From 549e95f02f08c4e073f2eeec82ff436b0fa1e756 Mon Sep 17 00:00:00 2001 From: mposolda Date: Fri, 10 Aug 2018 17:34:19 +0200 Subject: [PATCH] KEYCLOAK-8029 Documentation for Kerberos cross-realm trust --- server_admin/images/kerberos-trust-basic.png | Bin 0 -> 31433 bytes .../topics/authentication/kerberos.adoc | 41 ++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 server_admin/images/kerberos-trust-basic.png diff --git a/server_admin/images/kerberos-trust-basic.png b/server_admin/images/kerberos-trust-basic.png new file mode 100644 index 0000000000000000000000000000000000000000..b78a1424fef9abe831410c3c41ecd3799b6b6818 GIT binary patch literal 31433 zcmcG#byQr<(l1ODO9)O9f(Lh(AOV7V@L<86!F6Dszzi>LvRm+OMu`KAcF*l z!3P+IyUBCTE9d>rz291QUH%yM^scV1s;=&;{&h`+rnlk<%sHuusf}FX`Z)muDon3+6SXkmxzOLq$j@F*E7S^`*E)w+n&F%EG_Er+~`hsda zYOb=@cJ_+??$+A=>N=MGj+UZU^iqsRvs7z_9&L2u{j=_Ei?ho!r{tEWB4h4zM{xdq6}Q-U6l^lufMUH^lvi^o6A z1Q?9l*W8txmy72{rGFBtsr~Osot^)K+Qaj;^?%Cy|H;@x$IsQ8`?a+P$jjXlm^d4T zo1t9AWZkXJJwfg|Adu5Pt*B`S@&tLmPO6n(%$8!k@Zh6H8n9M7Y|Q! z7fWlUR}%C9A1-@)D=|S)K~Z5Dd0BoLQ5jxdIU#8wd0vrMGNQ7tLiYBK>dq{iCndzn4Yk z-}dDOgyFuK-v2V)|7-$$=;rZ1oEP}=AMS7M0{FZ;;M@dnKcRs&gQcmeBe%A;c71*A z*19SuCpWx#ib7-VM~tM8?mYi6+5h__c3=|=_Wk1IX#4c? z*TGgpO880hQkcXV{<>FK4Wrq>}H8nMV{q`@qoZLk*wob2moHyN zM@O;3hpVfrKYsjZY-|jLLf^c3OKtgH$O3VM2a zy1TpKaCmELYkq!ya&q#gPoFX~Gu_WLJ76t>Zhl z)9UwW62+5NXu6XktmM=ogn9_pgJIw}5_dY+zJCL&P1x zl+Z_jjsB$(`1+?2p!q}jhX$bh(-G+YZ#(`sZa4FEL-}900aJoQ^Z$_B|4yktvPlE} zaihh5k&Ti3Mj+tDA8r3w1ek<>vB-Z@?7!F!aJoN~e-y()g#0n(zi|7X_Wf6G|FA4z z8mVWb2w36$_FjC4C^^pe7=62h=jXQye^G3F8$>KAIUt{WjCKz^5k30TFEHb^J{z^ zD_kZiB;VMRdDi`a^7xOvcgU6^A(XBK92VA1!h)MwN_kinA5P)Slfe`z)E}zv@`+wu zRD{(0f@F0U#=px>k)-fVwcmu@BD(j^j5auP2NKBB^(*Q&V70dTzR5Xf0t$sTnQfnV z%yQpUnUwvcW3B&oXN*$WrQjfIckljEGD@9ZWijybU_(A?UsmRFE$mU84nD?0L)aMO zn`g?ImFaef=pB3^k!r!-c8)rjAO6Ot(hI2(6Q2nJXQjvoXg^(s5UEc3!i7t!C%0Tz^3HKCs09(0?GG zVkUE^r6MZr_}6q8s;!l|(%J9HLmx6=Djw0Jb8+z~a0yEF;^`RoH`5kAWlHBSeYTxHp7y>+WqP}p%|J3^QIwU-x0<=)NC zlP?k3$7nfy_v5J@FiYLI5h?&*a=UeAv6aIr5Fr!sqr~TVgZt!)+};CO=AiJYeGwYz zOZTYFzf4Q<`tEGCdH7#722EuL`mTvyiRLC*pK@L6RxTYX?)K|F2wKRaPNx^UUgz`= zJQfrDsY@t{19^;S<|w^jTQITd->s}c-D{q8>XkY+n{HCJ*3qt!F~4+aW@cJ(l$<5S z)6LL8bqx%nJew_u5EO0wC8NR(Fv#6&)}s+vg+{gQfx@mdbf0IQXND{ix)H;XRAA4E zE{b7;>{Z!InVfaq-kGbcsd&J6m3#d=@)tQq5DfY5w&?q=_2XaJIH$>N;xDILI@90> zNZL(`pc2y@jl{1S6aJZJ&r-MV`qa5EPiqGom=wJazVFO`D@F|PpCB9r^UN+m#v&8h z@br_{_POB%#t9_HOAZ2$PG%5uI{GvvDk!`wRt;%w3L~;R(8{)Lw%>CxGKvUx9o~xj zQ=0I4$Q7zPisG#O;zxAUS(xl|(n5P~^xb6TQel;|sf+Jk(+ue&9NkaoIvncek5OLR z8CGM=VD^>bYb~cbQ{I;-nb>W%ITtS$1bZ20h59FR=u&R#?PSoD%eTU#Lc{h8n zB{oD=mNhgK`{&`+A|Hg!oI+0+>_mw0o7nK^AN;$(2&j` z0QM0YW7O}=?z`*;d_K!qgF$yGUPf;85~ZI^mrW8T!9Y^} z@{i?FDGunNFDo1-Pj5N@nR8b}eRGR)iKVOk4{H4tkuFHUGJuWK z?erg&2Yo`qoXTaExSzCzKVSrN+?%{_9D&1%?j%X+v7h?K%}t`do>e3j=P}nSpl~DQUbl?sH#Kbl{pfiG zfX4Qa4yK{xC-|;0^Zk3|-3tg1E6@liH-mCpE&DOkM+_j$V~59(`-;cL_B3@B(N zPcPzg&&MieK-uhfG$d0J-Tr9b83ia|8)?@pvR4)l(v53BN2cQ9@%;IR>~~1pP-Ol* zbKWnoMf>n;rwsCG(!ho5C4{kgmsYC+3NNs3!ojX_cW>$hH#^dfm%Zi@m&JDbkq|Bc zc~G!U#0E)`Cfs)0_51Qhb*~UiC=NylL{vD9I*PQon$1Zn`5@)$jj?M*fW>nQGRa>5 zX?C#jMwxQ@XQ=;X9u}gsv=*i6~Wwseyjh%Og|w9x=+}=#Y_1LY@d98 zYmHw4#dm_oPw=4Ro|uef&xveWAt=S}+w8Iz@xF7X{tUMdF`w8`vSBGiCSXp;2^l!oJ0_V96qj|m_S_n%}&_% zn^K?SeA3*_<_Q-BvpCpJU*schSI*!m^brjS7+z@iT<|wejopcG4gq)cpE z8I;2JHxzmtq54^OlM2!p!0x-&#?n8F3rIAS&%5XIh$o>dSC0}_OyE+Hmd9rfX%~%? zUONJ&2xW$v@ zXP?oBKWs3)5{o#EM70>^fKG9iqAl{j${S2Ml1<(Ju|p!+tk^UmR=ZY5O<}1)vPFo{ ze+B-^Mm!WY?evhBKhlFGAUUK$ugHPOz<1tOqZynwI zrq^*hU`xKshQTK0l7}EohGZ!pzV9)rfM-!Tc3=#GW_hM9zP?`_cB5O zbs>L8a&s@;Humnk2IvlxX))yi$*&C;y$0438o%_r*tkol)g0$BYUVzxdusUf;7F%Y z_Oknt#20z$P+d)_yTG;?<~%mL;V?!wv9F8Q>x12@CI&M@1gGzkwY{4#Ae&2Ncb%1q zf0~Uvf5lq1MbE%sHFFSKxlln(k6sVfc}h0-u@+Yv1~U2BthCG;7DGdIN0!q@2MY3# zLtQ>cEFHyn-X z%g)9PlH@`vHt^SzfM*UnW}KOdQjyxO6my<8%iSER5kE6rm+j~~C`3lEJT4)`G_73F zw!T?Yo3dwOt2@)q)$I?meJF{*cWW?aZkej7v1_YlC!OM;gCfsSy&@^v0wx5K%FMPO z-@p^%*dN8lVbgVG^TL@4u0GJJMSmWYT*jgsnGS_egw3bw`_CbDMJqzHn$6~SY53f) z;LLi6pXMq7rY2X#a3g&e2RjB{8(egJQYj7H0pua2xV}xRWGdcW-41<9}r1W{h+s&=5K=@^LKdT z-#-Zk5^Ory2>$FCG|fdY=p@9%e6mrv@)I*_6Y;{^;3mx*KAGdEp zbSXEahp{s&50~g);`mQR0V* zQTo|IU2u)$tyI957)T&>_lepZo5HUUBYTc5@hR@xp%-*FzWEA;OJfE(IrzF*du$!) z2*DGB(>_@;5BD3Ht=cc=3b=%h*cy9?P}{r@LR43DcovFNRXAF>9(XD4?svertHsAc z3EQs7LI{az%sggHR9I!*()Zv#U>~3PL9W#|ocv9LwFIrMT5p;$cBXqJ8QW5dr5|0q z1?PRC8bnkx%kt@f^KSux?L(6o7BGUj_??Dhd*-L)sVPhl=M!46J<+}9nrDe-s1!D(sQ`|es3Q4dw~cp< zNk~@d^a=?@6e(zo-3c^+GtKB*cgwbqW;{pkkB88M&)D>ACWU($T0(1`u1vQB6#^#s zqkEZw5E)N%Mihi-E*aNL^l@RJ@>?o%H7;G1#Wm}xK=<&XRgIcCFG|@7e~n-v0ze-Y zf39Uc<(vpC^;u(`u49Q*!%$T|N35t;s(x?rS*}a3tsOU96F5lYNNJ)Rb&WnV>ckFmb5-bGW(-YkDu)d?R2%Br z?1dIS-d#9v-WZWmf~7leq&6Yw&8`TqRCY|$E;iRUHfTx$yHx@YrZ+asKq}ToN1_+{ zi8XsnhM$*+uNr4OVy&ex%`e8V@vi&c*>O+hRtht9vP5lip+9)oQ0TQPcl@LWXXVLU z;3qr!auF~rW}fWXU&c&<)t|x`o#yCb&aFLkP$8(Ck;N{rraM01S%vTg^STmbFUw*> zXG>?TkMqPK%}~j-3t|vTiR*tvVDf1g)^^9Hb+NvM&CFNLIu=v$;P0FPtAEOv&HLbV zXF$>XE5L4ICaQVLQ?ikVTWOw(S3#;P3vMmelZI=n0(U1HKu*${L zi?%NOiE$$ZY%awiro|w1N7+|uKd;KyNXgOe?EUtX`*W`&DDxs_y1we4nY9?G3_wl6 zY1t#FkC>hE?7bz(nc^pwwqFZZJ{2FIos3uRwJS%QSv{^hE4kfHIu=gt=bmN!B0A8CgJ@M3CsvR^|Dz;4{ z%6Z`I)3#3RpRQuaha>UVR{A@_2Mx&4)>X1@f>h^xEf|@{Y!n3kB@<+i4Vltk{1=kltWff1^A9N7(8=@va*f?xz0@ zJO|INg%`GY-f!B!O)4F_&JExkH}7b$JzqWFGVO-m}`+9uz6fBmCU& z34nzgE%cT1Vm#01hPVW zD{AF0{ks&upz zB~+u@N0OiD)vk5&WY}Vp({Yu^^^R??q&o`rY3owsK%o7ql=F)cCk_pY4^dh@bYbz% z;)q~|XDlexCc|0b#|Dghr%Ha`6C@{{F`P9>DMu=A1rGd#b4rJ20?1RVW zA7BJ=a(ZN2zqB6_v+%6h{diJXQuoDYQIod*C8+5pqQb^f8So#z{E zYpBQBTnXfY!EwHe7Ie6`r3ihe>zG}lsuwv`3{n!b_Oi54FkvbqQ?44tW(IkjUUKF6 z98HI)m-yn6-P5l}@C7g=HE*?4Xg=FpANN0)334gG&yMAJ1xctQ@^p5o=IJeKZyv2B zBapL{F3p{&C?9UQeDCWc)sfa=aj+95Lu5ZUSYCEUm0tVm-p&VlhJ(sH;K+448pb(0 z8VxvJ4=4EZQOMMisRnb~D8z&{S-7pbDPU<}M2d>^=_XuXYT7Y?v&~g%u&jOE#d;)qm>A+nX9X{gIo@h|jE?hYF!YR!5%w$V~l4z5tO_gPo$@pCkaIk;d0@oL|KiQQ$ zxPXCXuRCx3UL|Oqs*4PtL(PLmCdUZmAGW_zDX(_&30AJ0E*%=nYvAow{{vU z{3^Y2C&=#Cmqdfh4fDs0a-|xY_h*hZjF8x6a?_HK{h&{zLHU8nIJpP5bx2mcV#y13 z2T1^IDF7)iwT-*X{`i&%J8PFdpZT>qFims8YRvz9>0^x?h!-+nN8Wo<0ODq5sR%q% z%czm#3qU1OwI8{)2Q$s-$6k&6zVqGrCt$`wKdI^ zx!T2vdp>q`zWS`!tUl+TKBUL$@|ExFX~^usN+-yPE%4qpd7G$z7#Y5qNd8v@|M@PE zp|l>6H9rN5w(TTO*+5XzmAWErb9=Ukx*&k7?>3S0QKB^fE-n-sDTUN@l0D&YA18lwEkRijaKODAx=0tXV8; zWfuIY3BD$$#7JCZ?3cR$Hj#3yWRzu>#G!c%WY@K+<=phezu>|?J1S*HJ%ji0&HBdX z9-K3yV3 z5VB)ahvclUookliLDYXBDN_YidJuImXHB%b<3i4`%L(waUAL$>TQ4o!<_>VMw}%}? z;MaTGVfXT)4f4LsdT9ix5rpmH#@>V0zv=z)eeK0k5%CZZYA3GzJqT8x5=!y_XRJo= z)_$7L4+-1O#VH2iu-yQa=2MU0KAdUGT}&lYL-)jq?mBL2y7ti_3`mvvbuI~dVmx@7f^@;-1C z5~qRMes(cK2%qLYBVFr&GmnuB(JcKoQasy;`pY~m2w|k5EC@QiUvYTEXEBM*nUFG) zV;?fb0QQbk13_o&_>E9}iIQ}0V|70v%WfHc0O)tEhI zET{%J8MGlY-+rr6CMRa&yljk`~7Pr75 zrPDq*?;URr&u$7Rxg6*=iVfH;7qRWH}$u>gO50$)lZA{LBE*EMg z5p%X}LB^TlQX?ESQji@mjUQ@w$phX&5V{vHQEE;d8+fGz6(P^IPbhO90$^IS1`6C$ zKc#^|AnBmjuS>bTaoZOez-Z~(GPvFNQ~F{poNR;RTp_hLL5Z=*T7;45*2x+zI*k*Y z^Rm>xl-dv_rIfhar%R0(w1R57ZzUT-{Dg^U!Kb0JOI3%_8QT#_{`V>B-Ji^}ZX!%hOG?^=uzhhXH9Ot2;ZMY4$QPdcYO>b5-$O-e%qu3x)ihsI zk>Cwce)^8$9rwyG9!yDa&xWq8;%rgOa8{v}bf#Ju^7D`wEQJr%NNE-Ol;l_9fF5uz ztY~OjWvHh1oc28;m0R@&pJch47@miSL?-;$8dyxKY!CQRo$MMI`?J#|V0z_EM_ja% z>g7dVPVrQtFqBeazd{tG1)>q}rIV_EaK1Fe&=eeJeEWZO1T)Hw1Hy%6lAylCczR zO9zV?x_w0~Bj4CFO^W_12;!4UB==QGGFoj(9~p^$-okHV$i|=TDm?Kk@sQs-xNutukbz*)x70(VY|M%B!pW4$$w!bK%B`I( zarp76eFK@?BV#$)3yELv2$6%I_*o-Q<5(15G~$I?1p}!)XYKset^D(EvaUPdJ{NOxQ0im)cd2 z`@5Rr!#TYDC`{*fDkLvyT+f3EbJDZF$Nhd#|Egup2YXQ<>wP^MQM8gOwGRXfK-3%h zqUn!2+rC`uamKM-?Ob!g_>TK>y`#egbNFkP5k2pMxJGqwgU>r2E};wNz_DD?qaHTuzzs+wq4GTv~nRv z{-K>3-0aAH@FCg~2x;V-$(`*2gKLhuoTK*mfNkIE;X;BIAMJnaGW)t+g-mR39e-lx zh<463HnqPh*!!jY_s~x`(DM*#_A3L-dfd-;g`ktpMyelXyLN`OQb)U$*xoxRgja#F zB$c3bL;u-S@{ahHfFQLm-DE*UW@`e_XHH6m@+F!8AjTrmyL6p4`~r zogo)m>U{iqh5LH>>>nj0HqFTEO(}GS)aBJaaIth_?;&@@b=LLS2xjZ7{RUtE+4bTQdiTGQ^+V2RuGh@ai=AfIj=MvGwy33 z0lMDde%HUYbo&oihjdTO{Pk)(-h+edo&D=epjSJ3{Th#t8gS?W+DndmH=%`#AI#Ul&VAOSmjE%mIKed|eWjQ@ldWe0!EZy!1nx1zoQIaOhT zhyL1Z7Hto-obIfRs3ElP`h9U*Pjz$CVERJ=Ih=Q&foF>6+wnzgL}_k4uG)1HPnv6F z0;ebMHf02NamP>y?I=Nq?f}OM4HqZ*O3wXnUxnOz0@lpn<4)?u+L0%sz_5(qk423q zi!AA$L#aLZ%Di>0_xT>(;Or63qWWB7a=EdH^iq;`Wa*AXv*ByWl96{Wohxv%>HDUZ z4dQ=1iFZG*}R1r@kRWn;mx6ec+Ne1mwoPWkClwYBLB%dHFJR;~Mfm*Rj~JyjAgy9f=ik^1^LJ*&`)s#;iu`sj4p zSr=8&iS4^X+h(NFXD5y5=KaE;N4&Sv)@M$H)L#evFwz8k04i107T3_Y2({$Ts&*t1 zjW@Fkx}Yi?&PVg{V0OqP<&ciemqeC)?mbbP_{=Ov#uDQ_5n>E%4yw1;LI95;nejIp zj$q1Cx7`tI-XASFjVkP4b4;A!E$7;uY0G z|Jxf>8uA&>Dd>l4u>!d#crPhC+bk8Mo`AFCEp_KXc&*7Z&VQr>0^e z#5j>-+-+X3+{;%l1j~G*x(_UQW>r+WmkLvy6#-PL83uBw82QMtC2Wb{z5~1j6k|a* zD4|VZv}i*v@ZK(5FtNKOU4Q|w*dus0aMARkYd`reJbMj3U87-fN_Vrb01DB3kc68F zN6d!Zj3A8~*FoWPy}eI$v$k&D^ISr++gmufE4O*b1Ha2}+I8FCbh=rdHu*^IS}Px~ zw9H^*Oig}UsY+_y;~R)m5Ix)y99*{tb8jru5Nq0jHUv}h&5pnLk>I|jM8@F8)CUsaaf%L2rhokc?`sFW})TW7IPS&D(nB=T7{ zlC=??WQ1~PZ1I1ClWnoNYQ%o3FVR|Kuf=q550@?iyf9bxf`C&2)AYU z$f+UwRK3$Jleex3`gmQ&SiGuI+^E<7!Tp$?nnoWojbJ1;u2lPhGxRvIkBtiu?4b8i zGc1mKRD=^6w*rIzTu+Ua^3BjqMado9&S>=3w)F9H3ox0jiJ}02Y%P?qfEX1#XOhlp zEO}}e4>7)TA_RSZKVPWu@x#o%{1oQcL28-Tm5H+VtNf0B+w}Y;GJfzN7I+R`0U_qKM2Mog{jP_u;CoN-N6v83tKB2>${P z4<|eVDUtEkz;QNHEX0T$f?K4y(J|Z8RpN!W_&x7A-0ZlSe%8i-Wc(J~=To9`Olv(K z2FqOaSU(33GcIl$+qHJ`4saygMqI*Za!BPE^n@}(A6K{w;bgB@BYlXE+#MVZ#2TyX zaeDEoqM%hvUf$M^m_I+@_TKBKAYuUS`)_u$eE9XUdD^%#N=CR> z;1Pi!#p2qB@AJJ$)E3FH=Ak-%dQXyjwmER5-X;z6j_|u}rn|+CrRl*7QO-{pJRFtY z5=W$F{y}5U4p?(J-F?B{Er5A&8Mk4ZUZ%Qy!l}q_BNW`zqm8v2YBiYZa4ub z*!w|HGYlfb)h+#P#U!lZs-w+?A*=+K5W_(x*{D}&rT0*2 zHP~6vSTe=lfV7sx%_uBrUXNisQ}t%)^XsD)j1LMj9~N`eNlt%AOiZow!Gmf1B5uP6GWuLh=>I|fp@a#soS!kZ0(*E?XAr7i1DKr@}h?U#y6%W&g7%3mG&uJBg zw?;Imb+m&j?mJrm8z>{%D6}Wic2LmT-7hnz>GN{z2T>TDS^sI;g=I%VBRQ`hQEn_n zQMfoSstlTckEJ&GCKIzQLsE35PEL?2r>)m)Z$QCY&=Gxd-V?g}lv#qV?D7(ivscPKU|Uy|E%WH61!jFmih+O3t!~?IueiVM6!+>}qj}ghKEiQawdD zkN3;Zp67DdgB>Fgu0{KGwF0$?cM&7-hnnHK@_Q5LUrO{DT0;P*URTPLP?XDBdeQ@G zz{-!Bk<*-pVul?3ALtQ2Q9Y}gY8obXM|Qy7Kc!$}&fYBjog?TyfRWlz1SLI1$>NK4 z{1e+)zROYTs?bBtrQIfJKiG|$ot$881?fdAElp55F(R?`Gpke*@~DRv%}+P)zIN!T z4!#ecwlXo`Gc*p*q(@|vb-%A~eMH6>^OZ5~XQ~6v>|1{vH(MZjpugao*;*te-m{!g zi$R`6_2g;7L6jj#AJ#@|Kpw7G!~1aIlQZW`jueUwPi=a1C%p&D1W`z%^7Jo@!ardVa!-OYzsL&B)I8gyq?^+qh8Xx3lRI}|-DM?Ml2q^s6o@7%p90`24i7l1T|t*Y$X-5sEid-hLd(fYPq zU0D+wl;(o-G7HsL>7l#gI7{J7kKBN1(O#7yu(p$>%60BsPkf=g6k0~>P@r;;2r5-C z=Ip_A5WuLeR>*0XG2jV%Ozo!KDM8~Uy^@;ynWUrAgM)mn|LwE3!z)CYl4bk203&>f z(Op9}d4j%*88VUU-z*SVC~Is7qdOtQ1!8lU398!lnWS7dkA>1GX;v&zOtbthp*IzC zLD+^TN#pV+uV|3N3uk5zok||Tth(dVpaM%TJKC>9mt61<)siX4kbCC;2yi9X^*B&qMQy9bi}nOg`5tBxRRRP15VyoE`8^; zF!?>98&LpXelE|xqv_ruwD%_K`=_etP=-3U4W%!jIvh7O@q6&>WH|H32vyTjrjFeQ zB$QHH=aXP_?2>GX<5K69B-;Wdz(T;<--M@Dv5Q!5jT-J2*1M@ncReP5MQfy;HZhcA zraHwT_Ne2quUZG?8AOqbTW7bJ@PdBesY=UeOt8;2wbdxqlZSvTBL)Zs=a|8M`_!ky zlL2|T(X3>WWL3|2uR_!Un?CTT>&5ibI=vtkeq@MzKSKV)W9Go24$lnlAf_ie2iJd? zcQ(TEae6ms|82B%9g0jSYMk-gje@;$Q-Lw^<70%3srpO8b^_}!rd0Eh)>el$@~WH9 z42JgH<=sYR#MQKXL?@(*hElreJwbCj%3|zL$VvZHxzX8926rlVOGKQ|(q;B}~7!={dXdr^e&aq@BLuth&7>TzkS$&s*Ht;jAXP zikNN1D!QhkZ_KzfLVP_ZZn-L;e;TL>`{rAJFU!kV=J#doQ7*-E$ z$F!nifiVYB=@02w#QA9>n43gN9G)4uvwV#t(Z28eoiHtIG^=kj0a8$l1epK_U=0l* z@7p<^T^_YYPYDf&tNMWCxl99PTDjRNS>?t*R`u$FyPUOFg(}&NLPCbm9hc`VMdiUs z8UrtHQd;8*ZTa2lUvGUAbJUrdIe%*uBduR;+h|3^rk<037f&&btJdB(sDJsX7(275 z(4+rwSq_#rhRx0(IT2C-MTRr1L^MDh$k${zG zET2rUkWDmHnwNdnZ6eoRvYv)+cm`5gvSr$i+nY@lfU+l98cF9Qa8q2`TU_RG8>kma za@Sas=kQ(Wj#Q)@fHT$m&@twMhvOQl;tC>@=^cEH8VsH?wJ=#YQdo>$blH<~s{(2I z_?&K-G%Aq}-Oc-KI^Ydg`&=Hc096JVJoTV!K;gThXGk<}WBf`Yb~m|@4L{Bk9-N4( z7^U(2E3XS22x358zrye<=&a=c7b50tv3KDfpZeM@pYVxxRJvC*DYqx*(~-c!2=)`j z)ugL4|Ffmt_+?m<_pE0mML`wv#c{?-&%Hl6bC$fV1>f2sF_1%2XHvm?VJSlmC%>*j zKYnaE+1BfyadS+!T^aEN4QBqA6r2yU`SkgV)D>;MpAf5JVs1t(?^)i|PPf0#IU&1GAK0*vFf@alIjG!0yK=~PW-UtC=WnaO`%)6wL zvsv=@^87;lP6J5%yUiY(DUEh^*7Wpco@-M#{%mY;Q_NXxgwG?*aK z-OK!g+tRO6lC2MSj-x0F%8?WsL4EO3FI*R`_s|S;0ZL(!-aGM$({(?UTo%5pB^YBi z>U*Q`JSwO}*i)shPrBRS)%P>0JftAC&B!!^dqfylcq%um$39UlEq{=4jLo~#)Ob& zpSt7m6RD3E2v1_kkujoj4VP|{IWxiVE5i)7tpqE}aEgRs9jAekr|wxj4MxIz^hzoB z5sx}CBXX#vhwT-q_aCKD7ajFnWsmr)&)8mF7y`f0owDA!dgD>!J9wfyK>9-2g9Er9 z6NYNMw%yBjQ?w*hD^^eBDsS(Ug;Wo(s;W)$K7F_xeJ@}+Y#*LKJ5>^dZs2j1M;CvN zy+xW|AQpq-RR3ul=sJ*#Hss^*@V|jkR?F2+SU=xiCjnmznz|nU1wn{tYjxzy<=Ty` z&vvn|naIh3+T}tfw)uJegfzb{sn= zka3OdmBJkOU=yqkuIaa3pwGV-v!D<6vWKtycNy{F*;WV=ZK;Dui?dxT!m!tS-C0T& zFrkU}?Q@;WF%}N9re41X)aEbpO{fA~5<2g$JAu8}!bEJPSE?U4>@Sj(V!K-Gn;Ob@ z=L=CuGUoFp0!K1(MB?h60&4?-eu-9rAf;C^l^nHLx>`X^tWB0dq77qwH>bw3i0UbN)i zcCjCM_zHMi9& zTjgZUI8&+X3L*AZ>O#z)TWUFQ zt_NWn%FQnuq1h3WQj9=VYDjNP_)2LXX)b|wXM)13% z>UtL2YrQ>DWxjSwRQ#|ows?S{E&AB+9u9;LMsqgP>^tYNxzXY{_z8)Zow^|Zz&~wO z*quUoWg)D0?v-VpR4tM2gOEjvP{pSQs?6>uQ5CW1a(yZG<*wh9fEM`ulj5Qu4*n{Q zAM|+8i2aD#w&1P(z4V6UP{L|V^e^f<&8P+!&;_5`M!szt%<{>?_e>U{WSDB&m%6_? zpV(>t{<83-kio@^j_72^hLsSb85=m~c3RR!GI@5J;8qX{H|%b$a~XQ}U1Gy?3YYi& z+@EOb5JtMiDe?zS$@dp2tA3xWjZL&;mP%ft5?RrH^>g}V2Gfyo>Q2eA#)0Ixe6Zb-?aLsu)@Utsj&e}Wd8*^KuqkFmq7nVxIc(Fq z)zIU1?-c~?cRr}&Ec3Z#pQd#l^|jA|6G&JJkRil+i0V|4Di-^X>z0RV=)MyR5Rtxih!z>I4Q7htn5XgoD}9Xj59k0(VP-^J}vbO z3trmh1#KKNK6o6xh2Tt=8@fnUdi>cgN^U2Ku;q`aVy-NAg25r)b9@^ zs0J!*-4YErpgefl;;UAwAx5`Q0!;TZ81cfeY(r~!L9dD&?3Ooh>?ym>Em0{(MB|Bl zA;@)N1fe9ON))HocnGYLpD!`&HH8rHgNtzXM|=r3%*-FRWPgUdCE0gzx9d}1U42t% z(C+V4AE!t}nQ$)33O+!!=_bnA%9XGh!waou#)ZRv&N65EuFt?F^ERpdr)LRzbcCOK z?TA5R&NF^wP_}9eKzx4k=Z6H zLqAUNjAK{kVY2uQ_;mo+e{L7YvE-6-mFvmmk^1XP%orjuqm^N!XNo*TPU2H@asx|2 ztR=;FRgxx^VL3!pobr@9d94O~DpVtrI4zIxj{FEUfuIs3h$hwhMjn3pRKe4oqi9*t zyEg;;ug<_KxPR{b?3p!t&6+hczh&4kJ+|F%!W)G4N@F)(IO1fVM1L?T-|)j`wnVFVXpAK%*ixE@qV#>Rl)29H$IU!SDU zeSzF@-F)rg<;Q+Q;#rAoAf)WV@>^^cmC%oS@FG^cb3yT|=p|N=?B}zip?6*nf^#yP z%(_D^dvV=-9Wp%X_dO_rN6CBbV`4eyNvU4BZ1JDncY8J)Bn8%6WD#~1ej;$6K+PlK z5j-}h%wcobXpO2f@TWJ4Bz$E)x{6#bhz>Jkz4%~!@bOFif24ObRPBMPBSD* z8MjySI>%;YM%fBJj)S|`2 z9ZRkE%M+o-PdsvpyjZs$Zggc9p9trPe`t?`-|bXctj3?|oi8f&mBodAGq_g5SxH}` z1`A8LNjGS1CcEh(0N5Z{u9-;Ox<{9ye@~a=DxU<>C@T1 zr%C81(LfO|ztP-W9bnC{dwsh{sxg$UZSwpYU-qdl!HrMpZSucQ7LMkGq$9D|J! zY3>vOKyihte<0_;Gm1hj|AV*foFNj++M<$hb$E8;u9)13ZsBzAu_7aWgq!49V;`4q z6+800HNHaZ);3yRYULRNnn#^}i47aPFzVfL@WW1}Oo8AA6)Y8OM4iB?+W*3ZSA<$R zdP=8_r&pZa+m4((F5nM@_6x7{lvfs|82WW#KR?Un@&%`xui^qe;Ote9@39R*)n^dr z5dA0pJgX>WJ3i?4>`>xBTsXctEUgVz^(JufG%ec4!*wr;Sh7ZCtL$aAZD6}YQ2oe` z4}8hm=7v!^R_Y3wj1MV>rd=1Gb_E@b@5m~mQUeY5ha?x1tmp`Cb}=!vH?}Gv{?kA2 z!2xg&F~ZqG@pwhOR$vh}V6KS$NNB}Nyc926FeG}mCqziskl;-1ClSWs{a5+D7lW6v(H3?^~y^?~5 zea}!FVOOJ46pE-lM5;gQ#Wcsb>fM&G8VqdQBJ(Am#3l$#4-?R|F36-V&bKiRy6vy- z65lp!n-G{FDQ7-V&bfLrlU!7>ah*%s?Rc*H&>X)76N2@e;3gtPeA!8P&2x38g%cf+ zIWhp3-|)hiY;3GEk!A4%3kvx&b~y6ehb!|(GqWUG5WldKCM*b=^v6@gc`OrJg8S97 z=`9GM&0UEJdl-g!+X8wnQit#eZqPd~cw2w%&z_w|vwqLf#6VTb-EIfpGj!O3=}HOD ztRky6J9I2gVhdP)QI22LhuP1RQ|Y2S-7XBIJG{-swq$^aN~9glJ2CVMv`OL14_G=2 zC|7Utw^MJ@Rx{xwc)J~_qF&kCJe2y*Em`s8Y?ar*^cRH+iuFMdc#>eJfjc82;?6l! zss=V|-x)wqb@rT=ns0K(s3lVhAUTQg&hDjvv|}3-Z8b$D%`G28p$)7GCkN(TUW{2y zLuzCAOQag6Y!GL<_Ln(;xjin`)FGgYq=rmk-hzAc!DCyFVD*{> zJg5ZFK58)D@X>}2H?%V2g+lv2?$h{!ajZYtB*z2T0wi9@5c-Lx%5QNYAK@LV57}fQFIc`*+3mkadLBMS zo`G`CT`Cg%SBWKGAP#W#jSE^ZA%mqqmjaYGj)`AP8fN!zFh^CLx_Uls#k#ZDS~kYK z$sT&fB~d4bN*=zM{#iG&Lg{Mhy0#_>3@++rT0Xk2!g`L*HO*6mJP{}mEIIWWyy!z@ zc|TVKGbs*OUW$Dd3~={J8cBVf3@c_lpy2V_Y0yJgh|_l&{9N(;f;JI$eD&Hdhb%?A z-pzIgEbLcqw=iW1a@$o5jmL_} z5OLoEt%U8ou(|LbVq-Owe{}NL@q}#Si%J-r<;Of!MBNyWe~f>>W30GES_9*3%Z7&d zMOVqXIN0qj#}mCkRLLZi{t=}dBaeG`Y4}J(F)r4*%HGx&J?8^#^7w>BgP>t>@#|ob zle@Er6H~4|_cePE45*yXNlvcl9v^p-_ST&Vnd*QOOB$4|fflqSoLWT8&E4^!nlu|S zR~_sHjQbR(e$pMX^i5+&>Tyib=4IzT8M)lVK~jP6wJ`5sBNR&1UnCQTXcBhmfNB^a zqV+}wsVDg55bWa3MGKhE6u}H!08bLPKY3SQ}#DRg#pm z&%w1zp=LSdmY6*&Vh7G6bOJ=&SzOW?KrJtwid?3>*KrbIOrX_pB42rVE?;1?gt_79 zO8{`b-O-tKi}M0M6WDHj#kPI6EifXids{(Yn2b45Bt~i5jb6Q>7MU&LID}vI-0^dD z9YlOMXmly3vdf{dwbNRPNI8a5dE}UNG@UgW3B-upcLLV+3V-1oiqplt1M8{bPZ?EU zsdDm6myaqbeQ_hCZ;n$J56@E$DNAqOR~>?urwNrE<9lblt3UI5en$4u@xB*OZ4vuv zuw@(lCJJ^imFoc%qpdHeyVxp_S>A-;4hgeIp^WO3w(FQBZ0m8Fx73$`VQZa{`Kjr6{+bQv>3IHu2+j+w~Mr+~w zupEUu=0qeMS2VP?pNxlXDNVT!ylr(x6)@a#3}xWaz!YXhQ*4krY(NHA^80s-uod~Y zttUht1q+M@dhMAO7n%R?=-H83`OK~Z*(9n$>OBeaYciUN6?wd8ud>AsU=0zG9Rhqp zc50(CC;(4)VEFmAgasZq^r=e_?SlzwkQ;~IZosvR@^zTM^J;M<@WF2-x%PjEB@eml zs*t&M3|3@$9*k{!^K<*?awa8-|YZ>tVYblg1Mn(*_6npL0hJ+x%&+fI52KT=%!7OWFHwRe3!5 z`Si{%#;S}GV;1%eYeiy#JI(6!Q0Zco?v{yZ&8nE~9w~?Nl*>WJHc-k{E)3BnUw*r< zsI)o1NGv&-+U8j+vhYVBSQ_;%nPs@m^mn*`>S8}keFMbWV+Rt=+*R4wZm*JZGLSsV zTw5rFiZZ^Y5yQLVDHIuvvDV?mB7=(|0>DJIaLvRwN4MTMh{(0G7qvsSz{D6ZW7Kqp zU9Qo8w7^j>c4}kuo9!@Qa$`K0YiR0k(&$NeQ2Cv;nh2w3 zgla^3yhZSIZcd*q2=*qstE0s7MSS_phyodpoN@_7A!J>G^EV^&h$jGY0`Pl8Bs#U1 zLe7~mi9Gd8-q+|+v^me+edi*pafgR1or{Ml)NWO$bzC^E^|OUsCX&H(*muDJi?vl5 zbt}~@sV@6wa3DHQ{3?N^hhN+wFwxo_zL?=-71hxkIMGa;%|c_Io^af_&de!T!MJ={ z_83~Rk64+WV)c{Xas+O+KmY7o19{45lhb_z*-F|=djiX`fW>C~IMAUe+K3;zY>B4T zKv1YK9yHgVbmR_9oycTuzt3Vb16D;=%pKGP*(>-CF~{)>SkB`$ zj6sO^h(`umIn~sQ;uA>T_mFy-;+6a4mMruKX|K_VL(~l+BzHa{4Xf%>W8c`AyDosJ z?m1mi&*V{CGi_`M&~5cBp7`wRRGaZ8$E&YfS=?kD^DeI6z@nXFizGcDVADN6^#M$n z3g&KX8?;hNe9$c4W%3#Ykqzan326+@CVN?*gT;2~n>Q)pa6|A#uI9x#>5t~rp(vM# zn(z~9k{d3HP+rwV>FkuNx+iP>+@Ft3rAMjM%VRwpu8pX@AaTW|aq82KG#6r?dEWBF zHq?fFcMcLS(Ha4SN1wtLYc{oRzlWO59r$wn5Km8v`Uny5Pb9=OZd)^zzY{n*B1*l) zgPLfpy>!R}T-dES>I-{b-*3^vQbI=7^5%MlJuwCOKh08C?@!bUJa{8AOV{LTj%VM> zdGMx|?h|Bi`rd7_y;v&~0rm@x^1@{O8;;2y^|pbS$QMRVaSAyIUfqWda2L#sZMHxO zU&^r~Z1q9(yF+h6G3IGfXIJxy{#iv`2D>M-pRcKZi3$#-V^%f8k1Dy6LH<8QpD0Al zQU&(2_y(THkvD%N(y%c%H{oPWWgFkucqAjYzRhNc{3tzIeCPIqx#_)~u_zobQS5H% zxU3H1_~%LON=a*HtD0Y2y^eFllwYKw7q ziXon6$y>d@#rRF6J}|qiM$X-3eWyRFU(kA$kLdXIoyQw^6RXqkO@A$~*5ej5JBQ`G zlU-yt2Z*vQT;sL>CU5x0rCj_kFDAJ`Tnob1M9~rk)$+X$? zMd9hmdbz0PE9`L>s2CO!_dp@^rHp5%k;Zz~hiqp;JxZ@#Q^Ve3;mE7j7oYL&d_nS&!B(>-S;>((Zw%gGZjMVVoBO=dT<)*g#PPGJWbLaW zTPYYBCByI%L{>l061}MH*(J_rtFas09mYDHQp-B986pdP6XUUDM7;{Gg|+nLURCP- zp%`YbRd%-_DODx!k$(DufP?J?6|dz&P^NzE~}78#!Tp*y(|Pj8+Ms`EyiqN-1n4*;w=*`IVG`{i|6`|K9vfp z#kD3RZrBxm&=I(F3d+>;mX-LgU&vl`FEWtH$QU2dC}`BQv!8tR$K1TyC)Y)kwP=b{ z>rZ@@J3~rotnBLM(toj`7&&U|!BYCTA!Tw)N!hvxqoIaf$A3gybG$FqVD050dKXm& z-}1_eKOCu`jF~=F%4d&cuyQv>IV?BTa{<^=c{^s^pv$irgLy5Ca779g-$+JGrKGDU zg_Nc|?l`cttYV{zmd*D;ayx24C_GrxlkYYgGtwLSFY&Kd4L#FKwB5q_F^M~}0XD00 zH4LBMESDIYQnaRNyz}cT5d&BChFwQKG8CE(?$phnRE!*Bdd*^DxAYSed(q!MoHjP8 zQII0EotBp&6LxiTTjyP*u4?H-w?B17SCAcRvLx%MK-{Xz^of8PiiKUqhJ7FJKFRDW z%17Y?SS){GeO6#EiQ=qnez{+g{~NjrjUAmbI=y*yu%-6bB86oy{oujny)08_G5Cq+ zz9ix#{Cl|(*^4G~s;tfq<<$v`SUX!BSSa$=1a2e9l&rAQx75bSZfA9H&H;)z(^f%z zA`d3WFs{sEcvk!-QzUxJiS)2fD|M1f5D|Q!te~uQQJ}WlTt8KNppE)5b**^NIpu@% zr+#iFli_Lulv}7Om__!sM^fj|JTT=LV~lZ*nSe8V(G+o(1JWx6frTU*tf*{;3d$N) zJn4o7E7h9?Xy6Ab*F8ONQ62t?9D{{$?rY|)PV0awSaI5~$|<;AW`%xUtEdk2J5HZg z@#ICBNK)%N{)L{Wu$&CoZH7!J^1`#GbkgUyY%aI%v@kAE`l|!rWmh$A&msMcmfe_k!xe2Q+TJkr)j3A=jzf{`<_L($sU1Z z(5(qh4(o-pKI+N_-c`nD?rVPe=@@+B(!S?o2-{@mN1vU{MMT2@jT_Fqips!HB$xy~ zDLg?`Jo&gDVY%vNJxJE|5PNd#fu;bHwg>-RkJs3p^evTzYv$NBHNt?v-A2?_-NIY)p%$j+wJ-r-E$(-wHc~fDh-*di<+4P-{x#=$qE4Syw&RjK<56q~$3n*Wby8+rCdjRZZ%7p-)jx$3F8n5&(9S+su(X?Y6bkmY z4?g?}D(2uZyY^Zjxp)9vNi9&Sq{u#68R1q{*G-P{P&rh9wZo#Pv0VrBOt^xc!@*z} z;P(MP)uOCLK7q99o6WXO zq5g6WUpfiw;m~ZOKoLklTpd(ew1qBgv`p|R2WDS`?%yp!cI&sO^}LM=ne-ZI|UcLF=Ec~%oh&DHvt&S^nz|n!C%x{m%ZLOA)agw!dC%~6Z(<9tXS64gRA)!NH8iOMvBW&!PuS!==K*mwcJ6Qzc z+&)DS9jj}r9#>v|xJW50`}K?@Rc5a7CbdntDd(VZ0`1{%U?8{t%@Fd!UWg7lBS?t& z1>X?t6Y`i7i8s6BrPt5T$U;!=#9Vc?hzaxTet2nyCb1$uug-;~tZ~m}7Uj~ShrsZW z<9tlpQ;t=ZzW6`|S8YX;vL`fp~F$ovkuR*jibEZM;oTNwvf&BRE`C;sq@A__3-Jp9OMz4U^q^;ag-X_s%a} zla9ci%?i%hWCKyx)>~h8K(*J&3e?xCN06vE@&|qAvwD+qO5?Q>%_BT=(mR!-1ykoW zz1=HO%i)HHuFws+!bGV1hV{o2*Ra5hBeAULpitSBXDho{fJ%g7)`%TPT^+8(Yn}Od zo(TF=^z8MqLCiWX-p1faC4OJ&=t!kDj-|;I2?G|G2OI3^sOh)c#K_GqF+B4AcPMF~ zrs83fg@NV-7dDsy@SCL&cQE2Lh|;;Q(Z5_ zXD5+hyhOnicj8447ha|^Jy+d2|9&o2iHv3b2Ia=?VUxO>%~8sn+upEdQ?M~6y;G0F zOrVkB`#?r3W2)l^OEFV|<&wWaIYQh-E`! zWP>^fjPT*N+$+L@0**#YJSTxcuPtp;yHYj5T1(o(Y}||ubmNd z=njv#)<$KPOh((3a9NDoF*>2C``iq(Qj(!WKl37wfO`;9xWkaql4S8RS>EQG+amNWgWFmb zWiA)EzoQXO{lzZ`vp?EwDe8rP&0;%!(2Z@0>r1cDBh|VijRoGv_`927$vz(rDO@*A zuG;PNvvaa)W;z$x6?a!-Oa($(J^yHisGC;SU#x36)f*^k9L}??{9cMarJgT#Ue^rK zSq`mQm>7*~)X;I9katnW(LuDdlSSwNjSoyGpr%qRl9IG1o|( zAiAVJmI-dwMWgVW%gT(WPhKBn5woW(%$I`KhNULd-}E(=gq^%T;AOT-ryFQnBWA07 z&2wO5T5`*{`HSTs3A<59GM=!iH`XdaDsf9=*5=?n4z7=r3x>sY;W zQE<$lw;HBy+Fe)EWdCsfi=AJ#olq7n&7QSZp~Q0IrnoKEEiwEB_vi1}vXr9R$(qoy zW{c^bw?@q)O%=wcKFXiC#FiVZ2i7e1CMt+`cDx3eJE|9YHI;0%tOABd_1Z)=S?A=* zZX|ywPTxPc0%4dSi4aRi1g;G$8mp+O8z28bTE9G2_*ndCRNwTpZAQ34Su3ha}s6&ZzauFqlgs&;F;++$wMpxHr^3|u$v$mX8Lhi^T@P|id3JIOw=ho@Gj|5d+5>Usb%trX5&maz8Ap9s^;++iBQmKtvHl3$gPg(BmT2J`~~ zEm<{{62D0ltk*jB$&;RoFX_qT`U}|1O3zr4D;!GkxGZ%ZL~diwBRTx}9!kG-iD}c9 zn5mbJ7PSMFrn1GXeKyBwW~55+#~D}~Y+}EG8?lTBC#bu<4lUqi7Iq=|l%xEoYjNN0 zBxpnIM9qG2_FPQ!ZI6pBL+m4DAlCDk>3I(xL!LN`^VX8s1bhXoVn5oI$Y|%Rmq9HP zX4U7MCSU$YV3BMMg^WUw4`uU88m3s&-J;v8hp&E9GcNjVag*8l7jKCSPtmo?90gBb zrag%fJs))WHGtGRRkwr}`wifmU#E#$$61IQx4-Ju))>9=%4RDLt~?Ymc|e2JN7+I} zdI4jF@wx)4re3xGDz!B>#JY^*%Y`%6gK*kFgwpK5D#o3hUR=+JoAH#Po7_a?y}`uzBBGGqeZAkjHs}^B z&DdNWtW{z}S^F~S@|VqW$smhGS9)&>w1Lc&ol}3hSbP&DNpDO_KST;o=V$k8Ay$Xa zT?b|T{$TR53)yj#lXf^~Pj2@o^2?x}7MP`K=%W=FZ%A`2P$0fX>Z$XXqvO0UKxQPa9h`prxg~WZAw*hJ8|BH*w^kv?&$yUwv zpw0C+O;-l|yr%Cvtm&_9l%8^#7*=f^8o+FbX!#6L85V*~Xuwn`)?_tKeKvv8(CIQ}OTDC71@9x4a ze-sShw@`WV&bsm@H>Gi9vh7&NX^L-^tb3>EaJ3u6fZh) zCPlmfVjtoOigvSBaYb{SZ?Nq*W;F=x*iFI(`1hES&yI0Mst>Yf8aTq$6 zR7~>eRxKa`)(>iwAJwLxWA3TS(`QSf`;l*go?~Qy3#^*uAG4Trwy}}PyWuNYup!FK zTFX_nK(Mx~Kb7iW|FTezOC)!NJwosjK?^YlS!^r95Cf85#J0MOLYQ5TfKh$)8Md06 zf_D4<5H^CMxvwLjpZZ)WFvbvawNEwtpHn+DNmnB-K~gc)jmnH9{6PU>Hjr}hpc;Y)dw zyE7|5oZzIM5DG@_NNRGp!%A=S-?_`obIU;fA{4b4v zBAzu#y2-u`N7QNge$caG zJ7()CD}51St-PlkVCbb#T<$gY){Y*4760h4?(Tqahx zRCGA;Exw?4ohYZ4aQss)dAt*$7J$+82fiCA#ppqFuob)Yl{=8r7cRNf{eBhc;LB5u z4wX@`YPoHpN`RpF<(7_U)uRb+5W(u?9^WP(AK9_A0^-|0zDN;s4}utFGLwky2K-)4 zI4!mN`4CZ&$I-CSl2IE`pJTBAo5d z^KzeuO%`nN^B%NUBZCzKwia z(i?#Po5T5?t7%HjONDXORPE7h=vATo4F%3G+BX4XECEc$(}j`Ja0AxN&{esdn;O_B zR;SLFcV2oU^z6{)E=LNZ27Za-FxB5zr@pR3-p&h!yw*RAd_%}_y_aA4g5m6yhso^T z3)9n^=$`{HMAFuN=Bl#OtJ`R+hT-%zSCPOk{tRjYpfQgtmX0>huhSWI1|JmJOGoG^ zC~Q45c*aTOuN{vPR4{8S0o;%tyH1~`u&FzWR)0qZ;W9mwU1&^dr|zg5qveK?)DM2+;3Q7(${N?y(MblO z)@^?oS`}_A3(gSbC9nCTzSUloVD1J65Za6AKn1eEoQqLLs+dCF^}$|c=2P?-&6jf6 z(c5DYlAAwS8J6+O2gLfVEb1|db0d7h z%an$NB2V*W(mc*)B3LbEpU;lNTg-vR?Kel`4T2NyI@EPd>jU}&PKAHfMB_8|B6}u8 z^aE};_BpwICdhtb@;<&T#$92pGt81DddZ11ud9^(G<`!hTF@UIPG~0~E=ggyUOtak zF@2cWK{3y|JFe&&_MyeGj0F-jfDJ2nN;j`qrLTti$rxY$(q&v?>541h{@^RS6z#41 z(HJc0SAnaEw9`4Q4qj`4AJh%F&~b(Bol(Fd4F&de$Pb;>y7~SF8vCDayUO3D^iXGX zSUAw}J5TUqpL-var{a);Elv@uGV*Xj(NyID`Jz)xU(>A#KH|dV4Wf0ID?`{W6y{d-U?Kj=zIZ|i&R?cc5#)(BD=m}})8v93C&f71A_7aY7 z801Q=xENZImkN||);xKX8YATOt>K`zgWPld-aH_7H4kG3B04B~@wMQF5*9`cHGTJH zM)S@g%ThYe^zRU844iTgqn$7a3kFfS!%8p-fBpr!{2P4o-#E-aum1mWn7=#1Ks9$A zVaVTMJQ(u-U_AdKkI7wghtd2Cz4?F0|AP$u3kJdr`afZye}3&B@aTW<=>L-c2V%lN zQ2&ts2V(l)8S?j_@5p0X{ewdNCuje6^8fv7|1ZLYY4x87*S{Eowt&sD-A|*Wy8G)D zQuYTAzyBm4dtY+;Jqlz0xLsill)T5!oSk<+jb4Qvjr;xl5$W^qDqW`!zn?RMK#%^t zBpQa1{}fWg4F8{kX&A2lQ$-CkB#c!2`x9oK{wc188Qwn?*D(M8Z=e0=6NaPz6kq!v zDE+I8kLQ^j9Lf4jopb!W?QYPM)+T{>yaqhm*XBX8#0z93d+F`;oV8{*?GwJoq=^qk zB3Y|qQc|)nRq7>VaaS3~8T?06^=vv;ES}$umj7$bD4WK6_JNj0My>@3Io;ejI=sP* zOApJ7^8H9CFMr5-a9rOCf{n`$knHj3T)DN_5G@DBmG{EBE&VW7gMokNEd+i!oP$Wp z>&M0s=l$Tarf!Ox;{u`xb!=M(uPBiuU(-1hlck}QzPJrz}p zG`XMq*DtU7KE{R)u5H`c`hIOPtjFv!<8nOhITml%v7!TFrxKX-h~#d*4CZ&Ra-t)r zUg16<1}Bs@U0A^*-!Ay@V`7Q#-2-rgTB42PSDQc#pdkP*z+oyoVfg0@t#wimpRp=Z zZs_wp11oMU;dNddm-zQ@tylkOJu`Ew&g(C_ehX>GDp2``L!E#;e?-MPb2rU=((s)E zFA^gIpN+gNYgA#3qiiV`2%xUNYfuXzl?~L>pVx_Z{&aD+t3Y-To+Dz6MWz}fchP-u zg-+oJX0YVVlIKs!KZ4}DX#;RYC229r=3_c`C-d&yJAbm8x~#N< zU)z9WPPtbta9bRKK^3kQ>2?dfBBXAjd%$Jjp1yA}~)A z2!1Y1kCuJ>uHWDTkbD!PhwdRy1%4%y^k}MTaz?<&@q%6{!Mx)hhgxyK7yQWBVX)Zq zDft;+`+?X?veIHbqMOpsw1FBxvISzxjp5U!HSECL6~N0t{fi{oMjgRnJ+6{((=-yT zoz?2p$NtI{a_~A>RaOZp$?;GD z%S!`PRE>%KQ8?lf6D4u)9+V2uH-2&45;p1tKcnfvWWZigzNv%Fiq6SmYK*qt%OR~Q z0Y+f`a@NsDf3EK$8cV>BxS)SK#y_nI7qt; z`d0iZ(sAqwrxaGBKMtHXII#<2=mfEj8PVRZD_n~%nYi}x<%(#D|%~T`yX=aQ_jR&akC`gFGBO>N@f3Odsml^**#YXzcX{( z17IT}pO-aiQ0-8Rd+JKKqCWrfGdSA&d1Ym@RZMs`6{6Q`^eq!Qwm#LV>)eHKJo!33Ib5W|m_{^B;Lk{WR@A8BlGM5eTvF_%K8slF0KkgWR?-3w} e8^Fi=_sTM#WtnlzkzjU+dy2AZGL`Q>eEvVu_<{}q literal 0 HcmV?d00001 diff --git a/server_admin/topics/authentication/kerberos.adoc b/server_admin/topics/authentication/kerberos.adoc index 5d80d06727..9a4e49fdfe 100644 --- a/server_admin/topics/authentication/kerberos.adoc +++ b/server_admin/topics/authentication/kerberos.adoc @@ -188,6 +188,47 @@ WARNING: Credential delegation has some security implications so only use it if It's highly recommended to use it together with HTTPS. See for example http://www.microhowto.info/howto/configure_firefox_to_authenticate_using_spnego_and_kerberos.html[this article] for more details. +==== Cross-realm trust + +In the Kerberos V5 protocol, the `realm` is a set of Kerberos principals defined in the Kerberos database (typically LDAP server). +The Kerberos protocol has a concept of cross-realm trust. For example, if there are 2 kerberos realms A and B, the cross-realm trust +will allow the users from realm A to access resources (services) of realm B. This means that realm B trusts the realm A. + +.Kerberos cross-realm trust +image:images/kerberos-trust-basic.png[] + + +The {project_name} server has support for cross-realm trust. There are few things which need to be done to achieve this: + +* Configure the Kerberos servers for the cross-realm trust. This step is dependent on the concrete Kerberos server implementations used. +In general, it is needed to add the Kerberos principal `krbtgt/B@A` to both Kerberos databases of realm A and B. It is needed that +this principal has same keys on both Kerberos realms. This is usually achieved when the principals have same password, key version number +and there are same ciphers used in both realms. It is recommended to consult the Kerberos server documentation for more details. + +NOTE: The cross-realm trust is unidirectional by default. If you want bidirectional trust to have realm A also trust realm B, +you must also add the principal `krbtgt/A@B` to both Kerberos databases. However, trust is transitive by default. If realm B +trusts realm A and realm C trusts realm B, then realm C automatically trusts realm A without a need to have principal `krbtgt/C@A` +available. Some additional configuration (for example `capaths`) may be needed to configure on Kerberos client side, so that +the clients are able to find the trust path. Consult the Kerberos documentation for more details. + + +* Configure {project_name} server + +** If you use an LDAP storage provider with Kerberos support, you need to configure the server principal for realm B as in this +example: `HTTP/mydomain.com@B`. The LDAP server must be able to find the users from realm A if you want users from realm A to +successfully authenticate to {project_name}, as {project_name} server must be able to do SPNEGO flow and then find the users. +For example, kerberos principal user `john@A` must be available as a user in the LDAP under an LDAP DN +such as `uid=john,ou=People,dc=example,dc=com`. If you want both users from realm A and B to authenticate, you need to ensure +that LDAP is able to find users from both realms A and B. We want to improve this limitation in future versions, so you can +potentially create more separate LDAP providers for separate realms and ensure that SPNEGO works for both of them. + +** If you use a Kerberos user storage provider (typically the Kerberos without LDAP integration), you need to configure the +server principal as `HTTP/mydomain.com@B` and users from both Kerberos realms A and B should be able to authenticate. + +WARNING: For the Kerberos user storage provider, it is recommended that there are no conflicting users among kerberos realms. If +conflicting users exist, they will be mapped to the same {project_name} user. This is also something, which we want to improve in +future versions and provide some more flexible mappings from Kerberos principals to {project_name} usernames. + ==== Troubleshooting If you have issues, we recommend that you enable additional logging to debug the problem: