From b6807949a6a8273e6d83b5758aded8262fa39058 Mon Sep 17 00:00:00 2001 From: Hannah Hunter Date: Wed, 28 Feb 2024 10:42:24 -0500 Subject: [PATCH 1/2] clarify the header/metadata coming from Dapr Signed-off-by: Hannah Hunter --- daprdocs/content/en/operations/security/app-api-token.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/daprdocs/content/en/operations/security/app-api-token.md b/daprdocs/content/en/operations/security/app-api-token.md index d94e325139f..401e561e671 100644 --- a/daprdocs/content/en/operations/security/app-api-token.md +++ b/daprdocs/content/en/operations/security/app-api-token.md @@ -89,14 +89,14 @@ kubectl rollout restart deployment/ --namespace ` in the calls to the app. From the app side, ensure you are authenticating using the `dapr-api-token` value, even though you set `app-api-token` to enable API authentication. ### HTTP -In case of HTTP, in your code look for the HTTP header `dapr-api-token` in incoming requests: +In your code, look for the HTTP header `dapr-api-token` in incoming requests: ```text -dapr-api-token: +a-api-token: ``` ### gRPC From 7a3cb5dc8d7201194c4a749a5d13173b45da311c Mon Sep 17 00:00:00 2001 From: Hannah Hunter Date: Fri, 1 Mar 2024 11:28:11 -0500 Subject: [PATCH 2/2] updates per mark Signed-off-by: Hannah Hunter --- .../content/en/operations/security/api-token.md | 6 +++++- .../en/operations/security/app-api-token.md | 6 ++++-- daprdocs/static/images/tokens-auth.png | Bin 0 -> 24183 bytes 3 files changed, 9 insertions(+), 3 deletions(-) create mode 100644 daprdocs/static/images/tokens-auth.png diff --git a/daprdocs/content/en/operations/security/api-token.md b/daprdocs/content/en/operations/security/api-token.md index aa30b39750e..2722f67a5fc 100644 --- a/daprdocs/content/en/operations/security/api-token.md +++ b/daprdocs/content/en/operations/security/api-token.md @@ -88,7 +88,11 @@ kubectl rollout restart deployment/ --namespace **Note:** The Dapr SDKs read the [DAPR_API_TOKEN]({{< ref environment >}}) environment variable and set it for you by default. + + ### HTTP diff --git a/daprdocs/content/en/operations/security/app-api-token.md b/daprdocs/content/en/operations/security/app-api-token.md index 401e561e671..9a9264ed267 100644 --- a/daprdocs/content/en/operations/security/app-api-token.md +++ b/daprdocs/content/en/operations/security/app-api-token.md @@ -89,14 +89,16 @@ kubectl rollout restart deployment/ --namespace ` in the calls to the app. From the app side, ensure you are authenticating using the `dapr-api-token` value, even though you set `app-api-token` to enable API authentication. +Once app token authentication is configured using the environment variable or Kubernetes secret `app-api-token`, the Dapr sidecar always includes the HTTP header/gRPC metadata `dapr-api-token: ` in the calls to the app. From the app side, ensure you are authenticating using the `dapr-api-token` value which uses the `app-api-token` you set to authenticate requests from Dapr. + + ### HTTP In your code, look for the HTTP header `dapr-api-token` in incoming requests: ```text -a-api-token: +dapr-api-token: ``` ### gRPC diff --git a/daprdocs/static/images/tokens-auth.png b/daprdocs/static/images/tokens-auth.png new file mode 100644 index 0000000000000000000000000000000000000000..0eb566d7cfde22a448236bdbc7f89dad73d954d6 GIT binary patch literal 24183 zcmd3tg;x~q`|ts!8w8}KB~_3vX{2M94ry5$q|2bY8&;ZKx*Mb$lQv?J9tk05SAUA`91$3`h z8xNw#);uIp_A+QI0Wa6%>@ggfk&rSc<%l-&jVI(-Yi1`6tK&VuceUWcb4{UHHKNGJ zWsBlZFQt^)?4h)HQGTo|Xy~7N>t`N(&0Cba%}T9#DpU8)e2Vu5E1wVf&B~FpK`!FJ z4t!}z;HV}nc~t)Imp>{}z^f@z01GW}5WWZD14r`r%#fgst1}Xgi^{*^J*728S11-s%7Y`QDxo?kNaiBX3Wxu)tK;zS@l{RQRm>{p=VRhoxis=97itcwSR6Tj`wBUN zcLzl%1*`tsr}4M%LCKq|T?D4g^zdR`;Z9}?I%)d6JjNjfMcWxpo#*{gebJ+0_Oq#J zG~SZb(o&}Nb~ldYw8Ia5;T)w+M59pZzt8;YQUSBx+~oGEv1*!I!#<}ux{N6{1M*}D z@kMm8IDg`921!r!W>s%jKxPlV+-tTn)%ZwKV-YdEB+tc;EQU^^t9 z)X+zJj&GyLc`qp$)(7K?4a8RbpUC#_K@)#A28epqEGf zh`8DEpTeBUU3ej10k9%f?;e#6uq8|pl0R93>73@s<7k>Caw_g` zPv!V4k3!!?6lOKJJaityW=VhcQH%q+R^Ve?&>$`)l^Yh)Vy@^NtUjElJk@Ok6{^qw zZ#O)CWy-;ds`e}{DIfML?ZB$duLudF1?Vg{2iNyX_TbOzT0r%sKs?QH+dDs^sAS2Z zUwe*cNbN#opP88w3@ibE0>(%QKc3teY*E&v1WRGd85^ga8y(HnHvcD~!00y#qKa`~ zE1^EKZ`R@}*K=H8u+P9&HagqnK40MNdWvy@cvQ^dHl#)MwNPD$!UNLJlav1~0Ow<| zN;Tx-gXK}>9Qjsb%jN9w=$q*#_niN}JnAb;Cgft*#1aarR*#Ple|lK7mxvq(*&HK> z`v14X{<3ShV5sjSd&PKvRW?tmJ`p!I3^u#-BbM<(sk1hDg0Y~k#n zV*Nx|!3tL^q0883N6+{(Al|+^Q z&o5+t@Ph*iVoI;v%`A#dI;zU?X1YY*=|3H+9xIcW$WvrmA8g6Was*5IkaIPJ>U}EH zu0;Fq{0~S$=I+2d<=%pAfB!J`YEDZv+ykt(aZ~PRPlRacmI*maQ2$R$6FK5xv~bGM zuB`|YEQH=L{IZsaL_)Z(+N<7bDsdM5= zrP_JV641_7sczWcoyltOu0pZcd;Z|(o5QUt?T6I3z;UHUtBuj#(J>LHxt@g!kIO-trxQgtW!5F4)1(m<^CKLTtK#g% zNR7KCg1a2{C$y+rj2LK0fkgFO^)=Vw%8XD&F1KF~&`i(A%3JQb6!@~mu5@{j9!EM5$@t(!;RD~bi z*z4^&cR4`^3!WOcO6mL^d=q~Lu_WrSuCoMd#FUhItqp^n3E`IqW2+#Y*?;Q!7$AJ^ zPn!A@;#{e+Cg`fRf-p2~4w<(gmCk=j*-iE-P3pwnm^M zLqqIrY;k%FVLGgInux@O8SMjHK#!(yL0Jirms z1$qk0S*EQ40>>%HqSLDOL{Q@Audc0`fvJqrEk-h$-A;@h9LoJzV2zFu8sFLcznam* zrHPBhN#Ho!4lD;_+1lEPfW)*9w_WnZU~%!H{{;SobN;Nac=>;Xl}J^7p2tQ-edlwY z06+4`yvd@`+1S`H!X_yGr1K*DYwna5_wd*Y34AyXRZ~<#LbDasFYv!zU!9tA{g77A^Kqo-Ea->Qk|~JHz|W3FM>-2>i;p2#?&qsRd3pJZkGU!Lc(ys^ zxK|Y!-}PI(Ztic+Zf8f_tRjL8rpL#?^D$dvTC22EP2et0-pp+z- zx(AKs!Z&rhXTQ+K6zE)^$c8MPCho{d5dVIZD1nz%iJ$fD+dBIdq%5MCSU;9|I!z<- zETaD0()d5>>n${#q9966L?$SDwppFJ6Jcyxi^q)q=o zvbUNTL#10tC(O_9r8oEHz`#IkGznh*IT>p>esS33r>}qO``1;ft!H>gL~3EbKi&BS zVYx1FZ|~%H7m@-wQEJZH6*a*Pf_zhPxiYP?wK%SI`276*&!0%JQi33jH~-{D<28(O zI{?8l-}8eWcFVbY!H|Fgxmw%e$SvZSFd~TxV=Lj2e`4<)1+XnJORP@MPsv!WeZ2 zhm(zg#AqE1OiawQ-!C_`@+1OrIs&lC`5jHS35k{`Vq;?kT@S<7b83npb7dRTK7BvY z{N2=dDN`1}%(AcHZ(kk9N+<&Us~Glsg(rY%6;1r}=g;U!7zFW71??X(=4$PrF)^IR zok5+Q4NbjC6A(pNSy?%`-RW|=MSp7+9$a0H2}`$kZtACppB9Te9EH18q%xmVMN^Dm zlHU`G;0dK4FJZLlA*voxNO8;muCLu->AUmwl{%XGp&=pd-EVYgc2}BT&#{3u2+HsX zbNk_9IjjLJ82sltAuWT$eL9is@3j*+5jg7jR+AcWFak5Ce z(srTYVt=O6d2iC~od*u6zQ3T_aTx4|;qp_cw#BF*OQq~MR9f=Y+dj274strTQ9M!n zQ9|ea%*A(cTye{pE(f#Nlmh3oKvWsc4b{=~CL$pT)I(<1t&x1;)pG{3RtX{Q8l7dYI`fs%#f@RzX*X3mq4sguFOG0hEF+3Q9_c z<1oU!jpj9W6HVDFxE=OSEbuFg+>Og-(ykejDohsw{AkR0WO%50Ozx)&}xYaQ*)q2@=Z+Md? zj%>|=nDJF(na~mRRzb-k=W(6PQS>x9^c)@bQyU(QZ4F#eaNOR`tu`S^v(iFF>E#h|o(`+k z6NU9HP%7W@u7XA~gz0E$$9Gc#h}m_%9W5@b^1Nw+idSH-m#x5a?7_qU^pw#T{c*7#uL@89v%AHW{}1(8)yX zFEqM>KyfWfOgYzCSK0b{nR=u1!kxS7!3p!YfZ@T_j@!GDYp*8&~-_>O!Rj$6VQ(11wS&|j?yji0As{t1wQt|5bdcRgGbKsbnbRnvO`)o50pgg6n-85($4xB#$BY)&yCg_zJZ6n0#f?POLcw1`pGC?v|n@Z5(N zmb5Fmpo3-0bu!EpiMWwgGz^!j1Sqa+Wk&q#igmmdhIkb)No;%Anet_aQV(uOcud|6 zrBo{nO?jr)rgif0o=3)$QS)c5830$je_595`R6e)D5!|W!)cKpPPXZ?H%F*B{5Qovx$hP0cLXr9>3bBi zz?U``@A`mDyu4iX?&?8{2pRR~W<>f7L^?5TyheHHaxCxS@-kffvf1I(Q%Y)Mkw>{D z7KM$+TC3fr_JUU~Q@uTa{Dqgj(qS z^oU$pA93HZq&b*W@AWFBP3xOW?8tU^Z45*%e+|#B z=xOLs78MS7AULtle2y4O^Tya;ggC)0s@Uqh&*$O7ozCfg&k)tDotN!tu#%km zaR$O|$8s-Jw}C2e=)grDDiy*JwX_S`6oQ#F*Boq&J<$lFYejdN1ugz-K;yS27E?N5|~-K(xQ zkKUpsH3`Nei4MkSwP%K&&LJtd6?aFanUp5*G`u zPcp>z2?+^5?u;Y|?OPqx6AU)nvZTgL{aF*1BL0REX&3~ilN!Z3+Qk|(XK$nLzI=HOnAi7NAM91Le|!ynU%TArkRJ}b%HmmB*N!+qRzeNFLw;X`;D z8E#%-3P-c?bcE*aYeV|eDAs*@rOF+J%lg@Pf`ns{BAggwZdQvmcpKN%--D4cyCw>&mnGC(sNduBHXt*snDc*DJ z14#9)-yN0`O<{NY$X@-G&vT14=Wt`Zy-zKq6%ZCWw7{UH?UYgFl>;M)*qLbmY& zwRxoltCv&jbzyra8}y;k$uY!!zKipet>|n8TI^C1^?tJE+YGN8`_e#xyYexCbStsK z7k87&au$WgCaXj_dd;Luaj5Yr5zfXoi|eD z%3=Cj_hNNyJ6kBrV?7bvRNNZ2MU%cxTQ~{34CovvFp8A-ndHVQ;y*PqD_n}FSZF2m z(pn`5`$BJD+)2Xy%@;hXt72~pc)037NXf|1fzyrIjAUWY@186vqP}%a?_ldrKX6Yr zG)F)D*!RDp_2)hvS6?fq#+yA3F3kGE8L|Bvl_mVuB&!u~`gF@(QRG~ruCkq6>CC~= z(LpOnCC}i^I=w2X3PISyu!mCuXiC` z3r1uQ>)IVSisr5U4Lxn~o?WpkXZs~l?NKDBGpni{Z|8ZL(M7Xzo-E#!b#L7Lud6xt zg_Y-iIk!W(Dj&fBCsk^Km+ax#FyE>%Qfd5e>NgHT9q?n~2va@DdO)3n0!`gXriIvk zF_3Viu`q;^9L0OH9w9}pD%Kyx_CU4n`j}+OmfnXac086UreZphU!q6&pJu(CX)a9h zAfqP#9z18^>qi;75L&CD1&WAYbBdOE@!scW0!WWcm%)VJ_2zcDW4D!l#$p_Gg^)+M)~XEpilxctW zWYljNy?iOAA7!W?un4u>CW}7p`ZawZBea@zyXt4%xz1Wu=bB|$SRwgYo^5}2UEJ-{ zao8n-^;@IjGO0v7TaUWlAV4!pk0BFdoWT6qSD{@A=Xe~G_EhF)klB4Ss(YdV6pl}V zJWo-+y;5xk-&MTz?P-WaHdHj-;gy4k{yd*X{dq>)JIggUlaK5NGbZA##Fj2% z-``J0qTj3>F1pWbH=W+@jpa;X^6^@JMxT5GmYJ(bk0v-7Fw|qc8`Ao%B8pqW6G1V| zot1iKu@xPO9ra-U9=i+pC1j%mK%?J7k0BX1y-Ro1FbCx_xI7!bv;uEzN|U)F9(Iw zV(nx>UErygl2zg*aIALw-_PNxWiPA!mmxUbK@wA%Pnt{>L5S*g6uHmYoO7i)dn)Hf za}Sknwp^(xg)1U!bca)S{EYlA4VLs2bv^&nn{H}{L1V=E63S++cmrnUn~>~Ah>k!S zYbA$QQvzmogygOg)~O@kVSf>ycb*Ddfmq00%5^ym%Z6*Rbi~m|)e_d%QqeNxz7+}~ z-}k!y=PhCXy$5qh_QC$J8G7x+c3y+HcquWE@Wb%+`l*@C(PwPD*YOg}5>e7NWS_+5C7+mK+EO+4Aq8IJO z;C=?LOt{`AOJwx5e8`&%Acx5Hl!LY$Y}kW~k(&2%j|>?50C$#T zI-es-D0E*rakiP;d@;$P(9>7e7~h4ph(sb z-2jdJ$Wi_?%zV3OHc23t1m~D7B-9)c7L{;!H^jUxDE%gl{uX z_`G$s>x;)ny*#=*8O^O7hKkP51!Ue=YvzC1GGQ1ID&}t2z-*JEEp@`-@e!4EPT}&3 zAdo3zX!W(t@~kOr_R*|OM2B5`V^TaGX8wEJem1q%6Vvpd6F{@hUWC!-xMEm?`}yQp zXZ-iWT{ai>gCLjSU5s9%G#R3{x)in=_b*@g6KeGRE0>+Z_0!7Nfx&v5?|?DdncL$AvgSWW-P`*e*MA0wPmZ+`snwK~TPZ%M+p;iWq!hq#Zb-)j+> zb#Vo+<2J-AW&4%(gHz@Gnz>u~V6M)7e6GN4to-{3n_kSQ3ef4S(H z|8zduwlTnUb`}~={Aouoml)3d+-QK1UH^o_yAASF3d6E-e*S|R+{)$o|I=WoM$%fg z^FWRfERuALFDF=!L_q57Q%C0f*AU@f3l)2=Gnpx`pa2v15YkzvZrprp$8#ut(c$b zBBi~s*8@*3&7?ra5rtO7HId!@r0etBD=iyhBvD^e`k(j)4{fN`6d!14dwUOzgw{)YnXY_s)>iAR1hBGQnB6cWrZz?w%&~?N1~ccvpnxi!!T%8^~|T) z3|pr0$FIddM#_x})A6WZEDPHmzMUs^ReZ1AZ0`u9^d|m;M~V-0Q^H8j_Fg$9iF)BqBF| zEcW~59EJTtQW}{%{aV((MUneLgTiN>2}hAu1!?y`KGHs%yJ+G4G>Ia*_C3}IHtnOi z)ghc`)MOl)og4W-F}+MMD;cX7nJa~F zPhJJ@`frscG6-|FBxo%L-L-G*i_UwwwsvHEgJtJ-w`B&hl-tbt1H;IheJ9-^o4Xgl z76uC_gFQU{jA-B2cN!i@1UdmTKb`<>0zRs>PeI7`-8UMNS?y z@js#OlpJ?9eDYP;Mf&2q zni>%4b0TWqa3nx-t;Q})T~WsY?BVFDC~x*_j=X!C4fY&87`xARCKZOpP53m1#!wkV9}m2k(Gl;#p#-Q3geS-%v?nLJVu zF4L9JUpO(-#ANrCo%Sv#mf}*2&Eu8f6406i=1XX}xV#%=)kQF%Ao9!O1jbL&GH=)X zo&so@^3g;QgcipM+REJrJ|`x|>Q*l_1&RNz7`-41MN{=)k52~6{}-WApFXZ_A*vPw z1t=wN_6#Qfa^t^_A*uxC>C1g#L7;5!N!6j{d%W-00KO&l=nOkpyhB(B*#rc6P8{X= zS}j4PM8xr}_j0$@+35nan&DI>319i1t3fXv=$RrrK81YZ;_j)Vqsbcc1nTX3sAk!2 zW`CT9=nGtDAmW9occrkvt=4*66%`egWP=vUxyT(b2$Qh8w^t-VOs2BP7JToMQwsnF z0BGl26=j;TWFvhV3iNBD^@O3$CH>Pk@O17^7;-WTG(oE5rmXrIw99^_(zPiHDPX(L z0$RrlMo<=rke6n8iUFd$q~!Xb#2NIqHJML|$iIDk{E>HQ)A?=hddZN7v&NJq4K1X| z{ttE=ANUR@!|+@gS3+T^(c<{Gk7koxckNB9heyZFJOTGn&hN6KZAbqUbj-qnGLoGs z2i`i1SH9m4=G7GWEf+X%XL@=RD6%;iiRq`7jt@`PZXnXUUT%S{PX~+dAuBxikYqeMhObLpnRYt1<7-2rfyq)Zi zr#ol|B>1<((&m@6c%T-_#0$%_qNRmnrw-X9{Sa8Cx>nd)Wa|+DkAJy&u95Lo>0&c{ zc4xMD(gnc3H(@321u!^-;X}FMJD{2Q^JL+o_v$S$(8T^H`dDtUUst>5R7J-Bkw&25 z(BzXJx7YplvP%IHu3~~1-)UL4fPZ@!HCD>ygBYY+v6X75kzss@fhRcVCynsK_`cv{ zv3Yy@Ve?f={S}syLKvo)%!T4kex6`+mC?rC615<_GR4vZNa&{PaN=JJ){H&fn>m6& zAXC#EseGyeIs$qi6ocYpbW3{FZf$IPW(+Pnn301fN^DoShaGE6DeL%EZ_t8-$On zXqLMto8QKF`muepb#U+=KtpIG1dKhd4%2jf%0RyN7#)GGw@bbc2!vX%uNE3>yMyBhJdwOJE3gxut{;Xho z&}*M$&rUCeX{K(9+Um_S(Ck+;ws0d3}j0)wTz|pV8a3`~TLyUs)Zi zn(@A?>FL~LXWAOP(ZXnM3jpvJz>^$If6$O~bPO3CQ-0dXEluMctXG~M8?nCM61@_6 z7%^{+(PYx}SNh^Xk}DeKN{g|p?P zFLo+lZfS}G*ISsBu@EpD;ig&?2kYs90H^G8vRyWuZh}OfzuO7>$uQ9JS=Y&HsqG9d z>$+8}Df)PfMjwwL9$)MHxV~uR<2drANS#kiUy>zu^&*I4D{|77_y9R z&kudwjA$j|Eu`N@(^pw-JrJ)Cp39h$`^>I)bDX{t8Lr|Y8Gon z(~Qx6_;5I&c-32Vm(3w^+p4W*v5E6Z=K?6&2lObkMlZt zQiN=dUl_O*mSE=29a4RG>^9|IGq+a@RRZ9w@u0ducmjL&-G$Xv=bA}Oj1DT#HPdP@ zW~t4Yo2BUsg2D68!uPmf#*(wC5u4jR(aYW{#AvItkhv}48uKoTB{(f_keILc2}-0< z@0x&ab(l!~7NT|89c0PZTi|C(O8w}>195zU!M`~sXX(f-DD;bM0mRQ6PA_jW9mP;7 zy~Ny+9T~>S;yBM*jzFW}Vb*qKei@D4@!~4K_oZ6&ktFh|c&|IqWtaTgfjxGr(i2gx z{9xOp&{%g@A|?ycB2Y!=U1LU5Xmwu|NOl26&NRVt89!4!-mqa6w(DweId_hJ?Kyly z3rATUFHjApZhCsST58ONCVIp{J_meiKaTc6z#R14$K-ZmFvaHv=U(m=CG>2s83URy zHFS;FrZjYiSSZzd)~rL4Nvf9lk81Dnd{mS3U$f`lN{3)yRozK973WE0SIN!P_a+9y z7bta)FJ6BTFJ@m*PtUd(Lbq3w>Qy1$bzB>BNoH|^<|#T~;oi6?6%jsJyNR>?J0e#pakaDgi4>Nx5VDpmd; z=vQODm8IVYZCd$)O(D>CD^J}B#4eVwqJ%&dB0mY`Y;178G6|VjXMrx#OST=H_(XuY z$mr|UMPnUKW&;S53><0Ovz3-R%{pEYAB~IVXb(2mqHKgG|@;A2fk9DqXl;sC^wi~A|xZM?Z{eFrQ+zj>221j&!x$;r%czK_@y{j zI9b#veA~-&&T{1@t2Bo%Ob>z_b$EGQ@ z_mh?(JrEI3@3Dvyy)_l($z`$I8R}&ZIncs-@eDM3fx*Y8P4@VE_gqh=aij z%tDdQ+O6g|+;`5#;b!OQwFVD?OA-3#t2u^y`HwJE_}P^2A-8vWOE_hGP<8Xu?YE`9 z`8b~jX~pnqogz}+rMY0q4Id4vJJ3XuYNOMF^DF`e8t>@prm}Esbc29PSo{DQnT>BR z#3w@i_*{Jr*GCwad3Q7QP9bGH+w*F2^achy(I@HZl#*PJj?60&dsyWyt)u+6#dKxx z>-Bl(hz!-VTW#bDdYZc~Q&wO9RqIiOlHJzW4SGE)tKQ8cyB4_y!=B_Se4a)t?lH4grU~*_ktLUtyeYe>PjmJkN^tIX{@n%1CAl({oP26r3G$|=+jGd&PDhg`N~4UhAJ6>wVEp~g zJBF1JvqF_^8^MLS$M2c&?ixE$leC^dSdC=i8`PHS1o_SVVd$ z9+q-y{3PbA^)0hD+ntK?ds?K7b0H{T699}o?bL0mv+Z#J%;TzG_2mC zBGLiOK>C@gC@333W6=WLKKKW*f_u5jyKa>$$9Jt}mL-t+79eeLr~nS)ah!`Z&C_h9 zC8u-Kf>F1ew&S(u8K9_M=f0JT9!@BSBrQA>W;tH2ZmasP*td`YJ@@`C=+K9T+EQ(& z`L)Y6W-S!?e$18n?s%8uzd%sy`=$>o$&-741_h-d;|Z>Z^oqFYZUu80j4Z)-WK&Th zH4nM=&qncfbP>=;Y&8jor|(JL0J2a8em`xi*CcjptO%Fso=*L)zyt7r^IPk$*tIJR z<2`;b$;rm#zjg*Sx^DGOpf98g7drd(#GHytqjh*t-5qg1+BrpCwQn%+xO44op?i!gclwY#CqD?aYV!t%$U^ zSJ&9wm6-Q#Hyq+NO#+$9M^0@6gPj!a9=r7FePe^*I5#IDuBYxkdA!WBHnpGeK+U#r zTPsVOJzy11@I zPPdfQFj6Ko-HDR1z#Z57Ibk6h%ZJ$kJ}9DV)oGgyl*LI~i0329zGh^xwnnTKEf1Qq zD7Qh%D4x1nKnsI^UgK6qTleqZLB>9ptcJChtqpq%i_v6E22UlgCM9r1IDP)A*c7~v zl*S3Nnp2zT2FN)LzUA42OQ3G8sHn)w%0klj@$r$9lk;kt`hdA9T+^*fNwE44v$ffF zzhGF6rpj^1fqG|afT)(-q5n$2_u)8*G}hBNT{|BG*jK!S&MJ>W?3Oedh+Cw8iV!w1{GmTgoTf87HGetHn;g zr;E=mQ|>^FGE0As=zHf0KKFs#Z@P{AD|93o?DqC&>&^aHyt`G=-hthW7@xv?|EPe& zf#Cibj5oerCDwo>2q(lxHdSeL8*`F=4m!|zu4!G~irFtvxCaf8j{&XK-t)r+er^Gq zs5A#zWZJCn>>ds=JKnVqq@Kc^URad|@)_^cO}IsoK7icqM}&V(6+gV24=cw4faX0f z&`%Wh*P>`aK`B8R?Ac?BPc6{;{*kUSr7PBEH$wZIv)0+2VcpV8o^Fo=_rn4zzcm6N zYkbc06}veBrkeeF;Z}e;{d;sAPq$J(kqyPiOA9$>H(R4FV5?CWuP{WPhQj+aeO-&GNK8r zL`cZ)SbiixD?;8Nk*l?31En^QXG8hGQHCm$4QA)g*#wQwwmTmZuS*m5C|uS&Wg_%J zT;QU~lqs(&3zi*$oSa^$oq@3r6UrP2YMGsy_+| zvY)mO%UPL9-Pav=f~=-=X;WM=#wvag9XuE2T*cOi~Q1ZJS z-=C9G!;@JepFF11U2#@te8-RPZ)YrltAn|08L@24s;3j)84d%IDk|#xv4jc_8n|qi zuApXwvhiD>*YZWBsc68sV`o-l*d?CuCN4JL+bFtqE~!jd{w0@^qIwLl`6&LsF83+~ozWk+@Pwq;Tr1@cGyTT~}O+IPD$QcwMSY>Kf zt&0iTg;K=J4Zz7D-Go3hNfH|$ zr>>1EAAXwxKR&LAeX6m&Hgc>9_c@yvv~+aEy)lfrtj}`txk_Cv_oLpO?{IluT2BI`dh(!gxn{x~ z?qe4uQIhDe0E^Y?U$)TB;we?_4DFo1C1pdkKw(e}S3Ihr(={a*3u|>#fq4l??N(pr zqEo{uz*Rq7(%*7Dvi8WQagTZBhkrugM+8BTMAT zjbIeh8qHbxH5naSJ#zldqv$n}D*Y$u>1H}RjwEy71c7V zHcZ9XHLb7=T3QBWE$uw;^4~iU_lHPU3Cex2s3h5TGK#-M8l0u15@^5cIIO=>R!j;4 zdXbqa5bzN$=kp@FsHimDcVz1hD()w$0|Ntb@58xE8YgUPrw{&}n6%&CPuuqV!nwC# z9&w0U-ySJ6uuPs>RANw)V7X`BGd>#XLCK@0uHq)F{jsAtkCJ0yP|3}et+jXH!}(OK zxP&7T_3-^ssAqA^iPzh62zFn4F+=9$MxnZ}<-q*@zaFlY_DQ6sqI=s{Dar6i=5#m6 z%TkMK{hDpW7gv`-UuE=a?E`sSkREZ?M1*P*C7|sw#DSAJ`J$yB3`))a^!cVhM6(@o zDLoqk?ZS&30oqQKlNjD-ER>15wUwX%{r0L!683wwJr|?PvVmC>?k$HZ*TN+xp4(^A zQ2Y^p3MU(Ag^)>SVVD6JHGkHutTOYwE~^~dR!!#k51YSFvU9_BT`xJ~c`Sm*1kjO^!-pEabzB?RiQqwzhEM=KlaF=pv$)6J=Z!Z zeB0qyH**Vtgn7dYRMD?)e*KpARl_TG+oi_m{z{NzZx?m?+sSWc4y#J4HWn?{KjdK~ z0jhmiMl`p7lS^tRP4Phfs3RB!qcEx=7G@u6+*K~j03L{o=Mx@hU^MpH+casO@2nO%ZMLf;NO z^!&BRR?A~04hB<{QZ43}9Z$2FK)-#=k z)b?5{@(XdBpsdw(0*&8gPg#GDj5=VlFqys8zGXOFv`LU#;e;+mCj{nR)H)Assya)%t2*3m>sfF zsX>Gnzv$rFLG|i(Ev6afej)|+tZu6=L5(7`_`|!YM|DER)n(`_jFETuVtYJ8<6)`f zGBpuplS^OxRjN%aE+4M)g-)(tgU1oD$4lRQFcPordP;(YDENQlv@;-MjPMmSl-sQb zxTy*sZw+hfae#Q!kP=IXRsXiOes#?3=Bb(}8`2ekEnjy~^Z3j)5|}WN6A%~&V(*== zp{m_pmA3tjK8^40jA7t?enJTYyE{7oAm0EEBSp})ETwdITq-n=bZ&Fl+e)8L)ca($ znVi?`U^<$8ivP0`M9@e4%5w|n5a=or;~kb-?SqBPE_MY~S6d#w*Oq`kNiy>vBbr}ihM^e?~X605)XzZ76*T+C3rsr?rIUx%q&c!X*( z>es$AiI275%1q%o;efQW>GHFlkO6#_4OJ2%oSyH~+gl!x#5#VDm6`U6Qo-5=L6J*F z_bTb*NXn=635EDXLo!}7xfra+ou|3;@Mkiz#W!GLNoXQSA#IxSYOUKPR-2lbV?IJc zUZOO)Fkv5KhCTCSC%=dO!!i}AIEMEhV?Kg6h}T+tf{kBqPU&h#9>1O?#KH>%41K*9 zdnul7r^J$vu?IxY_PYapYjlQEF<@v*yhYS@8ke{feRbE9x{bCsZKIH-sr#G4V>Z8m z+NH+~mQ&otS1r2`#;Py@7K-8QtSn<=<3WKe&m6c1+e(duZ}p+uN6sRwU^pk+yb*4t zR88?WNkMBPV%?-{&Y}v=L1JS4(Fafb*aVsC34-`Xkne)~-o%rKRd>$GZlnT`YlwI` zb+3t%8_~0DzrOlKlm6r{>AzzyKMnQhdGb_Q9sQ9mv?xLq_cj>Aqt@3^b~W$^1Isa| zQoO)*l9qZeV09{rP?kLSvL{gc_OzxS>CG$;0o8Nk(_cHUGFE__)*bgc&doJj_L=_s za^7w}E;rG=?CZae)~{^=s4^ohM?Zi9iWU1aCl)h4R?o6y;s&(e9d9JJvRz9xs~h$zm8FdjxcT{+O?p*syG5bt z1vpDb2PTKL=U|n^k*gxhaFo3H@Hj!_6Te#*20Q5CxaKjY8(z#Mq4j~R#r5FS^{uSv%0#58 zUgt}-S4bsQQmf%~r!9{S2_0qri!6#K^H)ov{{fu!yv7=sB+m#QS%~vp|YQL6*hb`0Yts1(TNAf3~;pI`{%q@;RRX?0>b0v!W z*TzZl zfE%{|IjsPAGQ0C0UC`3d=%)Z=`;Hi`#hae0xHVqk3_*`U+O!o{R5Hc}-bD z3$EEzR9&2$4}ht?x3PY$;V)Azp%O%HfLuAe=gNDvs9Z*0)2W4}`_{h#WviP+h<-!s z_1(*n_Kya`u6vO}$Rpr0r9IU%kHBwD1x0vQ(ybWomEGj$PA}$LsUG*WqHZ(M2^(lo z80fz`vsg`e6f;E+Ny;51FcLgZG242_hEp7Y;cG=%6B1Lyj8C{&S+l)YP*k;T0;BWr zb{*5{{~3?HkE3fE*LC=J&YeA}I4A_CHqerEn2K1#-1WN7UrKrgvWR)VKQqv~^sf0l zKE;(FOak|LIvPp+^0ZNLXq=lu#SZ#_{}{B!WbLRn*Pe9>fNM_M_9Y%#wH8O(_uQi1 zd3Z8NH|3!lTO)?KR3$M9F0V$yL&MwgK?(JMsTTCWzmVR*4pM_lw{^vPw2BNBnZAwz zB$p9cBXXhmpg@cRej_q3Mbd{*ak}^QpL(NgmrGkk6mj~l8+m}}hq0mm1=~$M=v_tA z$_dk?&uL$D%kAFk29?+QVjk>|eCNZ-XCDlzVjo@XBP}nINJMxL2oDW$y*N$_?9@cp z=cD&t2rFMFcuOA`Q18fzAnikvFR%>><_A#1C=0R0)|Jzf%Mn`iIgN;6d1So9PMV@K z;`YNsD*ulqWzNZC9D$1J#ZRjIhm#Wh4=0`CbEDTJ&4g=Lngh>|$by)ZGY0$nS=i3^ zHS0f*FQn5ZS!C$bS+u5iw`3uISubI?bOFY{OeYzQG#vL+zX5)l4 zHgwvnam9y{{GL= zszJWx9KMND#RK0A(BvOMW?mON%JCz@qiE zJ<=80r)l#d!Yk=5D(WViKje0YjyE35m7fISWW1wpX%yza#ZHEPovm7|lLG$0K2dEyd{5p0JF9B7P@kSbgUUKg1dgW13V^bZtnu14IV5Kosd&~BGj*gC( zM@y~lXFg3b7k;0n4~#VCGW`?MBXv6Z9SWvqA1I9C@rT$tpp`ZI>dp_zDoxFUOk>?DnotD*CHq_ zKrr%4SXMxP4~+eS#is9M=kZQ0%;dEr3Qiv<`*D<$y1zq`!_LJ|>b67HnaZsY4rZUn zVV)DB7j%uti0xXUjO&^$p2`+4k?+rYUMBF)nx&Dq=Df7}bAm-USEGNzbd=ayrva%6 zL&hk@sz&@n7PeMfj<|R|jc`?pDk73t8YrVC>Q`%5L<&3`LZ#f2%KJ{y5y7~?v<@J0 zOQ{NJG4+6+zn`XczUZ2F?@pi&5ByfoYdo1W^W_{}G#Ng>+rfA4|Lf+wAKC8S|9^L> z4mC>6QdC<}wA5a$UDXgIDt6V1(#96+?yxB;u}4J_A!brDI&6x@h*hncI@sTFTpF9h2$!yGJLj=wz8oH zDrDq=cL`E&m&;tt2H5|xsRpt1rJ2~9@alTK&bIGxl7XHH4qor|rWV;(jep70E1BAu z^glekJm)plo~T(+cE={eohu=YGJ5tqO6yJRfcv;>WoyUyHSr3D*kvhh?qP=_>#XTR ztdU?=pnYK4f$yVQpS_VYBco)Gv%=`Hxu|D%?A!gLj<{OCj4ARw=;8qa)22{|?92Qu~ZDc=P+jTJw323)f562R} z)JW{T>>Rr!WlMBNP4?^q#|lU5&39kzuDEtscKzABqR9HP?D~xbJgcEQ#)HU~td$rz z-EA(A`guX}xI#s`_xGh?ly6T<&hTDTc&Yno(b>&imRxMN8__k@*bH4@eXqLN5{;NI z+*sSWDt>JCoHqNZk-GF-zSeYIYc zOm_{62Q8qv!VUoKp}YV#atkvSQo1ftiAMh;IWx^1fMyg4ztQ&46&a428Hx#qy}GJ& zbcm{w4$VjHVLXKm^{f@qwUyoNA5Hjj_fA=hI+8STP_cCYX zEZfBr;&pN*I=NMO{5YOBuV$sqi4XQO{7UT`d^qe;>6}1CMFlvUF!5OV{y_!g4ZdPr zCtcKNHGjhKe)`+z=K}9HEGI6C%sPq8pWoT|k*&dLg%Z6=K~NTz4AQHvhp5WmrbY_C zc;ch{)N61piL=Fb_H!Ad(Un4(nV(4yhy+d8#Qicxu)cLTP)zi%1zfk zc36miUAjp@XtH9dsh4GJpRKw|QN!<7oYp^IJJDv+YQb6CG)zTO2GhZQEbF`T;&*I* zkwER^j2?sHw%g$|7`WDB-0`0vHP!9qLZ$lt$~S72O{PA(t8Vy{^*XgW`#u(Z#Z5FR zG2j6IxBu!F0|7W~Dq*p=*M%it^DT7w`eph7@9ypdHBCSFC?)aF-C%#0r1g;qti9Y{@ix#amj*{^lX#ohzuz}@i^dv&GiNh=TJO?U-FddzRCoMfOr?ATkh zU2?2@Fk2F)bX%0B0W7UIIn;oAg9}f9ian7-Jm`Hd^E#yFc{3p0RIhGPtYG;fd3va@ zTe+6i8a`B3)w1=58Nr$G0I{~+ z40D)1I_M^^g>{C*f)5VdO00Rq#EXoEzZ1LWIIb+C?lotb5q>(9=%({aFLAg$smhV4 zfu;zleP$Qj%??vNT25H3r^9Xtf`$C}Dd9U8=mp)78pG@9cpcJbited_cUHDBO^2B9eE312@b=wMZSD2<@rVU?NGgbOm7X9NhmiT*|nFe(M;Jdmq%vS7 zeX$CbnEVd&kU23_XZZQMp54Xg1Aj)ZjJDYh@cda5;=tJ2XXI-|@8y$*pyQX&_u|w# z!4j6BhAjKKz{Be!Y)20Q{HE=6nudb42`usch=^xx(@;B-*4j&S=b8uhVtS zR$p|Pjf8aS>1~XVvmsTsM?hm9f)sQF>{M}y@Y8%FQ%*a>g~p{1eT8J14?Y>LewS#7 zI;(GW#ylj$V_#qJ(+~TQ$!4zxv5D!AHH;OLpI!H zlvhL(BeXMB#^txF1gL%B1Zq}d`E@kCPVG`UaQAp*;`}7Je>|LfcX5qZ?(O44dBisz zh{|kej9;zL3@B>UwuESUJx@E@Z-i%5_4~?vjX2Hx!GobNfuN%whXz@@oi)P&)X;LN z+9f|jEs_JWFCf53Ac!`YYVQRJ)2EsFR!vK;`l{?}Yd^UWgZt|1MiU6SJjt)~dwA!{ zhVh(r{6(PUM&pZm=H?S;ohfF%@UL!_Bc9VWOG~ePlK9}&8_)dwWMVvXv_-&KnfC(W zMrpElG2Y~pdTJ$)mFks%CdcEhfSEz%j$aOFT8)ozPRX}d0?h3mg&h3fqf`zGN=uai zpq2eFM8W4PJ0QsOpNvUUy!q)V4$IKYV{5r<;QGZP7Aqt!chM1t=Lp5uY|sW~9X|$z zM{ruFKidyKC4)&Yo|fws z)c{*r$poHgiJq6TL-i1y$%R*Ea!!bXKst%)*x@P)QCj*o%>x(;Qm(|=aoo$bjzZ}uwS0)?9=ghEw29(BP*zALv- zi_XTwxbW(eKu+)A{s(BiW@kq~%#yy2r+1wC$pDSy?($SS43+&Bapns?ve0#;e4to` zWNYVbo9%t(slW~JoN6Fy)w%b5s!Z)ur%;CMsw#CvzP>WI$Iq%R;5@WyKF_K%RZ9?j zMig>F32*$v*)(HAV(U~c%Nd8m-Qt3RwsYsol)N2;A-3wMdTB_!Xy1cB?I#L9{zh%i zbea>LkfUCs{J{Z@t3h&0d1-9s#5GJJmC$`ST|)gH?AzZWARr-GVv7gR+u8em%@VKO|*8rCcmROo2#oeou_GveyPgJo?aS$+)$M26zDg zG1)M2ffgjd3pX}4#LdAami~yzyb2MK{%3h@3I2L-Z0<;SIVScPjkIIvK(hhVXK&-j zF;~;%?aN_G{a7uc<}G2}Gs56=2^t(ho7YN*?U_t;F}>G zF=yI*f+xFO*Hrt>H7o#&0$^cEB%~eK%uL3S@z*^PC$^vH{P024WE3d6WH0|iR-&H9tLS|Efy87Vd9_hD&?j> zNnq+uj6cv72v9@_Hj~W>fE$yYdxs(;5m*e&UPk5IiAS9S1sfafL}HHa1?vE$1xG*6 zMBg*AH%Jy1Wvq?;rXi?n!h$vwxx}v=dlcdX2>6d=t`)?u-vmd@+#R1Zrep8|;@^-m zi|$EK@O5JqM->>o%P{y%T+2cEn-Pp9>&x z#I;Zma_q|<#u-lNZ%bHUbLgwu6Uf($a-bqL;CTA9fG-W9iZ%>gLY!z#!~efOb-vfXJ2}&{fl0*#qC5E9JHi+MhY>({(p@{n$0%KG8$}7;2n^s>!!DQe^yeew`^)W*B8{<^)G_)3O78p=#4Ppu>q8^a?9kk8;6+HK zR&vR}i`;tYerq5B6A6<&0?D;PlW&1Q0F3TCZL$0Lh}B~vVpP##f9qFozKEs2t0R=1 z<@vilaNzzt1Zv`vqb&%gB^O)%ELCk5g*ayG@u_%v=fhmQ%1i$x!I&88+cb2%d8M$6 zG7XP$Vs1m<6#rU|I`ywawcbibPJiyBrmT`Sc;(9Xu8ivPIyu)7*c9F>@3Bc~P0LRw)X^DM!=uwO@_MHYsexq~9a^9@=lRXDVBEVHkT7&W{mKT~K z_2{(6l-6+A2UB<;C*hjf=iSZj3LqrOjs}^xS04uic#wJhdrGs<0k;fUL6P#gq@992 zIIn`#gW{oq8m|fzf4(M}5jyc>V5qh-V=yHX8c=P)0U@(S%ZtF9w4?di^Bn*#A2nK7 zi4DU_pp)eOp@8IeHd1AV$1eEqKra&j@nnW7K@Qsw=-r_4H?xWr^GG{{?{~zEqq(yC z!4K2R;e>F*_qa8~qiAC+e+URUcYpic*6ojl@1JTHq6B^ady6v>d=p6K_l0l!;2CPx zyL+h#;V?i0;<1+i&Y0M8TOyxjTKEu&FM`L&=k|m5_&xiAg+qOk6-k^ECTX%vIo|DN zHlc#X@co?2e(U)n*H?-x_`umJ6^DMk7W z5Ib_|3ZA&sj;w3&QE&5OVIB9*7~_PSKA-3Fek~8nym(16?ppA|v7PnK8ZM(X7H{27 zi=lw#)VcFD(-K*880ZszCWCLC_9Pb>3j-v^0rfMD`!vUQeCH^b=}@M{4@{E^1RwMK zVNvvA3SO{Dl(ol@wD@DXg7egpDCxz3=oCJ~yaGth)#v5T+}HvvPE+8$*E7i$&fw4Ar!vx$?J0cxC)PayC)J}40|iC-NSy71C8g=dNtY<6P|lq|j|aPy`__ORrkPA# z@OAi=DsxlzdF$S`c|uPAk8F5)jWeQqd)d6I56r#8WP;Pcw6=+N*BfRgm}k$pIPGjF zDD_JFxON(Cvg2xEjIWMpi4bEO$pBvx8<)WK;bx&&O_{Li*D^a!(pOGuR$IH&IF=kv zH*c0I!6zV~h=SC^iSSg_oP!D}RVwFSp&*ieg$3?>x{Sy~sK*+QhF*i*1p~r6*Y~Hl z00S40K$4Q(t*u8BQO3No4q5W7Hbfq&>p>gOmW8C(*JB8P(^-aszC^h|VVq)JGYmZg z?Y2I1rqyl36_X!9*o8jVbUi15klX!bmLKV(L}>`Ungac-)huiXlME=9W6V^wyxnmi zERx&MC#sSMUiRyU!k5t=XE1OqYr&+U$aVO*w}fOITr6N)sn_6|<;jjS<4~)gL=5S+e0Eck)HHsatnL8>NIM{ubod9YV^Kt9^iOKY`S>=ZI5&L81 zIhyVP3aK$&^&btGg@#M5(Dy*B zo(W8`oF;u*a_X$quDY37t~Vx)V0Jd`CGp$N6SayGiAfW6e{ZduLWsfZH|N^)geiJ2 z*!r|9)gQXK&8z+XgIc7f`>*iFDOUJ+ntY7UO$Dd3(e9a?Gtd2XEjh}GLze(`ei-6u zckB@S354LeJ)VeWwIrR#+gMd}^E%Jlr31=0{p;dR1$sA;dMgl#y>r(ewUN;-25wUH zsN|3(KUjOJ<#wNf|5z2^SaXGNDKH}^l1H*x6j;Fc+b%Yf^%;e=xG$rSy*)thN}N;3 zNYm^4Jg1}1cX+?(?P5`OFGXq>*2Eew3tyIBVFwzjY~G$tdHK%pu{1b>;WA#+Ead39 zo0d2hS^#q)Eo(N*IYJ=~rn5*r0kK!7L;w+))=D;B)Ws%S4~-eA@aTvyJ{biINz$WR zKP6~lFx~@?v&BamkA_`jo)?KbLwA+<3I=ZApQ{x$?tH!z=Y+{JE%$e!cDb7U=2s|* zUDotPArUEsH`c@n7ES(fCn>W zb`3>X2t;6_(AG5;1(66L$(@ZZdQvZXvG{_B7eGcf_yRjyKdSCuE0{mHPg(f3haKGy zaRWc2mNY ze#8xNoCMQjlXWkL6{x$aKT0W83eBqf*&^>#K>0Q;)XTc2`38NDiFi&VK9Iea{@z(U zt~j=&M*z0>=LYs)EVL`-HGOe#RYA^})Pv5e_7BPdDXJ#QSh*q=Smp9~{BUd`O&A4W zkbqT(@+F;_UYkpMfH`s4G2B@s2$ZeTk^$TTpVv$Pc2^X=E|xkAgsGNHd?3i$g+;$x zIn6bQSpMWTqmdU!z9KP3KRgyZ_SayfA8-G&12Ec!zKA+tHCL+4kk7IM6Y&S~{h5D_ zmGYr21OzdB)>~6H3u8}W=(*-AwTT5B*K6D&9)z#nXUSJ|=Q02WkZ_M;C?dfDb(lpk zy%w>5)d#n~+C7?^C7A4A-%J77Kg*zHypQ_+^22H1%N{cGh9X2K;L|5OhQxN|P$x{a z$6`d?&klTRK04kq?A;PwBB+h!J?01c_uuHj6+rvsI-`LbMiRW!B zU*)LSd*pcP!sX`_FT6>#~{;U0Vf{pZ{u90&U9B!_Rdao{kW} ze6dxI09=t>0~(XjUGjtHw4{m2@S^Vkv`LhnaD?#w7ojHYbW{!W61G5Wkce zjrf`q0N2a3!%3x7Qz8TD;lOh~6trm@J2S`hn(+x9H-m4^_-jT47Z?8ZnFAT~RVS~N zr=1AGb+FfS0q!nk`s4wS=rc)?FwXYwX{f+|&*G5?#T(*?N^ylQB%lGkD(_!*IM>z_&iH7x>+UjK3vUEW9isJrtZp lfT{l<0MbcUu52Hlm@(Hj!TK&p0kHUg9%_L#i`8vj{~zwa$FKkZ literal 0 HcmV?d00001