From nobody Wed May 3 15:56:48 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9541B126FB3 for ; Wed, 3 May 2017 15:56:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.701 X-Spam-Level: X-Spam-Status: No, score=0.701 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NOblGqs2M2Xd for ; Wed, 3 May 2017 15:56:45 -0700 (PDT) Received: from mail-qt0-x234.google.com (mail-qt0-x234.google.com [IPv6:2607:f8b0:400d:c0d::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 500D312426E for ; Wed, 3 May 2017 15:56:45 -0700 (PDT) Received: by mail-qt0-x234.google.com with SMTP id n4so3312005qte.2 for ; Wed, 03 May 2017 15:56:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=P1KSNLMxYvCZ0Se7YHYWPdJeyDFT/J0Tk0z1z4Wm/4s=; b=p/BdKmWZLCywWnVYsWwKL8bKjM/SrOHJTqk3L509bUxRpMzKvo36yt/wcuYBNDmCBD N7CMGQtLjypSOLyrtmY39yKHjXHBr67ROuM45tqBeIQzPRMRIKLjgg8Xty5hlbOnr7K9 P3vwWhACPO9cuSlNNbntJvGWRKlz426z/FK9rh/hyWyhKKGUTtYoQu90dR7eILvXXA5T 8sJokZUU8I6lPINIgbV+4FyW7UQBy2ANPuNYbkCKA55J+Jb/cLtTJwCPETjwfx0W/gwG Tc9yJmG+j/cpkbMXv/kn8Zd21+lbZ/U46K7LtrXXs/ppQ8zD5+crnVvSbbYLmpCsoWiQ 6Qww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=P1KSNLMxYvCZ0Se7YHYWPdJeyDFT/J0Tk0z1z4Wm/4s=; b=D0aXR6wh00lAgWes8V5DcYdTjUMLtoc0BBDsAnuBlzKJB8UBaKNNr0kR21/ch7azWJ t4AV6ofv792YTVMR5vLbYE5eQ0Ff5M80XisjFEzTk+VZL9m3shUlY0RDxJXqti4kWTbE jSkTKMw+nxxleXmtI/FXHTjnhyglFxMwZmIfed9QAUvBCFTv0hTsNXkQQln1uZKxjsUd xceG0VGEzopKfMRMafpH+mZf8jhHbyIx2u6IZDaAYEt53V0ou8tspnNSFDSkJZdKY2Pu DPaf5NCKFYyNKDAPXxMR/YkFM1WxiPXVdhNNJesInryJl6urWv6TnM3aqD68ymQXimxG TgvQ== X-Gm-Message-State: AN3rC/70qB6NgUP8HCDj2wLmfzFfrESIHmGxNDJ5UvmJy/BiG/oDLqxF YEKMYsE8BS067/3nnzXLqC9jAvE//w== X-Received: by 10.200.53.187 with SMTP id k56mr7730910qtb.104.1493852204430; Wed, 03 May 2017 15:56:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.237.61.6 with HTTP; Wed, 3 May 2017 15:56:23 -0700 (PDT) From: Dick Hardt Date: Wed, 3 May 2017 15:56:23 -0700 Message-ID: To: Phil Hunt , Marius Scurtescu Cc: SecEvent , Yaron Sheffer Content-Type: multipart/alternative; boundary=001a113f276cfe00ba054ea69152 Archived-At: Subject: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 May 2017 22:56:47 -0000 --001a113f276cfe00ba054ea69152 Content-Type: text/plain; charset=UTF-8 Phil / Marius At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope. Checking in on the status of the use case document. Would you provide an update when you have a chance? /Dick --001a113f276cfe00ba054ea69152 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Phil / Marius

At the Chicago meeting, t= he two of you agreed to work on a document containing use cases you conside= red to be relevant for secevent so that the WG could decide which ones were= in scope and which ones were out of scope.

Checki= ng in on the status of the use case document. Would you provide an update w= hen you have a chance?

/Dick

--001a113f276cfe00ba054ea69152-- From nobody Wed May 3 16:17:01 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B60812778E for ; Wed, 3 May 2017 16:16:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.322 X-Spam-Level: X-Spam-Status: No, score=-2.322 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SKFtmmJOaKuj for ; Wed, 3 May 2017 16:16:52 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E158127871 for ; Wed, 3 May 2017 16:16:52 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v43NGnr0003872 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 May 2017 23:16:49 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v43NGnw2007778 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 May 2017 23:16:49 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v43NGmuK030825; Wed, 3 May 2017 23:16:49 GMT Received: from [192.168.3.209] (/207.140.26.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 03 May 2017 16:16:48 -0700 From: Phil Hunt Message-Id: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_6E3BBB6F-156D-4085-AC09-3722248F324B" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 3 May 2017 16:16:47 -0700 In-Reply-To: Cc: Marius Scurtescu , Yaron Sheffer , SecEvent To: Dick Hardt References: X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 May 2017 23:16:54 -0000 --Apple-Mail=_6E3BBB6F-156D-4085-AC09-3722248F324B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii My understanding was you wanted informal cases not IDs. The SCIM cases = have been posted to the mailing list. I believe Marius is close on the = RISC cases. Phil Oracle Corporation, Identity Cloud Services Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On May 3, 2017, at 3:56 PM, Dick Hardt wrote: >=20 > Phil / Marius >=20 > At the Chicago meeting, the two of you agreed to work on a document = containing use cases you considered to be relevant for secevent so that = the WG could decide which ones were in scope and which ones were out of = scope. >=20 > Checking in on the status of the use case document. Would you provide = an update when you have a chance? >=20 > /Dick >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-= DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwO= Tc&e=3D=20 --Apple-Mail=_6E3BBB6F-156D-4085-AC09-3722248F324B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii My understanding was you wanted informal cases not IDs. The = SCIM cases have been posted to the mailing list. I believe Marius is = close on the RISC cases.

Phil

Oracle = Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Phil / Marius

At the Chicago meeting, the two of you agreed to work on a = document containing use cases you considered to be relevant for secevent = so that the WG could decide which ones were in scope and which ones were = out of scope.

Checking in on the status of the use case document. Would you = provide an update when you have a chance?

/Dick

_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY= _A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D

= --Apple-Mail=_6E3BBB6F-156D-4085-AC09-3722248F324B-- From nobody Wed May 3 16:31:34 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52FF7128959 for ; Wed, 3 May 2017 16:31:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id staRvQ5-0DU6 for ; Wed, 3 May 2017 16:31:31 -0700 (PDT) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48F661287A0 for ; Wed, 3 May 2017 16:31:31 -0700 (PDT) Received: by mail-qk0-x235.google.com with SMTP id n4so1537589qkc.0 for ; Wed, 03 May 2017 16:31:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=uoVn25GDSFfauZAWao0sSYckPehz7oWtzz2zhaRp/gI=; b=MfA2iouFXKDlqaSWTbyBPDTT8lAAfTUSork3uQ2PTbwt2uIUYHAc1i6KJ1fRYdHNjD szYFqefOAwjGIxCAHlPwvCpdezdkBTEAfDlA4UUxf30nnVf4pc3CegGeX1QymNylD1wS tyrgEkh6lXAWEBEcAKDdH/WT/u4YLfCb09QPC4SjvfqbkdJxOO8oCLs0JyUam0L9zCI/ nEDqzKfUIKpsbDzyCg0v3YPitPDDnVHhb0aazor+onVnaa5rcT49B+wNnyIEg8P+LgbA +1/EyJ6OKu0y4+dmVY7ZESKEvhRUYCshmdr8F4CbYZaFM2R4ds4vidS6nigZ+v+GYR/r kYXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=uoVn25GDSFfauZAWao0sSYckPehz7oWtzz2zhaRp/gI=; b=eqMVZbNb/Et3JIWjrx2upONs51p0fiULOPrIkPFBWu2jFVSaih4VbU5qfibamSovdd xNTQQ/M0Jegc+/sZZxGBHdl5CCWmeYoIFKYeS6DHErKb7PPREVLZ/jjiU7nEmuqqbR5Q lDxVSnVNXOphn9pYIdWgr5TL4LN/J2Id01dI748IrL6f9/9Z1w/2q1tWzBtrIItScX6v yVpj2y+/ZnbL7DdOq/cN+mxQApQ36I4IpUx0jnJ3annAAhhR1HOoGFzAXvDR/rD3MIb+ 3Kr00nD4bcrE5qvWkzVBTlElgV1HnNbxJ6ofPUjVm0kdTy5HNO0rffTaZ+KHhq3PldSj MH8Q== X-Gm-Message-State: AN3rC/43kQ7BuMWsJEfg+k9zHhp/EXl4lrnPaBhi1d3OT/dqxvgSTUyZ NMzUzEaqICHIVDX/NtVXg/g+BLXavw== X-Received: by 10.55.215.145 with SMTP id t17mr5833096qkt.78.1493854290386; Wed, 03 May 2017 16:31:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.237.61.6 with HTTP; Wed, 3 May 2017 16:31:09 -0700 (PDT) In-Reply-To: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> From: Dick Hardt Date: Wed, 3 May 2017 16:31:09 -0700 Message-ID: To: Phil Hunt Cc: Marius Scurtescu , Yaron Sheffer , SecEvent Content-Type: multipart/alternative; boundary=001a11499eb2532833054ea70ea6 Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 May 2017 23:31:33 -0000 --001a11499eb2532833054ea70ea6 Content-Type: text/plain; charset=UTF-8 Hi Phil per https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBcI you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose. On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: > All, > > Dick asked me if I would enumerate the SCIM use cases. Here is the SCIM > case. Happy to put these somewhere in a working group document. On Wed, May 3, 2017 at 4:16 PM, Phil Hunt wrote: > My understanding was you wanted informal cases not IDs. The SCIM cases > have been posted to the mailing list. I believe Marius is close on the RISC > cases. > > Phil > > Oracle Corporation, Identity Cloud Services Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > On May 3, 2017, at 3:56 PM, Dick Hardt wrote: > > Phil / Marius > > At the Chicago meeting, the two of you agreed to work on a document > containing use cases you considered to be relevant for secevent so that the > WG could decide which ones were in scope and which ones were out of scope. > > Checking in on the status of the use case document. Would you provide an > update when you have a chance? > > /Dick > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=https-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c= > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r= > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=HWdy4Q9fHAYB3f- > DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=JTwCxbXPzY_A62IiywTMIjRB- > XsMY8UPafBs4oPwOTc&e= > > > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a11499eb2532833054ea70ea6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

you offered to put them in= a WG doc (see quate below). Would that not be an ID. Also, as I read over = the document, it is hard to follow what the use cases are as it is very ver= bose.

On =
Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt <phil.hunt@oracle.com>=
; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SC=
IM
> case. Happy to put these somewhere in a working group document.
<= /div>

On Wed= , May 3, 2017 at 4:16 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases = have been posted to the mailing list. I believe Marius is close on the RISC= cases.

Phil
=
<= div>
Oracle Corporation, Identity Cloud Services Architect &a= mp; Standards
@independentid
phi= l.hunt@oracle.com
=

On May 3, 20= 17, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Phil / Marius

At the Chicago me= eting, the two of you agreed to work on a document containing use cases you= considered to be relevant for secevent so that the WG could decide which o= nes were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an = update when you have a chance?

/Dick

_______________________________________________
Id-event mailing li= st
Id-event@ietf.= org
https:= //urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mai= lman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjW= wlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2o= HuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e= =3D



--
Subscribe to the HARDTWARE mail list to learn about projects I am working on= !
--001a11499eb2532833054ea70ea6-- From nobody Wed May 3 16:39:32 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3C0E127B60 for ; Wed, 3 May 2017 16:39:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.232 X-Spam-Level: X-Spam-Status: No, score=-2.232 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KZUmSHkZ5iee for ; Wed, 3 May 2017 16:39:29 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72CBE127873 for ; Wed, 3 May 2017 16:39:29 -0700 (PDT) Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v43NdQ2e012628 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 May 2017 23:39:27 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v43NdQmo017187 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 May 2017 23:39:26 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v43NdQgx017292; Wed, 3 May 2017 23:39:26 GMT Received: from [192.168.3.209] (/207.140.26.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 03 May 2017 16:39:25 -0700 From: Phil Hunt Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_884C5758-8C18-404B-9C6B-4AF55B5516EC" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 3 May 2017 16:39:24 -0700 In-Reply-To: Cc: Yaron Sheffer , SecEvent , Marius Scurtescu To: Dick Hardt References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0021.oracle.com [156.151.31.71] Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 May 2017 23:39:31 -0000 --Apple-Mail=_884C5758-8C18-404B-9C6B-4AF55B5516EC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Depends on what the WG wants. Email cases, Github posted document, Individual IDs posted to the working group, or an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has = RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft = https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03). Let us know what form and what format. We can also use one for OpenID Backchannel Logout. This is particularly = important because it will be triggered by (or is related to) SCIM and by = RISC events such as account resets, authentication factor changes etc. Phil Oracle Corporation, Identity Cloud Services Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On May 3, 2017, at 4:31 PM, Dick Hardt wrote: >=20 > Hi Phil >=20 > per=20 >=20 > = https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBcI= = >=20 > you offered to put them in a WG doc (see quate below). Would that not = be an ID. Also, as I read over the document, it is hard to follow what = the use cases are as it is very verbose. >=20 > On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt = ; wrote: >=20 > > All, > > > > Dick asked me if I would enumerate the SCIM use cases. Here is the = SCIM > > case. Happy to put these somewhere in a working group document. >=20 > On Wed, May 3, 2017 at 4:16 PM, Phil Hunt > wrote: > My understanding was you wanted informal cases not IDs. The SCIM cases = have been posted to the mailing list. I believe Marius is close on the = RISC cases. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect & Standards > @independentid > www.independentid.com = phil.hunt@o= racle.com >> On May 3, 2017, at 3:56 PM, Dick Hardt > wrote: >>=20 >> Phil / Marius >>=20 >> At the Chicago meeting, the two of you agreed to work on a document = containing use cases you considered to be relevant for secevent so that = the WG could decide which ones were in scope and which ones were out of = scope. >>=20 >> Checking in on the status of the use case document. Would you provide = an update when you have a chance? >>=20 >> /Dick >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-= DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwO= Tc&e=3D = =20 >=20 >=20 >=20 >=20 > --=20 > Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItf= plrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuC= S8&e=3D=20 --Apple-Mail=_884C5758-8C18-404B-9C6B-4AF55B5516EC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Depends on what the WG wants.

Email cases,
Github posted document,
Individual IDs = posted to the working group, or
an ID that gets = adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM = itself had RFC7642, Oauth had a WG draft https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03).=

Let us know = what form and what format.

We can also use one for OpenID Backchannel Logout.  This = is particularly important because it will be triggered by (or is related = to) SCIM and by RISC events such as account resets, authentication = factor changes etc.

Phil

Oracle Corporation, Identity Cloud = Services Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Hi Phil

per 

https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2O= jEBjCZ9cBcI

you offered to put them in a WG doc = (see quate below). Would that not be an ID. Also, as I read over the = document, it is hard to follow what the use cases are as it is very = verbose.

On =
Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt <phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the =
SCIM
> case. Happy to put these somewhere in a working group =
document.

On Wed, May 3, 2017 at 4:16 PM, Phil Hunt <phil.hunt@oracle.com> = wrote:
My understanding was you = wanted informal cases not IDs. The SCIM cases have been posted to the = mailing list. I believe Marius is close on the RISC cases.

Phil
<= div style=3D"word-wrap:break-word" class=3D"">

Oracle = Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, = Dick Hardt <dick.hardt@gmail.com> wrote:

Phil / Marius

At the Chicago meeting, the two of you agreed to work on a = document containing use cases you considered to be relevant for secevent = so that the WG could decide which ones were in scope and which ones were = out of scope.

Checking in on the status of the use case document. Would you = provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D




--
Subscribe to the HARDTWARE mail list to = learn about projects I am working = on!
_______________________________________________
Id-event = mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9= vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D

= --Apple-Mail=_884C5758-8C18-404B-9C6B-4AF55B5516EC-- From nobody Wed May 3 16:46:21 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAAB7128B8E for ; Wed, 3 May 2017 16:46:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.71 X-Spam-Level: X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vUld0cAfBeMP for ; Wed, 3 May 2017 16:46:17 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1170C128959 for ; Wed, 3 May 2017 16:46:17 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id n4so1724762qkc.0 for ; Wed, 03 May 2017 16:46:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=zHBiMwlka0tCZjYNpktOcGDZXLh5XjGL4cC3eOIYH/g=; b=dP3eOoViQMfksRiTMe6w58liq7x4VPFmLU4J3Ux1m+SpDG1qCCXKMIWMrbZolH+BGC 19wygLWMpe5Br1iWvYQKmR9QP1PDObd+gG8mOP1CiMvcabekxWZphgavw3Ey9GPTjZl5 snvN1PaflO1CCUhZXz9IYUXrWQNMB8VNEugADWKj4ch4Wv4vi3wtoFZfEFGq3l53q8ch fRlVg3qsXvV+byUqZ13SwsvckwZRCx6zEQt8UB2hhARdcvbXs7ugfWISZV/o+Hxug+JL MbJhocA7yX6c4ThPzVD8BntuSrLjSLDPUo4/oxKcN6MlCdw11eb20rq/JqdSlkiBgxF1 CPGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=zHBiMwlka0tCZjYNpktOcGDZXLh5XjGL4cC3eOIYH/g=; b=bk52a531/vCzvP8z6q4x1Mf67qTkwCyKlGQMjBJ+CtK9OXhVYc/VpbrXdyDPTVEjpi MRRL8knBsY4Bfzn6C5mqvmUb2fWfugHI3v6lEEqmtCL020MEDY5C/USW8u82I3aSfrDn Ze8hMTGPUU5IUtP0752cDa/aQDw/RtXLMAIIGSP5UoMFLlU4kb/eB2zb/yaImezkwXiw ctdb3F/sjz+dmrC9Rrc5HjDXcDT/6ph1ohao3Z4IDpWLagAUVmJJXYT6GzVf6TMnmYi4 VuQ7RsAVguN5qzC3JLAeTLIo1xW7WCdKvlqvmPF0HLsX3sWWr+3qcMS01kWvuVbyw7kM hBzw== X-Gm-Message-State: AN3rC/5ZCBbpbocuIuxRXSoGQr923xZlqFvw4/Lzw083BAqI2jLWA1HK fOUq5p0JuoQTQkCZ/A0+xUnPM1A0Qw== X-Received: by 10.55.165.85 with SMTP id o82mr5153398qke.82.1493855176168; Wed, 03 May 2017 16:46:16 -0700 (PDT) MIME-Version: 1.0 Received: by 10.237.61.6 with HTTP; Wed, 3 May 2017 16:45:55 -0700 (PDT) In-Reply-To: References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> From: Dick Hardt Date: Wed, 3 May 2017 16:45:55 -0700 Message-ID: To: Phil Hunt Cc: Yaron Sheffer , SecEvent , Marius Scurtescu Content-Type: multipart/alternative; boundary=94eb2c062aa41f1984054ea743bd Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 May 2017 23:46:20 -0000 --94eb2c062aa41f1984054ea743bd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable As the more experienced chair, I will defer to Yaron for guidance. So far no one has expected it to be adopted as an RFC On Wed, May 3, 2017 at 4:39 PM, Phil Hunt wrote: > Depends on what the WG wants. > > Email cases, > Github posted document, > Individual IDs posted to the working group, or > an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has > RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft > https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03). > > Let us know what form and what format. > > We can also use one for OpenID Backchannel Logout. This is particularly > important because it will be triggered by (or is related to) SCIM and by > RISC events such as account resets, authentication factor changes etc. > > Phil > > Oracle Corporation, Identity Cloud Services Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > > On May 3, 2017, at 4:31 PM, Dick Hardt wrote: > > Hi Phil > > per > > https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBc= I > > > you offered to put them in a WG doc (see quate below). Would that not be > an ID. Also, as I read over the document, it is hard to follow what the u= se > cases are as it is very verbose. > > On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: > > > All, > > > > Dick asked me if I would enumerate the SCIM use cases. Here is the SCI= M > > case. Happy to put these somewhere in a working group document. > > > On Wed, May 3, 2017 at 4:16 PM, Phil Hunt wrote: > >> My understanding was you wanted informal cases not IDs. The SCIM cases >> have been posted to the mailing list. I believe Marius is close on the R= ISC >> cases. >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect & Standards >> @independentid >> www.independentid.com >> >> phil.hunt@oracle.com >> >> On May 3, 2017, at 3:56 PM, Dick Hardt wrote: >> >> Phil / Marius >> >> At the Chicago meeting, the two of you agreed to work on a document >> containing use cases you considered to be relevant for secevent so that = the >> WG could decide which ones were in scope and which ones were out of scop= e. >> >> Checking in on the status of the use case document. Would you provide an >> update when you have a chance? >> >> /Dick >> >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7 >> g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D >> >> >> > > > -- > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > bAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3D > fzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D > > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --94eb2c062aa41f1984054ea743bd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
As the more experienced chair, I will defer to Yaron for g= uidance.

So far no one has expected it to be adopted as = an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt <phil.hunt@oracle.com>= ; wrote:
Depends on what the WG wants.

Emai= l cases,
Github posted document,
Individual IDs posted = to the working group, or
an ID that gets adopted as a WG draft to= end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth h= ad a WG draft https://tools.ietf.org/html/draft-ietf-oaut= h-use-cases-03).

Let us know what form an= d what format.

We can also use one for OpenID Back= channel Logout.=C2=A0 This is particularly important because it will be tri= ggered by (or is related to) SCIM and by RISC events such as account resets= , authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
phil.hunt@oracle.co= m

On Ma= y 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Hi Phil

per=C2=A0


you= offered to put them in a WG doc (see quate below). Would that not be an ID= . Also, as I read over the document, it is hard to follow what the use case= s are as it is very verbose.

On Tue, Apr 18, 2017 at 11:27 AM, =
Phil Hunt <phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SC=
IM
> case. Happy to put these somewhere in a working group document.
<= /div>

On Wed= , May 3, 2017 at 4:16 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases = have been posted to the mailing list. I believe Marius is close on the RISC= cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
Phil / Marius

At the Chicago meeting, the two= of you agreed to work on a document containing use cases you considered to= be relevant for secevent so that the WG could decide which ones were in sc= ope and which ones were out of scope.

Checking in = on the status of the use case document. Would you provide an update when yo= u have a chance?

/Dick

<= /div>
_______________________________________________
Id-event mailing li= st
Id-event@ietf.= org
https:= //urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mai= lman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZ= YR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjW= wlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g= &s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D
=




--
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing li= st
Id-event@ietf.= org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.= ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1Y= umCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkIT= SeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAhF<= wbr>4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVb= uCS8&e=3D




--
Subscribe to the HARDTWARE mail list to learn about projects I am = working on!
--94eb2c062aa41f1984054ea743bd-- From nobody Wed May 3 21:57:19 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D3D91293F3 for ; Wed, 3 May 2017 21:57:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.232 X-Spam-Level: X-Spam-Status: No, score=-2.232 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iwK_3iC6mhPR for ; Wed, 3 May 2017 21:57:15 -0700 (PDT) Received: from dmz-mailsec-scanner-7.mit.edu (dmz-mailsec-scanner-7.mit.edu [18.7.68.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B145129B36 for ; Wed, 3 May 2017 21:57:14 -0700 (PDT) X-AuditID: 12074424-633ff7000000195c-11-590ab4a8c776 Received: from mailhub-auth-2.mit.edu ( [18.7.62.36]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id 4C.BC.06492.8A4BA095; Thu, 4 May 2017 00:57:12 -0400 (EDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-2.mit.edu (8.13.8/8.9.2) with ESMTP id v444vALV026386; Thu, 4 May 2017 00:57:11 -0400 Received: from [192.168.3.128] (c-69-181-139-182.hsd1.ca.comcast.net [69.181.139.182]) (authenticated bits=0) (User authenticated as jricher@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v444v5tt014352 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 4 May 2017 00:57:07 -0400 From: Justin Richer Message-Id: <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> Content-Type: multipart/alternative; boundary="Apple-Mail=_3438C97A-4288-4C0E-BC18-CAC61C0A8086" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 3 May 2017 21:57:04 -0700 In-Reply-To: Cc: Phil Hunt , Yaron Sheffer , SecEvent , Marius Scurtescu To: Dick Hardt References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> X-Mailer: Apple Mail (2.3273) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrEKsWRmVeSWpSXmKPExsUixG6nortiC1ekwaPXMhaPZxZZdCzoZrK4 dXYNk8WC+Y3sFqvuz2B3YPXYOesuu8eCTaUeS5b8ZPL4+PQWSwBLFJdNSmpOZllqkb5dAlfG h44/rAUfrjBWHL93kbmB8fo+xi5GTg4JAROJ2afnsHUxcnEICbQxSSxeeokZwtnAKNG9cQo7 SJWQwCUmifPnRUFsNgFVielrWpi6GDk4eAWsJC63u4GEmQWSJG5Pe8IMEdaX6H0ONl9YQFNi 09TPjCBhFgEViUe/S0HCnAKBEl3bj7JCdM5hlNixwgTEFgEafuBsCwvEBceYJC782MYCcaes xK3Zl5gnMPLPQrJtFsI2iLC2xLKFr5khbE2J/d3LWTDFNSQ6v01kXcDItopRNiW3Sjc3MTOn ODVZtzg5MS8vtUjXXC83s0QvNaV0EyM4ClxUdjB293gfYhTgYFTi4Y24zRkpxJpYVlyZe4hR koNJSZRX/RV7pBBfUn5KZUZicUZ8UWlOavEhRgkOZiUR3iUruSKFeFMSK6tSi/JhUtIcLEri vOIajRFCAumJJanZqakFqUUwWRkODiUJXpPNQI2CRanpqRVpmTklCGkmDk6Q4TxAw/tAaniL CxJzizPTIfKnGC05rrR+fM/EsaHjG5Ds+/TnPZMQS15+XqqUOK8CSIMASENGaR7cTFBSc93a ve0VozjQi8K8/SBVPMCECDf1FdBCJqCFzbIcIAtLEhFSUg2Mm6Kee3/Qu9vLd+5dw8mDm/mE cvgbhETDwp/4LpOtLD2q9NbaOGeZ6MOyeJENV0tfmPYz3RNUM28r2yx9+NTbhsj+S9u8X4Wq r3KY+rrng7brUw2vb6aXUgV4RGVWbtV8s+7TJ4baNRNVbSOX//2e8u1Wpfaz91Xbr5qtmn7z AOdto1VdgjWNSizFGYmGWsxFxYkAMVtIt0UDAAA= Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 May 2017 04:57:18 -0000 --Apple-Mail=_3438C97A-4288-4C0E-BC18-CAC61C0A8086 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 In fact, I=E2=80=99m going to ask that we *not* push a use cases = document toward RFC. Use case documents are wonderful tools for guiding = development, but should be discarded as artifacts of that process once = said process is completed (or even well on its way). As such, RFC, wiki, blog post, or anything referenced from the list and = easily findable works. =E2=80=94 Justin > On May 3, 2017, at 4:45 PM, Dick Hardt wrote: >=20 > As the more experienced chair, I will defer to Yaron for guidance. >=20 > So far no one has expected it to be adopted as an RFC >=20 > On Wed, May 3, 2017 at 4:39 PM, Phil Hunt > wrote: > Depends on what the WG wants. >=20 > Email cases, > Github posted document, > Individual IDs posted to the working group, or > an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has = RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft = https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03 = ). >=20 > Let us know what form and what format. >=20 > We can also use one for OpenID Backchannel Logout. This is = particularly important because it will be triggered by (or is related = to) SCIM and by RISC events such as account resets, authentication = factor changes etc. >=20 > Phil >=20 > Oracle Corporation, Identity Cloud Services Architect & Standards > @independentid > www.independentid.com = phil.hunt@oracle.com = >> On May 3, 2017, at 4:31 PM, Dick Hardt > wrote: >>=20 >> Hi Phil >>=20 >> per=20 >>=20 >> = https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBcI= = >>=20 >> you offered to put them in a WG doc (see quate below). Would that not = be an ID. Also, as I read over the document, it is hard to follow what = the use cases are as it is very verbose. >>=20 >> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt = ; wrote: >>=20 >> > All, >> > >> > Dick asked me if I would enumerate the SCIM use cases. Here is the = SCIM >> > case. Happy to put these somewhere in a working group document. >>=20 >> On Wed, May 3, 2017 at 4:16 PM, Phil Hunt > wrote: >> My understanding was you wanted informal cases not IDs. The SCIM = cases have been posted to the mailing list. I believe Marius is close on = the RISC cases. >>=20 >> Phil >>=20 >> Oracle Corporation, Identity Cloud Services Architect & Standards >> @independentid >> www.independentid.com = phil.hunt@o= racle.com >>> On May 3, 2017, at 3:56 PM, Dick Hardt > wrote: >>>=20 >>> Phil / Marius >>>=20 >>> At the Chicago meeting, the two of you agreed to work on a document = containing use cases you considered to be relevant for secevent so that = the WG could decide which ones were in scope and which ones were out of = scope. >>>=20 >>> Checking in on the status of the use case document. Would you = provide an update when you have a chance? >>>=20 >>> /Dick >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-= DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwO= Tc&e=3D = =20 >>=20 >>=20 >>=20 >>=20 >> --=20 >> Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItf= plrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuC= S8&e=3D = =20 >=20 >=20 >=20 >=20 > --=20 > Subscribe to the HARDTWARE mail list to learn = about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = --Apple-Mail=_3438C97A-4288-4C0E-BC18-CAC61C0A8086 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 In fact, I=E2=80=99m going to ask that we *not* push a use = cases document toward RFC. Use case documents are wonderful tools for = guiding development, but should be discarded as artifacts of that = process once said process is completed (or even well on its way).

As such, RFC, wiki, blog = post, or anything referenced from the list and easily findable = works.

 =E2= =80=94 Justin

On May 3, 2017, at 4:45 PM, = Dick Hardt <dick.hardt@gmail.com> wrote:

As = the more experienced chair, I will defer to Yaron for guidance.

So far no one has = expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, = Phil Hunt <phil.hunt@oracle.com> wrote:
Depends on = what the WG wants.

Email cases,
Github posted = document,
Individual IDs posted to the working = group, or
an ID that gets adopted as a WG draft to = end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth = had a WG draft https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03).

Let us know what form = and what format.

We can also use one for OpenID Backchannel Logout.  This = is particularly important because it will be triggered by (or is related = to) SCIM and by RISC events such as account resets, authentication = factor changes etc.

Phil

Oracle Corporation, Identity Cloud = Services Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 3, 2017, at 4:31 PM, Dick Hardt = <dick.hardt@gmail.com> wrote:

Hi Phil

per 

https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBcI

you offered to put them = in a WG doc (see quate below). Would that not be an ID. Also, as I read = over the document, it is hard to follow what the use cases are as it is = very verbose.

On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt =
<phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the =
SCIM
> case. Happy to put these somewhere in a working group =
document.

On Wed, May 3, 2017 at 4:16 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
My understanding was you = wanted informal cases not IDs. The SCIM cases have been posted to the = mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & = Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 3, 2017, at = 3:56 PM, Dick Hardt <dick.hardt@gmail.com> = wrote:

Phil / = Marius

At the = Chicago meeting, the two of you agreed to work on a document containing = use cases you considered to be relevant for secevent so that the WG = could decide which ones were in scope and which ones were out of = scope.

Checking = in on the status of the use case document. Would you provide an update = when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D 




-- 
Subscribe to the HARDTWARE mail list to learn about = projects I am working = on!
_____________________________= __________________
Id-event mailing = list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D 




-- 
Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_3438C97A-4288-4C0E-BC18-CAC61C0A8086-- From nobody Thu May 4 03:36:24 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D34F12E85E for ; Thu, 4 May 2017 03:36:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.99 X-Spam-Level: X-Spam-Status: No, score=0.99 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P9JX5uwFJkVE for ; Thu, 4 May 2017 03:36:20 -0700 (PDT) Received: from mail-wr0-x233.google.com (mail-wr0-x233.google.com [IPv6:2a00:1450:400c:c0c::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13045129ACC for ; Thu, 4 May 2017 03:36:20 -0700 (PDT) Received: by mail-wr0-x233.google.com with SMTP id z52so5378991wrc.2 for ; Thu, 04 May 2017 03:36:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to; bh=h8Rs3LSZRl1dswtfAw+U0OQAmv98W1InfLMRUQUuR6w=; b=ffFsGF/vfq41msirBThMmdB3iKlFOw3MEZfKJbu3ZnKR4DnzRBNNceYnTR93byaKdU eCKzpPsg6zeAEPDM4jfv6X4VCwatzo5LEhoXPwrC+MCFZ/YYE8IheqtmRYOhRBohG0Hx uaShxuzw8ei50QofBZH3oP2wrYO2QaqdBbhFYy+Rvpwc/9GWoXVgtCJx9D9yRkV2mozO KDxnuqJEBdYDbevOtz+vLJv37YElnE6yvU6v0/GmC8jWtPEi6h75CLDRCRHY96A/MMmI 0gB8Fgmw/46d7+bLrtc+A1wCbz29roN91W8Da0YmUkoovSu/FhsxqI6gQsvNxsnKhopu fpwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to; bh=h8Rs3LSZRl1dswtfAw+U0OQAmv98W1InfLMRUQUuR6w=; b=Vvblpu2J1aF6YaqoKVz7ojFa1ARKAqhQSsRRNWu3FSYq3rkYp21iENtu/tBWeX5wb9 78ckjuEfx5fTvM0MP2rc54zAYLZyrkGOHkMTa32xUBBJjRV6RfKrIFaKOkGPRS1kPR7a iM3hOUKg4Ygz9nzs2DCdSEqZcYbMw+NjQIPNVC/r3JH64/hH1OQ6Og29Xpxxis73+G5O 58u0imTvvsiMKlpi6zhiVwXARdCGYz6qY0HOvOwInqPgi6sHl9pwyG6LQDFVDfgPtKdZ lENWD8XbjUgwbOaZDYRhE4Ldt/Ww6wPI56oDYOJHf4aK0C0Mhn5UmOuwtuPNMGzSjdq7 iFcA== X-Gm-Message-State: AN3rC/7KJC6ZOe8VYxihKsmHwe1o94lEbAJS3qxr6rZUiJPN7eRor9i/ W8jzNt4ZfCUw0w== X-Received: by 10.223.169.230 with SMTP id b93mr28375782wrd.196.1493894178551; Thu, 04 May 2017 03:36:18 -0700 (PDT) Received: from [172.18.133.122] (cowboy3.intuit.com. [65.204.229.13]) by smtp.gmail.com with ESMTPSA id c184sm932858wmd.2.2017.05.04.03.36.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 04 May 2017 03:36:17 -0700 (PDT) To: Justin Richer , Dick Hardt References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> Cc: Phil Hunt , SecEvent , Marius Scurtescu From: Yaron Sheffer Message-ID: Date: Thu, 4 May 2017 13:36:10 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> Content-Type: multipart/alternative; boundary="------------36E8FD8C8CBC2065E1EC65FF" Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 May 2017 10:36:23 -0000 This is a multi-part message in MIME format. --------------36E8FD8C8CBC2065E1EC65FF Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes. Thanks, Yaron On 04/05/17 07:57, Justin Richer wrote: > In fact, I’m going to ask that we *not* push a use cases document > toward RFC. Use case documents are wonderful tools for guiding > development, but should be discarded as artifacts of that process once > said process is completed (or even well on its way). > > As such, RFC, wiki, blog post, or anything referenced from the list > and easily findable works. > > — Justin > >> On May 3, 2017, at 4:45 PM, Dick Hardt > > wrote: >> >> As the more experienced chair, I will defer to Yaron for guidance. >> >> So far no one has expected it to be adopted as an RFC >> >> On Wed, May 3, 2017 at 4:39 PM, Phil Hunt> >wrote: >> >> Depends on what the WG wants. >> >> Email cases, >> Github posted document, >> Individual IDs posted to the working group, or >> an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE >> has RFC7165, and SCIM itself had RFC7642, Oauth had a WG >> drafthttps://tools.ietf.org/html/draft-ietf-oauth-use-cases-03 >> ). >> >> Let us know what form and what format. >> >> We can also use one for OpenID Backchannel Logout. This is >> particularly important because it will be triggered by (or is >> related to) SCIM and by RISC events such as account resets, >> authentication factor changes etc. >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect & Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >>> On May 3, 2017, at 4:31 PM, Dick Hardt >> > wrote: >>> >>> Hi Phil >>> >>> per >>> >>> https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBcI >>> >>> >>> you offered to put them in a WG doc (see quate below). Would >>> that not be an ID. Also, as I read over the document, it is hard >>> to follow what the use cases are as it is very verbose. >>> >>> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: >>> >>> > All, >>> > >>> > Dick asked me if I would enumerate the SCIM use cases. Here is the SCIM >>> > case. Happy to put these somewhere in a working group document. >>> >>> On Wed, May 3, 2017 at 4:16 PM, Phil Hunt>> >wrote: >>> >>> My understanding was you wanted informal cases not IDs. The >>> SCIM cases have been posted to the mailing list. I believe >>> Marius is close on the RISC cases. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect & >>> Standards >>> @independentid >>> www.independentid.com >>> >>> phil.hunt@oracle.com >>> >>>> On May 3, 2017, at 3:56 PM, Dick Hardt >>>> > wrote: >>>> >>>> Phil / Marius >>>> >>>> At the Chicago meeting, the two of you agreed to work on a >>>> document containing use cases you considered to be relevant >>>> for secevent so that the WG could decide which ones were in >>>> scope and which ones were out of scope. >>>> >>>> Checking in on the status of the use case document. Would >>>> you provide an update when you have a chance? >>>> >>>> /Dick >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=HWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=JTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e= >>>> >>> >>> >>> >>> >>> -- >>> Subscribe to theHARDTWARE >>> mail >>> list to learn about projects I am working on! >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=bAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=fzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e= >>> >> >> >> >> >> -- >> Subscribe to theHARDTWARE mail list to learn >> about projects I am working on! >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event > --------------36E8FD8C8CBC2065E1EC65FF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes.

Thanks,

    Yaron


On 04/05/17 07:57, Justin Richer wrote:
In fact, I’m going to ask that we *not* push a use cases document toward RFC. Use case documents are wonderful tools for guiding development, but should be discarded as artifacts of that process once said process is completed (or even well on its way).

As such, RFC, wiki, blog post, or anything referenced from the list and easily findable works.

 — Justin

On May 3, 2017, at 4:45 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

As the more experienced chair, I will defer to Yaron for guidance.

So far no one has expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Depends on what the WG wants.

Email cases,
Github posted document,
Individual IDs posted to the working group, or
an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03).

Let us know what form and what format.

We can also use one for OpenID Backchannel Logout.  This is particularly important because it will be triggered by (or is related to) SCIM and by RISC events such as account resets, authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
phil.hunt@oracle.com
On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Hi Phil

per 


you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose.

On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt <phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SCIM
> case. Happy to put these somewhere in a working group document.

On Wed, May 3, 2017 at 4:16 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases have been posted to the mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Phil / Marius

At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=HWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=JTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e= 




-- 
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=bAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=fzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e= 




-- 
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--------------36E8FD8C8CBC2065E1EC65FF-- From nobody Thu May 4 08:25:49 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE1241293D8 for ; Thu, 4 May 2017 08:25:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.452 X-Spam-Level: X-Spam-Status: No, score=-0.452 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kr3vOCUe0C_H for ; Thu, 4 May 2017 08:25:45 -0700 (PDT) Received: from mail-it0-x22d.google.com (mail-it0-x22d.google.com [IPv6:2607:f8b0:4001:c0b::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80AF812EAA4 for ; Thu, 4 May 2017 08:25:42 -0700 (PDT) Received: by mail-it0-x22d.google.com with SMTP id x188so13558341itb.0 for ; Thu, 04 May 2017 08:25:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=fRbZL0XYoRMY92/IDDu4uv7ekxKVIqC1y34VIkBc8sA=; b=vHMhVsMe4lwAmxMA4wWkWBkGGv2Fx4RggGjDwKkxNd1h06fuMYqldy1zE4MbH7Iykr Tob/nAjv2HWUkkV3joGhiLolqty/48pdXgqTtwSYTQVvFblcXVnN8se1rQuMcG05qtXB QgORB0O/Z77cOABq/F9CyCImK60HV9BUvNjJGDbtZnAu+a8u572C2a6AI8BpplkkKYjQ 0aZIVpmHiJbjnSfFgw06gkalRovlbboYYvLO8b7lR+ddeu803/RzYHuCexfQ8bqmm9oZ Pgm7CZOMrA6IiD+r/KdoiDyT2RKukgq3mYYlJqSNE0nh55OT1sOUb3UBhIK7muzbG9NI yIxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=fRbZL0XYoRMY92/IDDu4uv7ekxKVIqC1y34VIkBc8sA=; b=jcgjqIVXOj+69i5PT+xd9FfdtuAvxzxxrbqFgc5lY2G5mg55XVk4BIPfHh8cSfwm6W exuUDPrA6eGkrf7tEJpsPeHOiyntQXKCWU0t1H0Q2MO8G3nvmcm5QSKzDmGMj0ml/0/R v7DL77lSYj3i5RH6kfpH3oxuwRsZz+7KGRooZ72DQ5TT/djkMFbgL31wBLoePYsW6V+m c0k38N1gL8hNmdgwlpTqbw02N1NV3lk+TamVXbDW8pZtJ/HMduVvYlnFTCI4K4KnMBT8 zXfJgkDptm3V7MsrF2LVQj118AwGrn/gw1WMa+7nU4uWHWajypE9Jb/bgpxQhOSd80I5 7aKA== X-Gm-Message-State: AN3rC/63LD7YIGm1THJ2kb0aIBIxGVQapT4WLloS++yoroOA/KV0y5MS mdL+4+OdhveQdb8ll65Xrx3sYHgRpOc9 X-Received: by 10.36.67.200 with SMTP id s191mr3070212itb.78.1493911540076; Thu, 04 May 2017 08:25:40 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.10.202 with HTTP; Thu, 4 May 2017 08:25:19 -0700 (PDT) In-Reply-To: References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> From: Marius Scurtescu Date: Thu, 4 May 2017 08:25:19 -0700 Message-ID: To: Yaron Sheffer Cc: Justin Richer , Dick Hardt , Phil Hunt , SecEvent Content-Type: multipart/alternative; boundary=001a113fa312ac81ca054eb462a9 Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 May 2017 15:25:48 -0000 --001a113fa312ac81ca054eb462a9 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Do we need one document for all use cases (all profiles) or one for each profiles? I am happy to create the one document or the one for RISC (if one per profile). Marius On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer wrote= : > My strong preference would be an individual I-D that (as Justin says) wil= l > NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks > are used to, and it is referenced from the WG agenda and minutes. > > Thanks, > > Yaron > > On 04/05/17 07:57, Justin Richer wrote: > > In fact, I=E2=80=99m going to ask that we *not* push a use cases document= toward > RFC. Use case documents are wonderful tools for guiding development, but > should be discarded as artifacts of that process once said process is > completed (or even well on its way). > > As such, RFC, wiki, blog post, or anything referenced from the list and > easily findable works. > > =E2=80=94 Justin > > On May 3, 2017, at 4:45 PM, Dick Hardt wrote: > > As the more experienced chair, I will defer to Yaron for guidance. > > So far no one has expected it to be adopted as an RFC > > On Wed, May 3, 2017 at 4:39 PM, Phil Hunt wrote: > >> Depends on what the WG wants. >> >> Email cases, >> Github posted document, >> Individual IDs posted to the working group, or >> an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has >> RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft >> https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03). >> >> Let us know what form and what format. >> >> We can also use one for OpenID Backchannel Logout. This is particularly >> important because it will be triggered by (or is related to) SCIM and by >> RISC events such as account resets, authentication factor changes etc. >> >> Phil >> >> Oracle Corporation, Identity Cloud Services Architect & Standards >> @independentid >> www.independentid.com >> phil.hunt@oracle.com >> >> On May 3, 2017, at 4:31 PM, Dick Hardt wrote: >> >> Hi Phil >> >> per >> >> https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKe >> q2OjEBjCZ9cBcI >> >> >> you offered to put them in a WG doc (see quate below). Would that not be >> an ID. Also, as I read over the document, it is hard to follow what the = use >> cases are as it is very verbose. >> >> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: >> >> > All, >> > >> > Dick asked me if I would enumerate the SCIM use cases. Here is the SC= IM >> > case. Happy to put these somewhere in a working group document. >> >> >> On Wed, May 3, 2017 at 4:16 PM, Phil Hunt wrote: >> >>> My understanding was you wanted informal cases not IDs. The SCIM cases >>> have been posted to the mailing list. I believe Marius is close on the = RISC >>> cases. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect & Standards >>> @independentid >>> www.independentid.com >>> >>> phil.hunt@oracle.com >>> >>> On May 3, 2017, at 3:56 PM, Dick Hardt wrote: >>> >>> Phil / Marius >>> >>> At the Chicago meeting, the two of you agreed to work on a document >>> containing use cases you considered to be relevant for secevent so that= the >>> WG could decide which ones were in scope and which ones were out of sco= pe. >>> >>> Checking in on the status of the use case document. Would you provide a= n >>> update when you have a chance? >>> >>> /Dick >>> >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g >>> &s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D >>> >>> >>> >> >> >> -- >> Subscribe to the HARDTWARE >> >> mail list to learn about projects I am working on! >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz >> jWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4 >> Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D >> >> >> > > > -- > Subscribe to the HARDTWARE mail list to learn > about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > > --001a113fa312ac81ca054eb462a9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Do we need one document for all use cases (all profiles) o= r one for each profiles?

I am happy to create the one do= cument or the one for RISC (if one per profile).

Marius

On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffe= r <yaronf.ietf@gmail.com> wrote:
=20 =20 =20

My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes.

Thanks,

=C2=A0=C2=A0=C2=A0 Yaron


On 04/05/17 07:57, = Justin Richer wrote:
=20 In fact, I=E2=80=99m going to ask that we *not* push a use cases docu= ment toward RFC. Use case documents are wonderful tools for guiding development, but should be discarded as artifacts of that process once said process is completed (or even well on its way).

As such, RFC, wiki, blog post, or anything referenced from the list and easily findable works.

=C2=A0=E2=80=94 Justin

On May 3, 2017, at 4:45 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

As the more experienced chair, I will defer to Yaron for guidance.

So far no one has expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt=C2=A0<phil.hunt@oracle.com>=C2=A0wrote:
Depends on what the WG wants.

Email cases,
Github posted document,
Individual IDs posted to the working group, or
an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft=C2=A0https://tools.ietf.org/html/dra= ft-ietf-oauth-use-cases-03).

Let us know what form and what format.

We can also use one for OpenID Backchannel Logout.=C2=A0 This is particularly important because it will be triggered by (or is related to) SCIM and by RISC events such as account resets, authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independent= id
phil.hunt@oracle.com

On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Hi Phil

per=C2=A0


you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose. 

On Tue, =
Apr 18, 2017 at 11:27 AM, Phil Hunt <phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SC=
IM
> case. Happy to put these somewhere in a working group document.

On Wed, May 3, 2017 at 4:16 PM, Phil Hunt=C2=A0<phil= .hunt@oracle.com>=C2=A0wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases have been posted to the mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independent= id
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Phil= / Marius

At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/= url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d= =3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3= f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-X= sMY8UPafBs4oPwOTc&e=3D=C2=A0




--=C2=A0
Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am working on!
____________________________________= ___________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__ww= w.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP= 1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0Fk= ITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAh= F4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS= 8&e=3D= =C2=A0




--=C2=A0
Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am working on!
________________________= _______________________
Id-event mailing list
Id-event@ie= tf.org
https://www.ietf.org/mailman/listinfo/id-event



--001a113fa312ac81ca054eb462a9-- From nobody Thu May 4 11:28:38 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B49D5127978 for ; Thu, 4 May 2017 11:28:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.55 X-Spam-Level: X-Spam-Status: No, score=0.55 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1vxIroEgxzJU for ; Thu, 4 May 2017 11:28:28 -0700 (PDT) Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 765C0126C25 for ; Thu, 4 May 2017 11:28:27 -0700 (PDT) Received: by mail-wm0-x231.google.com with SMTP id m123so3311133wma.0 for ; Thu, 04 May 2017 11:28:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to; bh=mxDSdNBSbQpsidSLNDKzN+GJ0cN58Ruzg4r2GpwvWKA=; b=gbiJRR3zf4wwD3G/S31lxEZMFTpWgKuvBDP7EgMKVk+8xrKX1xW9L/wReItTW1uRfK Lv67XqL0vGsYIUxj3Ur1lIHmSx4IvxGtsUKL91VPj/tueQjf5NFPYpfN9ZTQhFVVLEuS vI4tZSsJHO9A8Ro9SAPE2sfbT2mr9RM72pCZ48z+G6/Ku+z6ABgBgD9z5v0tT4he/AZM B+ArWgV+XCflaJODdHAB5DFwiVG1UYFt8JtVQNjwMm9R2tl7m5XNvfnMyL2Kivb2R6O/ yKJcOt6yUjTlFkj+XUlGhjds1OLVzpekvELIwz6E0jE0GHIhZQ4AHVmswo1lctGYKNbH Bjcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to; bh=mxDSdNBSbQpsidSLNDKzN+GJ0cN58Ruzg4r2GpwvWKA=; b=Z3zqqGlho46xdlTxdpbcaVudNabhY7MPqpyZ60bg8qJvj6xlheaAlATwt7Bg5ytLMF pnu+LH5xU+hpFzu0X3VxYWI7TYeuvxHmcTcPKYbSQpsu9JFaMRUl3LbjS/2d10wY+rOn EXWf8FkEhLPyubzi1vqbOfHRkns4fANd641DXqJuQrkttPvcjMMLQTojiaQujN1pNQku Tc54FdZ9w+bXmP645pQyyZzsniG0rK6xqBjkIGq01i8u0CODLCQ+S+0P1dcjfak8IS97 znFmIfmlx6+1GpGjpxyL3jK+7CefOwi1u4L1t3Phis3+J5yHvqtn0Yq7brWc0I4oUFLB FabA== X-Gm-Message-State: AN3rC/7dQgl7zGKBHw7cVFkWN1ML8/qcFJP0+inzqTC9tBfiMrx04t0p 1n6XtM/TtB5/PA== X-Received: by 10.28.47.23 with SMTP id v23mr2850580wmv.50.1493922505890; Thu, 04 May 2017 11:28:25 -0700 (PDT) Received: from [10.0.0.14] (bzq-109-65-143-171.red.bezeqint.net. [109.65.143.171]) by smtp.gmail.com with ESMTPSA id y16sm4002881wry.46.2017.05.04.11.28.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 04 May 2017 11:28:25 -0700 (PDT) To: Marius Scurtescu References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> Cc: Justin Richer , Dick Hardt , Phil Hunt , SecEvent From: Yaron Sheffer Message-ID: <10de4c6f-c0a7-9d9f-c524-fa87048dd580@gmail.com> Date: Thu, 4 May 2017 21:28:23 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------259787E26C1D5F88CA37005A" Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 May 2017 18:28:31 -0000 This is a multi-part message in MIME format. --------------259787E26C1D5F88CA37005A Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Whatever works for you - and that's the whole point of *individual* I-Ds. Thanks, Yaron On 04/05/17 18:25, Marius Scurtescu wrote: > Do we need one document for all use cases (all profiles) or one for > each profiles? > > I am happy to create the one document or the one for RISC (if one per > profile). > > Marius > > On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer > wrote: > > My strong preference would be an individual I-D that (as Justin > says) will NOT be pushed to RFC. Why an I-D at all? Because this > is what IETF folks are used to, and it is referenced from the WG > agenda and minutes. > > Thanks, > > Yaron > > > On 04/05/17 07:57, Justin Richer wrote: >> In fact, I’m going to ask that we *not* push a use cases document >> toward RFC. Use case documents are wonderful tools for guiding >> development, but should be discarded as artifacts of that process >> once said process is completed (or even well on its way). >> >> As such, RFC, wiki, blog post, or anything referenced from the >> list and easily findable works. >> >> — Justin >> >>> On May 3, 2017, at 4:45 PM, Dick Hardt >> > wrote: >>> >>> As the more experienced chair, I will defer to Yaron for guidance. >>> >>> So far no one has expected it to be adopted as an RFC >>> >>> On Wed, May 3, 2017 at 4:39 PM, Phil Hunt>> >wrote: >>> >>> Depends on what the WG wants. >>> >>> Email cases, >>> Github posted document, >>> Individual IDs posted to the working group, or >>> an ID that gets adopted as a WG draft to end up as RFC (e.g. >>> JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a >>> WG >>> drafthttps://tools.ietf.org/html/draft-ietf-oauth-use-cases-03 >>> ). >>> >>> Let us know what form and what format. >>> >>> We can also use one for OpenID Backchannel Logout. This is >>> particularly important because it will be triggered by (or >>> is related to) SCIM and by RISC events such as account >>> resets, authentication factor changes etc. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect & >>> Standards >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> >>>> On May 3, 2017, at 4:31 PM, Dick Hardt >>>> > wrote: >>>> >>>> Hi Phil >>>> >>>> per >>>> >>>> https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBjCZ9cBcI >>>> >>>> >>>> you offered to put them in a WG doc (see quate below). >>>> Would that not be an ID. Also, as I read over the document, >>>> it is hard to follow what the use cases are as it is very >>>> verbose. >>>> >>>> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: >>>> >>>> > All, >>>> > >>>> > Dick asked me if I would enumerate the SCIM use cases. Here is the SCIM >>>> > case. Happy to put these somewhere in a working group document. >>>> >>>> On Wed, May 3, 2017 at 4:16 PM, Phil >>>> Hunt>wrote: >>>> >>>> My understanding was you wanted informal cases not IDs. >>>> The SCIM cases have been posted to the mailing list. I >>>> believe Marius is close on the RISC cases. >>>> >>>> Phil >>>> >>>> Oracle Corporation, Identity Cloud Services Architect & >>>> Standards >>>> @independentid >>>> www.independentid.com >>>> >>>> phil.hunt@oracle.com >>>> >>>>> On May 3, 2017, at 3:56 PM, Dick Hardt >>>>> > >>>>> wrote: >>>>> >>>>> Phil / Marius >>>>> >>>>> At the Chicago meeting, the two of you agreed to work >>>>> on a document containing use cases you considered to >>>>> be relevant for secevent so that the WG could decide >>>>> which ones were in scope and which ones were out of scope. >>>>> >>>>> Checking in on the status of the use case document. >>>>> Would you provide an update when you have a chance? >>>>> >>>>> /Dick >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=HWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=JTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e= >>>>> >>>> >>>> >>>> >>>> >>>> -- >>>> Subscribe to theHARDTWARE >>>> mail >>>> list to learn about projects I am working on! >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=bAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=fzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e= >>>> >>> >>> >>> >>> >>> -- >>> Subscribe to theHARDTWARE mail list to >>> learn about projects I am working on! >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >> > > --------------259787E26C1D5F88CA37005A Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit

Whatever works for you - and that's the whole point of *individual* I-Ds.

Thanks,

    Yaron


On 04/05/17 18:25, Marius Scurtescu wrote:
Do we need one document for all use cases (all profiles) or one for each profiles?

I am happy to create the one document or the one for RISC (if one per profile).

Marius

On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes.

Thanks,

    Yaron


On 04/05/17 07:57, Justin Richer wrote:
In fact, I’m going to ask that we *not* push a use cases document toward RFC. Use case documents are wonderful tools for guiding development, but should be discarded as artifacts of that process once said process is completed (or even well on its way).

As such, RFC, wiki, blog post, or anything referenced from the list and easily findable works.

 — Justin

On May 3, 2017, at 4:45 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

As the more experienced chair, I will defer to Yaron for guidance.

So far no one has expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
Depends on what the WG wants.

Email cases,
Github posted document,
Individual IDs posted to the working group, or
an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03).

Let us know what form and what format.

We can also use one for OpenID Backchannel Logout.  This is particularly important because it will be triggered by (or is related to) SCIM and by RISC events such as account resets, authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
phil.hunt@oracle.com
On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Hi Phil

per 


you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose.

On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt <phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SCIM
> case. Happy to put these somewhere in a working group document.

On Wed, May 3, 2017 at 4:16 PM, Phil Hunt <phil.hunt@oracle.com> wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases have been posted to the mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Phil / Marius

At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=HWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=JTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e= 




-- 
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=bAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=fzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e= 




-- 
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event




--------------259787E26C1D5F88CA37005A-- From nobody Sun May 7 14:49:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DDE212773A; Sun, 7 May 2017 14:49:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.021 X-Spam-Level: X-Spam-Status: No, score=-1.021 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QiKm96_fAqNJ; Sun, 7 May 2017 14:49:52 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CFB5126B7F; Sun, 7 May 2017 14:49:50 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v47Lnlbu014621 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 7 May 2017 21:49:48 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v47Lnk0h001186 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sun, 7 May 2017 21:49:47 GMT Received: from abhmp0015.oracle.com (abhmp0015.oracle.com [141.146.116.21]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v47LnknK022473; Sun, 7 May 2017 21:49:46 GMT Received: from [10.0.1.7] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Sun, 07 May 2017 14:49:46 -0700 From: Phil Hunt Content-Type: multipart/alternative; boundary="Apple-Mail=_76C4B00E-8E65-49CE-B103-85C8304D3B12" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Message-Id: Date: Sun, 7 May 2017 14:49:44 -0700 Cc: Kathleen Moriarty , "scim@ietf.org WG" To: ID Events Mailing List X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: [Id-event] Plan for distribution draft for IETF99 Prague X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 May 2017 21:49:53 -0000 --Apple-Mail=_76C4B00E-8E65-49CE-B103-85C8304D3B12 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi all, Marius and I have been doing a lot of discussion since the last IETF = meeting and with various folks. Going forwards, Marius and I plan to do the following: 1. Data Plane - The distribution draft will be cut down to cover the = data plane - delivery of events (ietf-hunt-secevents-delivery). It will = be expanded to include polling of one or more events via HTTP GET to = address firewall use cases. Marius and I believe there is reasonably consensus on this (though some = are confused). The distribution draft will cover all cases from SCIM, = RISC, and Backchannel Logout.=20 The Data plane will define and describe the Verification event, how it = is used and validated for both push and poll. The spec will not cover = how or when a transmitter decides to initiate verification as this is = assumed to be part of the control plane. Important: The data plane is not and will not be based on SCIM. The objective of this draft is to allow near term implementation and = piloting to move forward.=20 Monitoring and automated provisioning will be part of a new draft=E2=80=A6= . 2. Control Plane - new alternate proposal Marius has offered to produce a new draft (e.g. = ietf-scurtescu-secevent-stream-mgmt) as a brand new Control Plane = proposal. Since part of the problem with the original proposal was a lack of = consensus on the requirements for the control plane, I would encourage = discussion on the features of the control plane now. For example: * How a stream is registered/defined (CREATE) * How a stream is validated (verification) * How a stream is monitored including indication of transmission = problems (READ) * How a stream configuration can be updated (e.g. credential rotation = or endpoint change) (UPDATE) * How a stream can be paused or stopped (UPDATE) * How to delete a stream- (DELETE) * Meta data including issuer and receiver public key sets (e.g. = jwks_Uri) * Some generic discussion of credentials for HTTP authentication * =46rom a data perspective: - what event types are in a stream? - what subjects are part of a stream and how are they managed (see = use cases) - how is this modelled and managed? - can a receiver inquire if a subject is enrolled? - what are the different identifiers that can be used: subject, = email, telephone, etc? * How is the control api extensible to support the various profiling = specs that will use the SEC EVENTS control plane draft? ps. I am stepping down from participating as an author or editor in the = control plane draft going forwards. Regards, Phil Oracle Corporation, Identity Cloud Services Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = --Apple-Mail=_76C4B00E-8E65-49CE-B103-85C8304D3B12 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Hi all,

Marius and I have been doing a lot of = discussion since the last IETF meeting and with various folks.

Going forwards, Marius = and I plan to do the following:

1.  Data Plane - The distribution = draft will be cut down to cover the data plane -  delivery of = events (ietf-hunt-secevents-delivery). It will be expanded to include = polling of one or more events via HTTP GET to address firewall use = cases.

Marius = and I believe there is reasonably consensus on this (though some are = confused). The distribution draft will cover all cases from SCIM, RISC, = and Backchannel Logout. 

The Data plane will define and describe = the Verification event, how it is used and validated for both push and = poll. The spec will not cover how or when a transmitter decides to = initiate verification as this is assumed to be part of the control = plane.

Important: The data plane is not and will not be based on = SCIM.

The = objective of this draft is to allow near term implementation and = piloting to move forward. 

Monitoring and automated provisioning = will be part of a new draft=E2=80=A6.

2.  Control Plane - new alternate = proposal
Marius has offered to produce a new draft = (e.g. ietf-scurtescu-secevent-stream-mgmt) as a brand new Control Plane = proposal.

Since = part of the problem with the original proposal was a lack of consensus = on the requirements for the control plane, I would encourage discussion = on the features of the control plane now.

For example:
* =  How a stream is registered/defined (CREATE)
*  How a stream is validated = (verification)
*  How a stream is monitored = including indication of transmission problems (READ)
*  How a stream configuration can be updated (e.g. = credential rotation or endpoint change) (UPDATE)
* =  How a stream can be paused or stopped (UPDATE)
*  How to delete a stream- (DELETE)
*  Meta data including issuer and = receiver public key sets (e.g. jwks_Uri)
* =  Some generic discussion of credentials for HTTP = authentication
*  =46rom a data = perspective:
   - what event types are in = a stream?
   - what subjects are part of = a stream and how are they managed (see use cases)
   - how is this modelled and managed?
   - can a receiver inquire if a subject is = enrolled?
   - what are the different = identifiers that can be used: subject, email, telephone, etc?
* How is the control api extensible to support the various = profiling specs that will use the SEC EVENTS control plane = draft?

ps.= I am stepping down from participating as an author or editor in the = control plane draft going forwards.

Regards,

Phil

Oracle = Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

= --Apple-Mail=_76C4B00E-8E65-49CE-B103-85C8304D3B12-- From nobody Sun May 14 19:35:02 2017 Return-Path: X-Original-To: id-event@ietf.org Delivered-To: id-event@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D4F7C12945A; Sun, 14 May 2017 19:34:59 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: Cc: secevent-chairs@ietf.org, yaronf.ietf@gmail.com, Kathleen.Moriarty.ietf@gmail.com, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.50.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149481569977.2788.720203054738048165.idtracker@ietfa.amsl.com> Date: Sun, 14 May 2017 19:34:59 -0700 Archived-At: Subject: [Id-event] secevent - New Meeting Session Request for IETF 99 X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 May 2017 02:35:00 -0000 A new meeting session request has just been submitted by Yaron Sheffer, a Chair of the secevent working group. --------------------------------------------------------- Working Group Name: Security Events Area Name: Security Area Session Requester: Yaron Sheffer Number of Sessions: 1 Length of Session(s): 2 Hours Number of Attendees: 50 Conflicts to Avoid: First Priority: saag jsonbis httpbis dispatch oauth tokbind tls acme Second Priority: ipsecme sacm ace People who must be present: Yaron Sheffer Kathleen Moriarty Dick Hardt Resources Requested: Special Requests: Please avoid cfrg. --------------------------------------------------------- From nobody Wed May 17 21:45:18 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3832129BB5 for ; Wed, 17 May 2017 21:45:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.522 X-Spam-Level: X-Spam-Status: No, score=-1.522 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rRvaubBktmn1 for ; Wed, 17 May 2017 21:45:16 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65E1812E03D for ; Wed, 17 May 2017 21:40:46 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4I4eiPl027942 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 18 May 2017 04:40:45 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v4I4ei2p021352 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 18 May 2017 04:40:44 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v4I4eiTn003268 for ; Thu, 18 May 2017 04:40:44 GMT Received: from [192.168.1.13] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 17 May 2017 21:40:44 -0700 From: "Phil Hunt (IDM)" Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (1.0) Date: Wed, 17 May 2017 21:40:42 -0700 Message-Id: To: ID Events Mailing List X-Mailer: iPhone Mail (14E304) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 04:45:17 -0000 In many cases where we are talking about events (eg risc) there is no need f= or extra claims other than the event type itself.=20 It occurs to me that in the case of RP issued events the current sectoken fo= rmat requires an embedded iss to deal with the conflict with the set issuer.= It seems to add a lot of complication for most events.=20 What if we defined a new sectoken top level attribute 'subIss' to mean "subj= ect issuer" and keep iss reserved for the SET issuer.=20 I would suggest this as a recommended attribute even when iss and subIss are= the same for parsing consistency.=20 Thoughts? Phil= From nobody Thu May 18 06:42:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A60126C26 for ; Thu, 18 May 2017 06:42:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.099 X-Spam-Level: X-Spam-Status: No, score=-0.099 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DtChhlMOpZJv for ; Thu, 18 May 2017 06:42:24 -0700 (PDT) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A7B91294D4 for ; Thu, 18 May 2017 06:37:10 -0700 (PDT) Received: by mail-qt0-x22a.google.com with SMTP id v27so34037093qtg.2 for ; Thu, 18 May 2017 06:37:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=ol8qo2HDljbv6dUqORq9eS4XKSYGkTb9OgaNKUSQElI=; b=onlFZgBXAL1kcy1sv7k3JjYUgkKHiVCbyvQp2DVZ1HZRH8zec75i8ca89B3nqeNJVW 5/uHSc5IIO4/KJWba7ycY9AoBnvzPfartRNyb30/Q1InfYrFkPQmvhituUAeAoiWSK7Z OLRwh9hLHtKxnF4AJLwVXCbvV1rSQGTq1NAwOqZEOTLNEkhHGI0Jyw4XInQJWNwkGbrq 8xjvKmyhZS79w+apAS9XKx+siPPJ2zz9QAIFuQ4E5JYtL9Jr36YPUowkyjZANJ0a0cUP h+67pJBLVZEWs/EBDifvJllRKrba2TrTMC/G//H8Vx9f8+mg7w2ozcIoUtsPtuwwq89Y gsGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=ol8qo2HDljbv6dUqORq9eS4XKSYGkTb9OgaNKUSQElI=; b=Oo09PzeiaK9srVM1vilij/+HaoOESckcqBTpwFlyUDXw4QC0P0QJLu8uOy4rBvYDmr 64C99iM52zkMuBeU6GLMlmGX323Xkow+/jDuArmzGt6WzdKgwS0Ftjk1GVVdTB/QuFWH /I9XwtaDZ3ZWVd4rhufna3/L7K1uozaFjE6BqJbhKTAh6xdFDxDKNoHyj2Ju/4uuA+TT vijjnLpNvxmOrpm3agAFIkTazmQAUPpBiaoYWwm1BrcJuYloFxQ5Vb/qYkYKCBdPsriw s2YdMDJOP/2PrsmLqtDp3/+7tCiIU+1v0H4IqR317sSQaHtvywzAWvYDNxR03WaftM8l fadQ== X-Gm-Message-State: AODbwcBEy9ZPHA/3j/BbkZKn5TuGJy5DtU/mDXxTvdMfnyc2NDo0oH8h iWXAmWosvIYiU9RrxVkG3eQPqg5hFQ== X-Received: by 10.200.38.11 with SMTP id u11mr4196909qtu.293.1495114629333; Thu, 18 May 2017 06:37:09 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Dick Hardt Date: Thu, 18 May 2017 13:36:56 +0000 Message-ID: To: ID Events Mailing List , "Phil Hunt (IDM)" Content-Type: multipart/alternative; boundary="001a11411f06614c1d054fcc802c" Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 13:42:26 -0000 --001a11411f06614c1d054fcc802c Content-Type: text/plain; charset="UTF-8" Phil, would you clarify the use case and the requirement to ensure everyone on the list is aligned? Thanks On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) wrote: > In many cases where we are talking about events (eg risc) there is no need > for extra claims other than the event type itself. > > It occurs to me that in the case of RP issued events the current sectoken > format requires an embedded iss to deal with the conflict with the set > issuer. It seems to add a lot of complication for most events. > > What if we defined a new sectoken top level attribute 'subIss' to mean > "subject issuer" and keep iss reserved for the SET issuer. > > I would suggest this as a recommended attribute even when iss and subIss > are the same for parsing consistency. > > Thoughts? > > Phil > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > -- Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a11411f06614c1d054fcc802c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Phil, would you clarify the use case and the requirement to ensure eve= ryone on the list is aligned? Thanks

On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
In many cases where we are talking about events (= eg risc) there is no need for extra claims other than the event type itself= .

It occurs to me that in the case of RP issued events the current sectoken f= ormat requires an embedded iss to deal with the conflict with the set issue= r. It seems to add a lot of complication for most events.

What if we defined a new sectoken top level attribute 'subIss' to m= ean "subject issuer" and keep iss reserved for the SET issuer.
I would suggest this as a recommended attribute even when iss and subIss ar= e the same for parsing consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
--
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
--001a11411f06614c1d054fcc802c-- From nobody Thu May 18 07:36:04 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CF9912951C for ; Thu, 18 May 2017 07:36:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.23 X-Spam-Level: X-Spam-Status: No, score=-2.23 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r3aKxc17q-sD for ; Thu, 18 May 2017 07:36:02 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87DB1129AAD for ; Thu, 18 May 2017 07:30:41 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4IEUdR6027720 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 May 2017 14:30:40 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v4IEUduC005038 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 May 2017 14:30:39 GMT Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v4IEUcH0022597; Thu, 18 May 2017 14:30:39 GMT Received: from [192.168.1.13] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 18 May 2017 07:30:38 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-DD2B9746-02C5-4193-8AE8-4FD07357F52E Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14E304) In-Reply-To: Date: Thu, 18 May 2017 07:30:37 -0700 Cc: ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> References: To: Dick Hardt X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 14:36:04 -0000 --Apple-Mail-DD2B9746-02C5-4193-8AE8-4FD07357F52E Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable ?? Happens in any case where sub is not globally identifiable.=20 In Connect, since sub is not uniquely identified, the iss for the sub must b= e included. This creates a conflict if the issuer of the SET is not the issu= er of the subject.=20 Resolving the iss conflict has been on the list of issues since chicago.=20 In RISC we were discussing account close events. I am assume one of the scen= arios is RPs will notify IDPs when they close an account. They must use an i= ss not associated with sub. As things stand now, they will have to assert th= e extra iss value in their payload---which for most events is complex to par= se since their are no other extra claims.=20 Phil > On May 18, 2017, at 6:36 AM, Dick Hardt wrote: >=20 > Phil, would you clarify the use case and the requirement to ensure everyon= e on the list is aligned? Thanks >=20 >> On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) wr= ote: >> In many cases where we are talking about events (eg risc) there is no nee= d for extra claims other than the event type itself. >>=20 >> It occurs to me that in the case of RP issued events the current sectoken= format requires an embedded iss to deal with the conflict with the set issu= er. It seems to add a lot of complication for most events. >>=20 >> What if we defined a new sectoken top level attribute 'subIss' to mean "s= ubject issuer" and keep iss reserved for the SET issuer. >>=20 >> I would suggest this as a recommended attribute even when iss and subIss a= re the same for parsing consistency. >>=20 >> Thoughts? >>=20 >> Phil >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >=20 > --=20 > Subscribe to the HARDTWARE mail list to learn about projects I am working o= n! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dp1Vsd1Hb7BX87sV4x9M= htsGbORcuiacHxujwThSnWh4&s=3DATYzOXXGto5afit3OgTjh19KczxKCvaBwC7ftofHMrs&e=3D= =20 --Apple-Mail-DD2B9746-02C5-4193-8AE8-4FD07357F52E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
??

Happens in any case where sub is n= ot globally identifiable. 

In Connect, since sub is not uniquely ident= ified, the iss for the sub must be included. This creates a conflict if the i= ssuer of the SET is not the issuer of the subject. 

Resolving the iss c= onflict has been on the list of issues since chicago. 

In RISC we were= discussing account close events. I am assume one of the scenarios is RPs wi= ll notify IDPs when they close an account. They must use an iss not associat= ed with sub. As things stand now, they will have to assert the extra iss val= ue in their payload---which for most events is complex to parse since their a= re no other extra claims. 

Phil

On May 18, 2017, at 6:36= AM, Dick Hardt <dick.hardt@gmail= .com> wrote:

Phil, w= ould you clarify the use case and the requirement to ensure everyone on the l= ist is aligned? Thanks

On Wed,= May 17, 2017 at 9:45 PM Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
In many cases where we are talking about events (eg risc) there is n= o need for extra claims other than the event type itself.

It occurs to me that in the case of RP issued events the current sectoken fo= rmat requires an embedded iss to deal with the conflict with the set issuer.= It seems to add a lot of complication for most events.

What if we defined a new sectoken top level attribute 'subIss' to mean "subj= ect issuer" and keep iss reserved for the SET issuer.

I would suggest this as a recommended attribute even when iss and subIss are= the same for parsing consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org=
htt= ps://www.ietf.org/mailman/listinfo/id-event
--
Subscribe to the HARDTWARE mail list to le= arn about projects I am working on!
= --Apple-Mail-DD2B9746-02C5-4193-8AE8-4FD07357F52E-- From nobody Thu May 18 10:46:36 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 051DC12EB4D for ; Thu, 18 May 2017 10:46:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.031 X-Spam-Level: X-Spam-Status: No, score=-0.031 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oWzy-fQ-8V83 for ; Thu, 18 May 2017 10:46:27 -0700 (PDT) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0129.outbound.protection.outlook.com [104.47.32.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84316120227 for ; Thu, 18 May 2017 10:40:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=DJY6qO0PvpZo5JgHV1rSZZMhsZltv0Nl4OVe8tvhl6M=; b=Fpbu9iut39PmCJO6X/kFwYaqggWvN+0CC25qHsZhUtqraiRWXIKoBZbbRYz2te/kpuSmmwIKWh6BrTJFKKOh7em4rbKtRQGWiheVF6rUWuJiHXPorqCdfltXucOHrN6ZjzTuSs9X+vZ7dA5wzLAO3hCpwlHCa8gfLpdIXGleIEA= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0277.namprd21.prod.outlook.com (10.173.193.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.0; Thu, 18 May 2017 17:40:39 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1124.007; Thu, 18 May 2017 17:40:39 +0000 From: Mike Jones To: "Phil Hunt (IDM)" , Dick Hardt CC: ID Events Mailing List Thread-Topic: [Id-event] Dealing with issuer conflict Thread-Index: AQHSz5GPBeIUkwXJI0S9grGRbpCBVKH6GH8AgAAO/4CAADPHoA== Date: Thu, 18 May 2017 17:40:39 +0000 Message-ID: References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> In-Reply-To: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetBy=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-05-18T10:40:37.4974099-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:3::32c] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0277; 7:1LdXof7YQ+vkoRHspL/4sCSkUz/8sUtgE0UojfV6cvB0Z656rO02vPdnQKprx5PlT4R80kFCofQVVQ2kLnmL60BdSJnYf3I59BSrYBazmptomo25TrtoRbMb+D3XdHB+t384yUhdl7e+TPRZOVASjIvGq1lt2c/rzSI+5Pa8uKJnV/a9hx83CDzZ55xBOyOS7wx15fO6tXCemD36r1acPUHijrCgf8eFX/oSYSnkaOjp4wH7Hp8GBi7PrX6+8jZHgX39r/Ip3aoTIVfAjb84iGVde1Ptf1yHTo1mK0HpA04WjWY6u2UmNGI1PtrGtk44JdxZu3qWHPdGrwTXjd8rvlGahR+TJXa4Ax4gG5LoZik= x-ms-traffictypediagnostic: CY4PR21MB0277: x-ms-office365-filtering-correlation-id: ff0eca2c-d56b-4727-8e3d-08d49e15000b x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:CY4PR21MB0277; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(21748063052155)(21532816269658)(146099531331640)(17755550239193)(5213294742642); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(61425038)(6040450)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006095)(93001095)(100000703036)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123560025)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:CY4PR21MB0277; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:CY4PR21MB0277; x-forefront-prvs: 0311124FA9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39400400002)(39850400002)(39450400003)(39860400002)(39840400002)(39410400002)(377454003)(24454002)(6306002)(77096006)(54896002)(10090500001)(99286003)(966005)(7696004)(55016002)(6506006)(575784001)(9686003)(8676002)(561944003)(606005)(6436002)(86362001)(2950100002)(53936002)(8936002)(2906002)(3660700001)(8990500004)(3280700002)(5005710100001)(86612001)(81166006)(50986999)(478600001)(54356999)(10290500003)(72206003)(76176999)(229853002)(7906003)(33656002)(25786009)(122556002)(4326008)(7736002)(53546009)(5660300001)(6246003)(189998001)(790700001)(6116002)(102836003)(39060400002)(38730400002)(236005)(2900100001)(74316002)(19609705001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0277; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504CBB636CAD1E33158997DF5E40CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2017 17:40:39.6779 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0277 Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 17:46:34 -0000 --_000_CY4PR21MB0504CBB636CAD1E33158997DF5E40CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBiZWxpZXZlIHRoYXQgdGhlIHNvbHV0aW9uIGFscmVhZHkgZGlzY3Vzc2VkIGlzIHRoZSBiZXN0 IG9uZS4gIElmIHRoZSBldmVudCBpc3N1ZXIgaXMgZGlmZmVyZW50IHRoYW4gYSBsb2dpY2FsIGlz c3VlciBhc3NvY2lhdGVkIHdpdGggdGhlIGV2ZW50IHN1YmplY3QsIHRoZW4gcHV0IHRoZSBsb2dp Y2FsIOKAnGlzc+KAnSBhbmQg4oCcc3Vi4oCdIHZhbHVlcyBpbnNpZGUgdGhlIGV2ZW50LiAgQW55 IOKAnHN1YuKAnSBhdCB0aGUgdG9wLWxldmVsIChpZiBhbnkpIHNob3VsZCBiZSBhc3NvY2lhdGVk IHdpdGggdGhlIOKAnGlzc+KAnSBhdCB0aGUgdG9wLWxldmVsLCB3aGljaCBpcyBhbHdheXMgdGhl IGV2ZW50IGlzc3Vlci4NCg0KQW55IHByb3Bvc2FsIHRoYXQgcmVxdWlyZXMgZHVwbGljYXRpbmcg aW5mb3JtYXRpb24sIHN1Y2ggYXMgcmVxdWlyaW5nIOKAnHN1Yklzc+KAnSBldmVuIHdoZW4gaXTi gJlzIGFsd2F5cyBpZGVudGljYWwgdG8g4oCcaXNz4oCdLCBpcyBub3QgYSBncmVhdCBhcmNoaXRl Y3R1cmFsIGNob2ljZSwgc2luY2UgaXQgY3JlYXRlcyB1bm5lY2Vzc2FyeSBlcnJvciBjb25kaXRp b25zIHRoYXQgd291bGQgbm90IG90aGVyd2lzZSBiZSBwb3NzaWJsZS4gIChIb3cgc2hvdWxkIGlt cGxlbWVudGF0aW9ucyBoYW5kbGUgdGhlIGNhc2Ugd2hlcmUgdHdvIHZhbHVlcyBhcmUgcmVxdWly ZWQgdG8gbWF0Y2ggYnV0IGRvbuKAmXQ/KQ0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBJZC1l dmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBQaGls IEh1bnQgKElETSkNClNlbnQ6IFRodXJzZGF5LCBNYXkgMTgsIDIwMTcgNzozMSBBTQ0KVG86IERp Y2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExp c3QgPGlkLWV2ZW50QGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gRGVhbGluZyB3 aXRoIGlzc3VlciBjb25mbGljdA0KDQo/Pw0KDQpIYXBwZW5zIGluIGFueSBjYXNlIHdoZXJlIHN1 YiBpcyBub3QgZ2xvYmFsbHkgaWRlbnRpZmlhYmxlLg0KDQpJbiBDb25uZWN0LCBzaW5jZSBzdWIg aXMgbm90IHVuaXF1ZWx5IGlkZW50aWZpZWQsIHRoZSBpc3MgZm9yIHRoZSBzdWIgbXVzdCBiZSBp bmNsdWRlZC4gVGhpcyBjcmVhdGVzIGEgY29uZmxpY3QgaWYgdGhlIGlzc3VlciBvZiB0aGUgU0VU IGlzIG5vdCB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0Lg0KDQpSZXNvbHZpbmcgdGhlIGlzcyBj b25mbGljdCBoYXMgYmVlbiBvbiB0aGUgbGlzdCBvZiBpc3N1ZXMgc2luY2UgY2hpY2Fnby4NCg0K SW4gUklTQyB3ZSB3ZXJlIGRpc2N1c3NpbmcgYWNjb3VudCBjbG9zZSBldmVudHMuIEkgYW0gYXNz dW1lIG9uZSBvZiB0aGUgc2NlbmFyaW9zIGlzIFJQcyB3aWxsIG5vdGlmeSBJRFBzIHdoZW4gdGhl eSBjbG9zZSBhbiBhY2NvdW50LiBUaGV5IG11c3QgdXNlIGFuIGlzcyBub3QgYXNzb2NpYXRlZCB3 aXRoIHN1Yi4gQXMgdGhpbmdzIHN0YW5kIG5vdywgdGhleSB3aWxsIGhhdmUgdG8gYXNzZXJ0IHRo ZSBleHRyYSBpc3MgdmFsdWUgaW4gdGhlaXIgcGF5bG9hZC0tLXdoaWNoIGZvciBtb3N0IGV2ZW50 cyBpcyBjb21wbGV4IHRvIHBhcnNlIHNpbmNlIHRoZWlyIGFyZSBubyBvdGhlciBleHRyYSBjbGFp bXMuDQoNClBoaWwNCg0KT24gTWF5IDE4LCAyMDE3LCBhdCA2OjM2IEFNLCBEaWNrIEhhcmR0IDxk aWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+PiB3cm90ZToN ClBoaWwsIHdvdWxkIHlvdSBjbGFyaWZ5IHRoZSB1c2UgY2FzZSBhbmQgdGhlIHJlcXVpcmVtZW50 IHRvIGVuc3VyZSBldmVyeW9uZSBvbiB0aGUgbGlzdCBpcyBhbGlnbmVkPyBUaGFua3MNCg0KT24g V2VkLCBNYXkgMTcsIDIwMTcgYXQgOTo0NSBQTSBQaGlsIEh1bnQgKElETSkgPHBoaWwuaHVudEBv cmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbT4+IHdyb3RlOg0KSW4gbWFueSBj YXNlcyB3aGVyZSB3ZSBhcmUgdGFsa2luZyBhYm91dCBldmVudHMgKGVnIHJpc2MpIHRoZXJlIGlz IG5vIG5lZWQgZm9yIGV4dHJhIGNsYWltcyBvdGhlciB0aGFuIHRoZSBldmVudCB0eXBlIGl0c2Vs Zi4NCg0KSXQgb2NjdXJzIHRvIG1lIHRoYXQgaW4gdGhlIGNhc2Ugb2YgUlAgaXNzdWVkIGV2ZW50 cyB0aGUgY3VycmVudCBzZWN0b2tlbiBmb3JtYXQgcmVxdWlyZXMgYW4gZW1iZWRkZWQgaXNzIHRv IGRlYWwgd2l0aCB0aGUgY29uZmxpY3Qgd2l0aCB0aGUgc2V0IGlzc3Vlci4gSXQgc2VlbXMgdG8g YWRkIGEgbG90IG9mIGNvbXBsaWNhdGlvbiBmb3IgbW9zdCBldmVudHMuDQoNCldoYXQgaWYgd2Ug ZGVmaW5lZCBhIG5ldyBzZWN0b2tlbiB0b3AgbGV2ZWwgYXR0cmlidXRlICdzdWJJc3MnIHRvIG1l YW4gInN1YmplY3QgaXNzdWVyIiBhbmQga2VlcCBpc3MgcmVzZXJ2ZWQgZm9yIHRoZSBTRVQgaXNz dWVyLg0KDQpJIHdvdWxkIHN1Z2dlc3QgdGhpcyBhcyBhIHJlY29tbWVuZGVkIGF0dHJpYnV0ZSBl dmVuIHdoZW4gaXNzIGFuZCBzdWJJc3MgYXJlIHRoZSBzYW1lIGZvciBwYXJzaW5nIGNvbnNpc3Rl bmN5Lg0KDQpUaG91Z2h0cz8NCg0KUGhpbA0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5v cmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9pZC1ldmVudDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIv dXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQm ZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9 SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPXAxVnNkMUhiN0JY ODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmcz1BVFl6T1hYR3RvNWFmaXQzT2dUamgx OUtjenhLQ3ZhQndDN2Z0b2ZITXJzJmU9Pg0KLS0NClN1YnNjcmliZSB0byB0aGUgSEFSRFRXQVJF PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19oYXJk dHdhcmUuY29tXyZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09 cDFWc2QxSGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZzPU5HYkNBZkJFbDVU dHNrV2RqaldPWTJjUUpBM0ZzeTlRdm50UG5zdHlJa2MmZT0+IG1haWwgbGlzdCB0byBsZWFybiBh Ym91dCBwcm9qZWN0cyBJIGFtIHdvcmtpbmcgb24hDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBp ZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3VybGRlZmVuc2UucHJv b2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3Rp bmZvX2lkLTJEZXZlbnQmZD1Ed0lDQWcmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlU cGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElH ayZtPXAxVnNkMUhiN0JYODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmcz1BVFl6T1hY R3RvNWFmaXQzT2dUamgxOUtjenhLQ3ZhQndDN2Z0b2ZITXJzJmU9DQo= --_000_CY4PR21MB0504CBB636CAD1E33158997DF5E40CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9 DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpw dXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2Vj dGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEu MGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHls ZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQi IHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0 IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj5JIGJlbGlldmUgdGhhdCB0aGUgc29sdXRpb24gYWxyZWFkeSBkaXNj dXNzZWQgaXMgdGhlIGJlc3Qgb25lLiZuYnNwOyBJZiB0aGUgZXZlbnQgaXNzdWVyIGlzIGRpZmZl cmVudCB0aGFuIGEgbG9naWNhbCBpc3N1ZXIgYXNzb2NpYXRlZCB3aXRoIHRoZSBldmVudCBzdWJq ZWN0LCB0aGVuDQogcHV0IHRoZSBsb2dpY2FsIOKAnGlzc+KAnSBhbmQg4oCcc3Vi4oCdIHZhbHVl cyBpbnNpZGUgdGhlIGV2ZW50LiZuYnNwOyBBbnkg4oCcc3Vi4oCdIGF0IHRoZSB0b3AtbGV2ZWwg KGlmIGFueSkgc2hvdWxkIGJlIGFzc29jaWF0ZWQgd2l0aCB0aGUg4oCcaXNz4oCdIGF0IHRoZSB0 b3AtbGV2ZWwsIHdoaWNoIGlzIGFsd2F5cyB0aGUgZXZlbnQgaXNzdWVyLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+QW55IHByb3Bvc2FsIHRoYXQgcmVxdWlyZXMg ZHVwbGljYXRpbmcgaW5mb3JtYXRpb24sIHN1Y2ggYXMgcmVxdWlyaW5nIOKAnHN1Yklzc+KAnSBl dmVuIHdoZW4gaXTigJlzIGFsd2F5cyBpZGVudGljYWwgdG8g4oCcaXNz4oCdLCBpcyBub3QgYSBn cmVhdCBhcmNoaXRlY3R1cmFsIGNob2ljZSwNCiBzaW5jZSBpdCBjcmVhdGVzIHVubmVjZXNzYXJ5 IGVycm9yIGNvbmRpdGlvbnMgdGhhdCB3b3VsZCBub3Qgb3RoZXJ3aXNlIGJlIHBvc3NpYmxlLiZu YnNwOyAoSG93IHNob3VsZCBpbXBsZW1lbnRhdGlvbnMgaGFuZGxlIHRoZSBjYXNlIHdoZXJlIHR3 byB2YWx1ZXMgYXJlIHJlcXVpcmVkIHRvIG1hdGNoIGJ1dCBkb27igJl0Pyk8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWYiPiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBC ZWhhbGYgT2YgPC9iPlBoaWwgSHVudCAoSURNKTxicj4NCjxiPlNlbnQ6PC9iPiBUaHVyc2RheSwg TWF5IDE4LCAyMDE3IDc6MzEgQU08YnI+DQo8Yj5Ubzo8L2I+IERpY2sgSGFyZHQgJmx0O2RpY2su aGFyZHRAZ21haWwuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gSUQgRXZlbnRzIE1haWxpbmcgTGlz dCAmbHQ7aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQt ZXZlbnRdIERlYWxpbmcgd2l0aCBpc3N1ZXIgY29uZmxpY3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Pz88bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGFwcGVucyBpbiBhbnkgY2FzZSB3aGVyZSBzdWIgaXMg bm90IGdsb2JhbGx5IGlkZW50aWZpYWJsZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gQ29ubmVjdCwgc2luY2Ugc3ViIGlzIG5vdCB1bmlxdWVs eSBpZGVudGlmaWVkLCB0aGUgaXNzIGZvciB0aGUgc3ViIG11c3QgYmUgaW5jbHVkZWQuIFRoaXMg Y3JlYXRlcyBhIGNvbmZsaWN0IGlmIHRoZSBpc3N1ZXIgb2YgdGhlIFNFVCBpcyBub3QgdGhlIGlz c3VlciBvZiB0aGUgc3ViamVjdC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBp ZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+UmVzb2x2aW5nIHRoZSBpc3MgY29uZmxpY3QgaGFzIGJlZW4gb24gdGhl IGxpc3Qgb2YgaXNzdWVzIHNpbmNlIGNoaWNhZ28uJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJl Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIFJJU0Mgd2Ugd2VyZSBkaXNjdXNzaW5nIGFjY291 bnQgY2xvc2UgZXZlbnRzLiBJIGFtIGFzc3VtZSBvbmUgb2YgdGhlIHNjZW5hcmlvcyBpcyBSUHMg d2lsbCBub3RpZnkgSURQcyB3aGVuIHRoZXkgY2xvc2UgYW4gYWNjb3VudC4gVGhleSBtdXN0IHVz ZSBhbiBpc3Mgbm90IGFzc29jaWF0ZWQgd2l0aCBzdWIuIEFzIHRoaW5ncyBzdGFuZCBub3csIHRo ZXkgd2lsbCBoYXZlIHRvIGFzc2VydCB0aGUgZXh0cmENCiBpc3MgdmFsdWUgaW4gdGhlaXIgcGF5 bG9hZC0tLXdoaWNoIGZvciBtb3N0IGV2ZW50cyBpcyBjb21wbGV4IHRvIHBhcnNlIHNpbmNlIHRo ZWlyIGFyZSBubyBvdGhlciBleHRyYSBjbGFpbXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJl Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJy Pg0KT24gTWF5IDE4LCAyMDE3LCBhdCA2OjM2IEFNLCBEaWNrIEhhcmR0ICZsdDs8YSBocmVmPSJt YWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5QaGlsLCB3b3VsZCB5b3UgY2xhcmlmeSB0aGUgdXNlIGNhc2UgYW5kIHRoZSBy ZXF1aXJlbWVudCB0byBlbnN1cmUgZXZlcnlvbmUgb24gdGhlIGxpc3QgaXMgYWxpZ25lZD8gVGhh bmtzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ T24gV2VkLCBNYXkgMTcsIDIwMTcgYXQgOTo0NSBQTSBQaGlsIEh1bnQgKElETSkgJmx0OzxhIGhy ZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+ Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkluIG1hbnkgY2FzZXMgd2hlcmUgd2UgYXJlIHRhbGtpbmcgYWJvdXQgZXZl bnRzIChlZyByaXNjKSB0aGVyZSBpcyBubyBuZWVkIGZvciBleHRyYSBjbGFpbXMgb3RoZXIgdGhh biB0aGUgZXZlbnQgdHlwZSBpdHNlbGYuPGJyPg0KPGJyPg0KSXQgb2NjdXJzIHRvIG1lIHRoYXQg aW4gdGhlIGNhc2Ugb2YgUlAgaXNzdWVkIGV2ZW50cyB0aGUgY3VycmVudCBzZWN0b2tlbiBmb3Jt YXQgcmVxdWlyZXMgYW4gZW1iZWRkZWQgaXNzIHRvIGRlYWwgd2l0aCB0aGUgY29uZmxpY3Qgd2l0 aCB0aGUgc2V0IGlzc3Vlci4gSXQgc2VlbXMgdG8gYWRkIGEgbG90IG9mIGNvbXBsaWNhdGlvbiBm b3IgbW9zdCBldmVudHMuPGJyPg0KPGJyPg0KV2hhdCBpZiB3ZSBkZWZpbmVkIGEgbmV3IHNlY3Rv a2VuIHRvcCBsZXZlbCBhdHRyaWJ1dGUgJ3N1YklzcycgdG8gbWVhbiAmcXVvdDtzdWJqZWN0IGlz c3VlciZxdW90OyBhbmQga2VlcCBpc3MgcmVzZXJ2ZWQgZm9yIHRoZSBTRVQgaXNzdWVyLjxicj4N Cjxicj4NCkkgd291bGQgc3VnZ2VzdCB0aGlzIGFzIGEgcmVjb21tZW5kZWQgYXR0cmlidXRlIGV2 ZW4gd2hlbiBpc3MgYW5kIHN1YklzcyBhcmUgdGhlIHNhbWUgZm9yIHBhcnNpbmcgY29uc2lzdGVu Y3kuPGJyPg0KPGJyPg0KVGhvdWdodHM/PGJyPg0KPGJyPg0KUGhpbDxicj4NCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGlu ZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9i bGFuayI+SWQtZXZlbnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZs WllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209cDFWc2QxSGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlh Y0h4dWp3VGhTbldoNCZhbXA7cz1BVFl6T1hYR3RvNWFmaXQzT2dUamgxOUtjenhLQ3ZhQndDN2Z0 b2ZITXJzJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vaWQtZXZlbnQ8L2E+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tIDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5TdWJzY3JpYmUgdG8gdGhlIDxhIGhyZWY9Imh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19oYXJkdHdhcmUuY29tXyZh bXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPXAxVnNkMUhiN0JYODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9Tkdi Q0FmQkVsNVR0c2tXZGpqV09ZMmNRSkEzRnN5OVF2bnRQbnN0eUlrYyZhbXA7ZT0iIHRhcmdldD0i X2JsYW5rIj4NCkhBUkRUV0FSRTwvYT4gbWFpbCBsaXN0IHRvIGxlYXJuIGFib3V0IHByb2plY3Rz IEkgYW0gd29ya2luZyBvbiE8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGJsb2NrcXVv dGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWls dG86SWQtZXZlbnRAaWV0Zi5vcmciPklkLWV2ZW50QGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9 Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXAxVnNkMUhiN0JYODdz VjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9QVRZek9YWEd0bzVhZml0M09nVGpo MTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZhbXA7ZT0iPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9f aWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktD WDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5L ZTRDX2xMSUdrJmFtcDttPXAxVnNkMUhiN0JYODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25X aDQmYW1wO3M9QVRZek9YWEd0bzVhZml0M09nVGpoMTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZhbXA7 ZT08L2E+DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB0504CBB636CAD1E33158997DF5E40CY4PR21MB0504namp_-- From nobody Thu May 18 11:46:31 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0AB78129C15 for ; Thu, 18 May 2017 11:46:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YDuFusBe8MBz for ; Thu, 18 May 2017 11:46:25 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A7B0129B44 for ; Thu, 18 May 2017 11:41:22 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4IIfKf4029759 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 18 May 2017 18:41:21 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v4IIfKtv019056 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 May 2017 18:41:20 GMT Received: from abhmp0009.oracle.com (abhmp0009.oracle.com [141.146.116.15]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v4IIfIBp023080; Thu, 18 May 2017 18:41:19 GMT Received: from [192.168.1.6] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 18 May 2017 11:41:17 -0700 From: Phil Hunt Message-Id: <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_77D80263-AB02-4E63-8972-34708074B5B7" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 18 May 2017 11:41:15 -0700 In-Reply-To: Cc: Dick Hardt , ID Events Mailing List To: Mike Jones References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> X-Mailer: Apple Mail (2.3273) X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 18:46:30 -0000 --Apple-Mail=_77D80263-AB02-4E63-8972-34708074B5B7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Mike, I=E2=80=99m not sure we=E2=80=99re on the same page here. My impression = is this is still on the outstanding list. Let=E2=80=99s look at some example cases: For example, if a relying party (e.g. retail store) wants to notify an = IDP that the user has been deleted=E2=80=A6 Currently in the draft: When issued by an OpenID Connect issuer: { "iss": "https://connect.myidp.com", "sub": "248289761001", "aud": ["connect.myidp.com"], "iat": 1471566154, "jti": "bWJq", "events": { "http://schemas.openid.net/risc/event-type/account-deleted": {} } } BUT, when issued by a party other than the issuer of the subject: { "iss": "https://exampleretail.store.com", "sub": "248289761001", "aud": ["connect.myidp.com"], "iat": 1471566154, "jti": "bWJq", "events": { "http://schemas.openid.net/risc/event-type/account-deleted": { "iss=E2=80=9D:"connect.myidp.com=E2=80=9D } } } If you are writing code, if you agree that the OP issues a lot of = events, you end up having to check that there=E2=80=99s no embedded = =E2=80=9Ciss=E2=80=9D present before you can assume the issuer of the = subject is the same as that of the SET token. This strikes me as very = complex. Regarding your assertion: > Any =E2=80=9Csub=E2=80=9D at the top-level (if any) should be = associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which is = always the event issuer. May be you are thinking that we should be solving this by always issuing = embedded iss and sub (Alternative 1): { "iss": "https://exampleretail.store.com", =20 "aud": ["connect.myidp.com"], "iat": 1471566154, "jti": "bWJq", "events": { "http://schemas.openid.net/risc/event-type/account-deleted": { "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D "sub": "248289761001", } } } OR, Alternative 2: { "iss": "https://exampleretail.store.com", "sub": "248289761001", "aud": ["connect.myidp.com"], "iat": 1471566154, "jti": =E2=80=9CbWJq" =E2=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D, "events": { "http://schemas.openid.net/risc/event-type/account-deleted": {} } } I can see pros and cons for either. I like option 1 because it also = makes the SET different from ID Tokens and Access Tokens. Option 2 is nice because most SETs we=E2=80=99ve been talking about just = have an event type and a subject and no claims. The best way to define this is to enforce that sub may only be used at = the top level if it is globally identifiable (e.g. such as in the case = of SCIM URIs). Phil Oracle Corporation, Identity Cloud Services Architect & Standards @independentid www.independentid.com = phil.hunt@oracle.com = > On May 18, 2017, at 10:40 AM, Mike Jones = wrote: >=20 > I believe that the solution already discussed is the best one. If the = event issuer is different than a logical issuer associated with the = event subject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub= =E2=80=9D values inside the event. Any =E2=80=9Csub=E2=80=9D at the = top-level (if any) should be associated with the =E2=80=9Ciss=E2=80=9D = at the top-level, which is always the event issuer. > =20 > Any proposal that requires duplicating information, such as requiring = =E2=80=9CsubIss=E2=80=9D even when it=E2=80=99s always identical to = =E2=80=9Ciss=E2=80=9D, is not a great architectural choice, since it = creates unnecessary error conditions that would not otherwise be = possible. (How should implementations handle the case where two values = are required to match but don=E2=80=99t?) > =20 > -- = Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org = ] On Behalf Of Phil Hunt (IDM) > Sent: Thursday, May 18, 2017 7:31 AM > To: Dick Hardt > > Cc: ID Events Mailing List > > Subject: Re: [Id-event] Dealing with issuer conflict > =20 > ?? > =20 > Happens in any case where sub is not globally identifiable.=20 > =20 > In Connect, since sub is not uniquely identified, the iss for the sub = must be included. This creates a conflict if the issuer of the SET is = not the issuer of the subject.=20 > =20 > Resolving the iss conflict has been on the list of issues since = chicago.=20 > =20 > In RISC we were discussing account close events. I am assume one of = the scenarios is RPs will notify IDPs when they close an account. They = must use an iss not associated with sub. As things stand now, they will = have to assert the extra iss value in their payload---which for most = events is complex to parse since their are no other extra claims.=20 > =20 > Phil >=20 > On May 18, 2017, at 6:36 AM, Dick Hardt > wrote: >=20 > Phil, would you clarify the use case and the requirement to ensure = everyone on the list is aligned? Thanks > =20 > On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) > wrote: > In many cases where we are talking about events (eg risc) there is no = need for extra claims other than the event type itself. >=20 > It occurs to me that in the case of RP issued events the current = sectoken format requires an embedded iss to deal with the conflict with = the set issuer. It seems to add a lot of complication for most events. >=20 > What if we defined a new sectoken top level attribute 'subIss' to mean = "subject issuer" and keep iss reserved for the SET issuer. >=20 > I would suggest this as a recommended attribute even when iss and = subIss are the same for parsing consistency. >=20 > Thoughts? >=20 > Phil > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event = > --=20 > Subscribe to the HARDTWARE = mail list to = learn about projects I am working on! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dp1Vsd1Hb7BX87sV= 4x9MhtsGbORcuiacHxujwThSnWh4&s=3DATYzOXXGto5afit3OgTjh19KczxKCvaBwC7ftofHM= rs&e=3D = _______________________________________________ > Id-event mailing list > Id-event@ietf.org > = https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8Y= AXLrAb5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLyl= rw&e=3D = =20 --Apple-Mail=_77D80263-AB02-4E63-8972-34708074B5B7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Mike,

I=E2=80= =99m not sure we=E2=80=99re on the same page here. My impression is this = is still on the outstanding list.

Let=E2=80=99s look at some example = cases:

For = example, if a relying party (e.g. retail store) wants to notify an IDP = that the user has been deleted=E2=80=A6

Currently in the draft:
When issued by an OpenID Connect issuer:
{
  "iss": "https://connect.myidp.com",
  "sub": "248289761001",
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {}
  }
}

BUT, when issued by a party other than the issuer of the = subject:
{
  "iss": "https://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {
      "iss=E2=80=9D:"connect.myidp.com=E2=80=9D
    }
  }
}

If you are writing code, if you agree that the OP issues a = lot of events, you end up having to check that there=E2=80=99s no = embedded =E2=80=9Ciss=E2=80=9D present before you can assume the issuer = of the subject is the same as that of the SET token.  This strikes = me as very complex.

Regarding your assertion:
Any =E2=80=9Csub=E2=80=9D at the top-level (if any) = should be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, = which is always the event issuer.

May be you are thinking = that we should be solving this by always issuing embedded iss and sub = (Alternative 1):
{
  "iss": "https://exampleretail.store.com", =20
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {
      "iss=E2=80=9D:=E2=80=
=9Dconnect.myidp.com=E2=80=9D
      "sub": =
"248289761001",
=
    }
  }
}

OR, Alternative =
2:
{
  "iss": "https://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": =E2=80=9CbWJq"
  =E2=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D=
,
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {}
  }
}

I can see pros and cons for = either. I like option 1 because it also makes the SET different from ID = Tokens and Access Tokens.

Option 2 is nice because most SETs we=E2=80=99ve been talking = about just have an event type and a subject and no claims.

The best way to define = this is to enforce that sub may only be used at the top level if it is = globally identifiable (e.g. such as in the case of SCIM URIs).

Phil

Oracle Corporation, Identity Cloud = Services Architect & Standards
@independentid
www.independentid.com
phil.hunt@oracle.com

On May 18, 2017, at 10:40 AM, Mike Jones <Michael.Jones@microsoft.com> wrote:

I believe that the = solution already discussed is the best one.  If the event issuer is = different than a logical issuer associated with the event subject, then = put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D values = inside the event.  Any =E2=80=9Csub=E2=80=9D at the top-level (if = any) should be associated with the =E2=80=9Ciss=E2=80=9D at the = top-level, which is always the event issuer.
 
Any = proposal that requires duplicating information, such as requiring = =E2=80=9CsubIss=E2=80=9D even when it=E2=80=99s always identical to = =E2=80=9Ciss=E2=80=9D, is not a great architectural choice, since it = creates unnecessary error conditions that would not otherwise be = possible.  (How should implementations handle the case where two = values are required to match but don=E2=80=99t?)
 
          &nb= sp;            = ;            &= nbsp;           &nb= sp;            = ;    -- Mike
 
From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf = Of Phil Hunt = (IDM)
Sent: Thursday, May 18, 2017 7:31 = AM
To: Dick Hardt <dick.hardt@gmail.com>
Cc: ID Events Mailing List = <id-event@ietf.org>
Subject: Re: [Id-event] Dealing with = issuer conflict
 
??
 
Happens in any case where sub is not = globally identifiable. 
 
In Connect, since sub is not uniquely identified, the = iss for the sub must be included. This creates a conflict if the issuer = of the SET is not the issuer of the subject. 
 
Resolving the iss conflict has been on = the list of issues since chicago. 
 
In RISC we were discussing account close = events. I am assume one of the scenarios is RPs will notify IDPs when = they close an account. They must use an iss not associated with sub. As = things stand now, they will have to assert the extra iss value in their = payload---which for most events is complex to parse since their are no = other extra claims. 
 
Phil


On= May 18, 2017, at 6:36 AM, Dick Hardt <dick.hardt@gmail.com> = wrote:

Phil, would you clarify the use case and = the requirement to ensure everyone on the list is aligned? Thanks
 
On Wed, May 17, 2017 = at 9:45 PM Phil Hunt (IDM) <phil.hunt@oracle.com> wrote:
In many cases = where we are talking about events (eg risc) there is no need for extra = claims other than the event type itself.

It = occurs to me that in the case of RP issued events the current sectoken = format requires an embedded iss to deal with the conflict with the set = issuer. It seems to add a lot of complication for most events.

What if we defined a new sectoken top level = attribute 'subIss' to mean "subject issuer" and keep iss reserved for = the SET issuer.

I would suggest this as a = recommended attribute even when iss and subIss are the same for parsing = consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
-- 
Subscribe to the HARDTWARE mail list to learn about = projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf= .org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZY= R8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lL= IGk&m=3D8LfCYox0y3ghN8YAXLrAb5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDV= ir82WEWzix61-YzkrfquEPKMk_TtLylrw&e=3D 

= --Apple-Mail=_77D80263-AB02-4E63-8972-34708074B5B7-- From nobody Thu May 18 12:14:14 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A8DC129AAA for ; Thu, 18 May 2017 12:14:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g_rIAmliJtJq for ; Thu, 18 May 2017 12:14:09 -0700 (PDT) Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0106.outbound.protection.outlook.com [104.47.42.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1A3D129C3F for ; Thu, 18 May 2017 12:08:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=aRfRZ0R51oOy7mc2Ggr12Fwtxl0UznAoOi7lxc9YGq8=; b=FyBjs6XTaPelR/V5p58Ms1NLyWgQtx3N950RTXj8afKiq5H2lWUDpfXVI/B4/qedvlwlc62v43CtWCDPrapzIFNxvoCOQ6JofaTeJSDlK8/mcxTvbMe8k86eID7dP7KGQEWLYv+lggzQoHFDDPEjZsP4HnLX24EtG2kSF8Bsw1k= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0469.namprd21.prod.outlook.com (10.172.121.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.0; Thu, 18 May 2017 19:08:15 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1124.007; Thu, 18 May 2017 19:08:15 +0000 From: Mike Jones To: Phil Hunt CC: Dick Hardt , ID Events Mailing List Thread-Topic: [Id-event] Dealing with issuer conflict Thread-Index: AQHSz5GPBeIUkwXJI0S9grGRbpCBVKH6GH8AgAAO/4CAADPHoIAAEkCAgAAGbLA= Date: Thu, 18 May 2017 19:08:14 +0000 Message-ID: References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> In-Reply-To: <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetBy=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-05-18T12:08:12.1839774-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:3::32c] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0469; 7:kTXR+WVsEix53ETC9fTv5xli0duUvXRPcjuqpi9fsEl8xWX4Z5fVB2H3ILcQlNYhNr+c0FUeHJGMZhVXcuRA6ZaBtX1noE0emGCSsgi8wODsoboG23QK5Y9kMBO5XpLTQdZKx0Rd7KniVW+Tfkr6l/YoKNytNRdU5rE/I9Z4taItA1M74KZAOutTa8qzYHXJv28vCgk7GTLtvUGls/3Vx285+yGEHyv1KxahUSnCM811fk51h6UPD5a/1quQNP09QDdcQK1DLBpiipXNHZVwucS/Q8j3pPTOmrq1UbJwnICQJLeP70GtJeCYR8zT4hjMX83flIEicwcL+EPgi4huPYYDVcz/aXC4kSMcIVQ0pDg= x-ms-traffictypediagnostic: CY4PR21MB0469: x-ms-office365-filtering-correlation-id: 54547879-6231-4cd5-09f3-08d49e213c95 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:CY4PR21MB0469; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(21748063052155)(21532816269658)(146099531331640)(17755550239193)(5213294742642); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(61425038)(6040450)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(93006095)(93001095)(100000703036)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123564025)(20161123555025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123560025)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:CY4PR21MB0469; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:CY4PR21MB0469; x-forefront-prvs: 0311124FA9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39410400002)(39840400002)(39400400002)(39850400002)(39450400003)(24454002)(377454003)(6506006)(6436002)(606005)(7696004)(2900100001)(10090500001)(2950100002)(6916009)(25786009)(53546009)(5005710100001)(8990500004)(39060400002)(86612001)(86362001)(575784001)(4326008)(6246003)(110136004)(53386004)(38730400002)(33656002)(9686003)(236005)(3660700001)(3280700002)(54896002)(54906002)(99286003)(55016002)(6306002)(53936002)(54356999)(50986999)(76176999)(6116002)(790700001)(102836003)(1680700002)(2906002)(561944003)(7736002)(10290500003)(81166006)(478600001)(93886004)(74316002)(7906003)(8936002)(5660300001)(19609705001)(189998001)(8676002)(72206003)(229853002)(966005)(77096006)(122556002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0469; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0504BE77665A866FF1960E58F5E40CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2017 19:08:15.1873 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0469 Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 19:14:13 -0000 --_000_CY4PR21MB0504BE77665A866FF1960E58F5E40CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TW9zdCBvZiB3aGF0IHlvdeKAmXJlIHRhbGtpbmcgYWJvdXQgc2VlbXMgdG8gbWUgdG8gYmUgZGVj aXNpb25zIHRoYXQgY2FuIGJlIG1hZGUgYnkgcGFydGljdWxhciBldmVudCBkZWZpbml0aW9ucyBv ciBldmVudCBmYW1pbHkgZGVmaW5pdGlvbnMuICBJIGhhdmUgbm8gcHJvYmxlbSB3aXRoIHBhcnRp Y3VsYXIgZXZlbnRzIG9yIGV2ZW50IGZhbWlsaWVzIGVtcGxveWluZyBzb21lIG9mIHRoZSBzdHJh dGVnaWVzIHRoYXQgeW914oCZcmUgZGVzY3JpYmluZy4gIFRoZSBTRVQgc3BlYyBhbHJlYWR5IGZh Y2lsaXRhdGVzIHRoYXQuDQoNCkJ1dCBwZXIgcHJldmlvdXMgZGlzY3Vzc2lvbnMsIHdlIHNob3Vs ZG7igJl0IGJlIG1ha2luZyByZXN0cmljdGlvbnMgaW4gdGhlIFNFVCBzcGVjIHRoYXQgbGltaXQg aXRzIGFwcGxpY2FiaWxpdHkgYnkgbWFraW5nIHJlc3RyaWN0aW9ucyBvbiBjbGFpbXMgdXNhZ2Ug dGhhdCB3aWxsIG9ubHkgd29yayBmb3Igc29tZSBldmVudCB1c2UgY2FzZXMgYW5kIHdpbGwgcnVs ZSBvdXQgb3RoZXJzLiAgV2Ugc2hvdWxkIGhvbGQgdG8gdGhlIGJyaWdodC1saW5lIHRlc3QgdGhh dCBldmVudCBkZWZpbml0aW9ucyBkZWZpbmUgd2hhdCBjbGFpbXMgYXJlIGluY2x1ZGVkIGluIFNF VFMgKG90aGVyIHRoYW4gdGhlIOKAnGV2ZW50c+KAnSBjbGFpbSBpdHNlbGYpIGFuZCBob3cgdGhl eeKAmXJlIHVzZWQuICBJbnRydWRpbmcgb24gdGhhdCB3aWxsIHVubmVjZXNzYXJpbHkgbGltaXQg dGhlIGFwcGxpY2FiaWxpdHkgb2YgU0VUcy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUGhp bCBIdW50IFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBUaHVyc2RheSwgTWF5 IDE4LCAyMDE3IDExOjQxIEFNDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPg0KQ2M6IERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPjsgSUQgRXZlbnRz IE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50 XSBEZWFsaW5nIHdpdGggaXNzdWVyIGNvbmZsaWN0DQoNCk1pa2UsDQoNCknigJltIG5vdCBzdXJl IHdl4oCZcmUgb24gdGhlIHNhbWUgcGFnZSBoZXJlLiBNeSBpbXByZXNzaW9uIGlzIHRoaXMgaXMg c3RpbGwgb24gdGhlIG91dHN0YW5kaW5nIGxpc3QuDQoNCkxldOKAmXMgbG9vayBhdCBzb21lIGV4 YW1wbGUgY2FzZXM6DQoNCkZvciBleGFtcGxlLCBpZiBhIHJlbHlpbmcgcGFydHkgKGUuZy4gcmV0 YWlsIHN0b3JlKSB3YW50cyB0byBub3RpZnkgYW4gSURQIHRoYXQgdGhlIHVzZXIgaGFzIGJlZW4g ZGVsZXRlZOKApg0KDQpDdXJyZW50bHkgaW4gdGhlIGRyYWZ0Og0KV2hlbiBpc3N1ZWQgYnkgYW4g T3BlbklEIENvbm5lY3QgaXNzdWVyOg0Kew0KDQogICJpc3MiOiAiaHR0cHM6Ly9jb25uZWN0Lm15 aWRwLmNvbSIsDQoNCiAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICJhdWQiOiBbImNvbm5l Y3QubXlpZHAuY29tPGh0dHA6Ly9jb25uZWN0Lm15aWRwLmNvbT4iXSwNCg0KICAiaWF0IjogMTQ3 MTU2NjE1NCwNCg0KICAianRpIjogImJXSnEiLA0KDQogICJldmVudHMiOiB7DQoNCiAgICAiaHR0 cDovL3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjL2V2ZW50LXR5cGUvYWNjb3VudC1kZWxldGVkIjog e30NCg0KICB9DQoNCn0NCg0KQlVULCB3aGVuIGlzc3VlZCBieSBhIHBhcnR5IG90aGVyIHRoYW4g dGhlIGlzc3VlciBvZiB0aGUgc3ViamVjdDoNCg0Kew0KDQogICJpc3MiOiAiaHR0cHM6Ly9leGFt cGxlcmV0YWlsLnN0b3JlLmNvbSIsDQoNCiAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICJh dWQiOiBbImNvbm5lY3QubXlpZHAuY29tPGh0dHA6Ly9jb25uZWN0Lm15aWRwLmNvbT4iXSwNCg0K ICAiaWF0IjogMTQ3MTU2NjE1NCwNCg0KICAianRpIjogImJXSnEiLA0KDQogICJldmVudHMiOiB7 DQoNCiAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjL2V2ZW50LXR5cGUvYWNjb3Vu dC1kZWxldGVkIjogew0KDQogICAgICAiaXNz4oCdOiJjb25uZWN0Lm15aWRwLmNvbTxodHRwOi8v Y29ubmVjdC5teWlkcC5jb20+4oCdDQoNCiAgICB9DQoNCiAgfQ0KDQp9DQoNCklmIHlvdSBhcmUg d3JpdGluZyBjb2RlLCBpZiB5b3UgYWdyZWUgdGhhdCB0aGUgT1AgaXNzdWVzIGEgbG90IG9mIGV2 ZW50cywgeW91IGVuZCB1cCBoYXZpbmcgdG8gY2hlY2sgdGhhdCB0aGVyZeKAmXMgbm8gZW1iZWRk ZWQg4oCcaXNz4oCdIHByZXNlbnQgYmVmb3JlIHlvdSBjYW4gYXNzdW1lIHRoZSBpc3N1ZXIgb2Yg dGhlIHN1YmplY3QgaXMgdGhlIHNhbWUgYXMgdGhhdCBvZiB0aGUgU0VUIHRva2VuLiAgVGhpcyBz dHJpa2VzIG1lIGFzIHZlcnkgY29tcGxleC4NCg0KUmVnYXJkaW5nIHlvdXIgYXNzZXJ0aW9uOg0K QW55IOKAnHN1YuKAnSBhdCB0aGUgdG9wLWxldmVsIChpZiBhbnkpIHNob3VsZCBiZSBhc3NvY2lh dGVkIHdpdGggdGhlIOKAnGlzc+KAnSBhdCB0aGUgdG9wLWxldmVsLCB3aGljaCBpcyBhbHdheXMg dGhlIGV2ZW50IGlzc3Vlci4NCg0KTWF5IGJlIHlvdSBhcmUgdGhpbmtpbmcgdGhhdCB3ZSBzaG91 bGQgYmUgc29sdmluZyB0aGlzIGJ5IGFsd2F5cyBpc3N1aW5nIGVtYmVkZGVkIGlzcyBhbmQgc3Vi IChBbHRlcm5hdGl2ZSAxKToNCg0Kew0KDQogICJpc3MiOiAiaHR0cHM6Ly9leGFtcGxlcmV0YWls LnN0b3JlLmNvbSIsDQoNCiAgImF1ZCI6IFsiY29ubmVjdC5teWlkcC5jb208aHR0cDovL2Nvbm5l Y3QubXlpZHAuY29tPiJdLA0KDQogICJpYXQiOiAxNDcxNTY2MTU0LA0KDQogICJqdGkiOiAiYldK cSIsDQoNCiAgImV2ZW50cyI6IHsNCg0KICAgICJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3Jp c2MvZXZlbnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQiOiB7DQoNCiAgICAgICJpc3PigJ064oCdY29u bmVjdC5teWlkcC5jb208aHR0cDovL2Nvbm5lY3QubXlpZHAuY29tPuKAnQ0KDQogICAgICAic3Vi IjogIjI0ODI4OTc2MTAwMSIsDQoNCiAgICB9DQoNCiAgfQ0KDQp9DQoNCg0KDQpPUiwgQWx0ZXJu YXRpdmUgMjoNCg0Kew0KDQogICJpc3MiOiAiaHR0cHM6Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNv bSIsDQoNCiAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICJhdWQiOiBbImNvbm5lY3QubXlp ZHAuY29tPGh0dHA6Ly9jb25uZWN0Lm15aWRwLmNvbT4iXSwNCg0KICAiaWF0IjogMTQ3MTU2NjE1 NCwNCg0KICAianRpIjog4oCcYldKcSINCg0KICDigJxzdWJJc3PigJ064oCdY29ubmVjdC5teWlk cC5jb208aHR0cDovL2Nvbm5lY3QubXlpZHAuY29tPuKAnSwNCg0KICAiZXZlbnRzIjogew0KDQog ICAgImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVs ZXRlZCI6IHt9DQoNCiAgfQ0KDQp9DQoNCg0KSSBjYW4gc2VlIHByb3MgYW5kIGNvbnMgZm9yIGVp dGhlci4gSSBsaWtlIG9wdGlvbiAxIGJlY2F1c2UgaXQgYWxzbyBtYWtlcyB0aGUgU0VUIGRpZmZl cmVudCBmcm9tIElEIFRva2VucyBhbmQgQWNjZXNzIFRva2Vucy4NCg0KT3B0aW9uIDIgaXMgbmlj ZSBiZWNhdXNlIG1vc3QgU0VUcyB3ZeKAmXZlIGJlZW4gdGFsa2luZyBhYm91dCBqdXN0IGhhdmUg YW4gZXZlbnQgdHlwZSBhbmQgYSBzdWJqZWN0IGFuZCBubyBjbGFpbXMuDQoNClRoZSBiZXN0IHdh eSB0byBkZWZpbmUgdGhpcyBpcyB0byBlbmZvcmNlIHRoYXQgc3ViIG1heSBvbmx5IGJlIHVzZWQg YXQgdGhlIHRvcCBsZXZlbCBpZiBpdCBpcyBnbG9iYWxseSBpZGVudGlmaWFibGUgKGUuZy4gc3Vj aCBhcyBpbiB0aGUgY2FzZSBvZiBTQ0lNIFVSSXMpLg0KDQpQaGlsDQoNCk9yYWNsZSBDb3Jwb3Jh dGlvbiwgSWRlbnRpdHkgQ2xvdWQgU2VydmljZXMgQXJjaGl0ZWN0ICYgU3RhbmRhcmRzDQpAaW5k ZXBlbmRlbnRpZA0Kd3d3LmluZGVwZW5kZW50aWQuY29tPGh0dHA6Ly93d3cuaW5kZXBlbmRlbnRp ZC5jb20+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+ DQoNCk9uIE1heSAxOCwgMjAxNywgYXQgMTA6NDAgQU0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9u ZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3Jv dGU6DQoNCkkgYmVsaWV2ZSB0aGF0IHRoZSBzb2x1dGlvbiBhbHJlYWR5IGRpc2N1c3NlZCBpcyB0 aGUgYmVzdCBvbmUuICBJZiB0aGUgZXZlbnQgaXNzdWVyIGlzIGRpZmZlcmVudCB0aGFuIGEgbG9n aWNhbCBpc3N1ZXIgYXNzb2NpYXRlZCB3aXRoIHRoZSBldmVudCBzdWJqZWN0LCB0aGVuIHB1dCB0 aGUgbG9naWNhbCDigJxpc3PigJ0gYW5kIOKAnHN1YuKAnSB2YWx1ZXMgaW5zaWRlIHRoZSBldmVu dC4gIEFueSDigJxzdWLigJ0gYXQgdGhlIHRvcC1sZXZlbCAoaWYgYW55KSBzaG91bGQgYmUgYXNz b2NpYXRlZCB3aXRoIHRoZSDigJxpc3PigJ0gYXQgdGhlIHRvcC1sZXZlbCwgd2hpY2ggaXMgYWx3 YXlzIHRoZSBldmVudCBpc3N1ZXIuDQoNCkFueSBwcm9wb3NhbCB0aGF0IHJlcXVpcmVzIGR1cGxp Y2F0aW5nIGluZm9ybWF0aW9uLCBzdWNoIGFzIHJlcXVpcmluZyDigJxzdWJJc3PigJ0gZXZlbiB3 aGVuIGl04oCZcyBhbHdheXMgaWRlbnRpY2FsIHRvIOKAnGlzc+KAnSwgaXMgbm90IGEgZ3JlYXQg YXJjaGl0ZWN0dXJhbCBjaG9pY2UsIHNpbmNlIGl0IGNyZWF0ZXMgdW5uZWNlc3NhcnkgZXJyb3Ig Y29uZGl0aW9ucyB0aGF0IHdvdWxkIG5vdCBvdGhlcndpc2UgYmUgcG9zc2libGUuICAoSG93IHNo b3VsZCBpbXBsZW1lbnRhdGlvbnMgaGFuZGxlIHRoZSBjYXNlIHdoZXJlIHR3byB2YWx1ZXMgYXJl IHJlcXVpcmVkIHRvIG1hdGNoIGJ1dCBkb27igJl0PykNCg0KICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJv bTogSWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYg T2YgUGhpbCBIdW50IChJRE0pDQpTZW50OiBUaHVyc2RheSwgTWF5IDE4LCAyMDE3IDc6MzEgQU0N ClRvOiBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBn bWFpbC5jb20+Pg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3Jn PG1haWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBEZWFs aW5nIHdpdGggaXNzdWVyIGNvbmZsaWN0DQoNCj8/DQoNCkhhcHBlbnMgaW4gYW55IGNhc2Ugd2hl cmUgc3ViIGlzIG5vdCBnbG9iYWxseSBpZGVudGlmaWFibGUuDQoNCkluIENvbm5lY3QsIHNpbmNl IHN1YiBpcyBub3QgdW5pcXVlbHkgaWRlbnRpZmllZCwgdGhlIGlzcyBmb3IgdGhlIHN1YiBtdXN0 IGJlIGluY2x1ZGVkLiBUaGlzIGNyZWF0ZXMgYSBjb25mbGljdCBpZiB0aGUgaXNzdWVyIG9mIHRo ZSBTRVQgaXMgbm90IHRoZSBpc3N1ZXIgb2YgdGhlIHN1YmplY3QuDQoNClJlc29sdmluZyB0aGUg aXNzIGNvbmZsaWN0IGhhcyBiZWVuIG9uIHRoZSBsaXN0IG9mIGlzc3VlcyBzaW5jZSBjaGljYWdv Lg0KDQpJbiBSSVNDIHdlIHdlcmUgZGlzY3Vzc2luZyBhY2NvdW50IGNsb3NlIGV2ZW50cy4gSSBh bSBhc3N1bWUgb25lIG9mIHRoZSBzY2VuYXJpb3MgaXMgUlBzIHdpbGwgbm90aWZ5IElEUHMgd2hl biB0aGV5IGNsb3NlIGFuIGFjY291bnQuIFRoZXkgbXVzdCB1c2UgYW4gaXNzIG5vdCBhc3NvY2lh dGVkIHdpdGggc3ViLiBBcyB0aGluZ3Mgc3RhbmQgbm93LCB0aGV5IHdpbGwgaGF2ZSB0byBhc3Nl cnQgdGhlIGV4dHJhIGlzcyB2YWx1ZSBpbiB0aGVpciBwYXlsb2FkLS0td2hpY2ggZm9yIG1vc3Qg ZXZlbnRzIGlzIGNvbXBsZXggdG8gcGFyc2Ugc2luY2UgdGhlaXIgYXJlIG5vIG90aGVyIGV4dHJh IGNsYWltcy4NCg0KUGhpbA0KDQpPbiBNYXkgMTgsIDIwMTcsIGF0IDY6MzYgQU0sIERpY2sgSGFy ZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdy b3RlOg0KUGhpbCwgd291bGQgeW91IGNsYXJpZnkgdGhlIHVzZSBjYXNlIGFuZCB0aGUgcmVxdWly ZW1lbnQgdG8gZW5zdXJlIGV2ZXJ5b25lIG9uIHRoZSBsaXN0IGlzIGFsaWduZWQ/IFRoYW5rcw0K DQpPbiBXZWQsIE1heSAxNywgMjAxNyBhdCA5OjQ1IFBNIFBoaWwgSHVudCAoSURNKSA8cGhpbC5o dW50QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpJbiBt YW55IGNhc2VzIHdoZXJlIHdlIGFyZSB0YWxraW5nIGFib3V0IGV2ZW50cyAoZWcgcmlzYykgdGhl cmUgaXMgbm8gbmVlZCBmb3IgZXh0cmEgY2xhaW1zIG90aGVyIHRoYW4gdGhlIGV2ZW50IHR5cGUg aXRzZWxmLg0KDQpJdCBvY2N1cnMgdG8gbWUgdGhhdCBpbiB0aGUgY2FzZSBvZiBSUCBpc3N1ZWQg ZXZlbnRzIHRoZSBjdXJyZW50IHNlY3Rva2VuIGZvcm1hdCByZXF1aXJlcyBhbiBlbWJlZGRlZCBp c3MgdG8gZGVhbCB3aXRoIHRoZSBjb25mbGljdCB3aXRoIHRoZSBzZXQgaXNzdWVyLiBJdCBzZWVt cyB0byBhZGQgYSBsb3Qgb2YgY29tcGxpY2F0aW9uIGZvciBtb3N0IGV2ZW50cy4NCg0KV2hhdCBp ZiB3ZSBkZWZpbmVkIGEgbmV3IHNlY3Rva2VuIHRvcCBsZXZlbCBhdHRyaWJ1dGUgJ3N1Yklzcycg dG8gbWVhbiAic3ViamVjdCBpc3N1ZXIiIGFuZCBrZWVwIGlzcyByZXNlcnZlZCBmb3IgdGhlIFNF VCBpc3N1ZXIuDQoNCkkgd291bGQgc3VnZ2VzdCB0aGlzIGFzIGEgcmVjb21tZW5kZWQgYXR0cmli dXRlIGV2ZW4gd2hlbiBpc3MgYW5kIHN1YklzcyBhcmUgdGhlIHNhbWUgZm9yIHBhcnNpbmcgY29u c2lzdGVuY3kuDQoNClRob3VnaHRzPw0KDQpQaGlsDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBp ZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNv bS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRl dmVudCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JL MTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09cDFWc2Qx SGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZzPUFUWXpPWFhHdG81YWZpdDNP Z1RqaDE5S2N6eEtDdmFCd0M3ZnRvZkhNcnMmZT0+DQotLQ0KU3Vic2NyaWJlIHRvIHRoZSBIQVJE VFdBUkU8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0Ff X2hhcmR0d2FyZS5jb21fJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1wMVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JnM9TkdiQ0Fm QkVsNVR0c2tXZGpqV09ZMmNRSkEzRnN5OVF2bnRQbnN0eUlrYyZlPT4gbWFpbCBsaXN0IHRvIGxl YXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiENCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2 ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5f bGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09cDFWc2QxSGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZzPUFU WXpPWFhHdG81YWZpdDNPZ1RqaDE5S2N6eEtDdmFCd0M3ZnRvZkhNcnMmZT0NCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxp c3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJm09OExmQ1lveDB5M2doTjhZQVhMckFiNXpmVXQ1clZEOHZid0t3dnc4 LVJqayZzPWd2NC15TjhMRFZpcjgyV0VXeml4NjEtWXprcmZxdUVQS01rX1R0THlscncmZT0NCg0K --_000_CY4PR21MB0504BE77665A866FF1960E58F5E40CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTou MDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlm O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJl Zm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb25zb2xhcyIsc2VyaWY7fQ0K c3Bhbi5hcHBsZS1zdHlsZS1zcGFuDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLXN0eWxlLXNwYW47 fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29u dmVydGVkLXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMw MDIwNjA7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJ Zm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4w aW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjEN Cgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3ht bD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6 ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBl bGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxp bms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5Nb3N0IG9m IHdoYXQgeW914oCZcmUgdGFsa2luZyBhYm91dCBzZWVtcyB0byBtZSB0byBiZSBkZWNpc2lvbnMg dGhhdCBjYW4gYmUgbWFkZSBieSBwYXJ0aWN1bGFyIGV2ZW50IGRlZmluaXRpb25zIG9yIGV2ZW50 IGZhbWlseSBkZWZpbml0aW9ucy4mbmJzcDsgSSBoYXZlIG5vIHByb2JsZW0NCiB3aXRoIHBhcnRp Y3VsYXIgZXZlbnRzIG9yIGV2ZW50IGZhbWlsaWVzIGVtcGxveWluZyBzb21lIG9mIHRoZSBzdHJh dGVnaWVzIHRoYXQgeW914oCZcmUgZGVzY3JpYmluZy4mbmJzcDsgVGhlIFNFVCBzcGVjIGFscmVh ZHkgZmFjaWxpdGF0ZXMgdGhhdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDIwNjAiPkJ1dCBwZXIgcHJldmlvdXMgZGlzY3Vzc2lvbnMsIHdlIHNob3VsZG7igJl0IGJlIG1h a2luZyByZXN0cmljdGlvbnMgaW4gdGhlIFNFVCBzcGVjIHRoYXQgbGltaXQgaXRzIGFwcGxpY2Fi aWxpdHkgYnkgbWFraW5nIHJlc3RyaWN0aW9ucyBvbiBjbGFpbXMgdXNhZ2UgdGhhdCB3aWxsDQog b25seSB3b3JrIGZvciBzb21lIGV2ZW50IHVzZSBjYXNlcyBhbmQgd2lsbCBydWxlIG91dCBvdGhl cnMuJm5ic3A7IFdlIHNob3VsZCBob2xkIHRvIHRoZSBicmlnaHQtbGluZSB0ZXN0IHRoYXQgZXZl bnQgZGVmaW5pdGlvbnMgZGVmaW5lIHdoYXQgY2xhaW1zIGFyZSBpbmNsdWRlZCBpbiBTRVRTIChv dGhlciB0aGFuIHRoZSDigJxldmVudHPigJ0gY2xhaW0gaXRzZWxmKSBhbmQgaG93IHRoZXnigJly ZSB1c2VkLiZuYnNwOyBJbnRydWRpbmcgb24gdGhhdCB3aWxsIHVubmVjZXNzYXJpbHkNCiBsaW1p dCB0aGUgYXBwbGljYWJpbGl0eSBvZiBTRVRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1p a2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFBoaWwgSHVudCBb bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tXQ0KPGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5 LCBNYXkgMTgsIDIwMTcgMTE6NDEgQU08YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0O01p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IERpY2sgSGFyZHQg Jmx0O2RpY2suaGFyZHRAZ21haWwuY29tJmd0OzsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCAmbHQ7 aWQtZXZlbnRAaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbSWQtZXZlbnRd IERlYWxpbmcgd2l0aCBpc3N1ZXIgY29uZmxpY3Q8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5NaWtlLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SeKAmW0gbm90IHN1cmUgd2XigJlyZSBvbiB0aGUgc2FtZSBwYWdlIGhl cmUuIE15IGltcHJlc3Npb24gaXMgdGhpcyBpcyBzdGlsbCBvbiB0aGUgb3V0c3RhbmRpbmcgbGlz dC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ TGV04oCZcyBsb29rIGF0IHNvbWUgZXhhbXBsZSBjYXNlczo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Rm9yIGV4YW1wbGUsIGlmIGEgcmVseWlu ZyBwYXJ0eSAoZS5nLiByZXRhaWwgc3RvcmUpIHdhbnRzIHRvIG5vdGlmeSBhbiBJRFAgdGhhdCB0 aGUgdXNlciBoYXMgYmVlbiBkZWxldGVk4oCmPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkN1cnJlbnRseSBpbiB0aGUgZHJhZnQ6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGVuIGlzc3VlZCBi eSBhbiBPcGVuSUQgQ29ubmVjdCBpc3N1ZXI6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41 cHQiPns8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cHJlIHN0eWxlPSJi cmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsg JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL2Nvbm5lY3QubXlpZHAuY29t Ij5odHRwczovL2Nvbm5lY3QubXlpZHAuY29tPC9hPiZxdW90Oyw8bzpwPjwvbzpwPjwvc3Bhbj48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtz dWImcXVvdDs6ICZxdW90OzI0ODI4OTc2MTAwMSZxdW90Oyw8bzpwPjwvbzpwPjwvc3Bhbj48L3By ZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDthdWQm cXVvdDs6IFsmcXVvdDs8YSBocmVmPSJodHRwOi8vY29ubmVjdC5teWlkcC5jb20iPmNvbm5lY3Qu bXlpZHAuY29tPC9hPiZxdW90O10sPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2 MTU0LDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEyLjBwdCI+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90Oyw8bzpwPjwv bzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZu YnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8 dT48c3BhbiBzdHlsZT0iY29sb3I6IzAwNjlEOSI+PGEgaHJlZj0iaHR0cDovL3NjaGVtYXMub3Bl bmlkLm5ldC9yaXNjL2V2ZW50LXR5cGUvYWNjb3VudC1kZWxldGVkIj5odHRwOi8vc2NoZW1hcy5v cGVuaWQubmV0L3Jpc2MvZXZlbnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQ8L2E+PC9zcGFuPjwvdT4m cXVvdDs6IHs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPn08L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyB9PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8 cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij59PC9zcGFuPjxvOnA+PC9vOnA+PC9w cmU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QlVULCB3 aGVuIGlzc3VlZCBieSBhIHBhcnR5IG90aGVyIHRoYW4gdGhlIGlzc3VlciBvZiB0aGUgc3ViamVj dDo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9y ZTogcGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPns8bzpwPjwvbzpwPjwvc3Bh bj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVv dDtpc3MmcXVvdDs6ICZxdW90OzxhIGhyZWY9Imh0dHBzOi8vZXhhbXBsZXJldGFpbC5zdG9yZS5j b20iPmh0dHBzOi8vZXhhbXBsZXJldGFpbC5zdG9yZS5jb208L2E+JnF1b3Q7LDxvOnA+PC9vOnA+ PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7 ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDxvOnA+PC9vOnA+PC9z cGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZx dW90O2F1ZCZxdW90OzogWyZxdW90OzxhIGhyZWY9Imh0dHA6Ly9jb25uZWN0Lm15aWRwLmNvbSI+ Y29ubmVjdC5teWlkcC5jb208L2E+JnF1b3Q7XSw8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6 IDE0NzE1NjYxNTQsPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtiV0pxJnF1b3Q7 LDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90OzogezxvOnA+PC9vOnA+PC9zcGFuPjwvcHJl Pg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZxdW90Ozx1PjxzcGFuIHN0eWxlPSJjb2xvcjojMDA2OUQ5Ij48YSBocmVmPSJodHRwOi8vc2No ZW1hcy5vcGVuaWQubmV0L3Jpc2MvIj5odHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3Jpc2MvPC9h PmV2ZW50LXR5cGUvYWNjb3VudC1kZWxldGVkPC9zcGFuPjwvdT4mcXVvdDs6IHs8L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDtpc3PigJ06JnF1b3Q7PGEgaHJlZj0iaHR0cDovL2Nvbm5lY3QubXlpZHAuY29tIj5jb25uZWN0 Lm15aWRwLmNvbTwvYT7igJ08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJy ZWFrLWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZu YnNwOyZuYnNwOyB9PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsgfTxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB5b3UgYXJlIHdyaXRpbmcg Y29kZSwgaWYgeW91IGFncmVlIHRoYXQgdGhlIE9QIGlzc3VlcyBhIGxvdCBvZiBldmVudHMsIHlv dSBlbmQgdXAgaGF2aW5nIHRvIGNoZWNrIHRoYXQgdGhlcmXigJlzIG5vIGVtYmVkZGVkIOKAnGlz c+KAnSBwcmVzZW50IGJlZm9yZSB5b3UgY2FuIGFzc3VtZSB0aGUgaXNzdWVyIG9mIHRoZSBzdWJq ZWN0IGlzIHRoZSBzYW1lIGFzIHRoYXQgb2YgdGhlIFNFVCB0b2tlbi4gJm5ic3A7VGhpcyBzdHJp a2VzDQogbWUgYXMgdmVyeSBjb21wbGV4LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SZWdhcmRpbmcgeW91ciBhc3NlcnRpb246PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+QW55IOKAnHN1YuKAnSBhdCB0aGUgdG9wLWxldmVs IChpZiBhbnkpIHNob3VsZCBiZSBhc3NvY2lhdGVkIHdpdGggdGhlIOKAnGlzc+KAnSBhdCB0aGUg dG9wLWxldmVsLCB3aGljaCBpcyBhbHdheXMgdGhlIGV2ZW50IGlzc3Vlci48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk1heSBiZSB5b3UgYXJlIHRoaW5raW5nIHRoYXQgd2Ugc2hvdWxkIGJlIHNvbHZpbmcg dGhpcyBieSBhbHdheXMgaXNzdWluZyBlbWJlZGRlZCBpc3MgYW5kIHN1YiAoQWx0ZXJuYXRpdmUg MSk6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cHJlIHN0 eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij57 PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL2V4YW1w bGVyZXRhaWwuc3RvcmUuY29tIj5odHRwczovL2V4YW1wbGVyZXRhaWwuc3RvcmUuY29tPC9hPiZx dW90OywmbmJzcDsgPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmcXVvdDthdWQmcXVvdDs6IFsmcXVvdDs8YSBo cmVmPSJodHRwOi8vY29ubmVjdC5teWlkcC5jb20iPmNvbm5lY3QubXlpZHAuY29tPC9hPiZxdW90 O10sPG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0LDxvOnA+PC9vOnA+PC9z cGFuPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZx dW90O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90Oyw8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4N CjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtldmVudHMm cXVvdDs6IHs8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8dT48c3BhbiBzdHlsZT0iY29s b3I6IzAwNjlEOSI+PGEgaHJlZj0iaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjL2V2ZW50 LXR5cGUvYWNjb3VudC1kZWxldGVkIj5odHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3Jpc2MvZXZl bnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQ8L2E+PC9zcGFuPjwvdT4mcXVvdDs6IHs8L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDtpc3PigJ064oCdPGEgaHJlZj0iaHR0cDovL2Nvbm5lY3QubXlpZHAuY29tIj5jb25uZWN0Lm15 aWRwLmNvbTwvYT7igJ08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFr LWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQi PiZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDwvc3Bhbj48bzpwPjwv bzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IH08bzpwPjwvbzpwPjwvc3Bhbj48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyB9PG86cD48 L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij59 PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8ZGl2Pg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcHJlPg0KPC9kaXY+DQo8L2Rpdj4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTog cGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMy41cHQiPk9SLCBBbHRlcm5hdGl2ZSAyOjwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ezxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0K PHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2lzcyZxdW90 OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNvbSI+aHR0cHM6 Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNvbTwvYT4mcXVvdDssPG86cD48L286cD48L3NwYW4+PC9w cmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7c3Vi JnF1b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDssPG86cD48L286cD48L3NwYW4+PC9wcmU+ DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7YXVkJnF1 b3Q7OiBbJnF1b3Q7PGEgaHJlZj0iaHR0cDovL2Nvbm5lY3QubXlpZHAuY29tIj5jb25uZWN0Lm15 aWRwLmNvbTwvYT4mcXVvdDtdLDxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2lhdCZxdW90OzogMTQ3MTU2NjE1 NCw8bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPiZuYnNwOyAmcXVvdDtqdGkmcXVvdDs6IOKAnGJXSnEmcXVvdDs8L3NwYW4+PG86cD48 L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyDigJxzdWJJc3PigJ064oCdPGEgaHJlZj0iaHR0cDov L2Nvbm5lY3QubXlpZHAuY29tIj5jb25uZWN0Lm15aWRwLmNvbTwvYT7igJ0sPG86cD48L286cD48 L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsg JnF1b3Q7ZXZlbnRzJnF1b3Q7OiB7PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7PHU+PHNw YW4gc3R5bGU9ImNvbG9yOiMwMDY5RDkiPjxhIGhyZWY9Imh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5u ZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVsZXRlZCI+aHR0cDovL3NjaGVtYXMub3Blbmlk Lm5ldC9yaXNjL2V2ZW50LXR5cGUvYWNjb3VudC1kZWxldGVkPC9hPjwvc3Bhbj48L3U+JnF1b3Q7 OiB7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij59PC9zcGFuPjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij4mbmJzcDsgfTxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0K PHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48bzpwPiZuYnNwOzwvbzpwPjwvcHJlPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBjYW4gc2VlIHByb3MgYW5kIGNv bnMgZm9yIGVpdGhlci4gSSBsaWtlIG9wdGlvbiAxIGJlY2F1c2UgaXQgYWxzbyBtYWtlcyB0aGUg U0VUIGRpZmZlcmVudCBmcm9tIElEIFRva2VucyBhbmQgQWNjZXNzIFRva2Vucy48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T3B0aW9uIDIgaXMg bmljZSBiZWNhdXNlIG1vc3QgU0VUcyB3ZeKAmXZlIGJlZW4gdGFsa2luZyBhYm91dCBqdXN0IGhh dmUgYW4gZXZlbnQgdHlwZSBhbmQgYSBzdWJqZWN0IGFuZCBubyBjbGFpbXMuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSBiZXN0IHdheSB0 byBkZWZpbmUgdGhpcyBpcyB0byBlbmZvcmNlIHRoYXQgc3ViIG1heSBvbmx5IGJlIHVzZWQgYXQg dGhlIHRvcCBsZXZlbCBpZiBpdCBpcyBnbG9iYWxseSBpZGVudGlmaWFibGUgKGUuZy4gc3VjaCBh cyBpbiB0aGUgY2FzZSBvZiBTQ0lNIFVSSXMpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ UGhpbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOmJsYWNrIj5PcmFjbGUgQ29ycG9yYXRpb24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFy Y2hpdGVjdCAmYW1wOyBTdGFuZGFyZHM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkBpbmRl cGVuZGVudGlkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48YSBocmVmPSJodHRwOi8vd3d3 LmluZGVwZW5kZW50aWQuY29tIj53d3cuaW5kZXBlbmRlbnRpZC5jb208L2E+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzpwaGlsLmh1 bnRAb3JhY2xlLmNvbSI+cGhpbC5odW50QG9yYWNsZS5jb208L2E+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNYXkgMTgsIDIwMTcsIGF0IDEwOjQwIEFNLCBNaWtlIEpv bmVzICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYw Ij5JIGJlbGlldmUgdGhhdCB0aGUgc29sdXRpb24gYWxyZWFkeSBkaXNjdXNzZWQgaXMgdGhlIGJl c3Qgb25lLiZuYnNwOyBJZiB0aGUgZXZlbnQgaXNzdWVyIGlzIGRpZmZlcmVudCB0aGFuIGEgbG9n aWNhbCBpc3N1ZXIgYXNzb2NpYXRlZCB3aXRoIHRoZSBldmVudCBzdWJqZWN0LCB0aGVuDQogcHV0 IHRoZSBsb2dpY2FsIOKAnGlzc+KAnSBhbmQg4oCcc3Vi4oCdIHZhbHVlcyBpbnNpZGUgdGhlIGV2 ZW50LiZuYnNwOyBBbnkg4oCcc3Vi4oCdIGF0IHRoZSB0b3AtbGV2ZWwgKGlmIGFueSkgc2hvdWxk IGJlIGFzc29jaWF0ZWQgd2l0aCB0aGUg4oCcaXNz4oCdIGF0IHRoZSB0b3AtbGV2ZWwsIHdoaWNo IGlzIGFsd2F5cyB0aGUgZXZlbnQgaXNzdWVyLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+QW55IHByb3Bvc2Fs IHRoYXQgcmVxdWlyZXMgZHVwbGljYXRpbmcgaW5mb3JtYXRpb24sIHN1Y2ggYXMgcmVxdWlyaW5n IOKAnHN1Yklzc+KAnSBldmVuIHdoZW4gaXTigJlzIGFsd2F5cyBpZGVudGljYWwgdG8g4oCcaXNz 4oCdLCBpcyBub3QgYSBncmVhdCBhcmNoaXRlY3R1cmFsIGNob2ljZSwNCiBzaW5jZSBpdCBjcmVh dGVzIHVubmVjZXNzYXJ5IGVycm9yIGNvbmRpdGlvbnMgdGhhdCB3b3VsZCBub3Qgb3RoZXJ3aXNl IGJlIHBvc3NpYmxlLiZuYnNwOyAoSG93IHNob3VsZCBpbXBsZW1lbnRhdGlvbnMgaGFuZGxlIHRo ZSBjYXNlIHdoZXJlIHR3byB2YWx1ZXMgYXJlIHJlcXVpcmVkIHRvIG1hdGNoIGJ1dCBkb27igJl0 Pyk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAt LSBNaWtlPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFu PjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JZC1ldmVudA0KIFs8YSBocmVm PSJtYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+bWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPl08c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24gQmVoYWxmIE9m PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5QaGls IEh1bnQgKElETSk8YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+VGh1cnNkYXksIE1heSAxOCwgMjAxNyA3OjMxIEFNPGJyPg0K PGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj5EaWNrIEhhcmR0ICZsdDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iPjxz cGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmRpY2suaGFyZHRAZ21haWwuY29tPC9zcGFuPjwvYT4m Z3Q7PGJyPg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZu YnNwOzwvc3Bhbj5JRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQt ZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmlkLWV2ZW50QGlldGYu b3JnPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbSWQtZXZlbnRdIERlYWxpbmcgd2l0 aCBpc3N1ZXIgY29uZmxpY3Q8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Pz88bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SGFwcGVucyBpbiBhbnkgY2FzZSB3aGVyZSBzdWIgaXMgbm90IGds b2JhbGx5IGlkZW50aWZpYWJsZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4g Q29ubmVjdCwgc2luY2Ugc3ViIGlzIG5vdCB1bmlxdWVseSBpZGVudGlmaWVkLCB0aGUgaXNzIGZv ciB0aGUgc3ViIG11c3QgYmUgaW5jbHVkZWQuIFRoaXMgY3JlYXRlcyBhIGNvbmZsaWN0IGlmIHRo ZSBpc3N1ZXIgb2YgdGhlIFNFVCBpcyBub3QgdGhlIGlzc3VlciBvZiB0aGUgc3ViamVjdC4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVzb2x2aW5nIHRoZSBpc3MgY29uZmxpY3Qg aGFzIGJlZW4gb24gdGhlIGxpc3Qgb2YgaXNzdWVzIHNpbmNlIGNoaWNhZ28uJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIFJJU0Mgd2Ugd2VyZSBkaXNjdXNzaW5nIGFjY291bnQg Y2xvc2UgZXZlbnRzLiBJIGFtIGFzc3VtZSBvbmUgb2YgdGhlIHNjZW5hcmlvcyBpcyBSUHMgd2ls bCBub3RpZnkgSURQcyB3aGVuIHRoZXkgY2xvc2UgYW4gYWNjb3VudC4gVGhleSBtdXN0IHVzZSBh biBpc3Mgbm90IGFzc29jaWF0ZWQgd2l0aCBzdWIuIEFzIHRoaW5ncyBzdGFuZCBub3csIHRoZXkg d2lsbCBoYXZlIHRvIGFzc2VydCB0aGUgZXh0cmENCiBpc3MgdmFsdWUgaW4gdGhlaXIgcGF5bG9h ZC0tLXdoaWNoIGZvciBtb3N0IGV2ZW50cyBpcyBjb21wbGV4IHRvIHBhcnNlIHNpbmNlIHRoZWly IGFyZSBubyBvdGhlciBleHRyYSBjbGFpbXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpPbiBNYXkgMTgs IDIwMTcsIGF0IDY6MzYgQU0sIERpY2sgSGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhh cmR0QGdtYWlsLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ZGljay5oYXJkdEBnbWFp bC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbCwgd291bGQgeW91IGNs YXJpZnkgdGhlIHVzZSBjYXNlIGFuZCB0aGUgcmVxdWlyZW1lbnQgdG8gZW5zdXJlIGV2ZXJ5b25l IG9uIHRoZSBsaXN0IGlzIGFsaWduZWQ/IFRoYW5rczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIFdlZCwgTWF5IDE3LCAyMDE3IGF0IDk6NDUgUE0gUGhpbCBIdW50IChJRE0pICZsdDs8YSBo cmVmPSJtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPnBoaWwuaHVudEBvcmFjbGUuY29tPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFy Z2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1i b3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIG1hbnkgY2FzZXMg d2hlcmUgd2UgYXJlIHRhbGtpbmcgYWJvdXQgZXZlbnRzIChlZyByaXNjKSB0aGVyZSBpcyBubyBu ZWVkIGZvciBleHRyYSBjbGFpbXMgb3RoZXIgdGhhbiB0aGUgZXZlbnQgdHlwZSBpdHNlbGYuPGJy Pg0KPGJyPg0KSXQgb2NjdXJzIHRvIG1lIHRoYXQgaW4gdGhlIGNhc2Ugb2YgUlAgaXNzdWVkIGV2 ZW50cyB0aGUgY3VycmVudCBzZWN0b2tlbiBmb3JtYXQgcmVxdWlyZXMgYW4gZW1iZWRkZWQgaXNz IHRvIGRlYWwgd2l0aCB0aGUgY29uZmxpY3Qgd2l0aCB0aGUgc2V0IGlzc3Vlci4gSXQgc2VlbXMg dG8gYWRkIGEgbG90IG9mIGNvbXBsaWNhdGlvbiBmb3IgbW9zdCBldmVudHMuPGJyPg0KPGJyPg0K V2hhdCBpZiB3ZSBkZWZpbmVkIGEgbmV3IHNlY3Rva2VuIHRvcCBsZXZlbCBhdHRyaWJ1dGUgJ3N1 YklzcycgdG8gbWVhbiAmcXVvdDtzdWJqZWN0IGlzc3VlciZxdW90OyBhbmQga2VlcCBpc3MgcmVz ZXJ2ZWQgZm9yIHRoZSBTRVQgaXNzdWVyLjxicj4NCjxicj4NCkkgd291bGQgc3VnZ2VzdCB0aGlz IGFzIGEgcmVjb21tZW5kZWQgYXR0cmlidXRlIGV2ZW4gd2hlbiBpc3MgYW5kIHN1YklzcyBhcmUg dGhlIHNhbWUgZm9yIHBhcnNpbmcgY29uc2lzdGVuY3kuPGJyPg0KPGJyPg0KVGhvdWdodHM/PGJy Pg0KPGJyPg0KUGhpbDxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRv OklkLWV2ZW50QGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8v dXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3Jn X21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed01GYVEmYW1wO2M9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZr SVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXAxVnNkMUhiN0JYODdzVjR4OU1odHNH Yk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9QVRZek9YWEd0bzVhZml0M09nVGpoMTlLY3p4S0N2 YUJ3QzdmdG9mSE1ycyZhbXA7ZT0iIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9z cGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LS08c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN1YnNjcmliZSB0byB0aGU8c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2hhcmR0d2FyZS5jb21fJmFtcDtk PUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209 cDFWc2QxSGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZhbXA7cz1OR2JDQWZC RWw1VHRza1dkampXT1kyY1FKQTNGc3k5UXZudFBuc3R5SWtjJmFtcDtlPSIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPkhBUkRUV0FSRTwvc3Bhbj48L2E+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPm1haWwNCiBsaXN0IHRv IGxlYXJuIGFib3V0IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiE8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Jsb2NrcXVvdGU+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpJZC1l dmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmci PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48 YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9 RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1w MVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JmFtcDtzPUFUWXpPWFhH dG81YWZpdDNPZ1RqaDE5S2N6eEtDdmFCd0M3ZnRvZkhNcnMmYW1wO2U9Ij48c3BhbiBzdHlsZT0i Y29sb3I6cHVycGxlIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9 aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZlbnQmYW1wO2Q9 RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm YW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1w MVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JmFtcDtzPUFUWXpPWFhH dG81YWZpdDNPZ1RqaDE5S2N6eEtDdmFCd0M3ZnRvZkhNcnMmYW1wO2U9PC9zcGFuPjwvYT48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjwvc3Bhbj48 YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 cHVycGxlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJy Pg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZh bXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPThMZkNZb3gweTNnaE44WUFYTHJBYjV6ZlV0NXJWRDh2YndLd3Z3OC1SamsmYW1wO3M9Z3Y0 LXlOOExEVmlyODJXRVd6aXg2MS1ZemtyZnF1RVBLTWtfVHRMeWxydyZhbXA7ZT0iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6cHVycGxlIj5odHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX3d3dy5pZXRmLm9yZ19tYWlsbWFuX2xpc3RpbmZvX2lkLTJEZXZl bnQmYW1wO2Q9RHdJQ0FnJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZ MDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElH ayZhbXA7bT04TGZDWW94MHkzZ2hOOFlBWExyQWI1emZVdDVyVkQ4dmJ3S3d2dzgtUmprJmFtcDtz PWd2NC15TjhMRFZpcjgyV0VXeml4NjEtWXprcmZxdUVQS01rX1R0THlscncmYW1wO2U9PC9zcGFu PjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB0504BE77665A866FF1960E58F5E40CY4PR21MB0504namp_-- From nobody Thu May 18 12:40:07 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 237FC12E91F for ; Thu, 18 May 2017 12:40:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.218 X-Spam-Level: X-Spam-Status: No, score=-4.218 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zt4RZwUoWwCZ for ; Thu, 18 May 2017 12:40:01 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5968A129B01 for ; Thu, 18 May 2017 12:34:26 -0700 (PDT) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4IJYOg1026254 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 18 May 2017 19:34:24 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v4IJYOmR018957 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 18 May 2017 19:34:24 GMT Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v4IJYNFv020733; Thu, 18 May 2017 19:34:24 GMT Received: from [192.168.1.13] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 18 May 2017 12:34:23 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-4FE7D51D-3D04-4266-A046-8E6CEADF6105 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14E304) In-Reply-To: Date: Thu, 18 May 2017 12:34:21 -0700 Cc: Dick Hardt , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> To: Mike Jones X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 19:40:05 -0000 --Apple-Mail-4FE7D51D-3D04-4266-A046-8E6CEADF6105 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks Mike.=20 I think we disagree. The concern I have is that most implementers will have to write code that al= ways checks for the absence of a duplicate issuer claim because it changes t= he meaning of subject. This strikes me as complexity that needs to be dealt with in the core spec. I= t stems from our SecToken's use of JWT and its popular use today. If every profiling spec can do this differently requiring different parsers w= hats the point of secevents? Phil > On May 18, 2017, at 12:08 PM, Mike Jones wro= te: >=20 > Most of what you=E2=80=99re talking about seems to me to be decisions that= can be made by particular event definitions or event family definitions. I= have no problem with particular events or event families employing some of t= he strategies that you=E2=80=99re describing. The SET spec already facilita= tes that. > =20 > But per previous discussions, we shouldn=E2=80=99t be making restrictions i= n the SET spec that limit its applicability by making restrictions on claims= usage that will only work for some event use cases and will rule out others= . We should hold to the bright-line test that event definitions define what= claims are included in SETS (other than the =E2=80=9Cevents=E2=80=9D claim i= tself) and how they=E2=80=99re used. Intruding on that will unnecessarily l= imit the applicability of SETs. > =20 > -- Mike > =20 > From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 > Sent: Thursday, May 18, 2017 11:41 AM > To: Mike Jones > Cc: Dick Hardt ; ID Events Mailing List > Subject: Re: [Id-event] Dealing with issuer conflict > =20 > Mike, > =20 > I=E2=80=99m not sure we=E2=80=99re on the same page here. My impression is= this is still on the outstanding list. > =20 > Let=E2=80=99s look at some example cases: > =20 > For example, if a relying party (e.g. retail store) wants to notify an IDP= that the user has been deleted=E2=80=A6 > =20 > Currently in the draft: > When issued by an OpenID Connect issuer: > { > "iss": "https://connect.myidp.com", > "sub": "248289761001", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": {} > } > } > =20 > BUT, when issued by a party other than the issuer of the subject: > { > "iss": "https://exampleretail.store.com", > "sub": "248289761001", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": { > "iss=E2=80=9D:"connect.myidp.com=E2=80=9D > } > } > } > =20 > If you are writing code, if you agree that the OP issues a lot of events, y= ou end up having to check that there=E2=80=99s no embedded =E2=80=9Ciss=E2=80= =9D present before you can assume the issuer of the subject is the same as t= hat of the SET token. This strikes me as very complex. > =20 > Regarding your assertion: > Any =E2=80=9Csub=E2=80=9D at the top-level (if any) should be associated w= ith the =E2=80=9Ciss=E2=80=9D at the top-level, which is always the event is= suer. > =20 > May be you are thinking that we should be solving this by always issuing e= mbedded iss and sub (Alternative 1): > { > "iss": "https://exampleretail.store.com", =20 > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": { > "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D > "sub": "248289761001", > } > } > } > =20 > OR, Alternative 2: > { > "iss": "https://exampleretail.store.com", > "sub": "248289761001", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": =E2=80=9CbWJq" > =E2=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D, > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": {} > } > } > =20 > I can see pros and cons for either. I like option 1 because it also makes t= he SET different from ID Tokens and Access Tokens. > =20 > Option 2 is nice because most SETs we=E2=80=99ve been talking about just h= ave an event type and a subject and no claims. > =20 > The best way to define this is to enforce that sub may only be used at the= top level if it is globally identifiable (e.g. such as in the case of SCIM U= RIs). > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > On May 18, 2017, at 10:40 AM, Mike Jones wro= te: > =20 > I believe that the solution already discussed is the best one. If the eve= nt issuer is different than a logical issuer associated with the event subje= ct, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D val= ues inside the event. Any =E2=80=9Csub=E2=80=9D at the top-level (if any) s= hould be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which i= s always the event issuer. > =20 > Any proposal that requires duplicating information, such as requiring =E2=80= =9CsubIss=E2=80=9D even when it=E2=80=99s always identical to =E2=80=9Ciss=E2= =80=9D, is not a great architectural choice, since it creates unnecessary er= ror conditions that would not otherwise be possible. (How should implementa= tions handle the case where two values are required to match but don=E2=80=99= t?) > =20 > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt (= IDM) > Sent: Thursday, May 18, 2017 7:31 AM > To: Dick Hardt > Cc: ID Events Mailing List > Subject: Re: [Id-event] Dealing with issuer conflict > =20 > ?? > =20 > Happens in any case where sub is not globally identifiable.=20 > =20 > In Connect, since sub is not uniquely identified, the iss for the sub must= be included. This creates a conflict if the issuer of the SET is not the is= suer of the subject.=20 > =20 > Resolving the iss conflict has been on the list of issues since chicago.=20= > =20 > In RISC we were discussing account close events. I am assume one of the sc= enarios is RPs will notify IDPs when they close an account. They must use an= iss not associated with sub. As things stand now, they will have to assert t= he extra iss value in their payload---which for most events is complex to pa= rse since their are no other extra claims.=20 > =20 > Phil >=20 > On May 18, 2017, at 6:36 AM, Dick Hardt wrote: >=20 > Phil, would you clarify the use case and the requirement to ensure everyon= e on the list is aligned? Thanks > =20 > On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) wro= te: > In many cases where we are talking about events (eg risc) there is no need= for extra claims other than the event type itself. >=20 > It occurs to me that in the case of RP issued events the current sectoken f= ormat requires an embedded iss to deal with the conflict with the set issuer= . It seems to add a lot of complication for most events. >=20 > What if we defined a new sectoken top level attribute 'subIss' to mean "su= bject issuer" and keep iss reserved for the SET issuer. >=20 > I would suggest this as a recommended attribute even when iss and subIss a= re the same for parsing consistency. >=20 > Thoughts? >=20 > Phil > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --=20 > Subscribe to the HARDTWARE mail list to learn about projects I am working o= n! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dp1Vsd1Hb7BX87sV4x9M= htsGbORcuiacHxujwThSnWh4&s=3DATYzOXXGto5afit3OgTjh19KczxKCvaBwC7ftofHMrs&e=3D= > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAXLr= Ab5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLylrw&e=3D= =20 > =20 --Apple-Mail-4FE7D51D-3D04-4266-A046-8E6CEADF6105 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Thanks Mike. 

I think we disagre= e.

The concern I have is that most implementers will have to write code tha= t always checks for the absence of a duplicate issuer claim because it chang= es the meaning of subject.

This strikes me as complexity that needs to be d= ealt with in the core spec. It stems from our SecToken's use of JWT and its p= opular use today.

If every profiling spec can do this differently requiring= different parsers whats the point of secevents?

Phil

On May 1= 8, 2017, at 12:08 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Most of what you=E2=80=99re talking abo= ut seems to me to be decisions that can be made by particular event definiti= ons or event family definitions.  I have no problem with particular events or event families employing some of the strategies t= hat you=E2=80=99re describing.  The SET spec already facilitates that.<= o:p>

 

But per previous discussions, we should= n=E2=80=99t be making restrictions in the SET spec that limit its applicabil= ity by making restrictions on claims usage that will only work for some event use cases and will rule out others.  We shoul= d hold to the bright-line test that event definitions define what claims are= included in SETS (other than the =E2=80=9Cevents=E2=80=9D claim itself) and= how they=E2=80=99re used.  Intruding on that will unnecessarily limit the applicability of SETs.

 

      &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;      -- Mike

 

From: Phil Hunt [mailto:phil.hunt@oracle.com]
Sent: Thursday, May 18, 2017 11:41 AM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: Dick Hardt <dick.hardt= @gmail.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Dealing with issuer conflict

 

Mike,

 

I=E2=80=99m not sure we=E2=80=99re on the same page h= ere. My impression is this is still on the outstanding list.

 

Let=E2=80=99s look at some example cases:<= /p>

 

For example, if a relying party (e.g. retail store) w= ants to notify an IDP that the user has been deleted=E2=80=A6

=

 

Currently in the draft:

When issued by an OpenID Connect issuer:

{<= /p> 

  "i=
ss": "https://connect.myidp.com",
  "sub": "248289761001",
  "aud": ["connect.my=
idp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {

    "http://schem=
as.openid.net/risc/event-type/account-deleted": {}


  }<=
o:p>


}

 

BUT, when issued by a party other than the issuer of t= he subject:

{
  "iss": "http=
s://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.my=
idp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {

    "http://schemas.openid.net/risc/event-t=
ype/account-deleted": {


 &nb=
sp;    "iss=E2=80=9D:"connect.myidp.com=E2=80=
=9D


 &nb=
sp;  }


  }


}




 

If you are writing code, if you agree that the OP iss= ues a lot of events, you end up having to check that there=E2=80=99s no embe= dded =E2=80=9Ciss=E2=80=9D present before you can assume the issuer of the s= ubject is the same as that of the SET token.  This strikes me as very complex.

 

Regarding your assertion:

Any =E2=80=9Csub=E2=80=9D at the top-le= vel (if any) should be associated with the =E2=80=9Ciss=E2=80=9D at the top-= level, which is always the event issuer.

 

May be you are thinking that we should be solving thi= s by always issuing embedded iss and sub (Alternative 1):

{
  "iss": "http=
s://exampleretail.store.com",  
  "aud": ["conne=
ct.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {

    "http://schem=
as.openid.net/risc/event-type/account-deleted": {=



 &nb=
sp;    "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D


 &nb=
sp;    "sub": "248289=
761001",


 &nb=
sp;  }


  }


}




 =
;




OR, Alter=
native 2:
{
  "iss": "http=
s://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.my=
idp.com"],
  "iat": 1471566154,
  "jti": =E2=80=9CbWJq"
  =E2=
=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D,
  "events": {

    "http://schem=
as.openid.net/risc/event-type/account-deleted": {}


  }<=
o:p>


}


 

I can see pros and cons for either. I like option 1 b= ecause it also makes the SET different from ID Tokens and Access Tokens.

 

Option 2 is nice because most SETs we=E2=80=99ve been= talking about just have an event type and a subject and no claims.

 

The best way to define this is to enforce that sub ma= y only be used at the top level if it is globally identifiable (e.g. such as= in the case of SCIM URIs).

 

Phil

 <= /p>

Oracle Corporation, Ident= ity Cloud Services Architect & Standards

@independentid=

phil.hunt@oracle.com

 

On May 18, 2017, at 10:40 AM, Mike Jones <Michael.Jones@microsoft.com> wro= te:

 

I believe that the solution already dis= cussed is the best one.  If the event issuer is different than a logica= l issuer associated with the event subject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D values insi= de the event.  Any =E2=80=9Csub=E2=80=9D at the top-level (if any) shou= ld be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which is a= lways the event issuer.

 

Any proposal that requires duplicating i= nformation, such as requiring =E2=80=9CsubIss=E2=80=9D even when it=E2=80=99= s always identical to =E2=80=9Ciss=E2=80=9D, is not a great architectural ch= oice, since it creates unnecessary error conditions that would not otherwise be p= ossible.  (How should implementations handle the case where two values a= re required to match but don=E2=80=99t?)

 

      &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;      -- Mike

 

From: Id-event [= mailto:id-event-bounces@ietf.org] On Behalf Of&nbs= p;Phil Hunt (IDM)
Sent: Thursday, May= 18, 2017 7:31 AM
To: Dick Hardt <= dick.ha= rdt@gmail.com>
Cc: ID Events Maili= ng List <id-event@ietf.org>
Subject: Re: [Id-ev= ent] Dealing with issuer conflict

 

??

 

Happens in any case where sub is not globally identif= iable. 

 

In Connect, since sub is not uniquely identified, the= iss for the sub must be included. This creates a conflict if the issuer of t= he SET is not the issuer of the subject. 

 

Resolving the iss conflict has been on the list of is= sues since chicago. 

 

In RISC we were discussing account close events. I am= assume one of the scenarios is RPs will notify IDPs when they close an acco= unt. They must use an iss not associated with sub. As things stand now, they= will have to assert the extra iss value in their payload---which for most events is complex to parse sinc= e their are no other extra claims. 

 

Phil


On May 18, 2017, at 6:36 AM, Dick Hardt <dick.hardt@gmail.com> wro= te:

Phil, would you clarify the use case and the requirem= ent to ensure everyone on the list is aligned? Thanks

 

On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) <<= a href=3D"mailto:phil.hunt@oracle.com">phil.hun= t@oracle.com> wrote:

In many cases where we are talking about events (eg r= isc) there is no need for extra claims other than the event type itself.
=
It occurs to me that in the case of RP issued events the current sectoken fo= rmat requires an embedded iss to deal with the conflict with the set issuer.= It seems to add a lot of complication for most events.

What if we defined a new sectoken top level attribute 'subIss' to mean "subj= ect issuer" and keep iss reserved for the SET issuer.

I would suggest this as a recommended attribute even when iss and subIss are= the same for parsing consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= /p>

-- =

Subscribe to the HARDTW= ARE mail list to learn about projects I am working on!

_______________________________________________
Id-event mailing list
Id-event@ietf.org<= /span>
https://urldefense.= proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent= &d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAXLrAb5zf= Ut5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLylrw&= e=3D 

 

= --Apple-Mail-4FE7D51D-3D04-4266-A046-8E6CEADF6105-- From nobody Thu May 18 12:52:33 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C04712EBDC for ; Thu, 18 May 2017 12:52:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.799 X-Spam-Level: X-Spam-Status: No, score=-4.799 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7SUwxWG5pbuf for ; Thu, 18 May 2017 12:52:25 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0135.outbound.protection.outlook.com [104.47.38.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04C7A129B18 for ; Thu, 18 May 2017 12:46:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=tneS8rEAwwYAn1NOKMUxnOv2ShvNRiypMl7SE9//+nI=; b=l2nfUigCAEjBrHSb/EP8OtzY5WvsGlNlhKeaY7+0nOXURgTAKuKmpRuXFjA4SDDgDbCKt5VvlBs/7y3AzLOVUrKcpFzuUKc/BlPWVO++xR0PE+Tj8h6pQYpSp7CJG69kh3TniKLA2hZtbRhf0vXNjpJLY/Uc+/I3eSmkF+dmsyo= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0183.namprd21.prod.outlook.com (10.173.193.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.0; Thu, 18 May 2017 19:46:40 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1124.007; Thu, 18 May 2017 19:46:41 +0000 From: Mike Jones To: "Phil Hunt (IDM)" CC: Dick Hardt , ID Events Mailing List Thread-Topic: [Id-event] Dealing with issuer conflict Thread-Index: AQHSz5GPBeIUkwXJI0S9grGRbpCBVKH6GH8AgAAO/4CAADPHoIAAEkCAgAAGbLCAAAhqgIAAAahg Date: Thu, 18 May 2017 19:46:40 +0000 Message-ID: References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> In-Reply-To: <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetBy=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-05-18T12:46:38.5076864-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:3::32c] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0183; 7:rd6FNGQdMpUJSQujHhoWycAGKdxmxYYoMCTBO/gqPpN0U78l4sJDhdie1E2G2e9dR9umhaA2IjF4fpP1By6UKK8I7FBqK3/ufqT1QTaujL7csLCEuLLp1Oq7aA5VLtjiXVSmKbYJQJgxvsxaftav3uhMgR3Cr1qSCPrx/PZAt+zBtifIYQn+KMuWtJEHhJJku0cH91fVR2V3sRwa0Y1cebD62tWCD5HMomSQSXnq+8KKw4QUwLgH+/GELPb2m+arsTTfVmSqDwXcjimIISiGR4cNewFeJRoCucZN0aOuM/mRLrLDwtBTszBLW/suIERZqaZrp8xosZJzpEJP09LVxXJGETWybReCXpQQsGC59Ds= x-ms-traffictypediagnostic: CY4PR21MB0183: x-ms-office365-filtering-correlation-id: bb547f20-c01d-4169-4303-08d49e269ae0 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081)(201702281549075); SRVR:CY4PR21MB0183; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(21748063052155)(21532816269658)(146099531331640)(17755550239193)(5213294742642); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006095)(93001095)(100000703036)(100105400095)(6055026)(61426038)(61427038)(6041248)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123560025)(20161123558100)(20161123562025)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:CY4PR21MB0183; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:CY4PR21MB0183; x-forefront-prvs: 0311124FA9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39450400003)(39840400002)(39400400002)(39410400002)(39850400002)(377454003)(24454002)(51444003)(54356999)(76176999)(10290500003)(2900100001)(236005)(189998001)(561944003)(2906002)(86612001)(33656002)(8936002)(72206003)(478600001)(50986999)(3280700002)(54906002)(6306002)(99286003)(9686003)(55016002)(6506006)(606005)(7906003)(54896002)(7736002)(77096006)(93886004)(3660700001)(6436002)(229853002)(4326008)(25786009)(39060400002)(966005)(53946003)(74316002)(38730400002)(53936002)(6246003)(8676002)(53546009)(5660300001)(122556002)(81166006)(2950100002)(5005710100001)(110136004)(6116002)(8990500004)(102836003)(6916009)(10090500001)(575784001)(19609705001)(86362001)(790700001)(7696004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0183; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05041186A46A2E20E01A83C1F5E40CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2017 19:46:40.8854 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0183 Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 19:52:32 -0000 --_000_CY4PR21MB05041186A46A2E20E01A83C1F5E40CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4gbWFueSB1c2UgY2FzZXMsIG9ubHkgU0VUcyBmcm9tIGEgc2luZ2xlIGV2ZW50IGZhbWlseSB3 aWxsIGJlIGxlZ2FsIGFuZCBhbGwgd2lsbCB1c2UgdGhlIHNhbWUgY2xhaW1zIGNvbnZlbnRpb25z LiAgSW4gdGhhdCBjYXNlLCBhIG5vcm1hbCBKV1QgcGFyc2VyIHdpbGwgbGlrZWx5IGJlIHVzZWQg YW5kIHRoZSBhcHBsaWNhdGlvbiB3aWxsIHByb2Nlc3MgdGhlIGFkZGl0aW9uYWwgZXZlbnQtc3Bl Y2lmaWMgY2xhaW1zLiAgVGhlcmXigJlzIG5vIGdlbmVyYWwtcHVycG9zZSBTRVQgcGFyc2VyIGlu IHRoZSBtaXguDQoNCkkgdGhpbmsgdGhhdCB0cnlpbmcgdG8gYXJjaGl0ZWN0IHRoaXMgZm9yIGEg d29ybGQgaW4gd2hpY2ggdGhlcmXigJlzIGEgc2luZ2xlIFNFVCBwYXJzZXIgZm9yIFNFVHMgb2Yg YWxsIGtpbmRzIHdvdWxkIHNrZXcgdGhlIGFyY2hpdGVjdHVyZSBhbmQgaGF2ZSB0aGUgdW5pbnRl bmRlZCBzaWRlLWVmZmVjdCBvZiBleGNsdWRpbmcgc29tZSB1c2UgY2FzZXMgdGhyb3VnaCB1bm5l Y2Vzc2FyeSBjb21wbGV4aXR5Lg0KDQpUaGUgU0VUIHNwZWMgc2hvdWxkIGRlZmluZSB0aGUg4oCc ZXZlbnRz4oCdIGNsYWltIGFuZCBzdG9wIHRoZXJlLiAgU0VUIGlzIGFscmVhZHkgcG9pc2VkIGZv ciBzdWNjZXNzIGFzIGl0IGlzIG5vdy4gIFdlIHNob3VsZG7igJl0IGFkZCByZXN0cmljdGlvbnMg dGhhdCB3aWxsIGplb3BhcmRpemUgdGhhdCBhY2hpZXZlbWVudC4gIEV2ZW50cyBhbmQgZXZlbnQg ZmFtaWxpZXMgc2hvdWxkIGRvIHRoZSByZXN0LCBpbiB3YXlzIGFwcHJvcHJpYXRlIHRvIHRoZWly IHVzZSBjYXNlcy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KUC5TLiAgSG93IHRvIHJlcHJlc2VudCBS SVNDIGV2ZW50cyB0aGF0IG1pZ2h0IGJlIGlzc3VlZCBlaXRoZXIgYnkgYW4gSWRlbnRpdHkgUHJv dmlkZXIgb3IgUmVseWluZyBwYXJ0eSBpcyBhbiBlbnRpcmVseSBhcHByb3ByaWF0ZSBkaXNjdXNz aW9uIHRvIGhhdmUgaW4gdGhlIFJJU0Mgd29ya2luZyBncm91cCwgYnV0IG5vdCBoZXJlIGluIHRo ZSBJRCBFdmVudHMgd29ya2luZyBncm91cC4NCg0KRnJvbTogUGhpbCBIdW50IChJRE0pIFttYWls dG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBUaHVyc2RheSwgTWF5IDE4LCAyMDE3IDEy OjM0IFBNDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0KQ2M6 IERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlz dCA8aWQtZXZlbnRAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBEZWFsaW5nIHdp dGggaXNzdWVyIGNvbmZsaWN0DQoNClRoYW5rcyBNaWtlLg0KDQpJIHRoaW5rIHdlIGRpc2FncmVl Lg0KDQpUaGUgY29uY2VybiBJIGhhdmUgaXMgdGhhdCBtb3N0IGltcGxlbWVudGVycyB3aWxsIGhh dmUgdG8gd3JpdGUgY29kZSB0aGF0IGFsd2F5cyBjaGVja3MgZm9yIHRoZSBhYnNlbmNlIG9mIGEg ZHVwbGljYXRlIGlzc3VlciBjbGFpbSBiZWNhdXNlIGl0IGNoYW5nZXMgdGhlIG1lYW5pbmcgb2Yg c3ViamVjdC4NCg0KVGhpcyBzdHJpa2VzIG1lIGFzIGNvbXBsZXhpdHkgdGhhdCBuZWVkcyB0byBi ZSBkZWFsdCB3aXRoIGluIHRoZSBjb3JlIHNwZWMuIEl0IHN0ZW1zIGZyb20gb3VyIFNlY1Rva2Vu J3MgdXNlIG9mIEpXVCBhbmQgaXRzIHBvcHVsYXIgdXNlIHRvZGF5Lg0KDQpJZiBldmVyeSBwcm9m aWxpbmcgc3BlYyBjYW4gZG8gdGhpcyBkaWZmZXJlbnRseSByZXF1aXJpbmcgZGlmZmVyZW50IHBh cnNlcnMgd2hhdHMgdGhlIHBvaW50IG9mIHNlY2V2ZW50cz8NCg0KUGhpbA0KDQpPbiBNYXkgMTgs IDIwMTcsIGF0IDEyOjA4IFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KTW9zdCBvZiB3 aGF0IHlvdeKAmXJlIHRhbGtpbmcgYWJvdXQgc2VlbXMgdG8gbWUgdG8gYmUgZGVjaXNpb25zIHRo YXQgY2FuIGJlIG1hZGUgYnkgcGFydGljdWxhciBldmVudCBkZWZpbml0aW9ucyBvciBldmVudCBm YW1pbHkgZGVmaW5pdGlvbnMuICBJIGhhdmUgbm8gcHJvYmxlbSB3aXRoIHBhcnRpY3VsYXIgZXZl bnRzIG9yIGV2ZW50IGZhbWlsaWVzIGVtcGxveWluZyBzb21lIG9mIHRoZSBzdHJhdGVnaWVzIHRo YXQgeW914oCZcmUgZGVzY3JpYmluZy4gIFRoZSBTRVQgc3BlYyBhbHJlYWR5IGZhY2lsaXRhdGVz IHRoYXQuDQoNCkJ1dCBwZXIgcHJldmlvdXMgZGlzY3Vzc2lvbnMsIHdlIHNob3VsZG7igJl0IGJl IG1ha2luZyByZXN0cmljdGlvbnMgaW4gdGhlIFNFVCBzcGVjIHRoYXQgbGltaXQgaXRzIGFwcGxp Y2FiaWxpdHkgYnkgbWFraW5nIHJlc3RyaWN0aW9ucyBvbiBjbGFpbXMgdXNhZ2UgdGhhdCB3aWxs IG9ubHkgd29yayBmb3Igc29tZSBldmVudCB1c2UgY2FzZXMgYW5kIHdpbGwgcnVsZSBvdXQgb3Ro ZXJzLiAgV2Ugc2hvdWxkIGhvbGQgdG8gdGhlIGJyaWdodC1saW5lIHRlc3QgdGhhdCBldmVudCBk ZWZpbml0aW9ucyBkZWZpbmUgd2hhdCBjbGFpbXMgYXJlIGluY2x1ZGVkIGluIFNFVFMgKG90aGVy IHRoYW4gdGhlIOKAnGV2ZW50c+KAnSBjbGFpbSBpdHNlbGYpIGFuZCBob3cgdGhleeKAmXJlIHVz ZWQuICBJbnRydWRpbmcgb24gdGhhdCB3aWxsIHVubmVjZXNzYXJpbHkgbGltaXQgdGhlIGFwcGxp Y2FiaWxpdHkgb2YgU0VUcy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUGhpbCBIdW50IFtt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBUaHVyc2RheSwgTWF5IDE4LCAyMDE3 IDExOjQxIEFNDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1h aWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KQ2M6IERpY2sgSGFyZHQgPGRpY2su aGFyZHRAZ21haWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+OyBJRCBFdmVudHMg TWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0Zi5vcmc+ Pg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gRGVhbGluZyB3aXRoIGlzc3VlciBjb25mbGljdA0K DQpNaWtlLA0KDQpJ4oCZbSBub3Qgc3VyZSB3ZeKAmXJlIG9uIHRoZSBzYW1lIHBhZ2UgaGVyZS4g TXkgaW1wcmVzc2lvbiBpcyB0aGlzIGlzIHN0aWxsIG9uIHRoZSBvdXRzdGFuZGluZyBsaXN0Lg0K DQpMZXTigJlzIGxvb2sgYXQgc29tZSBleGFtcGxlIGNhc2VzOg0KDQpGb3IgZXhhbXBsZSwgaWYg YSByZWx5aW5nIHBhcnR5IChlLmcuIHJldGFpbCBzdG9yZSkgd2FudHMgdG8gbm90aWZ5IGFuIElE UCB0aGF0IHRoZSB1c2VyIGhhcyBiZWVuIGRlbGV0ZWTigKYNCg0KQ3VycmVudGx5IGluIHRoZSBk cmFmdDoNCldoZW4gaXNzdWVkIGJ5IGFuIE9wZW5JRCBDb25uZWN0IGlzc3VlcjoNCnsNCg0KICAi aXNzIjogImh0dHBzOi8vY29ubmVjdC5teWlkcC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29m cG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19jb25uZWN0Lm15aWRwLmNvbSZkPUR3TUdhUSZj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVh MnEwYllsR3YteEJLUXJfUFlSTzFIZyZzPWtKNU1mbjZpMzlsb3JMZ2Jia0M0MGtCQy1IZmtvbV9u SEp3OUR2Q1RvdTgmZT0+IiwNCg0KICAic3ViIjogIjI0ODI4OTc2MTAwMSIsDQoNCiAgImF1ZCI6 IFsiY29ubmVjdC5teWlkcC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktR cl9QWVJPMUhnJnM9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZl PT4iXSwNCg0KICAiaWF0IjogMTQ3MTU2NjE1NCwNCg0KICAianRpIjogImJXSnEiLA0KDQogICJl dmVudHMiOiB7DQoNCiAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjL2V2ZW50LXR5 cGUvYWNjb3VudC1kZWxldGVkPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfcmlzY19ldmVudC0yRHR5cGVfYWNjb3Vu dC0yRGRlbGV0ZWQmZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZt PVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmcz1RSHhKeTd6cUR6 Y1JHaG1jR2hhdEEyazE1YllVTFBPRGJXNzFadGM0S3g0JmU9PiI6IHt9DQoNCiAgfQ0KDQp9DQoN CkJVVCwgd2hlbiBpc3N1ZWQgYnkgYSBwYXJ0eSBvdGhlciB0aGFuIHRoZSBpc3N1ZXIgb2YgdGhl IHN1YmplY3Q6DQoNCnsNCg0KICAiaXNzIjogImh0dHBzOi8vZXhhbXBsZXJldGFpbC5zdG9yZS5j b208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19l eGFtcGxlcmV0YWlsLnN0b3JlLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFj eEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5L ZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZz PVlaYXgwYllJeThfSjNuYzQwRTVrQU1kc3FRcHVpNlNsajRZWllxSTdiRk0mZT0+IiwNCg0KICAi c3ViIjogIjI0ODI4OTc2MTAwMSIsDQoNCiAgImF1ZCI6IFsiY29ubmVjdC5teWlkcC5jb208aHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2Nvbm5lY3Qu bXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kw NTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1a UnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9SmNNbUhNTGZOSV8z bHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZlPT4iXSwNCg0KICAiaWF0IjogMTQ3MTU2 NjE1NCwNCg0KICAianRpIjogImJXSnEiLA0KDQogICJldmVudHMiOiB7DQoNCiAgICAiaHR0cDov L3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjLzxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5j b20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3Jpc2NfJmQ9RHdNR2FRJmM9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3Vn Q0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEy cTBiWWxHdi14QktRcl9QWVJPMUhnJnM9SlZhRzVlZTZCWWYyN2VtRHl2c0c3NDlFajRYWDlkMkZj S3ZlUkoyMHd3OCZlPT5ldmVudC10eXBlL2FjY291bnQtZGVsZXRlZCI6IHsNCg0KICAgICAgImlz c+KAnToiY29ubmVjdC5teWlkcC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNY Q2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNl R0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14 QktRcl9QWVJPMUhnJnM9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndr ZyZlPT7igJ0NCg0KICAgIH0NCg0KICB9DQoNCn0NCg0KSWYgeW91IGFyZSB3cml0aW5nIGNvZGUs IGlmIHlvdSBhZ3JlZSB0aGF0IHRoZSBPUCBpc3N1ZXMgYSBsb3Qgb2YgZXZlbnRzLCB5b3UgZW5k IHVwIGhhdmluZyB0byBjaGVjayB0aGF0IHRoZXJl4oCZcyBubyBlbWJlZGRlZCDigJxpc3PigJ0g cHJlc2VudCBiZWZvcmUgeW91IGNhbiBhc3N1bWUgdGhlIGlzc3VlciBvZiB0aGUgc3ViamVjdCBp cyB0aGUgc2FtZSBhcyB0aGF0IG9mIHRoZSBTRVQgdG9rZW4uICBUaGlzIHN0cmlrZXMgbWUgYXMg dmVyeSBjb21wbGV4Lg0KDQpSZWdhcmRpbmcgeW91ciBhc3NlcnRpb246DQpBbnkg4oCcc3Vi4oCd IGF0IHRoZSB0b3AtbGV2ZWwgKGlmIGFueSkgc2hvdWxkIGJlIGFzc29jaWF0ZWQgd2l0aCB0aGUg 4oCcaXNz4oCdIGF0IHRoZSB0b3AtbGV2ZWwsIHdoaWNoIGlzIGFsd2F5cyB0aGUgZXZlbnQgaXNz dWVyLg0KDQpNYXkgYmUgeW91IGFyZSB0aGlua2luZyB0aGF0IHdlIHNob3VsZCBiZSBzb2x2aW5n IHRoaXMgYnkgYWx3YXlzIGlzc3VpbmcgZW1iZWRkZWQgaXNzIGFuZCBzdWIgKEFsdGVybmF0aXZl IDEpOg0KDQp7DQoNCiAgImlzcyI6ICJodHRwczovL2V4YW1wbGVyZXRhaWwuc3RvcmUuY29tPGh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fZXhhbXBs ZXJldGFpbC5zdG9yZS5jb20mZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NY NVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19s TElHayZtPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmcz1ZWmF4 MGJZSXk4X0ozbmM0MEU1a0FNZHNxUXB1aTZTbGo0WVpZcUk3YkZNJmU9PiIsDQoNCiAgImF1ZCI6 IFsiY29ubmVjdC5teWlkcC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3Yy L3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktR cl9QWVJPMUhnJnM9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZl PT4iXSwNCg0KICAiaWF0IjogMTQ3MTU2NjE1NCwNCg0KICAianRpIjogImJXSnEiLA0KDQogICJl dmVudHMiOiB7DQoNCiAgICAiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjL2V2ZW50LXR5 cGUvYWNjb3VudC1kZWxldGVkPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwLTNBX19zY2hlbWFzLm9wZW5pZC5uZXRfcmlzY19ldmVudC0yRHR5cGVfYWNjb3Vu dC0yRGRlbGV0ZWQmZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZt PVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmcz1RSHhKeTd6cUR6 Y1JHaG1jR2hhdEEyazE1YllVTFBPRGJXNzFadGM0S3g0JmU9PiI6IHsNCg0KICAgICAgImlzc+KA nTrigJ1jb25uZWN0Lm15aWRwLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cC0zQV9fY29ubmVjdC5teWlkcC5jb20mZD1Ed01HYVEmYz1Sb1AxWXVtQ1hD Z2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VH SnhQRWl2empXd2xOS2U0Q19sTElHayZtPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhC S1FyX1BZUk8xSGcmcz1KY01tSE1MZk5JXzNsc3JOY2ViNlZNNmRLTWJaQlg3LVVyZF9FNmdyd2tn JmU9PuKAnQ0KDQogICAgICAic3ViIjogIjI0ODI4OTc2MTAwMSIsDQoNCiAgICB9DQoNCiAgfQ0K DQp9DQoNCg0KDQpPUiwgQWx0ZXJuYXRpdmUgMjoNCg0Kew0KDQogICJpc3MiOiAiaHR0cHM6Ly9l eGFtcGxlcmV0YWlsLnN0b3JlLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20v djIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGVyZXRhaWwuc3RvcmUuY29tJmQ9RHdNR2FRJmM9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gw RmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBi WWxHdi14QktRcl9QWVJPMUhnJnM9WVpheDBiWUl5OF9KM25jNDBFNWtBTWRzcVFwdWk2U2xqNFla WXFJN2JGTSZlPT4iLA0KDQogICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiwNCg0KICAiYXVkIjogWyJj b25uZWN0Lm15aWRwLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJs P3U9aHR0cC0zQV9fY29ubmVjdC5teWlkcC5jb20mZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZs WllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2 empXd2xOS2U0Q19sTElHayZtPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZ Uk8xSGcmcz1KY01tSE1MZk5JXzNsc3JOY2ViNlZNNmRLTWJaQlg3LVVyZF9FNmdyd2tnJmU9PiJd LA0KDQogICJpYXQiOiAxNDcxNTY2MTU0LA0KDQogICJqdGkiOiDigJxiV0pxIg0KDQogIOKAnHN1 Yklzc+KAnTrigJ1jb25uZWN0Lm15aWRwLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fY29ubmVjdC5teWlkcC5jb20mZD1Ed01HYVEmYz1Sb1Ax WXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBG a0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZ bEd2LXhCS1FyX1BZUk8xSGcmcz1KY01tSE1MZk5JXzNsc3JOY2ViNlZNNmRLTWJaQlg3LVVyZF9F Nmdyd2tnJmU9PuKAnSwNCg0KICAiZXZlbnRzIjogew0KDQogICAgImh0dHA6Ly9zY2hlbWFzLm9w ZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVsZXRlZDxodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3Jp c2NfZXZlbnQtMkR0eXBlX2FjY291bnQtMkRkZWxldGVkJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4 UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktR cl9QWVJPMUhnJnM9UUh4Snk3enFEemNSR2htY0doYXRBMmsxNWJZVUxQT0RiVzcxWnRjNEt4NCZl PT4iOiB7fQ0KDQogIH0NCg0KfQ0KDQoNCkkgY2FuIHNlZSBwcm9zIGFuZCBjb25zIGZvciBlaXRo ZXIuIEkgbGlrZSBvcHRpb24gMSBiZWNhdXNlIGl0IGFsc28gbWFrZXMgdGhlIFNFVCBkaWZmZXJl bnQgZnJvbSBJRCBUb2tlbnMgYW5kIEFjY2VzcyBUb2tlbnMuDQoNCk9wdGlvbiAyIGlzIG5pY2Ug YmVjYXVzZSBtb3N0IFNFVHMgd2XigJl2ZSBiZWVuIHRhbGtpbmcgYWJvdXQganVzdCBoYXZlIGFu IGV2ZW50IHR5cGUgYW5kIGEgc3ViamVjdCBhbmQgbm8gY2xhaW1zLg0KDQpUaGUgYmVzdCB3YXkg dG8gZGVmaW5lIHRoaXMgaXMgdG8gZW5mb3JjZSB0aGF0IHN1YiBtYXkgb25seSBiZSB1c2VkIGF0 IHRoZSB0b3AgbGV2ZWwgaWYgaXQgaXMgZ2xvYmFsbHkgaWRlbnRpZmlhYmxlIChlLmcuIHN1Y2gg YXMgaW4gdGhlIGNhc2Ugb2YgU0NJTSBVUklzKS4NCg0KUGhpbA0KDQpPcmFjbGUgQ29ycG9yYXRp b24sIElkZW50aXR5IENsb3VkIFNlcnZpY2VzIEFyY2hpdGVjdCAmIFN0YW5kYXJkcw0KQGluZGVw ZW5kZW50aWQNCnd3dy5pbmRlcGVuZGVudGlkLmNvbTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fd3d3LmluZGVwZW5kZW50aWQuY29tJmQ9RHdNR2FR JmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1 VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9MXJ3OUEyaEItUlI4MnZZZ1JOemhMbU5jVWtwSjZ1 eXE0UEZOREltYi03OCZlPT4NCnBoaWwuaHVudEBvcmFjbGUuY29tPG1haWx0bzpwaGlsLmh1bnRA b3JhY2xlLmNvbT4NCg0KT24gTWF5IDE4LCAyMDE3LCBhdCAxMDo0MCBBTSwgTWlrZSBKb25lcyA8 TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29m dC5jb20+PiB3cm90ZToNCg0KSSBiZWxpZXZlIHRoYXQgdGhlIHNvbHV0aW9uIGFscmVhZHkgZGlz Y3Vzc2VkIGlzIHRoZSBiZXN0IG9uZS4gIElmIHRoZSBldmVudCBpc3N1ZXIgaXMgZGlmZmVyZW50 IHRoYW4gYSBsb2dpY2FsIGlzc3VlciBhc3NvY2lhdGVkIHdpdGggdGhlIGV2ZW50IHN1YmplY3Qs IHRoZW4gcHV0IHRoZSBsb2dpY2FsIOKAnGlzc+KAnSBhbmQg4oCcc3Vi4oCdIHZhbHVlcyBpbnNp ZGUgdGhlIGV2ZW50LiAgQW55IOKAnHN1YuKAnSBhdCB0aGUgdG9wLWxldmVsIChpZiBhbnkpIHNo b3VsZCBiZSBhc3NvY2lhdGVkIHdpdGggdGhlIOKAnGlzc+KAnSBhdCB0aGUgdG9wLWxldmVsLCB3 aGljaCBpcyBhbHdheXMgdGhlIGV2ZW50IGlzc3Vlci4NCg0KQW55IHByb3Bvc2FsIHRoYXQgcmVx dWlyZXMgZHVwbGljYXRpbmcgaW5mb3JtYXRpb24sIHN1Y2ggYXMgcmVxdWlyaW5nIOKAnHN1Yklz c+KAnSBldmVuIHdoZW4gaXTigJlzIGFsd2F5cyBpZGVudGljYWwgdG8g4oCcaXNz4oCdLCBpcyBu b3QgYSBncmVhdCBhcmNoaXRlY3R1cmFsIGNob2ljZSwgc2luY2UgaXQgY3JlYXRlcyB1bm5lY2Vz c2FyeSBlcnJvciBjb25kaXRpb25zIHRoYXQgd291bGQgbm90IG90aGVyd2lzZSBiZSBwb3NzaWJs ZS4gIChIb3cgc2hvdWxkIGltcGxlbWVudGF0aW9ucyBoYW5kbGUgdGhlIGNhc2Ugd2hlcmUgdHdv IHZhbHVlcyBhcmUgcmVxdWlyZWQgdG8gbWF0Y2ggYnV0IGRvbuKAmXQ/KQ0KDQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLS0g TWlrZQ0KDQpGcm9tOiBJZC1ldmVudCBbbWFpbHRvOmlkLWV2ZW50LWJvdW5jZXNAaWV0Zi5vcmdd IE9uIEJlaGFsZiBPZiBQaGlsIEh1bnQgKElETSkNClNlbnQ6IFRodXJzZGF5LCBNYXkgMTgsIDIw MTcgNzozMSBBTQ0KVG86IERpY2sgSGFyZHQgPGRpY2suaGFyZHRAZ21haWwuY29tPG1haWx0bzpk aWNrLmhhcmR0QGdtYWlsLmNvbT4+DQpDYzogSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZl bnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbSWQt ZXZlbnRdIERlYWxpbmcgd2l0aCBpc3N1ZXIgY29uZmxpY3QNCg0KPz8NCg0KSGFwcGVucyBpbiBh bnkgY2FzZSB3aGVyZSBzdWIgaXMgbm90IGdsb2JhbGx5IGlkZW50aWZpYWJsZS4NCg0KSW4gQ29u bmVjdCwgc2luY2Ugc3ViIGlzIG5vdCB1bmlxdWVseSBpZGVudGlmaWVkLCB0aGUgaXNzIGZvciB0 aGUgc3ViIG11c3QgYmUgaW5jbHVkZWQuIFRoaXMgY3JlYXRlcyBhIGNvbmZsaWN0IGlmIHRoZSBp c3N1ZXIgb2YgdGhlIFNFVCBpcyBub3QgdGhlIGlzc3VlciBvZiB0aGUgc3ViamVjdC4NCg0KUmVz b2x2aW5nIHRoZSBpc3MgY29uZmxpY3QgaGFzIGJlZW4gb24gdGhlIGxpc3Qgb2YgaXNzdWVzIHNp bmNlIGNoaWNhZ28uDQoNCkluIFJJU0Mgd2Ugd2VyZSBkaXNjdXNzaW5nIGFjY291bnQgY2xvc2Ug ZXZlbnRzLiBJIGFtIGFzc3VtZSBvbmUgb2YgdGhlIHNjZW5hcmlvcyBpcyBSUHMgd2lsbCBub3Rp ZnkgSURQcyB3aGVuIHRoZXkgY2xvc2UgYW4gYWNjb3VudC4gVGhleSBtdXN0IHVzZSBhbiBpc3Mg bm90IGFzc29jaWF0ZWQgd2l0aCBzdWIuIEFzIHRoaW5ncyBzdGFuZCBub3csIHRoZXkgd2lsbCBo YXZlIHRvIGFzc2VydCB0aGUgZXh0cmEgaXNzIHZhbHVlIGluIHRoZWlyIHBheWxvYWQtLS13aGlj aCBmb3IgbW9zdCBldmVudHMgaXMgY29tcGxleCB0byBwYXJzZSBzaW5jZSB0aGVpciBhcmUgbm8g b3RoZXIgZXh0cmEgY2xhaW1zLg0KDQpQaGlsDQoNCk9uIE1heSAxOCwgMjAxNywgYXQgNjozNiBB TSwgRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21h aWwuY29tPj4gd3JvdGU6DQpQaGlsLCB3b3VsZCB5b3UgY2xhcmlmeSB0aGUgdXNlIGNhc2UgYW5k IHRoZSByZXF1aXJlbWVudCB0byBlbnN1cmUgZXZlcnlvbmUgb24gdGhlIGxpc3QgaXMgYWxpZ25l ZD8gVGhhbmtzDQoNCk9uIFdlZCwgTWF5IDE3LCAyMDE3IGF0IDk6NDUgUE0gUGhpbCBIdW50IChJ RE0pIDxwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+PiB3 cm90ZToNCkluIG1hbnkgY2FzZXMgd2hlcmUgd2UgYXJlIHRhbGtpbmcgYWJvdXQgZXZlbnRzIChl ZyByaXNjKSB0aGVyZSBpcyBubyBuZWVkIGZvciBleHRyYSBjbGFpbXMgb3RoZXIgdGhhbiB0aGUg ZXZlbnQgdHlwZSBpdHNlbGYuDQoNCkl0IG9jY3VycyB0byBtZSB0aGF0IGluIHRoZSBjYXNlIG9m IFJQIGlzc3VlZCBldmVudHMgdGhlIGN1cnJlbnQgc2VjdG9rZW4gZm9ybWF0IHJlcXVpcmVzIGFu IGVtYmVkZGVkIGlzcyB0byBkZWFsIHdpdGggdGhlIGNvbmZsaWN0IHdpdGggdGhlIHNldCBpc3N1 ZXIuIEl0IHNlZW1zIHRvIGFkZCBhIGxvdCBvZiBjb21wbGljYXRpb24gZm9yIG1vc3QgZXZlbnRz Lg0KDQpXaGF0IGlmIHdlIGRlZmluZWQgYSBuZXcgc2VjdG9rZW4gdG9wIGxldmVsIGF0dHJpYnV0 ZSAnc3ViSXNzJyB0byBtZWFuICJzdWJqZWN0IGlzc3VlciIgYW5kIGtlZXAgaXNzIHJlc2VydmVk IGZvciB0aGUgU0VUIGlzc3Vlci4NCg0KSSB3b3VsZCBzdWdnZXN0IHRoaXMgYXMgYSByZWNvbW1l bmRlZCBhdHRyaWJ1dGUgZXZlbiB3aGVuIGlzcyBhbmQgc3ViSXNzIGFyZSB0aGUgc2FtZSBmb3Ig cGFyc2luZyBjb25zaXN0ZW5jeS4NCg0KVGhvdWdodHM/DQoNClBoaWwNCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QN CklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8aHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1wMVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JnM9QVRZek9Y WEd0bzVhZml0M09nVGpoMTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZlPT4NCi0tDQpTdWJzY3JpYmUg dG8gdGhlIEhBUkRUV0FSRTxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJs P3U9aHR0cC0zQV9faGFyZHR3YXJlLmNvbV8mZD1Ed01GYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllS OFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empX d2xOS2U0Q19sTElHayZtPXAxVnNkMUhiN0JYODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25X aDQmcz1OR2JDQWZCRWw1VHRza1dkampXT1kyY1FKQTNGc3k5UXZudFBuc3R5SWtjJmU9PiBtYWls IGxpc3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBhbSB3b3JraW5nIG9uIQ0KX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcg bGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6 Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5v cmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVp dnpqV3dsTktlNENfbExJR2smbT1wMVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andU aFNuV2g0JnM9QVRZek9YWEd0bzVhZml0M09nVGpoMTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZlPQ0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCklkLWV2ZW50 IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOklkLWV2ZW50QGlldGYub3Jn Pg0KaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193 d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmQ9RHdJQ0FnJmM9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJ VFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT04TGZDWW94MHkzZ2hOOFlBWExyQWI1emZVdDVy VkQ4dmJ3S3d2dzgtUmprJnM9Z3Y0LXlOOExEVmlyODJXRVd6aXg2MS1ZemtyZnF1RVBLTWtfVHRM eWxydyZlPQ0KDQo= --_000_CY4PR21MB05041186A46A2E20E01A83C1F5E40CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTou MDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlm O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJl Zm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4u RW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0KLk1zb0NocERlZmF1 bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEu MGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7 fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMg djpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lm IGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFw IHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlm XS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJw bGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5JbiBtYW55IHVzZSBjYXNlcywgb25seSBTRVRz IGZyb20gYSBzaW5nbGUgZXZlbnQgZmFtaWx5IHdpbGwgYmUgbGVnYWwgYW5kIGFsbCB3aWxsIHVz ZSB0aGUgc2FtZSBjbGFpbXMgY29udmVudGlvbnMuJm5ic3A7IEluIHRoYXQgY2FzZSwgYSBub3Jt YWwgSldUIHBhcnNlciB3aWxsIGxpa2VseQ0KIGJlIHVzZWQgYW5kIHRoZSBhcHBsaWNhdGlvbiB3 aWxsIHByb2Nlc3MgdGhlIGFkZGl0aW9uYWwgZXZlbnQtc3BlY2lmaWMgY2xhaW1zLiZuYnNwOyBU aGVyZeKAmXMgbm8gZ2VuZXJhbC1wdXJwb3NlIFNFVCBwYXJzZXIgaW4gdGhlIG1peC48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkkgdGhpbmsgdGhhdCB0cnlpbmcg dG8gYXJjaGl0ZWN0IHRoaXMgZm9yIGEgd29ybGQgaW4gd2hpY2ggdGhlcmXigJlzIGEgc2luZ2xl IFNFVCBwYXJzZXIgZm9yIFNFVHMgb2YgYWxsIGtpbmRzIHdvdWxkIHNrZXcgdGhlIGFyY2hpdGVj dHVyZSBhbmQgaGF2ZSB0aGUgdW5pbnRlbmRlZA0KIHNpZGUtZWZmZWN0IG9mIGV4Y2x1ZGluZyBz b21lIHVzZSBjYXNlcyB0aHJvdWdoIHVubmVjZXNzYXJ5IGNvbXBsZXhpdHkuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5UaGUgU0VUIHNwZWMgc2hvdWxkIGRlZmlu ZSB0aGUg4oCcZXZlbnRz4oCdIGNsYWltIGFuZCBzdG9wIHRoZXJlLiZuYnNwOyBTRVQgaXMgYWxy ZWFkeSBwb2lzZWQgZm9yIHN1Y2Nlc3MgYXMgaXQgaXMgbm93LiZuYnNwOyBXZSBzaG91bGRu4oCZ dCBhZGQgcmVzdHJpY3Rpb25zIHRoYXQgd2lsbCBqZW9wYXJkaXplDQogdGhhdCBhY2hpZXZlbWVu dC4mbmJzcDsgRXZlbnRzIGFuZCBldmVudCBmYW1pbGllcyBzaG91bGQgZG8gdGhlIHJlc3QsIGlu IHdheXMgYXBwcm9wcmlhdGUgdG8gdGhlaXIgdXNlIGNhc2VzLjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlAu Uy4mbmJzcDsgSG93IHRvIHJlcHJlc2VudCBSSVNDIGV2ZW50cyB0aGF0IG1pZ2h0IGJlIGlzc3Vl ZCBlaXRoZXIgYnkgYW4gSWRlbnRpdHkgUHJvdmlkZXIgb3IgUmVseWluZyBwYXJ0eSBpcyBhbiBl bnRpcmVseSBhcHByb3ByaWF0ZSBkaXNjdXNzaW9uIHRvIGhhdmUgaW4gdGhlIFJJU0MNCiB3b3Jr aW5nIGdyb3VwLCBidXQgbm90IGhlcmUgaW4gdGhlIElEIEV2ZW50cyB3b3JraW5nIGdyb3VwLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRp bmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gUGhpbCBIdW50IChJRE0p IFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNk YXksIE1heSAxOCwgMjAxNyAxMjozNCBQTTxicj4NCjxiPlRvOjwvYj4gTWlrZSBKb25lcyAmbHQ7 TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gRGljayBIYXJk dCAmbHQ7ZGljay5oYXJkdEBnbWFpbC5jb20mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZs dDtpZC1ldmVudEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtJZC1ldmVu dF0gRGVhbGluZyB3aXRoIGlzc3VlciBjb25mbGljdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MgTWlrZS4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1h aWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayB3ZSBkaXNhZ3JlZS48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlk PSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGNvbmNlcm4g SSBoYXZlIGlzIHRoYXQgbW9zdCBpbXBsZW1lbnRlcnMgd2lsbCBoYXZlIHRvIHdyaXRlIGNvZGUg dGhhdCBhbHdheXMgY2hlY2tzIGZvciB0aGUgYWJzZW5jZSBvZiBhIGR1cGxpY2F0ZSBpc3N1ZXIg Y2xhaW0gYmVjYXVzZSBpdCBjaGFuZ2VzIHRoZSBtZWFuaW5nIG9mIHN1YmplY3QuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVN YWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgc3RyaWtlcyBtZSBhcyBj b21wbGV4aXR5IHRoYXQgbmVlZHMgdG8gYmUgZGVhbHQgd2l0aCBpbiB0aGUgY29yZSBzcGVjLiBJ dCBzdGVtcyBmcm9tIG91ciBTZWNUb2tlbidzIHVzZSBvZiBKV1QgYW5kIGl0cyBwb3B1bGFyIHVz ZSB0b2RheS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYg ZXZlcnkgcHJvZmlsaW5nIHNwZWMgY2FuIGRvIHRoaXMgZGlmZmVyZW50bHkgcmVxdWlyaW5nIGRp ZmZlcmVudCBwYXJzZXJzIHdoYXRzIHRoZSBwb2ludCBvZiBzZWNldmVudHM/PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWls U2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEy LjBwdCI+PGJyPg0KT24gTWF5IDE4LCAyMDE3LCBhdCAxMjowOCBQTSwgTWlrZSBKb25lcyAmbHQ7 PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25l c0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxi bG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYw Ij5Nb3N0IG9mIHdoYXQgeW914oCZcmUgdGFsa2luZyBhYm91dCBzZWVtcyB0byBtZSB0byBiZSBk ZWNpc2lvbnMgdGhhdCBjYW4gYmUgbWFkZSBieSBwYXJ0aWN1bGFyIGV2ZW50IGRlZmluaXRpb25z IG9yIGV2ZW50IGZhbWlseSBkZWZpbml0aW9ucy4mbmJzcDsgSSBoYXZlIG5vIHByb2JsZW0NCiB3 aXRoIHBhcnRpY3VsYXIgZXZlbnRzIG9yIGV2ZW50IGZhbWlsaWVzIGVtcGxveWluZyBzb21lIG9m IHRoZSBzdHJhdGVnaWVzIHRoYXQgeW914oCZcmUgZGVzY3JpYmluZy4mbmJzcDsgVGhlIFNFVCBz cGVjIGFscmVhZHkgZmFjaWxpdGF0ZXMgdGhhdC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPkJ1dCBwZXIgcHJldmlvdXMgZGlzY3Vzc2lvbnMsIHdlIHNob3VsZG7i gJl0IGJlIG1ha2luZyByZXN0cmljdGlvbnMgaW4gdGhlIFNFVCBzcGVjIHRoYXQgbGltaXQgaXRz IGFwcGxpY2FiaWxpdHkgYnkgbWFraW5nIHJlc3RyaWN0aW9ucyBvbiBjbGFpbXMgdXNhZ2UgdGhh dCB3aWxsDQogb25seSB3b3JrIGZvciBzb21lIGV2ZW50IHVzZSBjYXNlcyBhbmQgd2lsbCBydWxl IG91dCBvdGhlcnMuJm5ic3A7IFdlIHNob3VsZCBob2xkIHRvIHRoZSBicmlnaHQtbGluZSB0ZXN0 IHRoYXQgZXZlbnQgZGVmaW5pdGlvbnMgZGVmaW5lIHdoYXQgY2xhaW1zIGFyZSBpbmNsdWRlZCBp biBTRVRTIChvdGhlciB0aGFuIHRoZSDigJxldmVudHPigJ0gY2xhaW0gaXRzZWxmKSBhbmQgaG93 IHRoZXnigJlyZSB1c2VkLiZuYnNwOyBJbnRydWRpbmcgb24gdGhhdCB3aWxsIHVubmVjZXNzYXJp bHkNCiBsaW1pdCB0aGUgYXBwbGljYWJpbGl0eSBvZiBTRVRzLjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFBo aWwgSHVudCBbPGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tIj5tYWlsdG86cGhp bC5odW50QG9yYWNsZS5jb208L2E+XQ0KPGJyPg0KPGI+U2VudDo8L2I+IFRodXJzZGF5LCBNYXkg MTgsIDIwMTcgMTE6NDEgQU08YnI+DQo8Yj5Ubzo8L2I+IE1pa2UgSm9uZXMgJmx0OzxhIGhyZWY9 Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBEaWNrIEhhcmR0ICZsdDs8YSBocmVmPSJt YWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iPmRpY2suaGFyZHRAZ21haWwuY29tPC9hPiZndDs7 IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRm Lm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTog W0lkLWV2ZW50XSBEZWFsaW5nIHdpdGggaXNzdWVyIGNvbmZsaWN0PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TWlrZSw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPknigJltIG5vdCBzdXJlIHdl4oCZcmUgb24gdGhlIHNh bWUgcGFnZSBoZXJlLiBNeSBpbXByZXNzaW9uIGlzIHRoaXMgaXMgc3RpbGwgb24gdGhlIG91dHN0 YW5kaW5nIGxpc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPkxldOKAmXMgbG9vayBhdCBzb21lIGV4YW1wbGUgY2FzZXM6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZvciBleGFtcGxlLCBp ZiBhIHJlbHlpbmcgcGFydHkgKGUuZy4gcmV0YWlsIHN0b3JlKSB3YW50cyB0byBub3RpZnkgYW4g SURQIHRoYXQgdGhlIHVzZXIgaGFzIGJlZW4gZGVsZXRlZOKApjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DdXJyZW50bHkgaW4gdGhlIGRyYWZ0 OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2hl biBpc3N1ZWQgYnkgYW4gT3BlbklEIENvbm5lY3QgaXNzdWVyOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTMuNXB0Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHBy ZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19jb25uZWN0Lm15aWRwLmNvbSZh bXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9a0o1 TWZuNmkzOWxvckxnYmJrQzQwa0JDLUhma29tX25ISnc5RHZDVG91OCZhbXA7ZT0iPmh0dHBzOi8v Y29ubmVjdC5teWlkcC5jb208L2E+JnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHBy ZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O3N1YiZxdW90Ozog JnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWyZx dW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1o dHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dh V0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRT ZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZ bEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1V cmRfRTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlpZHAuY29tPC9hPiZxdW90O10sPC9zcGFuPjxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJz cDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0LDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0K PHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2p0aSZxdW90 OzogJnF1b3Q7YldKcSZxdW90Oyw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8L3Nw YW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQi PiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8dT48c3BhbiBzdHlsZT0iY29sb3I6IzAwNjlEOSI+ PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAt M0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjX2V2ZW50LTJEdHlwZV9hY2NvdW50LTJEZGVsZXRl ZCZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kw NTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr JmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9 UUh4Snk3enFEemNSR2htY0doYXRBMmsxNWJZVUxQT0RiVzcxWnRjNEt4NCZhbXA7ZT0iPmh0dHA6 Ly9zY2hlbWFzLm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVsZXRlZDwvYT48 L3NwYW4+PC91PiZxdW90Ozogezwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+ fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7IH08L3NwYW4+PG86cD48L286 cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5CVVQsIHdoZW4gaXNzdWVkIGJ5IGEgcGFydHkgb3RoZXIgdGhhbiB0aGUgaXNzdWVyIG9m IHRoZSBzdWJqZWN0OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHByZSBzdHlsZT0i YnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ezwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNl LnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19leGFtcGxlcmV0YWlsLnN0b3JlLmNv bSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kw NTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdr JmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9 WVpheDBiWUl5OF9KM25jNDBFNWtBTWRzcVFwdWk2U2xqNFlaWXFJN2JGTSZhbXA7ZT0iPmh0dHBz Oi8vZXhhbXBsZXJldGFpbC5zdG9yZS5jb208L2E+JnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwv cHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O3N1 YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJl Pg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2F1ZCZx dW90OzogWyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9Q MVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1 Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZh S3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZk S01iWkJYNy1VcmRfRTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlpZHAuY29tPC9hPiZxdW90O10s PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0LDwvc3Bhbj48bzpwPjwvbzpw PjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90 O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90Oyw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtldmVudHMmcXVv dDs6IHs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8dT48c3BhbiBzdHlsZT0iY29sb3I6 IzAwNjlEOSI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjXyZhbXA7ZD1Ed01HYVEmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9T ZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SlZhRzVlZTZCWWYyN2VtRHl2c0c3 NDlFajRYWDlkMkZjS3ZlUkoyMHd3OCZhbXA7ZT0iPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQv cmlzYy88L2E+ZXZlbnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQ8L3NwYW4+PC91PiZxdW90Ozogezwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7ICZxdW90O2lzc+KAnTomcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fY29ubmVjdC5teWlkcC5jb20mYW1wO2Q9RHdNR2FR JmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9 SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1aUnhveTZM Ym9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJmFtcDtzPUpjTW1ITUxmTklfM2xz ck5jZWI2Vk02ZEtNYlpCWDctVXJkX0U2Z3J3a2cmYW1wO2U9Ij5jb25uZWN0Lm15aWRwLmNvbTwv YT7igJ08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTog cGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyB9 PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsgfTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB5b3UgYXJlIHdyaXRpbmcgY29kZSwgaWYgeW91 IGFncmVlIHRoYXQgdGhlIE9QIGlzc3VlcyBhIGxvdCBvZiBldmVudHMsIHlvdSBlbmQgdXAgaGF2 aW5nIHRvIGNoZWNrIHRoYXQgdGhlcmXigJlzIG5vIGVtYmVkZGVkIOKAnGlzc+KAnSBwcmVzZW50 IGJlZm9yZSB5b3UgY2FuIGFzc3VtZSB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0IGlzIHRoZSBz YW1lIGFzIHRoYXQgb2YgdGhlIFNFVCB0b2tlbi4gJm5ic3A7VGhpcyBzdHJpa2VzDQogbWUgYXMg dmVyeSBjb21wbGV4LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5SZWdhcmRpbmcgeW91ciBhc3NlcnRpb246PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+QW55IOKAnHN1YuKAnSBhdCB0aGUgdG9wLWxldmVsIChpZiBhbnkpIHNo b3VsZCBiZSBhc3NvY2lhdGVkIHdpdGggdGhlIOKAnGlzc+KAnSBhdCB0aGUgdG9wLWxldmVsLCB3 aGljaCBpcyBhbHdheXMgdGhlIGV2ZW50IGlzc3Vlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1heSBi ZSB5b3UgYXJlIHRoaW5raW5nIHRoYXQgd2Ugc2hvdWxkIGJlIHNvbHZpbmcgdGhpcyBieSBhbHdh eXMgaXNzdWluZyBlbWJlZGRlZCBpc3MgYW5kIHN1YiAoQWx0ZXJuYXRpdmUgMSk6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cHJlIHN0eWxlPSJicmVhay1i ZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij57PC9zcGFuPjxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsg JnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zw b2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGVyZXRhaWwuc3RvcmUuY29tJmFtcDtk PUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEw JmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209 WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZhbXA7cz1ZWmF4MGJZ SXk4X0ozbmM0MEU1a0FNZHNxUXB1aTZTbGo0WVpZcUk3YkZNJmFtcDtlPSI+aHR0cHM6Ly9leGFt cGxlcmV0YWlsLnN0b3JlLmNvbTwvYT4mcXVvdDssJm5ic3A7IDwvc3Bhbj48bzpwPjwvbzpwPjwv cHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7JnF1 b3Q7YXVkJnF1b3Q7OiBbJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9p bnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29tJmFtcDtkPUR3TUdhUSZh bXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpC bTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209WlJ4b3k2TGJv Q1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZhbXA7cz1KY01tSE1MZk5JXzNsc3JO Y2ViNlZNNmRLTWJaQlg3LVVyZF9FNmdyd2tnJmFtcDtlPSI+Y29ubmVjdC5teWlkcC5jb208L2E+ JnF1b3Q7XSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NzE1NjYxNTQsPC9zcGFuPjxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJz cDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtiV0pxJnF1b3Q7LDwvc3Bhbj48bzpwPjwvbzpwPjwv cHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2V2 ZW50cyZxdW90Ozogezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90Ozx1PjxzcGFuIHN0eWxl PSJjb2xvcjojMDA2OUQ5Ij48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5j b20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0X3Jpc2NfZXZlbnQtMkR0eXBl X2FjY291bnQtMkRkZWxldGVkJmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllS OFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVp dnpqV3dsTktlNENfbExJR2smYW1wO209WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJL UXJfUFlSTzFIZyZhbXA7cz1RSHhKeTd6cUR6Y1JHaG1jR2hhdEEyazE1YllVTFBPRGJXNzFadGM0 S3g0JmFtcDtlPSI+aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9yaXNjL2V2ZW50LXR5cGUvYWNj b3VudC1kZWxldGVkPC9hPjwvc3Bhbj48L3U+JnF1b3Q7OiB7PC9zcGFuPjxvOnA+PC9vOnA+PC9w cmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7aXNz4oCdOuKA nTxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw LTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2 bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdK eFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2 LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRf RTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlpZHAuY29tPC9hPuKAnTwvc3Bhbj48bzpwPjwvbzpw PjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+JnF1b3Q7c3ViJnF1b3Q7OiAmcXVvdDsyNDgyODk3 NjEwMDEmcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1i ZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsm bmJzcDsgfTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+Jm5ic3A7IH08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxkaXY+ DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Rpdj4NCjwvZGl2Pg0K PHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEz LjVwdCI+T1IsIEFsdGVybmF0aXZlIDI6PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0 eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij57 PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGVyZXRhaWwuc3Rv cmUuY29tJmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlU cGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENf bExJR2smYW1wO209WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZh bXA7cz1ZWmF4MGJZSXk4X0ozbmM0MEU1a0FNZHNxUXB1aTZTbGo0WVpZcUk3YkZNJmFtcDtlPSI+ aHR0cHM6Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNvbTwvYT4mcXVvdDssPC9zcGFuPjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1 b3Q7c3ViJnF1b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+ PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7 YXVkJnF1b3Q7OiBbJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29tJmFtcDtkPUR3TUdhUSZhbXA7 Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTVi aVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209WlJ4b3k2TGJvQ1VW T1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZhbXA7cz1KY01tSE1MZk5JXzNsc3JOY2Vi NlZNNmRLTWJaQlg3LVVyZF9FNmdyd2tnJmFtcDtlPSI+Y29ubmVjdC5teWlkcC5jb208L2E+JnF1 b3Q7XSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NzE1NjYxNTQsPC9zcGFuPjxvOnA+ PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsg JnF1b3Q7anRpJnF1b3Q7OiDigJxiV0pxJnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsg4oCcc3ViSXNz4oCdOuKAnTxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1E d01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZh bXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpS eG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhNTGZO SV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlpZHAu Y29tPC9hPuKAnSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtldmVudHMmcXVvdDs6IHs8L3NwYW4+PG86cD48 L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZu YnNwOyZuYnNwOyAmcXVvdDs8dT48c3BhbiBzdHlsZT0iY29sb3I6IzAwNjlEOSI+PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVt YXMub3BlbmlkLm5ldF9yaXNjX2V2ZW50LTJEdHlwZV9hY2NvdW50LTJEZGVsZXRlZCZhbXA7ZD1E d01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZh bXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpS eG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9UUh4Snk3enFE emNSR2htY0doYXRBMmsxNWJZVUxQT0RiVzcxWnRjNEt4NCZhbXA7ZT0iPmh0dHA6Ly9zY2hlbWFz Lm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVsZXRlZDwvYT48L3NwYW4+PC91 PiZxdW90Ozogezwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+fTwvc3Bhbj48 bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7IH08L3NwYW4+PG86cD48L286cD48L3ByZT4N CjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+Jm5ic3A7PG86cD48L286cD48 L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgY2FuIHNlZSBwcm9z IGFuZCBjb25zIGZvciBlaXRoZXIuIEkgbGlrZSBvcHRpb24gMSBiZWNhdXNlIGl0IGFsc28gbWFr ZXMgdGhlIFNFVCBkaWZmZXJlbnQgZnJvbSBJRCBUb2tlbnMgYW5kIEFjY2VzcyBUb2tlbnMuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9wdGlv biAyIGlzIG5pY2UgYmVjYXVzZSBtb3N0IFNFVHMgd2XigJl2ZSBiZWVuIHRhbGtpbmcgYWJvdXQg anVzdCBoYXZlIGFuIGV2ZW50IHR5cGUgYW5kIGEgc3ViamVjdCBhbmQgbm8gY2xhaW1zLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgYmVz dCB3YXkgdG8gZGVmaW5lIHRoaXMgaXMgdG8gZW5mb3JjZSB0aGF0IHN1YiBtYXkgb25seSBiZSB1 c2VkIGF0IHRoZSB0b3AgbGV2ZWwgaWYgaXQgaXMgZ2xvYmFsbHkgaWRlbnRpZmlhYmxlIChlLmcu IHN1Y2ggYXMgaW4gdGhlIGNhc2Ugb2YgU0NJTSBVUklzKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPlBoaWw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBDbG91ZCBTZXJ2 aWNlcyBBcmNoaXRlY3QgJmFtcDsgU3RhbmRhcmRzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij5AaW5kZXBlbmRlbnRpZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3d3dy5pbmRl cGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4 QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3 bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZ Uk8xSGcmYW1wO3M9MXJ3OUEyaEItUlI4MnZZZ1JOemhMbU5jVWtwSjZ1eXE0UEZOREltYi03OCZh bXA7ZT0iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29t Ij5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIE1heSAxOCwgMjAxNywgYXQgMTA6NDAgQU0sIE1pa2UgSm9uZXMgJmx0OzxhIGhy ZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkkgYmVsaWV2ZSB0 aGF0IHRoZSBzb2x1dGlvbiBhbHJlYWR5IGRpc2N1c3NlZCBpcyB0aGUgYmVzdCBvbmUuJm5ic3A7 IElmIHRoZSBldmVudCBpc3N1ZXIgaXMgZGlmZmVyZW50IHRoYW4gYSBsb2dpY2FsIGlzc3VlciBh c3NvY2lhdGVkIHdpdGggdGhlIGV2ZW50IHN1YmplY3QsIHRoZW4NCiBwdXQgdGhlIGxvZ2ljYWwg 4oCcaXNz4oCdIGFuZCDigJxzdWLigJ0gdmFsdWVzIGluc2lkZSB0aGUgZXZlbnQuJm5ic3A7IEFu eSDigJxzdWLigJ0gYXQgdGhlIHRvcC1sZXZlbCAoaWYgYW55KSBzaG91bGQgYmUgYXNzb2NpYXRl ZCB3aXRoIHRoZSDigJxpc3PigJ0gYXQgdGhlIHRvcC1sZXZlbCwgd2hpY2ggaXMgYWx3YXlzIHRo ZSBldmVudCBpc3N1ZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5BbnkgcHJvcG9zYWwgdGhhdCByZXF1aXJl cyBkdXBsaWNhdGluZyBpbmZvcm1hdGlvbiwgc3VjaCBhcyByZXF1aXJpbmcg4oCcc3ViSXNz4oCd IGV2ZW4gd2hlbiBpdOKAmXMgYWx3YXlzIGlkZW50aWNhbCB0byDigJxpc3PigJ0sIGlzIG5vdCBh IGdyZWF0IGFyY2hpdGVjdHVyYWwgY2hvaWNlLA0KIHNpbmNlIGl0IGNyZWF0ZXMgdW5uZWNlc3Nh cnkgZXJyb3IgY29uZGl0aW9ucyB0aGF0IHdvdWxkIG5vdCBvdGhlcndpc2UgYmUgcG9zc2libGUu Jm5ic3A7IChIb3cgc2hvdWxkIGltcGxlbWVudGF0aW9ucyBoYW5kbGUgdGhlIGNhc2Ugd2hlcmUg dHdvIHZhbHVlcyBhcmUgcmVxdWlyZWQgdG8gbWF0Y2ggYnV0IGRvbuKAmXQ/KTwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAj RTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFu Pjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPklkLWV2ZW50DQogWzxhIGhyZWY9Im1haWx0bzppZC1l dmVudC1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5tYWlsdG86 aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9iPlBoaWwgSHVudCAoSURNKTxi cj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj5UaHVyc2RheSwgTWF5IDE4LCAyMDE3IDc6MzEgQU08YnI+DQo8Yj5Ubzo8L2I+PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkRpY2sgSGFyZHQg Jmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbSI+PHNwYW4gc3R5bGU9ImNv bG9yOnB1cnBsZSI+ZGljay5oYXJkdEBnbWFpbC5jb208L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5D Yzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPklE IEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0bzppZC1ldmVudEBpZXRmLm9y ZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9h PiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtJZC1ldmVudF0gRGVhbGluZyB3aXRoIGlzc3VlciBjb25m bGljdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4/PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5IYXBwZW5zIGluIGFueSBjYXNlIHdoZXJlIHN1YiBpcyBub3QgZ2xvYmFsbHkgaWRlbnRp ZmlhYmxlLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBDb25uZWN0LCBzaW5j ZSBzdWIgaXMgbm90IHVuaXF1ZWx5IGlkZW50aWZpZWQsIHRoZSBpc3MgZm9yIHRoZSBzdWIgbXVz dCBiZSBpbmNsdWRlZC4gVGhpcyBjcmVhdGVzIGEgY29uZmxpY3QgaWYgdGhlIGlzc3VlciBvZiB0 aGUgU0VUIGlzIG5vdCB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0LiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5SZXNvbHZpbmcgdGhlIGlzcyBjb25mbGljdCBoYXMgYmVlbiBvbiB0 aGUgbGlzdCBvZiBpc3N1ZXMgc2luY2UgY2hpY2Fnby4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SW4gUklTQyB3ZSB3ZXJlIGRpc2N1c3NpbmcgYWNjb3VudCBjbG9zZSBldmVudHMu IEkgYW0gYXNzdW1lIG9uZSBvZiB0aGUgc2NlbmFyaW9zIGlzIFJQcyB3aWxsIG5vdGlmeSBJRFBz IHdoZW4gdGhleSBjbG9zZSBhbiBhY2NvdW50LiBUaGV5IG11c3QgdXNlIGFuIGlzcyBub3QgYXNz b2NpYXRlZCB3aXRoIHN1Yi4gQXMgdGhpbmdzIHN0YW5kIG5vdywgdGhleSB3aWxsIGhhdmUgdG8g YXNzZXJ0IHRoZSBleHRyYQ0KIGlzcyB2YWx1ZSBpbiB0aGVpciBwYXlsb2FkLS0td2hpY2ggZm9y IG1vc3QgZXZlbnRzIGlzIGNvbXBsZXggdG8gcGFyc2Ugc2luY2UgdGhlaXIgYXJlIG5vIG90aGVy IGV4dHJhIGNsYWltcy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCk9uIE1heSAxOCwgMjAxNywgYXQgNjoz NiBBTSwgRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29t Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrLmhhcmR0QGdtYWlsLmNvbTwvc3Bhbj48 L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5QaGlsLCB3b3VsZCB5b3UgY2xhcmlmeSB0aGUgdXNl IGNhc2UgYW5kIHRoZSByZXF1aXJlbWVudCB0byBlbnN1cmUgZXZlcnlvbmUgb24gdGhlIGxpc3Qg aXMgYWxpZ25lZD8gVGhhbmtzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gV2VkLCBNYXkg MTcsIDIwMTcgYXQgOTo0NSBQTSBQaGlsIEh1bnQgKElETSkgJmx0OzxhIGhyZWY9Im1haWx0bzpw aGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cGhpbC5odW50 QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gbWFueSBjYXNlcyB3aGVyZSB3ZSBhcmUg dGFsa2luZyBhYm91dCBldmVudHMgKGVnIHJpc2MpIHRoZXJlIGlzIG5vIG5lZWQgZm9yIGV4dHJh IGNsYWltcyBvdGhlciB0aGFuIHRoZSBldmVudCB0eXBlIGl0c2VsZi48YnI+DQo8YnI+DQpJdCBv Y2N1cnMgdG8gbWUgdGhhdCBpbiB0aGUgY2FzZSBvZiBSUCBpc3N1ZWQgZXZlbnRzIHRoZSBjdXJy ZW50IHNlY3Rva2VuIGZvcm1hdCByZXF1aXJlcyBhbiBlbWJlZGRlZCBpc3MgdG8gZGVhbCB3aXRo IHRoZSBjb25mbGljdCB3aXRoIHRoZSBzZXQgaXNzdWVyLiBJdCBzZWVtcyB0byBhZGQgYSBsb3Qg b2YgY29tcGxpY2F0aW9uIGZvciBtb3N0IGV2ZW50cy48YnI+DQo8YnI+DQpXaGF0IGlmIHdlIGRl ZmluZWQgYSBuZXcgc2VjdG9rZW4gdG9wIGxldmVsIGF0dHJpYnV0ZSAnc3ViSXNzJyB0byBtZWFu ICZxdW90O3N1YmplY3QgaXNzdWVyJnF1b3Q7IGFuZCBrZWVwIGlzcyByZXNlcnZlZCBmb3IgdGhl IFNFVCBpc3N1ZXIuPGJyPg0KPGJyPg0KSSB3b3VsZCBzdWdnZXN0IHRoaXMgYXMgYSByZWNvbW1l bmRlZCBhdHRyaWJ1dGUgZXZlbiB3aGVuIGlzcyBhbmQgc3ViSXNzIGFyZSB0aGUgc2FtZSBmb3Ig cGFyc2luZyBjb25zaXN0ZW5jeS48YnI+DQo8YnI+DQpUaG91Z2h0cz88YnI+DQo8YnI+DQpQaGls PGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+ DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5JZC1ldmVu dEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0 aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBR Y3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpq V3dsTktlNENfbExJR2smYW1wO209cDFWc2QxSGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3 VGhTbldoNCZhbXA7cz1BVFl6T1hYR3RvNWFmaXQzT2dUamgxOUtjenhLQ3ZhQndDN2Z0b2ZITXJz JmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQ8L3NwYW4+PC9hPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+U3Vic2NyaWJlIHRvIHRoZTxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQt c3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2lu dC5jb20vdjIvdXJsP3U9aHR0cC0zQV9faGFyZHR3YXJlLmNvbV8mYW1wO2Q9RHdNRmFRJmFtcDtj PVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJp UnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZhbXA7bT1wMVZzZDFIYjdCWDg3 c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JmFtcDtzPU5HYkNBZkJFbDVUdHNrV2RqaldP WTJjUUpBM0ZzeTlRdm50UG5zdHlJa2MmYW1wO2U9IiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+SEFSRFRXQVJFPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+bWFpbA0KIGxpc3QgdG8gbGVhcm4gYWJvdXQg cHJvamVjdHMgSSBhbSB3b3JraW5nIG9uITxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2tx dW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCklkLWV2ZW50IG1haWxpbmcg bGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9 ImNvbG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxhIGhyZWY9 Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXAxVnNkMUhiN0JYODdz VjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9QVRZek9YWEd0bzVhZml0M09nVGpo MTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZhbXA7ZT0iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi Pmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3 LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9 Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlS ckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPXAxVnNkMUhiN0JYODdz VjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9QVRZek9YWEd0bzVhZml0M09nVGpo MTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZhbXA7ZT08L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPC9zcGFuPjxhIGhyZWY9Im1haWx0 bzpJZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPklkLWV2 ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEg aHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNB X193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3SUNBZyZh bXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpC bTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209OExmQ1lveDB5 M2doTjhZQVhMckFiNXpmVXQ1clZEOHZid0t3dnc4LVJqayZhbXA7cz1ndjQteU44TERWaXI4MldF V3ppeDYxLVl6a3JmcXVFUEtNa19UdEx5bHJ3JmFtcDtlPSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjpwdXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw cy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZhbXA7ZD1Ed0lD QWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7 cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPThMZkNZ b3gweTNnaE44WUFYTHJBYjV6ZlV0NXJWRDh2YndLd3Z3OC1SamsmYW1wO3M9Z3Y0LXlOOExEVmly ODJXRVd6aXg2MS1ZemtyZnF1RVBLTWtfVHRMeWxydyZhbXA7ZT08L3NwYW4+PC9hPjxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bh bj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_CY4PR21MB05041186A46A2E20E01A83C1F5E40CY4PR21MB0504namp_-- From nobody Thu May 18 13:17:03 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 183CF12E3AE for ; Thu, 18 May 2017 13:17:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cbIm7Ql3Q2CH for ; Thu, 18 May 2017 13:16:58 -0700 (PDT) Received: from mail-io0-x22d.google.com (mail-io0-x22d.google.com [IPv6:2607:f8b0:4001:c06::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3778129420 for ; Thu, 18 May 2017 13:11:26 -0700 (PDT) Received: by mail-io0-x22d.google.com with SMTP id k91so35805456ioi.1 for ; Thu, 18 May 2017 13:11:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ZFhsqjG0lYxl+kTsWoPWfxeRWkQt9HSFyygeIuXvYbc=; b=NC6fFvzH6EC42n8QYB8iHdhTmhGA/DznF7SwAUQdP5cKZ3TVyaVQhBIHFZNFDBJ+D2 fuGohJKvTa8jA8FwPaw4WOhKj94S4JZFmhSnbFmzd/WhOJfj3fwp0UKPNKZEG1HmYJhG D7IB8Cbe3LYGUUH+KeNPbxZz2BcXWZJBZKSXD5Gs/6NBohde+dSnSnpl/NdBrPP16gq/ 1eLtjFozPGXo0ePVQ81tb9zAiZVcBozgYRHYtcsPba57NFjSwdAXur/MZzDiIrKte76E HyVjBOHVbzGPfUwQErtui6acoqTO2UtERd8VU+mzew9AMDuRSTNcKXB9JwaRGs++Ev7C hN6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ZFhsqjG0lYxl+kTsWoPWfxeRWkQt9HSFyygeIuXvYbc=; b=TS88mX/llZQpc8An0WHqJRjYZ0zrOrzMsYQzZEZrc76HHg5j2hMQcunoWFbDo7C2Df e9YxV1TTOdkCZb7X0mQbt9Vc3r0GjQMb7sK1lfFvrtkOL4bqDAjY8ex6GWAxUp5lxghF c37vNbdSZ/VGpwobgCgSl6UOVPe0WoPBuz5X5+00v3ucEQxwGg2fIgGomyDq1f2UGb+m mwqCKIpBSNWU+8S3cGHjAJTz80Acdzw0Zl8/UuSZrQH8xdCttF06uP8TLV6fjy4sC+7D t1+p6M6NoLEtm4lk5yLSRkv/uTCASdfxmm2A8q/IWG88Ood/mgy+s0Up5tJfAbDmQx99 riLQ== X-Gm-Message-State: AODbwcAWe7Qk8mSgubYl/6bTg1qQrn0qidn4b2QSoHuC7flJPX8jfpYg v+A9EbAC14GdqfnQ80OxclIYeOTA49Qq X-Received: by 10.107.6.27 with SMTP id 27mr6446978iog.53.1495138285809; Thu, 18 May 2017 13:11:25 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.136.77 with HTTP; Thu, 18 May 2017 13:11:05 -0700 (PDT) In-Reply-To: <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> From: Marius Scurtescu Date: Thu, 18 May 2017 13:11:05 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: Mike Jones , ID Events Mailing List , Dick Hardt Content-Type: multipart/alternative; boundary="001a113ee7d26acc1e054fd2024f" Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 20:17:02 -0000 --001a113ee7d26acc1e054fd2024f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable We also have the open issue of SETs being confused for Id Tokens or access tokens. Pushing the iss+sub pair always down to the event level, and leaving only an iss at the top level solves both problems. The top level iss is the issuer of the SET and provides context for the SET signature. The event level iss provides context for event level sub. There is no top level sub, this eliminates any Id Token or access token confusion possibility. The only drawback I can see is the extra verbosity in case multiple events are in one SET. Also, the top level iss and event level iss will probably be the same often for SETs issued by an IdP, but they don't have to. But I don't see this as a big problem. This is the alternative I am referring to: { "iss": "https://exampleretail.store.com", "aud": ["connect.myidp.com"], "iat": 1471566154, "jti": "bWJq", "events": { "http://schemas.openid.net/risc/event-type/account-deleted": { "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D "sub": "248289761001", } } } Marius On Thu, May 18, 2017 at 12:34 PM, Phil Hunt (IDM) wrote: > Thanks Mike. > > I think we disagree. > > The concern I have is that most implementers will have to write code that > always checks for the absence of a duplicate issuer claim because it > changes the meaning of subject. > > This strikes me as complexity that needs to be dealt with in the core > spec. It stems from our SecToken's use of JWT and its popular use today. > > If every profiling spec can do this differently requiring different > parsers whats the point of secevents? > > Phil > > On May 18, 2017, at 12:08 PM, Mike Jones > wrote: > > Most of what you=E2=80=99re talking about seems to me to be decisions tha= t can be > made by particular event definitions or event family definitions. I have > no problem with particular events or event families employing some of the > strategies that you=E2=80=99re describing. The SET spec already facilita= tes that. > > > > But per previous discussions, we shouldn=E2=80=99t be making restrictions= in the > SET spec that limit its applicability by making restrictions on claims > usage that will only work for some event use cases and will rule out > others. We should hold to the bright-line test that event definitions > define what claims are included in SETS (other than the =E2=80=9Cevents= =E2=80=9D claim > itself) and how they=E2=80=99re used. Intruding on that will unnecessari= ly limit > the applicability of SETs. > > > > -- Mike > > > > *From:* Phil Hunt [mailto:phil.hunt@oracle.com ] > *Sent:* Thursday, May 18, 2017 11:41 AM > *To:* Mike Jones > *Cc:* Dick Hardt ; ID Events Mailing List < > id-event@ietf.org> > > *Subject:* Re: [Id-event] Dealing with issuer conflict > > > > Mike, > > > > I=E2=80=99m not sure we=E2=80=99re on the same page here. My impression i= s this is still > on the outstanding list. > > > > Let=E2=80=99s look at some example cases: > > > > For example, if a relying party (e.g. retail store) wants to notify an ID= P > that the user has been deleted=E2=80=A6 > > > > Currently in the draft: > > When issued by an OpenID Connect issuer: > > { > > "iss": "https://connect.myidp.com ", > > "sub": "248289761001", > > "aud": ["connect.myidp.com "], > > "iat": 1471566154, > > "jti": "bWJq", > > "events": { > > "*http://schemas.openid.net/risc/event-type/account-deleted *": {} > > } > > } > > > > BUT, when issued by a party other than the issuer of the subject: > > { > > "iss": "https://exampleretail.store.com ", > > "sub": "248289761001", > > "aud": ["connect.myidp.com "], > > "iat": 1471566154, > > "jti": "bWJq", > > "events": { > > "*http://schemas.openid.net/risc/ event-type/account-deleted*": { > > "iss=E2=80=9D:"connect.myidp.com =E2=80=9D > > } > > } > > } > > > > If you are writing code, if you agree that the OP issues a lot of events, > you end up having to check that there=E2=80=99s no embedded =E2=80=9Ciss= =E2=80=9D present before > you can assume the issuer of the subject is the same as that of the SET > token. This strikes me as very complex. > > > > Regarding your assertion: > > Any =E2=80=9Csub=E2=80=9D at the top-level (if any) should be associated = with the =E2=80=9Ciss=E2=80=9D at > the top-level, which is always the event issuer. > > > > May be you are thinking that we should be solving this by always issuing > embedded iss and sub (Alternative 1): > > { > > "iss": "https://exampleretail.store.com ", > > "aud": ["connect.myidp.com "], > > "iat": 1471566154, > > "jti": "bWJq", > > "events": { > > "*http://schemas.openid.net/risc/event-type/account-deleted *": { > > "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com =E2=80=9D > > "sub": "248289761001", > > } > > } > > } > > > > OR, Alternative 2: > > { > > "iss": "https://exampleretail.store.com ", > > "sub": "248289761001", > > "aud": ["connect.myidp.com "], > > "iat": 1471566154, > > "jti": =E2=80=9CbWJq" > > =E2=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com =E2=80=9D, > > "events": { > > "*http://schemas.openid.net/risc/event-type/account-deleted *": {} > > } > > } > > > > I can see pros and cons for either. I like option 1 because it also makes > the SET different from ID Tokens and Access Tokens. > > > > Option 2 is nice because most SETs we=E2=80=99ve been talking about just = have an > event type and a subject and no claims. > > > > The best way to define this is to enforce that sub may only be used at th= e > top level if it is globally identifiable (e.g. such as in the case of SCI= M > URIs). > > > > Phil > > > > Oracle Corporation, Identity Cloud Services Architect & Standards > > @independentid > > www.independentid.com > > > phil.hunt@oracle.com > > > > On May 18, 2017, at 10:40 AM, Mike Jones > wrote: > > > > I believe that the solution already discussed is the best one. If the > event issuer is different than a logical issuer associated with the event > subject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2= =80=9D values inside the event. Any > =E2=80=9Csub=E2=80=9D at the top-level (if any) should be associated with= the =E2=80=9Ciss=E2=80=9D at the > top-level, which is always the event issuer. > > > > Any proposal that requires duplicating information, such as requiring > =E2=80=9CsubIss=E2=80=9D even when it=E2=80=99s always identical to =E2= =80=9Ciss=E2=80=9D, is not a great > architectural choice, since it creates unnecessary error conditions that > would not otherwise be possible. (How should implementations handle the > case where two values are required to match but don=E2=80=99t?) > > > > -- Mike > > > > *From:* Id-event [mailto:id-event-bounces@ietf.org > ] *On Behalf Of *Phil Hunt (IDM) > *Sent:* Thursday, May 18, 2017 7:31 AM > *To:* Dick Hardt > *Cc:* ID Events Mailing List > *Subject:* Re: [Id-event] Dealing with issuer conflict > > > > ?? > > > > Happens in any case where sub is not globally identifiable. > > > > In Connect, since sub is not uniquely identified, the iss for the sub mus= t > be included. This creates a conflict if the issuer of the SET is not the > issuer of the subject. > > > > Resolving the iss conflict has been on the list of issues since chicago. > > > > In RISC we were discussing account close events. I am assume one of the > scenarios is RPs will notify IDPs when they close an account. They must u= se > an iss not associated with sub. As things stand now, they will have to > assert the extra iss value in their payload---which for most events is > complex to parse since their are no other extra claims. > > > > Phil > > > On May 18, 2017, at 6:36 AM, Dick Hardt wrote: > > Phil, would you clarify the use case and the requirement to ensure > everyone on the list is aligned? Thanks > > > > On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) > wrote: > > In many cases where we are talking about events (eg risc) there is no nee= d > for extra claims other than the event type itself. > > It occurs to me that in the case of RP issued events the current sectoken > format requires an embedded iss to deal with the conflict with the set > issuer. It seems to add a lot of complication for most events. > > What if we defined a new sectoken top level attribute 'subIss' to mean > "subject issuer" and keep iss reserved for the SET issuer. > > I would suggest this as a recommended attribute even when iss and subIss > are the same for parsing consistency. > > Thoughts? > > Phil > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > > -- > > Subscribe to the HARDTWARE > > mail list to learn about projects I am working on! > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > p1Vsd1Hb7BX87sV4x9MhtsGbORcuiacHxujwThSnWh4&s=3D > ATYzOXXGto5afit3OgTjh19KczxKCvaBwC7ftofHMrs&e=3D > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D > 8LfCYox0y3ghN8YAXLrAb5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61- > YzkrfquEPKMk_TtLylrw&e=3D > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > > --001a113ee7d26acc1e054fd2024f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
We also have the open issue of SETs being confused for Id = Tokens or access tokens.

Pushing the iss+sub pair always= down to the event level, and leaving only an iss at the top level solves b= oth problems.

The top level iss is the issuer of t= he SET and provides context for the SET signature.

The event level iss provides context for event level sub.

There is no top level sub, this eliminates any Id Token or access = token confusion possibility.

The only drawback I c= an see is the extra verbosity in case multiple events are in one SET. Also,= the top level iss and event level iss will probably be the same often for = SETs issued by an IdP, but they don't have to. But I don't see this= as a big problem.

This is the alternative I am re= ferring to:
{
=C2=A0 "iss": "https://exampleretail.store.com", =C2=A0
=C2= =A0 "aud": ["connect.my= idp.com"],
= =C2=A0 "iat": 1471566154,
=C2=A0 "jti": "bWJq",
=C2=A0 "events": {
=
=C2=A0 =C2=A0 =C2=A0 "iss=E2=80=9D:=E2= =80=9Dconnect.myidp.com=E2=80=9D
=C2=A0 =C2=A0 =C2=A0 &q= uot;sub": "248289761001",
=C2=A0 =C2=A0 }
=C2=A0 }
= }




Marius

On Thu, May 18, 2017 at 12:34 PM, Phil Hunt = (IDM) <phil.hunt@oracle.com> wrote:
Thanks Mike.=C2=A0

I think we disagree.

The concern I have is that most implementers will have to wr= ite code that always checks for the absence of a duplicate issuer claim bec= ause it changes the meaning of subject.

This strikes me as complexity that needs to be dealt with in the c= ore spec. It stems from our SecToken's use of JWT and its popular use t= oday.

If every profiling spec c= an do this differently requiring different parsers whats the point of secev= ents?

Phil

On May= 18, 2017, at 12:08 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
=

Most of what you=E2=80=99re talking a= bout seems to me to be decisions that can be made by particular event defin= itions or event family definitions.=C2=A0 I have no problem with particular events or event families employing some of the strategies = that you=E2=80=99re describing.=C2=A0 The SET spec already facilitates that= .

=C2=A0

But per previous discussions, we shou= ldn=E2=80=99t be making restrictions in the SET spec that limit its applica= bility by making restrictions on claims usage that will only work for some event use cases and will rule out others.=C2=A0 We shou= ld hold to the bright-line test that event definitions define what claims a= re included in SETS (other than the =E2=80=9Cevents=E2=80=9D claim itself) = and how they=E2=80=99re used.=C2=A0 Intruding on that will unnecessarily limit the applicability of SETs.

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From: Phil Hunt [mailto:phil.hunt@oracle.com]
Sent: Thursday, May 18, 2017 11:41 AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Dick Hardt <dick.hardt@gmail.com>; ID Events Mailing List <id-event@ietf.org>


Subject: Re: [Id-event] Dealing with issuer conflict

=C2=A0

Mike,

=C2=A0

I=E2=80=99m not sure we=E2=80=99re on the same page = here. My impression is this is still on the outstanding list.=

=C2=A0

Let=E2=80=99s look at some example cases:<= /u>

=C2=A0

For example, if a relying party (e.g. retail store) = wants to notify an IDP that the user has been deleted=E2=80=A6

=C2=A0

Currently in the draft:

When issued by an OpenID Connect issuer:

{<= /u>

=C2=A0 "iss": "https://connect.myidp.com",=

=C2=A0 "sub": "2482897=
61001",
=C2=A0 "aud": ["connect.myidp.com"],
=C2=A0 "iat": 1471566154,
=C2=A0 "jti": "bWJq&qu=
ot;,
=C2=A0 "events": {
=C2=A0=C2=A0=C2=A0 "http://schemas.openid.net/risc/event-type/account-deleted": {}=

=C2=A0 }
}

=C2=A0

BUT, when issued by a party other than the issuer of= the subject:

{
=C2=A0 "iss": "https://exampleretail.store.com&=
quot;,
=C2=A0 "sub": "2482897=
61001",
=C2=A0 "aud": ["connect.myidp.com"],
=C2=A0 "iat": 1471566154,
=C2=A0 "jti": "bWJq&qu=
ot;,
=C2=A0 "events": {
=C2=A0=C2=A0=C2=A0 "http://schem=
as.openid.net/risc/event-type/account-deleted"=
;: {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "=
iss=E2=80=9D:"connect.myidp.com=
=E2=80=9D
=C2=A0=C2=A0=C2=A0 }
=C2=A0 }
}

=C2=A0

If you are writing code, if you agree that the OP is= sues a lot of events, you end up having to check that there=E2=80=99s no em= bedded =E2=80=9Ciss=E2=80=9D present before you can assume the issuer of th= e subject is the same as that of the SET token.=C2=A0 This strikes me as very complex.

=C2=A0

Regarding your assertion:

Any =E2=80=9Csub=E2=80=9D at the top-= level (if any) should be associated with the =E2=80=9Ciss=E2=80=9D at the t= op-level, which is always the event issuer.

=C2=A0

May be you are thinking that we should be solving th= is by always issuing embedded iss and sub (Alternative 1): 

{
=C2=A0 "iss": "https://exampleretail.store.com&=
quot;,=C2=A0 
=C2=A0=C2=A0"aud": ["<=
a href=3D"https://urldefense.proofpoint.com/v2/url?u=3Dhttp-3A__connect.myi=
dp.com&d=3DDwMGaQ&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&a=
mp;r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DZRxoy6LboCUVOSdv=
aKuUa2q0bYlGv-xBKQr_PYRO1Hg&s=3DJcMmHMLfNI_3lsrNceb6VM6dKMbZBX7-Urd_E6g=
rwkg&e=3D" target=3D"_blank">connect.myidp.com"],
=C2=A0 "iat": 1471566154,
=C2=A0 "jti": "bWJq&qu=
ot;,
=C2=A0 "events": {
=C2=A0=C2=A0=C2=A0 "http://schemas.openid.net/risc/event-type/account-deleted": {
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "=
iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "sub": "248289761001"=
,
=C2=A0=C2=A0=C2=A0 }
=C2=A0 }
}
=
=C2=A0
OR, Alternative 2:
{
=C2=A0 "iss": "https://exampleretail.store.com&=
quot;,
=C2=A0 "sub": "2482897=
61001",
=C2=A0 "aud": ["connect.myidp.com"],
=C2=A0 "iat": 1471566154,
=C2=A0 "jti": =E2=80=9CbWJq=
"
=C2=A0 =E2=80=9CsubIss=E2=80=9D:=E2=
=80=9Dconnect.myidp.com=E2=80=9D,<=
/u>
=C2=A0 "events": {
=C2=A0=C2=A0=C2=A0 "http://schemas.openid.net/risc/event-type/account-deleted": {}=

=C2=A0 }
}
=C2=A0

I can see pros and cons for either. I like option 1 = because it also makes the SET different from ID Tokens and Access Tokens.

=C2=A0

Option 2 is nice because most SETs we=E2=80=99ve bee= n talking about just have an event type and a subject and no claims.=

=C2=A0

The best way to define this is to enforce that sub m= ay only be used at the top level if it is globally identifiable (e.g. such = as in the case of SCIM URIs).

=C2=A0

Phil

=C2=A0

Oracle Corporation, Iden= tity Cloud Services Architect & Standards

@independentid=

phil.hunt@oracle.com

=C2=A0

On May 18, 2017, at 10:40 AM, Mike Jones <Michael.Jones@mic= rosoft.com> wrote:

=C2=A0

I believe that the solution already d= iscussed is the best one.=C2=A0 If the event issuer is different than a log= ical issuer associated with the event subject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D values ins= ide the event.=C2=A0 Any =E2=80=9Csub=E2=80=9D at the top-level (if any) sh= ould be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which i= s always the event issuer.

=C2=A0

Any proposal that requires duplicatin= g information, such as requiring =E2=80=9CsubIss=E2=80=9D even when it=E2= =80=99s always identical to =E2=80=9Ciss=E2=80=9D, is not a great architect= ural choice, since it creates unnecessary error conditions that would not otherwise be = possible.=C2=A0 (How should implementations handle the case where two value= s are required to match but don=E2=80=99t?)

=C2=A0

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 -- Mike=

=C2=A0

From:=C2=A0Id-event [mailto:id-event-bounces@ietf.org]=C2=A0On Beha= lf Of=C2=A0Phil Hunt (IDM)
Sent:=C2= =A0Thursday, May 18, 2017 7:31 AM
To:=C2=A0= Dick Hardt <dick.hardt@gmail.com>
Cc:=C2=A0= ID Events Mailing List <id-event@ietf.org>=
Subject:= =C2=A0Re: [Id-event] Dealing with issuer conflict

=C2=A0

??

=C2=A0

Happens in any case where sub is not globally identi= fiable.=C2=A0

=C2=A0

In Connect, since sub is not uniquely identified, th= e iss for the sub must be included. This creates a conflict if the issuer o= f the SET is not the issuer of the subject.=C2=A0

=C2=A0

Resolving the iss conflict has been on the list of i= ssues since chicago.=C2=A0

=C2=A0

In RISC we were discussing account close events. I a= m assume one of the scenarios is RPs will notify IDPs when they close an ac= count. They must use an iss not associated with sub. As things stand now, t= hey will have to assert the extra iss value in their payload---which for most events is complex to parse sin= ce their are no other extra claims.=C2=A0

=C2=A0

Phil


On May 18, 2017, at 6:36 AM, Dick Hardt <dick.hardt@gmail.co= m> wrote:

Phil, would you clarify the use case and the require= ment to ensure everyone on the list is aligned? Thanks

=C2=A0

On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) <= phil.hunt@oracle.com> wrote:

In many cases where we are talking about events (eg = risc) there is no need for extra claims other than the event type itself.
It occurs to me that in the case of RP issued events the current sectoken f= ormat requires an embedded iss to deal with the conflict with the set issue= r. It seems to add a lot of complication for most events.

What if we defined a new sectoken top level attribute 'subIss' to m= ean "subject issuer" and keep iss reserved for the SET issuer.
I would suggest this as a recommended attribute even when iss and subIss ar= e the same for parsing consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= u>

--=C2=A0

Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am working on!

_____________________________________________= __
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.i= etf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1Yu= mCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITS= eGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAXLrAb5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLy= lrw&e=3D=C2=A0

=C2=A0


_________________________________________= ______
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event


--001a113ee7d26acc1e054fd2024f-- From nobody Thu May 18 13:25:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 060EA12E6A3 for ; Thu, 18 May 2017 13:25:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.218 X-Spam-Level: X-Spam-Status: No, score=-4.218 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 07dGYmjbZhXY for ; Thu, 18 May 2017 13:25:49 -0700 (PDT) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1D4F129A8F for ; Thu, 18 May 2017 13:19:46 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4IKJhFm011798 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 May 2017 20:19:43 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v4IKJgW7008022 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 18 May 2017 20:19:43 GMT Received: from abhmp0013.oracle.com (abhmp0013.oracle.com [141.146.116.19]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v4IKJgMn012148; Thu, 18 May 2017 20:19:42 GMT Received: from [192.168.1.13] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 18 May 2017 13:19:41 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-20E2049E-FC40-42C9-872B-42ACCA5FB84D Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14E304) In-Reply-To: Date: Thu, 18 May 2017 13:19:40 -0700 Cc: Dick Hardt , ID Events Mailing List Content-Transfer-Encoding: 7bit Message-Id: References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> To: Mike Jones X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 20:25:53 -0000 --Apple-Mail-20E2049E-FC40-42C9-872B-42ACCA5FB84D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mike The RISC group case is a useful case to discuss here since we need to unders= tand how SETs will be used.=20 AFAIK, the RISC WG is assuming the issue of iss conflict will be resolved in= SECEVENTs.=20 My understanding is this is much more than registering an event claim but to= get to interoperable event formats that can be used by many downstream SDOs= and WGs.=20 Maybe I am mistaken? Phil > On May 18, 2017, at 12:46 PM, Mike Jones wro= te: >=20 > In many use cases, only SETs from a single event family will be legal and a= ll will use the same claims conventions. In that case, a normal JWT parser w= ill likely be used and the application will process the additional event-spe= cific claims. There=E2=80=99s no general-purpose SET parser in the mix. > =20 > I think that trying to architect this for a world in which there=E2=80=99s= a single SET parser for SETs of all kinds would skew the architecture and h= ave the unintended side-effect of excluding some use cases through unnecessa= ry complexity. > =20 > The SET spec should define the =E2=80=9Cevents=E2=80=9D claim and stop the= re. SET is already poised for success as it is now. We shouldn=E2=80=99t a= dd restrictions that will jeopardize that achievement. Events and event fam= ilies should do the rest, in ways appropriate to their use cases. > =20 > -- Mike > =20 > P.S. How to represent RISC events that might be issued either by an Ident= ity Provider or Relying party is an entirely appropriate discussion to have i= n the RISC working group, but not here in the ID Events working group. > =20 > From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]=20 > Sent: Thursday, May 18, 2017 12:34 PM > To: Mike Jones > Cc: Dick Hardt ; ID Events Mailing List > Subject: Re: [Id-event] Dealing with issuer conflict > =20 > Thanks Mike.=20 > =20 > I think we disagree. > =20 > The concern I have is that most implementers will have to write code that a= lways checks for the absence of a duplicate issuer claim because it changes t= he meaning of subject. > =20 > This strikes me as complexity that needs to be dealt with in the core spec= . It stems from our SecToken's use of JWT and its popular use today. > =20 > If every profiling spec can do this differently requiring different parser= s whats the point of secevents? > =20 > Phil >=20 > On May 18, 2017, at 12:08 PM, Mike Jones wro= te: >=20 > Most of what you=E2=80=99re talking about seems to me to be decisions that= can be made by particular event definitions or event family definitions. I= have no problem with particular events or event families employing some of t= he strategies that you=E2=80=99re describing. The SET spec already facilita= tes that. > =20 > But per previous discussions, we shouldn=E2=80=99t be making restrictions i= n the SET spec that limit its applicability by making restrictions on claims= usage that will only work for some event use cases and will rule out others= . We should hold to the bright-line test that event definitions define what= claims are included in SETS (other than the =E2=80=9Cevents=E2=80=9D claim i= tself) and how they=E2=80=99re used. Intruding on that will unnecessarily l= imit the applicability of SETs. > =20 > -- Mike > =20 > From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 > Sent: Thursday, May 18, 2017 11:41 AM > To: Mike Jones > Cc: Dick Hardt ; ID Events Mailing List > Subject: Re: [Id-event] Dealing with issuer conflict > =20 > Mike, > =20 > I=E2=80=99m not sure we=E2=80=99re on the same page here. My impression is= this is still on the outstanding list. > =20 > Let=E2=80=99s look at some example cases: > =20 > For example, if a relying party (e.g. retail store) wants to notify an IDP= that the user has been deleted=E2=80=A6 > =20 > Currently in the draft: > When issued by an OpenID Connect issuer: > { > "iss": "https://connect.myidp.com", > "sub": "248289761001", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": {} > } > } > =20 > BUT, when issued by a party other than the issuer of the subject: > { > "iss": "https://exampleretail.store.com", > "sub": "248289761001", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": { > "iss=E2=80=9D:"connect.myidp.com=E2=80=9D > } > } > } > =20 > If you are writing code, if you agree that the OP issues a lot of events, y= ou end up having to check that there=E2=80=99s no embedded =E2=80=9Ciss=E2=80= =9D present before you can assume the issuer of the subject is the same as t= hat of the SET token. This strikes me as very complex. > =20 > Regarding your assertion: > Any =E2=80=9Csub=E2=80=9D at the top-level (if any) should be associated w= ith the =E2=80=9Ciss=E2=80=9D at the top-level, which is always the event is= suer. > =20 > May be you are thinking that we should be solving this by always issuing e= mbedded iss and sub (Alternative 1): > { > "iss": "https://exampleretail.store.com", =20 > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": { > "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D > "sub": "248289761001", > } > } > } > =20 > OR, Alternative 2: > { > "iss": "https://exampleretail.store.com", > "sub": "248289761001", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": =E2=80=9CbWJq" > =E2=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D, > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": {} > } > } > =20 > I can see pros and cons for either. I like option 1 because it also makes t= he SET different from ID Tokens and Access Tokens. > =20 > Option 2 is nice because most SETs we=E2=80=99ve been talking about just h= ave an event type and a subject and no claims. > =20 > The best way to define this is to enforce that sub may only be used at the= top level if it is globally identifiable (e.g. such as in the case of SCIM U= RIs). > =20 > Phil > =20 > Oracle Corporation, Identity Cloud Services Architect & Standards > @independentid > www.independentid.com > phil.hunt@oracle.com > =20 > On May 18, 2017, at 10:40 AM, Mike Jones wro= te: > =20 > I believe that the solution already discussed is the best one. If the eve= nt issuer is different than a logical issuer associated with the event subje= ct, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D val= ues inside the event. Any =E2=80=9Csub=E2=80=9D at the top-level (if any) s= hould be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which i= s always the event issuer. > =20 > Any proposal that requires duplicating information, such as requiring =E2=80= =9CsubIss=E2=80=9D even when it=E2=80=99s always identical to =E2=80=9Ciss=E2= =80=9D, is not a great architectural choice, since it creates unnecessary er= ror conditions that would not otherwise be possible. (How should implementa= tions handle the case where two values are required to match but don=E2=80=99= t?) > =20 > -- Mike > =20 > From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt (= IDM) > Sent: Thursday, May 18, 2017 7:31 AM > To: Dick Hardt > Cc: ID Events Mailing List > Subject: Re: [Id-event] Dealing with issuer conflict > =20 > ?? > =20 > Happens in any case where sub is not globally identifiable.=20 > =20 > In Connect, since sub is not uniquely identified, the iss for the sub must= be included. This creates a conflict if the issuer of the SET is not the is= suer of the subject.=20 > =20 > Resolving the iss conflict has been on the list of issues since chicago.=20= > =20 > In RISC we were discussing account close events. I am assume one of the sc= enarios is RPs will notify IDPs when they close an account. They must use an= iss not associated with sub. As things stand now, they will have to assert t= he extra iss value in their payload---which for most events is complex to pa= rse since their are no other extra claims.=20 > =20 > Phil >=20 > On May 18, 2017, at 6:36 AM, Dick Hardt wrote: >=20 > Phil, would you clarify the use case and the requirement to ensure everyon= e on the list is aligned? Thanks > =20 > On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) wro= te: > In many cases where we are talking about events (eg risc) there is no need= for extra claims other than the event type itself. >=20 > It occurs to me that in the case of RP issued events the current sectoken f= ormat requires an embedded iss to deal with the conflict with the set issuer= . It seems to add a lot of complication for most events. >=20 > What if we defined a new sectoken top level attribute 'subIss' to mean "su= bject issuer" and keep iss reserved for the SET issuer. >=20 > I would suggest this as a recommended attribute even when iss and subIss a= re the same for parsing consistency. >=20 > Thoughts? >=20 > Phil > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://www.ietf.org/mailman/listinfo/id-event > --=20 > Subscribe to the HARDTWARE mail list to learn about projects I am working o= n! > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dp1Vsd1Hb7BX87sV4x9M= htsGbORcuiacHxujwThSnWh4&s=3DATYzOXXGto5afit3OgTjh19KczxKCvaBwC7ftofHMrs&e=3D= > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAXLr= Ab5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLylrw&e=3D= =20 > =20 --Apple-Mail-20E2049E-FC40-42C9-872B-42ACCA5FB84D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Mike

The RISC group case is a useful c= ase to discuss here since we need to understand how SETs will be used. =

AFAIK, the RISC WG is assuming the issue of iss conflict will be resolved i= n SECEVENTs. 

My understanding is this is much more than registering a= n event claim but to get to interoperable event formats that can be used by m= any downstream SDOs and WGs. 

<= /div>
Maybe I am mistaken?

Phil

In many use cases, only SETs from a sin= gle event family will be legal and all will use the same claims conventions.=   In that case, a normal JWT parser will likely be used and the application will process the additional event-specific clai= ms.  There=E2=80=99s no general-purpose SET parser in the mix.

 

I think that trying to architect this f= or a world in which there=E2=80=99s a single SET parser for SETs of all kind= s would skew the architecture and have the unintended side-effect of excluding some use cases through unnecessary complexity.

 

The SET spec should define the =E2=80=9C= events=E2=80=9D claim and stop there.  SET is already poised for succes= s as it is now.  We shouldn=E2=80=99t add restrictions that will jeopar= dize that achievement.  Events and event families should do the rest, in wa= ys appropriate to their use cases.

 

      &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;      -- Mike

 

P.S.  How to represent RISC events= that might be issued either by an Identity Provider or Relying party is an e= ntirely appropriate discussion to have in the RISC working group, but not here in the ID Events working group.

 

From: Phil Hunt (IDM) [mailto:phil.hunt@oracle.com]
Sent: Thursday, May 18, 2017 12:34 PM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: Dick Hardt <dick.hardt= @gmail.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Dealing with issuer conflict

 

Thanks Mike. 

 

I think we disagree.

 

The concern I have is that most implementers will hav= e to write code that always checks for the absence of a duplicate issuer cla= im because it changes the meaning of subject.

 

This strikes me as complexity that needs to be dealt w= ith in the core spec. It stems from our SecToken's use of JWT and its popula= r use today.

 

If every profiling spec can do this differently requi= ring different parsers whats the point of secevents?

 

Phil


On May 18, 2017, at 12:08 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

Most of what you=E2=80=99re talking abo= ut seems to me to be decisions that can be made by particular event definiti= ons or event family definitions.  I have no problem with particular events or event families employing some of the strategies t= hat you=E2=80=99re describing.  The SET spec already facilitates that.<= /span>

 

But per previous discussions, we should= n=E2=80=99t be making restrictions in the SET spec that limit its applicabil= ity by making restrictions on claims usage that will only work for some event use cases and will rule out others.  We shoul= d hold to the bright-line test that event definitions define what claims are= included in SETS (other than the =E2=80=9Cevents=E2=80=9D claim itself) and= how they=E2=80=99re used.  Intruding on that will unnecessarily limit the applicability of SETs.

 

      &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;      -- Mike

 

From: Phil Hunt [mailto:phil.hunt@oracle.com]
Sent: Thursday, May 18, 2017 11:41 AM
To: Mike Jones <Mic= hael.Jones@microsoft.com>
Cc: Dick Hardt <dick.hardt= @gmail.com>; ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Dealing with issuer conflict

 

Mike,

 

I=E2=80=99m not sure we=E2=80=99re on the same page h= ere. My impression is this is still on the outstanding list.

 

Let=E2=80=99s look at some example cases:<= /p>

 

For example, if a relying party (e.g. retail store) w= ants to notify an IDP that the user has been deleted=E2=80=A6

=

 

Currently in the draft:

When issued by an OpenID Connect issuer:

{<= /p> 

  "i=
ss": "https://connect.myidp.com",
  "sub": "248289761001",
  "aud": ["connect.my=
idp.com"],
  "iat": 1471566154,<=
/o:p>
  "jti": "bWJq",
  "events": {

    "http://schem=
as.openid.net/risc/event-type/account-deleted": {}


  }<=
/span>


}

 

BUT, when issued by a party other than the issuer of t= he subject:

{<=
o:p>
  "iss": "http=
s://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.my=
idp.com"],
  "iat": 1471566154,<=
/o:p>
  "jti": "bWJq",
  "events": {

    "http://schemas.openid.net/risc/event-t=
ype/account-deleted": {


 &nb=
sp;    "iss=E2=80=9D:"connect.myidp.com=E2=80=
=9D


 &nb=
sp;  }


  }


}




 

If you are writing code, if you agree that the OP iss= ues a lot of events, you end up having to check that there=E2=80=99s no embe= dded =E2=80=9Ciss=E2=80=9D present before you can assume the issuer of the s= ubject is the same as that of the SET token.  This strikes me as very complex.

 

Regarding your assertion:

Any =E2=80=9Csub=E2=80=9D at the top-le= vel (if any) should be associated with the =E2=80=9Ciss=E2=80=9D at the top-= level, which is always the event issuer.

 

May be you are thinking that we should be solving thi= s by always issuing embedded iss and sub (Alternative 1):

{<=
o:p>
  "iss": "http=
s://exampleretail.store.com",  
  "aud": ["conne=
ct.myidp.com"],
  "iat": 1471566154,<=
/o:p>
  "jti": "bWJq",
  "events": {

    "http://schem=
as.openid.net/risc/event-type/account-deleted": {=



 &nb=
sp;    "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D


 &nb=
sp;    "sub": "248289=
761001",


 &nb=
sp;  }


  }


}




 




OR, Alter=
native 2:
{<=
o:p>
  "iss": "http=
s://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.my=
idp.com"],
  "iat": 1471566154,<=
/o:p>
  "jti": =E2=80=9CbWJq"
  =E2=
=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D,
  "events": {

    "http://schem=
as.openid.net/risc/event-type/account-deleted": {}


  }<=
/span>


}


 

I can see pros and cons for either. I like option 1 b= ecause it also makes the SET different from ID Tokens and Access Tokens.

 

Option 2 is nice because most SETs we=E2=80=99ve been= talking about just have an event type and a subject and no claims.

 

The best way to define this is to enforce that sub ma= y only be used at the top level if it is globally identifiable (e.g. such as= in the case of SCIM URIs).

 

Phil

 <= /p>

Oracle Corporation, Ident= ity Cloud Services Architect & Standards

@independentid

phil.hunt@oracle.com

 

On May 18, 2017, at 10:40 AM, Mike Jones <Michael.Jones@microsoft.com> wro= te:

 

I believe that the solution already dis= cussed is the best one.  If the event issuer is different than a logica= l issuer associated with the event subject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D values insi= de the event.  Any =E2=80=9Csub=E2=80=9D at the top-level (if any) shou= ld be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which is a= lways the event issuer.

 

Any proposal that requires duplicating i= nformation, such as requiring =E2=80=9CsubIss=E2=80=9D even when it=E2=80=99= s always identical to =E2=80=9Ciss=E2=80=9D, is not a great architectural ch= oice, since it creates unnecessary error conditions that would not otherwise be p= ossible.  (How should implementations handle the case where two values a= re required to match but don=E2=80=99t?)

 

      &nb= sp;            &= nbsp;            = ;            &nb= sp;            &= nbsp;      -- Mike

 

From: Id-event [= mailto:id-event-bounces@ietf.org] On Behalf Of&nbs= p;Phil Hunt (IDM)
Sent: Thursday, May= 18, 2017 7:31 AM
To: Dick Hardt <= dick.ha= rdt@gmail.com>
Cc: ID Events Maili= ng List <id-event@ietf.org>
Subject: Re: [Id-ev= ent] Dealing with issuer conflict

 

??

 

Happens in any case where sub is not globally identif= iable. 

 

In Connect, since sub is not uniquely identified, the= iss for the sub must be included. This creates a conflict if the issuer of t= he SET is not the issuer of the subject. 

 

Resolving the iss conflict has been on the list of is= sues since chicago. 

 

In RISC we were discussing account close events. I am= assume one of the scenarios is RPs will notify IDPs when they close an acco= unt. They must use an iss not associated with sub. As things stand now, they= will have to assert the extra iss value in their payload---which for most events is complex to parse sinc= e their are no other extra claims. 

 

Phil


On May 18, 2017, at 6:36 AM, Dick Hardt <dick.hardt@gmail.com> wro= te:

Phil, would you clarify the use case and the requirem= ent to ensure everyone on the list is aligned? Thanks

 

On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) <<= a href=3D"mailto:phil.hunt@oracle.com">phil.hun= t@oracle.com> wrote:

In many cases where we are talking about events (eg r= isc) there is no need for extra claims other than the event type itself.
=
It occurs to me that in the case of RP issued events the current sectoken fo= rmat requires an embedded iss to deal with the conflict with the set issuer.= It seems to add a lot of complication for most events.

What if we defined a new sectoken top level attribute 'subIss' to mean "subj= ect issuer" and keep iss reserved for the SET issuer.

I would suggest this as a recommended attribute even when iss and subIss are= the same for parsing consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event<= /p>

-- =

Subscribe to the HARDTW= ARE mail list to learn about projects I am working on!

_______________________________________________
Id-event mailing list
Id-event@ietf.org<= /span>
https://urldefense.= proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent= &d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAXLrAb5zf= Ut5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLylrw&= e=3D 

 

= --Apple-Mail-20E2049E-FC40-42C9-872B-42ACCA5FB84D-- From nobody Thu May 18 13:36:45 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B37E212EBA5 for ; Thu, 18 May 2017 13:36:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.218 X-Spam-Level: X-Spam-Status: No, score=-4.218 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 42Wlf-nBwJLh for ; Thu, 18 May 2017 13:36:37 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E90AB12EB12 for ; Thu, 18 May 2017 13:30:01 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4IKTxUX024017 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 18 May 2017 20:29:59 GMT Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v4IKTwTd006377 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 18 May 2017 20:29:58 GMT Received: from abhmp0012.oracle.com (abhmp0012.oracle.com [141.146.116.18]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v4IKTwpT017297; Thu, 18 May 2017 20:29:58 GMT Received: from [192.168.1.13] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 18 May 2017 13:29:57 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-2AC2151E-519F-49F5-A590-1FF44E35C5F2 Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14E304) In-Reply-To: Date: Thu, 18 May 2017 13:29:56 -0700 Cc: Mike Jones , ID Events Mailing List , Dick Hardt Content-Transfer-Encoding: 7bit Message-Id: <9ABE055C-C3B3-48CA-8DF3-5051C5E6DAE4@oracle.com> References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> To: Marius Scurtescu X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 20:36:43 -0000 --Apple-Mail-2AC2151E-519F-49F5-A590-1FF44E35C5F2 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Marius, +1 I like this because my point has been re-using iss at the top level may be v= isually pleasing but it doesn't make the code simpler. Those that fail to ch= eck for an embedded iss could be exposing themselves to mistaken assumptions= about the subject issuer causing confusion.=20 IMO, this proposal can work equally well for the SCIM cases too.=20 Phil > On May 18, 2017, at 1:11 PM, Marius Scurtescu wrot= e: >=20 > We also have the open issue of SETs being confused for Id Tokens or access= tokens. >=20 > Pushing the iss+sub pair always down to the event level, and leaving only a= n iss at the top level solves both problems. >=20 > The top level iss is the issuer of the SET and provides context for the SE= T signature. >=20 > The event level iss provides context for event level sub. >=20 > There is no top level sub, this eliminates any Id Token or access token co= nfusion possibility. >=20 > The only drawback I can see is the extra verbosity in case multiple events= are in one SET. Also, the top level iss and event level iss will probably b= e the same often for SETs issued by an IdP, but they don't have to. But I do= n't see this as a big problem. >=20 > This is the alternative I am referring to: > { > "iss": "https://exampleretail.store.com", > "aud": ["connect.myidp.com"], > "iat": 1471566154, > "jti": "bWJq", > "events": { > "http://schemas.openid.net/risc/event-type/account-deleted": { > "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D > "sub": "248289761001", > } > } > } >=20 >=20 >=20 >=20 > Marius >=20 >> On Thu, May 18, 2017 at 12:34 PM, Phil Hunt (IDM) w= rote: >> Thanks Mike.=20 >>=20 >> I think we disagree. >>=20 >> The concern I have is that most implementers will have to write code that= always checks for the absence of a duplicate issuer claim because it change= s the meaning of subject. >>=20 >> This strikes me as complexity that needs to be dealt with in the core spe= c. It stems from our SecToken's use of JWT and its popular use today. >>=20 >> If every profiling spec can do this differently requiring different parse= rs whats the point of secevents? >>=20 >> Phil >>=20 >>> On May 18, 2017, at 12:08 PM, Mike Jones w= rote: >>>=20 >>> Most of what you=E2=80=99re talking about seems to me to be decisions th= at can be made by particular event definitions or event family definitions. = I have no problem with particular events or event families employing some o= f the strategies that you=E2=80=99re describing. The SET spec already facil= itates that. >>>=20 >>> =20 >>>=20 >>> But per previous discussions, we shouldn=E2=80=99t be making restriction= s in the SET spec that limit its applicability by making restrictions on cla= ims usage that will only work for some event use cases and will rule out oth= ers. We should hold to the bright-line test that event definitions define w= hat claims are included in SETS (other than the =E2=80=9Cevents=E2=80=9D cla= im itself) and how they=E2=80=99re used. Intruding on that will unnecessari= ly limit the applicability of SETs. >>>=20 >>> =20 >>>=20 >>> -- Mike >>>=20 >>> =20 >>>=20 >>> From: Phil Hunt [mailto:phil.hunt@oracle.com]=20 >>> Sent: Thursday, May 18, 2017 11:41 AM >>> To: Mike Jones >>> Cc: Dick Hardt ; ID Events Mailing List >>>=20 >>>=20 >>> Subject: Re: [Id-event] Dealing with issuer conflict >>> =20 >>>=20 >>> Mike, >>>=20 >>> =20 >>>=20 >>> I=E2=80=99m not sure we=E2=80=99re on the same page here. My impression i= s this is still on the outstanding list. >>>=20 >>> =20 >>>=20 >>> Let=E2=80=99s look at some example cases: >>>=20 >>> =20 >>>=20 >>> For example, if a relying party (e.g. retail store) wants to notify an I= DP that the user has been deleted=E2=80=A6 >>>=20 >>> =20 >>>=20 >>> Currently in the draft: >>>=20 >>> When issued by an OpenID Connect issuer: >>>=20 >>> { >>>=20 >>> "iss": "https://connect.myidp.com", >>> "sub": "248289761001", >>> "aud": ["connect.myidp.com"], >>> "iat": 1471566154, >>> "jti": "bWJq", >>> "events": { >>> "http://schemas.openid.net/risc/event-type/account-deleted": {} >>> } >>> } >>> =20 >>>=20 >>> BUT, when issued by a party other than the issuer of the subject: >>>=20 >>> { >>> "iss": "https://exampleretail.store.com", >>> "sub": "248289761001", >>> "aud": ["connect.myidp.com"], >>> "iat": 1471566154, >>> "jti": "bWJq", >>> "events": { >>> "http://schemas.openid.net/risc/event-type/account-deleted": { >>> "iss=E2=80=9D:"connect.myidp.com=E2=80=9D >>> } >>> } >>> } >>> =20 >>>=20 >>> If you are writing code, if you agree that the OP issues a lot of events= , you end up having to check that there=E2=80=99s no embedded =E2=80=9Ciss=E2= =80=9D present before you can assume the issuer of the subject is the same a= s that of the SET token. This strikes me as very complex. >>>=20 >>> =20 >>>=20 >>> Regarding your assertion: >>>=20 >>> Any =E2=80=9Csub=E2=80=9D at the top-level (if any) should be associated= with the =E2=80=9Ciss=E2=80=9D at the top-level, which is always the event i= ssuer. >>>=20 >>> =20 >>>=20 >>> May be you are thinking that we should be solving this by always issuing= embedded iss and sub (Alternative 1): >>>=20 >>> { >>> "iss": "https://exampleretail.store.com", =20 >>> "aud": ["connect.myidp.com"], >>> "iat": 1471566154, >>> "jti": "bWJq", >>> "events": { >>> "http://schemas.openid.net/risc/event-type/account-deleted": { >>> "iss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D >>> "sub": "248289761001", >>> } >>> } >>> } >>> =20 >>> OR, Alternative 2: >>> { >>> "iss": "https://exampleretail.store.com", >>> "sub": "248289761001", >>> "aud": ["connect.myidp.com"], >>> "iat": 1471566154, >>> "jti": =E2=80=9CbWJq" >>> =E2=80=9CsubIss=E2=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D, >>> "events": { >>> "http://schemas.openid.net/risc/event-type/account-deleted": {} >>> } >>> } >>> =20 >>> I can see pros and cons for either. I like option 1 because it also make= s the SET different from ID Tokens and Access Tokens. >>>=20 >>> =20 >>>=20 >>> Option 2 is nice because most SETs we=E2=80=99ve been talking about just= have an event type and a subject and no claims. >>>=20 >>> =20 >>>=20 >>> The best way to define this is to enforce that sub may only be used at t= he top level if it is globally identifiable (e.g. such as in the case of SCI= M URIs). >>>=20 >>> =20 >>>=20 >>> Phil >>>=20 >>> =20 >>>=20 >>> Oracle Corporation, Identity Cloud Services Architect & Standards >>>=20 >>> @independentid >>>=20 >>> www.independentid.com >>>=20 >>> phil.hunt@oracle.com >>>=20 >>> =20 >>>=20 >>> On May 18, 2017, at 10:40 AM, Mike Jones w= rote: >>>=20 >>> =20 >>>=20 >>> I believe that the solution already discussed is the best one. If the e= vent issuer is different than a logical issuer associated with the event sub= ject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D v= alues inside the event. Any =E2=80=9Csub=E2=80=9D at the top-level (if any)= should be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which= is always the event issuer. >>>=20 >>> =20 >>>=20 >>> Any proposal that requires duplicating information, such as requiring =E2= =80=9CsubIss=E2=80=9D even when it=E2=80=99s always identical to =E2=80=9Cis= s=E2=80=9D, is not a great architectural choice, since it creates unnecessar= y error conditions that would not otherwise be possible. (How should implem= entations handle the case where two values are required to match but don=E2=80= =99t?) >>>=20 >>> =20 >>>=20 >>> -- Mike >>>=20 >>> =20 >>>=20 >>> From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Phil Hunt= (IDM) >>> Sent: Thursday, May 18, 2017 7:31 AM >>> To: Dick Hardt >>> Cc: ID Events Mailing List >>> Subject: Re: [Id-event] Dealing with issuer conflict >>>=20 >>> =20 >>>=20 >>> ?? >>>=20 >>> =20 >>>=20 >>> Happens in any case where sub is not globally identifiable.=20 >>>=20 >>> =20 >>>=20 >>> In Connect, since sub is not uniquely identified, the iss for the sub mu= st be included. This creates a conflict if the issuer of the SET is not the i= ssuer of the subject.=20 >>>=20 >>> =20 >>>=20 >>> Resolving the iss conflict has been on the list of issues since chicago.= =20 >>>=20 >>> =20 >>>=20 >>> In RISC we were discussing account close events. I am assume one of the s= cenarios is RPs will notify IDPs when they close an account. They must use a= n iss not associated with sub. As things stand now, they will have to assert= the extra iss value in their payload---which for most events is complex to p= arse since their are no other extra claims.=20 >>>=20 >>> =20 >>>=20 >>> Phil >>>=20 >>>=20 >>> On May 18, 2017, at 6:36 AM, Dick Hardt wrote: >>>=20 >>> Phil, would you clarify the use case and the requirement to ensure every= one on the list is aligned? Thanks >>>=20 >>> =20 >>>=20 >>> On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) w= rote: >>>=20 >>> In many cases where we are talking about events (eg risc) there is no ne= ed for extra claims other than the event type itself. >>>=20 >>> It occurs to me that in the case of RP issued events the current sectoke= n format requires an embedded iss to deal with the conflict with the set iss= uer. It seems to add a lot of complication for most events. >>>=20 >>> What if we defined a new sectoken top level attribute 'subIss' to mean "= subject issuer" and keep iss reserved for the SET issuer. >>>=20 >>> I would suggest this as a recommended attribute even when iss and subIss= are the same for parsing consistency. >>>=20 >>> Thoughts? >>>=20 >>> Phil >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>>=20 >>> --=20 >>>=20 >>> Subscribe to the HARDTWARE mail list to learn about projects I am workin= g on! >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Dp1Vsd1Hb7BX87sV4x= 9MhtsGbORcuiacHxujwThSnWh4&s=3DATYzOXXGto5afit3OgTjh19KczxKCvaBwC7ftofHMrs&e= =3D >>>=20 >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mail= man_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY05= 7SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAX= LrAb5zfUt5rVD8vbwKwvw8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLylrw&e= =3D=20 >>>=20 >>> =20 >>>=20 >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >>=20 >=20 --Apple-Mail-2AC2151E-519F-49F5-A590-1FF44E35C5F2 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Marius,

+1

I like this because my po= int has been re-using iss at the top level may be visually pleasing but it d= oesn't make the code simpler. Those that fail to check for an embedded iss c= ould be exposing themselves to mistaken assumptions about the subject issuer= causing confusion. 

IMO, this proposal can work equally well for the S= CIM cases too. 

Phil
=
On May 18, 2017, at 1:11 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

We also have the open issue of SETs= being confused for Id Tokens or access tokens.

Pushing t= he iss+sub pair always down to the event level, and leaving only an iss at t= he top level solves both problems.

The top level is= s is the issuer of the SET and provides context for the SET signature.
=

The event level iss provides context for event level sub= .

There is no top level sub, this eliminates any Id= Token or access token confusion possibility.

The o= nly drawback I can see is the extra verbosity in case multiple events are in= one SET. Also, the top level iss and event level iss will probably be the s= ame often for SETs issued by an IdP, but they don't have to. But I don't see= this as a big problem.

This is the alternative I a= m referring to:
{<= /div>
  "aud": ["connect.myidp.com"],<= /font>
  "iat": 147156615= 4,
  "jti": "bWJq"= ,
  "events": {
      "iss=E2=80=9D:=E2=80=9Dconnect.myidp.= com=E2=80=9D
 =     "sub": "248289761001",
    }
  }
}




Marius

On Thu, May 18, 2017 at 12:34 PM, Phil Hunt (= IDM) <phil.hunt@oracle.com> wrote:
Thanks Mike. 

I think we disagree.

The concern I have is that most implementers will have to write code t= hat always checks for the absence of a duplicate issuer claim because it cha= nges the meaning of subject.

This= strikes me as complexity that needs to be dealt with in the core spec. It s= tems from our SecToken's use of JWT and its popular use today.

If every profiling spec can do this differently r= equiring different parsers whats the point of secevents?

Phil

On May 18, 2017, at 12:08 PM, Mik= e Jones <Michael.Jones@microsoft.com> wrote:

Most of what you=E2=80=99re talking abo= ut seems to me to be decisions that can be made by particular event definiti= ons or event family definitions.  I have no problem with particular events or event families employing some of the strategies t= hat you=E2=80=99re describing.  The SET spec already facilitates that.<= u>

 

But per previous discussions, we should= n=E2=80=99t be making restrictions in the SET spec that limit its applicabil= ity by making restrictions on claims usage that will only work for some event use cases and will rule out others.  We shoul= d hold to the bright-line test that event definitions define what claims are= included in SETS (other than the =E2=80=9Cevents=E2=80=9D claim itself) and= how they=E2=80=99re used.  Intruding on that will unnecessarily limit the applicability of SETs.

 

      &nb= sp;            &= nbsp;           =             &nbs= p;            &n= bsp;       -- Mike

 

From: Phil Hunt [mailto:phil.hunt@oracle.com]
Sent: Thursday, May 18, 2017 11:41 AM
To: Mike Jones <Michael.Jones@microsoft.com>
Cc: Dick Hardt <dick.hardt@gmail.com>; ID Events Mailing List <id-event@ietf.org>=


Subject: Re: [Id-event] Dealing with issuer conflict

 

Mike,

 

I=E2=80=99m not sure we=E2=80=99re on the same page h= ere. My impression is this is still on the outstanding list.

 

Let=E2=80=99s look at some example cases:

 

For example, if a relying party (e.g. retail store) w= ants to notify an IDP that the user has been deleted=E2=80=A6<= /p>

 

Currently in the draft:

When issued by an OpenID Connect issuer:

{

  "iss": "https://connect.myidp.com",
  "sub": "248289761001",
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {}
  }
}

 

BUT, when issued by a party other than the issuer of t= he subject:

{
  "iss": "https://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {
    "http://schemas.openid.ne=
t/risc/event-type/account-deleted": {=

      "iss=E2=
=80=9D:"connect.myidp.com=E2=80=9D<=
u>
    }
  }
}

 

If you are writing code, if you agree that the OP iss= ues a lot of events, you end up having to check that there=E2=80=99s no embe= dded =E2=80=9Ciss=E2=80=9D present before you can assume the issuer of the s= ubject is the same as that of the SET token.  This strikes me as very complex.

 

Regarding your assertion:

Any =E2=80=9Csub=E2=80=9D at the top-le= vel (if any) should be associated with the =E2=80=9Ciss=E2=80=9D at the top-= level, which is always the event issuer.

 

May be you are thinking that we should be solving thi= s by always issuing embedded iss and sub (Alternative 1):

{
  "iss": "https://exampleretail.store.com",  
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": "bWJq",
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {
      "iss=E2=
=80=9D:=E2=80=9Dconnect.myidp.com=E2=80=9D=

      =
"sub": "248289761001",=

    }
  }
}
&nb=
sp;
OR, Alternative 2:
{
  "iss": "https://exampleretail.store.com",
  "sub": "248289761001",
  "aud": ["connect.myidp.com"],
  "iat": 1471566154,
  "jti": =E2=80=9CbWJq"=

  =E2=80=9CsubIss=E2=80=9D:=E2=80=
=9Dconnect.myidp.com=E2=80=9D,
  "events": {
    "http://schemas.openid.net/risc/event-type/account-deleted": {}
  }
}
 

I can see pros and cons for either. I like option 1 b= ecause it also makes the SET different from ID Tokens and Access Tokens.<= /u>

 

Option 2 is nice because most SETs we=E2=80=99ve been= talking about just have an event type and a subject and no claims.

 

The best way to define this is to enforce that sub ma= y only be used at the top level if it is globally identifiable (e.g. such as= in the case of SCIM URIs).

 

 

On May 18, 2017, at 10:40 AM, Mike Jones <Michael.Jones@microso= ft.com> wrote:

 

I believe that the solution already dis= cussed is the best one.  If the event issuer is different than a logica= l issuer associated with the event subject, then put the logical =E2=80=9Ciss=E2=80=9D and =E2=80=9Csub=E2=80=9D values insi= de the event.  Any =E2=80=9Csub=E2=80=9D at the top-level (if any) shou= ld be associated with the =E2=80=9Ciss=E2=80=9D at the top-level, which is a= lways the event issuer.

 

Any proposal that requires duplicating i= nformation, such as requiring =E2=80=9CsubIss=E2=80=9D even when it=E2=80=99= s always identical to =E2=80=9Ciss=E2=80=9D, is not a great architectural ch= oice, since it creates unnecessary error conditions that would not otherwise be p= ossible.  (How should implementations handle the case where two values a= re required to match but don=E2=80=99t?)

 

      &nb= sp;            &= nbsp;           =             &nbs= p;            &n= bsp;       -- Mike

 

From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf O= f Phil Hunt (IDM)
Sent: = ;Thursday, May 18, 2017 7:31 AM
To: <= /span>Dick Hardt <dick.hardt@gmail.com>
Cc: <= /span>ID Events Mailing List <id-event@ietf.org> Subject:&n= bsp;Re: [Id-event] Dealing with issuer conflict<= /p>

 

??

 

Happens in any case where sub is not globally identif= iable. 

 

In Connect, since sub is not uniquely identified, the= iss for the sub must be included. This creates a conflict if the issuer of t= he SET is not the issuer of the subject. 

 

Resolving the iss conflict has been on the list of is= sues since chicago. 

 

In RISC we were discussing account close events. I am= assume one of the scenarios is RPs will notify IDPs when they close an acco= unt. They must use an iss not associated with sub. As things stand now, they= will have to assert the extra iss value in their payload---which for most events is complex to parse sinc= e their are no other extra claims. 

 

Phil


On May 18, 2017, at 6:36 AM, Dick Hardt <dick.hardt@gmail.com<= /span>> wrote:

Phil, would you clarify the use case and the requirem= ent to ensure everyone on the list is aligned? Thanks

 

On Wed, May 17, 2017 at 9:45 PM Phil Hunt (IDM) <<= a href=3D"mailto:phil.hunt@oracle.com" target=3D"_blank">phil.hunt@oracle.com> wrote:

In many cases where we are talking about events (eg r= isc) there is no need for extra claims other than the event type itself.
=
It occurs to me that in the case of RP issued events the current sectoken fo= rmat requires an embedded iss to deal with the conflict with the set issuer.= It seems to add a lot of complication for most events.

What if we defined a new sectoken top level attribute 'subIss' to mean "subj= ect issuer" and keep iss reserved for the SET issuer.

I would suggest this as a recommended attribute even when iss and subIss are= the same for parsing consistency.

Thoughts?

Phil
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event=

-- 

Subscribe to the HARDTWARE mail list to learn about projects I am working on!

_______________________________________________=
Id-event mailing list
= Id-event@ietf.org
h= ttps://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org= _mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWH= vlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivz= jWwlNKe4C_lLIGk&m=3D8LfCYox0y3ghN8YAXLrAb5zfUt5rVD8vbwKwv= w8-Rjk&s=3Dgv4-yN8LDVir82WEWzix61-YzkrfquEPKMk_TtLylrw&e=3D=  =

 


__________________________________________= _____
Id-event mailing list
Id-event@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/id-event


= --Apple-Mail-2AC2151E-519F-49F5-A590-1FF44E35C5F2-- From nobody Thu May 18 13:42:38 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED71E12EAE2 for ; Thu, 18 May 2017 13:42:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.019 X-Spam-Level: X-Spam-Status: No, score=-2.019 tagged_above=-999 required=5 tests=[AC_DIV_BONANZA=0.001, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SQAsL9JQ6JiQ for ; Thu, 18 May 2017 13:42:32 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0108.outbound.protection.outlook.com [104.47.34.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEE461200FC for ; Thu, 18 May 2017 13:35:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=GkZkCByzSYjoYXY3eTeSE+GuFWsVG50abGHaOKDc7rA=; b=GwyeYBxvxXmxLqXios+GpUaBvcHnLkOQSME8+e8QdLtlVRDh83GgOen75HHH1FppfnbZfUMAdqD8i2iS7KIiTBCD8joPjv9EoKMuRTelCFD8OYgulQRaeWUk2HNegMChK64UXSZB1z0/Li2CewL5FsvBkatLhIA/VnZO9JQ4P0M= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0133.namprd21.prod.outlook.com (10.173.189.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.0; Thu, 18 May 2017 20:35:26 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1124.007; Thu, 18 May 2017 20:35:26 +0000 From: Mike Jones To: "Phil Hunt (IDM)" CC: Dick Hardt , ID Events Mailing List Thread-Topic: [Id-event] Dealing with issuer conflict Thread-Index: AQHSz5GPBeIUkwXJI0S9grGRbpCBVKH6GH8AgAAO/4CAADPHoIAAEkCAgAAGbLCAAAhqgIAAAahggAALAQCAAAJ8QA== Date: Thu, 18 May 2017 20:35:26 +0000 Message-ID: References: <262D32B6-940E-4B96-9981-079A5443ED3E@oracle.com> <74177700-9959-4F07-83E3-F3B750CAC9B8@oracle.com> <9342926E-FC34-45E4-919D-FB61FE8EB6A3@oracle.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetBy=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-05-18T13:35:23.9214607-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General authentication-results: oracle.com; dkim=none (message not signed) header.d=none;oracle.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:3::32c] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0133; 7:REnm32hA3TdPlj8RHdJgnQnb48HZ8c28Zrv4uArx+KFvPUbEGqshZSdOuFW+U6D5AaZHh6QOipKQ8xvxmrTQhC9nUVFYgRWoNxCWBNX/vV/bpJ7fU+S7jOVgyftQexbRAJfAVwbP61Vm1KmedAF8Y+mSs0h4y6HLK4NLk3Y5sWbvTRtNpmAnXtUScIMlgkbCQLuwmsV/zE8rGla0hJVPixOv6ODo59pNShSLdLvhfjUwIdWh92b8tHefsKWfO80eESt5RGLKtTihLfhqO8BYwiTUJbm2EbQEf5u9JOYbtFqXJIjIU1oHBYW4xs7Ico/m+IXBgP7gPCBc4SJkprwM2nUOQ7BkymH+q2OFxAGob1o= x-ms-traffictypediagnostic: CY4PR21MB0133: x-ms-office365-filtering-correlation-id: c0fbddf8-f312-4807-7d4f-08d49e2d6a93 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081)(201702281549075); SRVR:CY4PR21MB0133; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(21748063052155)(21532816269658)(146099531331640)(17755550239193)(5213294742642); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(100000703036)(100105400095)(3002001)(10201501046)(93006095)(93001095)(6055026)(61426038)(61427038)(6041248)(20161123558100)(20161123560025)(20161123562025)(20161123564025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:CY4PR21MB0133; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:CY4PR21MB0133; x-forefront-prvs: 0311124FA9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39400400002)(39850400002)(39840400002)(39450400003)(39860400002)(51444003)(24454002)(377454003)(53546009)(53946003)(38730400002)(8676002)(122556002)(81166006)(53936002)(6246003)(74316002)(4326008)(39060400002)(25786009)(229853002)(86362001)(575784001)(19609705001)(5005710100001)(6916009)(2950100002)(7696004)(6116002)(8990500004)(102836003)(790700001)(10090500001)(110136004)(5660300001)(966005)(2900100001)(72206003)(478600001)(33656002)(8936002)(189998001)(561944003)(50986999)(54356999)(76176999)(10290500003)(2906002)(6506006)(93886004)(55016002)(7906003)(236005)(99286003)(606005)(9686003)(6306002)(54906002)(54896002)(7736002)(6436002)(77096006)(3280700002)(86612001)(3660700001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0133; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR21MB05043FEE04230B7FB1D61165F5E40CY4PR21MB0504namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2017 20:35:26.3131 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0133 Archived-At: Subject: Re: [Id-event] Dealing with issuer conflict X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 May 2017 20:42:37 -0000 --_000_CY4PR21MB05043FEE04230B7FB1D61165F5E40CY4PR21MB0504namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBjYW4gYWxsIGJlIHJlYWxseSBzaW1wbGUuICBJZiBhbiBldmVudCBpcyBkZWZpbmVkIHN1 Y2ggdGhhdCBhbiDigJxpc3PigJ0gdmFsdWUgaXMgbmVlZGVkIGFzIHBhcnQgb2YgaWRlbnRpZnlp bmcgdGhlIHN1YmplY3Qgb2YgdGhlIFNFVCB0aGF0IGNhbiBiZSBkaXN0aW5jdCBmcm9tIHRoZSBp c3N1aW5nIOKAnGlzc+KAnSwgdGhlbiBpdCBuZWVkcyB0byBiZSBpbnNpZGUgdGhlIGV2ZW50IHBh eWxvYWQuICBXaGVyZWFzLCBpZiBhbiBldmVudCBpcyBkZWZpbmVkIHN1Y2ggdGhhdCBpdHMgaXNz dWVyIGlzIGFsd2F5cyBhbGlnbmVkIHdpdGggdGhlIHN1YmplY3QsIHRoZW4gdGhleeKAmXJlIG5l dmVyIGEgbmVlZCBmb3IgYW4gaW5uZXIg4oCcaXNz4oCdLCBpbiB3aGljaCBjYXNlIGl0IG11c3Qg YmUgb21pdHRlZC4gIFRoZSBzcGVjIGFscmVhZHkgZ2l2ZXMgYXBwcm9wcmlhdGUgZ3VpZGFuY2Ug YWxvbmcgdGhlc2UgbGluZXMuDQoNCkluIGJvdGggY2FzZXMsIHRoZXJl4oCZcyBuZXZlciBhbiBv cHRpb25hbCBpbm5lciDigJxpc3PigJ0gZm9yIGFuIGV2ZW50LiAgRWl0aGVyIHRoZSBldmVudCBk ZWZpbml0aW9uIHJlcXVpcmVzIHRoZSBpbm5lciDigJxpc3PigJ0gb3IgdGhlIGV2ZW50IGRlZmlu aXRpb24gcHJlY2x1ZGVzIGl0LiAgVGhlcmXigJlzIG5vIHNwZWNpYWwtY2FzZSBwYXJzaW5nIG9m IG9wdGlvbmFsIGlubmVyIOKAnGlzc+KAnSB2YWx1ZXMgaW4gZWl0aGVyIGNhc2UuDQoNCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAtLSBNaWtlDQoNCkZyb206IFBoaWwgSHVudCAoSURNKSBbbWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tXQ0KU2VudDogVGh1cnNkYXksIE1heSAxOCwgMjAxNyAxOjIwIFBNDQpUbzogTWlrZSBK b25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPg0KQ2M6IERpY2sgSGFyZHQgPGRpY2su aGFyZHRAZ21haWwuY29tPjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8aWQtZXZlbnRAaWV0Zi5v cmc+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBEZWFsaW5nIHdpdGggaXNzdWVyIGNvbmZsaWN0 DQoNCk1pa2UNCg0KVGhlIFJJU0MgZ3JvdXAgY2FzZSBpcyBhIHVzZWZ1bCBjYXNlIHRvIGRpc2N1 c3MgaGVyZSBzaW5jZSB3ZSBuZWVkIHRvIHVuZGVyc3RhbmQgaG93IFNFVHMgd2lsbCBiZSB1c2Vk Lg0KDQpBRkFJSywgdGhlIFJJU0MgV0cgaXMgYXNzdW1pbmcgdGhlIGlzc3VlIG9mIGlzcyBjb25m bGljdCB3aWxsIGJlIHJlc29sdmVkIGluIFNFQ0VWRU5Ucy4NCg0KTXkgdW5kZXJzdGFuZGluZyBp cyB0aGlzIGlzIG11Y2ggbW9yZSB0aGFuIHJlZ2lzdGVyaW5nIGFuIGV2ZW50IGNsYWltIGJ1dCB0 byBnZXQgdG8gaW50ZXJvcGVyYWJsZSBldmVudCBmb3JtYXRzIHRoYXQgY2FuIGJlIHVzZWQgYnkg bWFueSBkb3duc3RyZWFtIFNET3MgYW5kIFdHcy4NCg0KTWF5YmUgSSBhbSBtaXN0YWtlbj8NCg0K UGhpbA0KDQpPbiBNYXkgMTgsIDIwMTcsIGF0IDEyOjQ2IFBNLCBNaWtlIEpvbmVzIDxNaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbT4+ IHdyb3RlOg0KSW4gbWFueSB1c2UgY2FzZXMsIG9ubHkgU0VUcyBmcm9tIGEgc2luZ2xlIGV2ZW50 IGZhbWlseSB3aWxsIGJlIGxlZ2FsIGFuZCBhbGwgd2lsbCB1c2UgdGhlIHNhbWUgY2xhaW1zIGNv bnZlbnRpb25zLiAgSW4gdGhhdCBjYXNlLCBhIG5vcm1hbCBKV1QgcGFyc2VyIHdpbGwgbGlrZWx5 IGJlIHVzZWQgYW5kIHRoZSBhcHBsaWNhdGlvbiB3aWxsIHByb2Nlc3MgdGhlIGFkZGl0aW9uYWwg ZXZlbnQtc3BlY2lmaWMgY2xhaW1zLiAgVGhlcmXigJlzIG5vIGdlbmVyYWwtcHVycG9zZSBTRVQg cGFyc2VyIGluIHRoZSBtaXguDQoNCkkgdGhpbmsgdGhhdCB0cnlpbmcgdG8gYXJjaGl0ZWN0IHRo aXMgZm9yIGEgd29ybGQgaW4gd2hpY2ggdGhlcmXigJlzIGEgc2luZ2xlIFNFVCBwYXJzZXIgZm9y IFNFVHMgb2YgYWxsIGtpbmRzIHdvdWxkIHNrZXcgdGhlIGFyY2hpdGVjdHVyZSBhbmQgaGF2ZSB0 aGUgdW5pbnRlbmRlZCBzaWRlLWVmZmVjdCBvZiBleGNsdWRpbmcgc29tZSB1c2UgY2FzZXMgdGhy b3VnaCB1bm5lY2Vzc2FyeSBjb21wbGV4aXR5Lg0KDQpUaGUgU0VUIHNwZWMgc2hvdWxkIGRlZmlu ZSB0aGUg4oCcZXZlbnRz4oCdIGNsYWltIGFuZCBzdG9wIHRoZXJlLiAgU0VUIGlzIGFscmVhZHkg cG9pc2VkIGZvciBzdWNjZXNzIGFzIGl0IGlzIG5vdy4gIFdlIHNob3VsZG7igJl0IGFkZCByZXN0 cmljdGlvbnMgdGhhdCB3aWxsIGplb3BhcmRpemUgdGhhdCBhY2hpZXZlbWVudC4gIEV2ZW50cyBh bmQgZXZlbnQgZmFtaWxpZXMgc2hvdWxkIGRvIHRoZSByZXN0LCBpbiB3YXlzIGFwcHJvcHJpYXRl IHRvIHRoZWlyIHVzZSBjYXNlcy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KUC5TLiAgSG93IHRvIHJl cHJlc2VudCBSSVNDIGV2ZW50cyB0aGF0IG1pZ2h0IGJlIGlzc3VlZCBlaXRoZXIgYnkgYW4gSWRl bnRpdHkgUHJvdmlkZXIgb3IgUmVseWluZyBwYXJ0eSBpcyBhbiBlbnRpcmVseSBhcHByb3ByaWF0 ZSBkaXNjdXNzaW9uIHRvIGhhdmUgaW4gdGhlIFJJU0Mgd29ya2luZyBncm91cCwgYnV0IG5vdCBo ZXJlIGluIHRoZSBJRCBFdmVudHMgd29ya2luZyBncm91cC4NCg0KRnJvbTogUGhpbCBIdW50IChJ RE0pIFttYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQpTZW50OiBUaHVyc2RheSwgTWF5IDE4 LCAyMDE3IDEyOjM0IFBNDQpUbzogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KQ2M6IERpY2sgSGFyZHQg PGRpY2suaGFyZHRAZ21haWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+OyBJRCBF dmVudHMgTWFpbGluZyBMaXN0IDxpZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86aWQtZXZlbnRAaWV0 Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtJZC1ldmVudF0gRGVhbGluZyB3aXRoIGlzc3VlciBjb25m bGljdA0KDQpUaGFua3MgTWlrZS4NCg0KSSB0aGluayB3ZSBkaXNhZ3JlZS4NCg0KVGhlIGNvbmNl cm4gSSBoYXZlIGlzIHRoYXQgbW9zdCBpbXBsZW1lbnRlcnMgd2lsbCBoYXZlIHRvIHdyaXRlIGNv ZGUgdGhhdCBhbHdheXMgY2hlY2tzIGZvciB0aGUgYWJzZW5jZSBvZiBhIGR1cGxpY2F0ZSBpc3N1 ZXIgY2xhaW0gYmVjYXVzZSBpdCBjaGFuZ2VzIHRoZSBtZWFuaW5nIG9mIHN1YmplY3QuDQoNClRo aXMgc3RyaWtlcyBtZSBhcyBjb21wbGV4aXR5IHRoYXQgbmVlZHMgdG8gYmUgZGVhbHQgd2l0aCBp biB0aGUgY29yZSBzcGVjLiBJdCBzdGVtcyBmcm9tIG91ciBTZWNUb2tlbidzIHVzZSBvZiBKV1Qg YW5kIGl0cyBwb3B1bGFyIHVzZSB0b2RheS4NCg0KSWYgZXZlcnkgcHJvZmlsaW5nIHNwZWMgY2Fu IGRvIHRoaXMgZGlmZmVyZW50bHkgcmVxdWlyaW5nIGRpZmZlcmVudCBwYXJzZXJzIHdoYXRzIHRo ZSBwb2ludCBvZiBzZWNldmVudHM/DQoNClBoaWwNCg0KT24gTWF5IDE4LCAyMDE3LCBhdCAxMjow OCBQTSwgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+PiB3cm90ZToNCk1vc3Qgb2Ygd2hhdCB5b3XigJlyZSB0 YWxraW5nIGFib3V0IHNlZW1zIHRvIG1lIHRvIGJlIGRlY2lzaW9ucyB0aGF0IGNhbiBiZSBtYWRl IGJ5IHBhcnRpY3VsYXIgZXZlbnQgZGVmaW5pdGlvbnMgb3IgZXZlbnQgZmFtaWx5IGRlZmluaXRp b25zLiAgSSBoYXZlIG5vIHByb2JsZW0gd2l0aCBwYXJ0aWN1bGFyIGV2ZW50cyBvciBldmVudCBm YW1pbGllcyBlbXBsb3lpbmcgc29tZSBvZiB0aGUgc3RyYXRlZ2llcyB0aGF0IHlvdeKAmXJlIGRl c2NyaWJpbmcuICBUaGUgU0VUIHNwZWMgYWxyZWFkeSBmYWNpbGl0YXRlcyB0aGF0Lg0KDQpCdXQg cGVyIHByZXZpb3VzIGRpc2N1c3Npb25zLCB3ZSBzaG91bGRu4oCZdCBiZSBtYWtpbmcgcmVzdHJp Y3Rpb25zIGluIHRoZSBTRVQgc3BlYyB0aGF0IGxpbWl0IGl0cyBhcHBsaWNhYmlsaXR5IGJ5IG1h a2luZyByZXN0cmljdGlvbnMgb24gY2xhaW1zIHVzYWdlIHRoYXQgd2lsbCBvbmx5IHdvcmsgZm9y IHNvbWUgZXZlbnQgdXNlIGNhc2VzIGFuZCB3aWxsIHJ1bGUgb3V0IG90aGVycy4gIFdlIHNob3Vs ZCBob2xkIHRvIHRoZSBicmlnaHQtbGluZSB0ZXN0IHRoYXQgZXZlbnQgZGVmaW5pdGlvbnMgZGVm aW5lIHdoYXQgY2xhaW1zIGFyZSBpbmNsdWRlZCBpbiBTRVRTIChvdGhlciB0aGFuIHRoZSDigJxl dmVudHPigJ0gY2xhaW0gaXRzZWxmKSBhbmQgaG93IHRoZXnigJlyZSB1c2VkLiAgSW50cnVkaW5n IG9uIHRoYXQgd2lsbCB1bm5lY2Vzc2FyaWx5IGxpbWl0IHRoZSBhcHBsaWNhYmlsaXR5IG9mIFNF VHMuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IFBoaWwgSHVudCBbbWFpbHRvOnBoaWwuaHVu dEBvcmFjbGUuY29tXQ0KU2VudDogVGh1cnNkYXksIE1heSAxOCwgMjAxNyAxMTo0MSBBTQ0KVG86 IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPj4NCkNjOiBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNv bTxtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20+PjsgSUQgRXZlbnRzIE1haWxpbmcgTGlzdCA8 aWQtZXZlbnRAaWV0Zi5vcmc8bWFpbHRvOmlkLWV2ZW50QGlldGYub3JnPj4NClN1YmplY3Q6IFJl OiBbSWQtZXZlbnRdIERlYWxpbmcgd2l0aCBpc3N1ZXIgY29uZmxpY3QNCg0KTWlrZSwNCg0KSeKA mW0gbm90IHN1cmUgd2XigJlyZSBvbiB0aGUgc2FtZSBwYWdlIGhlcmUuIE15IGltcHJlc3Npb24g aXMgdGhpcyBpcyBzdGlsbCBvbiB0aGUgb3V0c3RhbmRpbmcgbGlzdC4NCg0KTGV04oCZcyBsb29r IGF0IHNvbWUgZXhhbXBsZSBjYXNlczoNCg0KRm9yIGV4YW1wbGUsIGlmIGEgcmVseWluZyBwYXJ0 eSAoZS5nLiByZXRhaWwgc3RvcmUpIHdhbnRzIHRvIG5vdGlmeSBhbiBJRFAgdGhhdCB0aGUgdXNl ciBoYXMgYmVlbiBkZWxldGVk4oCmDQoNCkN1cnJlbnRseSBpbiB0aGUgZHJhZnQ6DQpXaGVuIGlz c3VlZCBieSBhbiBPcGVuSUQgQ29ubmVjdCBpc3N1ZXI6DQp7DQoNCiAgImlzcyI6ICJodHRwczov L2Nvbm5lY3QubXlpZHAuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fY29ubmVjdC5teWlkcC5jb20mZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQ RWl2empXd2xOS2U0Q19sTElHayZtPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1Fy X1BZUk8xSGcmcz1rSjVNZm42aTM5bG9yTGdiYmtDNDBrQkMtSGZrb21fbkhKdzlEdkNUb3U4JmU9 PiIsDQoNCiAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICJhdWQiOiBbImNvbm5lY3QubXlp ZHAuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNB X19jb25uZWN0Lm15aWRwLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZzPUpj TW1ITUxmTklfM2xzck5jZWI2Vk02ZEtNYlpCWDctVXJkX0U2Z3J3a2cmZT0+Il0sDQoNCiAgImlh dCI6IDE0NzE1NjYxNTQsDQoNCiAgImp0aSI6ICJiV0pxIiwNCg0KICAiZXZlbnRzIjogew0KDQog ICAgImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVs ZXRlZDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9f c2NoZW1hcy5vcGVuaWQubmV0X3Jpc2NfZXZlbnQtMkR0eXBlX2FjY291bnQtMkRkZWxldGVkJmQ9 RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpC bTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZP U2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9UUh4Snk3enFEemNSR2htY0doYXRBMmsx NWJZVUxQT0RiVzcxWnRjNEt4NCZlPT4iOiB7fQ0KDQogIH0NCg0KfQ0KDQpCVVQsIHdoZW4gaXNz dWVkIGJ5IGEgcGFydHkgb3RoZXIgdGhhbiB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0Og0KDQp7 DQoNCiAgImlzcyI6ICJodHRwczovL2V4YW1wbGVyZXRhaWwuc3RvcmUuY29tPGh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fZXhhbXBsZXJldGFpbC5z dG9yZS5jb20mZD1Ed01HYVEmYz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJnI9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZtPVpS eG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmcz1ZWmF4MGJZSXk4X0oz bmM0MEU1a0FNZHNxUXB1aTZTbGo0WVpZcUk3YkZNJmU9PiIsDQoNCiAgInN1YiI6ICIyNDgyODk3 NjEwMDEiLA0KDQogICJhdWQiOiBbImNvbm5lY3QubXlpZHAuY29tPGh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZkPUR3 TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01 YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1Nk dmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZzPUpjTW1ITUxmTklfM2xzck5jZWI2Vk02ZEtN YlpCWDctVXJkX0U2Z3J3a2cmZT0+Il0sDQoNCiAgImlhdCI6IDE0NzE1NjYxNTQsDQoNCiAgImp0 aSI6ICJiV0pxIiwNCg0KICAiZXZlbnRzIjogew0KDQogICAgImh0dHA6Ly9zY2hlbWFzLm9wZW5p ZC5uZXQvcmlzYy88aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0 dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjXyZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdI dmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJf UFlSTzFIZyZzPUpWYUc1ZWU2QllmMjdlbUR5dnNHNzQ5RWo0WFg5ZDJGY0t2ZVJKMjB3dzgmZT0+ ZXZlbnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQiOiB7DQoNCiAgICAgICJpc3PigJ06ImNvbm5lY3Qu bXlpZHAuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRw LTNBX19jb25uZWN0Lm15aWRwLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFj eEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5L ZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZz PUpjTW1ITUxmTklfM2xzck5jZWI2Vk02ZEtNYlpCWDctVXJkX0U2Z3J3a2cmZT0+4oCdDQoNCiAg ICB9DQoNCiAgfQ0KDQp9DQoNCklmIHlvdSBhcmUgd3JpdGluZyBjb2RlLCBpZiB5b3UgYWdyZWUg dGhhdCB0aGUgT1AgaXNzdWVzIGEgbG90IG9mIGV2ZW50cywgeW91IGVuZCB1cCBoYXZpbmcgdG8g Y2hlY2sgdGhhdCB0aGVyZeKAmXMgbm8gZW1iZWRkZWQg4oCcaXNz4oCdIHByZXNlbnQgYmVmb3Jl IHlvdSBjYW4gYXNzdW1lIHRoZSBpc3N1ZXIgb2YgdGhlIHN1YmplY3QgaXMgdGhlIHNhbWUgYXMg dGhhdCBvZiB0aGUgU0VUIHRva2VuLiAgVGhpcyBzdHJpa2VzIG1lIGFzIHZlcnkgY29tcGxleC4N Cg0KUmVnYXJkaW5nIHlvdXIgYXNzZXJ0aW9uOg0KQW55IOKAnHN1YuKAnSBhdCB0aGUgdG9wLWxl dmVsIChpZiBhbnkpIHNob3VsZCBiZSBhc3NvY2lhdGVkIHdpdGggdGhlIOKAnGlzc+KAnSBhdCB0 aGUgdG9wLWxldmVsLCB3aGljaCBpcyBhbHdheXMgdGhlIGV2ZW50IGlzc3Vlci4NCg0KTWF5IGJl IHlvdSBhcmUgdGhpbmtpbmcgdGhhdCB3ZSBzaG91bGQgYmUgc29sdmluZyB0aGlzIGJ5IGFsd2F5 cyBpc3N1aW5nIGVtYmVkZGVkIGlzcyBhbmQgc3ViIChBbHRlcm5hdGl2ZSAxKToNCg0Kew0KDQog ICJpc3MiOiAiaHR0cHM6Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNvbTxodHRwczovL3VybGRlZmVu c2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGVyZXRhaWwuc3RvcmUu Y29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksx MCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZM Ym9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9WVpheDBiWUl5OF9KM25jNDBF NWtBTWRzcVFwdWk2U2xqNFlaWXFJN2JGTSZlPT4iLA0KDQogICJhdWQiOiBbImNvbm5lY3QubXlp ZHAuY29tPGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNB X19jb25uZWN0Lm15aWRwLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZzPUpj TW1ITUxmTklfM2xzck5jZWI2Vk02ZEtNYlpCWDctVXJkX0U2Z3J3a2cmZT0+Il0sDQoNCiAgImlh dCI6IDE0NzE1NjYxNTQsDQoNCiAgImp0aSI6ICJiV0pxIiwNCg0KICAiZXZlbnRzIjogew0KDQog ICAgImh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVs ZXRlZDxodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9f c2NoZW1hcy5vcGVuaWQubmV0X3Jpc2NfZXZlbnQtMkR0eXBlX2FjY291bnQtMkRkZWxldGVkJmQ9 RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpC bTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZP U2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9UUh4Snk3enFEemNSR2htY0doYXRBMmsx NWJZVUxQT0RiVzcxWnRjNEt4NCZlPT4iOiB7DQoNCiAgICAgICJpc3PigJ064oCdY29ubmVjdC5t eWlkcC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAt M0FfX2Nvbm5lY3QubXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4 QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktl NENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9 SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZlPT7igJ0NCg0KICAg ICAgInN1YiI6ICIyNDgyODk3NjEwMDEiLA0KDQogICAgfQ0KDQogIH0NCg0KfQ0KDQoNCg0KT1Is IEFsdGVybmF0aXZlIDI6DQoNCnsNCg0KICAiaXNzIjogImh0dHBzOi8vZXhhbXBsZXJldGFpbC5z dG9yZS5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBz LTNBX19leGFtcGxlcmV0YWlsLnN0b3JlLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxa WVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlS TzFIZyZzPVlaYXgwYllJeThfSjNuYzQwRTVrQU1kc3FRcHVpNlNsajRZWllxSTdiRk0mZT0+IiwN Cg0KICAic3ViIjogIjI0ODI4OTc2MTAwMSIsDQoNCiAgImF1ZCI6IFsiY29ubmVjdC5teWlkcC5j b208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2Nv bm5lY3QubXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJnM9SmNNbUhN TGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZlPT4iXSwNCg0KICAiaWF0Ijog MTQ3MTU2NjE1NCwNCg0KICAianRpIjog4oCcYldKcSINCg0KICDigJxzdWJJc3PigJ064oCdY29u bmVjdC5teWlkcC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29tJmQ9RHdNR2FRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpq V3dsTktlNENfbExJR2smbT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJP MUhnJnM9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZlPT7igJ0s DQoNCiAgImV2ZW50cyI6IHsNCg0KICAgICJodHRwOi8vc2NoZW1hcy5vcGVuaWQubmV0L3Jpc2Mv ZXZlbnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQ8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjX2V2ZW50LTJEdHlw ZV9hY2NvdW50LTJEZGVsZXRlZCZkPUR3TUdhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJL Q1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZzPVFI eEp5N3pxRHpjUkdobWNHaGF0QTJrMTViWVVMUE9EYlc3MVp0YzRLeDQmZT0+Ijoge30NCg0KICB9 DQoNCn0NCg0KDQpJIGNhbiBzZWUgcHJvcyBhbmQgY29ucyBmb3IgZWl0aGVyLiBJIGxpa2Ugb3B0 aW9uIDEgYmVjYXVzZSBpdCBhbHNvIG1ha2VzIHRoZSBTRVQgZGlmZmVyZW50IGZyb20gSUQgVG9r ZW5zIGFuZCBBY2Nlc3MgVG9rZW5zLg0KDQpPcHRpb24gMiBpcyBuaWNlIGJlY2F1c2UgbW9zdCBT RVRzIHdl4oCZdmUgYmVlbiB0YWxraW5nIGFib3V0IGp1c3QgaGF2ZSBhbiBldmVudCB0eXBlIGFu ZCBhIHN1YmplY3QgYW5kIG5vIGNsYWltcy4NCg0KVGhlIGJlc3Qgd2F5IHRvIGRlZmluZSB0aGlz IGlzIHRvIGVuZm9yY2UgdGhhdCBzdWIgbWF5IG9ubHkgYmUgdXNlZCBhdCB0aGUgdG9wIGxldmVs IGlmIGl0IGlzIGdsb2JhbGx5IGlkZW50aWZpYWJsZSAoZS5nLiBzdWNoIGFzIGluIHRoZSBjYXNl IG9mIFNDSU0gVVJJcykuDQoNClBoaWwNCg0KT3JhY2xlIENvcnBvcmF0aW9uLCBJZGVudGl0eSBD bG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QgJiBTdGFuZGFyZHMNCkBpbmRlcGVuZGVudGlkDQp3d3cu aW5kZXBlbmRlbnRpZC5jb208aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZkPUR3TUdhUSZjPVJvUDFZdW1DWENn YVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdK eFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJL UXJfUFlSTzFIZyZzPTFydzlBMmhCLVJSODJ2WWdSTnpoTG1OY1VrcEo2dXlxNFBGTkRJbWItNzgm ZT0+DQpwaGlsLmh1bnRAb3JhY2xlLmNvbTxtYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb20+DQoN Ck9uIE1heSAxOCwgMjAxNywgYXQgMTA6NDAgQU0sIE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNA bWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPj4gd3JvdGU6 DQoNCkkgYmVsaWV2ZSB0aGF0IHRoZSBzb2x1dGlvbiBhbHJlYWR5IGRpc2N1c3NlZCBpcyB0aGUg YmVzdCBvbmUuICBJZiB0aGUgZXZlbnQgaXNzdWVyIGlzIGRpZmZlcmVudCB0aGFuIGEgbG9naWNh bCBpc3N1ZXIgYXNzb2NpYXRlZCB3aXRoIHRoZSBldmVudCBzdWJqZWN0LCB0aGVuIHB1dCB0aGUg bG9naWNhbCDigJxpc3PigJ0gYW5kIOKAnHN1YuKAnSB2YWx1ZXMgaW5zaWRlIHRoZSBldmVudC4g IEFueSDigJxzdWLigJ0gYXQgdGhlIHRvcC1sZXZlbCAoaWYgYW55KSBzaG91bGQgYmUgYXNzb2Np YXRlZCB3aXRoIHRoZSDigJxpc3PigJ0gYXQgdGhlIHRvcC1sZXZlbCwgd2hpY2ggaXMgYWx3YXlz IHRoZSBldmVudCBpc3N1ZXIuDQoNCkFueSBwcm9wb3NhbCB0aGF0IHJlcXVpcmVzIGR1cGxpY2F0 aW5nIGluZm9ybWF0aW9uLCBzdWNoIGFzIHJlcXVpcmluZyDigJxzdWJJc3PigJ0gZXZlbiB3aGVu IGl04oCZcyBhbHdheXMgaWRlbnRpY2FsIHRvIOKAnGlzc+KAnSwgaXMgbm90IGEgZ3JlYXQgYXJj aGl0ZWN0dXJhbCBjaG9pY2UsIHNpbmNlIGl0IGNyZWF0ZXMgdW5uZWNlc3NhcnkgZXJyb3IgY29u ZGl0aW9ucyB0aGF0IHdvdWxkIG5vdCBvdGhlcndpc2UgYmUgcG9zc2libGUuICAoSG93IHNob3Vs ZCBpbXBsZW1lbnRhdGlvbnMgaGFuZGxlIHRoZSBjYXNlIHdoZXJlIHR3byB2YWx1ZXMgYXJlIHJl cXVpcmVkIHRvIG1hdGNoIGJ1dCBkb27igJl0PykNCg0KICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTog SWQtZXZlbnQgW21haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2Yg UGhpbCBIdW50IChJRE0pDQpTZW50OiBUaHVyc2RheSwgTWF5IDE4LCAyMDE3IDc6MzEgQU0NClRv OiBEaWNrIEhhcmR0IDxkaWNrLmhhcmR0QGdtYWlsLmNvbTxtYWlsdG86ZGljay5oYXJkdEBnbWFp bC5jb20+Pg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgPGlkLWV2ZW50QGlldGYub3JnPG1h aWx0bzppZC1ldmVudEBpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW0lkLWV2ZW50XSBEZWFsaW5n IHdpdGggaXNzdWVyIGNvbmZsaWN0DQoNCj8/DQoNCkhhcHBlbnMgaW4gYW55IGNhc2Ugd2hlcmUg c3ViIGlzIG5vdCBnbG9iYWxseSBpZGVudGlmaWFibGUuDQoNCkluIENvbm5lY3QsIHNpbmNlIHN1 YiBpcyBub3QgdW5pcXVlbHkgaWRlbnRpZmllZCwgdGhlIGlzcyBmb3IgdGhlIHN1YiBtdXN0IGJl IGluY2x1ZGVkLiBUaGlzIGNyZWF0ZXMgYSBjb25mbGljdCBpZiB0aGUgaXNzdWVyIG9mIHRoZSBT RVQgaXMgbm90IHRoZSBpc3N1ZXIgb2YgdGhlIHN1YmplY3QuDQoNClJlc29sdmluZyB0aGUgaXNz IGNvbmZsaWN0IGhhcyBiZWVuIG9uIHRoZSBsaXN0IG9mIGlzc3VlcyBzaW5jZSBjaGljYWdvLg0K DQpJbiBSSVNDIHdlIHdlcmUgZGlzY3Vzc2luZyBhY2NvdW50IGNsb3NlIGV2ZW50cy4gSSBhbSBh c3N1bWUgb25lIG9mIHRoZSBzY2VuYXJpb3MgaXMgUlBzIHdpbGwgbm90aWZ5IElEUHMgd2hlbiB0 aGV5IGNsb3NlIGFuIGFjY291bnQuIFRoZXkgbXVzdCB1c2UgYW4gaXNzIG5vdCBhc3NvY2lhdGVk IHdpdGggc3ViLiBBcyB0aGluZ3Mgc3RhbmQgbm93LCB0aGV5IHdpbGwgaGF2ZSB0byBhc3NlcnQg dGhlIGV4dHJhIGlzcyB2YWx1ZSBpbiB0aGVpciBwYXlsb2FkLS0td2hpY2ggZm9yIG1vc3QgZXZl bnRzIGlzIGNvbXBsZXggdG8gcGFyc2Ugc2luY2UgdGhlaXIgYXJlIG5vIG90aGVyIGV4dHJhIGNs YWltcy4NCg0KUGhpbA0KDQpPbiBNYXkgMTgsIDIwMTcsIGF0IDY6MzYgQU0sIERpY2sgSGFyZHQg PGRpY2suaGFyZHRAZ21haWwuY29tPG1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNvbT4+IHdyb3Rl Og0KUGhpbCwgd291bGQgeW91IGNsYXJpZnkgdGhlIHVzZSBjYXNlIGFuZCB0aGUgcmVxdWlyZW1l bnQgdG8gZW5zdXJlIGV2ZXJ5b25lIG9uIHRoZSBsaXN0IGlzIGFsaWduZWQ/IFRoYW5rcw0KDQpP biBXZWQsIE1heSAxNywgMjAxNyBhdCA5OjQ1IFBNIFBoaWwgSHVudCAoSURNKSA8cGhpbC5odW50 QG9yYWNsZS5jb208bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPj4gd3JvdGU6DQpJbiBtYW55 IGNhc2VzIHdoZXJlIHdlIGFyZSB0YWxraW5nIGFib3V0IGV2ZW50cyAoZWcgcmlzYykgdGhlcmUg aXMgbm8gbmVlZCBmb3IgZXh0cmEgY2xhaW1zIG90aGVyIHRoYW4gdGhlIGV2ZW50IHR5cGUgaXRz ZWxmLg0KDQpJdCBvY2N1cnMgdG8gbWUgdGhhdCBpbiB0aGUgY2FzZSBvZiBSUCBpc3N1ZWQgZXZl bnRzIHRoZSBjdXJyZW50IHNlY3Rva2VuIGZvcm1hdCByZXF1aXJlcyBhbiBlbWJlZGRlZCBpc3Mg dG8gZGVhbCB3aXRoIHRoZSBjb25mbGljdCB3aXRoIHRoZSBzZXQgaXNzdWVyLiBJdCBzZWVtcyB0 byBhZGQgYSBsb3Qgb2YgY29tcGxpY2F0aW9uIGZvciBtb3N0IGV2ZW50cy4NCg0KV2hhdCBpZiB3 ZSBkZWZpbmVkIGEgbmV3IHNlY3Rva2VuIHRvcCBsZXZlbCBhdHRyaWJ1dGUgJ3N1YklzcycgdG8g bWVhbiAic3ViamVjdCBpc3N1ZXIiIGFuZCBrZWVwIGlzcyByZXNlcnZlZCBmb3IgdGhlIFNFVCBp c3N1ZXIuDQoNCkkgd291bGQgc3VnZ2VzdCB0aGlzIGFzIGEgcmVjb21tZW5kZWQgYXR0cmlidXRl IGV2ZW4gd2hlbiBpc3MgYW5kIHN1YklzcyBhcmUgdGhlIHNhbWUgZm9yIHBhcnNpbmcgY29uc2lz dGVuY3kuDQoNClRob3VnaHRzPw0KDQpQaGlsDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGluZyBsaXN0DQpJZC1ldmVudEBpZXRm Lm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92 Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVu dCZkPUR3TUZhUSZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAm cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJm09cDFWc2QxSGI3 Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZzPUFUWXpPWFhHdG81YWZpdDNPZ1Rq aDE5S2N6eEtDdmFCd0M3ZnRvZkhNcnMmZT0+DQotLQ0KU3Vic2NyaWJlIHRvIHRoZSBIQVJEVFdB UkU8aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2hh cmR0d2FyZS5jb21fJmQ9RHdNRmFRJmM9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBr S1kwNTdTYksxMCZyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm bT1wMVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JnM9TkdiQ0FmQkVs NVR0c2tXZGpqV09ZMmNRSkEzRnN5OVF2bnRQbnN0eUlrYyZlPT4gbWFpbCBsaXN0IHRvIGxlYXJu IGFib3V0IHByb2plY3RzIEkgYW0gd29ya2luZyBvbiENCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QNCklkLWV2ZW50 QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlz dGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1 WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xM SUdrJm09cDFWc2QxSGI3Qlg4N3NWNHg5TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZzPUFUWXpP WFhHdG81YWZpdDNPZ1RqaDE5S2N6eEtDdmFCd0M3ZnRvZkhNcnMmZT0NCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5nIGxpc3QN CklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBzOi8vdXJs ZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21h aWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZkPUR3SUNBZyZjPVJvUDFZdW1DWENnYVdIdmxaWVI4 UFFjeEJLQ1g1WVRwa0tZMDU3U2JLMTAmcj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3 bE5LZTRDX2xMSUdrJm09OExmQ1lveDB5M2doTjhZQVhMckFiNXpmVXQ1clZEOHZid0t3dnc4LVJq ayZzPWd2NC15TjhMRFZpcjgyV0VXeml4NjEtWXprcmZxdUVQS01rX1R0THlscncmZT0NCg0K --_000_CY4PR21MB05043FEE04230B7FB1D61165F5E40CY4PR21MB0504namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFt aWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6 IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTou MDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9 DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHls ZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmln aHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlm O30NCnNwYW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJl Zm9ybWF0dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGlu azoiSFRNTCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzO30NCnNwYW4uYXBw bGUtc3R5bGUtc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1zdHlsZS1zcGFuO30NCnNwYW4u YXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1z cGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4u RW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMwMDIwNjA7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjQN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIg c3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQi IGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+ DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNs YXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPlRoaXMgY2FuIGFsbCBiZSByZWFsbHkgc2ltcGxlLiZuYnNwOyBJZiBh biBldmVudCBpcyBkZWZpbmVkIHN1Y2ggdGhhdCBhbiDigJxpc3PigJ0gdmFsdWUgaXMgbmVlZGVk IGFzIHBhcnQgb2YgaWRlbnRpZnlpbmcgdGhlIHN1YmplY3Qgb2YgdGhlIFNFVCB0aGF0IGNhbiBi ZSBkaXN0aW5jdCBmcm9tDQogdGhlIGlzc3Vpbmcg4oCcaXNz4oCdLCB0aGVuIGl0IG5lZWRzIHRv IGJlIGluc2lkZSB0aGUgZXZlbnQgcGF5bG9hZC4gJm5ic3A7V2hlcmVhcywgaWYgYW4gZXZlbnQg aXMgZGVmaW5lZCBzdWNoIHRoYXQgaXRzIGlzc3VlciBpcyBhbHdheXMgYWxpZ25lZCB3aXRoIHRo ZSBzdWJqZWN0LCB0aGVuIHRoZXnigJlyZSBuZXZlciBhIG5lZWQgZm9yIGFuIGlubmVyIOKAnGlz c+KAnSwgaW4gd2hpY2ggY2FzZSBpdCBtdXN0IGJlIG9taXR0ZWQuJm5ic3A7IFRoZSBzcGVjIGFs cmVhZHkgZ2l2ZXMNCiBhcHByb3ByaWF0ZSBndWlkYW5jZSBhbG9uZyB0aGVzZSBsaW5lcy48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkluIGJvdGggY2FzZXMsIHRo ZXJl4oCZcyBuZXZlciBhbiBvcHRpb25hbCBpbm5lciDigJxpc3PigJ0gZm9yIGFuIGV2ZW50LiZu YnNwOyBFaXRoZXIgdGhlIGV2ZW50IGRlZmluaXRpb24gcmVxdWlyZXMgdGhlIGlubmVyIOKAnGlz c+KAnSBvciB0aGUgZXZlbnQgZGVmaW5pdGlvbiBwcmVjbHVkZXMgaXQuJm5ic3A7DQogVGhlcmXi gJlzIG5vIHNwZWNpYWwtY2FzZSBwYXJzaW5nIG9mIG9wdGlvbmFsIGlubmVyIOKAnGlzc+KAnSB2 YWx1ZXMgaW4gZWl0aGVyIGNhc2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6 My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gUGhpbCBIdW50IChJRE0pIFtt YWlsdG86cGhpbC5odW50QG9yYWNsZS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gVGh1cnNkYXks IE1heSAxOCwgMjAxNyAxOjIwIFBNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZsdDtNaWNo YWVsLkpvbmVzQG1pY3Jvc29mdC5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBEaWNrIEhhcmR0ICZs dDtkaWNrLmhhcmR0QGdtYWlsLmNvbSZndDs7IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0O2lk LWV2ZW50QGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBE ZWFsaW5nIHdpdGggaXNzdWVyIGNvbmZsaWN0PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1pa2U8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp diBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+VGhlIFJJU0MgZ3JvdXAgY2FzZSBpcyBhIHVzZWZ1bCBjYXNlIHRv IGRpc2N1c3MgaGVyZSBzaW5jZSB3ZSBuZWVkIHRvIHVuZGVyc3RhbmQgaG93IFNFVHMgd2lsbCBi ZSB1c2VkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxT aWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5BRkFJSywgdGhlIFJJU0MgV0cgaXMgYXNzdW1pbmcgdGhlIGlzc3VlIG9mIGlzcyBjb25mbGlj dCB3aWxsIGJlIHJlc29sdmVkIGluIFNFQ0VWRU5Ucy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1 cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TXkgdW5kZXJzdGFuZGluZyBpcyB0aGlzIGlzIG11 Y2ggbW9yZSB0aGFuIHJlZ2lzdGVyaW5nIGFuIGV2ZW50IGNsYWltIGJ1dCB0byBnZXQgdG8gaW50 ZXJvcGVyYWJsZSBldmVudCBmb3JtYXRzIHRoYXQgY2FuIGJlIHVzZWQgYnkgbWFueSBkb3duc3Ry ZWFtIFNET3MgYW5kIFdHcy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0i QXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+TWF5YmUgSSBhbSBtaXN0YWtlbj88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+UGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpP biBNYXkgMTgsIDIwMTcsIGF0IDEyOjQ2IFBNLCBNaWtlIEpvbmVzICZsdDs8YSBocmVmPSJtYWls dG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5j b208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkluIG1hbnkgdXNl IGNhc2VzLCBvbmx5IFNFVHMgZnJvbSBhIHNpbmdsZSBldmVudCBmYW1pbHkgd2lsbCBiZSBsZWdh bCBhbmQgYWxsIHdpbGwgdXNlIHRoZSBzYW1lIGNsYWltcyBjb252ZW50aW9ucy4mbmJzcDsgSW4g dGhhdCBjYXNlLCBhIG5vcm1hbCBKV1QgcGFyc2VyIHdpbGwgbGlrZWx5DQogYmUgdXNlZCBhbmQg dGhlIGFwcGxpY2F0aW9uIHdpbGwgcHJvY2VzcyB0aGUgYWRkaXRpb25hbCBldmVudC1zcGVjaWZp YyBjbGFpbXMuJm5ic3A7IFRoZXJl4oCZcyBubyBnZW5lcmFsLXB1cnBvc2UgU0VUIHBhcnNlciBp biB0aGUgbWl4Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+SSB0 aGluayB0aGF0IHRyeWluZyB0byBhcmNoaXRlY3QgdGhpcyBmb3IgYSB3b3JsZCBpbiB3aGljaCB0 aGVyZeKAmXMgYSBzaW5nbGUgU0VUIHBhcnNlciBmb3IgU0VUcyBvZiBhbGwga2luZHMgd291bGQg c2tldyB0aGUgYXJjaGl0ZWN0dXJlIGFuZCBoYXZlIHRoZSB1bmludGVuZGVkDQogc2lkZS1lZmZl Y3Qgb2YgZXhjbHVkaW5nIHNvbWUgdXNlIGNhc2VzIHRocm91Z2ggdW5uZWNlc3NhcnkgY29tcGxl eGl0eS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlRoZSBTRVQg c3BlYyBzaG91bGQgZGVmaW5lIHRoZSDigJxldmVudHPigJ0gY2xhaW0gYW5kIHN0b3AgdGhlcmUu Jm5ic3A7IFNFVCBpcyBhbHJlYWR5IHBvaXNlZCBmb3Igc3VjY2VzcyBhcyBpdCBpcyBub3cuJm5i c3A7IFdlIHNob3VsZG7igJl0IGFkZCByZXN0cmljdGlvbnMgdGhhdCB3aWxsIGplb3BhcmRpemUN CiB0aGF0IGFjaGlldmVtZW50LiZuYnNwOyBFdmVudHMgYW5kIGV2ZW50IGZhbWlsaWVzIHNob3Vs ZCBkbyB0aGUgcmVzdCwgaW4gd2F5cyBhcHByb3ByaWF0ZSB0byB0aGVpciB1c2UgY2FzZXMuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgLS0gTWlrZTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzAwMjA2MCI+UC5TLiZuYnNwOyBIb3cgdG8gcmVwcmVzZW50IFJJU0MgZXZlbnRzIHRo YXQgbWlnaHQgYmUgaXNzdWVkIGVpdGhlciBieSBhbiBJZGVudGl0eSBQcm92aWRlciBvciBSZWx5 aW5nIHBhcnR5IGlzIGFuIGVudGlyZWx5IGFwcHJvcHJpYXRlIGRpc2N1c3Npb24gdG8gaGF2ZSBp biB0aGUgUklTQw0KIHdvcmtpbmcgZ3JvdXAsIGJ1dCBub3QgaGVyZSBpbiB0aGUgSUQgRXZlbnRz IHdvcmtpbmcgZ3JvdXAuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiBQaGlsIEh1bnQgKElETSkgWzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+ bWFpbHRvOnBoaWwuaHVudEBvcmFjbGUuY29tPC9hPl0NCjxicj4NCjxiPlNlbnQ6PC9iPiBUaHVy c2RheSwgTWF5IDE4LCAyMDE3IDEyOjM0IFBNPGJyPg0KPGI+VG86PC9iPiBNaWtlIEpvbmVzICZs dDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVsLkpv bmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gRGljayBIYXJkdCAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tIj5kaWNrLmhhcmR0QGdtYWlsLmNv bTwvYT4mZ3Q7OyBJRCBFdmVudHMgTWFpbGluZyBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86aWQt ZXZlbnRAaWV0Zi5vcmciPmlkLWV2ZW50QGlldGYub3JnPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0 OjwvYj4gUmU6IFtJZC1ldmVudF0gRGVhbGluZyB3aXRoIGlzc3VlciBjb25mbGljdDwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGFua3MgTWlr ZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0 dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0 aGluayB3ZSBkaXNhZ3JlZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBpZD0iQXBwbGVN YWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VGhlIGNvbmNlcm4gSSBoYXZlIGlzIHRoYXQgbW9zdCBpbXBsZW1lbnRlcnMgd2lsbCBo YXZlIHRvIHdyaXRlIGNvZGUgdGhhdCBhbHdheXMgY2hlY2tzIGZvciB0aGUgYWJzZW5jZSBvZiBh IGR1cGxpY2F0ZSBpc3N1ZXIgY2xhaW0gYmVjYXVzZSBpdCBjaGFuZ2VzIHRoZSBtZWFuaW5nIG9m IHN1YmplY3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25h dHVyZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRo aXMgc3RyaWtlcyBtZSBhcyBjb21wbGV4aXR5IHRoYXQgbmVlZHMgdG8gYmUgZGVhbHQgd2l0aCBp biB0aGUgY29yZSBzcGVjLiBJdCBzdGVtcyBmcm9tIG91ciBTZWNUb2tlbidzIHVzZSBvZiBKV1Qg YW5kIGl0cyBwb3B1bGFyIHVzZSB0b2RheS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBp ZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IGlkPSJBcHBsZU1haWxTaWduYXR1cmUiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SWYgZXZlcnkgcHJvZmlsaW5nIHNwZWMgY2FuIGRvIHRoaXMgZGlmZmVy ZW50bHkgcmVxdWlyaW5nIGRpZmZlcmVudCBwYXJzZXJzIHdoYXRzIHRoZSBwb2ludCBvZiBzZWNl dmVudHM/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IkFwcGxlTWFpbFNpZ25hdHVy ZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBoaWw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KT24gTWF5IDE4LCAyMDE3LCBhdCAxMjowOCBQ TSwgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0 LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDAyMDYwIj5Nb3N0IG9mIHdoYXQgeW914oCZcmUgdGFsa2luZyBhYm91dCBz ZWVtcyB0byBtZSB0byBiZSBkZWNpc2lvbnMgdGhhdCBjYW4gYmUgbWFkZSBieSBwYXJ0aWN1bGFy IGV2ZW50IGRlZmluaXRpb25zIG9yIGV2ZW50IGZhbWlseSBkZWZpbml0aW9ucy4mbmJzcDsgSSBo YXZlIG5vIHByb2JsZW0NCiB3aXRoIHBhcnRpY3VsYXIgZXZlbnRzIG9yIGV2ZW50IGZhbWlsaWVz IGVtcGxveWluZyBzb21lIG9mIHRoZSBzdHJhdGVnaWVzIHRoYXQgeW914oCZcmUgZGVzY3JpYmlu Zy4mbmJzcDsgVGhlIFNFVCBzcGVjIGFscmVhZHkgZmFjaWxpdGF0ZXMgdGhhdC48L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkJ1dCBwZXIgcHJldmlvdXMgZGlzY3Vz c2lvbnMsIHdlIHNob3VsZG7igJl0IGJlIG1ha2luZyByZXN0cmljdGlvbnMgaW4gdGhlIFNFVCBz cGVjIHRoYXQgbGltaXQgaXRzIGFwcGxpY2FiaWxpdHkgYnkgbWFraW5nIHJlc3RyaWN0aW9ucyBv biBjbGFpbXMgdXNhZ2UgdGhhdCB3aWxsDQogb25seSB3b3JrIGZvciBzb21lIGV2ZW50IHVzZSBj YXNlcyBhbmQgd2lsbCBydWxlIG91dCBvdGhlcnMuJm5ic3A7IFdlIHNob3VsZCBob2xkIHRvIHRo ZSBicmlnaHQtbGluZSB0ZXN0IHRoYXQgZXZlbnQgZGVmaW5pdGlvbnMgZGVmaW5lIHdoYXQgY2xh aW1zIGFyZSBpbmNsdWRlZCBpbiBTRVRTIChvdGhlciB0aGFuIHRoZSDigJxldmVudHPigJ0gY2xh aW0gaXRzZWxmKSBhbmQgaG93IHRoZXnigJlyZSB1c2VkLiZuYnNwOyBJbnRydWRpbmcgb24gdGhh dCB3aWxsIHVubmVjZXNzYXJpbHkNCiBsaW1pdCB0aGUgYXBwbGljYWJpbGl0eSBvZiBTRVRzLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZiI+IFBoaWwgSHVudCBbPGEgaHJlZj0ibWFpbHRvOnBoaWwuaHVudEBvcmFj bGUuY29tIj5tYWlsdG86cGhpbC5odW50QG9yYWNsZS5jb208L2E+XQ0KPGJyPg0KPGI+U2VudDo8 L2I+IFRodXJzZGF5LCBNYXkgMTgsIDIwMTcgMTE6NDEgQU08YnI+DQo8Yj5Ubzo8L2I+IE1pa2Ug Sm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20iPk1p Y2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBEaWNrIEhh cmR0ICZsdDs8YSBocmVmPSJtYWlsdG86ZGljay5oYXJkdEBnbWFpbC5jb20iPmRpY2suaGFyZHRA Z21haWwuY29tPC9hPiZndDs7IElEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1h aWx0bzppZC1ldmVudEBpZXRmLm9yZyI+aWQtZXZlbnRAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxi PlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50XSBEZWFsaW5nIHdpdGggaXNzdWVyIGNvbmZsaWN0 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TWlrZSw8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPknigJltIG5vdCBzdXJl IHdl4oCZcmUgb24gdGhlIHNhbWUgcGFnZSBoZXJlLiBNeSBpbXByZXNzaW9uIGlzIHRoaXMgaXMg c3RpbGwgb24gdGhlIG91dHN0YW5kaW5nIGxpc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxldOKAmXMgbG9vayBhdCBzb21lIGV4YW1wbGUg Y2FzZXM6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkZvciBleGFtcGxlLCBpZiBhIHJlbHlpbmcgcGFydHkgKGUuZy4gcmV0YWlsIHN0b3JlKSB3 YW50cyB0byBub3RpZnkgYW4gSURQIHRoYXQgdGhlIHVzZXIgaGFzIGJlZW4gZGVsZXRlZOKApjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DdXJy ZW50bHkgaW4gdGhlIGRyYWZ0OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+V2hlbiBpc3N1ZWQgYnkgYW4gT3BlbklEIENvbm5lY3QgaXNzdWVyOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTMuNXB0Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJl Zj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19j b25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQ UWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6 ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1Fy X1BZUk8xSGcmYW1wO3M9a0o1TWZuNmkzOWxvckxnYmJrQzQwa0JDLUhma29tX25ISnc5RHZDVG91 OCZhbXA7ZT0iPmh0dHBzOi8vY29ubmVjdC5teWlkcC5jb208L2E+JnF1b3Q7LDwvc3Bhbj48bzpw PjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7 ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDwvc3Bhbj48bzpwPjwv bzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZx dW90O2F1ZCZxdW90OzogWyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBv aW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEm YW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1K Qm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxi b0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhNTGZOSV8zbHNy TmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlpZHAuY29tPC9h PiZxdW90O10sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0LDwvc3Bhbj48 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5i c3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90Oyw8L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtl dmVudHMmcXVvdDs6IHs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8dT48c3BhbiBzdHls ZT0iY29sb3I6IzAwNjlEOSI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQu Y29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjX2V2ZW50LTJEdHlw ZV9hY2NvdW50LTJEZGVsZXRlZCZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhC S1FyX1BZUk8xSGcmYW1wO3M9UUh4Snk3enFEemNSR2htY0doYXRBMmsxNWJZVUxQT0RiVzcxWnRj NEt4NCZhbXA7ZT0iPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2Fj Y291bnQtZGVsZXRlZDwvYT48L3NwYW4+PC91PiZxdW90Ozogezwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEzLjVwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0i YnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7 IH08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQiPn08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CVVQsIHdoZW4gaXNzdWVkIGJ5IGEgcGFydHkgb3RoZXIg dGhhbiB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdCI+ezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7PGEgaHJlZj0i aHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX19leGFt cGxlcmV0YWlsLnN0b3JlLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZ UjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBF aXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhC S1FyX1BZUk8xSGcmYW1wO3M9WVpheDBiWUl5OF9KM25jNDBFNWtBTWRzcVFwdWk2U2xqNFlaWXFJ N2JGTSZhbXA7ZT0iPmh0dHBzOi8vZXhhbXBsZXJldGFpbC5zdG9yZS5jb208L2E+JnF1b3Q7LDwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+Jm5ic3A7ICZxdW90O3N1YiZxdW90OzogJnF1b3Q7MjQ4Mjg5NzYxMDAxJnF1b3Q7LDwvc3Bh bj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogWyZxdW90OzxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5z ZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7 ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksx MCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDtt PVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhN TGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlp ZHAuY29tPC9hPiZxdW90O10sPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNDcxNTY2MTU0 LDwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdCI+Jm5ic3A7ICZxdW90O2p0aSZxdW90OzogJnF1b3Q7YldKcSZxdW90Oyw8L3NwYW4+PG86 cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNw OyAmcXVvdDtldmVudHMmcXVvdDs6IHs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8dT48 c3BhbiBzdHlsZT0iY29sb3I6IzAwNjlEOSI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnBy b29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjXyZh bXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SlZh RzVlZTZCWWYyN2VtRHl2c0c3NDlFajRYWDlkMkZjS3ZlUkoyMHd3OCZhbXA7ZT0iPmh0dHA6Ly9z Y2hlbWFzLm9wZW5pZC5uZXQvcmlzYy88L2E+ZXZlbnQtdHlwZS9hY2NvdW50LWRlbGV0ZWQ8L3Nw YW4+PC91PiZxdW90Ozogezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJl YWstYmVmb3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lzc+KAnTomcXVvdDs8YSBocmVmPSJodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fY29ubmVjdC5teWlk cC5jb20mYW1wO2Q9RHdNR2FRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRw a0tZMDU3U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19s TElHayZhbXA7bT1aUnhveTZMYm9DVVZPU2R2YUt1VWEycTBiWWxHdi14QktRcl9QWVJPMUhnJmFt cDtzPUpjTW1ITUxmTklfM2xzck5jZWI2Vk02ZEtNYlpCWDctVXJkX0U2Z3J3a2cmYW1wO2U9Ij5j b25uZWN0Lm15aWRwLmNvbTwvYT7igJ08L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5 bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZu YnNwOyZuYnNwOyZuYnNwOyB9PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgfTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0K PHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwv cHJlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB5b3UgYXJlIHdy aXRpbmcgY29kZSwgaWYgeW91IGFncmVlIHRoYXQgdGhlIE9QIGlzc3VlcyBhIGxvdCBvZiBldmVu dHMsIHlvdSBlbmQgdXAgaGF2aW5nIHRvIGNoZWNrIHRoYXQgdGhlcmXigJlzIG5vIGVtYmVkZGVk IOKAnGlzc+KAnSBwcmVzZW50IGJlZm9yZSB5b3UgY2FuIGFzc3VtZSB0aGUgaXNzdWVyIG9mIHRo ZSBzdWJqZWN0IGlzIHRoZSBzYW1lIGFzIHRoYXQgb2YgdGhlIFNFVCB0b2tlbi4gJm5ic3A7VGhp cyBzdHJpa2VzDQogbWUgYXMgdmVyeSBjb21wbGV4LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SZWdhcmRpbmcgeW91ciBhc3NlcnRpb246PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+QW55IOKAnHN1YuKAnSBhdCB0aGUgdG9w LWxldmVsIChpZiBhbnkpIHNob3VsZCBiZSBhc3NvY2lhdGVkIHdpdGggdGhlIOKAnGlzc+KAnSBh dCB0aGUgdG9wLWxldmVsLCB3aGljaCBpcyBhbHdheXMgdGhlIGV2ZW50IGlzc3Vlci48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk1heSBiZSB5b3UgYXJlIHRoaW5raW5nIHRoYXQgd2Ugc2hvdWxkIGJlIHNv bHZpbmcgdGhpcyBieSBhbHdheXMgaXNzdWluZyBlbWJlZGRlZCBpc3MgYW5kIHN1YiAoQWx0ZXJu YXRpdmUgMSk6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBocmVmPSJodHRwczov L3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0FfX2V4YW1wbGVyZXRh aWwuc3RvcmUuY29tJmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hC S0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3ds TktlNENfbExJR2smYW1wO209WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlS TzFIZyZhbXA7cz1ZWmF4MGJZSXk4X0ozbmM0MEU1a0FNZHNxUXB1aTZTbGo0WVpZcUk3YkZNJmFt cDtlPSI+aHR0cHM6Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNvbTwvYT4mcXVvdDssJm5ic3A7IDwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+Jm5ic3A7Jm5ic3A7JnF1b3Q7YXVkJnF1b3Q7OiBbJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91 cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAu Y29tJmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smYW1wO209WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZhbXA7 cz1KY01tSE1MZk5JXzNsc3JOY2ViNlZNNmRLTWJaQlg3LVVyZF9FNmdyd2tnJmFtcDtlPSI+Y29u bmVjdC5teWlkcC5jb208L2E+JnF1b3Q7XSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0 NzE1NjYxNTQsPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiAmcXVvdDtiV0pxJnF1b3Q7LDwv c3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+Jm5ic3A7ICZxdW90O2V2ZW50cyZxdW90Ozogezwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0K PHByZT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZx dW90Ozx1PjxzcGFuIHN0eWxlPSJjb2xvcjojMDA2OUQ5Ij48YSBocmVmPSJodHRwczovL3VybGRl ZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9fc2NoZW1hcy5vcGVuaWQubmV0 X3Jpc2NfZXZlbnQtMkR0eXBlX2FjY291bnQtMkRkZWxldGVkJmFtcDtkPUR3TUdhUSZhbXA7Yz1S b1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJy S3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209WlJ4b3k2TGJvQ1VWT1Nk dmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZhbXA7cz1RSHhKeTd6cUR6Y1JHaG1jR2hhdEEy azE1YllVTFBPRGJXNzFadGM0S3g0JmFtcDtlPSI+aHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9y aXNjL2V2ZW50LXR5cGUvYWNjb3VudC1kZWxldGVkPC9hPjwvc3Bhbj48L3U+JnF1b3Q7OiB7PC9z cGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJnF1b3Q7aXNz4oCdOuKAnTxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwLTNBX19jb25uZWN0Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEmYW1w O2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01 YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NV Vk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9SmNNbUhNTGZOSV8zbHNyTmNl YjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZhbXA7ZT0iPmNvbm5lY3QubXlpZHAuY29tPC9hPuKA nTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdl Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdCI+JnF1b3Q7c3ViJnF1 b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8 cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsgfTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7IH08L3NwYW4+PG86cD48L286cD48 L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08L3NwYW4+PG86cD48 L286cD48L3ByZT4NCjxkaXY+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtI ZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHByZSBzdHlsZT0iYnJlYWstYmVmb3JlOiBwYWdlIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEzLjVwdCI+T1IsIEFsdGVybmF0aXZlIDI6PC9zcGFuPjxvOnA+PC9v OnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij57PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7aXNzJnF1b3Q7OiAmcXVvdDs8YSBo cmVmPSJodHRwczovL3VybGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cHMtM0Ff X2V4YW1wbGVyZXRhaWwuc3RvcmUuY29tJmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FX SHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNl R0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYlls R3YteEJLUXJfUFlSTzFIZyZhbXA7cz1ZWmF4MGJZSXk4X0ozbmM0MEU1a0FNZHNxUXB1aTZTbGo0 WVpZcUk3YkZNJmFtcDtlPSI+aHR0cHM6Ly9leGFtcGxlcmV0YWlsLnN0b3JlLmNvbTwvYT4mcXVv dDssPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7c3ViJnF1b3Q7OiAmcXVvdDsyNDgyODk3NjEwMDEmcXVvdDss PC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij4mbmJzcDsgJnF1b3Q7YXVkJnF1b3Q7OiBbJnF1b3Q7PGEgaHJlZj0iaHR0cHM6Ly91cmxk ZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHAtM0FfX2Nvbm5lY3QubXlpZHAuY29t JmFtcDtkPUR3TUdhUSZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1 N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2sm YW1wO209WlJ4b3k2TGJvQ1VWT1NkdmFLdVVhMnEwYllsR3YteEJLUXJfUFlSTzFIZyZhbXA7cz1K Y01tSE1MZk5JXzNsc3JOY2ViNlZNNmRLTWJaQlg3LVVyZF9FNmdyd2tnJmFtcDtlPSI+Y29ubmVj dC5teWlkcC5jb208L2E+JnF1b3Q7XSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtpYXQmcXVvdDs6IDE0NzE1 NjYxNTQsPC9zcGFuPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij4mbmJzcDsgJnF1b3Q7anRpJnF1b3Q7OiDigJxiV0pxJnF1b3Q7PC9zcGFuPjxv OnA+PC9vOnA+PC9wcmU+DQo8cHJlIHN0eWxlPSJicmVhay1iZWZvcmU6IHBhZ2UiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij4mbmJzcDsg4oCcc3ViSXNz4oCdOuKAnTxhIGhyZWY9Imh0 dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwLTNBX19jb25uZWN0 Lm15aWRwLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktD WDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5L ZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8x SGcmYW1wO3M9SmNNbUhNTGZOSV8zbHNyTmNlYjZWTTZkS01iWkJYNy1VcmRfRTZncndrZyZhbXA7 ZT0iPmNvbm5lY3QubXlpZHAuY29tPC9hPuKAnSw8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxw cmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPiZuYnNwOyAmcXVvdDtldmVudHMmcXVv dDs6IHs8L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDs8dT48c3BhbiBzdHlsZT0iY29sb3I6 IzAwNjlEOSI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3Vy bD91PWh0dHAtM0FfX3NjaGVtYXMub3BlbmlkLm5ldF9yaXNjX2V2ZW50LTJEdHlwZV9hY2NvdW50 LTJEZGVsZXRlZCZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktD WDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5L ZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VVYTJxMGJZbEd2LXhCS1FyX1BZUk8x SGcmYW1wO3M9UUh4Snk3enFEemNSR2htY0doYXRBMmsxNWJZVUxQT0RiVzcxWnRjNEt4NCZhbXA7 ZT0iPmh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvcmlzYy9ldmVudC10eXBlL2FjY291bnQtZGVs ZXRlZDwvYT48L3NwYW4+PC91PiZxdW90Ozogezwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEzLjVwdCI+fTwvc3Bhbj48bzpwPjwvbzpwPjwvcHJlPg0KPHByZSBzdHlsZT0iYnJlYWstYmVm b3JlOiBwYWdlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+Jm5ic3A7IH08L3NwYW4+ PG86cD48L286cD48L3ByZT4NCjxwcmU+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPn08 L3NwYW4+PG86cD48L286cD48L3ByZT4NCjxwcmUgc3R5bGU9ImJyZWFrLWJlZm9yZTogcGFnZSI+ Jm5ic3A7PG86cD48L286cD48L3ByZT4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkkgY2FuIHNlZSBwcm9zIGFuZCBjb25zIGZvciBlaXRoZXIuIEkgbGlrZSBvcHRpb24gMSBi ZWNhdXNlIGl0IGFsc28gbWFrZXMgdGhlIFNFVCBkaWZmZXJlbnQgZnJvbSBJRCBUb2tlbnMgYW5k IEFjY2VzcyBUb2tlbnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9wdGlvbiAyIGlzIG5pY2UgYmVjYXVzZSBtb3N0IFNFVHMgd2XigJl2ZSBi ZWVuIHRhbGtpbmcgYWJvdXQganVzdCBoYXZlIGFuIGV2ZW50IHR5cGUgYW5kIGEgc3ViamVjdCBh bmQgbm8gY2xhaW1zLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5UaGUgYmVzdCB3YXkgdG8gZGVmaW5lIHRoaXMgaXMgdG8gZW5mb3JjZSB0aGF0 IHN1YiBtYXkgb25seSBiZSB1c2VkIGF0IHRoZSB0b3AgbGV2ZWwgaWYgaXQgaXMgZ2xvYmFsbHkg aWRlbnRpZmlhYmxlIChlLmcuIHN1Y2ggYXMgaW4gdGhlIGNhc2Ugb2YgU0NJTSBVUklzKS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPlBoaWw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2si PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+T3JhY2xlIENvcnBvcmF0aW9uLCBJ ZGVudGl0eSBDbG91ZCBTZXJ2aWNlcyBBcmNoaXRlY3QgJmFtcDsgU3RhbmRhcmRzPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj5AaW5kZXBlbmRlbnRpZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpi bGFjayI+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91 PWh0dHAtM0FfX3d3dy5pbmRlcGVuZGVudGlkLmNvbSZhbXA7ZD1Ed01HYVEmYW1wO2M9Um9QMVl1 bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NI MEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFtcDttPVpSeG95Nkxib0NVVk9TZHZhS3VV YTJxMGJZbEd2LXhCS1FyX1BZUk8xSGcmYW1wO3M9MXJ3OUEyaEItUlI4MnZZZ1JOemhMbU5jVWtw SjZ1eXE0UEZOREltYi03OCZhbXA7ZT0iPnd3dy5pbmRlcGVuZGVudGlkLmNvbTwvYT48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PGEgaHJlZj0ibWFpbHRvOnBo aWwuaHVudEBvcmFjbGUuY29tIj5waGlsLmh1bnRAb3JhY2xlLmNvbTwvYT48L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIE1heSAxOCwgMjAxNywgYXQgMTA6NDAgQU0sIE1p a2UgSm9uZXMgJmx0OzxhIGhyZWY9Im1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20i Pk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMw MDIwNjAiPkkgYmVsaWV2ZSB0aGF0IHRoZSBzb2x1dGlvbiBhbHJlYWR5IGRpc2N1c3NlZCBpcyB0 aGUgYmVzdCBvbmUuJm5ic3A7IElmIHRoZSBldmVudCBpc3N1ZXIgaXMgZGlmZmVyZW50IHRoYW4g YSBsb2dpY2FsIGlzc3VlciBhc3NvY2lhdGVkIHdpdGggdGhlIGV2ZW50IHN1YmplY3QsIHRoZW4N CiBwdXQgdGhlIGxvZ2ljYWwg4oCcaXNz4oCdIGFuZCDigJxzdWLigJ0gdmFsdWVzIGluc2lkZSB0 aGUgZXZlbnQuJm5ic3A7IEFueSDigJxzdWLigJ0gYXQgdGhlIHRvcC1sZXZlbCAoaWYgYW55KSBz aG91bGQgYmUgYXNzb2NpYXRlZCB3aXRoIHRoZSDigJxpc3PigJ0gYXQgdGhlIHRvcC1sZXZlbCwg d2hpY2ggaXMgYWx3YXlzIHRoZSBldmVudCBpc3N1ZXIuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5BbnkgcHJv cG9zYWwgdGhhdCByZXF1aXJlcyBkdXBsaWNhdGluZyBpbmZvcm1hdGlvbiwgc3VjaCBhcyByZXF1 aXJpbmcg4oCcc3ViSXNz4oCdIGV2ZW4gd2hlbiBpdOKAmXMgYWx3YXlzIGlkZW50aWNhbCB0byDi gJxpc3PigJ0sIGlzIG5vdCBhIGdyZWF0IGFyY2hpdGVjdHVyYWwgY2hvaWNlLA0KIHNpbmNlIGl0 IGNyZWF0ZXMgdW5uZWNlc3NhcnkgZXJyb3IgY29uZGl0aW9ucyB0aGF0IHdvdWxkIG5vdCBvdGhl cndpc2UgYmUgcG9zc2libGUuJm5ic3A7IChIb3cgc2hvdWxkIGltcGxlbWVudGF0aW9ucyBoYW5k bGUgdGhlIGNhc2Ugd2hlcmUgdHdvIHZhbHVlcyBhcmUgcmVxdWlyZWQgdG8gbWF0Y2ggYnV0IGRv buKAmXQ/KTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8 L3NwYW4+PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPklkLWV2ZW50DQogWzxh IGhyZWY9Im1haWx0bzppZC1ldmVudC1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5tYWlsdG86aWQtZXZlbnQtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+XTxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48Yj5PbiBCZWhh bGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PC9i PlBoaWwgSHVudCAoSURNKTxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5UaHVyc2RheSwgTWF5IDE4LCAyMDE3IDc6MzEgQU08 YnI+DQo8Yj5Ubzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPkRpY2sgSGFyZHQgJmx0OzxhIGhyZWY9Im1haWx0bzpkaWNrLmhhcmR0QGdtYWlsLmNv bSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ZGljay5oYXJkdEBnbWFpbC5jb208L3NwYW4+ PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFj ZSI+Jm5ic3A7PC9zcGFuPklEIEV2ZW50cyBNYWlsaW5nIExpc3QgJmx0OzxhIGhyZWY9Im1haWx0 bzppZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+aWQtZXZlbnRA aWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj48c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UmU6IFtJZC1ldmVudF0gRGVhbGlu ZyB3aXRoIGlzc3VlciBjb25mbGljdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4/PzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IYXBwZW5zIGluIGFueSBjYXNlIHdoZXJlIHN1YiBpcyBu b3QgZ2xvYmFsbHkgaWRlbnRpZmlhYmxlLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5JbiBDb25uZWN0LCBzaW5jZSBzdWIgaXMgbm90IHVuaXF1ZWx5IGlkZW50aWZpZWQsIHRoZSBp c3MgZm9yIHRoZSBzdWIgbXVzdCBiZSBpbmNsdWRlZC4gVGhpcyBjcmVhdGVzIGEgY29uZmxpY3Qg aWYgdGhlIGlzc3VlciBvZiB0aGUgU0VUIGlzIG5vdCB0aGUgaXNzdWVyIG9mIHRoZSBzdWJqZWN0 LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SZXNvbHZpbmcgdGhlIGlzcyBjb25m bGljdCBoYXMgYmVlbiBvbiB0aGUgbGlzdCBvZiBpc3N1ZXMgc2luY2UgY2hpY2Fnby4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gUklTQyB3ZSB3ZXJlIGRpc2N1c3NpbmcgYWNj b3VudCBjbG9zZSBldmVudHMuIEkgYW0gYXNzdW1lIG9uZSBvZiB0aGUgc2NlbmFyaW9zIGlzIFJQ cyB3aWxsIG5vdGlmeSBJRFBzIHdoZW4gdGhleSBjbG9zZSBhbiBhY2NvdW50LiBUaGV5IG11c3Qg dXNlIGFuIGlzcyBub3QgYXNzb2NpYXRlZCB3aXRoIHN1Yi4gQXMgdGhpbmdzIHN0YW5kIG5vdywg dGhleSB3aWxsIGhhdmUgdG8gYXNzZXJ0IHRoZSBleHRyYQ0KIGlzcyB2YWx1ZSBpbiB0aGVpciBw YXlsb2FkLS0td2hpY2ggZm9yIG1vc3QgZXZlbnRzIGlzIGNvbXBsZXggdG8gcGFyc2Ugc2luY2Ug dGhlaXIgYXJlIG5vIG90aGVyIGV4dHJhIGNsYWltcy4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+UGhpbDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCk9uIE1h eSAxOCwgMjAxNywgYXQgNjozNiBBTSwgRGljayBIYXJkdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRp Y2suaGFyZHRAZ21haWwuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5kaWNrLmhhcmR0 QGdtYWlsLmNvbTwvc3Bhbj48L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5QaGlsLCB3b3VsZCB5 b3UgY2xhcmlmeSB0aGUgdXNlIGNhc2UgYW5kIHRoZSByZXF1aXJlbWVudCB0byBlbnN1cmUgZXZl cnlvbmUgb24gdGhlIGxpc3QgaXMgYWxpZ25lZD8gVGhhbmtzPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T24gV2VkLCBNYXkgMTcsIDIwMTcgYXQgOTo0NSBQTSBQaGlsIEh1bnQgKElETSkgJmx0 OzxhIGhyZWY9Im1haWx0bzpwaGlsLmh1bnRAb3JhY2xlLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+cGhpbC5odW50QG9yYWNsZS5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gbWFueSBj YXNlcyB3aGVyZSB3ZSBhcmUgdGFsa2luZyBhYm91dCBldmVudHMgKGVnIHJpc2MpIHRoZXJlIGlz IG5vIG5lZWQgZm9yIGV4dHJhIGNsYWltcyBvdGhlciB0aGFuIHRoZSBldmVudCB0eXBlIGl0c2Vs Zi48YnI+DQo8YnI+DQpJdCBvY2N1cnMgdG8gbWUgdGhhdCBpbiB0aGUgY2FzZSBvZiBSUCBpc3N1 ZWQgZXZlbnRzIHRoZSBjdXJyZW50IHNlY3Rva2VuIGZvcm1hdCByZXF1aXJlcyBhbiBlbWJlZGRl ZCBpc3MgdG8gZGVhbCB3aXRoIHRoZSBjb25mbGljdCB3aXRoIHRoZSBzZXQgaXNzdWVyLiBJdCBz ZWVtcyB0byBhZGQgYSBsb3Qgb2YgY29tcGxpY2F0aW9uIGZvciBtb3N0IGV2ZW50cy48YnI+DQo8 YnI+DQpXaGF0IGlmIHdlIGRlZmluZWQgYSBuZXcgc2VjdG9rZW4gdG9wIGxldmVsIGF0dHJpYnV0 ZSAnc3ViSXNzJyB0byBtZWFuICZxdW90O3N1YmplY3QgaXNzdWVyJnF1b3Q7IGFuZCBrZWVwIGlz cyByZXNlcnZlZCBmb3IgdGhlIFNFVCBpc3N1ZXIuPGJyPg0KPGJyPg0KSSB3b3VsZCBzdWdnZXN0 IHRoaXMgYXMgYSByZWNvbW1lbmRlZCBhdHRyaWJ1dGUgZXZlbiB3aGVuIGlzcyBhbmQgc3ViSXNz IGFyZSB0aGUgc2FtZSBmb3IgcGFyc2luZyBjb25zaXN0ZW5jeS48YnI+DQo8YnI+DQpUaG91Z2h0 cz88YnI+DQo8YnI+DQpQaGlsPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188YnI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJt YWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5JZC1ldmVudEBpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0KPGEgaHJlZj0iaHR0 cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0 Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2ZW50JmFtcDtkPUR3TUZhUSZhbXA7Yz1Sb1Ax WXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtLWTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3Vn Q0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJR2smYW1wO209cDFWc2QxSGI3Qlg4N3NWNHg5 TWh0c0diT1JjdWlhY0h4dWp3VGhTbldoNCZhbXA7cz1BVFl6T1hYR3RvNWFmaXQzT2dUamgxOUtj enhLQ3ZhQndDN2Z0b2ZITXJzJmFtcDtlPSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJj b2xvcjpwdXJwbGUiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZl bnQ8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLTxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U3Vic2NyaWJlIHRvIHRoZTxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJodHRwczovL3Vy bGRlZmVuc2UucHJvb2Zwb2ludC5jb20vdjIvdXJsP3U9aHR0cC0zQV9faGFyZHR3YXJlLmNvbV8m YW1wO2Q9RHdNRmFRJmFtcDtjPVJvUDFZdW1DWENnYVdIdmxaWVI4UFFjeEJLQ1g1WVRwa0tZMDU3 U2JLMTAmYW1wO3I9SkJtNWJpUnJLdWdDSDBGa0lUU2VHSnhQRWl2empXd2xOS2U0Q19sTElHayZh bXA7bT1wMVZzZDFIYjdCWDg3c1Y0eDlNaHRzR2JPUmN1aWFjSHh1andUaFNuV2g0JmFtcDtzPU5H YkNBZkJFbDVUdHNrV2RqaldPWTJjUUpBM0ZzeTlRdm50UG5zdHlJa2MmYW1wO2U9IiB0YXJnZXQ9 Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+SEFSRFRXQVJFPC9zcGFuPjwvYT48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+bWFpbA0KIGxp c3QgdG8gbGVhcm4gYWJvdXQgcHJvamVjdHMgSSBhbSB3b3JraW5nIG9uITxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4N CklkLWV2ZW50IG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRm Lm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+SWQtZXZlbnRAaWV0Zi5vcmc8L3NwYW4+ PC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZh bXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPXAxVnNkMUhiN0JYODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9QVRZ ek9YWEd0bzVhZml0M09nVGpoMTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZhbXA7ZT0iPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50LmNvbS92Mi91 cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQtMkRldmVudCZh bXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZVHBrS1kwNTdT YksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRDX2xMSUdrJmFt cDttPXAxVnNkMUhiN0JYODdzVjR4OU1odHNHYk9SY3VpYWNIeHVqd1RoU25XaDQmYW1wO3M9QVRZ ek9YWEd0bzVhZml0M09nVGpoMTlLY3p4S0N2YUJ3QzdmdG9mSE1ycyZhbXA7ZT08L3NwYW4+PC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fPGJyPg0KSWQtZXZlbnQgbWFpbGluZyBsaXN0PGJyPg0KPC9z cGFuPjxhIGhyZWY9Im1haWx0bzpJZC1ldmVudEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjpwdXJwbGUiPklkLWV2ZW50QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlm Ij48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly91cmxkZWZlbnNlLnByb29mcG9pbnQuY29t L3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1hbl9saXN0aW5mb19pZC0yRGV2 ZW50JmFtcDtkPUR3SUNBZyZhbXA7Yz1Sb1AxWXVtQ1hDZ2FXSHZsWllSOFBRY3hCS0NYNVlUcGtL WTA1N1NiSzEwJmFtcDtyPUpCbTViaVJyS3VnQ0gwRmtJVFNlR0p4UEVpdnpqV3dsTktlNENfbExJ R2smYW1wO209OExmQ1lveDB5M2doTjhZQVhMckFiNXpmVXQ1clZEOHZid0t3dnc4LVJqayZhbXA7 cz1ndjQteU44TERWaXI4MldFV3ppeDYxLVl6a3JmcXVFUEtNa19UdEx5bHJ3JmFtcDtlPSI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjpwdXJwbGUiPmh0dHBzOi8vdXJsZGVmZW5zZS5wcm9vZnBvaW50 LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fbGlzdGluZm9faWQt MkRldmVudCZhbXA7ZD1Ed0lDQWcmYW1wO2M9Um9QMVl1bUNYQ2dhV0h2bFpZUjhQUWN4QktDWDVZ VHBrS1kwNTdTYksxMCZhbXA7cj1KQm01YmlSckt1Z0NIMEZrSVRTZUdKeFBFaXZ6ald3bE5LZTRD X2xMSUdrJmFtcDttPThMZkNZb3gweTNnaE44WUFYTHJBYjV6ZlV0NXJWRDh2YndLd3Z3OC1Samsm YW1wO3M9Z3Y0LXlOOExEVmlyODJXRVd6aXg2MS1ZemtyZnF1RVBLTWtfVHRMeWxydyZhbXA7ZT08 L3NwYW4+PC9hPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMt c2VyaWYiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_CY4PR21MB05043FEE04230B7FB1D61165F5E40CY4PR21MB0504namp_-- From nobody Thu May 18 17:54:54 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BF4812EC00 for ; Thu, 18 May 2017 17:54:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.7 X-Spam-Level: X-Spam-Status: No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OSbC-a1C3Zlm for ; Thu, 18 May 2017 17:54:50 -0700 (PDT) Received: from mail-pf0-x22f.google.com (mail-pf0-x22f.google.com [IPv6:2607:f8b0:400e:c00::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3ACD112EC17 for ; Thu, 18 May 2017 17:49:33 -0700 (PDT) Received: by mail-pf0-x22f.google.com with SMTP id 9so31580676pfj.1 for ; Thu, 18 May 2017 17:49:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=lHtXQ8nXwUVqEMwmXRtaR3d71idu/gaKc7JLa866wjo=; b=OkQ/tX3zFk0Sxg3QvHNnVCundcMS/0pJqNpjzIkh9iZvIy3JawF7JgVqVKTS2fYkww HDjZGH2fNehdxoLk0W1aeanN0Y3cW9c0SZw6hivqhknFB7qFjpzp9cJUCedwJxvaZvMB LdvTmD+vsd7VQhKIOk32P2wpYlLm18BdwFE5M8Cl4txlzxM0t0Cf5J1nTgwECg5WZwwb EvbZVOz5Gp2enIu4+i41emWEDLb5vWYJaxsLU9u++V7qi8MJDxJ7QzHNfjExSK0hLMGD Sg1Rv7ZSHnDF8ni3soKPeWO1HLJAMIKWpyMu61wkdVhzfAfCpgbYfM4eutgtzjWC9qKO i0ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=lHtXQ8nXwUVqEMwmXRtaR3d71idu/gaKc7JLa866wjo=; b=F0popbwJ+tPLvinrCOklAcTAQBX7k9u1p7zApm75NNqb/Xo5jj+/5DM1moP+Nhq3wG fG0O5LR+Sy7TBLOSU90k48J6O39sWWc2wnkc3m+20Kny5FtG5rWzoPH6YhI53N9XgJ+9 ah17pnEI9p6gJn27Vy1ZIAqfQEtyIS3gEM6xSs0PdTLlE3db+QV0xU2R99IXB6CXaoCU dfKKF64OUTU0zguHBn1Cn6A+T3hFx38vmQyoMUHvF3FsfzwaHrobpd1E3H9uoZVBexzu EJdAbKaruFxiA1A1Zve67c41A+xBvCcm3vd97cbu9kinkw66jjb0750N0xRT/fsR6tzJ iDAQ== X-Gm-Message-State: AODbwcB6J9Gl1fKjMMyP+a3P+9xXz8m9kRV/+h1gXeiBmgYNq6YWfWJS Sqqxx+i+DwPo1IgzdBQ= X-Received: by 10.99.122.85 with SMTP id j21mr7536889pgn.129.1495154972729; Thu, 18 May 2017 17:49:32 -0700 (PDT) Received: from [172.28.20.94] ([65.204.229.97]) by smtp.gmail.com with ESMTPSA id x6sm11420972pfk.22.2017.05.18.17.49.32 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 May 2017 17:49:32 -0700 (PDT) To: SecEvent From: Yaron Sheffer Message-ID: Date: Thu, 18 May 2017 17:49:31 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Id-event] New rev of event tokens draft? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 00:54:51 -0000 Dear draft editors, We discussed the draft in Chicago, but there hasn't been a new revision since. Are you guys planning to issue a new rev before Prague? Are there any specific issues that you need WG discussion to resolve? Thanks, Yaron From nobody Thu May 18 18:15:38 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45DEA129412 for ; Thu, 18 May 2017 18:15:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.222 X-Spam-Level: X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tr-cwZ3NMzI3 for ; Thu, 18 May 2017 18:15:34 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 782CB127076 for ; Thu, 18 May 2017 18:10:04 -0700 (PDT) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v4J1A26o020714 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 19 May 2017 01:10:02 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v4J1A2Fe012307 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 19 May 2017 01:10:02 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v4J1A2YK007938; Fri, 19 May 2017 01:10:02 GMT Received: from [192.168.1.24] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 18 May 2017 18:10:01 -0700 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14E304) In-Reply-To: Date: Thu, 18 May 2017 18:10:00 -0700 Cc: SecEvent Content-Transfer-Encoding: quoted-printable Message-Id: <5B82D01E-B7E9-4FDE-83BA-2CD9299C1268@oracle.com> References: To: Yaron Sheffer X-Source-IP: aserv0022.oracle.com [141.146.126.234] Archived-At: Subject: Re: [Id-event] New rev of event tokens draft? X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 01:15:37 -0000 I believe Mike is handling a number of issues on the tokens draft from Chica= go. I will re-confirm in case he is short on time.=20 I hope to publish a secevents-delivery draft next week which covers: - data plane using http post(push) and get(polling) methods - verify event - http and tls requirements and security considerations.=20 Marius is doing a separate control plane draft based on restful model that c= an be compared as an alternative to the control plane in the current distrib= ution draft.=20 That should provide a lot to talk about for IETF99. :) Phil > On May 18, 2017, at 5:49 PM, Yaron Sheffer wrote: >=20 > Dear draft editors, >=20 > We discussed the draft in Chicago, but there hasn't been a new revision si= nce. Are you guys planning to issue a new rev before Prague? Are there any s= pecific issues that you need WG discussion to resolve? >=20 > Thanks, >=20 > Yaron >=20 > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3Du_6sDtetuViJekDjF-d= sKWHSXsUJgt8NcmKWx-VUP0A&s=3D5m7ByjKLLHvD2GLqmj19sqgHY_H0s62E60VTRWtpr9E&e=3D= =20 From nobody Thu May 18 18:16:35 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 757C312EC2A for ; Thu, 18 May 2017 18:16:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WdwAaNn34B9m for ; Thu, 18 May 2017 18:16:30 -0700 (PDT) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0101.outbound.protection.outlook.com [104.47.34.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B90C8127B31 for ; Thu, 18 May 2017 18:10:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pUcuFPek3xiDhb9kpdhp/rTzvGeGmu739SgpfvPfhjQ=; b=T2ZgPkV9YvVLnoyWXKb690trLcr8bamWFiisOnr9WnOkusTcxFwpgC8CxYIvCoZpBanmkIgsqiBqhxDpAn2X6OlFVDnCEElxOZzplObdcZCSATrJuItUVYqpSYpjHEFmfOjomsBo4aaYef7i/hm6wSy+cH3w44GbYW0jEzJnoEw= Received: from CY4PR21MB0504.namprd21.prod.outlook.com (10.172.122.14) by CY4PR21MB0503.namprd21.prod.outlook.com (10.172.122.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1124.0; Fri, 19 May 2017 01:10:58 +0000 Received: from CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) by CY4PR21MB0504.namprd21.prod.outlook.com ([10.172.122.14]) with mapi id 15.01.1124.007; Fri, 19 May 2017 01:10:58 +0000 From: Mike Jones To: Yaron Sheffer , ID Events Mailing List Thread-Topic: [Id-event] SecEvent - draft minutes Thread-Index: AQHSrK8kxq2W1fRQNkWzwvVoODSKAaH7Htqw Date: Fri, 19 May 2017 01:10:57 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Ref=https://api.informationprotection.azure.com/api/72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetBy=mbj@microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2017-05-18T18:10:55.3291602-07:00; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic; Sensitivity=General authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:3::32c] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; CY4PR21MB0503; 7:KzHYR1NONuqh5OtBVIaC5AmyH6pXd+lKaqus4Lu/s6b6Gcw3pmv4FyxRqFzRBUw/xTl1VWHi446ERj0XDNmKIR2QULDeT45CHTLTl04KQ/qRvDVe/KoVYm/Xz3BxTdpLqcecl9ywLYUYf8CK/0PY+7Ph0EKqpMJNK7xZ5Su9eB7McVii/2ZCOcHaid3XA3yILocbWsegHht8ETQSMPHzvBs9ohSFYxj3KFfR621m0a9lJ3+W8DibaMaQ7Cxjx0fJbXsuKjTXOiMlRUydZ4ceyiAwVQqFqB6r/VpUmjM3R+/LEVLSX022gZ8U4LQBQMPuLnDme/3IEPnKm7JjDDwIQMc+4Z0mfHsX5ny2/4i1Sg4= x-ms-traffictypediagnostic: CY4PR21MB0503: x-ms-office365-filtering-correlation-id: d73c2cf2-5959-491e-2360-08d49e53e829 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:CY4PR21MB0503; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(192374486261705); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700036)(100105000095)(100000701036)(100105300095)(100000702036)(100105100095)(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(100000703036)(100105400095)(93006095)(93001095)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123560025)(20161123555025)(20161123562025)(20161123564025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704036)(100105200095)(100000705036)(100105500095); SRVR:CY4PR21MB0503; BCL:0; PCL:0; RULEID:(100000800036)(100110000095)(100000801036)(100110300095)(100000802036)(100110100095)(100000803036)(100110400095)(100000804036)(100110200095)(100000805036)(100110500095); SRVR:CY4PR21MB0503; x-forefront-prvs: 031257FE13 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39860400002)(39450400003)(39840400002)(39410400002)(39400400002)(39850400002)(13464003)(377454003)(33656002)(6246003)(39060400002)(86612001)(53936002)(9686003)(97736004)(54356999)(99286003)(6306002)(2900100001)(189998001)(55016002)(38730400002)(50986999)(76176999)(7736002)(72206003)(305945005)(53546009)(74316002)(2906002)(2950100002)(6436002)(25786009)(10290500003)(81166006)(7696004)(10090500001)(8990500004)(8936002)(5005710100001)(3280700002)(3660700001)(5660300001)(102836003)(8676002)(6506006)(966005)(122556002)(229853002)(77096006)(6116002)(86362001)(478600001); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR21MB0503; H:CY4PR21MB0504.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 19 May 2017 01:10:57.6243 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0503 Archived-At: Subject: Re: [Id-event] SecEvent - draft minutes X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 May 2017 01:16:33 -0000 I had agreed to write some additional text for the security considerations = about ways of preventing confusion between SETs and other JWTs. That's on = my queue. Per the minutes, https://www.ietf.org/proceedings/98/minutes/minutes-98-sec= event-00.html, we were going to have a terminology discussion of claims/fac= ts/statements on the list. I think this still needs to occur and be incorp= orated into the draft. Consider this paragraph the kick-off of that discus= sion... What do working group members want to say about these terminology = choices? After WG review of those things, I think we'll be ready for WGLC. The SET = draft is simple, targeted, useful, and already does its job admirably, at l= east as I see it. -- Mike -----Original Message----- From: Id-event [mailto:id-event-bounces@ietf.org] On Behalf Of Yaron Sheffe= r Sent: Monday, April 3, 2017 12:18 PM To: ID Events Mailing List Subject: [Id-event] SecEvent - draft minutes Hi, The draft minutes are available here:=20 https://www.ietf.org/proceedings/98/minutes/minutes-98-secevent-00.html Thanks Yoav for taking minutes, Rich for scribing Jabber, and of course our= presenters! Please let us know if anything needs to be corrected. Yaron _______________________________________________ Id-event mailing list Id-event@ietf.org https://www.ietf.org/mailman/listinfo/id-event From nobody Wed May 31 17:23:09 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35C34129479 for ; Wed, 31 May 2017 17:23:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.44 X-Spam-Level: X-Spam-Status: No, score=-0.44 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTML_OBFUSCATE_05_10=0.26, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4MbkWcW5Z_M6 for ; Wed, 31 May 2017 17:23:03 -0700 (PDT) Received: from mail-it0-x235.google.com (mail-it0-x235.google.com [IPv6:2607:f8b0:4001:c0b::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DEDD1293F9 for ; Wed, 31 May 2017 17:23:03 -0700 (PDT) Received: by mail-it0-x235.google.com with SMTP id f72so23279182ite.0 for ; Wed, 31 May 2017 17:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PHzxHVWtUbZ46uJi71hpkdBFmCynzj4Dl2RVY7yGI8Q=; b=E/hXxM/7Tt3QEFIShGUlpJxlRRDkP6MipoS6NiVJgupcOYygaEeqf6UWwk5nCNEtA2 xIz+xPz59VvSTqod5HKVjVS5w0z5BdlsTXtzHeSz7OksTzZt24QTmdsE1/5oeC+rsKMe SiUYajloTcTJ7Cqdb0GpGzUeT8kDfmqSBHwR5LGevz3O59airqsNRRLGDqmd/tNN/7bh xbw7g2tdo9a34WW3V6fdSn6d/L5LZxRiRkHPvCXgb2CUznejHCdeyqd/qjOo9HPZN7BS VpYIsTr6dYDX1z0nVNMsRgS1zweCinPPwepPUkLwBcA4zDEwMncy382JTZ4gTaPzEKeV yqYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PHzxHVWtUbZ46uJi71hpkdBFmCynzj4Dl2RVY7yGI8Q=; b=K3QgI4bOBgyKXZDYdBadrGqR60d6ohsqL4WZPxFr6oNUWuWp3HOZ8/YL6y3HPLcaKU tasQm8S+uLbKxmdphTBbGW3WmaYo5nx2iOc3w80rSEf5ZqZbjHDfBiIIwdGzMv2Ij1kP fnUrVOKV7l3KoLP/2alt9Ywz8py+wDZ83T/4L+vc+rloz+cCZ72J1qdMgrIpuNr4h7N2 cvo9mBRfkrnOzKp9+IkYS5H7/iyAQvH0H2KcuZ3xd2VdQCrfHPfhbqMrCgy1r3YLReWn vzEPcVpxngvi6OmSTWgqHjr7qRqQP45Dc+hC/EYEZl54Y5FClV01jHCXh8+kUgNdhAKa E75Q== X-Gm-Message-State: AODbwcBQoOkvFu6gJWIc5NIT3ygVD0zDFbfrTrS0MlTU4aDWZdhZjAo0 4l5zYdVHunzKxFNz3NcTt7C3bMumZvpw X-Received: by 10.36.172.84 with SMTP id m20mr9921232iti.119.1496276582105; Wed, 31 May 2017 17:23:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.128.135 with HTTP; Wed, 31 May 2017 17:22:41 -0700 (PDT) In-Reply-To: <10de4c6f-c0a7-9d9f-c524-fa87048dd580@gmail.com> References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> <10de4c6f-c0a7-9d9f-c524-fa87048dd580@gmail.com> From: Marius Scurtescu Date: Wed, 31 May 2017 17:22:41 -0700 Message-ID: To: Yaron Sheffer Cc: Justin Richer , Dick Hardt , Phil Hunt , SecEvent Content-Type: multipart/mixed; boundary="94eb2c1fcbbc2a6b090550db0a5e" Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Jun 2017 00:23:07 -0000 --94eb2c1fcbbc2a6b090550db0a5e Content-Type: multipart/alternative; boundary="94eb2c1fcbbc2a6b040550db0a5c" --94eb2c1fcbbc2a6b040550db0a5c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Here is an initial use case document, for now it has only the RISC use cases we discussed so far. When Phil gets back I will coordinate with him to add SCIM use cases to this same I-D. I will get this into a decent shape for the IETF meeting. Marius On Thu, May 4, 2017 at 11:28 AM, Yaron Sheffer wrote: > Whatever works for you - and that's the whole point of *individual* I-Ds. > > Thanks, > > Yaron > > On 04/05/17 18:25, Marius Scurtescu wrote: > > Do we need one document for all use cases (all profiles) or one for each > profiles? > > I am happy to create the one document or the one for RISC (if one per > profile). > > Marius > > On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer > wrote: > >> My strong preference would be an individual I-D that (as Justin says) >> will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF >> folks are used to, and it is referenced from the WG agenda and minutes. >> >> Thanks, >> >> Yaron >> >> On 04/05/17 07:57, Justin Richer wrote: >> >> In fact, I=E2=80=99m going to ask that we *not* push a use cases documen= t toward >> RFC. Use case documents are wonderful tools for guiding development, but >> should be discarded as artifacts of that process once said process is >> completed (or even well on its way). >> >> As such, RFC, wiki, blog post, or anything referenced from the list and >> easily findable works. >> >> =E2=80=94 Justin >> >> On May 3, 2017, at 4:45 PM, Dick Hardt wrote: >> >> As the more experienced chair, I will defer to Yaron for guidance. >> >> So far no one has expected it to be adopted as an RFC >> >> On Wed, May 3, 2017 at 4:39 PM, Phil Hunt wrote: >> >>> Depends on what the WG wants. >>> >>> Email cases, >>> Github posted document, >>> Individual IDs posted to the working group, or >>> an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has >>> RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft >>> https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03). >>> >>> Let us know what form and what format. >>> >>> We can also use one for OpenID Backchannel Logout. This is particularl= y >>> important because it will be triggered by (or is related to) SCIM and b= y >>> RISC events such as account resets, authentication factor changes etc. >>> >>> Phil >>> >>> Oracle Corporation, Identity Cloud Services Architect & Standards >>> @independentid >>> www.independentid.com >>> phil.hunt@oracle.com >>> >>> On May 3, 2017, at 4:31 PM, Dick Hardt wrote: >>> >>> Hi Phil >>> >>> per >>> >>> https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKe >>> q2OjEBjCZ9cBcI >>> >>> >>> you offered to put them in a WG doc (see quate below). Would that not b= e >>> an ID. Also, as I read over the document, it is hard to follow what the= use >>> cases are as it is very verbose. >>> >>> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: >>> >>> > All, >>> > >>> > Dick asked me if I would enumerate the SCIM use cases. Here is the S= CIM >>> > case. Happy to put these somewhere in a working group document. >>> >>> >>> On Wed, May 3, 2017 at 4:16 PM, Phil Hunt wrote: >>> >>>> My understanding was you wanted informal cases not IDs. The SCIM cases >>>> have been posted to the mailing list. I believe Marius is close on the= RISC >>>> cases. >>>> >>>> Phil >>>> >>>> Oracle Corporation, Identity Cloud Services Architect & Standards >>>> @independentid >>>> www.independentid.com >>>> >>>> phil.hunt@oracle.com >>>> >>>> On May 3, 2017, at 3:56 PM, Dick Hardt wrote: >>>> >>>> Phil / Marius >>>> >>>> At the Chicago meeting, the two of you agreed to work on a document >>>> containing use cases you considered to be relevant for secevent so tha= t the >>>> WG could decide which ones were in scope and which ones were out of sc= ope. >>>> >>>> Checking in on the status of the use case document. Would you provide >>>> an update when you have a chance? >>>> >>>> /Dick >>>> >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>> WwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g >>>> &s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D >>>> >>>> >>>> >>> >>> >>> -- >>> Subscribe to the HARDTWARE >>> >>> mail list to learn about projects I am working on! >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>> WwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q >>> &s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D >>> >>> >>> >> >> >> -- >> Subscribe to the HARDTWARE mail list to learn >> about projects I am working on! >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event >> >> >> >> > > --94eb2c1fcbbc2a6b040550db0a5c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Here is an initial use case document, for now it has only = the RISC use cases we discussed so far. When Phil gets back I will coordina= te with him to add SCIM use cases to this same I-D. I will get this into a = decent shape for the IETF meeting.

Marius

On Thu, May 4, 2017 at 11:28 AM, Yaron Sheff= er <yaronf.ietf@gmail.com> wrote:
=20 =20 =20

Whatever works for you - and that's the whole point of *individual* I-Ds.

Thanks,

=C2=A0=C2=A0=C2=A0 Yaron


On 04/05/17 18:25, = Marius Scurtescu wrote:
Do we need one document for all use cases (all profiles) or one for each profiles?

I am happy to create the one document or the one for RISC (if one per profile).

Marius

On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes.

Thanks,

=C2=A0=C2=A0=C2=A0 Yaron


On 04/05/17 07:57, Justin Richer wrote:
In fact, I=E2=80=99m going to = ask that we *not* push a use cases document toward RFC. Use case documents are wonderful tools for guiding development, but should be discarded as artifacts of that process once said process is completed (or even well on its way).

As such, RFC, wiki, blog post, or anything referenced from the list and easily findable works.

=C2=A0=E2=80=94 Justin

On May 3, 2017, at 4:45 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

As the more experienced chair, I will defer to Yaron for guidance.

So far no one has expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt=C2=A0<phil.hunt@oracle.com>=C2=A0wrote:
Depends on what the WG wants.

Email cases,
Github posted document,
Individual IDs posted to the working group, or
an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft=C2= =A0https://tools.ietf.org/html/draft-ietf-oauth-us= e-cases-03).

Let us know what form and what format.

We can also use one for OpenID Backchannel Logout.=C2=A0 This is particularly important because it will be triggered by (or is related to) SCIM and by RISC events such as account resets, authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independent= id
phil.hunt@oracle.com

On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com= > wrote:

Hi Phil

per=C2=A0


you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose.

On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt <=
ph=
il.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SC=
IM
> case. Happy to put these somewhere in a working group document.
=
On Wed, May 3, 2017 at 4:16 PM, Phil Hunt= =C2=A0<phil.hunt@oracle.com>=C2=A0wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases have been posted to the mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independent= id
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

= Phil / Marius

At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Deven= t&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&a= mp;r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q= 9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywT= MIjRB-XsMY8UPafBs4oPwOTc&e=3D=C2=A0




--=C2=A0
Subscribe to the=C2=A0= HARDTWARE=C2=A0mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?= u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDw= ICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkI= tfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D=C2=A0




--=C2=A0
Subscribe to the=C2=A0HARDTWARE= =C2=A0mail list to learn about projects I am working on!
__________= _____________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-even= t





--94eb2c1fcbbc2a6b040550db0a5c-- --94eb2c1fcbbc2a6b090550db0a5e Content-Type: text/plain; charset="US-ASCII"; name="draft-scurtescu-secevent-use-cases.txt" Content-Disposition: attachment; filename="draft-scurtescu-secevent-use-cases.txt" Content-Transfer-Encoding: base64 X-Attachment-Id: f_j3dodzw70 CgoKCnNlY2V2ZW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIE0uIFNjdXJ0ZXNjdQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHb29nbGUKSW50ZW5kZWQgc3RhdHVzOiBJbmZv cm1hdGlvbmFsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQLiBIdW50CkV4cGly ZXM6IERlY2VtYmVyIDIsIDIwMTcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9yYWNsZSBD b3Jwb3JhdGlvbgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBNYXkgMzEsIDIwMTcKCgogICAgICAgICAgICAgICAgICAgICAgIFNlY3Vy aXR5IEV2ZW50cyBVc2UgQ2FzZXMKICAgICAgICAgICAgICAgICBkcmFmdC1zY3VydGVzY3Utc2Vj ZXZlbnQtdXNlLWNhc2VzLTAwCgpBYnN0cmFjdAoKICAgVGhpcyBkb2N1bWVudCBkZXNjcmliZXMg dGhlIHVzZSBjYXNlcyBmb3Igc2VjdXJpdHkgZXZlbnRzIGFuZCBoZWxwcwogICB3aXRoIGRlZmlu aW5nIHRoZSByZXF1aXJlbWVudHMgZm9yIHRva2VuIGZvcm1hdCBhbmQgZXZlbnQKICAgZGlzdHJp YnV0aW9uLgoKU3RhdHVzIG9mIFRoaXMgTWVtbwoKICAgVGhpcyBJbnRlcm5ldC1EcmFmdCBpcyBz dWJtaXR0ZWQgaW4gZnVsbCBjb25mb3JtYW5jZSB3aXRoIHRoZQogICBwcm92aXNpb25zIG9mIEJD UCA3OCBhbmQgQkNQIDc5LgoKICAgSW50ZXJuZXQtRHJhZnRzIGFyZSB3b3JraW5nIGRvY3VtZW50 cyBvZiB0aGUgSW50ZXJuZXQgRW5naW5lZXJpbmcKICAgVGFzayBGb3JjZSAoSUVURikuICBOb3Rl IHRoYXQgb3RoZXIgZ3JvdXBzIG1heSBhbHNvIGRpc3RyaWJ1dGUKICAgd29ya2luZyBkb2N1bWVu dHMgYXMgSW50ZXJuZXQtRHJhZnRzLiAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC0KICAg RHJhZnRzIGlzIGF0IGh0dHA6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kcmFmdHMvY3VycmVudC8u CgogICBJbnRlcm5ldC1EcmFmdHMgYXJlIGRyYWZ0IGRvY3VtZW50cyB2YWxpZCBmb3IgYSBtYXhp bXVtIG9mIHNpeCBtb250aHMKICAgYW5kIG1heSBiZSB1cGRhdGVkLCByZXBsYWNlZCwgb3Igb2Jz b2xldGVkIGJ5IG90aGVyIGRvY3VtZW50cyBhdCBhbnkKICAgdGltZS4gIEl0IGlzIGluYXBwcm9w cmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBhcyByZWZlcmVuY2UKICAgbWF0ZXJpYWwgb3Ig dG8gY2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndvcmsgaW4gcHJvZ3Jlc3MuIgoKICAgVGhpcyBJ bnRlcm5ldC1EcmFmdCB3aWxsIGV4cGlyZSBvbiBEZWNlbWJlciAyLCAyMDE3LgoKQ29weXJpZ2h0 IE5vdGljZQoKICAgQ29weXJpZ2h0IChjKSAyMDE3IElFVEYgVHJ1c3QgYW5kIHRoZSBwZXJzb25z IGlkZW50aWZpZWQgYXMgdGhlCiAgIGRvY3VtZW50IGF1dGhvcnMuICBBbGwgcmlnaHRzIHJlc2Vy dmVkLgoKICAgVGhpcyBkb2N1bWVudCBpcyBzdWJqZWN0IHRvIEJDUCA3OCBhbmQgdGhlIElFVEYg VHJ1c3QncyBMZWdhbAogICBQcm92aXNpb25zIFJlbGF0aW5nIHRvIElFVEYgRG9jdW1lbnRzCiAg IChodHRwOi8vdHJ1c3RlZS5pZXRmLm9yZy9saWNlbnNlLWluZm8pIGluIGVmZmVjdCBvbiB0aGUg ZGF0ZSBvZgogICBwdWJsaWNhdGlvbiBvZiB0aGlzIGRvY3VtZW50LiAgUGxlYXNlIHJldmlldyB0 aGVzZSBkb2N1bWVudHMKICAgY2FyZWZ1bGx5LCBhcyB0aGV5IGRlc2NyaWJlIHlvdXIgcmlnaHRz IGFuZCByZXN0cmljdGlvbnMgd2l0aCByZXNwZWN0CiAgIHRvIHRoaXMgZG9jdW1lbnQuICBDb2Rl IENvbXBvbmVudHMgZXh0cmFjdGVkIGZyb20gdGhpcyBkb2N1bWVudCBtdXN0CiAgIGluY2x1ZGUg U2ltcGxpZmllZCBCU0QgTGljZW5zZSB0ZXh0IGFzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDQuZSBv ZgogICB0aGUgVHJ1c3QgTGVnYWwgUHJvdmlzaW9ucyBhbmQgYXJlIHByb3ZpZGVkIHdpdGhvdXQg d2FycmFudHkgYXMKICAgZGVzY3JpYmVkIGluIHRoZSBTaW1wbGlmaWVkIEJTRCBMaWNlbnNlLgoK CgoKU2N1cnRlc2N1ICYgSHVudCAgICAgICAgRXhwaXJlcyBEZWNlbWJlciAyLCAyMDE3ICAgICAg ICAgICAgICAgIFtQYWdlIDFdCgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgU2VjdXJpdHkgRXZl bnRzIFVzZSBDYXNlcyAgICAgICAgICAgICAgIE1heSAyMDE3CgoKVGFibGUgb2YgQ29udGVudHMK CiAgIDEuICBJbnRyb2R1Y3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuICAgMgogICAyLiAgRGVmaW5pdGlvbnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDIKICAgMy4gIFJJU0MgVXNlIENhc2VzICAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAyCiAgICAgMy4x LiAgRXhwbGljaXQgSWRQIHRvIFJQICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuICAgMgogICAgIDMuMi4gIEV4cGxpY2l0IFJQIHRvIElkUCAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgIDMKICAgICAzLjMuICBJbXBsaWNpdCBJZFAgdG8gUlAgIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAzCiAgICAgMy40LiAgSW1wbGlj aXQgUlAgdG8gSWRQICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNAog ICAgIDMuNS4gIFBzZXVkby1pbXBsaWNpdCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgIDQKICAgICAzLjYuICBJZGVudGl0eSBhcyBhIFNlcnZpY2UgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA0CiAgICAgMy43LiAgU2VjdXJpdHkgYXMgYSBT ZXJ2aWNlIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNAogICAgIDMuOC4g IE9uLVByZW1pc2UgUlAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgIDQKICAgNC4gIFNDSU0gVXNlIENhc2VzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gICA1CiAgIEF1dGhvcnMnIEFkZHJlc3NlcyAgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNQoKMS4gIEludHJvZHVjdGlvbgoK Mi4gIERlZmluaXRpb25zCgogICBvICBUcmFuc21pdHRlciAtIHRoZSBlbnRpdHkgdGhhdCBzZW5k cyBzZWN1cml0eSBldmVudHMKCiAgIG8gIFJlY2VpdmVyIC0gdGhlIGVudGl0eSB0aGF0IHJlY2Vp dmVzIHNlY3VyaXR5IGV2ZW50cwoKICAgbyAgSWRQIC0gSWRlbnRpdHkgUHJvdmlkZXIsIGluIG1v c3QgY2FzZXMgYnV0IG5vdCBhbHdheXMgdGhpcyBpcyB0aGUKICAgICAgdHJhbnNtaXR0ZXIKCiAg IG8gIFJQIC0gUmVseWluZyBQYXJ0eSwgaW4gbW9zdCBjYXNlcyBidXQgbm90IGFsd2F5cyB0aGlz IGlzIHRoZQogICAgICByZWNlaXZlcgoKICAgbyAgUklTQyAtIFJpc2sgYW5kIEluY2lkZW50IFNo YXJpbmcgYW5kIENvb3JkaW5hdGlvbiwgc2VlCiAgICAgIGh0dHA6Ly9vcGVuaWQubmV0L3dnL3Jp c2MvCgogICBvICBTQ0lNIC0gU3lzdGVtIGZvciBDcm9zcy1kb21haW4gSWRlbnRpdHkgTWFuYWdl bWVudCwgc2VlCiAgICAgIGh0dHA6Ly93d3cuc2ltcGxlY2xvdWQuaW5mby8KCjMuICBSSVNDIFVz ZSBDYXNlcwoKMy4xLiAgRXhwbGljaXQgSWRQIHRvIFJQCgogICBvICBUcmFuc21pdHRlcjogSWRQ CgogICBvICBSZWNlaXZlcjogUlAKCiAgIFNpbXBsZXN0IHVzZSBjYXNlLCBJZFBzIHNlbmQgc2Vj dXJpdHkgZXZlbnRzIHRvIHJlbGV2YW50IFJQcy4KCiAgIFJQIGNhbiBtYWtlIGNvbnRyb2wgcGxh bmUgY2FsbHMgdG8gdGhlIElkUCBhbmQgY2FuIGF1dGhlbnRpY2F0ZSB3aXRoCiAgIGFjY2VzcyB0 b2tlbnMgaXNzdWVkIGJ5IElkUC4KCgoKU2N1cnRlc2N1ICYgSHVudCAgICAgICAgRXhwaXJlcyBE ZWNlbWJlciAyLCAyMDE3ICAgICAgICAgICAgICAgIFtQYWdlIDJdCgwKSW50ZXJuZXQtRHJhZnQg ICAgICAgICAgU2VjdXJpdHkgRXZlbnRzIFVzZSBDYXNlcyAgICAgICAgICAgICAgIE1heSAyMDE3 CgoKMy4yLiAgRXhwbGljaXQgUlAgdG8gSWRQCgogICBvICBUcmFuc21pdHRlcjogUlAKCiAgIG8g IFJlY2VpdmVyOiBJZFAKCiAgIFRoZSBSUCBjYW4gYWxzbyBzZW5kIFJJU0MgZXZlbnRzIGJhY2sg dG8gSWRQLiAgV2Ugd2FudCB0byBtYWtlIGl0CiAgIHZlcnkgZWFzeSBmb3IgdGhlIFJQIHRvIGRv IHRoYXQsIG5vIGNvbXBsaWNhdGVkIHJlZ2lzdHJhdGlvbiBzdGVwcwogICBhbmQgY3J5cHRvIG9m IHBvc3NpYmxlLgoKICAgSWRQIGNhbiBkb2N1bWVudCB3ZWxsLWtub3duIGVuZHBvaW50IGZvciBk YXRhIHBsYW5lICh3aGVyZSBpdAogICByZWNlaXZlcyBldmVudHMpLiAgUlAgY2FuIHVzZSBhY2Nl c3MgdG9rZW4gd2hlbiBzZW5kaW5nIGV2ZW50cyBvbgogICBkYXRhIHBsYW5lIGFuZCBtYXliZSBk b2VzIG5vdCBuZWVkIHRvIHNpZ24gU0VUcy4KCiAgIElmIFJQIGlzIHNvcGhpc3RpY2F0ZWQgYW5k IGlzIGV4cG9zaW5nIGl0cyBvd24gY29udHJvbCBwbGFuZSB0aGVuCiAgIGR1cmluZyBSUCBzdHJl YW0gcmVnaXN0cmF0aW9uIHdpdGggSWRQIChlaXRoZXIgbWFudWFsIG9yCiAgIHByb2dyYW1tYXRp YykgaXQgY2FuIGFkdmVydGlzZSBpdHMgb3duIGlzc3VlciBhbmQgdGhhdCBpc3N1ZXIgdGhyb3Vn aAogICAud2VsbC1rbm93biBjYW4gc3BlY2lmeSBmdWxsIHRyYW5zbWl0dGVyIGZ1bmN0aW9uYWxp dHkgb2YgUlAuCgozLjMuICBJbXBsaWNpdCBJZFAgdG8gUlAKCiAgIG8gIFRyYW5zbWl0dGVyOiBp bXBsaWNpdCBJZFAKCiAgIG8gIFJlY2VpdmVyOiBpbXBsaWNpdCBSUAoKICAgRXhhbXBsZTogR29v Z2xlIGFuZCBBbWF6b24sIEFtYXpvbiBhY2NvdW50IGNhbiBiZSBiYWNrZWQgYnkgZ21haWwKICAg YWRkcmVzcy4gIEFtYXpvbiBhY3RzIGFzIGltcGxpY2l0IFJQIHRvIEdvb2dsZSBpbiB0aGlzIGNh c2UuCgogICBHb29nbGUgYW5kIEFtYXpvbiBuZWVkIGxlZ2FsIGFncmVlbWVudCwgV2hlbiBBbWF6 b24gYWNjb3VudCBpcwogICBjcmVhdGVkIG9yIHVwZGF0ZWQgd2l0aCBnbWFpbCBhZGRyZXNzIEFt YXpvbiBtYWtlcyBSRVNUIGNhbGwgdG8KICAgR29vZ2xlIHRvIGVucm9sbCB0aGlzIG5ldyBlbWFp bCBhZGRyZXNzIGZvciBSSVNDIGV2ZW50cy4gIElmCiAgIGVucm9sbG1lbnQgc3VjY2VlZHMgdGhl biBSSVNDIGV2ZW50cyB3aWxsIGZsb3cgYmlkaXJlY3Rpb25hbGx5IChzZWUKICAgbmV4dCBzZWN0 aW9uLCBmb3Igc2ltcGxpY2l0eSBvbmx5IHVuaWRpcmVjdGlvbmFsIGlzIGNvbnNpZGVyZWQgaW4K ICAgdGhpcyBzZWN0aW9uKS4KCiAgIEFzc3VtcHRpb246IEFtYXpvbi9SUCBpcyByZWdpc3RlcmVk IHdpdGggR29vZ2xlL0lkUCBhcyBhbiBPQXV0aCAyCiAgIGNsaWVudCBhbmQgY2FuIHVzZSBhY2Nl c3MgdG9rZW5zIGZvciBjb250cm9sIHBsYW5lLgoKICAgT3BlbiBxdWVzdGlvbjogd2hhdCBhcmUg dGhlIGltcGxpY2F0aW9ucyBvZiB1bnZlcmlmaWVkIGVtYWlsCiAgIGFkZHJlc3Nlcz8KCiAgIE9w ZW4gcXVlc3Rpb246IGRpc2NvdmVyeSBvZiBob3N0ZWQgZG9tYWlucywgaG93IGRvZXMgR29vZ2xl IGtub3cgdGhhdAogICBleGFtcGxlLmNvbSBpcyBtYW5hZ2VkIGJ5IE9yYWNsZSBhbmQgdGhhdCBz dWJqZWN0IGVucm9sbG1lbnQgc2hvdWxkCiAgIGJlIHNlbnQgdG8gdGhlbT8KCgoKCgoKClNjdXJ0 ZXNjdSAmIEh1bnQgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMiwgMjAxNyAgICAgICAgICAgICAg ICBbUGFnZSAzXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgIFNlY3VyaXR5IEV2ZW50cyBVc2Ug Q2FzZXMgICAgICAgICAgICAgICBNYXkgMjAxNwoKCjMuNC4gIEltcGxpY2l0IFJQIHRvIElkUAoK ICAgbyAgVHJhbnNtaXR0ZXI6IGltcGxpY2l0IFJQCgogICBvICBSZWNlaXZlcjogaW1wbGljaXQg SWRQCgogICBObyBlbnJvbGxlbnQgY2FsbCBpcyBzdHJpY3RseSBuZWNlc3NhcnkuICBUaGUgUlAg Y2FuIHN0YXJ0IHNlbmRpbmcKICAgZXZlbnRzIHRvIElkUCBhcyBuZXcgaWRlbnRpZmllcnMgc2hv dyB1cC4KCjMuNS4gIFBzZXVkby1pbXBsaWNpdAoKICAgQ29tbW9uIGVtYWlsIGFkZHJlc3Mgb3Ig cGhvbmUgbnVtYmVyIHVzZWQgYnkgdHdvIGRpZmZlcmVudCBSUHMuCgogICBFeGFtcGxlOiBBbWF6 b24gYW5kIFBheVBhbCwgYm90aCBBbWF6b24gYW5kIFBheVBhbCBlYWNoIGhhdmUgYW4KICAgYWNj b3VudCB3aXRoIHRoZSBzYW1lIGdtYWlsIGFkZHJlc3MuCgogICBNdXR1YWwgZGlzY292ZXJ5IGJ5 IGV4Y2hhbmdpbmcgZW1haWwgYWRkcmVzcyBoYXNoZXMuCgogICBPcGVuIHF1ZXN0aW9uOiBsZWdh bCBhbmQgcHJpdmFjeSBpbXBsaWNhdGlvbnMKCjMuNi4gIElkZW50aXR5IGFzIGEgU2VydmljZQoK ICAgRXhhbXBsZTogR29vZ2xlIEZpcmViZWFyLCBJZGFhUyBtYW5hZ2VzIGxhcmdlIG51bWJlciBv ZiBSUHMgYW5kCiAgIGltcGxlbWVudHMgUlAgZnVuY3Rpb25hbGl0eSBvbiB0aGVpciBiZWhhbGYu CgogICBJZGFhUyBzaG91bGQgYmUgYWJsZSB0byBtYW5hZ2UgU0VUIGRpc3RyaWJ1dGlvbiBjb25m aWd1cmF0aW9uIGZvciBpdHMKICAgUlBzIHdpdGggYSBnaXZlbiBJZFAgdXNpbmcgdGhlIGNyZWRl bnRpYWxzIGFscmVhZHkgZXN0YWJsaXNoZWQKICAgYmV0d2VlbiB0aGUgUlAgYW5kIHRoZSBJZFAu ICBDb250cm9sIHBsYW5lIG9wZXJhdGlvbiB0byBjcmVhdGUvdXBkYXRlCiAgIHN0cmVhbSBhbGxv d3MgdGhhdC4KCiAgIEFzc3VtcHRpb246IElkYWFTIGNhbiBpbXBlcnNvbmF0ZSBSUCBhdCBJZFAg KGNhbiBvYnRhaW4gYWNjZXNzIHRva2VuCiAgIG9uIGJlaGFsZiBvZiBSUCkKCjMuNy4gIFNlY3Vy aXR5IGFzIGEgU2VydmljZQoKICAgU2ltaWxhciB0byBJZGFhUyBkZXNjcmliZWQgaW4gcHJldmlv dXMgZXN0aW9uLCBidXQgdGhlIHNlcnZpY2UKICAgcHJvdmlkZXIgaGFzIGl0cyBvd24gc2V0IG9m IGNyZWRlbnRpYWxzIGRpZmZlcmVudCBmcm9tIHRoZQogICBjcmVkZW50aWFscyBhbmQgUlAgaXMg dXNpbmcuICBUaGUgU1AgY2Fubm90IGltcGVyc29uYXRlIHRoZSBSUCBhdAogICBJZFAuICBUaGUg SWRQIG11c3QgZGVmaW5lIGRlbGVnYXRpb24gcnVsZXMgYW5kIGFsbG93IHRoZSBTUCB0byBtYWtl CiAgIHJlcXVlc3RzIG9uIGJlaGFsZiBvZiB0aGUgUlAuCgozLjguICBPbi1QcmVtaXNlIFJQCgog ICBUaGUgUlAgKHJlY2VpdmVyKSBpcyBiZWhpbmQgYSBmaXJld2FsbCBhbmQgY2Fubm90IGJlIHJl YWNoZWQgdGhyb3VnaAogICBIVFRQLiAgVGhlIG9ubHkgd2F5IHRvIGRlbGl2ZXIgZXZlbnRzIGlz IGlmIHRoZSBSUCBwZXJpb2RpY2FsbHkgcG9sbHMKICAgYW4gZW5kcG9pbnQgcHJvdmlkZWQgYnkg dGhlIHRyYW5zbWl0dGVyLgoKCgoKClNjdXJ0ZXNjdSAmIEh1bnQgICAgICAgIEV4cGlyZXMgRGVj ZW1iZXIgMiwgMjAxNyAgICAgICAgICAgICAgICBbUGFnZSA0XQoMCkludGVybmV0LURyYWZ0ICAg ICAgICAgIFNlY3VyaXR5IEV2ZW50cyBVc2UgQ2FzZXMgICAgICAgICAgICAgICBNYXkgMjAxNwoK CjQuICBTQ0lNIFVzZSBDYXNlcwoKQXV0aG9ycycgQWRkcmVzc2VzCgogICBNYXJpdXMgU2N1cnRl c2N1CiAgIEdvb2dsZQoKICAgRW1haWw6IG1zY3VydGVzY3VAZ29vZ2xlLmNvbQoKCiAgIFBoaWwg SHVudAogICBPcmFjbGUgQ29ycG9yYXRpb24KCiAgIEVtYWlsOiBwaGlsLmh1bnRAeWFob28uY29t CgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgpTY3VydGVzY3UgJiBIdW50ICAg ICAgICBFeHBpcmVzIERlY2VtYmVyIDIsIDIwMTcgICAgICAgICAgICAgICAgW1BhZ2UgNV0K --94eb2c1fcbbc2a6b090550db0a5e Content-Type: application/pdf; name="draft-scurtescu-secevent-use-cases.pdf" Content-Disposition: attachment; filename="draft-scurtescu-secevent-use-cases.pdf" Content-Transfer-Encoding: base64 X-Attachment-Id: f_j3doe77c1 JVBERi0xLjQKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nJ1VwXbbNhC86yv25dDI71mUZKdxkltsK63fs1s1Vk9VDxC5pBCTAA2AtvX3 nQVJWbLSps/SQbLMnZ2dGSzuaZJMaSLv7jOtBuOvZ1T4wYSKwf1gGv9J3Uda0fkCD3yg6Qkt8kFb M6WTUzo7/UiLajD0nPIDm0CveN0kdJs2LrBPm6PFt8H0lBbXg+GVCewMh9GlU/mrgH+xtij56G2L ZTLOyAcVGv+JrkxuXaWCtkaV/wNqntCvjQmCNXuqtWNgXGLmasWOTo7pZDI9+0+A351KS6YL62rr Yl/Bes1U/etGbeh02rYGlhhx/a+ItwyFddjQTFzy9KcHF+XZo7LT+6AmE91Hvrdm1Hs8ajyPUike TSaoP3kf6z+vfMCQoZtrsdaeMps2lcQiA4LTK/YU1kwAoAhAcIF8z41bbspktOay3uf2qMMaMLk2 2hQRxfF9AyeqWCRAwd6xodbYiBIBOz6ZBj29akT65Jn1bQwE2bwlfMOV3R3gRQjxi29WlQ4BWdLo 1ZQlpbYNk0m5ZQlye9RrZx+0R9/Y5/xiTmcfIr/49eMOGzy83xFqOKBadydT93JGHJGgf5hmptCG 2eGpvdYL5e/oi3WgthxezRZflkcJ0W82MOqhkgWKo8LZpvZUIVGq9PZZK+60OCSgXmrjE5GMqUSt 0IOnTpzfPtVBdWNBSbRfh1B/Go8zBReQnTt2ieaQJ9YV4xg/P+5wxj9WKRbsUHxQpc5iMBRGe9JV Uwkxr5+osias9/MlfogAK8SzBiHOjpGwulSpfAOIXXlbshi/2nS67cghgdt0IwZdMdS4innRRtUI QO20EtFtDP8BfY9eOWPQtJccGYadWE4x2JTqaBlXXWu4Z6TsjVgjUUSPAmvJJ2/2hPpeih81Ustx jZE1B3tMlB5e2HrjdLEOEha9ZfX883KYLo/avSe5ooVrfHvqJJg1Oy951xnk0bmGasofHIztelBN WFsnEfoMarGBKOLZPXCWHA60LWwP5DdOg4i0c7Ti6djyeuvpmgtV7nWfPx/Lr1xiJ8tesW3VZe9s N/dy2EU1CBzzc0xLiGOwEDWWAASBE5znwgfKCgmJEmLX4dTNCgVx/7dneGcYTD8vGWsRkz9ofpRy /JG9oJIi67J3NsedpJvtdqWNbVwvn6gACXGQ0xCHjLsJv9S8XdIY9yWFC5vJNVXV1sRk81Pc6jAw d7baf5wqiNFBaZOWDUpvdVWXrePnt5d03cpDATjCt6ca1ydupajEu2RHIhGtDVO0bNcmGUlOelyo cp3LSLZBopVzyuAKUb1Ke30E8vu8JFvvf25vgv6io5/iXd9fg919/8Pr/q+5KpimfwNxthj8gfc/ g6XR3mVuZHN0cmVhbQplbmRvYmoKNiAwIG9iagoxMDE5CmVuZG9iagoxMiAwIG9iago8PC9MZW5n dGggMTMgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJylld9v2jAQx9/zV9zT2kok kNCWrm8drTSkVWMke5r2YJwDvCY2tR0Y//3u0rQN0FUtTSQibN/na98v30MviqHHb/OVZdCdDGDu gh7Mg/sgrieh+cgSvmS04ALiBLJZ8GATQ9KHweACsjI4HmmPVqMPr62YeXh6UpSVVX4DNyvU3sFP hzAUDh1sP7diA0kvHpxkf4L+Z8i+BceZmBYIZgZDQ3AyPjkKkvN6igziCIBErckr6ZXRANE7X4CE iHH/kZjQ0DXOlFbMc+/mPRKZ1ac/k1E6bJ/3UBbT+LQ3f5eFksrDKB+DNzAZv5W5zUrarEmNYuKb Wf0Wi885Kg/fV5t12mYdsK/TFuuMBsYOq9yE6hH5Ht+3Wee8r5wSkNNYOBCU1HalJB7AGkStkvgg 64IGvutwbLFUlGXksbefsM1iv6fD0e1HcvWsYV1VfmGsO4KrPLfoDmY1db5b5KyyU6aNsAHIrNCu VJ4aEYTgFwhNzPxCeHCoc0e/je9x1XSUxniCEtXqRUv7MPWKMadp+JwjY2tWKkfbAaWhNM6DrL06 rTxo40EUa7FxBFcOFH9xqw/R45+PstX0eKMsNcFio/QcxsL6zeEyzcn2NbhzkYpydyB0TiGQig8H 6UJY1uXBoTE2V1pwFDrkmz36wvvlZbdrlqhVHtHd0F3Pu1Y52d3Vq7MvhHTjPJYwMxaG1jgX5qYU dLYnx94KLeZY0r/XBNfrdeS46lEWpsojpWemJbnfmjmQ/2uxL6bXJc/v587l8/q01qeQVCTCYemw iauzcDePWMhigSuhue+5qGFQpKWgyIo7QhiuggKWhdAMLIrajFOVt8rx4LWCyo99JYVHWCu/2HKR kJJKkuzuUHNKuApzmG6YwJpnSb0wpc15dLKCT/C10k93OflGUUlT7Uksp1QpSae+sXcucvg1phhB 8puIN1nwg95/rQ8V82VuZHN0cmVhbQplbmRvYmoKMTMgMCBvYmoKNzE1CmVuZG9iagoxNyAwIG9i ago8PC9MZW5ndGggMTggMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJx9VU1z2zYQ vetX7Km1ZxRZH5069aXjJprWM+3YlZjJoe4BAlcUYhKguWBk9df34UOK6KSlDhRBYPft2/eWzzSd zGgafvmum9HV6poqGU2pGj2PZvEl5Ztu6JcCG97SbE7FdpTOzGi+oOvrt1Q0o4s767mz7N+879TW 0+las+474w+0/MzWC30QpndKWGh4/aEONJ/Ori+LT6PFT1T8PrpYTOYTouVLWxttPK0eyDu6Kx8u vx/Nf4w7cM4RFZ2y0hgPADfYhdf5xYo1m89hNZ0Ky8WOQyStLKlaHAnbklZ363fECeBG6aecCNk/ Mu2V9WGhUU9MxiPObHHMjuAHYiUH2rqOfIqNvaXDg/Jjso60a0IFynNJHVdGfKe8cZbEcysZlgIK 3R1anHVbap2I2dQ8GZQKRBF36XTfACvtua7fPFm3t4QqWmewFnCUyitqa2WZHi/2O+6+wt0lZiQX /XiJUjMrPRqktGYRFPLElhDARpqMrY4kOZtxn6UKJTTqsGEARGTrPFlGzShJTGVpvSzkVUHbkNQI iWt34CWTFAJhkV9AQ8hpQkLUqJ31natzOpBtBzWV0Bl2IyIYZtUMyd4bv4sMPl4w/nIHrLZXNbku l9J2rupU02C/frxE1iSSEj32RvgEw4j0OB5Qhh4fn/2uc321y8EmZ70JYaRlbbaQSV/X5L8IFgtW B4CqDiZxgZEzkhaTBTpz12QLBPyg81zjA/Gbs43fssHp/SnC8kVhjW/oV+eqOjXxtlH/ODvO9yAG 19vEBpob/IEmbQ5UNcrUgxaosuwgHEA+nQVpSs4ThwJyMmPBGjqtMQ+GyvgKTZJSzRU6pqqOORhg TB+DNl/hNDLApKGFoCr4om/L+DdqIaI/Ij7GCB4XWi3XBUCFTrnMUwYE7GyhwToBt7wnHsQJ9jub JqF52xwiHYzGlR4G41KiiAfTZ28Qe1u7PW1MaWDTpI36AN0Kcw5l+QVB0stxzClHhqEhi929PT8e 7AT3iCkxC2Cuo3tjETkOZsCgBbeQddOGNzeZnatk1mSrGCgSmai5CtpEpyGS+9sey/NhF2oTCo9j 7htDJhE3MPgQzX0Lop57lgRoH4ynujgFsriizSU4qLcQu9kaAOT/kijLz/8XvzSiXRzuiLdzElRT OgSzMsbzPo24LIrg8jgKBok4OWuC8R9Yw7RRVfLNfad0FnccINJvPqEHA4HsXF+XuUswnXD6BqHc JgCfTX+Iedb4uHoW3dN39FsQf77w0UT3hd7D+s0GY2Y+jl/XVx9d+usBoGjxN0Iui9Gf+P0L9lqL +GVuZHN0cmVhbQplbmRvYmoKMTggMCBvYmoKOTc5CmVuZG9iagoyMiAwIG9iago8PC9MZW5ndGgg MjMgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJxtVU1320YMvOtX4NTY79mKZaWx 61uauI3faxrFYk91DxAJktuQu/R+SFZ/fQckZZluqQP1uLvAYGaAfaSL+YIu9De+83b29v6KqjC7 oGr2OFv0izS+8pZ+zrDhmhaXlJWz4cyCLpd0dXVNWTs7ubNRvJV4/slzGen5WUuevIl7ut2KjYH+ CEIfOUig6fOF93R5sbg6zf6eLX+i7LfZyXL+bk5013aNyU2k+xVFR3fF6vTN7PJ9vwPnHFHm2YbW RAC4IXPcjn3jjnvJxWwny0McXf/dkVjvmgb4KOemIRMoRG/y2OzJ4mgI7PeAktWiKHK2WGcfKYgt jK0QaLE8AJKhzgEqcUCEHZkCH01pxCN07XaUuvmxjOX8R0RfBUmFOz8gHNF9dG3rLEnLpiEuCg80 5Dx1tbNCNrUb8ZSCFLTZU9w5KkxZitda7ldhPka5fWKElRv60PI/CMe2oBXvV9yc0cbF+r/fSTiv qeat4OOkQM5zlxB+Z3AugpLArVD1EuB8ItGXFBMCFibkDiLsFak85TXbCuS9Kq3mUMsz7q+dWHpM EqJx9oYaqRBIQXbebDnfj3qyLgc9s5y/V8/0dMN0oJ9hQb81ubym4lfnqkboF+NlI+zPcIp5TS1b rmDPhn31TLArlU3NPKFCs0vb6w1flMnmCoQbTQ02QY7xtJGam3JKyZAKTkgNhAPFGyCBZYbktL7N lC54cJM0IuXOlqZKvi+USuhvYphAUXi9IkwVrG5796WgBKtGuZeeE25QReOFC2gAE28aA76LkZuN xJ1ID1wLUqL1L0LN1Yk2ok2oaxjOc52MaAAb0TnK29QVeI2xgF64RbLG7dAONccpBR9CSG036DrQ oX0FRtEj4DAOCPpGpYcTXXObyMaq/9Qo0X2XqTGBZeB6kOvh9GWHXc1fzKL/scXatAaSD32raAoJ OfhHYyFn52VrXAo0OBFNk+Lg/ecgRxydd1s0vFcvq07kdhgYEhXWSx2OnVp612q4EctELGgAIjCS ejHHKbTup5B1cULYQbbD7Bh0ywYFqU0hoqrSQL1CtJV6+XxqZEjTS9UHWa8GM34/IPLSN2GYcjzk mwyyayT8as9XXloT5DiEx9H5cOLHUfxwqjUhltHMVKILdzp7FchYGvrC6xQSdaF3qaonNH/OskN5 zmJS73CDADVK0/iHOYwk5oCUQJVxhdEhv6cOIz+M8OAujPLOGYgxyjcMVJyLx+tFS9X7DgDWsFKE RRL9QJ91HI7P7VOHUgJ9Qp396Lg86++1V9cd/bnSRn/3FyLeZrNv+P0LeiFcwmVuZHN0cmVhbQpl bmRvYmoKMjMgMCBvYmoKOTc5CmVuZG9iagoyNyAwIG9iago8PC9MZW5ndGggMjggMCBSL0ZpbHRl ciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJxtUEtPwkAQvu+v+E4Cida2oAVPIDRKIhGlnoyHtSxt TbcLu1sj/55xKRCMM4dJ5nvMYwPfC+D/ZlNTya5fI2SG+cjYhgUORFNSifuECH0EIZIV22sChF1E UR+JZO1pZYWuhL2aaL6yOMZCpLUu7Bbxt6iswZsRGHMjDM5jxrcI/SDqJF+sO0DyxNo9j+Tj6eyk 6bRYeOuwUW1zpU0Lo+VSC7PH2s5HF7XBgqZaYdKa2kHXSQh8UCorxcmFWrHkRXkHaQ6CYeZIXqok EZtViDjPixKPdWXPHJ81T0vaTum10twWqvrPfU1aLyftcMtzpRrv3qDneMddceEGHF4S/6wLug0T kQr5KTTCS/eiP5/D+5xnAjcfZBkn7IVyB3YqfWJlbmRzdHJlYW0KZW5kb2JqCjI4IDAgb2JqCjI5 MAplbmRvYmoKNCAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90 YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRH U3RhdGUgOSAwIFIKL0ZvbnQgMTAgMCBSCj4+Ci9Db250ZW50cyA1IDAgUgo+PgplbmRvYmoKMTEg MCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVu dCAzIDAgUgovUmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDE0IDAg UgovRm9udCAxNSAwIFIKPj4KL0NvbnRlbnRzIDEyIDAgUgo+PgplbmRvYmoKMTYgMCBvYmoKPDwv VHlwZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgov UmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDE5IDAgUgovRm9udCAy MCAwIFIKPj4KL0NvbnRlbnRzIDE3IDAgUgo+PgplbmRvYmoKMjEgMCBvYmoKPDwvVHlwZS9QYWdl L01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVzb3VyY2Vz PDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDI0IDAgUgovRm9udCAyNSAwIFIKPj4K L0NvbnRlbnRzIDIyIDAgUgo+PgplbmRvYmoKMjYgMCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94 IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVzb3VyY2VzPDwvUHJvY1Nl dFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDI5IDAgUgovRm9udCAzMCAwIFIKPj4KL0NvbnRlbnRz IDI3IDAgUgo+PgplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAvUGFnZXMgL0tpZHMgWwo0IDAgUgox MSAwIFIKMTYgMCBSCjIxIDAgUgoyNiAwIFIKXSAvQ291bnQgNQo+PgplbmRvYmoKMSAwIG9iago8 PC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAgUgovTWV0YWRhdGEgMzEgMCBSCj4+CmVuZG9iago3 IDAgb2JqCjw8L1R5cGUvRXh0R1N0YXRlCi9PUE0gMT4+ZW5kb2JqCjkgMCBvYmoKPDwvUjcKNyAw IFI+PgplbmRvYmoKMTAgMCBvYmoKPDwvUjgKOCAwIFI+PgplbmRvYmoKMTQgMCBvYmoKPDwvUjcK NyAwIFI+PgplbmRvYmoKMTUgMCBvYmoKPDwvUjgKOCAwIFI+PgplbmRvYmoKMTkgMCBvYmoKPDwv UjcKNyAwIFI+PgplbmRvYmoKMjAgMCBvYmoKPDwvUjgKOCAwIFI+PgplbmRvYmoKMjQgMCBvYmoK PDwvUjcKNyAwIFI+PgplbmRvYmoKMjUgMCBvYmoKPDwvUjgKOCAwIFI+PgplbmRvYmoKMjkgMCBv YmoKPDwvUjcKNyAwIFI+PgplbmRvYmoKMzAgMCBvYmoKPDwvUjgKOCAwIFI+PgplbmRvYmoKOCAw IG9iago8PC9CYXNlRm9udC9Db3VyaWVyL1R5cGUvRm9udAovU3VidHlwZS9UeXBlMT4+CmVuZG9i agozMSAwIG9iago8PC9UeXBlL01ldGFkYXRhCi9TdWJ0eXBlL1hNTC9MZW5ndGggMTM1ND4+c3Ry ZWFtCjw/eHBhY2tldCBiZWdpbj0n77u/JyBpZD0nVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkJz8+ Cjw/YWRvYmUteGFwLWZpbHRlcnMgZXNjPSJDUkxGIj8+Cjx4OnhtcG1ldGEgeG1sbnM6eD0nYWRv YmU6bnM6bWV0YS8nIHg6eG1wdGs9J1hNUCB0b29sa2l0IDIuOS4xLTEzLCBmcmFtZXdvcmsgMS42 Jz4KPHJkZjpSREYgeG1sbnM6cmRmPSdodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1z eW50YXgtbnMjJyB4bWxuczppWD0naHR0cDovL25zLmFkb2JlLmNvbS9pWC8xLjAvJz4KPHJkZjpE ZXNjcmlwdGlvbiByZGY6YWJvdXQ9J3V1aWQ6NjFkZjFiY2ItN2U3Yy0xMWYyLTAwMDAtMDYwMjI3 NjdlZjFiJyB4bWxuczpwZGY9J2h0dHA6Ly9ucy5hZG9iZS5jb20vcGRmLzEuMy8nIHBkZjpQcm9k dWNlcj0nR1BMIEdob3N0c2NyaXB0IDkuMDUnLz4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9 J3V1aWQ6NjFkZjFiY2ItN2U3Yy0xMWYyLTAwMDAtMDYwMjI3NjdlZjFiJyB4bWxuczp4bXA9J2h0 dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8nPjx4bXA6TW9kaWZ5RGF0ZT4yMDE3LTA1LTMxVDE3 OjE4OjI3LTA3OjAwPC94bXA6TW9kaWZ5RGF0ZT4KPHhtcDpDcmVhdGVEYXRlPjIwMTctMDUtMzFU MTc6MTg6MjctMDc6MDA8L3htcDpDcmVhdGVEYXRlPgo8eG1wOkNyZWF0b3JUb29sPkdOVSBFbnNj cmlwdCAxLjYuNS45MDwveG1wOkNyZWF0b3JUb29sPjwvcmRmOkRlc2NyaXB0aW9uPgo8cmRmOkRl c2NyaXB0aW9uIHJkZjphYm91dD0ndXVpZDo2MWRmMWJjYi03ZTdjLTExZjItMDAwMC0wNjAyMjc2 N2VmMWInIHhtbG5zOnhhcE1NPSdodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vJyB4YXBN TTpEb2N1bWVudElEPSd1dWlkOjYxZGYxYmNiLTdlN2MtMTFmMi0wMDAwLTA2MDIyNzY3ZWYxYicv Pgo8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0ndXVpZDo2MWRmMWJjYi03ZTdjLTExZjItMDAw MC0wNjAyMjc2N2VmMWInIHhtbG5zOmRjPSdodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4x LycgZGM6Zm9ybWF0PSdhcHBsaWNhdGlvbi9wZGYnPjxkYzp0aXRsZT48cmRmOkFsdD48cmRmOmxp IHhtbDpsYW5nPSd4LWRlZmF1bHQnPkVuc2NyaXB0IE91dHB1dDwvcmRmOmxpPjwvcmRmOkFsdD48 L2RjOnRpdGxlPjwvcmRmOkRlc2NyaXB0aW9uPgo8L3JkZjpSREY+CjwveDp4bXBtZXRhPgogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgCjw/eHBhY2tldCBlbmQ9J3cnPz4KZW5kc3RyZWFt CmVuZG9iagoyIDAgb2JqCjw8L1Byb2R1Y2VyKEdQTCBHaG9zdHNjcmlwdCA5LjA1KQovQ3JlYXRp b25EYXRlKEQ6MjAxNzA1MzExNzE4MjctMDcnMDAnKQovTW9kRGF0ZShEOjIwMTcwNTMxMTcxODI3 LTA3JzAwJykKL1RpdGxlKEVuc2NyaXB0IE91dHB1dCkKL0NyZWF0b3IoR05VIEVuc2NyaXB0IDEu Ni41LjkwKT4+ZW5kb2JqCnhyZWYKMCAzMgowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMDUzNDkg MDAwMDAgbiAKMDAwMDAwNzI0NyAwMDAwMCBuIAowMDAwMDA1MjYyIDAwMDAwIG4gCjAwMDAwMDQ0 NTUgMDAwMDAgbiAKMDAwMDAwMDAxNSAwMDAwMCBuIAowMDAwMDAxMTA0IDAwMDAwIG4gCjAwMDAw MDU0MTQgMDAwMDAgbiAKMDAwMDAwNTc1NCAwMDAwMCBuIAowMDAwMDA1NDU1IDAwMDAwIG4gCjAw MDAwMDU0ODQgMDAwMDAgbiAKMDAwMDAwNDYxNCAwMDAwMCBuIAowMDAwMDAxMTI0IDAwMDAwIG4g CjAwMDAwMDE5MTEgMDAwMDAgbiAKMDAwMDAwNTUxNCAwMDAwMCBuIAowMDAwMDA1NTQ0IDAwMDAw IG4gCjAwMDAwMDQ3NzYgMDAwMDAgbiAKMDAwMDAwMTkzMSAwMDAwMCBuIAowMDAwMDAyOTgyIDAw MDAwIG4gCjAwMDAwMDU1NzQgMDAwMDAgbiAKMDAwMDAwNTYwNCAwMDAwMCBuIAowMDAwMDA0OTM4 IDAwMDAwIG4gCjAwMDAwMDMwMDIgMDAwMDAgbiAKMDAwMDAwNDA1MyAwMDAwMCBuIAowMDAwMDA1 NjM0IDAwMDAwIG4gCjAwMDAwMDU2NjQgMDAwMDAgbiAKMDAwMDAwNTEwMCAwMDAwMCBuIAowMDAw MDA0MDczIDAwMDAwIG4gCjAwMDAwMDQ0MzUgMDAwMDAgbiAKMDAwMDAwNTY5NCAwMDAwMCBuIAow MDAwMDA1NzI0IDAwMDAwIG4gCjAwMDAwMDU4MTYgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSAz MiAvUm9vdCAxIDAgUiAvSW5mbyAyIDAgUgovSUQgWzw4MjM5RTNBOTU2MTBBRkU4NDkyRTg3OEJF OUJGMjJEOT48ODIzOUUzQTk1NjEwQUZFODQ5MkU4NzhCRTlCRjIyRDk+XQo+PgpzdGFydHhyZWYK NzQyNgolJUVPRgo= --94eb2c1fcbbc2a6b090550db0a5e-- From nobody Wed May 31 17:34:15 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F193128D64 for ; Wed, 31 May 2017 17:34:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.219 X-Spam-Level: X-Spam-Status: No, score=-4.219 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kyX0vuSkKZ9v for ; Wed, 31 May 2017 17:34:11 -0700 (PDT) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86F9A126C23 for ; Wed, 31 May 2017 17:34:10 -0700 (PDT) Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v510Y6Lc004548 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 1 Jun 2017 00:34:06 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.13.8/8.14.4) with ESMTP id v510Y617013264 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 1 Jun 2017 00:34:06 GMT Received: from abhmp0019.oracle.com (abhmp0019.oracle.com [141.146.116.25]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id v510Y3R1030209; Thu, 1 Jun 2017 00:34:04 GMT Received: from [192.168.1.18] (/64.147.86.33) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 31 May 2017 17:34:03 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-B7D1D1F0-BCC2-42A3-BEE6-CB7C56B6A1EE Mime-Version: 1.0 (1.0) From: "Phil Hunt (IDM)" X-Mailer: iPhone Mail (14F89) In-Reply-To: Date: Wed, 31 May 2017 21:33:47 -0300 Cc: Yaron Sheffer , SecEvent , Justin Richer , Dick Hardt Content-Transfer-Encoding: 7bit Message-Id: References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> <10de4c6f-c0a7-9d9f-c524-fa87048dd580@gmail.com> To: Marius Scurtescu X-Source-IP: aserv0021.oracle.com [141.146.126.233] Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Jun 2017 00:34:14 -0000 --Apple-Mail-B7D1D1F0-BCC2-42A3-BEE6-CB7C56B6A1EE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Marius, Go ahead an submit as an individual draft. I will submit scim cases in a sep= arate draft.=20 Afaik there is no plan to have this he a single wg document.=20 Phil > On May 31, 2017, at 9:22 PM, Marius Scurtescu wrot= e: >=20 > Here is an initial use case document, for now it has only the RISC use cas= es we discussed so far. When Phil gets back I will coordinate with him to ad= d SCIM use cases to this same I-D. I will get this into a decent shape for t= he IETF meeting. >=20 > Marius >=20 >> On Thu, May 4, 2017 at 11:28 AM, Yaron Sheffer wr= ote: >> Whatever works for you - and that's the whole point of *individual* I-Ds.= >>=20 >> Thanks, >>=20 >> Yaron >>=20 >>> On 04/05/17 18:25, Marius Scurtescu wrote: >>> Do we need one document for all use cases (all profiles) or one for each= profiles? >>>=20 >>> I am happy to create the one document or the one for RISC (if one per pr= ofile). >>>=20 >>> Marius >>>=20 >>>> On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer w= rote: >>>> My strong preference would be an individual I-D that (as Justin says) w= ill NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks= are used to, and it is referenced from the WG agenda and minutes. >>>>=20 >>>> Thanks, >>>>=20 >>>> Yaron >>>>=20 >>>>> On 04/05/17 07:57, Justin Richer wrote: >>>>> In fact, I=E2=80=99m going to ask that we *not* push a use cases docum= ent toward RFC. Use case documents are wonderful tools for guiding developme= nt, but should be discarded as artifacts of that process once said process i= s completed (or even well on its way). >>>>>=20 >>>>> As such, RFC, wiki, blog post, or anything referenced from the list an= d easily findable works. >>>>>=20 >>>>> =E2=80=94 Justin >>>>>=20 >>>>>> On May 3, 2017, at 4:45 PM, Dick Hardt wrote: >>>>>>=20 >>>>>> As the more experienced chair, I will defer to Yaron for guidance. >>>>>>=20 >>>>>> So far no one has expected it to be adopted as an RFC >>>>>>=20 >>>>>>> On Wed, May 3, 2017 at 4:39 PM, Phil Hunt wro= te: >>>>>>> Depends on what the WG wants. >>>>>>>=20 >>>>>>> Email cases, >>>>>>> Github posted document, >>>>>>> Individual IDs posted to the working group, or >>>>>>> an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE ha= s RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft https://tools.i= etf.org/html/draft-ietf-oauth-use-cases-03). >>>>>>>=20 >>>>>>> Let us know what form and what format. >>>>>>>=20 >>>>>>> We can also use one for OpenID Backchannel Logout. This is particul= arly important because it will be triggered by (or is related to) SCIM and b= y RISC events such as account resets, authentication factor changes etc. >>>>>>>=20 >>>>>>> Phil >>>>>>>=20 >>>>>>> Oracle Corporation, Identity Cloud Services Architect & Standards >>>>>>> @independentid >>>>>>> www.independentid.com >>>>>>> phil.hunt@oracle.com >>>>>>>=20 >>>>>>>> On May 3, 2017, at 4:31 PM, Dick Hardt wrote= : >>>>>>>>=20 >>>>>>>> Hi Phil >>>>>>>>=20 >>>>>>>> per=20 >>>>>>>>=20 >>>>>>>> https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKeq2OjEBj= CZ9cBcI >>>>>>>>=20 >>>>>>>> you offered to put them in a WG doc (see quate below). = Would that not be an ID. Also, as I r= ead over the document, it is hard to follow what the use cases are as it is v= ery verbose. >>>>>>>>=20 >>>>>>>> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ;= wrote: >>>>>>>>=20 >>>>>>>> > All, >>>>>>>> > >>>>>>>> > Dick asked me if I would enumerate the SCIM use cases. Here is t= he SCIM >>>>>>>> > case. Happy to put these somewhere in a working group document. >>>>>>>>=20 >>>>>>>>> On Wed, May 3, 2017 at 4:16 PM, Phil Hunt w= rote: >>>>>>>>> My understanding was you wanted informal cases not IDs. The SCIM c= ases have been posted to the mailing = list. I believe Marius is close on the RISC cases. >>>>>>>>>=20 >>>>>>>>> Phil >>>>>>>>>=20 >>>>>>>>> Oracle Corporation, Identity Cloud Services Architect & Standards >>>>>>>>> @independentid >>>>>>>>> www.independentid.com >>>>>>>>> phil.hunt@oracle.com >>>>>>>>>=20 >>>>>>>>>> On May 3, 2017, at 3:56 PM, Dick Hardt wro= te: >>>>>>>>>>=20 >>>>>>>>>> Phil / Marius >>>>>>>>>>=20 >>>>>>>>>> At the Chicago meeting, the two of you agreed to work on a docume= nt containing use cases you considered to be relevant for secevent so that t= he WG could decide which ones were in scope and which ones were out of scope= . >>>>>>>>>>=20 >>>>>>>>>> Checking in on the status of the use case document. Would you pro= vide an update when you have a chance? >>>>>>>>>>=20 >>>>>>>>>> /Dick >>>>>>>>>>=20 >>>>>>>>>> _______________________________________________ >>>>>>>>>> Id-event mailing list >>>>>>>>>> Id-event@ietf.org >>>>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.o= rg_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5Y= TpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHA= YB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4o= PwOTc&e=3D=20 >>>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>>=20 >>>>>>>> --=20 >>>>>>>> Subscribe to the HARDTWARE mail list to learn about projects I am w= orking on! >>>>>>>> _______________________________________________ >>>>>>>> Id-event mailing list >>>>>>>> Id-event@ietf.org >>>>>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org= _mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTp= kKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1Qk= Itfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbu= CS8&e=3D=20 >>>>>>>=20 >>>>>>=20 >>>>>>=20 >>>>>>=20 >>>>>> --=20 >>>>>> Subscribe to the HARDTWARE mail list to learn about projects I am wor= king on! >>>>>> _______________________________________________ >>>>>> Id-event mailing list >>>>>> Id-event@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/id-event >>>>>=20 >>>>=20 >>>=20 >>=20 >=20 > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailma= n_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057S= bK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DgwGItrqQynlr86zXGtW= nR-LWrcrcTS6Ly1w14yDo0vk&s=3Dt5e3IvZ_e-KRHUBVMfjtwKEs74yLZva4z-6OkkgmSjo&e=3D= =20 --Apple-Mail-B7D1D1F0-BCC2-42A3-BEE6-CB7C56B6A1EE Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Marius,

Go ahead an submit as an indi= vidual draft. I will submit scim cases in a separate draft. 

Afaik ther= e is no plan to have this he a single wg document. 

Phil

On May 31, 2017, at 9:22 PM, Marius Scurtescu <mscurtescu@google.com> wrote:

Here is an initial use case docu= ment, for now it has only the RISC use cases we discussed so far. When Phil g= ets back I will coordinate with him to add SCIM use cases to this same I-D. I= will get this into a decent shape for the IETF meeting.

Marius

On Thu, May 4, 2017 at 11:28 AM, Yaron Sheffe= r <yaronf.ietf@gmail.com> wrote:
=20 =20 =20

Whatever works for you - and that's the whole point of *individual* I-Ds.

Thanks,

    Yaron


On 04/05/17 18:25, M= arius Scurtescu wrote:
Do we need one document for all use cases (all profiles) or one for each profiles?

I am happy to create the one document or the one for RISC (if one per profile).

Marius

On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes.

Thanks,

    Yaron


On 04/05/17 07:57, Justin Richer wrote:
In fact, I=E2=80=99m going to a= sk that we *not* push a use cases document toward RFC. Use case documents are wonderful tools for guiding development, but should be discarded as artifacts of that process once said process is completed (or even well on its way).

As such, RFC, wiki, blog post, or anything referenced from the list and easily findable works.

 =E2=80=94 Justin

On May 3, 2017, at 4:45 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

As the more experienced chair, I will defer to Yaron for guidance.

So far no one has expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt <= span dir=3D"ltr"><phil.hunt@oracle.com> wrote:
Depends on what the WG wants.
=

Email cases,
Github posted document,
Individual IDs posted to the working group, or
an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft = ;https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03= ).

Let us know what form and what format.

We can also use one for OpenID Backchannel Logout.  This is particularly important because it will be triggered by (or is related to) SCIM and by RISC events such as account resets, authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independenti= d
phil.hunt@oracle.com

On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

Hi Phil

per 

you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose.

On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt <phil.hunt@oracle.com&=
gt;; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SCI=
M
> case. Happy to put these somewhere in a working group document.
<= br>
On Wed, May 3, 2017 at 4:16 PM, Phil Hunt&nb= sp;<phil.hunt@oracle.com> wrote= :
My understanding was you wanted informal cases not IDs. The SCIM cases have been posted to the mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independenti= d
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

P= hil / Marius

At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v= 2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d= =3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D 




-- 
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-= 3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D= RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0= FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgA= hF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS= 8&e=3D 




-- 
Subscribe to the HARDTWARE mail list to learn about projects I am working on!
______________= _________________________________
Id-event mailing list
I= d-event@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/id-event





<draft-scurtescu-seceve= nt-use-cases.txt>
<dr= aft-scurtescu-secevent-use-cases.pdf>
= --Apple-Mail-B7D1D1F0-BCC2-42A3-BEE6-CB7C56B6A1EE-- From nobody Wed May 31 18:24:28 2017 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC748129498 for ; Wed, 31 May 2017 18:24:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rWNQZbLof6JX for ; Wed, 31 May 2017 18:24:24 -0700 (PDT) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7949A129666 for ; Wed, 31 May 2017 18:24:24 -0700 (PDT) Received: by mail-qt0-x22a.google.com with SMTP id v27so25919304qtg.2 for ; Wed, 31 May 2017 18:24:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=sS5BZHepM18Q3LftLZ/FwEExOZqyFIeDwI4b4DM0R9o=; b=e7OlWizb9t9CBvpS5mf8lup2fX0ahwNN0H+HNf3CRfEK4O2D9b1610zhTrhI9ItJRw DOZv7KLO/mSkeZL5bY6IrAnK0VEgxoxvHmuviaSCopXdI5wJJXkoacqzIe2VEHOvXk3+ KiEKM5bdUvU3EMbgAraWd8m++F5HdQgk1w8sK9SQO/lfg1eH36M6uXlqK9DXJuP06kkT flYEPeztzuSoXmlWKqSbqAVIlloN88x8xD3Iks5BifDLXTrGtsjIl25EC6NQn301atIy e6RJBXZRx3xJBkUxUuOMV0PfU9Uu/vIgVDHbRxvBG3ZvxuHU06cWipBg8MOk1bWaATmh AisQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=sS5BZHepM18Q3LftLZ/FwEExOZqyFIeDwI4b4DM0R9o=; b=LBe5MYMRCwjarqEPbZtZ8C69k/aFFuEs9RGbBteUL9XAx6D9K5b/jpDUJBFlWGufqY JpL+TRRHZiBWl7Ku1EAN9hQiHubhOw91Nd90sLnZLOp35a35v1RSXsM3awOXQVlko78C W6mky07FWSRLnh03z3RBH88nLy5WSCPWFI+lkCchBr+1eXqv1wR9OvpKUP/i8USQNgm+ ANcgOBGD5bLwAeeI45nd16uM0RuzhytdvAagt3Oxahfqwzff7j8+OKVKBRrJLjGH7ziR pPC513fzy6MEVPukYXJFHWkOrZMhYQEYosrQI/02rn3b2wrsjzvjCil2poICn3VSD1ve hG5w== X-Gm-Message-State: AODbwcCniTD0lh/Vg7dIfKw7CAxCZitL0Q5MLrrwa2lDvgIYWbzcssIu sBMgNAe2EPnP3PlrUjcyPgcVhmUb5w== X-Received: by 10.200.49.100 with SMTP id h33mr36273203qtb.52.1496280263472; Wed, 31 May 2017 18:24:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.108.34 with HTTP; Wed, 31 May 2017 18:24:02 -0700 (PDT) In-Reply-To: References: <2104A459-8402-4498-9F7F-3EED264DB4E8@oracle.com> <2F79A80F-AE98-4372-B096-C26ED77F4C3B@mit.edu> <10de4c6f-c0a7-9d9f-c524-fa87048dd580@gmail.com> From: Dick Hardt Date: Wed, 31 May 2017 18:24:02 -0700 Message-ID: To: "Phil Hunt (IDM)" Cc: Marius Scurtescu , Yaron Sheffer , SecEvent , Justin Richer Content-Type: multipart/alternative; boundary="001a1137715896bc6f0550dbe5f6" Archived-At: Subject: Re: [Id-event] Use case document X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Jun 2017 01:24:28 -0000 --001a1137715896bc6f0550dbe5f6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Agreed. There is no requirement for these to be in the same document. On Wed, May 31, 2017 at 5:33 PM, Phil Hunt (IDM) wrote: > Marius, > > Go ahead an submit as an individual draft. I will submit scim cases in a > separate draft. > > Afaik there is no plan to have this he a single wg document. > > Phil > > On May 31, 2017, at 9:22 PM, Marius Scurtescu > wrote: > > Here is an initial use case document, for now it has only the RISC use > cases we discussed so far. When Phil gets back I will coordinate with him > to add SCIM use cases to this same I-D. I will get this into a decent sha= pe > for the IETF meeting. > > Marius > > On Thu, May 4, 2017 at 11:28 AM, Yaron Sheffer > wrote: > >> Whatever works for you - and that's the whole point of *individual* I-Ds= . >> >> Thanks, >> >> Yaron >> >> On 04/05/17 18:25, Marius Scurtescu wrote: >> >> Do we need one document for all use cases (all profiles) or one for each >> profiles? >> >> I am happy to create the one document or the one for RISC (if one per >> profile). >> >> Marius >> >> On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer >> wrote: >> >>> My strong preference would be an individual I-D that (as Justin says) >>> will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF >>> folks are used to, and it is referenced from the WG agenda and minutes. >>> >>> Thanks, >>> >>> Yaron >>> >>> On 04/05/17 07:57, Justin Richer wrote: >>> >>> In fact, I=E2=80=99m going to ask that we *not* push a use cases docume= nt toward >>> RFC. Use case documents are wonderful tools for guiding development, bu= t >>> should be discarded as artifacts of that process once said process is >>> completed (or even well on its way). >>> >>> As such, RFC, wiki, blog post, or anything referenced from the list and >>> easily findable works. >>> >>> =E2=80=94 Justin >>> >>> On May 3, 2017, at 4:45 PM, Dick Hardt wrote: >>> >>> As the more experienced chair, I will defer to Yaron for guidance. >>> >>> So far no one has expected it to be adopted as an RFC >>> >>> On Wed, May 3, 2017 at 4:39 PM, Phil Hunt wrote: >>> >>>> Depends on what the WG wants. >>>> >>>> Email cases, >>>> Github posted document, >>>> Individual IDs posted to the working group, or >>>> an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has >>>> RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft >>>> https://tools.ietf.org/html/draft-ietf-oauth-use-cases-03 >>>> >>>> ). >>>> >>>> Let us know what form and what format. >>>> >>>> We can also use one for OpenID Backchannel Logout. This is >>>> particularly important because it will be triggered by (or is related = to) >>>> SCIM and by RISC events such as account resets, authentication factor >>>> changes etc. >>>> >>>> Phil >>>> >>>> Oracle Corporation, Identity Cloud Services Architect & Standards >>>> @independentid >>>> www.independentid.com >>>> >>>> phil.hunt@oracle.com >>>> >>>> On May 3, 2017, at 4:31 PM, Dick Hardt wrote: >>>> >>>> Hi Phil >>>> >>>> per >>>> >>>> https://mailarchive.ietf.org/arch/msg/id-event/FGuz9IsUMKqKe >>>> q2OjEBjCZ9cBcI >>>> >>>> >>>> you offered to put them in a WG doc (see quate below). Would that not >>>> be an ID. Also, as I read over the document, it is hard to follow what= the >>>> use cases are as it is very verbose. >>>> >>>> On Tue, Apr 18, 2017 at 11:27 AM, Phil Hunt ; wrote: >>>> >>>> > All, >>>> > >>>> > Dick asked me if I would enumerate the SCIM use cases. Here is the = SCIM >>>> > case. Happy to put these somewhere in a working group document. >>>> >>>> >>>> On Wed, May 3, 2017 at 4:16 PM, Phil Hunt wrote= : >>>> >>>>> My understanding was you wanted informal cases not IDs. The SCIM case= s >>>>> have been posted to the mailing list. I believe Marius is close on th= e RISC >>>>> cases. >>>>> >>>>> Phil >>>>> >>>>> Oracle Corporation, Identity Cloud Services Architect & Standards >>>>> @independentid >>>>> www.independentid.com >>>>> >>>>> phil.hunt@oracle.com >>>>> >>>>> On May 3, 2017, at 3:56 PM, Dick Hardt wrote: >>>>> >>>>> Phil / Marius >>>>> >>>>> At the Chicago meeting, the two of you agreed to work on a document >>>>> containing use cases you considered to be relevant for secevent so th= at the >>>>> WG could decide which ones were in scope and which ones were out of s= cope. >>>>> >>>>> Checking in on the status of the use case document. Would you provide >>>>> an update when you have a chance? >>>>> >>>>> /Dick >>>>> >>>>> _______________________________________________ >>>>> Id-event mailing list >>>>> Id-event@ietf.org >>>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>>> WwlNKe4C_lLIGk&m=3DHWdy4Q9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g >>>>> &s=3DJTwCxbXPzY_A62IiywTMIjRB-XsMY8UPafBs4oPwOTc&e=3D >>>>> >>>>> >>>>> >>>> >>>> >>>> -- >>>> Subscribe to the HARDTWARE >>>> >>>> mail list to learn about projects I am working on! >>>> _______________________________________________ >>>> Id-event mailing list >>>> Id-event@ietf.org >>>> https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.iet >>>> f.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3DRoP1YumCXCgaWHv >>>> lZYR8PQcxBKCX5YTpkKY057SbK10&r=3DJBm5biRrKugCH0FkITSeGJxPEivzj >>>> WwlNKe4C_lLIGk&m=3DbAI2H661a1QkItfplrd3RIM36dgAhF4WdbWxW8BOy4Q >>>> &s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D >>>> >>>> >>>> >>> >>> >>> -- >>> Subscribe to the HARDTWARE >>> >>> mail list to learn about projects I am working on! >>> _______________________________________________ >>> Id-event mailing list >>> Id-event@ietf.org >>> https://www.ietf.org/mailman/listinfo/id-event >>> >>> >>> >>> >>> >> >> > > > > > _______________________________________________ > Id-event mailing list > Id-event@ietf.org > https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www. > ietf.org_mailman_listinfo_id-2Devent&d=3DDwICAg&c=3D > RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D > JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DgwGItrqQynlr86zXGtWnR- > LWrcrcTS6Ly1w14yDo0vk&s=3Dt5e3IvZ_e-KRHUBVMfjtwKEs74yLZva4z-6OkkgmSjo&e= =3D > > --=20 Subscribe to the HARDTWARE mail list to learn about projects I am working on! --001a1137715896bc6f0550dbe5f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Agreed. There is no requirement for these to be in the sam= e document.

= On Wed, May 31, 2017 at 5:33 PM, Phil Hunt (IDM) <phil.hunt@oracle.com<= /a>> wrote:
<= div>Marius,

<= /div>
Go ahead an submi= t as an individual draft. I will submit scim cases in a separate draft.=C2= =A0

Afaik there is no plan to= have this he a single wg document.=C2=A0

Phil

Marius

On Thu, May 4, 2017 at 11:28 AM, Yaron Sheff= er <yaronf.ietf@gmail.com> wrote:
=20 =20 =20

Whatever works for you - and that's the whole point of *individual* I-Ds.

Thanks,

=C2=A0=C2=A0=C2=A0 Yaron


On 04/05/17 18:25, Marius Scurtescu wrote:
Do we need one document for all use cases (all profiles) or one for each profiles?

I am happy to create the one document or the one for RISC (if one per profile).

Marius

On Thu, May 4, 2017 at 3:36 AM, Yaron Sheffer <yaronf.ietf@gmail.com> wrote:

My strong preference would be an individual I-D that (as Justin says) will NOT be pushed to RFC. Why an I-D at all? Because this is what IETF folks are used to, and it is referenced from the WG agenda and minutes.

Thanks,

=C2=A0=C2=A0=C2=A0 Yaron


On 04/05/17 07:57, Justin Richer wrote:
In fact, I=E2=80=99m going to = ask that we *not* push a use cases document toward RFC. Use case documents are wonderful tools for guiding development, but should be discarded as artifacts of that process once said process is completed (or even well on its way).

As such, RFC, wiki, blog post, or anything referenced from the list and easily findable works.

=C2=A0=E2=80=94 Justin

On May 3, 2017, at 4:45 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

As the more experienced chair, I will defer to Yaron for guidance.

So far no one has expected it to be adopted as an RFC

On Wed, May 3, 2017 at 4:39 PM, Phil Hunt=C2=A0<phil.hunt@oracle.com>=C2=A0wrote:
Depends on what the WG wants.

Email cases,
Github posted document,
Individual IDs posted to the working group, or
an ID that gets adopted as a WG draft to end up as RFC (e.g. JOSE has RFC7165, and SCIM itself had RFC7642, Oauth had a WG draft=C2=A0https://tools.ietf.org/html/draft-ie= tf-oauth-use-cases-03).

Let us know what form and what format.

We can also use one for OpenID Backchannel Logout.=C2=A0 This is particularly important because it will be triggered by (or is related to) SCIM and by RISC events such as account resets, authentication factor changes etc.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independent= id
phil.hunt@oracle.com

On May 3, 2017, at 4:31 PM, Dick Hardt <dick.hardt@gmail.com= > wrote:

Hi Phil

per=C2=A0


you offered to put them in a WG doc (see quate below). Would that not be an ID. Also, as I read over the document, it is hard to follow what the use cases are as it is very verbose.

On Tue, Apr 18, 2017 at 11=
:27 AM, Phil Hunt <phil.hunt@oracle.com>; wrote:

> All,
>
> Dick asked me if I would enumerate the SCIM use cases.  Here is the SC=
IM
> case. Happy to put these somewhere in a working group document.
=
On Wed, May 3, 2017 at 4:16 PM, Phil Hunt=C2=A0<phil.hunt@oracle.com>= =C2=A0wrote:
My understanding was you wanted informal cases not IDs. The SCIM cases have been posted to the mailing list. I believe Marius is close on the RISC cases.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independent= id
phil.hunt@oracle.com

On May 3, 2017, at 3:56 PM, Dick Hardt <dick.hardt@gmail.com> wrote:

= Phil / Marius

At the Chicago meeting, the two of you agreed to work on a document containing use cases you considered to be relevant for secevent so that the WG could decide which ones were in scope and which ones were out of scope.

Checking in on the status of the use case document. Would you provide an update when you have a chance?

/Dick

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Deven= t&d=3DDwICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&a= mp;r=3DJBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DHWdy4Q= 9fHAYB3f-DZ2GWUJnaZDGcZQRaMexC2oHuR7g&s=3DJTwCxbXPzY_A62IiywT= MIjRB-XsMY8UPafBs4oPwOTc&e=3D=C2=A0=




--=C2=A0
Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am working on!
_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://urldefense.proofpoint.com/v2/url?= u=3Dhttps-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=3DDw= ICAg&c=3DRoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=3D= JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=3DbAI2H661a1QkI= tfplrd3RIM36dgAhF4WdbWxW8BOy4Q&s=3DfzkXYKa7l9vPc2VrpDeaBZo7bH9cDrk9wUethVbuCS8&e=3D=C2=A0




--=C2=A0
Subscribe to the=C2=A0HARDTWARE=C2=A0mail list to learn about projects I am working on!
__________= _____________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event





<draft-scu= rtescu-secevent-use-cases.txt>
<draft-scurtescu-secevent-use-cases.pdf>



--
Subscribe to the HARDTWARE mail list to learn a= bout projects I am working on!
--001a1137715896bc6f0550dbe5f6--