKcb7Omqpd09|M_ zLA14-#N6Ns9R&)|qYR0_bb82OdnckMtSlKo=0wJ{n2;PtNrkn$&ZdOZ-2ecFe-0}AsRP#2dQu&Y z`c;d&@go4h0hV5-Yz|J5Ps4|#2d~R9Q8O|~+UL@+u5G1~m7TUFQ_DgbVR6pB*27M* z#E3KL9oXK79usBYRs+8L!Lgy$z=ErV5cOs*aaEI zqD~KMX`N?%D-sQwxN(&+6wP${_(rdCX3`b_m^Lad01T6Q*R1`f%!{3TzNZAxlAH{x#L)@gD8qn@gbR6I zf(mhFsb~Q7l4d9*1$JJr%(Xk%8%JTA83RTZxGdMSG@0NX2NVYRUNZ1!Wh!swo3=TO z(!J`-(nwGB(fsOML!`H6q3e5PQ`u)tD1d75=cNZJxSg>%IjR2BOZ6{08NT3Y{=B6T zEtR8QlrzGcW3GbDcukYPRPyQ!btCyc;j%mCAKZPVwc=?mTnRg7>gw%~Hw!+tHc$$* zJTi<<|Fv+;Rk4Xq)2$kjIbZZ$FP|KNs`UZ&LI`>69q?CO^FxzQZgD0e@DkSo$7ml_*`YV!;b8X<|y76}hE#dllcq ze;)qJ%LAqT*%?Zk%N5>fQq80`|@R@B&xZnkp?V~0%T-!sCW=nc{*M2%YpW9nF( z_sV#Wi!$Gb#nC-c z6hjZ%gyM?43hn}WBfLLv|6w^3a6cEf22 z%6n(?U9DZ;tCFU$L$vsw3J&f#w%-|aJ;cd16N+MQt26>&@{Xj>)i+wXHzw!(?_K4t zOFr3v>0oPl_xv)TNv!HFg1yrwu#!77`$)!ZF;3cPJ1 z1Kan&a8in9xMv-Uv zy+hM$2FK^+1*F-Y2H7mjZ-Fh)q+ch6a)DpmlvV(U`^Hc)*vN8k)TZRM+47O!wnW> zRIq4K-D;rWaF{_$P=4jJOyyzj>?IIFxEs#uGIt#*SZ!0@G-*?ZISlzD_ZOj}K=;{W z-QLy)o7_xNiq}464fCmC7JAiU#IZE}X(3?s8R4`8zmx#iSk!lG$VUtte8-3{D~av)f+*DN zU~2kqhmZJnKA1>X`j}wom0yxU!Nq)Jb?2jre6E9u`i5K?Q3kFXJ8l=xW+xH&>s$G9 z*TF9uA#Rh9+ZfVS(`8`>C5`u?LrSlK*f7M)hT*7wQm$ozAVv%`@yv%-An8SD(-A$o zquGqh=`=*n=OMHN@QYA@+dacr8sN%32txdi(JJqo)KcZ3E5o{OQ8}Dhha$(4QnsziDRMzDwB1tKWdC}sU*l~6H9Whzl}W6&cFahQ%g`oHdyattB<$EYpQEZcQR33k?WvGYX^Ex@fk1y((# zJ8jBl_a^tnm(|+1s#A?r`=TAJVh~Ef!rpS_X-mBeJuP>Owi9L0+feA}%cbHc`kev6 z9uJ~WqvJFZ<Lm(AhTOq<7!jAZPAJCRj6GVBcmW5fo;_4U3u9^6kja zYcQ_8G0bFL=#QJ?oJtAuXflmVKXzo6@!j4I217G(Qk^7>Z_R!eCMmUcww#T3q@@&q ze&fY{CpiiAh%e?N&gK&*XSM{Ui7JhHU5PF!0e;c=sdf4sA2@_Zz}QM4B)x20V~FM4 z)t*k{SI93y0?yc9&}a8_mu|-i-T^}V_`f)9>n^m#Qj!1~r70UoOtHsP-GZpS-MEGG z>hDlpSqM?6-O>2Dz?uO3a@^ZYc(bgf60j=-nFz-AweT zZxu#ri;ZQ;%zYd}Vr;OS^s;fp#e6!{nT=Ey$u2@7Zo{#+X<1gd6(~+e=SJTXNJ=gV z@#C=mM*_6(O{FX~G?isNkxtZao?aceyO-L%&5t(S8-($S6WtC|lvDFxVajKkO13BY zRQjYzr$1wlfe=F6ww^*8JSGg#DXk2ssp#yK+QLkNMz9BS7&n@_>p#_LB5+;lcOioliA$5vN4 zK$@tm)9d6p^4KhZ{*5_Ub~Xj#rG$k^>g{{mj{E8B|5q=)*F`uZMMktf zwd~@S+5;#UI+&iEP9jJi&q7Dr8Q~?kbz_A#`Is<3#!5ch^|uE&a#E6;Z7f<{W+hoJ zi^1^TCS#n}&PL9Cl}1FAf5{_AmcDqArmPai=RcVY@j~pT-CpHh)1~&|Om-XzYd>ir zumqi|r4$z}oum~6;9|z_2Ocv1Xm^&mPL!soqjZJuDB{E)9lBfA=UD&>^?Ml~?JuMJ zTaqWLude9A)F(h}7~*B4=_KKCxRF_9ef1Z50$a?E3WbIw7oj8L%$0rzne56cK>MiQ zw!V>+;joKP7K38F3Gst|r%jz-t7FD1Op&oGNJL$(5vjRhX%ojv|!D<4{fxJ*{9_i#;z;#noEQv@#q z4s#D8Me@k)9W-o6S33RM^#v@92<5Y-W~fck?NZjzD|Hz`ny5NJ*J=u5O)>F=3*URZ z+Y5@gkH%wQrOo?2ta`s^O04ZkF8{jhPbd-*qwgEhu_5T@n=nh zY8Q8{u0MA!qyaEP@YTD!r2`WtdG*o@n-pIIu|WulmyKo<5~u8>sQ?(|biOB6DFsL` zLUD>GGu==Z6FUZNjvY^nY>6`LBDB)!n=w;*3J-!1KS8MK)kZZ4AeG=|Qq-ZmVYMv= z1=a!K>BX=4pZ9}|ajIe77cEcO=}0%eO#xBTf6U)z|Lw_tip|gwtnbC-XSwAofI7FA zT3Z7{YI4@p3V~XBTASEH=lGX9WfhCM9Ya6v`MfktEU)KBft+i`ee$~tGiQCCY75WQ z0QP`XewNSZ{l5axs2Eb0)g51IAz&*t{$);i*~U`0W8lXj=Ges^N#JP3h# z`(Bx~d!ks~?QWHAecB%_@?q^=N+nwziAaXao|3HwI*O(DqNECh@h^8(|6^KRA6tWe zYzgv(n8YHJY$41#STc<)3J@CZw&0`lAkI1zXT&&C7(y5}RJcm5(5Hvg+lf@1D$~%5 zD2hp(^x6R_*br{p$g@sJ_-Vhx4zngM35DMBXvMnLfi7Q`fhHc5WcC^LzHzKxk&L;6 zVUu~J>i;4#B?i+m6DP_7PKA`s+u1-USa?8~`SiXk&DMz$%+&xui2?Nq#xCYeit!5t zLb&fd@SrN2)__3$hCOUoQyAKzI#TIfIl6NDP6r8yl<^=zXENbS4T=`uYgeTB2f5R` zxdvY6a@YMHIYkU6OO?y0lr+EntVvFue|GN*>H*ZPn63+Qy7Xgt^>4)WKZ?c(rEY)Z zvi==m{f~vr|L+QJH7xioWySAAr+mvl;fZ)Bf-tKU?Qh*gb4vg^0Hk|e7atH)Vldl| zaL!{VNNoz;L~r;Cg@ixdLHU^2j5Q9`+r zy12$?&t6#wLKrZ`{6~p}PqC*fPY20p{T``#kfgf-z(ZH#jru?z!)x(W!H0Yz2E!qS zGbJ7z;Lh#K0|>M3HD4I&<}HKMWZy+J9b#4&mx+@OH!3+?i*SaSr#izAT>;mNauF zvXG>FUp@cvnY>hg`AYy_oVtkS(q$e+!z2>Uf4v1X{x9DXg&z$*8|Il(@4_l0GBVVv>i+aRG9zXPkMtqLn)vgyF_p z_LUH3fjv@5Q5mc{+xSq6a_n$v3ZAVU$4sSm`>sB(1-Bj6>ROj5)2d}oXC+k{#|7dV zk|*Yvew#!yq6C^dVleJ*Iq!9tLTa!;5+KWDilQj$MjhwRYEiaOrhkv__^uqz}ps)PlV#Iey2ClBiMZ%QMY3A9dUF74kD38Agt&eVC&tA zt~<-`{Xn`mt>cTLSZqvjE>eHXQ70+?ZX7M{QHv4}G);S>eKLyN+JXIAazwoe)EQ2j z;17s9(^7O^!jNgi_5A{0#*>m@1K8yLOE>5PsJEVbUKY`sp8Xhps(_vEs8nlM7R_U5 zEuEcuAEo2@61P9{(DFa>fzt9nO4sYXK9-Ye4@l4nOVYuA;JXA~3pp@dFkd~O`?5CBe&Mr5=|38Yn1HA;KvhhAQ>bml;~|MyDM#*Z5nR z4Jwo%@P}0>17fZ{nLiHuw12IPnGO-)OR~U7;=i*eUNx%mv}2m0Qh29ohH>*~Mi|D@ zIA>5QLf9l(-W)ku06p$YH4=sed?4f+DKAxj#JU1 zH>0ttvnzWjf9!5T(82#Bgdt70;^$hgY}w=W_JPA?4L#gr!CE?9_F+6ir0nzeD$M_D zRl7SsaZ%m+U*VU2DsB01g;gI*mkg$6{Jx{7LbTww9zK;OPj(l`E}jF@m`cC$RGkbCs(Q=Xu<6IWlS0G-Ik-ED0UY$=aU+Zkf5=o)ZP@ zID2%~a@cT9x;}sJY~UZ>?)i^SF7qf9sA?%LsaEzf>R+-l96e!4=J!#mp@%O z;fVx@2KSIU|Fuv=tB}uI_{@ATK3yDr9-&gnus^pB=v0f?Yrl!t`d=)L*8S+00J>6s z1i<)Cd@4Hn4G;SR9-f%T=gnsQwp*S5lTYH&+0ZIU3jHQ3pLZ@?d)!zVZ(1gTypV{J zEuGyOFz~7-S~aYx>_NRrHT^WP8)6}vVuQ}P5`s5qLQW#~*;CXto13V)Hv<#($TAv> zB)|G-YfRC+9!=YY1A-);#4oCi=|Y@3DpY--(kb$DY)~n@ipID(+AS}rQaK%`-uqh8 zwGu;(+>0X(C_`z0_P%vnM*~7y7fiuEHI>T!>N@?G<|fQ5G;ODx z=<*ials7RbAOs4=w&Kj#*H~0xFYA$b13)ZwNAR1EaiZ7G-8EG%r&E`@UpvJWgnGk` z<^Gw(OIzVwlZ!a`BjOyATZi3D2hXAeD2!?(`G7A&DPcn6#cx(U4IN}%i@PpSA;QT! ze8QM;apL#R-Bk@1&}%4`oY{}z*O`swzNyrUiEyUDqQ;(heOvB0@~I{V8+s8GmyuF` z&5NbFsm5Jt5TZ$EUZf7s>os2(?9T2ZOf9%1!5E2iDN6bYEKrj9AwasLdSA4pv-&jE zJ?2Y~QwTGk-F>UqGSgu2E-`m?KPWOMpG{NrrmWF7RpKbep+0J@}aG+%><}XUApMfaR{8& zH(bBdzc~5QRNJcqcn;T*Uzq|!M3{B2`QpfPU6+ndWB$BF!M-g7`uEigxD$hlIru_H zfnSWfaiT1TR!wgd{$5w|#3qp7IIZ0i$7@r`epWGh(<+IpUXJ9+laJ!OXC9P#P46oS zxDsMfVh{&U2EibS(jAhgrbDyEPG4m@`@=&Zjma|tsAp@w>bsLca2VNo(x4CbIC2YX zV6&nVmR4ac5#6$~JUJaD#dU;|*RHq{z>s>qj5<@?IjL&?(gR0h-t^8W1@i)qOb^*V z9sDHe*F2_J3)d@I-F;xAry;9Dm-J6PDC2zb&_P?!5W~y!uyO{|<%ee|{|Q`DcEt znLfyA5u!PIw7lKl{lSyHH2wd>%RbT%`+e!Kj&ij{;(3HgbSr0WHSVw{e`lLJ8C*Vl z_+T-F_)b{TjQy?o!2T=M&(|k^Yi9q;)rn6;+W+IH04e6GRXTTUUrEeiP0M(I7Z6dh zANZdbPk1RGR!b9~kxkdh&? z^|WD^X!(H^A=mQ~sA&;EEc&Ttp};4SMLA zhfZOGTi#hwZ`Ew|7^$aLpVBTnvc5j=p+8I{!9O9c*>tvM84M>U7y(jmYkrwzPgjD0 zilQhO8^Wx*&KE~JGsh^50QoR6RUOX5X?ZeCcHek#I@J}ae8aW-c%zR4qB0sQEvpZT zH#u#&ba+W`K}ESN0Vpx}$eq+rBLiVV#bDHB_QLTfBd)?t+Je3?!1M9M)Ce5YF^mBD zYHMmZ9|uJhbi3kAx7`@CC&T@3V-Nj5!TRpQ+G?VoH!R5E;fmw>-TDxxu5?9bV@*=d zZ{Pv#$EsTEtH%+h7Fd#m7>RQUT%g4HalOIjQp;OkL|Br>>Mv)B#1*(~a9^KthWZpD zFdASwAGDuE2q-^GRtJct9s19_@ep&VV1ZZ6~|S9DV_Otz&{d4$mw1S1yxp znQK1DRta}dNY3ND7);b|S0xsIm${Rndl{qw!lmtyq7t0epWqGG?!)Y^J-igXSyimB zmtBVt;w$epf25!B?6{IYhYoXB+GXpeGc7_-`_2}7?B|gNBz!UMwi$4#@+Q)eqkUx? zx9@eR1t2kc(<;&WfO`{& zzY$Rs#YblW!b!iu>o&oRI0?pB4!GAjaTWnOoIEk-sZzU})L%^H#wO&P671Fr$R!dH z5;aAJV|WEWOMvNi%XCoWHUMsUEcGk{L3-`aT+VE@^apw5UBFMJ9C#J$$Eurgt;s&M z`ewtk>d(49eF^>@!<@BrQ~CI(0D4jXax(Z2?9Kk2hbKH0AHD3ubcDE7=iU-?^0&Lm ztS0mG!O;_zBt8D@_sM_w=s96-g%HirqbDv}e7pRE|62Lz(JBv8(E`5tf4TvBH~CM$ z`0R4Erv!!&U$t*{)8MJ`|9-j1qocK$OC5P8W(&(>#i#cS%V} z!(3W$iKnwq)Taqw`v%@yhNiQfx%N1Pm1NFj4R6dIejeh^Ax-W*>A9a5nb3xUhUh3|>^RZd($D1@1Io2v|P=l0<@a^uB^^#>fWE-5~%&Kod)G=FWw;S4Fi18zsQ> zy$T7kI7N;)p+fq_z%pEA3s3^&LElJib()3n3pgeUb6*=XNr4xq5N6SJ{(ONwPPkV# zgH=+UQ9feotJ5=2eC%P0x-gnQS|)g7_OZ)t5gcJ^0fZO{b7>#AK#vh3OXZ$0rs*|y z4@FU8&@-REpXNwbQm?ipk`P8P`5m4%cBCxfw2Jnia}6d;bx^B&-SH&<6JUZ=S6aP2 zWkx*B9Xv)*&oryWz*-Qe1Zc~IDJ-ZU1`cSJ&Ip4TmBu;Im{M+c>Z#JH<^zY_oQQfi zwloHKHxjaZu=jcW=8y3yenbQ23uX~-Xk1!J;nPZ(V!s2@&t)$)s(ipvIm1NuY?+u^I5v6N7%lEJj zp<1%%JS0!=H1^1K;6fjZrTZuW(sdeqYY7Pl6$O2?4=tlvQH<+5ci7jR*@x>jf7~*M zYIE3Tl~|ge&XuFRwcLv`hBR8GH<#ZLfdrLje4Feik$~483b$D2ZZ{EoU3s4-2WLaE z-?*Hm>MhnCJ#1IhZ*B6xk*ugW6$!QX;whxrYrLfXo_)0gf2Pt-=fD3FpcgeB6CRfB zWa&6akG|9(JrUFTss6VM$Ji=IGJOJPL1@Yc2oX z+0mnyer#XY;qLYKD}egH`bz-cs@z*)2=UeX=$8O`sQ2wW4@9;e*6v^BG%b?;c)z&R z%e=3|BIetZGF!3I!+QPJ2&al1$#;F?#c!Rvo1D7TxlD1pUIw~z`_}gzG+~mdp*y2N zd-BDj{-lAozc!zHU1keW1=MuYA0@VAl|4Yobl%I+!1#s$JR?KE>L7-&U5yyb7j?Xv zXxfG)&2pca&^iyeT%7lE`g(HvsKX;H2Q~+rXW|kC$MuKp(Jnb)@Z3?~o$Rj)1{$`j zz%Dza=9zytzs(547{Wkm)#x8BCMh_>aU!T@GW-7d<;sOidW&_G3+&J85b6nGdJLPJ zNHAM7vSXAC#0f>PSwBmu?`cY0f@}51I-*d@8G|r0a7?&QtuDhDHo-G`Mvd6qoZV<8 zh>xDA8)T0dUs$CZHTP`Q)T$^MUmt6CPnX!^IKtEd2r&wwXK*g<0~aVUvZ$8BdOh|i zmjWY%Ukzrfx;6S4J)`E(vQ;rA^kcc0IcK6&j!ZcbZ4}Z7&zb&-UaIJ)E*$3*WojIM*6Hpzx~9%IMG+Xjv7-y^u4hqCzxvz zrkJ9r3|4Qv{!_PgVR35;@hib;r3h0_2od0F-p_%D4Sq3-V(9LgL?SyXzmpcDH?1tK z!0JbYK~lSSu6ilwY6*HC*nbyV)*+NjcAUrLK&7*b^{2JLPW_CTefCX~pCYLFrr#|S zSy2o+&+eOhv*J90>otFfpiN3LzS-wW>QX z=&zTL9T`y>w`7^nc%R?|}d*<%;+CpV~ayJg1zI zQKc4Ws&u+#zXpq#V^7JH$}Ou+3)VYbWa?`p86J}8dOhbVPWu_84$u4f2YPb*(%I+Q zQ>w-BC+l2BT$y#By-MT%bg$+=|*X!22>8Xg+s64#0qs{( zNZ04@o%Z{q+g<7^eB1KK*LJW(z0XH>t2GMxOaq32(WWw3i~|NF;L)n9J&1jF|K zwtnd);VEC6b^p)$Xx)!~380%=57-lyG_JoTyTW);^Bd&EMS0`@CaLy-JZkoL|B6vo zsy`+a9ta81;JtaWC;k6Fyv$?$kUy9X>!{@P4wGm+f8UkjJ+l6XzD;dL*FRZ&BN#$_ zCoXE;=Q05!mvz46-Y@IFjh(be)x7&t0BU+4brkN4o{Ibq^BI()DEZu|^V~&yej6UmSGJtsTalIk+CZ~xH!(*VEw4A>fzMm1-SL@YJje9!p%RVuf*vwsgey)O^w3_1P9esv&{s4R>cAZnCCffA&_jgF&cOL2 z>$9w=$O>p2?`>kLIb1~2^TZC>eUrhlrz={Sd!=i-j_asbb(pmh;DAORRJig4oKS?B zTFu|ibA~G^iXx1Ons5BwGLaVDpr2=JQ)AevKchqlkf}e9CoUthd|etdycI5|0GfJr zUe!}Wa=?-lfDbT60&#N$E>I#dnD#T5+Qj_PH{vwbXpVwRkCID<_Zw5rtv)3}fk;s= zqA1VZ-7ja%=zHu}cHaejtQ7UG_Zt|@@VoGatoOUlw!Dn+q!9vufs?qNqor&S3C1S` zVzAyUU#Dhip6F#fOZQRTWG~C0>e!z4N^55rA&8 zuHD_;P3T$={Ue%FqSxlP-De5(Jfu?1e&KCi&C?#KIse%@Ty77#_mFj}@KiMievJmA zM|#V6SW;EovKaFbC!Ucr4M?^7=AWEYmw6Nm7pwaI-Aa`Qvdcc^A3gay(NlSUPFzwy znd!gph=c@Q3pog%KldAJVUH6&VM)^TKStO0DAV~!oMJHGuRfpnM0DAQp@25?g5P@d zMilPbM*kiUPeP{))~hGK7@tj!p8RcKRj*mdSx@`D*?+G;vjr%Qer%Un!_`L&ueV+kipQ-Q#Abj;n#YxqYP`=KY$mZnMKm z{r|PPxnb_yu>$JwFw21wLU}q9m9muvXzp3sjvCBq9{vh_n83d5|Wu0 zE(C*VoHz4{&$=+y>o|G0DGIz?yuS7A_a@p-Jp?fCHwWUmK~DblIjd7p`V z-jKNie5};zp0(~oS>|KMV5@@gSZC`0KkPf8&ETOz4#bL(15(7(X}{~~$48RMQ!FrX|J8tB=A#0dS^9=Mm@JBlGd#^j)(tlv;S_h|8BGYJp8BP8*b@T`d*cA^|g9OoA1Oj-*eUL z+8#urRO`UgF2&VtG*RU1KvUse^Ez~@JgZHp;Et>TO%HOp7T@DKap|?5s*2vWdp?7A|LuMG+j!67d<+diLijSbneJF4PD;4soqrG~@>xWSpQF3}iCGHs-cAeXZJ#K$wTJ z&|9N%1JV0yZ@G(dpoYTGDoF5w#hQAwQ(fH`1Au%~|Ai%}z9*dqD-V#-u&pjExdx*R zXBrI7Y|#DPSt+>&b5DThp}_mlK5M#k+Hnr8L6{*pHR$qY>@z@43bNoU3hxNI zc`I`EnZeE}peRIKC3r1jX2xKD%`t33WI*>{cts~YYwxPM>qY==)0oT7Jx|qn??G4v zxh-%8fzZ*rHxx^YxS}Z5(Gh>b>$&S}--}aEH`GGfZk2asy;sp)n~F)2YZQgLR;KD# z55fEtpkM^#p&&(EF=+GsuF!X^(9@gEu8x5iup=8^==2Z5D#&et^l$ROl5-rbJBvT%ve!U2Vq!-4#(Ro9 zdR!gfd1C~#58o>MiFvPkjAOtc_@Idp{MD?+ZL8G%OU2Q1-4k4u<|NDaIgb~ z>g{Jn8*CnUWQ_S@zCBR}rC>V1eB1vbkd|g3#1QgOfXfoK7wnt@n&N>r#I&qR8>mn!ZOG%wZZ9mBGm>60W+o;*qB$X4uQB`^wd zOaA#@#4j>wI}`U^Wp~+bn9SkOjtH_OvG1=Pjo#8r1=*ps-U zepZIoWkYdr+EGjXC|~BXRH8uD0mloo3DHBXvmF*D=vebQ$SUCxGSdItmXGa{|JU5 zQk(C5Bkv|C)%OYj0A`rHP2g11dk~mRpGYFty~iUBu!;`{?0^Q`tvCbB@r{bFpt@HL z=eb)`+jRxd5g_*jU>*wo3>Yv_VDj8CE;R&WK#4)$nTM_?IkW^{gGb-H0T1Xk_@_lT z1Q8lS3DR@#`ZVH#CIrtuO(Y{PRYFK--8!G?qz!FmT!{WP_G(qoc<7kXOo~?7~WA#<9 z_(AA`+%n}a@7{de1!?jGbV>ex$V~>^F;tlH8)jUDl@F>pIzJue3c;%6;Y_17+RkYdbjq<&7r&RH*OWqdh+^ z6?WwqUQ8hGGOWh>Jn025*2$v7{U01pD$WYKa%^*WF~f6=#988z)PiF;wp15_g`SNb z+c6lPPcP1r?4=f5>J8#BJ{7Xpj$Y`N2l4RVZT4U4;so7=+?97jkW%7N6vC_mrTsZ5 zy1p#?0gJ_1uN>&CkpU1mt`v1t2J%CgxySHn9oeGfBK4|z;faIC{jeB*dln^14AM5{ z;{`;;%h2>Ak*K-N6e55G2&`-H`b@wl9Rg}+E8h4mjNXA12xu-&#$t0Zhk8=cYP;z0 z6x+7tx3=e?rkX9mN-avLgA5)-NlD2?9WS!tERr`HBL5B7@AN0{@Jam|^+rrPoN9Tq zXn@BoD?Y*ozr{0bkji~;KlV`vMThJr_fb@Cwj4Z#0fB3GCyCoui-SZ0At7f+JZu^Q zOKzO6%cUI*B$(wCs{+J+Iw7zwf3JjGB)~#r;M#G}14!!GeI3?mqO)>4!*0ItAWFze zEy_)jKZEmpI-b~yPF*&u*^rEkI0ZR8ugH^d13ZfcxqxTbV8Qfn{bD>dKnfU?DrSPA z#$_5LbetXGPq ze<1gg_(%0dO}8L#!VPdT;v=FcY|ELOU**I_geq?05I1l45VLOuasXp5A;4O7(hw8$ z12qFW8}Q&BHmk#A99E2OrArlHh_N{<1kuRCM@c_>iO$)ejPjFJa{vF=s^i)yZ@^lF z>p3t$>~L6eUidJkhH==orrSM3ld`q0b-YpPI7hZnpjr>61!L?&FwZvoj6sAS-Lyn3 zOFBoV!f~dyP=IB2Sb589{7n+sR_*1t%y2n<$e>pYpy_sQ?0t8N8Mz*Yo8n;pk z@0T{8$#gl#UDu=SeAj+;8u9d`i_|!K2Vu1~s*MObtWki>M=&>f0^sS%RLiXHXPKO8 z=K3aMZa*pkV5os5{<=2dO8o?W^yr1BsFI!6Z~m|b3`&$3YN|7w3>q!XFG>I#?TL(< zK7JM@C3W!tZ%0JHNAGk^lj+VVu$^3q=^r5EnBa_gT@MDWgSs%rPMdc4RG9NTCXP(< z(bNbJ-=4;vefJGp#%iRne|%h5Z@vXE4Fuv6oIQPnC)^-P_z9$_0N*Uc*Zd-WD?)k= z2=NhNG5Jg!)fX&kQK))T6X-UB$s<4*7%%$h-d$DWuQdpbSRzR`fiBIZhE5xztbuDOJ%GP!pj zwzsh4Q(>Xxvoa5`3QK(p-GQ#M0JW8 z7e~3qFJUny*vT3O*5MGw5T^-z8^1Ogs#g$eaUIUhqQ_#30guOZs?sLTt1e?GdsSExX)5D50JbOW!I_)W znvt2k`%E&lJq$vdU+ue=XL0~CGT?uj1cADP`U-#24xhpi(m!xZV2TJ30xTUm(BPQ; zPW3{1zCr=glJpzC<>Vb^ZCA08&>C^7peU+z@$kL|%e?kX&j-`#U8gE?>kg-ykOqQV z!Z$)ZAw>lsVm=PQ_(ra6<9V$g50X|SI* z9o&i2MfH*aMS-UK=GgOc2zz!k8~{*6lp$WKP8L8pu)>PQtxI&? z{yq_K=&%95tEW?bYlO4HK3EqV=0xW=55OE$&`oO_^VS`jjcsJq4UgDM=>Y|`1OFxB zQUGSA_?&)7jV{>yWU)u=c)C|X?{J$^EF|QNePCnR0>vdrks6%6hWy3twK}ie+pUHW zK;Y6)O$DqsDPzl8^~^})Xv}4g-+94TzLvrY@zL%)+1d+0yY71x+P3*({!ynT~ z_MY=ZrCM?e?fV_E^R@sxf$Sv%ib9y5!$%uBXG7;|Xx&w_8exugUr*YiN0|#fA)s1( z?y4GFwp@aAtula~!TlP0-xloJ2D;xO23sB*!>#6Wi$;36KIK<``v|1qJg?zGO*vaq10el(vN8O!>hPqb27s(c z_$#1@w&)M*DFgp5MY;*}h4d?!B7%(2hrw)Po;^k3>hvgDfgTfr)148V2zqZZTb*N1 zQ8+>x2mpi>6@Uo&I0)HaV)4m?5bZp}Z-aD37{c(0N#UJokE+96s(I7aWpiJ&zQ&8a5_LpK1bypENKTN~- ziGclS(WZ-4C1MZK+lJ7sf_tN1zn8;x29z|y0nl`xNJs&gd7lx3@fA~GmXp^_0D8^< znpTYW{VR{y-_!kaO3*2YH$zTR;QNLFePhJ}#U;EWwfJMjeo$S`PdX_`z1CkZM6mty z-=y~J41`%u9VsZwxRScKtR>o3g1C!JqM^jFfFhB>y3sLBra5Dkq<$nYMFe8dGn>C1 zoH$ zH@V4xM(?ahWkg1b9f}Yt0-o~Gyufy58fA!mKa(}1=0@0xGd&_Abenwiqc%ggO~(M& zKq$YZm%eSiCTb6d;|_nUyy|!_X|d52#n)kt{@wH>#t^3oa=sMCS#n9{3&VPbAyl>m z1(REhL_DEW)sE?0{zX=dp(bQ{8VR{G;hD&1xQ~{U#T+(rqj=zTQe;Z!j2tl7npr-5 zVjT??HahnWSM0h8N!ECMV2TJz=ZzgOA*=tnPDsyJsQaNY^&7tBB)0%zrVeuz`{T?{ zKvAV0hW$oWcgU4InLQXja9NvYy9GiT2q-M!1{q*NmZAb7{MLN7z1SWj4$ASwWW)!Mi=DjNFgMti@}ZPQl<2Z3{QH5))F*tTT&X7AFxBIz817NjyD7~uOex%k>P-fUVxy$3OwjDWjM@o&7@Y@hL4l;S&h@5AA@(!qFPtp}YVDF?v zVouUKx^~xoe$B1;TP4GkY((DYN4@+>{Az7jbI(6MADs_jZuAI1Y=z~?c^7k`XTvkT#PkmkQbZsIlPP_Vy7Gw{ zO`7L*L4GwpBA)16dxY|H+9`^<#X-Z*YQiNGleq>_{XyX^5Yj+EVF@?rb)4AHdPS0= zg6j=3mbB{$!6{BiuK^ezu5{sOp}tVH*=;2tMjI)6?bz8+WrN0bp-b2;E+CW$`fNG- z()lR2WDB$ts9rMAMD(^cQtjX4%d}WW7eWpq8A?!RALfux-f*2T=xOF2%`9 z_v=W6gUoo<9Wj`?j$U&xYqU>B?es+qI^6lsMUK#aYcijSeBjCdu=q}-!sYE1jTG`> z`{R%bxw*-5qv>%;cGM+ES zq}s0ScVjWiZhOXd?$zDR9?I6xV_|frmFh0*h)IsN#8?BcdeYhyPS>tX(5iMN)ICW| z@|NPh)c)5!-Kp|k`^xl)i|JN(+o2s;y_|O5#FJ%m@$inDM zE8Shz9L$Y9#m63rPPbC`Bss}-esN=^zP3cFl1RR~>%puIYe8psV3pn0b@vJ&0i!dm zM0Z&k7(Hn{F|n_dL*0|)Bsc2x&e6TRM#_Bc=B>XY#m~22(j@tq8xvT1uM=UF-L|f- zAjMZ@xO4!Zy30yq^rZD%L_H35Pf{eQ?MhtsZunf3`1Cv`7m1+$vtrW#_AVdiQdNwy z+h#8JP6HI;eB;yMJkcWbC^Kesmvxk7d5oU44wD||p>e2tk|Id}SHFldUmMZK5!q2w zPb0xbbNoL>*=;Ad;)d7(-ruEiy0&5)Fs4T~-Xe_7w9?&Wz57FaO#`n0t0%3#G0w7m zrQ`02x+jTAuCGlfG{L35dZoUW`FmnacWeX+u+Cf~B#g4#4uSL+lVtLvw~kY!O~F-g zWszUCj8!9&X@%2ez1h=A9}odnPg)N=y^L47+}#(W?n!Vb$NuP%KjArj@eo7Kr zgVg|09sA&Obo6KzDn@U$nx3_H;^a3!>fHiS?}uqp0FX}$AR3`{^IY@rpNIeQ)+T3tOLvL-U@F;O&?3`XpJibY|U1;D3I~IX~)`(&{(S+5LPUy2atJXbcSvfSaimE zkXVU(QdQ>w5IpLPU95vG-L98ar{h@SW;Ef+l9dbSf-4sNHrfUIwxUMh+O<0xQU5{! zG!NuWfr$<^r~rXwEl6AcXUs^US2-XF5M(?((BkljovhU`3Hn^-`K17QO*4f{vHWG# zuU>&CQ&ujZ(kGe{$$Zlgk8*Ak%iPl8QimM{ezg+D`Cf|w<+6?kttGjmUrZraIUq^2 z2dIGg5TGiyVw5CDMz#%oA|kyCSrdZgt#yTRq~tba%gP0`6Xnb|4e==FZgcz=;Ep4$ zlwe|)mO2hB zUq%lfylRGAFIv{DTtL)|$E;wu>RHLXtXUWKB9yTzXPkbQ=4CU-(Z*nS&G=g4biYoN00<~0_OfQ3Xfd{TafXCP{YO|nE2em$*VBN$XdSY00Z~*=YHLdaVb}B4 z5T>~M#*|mA9PaLiPnb|GUKN3{$^o&jt`+N2;Ma7s0%oOk2ViF6>BLenv#_^o7KXLMU#M>4I-;1yMIMkk{g9kC>*nPRm{{dCuij!_kosK84Vf@It} z{f;b^vTW5IoZOC7C=gW5s>mX44ZBv!biez~mW}6C;aTvRjCx_s6L>;_ZPk}`ljR7bBE$2 zMdcysT)QhCntE!6n|!9jm<-mtfvMWY7uu8(Y!K8&V>VF%ExswceyF0Whk)kNv-06MgW+cun zDc;$UUEeji+K3D_N_oDMkU>%H_IE2jf*{t^Rryp~q+DThSDvv#Q@53lbx>FvS+_pe zx#waq7%+9MM9b_#rjUrN5`&ak$Au%~lO545TD(&Zt+%FnzYOZJ9l<#+M{k5#+AS11 zI(CuzVz{ByFzZ|vQ1h$Eu(?B%<6Th>rAmWkRXg=(4VK)?7DOl(GjQR^_+(d@S3o~ptR8?<;!RUt;IDyCer9;}r4 zIN>B3M6xDs+WS-G;(41PA@ry{+v~R*kHVJIG|wu^g~{QrD2Mp;o!RAF5h+0u+U;Pt zw{`3wH5Tig%6-x?w7Hj|t+%}Of=(}yCdJ3>o_SkuS$`xf-fxR8pgm42Xy53TGH#R0 zg-Nw&_gj0#>r)l}KVh9R-*)b~N|PY_we8vV&m;ReaSAx0SmzsL)LvePxQ>)A@4jrH zm? zduBnhf7*EMECx`;WVNsdO1Fa=9znX8TpQCOIHZbDy=rD)hKOWOT z)z41$_x{}wDAcz%KDLdy{Su;JXfd^=X2dnc?4`GJ_CvKKtuAzcZVZ z0R#emx#6HQ&ZUGfO8sEZlgE0MJIRp?NKq#RvjOG{HG*VdqNUs6vVuhlSWi<)jpDi5 z(ozcS&SI^FmwpyOX$Uv!I&6o3rxGvzn8?uzZ?VGA=cYA6`)o%cgqaX5!$|ySo{%6f zCNsldQ?4Kg;*=%rHrHRi+j8Ur8aE)9TgoLV67sI}#ur)@lEIMO_p@jT7A#V*b}?7f zn!H_+>nlYa;UEL7GY9(7$PAp7&FJT92>HA(v%F{Lk;JdhLzIc+hso4?^JFq3NTzb% z?YoAS0CWHlE0%y<>~&NYUNTu1dXuY>J1MjdA%w8}8*Ouw_9tFAiV3sHbc%UW{2~ZZ zXyn!PZY*4C5q!&(G4M)PCgNT+9!HmMN6U^*GL^LI;Z%3y;_brvS3^~I`f zz=R0>l44ZE5l&w;=tS{1Bb7|FKeN5g5zm+mX;4rvICV)05T`5wL1ZCU`cvyg+lew1 z8hiG?HWRFwn4tZwA>hie)NriEkbC!P)D1y4>-Nrqrpy`RR6)p-ee~9Lby28Wkqr&H zL`f11=d7LJ$OR;hX8T@&2!l=Hq*pBPc+r4L3?VW0xpppnu8tI~94|1~^eDH?aD1d) z4yEjh3YKdOww$UFy!;TUzH8Gq)yAd14!bcux8yO8q;~VR0c}7CQHTo?Ehb&s z0#4+fY=rf5AlG_)myg|*h^f^mp^o>OaaAC!*Ma;N)LyEuUpHV@+C_K7xq^z8SJZ~a zKnnYn7<7<3y^lc7#P#poq+mI7^hBM_bhBRadGwW;VX-p&_sYdkiQv>Sn$l=KkWX5qYoU)zZ$OSY@#&E00YWck`Z1fj{pZ9BALL>#_-sWp{Ot-~m8f-pe;DUM9 zcv*oW1q*x2MV`2_hLF^55ZXAy$*E=sZD<9O{0-q`IqkQX$*yq{29?9nNv4yDj`aB; z|Di$yK0nW9&6RCp88i>`T(nx%pNb8VASwVc1l0acs#i_#K(sm^ikvonni3$es{`Vc zF9>OndIl4s)h4+Q=siPrw)ek@b|^?vB=DdQS4PBHiF-WVhz*D`2^h;-jUo7~p8_(S zv;5Q0>W%?tGr)Zvo3w1|9@WwLt<<;c)JUKRJke7WC4kvf08<%=m2?^mbI70OL7=wlcIA9USo*)#QHdg=3$!X zRA+#gYmJq`r)O(^?y;XkE8rV#dy|obPyzqcu**M=bv4|Ty=231;VVIo2uwCyH8a*n zdD3VDLI^WiXF5|T;m(Xq*17H^vSd3B27&XPJZ?nzdHYfbAq?y-XbL@lIfR%akPVMls#;xTQv-<8Xwrs7`N)_lB`E-|fw#3b2DA=ZA{>*(^~#c7NqtyY zQHHrI{;GzZd~ARKErKyAiATnDF$rlIPJ-MTPLI@ZX4ZBR2;fovWBTb#)(Hk-`BYO$ zjpDgk(^8s?X#MJ^>^DO>Cc(7ME2o7VUlD}a@CRq6u7;D~n@G%dyBR_ew>`1F)t0x^ zq;c)Kz$~ZqOc(??T0YIGRMt5rLFWF7ccYGlizh)mtWjLGx8>5^nv&80%HhZ;)9FNe z8gy3%nV&|a7q+p?b@GVsRKfZxo97gdkZm%*5c{Y55@>JU_9|(q7lYU8BDrcY$9j_g zRW~b9${9?!-cTtVbWn0*tp%t3DkW_K3<_4E2p$wwWS0<(6mZ_XL)O~>h`kzH`eh)V zJ95mb+WqYB_bj&9kIH`Y;68WlSH7A0x!ms%(d@MV>s6p23^L#J+aR44hOt7X1tB~V z(o(h6H5w550H+-v1iNpo{be4#goSiY|7TEB%gOX?TIb(uw+AW_tGlMg%cR;`*q1E!x| z8Hr3*t=Gt>4yJI5>cbPVvq+%O(AIq4*O8MF00)M%vmCjAdRxV=1ZF!}!OFe39SP_P z)FrCuU9lCC)Yc7=a@O}h9%htF93cUQTfDM|vH8wzH}DE9>Ic6;dgr%`0TR{OwI>el zCc`l4CB|849Lw*ep$bwr(InMys%hGva3X_Hf^>(EJTXvmF9V}=YNQ5*s}Ur#ruK8X%U~v}=`i}n z0K`F!2Ga;f86>$^tD;%B?=F##8buGY$L4k4Xo=uK22NhQmw^e~9I+CZ4LAD^w@nG4 zje>(s^Ab~nxPdvQjXKmoA@ALMym_%kLts+kwW8PRfH-IzkMg}dIYGFkyQm}ZChkaK z7TR^``)tNS4eH{FmtM5Qjx(Gy0m`g1#@R&X#bQavm$`JJO%pA%hJa&pSr&TUWI`Nh zb6`j30}os3tQ^_N^$^1)lR>p>e0`kpb%t=?gGsL=`Rv_zSoho@%tCt;y1xu~tWHDd z5b`5&0z4lI%@=jO7)zEq7{5!x78{U3Vw7>plCdzj0Q+pu<(fg{(91BI2a6|9bYP@G zov)9PV?2pV$mQ!xGH;LbiHE?Zil|I_@LF*1x6-H#K$)#8rN^Sy*D%3v6T_H;O5$Ew z3%8BlUeLj8{j<=~NwuC%cFU<9py^J*{o{-;fWXPah{R&e;OW-cjM%xw^NZPLRS>-a z@bqL#HRtA^jpFe(fenYf1j+#fuFbXE0UNA}%BJA?OQKvPAfScW2D!^?T%BrkW!W#@ zKxJ)+cU$qphaLgUatelVonA4LWiSD*3nP}WZB6&xp?P_@MU2$SU>FVCpp1#q?J5$L zK-$uiAh~0?lnr^KI}2vRGgleT`aW=A$k&^aAPQlOq;H!v65j~1#lAsLL`?&w?}K#M zo?MK=BZjN#js60km3~qw&~9FT0|2sjl4WR z3%)a)o{@q_LR%Vx6-{lnaGEC|B>)i$4LX}2`q^^;LO46gkqbzhqglit%amQ%e%Jqz z<4)-c)Fn#q;ud;zXUlo_-Z)q6m-Vp*A7$VByU^CuJEwE*d7U|~2{zVnxA&J?dsoFB z=V4|pG-9H4(Tjhx5BHVCG%;@B>H=`-JBdAuTKua{KQ3 z=MIICC`>^V8V#AbVKj+n<9TKi70Gg*xY@h+^XeK6{aUA^OfG5^)wn>a!%PpqD>NyQ zkRVE0Yv0$nST`TdIAkD%f4Zr$s)qA`j-ykJrK>kjZbY5SA^bTUJ33QN!zFV2-VLYM zzSi(vah|#C;fn}Tw18J_KRWTX`=rbgYoX9&fodI|5~Ji|`s7*LR8|r~iLjOwET73l zTN-Tnj+J_OvuJHK#C$!|mMr_PoDJuu(Lh{SEMgD*5D{9P1Ls4lVC7(`S<}AlOe0~& z6GyIFXXCqk!jBF&m{zdLHfnVdFTSx{#f0+%`_ww1#H{{P$#3RoM8Fc&(61UZWr zVNPKX%9;Y_r8R^FyS6IZp$u~|pm=s~CpDyxWWm#uHp1(vF+58(s)q1r+8=m!b1i0s zH?t#dR0iT)Bv7rYVYfSKCz#wNTxl40#RQUNFhLx#gl%)SP^ERnt}KRnF3#tMHB1(! zd0d6vgEBy-^d!(=0p8iWVXEkhoAS~$XC)iHq=zW97%C@;H@qkRG83w5vJd@$F86lR z55RaK#d#kbdN0S1OzdF=Yb~_$vk*_z?~&25*1`+#MgsI5_Ld)SJ>>sa(TO}tXF-sA|oz+zDQzDDat?4d*mk5}_~uN17L38lau$+(ZAMgdp? zl-rh%OjawHP@DxJ3bi|$UI*E;B+^7DpV)kBv<#w9zpLr7$9@(q!@JVoayiuH>Nqh8 zv^%~DTjR$9H=#eO2yvJop@_J*&By0+t;tOELU$V6s7wl01I?%Qo}9D};P>8qdiM0n z{#7gp5QIl(7)#&WV2WKa4i(tpY_7D7C&fMzLI?@r>;y+HpcMhY;k#{<@1n@j zvCtK$OJw&hAJAZ(nd80#&?MS^hwg{i>k3S0^Ib5Y{`xRNqO#r_GzCIgF(q*|Rk%7y z8iyRENKUl}K(kZ|IU^ukJ5pfqNXxU_xe&sm(+wpCAR5#S{!UvNe#;vL5W?WjqJ{!z zV1kM67;vZ%`63_;>@I4^aRw%t>5SkvTqQ`mtMOHhpiCmEOg}CcHHu{5GPi>OT7?k8 z5M5D2fiWJlXkqzWW68;#lQx$? z2MR4Cg_BvWkJ^H8hMO-JDVRE#UY6TJWg7+y9g~@JMcgypF;Rfc4Iu>2_f6QCUa&y3 z(0ik)^-61)M8mdVhKqsO@E6zE@!5{c!xgX1+@=tVGfLjgbgs|$Xd9d8R?-MxmzOdwV+54}EPRy6Q5SQmb6VJ> z#~cO0e`Suqp_WYaC}@OV|KRu@LazWsxkzBIwE@m;nT%i)kQ+%LSq2lt5li6zJmYI^ zjYNxt+=Hc7xo`|)f5Nn-CqcSlpKWKS5Gdl*E$cSyz2iLTwFIKjYLbdOPPpHA_Q#2h z-EG!-0QjeP{W=-g(PlgRG;1yD_qBIv_lWg2wDPmy!tTinqDTI}?I=-$bLk^E$LF)q zJpJ_exvM|-PtvYguYyEzFC{KYh`l+3`{{eE_W_!_yvKXHv|&s%@w5a*fF%A)tH}=~ z0IjYPe=(JFwhj;k&bG+wtR(Ls>;j8XEhUW}@$_>Gzd{fzX+kNmM>68&3k4h5kOFSy za7mLb8yYZdEYZQxe603`$<}Xj+RKUV%J}JX{j$y1r;2B06T2R?Ve>YR36?LNDzr^9 zhMchYn3Mw6!&Ej)k%n~Y@5ZHyAA8Cr8^TI40XAu_bkvdno9jdA;E|UO1;eTut%LM1*h(?vV>ff=_Gty&wto-~0Eg}*ad%~L_Y;>xJ7%QrbX8j%NOcS4BH*7l z9^rKAqz*yq5Ev74$GFtrlD5wCE?~g(Ns#xpGkx#vICh(=qw&Mbn#@AZNoB+JcE-jZ zB@b4-aV`ThWt5o}XQHv>%Km<*MVdNS;|A_jJSG~IuMRfm_#Q?jkPrfAM=jZ}q-Zc8 z62m#n%TQBmmLrgXZJ_%t>tM6c;V?%!$H6AO<{P1{sVx!;m9EXTc&CKi15qv#=pES7 zOf-KB?Io5hg9+k@B`{#j>ukkazK8aJYLyEoQ1%k0Ej+bJ(DI%k>s#%+d;fDQUCx%<+ zT=@uS=TA1n(XNHhX|=e?+rk}q;sXR&Bv^zQ=sK!Q|8P-dUQ%V+t*HgVZr&rt8nH%# z@Y7YGNKNwO?@ibR7E3oPU#;3|+O%w<-ytp`gi4wK?2(MXE%DI|z#EAQ50=|QNd(9g zz$1K}Y|wnz%11f~qE#1Iq;-Bile7s)z}GOX`?IBRsY&qL-|9DA8P0+*p{301M!W6h zt`GlPbs5pyoddpiAwdQ+bk#PZc>{_vEU0FBU1%MaukX4tlr6Oy!U>*OlIXpQzN-bu zHW}>_pQ`J`r2;p5BXgdFTJ*}y; zAWW2(8uXwHOyq5ilH4`No@pE$;>cY>jDa=NRKw|^_S_`^3G!fM7^vaA@z%7I0`ieW zP@DvLHZgRsHFG;j3I^#HE% zBKE27h-8!9i4k#6f2MB*Xx-#lFbjP!nqL0}V3cI$8VmOj%|R%$WFZXBl>4d3#9MCg z`KutlZh~?^a964Hp^VxGCG1ikN&#M7CDtpa1R%uE6*=A0`2rchp74krXI+Mf;O;q2 z*GFnpAIS=^C!_{K^yMBH^!nokWGihq6Fmn4c_@`92LZ+`J*A-R!{?jhJDOjmjmq#OHD{`!!leAqK}3&Jm_efeD+7}_B!uoc+RV%z=nm*e-9cS+BP z^)@6^$HkopH@z(*3@PAaNrv@P;J}n$WrEt8Y?q(z^XWH!stPzT^W&snXD_EkQW6s> zVkB|qNe!BkTPfKtu((5Zr#m=bW($IqGy&Wr8RK>&6ma?>sDjEBARJi7Lxd;beGI#r zBNxyiI(nzVTDv+s0PFZDAS+NOk*8Ym9aa?efMHTw_gVs!cdvN>^k`j)*!K$L6VuS? zO7p_~Kq8dTQqk-|7#P#EN*Uk;RvIx-jiAh~a@lbN!r-o=Mhm7G`<{kwB@8tkP8yzwY8yhtr^xNx$;2m6I(O5`GdMe^{A*mE+K|; zpKZPJ&9Hqn-W8YP;J+F*b7>n0rz8a^v8W! zov}JuVZ$T zl_cgvjaL?-VB(EX#2zhap+s>OIG;F1tQ;&EkdB~pwS<{W8o4&f$3I>$N)m9@WT8bV zCb*E&%B_RoGix?vyg@bPxny3yu&YV!|9 zA@d2KuatVY9?cT4fAU+ri1l*mkLS%GJ5&|5zOicE7P7AsgZ{ALcMb$N3;+t3A?KdE z5ekyJkgy9Z26Vj6$(ltqG?n|_!q8b_4}q05L0nX>f04bV$;#mnN;)_AMpF6>D87=Le=6wYt;bQ=w2i_laR zy(@Aqk*%wq#rM+C=}Pr-btFg%IIo%F)zxs4P&De!zX|v7f^1e&f0&igB)TzqGUASHP&pjNevtpGO`a0-kjh98L zZ%wpQorY+ED^v#4M5m2=P1tu;V6wE_u-g>w(2F_k5j{0M4x(R`42U{1;tY5`6q+sQ zerYLQ>0nIfgf+%5hlD6eh`1k}hnw0Y&v8E~t%E#OQpmZD40kb_B^Ts#!KG&qp@r*p za#z&36w>|@7{T`zTXj>I*V%hxFiABYIM;rOBdf(hf_sRWhn7rBvd-PK+FmC{Jy~w! z-BCP&u-6c-nhm?UeL>$}x5BH?1fCTT=OO`tv%A9Q&xty;@36y~Nan@^H2qYUFXFxi zY5ka5>lqK>y^th>3F3$)h#_!kVY5Djc|i8(#C3igA90|vaCk>PPKvH52(#hgI6h=3kbm$U1hSu*QLBzM;DHkR(HgXq2w(jj{aVFOJ8t7$08-t^~z4p&=7N&zTA z?hFm1Yt6JK^9qEJCu#KQ`D6e>9n)>JJ9YujME+-avAxjmfvZJog1v_zbJ28d5)`W{Hqc?(y#_l^vwq`TrXh#4>XMDdLWL8jFl3X?2n#e9tRh zQEbqKy|gEV9WF~4O@di7Z*p6J5eXnz1_SyF>SFxb9d&W1ZZW}eju$~c<7OAw;az{dP|5O@+@gz8#fKiexG6dK;egZ-U3DGnfn=FP=ZbA1+%Y`i^%RmulFi-v2OwLL&YQA&gc$m~;*=-m8xBvWY~jZwW-$%|4@VSKq6S@fzajFTPi^s+qs%E`bojG||1`(D>rLd-pOhx{EIw zRl97^i^>PaDbE_|*L#0-y*j2&3B9+&@$&ahU9B_Ka7w2lY+WY}pf!Ue9--4=94*0O zg^s$JN-x_al92>ZlE*Tri*WUZA<*uC5Q;dxshYOAV6F{N%?7`1UhbMOq}?*WxAvB6 z>$c*FE`l_`d4?tFprkfDDlfwy1hH1#=qVc+K%6GdH?ByA$8}M0X&D4cto+?x-PdJ7 z4T5QtRZb7uBqdbLDQiw3aw^}VeeT#g(T325HGyeCzVg&jhC+*Vs(Nqn$N&Wz6sc1c zcFd~1Lq@a?VKKng&UtlPyoA=$<{Wj17Sp~mbtum@4W=!Tv~G5Rc@IOFbu6F=h z_4JP59M53AH#ZE29B#xEuyrjD>YenOO}7AA+0Pfv+&dX{L_lF_oF{9oaDGA>imeBZ zT-7UQ(++8(B@_E~h``n(StO_H+#*Qw^9x@GQ&q)q6RN7}i;YC~(tWC=z>xhnxA)17 znq&E0r?kaCAm$qOje^^v1WFwqJYVQ<-A2fD--V-g&ONY$CpuCb)(31l2oMU)H2q=T zrjjoCg>i?f96;O8z6>?t(KJQX7rW=1e=9&_E|j{@A2djA3%rQq!qLe%538I$r&74x z_7*~{0X$)Aw5r>RKi8yICqXLTbw9C{!hLTu`BlHD9~Cks+zJX^s^Zzpu6DA6?HOjm zKNx88D60PJjBfK~?(UAb#5v9%vG#X?pBL*qT(s;;eE{@3b%tj|8OX8XjKuf7pNKkR zrTUBARp~bwG zs-~{r%A4ok5L6oHRnOR9U4?@Zf=F~YMn&sA6A&!k)U zEsMU7YP13%2HiFbcm3^oQEfGP@@1^oo=~E~MbBCzW6zBgLc_w917M1|LaoMV8C^`YMss<_tcB6v$$IO#h;28gMXQ?2cTZft} zXj`r-2LISvijRpea3r10l&we&N+~evecwXaYVJ7=GNGl;Tsks_-%MI*E=|6sm4YIh z9g!C9V~xo3!(}*0Cf_8VNvrB@iEq0gvWT}`BDzTuvT2rtWOaU*2~yoJb|y)Z&!km# zf~D5^kVSY;b&1I4_sFLSJ{gsL98U6o2dJmpO-6L!smwS#05Y}P+j?6FgT?!8;ijg^ z>B2JXj-r)_N&V;Gwe+;+rhsTIf#W+X_ilY{gE3A^ds=P2yW1-7lBlBnRDzUjCatQs z1(C|ngzV1c6*BItGaRF-=iAj*o-}uOpE+SRGbUCdB1`Xuv}e5RP8s90bWG9d-NP9~ zhp7Z9)l6DxFN`t9#2Xwb#{eq;dYqPWy0D<85~NNy4&|kMueYj!zO-Eq|ERuxw72r4 zHUiRYeJ+T%B}~2*Tf2vD6wgeLF-}W~<*g<6^KV6;XuiFcYm ztx_7~Cp_w1f@AOZSKW=FiyG=DTsGBPz*-CSd=}gMqY-VwEM(A!Ez1r3#T;WV*|>0V zIYLenyRW*Vo{Lq!k3fkL82M-)?dY0G93tf)1=Cp_vlyRBmhyGF>RP|$tX-%kRvw>y zkG8?y(jxrXV9mV^d18<<-1^Qgd&^IXy_yJo;P@i48Tk2UGhjj2^aaUc_Tn%8M#Hqe zA?=Y_Z`sJ1!QG0AgqXPS*X0lGZWh`l%{FwR4AAG(Z`olall5heyXDd6)9-@R*Ed9S zmw%+a1N{Udg6`k$rJqnJ#ilb@u&~QH_gO8b{eRMDR4^X18p-fkZ=%b-2>5CHY^$HU zoR4@Z9owRcT$5+xPyoS{X5Sh!7Y@(P&|JZ6xH(aSzdi68z8&>>Nh4Cm5%zGpYQ5uH zi$asR?SpmK=2XGwL{uY;(NeHpq^qy>S@3wSx=`0z?YBrtkj|T=*7$^o-rsFPF1bXb z)OurEZF0euokNZ;)7QpTR0$Cg%!UWk+onsS`pgQ(=Z<3=LMg+3JLAgAh=e$co-c0i z%nRACTUO}mU*>=7R8f_C>&-pd?yK)&|JRp5bC+|WPnEM|EN9!- z@qq3fO8HbIAT;NvduCA}u(Xd#PULmYs~-IMCesigZ|-uxWoeKB1KuR0_~rE=Wp<~ z>04~KUp}a!7tsW+I#1X7_sYrx^j|Ve)Z)=THOypH|HDTH#1^6aoL14y5slXQ&F3Fk zq_3~NvYZ8hk_|7{YMN6sHl$VqBTA8cy0W$W8y@8IKb*ySP>kw*EM>~P!FMHS_G*0b zcmCfRf+bGcx4AXTqxWauM6s$_%|n~M{E_xOAkp*dAL8q(S=~bq_;@d&QU8yDhq}$b z8(t}+6P@Tlfr!5SNv}vp2}8?!`ih^Y3LIUfuTD=`GD}Fju;VUX%?a7A%;$eNi*>>P zeRR35w&L1)K7KaOj@ia*Q#Qk)^m=7SV|L0QERshO_#m^2XQ7?RYApI%kt+Hc$5W(+ zghyBEtMkKFw83UG2!tp!2@v8L1-d*)`{kLpp@lUVQGDx%E2HPfXat?EYVD4qj35cp zo1$HKM~zuERLGuer-iR&mw{%lMn*plg`df?F$88J%K#X-o^J3@dGL3(Ntxu(aq*|v zxf~^?E!JX-o_NINMULg4g_m}XSnmRymCcwJ(vhtg-Rbd9v1iq&BbJy}=FO>78 zYcq$3yBu-&-o)Pa+kL&46zX>@*~Z<;MIkLSzlXDui+G}*qFr%c2RLti#UTcP8G^Q_ zbU6xV=B2gUIgL3<+m*B7-ZbrOLC_|}L8!Xw49OA#G6-RLsG>d=MaNYYNny!*x4LEI z3ZY{#+N&V{Io5Sl=f|wl8jymuUq@|r!irX4inuvR#5!aAZGK%DM4{P6*2^ zDQN9)X0OH;-1Cb|XbiXYA6qSE*1b3IOLzv&`NGR~r?J4tMo;bfIA?>8J5PWNeFSt`j>beuy6dV+1cybr>pJWG-Dbuy^SXTchc}f!>-F88 zH*e;*0z$j2Zz2?=#9(B)aB)g46m69k>8@eY{$6Io2{W)EVZ92R&QdzvvR?(z!#1{# zQE#2e!tKd*Z|JtR$oIctar%)M%;xA{o3@M<0p1|5nRMw9myrUg)VJ$GT{WwYOJ-O@ zeJ$lYNxWsaqEfeuzjP~5Obr#HsJa6@Af~IN5N5ta)$<^w$q7a_gjqUImriALqrC?I z20ByrrQNCyvFq~8BeGqnj9drE%RVHc%r9HTHdA;bMZ7O z+z)%*yi*f>d0^>8;x1wLE0rZwT{yKZkVJ)YVUzDcOJ4Ss z4lnMy)oGoa#9&oOqT-ZlHqAzTCz^?EffuJlP|aZO^DZB{S)*unuHZ(sWo~2JO=a4{ z^);qwUaiS%9&?7AYXrz0Fdb>^BgH9=|E7x~27Sks$3lKr%~rbpsQ_;l^F*8}i-$p& zwTJmg0mccc)x1I58cK#UtUf5&Zts8(V!L1VmQ&4?ceP)-h23g3^u<2i7NyX`CDk#N z%Yjc&MivYoD)RghHWhWV)i{jxMI(~^Jb2Ieks;pST zp->E_eP&P9GaEkFitTXUsYRURXVTCweRFl}MlORwL=+mLF4fYLj)$I*3Y@IJt|8X? zT3yr~SDfPOr;HoV)EN|dh@!xllKgx^IK+q%8YFN&^^El~+o=SKKnNBSraD&AE9W^} zd~)tOda9R=Zb*tn6@)}hz;JJZF;RX7jcsc`wQZVx)1vL5+jjiTe1At=fWUOzaSX|{ zRG&thg}vK-iZoWuXy)~_t?i$tcvx@m$v;)O7{MvEbh4c<^PY+yzxU?OK0sv4p<=IM z)w-9W!c>QfdiA#XiZhjR0_Oh5lUiE+2YCr!5p(o$iWmQ3_#Z-4`mH{atYZ zx#QKRdDAzNKtC`hl5hwSBTe`U_2+6i9fvXAlfPAKTW3>=f}p#T-@@}tNP~kqW4MaW>u&>f0v-n=YN+cx*uwr$(CZQJ(jv2C1rzVrU=YgIZ` zsa2h>BzI7$>pX=Iy#~~a1vpae1rqxH6-WkZTENl(d(&1zHZEhi_eA3-Fwp#W6(IAq z*(-&xIjbgGk)QxFf#jU+;zbz0!x7TY}t)T$DQ zH(N_@MXb%E$2U9yEuv`SuS%O~7>&M54VwW<*kY(i66`@?5?S-E--4xrWeds|T9YYK zI3n>>PiIt1`qy8qC^ecqXK%=>Rlob?WublqKU#f zp!F&)g-e*3Z3vu#a@OBzIz)u(&8X9sgeNSU45jR0((8lcC8PHwQxmKm!)czO?oZ88MP~MIO(J#h8nN=-1 z8RtaW-Uc?4nDE%%`ja(5@^IByh_m!))kqQwN)Oo?d(N|PSy#HM)Fa=kJwRj?w46Uz znjhKVj*7PJmX~Uw>H1x}w!%qP(<1G+u0g)3{hP6o{X>uA_Bmuup$g{3u?AUmIzIL` zwp*TU8(o}u4xOK_(&^4~z$kb(|J>K(iUL@vo#+DPmO$tw30r)zfftn&cn)8pDbE4Q z8e|?NX~u^0-lP0#72PpJdibtc9^D~T;!+S6u2T&W1jOeHrP9kObhdMjmdybVq$nJe zCJC`WMjF6*`BsVvQow(JLdG_(N5(Itk1ciF1E(P&2V~P?(+NF>-}EVZTm5*p=otp$`)pqkC3*@5QH(6>Swk{H+#SBdWuy*eYPo9K=(Q zvKAIZxngFfJ7^rwrRGdybl`iY?WnbA z`ZdKw{F}@4iDgOz%KkP}f@+$?aY_KS_7ZjT@g~iCVV9w@)*23j~@_@-oC_%P=v7HUp6-yi(NY( zSVTh@R`Sl>`@SM>dXq(g?G^w%#=U1CB=es>A`LL3%Wlh~`|CAXrv1vetm_XE*&mwC$#TREKW%-yPXFiaeV+enaha^;#ENC@6p9M`2)y4 zg9nbd-Mw;~vL@c6=f{CSpe0Y(Si(Tt$9!*9%<8&|dXFInOwuW50{{)`8~Xctk+6fO z`XvSN%J&B8Mn%7Pz&8Oe<}w6d>QW6hNRyH71UaQlz&pBD3yu}3h-?}^y6aAX6bGho z-T>yPiuHL`mU<(Xk)f7yLx|nvoSO=OE_bW4>LokS7T`*y5=#8$fe4dUpRa>`!+!JH z3XgSIbtdswhQUgnrx0Y$)X{p}o`9H;))_WHjYl!eMsG0#e=SG_AFgeU*tZ(`QUvFO z#XTYi4jsQ*4XWGcA-fsC)4Q%xhDmEKH(z1(GH~&0`sD-Cqnf6cC@7U0N1q$C3j%o( z2kEQ~rQOrf@igaYYoBHE`{=K~%oNXI{803bJ$H8j6na)8U6+}sS%Lu>5ehCSK|2`z zbLD&2W-#{1f_iEI^T+e=``?sJHX8uDT9E(-)w!D+!^oV+vKdAWlD8?tLE^;xTT5))zS&Xc%~q|=e%I^IG*m!dQ!IMOa z?GU>6{PZ!tc`;3kl!beDN~*9CXSygP<9GWv1S;nh0$5Uh!b1l&w5%Ae7si>jA7)<7s}CAffa?Z_oD5#VwGFlW5Y`>h0pP4?iApb?2lCVl=SIE zGldGir328OT$c36B$~i2+Ls9b1NrM>P;p5-UP7=4$w$hZHuQH}-4L3Fb`%R{!BW0$ zZ+7H3m>-`=4QY?a3W`y52zl~}LRjxiKH_&##4Tt`Vim_fh|3@+;|5F}=-4Lcv7KC3pq{2QIzQAUQ6M!tG!uMiP=di={( zSR?E1iWT2g-4wL=D<_wnBdDpxEoUU3>LgGA-wwqg!GwmSZUCx>ZlGW_ax|Qa?G{Fj z7MIpFSUyjdgD>}6>QlZYgP*;d&)ZUCxM{tDHT|;vM|#g^M8x}IS-tLjxF(J~~`lFI5Rv*lHm2`%;Loa zste@gR)+11}1e9G({qHyPw6i^eRKm+#*qB?X& ziqKORlXD$dm2-#ZDj^E`gBuF~PH7!YhD@Gw8`7ydJ@^*^kH=eA>)eD;H~Il1k?7ei zN*AX_0}@W+)&9MGci~kkH*JHn;S&v6xPkf z7X5aA7x5eO;UW5Tr)f}SEcSR)4oiLID3CZWU1y1# zQEl9Vw$o~eGc|j_@kt17#MJMF_1KmWhw$S<9MOuAnB?Th+F~R4NR98yjXFuCJI8I@ z3FhX7m=1!N#3_BV77>^o{I9FJB^YU@BcbbDi?e!|jR?cr zlBZs)b82%jI563gor7&)2HQ+=ngwOIRiV15!!Qh6wxxUBJXiEWP8 zWiT^lsYM+}YpRc-+TxIh6I-$t=Vbrz2uF%lX>2C>01cSZj$kqEDU@bX^YclQQ3MD^ zjhb?;aZ>WyjcGPdw;PdL~Hlg2&{RE>0GJA#Ur>j;0?fOAz6?}L)H zI_QL{Fz)?bJ$bZ)Si3QEd>*;td(N*=U3BF9d3qa1b&)N{?Rpeoq}ryCNi>WIXnu6k zh6Jg{%sK`hMmy6P7eXkG-V{@oF4BebB5Vtw0uk98S1T%_%=X`;W(PIaywZ~4fsr-F zlSxJS@9!jhA+f=$MEY=J62QlbN~c=W1&Blf7$`}(Tqqi$ss&`2hqh7YrOdn4jI=UW zdiVNIXE>C$|br_RecCr&#r+EhCuSuK|FOYu9%<=(Gb0%5;Fo ztyrL9U~DWgrUWyyr(0hoLU!~(s%)oFXI&C}lC03J8hsy6#zOvlxgkDl_Bn9O87z)_ zpwzjwWPTR5ea7z~Teo1JH5i!m-ZiQLXQ_S5(gmcjj)G>R`i5N@zhPea{d=@mE$r6i z;$+XdY%Y5_>2F*R?ek>CxX`VNVSs@M@<;M?{Co&Bv%!#QFp!uSZU-YT(P$27i=uma zyXGm=gJ%;>Qs7EJi2eL6@^Qd|n-Y{Wkt$^fO z`WJ==tHpa~$v|I@+rCf%9!>wp)^@r7)m^7BY705T9Kb)6N-;sKNPlC~%Xu3WB2-U4 zaho4Ms11G_lwLt%6cI7}9%_4MIo3v=Af4W0?vgVTB^MUMbJ3)lZiPZ}4gJgo9w?|K z`|R&pAWWr~HJI)y{*fGa^6&2J!UwJFKVFQCHY}H>gWZ3bbMo?FqJt^^U_Bmf^{%2J zDozQcHbb*q`bAa9kX}@bFKHLrz%*hxlsNqsd};b2<7BV19noh_M?eDjNhsepgGIyC7KAB!rYhkK zrZ!ALWhfwib%C1qAiIp3|gRDXs2Hnruv=xwZp;5tz-H_AS1Y? zlip)R({Ah}GhKnZs(PH`{%8q3Us|=2$@;L0c*XaGlS*-UPy5xw`;KNawkWb`e3}LM zg~4)#hL#9&L@0Xo=Lo5Nxh|$41ag(){owiVh$&hGOa!LYqg{ z6yPs$+&-X~5RKa3RavCBpMe$ld^QXn#XM%Neej-C1R#_}E`A{HXP99}MXklA{<+C= zeobC_TmhT17+D`9haDIY-u-smamlZZUZP0c3Kp0cdS)e+I33p2hGA>u!M(PaoyrOz zkHjeJcwCImHLk2!ST^&AL*gx)WpRlr9y+YI4>NWNnWag6antD-&QXOlYp4*P<-9rM$RjubNuVqaT!4nQ5wSRE1-6_TqQs@BfRlke2r`Xt-c2ZIlx2TowPF$OQQ=D!i z`PEy&5)(r?^!aEg0s*`gbYjX48j@M*@Veb{&-b~})VQ+&Hj_$w7|S>Enm=+FFV`Vf z57{3rke&Avu0!`JYTNww?gJRX8sdjOx$fw z2yp*_gWUZG_2jBC*>~YhHTmn^tx^XWZc{p_#`+fHyi`@1Hl}J-zOc{a!wsIuni+iV zl!`V!MMM2!Gv4qN9?xVxd1sEG$13BZ)O9-g$Nu#U>T5%}ZzEg&AZdAw-El9g^C zGcM*ZjL3)Ga=4|I7sAx|TU_(HCMK(=lkI=kCh;{8#?Tqi$4v#KJF2tDm@tFRZeM3U zg5y|~BNAZ(rLQMk5-Ymn`$?5Ey5}q$m`0*kygDP$hiY z!tHZG20NBcN85F5t0QHvx^vF zaJ=ab(`kt*zoGhttUj6sED0Z8GVdz{vTVNNXkmazkyh>u z-AE|Dw`bb~<#eMuXhOf`EMzl{I39arlO+;< zACPu&G)I#36uW?#kzBV}WuB?*+sSG$KwF1pp7!=K$bdJ8OR&dQmk3~o8C3h1Kze&+MzE0@HmbSQ&< z?4h8%sq+8=4HI=?1=M1SZLy~i!(Xy`Al8Opm z=UFZg+hpJ}JWLAjzq1=afN?~c`A%+(Flub$Muq(6r$3+k=1rK|zR~1-A=<`ae5N?B zQ*XkV%A~JX=9}k|%^?O+SV7YabbY+o(HY&98mwUV)9SD?pRzgr5a*0lhnz$DPCsa$ zIp`9CO5sXt-z!SoYD&R$%;j3PvnZ1`2EOjsfjTkEGe~tG;iWSueVc3kh9vPb#3sHx zW;$7?u#oPhp~I7RSgta8rOmXC)du~LK!HObp$YD|S2uAe23!~OkB4IkxMnyqspJNZ z=|fTbOKK8Cp;Ck(RRd{C(Hem@#$hNMiRk)ictBw&e2{==1I{!klUJ{qJ}3Sn!ko9r zmm=`OSw0{Et2qss!PwbmCDt?PF*u)IO3c75mIWUYc22G!uw6PTzRnIiK|G3?ZFAw80_ds%KfrnRkV8s_PtA; zNK>BdJeFj+QH)L=b5!vNDqx0!E@*~waO|ksV4f_L!76PS9u}w*#Jf=Ck&`26|DnTA z@>dPb(8XEq4dA+di@2vXMmCzI2m&r84@uLF{n1L*`IPzU2E3ouI!L(Bhth(6Lbd z?&j&h_*>8uo$p<*Dq^)zM|Le?{0bZX>v-}joIi--SY9=>d52p~=;^K+kVUE*;3C-L zX~n?#d5Sni#N6_1lf?j%QQFI8ka8|!7``yt-2*R|Bbf1qT(UnhBG=CJiBwOLBZ<5m zlj|{R7~>Dw8mQ}!V2^|ao+_j3$8iS>{!>u;CCu+Fj`R&7xe(6cRd(ZAAV2xOf{T$8{N=yXpSEWtcFss&e?=3GE4qC6-KleL7zr5=PD&#DE^ z%PELRRF|Ye!NQ+iQFtlbn|zV5IYkpuSSmx?$)A^nPPr^S!7G&9F^w1JiTpov3A^$( zwU}iFu%BD-E=5`c)iRSv*r}QY-0H@n!v1%&V~mf5`}|Kzy%vZ={%^bdfW|fFCY>0M z-fIaz_Jxc%sav!&;YxoklkZKlE^Lg)MWh|ogRFbqae21IRFU~&lDSX*b5|XLNj{IO z_n>gyoYj3)WI{fKk%P8yiI?REPp5N%K>WMN)rw9g^$=VrO`f#sY-8cPD*I}lM0dl| z-AFuwnZ9l^vAt1Kh2@kMOJ0~LihXPmFLNH{pg&Tx^Qup@h_~yzp=u}TIgb6i5Sy=z zY-pO&4V(P3u-#ymX^Y&3!6D6`B>by=V7=(IJV4S@Ps~|rJ%IS&vYiepFi!dct@uaT zG#}}-R(wbq)U)0xVkXi)=8J)6447wv7SMstyVlD6q;4*<>OiW>$lJgbF%D+9adCfOzu`+nwoF z6UJetB*SB6G&C~asvPG=O<&P-@-1`t!Zg}rGVcAH%zo%S#o|(ZA|zdQXX~%0bD^B2K}S9ch#d{;$tG#03v3w?Zfq1xp54-lr0lf z#o90U8_3Lz^HMpHCOz1h1`(u;_#pv$xl72KCHsd&2O833QwrsNJJekbm?x8#BW)nO z*Eu~qX3pnuhBJs`lb?gwq(R)yi2U~-7hK-Ozu2cki|6S!iL_T{i3g|0R(qY02P+@9 zI>G@wZFN`=Nr}_*K93eRe6#S_spoW3Y#CjUr#9QA%U|Da_5qW$pYvs)FG$C>=^Dn0 z*lbO`Vc{=%H_i^DMhS-@hpHuO4e=rxLFUwe2ptGxh=y~RcgkfC43n3dyppp01^|_B$j#wSmS`Ng z+jecN4V~5SDT21a`@D=p-%AdNK-oJmNaVBjJ zlY>5|zHN?_`X`PnW$RJrKko1jlZR(!d zn-q2Sj0U5;?LFB5?s0@XPgmCv)0YxeJD{T4accRjLqy-nf$_zU8JfuS#)%SDGo%D< zIBhScua*O6WuN+MI4q=nzUZGmO7ryL@E_1Ogk-_8f5~IRBne!;X}OU3RU5Vc4%tJV zg&F3YXWw}~Za(#sf`#c|8^4O1ofm(5;iADfeY*e0lCo|8+}F0?YU#f&6?EFzb`Z5r zUp6L4@`k=@|CF-ZobK7_Rg3#?WR1tuRunBMzC{5Rg~@`Xb-VlCCC_ecRuwv>hI?`$ zYVEO2FBB%#`siE^UJ-A&qi0aVkiMD;HEbh0#4I#`6Q{4XqIO0~iN(wFz4Eg7X@3o8 z*-MAkw_uO`e`ENN{Y=HIAwuifrw&XTx4-1VV~Emq2#gmjh=MXuyj`>(=bv__x3Mm& zpBJ9Co|Z(e2^+v!w9#6irURHXPJmfIvo^hP&3aZ{UkH4if)?G^LcgHD|Czpyt_(qb zM(k{Rt?*f#jCk`_!cU?lsOtFqn~}5i*rABLZN4=68>@o!&r6f)W*S}3nR{p{=PgK`Dmf* z+uWk7Mg#IL?S^rHrIk$aEHJjDMlu=4z}Y6%>r)2h7mE+u|2Ch3q2I5!&c26#`!b_# z?BHEOg*g1~Hr+)d;_(%9%)tK%llurgxHVPZ_35l8vXVh_IOpblZn z+~4Pe`$6#^rvK2HD1lS~QV`(&I*!ZxiBH(eh%z2^5g7POskL3~UNZi}z zNG=Z>FYe~2eqm+e5>EM)bCAr1Yd0$Afzb%RR5QDUUL+iY%qT}I?Fug1Y93ase3SG_ zThZoYMs+m$R%k+}y6mhDFYZ|0ASU5Y5Oq4>{a${oH1P2;9(iSe0oOoRW5Y=uZNkp* zg!v|84_7HG=pHy5j1f`Q6?x_P-+4$%-Oxd1m@@hFZw6UZd{YP=rj)s|r96P&&G5b<~U3oxNDSj^SGyG=5+=m)(RauD)vSK#>}*vIw(8}O2s(#4ba2l7TY{@#e9*f zEZfyWhP0nfp>ku-c2&m{H!G;Ic{u$x5CuafWBgYw&)`3BMbEF`8#10m3s?e%~S?!*}5}C&fEmB z_RM-@u4V#~cGcT_X=}w~2SO5^dqA%mP~2K#Hdl{iL*AOgUho- zG0AE9(;DzdLIfXMV+;1R26g>$zf4wVWvJL7y!%-n^2Aa|%4p$B0*T)VIIp>orh|*zU8jpl`tfik zTyvMn`|&?7=h>9u0wk$Yd==Ameb|89D1u?ps#GEF_mscM`WrXd$p;fsQl1+RNd~Aq zRWS8cC!1?Y<$JU`v@g3qqnhMr=+-ZtfB)c^M$*jOhhu;sQIM{Z(R3T+re?$wdSu=#t%3{e1PDS!X05H+zGuF zJ?EzM6p>l(m-}u(uS~8{p%PJSUzqtNl_KrfKw(9QYeWe5F0A9 z&{M6YJ+@e_R<|dUb|Qfc*`RR)xzR6sq)f$`a~N}^r;UMrTDAmc0s7`>BMiT|VUi+x zCor*4H`%#5Y%5o7T(k3D`>x{)BpQe^%AtRt2|V+t;Pn|EB)hGQ-3YUq4;iPMLGw>1 zh&KGtL0;Ys!~#S$M;+Tf+;M*X0AN5hCx_{(%(?KwCFn7hECXDyAg{ZSn#VKzTE~SP zAD5ww&gXTgsFCc(Gd|=>B{7yp<7q;a;y&8lS{Ig$IoZ&ps*NWl*D{Qbq;Qr7>#suC z;H#ZCZ5`~mXQnQ}3&N=?zN^c{`gRlmxA&w=mySMRhtE?C6CLX&u$gIG=wHj%gzIec ze8}f;p5(SlD18_9!paw+y*7p*@i?+YdrimSMM|CEMs2eji8w3CzTP34 z6sM2K6$M{On{N4F^s>CGwk2pa6&azsSd$)$**5jHKo<>5hHse}KD=x3;-viC7pl&t zR*uM;p|#jgwH96}OPt&GEX_VKqjeYr0qm{Eg4MRls8X|HQ8_GQrS7~|Xs0O6?}b0B z)dFpypebxuE>trW)X;fzYn30{;!R6Kpg4&sw^S%COz&--+W$KE9^3g#NnN>~iuv`r zIX5}MO%oWbd06y4;WSI3YBQ^LA|}t7-Bs-^qxAemnAXqIm)_>HMlFmE`g`(-0|%f5 zBpl`2Y&PKx)WrlEhjEYQ`mVBrNxO{o@3#ecRtm%ygNTk5+nO%Qlil)V!m?`u)-gaz z#A^afunaaWAT8Zwxri%Z1l*@^`6{-f#PH@`je@bJ9>uImdwZ-K*czW_%E=W=i|igd z4<6hQnQ?Z%w)nX#Mem~#OO|=3L+fBA}xrwiA}VfYd+vz{JlnhVmH~_ywpKbfy(CP zej-x#XXGGLu9eJ8DP~*Jh*6}sJ#Dm-5e@O)^q!iuS*t8gu(^m?T>8ht!L+P0RzP(v z8u)u-_xra}r(=kYcFVvB961~#?~Bs5&sgrPFvrAg=6=qRR%*;mak+?5jI}nyOEjA{ zj>(GWCAC0V4+sySzsbz1%JmSV+n&Q6gzKJ#rHCGz-wYZaDeYK;cohquD8w&(*Pg}& zZ&1F+#-qb=SFDM3Dp!EGdY$$){sCUWhT;lBIP5w=ZvTDwRO6vh^Uijs0L%;1TEQku zu^A?K%;sLPArABib%>&2vy_wsX3SvR#0mYSgtMqg7jQ_x z4?mmK-?coxiFn}HloV3>tzH29P-E$tA=$=llZ%Oc&iuGrl3WfF+EV~jV*fa%z-^vc zpZx+Z$+J1jh2nanU)5NC1aaDBGTYJ+_(@&&(sAUDry2yCM!))}837 zWm~zBAnmh3*1h=oDfwyH7<`A_aZ2cBA^+p1)NopDX@a*>T`V%F=9AUjxVfdL56OC< z0~vA3 z5dQrIE!|7(jz+BGXaC39a&4=+I5>uikH`1K7kK&OZI=k-XEu|2_5F3{bBxdIdhcEc zo;JEKFqo%tQM#d-LIZeVcs79y^ud1dq=V%_v6dDFSfJpzspE_%r5vy(!_GXSijYc+ zH^TxA_+{Z2Z#@>$D;@1jWsA=o`!>cq1>#709(U&K5zJeFc3f)$6|F5a)bJ%x@)$K5 zge1WhgA7iws{h+qdvP&6&Lz+N^v&}J%fD&N`n>ICaR1Lov%JmG11Fgq&Ax?QV2+yr zL86!OV4!)nUUg6;n9K%y?K3pT98glZ$pRNHGxQr(cZF5bZg3HVc!5{r^@=)!*+D^# zf~(hO`Fxo~iSe29oE7+{st$UUDH57bmq(0jG!VfPW)!?cWZtbu!!X+hWlr+zyqCrg z@YR60L0#+6huTZd&x4|sd|P?jGEc@9h$&AA2aI}lwqo_2YSz!9@b=FMjDIMg!8|lu zcsUv|th?BH-l_+sTFi%{?h1rVcK-FQ44RkIXDUswnDoqMdCq{hN~SMD7y=b!EsOMZ zJF`cCt0N^a!B`}f$X=$%w$78|79$z{8Pr_TL)_3W$NlK8+ z&mbH`Flu|9Mv6Q}1i>|V?1!Z8QNOJ-*&FZnFyZHK9VmNsa*BVk3gAcYHq*~+tuffP zy1ceSG=XokL;7g{9_j_IE*>SHN#T}?CI(J;@0c)05^2y{inY0PSU!ZvKV1d^6A?L0 zh*FbpMtb}!h{a}LXG|>c&-?|%IG~v)Ib1!D`EG@OJA;-r_l1t+$)M04*`vc^b%FQ8 z$)dqwq3F3~&i&u*)P$%n5fGGA9={4{l!-(F?FPkFj_v|K`POijAtCOW7fsY&B!+oBk3`xRijo`Z9m?m^iw@wmH! zWs*NkxpjRUD((j3k#A1jn7(hiky3{!U4gziv8XlgitY6#Dyhl0kJZum1Z;NA@QFvz zg-B*K@yXvS7FmKLmv#V8-ILyS{Gb@@SpKMQyR_`AcbwqBlm*lZjyF@@N^3UGVJ+91 zrTSD|y{iqBYZFi#8hjb3njj#2`4?oJsDO=Bkc}jv7O`87$d5OojvYtB^a^WqBpijv z`U9wY!*LUZ-e|ul&LpizQNB_pX;%Wx7O^Bc7d)c3{Al&g1c*>K8U{o8;a5~Z9bNJc-FfiVzn7F%!MCF&6_KAX!;;06w+OO7ssF|!xS}n~P594U! z>EvUh3)aH}>yS7d0TORI4SxsEI|@WLE4lt*-?Khx=MKEzj7;oaB`Q;+68;Qhnep1N zvw9)x`^6Q3_}S$%}Yf zs%NL(wL+8>4^($w{`AZ_`-dUsAxs=&(*304#V+1D(5f$q^0h)C(URn}$3R75bNVCh zdKqX^r&e~@=up2KGQiGVSblD&(;n`+zh9?gG2RoE=cvmwRJbIjeNu(J#W=o8|UXddubQwbgyfiR>@ zqH6Y~oc8q|mFx^SodygJ`;3SQ@IHhDHp^hCD%5+EC)R@Ffn(!?5G#tf;3!WmPzbA- zRbl0nO9SK#jh#StY;>Z08vr{;F3s?4(>2Cdg|OKw}L8o;fFg z8vw*MO4clvezbnjhPP&}4rL$H=5HEjOD zV&&}74BBW~&VFnxh0DoSEY_`Rs&r>a*FjO>NAf}f)RvV+V60kqnBX$-QBqdGKgLDV z6hRzSl~lNq6i~HcRq?)WbQRUcqIi>+++kBFFLd9c186z(cJBh~asSu)4ajL}w#N8{C0U?A5;15JAJ z{&<@6%E2$+tUx9V(s-{p4_vF`3x=}}YZWv0MvLLAg1pqWY_*bVdh!R~=napp85=NS zY=^IGu&~?gANMFKI5_NZyh!0F4M2Fe<>WDYxseeG)-=Sb0#DZEdC6!fC#2mI-d5nn zP}NcK24WGC(TgwH2okj4KkCa*-Qdp4VS2k>hsRX(YGQNSlM(4#sgk^`4aA^GK&Mu3 zRdL??6C)*VF=y~n{;xv2tDpd~-_bMol2ffuWjJY)4SED`OHEmMX~td1rRg4D)kK8> zxL`;u0{Goo6)RVCh&e#zLKtCangx5Q{5SzF{G|#}iPQB`zO-c@O?f21es>sBu+11e#uRL*c z-h%y3#|sUtXZk}7;dceQUghn@e>%wX7ZQ9@1Cf)b=$3FHZ?Oxw zYS@c4JCE|OTb~5$6RqL;@sGG1>?ql?&-X;eW0g69xJ$zdyhgs!M_PsLlhl7y-tN9N zu(@do$^`^pyC3$-WRPry4&Y7!(^stLQ}b?K2gk7=9h@Cjjy#`5zE-XEu_Nd2(`CDGfq$wZF^&|7u}8)04G z1_)Ugz4R1tf6KVZeV0!ZCo_Cns3{T7kHpjD!x63cs^}*r1C5dpSG&5_NCLTH3M+ha z68IjYQbefFGanVO*F0{n0RRydlE-=@)z*_H%e=@R_6PL+Lrh>CLSh!B06V6>_2kZD zm6_-uyo*Q=GNFEPD(Pk1+%p!0!gB2IFhdyJ8ryA1VrDg zn6rnFK!IG+UAf8f3vJ8bi*iht=*>4)Qs!E{91}7>_nxQ{Z&K1eXR((DW{~D%9%W#Oa)M~2HS$S(`wIeLE<$Ed%Gt4*>z9-;Quq)(XXll8^hY6!^H1CepTySTJSdqCf z)nT{I!F~$C`QSZ=TwS&|xM<_(tE?qH7;UkT3w;b4AKd$$Fw(|~y`94!MFDD=nidg) zq=JZp)t@*Jzp3EAvga48vw`v!@F1I+NW*gl?hF7bC2C5k64u$u2EagN(uay#Wbbj> z78k;J2~yVCr$UV7)kwkMP|ePg$kAdc#;BV)u#@}rmQ;^s$lMO0;sH_dq=;&tahOh| z^|RxGY*6O#>}A!7X^YpAn%uY`NQKJajJ7-R2>YdAu6+6m5gMMKBc#u48Sxb8ILzI( zE9_=VL?$NV?N3AuX_!kW6Q(W>1hf|tbZE#F*h?!CkZbJxg(_h<_D&gkE?tuVM)NnN zpjsNou$9%TFHPG!iqiJvcv@KVqB~z>ny~2NB&6-=xkb;Ji;ng>wQ<1zH)u)(tFm_j?bt4m3rGTrx^-uxP65VppuFoZ#dc-89e(*f z3Fp88*SG#n!GrS*+VZ+#KUgUk_+PA)15UZbS_MadeUdI$Ul*B&Co@xm#XG8{`MoP5 zl$90-3uU&5#7&G-m*<&!QhGzfwK$+R=V@a!GtHa12m8otHMXvO)TmUz+_5VGvK%=_ zC1H&LVe4#tE6c_^C6yJZhe^YR7THTCFzW4pvB_rVu?E6dleHotGKAH7I}SSh$!t$H zamscv5XwG7+)RS2l|8m+)*5~EV|#}-!Xa8wFuKOAe*O`459)9n%hjpBXUgOJUiM-l z09<-UWwKan;|pOB2>a%RtDm2%Jy^r_xpvcf#RrTm)^)3ckg)&r7!9e#MNr)zZv=NX z-=+=@gw)^VGFO8A$R&B_R8&c;>c#{>(HH0wXJ@&Wx2ljdo!0#PHwZRYcBs04I06Qs zZ7(6nhj(hKf zEWwE4efY|jt%o&pbebVGR&d9oPjjcQ(U?1$kpF1ntq1r9x3U`=iHaAcLuBX%r^(== zy+grhVfAG-@{;l#}^8YHfrji zWUWjTL&%(%!kkfs{h8OnE)oh@Jr;KASC_wJ)8Gh;vB%F%9I%qfNm?6yr@gl_&=)G* zeeYhTkpZn<&!@AGPzKbM7cKFB!ylUZ2>lPVV9XG;p?TY3WF-J9hp4}=)_adB`Ff1y z+ZrAU^zXVkz-HRCcy-h(dCWALie7SRP?%#WqJyCT@Kg;vNtg-je<{{r8!P)$9a86W zvEWu_cTaCNk&>u1PCZGqRt8tZ>mc6x)cON+c{KPyn{=fie8GD@1~cnITYh0u)GbeD zz=7wuGJse6=0&Lf1l!ANm0D7(PEV~US>~oAT?mUxjsGp@kVZnayf`eNY0_mtT++yT zY#W57$H~Wu(Dspd-ii25G^p3~TTHXk6`}ANl1A%!@J3P>3v3nX?EYM>J*wYW@0^&? z!V8T-Y8Zw+13%Y)xggNu>U|CawgM%(Ag5i?}hZ_P*0f8-&$rwu4-^d7Ztd{SsYeb5)PvudKvkcsEZ!j?2OsqP--hO zo=S(uM(GKjBenL}o4bh0)c3NGTli9plG%X)6=9?rSR%ncH@juz0dCgJ1plk1YuM6b zI3_CmuLX6s>~;92A}(?&G^jd<%(`_0L0sscW!=At;l})Sej_7a6Y9i2sI|gY{I^|^ z2AAPXB=j>cN>x3pko59&XjGR#+k~cR27^!dvx;d>-alTNvRB>>JZVyqK!F#kH% znx~~>`?9n7d?}f+kuDnG!t4+s3=|v3RJlCoguvSXrofw~YH0WWo%QN9dAZ=!G_#7< z&9Bx2=+@*5W!6>aFp_IW!*S=OC3M;uhSwe|2?l@%xawY%KV>kUqMf60f*z)f`wTw% zwW1AUYX!3kF5)f;uA=Y<#GLE^`V-InzdJm{2ZCCgYFjAB`IxuwdmM%_`+>dt%@?n+ z8{yQQ+OC9qg#6#t-*j`G*%_89oiiFs)5+6XVnD8BzDG+@N)CO7cBfJ#51~xRNCZsK zMf3L3o}O8R>=Qh!P~ z3Ld4rtfGX&gHEZ#*wHpmdAJogkyk7pO}>B)mfcwigM7#NpgnCb1V3A=7g>?~(Kv=m z{#L|e`Kp02J@v2ZdwDsC+DTzp9;p&0D`ALhzK`e@>z>W-mtSV-pj!<*%~to5_vW!@ zb*8QJ{+Gkp-p;7LplBMp(#|>G=jEa=^1%~a(g&#rG{(be4-C=&H(A}g)=|D#=J)GYW9{mGyR`vqGqub1yb>?3_tILD1)Si~zq%!8tq5`3+19`*=2qwFIL zx;K_6j!?ZMk*@*Ak~E#+$jXKj`v9w$#qV^l>hB4Ws3c0mmy6;L5B_cIg^mwTX0F5v z*ZIJibe#rAr00}0cm+#nEUlC;7S!5u5$9E?9OZ{Whpkh{|N+fpcy*%9b zIBzXT_#1oN?^9-J#Ijz+*2E2e1ZLJNI?c7*|HdZoB%md6pMZqtS~g5u>)x>D8r^p# zTJvTKlM?iCXgwu$3{X~NXdluM?i)WZNpA24!yU1kRw{xwsuy{(SYTvB7CKKxd;`j9 zCd?FPovX)n48y{)*jA?3-p}DunxegPC;nkhC2mPR-H^T{?pR51&k?zAN0z^MD#p}o z3Fd41rwIm9C-lBySf^TOmFhmFDw4MRI&SDJeC1@Wu14VHmd&bDc(%eW*uOPTvEu^i z?VElDxJ9Y0fTIo**&}V=ilxulejVBL1v>$bXR&4ybL%&^n(HO zR}Id1iMu(*019Zajp@1SCA>&D{vmual_9{7R-r||IRp13F#{87c15*tz4EyYZ76Cd(U~8Wh>tbJ59b^)vp5QGxny-Vg?fc)OKfYWw)v za_PZ~jKFADt*QQsfW0Vz{XrfqCWksR>pH^0Po7E@As|@=OV!M_=R2DSf$^%o5er1uZEkVhoI3#bIHt7(i{EyGX87w9s2GC6^hO%McW z*8e}IzA-w|rt3PkZJQI@wr$(CZ9AFRPRE=~Y+Dme>}2A%?`M5KzP0+-)m7E|)HzkX z>Z)`0mNmrJoH(NlR_ml=Ki8<1E|-&hQ97~frvwmZ(C?p=zQc>#wOhRQRTF1V3LS( zG`29^zNbcW@Ty_XU`hvu@L1N;^>V?L?ew;M{dt)_SQS zTBLQxk<9gkW>nIDF$p*k!cZ;G)Gnv#*{xUfOmP6Lf;)xu5AJX0fnkbIBvQX-Ojf2; zknyCmDWei%8fio2Xu`@9PsG1*bjTwh>BLJ}K~o>NSx;c2RMy(7wS!Ec5h}-|uLn#w zx0x0etcEXtNnpj$-Ss~*j(?M+3)_QD&r+kd1}GiGGu7OqFj}46{U9`7`pHd^Hkp@T zW&P|Y6eGXp8y@cXJ!|*0DdftS?>TL>$Yc45LzAB3nGwZ~yM62=N6>jyUVahR^j_g{ zTt`ZlO`H^yc;#-O|H$Y%N@=g zfxR9=PW{r$=N!J#VE7CYF`1kv2t@j+IwNW`3y;J-DX)O+-L`U(NozVg0eDevB;uWG z9p9B2iS*%-d0PRnZgGT1o-kqx&-`MwBN1nR%YG1s?8jq>lCGLoiJetXl#1JETE zKnXNPMvV)vg6QqEhm>5Oi5bHLMQw!NhHI(4SMsmw?xl_k17XvDGubO9deX zrGFBEdU|nJ2u!aOXcdlm1>V-VmW`I8SPFp!pD!tbR-=t-Hru&An+lR>`tiwX*z=ik zLgISs>Fp~nxfKKM{SKC6nhWe+K3oTw9Lm$gcX1A+3+M4U!G@3@7?c-Yu{wN=C#8X! z2Q$|Q4Dsd^sPG~eD8F!gLPj}@((RIdlhN+8q8u^MKu(36uw5Jy@4ntlDbWo_tQi`su(9!<}9OwVDCq62zyQi34tew5^ zHmy`J`l9>-#cw=d`e_r@v&V}5S;&ByGws|#Usrne<@Ma6+DF8|kr{fT_cWB59A^jUv_;BI^A<-Lq(?~t~k3-Pp-$UY6oQzrKun771M^?H#wTYuWg?^>))2H>{@9AEWaUpfJJxa$NQIO7nN z-j8qhxq!5!mVxQX3wZ#nr&oRydZ+AHfz#;$bR`U~=|e};WF_ZeuWP`k!ShSbyu{)8 ztf1eH5^?sI30;C3+g#_Cz+Y3b zFRRh1;%(W}TLpGg1#H5iQ8^QTi^{qiE25-hNt*w&p~Q0#-3Xfps`17>qjGU{#?B1y zuv51JHK1Kgngh|@gDeCXOU)ZAv;^1U#~_OOu38^YIeXkZ{l~Gla_+jQi&_AF`9`A< zg3Dqv&AU*6bbFxOe}ge31#6phJ#XpR!){Pifl~h28cHwFbY&HG8|S-1j4*V5Vs!DiybOtpkkz z=}Dnb874a@^AnVJaJLqh&_}2TGd9jzZdv^`Oe7_mc$}l59$c46UiaFZCpdN{!v9A- zH)hCt)z>u5vhm%f`@2JDH-{$8gv;%uy}#EvKwj8QGnK8V3!VIS5lwP&#C z^mTa(9*zQHzxcuiV%GERiiqm-O4p=Nn8Xvl`y7pHzUTV~OKJ+qG#bZF_ORKf5h_(J zKLn{hkKwYVs14CjA-o#RK|K8mkIEmmYpghiuN-`0EXOiD5j%4mPgFi7ojA{ZH113q%| zO1u!$#WSMNEIev2#{aBo8pb9%y6(uxwbt^r5VRdOO^O{)jmFi}X%%6|*X`Q7zYaM(>{{HVLH{FuX)}QM4_K+lpVwgggpKZw9oecS56t$0 zyK4x9C=DXf;syOrDZK^xFsdinMG>y{M{eRmL8^seo*cA$|<=x zD)ml&tqtDQ!hbYiL_w*~F_%9b8Jb;CB@(O^-590qAa7-MZA)mG_ zZXe(+$2v$Wj#Puh01jN++b$M$lsv>+Yj$)ppoE&%+^OTXrM}fTs*K1M$#a^>79;hV zr~DLR8b$A}Cs(i*bWl}b=ae-i-)~ZJGh0RlUqJ=_I)PLcwgipj4kKD}LPjtYvl) z+NupQBKT(%$d{8&UHB~Qa|#&s>74I^YIkZ4Gp#N<*4~B%s;1$b4d7}t# zs{uZ>C0AEf055q>VtZ-9V`2*gn0Omhy(=RDqnSRll@q0DuvnvX6MJ30HgmG1};*%l~CT1^>{8*8> za;&>)<|+$kRuAx&@F&Y1ei*=^W&(3+Cj8e}zf_1DaUSyPF4@+vk*q*T#x62VZYLk8 z+XR12U^32bm7q%+y5PAR@kLh2Y7Y(T@li$UDf6?p2iC}2iwgsv2B6vp_xA>3<7n6V zjUfjD$%Ja>M5%^71`aY`$W6dNW+aY?eQXPJ<-EViA!BOW1T(j)N>tf^aO)49==G7O zJSsVcOfQ|p52t$i#5x#A*a_{UN<%!|H%EM%@bI!I7y?#CBAY!6>$ky>v_A1!32qC+ zU)fJHV(B10^KFj?t6ZqDBPf5cM|9pJLKikT1CzHPT}`9a+`Y)k!dc1uwZfdf2 zQ}a>B!~CfZStZ<@0WM&CI|SW=)&`H|J<`J}mEhP(ntxfTkcmBDe{jN(?39dv(EF|m z#nSc}|FqKK+J78J^us^sv=qO$If0!N^&i$2slxe*wB%&q&V-}Zz!D}*4;*dhk1`~N zIvYK#ab|>$rp?(rPEw>9M+stJ7#fIXdS%&HBPzGsp{GvIH|sIW=SypzN%PMO^J35WM9X>6lnzelx2%?xfxQ56moLn@*4HD+Tl7<IvQzy@U=@#JnG2?Gn5*Oh8N3xQ{DEEhsbxB z&N!y+TzwM-81;-)d%*KsTuI4t&=&_*d&^@D)G_L?HpS zJV5u)z@ZDRof)va|F>DKIrCxVy0_OX#k*_+K2;SC$jPWYnwPa+jDO-4f{jPod|tvs zF9rj*WwB6!ea3e12Y`pF6GB^d<0-U*DE`WA9CS-6F!JMs#m3=(06kNH_HcXMq6{CfEp4+%iMq8G2?dDSjd&`=;*LJ=e zcueAlZm8{fyaQ%Ko*vll90ee+kh^l(QV_;6Sz5k?V_@;A9Kq#BpbQ6=qbEBk;@6aO z?1$ATU3qc9M0{v#biBR}EMqb**yY^A(}#{;CPuCjcdiB-od2>c$NwbgTss*9=m zPOh}Hnr4#nYBBU81D2x78Zq*cFgC@oEKJD<>{L@29Qp1}o6WvEOdWzV7paV6I`(a( zMnACNi)x5q88zd31LJ`MroRc+49q30n4l0A#2~^=DxgiiD{Rzu@*?D?f|`yavzwue zeb0rH4mS=JJ)F=x9tj{-Jv1?M&a;p{?{9Cto-m&J!*J{{Q<@;wT?jQ(V8L0(2j7a_ zT}kk1gdA-B9;7w>$Gl8otzQ?%thz z;`=tF!Lnj#)#=zB<=y|4&ut4{*+qTfa%Kyd)CW^{am0t}s{FjuCQpK+HB<R{Ls>9XxN=ED3aOWm8k zWxmGSHC6iKwzn~2byeowmOlnUDPrgHp()LlTF_pXfy8O^qC+i+`EN`q@FpnuL{|^* zZvZN*XYW4M5s1YzKj4Qu9R%52nd;sEj5OtIt8NGA^GJ z^z^SQYnyFH1E{4X>r@&N$U3^zRhEIO;=X6Z0JwIwk(sW>>~fSc>k{kj>x4Q8h^p<6 zeGm{7Gnm%sh;fXzo!Q%eCI#C~j4s-2RX$`xTa+k+!t!K(${qD;@==}tnDYUUd{1Bq zq?cK9duyq59BGrcb`;vTq(g<=wr8`pe~6aM3_qGcJ3}rE!JI>to=%2@Psh}PN0;X# zt|NzQ>}z;KOqm&P_jn@2&nwY-$y4%$w$I+${m6l=s^PVn>0x2lZR`pv7%cCCKF_XT z6BA!D{&%{4-LY)ffQ-m z0fCD76QX9>nPGn5Vb2<4KEY9YoPK76KAuc4Hss8}D0)86FLk_LV%cwVcx5H~hka0$ zQ}uyCVfw>fDCpHhBR_m%CaukLYJa$%;Aj9f(GMxl?!G`T%oqEHl|=?odR~8d#2JZZyODuL)hNPATjPET_WoeM&%VMYcF084;iIjten0cz`4R~Pf@&JQ~ zl?k78+tYTmzgX8={s#)_+_d;aSP9s&d~x1)yhkrLry&6TCWfxOGU;s5yKcK`Gpxx# z3)R>mllB$o+8OM-4ja7lbh&#eT~#WC#qq?k)M*<4z#QSF2qsupSl95=$15+itfGDDEJtiSz(3 zwPMj=AzJhFyHWRDcS}X9i?g++Xw*s{1x)Gf^=i@G7F~Hs@2G7*EssLRHhE=+HiwlD zB$rHn=d^En_=?VIyKosv_PuzBvQR>i*LFQ1*OurS>_x_=fzvuz51l%{# zAvdNqKQr%B)zpB=jQb|(Oc)2?;0vY8=~f1F2vYtIZXCL|qu~KiwIF(PVK%9NW5*6E zr7}(#EqPxT8?JWUkN>jb)qm)dm03TfOU)cPO(ZIqM3UG##_-P8z{Ez`j?(O@@e~9& z4p|Y761#_O{Q{waIs_%(kwNuPj>ul})a;WOFqsl@{i%T&7PE6%JzDQoZiF>>4Y&zt zTt!GB86^)d^04&#d``usH1~M7>C=pRspc>LJ+(Kg6jV}YpgB@TZqQt*L*t-F4ZC}h?FwfLPed!6vtx0X?dMpHwK+5Z=-)P_*jNr}*@HjXa7U&9m z=%u8|w?BkDuH#Mzb~l_NqawG}EVPi11m2}4pzP*FQxsAREmW6QFzRW_LaZR3_Mh}A zslCFPP@NFxYmiQ8TJe=o=mHI`yf1&dvr&3xopXU*oCNm*c#!qu&LeJ4{p7$Yr^U)C z7N2K;I2a-KSp8=Qtdvz9W*Yu*3VgyGz8394o8q5)F^q>}8ettvB5 z$8dB?|58zjM{IG79jAK6V*nC*{k0H)mrG@o+u!nVV;ERr;|qn)|5JMEAwSNgz&~As z2E9?Tr=>3br`|L+DY3#X&$1*2E1ZUG{1$j7{S97!9@{JwYfUymN+N|eS2F&H`2LJn@sa^3n5S$Wx zv&fY!RKl7j_8ymR8S7{L2agI)xhOj%<>xu&mx-ADYu?_Xr++MwCTVm{r}3lZN%nN! zLFow+huN0D5wss-rmMwN>T>Ff%P$knjC_;^K*8sc{yWzwrf7*%%k2+)vkRQNA2i*j zmmOrOihw(Fl2Ns8=gVLj76hCndfSr%o}k<;j524n2*pawT5@oLC{zpd=UBlCJLV`5>!ccYtv8fl=2(k} zPw|HBUJLc183uzcd3cnY24j80vr@UQ9btxuj)MjyUSsT;WFfw(s_7y^q-UN0P*;wh zY%&3YSL>~Kvl*wopojM#9>a))qGdb71S(Q%%~9arbKfh1N(X3ug6&stIAZb#n~oem zTPzr;-w+p&PniM$TW=a$J(q*qSMt&ad)-tj>d@Us1~Dx!609f}gjC?Q!hVDqbakV; zpClZ_;r=-AFGH-jsiR*6#@*P3f?Nb9u7=n3{T7`0Q1FNJ)~5mPP1aBUw$qaDWwg24 z1&Y!tg1|n~X;Ta!t`sPGHoeRvm?#|$SJNLZxc$|P#uu5(rG1G@k#xiD?b6CDi&lu1+IvG01vuJx8kYoA$X0!S2{#dRA*+D|D*+eR~0lubYSAUh{c?O z)v(LDmvZtJJqW6$cQ_P8_wV%btLzvGIp0AQo>a8s!zbD&thrlLKQdOQ_B)K#h>=-0 zOM7W*ox^z8dCA$arb<>d(UDp2Z-3X2>em{#(G6wq;(;}|!yqbA1CL-O&%Pg>J>3~m zRnQUNnnZM&8aJL^uzEgKReg!L^ie7C>dOzCK`oBg=4E8WI_zGosw@p!*xKVx$Hjm2 z;9l$b)juY#Uo?qS***3UTklsXDKco9v>R2*#pq!~WdPDu9KL6+n33|Bo)R#6J~Z!f z=PhpPd0Yu6P)6~VHTVcd1>&Qk-_`Emg(B@6Q!Q9grV0wVf^{?|^vD)MkKYxb-P%(l zXnZm3DhiO+nuY47hu-gU0RTnS;(e^Gx6kWn*w#((%T};`8W^=X4=_{tY7;8Z> zEE@UVn&*WeO_}#B-!0xPfvQ5Oi5@JHmMt#5n|>W?Jw{e^E&tSWw=m!25!)V{5Bdx~ zV|8+F(HqLeH3?Cda8k7&X?bPO-6!+NN&R*tFFApXS> zj9N*BF`_#{iuZ#n-f`}6B_-j|K&+F?n9JokENIT*Mi`&viSL1NTRGPQI1b3G zMQYyqWQ2EL2SqcxaYuv7EerSmhTK3ih0UY_unFpRx8<0DFfuX19< zi45`*c+9`re4r4ph!EfYxcl}ySp&`u1b(MT#_stFcXnrPH}HblZ6E7l(NMf2!HhQV z_=p8)zIBk_ig$ct=;PkIt|?gCBK-{jYri=WvC$-X$o-h4#8IX)lJWl4yUW?~F{iEj z#v12>f!+SS*>2BvG(>lL>YgrsO@73T;n>Vy9a)Xl(`1~v3?fpo!a=vG_f}JTEV4s% z8>9LbHEbbs*9ynx9d`?V`ezg_>pywj8)I#~m=JtDeWPgp&XL}DL}U8q#-w5G$+3ps zkrb9GK{h$D)`>KPu4(rQmn8U}*ZZ$aJszgF_1mxKg6|fGfW}Zd(?Pa*hqJy~@PIal zqS1O&h0y{Tde!K!K8`_r=2{OLxa7Vj9}dIiQ2ma1-&pkhVy7mIOhYA%j)E;)`v4V! z>uCH6>~S;yXKuA8ID~1OLlMRki{WF;ga2l_VJ(Qj@BHnzFkbdKdt&qL4g>5@8J^mD zV$j3&+iQ3GrOp8@IRtMg$vi)33cRZgAt6ps&-ghB7GnATV2~jqTB9+TyK-yrtAt*{ z>t^1&xZX4`%B=mW_K+fAn{;LjGVwGVZ54ivn_6HeNmM!a(@AsSiBhv%tf}b#0=Ja^ zD}Ki+4^=2b4k#&hhTf)~VsZj2hyW){D80tTX2 z;m;b&|G!SO45cpViNC&k9d$8-6`uFW?)OZW2MB{K2oqqQaOf2_F3hG07LrUEsKDpS zGAvP)VN@xSe#zs#%x#WkkUyHq1L6thGS6(pRbnUh*=!0}K=x?@s+`U2dXg(kQkcRX zcF+9BtTRjHb26DQ_7WyK*=$DEPt_4bo4K&KpDjLeFW$EBp+OwWW!>0|HUY8xvxjyL zm`5yuI~1*Ev1>!VgX`cH+c|Bf-3|5bFw0R`nTdXl!BLqk$6l47{F8i{`2Ak{D+I?{ zx?`QuX71|`zEnbdhu{9|A`5?u?Z68Xq7>&S0tGLBTFd{WQ*+m$x_dBzmH;miWUYhy z%X;_u+7vc-u4=t2tG}~R_}`ew5mP{O#lD0N-WVv=!I#Y z6%w}5mr(g6dm{oF*vJ>j;1({8qL0WkdFw`@junu%mZuMgV!d9)W1?Joo@heFNW1CJ zi?)7{?xm*X1i0BY+5?%HxBaa#_uLAHDQ|PyA*k9UtzX^W_;!T-D7575yC5AQ+sg&yG!v-m z@a)(an0$cGFzfSBk~@$`T_qh(yF-KIVBalbq0SV?!JyjF=5@Vo`Zy`LL)M z#5H0j?J4SlfF#gpUQZI|WOK7TOme-}gQOJ6e)qo?UbDQxY|Qwx^%{2EgJh6mx|@E= zTy6>G(&$cH%vXn}1)8Cs`75ttaHe{j@9}YYqmi>W8*@pa5W(|`L0Wm| zpsGfnU}zY8`C@62>zU6)O3cz4GX2j+0WOlbvK`vwb0{`#fgjLx%SlSP&sic3E>|Q! zTci!0&X?xLSw7L3U}yOMRBmcORfCQ*%Ca1vH|+|e^2yOA+uRk?uwBUK5NVy5m_u4@ z=Ud{&`IYq4sHx8q?!bkeS337Kk!(Zq{LM9shgLe7(qn3S7{(lIG3VbrbEIY_+x}6c zNpEJ2&&t~R;%JQ6*M}X<5Pp5t7ZgHT+1gFp1;3Bj2a-}~wq&PUA0~8M(8|5i)Ii_b zMy11pMgP0=G-Ca1x3hnhEIfavl>by8cl)TV3T!z>p8KZf_47DGuP$kO`6 zdk^V(zb{*-spQ_(9-(rv54&O)Gm6t=^%B;YKKpG)SwF*Y$+n&k7NkN0cNx<|z+=A1 z@MxV*rqTPghwrQ+xV6&skzvzavr-|v6BYdUx9+*AYDh07{0R(CAq-b5fd zUwygKau`uS@{-VD$Ij7PwpRAcAg=%W!jpDjcC$r@Ao#w)nRiv>Az^k=T=7vzB@M@-&IRQ#$q@BV1wD0Sm6OUH$6ixjpm%!fR zg#4vdi+iglVh77-gGjyg^~5VB+N3*}u2Q>d8v17^FgyGvbzo%<0&b1M=-z1qK+jWX zhLMmp%SNo&UQw4QP>1nbUftPU{sM=KoxA}~5OVDY z+JQSu#y@&1cK#QGfsd)$5n*SgK<{g!FWvIEu52mNM~y&O0=tw|KHX*B5I*{P8wE<) zd{knb>_ya98WmFoyBdh?xJ~IT`$J;;ItksIT}`#q>!Su|FLhmX6iRcVeYeKnJHrNt z*N|MxrO9mH*Gp9X8{LFb3#)vXYa$|AOedx%Kpsm5i0=>P6Vsn|;|b~3<+ZNaT;36W z)=W%L=yx>wb#4Xw98Sd=Jn>)m68;GLPKDT=uF7hsW(Dif)ekPpgMiZrt)Fa|)60Ou zpGC(EzQwjYIQ>H~W)#$Snfm_Zzp!X)GV@r*vAUFBC&sW;rWQJrzL63GgZeQ2Qm&Vm z*5_3k1cEP8b}s>qBv-~5SwUFlC&`5*kinpLYi`~wUG(3teo;{cQ-kA`%zISEo++KO zX35c1-7zHhrI(wtlPQUVDkV0OSZs_zEHi1@?Um|J-T9J4eoWL0t}rH2V!)(<ix~3-K8j7p#$x^!cyMT3LkXB@KV+bTb`d7J= z*G>^3BX`~3EA)OpjuDFRP{6Z#T(e&auTRSQFF&8^#iS31ZY>10k~xT)gr?&DX6M3J zBgxtc1*+oY;Ybp*$JK}a`Y8_SNeDIIfTLB2A%&QUz!A(6GBLI;~ZGkmn z6~nnIoYK%2cE`vYD8;(Yctjjxi+4wVo$k(LlWK-A;W7MK4J543GNtGXZJwVAl?qc~ zOK!Aq*qM|M>+PIb zW5!pn&DtOu<5`8#uL#<#*ViX6akTo3Yo4kLl&E(!18B`?Z2f!2ps52Gj~xrIy&yfj z5an9dOYmR6TOB6%T`?OA_GP6CXsV!$>)84+tdcC;mu`yDLu)x2T}KbGMo>lE_8eUH zz{$8h)Rd!^c7_~={1_}}e)t*yX+-Y2f=wCY(sB-QM#;t9_1HSp@|+SWsLYZp$l zzQ@?->8`bNuFuwddk=JEtVC%TwMI1f_-SFQdpE|S&B|_nRx|HXi_*fh7JH!NxzS1U z+}x`uaa5NuJ5K6>z}Rc5j2?kdLH}#4G>ayz3DfPf<5ObN`Xg?H)ScUHZW>sKu5Oq+ z8<>$!!xCP=#UOpyMG4jV+P#)}o`{CO3?dAhT<=;lLYfx*cT>S=%_%a~>$N4rSK(Xb zj~jr->ts4p}H%xW@4 zsGe6b#@iug+;@2=zx0X#y00|;@>{gT>4RbJr;AtM?=O9;Vpo%}_@!(-PP_K7E=Z8b zG{jDXe#TzXg@%ss;|iTiDb!TaH8Q;fMl0nJO84k<({B*U>1uI|`C=wV4L;$4Sz{t` z{Ahy%k~b2f(;Do#G!zrB1`ET!kWth08_TBS*xv@iRS#{Wh7}G!MxaI2O5AZvj27-s zM-=FO0MNv^iY;YfwDJ&cx5+k;lG-oVgoP(0axHfB2Q>7h;0SloC7{Hs4k*CM0q6dn zB0PN7n5!lx3^82U^k*GvPkC0V{>-`XywT4p-E$q5xVO$3D9~H(aSzy^G`7xG9w)Gv z$!a=|eYQU>ja+iCz1c2}u+|)uLTg067dC9O8nU!LV#%p&1r9Lf&X$+YRU&@r|3+#L zyv`+=TRGLLrPuoETY9*F#*vS6PONZ|) zbse095^4CWqnNE=7WGHG)Js`aRJlZSQ*^sqziZyi)+h!!9=-5N#D`J>l9nE*%AShG za}Z>dJwiZA>SJLNCL>|?JQ2j5%5kSG#1fHefs_;t%7;v=-FV||K6T2g5Sz#8$hRhg z3u1<$bhQ=9t6(@5&i197Inds|r{ltceqHB7Cz1SH$YI^-TiU!e?hKYY>3p9-99nWu z!|&o2lM)ZGm0V*6aw+oo`u-7F6<8%bscm;)5?7qy$6L1WS9lY?vb8I?AWAz&w0un$ zwx)c;+n6+H`L9W_t3FUpq5ex;KnF1Sjd=g7hg?%A8lw3VLG<#aRQSr&?;E;BNt|By z1e8l*$>8QV>_sAm_UkH?XIwB9rb$aIjL1?VYsrwnhsi~g)kLma-}e`cMb8DCWkt5U zY(ejnTGk;$W;erC^_I~!yAA4DQ}8HA)BpxgjL4qv^B0?9NS@#?X zqwVJKU*BULCs@Z(*qEyP+c)xasu2h?mJAk2n*&BLh;;~apM*9l=tpsT%t7Wbjt=R$ zxAc&3C#{ilx|xePTHc%=E3@-2>##CS8~b?$t)eSxK2l4ahRx+rL)6wspl_c(9M ze8Yzle-OJmY3(L1MV(|*^x1<{N6zp_{-%^QK1h7m&d$v%-OGf#l;8h-`+^=LReiRr zW+gmc_=mFUCn0NfK1N>}=m>brjbOs^5MzZpWnLWhtU0nW`f!GnEmC@66{A1J`T&dn z#OAZnYU_-NrWKbTN?;6lE-rcu+Xu0-U_0sZFGDL2Nos(v;{qiBD!RRq{O-Yurg4OC zInVtue=?V5Xg3><@~utdWt+ynPzTr#_NyK@qZMrdC17|KX3~l}2trp_jb|mUO7R^4 zpF$cDK@wbQDd<|UhCojYzmG{FtVUpz8`odwZHoMkj2k?;_?f;}o0fke7|!~VcJnA7hhYRwOLXe~FcmiTeygoy9INe@$8JTv_O zqIK?ZX|$%bx*wOt=l?EYEHLVA>6VL@X{~(o`itsbC^*ygK84<8J!5 z@e+?jI11$jzDreg`Rh~EniX)-8sS_W^T1a&EwVQGnbehcHnd|yyz#z~9H!7VCc(Zw zAOzmGKz!==PX>QP8~LXKy{lKFoOamzVR$`iO(Ln&2!*xgX466~I*aiDO77h10B#)C z`qm5?xY{d^0hj*H^JIonHv0~5t)Zt)zmuzHbf-muiBzu~>Z%I+{%DFC7@Uul?{Ec9 zWv+C8610Y7n{jv9XtLjn?ebF|!3qACiDgR+l|qiWMk~0c33%wo6XwA42Zq>`M@E$J z{I$Ol^YObK+3{-tB!Fnk&I9cqA*@0Fz!1EL%)f)p)Q1G|LBe-wC?qgX<{|BX@{p5%OtW++?5}MAifnt*j&kkgCieAx`=c;UNf9Dq=Y@!yUMX^*W_mimT zlef?9z{$TiOs*LBPOw!}@Z>lJ0>{r(Bq4-_%l>a+(gWBIle7gG6r`5}POWIOXz2C8 zbBSfa(L;|sN!|QmsO46{Yj*T_yYj+n-JMv>k1c4!qo)Njl)w|>xdyLaF99tIj$$-2 zETH7*UoLbYl+VKE@>%3&*yz8+2k6Vm{oM@)6F%JO0i5nt^j(dmtpkW-&AL~P`j*VD zX%1)?VtihVUDqK~m3HHAr1QtSL_x%zan9G0&V#0OSHTlT<$?iYbd%+_20{WlwJUws zzWeP3y&9syHZ+vc2lqOHcX~48py3fAR$JBx;7xx-#fmx)lnvu)FfGtQJ`~YGQf1LH z?nyB$Ss1xT;PKD?x@TS&(x&?MaEed+Zy!Y%uKc-Di)3TN{!|kiZS&FclJFXqxv-8U z76HcPtn+66V3egRd99>Us;d#T#;TwmMv z1gzGW( z9PMn1OZ-L+GTXj}tCnKXrsZZ*(@xBQmoT?(56VCswsV%p1*+5|srk>^cRECsr5bYZ zqTIQ&?nUTpfJmTg!s7)$hcKdC;|hQ1lcoTBrcKB7`EgrmUlntFOd<{Ou!~<1QeVUm z{I7jH$-q?->D~Wgl_Go{U_dP&!e%a&IV((xsOeQ?8)JTLRS^xsjfo9M6IC>m}P_=gY|h`Q>v)&BT-Sip+yA{vaPn*{br^;C7K>!t3;! zjE_sXz9JnWNAX{L+p}x$Z^fXPsCiO3l#VO+$@V_l?feY58fZ&}&X-&HjFvJGfKQ32}+TSyCx?f##dwR3}#R|1Rmf9?39SAn|?J^6P z)KIYV=J4W51Qp}yq^ zE=2?%VyH0+cr)5>V;c`T?BB*sogUYaBFrFtAT4zbAT9YhG}etJ7QpQA<4CkH&*zHY zHf72~!PZw$#R=%=6vbN0@=v@@Db)OHXXKW=WMoj6*rEb?IcttlHYS)*p6P8A4bmN# zQrGMpu5vG3BV{C!6nD&ch~u2Rj9{Ik9PCk7l(1Yn#1Hk{+)HF=mji#;#mZ$^asnf% zVVKN>cjUP$)@%aNb_R&o%tH(8l45Y0j3B546ufqj76&^( z!MkO1MYTGmTt?WshT2F%F6V?BA4h!x6|+!mJ+d1V+(sLL?N9pTI~o#yyQRUyd0fUj zHO!W!A7SCab6V-Nfsn$jFvfcnU2*>}WJi0Oi+jpwodYP|g*f4dwHiMk`*wqdV!g|LP)ij6`n|gF*DgD}*MXxbcYYPNi11=JxO0rM7{M zlbNTYz(t46F~P+&+ZfJzmnpEpOLd4;mH6!I#%SU<@oH;d0-z-8mxi-o+S_{6fg9Wj z)_3caK~Y?-#R{=OET$1Q=-$@wr3L0>pn-^X0!n8*-&qI?FD-hlLZ9mM$nBbqB(ws~ z40Z&Ko!(=BG1I;MeK#ZkIXkI2E!WkGw#e?s(f66+;<^>vldFHbjH@D!g&853HygbQ zb;`aUz}42`<*fE9Ia&<`f^CwJuZjGvnd-uAA$i$+A!lZb6-oW^fRc_DHrGZ?e>{dx zxI(07>as$*twIC|Wm56nI-;9y7NwR3k8Pt4U~6&I(ZjAiztwr7#)` z{4PXGb3(qWdbt@OOhd>x$zlJ7n-RW2q*|9~Hzxb;^@$RCJ~wQf!|Efy!>74WyK7_n z6I;vclsC@fD9goHtiXIg@!Uv6$AaqACUq}V9Y@m1j6MuF?L-UJC)wbpI#etPd{FW|~N`*?m5wPk5M1?nKh@FrKZ&U%b$U*UaDeXtJ1 zbIQa!Q(x!tml+HC{MjZ;LD@^5A5*p_9xtJVp&X|k`=Mj?B=&Rs{qE=FI+5@&i+j6( zXT<0G4Vs!YqNg3pLdykJK?w)bRv?NFH-wh{LeOIT^JoF=%PC?u;#`OHd+Es1uEuL< z8$ZunI_fCJ7=XP^Nb;y8qTVcYMU`xkf&B zMW|wcTY}7H24{=bZwkI)I7Vqm;DnPlq7c4D2;l>uuGVhg;*zjgkd&U;0%$rCuTy_fxWmW*=e-S9uqLS2)bLUJ{98GGKY!_-FaMn{SmClw z_mVk8#FCBd>kPd$6EKl?MF6`>y6dDJYG?%)Fi?~}iFX0At-zShh80Nu5GaqHf-7ey z!BrEH3jFEV{6Sw`3p-DR9kxURg)Tu}nHvAu`Yqf+?J_{jXpJb@);1I1n2TY@$p5X# zuD$Sw;9uvI&u!_&FEI?__Bt9j#hc~LpGpcNK7(GApLCdI=h;^d>w*eU z{VbAIc=>8Zjm-TqVQD4=s4ouY)28~DW3H5zB3_t4c88Hzos`XmXe*rmYwudTq3Zho zOyp9^EhVC9im2v3W5&1)a%adTRH89+hH;s}j0W{Y5sK(>&81XwE0z ze?iBi;EGRpaAxG*pNYQs4UV~Ow{Z2vt0E{AwnrQG)MMDyQ1Y!r{)Pf?X7C9a0%Xgv zk)dnzD5Rk3kA!B|!f4H%?&OG4;2~ZZ(veSan_1oOoq)!M%sy zrT)s9V&n_l>|LUDU#Ht_#XOO%zxO?}lAz1iv6kFDbC#R;_`OSD+zgL}G%Zk%rEmk$`9~HmpT4!&SaIi8Rox=b8e2>8f)JYo!|8fi>QyVM?N1G}s(t z1hd9g)?>Oxy`JO_c2kc#t_^|CbObfMA80;2Bz5e{$LaUwS|WnCbKJ=wEHt9PcNdH;j4v-?j$7rsUAk|=7_ zaC(}ye+rGS*t;&_R^#Y;D^*81LE*gPXG0lV*XA2etqNNeil*igt_bRyzBaoSm{@G- zTuYd`Ehg$?Cz|A@S=MOcO_(a*{tXiXlN$HvD?NEC)^XDE>+Z~(k#>%>(X-%}UNde2 z{qY~V{L|}v?aM;HrN}<@&H8SkjAaiHjz|l<3py&i7&*=5VSD+73P^9bQ~ig zAGK!0z*9sgyNP7Wvg|IXROb$#4CQ@McxTm&op}cM{;`I8`LA_D`U=9l&#@y=79R0|b-4Mj={< z&%W_e`~$|?Q7t&TJJdGasI`~t!`m!9^5t;un`E?Fw7K7zLX-5MT0?oyVbL$~VTw7y z>{pm}_AL29mTtp_xB0u(%by2G`ES+Zq{f=gmyyIaCCY5tso(J-Z}6)Y9GcmE+39nZ z_nI-)oq3PMZkf*y6rBExw_1{)E2C3lE+ziwx{XCSFpACX2ZDqr+Tbo_u)STr&*T~5 zcx|_+AbaK#`L7svj+JH7ccX1Sh|!rH<(;|b%q8D=yBMhOEn-Pd?o9_LZHg93oDpIV zZU0V;N@2o=9;u|d7AQ_|`(N7*%d>k-lz^~%HRq*^v5Hz3nTsz4^gk)3x$`x=j1dO| z(aXm>`=qmE*$(riwc?I`c zPw3m@F0%h3S+2F(Cvi@f+z=;fMLoqzdtQ9!Ipvmc2k6;f=rrProl5S_eq6)Stp~rs zj;-rGp^we#wBsPMh?fiAn&jsHaVC2V^UCstLu|zLu9$OGj|!P?ePuGDGwpkw2^;q) z;U`isBpfk+$J0wRE9^TW7K> zpERFol|1P8*hJwFvi&A|lC6jTZzF(>FF)=FGH!>$5pqs0@XtQq9 zf+C|G&g8?r@I%+y50#=M?PT4ldJ2Bg$@SGc>o;}^UeA@HBKSA@<$L~AhFxn!rpJiZ z_^%E$@*401|9kbx-#+!_A7<)q7x|$DxCL{&EKxOPxJ+Z|IK54xF|(fK&2RZG(Pw7+ z*+9A_18*K7_6nK1w)S`TD=w0j_YHi{59U@CZbAig9qJYY4G0w1*!xRw_V6yQv^V_- zy)oqcev$ARw-svr}l|0eZ)QcsqFCDtE+fY z=xHY?v(QD-%GRc?6}WK5?7(>U-TAi4Rh#%Ho-~=pvv(Vne)h+S9i6>oDu09`g6*;| z89VNk_G;IGP&L)XbwB`8rg~M4qE{JyX!inP>tIfMX<~su$+|){G(@hgZ7^!cGqCs8jS zmp!Z;nutqNQ#|Q0St4^)f1LN1U32dKKvd%y#XQ$6yZ=KSe>)A}4Ahvby`9 zna+HBc46^N+F;#_fU?YlVV$PAY&TIzkjk19R5md}>B11+^~xd9GLd#gWy$B4<5v3| znS~6;ty<7OsFxz?Q&0@(mS=L8+;@CwM@SpJIvXr??e&^Lc+A%Dmgy;o6tHK<@yj2? zQl;WbgE~k-VZ<>=O=cMbM&N(tl6OnYsH(7w(ls{wW`+{ z-o9Xi{yxr(4GW%7hHjcJ8`be=)fnA+@525q)vQ6~lUuQn5686AZTs7%4B|{+Z|ZUD zlWn2lN$T9dyB6xPWFzD^@&e};$3QhPSP~5ObTK#~LM>eh*CGAt2d>5}= zda*?{tV&GEfIjJ9-4mu$q7qXkVLZTZIoa|x(5-tdB;g&s0#a9WphWd1Wo|>w^J1xp zJ9Hv9R3L7;cFrupkPmqraS>vTfIMnV5P@(lY`|A0{I)RunzGsI-2Jzf)U52*6gkbX zE%54%bq{u44VbpENv1&US{=>b7mu3H7oREUzjG3Sfgc#4Hf70rizLbg^z+Q$u#b&S z>_g>M$YU; z_dou0$Q7PQQl6O(OL>8>tbhvc8_(xE%szQc;j|h@j`1_|^gyV2GG(*u&BN6B8=42? zASNyrrtJ_2#KK}1L;|eWKp;?22o#j~t3h#Dju3%BRzXD|UEUpAK< ztOuttI355Ql!eVGIBW^R^U;F~UG3!r0x&!hk3=I(f>}qgaL`5|gGshGHeI#=p6S88 zcszeH3dQI1k$fDI6X=P;XlrYu&{z}}ivSS_ZU~!43r4WH+gB_Y16+C_%b&;Muwg=r zG!IS?PY(|I{}GsvoM!SUO@=T6`%FAK=M>N+l z#2-M}16)o}ARRC{3b1+GSJWBwpSu1*fxb%}V9-&3FW?8lxS%)8PglZ0`-v8I*pubw zzoY>&`xC`uG5?|E-{KKoSqgu}IjHv2-oGJN`Y8m0WRQ(H^dMn87RGvTp;I!0LuWC_ zOCl3TWZ<>XBm{$mCn4}?f)+xXj=>=qXrdMlgU2$kB*uyz3pSTWW77el9ndn81scIK z2zazMnt`AJ1S|qiBhnBw43UY@W-thJB3%n05m;8;v2O!C*lG$W#u4#SHmxP+=A>ji)(_3%U(i&L{^UU|I5I!ItJTnMVH+ zCzo~<07vgfBi)O}_5{E@2j|+47S?|lPdeH|NC^f(*Cv4DK)?bB4{aJ9!DJGMXb&wd z5{5xr(dTlQJU%TDF!The0T}?N*3zm3(^#Tha|Oru0)%{m93ap*1Qx%<0gj9&EpvbZ z<3|Zo`A1h!|G$?@*Zw8#SK#1UA{2ivP5Q83$1etcG4P9lUkvh`dkp+@a|5u! Koem$ob@@Lxs>KQb literal 0 HcmV?d00001 From adc37d94696b657f176c6f4050913a052a50ac87 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 24 Mar 2025 16:24:39 +0100 Subject: [PATCH 014/183] formatting fix --- midpoint/guides/tasks/import-tasks.adoc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/midpoint/guides/tasks/import-tasks.adoc b/midpoint/guides/tasks/import-tasks.adoc index 6f4dd3538..9c9c894bd 100644 --- a/midpoint/guides/tasks/import-tasks.adoc +++ b/midpoint/guides/tasks/import-tasks.adoc @@ -41,7 +41,7 @@ This is the most straighforward way to create tasks in general. . Click icon:tasks[] btn:[Tasks] dropdown menu and select icon:plus-circle[] btn:[Create task]. . Toggle the *Simulate task* switch to *on* and select *Import task*. . Name the task and go through the wizard keeping the Resource, Kind, and Intent to defaults. -. Click icon:check[] btn:[Save & Run] or icon:save[] btn:[Save settings] based on whether you want to run the task immediately. +. Click icon:check[] btn:[Save & Run] or icon:save[] btn:[Save settings] based on whether you want to run the task immediately or save it for later. === Using the Main Task Configuration Section @@ -56,3 +56,5 @@ This way gives you full control over the settings of the task. ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* for real production import. ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* for real product or leave undefined. . Click icon:save[] btn:[Save]. + + From cf6d046829e20ecb68a7e3fff419c455c8c5a28b Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 25 Mar 2025 08:28:13 +0100 Subject: [PATCH 015/183] Finish v1 of connecting HRIS, start connecting LDAP --- midpoint/methodology/first-steps/connect.adoc | 186 +++++++++++++++++- 1 file changed, 180 insertions(+), 6 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index fe03d8a5a..30c8c7d6c 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -57,7 +57,7 @@ To get users from CSV to midPoint, use the CSV Connector and configure it accord *Use the xref:/midpoint/guides/manage-resources/create-resource/[guide on connecting a resource to midPoint] to help you with the configuration.* -=== 2. Configure Resource Object Types +=== 2. Configure the Resource Object Type The next step after connecting the CSV resource is to configure the resource object types. In your case, each resource object represents a user in the HR system. @@ -72,11 +72,13 @@ After you save your object type, you can preview the resource data to see what y If you close the resource wizard too soon, don't worry. You can get back to it any time: In *Resources* > *All resources* > , open the object type for editing via *Schema handling* > *Object types*. + +Similarly, you can always view the resource objects via *Resources* > *All resources* > > *Resource objects*. ==== === 3. Filter Out Irrelevant HR Entries -// This should be a separate short tutorial that elaborates a bit more on the topic. TBD +// This should be a separate short tutorial that elaborates a bit more on the topic. TBD /dakle // There's a hint on this at /midpoint/reference/master/admin-gui/resource-wizard/object-type/#specify-the-resource-data When you preview the resource objects, you may realize there are some accounts that you don't want or need to manage using midPoint. @@ -94,11 +96,12 @@ To prevent these accounts from being imported to midPoint: . In the *Specify the resource data* screen, type a filtering condition to the *Filter* field.+ For instance, if their `employeeNumber` starts with `8`, unlike anyone else's: `attributes/employeeNumber not startsWith "8"`. -. Save the object and view the resource objects again. +. Save the object and link:#_get-back-to-config-wizard[view the resource objects again]. -. Click *Reclassify* at the bottom of the list and then confirm they no longer appear listed among the resource objects. +. Click *Reclassify* at the bottom of the resource object list. +. You should see that the `8XXX` accounts no longer appear listed among the resource objects. -Now, you're ready to import users from the HR system to midPoint. +Now, you're ready to proceed to the next steps before you can finally import your users from the HR system to midPoint. [TIP] ==== @@ -107,11 +110,182 @@ When you viewed the resource objects, you were looking at real data at the remot That's why it's called preview and why it's important to preview the data before you import them to avoid needless clean-up maintenance later on. ==== -== Import users from the HR System +== Define Mappings and Synchronization Policies to Prepare for Import + +Before you can import any user accounts, you need to define how to handle the user data in the resource objects, as well as specify rules on how to behave when users are discovered, updated, deleted, and so on. +This is what mappings and synchronization policies are for. + +=== Set synchronization rules + +Firstly, let's tell midPoint what to do in what situation. + +Refer to this guide on how to create synchronization rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/synchronization/[] + +The rules you want to define at this stage of your project in particular: + +[cols="1,1,3"] +|==== +| Situation | Reaction | Explanation + +| Unmatched +| Add focus +| The account from CSV doesn't exist in midPoint yet, so let's create the user in midPoint. + +// technically not needed in clean MP but they need to add it later anyway so I'm putting it here already /dakle +| Unlinked +| Link +| There's a focus for the account but it's not linked yet, let's link it. + +| Linked +| Synchronize +| Synchronize the data between the remote account and the focus based on mappings. + +|==== + +=== Map user data + +Secondly, let's map various data in the user objects on the resource to user attributes in midPoint. + +Refer to this guide on how to define mappings: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[] + +These concrete rules you want to define here. +Your source attribute names may, of course, be different based on your internal naming convention. + +[cols="2,1,1,1,1,5"] +|==== +| Name | Source | Expression | Target | Lifecycle state | Explanation + +| empnum-to-name +| `empnum` +| As is +| `name` +| Active +| Name must be unique so the employee number is the best choice now. Later, you can generate unique usernames, for example. + +| empnum-to-personalNumber +| `empnum` +| As is +| `personalNumber` +| Active +| empnum is also important for employee identification so we map it to another dedicated parameter. It'll stay there even after you create unique usernames. + +| firstName-to-givenName +| `firstName` +| As is +| `givenName` +| Active +| We'll construct a full name from these. + +| surname-to-familyName +| `surname` +| As is +| `familyName` +| Active +| We'll construct a full name from these. + +|==== + + + +== Import Users From the HR System // This is covered in [First Steps With MidPoint: Assessment - Evolveum Docs](https://docs.evolveum.com/midpoint/methodology/first-steps/assessment/) but we need this for GUI +Everything is now ready for import. +Before you proceed with the real import, it's best to _simulate_ the action first and see if everything behaves as expected. + +* You first simulate import of one account. +* Then, try it with all accounts. +* Finally, run the actual real import. + +=== Preview Import on a Single Account + +. In *Resources* > *All resources* > , select *Accounts*. +. Pick one object (account) and click the dropdown menu on the far right of the row. +. Select *Import preview*. +. In the popup that appears, select *Simulated development* as the task execution mode. +. Click btn:[Select]. +. Review the data in the simulated import. + +image::import-preview.webp[Preview import of a single account] + +You haven't created anything in midPoint yet. +As this is only a simulation, it's the best time to review if the account data map to the right user attributes, and fix it if needed. + +Once you're happy with the setup, you can import for real. + +=== Simulate Full Import Before You Go All In + +Firstly, make sure the resource is in the *Active* lifecycle state. +You can find this setting in the top bar when you open the resource via *Resources* > *All resources* > . + +Then, create a simulation task for import. +You'll use the *preview execution mode* with the *development configuration*. +Refer to xref:/midpoint/guides/tasks/import-tasks/[] for more details on creating tasks. + +Inspect the simulation results and confirm whether all is good. +If so, proceed to the real import. + +=== Real Import + +You've got everything ready to import users from the HR system to midPoint. +xref:/midpoint/guides/tasks/import-tasks/[Create another import task] like you did for the simulation. +The only difference is that now you're going to *use production configuration* and leave the execution mode on default. + +.Double-check archetypes +[WARNING] +==== +Before you launch the real import task, double check that your resource objects for accounts have the right archetypes. It's complicated to change them later. +==== + +The runtime of the task depends on the amount of accounts you have in your HR system. + +Once you run the task and it finishes successfully, you'll see the accounts as linked under icon:male[] btn:[Accounts] in your resource. + +Congratulations, you're ready to connect a target system to midPoint. + +== Connect Your LDAP Target System + +The next thing to do is to connect your target system. +A target system is a resource that acts as a recipient of data _from_ midPoint. +It's not authoritative, yet it has data on the same accounts that you've imported _to_ midPoint from the HR system. + +When a system isn't authoritative, it means that it can't overwrite data in midPoint. +Moreover, midPoint is supposed to overwrite (read: rectify) the data on the resource if they happen to mismatch midPoint's truth. +This is useful in cases when, for example, someone creates an unauthorized account on the target system. +The account needs to be deleted and midPoint does so as soon as it find the account, if instructed so. + +As mentioned in the previous chapter, the target system in this guide is an LDAP server. + +[NOTE] +==== +The steps you'll take to connect the target system are going to be very similar to what you did with the HR source system. + +We point out the differences at the right places to ensure you don't get lost. +==== + +To connect the LDAP or any other system that contains accounts, follow the xref:#connect-the-hr-system[same steps you took to connect the HR system above]: + +. Create a resource for the LDAP system. + ** Select the LDAP connector instead and name the resource appropriately. + ** The connector configuration is more complex. + If you're unsure, your LDAP server admins can surely help you out. +. Configure the resource object type. + ** First, configure an object type for account kind with default intent. + You'll likely add more object types later, but start simple now. +. Define mappings and synchronization policies. + ** Refer to the next section for details. + +=== Define LDAP correlation rules + +// TBD - table with correlation rules for the LDAP resource + +=== Connect attributes with mappings + +// TBD - table with mappings rules for the LDAP resource + --- += The old original content follows --- .Goal From a05bedbc661349bc155f1416c5ef973de850dea8 Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 25 Mar 2025 08:28:55 +0100 Subject: [PATCH 016/183] init version of root for guides on tasks --- midpoint/guides/tasks/index.adoc | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 midpoint/guides/tasks/index.adoc diff --git a/midpoint/guides/tasks/index.adoc b/midpoint/guides/tasks/index.adoc new file mode 100644 index 000000000..0a37a1152 --- /dev/null +++ b/midpoint/guides/tasks/index.adoc @@ -0,0 +1,8 @@ += Tasks +:page-display-order: 11 +// :page-toc: top +:experimental: + +This section is all about tasks in the GUI. + +#WIP From 0699fec97689eb8fa9995560bc4795802beeeed2 Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 25 Mar 2025 08:29:39 +0100 Subject: [PATCH 017/183] basic guide on creating import tasks --- midpoint/guides/tasks/import-tasks.adoc | 31 ++++++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/midpoint/guides/tasks/import-tasks.adoc b/midpoint/guides/tasks/import-tasks.adoc index 9c9c894bd..715c99f8a 100644 --- a/midpoint/guides/tasks/import-tasks.adoc +++ b/midpoint/guides/tasks/import-tasks.adoc @@ -23,13 +23,13 @@ To create the simplest import task, you only need to: * Pick a resource from which to import object. * Specify the kind and intent of the imported objects. -* Select the execution mode. +* Select the execution mode and configuration preset. Everything beyond that is optional. *You have two ways to create tasks:* -* Open your resource from which you want to import via icon:database[] *Resources* > icon:database[] *All resources* and create the import task from there. +* Create the task directly in the corresponding resource from which you want to import. * Use the main task configuration in icon:tasks[] *Server tasks*. === From the Corresponding Resource @@ -51,10 +51,29 @@ This way gives you full control over the settings of the task. . In the form that appears, specify the basic parameters of the imported objects on the icon:briefcase[] *Work* screen: ** *Resource*: Click btn:[Edit] to select the resource from which you want to import. ** *Kind*: Select the appropriate kind based on what you've used for the objects in the resource. - ** *Intent*: Leave blank unless you use multiple intents on the same resource. + ** *Intent*: Set to *default* unless you use multiple intents on the same resource and need to select a non-default intent. . Switch to the icon:gears[] *Execution* screen using the left-side menu: - ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* for real production import. - ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* for real product or leave undefined. -. Click icon:save[] btn:[Save]. + ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* or select *Full* for real production import. + ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* or leave undefined for real production import. +* Switch to the icon:circle[] btn:[Basic] screen and name the task there. +. Click icon:check[] btn:[Save & Run] to run the task immediately. + If need be, save it for later without running it yet. + Until you run it for the first time, you won't see it in the defined tasks of the resource. +As opposed to preview development simulation, the full mode with production configuration runs the actual data import modifying your midPoint database. +== Simulation Results + +// This needs to go to its dedciated section once it exists + +You run simulated tasks to confirm your configuration behaves as expected. +To see the results of the simulated task: + +. Open the corresponding resource via icon:database[] *Resources* > icon:database[] *All resources*. +. In icon:tasks[] Defined Tasks, click the task the results of which you want to inspect. +. Click btn:[Show simulation results] at the top. + +Here, you can see tiles with an overview of what would have happened. +Click the btn:[More info] buttons to view the affected objects. +The left sidebar shows an overview of object counts. +Click the numbers to list the objects and see more details. From 91baaa8b134917f25018ba78db7e1572ba1a6407 Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 25 Mar 2025 19:11:21 +0100 Subject: [PATCH 018/183] add icon support to the header --- midpoint/guides/manage-resources/create-resource.adoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/guides/manage-resources/create-resource.adoc index 0f137c930..f9ced870f 100644 --- a/midpoint/guides/manage-resources/create-resource.adoc +++ b/midpoint/guides/manage-resources/create-resource.adoc @@ -3,6 +3,8 @@ :page-display-order: 10 :page-toc: top :experimental: +:icons: font +:icon-set: fas Every system you to connect to midPoint is represented as a resource in midPoint. To connect a system, you need to create a resource for it first. From 7662f814ed77963393dc3340afe7bcf64542bf8d Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 25 Mar 2025 19:15:37 +0100 Subject: [PATCH 019/183] describe LDAP correlation and mapping steps; more docs interlinking; change heading structure for clarity; describe mapping naming policices --- midpoint/methodology/first-steps/connect.adoc | 193 +++++++++++++++--- 1 file changed, 169 insertions(+), 24 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 30c8c7d6c..3cbf0a771 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -3,6 +3,7 @@ :page-display-order: 110 :page-toc: top :experimental: +:icons: font .Goal [TIP] @@ -46,18 +47,24 @@ Overall, when you integrate an IDM solution on top of existing account data, *yo == Connect the HR System + You now know what to be careful about and what your nearest goals are. Let's say that the way to get data out of your HR system is via a CSV export. -=== 1. Create a Resource for the HR System +=== Create a Resource for the HR System A CSV file can be a resource like any other. To get users from CSV to midPoint, use the CSV Connector and configure it according to the structure of the CSV export. *Use the xref:/midpoint/guides/manage-resources/create-resource/[guide on connecting a resource to midPoint] to help you with the configuration.* -=== 2. Configure the Resource Object Type +[NOTE] +==== +Set the lifecycle state to _Proposed_ until you finish the whole configuration of the resource. +==== + +=== Configure the Resource Object Type The next step after connecting the CSV resource is to configure the resource object types. In your case, each resource object represents a user in the HR system. @@ -76,7 +83,7 @@ In *Resources* > *All resources* > , open the object type for edi Similarly, you can always view the resource objects via *Resources* > *All resources* > > *Resource objects*. ==== -=== 3. Filter Out Irrelevant HR Entries +=== Filter Out Irrelevant HR Entries // This should be a separate short tutorial that elaborates a bit more on the topic. TBD /dakle // There's a hint on this at /midpoint/reference/master/admin-gui/resource-wizard/object-type/#specify-the-resource-data @@ -110,12 +117,12 @@ When you viewed the resource objects, you were looking at real data at the remot That's why it's called preview and why it's important to preview the data before you import them to avoid needless clean-up maintenance later on. ==== -== Define Mappings and Synchronization Policies to Prepare for Import +=== Define Mappings and Synchronization Policies to Prepare for Import Before you can import any user accounts, you need to define how to handle the user data in the resource objects, as well as specify rules on how to behave when users are discovered, updated, deleted, and so on. This is what mappings and synchronization policies are for. -=== Set synchronization rules +==== Set synchronization rules Firstly, let's tell midPoint what to do in what situation. @@ -125,7 +132,7 @@ The rules you want to define at this stage of your project in particular: [cols="1,1,3"] |==== -| Situation | Reaction | Explanation +| Situation | Reaction | Comments | Unmatched | Add focus @@ -142,18 +149,21 @@ The rules you want to define at this stage of your project in particular: |==== -=== Map user data +==== Map user data Secondly, let's map various data in the user objects on the resource to user attributes in midPoint. -Refer to this guide on how to define mappings: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[] +Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[] on how to define mappings. +You want to use *inbound mappings* because you're pulling attributes _from_ the resource _to_ midPoint. -These concrete rules you want to define here. +The xref:/midpoint/features/current/mapping/[] feature page may be useful to you if you wish to dive deeper into the mapping mechanisms. + +These are the rules you want to define. Your source attribute names may, of course, be different based on your internal naming convention. [cols="2,1,1,1,1,5"] |==== -| Name | Source | Expression | Target | Lifecycle state | Explanation +| Name | Source | Expression | Target | Lifecycle state | Comments | empnum-to-name | `empnum` @@ -185,9 +195,22 @@ Your source attribute names may, of course, be different based on your internal |==== +The mappings can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state. +.Naming conventions for mapping names +[TIP] +==== +You may be wondering why name the mappings the way we do above. +On the first sight, it seems redundant to name a mapping _surname-to-familyName_ because it's clearly visible in the mapping ingests surname and outputs its content to familyName. -== Import Users From the HR System +You're right, of course, but the reason for this naming convention is that *mapping names need to be unique throughout the object type*. +This convention helps to ensure that. + +As for spaces vs. dashes—you can use either, but dashes are generally the saver option. +==== + + +=== Import Users From the HR System // This is covered in [First Steps With MidPoint: Assessment - Evolveum Docs](https://docs.evolveum.com/midpoint/methodology/first-steps/assessment/) but we need this for GUI @@ -198,7 +221,7 @@ Before you proceed with the real import, it's best to _simulate_ the action firs * Then, try it with all accounts. * Finally, run the actual real import. -=== Preview Import on a Single Account +==== Preview Import on a Single Account . In *Resources* > *All resources* > , select *Accounts*. . Pick one object (account) and click the dropdown menu on the far right of the row. @@ -214,28 +237,29 @@ As this is only a simulation, it's the best time to review if the account data m Once you're happy with the setup, you can import for real. -=== Simulate Full Import Before You Go All In - -Firstly, make sure the resource is in the *Active* lifecycle state. -You can find this setting in the top bar when you open the resource via *Resources* > *All resources* > . +==== Simulate Full Import Before You Go All In -Then, create a simulation task for import. +Create a simulation task for import. You'll use the *preview execution mode* with the *development configuration*. Refer to xref:/midpoint/guides/tasks/import-tasks/[] for more details on creating tasks. -Inspect the simulation results and confirm whether all is good. +Inspect the simulation results and confirm whether all is good. Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. If so, proceed to the real import. -=== Real Import +==== Real Import You've got everything ready to import users from the HR system to midPoint. -xref:/midpoint/guides/tasks/import-tasks/[Create another import task] like you did for the simulation. + +Firstly, make sure the resource is in the *Active* lifecycle state. +You can find this setting in the top bar when you open the resource via *Resources* > *All resources* > . + +Then, xref:/midpoint/guides/tasks/import-tasks/[create another import task] like you did for the simulation. The only difference is that now you're going to *use production configuration* and leave the execution mode on default. .Double-check archetypes [WARNING] ==== -Before you launch the real import task, double check that your resource objects for accounts have the right archetypes. It's complicated to change them later. +Before you launch the real import task, double check that your resource objects for accounts have the right _Person_ archetypes. It's complicated to change archetypes later. ==== The runtime of the task depends on the amount of accounts you have in your HR system. @@ -244,6 +268,8 @@ Once you run the task and it finishes successfully, you'll see the accounts as l Congratulations, you're ready to connect a target system to midPoint. +// :sectnums!: + == Connect Your LDAP Target System The next thing to do is to connect your target system. @@ -264,6 +290,8 @@ The steps you'll take to connect the target system are going to be very similar We point out the differences at the right places to ensure you don't get lost. ==== +=== Summary of Steps to Connect a Target System + To connect the LDAP or any other system that contains accounts, follow the xref:#connect-the-hr-system[same steps you took to connect the HR system above]: . Create a resource for the LDAP system. @@ -276,13 +304,130 @@ To connect the LDAP or any other system that contains accounts, follow the xref: . Define mappings and synchronization policies. ** Refer to the next section for details. +=== Create Inbound Mappings for Correlation + +As the LDAP resource is currently a strictly outbound resource, meaning that it can't push any data _to_ midPoint, you're going to define a new kind of mapping. +The thing is, to successfully correlate accounts on the LDAP server with the users in midPoint, you need _inbound_ mappings for the LDAP resource, i.e., _from_ LDAP _to_ midPoint. +However, as you don't want any data coming from LDAP to midPoint, the regular inbound mappings aren't the best fit. + +That's why you're going to define inbound mappings _strictly for correlation_ purposes. +MidPoint will use these mapping rules only to know which resource attribute to correlate with which _internal_ (focus) user attribute. + +The are the mappings you want to use: + +[cols="2,1,1,1,1,5"] +|==== +| Name | Source | Expression | Target | Lifecycle state | Comments + +| inbound-employeeNumber-for-correlation +| `empnum` +| As is +| `personalNumber` +| Active +| Used for correlating employee number in the resource with the personal number in midPoint. + +| inbound-surname-for-correlation +| `surname` +| As is +| `familyName` +| Active +| Used for the second correlation rule when the default employee number correlation fails. + +| inbound-givenName-for-correlation +| `givenName` +| As is +| `givenName` +| Active +| Used for the second correlation + +| inbound-locality-for-correlation +| `locality` +| As is +| `locality` +| Active +| Used for the second correlation + +|==== + + +Refer to this guide on how to define mappings: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[]. +You want to use *inbound mappings* and set them to be used for correlation only: + +. Click icon:edit[] btn:[Edit] on the far-right side of the mapping row. +. In *Use for*, select _Correlation_. +. Click icon:arrow-right-from-bracket[rotate=180] btn:[Exit wizard]. + +// TODO: task 12 - rework /midpoint/reference/master/admin-gui/resource-wizard/object-type/mapping/ +// to be better structured and contain more info on advanced mapping settings, +// so that I can just link it from here instead of writing the whole guide on correlation-only setting. + === Define LDAP correlation rules -// TBD - table with correlation rules for the LDAP resource +// TODO: I want to link an existing correlation rules setup guide here. + +Next up are the correlation rules. +Correlation in the case of an outbound (target) systems ensures that midPoint can bind together accounts on the target resource (or rather their xref:/glossary/#shadow[shadows] in midPoint) and the users in midPoint. + +There is one obvious correlator, and that's the employee number. +If an entry in LDAP has the same employee number as a user in midPoint, they're surely a match. + +As a less reliable indicator, you can use, for example, matching first name and surname. +However, two people can bear the same name, so you can't connect such entries automatically. +More on that later. + +Here are the correlation rules. +To edit the correlators: + +. Click icon:edit[] btn:[Edit] on the far-right side of the correlation rule row. +. Click icon:circle-plus[] btn:[Add correlator] +. Fill in the *Item* and select the *Search method*. + Repeat for every correlator. +. Click icon:check[] btn:[Confirm settings] when you're done. + +Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[] for more detailed guide on setting up correlation rules. +The xref:/midpoint/features/current/correlation/[] feature page may be useful to you if you wish to dive deeper into the correlation mechanisms. + + +[cols="2,5,1,1,1,5"] +|==== +| Rule name | Description | Weight | Tier | Enabled | Correlators (Item : Search method) + +| personalNumber-correlation +| Correlation using `personalNumber`. Doesn't require human intervention. +| +| 1 +| True +| `personalNumber` : Exact match + +| last-resort-correlation +| Correlation using givenName, familyName and locality. Trusted only by 50%, human intervention is needed. +| 0.5 +| 10 +| True +| `givenName` : Exact match + + `familyName` : Exact match + + `locality`: Exact match + +|==== + +[NOTE] +==== +The attributes used in the correlation rules are acquired by the inbound mappings that are used for correlation only. +==== + +=== Simulate LDAP Reconciliation + +// TODO + +1. Create simul-devel task for the LDAP resource +2. Inspect the results +3. Adjust the rules so that MP doesn't delete what you don't want deleted and so on... +// t=2060 + + + -=== Connect attributes with mappings -// TBD - table with mappings rules for the LDAP resource --- = The old original content follows From 9eea6e12589dc349234f0aa1ace27196c608abf7 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 26 Mar 2025 11:39:52 +0100 Subject: [PATCH 020/183] Add locality to HRIS mapping; number of minor stylistic changes --- midpoint/methodology/first-steps/connect.adoc | 48 +++++++++++-------- 1 file changed, 27 insertions(+), 21 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 3cbf0a771..2557a21a8 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -73,7 +73,7 @@ In your case, each resource object represents a user in the HR system. After you save your object type, you can preview the resource data to see what you're getting from there. -[#_get-back-to-config-wizard] +[#get-back-to-config-wizard] [TIP] ==== If you close the resource wizard too soon, don't worry. You can get back to it any time: @@ -85,7 +85,7 @@ Similarly, you can always view the resource objects via *Resources* > *All resou === Filter Out Irrelevant HR Entries -// This should be a separate short tutorial that elaborates a bit more on the topic. TBD /dakle +// This should be a separate short tutorial that elaborates a bit more on the topic. TBD @dakle // There's a hint on this at /midpoint/reference/master/admin-gui/resource-wizard/object-type/#specify-the-resource-data When you preview the resource objects, you may realize there are some accounts that you don't want or need to manage using midPoint. @@ -98,12 +98,12 @@ To prevent these accounts from being imported to midPoint: . Find a common pattern these entries have in the HR system. + It may be that their employee numbers start with a different digit or their employment type is different from others… -. link:#_get-back-to-config-wizard[Go back to the resource object type configuration] and select the *Basic* tile. +. link:#get-back-to-config-wizard[Go back to the resource object type configuration] and select the *Basic* tile. . In the *Specify the resource data* screen, type a filtering condition to the *Filter* field.+ For instance, if their `employeeNumber` starts with `8`, unlike anyone else's: `attributes/employeeNumber not startsWith "8"`. -. Save the object and link:#_get-back-to-config-wizard[view the resource objects again]. +. Save the object and link:#get-back-to-config-wizard[view the resource objects again]. . Click *Reclassify* at the bottom of the resource object list. . You should see that the `8XXX` accounts no longer appear listed among the resource objects. @@ -138,10 +138,10 @@ The rules you want to define at this stage of your project in particular: | Add focus | The account from CSV doesn't exist in midPoint yet, so let's create the user in midPoint. -// technically not needed in clean MP but they need to add it later anyway so I'm putting it here already /dakle +// technically not needed in clean MP but they need to add it later anyway so I'm putting it here already @dakle | Unlinked | Link -| There's a focus for the account but it's not linked yet, let's link it. +| There's a focus for the account but it's not linked to the shadow of the account yet, let's link it. This isn't used during the first import, but it's necessary for later when the account shadows are in midPoint already. | Linked | Synchronize @@ -184,14 +184,21 @@ Your source attribute names may, of course, be different based on your internal | As is | `givenName` | Active -| We'll construct a full name from these. +| We'll construct a full name from first and last anmes. | surname-to-familyName | `surname` | As is | `familyName` | Active -| We'll construct a full name from these. +| + +| locality-to-locality +| `locality` +| As is +| `locality` +| Active +| User location can be later used with the full name for a last-resort correlation. |==== @@ -256,7 +263,7 @@ You can find this setting in the top bar when you open the resource via *Resourc Then, xref:/midpoint/guides/tasks/import-tasks/[create another import task] like you did for the simulation. The only difference is that now you're going to *use production configuration* and leave the execution mode on default. -.Double-check archetypes +.Double-check the archetypes [WARNING] ==== Before you launch the real import task, double check that your resource objects for accounts have the right _Person_ archetypes. It's complicated to change archetypes later. @@ -268,8 +275,6 @@ Once you run the task and it finishes successfully, you'll see the accounts as l Congratulations, you're ready to connect a target system to midPoint. -// :sectnums!: - == Connect Your LDAP Target System The next thing to do is to connect your target system. @@ -295,14 +300,15 @@ We point out the differences at the right places to ensure you don't get lost. To connect the LDAP or any other system that contains accounts, follow the xref:#connect-the-hr-system[same steps you took to connect the HR system above]: . Create a resource for the LDAP system. - ** Select the LDAP connector instead and name the resource appropriately. + ** Select the LDAP connector and name the resource appropriately. + ** Create the resource in the _Proposed_ lifecycle state. ** The connector configuration is more complex. - If you're unsure, your LDAP server admins can surely help you out. + If you're unsure, your LDAP server admins can help you fill in the right values. . Configure the resource object type. - ** First, configure an object type for account kind with default intent. + ** First, configure an object type with the account kind with default intent. You'll likely add more object types later, but start simple now. . Define mappings and synchronization policies. - ** Refer to the next section for details. + ** Refer to the sections below for details. === Create Inbound Mappings for Correlation @@ -338,14 +344,14 @@ The are the mappings you want to use: | As is | `givenName` | Active -| Used for the second correlation +| Used for the second correlation. | inbound-locality-for-correlation | `locality` | As is | `locality` | Active -| Used for the second correlation +| Used for the second correlation. |==== @@ -363,8 +369,6 @@ You want to use *inbound mappings* and set them to be used for correlation only: === Define LDAP correlation rules -// TODO: I want to link an existing correlation rules setup guide here. - Next up are the correlation rules. Correlation in the case of an outbound (target) systems ensures that midPoint can bind together accounts on the target resource (or rather their xref:/glossary/#shadow[shadows] in midPoint) and the users in midPoint. @@ -412,12 +416,14 @@ The xref:/midpoint/features/current/correlation/[] feature page may be useful to [NOTE] ==== -The attributes used in the correlation rules are acquired by the inbound mappings that are used for correlation only. +The attributes used in the correlation rules are acquired by the correlation-only inbound mappings. ==== === Simulate LDAP Reconciliation -// TODO +To test your configuration, run a simulated reconciliation task on the development environment. + +. Create 1. Create simul-devel task for the LDAP resource 2. Inspect the results From a81138f491a832226e540b09146630bd53c44236 Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 31 Mar 2025 11:19:07 +0200 Subject: [PATCH 021/183] Move guides to gui-guides for clearer structure naming --- midpoint/gui-guides/index.adoc | 12 +++ ...eate-resource-select-unique-attribute.webp | Bin .../resources}/create-resource.adoc | 0 midpoint/gui-guides/resources/index.adoc | 32 ++++++ .../intro-to-resource-configuration.adoc | 0 .../resources}/view-resource-details.adoc | 0 .../tasks/create-task-of-any-kind.adoc | 33 ++++++ midpoint/gui-guides/tasks/import-tasks.adoc | 42 ++++++++ midpoint/gui-guides/tasks/index.adoc | 16 +++ .../tasks/live-synchronization-tasks.adoc | 70 ++++++++++++ midpoint/gui-guides/tasks/simulate-tasks.adoc | 101 ++++++++++++++++++ midpoint/guides/manage-resources/index.adoc | 18 ---- midpoint/guides/tasks/import-tasks.adoc | 79 -------------- midpoint/guides/tasks/index.adoc | 8 -- midpoint/methodology/first-steps/connect.adoc | 6 +- 15 files changed, 309 insertions(+), 108 deletions(-) create mode 100644 midpoint/gui-guides/index.adoc rename midpoint/{guides/manage-resources => gui-guides/resources}/create-resource-select-unique-attribute.webp (100%) rename midpoint/{guides/manage-resources => gui-guides/resources}/create-resource.adoc (100%) create mode 100644 midpoint/gui-guides/resources/index.adoc rename midpoint/{guides/manage-resources => gui-guides/resources}/intro-to-resource-configuration.adoc (100%) rename midpoint/{guides/manage-resources => gui-guides/resources}/view-resource-details.adoc (100%) create mode 100644 midpoint/gui-guides/tasks/create-task-of-any-kind.adoc create mode 100644 midpoint/gui-guides/tasks/import-tasks.adoc create mode 100644 midpoint/gui-guides/tasks/index.adoc create mode 100644 midpoint/gui-guides/tasks/live-synchronization-tasks.adoc create mode 100644 midpoint/gui-guides/tasks/simulate-tasks.adoc delete mode 100644 midpoint/guides/manage-resources/index.adoc delete mode 100644 midpoint/guides/tasks/import-tasks.adoc delete mode 100644 midpoint/guides/tasks/index.adoc diff --git a/midpoint/gui-guides/index.adoc b/midpoint/gui-guides/index.adoc new file mode 100644 index 000000000..c34a8b80c --- /dev/null +++ b/midpoint/gui-guides/index.adoc @@ -0,0 +1,12 @@ += Guides for the Web Administrative User Interface +:page-nav-title: 'Web GUI Guides' +:page-display-order: 2 +// :page-toc: top +:experimental: +:icons: font + +This is a collection of guides on how to use the midPoint administrative web user interface. + +++++ +{%children%} +++++ diff --git a/midpoint/guides/manage-resources/create-resource-select-unique-attribute.webp b/midpoint/gui-guides/resources/create-resource-select-unique-attribute.webp similarity index 100% rename from midpoint/guides/manage-resources/create-resource-select-unique-attribute.webp rename to midpoint/gui-guides/resources/create-resource-select-unique-attribute.webp diff --git a/midpoint/guides/manage-resources/create-resource.adoc b/midpoint/gui-guides/resources/create-resource.adoc similarity index 100% rename from midpoint/guides/manage-resources/create-resource.adoc rename to midpoint/gui-guides/resources/create-resource.adoc diff --git a/midpoint/gui-guides/resources/index.adoc b/midpoint/gui-guides/resources/index.adoc new file mode 100644 index 000000000..9f03713b9 --- /dev/null +++ b/midpoint/gui-guides/resources/index.adoc @@ -0,0 +1,32 @@ += Manage Resources in midPoint +:page-nav-title: 'Resources' +:page-display-order: 10 +// :page-toc: top +:experimental: +:icons: font +:icon-set: fas + +Resources represent applications and information systems connected to midPoint, where resource accounts are managed. + +This section contains guides to help you work with resources in the midPoint web administrative interface (GUI). + +- xref:./create-resource/[] +- xref:/resource-mappings[Resource mappings TBD] +- xref:/resource-mappings[Correlations TBD] +- xref:/object-type-filtering[Filter and classify resource data via object types] +- xref:./resource-templates/[Create templates for resources TBD] + +To list all defined resources or create a new one: + +* Click icon:database[] *Resources* > icon:database[] *All resources* in the main menu. + +The resources are displayed in a table with basic details: + +* Name (in midPoint) +* Connector type +* Version (of the connector) +* Buttons to test, edit, remove the particular resource, and more + +You can sort the resource list by name by clicking on the table column header. Reverse the sort order by clicking the header again. + +For more information on connectors, refer to the xref:/connectors/[]. diff --git a/midpoint/guides/manage-resources/intro-to-resource-configuration.adoc b/midpoint/gui-guides/resources/intro-to-resource-configuration.adoc similarity index 100% rename from midpoint/guides/manage-resources/intro-to-resource-configuration.adoc rename to midpoint/gui-guides/resources/intro-to-resource-configuration.adoc diff --git a/midpoint/guides/manage-resources/view-resource-details.adoc b/midpoint/gui-guides/resources/view-resource-details.adoc similarity index 100% rename from midpoint/guides/manage-resources/view-resource-details.adoc rename to midpoint/gui-guides/resources/view-resource-details.adoc diff --git a/midpoint/gui-guides/tasks/create-task-of-any-kind.adoc b/midpoint/gui-guides/tasks/create-task-of-any-kind.adoc new file mode 100644 index 000000000..000e19480 --- /dev/null +++ b/midpoint/gui-guides/tasks/create-task-of-any-kind.adoc @@ -0,0 +1,33 @@ += Create a task of any kind +:page-nav-title: 'General task creation' +:page-display-order: 1 +:page-toc: top +:experimental: +:icons: font + +There are many tasks you can use in midPoint. +This guide provides general direction on where to start with any task creation. + +You may know creating a resource-specific task from the respective resource the task is related to. +This guide describes the general way to create tasks which gives you full control over the settings of the task. + +// TODO: rewrite so that it's general; originally taken from import tasks + +== Create a task + +. In icon:tasks[] *Server tasks* > icon:upload[] *Import tasks*, click icon:upload[role="green"] btn:[New import task]. +. In the form that appears, specify the basic parameters of the imported objects on the icon:briefcase[] *Work* screen: + ** *Resource*: Click btn:[Edit] to select the resource from which you want to import. + ** *Kind*: Select the appropriate kind based on what you've used for the objects in the resource. + ** *Intent*: Set to *default* unless you use multiple intents on the same resource and need to select a non-default intent. +. Switch to the icon:gears[] *Execution* screen using the left-side menu: + ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* or select *Full* for real production import. + ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* or leave undefined for real production import. +* Switch to the icon:circle[] btn:[Basic] screen and name the task there. +. Click icon:check[] btn:[Save & Run] to run the task immediately. + If need be, save it for later without running it yet. + Until you run it for the first time, you won't see it in the defined tasks of the resource. + +As opposed to preview development simulation, the full mode with production configuration runs the actual data import modifying your midPoint database. + +// TODO: Mention simulation and link reading simulation results article. diff --git a/midpoint/gui-guides/tasks/import-tasks.adoc b/midpoint/gui-guides/tasks/import-tasks.adoc new file mode 100644 index 000000000..8474bb3b6 --- /dev/null +++ b/midpoint/gui-guides/tasks/import-tasks.adoc @@ -0,0 +1,42 @@ += Import Objects to midPoint +:page-nav-title: 'Import tasks' +:page-display-order: 1 +:page-toc: top +:experimental: +:icons: font +:icon-set: fas + +Import tasks in midPoint are essential for synchronizing data from external resources into the midPoint system. +This article is here to guide you through creating import tasks, simulating their execution, and deploying them in a production environment. + +Import tasks are mostly useful when you connect a new resource to midPoint. +Especially if it's the first resource, you want to import the resource objects to create their respective focal objects and set the stage for later when you eventually reconcile data from various other resources. + +This guide shows you how to create an import task for one specific combination of resource, object kind, and its intent. +For a more general guide, refer to xref:./create-task-of-any-kind[]. + +[NOTE] +==== +See xref:/midpoint/reference/tasks/[] for advanced configuration options and explanations outside the realm of GUI. +==== + +== Create an Import Task + +To create the simplest import task, you only need to: + +* Pick a resource from which to import object. +* Specify the kind and intent of the imported objects. +* Select the execution mode and configuration preset. +* _Everything beyond these essential settings is optional in import tasks._ + +To create an import task: + +. Open the resource from which you want to import via icon:database[] *Resources* > icon:database[] *All resources*. +. Select the icon:male[] btn:[Accounts] screen. +. Click icon:tasks[] btn:[Tasks] dropdown menu and select icon:plus-circle[] btn:[Create task]. +. If you want to first simulate the import, toggle the *Simulate task* switch to *on*. +. Select *Import task* and click icon:plus-circle[] btn:[Create task]. +. Name the task and go through the wizard keeping the Resource, Kind, and Intent to defaults. +. Click icon:check[] btn:[Save & Run] or icon:save[] btn:[Save settings] based on whether you want to run the task immediately or save it for later. + +// TOOD: link reading simulation results diff --git a/midpoint/gui-guides/tasks/index.adoc b/midpoint/gui-guides/tasks/index.adoc new file mode 100644 index 000000000..5fb783301 --- /dev/null +++ b/midpoint/gui-guides/tasks/index.adoc @@ -0,0 +1,16 @@ += Automate Processes With Tasks +:page-nav-title: 'Tasks' +:page-display-order: 11 +// :page-toc: top +:experimental: +:icons: font +:icon-set: fas +This section is all about tasks in the GUI. + +Tasks in midPoint are active processes that run inside the server, used for various purposes such as synchronization, cleanup jobs, and executing scheduled actions, serving as the backbone for automating identity management operations. + +++++ +{%children%} +++++ + +- xref:./simulation-tasks[Simulate actions before executing them TBD] diff --git a/midpoint/gui-guides/tasks/live-synchronization-tasks.adoc b/midpoint/gui-guides/tasks/live-synchronization-tasks.adoc new file mode 100644 index 000000000..4034fdc7f --- /dev/null +++ b/midpoint/gui-guides/tasks/live-synchronization-tasks.adoc @@ -0,0 +1,70 @@ += Live Synchronization Tasks +:page-nav-title: 'Live Synchronization' +:page-display-order: 1 +:page-toc: top +:experimental: +:icons: font + +*WIP* +// TODO - polish and rewrite this, it's just a copypasta from our robofriend + +Live synchronization is a mechanism in midPoint that allows for near real-time detection and processing of changes on resources. Here are some key specifics about live synchronization tasks: + +. Task Definition: A live synchronization task is defined within the element, with specific properties to indicate it's a live sync operation. + +. Activity Type: The activity type is set to liveSynchronization which distinguishes it from other types of tasks like import or reconciliation. + +. Resource Configuration: It specifies the resource and object kind (e.g., account) that needs to be synchronized using element with a reference to the specific resource. + +. Execution State: The task must have an executionState set to runnable. + +. Scheduling: Live synchronization tasks are typically scheduled to run at regular intervals, often every few seconds or minutes. This is configured under the section using the recurring and elements. + +. Connector Support: The resource connector must support live synchronization capabilities. It should be able to efficiently detect recent changes on the resource (e.g., via change logs, timestamps). + +. Token Management: Live synchronization tasks maintain a token that tracks the last processed state of the resource. This ensures only new or changed data is fetched and synchronized. + +. Efficiency: Unlike reconciliation which processes all records, live sync focuses on recent changes, making it more efficient for real-time updates. + + Example Configuration: + + + HR Live Synchronization + + runnable + + recurring + 10 + + + + + + + account + + + + + + + oid: Unique identifier for the task. + name: Name of the live sync task. + ownerRef: Reference to the owner (usually an admin user). + executionState: Indicates that the task is runnable. + schedule/recurrence: Specifies recurring execution. + interval: Interval in seconds between executions. + resourceObjects/resourceRef: Reference to the resource being synchronized. + kind: Type of object being synchronized (e.g., account). + + Behavior: + The task wakes up at regular intervals and checks for changes on the specified resource. + If changes are detected, they are processed immediately. + +Live synchronization is a powerful feature that ensures near real-time consistency between midPoint and connected resources, making it ideal for environments where timely updates are critical. + +Resources: + +** https://docs.evolveum.com/book/practical-identity-management-with-midpoint.html#05-synchronization +** https://docs.evolveum.com/midpoint/reference/master/tasks/synchronization-tasks/ +** https://docs.evolveum.com/connectors/connectors/com.evolveum.polygon.connector.grouper.rest.GrouperConnector/ diff --git a/midpoint/gui-guides/tasks/simulate-tasks.adoc b/midpoint/gui-guides/tasks/simulate-tasks.adoc new file mode 100644 index 000000000..86281e114 --- /dev/null +++ b/midpoint/gui-guides/tasks/simulate-tasks.adoc @@ -0,0 +1,101 @@ += Simulate Tasks to Keep Your Data Safe +:page-nav-title: 'Task Simulation' +:page-display-order: 1 +:page-toc: top +:experimental: +:icons: font + +*WIP* +// TODO check and rewrite this, it's a copypasta from our robofriend + +Task simulation is a powerful feature in midPoint that allows administrators to preview changes before they are applied to the system or resources. This helps ensure that any modifications or configurations will behave as expected without causing unintended consequences. + +== What is Task Simulation? + +Simulation, also known as "preview mode," enables you to run tasks and see what changes would be made if the task were executed in real-time. It's particularly useful for testing new mappings, synchronization reactions, or other configuration changes before applying them to your production environment. + +== Why Use Task Simulation? + +There are several reasons why using simulation is beneficial: + +. Risk Mitigation: Avoid unintended changes by previewing the effects of a task. +. Testing Configurations: Test new configurations without affecting live data. +. Debugging: Identify issues in mappings or reactions before they impact your system. + +== How to Use Task Simulation via GUI + +To use task simulation, follow these steps: + +. Navigate to the Tasks section from the main menu. +. Select the specific resource for which you want to run a simulation task (e.g., HR System). +. Click on New Task. +. Choose the type of task you wish to simulate (e.g., Import, Reconciliation). + +=== Execution Settings + +When creating or editing a task, you can configure it to run in simulation mode by adjusting the execution settings: + +. Execution Mode: Select Preview from the dropdown menu under the "Execution" tab. + .. This ensures that no actual changes are made; only simulated results will be shown. + +. Configuration to Use: + .. Choose between Development or Production. + .. The Development configuration allows you to test new configurations without affecting your production setup. + +=== Viewing Simulation Results + +After running a simulation task, the results can be viewed in several ways: + +. Simulation Result Object: A new object will be created that contains details of what changes would have been made. +. Task Details Page: + .. Navigate to the Tasks section and find your recently run simulation task. + .. Click on the task name to view detailed results, including any metrics or event marks. + +=== Creating Reports + +You can also generate reports from simulation results: + +. Go to the Reports section in the main menu. + +. Select a report template (e.g., Simulation Report: Items Changed). + +. Configure the report parameters: + .. Choose the relevant simulation result object. + .. Customize other settings as needed. + +. Run the report and export it to CSV or another format for further analysis. + +== Conclusion + +Task simulation in midPoint is an essential tool for administrators who want to ensure that their configurations and changes will work correctly before applying them to live systems. By using the GUI, you can easily set up simulations without needing to delve into XML configurations, making it accessible even for those with less technical expertise. + +For more detailed information on configuring tasks via XML, refer to the official midPoint documentation. + +== Further Reading + +midPoint Documentation: Simulations +Task Configuration in XML + +=== Resources: + +* xref:/midpoint/reference/master/admin-gui/resource-wizard/[] +* xref:/midpoint/reference/master/simulation/[] +* xref:/book/practical-identity-management-with-midpoint.html#_conclusion_5[] + + +== Read the Simulation Results + +// This needs to go to its dedciated section once it exists + +You run simulated tasks to confirm your configuration behaves as expected. +To see the results of the simulated task: + +. Open the corresponding resource via icon:database[] *Resources* > icon:database[] *All resources*. +. In icon:tasks[] Defined Tasks, click the task the results of which you want to inspect. +. Click btn:[Show simulation results] at the top. + +Here, you can see tiles with an overview of what would have happened. +Click the btn:[More info] buttons to view the affected objects. +The left sidebar shows an overview of object counts. +Click the numbers to list the objects and see more details. + diff --git a/midpoint/guides/manage-resources/index.adoc b/midpoint/guides/manage-resources/index.adoc deleted file mode 100644 index 752feb53b..000000000 --- a/midpoint/guides/manage-resources/index.adoc +++ /dev/null @@ -1,18 +0,0 @@ -= Manage Resources in midPoint -:page-nav-title: 'Manage Resources' -:page-display-order: 10 -// :page-toc: top -:experimental: - -// WIP - just a copypasta run thru AI - -Resources represent applications and information systems connected to midPoint, where resource accounts should be managed. - -To create, modify, or delete resources: - -* Click the _Resources - List resources_ tab. - A list of resources is displayed in a table with some basic attributes: Name (in midPoint), Connector type, Version (of the connector), and the basic options icons. - -You can sort the resource list by name by clicking on the table column header. If you click the same column again, you can select whether the sorting should be ascending or descending. - -For more information, refer to the xref:/connectors/[Resource and Connector Reference] chapter. diff --git a/midpoint/guides/tasks/import-tasks.adoc b/midpoint/guides/tasks/import-tasks.adoc deleted file mode 100644 index 715c99f8a..000000000 --- a/midpoint/guides/tasks/import-tasks.adoc +++ /dev/null @@ -1,79 +0,0 @@ -= Import objects to midPoint with import tasks -:page-nav-title: 'Import tasks' -:page-display-order: 1 -:page-toc: top -:experimental: -:icons: font -:icon-set: fas - -Import tasks in midPoint are essential for synchronizing data from external resources into the midPoint system. -This article is here to guide you through creating import tasks, simulating their execution, and deploying them in a production environment. - -Import tasks are mostly useful when you connect a new resource to midPoint. -Especially if it's the first resource, you want to import the resource objects to create their respective focal objects and set the stage for later when you eventually reconcile data from various other resources. - -[NOTE] -==== -See xref:/midpoint/reference/tasks/[] for advanced configuration options and explanations outside the realm of GUI. -==== - -== Create an Import Task - -To create the simplest import task, you only need to: - -* Pick a resource from which to import object. -* Specify the kind and intent of the imported objects. -* Select the execution mode and configuration preset. - -Everything beyond that is optional. - -*You have two ways to create tasks:* - -* Create the task directly in the corresponding resource from which you want to import. -* Use the main task configuration in icon:tasks[] *Server tasks*. - -=== From the Corresponding Resource - -This is the most straighforward way to create tasks in general. - -. Open the resource from which you want to import via icon:database[] *Resources* > icon:database[] *All resources*. -. Select the icon:male[] btn:[Accounts] screen. -. Click icon:tasks[] btn:[Tasks] dropdown menu and select icon:plus-circle[] btn:[Create task]. -. Toggle the *Simulate task* switch to *on* and select *Import task*. -. Name the task and go through the wizard keeping the Resource, Kind, and Intent to defaults. -. Click icon:check[] btn:[Save & Run] or icon:save[] btn:[Save settings] based on whether you want to run the task immediately or save it for later. - -=== Using the Main Task Configuration Section - -This way gives you full control over the settings of the task. - -. In icon:tasks[] *Server tasks* > icon:upload[] *Import tasks*, click icon:upload[role="green"] btn:[New import task]. -. In the form that appears, specify the basic parameters of the imported objects on the icon:briefcase[] *Work* screen: - ** *Resource*: Click btn:[Edit] to select the resource from which you want to import. - ** *Kind*: Select the appropriate kind based on what you've used for the objects in the resource. - ** *Intent*: Set to *default* unless you use multiple intents on the same resource and need to select a non-default intent. -. Switch to the icon:gears[] *Execution* screen using the left-side menu: - ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* or select *Full* for real production import. - ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* or leave undefined for real production import. -* Switch to the icon:circle[] btn:[Basic] screen and name the task there. -. Click icon:check[] btn:[Save & Run] to run the task immediately. - If need be, save it for later without running it yet. - Until you run it for the first time, you won't see it in the defined tasks of the resource. - -As opposed to preview development simulation, the full mode with production configuration runs the actual data import modifying your midPoint database. - -== Simulation Results - -// This needs to go to its dedciated section once it exists - -You run simulated tasks to confirm your configuration behaves as expected. -To see the results of the simulated task: - -. Open the corresponding resource via icon:database[] *Resources* > icon:database[] *All resources*. -. In icon:tasks[] Defined Tasks, click the task the results of which you want to inspect. -. Click btn:[Show simulation results] at the top. - -Here, you can see tiles with an overview of what would have happened. -Click the btn:[More info] buttons to view the affected objects. -The left sidebar shows an overview of object counts. -Click the numbers to list the objects and see more details. diff --git a/midpoint/guides/tasks/index.adoc b/midpoint/guides/tasks/index.adoc deleted file mode 100644 index 0a37a1152..000000000 --- a/midpoint/guides/tasks/index.adoc +++ /dev/null @@ -1,8 +0,0 @@ -= Tasks -:page-display-order: 11 -// :page-toc: top -:experimental: - -This section is all about tasks in the GUI. - -#WIP diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 2557a21a8..a1ae9881c 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -57,7 +57,7 @@ Let's say that the way to get data out of your HR system is via a CSV export. A CSV file can be a resource like any other. To get users from CSV to midPoint, use the CSV Connector and configure it according to the structure of the CSV export. -*Use the xref:/midpoint/guides/manage-resources/create-resource/[guide on connecting a resource to midPoint] to help you with the configuration.* +*Use the xref:/midpoint/gui-guides/resources/create-resource/[guide on connecting a resource to midPoint] to help you with the configuration.* [NOTE] ==== @@ -248,7 +248,7 @@ Once you're happy with the setup, you can import for real. Create a simulation task for import. You'll use the *preview execution mode* with the *development configuration*. -Refer to xref:/midpoint/guides/tasks/import-tasks/[] for more details on creating tasks. +Refer to xref:/midpoint/gui-guides/tasks/import-tasks/[] for more details on creating tasks. Inspect the simulation results and confirm whether all is good. Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. If so, proceed to the real import. @@ -260,7 +260,7 @@ You've got everything ready to import users from the HR system to midPoint. Firstly, make sure the resource is in the *Active* lifecycle state. You can find this setting in the top bar when you open the resource via *Resources* > *All resources* > . -Then, xref:/midpoint/guides/tasks/import-tasks/[create another import task] like you did for the simulation. +Then, xref:/midpoint/gui-guides/tasks/import-tasks/[create another import task] like you did for the simulation. The only difference is that now you're going to *use production configuration* and leave the execution mode on default. .Double-check the archetypes From 75bec547f873b4044df254b0da3203d152a0a404 Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 15 Apr 2025 18:26:13 +0200 Subject: [PATCH 022/183] Delete GUI guides Because we decided they need to be versioned and thus kept in midpoint/reference. The deleted stubs were worthless in their current state and, thus, could be safely deleted as such. --- midpoint/gui-guides/index.adoc | 12 --- ...eate-resource-select-unique-attribute.webp | Bin 11414 -> 0 bytes .../gui-guides/resources/create-resource.adoc | 90 ---------------- midpoint/gui-guides/resources/index.adoc | 32 ------ .../intro-to-resource-configuration.adoc | 55 ---------- .../resources/view-resource-details.adoc | 40 ------- .../tasks/create-task-of-any-kind.adoc | 33 ------ midpoint/gui-guides/tasks/import-tasks.adoc | 42 -------- midpoint/gui-guides/tasks/index.adoc | 16 --- .../tasks/live-synchronization-tasks.adoc | 70 ------------ midpoint/gui-guides/tasks/simulate-tasks.adoc | 101 ------------------ 11 files changed, 491 deletions(-) delete mode 100644 midpoint/gui-guides/index.adoc delete mode 100644 midpoint/gui-guides/resources/create-resource-select-unique-attribute.webp delete mode 100644 midpoint/gui-guides/resources/create-resource.adoc delete mode 100644 midpoint/gui-guides/resources/index.adoc delete mode 100644 midpoint/gui-guides/resources/intro-to-resource-configuration.adoc delete mode 100644 midpoint/gui-guides/resources/view-resource-details.adoc delete mode 100644 midpoint/gui-guides/tasks/create-task-of-any-kind.adoc delete mode 100644 midpoint/gui-guides/tasks/import-tasks.adoc delete mode 100644 midpoint/gui-guides/tasks/index.adoc delete mode 100644 midpoint/gui-guides/tasks/live-synchronization-tasks.adoc delete mode 100644 midpoint/gui-guides/tasks/simulate-tasks.adoc diff --git a/midpoint/gui-guides/index.adoc b/midpoint/gui-guides/index.adoc deleted file mode 100644 index c34a8b80c..000000000 --- a/midpoint/gui-guides/index.adoc +++ /dev/null @@ -1,12 +0,0 @@ -= Guides for the Web Administrative User Interface -:page-nav-title: 'Web GUI Guides' -:page-display-order: 2 -// :page-toc: top -:experimental: -:icons: font - -This is a collection of guides on how to use the midPoint administrative web user interface. - -++++ -{%children%} -++++ diff --git a/midpoint/gui-guides/resources/create-resource-select-unique-attribute.webp b/midpoint/gui-guides/resources/create-resource-select-unique-attribute.webp deleted file mode 100644 index bcfb1af8151a0e6c57af63a7cafffff6ae4bede3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11414 zcmeHtgtgx+Db_K|mIE>6Gs7FkpAtrF$vqMkOQ_l@ts*1Vp5yL8Jtc6e(#0 zX@z^>(dYTz`}+Rw{R8eZ`#L-CnR$Oc^O^U|95`pzNK;KMK>z^ERh10P3?wZ`0RRAt zKp-B#gac?QD;wnCf<*u~#~J0~g|7erF0NQlBXuPX3ri~wqGbRNAOSzP02cz~<*sO8 zpmWCl?`dxoz&UFfhMxKQ@0|a!mfRNYg#rK^4v?XMa`(i7*apPnzF7A&{1C)+D0_r0 zh>Jli;0Xo@;<2-OIqd!eBmV=V>^)sTjwr~vZ0q6* z`p32S3)`OIz%%UP>k8@8?f8_xH-Xs7tyZ&SEmIDBiyI}qOf9fu00{~?t0MxYoQ-^#2 z0JSjy!1&o6;fXl!2M_$l#b5wn`#AuRTLJ*>0059)|4TQp?W`Sm`UwC`K&^E803hQL z0Pxs>zHj^w<0b|T{?_gP%K5DyxN>z4SO7pMP+1Kyz4x`og*D)`F6FA=W~{-Nn)p2U z<`?>h&He5xF-;0=K;90C>zB9vO+KAL*x|<7bh^T&I~f~~S3}7aJq(8==glT+bVxVA z#6Yd6qt}xQAblaez9;OyzP^^=<+~pOJ-C%mC)92HD34V7Ax$mi4I{@bT-m9cyci>^ zAxQAs=sV>D0Xb3Rxm4P40p#EUBaH&50`{8XgsIXsBwAh zW9D2GRpT;(Xnz+X0s>_Ffi!o{X?wV5*hm^fj6Co0=Tv9aE(`pyj zCyCa~CidRP4?`%!m?#LNbM|k<9NLA3aT1d?M{y}o{m9v$Mi8sxDd98Z;6Z&b3Y($1 zVHcZQ^)5eKLDd_S`iXpAR>;t0qrb;*gAy;V(7G>N@FFbt5!H@d z&r4F12=kR5gA3Qp8eiU^o>rY`%WBmT-zI>iYD+v=wps5o`D!)B;7-S9evt;!6-7Fu zlXTbpz4*LkO1Jj=d7h75C434L8E@AWiUzc)d+$S3jTVgy^0W+I6VZ3I(-8m`Lpp&R zKEA8s6ZO}n_eXsb-Dz+B^649Uf`fdI>p({`Q3G{QYZBt%l>Yd6Y`y2??aJ#ygj=cVm77)s5b-vcbz%Vs$xcKL+~)WN z@PfUc4Ap5v*{H|UX9H8lbWcrrS07t@5$8}et=vNgW3Osyb-io8H=uAQAuKLB2#W5{ zUO8Rb>U-k6c4s?`r}z1+chSnw=n0F84tb&#&qdsXr1YwJCLA$Y63sq*Ru*%;6w-G# zn73hy3SE*HO{UZzT7JK%gELzq+mfT8bhPEH&QXr)UG5Wg^c&|Fqu;_V`2^ofxP@0r zu!h^{_jAV9Nxwc;z}jzxVvRMrRLwQ#n-^61!l0q0VQt~8rM;u)$(CojEGNPEGq2QU zi(rft;brW@Wu{2Ry$`~vYwL3zCs1ie3tf-*6RTpiBD3$dG8wYyMZ$o`t}oqk0en_b z63I6qyIre8ZGQH`B$B_aq>JavqY_l{c`os8=xGmH=R$2PF)WeSYmrfJcN8YA%LxU3wDlUmwUK0K=S2UH=n=7M0Ad8*2pvW3`GOwik zhB&XM!6)#3bG{Efc^v&?lGqD<$DSv};;QKJ#g0(zp4MY2Wa7~5DjT}_p(|EQn7Gku zdc^4p;S(~QaOmRlJ9rK(EntJ-4l*^CadYTRtFX)vT_GPeDhVdZ)9TXd^tr^XAzHJ` zGng(q6HymSfVBFNq#H-1)FIWh7>2d$p9-@PSgozru%Vr^>32<#%zH2K=wwIHgj}zy zGHBuCmeg7j>q;io!rYIw;j*rbPVxMouV`!rdBg-Zjr+{M<<~PqSPrW_b|pD8jD@a0 zB!%%C1!;VJbiYEkh<~wtI(k5f;BQh+U(3_4x$Y_2k`u~h z-AJ;VI3BO&-z<<7QDvaXZJWR&5#FZB{$R~USkmls`QS@)Mzn&qQsEuV@)6#rR>}Bd zKD~jBx7DPy3@=G*(U-mmyxA!h$ChTInL)B8VN7&^Z-qK3<3l6E4(qk{>ego;Bj)`- z$?V+v+He;Wyi+t%mi6F>-C9k-vHwR*s9m&p6@Fr=S%`+9*b+*hz8zk9!S9lL+Mr(7 zcAdWQL_vYKhrP{S!BhdK&G>N^yJ5F0p_nX%Uf(IBwVu;qvVUN>e4bs6`A|u)5^1cS z*3rUd9!j*RyY=Undj{%oBWY#`k;72?jzkQl2T-1WohKr$klmS>+lEFs!QWKqu{=+z zG3HJ047)3DWisQ{ZhlVj#BV$1Wo`L=?5A#oD}j-BbUd3h94 zCazuo$c=4HSGAQHXBye!fK|xKze#RyF~8R~nt$)UhfpD#NF~Xeb)T97ha+nJjc%*u zNcB7)_tBDr4vao8BhDz>@XSJx(_u*{*XFbbISOjrLvlg2%(*PzX)ba_^3A}H`Jadd zf%yALgkP2NRh|U-u&y6PjVigRJ9ntYiQ4<50_0H`t*$Pw!eDXrpt#R8ZgZK80r@Wo z#hxr%=ncPHE5#A<%~t>o^HrccwmB)6MahleJZ)Bt_;NL+52Il3cD<4x_RxD1-`#h7 zIg7CIeCZW@@X>qkvz_{#(YFMxUE*7%ovQ0UQJYqkg$erG4wNcWUy9WStJjmB+Mo?H z_O2zm*aXj*<*#+b%)s$uA1bJ|e!$$ROfCk zV3Ia3RV`^{O6FOnWM!IkOY%!)5(WZ*W=I_)b1aSB!H<9cT_TD{Yi>U5b7^RdVv1~I z^DIA3_sC(yYF&wQWSsV`ohK5I-2@T^op!GYXRB9XFI%3X#jF#88EI~%+ZzzRy1_ps z`(a1oZ6F73!i&$sIcS!lb9r>b#EoI;W*BO~z49q=F@bq<%o$8t!z= z)a!d}?H^3xyJ5~7ndI6{uj)lE|MZaW{W&`MeDxaP)aa^+`T#GBn5@$S<_FFJEFE|$ zYM);?2Us88;_SVndgJL@d676_giCTJ74Kt+ce)4K9CwhupZe~m2dqWeTnaeevWljo zUUW+#j%uV5!_%c*xEHv3MACajma62el;Yk!ix!owRC8e3Eq9dz1iv!QG|*`tm;}&_ zDU>2UPF2xd&1oOKmO4$mn@TvpN;un?Rz*fR)n%;iSv%i3cS>+Mzre2}H@cyh+qCrl-_ZqoggXq=N=Li=Nd8}N3xQYIqNl^PMc@LF<-cnS6qbqe)dj=XF=3~ z85z+{H6^@nWATZ#zr=@a67N02cPEWWxe|5MR~>u6`{P}Z=eId~^6}8RqwgG@*%#yP zT54~7kWP2M$VQA=OiSN{Eva3Gw-n7;&QEgdlvfFOlGQ(~-5{OS+gY!vaS-{W9134V zBsNfp>&3*RmC0VE@4qb-$mM<8r7YZQr-3XekuQ_o`CGAh9?jkuIp85y@QeCJQ{} znk0TAn`J`vHL~V{X4^rVcPs4`$^-@hDFqs-9RmFuR~Y*Rs7OR-#qF3sk#yo!c711Q zH&q2*M34?v0m zi62u63Jlfzb*boZoo~;`ZW;15GJhsv@c)vFabJ~?zG_8%``|_#xezqXGY_dOBs)9K zOJ#aDbZCfiyyO;&*RiVU)9&2PS10Oi+n$I-G3Dz`gUh{&l$09oh3_9n7Cg2YsNRJg zWgjK4lvG~~vY^|rj3mxb+0q$rb5Jvu_oG^${)0+tYjyl_Cv~OShERw+$&FVD%~VO;j5{H? zz!V$^@{8R*I6h|iX*ZBnVIe;t7^MDGPI)@qUjIvo)T=97Gf!GVSdKZejc<I`{Dqaloa@ke?G`XBE-*L@mkKdH;wSB7Nn^6PN zmsFzs#DW9Ea<&HP`^6JCf4NPMjC;qEDt*Ijj&1fE&#X<%%vu)l@#Gn*6_Q8v*0`m` z2+!K%JrLWV@ZMj!kG9km?$IdGv>82mTKMpelMX-Uo{UnkQy(Gjphj6C;kHHB+-$s` z>=)8>L_xS(w$Vav2jlBb!*(8I@Z5%hdF`^kP5&Jk+kv?n;qtxwEH`Q-pUl3c8Fl)1Fx*}2>MviObV=a4eWWD-_K@cBt z$IOmZj6e@RO@!sDekmmxZ+e{C%R;+&UZ=!&InmXD+ICiWEVz?GA5S{ukB(|nQ(wZO zhu%G)K75cCUvxSWJh!^Dtp9L$c58r{{&rKATxwX{q!`8fCygQ=Tpmh%Z2>yFbeZdpJJyoun;Ff`fYmiojV>ay(e{FiduA@q9F>cspPy#F2~P?O zr^@SZ9k-f#bWz0*QYTaU-T%`iI455!;9~#%(T)`^3-7fJV~VoA!}zBPxEdF@6)##H zd0o>!AjCoxoHZycb3`L+x0eD(k5~roklx{tn~xTzn(lafdO}E#()#2R?7_)x8=+*t zfF)ah8x_hO7$G&tNn#uN)_~42ye2o|`Rh~id6n>k`^=sS)Vvhc3ayN@f>8pqEN$Pf zr{K1cMN`orFZ5JSf6#hwr2HhlfP>Q{Ea~)CclOBkqIZKom)qbcOOorjMoU+1@y9mH zE>GTgMExpxRvqH2_f=61k5D7&47q76t}pQv6V&2p70j}-~Qdu(rm;R z$+n6J1{l6sOk6mrJBIaVU3a)d=kdGCV-+6=pEdX8=8y?-B#0fbv`WYI*=SxJyF$De zI!o@vb^-PNQHU{-Kxov*2Ap;8mQCe=TX6>`1k@3y;(MId`wO(}UN!?Z{&36S@?l9M zYp&P?ZfReK-ph2loXR-&*4gAUgDmwiNo7qnnySOrXqD*5IK{)&XDR&GS~70oXb|LT z`C5O+g{v&iTry<$pN?vO&inugL!TB%#ChE;rsRO#5`e;?+lGD@2t8%laJj*Nmr zxQLbDh8SxgZYtI7H`e!(nlw<90i#*KY014 zyuglePnzC#%a2ubc~+bC#~oG3MLMC>ZZ_#rilX73l+g#Kq{(Ie*e)aGQ`>FTpf_Gr zzgQsnsE!f(PDbmWj^=#49%{Za(~jO|Evcn3_g~F^+7~wx+))mt-?IzJ6!C`&(8l9b z@aW%p-qc;*+M`(?bY=Jovh-v%r%645D0dikvpkpXWWw>YTOU$%QguF&_GSipx zE~ttWSKjhO?J-$^?=DTgMNE;4Zye(KxVz-Gb6uXB{^cI1e7rd>K<0eH66Yy|8wk-4LyL`{^H*#MZabR`Zh4&MP z%&(TcwhY$d#4CR%x?*R2$2%rk7)dZZw3KHl!{n`ltJ7AOSZWcK8XuNuZU$++2w39> z96;Lbygs|#_};)>^g=ipdzqk)U~w5Rd&KkW#?uwE;j-%nLU4?6mI%j%85zmQ#_Veg zqel3(E0Zq;-XItBDZ8vCGR(Hv-};^MbkfaBNPc{%)sbA94>3>j#|eGa#r>&NK%fr& zz&k;z=GDB-cI?2<%$b0ATk7T{%(_e(IUkp?@Tt@b;j($?^!|@^b-@$}9-oQfGuz2` zU%HLB5*3Rp@6(aeyQr*mD@ym3ROrvPf8%6#;I^Hw5}oRvJ)Gc4S$oGPqc7pc^s5F} z^eXEi^~|YgX1kqk{@Tv9ZmB1sF@5bnd`^zpZ%6VIs_Pp`7^P}!LXvZmLI*K8bu5NH z5A<3zp(U=+N}`emzMD-Mku?#+&_;@?rwe?WB+-3Z*PHxp&B$?eM?2>TDauv_uXc%% zO~iC0Sfy~ekM(4Vl9|x4*Dv|IOb0H6r@qpe;*D!{SMj$h5DY20Y`usHg+Ie)*wq}a zhnWi6^$aJ$ZZ1dH%ws|k^>#jUs4?n`BD;5b7x3%YY>2l%O5P~lStFrM>2|-;+`KjU zPzO`~0G}~juE8IC1=jyXKH`*&nG*>AkZL$SbB9a%`;ol4RDTF6G*ZW5qjEYgeBYxt zcCtXf4mSF!1pPT+)QNvFs(~Kwfs1%daH!O5G(bul>e;nL*bomBm^>A=JAK z-IV3fPcI2)x-sC(!FhP3u5~Qa&85Ri5qB}kQp(Ph^qD&O&yCZOo6#7bsn?aH^={h^ zrH8V)Pwsw>-dFpqda>9@QRx_`c3^vfc*1Xw;uTgV8@CrcXY+XnA{=(xbug z3tz;~NGBa=NOenh!=u)0?K6DtMs^wd?U#A1VQhIsw_6WC7uWTUlr zH`W3n5kb7sd;4iMEVtrTK6VLEQ7Zr3B**duAxgsRRF&$pd?|f&I7*j3EK=7wh{o;G z(vh}zf6oOSm+|V>u>K&-uJGP?{_Kq_vpe^AbTwfX{fpU!@^8M%PchJ8@|q8v^3=!} z2-7qlIE#O#Q=I26z%@AMHhFrHxZl`gzGSeKw4&m@S1?f>0|oE91^+Tj0jDKm)T^S@)*A(B!K39c*C6Tc4@{zi{(<<2|p&F+7EinrGG4A6KS?3Vh zhvfwYdaYz9_f|jSQ>tj#OK=>E*nfSfEaHWgk4Np)l$jbS@CRjQu_Y?ix<0c>q|Y1- z+{HU(W{J;iQV;4lYx0Y8vgHaNekkDHyGz<_LFhg&F;BxLR}00&UiR(nXl+CIS7qsL zxxX?NKlolqeXCX7Z$XaW7yq?R9FuQyrwk$N3JX=?w@%h^#eRAlxK5TCK>EQW0-Te# z+a;szR#Bj>LL~6`a{uMAR}Q3e39*JwhI}hjY5k6-#V!T8aSEYH-@X?GR48Rp@eT+; zro7x*OOuqg5v^rE+#Z0&ut;FIxnAOmtaMs=kp*P?d*$M@yayW=XuE`pPofPZjBSg8 zC6Ru_esA`#j`%EtIw+_63)U%~zD>R;kW?p~NgDL3UOCtevsDSFd{AA3HjRm#a9ke5 zr&Kqybn}Dv-q%7#6}Q)2bE@+d`$YffUZ!VLaD3H*x>s5=Od#f$@e*I|OK-b3j#Khm z9U?Z&x5ZoV23-a#^q?sp?221xxv5=7qP0cSUta9@c0P7womu+zB-K=!mC0M<*H~c% zb3olb@8s!r%VtT9c0Z5b7nV`XR(4AW;VIKkyRDfH-ONe35SBfo5(PhvZv#img2fi9 zR^LW8oP##g8ujB7$U~g^Ux|m0ks`nG8p2{Ex2F$+-#85ObgT2N9aUIXsW}^l9_DIi zaiyQ|Zl>Jj-w0ZlWd3D1UqUf}L$Jr+yd?X|A=cB~ykEaW#d z4qbgFi&LX~dizyc3ey5t*DKN0_7{pSXnNK66@g+6lWGk5eZ<5Kv;uPn(!*tcPK1a27U&5FDjFe|B_f)%Uq-|qkEqEPpS zKwz*=d*5e$@sBGjnup21`VG-$Z?)*szttD<*eGma{p#vnwr$GzXY@ZW$dAg*5c8c(kh)h<9Cq%xd3<`T$m)Z9 zW+d(A|G=HhXK#Gt@bT>(B}Mi;$PY(f@qO$KqK-f*hTdaDm|!Pw2ZPsQO21=hw!mQ+ z(-jMx9i;~pJYP7nZV}nUq@|EEstgA&w|a94h&xF0(FH17Z1{P^v042XzGuFsWy`he zyhtv``z;Jy55@QLnH(1~$6kKF&0_b_ZXO>fsG6g@W!YQ2RK6u_(26Ip&-UXMm!--* zlsO^oDqhKTmazR6_b2K_w2}`GI6K$f5x;Sap6e;}D$ZabTI{H%);B>o9Bkzv=3=@q zU3X=)y@SSWPqguEJrmSzCzO;eME)9wte>=>i@OUNi{S8cad!2R_LGAkY~7G(X%L@P z3qd%}DOe{t$XQp)Zk}ikQ9)5b7*y5I!ABSZ`tY>HNE@lB{q_Ksi+H6)l2X^OhJ^Ji;y3}T?j4+6LN7mi}sxDg;n(djem#nU)f$J{_bcY zBea*BwVtO0a{V#4Mg48-?(OM(J^)*k5ZW2-0@A#|-r#?Cbv9{#v(E->=iuUg zZUHL$Hw){4`A3%jEuOQM^YH(44x0V#?|)4JO07J)^mAh2lA*WX*z7*{S~Jd!Ut^&`CSSApvBb=4eoPrt^GxF_%HJ*iV>ECiHabgNMVF9 zR1_sD43$KPi9z8g5eadGtt}EJf&63d<%YrfB0SNGcAzw%0^rg*zbkR@o=eX6hv#dL zKGPG_016WU7us(P;IQ8s2!Zhnoo(g6h9dNTj`F# g1^!jwUj_bE;9mv)|5M All resources, select the resource. - .. In the left-side resource navigation, these are the sections you'll use the most in the beginning: + - *Basic*, *Connector configuration*, and *Resource objects*. - -. xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[*Configure object types*]. - You need to do this to tell midPoint what the objects in the resource contain and how to work with them. - -Once you configure the object type, you can import users from the resource to midPoint. diff --git a/midpoint/gui-guides/resources/index.adoc b/midpoint/gui-guides/resources/index.adoc deleted file mode 100644 index 9f03713b9..000000000 --- a/midpoint/gui-guides/resources/index.adoc +++ /dev/null @@ -1,32 +0,0 @@ -= Manage Resources in midPoint -:page-nav-title: 'Resources' -:page-display-order: 10 -// :page-toc: top -:experimental: -:icons: font -:icon-set: fas - -Resources represent applications and information systems connected to midPoint, where resource accounts are managed. - -This section contains guides to help you work with resources in the midPoint web administrative interface (GUI). - -- xref:./create-resource/[] -- xref:/resource-mappings[Resource mappings TBD] -- xref:/resource-mappings[Correlations TBD] -- xref:/object-type-filtering[Filter and classify resource data via object types] -- xref:./resource-templates/[Create templates for resources TBD] - -To list all defined resources or create a new one: - -* Click icon:database[] *Resources* > icon:database[] *All resources* in the main menu. - -The resources are displayed in a table with basic details: - -* Name (in midPoint) -* Connector type -* Version (of the connector) -* Buttons to test, edit, remove the particular resource, and more - -You can sort the resource list by name by clicking on the table column header. Reverse the sort order by clicking the header again. - -For more information on connectors, refer to the xref:/connectors/[]. diff --git a/midpoint/gui-guides/resources/intro-to-resource-configuration.adoc b/midpoint/gui-guides/resources/intro-to-resource-configuration.adoc deleted file mode 100644 index c866bde44..000000000 --- a/midpoint/gui-guides/resources/intro-to-resource-configuration.adoc +++ /dev/null @@ -1,55 +0,0 @@ -= Introduction To Resource Configuration -:page-nav-title: 'Resource Configuration Overview' -:page-display-order: 110 -:page-toc: top -:experimental: - -// WIP - just a copypasta run thru AI - -== Resource Definition - -Resource definition is perhaps the most important part of midPoint configuration. It configures connection to a resource, resource object classes and attributes (resource schema), mapping of these attributes to the midPoint object model, resource capabilities, password policies, etc. - -Resource definition is an ordinary XML object in midPoint repository. Therefore it has its OID and a name that must be unique across all defined resources. -You can check this by clicking through the path Configuration-Resources from List objects - a resource of your choice from the list of available resources. - -=== Resource Configuration Object Composition - -* *Connector Reference*: Refers to the specific connector used for accessing the resource. Either an OID reference to a connector object or a smart reference to a connector type is required. - The list of available connectors is in xref:/connectors/connectors/[Identity Connectors] chapter. This list is not closed; we can produce a proper connector tailored for your target systems. - -* *Resource Configuration*: The connector specified by resource `connectorRef` is just code. For the connector to work properly, it needs configuration. - Such configuration includes details like the name of the host where the resource resides, TCP/IP port number, technical account used to connect, password for that account, database table name, directory root, filenames, etc. - Configuration properties vary by connector type. - -* *Schema Configuration*: Resource schema (attributes) can be defined statically or generated automatically when the connector initializes and if the resource supports getting schema. Most resources support this, e.g., LDAP, Database Table, CSV file, Active Directory. - The resource schema differs for each connector and/or resource (e.g., two LDAP-based resources can use the same connector but have different attributes). - -* *Schema Handling*: Specification of handling objects defined in the resource schema. For example, read-only or read-write attributes, account object classes, expressions to determine values, etc. - Schema handling specifies how an IDM administrator should use the resource schema, e.g., what object types to use for accounts, attribute setup, password management, etc. - It is where resource behavior customization occurs and influences how the resource will be presented in the GUI. - -* *Resource Capabilities*: Resource capabilities can configure special features of the resource. If this section is used, it overrides connector's capabilities. This configuration can simulate capabilities if the connector does not support them or hide native connector capabilities for a specific resource. - For example, account de/activation: which attribute stores the account status and what values represent activated/deactivated accounts. - -* *TODO Scripts (Before/After Actions)*: Scripts can run custom actions before/after connector operations. For instance, creating a home directory for users and setting access rights. - Not all connectors support scripts; language and script arguments are specific to each connector. - -* *Synchronization*: Synchronization enables you to sync changes from the resource to midPoint. Changes like account creation, modification, and deletion can be synchronized if the resource and connector support it or by using other synchronization methods. - -== XML Namespaces - -Several XML namespaces are used within the resource object. Refer to the chapter xref:/midpoint/devel/xml-namespace-list/[XML Namespace List] for details. -In examples, we use these prefixes: - -* *icfc*: Connector schema namespace (attributes common for all ICF connectors) -* *icfs*: Resource schema namespace (attributes common for all ICF connectors) -* *icfcconnector*: Connector schema for each connector type (attributes only for this connector type) -* *ri*: Resource instance (attributes only for this resource instance) -* *c*: MidPoint's common schema (attributes common for all midPoint objects) - -For more details and example code, refer to the _Resource Configuration_ chapter xref:/midpoint/reference/resources/resource-configuration/[Resource Configuration]. - -To use the resource samples documented in the xref:/connectors/[Resource and Connector Reference] chapter: -* Each resource sample is documented inline. - Follow the inline documentation for guidance. \ No newline at end of file diff --git a/midpoint/gui-guides/resources/view-resource-details.adoc b/midpoint/gui-guides/resources/view-resource-details.adoc deleted file mode 100644 index c50b01bf8..000000000 --- a/midpoint/gui-guides/resources/view-resource-details.adoc +++ /dev/null @@ -1,40 +0,0 @@ -= View Resource Details in MidPoint -:page-nav-title: 'View Resource Details' -:page-display-order: 110 -:page-toc: top -:experimental: - -// WIP - just a copypasta run thru AI - -To display resource details, list resource objects, or import resource objects: - -* Click the resource name in the resource list (available under Resources tab). - A new page will be displayed for the selected resource. - -The information is organized as follows: Details, Defined Tasks, Accounts, Entitlements, Generics, Uncategorized, Connector. - -At the bottom of each section are buttons: -* Back to go back to the resource list. -* Test Connection to check if the connection to the Resource system is successfully established. -* Refresh Schema to refresh changes in schema. -* Edit Configuration to modify configuration properties. -* Show Using Wizard to display resource definition in wizard format. -* Edit Using Wizard to modify resource definition through a wizard. -* Edit XML to edit the resource definition in XML format using an embedded editor. - -The Details pane displays basic information about the resource: -* Connector name, status, and version -* Basic information about resource configuration and objects that can be managed on this resource (e.g., accounts, groups, LDAP object classes). - -The Defined Tasks pane displays tasks related to that resource. - -The Accounts section lists accounts in the repository and on the resource system with a summary table. -It also offers options for filtering accounts according to any attribute and executing account operations such as Import, Delete, Enable/Disable account, and Remove/Change owner. -At the bottom of this section are options for creating tasks. - -The Entitlements pane and Generics pane contain similar sections as the Accounts pane but for other objects (groups, projects, etc.). -Objects in these panes are categorized by intent. - -The Uncategorized pane offers an option to filter Repository/Resource objects according to Object Class. - -The Connector pane displays information about the used connector. \ No newline at end of file diff --git a/midpoint/gui-guides/tasks/create-task-of-any-kind.adoc b/midpoint/gui-guides/tasks/create-task-of-any-kind.adoc deleted file mode 100644 index 000e19480..000000000 --- a/midpoint/gui-guides/tasks/create-task-of-any-kind.adoc +++ /dev/null @@ -1,33 +0,0 @@ -= Create a task of any kind -:page-nav-title: 'General task creation' -:page-display-order: 1 -:page-toc: top -:experimental: -:icons: font - -There are many tasks you can use in midPoint. -This guide provides general direction on where to start with any task creation. - -You may know creating a resource-specific task from the respective resource the task is related to. -This guide describes the general way to create tasks which gives you full control over the settings of the task. - -// TODO: rewrite so that it's general; originally taken from import tasks - -== Create a task - -. In icon:tasks[] *Server tasks* > icon:upload[] *Import tasks*, click icon:upload[role="green"] btn:[New import task]. -. In the form that appears, specify the basic parameters of the imported objects on the icon:briefcase[] *Work* screen: - ** *Resource*: Click btn:[Edit] to select the resource from which you want to import. - ** *Kind*: Select the appropriate kind based on what you've used for the objects in the resource. - ** *Intent*: Set to *default* unless you use multiple intents on the same resource and need to select a non-default intent. -. Switch to the icon:gears[] *Execution* screen using the left-side menu: - ** *Execution*: Set *Mode* to *Preview* if you want to simulate. Leave *Undefined* or select *Full* for real production import. - ** *Configuration to use*: Set *Predefined* to *Development* to simulate. Select *Production* or leave undefined for real production import. -* Switch to the icon:circle[] btn:[Basic] screen and name the task there. -. Click icon:check[] btn:[Save & Run] to run the task immediately. - If need be, save it for later without running it yet. - Until you run it for the first time, you won't see it in the defined tasks of the resource. - -As opposed to preview development simulation, the full mode with production configuration runs the actual data import modifying your midPoint database. - -// TODO: Mention simulation and link reading simulation results article. diff --git a/midpoint/gui-guides/tasks/import-tasks.adoc b/midpoint/gui-guides/tasks/import-tasks.adoc deleted file mode 100644 index 8474bb3b6..000000000 --- a/midpoint/gui-guides/tasks/import-tasks.adoc +++ /dev/null @@ -1,42 +0,0 @@ -= Import Objects to midPoint -:page-nav-title: 'Import tasks' -:page-display-order: 1 -:page-toc: top -:experimental: -:icons: font -:icon-set: fas - -Import tasks in midPoint are essential for synchronizing data from external resources into the midPoint system. -This article is here to guide you through creating import tasks, simulating their execution, and deploying them in a production environment. - -Import tasks are mostly useful when you connect a new resource to midPoint. -Especially if it's the first resource, you want to import the resource objects to create their respective focal objects and set the stage for later when you eventually reconcile data from various other resources. - -This guide shows you how to create an import task for one specific combination of resource, object kind, and its intent. -For a more general guide, refer to xref:./create-task-of-any-kind[]. - -[NOTE] -==== -See xref:/midpoint/reference/tasks/[] for advanced configuration options and explanations outside the realm of GUI. -==== - -== Create an Import Task - -To create the simplest import task, you only need to: - -* Pick a resource from which to import object. -* Specify the kind and intent of the imported objects. -* Select the execution mode and configuration preset. -* _Everything beyond these essential settings is optional in import tasks._ - -To create an import task: - -. Open the resource from which you want to import via icon:database[] *Resources* > icon:database[] *All resources*. -. Select the icon:male[] btn:[Accounts] screen. -. Click icon:tasks[] btn:[Tasks] dropdown menu and select icon:plus-circle[] btn:[Create task]. -. If you want to first simulate the import, toggle the *Simulate task* switch to *on*. -. Select *Import task* and click icon:plus-circle[] btn:[Create task]. -. Name the task and go through the wizard keeping the Resource, Kind, and Intent to defaults. -. Click icon:check[] btn:[Save & Run] or icon:save[] btn:[Save settings] based on whether you want to run the task immediately or save it for later. - -// TOOD: link reading simulation results diff --git a/midpoint/gui-guides/tasks/index.adoc b/midpoint/gui-guides/tasks/index.adoc deleted file mode 100644 index 5fb783301..000000000 --- a/midpoint/gui-guides/tasks/index.adoc +++ /dev/null @@ -1,16 +0,0 @@ -= Automate Processes With Tasks -:page-nav-title: 'Tasks' -:page-display-order: 11 -// :page-toc: top -:experimental: -:icons: font -:icon-set: fas -This section is all about tasks in the GUI. - -Tasks in midPoint are active processes that run inside the server, used for various purposes such as synchronization, cleanup jobs, and executing scheduled actions, serving as the backbone for automating identity management operations. - -++++ -{%children%} -++++ - -- xref:./simulation-tasks[Simulate actions before executing them TBD] diff --git a/midpoint/gui-guides/tasks/live-synchronization-tasks.adoc b/midpoint/gui-guides/tasks/live-synchronization-tasks.adoc deleted file mode 100644 index 4034fdc7f..000000000 --- a/midpoint/gui-guides/tasks/live-synchronization-tasks.adoc +++ /dev/null @@ -1,70 +0,0 @@ -= Live Synchronization Tasks -:page-nav-title: 'Live Synchronization' -:page-display-order: 1 -:page-toc: top -:experimental: -:icons: font - -*WIP* -// TODO - polish and rewrite this, it's just a copypasta from our robofriend - -Live synchronization is a mechanism in midPoint that allows for near real-time detection and processing of changes on resources. Here are some key specifics about live synchronization tasks: - -. Task Definition: A live synchronization task is defined within the element, with specific properties to indicate it's a live sync operation. - -. Activity Type: The activity type is set to liveSynchronization which distinguishes it from other types of tasks like import or reconciliation. - -. Resource Configuration: It specifies the resource and object kind (e.g., account) that needs to be synchronized using element with a reference to the specific resource. - -. Execution State: The task must have an executionState set to runnable. - -. Scheduling: Live synchronization tasks are typically scheduled to run at regular intervals, often every few seconds or minutes. This is configured under the section using the recurring and elements. - -. Connector Support: The resource connector must support live synchronization capabilities. It should be able to efficiently detect recent changes on the resource (e.g., via change logs, timestamps). - -. Token Management: Live synchronization tasks maintain a token that tracks the last processed state of the resource. This ensures only new or changed data is fetched and synchronized. - -. Efficiency: Unlike reconciliation which processes all records, live sync focuses on recent changes, making it more efficient for real-time updates. - - Example Configuration: - - - HR Live Synchronization - - runnable - - recurring - 10 - - - - - - - account - - - - - - - oid: Unique identifier for the task. - name: Name of the live sync task. - ownerRef: Reference to the owner (usually an admin user). - executionState: Indicates that the task is runnable. - schedule/recurrence: Specifies recurring execution. - interval: Interval in seconds between executions. - resourceObjects/resourceRef: Reference to the resource being synchronized. - kind: Type of object being synchronized (e.g., account). - - Behavior: - The task wakes up at regular intervals and checks for changes on the specified resource. - If changes are detected, they are processed immediately. - -Live synchronization is a powerful feature that ensures near real-time consistency between midPoint and connected resources, making it ideal for environments where timely updates are critical. - -Resources: - -** https://docs.evolveum.com/book/practical-identity-management-with-midpoint.html#05-synchronization -** https://docs.evolveum.com/midpoint/reference/master/tasks/synchronization-tasks/ -** https://docs.evolveum.com/connectors/connectors/com.evolveum.polygon.connector.grouper.rest.GrouperConnector/ diff --git a/midpoint/gui-guides/tasks/simulate-tasks.adoc b/midpoint/gui-guides/tasks/simulate-tasks.adoc deleted file mode 100644 index 86281e114..000000000 --- a/midpoint/gui-guides/tasks/simulate-tasks.adoc +++ /dev/null @@ -1,101 +0,0 @@ -= Simulate Tasks to Keep Your Data Safe -:page-nav-title: 'Task Simulation' -:page-display-order: 1 -:page-toc: top -:experimental: -:icons: font - -*WIP* -// TODO check and rewrite this, it's a copypasta from our robofriend - -Task simulation is a powerful feature in midPoint that allows administrators to preview changes before they are applied to the system or resources. This helps ensure that any modifications or configurations will behave as expected without causing unintended consequences. - -== What is Task Simulation? - -Simulation, also known as "preview mode," enables you to run tasks and see what changes would be made if the task were executed in real-time. It's particularly useful for testing new mappings, synchronization reactions, or other configuration changes before applying them to your production environment. - -== Why Use Task Simulation? - -There are several reasons why using simulation is beneficial: - -. Risk Mitigation: Avoid unintended changes by previewing the effects of a task. -. Testing Configurations: Test new configurations without affecting live data. -. Debugging: Identify issues in mappings or reactions before they impact your system. - -== How to Use Task Simulation via GUI - -To use task simulation, follow these steps: - -. Navigate to the Tasks section from the main menu. -. Select the specific resource for which you want to run a simulation task (e.g., HR System). -. Click on New Task. -. Choose the type of task you wish to simulate (e.g., Import, Reconciliation). - -=== Execution Settings - -When creating or editing a task, you can configure it to run in simulation mode by adjusting the execution settings: - -. Execution Mode: Select Preview from the dropdown menu under the "Execution" tab. - .. This ensures that no actual changes are made; only simulated results will be shown. - -. Configuration to Use: - .. Choose between Development or Production. - .. The Development configuration allows you to test new configurations without affecting your production setup. - -=== Viewing Simulation Results - -After running a simulation task, the results can be viewed in several ways: - -. Simulation Result Object: A new object will be created that contains details of what changes would have been made. -. Task Details Page: - .. Navigate to the Tasks section and find your recently run simulation task. - .. Click on the task name to view detailed results, including any metrics or event marks. - -=== Creating Reports - -You can also generate reports from simulation results: - -. Go to the Reports section in the main menu. - -. Select a report template (e.g., Simulation Report: Items Changed). - -. Configure the report parameters: - .. Choose the relevant simulation result object. - .. Customize other settings as needed. - -. Run the report and export it to CSV or another format for further analysis. - -== Conclusion - -Task simulation in midPoint is an essential tool for administrators who want to ensure that their configurations and changes will work correctly before applying them to live systems. By using the GUI, you can easily set up simulations without needing to delve into XML configurations, making it accessible even for those with less technical expertise. - -For more detailed information on configuring tasks via XML, refer to the official midPoint documentation. - -== Further Reading - -midPoint Documentation: Simulations -Task Configuration in XML - -=== Resources: - -* xref:/midpoint/reference/master/admin-gui/resource-wizard/[] -* xref:/midpoint/reference/master/simulation/[] -* xref:/book/practical-identity-management-with-midpoint.html#_conclusion_5[] - - -== Read the Simulation Results - -// This needs to go to its dedciated section once it exists - -You run simulated tasks to confirm your configuration behaves as expected. -To see the results of the simulated task: - -. Open the corresponding resource via icon:database[] *Resources* > icon:database[] *All resources*. -. In icon:tasks[] Defined Tasks, click the task the results of which you want to inspect. -. Click btn:[Show simulation results] at the top. - -Here, you can see tiles with an overview of what would have happened. -Click the btn:[More info] buttons to view the affected objects. -The left sidebar shows an overview of object counts. -Click the numbers to list the objects and see more details. - From be20a9923cbfefb93ba2b79d9271d12dd0357d0c Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 15 Apr 2025 18:28:14 +0200 Subject: [PATCH 023/183] minor wording tweaks --- midpoint/methodology/first-steps/connect.adoc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index a1ae9881c..b76a6e1db 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -10,19 +10,19 @@ -- Now that you know what systems you need to manage, it's time to connect them to midPoint and assess the quality of data you're dealing with. This step enables you to identify serious security risks, such as orphaned accounts. -You'll also get to know how consistent your data is across the systems. +You'll also get to know how consistent your data are across the systems. You can use the knowledge you gain to improve your plan based on _real_ data. -- == Considerations Before You Connect the Source System -In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as Active Directory using LDAP. +In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as an Active Directory or other LDAP resources. In reality, however, it's not so straightforward. * Firstly, there are almost certainly errors in the HR data. They're managed manually with no automatic validation. - Having nothing to compare the data with makes it impossible to assess its quality. + Having nothing to compare the data with makes it impossible to assess their quality. * Secondly, the Active Directory data is managed by different people and also manually. There may be outdated information, such as old names of people who changed their names. @@ -57,7 +57,7 @@ Let's say that the way to get data out of your HR system is via a CSV export. A CSV file can be a resource like any other. To get users from CSV to midPoint, use the CSV Connector and configure it according to the structure of the CSV export. -*Use the xref:/midpoint/gui-guides/resources/create-resource/[guide on connecting a resource to midPoint] to help you with the configuration.* +*Use the xref:/midpoint/reference/admin-gui/resource-wizard/create-resource-using-wizard/[guide on connecting a resource to midPoint] to help you with the configuration.* [NOTE] ==== @@ -184,7 +184,7 @@ Your source attribute names may, of course, be different based on your internal | As is | `givenName` | Active -| We'll construct a full name from first and last anmes. +| We'll construct a full name from first and last names. | surname-to-familyName | `surname` @@ -885,4 +885,4 @@ There is no automation between HR and midPoint yet, but we’re already prepared ==== -You can continue to xref:automation/[Automation] step or return to xref:kick-off/[Kick-off] step. +You can continue to xref:automation/[Automation] step or return to xref:kick-off/[Kick-off] step. \ No newline at end of file From 6f280590e936b79d7afdf42c3455b06cec8081eb Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 16 Apr 2025 09:08:32 +0200 Subject: [PATCH 024/183] Remove/comment out invalid links to tasks We don't have a suitable tutorials yet as I had to put the work on GUI guides section on hold to create it in the versioned docs section. --- midpoint/methodology/first-steps/connect.adoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index b76a6e1db..742d87042 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -248,7 +248,7 @@ Once you're happy with the setup, you can import for real. Create a simulation task for import. You'll use the *preview execution mode* with the *development configuration*. -Refer to xref:/midpoint/gui-guides/tasks/import-tasks/[] for more details on creating tasks. +// Refer to xref:/midpoint/gui-guides/tasks/import-tasks/[] for more details on creating tasks. Inspect the simulation results and confirm whether all is good. Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. If so, proceed to the real import. @@ -260,7 +260,7 @@ You've got everything ready to import users from the HR system to midPoint. Firstly, make sure the resource is in the *Active* lifecycle state. You can find this setting in the top bar when you open the resource via *Resources* > *All resources* > . -Then, xref:/midpoint/gui-guides/tasks/import-tasks/[create another import task] like you did for the simulation. +Then, create another import task like you did for the simulation. The only difference is that now you're going to *use production configuration* and leave the execution mode on default. .Double-check the archetypes From 939ec0e840b54ec06b5195d6004746ecf4717a79 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 16 Apr 2025 11:10:00 +0200 Subject: [PATCH 025/183] Replace image; minor language improvements; add partner network link --- midpoint/methodology/first-steps/index.adoc | 55 +++++++++++---------- 1 file changed, 29 insertions(+), 26 deletions(-) diff --git a/midpoint/methodology/first-steps/index.adoc b/midpoint/methodology/first-steps/index.adoc index 3c9869eeb..043daabc3 100644 --- a/midpoint/methodology/first-steps/index.adoc +++ b/midpoint/methodology/first-steps/index.adoc @@ -5,35 +5,37 @@ == Introduction -This is a guide to a simplified midPoint deployment that will help you get up and running quickly and see tangible results quickly. +This is a guide to a simplified midPoint deployment that will help you get up and running and get tangible results soon. We believe the best way to get started is to use an _iterative, cyclic approach_. -Start with a series of *small steps that will deliver value early on*, and then repeat those steps to refine your solution. -The steps in this cycle consist of connecting new systems, cleaning up the data, and automating the processes. -Each step should take a few months at most. This allows for manageable effort and reasonable budget allocation. +Start with a series of *small steps that will deliver the value early on*, and then repeat those steps to refine your solution. +The steps consist of connecting new systems, cleaning up the data, and automating the processes. +Each cycle should take a few days at most. +This, of course, depends on how fast other departments you need to cooperate with can work, +but allows for manageable effort and reasonable budget allocation. While learning to use midPoint, you can *feel safe thanks to xref:/midpoint/reference/simulation/[simulations]*. Before making any changes that could potentially damage your data, you can test them to see if you get the expected results. -However, no matter how safe midPoint is, it's still a good idea to *back up your data regularly*. +However, no matter how safe midPoint is, it's still a good practice to *back up your data regularly*. === The Concept of an Iterative Cyclic Approach The main concept behind this whole guide is the iterative cyclic approach. -This approach enables you to reach your desired solution in a series of small steps. +It enables you to reach your desired solution in a series of small steps. Each step brings new value and improves the overal solution. image::first-steps-idea.png[steps in the iterative cyclic IGA implementation approach] -* *Connect* a new system to the solution. +* *Connect* a new system to the midPoint. At this step, you give midPoint the option to _read_ the data from the system and analyze them, possibly comparing them to what midPoint already has its database. -* *Clean-up* step is aimed at improving data quality. +* The *Clean-up* step is aimed at improving data quality. Data in disconnected systems may often be in a poor state. Accounts have to be correlated, orphaned accounts disabled, data errors corrected. MidPoint is built to help with that. -* *Automate* step focuses on speeding up the processes and improving efficiency. +* The *Automate* step focuses on speeding up processes and improving efficiency. Manual work can be automated, making the process faster, cheaper, and more reliable. On-boarding (_joiners_) and off-boarding (_leavers_) employees are the usual candidates for automation. @@ -41,21 +43,22 @@ Repeat these steps as long as they bring you a tangible value. In every loop, you connect more systems with more data, align the data, automate the process, and thus make your organization more resilient to usual human errors. You can repeat the iterations as many times as you need, with as big or small a scope as you need. -The goal is to bring these things together: the data, the processes, and the policies. +The goal is to bring together the data, the processes, and the policies. The number of iterations you perform during the first deployment is finite because your time and budget are finite. However, the first go-live is not the end. Your policies evolve, you implement new systems, your IT ecosystem develops. -That means the cycles of connect—clean-up—automate _will_ repeat over and over, endlessly. -But, on the bright side, they're going to cost you significantly less than those first ones during the initial deployment. +That means the cycles of connect—clean-up—automate will repeat over and over, endlessly. +But, on the bright side, their cost is going to decrease significantly over time. -image::first-steps-big-picture.png[Iterative midPoint deployment process big picture] +image::adopt-midpoint.drawio.svg[Iterative approach to midPoint deployment] +//image::first-steps-big-picture.png[Iterative midPoint deployment process big picture] When it comes to identity management, *one size does not fit all*. Some organizations need strict policies, perfect visibility, or high degree of automation. -Other organizations are perfectly happy with just basic integration and automation, as long as the cost is reasonable. +Other organizations are perfectly happy with just basic integration and automation, focusing rather on the low cost of the solution. -It's virtually impossible to plan an ideal identity management project right of the bat, in all its width and depth. +It's virtually impossible to plan an ideal identity management project right of the bat in all its breadth and depth. Hence, the iterative approach. You repeat a series of small steps, focusing on areas that need to be improved at that particular point. This is the way to satisfy the requirements while keeping the costs reasonable. @@ -73,19 +76,19 @@ To safely deploy midPoint on your actual company data, you'll go through the fol . Clean up the data by fixing inconsistencies and handling orphaned accounts. . Automate some processes, such as the joiner-mover-leaver (JML) process. -You can also watch this video to learn more about the approach and see a live demonstration: +You can also watch this webinar to see the process in action: -// video::suo775ym_PE[youtube,title="First steps methodology webinar video",width="100%",height="350"] +video::suo775ym_PE[youtube,title="First steps methodology webinar video",width="100%",height="350"] == Who Is This Guide For? This guide is meant to help small and mid-size organizations. -Typically, such organizations handle hundreds or lower thousands of identities, most of the processes are manual, and the IT staff doesn't have a lot of knowledge about identity management. -We expect that there's an HR system serving as a source of the identity data, as is usual for midium-sized businesses, smaller government offices, or academic institutions. - -Nevertheless, most concepts in this guide are applicable to organizations of any size and type. -Even if your organization manages a considerably larger number of identities, the deployment process is the same, but it will likely require you to spend more time and money. +Typically, such organizations handle hundreds or lower thousands of identities, most of the processes are manual, and the IT staff doesn't have a lot of knowledge about identity governance and administration (IGA). +We expect that there's an HR system serving as a source of the identity data, as is usual for medium-sized businesses, smaller government offices, or academic institutions. +Nonetheless, most concepts in this guide are applicable to organizations of any size and type. +Even if your organization manages a considerably larger number of identities, the deployment process is the same. +It will probably cost more time and money, but that's it. === Key Challenges and Requirements @@ -93,14 +96,14 @@ These are the usual challenges you may be facing: * Your identity data is of low quality because it's maintained manually without automatic validation. * You need more people to manage identities. -* You want to get tangible results quickly. +* You want to improve your IGA and get tangible results quickly. * The implementation can't be a "big bang" effort because your IT staff must also continue performing their regular duties. -By going through this guide, you'll learn how you can deploy midPoint iteratively and get first results in a matter of weeks, even if you face all the challenges mentioned above. +By going through this guide, you'll learn how to deploy midPoint iteratively and get first results in a matter of weeks, even if you face all the challenges mentioned above. == Why MidPoint? -Here are some pointers as to why midPoint is worth your attention when looking for an IDM solution: +Here are some pointers as to why midPoint is worth your attention when looking for an IGA solution: - MidPoint is an open-source software (OSS) that requires a minimal initial investment and no licensing fees before the project begins. @@ -115,4 +118,4 @@ Just https://evolveum.com/download/[download midPoint] and try it out. - MidPoint is an OSS product with a dedicated team of professionals ready to provide support. https://evolveum.com/services/[Contact us] to discover more about our services and benefits. -- Evolveum's network of official partners is ready to deliver dedicated local support to your project as well. \ No newline at end of file +- link:https://evolveum.com/partners/find-a-partner/[Evolveum has a network of official partners] that are ready to deliver dedicated professional support for your project as well. \ No newline at end of file From 4de98dad743f16277d9c9ac35ef0aa59f2c403a5 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 16 Apr 2025 12:06:36 +0200 Subject: [PATCH 026/183] Minor language improvements --- .../methodology/first-steps/kick-off.adoc | 58 ++++++++++--------- 1 file changed, 32 insertions(+), 26 deletions(-) diff --git a/midpoint/methodology/first-steps/kick-off.adoc b/midpoint/methodology/first-steps/kick-off.adoc index 524688b02..400813923 100644 --- a/midpoint/methodology/first-steps/kick-off.adoc +++ b/midpoint/methodology/first-steps/kick-off.adoc @@ -12,20 +12,24 @@ Make a rough plan. Get long-term support from management. Secure budget. -Now that you have a rough idea what's an IDM project about, it's time to make a plan. +Now that you have a rough idea of what's an IGA project about, it's time to make a plan. Before you involve a broader spectrum of people in your organization, devise a rough idea of what you want to achieve and how does it help your organization. -Prepare a pitch-talk making it clear why it's a good idea to implement an IDM solution. -Be also ready to explain why midPoint is your solution of choice. +Prepare a pitch-talk making it clear why it's a good idea to implement an IGA solution. + +[TIP] +==== +Be ready to explain clearly why midPoint is your solution of choice. +==== The sections below contain guidance on how to select your advisory team, what questions to ask, and what to take care of. == Pick the Team Members Start with a brainstorming or "kick-off" meeting. -Bring together all the people in your organization who’re interested in identity management. -This doesn’t have to be a formal team. -The project is not formally established anyway. +Bring together all the people in your organization who are interested in identity management. +This doesn't have to be a formal team. +The project is not yet formally established anyway. Here are some tips on whom to invite: @@ -36,22 +40,22 @@ You need someone who can see the big picture and understands IT. * *Administrator of a critical IT systems* with which you want to integrate midPoint. * A *member of HR* familiar with HR practices. -Since HR is going to be your information source, you need someone that can help you assess the impact of HR practices on your project. +HR is going to be your information source and you need someone that can help you assess the impact of HR practices on the IGA project. * A *security professional*. -Identity management is closely related to information security. -There may be policies, limits, and goals given by company security policy that you should definitely consider in your plans. +Identity management and governance is closely related to information security. +There may be policies, limits, and goals given by company security policy you need to consider in your plans. In smaller organizations, this can be a meeting of just a couple of people over coffee. It could be a series of meetings. Do whatever suits your organizational culture the best. -== Topics for Dicussion +== Topics for Discussion Here is a list of topics you should discuss with your team. You probably won't have all the answers after the first session. That's OK. -It's just important to know that these questions are there to be answered eventually. +It's important to know that these questions are there to be answered eventually. The sooner you find the answers, the faster your progress will be. === What Are Your Data Sources? @@ -59,17 +63,17 @@ The sooner you find the answers, the faster your progress will be. A data source is a system you can consider authoritative and from which you can pull data _into_ midPoint. You probably have many systems with identity data, but only some can be considered authoritative. -The HR system is likely your first choice because its data usually _is_ correct and authoritative. +The HR system is likely your first choice because its data usually _are_ correct and authoritative. [CAUTION] --- +==== *Do you have other reliable source systems?* If so, could their data be in conflict? For example, one system might say that an employee's name is "John," while another system says it is "Johannes." In that case, which system do you trust? --- +==== ==== Questions Regarding Data Handling @@ -78,30 +82,29 @@ In that case, which system do you trust? * What happens with data on former employees? ** Are the records deleted? ** Do you keep them marked as inactive? - ** Or do you only set a layoff date? + ** Do you only set a layoff date? * What's the unique identifier of each HR record? ** Is it guaranteed to be unique? ** Do all your systems share the identifier? * What happens if a former employee comes back to the organization? -Do you start over with a new ID, or can you reuse the old records? +Do you start over with a new ID or can you reuse the old records? Ask the HR department for some sample data to ensure the data formats will work for you. -If you can, request a few sample data exports (like daily or weekly) to see trends in the data. - -For example, if the exports include former employees, an approximate number of changes, etc. +If you can, request a few sample data exports (like daily or weekly) to see trends in the data: + +For example, whether the exports include former employees, what's the approximate number of changes per period, etc. === What Data Targets Do You Need to Synchronize? -As opposed to data sources, data targets are systems that hold identity data but aren’t authoritative. -Your goal is to _push_ data from midPoint to target systems to ensure identity data consistency. +As opposed to data sources, data targets are systems that hold identity data but aren't authoritative. +Your goal is to _push_ data _from_ midPoint _to_ target systems to ensure identity data consistency. The usual setup is that you mostly write to target systems and use the authoritative source systems to overwrite any conflicting data. Of course, this depends on your situation. A system may be both source and target. -You'll see further down the lane in this guide how you can temporarily use a target system also as a source for a select attribute. +You'll see further down the lane how you can temporarily use a target system also as a source for a select attribute. In this guide, we use an Active Directory (LDAP) server as an example target system. Whatever target systems you have, discuss their internal data structure with their administrators so that you know what you're going to work with in midPoint. @@ -113,7 +116,7 @@ For example, in the case of an AD/LDAP server: Are there conventions for the process? Any exceptions to these conventions? * Is there a reliable *unique identifier* of user accounts? - Maybe an employee that number is conveniently stored in the `employeeNumber` attribute? + Maybe an employee number is conveniently stored in the `employeeNumber` attribute? Look at live AD data, select a few samples (such as your own account), and roughly assess the situation. Then, compare the sample with a record of the same account in the HR system. @@ -175,17 +178,20 @@ You will need money, even if you plan to do most of the work internally. You will need training, assistance and support. .Plan for recurring budget -NOTE: Having a modest budget every year can lead to a successful identity management program. +[TIP] +==== +Having a modest budget every year can lead to a successful IGA program. Having a generous budget for the first year and no budget after that is a certain way to an expensive failure. +==== == Get a Buy-In From Your Management Once you develop a rough plan and estimates regarding required money and time, *go talk to your management*. -It's crucial to get their buy-in, get them to believe that your identity management mission is meaningful and that it makes sense to invest money in it. +It's crucial to get their buy-in, get them to believe that your IGA mission is meaningful and that it makes sense to invest money in it. Don't oversell and exaggerate. Provide honest plan and estimates, set realistic expectations. Identity management is a long run, any kind of hype or exaggeration is very likely to backfire in the future. Get a green light—for a long program, not just for a short project. -And with that, you’re ready to go. +And with that, you’re ready to go. \ No newline at end of file From dd0bdad117e1c1c5948ed2988e7ca31ef94ba101 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 16 Apr 2025 13:00:08 +0200 Subject: [PATCH 027/183] Reuse existing implementation schema instead of duplicating it --- midpoint/methodology/first-steps/adopt-midpoint.drawio.svg | 1 + 1 file changed, 1 insertion(+) create mode 120000 midpoint/methodology/first-steps/adopt-midpoint.drawio.svg diff --git a/midpoint/methodology/first-steps/adopt-midpoint.drawio.svg b/midpoint/methodology/first-steps/adopt-midpoint.drawio.svg new file mode 120000 index 000000000..bae3149b8 --- /dev/null +++ b/midpoint/methodology/first-steps/adopt-midpoint.drawio.svg @@ -0,0 +1 @@ +../../../why-evolveum/adopt-midpoint.drawio.svg \ No newline at end of file From e5e8b8d9b17adee1bf94000150a9fd44c0708e63 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 16 Apr 2025 13:00:46 +0200 Subject: [PATCH 028/183] Add config specifics near the links to atomic guides --- midpoint/methodology/first-steps/connect.adoc | 63 +++++++++---------- 1 file changed, 31 insertions(+), 32 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 742d87042..b20c3ae4f 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -7,24 +7,29 @@ .Goal [TIP] --- -Now that you know what systems you need to manage, it's time to connect them to midPoint and assess the quality of data you're dealing with. -This step enables you to identify serious security risks, such as orphaned accounts. +==== +Now that you know what systems you need to manage, it's time to connect them to midPoint and assess the quality of the data you're dealing with. +Use this step to identify serious security risks, such as orphaned accounts. You'll also get to know how consistent your data are across the systems. -You can use the knowledge you gain to improve your plan based on _real_ data. --- +You can use this knowledge to improve your plan based on _real_ data. +==== + +Let us repeat that for the purposes of this guide, we suppose you have an HR system that exports CSV files with accounts and an Active Directory system implemented using LDAP. +The HR system is considered to be an authoritative source, the AD/LDAP system is considered to be a non-authoritative target system. + +Whatever your actual systems are, the concepts presented in this guide are universal and you need to adjust only the implementation details, such as your resource configuration. == Considerations Before You Connect the Source System -In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as an Active Directory or other LDAP resources. +In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as an Active Directory or other resources. -In reality, however, it's not so straightforward. +Reality isn't so straightforward, though. * Firstly, there are almost certainly errors in the HR data. They're managed manually with no automatic validation. Having nothing to compare the data with makes it impossible to assess their quality. -* Secondly, the Active Directory data is managed by different people and also manually. +* Secondly, target systems like Active Directory are managed by different people and also manually. There may be outdated information, such as old names of people who changed their names. More serious issues like orphaned accounts of former employees can occur. These issues are fairly easy to fix through synchronization with the HR resource, though. @@ -34,54 +39,48 @@ In reality, however, it's not so straightforward. These aren’t employees and therefore aren't in the HR system. That means an HR-based synchronization without proper planning would delete these potentially business-critical accounts. -Overall, when you integrate an IDM solution on top of existing account data, *you need to be vigilant*: +Overall, when integrating an IGA solution on top of existing account data, *you need to be vigilant*: * You can't change *usernames* carelessly. - Many systems in your organization may use them as the primary ID of the accounts. + Many systems in your organization may use them as the primary ID of accounts. * You mustn't delete any *accounts* unless you're absolutely sure it's the desired action. * You have to keep *passwords* as they are. Otherwise, you'd lock people out of the systems across your organization. - == Connect the HR System - -You now know what to be careful about and what your nearest goals are. - -Let's say that the way to get data out of your HR system is via a CSV export. +The first thing to do is to connect the authoritative source system to midPoint. +When you're done with this step, you're going to have the HR accounts in midPoint and can move forth with connecting a target system, such as an Active Directory. === Create a Resource for the HR System +The HR system exports accounts to CSV files. A CSV file can be a resource like any other. -To get users from CSV to midPoint, use the CSV Connector and configure it according to the structure of the CSV export. +To get users from CSV to midPoint, use the CSV connector and configure it according to the structure of the CSV export. *Use the xref:/midpoint/reference/admin-gui/resource-wizard/create-resource-using-wizard/[guide on connecting a resource to midPoint] to help you with the configuration.* -[NOTE] -==== -Set the lifecycle state to _Proposed_ until you finish the whole configuration of the resource. -==== +. Create a new resource from scratch. +. Use the CSV connector. +. Set the lifecycle state to _Proposed_ until you finish the whole configuration of the resource. +. Get back here when you're done. === Configure the Resource Object Type -The next step after connecting the CSV resource is to configure the resource object types. -In your case, each resource object represents a user in the HR system. +The next step after connecting the CSV resource is to configure the resource object type. +In your case, each resource object represents a user account in the HR system. *Use this guide for xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[instructions on object type configuration].* -After you save your object type, you can preview the resource data to see what you're getting from there. - -[#get-back-to-config-wizard] -[TIP] -==== -If you close the resource wizard too soon, don't worry. You can get back to it any time: - -In *Resources* > *All resources* > , open the object type for editing via *Schema handling* > *Object types*. +. Name the object type _HR account_, for example. +. The type will be of the _Account_ kind, _default_ (or empty) intent, and with the _Default_ attribute set to _True_. +. Select the _Person_ archetype in the last step. +. Keep the rest of the settings to defaults. +. Get back here when you're done. -Similarly, you can always view the resource objects via *Resources* > *All resources* > > *Resource objects*. -==== +After you save your object type, you can preview the resource data to see what you're getting from there. === Filter Out Irrelevant HR Entries From 5215bedbb8dfe8c2a4d12f0e481c83743fb9e6ff Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 16 Apr 2025 21:23:10 +0200 Subject: [PATCH 029/183] link correct places in updated res. wizard; polish --- midpoint/methodology/first-steps/connect.adoc | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index b20c3ae4f..1ec545a53 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -97,15 +97,17 @@ To prevent these accounts from being imported to midPoint: . Find a common pattern these entries have in the HR system. + It may be that their employee numbers start with a different digit or their employment type is different from others… -. link:#get-back-to-config-wizard[Go back to the resource object type configuration] and select the *Basic* tile. +. xref:/midpoint/reference/admin-gui/resource-wizard/object-type[Go back to the object type configuration] and select the icon:circle[] *Basic attributes* tile. -. In the *Specify the resource data* screen, type a filtering condition to the *Filter* field.+ - For instance, if their `employeeNumber` starts with `8`, unlike anyone else's: `attributes/employeeNumber not startsWith "8"`. +. Edit the object type you've created for the accounts and xref:/midpoint/reference/admin-gui/resource-wizard/object-type#filter-resource-objects[set up a filtering query]. + + For instance, if their employee number (`empnum`) starts with `8` unlike anyone else's: `attributes/empnum not startsWith "8"`. -. Save the object and link:#get-back-to-config-wizard[view the resource objects again]. +. Save the object and preview the resource objects again. . Click *Reclassify* at the bottom of the resource object list. -. You should see that the `8XXX` accounts no longer appear listed among the resource objects. +// TODO: I have to confirm this step because I don't see the button now @dakle + +. The excluded accounts should no longer appear listed among the resource objects. Now, you're ready to proceed to the next steps before you can finally import your users from the HR system to midPoint. @@ -113,7 +115,8 @@ Now, you're ready to proceed to the next steps before you can finally import you ==== Up until now, you didn't import anything to midPoint. When you viewed the resource objects, you were looking at real data at the remote end of the connector (i.e., the CSV file). -That's why it's called preview and why it's important to preview the data before you import them to avoid needless clean-up maintenance later on. +That's why it's called preview and why it's important to preview the data before you import them. +It helps to avoid needless clean-up maintenance later on. ==== === Define Mappings and Synchronization Policies to Prepare for Import From af4e1bf7f43d139d0a1c272eaa75e23247730021 Mon Sep 17 00:00:00 2001 From: dklement Date: Fri, 18 Apr 2025 07:40:45 +0200 Subject: [PATCH 030/183] Add sample CSV from MID-301 for testing --- midpoint/methodology/first-steps/connect.adoc | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 1ec545a53..aac78e8b5 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -19,6 +19,18 @@ The HR system is considered to be an authoritative source, the AD/LDAP system is Whatever your actual systems are, the concepts presented in this guide are universal and you need to adjust only the implementation details, such as your resource configuration. +.Sample data to test with +[NOTE] +==== +If you firstly wish to test the scenarios described in this guide, you can use fictitious sample HR system export CSV file: + +* xref:../hris-export-sample.csv[hris-export-sample.csv] + +Place is to the home directory of your midPoint instance. See xref:/midpoint/quickstart/#file-paths-in-docker-containers[how to work with file paths in Docker]. + +Obviously, the caveat of having a static CSV file to test with is that when you want to imitate a change in the HR system, you need to edit the CSV file manually. +==== + == Considerations Before You Connect the Source System In theory, you should give the data in your _source_ HR system absolute authority and use it to fix any inconsistencies in other _target_ systems, such as an Active Directory or other resources. From d0cb96ad877e0b668c8752803fa2421ce3c87735 Mon Sep 17 00:00:00 2001 From: dklement Date: Fri, 18 Apr 2025 08:46:18 +0200 Subject: [PATCH 031/183] add also the forgotten sample CSV --- .../first-steps/hris-export-sample.csv | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 midpoint/methodology/first-steps/hris-export-sample.csv diff --git a/midpoint/methodology/first-steps/hris-export-sample.csv b/midpoint/methodology/first-steps/hris-export-sample.csv new file mode 100644 index 000000000..6dbc9b43e --- /dev/null +++ b/midpoint/methodology/first-steps/hris-export-sample.csv @@ -0,0 +1,45 @@ +id,employeenumber,firstname,surname,status,locality,country,emptype,job +1,"1001","Geena","Green","In","Small Red Rock City","_loc:Rocky State","FTE","124#CEO" +2,"1002","Ana","Lopez","In","Hot Lava City","_lcl:Lava State","FTE","125#CFO" +3,"1003","Jimmy","Taylor","Former employee","Small Red Rock City","_loc:Rocky State","FTE","107#Junior Consultant" +4,"1004","Peter","Hunter","In","White Stone City","_ilo:Stone State","FTE","910#HR Consultant" +5,"1005","Emanuel","Young","Former employee","Hot Lava City","_lcl:Lava State","FTE","120#Senior Specialist" +6,"1006","Martin","Knight","In","Hot Lava City","_lcl:Lava State","FTE","121#Junior Specialist" +7,"1007","Diane","Davis","In","Hot Lava City","_lcl:Lava State","FTE","107#Junior Consultant" +8,"1008","Elisabeth","Mason","In","Small Red Rock City","_loc:rocky state","FTE","191#Accountant" +9,"1009","Josef","Zimmer","In","Hot Lava City","_lcl:Lava State","FTE","113#Sales Representative" +10,"1010","Alexander","Freeman","In","Fast River City","_rlc:two river state","FTE","113#Sales Representative" +11,"1011","Victoria","Violet","In","White Stone City","_ilo:stone State","FTE","111#Sales Director" +12,"1012","Robert","Nelson","In","Fast River City","_rlc:Two River State","FTE","199#Service Development Specialist" +13,"1013","Olaf","Peterson","In","Hot Lava City","_lcl:Lava State","FTE","102#CTO" +14,"1014","Tom","Walker","In","White Stone City","_ilo:Stone State","FTE","107#Junior Consultant" +15,"1015","Lucy","Rider","In","Hot Lava City","_lcl:Lava State","FTE","331#HR Director" +16,"1016","Jane","Anderson","Long-term leave","Hot Lava City","_lcl:Lava State","FTE","107#Junior Consultant" +17,"1017","Frank","Usher","In","White Stone City","_ilo:Stone State","FTE","106#Agent Recruitment Specialist" +18,"1018","Sam","Brown","In","White Stone City","_ilo:Stone State","FTE","106#Agent Recruitment Specialist" +19,"1019","John","Smith","In","Hot Lava City","_lcl:Lava State","FTE","667#International Intervention Coordinator" +20,"1020","Olivia","Xander","Long-term leave","Hot Lava City","_lcl:Lava State","FTE","106#Agent Recruitment Specialist" +21,"1021","Alice","Baker","In","White Stone City","_ilo:Stone State","FTE","139#Chief Recruiting Officer" +22,"1022","David","Iverson","Long-term leave","Small Red Rock City","_loc:Rocky State","FTE","199#Service Development Specialist" +23,"1023","Ellen","Jones","In","Small Red Rock City","_loc:Rocky State","FTE","331#Contract Termination Specialist" +24,"1024","Brad","Carpenter","In","Fast River City","_rlc:Two River State","FTE","906#Airborne Unit Coordinator" +25,"1025","Robert","Riley","In","Fast River City","_rlc:Two River State","FTE","222#Careers Advisor" +26,"1026","Joseph","Smith","In","White Stone City","_ilo:Stone State","FTE","146#Expert Specialist" +27,"1027","Emma","Jones","In","Fast River City","_rlc:Two River State","FTE","222#Careers Advisor" +28,"1028","Jonathan","Taylor","In","Fast River City","_rlc:Two River State","FTE","665#Domestic Intervention Coordinator" +29,"1029","Ashley","Jackson","In","Hot Lava City","_lcl:Lava State","FTE","331#Contract Termination Specialist" +30,"1030","Amanda","de Wries","In","Small Red Rock City","_loc:Rocky State","FTE","209#Senior Consultant" +31,"1031","Jennifer","Jameson","In","Hot Lava City","_lcl:Lava State","FTE","209#Senior Consultant" +32,"1032","Patrick","Anderson","In","Hot Lava City","_lcl:Lava State","FTE","113#Negotiation Specialist" +33,"1033","Scott","Hoover","In","Fast River City","_rlc:Two River State","FTE","113#Negotiation Specialist" +34,"1034","Laura","Shepherd","Long-term leave","Hot Lava City","_lcl:Lava State","FTE","113#Sales Representative" +35,"1035","John","Smith-Walker","In","White Stone City","_ilo:Stone State","FTE","113#Sales Representative" +36,"1036","Maria","Schmitt","In","Hot Lava City","_lcl:Lava State","FTE","107#Junior Consultant" +37,"1037","Eva","Mendez","Long-term leave","Hot Lava City","_lcl:Lava State","FTE","107#Junior Consultant" +38,"1038","Ricardo","Pedroso","In","Hot Lava City","_lcl:Lava State","FTE","190#Expert Accountant" +39,"1039","Charles","Whitehead","In","Hot Lava City","_lcl:Lava State","FTE","400#Environment Adaptation Specialis" +40,"1040","Frederick","Smith","In","Hot Lava City","_lcl:Lava State","FTE","400#Environment Adaptation Specialis" +41,"8000","Janet","Garner","In","Hot Lava City","_lcl:Lava State","PTE","899#Cleaning & Maintenance Specialist" +42,"8001","Ben","Goosehead","In","Hot Lava City","_lcl:Lava State","PTE","899#Cleaning & Maintenance Specialist" +43,"8002","Maria","Alvarez","In","Small Red Rock City","_loc:Rocky State","PTE","899#Cleaning & Maintenance Specialist" +44,"8003","Monica","Mendez","In","Fast River City","_rlc:Two River State","PTE","899#Cleaning & Maintenance Specialist" \ No newline at end of file From 93b4ed13ae89ff0f90d9a75e64ddbf284fbbdfd9 Mon Sep 17 00:00:00 2001 From: dklement Date: Fri, 18 Apr 2025 17:46:21 +0200 Subject: [PATCH 032/183] general improvements, link new guides, fix issues --- midpoint/methodology/first-steps/connect.adoc | 41 ++++++++++++------- 1 file changed, 26 insertions(+), 15 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index aac78e8b5..02ef1210c 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -86,7 +86,7 @@ In your case, each resource object represents a user account in the HR system. *Use this guide for xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[instructions on object type configuration].* -. Name the object type _HR account_, for example. +. Name the object type _HR Person_, for example. . The type will be of the _Account_ kind, _default_ (or empty) intent, and with the _Default_ attribute set to _True_. . Select the _Person_ archetype in the last step. . Keep the rest of the settings to defaults. @@ -112,51 +112,61 @@ To prevent these accounts from being imported to midPoint: . xref:/midpoint/reference/admin-gui/resource-wizard/object-type[Go back to the object type configuration] and select the icon:circle[] *Basic attributes* tile. . Edit the object type you've created for the accounts and xref:/midpoint/reference/admin-gui/resource-wizard/object-type#filter-resource-objects[set up a filtering query]. + - For instance, if their employee number (`empnum`) starts with `8` unlike anyone else's: `attributes/empnum not startsWith "8"`. + For instance, to exclude employees whose number (`empnum`) starts with `8`: `attributes/empnum not startsWith "8"`. . Save the object and preview the resource objects again. . Click *Reclassify* at the bottom of the resource object list. // TODO: I have to confirm this step because I don't see the button now @dakle -. The excluded accounts should no longer appear listed among the resource objects. +. The excluded accounts should no longer appear listed among the resource objects. MidPoint is aware of them but they are no longer considered an _HR Person_ (they are of an unknown kind and intent). Now, you're ready to proceed to the next steps before you can finally import your users from the HR system to midPoint. +The next steps are: + +* Mapping rules +* Synchronization rules [TIP] ==== -Up until now, you didn't import anything to midPoint. -When you viewed the resource objects, you were looking at real data at the remote end of the connector (i.e., the CSV file). +Up until now, you didn't import any users to midPoint, only the shadows of their LDAP accounts. +When you viewed the resource objects, you were looking at shadows of real data at the remote end of the connector (i.e., the CSV file). That's why it's called preview and why it's important to preview the data before you import them. +Reclassifying shadows is much easier than manipulating imported data. It helps to avoid needless clean-up maintenance later on. ==== === Define Mappings and Synchronization Policies to Prepare for Import -Before you can import any user accounts, you need to define how to handle the user data in the resource objects, as well as specify rules on how to behave when users are discovered, updated, deleted, and so on. +Before you can import any user accounts, you need to define user data handling, as well as specify synchronization rules on how to behave when users are discovered, updated, deleted, and so on. This is what mappings and synchronization policies are for. ==== Set synchronization rules Firstly, let's tell midPoint what to do in what situation. -Refer to this guide on how to create synchronization rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/synchronization/[] +Refer to this guide on creating synchronization rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/synchronization/[] + +The xref:/midpoint/features/current/synchronization/[] feature page may be useful to you if you wish to dive deeper into the mapping mechanisms. -The rules you want to define at this stage of your project in particular: +These are the rules you want to define at this stage of your project: -[cols="1,1,3"] +[cols="2,1,1,4"] |==== -| Situation | Reaction | Comments +| Name | Situation | Reaction | Comments +| add-focus-for-unmatched | Unmatched | Add focus | The account from CSV doesn't exist in midPoint yet, so let's create the user in midPoint. // technically not needed in clean MP but they need to add it later anyway so I'm putting it here already @dakle +| link-unlinked | Unlinked | Link | There's a focus for the account but it's not linked to the shadow of the account yet, let's link it. This isn't used during the first import, but it's necessary for later when the account shadows are in midPoint already. +| synchronize-linked | Linked | Synchronize | Synchronize the data between the remote account and the focus based on mappings. @@ -165,15 +175,16 @@ The rules you want to define at this stage of your project in particular: ==== Map user data -Secondly, let's map various data in the user objects on the resource to user attributes in midPoint. +Secondly, you need to map various data in the user objects on the resource to user attributes in midPoint. -Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[] on how to define mappings. -You want to use *inbound mappings* because you're pulling attributes _from_ the resource _to_ midPoint. +Refer to this guide on creating mapping rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[]. The xref:/midpoint/features/current/mapping/[] feature page may be useful to you if you wish to dive deeper into the mapping mechanisms. -These are the rules you want to define. -Your source attribute names may, of course, be different based on your internal naming convention. +Use *inbound mappings* because you're pulling attributes _from_ the resource _to_ midPoint. + +These are the rules to define now. +Your source attribute names may, of course, be different based on your source system attribute naming. [cols="2,1,1,1,1,5"] |==== From 8ba7fa8a891bba396b79b3a5e848a4d074f321c9 Mon Sep 17 00:00:00 2001 From: dklement Date: Thu, 24 Apr 2025 13:41:33 +0200 Subject: [PATCH 033/183] improve links to related guides --- midpoint/methodology/first-steps/connect.adoc | 44 ++++++++----------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 02ef1210c..21a0397d5 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -96,9 +96,6 @@ After you save your object type, you can preview the resource data to see what y === Filter Out Irrelevant HR Entries -// This should be a separate short tutorial that elaborates a bit more on the topic. TBD @dakle -// There's a hint on this at /midpoint/reference/master/admin-gui/resource-wizard/object-type/#specify-the-resource-data - When you preview the resource objects, you may realize there are some accounts that you don't want or need to manage using midPoint. These may be AC technicians or people who manage your office greenery. @@ -116,26 +113,16 @@ To prevent these accounts from being imported to midPoint: . Save the object and preview the resource objects again. -. Click *Reclassify* at the bottom of the resource object list. -// TODO: I have to confirm this step because I don't see the button now @dakle +. xref:/midpoint/reference/tasks/shadow-reclassification-task/[Reclassify the resource object shadows] to reflect your changes in the account list. -. The excluded accounts should no longer appear listed among the resource objects. MidPoint is aware of them but they are no longer considered an _HR Person_ (they are of an unknown kind and intent). +. The excluded accounts should no longer appear among the accounts. MidPoint is aware of them but they are no longer considered an _HR Person_ (they are of an unknown kind and intent). -Now, you're ready to proceed to the next steps before you can finally import your users from the HR system to midPoint. +Now, you're ready to proceed to the next steps before you can import your users from the HR system to midPoint. The next steps are: * Mapping rules * Synchronization rules -[TIP] -==== -Up until now, you didn't import any users to midPoint, only the shadows of their LDAP accounts. -When you viewed the resource objects, you were looking at shadows of real data at the remote end of the connector (i.e., the CSV file). -That's why it's called preview and why it's important to preview the data before you import them. -Reclassifying shadows is much easier than manipulating imported data. -It helps to avoid needless clean-up maintenance later on. -==== - === Define Mappings and Synchronization Policies to Prepare for Import Before you can import any user accounts, you need to define user data handling, as well as specify synchronization rules on how to behave when users are discovered, updated, deleted, and so on. @@ -145,9 +132,7 @@ This is what mappings and synchronization policies are for. Firstly, let's tell midPoint what to do in what situation. -Refer to this guide on creating synchronization rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/synchronization/[] - -The xref:/midpoint/features/current/synchronization/[] feature page may be useful to you if you wish to dive deeper into the mapping mechanisms. +* Refer to this guide on creating synchronization rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/synchronization/[] These are the rules you want to define at this stage of your project: @@ -171,20 +156,23 @@ These are the rules you want to define at this stage of your project: | Synchronize | Synchronize the data between the remote account and the focus based on mappings. +[TIP] +==== +See xref:/midpoint/features/current/synchronization/[] to learn about the topic in more depth. +==== + |==== ==== Map user data Secondly, you need to map various data in the user objects on the resource to user attributes in midPoint. -Refer to this guide on creating mapping rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[]. +* Refer to this guide on creating mapping rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[]. -The xref:/midpoint/features/current/mapping/[] feature page may be useful to you if you wish to dive deeper into the mapping mechanisms. +* Use *inbound mappings* because you're pulling attributes _from_ the resource _to_ midPoint. -Use *inbound mappings* because you're pulling attributes _from_ the resource _to_ midPoint. - -These are the rules to define now. -Your source attribute names may, of course, be different based on your source system attribute naming. +Below are the rules to define now. +Your source attribute names may be different based on your source system attribute naming. [cols="2,1,1,1,1,5"] |==== @@ -230,7 +218,7 @@ Your source attribute names may, of course, be different based on your source sy The mappings can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state. .Naming conventions for mapping names -[TIP] +[INFO] ==== You may be wondering why name the mappings the way we do above. On the first sight, it seems redundant to name a mapping _surname-to-familyName_ because it's clearly visible in the mapping ingests surname and outputs its content to familyName. @@ -241,6 +229,10 @@ This convention helps to ensure that. As for spaces vs. dashes—you can use either, but dashes are generally the saver option. ==== +[TIP] +==== +See xref:/midpoint/features/current/mapping/[] to learn about the topic in more depth. +==== === Import Users From the HR System From c2eb4de5174f896bdfb5c6e726a4a72c159b5074 Mon Sep 17 00:00:00 2001 From: dklement Date: Sun, 27 Apr 2025 07:14:53 +0200 Subject: [PATCH 034/183] better mapping lifecycle state explanation; add mapping image --- midpoint/methodology/first-steps/connect.adoc | 9 ++++++--- .../first-steps/hris-inbound-mappings.webp | Bin 0 -> 39226 bytes 2 files changed, 6 insertions(+), 3 deletions(-) create mode 100644 midpoint/methodology/first-steps/hris-inbound-mappings.webp diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 21a0397d5..cebf3da0e 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -215,13 +215,16 @@ Your source attribute names may be different based on your source system attribu |==== -The mappings can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state. +The mappings can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state and the states can be considered hierarchical in this case. +Refer to xref:/midpoint/reference/concepts/object-lifecycle/[] for more details about lifecycle states. + +image::../hris-inbound-mappings.webp[] .Naming conventions for mapping names -[INFO] +[NOTE] ==== You may be wondering why name the mappings the way we do above. -On the first sight, it seems redundant to name a mapping _surname-to-familyName_ because it's clearly visible in the mapping ingests surname and outputs its content to familyName. +On the first sight, it seems redundant to name a mapping _surname-to-familyName_ because it's clearly visible in the mapping ingests surname and outputs its content to _familyName_. You're right, of course, but the reason for this naming convention is that *mapping names need to be unique throughout the object type*. This convention helps to ensure that. diff --git a/midpoint/methodology/first-steps/hris-inbound-mappings.webp b/midpoint/methodology/first-steps/hris-inbound-mappings.webp new file mode 100644 index 0000000000000000000000000000000000000000..e3aa454ce8f291bb8a47128ade18d4b785634ad0 GIT binary patch literal 39226 zcmaHSb95$6x9<~9Jekzx zx@uST-lbNO6cb}g0|3-Tg%s2jI5c1Y007O`kUYqx~nZ|2NP7 zN`*Hubu(`tCIEmu4FJGs|3`0MY5$}H3YGu>l`mb%OaK6B z=>Pzk`B&aL|4Y50z6AcS-u}Nl|E0gLo-30X1_03e29*I+zwfcdqcq-r_ryfV{=o=> znR4tgR}nB;UrwK1u}<_^0*S`c%~Wet_xJTPrS*5_c=xYvKh96ECi=iprIDgKnvvu` z7Lv)PV@+_Dfi#X|b!#N;3uKzbY}zi`$u^iKnr7NfGz~Ok@lqxy{T5 zahbU@ap5mOJ4Y+Y#@ER^VVU=Q)HsKb|I(PF-;KPyggjq#;G2a^ZUl2J?Z8dR9?Gb- zlH>k0N#cYv98^Vt3{At8Q_EbSA3sK5u1e+Pt)1Wm8-v;4M*VvSu9l7?hhrAvX@)y_ ze!*>M)fqCJbv-k_6vhx375f35 z6hE2vp=>}ZX|L7UNQ+A}bmqPzZ1iex9_zL9`@=WQn6n)>yIQGC$}&+UUdv9kY(S}^ z5Y1KEvazj5&9S*wahlc{R?AXQx(X>#g{rZS&lc4&~xhNpglXo;a%FY3}&&+^*&#W1qfd~nE7N2 z5;M2s*)ZWBIXjlLEDw&3c*y83q$H(n&^B`2r;JiOp6!tBQnAg&lwts$gY+%zlcj!fSRfhY0=jm2k zyJwzNaYGOk643@BK~k!aU%tRv+e`CakGNlTY(6x#x-7!d|N1Zw5Zcacz z>UW;5-BD!1$h*VOI`*AHmqY0{7A`L?N5T7wwcJjuEWf4wKCKQkn%w1Tw;@0d9KBC7vmqJ(J^(jq0mw+ zjZYw=9B%CjQQb2(F@Y@RI9#w)Hi{R1Zyh?0Bpnv?xH zM_{fhPS%9h;J7GPgx9d8cbYixz|IZ)7YZ>pST;b}{E=vC%b`qDtG!LL0|a%A-AA1Y zXDo_VH#vESIri@4}9CrSBz(_U|$MJNrX@k0>0%V+MweXOSUq*=ld@I@PXhoj3bQ|{ZRy2WA*CDqd!0FIAJNw)lu5ddHyWO}R2u=`j-LAggpKA7U7 zOc0#QwwT&B;7%{!{GFj?EOM{_>FGts)Kt#H zz?$yKb-xvudNat*xhGJ#>?z>OuT!Sl zLXw{YBIKg|V2%UUB$;h}<9^NKMy$n+!QywcFH-WoRhX@^^Vh919XHOl>IjNxtsUbfV>-EZ>1!QEd0Zn7Fys7Le ziXWR;Od4{q@}f8(iq?BGnqh^P3~dqtqr9nAqHSgfqzANuK*EU9b>GcEzpPZVcZLN7 zrD*|aK>3N7gCXEXq&{X7#7k;nYmNKJ@Oju4>Od+4-mZJCv$&R)y(kM&KkHC2rxLhOyHXCE9=o)tv3QF?GoEH+9h4POV8~5 z!4i^57Sg=Kpex7Yq$wiis^Gfqprg$u;-!3&9h*0&&b^Yy^%Bos)BH0y(g@4jJB6tu(dQxpMVAYzkFtrN@ zna|r?3_m#_7O@w1Wo{NT?@xW;?X`MwyEPX8W#4R|N)YjesQ75shSJw42J#y>Q#nba z`Az2CFEck64`6M}6u;b-eMWbUy%$RmU6V%rB3xoa<Mw$;Ayxr!4;6*P!LEv znGGkGNqJRXwXHV=yk|0|r^hSh!!COg!jLOf$`4Wws|9PaDviQ2dsoxoL z2l1gkX4gWNBIA437?)NMg9Y#4^A25tHB|7@a#OA8Vy?C5+=~t?w_~tEN0n_Ar@j_L zE{1u(WTpns#~s_nnMT{goweaYxga+2+2#GbxRumQ-Q`jKE5O38%Mxz-@^sfV|+h|cJsu@5Ns&+ zJ}P6*-lUbkQ`sm;)6Db2*;>p58ZI_+&aU6iUf6IH5B8zVbNGU19BO%HuLiPCEM#dG zFW{J3$fj(MQScN~=8j}-ofoV6SufVXu58y`d{>O6LZ2to;PwxKe3;OR$qT=A;O$NA z4fE0_rT;0YxvtM=zT#ggU?|#8IUYr}%SO z67$Py_KG<(_$qo-iXtwSg9#<4F1+6n(4F1%zp_T zG4rRA%O$ulB8H?*H?RM`@F1mC46B>BpqI@L)D3m=s{OFpP@hi;s!g0+;FG`o0TrOp zi`|s$+3*YH4n8zc$Xhp@pM7IzI&BmY!M`VHcyjnVb=8yKP z+_}42QWDAy#_atw_1Tb`xT+tG)E5CV44Z4363x*-uN6uHIb&P=vm=ASdYq!;Y;Fme zAF!fKvCOpz7gPQ@SC|ZBk2QJy>YH&gCazKb)kO5>ji1Tu# z=cq0L9IpIjaZqpXU)hbWMt~pR8}cWaP6b}!_;}d3+(F>%+e>y{KUE}?S{4Q>@>wVk<4q#2;>e;@({6Q-fx0Hd&ha z7rAR~s5}bSeksG)$t+XK%d^Qe1D;Aj{Vvto%iGMphhI^RqgfgZL@eiBw$dc-^x%-P z8PEKyorO(^^pFcUCC{>7)_RfV>N><#IIX<+zRU&h0>WbinV-WWOo1n&x<~6kS8aL+ zkc)qCg34bBNw+;OBoL168FZ21YvQAwebhT6EouTP!OgU6sVDi_1m`@qSOh=i&I)B= z#T~p#eBA;GvO#uC+p|l-tt;lSnz@f64--pmHG#m{RdsG8MP{-t9LCF%g4m-rL(A{8 zx6iXdZ3*bn7_4ERo9rJ11NVC=j@-}=39nawfy73Hl7u9HwfZFgi<){CCeC`) z!5ypzxp%!_A(cB*7eClkdsIs>f+hCjK9MT|#4M3l#aTO?zb@>BWS$U%tKav^=D5U# z1@(zpIZKTffXqoto98mq0X3(H6io{}0hj)JrCeJ^c*(^-W6K6gcIoCkfM?|+f0o(f zH+nVaPZbR7hi7eWs)gBPc>T^cjGea>F4T`AuJ6r7?IPy^uu>#o*zdZ+3E_}K>o?lv zvu1879NUk{3JUDR!8&9U97-)cS47SRqinuerZVZ|u&4s4z||K~B!YW{tsD=9ciC%$ zyEbA*`w9jJTBD%KK5^N2gIcr*cJ~}3yLITK=vT(hLyY&s5lY^{iyQkdfH8_hk8&DV zIz2p000(`JBfNg^f(lsdx#YbTFR<9h8CYp$VW68#jr7*^C9zi3EZ54o?YM7fIef?< zuJZ6KJ7Je>kwb3>E?dh_q{sf0cFI25+(E<72nP}vq_y)K`tqoTI26jBVjsY*$10>- za%t4tl0i07nv6Jdn;BvCNO$(0U#np104Alr`b7qquxt0@d#0SZ?@}|?0bQxgAN7PW z%}X5zcDPmeZm-5*R6g&q%s7w&f}IX;;TmIRMJP!-km!?{7;qioR$f}!X6HplzNWW> z1xm+JNzLQJ%sX4M1CkPX<<3YL;yR24wbaDp3{SBp-LlYF1fR65gwPyNxdWU6HNifT71 zPUj&E?QtM>?!e*FRti>b*aisG2>Ta8Bh-6;>zfT!@;KkB^wlAmZ?Bvx7~QmrYFZnr zh9TBT4CRDCZ-tRIIgHXqI!dH@?VxV}-ZninT&tj?>L#_+vkYfPr&Dnx)4%`#z}i&L zM4s04H!5X_rUVhNjhawS_!42*q{4AUR8X4Sa^-hbX^NlUdWB2kET1E?camZEINHvH zbY5VB!4TXqwk7qe$s^i(n+2SM_% zo4ebozi{2`<4fl#i^!KSzuk2M9hjC6XsD^&`quLhg5>KFA0F~V(~>V$nAiyF*ZsY> z;*2p_iFn}m-XaTN{Hnv;)Xxl^le{I@$08GN+r&(su)x5S2|qWbgKSDaOCc2=;P<;S z#1_r&j=aZHd~RSwpFHO~!+5e~M@#Td@DYySfEJ|1AQM)bPlWp|B%FY=RXBcHfiqYS z%4|q+2&k`*7O)>${yZ+0=TYD|B9~c+<~%Sk14ARsMj(v(OMRLyZjv^=xtC`C-#@L( z;Y=y<-mtz zPEf$Axr2|R^Uqtnr_8yjzCmJeKip{alEDn@!%E{wy-hdV@BE}rOm?3DBEO;N_ktLC z%3W$rI4t&iUz^uV9uOfY!t+vt3P;99?YJG6*x5Xc1E4r^^c~T4hdB3@PQP^2MU0~) zM2|bpnsN{$544v5=FRGblT{^?#mOWnwSu3viC0N5cr)3b?Vb0%s@FPNMEZ?0SKKV4 zfWRyfuHCY%QcPwi9)C^5zKq3x&XLBV`+kYlyo^mCsB%A~1koybGCB ze2Zf(cVi7zwazbR{?W=JJntqJEgih@(Do2#Kgfo8l;<_4Hm*`0;R+ChRs!F2=>Fp0 zg2Ll4)yL}~mg;grWTd%~$yvWy?Qp~)Ii@^u^rCv2J)Ks#w%2%V;ksJugYG-AA4Iv0 zLaaBJ+e-Pai&PdYj4!vn??(;-V!ZsV7yI1oQLa$gHnkrGDayo)YUd9iAkx*ug}Yxg zckwc+-%D*#-m??PdwP9(-V<(DacAa>uG$4Bt7$Jabn5cO&yRCFmcV{e^T^!pP$E|m ze8)VG=}KlbhNshxPgAb_c~m;ca|%>kUu)|W*!2rfq2pQ;PsSlPDT}jPi8wEk92_Lbm|2H!AB7d*h05}4b#u_*V{5UV~)YX(+7^MO!4o%L_rOC zkI`%gcWB^F*oP1Hc80FWH#bWS^$adS={pdgIZ}Fz;u~ef=(|k{V;NI6i&FF@dyKaO zs|krGi1(?Nc=-6;V6KW6;L!r>O%=qH)#NC=r&@LQ!&!lKm-KSFgydam#yinDd+m_l zxy;zlLqd$ZZan5XQj_S*za%~xYI$aK$g6%V}>Eu!^Hd3mt) zbx~TkLUHpUj4KG;Rs$T%X%m5Y(Irp-j^&Y|em-h2FL{DxBx|UIA+Xv&y+_{Kn=F3{ z;|9;jv`jo>Pz5LA)}YpC&tlEKvGeR_34%a&TX|vG%CXrNf_-6`JXs%U6fvpo8kzkd z#%tT|401$cgbOVt5P|Oo{USTJZ3H6MUV1SJA#Aj`!tM7b^A{zV|<=>ld&O6jxahK^~2@|W2 zS?g;mEi~W5iOUC@uD%EBj}>KhxUagX6?UjHlVSAd3OHt{eW!p@6n|Q!3bvsLjj1_m+t} z7Qgp%SyL9J{}k;h88I4e1fKdo(`z4dVm6L|{F*CXAUtfUHiieltU6+JI=4j(u$Ia5 zH(~D@efb0_BkdWrTpje{Yt=)9&GyM>7O1K;GkiCy?~8ESR%SR0F0d|NX0b_-_`Wy2 zC`-NV{M+OiVcy7gFfXh6cgPs-@Y-IbxkM85Lo+|9frK5PoXs|iBH zQkBu$`lcF)DBo~=?CB0F4;|N#(0DUN?4U03ch$(XV26(q!$34{==~@q{q*+Y7TFo$ zhJ>1+w3eRGoky9&L9$0hRn|0(F-G72H4Q-wA)G8~Y}oI}oBt*SmYh-mWv034N+*i4~*a9O)=_ESLoblw-J>JRslsRHeo>WQzFb zECk5mEvOip26KV+0^R6iJ#t2s>X}-O@l!4gq|IO(--)ECcz`2k-MxB9E`6v$AmJ>T zA9<&B#2Fj4mD{fWXLu4jL833-qs&2f{geEkZYMm?sEDw|SPEK}|Lhdh9K})_NNccU zkinKdz|&cfmcd4tgqhNWz?41|yL9Cy6?FAxP|?>Ja4(wl*Ouieo^rI*(mn`Aw@r z<{y|P-?0H~tKlEMgjF8Z+#a>HsqO&c>r&@9yUR&iR>^nF>`nZ&(bga|YCJZT`R2rf zzeY^{df=|J64g=%#6K)aI??bqTo+3j!`5oplsP;XjIjbS30JVu?p?Qw--ib;SgMx& zsJ&M!mq1)`OpsJ1C>LgJqTeM(?#{@D5Wx^o2rafKWP4*wG_Y-7QBMM{0&P;Ces*!; z&*hc&;t=ut+D)n_dkr?r;c?-38MOOG&WxqRcU?X~kgBoNIUl0YesX5C(~gPG)}>Le zT5WIJ8o!Ac%x3!Mpts&Eu8DrqPD7rb6^>rd2>dPEcBjT?82P3cRWok& zDyt>L88#9GFf{+qY7!`0=oL01krZN&H@Oqj4r61}hVTY|l6G_Py|A$cQ6Oxn+;zG* zbBjstV(yy^z`!`9R6ubClxL~=B~NcpO4C}jb2e*$M@c5#XqF?ZLux=a5%l-X?Ye-M z^CM!L{$m!V>{4r8R^#b96;ud@!t`9(!yi}=j5kOE(5HUXcQ|($pzuZTNdkELP$4j< zswNeJl6^P4`AxV z1nn?3|A$w9u0)v{_YgKR1vo92D~w17sf;kUqrLKS2FDfw{3 zUEBtu1U;3nnl#&Myp|nQgcc0bU43(r{G)g%0|&r+)u;W z(O1J2J$v5-8hd8D7CKXzFekmwa3(w2Z5>mZvv-_aHDjo$N#+`VT0A3h3xRio%tmr} z1_S?Kvi!-VCe%CZN<&0++Sg>vG@+x#n4*YBa)%#>a}$-7e*_^4Y5fM0{_PJ_eG&Ml1cW%1 z*njMtEt1aywc>qvu>NWww?6cIw_@CWb{6rch?XjTIh?S%vkL)CK6=SV4#hs`fB47d zCQTi^+FPncBhKQL_W%AUQ`j~glAvr;efpkKjrX)VM8?!Zu-{1Dlm@@XWr&IE$oDyy z9Vb(6uhIyFL=LB?Un&I^N~NVq(Br9)JRMbmUuzW;Q&QL|E#-IeK`6{Rcl*g&eGCe0 zSZFxsPQG8DkY|DA!PP25a7uPe#SU$rYR;u85_mMae4ABl`AjDxJbu;iP>UlkSBJr; zI-7;%#=nTM(-lNchO&#YcjCR1CJVy6n6L6g*YviXAaNZMZ7zmQTp6A2_HozgDQ<|C9gFQ;TO|`|%AIQm|n*9YGwsiV~|Y-4>%;D1z3f z@loE{BEshvwu7HooQJqJ$HgCr-HU#syRc-};S_SRh7?s{Z{h$8$AM(c@n`qYL)PoT{_a+Haf82Dq|9Ut z9{t2dJx!E3AS7laqJKD6)+%fK+Dz>5c(c(|mrUfbhKy}ps_Xc{x2R56L*NWuG#9~u z63HUP%7VEBRg}pBR};e$!Mvg9gpt(3^3<_2xb$g8!DnMsy%0mPa4UL#vT_`L6;CBy zMBE>e6hO_el*t#Rx;kq0J>hK=P30{(4aG%&vd)gG6Cs(~-Rb_qZ?>h5y|f^RW68HY zEz-U9)7>SKx~BQ;{j!zGgY-T?oiP@_5R9KDdLDi<_$QJ@=)jjcO{{BnZ^-zVY!SUX z)t0E}F?zxHD|cqQ_a�`L%-%N$>fYI-q}V=Rc`9#hS-avV&AwSyVP`7G+Q1{$igc z`4A|W&kH~5yS3Ut&h)t&GKI%jChL(|F>+O0irN~QIcAtV2P0yqkNh272P36K`jACY zK`PF3UEpq_s8o|~5}Sr|OqCFSJ@DNu&(yt-f$(5Sq*Xd)Z+_dqTed5$c;Y5p2-!!Q zs)ooZRvjAiHa+<}dqxnf*Zv3**HWIw4!ZM@ClwdU+%D^cHX_tF>R&sv=&#oM{c~c! zAIK{7KFa#Rh2bco3k$%Lt2eG(Pnj3${v4WKZlUakhbPU~)H!z%m~c%Vs@ewy3Ri?? z$g=XoOksReLe!eyDT8T;W0(KY{XJSR$5!J}(pm2BSbTKACPaQ*ahfDQNM*%>unn?e z5yGGIU&B`-x=UZ{Ou9lVwRRZ`tb3JCA5&pI67`NWQnk=+beUpUW+ZQgP87BlL2m=zRNZz^DcDOt7j>=- zqkhFR`D~cAvtZH8W(g_w68ud>*sC_{yes5{FGhTj7YjZ7ihZBDm|LMmc*aQMr24&# zC(mw472jc)5R5(M_J`I{HIs}$%Jgd!t?*8DH8j0^s(DFu=@A}1@~oMI@bqk`sWmgF zyQO9AlitxQ6s&qY;pvf-0|{(^9R=0-cIs7~OtJrfI_@rUg-Wt8MgxpGa|b-3AG&O< zIBxobdY}z?Jwdg22g`3yfm8FoF;hQISr&_>ed=0t(5tS;uhiva=n3C zsqCXkmWKSe^^N`qg?1h2Cd4tH>j(s4cOLXw)>Lo0BdjY_dwc6g`}&dJe{MaYuH)EW zmyaZ!hp#x`OH*YEfOas|P8!t9?P^PwJGE(>M6#k?jmMPq(hJTHJ~kd?Dc=&sW@nNP z5Vb#Gx+6-zA|qe^6%qc@OqZbF8cx9dXK(9F`CLkhg6PF}0wxkaF)DGAJ=ad>v+Kq; z3uDk34y7lmB^6ljH4$P;EKy8r3oMa7HU#)YAW~gnUv@>0G1;8`YK76hcN!TffAflx zDLu|TxQzu;#VX+i-Tatonr**a`7r z?+o!8>0u0-Cdm{AS-Dph%oD6RYBc^A@hP5PkK1WFn{)y|1@UL^La3B)wE{g&;4twI zMGyd#<>?62G>IZlMNjK2&E~4P2)N%YVESwOWlT_Mb5hvLj`~>Ayk`~}siX33EXG|- z;B552Sw;BsE>}X6P6W&~UR!}~r(Uo^k!P_Fi>z6H*Tp6wsx%L-AVc)@YhO1++h-2T z%B_;7da@XQT{3OHUzD$@08Emi%Z~@@N^Rx|f*cC*t9Zb?gBY|^Ll;c(h0^y2{`?xVTv=APyg%P zCw>vXc8bWCDL}^@(mGOd+UnYkKQz$GF3qY_P^Dz{k`s#jdx!^!v|gjSwO`|3xyT^v z0(J5o6c?@Cwy)LD5bm>~yCbtrPI}hz&NiqLVh928wOs?|UjnWeJCl3KOqv zK1bDU-;mClxuA-28UIjoQlj43#r9Ql*Y@Q8=6-?Ud8&NX2FVbXB;3GU{b|~#wdLlF zJbljVN$Pk?@|&BD(;l9;%tqM@vtwe(X~5PAqnxL#c6Fxrxl~MwX&!VVka5X<6IoC- zm?Xp_Pw6+^Pd57V z6a!3@XS^-r_t?zghOqLu3piOZzO0L&MGTf_JZH@OFNRIxKqFA5v;`Dj3)<$VaZ z4C85W_y+CWjKAyzB&4uYk?L)rs;EeqCv~LKZwnv06_B7-P}8>-QNR;eTb77C#zfCX z0t{n6)72Wfb>061L*1N>ze zgK4zFXvS{VhH*?NrgflKTgurF;k<;0BdaCuEV&(Rs|!!7OooXCP9p3b*<#z6JR zAXM9o_8V7k6~)Xu$s$+oOy#<(+%f*vGI%z0=;#(2LG7FP$Et`aH|m$g`yhH-fe z1GGbJ?kB~8ZUOIAe=cCrp_If7{N-tD3kiwb z-ol;PSr^*$qlYESmV{>d;?`m8Wh<9=@UxhzM`e|4MEm!_E=7nRG>m#>mbS$13$pFY z?-!8R(a5C7;r8#H+%Wue0k3g;(Fz1wXnc5=tP4GxThFN?pkNg-Gwms&#FT$yW{^|Q z>wuZRpx8kdLJ(J5aMe~e?28-=<~6nf+Y6GA9ps?TTs!E*2kZ5_6Vv`BuYDJo5kFP#&Qs|OD|#m_8ajNbIxnam zD6icPo}~wnUC;Up;+udUfsrlLtQNBBgh9WpYMwS4xtf$R=_Y13Gd8Pp=IaMFC0o#& zg3SA?DuP|4w2FPV;eHXtzgO%2;rj!LJrxk3>WG?s-OlSt;>bY`|3_-eEJJ1IvhV9N z77y4D+W^1n!Nlb$GuK5sr#jYx`pcE7G7tP#K#C>qDs#hg^kY31M~btIfzI#ZnuyL= zb|K|>DXcZd6y@OeWPEjWZXC>~kr%AA^X?^LEnrD41QB5|dbf&yt||37h-QJyY6vKv z_s3kss|ejHi!SqcY?jqoc2O{0w z29utvH8>fQK|Ubt?;bGid%=jeDX>@O@kl3(8Y`dPGj@14B(Fdr+k&r;ue@MYO=R1f zvReP;r_S#62D{4;RiF3DRa~{Vb;F_WzVKA?%%xGj?m>QH!u%BRsaAk`iL-VJ7zGBV zU4nnmo87>f|7$_Gb5y{RcmU$_P^l?yTm7>_;QIaMU0e4{rRjFhtSo=+)~zQNE^oLd z@oEvQ)@uzZn|@j*8AO+Q4e(lFP35%HPuAa}U5R=xyuBwK;PtV>bklk0GV;b{sN1Ly zyNrW)xnj?x}QtmFB* ztqhLC*StpN&4EM%+@9Y7D%dlUh4kPf+s0LOjhh6MyHNpcvUht`4LK547R+ugl}?Pb zdIIMY7R-b?yXx{UOGL$%bIfMt_+-kLyQ?FJKN-L}nPs@WS%MiN0+ohMx1LE*^je3Q zqF0`Gx;(_@Q>sc4nnWOGo_jWbwY5FDx9gr-pU>EGHHCT+_pjnH%t*O2nr?%4kuJd0 zP1o4*p7TBmpOVwNi30{|WMB=}qz_)!EW9)S!JMJc?lQ#36oL76$_VXGa>io*8NM1k z@$~d6!Pp(W{Yr2YtGe_=fr2qYNo*&?g`6H-zR4>1w5aw71mO5t2z&P_yINz*(4JP{ z#z)kk-MCHMpt%K>4bC{A`3;+`x-D?*CSK_$rdVHZw@@(2dZcr z3k9vEI9&2CS3m6x=1KdlrXi~Wgie;5urAi}utOVY5SVqZBInjR7WdWnc3m=6MWQLO zGW8wAw@OBB(=Y3ftPuY^xUE9PHyOJfekt2;g&V=9RWXs#_AN7b0NRKuB-z?Gej|)OAjk!YLk4#PTi|@wE0#-If_|GjLF6x6;K}&Rgtt&P z{uo*2r~zCk!uz29jRDgWMH6_{4crkpi-cxLX3_#~NYs%DvvLf3$l1L1zp8?{4ylph zSLcz*yIVJt`3r7U8O7EFi;bM8R0banuYXI3(^8XPRQoLd?L zf9Q3i%RfN2undIT&|67pXjL@k;45Y{ZaDabuzg(Y43|$6BE)#7B>o`F$|=p!)pgm} zXsL)W^k>yQ^fBZ)KlmX6=L{V|BBge(o0dOU)IF0bz#^7^UgL9Q&H6$#;Bg+M3@*k; z=*jdQXFglnr-`(4V3F>Sb|wrwm_d zWprIFJ9NrRZlo`4u$bFhPyA*sH(LyA`^T|vN95DkX=nV+S+Os9z~k(qh=-o`S&~58 ztzwrcksvR-RMOFzWm13IoAz1A-S|BcYE>%uTLAJs$Zt*_`#>+pv}*ALp`gAY4{0+N zM@Z64@DgQXXe1m_D2zP&j_bWa1?L{PXjX8#_HdIDMvljF4}VWE+nJ6Y#n{63b-)h& z#I2@C`&gJ`FSqj38*Pn+2<4eH3_ujxH`SslTJsP)89fxx~@coveiAApZmMR9DQ}O zomq*#p54|sO0~@V4%G+3J+q=yr~gx zL^BUWP+lah`tIG5&l>h%P+_YE#Zs|YT>P-N=0`^Y%HwMo>(YHqa|rlHM9>5{P7JA0 z=s}JVO05YEVx9v<*Ldk=4EbFWAsg&j(CSH|AFm}-;ux0_I` z#zxIbNV(t+4)2{^d)rP`m18xsxktps zQ!ntXdad|gGi2A`f7|oW?b=v9Dh(j$F)uOD$CV}OzAwG zYWthm4^25b+-Sy-za9U{6h?YE@9|T)>)VcFAI4k8hN-|0bR6(5--gec>zw$;%jM@m zE)>xivGM>sUYMX@aG&iWK4|%1U~8Yxk!pgWPEue|tO?6l{iz6o#$DUGytYhKr@ppe zEyUy@lS0EGE}4AMMGOdz@IyyNO>EAlBd=} zaaX&f>(kPnNZBxQ8eL^lP#Vc=-_HWl+o%n4BG~otHyrJ;R@)tND*&N1Q!THiufwvO zoDAvD#j@mbYWKT!Wh(!^?|ujKX1)34sxq}N>VRK9Z+VYW5rsi?t*m!gZofmRw`y>m ziPVmd7dqTURmLgisY6uED{C>ib4=^`bVU2se-CMdU}as zK}pBEM~`s#*G_9mZDh3*uEWo^G^+uJOj?a>S_0ady>x_2X~X8v&tZ>)d6V3RyGxx( z_4TW`a@LzKw*)McnBtbH&L7n!^ySv%b>d+@rrs}OWRIkib~kpTZXCTPCrhfrKu`eE z>!>v}oxu?B8c20y%Um)UJmTOc)06*wJRyNhwh{fH$QG)Vo}5v{Iz$ssUoi{ zi&)VeBnq3<=Tz)1WyYP0#Sxx<*f_V{#j@~vJM3{kuL9sj%V*eO&D>xUh5 zem<=F?78Es7Hd=8{HrZ@gHg#=J4uu4{mfkL0lmYiB*4(HH1UHpFa=i6fK~7Zu9jPr z9NA@7V}09BXq>Updw{{-@|i=_d{5q%};>mI1RV@A;O5M7?{ohxS% zc;+9_%&_{mCa7c9r=dZ#?myjk-GT}{{MHZMssoq)msi>cF6zc39T9A^i!P0o(ZEsX zzcH^Y`34Qk`zu=$&&N%b=5xOyt0VVKq_D|&bS>=d@4}b7PyULv1xDJ}t!Wc) z>ZZTr3Y{G-c6EIi`1^6a8>mGJ4>2d2OgF`ZMvs?q$W!>h|2%q=>PUGhK&We>~sm3gAml}fXC%iBe@5VTy>YD#8!GVg4~-ER?8GLtV(MpjU~)P?Y9S@%%}K9GuKJ6$ z6r^Q0EL}bD)hikNT-RSvVB$GKtOG;!liLKLkZM#_e+n%&2ja z6gB4Lca_gXZ0$B+s)TF0UvL;6f`bBf#@`p1{tV?nq~ z{MP7FRN;hzBNL5(B`v>X7N@57J2-V5lZMC{4-H+MOO9`|KZ`JS1?irfiV+!P4&S%) z$DtObBYr`~zfKZyZ@j73%jtxV#8^$ zz^;VTV-@IABdbz3U;roo#-_52QONIkT_{dL^V?gFfReI!1{EKP*JweH))%` zvoZ%1`JB%~mpQ9)#tYj`lv)RVPTwcQ+Bi4=HOuBRei;qZapt5-K63gZ238o^Jx%|(9M-ak{H>ZXb-x|H6+~OMS`YK{ zDM*;@ooVJK|5Ly+Njm#o4$!AjwRyFrW2COohw6q$(x?=X3~`<%J1gIfW(~EI*scyl z$0JVA{>zCIRFY%it9j02<5~1NdoW)PqiN~3$e)ggwJO>0@N-&VIkt@s$Na3@jwsq6 ziY$+Jbt`&Hyr7yvK2vi&GKOiI=76ZLP$OgH32BI1X82t3yfHGa+KjR_3M_z4(vzD; z%0}$gFv#p?o(m$mU*|X{?bLIv`DU(@EZ2mZC1*Og$pfQDvr&m}8lT1bwfD-Gj|**a z^zAR1*4Ay&ER`k?a57W(^n2t_j!i`}BQ4|dWv##DbivyH&Vp{o2S8RI`V?GqaF zX=YM~Z)^cIMYX{+rf+23iLEG=MjHbttTVJB3=H3*hHs#eTY423kGG1Av2^=dvN{ve%DYqA*iaGJFm@*mX8%<$+L z^coEGHgDXOaF0VhjRfo%4au24lHh!-)diZ(8iSgV-}$d7PxWp%)D-kGVU{rn8T=E6 z{#8cC4mY$Pt44QMZClJ!5Y-I)Q}Q)6@5bG@9YLL`i)DS&TA0Oqi$t|j)j}}$2nUUZB)b|H`O1A)QDs<1jWx>kz#77vvg|ANa+*)xcC7VErebR zhE&qn6xi3sfTlqbEEMLxFJ*uW8K8Nb zT6~u_fC4$8p3#Vz`yQmTU&P$ug?eJ8^kYnN|mwz)vU{ja+ zYJX(B2(rb)==vyih-r2wD}E$C1ax9fG&uXr`TCOC;~A~}p6d6eJ<_D|(4^hThU}dA5;V>LVB=L`i}+>0PXwNh{L{7Y%F#K<>}(12D>=u`*TYQnt)wj+?WW*;Umx#jwBAdp(sXVR!OjH6n@UZ! z(J#~eF1WfL8)vRPCh*&V%5E%taqbp(u$?m3IUbcr){;~HHZX!sSTY>&(2W+{72?5^ z6s+f`A&d9)-54r`FZP*V*ja+YsmhG4-Q10OuASyQQW-YCGJ$-1XM-0SVftfO!&@|v zQllCr%I%o<%r-{I(P@S(x+~M2oYa>vH$tiuWze)xrBD-}OT8m&ODqUjAUc zMM!EN~D%_Eu@l*G>u2kL$8wZHzkj0eQ*GCFno09yn=S8ZU2=x22GVa5YWu%&6 zQ*6*}oKrm&In_@qSbO}_WcjEkO!p(TYVmDfPt==5^TR9k?)VRhEQXSDgs(m!t*{^M z(Rz6|JL+H8I~~;2>&~f2`h9`5hPN4H+99Y3TQgc2NTn-La_0KK5VVa72xc^oRUkzi z*xUW}fIU7s@=JrAk?!q-&I0_&XBp?fuK{LKK3OKV_Kx;|EO<-5z3HH)iz2n_*YMGA z5}i|`3{iSmnGiaS_)t+_JT2Swgr~?CfT+3ZH;i9~rnr6S@?m(AFrU5P1tJ z>+S-H4nhwE9d~`>%K0`Al)FK?r1->5BPb#OEKHKTOa>!5n6ioVc-qcKDQ1iK(-T6o z7c@-g-4}~bzy}8Kh$5JYmD@Eq>>=O8N*1$05sBKg|27{qb25-zC6p~!`Ko8ocGs^a zolyjIwS>z5=zf=0YpA#W74C;!jE6hi(Ll+4RClW2DG5F zyJQZp*I}b%bRPQtk{L-K>hEH%Vg#%f7{85h<+-eS+<`g?q$4H;(lc0+iJyPfq_$(z z4Y+RFjj~314d0gp?>j2F2|NwX;WrqFy|fmLIC8->#Yc_R*1nnyH{i{OkV4dPKsAaC zJ(6j0gxaR=KNvg+Xdxuw)3)93fdCwk`P4-2yPp^4RmObf(2bSVt6!6>!qb4qt$a!v>z{mdog3*tn zdJ`KM8PER)qpDkw>#Yd%!-5LT9I{vI&kdaPuMtc5`l44FrjMgtQ@V#H~F1%IMkAfGaY=Kp|d+dirGA_5hd zmL?WV<)vzfad-SIL+C?37~ie}Pc4Xmf~pp3c=k%^z5p}3LE*x+?ikGctHZS1f*Ta8 z^oHstKlb#O%;Lg=U}5`0AjylGNquxz8rvGOR@;Hj_ty)xEs6Am6X*{3V3J(4K`hKPc5rbWkeKM~ zB}+Tlp829(v3`h2X{<~6EarHrZ=b&zeVHb1uDrp#q!&oJ@?WLXQ2Hb*N1TrqX}6A> zr^B;kZ9jUmro(8)CKswr5o&!EKzu1W{&w`9Pel-C();LxU$(a!K*){@)8~f%T0ojm|d#EIqP~SR#*Z5rrTHI>B%GiN}4#BHqw<~9BfdmJ+ z@wM$$3df?SJ=|5bC1QnaPNB;Yv)F5L5lOY`v0uMqx+58?#$CSQLeI6sN=)G|apl8D zF1toI`7;w|A0M zR?wl;EkE?51n%F~ogG-cE;JB>p;oruvOAe?7s{4p51@=B%zLMN4b7E3iwx84P?UUYRg^_q>B-YJP)z zU;9>gXXtiq{rz%Huvz`7*>~4UFq4_yW{sy@KO)MqlxFzsVCvLzg%kDo9YfF)pN}|` zc+!p5%fdXtkdf3V?^zc(ponJ5CNm$lHE})UGG2vWL>((oOB@->d%F z$@{h9*K2ps|4#X(e5*HXoaJqD{d@l#N#v*pRDJ$%y5L^G4I$;b&8hrjCI|G&Z$2n0 zxXmftXHx`O0Yx<-g(nOy{fg?GY6^J_7XGb8LCE2eH1cpqj_un-WaqC*Og z#8vyq2&3D9KX?_k=F_)5WnMHO@W0=^u57>CU6Y3{r6FX5zXH+e2sJhBWtLajcsyTg z|C6?HF|<6+-V&yuuCr3effE>b2GlwQBBy)9Q;brjL8*K=4XhV+Yp-ip6b*T2qrp4gq0{37hC8WokwFn)Y_N^+Y60jig}n*o9* z&e&*JsJGAZ;w8u)CiTic)prK{zUt$Q)9qtx36unjaqUzJ;$VH^>e<@DnZ2d-LyJrv zu%xiLWuBX*N-1X6=o!`r6<{awb8&;3Z8Q@B#hP zMPe^MGQ$(V7y43be~oioYxwm1=t0;Gdhj;dMc2Dbk2EQlHW~fxXzYKvP5CuTk`M%O zAmzQ!amD-r0j_b4YenD@=1inT;s0vlO}38*1tkl*k?noJ(S0V2wcg67ZkzcYuprUD zxcg^-(@z?}BvMa|ZBU2=6T!)5okIeN8$#1pU+KQ1IVXx=H3WXXmcR!8(I`-q(xNGw3A3p7DUbm(9IC$&WIH zz7!rvh!{(wn@@s9U8$>(p^_R>ziLFVQYJ3s%b=8t9`rhRQO?z-@Eup_JBk4RKIh)1 zBGAAQjoAZl#p2N%&~|hu1ABAMT7e4@WOx5xcM`COmw)VtqaJ{cB64Yo%g`_gv$vXu zwYM7AP=Ei8S&=lHt)zQ8G{~p+015jl6-RvTN^DzN4@f73fy-PRZof4og$N*~aYHzW z;V3jdaLO{$kR#dEc`6RO9|Q6au;>&-EpwFZ8z>vJciWP*GRSWH9U|E0{9zq-%FK#P zLdeftjrPiJJo-PXC_!`zG=&0Zcv@pP?oKj6-d%U?TR4h*Our^Qtkqjx?XuDz?&;Tym|fSt6#d9Dp$Gy{j5TdXngsYxf?<*!-d%N;yEm(*h#0rQmSg-CcP65h1Z7ziV9T zZ>JN*<;fh8e}n2=rGv)(Ape1_2o~i(Em8B~0|0UEOX-@km#;|Ux8-sFmR?RS|F zrNgoVK`t_@5X&OcSI1_)5O41A`bFHT!^5$uTd!mC>Z1BGl|!QNXo!X~LRy5qR&WYv zV~y+N89pXSir@umC=rP?XK~+;OkkLvKn^FBfpf6A4pQ?fak`L{B&LCHxRz8JkLcz6 zJ7^Z|0W_@r_CrAU*DtR~{GgBSkU0RLpL(@krO&bv&h<(K;L<8Z#%^-GjCOgXXXdmQ z%7T%I&@nP7bHw`7GLZs9meH@u{Z_TbOEdxPATh0u!ePnTQuh0CJ-iWcFZ9!VOnG0uY+IV#xr_=XW?qDPYgzh4o* zvqD2cto#Rjr?qA!!{I>DB1yc+tK3Nntl-A!{gm8FuzqkrX8#!No6kwd6?@*~672!XwdPHLf=IU;W?*J4w!;n3GDhkL%xfaS ziyOq?q>(*1V%Ck54BFl$@o72jd{)t{8`z(sgN>poDHj?XdoNg{$Oa#`vM5m^y zP36CM8FhOYeHY}-9U(N5;CC)@QgBocYe;cHjU%Bd3Ul1|KPH8Aam%OWA@#j;4i2tx zH4iHwd)B76i)=hv@JN2TK^T#C83(t99?GP{(Jns-Dcj_7B#T1_W@hyXc?j$4%haID zY8(zZqlVfwa&g8^47bp?)N^KJM?M+wu}|(>p^g6mC6tMpR0IXk>hy3?#$In0C{itB z!X_@U`pjxfRemv}2q0W4B3urFPKiP7Jc_A!%0#k%L~uL}npVBcnkO;g6VxTE z*BXE!mz3Pcb4b=GF*#AQaf7Z)Lzt%+NcPYw@cdH&i2+|ADhf1Iub0aLB?yB?MP))r z5-NGw*h24X+(Hs)FOW%&Ai+ekP}hPQy$N?q=7qmIHdWjTN%#kcLKMOID{#VB?xc8F z_pIn3$k7rbV79?pPKHTENVt;X*`LFc!QbprBAo9La!resnb{6xBnqq+KhFLtlti>5 zH1!oIcX7wjwa^_Pil9>QZ-)F6$RMbTTQ4nm@j)>pAfwh1F`ZjwbjH~d=EEHhTmNeU z0#{Xnh}sRI?AFMd+~487SFuQmEv|;pL5w_OB1MkriG_t(+wy7rCnQvCgCQ@($P_Rc zxFciY{@@{H|H(8Fv|%?EpwupaX=nlk00+@5^^vBMoL^4_&U615lkCWc9$<+|k5un0rcoib% zHm&c&il~wkG!pqk?;&*gnvJHQr|t#RZn10ub2=?Ch3IkGvRl;*WWoKE7wD9I60nz|q4kJ8k6JA{zh_1y=IRH?zNZv;VfC)-kSBZO|(@UQ7}edyq@iEAaq|WYJ;I zkHsi-JQ+p(BMTa9q8o$+VlE*XQkv%oYjq1xVxHXhkK=9Hp@=ahRREkb=cjW5j&-KK z2L&a=9Jp^#gBk~W`-~2!x*||AZJqhn&ERWyDDzouerI?oLlZ~GjxTosy)4ABYnlZopGWSi6IuZ37BHSX?{TM|L8eX)trB!x@{ zntr}(iKZ&;BrRx!>b z5wSF*NS1tLf($zx59`nDktapuRGzSC_SEK$MYcv`O|wL2vc&F8 z3QMr7L3>{xL^t88er#K?<^Ky{OsD?E zH8VT_d-@Pdvi)XwvdTy~b?7V!RJ2aB2~)9QNqN7TaB$ zsN}MlH8DJk^u1<4*90{Sz=Z@{RUX_`e~=24PbC(t1Lew1ph_@)Nb>NiufOGBSY!O1 z^S!z5!;Y-4f(y7`RZXDW4GW>4{+$oK3{*T*uSyvtAm>~VQAcDch+mEbh*ru6AU!J= z76&AvMWV$D5_upow;{kJ^F)}#@L@1pM03keuydRIVjMI~3cGDw9B>n&EqA{Sqm-!* zg_gwLNl>Mx((J-rMo3XH(*>%byU?c#+C5ty9fMzy;X2O4I1_Njk187wO?NE4qrrMu@1&Ii4euy$4!=&%cjrOdFZB$+dgSPB@r+5IMqN!pj6oQ#O!ZMDlvZP&xxJpm{1&fRFBP)WAbk6+ zU~`F4!(MSXfJ?SQx5Q!}Afr`lq z@_7$(4Ql?NXmje_v++-I0VS*uK@^i2>~gRjR*Zb;C%hWfoNF5xz~E#ENQpe|8!VVF^cWNrwIo$&Szwm_t=rv*q3cGd0d&_zslIvxcwG2d)bl_y0r3AQ%?hI$i5&X#!icpwDIyS94)WgRfZ?(aw*W(Xwm1qyAi3E-! z@M%SGvNCAy2TG~-|9$*FE_X6Iz*GOvIOX~L`yJr_IPMStk^OVrVVG3Ecm(US{_C8p zex3X`bwcV%jr*SWXgDUCOC*ksrEv0vD=w=KzxLpKJ!4e(ocB^jR*sa$6LvV9P)Ov4 zpd}%i3w$^s#74zMD#_`=7S8>ENQ?__Oziw)-ti=Uo>RFMz@kU;tD|62qDW#d_XD!~ z|NR}r>8a8jpw@A@nHJ7{-qQ%y&&9}4&Q-I#THt~lA_Uqz`%O+c4BEv<~k`R&m2qHqc=>p^-qy!6BqJac6Iydr{+p;vP4N4Q%)e zFS&9G@u$`@?Dat?s39L^Ujw)sli^Y0$oPK>>1r)3TIodMBux6Z$H2~;#2Lcn%y_ok zh3K^+AH-TvlER;kS)igKgKo>#39DY?CLcgS>hzdzwGqglSGFd4U>5QMC!d5Bk0b;F zV#qlmi8vV8wCBF@eo8c?!2UtP5I`|2d8zp_OPEj|+nk4ce;gsHgOlKH#E64!O1$V3 zY8X-=IW=UPo_C%4jH>TeQ-^U4aGYHJrGNVr0X^^j?{5b@VJH}>pdXzXyXxWNIYExN zTYxhc$6xm_L|`YcL}w1g`J*`^&a-nx4V*T2F*`4%9@*f+is_h#fZ2&a7cp{!N$`Oo z^a(1ZFQcf)3}HxOoBvTjfLMbEYp)=Ad!mqpXGM<)!;baQuHv|Sbsl3{AWE29flMG5 zud>hmPw4|sdLXFGS%?x<_5hybyn{0dTnhu%3UuFpB}ER96sYrKIq%l?UBif%kwGvL zCOHJ$XqpHP3N72)WLzu#JNhepZ-~9JW3Pi#FUIZQLAr|$E65lJEttG20;VFxKFN(d zGA9SkI#~3#dZ<45IlCX{x3LdO+Y*$}g8`_xY%s$8lm=3K=D>{~jL z;z|1y=&bY>lagEJz%NB{q^*GY>t1lGL5lP`jE9{mZzBv_En2M8f_T>8tO!Bb;8dtkHmLmESf1`d_X22YbY52>E+aBGt4S6#Q80`Gz~C~*Iu;+ur-_hI{c6x?IrC}^rTs6v{Q%s?&Gs~2 ziq+B|XIUZFQDW(GE<0pZ?%4_Z!LCwp;UG}V82iJj&B+i+l5tCmGa9-TOA3uZ>ow$N zga0J2d{N4X1+87u2$u=~Ur6|kQo}qdvkzqQpcRo0DH*@ki%t~mXyO;8d|A-CC4F%# z{>Q144*#!H_n+|@R291*`Tt*SYS5K|HT^f$=`BJ3Yvoo7tQyc5QXMBcAB;uQyKnYK zIE_Cmf;7bsQFAw`GDJ7?6kO+mr*EeH+na&ci3RS0{S)VGa5$nIzgEPZMZ~eNGPMX= z>5~HIFCoE}Jm)Vxp`LG!R_U)cntmsKo-MSHxOe&zKyF%QXVGWI?|Sxg29)vp{rmYF zVN4+GWT5nxsOyIQM(I!>4!Ph1v0$VeFzEwrWG~P1ugs^&eg*JX_$QiqLR zRGJV_bU0w-im1F)Y!W{Sp2}lAcNut?pdc0KJsC8`5!^x$Q|s;`aLpN`DpQPcI;2=m z23MhxR!M7LW9*8#&49o9FHMn9jp+5D1E@n7k|7(o5t$@i>-rpS6~`Dxn7snluU3%U zlN|T6#PkIoERQtPJou+y^dL?(rpoAy;3yd57&X&78NmWyQZ#WxR^-6z6|ZB>7O5x9 zf~vZNPqFGQoRzJutq$xnCBPw)6OBctH6soBzp17XDwlB0)fk>cKUkI-8B?^?G@U79 zFggI&mmt8@P%?RjfB^YNCZcAyVLoYAfg%44xeLO%0!3aL?F0pPi^g_VY)m|$&DWkv zWXo`SDOc5{ZWY`IqQt{&!ggL_QjwI+e7H1d;Fb=-q1Lta|G3|v0%CM%S}r0aE(BR*3*Y&ATIVb95`Pv^>&T&P;KL|}D{ zf$zZRpX23SF$b0*v-orA`0>2f>vs|3wKS40uwxE9KE%FcNet8n#{eT_Rlvyz2h`hV z+s`sb852dfy$`l>(~-(vhszoszXDyMiV+980O3aqQY(j~2cLU!AYGxl~` zD?W~^Sw|-X#c+|{4&99~uri$8#6wU;WL#;_MG*<_xUz8)78Lzxh%Z*nm9Xk^)dVC~>4 z@LFNnwoszik$f!I&fWBSCo9-`f$6wtf3T!pgJ9rh8q2Mgha0ktEAIs!u-AKL$)-+# zoKqW!@jZHE$)cB&;he37oG=I_!de}$Z9JxcXeWigjM{c*qSG=VbAG++#(iHxectHL z-6m*}7Nf*tg3o*AHypASSONy$qK1F-Dpq4aN}=LxSoMgaQf5|#NGqRIf7I_boCVFQ zpl+bEV=?FBPN~;uy7By|#I@0y!;bU@*Dlr^q{@A~$=%jzn|0BYUn|BzWO5O1ie25C zR=kxudK7Y^#O4M%I< zQrLh9{3+k}MvXm~yJ6yV!8KbgZ=xI0Co(VOQdv0tXl_yXpyWivWR zd8x}`vWg@q#2SI*6g&Nm?mMwN8`S3QONJ=V5NHdQ*%tlX10^(+(5Boqgt{aW*$ z@jD*Mbv5Rc62~2>!Gx7)@7Td;sm>Q_(lFRq8)LRTl}irYUyb^A0*pg*4s*Z%daVDl z#a(uEf`U?A{LyihIp)X(WT#c0t>PZc!x~CmnlM~9S)#~(ugL~QQ39GckXl1-enOX0 zI5U~Mt|VlI0*+ApW9gZ3s<1x&kw71pd_Hg|?`6V|Dv@_CEYEA{upEbpshExv9;@=7 zy3`}}U0MOpDyuxLJIX(FwDFHm9p_#DEgc=X1%vuG6_rPP4k7(MIN(uxdx&YtGDVuv zbF@*OJu6x)8l%OdCC;~XP6EA!rRT6Fdx;+COf(qdDa=xWEy@w1^k^G~`iA-VVRq8O ztV6jPfuBmTh=x|^zsR-pX2 z4#Ax3AN{P1pm&V*-5PtyRvVKhDJJQAN?V0~xx9(M2Kd59_FPnIP35TW78x>hW_8vO z(58_%lR#&!L-2%!=h7WM8(CfAD0NKY9A_2!Y$Qtq6zxZ_84%j2g`q-OXTu(lf4isF z8I3BZwr8QF5QMevO~Ze!X#;alMK_YawLtm3iR&S%rhcGNW;bRF0-4|beRUxAK*ONz z2y*#aB$Js72b~E5QvH*{iJTc}mUDJ%pNn=eD(&m+asWFb_gzn)o0o`Bdc(8t{wdR1 z^w$M&N-5^d(z^_!5*ai*#J*yJ|y1=Z1T+LFr7+jP@MTI*UXVN;- zvP-m@(|OvY!tN75wHxUJru6hgZkB^0Zi2KUxL_!#oTYgC)%+UEJE)UF_qvtF66tI< z&sjt5tJX$s(2bondcbNkw@Q=wiJ$A+cs=CmH_h*Y3<+sXLvV3+epGb1((|$NR44_5 zTu)Z*$Cq6Ky#D++?9-9pk>r0WFgr~!^DADjzBfRet?=_#$!3s}Q(uKflVyW!nFeKH zq2Y@8W(!#sm{NQ9z|mw;;*o5DwwyWwr1nx2Ul42=R8vr!4_+3JYy%&TwxR;B@2~xL zEIc2AsUE#KP_|*=M79V*jr&W7*!C7ZDwYfgDfIR1>P*)^3fQ&%9}s~(-o>?$)G}Y0 zm0qUlNGu$VI@-Sl(a6)8^a9MGg`<$vkz8gSJ3;MmS+<2n+b`cGaqSFq7!_C558xJ> zk*H8A1tSxL>;3d(wq!cO>CzZr3VI(I&@H59J%6b@{;sdM7purXOvKUHp!Pgj9W!~3 z_k2@(eWstr4go1Vs%*T3?{aw9HIk)X1h@G+U94O}SA^r{jbDX#^(0fKUa=HWIrcQ1 zkbutmCEHMj84>RA{z*F3)`@}k{!BT)rvOb(lhiCEo z6ldo6fZe6?W9|*5v23vN$HvP$ZEcm30fL?bTG~Ry*TlW3fsVu*o=k>>Ke=d>Ege3N z$e@JhQsKp|sN_GCrc=@7xGgfOIHdmb7JW+n++Ph&Z#7>di1EJPsQo9i8W&`2`8sm> zvb&)}#!v|8=J>q3!;*d5OK(;+t@)63HdFK^Fos4?ZhmTmTA`ce^RObdgN!VKL@(45 zojEM#0W4Dx+WWtn5|mte;!$a^8U&SPE%H0uisS+uARZ8FD&Z zV-YwAtxW}w!7vn@@~+#&``K;8*@m2PTWO+pl?x{~qF%u@+v)o_^uXmMuUlsou-!c2 zVfDtr!hGU3OEQm>N)hAp=Fy5rXRxL%NU5Q6x|1B@7fO}rkVI(>;KGOVj85oS z#p*^?v5ZNN5+ogmpUxN3{qV*^8boA`)6&j=Xqe4HkZ^=*$Z5hhYk5Q`QqtC{sp&H` z#^PrrtT3ib?pHN%n#dFMO@9`8E*o@MkL%xANjf?fE67>j3;pz&*9~|8B0~A`SI~6q zWCJfG0`(XZ4siET^PpZ~`O9&eZ4aUNUm^Fe7-R09HmbUr^3as3Q@(9XynGxbd5b8X zbc6ewtN{d_IdilbROv38(ULFXyot5 z+{Y5778vyvwzyK~*Wrg}Tbhxkgp5;)EEox0wUEEKWb4--FV68Tv2Qks3nVO~Z}j0-D+NDsV%?)J;hSG6D00ca1$2awZ9cql@ZAo~fDJA!;oac--V?l4Eq~ z$z8j^szd}%4%j}!2kq(^r!-tnRMT9iMr`~HJItqQkRvjbq(EekmDqz8e@`$hR=Ycc zEzypVrq^JD<6oVS2Kt?%TCQ9bw}N65k@|<()?3^NCrjA0z-}*BoeW9G3paoiqD|ab zyTSt0Db1>Sr!(D$@jR!e?T$M~zciS6DCJkdUb-oE%uLtIyo5E_OsE~-c!|d-RFzp@ zSZn$|wiBse^Qj4DvMtvWB)LA7ET?{SrLd!_$0I5$!+_hbfqK)4P$FPk{D&gGGpPnF zJD;JNOADvT!WPLDB|C4~UaR>iN8Dj%j*mt;`Ys2dd&^&<7h{BOgV2TVHzOHo&m7}73nNH~&rQW$UAoSSX9opLDXk@Lg{hY1Gdq|2k@=D%+oT34N zh5VTAuhjU|gUQj^ztj9hDS%2U!7;wD+Lv1Gt_wJcjXjf^8OJ}vW_w)`b2$$Dwki_q z7qX}YGkdI&iv{LyLR;4?gIa>@olwq*)yZCbsr9*FVN4wt`s8EH;9O#>d#oI4_k8+o2Gb@HJwgafdgRFXXzaiTe)`GZ z`ZS87*6U0H;*Yy1ZTYgD4q2n`20^PUg>S;7Ln0bDyam#j!$8(AfEFSW1)lA|oOFON-@l;6pIPaTzj5vU$yJvSX9Soswn zEvP%__v!b67t<8ehRAVL46OrZ@eC&Slz>Vq-c;!PhQRkP9tCGb{@!CH^f+aY1@m}!iI?p3$8qp^p^~;_%q>A$y;>7P*0bJd<<~x+;4zbGx z`1m=`ZwZy|Bq33VXHMhuZP=leNmI|Xq2<0;^Y?@9UV_4|vqB(L=UH@Nlx zOmO{wKFq68TeW&d>M-}b(gt(6MUiK(^G6f6I_*{4K<` zi=2P(tpG|r9&y!p>cB*vrr_P&6A(Qt>9Bu+7N~(bSs{4VzLYt=BXuRlK^7`jW;wsopD7PJ!qWEe3P(^2K-=1sZKZTsYv7kLXg*lFOs`5Zb z&>kDxYRAc`h}|vQ=C;F2eACuu;V1qs_><~D)|3?a>_gty$m8I(seUm+V3eb3aZVdp z^FukCS=+LD9a`5&z~F~4%B>ylKUNaDr|Wm1MpsY287R`&p>+Pn2~T5#9>Ey5tmerQ zr#|&55miaR-4reiFih~z;1NQA#Q zsW;pZ^rypzNRW@%Mt(|R2m7VIrPyVO$zln?CbtyJiwto zZUOWt@0vSv^T-5}nMBpbgc1vc$Hcp>-3g64fHi<8 z^rIigQXQCsl}02Q@m7`}wwimj;^_bUsb<&P`TROY(QF;*vw!$Sb}1vm6`ivwzm_lK zPQ!7{#-1E^ptoWXG!$yIM!t_iEOUccxYNis_dfb3rq5*Y1ip}qJ8^WBxg?ox`Qsh) zamp%C zP2yT($t*qIVTi`6Rv3I09dM5VnE zwiQbvGw_hV_66NX3cvd+TR>X<$nyqngfH#rkI$G)CGez|OHq#}@08h-Zw%&DHFZ1!w8xy9oxzHaNN4aS}0{Pq290*rvW0jdps~q` zt;~5C58BGyHUNM(6{#YjiT?_;$v#Wc7TjQ6a-SdknRk&)C^C_YQ1m##FAuiqV$P_M^p_;J?q zXspsvq-Zl1wGDk<19T6q=(%XTifE1+>N%7nfPzRdncPO@v+TRpeNYl2(Z!#CR3Jnk z)bqKk+;E3Gcmq-=H2Cy6EEspokhxmiCvfCMMgb;|I~kJwhOt;z_7~&lLCDMv;u6Dra;WBQPDc(i0{* zw1tK*6u)q!Uq8A}Ps&`huBIQL-O{YR38Bj@c12)DPBEK{n8?jNaFJ%q=M`l*`Sl#& zRCi#!-4G_ z*pkD+mAI|_YtI0VI$KwLn)|)xr?UjcWEx>I=wRK1fdtQ;s44s!Z|Z*0n6d5nXW_59LJQKm@_O>TJ+=lIJsZ;qC$hg6WR zSCiy%+cmqV#d!C^v5)M@4&|K&dsv4DCVh;Z9guq6aP<2?>d_R@d+JyM}$p_*z?n6|t$= zLA8VZAx-Du>WLi`wdl$POMfp?ck_L|gGdx@x8rfcaFXiu!3oQ%O^b8(IVqw@;sC~M zfg+jXG82fi1pO)RRU2`~d9XgWcg}13kj)}se_Y-Z_NzUQ&fns#t)99{@)wfqmqz%0 zKEbR3ZB8QE^tDdT9qan)3+dc9_bg#)^y3~A+g*~AQ)4OVARZ{_TLrW^_-F_F_Q8x< z)Ga7t#~hm_10U~TOwSd_dLnj6VGFm?DteyKPs z+OYXF+jEXXVy*V!;o)`T2VF)%*?`j=;cFmvOs}JBS z-!1yG#|k@8w)J90XT^7r+Egg2{mhj1rcI+dl(+S;3@AnjhQpMJkMxpO6-BfWo6Cw` zhuBEU^uO=4jcT%S@zsDNz;{VUN>$c88j@q+E)VeX=EY)8old;z(?Wyi&sKV3efNPe zjP5#U{dQr+LEkjfNGU*iLD=C@#C3F&q9|Re&lRpkD(~?)k zG4Q(ay!>}xCXY8yrhgunvGVDlVA_kwEC`t)wKajNG{RMb00BzOeQt=|Ux`^7Og6U7N_HBwvJ{Z|V3Jo`tGn)dcPPK|lrqKU=O^F%WgSs5ERvdWyS&yZ@q09~Sh_6UY_(1^Q zm0AN280J}ccglWmxrO|N#Wcw~LY^kp*>mrEMZNh=(q#eJ-&1a^wXD3OA8*3_fr@9~ zl3iD@P)%&R<1aGkrB2y&VPS`?l$m?OS%aq)`Igtnjr8RL-_lci4O=Lk)WH)Lym0H&)^_o>C@V<*8xESH&jsyuEoXXEX9v@+!({I~e4~7##A5+=l!1+)27E7MO+q zb*Pw+W@mZ5SKMUsAnnblj2ISk;#6GIoD=;9KThkDdCa^KNXX1f^h_^|y^30&=@MiF z6xj|FE&+T&m8sH+$jQ=O5p=eN3)w`E>q9jQbr^4K0HY`|Vl&hb-Xw$4<~93~;+h*; zY+kA1C>j;c%~k^Y&(>s~Xo0iss;xZ(Y(4$ULwR9tXIF}3tqbRh(IIuIHMccp%q>)o zd3C?lJ4Bk~nl}%5mjPpF2e}7|Vg|Zn^yDB-_B;4_uZI1eVT8@&5gAU9V`Q8F`qUH6 z<(EMWrqogLHW87Rve(~J()+2L>CWNq&yE!Za)U)SajT|C@z!C z1Oj9s2?+re7pe#dZYUyUtw_PTRE4s*fEy}^EFwY?P<9X$3l)XOyNN*CcY4nI1D=y} z&;2s<`+oPkzx#c2X3j}wTHB(JZ@hT9>En56j4zbYd46krr-+ZUy%D?d!RV`qS{1&n zkGS?CddP6R&Tl_k+*4iMp0lCm_64YsEY7jnb0>Ao=hEBPi}%JISv38ev|7@|tfJOx z=d!CpbLaJf7)Wnz-O#ZrNx=Dr1N|7{>Y#nECjy=Tg_;Og&7uiu!o_ z`&VQP=hpj%{0{#8ochts^wZwe_Kv-V4Xd4IYD4IcdVEVyoytcT4%% zfR~Le`aOHPheHyS#THE$9&Rg7dLgBoxemXPsx~lI^p>XNS&i9#-xrp498U+q<+T&1n zlU5db`NI~w9J-g!Tt9BhOMQqtaju{=y`=Ku65njU5x4U`OH#ul&kb-J%_F>rLmyts z{`KO&eJkD9v=oR;z2r!O{nfm5?98G_yVHcOCnwh*xp(|Bx3yuZhk@5SWjWqXnk>ZS z%_t~wuYDxZmg_3-Ct8MiUXZ}&&^Z{sx%TuKen&dz??{{x2ODOrblooL&q#IZc)N6? zG%lj=Ai;?g7){lYZ25p$K6Z0|N8L*HwYF(@W>mq;iekUgzq9C?nYh_7J@yAe)?m#> z#r?9U74(|d9$C+%nc?)vj}*}~-LsF6h1UIC8{8$KyN>6Q??qG;Huw(WdHB(_^H>V> z=y=YH;U=@H0l2=dqOa+c&7kq_qMo_$7H?_W{mf&>Tuy^c)Q8BVc*pXJknHR2*PWdr zk}$7~xXImEyBmyESCvm9>`ztOqK{KpinWz7_pMAU#`9}DMql<5>)!4RWBv59!Y)5N zxxdgRx;Hexen9tO>HY;w$Gw-{T)%f!KKq7fIMcPLv~%@kM!#*m;Q67~i`O2{3!Q1+ z^PRzR{S|flmIp+W!CSu0JoJ@=KbfD}9(DM36{ly!WP{Zbz1ZLOgvo_Jo>)LIxef0< zM{cWcspLg1IMe94l?{KK56>Rwgcs?ASLU0omD^gB@c7X82o{UCVF9)q5v zo?K^zaPCO=xD=BH^dT#+RAV`N`6GP#nJ?n5X?`N*HHY6&(E37h@I zKdY_1Hm|v3@1e%j{%bMfPi6Hf2ZD!wEKY0~+7_(acqck|S0E?h8+$wBd(QHNMqy)* zf0FLHEz8cPMKs3->v?bJ*tOsw9G8a4DS9NUk#TA^c{x-?owc!hx*+F_gLPQzvU@3e zjEC67)m~|v?sVoYqD2*qC=#*^hh*JPRK@Kpw{7!^TWOm87~>q!dTZ$Z?_U3SgzR=%Y5POt0dC;+#kIFq9UV|ke>rgAmE!q)zY(il@4Q#U zeb3n19g;V~zHH3@rEu92ulk^fW_ljqCDYx=P)l2{-*c?$SyL81gW~2|bELxLv02eN z6t2yQe~fOKnD=CC+FA4Kg}q&tbL8uqz;ANi6uJ*|>t$2)c8NPxS-sW|V4uoXRfKa> zK=Sy%)z99msF|HCoz`0CH)U-EJ&(rTG~cm*R2D+DbSr(G~#blO@B6YGF<-yCT70f?+dF+d`ujtA1kSP z#Mb6ujO%mvYGpVZE&uRsh4-^%`&dyFecXab-58vH`fW`gEa;i! zLDnPpd5W~c@2;S~#-^N2iSawaH)ciaBrxX4mxdc^MVe*}kM-K@FC?2%OE2owCwG3@ zJJ{h)D$5_3D>JA4;ap{!J;&2`{PHbF?ghbz(UiEQj7v^|>8G8;-p{z}cC5OnAWwDo zq}H{a1(XB>gZ{>S>dTmIzP>jDJ{~k)T%c%C^jCdcLEl7KWYd;f$Ml+OpYGwsj8A-_ zsBcLe+Z6q?VU`))2HJ1Eao?=N@BH#~yBgN@Z=Tihi&5{9@tbK*H=BJJT2Gx+XH#6Z z|2A;FWG(G=@8ZrpozdRy@t`ET#?PhBet^t;-WRC7-ka_C z6oo>u*(*`{pf^CFv~*Egz}l+|%nAFvHVUP!rGwG|`wxOP57=sqx-Hb2rs-pWZ8~9} z1h(Y_2DqY#TH2^tpic&k1njRsp97lU(C4vk0$aW5Yd%iEQZrBX8`zx9XcCS{z>#Ud zpFpBA2^1!YiYCyRL?V+)2WYLdKO<5zc>|ZXGf}8DwxJS;7l_EwT*OZxVqpe~Zeh>@ zn1%78atIuWJ>oBL3X>vkVVm4}VSzjbjIp&ruL)&_3ME2B4xvMZK_VG5l!bv{F&AM1 zTfG~PL2DrLKo&+ll)YGrpeZ;Cj(}YsDo~IxfI|xNnXV3w6Aa)R3*#@BOPF}PQmMo# z$vCmp4^Lz;7p&&#A3&Awt z&$C7l8Vw;K*2GDF7pVYb92E4|c+@auLkxC*^!8D1K34|vim4Vb!Q)%i8gH{XA1hE4JA$8UPSIvx=_EH3r zi>2;jaS#hLRg<5OaX?MLkQ{P=sp2#lH7$@7Oqeh8>@kZYe|f`3>~0+mK05n&k1 zBf?-ED8Qlvov?HojgLSSGLJ&wP5R5ke7O>mB6fa28lV73EzMa8ZK;vmY7(dPN7Q-( z4M3J*NmPvn>e)|dfCus8)usG-D)|4NrRLaQ%6<|K&LwJd>eOU|{<3{h;EMuZ6!@aR Y7X`j3@c*a4pEoy%2wdqX!L7@G08z)B^Z)<= literal 0 HcmV?d00001 From 16af740a3bf3e5c47df2fd691b1410547a5ef71f Mon Sep 17 00:00:00 2001 From: dklement Date: Mon, 28 Apr 2025 17:54:44 +0200 Subject: [PATCH 035/183] integrate new Import task GUIde; rectify mappings The new GUI guide on Import tasks is used now instead of guiding readers about how to proceed with the user account import in detail within the 1st3ps methodology itself. Moreover, this commit rectifies the inbound mappings to add the forgotten status mapping. --- midpoint/methodology/first-steps/connect.adoc | 105 ++++++++++-------- .../first-steps/hris-inbound-mappings.webp | Bin 39226 -> 48672 bytes .../first-steps/hris-people-imported.webp | Bin 0 -> 60798 bytes 3 files changed, 58 insertions(+), 47 deletions(-) create mode 100644 midpoint/methodology/first-steps/hris-people-imported.webp diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index cebf3da0e..577e680e6 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -156,13 +156,13 @@ These are the rules you want to define at this stage of your project: | Synchronize | Synchronize the data between the remote account and the focus based on mappings. +|==== + [TIP] ==== See xref:/midpoint/features/current/synchronization/[] to learn about the topic in more depth. ==== -|==== - ==== Map user data Secondly, you need to map various data in the user objects on the resource to user attributes in midPoint. @@ -213,8 +213,33 @@ Your source attribute names may be different based on your source system attribu | Active | User location can be later used with the full name for a last-resort correlation. +| status-to-lifecycleState +| `status` +| Script +| `lifecycleState` +| Active +| Find the script to use beneath the table. + |==== +.The status-to-lifecycleState mapping conversion script +[source,groovy] +---- +switch (input) { + case 'In': + 'active' + break + + case 'Long-term leave': + 'suspended' + break + + case 'Former Employee': + 'archived' + break +} +---- + The mappings can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state and the states can be considered hierarchical in this case. Refer to xref:/midpoint/reference/concepts/object-lifecycle/[] for more details about lifecycle states. @@ -244,56 +269,42 @@ See xref:/midpoint/features/current/mapping/[] to learn about the topic in more Everything is now ready for import. Before you proceed with the real import, it's best to _simulate_ the action first and see if everything behaves as expected. -* You first simulate import of one account. -* Then, try it with all accounts. -* Finally, run the actual real import. - -==== Preview Import on a Single Account - -. In *Resources* > *All resources* > , select *Accounts*. -. Pick one object (account) and click the dropdown menu on the far right of the row. -. Select *Import preview*. -. In the popup that appears, select *Simulated development* as the task execution mode. -. Click btn:[Select]. -. Review the data in the simulated import. +==== Simulate First -image::import-preview.webp[Preview import of a single account] - -You haven't created anything in midPoint yet. -As this is only a simulation, it's the best time to review if the account data map to the right user attributes, and fix it if needed. - -Once you're happy with the setup, you can import for real. - -==== Simulate Full Import Before You Go All In - -Create a simulation task for import. -You'll use the *preview execution mode* with the *development configuration*. -// Refer to xref:/midpoint/gui-guides/tasks/import-tasks/[] for more details on creating tasks. - -Inspect the simulation results and confirm whether all is good. Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. -If so, proceed to the real import. - -==== Real Import +[TIP] +==== +We strongly suggest you *don't skip the simulation steps*. +It's the best way to make sure your resource configuration behaves as expected and fix it if needed. +==== -You've got everything ready to import users from the HR system to midPoint. +. You first simulate importing one account. + Refer to the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#simulate-import-of-a-single-object[guide on import preview] for details. +. Then, try it with all accounts. + ** Refer to the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/[guide on creating import tasks in GUI]. + ** When setting up the task, switch on the *Simulate task* toggle to activate simulation mode. + ** Use _Preview_ mode with the _Development_ configuration in the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui#execution[execution setup screen]. + ** xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#read-simulation-results[Inspect the simulation results] and rectify the resource configuration if needed. +. Finally, after you get expected results during the simulation, set up the same import task again with the *simulation toggle switched off* to run the actual real import. -Firstly, make sure the resource is in the *Active* lifecycle state. -You can find this setting in the top bar when you open the resource via *Resources* > *All resources* > . +Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. -Then, create another import task like you did for the simulation. -The only difference is that now you're going to *use production configuration* and leave the execution mode on default. +==== Import for Real -.Double-check the archetypes -[WARNING] -==== -Before you launch the real import task, double check that your resource objects for accounts have the right _Person_ archetypes. It's complicated to change archetypes later. -==== +Once you confirm you get the expected results during the simulations, you can *import the users for real*: -The runtime of the task depends on the amount of accounts you have in your HR system. +. Make sure you have all relevant objects in the _Active_ lifecycle state: + ** The whole resource + ** The object type for accounts + ** Mapping rules + ** Synchronization rules +. Create the same import task you used for simulation but this time with the *simulation toggle switched off*, i.e., use the _Undefined_ execution mode with _Production_ configuration. + ** With the *Simulate task* toggle off, you won't see the *Execution* screen and midPoint uses the production settings automatically. +. Check the imported accounts in the icon:male[] Accounts section of your resource. +. You can find all imported users also under icon:user[role="red"] *Users* > icon:user[] *Persons*. -Once you run the task and it finishes successfully, you'll see the accounts as linked under icon:male[] btn:[Accounts] in your resource. +image::../hris-people-imported.webp[title="List of focus objects with the Person archetype"] -Congratulations, you're ready to connect a target system to midPoint. +If you see a list similar to the one above―congratulations, you've imported your users to midPoint and you're ready to connect a target system to midPoint. == Connect Your LDAP Target System @@ -302,9 +313,9 @@ A target system is a resource that acts as a recipient of data _from_ midPoint. It's not authoritative, yet it has data on the same accounts that you've imported _to_ midPoint from the HR system. When a system isn't authoritative, it means that it can't overwrite data in midPoint. -Moreover, midPoint is supposed to overwrite (read: rectify) the data on the resource if they happen to mismatch midPoint's truth. -This is useful in cases when, for example, someone creates an unauthorized account on the target system. -The account needs to be deleted and midPoint does so as soon as it find the account, if instructed so. +Moreover, midPoint is supposed to overwrite (read: rectify) the data on the resource if they happen to mismatch the data in midPoint. +This is useful in cases when, for example, someone creates an unauthorized ("illegal") account on the target system. +Such an account needs to be deleted and midPoint does so as soon as it finds it, if instructed so. As mentioned in the previous chapter, the target system in this guide is an LDAP server. diff --git a/midpoint/methodology/first-steps/hris-inbound-mappings.webp b/midpoint/methodology/first-steps/hris-inbound-mappings.webp index e3aa454ce8f291bb8a47128ade18d4b785634ad0..0f52058a6c036bcf3840fd3c19e9ca5c48238694 100644 GIT binary patch delta 45115 zcmV)eK&HRCvI3y|0vu9FMn)LE0037-LQqyvI9Lh*001li0043Y0N{}vCkGq=4FDei z3$aRo0)K+7001v?1-JlJ59GFyBuP~H?{(F5=hPnWh?szWqS1VOfbP}il8Sc6a?ZiW zgKqY=I616i4o7q?dcDE~R9=*3X>>@8WMFl-*gP*YcazP-keSy;=f1hH#_geO|50RL z`?tP}^ZozJ-CA-wG{V0k|H(O*LEG|{x3(o&wtpqr%M0aHqi; zJItB&I^o=Q7!+n^EI6w&DrjaH@M* zfqxM*GjmRdnPyDo$~5DhT%dpo^W#4Qm|nZsI{k^8l5nV z7*AlD@y$RN004;E*wzT{7A%B7+)09U_kY~4XP++L*X6kT*>+vqZoS>QY+aIiyS3mR zAt51w;10oIW{~kM0ALzPvTaFbJD8c7ne52ouA1I&`$zZN-sgP4YM2Vj%!tU$NQPi$ zj&T1iu(mCZz{oo@%<79&cf~dVk!l z#@*fBy~o{M+uf?Yd&=K>-!u3Af7kE-*1h%b{wH&4BWUDwh_Asdbccp;Af8zOx&QVSJ zLwHXMdIx&D2A~H;f^I$56H7O6^fQYM=MNKI3m24Aou{&GD#TRXU{w`C- zyArM=*Td#2M(L%tflFnxtAByQ004xV>n>co%+LIf&x%7lWMg)m%{1F+dh_x{iUI&A zi7b$?JF)KG`~3^My8{O7JdEwI*I3bk{yT6RNs&Bod{;-yyAKFQU~!B45BDGLKiq$~ z|8W0tXb3}S&|p>shO>k}Y3nlT)j)VlHH4}N%x0bAEpMsUK#y^bN`DCD2$Vr6g-{ZK z(X1zIy>6p()N7!_sDLm{`=r;1E!Pj>T;GSC$6B-Zh^<6h@Bnf~D~jMy0*!@5>rovc z6k(c{v}UR^S!-5)!#JZLRv@seRWx22)I^x843b_W_SE2?LT&sSbRcQt*Ff&?!>NUP zoKs5DujXo^HI0fR8Gq^is(hbAN3voNPm(p36e*_^{9YrCsrQzO2t|>gV_D8AS3mVz z>S@a=yDEf){bb!;t)exJ3nF1Zc}!#OKiq$~|D5bV0;h%IBmZT{Ab1d;bT=;Yh)*U` z5GM(JBR-4{YS4q~f{S+){TQ`{J`p$xb$zz-*+Iuo+CyKDGspx60EZ9i|*kw8wicemTas`hJ zBn|)o8fX*Wy2yFu@#{k5?8{VJnrwmA zL4ebcnSO#bd9F1P;CS@(AaWzw!d-di0@cF;XPj&UEvTV^aC-b))(yenx=>J(PfnR@ zDmFw!Ri+>B=n_zT(mYmTEugBazd zD}P2|3qh|y>=}?^aOiUCOpu(%ocvBCAZXXr&^Qn_P@qE4^Yi>rI{|PY=86BDtJAeMbRf_#nQf~^Hfmgm{L_ol%MesN}{!XIWE(hq|!`_C641yP-z`OBH&s;*6H^+`cV6!Y@m2Q& zL>V#_@M#EEKUY6c07KnM!aA8qd)Zz5$0373aQA;Hf558P%kg=Q;8nouUM%TRNERV! zb?lC3;1Bs*qI;I~%zG3z7>3>akAKR5V!cJpKH?wQvFBg20|^{wOJK@5t!pLo4Dj_1 zZ#y&3M0C(hS;cq6?q;voz2u4~64zu9qhG092VVL4o?%5IReinQSU7J{J`)uWGkHDl zC)eNdT~)*FIz4L-~#F@z1wPor>p)B&Ckp27Bxr*OeKY0*ew|ML{9&8kMXd2~0%DJe!jiVikOJ@m zklXBMu3zeKE$;2R5#Z3ee8!Gnoku{wU(_7Q-rKgxK@Ix3tQ*3G)_(-i-7HshTu9KS zAqh?yb_etw0MI#O_Hl_d-hp;ohxV4yp23O9hE`%PDwkEb+By-ymQ+1K`VhkP(!1@>G3>k@*F4$FD?^&x+SVR zD60wJ`2KvypTFgo<9~85L4e!z-rfl6$rcs*XAC>H4IQ7=>b|ZAmA7q5LQ|H~pb9_* ze|U{C#Uti81s3-IM_|q4)|c9sG7TKpBV(>)tK3p0w2ftv;b*?9!-)P9;6I5?zM3rF zk`%X35e;SN`5$UO0((Vc7k6^i4Nq+z+e+BG`-16bLgyIZrGLR5$=KPQSo*!cB1>d< zfN#VScKQeEs~LYeTeB*WkQX6c_3-W}4I^e`1b!|U!|+P4k7dQs(+%HiD{4mS2; zzBnjVS2vfjg@3VU*ro(gK|G|!9I6OP+ch*Cb@Rt705xzt_iZGKUTj?oS(F-DMlvKpSGjzrvIK<*D8+vl$IoU<`SHiT5gCXV zi5T8?_}s|td1)lD(^~1q_4)UPXCe~drG%~<;>-Lltbgbt>MjBwRkVQKbSA1h5u=8B z!IRU&SBAEKKOm4+#}NQE)bg5ICs`8b06@QPrarWmlrIxF5;#kV4Tn);gDtE8pc+Tc zd_p!=)jYqoyo%+ryUs#>mNR+FgCnK}!ie`kQdCBmM=FM1@rY!XW@OWl#_sqed8&cd z96q>7w0|bgk-%Z$)IG0i$=K19;fLk??ob+z`h@Ju`nBtJb>qB#q%jzl3p4tCI~pap zoHW@C+)n*y`dsB}d|sbl5?11?2}8XRk(4@$=%0TuqMEnql9dQKaTYb!76wyqhM@q& zCp5I8TeWUi)sX|DTU(wi$L56w#)DHowRFX+Y=6K5f>%M0c)iykstfX!)u9C2o>h$m z*k=e9d%{K?g#bq*rx!UEKcL;ldyDI?WR5}=lfa#nI*EvxFT-TiGM}ZsiWM>YBV@-k zTad)hi&eK?@nBU{P)}Sg5Ui$f-!G{+{RW3b}IR^khfcq#e zIqU2EmB?-3k7{ZUHu=z(r)DUChSz;2nnxxb%3Xk>-oBgjm;4p+;XQBC$=rtuXv-Lx zO*-<0tODfbGBETOG2@$0rQDv6{fEMa?^KM(-TWplcU>}B)E>pi$&!BtrU?~%%zvis zTz!$uvjGBM;zc4}ea5M%4#dp1AeG#A)ecHR+YR&46Ww#9{PN?eb0>gQ@Qd5{F~t%` zu6xT&)utI~ax*wk5*iNU1TrzjmcA0YQ&cxjdnv^xo;O^zfgEK{4SlF?CnO@CP0oiy8s zUQQ7W2>SGy+9+R!D4!EljiBwMB7@U+bq7xmCc9G)gYKoOTR}b{-y)dUFqPYEZXGny z?i>clmDXqn0DLQag`w1;1Gs6}IJw8>gwD9x#}Q8wbK2&W87zwbG~{+CuW{nP{Q3ZP z4UGh^e@UNH=qxgFQ&0|WJAWHe5?ZdPf79s*i35N_SzqA1D8H*=fS0BublfrT`cp9y z2RNi&{pUUM(jV$A1nxbSDNa6=y#R9JZbO%h4(I|6Znq^*%$HwoL3A(f-vwXzL%oeK z6hL9>+6LJ&@cu=OQ>uh_i99sy(hqe2f!#gJ;ajdzw_=-2Rz)5M0DsV@4KHI4em;+4 z=q*a!o`sQ2yRX`2OOW)_u|{eeMdJL*f%S+R|4}(n{L=&rA(tmX$0s4L+o^RAy-&?h zB88xo4pI(N)tI)&|kHo+De@| zKw)LR_itpgB?7Q>q-G05{tf6p$Q{pO?1T{Nfx#h&t;C^6{r9%ROqM0gPyh`n@o8S% zuYXQP{_q~*m#z5K4Oq;7b`~+)tZtoxIE)$^IMmf~al@gsw10!9Bs{x~D8DpRH$!ic zvzeZ7We27XJnd$j7qrY3S|(jVK$W{*%ofs{Ip)NnuidN=Ml-Qt9NFWfV|xjeKMGc@cTAf9-lQU7XZHL5e!4lQ&uwKhcUS*M6oAN2C)&}k0K0tRd zXFP*59STWTxO`XAXT!!sUlfL+x7dV&*!G@S#XFN%5#TC9)tYWgT?t4dz+J9jGKRb0 z)y(-TCI#UR@o(EwY=@lM2M5lKndJ}EY>AFfkAL=ZZAqRQmmHAR88`Pd;z@i?ySyRf zqeZqWCW3dLzrNc>)1`4oE{GZg{r~B8`={JOypVBB(VTDlo)@75Ac6g4KKb$MPT;Nx`vAxttl7YZU3QBOphR?M*CSYM z4eMm&8@pjM#AT5x)lUUb`6 zk)U#clXuu2e}enRVYhfJaHZDVaDUep@NB}~V>6I;CUT+sJM+H&X`fNCugyp1^&SQf z6MedTDR`0HaK~O$*yYv5?uYuC7QY-vTo zfO38OsqB#k7z$w4y{vyb=KMu zxE-&}9|{8waJAs|MgDzlRhuTt5brJKwrHwi>s3FA1DuRJ_HP--UC5RA#KoOc6e4qc z7GuJ&Xf*ino;T(+C(2;r5(5to0$qjI%_m?_!Pw_A;7`F2#(mfa5a4{uRFhvauG&={ zz~Fk;*p+)6wH;TcFi=B%;eYfbY&%d~#IjgDA?5s0e0uOjy!wgWNNpX|qx4};Idl51 zwxV@hA#B-FWb5sIoeCa~nj8j(yoD)Y8F4W|G4M=Ant}|7*tbLb=-KPOQtX@}?0OQ> zVW||8dq>ZFxTT$WVR<>YNtASLAW9ow#BUwF9;&S%dl=&&@p4GhN`J9wXczj8WpyN* z(-R2JvCGN(F%+PIlyb`(RAj7}>)TL_BhogeBZ1?}kycW~A}Y}m!ea7hYm_fd6d>iA z*xBc0wnPWoZM?S(pZ4|oPtGQLQbZlra-W?0-~_+7JkN-r?P|fkWLHOklW7Bo^}G7! zI#xsP`Y2Wlt#Pu$=YRFz*itpA>y{b>Y!OJEnKw*Hxk+T7H2J`*S~It`4JbUon4~t0L>0pK>pejhiCFFRV>_Tv zG}c1&v0Q2w^>n+3J%}gW3oBwc012FTv3Fs+#`h)QZfxTd*MI#0#EjXvirV>kIOKM+ z@U=9OC1L^uxJ_lCUT&xBLTvh-=!W(#?Ai}){I_!{w7c2sbuYg3p?^7LA9L^vb++J! zGcv7leH9#aC%*r+p#$&&G=TD+zT0*{@I1g@3>gIX;)&lUmD&ATG8VLMae5y1y&F$k z^j)N>p-BjA|9_kSl!V1Jl1T76=y&^*_^lZ4Ed~Gp2j%S5_^d|oLr{1(ne|)|hHDw& zMQQ-Mg-f4JyUSv9+3CcEYF>B5#t(%BKOuXfu@-yX%uzO@C7*7^wi5^hXr_#2 zN~caRYG0L4j9Y4>5`d3t&A^)@33aF_69V3yyj#zDk_j|Z1~IakJxDke)yY9?oZ>mb zp40*f@cSh1zU+f7DhW%P@}pCyVJ&4?%A4GsxRHQkMU}AYd^9i=puuMqqk6Ni(}Pgv zxxO>cjDO|8rmmFVo5)@90Nk!79h0zDhh;#~Z=R@)+e%$TyL}GpEd%|wp}GxZIp{Dz z8Lu;*zp)3%Z!0osER86y*)HmZFn6{cieFO1gpu!mCV`4Tn?CHi*EppiPO`i86#L zLCuX8jlQSt_G3E;9>k*WChC?Y&^Fs)n@>lW3ecjx!x1Dy&P8_zsG;*#;X+{gCVD7g zd}#V|#WwkPwyiz;N56Vtop_wP>V)g%bQHw#Z29P2dBaE7Ydah^Jdsw15QYM@sp`uN z%74TaDID}oF?Gt6rhdN znVS)@Kvh(tyCz@o;nKrwwYzmpu9-XYw131NKiAeMh)thi$sv~(oiX(JobA}K-s4rk z>zUvGNqGL#fFwX`xUHYY!wn>m@nv>Kip7d+x%i}hMLu7u*GJnJ16xj&^Tm))|+fAkr?fV8pM91iQ8%B6J)^sJE z`{Clml|T;f#gla!05a3P(Tn;$q7R{9-WNhGYN~~6f%{(jF6k0e-Tt8FIWf z-AxX2czo>SMMWGSet6nhxuZa8jMUd=uNX&5<_^%wrefQ_W(0k{^vShnKYy?dSY6Tx zCEYjj>g;OH*y{iyX5AEaUG#-zc{7tRq68xQOJJoCu`70hxMBlKR~14wxcf0<_e&Dp z;fuSKMK)I$?Tsq;u!^2CS7t3W>-5?3VQx~XK(M{C3RmE%w5qO))L#lh;hKP4Q-W4>-6tOvkVcWAb%yHVKqnO7y~yA zRd2T}MF0x>3S3UI*-7IyX3Q7(aZVjUsstrdS)$oa!y$2TFg>l>K&u4T7IM`JuT@dS z5zS02;7$d)sWDrO;KN_*(dT2Nc!eW$FPsL=#Yiqj^ll4R8xuNB6vS)u8SUQ<)Q(-h zPx3rWa2lCYCRMisWq+qlOL4?aL)FU-ODV+l99f{&D#LA2{pO`vRRq1sY3{Jr5+FMJ zd9$^^O_nG^{eEF{WY2gYq8XNVoB9Hy2+AkW*(b~yw{aU}q^J^dZwv6dVD7H&3r@)h$XgJsjkFvYxw-CwS|IaLfjeDS#TNMnw! zWVZw(;}~1+Dt|^w!j098rOGM?0LYhptj$`~4Ma+5=Gp(4*dJjg|1fu5f0ZGr15iV4 zXU!eL#{e7rFS%5?DYKxl@vsPo9ySeSxaHfB^CBvdY}nK90wJ=UpjqlpJmZM zm^V`jyl)0|v1XaG1wkU!9H&49&!gub#w@eorKZ6MOINjbFyu`#DKL!FZQ z3TBVvzklNx4FDyo3cyexniT>(H*`*=S-d7j6AgI0b$?W^V5bj#GjJ*^q7@NZS;CI@HkO%$ zIcX-ZRwvG3x1~NG>U<99dP4qcTYkdY?4vFZk(1s$rbiYveU8)ls0F%`QHLBHXH|Z* z6*Myb?^{|!=Kb$Kk7X;kM0#T_J=kReH9q-?#ojl4^omO(0{tm<5`lMk*6@cV^~^>D zK7WDqPu$W1=}rC!Q$yRV=3&AM#^+OAPml0#mc%cuRqv#_%ZU;PVhd?R)^FfAU@<{w zwEohlMTMC!$QEc_6^v1YLHNKPq(%I}Uw&6{tdn^A|0Yn4U5nM*#79v_WAqiH7BkP7 z?STJBpl$bR8h0CA3=wJc8HOx`Nit-}E`Lwcsz7FS+=og3EKdBtf4?OdaQ{4)@c(Do zbMB*I1xqPqwhB2-H6xUnY0RB#Wtpl1i%9fpntrikug~Z7OcID^!ZrVgMYMu zzdCadTFzf?lxEBcS6QL}TVDgcAMOx7um@|SejgS;79IPfd&6@Of`bwdGOI_#b`iSS zxBMnct04f`5+tw=)ZZFm3`I$(Tg>m7bnX>Q(whoJ5!XNK&oemAeTrHXs7c1Y|NpHl zEnWZ)zL+oOEozGb{`{YotY9N?mVe!(AM_v&N+(z{TKnF#MS!bJ!Dic@<^>&lxtLz? z(d6#_V=Aq{2s_ynQRi8_E!}LMdISms&6LR+CM-;=be*yLDxbH*E_Z)`R-)aqZk;8s zhUPOWXP=LBJy`Sqz`gH~QFrt?#CZ)8uiQZ3hNC?+9MwvK<&Z|?(vR6*h<`rE=tf+# zN6-xuEG!9pZ%p8rGi>u&I`q$K)L|yseR2IQ3ku(-AsrhCmNf?*H`{e=k2^Y zfhY-8^SMKxYII5HCSAg+s7?s_9>BOxB!ARtvUuRg*s*cK ztg4t0_DECIE9^+1JHoj*`8=3<^}>}L9tEpOYW zkr26`pY~^7v6QAJ2FJZqph15!Z&^{s?f6uCC_@kAnL1Kn+Pjn<>nH#~4ZrkOZNGdm zZ*j}H>OaMxMJw1quzwKY#&<~oAc0M^uKqO)iDjhQl!$%B9XYcQ^#)T=30I$%U3bsP z%=q-3Ntba+Tla10btJF~(BFQM8BWF6!EPTSHqFSA9bVJI$FAvxe{#kR&wC7KHuinE zayET%Vqi%%E#hd-Qt%p|o`on<)|3&_5toRVRaJAn0iq7!*niieRms}7r ztIEbi-HkB@!GH7>f^AMa7&UZRSF#5&qVZtrsdt;QE@~F~Jwy#+OJ1vej6SQU=W|Hc z)6*mTn{WF$(X7~so_)-(6ABaFmK|b@ms8Ja4T-o+b%{xfH1=+JhdERbGn2q=p6=ae z*P4XGB;b&9t=si^Imwyx$+;vyCStw;u7McP4&D>J3 z%B`d}qO&G7+2Hn()h1X7WsDM*MTt4#bhBkP-MmKY*G`ms(Fo(F#Homz5zj1Cy3`og zF%mPH!Z)fOO3aVr($F?0f2MEx3I7(Uzbd9BMjgtcM6zJUs!Yc^QwK!XT*>*YX-&w% z;j>w#Lw_}1xu#{yR9BI(X4ZRTAp*OC$eMKcn8G|PQHI%L#a=YrxG8rpVg1ObL8+){ zQ$m3AG1`Z(frSeDHIa9hg^1#9saqJa5V=L`*rzHUjJT?uqNh0tkjEv8#hJP4Zs3O7D7+4u*z=3b$@)2^J!- zDT)M5d+n<1Fm6d;0wLxV(eOl4mb^ioW}yNuio6dW=3GR|V6w*Dr)q6Zh}%UjqwKXPANo@)}Y_?W$C(eT*8KPRL+Al;A%_>+h2*Xn#|m zPjnQY1D3oGow_zlj_;EuF7LuUTmpbg0LUrXl8ZBra(W2}&fmE$OY#Ke2*k*7kUn1N zPvyC!?WF{aix8Fo_)0UXcbf!0@C|N8xG8pVZ7~-;g#y0wFDz8C+8Bz}Rp^N#@nm04 zb)lYBH5)y?y(^be)NaXa&wt3HQhyMi2G7mU`mSdb8GP?R!I+B~H_Z7ayMlOcJ-h7H zRBtf(bp`UGu@H0G;nXpNQLen>^RI8m@3qX0a(n zEld`oTx<`M2q3_9i2m-`_`y_jm=duYR%2@;l>SV~Hm_mX0)QT^D^!1Lgnu!U9Jz-{ zDfa_aD|S6nXOkrBia!r8m~0FSdWO+q9Uh+(OHL3 zR1_3Jk*sJe!C8nn&K18XVw_Y}lzE*z(`HGe`Drgd@c{ajGn<)D!GV}l`5btQ6O$q?8 zXY?xkS78F=m;blwy#E~nXvqpT*wxh6f2ykV(EeGY4Q*!JwC*)q;gvn@wF%}diGeav znJq_Ih-kGTN#d)gKW$oe?sXb;8W+AETL&}+v0*j0ei`H3EKvb@ihrUpAA4`N7=qL< z3aI^Le$v? zzk>KMXnt|lXEP~D(|n2)nOGl$_AZlpnseOC4(dPVlqzdi! zF(Ove|D~E1yx%bTTc!UYHGNHQ$HIS!ktk@h@@4;@s5TM#3f^vXcJmO{qAi9H?s1p2WX!{dhBJx$tAF2(B4!NZMN?<$o(*9) zUpv>3L%zjCfPHt}$IF;vWG_?+O1%frhvXXl@0xKRcA9RMSys7*G5#JWT`=(ZR7aWc zvy^%r`Kab}mk*@(MCrc@dL%@_H!(s53k+F`Rhm`$FnGa3=4aQ=FtX>a8NKiN=HaV( zA`dhyTN+x|5P$UyS;)o>>wc59OjLjWpN&&dMMh0!F}Z%FwqVpH+4Z!<&OoW8WZZ{+ zk=qS^MnS5OtjWz)QFt3v{TP58P)@lIp%xaUTxuu-Kjca1uuos$5fI@EK zr09yD4!f4VUK56nGT!~yq7`hQt2uT05B`Js$&4z1f`1C`2sGWB&yIGn7m)>{Q^5~| z)QfB5j5)Hidit{=whOWeG%tKWuL<#*Kd|>U+Yo{m{M^^Z8*@~J5vGePRd8eA{K^Ow zEHY$|l^C`PWU~P^)OFRiS*UQDJ5mVt?8YW6M3!NQGAv=rgKzz^jkh=bGGdMF1pv@5 z(G*!-(tme3UkR6c4`5cQjC`GV*FLcSH_H&l3uOEX!L}oek}zK`9eOdgePPH#iPOIB zi>F3twU2=!Nz3<=mg4`nXv0;ZezT^0SJukqwTXr-f&d4!YJREr zAo`G8qwh6;V7;2E%fhm_4)!nn3&~{*k%x>n2nT-)#rJ?I>XU%{z=MdM zAAcE`h<#OxhGolG*URwVHB$>YzNHjLMNq@)$B2gJ^wZ7e1%HJ{h4{X|+rze~3J+!1 zA|k5<^D}=2h(}Nu*Gc!%nG%agniq@-ad}MN%g@89unH%x$*X#gnJv*4e;!UHBXf{+ z5124?lu?UTu+dgP%xnx8U!Q)xv6kFbsDJ0NoZntM%a}uU;F=eHg-4BD6N4vWU_HMy zLIsNqnPVk}tpZuZ0QvGVTZo=M{Z)l;#g%D{VF^mu7{&18+C`c=9(OwA#l&si^69O@Bk* zsvdp7dhnbnN8a)ITt|!l#{^jdZPsl4-=SDWu*ypzx3a`DkPiDo=qcv-$8Ib zY?hg2GT)S*t-DIMMq>4iEmrU4CgNiSlIkRQ`wSu?*`M1ot&NZpi} zd1p1Y)=WXXvzlGKz3=w@^wo55k$<_^{Jxg&F>Mdkf(el5_LX?}0;nzshV&P-ggiVZh<%lYv zCbk%Zuklz5-6|N6z$Q{(H-APPnQPJ<5U;3;&M_=u@-U${_||{#k^08XFRg4-Nr3wT zDoNBK{KI4PH!M_Phwgi!x?GbN*MOI?1YhDD&O} z+m4WB-AFI7C(vF^U7pdSf+v2OX9`k2j(_d)uFqFG`oEI; zlgO2AcA}cG*am`Z04XgCmrRdK*6=w!qPp^~20?Z(PT2t5h9gxKN!Rhv?NR#L=Y96D zul|j^-a$ptpMA4t-KkS$7MXY!>piIhe(a4aGK>KoBN@39x+bAq_Vbi#6@`~OA&F5! z{+N(GC20yA=)LAj&VOgQRRJ=KwxB?E%@v=|nw4cvD0thaSaJlmo~XTLwV5G%GFN=Z zf=PDWS!6X5;Czhc;cNJd`ZZBjhoEK=Gq1Vh=hGk4$Hc7@tTuroz-gHFiG>j?gzQ_T zz6dWLt4;%^b#m_z-QCT7s!}`b!~)3EhnCgY}%(?)JKZfY~lJ{?03&;qfJ-omIQE7)KgdQgOoEfiKvB#24PU*-^u(cM0q z+cv9AVAL$n@@23(&ovsl!~FXF8CR!)^fkGZg|0{2Y5`X?4j z58jizW8^T541cOimM1Oh3WBe7@-TtW@&C3QP|7HmQ3ecqhJEr&ju053q;XT&w*`%x z`W%x>2YJKAUTpmI;CN2q$DwoSOqoR@&i1JZ`g9S?Y`AV!x@o5Hak3Cmlr=-5XQr=^ z7lLg^$g-|j>08aM&svmZ*5KjyJAD{ZMU6|U)jsC4ihpbFAK265|F=l}Wibf=5;!g< z&Hm}09^d`$qQeGgv*b9)?R^ZS@m}QFU0J7S8z*n^Gxh(P*Hywc48)o3+a`Gz9-9mW zVif=>DghZ91Oosyyqek2k@7;4MxV@SeBY`vCg7Z+yfJDs8o`e!uuVpl8t+M$D>`;RW@EpqW5Gfv_3EpP3OsZ$#*n(`9a2FTh_uSJAU!9M~0(>-C@j|sxk2>Y_0osLIq9%R!n-f3Nr@j;||A8L; zSn$A}o@qZ%61%VsUy%&h%$%y+fyrM20ON{(Q@qQboSwfF5YJc+f5~0PCb58q1b=B` zi5dn3Q$C!I3Z73d^7zBDeGcfS{W_-H#K1!9IJJV2UyD{6(mFV)*t5I)DEB9lNsmu7JD=yBN(kWq;;rYZ~M0~}G zfAPyV2skdZU<_kuOvTL$p3-G49G|G*7thHh2LeVI z9qwUofHu@_PX`wMXVvJ9jfsEo*SwUr@z-{clGD zKe~*wu<{P1YltG-_FfeS;FL4R0RR#>m4Msi6=K3QY4Eq&v0oVGpE4A_RNfzs5A7Ja zg5#2qznohpa6`F~e1ljG-g12tQ^aGlrrYjiP^<6!Oh?|ZPZel2JT0IFqW z_UQ#%!E} zP*S9r&th_6a1I%=g9X>T7-2SS}%Z zdFrP!dmY=t>#me!l_Xv1byoSlNV?MNG(PMsXWy>0L**TA~zc{+Vg}x?LcHGYDK@U*CTHJb&>fs?D&o_-0sW zG&{R~Hu2(X4$y4bF~hCd%c9ain?$dZ(SHdvED1G#OzJFUG?6r87FNdo?W7Tpmp!F{ zHonYDKCtJq--a6A2?6#9dcyOn2ll)j!5>&s4my=Vj8=NKl7D&Wm>^Y|Ti(*~E5{lS ze2(bqwO@A>y}t6=L2AmE;~1cPRj0%Q1Km(Vljt1!z@DC-=wBw)UW9`DadVgbJWSRA zz+V-jy}y~!*$_AP)NSsMiZfk*8EN4zoFp{dW;btF-&V<4NNeOmPf1*qniO$LzD%*~`0 zthOoIn(M~zyNWb%Ckdg8Sq^Alh>LBb85)nDe7PrccL@kC#gSkaC$B>hr4!3mrBkZ+ zkZvx;$y9S%yBru4K@VA2Hwjl&!oOxz4^T}tq|X;vAb+93SCwu^Xu5HnBYP3>SL`lr zpVwvh>=*Qlv_+vOy;k^Q%i5c?#38{@V`e*Z=);l%`c*WkD_#-i2KpAK;3$vU`giSpz3>4OP} zrOmtj1|3RCxEY|5Y*}H(^bgGmh($${vf?`r3gT?BtmnwuvT@R?s9ovxoQJC)usikP zCSLXFkj_b0*`_#6`TSvXFzG~pM4dwbq?G<7Wq;3{0=acrM8wk=7o3c`*u|&=Ip*RL z_W%<2Q1Jp^U>caMo!C1h?a6VlV)m~)(1asnim5n=?IK%ZCK0*qH2-!ffOrNH>6F^A zR!|(HwabA)5vG=f)l%K_^yQyNgKOs-vK`Fd(#svF3?!I0ZtKL@Ia7RZ!7~)vO!}Xy zH-9RbuoaTzse__xQ#m@QqFuS>P&bZCX0A*-5s^azR~rjx|3I)NDki|qf~i{Hw!hM) zf~zlhgnebZG6i84I{)PA=hR7rNzlH!X-%K9>QdFuDRA6>RN zBrzks0$TWLAI6z;iWX3Hku$UBulrT)n}7V83Va){d^81Y`|Ku+<=oynYs>K&iPnCh z>e{pwIR`bon^3BDb52r@ofC%|9Nb%BQ^VC4yn_CUh_sQ`a-1GmmL-#Sg3F=}wOGvHSkMOE=wMr@FdCl(y6S+u;-#F2&I) zww$~LySlW>fk6?beueBu*6a7wc7K){GdegEzV9}{nEQBts=;YiwS@u!jy!d5ktU98 z0T45bCL^-#20vVF!gZHfGyuP{)%-5mnAKg)<~d6&dVr1dzd2Y|?j)E5?YjxLT#y(5 zDWz;OL!`Y+0c6hp=CspN2L%8CxB2NGB8?o`2Jqi-M~UTzqz+!8ul^;_oqxZGvYb1n z8ZtVl;}lJXlsk+*qzDDEYBr0kT}r{#CR|6USqGgn^%c8VUbTyY8tMqNy=NdhVB17t za5F96A^=LHMKfOVv$(vgN5@u@@muj0$Qdv6rU_FGDaMAm6$3+9!hKkIWb`0 z1&lnC>cmOs0X8csGRtV%o4W7syL8e`HUjy$1b|NAgeb;zY4gXmmZWdMD+;xY`8l!^ z3gQ)a_Dlue@dtBSM65YWw)vmRCdsLGP`K@tO)zm6KuRf_%m}v_B7Z0X9C>QrqKw=H zq=4+{-zH#EVq+MMHRZ1a1@W3YhoCFaOn-JoUsNr4pSD@w?X^v4-?HQu8r0p6m zu<7nniw>ZBzOH1QoM zVB$=q{&{kC?;B@{J$M{hz%FJruzjAlt8cUHwAK|Lt&|;=z?bbLGz%6jd(dc?D z*}-|v>&(}wNigJx1sE4sddbdY6Pp98U=?{Nx$uxURfG9m7JurRKn5%W-n&9ST7+1{ zK^atVCu~RT_kpkYxaJ%hfKE&vLBEC9!dafqbQVurN}>NHMq8F5sDDhL?M^mwOk(vF z?GWHWL;xZjh;S%r5y;ujk-{H$$gHI#>5A4_R<(&rNJkL>zF85D6D^3zUJAip`LzXK zGJDfpwI@_U_kY&&TMa(b*O#a-+ecY+lyMw&l!VFj;nn~mYSoa=-VEG80>>XeJpE-@ zThH@94&yF`Leb#v?ph?cySuxVA_pkN2~Kf$DDD&~F2&tl3zXvCJMZu3|GOU~*LAW< z_Pox_?97gB&;%i!{&KJFaP^THijoF|bUV2}x9F1;@{*ya(ccj}!eFeBQTLzuA~Lmr!Zp7HhoPT zf3t58BNx)=#n2yLrG+Pl17=6jG+i&-yeTZ2g-kP$a7!OAZU>eo!%OM><~KZic>$|b z{3xw%-&S6-TPB{e((IGnAyQT?cKX$2>7P8(%q9x_Kv9L=`LS}<#>VMq4(OH$?K=2M z*+*|9sJvJY@9^c5xOjFMkDD#kldGTT>c(#9*JnxxVgI<&fLEtAz|X^o6-AxtP~Pv8 z_Q&zllesiOHeb8y+jxiXXg1_B{p6O~Tn)UM3z(N={DV4TeAW(Hk<`xDvdG{86n zjM=oCZL_>g+^%t>SK{V>Hz&~Xns z!0`?D*POhqtn-p@03Rb_<2&540s~F{37FyX5w?dzd=%UzA%=YpxjWBELZ_2#e^-eZ zo%KRJ#rL<`(I5+54=IAJ6ouYY2*|8rwctp@0!^DU#y4+smfSGqcDmFwQ^JtxWN=)~ z_8`+bg(wGJIsOuUIJcIyBSOZS^C`M0C{@cJCr%e{*T&ThkcGOMjhTN9n#>!dZYOa| zeCMO{!r1k;Hc9V7L~#=_dalILctpoJ{WFx#R)fHKog}PK%|YWO5zGy2Xy#{0kw1h( zlVb&5wIfAU`C!Vohk75s(-Ab#2Q^0BK_gP-(r}%6%A#(Ty^3fk_s2`F(~HMtEfzb)dU_v{NxZlG26f7jt#3YKoxCqcUa;#tlv-W#_8quAp&D z)#GH;8D-~)b!JeFG=r?o*~C|0FM$?)dpC`DiCW6qf@KEXSy zEU@GB2h2XHVh^bSHH;SLpOosJ&NBDRktgged(YnC>1@i+Yfa`Gr!7h6b0W?q*oCGC ze-jw;_%um1#wuRQ(Of#Kj=to4we&BZzqz-uJ!3Aas5%bdwX+5##mZ_E4loQd>|g3m z_Zr*)he*5!?1HYZ?s=3FtiMY+ZOCMTA`5ir*&5ki+^*qNZ^F@Vx3p>Uq;@`IvI2rf z^fn{j7S80y+68_IC3pPYF3Q1U<;mEcKMc~lAbk~1-ym!Fe*TCR8uM`Elm?S}CPvn? z{q!SRmj(Y={X6?Z`y+iSihD`&m!ytD zAaG|ft6L$5j-*@q`Mw124Vv&KF;B0+aU)8yn!mA-Ps8#JU-jn^o|X?vU(brTKIq4x z9Q$o=?#R|xl1((jCp?V6MYoKJl&LErN2X6i)|tJj^1h65v528{&i8L3T@gZVAYwu3 z*;xuifsu5^yYRTGZ*hp14%rq0?}TL20rsX@K^egQeLM(FJrxw~^k?^|Dh(fe*iwqS zHK`-!LGjz96OrfmrR$t}XSX~*K`2hGDNfRW8h`z-mM^KrW)4n!oBs&j4gWw+M^Rjg zMsqq(O8RZSX$`A#)4}N7U(Yusb}#zlamp5vDA-p8=b1oZ)nZD~D}x)w=C3>5fJkD* z4IqKpoYS-i&A=lS6%xv|54$+WKdm8ZtQFcw5k?-a(~(+oaBki5=zl+!rNX}-B$%uq ze%Su!T{%5XUDR|}4Zp1S+Avx!W7>#B;E*(YjMIqy2nj;OWcljq`eT(#p4|XhdxtfOIdJ)kH-05( zXcTp2U)CH>2MxD#R^f;0`QtF3ITbmto9(@i$}(H?Pus}8gOH0S>gB5aI3Or`X{@|9 zOvJ84m2ga#uwBvp!E(M_JA$94NzZmv>MeL<46LJMWP=om<-(w9zRxE8b}Eod8DHw} z?6cD)*L&8HkLT*@l_%w7UEU7AcFQK#r)&2d(MB}mVMvwf!eITpunvjTFgon5xD~3E zad~4rn95F>cZNse{?)5x0xZ)zvCACr%1G)GC_{IIc42qtyx{Me>Hum`3M(`^iAvgf z)79>=aZ!#o8WM#@CauyWz+t03Ut{D;S3ZWb zi2hw7bz7an6qj5UUwe{QoP(Z@bjziNlo#vIQyMRhbzhm24cIY^6Q?T=lSNu3JvftM%$)`d zZ5H5QFZjj`YF=moao4fc1|tdjI^rfLJQVE2Twk7{7S?z5hLl$;mq|lW!_>iz>RAyVEJ$Dn1}$?FEK~9XJg1IjJf|e)+Do2!LWMG< zFgEPf9m%`76|J|iWNs3vp777qshYGL8SYH5pS|MT>h8o(s~*HUM5l|QnX~h<$P|l4 zu)}i4$IFZqrqDxk{=BFAa_Az>pVIL0G(!EfO67jzhfYVK<TWb2OHIbo_eMMKS;r@Hy zbefx=z26z6{TGVzPniRT4uP+m1{B;s6&ZFDI;E#YU{Zv^rVn{fUhmIzbM0*-&TxOT zCVe7PZ}?~(!mfsZ+h=2wuV>M&c!}XRfSzM<#lV$G`DqXjz{s z(p0Y+9@urGGk_P6XJ?>OqYI7hgvj#$k{ZyFT{S#x?Me8&aLDQQjY~mRmlYdc4)qSx!7BqsI2Ba z=8!Za4lEgZ8@+w*e6Mtk$*DWjDTV6iEmf9fE8ylgM~>$0w~I9*dEzzZfR^Oim-R8rfY*HfB2L1J?2VSwg z&L3Ybvqixa!yA3Alvk-p3LnS4gT#6V1HH05IJ5M%UUa8#@E!EReY_%xuOo+48)8sC z?f_T69_0Q^3)>sy7#(hW0Nv9l%|D8wVzQvHy5$?$9M;r2k>N<}+9AJR*qEa#`b)MS zVQ2kfUIp&&ibh{p*x_CgH1|Xc>i8sR>9=C5-ss!Ho2LgpTvDdp?DV4Mr1kf~0B6UqD5F zymf)t&FU__OC2C~)t+V9xO|5>a+$Tk^fS59VsdCek`fTAy6EY*cl*&vbxo<5p$`w^ zo!xK}TryHUn$*>P#g|4X*j8iGejyl7v4-3fzDMwCveK2~X1kaoD}6RM7_Z5~!d-6J z+M$ndi3JWwfq$ zPhpJBT%{`hPJ5R{WS*M#O|15=OfES6)ZegF7D=#Atk!oo#-9rzYW$s=x-u}^JGQhk zb2a{uF!_vY=vVU#k2?Sq^ViGGLC$%MEx%;d|JpIOF4f4%{D#Y2i5si7__Z$FhHZ8t7bw8WEj{cL0KLua-Xv((uD zUF>HeR>D8_Y|5z*4^DBVD`h*_~Z8J+y1YM_0Hr^<|gvvA`gpiVC0LTwu$8fZ$@FrGqk3dLw@ED z77RWaoB1nI2`-gc=>89V-28W!~!9r64!Hv9n@^IRZ^60Fh(u#a4z}ivV%I`F+ABsOt2X9rELno8~)3tf*~l8bFywL04pA8YiLaM80VQGLenZ#1s4aABF+#6QmA zhP^(z1L~ai#5}W2iZsN&2>&@GnaGZ?d2KR24^^EHyl~U5Z7c0s*_udes#&9z=M+fI zq3S@SVJm^uRM*&Wd!aej_Um6fY&e#%KVv#uWcEw8nLPGW*DkjR>evzm{%Pu`5dD)b z_fU_e8wl|@XLyQG-+EKvTWBt_3DQ5_T}@;JSXglNBF;K7y$+(D1XTc{!`(90aCBe^Vf@{<-ZWcg7(mV$l?d{$&K_f6cNw@U6E z$WY1Zo*Nruja2j zb~>*D%=if_HA`97og=jA-xa^qI=+4SB87`I6f5Y?8q#|q9q8wlsp(tqe%>=K1Gr(|x7K0vHLu^#-x-C+rG7@<=G z5(Zq4Kq{$vkH_TH%8$$$+wWxJ8u8hJ*)bDj=s7m_BEpEgS3paL*P8u1$T*L{nt%YMaP_ zUtdvvC)p%!1>$Ty)Ja9+>{J2H^kLX7W=ak6b17jC;;CM(Gl&sAzE|wN9Ax&fOM#P? zi`C|{u*g(rSEc7B%w+R>Upzp$u~{a_Ygiy!P5LOsPM>0!CXe&-P(zi>Hvz?5Y1LXs zH!jv&%}g?lmYyEFzQ&%4@5zXKGp}Uua(1n+WmxDK8Q`5U8JYJPCDVWtTwrudZzKYr zddHJoZC&l`&5_ikRfsa0jv+qO_4R4vU>mP0MEPBI&339`(0_tyrJ zdY0KOwT8yqmR;PP=P+)ZQTpl}TB&Iaiwn=xW-bc0&iEmIM)p%ZsUS5h?f3epT?Zut znz6PiKKS8-p>nLXhdSWDr%>d-Rku%46&TrQGsSHoGD}$NfA5r3v!1W=)j65|H$1WY zDDfA>+lTzLbq6;lBT?GH3S;3}n94Sv0b6&-rxsc(nM;rL?M}v1CJ(~=Ou$jli}VCL z%?7dg@^giqahs*|`91gUNT9nqsy(sDY?C}K z@hcqew!3#Wnyp;={@p^;y}hV1^Nx!I#459^nw`_B@ZbiB9K-3J=U-L7QM);$-3GKYM2( z{fe4%z3`1X&`HO2hW96@nFz(hrBo~q`ss{J>qU>s`cgBsbAF5?IAC|*auLd=r8N`a zWAQYSS)rlfT={aTe;GEh851NdH}IMh%sj_{CNJXAyD|th;mtdXfspK*u`EekkN2&l z&vLW{E`sCGyiWlLGQlGHgku?? z96&kA4Ao569DbK6=GbJ1y60kkm-r{Hs^$IO$VlR=!(b5+!OZ@KCwADFMT5;QjmPN< zZ;Ixi8cR7CcI|j|CSem}~Z8#q6FGh*rWQmQ&-yiPf0wGsJ z(Z1V@c=k3CJ1x) zX%j6)te3>wE*e4zxBgwLd$r+i2=roeS}s_U^qw&lZ$+cuBpE&!X6fgXY;h{JdT`np z&l_o8Jhv4vwL+T7jPFNB4~OQP;{J#tBhg^<=;6hgr@0yvWB}Bc%g+wU2Pi&wvpOc( zcPBK3F?6~?YMcn-(;{TNi&sQ&bQ-Cpc0H}4yKuW66p5;-9$!%kL)#n%2)Bb(-UH-E7ax_s30F<$M1gL;|J+ zIxb~_2W&ym47q~qd!My2rX&HfJZjCeIE?;*zrK%!x-2E$3EcW-?_cph@Or&%_IE+k zw@C<>4vU_?*iZ+f1rc&ZP<QRVylLbj(-5Bd%##H8 zSztrN9aT%s|8>HD#;-4LcAYC@*v9-vk@A{T#@qpxfBj!lKC&THJL-v|*=l{X` zD~=>1@mU(MLb+k=D4a5QLyGfFwVlNO@wyJLLKe$Dyid9OaXak%K+7GwKGHIk9jpxl z>(U?%FTOKUZ9eL`hGHgf31vDGItX!qTl~79hS}U}st&$JTWA{rtV9?*4i-Kkq*v36 zrd|_%=VcmL1?qUiu*1HJOuG)LSYgdMw z?}Fh4PX=9lxIIR)r?@*J2~d1f;G=`3r4mXycxXTFmG=HH7c=9YbLU-|*<=GyEpjmvGL^`9 zC+n0h;6P(z;tu{>GL!--c=|WyME1iT0Bti06&{?CJ)LWfR!}j(z|> z`mE9(2WwpU;pRlM4E~im$?Ba555w?re5+9!wsr6{}J+ZbYMe|Lpyp_oGBn zBEEQIEJrIQHN_A$ACh7H0WL$=ITcQ|5Io4bd}f;WVErn@Ck(r*wSG3LUr$&$0!Awz zE9_jQ&!XFB^{q8OzVC7nbf~B+uR`GcZ6cF4{uFys^sUCf8fppQ2-9Kz{P1}%g|p?_ z`7q@cG2anP`~Sg3;^#ea_v9aH6s%U&p7!;0VM9VK7M)d}KT4-6_#cxb_OiKjJLt5Q zIui|`jM!o&k$fnG!vP%1uUROoqE3lTBe*_ALxM*@?0P;gk75<&=)c{iH~Z?UhbxJq z^+{XL_u94+l0w}oxy)EZohC$;#CO=zJ-EZbk|yOE1m^XAk3b9Lf94NY0c^d&vU3Zi@P7>Lb#-8u_Ec`s)GY6kW+y?>>&aL)1R8joggLFatd0(Tr?|kCxP4etW$ts`sC1ck_6r2&xQo-q|XhFE!DrX}4h| zLv()tmHD&^ZWyzsWU^&)_@U)$lAr(0+72TmB=+dRgV~CBO5XPaRUQI||3g80^OpJ( zlgO!M(x6;HY%-~hr&p5sy%CRDu;CNMf3qfB+mRRxo1CvJF;fY^P{^5qYW#_lg`Z{H zktM#?+0be`T`r>_C@@^ZX|4W5Vb-sl0NCs@N}m6l@;_E4zB-VrsN4?>le2lH_|+hf z<%A}sIaFAu;H$J70?(Mj`EkM7)&GngMKo8eZHP4~FR9%!1!=^uDXs=&z292U=;`wQ z$joYsZZDG`{{ds<&v!mm{LhJBnbVSlrvIe=_=KVxC_K;`&165PI8WI)U>*m+_KAIwN(OyuLR9JlXI@yvrqEIFktz-un(i$hEZx*zqc zWGof7=jkTh1HY>m4}C7>V;v%*G|Fm7$^TORli-2-Kf}%@`1#Lj;)M74$bU(g_jv|I zP%qejhF|ReXZJzdsOa(h_W@QI^!q?JY5TuNj}$e-kbWsX=~XL@222fMi^J~=gh~xG z!sVPnUITLhRxsBG0t=g(t9tQUnG7!(hS5Y_RyBq zKaeg52rsH2Mn#SBm{YrDnMpW@dF4``5&K#BkwGdmzA~#elhgB@VZ`D0u8@A0%r_3? zD1;oYIL`WPVZ)`SlW{&j^h#m1>uJ{%#Z+n~=&cmSypi^4+HtajizQ$wXeN&^(w^&5 zz)tbb{q9XGVo&)@Fr0^cfzP!0XWe-XDDZtpx9yx`NY3^cnr~A=bZN4azA&1y z%7(9WHysQ|efHY0o*piI{%}N4Q5vcMUEjO_ZX%M%3 z9gJy|p__+k*Lg13;i+Id{-G2AsZe8hnH1MgXinejK*IohzOtfZTfY*#e-U}SKJ`a+ zw>n$i%A**(^t__y5FwW=v z*y2KZGivBFE*F>u>6{rmGV7GlDIt z{$odrD-I`$?S>JPC(|GugzrA&Xz zwE)i|dxp=)Ynd6(lv%qfmtb!Z7C8h`XVZv{k*Awd@0cn*|Kv zcp=it9p7$?jOPZ~$58~-;a8-r-Lz?qo(t8jF0>+_18Ysy& zZ0CH&n~Rw6ZZ&y>5quImvh?Zh))zICjj#Bx@eie?Lck+T0CCmLkqk^z)e86wvL zp7K$@4cO{12d*N7#Yn_){QKR3o&ffvX=Gl6SVQ>R`%7!6VUcvOF^& z>`s{*x{!rcxFc-E!E~+@O^OSUmm8+~xSadrUoO%akFnLt-wKlcc#sO0-CUy;*6(bU!cWwi4H7mPX{yIox4eTXB)qwAY43RG>-yskDVRW(ic&f?FO_ zuLsRL1!agMyqtdurr6#|P=14`KpeqL({f^X)1M(yb9#+F zkw(R`S_q&H>F~2M2Sk)DPU3w3ke1z?p{_YFWH0O5iE63{ zoraF?BG6He2se3#A~<3QXr=~T_7?EB1n^U4RolQ9N8wnFBuYTpolEX+rAZs={-Bc( z*B;-qSp80>EEI1o0w0#jA_LHiUj1Wahh3cK%UoH><|(PH-+%;?QA9eYITxXA1Q_cR zrz?VGXPb+3c&kcD_uaIj(@8%pK|J0OG+x}7Z}zu);6)5J7hwR!4;qwanU4G<}&+$at|9N3N|DPA8Y|*amAH{zms-oY};r}~gj8>~R0jl!k+KyN`jh5(dWA0YlM#2sl z0F2q=$&Y`b_x@;4W#yQN`VZ{U0{8#GIJg|U-P7r$H>Xia}* z!%6RYgK(_oV)`DpcVs#|4+9th-)XvSvy3N9Sx!!zX9^dNVMJY$TwAe^qnEU*ZGz)u zAQon#GP>M2o=3)FZx%<=xF&S-*aMyvSdr77uw_*}lMIFmDc07tYIA*zepYU!iB^1W zWm;L;Ae7cJn%Flt^gk!$ejk5q&~O+ zF?i_Z0%%wf9=F|HFGY~677BdPqG=-T+)JDDazSkYwBYJfZY3W~4)=|9mb6Z{ zGK`2=mi4-A120ES`}<`osSbFU%Y0Jzhuc^o!0!UCfCB6ts1=9J0mc;{JYilu(Q1rG zf(bAZ+VzracPRf|c}_>%00QR4Lo+%o(S$r?;Ibd>!0obIQ3i_;SqYS!A~F3hUV5J^ z4bpnXbpLUzrqFZ3T=J(+gwB`T)D*yFU9fQehW&3!-r!JD?OS!;sJy?hhjL9HRPkLV z^U6446~UM{71y-ScvWZxw6hkbL26dtdN~ncf{9N%?D*ov)PJq21K6?2ymH{8vdRO> z-uC!6_t+?E!(a&CIRDwKqc=S5Fg%`a)%RAYKYhC?izx;^)kpvOkUgkMlPW3LmxGyhT>)OP4 zwt5Jo+TVAG?AK!f@VSiehB4D3_*-Yl&!`nn?e9p4?p%R&&hoGyc=hL@UCWeVBlXTv z9!D@_pS88G`Cp{r^HCKo?1dqLdUy>;E2cEFInO2k^0PxZ8(M9!2SZ^aAOggq+N`Qa zUV(#rx!PyjF#aise8cIk4NHw|%HT*mDGg*8JvE3D+HzwMfaJO|P5V(2a{5$GOl}70 z(W>s|qDf42PKF7NQv}n=wO^{s{B~65`*XQslF3;rEEMvVv1v9N7eH~4{q{5|bEml? zC!GN=iyy*WX&N+5`esMbo7mct;~;lx65n%S+00pB=|SbAq+PXh$GF%Zc)EO z;4QEOfc>Z-)#aw~xiZtv%7Fp@2Rbb`R;<2`R(&U%ej0+>&pBypTaMS>A%xIs_o^+W z7C#mSa4}sba*LE}7h<`5+UB4Zj`+L%@*nX~+=}=d zNo-Hf6y0Z=_HLiVS1s-;u18NZKui6B?NLEf3KZhgHl3ogW9y9^5@0Q<_HDIpJA1)ha_*Rhp$Yi}~o* zjW#8$Z8Y@$ro8&F)dZKMIyzU8oRMaW<fO$O ze>(=3e|^4w59T2IjaD--Bol1OzTsBHSuI=u%#57yHGFSMStfOt{apEZMt~N$p=!D_o2& zacK*Z;xzCQWF7bg^Plq0`u{8MX4(E%$~=)J#A!FesPBr-hl2!PDQyeVjY{iw_?2 zm9Yuz!=(Y(s8fk{XMBpn)NP7bVYlCbG5SAYT7EZl#VFp55%C&7{ORL9HI1CfY`Yy1pVSp$}C>)`}XV)ONodxPCyeh8O4$_r??X2q{e=z!*<- z@pgG=rzO&MWpQB>#2W37vW!wDXSD3@!{+vtEIMhlWrX1tg40qYeS4=42orT9@fa?E zLy*h!FGctmr$(_k1!;%_*lc0O7%ZHUDrPhq>usx#Xyfi5b5-M-7p_ZZBeoJZH4)vB zfurfH6Gk4hATdfUh)QSzzIJ~EC>+5suU9J#ft1gTE$(wYF9B-PzDB4mRGStwI}CIstj!LKkOo=WW{?deGIE=_D>rWR8?`fsbT{ctz$MH!AGC`7lja+o2EvzLD_eo} zYN>`;dPRF9mc&XB;&&Bk@F8xo0wwYbkm<@IlA+wy`$Vz}q<~QK5dj6DyuYnGS8#8j zhMDf{6Afdg*oP`2DnA-JN*og~R4WM>lJd~-Yt3jZ4DVEfZrcN=;C>$dYh+{E>vxeM zv#p8xTi&Sij`_oT_pcyV&4Aj5cBC)WVeGWEjl(R9oZQmyemw~?Cpy@W!I-k zOz~u$iB6iNLUiX@k-^$WB@Vvo*MyTd~DKZ8^te3 z*051&l`Sv$IM1sAa!IEiJp74Lu`|VF4Si*^pHtGKGiWa)DwW*>dO>aG%M{CgLZT-3 zmN6edGvx{Q952lTcNnDKzI>1T$1$My<>>aG+&M@V%;X3TH$Plv!hN=l`A*kw9n-<_ zng316wcKMna~oJj;G#Q+5^^G*^6DVc&P+r&wzj`T6q$<)PB{F$6N~dm-Jv}G%Ow2E zo3$uBmVCAocG0jrugspA$2<%|-;8p_|3OtxXMjJX+$%Q~H@1@MMvKV|1z*X*_5Y5f z2_OGv88zH!vd$|G_Xf|nrkBk_O3A|fSvIp=x4s7$X(cQVuH6qS>9h4csT7wLOr0lL z0)g80Y!@MjuQHlG)iadPqg!dsg&gypWkfx*b|cl~aw(2`3`ts7;OEtB`ZtlvQWR=f zN<^wy>#A}3`zut>ofD6&~UfgB=dlrP0{6)tnbFin+M$v`l=Y9OZNETujDsi!v#^{X z%0KSQCqXtVAlJa`G@mKM5#gU5Q-5Zs#-OqFZNMr}Y>1i?woa#D8>-Y-}B4I75CCHJYy2Zu|fMJeJidpq-SEgWLg0X;& zM0*ZF2X0unopiZMpD-Pe<%zGZvwunqwZpr-UZ%M}1f(T`(JBe4%6Ga3S~vB26YoZg z1W+?Bg{X+xO(C|YS2E{$n3B1qsDHgU8_-Z!Ho{K+l&*Qu^y#_{mB`?4L-O>6E4S0i zI{uJ(Thn_5nR7_T_egfWF_44n-W22#?r} zk4r3#1Gby}m(^d4^r3s1&MxounLmTQ!K-oq%vNk)nXO1RvCVr(qJp*iv0H#suj+Kc z`xrf=i?Tutp|{RyZe|^GB;ec%ld#)IVNi6C?#*EP>MsGVql%1=f^2}J-TsQWRS4gn z{&<6r)+pi=hHz#jv;S$@YbdQtZRI2ZN~tvwer9da?~H^yT5_*{-VzC~4zXfBi z0;X*}Q!~TlNV9rJi_0sp?^b~3?-SpObgUzxnv+q$C6mF;ZMX&B8PS}#>^@Zr+?{?c zhcgu!Cji~Vv1ERZLSJ*dKc?GdF}i)}#u1d0`ska&!+`l^6dFS`f3EzfdiR_PgVdL( zbx!!%GrU+EY&xXZ&aa%Y?X5LGBeH0QYo|`fA>Yw*H1UMcHLm+lQZ4m z@|fWmqqD%q7Pn0U`_8hZ6UC3spoM2mABVk641o{nEzZ0|7HIe_ItYX z^zDsEFixk^niRJz&assS!rhAZy09q(ukYQXhqQ*9Rxxm7$ z$H-3~0?ifOhlw2eh_|kwKXW}U50uvJAhENH@ z(etJWc^!J=2W%(9T?5P;I1EA}7@WYK2*{q~V3J_{IQ*~4kGUM0vI zTNVWa(`IdFm#v?R_fk+}#ooFqH$5?fSp6D(#sg|T)q@r>&f6U_2k4Lc5PauG@4I+m zZ3rIm(r2HI9%&6T9=2`5ehFXN31)~i{t|wIH-x96a_I9up3yQsR8yKZRp#&{fT;_B zy741`I(9}9n&HY0`TH6l^wfwEdRZ8u47?ENQf6x`?BGK~#A6BpOIAX_Cl4M!EWWWj zenGH`4-2-I`B+Q!f;)qfAG*|N<6>O6t{R&IDbg1{H3do7{^}m*P&7d^&QKn^QgX3@ z!cL*mpV3OtSiajrmY0QVa%q+IqNm{XgOjBWLUn6K{dgT{($;MNE}W zg#9c}Z2P`uKSt(H90Yj`QFp~mDN3<#4y=7<=?ru|j5aM_y7~S|JPe2c{wdm+epOGI zM5o-`PZl>5o>g52E6=@B^hd?vfU34yb+=# zSr%XUUJ8ls&KVz&=}NVbedPAX(Rlmes1=s_l@Kt39=E2_G{IA#JHrj_m4yS%iOj8bTAQ6pV>r>`__M)r3hB|k z`AIkC&lfB8htJwrixx@blnQ$Grrnj-Zge@Zr_3sXffO=RYQnze^LZZ{eHAVcka`PM!BPHBlL zSU8OxtO;mJ#&1dZ_du|M9l_sOy1BIeS1w_xUZ)AzMp-h}X&!yFfxbicpR9En+G{pS zIXkvK*qXKv8KZ&v4C{acIFwjq!6HCD375Vcy=<|vlqGq|yjOn#-d}9r9cZ*Q;i{M$ zVRS@s`;ZF$Tz=TO<#(ANfBlbel1|Chx9ViZ@#r9@ep_(^d6 zPfVpy!c@{=(s1zOBvTl9mQB!^O9R^cv|T``^ky>gyKT0{Mv%WQ?qvq$p{D;|cx?bV zprxoq>G3E-UsC$hh`QG@irR!T8bMA8*b9cHPVv~~!<)a-R~IhFh^Y9mzS`!UXXiDD ze$7W7O|h^KbKO(tF!(RnJFLL1Afg1w`9lu`nRFp`)m2{Df_^qZXK@bC1bf~jAtbv= zZt_yHOgn_!;4r}YJ<%ZEk5KN6jS1km6L+U0B9V`mu@N7VFtB)Ge~Llzcy2$Dd826uOtVA;Sx2<{#{cyJBw?oMzP zcMI?$iDM9jW@ZP&mY0Pdclk%^Gdb*4KWs72TItbV~_1 zsbF%Y2n5@vUcjTU6SU8#OZBpZ127Z3Y@q;5x|xvZMJLlN}gn&<#W z)SfxD0J=;04b;HTfxK7s9)zwK&Q9&wr`BwhEXllkA^T%6ow3cmtcvqW?~G@#3XGtKuP}vF<<@c-ZQ5fgE^Z{F%1>l)!tD}-UGRh zsLzs9Mb84>%2LNsOYzRI&T@v%pfUUO&8$;!uMpXGYw(L#@ma*1 zde?m?U_-KRJn+X7dW~((%khan3I6=b#6!cIR223`f@YB6OD%Zujr@DE+!vg4->!-^ z<=&!?1@MTkl@Uu_6vHPp-u(MUePk>zLdwMOom#qHODYK#=)aoP_qT>56Be3_-{u?w0U@O)Uhrewbn%BUJ)^<)sH|Et*y05?W z`ekol3OYmrHTSCL>4)Mcn||`7KcAu1z?C%71l;y)p1q$mM6OIJ-}u~MnWr-RByp*k zp=K-XA0mFz^Nqt}(enL*?c#4}k){G`uKYB97RGEw0^&ZbIaIP>&g#cT`{q|G-g6Xd zV9^x|jdEA2v_LX?1;K1u1oT7Emyy~_?bJ)B;~wV)+X{A$X|V@%;$8*aJl;tlbj&Kg zSjL~rI7s(Ws$8k!y;?CRd0M><99-G=y_>dtoCh6+Iim9>*E4HuWb4gp51hFlz^fO8 ztNLEf+?;Ui4AJZ0^D3KDEhS;YhpcEofh4rUsb7V_0{@G%6=rw4>z;w8!j>#kC0pxW zu~4yeK93wJg27nd%@pwO7+}*rq0??bWAoWCY5 zyngoluH?N4F2#@M>JAl2gjlV&cK1e8Y6KB}luSpj$Tct6yxnjlOdi1h=v}hZ8*hwk z=dN=?eZ%DY@d5#RmE-5uL5F(K+aGC880)FIm-3s=->;?Ws;V=OnV%&7J=avdU!u64 zZ`>9}YAJApF;ryqG+#WqN+ARTEa@F9{- zz}6)D8NTc1x4rEp59{%KlBCgiph3*0g;$n5TQEi%(GJbr@wk%7f&F{;x(5Od0J$CNKMeC*%%Qtk)&J5b{s;rs#3cl9x)zZ2qUAZ}bX zOu{nwp1xd_}GtRvpG6oCl&n-|Fe=O!l(Q;EamxBCp2PnE|l3<>9FYR;I4 zsd+XeC$J{EQ=B--7`O(q@{^yU_#4*!Y}pIgYnlmE{+-Uuk0-Z@)HCpWlSQuS-ko%g z+wjXbBZsMw7Ml9NH#Z}l?>kAlnibSo&7%7yNZQU*X&``X#lJyIL67&Eb@yeK^!q>9 z&t)#lD$9~8Eq)%|beH~Ys5`G>_U`ccC&<|+fDPx3^rmq!^mJgA=n<%(d5rVu(LI{L zVE2~riXox?8~s8%d#8#D2X`GQ)u?pUNnLkO39fty%zhiFZe_fjlPru6SWS;Z{azxklRf%2pPkFssWp7Hz6Sx9|i9j@hb-Br;oMY+^|GyYda7u7UF)DOaS{*oim{6kSF!UiYBM^KCw0$piLSGiUlt9#XQM;NhMh0{U=%M2HSLnnjct@;1~^Fz`;O zen#n_F1!z!!XIPM>zdd>=ABECF;6W-T{0T9N9*HNM?Esu>i=Q5i7=JLt7A6P*5_#n z;T5`7>kx9Tjpv&-QYdwk+Yz=Z3Z14A2e0Gf&NTC}nzDrt+O}*n@d96MbaT!IC9Y1^ zJ&|Pk3wJ~voFxbC?-i^l;UH_N@G<$3E7tAJ^jC~(eO!n-192`} zwvjGoNQj)wR8$wC(;5)oMt!aWA6G3(+^xUcp99{h!#j3Ncn+0v0Au~!#Gf(*q*H|y z^p@c1hfT}?XykX7BVhWq)||P^hT)rC`o$e5JDf_;LByv&5K?gZ1BcWv^RwKVDD&YnIT9Qzx?fp@q)#_~Hx0`GaYg-IyYkrtwYVVoOwb)1Ze{sVmP zxS$z+n8;nL$4ijY-M2<^E6(WYrN2%|0$(($y(6X~)i*5P+Fk0K`+U#|a_&xJALfzQ z+E*Rou8OI-R7wM|g3mdcq*K&_JMp_+r45H6l)E72OU_1;;oF7_Vunkc>XvPW7qxu` z5X67NVabbY#NO?TgvSn^s~P_YMp~Dz=for2qF+4d@|aqH^^BkY@z=cJ82@Y zZE=^LFu@5_7?)JIK=h~X;T_Xjomp13w^Uz-nN5&eDM_;tFRZp>RNp34kq(A3&(LnIxKQZJxEnCi-Y zPGtb7zfNNuXREfNh^TmIpi^J5Oq>d2HSvvJ>lRXc4Sg&nH8kii-ey#S0O^`!TwUyo|@35AsAjIcfy_QL13iOcDl z@nVUBlIMwk`BGYseAG7?u~}rnKc_ye;6;M2e>wRBwX10IjGopqte?SRYi(C(Ow>W_b%^kh}=-OpifsWL<_3rY(iOCHV67S^JkRSa(kySaIe z|77fBP$z9GC-sfAEVuntjLJ=;vVpuCj)D*A7EUhTbY#ui!7hYQXg=PlQC&WqY0V$; zBZ=*I6eD-XqTgIxbSrXcXd%n>Lpp$xe~z;h*R)1i?IN>ec+W^2!T`@Ol^3P1S%lWs ze#i%smfpnX+$336?XA>VCymCl!@e*4>Z7sW^`&(gck{^L05y2~tWJXvv-kqCKdf99 zKVvg-ekM1$Hp3Jy5|LE{OZ#FS{=N=_^F>QW+KvEc{hL|tH^0J`JlT=KwK#zL!E_(a z>+V;K$dQ9iPnWU$S@W^tXD8=^GZfFJ%i04J+#%vglC4+xycSlOk4kqio3SsO(H|r7r=#;dscMDOT@SC|P4~;Qg1yOo^o z7U`nuDjx1x+-!YP+_0n~9n6)PK9;K_ANT|-mt$_2YpU?_if;6z7@g#Sc8ZBs{13^+ zSdDtNP##;Tn2}jefQ+YZOQ@LfEbnFBiGynfMpmH1O3(X5?Uo^#ZZ|-F+8^?j{Mo{y zd6BDcqIQmGI|O;e@ka@zbom$N2}5k0+C#$J@7a!fabkfavs-q zo82qeps@loQR%@Sxa-ViA3Ae#>ef=VC|C<#5h8cSK61g=kALT>mxl0*(V-r-c@2|( z_2jJcj5IF$b!dw>xLjT--=hRUH33_0xP8Whr)_2_0jf*V`5=v;%q`hT*Nxn(`mfET zq&92Xz>tBun3_%VW{y z43Ip3;q7{pl+zkyK^-a_fc z#0BrhZn_Gfuwx;nA`tOZoXnQj6Z7v}phFoUqO;4|@gGM`Fzx^q`|x|Iy;{kQw_`gS zEd_sG_R0nmq0w?IB9kq1% zaSvPAVfaUN;oHd)H<4_=k)2Ffve5C4E8y@)_o~4dy|~OR2iDfT6h2)AkK7)Bo5K@?UID9~Jy2lGc%jhKBaqk0I_Y z4{|~;37DF-$M4V``b(XIKg?j6K4JCSR661p2h*;tWi1<<)nfS&+d~MRL@aKqERZmd zu_FGm;_Vbde|vbG&Y{cm-??l{gu{)QhXR=pp^6{C*k{!dP&MoX3-c4xd(lLJ{7$Fu zg-#SBd?)lHdmM=2sliIEhUk>6^uy&lKd)mAg9+g?(*(udSyo`5?m zp23(r&P zn6oj5Dfh7r8vGn+fio7hA9JSX6CKY#wRW~T>;Mgw)(7uRf1Bgo>-XQX%d1Ab*yM!P zW>EENN6)Lwy7;w~Icxg!g@k(B&LmyXp%+xF_{*t=ko&hb;>)cl%Ro~#kVY{;f7+4h zSkbMrCihJD?%gC0M|q%?3!jxmi^IH*{y;bx=rL{)Q{iEvi0l%n3x2*rEJ=Y39l8Hz z>IbXrpOg#oXJln~(SYw6>!M1;PB(9`SS^zMd`2#QHUIL>VDYhG7<{ z-8g09@-3FDy<90aE0dVV-l;j={l`xioltxBl)IQN@RLZ&?KEvA!%qJ5N@ArL?_}9A ze07x-XgTrIvfN>aEMPwXx{qNt&*e6W7h!4ItQIW%E&sDB3HV`oa&q$c24p%Bi9uKB z5eBv$#3?16cxtOhooeJlqtKXqdn20N)`mu{OnTt<@wcTezxZ~j_H1CraZh@eN8`g9 zA)T({1s_IE$aa|zMeq&z(t6F>XGwIEJZUNAZ0b7s<#!l?bM9Nr=F{CetUgQJoyB>B zZF^DeI;v6~CBWC}c{$qiP`mH9M7XR$&{ru}0>`*;PQpJfOV;<@fvwfkzK}r#M@-SM#d4Nl$;X@YVQc>llJMdx(~%OhzQrAAF!5I1tR@&|A|s~a4$FZ?c+wx zY7%lbT^oI?Jn;u_G@_r7gV4KKB>1pY{N!m$QQeAz->ms%+YPINSE-zbd~F*(#Ok7A-|D;ZY87?99x~XZU2)*ZL+~!)V0lE~=3ng);<pzRp^;Zx_ZsY~|Bw03}r<8%RKO>iV=BpdMAAsSsdW89PYx9dD|i2lVKgRpKY zh$&zoe8i+to91ehxX~!E=`h?^OouR8-t~OMGQtQ&e$a#XjEKd%at2bVd2+pNT4%-= z+ndgi$kdNHVlQ|~PUH9KR3T3?8m4RlZn6#odbYDL$Yy-|W8PZ2zNU5D4YX0w9*3Hj z2*OoKUk{SK3i$bP+35)7)DXc(L)0Df`=BNKU{!(~9%)-fCcN4#%G0Du$LV+GC3Jk8 z0gXa*qL#vo2cVa~ca(bSXCO`7VLaA=eA;eI)EWGr!JR`zQr#whhgAG}j@o^!Jpcff z{1uD3;J&8RP2NZse`uU^Oyr(pqK3oGrafcpw$f1pFJP+dL*?_c@Rx`8Gx;AA8p^sI z{_3ak70>$*JtJua^@0AESN$K!j{kId()|CNh-Bf%O@XfiO303WHmG*LS)367aNcHq z8q)h3u*YFK-16S*Ok2d4LnZy|qv$60KuHojOKSCD*;foC^MhH(nRv${&gXAPTitvm zcOyGLyTN;Iiax~h1$H3XiRI$nmd|4`YV5-|nm^g;)Stq-SSkr|DAfy00PvO0xI z_koj>vwZ?kSO4+*bd>Vf!3R4HVUgIq^+5|A+CKcw~UEolG9l)ixjtbe#%;{XUP<``%4XX z-HDM;s5dVOzG=H1D^_JrhQH9%#X;xKDr>hBv7{_OR9^W$7pT#awmB9~ieRG=c^Ank zyNk9l-Ozo0E-?p{65-wFiB4DEL6hN)3E40e%`)e?{wfOS`?KE`LkC(#kCGHwVBWr` zD96sbEn~*TXPcTg9*Y~!;cC!YM`sGmVFs$tQ9V9xiOF!@r3OsOeW5zaX8vO~X)`LC z)6$Co^y{goW@7Z<@FzW^TBm41shlyT_OY+svFbMTPwf#-Fyn9DjV-v{k156Yl> z@=TwGT5y>Lx|VX5V+&i@K70xL-Eqck&QWjo6FfH)4A)wwIP~2a-IpPC@0%;@#-8dJrtR+LqxT-}Pfck$E=l(c|D6k zP|4=!>&j{~d7rcJZ)DbyyKs8F;KJa{T(U?1kbhKD=TVm94YuM+%EIX}MkT{UM(q1F z#5*$2Tz>e09N_L%{jl8tT?#%!#9Q5=4diDIpPrFOou3%OGsoNc6|J2>h+! z`h#SQPma4h(Y*qql0l+}ACm-+0lO^$)+ChcQ3$R9T|%9Ya4J*J6HJUQuZ$qkC4-34 zQU&DE6+aD}T6Z@>Ps^xhU%4#WRnh{_or-iHT|BjG`L3JTTjSyqF8C@T434AI>4Gza zjqTIKJUn(v3UtA}YECo*{wZ`p@9K@7@|JjuMXO3m$#V4-9K!Ka^bJni5&0>=*Pgev zmRDsb3?VVznvTl7U-(gx)APtU4H!|C)%~V|jQknuXY24~^&&N1znSS`wVcMbPyCfS zPr0HgrUn0QZ8G#$;DX$f)!NkyKi6=>>3-7Z0LL!6hj=Qr+usx`Zg_d?NrGk7`{&21Ge6dD0$|Vt{KjzTLejq(hG!gepn;Oy7ur(NdTm-1Ow*LG0mZqB4^F|pju8vP8i^RAvfZ7DzXWt7~5nWVIY7N5mA*VR6@X!5m zCat;d5BPaRXAjLr<_`3tbbaqd#4R!Y7A+&l^ok@UpTQrx#T?*nUfzW3%b_1*IHr&_ z){8qyR&8gY(;yl5$9Ue&aRg5u5R0Xa;Ty`sLr|#~XP%@3(2($MZ>H zo+|unzj<##=(J0Ppp|J(Ot52RS#L4i5G+;+i%+{}#kK@TN8_G6u!ZNDxh!p119;Ma9v?5-*w$qq8<3e6Aa00SBrsFY z2_i_nHy}K^gVma@bBrfc{zeZktUU(ug)fPp@l)<@%>I@@q{py2YuV0knhF*Z((()W zD@(|H`~9yZ@r4S3xHzhu0DQQIznbW0`Lr@`NEJ=oE9Xu(9|OWb35Uc^)OPCpnGO2o zEDO)`ts(h?a|4qYwaGg*A6jm%Q%TRk@`M_QSb%=5NV7*p1ycUKKXn<8pCu|aF*Tuo zvF1`)Dm&O=Osm1 z^(})q^Rp@{q)mrx{Pi5M=)D9+{0knTnlj}p%g?Jff4LZ_GAIKKc}({2*4k18xi}cE z`pQqk#80>|u2Q;OR4SKd#%N{- zj$ogFDe`)l3((2_Wm@)Etm&K1U51#nNTinC;YJ!OLMICfW>&dzH_3dSb?XjiMAVop z<3rkQ8e>(6Yl|(xGZz>R^Bh=HE-y;oljI7`U?uVf33z#>bz(kBiyBeXE16yLR9h z^&-IzH;78b%8X$!cqh`v05M3;k3U(K?g-l6agl{#q69K6TEz&I62M*nCxbn$pJl|2lIqw$dD}P-pd*w({8|l1m7= z6CWu5h5QsWd#b?6Gzcr~IB;g~nUvn>bOqV``m`V>k{3K#ec5IlzqjphaNobslYR8B zf_BTj8CGuf8JD4x>{G7ut1lsE)oN|p8?o#&lprp$(T2)E`pUm?iFQ1nd7r5MP3kT9 zQSaK!e1u!5tmW7m!M7}5oBD~aZ4#fTz^T12!1Yx$!0%z=4sgu6d||{~#W)YTdWuBg zpq-j{SL%c@f`aL=oQ+K*4#NwQ2TOklpkSnxp2}U|!o(m6G8O7{Ff9YgqaVG!z@#>(awl#Tp`Ps z6ml@P7`N#Qjq{fgboaMfu!dKAETuyg9-qj5oX;l$%5)MuJT!T!%d84tTEp37RPO|3rJD5DXXbfhzl(=XzZ z&;wYG&M!)a)#}Z0lO~=Og70hjyZ^40KSM7WkR8^qovI(Jz)Ckt*rdNXE6&7%XyZa> z;hu>HJ}IWDjIQ1V?(T(}e%SuH92n@7|aq2$`aP=B<1kA4(B)k1A8|>99~D2i}8~4E3cgOg!!+%nbChz?RUw3GwYGJJe2n*g70005E@9cgm!dFf)}3+ zu<%&gIq(VS@&(2Ig_{?XYeAVd`p)P8T^~N(zEiYri9ou|D=*70{Nc=kPbTRT$n)&; zBPvA#99FH`rp=7yV*i#1!qAN-*l@w5%+wDhzpuoXJ^SOaDjGV%vcm8gizxJk6gD63 zx!-+S`0Jo&ME2V}asJO29&AdDv$udlK0ol|B3e&c@f z<_M4smnF}Rh(Li@N)xNTdq(-I)jeLvM^a=@S~ENP+$jjbwkQSkhziyej6`PwKfS;{ zW=Z$kCJ@L@vh?a=HTA`C8~Z-P(}>Yu-wyRU6m37k=NboBdj*Mv_Ea9&v)iikI8Z$p zSvJNb5XEL*z}5^)hU-P}h>n5oRpv==uiu1{VTYK8>aG(Vx2iTMc-YHh6%||q_#{;j z3&`7K&NNKY<__3;b3z4sCp(-Lyu5FOPU*vulk7;LrX!xIu#z9(HBNoWFs2TJkmQQk z_I#`I(4qA;`zQct*-Ikjg?SsutREDal(n73TgW4XM7F=PG$Z@;nH<0jCSl?=4QsPr z%iCYt`o})5L+bU=?s}0WdvNcqLXY|-S#9^L*$3W>_d@1VAbS-#Pk!XHQpp_w3(y(g z^s#~wrluU};powlN)s02WzK{`$8tQRch1=?!bH@IV!zf$GMZ7M4rOol%OXRCU$Gzt zPZP>UiT#yy?#k~`JQd)+KDG0q+|{QKFBCS>?|HJ9 zVbqkAG?7Q+td~=VK{C{96|25l>+e~7q=@nuzFb=@x;P1+9!j#=b~#f0@MCAyT=bU; z-{14HhIV03_XfZPC(AN>b>aG=s%yxD_iJWln)x};M9j?@Ikcz`XZ(oQyob6n`~saM#saeu4noyU;> zV&oKyfS3EN0E41XysTzA-(wL~7YjMCzc99?Ie=dv{tPq(_@VZ}Y8srq`)@DaSAQ(- z9&c%^g$8F$xPp4~Ulx6st=6ok*i}_!MWV~uPVLu0{RCW$Y50kRVr6vMEGsV>QCAY$ zubouqW{PQDOy_>|LELW)$4YA_Mi0xtky~?i8nA3ko%mZ-RY7bV z(d8w5G7iYC{_s3I&pei8B8TdVwt!h+J0?$*u)h^+IJ7#FEML0TV3*RjagPr{tQ3B6 zrQ%r4bbt;#F?W0NXMDo1rtJ1l-{8w5t7Mi+1DuooB_PgqEnwmeb=vxK36Jb)f{E!aPhX$!17bmy&&h1E#cc*NP1~vFp^XP_euA9VQI1ce~>C zJq1E0bh*`^q1Br^Uv8j0gi|DIXh*IuJ72VDoO7R(IZvzBtm8kvH=$8CDyyJ=Atlgh zFwdDHg;1tfToxr$^QnFLW3ePkmMRi}wwh@Yel?|&XBe#$HBk z?PFTe=-B}`rgNRRB9oVW1NBfhcT=fJ91>5mVZQxwpSqF~)V)dkAMgMqqvk0i!7hRv z%l(zY2oL`T4*s~gy$FsMqvRkpTO&5LBeL{LLfe2OH+`U1rHyHTaZ`4Tu@NR($tDOAu3i9{r}!4 LQ2RI50`-3Yd5GG3 delta 35617 zcmV)?K!U%Z`~teN0vu9FMn*E30037-LQqyvI9Lh*001li004gk0H%=~CkGY)5db*= z9&{1{OTO zGO%K@=KKGbxv`wgzmUIxIsXH;FN4Zb$)&O^$(F@vNtR{HwhU^6EOX1U+a$ZyCRwI7 zTXtKPZ5d=)W?Qx_v@FY#N>o)+sp@%->-qhjr+-K#sa(?)=%X;KvBJ#EFt7@92Kt7X z6Nl5IFnGc=%(I)*tKjX^cbD}X4l^@za?fl-J7#9a9Wy(e9S!aRy~?a6%-kov3p3+> zRyoHL<}7Cy^vU}AhWYNiA7+Nm-Gw^W;SA4B=S)_)CmrTwl{pMy##IyshnXEtR-Dx@ z%zx<)Gp(38J+RF=1Ir5CI~C^i1Xh|HP8?>2duAQZ?e05aX1FKJOuZUh@ys^NoK?2H z(Y#{Z@5m{)SncZPwh~-QC^Y-HHXR1H~y;+##NL8vsyI zs%_iWnl(Lir-Y!=ox{HJYhTyjygpuccYo|-??V_s%0>|hm6Fbx{!?HjNpM=dwJjYY z$Lx9GLt^`IXODd0vHpLVV>!DWo~}}zE;v@gAMyj4@(6ayF6Ed(6ym z^PvS)W(P-@3bdp=+kJga{HM-61K= z4(#s0Run`+>fmtz05pmI|64FdjvB%k2=WM08*O2LdH4LQ@3`{H?gEVGtP4-?M5SSr zFxb|A35+DkZBr{Uxx-nQBNT?zm;V8WM@m0UZ>Jlud9>GF*?&AzLTG#K zwO9T*?~%!)gVK4#;*rupJKuv2+GDSLb3We`9xWBn5+23#D2_);2JNcu_^K0~?;d;Q zm-8|nMXcrRb54i<7ciQ(kc8r&9S(<-eWyVu3Ls7#-I|aewXfRC6f9>NlPu z2kS6s7wqo4DI{}>H9K<7Gha$sqwoVE*X~~^7_(-9qY60KT3#{hR%QDaD2R5puI)5)2Pnb4D0~$Ek`UczP zN9FKB7^5Lj0S*pM&mcIr3{rKe2@$ZG~GvOeg{ct zYz+wBdbZMnF(%QGIQZ_~Z582EX)(>YXnIeQ*c6HY2dCb_J2R5~?o(vtoCkH#wXy!d zIKFS3P6z*2Xn)qPDJuBe01Q4VQcbGoF#rHCAu{}|n{WQt6cqIn6Xnl3DU(6do@meD zU^|+s-a6nOA6wGIrgA2&MZgv*M$dNzD+XMImfE~v)jQq%>g=F{QH$SmbxrCR@x6;` zpHx?Z6cr&ILfw25?KT4g1FAN+XxcVBV1)n%DCW^EF@L3UXaT^%7a3Vop%@y_z@T~a zK+pVOo}cv~Q18H_ImI|EoRP0q4fsK2jOX487y_HN#d~~~Z0T+Nu0Fj?u4qX=I0c68 zyXDh33uKly+}-utdh$lNcra+OjeioB^=pW3Q)=>=)FvPuz_+6t35{9Kqf51-1^cEV z&l-)ENq@mNR%BSv5ExO0ATE2rvI^}bVMHZiKPolx+2d#ii=bdEwU$q1P1+QIHb#z_ z6NOXOM*xg1ecp{Q**zu}&JGx=wz){U(Z>P60;?cMVkvjzcwk?ts9C|$GyxR0)e^*0 z_#-$lg7QSOj@|)$O4Z-nJLqBg$ZiPbN`?(@zkl1krm!s}`#94r^w2Gr1_(NsgbWDY z3CU1nX?8j!SgjlaptUB)Uz_Z(_D!5Onm4%x?1^@)0xuP27||>$0kFV2 zIXK93@gFy5c%Io6bg!Wx!fXP2zMD4wa3D@MqC4W3VUX!_&S|#DMx)D`2Y?CDUV}g+ z+x>jM&(j<(vN}%!=bJj8D4K_*d;L>_Zht>ZqD{SX9%Fq)OHrU2S(DWsUb91}i$ zXGR~Ef{zfv9of^;8KK3qgY)rMrn_u902JhA#H~RP@*<|_(rqb!VvYs}J2I*ywSQ;w zob-@pcy@Yeu(;1ZPTz2wzprq7G=wg;ShLm)l(ekJ+PrB>G(dv*$gGoh0G_m?gDuB( z>~SN6v=i@})>J5?Bp1NrM*c}4o?M6WL@(8SQb;B$fO>WB7AHUX$+sz{@uPIZbq3)O z_Op)SXiX@a51q?8T7)oYJ;wRrE`O732!+?!wyI zXMNgNlN3OFHYY4GOxLfcJlRk(@4-bzM~)CnGi+~J*a6ahs1{k`W+EC^qkVz?R?8!g6 z3n_TuRWF_eDDc!-mH3jZ*?%`#Apmqzvk{Eu=_{zY=Latd02o``)Xn6L{RA+9Y$REl(i1c0 zA#)j`&z7o4Iv9$_OJ&~i=K4GmnXAZGXSf%s)WovKy**YDZGYWY)R%;?l+M*YPxBE7 zf>^;Dww8OekQDR{hl4_WU5P(8-Qm!g$`B5Lz=X)o$PX*6_<+Znz`I9tjy*Zl92UNm zHx2PQmRBW>%^^YvC0ZI*2E$K>;ewP0ty=lt{c=ej3-~;yyC^JY%-I;}tnul0 z!*)tAz;Li1bbtTov~f*u=$G@mfzGZS=Zq?9H^b4ho(5SRRsOXr?t)A(-rHG7w~c9h*(o4SV{RYp=wQaP9Hr@= zJ4j3s3q>+54mo|bWiOJSbixYTw0vnpIR@=UUOzcdSARc%qyW%M_G|dqb2?M;Ui)$r zfG5{s(AeAm-8$>z;Psx)vlP4PgfjToUa>)%pIpBMq=O4L!Vr7 zofhae+*=Y_Of9A5k(2gxuWCLb^ruqH-caYARE4a`TJtf>(VMMn{&qUV!1fh`4qyuz z_3g*z@qZrjom-O-yFH{xit7kPkGhxWwFsUBnK*kfx2yx!VH^AZd|Q+>g8VXRqi*5b16_udT>|9>!eU>QXg!=3&eCf?eGqrupMhF*kV z2EPGy*sOcXT_6k{Pw%FL!NKND-M+N|fIj>a|0Z0k9;D37h|EsOyEaK_>QRyjQSgKY z@`d4HdH^dV5Eycs;ZIWw?n=2EOysvT!bLOqHP}md7Tko(RnB4B@qAJZbfsb9Kq|F+ z@_(FwVYU>7693wkMyzQ15{sL9%X&vDTFcYzuPDZrJ@0sG=dl@-?50AI>@qCi7M$vE z>KQ_k=o=0+HWv8NINA7H3EbA885sEJd-p^E2ghwgk8PeZkARS-Yg##!5qJQm!Ju{P zV7FT~O)S*J>k%1}@;#LO_WddxY+re`J1Jp6J2ROGRV?NINpvYFx zG?x&-R?#g#e&ggk-79JUz*xqwH`C6;#sdU^`lgHBTZW0VSNaAU5C%=W0-wGwDdKDY zC*~EH?1)D-=)60HUIydw)o4nf(SNd%#56=@;sQWu<94C@rqwiXkzi|DofsEn&&k2B!j(0x zuh_6mc;R{7T5|qO5ZXLE*mN7G-zN#+gV=0O&6n~7;4V41r=VShYT zhH|7$>l@_^+>cP2YC2f6ZYBn`DP+lWJ7!`Uz)QWs?eSC@Tma5WLVrMsn*&34zxVx| zPG^7Dw;JUxs7%FIlgnA}Tyi%I+6}*awS^TveaoDY0iz({ynREjV>3|*NpAs->d}q_ zTtm4%Elsy|)-gV|{N>dtbIM6s>7<AmSh5Q ziFGK#SNCeC&!@=nD&mZhT=s|-_r#CW<#O+CN()ZNZD|U%3+4q_hkfMV2W<$J%s$#n z@aHCf!A?~JF3?m}nYtBNVH)a=Da}B^t72Ox3R2yg6pLrD#(#f;9^fwt47ovbRo*K~ z`Aj*yy>zCFGQ`9H05!I=GAEg~=8TueET<3v;1!dqA^M78wp2LqBBQ95xbT4RtYsgf zx$qq%bx)r}f=kVCFU#~r4! zc4xbsQl3Mpo(`tYo_FJ=M$pU0xS3%R_j}Qrso*=M|9ZoWC%(1wP~$UEfZZ+qXAsz? z2I?)UnTsqktcYCpO!@k*7BgC=e)-(Xj@VsYbfMyptC%B+~Xq+D4WM)qx zqhMt+AE1}KCeL4;P?!w>fU&HGZWeF!C%}70)5OVNC!Y^6%$91rxP{?`=o~@BS_Wvw zG8(#mih1(}3_x{ji65DxbpyZ@(uSsn0)Kv5X@A2BPwkP9JoiB9il8$>EbW7Xn;2M# zZ9s@C?bW?mc6do`!JzMEfe-&|stjc*9~{r{6`o7mV5dtqvl~bo?rB79Kz!t-hW7+X)!*7W*ok~MKrXos z0o^9)E&O67@p9NSZbF+2%cf!^}k?sRLcGHB|~0xM8} zTV#Bvg#@=I#o*!n~|fVVuFL6L^|TBov0ZzbUcAs5W<_F?2^&gLw^)g ziX~-hMVM1id<}uO=1&+5$#=1)A{Ug_Bg$E94F&W76U@#NPQ)^#k)AuW_erG7A$S=C zjaAj8X}@AqZ7A^t^v+cOoGu~*0DzKqCQ6dHbFe$LuPUxwkaa)Gtfd}(wlrE?9*Kv$ zhIN1jwA2*&+jP1*s60cf0S>t!e}9?@!=|x8L(B@U>D&QoS5AZ`C7_Fzov}4<97hH? z&wCtRjKH^hblE!K+dXa!zPYo6^}QSRMLS}KY~I+qs6O$fRMlu>@8Es)$>oBMe1UA% z!gz2L@D(=RTlYaIsYj)-)a3;QnpQ_czxr9?9-FTHsBRSfo|7lQ!G6H~lYjHt9nsXK z@Vi0It}X9aT(Y7^?dhL-*8_1YJWTW9DHE+A4;k%_zLqs(4K7=fnNzTF=%~g#>uFKk z+q%6#;(&>lE;`#smK-N!sgZBnIFDH{QPOE+*WBYPp3|ieT!5C`$-D!fyJasq?;al?zXNws?gWiM+_tMD zDXu3JJ?mPs^~jxrvhOcWT_GpFnPcINpX0j*4?1VlAZ_?%%Sx;tTz_^hKVXr{Nl(F^ zH%2qhZ>{9IL1ky!j#wsL?4VKSd{JnPU#LAi8(&=%x!;E!q6K5CA$Zz?bE++rX`zj$ z2mmrMO@2!hMoQqXOyqjt?YvfZ9oR1mA(XD^HM6g*Xj%P@DGJw%cY#W zdD?bXq`Xx#CK$t@Ky#Z{{}A(slN423>wC97yg7l;>5OuH){;rqgtE!l7TGYbM%qaG ztGn)GeN?sSdw)~DyAD@pWYCQaIs0&tK-;~hvMD%bGguDEz4Rmv>CzvZO4^4^b7pC!5 z=MLVx&iOP5t(j&Ycq$Lp3|nhv9MyIUcG$)lwm~EH!J4I=SGw&7&g?OZ1n_%Z9~+ai z7dh_tI)B9y%CPwN)7QO{J5i@@W7t!n+F@fJiZK*@gf^ohOo{t5Q1m zyBBuGP?cqJ&-lRRb+5s$zMEV!C)xaUzcb-S$YljRSpgz6t((EQ{8fVxPqgXjdwBv+ z36Zpuwers+a#u*^+G2O3;XWxCU`3I~{pgpP>woj^^AmLr@+2!DsIV^~c|21%a!J5c zRZV4?F^*q>`r}6IhR-8$(ggwM^8!W|STmz+)h^2S zvwstttySz+pJVu-3I=V)x<2YjMMr{jIkNRvhM+HpV1psjCV(fsY>MnQD{FY-f&Yn> zHz1UM9`{V;zq9yH#lLhOdyI;R){iJHG?o8U{!{s{=#ML4OIS3UCJU(c4K8RUsSAo^ zh-EB>3aIv`cD|sMqrSnLDlM>{P5GPp27fC@JqlESwMU`ypUQtLYvADM6R-Itb7e_p z!N3v8!Z}HOSA`=&WxGX|Uq?zMBD_UCg=}OZrI9ccYweHR*|9BDCV_*UPrTh}y01UT z?+a7PS>VcUZLYj&A6+Y-b$L!pYOPPa(c{hLZCh9&VzudIOb2v4AKN1*`{j9D*?)|< zvS}aZrjUg zRUoQEHMTF}BNM-yo&`i0Kv0LKXrwm$F_d6#yV+NjY1(ORnD}wNIv>-asKFc}Jdom* zvnKn6W}iHEIQqtK2PZQcQa|)`&85cIbShH2GaBjJh-VlX0 zWyR&evu2UDFV1gRPd_ybFJ58<{GM*%uYSq&YWNKh=%>nFPa(k;OV!sZT^JUoTsV-1 zMueK3GG?UkfZKV;@49DmI4LFRCJ8G&%EvmfIE|vF^B6+U^MBF5%ayWl zuxW|Cj!#B4Gj5CS-}z@uhNxh3?|9iOTiBotLQ8J-!iPhMC*DRXw;it9HEIRy8xjR+ zhoZ&Wl>#=0@EZ^!N)W((Cv-C5F}1ecL)|}>Teqh5Lt|JXgA0dF@tQ|7xMZN#p!`e# zU}J`;KvB^GJlD7SpXQV!$E0bWt*@8`DL3MY zr~O?Y7Ftk$;7(}jQGRZ@0&r!BDm3~0@9ZU@m9j!YrAC$f7KDRs%YXP?zhoBYkD?KL z!=Om1Ry)TV6DR~NI(G_yjsEdU!{;Ac;5R@9WvK6+9i#_?)udEoKhIBz5aJ{2o`Kuy zJ^u1ger_28w4})^`0r@ttS0g2p~;K}X@kQ>mmV(|ioWq$#|&S#+#oPcgRG2_ir^dc z$I5l8S>6mS(+ul-27k_t!sV^kcN>O2d3Xmf+x}o|QC$Xku@$g9BP z2SByJ(!SNbm@*m8ee4|0yt{65m$#nbbaz>fD=Q?^wQ*?q5`Q~F1it~&i#U6QX~h{d z#h@sogS^S$GUMws@VsxW6iq0~X>qooY||*O-0x%kS!ZQAk~curZlrarKRzAOXjzJ` z-Q6PiF@+F92r08T6n+Dg1n{tWY!#dilxbtkw`MkDY}Tf{L%YDyb~Em63C5WwJl3X} z4f|^4pZndb7=NVvv)@(apZ(4&{e0gY%0J(Ckjj55|Ec_^oG2OqrG=*av!L>y%6}^V zsr;w%pQ7LCbPhf+1Z6-ziqp~nOwi#di$R`WLlW@LZu$TJ)9x?+>q=-5ch@vISuAWc zQaR}{o{vlp6=?|Bpjg;~Hg<_ubQm@;nOzNkxB4#VK!1m(8$SKOwm<}=rNQ-e`_-qB zKmUHSI^A;r^KXa#@^pt^JgZ6T%2W;8xkg4(P~oVkKXiT$q@C?}aW$^# z0%^3>wCy{V_0=d(Gz&Z(TB#0nmUEaJhquqSpnoi-K=)$r{L)dl|C%Nt>HAoER*@&F zR|+30?9vN6AMTECT|pC;2ycvVbUpM-CWIO8)UA6LS$%HJBzMO}x26k}*~-wretBHN zJsfZQsH0yqVeBQ;AGw#dv_GRs?5R9U78mPKblbG0vj0e9sN!NBN*4V8Q;`=%T|Msp zmVck3e6~K>RyZcIa$xKDZAr`251f$>{IC{-tIqIOWvOJc)%iDk{3SwDgV!_>xuW=u z-QyJ3_fvTcW>LTd+qOOVUVMmm*D8%1WZsCX;EJ z^Tv?X#TC6d1xGqGU3sOk7j`tBvK*v2HHM|F8{Qmgq|9k1x03Aj3CC>Qg@Ji%^pVDp zG)iVnVE2GV%6nu}I0Z=2NR1J5tgus9klvKMdi-r!S4osSYzB|H*Rs43KGs(*uYVwQ z38mADFcgb4N;NbY*9fJYGz_nfG>S9bQFIuUxHR~@;l|hhW+*;wVy@MWB-Qgp?dsX- ziSUvtOQj>jhLwUVFxQ+uj8)poYY&tB-WF8+g_#s~U(T{`D!mStJ9%{V?ts#`vNx!s zggDoKyP1o5x&L`~iz~0U?EUY#GJkp{^@3M1j~}E1KP-*Z4bFve5@?6SN;IBiY_H<- zCO$H55PiK?*D5a_6;nKh4NzW5MTZHE&^*=Ja39;a!_*8U{XOSs40jz6ithC;x zp3NPQH_{~jK%>;5iRi-fYuyu^e(=X-4H(!az)aak1kC`0lDwC4CenWqHCdA?4RZxl5Ph)Zl@?O}?3? z&GLyt6MkDNuOf7hR|y&OnwAeYn}iE|oe7|#ph-3-xT7BiIvo^vUR>7WIE30 zRd9rZL#v0IO*KCX&lm?%5L(pXsS3LcH%}424~;>eZdmt8bx!8Xl8u7i1)`CrnMpqZ ztgF>SZ4*(Y4#n+|$nZp6*YM{iT|(KgZ=2OMc#FA4VhPp^pj3`y2I`)}X6e zA?z_MbX5xBD_i(ex zvBmRy2=S3O`+wNzNp;BZI1Q+nOrvRU3a)fmE7-eM*J|OgncgBzMZUG^DKAUab@qO3 zdM1|#lt$9gmE{my{tCZ}s1RHJVt+r`L_esUc7(B5bZO-IeQcahpeZP$jn@4jG9-XT zDn}&acfED&@wNPDV*=4QQur#@R11CEL?bC0MHy^p8h=E>HVzGxX%e!e!k(+ZV*TO-}nX8R{C-D;7WcN6$Qv_u!da-Y!6CP)GTF zqzIP>uzx_nwgd{2_N4^?6xh&;6`4q-dr^CAomsc7(~1nSGy`AT=G;ck1+7`- z@CJrnU$Fb#MZ3}Gsj6$0&%m8Aknb|y{qCyURDS?um5r+D#ImSu)F6a%q#vz31AT-r zTbPH{H8tFAyxMVw06w(gNa6D9F*Q)7ZK3iAATm6hk(*>9zY#cg!|Iz03ni=22dd2lyUBN z_J8{+ictAa<-e69FaS~ki~>M1?XJ9ir4@H23BX(diqiHIp^}~NiqeYxN+qOpKe_3r zy#q2S0P6=>WgO3P?IYw>tLhl6}?nQOg4RHxGKIS3~Y zhI#=@UbR@C+HqyVTHkne6VUBFdnI%0B(Xa-IdBa(-MKh=xR z2hJ&8i9Yp!f6*GZ@&KbmmtYwb`F|eYWBreu$h3&6k?sslMn0YHgw_}|`5tu{qC}Tq z-Xnuz0y3G^6n|(f((c&g1$did&_@llTjHDMHy|V>3(t#Jx&l=d5*g~UB}@F({^F|! z0&57+^Jt7|>I-f(ilH%-d$k}KV}NDauP&B}h5V$)(q=2;pxWgL(D9y%YkxI4TK;CG z-RUv1S_5zV7uNlvS4j>GciNui&=#bPF~2pm%ozwW+-ZEem+TQkp_BILYu7uSPT^Z? z?t5$AO;gA6Y*ed zI0Lj%mhRT3ITJyKdv)`nV`*25gcWX^yYhE^R8gGtNu_r?oHL}PHLp18VNWG(Qia{% z{jQ;_*oQ_MLJQh9m%|ETyjwDl@yo#%@7C&rE=veMBlAiZHh{ebcYnwBSj*%DVw>~% z_v+y<8cP)yKlaDTN9O&``WC7Kon{?pwy=t$41xQROCNpNMkjj)Byy`a_Qc9MEZy*# z|7|~GxO?EF-sB`W%<-?W$0M$mwm5jQa4^3nuo#dQm<}q!@0N;%sz&8~a+je<= zTbyqkdK(ueB1wP%Qn|vmeY|8ob@wB%{s1&~wausL%nn^()8G3%pe~Iv9Gs>V=-1eBegqEo z-O$?ZjJ={VC%qOLX$VaPHOG4@#qZC02Wc=>qDxVXo!U$|et(zpgnfR>gJSIsL&xzB z*ev8`lEb6-e#(>2I+0gghOK(NCkVo~gSAX^EjcS3Fp@WcrN0f_VZWpyWPHPVCn4^4 zA@ryn7w5^Z3VmPu)q~gp2*RLIJ@oBb8$a_4bfqgbnnzhLN*t{ADL#euTx%~`zm_{b zH{}*}S86Ox9e-RCF02TP9W|y+EHT*27y`Uj({U)}U86nl!SIb$P9tBiMb9Ym$W1Ow?GyA;Toz=tf4LyxdMoA zHRz}Ft$!e}6#z%4b-fylqqkcQk~WkR=%%#i0WYQ)zx(^dxWGgy_E0srq8}n@ zSrz%TVu&~wI|(yin}gYUgpX5>gTwzaY*~W(rHZC!uWo|i)ky}tCj$98;TI$2+_U1% z(1EA>!tNQ0aa8o}m@Z+f!Om#3yniaa?ke^v@p$F=OT-g*?8BpywrT!@i?}N_XiZlk zgnzMXulU`yI<``rF3r;3o8GRU)U(D}Nw^obglEI8tA%z-TBd*C43Hv{{jOcbKE(zb z&w_$ga}}QPyFGg(b2ujr#Y*31n^fWN!o3D}M}p*t-30K!867;SXI&QUD(PAX<~o>E z)M*E!B^pO}O!7SF5!{a)N;#=8E`aXwB7ZJpP1Tp_*NC}}WfbMH&XTT;ppgpyVtflr zb>i<3umIOqh7b7UV4?ts=HqFZ52ML_Wq)bG zO!w$qh$|YRFME&3;)bE4P@ZT$!ak~_+Ezs1eJQSA`f*(1@!dCe$11{o+3=CBeQdPn zf8;~YmeKEGqFv>pl#|rYBkNj%SEqGbmjfsm8E=z;g#2&B?1B5EiFJ&E*GGa7`Nybb z9lEpmP=nm{-t@Y^`mAN(z|u`Wuz%n4dm0@*iCH7sr3+g7uO&8LnVcpCzE`hl@le}T z>%D+YfoQu@E8~f~z?uMj{@F6}z2|nx{5oM>wOac> zpru#*{&x0FWXAB?aEMPlu{?CYhNMvO>=*9dR2G@3CgtQZGE4nJ8#B^@y-Ltc& z3?xG}>S38V%lC8`-?V4nL=NXAf|jH@v4*-d%)0n>WZP*&IRSOeWrq3wD5sK+#>fpt z%W^>4uoZyrFF$g35ON8<;(tHuJ^e_MbtbJG3A)bIxidlEnL2k2!TxY+7IGF?0qrZy zPkN%RUVonmg0RyP^}&n! zkVS|p#m2vTtq^bkYM=*IAM0!?sZq=G2MF|=n#5b1>bw-*m}t9F3r+bo;F`V+iIxv_ zGCx$BNcOu1bQ_^8<+H{8yttS~($4)rN?k+J>osxWU= zb&lSw%+8m41|+f|lIp}7>e4Xt^4AK-A_7YbnrzXNQGDD5&o5KdbnoXIK2oihLe35& zGt>EJ`)+RP^>4q=+|--jcV!6rM}e(8VVjrqV$iw`c1xofU4NQb;eFG6=!wrxUh8WSA_2_9Lf3d7`#e^qYRLn1iL^GMW9%p{Ud1AEuFV|6*cGhH{p?(`W}` zf;2#H?P1b>o#2&Lc}6c)IqiAm-bvtjoOIdH}j2 zt4TJy-LVeL_6|;jM+SwzX}Ao2+^g89xP-B1bOoZ=XdX;{(TTV#wGqkKIIjTiQ4M|- z=8gkiMHWE&U4!93?28FBmNHst-AJ+~Lp3 z->qVguZ2d*?U$^D=*Zj$lZ!fNKXPfWDzrHOE#HHZ7C9b20)#;`Z}j=Q&`7G{j(#z9 zDtW;en-nNMHX14KfM+oJ8>&qxSJHI~f9Vo(r@7o#y1gi?ewJ4wmRidCr&x*6TIn&0 zFMooBKYR-FmE2G)ZW02j$Qvx7>ckrA()ne}G_TDq+lKI#Zdf=p^EuyG#KkXNjjH|u z-x^>;x)-@5EG<-6(+#W9Sn@bOLK}W|Z(-Q$lZr+?&q&1+O-@qNF0#IDZCX@BFvFd) z_QEisb@qS|Y13hI0gFoF@wV9i*;jj&tA7KE*m3b6IGxge1+*SH=$FRUl8RnT!s(p( zYH*oEyE>p;7J+9D;!dYmr@7#7UTXn306p)q$~fCgd-JladRbnbIDMDM@LHR`@Yr&_ zPf6XH)!j5_aBR)7Gpc6Rh`K8^XieaXqAYJ)o93U{aHsYjIld^83DADmNEYI)H-Aj0 zNGGZ9Qe0fpGFSNH(0y_y${F}OB_FlZO*c(0{f z=|ecgeEXShx}i;D1dgwE17_ zycG6Da<*y5`vjVTG#h1ds+7DK>id-fr|GVmu6r(AOF4mPR7mOncWa?>xa zw{K>rUtVwD%oMIn)Zr@r4)rTh`2W{gCo}cmgMS0Eo*w6JlKRB&^#6Md8)9&v^PA-W zKGLy`PF{J#o+W_5J4+Xpw0}ok!Vr=UXymL!OWnpS>H>mBs)wgy8W|nxQoP^CJZnS$ z@_Q=?e8-lR6nBYANd?A#)~FV8wpc0f23$XX$QY_R|5KRyTM8 zwzUk&S)l5xkQW_xp%7*Y&Trh6MhKgv|sT zjwND;<-$kECo3zPY~AlQRlb}mJxv5ac(cbzJc?h*k0_PnRw_U4tDL6P^0@aa-Pvt+wl9b&s<_P4^-#+2qpHCLHl04d$`Fb4e z{rMz24CUzc)o{Y32kyNjXGb~pnxCi`vJU$c4(unD_Vyop!RPZWpztIHLvp8G*~|QV zGO(58;IotEe@l%Lnv6Mbh#{N<>}XZXRdS#e4OH=v2y|}OgGPdi%)S~{MH2u}TTJH~7Tl~JW@qfjTG1?t) zz;g1{;d)GRE-t2#x)CXN#%8BDz}kPbwjP>y-3gyWA%9&C*iA947tC}=i156_3Jmdl zzw!Uj{?)(wS0CP>U+2k~>@Ii+F&Fx)fAv{R`$NXl%h+!FURGaLF=;a$N0Xm{0zq@z z-g&KR+V-4Fpo84tV5f>Z; zzJIj;uYd8MlC|&H`NldFMUFTS2e|&gU{vwC5crPo?gT0USg2yqm9&wcAmYG)K{||JO~Oe{C?M zu_Lb`8WHrIh(by0Y(kOn;w9YBOM4QY3QkzQseeicSeDxl?1GxQD`20BH(npzb8s5k zyKn>`tYon!i?oVPodc3 zDNz(KMcb*t$WG+EQo*gp+%hF^K0OJEc2!Jtj`+MqMtq&tmc7eb`RmDB^LmigIut;# ze1ETq{5iZ&s-G3?(Ma5yr%|J)y#0E>L%)@>LZ`5cu5=x8ak`mn#B!W1Se`8)EwAI6 z4)050xBvghdgat)ptSVwT+UbA@R6!D@;TpFX{kuhJ4~*k%3UFUJ6Sz+JTvJlKP-!n*RLdo1ZAJbl zou7IEk9)wbS6fG}Zg_$a?kE zQ~*3PR^F(xu~ekzy+Wo7fE$GE?Z{R6d*Odpk8Q5Ekh-AVF;Z?@m03Fd>}OW?7k|8T zr-ET&sFeOCgO>|lU^PJz9a?ydPA2c2wX?e6hmm7q{eocQ*z9tQ)WD(NYT35RnlJHR zHD6-qx#I$GbDM1f0bJoQSjhwg~Ap_{YW;zs0}wzd=wuKWz5DRmAUs z@9{00WJ((* zJY8sTaP*1Sed^{$x`T^wvfEoD-d&pg9YXBr*1o>}V1a--{a{v$L&r0eXCEiZ6SXRb z6mNxeZYL4=$g@*$UY@56_iWX}RccZFFuGs%O=Q4mukO&k;EZX|t8MZe*ni&n;S7tF z8Ew#$A7=put;f3h)pctIPg>6HGhdy;sz-Kqb@WG51T}3&&9FR8+OB-9s~7F zM(ncVdD}`O8dIEi$H(q7|v?)*t4vmMbNBL(jM60rLYApIxALE zW*#SLzw?o|x=pA*pyvDGgnwm*$GT1|^3^R(7_?}Fj%K9nUg+C|L_~uyXxZoXwTc)w zBV;W`SL_}GPFxYN21!q6CGjNi!=_qMj8}mM8_DclvQmXd(C@Ai(O6IfyaXanUfeaO zDiGWKJ-P+uiKgAJdsW29^r-4p4P2zmUtf}iy;`Y!UU_XRpMS)jI2Oyd%79e( zXmY0FGDg&HAI-|H_JoRak>ol+(N;MmrL~`;zN*pPW;(dE`aOwdI96M}42=D1RNxO* zS~(0EIgu#8r-@+jadF)Yqu`A#P4LxG4- zjwM62Y>yY|27b*uIe$d-=Yf)^^%@0s&9PX%QB*ky3?@aA`z5OHGe;{gfaU9R%S#2H z%!h~8)0UFDaO{d>cLBfC&yGaKGl}GHfgCGEE+hIAAMuq$dA0JhUZ1@Uiyv3@n%M{2 z3>}9=Qi$v(sh{l_m$3TcZN$y5O_qnmg>S*Ovp6BtGl#H4C4bL8FZ)DbX^yUuv=`%g z=?Ke6XrYl0?kte0zGN@rLLat2J#7U6;W<(NSl_5m{M3r8w5tH#PN^Kn+K+tO1n``A zn*EN;gnvOC5YP7;|99Xn&;wX&L==iBnQ=pk%qu@oQ+UPrT~V38!>aIFLeb%cg9C{m$}{j%{?d z^=F(tV))31TXZ-mk-V%xTD+mlRe zbH}zOwl&ejwr$%^CdS$GJm)>%cYd5dd)*srRrjvytE;N3uC|!3#+5&%Ua4191pGd9 z{v-ia9Nsxed%qacwv7C(mOgp66}}lnSGrOM_v0~0g#C?q`Z^ErA!wB(ll3MKYzC>^ zxZKn=)==z4cgH7fP>x83I?I%sQRu?3f!R)M(*U98l^|^U>C6Q##X0}kH0!zkBzBcG zkSCATxOh|OPfyHNnQV0MF(tSZ+e(jXaoS~19PJN7p3Aqg8NDfyU&W}9p|utn!#qX1 zPuyFenLhl8GROmv9XeAwYlw`iGN)>Zf(T%j^5UVDwiUlI3NpW*==mb>g+! zbUoWao?}YGnmrZV=!w;>)u7BjMZjwF(sSv@&yBG#^7@xtd-JAnhFXgkG?}?;>MimI z=Y|rwv9?LslJ>!?P33FE>3ZP9U}avEtjQnTwsFn5U*^()gID%|>cW~}TC-R3uEZ9! z3gh*DG`4BF5Jtu?F{3!VaRZjHXGh!S7pDtm6Gz)HZNF9p50!e4WvXRATZ*$7F*R!z zYQ_TEj~JON(>itEVSlg=m{mEfIs~m6O@()wB^E@?bOudE2HRJj3WSHj?gl~*toq~( zUnxj_wyJ!9R+Hv{R^(US3)*9yJ1z|+gKU^p3{twl_b@iJ`7hZc%N9sap?-X|%!41cm4{6%`C0;^3osPv3kw!<@l`O>C*G81dM0c!{ zD-E>NTLf)|9a$I1H|gHnJ#e%%=_iuimt(~10FX@p6wBp)OO{W5%jSM~vh2b-Ka|lS zW(b%9$bck4Rbc8jJ<_aHPK%~ei?O4-F)kewdgdxew^VY9Tf{N+&CJlza8v&{7n{QM z@;KDSx_!}V(G13*_~}bBY)uW;4$Wz41EO!|-w>jOF>4@DiW?dOds`VXG)aSn!#ozf z%5KvE`O#)(W@3xj50?S1p#nc0KzDX#Uh}v3Q~J44f#%1h&3|DFthW>H9*LN~>qa^K zNx~Cepf6s+FiOn?1lPcXM{i)&j_u^h`WV*L8>U~>C}o@*=Z|J(rhD1YB4D2pi3`;o z7h-*~Yr}ozL;(UhuC;{SN0~dNy(AF?i4`FJ-9-aU(fWL=-P?}=Ivjz(rl`R^g0hAQ zeCZ?^KRZJGfQugWXzWbFed)Oo*kYC^@@A7SxAdDa0*9u=Pv<@TS%^IzPS01lU0kax zS?N9TKA;18yxzrk1^_CFd?$>UYR@PR82L2nV>uk?b8>8k^xj+1*hrnA!8cz0JqhUZ zp*z%~_SB-=&Vufk{uDAv2g2lKL9@g~zz;?;;28;M8a_<{<7k)3$xrg~8|t^tQxh@H zAovJ5|Fy7q=X}rT;J#lSaYy}CKwrfrr3NKl4B|0SmiZd1o4l57xao&m!KIT+kooB% z_-Asqy`QJK)@yNVIL3AU+nxdbBVeS?Te-qy#gI5kyDXN9Jp8Vs|A23H9nWv$V*AYN zi$QU1SlOdHj;5)a?CNP3_czY(#aIMS97(A3hN*#$1g7f>E%lL4v%OA)+HPAH?pGKEA^RhU}3cpCKGIxKjl(`|odfcW*y1kX3X^~JD-H*2D#Mm0#5*|Y4LuMbmT z(hgcG?DvTL@{HUTE6Rke&DljL+Ox9Ifb5le(+|B{92FXW{`37UD&b~RGlR+EETEGq zcH+r&u84pZH%ZQ-F>2ykUJj5{QRFDp53ldfF69A4o@+nC8za)}PFX(3YL%Xc%5WzE zrVqWN+7bn499$6I16DH@KVNA~9V&{0?q}&PV(_nzinwC$0$nBIG8<-+TpzL*cI*1LD=?a?1nIV@$B2tNZNIuQWfAz-bniv#_y+pR8o z>Q%>NB*UKIYW?dpD%~K=xSctjEVS~a7zIn+Unsf;MI>|Dhf1(QPMod2I^bF#8UCrs z!9@T1PHzeM=(~iw52%NmP)L@It+}P!ClB5^n^gCNI9-eZUN(eY zGd@(z4`16ZE#Wcp830r_cipWOwcK%W$!xM2)K41|XX(&vd_WJfc0(QYrhxhSP9QGW&^SdRSqsoc9FiE+fh z0A4X9bMZ3!ddFSV>sYBGb{JwY+qT~p1Ln?#QY%DqWvZWmIz}B2gDSFVC1CSRsKU3d zHyQQ%I-8&20GuNH@3ic6SmAL_5tO!3w3bdJ2nu>QwNS7?7pS~n8#b#`_TXv_K1x>i zzV|P=vCM(N4)zLGz)HT!>o9k&>x$J8-cO;5JVZn4{vwJ!35 zJ36eW-KJ4T`uzA%HYfog1TA@m!sTp+D3BX9&Q;nCxbm0dtM$sHfaXE?I9nn>D)1W2^&o@fo0TNyPv)j- ziu1JpC`IZ;-5=YkgiOtkfC0c%3D-Y)r*xe|m|vrD-5buO4>#;eR*5TVhmt|y`QxV(UC%i`OluK&I+P$~qUUKSSPx>+PJUSOG1 zM5`Z`BUlvXcGs1LjI56GOLW23Qz+2PTjr$ISyAL_lta@OnC^a7d<3LbuGuA>&d2nP zWoRv*xr}zFK6ogPZVuY0Z^P#K>xbGEM|vR$b_KjMOD)(U7i5??y1MmCj(7Bs|JvW0 z{-j&BxsOR{s7?7O;(V@ao4X!)o+4?gxW>L<5KOuBU!m7j{va%VtPJ@^rx&W#fFk0DFtDzChI%v_hr zW{->cZW%)&jD86WgRRTT-&c@GYHXgpY5uMSFKV$^VQR<4gyPe+-;uYoL_vUF|J?E} zL15L_8S1Ru6tzaRpw#1xS?Do6kECAl+^gF*+m;Gd=P6rvWdLw*vyo8xOJ4f&Q^>8- zPyEQhozHZJQ`$D&|Mk(#jD?Ro88AA71V7%0{3|p|-*kVz(ALG9qTF)(?pQ$zVjLZ@ z^BT%Uh}XCM*wu>yOB(LZRorgn_(V)4C?4dBcX+5Dy_{>`oAkUnLMR>WZYqWd5G&+Z z;+_}!UW@=-!GMFA{*|i&Lvc776`M`_-i$J7M`xsPl=Z}Q}-EUwST3?Vp zSAOL_=>WaX&A*>+3AQUgw0dt_2&XgBT5a%E>W0Nw7k?Q&Ihr{)U*bkRe8muU$LAqW zCmwfU^suswGo~jsD0tNd_A6nSvCGbdZ8{EjEOtGj^s#-J4Hz;B3OZtB#d%M!UA{VO zTvJ*G;7zVwX~Y`Mij+S>Jx_cHH8RQk-W|sJbpg11l6={7yf(A%4y)*;~7EJDAG96Ld#P`D%48d!Nn*zXZ$$ zMFqDyhx=}bqAH@PC8Y3%A*5YWpHWYuj>03pRx{LHi#T85u~<8UP+&8XR$&3iMNV-7 zJW&PIOd~rsxS2rM_Eggzt+zOm&Q1n!xS}imkR)#xPgJEAT5(%@_N_2MQD|pR4NBkp!!ia4tn;5(a^WH zy4*|c@p4R!0pM)#L2f^$467TVDX6WPcnsI(NIcjm&ciON(9x-l;>VUIrM5VcV0vh} z7@=t6OpJ$wdwQ+TpMxCWQZM~e{iZSRD&J4J+}}4B!AZX}t)56j?XLmGFQ05IT{xOc z-nGdUfRhTFUE;l7tdM45i=Jk?SGA+cMG)Aii z6&}}$2mi)jsiT%Xo-{=$!;=*W&E5zIu>Sd#4QSeBZ(1Yka6f=5{6*7`3_;l0+!?7^ z#~%1DCaN?f{||=YYrKz{&}r2iMI`;1>wgoN`7=VTG~=K*?O;G*?qY%H;Qupw0^A!> z%G8kn*t%UP{`@T?JOOgPH?`*H80VFyZ}+!uq@AF9ALAWN{fo3n(=r*;k>5@x{uf(R zpEINhK~VeBK7c*WOO|&iNX;ueYeLU37h-Kn{})pq@;!VQ7&-9uET4VOu2YfkYc2d5 zb{TI0^OAiFJAeAQ05ZT)qIAdD1%*g56CQ8WIwp|1BQ<{Zmh3rMaG?RJpa}A`1=j^0 zKWI_Bl&((R;>C_a^Jhoq9y>O+|17_5(Kf|8&v2(O0>D!yd9mn(`CiUbPhpdYy2k=~ zpEq`UrQS;wdsBF!p<=9zuRjPI^rSCC28*l709D8kCCuEY7eOiK-I%qAVq7bY;oEL9 zx0C_?y)HeCh2Vk1nlt-8N<|~t;BA=Bh7J~7HG=1&s2=`5ZzbW8FaFq*MBRfNM&!_u zlwx2J0kSrmhIBR?R?&a|jaim5nyH|FJTT0o@dOL|ERjHd>P&21Tnk7ef;>vkKrsZ*>}z~)|4mR(S0lmyBh`Z53uYILN9fa>+LTcaB$z0vNp_W_#GnD z>+)_BcEZAjN=hWaQibutVKVYR_9#gVI02bNLohn2HX8FF9jEB3y>fQ9ZjkHbgBhad z-&g!>#gia7PUlU%S`0xO_QeDRmZ#IqrYI|-ss+m&^VC7)lO{ol#*?H+ypY`Eyed^ z1;yrVR(7Z%3dN`En`1u4m4X3Di2sHe?sSauLO~(ky1^~=TYS*s3Xf!apo!|&8^r0K zGNsXMQDN~zz!e_Nm-DgG(nPlCKOQ|dnV>NM^grAc{Z91{gw;N22b5l}K?d#q_b*>^ zdBeuOHn`*6`dr7w=)c>8p%$8#i)RuWXyCA%OEk56{{)b<=<;%I=+)_(zPPGAPiB)U zJ{V!34U-k(tmdBpyJzD%c!!QilOp&)>Wf7qEm%GFA`=*=#!#wAg$0B;T{tlQ&dx8w!F|Q0P*I75U$4cKC^=;O(SlbyF(hzM+~# zRH~P0cnnL`w{Msw$N13k-@+fLv7L@@VE$V2xz5wWy^#Ge+6l*lBMVG;AwzxnNmpS%x}A>sXz*9_>17!BGIqLZIKcd?<1*U)u7d3)gr zMnOXAnx)VeiVm6x-lH%tFe3V%cTeEF+N5kW6ew0Gg&%pDGeP-1xM8Yqb+<0jJA1eU z<#LPdlZ`07Hv~T(9h#4ln?uzNdaPbFagP1Z*mCLhFj>p)shGpX+MiKEsG_yrRfNoK zpA5iF@}lr&L}QQP61Pd@38&8mOk8I{=KRDMjOV0*@+y0*}MxkCMbPC4k=RnxB)CKTDkp07Ck_mRM6HAsc-X1$CIj7ZU5dRJ$w{xahdSI z=v)3OZMrTrbRwwM1ttw`O{&28^N9QX$eR#f&M=X&q<~AYv!atmSbd5sdK@WrVVKjN z{}CCqt9u?DFPY!1OK@lmaB>|h2xu1?v0NGV{0 z+lf356O@I`H{?F7w>LwRKC@vc_jU!-45WRj($wt$F$53b=GFlCBzI|?}`2DR}jrQ)j) z%l#3>^)hT+@iuRoz(!2akg8g(2Zdf#_87}1U8Tb2LeIhrx+)1_nPep0#VE)3PX#6p z{6MHFG0?rAFY=Y43>%bGh@eTS735+Ie6H{cNMXIfCOCtH63Ii|@~id7JpfiL^MAK( zD|r-?2=)(zDTDKt5kxLM$nd}4v0;LtMoSJu*ad4l8zmK@;7LhjeGE+me{n>Ka=k^! zH!f6UWI2+PDzaIAJN>Iz9MOW**qg7?$rDH4OuvsTicT%C5%Nzb1K_UiJ#>&o`$f>e z#9MpBR8FPwDOYotFHbl;pzh~56rP$SF^xM?>5Z`sg}>ulk5ZvBdt5boXi>Bh=iw#N4S|8u)xb%&?V&r#NJ*T+?m6S2ocL_ zb9O#ZbUsY@#3olkO+|o*VfuDHf)40d72h8d= z#}r`3>BwzXF_M!Q%@i^4WMsK;h-_1mk;34Zy@}=(2_Y@XIGQ+p+jKsThoGWBN^P2G zsb`eSy+!eNCdncPKq+o8!Ik&V=kR&34tEe3ODQn$@07m%8tQ2}S{dKF3^fK2O)`9=?V@91sqy;GJvYc=qA=ZA+tT zQlVC_UwpKXBqDw-+PLNM5ai9iM(59ELeJ(3GFno$!Ebj@Bb zq|w-M4gpX<4c@7&mJJvE`^O~~@hx@Hk1kqrY~(D)_KaX&TLvs|q|RQtuo2qjsryTL zOeRthTY&2p2aWQj$ zgKl*m`8gj8qt4THd_yY4y(d0ClBAfyNZSYCzmjaM)Jc-Lfr8j0earvM*kqf&CK8vv z!n=b;QqbSy?3!++r&48iXwQt38)OsbN)i?SWgN+xhf0`kkLzjkkv06Ngqq457R`~` zw7$UJV4`K7=t92GuX{`>B+lhydg0FB7+7uvaXH}N=ZowvQu%Mg{I{8or2(TBzK|J(@54ynmsM+2p^7XPOtdz23)?ZoL{EuP{+f9=J$Bl+L61 zu9U?0!`6OQA!BGKm~1&JArPVhtj=X_?TfVY*{-<;BE5guzJ+CK40h}g-9nO$p)(^m z`-DDCYrrSq>E64JdG-RZMJ-eg*8YqWN|Z}6U2{=|#)S+1aSbU8iz}iMIKmJ6b`%l{ z<7n@X3Ijn_PeQ1LTy$1wPmxT=g|Re(hX5i^?6~D9W%3N8j7&JFbcLt4Dulfy@w=_KF69YH;!h0_7E$a1T51D!%HqdJCnfuRRr4su0UJr7zy$X)5l zQ~3uaU*$w{-X>7K%oL^=>zfoWpT^p2HkJ+6-&w!wt6rSQx=MtAyA`zrs-3V9hN<6q zuuC9C({*Z8L4xuw`4P3mRzd`2D8MkLtRLE|Vt%1tGFmiRJU@{a8hZ;0LMm63C5!+L zyICx!>=-Af5fB4#)HE&VvUPRDONh4G`7(-9p*|2^6n`T{m!AA(AMQF#hK`*kSOpu` z#c@(7n6pVF=4n$Qg~kQV;ZPfh>YNFlVUGus0fSorbr1k235+~heTaZUvw%Vq{wp*X zD3k;!)CPEl0a45~jW8D*j*;C4*$WcXZG-|SRta|-b||+C8a`qY)vtCso2DA;_Tj%^ ze`fx(q4fK#mi$0Isejq+B)8h&%V%%*a`|e5waTBShi@^E_gnH zz#g6nU1ZV*_s$Im(LnNk{6KzKA68D*HD}2;OPO*KCqEGwugjU~`)(8wV2f~x8bc}I zm8Oc61dAwKh5Efv_*b<>#@1RA%WJ$+opi`{y~xd%qU{A%HAneDKOXrqF#vn8uAD@9 z25*HZcL#^;eiIZpbrOgJ)aYS07-BWxt|Yp!3ob4%#P2h}J)rfCvemg~*VaGD6`ZJC z6j@w$pwrQANGbBZkLYqlYqqt&9}B?67?2Wq)WK^s`FUy~+sMy=IuDbtH(DtQa?YQ* zly-;=9w(1s>3`G{YSaQw(E^2mXY)_ZDnbPRK%gu%P6}wMWntJ+1?28XOdW_0^>!d+ zZYTLDj`md^j$zGOQ;|}9o^@S(2#SMjC|Ov&GSmTrI4-2qQ4G*2DMx@kN|Hd12~`&1 zaGcF|;~n7i5P{P}K_GJov{q_CwIHzx$BCCDrglfF*cFxMQse`Q;{u8!`9I>6=)*JV zpirNn{2~zC?Q}WYoTM=Ffr0epS&~*=z5<;v zf=rq@0LXLz;y+O{BIw4V2mX9;;;qg~NQ71ce7AXc|4}Gh!Up%9ZhxLMz6~4m_oZ*P z1W%#`{gV0dykU4D0jeivi#ZcFIuJB#@dr1`bO%$!f`<_VbfUPK>9lwKCDeQWKK>t1 zJQ)+{!2gE=dM@v78hXVn33YO!JPRzJTxz02 z@R;*5h6lJB8_BzAl~oCz(`Aw09iHga>OdFQnxf=unUAU^9CXc!z&7EUs5rsAVqF6%}7B9YOv;*frV*eB8_krt8!5 z=GpBVab8_48Z>nJ>xe$hwGqe-gL^rR1YV;vqw-K3eOoey-H@y8Qw4@b(S>}oRmbAn zY78u};^PWb?oxrCeo|g|)HJ{_3g73UjEt z5*-~Cd`qrYMC}SMc^?K^x7%W~l~CcVq9xH2yMPZg`8cd-I3W-K3@~SfCF9`We?9e% z^-*D<1ojOOg#c@0DM~DsSi^*K*=IdH`r?Sl9G!)BB8DC9QsTuP(Zf&zDQKWu^?hnJ zrq%p58{18)LF44}F8tdj2^skIet$XQi@?B12Yu^E-_Zyk%MNnF+XNodIQ_hXBZfGB zAwG31${WcRb(sOo7S?mw-o|V{mw0ADiYTRF9{~9sLC$032a*s2Ll_cNOP)v2Q5nNf z#5ew9g+SE?57b;j^L0m|h|Gu`5``TZU|hy=`{_Q!G(#1$w1AjGFI;Aw`JXTZ9(O}g zTd)!*s_p{4%Q;6EQiNv4@5`{g|5X+RP+8yrmxnUG&8^$|VQ*u@U=(Z$D1?z;qPS>u z?5`7XEevm%FNi%M4k}JPj?O(;Hv{`=uDWbsqnvaQ3TjB$N|bw~*9xdyoV05Y(O(*& z29ReQ0In|+U$oXm7~y+Ea0$6!q`OJAk^lSwj%J*p?q{pz@Wfox$kMT-;<8tGeE>Bs zhuVNxf)p{?$(eEj^$rvilZjFDfjygE&xC_oCE~3^e;;lXO*iX9<^{0K@MJ>JaOu$m z=)Y3?M<}VKAru7AiW{zQ(>{hjxMdTIvBPdc_1a+N)nendX3NLnU(-;Oj@u@|XJj^+ zmEAM?e=13!YzE9-^*~Y&P^Q&l-2=8KeT=c}wCTQ|%7)}@c)|5KL8}bK>D{-r<|Jfqpc|>c_!tPXc#~RNqFhh zf_r?p9UM-g)hiX8I^aM_D99zZC>3xxp_K_-#0v6EKXgfllVOzsskpX6_i(y|`4MAv z3mZ(1{lpQ;4mElHuE4$)n*B)Z*R;72m;zp$vh{Z4_6w~t#n9l5A5NI-Od`aVC?8m# z>3B@2JZz?!u*AV|iopGsDb}fIU*VT1DfQ2K&E`|@hETfyj<*j8;dohICX2D!24k$t z6uQc+oi3$-12&cJ?XYhgs`=-Rf<;WR->h4mjZmbRHnq8;VOzdSV-RY;gj}x+9OsrT zNE@?av`HD`Q3HVtg`h!th*x#yo?HREJkl{G{pVWYv7$X~{DQO}D@K=;A71(YIC?VS z|I*W?|7G!@F5dym`~M1F0YR6BHVj|XCpUzBFBO|9@aiC=D79Re{BV|yZ+=O8z(ls}_JZ#;;A-XrFb&T1_4f7jg)}M{ zcHCcbL)>}IaIJhG7>Anwj+{SS2BaLp7~ajb`YZb(x>pYR8U7aSaZ@$Rmeg*mAN5NZ zBsv^O|01R!9h)RTim&=m$5RR!CL}}+en$>Vd5AC{#N4v809t*@q{bX$k_IiFoz7ig ztXl;msu|2<4*=K=V~(*OeRP)tTC+WsqOS&!B1)0xIt?Q(6#cH(I(5(V-_Jb zJ)*~04Ogy;mX;Prj_G315UKHoLbK}OdV}B8Q%Dtycoyo6fJd=+)+HvU6diRf7pfSn zc5M(4B)DoSX0H%15dX+T^sH9wN3BW-)E^V;E?XoI4(*JiTiYUI+Ka) z>F&>EYI-y+LVF-o_}Gm&E{n{nQgRvh7l!pbGQnu_ww%L(qxDyXQD%tMYL`5H^EH#Z zLy`P8bJ<4i!1Gsk)WxNXz@@V;@&ajW`W|O_l2i4A7Ng@Bj_l03H0~U!`N{<=BsQlQ z#CEK{Sw6mH3s6~d%Rd)R?@y~efb$sd#o;u;Z41z`L5@W$5|Ca5MmS;Xd@d#gke*(< zKGs>Pm?-+KJ&5J&_Ee5qJWlzPb=(rCx){z=DX`)+KnvZ=(BwZV-L6op)wm>5F%E#kDgS=?SEjfHSSD|`e#+5C zXU)%fIpgGvq!bR{l(X{Vjnmuue&HLaoX%o}^C-@|6}#-?;^)J>QYbSr&2sg-Ss8wus0%8!=QMP8LE!g*M zJVie1?{>{pn6;$uOEt6CJwC~bcHR)Wt~&3mfYd86EW8X8`IWM8Bi1pM-N1d0IwWh1hZHcKr10kvyRHmOI%ZU^&o{leuM3!u zYlGRF1Z}b+w0LaDIj_9>1GaoCAWtuP_!pm26&AEKI_|o4w-`EAMrDYM%5l|u-A?@} zAZSJveI1kIJ4+tkq(-%tJMXs&JX`HqoJb!?og%FP>YRt`oGsnf8CNZZ)goMEW>=BM z*p=NWr5owP2Z_gr_(!zM5O-E(CimdLn$!fFd!_4QF?fe_l)&{f6a zeuP|6Ogjcxn4A@SXIorlSI1Z;;rpM?ADaTdc2)clGuU0L9^udh0COIS}u`(T!Pe}A-xu=|ikVW!4( zT)P>jUobvEw@F$r6$-iNrZ8l@ZFDc#gdA5LX6@IR*Y2{lX0WT#gJFg440X? zh@K1ad&NJSsYB_#um+t`QGHx?vtJ$+T&aY)w60@1L`=B~&kpbjXEEwxC%u13y$_c9Ea0`y+ zn&s$zX2R0EU8M?1fLa4!SrX{GNyVk$~O1#k7=^d2Wlwo+qSO^0yPi^>5k3~Ku~mFiZ1GIk<1 znRwv*EO3VU z!=w7HM&5`lSLzRDo&*0{F}{+O1HXi5qPYH(#k?fPS;vHC@08rCwcgmn)*${*#p3En zgE)x%xL%|LFC7Jd?R|&QN#tRzTH9kt3Z$DCnB0j7_qbJ;x*@?8ctp^w4zpas8iT;r zj4#pKP*bu77r=82=30C2V`BopWvc7a+(orspD;}^P1{x8ECA&2C4w3fh#Wd_Q>!)s- zLWMI=hdiPGc1^A^8COhh&A><_iD=)Mh5uaD0p*#DZlHK=h5@`v=p(D8zGF~jHDn2a zSls-5aU}7?z@lppa{XK&mz@mgTW{Obxl-xPOY?OB3TjSQL@!KErH=GlkBQvit!Vm=(2z_hq3j1PiS2rM=~_+9#5+T zAqEdEQAzO@&V{U&tn>n-`ecqSsi5l^SUg8|k1aDbo|EaQgqI-W1Su2>E^j5#b~(4o z`UdW-*tKS@xkxsX#d}&`^P;_86Lf8FgBh^W#G~41aSU*K9jk+0`J(-upDrn*Wdtd~ zA%G6RlrK3OJxhgAG|cg0(|LH_A;j;?i^Dk?4jxYaX9hD` z^2*ioOE}rBKMT%2Bmziek08>#yKszcYu2Y`O^1@kT+6D;aQmZ( zQ`7ej71-@lR0B;T`inVZI548m&SoGC`ycpf9^A+a6B;ixDor=YbK^QhLVgr|QG+x^lps zczHT)H>`csHS+0hf=iVjG6Ef$>Lh)MkeYT+O0UYy!B_)el;Di&18r@2LfVf_2uU# z*J%{HSU(QRQ`^bOBS`f_tuO^53#a>-TnolG(P1RCk@ZsF2mi#WRYDDef?#T~gNWOy zxBTakH8?Nu8=j;?XWCT74{in=gVyl?h}}iwj`S`yjd%xTjd4%XMfqaFy7jOnWSxeL z6~)Dn78Edvs@l!HLfJup^T{f!;C^ULDr5|nkf& za_*T9zlXtlZf^y>TI+zVrg2Z}S58)zWA_=-Iowpr7~faV7JMq3n#!u*?gF+e=XWve z)o&6<8}Oy2=pUt1mJy6O#}J`WzR>gcHKl0e}z3hV@!Cu zTd8ZO%R*BsPx!a6@$+z%6)dB8(+uyfGy9QrXDu+M(Pb7S>Uu7wI7nL3H`E84r@T74k}dkGg#mf*%{%=F|kp$SiHJ| zOk?b*xt_O0F?a2tWiBCm0%8jFF5_S9W$2TGsTV@2x6xkn;4XF7=}HEY9Fxa@RtP0VO+U9<#flLz{tV}|^%9?)YA^h(lpi?`LX!>i)#Y%-<=2!W3Xpme44FSj}^d zPUks-$V zH-BoK9u9chaTfcx-ZH5Os4_SR^&D~_Q=`Nf#pf593|nVQ>k&d~HGhkgomD)W@4Fd{ z6k2RfKJ>H+O#~D*-Dhe9j>y%R%Lx9XX*eco7I>PAXW{QT$S&?ZSj*^_;(~y)ILRrw z>Md7~JgYx$ap#slxE(K~r&mbas7h)8^7K`p4A6a$nW=S>aZQvaG;yJizBY_5#ddl} zDxvmICtv1pt&-8hM4)7cPD~Fbj{J}(9|A3pBWUV9E~H@ocndOC&s%BG)ducR4B>aU zgG9dBoIK`5WkHBfdVTG6-?wSlaRs8gD(1;QgR>+a?cKAfYgobjVN!1k*+@1Ey!x><^-H$Pk3Xv&c1U^k zkbDwo2;E&`XvWF)Ga528hZeH*;J(pZyI)twnTA1SD5!TL@8!U?R1;<3YTgcYI>e8A zq4qGA#8Y>%Kcf5QzOPCaDWu2)eC-Ug-&QXKXd(r#W{C3j`|<4AT{9#3Y~_?Oz171K zNDnjBKRq{CQ+_7{9@{H`Y^|Q;-Pi4+-}B1fo6)y1@6zr9&!;G-j8NmK8C&|z;~7ow zsDMRTe5tT`^?`4nyoxSL0zF5{m~kqe$vr`F#2Mq$|!X`Tw!Z{vW#8|L4P;8U^w%kXl1O8^uo(G3KsP z*Du0PbOHv-by&j7QjEdIv8un@HJqPOfgP61KJ<}u_kQIdsYkW=O?aIgQTI21G%yqmWm+o@Jf0pt+YbA3zwC^;3mt9i@9ZfKEz%EmnW z*x!|4LIcExiZYL5(B}$u46-H_5F-phH3CqNb6)>GH<-PVxh1FHu6>093V8sh($enn zZ8@Q9s%{%*WaZ?Gk@6P@jPBn!ktrPTLpYP>m0UTJ)W=?B;z~(`>w@`y#&LmZd?MJ_ zEqo}nupZqd60aABfbN~pczc3LPTt04v<@&Zkc?amy(S+76YhBr6|Ii~*YDnPi<5vy zpCr>or(e6;SYG_~2ROzqf+$_IKhC_ z*A)9qak=lp@X5_Z3ZnhqZz0KFl{4ceDrfsUe_E2-WtxHA(K{9{JiM}je3D^DJu8X5V>%B-7aSq7CHW70$e?^i?DvkwQO4g=rK zjS?SaFJh)9sBWB zO=i>|O6pva{@vcv66v|-wxPs5cDmTea^;dxQeamkQF(Wmec6iG91;-n*CD^_Q1N$P zMKf3nfFig5TI9l>;pmjvOcGyasRaFK;#P%2Wm(b;ed~5@xwBAqVfVCBZhrRgB{WnmevFyz{@wGcmB+nJ5-(F8cX$Bku~E5 z>rwcA6UexYWJZ&XT!3M~4Sv42OB>5M2{D6oXMlM*S|y0HQ2=1D$wZN1Ok38}_j>o! z-?w1qVDKqnIB9BRQw;-aEX8GW8dOfRZd>-iNr}Z4e*95|5{1&pk##}NOaHHsCn6A8{ey~eH4${{xckGr?Vl0X#W;{{S zSF)0r?2twfLPiBWZ2>+%-g? z$HzHBF zZCCtw4<3N2{IOy9lC@P22}WNZhlBz=4Pk)6IKUAGAcw?f;pB_QvLuFo<9IYwr)MF? z<2RtY9A%&0=ytH~NfG0yZ8NucU6^5-O`B6z$Tjvn#h0z^<|!Sd=iMlE)Oy9?WjWS0 zf8;B7yiIkh$?>bT@KeuN%pk>G`(9YnyGY`a$_nuN-d7-JUGlp-RSNLS% z(g(0&E8#Q;(d+)kb>$GUQ3&df$9K$ex$D{STcV}KOHWzhT#Dnum;m4#%ofnj#&dng8up7}%yWFJQ)*&zG$jqp6Ag1SpDvpKV}H*fm?@K{8BP3%bECNb z{SAWosa#~5Zj(EzDVq@`0uk2+a}S?{ix%)cvn^wY&aHxkdTnQ(YYcu#Pr@U8+Q)_k zU{ydCQQO9ZLD_tCzPMxwG0R<#;E%}KLNrO?nb4uvT2J1Ft0fo&o}ex3z~{L?_=FSr zW-T$O8~;XkZ$g>XzB4a3E=&jY;X03an)ergBV0$nt#Rt!v3Pu|+DEK-v+T_pEdaEm zZRy91%t&mbw5n280nC+mr_7?-RkrlM8&VDv4uz?Z9O@^nD2eJIH7!8hqXA z7*}WE5vYSmLhg_am#D6K)+fgxT7jT#VW%^}qh8`>wIB!UOX_phQCSPKel5~OmavNVaR6=a167%z3`+XQ?U(bB;EZ3$IF{=MPRW1g{7K`BJPFKf@bq6)Q~`Uu*!A7zuI{%pm>*qw>ZT$Dz`yJ4S47 ziO~oKHSYCh0>_V*WZr1O)2+(QT|*pwgNp+N5gr#e%4F?xm-3N84e3?)RTk_`bj~>q zz{)K$ZF2RirvkvW-vriC{+_akk^TrXIY^7+7IDtIey@87Y2#>EmJ93%6*qt(^;m1^ zc>s$!b%df-RP?#@<@cn_UMg3bOSs3AQ+a;b>xbn0y)sbqz)r~y@<&Q)u?|6}^18;W ze#s;%;?M?(=AE0c517zP5O1-n`J`k zpN1i4WJi^HB3~!=I1mW2y9bepGBvfEucb~=dd3CErMhv)c0U;eJELWW-}e9uo{R?< z|0}2nSNAbMt|0Xb|JG-MNpI@X(&eg0)4;4@+cR&fK7PZW{aLT@;~s#HjU5K1a?)_< zI?*-M0;@^Uc&a#mh9^Mk5RY>ky?t365>N>G473PaiqMXR0(X(x6M4eO`?;+9qI=>t z)TkT`zk8OR={8C_m|r63yl7e-H|lO!=nI1pWOhQ1t^#z z3(S#Jho^m6s~}ZpTn_AMH}y%0|D#;Om=}ht$ozkwIrTGt@_Ie^Yop7FRwGhzqX#1C zc{R&k^WrliO~3Qnx8`QXs@VLap_f=gd2>Mt2QYYqEY$x}W7$T}M^*CCs-SI%yeW!n zR48X4>Qugg~c}F=X>%yM4Dg8f%?24#QVoB20 z^?lT&tfJa~!%NGjT+RUlyzQeI-O(8{_@QtJ`qT0|=_L$B|371&$u5(nxx%5r&#oa{sAu_8r&%GNdxWL$V%r~oSoV0y zuc)}L{#?&gJm9%*8&`B?l|!?(p)Cx%gh7`u=+2aXMUBOhuwvobBUK7l@psHGL2{gJ zF187|!Bo`BZ~}A$cgC0~dRDA(WThagB4!@~1_@`4=M`U=365k7qAF5eaPFd?NapY( zN^*{W?1nH%GHZ%818`dSA|?I4g67sLNwnkz!wJ!3B)g0h2*Vw;9B_ebrT85KY=Xi1>t>k4DVRb*Q!FwM$5U znj+#8Vw~wMLA^OEvv~pg8Ng(Kr8DGz z*x=7&h#iw&O|hb7H}}Iab$iGq1V(=!O>F32K8s-v1MJT<+vW#K`gV_6WG^2fkk5N8 zusU?tC|&^>J&ftR;g7)~gtv)Jh|=qMjw?{m8&XorzGs8N@F2$%Ajfe$ehTW4R$@zb zZ4mkCLWdJ8RYi~idJHZYW}pHZCz^DBXE~^@6B)6Zp;<7@09kaq`7OKRc2^~Uu5yxYA<>HQj&%y0n{ zM7+n=0d@V|OB-rkXC?-*Mlnz+KE+PQ@r5 z$~9_3@psJSisMAfezzK#ijSOsCdn&pZmf&AA24>{V21F|)^(cY2G36AJ+X2kut=(be6iFQPP4Qqzsi8Ot2ILI5s*H$=&zqL8uLIisu!Bp z-6P~ULg@ox?YRU6yZLB;KGHbV^^|)E_#%rHLG&8Y!C4tb29d$h%1HuEA{f}KfB~XQ z6D9ae%~;hWfjx*c2rd_d1dA>Rp};h&_F@`BRuFeVNQ-3K$ZXYc$EM0u5_X`vQL!Kv zEuNd6i)W2y7(I#ul{pV|BYO)0gd3*z{p&u0x-%O!!mb0@oag(0fb!;4GRU{@5OW_k z_e;?ms1H_L|FFMCVytQS{GN^@Ij=}-p_fZ~^9jULkMbpTwK0t`i2-Dxpv@o?$P=uI8HPjKIEU)I#&=wp;cEpkC@qZ*x;D`PKvDyrW`mv zVS+bGfenfAXSM`?=-NW=Pz~m?6YGutzMx3H-&r{U&`5cko=;xf@3p}|Hsk9a=e7g< z>t2t0$R+6irJohbZr1EcCF14VRB&cx=@T3x-nXoe8dLmx#QEkKvApjGrJHtCW)FWh zt9A8q!4i484hrm_@z497oyC8r zO^Nc)_x+;$^LUA~GBzzRG&yE1G&440Enzk|VJ&22G&M6~ zF)%h_GBY9|cx`Y^O*%<#b97;DV`WK1JtBB*a4uM-Ix#UiH8_*Fv>^&LR4_O?F)=zdIFsYFY$Px>HZn3XWMnO4F=R9?G&E#n pEjTnaH7z(cHfCjEG&5r~Fk_Q*wLc0qR4_O?F)}(ZFtfb1WC(PaZan}1 diff --git a/midpoint/methodology/first-steps/hris-people-imported.webp b/midpoint/methodology/first-steps/hris-people-imported.webp new file mode 100644 index 0000000000000000000000000000000000000000..4002ef1d78a61f54bd2e6011c4909d5f0fa93904 GIT binary patch literal 60798 zcmaI7W0WRM@GtnZr`^-Grfp2ywr$(CJ#E{zZQHhOyL|q8%{=vgZT)}C{2#fn zhDHts000pFj|8uQt-a$9*8RcEE{?YU;glbYY+$Nq_=78cFqQq!1ODKZ|M>d<3t#+) zP5uY}k5S0>it++KwjuxU@lF0;SpWZp4NUE=eq{ds$PgJ?S^u;TtopyO;eXikKWt^` z^z&^0L;qO_V`QzQ@KX}~9M}L6fEYjuAPc|;=mVSpW&lfoBY^s+wEp2Z0OWt_`Tr04 znE#_M`=h1*qh$s#_|Xsq*Z`~mdjF#j_^%IsWPa#>`_{pjk>P(>Krs9O0NB>|_dPKH z01*!We8zl#zvq5`f93%IAR7QckM;l7x5)tjSRa4*G5?!KlnnsD2Lb?11OJ<+p9}yr zhX4TRtG0UfdjE4Dke@TKu`vK}R}28assR8{l9K>H zY8n7QV)E0r=KsO&Uq1@}kKg`(W&Usf{fu16oga&6cfrR1O3?#Nk)UGojTt_3N}CEE z-#~%`ptim3t@m=>y%JbIp1V@4e!47#Sz6m zG^>c*fQXE6p6qa(GYPCQZcaBl4z-N9$I;;?p{VfXR#B3rJ5zm?xeO^3*u36#`hpJI zsBln}(5fuzXv%3!XMTIKraXUhu&7N9G}Sj|RtzyN+S%LVXc%NFJ7scLo|VmeEexCE zl($E-d2I}x8vK>XFH_S}+BD*RTv(jGZ@? zKm(xdGL9L&lQp3(SG&VLy9+YGduuK)B z@a)c>K7NmHDBm1!jvzHYI#Y%@S3I(I*EKfYR;(H;Nwv4wX5gwD>Y7dBs^VEKOr5W3Oi~|>L)nmv!^vvLdZF4j?x?~tC>n=6 z>fA=iSclg=T>$iyjcVC$hjrRx-?&f*aliN;?2iu~-QY8R#k!WVI%%a2MANfqyD;$| z5ivFAr2bI*AVv4~ecx-F3>MFRbD;NRhu=`VlVPY>u2>~gOM-LeM8(EL2T&7=leKXZ zi!EV&zI5iihPV`#E{PCMdMdJ$p}V26jc;lc{rQ`{2d~jshu?0E(xYT3gE5X7NdG@} zd1FQ9g_|LT!n7E-ECMC3UApOvV6cY#s9@)w_*0e!AO^<3k_njH@cdGfkp#QHsrihY z@#91y1`EJPmF$Hz`SpIKV(ni_Wur1uOR;=vBAMiPq;VEj3hBds3||cX97l>VR!wZ= zgzb*8sFw68sThB8=@{4fE&jq0t(xm=dDEE?pQhFK3}1HtX|lo=%NlK@p0cPhYU+f` zxc=6;8cLeSIr_kIg;KK3DU;qbKxw%m*GOtot)r@;s$n(_r%s|)OCnyao3I>jqFS$; zNHU5sO0-goGg50>(KnM=yKB5b0&tOH-=DHV!s6F49X;Xzrh&E2Cp%WOR_%tFmPZf=R zq&=rf+>kj@oKt4?q^H!61Nrn!%N7;ORZ>#pkE}y1u%)x0>yN%bq9B-H9PTu{M8wX5 zTl*#^B9gDEI6R-!i|w$Va$2W9A>7F)CSVrB+m(e~jnVpAEx0T;M9GP5LuP_(*2W0b86!gD(l&cwg>)`tG-i19L66! z1YoyEQ~!-@x}G#A`i@mz`#T#bgb1#5Is4nJd-j_;Y2#aGLjPx`{x3Q*8tS_4YLDJ| zu(Q4;s!8Gurg1~^(?v8rCbFdh!07(OwB=Z?y&M3Oqrs>_&?`%38| zxw6Ik(gCSK=~BDh4aYZbsbAn&l(ik;SZK|ra~j7RxI*9)_b7YVNa`XYb0-^AivfvK2KH*-AGdTE~1mhfk&S7lA^ThXV2l zu+Na-jKzTKq)8XUQyyE6Y8fBmBsR#1JD80gO*t-Tw-y;Y`=V-sj3lj&DUFrJ+%E}n zB&5tJ-ycFpZx~uA@;i2Fih;lnkm*XWRN!F>Pa*&5cAott&d4;db=wa!`sQXO?WPr{ zVi~iN1Q4YrOBs+wH3!qm7AABrWHnQ3tgy|=B6tI2rzLFkc^oDZ`7c#_B_P^H?$60S zeCT^u zW*byz>b(tC`ZM}S&$TSHU-xUOd;aN6pti2t`AMAjbd#BVU?S=hBY)C`SB`!;bb|Vt zT^E!;MX!}kyskDW(ld8AOx~IMvushLYTDNlz6!t&W+~sLO99dR+p!~LoIt(97SSh> zkM%Qcv7*5#4TDa0P=SIt!4NekXlFt06nouRBGQc?t=~M`P_r;?@A$AfzVu7D4e1(& zfjbsu(U1L-ZMRgXtnea?ofz&G@}s34qyV<_;^ku&qJin2?A60ZLx5AKty<7_qT$CK z?Dl!e&)Ngh-u&m?ttJz)M(n@`=(qf*PK-60D!aV7Ed#{+Ei$&%H1o+aHdUor&Wows(S<1j2C z>Te(cBgoBT+rV9ZrN)raZx|*-3Y`-rS}7yw%J4+m$ubsWr|MR1xg4a{2DES!9|e!b z)Hru^N1HK-5lCx2xjWIH5joT~0JoEL*1>d=gmy0fpeY%0M}77*SkU3{f$STRaM6}- z{hde7h1Z8Yl=hj&(gT+4MIe3ry7+3`CXs*Z0nF$=Uqspnf{Tinj;^~F;Sm`QhBEG3 ze}5U?rVpW$px}Yb3ofqAN=Htz%b?K4O+>U6lhJXGt<%00 zhk(WvNO)Yp(TAiRF6~*U_^koCcg&lwn|M-=sCPvXQx3IDg;t8Ghk}47OWcsCmwacI zo4k!rO-HG{I#&bvIMUh4=~{?78w|9==pdyJ0nk(d_Trb$m4i#&5&$MI!ovmdF2l>n z*$DKm*aIa{0GYw&*?6;RjvCSO4mqx024pfpoaJuAwv#i+1M`ZHrf8)&Vm>1R0h;#4 zD}<-GzyMpw+usF1JuMC#6;cJE){p{&gYjIO{8`gPU5rV|Bg@h9W95Q~ZfSe|166t* zqdd3pf}|a&IP8vn2~F#~WpXj?6sG0E&bwu~disqs%3-ywA@a1}J9J3Ss}1`Jt<$Z> zX5^gCL}wEk&i;21o8k3s{cy4LM2(NYX&o{fc>@X^3J{fqKwm zf^qBUroDiW#E%0&Mbz#Z-b@3v=$-&Nl%}T^=@-!AaO4|NXZxSzNA|P=dZK8qW0~Rr z8ecS`*l5FFP2^4FtXoX}0DuT^RbXHM@PQiCJmn|>{vW1=8jn7`DmUS7<awo?K5+(Gs3 zGNC3+Q}~j>!iE-g!|h}NTAv-d%yHLhs%iwv66m^NQepMbi4StcEMn-{LKnGaoEKA} z7R0Ka{_H_TQ=Pny;Zj(Zh(&7=(J;^T4bO~RvC9#6m|Si@J1HuJ`-jIDGEA`bg*<4Z$` zcex>YGPoH**G^D#3GacHLj1`9wO3X#BWIjHFbk4as}4FI&pi{*-B_&G5DwHoJv~u< zo=hp#MI)8jn~a&>{e;kl9>b2A;5*ZhQ^&r#FIw6XU%rx*7G!l-+B#pNwG*^SJzqJQ zcp))!g)A)SN->)6KO`xU4Tx$m^?&HUK7AVII?Wt=I_L?=DXBlrDLSU(FN(PIw8ORl zw3$@^R+Z zm225|>OzDqiWxdSEiMI2z5hN95v9=lp#jrTvV2czK~#Uk z=M<=I+c26Ec-u*qH$p&D-HC(NvDdp)xZ3!_9&mPk-Yi;N`lMrn3*qSAqHOpje$E(O zrpG~GSc*@+#$7)^>cg65`Ok=D=Mk8Qd_Tujdz65U-2(2wjjyhE(qFnQtrJ&inlGW@ z;Ug}8V!Zv@srXlun)aedX$pdMm|pYXxRunA={&k;1=7vvKzBg2P^QDNA^s>GOu``eJh4W>L>%TGm$kPq&vTue;@&)Oz=$KfrY|5ag2p|nFJ+Sx zOc%!$OP&)j|0VE2?7sFX=UOdDe!){*3NmG~5Z@9tmLm6G<;O-1{@a(F+3mpDQ3$?K z0+9?PC>9$Z7=H-~0)5U zGZH#-!Fq#Jt6fm zGj~b)w?h7gB^CPByDADKqzSb{=10$=+O_P0eUSOU`wPc&PU3a-d&wjv95ePhe(?-F-1QDNke5YZu*oOME^Be9=!(7hwE=cR^D6KF|ob zx}jmVn$@uDItwT(Xdtm*nNy!!%m&^57L<@J2UVCW!aJ=~i_S+8vP6XF^nC9juJ2*D+bIO2b<8eU`x%)IIVn3f z0YmdViAVkFW)vTXdo!RRdVAxgS!LL{wyydC)!FmcRxLObImolymP#}$tK@a}c0OAJ zZ07)LKmhj=a!RkwQTN(quVp*ls|sGD3KwY`g2r8}k7OJyNzXH`1-IuG==li@&9>B? zUlV$#Ww;^4@^-f%$Z<&`9*_|NX}f0*_#QCkG!7JsnOpm_`ibzn2lbb5)-gCXp3`^y z4OG?T*>4_*8DIma8ttXbr{k06vzV5jSnRphpYte&9yuMqU8Zl4opx3Co97~7VJ#ta z`Ae&By0m@ccr-cBF~mKEGIjr3&?j?Ka^N&v3I-LN?I51@U$&Ny4|X!J9X;mv3Lb4{ z%q906|H5U!C9Qu9s=nVfYyte&vV!qe8&cEDwP$!?y~*{fJ{qPkK^55hBzq~`^K-`= z$FwRvVPUd*Jl-$Y28nRF(F*#}eKa0;TG;HBV6GT2o2Z5mrM_oKVLF+m@7~|(`J(-Fh4*$tU}1~hoXvgUP4e%6`Ysoq zn9dkt(%~YoI8Wf_uFLEzbK;PUyVg!d|Ip6eA#(&o<;xA_>XkG8EWzmbB?!!sD9ptz z`}owdxS~QDS+U1AIHe)wjjD@J5M5qUl;Y(N2^Cg%PaeZ>zTwbvf?rM~o%&lZ&B#S; z_huJfc=WTDu61*7&d5{kJlJMT?4LnAq(aAquNGlJUNhu{Kkhm4=3J5UQR7U`9?M;v#1_>u8#$STT{xq0la1j_N<7)ua+l- ze@e5(08PK~Sg9um+)qGWFDgpkj#iV8AR`KCgOuv(`bD7p5^K_k8`r@f8(S{NPCQTm6noDA&`NhgY;5I&J=YJvmgDxKQqT-hg)IBjq} z4D{GwI@@2bBpl|jh%vEKJXBi?2rPr%*8jBMi^lCXoS$MkrGZ>m#jT&r(_(G!JU#Ck znipt)@6|*#Wys_-;Z6(H`@|zNvBaaSpW~xVzF8r%0~Ms9Y%!Dh)v`MxSXr6%rCmTL z(&*g&+K=e2UV1~i?Y16n=CB~-Av>^(a+XBNqx}AN#*W^svRVQA8lKiCY_ruh~SpAfBj7;2cS1vevUEtB_!)6G_8_b`ae-d4C zAZqZUXU`J4Gpj%`2J6575;CBQsC?_53wcjUNCSeyUN;y5JS+yi>u1ximX1j2k(`F|f7wUaLZ{{%@~j2H1hYcXmU-OzLZAb;9S2mNrI+jH8yKKz)-{Ix8B+3u|gK zQ86Kmsex_qe9-0ZKd6xj7(f(o#Az>D;bHt*U<)3?)k8$XVQ2 z$#N~-YIOd4*KY@XRMu&m?Ux(3#*6YesZ*zzx}&Kdy|blC{tl}VP3=u&`^P`e&q2B- z=4l!BMAVFXo{VWqzXoT{hJ6mq!jjCp3XYS}j@CH-bpMzcQK=RqUM3CO`SH?mh2(eU7Ffs8kHbLJ*_x`JZ;Ho4h#a}t*kvTr>k@ZHx7Df1`& zA1YrbE3UZyXgF#*)EGt$q*tNrm7L|>11lzKkZ?{607&{gIyI}b3UDvf&CyF*; zUuaHj1e$^a)()e;$r=S3-jAJ#;#DV55P*W6jvdMCYKg^d&2+=B%nQTs!0O-_L_}V9 z@ho%{w_(&Tbkrn*%v#Mfv?)0AJ+HSmP-dlG#7Uq)llnW4Y=rG2`lfsNx>Rm~r6%DO z)oBHqFbklK_toM_n%tjFg#3+=-Jx){uxilXt)9!dz+*G=gJVGOs^scvb{Vf@(;%O1mx=4Bm-|N?)6C>`oDSkn3zmvml z5>TRznv8DjRXO;K7IX||6zOfH1(eZBPz_;yv<32GFRU?KH*V(JN|txtA(~xJT@5I! zV#18~J=QDsL8?#PBGT4tKH?UwKm=)T4jLeJ-3wbzuGkPa?x}~r#TT5?_c53b4)D-8 z=^XAh|J;EPtM<(Y?GU&nJnx$IZ_jJO(t_)(+h*hRP>+Xu=Zq9bq2K7 zvlbxN$Y^q@zg|#(l6Z<*E3XXmSWFMP3U<~RM|!)qD&jOnccyGmGczK1zJP5fvT~eFNkqRWHP-p8a#Jq-(dGd ztgqR+!BV+6JnYMolLgT;`5M&L4!BS1*%uXT4a%y?J4pIb(AC2$$7qto5_;qhZD1<52&{( z5!Ol5ujZtUNDkE)tmvgSAHBggHXx!ew~e}Ksohr?QOwDn779;Xx}G@kUO%9_lPsyH zYL)6f(~G41q~rx>2anHdxGyglIjo{Y)>m2Tq5YUAKZ}8kpW&)f$mv5q<|-c>Iz_%w z<#JZhvd&8AJ2w=9UFPEBfoB>PQ+k?*Gin#V{~%TJH1Q@Z!+CmSX^(p#zbKOdq|cx6 zNc<8&Ir|V&U(pABg1^zf?h`&uUBM z!Aq9A&oohlSYG_>z(+OTlhsHHc`?Yt1QEr1u%g$`aX4P&Ac+G(Rp13HB2{&nkvs?d zeQpTTIsHZqM{&nm_W!AT?8!v12q53%cKKov|CP!C{bQ}*RG{$PRZ|moS=(mW$gq>~ z2}yO~&p6k8GME-`YGWOd|B}m75h`>hC@h!kg>ps88~w zFb;m*FqvU*#ic;ed{>vKuT zsp78t6ZS1QA12kjPE&hfd6}B8r7GoyGNxuq>30Ge`EfD}MYJQ7Y)sb^yQ4EE6N_aM zswD@SGkK>ae{Lg^{Fa1Y$zrzt#k1^+d;t9DY?*2gDnSKO+(LiY17@{w(DRr*^T`*qopOqv%!cf9cqP*15 zY6@G+@a0}r-VOojj*X~1A)%wY8EL))0MFR^9QvBug}o zvcl?od;ixJWJkKH7b`<=;>(hpl29#NOmc+9L^HN!C9=O*poYg+{dcIaFavXcdt3@-nSK+e zgsm`7^s!~k!02>|`iaIQx?NA`4RCWU^4=rK4S~uBHoEz!O(oeDaTyPF2a(hh`UJV4TPO&0aOgN`iR^a&^Wq0zaB8jVXj5ek&-)*_jAQ)&! z-#ho{BY`SDOo1%l=dS}q!vy>|XJ%JjX_Cp>G~3210yuXZ*98DZ*(bVPuzb@TzCoz7 zBTlL~*8t@l*5GeXxf69ecN(RK5HC&5oMRso9_Bfkq2Ct-9>qRcF^D(_V~cTVOT&=4 z_me1D-Or9+96EU4Pl+%}!B33-dhfusJ_tLq!-psF3nJqFqzSeFI%il^Nlg{j-)AQI z6dXC`YY2MsY*;~<*P#PknWLmB5YT8%zxD_;1DeaDhlamdKL1SpjYh#WmgELEEGXEv zYZv_rLBH$g#`|7g2+7vY>DR%luTDJp?ET)WHZ%PkPrisRLlQ((w6$^a>bvL~-Pb<+ zEx61BtISH2#at^Z;J3o|OF>#XSHGA|VcD~+NU|7j+6fE*OmYT*0{~wliJ7a6Z`(}G zReGzV7c^2MhDAj3N6J9rbB5bzU4xfayO)L-zfll!^AXYXMzued8(eVQ1JLlaubc7AE~2KPUjDKk3?2GJ@HBB+?bCi|TW@jAC2))o(oqT6l~whqv;WyBg$oYnhwG`c zLmuRTlO5-Q(@6MTkJE}QYH@Thy?)%as4ga&b#W5N{QTym;iVsNd8NbT&fZlsPd2s~ zg}ny|=cNPxob|L_nZwBK=pa`H;^-liT}6Y6m`XuT3KY?89!Qn+SL?%a=kFIB0dI-$ zTavoeH<27Z^ez^nrBGr%qjws)HW06I5AF6Zepm7{yb-zLe_*~wRyLD^%s57?}h zr`?Ox_{^zoN!-;U((^W2cd`w8&pez)3VXs^y#(<=`IKopv})2oy)^;!T!%<6*o@~a(%`X4OOa1@ zLQXH@PZTNODFp114Zw20Q^zzIgp%9K2g_84N#O89^&3L5w!VUF7ts9nB`!fv#*y+sdhUB;jtlqM+*!(>@O#MR6rjw58pv%B9g3`OM zrCO&$>fhhdeb>nIj|!&hI$EcM z0QXyl@l*%GLjGLr5aj~2=wqDj8H)L?8UI|dxOgNcANs84KbNziZ)zy-&JH6_>|P_G ziA$Uh_3UDEFm|gn4u_b9V&qM;%s~yHV#gdhJH&sS2pYk_S+J_KY;ikju_a*Q1ndh> zEy}4w5If2C6%gS#ALVGpK2inv@R<&_;Txg_$_k9wbU^ciS<^crZ~7gKjs>DNfT=C$ zdM8jj3o2XI95dY7Drz|jQ^j^x_M%6))ZZS-q5R&pZDznXMZg9gW4_l_g-C&s5D5s& z_;9m6NPn2Js4ih7%Vc-s2}rAXE+l?dRGc33Yg^m_sFStz9I#kBq0;gYIO97Vn2gVQ zL)TqAtxJ82*R_#&HaNm4<-|D&`P^;ZI08Q|ix~JTAoe<;G6v`AX;W9wR?w7f7L!$s zm(9gVsiaYxYQM0`YYnQJ;6=`}HJtwkgEVGn^-EEA98QF7ykzw+XU z$Qh*X_2}iTI;fQD%T`7jgtOtGn$_56?29b4mI%5MFW&%5SmoVYom?${l zkAv;rZfkwQLFucPo_fd;wdNgEgyt7=~n%YVI2}m)A^9n!Qr;p zDfI%;EF*Idhj6^mz&3&VsXk~<9&lTh1a6TJ41Hy<7ikMlJ5*z?PRcv)jgFZsFaI3+ z;s9)ZkYGMrV(hqc{9hZnjDf=^}J0rD&Xp zPC;Me)^DO*D)@>~YvAQp$LCZ<4L*Yo5>;VAIRYam6%L`HzMwm+=y3p^+6^>J__zTB zFG4`L=*r2~lV+;XTrS!G?>rVjDCrC%oUbDD{scHauz+RT8-=E*vDjO?ZVZ%2Y-^cM zwfbs0#)WS?9!b>g{%VdN?Z_R6fH4O_g*Jr#JV>B-FJf~!*xAu|MY7K}%^pO@y1?{$ ze2Q{Nzt3u}&QO6GqN1CG_3l7Co!Pn*nD(D-LC7T=;Jm6Zf9sU>Rb_|&$ypE-1Cyyc;U?IOk!AKRN?G0c#zmw z(pz9cH!1dqffiX)ABEe~ohq|B&S~n~5@tplZxcByEwsWZC3=D73hix1R%KA{Ty=cL z;pLHTmGXtcOI=QgD{`9JOn075n24S=^ceJ@Q8ruOeP)%-FgphV6<*szi&fc}h;1d5 z^=Xa#CKF`i`eY` z=bnNhw|W+DGaI$<+0seFFeQp1VpM^KNIe1r^Qi79Ii6;Zz1pWljR0}fP;MR}dB2h3 ze@^aWCAtg8f+!P15^1|)@Xb)M4m)bNq%&rC>k1ufnAoLxnSBPmbX29!qCtrxKGl7D zBHqrvU~9u67p(4+zUx8`=PuH4el>hg9a}mS52{BZPSjB!2i3cO|FB+;vD*)K<+eRy zy0ezXP`;}XDig8i%TCgZnOWn&oR(*W4zYMG=vvm8+1+1mh&m3&5`ts|ik5b8q3DYf z`-itb5Jp|ODhJp9Q@LKCZ*253(#bV--|FHdx4=36#Sm^9SC&J#Jdm;vVcr|NS_zSy zNXtalHy|tNe(4wii`fomM|$$BEo}Bq?g7@e&O;3ar)Ea30WmvTsT+f@MJ)5& zMZy>X`_u{ZEW#uxk}TLvDFO53Lea-B=?np}O|ik0F$o(cUJ|g&P&Pu!gRmWc4QM;| zi2RE#*sLgX$Tr8Vj`v`_`KrD+9dD><;Dinp4b}%FoYZ{1p$unj2O9)`ThvODV%&X8~_1sEj&3be^hCAv0IP4>ZN@e9@!qRLhp0=2R zaNf#{cw6$W%k!nhK@TRNwY*-Jogc*!&oXO2!gl0P<5q3E-rb{oNoaWi{!Lo8FJ7k2 zA!!sRW3Zjc$oYOpV+eFkz!DCR#cddPqYm6I4u0tqJjtdI+hexls_HTStFLV_Fu(t5 z4EV_&t(nvLxMuULVLs7WOK?7G-1LnMoE=|JK0zjI4R5AP*sVw;eC}z~8Pj#UQKx3i z=sgTXqzviP9R6?s+Ya^Oo`rtR`(GDsD5jzz(oaeZ3S7r|$8;zC6`*?dle({t&vMBR z5r+%yi9P?KZ-g)r=xa_wamuy$;?j(;&0Ki1#kg*>IL;GlKPa{eqo=AZUkM7jZh|H@ zryX%uC94X>W@U>Sl)aL2>M|dBn^x;f7rGFW8lV;VM`vCd(1@FrNt-Bg$F-&?}+X2I`s@-d!#5}OPaZz#vFtYt`_F9p4U21!j;M@s66SoXryiV-H zJ%oTkU`nQi`+3*{Du<^upk^8W?$B#a1e#YOg8)3?<}DE#oDD!PB6yS{I^=DSnXu!= z+!m~=-+^dhzwMUzFM$M1^H*th=>j*ja2zgnxVuV?dOh^ulsP89_@Jm*S|)C&e&uIe zoM~s0>ekr~jVFukZsiErrN7n>5Y*q!{YYusT`o*`_Hv=4If&aNw%bzbJDSPe87Hz3 z!v>yR{}8*hZEYx+jXes_3y#65WTIp=;i&dYI>vyLXj+&OppD(F4w+gMwHHlJ<(nGG zsDg(M7;UynbGQP0OiB)nO_*bzpJZoM4G5tLX(L*UuAOvMNfp{4bw2Ccng2 z{M6p;O(HHLZ2weF#Jc+`*;cW`RMT)VUu)D~4V?9=%p9NBZ9UmA6(_vxQfk>Wk+=p+=@V+14;E3s|)(Q??*x;%^&ZgUG% z=g_+J-3aw)$7vgMbI+x+ybF3NG`!_${jPGKJOC;0bCRc={>Cz=pCB=R7K0g=Pg*cq zvCgi%XjjLB9z1W(@a#I46FMA8+=M>Ii`L_rW9a@UbdPpxVEr z$~-34x7f$MZ;y|2N{ZWjVFi10SI%v`Kh#*r7gTO-w339eA`L}Xf-iM9_wKp%;cd-- z9OAB^zR{vo5)NhT0YK{4pNEeNn`xo5?;W^X`Ayj?${ z+RSW)4t7TEsJ86bHp!h1O5*0mpH9P*drJyG%jN%eTTeq4_$;`4X$9Bxt`fQ}$2Oit z%(@KShOoVAH%pNz;JZipgY^+|Ik(Z{nsXyKe7z;qJ#nA~W9u^O7q}ym)x&Wl4Z~zm z_%lH0Lep`g($mlvN@{ylcp9;=3$vh7E;|mzXSR-?QW&2`^$#5|v4DqQ7yf&cFcNH> zzz!kbYvLC|`UAyTER7o;MoM#ONAG-M_!Y5lGr@)3UlVXc&NXxK6tF+Wa`Il-m@tR) zxR6jdt?3zXq|^1=Ab>g`{qbvDhbBQP8NAR>Rtr;b+2S#w@avniLW*(zIln8O57Sl_ScVC()8_v@6;msw)O});gTGZ3UeZFVF&JuP!O# zI81^>a`UE*I>*U6)tbGtGTznO#rW;jqohr5tyJsvU*j}jCodubt!!7sC4SYYi{C!E z?+s*trhSqs2Yr=8Yz%2~rX$pbN~jM{BLzzKLKt1F$UXPl+*0!}$?L4@Auy=btbI(8 z>8KpR!0)BVyHC$l50 z?vb7HvuvXq{g%fe{!3ZsN4oUf8t9q7U8#0G+pzuD;DpnaRBhHWHh3t&f9it@{+|%u zFSPfTOO{FWij@q~Z|a|ESKeb443~fD)5?ubwQ(#UN0@{&z}vRdCwoGBb4z)fwRz*3 zI{%6E%`31G249~E&fVA^L%XmTQ4ue$7Yj}xAY%@wz4Ta$clN)4QWv;<#PPn`z}Hwf zzbmnt#*?MhS;>w|z!kaK3Qo=De=hOah-ZJ(Ey=pFc&(W#=eiN=Q;AH*))oWNFvI^t zQ=3{souz#z%|oYr)PkiXLV-A4Ocb_y5U_r?8(Fh6+XZ=Y-@R7>=9o^RxAQMFcisTQ zGqJ*8OT?$`;fw|+JzpHkWu1mHVALNZBGX!H-HYu8k9@W2+xrjJM~*b71x}E`e%cxo z_vzE^Y3X%zuB6||D-Ia+fdXU8>z2pi4L{62qQUq&3+}kiwVxhw#uL8Tvm&mT^L0Jq zp95@Pzu`V^5dw&!4R&RYH))APMWt41XZsn$QHM_p&+X~?a~%uL1mq;@!9hf(Lj};X z7%LTTVMPe-(zF$;ul#z0?G*0+d&=At+iQM0|2dFmx36=%Zod6)BNOwvN5lA(c0><5 z~EG~2}Iab<+bZb!*si6!Ejm!P8yMv2#78Uy}?*$K5KJ}1|Z z8RZw-f4tQ$#@@k;ufqqiO z2JY*}*1zT7_kfgaVTr4;RYZLKHEH4}{lR(D4tTtKW!wr+n z-7VT>E1P88?FXg}>_z0vw9o=pNs)p^$!CGWRLXa<-#*alL5WnJ)jf2~tU7t7>Eqxo z6CTReZRVpv@sA%Rg*d95@Q4Bf_Mm-%Rnvb7>XQ{dNo7JRu@z^>is8WTd3J~5s|_aK zRm7g^YmiRLa`-}OBqDw6FstHJ#DhA97{hO4mD`FA%cOSaou zWBn&U&zSD3p^dtM=&FNC=VrEve8Fz5?Yeb4 znZ|DgFI!9pIC)$7i)}j<;ywC{7-5NTtiYq-E4}dfY0>M}c^ZGTC#V**J6Ka~6_wXS zUh*gn;EGkb-PPwoXmm87uYs_6eiz&Afsn3;5!JeP$rMQSl0l$G97N|rE7nE5W&@+? zr`}mCMm@?Aw{C}US%ZxM)`@5{=Je|;T`af1y$!1NM1@X2;cG$knxkc8ynSGZp#`($ zYIv(oKAl?cclESFdur^h4;T2%&+bT9l)S}{X;Jv_y*2@pK!0yk=awhY744CEWa0`5 z?VC~GLo%@M5Etrng2l%NBCof(CH1#sp(xYptKxT{lGlq1qPrc&5e)dza3n9*9T)X4 zr}uAnhMeMAC0`P%AX~K9Nk1BoeEVvcxI~5>GDa<~EWjmE7vQ>Uqv$SV7~amnP#{uN zx2o7HJ=^7y{OogturY&M^Bs{t$0uXZsU-;sS4Z5KtU~Cer#UvxV@j!X*PlE^t|3}6 z*z4}lJ~i&6Y(h2@;*yaT ztjJf{%B#tspbF5YRT}?nweix5Dcytm50xpBn7?DAptQQe)-5Pc*+qxW*2)AM%sL_2e7GOChGC1!BXjk>dGw$`YdNHzE6VrrAj zjw3b|At9y+3FZE8H%1d@7+%D;^7Kn`?>5vv;2dK>6}u=6&JC?TBpcWsF(TUY_6Midr1N8w#* zABo@u5V|2%4PJ>OgB8>G%1GiTR@02kHK+bkpa{~Whe~e(RFup`Qp86BSIjnp~vn|k$;hpRtHy@=h zl;LR0+RqIM?OxuBLD+OV}D|V@}3UQNc^d&7OU;Xs17ee`6>Y z&f2q<*WohxjR9M`c1K6Yz~IpJ@HxEZWAsbesB zCr+=S>4IB$Oxx>^m}uN?JSy5;T~F)0>%zddjo}*#R9xcg_|vqk@`%i8sJET+;l8VA`QJ1>KI3zMRC7j9bawzy>?6gR2O?t*S`m zbDld7PD0H4+y+=OkUyTO3vu|1a%2v@KS-!z1i3JXSj02wz|4uG&T*M4`BSxnb8y)0 zqIR5r2K?nQU|=(k+hCENXuyriX;+~|UR^#m59zu;sp(DnY{%H(tLDv4x1Drqnwl$m z)naUqC&I4)zH~s47d9?2^ZV-jl(cX5uCV}NXUpm%;!$p82A>kQvOvU%yaGdmMeBa5 zG=lLP`W!O#Tgfm=F6-7nC5Ux9KHR~BH@%Min=S;EIGfA{C0Cq0Mk9>Se5%hkaPWSR zhoNC@%D`YiAW)hkH*((0Rh#MV0KJLkF)p<`#0$3_Mc{O>`dtf@!_mNo&A=$=Fi?6; zZK4k5Hx*^|4t&``9<7A@&|NLJBbLkE?)IPf>!X~yHl9j~NaKL+my{3Ne4g;gcBR&h zqK@2;WpZfOWPeSHiC3xs%k3p==4_1I0cIH|$C z!?lJOcjp|cFsz)@?5!F+3B@cjDZn4&vr&4WFm<>c+L z`OwBS3kLJR5hK;xQ#g0Z7?*ttqYsn_9?jLG6Hrm7Q+wpT!9w={eZzvreRoy$PbHBj z=GB%_Z|0#IIi)Pgv!!Bk62`l8#^8SttWI(;j0v?}N9rfyyt`ajBiz10#-hXecQjbO z^j52Veq2q~-Mh~|MrAl!B|hvm@*c7i|2cA*t={s1K7s4kh5iW_?VL>IH$B8-L!9hZ z=ZD7JPq;-xhbf3Abl zHrL8UM_F+yBR>y&;evRK-cT5h1F0y{WYC4sOa$( z>0OiN@jgGhfMQ%?8KZhJUjn5r31q-Sxl?<0~?)6Z_I#+dU9d zLd1!@0z*|xsoRdWKHf7E$r6W526POJ8@?na;@=_-91U-68Bw4vLOZ1m=}|=itv687 z>qf#1QI1>6zUf5Np2KW>zy`p~IKPSFuNE|A~Jf*SN}_Kh?%)mz1^Kedl5pBU~pHZxm1H zW_WmIU+h?W>V}3|D6oe6ZPEwUz0QSL5OclbZ|nSP(&g_CvnhVHuzGmG!R=y()OYO< zvl1UUj`S9~eDo&T{zX_0E|)sIJIG5ea*0KptT%zcql&8942h0SzzBec_M*Zw09qb- z#b-JOMh{@XiDWQd3PFn5fF;=o2pYZ3_whXo}`NrNpESOflzKnCbxDQ4P9)%gEXH}1E( zChc8&wuc!~zXc6^HtS#X$QsuKbo?KI~;9MQCwg?}$aI_y4sc5Xvjh>Uv`Dn6778xZhG>kR5PFsme*1KT$Sb+HKqxdarK ze2ikj*iJb}3yEb78un0Tl_SJtr+}4U~N6TIdlg& z1k#}T{P=|*KoYtJ_kkhLf3BF5GB|Zg$}2%i*9Y-^fVdb6da=XwZ$mgdDFzx!M>J9A zB4Fys#~qE!{T%=-%#proCkN_d4o~va5=RK*64Tx{ANpYZmwfSoRK-otmhQPE#Jr$d z6*As{EinGkd*2({`(!|)R(X6hZp}keSEm5Ox_sGz?FMOtDW|5mYQY7xrq;NG?#{JG zCWv(Ye!&G;*fAq62jEqEIqQX$OL?PK-4fyC`E=ftcA|{MJzg>KUrg0$4hP?^W-ciE zUcC3S%qEwt8b*sSFdF0CGX4)g<%?TnuMZD+p3L?rI5nh#yc~)NFRyoJHBBj7nra+Y z6Y$BOyqW+hio#hP>-`-7bc`dtvx6>LS9GP~ewOBx5IU=DqVh(t^B#M-iwh-XjZV&- zJqN4KuIMOt5vw!Y25f=x59a{Fs6GG1Oz7Rl*c!VZWS7w#NkzZaP`WLZMg%0&uQ}?% zGyyIo^w$+#2kH1c`N}^)6T1e)PXQRp+~>*#X%(+dIrBFd!Ia2*;kT_g7~zwm2qD334uWxcubRTIb%*MIz$VAszDkZrQAY zP5ba_>R?9S-w|fOD)rz#5^%w7Rh_7WryVQ9+h3N z6+I&D&N|EbwDAvf!W=B&4|`wgh)V&SxELPtJXIHaz5dX(Ns+w{56K*-)e{KHUu=ZLr(z@;oH2g+9? zh0b-LJRmxd)Nyo{aB=W^Td-kCmr+{D&?0vKJzh5YJsR5o~ zhHwm4q};hMVUBZ`_c}b%LM-}8P*{QjaFqk%$tg+kiA30dKnQN*CA05aGJMdTJv!Q? zBti+_d1I8b`&_o-QFxhpe19A#&&THf7%t$n$UYymH}AJhMq8KU^y5J zor^Ihbfs%9@!dAd*X;z%t#+Y!Bb47NBok> zW+rM`=@~IzHt~M8klrF6_@IM*p6oNdo5^gF{3+n~CKeizNIgpAf=1C@;FBL*-hFh2 zbh~o|j6q?UD1HEPU~TKIRm;a+A;hepia#>n0E5xEFP`c~7ur@Gu=jE&G98PsFdK@K#ftLps~pQ&>}*EJXAy%)!w-emI3njc}6WI}fPBs>rA&=!2V z5(CahRy^p(49zcM;@dT3HfG(otbI&2$0Of(D~`F|Fr>FXsY;X2p#4|hTy-Rg)un_E2MCiBYzx8F)7tLk(u7-H%o2zZ6}r7Hr9uN~^z z7nQ9QH-e@X0ATo0P!Xzif~}0scJ(a&TO)jZ1q}cQfN%YFy9|X>F^zH>J%}1zl2zJt zD%#$a(ncOsvZ~FiWvq9hbS_-uYDvZ`V1w1r06^?0vGv^o0NBurevi5;8&^@_G}f^Y z9I*-;A~jX2>5)q|EAkOTxQ_ZC$SW`#OEJRo@3E(uk#{V;JxfVb()p?dAbxGQ_I6m& z34E)lZK1z5)eQBISZYGG@k%8S7k#6xtmA z=q9he0b@_6TeIRx-gYg>M*C?L%MK|{QwhMeKwymNj9VcIn& zk53-fFNu;rhG#c2zmSYBilcMS=pN6HI&71XFKb{~t^rW(qJJ**7s2OO2qv4mpVpAf zS^p8B8Y7Dw?%yqUkp46L$M7G+f1VQh)_@%k9`45QAH#nP|1tcBCB(4V(opkJT?kp5 zdK-^fzW0R4@80C?7%~qx;1A^PR1*zvKy7rR^Bu)cIlhVK1&Ws_>(H2}KnDb4 z*I>cKvmF;}&LvvD$Ek4WnK!?1fvtN+YO-g;S6i$BL14{kb>TcTjYt!V!cmkMd3YK; z<-9kAR7Df%dC4L#0z0?Hnl;<>bM7_Lw6yekMBDp$LDj_N&GxOh7+;O>wIVB_8e$=r zuWWxZm!tnqB{l{0fe2U*7ZLb`KimpGo42&!K-ljqEd$XYlTEX zna~`{B*oal;~nudD>y;K^G{wC=uD61)+)v=>mUl3*yORt$pnW{p`}yKz4I6IbEC=~ zK%|9Rx~Bmrp1`W#l-nJaZpn3$a^A*J#0lxv)3iN8P}5!nSC~U1K-3+)BhlG#=@$}# zifAETw9@G=EOqZ?QNQ?$JQaH;>Sak2H7oM8$3!PC^_5z2Uo`gqjxZ0w7H-}4(nFcs zDV!LMUj_AOFcNEWic=58V6d0cV#40@A>rCMPb2;~$1a1dwwa z$8id@WexO??pPZri?VZ8lefzPujOU;G)P4RY$ID&#N~kVn?s%z-?1^7XZl0y7WJAf z->$D;0#bu&c<)lzrCaTdrduvmy1)5?)XusP%Wyv$)UOwT2{pa7x2jb3dbO%1-fKM~ zjWzv$R22d3yd(Eex&71P+=X47j!Q^Dz7 zsP|`w=`#*KuMT^5SY|q*|lD}Q`dTVu>W?@ z7s(@G*Qj)-cbcXyUj9HGNDU5ko=_K+1f(Jy?ATV08^4aG2^ z%eFoE;lAK}9nWEX{3gn3z-u-eM0zg}evgR%r>w<`WSv=s(QG3osOi2VR&TFgL^JiKF zVOo%nJGHVh6cCV__J-Ha2xpWveVEBC5{3{pSh#94A_6A8O;>8Lbb(J6)Y8?ZAo^wb zG{09^g_)X?HXnhizm7)LOLHo?)Xr#i!-&2mz+B3edP&@TX=7)Mxo;-RD_iCHroP&{ z;aIM4{;Iqmat1CB5Ii@YKr~0MPt(do8Euf?ukxemPrEY?C#(l0cnX@_rzJvdWW>l zQm#nLe*4*w>u3At_D#NC#Wpy3A?&kkCw=ncltsV&Y}j+d^0|@c(|J<{P$ud+o!B3} z_pH~$ZTYjuKG+dn!^ROv=CvA^Bngv?%JaJL!(qy9O1HrtZ3pR?5KXOz&4Rb<}lG z8%i1OtM0Fqy%7sKr!$>DoUX0mx{r};4tmYIshe(m*xg;>6%>$$!3;5JG2lEGaQfo7 z&S83Q^Lx>bk4?WY99|Ntfg*41Em5yIiX0lCT+vrjXW^X@icsZiql9$5ZQ{tu2 zMMEVuI-v$r1{G4Bz<0X`Q~VT)s%5uPUStZbI-{g|-I{0D=eD2sBf8NhL!ZMGKZ7=QymH=J_4y^MLfCjN0wgn*yr8zav%$?=*p{4hu zLSi{qj1kSD=?_xEGUU)Y?hPY#_Mm!2&?pi$Sq5zuf{QO7@L->t?t0(`@_b_L6Q>9V zMY0w-;OqDJKoEr=_wynx#ABcMMKz#Ysu@2ozwh^$ha4VdQI!`cmutqPb-&%rZkbum zho(b0yvqY09ehgSPpSyp&QUFH`B?aS=%Fkc&WQ3A>1|!I+xP30&&km|dfW?@YuRi! z^Qp|t31W%RiIjllr|Psv`fE12Vpt~EG{eDp?jDc6R6>iQ9?nj74g_8>0g(BQyMNTw zfzs)EbAQBbU8rX}5*C`{?r@$And|STnu9^P6vc zD+%yQ+)Bv@trc=)T=&QaBiU@XxmoQXNqZ8z4mY*28o9;WK^mJ=-507%&eSEar zBN$^|ayYa}4Z=fAiASlLXs0hSWG5{wfwYc-x(HK)Wos-xRJ-ku;;bZ9%R15NXFDUj zMVkplv7(^fia`S+VA{uY*%{@8Y%}~a%3x1x%UsadS(mO>9&q7WJytj6FWt9GaC?B1>@TEd$E3>p)#sIkyxO@nn2ZMC)jAk(T`U&|iNR=Arl^erT3z30-Fj zNIgHY^0N7N6MUfSP152xtm(;U3`Y?cyO~txw6Q`^r^LLl0KPlE1Npe0m;1}Fd=Cmh zg|O?AuwG|B6PvQ=sq~53Cd%3C2Hf8lCLmbVGa#-7>}C$R9|+j>*NX1ZU-#X;f1r## z56?<`cFg2;A5NZ6*bu6%mXCt3mk0K}Av6~*`BT}rn20Ux?I*9|)(^dxIaKr~SW z*>ZdNP}OvN@*T{!B;l0tePwkvzS|_L2|v>_Gn~fnXoomx>2fA_xvRLV!lMe&f6bCB zdJ7Sa(*R_h?A2R3Fr@-&O*}uTudPEAg~G=`uB1FF5`W)x1A}H)PzeF{MsU3jRiZIC zXT{Qt6k}95{T^%gJb5h?NHQAGji*{*t*|ahm~j-`c1D zy-|W*-yfsiaoxQiMF`Hu3Q3YV;QJ~O=TZ%+^R656o6r9g%wGTzkotZUCBz%lUNr1w za85||g@57m0_M5^w^1CW&nIX9kM8iF9mTt{J>{at(J@F1xETNdh^K_ahwdN(qP5KkYX+6s`1m`RZDHU*TehSgAn6h)=x+OHihqhWdcu@K zRY$2JkV=GpX}uU+0??_;3J@&qEI8fe3}dYlFVFDj;2B z^X@>ehY4~Bn%_OjOpW7oyAlZ2K;=JBe%_m=j6!f3CPPT(AldA@_oFZwZ`7Rog=fFC z2uRbRTv{?Ss=a2hd+Kg$f5aUfggHy$njUoWVE~A7Br{6?OAflZ{rdzAD)x6M;keXE z=9TIVv*=wWRZ6g9!BSjcK?hkjK z2VBg(*iX2sefaDti+Sgu^0zEs~%!+%GLi&S4fz75!N2*)Zeoy~y zdQ?P{BAfsw99kt1DDOKaK>28l;oSh?Dh?o+O zT)p%~4%$u$%K#c!WAzEazN_hBx2r$BHM@Q>U067}3UN_GjjF-o6_$_!luCL9S5ifG zTTxw(eVc!GBZmp~M)f>)7S5p`_NfAdOaBhM(4IZgSXcWT=sZQX#-9jmT3T>NcDs^s>yVVe~ z3oOuX0(5-nxu>rC%CyQNtGcahe@xM~)$4ppmTyg)t2IcA^Ca&GZ`^Qzp}(oJ?cc*n zr&%wyFhF-jxd@jgxlC*`aw0!^JNfEiM~l+`P^Ggd zM^hy@GaZQ|ngB5BaC~V;0)X0WKoIcN7Hc3ds-L!5tt-;9|K5+HOczbO!e;7Hc;s~W zyyE&jmJGb7WpfUThmtm|bYCZrcG_=F5&Z;Wp*X6q-1Qx=-6yZxTyXS?uh6A{QxNguoeQ(+eY8jL8x}cZaVYd_tnF~S_LK*nvCqg{xhS%d=Y{jy603p~0 z(D{RYR~qtaaL(PtJ_N9#_2Ywq92zMzpW#BiYb4r-KT>ug_3RSppg|d8OKTo5y0%DJ z0h=QAq98mdGe-!nqXk=gr`ze>e%(jz&p8?rP(J$ye!C|)Lr}${CU+wi>_c|4 z@P`pGgy3p1k9FR1IL<{QXM8h2mbe^(gU!Dk6PH>w8Jj#|lr^aU${1Zi4Il_rZ@E)0 z1n04;S1NC&iIb)UQE0+ao!}#;Bmx%ks+yf(rb!ScMfun>D=SR_P{Xcyb#@5^X_3{$ z1vGx+muiR*l`^CCmL#64W28|*lfJEAseEh>D=SX0y zN73Hsawl_Rz5$zloKN1iIpl1Nd_*pW?OR(z#-_oBli@X!u_+lTmhZ*X$=6tLDl#y2 zwd0&?UsY{H0ntYhp5`$|8IEr)4-DwSlU1phQl5->6^AM| z-^)}t>V(I9L zLv^PLl~QrhV*+TzB`kCY!cBanvr+ka?kZ()kK#5ts^tre6(nBu2%dB=xQKo?>PzCCwXp4FA64KmWDI-#%D! zXWl$Q7;ALASk4N~X-QS8hQ_Ekl$2L;>~|h&ZEa#>VRcC5`|f}IjeFH^rZp}1sy`3; zeHuFkY&EOr?C@+A#i%$GOLb%q$AU}_J+E1c(NCuWQIfiet)6|k$DvxtXR(X-T&|#0q#|QD)s|07C{z= z3Td0D0`0KlhNWw=NHFf7(o)v~!S7;aHW^wRbk1Z{QR=Yi{<^2mhPWq0Q-R4CEaCSZ z<$beEnjb(Re5gO6r)I!_h9!A;$o+Q!P{Hd)@;}T)vjBTe)Bpeo!N~%3&62YuG-z^0 zml7~4&JDwim70(ErcI5e`RAz2gkamz*ofVTBd8OkRU*lWkxdzb ze9hVd9d{FpQfC}p$k6kp`1)v+c}Ph7@9LatLsiedOsPAM;X#~aU7xn9AO0lWn9MwW}DpTx0_fFFk7tXN- zc6M|upw4kyLnz-DJY|UQ)6-Fewuy2O_DxQN0C44K2{!fD*}aHcT3AWy>$}V!^6hBT zqF7PXQrJuFN&q&g3R*%h-6=tU6+Tq6(f4Orlk%taeR%@IQ|^?5Qc%RmRhj0>{y zaR)a`K&%pxX#CBJHz%M1*Oa9+DhEIaPUdQA=A4x#!gska7aS?UZN3xLNSk9^cTI2PREl^jnQzmpAT0is`Xa(wL#3dAPc&DwR96hkI(rt0`lv4T}bcgZwM>d>Y+#6U&6E zdJ~<=GH8lMtK;3FH<+Z?;c4vnP}D;eV>7em66Os(gn!@hpZ?OrZyzkNGjARypa`G( zATEE-o#Z}nXnN~<_-{UoN&wZ>;R<%}{m-9R(;~G$uSJQoT@(NeUQw${ooTb8qe)9z zDtVgC3FJ(NN_kC}-lkn7BREH@1XYvnRdB#loF_JL>peRL0sCoT4l1uzYw~@g&YUZ5 zHlyp%-KNAc{8RMG2yKOW>CQ}uw*a$<&Z=cG!3mSM`A%FKRfOXLes%%bibE##Om`Gn zY>oY{0vrKi-O6e1Vb@t-AMZ$sP$0(ORn5DI=?9k0B`lZsW}}%cutgLQ5wM+VELkN& zWhea2)WLKaMvq98DV-%Pt}N1LF0XHw%kK5WoO!m;zT12!F0`xaIs0~g8Oc$J|a>FURgEvj+ekrJ}1vkpqU+)K)K+)>YJFIB8poa!El;WqS2(6HO-p z+ZkaM0%f$J;C7IGA&|CFrW1!yl9$58KO}TAyasM%E(LAVjHPbZNzMUz+jkP^$caz@ z1f(~zp%ZRNig0kgj4rx~)dfIkLt38Y{#?5_0F?M;;&;2PJ7k$fJ;c_RU}oE1Vt0uv zFBNEgsleHn3Y>kl#M#4MeFd{Yl(`Az^5*=OflODf{~1vkpy5)7fsky>w>!cN1WnAI z7B$Xta{yrQ3R<0-ESm+5az$TJn`+8-8Gw8_$}mr~6oXN{=lZaZz9RubaO7#a4Yp-P zC;)&*Iny5l(VGbo!NNviF^YsCDtJF*If~p#b0;B5-Vlb}cN{f6USNHr|%r*Bk}=h~MAwlx+oNFuCo$CwF0v zkwMp*{0k8afJhOL8F2pGVE3A=|ERNO#!hv^BJLr!euTto-uruM`@!*n;mme~u@*Mfzc3|tMn zNa*9Pv_v=beq~E zJ7ymF1SV5+OyF7z96E&Y)^zif->-zcsiMBy>K`o<&V(y^12i42e9$B7GyTdB3+{^E z%J;iW(NbRPyHIKS!>k`6(R=z;S%W{H78+T9e!ur-TY`MR>dt}p+uwdcz@@g`5&PO7 zJpk!ZXG^y(i@CD*a?sS^Ll2g^X|yG#P|h+G$tM}X8G@orTs2XzhV3vP6p%Y9V@HbG zgrnH4ZX0hZTPBjc2o6AoI#1y1vTPQmm~!QCkwA8pIh56$Q{7&Co;9vO!=s$*kAo$f z2?YufFdJsP@bmNZ)cRN7_CWJgf_+4xAMI8@<4u1@PS|KU8efAw8DR~ALo9TsH>9!%Ph7;8vznTODY*T!Az0ReAGj!5U$Z94k?zVtt}jRvBa z5Hc5)kyWBsw0OuuT14QZ=kki}_7)r`Utg!`+hhKB!sw6el(Mrb5J z7oHnxHU!x6>OrOG%BXAYcjPP1aI2u{JlQlaq67JD1%lL&<}?Y3&Y-?|OjOUTVC9@w zo4)>JYf^-<$z3H)jy!7LTv2D^WDojca*i#0xDiK|uUXrne{N!z0E=EX?v^?H>lNp^ ztz^uOt*Ss(GRm6$-l{zkel*>Q4(8Jyt+nwkt$&(2s5Y^c3jUsX+pnjEi_E{iw$fj# zWRTO|CVPD1#Hh~xO>!S77K{TgG}P5V@N}H!kfFrEVAX9?9$3OuqwmJ|H3@{^(8GAw z0u@3f&UDe>pAYM;88CohQ63R=3yTokTU!gnaX21kh3U=EiPO#~*#Z^qQku7g%bS#| z1_}hKDcfNL#o`wq#XuXvj7svcaXTkN0_C;6_W}_uwXQ7Iup}KFb#gNV00Po5s^i^~ zz0_!OEOM&IW4ka9;goCDmu7;MR$VaJ9XpJ4b-2E)-mtxT0173wKC*!>gy>X7eNy^@ zxB~Df&-P;Q=hXSV5DnKop!2V z5fJsg#kn&u?4SJVzPg|5v&WhgyvGp`=_9WB8BZKZgGpATUAwO*=#8 zR=LsdFPqxF<$Evj_8KonvbCpJqS3~yP0YEa8|Qo;RkYVCPg65-?U8*-&`jggTDm6` zU#QIVT4iYdmU9x&(e5%FdYrFWhNe8q0+@%T+=<8R?49DH9lwNrVh2MpdoL$dTuCuN z%CeD(WkSYfL+uTB=do&mXyslhvAHG3!32$QPz5v?3L?^Khzv>ft%Nt>MP;;WwSNna z0ANnl(@TPvOfkVy5gJ z+bOGwt~N3sV`sNhO<;sXoOADy_|mk^5g?i+^cjzZwC;jEO}F0Qh`bM9keaD`oi6`d zS^^Ii1gf51In2JTv(Z44u-$=iZQZM@(TdQf-YKhzt~O%*-s!~D-9X}|3cjG&EJ*A@ zmxW-w%gn!jg@Y2Z=&q~_k!=t}?q@-(W~#H{ni**RnjrAK+o1hWS0ByG%kjmc;cmGN2tazOZCT!tW2XGSaOwY*&z4TUS?C`$1YN zysbfCG|?6LW$ErhQYND@0>%P7M>jJvhr`f(@^j&U_NC%6V|ZTvneiEFY(BGV!KPPB zL*&p4*P^Wy06_U}CX0gYxtLc^_CRH{6=S=8-@yNn+44O~q+-fLQ!vC32}4j(bV2!) zjQ{}BB>zeP=de?;iLNC1$R;LrIQZ`a?@I$RC#@I%bF9rjMQW_E>BryT3&4tTk{@5B z@=?>BP=nO;V(E5Nv(~!PRCuTK4L6J4K)RjMO?1Vy0hfMlkM@QrO}hDXEb45X-UJrg zGmkPXrj_P-uQ3#W13F)V1cIVtX_%Pbpw$26ncdV8ovKCq0wiSWRd2#UlOj!^ctmDz zl3=HF6J0SG>|L+ejL71}UT)Zl?^p1M+T)~oke9Q1o6*9Fbj~|$wJ|mTxY5rP4=z~c z_E|9(1X>@1C!X4a>V%kIb46GdHRisADTPI{O^c%zf^S z)w*k{25RRqcaG|TVyX;Un@&O< z8Br5Rr5Q1EqdI{)wsNBo?x5x*0T}72E!Wz~sFRFr=0+ctNe}?=p+_s-K(5TSoq+UC z)i-_oX+ahNKnPBU7_Usz308n30gqDA8$;qY;{b?hHW{{?0)P*_*yuhcT2lKEt{yaT z8fwc(q7(uU005d3GdHRWsCO$jns_$p0u#~g9Qn+R@+dc^+If^EsgNV(wigH@Wtz{|T!J(b#4{y~FqJ>aN^V~SntzM?vzyB~i zjiY?%*;@C}($dn~lND6~BB!HU$(P2X;zS?ON8Ql`lpC#%Qt^|ka!3FPqoREDshyps zz^!xDH4FAi3*|Xq8q$xn3h=ubj|$g#=>hE>12SS*QZDeiMJRx|AWG&&Z@bcztjAy= z|3|UdG!W0+D3jhF-Ft6V@>d;-fgCATcdUsdm>yc}^_l5rQ>-Zw&O(%lJ=I~?`m_SS zlo<6Le6cx6-|y-w#-;8M5^ayv5ZGa)pR%W}H`$sJVJmnVM>%1FM;dt=ZbR%TUIXxP z1ew#(-_1z7HLIxN_RJUZ@qxSXxt~8)oyUtf?Fh1Z>m~NiO&PCrEn8L{DQU!flKM^u zFlW2<;CD09F3mFLlz>jySk4-)=rn>1j}YbpD483rn!noN^S~K?a^5mb&1%|wSDaG5v#rV)GQQsY7O^cc=av-BKugP)K911AOhiC&# z+Ays9P6xLaxz)%tj^6qehFUX+0Wyf+?f)F@NQ+Pa{%WeBIoh4NCjg+DbE?}*EVRTF zKnV6cO^85r707)?DFJpx&BxajlnXD#)qnA^i#!(H$sbE5zd=v#Ch4v)RFiFD>h0l0FM@x(5i64 zr2Mu5K`LKob%_-#3K~k$8jD{EX`44x?uM9_#8kBSs;UD@Zl-N~}NMqrrK}z2A!(GrMbECH%D)Wl7Q53(AV7$Q~Wdvz-tXQ+;qQS-XAeO z^k}IY&D&%YprExtkeU#X2Lk|*X&n8aeN5K_Y&lT_z=A*p0GnPl9a${2FxBjnFMp9G zssKW8;BCC`vy%~)pd=SG$=s;ljO7fsqa)S^Y7ZHz+gcw|$lxCgY_<^1+^7g&3^84~ zA3M@6h2{8Wx%kCU1}52=y+DpE*=^@~GUy$5q-5zd@;JEdjeu*{I2{V*0)5{2I#%tc z|7xnC5#S3~6p>V3%c1Q<9koaUna0t!-`64$E;**kF-p{2AcBC|!oBwuir1YeI4DR{ zT#5H>W zC{|o_Q?5hp8Bv2xZ@nXlrvj55nB=Y*UO2Cp?r^VWmC(nNWVXu1!iv4@Za1hYi4fL@Za1h z7iVtN@E^l}?9#*#(T71SA#1bOmwq|1Rd;;EZ(EpL&BBZ=-8dDqnX)`hOr5vLS>gEB z?vSM^H|6Yj#_o19G|d%Ga_ML39w(w)WOvb(m3xUUqbHpVOlneL7RDqSw+WbCbk%Qt zja|Rs7$MVPMUC3dD2s>3nwn_$*q=!XrS3@ zVb+wm;;STtrUiJcR=H|(%tpIl`%OG4%BQ;%_=*7{U2rI>q)`2eNk?b_R<)r}W0S)u01WVFiF{C~Hk*xLB_$z?2z zfa2#H!>r%7v4(ml$s{YIiQ;!KcDWUK3@zemSTjEnwGlJ2 z1&5+b3T4XN*<}(;Kolm5dMD{5&!|u@m2755 zLtFarV9XwavM9m>t5vQR>^DLJqu@|PNud}R)rOh@k1hn%J4q+m?^gS%kQ&NmUbY5O z67%vX>BGN(xif3a_v&j{t#Vajw4iK&VWj{-l@yA`s5aCvTuVT`lLAQ^85EnD4I`70 zA~`35`p@!Rf_=)+E7oAN%2jZ5;pqTPGy>y!2>xwsiL2)?GmnoWA}U(Ls5VsBLh~>L z)H^AVB!DL$TQ2i^sZ>rmJ8nutLcgXHF&sLkKo9y^91FSZ^v)+qN1u zYV0<)jrZj9{XNh7*Lm(edv<4LcV}h?JD8Mmr2Iuuouncx&IJrK!+}F1y-(i;VhfxK zCp|q3>4l6OlfNsKks|HFndlcO!wU#n3kuUoH9mkXNp&;f!cfzoKx&XN`?SzgxRLk> zW=urG!`+ZFM?tNprymQl0bE*#Q_|OJdaz2K`KoZW`k3Yk`7%$597BAqGyIC`Mdbjy zN!=>rQB8W*>ecf`hetFEgN-d7s1Sl=zj30@uDvK*o@7LsZHmN8w``rCuM3T!KRHn*YEeIRcvDu~ zm-&=e(*>pPxWegK$K3P@^34o$RPWn~$xz&>KgjDqbJu@GzsTbrXM8&KPb8N2?znROdUlmF1T1EgM;n;(JJ|%uR-wr*~P8Ax?cXX*Lj8{NV zkDpmuYYB{#i{-VK+ohc+IjLucmupU`1qL!M+!%s-^A3w=dnh=>^?ow4_wiKTV#ADL zZrZ-es2kfH4!CTa@`q4uOKF7Ik+heu1V!#C5$QgvYVQO@kr3BIM-9ijE!rN6P5CVQ z3WR-y=U75_E(nK`p35R2jA^@$HSY^zj)Nm#3tK|85&+u zm_Heh)K78|-U_h8`Lu(d(^l3idbj}25HHZNf z9HkcDp2wMc40bk5i7r^pTGS9uU;2E^y1vUD#@28+{#8-UAw0}mb0up;(TC)J z=VQ|(8QIf0)-q+T+H19|b{2@*SR2Xg<8%k|GBchh3xZ7c#PnOT-3l}d-lzFhD#G3T zEnm}(0tYBVg%-3FRqn*od^Mtwcr_2n$8EH{)@{0mpsrTn#VSR#4*!IWU37AcsHlDx z?WYtJ7L931axrG(6K9yEV=;WYfang#_0~oo!DUFNK+G_*W6_~~F7bH(_P*VHs8Z}= z>wlU@B)pjl0I=Bxk4r63sziV$nDaC$nP8p z%`?_?Sn9ztdxSCOllawuz=-SC-CUFv^zacC7jxnJ^c){Rqr;-bQWjMH`oj?cI|&vT z8XW}bKB9In3V522{7^NmMT;CLW;K{-6zRw<4WYq_Ic}L%qmhjgdA(at?@zzuQtxPo5+02NUK4r0qN>q@}G#j^emHulQs(O^$Y(766SR+ShebLoP764 zBY>jycMDvPCP1_}OHfKxYU&%uh zV5*_G(xDZ1LOsTm)HSLkxR`@Ubfpjab|7iKUN#brkfL17zvf_v63VT^cTz_nqR$$F zjINsERaI(?W7i7tdl=uYbynNR>G4SA50_D!_%n8Uco{@K;wu-Hzps{Cg;a40Yl{Fx zq`MV+b`eE}oHn=pALwyNnngJsECYxA#!sb*0vbLmVq)eUWWT7SO2NlzY@vTrrRgoKf%93NN|)KDhJX%E3M(-s++b1ga{Gtr zi*#@DKU3TkHYEGOj{EqPC-*jXZ=;YlcHuFPfu`HB=^}bPDlRsYB}K|jJT1<#b*HMi=)a~@U}VV}DGE`dW2SoZvrhFdG^4kqGh$6yn9 zX)`EOT!m;To+LwWt>>Sf!Vcbi)0=3O{s_NPMC#05^*r=n8=$HL3_zfGDudBVR)QqYY3z=El?2dq3^{FKa6r89U*3`lHLps3$}}dz)G8>(b~(PSuK8cM$(GSk(QJ z#+IBMpM)1hx$y^r6DDn&@FKYG)xsKEYUB2z?{=}aP22=%JTv59834LJJ2*BDVtNda zLC2Avx2hL6;5+m5CH;_&6bg!!(uU_mpJ(W*e1vi?uy@o4xn$p#4W(Gx(w}yPZxujW z^tq8PG8Tt19#$^rM@CJ?qCXDOfFerz@b1Q?tS51`-@2CT=4Ji->{|$tL{$M&*=-kt zc)UOtqH~{m5YGo}2W8h_Va1u$;V4>2vp?`c2z*<%EDp(SHwA8sRX@aLrrRQRp-`U9 z8qFIKC`oDhU-*gf!_>OdrNgfk9>U>$X@dv*|Fl?(qQ52)@6vK5%>UjTmD%Gb*AD2v zS8`dQaLi;meI%F*OTl!(TWAg-zQdrYMp}??K1yD=%2VE!pfex zHe8(>tmg)5cXu}K{OmKH^-XR$)O8PQ|JHv6D8{D2(!{jQC}wX=wENQRQ9*%#6E5rJ zvL($XDz;;h?X2!0uM2RX>RU*5f=XWnfr1LP(~yTg`^lX|w#{Iy7l6gy2gAWy{$*l+ zk}%UswYeNGTN%b3kLf!hht95fAJmMaZNY-=vuu2t4`C)ZU?DA#hC4_`!1{dbSeyd= z;jo{xGom$wLe20g=Z+e(8#X+|M2!=h>#!oLjFyu{#a&!#>ES;!ggeH31<_`$hV{3n z;;GUp$?I;0bn%)!?-Fqato@AO-5hO?(3@$2iY{fyGr-jw99@%-X{zIvH&~81!PVdqrG+9W3*1uy!X<8}>nmt|K*m@xNjq^W z+eOJb@dnoveoO2kTUvU&euDZf2a5mozwpt&mwqBr(;A%f+CVKVjI7=|mMR^?PIS$j zHWDM}9}Q(3Lt**sUY9kZ{bJ1ooTE-SZ1ZQz9f~h5VVCi!(wFjzsXf8H%@~|4 z4kNCSgju@tYo+Dd^wzGnyJEpx?YMgspxjTme-cK9&0~tI&LY(sT3(podu{WIoqrjq zdBE)|Bt((^m3*oJ6S^o!**>gU>j?JBpA)939Yn8PCgfMj)gdEqRDteb{)$fI&!nlT zJ)~`f&L9h(#Gy@LC)A>l&%Y)KT81=-Q&UaI`!YogA4?*QZgrtdvIP z94`Bw&vfyttIDuaavV6B=OD1C@*2lPTMAOPrsj2$*X~l=+68AW52JLhsB4Fy{lM1c zRGRj4k-l?joBmc-5B{M@yN_LGCN8?apGJT>|A`<|Ygooarf z-j|)&s`K~R*#ldIZmjHB!gU_`UhPaWqY1EXmMx4w)f22wU~FB9eL^*kM117RRx-6m zIK4mb)FP%kcF9fF6dv=JoTY_K&|1^)hx2-$NK{E^ zDRr{bt>qHIc5^OBx9X~lmZ2_KiimxfJB@afZ4vtD+*5P~UlzlwWgNNiQ@Cw3bn@|o z9X3YNy1}QS`ODgHrra5`1N_Ubp#Yw~b3U75LKiXiq@4nv_d5?MjMW`l+fT_ZJt@QW zU%-BvY0)3sfVOThL%=~UGGBh4EhK}*PT<2P^HmZVK-Nk>vuEPidxIp=)Pzgv%MloJ zo4k~v-?B=G5S3*&^2IhzXEp8$mXy7YO=%4cb8zyYp1Nj-+Hd34=i=8_gtD&I_XVO+;o%0vkRgCV{<_`NB#AZIlgP4l9#3D8-YJ?jm-gFVS6sO& z<+hKb!;;A2hZ9JgO+0RW~n}3>q&=b*40v3I16z_qU6Vdfc3VXuY z)ONoRux9Wrqz)3>W)!A=l!s%M%pI&n#=Dzd+`TVucNLcXX_IV8gTLn!2AaxPc_N+@q!%+|wzKpKtyzREK$(^c*C z@D88XJ#|TbVB5;H1HTd_yMoUw3h4yKE7I`1H;=+APa8{Lr`Af%aGdw&Ho*)?b>~Uj zfYM3?9i9ijsFp7*uwzbk{XNu?y8Qmsvb*eS83FoT=TU@{wXn!K=H%gsyD5X_sJi;2 z223w)P1GS@7dTnPsfs?0ywei;0kUmX>D5ZMc^UdmI87RA`kEdbI|&sesxybxJ-}g9 z!y>omV*}wi=!(uj-07d6TyLi{H0hpQh~Irz@E|U$37>AN1BgkLTEro~qgNh9d_8VH zC@H1e%AvHlE(zF*C$0n1Em_x9$Ky)WSeY6Q2T?@A?$P+MCkW3m2e zjfI~*;C)qh^(6%zuISHHh|8!v*_w)~66vRFUsHNV7N6Myb`VN7v7ov|AF)kdfwI;7 zoUeiw)J_&44*M4kJXxm}SlIoO0p)u>1Afv8VIr{nDhyRU>v+?pQ1n*Mu){%He(DLq z8~m7+p2_I35n;5wbwk8~nMZ`Nw3g9a{XH@9jGmv2Ty{r7pjkkN61M;L`b+0iK^*UWOtBX1^Y~yx|-6pm01C2LTES)SHSFqIG5aTSZ zh?Zz!sa;XpBFfEb@y4e7T8Y)+jIo%$Oa_D*U_R_w0FEEJu79%FW|7K{T(*Xs0� z?%PWKoiF8COnC&ioov#fy2dFuXNU6z$*GqdYMqI_y;d;t58*qv2_Z2ithrrdi0+>nj< z)Yrjj0El-s_M=3UJbtqyp+;~JajO=c#*fX`M2SyzrC4vY`!{Mv9pRlgD#;rGUOf^; zwxw;PE}u-9kwiw^z7Sp<O(;yalnb++$R{A z6^p?F3bdz)b`$f_WF;9`IpJt^UFYN>$M15^1f*4#*N2=7BZS0Dg1{>I{|F(KMZcJ( z1iSGVki`5;5#5X?ZMm1!f8pSJ%+M*W7j}B^)$#eksU)ErdhdCgbgUEoSGhLl)7f-~ zQD5$2ThXFQ^+SQu3Q~#Pytg8n{v}xQ=AF9NGG>V@b3PS;y!y#X6cyOh@5u&ZK4gjOofAkl*Ieu{GdZ= zqx?pI?lyFe&JHl{fYOaW7}+er(Wu@WFS8$o%##U+q{Aop(3VY)j1vh)#Jt}xYAs?h z2}1Zi6Ys7p8%EoD_FqZ;8ZqU4&G>7)U^g}9g8Lj>*e}0-!EbW3s`3!oxII1KCb|t( zrrr}f^<}96Y&@%l@ONrlN6MhY{-UUW5!A+Cl9*kpzucq3a=$}j)?Khvq)46aEUOf1@^V}3sToQPxKQwg4@j6MTr$26fZ_;E1C;!lXu$H)LW3ZeB$gZ3FqtJ&_&d*z5}woW@~4i zFw$-(vnCe_ZJ&EAuX)5XuD(wB-jinhD2@7?E~Q>5-=2h2LvIr3j-=_RoWHIP<7Fn+ zjT_pT7;Nk-77~Pq<+VL*VCyM21Ai%2vwITsprrf15(e1#vyD3p_U-pN_F&0G$PSF5 z=s0xz?7WjYa$LI?b?VZcq}#%G$dUs0!NTR(XCF1SPNt0&_+z|uG!8m%zLb$z4m^e~KuG=i_7f_Fv5wS6` zE&9TQ3Zr)p(|=r*^IZz%@AmJBpP}3xMucadA2~V3afTW8#1Mc>bbejrn3;#X`)&KK zW3hrgfCYg$*tzPn;2JRaA%ZD^SdPJRF+r+*I*V-scq35L6S$UOKR_I8!;ltaQJJ6} z0f;@ZW$P<&qC)U6Fd}Fz2KF(XIT(;o11t#61#t`Bp%xR`3=v|tih?#3&$Jo`6V!(W z8oY$!*pvf_LG&74&vzeWV5OCR*MV4n9bP%QN>hEQ1EqgaxWuK zDmCgZ?5-IlYhJ|TPW|YiR1sDfr=ykhmTR$-2+zyTxP&tNY)|1{^dH5iY7(Bt0>sJE z%?rt9S1Wy%s?&j6<>rgP0HjLHFt+Zwo=c>eVp`_{-=@HB-U+T`x;zjoi^tZUh`GLmG%~X7^)1QzzmVh{%1I z;Xzye3dGh_)`+61QpuyA`6I@feWuxwOP}*M?$c)@{6R=w$s_x;lJXBvwnO!wsg-SN z)epoRp%S-o!f3>oN+c18g!M5GlyX^fl>r}qQc@QecPYEb~ao1Q+9(R*q5gK$9-QKV34nbMnJ(0|{qlXuZiGn@iS+VffQJE;r~B0WW=SjB7bJ z(Yl3eZoW94%pdQWdm&{%T$X?udAk=*Q19MPP+X5LGR`e!FN)%vR=B?&;A5YA0&C5m zsu;AYFoGlw`!NVxQENHAX0iI$A5Avh!(pN|@x?@{CFzvX5C3qCQ3{IcQ5Vq<*r3)7Rah?()_!P zk5`~7YGo!Kgc2lp4drE`Ih1FtUh@OvtTNgUOljfwEqqg%^xpZy9GyA~BUdlFC& z<_6rMzVTF1Uq;4RtpBST60l6h~V_L4#t`;+bX_y2KO;mZ3L`zg<-a zxm^%-F?fhw32HfvQmj3iY&@vqhzlnXIz33lT<88W~?)a)()+FTEqRmO@|gchwL_6PhkHGw!A%|-aSU6DzI z{9O#u7Bl9sWENgN7yCTC$;NMnWw;;2MF-4aw&5LXU9K~-b5(ahwv7^_ZbsYm7nQvw z8PJfA{=F!-c{~ZbrbZVCq@_Z4I<=?gcLf3+Iz6|i#3=r#md`0uVR^BRN#?ya-=A{) z#TmNuyQl5HJ$jsaez$Bgqm2MWfH3*drn`q)&Mpu>HP;o_Z@Q_eK!Ls??Kbs6t_qL- z^hlIrquPWR+(g(#i@iuzSMk&a>X80RkdQ`Q7%t9tagp9ap>e4=&^1`VHS(fldz~oV z#83Io0)@Q+7SsO$rFCE5kC1~ScVu5@dd_>o-W^7W(tad!AFX(riyBsU4=*uh^q6ZR zW;hX2x<|I5aMqHpU5m(Z3vF6go-4@MIsJ*-v6V;%x?GHG+l`a7@8 zu@H=0g}X^yAp02)iF*4#DBg8wtzd06P@aofITbPTMG?i^T%Q)&9#GPYFM)ujt<`hO%7d*jwyI>+z+>vv(GQ3 z^o^!(CU(XDN;tP#^=Ae#Y+Xi{@xA;0h(u)?|KrBVpo)aUfof)A8)`~?jh=D6V$Fsf zGFgc~QAA64ja-=Xlg()NU>JVV$Y>HQLl|PBDmra6o#_m#-3cCw|9J5Ou2B&ECw06K zI+P4eCYD>;veJ@|PL`i4+i-DIbgAtQp=fuQl3){3!U(r1b4S1dSe`0P2Yy$5-_NEu z###I7vSh|tFp*=AN-5L1eB}0tPUZJWm&7rr^n|e1rQ&fKzvfnDs_-8s(uuU;S9s?p ze@&?|Tq~cyl%UC`uqSVbEYEXS7Gcnh=`%V8Aw;pcSdXRW7U{~8s3?k|d@mxDB^HxWVXi=wF^MXnbAI7m|a49KxM0(dQDf`92S>d?0E*1_L|XrPn?=Y=1XJbH{x zMJFf~oXh%gnh+C0g0EPv1&Ke|PwFZI-+q`%tS4jDHP&X=6qbC$b8c4G3LDd2_a>Yo z-qLGSF_*eU7AiG2m*6m1I?(DVYnFZT3WxJl5a}{&bmk`dX~*UoGvNs*DM_!x)u#j6 z6o=EZbrsOK>ebl4Jrc==&m;LOc^b%euR%Nn{=`iqT%o5?Bi+ImZkRhClhLC>Z-|H6;`%gv(l#J%2(@AcS z7I;$I6szjV_AUA&P8Z1wkVuW>=_-q50w(f%-I-oXC4Rf4x-v-w7*aT zmnxA(A_cSj;DtoHdw0}F78JXUA~|C)Tj4l zpun6$WZXbnHKkqVA6bf^&uL%sAT=y6YUmwXZk8-hEfq)$C4j(vAoAT#OCxA(s6h0e zRN?Rx#H=;h#9FBsry80YhdhQ$!uMjRW`t;KubL3|!uH`R%U4m&Nw8m*vB}~(E0xdn z>7Kb#xLNX@{u`-yRYrN8()fTYI>9rpV3JCt*Qyg8;o0_%1T=J2oMqo)rMUJ%LjXc7 zs!v)<+Tp@bgugdEn3sNH|fUD3klY103Ku(gSM`x`}n+k86Loj6A3Uh|fb@~?vzsEe870rASn4&Q60 zw|+*W`Jgr)+P;wsR_>qmqx3LjHNNMbRW=Pz^yc;YT_TFu-tni8Qtr!pcnQuMB~{Cv zf%NqD3v9iFIs+A>%@-(8tdlL%FkOR4vrvk{YWV{MdE=jTC}UgHV)f*xsE0>QbTQbN zm*^JnyE$o9(MX*Df?_`=`4>V89Bd^&GMWoMcf0UU3LTG+TxKL9>oWyk*Wt@8FVmVs z0%{MdP>zbh2#(Z-1WSIeKw{0*(Xy@r`bWl2yi{3!DMHVe;hC?Z8>2ffGWF2PHR z8n=0eCuSJXxjBEk(dg?^HW{D=gmwFN+t%0Z;E%x95P_(FT|>{`Ebz*FkTiFo#X;W1 z>mgk23#iQdySGxITgG#T;Dds(A2gkuWMsvX)nRl@R7_LIR*6b3jrDl&I_{E@wFH<* z?^mN*zE_nr?P6yf*W>CpWOK0~P@Q5!`H6YlI&z8K1zfq;OO*YT0R zq5UC-uHfn8{UW$KGm^injWqaY%a8S>#=#D^>ELYj->kI$$)?W>Z%=u#)`(*7(4l!Q z5`_d^Xa#D-2fP1!P6yWU*Qd9~=F8#wXCJlHP|&v+LTj|L98Ep|A7r~*=8YgOCf~^< z5}6WuagE@S>@Npu_H&a&+II|}zj!v!xHd}X(Gr6BC4J;xRfyan6u4YpQ@(yjXs7&T z7WAdljmTb4-a!}=1SkvMhEZL@eO%3?4ty~&dvFR7sd)47pKOeN#Yk`$tqAx6F;soK zE;tw8n|`fqg9vvgyK!ZFk3a$fxIdPp&&BUqB>%UJLi?jd_XWgK{Xv!Z{A`tlzJia9 zFxo;2!_m94W1sK+fCw$-FPp>KfuImsJes&WZ;emX;ESZTucw?#2t`bGr3QLzsE@A< zUP?e>`H$%e({+R2e?o$A1+^2#Zx)0?*(g(anypw3T=*;X=mcK&teVhv*#0ksRbJ}?}D}{Pl0^|3@kcP&|5&285 z_nJVk61rdFedb#Pp&mkXGGY?HbmmHqtx@Ek=cv=o>`yY|_+UegafX0Da!_-K@5~X} zz=1KOnTG_fp;wR>FmEQ|o1V=uu%5tVyjcn?wNcVy<{$foNA&Q18Ytq^jFsKfFs6RK zerg3uqJJ@bza+QnuVbV9H(x71_`ns-vXPEyxOzA|TQh)^=YUeIG}UnP3Ic&L-wR5< zgD2WJ7r2D3Oh%i%4&;ojJ>=d5kR+_S87((XDCIVzOQ_dwX51k~H#ucVrQxYor`(;o z8HLMdJ%d`gWDv>MM#INI=u}#F8&grH#1`>P>=7r=`_iURRhZ-S@OG~qp{vYZyR!g3 z!LX@N8Fb<+35Ng3`?8}-5eG#eJ4EyuMvFW`Ia*QWIOVkuvZZT<@cC3)7FnS?=JIhV z5-?b_qk-^g1s^PnyDI!~G?06mG8`yD^Xq3vUxqjy2bo-rtCOee@EaC+zjzb7L_)>3 zwwZ|xAMMLCm@eHhcOu&R$x2q^{7YIUx{*SAV$Or!p}Fiw zp$uIDDr({U4$}S`>J--84``Bedt-Y}2Fj>z{M0o4#lW^7>Gpjif9_cyAlAawp7kjc zZ$bBH6tDw!$yP}mN8Gt0<4=!BR?IIi&`$FbdKtCVx8)W)qbj=zY@htgjMZde*sm)U zgPH1Tazz_^iPyYMEzP|oj-;Pskvuf(T`rz6D(oGSSL#aRprDAA&@TVHTWjjiyH{C>n zJb?s2rL9l|xB>26M^AA9P~4_|WgaHk+sOv08FC;`7cW*Wnn|)bC%`Le+xzysRa=me z(k`Q%^V;2%*mnD=eh6wHJPx?2L5+T(qK2Jhg1(^ROojt*y`1CWPkp?Tv6NIkSnw>l z`ePg@E?Lv|1jUql?HRZ+!?Y=+$<;>}yuW42LS0-Ybm;dYz?RjoAt@yH#12thGw^O7 zPS1~*&MO~o|BbWnXySYar;P2@d%x?{#Jj7V45yh&Ktp?TV|wVOfXtegueQxoIN5eGc1`er zF)Q06pqAyPt@g1t+gc1axQ5LgSK>E z&gkidXMMX`x{RfbgQe&#Ok89AMi#m{{u=H2`YKa5$bIq^6c94#U@x;vf4CoE-@n+K zgnw(RGC2vz?HS6Bb_;!>5{HbcJbSOvXFS;Sh6efNFT7+BczD7?dKfcYmiju>HfSX? zm$#+3*XnmOV(Xia;rS}}nHXt%3~>5BZhu>RRUVW~_~PTc&Ru0%UL110^y;`P8&w*mT%cN`?=7tH=JiZ74~ zSF`|Mo=;IhMT<-uEobT(w#fXlTV&U2)eG60D>B055(A!~GV0*!Cs!ve7f|_-!xZBX z6NzU8g;utvF&RJ@rCNzT0%_umVT~4|E2Z$tNDty@#_lapkG1;VC+H}A^XZt$UV&?Vq9c_uvB)ADE3QPV(#7x z%nS8N4%l=$b7*Kl;NOtAz}7kLgk?hmb#AvSk|fkWEJaI?^K!yKW98z$EgS!X)2N<;JU$JtXr5*a4uryRpV4}= zF~$d3cQpM;f)+;DyOY%w`%fJe^lK-2#WNdheiO#fTCS3~qIf}r4e?yI=OFu;EMo-G zAJ^6@(U%EYezf(%h>RJ{Yll+!_QHxWS~BD1p66_H+wKd_tWl@ofptn3j#Mm;IYA+SfiNFliw3# z1m=BoB3j8Ba~G1=Vnl{J%R=&0xSH!msCM7(N4AM%9VM2S@C$+(4Dtt7sU<{8;#DzX zm&>He7$tagmhQU^Z~j3<2w$U$2(fU&kTZW=0ty}aq(3l6+#jo#EYj&~TAQNPWPYZA z_Kib0Nb3sUGf_2Eug!wT-YZ>l51qEWtjh2+^vp_xkw9UL7D05xZoUTRDU@tp(R8&e z?gSb|j8O+Ji0rz2b=s;pSdoYo5JZWDGr)}0)rSEz0s;U()_dY3S10(9NquMW=$@RD zxTvdN{n2zF?HbyvTow5Sp|$*%5Wx==p#G0qiIhOmO(q2o;vMAiWpAvIXo*w86eLz% z*K@aD8z+!GVJqjW*H(@wRlI+}3-{VTWIC6rU1N-fP{V&~F#3qp0&`a+8?JcOty%MD%o`ISCll*yRz@bSG0m%CU$k*6 zMfVd4qg0H1!Pc-N&GqNs9K$7yQ{OT5_;p=Qp{{8f4fB`MBjIgRGtFn3_OUeGfAj3) zWI86M0A|#8@M40XnXw-2std!5(eHJCuBHOR&1nzpxW5xJpa3reX2!dq>RX%CtAgf$!3MsSu*?C{fy;m%h&Yvj3SQ}Z!OJG zTc2837Z&Gy{<2xMk#1vjr1swNGx>8OPN8-4M9;#WGiGvN3%3%^PwLcfxUSY$iyjGZ z%4y91>ly>-+7w-^>Ot%f%9o<^?c}H0kM^4Ye) z{f+PEQ?LTpI0BZXjHeDDfj|AvMQRL^HwY6s-K>uVsOhi^mX3 z-)d|_s_8w|5yquctbfY>*|55ip}pkp_o|eCxLOY-PdVT~n=FP$>935z4j_OLQOWIo zBHE)>PXPu=hdEA)0y4X(QimwKtz<{sg@zznT8xSYXsli@s3@>Q_Lm zlPghi1g27sc;uc~gtNI>=yR)IxYmm=ji)R*d26JPVvu?5F}qChqc50&#T{8bl?268 z9^+toWTV7WT2kE195OaLgYVPA&Sp-L_MG%8gf8r4ofaO-ND#W`{}CaopBAk5z;qK0 zDuVcRlSF@ibKP7(W61=LbLxC!%kne9rW<8?Q%8wrdW*U30Rfw2HMi_pmOz`3rvn74it?G&=+B*S9kvA zhI&p|tXinWi5L*t)s@Tb(l)}aeWNFEw=p)S0MR`pv?(?s<&tZyV->aX`RRp62I^t9 z#9-GP{b5B>bTvcJoqVgc)&-JiFqj6+wd5*+B%qJ>89=NiFb+ls$3ZYCj%Y$9M0-(p z+Moi}Mh*(3J$kb3DX~jdi#w0`Z(Z);>s(uP)BfCT!ZxFAMO(NSf$n$4pAmPG~2)iMa9WIfaS=Db2LkTa< ze^=P#mJX^@S3(;2iIMGL#AR!X@B4@|%oR2I#YC6Z-2V#E13I$>#)1Lq`Eq*;e}5V# zF=+WMB0tHHMKR8jGh8)D(QI&yV)+T=Ik-e&dk1#&6$^&9@)2FMS{M+I*OL#Yg+1~+ zeX%z`#qG!p`J=?FvqgvC@PhYOr8%b*7{*FG`0#-aji?4nS*6uc%U}!KD){`~et7JO z!2y%?DLPuo{EGm+ljHP2x~&ud{CoRtqeCBAfgc(GZy&ocJ1N^#{so6JbS#|7yLiwC z71~NlF@8ocj4|AR-9%*Ik?H^)u&_yG{g2f2U-yhgswl|+yUR+C9=N0D)V$q=Z=zps z1!kEiQmWSTBvl{?n=UWtPW{GuW1j>vOeILMIS(mUePNAa8^AQLPVwjj;y{!R(G!Ia zOW017^Hq-CJdT>A{J)^5fOm? ziBg%CoFE~JZHflD*FNdR0o$wKN8XQt+oVT0`a_4OAt=o9&mBb#$L zCgd^md*-UFND9g;x!Tij4L4WtYO_!lnhz!$C~mHW3aIDeOY2+PB9u1Jmh!Q+75qO4 z0?R~8jz()l-4E2#ftjY(z84J!md5r`H-+if56XV23s{SA@@x#t)?(ii>mWnqsiQ~M zSDs?xC#GQovt-d%C3nP3=P*=?i{`GYXa1J|9aD7q__P5r(fzip^s&jxaGI`C*zbQU zP$kup(-0V{Wgcc)n7uI6-RNWQ5l%aS#WjU)AdV?tS)JywyL5XVEbnYdZnHLXca3u6 zA$s|od9`4_yjtehbU9~?t*yNaK3a#4g%reQt94?Af_lH5mMZGP^mh$XYQO zd}5G3sWIZV2CBoC*^^DEY?5MYHp|DCTc{JQma_q&F#?vJ^$VLDE?mf{pkB!}K1nNu zmpEGrP|{+%ZTUqAKNgc0|hjE;$QTP|Q5=~$@KzNdSTlLf zU(8YSM#0OGJm&2hHUnp+e;mfQ$j8%w4t|)?M*G!qq=`67KUH<7a{gUGG&ja84<&%< zSgH4I=%M;?Sp8nWRNpyxG+N;wRWm5Y_VM+LSYLnThLs&u)X?ZRhj7-Pv1y7? zS>?W&hxo0qZin1n8(tnekTb>Dy2@E)utFxuCY(5#77^G-b8+{}c~Z^U@16I=-ITHkl6 z!)J7iN=Fqg0c4}?@ru%4v60-N7Shr8nu|;rr3-4|(3thz+~^UW=Wh*HPZv)un(*LX zc*Jb;e8=n=oF+FH&dKsssa(wKUvZ21_9%U5FLA-{Z#R&wCFO?$50k&Ae-q}f# zezNCQw=mzeJB;eWZg6kn4a6s+QLB-1u@=570z6m#5E$O6gP;-nM+-K7v}>UV1xSKt ztn6$_tz+za*P>UK8sw&zmw6?EM2#RloEsoVKDeu47S_-$*iB>h=qd?xqO=%%yDYn{ zw10p&=M2t(G5bHiQ`Uo`zL?bi@%75TY&JAIQ%NpL6whkS=ctg1@b3!>r0!vp8SFH z4)%LlhDbdnFoFPNmn0#BYo*_H&;aQMWY9(ck3S#4kq?F*xjl((u1D2^s=e#UF=`xc zylV93?lR59ibc0pXRs2o zw4rL^k6?O$S*d?L_EvZ?&zkjd4}9aKE_%E|xVIm(i5F-rK}b?KF|K+CF6Vut6N?(! zqNl#@mo2$?-Nw-nd!WD*E!M&R}TBRB0vbJuCFCndr!oyi5k|tJK~D4~imW z_#^gpcB@RbrvZ0W8*=(6zO_J?IxrT|h2up;m)pm5PPz~m1|9`@=*w~l?(_beZ!+@h z`;U?|F@sw?>dXG8GXAd+y$4{zw%@!RPL@0C%)E5ri12UY1x*fa_DG~Jdy!@nVyy5f zM4?0!Sy`bmoYdc^;*E0kTkL$;&$8p4RZ6$dVkiIWp^)JdQSomZl`WhKOE~hKC3=ir zEBw;eV<9J-%@-zgN&m*j6NH5CWF1C?Z&+B{EBTe&`0Qh=~dU z=)NX+W6!k|KbJqd&sWAV5k0|t79BM_)tjQGUI=jbi}_6+?-D$}m1I@ntqU_eYJfS! z5hv<5sP~R;L0jPBCAt>pmU(!iCmtPDpAKVW*uNh>>~D;XaM#4J#Mj$U`d2msi-nS3 z*0Hl4Na%64gnM2$??UZ|q=rM#Z%Wr15(J;T*uN~Fx2Oad_Ne?5AO_EW0EY5k4DPQP zSGwRL`YMl$?dZ1eU}de61WWemu=tfvpFv`p>(cO^;SCb_0uD;#Fw3^o0p!Mm?p^eV z6RoW3++dXW@rFv5n^E~GKk!Fo&VL67Ehl)dUknsSQL&-` zc<^zKmQ!BwN07Y&$u^?xQLK?;s5kIm4Rl++;lc_&w9sm*!;9?6$IuH4sVEhTR2mKp z*QWUMJR^7_o>dE?O(C(UEOWmaY=Xgp_jcpG8EZhmq}qr4nqZ>BqpQ;)*HGPisQ=y` zO6?@HJRc7#@juxKl$KeDd(-W4_dQ=cf9-iYec{KglVikj2!Gt!j;Dfg8TXLxS4vBS z_03xEL3A>sPeg#xV1$hqEl*o7b+vJz;50oc^H&x>62$P1m&l<9uMg&~+dm-E1f@z7$qgM0gwT;H(tAgGNCJdVQ>b!jf*?qj zCLkb4FN$;lk)nWrNRuugO^SjP6@=fxa=-8W)?4fS0q-Vj*6f_K+k9sB@STl z)537PQL*-!la-ZmI8r9#)-_G)nO2!jER1J8L3E5ohX&}4mw4gyjxzT1u;Zbp>Zm z5<(75JvST6REF?~yc?#@dM>M+F8-*?oz$flhe_lIOOjVyebzE_Z@_i*+m;}{{c%C< zJ=*HECluBb*K4$<>@#a1)LNGB{dDJIM3{$!*QMOptgR=W^Jy93ne-&7^08WqB3s3M zd9N5 zOc{pl@bZ7O1$M`$-}iO1#M@eB9I?(aI+udzSt&=+R5Tr~g6>xrH)nqsGt5buFz!zy zClZ(aGHvt8nwtSP-T2pfQ+rS|Vv}G?unYLwXJi~snVEK@gRT86>GO)=fCsTI&x;`s zi0?0sIfR#nZ^=s}P(vlW@Tod6G9+Xd-#s3$cPyvZlFkX*J7{s-ij@#eo5X*rG>J1I zQa!yl@JxJjE_U`H<@pyx(1F4eG4+%ru!SAptHLk7{8&)krD@S|yPl+mk{* z*R_R{xXt(ax+NlxFnRH*h+EnLo6d_bEDfFDXWv*9{@#x7Bt7}U*>^{4?S1S}zO3Ub z+R~jurMdfDal@>4FE!Q`AF};bnbOdi8jXaF-yAny0G+AlSP2{=fU2qXC0N3rymC48 zf8?rjr_fSR_oh_Z?xhD%+fQlj$3HkZ^6AAi^io|bSsq<|tmynve`rj8{(k(;T-6s% z%xK`teRRBYI6Yt3nm37yuA`vC6g1u(n1B!>=WD1|99(zjc0rtQCa9`qL zmUgF9>7DOaPL9?uX4Jp!@G8S@_U3NeRY>y-JP>@b7LUv}gI>to`n!k5cEVYj9U3gL zTsadYXiimE_awA2e%q(mKuLL0JTyc^h+5GHE>bea-U~CH;KQ+yg-M7AtZ+>}$lXgK z-r)}%N>O%jr5t+8md7v0;70S|+}tzfGwz_n^^SafC;G%lx{dCri8o^`QMf(j_9qO* z@(gdu>X+H!UCVCoL$9E3n7F;hVR*BYv7Eb(C7e2MtvYSZR-(toV#l65dX=?kZV$Jx z{+NhxMOtDd_XY@ljK~X{*Xs36-l7^~W*D|pMDmi~w^&U)7qSeV?R((3^w$pA$C$Qe z!_81(k{d~6JXHo$uE-S=lCF7TP_|%@C{3H}(yHJAm**3ZT zDmf5Hj{+1Bh_hksbxb~bq26n|Ui+ezOkdgPYC+Gg7%QK*ibx|rN_}Q;@))57oEoA zla-mU_n6-7Y}4K388%7@HtQxGyC*8q`?~%*qO0trn24{eRm5{m5h~(k+6WPTtx=yWSr4RFf6nb$;b6~7U^Ll(R%@2d*COdU-+!>CEo{SnP}dwu zc_F=5+fweJ#rdUMo%mCo(oh-IS;fo=b+Xq-{2uw`S`n1*BJcP9RT)cp))RUL1%0MQvHQNE#>Xwk zsOqGEUb2gmY`oSsHw8O41vt{bvwPn3G5$mk43miHvWNK0AJOTBidIcy55P7_OsMh; z;fEfzwW+#8P8tIOMwHQs^Kl?rw6`h>IlSwv6zIvI{R8u6@&2u4X38OXDfYssE{ zcwsARtblJfvTto)=G>~xUFrNw+qM;M4nu>Mv^D(iWDb*v!m~-X-q^DA_{Z!YG#_&S zvw?tZBQ~@|_Ia1eh@r@?`Wv-6&Gi7HQOr`6*B7ffeXbvyWE36UQb=0oAYYSDM(ezI z;*wn`QyHkR`}XXsCQK49NcoxKC)WO>Fk`lf&Jj8sG!FEcZFAlIT}Y9UTFVIMwTm(k zPfYnu71)(k)}yYjh)f@S@{ve?Mb~FEGUeo?7UT#=>z)ofmlv0 z=EzTBCE-rz%zT?JpyLaa5 z_kJg99wALtoN^D|kCIonsGR`6N*d9SY=i@MyWFR9qbxF|={7QX6(Yt7eCN%y-d~|9 z4hz9CptFY42^ZOq--J?kzG|mgp+>xMz5#v>0h>OdEN@cp2|1&?$TQpsI(ofAYU!jt z(3NLNORP>3ak%K6QOpp91^##s?*H`g%5>cleOasO!H8w)7O6Wr6zTgTC|HA9uGiv` zH0jEuBk-icx%fPe??!)RjZe}>%E4R7)Ej5aV(~4C-^iOE*Bb6#-(byH9!XBh+_}O+ zd+x}Ky^6MuANyQz~1GHnwec^ zl^0gUzQMU=R10<_ze#yPZ{745+?;A{!`F0Wv-dV`Q8u}QmPANN!|m2(C0N&-azf75 zZ4&Ro0vCWUw0O9w%@09y`nvqcT78pS7oOU|vAeOL{Ex(M#u@*4c9`LKBn6~2y62)ueo<5 z#2Z3q@weAm+d&`yZ$U|8{EzFdKInUjqKv&SM|UGB^K(~!@BTC1M;QUohdwuK_%?T5 zEZeP9k92Y7o2WqtP}_^p03JmBNx-VA zHr1J6L*{BnXS)0~>sHtN`P@LmvlBlK56T$)K9;ne4{-x&SA^kj?ytI@9Ipq}i!V_4 zE;X)kk#cJJoKfCYpTA_C zrB{uA*(Vi^`nK0t@^CC4=X(MUx`gD-YnSixX&JK^T)C~Z$*x2>kGad<+;1| zlL;}7vh!76$I0c4MM-=lN~koem}X>#7|6hOz8kFlS{W=~&+OAqv+^p&ID7XwaKG7t zY=j{~hx3r5m(vnUDU0r%Js+@U*FDMR;#u6f(30$Ap(5;RsaZkuF@O=>m@p1c4ykrO zS%etmUf%bZnzDU;6|?7dkKBbOz?Rr$6>>%E#USd{cY!-oWd_U_U1LKanP=W|>hZ>8d)`)C|P-FiQ;)#Kqj z!=_{+w|o;1^LBE^)4qkz^Ch-yDnjjojwfk~L0~KXE*7$-xWus+S+6)hAc;_AK}`coLY;{`F4+D&@ag>4BM-O)hcC8NL@?otgm!WsWRr~jOs2+>WZ#y7VX%BZyrVVE?7(x72%nSztRU=aL(FuPqs? zRCUfw@FN}8G0$}?>);9S5C32bYPp8`d7mim9*;2dr_~M#=x+{M92ZR8wiEabl^$M~ z8)10f-14+J zw?C)3LcvmQhoegez6dqkGf&*5_kjA&e$fXpyyF@4#=P(D&K%#kE2d-2_*eR-l#lhx zNi*^L8AU#YAcG%5ee55iW{_dbr9+PUm{=J%+N6f$Dyd2SVIe~#q(e#arbH%Mv&;|n6Waz)T9 z8vUyOnNYOa2CGAMY2fq}NeGZ(5I)xSspa@&O}s$2DP^=K|9d7w^r#_U&E(~#R~pU> zZwt>K&|^v%p7UV!V^z`2q-0QrO+}z zUpJ;AxjrPzhTy)m9r&Z(_K+F%j0+wA$uV?>MB&RfZ(B2FVN~1R2Ai%Ik6lZ8Q`D5S z>s)%F@fv68^1~J2&YA9GlKp3uCZyK#^KXoeUwl~&hqXp|Uu$nyU(1vfi50}%UthaJ zL8>D&x8}@v|K#=e*J;`BonYi7o3zA`FEqYpVuO3%J7aue(R!L^68iPrEU=HOC(UZs zIJcMWymj(0DTGw|VQmAl>gb?|%S5hCO&iEFNt5CA&Hc?y7s(Wz7O{pm7pEd{EF?Y@ z;L0z$G2C~(8@JBtVcIQw%1&2w?| zYXfP7!04eUV-}PXI{7+E>!ZyZ3g^+P$8WN|@3TpOKr^+pg?znB$J}3*?ay6aLl5@b zA$uHzD3BfwOB|{+-$jB*WAO4e0>Pii&%sGryIm?dq}wkE`T z78+dZ6&&#KlY(sHovv)PBGMZrpf_QUZDs;BQoGZFer&XcMc<;={IHQI`HhFJr#MGA z!#4P$y34}G#K_((etqYx-OAl`iEe|VRb}$S!3v!Yh?LXim(@;z_6J@+8ZmO_%#W<` zYE^bm@}#KNty1IVAG!;>h ztWN9@{g4dxy1A8kGs^pM-t{wg(op9oq2F%WbAApgMsZ$$$n8!$V@-y0;-RakM5RbF zc(_cjea2>V3|u<x0!#?a_QBSEjwhdJ z@uMa6sFH6H@7rK~qB$krojkPXVKxv5D;vA;vQ(sw(yQ1A`ddj30jss8tJipz3>c() zD&4IvwhTw+i*L`s>@F~>CwmU!g$pSuWxafNWkjOag-xm!B(e}dg}PRw?)AsWlf28YoAGwOBFB|abL_dKdPA@GV9Tw`xGS;69^R(KNXePbiMOD!klXxB=pqj2s{ zOqtu@8ReYLWbclGIkFJkf~k#7`>w}!V(q2N(eW_-Oc(7AziYL5BLtJK1H(4G`h%d) z`dFron|*1brkCuBWxO6e82a?#@Hn7L;~X>acWjDAN(kh-@nf%^j4QL(_{iC*#4lzG^aVXX-toao83Z6QmV~Evs!X! z9Gzxhp|kM$E3qXr3A~>z*M4AG%$Bqic}QsUXNN(5SJS+s1-DDsHafqs@PbV5_3`!P z#4>-t-Nuf8n;!2d51+dH{oVx9w;5}(%i1hVERk~#$2>Ot|`xrKtZMNLFBOq)Bd#* zWD7OLU24)bOSzxV+-1Bw5ox@>{`rL_v%K1Zib)4K%X5Q=Z!w-^iB&kW@@pkd@j(Q+|_%i-$PblLwWH! zvMz5#n>8hJ``Gc8y>*AX;nnj>g>=HA@(#u{1kor!Xf$fiLDRLdp~LuNANs~`7-p1F@XK+1m65=pbPsaA{TfD z{8u!~hwOKH8W6^wl&xn#g521~?mjb2r5}Wj%P5PI)#ChYh_Hhxgj)KI%zUC7koW1) z)$ywM4vqT9Q~7zFdD$5cxjY)N7EuXmZG1`8m)N~wyhbi--+M|x6Mu9yk(A^nb=UP|ob9nF3 zg?vTZX_nH_LSEb&UR^$U-?yyHe+%3_u2QbG8u3(q;awDxE>2%2W+?H=v{=lI>36ly zHo6BLsJ8DGlWb#>v5+7Y&jOCYfR|V7J`<#Fz=lZ|hA*Xl&eyw1f8&$OPQFfhIPnpA zXHnZx-&d-4pQ29s+Md4N4f#q)b)JYid!cXe@|PkYV?FHGHd-_%2+C-(a;j^x%dGbs zdtuJZPPC*s_7B;`4=SEEY#&RFW=M^&sp#I|T#tOI10QVk#?X|I>3gm}o*xK&5xO|! zqLDorkSNgmOrG6Zv^%O-q@|WtO+&MvqU)U~S_8}<;J|Sw&M=uO`?LNPlNIiW6ju;0 zaJcF8@EhT@AI}YAs5*p>r?p+MatqFd<`gr2ZOxOzobj{;5{khxi_~Is#jk1W*g~_i z?mM}w4l%3^>y+&ul)jphEM2Gs?SFi2nsMVnTZ6G=2*Y${PYGk{ZQgig{RDX*Ms6D2|-s;_Go_{n^>(KKsbhGgv99h;zxwK0$DIhcpE1^Vo1E*R1L$E&?4)Pi) z?Y)y%JpzItvb-TK?zvBaHl`Xz-#8J9f19PRQ07jwdL{8y^Mbq_HU2hfAX9=osjSM* zJH6PO#a^UWzIu04)zyZ+4RaUJez8VupStZVIs2M{c7%oI&?;5dXF0bclZBgiX+hv)?|;g zI~uv8?uzRt0LU-`$WV4MRlVBnv3_3IB5Dg;ylr%3yHmI5X_8$BmnAwv56!GZ?jWxQ zkTWKL-i(qz{;XpGn&UT}0?-1#c}M|TjD!?K3)ERa zfde!XP?rJ)bNiRAR)9WzQT}{u0@SJIKedLIo*@`6A_fx?2iC5@VQ@(~n1mc$1}r8e z2Zzativipux&QI#RFfqj@|gw%l2`KcLLjkd0@xAljPX!_d}?lkfH5cqh=rscOwUUd z?Sjz^z@be7^i7cgSfnfpqNE6x_mlH;_i{%Q5MV!dHxIm=p8^Dd@^nPY0rcr%Q3&`a z3jwPDIW?u~i9>@WL?lFDP&Ge{4;%vMz@ePvjIXQz)&P7`fVdC{UUH(MzP`R9zTzUD zIA>8YSy@?87+e$%hXNc>yuSwl;Rp4=bN|tB9gRogFkS?Vrw8~{Bf`;>NKk+P_J29% z?xm;qk75tJ$WJ##ke=?Meh4p7F%g)kyZfoPKe_P)H6K9uw;TT>H{R6W3oUAl#(NTR zz>0JqvN>VgcKAZE(-@J8KjIj+|f}MF8N2^0EYoa9K!9t`g5uWb*e`S26!PZ z29-fd0@4Ve`(?$@GEfOe1Pq22M~KUy06i$AoVq8@9RYM1#vS2|7WG9tdO^Ua(8{S8 zYAHbAB7nC)KN`9r2u=X60z?<%LG=55)D+{6HX$HRkrR`akd%>x!NkR3(qghw@ZTKf zXdE6GTBoXh#uo&93cMWPJAfeKbkqT&KU*ZHibEp^o;XuaPd5d~KQa01oE{JpC$TenBgz=ZV5N`TuXMr&0K`KQ%FUz^wo8h%!NY|EAn9;Gg3e z=#*c6;t@V*6y*0oqzl5s84biaFxGytVg85y6q9k3Ldn2npl~z_4V93U5raBPqGX|P zgqSo6E+H)?B?0uqFL}JD6TugOL#sFg&;SSkL+j_P1Qz%Sx!@l@Ul;T#o&W|=m;@9q z^9KX*-x!Dj{)?W5@~@_d{{OA~dG5c2{U3H Date: Wed, 30 Apr 2025 06:46:50 +0200 Subject: [PATCH 036/183] Configure objType & sync rules; other adjustments --- midpoint/methodology/first-steps/connect.adoc | 137 +++++++++++++----- 1 file changed, 102 insertions(+), 35 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 577e680e6..7651faa7e 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -79,7 +79,7 @@ To get users from CSV to midPoint, use the CSV connector and configure it accord . Set the lifecycle state to _Proposed_ until you finish the whole configuration of the resource. . Get back here when you're done. -=== Configure the Resource Object Type +=== Configure the HR Resource Object Type The next step after connecting the CSV resource is to configure the resource object type. In your case, each resource object represents a user account in the HR system. @@ -92,7 +92,7 @@ In your case, each resource object represents a user account in the HR system. . Keep the rest of the settings to defaults. . Get back here when you're done. -After you save your object type, you can preview the resource data to see what you're getting from there. +After you save your object type, you can preview the resource data to see what you're getting from the resource. === Filter Out Irrelevant HR Entries @@ -123,7 +123,7 @@ The next steps are: * Mapping rules * Synchronization rules -=== Define Mappings and Synchronization Policies to Prepare for Import +=== Define Mappings and Synchronization Policies Before you can import any user accounts, you need to define user data handling, as well as specify synchronization rules on how to behave when users are discovered, updated, deleted, and so on. This is what mappings and synchronization policies are for. @@ -134,7 +134,7 @@ Firstly, let's tell midPoint what to do in what situation. * Refer to this guide on creating synchronization rules: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/synchronization/[] -These are the rules you want to define at this stage of your project: +These are the rules to define at this stage of your project: [cols="2,1,1,4"] |==== @@ -271,12 +271,6 @@ Before you proceed with the real import, it's best to _simulate_ the action firs ==== Simulate First -[TIP] -==== -We strongly suggest you *don't skip the simulation steps*. -It's the best way to make sure your resource configuration behaves as expected and fix it if needed. -==== - . You first simulate importing one account. Refer to the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#simulate-import-of-a-single-object[guide on import preview] for details. . Then, try it with all accounts. @@ -288,6 +282,12 @@ It's the best way to make sure your resource configuration behaves as expected a Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. +[TIP] +==== +We strongly suggest you *don't skip the simulation steps*. +It's the best way to make sure your resource configuration behaves as expected and fix it if needed. +==== + ==== Import for Real Once you confirm you get the expected results during the simulations, you can *import the users for real*: @@ -306,51 +306,115 @@ image::../hris-people-imported.webp[title="List of focus objects with the Person If you see a list similar to the one above―congratulations, you've imported your users to midPoint and you're ready to connect a target system to midPoint. +You may ask if it's OK to have employee numbers as names of users instead of their real names. +Good and timely question. +It's up to you, but generally, it's better to use usernames as use object identifiers (names). +In this guide, we're going to use the LDAP resource covered in the next sections as a source for usernames because, unlike the HR system, the LDAP resource contains the usernames. + == Connect Your LDAP Target System -The next thing to do is to connect your target system. +The next thing to do is to connect your target system to midPoint. A target system is a resource that acts as a recipient of data _from_ midPoint. It's not authoritative, yet it has data on the same accounts that you've imported _to_ midPoint from the HR system. When a system isn't authoritative, it means that it can't overwrite data in midPoint. Moreover, midPoint is supposed to overwrite (read: rectify) the data on the resource if they happen to mismatch the data in midPoint. -This is useful in cases when, for example, someone creates an unauthorized ("illegal") account on the target system. +This is useful in cases when someone creates an unauthorized ("illegal") account on the target system, for example. Such an account needs to be deleted and midPoint does so as soon as it finds it, if instructed so. As mentioned in the previous chapter, the target system in this guide is an LDAP server. -[NOTE] +.No coin has only one side +[TIP] ==== -The steps you'll take to connect the target system are going to be very similar to what you did with the HR source system. - -We point out the differences at the right places to ensure you don't get lost. +Target systems may not be authoritative in general, yet they sometimes contain data we don't have in other systems and need to pull them _into_ midPoint rather than delete them as superfluous. +In the case of this guide, it will be the situation with usernames. +We'll read the usernames from the otherwise write-only non-authoritative LDAP system. ==== -=== Summary of Steps to Connect a Target System +=== Create a Resource for the LDAP System + +The steps you're to take to connect the target system are very similar to what you did with the HR source system. -To connect the LDAP or any other system that contains accounts, follow the xref:#connect-the-hr-system[same steps you took to connect the HR system above]: +*Use the xref:/midpoint/reference/admin-gui/resource-wizard/create-resource-using-wizard/[guide on connecting a resource to midPoint] to help you with the configuration.* -. Create a resource for the LDAP system. - ** Select the LDAP connector and name the resource appropriately. - ** Create the resource in the _Proposed_ lifecycle state. +. Create a resource from scratch. +. Use the xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.LdapConnector/[LDAP connector]. +. Name the resource descriptively, such as _LDAP with users_. +. Configure connection to the LDAP server. ** The connector configuration is more complex. - If you're unsure, your LDAP server admins can help you fill in the right values. -. Configure the resource object type. - ** First, configure an object type with the account kind with default intent. - You'll likely add more object types later, but start simple now. -. Define mappings and synchronization policies. - ** Refer to the sections below for details. + If you're unsure, your LDAP server admins can help you fill in the right values. + The xref:/connectors/connectors/com.evolveum.polygon.connector.ldap.LdapConnector/#resource-examples[LDAP resource examples] may also help. +. Create the resource in the _Proposed_ lifecycle state. + +[TIP] +==== +If you want to follow this guide for learning purposes but don't have an LDAP system you could use, you can imitate it using a CSV resource instead. + +To imitate the LDAP resource used in this guide and achieve similar situations, use the this link:../ldap-users-sample.csv[CSV file exported from our training LDAP server]. +In such a case, you'd use a CSV connector and an object type of the _AccountObjectClass_ class instead, but the rest of the configuration would stay largely the same. +==== + +=== Configure the LDAP Resource Object Type + +Similarly to the HR system, the LDAP needs a resource object type for the accounts stored on it as well. + +*Use this guide for xref:/midpoint/reference/admin-gui/resource-wizard/object-type/[instructions on object type configuration].* + +. Name the object type _Normal Account_, for example. +. The type will be of the _Account_ kind, _default_ (or empty) intent, and with the _Default_ attribute set to _True_. +. Set *object class* to _inetOrgPerson_. +. On the data specification screen, set *Type* to _User_ and leave the *Archetype* empty. +. Keep the rest of the settings to defaults. + +After you save your object type, you can preview the resource data to see what you're getting from the resource. + +=== Define Synchronization Rules + +Define the synchronization rules for the LDAP resource. +Use the _Proposed_ lifecycle state to prevent any damage to real data before you validate the configuration. + +[cols="2,1,1,4"] +|==== +| Name | Situation | Reaction | Comments + +| link-unlinked +| Unlinked +| Link +| There's a focus for the account but it's not linked to the shadow of the account yet, let's link it. This isn't used during the first import, but it's necessary for later when the account shadows are in midPoint already. + +| synchronize-linked +| Linked +| Synchronize +| Synchronize the data between the remote account and the focus based on mappings. + +| synchronize-deleted +| Deleted +| Synchronize +| Restore "illegally" deleted accounts on the resource using the shadow in midPoint. + +| delete-unmatched-resource-object +| Unmatched +| Deleted +| Delete orphaned resource objects, i.e., those with no shadow in midPoint. Potentially destructive in case of misconfiguration. + +|==== + +[TIP] +==== +See xref:/midpoint/features/current/synchronization/[] to learn about the topic in more depth. +==== === Create Inbound Mappings for Correlation -As the LDAP resource is currently a strictly outbound resource, meaning that it can't push any data _to_ midPoint, you're going to define a new kind of mapping. +As the LDAP resource is currently strictly an outbound resource, meaning that it can't push any data _to_ midPoint, you're going to define a new kind of mappings. The thing is, to successfully correlate accounts on the LDAP server with the users in midPoint, you need _inbound_ mappings for the LDAP resource, i.e., _from_ LDAP _to_ midPoint. However, as you don't want any data coming from LDAP to midPoint, the regular inbound mappings aren't the best fit. That's why you're going to define inbound mappings _strictly for correlation_ purposes. MidPoint will use these mapping rules only to know which resource attribute to correlate with which _internal_ (focus) user attribute. -The are the mappings you want to use: +These are the mappings to use: [cols="2,1,1,1,1,5"] |==== @@ -388,9 +452,9 @@ The are the mappings you want to use: Refer to this guide on how to define mappings: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[]. -You want to use *inbound mappings* and set them to be used for correlation only: +Use *inbound mappings* and set them to be used for correlation only: -. Click icon:edit[] btn:[Edit] on the far-right side of the mapping row. +. Click icon:edit[] btn:[Edit] on the far-right on each mapping row. . In *Use for*, select _Correlation_. . Click icon:arrow-right-from-bracket[rotate=180] btn:[Exit wizard]. @@ -401,13 +465,16 @@ You want to use *inbound mappings* and set them to be used for correlation only: === Define LDAP correlation rules Next up are the correlation rules. -Correlation in the case of an outbound (target) systems ensures that midPoint can bind together accounts on the target resource (or rather their xref:/glossary/#shadow[shadows] in midPoint) and the users in midPoint. +In the case of an inbound (target) system, correlation ensures that midPoint can bind together accounts on the resource (or rather their xref:/glossary/#shadow[shadows] in midPoint) with the corresponding focal objects, (users) in midPoint. + +Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[] for more details on the topic. -There is one obvious correlator, and that's the employee number. +In general, to correlate objects (e.g., accounts) from various resources, you need to find a common identifier. +In the case of the showcase data this guide uses, it's the employee number. If an entry in LDAP has the same employee number as a user in midPoint, they're surely a match. -As a less reliable indicator, you can use, for example, matching first name and surname. -However, two people can bear the same name, so you can't connect such entries automatically. +You could use, for example, a combination of the first name and surname, but it'd be a lot less reliable indicator because there are many people named John Smith. +That means you can use such correlation rule to connect the entries automatically. More on that later. Here are the correlation rules. From 21f75d06251b254f16a216132e3788a5ecc403a4 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 30 Apr 2025 06:52:32 +0200 Subject: [PATCH 037/183] Provide CSV w/ LDAP users to test with The CSV is an export from the MID-301 training LDAP server and is meant to be used if people don't have an LDAP server to play around with - they can use this CSV to fake the LDAP resource with a CSV resource and similar data. --- .../first-steps/ldap-users-sample.csv | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 midpoint/methodology/first-steps/ldap-users-sample.csv diff --git a/midpoint/methodology/first-steps/ldap-users-sample.csv b/midpoint/methodology/first-steps/ldap-users-sample.csv new file mode 100644 index 000000000..e84527baa --- /dev/null +++ b/midpoint/methodology/first-steps/ldap-users-sample.csv @@ -0,0 +1,52 @@ +dn,cn,displayname,employeenumber,givenname,initials,l,objectclass,sn,title,uid,userpassword,st,roomnumber +"cn=Alexander Freeman,ou=users,dc=example,dc=com",Alexander Freeman,Alexander Freeman,1010,Alexander,AF,Fast River City,inetOrgPerson,Freeman,Sales Representative,afreeman,{SSHA}7oe49dqK/ccuPILNCs2LFnAY9IdgV0vqjljCXw==,, +"cn=Alice Baker,ou=users,dc=example,dc=com",Alice Baker,Alice Baker,1021,Alice,AB,White Stone City,inetOrgPerson,Baker,Chief Recruiting Officer,abaker,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone state, +"cn=Amanda de Wries,ou=users,dc=example,dc=com",Amanda de Wries,Amanda de Wries,1030,Amanda,AD,Small Red Rock City,inetOrgPerson,de Wries,Senior Consultant,adewries,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Rocky State, +"cn=Ana Lopez,ou=users,dc=example,dc=com",Ana Lopez,Ana Lopez,1002,Ana,AL,Hot Lava City,inetOrgPerson,Lopez,CFO,alopez,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Andreas Baker,ou=users,dc=example,dc=com",Andreas Baker,Andreas Baker,9001,Andreas,AB,White Stone City,inetOrgPerson,Baker,Export/Import Coordinator,abaker2,{SSHA}WnenEQBj0PTlEE9lJcpUzhD3X35QpX2i3DS1qA==,, +"cn=Ashley Jackson,ou=users,dc=example,dc=com",Ashley Jackson,Ashley Jackson,1029,Ashley,AJ,Hot Lava City,inetOrgPerson,Jackson,Contract Termination Specialist,ajackson,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Brad Carpenter,ou=users,dc=example,dc=com",Brad Carpenter,Brad Carpenter,1024,Brad,BC,Fast River City,inetOrgPerson,Carpenter,Airborne Unit Coordinator,bcarpenter,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Two River State, +"cn=Brenda Itchy,ou=users,dc=example,dc=com",Brenda Itchy,Brenda Itchy,9007,Brenda,,Fat River City,inetOrgPerson,Itchy,Accountant,britchy,{SSHA}jx1Dg6LTTwyhNZbFhNUQW+Mbtr06+f5E7ODJ1Q==,, +"cn=Charles Whitehead,ou=users,dc=example,dc=com",Charles Whitehead,Charles Whitehead,1039,Charles,CW,Hot Lava City,inetOrgPerson,Whitehead,Environment Adaptation Specialis,cwhitehe,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Clara Whiteherring,ou=users,dc=example,dc=com",Clara Whiteherring,Clara Whiteherring,9002,Clara,CW,White Stone City,inetOrgPerson,Whiteherring,Export/Import Coordinator,cwhitehe2,{SSHA}hcKLJcYRRi+54CDJqkVzsYujIs0Y8qGlQbw1zQ==,, +"cn=Clara Whiteherring (cwhitehe3),ou=users,dc=example,dc=com",Clara Whiteherring (cwhitehe3),Clara Whiteherring,9003,Clara,CW,White Stone City,inetOrgPerson,Whiteherring,Export/Import Coordinator,cwhitehe3,{SSHA}rD+TLke8azMmENBlpu3vaw97QqbARoKk3zXz+w==,, +"cn=David Iverson,ou=users,dc=example,dc=com",David Iverson,David Iverson,1022,David,DI,Small Red Rock City,inetOrgPerson,Iverson,Service Development Specialist,diverson,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Rocky State,disabled +"cn=Diane Davis,ou=users,dc=example,dc=com",Diane Davis,Diane Davis,1007,Diane,DD,Hot Lava City,inetOrgPerson,Davis,Junior Consultant,ddavis,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Elisabeth Mason,ou=users,dc=example,dc=com",Elisabeth Mason,Elisabeth Mason,1008,Elisabeth,EM,Small Red Rock City,inetOrgPerson,Mason,Accountant,emason,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Rocky State, +"cn=Ellen Jones,ou=users,dc=example,dc=com",Ellen Jones,Ellen Jones,1023,Ellen,EJ,Small Red Rock City,inetOrgPerson,Jones,Contract Termination Specialist,ejones,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Rocky State, +"cn=Emanuel Young,ou=users,dc=example,dc=com",Emanuel Young,Emanuel Young,1005,Emanuel,EY,Hot Lava City,inetOrgPerson,Young,Senior Specialist,eyoung,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State,disabled +"cn=Emma Jones,ou=users,dc=example,dc=com",Emma Jones,Emma Jones,1027,Emma,EJ,Fast River City,inetOrgPerson,Jones,Careers Advisor,ejones27,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Two river State, +"cn=Eva Mendez,ou=users,dc=example,dc=com",Eva Mendez,Eva Mendez,1037,Eva,EM,Hot Lava City,inetOrgPerson,Mendez,Junior Consultant,emendez,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State,disabled +"cn=Frank Usher,ou=users,dc=example,dc=com",Frank Usher,Frank Usher,1017,Frank,FU,White Stone City,inetOrgPerson,Usher,Agent Recruitment Specialist,fusher,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone State, +"cn=Frederick Smith,ou=users,dc=example,dc=com",Frederick Smith,Frederick Smith,1040,Frederick,FS,Hot Lava City,inetOrgPerson,Smith,Environment Adaptation Specialis,fsmith,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Geena Green,ou=users,dc=example,dc=com",Geena Green,Geena Green,1001,Geena,GG,Hot Lava City,inetOrgPerson,Green,CEO,geena,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Rocky State, +"cn=Jacques Smith,ou=users,dc=example,dc=com",Jacques Smith,Jacques Smith,9004,Jacques,JS,White Stone City,inetOrgPerson,Smith,Export/Import Coordinator,jsmith3,{SSHA}tGbaP2JujE6TWRLerUwJSFhDiZ8g9ACpZ0/9QA==,, +"cn=Jane Anderson,ou=users,dc=example,dc=com",Jane Anderson,Jane Anderson,1016,Jane,JA,Hot Lava City,inetOrgPerson,Anderson,Junior Consultant,janderso,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State,disabled +"cn=Jennifer Jameson,ou=users,dc=example,dc=com",Jennifer Jameson,Jennifer Jameson,1031,Jennifer,JJ,Hot Lava City,inetOrgPerson,Jameson,Senior Consultant,jjameson,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Jimmy Taylor,ou=users,dc=example,dc=com",Jimmy Taylor,Jimmy Taylor,1003,Jimmy,JT,Small Red Rock City,inetOrgPerson,Taylor,Junior Consultant,jtaylor,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Rockky State,disabled +"cn=John Doe,ou=users,dc=example,dc=com",John Doe,John Doe,9006,John,,Fast River City,inetOrgPerson,Doe,CXO,jdoe,{SSHA}jJCyY5PSB7Hvd0wQ+fSHiDfJGwuYJRmnAWkDAw==,, +"cn=John Newman,ou=users,dc=example,dc=com",John Newman,John Newman,9005,John,,Fast River City,inetOrgPerson,Newman,Junior Consultant,jnewman,{SSHA}XiADnSWpzoFvimtXI0iRPi9wrJhjQYOj2jioXw==,,disabled +"cn=John Smith,ou=users,dc=example,dc=com",John Smith,John Smith,1019,John,JS,Hot Lava City,inetOrgPerson,Smith,International Intervention Coordinator,jsmith,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=John Smith-Walker,ou=users,dc=example,dc=com",John Smith-Walker,John Smith-Walker,1035,John,JS,White Stone City,inetOrgPerson,Smith-Walker,Sales Representative,jsmithwa,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone tate, +"cn=Jonathan Taylor,ou=users,dc=example,dc=com",Jonathan Taylor,Jonathan Taylor,1028,Jonathan,JT,Fast River City,inetOrgPerson,Taylor,Domestic Intervention Coordinator,jtaylor2,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Two River State, +"cn=Josef Zimmer,ou=users,dc=example,dc=com",Josef Zimmer,Josef Zimmer,1009,Josef,JZ,Hot Lava City,inetOrgPerson,Zimmer,Sales Representative,jzimmer,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Joseph Smith,ou=users,dc=example,dc=com",Joseph Smith,Joseph Smith,1026,Joseph,JS,White Stone City,inetOrgPerson,Smith,Expert Specialist,jsmith2,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone State, +"cn=Laura Shepherd,ou=users,dc=example,dc=com",Laura Shepherd,Laura Shepherd,1034,Laura,LS,Hot Lava City,inetOrgPerson,Shepherd,Sales Representative,lshepher,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State,disabled +"cn=Lucy Rider,ou=users,dc=example,dc=com",Lucy Rider,Lucy Rider,1015,Lucy,LR,Hot Lava City,inetOrgPerson,Rider,HR Director,lrider,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,, +"cn=Luise Callahan,ou=users,dc=example,dc=com",Luise Callahan,Luise Callahan,9000,Luise,LC,White Stone City,inetOrgPerson,Callahan,Export/Import Coordinator,lcallaha,{SSHA}zdiGkJ8pPTIqLHq9qGRMVVgGmuxAUdKe1XhEtA==,, +"cn=Mail Service Account,ou=users,dc=example,dc=com",Mail Service Account,,,Mail,,,inetOrgPerson,Service Account,,mail-svc,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,, +"cn=Maria Schmitt,ou=users,dc=example,dc=com",Maria Schmitt,Maria Schmitt,1036,Maria,MS,Hot Lava City,inetOrgPerson,Schmitt,Junior Consultant,mschmitt,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Olaf Peterson,ou=users,dc=example,dc=com",Olaf Peterson,Olaf Peterson,1013,Olaf,OP,Hot Lava City,inetOrgPerson,Peterson,CTO,opeterso,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Olivia Xander,ou=users,dc=example,dc=com",Olivia Xander,Olivia Xander,1020,Olivia,OX,Hot Lava City,inetOrgPerson,Xander,Agent Recruitment Specialist,oxander,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State,disabled +"cn=Patrick Anderson,ou=users,dc=example,dc=com",Patrick Anderson,Patrick Anderson,1032,Patrick,PA,Hot Lava City,inetOrgPerson,Anderson,Negotiation Specialist,panderson,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Peter Hunter,ou=users,dc=example,dc=com",Peter Hunter,Peter Hunter,1004,Peter,PH,White Stone City,inetOrgPerson,Hunter,HR Consultant,hunter,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone State, +"cn=Ricardo Pedroso,ou=users,dc=example,dc=com",Ricardo Pedroso,Ricardo Pedroso,1038,Ricardo,RP,Hot Lava City,inetOrgPerson,Pedroso,Expert Accountant,rpedroso,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Lava State, +"cn=Robert Nelson,ou=users,dc=example,dc=com",Robert Nelson,Robert Nelson,1012,Robert,RN,Fast River City,inetOrgPerson,Nelson,Service Development Specialist,rnelson,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Two Rivrr State, +"cn=Robert Riley,ou=users,dc=example,dc=com",Robert Riley,Robert Riley,1025,Robert,RR,Fast River City,inetOrgPerson,Riley,Careers Advisor,rriley,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Two River State, +"cn=Sam Brown,ou=users,dc=example,dc=com",Sam Brown,Sam Brown,1018,Sam,SB,White Stone City,inetOrgPerson,Brown,Agent Recruitment Specialist,sbrown,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone State, +"cn=Scott Hoover,ou=users,dc=example,dc=com",Scott Hoover,Scott Hoover,1033,Scott,SH,Fast River City,inetOrgPerson,Hoover,Negotiation Specialist,shoover,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Two River State, +"cn=Spam Assassin Service Account,ou=users,dc=example,dc=com",Spam Assassin Service Account,,,Spam,,,inetOrgPerson,Assassin,,spam-svc,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,, +"cn=Test123,ou=users,dc=example,dc=com",Test123,Test123,,Test123,,,inetOrgPerson,Test123,,test123,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,, +"cn=Tom Walker,ou=users,dc=example,dc=com",Tom Walker,Tom Walker,1014,Tom,TW,White Stone City,inetOrgPerson,Walker,Junior Consultant,twalker,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone State, +"cn=Victoria Violet,ou=users,dc=example,dc=com",Victoria Violet,Victoria Violet,1011,Victoria,VV,White Stone City,inetOrgPerson,Violet,Sales Director,vviolet,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,Stone State, +"cn=WWW Service Account,ou=users,dc=example,dc=com",WWW Service Account,,,WWW,,,inetOrgPerson,Service Account,,www-svc,{SSHA}nbiCSFRf7D89b9wZYLqzOKT6PBVHd4YY,, From 6ec527dad98da1d34510d7c784fbe0272beab846 Mon Sep 17 00:00:00 2001 From: dklement Date: Thu, 1 May 2025 08:16:25 +0200 Subject: [PATCH 038/183] minor fixes in the LDAP part --- midpoint/methodology/first-steps/connect.adoc | 38 ++++++++----------- 1 file changed, 16 insertions(+), 22 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 7651faa7e..c7afabb69 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -407,7 +407,7 @@ See xref:/midpoint/features/current/synchronization/[] to learn about the topic === Create Inbound Mappings for Correlation -As the LDAP resource is currently strictly an outbound resource, meaning that it can't push any data _to_ midPoint, you're going to define a new kind of mappings. +As the LDAP resource is currently strictly an inbound resource, meaning that _it can't push_ any data _to_ midPoint, you're going to define a new kind of mappings. The thing is, to successfully correlate accounts on the LDAP server with the users in midPoint, you need _inbound_ mappings for the LDAP resource, i.e., _from_ LDAP _to_ midPoint. However, as you don't want any data coming from LDAP to midPoint, the regular inbound mappings aren't the best fit. @@ -421,28 +421,28 @@ These are the mappings to use: | Name | Source | Expression | Target | Lifecycle state | Comments | inbound-employeeNumber-for-correlation -| `empnum` +| `employeenumber` | As is | `personalNumber` | Active | Used for correlating employee number in the resource with the personal number in midPoint. | inbound-surname-for-correlation -| `surname` +| `sn` | As is | `familyName` | Active | Used for the second correlation rule when the default employee number correlation fails. | inbound-givenName-for-correlation -| `givenName` +| `givenname` | As is | `givenName` | Active | Used for the second correlation. | inbound-locality-for-correlation -| `locality` +| `l` | As is | `locality` | Active @@ -450,7 +450,6 @@ These are the mappings to use: |==== - Refer to this guide on how to define mappings: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/mapping/[]. Use *inbound mappings* and set them to be used for correlation only: @@ -465,32 +464,25 @@ Use *inbound mappings* and set them to be used for correlation only: === Define LDAP correlation rules Next up are the correlation rules. -In the case of an inbound (target) system, correlation ensures that midPoint can bind together accounts on the resource (or rather their xref:/glossary/#shadow[shadows] in midPoint) with the corresponding focal objects, (users) in midPoint. + +Correlation is a mechanism to find the resource object (account) owner in midPoint, i.e., find the appropriate focus object for the related resource object. +That means binding the xref:/glossary/#shadow[shadows] of the resource objects to their midPoint xref:/glossary/#focus[focal objects]. Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[] for more details on the topic. In general, to correlate objects (e.g., accounts) from various resources, you need to find a common identifier. In the case of the showcase data this guide uses, it's the employee number. -If an entry in LDAP has the same employee number as a user in midPoint, they're surely a match. +If an entry on the LDAP server has the same employee number as a user in midPoint, they're surely a match. -You could use, for example, a combination of the first name and surname, but it'd be a lot less reliable indicator because there are many people named John Smith. -That means you can use such correlation rule to connect the entries automatically. +Alternatively, you could use a combination of the first name and surname, for example, but it'd be a lot less reliable indicator because there are many people named the same (take _John Smith_, for example). +That means you couldn't use such ambiguous correlation rule to connect the entries automatically. More on that later. -Here are the correlation rules. -To edit the correlators: - -. Click icon:edit[] btn:[Edit] on the far-right side of the correlation rule row. -. Click icon:circle-plus[] btn:[Add correlator] -. Fill in the *Item* and select the *Search method*. - Repeat for every correlator. -. Click icon:check[] btn:[Confirm settings] when you're done. - -Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[] for more detailed guide on setting up correlation rules. -The xref:/midpoint/features/current/correlation/[] feature page may be useful to you if you wish to dive deeper into the correlation mechanisms. +Refer to this guide on setting up correlation: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[]. +Here are the correlation rules to use. -[cols="2,5,1,1,1,5"] +[cols="2,~,1,1,1,~"] |==== | Rule name | Description | Weight | Tier | Enabled | Correlators (Item : Search method) @@ -512,6 +504,8 @@ The xref:/midpoint/features/current/correlation/[] feature page may be useful to |==== + + [NOTE] ==== The attributes used in the correlation rules are acquired by the correlation-only inbound mappings. From 6fdf36aa5135dd2e1740f6906acd74f2aaf8e798 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 7 May 2025 14:04:05 +0200 Subject: [PATCH 039/183] minor fixes --- midpoint/methodology/first-steps/connect.adoc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index c7afabb69..7ef16c324 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -463,16 +463,16 @@ Use *inbound mappings* and set them to be used for correlation only: === Define LDAP correlation rules -Next up are the correlation rules. +Now is the time to define correlation rules for LDAP resource accounts. Correlation is a mechanism to find the resource object (account) owner in midPoint, i.e., find the appropriate focus object for the related resource object. -That means binding the xref:/glossary/#shadow[shadows] of the resource objects to their midPoint xref:/glossary/#focus[focal objects]. +That means binding the xref:/glossary/#shadow[shadows] of the resource objects to appropriate midPoint xref:/glossary/#focus[focal objects]. -Refer to xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[] for more details on the topic. +Refer to xref:/midpoint/features/current/correlation/[] for more details on the topic. -In general, to correlate objects (e.g., accounts) from various resources, you need to find a common identifier. +In general, to correlate objects from various resources, you need to find a common identifier. In the case of the showcase data this guide uses, it's the employee number. -If an entry on the LDAP server has the same employee number as a user in midPoint, they're surely a match. +If an LDAP server entry has the same employee number as a user in midPoint, they're surely a match. Alternatively, you could use a combination of the first name and surname, for example, but it'd be a lot less reliable indicator because there are many people named the same (take _John Smith_, for example). That means you couldn't use such ambiguous correlation rule to connect the entries automatically. @@ -977,4 +977,4 @@ There is no automation between HR and midPoint yet, but we’re already prepared ==== -You can continue to xref:automation/[Automation] step or return to xref:kick-off/[Kick-off] step. \ No newline at end of file +You can continue to xref:automation/[Automation] step or return to xref:kick-off/[Kick-off] step. From e3d22c5baa11ebd11ef08ee9f3f600fbae34fb6b Mon Sep 17 00:00:00 2001 From: dklement Date: Thu, 22 May 2025 08:18:03 +0200 Subject: [PATCH 040/183] add LDAP correlation section; various improvements --- midpoint/methodology/first-steps/connect.adoc | 44 ++++++++++++------- 1 file changed, 27 insertions(+), 17 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 7ef16c324..9672b9b6e 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -324,12 +324,16 @@ Such an account needs to be deleted and midPoint does so as soon as it finds it, As mentioned in the previous chapter, the target system in this guide is an LDAP server. -.No coin has only one side +.No coin is one-sided [TIP] ==== -Target systems may not be authoritative in general, yet they sometimes contain data we don't have in other systems and need to pull them _into_ midPoint rather than delete them as superfluous. -In the case of this guide, it will be the situation with usernames. +Target systems may not be authoritative in general, +yet they sometimes contain data we don't have in other systems and need to pull them _into_ midPoint +rather than delete them from the resource as superfluous. + +In the case of this guide, it's be the situation with usernames. We'll read the usernames from the otherwise write-only non-authoritative LDAP system. +More on that in the sections about mappings and correlation rules. ==== === Create a Resource for the LDAP System @@ -463,20 +467,26 @@ Use *inbound mappings* and set them to be used for correlation only: === Define LDAP correlation rules -Now is the time to define correlation rules for LDAP resource accounts. +Now is the time to define correlation rules for the LDAP resource accounts. -Correlation is a mechanism to find the resource object (account) owner in midPoint, i.e., find the appropriate focus object for the related resource object. -That means binding the xref:/glossary/#shadow[shadows] of the resource objects to appropriate midPoint xref:/glossary/#focus[focal objects]. +Correlation in midPoint is a mechanism used to identify the owner of a resource object, such as an account. +It involves finding the corresponding focus object associated with a particular resource object. +This process essentially binds the xref:/glossary/#shadow[shadows] of the resource objects to their appropriate midPoint xref:/glossary/#focus[focal objects]. Refer to xref:/midpoint/features/current/correlation/[] for more details on the topic. In general, to correlate objects from various resources, you need to find a common identifier. -In the case of the showcase data this guide uses, it's the employee number. +In the case of the showcase data this guide uses, the common identifier are the employee numbers. If an LDAP server entry has the same employee number as a user in midPoint, they're surely a match. -Alternatively, you could use a combination of the first name and surname, for example, but it'd be a lot less reliable indicator because there are many people named the same (take _John Smith_, for example). -That means you couldn't use such ambiguous correlation rule to connect the entries automatically. -More on that later. +For the cases when this bullet-proof matching fails due to erroneous data, for instance, +you can set up a fall-back correlation rule using a set of other attributes, such as first name + surname + locality. +Such rule doesn't have as high confidence because there may be cases when two people of the same name are in the same place. +For this lower confidence, this rule is set to create a correlation case, +meaning it can only suggest which focus object should be bound to which resource shadow, but a human operator needs to confirm the match. + +In the suggested setup below, the fall-back rule that uses names+locality has the confidence of only 0.5. +That means that even if all the three attributes match, the match would be only 50% sure and, thus, a correlation case would be created by midPoint. Refer to this guide on setting up correlation: xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/[]. @@ -501,11 +511,8 @@ Here are the correlation rules to use. | `givenName` : Exact match + `familyName` : Exact match + `locality`: Exact match - |==== - - [NOTE] ==== The attributes used in the correlation rules are acquired by the correlation-only inbound mappings. @@ -515,11 +522,14 @@ The attributes used in the correlation rules are acquired by the correlation-onl To test your configuration, run a simulated reconciliation task on the development environment. -. Create +*Use this guide for xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/[instructions on creating tasks].* + +. In your LDAP target resource, create a icon:xchange-alt[] btn:[Reconciliation Task]. +. Switch on the simulation to first preview the changes and prevent any harm to your data. +. On the *Execution* screen, select the *preview mode* with *development configuration*. +. After you configure and create the simulated reconciliation task, + run it and xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#read-simulation-results[inspect the simulation results] to see how your mapping and synchronization rules work. -1. Create simul-devel task for the LDAP resource -2. Inspect the results -3. Adjust the rules so that MP doesn't delete what you don't want deleted and so on... // t=2060 From 48a9300b753e7fcec56db6435f9a47c0fcbd4879 Mon Sep 17 00:00:00 2001 From: dklement Date: Sat, 24 May 2025 07:36:15 +0200 Subject: [PATCH 041/183] add mapping lfccl states; particularize some details; restructure few info pcs --- midpoint/methodology/first-steps/connect.adoc | 42 +++++++++++-------- 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 9672b9b6e..f6b45451f 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -128,6 +128,10 @@ The next steps are: Before you can import any user accounts, you need to define user data handling, as well as specify synchronization rules on how to behave when users are discovered, updated, deleted, and so on. This is what mappings and synchronization policies are for. +Both the synchronization and mapping rules can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state. +Lifecycle states can be considered hierarchical in this case. +Refer to xref:/midpoint/reference/concepts/object-lifecycle/[] for more details about lifecycle states. + ==== Set synchronization rules Firstly, let's tell midPoint what to do in what situation. @@ -136,24 +140,27 @@ Firstly, let's tell midPoint what to do in what situation. These are the rules to define at this stage of your project: -[cols="2,1,1,4"] +[cols="2,1,1,1,4"] |==== -| Name | Situation | Reaction | Comments +| Name | Situation | Reaction | Lifecycle state | Comments | add-focus-for-unmatched | Unmatched | Add focus +| Active | The account from CSV doesn't exist in midPoint yet, so let's create the user in midPoint. // technically not needed in clean MP but they need to add it later anyway so I'm putting it here already @dakle | link-unlinked | Unlinked | Link +| Active | There's a focus for the account but it's not linked to the shadow of the account yet, let's link it. This isn't used during the first import, but it's necessary for later when the account shadows are in midPoint already. | synchronize-linked | Linked | Synchronize +| Active | Synchronize the data between the remote account and the focus based on mappings. |==== @@ -171,6 +178,8 @@ Secondly, you need to map various data in the user objects on the resource to us * Use *inbound mappings* because you're pulling attributes _from_ the resource _to_ midPoint. +See xref:/midpoint/features/current/mapping/[] to learn about the topic in more depth. + Below are the rules to define now. Your source attribute names may be different based on your source system attribute naming. @@ -222,6 +231,7 @@ Your source attribute names may be different based on your source system attribu |==== +[[mapping-script]] .The status-to-lifecycleState mapping conversion script [source,groovy] ---- @@ -240,28 +250,21 @@ switch (input) { } ---- -The mappings can be set as _Active_ because the whole resource is still in the _Proposed_ lifecycle state and the states can be considered hierarchical in this case. -Refer to xref:/midpoint/reference/concepts/object-lifecycle/[] for more details about lifecycle states. - image::../hris-inbound-mappings.webp[] .Naming conventions for mapping names [NOTE] ==== -You may be wondering why name the mappings the way we do above. -On the first sight, it seems redundant to name a mapping _surname-to-familyName_ because it's clearly visible in the mapping ingests surname and outputs its content to _familyName_. +You may be curious about why we name the mappings as shown above. +At first glance, it seems unnecessary to name the mapping _surname-to-familyName_ +since it is evident that it takes _surname_ as input and outputs its content to _familyName_. -You're right, of course, but the reason for this naming convention is that *mapping names need to be unique throughout the object type*. -This convention helps to ensure that. +You are correct, but the rationale behind this naming convention is that *mapping names must be unique within the object type*. +This approach helps to ensure that. As for spaces vs. dashes—you can use either, but dashes are generally the saver option. ==== -[TIP] -==== -See xref:/midpoint/features/current/mapping/[] to learn about the topic in more depth. -==== - === Import Users From the HR System // This is covered in [First Steps With MidPoint: Assessment - Evolveum Docs](https://docs.evolveum.com/midpoint/methodology/first-steps/assessment/) but we need this for GUI @@ -274,11 +277,15 @@ Before you proceed with the real import, it's best to _simulate_ the action firs . You first simulate importing one account. Refer to the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#simulate-import-of-a-single-object[guide on import preview] for details. . Then, try it with all accounts. - ** Refer to the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/[guide on creating import tasks in GUI]. - ** When setting up the task, switch on the *Simulate task* toggle to activate simulation mode. + ** Refer to the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/[guide on creating tasks in GUI]. + ** Select icon:upload[] btn:[Import task] and switch on the *Simulate task* toggle to activate simulation mode. ** Use _Preview_ mode with the _Development_ configuration in the xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui#execution[execution setup screen]. ** xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#read-simulation-results[Inspect the simulation results] and rectify the resource configuration if needed. -. Finally, after you get expected results during the simulation, set up the same import task again with the *simulation toggle switched off* to run the actual real import. + ** You may notice a discrepancy between the number of your resource objects and the number of to-be imported people. + That's expected if link:#mapping-script[your mapping sets some people as inactive]. +. Finally, after you get expected results during the simulation, + set up a *new import task* using the same steps as above. + + Now, however, with the *simulation toggle switched off* to run the actual real import. Refer to xref:/midpoint/reference/admin-gui/simulations/[] for guidance on interpreting simulation results. @@ -297,6 +304,7 @@ Once you confirm you get the expected results during the simulations, you can *i ** The object type for accounts ** Mapping rules ** Synchronization rules + ** You can use the icon:heart-pulse[] btn:[Check detailed lifecycle] button in the top menu within the resource to view a list of individual resource components and their current lifecycle states. . Create the same import task you used for simulation but this time with the *simulation toggle switched off*, i.e., use the _Undefined_ execution mode with _Production_ configuration. ** With the *Simulate task* toggle off, you won't see the *Execution* screen and midPoint uses the production settings automatically. . Check the imported accounts in the icon:male[] Accounts section of your resource. From 85d553758410cb1d4e1a8c9a808df658bc989cee Mon Sep 17 00:00:00 2001 From: dklement Date: Sat, 24 May 2025 08:37:45 +0200 Subject: [PATCH 042/183] adjust correlation table column widths; add TODO comment --- midpoint/methodology/first-steps/connect.adoc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index f6b45451f..0b9b8500e 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -500,7 +500,7 @@ Refer to this guide on setting up correlation: xref:/midpoint/reference/admin-gu Here are the correlation rules to use. -[cols="2,~,1,1,1,~"] +[cols="~,~,1,1,1,~"] |==== | Rule name | Description | Weight | Tier | Enabled | Correlators (Item : Search method) @@ -524,6 +524,7 @@ Here are the correlation rules to use. [NOTE] ==== The attributes used in the correlation rules are acquired by the correlation-only inbound mappings. +// TODO: Add link to the relevant section of the mapping GUIDe /admin-gui/resource-wizard/object-type/mapping/ when it's written ==== === Simulate LDAP Reconciliation From 3ddbc4607d3798892e33f06bf6ee10b039860a41 Mon Sep 17 00:00:00 2001 From: dklement Date: Tue, 27 May 2025 08:15:10 +0200 Subject: [PATCH 043/183] add resource capabilities, target resrc reconciliation, object marking --- midpoint/methodology/first-steps/connect.adoc | 71 ++++++++++++++++-- .../hris-resource-capabilities.webp | Bin 0 -> 44252 bytes ...ulation-result-operational-statistics.webp | Bin 0 -> 9868 bytes 3 files changed, 63 insertions(+), 8 deletions(-) create mode 100644 midpoint/methodology/first-steps/hris-resource-capabilities.webp create mode 100644 midpoint/methodology/first-steps/ldap-correlation-simulation-result-operational-statistics.webp diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 0b9b8500e..9911e43a1 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -250,7 +250,7 @@ switch (input) { } ---- -image::../hris-inbound-mappings.webp[] +image::../hris-inbound-mappings.webp[title="Inbound mapping list for the HR resource"] .Naming conventions for mapping names [NOTE] @@ -265,6 +265,17 @@ This approach helps to ensure that. As for spaces vs. dashes—you can use either, but dashes are generally the saver option. ==== +=== Make the Resource Read-Only + +If you're dealing with a resource the data of which you don't want to change, it's best to adjust the xref:/midpoint/reference/resources/resource-configuration/capabilities/[configured capabilities] of the resource so that mistakes can't happen. + +. In your HR resource, go to icon:info[] *Details*. +. Disable the *Create*, *Update*, and *Delete* capabilites. + ** You can disable Create and Delete by clicking their respective buttons. + As for the Update capability, you need to select *Enabled*: _False_ in the modal that appears after clicking the capability button. + +image::../hris-resource-capabilities.webp[title="Resource capabilities screen with the Create, Update, and Delete capabilities highlighted and disabled as per the instructions above"] + === Import Users From the HR System // This is covered in [First Steps With MidPoint: Assessment - Evolveum Docs](https://docs.evolveum.com/midpoint/methodology/first-steps/assessment/) but we need this for GUI @@ -361,7 +372,7 @@ The steps you're to take to connect the target system are very similar to what y [TIP] ==== -If you want to follow this guide for learning purposes but don't have an LDAP system you could use, you can imitate it using a CSV resource instead. +If you want to follow this guide for learning purposes but don't have an LDAP system at hand, you can imitate it using a CSV resource instead. To imitate the LDAP resource used in this guide and achieve similar situations, use the this link:../ldap-users-sample.csv[CSV file exported from our training LDAP server]. In such a case, you'd use a CSV connector and an object type of the _AccountObjectClass_ class instead, but the rest of the configuration would stay largely the same. @@ -407,8 +418,8 @@ Use the _Proposed_ lifecycle state to prevent any damage to real data before you | delete-unmatched-resource-object | Unmatched -| Deleted -| Delete orphaned resource objects, i.e., those with no shadow in midPoint. Potentially destructive in case of misconfiguration. +| Delete resource object +| Delete orphaned ("illegal") resource objects, i.e., those not present in HRIS and thus not having shadow in midPoint. Potentially destructive in case of misconfiguration. |==== @@ -502,7 +513,7 @@ Here are the correlation rules to use. [cols="~,~,1,1,1,~"] |==== -| Rule name | Description | Weight | Tier | Enabled | Correlators (Item : Search method) +| Rule name | Description | Weight | Tier | Enabled | xref:/midpoint/reference/admin-gui/resource-wizard/object-type/correlation/#set-up-correlators[Correlators] (Item : Search method) | personalNumber-correlation | Correlation using `personalNumber`. Doesn't require human intervention. @@ -533,13 +544,57 @@ To test your configuration, run a simulated reconciliation task on the developme *Use this guide for xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/[instructions on creating tasks].* -. In your LDAP target resource, create a icon:xchange-alt[] btn:[Reconciliation Task]. -. Switch on the simulation to first preview the changes and prevent any harm to your data. +. In your LDAP target resource, create a *Reconciliation Task*. +. Switch on the simulation toggle to first preview the changes and prevent any harm to your data. +. Name the task, e.g., _Reconciliation with LDAP - development simulation_. . On the *Execution* screen, select the *preview mode* with *development configuration*. . After you configure and create the simulated reconciliation task, run it and xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#read-simulation-results[inspect the simulation results] to see how your mapping and synchronization rules work. -// t=2060 +When reviewing the simulation results in icon:chart-line[] *Operational statistics*, you should get a result similar to the example below. +The actual numbers may, of course, differ based on what your systems contain, among other things. + +image::../ldap-correlation-simulation-result-operational-statistics.webp[title="Operational statistics of the simulated LDAP reconciliation task"] + +The numbers in the above image say the following: + +* 32 accounts were found during a previous correlation simulation, they're unlinked and would be linked. + + Apparently, this isn't the first time the correlation was simulated. +* 15 accounts were discovered, they're unknown and unlinked but would be linked. + + Some new accounts appeared on the resource since the last time the correlation was simulated. +* 4 accounts were discovered, they're unknown and would stay unmatched because no focus object was found for them. + According to the synchronization rules herein above, these accounts would be deleted from the LDAP resource. + +=== Mark Unmatched Accounts to Prevent Deletion + +In case your target LDAP resource contains accounts that can't be correlated with the focal objects you have in midPoint from the source HR system, +you can mark some of them to protect them from being prematurely deleted. +This is useful if you are not sure about the exact purpose of some service accounts, for example, or need to do some further investigation as to why they can't be correlated. + +Refer to xref:/midpoint/reference/concepts/mark/[] and xref:/midpoint/reference/concepts/mark/manual-marking/[] for details on object marks. + +Here's the marking strategy you can use: + +* If you know a certain account is valid and present in HR but can't be correlated due to some error in data, mark it as _Correlate later_. +* If you need to preserve an account that's not in HR but is valid, such as service accounts, protect it using the _Protected_ mark. +* In case of accounts you're not sure about, mark them as _Do not touch_ so that they don't get deleted and you can investigate and decide their fate later. +* If you discover LDAP accounts that should not be there at all, like legacy or obviously malicious accounts, don't mark them at all. + They will get deleted as per the synchronization rules. + +Now, if you run the simulated correlation task again, you'll see a new entry in the operational statistics of the task telling you how many accounts there are with _No record_ and what's their _Exclusion reason_ (you marked them to avoid their deletion). +For example, like this: + +[cols="8*""] +.Synchronization situation transitions +|==== +| Original state | Synchronization start | Synchronization end | Exclusion reason | Succeeded | Failed | Skipped | Total +| Unlinked | Unlinked | Linked | | 47 | 0 | 0 | 47 +| Unmatched | No record | No record | Protected | 0 | 0 | 3 | 3 +| Unmatched | Unmatched | Unmatched | | 1 | 0 | 0 | 1 +|==== + +// https://youtu.be/GIlr7xYi8UI?t=326 +// TODO: improve the object marking GUIde diff --git a/midpoint/methodology/first-steps/hris-resource-capabilities.webp b/midpoint/methodology/first-steps/hris-resource-capabilities.webp new file mode 100644 index 0000000000000000000000000000000000000000..5f902b297e274d8b1073d3b02b5b7fa566d7acb7 GIT binary patch literal 44252 zcmaHR19+rQv+u;VZ9Cc6$;7tpO|r3VZp@9jF*Y_gwr$(S&Hww(J?Gr#Ip@|hJ^g#D zt7_h=>8_dTewC%f#pfyj01Yt_MRi3kO;`W`K>XF{pa8sJ04Y&X#az&@O8{uDjft%j zxDWtf`@`8$Swe(ZQ%jo|>KFh4!2W8?06ZfTCwpNWnmL&O03gI)5<({Sj?Q1$@C$ReIotn()4njeiKUV07yj}GK=1f*AHMOw z@!3Dv;$Qe*PN6%hDvN&khW^DTw)k(@_`hKjOGn!;nQvb*Uzz`i-`C8QMJxjVnCJ#40BW&8jq&6(#|N=5s~sC) z$S7#J^!$VDm3C0^zN>k>s%RQ z0lxM17Ib_gKvWgYL13i~j^yarz3l!>oUq;sGx7?b`OR}I`^&sY2~n5$ zOY3|%`yR1EsEQ}|-c+&^2H)0wUOv`0epENqah6vn>q{OXqYfeyBY!8p+Yn{Xqd?z9 zALIhJ$F+*WRl&*&g#cIXj;Or_58LYS#o4&O@_NeK$~LpDRUh^BJ)p_Z3sp15OGB)exX{X3Rg0zkr}6YExOna4zUNu>hA&N zntGi$R%1ge5)V$Dp&8nkFu3C$<+R#D3r-nmAY`NS3wI1fwD$<(5bPe7d|1G9)&cyL zsg&%Jb}~Haxw+0wH<&k1xhXo%PFpBdZAwn}K@)uM4pg9Za#1jVE%uJjjc|v3bGAOPC4hX^YZX#en%~+vL_*Cf3|1cIVGh6(aDi#4{`RSKCG5LYb$qk zn}BUSBd-7!F@$bRDkMD}2TESOZ)_|Da>S@4U|n+GzN``gTI>qRp-^IhH3KgizYHXF~((cpY{N}8>JMG(7 z4W+}T$yAlVWou}b&)RsL8{(Dm!n&vl_8y?YJaa zs`?fXZ*F#^!K!M+n$!X(FE|t5xHiHQQVZ+U2s^9mU%N81<|pa|QKkONk*<#+_yP88 zWt#L*50jL4ND()LTphq zk!Q{$x2HiztOEDgwEG_YS-jp1IQs>SXj(x!Ya(6hYHpxR2)vni<;a<=l#?oAtIUCG z*a}9FLQ6KdHy_pIyw1$U7Lu0lwDtz_3D)}RsF zDKzuyku$yYdFB+pZEBqA5%#g*CUUntnBPaWRAWc>>ONT8C1W3${K<9HO|Wd)j{E8M zJGMBz5mY6tRp{EutAhU4X^!P;6Hl_~IN7X0#bf8FYRc)lEzRaN?;rr7lJ`$Ph1Eve zuh*;K>;13$t9@77@{3;WMt%cV1{;_A@bYr&Rwy6{AXB-jW3uk`^U@=^K&(xXBp)dD z{u{8`INzwHVGJ*Jw<1;J>k+7-r&allKm#Y>6Z`}1NnuOSS;^rAwz{U*+1prm8$+MO z(4DVOL7}eim_T-rY=AD){MVpU$V49F+6+5O@+zo!zG6wqrm z)!B_+BYD9+1zJA6?U>?8&+z3g2YQMf1r52x_QbkuwJ|RocUJ`VC)zTr-k=UFl30sh zM!%sl`BO;qqzgy1_8$nHW35^CO=H@ZqtXtp!=DO~TDq1UEMz%)5Y4Idq7t*aujejE z{FGVP9(Z{#qG?nhu@qEzY8P>K*VBlPzsn;3HQ6-;*yv>%Ov#-M~xQ&A~EH}Skrb6uSJiK~wtAm^4k0W-fTX0V+ z(y`-xOBg=lt3HFirj=B$ud1YbCemulW;@0RGa8>{j3E&%Asm zhkdOvK;B|@U%P%r1^(i@M|0{U%X+qsP7q#k58J}U+)2S}`24%BYGu{#1^KugRq2do zUK3fT{`$AEn(%fBNbKFQ$In6J4klOjy_)JvBYBm8rC(Q&seqd~b?tfn2G6!Q+HWc2 zwwb95dWo#`te5d1Bi-x6dw&V1_Z#Fz2bU{bPjD~w!G(bax_@TN=A~3Ebe0CtY&Xj_`~OmeDlLiiRfbjk4(Jivh=U(9B&sb6VZ;l zBVj_S*EwEgVGZoW^k%kHN~*&-9@DYV+u$|YL!sYVg3fz~^kwDjj}!3Hc3p(H*KP+% z%G8u5i~8+9hy2#;VICgUURls>=MD;w{7&tHG1m{cA7{-2Yn~Vr+O!WYy9FLR!# zNewP5t*__!e8Zag<=(Amo9k<6wq8X}5IgiBHs@s}-Z@g00xz3z!Dd;Y;Yh*-!teDu70FXPBjy$qj zg719Ej&y=c30Mlz*Sd(NunpGOy62#*Yde z-P|TJ&M6X$s181+3cJ9b;?5p=vFx1kSU-P!EHuInL%$OsIqa|^4%ngzirVT#cdj&-ukdx8v~mE+eG8^M4GwM$wgmq(wf+NC z5WqQ9tmYGe_{(L%O2CTGSeEUy;wz)?(mk>_H;+KSN$4_OO;nL%@h||Kf9W#vMI+EpdtFZ(JJf;x3;?|3BgQ z`pID@IJTH`e)Wf2b^P;i}*Pa;L5OK(2uQX@e&xF8zENecTH$TjkUIql}!}!bU@? zWw-H#kwEUqqxRSV@gzlfBm58|!f#R`_RAP=3()Uy5G!fcW-DS$2B-CTiXuLuP?d{E zgH{nZBFm(xC4OD!@^R7Fr9`rGM!)WyWGg9v{Az5mTDeIMfeUVp;2 z1h|zb>bPfXdZ}81uuCMtg-WSjh|Fg}zyQP1J z_fJDeo+RFEXxFRvYX(J<;zZFQ7adTc4?fQZ#pwOD^1*soKOysl2;x>(&CkLbc5gL- zp7dS2RV{-i%aP`2m_}N}Wn*M!Z@%MpXpVR%x`}8hQU)wQR2alg#5pk-^ZfT{+~udg zkP>6Y+H-x>5g3mxO&MK2R!OQeZQv_q+3X?o10B7u#e9Aa%L^FsBt*o}O+9;h7DD(= z4naw1+jW*y=w{S91kVEVX9c|jb-1_rS~ z!4n|~`1@5EIR5vS8rdbA4&71G>7r;Yu#Abs zOGRnTs4Rx^X6#6M+!mygx0)%-jA~yVm|)#9q>_==VJmu&D%5`KFJ*9^8u+m|MV1t| zxnuAyo>B$S?2>G6pM35ZIB`q)eIO%a{Y(;PzHT(-+q^yfhI;|K zvVsGmp{yy+_1nH!E_JG$ISi9M`C2-2m0+q$d6H6k+>d3j>E+6Dm|b-lFY)v|{x_-$^}9Oe&kqo8xwZe8l)jf1Psf{4iXww@ z0wejHnF|$p4k_q5u-(OkQ> zKkZ~55}ci*&%`lt=sHrp#uw^tz9FZL$Hy~_6wSJ3rE{=8d@o0!Su*QAQlO;$W-x!L z<>y8wK7`4)OHn6A{^*tDU91_J5gRM`+C*Xai(_rbVBm*Hr~%Gmt)Pm6%h(Yf7D$xG zXyCxO#VoQ*9QNflP8y|a@+HBP+V}!yD5-5l-k~?qZL={9H>%6J7DRI%ojJ5w6!b~h zT2jP^c8*^OPRaa55A*OFS!eNR&$F zUpK6MXSdgK5}ZRm!n?x`%KOAeShPa~zI_Q=6c|zKF2S~^*T<-?Pe{Yp=~u79>BvOZ zj^cwW!8CZpiDc`K)ur6@u@h|!OrSqwp_{^)myWBiC}MXy4{pC4L7Nl~x)h}7ZWyxYw^PtU3 zPm=L>snVUOVI%WkB$HM)!ZAZb{G1A9uD{(z2R=gu<@LKnO+;q4jiAT8O!&`*&${bm zu6!@_3Elem*#}n8jr|)eEOr*kMTpkJ-s>+j*6zgxiGq=zreg73_%E^hsP$h7-oy`J zgJRm}+rh#+s=3Lx>LgZ3lo0I5OBmXfjiSMjd0tiu)S;$-E7)lQi;A%2>2JOx(Gq|i z3wc^6aEOr2=!^RB7Ed*j-2vfB81nGcEQqj66`$cUhnvA<{Tm?I;}RvPO(PvU_m_C= z{{+ACgA`#L>z-Nq?b9GSG@1)_*pPsE#xE1LWRLD8NOH{i@R+j$$6viR6-j& zO{l*jBf_*JiWs!f!b9`SEvz7>>6Nb(32Ta7P!bNanx%z2jZISS`(~lmuCe(MqT{2v zf0D_AOdIV(Te64aDKZCb&#-;ZaRX~f-`PjbYh36`FX_y8R-Qdm?)1xg=v)6+J7rKNjH4cz|Dj8V@g$> zH7JPQ*Q9eQ+FvXycdw4Bz%f~qR9*ID*sfuPN@>P{7@3{5Y7dy6nhNKAQ1pPPK6!DHIB)C(M zGH6A)A->vo=rmPoClNEEK;(wE8?@FM<@g1pL@#?<=f-+QC+JSlR1ONbbPv_CM->2F z6*;ym1;Z+jh~meB*#3-g;fhjD?jhyv7(s3;$}TzRwWP8|FMe3yE%v#MS6)&daeuBv zoDB*8z@6M;7F*tRqkE+1mDhH?T#X^BLrT} zQSAs6S*u=B`yi}_a#Ark1mkvmbc0uHlMB;tl+;=SAA!ir<)W4-O5Tg#t;LFmjIc;- z)`=fT$SYDFhsC(%&xo&`M*Va7e+kKFFmOmWF!pd;>OmtbRTp91(bjM}P)qTG^)8^^ zl$E1(SQ|CGgd)yG){hed>tpLVz;`<88}f(-cA=oaGAu#4WC%#7PT&Hu(h#sU4nb0S^_(+q=e_+gh;apW%X$NTzMrPre{?!ktMTIXKU zHdFUw7Qeo`6im_xtU-aOUL;*|*en%zOJukctmaeCMI!YB1n#PDdW;LM`;^@Yd z$32it+~O!HV}|gK~lR;qrNC zt>_!UE_ARc%S})XzVN&I`}281_KF85@_Wbz$>c~LMR?s>8t2z`PM!!&n!x!6le04t0uqC zfW(ddE66oXV+p3#duuXhp!;h?L4BtRH5W`QgGD#;Q}DRx=siAmBCM!gAo&QPmUo8R zKjC&Q{jhbKWBZ8DO`2#IzqNk0K{@%H!wl4iAS*;&v_5P;P>*@_L=md4M3g!w%PlrC zx*+6MJJcUr=+MxTQnU1s{*=DdFW4(Ka{wN1uyl`u-!7uQ!mfcC=$b`9M}sA&#` zu0<$WkHJ;`IsQemFaWLdsnE4uUSy?HqKVb)NCYm7aEYK`+lNJK(L8gLu~!HX#2i_ zaK&#!8 z7i|!Y>LjPqz}-C_F_skur)>&cDvg66pd}JYf;BE85kfbK-bu(b)9oQk!Yi@n21(#A zqI`#XiYO@}T*}zu)vgZlk!tDk!YgTAB9^rES2IqPINuvAKQIxyUBHwb$DFB;gNKGj z0mRJf=PM;#+RSB=2c~y?eym`mfhY+(6X|IX@$x0k%Un-4rnBH&S%5saC!s%L*uSkP zt+eZJMgyEDTl%n3uW26ME+yW1t96CDt)XFgnWi^>P-t_7Ag69iTvJu+va;lwi?%r9 zU6R{3`}B6!<&A3`J9%U7bH6l)c>jGj5{`9CxVWU0x_gtqnw7pdBvPicY(UCfaC zdMXZj?h>80@5n6mR&VG`U>g-anr8{|KAmfSP`D-lM=DUPf8FQ(mSE`qdbboc1@e_v z#=Aaja_GNHw{l>5pdVS|p9c{{3T%z|8b-imtM}ho8jlEoWJrvY)Ucj7k(H@bzTRUo z;Fs_VL;q^WGqx46kYR7{>IR<6TmHmG2BrF8?h#7-R%W$?PFYi0ouQeWQldf530FF} zA8nWx(tAMIyO=E484x7-XCN4y`z0Cl7UN)xGE05Kpxp+M5hY3pYW1mflA%b_^ zn#IF?l=PJy%~0=b#fvY{?K2%aE^{RjBd0H%@p}b$8!e~6Lg`KiM*R7B23%m<-??{V z+GKppkQA69Vx%f8d9&$;W2wK+l?@Ay;XG)R)kI_!5sCpsxemuHL#;OsQ@K|Kiy@=9 z^lCj0)5Qnv7#VDD6`mr{kko(^Ga^89KU%2^?PpJsAm}&|UXor9cy8Gog*?)$rCk@E zrL_Yi;VsHa)Gy+E54)?D=__F@F(A6L{|AT4y3*=fN@)ysS^)bJG%8)fkN3aTR3SgE#ma!@x)J_&jg7W#oB&-IMy;YRX;ToXElu2(>f;M@?Z_@x7 z^#KRBoDeRwOcnPzv*8m|PIxqQYu9|oG-)K;!r8g&CTTcF`&`M8A6(m)=nDOB#9I-j zoc-m@GcT6BzeM@GcHVJM5h3ypI|YlNAokZu(bRh_a26UbaYU>yr>3d%J`#m7oO)l_ z50SJA&$W`qO$fZZ`3TxJG8{qXIBk%LNSkP^>F99-4|61jphTl~QVp3`oUB$b##~QZ zCiS6}&b?Y8cz@T$x$!O>?G5EC!~aG@OC#0aSqvOhQMu+#R+H}Or>*j!ropC^gz};b zWDoR$p;y#QpY9<)pi*P1!^qF^Ivs#tfq4NFMzMWIg-yv2;suikhF&>s1_`Ol4z=9# zaHo_+lHCB zv|CLqAYl;$jH4C5^Q9yq6R$*Bqc1jN`DV})l~l(SP$W-}x%?aK8&}$7;}AUC8|B2L zJ0TWJ+I%~$q!AjVg4V^V ze^3C0F)C6wvrF{u+hQ@HuT(2$ybFwuFpMUH7O51J zS|3Z^;1F&2EsSxRj>*4a8D%+T$&;}Xb;*1>zxLFwt25InjGdTL(7S#Ut!C!;F%E;Z z)~L3oR4>Rh1-uVTV})76A_oKmp2!kht;t6`*#Vq4hS3pROg?!wXh6#5;7&F-@}UR$ z_WOl9>r`j5fU#?tI zP&OveO*N6Vqq-h1$+H&kEcIt2$WXHT(%Ddg0kys8Hn4$HsT!#C&=tp0%+Xn}(K{Rh z%f<_vfpK&?>_u3A%@x#;^{p8K>!A{Bw#SnB-t}alscOHe7E&Wia%)Q&Busl!VhcxXAXSdrp%XaDc9uN(3V*Uu6+=^bLua z@gjY?$yrOtWpfQ8#XE}N^}P#)^9v$Cio-A386+3n+^yukAn7D5xU62FXY_6OHuY-fFCY~4X}84@$<;V?whC0 z%Xlr!F=besv(TpY#VOsEFa>gb2C(@x0vs$lib5PYNsXcsD(< ztTO+2Wrz21>{Kp}2z|n6kLUwnwlqBB!2IcW9v|H47=ZemmaLS+8y2d1t&i*tInkJ0 zHAS>oCjnc4pLO8P08?rIJks8c9_-+8e{grlI0%<8efCrf-S6MN<@w2rX+wwK1V>fI z=}RMg6>PeTS~kJ&`vUuQbaNbJfDtVDSK}TGQeoGe1fx*E*>4fQKENI~Ja>K}6p_NJ zA>)HNmk|$D5tm$J8vT>{PK3XIR3+>`xIDe_D1zRu)mEj3b6E!ch{ravXM0;s z#*1uVeVC({o|gb3@1r3VbSK*0k$DD$$z6Fmig}$WM2gc=njkz7dO$2wR8pp;^GujR zFhMBK{*2EYINRgjvQ&?f7rM6%N)`Uhau@YhwDKy&7%8fltbws=rxlCj zyf&5H;5(6kxzrzak*}JhTYXCM2V@96o&Ljv4**h6ELBjbV{Sf8N36d*OEnj~0^|L= zDcoUq36=|>xTDX`5uPBgrg%KJqlHivoEOU}s53A-=-<-~PfaC|xW9~jpLy|mL9nmH z_Yducfnm~(Obwr{m-a+sS?D8q!$s4?qPM0nbY?ToF7`HTGIGI!BB9~!jzY4br6V4z z9_5AeM!N?Daip4;3g4R>Pd)JYV+wrm%NWz=GPVSfu6M;LMo$r4E&aw|U+XE`INKnF z?AhP)9Q@xO+1bni7T$ZhNyA!xo*+DQgrnN za8&;IbQ@l`8Gi3L8#q;vh9H4O+EwN-KR=Fe-03(hN;(&iI5~F^raJ1~pza+B0gCjH zak{^++%130pOH>r)|^pbl6JPGOki2s64EMu^C{CR zHiqyX+$E<(qT&YZH{}&wGmj!)Y)nguGJD`~Zk7G>T<-en=A%vmCOgw`Wvvhd{X9}j zLfj4MSOS3UMshchccK`0ty!Mg*$Zv>J~6OivB_0qv0oORcgQRGwfiSs+_jkg#5DzV zgL=IE0Q0!`cAD{&rlzm8Rer@yeQ14(!ShhM<&ok%1x3E!<<*jPw%u&G9H(@_d1hTg z2f5);j(C1=Fc|Ev1U>O@QO?rlN&x=yt{v0I?bJ8*>vQ&rn5NXi`)+Kt55jGmp= z$_s6amrcK+hn#UiA4Hp%d3rsFTX1C*^$&=Ve-#u-}m=zhL+lw>E=ZW!Zuf@A>A4HQ+Y$Q4mP4T z@?~5Q*MJ+~@)7e;nOGqhS07yrvof>Z1Qz&@WUBQ){2^O4CNbf*50rRpb* zR{l;pKLr=QLTgV8kP{{TLtZaZk(5;I>l<0~Q~FN0iAjJkK!hud`$6^a9ocQ>T+O<2 z{d2g1<}DIq_~Z8=ceDe_^SZ7=2tT7)@0Gb$50@w6%oRtQn`p&&x-Lng?VSLGRoKIJ zZx<&?I$6{6lWuvCWX1y|vZlXbX{5$&`wuJN#8*jcu*lrQyP3%;Bo`Yf?eEEbpQi~= z+#8p6Y$Giy$j)MZ^>Z%*ZoTbJCS41qBZlkEza*n%FvD^Y{qzUx1w&B4bDw+Ah zJK3&q5t~03S}9r2#>`f3e;|9%SeP?}LTa^??1H@sLOP=gX{?>`uXgS|$AeRI9Kab$y*_S5U+ zQzcZ57GM4ASq{n^E`ypZa?x;^kP}JG5k1L`p5)egbY=U0B?ppB+Qju!$S=GiP4$ zeFgF6U$TThzrE`3U0D_`Kaz$?kd1d@ar5C?J#-AAEDq^gL?fB?Zs)rqH@s8Zp;edN z2VaB94!sSZz8Up4gJ@fL`{86uuwS|7%4$({^Nh;jMa*59Rko_P|yD#R!hh^D+}_7xSGt`xnVYBu8k`1$v_ z>RF7;9@`Ws{RBgRxM%Wy_9Rh?xO8WeXhTS4GNASR2!os{DC~;$so*j|`0W?YWB``y zIdgb-zIJ_9{-K((@2N64<54zB+fqK}6|g<3Q9gdz2WyYa1SC7g38BqmddheEvu0cl zcfJVK_3TKkc1m$XuEaK@FI~`kwy*G)lD-SnSsIw&*G_0=3$tAxrOGZkXr?r#dw2`Z*uIZ zhC6rtBLr2O>*1N)A*@aIIuq|YnZXYpp=qRcx zp5?4aa5mTiWjUXni;p)AyYEHHI=ix6AAK#cl+Q3w=^@l{uFr`#kb8eVm~I!iLckip zhAIxjtRWO~cm>MLkH60?jj91v53;28Vv!pPN;*GZ1!k?MR=8#-xK$3Qf?478iD`(g zmymvOk5v2)D<9D0!DG)>1e$H6$LD7c@cX=5Ppv(@Jl=i#P7%!d>K=bM5P)yim|A4_Sw3yrBkfkxtVnEFn z{}@^@HZZduUNXkZW;S7{^fDUYR6K??68-6zl>UIKlzyn2+F{uoD_n4w%H%*Ka3t8KrjW#0HMxgG4)Cat31mVYDy}V`sJyjc)`Tw&qRg z2x}#}Ad7b@>IT@|4E?P9w+|{Iz0iuTj?=`BSh{pUXj~pmlkKnO<1~*AWVG&llV9Bq z(Oi?T*qdOW*vXk}(Vj9Bw~9=AycTOPqQhas5B)9+RlC75GJPx+fIaa>9uBetFjdd^ z3`J}(AFq0OgZdMhM+ypt6i6uBa>V+ew|@TaZjvk~3P8 zU^D99CHCHAVNz^DJr9SQYux6S1!~9ac6cS{yyV^@8cxdE)EpWyLNeWK1Pon%xa)&h(wW>cm->+pW6`F#S$ zk)SX1pc129QYXeqMtiUo!u(2Vg%Ez==jZK}te|NUgN=6qz`24lTvwKFiLD&K;CVa%4#|rh0msE6clfN8N z!^Ao!?7)N1_gwE_6*p*tT-#^{w_=NZ>3ZA+g4~6tEFQj=yYU8EysA>xKQpOuadaZz z@vEpKQ!LrODWtQJ3tuKMMS3Hu#Hhh8YR^0BvSKiDV%V&xb+N*53PP)2d(zf zIzv2Hj(;mtS7;w-23{sK^NdAM-!C2cNO{?jBB|O5-O)z)Fwf&2Dq3Bg3Sv2*hO?#N z7=Ss)WnzPqM*e0STmdr7b9c6Y`)?qi@$|)DbF)AKI6^SBjZX{j$$1j{&EZ*X$^&P#A{_fBdGjfLxhhc)1A*?vJC;Xd zOVvzN{dNuYKve+6<*4jL%2ePCBRxtU^g$?OnoF#Uk_&J+194+)_D#ul7mwVt=&IG8 zR@(7U_G_nC`C%;xWQ(kSmcXhWl_nvxERQxujRpq~SN|8;_%x`QyqWVN>f=Zppa3Ld zComPyk08n+&OSfbbOh7twyAQn7WJm?t8ziQq>Z|o4ECrD<7H)sp_5{VnCV?m-1?Mz zVg=H(r`tzPa`d(^dxwi=`yK-wvoaObG<2Z%si#B~Dn;8$?g+fCsl_ zCKd`#?tUzuZNHeqhpyy}p@7%}Uo(XHZ7g_Fv0WySQEz=TWpR}D@6)QHNd;?kj1Kek zi4R#&H^cQ11k~gR@xBK^$tcR)C4${DS$Uf6m<3UIy%8wiCW1F zjW!r)zl#mhwxm7>UNf7XkOr_NrnOj>U=i1IF#j3s)EHwThK`7ce< zBL!n{?Xr&A608GqoiwhQ z{PcaeDrV5;bPT!4a?E36HQ+KPIjz;1Z5ZTlQ82pZGPB={q=9%qZFtxPkkEO>Z=jAyFX?QR4_l4I;o{PSGTqPUnbJ2Y^%A$vS^>nWwa<-kD81U|e68g+Oe)W;1;k(Y$2ukMBuH^NI(SJv4WvDq z9bfkTNno5UQfOYOW{)F$iOXibrE4>x7cwEA@h7Fj;J66vAzy{c~A2x`Z~Q#z~-7 z?xw?U_EW*aH#z`%7eGxLER+kB-_-7!QZKzam!|*_KAF*@N>dFKr63=Cce@D2X!hGB zM0Y9K+B5BW@kk!KNua@}*3R$=?ay$v5?x>G=J4>ZrL-GRgYrSQ8ve2#T0;IuV>x%7 z`j@EAO(3OQ31p=^bNhu2-)cROme4?4lU1@XYTBezDM!(qBX{LoG^?Qio_6*KJBYZA0C^E->wDw^k~L6qUEm6N3~es zNJZw;l|4_f;-a~0wq|hmC4gg^fjT(LiXiBJXW>c64|t>|>b=(`2mF`l$|Vj+yzwH)a%|`5Z-Z`N1bFV>HAv6if>^?n9=x|sJ(`2ozzUz$sqD!~{apfJ? z^+dTz){93l6gAxT;hB43Qf*CNXQlvXQ~lw)&oTm|BcUf*TVXRXSzP&U1?-pa!8Lu8 zJ*j^u{_}#PYuJ}@7h@X9QjhfMaDa+Z9vA&N4(oI<&!AgLEg)IK#jn7Q503bU@_|uo zIwNDyA~|1YM2SFlZ;{V|%iE9aQg3?Hk{pyD0kz-X%&AD$ChdEN`Ku z!w!W|`i{IY_TWsKxeBU!(91=Z)TLw>HqzL-g>9uFhSx=^u$(2?Vy(9yEO!|WtH5%x zjF{%*@MX+RYQ0!JL}ZQM4_t%*Yr z?^CXUaP+J@mY!AtWQhhoo(@i4$lLWVTa51t!saH%BRIEv-1#|XRSeRgyM5(lL|BH- zHp6Fu4!gX9lakix`Lr?nO>lA}cyW^`cBJO%-LqZVe{&9)0hkOdddeKzeha6JETofZ z<2IWHgIG_M423BLz6xfnH0Q1q6I|5V{Pa)xHSEvyOtnyDCT*3Q%Isft!3Eg|& zsmcYAY+0nE@0wNW4sLE0;&XyKux5XK*~T^Dcf{r~dP{$oY6y#f><2hCvE7MUCRP6k zn_?CvlJO2``is^fDuPQ9E%bfd2r{<>$zezlYt2`j9@K0qej+TVCkF%;D+QX3vkcAX zJR*KNQnhFR%ua@8K<|^8!Z5u&{)vJZO2t^B8kz+hv2{iH5C#mlqPLM2*>{tu}7t31xnW1 z1AP+`zn+{q_%rGNXxY$kVJ7;#8&Zm2(4;WZw6NaWrkEsjFink1{!A67fY-vW1&42* z`Wux=q0!CC=#w^hiRmBMP|q>jKIF}(W^5TD2FN# zb1p!TQcjuq1myf+IA=c>UN%8}>)}o^XX}(VJf!Ks)z#B@i&udcF>f{Uu9<;o8TQXA z`biWUx|mCEWpT(VPLZbKz;Sq#2^e#$9uS&6_f{6qq*&img9GdRBsN9!zI(955*Y83 zX8$pgy5nIVr*y?ySN$^kGYSag>J!riXad~@*zrxQ_6uu;!JUwJ7BM^oW3Cdr9?+xh zvmxTQn8phqK2-`0olLWInR_-8#J;*e^bCwpB$C+45>GK_x-MPJV{)iUwxD?5h~U00 zaw!U`^b67trn1$V6Wzhiv+X)PgoJ3uSa5+;l(1mC2xEXKgs3inD(V?< ziP=*zWprRytERMAYOUBfE+g2tBCjXw#H?xlVY^JQCdFD5ME|DWDgD#P^ms{N^mRox z7oky#c*`#MW>LeDFsq}AjS#jR^+Osr7l}caUla$rsdErwdax!nmy8}v>45=@&_Oa* z%S3;i2!hJW6dIWGvfAtd>i|!=@-P)Ho-AO1MK#byZ*{?t2)`1!PvZ1Vp%>kNE^}ps z_PWHc^Fa5p*I3^C`QJJ0!u_=2XAAycvCAWDQfq|MX%;>PYh zq~rXRCoQ^oll39SB4&FsOL%!a1f+R2_XuhPNBbRE9joW4FO%w?a{(`*>mTTX3XlN6 zDWO@F1ZE;tO7B1}++JzpV2y%xW{4xFJqD>kOQrUURu48G+hY~(!34>C=v4DEy zSw(J*Gw+PHz*u9dcnZe7D__Fr%g?kjW*HvEwWVNB*;47y*-#^qdLU&6EyFwSVvUUJ z%(ppa8u6$3ljm8v!X#BHy>ih3(W!{n{h|1s3DmodVGxpaW~dYM@vC@Ih(m-5C_^Qe zh@~cc{sfeItc+m_;}KzpSmY?IvS+rZZ-x`oJ(CW)1hW&u93I}ZOUMl@oh;cm@gJ44dbRG#J!iIE>Nt^2xY zooNwoOM^OwzBPuf3sQ3oNiROnZYEob@l^6bxXv6SJcITWb60~;upNsSd#+bp8&BLF zR#qdh(%%-oxv#cEgO__Y$86X+V-n)+!q%3!b=N=T!GxJo?Y;;-)k5l}W|0wdW6Efk<+7G zXL;7MCn1oUKZ)JTxx@Hz`eyFGXuM-QE2d0jWmdosZC9bEUJIVdh!g9kuv@c56qM!o z<|_b>^tZU~tG3l|D)cKatJfE_UiSm`m3|}ZZr&x~TG!G=0sAboToPWoY+M7E^N&*$ z>I>4xpDCczTs7~lj|Bw5d-7Y>K1kaGQ)}L|5*KHx@)eeUeWkIRM2BX&f2DOp%026B?8C)*i9u^ZTs~DOaFcouH@vU~kCQa)5;s82xR| zwC{4-K6Y)hXWj9G=KUBkc4KDgU*9_8iWJjTx!~sq{7S9na_regpLTj@2?FAZaN02S z+jw5hsh$s_EpJM*-zJ)FzD2^`LDDKBDArfMGhe$8DKE*w9&_$fu4zEi{aRAKJ(V6> zKki=_SvFs*_B=hb)8~tmSk{`sGFP+n(RVwifEJzhn9 z$p^+ycRKK@tr7|2#*>%EeF1LPW&H{^gA^uA!`co#DhCK@Jl73Axgay+U$s^>vC)0@ zBMvd!Syx(Kee%DMf8omTB}N+qZcznxXNpJ^DHKPXGqmhXv`NO9@Xqeo<6BIH8KDdB!(X?1|uH@LJT%+vLMz#L;&ri^^u*?VA%D zKYRhd<-LBQ2dXMOq^oHsjBYJ~Iz{5&JibJADA6Bv0IFVloZtvzXWsK~O3bT$82sPU zD0haGaTpJIx!?-UFM4L@PXO$3gMJJz(`0;rKjTaVnFTJ^{Bj3}F85;XIfcEknB~K- zUa{N1&}sw@u9%1K@KSi4MTA_ z0u-wL3(dxn7cjyRB+Ji1If&EpTN9HvqCLLU7s8spYn4^mt;=qK5Ur+$ui-b3fnJC5 z%_Ku?_it>`ora=<&m`xtewg@@sO>-P;9ZwF;UGKx!adim*fwJmbqcY2k*#F3;)2{u6p}6z z|H#AmFkBlZrpLF1hQz#dQdwUDUr0yGeWG90IpO?G_6zG3yR^`D$X1pyE4(9Q*8qPl zbkA59$=O=F3nEb480%qf~=vf>Jy4DUn!{sQ>mD{EdeK0inHQQ*#7F!sktf7-%>x5|5 z7%Y_B`O{Y8fL@yXijYiRq@3hF6BV}`f;LTic_YVT7uk%dYN)bd6!`9-Ey`GmsH8=k zly(XI{AJ8Gxe*0-8%!|9;1zd2B6c@VWLK;hjx>DdCiCu=r{3AylrA2<|9lCUhrjzp zOfbA3OMF;81ZZ~j*6$pXA0A^1GG2XWL7yM>>@BmuB@Fv=$svLXSLw6Hra2PZX5pl^RIJ7GbBv1L8-Re8^UlS zj@#tT#d}HDmN$dkQ+Zc4_g_Dsn65PQi>XSJxG4dh zBPq_QNZSi(7FeUF{8k-6DfzVUOjj`CtQkEa7tGSdXXo71#9M{o)K$miU5*HnlrF2u zFe`^m(Q&=8KRol5POzd2uI91aRnN!4W2w7|yPkjYuoayikN(}YYm|I%oy8a;}j*qfEzQCh6k&-)*gB6rgIZ#CLBh67s z>X*FQJFGYFFGddKuo|h(SugeUb2yi~)ike^W9`hekw@8Alg$RP6PTQE&renKbIMfy zZ!C)?RZO6}pATWQvKNVqSB{9-wGFAbzglY_KIM=Q7LXOsYNI0B`;$h36LI|667uN> z>_5VkcXo4pI=-mFZ5@Y@?o_WHz~_abRXd(J-2aTCy4%5sCs0V$ekshzsP)Y{z6Rn+ zGr>~6$gSM{-D3G&nT*~9+QEJ{swrODkul=S6JwEl_Ip-l0NJx(ZPp-SnFDUD=Go+&-6ZVTv zHJDTuy!5+VQr(^F$?)z&n6!tRbKAx-oRe1Xa`{+O%VibQ-N_Ztms4ZU9=q))Kd00E zZr48_8I!%cR0QDx7rXEF~!dye`a)1q5t-+K0cH-{&pzF_-He4 zizRPFHcEf|$ZYg~|5xkJ5whHB9Wc@K?m&Bes;vL5uphqZ7BSYr@`^_-e#u~!R!TqX zufnhBEAIQ!Rlvf+_YwBJRsAW=lO^wtjdzdo4~S`AE7?=Spd<@VWYey-H01MhmSH+2s zo`2zfX3c32u8T$HeiZ@PHJ<&>Evbw&e$in$XlHf6Ci--pdY#mJ)#rG2)MH;7X=ZLp zxF;6*qq~AF0_U)&=3e92yo7618gM&&=F@9;j#{_jXM`Md-(l;RQ(fub5koUz@{L7c zKE0A*y8QCIDP-c3?(?!d!PzG?ESF`ZN=ISC_t_HtaqIEcT6`{=mZC%i4DTp>-|u~W zZEzMyv*vBP^?LWg9<~D}Bjk|NO#9+vn;xsK{lvMsr0T7c#cN#NUe~)g%|k#v3p^{W z?d)uTb15h9a}ZQIMs~NrS0dmeo^Bg<``ctl@m6J$46(NHsc3d_0RZySVcUCbJ)Znc zi}+0nKJ}5n>G=26HGtQ+yK4o9@JraWq?k(2e9PeAy;W>L5)WveiqhoB_qGTYYI

gsss$g1>6NzSiSL(guVy*5TVW>?em|Qvhq@1R zb=sN$s?_#T^`7MY@w||f9D2&ZO)Y!-C;&X+4kqj-dlJjked8kYXvS{GzLVoqRAsYl zjzw@vo5O@#_P*RVUHJEllwDY>sjwffwN4W^)I^ zCyLMEQ}2dk^Ap!8x5($l%Lmk;z~Ey-YW1!}I*a#0IP%}Tg)G#y?J@qHmm>5j18uD|_ z*y?tfSaQcZ6iU>QP>66Lsvw&#%{H!OLBfa!j+_{vGL}L!(D~+#lYKpMYX) zF??HEQ$q?wdr!7$`>#6@sph-1C&^`svbW`Ka-xcexS=>4aa>5mlx{FlRL62MEHL_l9t2=ALE(nKazi4kmf=iYh8^bw4wWVL4OPxLx3# zTJTYOr50G_AT#(spiKw=&gl|oI>P-LQf02h5hRXblg?=fxws2;&63fS*pHFKj|7_5SR`!< zg(bW;kQM7%lRfNmsLMOS6d$=WUU2xtZK>7IRnsn>UVZAO5&O;?m7$CQILLt z;S|B`(IX(V`l7hU`^6l=li*)%EnKH7DfDOOx(;cxk<9*1of$&%&JmRsi6XFcH?lpP z`cr%84Nl+hx4e9h-%B#d5@zDodJQ zFXhl89gXSk`S;E8Nw#;{h-H4_Ae$PhCt0$6jrsi&gP`mp%=e6m!gxL92Jl3RIz^<`-82Q5-D z@a^muwpcEAOlxa)p{P{Kt(?;7tEvu#v%Y|l?W1OrKWGIBne%5HzH zVnQeecAUl%X$IsX-b&49+7oTVIkHsY62)1nKXPKKxiSX}WeGI=@cVU~{Fx;{_rlS? zmHkoHt(#y}J?Y&Z?`gcO2Yhi{-?fyk#~)=6+&5s~4XCe9Dg_Y-Bg@YWBLj@~%>t64EsG@Y(M${{#bY+}d~XuRKKdi$}>7Ow?JPD!}!hMK>kfMXJ zY;Jd<90A`c8z^ANwEmNS`n6S8FSYT{sfPvS>NWLE8RSC_`y+Q8yM@o!7~$x$0RRvA z&c+#ATr7`i>yvSstwv>`i zi3Z1}7pD2|q%fkkrdhlf+kC<*&Ql1J1jLc6er5bW9+PY$cSpUxBi6zOu1Ql+l9qoJ z+lkl187+92v`$AUY{fEIg|4Z}sTWmTs5sE_K$PSEX(+cApRF;+Iz>>54E>A7#r^xJ1f%9 z91zQ!ham~7bN8yH_Q|y#2}0HGcu>!6j9vn!1cN}ESxEGmrYr_IIyE!eFsfMBDO-Ig zhowt+SAuNM~LXHu)8CKE(fs^JUj%;n*trUX7p#|k+ z?#pa+oz;gID2!?v%M*!>Ty(0rL{v8?jj~YleL;MV7{ZwyF{-GscqPTU^qYx-zPJ|2 zqM;8eubeB0X54vA*QEB6qlji41IHsJjz~CkW(1nbK!_6!N3Kel^=5)R97$Y~5!0*> z$|Dd$X`ouChb8G-5^1^~g?%%ip0w51V@&x+<_sjHdNoj$=fHEwvg0s3ep;#;2p!ea zw6Ni*ti9D4ce*9fNQ!d2K95p{;FU&-apuc&hI8+>|#IUj3B4XRR8J4^8no`CjGZrC4 z=6;$sP5Z-WkD6A5A7q&7N;_~Aq}CA(&#er~n9D`;7!1c4<2z5gzps0uE@jr0__7sz zy`6nu9kx1p#L&`NT)2uv*~%!Xit>j?8x%zav3`BeNH))kdf_1B1jGIBliHXfbW#>g@jz6R8!<$H%f&~C4yn63NShJlJt02coQzS?3V(SsKVcsBxR%A^ zhqcL-$TmfD)vd?P?2F(emqkjxgvm81Huz)X1d36^`Qop2uUp@3x~J{tt;-^FsYeBnr6X+r86YUr z0k~Wrrs^lwD%;)#2sPQ+epjo8hGIq12=#z(aC=uWGB^P|ySvfhK=#ZEl#7;O8Y63p zVP+r0$D`~IN0PWl(IP~vb^IY04F`J9jt<>SQ!@Us(Q$hx1&sinSyf$I^H%1^Nv=wU zfsV?F+HxX|FPa`qB|5%xxa}Mz!e8FWfZTy>^CD3_Mm?tr78u0u8|Cz53{w_1kZ3hb zqq$Pyo}*2~i>knWN~Gr7_|wRUh0pV5*#ihL&t~Vj%7GE8fw2iSvk961WzOj>PjPqD z{+>29`QOWHl{(tMUu{Ln*r#Am5l@4LpN7LA|4>mA|2GaUnLW8>=;l0e&CcsUojQjt zEt8UHs)8WH@JOs z5O5{p{U2Y`zUE*Y@F_?lnTm|1krHf+hO_fJ25GZplAa-@O7hbFS9a$0xInM=YY%s* zhPSu_bz^9$hE@&{Up5crbkbPdh5pYN=;C3}ECT3EZ!>5>-m}WQwK4XN3ycd_m%ypk zU#GUCZ~4e8b&SD`hi6ic^}e};a}m@t z)Ja|H0z4e3;=xTgRUHW_!Jau)TsSxPrCf+iy3BsJC~oi}-o9uqZlR9^ z)IijajCD*Jx!9UH5boX9e`>R%rU-}hxuw|%VpK==$y(}4hxYBjC0FRDM%|aw0BDri z^Vd<3Q6Wms%^W#RdW*#_A4!9WB@Df!iAYF8z|jO8&t<^gOm(f}dQ*NBYWOz5R%x4f z)lkBXnahWFfjP8$jF7L$u`zSg4GW%TI7v4qe$)L?bPq8|OG`Zk&4WI&Y?*cn9=i&q zc4o+g#KzwncM~-X86>5=s8|9Xt|lit($f43|3`!pZc6T0Wtf4{eG?uzkAb7}U?a`Y z2;SrqqL87|^n`E~!3T@@jKapfI{_H!*AGRL<}ig-l)>!1ap+)c3-=7ucuAwS2D6qO ze42wk_uie@ck;G?(QLLD6ny%Urk)|iK8n%#NhZO1Vnaq4#?Bc-8&iJ`Q@LJ@*Vw5! zzbCdFQ=7y=+%OwTK|_A@t~O`4V3ujZEgmc+u+_C+{GJxpFC_3(EH)F9Pc0HL#FExi zvqf!S&))=HWWY#!>`y5>R!SJeL9Z)AB=YZMrU*oCZ1i3jnO)8h6jEI=^H(WCO^^6Q=v=A?UFHswgJc98n>m5D8+u61a2R(%3^QevRhktYy(Pgq2lgg3jZs?tiNwR~ z$Q+atLkEkMHtN{uX_9Y(r;)J}#^IICAs*70)k4O8j3JPb0Q9Ahz$ChdHUw=?O=EeV z1#toqplhh`hT1>l_il74G@G_heCQlU4JRc=of2NDi-&1E1WGAm42@2&ff`3=)UpW4 zFkpfhOksDSv3usUGwmGCsIBy4zQPQhkmRZFdmmDMDUFL}oOsA3U=|rIJ0Qv)y)?zJ zAF8W1EsUBd3w-+kUkU3CM z6B4ehdbIs$;mrsT%)Ew1$Hhd8Ga2A%fLqLviHw{Ag4Qi;z=Qt$*mv35?wTs<-)a)H zvD0zrui}0`V@8CBc_i53;-LlWF%c5uuR9uEiWPerGvN~gF@NAz^5)+tm(l-PtC26* z(YXaZhNev^!O{9?F5u*+=<;}~-r$KR)p=T_z1VReAOj-l0z`ji<*ePJ!&0kiT00TXViIvr$lUyqC3RSz55 zj|o%w3ca1H4K9?Sa}S*UmPz!LQL6oA6x|Ns0SZCCVJmPT2L(_7E${)>{K$2VUkHQ% z-V9#($m=-J6L>z?|6<7$PknJk_~9GZ2W7CZywfxH%PAy~zE#P1py3kkCx&x0k!Fud zhEZ1iCh&m3KJ}CWRBNne4bWZMgnnP4m$`!*XQGQxe7JyC5--x=i=LkBHZZ5$T>{Gf#I^&=qfqLifC$Sd^3zc%Pw$AZTz#*~& z5k>tNdy=x_xB%tN1_MWs;>n!WEku-cg7AeA?*S&#%;N?$Kbn}!($$WaP_O6FqS{Qx zi;uU}btNj+72uvn`)+$K3F2+XD`_xYNdbF-wQLf|v!9`jS}JbJIAmFZqwo()7V4GC0xK#Yb@YjjmpgAJo{Ce^uz=wL+bXVIp_p_-$+j zTERT$y5id>g=8*}HPU!tB6lo!69;(FBB{Bafi)ylJIT-QCh#9L$~R6CNke<|Puzn4 z3VmEaYu6*Fy%d8E2eh+qa8uxh6)lA6rc|m_3)kEj%C2_-^8crlb?HAERHObm1b~ z0==JQhKz{ASUY>_m{HOBW72<4?;M4BtzkGtm%_dn`me8bMb0Qa+)KBEJ67G|d2mRcgDwwkP8-3J*$n-#Yk)uRDsY1{9R^%Zz zdU}kQ&z~(DDsyt&p{pCX8IZ365Y?6ypRJ62H|;=9k3oBBQd4878Vb%079X|J5sb(# zPFSZwkUr|X7j5nu$BE6=4n2-O=tAEj0G>Y%$AJdjJ#IO#5ELOU5j@WE~PCe6V}5yE=^yMj#GCt!5-nsb6EoJJ?~wdTHczx-cYV60aor_ z;w)XEu5zByj*>mcEu4qxAMHAP;g9033#vv_XSffT(}Xn9L#P7VnBpDu#GVBB@lPhWkCF*;1!+CE2N_qYKQq3vxNks&9A%TvQK#qIG3! z#(R`ak=RiJ%sbWA+>M^fm0ruU0e$6yyxiFt%~u`o=~epUxK!|Ij*hA)Mx0k=3s(ch zRv%lC4*&pTf)}^H&2w(TH0q5#vu`sWPNhN@=F6q{OKY@$N_B+DF;mXR)^}?TfiwT- zy^mHsnP4*Vsmuoyx|O=sb^s_H^1vKV0mOa8_L%3_iE9&DRJNry{uA271f!{TFRIrd z?Z|(da?6li@aE0DZmcVrB%BR-FMd<01;4EF@-`n^tO=exlODIu3bj;?<9mD zzQdRtv9A;3on9-C`In-68L_$jw*~YpalZW;i5G{v2Uo!rT_RS$9@xGXAGar!YXjn` z*Sq%h?rNi-`+@y+glcG=5U<`$5HL zoHz?LEnW&{`f;;E(<2pnTQQ^mLNKWQ<@W&c4gF#MbNK&Dd6Lb@O}o7m8!E=(7%^*} zlDhIq4F9afc+vG(ipJj};0^nXY74x2vl$;LyAJ-app;Mlmpite#%T&6Ox9#Nsc8#@ z&jjT>4yZ6A;P>`4vhcg|CGXv4zs`nPd5QkXnCLK}LJ7TrSd4K=gs+k-PTW8-yFvN; zQN-oY3@{SezlSZ(fEXW)SRPyR%PA(zS!E+N*J{J*{5<7l)=gDM`VI=MAvI~1KPsD@ zUjY$CPhJ??NiQjQMezwOCoPM&iBp+P%Dso!Ey=iy>Y1mzS498sm zn@Ep=w3A}hmq$`G!WW^Rt8co~%(I$e56%+fkeaUD0Ie}KLV3&560SD~qW#Hpw!4sQ zNk?UKpAan{k*9~kLJ1^{n{z~|<09iUf}{@D zR~G_-%6txlfb99t_^YTo_Zx#;_WI*&uG^JfE?AF6h7`cMz|@R1P*1h z;lE>BV#%5>sZMC1h4t?^gX9kDg#eo$yQT%vtTf#$Z-{gqpqbiP`iel2gPgb z4c$dFCX9a6S$wv7^SzB7S8IE5!!Nx^!i4=+#9BkC?xf!{3S;<7r)7Ir<_`Jyexy`J zVWpWHa)CN!P8=?bJe|-KkRXeQ%8YGk()sIWQ|H8jAX5lA$^E&7_Jo%7IHD+T_wc)j zR?3w7K)aBqh=IxNC73o9k zX__eB>~tZX_8pI&YSt@$qHj2#mAHsz9|%y|sq!g8jC~kTw(XrrN+)DPjwCr_w{9ec zk}TnQjCT^Ai8E{lrc5utKpCCcyGr@6gMrW~Mw&XKp&?ea69~VcJi7YLI$oWnW8Tdgd+TZfVj^ff39XibB}Mj+oNXR=SjWReF(pHwhrbb4Xov?K3gJS)qR!I<_IYp z`13Cvraah2X7Ce9_ocj~K}JYrV_Lk@D-krehz@;e>kzJh1i-U3V!ie{1(!FTF(V1+ zy7chNRhoT)ekL+|S{@(+9AR}GaLE%>;c+>3@>yRu8C{EWT4OtPa&z@yViVUkkn&}WQXkc;T=C)dx5NuHS7h;r?L&J8`t zG_4h^R(6AuDV$B9CH9XNhCSbrOXh;8;lajI`=n!EJy9HDJ!GVs8EL{@g>hfRHv;E^ z?nL2-w~LYrip3+fm_QMI%~Y4W|@=W z>1yJ6t@pn`kDJ_<2Zf3j4_UZ~J?sR@_bY{ezNgQ<%X}acSzo*5MRA60$mFOv53VEo z$LIj3op3lKM@F`1hB4RNRT8+}h54ZV<`Jg@`oU9TB7R(@_xOL9CQYi-a4NL)_!dq$ zbO!Xr7M$R8`^HvGFI03V6$8|t_n>Kr9^Vr0$rJeqz^UQXvnBg5GWMq=lgwvI6um*0 zalUy?uRjAR)>gGWi? za=Q~4F6NE$1o_kGjRW)*Ul`RALQpCSZ9vM%u^gCfC>_{#WEsThK*_kssBq~$kj@|~ zeQYr(Mrk-x{$G3@jz_>>c-rmch*IlbBgi0O<+EF(2!hT-_%KFv^Jb)#`S-^y0AlXc zJ4ta~NP9Bmx2s7*4mXh~=%_F}QY8mA<0aPy;`?P_ z{vV|0X_4Q31ZL~4!FKI0EgN0;j7^%Hy-o6{y>GdEL;UqUcg#%QAkx0ljr66|K%Yc8E-q=J?&a%@GtcB-_=vNb zS~xW_lJB}pzPND!GFgi~#iSP1O`S7gxAJs<6_hpfA72fxS@rSq%KXhZYpy5VGh8@i+b@#%gbbyW!w`Gt2bGP{*__2w;?kkS1j=}w zRt$vRs`5byY{ag;MrU8wFNL)!`w`k($5!9tL_)5?unu2P;F7PC#QYVV5J89k3*IAN zZ#E2YmXNAd-vY-CX`X?H|J!DDb|fIDEqeGzIKVLvhj(A?vhY9x(_Zo(>IzD350X5i z7K}i#m>wmn{}KfEe4YX`TLhGF&=_{qEgy1CGC zH{8BJ)o3#R1h*9zK|ev*C`P9k<_ExX<&o_F0Q8Q$)Ii(R_E%4-*V|~qo#mF@1^pdi zc5(YJH(nK#4=jZ+AW>2nKRDG?PK}6IDMzqcl8bKos~-iacb3Gn`A@r{AsSYobyG_~ zEP_pJ@8i*(fl`433MX__dkV5iT7nc{AmpdanxYt zQYqQAHnWPuyBZ9P`xls7=W}<(RP+OYbkP=R()A&8AD!|{5Y9LD+Vn*J$f-QTC~8L3 zgnUZpc86W@nbB@rFeL1DV8Vvye_-*lyS-GJJx*1U`9qe4R;~Aw&bl~ z_1uq~tn&d(kI1lD^-i;f!#lIN!C|Ivj%C$@VqrO_6Zp?`4;{d5wL#O#(N!;r(_ZzN z{)z!h01YXblF|1Pf^E@Tu`$ox@8dsBu2+^Cjr6E`>%3$oy90k(SvII41CWv@J{9Lc zR&Z&{UJB1&-&BeOe=V!M=7f!Q+j31u%`J9ln?U_G_XiUHFG>9kJwdnz zTr!?KCyvPorc;?clHUp(v(LRAU%D5niJ`zQZx1{^V+pJA+wFx6AQw*4aNHSSrt7N1 zLSV<;M=XCq@DvDJzMpv|NS5q7agUSLLvcKM%fkfr;~7qvhM$@(2g{BQZeu3TO_jg( zbV`f0q5UsWRkX$`&~wFfrBrH^CkDJLC`*>(#1m5`7)& z{iWv#^PwHUg%khiP9Tqr;PPPG?e)PVO?kLzmnfJrt)1UD@63VUcx2-FX8)t!;=9An zP0jR^;uQaP$?_8D&2RYJ|CGc3YT1~|12r^5bvU!9>x3c^hXM=Z?$d~T7f7dJLR0=j ztR2*j*<_CYN*5aB@?9@Jm8*bvctv0{U;@*}*wQ~aB3h&U>G}e8OWRlr+nm(n_J~@bET1%oxWAHZ$9)P^z z6ufaF0BhSJU`@tzqw;)Yo$03A?tg5S#)XT!g8wWL%QAVuyVQEz{0{*^Kl9Z8rbQ|u zX8e--8z%KZ|K3#`wO7{wc3*eEA8m^@t<&_Jz#QKF4-2@%kpt+bWm#uQ)!CNU zUToV#MA61fg;Q4Ft=Z6E0!-#j5;*yPP`Yz$>+4 zo4c!alyH*Gw&js3B(g6n;=+o)0reVl0Zo%eus6?AXb5KW4%ft#icX3eereI=w%#*1 zq4DFvRLV}CfgeDAJ}wlg=90NRxfR4uY%EEwoc!;uRSWg1qE)?VV00X(c2GU|y~xj| zr@{8*Sgp`V42DxnW^tJRnG6Z(lEH|m4vHZ+f;76)O=!G!I#;~$ZhDI^>ifSw%nv`w zYTV&q`#T@5`el(sK`-!IWgOWjw?zHp42h!pKN75BcwEcLw*@7lC|c0zAzth?kvXOJ zemGi;>eT)x!JS(rw5QtUJ!Fxs1c6w^Q_S`DhhWgt^Y3Mh8~&aOko-!u81nHt`EO%U zMVV5@E0^hk#kOCle{w#3$3CP-L@87Q75Y_EU^`Yu>U{Fn*Qt&QCrbeuz?^zA)h70_Lq)V83Qaz}pz8#o9I#vJZs0H0@P5h9v=e=XKAK39pyMd$@j?5E*40K2 z?<-U<{dWj7tMTHAW3Z+18@dsEVqnd`bZJ&g6#!b-rsc`5*y-j&JW}8iO0VGc#Z0H0 zv(AghAaf@b=FD>e&l~ zp(i@&?5_xkLzu>PYSb)6!YZm(f=4)A6Nay#S48DwD0%ySo;OyGyas;uLp>Vg(8X3bg<2^PF?8_x-k4Hkr&!?qq&RCNs;uyYGnI;qZR@ za%Mje$bH^X{X^q7uNhspX~3FHJJ6ber5;szO0Xv5uqdA^4=C2(&L&7XMrHE?Aribl z8J;#1Gz2`kTz(=>tknQF92`_k{MFaQ?3F5p%gd{_OWIYvEIu2D%Q}V z@xvL6ZV!xR3m`WfVDdJf&1kD-{3xuXZ(>tbTip0sNhmue4~Wg#$gTzlIL~B~MI67` zGWZbd|NNzkVvbE!X>lWB_e~C z_c8M#ef*9&>;Cv}{9rxuk236$34?$Z-BzGr(5Y!{j7Vb1IltG!Iy#?*`C1oM zpO+mSgldeiijdc&;`4MF3JLmqZe&_g(`;xKAOO@`36+AwLN{+CH8X_$t+~ueowh`D z=y|~%e(l+aa@=OQGzQ;_mFyqCnI4(y`s}C{ciGYKm zBn?dB_5eaNItbYq;WB#}n_(Rsv!izfHi_e^HE+8r!A-JNpm9quOYya3fUrHTfahq?Of7h zn*;+5i;wfDq~CDf)hQ=(IbdU!oOmls*+L&Np=3+WqoOjqUXz?spt?ft9choTx;z9bgn$lO}o>{*;%U?f} zNtsmv-dlW&`}u$axGgxEPt6*Z!049x7IdBxX4DmJ8ybIxW8-t(L36!hwUjCI`_U_% zBu2kIoD3FptK1NsfWKl)m-d}9>{yGUJk#_$7MG)H?N^`$HmD!?BvIo8voUYunAy_N zlP>H0S5s^c36O`ixzC%r+slZu_m{=u7AGE6-X341Mn@|=SFqrv*(|3-y|x+g&=-$L zC&XM3yH*Dgn;dxeLxqjK{(v;!nFs94dm8CBAh~_>GvbnV3k1M8Q_YuFjJKs0x6uRt9=@LcP08HsCUWq?H|4JskNXh>zYYVAOK3Y(8C{X}k_s6P%PUc_z@1$$gO zU+8KH3gHQyA2vMXo&iULs?;KNNN=sH{JG}6B5fzwpUbUga(K!Y&)RU?d<(b7o>+XUo zTt_1C>7v~A@jUt055OT;v+4;Xw-C|VkIjB6Bcght=8A@8Wz==kbYgsH{8I}Jn)4VQ zMdrRSxIWd^i`=Sx*bw+?&D4{rIj$ICBpht~A#5o*iO~BJ=^`aon5Lkth#o8DGVf2v zcA<}21RoC&Ey`hD<)*F;*;^(V3~NQ~Py4>J!$ybclh3gm6f18p;u!P_`KxAM0gf&* zbT0GF#nWO?Z@p&=OK9=kiYxb?ti6K?N5)7(sVU{gxFjRwi?%FBM-^LP*yFj_sT#i) zMQw?Fzc09<(a0Z_9TxsEju9!8a*n_Yr;7ovuc`-|!AEO@yo$BIWsOWiM^vVobp-x= z-z?Ig74z%hnb=kh$l|*nZKo;Q683rd3~Ok%-<|)R?59FIcFLA{33gtSo;Jm1t8Sfq zkHI?5I!BHG;ehCA5=#@Vp-jx`3D09olv5{SJKrovm<~)CxtKb&S)`qcab(0qLZ=-8 zc~KhGgw>7QgxIdV=#_+yt%{c#YM4#Wuvi-yd7ctGOgn_?Q_ZqVx`tx^7ImB$b&*_H z`9^-|^gzw(Y8Ez0#CpBd8^2{yI|ybj`*@Or4|<_K+H{maWLKtXenQ zN44oXxyHV5rtgc7Es>W=^|MK_XE6AFc?9n=kwxUMFju{CZNHhAL~_9F?%Ajkz^#(2 zl*iKEIPMW?{Zgy0HYgJUcsIZ?1MB9ALb1*sZPF9&WpVp~1y=sXErGH1yJR?-f8=Ws z=hsg$XB>@5EXIZDZ>akw7SDjJ^2S95ZF}Y38qm{ODmSbWt<*OrZAe0Am4?wY(nfVA$ z^+t?f9e`_YABR54r;<2;3ckj?Sf`R?889`eo}tA-!<8_fs;u_Kq_f1W!qgkD3w-?q zcPApiANmMRgXV@L`?)wZtZ+oZhil%-AhYpy9hPq8jYC);*_vpMk$H&P)P!zR>mR{e zT&#)m)M!b((S!tSkpMABpe$KNLf`W(j)0_C0h5Ji8{_&{K*wrU0ogaMpO~9Nd8z^^ zS66MnXysDzijI>ooRMjWQt$H?62qCSyL3jl{b3zryC*7#9yca9hhhDA-W1cw>AiDrmEM($wMT9vNQ9=ExFN9PWAVbA7EIKJ3CYBVniD4~G75O!uFJP=Y+3&1I$cej>g zGDCKxrwKDdb94&FyBbfu==Y>e%eriB1`+7!kKF;E_my1hEX&PMnJ39a;yzbA)Yvj8ipKr4$l*a(K*HC3uYM+& z;GTqD#oTF<;P3+yWCc-?uQU1<{$g*~2f~ zkxjXV@z08^HTK=kiyu+$@z#;*hQF=r)K)$Es&D*<<7J(F@L71N&y2U8i6S-krH?>c zl#(gb4#vA8!FW_n|0Jqcb-9$0wLr3*il9btz9jg4tBEQkwBhN6Gy&cEdCxHw(L@cYh}B$Ye39Hp^de1VQx>BlBkQ$HL9o| z^oF&0t;UHfHR#cojffrU>~3tY9HVW|s?IP{GonQLt`1XDtE7eO2~GT>lt!Gt(Su7o zE1_O*-qvTQ3+K1evwcIifaL)>j_4d@i*!H?6?&a(mn>5N;J0PmF`^#uq*&yJ1vQ5_ zhu1Ebm}ErTGn`kCWuvy2#p6hGN9{DIu&3#w8UOQOB5+hZ8fZXgyn{AG)H@RcsV;7} zacK9Q%;y>hKM3UCYs%1J>lAv7G}LJecBxZf1BrF>mcRK*m8Ph-1X<0a#0-bv&+_-*5oCv;WaVhv#F=R(k|h340MNqhb1Wsz>q+IB&E*spG^@1`f`C^@Pj7XMzK5h$eN zlQlAeT4xkv-IYA_?kp?Tu}AGxD$8YiMVDN&IzqM;Pg~Q-obfcz&~_o2$u?00 zaZhHx2MX9+3dK7GHBvBGn4G*SbxTyQ``~p`4>h6`hmtQizBN23wwsX z7wABp6Xzs;ATe`dgb}B(B^8ETTct_dRtF&N7_hEBx5OBmlc0VV^KP6pxwurhyPRG{ z`!sN&1r<=L$y2>O&n4cjw`N&}mk?ns>p>NUvllCPEc?^#H)>rFiy)K?0+bBoS#blD zf#?zS?T7G!$(f~WPg2{aI%|7h#;*9nKf2lwdVc|oZzu?Oz|=)#xHs!MHrowuUthy5}Y9B0R=j=@%2rkcaMf2NJ#pxtdyjX}V(n{8yqu#;%31 za+}zsqMqMbu|GvM4x@6(5O&QlQ2y}u3^@}5y^%{7n4nC>TR_hykQ}1?MxBLI@xRb9 zJ}}gKo)+oEfo+vOLk9%FrK?J3>a{XZ}mv zPX*5TM77Up!JZ49_V=vHLHW@Th)nb0jJ7?&ZDFPEH7mPZRT4Ri!dj5hOh?7? zvL%~pkPQR^#Dks^Og&o=)D9E;7$8a93Q{^VRTSdmib}(biyF%^PB^*v~v!MIV(-5#Mo-dxvi?mfqQ6SkT7? zDv7Plwu@3hAIRac6nG9-I`)ZN1kia8GW)RN6n4te9l5Q%Mw;i?$)W|#2=nVKiM3{% z$Ro2b*&n;Fw|E!3jHkoyAt=>7>S6j>6CT*2R(g!+H!p@+jCs&kgoCS@w~+MQ&6uky z3Y0D@q9O$L2~(TonHiF1_t`VId7wcC)O=d)F!XC22ZUj7{BOe_C+6PU6Kq0RqVIWh zvRqyfBxZG_yRTlXk@OO0-0K3DQ(W~Fb78n{%?)p|%3hUs?6Oq6Uxz8pzp>J^n<>9+ zMVzfmv3&m}3c{E%BN%OX0%&m6-nLur5c4+gL8X;?`<%V_>3*=+n%l2_CA0G0-xj~s<{<%>;=O`GGcoHI0w(Z?`M1^ zNUoZb=m|8+~o^*&(%VEPg!o<1r+7_8MWlqY)0ms0TfHlJL ziplEIin##8N|NfVFHDwb7=cJQ-3G))G9+nE*T1*ziuWMiL#pve)3WpqPo#%LbpdN_ zmAVC;0Jr49X?tYNjB?nCRyoQBcbo*50IiH>20>3NOp?uF5B?U{{fgc@NNwvtHMaPg zXW$ns09o}*OcC^sfSOJ5fHST6-6bhjS#kQ^q$(|(y_DDKTYaX)R^xr+JVXD5hx`0D zvNsPKH2eF=J(Rc6kPQ^q89#}YTjkJe{O}1ZJgsm0)Pyo~&jq?N#L4uTEYb|hh_w0d zq+Q2zC(1qqFai)1OU?s-2&LOKWAD;?rDT)IZc{{k*v)%JH4q_-R*YYR{9K^zS>o%gwzqM}{$Y~p~&H^+^a)10ubtv|7!o>v0 zhoqGnAaKhgM1|Wy&_C|$u+POQUK@GD`U(2rwGM#Bdj-X~j{+7zUwrqu-|SJEArPz- z`y_><%7jZA{z%cS0-^F(Jk(JLDWQnL0+8?>6--mSDkH z1E#*VTs}P0n)`Pr63JmQfqr;tL~ke!g#Y*pZ#<`ev28z7VOYs7?K&T=f`9dCnxNF9 z5)QW_>l&I2t=Wky6l7T2sjJ9*PXQ>6*jxnM9y9AAu54;dtbf)NC58B=v-pz1#j+!m zs^rOEYLeh=+Z#y<{I~!#fsQ&Cr+sNdBV&RaaY&3Sm$uCou(A!{fSRhI+dO{QG0M|& zve2=O#LbI{YRH4vTzq|LDUu=5AIvu=V_qP5bvIv#&A4HZtt-D3cq_RJDGC0sWE*i$s z^T<_;)<{OyFi`wa-f)i=Z#*wjv0*JN==SwUZ+`t4iFK@`5IYJh!K?@ zhSAZX3fz-nC>YNz-OpyKHsHk&1Lirm3IQhPBE#pRDXj zpuUrIEwWW4DrJTuCavS&N%*h0&`Fr!6A<6b=R}KcewxNey~TRWLJV(?70HK2#32Yo z{kbh@ox9LOrg2)lV!t_8&u;5wKk(~%l<_hp_LZhr@}`gc;y*%j2EgKp)tO7bVvFZFHE) zMRKthXE%6uHO7rn&!n+uaos-TE$~x8xl!>N6ct@%`RUT)9WXZzLt0?t(B?lW`QEUl zKPt}(BK%H|&UsYUphEopzt4^T_eZGUghO!YAMH=rK?>JPFVcT1lc;~in~9o;K68Ew zwUfXt_(bFQPhpIi*Z>$>Sm!#3)5bSA7gBQ&BTnP%_;2f1DV&uTY3eFy>o7C%;L~R= z@XH)B0@xVs+Vt$P6q=LCKW2Au@kZtk_ThgT4^U5>w?^64b(07iZ(+WQH?6#4{nJyB zStApJxGFT;%#)<)d;OQ}^@IH%VFSOXAG!GI$9H6IfJ_HLQ<)QWrshz`jRQ+2w^+Jl+~Pd~;2hsLQSelMIEV@Qc=}RdKR`=@p#&uhB9PYs3pn+u3o?z2 zIiAXgB@QuFVd#%7^{^9WJFM#0eU1{M;6Nvr!x;~#lPB=3_Ppm^x*6%2jBN;NAJ4UhTl; z4Am^`99?CU2?wt}QIf^@0^dq%QAz|-kJIG28qBfP^{AlLCJo?v37a0^uxV@3UB|M7 z&g-6D!vfL|EIbtJOY-2klXi^7nWexlZmb6+v$-Y0!H+8mmWvl^^DAZS*#ub;{kWS` z0|~L)W`u~px#)_m&5h)utErK1^WARpC9eiNlQzzk)f3?Zw2^Q`7~YSEVTPSp6&$RC znpOn4vI+De`*8yu4^#snxuWPn=JFSqqnpNmnyC5xv){weWBbkaWAdeRnR!4_GbBaM zS%N-GPgxDc+Ri$c(J^{aCwKTNoLS>lH1q)~>6QHTen>s+D2EJL80SIGqOSjjp~n0G1cA~a&4vbQOl>c8)wvF;;=fhiI?fwbb{7Z_ z0O2?cSPs231(~;$)_wMhX#7}5#uSWZLnwSRd@gAp{Yy`MTo&Lld4!{LelE^1Dc#(# zYAjGIW8o0Ar9_&Fx{9RzJKwy2ri)FokT(if2lh-}APJVYUsJ_2=MQ3qRx}5Gqe{UP?q6Z2earJ|PG6vgn~iZe3NiP}BA(rfSt~Lx zjV4*n7HlpqY*yDANrcKU;*L*3y$~z9~M{g6~&k>JQp3Q%wZ~eBhVspZc?V2G2ycT!HK{ zfI(UVwDRLPb@);A(=!cIEhbdk^bGh?V#J$@2`CoINhK3v`;(}L<5iC1pL8!1LtStK zpxsw+Id}jzRSi*g$kN)jKF!qI&YV-b^4M?vI(x7d-!tt6Mu>BYXGU*US{OMX8PQ*{jk-qxrG4r38aqhE+DdG=8LT)Un{SB)EH&LdtG5f@+@ zzi&K2)I%~yBzwiiU#EpT=I$>J0TvyNf%Q?W5!e-ey(b7po-z(%h^X>Y{bS_bk$-Ya z#Ni)BXo!kdZcp`frCXHlkaOe%mq%_${{=1a_GZ}1TxJ#Y$jiSs;Na9Fe?@7zCEjR6 zWAf;?Zf{nl!3u|IjPj-O%8NgHq zr}&rjHn+j#Xr_C^j@gGs_sQ9yKB5c`{Onf+hT;z&nd*MTkV|I=0;NVk?qHXGn;)jx zE-p{}y%&avv^!Nic)Y~f&i=Vj+liH*m^zbK((zi%=={nxS{ zu!Y2c{_gYtV|XjL0Yj=&!6wvZjA2C=YX>gU*?O5e6TZZVhk4M%YP9|P^{wO5U)*5d zEcxoQpZEC_a8V^n&nTercd}}3)`glDY^HeeD0oDl!aCbn(cL2_S!n?d1unQrQDik@ zAU=z~{XN76()MPtc$59H_+bTKMg(%c;1jd$5_4Lz?G=l1A-F?tjDklf(!Z+7uXyt37hnqu6}H>-Z6!JrI*KB;J$a_pKC{zpyMGv?4n35{e|8+bWc# z1AzdPBr=~@yaXrlAHf$nr#r8%Pws%6I|^7u81UK$G+^3fr9ghXOFry13t~U*81Y zN|hvugzS$2U*T1(Nz0Ax(rJr(enhkG6^-if8P_8j0Jv`3D18M&^XHc3j=fc>zZ}n40$DC zZN*x)0jNT%vJscr<1l>t$7$T{5qbT*8Vm`rWMADNW?>_N5{r1QlCFk|KVh6LazXne zOJ40v4a^MFLV{oF zhv4@F${z5OVpR;L9}kYltU3V+B;^LJv`yE|$(Tcz=`AJ3E`alWG;tD&v^r7Eb5x=^ z%>#++xCZF}7KO*r1eaGedJHZCUv+%@6Tq<7#!~D~60GjFdv-v1hqIRvO6t@6v!SF= zwr0Ks7A2wO;VE8XHnHgYRuoMw&CJKRvfIRQ8%|x^ncFCBdyzx$>^RDlH}x~LFPhjs zHSQqqoSxN1ljKytJX-BVQL_rq^B4nA-z7a=15ZJJh3u0r7eXxXWa6%g#uZ7LDl80T zwzG5Xzq~X5mv{aROwzCw$alpiZuUd!gXu1ok)<%1?SiOM9b-X)VZV-)drk8?+h=V$ zydjZOnqd~$m=Mlnp=UB>4mJ8t1o^dRCvoQ^ea!Xff@ncxwzw|>WcmG?a)Oh@%9WQX z8(XwCrO_#QKQ0)E;M^t@53OjDahGZ)419a*IV_0a=?Zlu-pj-uXsCQYbRoFKiNz0> z&Cb*wW5WH*^NeI926XJW!R?xrMqsYch`s`{0VT7K4p)mlK=cv839<3~8=dHS_?SK+ zbeZ=(Zp@LLPk@8c;Z^ndva{+^z_t`Nt~#n+2v&c%wyBYLt^Zm59&lRX67 zRHpMJFXAXSYr|nWk)#>Av&D8L#e1cr1e2AQ;VY{$qv%D<303S_45h^v6~f#J9RNDX zUj{d;J>z_NaD?50H1ee0u?luH5Pis~b-A#>P*=y~QIncd8cn7p8JD`ciHa`E|YPFj}q73bVc z?$d2z6?5GY`Wi0Ub?-ULt-+A%EtC6bz9#G*;@GQFf)|p2O7v^O#AtqJ*Gm?VgHv6& z0U`iTlTV{Qk$d^hg|(}tP*eu&vE&XXNFqw;n9rwQdGH`&hJoJw$TG4RCZi<;`WK;K zn9EE79KUL=a85|7fphyPl_*a4 zZbm2-$YH;0gNkP$8_oG+5{OD&rXYea>WEy;;9s=4QMCuGZt)^=K^4C{BkW$jpS$tx-VJ&C25%ss^&wuqZ)vj=t?Oi#w0ZtOwHj;x-T8sX7 z66EFOWaJdK|D&fdKYVkaS9N{RkuUXN9D;XHCY-!*XE38mG@c|1p7Hify@CR3*SX0K zO!3h;G*}{TD6?Dq8oXk0+x`g?t%qNHlCGPlP-rQ8{WTA7TTral9cBm+oSKH_!mN_c zsWaDNL5$wbTgmZp+}~hyN)G|c;lo9p@`aPig_9_2=wOU(c(Vyn=vv&WzI1CVYuH*= z&YG_-T$HL1t{}Wk7p^5LrtKTJRu1mgn`#&fi++qyQWt1do>tb6%)&g-LWEnAK6V&r zO#;59zlcgDEG#yEM#lf+!_Txl`F68l2t%NbqjarK*{Op8NUrfhU7*hyg9f6@*^6#x h;LU#%JJ~U6br9QV^nLQLXY~Ic-tpfO1#>-w{{vdCLm>bF literal 0 HcmV?d00001 diff --git a/midpoint/methodology/first-steps/ldap-correlation-simulation-result-operational-statistics.webp b/midpoint/methodology/first-steps/ldap-correlation-simulation-result-operational-statistics.webp new file mode 100644 index 0000000000000000000000000000000000000000..73479990dc7719e88deb328908c2a2d96dedb259 GIT binary patch literal 9868 zcmaKRbyytTl6T{Q010kGfZ&ke5Hz^EyASSz1$PJNZ2rmEtHnvU>C2=8A4NWalqyqo}z=sYdfXL9;(OytNLFO;_|9;%e0Wg1Ora%7G z^}qA{M=BcF#L*Z4U`U}H0><_bCnz?6Vh&d)`@i@*6k{8k8-k&@42nNMpbLcJg}-#8 zf8pc5*z6ztk5SkV6(wP)ZP-vcsoDR)M*jmFn?r1%JZw-N3b2hWR6nf7zcBbO_WX-& ztev52`{(#;A*zY3sxtIU0UaPf9FPQL0R^aAjR0rB0 zKk^DtDI=(q1z-%75CQA}8^G`%dEjphpghpy-@bJ;Wo7w?1cNFB00?U@FISWRfD{J+ z&(SY0kJ&FT&p7}9w*mlNw*Qv5%K`w-YbZVX-!zI$0C*D!01bWrrWqvxKw}61;4j)6 zLJa@84jl9s*3=XLE(-wwO%njHCIA3M`(J*8&i$PSa_0d+1?nrAp8$}Y0svHIP~AHJ z!R}X3f&cc~|H<=T{)1+&Ob0mtFowg)0ICPcFE8ygQtn~39_0h$Rr8NO%81XzP0O9y z=V!H?=A+uzJQ&ej>sr?I(Q4=Q2T~oqU)Jw$xe6aw)a+#E*&hNAkw{ByQAXw*gkX(I z&<*J|I+sJatuTWklyUs9V+H1vIOPH<;&UAGC|*J)5A8w4a#;}$D5+!a#8!TJr30bX zY23y->NX+*X4)#WRHP?#VG*TBzTA5SD$W=swa!Xr6jG|!Aqtnl-IFr2xi6`V(y|SCh&JZf3*6fs?0?Xzc=b{(AH{^Yv9hN29Bu8!ZBm?Hzp*;s^ zgkBB2nNogUif}L_kQJgIwGiO1tAY!^YyOS4O=J=rZ zFy|u~O~Dnr8I)3MQqE(xry#8u;@*ZeCSU#Zyyx*dic{AIDNSGdprzu$t8aPZavkw@ zjqL9vdv1(3x0#(UYYBQp`i$L!0Y11FG%JkPdSO1bBRULm z8A+{LM%7-LeXA9aC4{<1bi0j~E6XQ!hxHpX_tw1z)te;_wad^?)>I4AnSFUx#m}1-jj`OP_pW1aqtipTvy|W)N+g1Y zi5Gx7L3b!to7^_bT-5;{ZC{lou;%pTk*63QF?h3j{0>q!O&C=#!5)WUd$EEm2&!;Jg_bJg0& zpIyh`$1EC+D2N;Wl{$-e;f?X)tW$G+R-(V?q3N}D=go%@d7(|D_FR8JZ+=sNwC|6U z{)01SZ{m|X+U-CB!-wMH=0>acYWh{nG6JenhhfMmp>vhhd}s{W*B_ykMJRTLmHiiG zvr`@tGROCvd@G3I6gDtUeFi~*3v%na`6z*9m1L=AP$u+C4vRiOf6v^Pn)pk=jDdjL z&(L28uW?t-hT1IBk?LlBEnD^rrfUHJ*|h`w05h4JW^c^opN=F0k z%9$nAPJ)laEuZ~nbz`9B(5bCgrWuG7N|XiOB#Kv|iW70^=K5obGa_+(kMK5z!&Zka zdn$eV!osd-pk5*A)YhK+xJDhJXv6G)K`ibfRwk!xl|&|KI@-NNTkIP8XjY!Qj?vUB z5-Ykn&r4~`1=G29?-gRquPmHwp5hV-cG~ogoRE2#b+Tb)Ic9B~GsHnS;H$p3Q;SZQbDDY1xYLJPHw4N=@Xi9vS}i#HyDe21Nbp zZ>Kz7=?GHXdstF{X-@p4EwF!p?z(cHHpbtTcw)TAivj;M(BWWCPL}#E8jGq~bf-AN zi6KWm>?aT=Xx4w9<&V(NiWKWP$zP#)P!|DTV8VdiCK+iX$%0dPqBNoBp!<@d(p1rd zQ%NUNA^H1(A=15I>j5W-`<IpRV+*i$x_{+@pCeyBKC%nLT>gai@)B#Gfg%)J)twYmgQeB zTq8gb*uaux`4M`GD19!D^G31T6yMSwo?%M?43W(tQuROV5>muja8^EIC3BK)6M#q} zdYPW-ajM1J_CEMoiXV{q~4OiV_| z#1^jp=L7iouXrsq=;4wX$aN@FCZp}Tl4TtSduyT~PPk2B4@PjTW{jIAeYfn^iqFA;>(euA-Pe~2yUSQ8#-QP)P{M5tjDAr|`z8 z2}|uB+^VARNT0iXw;Av&uLO?e*b6ptM{Q%(Jv}LG6%{X54*qo!;wm@*Z;R%)Qp-i+r@F{)tfZ6TqsxAMGVmQ~g#U*up z_f4-@%`<(qa%Oewa_~H<3ew*{m>!E1hiWv&@L(veW9NhrYF^a>LKhWp;|tVo zbpJ@Cy6UsQI0AI=kTNLP4)4V8``c@(_rvkjIc;K$TS7caB8khVa$ic$<}*Y|=pNqZ zsl)b&rs+kchCCOKI4F3=Oe{%%;eZqp&dxCnye?U~n8ubBWY2wi7QN75NMe?~*txN$ z0Oc*wp5V|QQLti8=BPVX2T~x(W912yGCl!HEe4do5+7-{(XjnL4sNiZ&xQ{|lp6*_ zy2XosUu=ec6D0ausi1|o(tT3mjE}cut?kXk`3JfVq)q~FE#it30qLc0WW^bWdYJp& zH7%&^2QviAM~4Tx_PjV5L1fOuXa(e?+-S@J3oR_sI)?PV`k7;3wIGdN(h{7DoqT7Z zA-`^O(knLsM?ParO+=@(naxaRA}aIBja5v|t18}CJt&i8DvU8hK9o2xjcM;Swv-6{ zUC8MInpmT7r$5s=a2uW@DrNI9h1B$=aiqoe1mLw#R}hQclAq|J6&NT-mY4_T54 zDpXi0@Lzf`s&ZoJh-9SwFdU7dz4MGDch@RHHN1L173=br%`BczkPhE&Bj)0%zAw$x zjrzeu;!0q~-5wn0?O2;{rB&LD@!KC=K@Eq+zPt{Uw8Fq{l>PNePt&4}RexiiGupY&NiR)QKmF>s)j!mX_1YVDmz zZpgafcxl3Z;+E_FmnXXiw6KZZIh%8(CrR%>e;wqno^}ryOJoDJ;EeUnO5$H<{5~)D zkK^k;XO{UMzn*qS>@K?2eg6Epy3KqcUzuz!{H_s5=mj)hR}EEw(pzS4rA*g^jN`XP z9ZuU~BR+*0B|0`#{xELAPW&TvR!G?Z9HwXl&KA1~Iq6L!CisauNA|(crA4qXQ&~-T z-8PIdIDVA8{==AWm}`hLTn2q5`Nj0DcA~E_A0O~7r|hiuY5X2QW2h5YA1VP0fZY{I z+ck(HneXY?1e5XOa9({t0MZWGxAL8)Rn9u!Vi>XD7B-_^qjO$;eK32xud)6DL+qaT z+n*ykvRYMh&!h+8of0SuWSs#Yd&%5Iq_~hhDiuVGTE`RCD5^(;#RJE*;OmJX ztMO5I0K|Kf+whZtlPe}NQ1z?d3Pfx7I5SzoL~pmzJF>@5vz234kT8l|U$cLHn4|0y zBV;#`AVP}x>>$08Q`!2W?0nlalUi16!3Pfz2;Br8? zK|`0lVVz}|7MOqqq=}S*ErcAe@URxL=dBQOFWxHOoqET83>`KdCcJZVjU4GqmR1#t zV=~WKKHLyTYl<8&Q3gW1Sj95F`GjvSjv1XbA|^^qM>qw+q@Ji~j7CZ>rzZU^A|#xO zKr%L7#1@$s4W^uDOGFf#irD|p4*SUwe5?W?+>L72WCvmOmybylKJai0_(j4fQVyu| z63oFUSVtk-*|>vh^Vcrs76*7{u*lVo$wNp15-VpPW{!=~!WI$n%NhGiOUOcBTbw6{ zlK67oz|2VrbKw{Dl>ZuK;f$S^c}xA?gQLfAyKrW2SVI&yD}rq*_X0NKRh|UYoIW*y zQP$QtdWEdYuBdqHFCD>F6z+T>epfSn1a~g|$q(;D- zu|EZoe$6T=#67I=S) z@L67CT++OB23|CK`+RoQfKk=&aPXtc!Ja{v-wq;1Ys#s9sN?=64VGIdj^c)6d zcMyi;I^rkS6OzcA8e`L_$^uoqLUbVV=9cgRJN&`TALYNI+|>ky&;!oNpU)BN~>$!?FIAw{)ORiNde`POj< zku)PxG0UmIZ@7<}lp$~=j*?PR3A0%go%0oqwcY!$hb|NhyU((SCBtdOY`{eap%*(y z%kH-V1!^MwKryXf9<8B(RN$n5LCeneCkqASZ4g}f=j-4YhYBVFKEUyC&!^2Iz;Cz5 zkCyTs8z~otwqx`pDt0PwRa$^cTIy^IPD}JveZhC(M5Zmz;SNA_og(kqk$5Wyc#jb|tUuW5-c^V&1VfP*I$8-V=_&L&`NWFID^A z6uMJ(01Mc24>KaUL~la6;?BuiBn?@k6~ca_Q7H@g8#2<-9aivaf)LHpic=*tHls=^ z5;oxw3ysxHuzUTCIN<7%Hi?>yV+#YfSfVbdVii0kn^xm{rcBRdvCu_0fC%P%@9ATz z7gT*YZah4V{^mZOm}sZJJ|ag|+X3CHdww#+5wcyR{EX{Uk=XeHZK_b4=fa5aX;I-4 z%h2{JIi~ES{rv2!-LE&A%`BE&%T-SNtr~<^!Ka;BU6ra8G^;qDud=#JLTq{;+%k7k z4EVlxGuEshjgA`CG&j=Z%cgNdGO$vg4{TWz%%*epV)OFCZ4uS%$gXH6Hd(T+40CGM zN#Bk%L7=-a3U-PZT}+!hz=_jgppHI<408k8%!AC&Cz8v=Z;?qO>pjpU_0${`s>8n4 z1TUT}X=L)ZxVrR4*?msC%*YQzFPkq3I(dL^8Eh#?e@k_el2U87eC5#pIe1>~Vr_i1 zLo8=hY%wvBD3Zj%S&ur|A|t9Y(XPnqNtWkmLGhMspr?g3fM?)_6L?b~^5=u;ptQR0ff0^AAZbvc$lb zUjg{p>}~gXf30#ULDJqWPzUWE+*v{+!D1J_jA5RaUeZ+9XM<7oX%j;6X8zlF03Q+J zNc3T$Abp@FFFtk-=^Ob3Lb#K!N^D8T{ip}{L2?79Es&G3;l+haCm7w}EP=$aTY#Bx zRB(z#>=-EH+?X?U1rbhm(3f_}T{gS&rNxI#_p2U~Ftd`Ya*Ev|mJ<%fDtdoKY{-$`zK@g!k5hEu@9`|+!c2px08!rRz*)Z=Om`no6r`MVFr%KlxI#qE zTe_1TAH?$ZZUQH(1-aOMM2Dj-@rsd{1L5ia%xg-b9=WT9f~TI(2Rmc}X!-{L0C*-cwjN z*%=cgsN^QUjt&SA5BEAFYQob4+CZmxa>s)iy1?vm^AMv@ z>>FX1#BMcSVsmmyYC!n<0C|`1yPwgB+@17Aj3u8?<80LT0G+W2kv(X4MnzbVY(h~7 zfd|Olj6Kp!^_Dn-fAp-DwqWD!j(*#C1ox%l_39EO2}5tLuhJbw-XhKN)E~Cswwjbk z=D%A80nND(7uMYB?G(0oU^(`!iVyzrNiZl|`dtM(&`JyqGcEX49sc)zbOEhA{{{HF z7FH&2>664bFr%r2_?j8yx2&*$ap^g>IZ>_rgCns^Jy|QI%>F3b)FHRE+%SqT96VpL^=dLM}5b zZ(hrNHgce$d^4}*aI?jaMGU5{kxy#7T#`=}-8aqO8c%z##0H}`Ny+8jH7I>!6y-!{ zjJ^0eR|v;6=ndD0o}$~5@AXqD@p)Jdqiph~+KwwRHLI05a8-FE=joNfZi2f$r>g}| zvq-NfBy*3(>Uu6cHq=Ts8;9&J_ALK-LHhIO@wsu8=OUH9Q`9^BUoCOyt>r8P)4_YD zj&IxNovdORag~HAIE4^>v@X7m#qdl0tS;@i@lf`U9U?}>YeZ^XHzM5_BQV{=9c;qn zvRXaEriop%|F&fF@Q+$QFKaE^jIW}&@^}b1too!cwxrt%iyW@o zQok+r4jM-MnSAY4c)b8$rceFB=TA;?|!c0Z+HlE>mXKQ+E-s*yU(v!bICM zs=*tE$j2hb{c-`%MT_UgcYPnh0pR9{GT zny}kHG?$`g974aVh*q6@uE2nUIE%#|`CTy>RqX0-8N#)C2sw{9cP(h8E+donACD^> zuPk1?r^2T0c@-ZWN!+Jtr&75?yltpU_wJj@5w46ZmGx`X4$*mAeZ%%`D&{<*DrsNM zSZWkL*hiO74(4P$sl>jlnK)ObrVxvEuOw}neIc387)F8Y@>0U_NyU2aw)c;o8BA>l9?VlO*ARwOxYECrThW%5MJNr;;m+Bi02 zKL}n@G)8cUX-I^qhLJZIvS#{FWUn=oCMedv9G1k_TDD9x{Ao>RISpL%W9y=+gn8Ga ztvVkunTOCg8KfMSmTnNS_W35a$0Gb=na7g!MUZk$x>tU}5<)ik^~$xz41qGLTAxPp zWM-p!ue;c|)azxit5)D=|mOMmbZo5|!lIf~EqC(v)*pTXU zlcSKKa#j)U_pCZgxo-PbQh9QDg}W`TJ8N4-t2p4T1iFaqj}B+#Ei~NmtXb8`UBvY` zzM;cRWBWN1P;9Gtf-m0e&`|kXN6SlzZu_QT)E|rG7VybCTod79kV?w!?Jtvkc=!}< zt_~j&_f$c=7~y%7%Nn}G6md6HaJ}+bvvX6q!!fz$ihe1n5sVFVh4?35V4JNT3DfZ`3{3`N4bv8E&o@g+G9QygRS!l zRIS~J3E zF=7kDa&^~qi`J+J>#qNUZ;Ge#aKAq3Yy68(Fs@r%55N z6K!@}T5GNMQJbIE^)t-kzb?zzHu9{8yrrH`r4ui?-WiLQMt@sIC>+b-6s!}wA$HP# z@6f)E+RW_A_akkm{@xg}{Lc2R(^q;@Nk$mo0huz~bT5}T13m&JOwZ*9F_t!GsLdQp zUpd4+uc9`q71Oaqv~8d^|3tTBruG~k$qJqee(=>J(c<$$a6E2@ticr8t^d9cn72YT znv=v$55&eHpIurbfY{WvU8b0M!mSpjlFif2%4y)%?i5ZCjYS_(&D%^#j1|3AE~4zu zdp4-~j2KI?wIw-_P>f$Zw>uVXRqCZHGKR~nzc>9e+A2XS69ZqVVD=`Fb-SjFcDV3V zObv0}(Pet}ZuzUJxU}6ArDVTEeS>qb4p9`v%Pmu;ZLkh~UXe@x8aP-d!Nq7^wX~J~ z8b(z_|C11dGL)4A%Bp>awq^g9^T_!LuwxOfuykxa*iNYs+%O*ExckEO*NBzBMr5GJ zZh80pV?#nTY9!BS>S%Q760|>B2(R`v4sDFE1-S@sve-gu7O_?8`@7;fR~})8+am&! z^;!g;x)RRa@wv5S7ic^uGWbG9PYH4c)6Z9sx0a%A-mz|%6n1J`bXgqDBergHj~mRt z`JTwjrU1E4`7b?KK-TNRQ;yGeGcI-6tlMfJz*lCBWP+=8@qK6iUf$#1CZl)E)3dnG zi`fwLlP=jjw9g20aZB>Nmq|9?ruJScq41rp=9~+a7(@OD*gB#w*aEWwnie%4?tb#Q zKf2ds6;j5jYrA%}CL{(Dp_%hXf}DWFF<8e+`A1;Dj4a#UiC3$Rurt*%{^@qF2nRGv zn;nQnI3U3*8_RuZ-&%jFxN2@FejGa3Do8k8PeA~5wu9%taSr-?6BMz&j1Y{MNhnPc zeRDA1f9S@Q%mzG0|GaIWwi%0QCX!ihF|ty+@F*yi85sEb@sHViZ60A;wYwOPQ0r~f z=9pBT0k;OmWNg=;fz}FS6|FQ7d2a539k6{by_ePPIUMTlif7AFGG|b1G2}&O<3N>& zTAPoNI<7O%RgQ+AwP5avHN-Kmb}?98Di_)YHERh2TZg|RZ_)Eetj=fM?pVG7Q5#;F z4&i(P1!7*VCMpyO_72ss#r_PYLsyHfKZdHMhnqLDyD+Mx#?lrDZo&;mB4-)0`yAW7BOujR`fQ=+7D(ba5 zRRjt%;V~Qf`ITj60!C4a!!lTBcAy|h6&5LR3$_(PEL|V^>j(@ z&g0G6$JL%u2dcJ=QCkNR!XaZRlC2DFvP9ITk|)0D1PWv2kv>1Pbh0Ei2ZLPGA=MZ5 zalJ`qVmbCNNGp0l&v-TNJRU2z``<^?dU%gg=g9q9EVdih?(#{7}A4ju`_7c}n`S0%5>Ya7mE{9l{ d?dO?Te!Vf78;xrB=;DE=jdw3*{ytHn{}1nUUeW*n literal 0 HcmV?d00001 From 8f8e52b55c3de1b46c240de9e751f798a54f9960 Mon Sep 17 00:00:00 2001 From: dklement Date: Wed, 28 May 2025 18:00:36 +0200 Subject: [PATCH 044/183] Cover reconciliation, LDAP usernames, multitude of other improvements - Added lifecycle states to sync reactions - Moved the Delete resource object sync rule to Draft - Added Create correlation case sync rule - Various improvement touches all over the place... - (like the motivational talk about why the iterative approach is the best) - Explained how to mark unmatched accounts - Added alternative way to validate simulation results (Check the Simulated Results Using Filters in the Account List) - Covered LDAP reconciliation - Covered reconciliation task stemming from the above - Explained importing usernames from LDAP - Started the intro to automation section NOTE: The whole article needs to be split into multiple shorter ones, eventually, but I'm keeping it as one for now. --- midpoint/methodology/first-steps/connect.adoc | 172 +++++++++++++++++- ...ap-accounts-disputed-after-simulation.webp | Bin 0 -> 28426 bytes ...-correlation-case-workitem-resolution.webp | Bin 0 -> 60140 bytes ...port-usename-simulation-focus-renamed.webp | Bin 0 -> 20780 bytes 4 files changed, 163 insertions(+), 9 deletions(-) create mode 100644 midpoint/methodology/first-steps/ldap-accounts-disputed-after-simulation.webp create mode 100644 midpoint/methodology/first-steps/ldap-hris-correlation-case-workitem-resolution.webp create mode 100644 midpoint/methodology/first-steps/ldap-import-usename-simulation-focus-renamed.webp diff --git a/midpoint/methodology/first-steps/connect.adoc b/midpoint/methodology/first-steps/connect.adoc index 9911e43a1..127613fa8 100644 --- a/midpoint/methodology/first-steps/connect.adoc +++ b/midpoint/methodology/first-steps/connect.adoc @@ -397,29 +397,43 @@ After you save your object type, you can preview the resource data to see what y Define the synchronization rules for the LDAP resource. Use the _Proposed_ lifecycle state to prevent any damage to real data before you validate the configuration. -[cols="2,1,1,4"] +[cols="2,1,1,1,4"] |==== -| Name | Situation | Reaction | Comments +| Name | Situation | Reaction | Lifecycle state | Comments | link-unlinked | Unlinked | Link -| There's a focus for the account but it's not linked to the shadow of the account yet, let's link it. This isn't used during the first import, but it's necessary for later when the account shadows are in midPoint already. +| Proposed +| There's a focus for the account but it's not linked to the shadow of the account yet, let's link it. + This isn't used during the first import, but it's necessary for later when the account shadows are in midPoint already. | synchronize-linked | Linked | Synchronize +| Proposed | Synchronize the data between the remote account and the focus based on mappings. | synchronize-deleted | Deleted | Synchronize +| Proposed | Restore "illegally" deleted accounts on the resource using the shadow in midPoint. | delete-unmatched-resource-object | Unmatched | Delete resource object -| Delete orphaned ("illegal") resource objects, i.e., those not present in HRIS and thus not having shadow in midPoint. Potentially destructive in case of misconfiguration. +| Draft +| Delete orphaned ("illegal") resource objects, i.e., those not present in HRIS and thus not having shadow in midPoint. + Potentially destructive in case of misconfiguration. + + Keep in _Draft_ (effectively disabled) until you learn later in the guide about options other than hard delete. + +| create-correlation-case-for-disputed +| Disputed +| Create correlation case +| Proposed +| In case a candidate owner isn't found with 100% certainty, create a correlation case to let a human operator resolve the situation. + You'll learn more a bit later. |==== @@ -552,7 +566,7 @@ To test your configuration, run a simulated reconciliation task on the developme run it and xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#read-simulation-results[inspect the simulation results] to see how your mapping and synchronization rules work. When reviewing the simulation results in icon:chart-line[] *Operational statistics*, you should get a result similar to the example below. -The actual numbers may, of course, differ based on what your systems contain, among other things. +The content of the table depends on the data in your systems as well as your actual configuration and marks applied. image::../ldap-correlation-simulation-result-operational-statistics.webp[title="Operational statistics of the simulated LDAP reconciliation task"] @@ -569,7 +583,8 @@ The numbers in the above image say the following: In case your target LDAP resource contains accounts that can't be correlated with the focal objects you have in midPoint from the source HR system, you can mark some of them to protect them from being prematurely deleted. -This is useful if you are not sure about the exact purpose of some service accounts, for example, or need to do some further investigation as to why they can't be correlated. +This is useful if you are not sure about the exact purpose of some service accounts, for example, +or need to further investigate as to why an account can't be correlated. Refer to xref:/midpoint/reference/concepts/mark/[] and xref:/midpoint/reference/concepts/mark/manual-marking/[] for details on object marks. @@ -577,10 +592,22 @@ Here's the marking strategy you can use: * If you know a certain account is valid and present in HR but can't be correlated due to some error in data, mark it as _Correlate later_. * If you need to preserve an account that's not in HR but is valid, such as service accounts, protect it using the _Protected_ mark. -* In case of accounts you're not sure about, mark them as _Do not touch_ so that they don't get deleted and you can investigate and decide their fate later. -* If you discover LDAP accounts that should not be there at all, like legacy or obviously malicious accounts, don't mark them at all. +* If you're not sure why an account unknown to HR exists, mark it as _Do not touch_ so that it does not get deleted and you can investigate and decide their fate later. +* If you discover LDAP accounts that should not be there at all, like legacy or obviously malicious accounts, don't mark them anyhow. They will get deleted as per the synchronization rules. +Be careful if your HR system doesn’t contain or export former employees data. +In such situation, you would not have the former employees in midPoint and their AD/LDAP accounts would appear as orphaned. + +[TIP] +==== +The point here is that you can move on with your deployment even if there are inconsistencies and unknowns in your data. + +Mark these points of data and leave them for later as per the xref:../#the-concept-of-an-iterative-cyclic-approach[iterative approach]. +This way you get tangible results soon without having to wait for a solution to every obstacle. +==== + + Now, if you run the simulated correlation task again, you'll see a new entry in the operational statistics of the task telling you how many accounts there are with _No record_ and what's their _Exclusion reason_ (you marked them to avoid their deletion). For example, like this: @@ -594,10 +621,137 @@ For example, like this: |==== // https://youtu.be/GIlr7xYi8UI?t=326 -// TODO: improve the object marking GUIde +// TODO: improve the object marking GUIde (#86) + +=== Check the Simulated Results Using Filters in the Account List + +Aside viewing the task simulation results, you can use another way to confirm your setup behaves as expect. +You can view the LDAP accounts and their *Situations*. +Even when you simulate reconciliation, the situations of the resource accounts reflect the results of the simulation, i.e., midPoint knows which accounts would be _matched_, _disputed_, etc., and updates the account situations accordingly. + +. Under the LDAP resource, go to icon:male[] *Accounts*. +. Use the *Situation* filter above the account list to see accounts in various states: + ** Select _Unlinked_ to see accounts that would be linked, i.e., their respective focal object (owner) can be determined automatically under the current configuration. + ** Select _Unmatched_ to see accounts that can't be matched to their respective focal objects. + + Some of them are marked by you as protected or for later correlation. + Unmatched accounts that are not marked will be deleted if you have the xref:#define-synchronization-rules[synchronization rule for that] (action _Delete resource object_ for the _Unmatched_ situation) + ** Select _Disputed_ to see accounts that can't be matched with 100% certainty to their respective focal objects. + + You'll get a correlation case to resolve these after you run real production correlation task. + + In the sample data used in this guide, the disputed account would be Anna Lopez who has a wrong `empnum` in HRIS and has to be correlated using `givenName`, `familyName`, and `locality` as such. +. Click icon:search[] btn:[Basic] to confirm the selected search criterion. + +In the list, if you see, for example, accounts that are _unmatched_ and not marked but you are not sure whether it's safe to have them deleted, xref:mark-unmatched-accounts-to-prevent-deletion[mark them] now. +You can investigate later. + +image::../ldap-accounts-disputed-after-simulation.webp[title="List filtered to show only disputed LDAP resource accounts"] + +== Reconcile Your LDAP Accounts + +Once you confirm via running simulated reconciliation tasks that your LDAP configuration works as expected +and no accounts you need to preserve are about to be deleted, you can run the _real_ reconciliation between HRIS and LDAP. + +Firstly, *switch all the configurations under your LDAP resource to _Active_*. +Use the icon:heart-pulse[] btn:[Check detailed lifecycle] button in the top menu within the resource to view a list of individual resource components and their current lifecycle states. + +Then, do the one last simulation, this time on production configuration: + +. Create a xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/[new reconciliation task] for the LDAP resource. +. Switch on the simulation toggle to first preview the changes and prevent any harm to your data. +. Name the task, e.g., _Reconciliation with LDAP - development simulation_. +. On the *Execution* screen, select the *preview mode* with *production configuration*. +. After you configure and create the simulated reconciliation task, + run it and xref:/midpoint/reference/tasks/synchronization-tasks/import-and-reconciliation/gui/#read-simulation-results[inspect the simulation results] to see how your mapping and synchronization rules work. + +And, if everything in the results shows as expected, you can create yet another reconciliation task―this time with the simulation toggle switched off―and *run the reconciliation for real*. + +== Resolve Reconciliation Cases + +If any of the LDAP accounts fail to reconcile with 100% certainty and +midPoint falls back to the xref:define-ldap-correlation-rules[_last-resort-correlation_ correlation rule], +the production correlation task (as per the xref:define-synchronization-rules[synchronization rules]) creates a correlation case that awaits a human operator for resolution. + +In the case of rules such as those proposed in this guide, the correlation case contains suggested owners of the disputed account object. +A correlation case is the way for you to efficiently find an owner for accounts that can't be matched automatically particularly thanks to the suggested supposed owners you can choose from. + +You can find all active correlation cases under icon:case_thick[] *Cases*. +There, click a case to open it for an inspection: + +* icon:circle[] *Basic* shows details about the particular case. +* icon:circle[] *Correlation* lets you know how closely the resource object shadow and its suggested focal object matches. +* icon:circle[] *Workitems* is the workbench to resolve the correlation case. + +Check the suggested resource object shadow owners on the icon:circle[] *Workitems* screen. +If any of them is the right one, click the the btn:[Correlate] button in the particular candidate column. +In case no suitable owner exists in the database, there is also an option to btn:[Create new] focal object in midPoint. +That's not, however, recommended for cases with an authoritative 3rd-party system like the HR system herein. + +image::../ldap-hris-correlation-case-workitem-resolution.webp[title="Workitems screen in the correlation section of midPoint, showing a suggested resource object shadow owner candidate"] + +If you're using our sample data to follow this guide, you have one correlation case to resolve after the production reconciliation task finishes, and that's Anna Lopez who has a wrong _empnum_ in the HR system. + +== Import Usernames From LDAP + +When setting up the HR resource, you used _empnum_ for account names in midPoint +because the HR system does not have any better unique identifier. + +Now, however, you have the LDAP resource connected and with that, you gave midPoint access to much more human friendly usernames that are stored in the LDAP system. +It is a good time now to adjust the HR and LDAP resource mappings so that account owner focal objects are named using the LDAP usernames. + +Here's the outline of what you're going to do to achieve that: + +. Set the _name_ attribute mapping strength in the HR resource to to _weak_. +. Create an inbound mapping for _name_ in the LDAP resource with an appropriate source attribute containing the usernames. +. Run a simulated reconciliation task to validate the new setup. + ** First, test it on a single account. + ** Then, simulate it on all accounts. +. Reconcile the accounts again for real. + +=== Adjust the Mappings to Prepare for Username Import From LDAP + +Firstly, adjust the HR resource _name_ mapping: + +. In your HR resource, open inbound mapping settings. +. Locate the mapping populating the _name_ attribute with the value of the source _empnum_ attribute. + + In this guide, it is called _empnum-to-name_. +. In advanced settings of the mapping, change its *strength* to _weak_. + +Secondly, add a new inbound mapping for the _name_ attribute in the LDAP resource: + +. Look into your LDAP data and locate the name of the attribute that holds usernames. They have to be unique across all accounts. + + In the sample data used in this guide, the name of the attribute is _uid_. +. In your LDAP resource, open inbound mapping settings. +. Add a new mapping according to the table below. + + Adjust the mapping name and the source attribute name according to your data. + +[cols="6*"] +.Strong inbound mapping to copy _uid_ parameter with usernames to _name_ parameter +|==== +| Name | Source | Expression | Target | Lifecycle state | Comments +| inbound-uid-username-to-name | uid | As is | name | Proposed | Set the mapping *Strength* to _Strong_ and leave the *Use for* as _Undefined_. +|==== + +=== Test the Configuration Update + +Before you make the leap, test the new configuration using a simulated import. +Firstly, on a single user using the _Simulated development_ execution mode, then on the whole set of accounts. + +When you view the results of the simulation, you should see the _focus object renamed_ notice. + +image::../ldap-import-usename-simulation-focus-renamed.webp[title="A single user import preview simulation result showing that the username would have been imported successfully and the focus object would have been renamed"] + +After the single user import preview, run the simulated development reconciliation task you already have under icon:tasks[] *Defined tasks* from the previous reconciliations. + +Inspect the results and once you confirm the simulation yields expected results, run the real production reconciliation task which you used to reconcile the LDAP accounts previously. +== Automate the processes +After the steps you've done up to now, your LDAP and HR data can be considered reasonably clean. +With that, you can *move on to automating the setup* so that it works autonomously: +* Periodically check the HR system and import new accounts, if any. +* Regularly check the LDAP system and clean up (delete) any illicit accounts. +* Privision LDAP accounts for new employees imported from HR. +* Create passwords for new HR accounts when provisioned to LDAP. diff --git a/midpoint/methodology/first-steps/ldap-accounts-disputed-after-simulation.webp b/midpoint/methodology/first-steps/ldap-accounts-disputed-after-simulation.webp new file mode 100644 index 0000000000000000000000000000000000000000..160119888dd824a8ad7cdfe3337ff0b8b7b29769 GIT binary patch literal 28426 zcmaI7b980Fw>7$h4m!4tPP${;w(X>2+qP}nwrv|7b?kKPy!`Hc{uZ*wnrQ06_TF6TpE$5I|f|P%anr>n#A9YiVfZ z0L}*hR@RR83ZeppYU&zy)Vq-;%NIHoce`P4NdipzHsFirn3K<;1^!~kKN$E z@%ewS$$#Ph3JTR;NkQ-{HqoXlifu#bNs5kQ!N8fB6Sh`)_RYAME)b zY-Q>6HMjq2|A`Rxx3#k3*OBzA;{u|9I3NwkeWld^a01K#OTZDJ{yJKJSsVa`uW^C@ zMUVYodbux^!I#PmF#J*o0XBdYp#NWb;6H2d#rbOglUoO4Muz_~fxrp?z_+c>&s#D8 zfJ^{@_t?+R*Sycq_j~{V`vU;I*8iio$prwm`!9R!|JX=#001En0GbE?$7YZM04*T^ zfVpO?Z?FGf=K=eA1vNGXfSVEkfKvwmlvx1yuKC}2`x^VtI8d+x07_rEl9~d5v~&O< zH~I3d^}oao^(FZK^7jAB`G52GwR5F7EdhWw0bCzYj@WCCA{|rtP+wV6=3I3VlJb># zDYPWG-o$$hiwCCMIAS>x-Eo*2MYm5o`8DFmsjlS!Z1V8sRHvu`rTrJV5{rkhcxfxn znoxJC_BkVMcR?xBGhz;@KdtAEW75w~^|HF3%>S~jKJf!bpplV9eN_z!y6Cl9YqYH= zKYO+p)HqB$uDTw#TuO?5BnHMp6k}!>*!Cs@%^+ZTE_Bgm#TbU|hVEB*0cIc>TjISC zV0LuQxD3oapO3Ha?;kGD+n*h#>M`+G&c&RHd_KR!_iLT7ACtv)L%Gt>H`zD&1qv3Z zP!TIexuDlkpiM|fi`_1%xBPR2;5RH*u?wL*B#XgqBvW=9uf1-RjQ;tB=jR zpbiUc34wY>HF}$@X|ft=-fVVK`rT~RvCLd*H)USfDZ=bvwBLODQsRVXSq19jdBiUp zPdd>|Esl(WQGe;>^!Qn`ULApTa_y+bk^JFNV8tnEWwCMEtImS{8;%YCNK`(7uOFd& z?XxGoJbFx8o-Z?#^(fO}`gt<6ib-94AY$NubM0vmy+*H8QQg&QZkq8 z{?A1TT*YxE-vUUZ^PLJgE+*gps-kZya|7039ca15AgE|mm&4z!!CL&g(2T@EQt(T6 ze*R3Q-ch1c1a1yBd)drWLm=cv&kRT^Y+L*-9q?2SaxVikoEnN?pg@7-D9puXs~=Vl z?{_Bzk7Qz?0HPHBJjPwpTC>$gbJACzqVBkSciCf!C#fqYUvhS=wpFd-C)9*ru zzevt|jWV~jU&KwXbsnn?4y&9Fc`xmrvzG?h&of;YrllCY@@Wc(!qEq*;aL@<28+li z-sU*j&AHVyt3B+E>@eIlGZPf7$3(0(6(bJ@9M=4>c5)}9jcKm5AB@Y*7n?FGhMIHh zEHl<{15NK9z`*?)Kdwe%A zL?4lBvB^el_DpMC8Qz>XbjUsQjoQjq`_oZl zibBAO`)~eewtkO>NP9@{G9??w+MxMy*sFjQif<+&24key){AN2PVEe>|6@V_!=~7D zbICoZS5tTZm(`6{nzbpLh%ud9SJK^%KzrFexbk3cD9w6axXNVIfc0d;XYY-5+Q(4a zrS~OQ5Fs9WUi)A8BXoT-#btC#&LQbp7nHJ>hW|(^UURgNEX-?m>WXx(%-M)VHzi*~ zfg6b_1?3Q#8AsXJ+^vDgi1h|Pp-Vs={^8~swkcF5yHMnbTOTG$bW)A=klIXvBP*-+ zhlU~CuMITeI@m`&k_>7a1g^96ie5D*GxtR!kEJx#+y{m;;a$7Lg5=|(tK2w&%?BQ~ zLpRjouH=sL3o@JR47Q?yO46E`xcLRG@(s^6h8I33>gbR>j3Jvk z&1?#lB=Nj3Qdv9;BCJq)6{ph};Xz|}>c0l9!x;{)nC{BP?%4Mn21#Y8w705M5v2aDW0n|RT;$mi zw#*g{G&&nUR-CAH|1mrsI}R?4?y`>-OLRt;36S9X;z@0Lu?T)v1ivXiepVj{?>vij zN^$dR3u6Cdxgp~{>#kfE8%URY7)&EBw_jj9(R@kB*YO%`@FjHL5;qiZ#p%h zH?g{?a@qP(x$vN}x_YEu`O3b5Gjv&)?a9ieRL3*2Mq0xoA9HImrMe>bOSR1aHL8oO zI_sA1-bAclpO{`$H(g^dDtTMNWQ8(KgCEkVM|~vSgZ5I<3hu=)^*P>1P_M>5QHp9tLme z49^Z3jzwMX8!+R2s#Dcf9dFMP%S}jNOzEg&inNdc%@!PobLw?NEBBR()5JY36;UjS z>UIZm)X6K(n+JdN6ex6S1TWZjG@{)ST46@R&WeZeaMxG5CV}GUuB~9M@}EibDh5&H zcvZiWUNQ9`33mpH$LEJkK~1wRQOA#TEa(ATPf#%}RN1K2U15xDa6Z}q<78D6D$74; zt}!Y*W=u|O8lfDQ;s`yK)grAeNYa8}z8@OO{P1iVIqf*lem6wR3rZkL9I-;|aw!Go zqUy6<*xG!=cJy35&g^F{2WI#`WcFm{Izca!s?QvQIWr8X!FK+PJ!b!a%4N!mQ0ixD zbn4D^D!ha!N@PiVvH6L`@#z86yv%1z3SHZGgqHiSaFp|%nFcLOLBiz9SWXdm%(b7I zKkQ0h;2~nd3zEx#(`G1T?&k4@P^>EXMnQLk7AW=ojH>9ACcxa}h(qyk%z1<ldd5Cg)kSs7PSO{F(d1uT7_` z4bRtAcF?muV0(Ca6!^U{1O(GmY*C;Z56Jag?Ce`GitaHdFzkb4&0QzKxHqw52B}PHi z6ipda0(BTr?}?pbZ&$qK%zjtM5TN{@zyLqdEi|CFKh7kU36l@&)6Lkw%q~TG{?FVt zj_SSu44M4pHdkEiu7&^_$h{>_i(}K>?KA>>iwdA_erJoV$w*Hu+m5sBDGx6o>@98r z^d?KznD4pKOaGAQKd3gi_OzPXdF1#{z(bE06%4>nxq`r=es=cVMeH%hQ?QfSqDEx` zI=#=~M_402(=0~C$&$QtU1C?+h>j#{I;oPU2M^3?f8iCaS0u{t^~D5I(UutbgS@HB z`nB>*jpI?B?^a=|ZLYH>tP&|XyHWoNoF2THTFpoI($_ol9ElSe}TebDA!j8lP zCuL%_^hFr*H=g6+`LxTl@qCpbW(bd|)HtSw2gC;%KuXmtdi??fuab#^ zU?6jcjQjd@mSKF4dmOW@Q!zV_5s?Mu%5pVYG5-OScgiGOqtKKy*(&(wg^ht!HcI@M z#KBPbPI$ilvk3_=z2ar-?5`Hj407d{C+K0JeM>k!V!9w4pvG;Ph*{6eps+hXcxJ{a zbY#jX?HG5WsrUZk6cJ7y{}h|Ad^_MXUtC{6S#za$g0CTvcgkh&Z2AQy-S9nmB(aV$ zM-?W8?<$1P)W#WUJaIF&Z$Cj^pm;mt_$OC*pL@{{p6zr8s9_Me9ZsSN30X@?DXhF5 zNL&U9wp`6Zdx6kj@c=QlXkOi5z7+f7G{X(qZ~H&Eb5GQJh4V>bM0{zmY>w`Ya_d6~ zT*EL9oIWl%VEeW@(6=5P)S;R6sD)m;>BS;cp|cq!8x6mTHXSVHBL^x*(CuH#ZM)Cp{M?l zy;6st;Ome^1b0mIvIY5Ne8<>MQla*_eQJ*bmqvI$kqc64|Zb7O-*WE)SVOJyyiE*1cOQ^QW_)|6u>Qakwt>%E#!MG!ivSbsm`V z)yye}>H$7HdSRhNJPf|u0)|+DJx5U=PcZmS5fcYsLQ5Z`!!vokT2u@w_tzatn^;4+ zO`hL6j;Bbg#Y|Q0sCBDHX7~$UXt?`1vpK4X+w)j`6IBOIcDduFs9cmmTy~%+6e}OoTD?KcW!Y)5e<`mb;px zQmqgYYEKQ^mb$c$@rz=~CHYdT_wP>)m=cIBGOlGQ)Q9I{1Ck5(dXZCk0tWC{6W`sw z@vlZ8;i58RXDFhpmO)a?b=j z@JqWRcEpWq9Z~tb01MADIKXp$o^9|?;>(~9?U^@AzSkbRBex<4NW6e4M?Bvh`l!nf z3By?B;<==`iXs*~Ctf|DEw0-83?kJS&CE;CkFfRf5eIHCzGF0y_-WWVMPI-L{^#6e z2i^}l-F?-BL-Xy+-v~R1_&{F)3neAU#XO43sN+ho{edlNz&R%t+Zafo({d|ukfvk~ zc)KvH4rLYy7XKr4Oej%!B=g~JHGXa~?W3_9nEMl)0!eJDfSZ6&qI z8gcKWr((kG&Adr1(Dm=;T%B;?DhE2*v5X}ya<(GKgOm(zfVWTml8&lT!nekVt)>Z9 zTF~M5YC~*RVLU$|*IoC#a&j;WGeDmAp-td{S?a%$xhb_;t$2ze z1*ZTt(L`_yykm)oRfjC?r`YPT<4*(?DXfYSS^+qpk-Ird0PV(3%_Lb~zKA;2W5l_;#%l8uQE?17WNt`KKVClu`z81+swR1Fw^1NcipjACg(oct5XuqWD0Q)1 zRRa#lI>^AkH-+R&OJ= zG=J&A4nF)t_DH;|cQ4|Hs!CwF2zt)91S+Z+hiF(8X+X3gw}G;;Ol|~L&%zC7=r`kd zr{L#8%2^VfyJ9*&uravngt|1FtCF@pvdmn6o?{&5xoneqL4n8Q(QcJ5?GK2vIyS8%74bN z?At2Hx5N5*MXOYRPUFW|!<(*l7c9UqB0p%bxI5Hmikqe$W>A>tv9NMBE-UST_!=_f ztz8!Yk)t4NZtEa|B)@*5-tnMoU4KF_*VkhmTi>I+@$8|qQJU&!RUzHc{c}@kfR4gp z-}xk4M_26F7eEQ1ij#jMvQ`bhmnLjvjZcKUCE7U^3^moBtWw(s@UJ?j{#q(%AVf2t zgWy<{k^cJDX}9l)3v$UCRBI^X{OE5Qx6M7}EaV_>aU(*p=eMQ4f{&O`BmAV}kJ;Jq z_bJ@SBFu9}$0h)IohTDE9j~F-h|w0)!s`6n={F|0WDEU8-n9%&Ln>RiT+`6Jg`-5f ztM@9nZKfj+A2i+uq2i!h23vjc3x`am#B@X|DHozc+nUcs+VN3%WvJ9D_X1Kwk?9nHJ4H^{9PENz;1!(yDCX?_q#W z^~5b_RpVhCL>-9zr0_=2b_cb*_P+ib!ScbHdK0xT;s`CSDMgEwBO;}=cox0DH3era%1~yKM?~MqP_R|<<8|vyiUV_qq%1UA|GsHAa1TTs3s}Yn$ zXd2L-L#gdc$jqITi>ni_BO?vsC?}hC#a-^Btxr+3h)f<~iC<1-ZJ{QyjS4_8o$4dr zU(hOMS>v71%<5~0)8zBk0Mx^6!&!8}5WdAFLa-l>O}5_(j(>V8dy>$$`LQ-uJQcg| zp<_>68-a6g{hFR&^UQN{xGv2IslHxzmTqcj*d$WW&E^j1($5mM&(maeYehTLIUi>2i#G|KxGM?aP+$&&&ds{(tj`?KuNmf45SreERB5~0`Ecw=oTC_6gaBMEuP7L_oSTY60H&AU#5X+e7 z6&FS;3&rg1Ab#EUYUa9sw{S8GtR1eq-t&1 zdSobTF0V?twO7d1LVIe#^+nB1c*jn&86F2!m*`9W=ZCwo!ikMY?|iJ?$ceS14ci zLYlV+;ilzE0%eLr&8xpTZPzI&cu`|vX4F|Tx4-K&?L-=*_ltE`k|F!RcegPPfBd&9 z5&DW+P`6!x{5yl6CM&7V0*}PoZtGv%`uA$ZY~-8JCN^VtmGgwXI@v71F!6GW(J-o6 zMuF8X5PoDFDek&SVgtLzQ@~VLe~R)we*;avvQjGXvHj25 zCxR8oY;A)3*be(i~Yo_~bf_*vPw%h>6K$rh^F)uyI z`@$P~*eb;2bZQNuEKvQlEx}6viCv+!BlhE_$m}~S{_UTc600PsfoGHgI`vTDXOyA@ zSb#9?@EYGn3%THDe~sNxj{qFYtw>y_S!X!Pq9$~HW((_FvjO%rG{49&^wN(008>bq zU{XAR!1z?<+-X{UtZ_M&r0)0xW-j3;1#6B7hfT4}R#=xe&Y-=Syd|ZC2z`^T=j7b| zQJjU!R8#41bEn@5?v(yi1iV2HI%A{9ok^#>h(luWqBkJMMjxhe$`+6JNt}?QV1M!` zT2R~7WVWNGT#=h5qrA-=Dwr6dAz+ORlW`+X=@_%wylB(hk|bu0mz6x3Zf}C1)di7h zuVYlQ(-0l7DYS(qGna*aTAtF`D@Z0~3z$(PWMuciPd%-AFiUPaM7cwkR-Gap4yBEa zN>#yw%^Bxnhfn?B&l1XyiaRCU$A^*_TOWJ4{>-V?KB?>|;Cq_Vs=IgqHTGQV{Z6{H zN0EskU4?r@xs+TxRT-A){9dFmF{K<83TK~9-&w+x*^KGuqCjrSEtln+Z=^3FjT@6* z7u`LI=_K;Ue}pP4O{7!c+cEKeIlf-Eb$VDoJb#|TNMQJctpECVqh3_93H?!2C)Dub zJ2jWEfRXMyOh%R2fo+_56#q(*+9#(ff?L4wG?`E%q*+GwwrsbZt>yxsyQLa#%~$rROIu`6(WDJEU;s-$M!20Q$p zM2d!|ejtfPVl$J(cLqeg@Pk0Khqso$hL+^k2FR6bAPz3$4PNL=QBvyw!NWTEAAO=q z%zq`ehK-5uL}5Fpk|6T9WD{jCqOnmL(~9)0PEF}pCg(jT7ggg{t1TjhkZDmfRRY&T z;ch_g&?KVz@be3uJ&5H)K?DSQDBG1Yh}kD+vGVVDHX!zq+M}PsTe8zMh!hr;IQ@>J6y*Bv7 z?-Qo^nX9#EPe9dJ@Y=7gvygcD+tv!Bqgm1an+)>>z#tY(LEYcWvw<__EHrN*r7Cvf zwM9V|v>9?PGQbJCdup72bMhB#v=z&!xI6dV9ebnm_nt4xBNL~LY0Sz=WQ!{!zd3fJ zBi`hV2{l)gtncKl#*srVPF#*-RLTbtxRo)b5|{EfObaL_COh}^aX*^+#)z=Gv}A8w z&De#pje>oI=nwaPs(gU~c+#kw$w_o%QsL8)o%*fNVD|(%>z#u1*1(hEZCw^ftcS^F zj(oTLqQ{>5fjb4#?z7`T7-fzI8NALcN=T|0XPA0j(#CbkNr?s?*$#)bTLM+5EdjZE-j&LPEN&^05?|}p0_~{4 z6(C3v#tO@|uLl`&t`^ShvgFzyjx+c01n-ep?G^bz5oM@jPem6g)+3id zJ_k-(zPsG8wPQ-MeqWVx6G)QXQghnDxTXtM@2L`x{e)B`Cyi3%g*)1aTGpkUWr3V? ztoo49c>_HQvNWl&iQAU7Ome-Y5>=?0BdL#U$PxDsazWWx-*4B65VEvwbY71-=4@t< zUrS4h0G-~cuRzG)h?GKAI8EHqSC9xf$|h`Y8reiDGNbHV&BIbp4$XaaPCtjn7$DsH z`i}CBjQOl^RNKW@#sL(b5@ied!!?=0C9nvcPI&%+8p3}xF^;?r5{sep(W}Q+IfpHu z-;bT=UNO)1jD_>Q2hZV!4D9_ZwUi8Tf8|L8ML>xnr+0v}CO`p<*x-G?o|51sq^6zmtcz)A+Z?pL8j8HGbKgW@qo#y%XF|{=-*nf^! z6kKrze9G`pN~H&OtFNQmLfPQ@VnUIfun=KWSZaxR5Qc$pELf!!2}QZ;k!bSm&G>Rw z*TxXtVBBPsGdFQQqz+%PUZe}Q{L;_Gma5a0#zJ5nv@m=ww zLYuD~mn?ApxhucCB9uTQ|2^OMffi{hV(oVGfu{IT-EFza4KHI!aFRFP0?tzrpV6Pl z)Kp%JZ=Mop8G}a#B$I|VA?6@MTPU|QPSQwqktsm{j+`m#rz>*dy(0SluTVjC_n3KL zK8pNKY(slNf`2Ov9_`a8bkmr>(ZWUDtDbVs0I_?KR-+A=7zn-lS>0zDr+G6Oe-bHb zxfqv{!s^;mnu)2A8+|Udn>I@!hL6m-^%qGQ%zz2qp9aTg3e2vcX~v#!}bzob*XZ31^@@?+wH}^wO-H$f4 z1tzsqt`5GkqExMns$eFzC1DEf;SW!;P{{4z?(F%2&#YD)Vpdg+zl|n0T$H-a=ok!I zUP`)G$yu`+Cq=|A%<+_r%cl_Z$A!K=oSg#?&`#>;N_!p98LEVMR1S1*D?0`sC`bkZtI3s>XheG z5REdg#PMBG-js|S676JG^rfp0&M{eELFlsLRZdVQj3J8+CUT+kbmHd-U-=;%k&h< zM4-}30}5-ZC^prNgJ>%-8pqn-G_C-K^VZ<|4*SN*z-5VnZ&VQrl-yGA+!Ha1QKtm$ zSs{$uawu&N%4Lrf>_b*NFEUlmm)(Rp@qG8q4zA*@ zSnrv+Y;JA}bK6d|J2wMz`Znb=@c(sX0%^=xm%*W=tKUNm11@0GK^fT3xBaVegMWax>7h$9V&yzYtHF8p6u zOo_JONe9nOw&Rvm&Tr+q>e9cC(TN>Ck-{NQ%DU&YzojNZLPZ)3H*Weh7cyJ0m0le{ z*704VSj`s@{mCB2@MK*+8uq=>F{(0B7wpgP359*z6Rt~+bJc$nXt^}4Q;JSiCtp4r zSz92GY&;gCpUu6#9bha(vD*H=g!{+#?URQkCMSyiu#B$BaAjm-f+|UX`G^GtKjFGM z#JaOgNZ>qaq=M!M6E-SQrrt_GW#1h$(n?eKbaAVLMa6koYdOeb&L)GihHD7Nu=-39 zqNU1eN^K_{5Bp;xMnqWNF|Jm%VIY`R$cou`GQ;(hPoDib3UFkpRam&BY3|9X*cE^-82$%H< zMyHqckUgop!r3uM6-mTf7Sas`frqrcNcrq`;!7kxcOOZqlp`xOKj?GkASqUqZ zDB&i4M$fOJgRnC@^wHggv&9uTbvz(SuMU-R>ZsmP4HdUX> zk(+JM2`i-T-r!U#sb^y@$LIFxxZxD#2DB&~ht(eWw2r791d~MeqE z-jZn7gtLBmTe&)UI)rf86DIVTyn5w4L@PeeRVTXd$};68y(WXM2dW`i;CrI|rFq~B z0{&s6)+&bK`)FgbY&@cL@q`CLVvsYbzQT=VSXQ4Zk!0i!SOV>)CcGFuB$)cki)H0A zVd@espC6_dtUl$hc|OfIue|MUPX!^TLfCBH4ZJrYZ{N;d4|=pdUS_!8j~1kO%4f#T z>5-78p2)PBael~15G3ft*R|a2k)!Vj2%AE=>>+7XAO%^V&_4{>3{%c{0niFxO90L` zu<93gSB(}=ZzE1u)PaP>*+ij^0Nzc59f3?N5kLq6cXSG(F$KzGt5)f}?SKUVYml25 zbJ~@74^=~L{n^4uw7VG1VH$G(bAu_Zc7mWF%l+=mat1t={&d`C$*v3EP%tpn&#k5@Ko-PvQ0Qeo3EWzl5KPsXENYm zpWWC@!=af-F3-gujPn}=jzFD-Arf&&h!R8pJl`M!8U;NJ1Ku{0)o^k_OPNJw^kzv{ z6^cbh-tuYXBb!`by##aOZT_sb%o?Z3I-|;Q9AIfmMi%is2rMEo8qQv+p{T}=sLL^* zY0s)*1}C3(0=4XkAC0|_-H)k?fXAp%x}7P4rUBFs(|MDUItT5@d44Pu&I!eDMM@)! zEA4@G6*3NyO7IQ5LP#S$T4BE?q+?38_pXtSxmk@wt7oX_k}+b0<7?k?j3dIPP{7 zVT~rb+q0fC7Ihw$sGkg~R>jm{!H&>&X%8n8vbT30KCNn9&R4R)vwsx~k9zE@7^UyE zdIEp)Ali2`xxAnJs}}{-wEA4J8>L;Wqc3-4sQRQ_>T%$HRI|DdNVK|1DLI8tG`mdo zrm^LOTjW!389FV*QvrTBDT9cCkIOnU>y)0-$q}FsaSh`!2uMqWr7yn{}0BiXFOqf^xP! z6LiSI&#O*%0fo(IW+BEdHq2B6oG4F0YKXohC?7*ODG$o;&rGruvVJ`~)T#)hbWwFU= zA+m3*T+0GkKYo2xy^A{S_b2R_U{SF|GOy{A{F0vT=2~CVG0R=8R)^UEykt z*Rq~(qbmtKIl2e-p&vK2>UCN9IGH)`Nc5D;5}U7XDw$4}WjDkfX4H!qZ08HtZvT== zzcex+T&>&DQ;r;ve8$*^3|tnXFP^?R?H=p_7+5QAKMof z9cx5IEMUogwgY=?J9m^tLDy!RKUId5Ta3;p_ts`(TTQ;|zhxuDby&%TTTPK7>y)Pl zFcaKdm%Vi%d-sk06e{M@O%E6$Ma(0zJefj~u_;hC6_PHR7P{VT>YciZL@RgTQeS6# z$($J{cipSOeL2JV=b3-J7>1fDXW}ZLz3Y)li}IETugzdddtk_&AxeBLuWHg>zj4kpFJ~Qz)oc<5IPlIi-&)p}PWEbpK;kLy!sKPI`ckgpxWSfTw2gCu zjJXN?f`Re@Vm1g|>lpVek(^JzSu@Dh*Fy%a|00#F?HM3 zMk`WhS!FcrlQjZwkBQ)KQU0NVW~>E1MCs9GWWAqal+=ke1?n)YL#y8S0d>j9NKp}z zYc6iK|Lv8Q4cH61DDvzyxqZ^nZ+62n%)mFC+8)i2xv*e{sn3F>l-y9(91tPIOq%Bf zPZtNbMTo>W=~!ULGTp_$;?^Fqr0Sl{Cc+kez(fOL^%DLqT!iMCt>&)Rlyw8Xp zdD7ukhA1Ws4s#Vec>)r-+?r<9_Vd;b@!IeyRRxnFTM+16&nN{P7bV|3(+^L5$%Ukn zrOcPv{+em?;4Puk?gLMarex2 zd}`I9aA;AC(ZAx0nh$VdETxOTuD80~aDsPIERP$X{}dz^&$dVHG8hS$iEkh5hOD4@ z?^s#8de*$|j9zyo#@t)tZ?CN}EH}PbHq>VYEwgWxGmb-;FX^f^-j34)zyXd$pu?@# z7~|J9%OTgJEB;`8!X@6+H+YH%`t7@tY;Sz81zGOgmWd0_WsdT+;KI))ON(%V=*@OL zY67?j1!c-t8U)_2y}6-@Jk)b!h=TN>z_Z-o=4oPbzFOjd(1QC3+i`SrfXukYSM>rD z(Y);ez4#11rRp|n6{Az4Ivx;BsDFK=Y~&uyQMQ$`;GdZ2|HE(T>oclstAOnK)Zx@F ze0OfoH~Hf4-+;QINnxtt1%_>t5*4pN{*4)<^yHtlR-AAE`OLOwoa+#R={GqO3OwNfXU4YTZ+r*W2X!%R( zyX@m5xgxt(f$z`Gh|P7)j-i&GL1*`D5te!Rnh?snxI&75zXSo51+7T(#m64MMWaZ( zCh>vl-^_lm=tAH#SZSO9jVBHLIx)!}sq84-9I7 zNN=f>f}!s_3(7_xsc^NVwHnaJaYz($KC%jRZr=f4@(HBZ*9r-SQCK6lWKHktw}WDs z-i#0Dj(Ci()i5U`)O_dZ@~b8~+57MzxPZkwodN0j6#QrTgg75i(M0%(r1{S%7@T+F@t zW;CQ=AD?>`l%A`t1@WdeBCJ=T0&qce@16L*kpVU=2`UD^vS?a{?mR@s-HCb9+oXS+ z*NGgWe7inY#pJzysUfF1isp%~4<0lt`i61;Ad$odHjU_pX@RLBt%j@GUXuu7;AceM zfjTsiGt+I2>)S9lqgj-0R?7>1$W)v-KM7Z~_<*CmeENw*}MZEgsSv#?FfFaL7MBB`<F=F*<324)3I6^Ee3dd<_R{mqENTNnUlI! zaVVNaO@tLosPHR@+M6XiF~^Ng%AGCfU0uH5V1sV{p1le3o!t;!nIEsQboyL+XJ(Gy z>A0u$;70ZWZpb%Vhf1Eu4UNApg0Ub9env~>OpAeWf}{ttp#&k=WTR~a_(hcGr|=A< z!P3%EtQi{qsoMHnBtCJOB}@zZhiIk}RegV$ZoqW_;HM!J$Eqak-Hb?S?)&#!qd+d{>7u<%lLAuFvWt0g0DOH;V)nQ!A7C! zn%#`N$R-)V8ZcQJAe9_yt&ybw@CI!+!Sf>xlvK%E!J1vMW-|g^p|J>2#aK|7T@Z5X z0=I%4oO-(F=aaF;_{bPX8TF*nk@&vCi>H~;7P!WA^x4W1L=gq5_!AkJB?P-HUBEVG zu}FIyo5*BEu&SuPE?6W352*j{tu2%l~ z6m}D(QFo7)WM$3Uy@P2{GTzCa3?3T`dNOEa(kwZanQ6oC?gsLzFhysUWAk++jGIXF zHE{$l*5xz~G;_f(GB_pb4|05dvX?m?hR%$*I((Ii&<~09ZW8x@k|5PgDL_Ddi|2+C z{!5bAgG83kiV>Q+IS1r^x;l1Rz5AmhxxiatCeI^Y41-#E`bEAZvcw`Q7tCvd;ARBN z5t~i(VeBr^@=rVHhK^Cc$&(fzl790oED_fiGCN|F$8^{C-Hyx7xwh@c|Aig8R#_gC z{}Ze9XU60;?J5)GLS<*<5*J^vhK^_L66gff=Xxj-B)$H7 zCF!prvDRxjX|3jQqXLFmUTZ;fE!A;hQYE=`HNx(50R72`$W)DbpWv(+b*6w;d_QG= zgGk}I;J_3tM)dLO+Jd9ci-CizX8q=}K6IX2<~UMIteX^2` z!ZYwu#7=S+#Q{=&Mtl-SyCW%ht#}awMHE>w7Kl@R)`Bw&W+TP=@)iqIAc-$`qut(k zG6LAN+YZBUMHuJB4r-D$56&n7alg8ySoSmnyK#w=yVi(uGvIXPitXCIA>qrc8VV1TdMSt-uqR0@@w94)to6!Gz~aT% z(=g+u{p0CyE_%M{$rFYjo&-&cfYARnVq0OI5dC*BCymmF^ z2h%M{p7Vd#q*!jD`3oQ-M~_Iuw7(JU8c~Vcx|w6~VdXnXLwS1rI--PMYgehVye!;6 zoo+&qlBXRDIpb&=R(Yk^Z4c@2tEL^Rql&$^) zc4ym)0rv6X*R_`S^!G>GF+j{^`E2EWyVZkQUu!$luEWf>Dq$a55a0iLO6oE5nWo!& zwqtSIql$+*T)pv#u|GCkFWX(ajak>Df{Q&Cb#%HO+L8X`S~Tf9iR~@=FNxRl>C7^M zwV%V^s-s%`uVrTWPPO$b5q7<{bn13f&^_x z4hG*dV2|(a+%ZCt7G)jA2__0UZy5QAluUfBQA;gSbc{5lYLf~Mgp$ROp@8Zyk?=dG zI#XaNCD}r&QB!91Ul~`tHto@?{Z^>4wC%~LuO%(_MKkFs=DotF{4hNX{loM4T;1p* zrDc8<7%Ge5JZxL;sX&+XH@xHM{yX%7C-rjn@y^0w%!17=Xm1CeIHCcZ%s#xJzShpL zCkd3!&zat;dl4}PoKr>y%a+JF8WBYN0^S-vRF(#Hwqza{|Cn_{8tM-<(Whc++{UMZ zGfMA2k=w0x>vE~#cp2+V=B0b|h0{0wm&p4sD$Rl#Gz}>~Yte6+eHh0vq}nQj?CyUo zSa0@c+Goa7y(SR`w)J>MmTg~}_Ds26R83mw2#)*wvk(3UL+e7Hf$A7Euy|Sf$7Q@( zmc6=!2=@T;=gg2xW!K7nOm)ez9qST?YSv<=BU9j7$+BL9IRf8BBl8&r*waOa&+nB( zO~2V1l{s}v6js%aAG#jcV)^J^nuBxTuno8hs34m*Sfxbdt<2Lu2=iK* zoz=aopC_s^tC|ibP)8l=vJb|K^x^0YN-uRP-8NyZHiS}`xMz9}usUI6LWyLw*Amb^ z5IiWJEh9xEs}r7y1(wJcFujN0+k=BI^8~ug*70aYhG21OY_7PxM>NtO4s-g8HT*X| zOpCWFR1Br=V!UT{@_HWMacDk2f;|a%gY&GG@@~a7OL3~5KD-*KpBb4J)Tg0lu-5v; zM4ua*&M0k*vy_DT#fka!HSWW9KhC%vCU8DrKt2S-(G`{A#4cS3VT@2=49>+%34fI|K_3!QCB#ySqbh4=nBy+})iZ3w(P&@3%kZ$6j;wR8?2i zbXT7`6D4D-fQ+)9;W6mED*OG{VwMv}C*a3;eqrYKJaT?33&9e-yYyOc1xmey)+jO= z&Esu7K*z{X+5ba(kcFl(b@k@_nd4yc5uSM()41GeW_I?57`TvZurzxEkN}aY%%l*` z)UC_SG0!R-^HP4XDp|GXEM?X2$}6Ig|5dcucJ$nJM)}*&b4fp@!&L&6{v$qIlbTdz zFAC(V5-bK36Cm{cP*2%S-qt4Rd~~l7X_Gz6I)${N+Kbi5Hc$t3f|a%1e9Jhm!VG7% z7`6M84r(BM8q~^hFn#{$&8JN-aV8&$`eyEa^SL;CLk;VU=BL(}Yiiw&GnfDJUa;D# z@%BRR=47a4Zc`?olN8MHke(X;e7OO-Y;su&u4CX=;04WLVHZ@cffd66E_;#cD=a*L zBqwBfT#U9qzFg~A?NfZP*VtjzEgQV-*4taRqZwv8Od7vWp!XC%<2i`(^yg(4!l_8y zSt7fu-KOuB3~(-3PRjuCZ-ck;Ja-)bQCqzXz<8C_-`-=kuKmP4{=p3Wdw)-Khs-6z%aI|oqe6wq_ zJ-3v B9%z~Ex{|L0hYSgfHH(RJ2X* zd7kW0j2!DFw(!57Ln;NC$E+;|@&h8dVOju1kF@dD2$tVKE>ntkT>s;7f*GWDu+9`I zG@!s=W-khxrhpb6&oeylWY7)D9Y(0wj7TYsPELr%78M82EW7)@1V(q!i^`LEZ`!dP zgbP9zI}4JFNFkjR=U$jzWS3sw?v;Bkn$kLhNrBb+B1XX!upLb|acx1JJy!32s|E|9 z!UF)~^)wj<<9Z7U|3F)OeQB8vmLpw>M>G0;I^Mg&m5b};uCcy!@4*(d#G2J5I7=!( zyxR^h<1+-aFQtM;!rL}+4kdiw~Ff$@w`1+RK4@W7skNxNgsorkxI{IQbG|H z$a#p;sGy)I%ux&7%pF@bm3G1QKB!dbUN*o=S}sicK;D>ft5ruYWa3%LF*F|MY!K}q zXAG6|L`(N_m1IQC6B=)6Km%hHl2b_cfwH|iK-7wIHt%F(RMr9iM7VLEf-ISNXc0+Y zhG)*z6q1j#tC)}#kgFNQPY`kN2T_0p(%T=@H!HK63&KXkDX%4a2h?-!J8t$V3X0_&iEK~wK2pl6ftvEarhjdVG3!7RNGy1bWe~_i z%f+cFuS!A$w%XbPb{rHk=@;S+X8`Q|q zO|$O={XlByXA`e+F5Cw1(w_PEL&YkDXJ?Gr22QUx1`h47?gDN@blRgvJ>_AU<=Rdq zRT_4_w9=BgyFVHoeT};KsfXMOVs;>6)v6q*pfF1-D^E8U4>Pi!P|3dkRA&)X4o$JN z6L8~_?%EAk#R24sMhp|!R^Rh2N^HfcEvO-`m=P!;1Dp<4JDWufqLknOV*oSoviZ57 z&I%I%Sofd=$hhn&>N?CWJbW$+kneh`RSwG)=W2cpE6i&asEmqPu>IFd1cL$Ya#^yk z-d|sYzS+Ya$kPgGDURdO%^`=0J+;N_O!8@Ch$QkfvPkBln)khGlE>%{n>i2MSLlej zU*w(vx8WL4KcHR>OGevrZ=tb%`aF61N$e4?TSp&qi&kN$rII2SloXR86cQl_-M^^<2$ZAu4(YUA1ps9~cq=y%+{;2F z(31I6D6idLT6IzeY(?L2jz|1YGv1%(>5l9GsG}ch*1SpZgC!Wi}_w90c!uQ4lU$r}lu? zvx*H%B-u@;o^Q)%6S!q#FEarjl7dV!szNqp%smMvET)2?195R?qIZjJqB-;$@^M{B z%;Z$4&K0F)jCXY`a570nNzfPPTCk(C#`BjAc#WK>1)I;N{8?BvY7_|(=WA;{V^X;T zo{~y+gM+*_e!)#d_8ZW`Ki&3%HLp#~NyW-(kEMd)U`gG-?fhvR5daO57VvK7DzaJ5 z4thg;IgLJ|j%@8864Y0CQK7UaF0bRnGzmJ!2ckN9YgD3Im2KvZxlrj)goQS2K0Mk%S_rE6qUtQ~ z0d`6W#dQ&DWMb$6D;nh&R*(So-Z9IPQKZNv9Y_Exy|X2teU2qCjFpN!a0nl;V^%0T zT)r=nd-W630Z!B|PMFNuyc1%TAk_w-;z+OvO>EAs&aW|`*wX+Znx!KL;B}N0gv#3p z9h4?cs@K7V4*X`ACXs;-(DF~R0O?OEDzd`s+#Gm0W;*bI0t1J%z=Rk`Uy1Nbf3V1k zNxX^DVKHS-^odHnzP{>XsHatOy1X&S?h;g>S`BZX$X%8aSqWZt^kE&vp$~*;+v5YK zO`^7e`EMnh0`Zn#6NQGJ_Y@X~sF##9e*Ow?w1SXP)eadR5TXWz)=~neWH(U}e67)w zz6*=)3Ih7vevZm2LafzS!t`HQ<**?u%6;#pC@;=@6*YX8Br~*-XL%5U0xY|(-3HO} z>~cI;P-Z2|sd4AQY_erG*R!p{`sy0+Vg#Do?tf-78h0?io?bFTOluY*FEmfIf z#+FnwMM%Q&9H(6&N8yt_*F@1L6VxP>Z-?dayNe^8 z?;^&OtRLA+foP^v^Fs@bvv^a0sHCX>RDApne9RhXy*S-e-&7Fr_{1=9PWM`q4l zMuwL-AAl*1q;#^a!g(xL`HLI>6CO77-BMl@EPDFZX%pZDu(wiWXy47>PiksDKh?sF zlCZrepZtAsFF%OW5CflDV-Ud^NEIgl*+J}vudco@-eN#y`hgC(_BEO>9Kq*Kf)LL< z=X9d(q^~+!WH}}cWNo|Gu7+g7iJ{`Y!~qcTK?$Els%6sBKm|rGG2Z`ZbUt~u2o+2) z_<}pQ0`~(?6@e{;K>uJLkE|#T5#Uex`4)OC(9TmVlha5V4(B-Dlp5|}Y?-is!jQU; zU>JEnwmEyD9dP;AJOOIoQYpg;(@PzteyRz+G2*yp?W>tGl)EKEs;pQ^y#6BSU?GHi@h-GNPPA6#VeqAt27v_8kbla;;=H{ZQGa-#kA{pjTLVcrQW@ z6E4NPJaUc^OcK)*PAL7fDzM^de)w$nLvj4_Ph~y!o77-(Z03Q>X52A+auC~Dq_Akk zQTAl+^eG$by201nuB3Bcr)cNYQ0DL8H&+SXR)l>QEYpo3mXkd~y#f--<8`p?%%=?jV?8YsD17y$dxi6w0DYZq7O6jGMb5uKqR!l6tJ^`=X({JY^&C$ zU~K8&BAT|BdkrmbiiI-zNr;1QfsKf_C##{o*H)ocX2P|f%jok608_wmE8qLcwLEik zksi}bK6C8`4PcuC*C5KYu+q!lhQOO2FTCUcLhJeNTX|eJ)<=upv8&;*5EbskSNZJC zdcZ0V9Dq$mh-o0_of^Mu9TSN%3I>9EEQ3m$1HsAGBP}jfh#T;{CTJc1wOx^n^H;|D zF3%#X;<$ZC#8=YJ2^Y$}(K}mVmf-Ya?vclw{|uE9rH+TTDHFWv9Y-~2%!IG8qe@!B z{AJfvEt_=@N@CQtIvvJyQwOc`A$Q-wK{cQ#yh4@SH(}1QLms|#GHq_fB?(#-a)D1P zg2$f&oUN#xEyclZ1?yl;{iJ_DJs0Llq~J>EtEq~e%LlI=Gb*_r19}q{2nY9z;n_42 z;Xw~?OdF^iv%T65cZ$Ni+qb2t~|<9a+iSNa`RL<{47kAgzpuRU) z;5D#^ut=CdyhUcwK8?o29agnoyf&R<`$|QlA}+TKUO>ocX3OX+e4F;|nOrKT?ka6x zD!U3t4@DhWP-K>MWOm&9d-_dP5Y0B2SzLGpb26KE8nBztqNKTcYSi_f$?mAs)a~H2 zfOHl&EAN#^G8GcvZq$R>nxlaYeD6fzETZDxWK_lmc6&P5k>8+>m>)^_wm5yy=^sJG zXJIT_J;1wUk*-`Mj^_}aFTRNLh#%S_VyFkMgt0WA&bZ`u+IOel6$mB55j*$r&mYV; zAs{Y&Q^jWe&{E~&ZkdVRSaKew^ank+YDk?p2{y+x&P{91iwDot;O9059p7{MV2zm8 zF#Y5B`ZK>eD-#wkq)}o!c17N+iQ~u6qb(OfSTFHOb_7GX+qY3uOWs_Glu*~VHJf*A z;1h595d}%K^q-c$om_(gL<#6ypa()Q@CPvRK;tl_Q#w9|7sLEyv{v)(REcaOG3Y~& z1_>5YFAnVqMeG_C@yo^S?-?qA+25CE3rQE)Cq3}HbUEKpR*!GOkJ;O)V82fiaty{t zCkEn+m%C$7l;*pVM`57&k7=s^N|rRCtkaH}Bf*YU=PKD0l6vtqs`yKmfJxFPxpdmS z?%4N!5RwNWE5iU4qhG8S6=J@+vKWlmFjO*e<5e4l$Gzv>f~VTcMW@qHk9&qUZv>TC z41}jIVh8a<#&Yb(a&!`wl()F@jyd?jM&(QXpkGaC>8a_2&KBs6d9tCTJ{n+9eX7hp zwh1Uc{!{pW#@Cx#G8Ans5GnPNdE0P=MCTb*9Ij>#Ji{N)Uc`YPkrjQB6In${b3Bmw zUJ_(}hX*NB#F<`FX>rP9>nN7@uSzCD;oR91uTW`Nhf=YkBFt`z##asXXI|pZmKEOL zaCZe@jcMDqp-teIz9ix`i@x{=I^{qUL;>sBgZ(x=qU~-!GZ5&J;u12`>}S25BTGZxq`K+u*-|g@0%4GjPZwsYM};0ee0YD zV&02&Q-PyR1p+)6HiZB}&R*P=pLbB zeo?=VrR^0gjg+jQtB+v5D9a!Ut9{)BJ~P}-GQ@+Q`o7 z`0{Xy^s8cENQh)UQWfRryV*XQdpb!e(}XsCF0cwGcJtej1wI^x7=9 zOMFlz;aybxxuy?YYaA}zwySzDb zJ52J&B4f5}+^f>6wTZm4V=Qme zix_C6CwtMXX?4gze>-+j{+gK$ElH6qht&|Fvw<+4}d0>ol! z+T`h76C4bZmWYN>DBm0pB+T11x#A@5I8?#qBK$r+AR&hn*xQYycE=ND6Q7*)Ji9 zQ1?fN-8@3<$Vq|8lccgb=PeozN3r%xXLd`cFsL}k@o2-bmZ4dtmHw?>70efIirb5d zarPB?4%Vr#87m+KLhoxI%jZ51=>k{bbI1Egw7wq&-MA``e&RoG`bwPu~=Kh z$sjUQXT?C9b)I zO9nix6NC2BYiIlzcd@ozKBs3UTHl7p^U~vH(Eon(NFxYa{MceKN}JHSEu6`R+YlM- z`W#S(BmHFX5gf@V@To^0UDEf4>w8{0WmH3jRyo1#U4Opw(0#zC?|iT zaBUL-onEc}4JqkF^FMlgB<&F#z(o#`otRBZu^m0zR}~4w@Uw; zXB4ToN0ShtLxWYv?hR^J+CTd~oSP*BQMiENZ)6?Kd5|$jQdx|woFk$ETl*!teV!0E z2UFTt~Yr!Bc+{AO}Ck&l8Xva9rS6>fc z)h3ZCfl|$FEfTxSb87$E28|eRi-@Sw{$IPd&fqJYa`0+VnBm4Oj4u_lmf6SJs~Y^| zUVx~hN&yX`Xv`7{MAVstEbL*^!#@skjv#-XKhAWR zu`U-jQmYS~ZiY8Dy<7k=?j)Hkca79#9`Uy+@|Q?1vL9?)T(nn3CDweftS0+$ep0=S z-C%I4WG+r1SnCa(laYxK9T_P;dOi|>pCkx$|JOj&0c$<0^~`_s zo!01jx2BrrwBifd>(Rjdk>=r(uzWRMtCn=$aakEIw#y@UONd#b{wAShi)g|I+)#1s zga=IaAOfCAJHKdOff24nGt_gdqB)iYYZB-cmJ;hY6NpZg17+x0+tX_@EPTf)m;+8-q*=tju-~nbbLcd*Ncu)dyrS^U zgEHM{k_N5hjv_H}$EBsLU9+Kg7e4|!=A2Eo(t-L0nSURV#YZW@<6bZX)j`^)21Vmq zqaj8%DR+GHslxx%g#1r(8v@56B?7gUZjeGh4--_whiUwyA<2jEM93q(@3uSDGuyD_ z8%@Fnl3fcS1Gyr=L@cnS1LZ$wC{WmMAs9?TI))L$OBupiDe?3w$%70QW8VGjDfC;g zXrcNW0vWFxEHoSN?>^~2A60Ul0eZz^k1)((t!&@i_D&3LTX`i4hs_Lxv$Oo=@j5W{ ztlm_Cr6+QVxVD`n^fKfXHQW(e=7?B4YW?GxOnq=5KWSORLhE_chjHB{2=YsVJ5_%sa>Ls<^GlZA zlC*9iY$dz4Jb6%m5czE(1}~nyZtME62?bjG=$AF1n0Ymn)cX#QVKa*_c=v?!lcR6( zD^I2u{aF-&FtfaUBd>{nUhAeV&=O<$|MlpOs5C3*6EPxOsF)T}~UcsPV zM2)og{7UFAtYQj&+^z*J@eccA0dpyq;1k<}0-#hg5&oWV`td$T25Mx6BYhWy5v)Tm zh6bZT@NEv;To)*c;LQ*?|4lvi1)ut)u|RiND!~XT%M=;^RFS}S*w0kCQ2)z5XgU4! z^)8=6ijS`}=YicxQKhJ43jRc@ml#zW!k3-Ke zgyH_i`V#Zz=os!9hDE&A4Ea6((k52u{h&r45#%vNq}x1^jCCst!%JqV4K!Grr;#!c zIn@@;Iyn3l!;kW1m@c4;CdaqK9Tu)~Z-|Vu1aBu`#8F{bN=i`myv4a5im_(C`YwjnXr2f%f;KwuHGR+QNXJy#@}0CV3Af!Z}>KoMR1 zh8$5>$AL~!J7Har)NC(W-ca|86mv$VY_U=VLcI1uk-H#G+I#^?_=6w{u@j4)TVSS9 zS8_O?Y=@1!Sg`bn2jz#xGD5)m7tB9&e-s&LEPsrR;otlHfV=YLC>q4Vy~KVOG$&sE zXK`4yyTF~!)@l+(GI(!ge5PCEaGNulHzBQDDfm@3CVo6uzwK{}H&SV?L6wIZ4(uga zs!_j-CKP=pwN-0j3@^Z5!FCt8o|#2>8GI1j!c|*0XtVHK#7ks;(RRPTm}#M?D!9iF zl5))nBZAtFd(Jj?%jMp~xm697|JJ-Kfs0Ex+J4X&f9^Bt7BiLgL4)b}(MAI9)8|fC z2)yXJ|6gi~-rkWG1 zyjWotw8n%C7EWKr|9wyzgJrJtb~h@9=SQI6UuVDkV0PAf;SO(1RPxWra*JO#1iwtn zHAq$^3^QFN@p=s$iF)ON!`dvKKSAiZ#tIh!18trzIk#w$VaIoxnz*|(k9U*W>XjFY z@S4n`a$_+e8p{ci8Su2tTZDA&|!gx(Y3i{tDs0Z6UPbg|X{?tM#e1H~1a9 z+l3+GebxP|+m+oHdlyqN6iwNn+Z1Z3F+OH%sE(B)BJp#o6<7#X0iWtUZ$Q4;&TNav zN>~*@g2i336DMDGqm4^zmr(P%Qb)7&$^}?rgwrD3`Ug`9|AgE@JYNZ~rYT%%5nBqP zV@Ne&NcC&zym)$hgjKxUV0Xc{qhXiZS=~YEq8EjP>r~)zM_XJ@8efcF+WlE1glc5I z9erm<6YpLLZ1m;gW%W;TVN|FhWQN^e+!nU?9_vx}Cjyrd)^@$pXiPK z605#~z1U9>bN*(?Fp<3%tcmw5HD4&mFMx>Xr`%x@-$px^0`h9;IkoW!>*zi~+$K*| z^?I8Rz8xkuQm*Ko#lQBqOf^ItJRF@07c!ivsw-IrzVt4kU)~e@g{4JV57jDKbOzZ?%_?;s8eRU3IHqDVa?$@|~4)5b)bT8M&mpn^mK z5j19gvsMW8-)afFaV1D(Oim=#vZiK6=Nq8W+|o&lyv|{HVJVfq0@q-^Za9^z(h<1) z!FHvtJz-nNN4@dV!eOH&50;Z^~-PW9J_p$`^8Ypr>?wlHs<@==k&8%t(QK}V) zzvk=6#?$`=&=C&)-m9xHRfQw$`PeLy#irz#D(E@Yj%6-C-{9fHauxnBhwHpnXsQ|a z8Vk7a&Ln=ted(hIyB_x}EcbI=A62lvjl&dsw<-6!Be`tY%?jESJPAFj@WMjj0V zzq}LE&S)Py%QysI$Af^73XNJ1wrUnLhsFOzek+*~bMLY9#g6Gs%AjPTjOdDExg z>&D?wLUR%N%F+n6aZ%QUo+~E4ozEK5Z;uL_f+~0hIJMkg2>UK-g#>_U8rk1`mAkKOPu!$sX1afiyO6 z39}jo@Wv59r&94NJ$r?=N%j`e{RBI<1SnzvNb+)-h<>^-z?N=F&g~3By+wbdtN%=$ zfc7Y&oFjmEI{0b;WLw>(hIV{2V5jG2_~(}s$flCKec==!TieD!YA`NLPCipfTHErw z3Qn72#yyx>wz!w2DwVg2?uv->Ei9fc+T1V-fqjjPMehgCo=-NNF-s5gqg<$J=tP>A zGC8eXI~e;y%d$oPif>c1|JoY?hoZvNMW5X7AuViIPC^#wUJHa?b$#iBa{-4tSFcxR zqt!qw?Y}B$4~HIJVI0I_8sBijHmT#KRvj}!jsUtsBT(>wp%RFf5mBr{=~eOq8{eEc zPL@>fahAbn;gfkbKa|edj6@0-3L!y)z+OQykk+SZ8kXXada6X7g{oM$FGkY-mOvRh z9A?XoSCtOiPNRmtPTaAGPV<<;P@mnz{~td~^hcHZ?ZeORCh}YYX zzE(5oF8(m_pivsxYD}Clau%T&v)4T@#4w7n`XU|5T=Bw+A$`#T#BMY&(bh3sVD&bt zXqM|qzTR{@{jbciat)`My$CS#C0W`2hU$H0mS_BxyFOOhP)uUN8sv>2*J|n1yh}gc8f?(v8IU_v&O#LnI!dF>-XM_t72<}+dO-_eeI=&uG z_bf#3;fdML%E~gbp+mlM*&ESSg*Q|9^XzK;(~~CkfImjaef7Nk&G>QPD?~gwc7?KTGd)RM7^!~T0pW&7w!r0V}nD%Z0$-=#z6AzknO3X zj35DBHk<3xo&ZKjCRKzw9bUJ#&QPiF`IMzCQ)CTT^GwS@t>H_0REFrrdKphO`H|c3 zC6SHkSkoLz#uc0lT#uso80UaqiSw#(G{ihgUa8x5Te<%i{I+8S#Vh#QFClgVn|RRA z%j<4A8+;wh@yW>gzlQztb9IqqGq3Dt)Fbr@U1Wzjn^K(ffT|1vF#dW_IYYWFlHZ8L z?&3nxb7QwziI#0jfwZ8Sggu2_7Fz!toUk4HR;CWV@o+gf?Vd9QFNpvbi9r2%hD?|Y z%65`(?{qoq|6nC~@z8792Iw8+Se#SWaRFWgY89UR zNXeT#FT%fK$MK_GgA$5Wcpq{+&snP5Ps82$1Q@WRm$Ix~9&w{gB=|S!R$Ni)>&+9& zpHH}7vTT}=CA;ttC13Oc_W5R8jIj~->BCs*^rLkF8z}Nnk!Hfgf!N2hA}v-R9w&af z?i;s77{CwExt90!t&BYQqb(o57iY)L_c~)!0g!ltdd0TN9IaF+w_ebo>FO}!=UR(O zoBRTrtLBZazQt{qel;0x$?ZtG0N5G=g(j$TsrX_|X4F5|~&FeD=Nk zy^@BhS)}fp)D)JQvntoh?gMyvL!#NzhcJ@yt( zCE7a&`OsQg^p3#k?>YvwVj&x+GObJ%_EI}yz_JG2mz{PN`iAYLpV$}o{zU44z@%IO zEq7i4+l;Qwj51Za@aiFTI&5WbJ7|&;w?(+X`M_=}z>cy!iY^2oGZAN>{Mz4Pp~+NB z|J!?^xTaBzHZe|FA+Hr~6 zX73d}b@C}TGfxt(3a`BVR*Ocxk$%?G10ql%>5WkGHlgJC*53#yLgc;4bh%{1BgT|v z9|ZerbQL?AU+vsieR^@%7tKPVejQk$rua2w59XsWlbb$sAH*QCCDIULBN|qeyLO^k z?w>V?N*B0pTH+X&Fi&83!`|`okh!E?ZxZ1{7wQ;6jIJxbm|k*<^4n0lj%Vt{FC$-$ zd>7*4rtmaki@X3j4>cmE9@gJ5rL0n9xBUhIrhqcWJOJm%XpOVi-@_O18FR2_P@kr~ zYhv^M#dmLO9P%gB%Bl>f`SKQY${}5)sMqd)dh!TQ+xxWMubc1beS#nR=@y^L8k6)> z2?vv#6(|pHjQ*)3JqTFCZ~kS71*-VTw`%sS#S}}V=d5G3s4DVmFZ(V-n%_p9@xmxH z&BtWOx6CEtAyo^#4@qaXr*IG@tK5*jI9-c;nvaz+tH)U86G|82Szc1{2&vUb$UKf5 z7A#t?zG?r~>_N&XjWUuoxKVlD zrF!L4mm9wMPW&xLEQ}33iE#2giLyaSrXBh{8sNiY=aqtBxQ|6r_x*;aSP}Hl)uY`@ zx%Uy1pRH~(E!|*_Q+E@~)Q1M6ym;a79Y(Qq_FBvBvVE+72Jk&{Xawa?p7)`mmp)}z zEBA`@L);mBuuNq}$1=*36Xr*^z>OBcXRI_y7rcd}F~=HL`Z~K3t^hRQsYfkhJTh(> z?zOZ}APXTmBnJf3bLtXNO0wTi|0Nj9JAY43n62;sl@DP28(%fLh(@s|aUzg>Kia2GK7=I_RWX7c_TNb2b zKOkKGp2LkTK%)7ByJ1~UcZY?=2m}d9LT z8t8Z6^tXf_gx%WqqS8K1Ad+HUBlB4Q)!Vq2tPDtDxV1rUPbi!XTx2whOw@Vawh0ef z>p?056)pqkhx+@+#oHKb5~tfMSZrm0LU-R(AFy`tc0+&8MV&*h&}uhh;b|LY8O1&4 zMJmWBX0^~{ z1s&*3{6z0Dfo11`XXoQ3_;ZKvmCCmVenh#P%RJWf62)XaZI65QCbqz6JC4T+#li5r z#HMCUdi{t5PeNH&u)?)2U%)Zu&EjHd9!^Ahll!&=*sO41) z=vFt&>;lCy>l)#3fH#NqX+`Zmb=94D-;mie>@|sk>(v~Audlh2?Pw_|pdlRg76A03wcmk7tFr!=B+Oa1%`2!e4)=V&X8w(*9BO>Ab0T z7^cX>%xx@YKe8A8ql#|Qo68@&w9PWLLUm6)qy$#+OnumZIRPDSjC@WWQ%O%S-=&us zUq2==QCaI&o?WZrui2kPZG~Hi43@8s|Gcob_o_x>jwq`Q^H0hF4w`dW+ywhE0|8Yp zWxzGU{s3&~M3JKUcC>i*FHNa<0+zSv4lcgVoM}x-M-Yg!MgGd6$zNtVhMX))lJRF6 zzoTqyVYXE3<;HQ8@Mf}n9bRdKqt~>&*ns%vtnyP()i-oI@^-it*Qz(Sc4-P+ef!h9M+R*^;EWN#o&01*CzZ1;_duh5`9ucH$9k! zF6pdy#|Rrg_QEdFIKBblnGhTZIH8Y;7}40fhy_ydmGL5(t0TDNGP1{^9}DO5R@ZST zyP8qn?kQbD3_U-t_Dp^wbvSjaJ4f@$du(`uy&-{tAoj9k8@c`G zBajA^Cy^lH0<2J3f)jxW|NY9Ia_M?(V>KC12j@1&0X^d4d|$Z@?Eu(XBEjBcv+7^a z(6~*QAPusnyWt_;sulo-+r*&VzfrFIsiFM ze{=#bVudcbm*>&1-D~~s|3|5b*suqN*-MR09q2F%9_eN+VB7XfaEjgK>@BH0WxA@%K6}*KLOzRcBb~O zkir0fy@Q*Js+1^+wvH|d%sBuGfb$ty0QewNS0@o=W%+-&|KH(x1pxL>$s*%Fb^X72 z{zod3nYpVe002hv$sug&;jXyD$r<>D1IQGA(XqsRjQkV61~*5Uu6nWO;# zZQ%d_&bkxG1@!O#Kzyd)78U@&eHj3Nqyqq;&jA4NdjFxf&$55Y0Y$3-fcmGdr{r{oeu%80|ski?x&;Qon=g5^OJOcoj^Pu>_G?0f{?T5zWKECnEY+eUN zqysMdQqzsW;?_!RntpZi`En@fG9O%|t+CRD@f=qjnq>e7j0E((uqV)dWujCRjYaiy+$(~_)xQns5#?_L`vIc3mu~3WOLhG zOTEU@WPy+&U?@Q&gHDEQRoH3A?H_N`v9B*X4KHdPa?l2XQ^t!k;Bq)3xS}`nDJ5&1 z5iVSlxq1^GqPT_|B~m2wyf5w1k|r>$#Y#ri}K@ltvi z*yT11X~)w5Id!}keK8szX;^OY!CGsW3cN&RWDlf?6=?h;qCzPhNy26uWn-9j7%3A> z6*b7lau?JnA_MTJttcv}N?Nj^K%WS-B^p>qY3@i^{3i;ZO^Fo}FcOWTdEE z{{9p-WvY6icqE!mGL1@!cnK4oX0!%8h6WlXT|7f&va3Z(V`UVb3T1=ja(!cPMj?_1zeW=47M+);|b%8!c|MaERF`)T<$Z31Re@eiD5bU2lZgo(?@ zpxxqnRO{bs@ZZdzAOYzyu!r< zh_u|{FvfbqGYTtiuZh@xr1S0t3=;XmfM8%!=zGiL186eL>8V?34$x6l{#QJyYduilIKN(JgY|Hr9r6-wedL? zwgF5==189oWBWU0YalG}E;Ix`0ton01A-?+gLzoaq^S=G_g3ND^3`#6H(D7d>aX*X zJWi8bf5r$E&ECt4d48ES_Ds{K$qxw$gvTLqQ6+gqJ z()DoWdh4}mp6zDqwawO|rpuN!gUe=CZj^N$rK9?d|U0>-Vc#wI0W7|CJU= z=MzPX)^`{$i%qWDYhS4b`yz`5%hnFl*c%%1P2A7gVwg?8+gGU#t#OsLUMJW;Y!t0| zl(za}ZQfjhIGXG&U#r(3(fTv0b;SA+q=yiq~RqNpb$3$jsE$ z*;T)@u<;Myb)V^GQ>%STO=DG=s^ro)xOjVh`z9^bn7?Un3-sgVe&E{|A6g2s5?#?< z|5vE)>MFT4x*6|r-OcDS*h^GuhuQ-c_#&tmG<@(6=0GznEMs`CwuQEZ@FolMnE96X z%kZKnDDrFq68P_q(treX>D=Ub?6`_%=h<)#6@hlMS@VH%P)w*$TNuCgQ9725k+xzJ z#>osSAhX0M<2#oNQ42JMG4YZXz|V`@eJkq|5X(P2-m}F(s7_3<^Bu_Mgba7%^T6qxXk2SUgdq`x(l1sLRASG;hYu!; zJ%LNM(1#8bto6&ZOMxa^OdyhcAaIUk%3YGy0ML=&wu*NE@Zr`PHxyhyD_7qU;lnSW z^0fh#gz##$nD}1kwHVOh7f9J5z8KItrQ9r$NXGHzy4%1-eBs!k=0Sd-wV6@8q0e|UIs;V<9?e*M5dx@Ans7&Ci!u}L5Ejg#VT1*jlxtYBNF6<=i;B+^ zN#RC`Dzo(+{mV6ZvFY;=c2g8b=+aD}OTtB#+eB?BVkGsjCrFe8vNU;8Rc@>kvu3E= z=Q^;Eu>8s{xyZJ7|=&R6}JhZfs8@nIw_iW;%azg$Fii&z(tEo2VP_RSOeEtBTMd1haGx1Z>EZ zV9~nG_*ibkm$98}a^Wo#f8Z2b%6waeCXu?<&r(c;CQ`bOl2Ov_EEzElflesQ+-ezI zKvikR&i3FX8Frf(+(E-hPajia)1ky6r|wXsw{?dA5pmLaLlHaRm2;-z5)>AncgBv- zt5DhEm_XOdt53zTY3b$|RxMBQNfqh@4D-DEs~>~}D)GC~LzYYz52CrS?wH+Mdp8}! z2ER_~1IeXoQpp^&YVt2tSm&za%^mgatsewrO)!%E*zGP=79s z;%`wCAtf|1KfPL}Rm+$`1Yi$!RPJ_rPUHS0sEjRRLnKP_U&+%IaVt?!DOJ(8{^G|% z&zn9Dx9y7!fw~8TCSK7|`Y6coVxVJXA2FUX^jQY1+|%7Uk9y?5ekExdKB*#t`6H>x zKE&a4eG6%O#fbq~PLw55314U@X0I^GztA;Pc$htZJ*sw3^Iry^MfEkpjIcymPqkI& zi5WU`KGkB7k)zL*rBb=(%#*Go*HJQMgU(zc#P%s`nc7C_`HnQ2!K&kGeyUgQPpXAv z%#ubf&H=rDfcqHN7`Ft#1uPL-)}OlK-d~%u<1FwWb=}6#(ccL%7c%$%Ebn9WBU9dPl7UFfl&lq94mIY1|`_(r@!)b@VTj1k$6VfvDWx@25{VrtX1E( zuowSlv-}+S$Niw)N~*X$6*~4~rt@~2Gg;zod@(V$B#!9J*ruVY6q$cc7Ng`qZ|Aok z)S#Vr%D}x>WP!~SjR+baI5qjYvrrUq#0&5*Oyr)^s78IUr=k+%v?Z<9(+!(&X=2yqC`vBxVegXX2p(d-KAsv zJZxLksJ%745z4nG5k#eBVS?T;IE<571o-XfsF+*7VKz;o`cujJXV08Xm>f$70Qv0ml~!hAWet*P^r=bVq)}F*bdVL{iM8s1uDpLKq?H z9llLRM9`4#uA_JNAVo%Oc>UPvbgO zY34d*Nw$*oCN7rj?Ta@*Zd?OuZEF@UvfbG$;GzGPkXyGjGT0Jsw}^{ZHVm$9FD+SPI!=P5ctIrXQTAHxcQtN4NQB zBnz|z+prLhkSJ|u0uPbf>V>ll673@K3^m0iG-pKh5Q7D1w3cTGIGMp8e>!+B!xGk! z!T1&o_n%CtuedGSva+CfXJUV(_oc3z)NDqGOVXb}i&I9w#&Xu3TswG&9>*=$0$eUi zp2P{7>BY!`gQ>;D$i%+8#*0w}2a}6ZKg9`ROO0+#Nh8rmjl8s&FkEp%Eb2n$#!4%( zsl?!+u!5P*BVH~g^uje+U5T?ZXT*q5^7$)jwBMib{pT7 zTn}DvtLwS}eo>*e(sNA5)Sw(X5(EucEFEF1+gzw0H?0V#jNC$~=b^J>I*@IQdx}%E zio^-}-um}zp)Y6~+FGDChF9oR_Odx&s*Y2N7YPlx316?r|6Nc?NUH>-a~T-Kh7}4# zH#II5qcl)O9fxymR*#S?ka|!{xTmP_KunBb1av)Uw62=)gQsJMFJ{n!zsrrp zw5}CzM-U?G`*k*x#up5r7Z{K#5{L5;qT&7?L@EtS$xsJA=5C(%r;D8T*gm!Z-U^Fp z`$$(V%MHm-LfhGCby4#wC^Ir(;Y4+;DEgVc8%j~2Z}ZiXJFKCRf`Vjw@tW|z{zU_$ z%8}>uZ-aZa_gWfC_cr}h=w!M*&!f=Y77>z6-Quz}15%DO{ZwOI`G;|$dE%2xk6}ON zpUpOs9&>(Q+l{aWxX>n^A5~l>oHy3AfG&qM60Azpf^=egg z&|p|-mI_NSELGwvd6N0t;cCn&XJ0@GIi>arv=7Zqqd~!)suz$eN#IqWM1H zz!!Xtl9m5YlfM4b`aS~>K}&!XyYADui%jHFWah2qp7ykLl*qMM72dx54MtsO3VVE~ z%n`+xZ3O(3^{>iIC!_X6Wi?3$zclbWi)w|VAHX6g1Wy-!_{qt$5aG9W{K=;cSsx%e z>(EVH?f|a&LYM5mve_n7uj3!@6();Z1DfmRnkC6zmmtmC6)6 z#>xU^XL0+1Xi{bvj_6tvy@g=*&I^IlF!~_qa6C?3aT&F*!X)!$kl9>aqyaS6x+=QN z;>FBl0y$ObinnHFPA5O_h|cbEt&~O*20o|BP}p?0XDi6M(pPGW1tG|c5Ocx-8YYcB zL!mcL$jK;6)!&TJc@aMcgkjEN>;j^yk@xY>Tmm$1^L~HwNhFziVmry1wLP?zk)r5Y z>==o)n(J_WM4R-%dwl!(+Ae%3+1NzjA~b09kTPgN(z8XD6>DJPp&Cw*j{gS1uv>+@ zp~2d?`-AFaq$p~!p~25&okmZYTC-(qh^@U;!X$ZQEA3*`$G5bpnQZM!{MlyFbk&RJ zT7W|$;(P&h^h8Vg?c9B8M1w{m`l3F;K!Ken!b)S$?@@wQi69*;*rkw`%wf&Y3cjIH zwr4uGaF=oOHnb4mCEcsH95q6q2e^fPYByTpXY?FfrblK?7#pm|sy*R5aEd0%lccA| z3&A_zb5uVbn~FI=yHbn8v;%=}?{K_c4Mtr!eX{P6d9(f5!=QL6wJ9WmgyP<>d%9?l zhxMR397HF>8s7D*cbheS%%BCTQ0D9L-2Dph+$NN4UA4mxr<-F(Guohy6c2Yfj@*Q(4&S_@`5JApaCxx_0PBLI0d zBB6{NA8P6$8MDHOcS@Bu95?UiG#&qO#~Nn2!W-m9OS74DI(Jno%3pym-6N!>TUVv! zdu|pYS{4tPC>50p6-;IZG#P)0ggbZ@R5o})$gCqLEaHS^TRL@stH_8mKmu2p4kG8h z*0eJZdOb3*Vqf1!*Bj;GZ9-0xc|YGTyLt80c{XV(Dvd*?$4Wwggpv83i}K+%USS-B zEXTvJDH(O)<2iE(Cc%TdfPxBjt`oO}V_hqMpn1Ekam2Ax6x#Hnh<8^%E@z&Rm3*JA zu1;p($T9uggnFL6OrJqm=G!9TusCfKBGv<}^)jHFDF&$U2v_0=h z^OBUzzq1_I=6W;ZRP?j|IvzT%H@sE1d()wuW#cYD?(2F`gjH}i;}#YQ=8Q4^J^alQ zd`7;1xJn?`VlU)vTZSSFRUu80#rc-_qonKE0c&;%+%Abq)V3kn-|v8T;>%T6*OX@R zhAKY-UqnA{2&i_1?N$%n7400%zX=6|Fzq29*TCny8HCFXT)j}08#@vk4P8E^6LiSI zQAopZ)J{J7>yRogtC^UbZLoI7|(`b%BBI*WiuB*w~c4Z$`n;jwtX@g zwG->mi-M9A$?@#YOz`2^nF2V%_UF1d&r7f<_-$Hrdkm{6D^&_Lxb_&xdQz+Rf6ss?SV9Bd zwz*LW5m;Pl(cG5MptW&X-VPB$AC^doTGh-X=Use!M1RO9F-mZ%NCxtKA~+~gNo?6 zUpF0f%pSBOFo`qOv^I%6&dy*}U`M_ieh!!VB@E1-aUADSJW0Xh_{Wc-Mm`>5)v0D0 zHlT}j>37>x*>OY_RU0(fc|qnX8yKGE+80F5*(G>Y-AT~7j5jdCxas~kQU9G_5vKFs zT*0jS;j!`fgbm`khIL^71NKT!mkEAiu(mcP!Cvo&9CvXLSxz)@vWr^`-j(;pQ(UO6 zhz}2rOl4WsW|&_Mz>VZKbDzmFo$zEwSIIS*$j(*bvNmQq9B|z)Iff`c=5XtvN=e}6-uBeSLYpGmUe0cdh{nr_h zp}QJb&E)F_SMsZjJoat|r#lY7cAnD1$s*%JqwaF2Xdj;)wV_0)S$n&WAQFflf zAD>$?s-~AxtPo9$IJo)YB=_Q!JTOT>uOD=jF}n=qR(krMCU){|*Ca(BQg$gww3Hv_ z;bO>81csfco&?gZE?+UfUo2Eu|0v8O)T#}1bK;uTy`)fc|c64w5jk-8VO|PC& z|ATV=R*GalrxNHUJxK7$9;^s?Z@$*dG~f4Ql3|L6p=%PN3!;aPhls9|j8*dV^NINR z5hC+h;^qG4Ew?k;OWT^$6H1qt3v#nVU56OB$LbbGH#8upj>xjM2qjGA-?t-dZvdGU zSn)dxo4w1!-oT5S=H<(#e|b zY~iHOC=Uy5&A2{)$_3mOCx?Lc35>&Lprk0{U|xNAF1y>oToZb-wQ6vPS-%^y7;kojRwHpV@Yv04SPiZa56mzW_96JM}-|(8$eq zO`HhZvpYVYdl`@v9=@(_lDHO$OOWauTy}wB<3v_S-V4kfT8+O0$+%n10&BjeL zXNa8dw@hV3qOdRP2&Ie-^W(Q)K$zkjIm`F&IFyW|^Gf`r@H_RslTNS0kmT_jP1003g5e7;4oiqY?{rg=c-uHT^&7+ zU6;vw9x)?#rx*8Sz?dDSbmXK4SI$8GHWtk;ixbCx@+{^)cQth<#cH^bk;d!`iHZ(I z4f2*nX*fCBIGNq7&AyD52T_p!8~ZgK`vUz~y$Q;FD5 zsLf2P63JW3v8&@26*l(>+wjSR*3)fd|E{!1656Pm;R(?cNcl$@!Mz;ud63HiP1rrn zN6ip9Bhr$wp`YV*1MKo;a$qND&Bg*Grh7|OR{v)D7wv{>Fp+ieY}!Da`P31LUYnH0 z{?P|>hk4Z4?B+hX;wBt0!dBvWsAvhnmE(L>Wgv0W7%j)O7NXibz+D@YG&sKLX=+>k(O@2zD&{=m&4r4>(H^s-STEe3H69xH z!Y&C4EWgaCnSdhxq)o*Q3BVmrU;|i8`1Q4a^1uQsN!68fG3FJezi}kJDkw}hc;txpiB;fY%DxItHY>H5oG#m64|2F}IKq+$k%rvXT!*?Wq@+?^eWeX9Bn4<eh+w+&^Zbsn+t7a2mCy^7GKYK z3lMxEnu8vc6@H(Ear&Bf86X{=2?X6_n&3+hY5qn;8CFuP383h736OHht*PykES_dB zFNa=RZ3xYyQzZE-?K|DV5*#cP3e98NLUEYm&(yTL4RM^=QZ+u`4j!QDfOWHDXyXND z|HoDdm6BBwTSb$6F9ogVg0};(cH}A((i32qIrZyi#a>)>ZH7``yaMbHH)ar%A}m;I z3G3(XU2w~Jpk-3q#mtMt5%Ss=RHBg9GzT*xj%O*6GZ_Kr=jcc}c)35J>u7;ajYB=# zHmV~h6I2l-%gHslo zh#31A9&uB{MKznfSEHn5W3?Nqi-jt!`OkISUih z8@W4Gp_2QDI%;L0`>Ib(7Zuco1>N~GCRBl)5FcVYS+i}q?|U|O zxXDf(s)N;<3yqE?umg%w*j9F$_x=k`ZlPpH9#ikrKt}tLLB1s?X8$mIAnoUNDD_FW zOp?&<@WI1QOV^DDN6*Y5;oDqXkV2n7`>Bv%7db=&C+vZ{)r!Y2|4$b=Ub&gF3m_}y zX!)%@!c;4FN7u6^>6s6QC$f1)KkO$~+6+qm<$@Jq=sM!o=b@;|Yz_h8gg>&UloU0i zZ*ra>_OwnGEE;uH{6oW1T>r{WB%MRKeY)OhwptQ(uw0NDx5BjjA-Z)=sE7o+m9i}T zjs=~|(uKKB75zG)vv|~#O@yodSIWqUcJ5gmFfVk}c{w@rxjk*PX$xTsDHD3x%oBtN zBXMyz%qA;Eaq*pax{vhT+rwP_O69vnT_Tyy9uAeD>qMf>Nm3aL956?aa;z0J4oWf? zn!Qb~h?fx=(cCa^gBXFCCWr%b-U8KbRc52WPmQ|;ieTi=`J&tVMxSy7g zxk|NN^nQluY=qJ$toy2XPtiNCpvW}!0Z`GTpSZlc!H479zVt0;xWYvr+eL`TP4iIx z)F_LS7*XCbC|?y<@n%h>S)m{F=Wpot%1qL@OzsSHL@-(0$5?%f&E^zzz<{49G}&zQ z3zVK^a7FRrWU$35qj6jbn4N6$&wB8s$A}L;HzaxJU@zziyC7*YVp;u^{K{-aL2fN) zy&clrfV++8MA2YB(ozIO$rRD5wNesY0xah@xgyrx_nX5n4wZ1*#&|hW4KKvaD`h^zT z@Rd=x=M}MNADsEl+L@haP4v3GwO-Bh@9<9RtA2brlCB|Owp7LQZ+BlEr|9-C$d=R2 ztPiw|7vHkzvHf~!I>dL&voB&FxQ$gv0$24lrgutCAJ69oh`#qLP79h1whYgaC^AX8 ze%d_{zfEDa)<&)fh!Ke~qJ7EYeCrNFd4ARVKtGO&fzlq(ffyelRCn*~(S~5#cPwj^ zLQ63R`RQ|qm`Xy`hQpw{$Q<%m>4=j7>aWQw{96tmXU1aK9ENhRBcjf`cgdv7uo9qCBhI4Sf}VOMvV#`;bwpP1z8-kObz`Qd;9z zQpl`#Y3vOVb!O80*a2}Pj4Xlf@CWEpK1>5sS-#zcnj4lWIrMi8m&K&&$xTQKiH*;) zu`qMfTXi~SC^t475h{_)N1QihDO_n3Xa@xz$4mS!loe; zHr8cKa))Z96CQ$&T{8NJBS)9XMD(@e#cSy$5yh{P7#Cyp`(NYDR?W)^1#2}`7si*) z+(HB?bjzzdhr`r#4BRRCGzhVjL5!I33(#wU7tJE#^78&aRfT&iOk`ucBgn{mtr+)~ z_^XlUi3ATK+iiVdX#^6oN1Oc%s=K*v;$yBWk>ukNDKpcZdbSp;mkm0fNX6Ypp6vJ^ z3C6rjyDRDVE8Bw5Um|FsYw~9#pY&~tBySTbFjG++5p)SgsQ7<&W2Q8>l22z;{poEX z*zz}-kCSGOou1g(i1s6>m{eCoeHQ=G;vO^d2F6GP5T>g!t z>)mN%S@oUtT|T}}+xqxjf+f7?$3G3tV>efDz^x9AtsKC4hUef<08ggZR0FlmZ_Ptj zG$Uoox|QEYzi*Hxxh6_K+=P4|loXY97X5vS`;EgB20t z6sJO;3nyX3ME`Ury=NQ%Kf7+cjv z5carre#R0*Yr)@?1CRf%>3f{I^gW*^ZRrux=`|-+jNgZ)H;ZN=*acmb5~+V?cS@m7 zybM*GMiOdGNud`Bod5Q?BIUfD0N$z`+zRYfq2QJZnLZ9gX=OZqVeQgTQF)6aGbPj( zty5CI32Rj-dWe~2?F=%c9r{AfxSv}9-7J0yqxYJLLPo~LPw}N$>0`t$mEx9)hh5Q9bW;lDaXU6o6DuZAv4w}LE7;9j*k~TWB7cFS<@UtWc(;yTA}5>;PS z#k|U(tfMMT9UiX}ft>qIs7W9uIgC?DrQ*n?Hyh#WrUBUF*vHkwC|#hJuR=EGiuMqr zAAS&%m~hzI6LN@>cFe{HCx$6!VevYqX;gv4EH)`CY0sApzyV~JNT%ANuZ&_1fL{z} zR{+5GbJ1xyM{Z*G_WJ9XJ7{^XQ`6RbnLTU5!jwVaxTpwP1#gfI58xd5#D5}cSmN2K zSKAP~JO#-T>zXu2$3Zn>Trj_R;U`VjebY2#kW0i1fjsI)@;Yr_^aaYcL? z^;r=kRFF?ul8@fF1F~f!8(xlK1a}J9jPk4TR%j`09ZCCN-F@I*a^1Kw``VJ6a^DlH z^i2huLr3@u@0r!Z=_QA=8mH+#e-7^sAqV*NUT$keN0fji)Zw2nb2yby%!rjSy8>yj?}NLcvyqt4W~8O;nu47$axCBazg#Q5Y96@kheq zvT5RylbO_|nO3t@a3RKvLv^_>6RdS=DYx*D_Bh)_v0KEzI>U@M^pKFzHL73)7`l2P zmr63Mg!(A6(lsj$JhG6Im9hsn8M{P;F#;IE1zgme)ZgsE!L9=gd3H360{PC^(W{GRW*CSZJ!KPMXP|ej?~jOqd=n1)gOO9uz+-|nZqwLUJ$|$XI6;b&*laE9)Yh{YpnX(cKt*pgv zKq#m3e7b&5fqr?1TRm(Z6No&r3o~X3Ql@&hM28Db|!&aJUS0C>T9M#Y5jU7 zbZ%Vmc{s##LFe@B@aj%qm!VJei*KK>SRAWqrj^k#T5C_9;AhL2=f;oJl#SEua$nvr z*~D;vYWm|0=??pqi=&Dlcx1Yy;`|-W)lUmVwsDw|MPv}Xl&gY8zpV-3klsTk<{-Z0 z3ghe`013Cvx&E11-|Ynj5QIhb<8%9^iE!!V zm0<#VID{ zz7^c@2UO4f0;ETo&mW>-WN%4S70#q?*$FIr-xcw9)vsDbHF06)??ewz6jm;oQByubNjlH)-U z9Tx*awqQi>B8Zl8QVi@+WHyx(tGFJJ@ePFjgy);}Zf?qO&hYc4CfY5S&AHaqrhLc0 z1|PsWYj#N&;MSA?0KA$Qh~_qFg%u!4uF8paL~aMCaPPbo*yeTs{+18Y!X66A9PMRD z|BA5zy0FyFyt(;cs?3xk%&QfAEDYcY5g`H%#SVm#-OYR*e2q!@w zzts>m6YQ)`3daEKudyM8kn3omsm#Z6N% zXW9%_H4JzMw*etZVdGbdLO#HWIq7q_iDO*yJ z$LMnG#UGGPKG;Pq2FNMH?YP5~y9fiN&)~J!bg zz(@k-hRNnA6{lsOoW%6K1#Dzu-g;?;5673=%LC8{?qg=VjB9=#gQ+%97naJ!5Bbg! znI783Lw1TmuShyW$S5JF5@E9hX|P-TkU;iJ@LZf<$x+y{HmM|6#G9|pWer@z5UsQ! zkt=gd2{Ao}!-hq0*K7-mfSdDzDCU5&J+urnd~!uhEA|^*XuT6Df<6Ue3n!s(NzF4x zybTK-r`7^3Q^+37&9|}M0-)4V_E*RQ)wL4hfHg<}Uv|!S$Z-EUUU9WcJiu9IyMhrh zcnswcc_l2u#q=Ize|RPD-j}GfMf_oVG`N0U*8agU<&ptju$3W__+bPmeL}4GXhT*y zR)n1D{x3Z--?`cJfgX2;LU>N~955u2$C)-ZGHzePyQV%r_kmAG{4_tf3Gk!vQuReJ zP&VLA!x0D&r69X(Pe3}e>1YBfDr!Q5N{G&I1ga^OkBHX527Sc*3gJPo4U4WO0PEAR zG-G()RvMF2#Ak^Lw*lyI;@P=|83rN9v5Te;@r;k=rZi>?Dyb-89o`|{1KFjFP9JKq z&0;!^&m|ClYwq`BUOHd|M7;_je1Lc8#>Nnbm6h(ssqq7R(}vu5V5p1ptNSXT3IpBy`cHW2@q|?}aD?rrA(bU|Io!2c=!B6~lC;ax(OKu#Tp#kFs39+F!Ww`F z!`9BC4^t!B=vm@D8?Tiu2gcVtr7HKYJ;FYcjiNtpleesTpA#rSdsn+z&8%h<=YI=+ zS#k9!+AA_fCKzq=I8OUKIMNAkCwys|n%Ab+_b23f1y8p?#kUc`udx=4Wwbpkh7qca zOh6o!L>-lq)`t-0Y^%FN?PJd-LKOtpmz6$7>L+hva6cC79w=W!=jpIG6qH0CT0=tIwZaK;wA}2q z)Gf*fiS1FG?&l;ZZ3=&5Jm6r5lven7y(f#~^mtr7VgXZC*~SkiC*Cx2Ug;RJk57JM z!lL5gv#jcZeraz@xmyXOI7a?!?KZ@z?Az3+cxx-N6E*Hh4=G@<`?`0L^wl1>$P?BO zH}3DtAseIW$IsiV?xx4MPI%KxgGFHfJ2M?jX<5-V&T*VM?5)2b+eMhoHE#BD zyOs$6$66OYOVM^J{4UghdZi;}A2IF7sj+s%4H z{cgPHK}IVIRmYvu6lvVDTL?d=oDz;QGEzJZCoTN7cHCh*YRH^3^5Cd6$c452h%p@apRTr9fcb{U&cS)o=9wD zf@F5)yL_<^Nj)*e?!~sWnUnEe3>cgJH4X$BgKq=;q5QI1fed{@;AEP??1#>VyYS9} zSd!KgZg=B%>FCIJkuTJ;%B86k*+)|2(=BK+ia0PBy>P5Q`U_ z>L|iLeDXMG@kYt!;`f|Jy%fuK4tCx7`;Sgz4ifmaW5>$rJD!GK5_p#qF{IH@%Q|{_ z?k}nJ_elwzSCiEcq>7iV)IJf96@cD~X3kt}O-^0#`$U9!u{l}1Y$ zp2HHMlQmw*_I9={1AVd&NS6{JlOCUlOYVr@dB`Tl%;`!%-*mh&Fan4{TzzLdDi`*@ zQQt^*%&V%GZr>>gT9Ve9Y+9V_W@#8Rn23Ho4-DP5NSZCD2y9^rtzFPh{8L@_gYTc- zn!{09hF|TaM&p^S;l+AxhgMFB;E~S6o_w++8bXS~)=@QlUEGCPdP>;{sH_cms4Wq% zzy1*6{hpos7WQ{DfY^}<@BYLGlgar(n&SwaqYK$+3r1?*y#v8va&nES!S8Xujn4KN!S+NZQ44Z-uo6RZMk7by=iz6~ zuHm5F4&%=9+)TY~5^r2We>$`*N&N1-YF7nme$O4`@*G~~PLVq=)1&l;tdZ<{F`7Cn z#iTg}qsTm={aIFjy)T!d>?vHMP87OOp(fUR>^3SJnf)WNJ@@VRDB^o~*xxq(I5(Y= z4vy}Z%-+)@!M05sPd(y$Aga+CXlN>2Kru*rKifChs;_l18{4_YGwCak3@)wf=PkLn zqjli)fT#72fp4T|TJIVqQ-WA9@fq4}QO^P}$smcB2P$3;Ip9wYlXIkJmf;gx8V%GT zG9vOGPMb9fbI-OJaCqD(^V#=`u;FMPLv$sxHL-&%B;vBC3?tzOy$jKk1IqzHow~Y# zpr|+j8F5fV$iW@`GAFR7>YHE7Al#|*hE}GI?;q^G_rFw8m*ia*QZ>>w+s-^>e==l8 zeMKO}AM#Z3B>h0;h@_ekQ5Dube=!qqdmpzy-=Q-uS^W6k{=MS0vo%4Be2=87Y9=&- zks!_LzTdrfAbD?a9v@TKGwAHkFL{M7PYF4D~$k$eNy>J0cz%9Vf-w6<1_3y$V`h zhX0OHze47Pb%$|dm9_B4`77??vYIajt8)I9CpZn?F6|2R(5Mruf@JKB9HSQtr zJ6Ranr{VZ}kc$J)jHgEaS4G{!VJCfo7sV{>64G4yi!v>C$FC*WH@MDq zXM&}l+z7i-HF%F1uwQJw^-pEJcJl7^(gMCmZ2Y-jU4?zqklQ4L=^L_d=8yaCdTx%2 zPi(Z2?X;6JIV|A)=UUc&hZVH*q*azqZt^e|T>{!Qa58|DeB-{vk2v4)HJN%;sqF-w z#(e2M4-RkpR+3mrUdYwgjpMnz;4wCUdfk>dM&H?yB`zWU@a=8+75ky-H+>HWGGT%V zYh%t`wHBpc@^wp}dos5FWSzx~N0#I68SJ}IqFaQv^fg9<(GOO`@?04Quj)sL_<$*U z_W6^as?2XWF%q_4UUGU)&QVZ34U}g6cb@E<6uVDqo<{QoQ&3e&)=#S)+ae*-%{Pt6-4O z&AxCR1P?OkYc4$Jv^Ma+1Vu!6^{H-UKi?1cLO)`E(dT#bdFXY)wf?#hZ+qBys`PEX zRG5S60zM)_tTlLF*5xhJQQaU0A$PnRmquD`)8fO>9qAy1X{?b}v%jvHh>Y4GJ@ewm z^7{#P(iNxmABR1HU3M)?XV#dkbmcDPGIt@^X=G&k?d9<9a=n0~Nb;DtYh>Jlf!kH-<;nHPHr>$z)>Nnh7Vi zla6iMwylosWMbQsbZpzUZRh6w?tSi`{?&DMbye*?ReP^mMgHJ|&}Vl(bv%Abj^J~s zY!^9$@5HM`kjIcfH}X26+HH4EM357{QmNhy6wroW-5*0{&}O<~-X~+09Y$u@&1V?S z{hoK93w=;|k3!fO1y$!x4-p?%#G82TDUKRsjYVv*y`hdoEk+jsc@w5UuYtKF(SQGPa@JbN;n5EiEwm79QL9%y7J z-hgEWZ~mNSHRYMXiI}jt{)u++$5lo}m5_iIh@9plX#(Lr zJS_l$chags7v9kqznMr#LgV(!#xkm~xNxTBA1ckO=<10SK6~p*__a&p}R^PrUy?v#*8!cn=yi7Itn{2K9W1=hz$fLdIfM>V=x&R8;0_$T?6ta8L3&jy|bR!q-LKNY~ff3 zG{AXgoi`4dc9Oi8+}h;w2KoHTlv|_WGcTg(I$SnM@RdAnDoJjYhW(i!%TS4!1)_BN zGm>3wtPBoQ)tyAVgx7IeS;|_Q59f$&PEl(dL|KeHtJ?**i_R+U#s=we^V?8yQnz#A zo!uyB6?4GY>b%a%^s*6SjVf1s0cHPy|B|yn+^sX2cq@-%C%;QOWHoS4DZB(CCO_$X zW?l_PLQ~h#sSsJj?xzEpxu*`xlKw~ry6B!(gz?Uh$h5zJJ;W|W#b=vKVuO=HzKRCZ3#QtdA+AfbGnIi0v|7pP;E<5 zNha)L?0XK6Bcri$u8hXATA?VHUarG87WkG?gycbBGlCsUjzT#EWKGX2J3^7}e1<#z9`CiuV zxs*2>1NaM36YYhsf(cq$6BMY0wF3P`2M#9h(-xD=~Hfxv@nilWDTLq7ym(qt^zzTb2LeW7Rk{og4|gZ;6FH0ROp zLnwZJzglO=qY0+CC~^TW5J^+ke{4E;$#f<^6;4LKnmYvg2=G z2wu=S2NvHv7;^92K`Or9#KoIRl){TYcJAH*fyG<|F7~U6-@?ggrGM7IJR8i>`8A{# z*AVyF;Xn(PGMLJ3u+EhR;}PS|W7)F8len<|iGRJ3pK6v4I2HFn8hm`yzxu1J1oSbB zBYy;j73Ll}(H;z&4z2_&3T-sn9kLqIR%?tKI9(*Op(1i^?r_}*Dr-EutMNNj%P{d> za&Bv3PD)fF5_6We~e$f3z&~L!H z>Y}YT&-bTL3eQG38Y*w1Q}XlQgp`2Z>-$+#(xihf7cL#ItB&o|@9bxC1PF*Bn0d;M zdtS}&AnwZ(tn|1hPs)?twgZ>P2xh?#m#6{X3)iHxL{Va{5QJa%=PoX;{YdZ^04@n& zilZZG*mBLq!vzVxNo;q~^6j=!vAOk`cgpCx%%#o|ra3b-4%B7UOB?)|TV>?xJY%A; zGN|p6SxdOC-m^s;55Xl}w*dqyUui!T$;aMT@my^mK9|^}6>9URa&A5)-2~aL9pz51 z*(ASRgmW`X<3XLdc%>|^Q_h=3*DaEQc2&sFlc%NZKrt-o(07az5k@<+AI&khiO zNIUVUH~h_y`C1-w)r)SjBJ30ME-4nth7PJ$*3Db*da;j9eY~RLvB*O~JZsiv(`LyB zHh_^soAm`i{jTSnn;F2p z?M!)1@ckyO4a&SAiBcN5Shb+zi8u(ag8oknXo48`7RgU3st&H*ix{&*w-!N!5Bc+C zbAt-aDH+EE-I#Q>-O;E58fN;JYg_b=>%gg{>(qr1fZ}}>s*FNZ(TKJ_boX-ZbY$YV zc7EuA3kzb@0d;#AAb&o~Vd7ZU=0~+=R`~cTqt~k*W1noNv9UXM%BfKKdjc4`(>f|bL!ixsHJr*J>}6!Pn(ykh*`*c zvqDtn=Q?A09DUBSgstGn!Ng?eoq1BfSRdcbJbu%iGz-^>Ns-}{2KFil7kHJ#xpj77 zQDIpG;PPQ?2dPvm_ifzSnDe$_GSZ!o2nz)Yc1f?4;g~XIU2z(F% z3llE%ABUNP~6Zzcf!cUQDB}-tv zT%!(VKdw6M3Urmm)|ER&(YfG@*GNYPD-NcRe2N0IY()oukx3hhez?ZC>mcHc*BImZ zdSXz5s4YH%HhD5YGQ7v=Sp@1f%6rIZUL3hgUi-z<&jgQwgPn*Oa~)XE_GwQb>`Z*w zNXB5o$KEMl+#o6X2S;ic>!W_33$6|oypZ%o;vVWevUIGALkcJ`AiNM1h64`|L)97X zYyiMpX|aZwSgT_*VWsO&(|S+9(B0e8QVH>IH5CwMBN4OVGWCySW1U{biXLi3ZU`{( z3lH*$y-3?~{#qh)j-bZVa5*tnankU;#IykgxaU@I6!LQ&)jBa5Ipw)k zNYb)w2Dpfj+22+85eGiDQPJmigpW}LUJ>egXT3(J1FsuQj4Qr2t{WFw<+xL+Uk&X^ z?>MYMz>CLl_aFCKO`d(GyTKz64<&yh!u8x@fSDLdsxm699IoqzjB{G z>$|zN4q7tjMpL5#4qxO$_GlW$de4`r_NfHMFidGAz*(u8h~y|UB6SI*;zcgd*^OU?u`q-&AWWbBs9t*g_?zhK(*!Z`4+Tvz@WP<3!2d?w*jOfwep>>*_ z^WW2_7aWs581t|u%n(n_XpYjr6A~XimjD{FPoO$^Wc)RMqLe zWQxKSFNOj*8$A?zb`M$Brm9cOE7mL%yrF5heRO)oM{@_@#k}6i^FN}vtGD6aZ5Qn* z7tgU?HmkP(J{`KiKlZ6J+-FcqCcb{u`9*tu*z3xD!MmD?(94HX z{ImQaU?6MVh5`Lj06&WTbZ`|MyRk80Z3|x1cOxmU%E%s1>uSNFbEJd}49@E|5!z!# zOP+@bj?#)x4E$iFw#q0j6EM#Dec`RQXfjIYd;_NJ+I4*)g6zE-uH-($w%zv1qC~hF z1s#Ui=?RY$$%2naHd+6tc)Sscveiv03MOhS4+z!!U$p}CjYU}0*I{<8_V7=8J@oh% z#n2z+E@jl}G?Z;OX#ZS%9-fG64s;QCE<&4PLmq#WOR2jz2PeFOtLwD;7;!IC2u(`m zg-a9INDg-Q+8TqFsX z(b$E*Ez4Wu`@LKb<%gUF-d^eD3Bop}xl&O(r@lb=MzzCmB)kG7v*>UZQ;Fn<{m*4Z~e{ zCA@uwY+MlWaIxIpDMoK~LmJ@Lb5(8gOh3Zh$4J~|>xzfK0txnoDWqW|PDS4d&7NjF zF zp7bwaX1VDytl;uZPb4kCutGE-zhgDPtF3bz#A+!_J z=^|oSMi@NKA+&cNHIvTNWg<3Z$%9)|7B2MT>Kx?ghvxZ<5`m)x_N9tVcRObyQNxy) zdu3xMazelD1FabLIp#)IcmlKxuQ=tFAx*GFz?_!NoDs?U8fRP(%UCDT`Xb|-tPsm7(a?VR@ z_FxRQ)GyVC(}5-|RuO!m5m)AwZ5EB%r?A0 zcfwpX!sVk_Y?@X^E}u6^(wBUuRz90{RH+M3MX$<)MYvQ@tJ9k~5pWd+_lFEOC^F<= zRLFHcoF1I?Lz$W1PN}$zj)9*HLReOlQ<>{2oDcl_L4Vjxfm}`xxxhEQq_bLFU(m-% zKH1fuP2uM&T6%xFnO}(?cJVi+IBUq`CI40V!EyKjG1LtoI+~3}8$1njP&w+8|}X zT8>MHmFm3dG23_6OVNYkQ!= zH~2o&qp=wL*}D1)ORZQnmA@?}!zrnyQ#y8PA9z%dm~uR5T}+uy%aA9<+^h?D^osOO zp7}!5wIq57@2f!;1&@bFn%)T|*;4?YrB}JR=g~;lSw3d)r)=r%)&@hyBWa^z8InEm zJHNG3ezZqogZY(rUmXI;|&mbv~y10rV?z+B@2lwvwp9<)K_CO|AYViFgSCY#Vj zI@2LwE*?u9v#gui(7=yb&Fg2QN+B0^+uRgUqea{LzpbPT2tSy}#vYw5bGl}&2@m|z zxC>5S9&kb#)HB=%j9av&Up*7K4`_HHf=Z%_Nf}+#38i{OuLOx%BnF&JYG_>0^uYd- z8i>x0xuPSep9+*(?8726*KH650KwruPn0s4cFbPlJOYG0cfZ{(z$-Ta$6^8-E#Htgo7)g7}K0h<_H|CgN_0kD9PtSuh@GuHU!~pLPUg5Np|U z#A)+CtN9fJ*6<$U^>#=#2p+nyrg-xyKcvB?;Bw@AUq+9-eBEX6)SQ=pjS7%6EQEr! zk&x_+v+*N>5znRNV9l4$ulyH*^|UjUiw!ltQk6K9`}z@gKT)wP`@`755TM%YS|@as zWFgy2kvFN3Nb*QikJ(aZ&W}jSu;6_Ocfl@67nX2 zzl5A2-b540-o_0KmE;Q)tyh8mOx%M`WV7lTS#^u~8jM8{hakclPJ#jT!=JYc(&n3I z#55N0M?LFvt%T=gCEPxRT#=$ERIw=dF*1Jfp9HX7VgZ(Cr6p`62C74Iq-i0oA2&_w zt@V>ThnDAEh$f&9-wsfq@uqZ{Pgd!*sg5RLM$1Zb+6`gRPi{QkQ7g6=YTv&$M%4^h z%~`y9U(F`^%y1i`{1r_eM#WB#UTrS9;_Zq=?#|drpNx5|(??51RMYk$=)npjDwTL? zscZSwIB{Xae^1cDsoJZ|85vqspwwV8(Kpn|DU8)2%eX{0-{WeLQ|ghQ{Xy2elcGZm}nx)rLVndGvmEO%HHa#YrX@XzjICxNi5Otqq{6?kyD zh3g|!KQKH-omo<9@rkGTg#2#|hC8Fe+w#%zT9LSw1IQK|D{57ylo2|!V{GN;bVZdEu;!RV%V@5Hv&2DsO>#^VN@iG{1uWGk3>2*7o>`QuIg>?y1T|y z__fXt@WOw8B6ab$0KkWhKp1SEYujQlXVm~yh|GeTle#Lz2Vv1K^s#NfJRx$pJV<(R zN0>G&=?;MOuM#xA1XMQ6QB76z9MG_LSkP?I45dQbCSG^`X!1TB3M`r9>xDqI;eQ9E z34q+>x1v{4pTT6r+Di3=^?tzN1}Q>?7$O6uiG{7d4c>boZ^+M<3iT{qfS(8e-$}^@ z@ZO5RZjbIT9jDNtFRkvxz^Q@NGWUGSywr zqPw_2hyGGti80bTy72|g%HC;ww*( znk$|m{U&>2vj4$3v^ez6T6$`4) zIa* z)^}&O+6`vekJ zhW*OI`@W+vU*8=PR#9$@P9i`Z#GkK>Bn12`A&JX z_5xsnig^|nHO^Cs0#yEKdAQTCXXGInU2rBga?0w2g&-vULWcs7g@u{);J_9Zj~u}9 zu(l{kcARP&V=0jNhv{UXYN$|3q=~nZEtlYqy`F-8KxQ(hPcI{4~kJAkHMBtyc#!$%~Sfa$-jy$uEe}kQ+Rk zy}IzIPPri|v#Rj2ii?vb%8 zdtQWNL9WiF9bx7|n;UKJT)pc+?u&;PEx`>70EINcX=vro&NhTW4L$6oVgIxelsW2S z_`!3F&7s|KKSh@^zx&|5%QoYYkdR@aV(cp&3cAZ5i>(;sbGFU>AyzV$B(g;e(o!Cq z&^I4>nLM*oP~h4QYL?XM8{D|_E*+X1obhhtda!!*^c9Sp zY<9xxFJ50k6MW8cn!4@!|9yRivchv)=(M~gUzi3s_;lca<&gOZbn-$a zrYB8O$w*Co6NnKvGB8je*Vue4qc`h`H!C-#^cp%cEvaEF#k{fe()=_w|7OGMIx@fO zgN1qyfhzEK(fHlKJD{^FY!#;PwN<1WKjAMPc_OhVqdjcmjXmEJ7X<}9?@d{^D*ki7 zwA0Ao`0iGT2ItYPjHBXRz-Dvd$0uL2$v>MEJ(b%kO(sCK_McPJ&T_uDizYO~$N=@D zBl^vM&!L;^2vZ+zrFBeQou=P5U(w4G0MZ_2kJ$h?o*2d|EiXk~<- zoID!H3xC9redFlws7owXPATWY%YQj_63ezPb8%&{MPd{P-Y(Wmno{N=8g~;QF5sE0 z$MVT;L@k_es6|4fJ;P(0J^VyL4)dlO{!LY$HL!Z~_u(a&B6Avak!IFbMW6_M+g7|n z-^di(*f3}Gx6Wqh0{VR&%V>kXh0>nM;1tn^$^C^7Pm1iJl&m;)!+e*;p2zGS94Y3u zJr2{@v@DCKjYurFg}? z3!=PhK|_*(lK{KSEH@QkWR|~FQhJ4yg2SD`E00R0N(OFDa9P>)S!bGiFPBX15Y6M} zdv-@Z<_+@mm%Nof@aUhoe>2QHgZ{mNq42^4|H6zy0;zO-?Kii|JmWmoY7Y?c#W;<(cM1YIeKWE2UEL{=qYagrrjx)^Ak3J~8LS&CG4m zNqysc`AS-+TCZzLwdM0;l^fP?H@=bJ>SvMfhRvIm1LZ^s{<*8&k?&LtwF>aSqtz#D zrkU*Q0O@x;=NzxBPvD**D>a$xcSg{h(SGaGncC~+qndP~^HY0&)OPxn%>1iG(#Z+2 zbE>yZ*-~R8sOaNEzJ<`2{ps$LZ@zM1JxS_@E!S;J-T+rK$;Qhg_}-+?YEFQG;Ad^{ zE6Zs_9dzH4aa+ct$odY%bSTGrUYfV7goFFqf_&?7ZS@-0mlKb_e$*Lb-oxf)Ews=z z>n;mLD=Z-q-1_W!~ntzvt##1Pn4o zdYgkB=RDY+e&$B4tVPrxO)a98qM2ARK|WdI_aSG*=6sj$bqdMpXD3IF1m~TbhM+qc z@|wt5mjpew-3?kDmHNY?Gm0&$`y8pp1ulEO+#;AeLGbLe?Vvc;QQG^gJ;Zr0LGk!1 zku%f^TgHIKvK=!rx?*n@KH{YpLN#dpGuPcjzWM3H&-HuNPkYe7CnfuWEp*|$sk%-u z?Ll3OvYiFNpck9ipvkp=ow#~Z#y^Me}xGfHTh8=LfXb~8{yxD`m&nXAN{XraLSw=dCq-eXcv~PrP4)kRPv|!Ek4>QGW~F( zCw%hzB1S<88HGo}d0W(x-~p=djSL?T$xb(vHb(Nmp!7NqnH9 zks;UHBfDMH=*IbkCCARTfqT2yXk{fqqk{lRWF!LKcsD-+$Id~E$-(zOSH**Cm$i9l z9;5FB)c>8n();Cp@^)!OcRsJm_9IQX7F1;j9A_!l>>Ksuv7UWO%-UT0&At4iQoH0( z^joQ!1PE&b2C^imE&6-F&{H|XzDOIeRXF(v)4GX&8D>-zzd!X_o3S&WBee%HGkm(6 z3Oi93<0iGe1>Buk??`~1Rl(QHlwuLw*JlKn4TDi0Et&;PkMK#8F4giUq_Gqlj{PiH z_tF7*q>ncqC&Ptpsp@BcHYXDf=#8zo_k^hN(#iYP1!+YJ3%4-~H43svltWd&vAI*- z)f0fQc&6RW~1Nd#N%e^0Jw8|HTA8Io1#d=GGzN zJMOBsw`@OeDUf(1mr?sF3con=(nilscGtxD7wcu&2|4GKTe}H`m;TXkr`MtiBeOu< zR}O;)7R-Q@Tv|Bh)4FGFW-d%_l%~(8&JRfrmEg58OiohqdRVv;INcgx7?-2$x1OG+ z(bAIfY6FzIlgJA|IlFKZL#N1o4^uy$4+Qh~kSYni!X?42wt?5W?p02wfYweCyU5^9 z1;t`mu(Gw3(vY5Puq{$iMaA);&#RczJDl^aYeKZYUG7oMynFwqkxxD_I$^%gN8W|+ zoYA3MxFfrmLKMjN2}yvPNXnRa^O}qvgqXvp53<+ACcTnCHgbaj zIp63@n|6Nmw-8G8YQ7cu z$4kr~`iB0hOvutn$_)qL6w=Q9PHN39=h{!+xum=q=`zzvH0l~IQG-lvg$Uz_9@R{Zh; z)m)ujrT7nsq%Yr1o*n`de|BV_{GK!f9ltJ)^ks?U(fe z;M_&?Z9wR6{zT=kd5xeya+CbD#Y*zJGJ0Q9&d^}&?I%=uuZK9nF8afWLQm?*al8^4 zNmpOj^#tpK?sSkzTgyE7U^`G&1;|D{f=`43=WaxucZPm@e2Szy|L}1Xk6c=4+cJv3 zn)p?FA||8n52lE$lRZ5?>efVCj_#k+Xy5I0S(NJ%BUt1Vpkrf}Gcz{iqF>z(>hoE8 zsvth&&Esu zhKF+n1x$4J^lO=j7cXwS2-cbRW^dT*|Jp>D?*7*+^*;)g`$<_E;TORGL@WDHYn_@# z1}nJGBO{5^#AzJ+wH|SiU^&LlgPIN$6g)(a8(=)26PZN2hw zAvu7bQLWO1+CxoGKsHHcfZT$#e=WnVSf)%c<&(Pm2x5;Ho*%b2%QhygT}=-IKN!RwhM{=s!fQ_qehX?b?TH#HgG*E=7!q z%JGt_BCDWro-9pA18&boCIt8LJvh}z3ibLlK{<9k zRF_oxaHR&B!Im*?zzD9rbMgh`#jy+jSS5V9@kKa~8aZe0KYZG(_N?%o&}P%=go{@J z=B3t$?$dh0$oC9S!98i$<|bW6Nad2c5;2Lk(0o@|wy@sw%;wQ;o#RwuA(X8pD@U;U z&O)4mZUxrou*f$&HC-g3C=PT1*fVEbKaiXLSv;~w2%^NR@*j4*`)hr`Ec5v%>*g?h zK(B&n@I8aoxsXBK5U0|0MpobB*E;bqRXWaVDzBIL1fSW9P$%mKO*&(gKt|(j&^L^$ zBVE0lm>2ukSF{~Lm!j~^vmYg&6PgZEi0{zS6oYlVMWub}J#|E;I-eM{D0_oxvMpld z7t2PCVKeA${RsPp;_37>MnW;&IH(>W96R88j-bKQ3w70-^Qso{f+BUe_}c{*H5