AadAuthenticationFactory.psm1
|
function New-AadAuthenticationFactory { <# .SYNOPSIS Creates authentication factory with provided parameters for Public or Confidential client flows .DESCRIPTION Creates authentication factory with provided parameters for Public or Confidential client flows Authentication uses by default well-know clientId of Azure Powershell, but can accept clientId of app registered in your own tenant. .OUTPUTS AadAuthenticationFactory object .EXAMPLE New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('https://my-db.documents.azure.com/.default') -AuthMode Interactive Description ----------- This command returns AAD authentication factory for Public client auth flow with well-known clientId for Azure PowerShell and interactive authentication for getting tokens for CosmosDB account .EXAMPLE $proxy=new-object System.Net.WebProxy('http://myproxy.mycompany.com:8080') $proxy.BypassProxyOnLocal=$true $factory = New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('https://eventgrid.azure.net/.default') -AuthMode deviceCode -Proxy $proxy $token = $factory | Get-AadToken Description ----------- Command works in on prem environment where access to internet is available via proxy. Command authenticates user with device code flow. .EXAMPLE $creds = Get-Credential New-AadAuthenticationFactory -TenantId 'mytenant.com' -ResourceOwnerCredential $creds -RequiredScopes 'https://vault.azure.net/.default' $vaultToken = Get-AadToken Description ----------- Command collects credentials of cloud-only account and authenticates with Resource Owner Password flow to get access token for Azure KeyVault. Get-AadToken command uses implicit factory cached from last call of New-AadAuthenticationFactory #> param ( [Parameter()] [Alias("RequiredScopes")] [string[]] #Scopes to ask token for $DefaultScopes, [Parameter(Mandatory,ParameterSetName = 'ConfidentialClientWithSecret')] [Parameter(Mandatory,ParameterSetName = 'ConfidentialClientWithCertificate')] [Parameter(Mandatory,ParameterSetName = 'PublicClient')] [Parameter(Mandatory,ParameterSetName = 'ResourceOwnerPasssword')] [string] #Id of tenant where to autenticate the user. Can be tenant id, or any registerd DNS domain #You can also use AAD placeholder: organizations, common, consumers $TenantId, [Parameter()] [string] #ClientId of application that gets token #Default: well-known clientId for Azure PowerShell $ClientId, [Parameter(ParameterSetName = 'ConfidentialClientWithSecret')] [string] #Client secret for ClientID #Used to get access as application rather than as calling user $ClientSecret, [Parameter(ParameterSetName = 'ResourceOwnerPasssword')] [pscredential] #Resource Owner username and password for public client ROPC flow #Used to get access as user specified by credential #Note: Does not work for federated authentication $ResourceOwnerCredential, [Parameter(ParameterSetName = 'ConfidentialClientWithCertificate')] [System.Security.Cryptography.X509Certificates.X509Certificate2] #Authentication certificate for ClientID #Used to get access as application rather than as calling user $X509Certificate, [Parameter(ParameterSetName = 'ConfidentialClientWithSecret')] [Parameter(ParameterSetName = 'ConfidentialClientWithCertificate')] [Parameter(ParameterSetName = 'PublicClient')] [Parameter(ParameterSetName = 'ResourceOwnerPasssword')] [ValidateSet('AzurePublic', 'AzureGermany', 'AzureChina','AzureUsGovernment','None')] [string] #AAD auth endpoint #Default: endpoint for public cloud $AzureCloudInstance = 'AzurePublic', [Parameter(Mandatory, ParameterSetName = 'PublicClient')] [ValidateSet('Interactive', 'DeviceCode', 'WIA')] [string] #How to authenticate client - via web view, via device code flow, or via Windows Integrated Auth #Used in public client flows $AuthMode, [Parameter(ParameterSetName = 'PublicClient')] [Alias("UserNameHint")] [string] #Username hint for authentication UI #Optional $DefaultUserName, [Parameter(ParameterSetName = 'MSI')] [Switch] #tries to get parameters from environment and token from internal endpoint provided by Azure MSI support $UseManagedIdentity, [Parameter()] [System.Net.WebProxy] #Web proxy configuration #Optional $proxy = $null ) process { $ModuleManifest = Import-PowershellDataFile $PSCommandPath.Replace('.psm1', '.psd1') $moduleName = [system.io.path]::GetFileNameWithoutExtension($PSCommandPath) $moduleVersion = $moduleManifest.ModuleVersion $useDefaultCredentials = $false if([string]::IsNullOrWhiteSpace($clientId)) {$clientId = $ModuleManifest.PrivateData.Configuration.DefaultClientId} #setup of common options switch($PSCmdlet.ParameterSetName) { {$_ -in 'ConfidentialClientWithSecret','ConfidentialClientWithCertificate'} { $opts = new-object Microsoft.Identity.Client.ConfidentialClientApplicationOptions $opts.ClientId = $clientId $opts.clientName = $moduleName $opts.ClientVersion = $moduleVersion $opts.AzureCloudInstance = $AzureCloudInstance $opts.TenantId = $tenantId $builder = [Microsoft.Identity.Client.ConfidentialClientApplicationBuilder]::CreateWithApplicationOptions($opts) $builder = $builder.WithClientSecret($ClientSecret) $flowType = [AuthenticationFlow]::ConfidentialClient break; } {$_ -in 'PublicClient','ResourceOwnerPasssword'} { $opts = new-object Microsoft.Identity.Client.PublicClientApplicationOptions $opts.ClientId = $clientId $opts.clientName = $moduleName $opts.ClientVersion = $moduleVersion $opts.AzureCloudInstance = $AzureCloudInstance $opts.TenantId = $tenantId $builder = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::CreateWithApplicationOptions($opts) $builder = $builder.WithDefaultRedirectUri() if($_ -eq 'ResourceOwnerPasssword') { $flowType = [AuthenticationFlow]::ResourceOwnerPassword } else { switch ($AuthMode) { 'WIA' { $flowType = [AuthenticationFlow]::PublicClientWithWia $useDefaultCredentials = $true break } 'DeviceCode' { $flowType = [AuthenticationFlow]::PublicClientWithDeviceCode break } Default { $flowType = [AuthenticationFlow]::PublicClient break } } } break; } 'MSI' { if($clientId -eq $ModuleManifest.PrivateData.Configuration.DefaultClientId) { $managedIdentityId = [Microsoft.Identity.Client.AppConfig.ManagedIdentityId]::SystemAssigned $flowType = [AuthenticationFlow]::ManagedIdentity } else { $managedIdentityId = [Microsoft.Identity.Client.AppConfig.ManagedIdentityId]::WithUserAssignedClientId($clientId) $flowType = [AuthenticationFlow]::UserAssignedIdentity } $builder = [Microsoft.Identity.Client.ManagedIdentityApplicationBuilder]::Create($managedIdentityId) break; } default { throw (new-object System.ArgumentException("Unsupported flow type: $_")) } } #crate factory and add to builder $httpFactory = [GcMsalHttpClientFactory]::Create($proxy,$moduleManifest.ModuleVersion,$useDefaultCredentials) $builder = $builder.WithHttpClientFactory($httpFactory) #build the app and add processing info $script:AadLastCreatedFactory = $builder.Build() ` | Add-Member -MemberType NoteProperty -Name FlowType -Value $flowType -PassThru ` | Add-Member -MemberType NoteProperty -Name DefaultScopes -Value $DefaultScopes -PassThru ` | Add-Member -MemberType NoteProperty -Name DefaultUserName -Value $DefaultUserName -PassThru ` | Add-Member -MemberType NoteProperty -Name ResourceOwnerCredential -Value $ResourceOwnerCredential -PassThru #Give the factory common type name for formatting $script:AadLastCreatedFactory.psobject.typenames.Insert(0,'AadAuthenticationFactory') $script:AadLastCreatedFactory } } function Get-AadToken { <# .SYNOPSIS Retrieves AAD token according to configuration of authentication factory .DESCRIPTION Retrieves AAD token according to configuration of authentication factory .OUTPUTS Authentication result from AAD with tokens and other information, or hashtable with Authorization header .EXAMPLE $factory = New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('https://eventgrid.azure.net/.default') -AuthMode Interactive $token = $factory | Get-AadToken Description ----------- Command creates authentication factory and retrieves AAD token from it, authenticating user via web view or browser .EXAMPLE $cosmosDbAccountName = 'myCosmosDBAcct $factory = New-AadAuthenticationFactory -DefaultScopes @("https://$cosmosDbAccountName`.documents.azure.com/.default") -UseManagedIdentity $token = $factory | Get-AadToken Description ----------- Command creates authentication factory and retrieves AAD token for access data plane of cosmos DB aaccount. For details on CosmosDB RBAC access, see https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac .EXAMPLE $factory = New-AadAuthenticationFactory -TenantId mydomain.com -AuthMode WIA $token = $factory | Get-AadToken -Scopes @('https://eventgrid.azure.net/.default') Description ----------- Command creates authentication factory without default scopes and retrieves AAD token for access to event grid, specifying scopes when asking for token .EXAMPLE New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('api://mycompany.com/myapi/.default') -AuthMode WIA $headers = Get-AadToken -AsHashtable Invoke-RestMethod -Uri "https://myapi.mycomany.com/items" -Headers $headers Description ----------- Command shows how to get token as hashtable containing properly formatted Authorization header and use it to authenticate call method on REST API #> [CmdletBinding()] param ( [Parameter()] [Alias("RequiredScopes")] #Scopes to be returned in the token. #If not specified, returns token with default scopes provided when creating the factory [string[]]$Scopes = $null, [Parameter()] #User name hint for authentication process [string]$UserName, [Parameter()] #Access token for user #Used to identify user in on-behalf-of flows [string]$UserToken, #When specified, hashtable with Authorization header is returned instead of token #This is shortcut to use when just need to have token for authorization header to call REST API (e.g. via Invoke-RestMethod) #When not specified, returns authentication result with tokens and other metadata [switch]$AsHashTable, #Asks runtime to avoid token cache and get fresh token from AAD [switch]$forceRefresh, [Parameter(ValueFromPipeline)] #AAD authentication factory created via New-AadAuthenticationFactory $Factory = $script:AadLastCreatedFactory ) begin { [System.Threading.CancellationTokenSource]$cts = new-object System.Threading.CancellationTokenSource([timespan]::FromSeconds(180)) } process { if($null -eq $Factory) { Write-Error "Please pass valid instance of AAD Authentication Factory" return } if($null -eq $Scopes) { $scopes = $factory.DefaultScopes if($null -eq $Scopes) { throw (new-object System.ArgumentException("No scopes scecified")) } } if([string]::IsNullOrWhiteSpace($UserName)) { $UserName = $factory.DefaultUserName } if(-not [string]::IsNullOrEmpty($UserToken)) { if($Factory.FlowType -ne [AuthenticationFlow]::ConfidentialClient) { throw (new-object System.ArgumentException("Unsupported authentication flow for on-behalf-of: $($Factory.FlowType)")) } $assertion = new-object Microsoft.Identity.Client.UserAssertion($UserToken) $task = $Factory.AcquireTokenOnBehalfOf($Scopes, $assertion).ExecuteAsync($cts.Token) } else { $account = Get-AadAccount -UserName $UserName -Factory $Factory switch($Factory.FlowType) { ([AuthenticationFlow]::PublicClient) { try { $task = $factory.AcquireTokenSilent($scopes,$account).WithForceRefresh($forceRefresh).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts } catch [Microsoft.Identity.Client.MsalUiRequiredException] { $task = $factory.AcquireTokenInteractive($Scopes).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts } break; } ([AuthenticationFlow]::PublicClientWithWia) { if($null -ne $Account) { $task = $factory.AcquireTokenSilent($Scopes, $account).WithForceRefresh($forceRefresh).ExecuteAsync() $rslt = $task | AwaitTask -CancellationTokenSource $cts } else { $task = $factory.AcquireTokenByIntegratedWindowsAuth($Scopes).WithUserName($UserName).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts #let the app throw to caller when UI required as the purpose here is to stay silent } break; } ([AuthenticationFlow]::PublicClientWithDeviceCode) { try { $task = $factory.AcquireTokenSilent($scopes,$account).WithForceRefresh($forceRefresh).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts } catch [Microsoft.Identity.Client.MsalUiRequiredException] { $task = $factory.AcquireTokenWithDeviceCode($Scopes,[DeviceCodeHandler]::Get()).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts } break; } ([AuthenticationFlow]::ResourceOwnerPassword) { try { $creds = $factory.ResourceOwnerCredential if($forceRefresh) { $task = $factory.AcquireTokenByUsernamePassword($Scopes, $UserName, $creds.GetNetworkCredential().Password).WithPrompt('ForceLogin').ExecuteAsync() $rslt = $task | AwaitTask -CancellationTokenSource $cts } else { $task = $factory.AcquireTokenSilent($scopes,$account).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts } } catch [Microsoft.Identity.Client.MsalUiRequiredException] { $task = $factory.AcquireTokenByUsernamePassword($Scopes, $UserName, $creds.GetNetworkCredential().Password).WithPrompt('ForceLogin').ExecuteAsync() $rslt = $task | AwaitTask -CancellationTokenSource $cts } break; } ([AuthenticationFlow]::ConfidentialClient) { $task = $factory.AcquireTokenForClient($scopes).WithForceRefresh($forceRefresh).ExecuteAsync($cts.Token) $rslt = $task | AwaitTask -CancellationTokenSource $cts break } ([AuthenticationFlow]::ManagedIdentity) { $task = $Factory.AcquireTokenForManagedIdentity($scopes).WithForceRefresh($forceRefresh).ExecuteAsync() $rslt = $task | AwaitTask -CancellationTokenSource $cts break } ([AuthenticationFlow]::UserAssignedIdentity) { $task = $Factory.AcquireTokenForManagedIdentity($scopes).WithForceRefresh($forceRefresh).ExecuteAsync() $rslt = $task | AwaitTask -CancellationTokenSource $cts break } default { throw (new-object System.ArgumentException("Unsupported authentication flow: $_")) } } } if($AsHashTable) { @{ 'Authorization' = $rslt.CreateAuthorizationHeader() } } else { $rslt } } end { if($null -ne $cts) { $cts.Dispose() } } } function Test-AadToken { <# .SYNOPSIS Parses and validates AAD-issued token .DESCRIPTION Parses provided IdToken or AccessToken and checks for its validity. Note that some tokens may not be properly validated - this is in case then 'nonce' field present and set in the haeder. AAD issues such tokens for Graph API and nonce is taken into consideration when validating the token. See discussion at https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/609 for more details. .OUTPUTS Parsed token and information about its validity .EXAMPLE $factory = New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('https://eventgrid.azure.net/.default') -AuthMode Interactive $token = $factory | Get-AadToken $token.idToken | Test-AadToken | fl Description ----------- Command creates authentication factory, asks it to issue token for EventGrid and parses IdToken and validates it .EXAMPLE New-AadAuthenticationFactory -TenantId mydomain.com -DefaultScopes @('https://graph.microsoft.com/.default') -AuthMode Interactive Get-AadToken | Test-AadToken -PayloadOnly Description ----------- Command creates authentication factory, asks it to issue token for MS Graph and parses AccessToken (this is token to use when passing complete response from Get-AadToken), validates it and shows claims contained #> [CmdletBinding()] param ( [Parameter(Mandatory,ValueFromPipeline)] [object] #IdToken or AccessToken field from token returned by Get-AadToken #or complete result of Get-AadToken - in such case, AccessToken is examined $Token, [switch] $PayloadOnly ) process { if($token -is [Microsoft.Identity.Client.AuthenticationResult]) { $Token = $Token.AccessToken } if($token -is [System.Collections.Hashtable]) { $token = $token['Authorization'].Replace('Bearer ','') } $parts = $token.split('.') if($parts.Length -ne 3) { Write-Error 'Invalid format of provided token' return } $result = [PSCustomObject]@{ Header = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Base64UrlDecode -Data $parts[0]))) | ConvertFrom-Json Payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((Base64UrlDecode -Data $parts[1]))) | ConvertFrom-Json IsValid = $false } #validate the result using published keys $endpoint = $result.Payload.iss.Replace('/v2.0','/') $signingKeys = Invoke-RestMethod -Method Get -Uri "$($endpoint)discovery/keys" $key = $signingKeys.keys | Where-object{$_.kid -eq $result.Header.kid} if($null -eq $key) { throw "Could not find signing key with id = $($result.Header.kid)" } $cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2(,[Convert]::FromBase64String($key.x5c[0])) $rsa = $cert.PublicKey.Key $payload = "$($parts[0]).$($parts[1])" $dataToVerify = [System.Text.Encoding]::UTF8.GetBytes($payload) $sig = Base64UrlDecode -Data $parts[2] $signature = [Convert]::FromBase64String($sig) switch($result.Header.alg) { 'RS384' { $hash = [System.Security.Cryptography.HashAlgorithmName]::SHA384 break; } 'RS512' { $hash = [System.Security.Cryptography.HashAlgorithmName]::SHA512 break; } default { $hash = [System.Security.Cryptography.HashAlgorithmName]::SHA256 break; } } $padding = [System.Security.Cryptography.RSASignaturePadding]::Pkcs1 $result.IsValid = $rsa.VerifyData($dataToVerify,$signature,$hash,$Padding) $cert.Dispose() if($null -ne $result.Header.nonce) { Write-Verbose "Header contains nonce, so token may not be properly validated. See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/609" } $result.psobject.typenames.Insert(0,'GreyCorbel.Identity.Authentication.TokenValidationResult') if($PayloadOnly) { $result.Payload } else { $result } } } function Get-AadAccount { <# .SYNOPSIS Returns account(s) from AAD authentication factory cache .DESCRIPTION For supported factory types, command returns either account(s) that match provided user account, or all accounts available in the cche. For unsupported factories (those working with Managed Identities) does not return anything .OUTPUTS One or more accounts found in factory cache .NOTES Command uses -match operator to match value of UserName parameter with usernames of accounts in factory's cache .EXAMPLE $factory = New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('https://eventgrid.azure.net/.default') -AuthMode Interactive Get-AadAccount -Factory $factory -All Description ----------- Returns all accounts from factory cache .EXAMPLE New-AadAuthenticationFactory -TenantId mydomain.com -RequiredScopes @('https://eventgrid.azure.net/.default') -AuthMode Interactive Get-AadAccount -UserName John Description ----------- Returns all accounts from factory cache that match pattern 'John'. #> [CmdletBinding()] param ( [Parameter(ValueFromPipeline, ParameterSetName = 'SpecificAcount')] #User name to get account information for #If not specified, all accounts cached in factory are returned [string]$UserName, [Parameter(ParameterSetName = 'All')] #tells the command to return all accounts available [switch]$All, #AAD authentication factory created via New-AadAuthenticationFactory $Factory = $script:AadLastCreatedFactory ) begin { [System.Threading.CancellationTokenSource]$cts = new-object System.Threading.CancellationTokenSource([timespan]::FromSeconds(180)) $supportedFlows = [AuthenticationFlow]::PublicClientWithWia, [AuthenticationFlow]::PublicClientWithDeviceCode, [AuthenticationFlow]::PublicClient, [AuthenticationFlow]::ResourceOwnerPassword, [AuthenticationFlow]::ConfidentialClient } process { if($factory.FlowType -in $supportedFlows) { switch($PSCmdlet.ParameterSetName) { 'All' { $Factory.GetAccountsAsync() | AwaitTask -CancellationTokenSource $cts break; } 'SpecificAcount' { if(-not [string]::IsNullOrEmpty($UserName)) { $Factory.GetAccountsAsync() | AwaitTask -CancellationTokenSource $cts | Where-Object{$_.UserName -match $Username} } break; } } } } end { if($null -ne $cts) { $cts.Dispose() } } } #region Internals function Base64UrlDecode { param ( [Parameter(Mandatory,ValueFromPipeline)] [string]$Data ) process { $result = $Data $result = $result.Replace('-','+').Replace('_','/') switch($result.Length % 4) { 0 {break;} 2 {$result = "$result=="; break} 3 {$result = "$result="; break;} default {throw "Invalid data format"} } $result } } function AwaitTask { param ( [Parameter(ValueFromPipeline, Mandatory)] $task, [Parameter(Mandatory)] [System.Threading.CancellationTokenSource]$CancellationTokenSource ) process { try { $errorHappened = $false while (-not $task.AsyncWaitHandle.WaitOne(200)) { } $rslt = $task.GetAwaiter().GetResult() $rslt } catch [System.OperationCanceledException]{ $errorHappened = $true Write-Warning 'Authentication process has timed out' } catch { $errorHappened = $true throw $_.Exception } finally { if(-not $errorHappened -and $null -eq $rslt) { #we do not have result and did not went thru Catch block --> likely Ctrl+Break scenario #let`s cancel authentication in the factory $CancellationTokenSource.Cancel() Write-Verbose 'Authentication canceled by Ctrl+Break' } } } } function Init { param() process { $httpFactoryDefinition = @' using Microsoft.Identity.Client; using System.Net; using System.Net.Http; public class GcMsalHttpClientFactory : Microsoft.Identity.Client.IMsalHttpClientFactory { static HttpClient _httpClient; protected GcMsalHttpClientFactory(WebProxy proxy, string productVersion, bool useDefaultCredentials = false) { if (null == _httpClient) { var httpClientHandler = new HttpClientHandler() { UseDefaultCredentials = useDefaultCredentials }; if (null != proxy) { httpClientHandler.Proxy = proxy; httpClientHandler.UseProxy = true; } _httpClient = new HttpClient(httpClientHandler); _httpClient.DefaultRequestHeaders.UserAgent.Add(new System.Net.Http.Headers.ProductInfoHeaderValue("AadAuthenticationFactory", productVersion)); } } public HttpClient GetHttpClient() { return _httpClient; } //PS5 has trouble to get interface from object instance public static Microsoft.Identity.Client.IMsalHttpClientFactory Create(WebProxy proxy, string productVersion, bool useDefaultCredentials = false) { return new GcMsalHttpClientFactory(proxy, productVersion,useDefaultCredentials); } } '@ $deviceCodeHandlerDefinition = @' public class DeviceCodeHandler { static System.Threading.Tasks.Task _Delegate(Microsoft.Identity.Client.DeviceCodeResult deviceCodeResult) { System.Console.WriteLine(deviceCodeResult.Message); return System.Threading.Tasks.Task.FromResult(0); } //PS5 has trouble to get correct type when returning static method directly public static System.Func<Microsoft.Identity.Client.DeviceCodeResult,System.Threading.Tasks.Task> Get() { return _Delegate; } } '@ $referencedAssemblies = @('System.Net.Http') #load platform specific switch($PSEdition) { 'Core' { $referencedAssemblies+="$PSHome\System.Net.Primitives.dll" $referencedAssemblies+="System.Net.WebProxy" $referencedAssemblies+="System.Console" try { $existingType = [Microsoft.Identity.Client.PublicClientApplication] #compiling http factory against version of preloaded package $referencedAssemblies+=$existingType.Assembly.Location } catch { Add-Type -Path "$PSScriptRoot\Shared\net6.0\Microsoft.IdentityModel.Abstractions.dll" Add-Type -Path "$PSScriptRoot\Shared\net6.0\Microsoft.Identity.Client.dll" #compiling http factory against our version $referencedAssemblies+="$PSScriptRoot\Shared\net6.0\Microsoft.Identity.Client.dll" } break; } 'Desktop' { $referencedAssemblies+="$PSScriptRoot\Shared\net461\Microsoft.Identity.Client.dll" #only load when not present try { [Microsoft.Identity.Client.PublicClientApplication] | Out-Null } catch { Add-Type -Path "$PSScriptRoot\Shared\net461\Microsoft.IdentityModel.Abstractions.dll" Add-Type -Path "$PSScriptRoot\Shared\net461\Microsoft.Identity.Client.dll" } #on desktop, this one is not pre-loaded Add-Type -Assembly System.Net.Http #for desktop, we do not use separate app domain (will add if needed) break; } } [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 #check if we need to load or already loaded if($null -eq ('GcMsalHttpClientFactory' -as [type])) { Add-Type -TypeDefinition $httpFactoryDefinition -ReferencedAssemblies $referencedAssemblies -WarningAction SilentlyContinue -IgnoreWarnings } if($null -eq ('DeviceCodeHandler' -as [type])) { #check if we need to load or already loaded Add-Type -TypeDefinition $deviceCodeHandlerDefinition -ReferencedAssemblies $referencedAssemblies -WarningAction SilentlyContinue -IgnoreWarnings } } } enum AuthenticationFlow { #Public client with browser based auth PublicClient #Public client with console based auth PublicClientWithDeviceCode #Public client with Windows Integrated auth PublicClientWithWia #Confidential client with client secret or certificate ConfidentialClient #Confidential client with System-assigned Managed identity or Arc-enabled server ManagedIdentity #Confidential client with User-assigned Managed identity UserAssignedIdentity #Unattended Resource Owner auth with username and password ResourceOwnerPassword } #endregion Init # SIG # Begin signature block # MIInDQYJKoZIhvcNAQcCoIIm/jCCJvoCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAlvOG3qpCyFPp7 # gL1YUx56kMBju2j5fF9ySnVyG02yKKCCIJAwggWNMIIEdaADAgECAhAOmxiO+dAt # 5+/bUOIIQBhaMA0GCSqGSIb3DQEBDAUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQK # EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNV # BAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yMjA4MDEwMDAwMDBa # Fw0zMTExMDkyMzU5NTlaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy # dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD # ZXJ0IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC # ggIBAL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3E # MB/zG6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKy # unWZanMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsF # xl7sWxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU1 # 5zHL2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJB # MtfbBHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObUR # WBf3JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6 # nj3cAORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxB # YKqxYxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5S # UUd0viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+x # q4aLT8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjggE6MIIB # NjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTs1+OC0nFdZEzfLmc/57qYrhwP # TzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAOBgNVHQ8BAf8EBAMC # AYYweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp # Y2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv # bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0 # aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENB # LmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQEMBQADggEBAHCgv0Nc # Vec4X6CjdBs9thbX979XB72arKGHLOyFXqkauyL4hxppVCLtpIh3bb0aFPQTSnov # Lbc47/T/gLn4offyct4kvFIDyE7QKt76LVbP+fT3rDB6mouyXtTP0UNEm0Mh65Zy # oUi0mcudT6cGAxN3J0TU53/oWajwvy8LpunyNDzs9wPHh6jSTEAZNUZqaVSwuKFW # juyk1T3osdz9HNj0d1pcVIxv76FQPfx2CWiEn2/K2yCNNWAcAgPLILCsWKAOQGPF # mCLBsln1VWvPJ6tsds5vIy30fnFqI2si/xK4VC0nftg62fC2h5b9W9FcrBjDTZ9z # twGpn1eqXijiuZQwggauMIIElqADAgECAhAHNje3JFR82Ees/ShmKl5bMA0GCSqG # SIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx # GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IFRy # dXN0ZWQgUm9vdCBHNDAeFw0yMjAzMjMwMDAwMDBaFw0zNzAzMjIyMzU5NTlaMGMx # CzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjE7MDkGA1UEAxMy # RGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNIQTI1NiBUaW1lU3RhbXBpbmcg # Q0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGhjUGSbPBPXJJUVXH # JQPE8pE3qZdRodbSg9GeTKJtoLDMg/la9hGhRBVCX6SI82j6ffOciQt/nR+eDzMf # UBMLJnOWbfhXqAJ9/UO0hNoR8XOxs+4rgISKIhjf69o9xBd/qxkrPkLcZ47qUT3w # 1lbU5ygt69OxtXXnHwZljZQp09nsad/ZkIdGAHvbREGJ3HxqV3rwN3mfXazL6IRk # tFLydkf3YYMZ3V+0VAshaG43IbtArF+y3kp9zvU5EmfvDqVjbOSmxR3NNg1c1eYb # qMFkdECnwHLFuk4fsbVYTXn+149zk6wsOeKlSNbwsDETqVcplicu9Yemj052FVUm # cJgmf6AaRyBD40NjgHt1biclkJg6OBGz9vae5jtb7IHeIhTZgirHkr+g3uM+onP6 # 5x9abJTyUpURK1h0QCirc0PO30qhHGs4xSnzyqqWc0Jon7ZGs506o9UD4L/wojzK # QtwYSH8UNM/STKvvmz3+DrhkKvp1KCRB7UK/BZxmSVJQ9FHzNklNiyDSLFc1eSuo # 80VgvCONWPfcYd6T/jnA+bIwpUzX6ZhKWD7TA4j+s4/TXkt2ElGTyYwMO1uKIqjB # Jgj5FBASA31fI7tk42PgpuE+9sJ0sj8eCXbsq11GdeJgo1gJASgADoRU7s7pXche # MBK9Rp6103a50g5rmQzSM7TNsQIDAQABo4IBXTCCAVkwEgYDVR0TAQH/BAgwBgEB # /wIBADAdBgNVHQ4EFgQUuhbZbU2FL3MpdpovdYxqII+eyG8wHwYDVR0jBBgwFoAU # 7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoG # CCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0cDovL29j # c3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0cy5kaWdp # Y2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8EPDA6MDig # NqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9v # dEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgBhv1sBwEwDQYJKoZI # hvcNAQELBQADggIBAH1ZjsCTtm+YqUQiAX5m1tghQuGwGC4QTRPPMFPOvxj7x1Bd # 4ksp+3CKDaopafxpwc8dB+k+YMjYC+VcW9dth/qEICU0MWfNthKWb8RQTGIdDAiC # qBa9qVbPFXONASIlzpVpP0d3+3J0FNf/q0+KLHqrhc1DX+1gtqpPkWaeLJ7giqzl # /Yy8ZCaHbJK9nXzQcAp876i8dU+6WvepELJd6f8oVInw1YpxdmXazPByoyP6wCeC # RK6ZJxurJB4mwbfeKuv2nrF5mYGjVoarCkXJ38SNoOeY+/umnXKvxMfBwWpx2cYT # gAnEtp/Nh4cku0+jSbl3ZpHxcpzpSwJSpzd+k1OsOx0ISQ+UzTl63f8lY5knLD0/ # a6fxZsNBzU+2QJshIUDQtxMkzdwdeDrknq3lNHGS1yZr5Dhzq6YBT70/O3itTK37 # xJV77QpfMzmHQXh6OOmc4d0j/R0o08f56PGYX/sr2H7yRp11LB4nLCbbbxV7HhmL # NriT1ObyF5lZynDwN7+YAN8gFk8n+2BnFqFmut1VwDophrCYoCvtlUG3OtUVmDG0 # YgkPCr2B2RP+v6TR81fZvAT6gt4y3wSJ8ADNXcL50CN/AAvkdgIm2fBldkKmKYcJ # RyvmfxqkhQ/8mJb2VVQrH4D6wPIOK+XW+6kvRBVK5xMOHds3OBqhK/bt1nz8MIIG # sDCCBJigAwIBAgIQCK1AsmDSnEyfXs2pvZOu2TANBgkqhkiG9w0BAQwFADBiMQsw # CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu # ZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3QgRzQw # HhcNMjEwNDI5MDAwMDAwWhcNMzYwNDI4MjM1OTU5WjBpMQswCQYDVQQGEwJVUzEX # MBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0 # ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMIICIjAN # BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1bQvQtAorXi3XdU5WRuxiEL1M4zr # PYGXcMW7xIUmMJ+kjmjYXPXrNCQH4UtP03hD9BfXHtr50tVnGlJPDqFX/IiZwZHM # gQM+TXAkZLON4gh9NH1MgFcSa0OamfLFOx/y78tHWhOmTLMBICXzENOLsvsI8Irg # nQnAZaf6mIBJNYc9URnokCF4RS6hnyzhGMIazMXuk0lwQjKP+8bqHPNlaJGiTUyC # EUhSaN4QvRRXXegYE2XFf7JPhSxIpFaENdb5LpyqABXRN/4aBpTCfMjqGzLmysL0 # p6MDDnSlrzm2q2AS4+jWufcx4dyt5Big2MEjR0ezoQ9uo6ttmAaDG7dqZy3SvUQa # khCBj7A7CdfHmzJawv9qYFSLScGT7eG0XOBv6yb5jNWy+TgQ5urOkfW+0/tvk2E0 # XLyTRSiDNipmKF+wc86LJiUGsoPUXPYVGUztYuBeM/Lo6OwKp7ADK5GyNnm+960I # HnWmZcy740hQ83eRGv7bUKJGyGFYmPV8AhY8gyitOYbs1LcNU9D4R+Z1MI3sMJN2 # FKZbS110YU0/EpF23r9Yy3IQKUHw1cVtJnZoEUETWJrcJisB9IlNWdt4z4FKPkBH # X8mBUHOFECMhWWCKZFTBzCEa6DgZfGYczXg4RTCZT/9jT0y7qg0IU0F8WD1Hs/q2 # 7IwyCQLMbDwMVhECAwEAAaOCAVkwggFVMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD # VR0OBBYEFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB8GA1UdIwQYMBaAFOzX44LScV1k # TN8uZz/nupiuHA9PMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcD # AzB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2lj # ZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29t # L0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcnQwQwYDVR0fBDwwOjA4oDagNIYyaHR0 # cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZFJvb3RHNC5jcmww # HAYDVR0gBBUwEzAHBgVngQwBAzAIBgZngQwBBAEwDQYJKoZIhvcNAQEMBQADggIB # ADojRD2NCHbuj7w6mdNW4AIapfhINPMstuZ0ZveUcrEAyq9sMCcTEp6QRJ9L/Z6j # fCbVN7w6XUhtldU/SfQnuxaBRVD9nL22heB2fjdxyyL3WqqQz/WTauPrINHVUHmI # moqKwba9oUgYftzYgBoRGRjNYZmBVvbJ43bnxOQbX0P4PpT/djk9ntSZz0rdKOtf # JqGVWEjVGv7XJz/9kNF2ht0csGBc8w2o7uCJob054ThO2m67Np375SFTWsPK6Wrx # oj7bQ7gzyE84FJKZ9d3OVG3ZXQIUH0AzfAPilbLCIXVzUstG2MQ0HKKlS43Nb3Y3 # LIU/Gs4m6Ri+kAewQ3+ViCCCcPDMyu/9KTVcH4k4Vfc3iosJocsL6TEa/y4ZXDlx # 4b6cpwoG1iZnt5LmTl/eeqxJzy6kdJKt2zyknIYf48FWGysj/4+16oh7cGvmoLr9 # Oj9FpsToFpFSi0HASIRLlk2rREDjjfAVKM7t8RhWByovEMQMCGQ8M4+uKIw8y4+I # Cw2/O/TOHnuO77Xry7fwdxPm5yg/rBKupS8ibEH5glwVZsxsDsrFhsP2JjMMB0ug # 0wcCampAMEhLNKhRILutG4UI4lkNbcoFUCvqShyepf2gpx8GdOfy1lKQ/a+FSCH5 # Vzu0nAPthkX0tGFuv2jiJmCG6sivqf6UHedjGzqGVnhOMIIGwDCCBKigAwIBAgIQ # DE1pckuU+jwqSj0pB4A9WjANBgkqhkiG9w0BAQsFADBjMQswCQYDVQQGEwJVUzEX # MBUGA1UEChMORGlnaUNlcnQsIEluYy4xOzA5BgNVBAMTMkRpZ2lDZXJ0IFRydXN0 # ZWQgRzQgUlNBNDA5NiBTSEEyNTYgVGltZVN0YW1waW5nIENBMB4XDTIyMDkyMTAw # MDAwMFoXDTMzMTEyMTIzNTk1OVowRjELMAkGA1UEBhMCVVMxETAPBgNVBAoTCERp # Z2lDZXJ0MSQwIgYDVQQDExtEaWdpQ2VydCBUaW1lc3RhbXAgMjAyMiAtIDIwggIi # MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDP7KUmOsap8mu7jcENmtuh6BSF # dDMaJqzQHFUeHjZtvJJVDGH0nQl3PRWWCC9rZKT9BoMW15GSOBwxApb7crGXOlWv # M+xhiummKNuQY1y9iVPgOi2Mh0KuJqTku3h4uXoW4VbGwLpkU7sqFudQSLuIaQyI # xvG+4C99O7HKU41Agx7ny3JJKB5MgB6FVueF7fJhvKo6B332q27lZt3iXPUv7Y3U # TZWEaOOAy2p50dIQkUYp6z4m8rSMzUy5Zsi7qlA4DeWMlF0ZWr/1e0BubxaompyV # R4aFeT4MXmaMGgokvpyq0py2909ueMQoP6McD1AGN7oI2TWmtR7aeFgdOej4TJEQ # ln5N4d3CraV++C0bH+wrRhijGfY59/XBT3EuiQMRoku7mL/6T+R7Nu8GRORV/zbq # 5Xwx5/PCUsTmFntafqUlc9vAapkhLWPlWfVNL5AfJ7fSqxTlOGaHUQhr+1NDOdBk # +lbP4PQK5hRtZHi7mP2Uw3Mh8y/CLiDXgazT8QfU4b3ZXUtuMZQpi+ZBpGWUwFjl # 5S4pkKa3YWT62SBsGFFguqaBDwklU/G/O+mrBw5qBzliGcnWhX8T2Y15z2LF7OF7 # ucxnEweawXjtxojIsG4yeccLWYONxu71LHx7jstkifGxxLjnU15fVdJ9GSlZA076 # XepFcxyEftfO4tQ6dwIDAQABo4IBizCCAYcwDgYDVR0PAQH/BAQDAgeAMAwGA1Ud # EwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwIAYDVR0gBBkwFzAIBgZn # gQwBBAIwCwYJYIZIAYb9bAcBMB8GA1UdIwQYMBaAFLoW2W1NhS9zKXaaL3WMaiCP # nshvMB0GA1UdDgQWBBRiit7QYfyPMRTtlwvNPSqUFN9SnDBaBgNVHR8EUzBRME+g # TaBLhklodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRS # U0E0MDk2U0hBMjU2VGltZVN0YW1waW5nQ0EuY3JsMIGQBggrBgEFBQcBAQSBgzCB # gDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFgGCCsGAQUF # BzAChkxodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVk # RzRSU0E0MDk2U0hBMjU2VGltZVN0YW1waW5nQ0EuY3J0MA0GCSqGSIb3DQEBCwUA # A4ICAQBVqioa80bzeFc3MPx140/WhSPx/PmVOZsl5vdyipjDd9Rk/BX7NsJJUSx4 # iGNVCUY5APxp1MqbKfujP8DJAJsTHbCYidx48s18hc1Tna9i4mFmoxQqRYdKmEIr # UPwbtZ4IMAn65C3XCYl5+QnmiM59G7hqopvBU2AJ6KO4ndetHxy47JhB8PYOgPvk # /9+dEKfrALpfSo8aOlK06r8JSRU1NlmaD1TSsht/fl4JrXZUinRtytIFZyt26/+Y # siaVOBmIRBTlClmia+ciPkQh0j8cwJvtfEiy2JIMkU88ZpSvXQJT657inuTTH4YB # ZJwAwuladHUNPeF5iL8cAZfJGSOA1zZaX5YWsWMMxkZAO85dNdRZPkOaGK7DycvD # +5sTX2q1x+DzBcNZ3ydiK95ByVO5/zQQZ/YmMph7/lxClIGUgp2sCovGSxVK05iQ # RWAzgOAj3vgDpPZFR+XOuANCR+hBNnF3rf2i6Jd0Ti7aHh2MWsgemtXC8MYiqE+b # vdgcmlHEL5r2X6cnl7qWLoVXwGDneFZ/au/ClZpLEQLIgpzJGgV8unG1TnqZbPTo # ntRamMifv427GFxD9dAq6OJi7ngE273R+1sKqHB+8JeEeOMIA11HLGOoJTiXAdI/ # Otrl5fbmm9x+LMz/F0xNAKLY1gEOuIvu5uByVYksJxlh9ncBjDCCBtEwggS5oAMC # AQICEALJyJtCgrJIcqJKOHHEJNIwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMC # VVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBU # cnVzdGVkIEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMTAe # Fw0yMjAzMjUwMDAwMDBaFw0yMzA5MDUyMzU5NTlaMFYxCzAJBgNVBAYTAkNaMQ8w # DQYDVQQHEwZQcmFndWUxGjAYBgNVBAoTEUdyZXlDb3JiZWwgcy5yLm8uMRowGAYD # VQQDExFHcmV5Q29yYmVsIHMuci5vLjCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCC # AYoCggGBAMTq3axTav3sMdYp3VziEZs81RtGGJOZcbPcR1+ikq165raa9xv+ZQA2 # mnWa5Wi9zVOAPyi1aS1RgWbKadHBgLKcG5nSVEACOcsK3QuQb334MsVqLoMebzdy # QOyqyVHpcOfvxkHfggK31A+y4csddAxl3wFBDnfXMX3B0THlB1x0HaFQmx33ewZT # mNa2ZoVQouxToXxXHOHV4lnFo3NTWoaKSfq0uMgNTGcUfTDka0y1juzWeJLYzEhz # yYTOlyRhRcVuq6VpAFFo2fORabtGQpv65MbIjopy73kcO6FDwCnh5M3TJSnPUUkX # /0iWNpjJqz1kyUIshhda6T7NUlyfzmD47+m9ilWM3+A+7zfi2odltoKSQVw8Prcs # nCc4AuG3tEIYqx3fig5Xo/oFEdplstTU05rYdciiBrUqzLUcqWiQ5RtY5TEkQfMw # Y3M46AlHSFtuZwbwvt9KjsbrpkynqEbKxJ4ekuv6RPt5z5rIgN5eelLEnSOHbtTI # HYqdHfXEMQIDAQABo4ICBjCCAgIwHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsI # iGX0TkIwHQYDVR0OBBYEFEzQTewm/4jkPEqAo2B+zylIxUyvMA4GA1UdDwEB/wQE # AwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1o # dHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2ln # bmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQu # ZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2 # U0hBMzg0MjAyMUNBMS5jcmwwPgYDVR0gBDcwNTAzBgZngQwBBAEwKTAnBggrBgEF # BQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGUBggrBgEFBQcBAQSB # hzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsG # AQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVz # dGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAMBgNVHRMB # Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCilggOMD65uoBk0VSHoyArVAPIB382 # oLCagin4YYLi+DYNH0dvvlIlpIsUefE7T43gVK2TkSunGfkEFLWP8IDfYp2D5iD8 # xZfl5AIOAxAExsVXNW8XCEtUIfo3itn0XxtllDxznjtMgyXoI+SrQMR+MFx0e5In # v+v31yqkasCrynfBNM9G8OAYk0XOKgBgI9mhqZ1FOl82KUsxkGmOW9D2F2em5wpi # Co+UDnUArIx/YuihkcVvUvMYJqZRKkMFdD75gpmP9W72Jf3jWMdLcV5AW6DX3UGP # jen1SH5GuFAPCODAMAttJXK7TOInAbK9WY6uiVI7BZ+MaE+l3cX0fSSQK5sxoDUM # zFoCXXq8uqBRv44m5VbdE1hzt9f96zxbUnluEkOjJ8jVc5xv8yCgxDiOR54z76Vg # HrbhJVckkunNKdlR6upMo6bT5l/qMDQWPPIAC6tfrB8R+g417XckSdmhKhMrkiTz # hFvUbFbaD/jH+3xen0ZhpN64mIv5C7mIj17XSZXI4kfvaYcCC72g2ou68PwO5ZHb # liI75pbBncck3/FNHpLwjpCidET9pWSm+Y/G0jwg068ELN4W0tboplDm1G94ACJz # Mr4rTC7bOJXoUHKgiHQl4478SyaMAaeJbfCHfdTV8lUthpGubPu2UmxiVXI0AoOG # Bl1/1lAJOruSnDGCBdMwggXPAgEBMH0waTELMAkGA1UEBhMCVVMxFzAVBgNVBAoT # DkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0IENv # ZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMQIQAsnIm0KCskhyoko4 # ccQk0jANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAA # MBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgor # BgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCDUzk/X5dULSTUZk6PgIxlzwXvLTTmn # Kj/fzcilhUocxDANBgkqhkiG9w0BAQEFAASCAYB11+OzeF7V+ek0Af3bHnM1gT99 # KYAtKURRZFolysu+Dss6lVXXWJfenibxlMFXUM83N4Dtdp6c7axI5jDN/wOehL1Z # /JlYhXj5bVMo3BNAJF5Jvlwnyf1diYJZgWgxKBJ7cq+Mg3KAG36HHqXhSi+lu9SF # OUJt8PwE1//xsGSqz3WyHDdZj7+2DTlH+/4vWhcmBt9f4EQrtT223mXeBjSghyPn # 25bIK03gArWZAgf9GwGN7KtcGhM2J38bkJXEiF4dqaHFpuBebj4/OCQspq3K/GWv # UX2vzrbsQ8uGF0A5Dw7kkqHSn+dIT/3QXpKtLEQprFI5Pmy3eq+4U1UM9sDmNTzA # MBRyFOOn5qtQi5p+m/OIaLWe2aWqYLCYgXqhJ6ksBrh6ZZvYUOPw8zttyckuAuKs # kWArAf4gBAC2hTEbgkgrNoWDb3fzaXfJ+wn4DFLK6Zdaq8hYudGpulAWwEKUhJEl # bK8BOpov7ifo9PMzOxU+SbCKY+iUAZIc5f8D2W6hggMgMIIDHAYJKoZIhvcNAQkG # MYIDDTCCAwkCAQEwdzBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQs # IEluYy4xOzA5BgNVBAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNBNDA5NiBTSEEy # NTYgVGltZVN0YW1waW5nIENBAhAMTWlyS5T6PCpKPSkHgD1aMA0GCWCGSAFlAwQC # AQUAoGkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN # MjMwNzMxMTUwMTMwWjAvBgkqhkiG9w0BCQQxIgQgTEP8lfR0FMQIza1jP7sjp9WB # 8o2TCSpw3pQpXtROGRgwDQYJKoZIhvcNAQEBBQAEggIAbD65EmLoXD+Tb53jiAOu # PSMq6tqyzO/tvzZuOEfCMKGbIL0iqtSG/N5kYk2DzB4xD6Zb7ZQFO6CuZVe+IoIr # cOd+/qSFFO7lsgU1ObCBOY672O21c2vJQDic1AUbScs4eXoPVnwXDkbh8dstlIo7 # ScBB0IxAWgZ23Qj1PwkzuBnyZsv5Pg1P0fX1hmKpHyz4ATeoa5pW40puMoJO1uH0 # aKkt3JYhNd9BxhicvTirQipZQVEP4FYxvsERNXvg9MMxKdxtUTUBbxayBxDd358i # tVHSeDTx1R8wDj+vYcdhrkW5ZyxagasUndbAyc905sDMR+kIBjaHgO8PiWEnB3uZ # iaNtoMDjDh25j9elraTYAfC9pjWZMtGT2A0ilUyNSEZHtbZe0PRrHmu84TID44Vr # Fx7ZcpdYdyBCukdQ6Ze+dJqtCH03Mj8Xy2J4vyH9Qy8cM2PKMr9pqXiwkDf2GeHX # 3jDKij4C/GhXueZOUrh4g/pl7BvG0nIksVzhWtQU0drMekcc85dK9oX3ET0zLAHl # t1U2/pWs/SqyPpXcEW7Nmj9cta0G39vwz76+9Drw/XD+/lbed2Xsy0i4IT/Fw0RM # TvcNl8nZgRJp5E7b27anXiwLh8J5dRT3FriedW90OFJ3qEqJgkszlymVI8e5QoBt # YhWTxEIErWZ2oRcB5W/0e+o= # SIG # End signature block |