Microsoft.PowerApps.AuthModule.psm1
|
$local:ErrorActionPreference = "Stop" Add-Type -Path (Join-Path (Split-Path $script:MyInvocation.MyCommand.Path) "Microsoft.Identity.Client.dll") function Get-JwtTokenClaims { [CmdletBinding()] param ( [Parameter(Mandatory=$true)] [string]$JwtToken ) $tokenSplit = $JwtToken.Split(".") $claimsSegment = $tokenSplit[1].Replace(" ", "+").Replace("-", "+").Replace('_', '/'); $mod = $claimsSegment.Length % 4 if ($mod -gt 0) { $paddingCount = 4 - $mod; for ($i = 0; $i -lt $paddingCount; $i++) { $claimsSegment += "=" } } $decodedClaimsSegment = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($claimsSegment)) return ConvertFrom-Json $decodedClaimsSegment } function Get-DefaultAudienceForEndPoint { [CmdletBinding()] Param( [string] $Endpoint ) $audienceMapping = @{ "prod" = "https://service.powerapps.com/"; "preview" = "https://service.powerapps.com/"; "tip1"= "https://service.powerapps.com/"; "tip2"= "https://service.powerapps.com/"; "usgov"= "https://gov.service.powerapps.us/"; "usgovhigh"= "https://high.service.powerapps.us/"; "dod" = "https://service.apps.appsplatform.us/"; "china" = "https://service.powerapps.cn/"; } if ($null -ne $audienceMapping[$Endpoint]) { return $audienceMapping[$Endpoint]; } Write-Verbose "Unknown endpoint $Endpoint. Using https://service.powerapps.com/ as a default"; return "https://service.powerapps.com/"; } function RemoveHttpHttps { param ( [string] $inputString ) foreach($removalTarget in @('http://','https://')) { if($inputString.StartsWith($removalTarget)) { $inputString = $inputString.Remove(0, $removalTarget.Length) } } return $inputString } function Await-Task { param ( [Parameter(ValueFromPipeline=$true, Mandatory=$true)] $task ) process { while (-not $task.AsyncWaitHandle.WaitOne(200)) { } $task.GetAwaiter().GetResult() } } function Add-PowerAppsAccount { <# .SYNOPSIS Add PowerApps account. .DESCRIPTION The Add-PowerAppsAccount cmdlet logins the user or application account and save login information to cache. Use 'Get-Help Add-PowerAppsAccount -Detailed' for descriptions of the parameters and example usages. .PARAMETER Audience The service audience which is used for login. .PARAMETER Endpoint The serivce endpoint which to call. The value can be "prod", "preview", "tip1", "tip2", "usgov", "dod", "usgovhigh", or "china". Can't be used if providing endpoint overrides .PARAMETER Username The user name used for login. .PARAMETER Password The password for the user. .PARAMETER TenantID The tenant Id of the user or application. .PARAMETER CertificateThumbprint The certificate thumbprint of the application. .PARAMETER ClientSecret The client secret of the application. .PARAMETER ApplicationId The application Id. .PARAMETER AudienceOverride Must be provided if giving endpoint overrides; this audience will be used for all subsequent auth calls, ignoring normally derived audiences .PARAMETER AuthBaseUriOverride Must be provided if giving endpoint overrides .PARAMETER FlowEndpointOverride Must be provided if giving endpoint overrides .PARAMETER PowerAppsEndpointOverride Must be provided if giving endpoint overrides .PARAMETER BapEndpointOverride Must be provided if giving endpoint overrides .PARAMETER GraphEndpointOverride Must be provided if giving endpoint overrides .PARAMETER CdsOneEndpointOverride Can be provided if giving endpoint overrides .PARAMETER PvaEndpointOverride Can be provided if giving endpoint overrides .EXAMPLE Add-PowerAppsAccount Login to "prod" endpoint. .EXAMPLE Add-PowerAppsAccount -Endpoint "prod" -Username "username@test.onmicrosoft.com" -Password "password" Login to "prod" for user "username@test.onmicrosoft.com" by using password "password" .EXAMPLE Add-PowerAppsAccount ` -Endpoint "tip1" ` -TenantID 1a1fbe33-1ff4-45b2-90e8-4628a5112345 ` -ClientSecret ABCDE]NO_8:YDLp0J4o-:?=K9cmipuF@ ` -ApplicationId abcdebd6-e62c-4f68-ab74-b046579473ad Login to "tip1" for application abcdebd6-e62c-4f68-ab74-b046579473ad in tenant 1a1fbe33-1ff4-45b2-90e8-4628a5112345 by using client secret. .EXAMPLE Add-PowerAppsAccount ` -Endpoint "tip1" ` -TenantID 1a1fbe33-1ff4-45b2-90e8-4628a5112345 ` -CertificateThumbprint 12345137C1B2D4FED804DB353D9A8A18465C8027 ` -ApplicationId 08627eb8-8eba-4a9a-8c49-548266012345 Login to "tip1" for application 08627eb8-8eba-4a9a-8c49-548266012345 in tenant 1a1fbe33-1ff4-45b2-90e8-4628a5112345 by using certificate. .EXAMPLE Add-PowerAppsAccount ` -AudienceOverride: "https://service.powerapps.com/" ` -AuthBaseUriOverride: "https://login.microsoftonline.com" ` -BapEndpointOverride: "api.bap.microsoft.com" ` -CdsOneEndpointOverride: "api.cds.microsoft.com" ` -FlowEndpointOverride: "api.flow.microsoft.com" ` -GraphEndpointOverride: "graph.windows.net" ` -PowerAppsEndpointOverride: "api.powerapps.com" ` -PvaEndpointOverride: "powerva.microsoft.com" Login to an environment with the provided endpoints (examples above are for 'PROD') .EXAMPLE $Inputs | Add-PowerAppsAccount Login to an environment with the endpionts stored in a PS Custom Object variable; where its content is defined as: $Inputs = [pscustomobject]@{ ` "AudienceOverride" = "https://service.powerapps.com/"; ` "AuthBaseUriOverride" = "https://login.microsoftonline.com"; ` "BapEndpointOverride" = "api.bap.microsoft.com"; ` "CdsOneEndpointOverride" = "api.cds.microsoft.com"; ` "FlowEndpointOverride" = "api.flow.microsoft.com"; ` "GraphEndpointOverride" = "graph.windows.net"; ` "PowerAppsEndpointOverride" = "api.powerapps.com"; ` "PvaEndpointOverride" = "powerva.microsoft.com" } .EXAMPLE Get-Content -Raw ".\OverrideEndpoints.json" | ConvertFrom-Json | Add-PowerAppsAccount Login to an environment with the endpoints stored in 'OverrideEndpoints.json'; where its content is of the form: { "AudienceOverride": "https://service.powerapps.com/", "AuthBaseUriOverride": "https://login.microsoftonline.com", "BapEndpointOverride": "api.bap.microsoft.com", "CdsOneEndpointOverride": "api.cds.microsoft.com", "FlowEndpointOverride": "api.flow.microsoft.com", "GraphEndpointOverride": "graph.windows.net", "PowerAppsEndpointOverride": "api.powerapps.com", "PvaEndpointOverride": "powerva.microsoft.com" } #> [CmdletBinding()] param ( [Parameter(Mandatory = $false, ParameterSetName="DerivedEndpoints")] [string] $Audience = "https://service.powerapps.com/", [Parameter(Mandatory = $false, ParameterSetName="DerivedEndpoints")] [ValidateSet("prod","preview","tip1", "tip2", "usgov", "usgovhigh", "dod", "china")] [string]$Endpoint = "prod", [string]$Username = $null, [SecureString]$Password = $null, [string]$TenantID = $null, [string]$CertificateThumbprint = $null, [string]$ClientSecret = $null, [string]$ApplicationId = "1950a258-227b-4e31-a9cf-717495945fc2", [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $AudienceOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $AuthBaseUriOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $FlowEndpointOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $PowerAppsEndpointOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $BapEndpointOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $GraphEndpointOverride, [Parameter(Mandatory = $false,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $CdsOneEndpointOverride = "unsupported", [Parameter(Mandatory = $false,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $PvaEndpointOverride = "unsupported" ) if ($Audience -eq "https://service.powerapps.com/" -and -not $PSBoundParameters.ContainsKey('AudienceOverride')) { # It's the default audience - we should remap based on endpoint as needed $Audience = Get-DefaultAudienceForEndPoint($Endpoint) $PSBoundParameters['Audience'] = $Audience } $global:currentSession = $null Add-PowerAppsAccountInternal @PSBoundParameters } function Add-PowerAppsAccountInternal { param ( [Parameter(Mandatory = $false, ParameterSetName="DerivedEndpoints")] [string] $Audience = "https://service.powerapps.com/", [Parameter(Mandatory = $false, ParameterSetName="DerivedEndpoints")] [ValidateSet("prod","preview","tip1", "tip2", "usgov", "usgovhigh", "dod", "china")] [string]$Endpoint = "prod", [string]$Username = $null, [SecureString]$Password = $null, [string]$TenantID = $null, [string]$CertificateThumbprint = $null, [string]$ClientSecret = $null, [string]$ApplicationId = "1950a258-227b-4e31-a9cf-717495945fc2", [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $AudienceOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $AuthBaseUriOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $FlowEndpointOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $PowerAppsEndpointOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $BapEndpointOverride, [Parameter(Mandatory = $true,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $GraphEndpointOverride, [Parameter(Mandatory = $false,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $CdsOneEndpointOverride = "unsupported", [Parameter(Mandatory = $false,ParameterSetName="ProvidedEndpoints", ValueFromPipelineByPropertyName)] [string] $PvaEndpointOverride = "unsupported" ) $InputEndpoint = $Endpoint #Enforce format requirements for endpoint overrides and force their usage if ($PSBoundParameters.ContainsKey('AudienceOverride') -and $PSBoundParameters.ContainsKey('AuthBaseUriOverride') -and $PSBoundParameters.ContainsKey('FlowEndpointOverride') -and $PSBoundParameters.ContainsKey('PowerAppsEndpointOverride') -and $PSBoundParameters.ContainsKey('BapEndpointOverride') -and $PSBoundParameters.ContainsKey('GraphEndpointOverride')) { $InputEndpoint = 'override' Write-Verbose "Overrides were passed and will be used in place of any derived audiences or endpoints; run this command again to change configured overrides" #Ensure exactly 1 trailing '/' $AudienceOverride = $AudienceOverride.TrimEnd('/') + '/'; $Audience = $AudienceOverride #Ensure no trailing '/' $AuthBaseUriOverride = $AuthBaseUriOverride.TrimEnd('/'); #Ensure no leading 'http://' or 'https://' and no trailing '/' $FlowEndpointOverride = RemoveHttpHttps $FlowEndpointOverride.TrimEnd('/') $PowerAppsEndpointOverride = RemoveHttpHttps $PowerAppsEndpointOverride.TrimEnd('/') $BapEndpointOverride = RemoveHttpHttps $BapEndpointOverride.TrimEnd('/') $GraphEndpointOverride = RemoveHttpHttps $GraphEndpointOverride.TrimEnd('/') $CdsOneEndpointOverride = RemoveHttpHttps $CdsOneEndpointOverride.TrimEnd('/') $PvaEndpointOverride = RemoveHttpHttps $PvaEndpointOverride.TrimEnd('/') } elseif ($global:currentSession.audienceOverride -ne $null -and $global:currentSession.audienceOverride -ne '') { Write-Debug "Provided Audience '$Audience' is being replaced with previously provided override value '$($global:currentSession.audienceOverride)'" $Audience = $global:currentSession.audienceOverride } [string[]]$scopes = "$Audience/.default" if ([string]::IsNullOrWhiteSpace($ApplicationId)) { $ApplicationId = "1950a258-227b-4e31-a9cf-717495945fc2" } Write-Debug "Using appId, $ApplicationId" [Microsoft.Identity.Client.IClientApplicationBase]$clientBase = $null [Microsoft.Identity.Client.AuthenticationResult]$authResult = $null if ($global:currentSession.loggedIn -eq $true -and $global:currentSession.recursed -ne $true) { Write-Debug "Already logged in, checking for token for resource $Audience" $authResult = $null if ($global:currentSession.resourceTokens[$Audience] -ne $null) { if ($global:currentSession.resourceTokens[$Audience].accessToken -ne $null -and ` $global:currentSession.resourceTokens[$Audience].expiresOn -ne $null -and ` $global:currentSession.resourceTokens[$Audience].expiresOn -gt (Get-Date)) { Write-Debug "Token found and value, returning for audience $Audience" return } else { # Already logged in with an account, silently asking for a token from MSAL which should refresh try { Write-Debug "Already logged in, silently requesting token from MSAL" $authResult = $global:currentSession.msalClientApp.AcquireTokenSilent($scopes, $global:currentSession.msalAccount).ExecuteAsync() | Await-Task } catch [Microsoft.Identity.Client.MsalUiRequiredException] { Write-Debug ('{0}: {1}' -f $_.Exception.GetType().Name, $_.Exception.Message) } } } if ($authResult -eq $null) { Write-Debug "No token found, reseting audience and recursing: $Audience" # Reset the current audience values and call Add-PowerAppsAccount again $global:currentSession.resourceTokens[$Audience] = $null $global:currentSession.recursed = $true $PSBoundParameters['Audience'] = $Audience # the override endpoint is set automatically when required params are passed if ($global:currentSession.endpoint -ne 'override') { $PSBoundParameters['Endpoint'] = $global:currentSession.endpoint } $PSBoundParameters['Username'] = $global:currentSession.username $PSBoundParameters['Password'] = $global:currentSession.password $PSBoundParameters['TenantID'] = $global:currentSession.InitialTenantId $PSBoundParameters['CertificateThumbprint'] = $global:currentSession.certificateThumbprint $PSBoundParameters['ClientSecret'] = $global:currentSession.clientSecret $PSBoundParameters['ApplicationId'] = $global:currentSession.applicationId Add-PowerAppsAccountInternal @PSBoundParameters $global:currentSession.recursed = $false # Afer recursing we can early return return } } else { [string] $jwtTokenForClaims = $null if ($InputEndpoint -ne "override") { [Microsoft.Identity.Client.AzureCloudInstance] $authBaseUri = switch ($InputEndpoint) { "usgov" { [Microsoft.Identity.Client.AzureCloudInstance]::AzurePublic } "usgovhigh" { [Microsoft.Identity.Client.AzureCloudInstance]::AzureUsGovernment } "dod" { [Microsoft.Identity.Client.AzureCloudInstance]::AzureUsGovernment } "china" { [Microsoft.Identity.Client.AzureCloudInstance]::AzureChina } default { [Microsoft.Identity.Client.AzureCloudInstance]::AzurePublic } }; } else { [string] $authBaseUri = $AuthBaseUriOverride } if ($Username -ne $null -and $Password -ne $null) { $authUriWithAudience = $AuthBaseUriOverride + "/organizations/" [Microsoft.Identity.Client.AadAuthorityAudience] $aadAuthAudience = [Microsoft.Identity.Client.AadAuthorityAudience]::AzureAdMultipleOrgs } else { $authUriWithAudience = $AuthBaseUriOverride + "/common/" [Microsoft.Identity.Client.AadAuthorityAudience] $aadAuthAudience = [Microsoft.Identity.Client.AadAuthorityAudience]::AzureAdAndPersonalMicrosoftAccount } Write-Debug "Using $Audience : $ApplicationId : $aadAuthAudience : $authUriWithAudience" if (![string]::IsNullOrWhiteSpace($TenantID) -and ` (![string]::IsNullOrWhiteSpace($ClientSecret) -or ![string]::IsNullOrWhiteSpace($CertificateThumbprint))) { $options = New-Object -TypeName Microsoft.Identity.Client.ConfidentialClientApplicationOptions $options.ClientId = $ApplicationId $options.TenantId = $TenantID [Microsoft.Identity.Client.IConfidentialClientApplication ]$ConfidentialClientApplication = $null if (![string]::IsNullOrWhiteSpace($CertificateThumbprint)) { Write-Debug "Using certificate for token acquisition" $clientCertificate = Get-Item -Path Cert:\CurrentUser\My\$CertificateThumbprint $ConfidentialClientApplication = [Microsoft.Identity.Client.ConfidentialClientApplicationBuilder]::Create($ApplicationId).WithCertificate($clientCertificate).WithAuthority($authBaseUri, $TenantID, $true).Build() } else { Write-Debug "Using clientSecret for token acquisition" $ConfidentialClientApplication = [Microsoft.Identity.Client.ConfidentialClientApplicationBuilder]::Create($ApplicationId).WithClientSecret($ClientSecret).WithAuthority($authBaseUri, $TenantID, $true).Build() } $authResult = $ConfidentialClientApplication.AcquireTokenForClient($scopes).ExecuteAsync() | Await-Task $clientBase = $ConfidentialClientApplication } else { if ($InputEndpoint -eq "override") { $PublicClientApplication = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::Create($ApplicationId).WithAuthority($authUriWithAudience, $true).WithDefaultRedirectUri().Build() } else { $PublicClientApplication = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::Create($ApplicationId).WithAuthority($authBaseUri, $aadAuthAudience, $true).WithDefaultRedirectUri().Build() } if ($Username -ne $null -and $Password -ne $null) { Write-Debug "Using username, password" $authResult = $PublicClientApplication.AcquireTokenByUsernamePassword($scopes, $UserName, $Password).ExecuteAsync() | Await-Task } else { Write-Debug "Using interactive login" $authResult = $PublicClientApplication.AcquireTokenInteractive($scopes).ExecuteAsync() | Await-Task } $clientBase = $PublicClientApplication } } if ($authResult -ne $null) { if (![string]::IsNullOrWhiteSpace($authResult.IdToken)) { $jwtTokenForClaims = $authResult.IdToken } else { $jwtTokenForClaims = $authResult.AccessToken } $claims = Get-JwtTokenClaims -JwtToken $jwtTokenForClaims if ($global:currentSession.loggedIn -eq $true) { Write-Debug "Adding new audience '$Audience' to resourceToken map. Expires $($authResult.ExpiresOn)" # addition of a new token for a new audience $global:currentSession.resourceTokens[$Audience] = @{ accessToken = $authResult.AccessToken; expiresOn = $authResult.ExpiresOn; }; if ($AudienceOverride -ne $null -and $AudienceOverride -ne '') { Write-Debug "A new audience override '$AudienceOverride' was provided and is in use, instead of the previous audience override '$($global:currentSession.audienceOverride)', for all token aquisitions" $global:currentSession.audienceOverride = $AudienceOverride } } else { Write-Debug "Adding first audience '$Audience' to resourceToken map. Expires $($authResult.ExpiresOn)" $global:currentSession = @{ audienceOverride = $AudienceOverride; loggedIn = $true; recursed = $false; endpoint = $InputEndpoint; msalClientApp = $clientBase; msalAccount = $authResult.Account; upn = $claims.upn; InitialTenantId = $TenantID; tenantId = $claims.tid; userId = $claims.oid; applicationId = $ApplicationId; username = $Username; password = $Password; certificateThumbprint = $CertificateThumbprint; clientSecret = $ClientSecret; resourceTokens = @{ $Audience = @{ accessToken = $authResult.AccessToken; expiresOn = $authResult.ExpiresOn; } }; selectedEnvironment = "~default"; flowEndpoint = switch ($InputEndpoint) { "override" { $FlowEndpointOverride } "prod" { "api.flow.microsoft.com" } "usgov" { "gov.api.flow.microsoft.us" } "usgovhigh" { "high.api.flow.microsoft.us" } "dod" { "api.flow.appsplatform.us" } "china" { "api.powerautomate.cn" } "preview" { "preview.api.flow.microsoft.com" } "tip1" { "tip1.api.flow.microsoft.com"} "tip2" { "tip2.api.flow.microsoft.com" } default { throw "Unsupported endpoint '$InputEndpoint'"} }; powerAppsEndpoint = switch ($InputEndpoint) { "override" { $PowerAppsEndpointOverride } "prod" { "api.powerapps.com" } "usgov" { "gov.api.powerapps.us" } "usgovhigh" { "high.api.powerapps.us" } "dod" { "api.apps.appsplatform.us" } "china" { "api.powerapps.cn" } "preview" { "preview.api.powerapps.com" } "tip1" { "tip1.api.powerapps.com"} "tip2" { "tip2.api.powerapps.com" } default { throw "Unsupported endpoint '$InputEndpoint'"} }; bapEndpoint = switch ($InputEndpoint) { "override" { $BapEndpointOverride } "prod" { "api.bap.microsoft.com" } "usgov" { "gov.api.bap.microsoft.us" } "usgovhigh" { "high.api.bap.microsoft.us" } "dod" { "api.bap.appsplatform.us" } "china" { "api.bap.partner.microsoftonline.cn" } "preview" { "preview.api.bap.microsoft.com" } "tip1" { "tip1.api.bap.microsoft.com"} "tip2" { "tip2.api.bap.microsoft.com" } default { throw "Unsupported endpoint '$InputEndpoint'"} }; graphEndpoint = switch ($InputEndpoint) { "override" { $GraphEndpointOverride } "prod" { "graph.windows.net" } "usgov" { "graph.windows.net" } "usgovhigh" { "graph.windows.net" } "dod" { "graph.windows.net" } "china" { "graph.windows.net" } "preview" { "graph.windows.net" } "tip1" { "graph.windows.net"} "tip2" { "graph.windows.net" } default { throw "Unsupported endpoint '$InputEndpoint'"} }; cdsOneEndpoint = switch ($InputEndpoint) { "override" { $CdsOneEndpointOverride } "prod" { "api.cds.microsoft.com" } "usgov" { "gov.api.cds.microsoft.us" } "usgovhigh" { "high.api.cds.microsoft.us" } "dod" { "dod.gov.api.cds.microsoft.us" } "china" { "unsupported" } "preview" { "preview.api.cds.microsoft.com" } "tip1" { "tip1.api.cds.microsoft.com"} "tip2" { "tip2.api.cds.microsoft.com" } default { throw "Unsupported endpoint '$InputEndpoint'"} }; pvaEndpoint = switch ($InputEndpoint) { "override" { $PvaEndpointOverride } "prod" { "powerva.microsoft.com" } "usgov" { "gcc.api.powerva.microsoft.us" } "usgovhigh" { "high.api.powerva.microsoft.us" } "dod" { "powerva.api.appsplatform.us" } "china" { "unsupported" } "preview" { "bots.sdf.customercareintelligence.net" } "tip1" { "bots.ppe.customercareintelligence.net"} "tip2" { "bots.int.customercareintelligence.net"} default { throw "Unsupported endpoint '$InputEndpoint'"} }; }; } } } function Test-PowerAppsAccount { <# .SYNOPSIS Test PowerApps account. .DESCRIPTION The Test-PowerAppsAccount cmdlet checks cache and calls Add-PowerAppsAccount if user account is not in cache. Use Get-Help Test-PowerAppsAccount -Examples for more detail. .EXAMPLE Test-PowerAppsAccount Check if user account is cached. #> [CmdletBinding()] param ( ) if (-not $global:currentSession -or $global:currentSession.loggedIn -ne $true) { Add-PowerAppsAccountInternal } } function Remove-PowerAppsAccount { <# .SYNOPSIS Remove PowerApps account. .DESCRIPTION The Remove-PowerAppsAccount cmdlet removes the user or application login information from cache. Use Get-Help Remove-PowerAppsAccount -Examples for more detail. .EXAMPLE Remove-PowerAppsAccount Removes the login information from cache. #> [CmdletBinding()] param ( ) if ($global:currentSession -ne $null -and $global:currentSession.upn -ne $null) { Write-Verbose "Logging out $($global:currentSession.upn)" } else { Write-Verbose "No user logged in" } $global:currentSession = @{ loggedIn = $false; }; } function Get-JwtToken { <# .SYNOPSIS Get user login token. .DESCRIPTION The Get-JwtToken cmdlet get the user or application login information from cache. It will call Add-PowerAppsAccount if login token expired. Use Get-Help Get-JwtToken -Examples for more detail. .EXAMPLE Get-JwtToken "https://service.powerapps.com/" Get login token for PowerApps "prod". #> [CmdletBinding()] param ( [Parameter(Mandatory=$true)] [string] $Audience ) if ($global:currentSession -eq $null) { $global:currentSession = @{ loggedIn = $false; }; } elseif($global:currentSession.audienceOverride -ne $null -and $global:currentSession.audienceOverride -ne '') { Write-Verbose "The provided audience '$Audience' will be ignored in place of the AudienceOverride '$($global:currentSession.audienceOverride)' provided in the most recent call to Add-PowerAppsAccount" $Audience = $global:currentSession.audienceOverride } Add-PowerAppsAccountInternal -Audience $Audience return $global:currentSession.resourceTokens[$Audience].accessToken; } function Invoke-OAuthDialog { [CmdletBinding()] param ( [Parameter(Mandatory=$true)] [string] $ConsentLinkUri ) Add-Type -AssemblyName System.Windows.Forms $form = New-Object -TypeName System.Windows.Forms.Form -Property @{ Width=440; Height=640 } $web = New-Object -TypeName System.Windows.Forms.WebBrowser -Property @{ Width=420; Height=600; Url=$ConsentLinkUri } $DocComp = { $Global:uri = $web.Url.AbsoluteUri if ($Global:uri -match "error=[^&]*|code=[^&]*") { $form.Close() } } $web.ScriptErrorsSuppressed = $true $web.Add_DocumentCompleted($DocComp) $form.Controls.Add($web) $form.Add_Shown({$form.Activate()}) $form.ShowDialog() | Out-Null $queryOutput = [System.Web.HttpUtility]::ParseQueryString($web.Url.Query) $output = @{} foreach($key in $queryOutput.Keys) { $output["$key"] = $queryOutput[$key] } return $output } function Get-TenantDetailsFromGraph { <# .SYNOPSIS Get my organization tenant details from graph. .DESCRIPTION The Get-TenantDetailsFromGraph function calls graph and gets my organization tenant details. Use Get-Help Get-TenantDetailsFromGraph -Examples for more detail. .PARAMETER GraphApiVersion Graph version to call. The default version is "1.6". .EXAMPLE Get-TenantDetailsFromGraph Get my organization tenant details from graph by calling graph service in version 1.6. #> param ( [string]$GraphApiVersion = "1.6" ) process { $TenantIdentifier = "myorganization" $route = "https://{graphEndpoint}/{tenantIdentifier}/tenantDetails`?api-version={graphApiVersion}" ` | ReplaceMacro -Macro "{tenantIdentifier}" -Value $TenantIdentifier ` | ReplaceMacro -Macro "{graphApiVersion}" -Value $GraphApiVersion; $graphResponse = InvokeApi -Method GET -Route $route if ($graphResponse.value -ne $null) { CreateTenantObject -TenantObj $graphResponse.value } else { return $graphResponse } } } #Returns users or groups from Graph #wrapper on top of https://msdn.microsoft.com/en-us/library/azure/ad/graph/api/users-operations & https://msdn.microsoft.com/en-us/library/azure/ad/graph/api/groups-operations function Get-UsersOrGroupsFromGraph( ) { <# .SYNOPSIS Returns users or groups from Graph. .DESCRIPTION The Get-UsersOrGroupsFromGraph function calls graph and gets users or groups from Graph. Use Get-Help Get-UsersOrGroupsFromGraph -Examples for more detail. .PARAMETER ObjectId User objec Id. .PARAMETER SearchString Search string. .PARAMETER GraphApiVersion Graph version to call. The default version is "1.6". .EXAMPLE Get-UsersOrGroupsFromGraph -ObjectId "12345ba9-805f-43f8-98f7-34fa34aa51a7" Get user with user object Id "12345ba9-805f-43f8-98f7-34fa34aa51a7" from graph by calling graph service in version 1.6. .EXAMPLE Get-UsersOrGroupsFromGraph -SearchString "gfd" Get users who's UserPrincipalName starting with "gfd" from graph by calling graph service in version 1.6. #> [CmdletBinding(DefaultParameterSetName="Id")] param ( [Parameter(Mandatory = $true, ParameterSetName = "Id")] [string]$ObjectId, [Parameter(Mandatory = $true, ParameterSetName = "Search")] [string]$SearchString, [Parameter(Mandatory = $false, ParameterSetName = "Search")] [Parameter(Mandatory = $false, ParameterSetName = "Id")] [string]$GraphApiVersion = "1.6" ) Process { if (-not [string]::IsNullOrWhiteSpace($ObjectId)) { $userGraphUri = "https://graph.windows.net/myorganization/users/{userId}`?&api-version={graphApiVersion}" ` | ReplaceMacro -Macro "{userId}" -Value $ObjectId ` | ReplaceMacro -Macro "{graphApiVersion}" -Value $GraphApiVersion; $userGraphResponse = InvokeApi -Route $userGraphUri -Method GET If($userGraphResponse.StatusCode -eq $null) { CreateUserObject -UserObj $userGraphResponse } $groupsGraphUri = "https://graph.windows.net/myorganization/groups/{groupId}`?api-version={graphApiVersion}" ` | ReplaceMacro -Macro "{groupId}" -Value $ObjectId ` | ReplaceMacro -Macro "{graphApiVersion}" -Value $GraphApiVersion; $groupGraphResponse = InvokeApi -Route $groupsGraphUri -Method GET If($groupGraphResponse.StatusCode -eq $null) { CreateGroupObject -GroupObj $groupGraphResponse } } else { $userFilter = "startswith(userPrincipalName,'$SearchString') or startswith(displayName,'$SearchString')" $userGraphUri = "https://graph.windows.net/myorganization/users`?`$filter={filter}&api-version={graphApiVersion}" ` | ReplaceMacro -Macro "{filter}" -Value $userFilter ` | ReplaceMacro -Macro "{graphApiVersion}" -Value $GraphApiVersion; $userGraphResponse = InvokeApi -Route $userGraphUri -Method GET foreach($user in $userGraphResponse.value) { CreateUserObject -UserObj $user } $groupFilter = "startswith(displayName,'$SearchString')" $groupsGraphUri = "https://graph.windows.net/myorganization/groups`?`$filter={filter}&api-version={graphApiVersion}" ` | ReplaceMacro -Macro "{filter}" -Value $groupFilter ` | ReplaceMacro -Macro "{graphApiVersion}" -Value $GraphApiVersion; $groupsGraphResponse = InvokeApi -Route $groupsGraphUri -Method GET foreach($group in $groupsGraphResponse.value) { CreateGroupObject -GroupObj $group } } } } function CreateUserObject { param ( [Parameter(Mandatory = $true)] [object]$UserObj ) return New-Object -TypeName PSObject ` | Add-Member -PassThru -MemberType NoteProperty -Name ObjectType -Value $UserObj.objectType ` | Add-Member -PassThru -MemberType NoteProperty -Name ObjectId -Value $UserObj.objectId ` | Add-Member -PassThru -MemberType NoteProperty -Name UserPrincipalName -Value $UserObj.userPrincipalName ` | Add-Member -PassThru -MemberType NoteProperty -Name Mail -Value $UserObj.mail ` | Add-Member -PassThru -MemberType NoteProperty -Name DisplayName -Value $UserObj.displayName ` | Add-Member -PassThru -MemberType NoteProperty -Name AssignedLicenses -Value $UserObj.assignedLicenses ` | Add-Member -PassThru -MemberType NoteProperty -Name AssignedPlans -Value $UserObj.assignedLicenses ` | Add-Member -PassThru -MemberType NoteProperty -Name Internal -Value $UserObj; } function CreateGroupObject { param ( [Parameter(Mandatory = $true)] [object]$GroupObj ) return New-Object -TypeName PSObject ` | Add-Member -PassThru -MemberType NoteProperty -Name ObjectType -Value $GroupObj.objectType ` | Add-Member -PassThru -MemberType NoteProperty -Name Objectd -Value $GroupObj.objectId ` | Add-Member -PassThru -MemberType NoteProperty -Name Mail -Value $GroupObj.mail ` | Add-Member -PassThru -MemberType NoteProperty -Name DisplayName -Value $GroupObj.displayName ` | Add-Member -PassThru -MemberType NoteProperty -Name Internal -Value $GroupObj; } function CreateTenantObject { param ( [Parameter(Mandatory = $true)] [object]$TenantObj ) return New-Object -TypeName PSObject ` | Add-Member -PassThru -MemberType NoteProperty -Name ObjectType -Value $TenantObj.objectType ` | Add-Member -PassThru -MemberType NoteProperty -Name TenantId -Value $TenantObj.objectId ` | Add-Member -PassThru -MemberType NoteProperty -Name Country -Value $TenantObj.countryLetterCode ` | Add-Member -PassThru -MemberType NoteProperty -Name Language -Value $TenantObj.preferredLanguage ` | Add-Member -PassThru -MemberType NoteProperty -Name DisplayName -Value $TenantObj.displayName ` | Add-Member -PassThru -MemberType NoteProperty -Name Domains -Value $TenantObj.verifiedDomains ` | Add-Member -PassThru -MemberType NoteProperty -Name Internal -Value $TenantObj; } # SIG # Begin signature block # MIInwAYJKoZIhvcNAQcCoIInsTCCJ60CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCE6pkogaoMV/r5 # n6wWeEeWyv0oYE2iW+hJ6YqE+wxnxKCCDYUwggYDMIID66ADAgECAhMzAAADri01 # UchTj1UdAAAAAAOuMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjMxMTE2MTkwODU5WhcNMjQxMTE0MTkwODU5WjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQD0IPymNjfDEKg+YyE6SjDvJwKW1+pieqTjAY0CnOHZ1Nj5irGjNZPMlQ4HfxXG # yAVCZcEWE4x2sZgam872R1s0+TAelOtbqFmoW4suJHAYoTHhkznNVKpscm5fZ899 # QnReZv5WtWwbD8HAFXbPPStW2JKCqPcZ54Y6wbuWV9bKtKPImqbkMcTejTgEAj82 # 6GQc6/Th66Koka8cUIvz59e/IP04DGrh9wkq2jIFvQ8EDegw1B4KyJTIs76+hmpV # M5SwBZjRs3liOQrierkNVo11WuujB3kBf2CbPoP9MlOyyezqkMIbTRj4OHeKlamd # WaSFhwHLJRIQpfc8sLwOSIBBAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUhx/vdKmXhwc4WiWXbsf0I53h8T8w # VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh # dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzUwMTgzNjAfBgNVHSMEGDAW # gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw # MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov # L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx # XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB # AGrJYDUS7s8o0yNprGXRXuAnRcHKxSjFmW4wclcUTYsQZkhnbMwthWM6cAYb/h2W # 5GNKtlmj/y/CThe3y/o0EH2h+jwfU/9eJ0fK1ZO/2WD0xi777qU+a7l8KjMPdwjY # 0tk9bYEGEZfYPRHy1AGPQVuZlG4i5ymJDsMrcIcqV8pxzsw/yk/O4y/nlOjHz4oV # APU0br5t9tgD8E08GSDi3I6H57Ftod9w26h0MlQiOr10Xqhr5iPLS7SlQwj8HW37 # ybqsmjQpKhmWul6xiXSNGGm36GarHy4Q1egYlxhlUnk3ZKSr3QtWIo1GGL03hT57 # xzjL25fKiZQX/q+II8nuG5M0Qmjvl6Egltr4hZ3e3FQRzRHfLoNPq3ELpxbWdH8t # Nuj0j/x9Crnfwbki8n57mJKI5JVWRWTSLmbTcDDLkTZlJLg9V1BIJwXGY3i2kR9i # 5HsADL8YlW0gMWVSlKB1eiSlK6LmFi0rVH16dde+j5T/EaQtFz6qngN7d1lvO7uk # 6rtX+MLKG4LDRsQgBTi6sIYiKntMjoYFHMPvI/OMUip5ljtLitVbkFGfagSqmbxK # 7rJMhC8wiTzHanBg1Rrbff1niBbnFbbV4UDmYumjs1FIpFCazk6AADXxoKCo5TsO # zSHqr9gHgGYQC2hMyX9MGLIpowYCURx3L7kUiGbOiMwaMIIHejCCBWKgAwIBAgIK # YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV # BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv # c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm # aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw # OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD # VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG # 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la # UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc # 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D # dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+ # lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk # kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6 # A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd # X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL # 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd # sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3 # T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS # 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI # bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL # BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD # uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv # c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf # MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf # MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF # BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h # cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA # YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn # 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7 # v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b # pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/ # KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy # CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp # mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi # hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb # BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS # oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL # gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX # cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGZEwghmNAgEBMIGVMH4x # CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt # b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p # Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAAOuLTVRyFOPVR0AAAAA # A64wDQYJYIZIAWUDBAIBBQCggaAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw # HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIBMI # YlHh64tx0HuN5kDhQhisD8uFb3uohr8QM4GMpvfmMDQGCisGAQQBgjcCAQwxJjAk # oBKAEABUAGUAcwB0AFMAaQBnAG6hDoAMaHR0cDovL3Rlc3QgMA0GCSqGSIb3DQEB # AQUABIIBAGfjwXl8j8+S4pKiJ+CLoNR553/84QGiQa+KcxZc5vNu8ztvo6WfwQr4 # DParegLL59boBwczot4zlv0cNDhC2wS8Q4jJpuZnBQ1hltpEOq3Ug76XQbV3WtiE # ridP93G8C+P1zL5EfslB5Iem/xgVXszvFbEiE1+ZpBcJ98FIFACUzIjWQMae7Ieg # 8SZkdmansN0U/RF4dfAUZ9do1Zc8x0mdZRxLIyrCzdgg8tKWr3Md7P1j6jDMkIA8 # QWy+R48QdV0go2sOBK3++MS6VqnQf1MW9bryphDbXSkPH2/SLbEmN4q5xy7vPzBA # u5IbnfK0h0T9Y/Hd6CA2bUcx9fSE4vWhghcpMIIXJQYKKwYBBAGCNwMDATGCFxUw # ghcRBgkqhkiG9w0BBwKgghcCMIIW/gIBAzEPMA0GCWCGSAFlAwQCAQUAMIIBWQYL # KoZIhvcNAQkQAQSgggFIBIIBRDCCAUACAQEGCisGAQQBhFkKAwEwMTANBglghkgB # ZQMEAgEFAAQgxFSAKUFhv2QiBrxau4avjt3+1odopTd783y6J6nHXBYCBma+GwLw # tRgTMjAyNDA4MTYyMTU1NTQuMDAyWjAEgAIB9KCB2KSB1TCB0jELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IEly # ZWxhbmQgT3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVT # TjpGQzQxLTRCRDQtRDIyMDElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAg # U2VydmljZaCCEXgwggcnMIIFD6ADAgECAhMzAAAB4pmZlfHc4yDrAAEAAAHiMA0G # CSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u # MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp # b24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTIz # MTAxMjE5MDcyNVoXDTI1MDExMDE5MDcyNVowgdIxCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9w # ZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046RkM0MS00 # QkQ0LUQyMjAxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Uw # ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Y7WYVfpBZm/HCkKYNps4 # rA5USPe/Bm9mphr2wJgndOCVRnk3v0BszPCm0KzA6Jewwu40tNyZHKz7FovVqVcL # CHJEUPAJF9YnQRvR4cgrKQGr37r8+eZIZe26z0Mex/fVCW7BN8DJqZiWrD1qYBdO # c2Zb6VkA1Cw3CGMpeZVyOB1WeTejEsVjvM8Fq+K/cZDJlF7OyAsQya+Wt/UknjwC # USMs52iHNFs2ejBXE0cyyzcjwROCq1b9SxXfehTcQM8J3rUnj4PPBJkXs69k9x0x # RJZ3iV8kGHemEO3giHO8pZVqGNNwhIPYIaK6falCnAVHxXEuFxJX9xkhEZ5cybCu # 7P2Rj1OHWh09o1hqGIWtkAjppIIzpgRQqkBRcBZrD62Y+HkLM2MauHOB6j51LuIU # +Gqqb1Gd6iDl23clONqTS/d3J9Kz005XjlLDkG4L5UXbYRQgXqcX2+p27Kd33GWj # wX027V1WvJy0LjAgasn7Hm7qp28I/pR0H6iqYr6cneyglgAqI+/F1MGKstR8mJ0r # U5nuE/byurtjvyk4X0TniR4koOOMphY/t+CHBRIT6IGirzTbE1ZuEG6qYQspJ68A # cqqKwQix+m5ZUbSTCcJruxkXU0LCMdhzCqqYRLaUptc97nwEnT64D4bECERZB2Rr # ooS9SY4+C7twmwJoWtJTqwIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFESEDhHavu0H # bJabSYgkTaV4CdoFMB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8G # A1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv # Y3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBs # BggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0 # LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUy # MDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUH # AwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQDkVEQxq1UU257p # X7INnE7Msoe2F74VVOzWTJCEwEGLBRD1YL0r4gspa+Wqd5Gu+mM9Lf+pcbnMyOsO # 7V6vJ+FsVFIHI+cAIZzaK4Zw/JY2Km3JN+34IGCt/sBMC4T9Txgubb1ytMWKJlNZ # 1PpVzsvWUZ0oSPx2XRa8NrK4LbG1qMPTjLgA0uZYO6JK12tnWgjhp8bmg9SDvuuR # O6r9jtFtLBo+wFnTozXaXsT67KS9ihHDjHiVZpJPztIGp4Rc8xwJ1o7TVp3lNdVk # Ogcb/DqTdX2PcM0KIsnILzjiTPd6HeeRBnl8XxfG6Hy1ZVBN8yIpKEnnfvLOtTQz # /sfUTMmtpsCv2LNcXbw5WUx53SCrLH5rt77v2vgRX9riKMnFU7wUKb/3a0SQ+vHq # ONNZpAkRZJsv/gZkJUa8dq2qagLuZNDXr/olHQVCpl/4jmime+b7kIO4QogQOcSJ # uWSFw0pV+O8MBWq9/wYE8J7TKva2ukEQHkv6P7mFpJr6rxPAKt/EJioE4gZ1kkv7 # lT3GhxMgK58hYeRvqnghpi+ODHxJxRIcXN7Gj5l4XujIUoAiBiVGQwO99+p0A/H5 # +Muud+C3pfi7k+ReWxbdJi8Hfh+RsRszm2Zpv3N6RFrR79boO3Uvw363HdbJ9hOI # JOFtS9Y3UQWyvccJDJsGPgh2XjErwTCCB3EwggVZoAMCAQICEzMAAAAVxedrngKb # SZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQI # EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv # ZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmlj # YXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIy # NVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEB # AQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXI # yjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjo # YH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1y # aa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v # 3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pG # ve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viS # kR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYr # bqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlM # jgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSL # W6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AF # emzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIu # rQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIE # FgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWn # G1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEW # M2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5 # Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBi # AEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV # 9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3Js # Lm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAx # MC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2 # LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv # 6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZn # OlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1 # bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4 # rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU # 6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDF # NLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/ # HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdU # CbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKi # excdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTm # dHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZq # ELQdVTNYs6FwZvKhggLUMIICPQIBATCCAQChgdikgdUwgdIxCzAJBgNVBAYTAlVT # MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVs # YW5kIE9wZXJhdGlvbnMgTGltaXRlZDEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046 # RkM0MS00QkQ0LUQyMjAxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNl # cnZpY2WiIwoBATAHBgUrDgMCGgMVABabmWn6dG56SXSIX4gdXfKU6IZvoIGDMIGA # pH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE # AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQAC # BQDqaernMCIYDzIwMjQwODE2MjMxMjM5WhgPMjAyNDA4MTcyMzEyMzlaMHQwOgYK # KwYBBAGEWQoEATEsMCowCgIFAOpp6ucCAQAwBwIBAAICEB8wBwIBAAICE+QwCgIF # AOprPGcCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAKMAgCAQAC # AwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQBEOeVtN4dEcV42QHaX # ixqlB7u6UdO13VKOI53YwbR1YqMPGJrfm8Lv+p4U1N2cSJ7mRd6vT6NLjoqfXEPj # PKODS4SpC8+5oOf2hCoymeEwRjyzzBgdFRMNuk3EpWh5w8yKbAzyxAHQI1Vc+Vco # ZQ6rHx1cVstcZQB+9xP8VHAuhzGCBA0wggQJAgEBMIGTMHwxCzAJBgNVBAYTAlVT # MRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1l # LVN0YW1wIFBDQSAyMDEwAhMzAAAB4pmZlfHc4yDrAAEAAAHiMA0GCWCGSAFlAwQC # AQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZIhvcNAQkE # MSIEIDDtqds8wR0+Cr/ZyRqXgk/WIYSBxm6ZcQ8cQE0oWkxxMIH6BgsqhkiG9w0B # CRACLzGB6jCB5zCB5DCBvQQgK4kqShD9JrjGwVBEzg6C+HeS1OiP247nCGZDiQiP # f/8wgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ # MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u # MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAeKZ # mZXx3OMg6wABAAAB4jAiBCAeFi51D4Y+JMDKQ6dyytw9eGMA8Y1+JZgZ11NfWVbe # rDANBgkqhkiG9w0BAQsFAASCAgAHgioq7Z/X2bYEXYEnWs6Sqok62/WjkEoQYpsh # qmAIbu6m9ONvTc28PwzpmdwWa2n3WcEhPw4pcaVBRY0L6BfyiYc55rHA1yRpZ2pn # kwBHtl/94I+0f7hvA5mG29zLZPiDuj/2L6HfbMSiV8C6jhTPHxMqaP1cG5tzFtEB # p6rh6d6KB7FiQc4lmSCVLdsrQKeQDPFeSHnfD2XdbRg0A+yTiKnFZP7rytDeCudP # k263i1muv/mcbSEE2H0cv6K09yGqtfyxaloGnHXd/tBkI4gUACtYW578KyWI4dVu # au8FvGmtiivjKAcEvBUIcMFI3CID/Mz3NHjymRiCw0fu7mSMrxuH2gwwJM/Zo1qu # jpjZwvXiDHuafYHuHbkrIMPEAT9RHvjywKjxVycByQkn/7guYYvi+r5mDGpovfMK # pIpgiG1EpMVWVWZ/qN/mz+MBhg8aCfqslglRwh1FBCji4qki8U1AHPG9sC4Eyq3q # xk4ztLW6jBxtHWl9nihA5vkGEDZ6+ntZHI+jaEhvXbSYPCZKJmsyzaZJXOSijVh8 # m7jKs/v5FKh1eLuFTN7Wvi7SqVdduyYD8nGaEKdA2WAYNG9nvG7WgOrnd6mahOBY # cc1Vx2V3FhCLPVtjWbAKd5nnN4MYDKN+C5HuZ9BigeiLNVupS6ZM7C/2mYlpHvj6 # /hSwBg== # SIG # End signature block |