diff --git a/Gemfile b/Gemfile index a8e2dbdb..b1cfb871 100644 --- a/Gemfile +++ b/Gemfile @@ -49,8 +49,9 @@ gem "bootsnap", require: false gem "devise", "~> 5.0" gem "skylight" -gem "omniauth-saml", "~> 2.2" -gem "omniauth-rails_csrf_protection", "~> 1.0" +gem 'omniauth' +gem 'omniauth-saml' +gem 'omniauth-rails_csrf_protection' gem 'repost' gem 'ldap_lookup', '~> 2.1.0' diff --git a/Gemfile.lock b/Gemfile.lock index 8b2069a3..22aa4e88 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -241,7 +241,7 @@ GEM omniauth-rails_csrf_protection (1.0.2) actionpack (>= 4.2) omniauth (~> 2.0) - omniauth-saml (2.2.3) + omniauth-saml (2.2.5) omniauth (~> 2.1) ruby-saml (~> 1.18) orm_adapter (0.5.0) @@ -431,8 +431,9 @@ DEPENDENCIES kaminari ldap_lookup (~> 2.1.0) letter_opener_web - omniauth-rails_csrf_protection (~> 1.0) - omniauth-saml (~> 2.2) + omniauth + omniauth-rails_csrf_protection + omniauth-saml ostruct (~> 0.6.3) pg (~> 1.1) pry diff --git a/app/controllers/users/omniauth_callbacks_controller.rb b/app/controllers/users/omniauth_callbacks_controller.rb index da2be7e8..c85ac57d 100644 --- a/app/controllers/users/omniauth_callbacks_controller.rb +++ b/app/controllers/users/omniauth_callbacks_controller.rb @@ -1,6 +1,6 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController - skip_before_action :verify_authenticity_token, only: :saml - before_action :set_user + skip_before_action :verify_authenticity_token, only: [:saml, :failure] + before_action :set_user, only: :saml attr_reader :user, :service def saml diff --git a/config/credentials.yml.enc b/config/credentials.yml.enc index f1c2d1de..044a8d3d 100644 --- a/config/credentials.yml.enc +++ b/config/credentials.yml.enc @@ -1 +1 @@ -FxQsw5puaOYRanW9OZyBgK7b80BtP6cD9pSUYIWIJDfe5roxsyLfMJoBZalYjzEwLqJW0AxhTJ/22P2AIKGNFbFa4HWGQZ4D/Q5JUNiwh+1ZjmtxoEq0ypY3c5p0Sx2P211CEUlpv8t6jnTaKK2BORsTDOPX+vxW92CdnKyf4Z30adZOh8LafBU5wdYLAGKzONJ3axBeb4ORtnOkPf+FwNLDXR0SyfxZpW7BEaT07WAaJL1XkjqZxmTbg+ertkxF13PNX3mYZ4q3iCzaoouTW2/fJnYMvkNd8oEg11w8RKdK8M4CMZ408k0qD19RseIW389je9FYFYW2+0jQygDw+wz6cwKCqADOoA7lLMn2336nhQZ4Xfrc3DZHtu8kt6z4hOqpEG8+v5/4MMXqLKxOLR92sHgGXK3e047i5twdAv6pjwz03uU6gQgCHy+5SUzGPrUIKzzYBBagJQ4kRCOCUvD6rCnge7BxTENZ2I9J7aI1K4nmNlbku2rPa9LOBBflg1ZntxWEI7AQk8JZtJ5byr7JSjEJKcaFZBC2UTUgvmPWhbepu7ku4qiDDYIW8Cppiiu6XVnYZttGbgc8V5t1zj2LsPPH68/1cC6kkWyHoM6l8HyIjTcun/VWLmqjP1WopvSigFUnnbcwKdlJ/1XXaG4eCg9alQAJl4Jfjdrtnt4vxTeuNvgL8t2LVWXee4nCMHPs6WdQwBKQO2Jmm9IDG7iP/sTsVMl5y7DCMxCmjaIgRfq49j+mv8lzNdvPuxopf6cHWRenopOENcXvfLYYQxbjOrxzkkCwYRWoEc/rEuqy3jrJzrJlSET6C039gS1EnPRPoDzPtqD+NyYVH477G8a9/2nvOqY8zx5C+xeYNHVJPMH7T6GcQbgvPlWnThqPMSOKgPMKACGcBryUVUhG30RwfUED9BJ9ssLVmCYZmWbJwEQFX3ZIAWmEkyuDVDRhoF1MfVM6VRhCcPq1Yfk+3jISBErMp/0nzt2X7WcNNd8PJtMfvlTPIFdo4/zw9JpvqxZfFEcM27k1hM+E/WN06rOtRNy2U+EhVjyeeVln6TbqEfOXS1eRNjjo3UrSzjTnZI4dpbu73aq4B75I39s5RbNyxIaRsvwIeAsC0wVpVgONioLu+gaO6x9waRI7QgU1otHazU0emjwwSFXUoIxw8rKK/mDimnYGI1FatOR/eZCyi2s0eLobzuynjbyfebn2lvHyCjnXoY8yZLIG8GXhvL71R5vJYZn7mErU45882sanaHafITiUlPrxX/rcH8hWt1v5WM5+p7IiRXRWgJVh0p4rS/HR4VqNLnsaHZeIq/6YvP8qW6aSRUK09ZnHVwso97GIaPYH3uTsyUuNTWibCgszKKIFA1b3iBxsYFFST/+NPWmACwZXHwqt7bqea7jPvvGJ/x1WMDbyUBW5snhWSBu41eXZ/xjsDhstT8feZ8UdRe0yt8EPzsHXmGTldfwryI6aBaUwgSK8E5VHYENx5DPVLBWoTAzlZAcQm0aap+rTcYz4eKfKRvOFqOJgTt57NvZgUWkeSVZUIhdVJZJjRhFaJFUolhC9qQvR4Hg8oeJo5SjX9g1qqLPH1kRGYWvV+lnL2AhAHh+fVuFxQH+S4gwpX/0rIANy936riTP/nAnvqgyfVOKTVn/cG+z0o3jRNNzeEzMZNOaHbelf9TQLlX8nWUdhoCrOaSQ7uu2qcG6nbMOAv3m9Csmoj2ugs7XvWSwZjxqzz4mITPMlIKcjg0VZh+OFIAskg02fSWhZEe5N+rmLbzWWTgZ06FM8SnT+c+pTeH6eCxozGfQFBfkmOlzEEG3K3xJiEqEJISrJh2+d5fKvyiy6XCo4Yq0XCpVlWwFXc4lDoqgenqoM1OewArmK5yEPtsQ2OkaeNPQHIpnWaR3Ms4CfUFrDaE4HMRl8CsizWvXLyqxuFlnqcETge1lJaYGImVqY4Z5uBoug0kqwXqfjnGuj4IRGRi4kP7FMklgCleftsmp1hRAv9TTNwp9qRP8MRgEtF/ELIrdZVWxnzfIlJuiUNqhYl7/MyYpsd2uNGYaN3dOPxrElmto7snDT31I8kSd6keS5bxQCgnlHUSxQOMGAGPNeywEwLYvT+ojTVeJ4vY4DGyEGtRqqNH+UN86fLm58depkdWcQCmcKeKNMN89QisObXBA/Vk2bXBMWOtj/v4qbKy/v1ge8lVEmco03GfHGGDzUen6CD/414jFTTmxRA+YcZsXqrZT8sQla2k5K9okzPIdl4JFiRGDRthNF/zqWcVzsSolFHqAJYAQguRy6UTJs9rlDQIygPK334ZrQUykCjklWnIQE3r52okR8rSxgq1ZSG10KTkShg4SAa4cI2cOos55TlQsR9VTVqUbgzTQlORPhazWnXUehwvZXTPqAgAF7pGRBf/Y9WHKueCm8GRZT6LlGk8LeK1zD9Tvq6eMv9yoMAi9/o/fVESUGqYsVLzZnZ5V+nF8AUAYn/X24UXxaM42q3VB1mB0eStd5/6a/t4tswqgaQE49SHx+jJJA9OCnqMEtjqw6mLN+1J1FIuLFWYcPH1/Jd0c6jEZFCVV6eEhfLDC08w1jyCkhHjwrOW9qPbmBF4OJYZ06qlI1SZKupDjpbiBeRD0wQoq5LQPsZ/kiMCZ+ygjMLTrjBctB50v6kdhLP/7LmjZp3edSJ+snB9048RwSc2pOa89e2MpQeeJefRIERUkh3TIB0qY5/WvvsVo1YBs55aOaJLzRO4OVj5KI7zS1uvruvuEEt5oYTyYtNCrKLBv4tv5HsxM58CeHP5RVrKK363EsKIPl2QLn8q6XvNWD2IZKzAFpRlUNJdqaKptxeYOIoRL5wmStJoEfl0Bp2laUVJMb2iSLr221Wgnkyf6t3Z7wpYo62/UBH+eRX7wcPfkFikLug0t/+NWPmLo1czkiCHOFn7yIhb6aMUZPDF0S/D7xoURZuuM92wVEuHmpB0feXR1CLugMzYHQnJrKvSNEaZcpvhsHYXe6Z3ipqaaVrUeQ+YQz6XyXAhL80effYpkVUo9qyYWF+92lVWKQIeHlEV7Gzm+8Hui1SxzxtAujylE8PZ1ckGIyXjsot/JM1LqNRLMw/6dQvUY5E0q3rWQADbBMD/Nh65wzrTvs+/9Vd2JxrkiSlxXWB/uwpEuzG5xh6No9ZuEu6BZsv17EbvedDfkfwwTKvqfhgdMlLaKbKWJreiQ+K3MNOit/2I9xrJaWHTAtmor4Jzre/pu6Ifye3yIJGc8em7L/gaOK+x/9BiygW57S4GA4jZ8zTjEQMg9uRnEy9pbaV6gdzQyphzf3oXoLSEZFzF1dAlwKS7j0eu5x3SuoN4SQA2XHWDOGRV0kOyarzi7PG9IPov8yMaPuc2OsgFhzEKD5X2xOupPSAFn8xjgTj12LiDcaHQNfctImh7LLTrq7lpK8GG2ohnhwbvxDaowkqxanaLXuJdMAezVGaXXKac+fjn6OoF6k5bey3sAqEMgqUGFDRbL3mroRYPFcyHwsCMB/jWKaiYMAz1vmKQAQRmHlvkNsjOMLhaex5oiOtA2TPj2ndmNf6QbioLLvFuXV2LN7415sXo4bHd+3RphLPGElv5UBGvxfuxK1sDuWekXSHmTeGFYuD7Cqr3ZVogjbsuKdB9awpYDqWNhlhKq5g+2GLot8vuc1oSeh6DgDBDExep+AOW5HtDy6b4cUZFNdYfAc85Cs4slMLtFze0QikoA0t5kbT/mCIwj0nH4Wdg2RmOeUudk4QieqAPfd6MCYr/N4aPYgyhJ1cBNvN2dwubuLMTRkwR+kJkofPz8DYRjiq6jD+gpfOF4TTW/GaeF18Nap418pnIGZl0eTHe2uAb5s/eWrSnuA1x/B9F9L0kk05tv+nGJrP6mltl/aKQYjjE1rCAEBZ83bBsSv+sYsMrXK0RO41ufIS1eZdDKU33pSzg7Q26xXwxuy3xdPPm43SIMtWSFwO8jaJyqHq3RrjE2QltVNF4s+FhKLQnUIBAnoexMDuESf211e70vZtsK/9irsmkda6E6MiSuVMsNlxPkWlL5XgM6/bXrC38Bi/o2JOUD6vqJhZpr/i+hGTa3aqKbkYYQJYEffjue6hfNDvPhS7KkUbHUbcF23m7SvUlLCIlTbECdmrGacAW9E3KOAYmLmFQCHuytdddPCCUZQ/3+eQaR6rZ3sRNMqrOg9ox7dP3pmZAqb6YD9XDCADm9Rr5/+1LeOo/jgJ7vv/cTsKW+bnAMKYAPOMNROupaz5hCKcY+QO98pZpSbqBKT3+zhi5M+g30RiUjtg4HD8T7mgthvJ/tWulJHLKix75Z42oQJYYIbTZq4BFs6/tn7pkDpOBXqiJkmxxZgQIDUFCQtA1uIFwXeeshFuK+zEi4gbRrYSwa0CpAUtSg/5qDME/Mm46rlAkJd+e6XSoi9Ki1fVHhR7wmbxBt7X2jeUuQ7WDqm6DoFfnM0SZOLgwcqdP7x21W3Q7wsofa4T6l3R9yrA4jt5/b0QplzrO8HVAolZzo5VrOH0xp89J6QkFSRvkQ0DUEPpPTAPOCYuggAf8WSj++QOEgbNX9QsfvTAoRvtIsvkNS7Pj5N18xF1wwz5vsqvspk1ES0pV62czZsvT5vGRvqUh1MouNrQ0LeV+a/AZQgjQFYcrS8aasBKBUhrbA1QhWN7riafIVnMANRRhxrorlpSn4WsnoavHzteWw1iGDhX2BOpE18VbuQpHOwdhKo1sUB1icZ0TwUiL4U1bGmht5VfZHFTr91U4S13Y9ABajoqyy6dq7OZoV5iIuYtSimnsy+v9rirK/tAJkV8H7zV25PZElbEng5xGURdeiiPCIh7BKHhUkJIdFw6qDwfptsFtSi3HVF9scUnmUGbA6Ju8UjQkCzYhD1zm+SusI0bPf/6CZj72rj41uKLmr/OuTA+N/VTLZRlkSOooQNqiPJe3S6Mv/89TWy/eQnlRNWdt6qUxe3Mr/3M3NbEDmbaQID7uyYxCLSCjHOMzrr3H2ZufM4ia8CEyUe/2i4ikpc1G/rPv3qF4AlyMovxYPfLXTHUYejRPm//TUKQlMzDhC/jbifOIRKJiTyXLA/AOom7elexnWavmdBI5UDfwwhVaUK3uMiED0eooyHmV2xSvDiOeYKAe5w3iOOMdFimCmg9gA6xwJVuPvfn6vnV8xCPosXwNvDSOO4UuCb45OGOWfK9S2WwKPVTRVn7b0P2hHDUIL7plq0Co0+kavAosICRlg2dYMDXVD2Eld9fnyt/SwAmvbtjYNEfokvQwXEzBqjVbInkP2P4aQyEmrktRG4AuirWQi0j+fa2TZQ8QNuwC2NPi/eiymqozx/Y+tW7+z2LZ40k5Txef5bppaJXpMrmkCyHbJharSrFW6maVa4jBL0nj6kDMMUnw/pL24KZJLJcOX652Xx2peCluVqO8bsq8EX6XXEzU/6fsVWUQze4QVb6/m21MAg2l9AIqTK+gxypytHuEcDvxSTxoKGDsdh3hHyUqPKkRioFj+JF1AqRf+qRNYdeljRsjn/HcRPaWRTpjQquW/0y7ZvxTHBo0glaiObqMCDTWvCJKbMyucF6oo1f6hWVREYmkOpqaot92hTGGZkWbcoS9yDE96XoJfSi3gQfmi6DKtT8r/4jQP5Tw/npMvu40F+uiyfhPK8IqDw+pitdZFF+6RVssh8WSXJWu0G8WIF9n+TxKvNvU+YUn3KPtfvJUA79kioxnBe6p2JPRAhTHN2LXaPVJVuS+uG0Rzy2GW5Z43+WO11bvNoq2X9sj6ZvAEzAp9Q0IDfV19sHmpimqnJfbW1vISvfn+xx3ZuYEd+6vmWo6QEKbzuqPERVr97Skecd08idxfAdaHSgNUoQYcgVJO0SLdTx13wIHsojKFhN8L5DIopkXgcSG2Ejvb1A6Y70T3Z0ZBot8+SV1ulvuckHlssDwBoIMHhWxLxfbbQwjPUH8jNpKMWe5lBdLyndw8xftO83x8dM4L25c54scxODrV3zSkSEQLUlHwSRFgGOx771xeRzJX62H7sN9pM54jbPe3ALMPKBsSf7P/PuYzRxcTW3UzAxaskrwUcsclfiOrhwNWfKsWbrEwP/ZnHcu+tQdp6OcQ6b+l0RmeAYxgKNpban4+bhOFpFrL3zl1qkEXlbZ3FnDcvGbzsSRWZWmLmYek/BkQ9aipU1dlD9Ar4ywAejObPboPxvgRLa8X0Wo9OU1Jc5BPA42QAUb+drznlL0+rG2NzCfruMhAYoUcw4cSMgsaHXc55yhQ6mrF2wuFE/8PBhZUXA+u6oQi0KqjOkXYJcvFOZHSMwMLyKT1KAuGDOk4YKeehAgi1WZ6Ex7JURwKP8umeI8HfNS9z6El6uZq+Wj/4DRiiMrF1N08+43JERzOAFW0HCLjlAZCOMRjf0LmhQLab4Co37QqLqbolHdWDlryWDGxyNOXEime2gGgioA1CkUlpd/PPhUi8tXBRJfwJejbalZq1u4g44gJfPB3y9wzZXv9jegUHX5TmWIORYQj19/m6rOd9Tbb8K/EkRq/l9nnsp97ys2n8Gfg+uRM7lZ2+zL1EjCK3Q7mruR9XfeIMtQ7TMYytXvsT4egGPE3JbE3N/JjN2gAocVDP2fICJz4CdMXv6QhmbvN75SDGkUPUycFAI7E30TOq4QZpv0S6BAptazU+oTGbJm1dq1iCnRc+VbATNgUQoPAcB1OYAgCxIxBchhD9nYwV5RQZMD6OAqRQXxNYY5dqs4eFTvW2JYILjj5nzVGmvK5Pxz1Gh0jBnl4amaLcKfAVSQBzNKmgi67HsIbLoydZhnlvChSZyONELxAfZyen7eB2Je4wk3QMRyPaYlySjMQsCEBazuAWGHDBJMfXUA6EN285GJPUYt1UUqISfh0jcWvplwGITolTzczp9UcJ4cS5CI9LywAP1ibs2Tp1cX9b2vgK42hgDSMuEWifVhpv59pNerPsdukxmtDL8jwMkJWAwTw4TONnuaw3GRHtrm9B56PZpDdvEMS5jPkCOPHKnWUGw9aubbX8w+YHxWw+VTnHHvw3nCBEJsVrA4Sw73qiTYDIGBSSa2h0Ue+oXnUi/MuWz7m06HK7iTKqV19N10EaG0nfRqllTTuYA9Fw4TxUOBGyLz1/WqS2Zmh2HIdJlxqHq+ZVflQvBY19GgGQRTMCaNyGLSrX7XnzFsveE0Gfvyhv337VMEYGBWKTNnPAsylhyAWA5ayRx8WVsvFmhHIm5LkdjUbD085drLlUEo7OI9TaLNWxUV4ZPyJVi1MB+fvvjADAjPC4lWzKwN05XYm2fh0hKqW94yh1ysx5nUvJn9+yLXovwo2jlyZ4sW1l1KBZcicnk8gtyqqvPVOo6ctI+4bbZhzwAmUTOHDBHeB3nd8jcEsLAdpZV02bjOz6P8TJa/ER9PCbFBvIH6TE0QFwAn70mggF0L1pE6r0DvaND23pGTMpz7Cn8rwua9Cu+f9CZdft7abYAggeJnvXDvtC8fS50kWrtYS+ADw5kdWtWAMtPCzjW0Xdmy73Tb/YKfWRfE6a3EcqPGDcTimdbkHEZcyd3s72dQjXQhmj+EzJOlT83BzeNKajezu0m1oxkHCbE7AQUp+IpRwOmg9NjCuBLz5i6tudjC82S4vKp0zl0lOCnQ/wvfFxb6L0KIGIk+ySZrw+1rAmW+SZ5usYWV+bRB9F4YZWO93th55VT+Fpv4v0Tu1OJQFw0ltk0u/P1xV+FsXlOCnjwXgLIc5Evb3liyyeYYVpctAuMbk9KNf33JXiR+ZfVu/IrkiYvROgwnU7V19vMeBzpHzkszJFKCRSA24B/U56acKQcNjsRURv32TPeC/xKGgAHsVXbCTL4w0TngOYA+q+Zaz3c1VCZvGB5hfUIBMsjWBeZk8nUVca7zv8JWJLRuINArezc5k9Nmxr7p1fH/MdoqbodkAsA8u2IXyvzYR7My2rVCF7iImG3kwKk+C07fyQGQ+/9twuredb6HgnZBhnJUbxVpYrhhQ5ro1oaTShX7Koghhy2IVj3xkggsJXa/BrZzXt5jpE7PnvM7dTh81cfm1Pzn2BeE0yYKbl92Fu+8CLEml4hHrsdjRLLoh8/deRZhth+O3BsTWeVSAUgVURIeme9jr9nZlMkFYqNm+LBwByRb6zd09jEbPdvGo0pj0T/1PrCV9CAN82ef13i67OrYylUGTnLL61eOkEnp6Dj3Pv4zgt/oRTZsfBbSYGs5sTLdwpoXgrRhP/7E6hkMIMicaLDh3hxBHggNEFcCpjAspGHQZc0TsfzeSXrtAyCXMlNW34xYdncUG4UU77ksWE6V2INqgMCChVyj5/pGs4eOVTE0c/7ZeorL7h5QSvHJra8CWrLTiHmn7ul/Fq+mroH44DCPOX5hBPdfUNz2E4j1wL7tfqxsh6E4oAyfHvkpCznaF65yOBTztQtGTPU3pVf1X2/DxKU0KSqBN1wAb1fJ4klnxSSbmvzzKczh0AV4IjHgZjYjFcBb1vmaZIZfVqr+V8RvgW03vu3HTFk9dSZ/cZxdgvp/0CD8ZodIz6VFUZ72btibpNEL++lqSw8sG6hbl+kN4tHiEZ7VHfJDMZGrmNkr8jN2duTfa7DPP3nwz0eFCqqk9CmTAIAE9W2/yOD9k0hCDySpdQRgXr9RVvnQ/5OL/uK2s5NITOdIVYaHnKJArZxowKvEiKQNHkpdCwsQ39Xxadoa71rFJ0bgp/W38puTD91E0X1lXPCwjGwiSinrTO9UPmjsQadHu7yAJz117rtg40sGhK61WPp5EVyfpb2TmPhj+uFcJaGkRs9VAJtVeNKsnvutBnG7y1lwR1Mo5YPlEo6sAu7iq9RZZUW+jSdoilhz74E3BaGS1lqBBpMnPcc/FaFO3MVPaodudVvy2Kg8WWpOe0YVZ+ZUpZzeeXDBxlN6eaHkE4NO+zsnK1YPBzW5h2VZ4YlCWCdzynhTHdWbk3es/jnWomEy0e0DE4eMq0bl0/OON4TemSP25vRy3wZTyyvE6JUy9DdzgIb5ugzfe2bJm+fPXBmF8=--VVtOd/wl0hZ79N8D--9VE/eY4yquOMJWBKFo27KQ== \ No newline at end of file +Dqc8I0Gk4sUuCo0sfevrH0oEjVX0QO+qP4gN2u08RZr6gHlXHW8zTrshEp+l1Rl5vb55Tzyv3PDUZIqoyIcVhKH0dIPQD4hOArJfTokXwEhTtLj4siiN/huLVqjqPlmNkHh0F6C4jYb1cyy/KryICLERNSIKreRPgSW6qVfmWXZhBdN9SE391u2h6a89kmg0W0ESSu929xZNxzPPyhvM7RL5yYT63d/yOR+hZVjkIm/BZwmHlghQ9WPLtJLHkogEjmpeWm5WRSYVyspmGgd7xdoi4BcF5HPIirBVID+5afb2wUqiTm5rLnq5UW+QqvuTj4TeAdxdElJWT8lg7LLj9hRf8t4SGorHClnIbDY5Iuhvp8YLsfS8BhFakl8rxhlIFfMEY+ynf1PEm6aRVuMbliG7SqEo0VWnEhTi2XwrMPaM87hUG08xLkiZjIob1PEGI2qUCQLZCQn1IJRttTOnYWTnaTda+DX+762wKfWXhnKYBUqzSXIjtORIqnWjOse/gHhK4JSC1axwvzE8NQdWKSC/StyLj+iguxe4VgFucSuoPu9LYKwJthTcu0iFguODSi458dSlH73DlmZmIxZgtUWhhbNrSWS7y3lHfGZunyqcq3Vi7LgpF5I0kgHtWaOj9JXnEU6+vISYfBiMTx0I3ikDdFokNf6EPh3xfgEwagDd3nccjtBzzioVrGOyuHFSGIfIyvyPD5hf+V2towDAgenYcz2f10TdWJYhoF9MqFzlNwN4FJmRVcDonzzXc4eyqdnLwoQbDDJiILWLoonOO8RJIFBf/CSiYhZm5hI0qZSz6VBF5mEf4KFVjN5nV8w20MLjnaxxTOjTmbHvgeGptCVxLVaY6B2bvHj2fyO3AZJL7MI4b5cVfJeFxdrS3JGUhfPhE9xwpM1KlJO1EBM9Tt9Z9CO7PO0MYMRz6qh98iZk1QdTBsUvVWHwPDT5+doFgdFksBCgzz5LHLHYMy1q4g4Xg3vpWUN+typF4+1/werbL5evYZfrI6AW/aD0rb0yGFkBR5ya5OpIXgX5/+Iw/T5FpbIVKJLT0//g/CtA0SsAKuaOMh/bALbTd7dZGvPb1gGcPm5zYosDPlOpf2jMFj+gyxH8yUOiPcYyv/H4JUfc/Njghz82xCTDnwTMI3M1GTyYovddfX03XxLzP9QP5zPNBwo3bbYFu1ZNtnOto/3Bfw0+1DLD5ScYkGDxhI/YODgpUnwRV1aLQC5nhiT8uJbV1aMgLWQfZolxV2aSvap4/mLi8dxw8TC6SuFsSvc1lGnsPWFkumPz89Xqc+zIk3RQKN41UIEjv6DTSjdJ3hzC6/m9+YVeLEnIMPI6Gj9SbQElK0yPWCsUZsyORQ40ZhuIUj6QuUCZAF7ad9AYgdAr+qv+sY7w7BjRlhi4A/moxkW7Y+s4NDewRqlGaZBJB716qEpVfIw8t/EsQfMRE8eQU3xZhn0M3Xf5Pe5lelV100k44tldBinrxLkgqrvg3k+5H60GOeA0KLRoIApRTTfri+j6ujzI/LWWsF+0Xn/eHFXPsliYhdN6m+uwdwm3rEomyclXu4cdz9Qf5qDjPyKk+k5NxHORhjqFZeMjX+rbjBOHkIdjnlE3lLo0rc1T7xV1xBaWD9Wx0nznlvmqdW4NvFiJ3JasIRNrk1TPXIgEexsBNtFCtHQRkaUMS3bv5YQbl53r6XO9kVCnvy0PJkIrXNO5OMOZf6sd89XbC8HWj6W7WoELFW9KhI8XVFVOBbHgrVEdPwT1MB7anu0+18lYhgSIY6AE4BCPIlORsUTM1L8hDjwRnhnSIcohnH21/YY3pZUdCcCB3HtDwd7YMcO8XzUF1WQ2ZYdbPk20zJzDEMQRYbHy2EhaItzQW/3zBZfhDkDVmW+ZcrsDyH6RM0GwPGWaZ3ZvBtjM3GyHKaicrBVbOZFGtDeczJXuZFnaHltjCP2Rh1LF0g/15dFphgaMVXMMlDUSj9l1y9g3K9oSFVzvO0guqcvkrvROZILFuZGmaI0iEvBQiZu/K002KAYqUJ89WHo31MCsdHphmo5WE+s0XL2T+BxE6+2Li7XxNJL/iGUmlYAI3EmG9K0bRUGZx2gKzt5KDQZ/KoVVMtkDxljsS0gHOYgXCeyLX6TpFZ5Ex8VpQahGfiBXnIVAGRrJ4UbeytfYwdz5BF1YucRpcitHUeMqlHTdxCtUUwDMe7zJLSs+hzMjkC0S73AQtqwxXHkhuAJVseKzfoQqTJ3+eoNxbl4VpyQl3tz054cQr3cw5YS0RirAvE0oMWlpCSqqZem1fF3JU9zGJI0WK/JUwTpzDdUl6F9AdMi6PjyHIid3uMDg34CUtYMaQkV4Wtu0T+k57dA7TrtGi+dnm2a/XanoVDa7Ooc8zlapHiZLpqFOjdR7Q/JY9R9vdDhHhCNk0X4SEOjhykywxpG34XwvBo2YcN1XP7+Qj1Pidj4Bsyd/LsTPuhYgd6e8dRcTFoaP5s0+cA2Ij40uAmaBZCLXMBpVhxD2iNpzuCMa+gimi1249WtfOCG8eqcwdsG3HFyRpwlTf8t4XOsS//BGuu1PfO9oAdCFAnbtTUhaASoAqfAQOzPPYfAExQUkqmoAfzcqppvpwRWg93zslH6dUNNn2E+5CRFVNKgrj9MtYfQpnCfhDSkSjNsdtcyQCM0u84wRqh1OG9G0kORQhGHuBFGe6Ih/qPduZt2bLhwQazHTA12z3PoGo/LCmQ7kfRkkXLKWGPLEVZShRG9b45z12LFJvOC3eMuoaz+s1f8tW6xvC4RUzbf1tlU0B5TK+FkstWFG+Cc18jXnGlmC/9MrGszBAW0C+6bVNz5Ljir+THbSmhY0ebwDcUfQ7Nz1/pS0SgdNWCuc6AizO9w7uzH//sjenh66PxARju4xvvKxfgnWvyRdXiP0XrL5qEtnLgjZ6lPVtqtRn3ARG9+4Mcx3ljBaVfuzVyLxPFRmM+0ikzwQPq7cxCepOrtPMG0whTlQq7RlHODaNpsUJnZUCkwsMnEIcIPzKwAQB9r/U6jmTBmIBBHh6v54u/xPaE1s5ZfL2cRIFCt6HGyQpo1bGFsshB6NWfQMZK86cAq9i3SdtQKXYbjPx9+yogBpYJhCep1SCfXBOYhx/tyWd7OPGuITmSpcw+KQM4Q6prGZV2rISdDeMx6qA3yPDBQKCcPddTHvTwSUr1heh8jHUcqvMtOIbPLQivp40+XrbfboU7qLE0G41zRInxgJwlFwbvwvqV59Tq8tOV5RacozilqaHmrb3UM4wfdk5v88GcDOUSpVbtbuy2N3lInWsnhDCGMp6dZD788PMfNEtYsfDrEk5AqvqIb2eW1sOLhuO0kCQw6H2DOIWlfj+u9Yxj47dycr6i+bXVQtEUSdXH6rOzM4xJdd1QTR3regkHNAEhMSpA/2KoD9LMrES8K8L5fhYfvA2KEJg5EKHwe9w6WcPdq35cwUYrt0rc1nY+9eRWtZlCp3v3BoyswRT9HIZeqCCJgSpDlGtTiINzFk0AYAZaE/bkhg4vXKVHLJBQpNfgMirNZbW8Eqpoi7r3puNJBAdY/or6JgtTL2Jpk52Zwoleo2ilTJLGB1w+Qf6TTp6KeiaUKwgSyOBzF1vxXQDjRYbcl7vHdY8a69VzYNibJl2nKcW5KSHbjrx/CzZnu9SyOczxnkG9zInf5RVQ9lyASzwrNQrtrcaPTaLDZ8IbjSDTAcTlcLocSjF4z+a2qrYkVajENdB3zAeecaGlvBaRHoHbPBFhqMQhqgCjmLg/Af09do1NL+++KGn65B3PpnMdfAkyPnn157zLE9mY5P6Ggc+Nlx7heDA+pcXhYjcvW34flz958ZU+fQP4XpQhr3Pg6cWZOrP4jKgpSYNXw43IP0VSU+ktrjQB2znT1TzrtoHCMqDij29GsYVP9QGlvWb1I1ZEHEmo0pN3MxAR5RjNyValx7eFNwVKWV/epD4T7FQuyFaW2Jpvp2w+ssdEQD0wYz3Adjv9p/HL03E/jCKBD55qs4/eoMTPdOdx2dqN35sTfHWLfE0Sy2yHHgSXR8m2Ym7I8EAxecVFxEHv+meelAmtN3NAgyA8+g8UqDUWGHcidTljSC+McXFUoT+l+ruFY9ONuIAZ3k1OgdvCQpIRcTia1G7Z+Is0k2LQNWn1jHcUUvG8uMnHsGXJd013ycB7Dn3SyGm8Uu3sO8bs0fbDtZrP8GH6H9izJYUrVtqOUcGUM+1eVn6pmQzmvrk+B1csSwtfzxImkPom9noOV5Xj75xQsorhai7iN+TaGjBynEr5zdMqax2d7PaVuV0/1GNjIFlCiMo50AnqDTyANAExJNlXjxq6LseIKhGKusFPpDTpem1tUw4N74uIWSwanfZJ3HufLdV57Ve5DnfpwU1miuZvj1mK/b17Rwb93H9ELKVhj3cKMca70YcarWxLfXHUihX4ULVOSJ25ozPDF0LepjE4e2yYJzDr5KYiAOjZFShEhRT5bDItpjfXCzr7wC9GjO4/HZSQm18F5lQRoiUlkGYBA52CcwjOoCs0sL+U9H1b6BC5hY/tlKzq9UUb6ww3IH7evMn/Isk+4csiYCiqkcksg7QyOU0OYQjGsge7ZIez4AhUx7EyjCNDJnX9MJjsKJotbbMbhkb9aisTHdU6hv27LTikkU7+li1BEEtOftYQR2LQwW8Cd2EY0J45LygnfS+yKODNTT2zizBMlmRxrXQn0FohQwSUq+aC0b93gYg+2liQ/cEAXHVhhYhrl+M3D7/csJZTMDV3aU8dfvtWYelTxpFDYUe/wkcoqGTxq67kkHaiDNnC8UAUx4FVM6NstCE/4tGYxpgHVzcwsQrfcvU70AR84zW0PIDU6j/j2z75V4oI1+I6reCQJ2qkhus6DFsd3nTZAPXzw44PXQnvMDGH4JXpKMxvg3aUp9a3YV9h8YnXIc22fPlimLHRtKV/tfqWmHDHFUiC/272TRAQQvkfLMdeZaQ+6xrzLMhgk4evO1GDVuk8LmVdIMg2KRo6djC/31aZLL716YfqbBNp3yzlnKuBzQwDIOsn2uZmw9VNIi6oZTulAGSmBI+NMf3SIMP/WEJPeXJH6oiClua+kB5sLYgUNUBck8rt+nTLmLlhsJXOPaHEUxZG/Vmtrorau9fX0fJGLFt5vaxfqGf9ACxek1IgjXw3x/ykgqjGuBLZps5PTSPA/SyWsht/ABbE+JsgEpNnVlj4keDQxiM+O4ib4/u4jsDkbpCL1tRGlBZgrXj5b31y8A1wosAIMV3MA0MlwcZKDxloKNR9bP8OL9o9QwTQnh8nA1qrk3uJTTmfc4bprReeFSTD6A+CJTag+9Gkv65Lg3TcoOgpQVl6maw5dNq200ZWIeDg3Tqz0WvFUsSDpTcZVz3O1neHuTfK8KW4eafz5/jy1/YL5VAtSwfX/mgrkSMqSmG0OcKgP4PVm0mRi7iiSP2lvof1NlrEmTjqWP3H+kX3qEZhvfLf8tAM5MSGKUTLKI2vYC7JKgRa1iYSFIbDHgstesu5qTFZsMbDuIWaWCFQz0vKt0r0ZyiDv7zJHIHJVrDIpOPhERoyrGAe4Uem4/WpCkIciZs7etq25qJL0lXqhzzCYihOkt36rYlVVpekVYxo6HbeZ9BgcswNOew2hwoir6U7DgCGwc9ZqIbclWr0ERlAC0y28Kh+Fw/hGwaNTipOka8K9pyjuBCxgohbiSCk6OftDxzuv2lTcQaEer6koR1DfrZGEWp8+bKydka/jPgdsCy4ElFuOEM8N4D/RQhinuiPH8kTxnUt585jjvKe3Wpg38YtkWhfi5XJzhVSGRd/2mgtIamChYX56FP13IOQ/yOQCKf/7mheGOlR/NzmrN5W6BO9T6U+z3u7jGUfUTiBdI7jojiSNHRYz9bvk3VBXLKWxR1ULPtgb2YUi50lcPibJu+411qkN9ObkgBUjXERBgF+TWpyCWbFIdPfxoVrsK0jAf5bRJPSmXCsvjcNoF+PyaxcogtgZdXYvQbVHrKLfMPqE1VzDSMXYSMUME+Tp7w2JZ2v3dTi25Yuw/gsIHaWicaC+OiyW5bgEI8j+Rd9Xbmve2mmSWHIhvcRR2xHKiBAU0mK4tu+iXA29iLKC8sM9FDa8FUmEW/K9V9gBTmV6NouXtdoKc90EY4segApnnLf2NufO6cJhGObKvJqcQqOQfO4bTo6U9KsUUkexYYbNVrhaksJ2/FJoTvwBjyFbz67xPZHEp2TEsJh+krgiQd8e5VRK6xnyVsEOEDo5ehzk+eHuN7tCuKgjOAdDb+GCvwazRUBJVX6B6u6OXZnlTSreScpRPJZjKmSEQhJjz8b3W66jLB8/BtnmkQNwIfhPfxDmEhKOetqSItGO+XNwFAcdjyuZ7kzxQzkyAxdlhjE216RGT5BkI+jH3PKttYxDnDDfXkBaciMW3RNIDOx2GS/B3Ia7PrGy/gkSB/VVCadeup/SkTWvDZvbAqoxIPPcZrNeTv1mFkuEuPdk+S9IRKV8IvkWTMobBHjKygHA938jJOefJLeFMvrvQB6k3QeYsvzHASNvYEr8V7re/Wkv+nSFMTfrA9CDDq3BmYW0nqzp88ruwgviZjKwMV6MwGhIODvG+15RvnTvmJrdAb6+ehkeJ0mezOCXkqex7Eeuz4Mp5jeUaybovEcGN9jopjY/Y/4j8Je1b7HYPmV4OtT3oO1vQestwuEWkxNTxT1kJ2YnCno1kTcad89W5QzkntM1QbnpLCDpqaGkL3m7FE8VY+k/tCeh/mEUQyHhgJUsAWM06PwFsdVaW1bIFLZkzL+0o9q6ZOEzczoVe60mEpNmGLIWag9N4ePxzt/NZGkrsi2qQ9Vo7Pvjht0qG/3Tvk0QLbBLi2/nvdlTetbv/ZNt1iloSrvxCVPP0By+S019LVfHFyIMWr4RMdCkqdpN8Ad0Pnc9mvFX8g7f587eRHHpMoaIlX2Xe8uyr8jL7OnVg6uNUXnd271rTx1ixVdoo+mCAMiPDZIZTGPm2tx2ifKonOG6mWClZIJ9lIEe03pCwv97U6GR1P++t3tiN6TBGO0eXn3m38CX6FEa8aSg85A4dsCMM0IUP+WvdTOd/LlOSnVYf1nIrx7462Cs+zcNRxwIh1r0lKMKD9gqPHBrAy/Xe/QrFoU4l37gmftIVK8O6yuf7QteYIZ7zKlsvlImjKSdEY/dzTe7opvZScQ7gRILDGL2z5HdxgJEGcGhsEIh+oWkzBvEkz+Qytws610G8QL1GZs878fDFS7Bm6u0mZoTgQCcOmFbcW4gXl61Luo/1nBA1H5c8wfkb5aQ/47KsOrWQQRu+4Xjii28WEZaiJmQlpY5nyaPvphJ1CMnMl6fcE81mpolgeO/U1FWZsEXJd4D3SspQFG8JpryjjSPPfZRIEJHZ6hjrQ4/L3NPYBxaaCez2rgxkxpcXE84poPlaU5BSe2xhzsg8LRRmj7/BPDPs0Z/A4EV10LwARCzaAHCN8rxXSObZ4nuHmjm7VnZXKGcOoLWp4TG+jquZ2VvhcqB6XP5jFu0MLvKqMYTf0di+1hElD6cwpnaF/TOXpBz63Fs7ibBOVqe/RdHk7VmnzHzwhYgA7AQ4nlfGu0+R4LsFWVJmG2iQ55MbgladGIq/12pG4Yzwo/vQRa81OT458UHBjheY+QEtntTibGvNnKZmFtcKPpxSOkH4QV8LhK8rxt9YTI0hlKSmm6oSafzKvIcoAp7bWUNU/rmM8zJXHV5mqnBzgwL/zh7yhAGG7OrFsex2ZxilcHCtW7FbWUfk0Ncdl9odOq4Xhs3Hr22666tSypvFlDLCEHHhPt+msqxb25sngmIQvWePbqmrpOpQ49UuiNHoY5aAYvNXFkwOey6ZA1yNufTy9NBxy+0fcm9XalWwlvXDiTTW6sqgYfP5lKPx4bpw6p2kbav5k29pp/3QN+kpr6DKth8lZlm+cBES35ZLCU/u1WPRPIjTBlnssIqnJNAtP2VCiS1hExiCv+0gCPr7GespGnvvrru+iHdhkDZqT3YgfiFqw4Tau1zNvbsyGtIpeZlJI8wX13GyoA+V2tpbM1CW4eKG6K+keUGvUxXoV5KpJRDMXyoojVvw+N0qH0P8p2Lttbu2TX5b8lAyBEOj1iMo7EnY+WhyCDIw5OvcXYdyY08yMjKPSeyWpbJ5oPrZmWvkfgc+mBfxaQ/o97p7oIKsI855fzFllBnYgLdhEv8tlgm89ASAUABFj2lEK42RkjJF3JCgtlZb1WrsT6FkAk0vEUxqVgk5dGQUiKe5+9byttkf/LmlAjBsv32/e+Sjqcr/WtfLiDzainQCmsvIJtkQyDM1Q3Re72aXb5VBA8Nft4iQVfgNFknHINQfu/72/4zhl8fOGryTlaKPm/AAzPFqrSn0xLOM2ZxJs7BTIqj+aXFxmpvzEAtiaK0blBRHPD/vOkqtb0RWxE4Ywt/MFCE8zlU7UvDXOy9LH8o34a38lFwuZj7RgIuNA9++FgBiE9ShCeRCwmCAKiyxy/0nY5ffs3mHgTKVv2LeA4a8eHqqatyQ4P3wJ9sjj7AGNMa/Kb7BysR6CS9QqfeViBs2f+X7YLOu5tM1j2V40LoDVKScyYbVE8ssGMOiS2YOpo072gabxfFS0b4rutW4VmmSEonN5fg567F4tyiqi7URjm5ic773mWZoX7zo4m/KReIEjLJzl89umX/OYKfOmg+rViRiuzu2cYSRWo+8/oo+gfuYfysSIWO2rWMgBjE2WNmkkpIko9WRnNXkuIyj7Do4t53itaIIcxHeT4s2hssKS5csRf9egGF4x7jKlQgZWq+/jtBYvmC/bzjKkTQYhKKjR8AvJ0GyfOsYBH6gveN0Tu/YyvX6wPv52fPZ4oYYDoxU+LT08jU3rSKDwzlO5/2KLtc6iNVhuhvrE+Z9basEH6MlC2ueL34aeR7DKYet7sJu7YPMfehtChGLd5Xn9YOTkEqWhF+2iFK08mk3r/QbwQJ3w1OibcLrJ/YXuyQNYmP+riOKJgfxjlK+AySjFbOH9g6Qqo0Dj16HJCGTkeioTMK/WHTNZdJ6CRBIIJ/EMjZm7QP5RwTZyGuomh63FkMqxCKo1bv0V/LV4a821HWDg9wlY4YYoGYvyPd9nc8HiFiwivifV5l1dPw2QUjSwZb+Q0tzEf1g+Ve6Z9mDxboB57/lT1aHA5nyvOHRo/4z5zTvEWdfGbQ6O3QhzkKmQrXyBk1fxjCgJ6X/oPQNCHwds3hJUm/YlY46GWDdGBJT08A/44jYmLvZsqzMROV9jLIbh4L4QPlF6C5yDIuS6me8OtVH5K5PbvJmDk4boym1S4BoBeW04uTV2ajbdafN58v8FrmMMwE8zH+naWD8L+YBpWr9RnnQkm/Oz+PGwaOD9yOhMix7BllnN7OtuGBzrzb2jClkQSsBiJQbHdObLimQTpC77Grn7J5JLFELAZEmsl6ceTexssiFA47tPWKBrC1ogyHmn/nCgnQdqA7fKnmjrDBzQDBYIeKm2Id4TshuvIkerpG5WNIm7MuUOcYhU8CpYr8IzpPxB/xnj0l/2cMMwqJpImHvXR0U/kGWPkHUhm2nJE4aQgXkyvzbyjLpIy4/1FAGhc0h8DIWhivn0e1t20CBjgPi6LqBf1lHuRHDpFeXdrotDY2Bu8mskg2FL/CYqZjgTgV4fB4OwgpgYR2qasmaZ9p/qYhknnT1Y6ojZpSI4vUINOf1t6VWu2h+rtSLll+0XT4pLthWz3UHf0+PSVnDkcOH+QDaNrgMLjahrq7mnevyGRZlzu+NUDQKYT61Ubon/+a/2RZusSkFy+lz8/NmCoTJ1Fm18S7SkOuS6wP53DEepKD4wUpJmTp25FHrk7CdU/KxV9Oj1aDIsFktq6v784lPMNoEu73D9BbbWmzv+R9/yRdOvIxG3sNrz1+A8LNVwxV4FrvUjVhHWX6jn84x1+Me7Zy9vphx2bjCRRaualDZC7PxZ+j7zDWcEmtm+0rUsf1yacI6fXIqQcNOsU+aENIuly05BSRXcQbrmhKARANKSMnpMab6Vvc+A8nW/4dc8AvzmqBXbP4+pTlI1Af55LUSK0DZik8q6Ax1tUbeZYIyLb4nTrePI4TCq6SlE+lNQ29VXJkQ7mZSkdWIER3OZ/Mgz6m2A/zop/FFp78AlDECKAE0Nk5UPWc5v+JPlClufnic4Uz+u8cHDnGKRBsHyFigMe42f95C+NSiPZz6MBnvbycuwzg+lzZuBQmGA7xGdGgxWLiqyq4yl+sqz8KIWhN3g91LQAoKNoBoyRtj3RS70dfrEKeVZ9Zz0V4ojtAddBwKrigtioKujlPLRU2ZPjtjf1EvKhyNYuZH1xmoG8tDaqw0pK31mVh8iEQUIkm1m9cl384531/qPZPbXr41dk7uKmaIxVnFLoFFRl8dMBgiEYGLRWr3bnvpAmgeZwN9rWwnqSMAlZwa5TevOAt0cWaRyxJuz7Ex4xd3yXIeonPAdaU+jrAbgNwLc5E65GT8dppbvLRvHX8Fws0cSPhAACvNOBrR+mgUDeTxkkAV3iqcm7eZWjDhWnmJOwZfyj1xxerqYvz6yJvAHvw21w2q5bJ2HmY+yfWZwiUgozOVcxEqGsqfsXLzFgbb7uYq+NylG5dEHuCzYEa+DppsjUqW6QkOT22J/qypL8afybKPhmq9EQ3aILmwozaL3cA7vxwbX5PUtd+O9Vdh8QcY2hkA4XR3tJcZfX7szcNGGLUfHyD4OvVvh7nxDbmZ9YHbtgiPdgZy/o4UFkHzv9ZhfDl6n3CZVrVLEMED4bLarurMWXPR8dhe6sJllX4gpx4Z6KayxK7C3rzilSIL4skLEk9ZGk4vF13fe4eJysRo+z0ULcXF2DBatsdrnkbd6RqaphSj67Hk/mKY3/LMPb4aBGHmtOSvltwIfW6SRxlBnbrxjKNAgL3G8LP+0vke/J9gnIGKhgae2WwG5W+bloBqnmaBDfpeuOgO7lqSrr7b4JGpepwN/cAGRtXoTmJCVMlehNiMr3qi2nvBxf/Wv5jYoRnkkCrnqinuWTpWwTSjqKa+v6uYgj24NEdI9D3PpPbTG/rAsRMR+u1pQcWD9wgQ2vGkZ1hy7GK5Ckqg2pP1RUwIXjFIQppJMN5wpN/btxGjTKXLTh/E+NSpknHpS8sto8AbXEzfkFaK9G4nFTz0mpJkQ7mLmlGiz9NTh997smdjIsUkULzzukVMeaG271WP6dDF3JkW81P/sPRbv8rdOj4Nhi5vshb5gfRRXRRxMtIrarQhXQcVRkDbxHHfgbLcQbd+LkIXYWcRQA+WFsEn31kDkUtQ7yJqCe/GDbm84PBBr+au6lD4FsrXbdu94IHBcJIYwRdX6RE6yqdfWBF0TM1w6xGl0kTO0Yo9vegXhtIuCfL7nR9/ZJ6vJ2yViURQlAVKx9/cZOvWUCTC4GQRWAYVbA/Xhd/bFRXB2GlHg/bXO3u+GJGUK5IhwWai/W1uuzjuqr/O+lmoVw5a0onZGdCTSjlWv0CLRJKrJluV6yFyfmtc0r+EXUas3eIsW95sWrmVz109ZC+W2Y28Klhd7M51u5FtTsFf9WMWntAmzCTUqd/xdmspgsmSlnb25imHStr9Sy7rWFEwPBzYCoKbKlsDSHygqCSaQ6AaBtPsAg6Wm6MytxcWK05kxJyiui6LBew0x6Lsp8SsIk1QJpVTXXjtj6cWFaTfVtn+Tsd9wCKaFM42XZ0+pSF6xga/4GOO9BdQFhh2Di5XylxIXzSEijCxOsTK730Ezk06PHzHtU5fSHcUCyV2i8lachKyOeecZMkEEtDw30ioAc1N4xJKdxABwQWJ7x8W4J++8OICc+2DPZzsc8uZBRDy1RtaosvvVtXM+Hw2DylXr1NP24c=--1q/VxHxNFhXoc6ww--9GukuKAAjsRsVuc4yILM9g== \ No newline at end of file diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index 3c16e299..93c4923f 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -10,50 +10,53 @@ # Many of these configuration options can be set straight in your model. Devise.setup do |config| - idp_login_url = Rails.application.credentials.staging_idp_sso_target_url - idp_logout_url = Rails.application.credentials.staging_idp_slo_target_url - idp_fingerprint = Rails.application.credentials.staging_idp_cert_fingerprint consumer_service_url = Rails.application.credentials.dev_assertion_consumer_service_url entity_id = Rails.application.credentials.dev_entity_id + idp_sso_service_url = Rails.application.credentials.dev_idp_sso_service_url + idp_logout_url = Rails.application.credentials.dev_idp_slo_target_url + idp_entity_id = Rails.application.credentials.dev_idp_entity_id + idp_cert = Rails.application.credentials.dig(:okta, :dev_idp_cert) if Rails.env.staging? consumer_service_url = Rails.application.credentials.staging_assertion_consumer_service_url entity_id = Rails.application.credentials.staging_entity_id + idp_sso_service_url = Rails.application.credentials.staging_idp_sso_service_url + idp_logout_url = Rails.application.credentials.staging_idp_slo_target_url + idp_entity_id = Rails.application.credentials.staging_idp_entity_id + idp_cert = Rails.application.credentials.dig(:okta, :staging_idp_cert) end if Rails.env.production? - idp_login_url = Rails.application.credentials.production_idp_sso_target_url - idp_logout_url = Rails.application.credentials.production_idp_slo_target_url - idp_fingerprint = Rails.application.credentials.production_idp_cert_fingerprint consumer_service_url = Rails.application.credentials.production_assertion_consumer_service_url entity_id = Rails.application.credentials.production_entity_id + idp_sso_service_url = Rails.application.credentials.production_idp_sso_service_url + idp_logout_url = Rails.application.credentials.production_idp_slo_target_url + idp_entity_id = Rails.application.credentials.production_idp_entity_id + idp_cert = Rails.application.credentials.dig(:okta, :production_idp_cert) end - config.omniauth :saml, - :assertion_consumer_service_url => consumer_service_url, - :issuer => entity_id, - :idp_sso_service_url => idp_login_url, - :idp_slo_service_url => idp_logout_url, - :name_identifier_format => "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", - :attribute_statements => {email: ['urn:oid:0.9.2342.19200300.100.1.3'], - name: ['urn:oid:2.16.840.1.113730.3.1.241'], - uid: ['urn:oid:0.9.2342.19200300.100.1.1'], - person_affiliation: ['urn:oid:1.3.6.1.4.1.5923.1.1.1.1'], - principal_name: ['urn:oid:1.3.6.1.4.1.5923.1.1.1.6']}, - :request_attributes => {}, - :idp_cert_fingerprint => idp_fingerprint, - :idp_cert_fingerprint_algorithm => 'http://www.w3.org/2000/09/xmldsig#sha256', - :allowed_clock_drift => 10, - :private_key => Rails.application.credentials.service_provider_private_key, - :certificate => Rails.application.credentials.service_provider_certificate, - :security => {want_assertions_signed: true, want_assertions_encrypted: true} - - # The secret key used by Devise. Devise uses this key to generate - # random tokens. Changing this key will render invalid all existing - # confirmation, reset password and unlock tokens in the database. - # Devise will use the `secret_key_base` as its `secret_key` - # by default. You can change it below and use your own secret key. - # config.secret_key = '4209afd3273dd9bfdfd2ae4cf0b9686a494d0178ff1c19d4897e83f2095d0bbbc119c9093c378d04cd4f75a7542f7c5c2eccf907ba46915cbe7ee6281772c8cc' + service_provider_private_key = Rails.application.credentials.service_provider_private_key + service_provider_certificate = Rails.application.credentials.service_provider_certificate + + saml_options = { + assertion_consumer_service_url: consumer_service_url, + issuer: entity_id, + idp_entity_id: idp_entity_id, + idp_sso_service_url: idp_sso_service_url, + idp_slo_service_url: idp_logout_url, + idp_cert: idp_cert, + name_identifier_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", + private_key: service_provider_private_key, + certificate: service_provider_certificate, + security: {want_assertions_signed: true, want_assertions_encrypted: true}, + attribute_statements: { + email: ['email', 'mail', 'User.Email'], + first_name: ['first_name', 'User.FirstName'], + last_name: ['last_name', 'User.LastName'] + } + }.compact + + config.omniauth :saml, saml_options # ==> Controller configuration # Configure the parent class to the devise controllers.