From 3ad2599edc7a57fdae5a061d57c08148f0c20bb2 Mon Sep 17 00:00:00 2001 From: John-Mason Shackelford Date: Mon, 14 Sep 2026 07:48:16 -0400 Subject: [PATCH 1/4] docs(enterprise): add Authentik SAML provider guide Add a provider-specific, tutorial-style page for configuring Authentik as a SAML identity provider, nested under the SAML SSO guide in the navigation. The page ends with the values to copy into the Replicated or Helm configuration. Link to it from Step 1 of the SAML SSO guide. Co-authored-by: openhands --- docs.json | 8 +- .../integrations/saml-providers/authentik.mdx | 127 ++++++++++++++++++ enterprise/integrations/saml-sso.mdx | 3 + 3 files changed, 137 insertions(+), 1 deletion(-) create mode 100644 enterprise/integrations/saml-providers/authentik.mdx diff --git a/docs.json b/docs.json index 085b0c75..408d49a6 100644 --- a/docs.json +++ b/docs.json @@ -554,7 +554,13 @@ "enterprise/integrations/bitbucket-data-center", "enterprise/integrations/jira-cloud", "enterprise/integrations/jira-data-center", - "enterprise/integrations/saml-sso", + { + "group": "SAML SSO", + "pages": [ + "enterprise/integrations/saml-sso", + "enterprise/integrations/saml-providers/authentik" + ] + }, "enterprise/integrations/slack", "enterprise/integrations/external-llm-gateways", "enterprise/integrations/observability-platforms" diff --git a/enterprise/integrations/saml-providers/authentik.mdx b/enterprise/integrations/saml-providers/authentik.mdx new file mode 100644 index 00000000..e0400441 --- /dev/null +++ b/enterprise/integrations/saml-providers/authentik.mdx @@ -0,0 +1,127 @@ +--- +title: Authentik +description: Configure Authentik as a SAML identity provider for OpenHands Enterprise. +icon: key +--- + +This guide walks through configuring [Authentik](https://goauthentik.io/) as a +SAML identity provider for OpenHands Enterprise. It is a provider-specific +companion to the [SAML SSO](/enterprise/integrations/saml-sso) guide. Follow the +steps here first, then use the values from the [last section](#values-for-openhands) +to complete [Step 2 of the SAML SSO guide](/enterprise/integrations/saml-sso#step-2-enable-saml-sso). + +## Prerequisites + +- An Authentik instance reachable over HTTPS with a certificate from a trusted + certificate authority. OpenHands fetches the metadata server-side and rejects + untrusted or self-signed TLS certificates. +- Authentik administrator access. +- Your OpenHands Authentication hostname, which is `auth.` + by default. The examples below use `auth.openhands.example.com`. + +## Step 1: Create a SAML Provider + +1. In the Authentik admin interface, go to **Applications → Providers** and + choose **Create**. +2. Select **SAML Provider** and choose **Next**. +3. Configure the provider with these values: + + | Field | Value | + | --- | --- | + | Name | `Provider for OpenHands` | + | Authorization flow | `default-provider-authorization-implicit-consent` | + | ACS URL | `https://auth.openhands.example.com/realms/allhands/broker/enterprise_sso/endpoint` | + | Audience | `https://auth.openhands.example.com/realms/allhands` | + | Service Provider Binding | `Post` | + | NameID Property Mapping | `Authentik default SAML Mapping: Email` | + + + `enterprise_sso` and `allhands` are fixed values that OpenHands expects. Do + not change them. Replace only the `auth.openhands.example.com` hostname. + + +4. Under **Advanced protocol settings**, set the **Signing Certificate** to + `authentik Self-signed Certificate` (or any certificate keypair you prefer). + + + The signing certificate is required. Authentik leaves this field blank by + default, and without it the published metadata contains no signing + certificate. OpenHands then refuses to create the SSO provider and users + fall back to the built-in login page. This is the most common cause of a + failed Authentik integration. + + +5. Choose **Finish**. + +## Step 2: Attach Property Mappings + +OpenHands provisions accounts from the SAML assertion and requires an email +address. Confirm the provider releases the standard identity attributes. + +1. Edit the provider you just created. +2. Under **Property mappings**, ensure at least these built-in mappings are + selected: + - `Authentik default SAML Mapping: Email` (required) + - `Authentik default SAML Mapping: Name` (recommended) + - `Authentik default SAML Mapping: Username` (recommended) +3. Save the provider. + +## Step 3: Create an Application + +1. Go to **Applications → Applications** and choose **Create**. +2. Configure the application: + + | Field | Value | + | --- | --- | + | Name | `OpenHands` | + | Slug | `openhands` | + | Provider | `Provider for OpenHands` | + | Launch URL | `https://app.` | + +3. Choose **Create**. + +The application slug becomes part of the metadata URL, so keep it consistent +with the value you use in the next section. + +## Step 4: Restrict Access (Optional) + +By default every Authentik user can sign in to the application. To limit access, +open the application's **Policy / Group / User Bindings** tab and bind the +group(s) that should have access. Leaving this empty allows all Authentik users, +which is convenient for initial testing. + +## Step 5: Create a Test User + +SSO authenticates against Authentik, so you need at least one Authentik user +with an email address. + +1. Go to **Directory → Users** and choose **Create**. +2. Set a username and an **email address** (required for account provisioning in + OpenHands). +3. Set a password for the user, or use the existing `akadmin` account. + +## Values for OpenHands + +Use these values to complete +[Step 2 of the SAML SSO guide](/enterprise/integrations/saml-sso#step-2-enable-saml-sso). +Replace the hostname and slug with your own. + +| OpenHands setting | Value | +| --- | --- | +| SAML Metadata URL | `https:///application/saml/openhands/metadata/` | +| Identity Provider Display Name | e.g. `Company SSO (via Authentik)` | + + + Use the bare `.../metadata/` URL. OpenHands fetches it server-side, where + Authentik serves the raw XML directly, so no `?download` suffix is needed. If + you open that URL in a browser you may be redirected to the Authentik login; + that redirect does not affect OpenHands' server-side fetch. + + +To inspect the metadata yourself and confirm it contains a signing certificate, +add `?download` and follow redirects: + +```bash +curl -sL "https:///application/saml/openhands/metadata/?download" \ + | grep -c X509Certificate # expect >= 1 +``` diff --git a/enterprise/integrations/saml-sso.mdx b/enterprise/integrations/saml-sso.mdx index 43d1eb1c..7605f2dc 100644 --- a/enterprise/integrations/saml-sso.mdx +++ b/enterprise/integrations/saml-sso.mdx @@ -53,6 +53,9 @@ need this URL in the next step. application. +For provider-specific, step-by-step instructions, see the guide for your +identity provider: [Authentik](/enterprise/integrations/saml-providers/authentik). + ## Step 2: Enable SAML SSO Pick the path that matches how OpenHands Enterprise is deployed. From c5681619e2de4ee2d6daa393e33b645d97c25ff0 Mon Sep 17 00:00:00 2001 From: John-Mason Shackelford Date: Mon, 14 Sep 2026 08:16:15 -0400 Subject: [PATCH 2/4] docs(enterprise): align Authentik guide with actual wizard UI Rework the Authentik SAML guide to follow the single 'New application' wizard (Application -> Choose a Provider -> Configure Provider -> Configure Bindings -> Review) rather than a separate provider/application flow. Correct the NameID setting to 'Default NameID Policy: Persistent', note that the default property mappings already include Email, and add the Service Provider Binding and digest/signature algorithm values, matching the real UI. Co-authored-by: openhands --- .../integrations/saml-providers/authentik.mdx | 161 ++++++++++-------- 1 file changed, 89 insertions(+), 72 deletions(-) diff --git a/enterprise/integrations/saml-providers/authentik.mdx b/enterprise/integrations/saml-providers/authentik.mdx index e0400441..37aaff81 100644 --- a/enterprise/integrations/saml-providers/authentik.mdx +++ b/enterprise/integrations/saml-providers/authentik.mdx @@ -19,78 +19,95 @@ to complete [Step 2 of the SAML SSO guide](/enterprise/integrations/saml-sso#ste - Your OpenHands Authentication hostname, which is `auth.` by default. The examples below use `auth.openhands.example.com`. -## Step 1: Create a SAML Provider - -1. In the Authentik admin interface, go to **Applications → Providers** and - choose **Create**. -2. Select **SAML Provider** and choose **Next**. -3. Configure the provider with these values: - - | Field | Value | - | --- | --- | - | Name | `Provider for OpenHands` | - | Authorization flow | `default-provider-authorization-implicit-consent` | - | ACS URL | `https://auth.openhands.example.com/realms/allhands/broker/enterprise_sso/endpoint` | - | Audience | `https://auth.openhands.example.com/realms/allhands` | - | Service Provider Binding | `Post` | - | NameID Property Mapping | `Authentik default SAML Mapping: Email` | - - - `enterprise_sso` and `allhands` are fixed values that OpenHands expects. Do - not change them. Replace only the `auth.openhands.example.com` hostname. - - -4. Under **Advanced protocol settings**, set the **Signing Certificate** to - `authentik Self-signed Certificate` (or any certificate keypair you prefer). - - - The signing certificate is required. Authentik leaves this field blank by - default, and without it the published metadata contains no signing - certificate. OpenHands then refuses to create the SSO provider and users - fall back to the built-in login page. This is the most common cause of a - failed Authentik integration. - - -5. Choose **Finish**. - -## Step 2: Attach Property Mappings - -OpenHands provisions accounts from the SAML assertion and requires an email -address. Confirm the provider releases the standard identity attributes. - -1. Edit the provider you just created. -2. Under **Property mappings**, ensure at least these built-in mappings are - selected: - - `Authentik default SAML Mapping: Email` (required) - - `Authentik default SAML Mapping: Name` (recommended) - - `Authentik default SAML Mapping: Username` (recommended) -3. Save the provider. - -## Step 3: Create an Application - -1. Go to **Applications → Applications** and choose **Create**. -2. Configure the application: - - | Field | Value | - | --- | --- | - | Name | `OpenHands` | - | Slug | `openhands` | - | Provider | `Provider for OpenHands` | - | Launch URL | `https://app.` | - -3. Choose **Create**. - -The application slug becomes part of the metadata URL, so keep it consistent -with the value you use in the next section. - -## Step 4: Restrict Access (Optional) - -By default every Authentik user can sign in to the application. To limit access, -open the application's **Policy / Group / User Bindings** tab and bind the -group(s) that should have access. Leaving this empty allows all Authentik users, -which is convenient for initial testing. - -## Step 5: Create a Test User +Authentik creates the application and its SAML provider together in a single +**New application** wizard. In the admin interface, go to **Applications → +Applications** and choose **Create with Wizard**. + +## Step 1: Configure the Application + +On the **Application** step, enter: + +| Field | Value | +| --- | --- | +| Application Name | `OpenHands` | +| Slug | `openhands` | +| Group | leave blank (optional) | +| Policy engine mode | `ANY` (default) | +| Launch URL (under **UI Settings**) | `https://app.` | + +The slug becomes part of the metadata URL, so keep it consistent with the value +you use in the [last section](#values-for-openhands). Choose **Next**. + +## Step 2: Choose a Provider Type + +Select **SAML Provider**, then choose **Next**. + + + Choose **SAML Provider**, not **SAML Provider from Metadata**. The + metadata option is for importing an existing provider's metadata, which is not + what you want here. + + +## Step 3: Configure the SAML Provider + +Fill in the provider details: + +| Field | Value | +| --- | --- | +| Name | `Provider for OpenHands` | +| Authorization Flow | `default-provider-authorization-implicit-consent (Authorize Application)` | +| ACS URL (under **Protocol settings**) | `https://auth.openhands.example.com/realms/allhands/broker/enterprise_sso/endpoint` | +| Audience | `https://auth.openhands.example.com/realms/allhands` | +| SLS URL | leave blank (optional) | + + + `enterprise_sso` and `allhands` are fixed values that OpenHands expects. Do + not change them. Replace only the `auth.openhands.example.com` hostname with + your Authentication hostname. + + +Expand **Advanced protocol settings** and configure: + +| Field | Value | +| --- | --- | +| Signing Certificate | select a certificate, for example `authentik Self-signed Certificate` | +| Property mappings | keep the defaults (7 mappings are selected, including Email, Name, and Username) | +| Service Provider Binding | `Post` | +| Default NameID Policy | `Persistent` | +| Digest algorithm | `SHA256` (default) | +| Signature algorithm | `SHA256` (default) | + + + You must set the **Signing Certificate**. Authentik leaves this field blank by + default, and without it the published metadata contains no signing + certificate. OpenHands then refuses to create the SSO provider and users fall + back to the built-in login page. This is the most common cause of a failed + Authentik integration. + + + + OpenHands provisions accounts from the SAML assertion and requires an email + address. The default property mappings already include + `authentik default SAML Mapping: Email`, so leave the selection as-is unless + you have customized it. + + +Choose **Next**. + +## Step 4: Configure Bindings (Optional) + +The **Configure Bindings** step controls which users can access the application. +By default there are no bound policies, which allows all Authentik users to sign +in — convenient for initial testing. To restrict access, choose **Bind existing +policy/group/user** and bind the group(s) that should have access. + +Choose **Next**. + +## Step 5: Review and Submit + +Review the application and provider details, then choose **Create Application**. + +## Create a Test User SSO authenticates against Authentik, so you need at least one Authentik user with an email address. From a64a92fbc39c8f71509ecb037f546e91b5fb7263 Mon Sep 17 00:00:00 2001 From: John-Mason Shackelford Date: Mon, 14 Sep 2026 08:26:51 -0400 Subject: [PATCH 3/4] docs(enterprise): explain Authentik UI settings and provide a downloadable icon Break Step 1 into sub-steps for the UI Settings: explain that the Launch URL and icon make OpenHands appear as a one-click tile on the Authentik User Dashboard, and provide a downloadable OpenHands icon users can upload. Co-authored-by: openhands --- .../integrations/saml-providers/authentik.mdx | 47 ++++++++++++++++-- .../saml-providers/images/openhands-icon.png | Bin 0 -> 42411 bytes 2 files changed, 44 insertions(+), 3 deletions(-) create mode 100644 enterprise/integrations/saml-providers/images/openhands-icon.png diff --git a/enterprise/integrations/saml-providers/authentik.mdx b/enterprise/integrations/saml-providers/authentik.mdx index 37aaff81..054be8eb 100644 --- a/enterprise/integrations/saml-providers/authentik.mdx +++ b/enterprise/integrations/saml-providers/authentik.mdx @@ -25,7 +25,7 @@ Applications** and choose **Create with Wizard**. ## Step 1: Configure the Application -On the **Application** step, enter: +On the **Application** step, set the core application fields: | Field | Value | | --- | --- | @@ -33,10 +33,51 @@ On the **Application** step, enter: | Slug | `openhands` | | Group | leave blank (optional) | | Policy engine mode | `ANY` (default) | -| Launch URL (under **UI Settings**) | `https://app.` | The slug becomes part of the metadata URL, so keep it consistent with the value -you use in the [last section](#values-for-openhands). Choose **Next**. +you use in the [last section](#values-for-openhands). + +### Configure the UI settings + +Expand **UI Settings**. These settings control how OpenHands appears on the +Authentik **User Dashboard**, the launch directory where users see the +applications available to them. Configuring them lets a user open OpenHands +directly from Authentik with one click, in addition to signing in from the +OpenHands sign-in page. + +1. **Set the Launch URL.** Enter your OpenHands URL so the dashboard tile links + to the application: + + ``` + https://app. + ``` + + If you leave this blank, Authentik tries to infer a launch URL from the + provider, which does not produce a usable link for this integration. + +2. **Upload an application icon.** The icon is shown next to OpenHands on the + User Dashboard, so users can recognize it at a glance. Download the OpenHands + icon below, save it to your machine, then upload it in the **Icon** field. + + + OpenHands icon + + + [Download the OpenHands icon](/enterprise/integrations/saml-providers/images/openhands-icon.png) + + + Uploading an icon requires authentik to have media storage configured, + which is the default for standard installations. If your instance cannot + store uploaded files, you can instead set the icon to a publicly reachable + image URL. + + +Choose **Next**. ## Step 2: Choose a Provider Type diff --git a/enterprise/integrations/saml-providers/images/openhands-icon.png b/enterprise/integrations/saml-providers/images/openhands-icon.png new file mode 100644 index 0000000000000000000000000000000000000000..efa92f7b7c138299039c98bae0f3257987ee7016 GIT binary patch literal 42411 zcmeEtM$^HfVVda67DtmHOWDK}JezTptor#}m-^`1X zXTbhL1&4yYaf{=Y|K}2jjTx6%xD$qB`}O$p^%#~99@Fs;f*1~h*o1jAJCoxl|3FV6 za>F2S=X?Kzf4px4INc_&G56iw8xsR8UCa=#R<-Y$|D~|8fJ0CK4Hyv++W{-r>>WUP z9K#6pDQM3)xG*yXn|tU4A3-cAloG`_7}<|vs&IzV0T4hL2Ejp~qE%0pz(K%;euO&u zcICex+MxO`Dk#|heUb$KPmKQW@SCN#`~Tl?cThLPFaYQ#h9mt+{JTG8P$7VyoF6IW z1pQ9Nf588wxX`M*H^1Nal-ci~I0S6%7wS(D)mq;AW+w`q?1@wzF5zbJOo(45ur$8d zbaaf~7NFd??5B&r-<*vKyald3%6tk`#D%&;r7WUWJ8=ag@xqLZap$`S%j_?W3&0l# z6L>b~@fg!sK)Vo}m`=Whx$Z#VB|?RjF~i=N3u zSHIm9Myoc!3{QuCblLXsluZ-{DgI{VO|=mPc|?BQbxh@Yo4|L`|LoK#hTsz5m;4#2 zflNswi}R5@ac5s(vZT1aAZ+}U6|A6a<)}jXhx013@%mWO>1l>rD!U6Oig*$AH2C)_ z`x%s@`#tx+5F0FU@5&<$!e!qOQRg~x__^JWPt1aE=v7&p)NtN{%_hXNMg$hAOl;Ot z`->=Yj6RUi|9DxvMI!d!Fd=rHHaXKq#~DHAfg>4n00P9t5ST*BJ7vz_r}f`t=JW|; zc(QlLUGxpy#&VCyuRE{fy`~<3g%sDdenpf(!;TY+oySF#Rh86(Ztme#4%cyOHf$xA zC!d3D3EY|j9qMu!KvN;8*vzl39YSoWchW_;Ew50Oso1?0kK0!O-zrrY@n(i-uiDO^ zBeU;dnHtznH%is9*VXQZC7=vVI2;pN*r(K3?ONaroJ$%?j6*Q2erVQ*vU>f85wnQ5 z405PTv7cqZ)>3~|X8KU=$%PU_us`68Fu*lW)%EZeb`lQ%vYX|DkRO*2KPM@06q(&X zT@Z74hcAaEtmY#$am8?kySYI*mi`bKwyq9CMDB11u@l>m^%In!y@8*#cW*{g@7a~A zWJ)|=0--J@9286Y2(Cuw;I0!IhM~QU>srEOiL>KV5Be1c^||MvVZ-0Ozxt>fK%C7t z0($!i=}0Hlf*KbS_<-Oey-vIh&cnaRt{nQlH01-su&0QnW~6TqlOG&DtU8IQh!Jf` z7zrWPj4Nh&XJ97-O91jHRfL6Ru5rCUq2#Ci;|!-x`F^{Nl5hr~@=cY~r^{6LVh=Vv zRi?MafU1ov{BhF}7mzQW$bRK4pN~Ai<>@cQb^Mm8HF>DdrOEzxgPbB;i1cX?F#5xy zY?s?(9)|my{Z^K5f>lOpuYM>owd&*TUAZl*(b6QRP~W!?#heG2-M>sb}Y!Bsd}Xo--_Z&nyfbIdi;&#z3Tb*w99Go;98HELk}z3@W~g?CiPC&Rbx3j9Tj zBV!|P8Glb9xe&o-8W7d((|g5#MjF=c_6%aY=Vj*we!Bc6EZ`mDW> z=?UP62e+{V(c}TZ$^C6e)oRxog8uIx;3VH{F-2Rg!LR4cXV?tB3J^BXG7W7R!@QSV zTULXt-C~i{LfsKBxJ0^AC`RroSu?t71GIFTqH{PURJrh$z6`;54Cn!vym=XWG@;gt zofX%`@~+X&{iO1}R@Oe~d&xu2Tw$H07njfJUfr;BwChY!G=1N~i$jkfBMI?9SR_0m zURfx2`{sdliex2yE~t%DArp=KgczQW`*s(xFTGw57dH5w;mesZ2GKOyR%)~ByDCoq zi)#M;WEnRo2(a^N-T^Uwk6>Wwet=ewNFA{%}(n@IFsfV4NusZNd76C{y<(x{5&a zsTdpjUVe2#t|lAILsMIHBpbkFehLO2iE2~4z-El^6ST;~ogsh0$nZOS5ezF`Jg0>i ztY_zgv5Rs|gq-c4Jv;Cd89_g(1is7OIpv{!L-=~fKKI>m+;5 zCl)5jY|jSaH2Sf7dMB`s+-Y76(<0bhVH%C9AF~>(VEM4;ZfbwR=u1v<#J*G!x>~5Sweqod4Ctgeq1zIK@en*?|=&N4^-@gT}$We zw0|&)-ssnoczI=hc6(GAlktDOAi_NN_(359BfL-1jDUV>n37R}O^9=n!i4;fa?AH` z-!1M-;o)Ln*ilyCLd)}sfzgo%7WH})jCS4w9clms$O2cnY6o|7A209bMwAc$;2+$6 zO6!=$>6bS0p$wSsxx{omqHT41Pvybc*vy465S8y|cXo>b9~&zns`^`%T2@~4wnNGf zrQ4rYjjg*KZ;P1j4iZdnVX1o%&~Y?4XiDs&=XI`%a$lZ_moG@N+_V<;Mb)yJvP~mo zHAOYhDosa^jDEQAFnCwC1ZENO3E61K6bE6}bki8iX4K#`xo+*uBWm)jimG!NbspRN zHH~CIsoT@FDFlMjyHZ!20%zt8?~6;P@Y@Q7(|wn9C6t z83{dlr)-9}RU9zBZ=BX2iAghqCBm`lmNSL@f$T#*(Yyl<6SEAl@Z@7$NKni+A_SG`E(<3gXB7a z36ZTF%0P;7q7)vQZMQnFKv!Cb6=?1+MX__!-lMnBlke>p5R(IZJUfbwN4USp%)Oic zMrZ3#yQg7&HjWb()kFYH54*Csak?ZTM-_}n1QTR8%AV~DV(Yt<7&J6Y&$DQfqP%=( zHUhs7KU3Zt2WVgd2kj%u_@WK5O7C<$5Z1~N`4KgXS#E)U#wgExUejohAD`DGo5eq9 zG>%#pGe!A#of`k9SFogq0#m(IW&MZ<1+-qhHLBBjJ{kV#4`?p!3wO&@g#U6S{`N?W z_ECY*E{EDt+^NzAn)eshobH(EEriL9@r>?}COorHMF1*RuTj>BPSLMaQRwG zARF2)UjZx@uNyvJu`Cw!0q1q6(BCR5Fm_pHk^ATl2tArcx4tW|`kmY1fpYNdrfWdwFP8cb?D*jJD+KQ0V&fQhu^n{Js&VQylDsxppv$t>K1b z7mwu>1dlmKzLHz<)xNTI*y4rH=oV)&REe3Ju($(EMHl6AqdCT<`Uo;21tUtbByZQh z&76PcF!V6df6Bze#d}(jUq24iA4q5JZKwEq$thD9$1&+jjg6;KL*ByyoCaQvaA1s& z$AvM&J=tLl;Quu>BszuJ!TiZ8Tx5u>Pu(MjbAwxA$C^q5Z+^r3?gpPy6edmn_@AK3 zun}ie>|zUX$NVT)Mo@UKLP^xe@jdizK_dS0-Vx5;{T2;{vz2r+SyVWrLxveL_(yfp zq8k>b%IzOfYbA^Fr89P zwvPwV(cH<-q)gN0aUBJJH2(bU{#gUj98D&Vxx%$BNAk6sc2j)4 z(4i4`VpS)#(BGI?-{+pIvU!()n}_G_$hU;Tv)x>AR{C?ZBfPf$Ir?1HSueMe{`~AS zR);tuBRZ5j#E~!%nSBcguQTb>|K5IIp_r;3xF;U8t0qQs{paQtRXo0VC~{0OB?XMW+D2pIRyS*;|Vw!lTVczB)c%YjZe# zrOC1g&5G(ma3#kc|ESw&L+^Xn6OVzhO+S1$ng{mSfR zqOIWR?^LhbKUH*za6OPG(`|_BSmWj2l*!?t4^0l!O4h{0gQmLD#MpN0^55Z35$8sJ z;%}%q1OV=sN>99t4g4%g&A3o~uJY&YH^W0smlrq3KDh-1j?`OfeETK~HK3yMi&OuT zCg=%qg0)9ErLz^|4sLi^dvfOjzRFrcBIL~HRy|tS6_Axo6FXs;q&WRcb&%8T6vIYn zV8zW2WM#5F-1EtNhgKCZ(=q&$dAyr}Toz9APX}tst_no@_4WEL@-v}kY4gbIWmhpQ zFN{Xd(*^Uq;CZ_FV32AQmL3a^W6bLiVL z+ktbOcEp`k1W zlT2{2u1NH70GSFRinvN|oxss03+o2=fm5GPB7JU-l#n$|-qtq6Yqe0-o`n4GpmA?_IwWq3$M+$y?;)=&>Qsp3-21Yjn{>Xebi*gH`jJ< zKeJ;sDF1H11LNEYriCMKo)_zPIUqsk3}@%gid0AAwDZh1ld%A|l)lQa1NT+vll%C% zAm#U$&W08gYO2PKy2MJrV87JTBUBYP)Ic}BvC}-;yMNzfAG4nyal%^)! zyk?(oCuMfi(2hR9tFz@(>M;TG@gL~9gz9NTD`0j2-5?%UZ zXAEtGHpLC;(BgeP|2^%XZ?l|VX8m)v%w0u{)!=t`e0{1mpa4V`uwjl0zCH~P~ zTA^63s?p0+^WW?>aw$cFlPdVx@jB^*N^E2(AUC8LgBaS0UuQqenAK^=tAV+51$DEU z)?m8cOVT(Pr-j}*l@OFOimb6jNqOrwa`aXVI{c{|S3eLzSHGS~Eyw3oGv|A^Gb zjmg#yuF0;@E~F@g9Z6E!yIGz;{NiaF{(+|YIu&R9#K>B*T3JzwXUU7E^!s3F3T@Z< zE^T`2dssmQNtu#$4$}t;|K#4;R9cwn!r5ATWAvP4k;j1A9*ty=e-0mOSUxry)lw>N zMSa|LdcL;X{uRF)FAKvD{sI`UI|mNIEB5+Rh|H8~i$*~^!q-mrf-kg>lUwKE@zJMhVj zx;s|W)Qp=}5yj}SA2HdRX&~f3_$2_+{%~7Ula_wPKNoJ~&0s)Ns;2ZZ2Unzmw9KO$ zNx8yFzZCIdffs8#0Sv_dYOZ(O-z#0=Mk7{}2RxfKvR7{bhWiCf{-l6&=Gj(}gei+vLC z(gLzZ3`A$+4~SPz`(gX1rKI;Pkw+l~MyFFC=s3_MjY;IV7vI9^v^f-??#tg=Me?Ff z8Ig<4I7DFSv%mSs(s1P>FeWY~DI$lIpw)xR9+@gqB?3b187IQM~{)V{ju)G&Hd{fIIE{O&QW5} zm%ymmdg?L)Y4zIn@=9E_uzx!LXlYx~)o74OoZtbfc`sIMmV{r6n_(GX>-jfzda%~~ zBPRxP2#h2AxRd*IdUQtVHl2<6Qc2@kD}!<$D8je4X^4dCSnzuWYrO6il?5%86EKqNw&l=kCJ$92n- z^m?+Tt}w?}0_${+tC@dq&={x3*VIJS`)sYyD+@kD=!_t6s$oGNk8H0~HQ%x&B`xIe z^|=&5vJOH>RoENGCuGXd4r!S6A2^@U*n=)#BI|M;1A`E!abfZ0F9`Jwvwdl4LjI_| z1L4IX`B15nstWdtnC$%aC95BDI(gSxGOuu%Voaz4bm1RNTRRipQXe=6d>jX2F!X9I z35VGUyxi&1#+O=V^xe>qH~$SZ=26mg8eEhsaANX8Pa{ZON&N+K%Xhv10>+wM)p%R@9p%y zY^XBm4*$T0P`iEUO^dfn^`XLw#&(O}y|h%_>!yxqYC)&ZLd1y~9^PFs-ho{N6hjyp z5^@E*$%Nsw%Z+E@HP8+q2!y%>6LC6>yVTry$s;qzo-2+@l5J+RY~`q!inpY|Kcy?j zWy$IG-SpSEwu5=$TB@rTI?gl*_Lr?KroPiCoxbCc9RCdVpknM($+F|(kc zAc@`go_Y*;X zD><eM#7~=o8-PGT;3h635m;^Fq=1S||1PECS5`ykM7Ip%OxUJt$xQ^_=}M$$V-_ z58rZ(k5?;tpoe=_@ccX`yN510LzZnm#!{Tivdu`o+C25wG%6IiJJ@`=sV(?t-}9OO zVsLI#nu(Ut5ZsEfGg=`_9{}Npui(9sx6Sgt*?4-G|BsvocT*nJ69{(b6SO*VVkAQy z#)V1_%vn1>eDyniVz=P?CncrT>ZdNDHba+wtn%j;)6YSnswLleP|GTn|_>%?2 zzgbU5qBEbO*)&lD{4V5wXLwzZf4MI0^Fcm=tQt>qLy@YN&rj2s%u#4G-qsg$|7cK~ z_lt*HDN0ODZl#$vPOX33z}3OE*URPJJEyAG=)&55@8?NncpOe{I|lk7_Y}j=BIqj%yI@sR@U*98?$6#w#X0}GcnUF_ zicn7}hh?Ou2LZw%dAg&qOH1|aGh23CB)tYD>l2Wh(MuE7a?KmeRNJy&fm<=z2c8Y4 z;A&L#fg#72`vLo#MRb<|X~6F&G}|EE1El+Jpl=SZvK>z_YcyFV^#!!$1l5;2X7 zWkDl3bak-h3q(*myuP+1B`bUScLiwx&bZqORF1=tLl4df2ZpqGkkv=@L}|Ry_16ow z3N}aL&16egoSA}pE`X&vjw7q^Ww>1H(*&b zx)p>Uoue97^|#5A^c@;6E34Rf*3kO7s{8Yfb2<`%2@M!HRU3^;AiaZ|tv}zbqzFVap$IsAg+IS(U7Tkzfa*t?N>=NbpT!Y9oSAjOw5ptd z+zuJ~c%y@R z-2khcxI#lNUIKCPZpN-&sE zi@Us~Ys~os78{CgsTSdggfc))8(Qge&JE7Z^$LHcc(tV)ZqwRFJj620Ly19KA{b=z zSo6#++qJfyHec%+tiz+H!mqxGD)m@e5e~9VF3RwvTgrAsCnNdS&HvAz`09G+;DChb zAe74y#AK^mBpeusXtSJzOs`1qp(>R}PmV7qOw|8s<3#)#v`1gvR3E(0NF^sjU@TME`NTP*e& zVK8v!2>9H8+IV4TWTP#X0G8=K?cWHfeU zakBjvC5TWAd1}I}uJMeDdpJqgB8{Gh$I?(S$oF;PCwXQB1c#o}Lv7i=rldkC+13C% zTF+5HNS@4=NZ>mzQ%oznNH;ckp4pQ;*chio;b<(gErCW#6K5m0jyX|{KMi{g!G8ac zbm}Fl^RxO~MfQm_=Pzi5>C(}-JKq?6mi*vogp=dv<*26sLYNHn2r`fGF>)8o{P_VG zKL1n$ewZz`vUXC%{C?0Mp!3sJI3qb2JyaMVSo4mRmB&1KnD^k2 zlsdiP*&5>+R^lQf7_Ao(EqB{blrLc*|6e*`Ac)D!e0QBxNDv7}#%xit6m|w~+E1$U zoe@*%=`1J*-d^?GPRRe{#p6%1T0|%r>qac>7-BT?7)%lzD~*>OJA@d*V2^E|%`Q1i zBFwXanzrMwWU-fXny2jTUHC+}aP1tG@OkqbCrGYN=;UN{YArh-$O*8jGf9&UpYKKy z7WMS3qXur$*b6nmup=tp&M%mH!E)g>K3X4dbyB z<3naK_`1nCn=>Rt3|HX{hJF#0gv6i`CO4A@GAO|(-yLm@`1jmCy6O6|@?={$CBc1t zsEYJcfi|wZhZUvywP(u`9E#|L0k#Xb=(!FKIp|P-ISO{IC}79ef$>@*Vyi@nAqFHB z_&%nkmks-P-?#p-^=!ef)5xk;&Akf7KOBxs9a%Id0^}qk5{3P!tP~6JG!KUfuXfGG zZmr!uJBe$UlFa07#VN2ZKk2Xtetm#}_;#vHVz>fWH)>$+;D<*ghWhBGDY>y4z$u}s zmI3Xeu+@WKo$8xzlfcB?9!kR&{{qShg<}*Q{vIb;uqq}A*rw4(Z*g%au;)YUhs^Mx z(0p$hCbOB3`#5&N2Q@K9YC$Gh@H;d%c=!!d2Ds1DOM0K%W51Jr5|Iz&Crd12 zLrIj~_kYi_yRstj>B~nLXR}6{VT-1wTZQDMVS@MW345liI;b&7>mG*Apb@7M@{o~O zp{pyiTTVS=)k=eWmU$wS7|KN6-fP6YINjbYDi9mRQpBHMeV_hC2UCu=H8*=?E6Eab zk(B7`b#2n@*d3mJD!7a;g+Tji{CaRyWDwDD##P#;KdQd1=|61K+$5yK1a*4cmF(=@ z62(R>*SzoU5POehpFvsgg=1vwy?X%IC9t|(aAs_f$w@+hOx~2WO@HB43r^rU!!`ID zCS{#hNDl{w&2sbm!)`|}TE!_$mr4(mCjCfZ#h!_&g%TlTm4}Eq%XTK8i zx`bq-Q5FM80RD{Zm^){g{9G2#zkV_O@J(A!fAGozeV%vPmo%2*BwD24XnqM(3> z<}aSUUe+ESFg_UlGe5NI!}58qzt-Fq3g^iO%%R*8TIJe=a`RfNS!LI=Q}&3MpJ^Pb zP0XsoOVVa`E)sf&3|He`)%e}x$Z|b&KtI# zANNst$~w?0UH0=a>(leuIHB+w6~KIAd4~nmJrp+lbcAu3ob+2qywo(Xsr{Pv`|l0b zavjcWFCUm?K(7n>@5+-7G=AkI@!V_yC(`?+dA7X}vejNF#Ih&Xjy5o%kF9oA#D>u* znlsUr4(E(8`16rp2U5mi)t3{tkHfUGg6Q!M?h1s1e zH9%tVcQ3~G3H#;jmCa(VTpBI-3;Bo7wPS?#8RU(^vTS_45d`RWi{q8+0qD{H2IM$Q zXex#YXW&1CxN8u{bvkCk9`dsdkWcsTiTc9A+sqlKoJywI$>yoF@kxfJd6Drd zUplYn4Z9o$Mtfa^Q3ZcE%umhofK0Z!TeaQghAFn7NZ~^=b5NV~fg-cwyT*`Nrb0^& zejNtOU{$Q0jo2YtORFhHYF;mL+TPGD@S9!;_2|oZ9NovE9goNwaFRKox}P489;(8K z8;3#FmHSgS!%?WHB4}-6WS9K0yRNRf+Z2t1^{*$UL?&N>I_j6(mMtjn2{_u7D=5cp z<4cq`S{6uRN$qKvZ;wk#B2}!@7djsL0L+_#e6uX+uN~INVOS`@#M*T*z#bKpW!`~G zd&(0b|0oVxIh7hFH7byXwdW^Y3@+TCMN}G3C~MZvjna??078M#S$BadivhOSvC1E$ zX(^%Nf|tn1zh>Lki$n#N=u!D#8QT=TsD$QXlsQ%Oj3W=IKG}&#L>|1i!#Qey`YhSq z>2Q(ZJmn>F5nE?ZUS)&6x{V7sWMStZ7d&0K0C<*AOLbKa*4FFyKVSR`M%!DgwuAD9 zz;4eS0ju-kQhBKC_}N6IdvcO$`eUWiuOkny0|j=Av5b=6-`TEkJ-944S_IfSo`_4! z;_1?-C%W@X$h)_QK^#M2fms2t0-mlkG5`T6DI@wI{aZ@8V7~qQ$B1r?30Cx0#9dgs z1*3o!>Jh8|!SvCSzE2fK{18IMra*OJsDf9sc)>J*9^Re2>3pR~C*v|wSM6UD`3kJK z0^*pWp38M9cEPB+F+IPd-TL9}GMA;@AbdhDZx8SNkxvBHAb-sY(jJ6y+1FL2B&DmuRB3ZYDr+S9X2Ee$%E-lII?Y2sPgJ$ zZ2MiU#u+pBp`lku2D*zM9-967q9o*YGdTT23=9LUP9FSHXUwbLJqHF#c5kMbE;-wL zx8LP0BJVbh7#rh{)XHE(>JA7KY8qoZJ@x5jd_fpMuS(?O5cu$b5lN_ocq}Wl-ATa>m2b{>WkVuG zqPL*nbKb|-)U>d?d)%Rw;dB8=`I#wqYV!NLCa6TYXyfmQn1Y1ZTmRwP7pup5`@O>-DWem|U*Gms9d20%4lSiU?6%y^xpwYACl=D}g! z_HVkWXbBSfHrS;F9VG!KY^Fb!(3<5ZPtWYr=uzqXir@dpjK?@=hbxDaIR_5M6LfS$tmJA;K(-#3hN4#7e6srAKW8WAkR zKh!Gekc&;a0=}*wT2A3RC;#0ua6Oy*vH&f3sAn}UA3h)N(wpr2=J(4vIoZBL?n;Q=kKpL0=|XXG zzU|-?3ryoj_O&ikUy9z6Q^L0G!#Jq-+3CueR81`;2oAvSqp-%WZKDI%?;{%Xm)WqV31+uaqt9A71tIo zp$TM(RRvHV9ZrEX>7K{J@_<)_uF28S{uARLey?d1f;6HVm&InMR{lIjp6dKK--5Qf z)8|7_h>02A)uD}SkpQC4QA`5^tx*r7Pz2MZHB;(xsU+y}>lMO#0yjC$lNnb#S;V~W zF;D1o{S?sOA9Z7afjQJpiFFoq0o2y|D@ME#OQF*Lj{`%%B)n@2w{K-}2Bb;&2Ev}7 z-D?*EwDuI%IoDPNz+ARD^@TM}Sms#kA^ zn!z13A3d|H6$e$GsuD&C4Grnfobt`9>VF7NUy#L=N0pa1ln7$<`oSM5!ZvM-?^+guLVtWcL!bX4`jY{Q zPx!h~>GN&>_)M6%KSY5-7B~iXY+O%|uSX_B|6uQ^E_HoW7Y1J(udWzw!lI4}a$0sH zq?Rw4PtQ7pd@ht4qKTKg$L#NpBwJ4M(nD!g7bLTX_U^?g_BTYASp0Ue)_!LP`c6xP ze^Xo_V*!VONw82u0|86^5%Z6%g3i8##MkUlj*C8}D*HJ}+9wzd>Vg_hjm8}M9u9_g z7jGaPH;O8DUER3bCZY%ZF2}<%rURB$ri0K0BTf0U&nN2zL_TJh6bLoqUD0%SN|_AV z)y=N6rzvdx04uN+(*KW{>9Z!vaFoM3*%G5@^wvFV>JK?#2s&c24HSGyxBo_NYAr4G z^41IJoVvM@1;kX;enG_#5>^8O#N=%ScCDDqEs1c+hzI2u5ne_1r~c`mtiA4|>l%H9 zQt~{06zPN)TPvS$#jzQqOHewClMjJFA79NNb82=^8*L8Y{tm|eg|=t4V9m~I(rI2s{fwWw zUb%~(-pV~qmXQg4S=@vc5r3)gM8tAJyNMq6ruSd47?ar)-vt!XQ%zyEZl2CI3ZDd@ z1XtV6t1Qkg!??O&DqUda$hf)P39DD{&dzHmlDo_NiRrpiO?R|y8KDBYK8R}2bcp$v zl2Jz!W4i^OHM{`LjBT6U**2%`xs6GA&t081e^teieNfxj7MjJYE&2zD@}a z7w0W+!}@zXmg()|TlU)&m~c{Fp=4=6Tn+!g_4-Cwl1Nae7+*+S=e67RS!2_|9f+wUGFnvx)S@^9I_5)e|`bA_f@R!iE&U+aQR4lFQ#S(R|a+WURD!JntO zVX|4ClW0a$H0P3omK)QYR`RRt?A1ke#sevYJQ~)rWr=IbO|y!WKRi6tg0mV!ZP?9+ ztqx!Xd$1}yw`#1l--qC8+hNC)mYS)7gEB$F!tuJ`Vm*c)c#$V~sJsR(;xpu`86C}K zdH1WxYK=f2_1AUy#$C%#yB>B5RX|LDF%IM0NFu3;o{VwVS7`Ac$MBpZp7nE!3#n6* z7AtGy08Px-G!v0C4*nFHu`Nu^8YQ~{Ktjni{kg6}LfTUai27!IiV__S?RaUnDF&H# z8)1QRS24w?+tgMkMux);WO)HT(O3OcUdkkAYb)>B?&d156}f~ET2}B5B?fE_W{8mq z`a6v!o#Ia5x-*uW%E|%#w@Vqb0=fBcpbsmQTv#O>@px@;O1e8PGsDkcKh>UZ5Z->W zQB2o5OD>OD4lc6-V-!tU)yT{-83#;OwUIhwBn)kBKtZp($w{|G1Hw6Gyvu9RrhfMv z7pJ{Ja%m~8re?S|?~I!5S(fm#kK)g{5IgPWpwLl!W%uH;qqFgQ)`f}`q*MhZr55l% zyt%F1TD=Upl>**OE)*-ebvm@zhUUvE#_^Bks(n#wi05lqvgR}i0E2^=i4OZvuZ z)%$dWC_s%{+kG4X;2!(4bKs6kG|gAXg)vg7lb zlv(TQvh<;4cF~|u3A_ftTtK5}F`YGFvjo;6!I~i`NQSc)v z=+Zk>8^4cd!T#ey&_LjE3!t&fRLYPq%5449k((<%)IvOlG(STN)vtQBfq$=pLvM6Q zYKnAaz|KLQRgQhwm;_HPxL>#Z^45!?Cn$c2%>(~8I^b7uR*~j!`kZzVrGGM-T>@L3 zpZt~5Tb}pcy-ad->pO}SQ*v8HGVj!UH;~zmm_%;sS{3P*K*nr(k-Tu5nC1CZgH*x? zZTUR$O#inKtp^n^T>9l9IDbYMf#R9j$gqKxNB!j5Z|tfb**kZ=+Crs6OW`h@W8Gl> zGN%1%Ok1{$50m1~UPYV6u{U|HZHvjoHg=;5dJDA; zEvPQf81%R%ZbQHxFQ?Gd`K~$RCzjlTS*}wE#IL;ZMqAc+v zuIVz{a?`;3n|I{yDyix_o}d1qTqn@)CAg4lU$#p)IW=StlP8yQNBCD#W#=DQ2l#W? zp?Ft0yUyoq0)gx?meNiYhGFb; zgI{~lyEnE@NkxBiTg3&1T9RJfVBN0-H1K+PM^)>$R6_PGeqY-%yjNkhkfOIjDpQD_mO;Z2tiE2aM;EPweLYLKLE)h?L3)54xzCs; zC#7-)EWR3er*2obd#M@0v|RF-wun=?5kD_8A{uU=#w;_a z(|mP0{@VI7JvJKJ3iM*xq1Cnu#EK@RH|-$2CZD*_D_$Q5_iP6iTP?dj;f;IDhs;26 zJ=QThCj#-n^{JK?XSu~I2-%OWF8@IX-^6e=lhB@3H_cBN<%14fVx`xoE6;*8 zpSpC&X(gYEq9G6zhoriydbGO ze+vgHVfMU#Um3mig2Lssw802UL?dF<#t$cpJU5G9CyZSjalyxd9#R{})h+W(?KI&> z{c4~7nv7@p$6X85+hQjYl`{jmzt>)Xi|hLNOOuiIB1vqkf(36S|cI0M)wmidq#N zdcnnL^-yUK3KoT&qg-^dP#%4HRQ)A;I00W21J@>eR8&-e=k$q#t8IcxA+z2JMff^N znuHP?{FS28;+FbEnmU#r&gmM^yTRAspi}%@#$B2E@REvIQ7Z?7nB3eU((M?n>?BIb zPkoDh+CBMI>_i1B3dMb&+-4~-Je3O9Ms2?_WHIcndpR7=v~0ov4sx(x4A#$6qV_Y; zk!~y6MKqEG0XcAAJUs$R3vxkC2W8)(bu~#sz|nIJz$(Md1v7SJXJjgUnByw&$#&WN z_Vf$A^-teBXOsMIe>9_H^f5Q1;xG-1*QY)q*pXvy)X*Ojp`&Fo>`-VosK)g7GvT2! zUrDNU)9hj24e@PydR|}dK_Q>UyA~Pkd834y8u*e8Dnta8nWzImLNX43GYd%Tdl=_hW+&`d{aa`X))MoBOd4dFn- zb-VV!YQhtwoy;47ew%s-WG4HJdOM50U0G4(OS@4a5AEr@jNRfirtZSI%Ayx+IX0GEI7U&5GTt7U07QSnifu>-6pb+8RU za<8@M*e5NeZEd<8HXh_(uw$SS`Q&sD^C?^cN}AWR9w-nfylJCc|LQauDa=S}%m|=Y zG$RiY@(U?1*d`Eebr@d+F>PpbVSV6Fz;uOfElc&u0!UnCYbR<9N`AjlmVRzgiD(O!B%jr{;UE2b>loXf?#%)c>+GDglr zF;E$g?o7`3ov`C3?>lHEL5b{&#c_sOQ6CsmCLOB55Ru$4qDJex1a{}ZM7&l_aiR3HU z-w6lpE0Rfp&0K^5&_1-Q>k{s{ZxmLVM)6DDpY^PSvYVc*Q@wC!OZ8h zvs|06)Wuj(@KcrBnh9p2I7~6wTnv((1-F_kuw$TX7Pn%^BG7gj^Eoq+r?N$GhiLqY z+Wk0?6ySM_^-jZ6;wyf@VH&yBbP+SKWs+rPW<_}W%<4y2w*+II^U@R+7VEnVowPYk zYB9>#u^hYam0cX57(afM68(A8dA5o|IkDOFlUg=Z{0u6J805~IleS(8eNxcRIot8d zXgzxEoheFhm+`C@6d6|3HEW82I&P?Z7B$7!k0k_f2@aLMR=-Z_>I%qK!c&QoF)+}3 zjN(XV?VS=T#6$H2HoWGr4+v}gsVzUnVJ4sq;7~)A|4H9X`UvGU;e45{`~*%5N95l> zj&duQgHefIv1^9A8Olf@pE=^XepWOo(G?jl77k{u_$ z$vp}oB0=>J*angPCvg{Nb8|&oJh3=Q1`FkJFa~~+Ht6txxDc49^k9A_(iC$P%fNXK zR*`hO7x{;CTpx_llft%SQR^;gVMC#D(7%Cp0uI1KVz2<;F(me$=M_$r631U%1$}Gh z(!*Gn!r64PC#$0SNA#OD@#%?NOl+(y6_IcM15du;+dlWGwzhjO&DpM>S`wmm3uAZW z7Uly`Y8S(XwD%P}@hlHqBu}MZ;Yb6m-)QzD<}L)d|8Oo8Myc}iokmc+J~sSla`))l zu+ZU2nVjjd6un@^#|z(%vj%Uum+G zj`9)ZzYN&CRz$A*Rf=?U&%=ox6&htir!ZYFvm;EYuv5~dYn&sO#rDUR#0}2qJ>lwh zace#y+FN)C3sP;FiQt~G1Z@zGbukQ(7SZkGnxa^& z&sv&CT2!3+H}62j-lvD_oJ&TBB014d%E}@b>o}N2ZnvmKAl|hcb0TNyOY^a>NNB;U6%@3kysAJvM07zuV9t z?*2|@W*1fFTUD1=O6f>Re;WCSYqfiDkYB|3URgOs%oh=qIkuSNXCHiqVp0MtQ1#x7 zGdZqxz#q@AP{zJV?)V!3TaF-(F512Ej?n>T7*_l+x_;fr6yewq&aW>31MV4PF>X&n z6UC@j(%6oY;&c91!qEKZ_;@eR6Cl^3OLI86-(OK4HSfPGEq!s1<%3>BTACnACe{%` zz7kiGlfA9RBq)2z3x=m(u<0dZ#=ko+IApW@=)cAIfPpKo$W1;>a` zIaqXA?E|hIxXGFBrCOF({aFHA0+E2*;hD}n)caM!MH|@+oceph_0VU9*pubCCl+|W zq38P!cw+=g@@=?YIRZP=4X7bWgTb&RcnBF8HsF&@c_qwb`(wbFIVQuc;};`#j^5{Vx*`VgQjs@GoFjMBLjO|CgaTlJt5C6r5ibr|&2FUVAq+RzPP+ zn8o6#ax5jc(LOrlYEc%6s;&QjImeJ1Nj;uTt0eJ9d=C zJg3iWC+9*D^#0x91Jv<5zB{Lm7V04Cfi-Sb^`W@O;a*{zAxb206@!6m^zbn3-M#C< zVu_5LJR~qD&tqqVLo5!3cJf>Q+V{ss0m6*!7>B4m%1X+3Iw#>1)m4M%<6xMs1opIh z(Qe!z(|eBi0w$4Gqc7sqwPAz@ovb#w0iZ!xkQlR!+K1M!!y{0{QWc1dG>)JDI5&a zfcGvzOEzYX2`%|{8i zj>s%!?6C!m;`QQS#nD<#CAw6}Cbk(LMr!M*FlreCI;y@|;<`MZzKxq13GVPt_0H!2O$A8~?Ly18Pq4jtolyt~16u#M`> z(rKB1_```7d)q}3FseP6m24Bi655AO+|3WufHxFd+?j{fbmL*G69v-0Yz{`=q!g;i9I(LD_4 zr#=@FadoV@%Dz*gmYas>uwb&+(wtSgNG(J6(Fv=^*#z6CIz6X0V$$y zIBSe_L$-Q9V!Smd)#N8-yc#U7v1M+5=Nlt=F9b#k-2fgwo9_Jg*RhX}r3!lP?tXQm zZtl|jw(vr%`=b!?f)LZ2XR`Z8^w2<9oq77uWMbwje_xXv6nroCVAsjj=HT;xV^SZU z&TiPI99X|eQgSFFIamlTi7MYf@eR43*v%RC8dvE)P9b1Z@Y6;IL`erCjFi7>q$EJ_ ziy9uTP~5pBs1oal)M=f1-<4Ze7d}6a@9!@Z8>XS0M6MWv5O6F=S+PF`3`8Z$xg|Sz z4B;lXnWE6ZA=}*?tadGOrpW*Nx++%Nr>6=&IaJVO|C0&{3JO-rNeLvUChL_YpoDLB zJlO3g07re)smihIqpMhSF15hL56>ldu~+x(RdQUFezWvjYu@Z}&~-uJ?HkJAYXQkS z0oxgm7t_8@n-63C;hy+E|IqM(4ypwVZKsrlMFY)xH@)P;pKO92@rkl)cB>2lR!2t- zX|aToLWeON;&Dj)8b5Y!iaN?%Xy=&?VQ~-khNUgOeUBKRB*ij{S7~vl7d4Qu5POQ1 zrZF+m%_no7j4il1K-8^j@N~^}+9#bafgM;nv z0cN7HMvwJyub{0>8XX;7RiA8<40X@2*zMMDnIXp$3|M@8Yk>savp3b^^>9jIH#^#& zsC+c45KX$-+VLcGXWZee&gRYOA5dUtt|s zngX_nmwQ%qm0&5a!Zs;l4#x(KC}7pZTh@W4hAy4lcxV|DpJC0JJe4tfwhK@BKydY$ z%}6xs6a7PykED62i1rtJdJJ!5>nyTvgq#69+2pilLhlRhYMPY-H+z3z6e zLgbWFkFMSi#w({h!R`6Bkb7@v=;>!V8H#w&)|$yX(l2Motva^Lo0PYak8Iz137jCU z_B(%;7(r4ZE4s#AvAr<)$bRyN3ztgL$$E#jb&WXQ>mbEC7&`keQy_M(HdCk8^7y2(CZS7dC-3ce36Mi-8mj1G82`1 zj{vF^$|`uxLN6IPse%Fn|ET?BU`5X%jNaY3B4XJ&Ae9m%-5Y+#s8`Kem@+)CZc5P)a-l} zvx2+-dX@Cq$^bEsd?pQv{rYe@;Kvvp3*u?MtoDpbd4r}!svs~Q7@dB}Z-U0Te_rc} zTDdq>;bJJz6||`>UAGM$M`qD>5ZYnz`uSp`@t=-fyTh&n*7?@$l zUwq6+kyZW9oaND|`W?q-9ii?upcC*;g)rfh+bysa+I^@Wjw-kYUWV8B2JDTiZ;c+- z`(`}?4)WlCBD8EjB;^+d|CBK1l4|nM z5^O%bx}-o28}}{Z7Y<_NVc=%sSn%%5dF0~KLl3Q6>6+0B`yDfT7-rH527?B^hh?8^ z%X;dUOsD0o2lh7zXm8HvS%z&5Ppx!IgWYyrr>?zp+}trt7aXd8$_Vkjd7}~1bo-yk z2oWzP_ODEn-9S&n;%`)75P zm49XTGt9!DIVXc~h5IRmEWQulc>$i^MOrpH3pCkm?@qsXlns%%EMO zYj%{!P+1X85t8-YU=HP(>v;&2p6pDVa>9W5H>M!0Bfz0U@6on>S!ffG1`D)AykxfiMoo&6F zf;io74hmjQdQVOlf?1wf24S4p#8TFF6l1;fW^#b#RB6`y#47^y7B6ztc#z@^O+yh` zHk^S1quP43acdwrqDm^1?$}5~eSB&_E!22eU+4F@?|FVPaX9N?7k174q?4w<{)(mH z+8$(h*B6E8u-|BQCr#+>i-JP~!@r)d-Mbqu!&tR0yTqc&uYR+BS zmI%dv`)Bl%*X&@Wg_J;i*vTxey(ihsTkcPvis!9xvd}5NJoYUH1+RA+zWa*1Fs{}I zHr#Z9%5>04q=_^{y@UjT5y)+xCb{Nq0dATls*}@_RJsfVWHOMaq5}?uwS9I&*Fk1vEjDa7i;WjM!NB)=jn#t?LBQP5TuXerJgRW|wH@|A_Z zY{EdKRuw&gUAh_XO+opeDcU~Jd-72uF16DKCjUhaPR7*C$VHasORC<-pj~?YP+ZF==NkqNHJ%* zQ(nS{@Ys7Kr<*;kkb|F;1T&5t>-Viuyrh(QWMc)$9BsJf_`VKL=yk@V4B%Zn`#7ti zo6=<^;fqt0Eu4zwzr#_kS66G!Zi7{@nwo?BK0nTMGbhE`aMeWczzy0lH6>!;%r$2GG%q&(MLZ zDLfo}y}p0Pkt9=$cBLrm%&vD(utta|ck=`|zIfEJCQ4E3UwD1`?EgznP*vMj`Fg9a z;TmWmKh>h%!qL4g$>J+>UPJ}i7i>kZ1rMy{0)T{>^5uTL>F#Mj>V z>Em+iYgV06MMFbAl|HBLVEr0fkH=T`E3_G>q=psg$@s|2he<{JvbZ`?F1hmEH8G}^ z1HLQ1!q4Xt+ll=@oxfAZel(01Xxl}oXx?Mzx8Fl$5fApA?slRstu9pcgs-)mLmw77 zW(pv34A02S7U+F%?8CdA<%v+~f5_3e7S4!?9hos(3@y)rd6s*S*9)&WthZ0KtN)?T zQ=~YY`PhboFTX~)6a!rw?p;s5m&R|cBm@86RrWAWKTNa9ZX z+1j1%_Cx5@@c{M&C=v;N$G$A?o>hF%ozsRrafrHd)_dmUEBKtA5&apqRd2)@!)u?d zA=~wN+vB1JZEq!-i%R4#^@c&Et|tX)$J($%c^1GK6BqZ{a>%CJeW}Km_mck`(mZ=z z0^EqJLY(qsMF0?jKvWy}N4IVpmM`qL{xdZ6e^EqI*u=mnVla-P4g3Y9Gb##-5U`Hs z>VIXn`66M>?=Eo0n0lYBHu|z6ysN6G$7L8Asw-y5Qk9r8cd7!`QT8uI%C_HR2q@ z8jMB&Ut=Aq_tlW%`!*u}dNJ~QY>h6o&m9)&I)nsqdtYbA#;7b(Nj$ZpQCcZ(IB2GK z-_j}CEo?^87M{gA8uZ?7bM!dZq!s3}wHj&{p)I}%I~fBRRV*%{G!X+fV|VS& zZu}HwLrY!Z(F2pt{x~FFtQt!x;QtGRIIz7}I5H?c7va)_VMn>~N>_#9quty%c%X(r z%9(4f%LGTvT%)riSE2dy{<|W)d-8asYOl?^r&TU{JqoackTJ=8X+c}}4Q{5v5vA0F z)HxSSG@G|@=#+u}k; zU5y_xCHGl&`j-v2z@+g%TKjR5p_+F!hDG@deIR4V*;#OP#eBwkLsOu@@#ppx8SmN<<&VPDq%t>6v zaNMQYagv3^m#Jq>Ra<*#rsFdTk>LeY#p-uKkX6A9&v)6H<85+pa~5!vNP#?!Je3&e z)yS-E%d7^HY(V`9y37P6Z65MjAy#fXUtmO2Xr;HAvCUxEz1Uz6By={q!Zmiptxo#`Cu$h%A!^GWr8lu$usr45U(XKT4hL4Lk8Gat`H;$zACv4S z8Ma58!DuN?|G4Z0(325=1@TIa2n_NkPYT3c|PKB9nU!`l0}bZ-udU= zkVC47vdgi5i4cjHTGUkT8RVTs3T=veAWvEbsVvHO5B2=C+H=3TFX? z*F9y-o10hgLJ?4Oiq)>jnjJ+qnruGErig>ot3)MQsd>99m0vnssW}fD+;PG-4E0&@ z8@tFJH%$g{@%{&neF{aSdHIBzhP965Vo&z%p05QRdF4HnHJ+nE90UM!atu6|$ehW^ zMkaU$!c9KvQpTCNKHa_tAMQ5;=f29>`d>xFL=O;_HttqcNu{b=*I3 zwXNmWp7P%GB{trh6YHfYAXQXWT1=O}Q6@F;GKuqRf8$s=P_cX5pxeGdggQ+31!WqEueA9yXI=}8ih za0UHNLbf@rl<*w=pq0@W3E3n2E*E3!fX72xYspt*-p>oD8p*fkMW9mrYmN)jLW(?2 zJtR-xvDE6w4QAL8g)1JB9*Hw5+_MwinTE8yp=A0HfY?QJ=1=b`chERFVJICLExzn+p$AVh+`~S z!lYNo%sTMx6yWqDY$KT@O}{D7TU)=I7|&DcB;?43Z4`|Az;CP0B=}+n1{+=k)$*Ta zcV8eF5gi`-eqIiZz3i0tk$(Ihi9{HG?VV>qH~lV4=nY zJh_UAcw7KS-)bnH<;1iWNX|?EmP-1+?4`FKKHyI9zBh1@iy}rfV$V)ps9cS!9!ZG8 zJ}r@DF~x(Z4rT^{kqTRse^PXTFd5ZnFEkLIDgdCBaHu)$v699QgW#*HHotxS>$PU1 zNwX9Qo_2+YEkCXc7YdQQW=4^Riz2LZ08Y%!%_W_ga)f*&MvOvebjaoz77PYI3DxLv zZ-2I}MFR8m)O!`y_!A1j>$g`#^gWE2r8uQ)3-Hkyq;()PrqTBdxH^;rEEU0OEiJBg z%dM%G``2eT&;{^J1VlVbPs%_;)%0*?Vc@kkMwe)<5uI?u@AvWRkesj$3C|jrQ7RXh zJ#4of`*R)pAL~XqjgyyqrL@E|F)xw4jp!Ron_ZhRf3`C24Rgaep$#w@#ifuOIOq;z z150Ed9JsG$J@`|gd{aU-8P{#c+kiYNu*WqR+nES;LVlp|!q$=eYsL;y&Eh+5G!p~J zFvjP{6{7WKj}4m^1#^4=LZQ9gRp!{ftbC>i^%IlzeGuceoQ8cGS5$36HsdA^J<@#j zkGu0Heuo>c{HCUGFeymk$QiUXs(tt`bN0tWz@qz3Yu*V+3LHTDNHG3Y`|E7>UK*N( zJsQ;?v$L=@);T7({3tEveEkxkpUcq*4^%jaTID){&|X?$atL*D>H4%j z6|{a~dT%)EzpzrW8{{!F^ntGboRW`#A$TC|`C&W0+GdIYH%gI}%beMk9RlJ=J=Y!2 zq0C{HnpKF%q)yS7LT`xgcsO zPT~615zP`X^xz+DO+uin^PWk>`1PDpnh*5fe_8c6WAW_UN$P~XF0F8q1>Fb~6k>ko znb%bycUMuia_PCSf;1fmwK|p8xRM{ert58U;rbAQL3VYPbzE-l#EC{{TFo`klLY0f z6bdSord7J5O7(ep)ssO-CO^0xIB8(K-$}%LLz4;oJ>f>a(Cv{ov zo?FBsN`DAtr;?FPwGL0>P%*>IY&7pvZe{yU-@+~%*+D1j&mSNGt&uF1q7(}rd4%gV zL6xwB?&QQWOv|7C4!=M6wPHh;z?mOs_NxnjN=hr@ncO`K10(1pGJA|hF^vfc&E%dF zdFo87B?*YOd3#Y-XC))<&c&IXC+3KDf@wuGjl9`s#=uM!2yt@v_Lw4(W>6u6=WuY9TJplu!ZUCrw{?x z!#WoKg#5?bkWTri4rv>q{`~PwX{rX8J~wFm=Zi`Jal)}eFB&jn9-W-*)YLZY#gYF_ z*n(+0zrqUW+0nhI$oaBPV2VlyL?>(Ii0U)oJ7Xp}5TBnX1v1T3oD5>HVyNo9W~~Zr zfgXj`2lc7F7v;G!;L+4_DB}xMMtNyb+l`Kxlyn1>B?S!v`>CGOPk$wHYdn}^CEx`1 zBjbM*>&Qc30I!Im+BnT39UoQbrS1ZUxX@3vf%}3rU6i|~pMl0QbAM5S!|SLM->Dh? zqA3{ifr&CDDCZ-`;kU^`dgQ3OT0ejtF%hQz`?br@Uc!5zmhc8h%W&w1nd9_EGw@au0Wl=D*<#FOHuGGGL2j!Do0(WJ#B$G7{P<*7 zd1YYqYb>-^pL_BDfIcqBKd|O~-c|4BBBDIsw~>1dAs=`oR$!#237dG4H%?9!_}@eK zVq#zAvx&yw#zP`8ymD7n471L{LrnFh8e11E!qQq{sk9zi_cHgo1U*Nd3Gt!9&Z=69e>Q_J-3jt>&=C}U6*?0pD zoF>WT+hL;9Z~@kMnml-CcLEM_iK0t-(UE8$KSo8SR#R)V51F-2tfG|ic+4Vil6Qgq zn?T)K)*p@QV@Idb+5S^-0pE)>OV1(n9ULU&sA1HsEX%x3d}|--9hQ0kHmbPZ<20b+ z)v{Pub|u<_KC7T4sB-L?Xag-jr%?&de4`o9!p||iv7EEB@CUE68*2QgHS)W z^FJ-Ifr>99gFBFgK(TKdRuB;GRE=}G+@+^lQMOhe06l;(Ll@TF-CFH6@LKk6?S5Jt zt*D&{bR|(TL>ChRIH8wRwfWwpFe}T`w}}BUEb#u=fSSKc`3n7R<(Rf}8Re!t2e!S- ziB*Ql#7dU|h@GcUs+D*P&0TymU&#f_3`#aO48Qw@)Vtlfd9!&$cKJ)!sAO~QwU+6= zDHZB*473E$cn_Gg#UbU|N_d@2Lx5M$yiW|<#X*xj`7597v3b;EL^ zBT#rM!4QkVt<~n+**$jz!MJE^hNk0ojEAS|vPVPto%rg<<7V7Oi(pI~tQ+=${6u70 z@uaWkf4A+QZXiXoRVGON=B2F3E`~E}>(Qxaah~6U_w&d&Df~Jl{@9<0jj(u%CaaiC zFekqIro?#Vj2Zd^F_y+uH8kSNmyC2A$h81lfXuuz^nDJSzHCz^dNeaA{S$8x+Mi7@ z99SJ-8Rc}Fhoadry{rFSpkMhzIM_pY!uUA$O*3r8*YR){kKk? z4daZFZ~RIR{S)S|@LZ*A36N$6yXG)a%6wO$Jba~C8We7*`$LbEBKCqU3_B3dc==xC zI_5%b+B#0j_|~{&uVcX*9Jf{%rR=Usj-4)<6%K8H>KP}6UeO{(_g%MNGmr1`hT}Zz zXcp9$-3~cYu4Vi3?`bh%z$pX-D&%JEJfM4puF*zeUoQY>!sqi$Mz5Q-%j%*T#6OGY zs9?633_ion`t9DuySB!ExsMsf++0KjB^ zv#_95(ijJJ!OW{pbWBl&Tc7@6u8lfk!8k~=c6JvEO<=x%Cl$It9-yjrA<@;FUuZ@BE151c8vRyF*?9i$T z@yExff`~WDZ1iT#V=ux8pdaX_S>ldFOAvNCle3m(tUNzCA2nGeuEg?Rpb~qzenu7L zib5Rf2!trK!qIk^)DLXk3^``6KHUqz_H&yz7R$NR)w%c45-oVR_qv}fiPz?|{gRr1 zmIr_AyF%>}bT6)`$So;RxHeOZIa3`pF_ECfp0BkMFeSDohv0bTs2H5k#)NHsTdE8y z4f#<($T|q*{gVQYtdYr*OD`jFkA!l#w|E!V*Qfi&5^@0nN{|Jd$T+1{b;Sz)UG@`p zUQ;pA5!wV!fb%%XrxKG9mx#2`?WM3PHFXcyskb8pJT)Nh7dqexEnNGwmTep-25NDf zYcNYnhoBx1Er`s8Aw5|Z@iy{a{CK+?xysZnov$2yr&j8vqn1||W_sEB=MSl24|?gW z+A51Eir}l*ib5a=)k}&n zaq=;;1f8nE4^cCVS7YJ6^Ko%ptw&^~DY&^=Pqb1cC4-_c{YP0@gz>|=Dk9=p-?sy5 z&xgX}!$wP7tgPoZwBd}AmHn1z00G#BkLrz1`_!&lI-`_bU$3?NumuHUv%L$K*Oxx6 zmFB4>szF50f;{>9l=^8-WD?19YWihY_S9Lh6%}|iUrvxqTw>O5ZT$TS5(jx$TSsSM z;sN)}?N23!B0Oqw@O!IJ0*WpKRxo^SInWsvb;YUA>f>B@)GHz#q;GnDx_mfv9QmrK zC)`&ajMjomoYo6(#c{$HfF9Z$6$drdMeMj=N)$cqy)wmVXarObJKsQ%{SU%ZN~5S3 zrlXgl#cItpFP{k~^TZG1OB<(s&xG@n^71m>bj~f-8(Z%|zPemK;xRaT8{|!ap7Nhn zO!rf9o=Yyo@#|6*jF(wdgITXm3bSV$AT7UqJ>Vok&li)-%pT`$=B(9G(-foQ}KvxQup74KXn9h99iAS$0WTcx+3~h8mYs_ z$5(;ROaGU!P$-7yUXnAcsKDb2=#85md9$6zR}Aw*V+}upwZl z*C(wrsuS1nerZ%C?2LbKOPQDD-@qEvLPODkZ8^E`W>h}P(O6;eTUwSH-AOt%f&E|NRzkMZO>3)&v z9)C<5b&Od*9rdZ)Z*HV%3=1iz0PeroQc3jShvl;rJYbsSQjo61`A`?|XiEW_rsb7G z8p!(}HXxV&|M%|Ad7u(>0I>P83Ni_%_$P;rz^B`tS5K*H%|y9>g6&%# zHaTo(>+KtkFPTQtIML&20WWz_a!i4hxe)X8`&B6L}4TylI-?qp#53k1PZDgxN zbpXq99F8+t)f^EOEupmn4DriFBVacW$BnYd>UN;L^76{=3wWHd2BrAmQ4sQUVh@&M z*E#yB2XcfPdg#yJ()J45vH1s5Z7`16M5? zU7XQ%ww@;oE8@EUexL;D*W@>b_m5qPGm8XL-Ch5~6k$hw74fpT_owY?6PT1GUc3L> zeu2+>59%wOkA3gO@srmFoPMoC5ZCVdI6H(__8k7?RZCrGQ$hkBb zee0J=-}5Pkv^cHd4-4B$R(mQoy`^J~llaU(5XCSc%|sEw{_B@}pPX|(wW6#SGW3gX zEonMmS*{(dQiFURY4N@@-B!wq(`e4BMR`qtBNWoc%kR>Bifb@s2nKX+HUGUg{rDpXG!Hm6b8t~I zJ73beOmFRfsLQ?m(p!uOWh}X3J}`92t-(#^F2_r$Ium z05DUxkU>VO)BHF(lS-Q!jW5ODUaJ>;hZ5|xN(UHt+^r9r^7kUOUPxaoNPeol4B4ZL zfBot^|6UU#yWmk(uJ?3N#OQsqW-p8N_N}8lYI5Hh8VSj~A3-t!{=o37<$8Tb|2S|f z!$;y>?pNugjSfNJ>I#>&F!|KFpe>73HfiBtv=NTr%MSwi_|RPc^!mf(KKIv(2y1Jw z48VsH0q{!E*&%`e2@fn-sT~iWlmtyMv$vC+amhB$y(zsuqJb(m08-Ak6@ckB_;=Kj z<)n&ZL#kk!0T=P5Z;B5PeV?nsG*NB*b#vRfkASfXjIduYs0?9%`sC|j#^s@aJ@B7s zIP#o`f@i3${$YDNE1)3Lb-oiEeG7;G$<}rq$nCHY=XVT4#0<&v?|^afq{1^xN?MvC zTRXe2*BOu&deoKeHN@X;{?$QuSiKj8RnQ6{VopNRdaC zurk7eq|qU+2QzbcVcEm9I?#yRY=T#lwi`4RZU!@NY(`Kbz}s>Ef3R_%o z#voiTHKc=FKNzx-L#ERIdBWRTD9UV!Kg$YMMnqd@h~91}9kn>3skE;uPw;{g!0XUf zd99DbXqD$m2^AzjXTH}JZPJ;*#-emTWG)hmEVEc_BW-nZ&RB(G6pj}HQ(&!YNE*; zyv8M%Q9Cem)vP4KF9;$BYm6v7?UCTY3DSJlH!tY*tm& z)%!q)Gz_FSo9Or-4ASr4W8^$t08jsXsQtF7nDk1(nN-H*z9)dzlW~1eZ-AL%Sba@` zQSDqC_p8<(X@d7=={Wo2LOtaGNwlLbLmW?UcNovjmH-EJR{d{vV?2~Zsjf9}IR?0U zf&CoPLSBoEL^S&m3_SmK1{$7u<{}?5M}dQww7=;)Teq|qY}ZHA1zq5;gD{FaW0oWl zlvYHz@PLzF-Y{!kHrx460zPVp1mflU$$_6} z5mowo#RavlZyQoIR!@lu)?k^H#gk0<(L(?u2$+T86op*zvpr|F1f^SdKd{{Vl^L&@R$sYe&+nT;4KNnb5s(`Boks2*M?2XXDo8 z$dZR>dIvcajvU{%6a*{Ux2RlUB$h(gPO`7R_k(X0C0#M^6Ql8`#gMaRK*DH0&(e1N zLn6N>cw3_-L%;xs2v*^lcS~<2_PpgwB!hVRovH4?r5JCLyiF_A^*GtFiK$C#o+!q&Vg&_`v3?%F8bbJQV z)K2|g#q%9=1|+TfeEih|%HPnYj;^L_aL<(0TRUlo~C zZ-utWhfg6?;n1YxR>L%6rVxE_#n)Wx2L1W&ZvVHTdGlKSu;AK}SsVLbo8TUh^M2** z9=;g^h4=3%n9o}tM8tbI`?pq@MKk$|4#iusDSa==ufra3&6bzC|+Hf{F`I{ zU+4$mx&0)^vNdxKFw|r(_h>PsD}Eh(1zl#hMAAzE2C#5oHTMQKQ0NPFn>OxKk2{(L z(Sp=we(C1)8AL+7dmuUU9o;`p4;JE&9rWgSgS|W6qT!xcAf*X+Ta%1L$dGsQ7X(On zZl@}j|4jc{xZReRskT-p^7q#Td(can^kVdWytw^b&~G<}Ax7GQ*i!`(x2a@~egnrn zxpjhKAvR77NfEKd_?tiUGla&s(VXrN_jh(le&pubX!J&$Z4iLh2QYzB;!mfwO^;XZ zjT6G~2=kZ5U#sqU zCh>tg23fD%uRs#|X`O&AZY2RIk zX@-TYUiS>!KmsNSVNZk#M-rZ!v3zdi(QeW6>>Nk>9_i;Tk_=yUg82 zII^mn$Yz@mKdfOXn-ae^@N~O0p)tALT@ykLd-~?Q5^rx6J#;AJhD3J53e_<>rnUD@XAc*xbEKX5j6j0j>$ z=5UD1eejxP5{MQ$<0xGWT3XTt>9k@!N^bA40mkAb92dcbV!@EuPYAYX^P-``4kZj5 z&hPnc!Tz2Z80uvk_C?NH;2Wsg-US3y=&-z|6UxF+$6s5!#Y^K%oVf^qg6pyZ*~Vt1 z!ps28OaP4Iw5+IW9)-O4m}gaqDLh~TE{`80x&)dr=D7Y##9=x&#ewRU|(N>yclWhb`??JZ(m;O;fb7K{RZl=C1P@OG0J znz139Ika?|F4P-MS1i?z%#*u7FCvGJh+Z2+C>3mW zhW~mQs1aPbiYi~)k&rT1fv_A7g_JCa8igmU7iLldaBii@wPHB*XXsd;rihPnKsz7w^QkB^nKK=IkD`i9#i?xtOcHf8!{hzu-#V-E-xMLE7iFS`Dd(#|)>2 zut{wm5~I_0jRZUqOG}4Uk+89s>dq;B%vv1cf>KU8zc>APHR!IXVq~@bA22|9D}ISW zk-`@p>EZog=lgPN*lj@3rRw}Eto#ZPe}UlQaGT~IdY_C+FZ{I}T(Qx^UMHX^^}nsR zKLke69-{HwKTe$5Pl#@RDJXcdCHrQvEur|o3yqsx(0s2Bs1x4O%u5%Oufcw-_VuJv z7H^tpu+BwvI*E5AWm$uD%85JSM1S#zgN^^?YoH^Cba9s6K&f)fXDZs)*`-1{evsND zn_V!Gi0^UBKRpLZ;Bmip;~X=^B3#V!U9Koad_M(+>*w&&T-;`CQ{@qCa3>pn z9M4aEzjxSj6m`=+<+`;IM@Q5h&&kuXOTTD|j;oQM>T6)UY%k=3%qVfzGQhgVMy$ObI5=&ySfeQA({^bjj}L zTSnDIXfV0c2OZxXLH7Qi{p!kf=OY0XJ?B4J138~m>j&~`UB7lbKMJiBTK9Px5N!&t zV^gv_D$jM&cEn0X-2i&UND}iDz@(>KN(NE)63+z#${h(WaX>{K<*qgNG^DFRQ zuXKcERlti0da7s zgmnO&r`zHwmsD?Ya+(Wz&noZ%(5I4h^2+)lLrD_-+B**$DlZT91bHG+V>(tE%*@zD zYlm*-8}S0^`6 zGQU&mL@i>+Ja|PONo{R`j=L$djdT9OsJQ6ySD!;BkBH;ZVOA!pO+aLCaL&O0a!F8$ zvIn~|g45v_2}nE?mf3RJ`H`YWsLRADN7riI`aE}Yn@p*InPr)=Sll*!!Eq2LW>`eD z2_49m#4h@slY)L|esw$DgA{NxmGqgXw?U#a}V zDP;vsuJ`^#rQB^sYV_VjrjIYdVG)p0PEPjCXf;KDSp5$Fw<~d0v~J zVJ`*^DH`1J6pAB`#5TP_M6!pd!>h%yr}rxgG(ISZ{6#SKGTOQMExN~a79kUJ9I5ZM z5t#WX5rI6ew(=Ro%R%6sgq4MUGa}5n{yis{0{sI2a~^QHLOq3#AEM*Um&Fn1ShUu} zwZD(p-O_#KkGslc-X~o{Z&R{4+xb;&nmRU9tagt_cKu|k3ZFxWYu>Cop!rJlu#=thGgCmOI1K0h6IoQNuKGjXON#lx3ve2(*_luE9_(u@+SvZz1< zdcm*2-ZB*EJ1?)m{`i1$f*DHl+Q8BavJlPKRQF=7iQGN!v_hBnPf)6nv4sU$nwOVK zMI7D*D#NDB>20?!hX^9C@Vr76hraxP@xzJLi4RDGpC}Ggh22%uB0cl93oQuNK%(qLdfa zYHWcM3JcbDBTfswA$MI&YOXraZhGsz@g33EuV!W@3cjulSiORGXz zRro1vL_Y@aN2!U;l{7>9R<#xESK!T<(IxT;b4dncmqBPVhg_H3<5idhO=hN7)9BGe zac20ErM*N$zo26!FX0kjzUZQO%H{Ow^Anfc22_#S0THA4H9k*GUCKncSkM zD-EORXu(1qA3Mb`05)mJwz#JVaJhI`Bk?{a1PR?vQhm>i~|Jdh?g z2|I+z!`}GMj(8dp4RXK0a#o%^_*P9bxSc|)u_*`O!D#y)3#1HGhj;Nh86&A56^Y$F za+{|MyM4gis;5R#>(_k$$Y&3Me)C^;d7)erqlMO|gT~^3FJn}c=}{H;O!6xQE}v2K zgri2_z=7IH9lVnG(;H|e=Mb|HErA>XJvXlC*}%D8 zUUU}?zYW2v1){`DA=Vv%ab=Z*9oIf#PPD;{7wPTT-FmXtZ~^Q_+6FNG8819kQ>kH>3tS zj7#db8Pb#wAw$;Jq}Ib43KkL-*R^BMYBDZDOJ+2Qafa zsP>^}2%~clKaBpw>S=lPbcv6YO9|>eS-q~-=`I-9%TCpL;d}~3OenhqwWaxZu_^qG zCp-U|L$Axt23K1wFOl9-9Bcvd1U*xd7CnMwAhhkfDleYYOYt!1;CcNfUD~wg)R1w& zB@Q%1JBH8V6NuI|$Jt%cOO0|(N5KM*PaDIus(S^=02q{ve7SzNRq<*LJ5RZoS&;qB z6Cb2tY7a27gtS>^dVCV!RtMzSBWc3cBScsE#PtheEJewKic-7 z-+%M9hZiG17oY+HdCN~kK}YwIxb~z*gt%5Ay+Z!OM)BOPqDEVVP=>G;uuhi>GqYO- zDHo6Knzy4x7MufM87vp`H)U^h$2>`uQBhNehqz)n=Ix%3a`M#Jq*(1w^v`yIfgGhk z`P~XpVKPR{f;h@27_``JJLml%OpEF2+Th7qW@7qtmLwL%qfB`g)|WHa<9B>13sf2* zG6TFHArL4t2grzgcI~Wz9t}U{>;9cp^mv!C@>axF+N$17sleCI5A!E;hBTz28+ZH- zs^kjOgdbACkoE@RK>QFjF_9lfGO%;!QzsAT)0ApAaQdO4rcZe~1c!G-$-t%C(v}MY z+{eRr#FEo_6o#h5%s}^n>>qI7F@?N<2g>4mCkvE^M#PXq35*w<3!X>aY11luNJ!}R z^YCj_M>cWQM76=sMNH}2ner(XE{W$C4~q@7Cm{Sl0xk(W&g(-ZnT3X%L9Rsr@RzXO zTYNh1DOc;0D!ArFXbMp&Z~Ds&ipt-T;hUs-32LM8E|j-73(TZlATCgzDDJ}-B=ZSM z$ZA_{(kR+~Y8Xemd4Ka!+4+a_s#`64S?ExBJqj)wdHjtwjpTEluo38p$ngT;1KNs@ zBj)QHC9WnD+_xXvq~=J%RJ94|l|6+Ibbv8-dX%#b^J^ZfD2X9DN$7IbGNSTglb4fJ(<&%i;W+^_gF{*mugOI`d znQxhx!HR0>+NiSWzwrk7!FBDcs-SvFS~16Mfe>8L@I;oB6o_Y(+iZ+(bFqjo_2-ZV zlDm0vGF_r2=SQv#Z!dQoLD^**8pE$&69&z0!~jMO(Gs{V@H0Zk@9W>~E!<*MKvxR? zYB$j`c<6*QvI6Vu9~<)A_HsHes$X0lC`HJV=)a zJHDpo%$As|wLzp)QaJXL5a@qeT`zH7UN70<&c1CMf2@cpE9xxYw)G7M@6D%rU)DCF zgaz6y$&KOlpWE>7I9Q$TzwgPBB_FE+2WcWEfotG;;mNkw&Jx(jl&W5ZTi*+@we%NA+Uw-ee(tSmZHi+8|Y8nd#A1s#$0#9~WMjw;S_R{%Ut}RAI0mbZ0u+ zQA!(Oh(N!cqx&uW8c6E-uv#YlDV&1drqVB-KvN?QFzAHtqF;gPKvr8Pr}!Tt3papm zI=ytEyfJ%WW~Vu!r3Ei6$Z6f-rgHwrste=o^7#WQ7d#h{*ZS%$BI-c)_}|CR23c(# z9nl94RW_|R^H{;>7sAK(a{iqXH8c?Bk5@Blk^4gGEJRQk!`OAgVV^;&e<*na?HWG) z*|QU1d9Fn@C4Ka|qq)6~xK_+h+ zeM7bGY>-|;ZtdsMGIhp?UorIddMHavE|~t^98?WxJv)M_uz||@MCmugKhv~jo*+AS zW&Q+;7Jb~!ZDO|j_N8Im3Gg|3I%_Q2?(@Kj>EE7jcY7dGHE<zbTu1a+k>AXXri=Pmj2lzCUf=w`^h@oJdXo_)gB#Mjiv3m|@UzwrIpj6+9? z`r|j&cr+lY8$>E_Aq4wNcEV)C8bNWt?w? z)r*OxGNbBD{Sr@?S)XuSU0rshL$JkER|+|Kz3*vv?f&fXRl0*%$^+a3B#y1KZW19H zyL~MDjETp>G(KKm9Y0uj5Zn+t8FI{B1iK@t4~mM5JCFxDX*R(NKFr`;rmP2mByW7c zV(!GnVID0VTtR$AdG_DjZLMS)|3orNYNF%!uXk9ue{%uINe6?e%!(!^{GrcV1PZyt zKR)t#YCOi8P-ML^N+ENxAnQ7!?{#kf%Hi*35_$)7*7zE?IXicg4=+V=&$np)d9o91 zrzz90)=3=nrarOh(*u#xc9W;tKN+)a;*~9dYh=Z{jlsVIh#2QHbgY_#RJ*S87`JZ( z>dg4oUxL+ZUKSIvQE~u2%Q7GjRQsNi6>2)?X;oUWipl}V24w_WVfsAS8gP!zjsF|% z@^wd3_TP(F9AP=5DwbSJ6P^tT$Da=A;?341j;EbR1ELerW4?0g{%FXja`He3) z%|3aL@Z5TPbyVR2Fl3m;j&Kn0E8v;#&gJ1X7@Cnrr=olrfNLQKJiP$6Akv)D;fI=FnhCR@mi691eB0p;&6@DpEd01V}I3!e4aw z>Q@#d)@`lE$~9yz*H8z*`!V0h)mwC5G_AlZuc40u%S3B#O5%b-r9X<4CUr2<)und! zZgXos8zBWw)T*tAl*Fpr9|&?62PvOr0EITO!go1m+B0)~faViF>8240wd~XKNak3Z zbYGF(K-67@jMBgz|KnX~n(()Tv8HVanS*rqOO?zv1evSREA%#6g#Q7STpaoftYb}P zKRtqk&iE&p$C&XXbbV2vjog1z+4{o9v@fE*mEGtro_ySVJto;-**$62L&XVYT#UN$Ry_>6&25trzJaoi}bIT1^b6*Yqtb3PY* zuPI?h11du6!DMgn*{7~jNG;@9;!5^Zi$U|g04Q%FK09;k@TL%Wt)=wa)iWO@JkD|a zhATie7EKtM+p4)M|Qv8_Sfqq*YL33srBqV zDY2Kg@SZb~@=A>k3AY1PZJGC7{U?x$dkv+D)ppT~UM*q+LN3{^*B5?`Jy${SwGso? zi0g9saAEsbeghMW4Q={bR{NdYV!^PC8;NyJDK^>fSG-VfI>0T!a-}c3jsSB-_|IHV zEcron;R@~#m@Tp@zcz-Cj?&Mb&(gXs zMz|XSpal}ip+}y=7;8Zrl}r~#wLg$vz@w<8=<%r+AQFLcFBNdwO%D#pFd#W$_{IJn ze>luW*Xhi=9+6o60Hi3(a3c_d4T2>1U&zYNvINXU~x|qsw-^(k{pq z*nrw0Mt3!a2!%3%=Wa^}ZI2YzgBg9>sD6^+Ct{QBStJ^NU{QPe+0>f0s%kwv^@GEvbJf(xWfU+8U$V+57i^yG?7Z#vliayeTIcipTK zmRN@S0L+J4p}PH^I4^;*csM}e680`pKO)i?g#R0-JUslc+kRgPfHyorN`w`Rgt9>i z#K6!E*?c|S^vpS5tiwy6E_Gd1^jQes|Ctbpm1wA^ij zaF|d7kJnOaG^7=j&=p2ag4_|ML%zHJUY@#OiOAf-(Ds&RPeDaR61Wxj`5il2U!G9_ z@u?NC-2T?1um$^rFG{%&pC95K6+IX<5T2ee3Bhm;;u-GvmtvUN!)(lkRO6zb~)}2tsGkX%5WxU2C4Glk9CpcrU469Xib-{a$(QntFM1usRC@(fS&SzSTJ_;Q!@-L9(6q6*24}e{@FRjF z{+|h(DL{8f1t(90nLH7oA`b!&TqZx`VG-MZNfEiNMX~d%yPWH+h(cm&%hdj7Oih9r zNInTlLfn_28Ek=~NfyE^CT4`sL^9^OKoZcBKw~Th+-T3l9DEUeFmZ5|-=B780zs@)Azm4EZn#NE4C!%(M7gnT zw7dwRV)TPPg9Haf_1=e{^LpT`Eap7)LAOLPba zSe$2es%yyqBghZvDO7uC*EgqE6 z`k83??M;@Dmva|hq`FjEiQ_^KkVQH$mC>qX_T~nS2Zz>Md~aGDqf6C{Fjq~Zq1nvK zVT}sBjKXCVP4Fe=S}|2+PHY>u)rsdLf1PN^cL}kXvq^guW|j2rZV2atU=!j$p3 z&_8FlMriFr<@*D_+WB;qcL^M-JZrC7P?NC!$g|}E@%)^vf%tkwZXS`Lj1a@htH^95eYJxcplp82 z1V~x=Tx{q|n6})q^ho4PV%&VMxi~%&XV#Q+nyRv0;Y!w5UHX?fThq<pTk>MgdIqF}j7`qRj)w{GTmC=>f zn9qOQoqTW_CAS)eMHuKscg`KXJtVL}a6h8im;36SmR2&5MYg3r_(&FurjhO59~nol zw`7eE!bBTQky$VI4H7kV2_yaA_9u87-{Vb!#y=_BipYR(_JmFud2RGgthq={hW=3%}3m7Kwy5d{a-KldF!T%5uFFD%e(gQ6hD)ls;xmZ?C6Rmj{Q^= z+s_SK^MzYFcRhQ{#%wS{F1qI}f-PsO{iZfyB0GPsd34AV)+Fae#F%xHT!cH5eybwp z5XbgzYzg;ciXf~n5-y~Fr%-KgI%WSqYfRvdY{EfFV;f^z18I8|_9oNU;ey3yi8*%A z^8ya$At%}hOr_W&xr*3m$kI04#=p^Cz``ylM|$Ap%fu`8e$O`M!{&Ew48ss2(cc%E zZUZNeu(dTAdlp^(+(f!5-biZc=xi)JW?ifRnmwT(=V;`;72%WS!}5~x8tl1jLK_-2OD-M z;PJRXx_s$_^p2=LzGAIM^Z4AJepg-erD%%;9I#>Zoi?Wd)H7_=gMv|{vEzdNin7|&DD;wr*$q2QvcD{$X%_RF;-pHY3oVs!ftN3 zBN1;^c5Gv>pD+9%tR^Y+G`ntuq5H=F|385xTe9%w?RXV^F4OC$QBl-TD1UAm{C}n> B0+;{* literal 0 HcmV?d00001 From e9be86254954d0f9024c728eea88bb038e8039b7 Mon Sep 17 00:00:00 2001 From: John-Mason Shackelford Date: Mon, 14 Sep 2026 08:37:04 -0400 Subject: [PATCH 4/4] docs(enterprise): document Authentik signing toggles Selecting a signing certificate reveals four signing toggles. Document that 'Sign assertions' is on by default (which is what OpenHands requires) and the others should stay off. Verified against the working reference deployment. Co-authored-by: openhands --- .../integrations/saml-providers/authentik.mdx | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/enterprise/integrations/saml-providers/authentik.mdx b/enterprise/integrations/saml-providers/authentik.mdx index 054be8eb..cf53b483 100644 --- a/enterprise/integrations/saml-providers/authentik.mdx +++ b/enterprise/integrations/saml-providers/authentik.mdx @@ -126,6 +126,23 @@ Expand **Advanced protocol settings** and configure: Authentik integration. +Selecting a signing certificate reveals four signing toggles. Leave them at +their defaults: + +| Toggle | Setting | +| --- | --- | +| Sign assertions | **On** (default) | +| Sign responses | Off (default) | +| Sign logout requests | Off (default) | +| Sign logout response | Off (default) | + + + OpenHands validates the signature on the SAML **assertion**, so **Sign + assertions** must stay on — it is enabled by default once you select a signing + certificate, so no change is needed. You do not need to enable **Sign + responses**; leave the other toggles off. + + OpenHands provisions accounts from the SAML assertion and requires an email address. The default property mappings already include