From c371349a96261bfd865c1405baead3f82c8c2277 Mon Sep 17 00:00:00 2001 From: Gavin Henry Date: Thu, 8 Nov 2007 00:01:35 +0000 Subject: [PATCH] Docs patches: ITS#5216 and ITS#5217 --- CHANGES | 2 + doc/guide/admin/Makefile | 13 +- doc/guide/admin/allmail-en.png | Bin 0 -> 24419 bytes doc/guide/admin/allusersgroup-en.png | Bin 0 -> 34392 bytes doc/guide/admin/appendix-common-errors.sdf | 545 ++++++++++++++------- doc/guide/admin/intro.sdf | 4 - doc/guide/admin/overlays.sdf | 138 +++++- doc/guide/admin/refint.png | Bin 0 -> 30103 bytes doc/guide/images/src/allmail-en.svg | 230 +++++++++ doc/guide/images/src/allusersgroup-en.svg | 184 +++++++ doc/guide/images/src/refint.svg | 199 ++++++++ 11 files changed, 1123 insertions(+), 192 deletions(-) create mode 100644 doc/guide/admin/allmail-en.png create mode 100644 doc/guide/admin/allusersgroup-en.png create mode 100644 doc/guide/admin/refint.png create mode 100644 doc/guide/images/src/allmail-en.svg create mode 100644 doc/guide/images/src/allusersgroup-en.svg create mode 100644 doc/guide/images/src/refint.svg diff --git a/CHANGES b/CHANGES index 07512645db..e6d5643502 100644 --- a/CHANGES +++ b/CHANGES @@ -3,6 +3,8 @@ OpenLDAP 2.4 Change Log OpenLDAP 2.4.7 Engineering Documentation Fixed grammar errors (ITS#5223) + Refint overlay doc contribution (ITS#5217) + Dynamic Lists doc contribution to the admin guide (ITS#5216) OpenLDAP 2.4.6 Release (2007/10/31) Initial release for "general use". diff --git a/doc/guide/admin/Makefile b/doc/guide/admin/Makefile index 5b673a9201..d4ee50883a 100644 --- a/doc/guide/admin/Makefile +++ b/doc/guide/admin/Makefile @@ -14,6 +14,9 @@ ## . all: guide.html index.html +# for website building (for webmaster use, don't change) +www: guide.html index.html OpenLDAP-Admin-Guide.pdf + sdf-src: \ ../plain.sdf \ ../preamble.sdf \ @@ -53,12 +56,15 @@ sdf-src: \ sdf-img: \ ../images/LDAPlogo.gif \ + allmail-en.png \ + allusersgroup-en.png \ config_dit.png \ config_local.png \ config_ref.png \ config_repl.gif \ intro_dctree.png \ intro_tree.png \ + refint.png guide.html: guide.sdf sdf-src sdf-img sdf -2html guide.sdf @@ -69,8 +75,11 @@ index.html: index.sdf sdf-src sdf-img admin.html: admin.sdf sdf-src sdf-img sdf -DPDF -2html admin.sdf -guide.pdf: admin.html - htmldoc --batch guide.book +guide.pdf: admin.html guide.book + htmldoc --batch guide.book -f guide.pdf + +OpenLDAP-Admin-Guide.pdf: admin.html guide.book + htmldoc --batch guide.book -f OpenLDAP-Admin-Guide.pdf clean: rm -f *.pdf *.html *~ *.bak diff --git a/doc/guide/admin/allmail-en.png b/doc/guide/admin/allmail-en.png new file mode 100644 index 0000000000000000000000000000000000000000..a50a0ffb39255bb2dd7e592461fe5b38bfed7cbf GIT binary patch literal 24419 zcmYhj2Q=H?|36ObEflriVztz&+OrjvdoE-ski29FLoX$3}Wg^gQ%rWMoVa^uZ=%WaNjW z<1|`o(mNygraI|^GVtC5Gg^{_(>{ZdzSH^XKMf=!W0wE-BJa8T7)@&AexYmm!qnIG z1=KOXg$xRXO1t}b20A`G*DN@9GY=YUt~-W~5~mZ1iH)86 z@?b}Q$4RGqZraKmI*ziofnw{*Q7g3@iHRwYCzO)5Mf#)@`0p`D9ll)-kIHRYUR{YW zy+OBfnZFh>7q*kG2K7;qcXJ&ALPY0Jgg^>05M7((=zk)gjQAvtb~m(efIi^@{YR4d zZ^fFsLI3?S<~uM8a{GUchxfr`Fp0$g%KsBS8bFMlK1}}`>;<$V6=Y%y{?zqDZMr*w zNo5WKW@D)Qfq4UK6#}`nY}tYKF`uMOePH^&z|z(FN_IGoBPbgr1R93v*M5@La})+u z=q~?VLf|kUlhfc8F4o7Rlz_Hf7)=jZC7BF)2S81Cx$bS+&o1e?3!%Syj!PoN^yB0l zvoGbnjK22`NJT>he^O*5R^1Bu%}`=D8g~QW;WQrE+Q@&ypYMQy_J#?mt0yz1NLxsq z;xGDj#&8}sH{foX^A3H5l9IoxO^biOPEA{Y$U|n0}o8 z&SwT=R`|R22)b{y+q+v0?C?i={;6fvE3rB;*MQtPNo0`^z@aT$!N8}qhA%q?K>^h=+ee@pzUy>` z9B`R%$MJ+-R|onk191L+-0b?F3r0hB_;BFOGhQ^a0~~hP)u7rB+yfUS!EUj`ubMZEINf>b4QQ6RPS_B#T%DWx{4l<`vgw!knI4xt602Lpy#Z=ro6|g z70KOnZ*)CEn-|tjrvW5dwpeW22WKyr&@AoWhMffS^gC`#+qo3RPN!0}Q_StH)C#OG z*I&_vbAK$ah+&)$x1St|Y4(X?^oy5?RC9Rmdxcg1$-A)#p;(-G$tMdqNs}qKQ&>73 zNw>aL?;QQ1Js9eA@9xZ{Q)T{aJG28&aTbH}xw_@R;D?&Fr+>lti0f-)Xj9naK*owc zfzKA-DTwAVpR0YsSh8NfGx*turzP0JX?SGPr$a+59oclDMG+VSF8ALruMDq?xzS+D zW65B%am?FNqq*@DOW*s0M<7Ekh;VJ*gR3JU>8id(ug+Fw2f8p07>O93c{neFvU}** zWn!#bf)S6--d52^e{-TY3tEVX_SfcbD4-Q-+G^M@!93^M!J+b7LsJekSWIVC*sFYh z_@euz%abJgKWpFd)AVCKp}Vn$@)r8lR?^}7eP{WcT#Ae-vm%dg6A(}$2nlM2B~xC; zM0`7Ul>PSA;J%(0Wa=#Vz6EN%}6pzi;TKUlVUuB3)s?j6k{^%C9sVVX+vv?MH0k*l|`$1qqab+;Kf`DzHapw>*Aiph$o}3plr%E}|7>#Jh)G2&Ay1pj8bU0W7Iuk{pf9k| zpatwq(=-`{ZMxySw*~4c=pBIZ2{vUr^gckNiuxm_1sO_ac@ueE$SlRCKTmc`Oh?PNuowbF!4!Pod3a5Gr->CVhsy7{FQKQc{ok*o>(z2gA1u?P z(#2!AjaIB!C7jv{^>6KY@1SGN?ueytI097J%3=(QUtW@}#~+zIT!Txqt;l{~bIVr~ zNc|#-??v@~>G%748h`Viiq{Dh8Dv%%v=Onu5iTwi4 z(|_tl5vfM66Vo5V6#-xbh5*?=y{>AWdxK5E7(r%NahTDcmlsy;7cUIscB*?<1Rrv2 zYQ`D~W ztfFp&ZLao){v6MJ6)m5oUC5=u;!tr=`jH&jYzaQ4pt42QvYpYsIriAs@ituHNsx)5 zuxu)TVAB@-hWDOZ(#))GHSUcYO(=^Y$jTRz1SJabt54?As_hmj&`ZeE6g6XIAz&(R zOg8dVFAJqMc0z7w8sn~PsReTiITBz1UZ+J+_F3oiJ_2?TCsLZnq42v3W7fRfu4 z-IY;t+zj-Zw7augk)(M&*c=?$8R`O!OD9CkUxa58)PdabrS>u+t%bBM9KRlec^ox{ z#jEEyooeAbl#xGr<|Qfm^FFl8D9&AEn(p}Y@JR4h&n;|8&-xfzR}HYQ8V#OnK`sQ= z84TIrVX}AkZjF^42lJkgP{ct;6l>dd{uQa^xKtIg_f-w!jOY=iXrvw4_rjPFWJ>VX z+aJ!7^z|T*pi{3%J`B@KUpyK6f&Y;HGqT~vH+O}-X3mFX_r5kAg#QPUaa>w@R7IrF zN*p}CqH45;tT``@%Ov(bGpyZjczZraEdYdjBNRVTRhdA>OFbfadweNmV7(Gvv>ye& zezaWV3Ay5g>s1r4K>;$$^0?^eaNt0IjQZ{BF(Us&d^_*4V`UkVB4RIdfmh8O8#IBK zSFZ8yk{mN&-gv495qDo3mWTE-pN%Axk*!>_z2fYS8i~$Ig%Z@!_hT{#qp7-Lu~56>srT zBV$-Tt}DNCt!j6A;dc-qcHcdbYwijxYbtD8(;7SJO!H z#uKy)X(%akuQk@;x)PiD$jOT(z88^x_$MRL+Jyz=FqIit(DVaMPY3dUQcM@4ttF2z ztanU4t2(OrzcyfuHp{cCfX!HKe+cxM@A%S%%G1fji zrgpVB0|cmAxWA?&vH@#+sYD#*W0lAY5__321bV-w+5W3*cw7OcIi`-^lx1)Rh z5jm~9%E-UPv8U+6iMZ%pbrMmACW z>-*4ufQ&GqkH{tPvbRG5EIhsmmu!Kx-iNo+Dc;Z5u1_-7iijBp7xDk%57c}5xAB_# z|01XK|NII$#~hW=~Nc3h-8bYRr@cc=g6 z@BGKQ{=X+8FDC#0%{Jx#or-qXuJYOvxeML~)R*ArX%~zgGFQLm79Qw1Xa3~@xT9Y{ zW;Z*1sLdc9s=zf(^W2dfO&x4qg3L&j{ibp0c%o*G6?XRU6uXYbA4`BQ0gduK@rj}w>F0O z$J8reW*qR_j;Z3SK^GywssFy`j*SL%90~bL!t^t2$~Uo;(t-YxP5^~JA^nN^-axwX zD*XJAmQdQ_)zF3H7<&gO?S#-AjyuW_{;45c*LjDwRT%_Q=$w81PjBCopc4ezr!maa zV44sG5n{omH$et5liEm_&7y(Y@6z_Ri((r)cAFW`aK}3EGf)*(t!#ri_+eu2V=k9w zSouqLA9Q$y)>kCAodB{K0_k80WO@LqxsISTq%r|7tJ|M=gK7XL+z26%VAGNd_!(Oj z*>y&*UCLURjTp#y&BV7>7p%Li3w%oL#Q`q`{h88D=pMVQ1R$I4uq5_Abdawi*C)m0 zanITWJQ>xOkFRL2VOpn&!}brrCNX9XR4;c{RhP5`-p>-%)&lq;F$c1am-bNQZ-yTa zUlKLv_ZzQGFnLj$1J1zD5HK^pg(slftP`nCi?d=NUfrSqfwg~A)%|a(gg}p?3DFyn zy4!vXzoz*KjdYD1CG_g#;nJW4$NgsV6N+DE5Kn*wAVRn3(}ovpSi8(QSs#g}`N~|p>sI#VF4^q(6+M)WRX7iGT@vv`{m$7u4j(mL$ z(v=(0GBID#;=~)Z1=dwiAHH3r+DrHd<8s!E`Je&2D{u5QFWQBtT#=%yNGQFZf}gnT zyK}YEe~+pA&vyCWta=QICo93TAO?>NBK&(w@ps(j>R86Cy`sQIVukl9IC7tkzbIFl z6HxBI==g-Ro^4VjhT()nOvx0fQZ^F;~&8gFs4& z`ZdU}rFfyNHEU$(6HTKlIC75sd}ND|%)0aTOeW#c4K-TzN~C>!!dd2-Ak1B2?z{Rd zu`+~x_nIrJL1i-XFK?25UwHa-*G3A#6sv&vmC{2Q(f$|rhXJ?b*s<&cZ1 zl{IYkD@TX+5|zR}^3zlblIDdY*Oq25?G#1=#Ky-4bltJ9{-hxJ&p( z*S7#tDL7yO^hfK(>{Q?H-Rb&q!L%Va-eWdd@TLa{ua)B(SN;mIBDub8# z4AFoW*WgNhb}sL-re+I6Y^U)$qCw)RArXulOw>!A&+3e1j2Oto9;`|cbpZHrUVqj1=<;DFWgi;^0&IE;9`cvK(`(Z?Bp5*B zVSK;kHK~6BHgt<*#FWFDmYh3vUk1`G_Hkx@47S@vali>NEc7PVixV3Awlocolh3W5 z;c(~2f7*gJu3n5o?e$M=LATjAzTh4l2Q*Yu-3%nT7^Qj+mS5jK#twr1P@J%g=~x2} zcas|$FFG8SaA{8XMT4#;0|=I6wAgc$2{#l|Re`2-uODfLQL~>Xpc%`>nH8%yISnm4 z0LhQBQHi}?^FH&sSvY0GU#}Hzwc70sTM94Jc(tD2gr1WrMowchZt`5Gn%U`Ougadq z%6&W}A+DbzH=l~*;4q`bS1BJYrW0(ISpQbo$^=6)+GfZcjo;ToX`*`$qJl8wkFgZ( z2U5_5q}fO$D1M))kNwUHU)`U=u*2fWW{esf7X1DQ*{t(k zmO>%FxSeXEs-LIf>XxG3e7ILCnzYbgDc#qk$-zcxjy?ZCi;I^mz^Bmf|kVz^cA zZky^plk$67;!^!TA4i^-Zl*Y&r}4}4&((C+fd`3#tR(SsWurZOU!Z~3nrYtF&SU%6 z#+vECcp-w}4$rn4UHRux?XKh89_QT1`Ru>go4zuBQ9AyHJv4PB`G4*vCFM2PjT;}S zBMss-WmqqPLTk0WO;>cV>p2BGD9DeU_W5`YW9{jusf-_ zr;QmOtIH~V0$$~n!}QsKOp}mi0KN@;C{TqEoc%&LBVG&_C3iT4RXfTMjPxWXDH>#su7Ci z6{?_%mMR%|4<1*leRBtI{Beb2+d03~-@kto;+em2QB1sRZX%A24(9VN?o|0cF?Ohf z-BHh9)0m~D3o}E_zsW*nUzsL!2^z zO+tV-w-|rt1|3>ZO@!{1RVi#{L>CL!t=n$2=-v%&0h#E5LlgD?zFk_xAF$E+`{I*V zL=t)@rM)fRS8GaBP!o?U$s!pWWL9U(^U7Mfh>7|tZVs4fW7^`nUYY_VJ_BjRz+2ne z18pPa<(+^xc>~(2L4R}y<|65Edx=KVCX-+KkFxzWej6MBE1UZ(?;)xdL4UrlnBKHG zRo|E1*`8Esch30X_R}1^C{lb}QXf_<5x=}*8>I_udOVPjw#M1ea$>WY|0xJEq!B-R zj-$u5%o>HGGHo?P6ZJKKD&t|svuA%4Mb3thq4CH$+FODOmusnH3|T{!-@Nra&Rcam zApG+F&uTAdj=RZjS=ASQ8t*?=PWQjz@iRFgNbgd$6+0IZ78o97rR1yj>3-dmO1Y8h z_G7FkMZG1sxfIVSSA2`2PfuoY!e(g0DH*>f|JWo@X(eX2%+jihgI+_9xVet$AJfa9*RU&FgPTk6Jk>`z z1*IMg_I4I;z0GLK*G^?D-t24ZLh^PrqqUrwvN*IoflZbWH%A|L-gjF-6#p*Ed^iwT zp2fupvE>(fe)F-#03K(&9m)w1OzM4vJS{^QOvxc)@-DPFfPX(CJ!8UTU(09MG#`MM zO&}Vb@h!0MMSS4xT{ujgXQ(L!W)pq%DY9p~PjP_x^_uic$}#`zuepUhWI%GtN)3*^ zX4oLX75{9s_4M$^pKE6|{Y>gFy15a&Ox5fZ^xVuIqnUkLM)c3W0D=)ag#(XYY}ARE5at z*$^J`x{Wd9m3{Q@rKom$Ftf`u*YtaEV$v!f@-gbq@}RX+kjY?TwuWy{{n>W-GF9|& z2XT4(P>1II=g-c^!}jWHC?2fG<%^>)O6QES9_PbRD#anwnt9Vf2gxeHfVrCO$XKiU zjJrVE!%xntu6MoUj$^pvvY$m*LoPN3<>fZ~Wt;>*>&Z?p+dFigKXedt&Ddm;D_9E) z{|kg~#DvLh_>Pk+IWxss$Z|~ePZ(Ut9X|=)xsH;20@g%trc16Kc|&6x6OYypHnz4P z^AZsLn~GmIpHAvP>@iPY1-88>#Y(Ni{Wj^y`hbNU=guQzM6}jSw7}ZqcPMH|5NfGKM&6yAJXG zyJ%0*8cPJ6FjQGWDgzxOWbcNi^;a@KwuZ1I^hTgsRcyu+dm)JKj?nF9D<{Q;t_-5+ zye8yg2HS!wo0do4f-os~T5D!);FxUY_fN04;Mi@NR>`@Lcv@h{^^^MpeUIdKc+7&X zYZ4kjw;zB#%J2`NB|N`=*^X<^Yayq8b@L}PRR$B3I)bp>78VtvXmTC zHc5-}nln_+)yYST5*Nv=biw`pG~>5vL$5v2%oKA$bJP?dR?@^Tk%{H10gkHE)Dhz{ z9okVN*`X1F?CV=L!^O;F&6n{>S+LpRV@uy@V+(>k#l~a^9wohv3;cbGL`rkQhx_Wu znJ2fwpCd4zbUM|Y!z;xI&6o3^I8UFY^HhL|Vqdk22_m%h?>JqKQ(ENEWq?9(R&-sK&V@=*?TSemYl zk>0*M=k-*+VA;6H6bZXkui)B`bCw;WIJ&;#d5clBwe9kFqV_1;^!I)8mF{q=;8myw z?@>O*b+e=Bk%8bBB8Cwq`1||qm#Pyp31Q&nG!)~WrEqX8lKC3k&Qhkf8u_*5wkRM9 zGnZj95g1H9c}$2u*&bI9P}TYnk1Y`Y6}5-O%I;fO{I;~sfJSootw_9?{k(u;?!;z9 z@S%W*C-%^tnh_x9*vl7U$TKNl{5cKE>1v2Z)E%qHFYWe7kLDA z&;c8y(j?+T13wpUN3+!mUY_jJ=g$g?iZ5qBeL2`LLs_mgxYvq}XV>~2i-sK+DS$;J zH7*>Ej&6FsM?zF2E2%F;(E^YN$+TcMb&@Zw+A6TvZ<)3M+3aR&6BpIF9O4#LA=HIIWaPxt${9SzhSaj?|D~gUF=jhz^}Nx-wuT1*7Sg zKc%2y*lst;>?AO!&Rl8k*H-IC==+Q^ejASe#uCY#S+P<7|F{575~EkAsT%nP+01d9 zVIr*U0?f_(7Z~WKibI%wt06&>E;w@Mg6QVJG{~oXv=2mjVx%G7+bCfQPj%wfrf*P4 zdXM_?7l#iC9Mb0kUDw)U+7*|W?0p3iOLcoiS6^)`oQdgWYRw#xT4 zy_}9JxLrl9&%FQCg4Gtsi+dDxi zXp$Y}Bhp%RJ;t5-n7EHyVX}wy&Y~LfSN`CZQ!Rw8Hz>wxTWkk7s+4lc#bSkRJF+6F z#w<5qg=|_UrvwW6tUGiWaXAlH5HuCOkDj-Hi&R%TE}yFi1O=s4qQu_SqRypL)9O$r zvc_R-?;`p9$|jZv_bnrc1@W(B*%489=vZ9%5>*kARUTcTkGL?HjNTKMnW{j@LEBKc z=yn8CZ(d=%-HTS36iXN{JHlBm2Kcj5+Q{GQ{O3l-ENwWfN#-c_!gtv#f}#-l`N!Cx zCPVlRb1}SadDC|yzKZ7f<8|00`u#sUY;fM0rb@qf0@;-bRxqHc$E}KG?lUMrebj{j zz$NqwTb9jM)`WAM+ymD;I`5C@{23BDbN(i9U_vc+g6k2R4x)@Sg;Zt*s3?LLfKy?D z(WNgf95gVtjZfE+&HCW4&g_%7_(w&Ce!D1$xFSq%%7) zX+-V#Uz4>1GdnVM3TGlq@nAVZQ=slM^06|*?>sWUwSB!(zjJy4rdWYZ92ZH$tJt{mx61#L_ZGLgX=p02|z_d~Z+5 zt7cuhTxdrMb1vuP+7!s}HRMLs%1x+7FULLxLO;e@Ts$;s)Sf+l=D zRbim>r2wFYuC;=LbsT_79lY*6e_7lpaMOg$*HgN3|I)vYcF!rs-cnuB2!YgW zAhCT`q*f*uH{4IVQk4bR#Ocl+e|-*ASKk(X`aMPJ&6{qrKBLzQT9-^>;T<$To2t+J zLOSSgnPAgqFJ;g;NYK}fn95Eu^cK?t3xNKpmqp`c)ibYi8R0vdmj2_`94&;8E)sE% za;LY|jzz=}mvMBMl%`o7=pZ&aZ|-dZLa2ZXas;qfCzmMmco-YbCg=U@%}joU&Ce&y zyux$oI5#7(#G4jDD&;lP?Ofx)!yqhm@Lh-uV}iwB$}xz`{9^>P5L7iiZmA(geaJn! z_54=%m#qhqk-PITPAmQ96FC+(ce!k#1edZ@RID54VrvDJ#vv_ikWV8g_f?CKV$2|~ zlJ)ZC8vmfm3=PP_aeI;fM+!fw%%3Lpy>CY)jWw1?chG&axBPG^^{h8es+j#l=|X4t zf@56Ml6yevxZM`-nML7)lKB_JZQ-?v&sv*}O~07lL#Zbt|LAn3B5LOuOaq3hQm@G* z<-YGhn{&?av&oE~kD9B1t^U3h|JZr6z&+Ip5x*RGE2u8v?SdrN4tNYw1YK$zjn_+e zqRAi9z17-Ko)^^ZuF5!QqH1-9{q+QND5L)O52c`j>#J9^-+iTdxIl`)~fNhy#T_}RDRk+_|NACK10;(5!M zl?VNpc6OpaOo%MH=vo!Z$KLQt!CMXB|4=>Sow*TH`f!XQ%Smvf-RWhXMn27ygD1Z) z#rA$&P}i6h;rm!>X4e?X=f^0H6eiBnLAR}>3sxqY=fj0pzdu*q1=MfXd_c|>BDGe! z9%CLPAP8Tanqo2cl?7HZYl+z~cX1vk!gm}Zl)k0oBN1$qxfoiaaz`C$)jiluz(_7+ zD#Z1Fex{$+uAwO|<@4qH^MT73q7d&_QcU!2>f%~!l0Z_}#yE8C`N;!FLn$68ux~Rg zU!DoNH!0oeCO1%eLl0nF;-LXK8tc1~5VFIz)|}OU4rofvM>rO`MH6Pu)@1@G+-`QN zbb2uD2itWj9L|yF!_vj((^r`W{EV)>d zkXyJAl0`#pVyq+1qNvQzMov4oyD1~mr_;JJ$szPyS|Z*`hT2j;LbKmld|)SbSrsK# z#A{BeKXkYcGLZ|+iHLTR-qb>fS4~dbI+ux|CuPMSOr`a)=j)?(IPI^bu+dVIixhu$ZmM6 zRS}s?WhtbfEgOts#&Y8F_RU)!2*uJu~e$;P%-`5H+R-ID%Y3TjZ zeggU<&PovrZz0l^IASNh$z(vx{mup45igt2oK(=+o&Ehp0Q2&bl)3Tixxi>2FEmZ|7}m4g80Ab(GlS zl-bb^uxg?mcHR)OIE&nfCfEe)5rjU#Le_bhk`MB&Z~_iqwvZJymcj(do^siJ7x?O=}b zm|tX`)Y}pJR7b!S66--tYr|w=1p+^ zG8Yv>!);fD%p}wN+VoOqrXBE!%&Rvhgc zF<#3v(m20O;PlGZPi8PCe6dYqG6p-(EvnacT*bTBF3P=@#{tq>?g%>EJG<3@V?-=e zN_jrrHKD#}=X{FveT~~AI%cvH-b)Q|T(=orQJsxa zjuH5bG>zUi!a`+sKTlZUD-hGY`p(cOn$R*l4H;-(aja{1N&e5USj|Ofys)nU1+!9h zS;4gT7vQa^yiOb1@Dd;X7T6&aGv~i>0SS7|z?&L!{fwOVrzO2jN`%eG-sBi(&Q=u7 zFYP?2L^)wy@N}Je0D^Uwe&k!eu>2HZfZ?H|PrfEEKlvfo_11>t*x@JeG68jqSN7w( zWIEg&zPz|JaQONgwq?iTKROUXf<6hBV%%vSQe-*024#`6C_{py2J0Ie7=wRm7*mWU zuSP3)(cD*t_>8s8L3rn~WkB)ZBE{poo-pjRt)*=_W)xm4Y;zDJi(z>;(%1XnV7(lU z{R9HZqJR-^cPNQm7)#?y5jlhWPM1A2&aV{d%QmDD)MVxGEpCHJvQakpc$Mm5e%dzL zi$uOV4s*U-Z|ln{MU+~}4%_9A%co%{4%j@9O7qur2J$b{mR~$fj|(~n(8t`6yJ~CX zA~4iwSTO-Sl6v#z8gpSHNlm4c2aM@|Q^zrrRYP%t(VU=wY^Bs2ldk#)DZCwL9HzAe zQ9Sg4vNFbzLJb+Yb|22i3Xh4M51j}_%44S1uLp1LmZX##UyKdaJH4#dc=&c?YRV3p zO5*TdDThd?P%%v){N70F$d$XDkRSh+rt%s&&%S4ye6+t09;oUpwtT(nvdMjur4YH} zgg^T_AyTW=vXthif!jtq0h{_<#yNtuI)`h?1(~lRCX=vVpvIs2P)Wmnmt(>yypuA^c`}+#NKO4g5P)C z2h|AVH3bhkZZ5Pfho^pjBmHU*Ysx3L1O2SLf4SW~*B5>7KkC4jA14|;0lOA;36CUo zmqQI9mo=~=2N_&Jm49be3=4R<(lTk&U?9cO(kv(yVNo_5leeAQ6@5l;xtb=6y?jq) z2$hiIk`G-Xy0k~1XJ_T5mipq-ST$pE*}1;23Y_eGS04z2_>U*~#vk1tcX-cf;QRrR z?eucix=H=sL2@Twp5Y!%qd>$XpnC~2>E0i2v1tmviQ4^GSZW<2)HMMsm*{w6JZ)zAfY-J$WCyt#; z&hN46r({|Qy*YL}6AFk*%$uf8Im%!w@WbYwDG2e_^owYl{474@!JhsJf`fn}jibQs zE7-NbsRU+AXCJAtgQ27;KH@oL?!8849BVl_zp9W~b;xbm32RY@CsxzglW$xGCe?W%*Fm#4&NrDQTUpZzqi#|h6k+L->OJlT;WLCeF zkc&Mtak?~5nFB!=5-jD&gm<6?bD6aU3 zzDI~+SS=Kpy=ksU-lqGE?d#%|CFDXP%q*w@rk>1%W9(d2c|j%c1d9VN`#ZdXg~!pg zT!Ta~@s32=dU+GqNEzdnwF~ewb;aX3z*>UD@)V8ZE7>tDc0q^_n$M5o<8o&IuD&LD zU^{_DOQO!pZbnC(&pgJycIuZuOX!s?cO0cVFjJyCp$@hOe+5(`@yaBQrf2whtU_}b zdDIxKt3E_Q7kug<&@twe5_|q!`;wfI9lkoDy6^@a4vCPv^T~4tm#6?hIx*Fkddv+) z_T*a6BT}@CG8t@Rw37N6*e0QDJNJl=6tR~XIZ#gR0g*Chg;N- zOy_4w6$9LE9rFX{GBMcxLO-uaIR6IS7No6~zXJ=mvHe>xY2Gqvyb5$yj zy+x%w3eMd&{UQv?tES5!5x1S_3agPugl@HRTOgbeoq#-bX_wHLFY02lZ+pYkMK@M8 zm(~Q8PSq&>=y4Lgl*}8D8}XC&h0=CA)$?McWKy#_T-grLCJPL#BfdedDr)9hpNbfI zM}0)*huJW2y_Eqk-!&|IOp(J%$VOh;!#O3mY$$e3=b1I=l|GW|rXjGs1yu>fJI=$i z#ED;t_l0y(%v8LOUU7T zt%Diqt!5U_xkeXDrAl(~%t+itOI+rms9462 z!5YokzoYdVF-G1k%z-U#KNJeQX2OqlG98e9X`h=|zFWF!lPD7Wh)0aRH+J5xZt}Os zJ@UvirR-L7R>9`hCU=hwQ2*N^REj=E4`#l(I0LjpPrt8=N^(MaeW!v*iA$3P-@$QkhQfx0_|8n7 zu=EbXjk9dLLV|zP0G*wjliNflPnS#4a7bi$CF&XX(2?+~&BfATW3oU--$|)&Q_(AX z_$j8ztN5CZ9!s zf0imPpfXs62#|8%d6B2YGn9dawB{Gcffl3S$?_gDD>~XVy+v;N9KJ~#{*M}H=JaF0 zl-{+WjX~BJlGU8upVw=L51atyShtUI%hNRHZXT6*M{^*XXS*dCM)wEqo&L%CKK99i zQ=UKM7x(4v08Kq~C7Z7~y|-c{f*e8Owv^ycmTbg}DJyd7_(MnCa~jUXK0dqmkr-qD z&FgNreGgL0?5LXVuDpXBUw-lJn2XiVYB5tbGMZZ`X`T2O zQp{;r3P2~DpVQSILs)7>>M<2=7XsG4txWPF0V(o_PdI9s71-p1LbzNVJ-JQU>Mz7)94QN5GwuBX#0B%704Y}Fa3NNFvJRS6*i#Y|7x;P zMb!T=wm`;b_S5XdO?mO7fuBDU-Dg_|VfT+dd=1y~LhH7?+)*uaf4$oA&3iIZRNK|{ zD?>^hXa3?ShE97ECE=lJG9sK0+6DenW(w z$E=kbHhbpt0ad(sb2!l!=Q&-sDf_Y~w=|Eig|kOJ{ml89R48rv$xzS{?33a6nWkf= z9fIL%`L>h)SyapCC!(hd!x$NAF*T&5`fWRWLVbCiPB^F1uA!y^d4C+`fBYj*El-PO zKBwT+)~Y)E3wBoZ(2`6x>~f%%Q#uc~-E5~6DgNY%>Wk4rROxj6o!)_;$&aKVp~Mv~ zTMdx3qBMoW#QNPWgG~L2Hc4-{$w$^o3R3TFTqhw}HcA0QuO_i;w-B?!n$nTh!va~C zx#@`TUxHC*Lt7m6UwwSuA>KA_C+3ecGFNb={ZpODJoV`>ZbuFe={uXLoZ;Y;-Yz;M%4YZiHSyAjTU=VkV@$bW$RsX za!j(drVaI3Py9tYAR>gZ`x_-GlR*n~w|aZ~n&R}!A~BS~ zQ)oX)eFbltmrvxs{!8;S`MTO>)9@*QxRh$EhX2vsvvpnVZ`PIJ2hDZ?bbdrjlJ8XR zpBkGvGQVW~w_Ji{)#CZtQZApB@yX#pSDjdyYBxLinr61JyJ>%z0? z8R~s-e@>Sw=b{u%E~2J7hVvLQ2O|DcRdtP8p@+DU`uSNA9rK#T=``|Sugto^`>&;H z(?HGWmi2U$=KT9{(sisE9cJGsY`G5QU80-Q>+;yyA6D46`CyLCrP)6dvz!<85W*KBx>G-G$!`k@&0vQ z_D{)WNQJdSUcvT1TEg<5e+c@9%?Cwm+P7QyuY6dkP_6%4bLXZUabD1;h{6+yCpVpW zLp1P>jVDKT+%(Lmsu2eG)iJc6Oj>};Pvf?g4{Ghzp6j+RNyA;CM!MgN?~6?kGlkU| zqqSk%<^X?UK@|UKc;1I2O)W&^e~x3V*=djpo2}^sRJ$L#h@1V{(rWsTccSdfsHYwH z`oIqj5ew(iT!YjnFZHi9`pu=<1Q33A$Mb7V6e|QZpN$%)b$9o8CnhD?L%TQ{7y%`g zs6TUBGoiR?yX;k|e0gYZub|dMlmjluu2PjWwS=|?t;5@B3tW^yTj&K6M`)f;4Evz? zJio?qskyo!>g*}*n}&P0foS?e8rFn|QS&Ih0&>fCkH4ejuRFHSre8h9THo=>=o;Od zc<>n|3AA@gu+R%T-WDL>hUZQL77zE1)apo;`-eUM*1Gpx%^sfQEop7L^T?)L6YgQ& z3SWO5+8w`r*`KoKFM9jW2uo^k?eJBEg45>PZ43K=3;pQzl9CI;+~qF=vWuv56AP5> zUU5>heSm%0*NSm3quIm$VtWEHfMi|wNV;;uzfRg6DGv&ua4p?SE=UirA(7Cr?am3? zQEINeR09=@uMwpae}||Kc4D|yEHgM~y&ii2IAfIt>a_zmv>g?_$%vUoBdtw#Cpb6ar&-$I2mlGpn zq@j#F8uPZE`dTble(T8-nroJ|kwHz%MSq$UUrc>_-aub#o+Tbe*ecB@Stdu*s{g@c zeefn;YFg0(qcT`x*1o@>!kQsrZdXT|l8y6_(Tdr5zuWZYV~3$l8La%^qBeN!ho{-=Jg#*_B8vc z|KIpOEMY4xMErC|FkxvNXEfcmk&CmvI_uI1lRdhsC#iE$aj`|f5l3CcVe;E zMB^oGOuO4ozH0VUZn~ZD{nL&%XTVbuo|*}*P5GHu*gg>^)suWNinjOoN2&tHQ}J}7 z>}w%RZ%GzYp8cWNWxb^L+5%l+--C9~8`hDtQ%s)q4IWdWOqQR;#3Vw;->oo|oyE%n z0I3{G#rXeLc|jVLC*-<1%3ZfNWOHW16kc(OiML)com+$NJ4)3PWc36GWrx)qhO|M| z{Lcm6`Esrr6ZGUd#tPnV<)~Q9EGN_GF7ub~$=QOxl3jIwqa_|UM1ErJy}@ZZV9%VA zknn(@xBJafe$}w7E^?{447C-s)KxcxY>PN*hJ5KbT{svfLA6dBH$VFmwxAor^1>Ll z`ttIDcfX(fj>klOj&Qk_K=1txXsxcO#@DyssVgEW@$fdeS?wpV$k`MX)kG~6x<_J& z71)x@j#N^nR0&8ssi)$Us$H&-OmbbGCJs^=eNd1G!C`VqI>z_X1l!5phP~Jm}eA$&!)4KX&a^k(ZZ$cwg5g zYdVVQ30sCJNTpwx^24v_r9_wr*+_JtnL?FFFk9e{8cb1192uEF@4x>AP#`D-Un6ai zo8vsNk1Pl*ivG7(I*JQ!pu0?Nc!MRNkA|F(*n0ummsb2P#r8Rd#P)g$B(}jwNwZ@P_XmgO!C)M%f?Y&tb$w}pT?fn zHBcDlDU>n@y}HAelqFNH9Qku1oCq{Fl5V@>O+aP3hy6)>P1mEt&AsAbRv9#~q33B< zS$EqTYGoV!HO0zssx@eY>b2hG1hGX3XM?C$tH9=Kv<#mvZ?F`UK51Lc@~`&iCMkqb z0tpD(eY!sM4DvSE?EHTfoOM_fT@;6BN$EueM34?aK#*<(q(fS|ySqaXS>ywxStXQ) zW$9d4KqW*LknT_#grz&a@y~spnYnY%-1|H4J$uf%c9|?~#kca^Do#mt&Y|E3X1xZ1o z+y

ev3EPWD`XdnmC`FngVazd#HXIkcP}cUc7;s5u4%E6Tdz0(Q_0=ubCDx|w-2kgn7=35YO$TA|%1DlJ;s8z1OU0Yw^6xBNlFWWi z^Ui-V7mv|(fs0MI$#6I=#oKM2clIE2<%qaX2StD^b$BGa`0o%AIaU>zNpW*J$XRqZ z#R01_JKW+E!;NbqBJQ|TW1+Bop(&b}%l|CmZ=sH6YoL_p!p-$%US6HmM3I0%_lbyD z>+j2d$h0=V1;FAH`klt>kGBQawL-53C@eR#^|^x=+OIFU<6#Sdz2BdPNjBfI#u3FG zg0hLy0dWz@csdHh-UKW@qL7_#w2viPB;5*h#kPCiO0%-E3UG6Cn}_k~C%yYqQ^SS6 zY`=aEg4b0}Yk*&wNz2Tn1#bUPI*p~|Qr%7X!;b4=SIaalZfQ!Z$z5~ar>%QGd$%W@ zo9%l%M=N!N%KZ-;Z;fiqiqK?RLSdf6wfIRD79Hh|eP=0%Q7{!K_=qA&Iw%5k=owWO zBJGQ(x0jDw^bb~YoF!*7)gB8U|6xGCS(SyvBxX7G9%qU6qF{wRih;c6K*ZqG3}aa;rl1 z*i^{5LFyknU3L2+U@(!&ML*k_-1jR~eNQID-Xpg-11#K=Ub)B8Megp z1`#$*ELhcXwZ;s@J|lmT@JXt8y0Sips@$NgJ>R{bJT~;pXyhjogw45{k)C8XznJ~4sUbW`T0yTz(d__ykg*CwY@9I65*)e0&2$W#Rf<6 zCZsLL%}Bj{s&7V&*1_z*)9%R?T=QgS@smDB%ikW5L3qW|k|~9K2kS489~&&Ta=_1x z?k*n4o%c2z9Mgq~3NuH{a8qLh_=tZK@2=`y57Nf!-l>EJ2It*mgd<<`H4=%{Kmx(kP zsRj)}C(*RiI2AAHezGEw&aFSaHXd(8W7_Cm$zUqw;rShvKs{b&97xxhjbDf0;=ZXl z{g>@$+3faw8T2X}b*>ZUbM@Bo-z#7CYCoFw0SYML9?QeVgG3pbSZ-}@k0 zlHJsB@3o+L5bfGt5%1cGCpE`hiM9Nqr=$#t@A+BUqO8A4t}qenFKvQaA$5+StXG~R zNBi2@i^ut#Ny<;9WV5W{loSs3_TB7kY;6N~q4~3c%I8+J?-zqwg=?*uH=jF6C|HyVYVEYYMzC(t4{z z8H^ufU_dhPXQsvnOu5(qRdHUYE(CcK!;XPGoN#Yzv7YbI<}+<6ygC?H-!3h$uUhcl z>vLn~ld0^QIBPzWYsSykfvIp>aaT(~*Gd>1{V1fLhRKAp){q3z1@(lUX|FMWRf!CE z(no^#Md@iN!ic0+2I7gugztoG1T(RW_nBu!Yp#KP6rQkD;cdtKD}c~pz~h$e{|qU4 z{8}yvBP)MGRc9nSdin`j-YS3ZUyv=ESS(t=(^@?pcl%9=Sj>*haayM)u{g~}ta$7u zIUB+y+!1>tZ1Bi5?b}r^<)Z(sb64PeXIMt$S$8BOUwJLwgO2~`7RqmvEG-QGRY?4x zU>RXJEIyAe2h+qm%Z9kLeko84K@F~JN=cIGE>E%Q2aTfvSe};f-V=sb>X&KO|NKxv zPg1kT>B79f;4|{{xcCH1QxNQ~`k%JBc**y5=?%8ofmHyG?u#vGqUm=T;Jnnbl?N*S zHK_Pf+JAVvGaqa=c8nt28xo|${NzRub3A_k$Kzvq(OUZ_br-m4hCj+*lDBELW!`sC zy2Q6!&pG&+IPg?=mjZ3cjdQB=~(9fe!nMxpIgY z!YoN0Uf;BLtS3KwNB?Cq8ouqGJpJ+st&ftO9Mc*x)2P!{5wlvby3)k~+`&o`C7o^c`Q&Wr2@jQN&ZeV0UGcpuB z*B8;WvoIoSV|r#eXC^&TtR1vARK*wMdlS{3R9SDr^Ra4z@49!oe(V$VeM1AIGQPsR z!|K}OMDDfe^z=;UK{J*8TBC4;_H&)~$}uw^1Pp|!7;|EAvg7b;j@;glwFfoW?uc_)YLRik^R0OOgLD!a0Hx!^We7hkCMi` zR_>sa*-ALhU+m7bO%0VC_hh$K3{xWvu-mIN!(3uQ0g-dLvc^biq=lnOu8_+Xr;J7W z>ME7PK<&6Xwcuwvgn_NSVIaxQ{(g0@QV(wD0k%CT5x@kye66KBr9yj#R#nVZ{4&;C zt3+`@0d>QO15RWeUu$V$b;r2NFc^S3d`p?S_}@a4ZGdsGGX={F_mZVwPnF4NL+=0+ zN@0g~hFWV6Vswpl^z?SHE)`XtM&rEnRB;Q$cy6GsBvq;K$J%MV z^{RTT?`FC7ZK?mn>fpy`f&M-&DV9H5^n8`bXiv3NUarp_5Z7_A9@eVATHiIAxghia zOLQ|H(xT7j1AJ#YDh$hz!ouS}h3PurIYwEMYDM}P&+5t@CuJDPBkY|1oMbUxvX^k6 zh3x>>hTXn9oT{+2ybQU2ynir%RKZ)h z5k4CV-a0U`O}ef=z#d*S=|5#c(G>p3l1T_aM4dtH9t*aFs6nCc< zt=%obiXx3)ndu6t6inC|S5PY~GF&gxO+~)+kw4gP47Dj(tgIVrF+o-c(`tH;a!MW6 zAmUBOcc*gZBh_T~+lH+q40H|WhFlu981CG;_&MIqD=Bc^^#o(cNt3#r4BGkWh*S11 z>Pfy|Bx^nyumIuj8m>_x)8;r*va_Es;qf1QIuPt{__Jm7Mkln1my7qwrc}gP;UwDR zJPmmjF@5_;RctPFt~xGM*d@V!{2sn75!Pce>gjxJx4MwTF4HRPy5XQsmY5-n5mMb4#yjS@QROAE-OntC=DvO#FMf z2yS6S!ypRvcaFyv98)2Q;=zFw@Hc5zup~6oLS6oi#Jb1S#r59NfAOj5#4n1JmeY*% zOh>oI*B8zdW{OC-T2HVWk~Y7xni(5C9~grs^gY;cKAa&Wpi$bLky;AUy`n>ZyTH&2 zIBA##cos(y|Kj3HA2vH63((nx!%3sq}-$r4MM7 ziGiknt4IVS*|$Wtkbp1pW!04y9S5TYM6uC3^Zn&6<+BY3 zM>715Gro-MMOR}Y93mHD$ z(bs!QS_}Tmmy|W`*GGtSqggUWp%CyNlw4Z-Rr`+zK6R<-$okV?yRr|-iuF=^rH<_l zJ&LyzrIT;##JO$WUz3>nyKB-#rmC-Gmr#c_Zp-Oo->xj*x{uK%4P=RJzi2RVH*bjO z=2X_A-*xhgebOMMD0KJF;f*ISD6H7;TDF<2x0?`8c*59byj_9Vo^Cj0PcX^Z`Mn#= z18x|c)UW!>zt@7LL}fWip-4f~%SNsRUoWFcPuBL}+KM(z)1dBpMn=SqQAs^#QZVAlFiLpa&DN;_Tq<9aP9m>V{QV8AK&6L3W2|+D@=oGl zq>LzOhwY$rH3LvXp<&m{(o@@CG*5gAu0v(R43UQG*crxSDDXEvp0;q3Hf4uhy~@xc zeCf*q1*Z|H;v<41#s6lTZbZ{|o-%BuRwtWV((349?QIPJD=YRCegZ8VYb*9m5q4KTr6L2-VdHZ`Kw&uR5CpMLwF694t<9ez8 z_`Xpuc}}%?nf}2t1)0oqplP3C3cJ4S>9P9Tz*;Cv%L3&iP|<#^Hb6&73v;>~6$Zp$ zvYAqY580JB5>%e+`-l5d#K?n1P%9zGw-qMHb`!_Saoj)6SQ>U#g=p3Zd4jUzF@2}Ch z9=YCpN|`*q!NwnocGpGni1WEaExlVCZy?Duf+I@6)IZ0Y6fL;dO+;^Qdcd1w&9Gdc$vEh zMGn<8pEH}gTkBI-+(_bdi``y+)fm#}D%>Ev%ixhqRLL><YLUJkxX2Kl!^0qfLqiJKAFcV<(3q zjkpb7xSJ!TG8Vo~C8pCn7itSpo#=DAv6J`A55Ojcj7=MV5{X>bVM8;GBxzIoeiBS0Q(H>Cr3 z1^QRnA;xI|R7`-jte0JtwyJYY9q4cjlt3pP^-9rDUw3LfPC51#7Z7sM%+)IC5c0e@ z%$uZHZvQUurR7|l71xB2Pc~R$zo?RV-s0eJU(|B2ZNb`tBH?XZ^YP21`@AI+sI^NjXSQR#59I9s?nfjGo^n1v(^HwuFe%^dO^7zUEl$F$o zRhuT|y?$qJOV3*zf;8oO%WrlDtZNTz<;Ptb+_IR*`zH>ji8?s}3#&DnNAxLUDl2KB z_f~h;lJ(5Z$2pkKgJz@m2_NlM?T(&$gM@Y{}*$x)x7;mg@QiWf?;c;|ySJH6v6GhflRwh`^CRifP zQFg|7dHriq1W7Ne|UImmv*f zp5_g?p$o>>n&cH5bV6Cyb2P5|JZ)D{)~i%&mFANEN$uXPy@aIV`MPEAzlla(#(wXm zAfUOwx@}`q(7Ka2Km7=rGff?S{+sY*XZ8Z$qpz=@ff5`n4kXp^zr*3oePyZ+A~VU7dL(mryE%X_k! zIJ!4jIEwjS`xE5+ZhP+8CNd(tm4H7!KAs6#N{&d%L1hPXxeR^XxYgx0SmS&2eWEy9 z(tg<4-vF@sMORDI^{2*vJS0bE`bLbH1@Y#7L(}{2&!QI39*|BJ-;hZtls$Jm>-MX% zKxhX9j7$J>*j);~>rMS{X)yQgcP*&q-X;ptn_5)yj2B|veiGzjj;9_&8|~5;w=CyU zGuVA9$y4`8PPWp+Poq6Ub7uOw^@1JzlT(!gxG`nxdSME0B$(D4?a#feEw{HvpjVNOZYhn9i`hhBLsZ>1z_HCh7K^ z`|xzV;PQ~UM$Yc)X5HjsiGQ<>Ck7Wl4_bjp*>To6>UvzVQ&n^AZ^)fCX`#-UFltW` zIJB}6F1f(mIn$yr`63)88#H`^q8=NYD2(r&nAD;dUqymknkREVaw#EN`SeM{;LMT7 z7wK=1sQY#Xk0W+HZ&$LMXGN7N>nz%RoL6FwsD{Lxv!5|WcrC31{Pus3l00wHR-9gttg|S&UG@F7slDBBu}wi@hkK@3a-n+4$g)MYlm{r`HeiDR6{)Q zCl-XL$H+R7$eu1^I(o{(oxgKU=+iPm&b;8`7Ey};Kb}*V+n^643kz?QITZOh0Tb5u zm02}GL&Pz87rrva)^Y6}n#)_oAIK;Wgn4r8F6gs2_1#<^RrEJ;UYt4PHnG>m)m1t> zCtENaeMO!`C$m}1<))hAp`@q|R1oa32+};~d6R1L82+n>VEy-+vj^h?`gx>pQun{Z zQPWH%GE%PZxZCj~Dse|L#|SZIDIr0wTATCU0k4{%lgmLwQjD#P=mQZNE*>s2ExbC% zg;gym&h^$OZC{9Ru=MN*Qr@`*n?XH#b@!LVOD$D(as|b&00-_AUS}Nq9z7^PZ-3Zs zkYOT7(RyB`lX;er*o=bFQ0JL9`)=ssV!Ib2 z_(Jg$lhPLOl58mn)7JHxSvAFv5auKnB?1iM{;*rCBPUlyY5#b;pg}nd1!RHhN#-iN z>U*7|J})ZRgrys2wgn*-cuPMq$`Px4DMuu=N3MrdxSzLB{U*S7Ae)0_I#@mB;~kcR z`hik=0A{}?_zbSz5v#E=a9_|A!V{h4(d0|8M6q;-a==%`DuwMeEE}vrQ|x7$KwZ(v z(F%I{dpV7SYiPBI+BQ<1mO*neJ@ko|lz}?9apjxLLM1sx4!|FZ7`McI$&!?;PWFQ1 z$RQDyh_hka`U8q^*m>0J0;>s1KGp-k2-Cs3hjQ7X)w&`{pSt3oE5RTmB9}4A}AeR%op0+9tCeQAfcp zfGLXPUperW6V$8_;0KTc8?Ki)OsXS~m{@T3pi%c>y8Vv;KdUviSOSg)m1kd?po(ea z!#RDY)J>NPVGqb0*F@MuM)NloDSp@=T&Ee!dN94It!@k) zNQAsnS3Ha>4J>%Up?V5oIbdROWHGTtY^{;X^SWR3)GHIE93wpeoPYC*PKy!00$7_z_9+SlWo%o+(;wtl*vz` zTA&FQ?*zaGLgcC`yF@Gx@pQV~g`(JiSjhb!IQ%2m@*IAfiBO$T*n8h1U<}jN4Jyir zc}=?YF~E)w`torX(BeOY5XQ2pb`Vh>5M^TCYU|a*BpPX53?(&P5jx0gz09QIDn;z`nu{$ifS;CuO@&X@Hgre;lZ=6MaS2;-%|@i zl{oy$oRVX->SL=$?IR# z$=<;G;Vtjsp$hb${z5wQVC|eN?3A02=<~-kpvfO$Z`^Kg@R{)PIiJfYMt=!%$nC_$ zfZLBZj{b}K>3_U&r*E8wE(D_DfNxpBnF_e6yH6AgaiC7EXE=(nofLouWKT@cGeE;G zWvu?kTRvf8(|cK!(Dkz(V1s0d1lIAqj@35xBef}xC*fy;PFJXXyeuw1?X%bFBfNd! z`j)o0a+&ws{Er7keyg zJ_8hy63(o&j{uqleCxqidYI8ZyH^db90Vl^K{eSr%9vIO?1yGk!ffF1aG zbSmd+gyw>0Vjmq*O2R}Bwr46Y4fg=s7#3wIhf zy=7rkt6u>OAR*85^6*`dITe(3ZysuyEi$|7i|s6JxjhJCL8;qlkN^>1O5lxVND)}PCcmo%k}5 zbCjK`z#wqIB(XJ)^8-f?@X4AUnc7!RIhq9x)u5tS7~`aMpO}e^Wg3ZJeWz0%-~vn( z?st0=cv0KDo|J&SFpqrwYDt)+GZ0|FttQNmpLB*fZ{omw3aOw(wd8WbT`;4ByicsO zZj+(F<2Pc2l4PJTC^I|I1x%f^(sxEef@nJLIz;5czPUGr6I#i1F~{yhdn+v)yU&EX zXz`Sps4MJea!rfqt<`l8nOc#mymtkSW+D>muFdQ&#ph2(X#m)d1UOPrh*XYNk%c!V ztNkhD19@`wIJB=7H_8okMf8OHKqoEiDfu~6^%JwwHzb5jj-Gsq%!()t=^x>+m9%vs5tXU;rxX7By%6Ki6mO-sc|MLOE&?vj`AzC*x|-EDyO|sr zgk*!e0Rujst7^0G`ugJHVh~ujeE%*G9L~ap;h|&{(0QNZ2=s(n@U{~=CNQNUrdVVwCz0Ok5zl{Qg>QIWVF-7I6Wp^FZzMSGCnA=#n~z7MRcs8uKQi_`i3qa+M8%(ltV#Iy4Hz0`9XMZo|Gspa;| z`|a}P!y)>3wHLFic^V=cw&P0&^ecGnPEFk|N2}GkrdM)K(>KT;a(@-XMa>Yugfs#R zT|*bjushdWivjL2A<$|S(6SO>@+V4ROmq1uAdO-4hWCE-Mf$^G7NW@!Kq?X31BJjZX zf#K#Je4HHUor?&jFJVB21BZVf&irnht_|V^tS27tM)SZD5tn~=Pva3b%)J-N07ap{ z_zc9Q{X&Q~$b$hX+@56cH@17}S>Nwi#MV9FlZH8d&E@wpUamm_rsda}Kw#>3d;M^P zyC{%1w%Z00iwG74PLsblWVUfd zhg-W^y?Jjkhue#Ufbzup{%w+|Z$_bJERB!+WGp5h5p1143&n8FJ* zox;%}i(b`Ttj4>RVFY(dK1pn=wg zrr{n?AAJ18c$(8vxk!og=||aVW(B%aMg<}T=2PWzs#^Y8YJ`qqNnVU?m%QLRjUb@}m)3#CNDOzN2?ZS7;M7ud>lLPS)U4qn*?)7 z&|KR`1M&+EyW+Z8bM2WM^3XTWt>1TZKXL&#PBxYTkT7<@wWQ&>yJa4F_3Wks_=EOM z6=G&7K21R!EA;25nXkBHxA2vGq(T>j`r|jS?4r9t(#puk(N;ljs)(CaDAZpK?AIe zndf>G++|H%YXl|_%!tOZD>1Hp`g^rQ67qDc7)TGWA`KP;ikThP$hFW7uB@Swf^*CVj{J)zy% zuweI^544$)Dy#9`0tO~R2biCzBh3Zg>F-!N+<*Z2bgW0@_EayCr{jkSg$2_ES@6|l z8w?8zzKH*s&D~#NYk}}|+)0*dmD2>Nbs!w%=yZY-){<#1-#N5bs|pIN8C?!M(6!OF z&arS0KayRiJg@o93n)t3j^j=2Sf`s21}f&+ygiPs3xbfiD=)12ejA}Xl>(M%Ox}f& zej;dm$bv@aA$#VCHCGJ?t$>Be$e5@NZIxT{8v7G5$+J zmjU{D`m`Lz@lLn_Rm~LfyrNX{5I;pc#ra@`X3xt(zn6Vw-M^n|K7KqTs*u5giwn!? z+*5nQ)k$Q>oALu(p6vTVYM-@h=FbjUh0llrwMvp3*f)u3NJ8q<;(UcJT;BcZ)1s(j zvgwL<_gd}1V}!tA_Gx$~;fxS)uy|ukL7DzDsI}vnX9D+~uiZpXzy;?6n+Bm|aXJ!U z)rU`1MTvW5B};P9q`)5;qx+AP+RFt0I&AH_TNa`L$`$W@SHlc^T8}K@EeI<_UY1%a zGqPujT%-Q&j=|Pm5BokAfN;<`h4gadmk}$4qwUV|2 zu%77p&RJ?nBl2q_aQKx~>JkInOXWNK6wOYBt%KNT;4@K2mmr=$r{_HUB^Tv8`zBE$ z%s%gUE_vfCLNG-eN;BmIWsa>#c}HlGF;+;8ioFzVtcBEE9(oXv!g?G|hZAQ4yh`?} z?0kVxXI&a@0Pwp`?n#$tB4kX*)+nH!?p_Rkty#GAvtM+(D0Ogsi<=64@FugDD8Z1) zlL)qKI@YXQt|$<*rEU9}*Gx7*E}Z;=fLVD^mn|!q(yg)s7aH0EtBA&mRn!)T>qA4X zW^eGQn@3wEqNa`Bl5%rzwjS6@n*Sl>Y5G19RA5=39p*OvQw(;jLf-}pDsWuQrjj{S zxTwQ?!qEHpWnrcRr)Q$KTa#LZ`wxvAUALKae&bz2i)uklI8cRM7 zVv9DlCuA2+bFS7st9j!!u-x2HCiTTnkzbdNNneZ;apOt6f8vF zJp@H&wy)qq5FeqUbdCxndAT0q8!j5Aw=?%^I)u${g5)oR3*me%uG+9wtdiuPjzpO} zPr`49Z%&?!HF5{NPxq^)Isa0XTzvEXc{?p$TV;S7m6;$pFIrCea?OubG8Dd1C&g>9 z23xWa2pEUy=u*_5OV6u+@(a%#X*bj!qTj3Zim;=Yd1^454srPyw_QIDVO%$%Bbgmh zk1KNU35e1oCG{jGqU4{d)xF~FxRyca@ZU00uX94>GkB4S=-)>zzGf4VIU`+y!OBoT@838QSYHEAc1gP7y zw7-hVJd5$^Tnf$Eo`#YrZS;as36GgW(D+|^$Eytd>~{i$sE$%P?!!r@E( zQGh4}Rxia5yb4o82i72DNKD4kDikCj+PtY9mp&CCX{hg|z+nRACRDBn>s4TzCy@-9 zbJ51uv5r0c(y4){ocFK821;w0owa#Gr~yR@2nyP23bb_(mY}-iB~U8d(5*OCw4659 zo!HfA2*kb1G5AXZnB?TTVUqPdVjeGIDYyK|8}AO=7^t8C)>XB#+duS8J*uS_R&e5Kw)MIl%b$|CUYiH z@X@8q^&FU=Px(BW`>=h9?O8;K*rwkxso9j~$BFepUuT{tkB689a9ESE3wanfQDrMh zZFT2>_57E$%(X;1aO3w=OUfSN4Lt;-8I8aLydeoo_)6BljG9tT74!fPN)7staO;$F z@ZDYekEZjrIRC%Nc2>?PgS5K8-omvZC}|eutM@M>S660?$b!JjW%DfsJ}Cc3<=r6y zB#lIm9sg$OaoL%#{ExXClHWe2_!yA&z=H^c0qKFJ(?1BC1&3`-rv}8gZWoN8Zh=QnqM8_`sV5n%4b1L)y=MA%m|DoRZxIn$CsCq&*qi6lIbv^` z(IMMHD$|6=y>&DH1+hndE0V;8Cx^vin>CmDBtQ27fB3z62tc}MF8_M)H2>7+E5eKw zX&432Qx%jJFnLoM+sb*D2gMKGno zefanP1@aE$sOHP0q1#^&*KLk+u8u|5S7vMgAGt|D4Ff(R|4W=6GUVAPsHZVP1H4M$ z(^E%78ghT|;s2DHNuWdB|3jzwU#2m-liiNs|6iVo;QL8{-b8z~=;{GR7e9k4H#e~D zGp&_zGH)|qhj)8dl5OIz!|JdM3)IbrNr+1-n_{$mo_;puiVqlojl~*0GF`BM2n-oQ z{lJ>Jci(Wlk#YXz`4zn*3Y>s`x+JhW=3+(Ya4%5dck|KTdM@DqURo8#h^Dig`!ID? zu1|#DB$V6x|VLCApA z*&S*02YMC4gqD)kE7~=R;0HhqX=lj5-uwjk_<*LvRvegIyphW|{vCHMDg>{1ZQrWE zRie%)fWzqw42e>Ja$^y1S&$vTA3C5WX5{OUc4bSD7Lh2(={9@mTVbrX`p`4!JvT9+ zEyyW+^&$-+le7{LhBzW-jqj!caPR?XHJ4cv*zYW#C9xry8toVAw!_eZUV;4Ug zRzCnAl3MZueKeO10k0UMR%5%Nz=verY{)avNk}`0%Ui9zu-gQ)$u__paGxheK(sC9-wzMB7qV4;yQsDDed?o@j%6c z>hgNbey5K<^OU58V?UFe9%WGvaS2Q2RpH19u|&PMA3)TgD+J z++K40FC|t4i^nEE%IZ?&wj@p<8z4F%4RmTetAT_;Fv(+zJA>(CHnex_!Md`fV5hoB}jtQh<2uiASmEE^AbKs-#SPr1YJG2 z1;E%zo=>X|piMf_G zu4Z~Kw8Dc_jb20QE)oywX*!dbjHYq(0S5xc0V>!QY-gFyLCN-ecap0+^wWZS(-T)l zzWDVWHEG1i(3QB4Uq+5PK_4-i?A26YM&#_3tfZQLqdiem+?nlefSE{35Zm3gSFOhT zzZ52BC5U)mAf|_VXT|kH3W$_nP^!!G3DrQ`1Lm<3+!_`MRkOHQ+x{@rF_~+fy*l2S z&J3@jr#~bMG{EMC&l~RGKVu3C0&4U$F6Y8SL63OjJCZ5R-LR^;h@eBh?DskHG}jh{ z9#o66-Z$@aniu!&=q~44o1#O>L#zX))OL8ZU0VVqiaK<-4Nf2GP24RsR)zE?US$d! zAAIbJWIBpkv6C9&`M|)-eM;K_Q&4VSJW0BJb{M#`&EI{}gn^PAlL7*4L3UjToL){! z*Cg%dcKt}5#YS_Hk-I=`gpQxfY$>*uJVmD>dY!f?`c z;W|zlLl$DKtPhv>n;<2N>xL{C;ERbWEtpQ?n?C#oKC}Ya5uD^7?Pl<4ME^_g$?g;P zj-@&hxJIanmd8GL{N*Cra$|kui;yI>HA&PU3pOlgt0S+(6LdM{lE@O7P3qSPYbqe_ z*U=rcATk*v#2KBEF7QDb5Gq_NU(nh_T~N#dTbM48QOrm$!sNZE{Aspf*xMY|Dm}K7 zUq2RZ4rsg<&*XcbjZ+y?e*WHRIrM&Gsc?HUH(+;mnSo+_0P#4mLB^{`Hau)vrl;(c*R;vAJg3(BNHa}gFe7_VpkqnBz!~O z;-dIlAVPCVB10|w60ja-dqySv_s-S>l{izj>FDI%_q(^$`}7OCi6`i*%skX(GOax7 ztFn5SgWc-%h#&)|D}ycuLb7KB=FWlbo-OzbfNcxW#zn5$2KRO!0*ZK}@aALG6(?3i z8QFQ)UctPV&6Xf<(6Y|(t|WiEVc)e*+}a&6x&=wRsKA);@6rlE)FYlWKP&;QrW5^5 zsHBL|Bha0BibXXs;F#+Cd2VU?3h}O!2tQL6dH(w*v6GYe7g$R4IbZd+K{Bx~_LX7W zy91=Cv_J5#@ZVxHf{5724BnHf3X)$Fu^6A3J@p;$`#wA zsK#8|Gn6sZ8iHUxzZQih$5*F04&aQ_B5I;Q<#1b3pV;j+ql-4|4$#|P;QIq$kgndr zr8UF_Flh~{1|ZQ*){U$RHlR5+WHs>FuRN4QOVr2VFTAkvfI`G_T=y?r+R1bO+3Lfa zlrR{sZXXDk)CDE^g_h4+5xaNs=I!1Erj%)|ilJaR23J064C2yVPqf8nYs zexts!g$c{%AzW&2vX&n#XX`Y7PBcMOd=4VAo$(}v(Iui`f@AYt1kxZUb|Db!_7Jc6 zn3Nzqd!f;sFwNuM+rxQItTpgJ{EhFc-g{*DGtVGMEkfl1tPR3mBsIp2+SV4Q4@ifr zx@&Pv2x~+bQgdBMst1fy$vQE|9quJz1>EIP$rVC)s#fDJ%Oy4_)1{s};LTfx0)$D% z1$P_(&_S|HB}G(g$gt`?7*usLK$K2;9P;U-(`kT4{cOe0q2Oo3-ArMJkqTZS_=3iS z7g&R5MB!qpm$aUdnpv=WZ=zzj!*qjJFED+bQELL->ct;1U6ZV*jMJ*ggae(m98|$v z?eS5IYQ`V5WfL^HZzaRlH}nh?)Q;`1fFi$+QY9lYbnkhv=c8OwFrnm0u_%OX(3_@ux~xFz1=p>HT+SlIeHE0h;v=O|C(Hgtq+*x>Q1q_il}moFvf=$EZ(TZ&W3-?8T)_^d?Iqtb6iiA|IC+LP*`Jn z;MrJZ1_59_;TIE)>6j|KK}LAI>(%fWX*xl3(Z&yh{T?buCA#WvIkn!xj9ZlFOgHWk zU9rc>W5y#@#0@0BL3X;HY0Wsw{Z+A209^cR-aI(barMxhrI|wy;Dwz-+ zM9@ig!;Mi=5Ys<6K$`+0n!fZJ-(vdwctnmc+Wto6lvgs*u@WvwU?92k@|i_TNY~Nt z`5Gxiz`uz2Bgrqi+v5l9-m*I9FW;aUFX+Isa_};{^!B*tikJ0f$W2@TkN*8=t5Dp>}$MiB*zHKHMdIU2E5`2PJSf25?P@7NO!{Z z@I{KtxF`B+OUjcJCHE)5Tb@9ST&c7R=_txQZ5`phAn$GNJ^c0Zq%umO=P>qdIzLb% zK5aNyB;g+L+w9GKzll#DC;RsuoeeKy(^zKjeu5=*)zvclDo1_{`2DtU*S9Q9&?xN@ z$ZlWs9rA+DVwAD-Op9owmWv4ZOz`E6*W5LIyiOynS@gCPOX-VP>vGI~D9o&_6aVQ2 z%EfEmEIJG^^8nZk`5V_vCvOh)PQ9%XI@rpcI1ApAR5`hH2$Syz)Xm8?h;!YWs96Z7 zdT}L{C*KGK3C7iEo`EsJ3;2SYh;^alH%j?Na&aS^xU|0e@LuYtyei2ek!J*^M+X|! zpxf&6o61gRn<}z=qCs-y16EvX9xaUPZ(8EBC)%xQB{>X8xa92WwBwZm_o*eg%LNh2 z{3f?6NE6IP?l4wCh#}5*C@o8;`n|aE=3c&X6JdVlCN0>OF>0b!=96qoDLjRxw7s&( zHnON@meJHLy@JNV|5*;&Ye|;l588#kRi?x@Hd+>IfZ0L38ruAh&WzlHm&4K`;CpW6 zCuz*>MWiK9e~PpI(Sg*W2k0-2+Gz$rYb3!OBBlW3>+ohr*7Z(*#p1}oQR)j*kP*S( zLf6`t_h>sW3=>*_Ur`$iO6YnW1GXy;+|?BlYmH9l{Wv?&w&_qkqMq>a=G32PM9%MF zzSJI=L2$$H|9SzynJGm;#|^|_E2}>=Y@(|0ONRetCzkY)@4^QfucUSv&#_js!={4# zlWH>tWM)NEadKkv;A}H-e%Vc44m~}#Qle?QOQ{Q*QOAj;M^!ha@c6lv(9XBAnomQ7 zqGMvaOL4Us1i=hdx3#Va5ed%C?G);U53ic`WU3^`dX*tlXLkL$r`<~volSVHTr5ilvA= zd>3xg>BVvqK8u)4_>a)*4w{pMPN7p$oWdGc#xZXq z;DUh-6KdAU1N>q9sla1O>tV^syp4-|5>`R@XSg*b>tmodgBBk>mQ_K*bX2Er9Y?ec zH>ld4L=BvL*CiIF`zCeVAzi*drVkn(a8vtDPj1xFHxNR!#S(wWJYH>BF6G;BqYZk_ zGGf#p5iE|i#ED6R9qADgDfD*O=;|GXqR$P_jhoMY{$-& z^uSZnxhzF&KZ&+AuJr;?qK>Y+Q0BE?pF-aiSybn?h9v$&^Dd=*V2&Ibza@zEX;1ib zx&_h@QGzEb!zBTaOSC^u*dutYO4@R?B zQPU>%$O2GDyO|ukzzwKVZc|nx3eHFWggT5#E@|(2K5(QHsGpHfiFr^zQ=uz3ted$R z5<_HtakIg`|1`(={f;00f_B;~!%&a>^gEC6Fkp^pTDGcfr%m+D$FA77@uAB*M!9d3 zwK0gnnO$hIPZeeYQoKT3LHR6PQ-d2*XFq{cE_-_uG;1sWGBOKgd$f)k*tuyRW)0BB zV^|dg^)Kcrf>&-fgSeuU{$}r~Y&z?NKHqBG!Jkf(hFsl4vt7aBHl_wU-VW6ytQ?vx z%rVxyS>2JBf}b#s!f8t-c%_XF>`F?rHMci*T5u$v*A<7Bz=wYI?EC_&j!dq+^fz?= z!0wvrnk9gS;x5UbApeky`ilVfaFecCMV#Z|AHM5<_}~(^0;GH;Lgsu!^>UtFBYDbI zG@)Gm?~W~8g&QRZuZGo2pYp5{vyr~?>uO5X+Sv&MoPTRDO3o9NUK?4#67J0PPH$)M z4KR3artf$}!^y`Y_itS$6<&LFH)VhRBt|x^@fLTjt#OZx?lUHYnZx{es=MQwio`DA z5`*urdmN`uQuuaIL)^Wq+z^umkA++J5XSQa@6OqP=Y%|Z{}B1Ev+WGy?7~XwRTYUSvzItB9A*-i>gdtBrZ##z}s{6GLXlwHaw5pjp;PLdd^7)qVUiu=mo=STNX zaLlBf<%aK-CdeH6S`E9@$6v03NbFLUZfLv4ezcqx@0yb1K51oz6*pc61J2%!Hk6B2 z^BGJ?6mEp-Sl#QRSY_A({S9!UC))f6tz-;pia$$!HYUQ;WB}^?b4Q{}2VxBP^?MZA z&BLDR__;8V_-*?+`U_fIVu!nj=~mVaV?c_9tFZ%k!-{;j!?u@;^K}`sy0kiQcQX5OKSHncDsvMuB5cC`s$@8Z-FSw%hRtM z;}frz{B2irMGBPCo+`dYbT{iBTPUd%qrYUH{xqxVempq27$J7hs=G~DQg$C2pIfzE zh`tYO?%H@hELZ$DKs+u5e@8Rc9I=tx85&h?@8$@S`u^u`g*DUU(Hh=lEV-N%Mkqx5 zo;PYf+^hHTvVZ1d#mH)Q%q3X@i#qj^UNltHKK=*H;#NnHW!~OA`|a3?e62FxqM+e0 z9TH|0Y!I`NyNf~OOtd!@8Fa=ZwXqhb?R}Hz`R0|bTl!ULGo;w(ms+QJ*X20G$J(Fe zJBOt4NH$)+i*?cKadXSRns4k$E^N7=c*6h?pss)U?dr0WwTSyD`BsPKu~x;8d?n)f zUO_L(t##%}=UngerJyJ&t-g;9$y?#`9o|9G&B~N9O@_#=v5vJRUpM|OJ%eOs z3OEz(^zew!yiv~*+Bt`)$a!t)x~}^BKNt|is)LW=1OQ!O-trj4D2>`t>r{1(s=HOkX+ek!tcKEuxw4A?6|H?4VDJGR<~GQS2n zS%VX|T6rTfR}0$c+1=`7UI#tx+kLZTNwd|5sZUKaf_R8bPQ%o~&;ty}Gu&Un+170r zi6v6Y=`QlauGf}tyGYDO{)i?_SL#Bv6X0IT)rX2)7Yp$jOsB1-ja|wjhPV#w-IZV? z6Shqh(sETl;8V?AUOlgON#93Tkw21E8Te6Dmpr-g14F5f@2r5BiDI2eHg%!yAORSe zEHiYSd)sT#Wo=ASS^p^>xev!5@zE zv+&TjF!c|kb>8*TN6Au4_tU0Aw>j!D7>D*th6NS($IpY_(KWgsO^1JU%@S|dMbJg%lu?5p(Aodn-mdL|Y3 z1l?zzjXbZ9iB1whH7c-YJY_nyf!8i(SO&^VSbi;u8UUX(s>If*yqXq z#%o~?`N;0ql@U=$w@J2i#b*(&4@vNp{&Sq-C`~wvE(U^u|Moj z69%3S;)B2XJTmholq0imK`a8@@uz&6U8W&JWPkLo)$pIgevySymL9c~CTOB`13!gE z72)W_S|@Q)$4Ww%zG+g*Lwjf+@IaC2;bG0 z2Jy4S^D$pBX&)#A76{F%sK=YT0xY=`B>VRF&Tw>BP79ju1}gf_k z$DhMeCSEa|*zQLBjuf|S*4o4W zEV8wAV^+eQ-JZ;9c1&H8Y>Z{SkPS;p|Hmy&&($toGQ(^-LX6@ZatK+ISA3H4m9|$a z2C~&JFS*{pLI8ZmVf|Y*!SL~5{Y@Q?>PC30VXdc%gJZM07(MqamjECl_NV`&7D$a) zsCdIS@0TZ31GE7x`N4V}b@Q31e{9nJA4}`$lH0l@v2xLdh+x7z{iy|LPjlH|p$r{Z zg7GP*T+so~4pF_3qiEmRk3(O7PdEsox%DsI+>5`w|L{_0%?zwsi0c;Ym00Y~vSvLK zJcYh@KN%VmVBtOV8I1ug%YtoLL3QN*)*v3!vD)|AW>^QD>lH(4*cFF@HF&A`+r1E; zYEfl+oE}JsK)#rI9?`9n@V)w(fv%nfxbe%VryU)G=~hLtx-xXDlQlOAn(xpm*-Y3N zK5-dpqrl&i&5RCw)OV#;t)Dm(T~cf)p#f{?s>h7qR&lSHQ+^niQ|2gqsil|v^pq>X zmg!F@3NlK}uKa@{SbjgEpqWQGelouA*$AZMQeUbRE043%W&=#>gJYm2C-N0P`?@5n zN64ai)hmIT4c}Zu6U5YdvUk{9vJhU(4_!<3$|t|Ft&^TJI%&DY>9OA2J#9c@C8Hi@ zNP~SJTdkzzY?<8ANZuK${(4WtVvAL(Bc1+vCBI#>Dh%SNGs?yY5pBqXl#r}Sw3T#7N&dNI zX6^8pcE0nnxq~E9j{S0H*P&&E0K@Z}8)K?$AfNBre5(@uD-F@cjjZrY{|X} z2mY{Ec?4E=z@M->1~v)nI|of64Z;UGV zm=3&+WH|iqc;zC%CA!%Z%b7?@bpu_t+uJm*y8w6QSHE}tC=^gfgqaVxoB!x;Qnr-b z^&jRJ)ZF2=+V_1BR`W_6Os&ey7`uJBAziSvt+CGgTRR6~p(DrTcRulHSlylZ;wb^#1}!rH z>c~FOeUGuN9Xtu2OBDI~iYdTfE%Wl63l-4(y*uZh-|7*5;qjWw?0_N>=Q=dE;Lxr$ zC!+fVct8eAJtK7g@>>J!2OjHUbZiP?KrU5ac9fyidF!P&3RHt_Bs?+sgLlQ~TAf&X zxPb>LsJV^W+xz}L7=6Ow3FX@I1 z4P^IuJ20rrzG#$q*e{^BF2}OdXT=@Q=4Iv6GFN1Ohn&bEJv@e3=p1o*FdqeIQ$~mar|>cdHs4%Tj}LCYlldO zvN^G<6J;5VJICQg97<4Ri|mP7siCNx`QX9LD#V+`!Jn==?0ZHYoppP28K1kT&895} z9=_tZVa8O*dDwgCHL3RZM#3OX>m^62S~cWCvbPq^U0eLVMJc7`qDUjCX~F057+(^B z^+(8qiP*%O*AEjtZN6E4y7V47rga{H*yXDkW-W^hl20&O%tgD$zl!V8=^n`~T7C79 z@#Aq}n?7!=P8^%Xh1r)L{b@s~Hn#>cL6hAf!`n}=leAL7D>U0Y zbLcOekrU}3fYPehCT?!R%2xOXIa*-MA@1ijP^J(*|;+2UtVM963RYv@;@9wKRqLPO8$^MOhqh9~@I>9P{pEidiNSsT`)jPJk zvI>z{cP-g|%D;S~a-FmjLSnjp-qgHXY}Zv#?&(dL&x2=)OMh#tKQs%kUB#$YOP-}R z4?Z-oo)poTx#54|2It795v89#9_&am{NxySTV1kn;9N03-<8$C{ho8NxTv*?n)N6G z1mTfbQm!Cz-7NL_ws(AMTo)}z9|zlVSMYPVW0CyQ6~iIVz1S^wcj1#9rbK6+5PGe( zokPkX-t0Hu_Pz(-dJ3k$)U=mwt8$BKOSY;!%-9PC(!36xz_QYoIm%O>beMTv3nNU! z0Q*Tit6=xLjFUDYl&3W}Wf8Mip~Fiak+Y?1TYu_MJzWDh0QEH;?Nw+!_qo%;x#N_q z(GXtn#UMs7-~0gJXK|>epzyNT_A=DRa~{F4>X82TYw$dF6zd#FM>A&{ZobnrcX14G zCvW7^>YEDk=T7LJ-MsniAg^RcyYbX1#;7MLAYNu0xw?|MwBs@h|Ga9?vNYb;;^c%5 z+T~$5Tukim&()lj=vOg|POY5pL+iNbVTlhJMT~ak&v@iqB6dDZ-8f*Hxa44PJM-jWc(U=2FB%a|*u3kTKm+@?FIARl`l@{_jRZoUs_#vwhjrJ^|Js?5+`~{> za@JDct9Nr-ewFmbPiM#&3k#}>IK@D=N)ms`?w(cQg}d8I}OH z86zFY8vXeGFC@Xz<+0rQ1^~@jeZ~CjYKl{NFgq*X-pzEB2NtCh7-H?1Z#ZkS@`+j2 z2_P>pobXj{_HN_w2VO~yDdTd@5m0mHFvDp9LWO16+qkd8^|y&axF&30+_Uf+o*6kCf*#Ak{m81tBL znbq(hsZim@IJ!O$?ePVDd`Zbh$S>mRK~dvM^3TmX7yGatPofZ*78phXy`ha(`hE2Y3SD;v&+37>3SHr4hqGxtW@CBiKv}J$ zT`X=BAGoLD?!a_g{ML$+tJQ41waAdkiAL;LBwQ0^&=LS9**;wE zf?JPl!!k7mW~%srzK;830O|fBXGB_$*Pd$}RB?{hRmpOEib>JM}D!g^An}21ov~SD9bm z-Yx|D!KnplZ>FmrDqJxqI|NtJ3sDcL1p0wrm!kh!IpZ^g>qU6r6cp4>l6)Ixg10F0 zteErB`chviF(9V`KEo$lCD*jz{@esA1D#zo7;$)fv@|@G_ z3=M-1?aknNaR@vS9V_y61YRNGpHMEq6r|OMlF^;nUG9M&peWw$aUPJTqcrF7Ix`dVKNwAPa z2W-8pXoDG`$Xja+B6GyFL{>FB3mIh&Y@EtmMBPXjGe2R09x{s`Od z|7K5!oB&w!MR5DPB?@6edP+{lT(es@ff%GyX2NAU(YIbU69#pYd4apYW`~k0aY00o z%AP%Vw*J!1{Nz0?gno8~nyzKQR~x<2%~!%9WO4#un4lYJmlN4@quWZ9qRS+U3C3p5GT~HN}K%8>o6kqIK*W-M4oE{ zawWrOV}N*-G((E|hHfUg?w5LX*n>mecPzH;Bl(#-T@l|6!}<2uS3n~%;A260Ws1|g z@AD7^{T&E@x01w|!VPA6w^-XCZr=8?@Wh{=*va!k-EBbBDD&%Uc!XC4>5!6~P&%ZB zqsb5d{gE=bQPLL9Byi98RDRygRCujdGLPp*RAWZFLR7sVCA7bXhbtn-(;dxB`Xi80mx7kHqfq+IJKeu!ZScv_Kk@O|VbC~5*W1;;HVlBH z29!%u_R|-70_iVEO>EBj?C!DH4mbRK2gPI&TD3B{I~8tlzd$A<+~XVb?tmc{2)FDd}HA-XIhbfAC$%`K%NPC(j@3o@(%4O+IU5LFS?bV8Mp zecf{f9v~5Ygtrdkbi}2oP`P(0;w=+$>GIMy1>wFL@!)p7u)jo57D9!i80rfMAh+ZL zHtTc3r<0^|Q$HG(r)hv)YTq7Kq3Z*ox5ke3ThmdU8T>U^)ujKu>20O{n!sC<)~H|d z)zWv#qM5y>l^aQi)Xx<^e`uhFjH&4d+e-0w-sz&XEFOE%92CZ6TF=G53ZCLNbv&p| zy^(^!`~~ts!1gv=+Qb*sKS`l+I$bim4+#{ogRTE_&PJ%SkeJ4t<)g2IG9O{4WEd3q zY&0vM5{T!x>}h&O6q=Nkv&s?EU_Zi54xGyQXB6^<(h4ga=ywWA!SUE(LITvlT)XxAI(&p(aib+Jj% za45bkScG!EOJK+SDc-Tac7gZmzvtFZ75hG#x0))EbVvC?sq8-ex1f0sm$%zvXZ1e@ z{Cpm#^4P1XzO-zf?NOS~B5qQxzU|O2#kYxtHh{oYDQ=f=XMfXPp6I5dl4lH?AbQmI zzUwzGbFAvad&C{{h#&mNIhm5*Enh^7O6D;TgK|yZ%FAj*Fr{3w%PnHs6tiwB8SVj#9+J^+&O86z;;8znAZji?$R%0nIn67S@ERqa91%gp zanqY@jprEsc~$lyWDdxq=6OA{@gd)+MBcaaqY}Z0i_v%0m#1Ol#TI4H-58t>Ds_Et z$9~r1q``^D@CC)ef;4#20hiM zuei9>`1alPFDPd?b+EdwyjvSA?n2JZ`3%QTHGjhK?mH`9tjlTQ7_>6#*3}$;!$#10 zMk-i31_mXasr1dwXZNvdjQvKjhUT^ltx6+<7#}f@Y9er#6tUHpTh&Ke=Z`nb^upHy z3p0t;+hH!NHx?&vWY@jIqAy9vwUI}c&2%uA!*}V{B1n@u(+7Xps3ZO$@g)w<@3nHd z6qYRch1SMtg-hpI)vY$QV$B4uPrIci2*KypL?t7Mw;Vi=jaNv|XMVR>0)qAVv z(c=VqTcwY0#*;~MkUn<70$yK%>Ob~{2*UEY$5t~Awnt*DQP-%G#XP>Y(H`rEHJ$kq6KK2F$~;^5|#czR=*3fK?peXRfWvu!CV zD!y8XBCD{LT90M!|5DbT7=h1MsBz1O$?`ZT9&eG)O#Oj#stNYvQ&-^@?E2aMn9t^) zR))4(Y%BioYlC;ukByzgVQSLv=KY^*INMgK{m)4r4>Zs#>d}j4bGvL&&AN&lA;+8< z26W{K3tKb-bF913_no)0Sr%M-xEowf8ZdZZ?jF4rjt-WaPvkM}dU}P3=xnU0 zU_EbCuSRH9HnzHy88WYutBIk%ncGUHcNr(67xvG0CTC~guq&eO(^(>iWvKUA{#ZB3 zzoSDczTMJZcE7*K-a#e94A4@$^nHzdMQJ`207UVX0BxE2N+a9{wyEGAN1d{@69L@{R2UPPA&a&K=e zP-@fssE~k_N`qyD-*x)P)CB>b)8l=CkJ$BXy>+jPg6yUB?bz$`y3*28kH?rOwDI#q zXy9Yq721ZH=R-xcjdrEcuum-yj|>_rn&o)Ohvp5QoYV)|enOZkLc_(B7SrBP-CYG0 zvHP*+jv<-v)qRA!ySogN(7`s+7 z`phxkdEY@+O3SQX~sb08uRl`QDEO+ZEJ{Fh@`<9LUx!J+qW3>~44 z%lsG@)Nnl?7T15}J-`xkeC#tgI9RgaYFF~vrD#UTG2_BjM8yBGxox>DXK$NFOk@S* zhNU&t)nVo<>m>)HRqcy5jdiyLif9G6xVWlhte+G&WCreMP9Vqifnw~eBwp{oQ#?H7 ztj+1^^RZ{ux7%%OOrC;VTwF!Zz8hqQ*i3+PX{nazj(n>V$8)mLKDO;C;P*Rk1O^OG8Cv8uWf3 z9|TI3=FP(1hdRMy=9BfoqI;oy&H~d^r~M6R#6-U6WZu-aaV|rn7mrddJh%f0+yDlbr?IcBk9ASdD@a*qqvn+BtQl~R`Zs>QrC&H8eU z99LIb1Bq-WqX*qlS03F}BqskE%S(pAcRIrjgkzTB^BKAU-ya*!=<4si)&J> zbxE;i*0$zY(c=it8B9EnOXRSK)ULAH8hCuC-sxePK&8JxBXj+Wac`_MH8p)94+sT# zPP02Lud9hwi!|np&S$4Ew#SMmOo#u8dp?edw8Nd69f=2KhueWY*OYVX1)KVao3-vF zXnQoDt<1L-4-of1(SDI?m`ZAH2rADE4ZN^w%3|&>p&p0l%cjFMfR#W9P zSWz!Dz?$y*7wd7Ay=V_C8&4u_m;aDn&gh)Q(Dyc8*sOewuy6On$bO;u3T%fv zdmkD2&84>fZJbNhH)S`P6>V7+@3s98agnYz8lDFX$gVsN*E25#GWM_7 z){f3jh02Xu9a6BZ9uyyx^)Q<+VyQ~%G&NOrV?TVm8qErKzqe7bM zu?tuPypkIhH3ijd#v)e#qJQ}>wXvzmQ*u>t@+ZbR*Rs<1*l&%xJVQToJpSsKiWjeC z!lYBWoF3Go?6H0v+9_9r;mc4&Tl^I5D|4N3oX6ciM&kChuni{9j=|pMo6*h{x}cOI zzM8jcYTcnH3$_HLB&kHJM7L?H?liUZlrk||$(d}Ff?nG#+w=GHfeEYli!V;+GTddp zLeM}~s>i!5 z1=#Ftb|q&l;c(}!m6&RbL8 zT1w>`cVfHyB5zE0lLMzu@^V%RcIeXh<6P=Y#+ErIvd`scqlbz&bnp0jmd1-T>Xr^7 z&*d}Y{tb4jjHwBxB*ZDjVF@glt=5I94etLQwHUaK|J^Je_^v9s(Tg>&DQlkvH+t+i zU^l7|7vq%S=nU1()!;URo~<|`qb8#zqMh<31W_@1rOnQdnb2#dKXb(!WSe$LYjAVw zp6pP6|6X{rSL!GX4Ie#Q^F~YgOIxvtj{Ea&J9h`sznSx-f^()N$(nQ1!^grVx)RYo zLUo?Jc!N7J-UuqpjLxfkWK?I;{7Z*UK=-*>kz#7jWOdm@b9CgU9}dCAuN95^zHYT_UxY zqNBIB?K=rHmC)6J-)Kj%kZN2~xb@MxVue-I6d@e|eO`Ij*@df5wRfhoK#BP*` z_?bPC51((eIH4=RE#V;{;N9?s`l00S(YP$I$SHCqCc(OuP+vPK-KP)~ghlt3c^4+> z%726jr}ynC^eRRs!lNsZEa`MqY=-Qv8L_NKL9PmushC<84$8I8orj>7Pt01?MGHq= z+dpAcjRIcHNKpJY*}#`-I5k^wK@bWP*FhAi@8Z_YIsfVIoz1|0yU)D8K$5EM9INeq zTSgk4j5nAU&#^?qjnUM6OpOf~jvOusP)<{v;j{7ed3m_;xTkrt`cF*<@bJAOZE%eH zRX*TwG14xj*N1g~ORBgzY^X(hriddxPyIJ?WRPeT&x^i=DmPB%7{|Y<;vez@9!q+`aLwD@=;?3wpJw8gz0i{!-R5|RQ^ z3>idm8tZ=jlWC3`j~$;_$ygu5e&WBJv92Qyu``Cul)hrDO@4*)lb?wK0YMSw3aj1G zGo>l*3yqR5Y-J%XQg>3LOzOe* z3&x2*NBdHy<8*2G*E=H1`cu%cl)Mr0MH*F0sL`$L@ovs%E=8;M{a+6>%lGro*~Q-3 z{Z!;Dv#)fts15S0!4R$x=j3KDo&5Wc*Kn&XrWSN;(Sug33U2*-V`V)q(~F7C ze#a{T%PMb$H($O_cWsMb@0C|O%Z|+_k^3*H(FCf)JBIzM$#r*jB1}o-<732t8`7Lk z%$D$Jptxrq9yj@<9Ck<;Y@i3<(hT>Cti7~1y==7EiEiJ*muXUcDi$76M=g9e&5q`8 zOab{d76mZMQO13TAmxNnL`YaJ?@Ev4diN%84FdzS=JUM0C_3}l?3Wr^2*Qn~AjFG8 zfYM9T0ZV|Z^&}I*5x1v)XTTl2L+J`;egCrv3qhG^(IO5XA&u@A-Ya!?l zj>E-8v&Y8jXqD5MOYOTS4_F>AyY04)S5@N9#vX6vU%vUl+fO}#0@1BF+a<~wZR_Lf zaqEOuBlJ2otQR@sEP^cS@2SiXu9?(*4_cZ|%uTPmsJfgzf8hJ^GFs?HoL5xWD@?$M z)I?stB-(Wi9!x9><2%^dVrqjvf;-#PbuGyaDafWyO@VnQ_|(C&dENNg0!lOX2T0dQ=JsX?wTN~p8+k|g>SiVyuZ}DWVD4BM_!h9ll8-b; z{=a;X(IN5Rf#I`+PNTf{&#EUe62Mvc2x;=(#tKCGl5KrNe>xoDz(zMjiF z7pEg*7O;eOv@CULQ&S^0Xwc%`enA0pw_OK?`%7BbS2Rd*;-jG?d54{g6GO5*<L%~1yrjdG3MW;NBigm9*0P*%uRB$wvKI#(4Y+7%7;v4w1t zP5fytl-b$8whdsK6zRj8-cKTB;2T2gvSa0XB^OJ77yds!R5NE_7Til3Q zr9rKzNxC?!!k+nCV~e&TBOw+6ER2wlzzGg=Vmv$D*-%#4`8Q_qQh_oqG+bxo-@H)- zWM_(u7vOQp@6!pEG00D1Cqub_e$Sc&H9Q6mVg@lwgU|hzWt-4484KE9S~jn2n7=1Q zhWr-&6z3|k8p(_t68z<&3o7d6iv>x21mai+0-_r$fQT>F6~hmv`OUh;F!fw^O@Srd zQUoPbIMc%y4RZ1C!n?!@Hb{eSQELtiUX*XAaBqhobY7hcEJyWZYzT^x7MJahvLsbc z$L{z7%j%c2umH1_@^0{nzk-=*8FwTdxVVGQwz+!ci5WL(@!OLO|#p`P+|E=N)@AcW{SVkU;Js~mU zeUPZUndy~u%<~*-jyQ=orvrJ0W_1FR-kVN!)6B*mRH52G3Lxlhj8y;Wh_M3!SvxaD zK&zrctlub(@hhqr&CbkWv%1g$f5RKjv#)g+%Q*_2-6Ic<-W&zWdF-{CFBr_ftBE zAo7L89fZYQ{1)YtmBzonrrEp+>?_9+7Mk(s+3=9QmDi|nEN#p`bmnk)Xwkm^Hw1m^ z>8O-&*YkZ?Qymtz{p+-V09|?_`!w*oJ97qfDFW4i9Nc)YylGLYrmz@jBa)$7P!@Zh zoyGncA6teJo=9uE2sR@W(2lU1Uw7PCHGZBm&d_{=6}L)rjpWhe9U^%1432e^KXT>6 zKEsOnhwp#iBC#q_xp>NsE!E#WO@r%ucR`KiC=ER@V! zw0ux-c#nvb9xF}pId8&}$7_2rKXSi{z?uMv&?cScPa}vw#H8UM5L6;!yVKcLAxP|v zm=~tnkofzLc|XBfh)x4qLet((Xss!5q+2G0e>ueuHW>U&>2vf3I(!{$&<*JenTb-( z$HLA1&Pinn92(_bY^E{M_Gwgq{Y)uu%!>@OIXV8%B@z^|z5Vwr?5U0XK8cWOSJ7vz zPswruFsro;jt$1&DH@-J+3*t+j*{S@_s=whSUEoxDAN>udc87u<#u_7V1_hPFr|iz zbQOZ)TlfrBDgNE->y-b7g;BcH|VHfuD063J}WFJ zq;rj5!~2H;DXOXvvz{e_m0Rq2o?F*cMP_5P62@m(ma~kh0y1Co+X+_(XCy?5T0x7i zuNe@>8M=zEc-|X7Ck$R{`BeT<`$vxcKLQ;v=nc}3#=!G?#oh!M$WqGWj#Xkku{N^H zUBIJU`ReLaeUhadDiqf9kK_RDDN1j7MO6|@etdmcPScH9JeES=zllw-8U#P*X2~Y8 zGJC@EZ)V{|o~>|RR6(?srLhj;$1#<_YmaL^xS`3ne^yzU=wyfxilkg^O_?Dacr&D$ zr$=sIVuD~wVp>FWGj*g&gLSD*HuZ@1J!@UZkXb4oZ-fL3zAP-R-quw@KCz*wf`gls zy?NzPJ;h4HgT_Tn*BJX}e%h4Uv~LEz=TJ2PQY6?c-L>mwT~3lK9pu-nkbWqk6x&cy zFQ8qYV-tQL?^B^f8SOp`Gn&hcD^Bs<6}_HnjH+?t7t0yWtBO=5LM4~56W-(~!Zxxo zI45>O?)JYI8KxiFIoP~3!|x&AiCA;4bj`yxo}(O=`H5w!|1RKeIGts>DRj|q$P2`y@NTIT5*bDTpw1bY?O z0UgpnUcBxNdm<1wD&%J{=|1E(P#=hu7~h0LG6yM!7)-)Jmwf-iuI{wT`Q68c?a6di&HMbMe# zwLRbBCXhNy0_B{_{ctBp89f$`l|lCt)iV%F?AJFvL_dN?SCt7B?qnIh6OG4& zXe6)MTj1^n-$}w$PHfENYsTTP?;@s3zP9{G%zOD<#`opBUE{%?$|ZUpO+}e!d}SZ$ zH+T2d{SD(qJhLkbn_vET5sNd*InKTjx4yqc_M8L>GBdYq3hB{D#iL-XT_JZA;yWDP zVJEcSExFk9c?z|R%xx%Ii;cZVBe^}ao!@WTa+c$ep-`3*R#)thnYQe^`n=rw%fG{L z;~824diL+EB6q}J)m-RMIu8N1ht>sGFx<7>LOm0r8#0OQfejiFJ`RJui<3Yu$zr3x zZBwpgq0eo!?Y!^5k$%1u$;1dC7TqG{!g*$0FYazku0mXl@r+D3(USIW_E)+1;q-=7 zCe$ksyF){NUv_Ss?GO@^hEMsfI{uw%g;i$%vJepcLO>Lwf7+Q?uJ5jEXes6_WxTYa z)0h$mn(d_X$J64{Oy{bKOqsm#Z~N`u2gIdSm5mMyT{q3;%+=qfHD}WHw|6ve`iDzU zfF!R=?Aoq>O3bA`eB+MjrJ|yCKPq|ia8pzZgqLnqo%0B`KGBojZTMHN5+D%VEj}3QU%F#{3@pA z)h;?Rud@NPdD5m0_qVo{Qj_>Fdh<1V8UGk|kl{_l^|&5CSf`fpWjRoOKux^N7)>rx4Cx-gOOD1WbLyFsD%?UYhm79>xqUFBKjdG zEybxJRo)}b7{d1qYB6y%s;iXZ;7{s|RgkMFFO9WYD0Pf$jJSJrA%26^V$^~os(+om zhP%dVZ-03h8ET<$*Lj;%xLPWuV@J%`vqL#$l;tu82eqsmd%&DG*DR^P8$1jAR4y*J zj>Nb*sS;Rk_{5Tv$^PI|AT)o*LsKe$jK z;l(G3yGcNtwCd+i(9a#xhxKe1TNnD&sExiLdr5f57-gxN8?!bT^a`cYek`^*$-bW! zq&i%%N{)s0m1A12;^|{_kf1?O4e>sA4>`u@0Q+YNIq+N(s3oC+EIWTz>X}9-h3~g8 z>7vzW;$oYu28*LaOSq5L&vk(~t@tzThji*TFnGm(eR~0m z7^8_i9|);z&MAnVc@JWtR_4kZAMkb+1UbI`w9v&Y8>8m6Qu}MEb!aj-kjqWG;?td{ z_Q~!MI=|Bo;&RQK-P> zoC2410YxhbzrO$a(${dRhSqyb7WbaQ==Il_M9h===-KgTr?f8JPX7K1WS1%RJC?r%GGxt4Kkvdn(v}&^ z+c?iLTE^PE$9RU~tyBDM2IuGcePb!TZ?$I8zo|+vrB2@P5rwd2v^KfFlOAx)_!rE#5d3`MTjD;fG!x}nTG+)h zL(JQ6yE-0_iuM?ALlnsPOL>j=BK2mvy@Bn~pC{8TG+AZSE$^unlD8l2t1^Fg8&OT) z#~@P$oUuJ74FzNCgq7M#wzN5O_Z$;l)RJ5p&%?6jU3Yc9BUXd=AQi4Z__HCoEu%MNQp*){vTX)D|$~vez)ubnyTgl{EWy;uSUZ>1N{gQi4JL#7o2PT0i$3 zX;x*&x^2n!SPMSvd688M#t zq2UK-!M8-C{Q7EsoNyU1G){54QOYA=@3>BK$*_HKg1ULr_%3zXp{Aez$30ewyfdbO)Q|b`e zbyo@D7SmA3Q^pp5|MkLv-hHN|)p{mscC_l6=GT=u+v{=V3bh~wD*j#Fz=QNzM9mn3 z4eEs}wvFNaT$=awP=39^51vDVwBTOhvIonpLEpl$uICB`nbF?}uRNbvmMnigR8ut< zg!NCuH}T^>rEEO2!7^u!)S5g(#9vQ1XcDf)7fL6DB!msIV$q=zs0CvP|0_u=Gd(u> z&maSJYBQuo4Cos&^ts2OlH0$lx?T_$(jRTdhlr8-J6bTIDuwJbdBO~DbV9V#{`8{@ zK{At4_4|k~A!KBIaO}~!Z=ss629t9rzmoN;H2!<~K|j^C0R+DgY|$(T!Vl*0r{ui$ zj%MkCW8bLU@b4m*!8JoFRfV{P@*>Hge%gB~e=NclW-EN?EeiSE@GJCoRmkrN6!|)^ z(w|c^BIbzbqy>H93_%zh!m)h75_R3Zt$zCA@l?M^hHgY&P^!pKn>AQ4q&y!Og@-Ch z-6I1eC>B`E=k72>%{0|Kg#zdxW`2!9bBH?-t1i=@$A=L=*c#qXE}HCSDa5}X<^D;4 ztBh83=Vb?XNUJ`zFB(E=nzXxfUUX8JXR}XBbRNhtxFO@k) za&4Zib2H*egft%!RJ?W9h!$<2M1@dR0}2`FS>Y#`y6=THXU?Ykrw+A=W5{R!Kdrm2ctE;uq)WK@pARb@>m6vZvA%?_HTa%$#Y&g z4g?jLE;Nm--G8t7>Ekmv22#PfEeAB26L_ZIX?IT9@ms!cvrll;5EC192}I2vobVK$ zRp}wLOyCD!AqaB>8#rQ%)}~K|U?w|A9gnhRGe1idIL&`7>oAHR=NwAD5IlXe zcDF2B_vNm6p^k*o1`{bI&&A$p?!fF|^kk)0?s52DL=8J`qWrQLy7crRY%hi32eYtX zRKPa!SkSdX4b(S{c%LPeax~OqEx=W-q@`e5#XW%v{4YzBxU0-Wh0=F@CNo zFOse2?4705>ju+|7~>e5)E$(=w8G`ol)v-Q&rN#+j&lM@D;!kk!Q1B$=GgEOwU$v) zQY&YOpY9>icR~0dys57qd{%y3a&>|EHGKU8_3AqiY7IeEM&DCyMy{0(*!bE8k_Eyu z&HM9=x)So5rLv6m6l$HUwc(WD_hnOJs-02$JD;WGTRH&-sH3{!Bw5>T3F>(4=@ZIr4~m#+AztVWt)$;m8r6%-A6pbL~&F{6piD+ z&*a903GV4wuYU@SFIM~$3Zz6T2ZoBvhZ9*zFhQI_Tcn>))x6B#rX@y|b`*$!sq}7M zqOetSck|`E8nM;SeK55o_7oSGExfh7S8;y%?D|4@L6~W3Y{USo@13VYcx2ROW%lD0 z5Cv%nYPe6pXRjj<@rQtGrAJj#H&-c>(fJVJzacA^cEX>1UR#jUZUu7OU%*ewIEKIY zn#h`?rNhF7M#R8&!V0f7qh-^%hz~*Ai56Clpi@mf^uXxw5HU}cRK4eT&{Y~#IG@ik zHgbx0&SdVT%3p&Zt-9hpgnryriyXyt^$|utmyW)x*LpDf%>S{tl8JB(`N$qEai@w_{MCesDwdZS2)+Ifz zD-KDN1>e<^8;^GaI}qf6%Blk7|G^IOEI0VE&t2o!DYUR@V(3*4Gg@Db$yM(U)y5Kx zFpu5YrJSzL6>KZq`uSN|#o;&Gx|q=7{&HS~NnDaO$7ZH>ZVkDQGKr&4qJleSZg0mr>o}1daOItwJyl6K6ysvdJ6cj zeBuzdFEP={)2Mapx73`7ksS27ppRRH%~l`zGr=a3WdvZF?9|e3%dI(NS2V{wpiNyu zWtZPC20DrIlZq;RiAnMGW+&%861O&!K~2&-9&`TNounc@yfw z^ONQKOmX0)cx4NOS&xJvu36$!aiemN>Jh|o{YJDd4y(J_-2dJhM_CxAEId+riYicqWkZZaHy)e>#tjj>QhI8R|K547x`jwRi^^P5bRNuWMecL zYEnI6R_*!yCDWQy1TZ=C9h}6pMu+22P}J=Bz1z>w&+wtzdh)8($-oCV@753B2g%4t zN#uWHci5@wBJ~dsY*9)YcMp*2{+k`Id;ym+j54h#FA{4kYc%WlboiveR_z=oqcouV zd|_m6rWUT3OsdH2@R#Fatk!7nNV*yQP7_yIoBxUzio9=@9j6q+52o~XuE6)zl> zRgp=`lXwkwO>@G06@TV}HpCGxv!=HmpcvG0xSX64E1?^sm5I=HJSJ(3gIIHV)MKNbOd}k zc|CZm$~AU*p)AcTRSi@=&4<^!IJ6q*v5Hx$s6T0AoJ(>|tyOe7*MJ7ve~f#}Uo(7P z3$ykMP{!rN`GkD{6z4y;o_@f2PUCnl5PWy)zEv`af?x@8Hnz`w` zB+78j+v<1pxX1-GU$wNA+-$8rwy|AXN7KC=@V@g_g=cF$8x9?Q4<_qbKg^e|gs}+i zDf*6Ve*=#0%*P5)G8$Z2U|u;&0t+mS;R{2@0bQORH>ZskgFA6l(Nc{bM#_4;5#uEh zSM;&6rQMWW8Is+S`?&_cfgn)S(Yp!+WuQ)#unA&f0+My@zue6-S*iqqvbVb}A->Un z-WIdPz^s=3PE;y&Kv3NcZ(N5&S2I2dwwCYZX)DY+rD(?U#`C!;$XUJv>*=^7=pc^s zDG^z5Ap>7dM2sNc+wHr{%?=CVb|pzyzK7AyOa2*NvC2ay`=wmrol z1?L2OPqiz|m;=U1KTI}6l(-X{cy#GLg0T)5kFN*V&LtNvCs%e?8Dn|kYgf8g6tz)$ zH6H8Vo9C-fydv4rS)EtdDjrnf5vuI(&8U z4|Wo@hGVp!Lc+RX@cGqHLNC>edXM`3NR&_yauyQ<4bL1!JMz2T{qWt<=Kfx`Oy@?m168Qg)tR;FRE|Q6age(FT?W-FLu)0527WNuYycG95JNa#z6U>fE zh24Y zF?`W-nroXC)l~YhZbVa>7;iP=k|(=OK=Ax5>Z+_KYhy&7YLrv;K+yR}{ibV7=rmJp zwBohb`0fM!7rl=jjAu?>&faSyl7pnE7Z=ZF;{Z}2^oEL|p(f+76Re~L(^3g6K9& zC@Z$Aw$fs@9xnW=hS>%ok6ZtogPD_|ii>)lddwSlaIB}bwqf!b&cy1Y=-ltb2U_@a zfJ)5)4+<4b!nVuKEqn-=)a%8KCV)~?d9nP|17xEgJadNTMfFuEzkdnH&Y!#Gzf%YT zG!LBFaxn7sKpnFn3vS+=s=2jo89otN%F51`uYFw;8lM(!8NTdN-Af{-@_2d`?a>Ba zKBAk^ve2^H>P+S8in4qYt6iUKRvp-iHI&p8 zBzK)yu>c;&%JpK^Qml+or{;CssvU-^4}*0--IT1$%3J|w+E{8T%Hh-PvAQi-we#jZ z3lHxU&rY)PBUn=jd{knx6!ic@Zq(D1v6baj7au1tr(&0#)l`ldOji89Vz#&_p=dpa z6?03Oq%axW!Xfd?$7RIH-ihR~`KYOTPnJ(E+kp+GHaSK3d%@+0m@1=2>FX%@%nv{X z#tfTR`h0%XQ4m)s^9XJ|mTPeXXov|3944A0+m}a~6m(M}47n4zTt#5Q`Uz~zqqZN< z0aB@&xsvJV&F>Xu!J%BH^wb%?NnBpf_n@-;V1G}$W6iD?)@uG^887a*{}SmS6hJ*O z;1X@o>gbmmso;-N(DNi?KkL3;`ZSmh`kl|=y9z0 z;Z0d+YODXuoh*hMD8$)6bG{|SA^77=>$`oJ_Yn5Krh>9#{tO-Z(V10=fub*hEC<)? zVo*8kGztZ}AA+dq&8jFPI&oX6A#o+*yUTG<@_&Sa#ySwds`Gzmf&vt82>yo&T1g!- zcapw2oRjMK@zfL4pGJksab9v(b2hV2wDA0MBG)o)8y--)5OsBQA?sq1wXw7=3ClGx zupy^Fna&j@pV-UX=exa%Z1SH6Og$&4Bg`M&M3I_+{0RxYv)e!{sKDs ze#?5LpN)S;`fn8F4NO>5{M-!aDVX~t{K4=J43ozdDJSOknm;vysSNoF1u z<~-lzE1&`az?y)7HK7of4$X4z2{kQ$c7ASyFa;qF54>=SHo2n`^~-ZxpWEpsvSPqs z2%9Q|$UO+B!9&b=l3W4zPx}y!z3&>4j$Y6+6rvj$Tbq9nWYr{lq>J)=rt5F&bRY;- z`XrT}`i{JuK|D{2H^qQ`cOBHPe<>F{8CR`BI#WlX@1;-<-DeL1XDh3AZrHk?VC`l4 ztyQ0LXn2bG^?i({F%L7fw8zQH#PiB66mmk*FZ1J5w1;+Qgc&279|2!FW6GFz`B@_K z!dkoWOy+HWDwZ zS^^$RUz*0Ufrf6htiPkqNVusr1`_#f5_MRmOJxlNjk13fP#;k&(qj04)7fP&i!_q1 zNMj8UA#`?EFx=MwWx*>~Cd=rEeTXJd?cm5v~if z(`G?fpSUM^w#c3$%lNCfYsJ~^{A5qj-eTt!&lwTNU5`a#Y$HIIh*Hi=9`@;BPk)H| zh2i)oeZ(07Bczi64x~UIJ4SE0A5o~sblBS5F*kUWOIlim2i-x=ukSzhVOQ&6!A^eX31NK`%{aFWQ$YB|onTmXfh06dE5 z9xKxdZi$Ot6Zm%KCs4W~wbR8#i=q&+xfdNiC}7oU7ICUaJc~egz!F6o{DZ95c#`pv z@+dLy-dL*Oe6w4#%YHfgy(f310+Bax^QJcE?^9vJODuzw?*>cWqQIxf2)tC&P&=X* zC%`Yri%9w9>S8Crv}-k&uK1_<;N{ux$r;|{H1h?FZuU_os|<1^qC`L2#~(9d33hz0*lHz$c(g~2pbM99u98V~oM-4k;vT!i%~A|%nrPCFcd)8A5X6Hxk)}UHa5po4 zFj$mQ+M%WLkK$Y(znOM8- zv^f*I(tM|lMV3(wf4-YF!76_@3pMML=9KB`Z$!M94IzOKdVN>8T>A^RhasTgOWeI$ zZtf$)2uiV=*ZE?_-;R!GF0#um;7s0)3k91CKLi+dtxbecEMvuJ_Fo(w_6`Sg;s8jL zZi0!jhNpI+%<&k7ylZOoL$4~MrsKZobOHqmd%&**f@T89Z}r>R8^bqM0HvY@=yo#5 z42AqmN*fcsjSar}emU&k1~7=!+fTfpHMdJ<&&rsqi2(^+NOu8NM{4+?WW-<^rW~4y z%F{0%<0|7Zd}eBr#wwlUA4&jw%>DNJSJPw)zG=QYdW^QAKi^)YNZ@TX+X0?2M}X0RT%9Eqh z9XKd`Wa|y6%_Etfhe!lx*x!cWMK`-D3Phy$yUkDk{gb!%zBo>2?{4LX78n;T!_*HxO|=dHEhcq@M*PpOv4N7#&*J znik^6>iSd`fuwunbYfAMPbb+H8M_EpWWz_g2fYk})MaD8zC!6RDxXFQLHZ0QTrI>4 zj?MSQ2$36)3V${T=NA0IGbrcMM&-+*SST#uPm1h&jzjUGMVvr&}NQ%)mw)~o%O$h1U~fL4`(j~ldsS6w;$wv(J@(Dq_8IOvuCk23ah;iBW!r2Yf3LW0 z3=(9wIN8*U9)aGu=e=561VKs$j#0X`F62uACG+mX3w(!0S~+%A;E>Vb@gr&g3qsJY z74g>{!h$qzJF5jskQ4_4N(d(qi-cVy0TQlASzO=M_2ToUu={ihiY6OLK@lO{ohzy& zI@Uye{e2ZM!pO}plXvC`aSL~kFi$OST^7$YAI$l}h0pcO<(*LF-Y^%+XJPqgfGn?{ zuJUo-{E$^p;VEJ*cBUhp^^cL#;oSFh=Lg+tWSY-OD=C>mGaUwlv(%?hZf>jb-MDaA z?*d;bQ#JLCm83#Z{0LJz!#nFzRGRDL4ptGnZD$KW>I^yC-e}o zj24#uPM4bs3SACof=q4#*x9l9AEgms&Q?Zk{$T_g^A87jw)bfvVG|lebV>W`RoUOZ z`IXKJFK7rn(zK5+iA3X{i+-g{sJ+L!_ht{iX^xKPe@e?s_jmU9oOZ~bBhEHoeaB1; ziilks%TfUQAV}oHHPrJI|5yrMUpFp-oK)!OkGHRD!el8B)8MFoWP#qj;Z{T%2XD?nM>I9a{zn&^EHFm&Go+jo+8Q!ri6oM!K?s>#Z{ z`EQGd&76!)UF%Dvi#}PUvggkN^Lg%hUWb_H-%qi6e=b0lQsQ&mf1~io0@_&R>Ai}P znmg^)#ftN~+^lU61tIJZLk+O=^5={U4103i3#FS7gqS7uPUNG={y^%OlEE+o02mCx ztJ(`wGDzZJ@Q;+|%^lN%M<>{TkQ`KN>|0Sv?zO*L!;Yy|Le7O3B?dG-rti^ScNEyi zVLHL7TJp2UnDlWuzC*W{59^`c_l5p{QaLHZ&*N5|Ek$4dsJmk#jhiSa5@XWi>!GCU zzgp)ht5``}Ddj!`r0ml7hBlxVQb$QiPR>s8tkvxY#Q^Dn2XF+SZYJNnW2qsw2?9G+ zOii@ecpym1L5u3fqLd_kE0gjaWzSNi+?_m{2o^PqNvkDya4((3Ul+`07=eRf8kd|s zy7(WGaENQ)_1)hH#k|@@nzqSO1@i_{{W;9RWJS< z9_;{cDQ_=)ORcS;T}$dG^4)mFM3-JG<`O^TkGNSc@{ zaGb4t?S94qwxqlPvbpCaYz_0M#)M&hU+|`u*rr|Kdj#&Yq!CbZaL@Rab-zDQe9i$x zp@!DPT#gob|FcjFou4(UEC5CV^YKEbU)sB_G6nu=eWA9#Lb7_^K` zUWpmh>$6k#gMATSIKD6}?d?}!cH4{Fi?@=7eq1KqTSTFwI-z(Fqab3Af z^Q?2*BTBn)}sm^V^Woz3;(Kf}I(q-%rUc2L3M2yKXIPuzUb^<@w4F{yFU483VARto)KE zR6!Z1GrzdRYt>_a%(vS4>4zsKxcxvD1!>4!n%uT|j#~*mNw1y2qhh?n45Ib`HXJo1 z4AOT5{$dRsbK~I^P`sl7d`w6YgY}2nw+hv93Jx`L+QkX)n{7Z$`}@Wn$pxt4nXa{C zbnT)#?m7|!7LAPMuWfU{cNKYbkrrS^jRO_bU~qwLg4J>`=kONEkU?kh`69NP>NH@YbW;P53>Ce(KSGS-~mPIkoeNja=R z&`zvv!|Kk~!+oIJY)&ctgGQEePa4VdGX?KGA}NQRnzw`c@ZD>6L~b4z%SMU*;o<)M zSnIPLC0}T~@>2i2^?@gp?)1>FAyU@|!0QQUM zfwoJXEIm#=am|-4dnfy_SWu0b)u-2VGq{{Hha%CQlL$)Un4&iJk=3P*#;OW>6FPv1 zERmgaB_$#7>B{bJ`)}Wd6pq_e&(iSEH6ROs*MU)j z?>i7N1fqKDGabM#BYdzsq-O8UZ(k=_+KYv!5+C;kA^kHVuHL{$EaO&?1{5w(Sz0h@ zT}S-x`3$!G?zO7B|NEJ3I?0fn>VGknwhl6Ag!K9#>ab_5?!Q2XJzXGt{P~bC*Jj@A iBMQ(K7&^2505@ZMm#_&LcLGBJk`kAHS1hXk`Tqcs`E~sO literal 0 HcmV?d00001 diff --git a/doc/guide/admin/appendix-common-errors.sdf b/doc/guide/admin/appendix-common-errors.sdf index f24f509c40..009189c84f 100644 --- a/doc/guide/admin/appendix-common-errors.sdf +++ b/doc/guide/admin/appendix-common-errors.sdf @@ -22,7 +22,8 @@ replacing {{}} and {{}} with the hostname and the port the server is supposed to listen on. * the client has not been instructed to contact a running server; with OpenLDAP command-line tools this is accomplished by providing the -H switch, whose -argument is a valid LDAP url corresponding to the interface the server is supposed to be listening on. +argument is a valid LDAP url corresponding to the interface the server is +supposed to be listening on. H3: ldap_*: No such object @@ -39,7 +40,8 @@ Also note that, by default, a new directory server holds no objects server and get this message, it may simply be that you have yet to add the object you are trying to locate. -The error commonly occurs because a DN was not specified and a default was not properly configured. +The error commonly occurs because a DN was not specified and a default was not +properly configured. If you have a suffix specified in slapd.conf eg. @@ -51,16 +53,38 @@ You should use to tell it where to start the search. -The -b should be specified for all LDAP commands unless you have an ldap.conf(5) default configured. +The {{F:-b}} should be specified for all LDAP commands unless you have an +{{ldap.conf}}(5) default configured. -See Also: ldapsearch(1), ldapmodify(1), and (Xref) How do I specify default base DN for clients? -Also, slapadd(8) and its ancillary programs are very strict about the syntax of the LDIF file. Some liberties in the LDIF file may result in an apparently successful creation of the database, but accessing some parts of it may be difficult. +See {{ldapsearch}}(1), {{ldapmodify}}(1) -One known common error in database creation is putting a blank line before the first entry in the LDIF file. There must be no leading blank lines in the LDIF file. +Also, {{slapadd}}(8) and its ancillary programs are very strict about the +syntax of the LDIF file. -It is generally recommended that ldapadd(1) be used instead of slapadd(8) when adding new entries your directory. slapadd(8) should be used to bulk load entries known to be valid. -Another cause of this message is a referral entry to an unpopulated directory. Either remove the referral, or add a single record with the referral base DN to the empty directory. -This error may also occur when slapd is unable to access the contents of its database because of file permission problems. For instance, on a Red Hat Linux system, slapd runs as user 'ldap'. When slapadd is run as root to create a database from scratch, the contents of /var/lib/ldap are created with user and group root and with permission 600, making the contents inaccessible to the slapd server. +Some liberties in the LDIF file may result in an apparently successful creation +of the database, but accessing some parts of it may be difficult. + +One known common error in database creation is putting a blank line before the +first entry in the LDIF file. {{B:There must be no leading blank lines in the +LDIF file.}} + +It is generally recommended that {{ldapadd}}(1) be used instead of {{slapadd}}(8) +when adding new entries your directory. {{slapadd}}(8) should be used to bulk +load entries known to be valid. + +Another cause of this message is a referral +({SECT:Constructing a Distributed Directory Service}}) entry to an unpopulated +directory. + +Either remove the referral, or add a single record with the referral base DN +to the empty directory. + +This error may also occur when slapd is unable to access the contents of its +database because of file permission problems. For instance, on a Red Hat Linux +system, slapd runs as user 'ldap'. When slapadd is run as root to create a +database from scratch, the contents of {{F:/var/lib/ldap}} are created with +user and group root and with permission 600, making the contents inaccessible +to the slapd server. H3: ldap_*: Can't chase referral @@ -68,47 +92,73 @@ This is caused by the line > referral ldap://root.openldap.org -in slapd.conf, It was provided as an example for how to use referrals in the original file. however if your machine is not permanently connected to the Internet, it will fail to find the server, and hence produce an error message. +In {{F:slapd.conf}}, it was provided as an example for how to use referrals +in the original file. However if your machine is not permanently connected to +the Internet, it will fail to find the server, and hence produce an error message. + +To resolve, just place a # in front of line and restart slapd or point it to +an available ldap server. -To resolve, just place a # in front of line and restart slapd or point it to an available ldap server. -See also: ldapadd(1) ldapmodify(1) slapd.conf(5) +See also: {{ldapadd}}(1), {{ldapmodify}}(1) and {{slapd.conf}}(5) H3: ldap_*: server is unwilling to perform -The OpenLDAP server will return an unwilling to perform error if the backend holding the target entry does not support the given operation. -The password backend is only willing to perform searches. It will return an unwilling to perform error for all other operations. +slapd will return an unwilling to perform error if the backend holding the +target entry does not support the given operation. + +The password backend is only willing to perform searches. It will return an +unwilling to perform error for all other operations. + The shell backend is configurable and may support a limited subset of operations. -Check for other errors indicating a shortage of resources required by the directory server. i.e. you may have a full disk etc +Check for other errors indicating a shortage of resources required by the +directory server. i.e. you may have a full disk etc H3: ldap_*: Insufficient access -This error occurs when server denies the operation due to insufficient access. This is usually caused by binding to a DN with insufficient privileges (or binding anonymously) to perform the operation. You can bind as the rootdn/rootpw specified in slapd.conf(5) to gain full access. Otherwise, you must bind to an entry which has been granted the appropriate rights through access controls. -See also: ldapadd(1) ldapdelete(1) ldapmodify(1) ldapmodrdn(1) ldapsearch(1) slapd.conf(5) -(Xref) ldap_bind: Insufficient access (Xref) Access Control +This error occurs when server denies the operation due to insufficient access. +This is usually caused by binding to a DN with insufficient privileges +(or binding anonymously) to perform the operation. + +You can bind as the rootdn/rootpw specified in {{slapd.conf}}(5) to gain full +access. Otherwise, you must bind to an entry which has been granted the +appropriate rights through access controls. + H3: ldap_*: Invalid DN syntax -The target (or other) DN of the operation is invalid. This implies that either the string representation of the DN is not in the required form, one of the types in the attribute value assertions is not defined, or one of the values in the attribute value assertions does not conform to the appropriate syntax. +The target (or other) DN of the operation is invalid. This implies that either +the string representation of the DN is not in the required form, one of the +types in the attribute value assertions is not defined, or one of the values +in the attribute value assertions does not conform to the appropriate syntax. H3: ldap_*: Referral hop limit exceeded -This error generally occurs when the client chases a referral which refers itself back to a server it already contacted. The server responds as it did before and the client loops. This loop is detected when the hop limit is exceeded. +This error generally occurs when the client chases a referral which refers +itself back to a server it already contacted. The server responds as it did +before and the client loops. This loop is detected when the hop limit is exceeded. -This is most often caused through misconfiguration of the server's default referral. The default referral should not be itself: +This is most often caused through misconfiguration of the server's default +referral. The default referral should not be itself: -That is, on ldap://myldap/ the default referral should not be ldap://myldap/ (or any hostname/ip which is equivalent to myldap). +That is, on {{F:ldap://myldap/}} the default referral should not be {{F:ldap://myldap/}} + (or any hostname/ip which is equivalent to myldap). H3: ldap_*: operations error -In some versions of slapd(8), operationsError was returned instead of other. See also: (Xref) ldap_*: other error. +In some versions of {{slapd}}(8), {{operationsError}} was returned instead of other. H3: ldap_*: other error -The other result code indicates an internal error has occurred. While the additional information provided with the result code might provide some hint as to the problem, often one will need to consult the server's log files. +The other result code indicates an internal error has occurred. +While the additional information provided with the result code might provide +some hint as to the problem, often one will need to consult the server's log files. H3: ldap_add/modify: Invalid syntax -This error is reported when a value of an attribute does not conform to syntax restrictions. Additional information is commonly provided stating which value of which attribute was found to be invalid. Double check this value and other values (the server will only report the first error it finds). +This error is reported when a value of an attribute does not conform to syntax +restrictions. Additional information is commonly provided stating which value +of which attribute was found to be invalid. Double check this value and other +values (the server will only report the first error it finds). Common causes include: @@ -117,70 +167,125 @@ Common causes include: * empty values (few syntaxes allow empty values) -For certain syntax, like OBJECT IDENTIFIER (OID), this error can indicate that the OID descriptor (a "short name") provided is unrecognized. For instance, this error is returned if the objectClass value provided is unrecognized. +For certain syntax, like OBJECT IDENTIFIER (OID), this error can indicate that +the OID descriptor (a "short name") provided is unrecognized. For instance, +this error is returned if the {{objectClass}} value provided is unrecognized. H3: ldap_add/modify: Object class violation -This error is returned with the entry to be added or the entry as modified violates the object class schema rules. Normally additional information is returned the error detailing the violation. Some of these are detailed below. +This error is returned with the entry to be added or the entry as modified +violates the object class schema rules. Normally additional information is +returned the error detailing the violation. Some of these are detailed below. Violations related to the entry's attributes: > Attribute not allowed - A provided attribute is not allowed by the entry's object class(es). + +A provided attribute is not allowed by the entry's object class(es). + > Missing required attribute - An attribute required by the entry's object class(es) was not provided. + +An attribute required by the entry's object class(es) was not provided. Violations related to the entry's class(es): > Entry has no objectClass attribute - The entry did not state which object classes it belonged to. + +The entry did not state which object classes it belonged to. + > Unrecognized objectClass - One (or more) of the listed objectClass values is not recognized. + +One (or more) of the listed objectClass values is not recognized. + > No structural object class provided - None of the listed objectClass values is structural. + +None of the listed objectClass values is structural. + > Invalid structural object class chain - Two or more structural objectClass values are not in same structural object class chain. See also (Xref) ldap add: invalid structural object class chain. + +Two or more structural objectClass values are not in same structural object +class chain. + > Structural object class modification - Modify operation attempts to change the structural class of the entry. See also (Xref) ldap_modify: cannot modify object class. + +Modify operation attempts to change the structural class of the entry. + > Instanstantiation of abstract objectClass. - An abstract class is not subordinate to any listed structural or auxiliary class. + +An abstract class is not subordinate to any listed structural or auxiliary class. + > Invalid structural object class - Other structural object class problem. + +Other structural object class problem. + > No structuralObjectClass operational attribute - This is commonly returned when a shadow server is provided an entry which does not contain the structuralObjectClass operational attribute. + +This is commonly returned when a shadow server is provided an entry which does +not contain the structuralObjectClass operational attribute. -Note that the above error messages as well as the above answer assumes basic knowledge of LDAP/X.500 schema. +Note that the above error messages as well as the above answer assumes basic +knowledge of LDAP/X.500 schema. H3: ldap_add: No such object -The "ldap_add: No such object" error is commonly returned if parent of the entry being added does not exist. Add the parent entry first... +The "ldap_add: No such object" error is commonly returned if parent of the +entry being added does not exist. Add the parent entry first... For example, if you are adding "cn=bob,dc=domain,dc=com" and you get: > ldap_add: No such object -The entry "dc=domain,dc=com" likely doesn't exist. You can use ldapsearch to see if does exist: +The entry "dc=domain,dc=com" likely doesn't exist. You can use ldapsearch to +see if does exist: > ldapsearch -b 'dc=domain,dc=com' -s base '(objectclass=*)' -If it doesn't, add it. See the Quick Start Guide (http://www.openldap.org/doc/admin/quickstart.html) for assistance. +If it doesn't, add it. See {{SECT:A Quick-Start Guide}} for assistance. -Note: if the entry being added is the same as database suffix, it's parent isn't required. i.e.: if your suffix is "dc=domain,dc=com", "dc=com" doesn't need to exist to add "dc=domain,dc=com". -This error will also occur if you try to add any entry that the server is not configured to hold. +Note: if the entry being added is the same as database suffix, it's parent +isn't required. i.e.: if your suffix is "dc=domain,dc=com", "dc=com" doesn't +need to exist to add "dc=domain,dc=com". -For example, if your database suffix is "dc=domain,dc=com" and you attempt to add "dc=domain2,dc=com", "dc=com", "dc=domain,dc=org", "o=domain,c=us", or an other DN in the "dc=domain,dc=com" subtree, the server will return a "No such object" (or referral) error. +This error will also occur if you try to add any entry that the server is not +configured to hold. -slapd(8) will generally return "no global superior knowledge" as additional information indicating its return noSuchObject instead of a referral as the server is not configured with knowledge of a global superior server. -See also: ldapadd(1) ldapmodify(1) (Xref) ldap_add/delete/modify/rename: no global superior knowledge +For example, if your database suffix is "dc=domain,dc=com" and you attempt to +add "dc=domain2,dc=com", "dc=com", "dc=domain,dc=org", "o=domain,c=us", or an +other DN in the "dc=domain,dc=com" subtree, the server will return a + "No such object" (or referral) error. -H3: ldap add: invalid structural object class chain +{{slapd}}(8) will generally return "no global superior knowledge" as additional +information indicating its return noSuchObject instead of a referral as the +server is not configured with knowledge of a global superior server. -This particular error refers to the rule about STRUCTURAL objectclasses, which states that an object is of one STRUCTURAL class, the structural class of the object. The object is said to belong to this class, zero or more auxiliaries classes, and their super classes. While all of these classes are commonly listed in the objectClass attribute of the entry, one of these classes is the structural object class of the entry. Thus, it is OK for an objectClass attribute to contain inetOrgPerson, organizationalPerson, and person because they inherit one from another to form a single super class chain. That is, inetOrgPerson SUPs organizationPerson SUPs person. On the other hand, it is invalid for both inetOrgPerson and account to be listed in objectClass as inetOrgPerson and account are not part of the same super class chain (unless some other class is also listed with is a subclass of both). -To resolve this problem, one must determine which class will better serve structural object class for the entry, adding this class to the objectClass attribute (if not already present), and remove any other structural class from the entry's objectClass attribute which is not a super class of the structural object class. +H3: ldap add: invalid structural object class chain -Which object class is better depends on the particulars of the situation. One generally should consult the documentation for the applications one is using for help in making the determination. +This particular error refers to the rule about STRUCTURAL objectclasses, which +states that an object is of one STRUCTURAL class, the structural class of the +object. The object is said to belong to this class, zero or more auxiliaries + classes, and their super classes. + +While all of these classes are commonly listed in the objectClass attribute of +the entry, one of these classes is the structural object class of the entry. +Thus, it is OK for an objectClass attribute +to contain inetOrgPerson, organizationalPerson, and person because they inherit + one from another to form a single super class chain. That is, inetOrgPerson SUPs +organizationPerson SUPs person. On the other hand, it is invalid for both inetOrgPerson +and account to be listed in objectClass as inetOrgPerson and account are not +part of the same super class chain (unless some other class is also listed +with is a subclass of both). + +To resolve this problem, one must determine which class will better serve +structural object class for the entry, adding this class to the objectClass +attribute (if not already present), and remove any other structural class from +the entry's objectClass attribute which is not a super class of the structural +object class. + +Which object class is better depends on the particulars of the situation. +One generally should consult the documentation for the applications one is +using for help in making the determination. H3: ldap_add: no structuralObjectClass operational attribute @@ -190,77 +295,95 @@ ldapadd(1) may error: > ldap_add: Internal (implementation specific) error (80) > additional info: no structuralObjectClass operational attribute -when slapd(8) cannot determine, based upon the contents of the objectClass attribute, what the structural class of the object should be. +when slapd(8) cannot determine, based upon the contents of the objectClass +attribute, what the structural class of the object should be. -While this normally should produce an object class violation error, some versions of slapd(8) contain a minor bug which cause the object class error not to be properly detected. In these versions, slapd(8) instead catches its failure to populate the structuralObjectClass operational attribute (hence the internal error). -Kurt@OpenLDAP.org -See also: (Xref) ldap add: invalid structural object class chain -Kurt@OpenLDAP.org H3: ldap_add/modify/rename: Naming violation -OpenLDAP's slapd checks for naming attributes and distinguished values consistency, according to RFC 4512. +OpenLDAP's slapd checks for naming attributes and distinguished values consistency, +according to RFC 4512. -Naming attributes are those attributeTypes that appear in an entry's RDN; distinguished values are the values of the naming attributes that appear in an entry's RDN, e.g, in +Naming attributes are those attributeTypes that appear in an entry's RDN; + distinguished values are the values of the naming attributes that appear in +an entry's RDN, e.g, in > cn=Someone+mail=someone@example.com,dc=example,dc=com -the naming attributes are cn and mail, and the distinguished values are Someone and someone@example.com. +the naming attributes are cn and mail, and the distinguished values are +Someone and someone@example.com. OpenLDAP's slapd checks for consistency when: - * adding an entry - * modifying an entry, if the values of the naming attributes are changed - * renaming an entry, if the RDN of the entry changes +* adding an entry +* modifying an entry, if the values of the naming attributes are changed +* renaming an entry, if the RDN of the entry changes Possible causes of error are: - * the naming attributes are not present in the entry; for example: +* the naming attributes are not present in the entry; for example: > dn: dc=example,dc=com > objectClass: organization > o: Example > # note: "dc: example" is missing - * the naming attributes are present in the entry, but in the attributeType definition they are marked as: - o collective - o operational - o obsolete - * the naming attributes are present in the entry, but the distinguished values are not; for example: +* the naming attributes are present in the entry, but in the attributeType +definition they are marked as: +- collective +- operational +- obsolete + +* the naming attributes are present in the entry, but the distinguished values +are not; for example: > dn: dc=example,dc=com > objectClass: domain > dc: foobar > # note: "dc" is present, but the value is not "example" - * the naming attributes are present in the entry, with the distinguished values, but the naming attributes: - o do not have an equality field, so equality cannot be asserted - o the matching rule is not supported (yet) - o the matching rule is not appropriate - * the given distinguished values do not comply with their syntax - * other errors occurred during the validation/normalization/match process; this is a catchall: look at previous logs for details in case none of the above apply to your case. +* the naming attributes are present in the entry, with the distinguished values, but the naming attributes: +- do not have an equality field, so equality cannot be asserted +- the matching rule is not supported (yet) +- the matching rule is not appropriate + +* the given distinguished values do not comply with their syntax + +* other errors occurred during the validation/normalization/match process; +this is a catchall: look at previous logs for details in case none of the above +apply to your case. + +In any case, make sure that the attributeType definition for the naming attributes +contains an appropriate EQUALITY field; or that of the superior, if they are +defined based on a superior attributeType (look at the SUP field). See RFC 4512 for details. -In any case, make sure that the attributeType definition for the naming attributes contains an appropriate EQUALITY field; or that of the superior, if they are defined based on a superior attributeType (look at the SUP field). See RFC 4512 for details. -ando@sys-net.it, Kurt@OpenLDAP.org H3: ldap_add/delete/modify/rename: no global superior knowledge -If the target entry name places is not within any of the databases the server is configured to hold and the server has no knowledge of a global superior, the server will indicate it is unwilling to perform the operation and provide the text "no global superior knowledge" as additional text. +If the target entry name places is not within any of the databases the server +is configured to hold and the server has no knowledge of a global superior, +the server will indicate it is unwilling to perform the operation and provide +the text "no global superior knowledge" as additional text. + +Likely the entry name is incorrect, or the server is not properly configured +to hold the named entry, or, in distributed directory environments, a default +referral was not configured. -Likely the entry name is incorrect, or the server is not properly configured to hold the named entry, or, in distributed directory environments, a default referral was not configured. -Kurt@OpenLDAP.org H3: ldap_bind: Insufficient access -Current versions of slapd(8) requires that clients have authentication permission to attribute types used for authentication purposes before accessing them to perform the bind operation. As all bind operations are done anonymously (regardless of previous bind success), the auth access must be granted to anonymous. +Current versions of slapd(8) requires that clients have authentication +permission to attribute types used for authentication purposes before accessing +them to perform the bind operation. As all bind operations are done anonymously +(regardless of previous bind success), the auth access must be granted to anonymous. In the example ACL below grants the following access: - * to anonymous users: - o permission to authenticate using values of userPassword - * to authenticated users: - o permission to update (but not read) their userPassword - o permission to read any object excepting values of userPassword +* to anonymous users: +- permission to authenticate using values of userPassword +* to authenticated users: +- permission to update (but not read) their userPassword +- permission to read any object excepting values of userPassword All other access is denied. @@ -273,68 +396,84 @@ All other access is denied. > by users read -Note that latest versions of slapd(8) will report invalid credentials in cases where the client has insufficient access to complete the operation. This is avoid inappropriate disclosure of the validity of the user's name. -See also: ldapadd(1) ldapdelete(1) ldapmodify(1) ldapmodrdn(1) ldapsearch(1) slapd.conf(5) (Xref) Access Control - H3: ldap_bind: Invalid credentials -The error usually occurs when the credentials (password) provided does not match the userPassword held in entry you are binding to. +The error usually occurs when the credentials (password) provided does not +match the userPassword held in entry you are binding to. The error can also occur when the bind DN specified is not known to the server. -Check both! -In addition to the cases mentioned above you should check if the server denied access to userPassword on selected parts of the directory. In fact, slapd always returns "Invalid credentials" in case of failed bind, regardless of the failure reason, since other return codes could reveal the validity of the user's name. +Check both! In addition to the cases mentioned above you should check if the +server denied access to userPassword on selected parts of the directory. In +fact, slapd always returns "Invalid credentials" in case of failed bind, +regardless of the failure reason, since other return codes could reveal the +validity of the user's name. To debug access rules defined in slapd.conf, add "ACL" to log level. -See also: ldapadd(1) ldapdelete(1) ldapmodify(1) ldapmodrdn(1) ldapsearch(1) slapd.conf(5) (Xref) ldap_bind: No such object - -H3: ldap_bind: No such object - -This answer is specific to OpenLDAP 1.2 and earlier releases. In later releases, ldap_bind returns (Xref) ldap_bind: Invalid credentials instead. -'No such object' is only returned by ldap_bind operation in a few special cases. Normally, the server returns (Xref) ldap_bind: Invalid credentials when the entry associated with the bind DN cannot be located. -This error occurs when binding using the rootdn and the asserted value doesn't match configured password value. Rootpw values must be conform to RFC 2307 format defined for userPassword. -See also: ldapadd(1) ldapdelete(1) ldapmodify(1) ldapmodrdn(1) ldapsearch(1) slapd.conf(5) (Xref) ldap_bind: Invalid credentials H3: ldap_bind: Protocol error -There error is generally occurs when the LDAP version requested by the client is not supported by the server. +There error is generally occurs when the LDAP version requested by the +client is not supported by the server. -The OpenLDAP Software 1.x server only accepts version 2 LDAP Bind requests. Note that 1.x server expects U-Mich LDAP, an LDAPv2 variant, to be used. This variant is sometimes referred to as LDAPv2+. +The OpenLDAP Software 2.x server, by default, only accepts version 3 LDAP Bind +requests but can be configured to accept a version 2 LDAP Bind request. -The OpenLDAP Software 2.x server, by default, only accepts version 3 LDAP Bind requests but can be configured to accept a version 2 LDAP Bind request. Note that the 2.x server expects LDAPv3 [RFC4510] to be used when the client requests version 3 and expects a limited LDAPv3 variant (basically, LDAPv3 syntax and semantics in an LDAPv2 PDUs) to be used when version 2 is expected. This variant is also sometimes referred to as LDAPv2+, but differs from the U-Mich LDAP variant in a number of ways. +Note: The 2.x server expects LDAPv3 [RFC4510] to be used when the client +requests version 3 and expects a limited LDAPv3 variant (basically, LDAPv3 +syntax and semantics in an LDAPv2 PDUs) to be used when version 2 is expected. -Use of LDAPv3! -See also: (Xref) How to configure slapd(8) with LDAPv2 support (for legacy clients)?. +This variant is also sometimes referred to as LDAPv2+, but differs from the U-Mich +LDAP variant in a number of ways. H3: ldap_modify: cannot modify object class -This message is commonly returned when attempting to modify the objectClass attribute in a manner inconsistent with the LDAP/X.500 information model. In particular, it commonly occurs when one tries to change the structure of the object from one class to another, for instance, trying to change an 'apple' into a 'pear' or a 'fruit' into a 'pear'. Such changes are disallowed by the slapd(8) in accordance with LDAP and X.500 restrictions. +This message is commonly returned when attempting to modify the objectClass +attribute in a manner inconsistent with the LDAP/X.500 information model. In +particular, it commonly occurs when one tries to change the structure of the +object from one class to another, for instance, trying to change an 'apple' +into a 'pear' or a 'fruit' into a 'pear'. + +Such changes are disallowed by the slapd(8) in accordance with LDAP and X.500 restrictions. -To overcome this restriction in 2.3 (and prior releases), one must re-create the object with the desired new structural object class (e.g., delete old object then add new object). In 2.4, support for a new control will (hopefully) be introduced to allow the (authorized) user to request this (and various other model restrictions) be temporarily relaxed. H3: ldap_sasl_interactive_bind_s: ... -If you intended to bind using a DN and password and get an error from ldap_sasl_interactive_bind_s, you likely forgot to provide a '-x' option to the command. By default, SASL authentication is used. '-x' is necessary to select "simple" authentication. -Kurt@OpenLDAP.org +If you intended to bind using a DN and password and get an error from +ldap_sasl_interactive_bind_s, you likely forgot to provide a '-x' option to +the command. By default, SASL authentication is used. '-x' is necessary to +select "simple" authentication. + H3: ldap_sasl_interactive_bind_s: No such Object -This indicates that LDAP SASL authentication function could not read the Root DSE. -The error will occur when the server doesn't provide a root DSE. This may be due to access controls. +This indicates that LDAP SASL authentication function could not read the +Root DSE. +The error will occur when the server doesn't provide a root DSE. This may be +due to access controls. -Note, also, that LDAPv2 servers, such as those OpenLDAP 1.x's slapd(8), do not provide a root DSE. Use -P 2 when LDAPv2 is desired. LDAPv2 servers also do not support SASL binds, so you will need to use a "simple" bind instead. -Note: SASL bind is the default for all OpenLDAP tools. To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). H3: ldap_sasl_interactive_bind_s: No such attribute -This indicates that LDAP SASL authentication function could read the Root DSE but it contained no supportedSASLMechanism attribute. -The supportedSASLmechanism attribute lists mechanisms currently available. The list may be empty because none of the supported mechanisms are currently available. For example, EXTERNAL is listed only if the client has established its identity by authenticating at a lower level (e.g. TLS). +This indicates that LDAP SASL authentication function could read the Root +DSE but it contained no supportedSASLMechanism attribute. + +The supportedSASLmechanism attribute lists mechanisms currently available. +The list may be empty because none of the supported mechanisms are currently +available. For example, EXTERNAL is listed only if the client has established +its identity by authenticating at a lower level (e.g. TLS). + Note: the attribute may not be visible due to access controls + Note: SASL bind is the default for all OpenLDAP tools, e.g. ldapsearch(1), ldapmodify(1). To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). H3: ldap_sasl_interactive_bind_s: Unknown authentication method -This indicates that none of the SASL authentication supported by the server are supported by the client, or that they are too weak or otherwise inappropriate for use by the client. Note that the default security options disallows the use of certain mechanisms such as ANONYMOUS and PLAIN (without TLS). +This indicates that none of the SASL authentication supported by the server +are supported by the client, or that they are too weak or otherwise inappropriate +for use by the client. Note that the default security options disallows the use +of certain mechanisms such as ANONYMOUS and PLAIN (without TLS). + Note: SASL bind is the default for all OpenLDAP tools. To force use of "simple" bind, use the "-x" option. Use of "simple" bind is not recommended unless one has adequate confidentiality protection in place (e.g. TLS/SSL, IPSEC). H3: ldap_sasl_interactive_bind_s: Local error (82) @@ -344,9 +483,12 @@ Apparently not having forward and reverse DNS entries for the LDAP server can re H3: ldap_search: Partial results and referral received -This error is returned with the server responses to an LDAPv2 search query with both results (zero or more matched entries) and references (referrals to other servers). +This error is returned with the server responses to an LDAPv2 search query +with both results (zero or more matched entries) and references (referrals to other servers). See also: ldapsearch(1). -If the updatedn on the replica does not exist, a referral will be returned. It may do this as well if the ACL needs tweaking. + +If the updatedn on the replica does not exist, a referral will be returned. +It may do this as well if the ACL needs tweaking. H3: ldap_start_tls: Operations error @@ -355,96 +497,119 @@ ldapsearch(1) and other tools will return > ldap_start_tls: Operations error (1) > additional info: TLS already started -when the user (though command line options and/or ldap.conf(5)) has requested TLS (SSL) be started twice. For instance, when specifying both "-H ldaps://server.do.main" and "-ZZ". +When the user (though command line options and/or ldap.conf(5)) has requested +TLS (SSL) be started twice. For instance, when specifying both "-H ldaps://server.do.main" and "-ZZ". H2: Other Errors H3: ber_get_next on fd X failed errno=34 (Numerical result out of range) -This slapd error generally indicates that the client sent a message that exceeded an administrative limit. See sockbuf_max_incoming and sockbuf_max_incoming_auth configuration directives in slapd.conf(5). +This slapd error generally indicates that the client sent a message that +exceeded an administrative limit. See sockbuf_max_incoming and sockbuf_max_incoming_auth +configuration directives in slapd.conf(5). H3: ber_get_next on fd X failed errno=11 (Resource temporarily unavailable) -This message is not indicative of abnormal behavior or error. It simply means that expected data is not yet available from the resource, in this context, a network socket. slapd(8) will process the data once it does becomes available. +This message is not indicative of abnormal behavior or error. It simply means +that expected data is not yet available from the resource, in this context, a +network socket. slapd(8) will process the data once it does becomes available. H3: daemon: socket() failed errno=97 (Address family not supported) -This message indicates that the operating system does not support one of the (protocol) address families which slapd(8) was configured to support. Most commonly, this occurs when slapd(8) was configured to support IPv6 yet the operating system kernel wasn't. In such cases, the message can be ignored. +This message indicates that the operating system does not support one of the +(protocol) address families which slapd(8) was configured to support. Most +commonly, this occurs when slapd(8) was configured to support IPv6 yet the +operating system kernel wasn't. In such cases, the message can be ignored. H3: GSSAPI: gss_acquire_cred: Miscellaneous failure; Permission denied; -This message means that slapd is not running as root and, thus, it cannot get its Kerberos 5 key from the keytab, usually file /etc/krb5.keytab. +This message means that slapd is not running as root and, thus, it cannot get +its Kerberos 5 key from the keytab, usually file /etc/krb5.keytab. -A keytab file is used to store keys that are to be used by services or daemons that are started at boot time. It is very important that these secrets are kept beyond reach of intruders. +A keytab file is used to store keys that are to be used by services or daemons +that are started at boot time. It is very important that these secrets are kept +beyond reach of intruders. -That's why the default keytab file is owned by root and protected from being read by others. Do not mess with these permissions, build a different keytab file for slapd instead. +That's why the default keytab file is owned by root and protected from being +read by others. Do not mess with these permissions, build a different keytab +file for slapd instead. To do this, start kadmin, and enter the following commands: - * addprinc -randkey ldap/ldap.example.com@EXAMPLE.COM - * ktadd -k /etc/openldap/ldap.keytab ldap/ldap.example.com@EXAMPLE.COM +> addprinc -randkey ldap/ldap.example.com@EXAMPLE.COM +> ktadd -k /etc/openldap/ldap.keytab ldap/ldap.example.com@EXAMPLE.COM Then, on the shell, do: - * chown ldap.ldap /etc/openldap/ldap.keytab - * chmod 600 /etc/openldap/ldap.keytab +> chown ldap.ldap /etc/openldap/ldap.keytab +> chmod 600 /etc/openldap/ldap.keytab + +Now you have to tell slapd (well, actually tell the gssapi library in Kerberos 5 +that is invoked by Cyrus SASL) where to find the new keytab. You do this by +setting the environment variable KRB5_KTNAME like this: + +> export KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab" -Now you have to tell slapd (well, actually tell the gssapi library in Kerberos 5 that is invoked by Cyrus SASL) where to find the new keytab. You do this by setting the environment variable KRB5_KTNAME like this: +Set that environment variable on the slapd start script (Red Hat users might +find /etc/sysconfig/ldap a perfect place). -export KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab" +This only works if you are using MIT kerberos. It doesn't work with Heimdal, +for instance. -Set that environment variable on the slapd start script (Red Hat users might find /etc/sysconfig/ldap a perfect place). -jsanchez@openldap.org, hyc@openldap.org -This only works if you are using MIT kerberos. It doesn't work with Heimdal, for instance. -andreas@conectiva.com.br -In Heimdal there is a function gsskrb5_register_acceptor_identity() that sets the path of the keytab file you want to use. In Cyrus SASL 2 you can add - keytab: /path/to/file +In Heimdal there is a function gsskrb5_register_acceptor_identity() that sets +the path of the keytab file you want to use. In Cyrus SASL 2 you can add + +> keytab: /path/to/file to your application's SASL config file to use this feature. This only works with Heimdal. -hyc@openldap.org + H3: access from unknown denied This related to TCP wrappers. See hosts_access(5) for more information. -in the log file: "access from unknown denied" This related to TCP wrappers. See hosts_access(5) for more information. -for example: add the line "slapd: .hosts.you.want.to.allow" in /etc/hosts.allow to get rid of the error. +in the log file: "access from unknown denied" This related to TCP wrappers. +See hosts_access(5) for more information. +for example: add the line "slapd: .hosts.you.want.to.allow" in /etc/hosts.allow +to get rid of the error. H3: ldap_read: want=# error=Resource temporarily unavailable -This message occurs normally. It means that pending data is not yet available from the resource, a network socket. slapd(8) will process the data once it becomes available. +This message occurs normally. It means that pending data is not yet available +from the resource, a network socket. slapd(8) will process the data once it +becomes available. H3: `make test' fails Some times, `make test' fails at the very first test with an obscure message like - make test - make[1]: Entering directory `/ldap_files/openldap-2.2.13/tests' - make[2]: Entering directory `/ldap_files/openldap-2.2.13/tests' - Initiating LDAP tests for BDB... - Cleaning up test run directory leftover from previous run. - Running ./scripts/all... - >>>>> Executing all LDAP tests for bdb - >>>>> Starting test000-rootdse ... - running defines.sh - Starting slapd on TCP/IP port 9011... - Using ldapsearch to retrieve the root DSE... - Waiting 5 seconds for slapd to start... - ./scripts/test000-rootdse: line 40: 10607 Segmentation fault $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING >$LOG1 2>&1 - Waiting 5 seconds for slapd to start... - Waiting 5 seconds for slapd to start... - Waiting 5 seconds for slapd to start... - Waiting 5 seconds for slapd to start... - Waiting 5 seconds for slapd to start... - ./scripts/test000-rootdse: kill: (10607) - No such pid - ldap_bind: Can't contact LDAP server (-1) - >>>>> Test failed - >>>>> ./scripts/test000-rootdse failed (exit 1) - make[2]: *** [bdb-yes] Error 1 - make[2]: Leaving directory `/ldap_files/openldap-2.2.13/tests' - make[1]: *** [test] Error 2 - make[1]: Leaving directory `/ldap_files/openldap-2.2.13/tests' - make: *** [test] Error 2 +> make test +> make[1]: Entering directory `/ldap_files/openldap-2.4.6/tests' +> make[2]: Entering directory `/ldap_files/openldap-2.4.6/tests' +> Initiating LDAP tests for BDB... +> Cleaning up test run directory leftover from previous run. +> Running ./scripts/all... +> >>>>> Executing all LDAP tests for bdb +> >>>>> Starting test000-rootdse ... +> running defines.sh +> Starting slapd on TCP/IP port 9011... +> Using ldapsearch to retrieve the root DSE... +> Waiting 5 seconds for slapd to start... +> ./scripts/test000-rootdse: line 40: 10607 Segmentation fault $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING >$LOG1 2>&1 +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> Waiting 5 seconds for slapd to start... +> ./scripts/test000-rootdse: kill: (10607) - No such pid +> ldap_sasl_bind_s: Can't contact LDAP server (-1) +> >>>>> Test failed +> >>>>> ./scripts/test000-rootdse failed (exit 1) +> make[2]: *** [bdb-yes] Error 1 +> make[2]: Leaving directory `/ldap_files/openldap-2.4.6/tests' +> make[1]: *** [test] Error 2 +> make[1]: Leaving directory `/ldap_files/openldap-2.4.6/tests' +> make: *** [test] Error 2 or so. Usually, the five lines @@ -452,31 +617,45 @@ or so. Usually, the five lines indicate that slapd didn't start at all. -For OpenLDAP 2.2 and later, in tests/testrun/slapd.1.log there is a full log of what slapd wrote while trying to start. The log level can be increased by setting the environment variable SLAPD_DEBUG to the corresponding value; see loglevel in slapd.conf(5) for the meaning of log levels. +In tests/testrun/slapd.1.log there is a full log of what slapd wrote while +trying to start. The log level can be increased by setting the environment +variable SLAPD_DEBUG to the corresponding value; see loglevel in slapd.conf(5) +for the meaning of log levels. -A typical reason for this behavior is a runtime link problem, i.e. slapd cannot find some dynamic libraries it was linked against. Try running ldd(1) on slapd (for those architectures that support runtime linking). +A typical reason for this behavior is a runtime link problem, i.e. slapd cannot +find some dynamic libraries it was linked against. Try running ldd(1) on slapd +(for those architectures that support runtime linking). -There might well be other reasons; the contents of the log file should help clarifying them. +There might well be other reasons; the contents of the log file should help +clarifying them. -Tests that fire up multiple instances of slapd typically log to tests/testrun/slapd..log, with a distinct for each instance of slapd; list tests/testrun/ for possible values of . -ando@sys-net.it +Tests that fire up multiple instances of slapd typically log to tests/testrun/slapd..log, +with a distinct for each instance of slapd; list tests/testrun/ for possible +values of . H3: ldap_*: Internal (implementation specific) error (80) - additional info: entry index delete failed -This seems to be related with wrong ownership of the BDB's dir (/var/lib/ldap) and files. -chmod -r openldap:openldap /var/lib/ldap fixes it in Debian Etch. -I don't really know how the wrong permission went into place, but I suspect it has something to do with slapd's starting, no database existing (I had deleted it to get a new, fresh one), and slapd creating one before chroot. -After a bug report, some insightful feedback, and some amount of testing, i found out that the 'wrong ownership of new files' problem is not with slapd but with slapadd. This happens when one initially populates the Directory. -Oh, and the right switch of chown is '-R', not '-r'. -My God! What a mess! The right command to correct this problem is: chown -R /var/lib/ldap +This seems to be related with wrong ownership of the BDB's dir (/var/lib/ldap) +and files. + +> chmod -R openldap:openldap /var/lib/ldap + +fixes it in Debian + -pedrorandrade@gmail.com H3: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) -Using SASL, when a client contacts LDAP server, the slapd service dies immediately and client gets an error : -SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) +Using SASL, when a client contacts LDAP server, the slapd service dies +immediately and client gets an error : + +> SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) + Then check the slapd service, it stopped. -This may come from incompatible of using different versions of BerkeleyDB for installing of SASL and installing of OpenLDAP. The problem arises in case of using multiple version of BerkeleyDB. Solution: - Check which version of BerkeleyDB when install Cyrus SASL. - Reinstall OpenLDAP with the version of BerkeleyDB above. -It was my case and that was the solution I did and it worked :) Hope this gives you some information. --- Le Trung Kien + +This may come from incompatible of using different versions of BerkeleyDB for +installing of SASL and installing of OpenLDAP. The problem arises in case of +using multiple version of BerkeleyDB. Solution: - Check which version of +BerkeleyDB when install Cyrus SASL. + +Reinstall OpenLDAP with the version of BerkeleyDB above. diff --git a/doc/guide/admin/intro.sdf b/doc/guide/admin/intro.sdf index 6c41397b65..210a9a81d8 100644 --- a/doc/guide/admin/intro.sdf +++ b/doc/guide/admin/intro.sdf @@ -361,10 +361,6 @@ For more information on concept and limitations, see {{slapd-sql}}(5) man page, or the {{SECT: Backends}} section. There are also several examples for several RDBMSes in {{F:back-sql/rdbms_depend/*}} subdirectories. -TO REFERENCE: - -http://blogs.sun.com/treydrake/entry/ldap_vs_relational_database -http://blogs.sun.com/treydrake/entry/ldap_vs_relational_database_part H2: What is slapd and what can it do? diff --git a/doc/guide/admin/overlays.sdf b/doc/guide/admin/overlays.sdf index f89ab2a6bf..6bab96dcf2 100644 --- a/doc/guide/admin/overlays.sdf +++ b/doc/guide/admin/overlays.sdf @@ -211,11 +211,86 @@ H2: Dynamic Lists H3: Overview -This overlay allows expansion of dynamic groups and more. - +This overlay allows expansion of dynamic groups and lists. Instead of having the +group members or list attributes hard coded, this overlay allows us to define +an LDAP search whose results will make up the group or list. H3: Dynamic List Configuration +This module can behave both as a dynamic list and dynamic group, depending on +the configuration. The syntax is as follows: + +> overlay dynlist +> dynlist-attrset [member-ad] + +The parameters to the {{F:dynlist-attrset}} directive have the following meaning: +* {{F:}}: specifies which object class triggers the subsequent LDAP search. +Whenever an entry with this object class is retrieved, the search is performed. +* {{F:}}: is the name of the attribute which holds the search URI. It +has to be a subtype of {{F:labeledURI}}. The attributes and values present in +the search result are added to the entry unless {{F:member-ad}} is used (see +below). +* {{F:member-ad}}: if present, changes the overlay behaviour into a dynamic group. +Instead of inserting the results of the search in the entry, the distinguished name +of the results are added as values of this attribute. + +Here is an example which will allow us to have an email alias which automatically +expands to all user's emails according to our LDAP filter: + +In {{slapd.conf}}(5): +> overlay dynlist +> dynlist-attrset nisMailAlias labeledURI + +This means that whenever an entry which has the {{F:nisMailAlias}} object class is +retrieved, the search specified in the {{F:labeledURI}} attribute is performed. + +Let's say we have this entry in our directory: +> cn=all,ou=aliases,dc=example,dc=com +> cn: all +> objectClass: nisMailAlias +> labeledURI: ldap:///ou=People,dc=example,dc=com?mail?one?(objectClass=inetOrgPerson) + +If this entry is retrieved, the search specified in {{F:labeledURI}} will be +performed and the results will be added to the entry just as if they have always +been there. In this case, the search filter selects all entries directly +under {{F:ou=People}} that have the {{F:inetOrgPerson}} object class and retrieves +the {{F:mail}} attribute, if it exists. + +This is what gets added to the entry when we have two users under {{F:ou=People}} +that match the filter: +!import "allmail-en.png"; align="center"; title="Dynamic list for email aliases" +FT[align="Center"] Figure X.Y: Dynamic List for all emails + +The configuration for a dynamic group is similar. Let's see an example which would +automatically populate an {{F:allusers}} group with all the user accounts in the +directory. + +In {{F:slapd.conf}}(5): +> overlay dynlist +> dynlist-attrset groupOfNames labeledURI member + +Let's apply it to the following entry: +> cn=allusers,ou=group,dc=example,dc=com +> cn: all +> objectClass: groupOfNames +> labeledURI: ldap:///ou=people,dc=example,dc=com??one?(objectClass=inetOrgPerson) + +The behaviour is similar to the dynamic list configuration we had before: +whenever an entry with the {{F:groupOfNames}} object class is retrieved, the +search specified in the {{F:labeledURI}} attribute is performed. But this time, +only the distinguished names of the results are added, and as values of the +{{F:member}} attribute. + +This is what we get: +!import "allusersgroup-en.png"; align="center"; title="Dynamic group for all users" +FT[align="Center"] Figure X.Y: Dynamic Group for all users + +Note that a side effect of this scheme of dymamic groups is that the members +need to be specified as full DNs. So, if you are planning in using this for +{{F:posixGroup}}s, be sure to use RFC2307bis and some attribute which can hold +distinguished names. The {{F:memberUid}} attribute used in the {{F:posixGroup}} +object class can hold only names, not DNs, and is therefore not suitable for +dynamic groups. H2: Reverse Group Membership Maintenance @@ -458,13 +533,70 @@ H2: Referential Integrity H3: Overview -This overlay can be used with a backend database such as slapd-bdb (5) +This overlay can be used with a backend database such as slapd-bdb(5) to maintain the cohesiveness of a schema which utilizes reference attributes. +Whenever a {{modrdn}} or {{delete}} is performed, that is, when an entry's DN +is renamed or an entry is removed, the server will search the directory for +references to this DN (in selected attributes: see below) and update them +accordingly. If it was a {{delete}} operation, the reference is deleted. If it +was a {{modrdn}} operation, then the reference is updated with the new DN. + +For example, a very common administration task is to maintain group membership +lists, specially when users are removed from the directory. When an +user account is deleted or renamed, all groups this user is a member of have to be +updated. LDAP administrators usually have scripts for that. But we can use the +{{F:refint}} overlay to automate this task. In this example, if the user is +removed from the directory, the overlay will take care to remove the user from +all the groups he/she was a member of. No more scripting for this. H3: Referential Integrity Configuration +The configuration for this overlay is as follows: +> overlay refint +> refint_attributes +> refint_nothing + +* {{F:refint_attributes}}: this parameter specifies a space separated list of +attributes which will have the referential integrity maintained. When an entry is +removed or has its DN renamed, the server will do an internal search for any of the +{{F:refint_attributes}} that point to the affected DN and update them accordingly. IMPORTANT: +the attributes listed here must have the {{F:distinguishedName}} syntax, that is, +hold DNs as values. +* {{F:refint_nothing}}: some times, while trying to maintain the referential +integrity, the server has to remove the last attribute of its kind from an +entry. This may be prohibited by the schema: for example, the +{{F:groupOfNames}} object class requires at least one member. In these cases, +the server will add the attribute value specified in {{F:refint_nothing}} +to the entry. + +To illustrate this overlay, we will use the group membership scenario. + +In {{F:slapd.conf}}: +> overlay refint +> refint_attributes member +> refint_nothing "cn=admin,dc=example,dc=com" + +This configuration tells the overlay to maintain the referential integrity of the {{F:member}} +attribute. This attribute is used in the {{F:groupOfNames}} object class which always needs +a member, so we add the {{F:refint_nothing}} directive to fill in the group with a standard +member should all the members vanish. + +If we have the following group membership, the refint overlay will +automatically remove {{F:john}} from the group if his entry is removed from the +directory: + +!import "refint.png"; align="center"; title="Group membership" +FT[align="Center"] Figure X.Y: Maintaining referential integrity in groups + +Notice that if we rename ({{F:modrdn}}) the {{F:john}} entry to, say, {{F:jsmith}}, the refint +overlay will also rename the reference in the {{F:member}} attribute, so the group membership +stays correct. + +If we removed all users from the directory who are a member of this group, then the end result +would be a single member in the group: {{F:cn=admin,dc=example,dc=com}}. This is the +{{F:refint_nothing}} parameter kicking into action so that the schema is not violated. H2: Return Code diff --git a/doc/guide/admin/refint.png b/doc/guide/admin/refint.png new file mode 100644 index 0000000000000000000000000000000000000000..41843e7c3c4d1d084562228f09db2bdfa00705ee GIT binary patch literal 30103 zcmYJa1z1$y7dCo^RA~^TK~O+Yx`$E*Q0bB`heo=45S5`tT1r9bkZu@S`bRg6Ad&+^ zH{8Sje&4-34-7DS&R#p#TJQU=y~8!slt}K;-va=E@RUg_KczXI-9BEi4!y1X=S2LN)!?Kh;V^k+EuPdX0;eGhGCYY%S=H!Hx~+nd+U z$-y0N;bO(>>}Hd;BSjAYtiUVSa~+@b?F?^you2ca)?MDfjc?PM3EAem&EC64FH@@D+z=!P!Lrv z^rqd(CMrX>z7a?No;fvqd$~Hf;fy@)8PH8zWcSBom(Ya>u0p?m)k{7y3@p>ZovUk} zI#RH0-Zdvfj6{`3(WqS*0rgSk$wq=Ey;+eulT(BzKngJ$4=@5+fPio=98_ggc}L+d zZ(RL5=B3CSG(H**C_$?1tVqnE2z@}k%B8^xkgRt3`lWjWg8Dg0lTDJ-G&Pm2>O>|N zbnKqNp4V2!l1&R2qJ_uP!JC0YJiP{JIF}riC_W00?d!P>(UaTJB`I-lZQbwIr$;CN zZa_f(UJUN9d#FYjENPTAdjsYHm-nR@DS_R81$zujkcVyQ2JwWi2eJ7@BDIiQ$;cMg zZ0l%plu#)PzuAShE+uo?gSMJ|cPV`NmR>0IDf=Fpu}h zi177qDetQ|;&CYgpYD_)kul^WE{VZ>4{e~TO;<4CN{Ln0u0W97s@vzm^eo7(NO#w5=DIekj&_Sq| z^WXs~IA}5KPzOK20w8g)%`f5i5CSCgL!#Z&u0R$pEfFgOG3t{?8OMx*0Ql&!6$2oX z@K+Y{k`Ar_8>a{;U?o810PR2&-Z#C~F_NZti-a1)iz5b~&XoxaTOj;Ys5zh=a>;_g zg^i~PBoU)1PkKqO=u*9R9Ni;({+)k5%# z4kZP2!S1syJKti&L^PwwoteGpS^b3&24@-)OMQ!!}Ah5h}Xs3;D6~*G3 z<(XKvIX^>4(_Cf(X0dMfryPKH)HlHpG~+4JsQd?p+z2QIYMbD1!yWTz>KhlpmA+OU z2+}oK!Z+8(ZIvj*`U3&EuiOO?^gs)@7%qYmAVY4cw=sxt5>?3X^nGjX!)O8%fCtU8 z2acY-deQv5HtH*z<%Y7CwecKI%!oOisVw1aM#=DBVv)iZh0E&XPU;2o5eaK0ZWnZN zN!=J#AQ3R`I(h?S*|$rPu^M__vBa72CC&wu7=INexO-F2T`TwJ_69{v22IIevB7;wa@z z3twaFLrb_aJ!(IV*vdm~)iiRe*=Rm+{>57MrMrZ?mbV?l;ELhsLkIGlT=}v0wbbVB z$eKSa!EX=F?{iFXF=8!srkvUoMN9ng3hToJVMXPfG4)pyL1?C7RX5APs}-EZJ9=OD z{Hf-}9q-oR6cfVVWmSI&&lftib#TWOyezFJB_uEITeES&cM~Co?7FtXV3Gh{OO*C| zN#(QWfR{jbU-6IlA==2v-}bnRjjeA#;0Ccs0*&_xyY)pVm;mz81P1dc=^2-N!*c|m zYxPf7C8rzS(!(jLoAS=a-&@@I;x9vpnI!Bf1HVz=dx!Qv57x zKg8ubP)!oFifW$5qYFduv>1ikQk))WC7s%1BxvESLl2Cfc-G7Y-@7TRi(enfpK!=VqhU+QgAbVgN~OqTlW`EBW&DlYN9y+9!R&60v7$u-y=`%SoRIfuspJ+Gn%s zf!nS>oBFDmp2COJ)6^c657TLwLS*KrTn4Veq{Aao(t<8{to6*Y7nn|$Iv+^HoY87VwCapFSc zx(!=gr9XK)aYNEF20Ik=X?z=f1CPp(UpS~4e_lhllv;jV&)=;A)A`ik2LQTJ<@Y8$ zwfl~oL%?(|&`FZ#1ThP(=nMv=h-DV$biTAPBrpK)>=Xk&2DlJ;I^>)6QI3mn-zx{0 z0Tu~PgO}_CsA!mFhv5!`qm_;zen5$qW@o&n9>>|TGt2msFbi}gv%TO5mQ%RT@Gl+K zAewwU+FU7AY&km4H=Z?^mXG{~L!q%!JvgWGe^>6xoa-vq z|!_sS${gYJA5zoJu2^TIQ1@HIm}_Wr{4_I z0F!r^>_O$No#Uk7w&dz@&pYZ`I7}7mIt_=2y_*%;3dTKcfz)4<8PiGQT;ps30~%*x z^3|rC^D=;5;o!5#9uz~740>$L4{O(}f+YwR_UW)Ea@wY0TgDINX|w_^KN_(jGM8^` zAf2}R^lW`y%BwW@&}tJ$YFI_5^v`Q1Sc-X#KV=UpN(jZ;=>c=X)0gNP>!grpb>GMC z0+qo09hpAv?nH-4B4O7&q`#knRHYr7prNC5`f%LMDBMAPvO7nh$F?0;zq&C~A) zsr}|xH|9|^y6UXX^2rqouX9I1MXNfcB>6LEz->rSPY-ms^12Ip)-Y{Nf zY(H$bohoib+BDLm%>VoYS`05T)USBLVG-fyKznrNHWx@Cetgt02hcJ_f|CUg5h&N&HQpTeUrNeDeIfn z;AaV*gf2X~3jdzBH}mZz}{xMxFQS!xK4^(1mXmG$bUrzjUZ`h3fV# z(A^RWK$7if{qs7#=d^s!;pUT3Zdm-?^!td|sDI&~)St~!_Zim7^8U>ycf0xS^tUr` zhdM}i`KH$OXT>6JseT_UwHtCr>*F4k-N2iA{E*;qbIQFIJhKBm9tUrLMl!644!%XC^V@`uyeTbI$WTpq1s9y>@*=Cig^1*?D4E&McsRz z|M~~oCktTX_yP1H83xw_UB*qR=&Z0)p>A%GpdB=O?|tiTMFeuYP3g;%;*YhjsW)PA zSVUAUqcF}eAL&z}#!gzHM#U$&`9*Yay=`7a*bRjLvw)~V!0W$Vn=(_H?en-!^->5s zda6BD7iM_zctlhTI%~}2t+kAWJvW=Q8I}&IQlb)#bSC&URTJ}fq{4?&>FYOD2oZ4svR@sH0oBgKc`Gk-B{rvZrJhj?-@;IW?DXN($ff7fg z))b1iziGDVS`Dc#WAj_Y;Z+X#z1;wZehBblPhaE_Jj%q@dVdJW{Eyo{&Kh$1yG<)I z@mEvQoaF~AcT$87_Gm~6mA67>7@7B_=Z;K7IZdu6NuEaCzl2hfQ^{TG*X08DVg+&s z?pNPoYpx_AsA6oTKYCVYbbn9f>5Q>{M0~7d;~f!F;MziMLoD}Ns6}+?iuP4g)cqV|5mGY%~$XAz#OnW1P)A0v+iLPS(}1Ay(G4&5peD>Lk-?TN$kxY}ZN=T{2&?*xlzE&@%+|+|T`RIDk6eFP zUX)mWXoKrRfgqz$2w!4vk43KEjSCJxZG1_!6poa6l#R#6{UDfS)N(~0)=Hr%L-Ck$ zWbm1mIB50$gIo3pu=!D-IMEl{WVrlH0qXFN=0H}&%^L10@#VbDQF%f<5J1w;Nymhb zB{~h7JwYxJ{5jz`m1tdp(B2Cozyycee&W7X#L5#Sg=GDz!qeLktRW77#}=TKu1Z+5 zNhfzqZh5$yc7kZ^^wy~^&`$@y(eTX}#f#QE%VN!LY*W|KB28VwFO?hIdD%tV&zVhx zzJT!%wuU0-0V!NGe)sfR`1pUpVX9q{C7g>4AK-3~z-R_EA z5rpu<@i$3-)P6W-wnq*B{NKV;|EO@f=nUam^hFc)n<>9`S!M1nUv|caZyOQqy#?wZ zv}8f|zuoQ(LvlOw$!?0Z_8=njClt>fvMI4uJj}LJeWj!y87BH`qt^*ogbAl1r9ekx ztUlpEaE9BK|2pSj+f;%bC^R{u9oC(xMuh+DD#CKoT>EeL-w12s(NUW_5QK}BK0WLH z34HZq(;{?%^F|IEbN$n6D``Cdnw~Z>L-c;j;?_Odm%Y<667HtBD}^nvmFK&B<-+3CPEQesn9!th~gn6n)|E%yOYA-$PJx zv2!9&@+|UpY_kMHoWq#JwB(h?iJlB?lif+_B)p`6v5^tY|J;NmJtLi|ukW?vU*Wp{ z-%I|_L#-B6I=#D1jErI?QMSUPGarOxR;jHV{pfy{yLEGBIO^#en`18ABU4hshd9#r zo;>4mJTzEHCgO#1JnHcmW7HaDEG*u!= zvvvEyg8X9Jy_$#YJPRW1JXg+*DqM-42T$-^Oc~XEg(yTC%3BtDf487(T<6YL1zbm3 zz_E!`xC@$yIvKS}Ns1OWR=Y6NmR=lV_d-L{;(JyvrFx?0Ci!H2C7W#EE8DUS{sY~P zTe41SL0>*eB-2h=tkfL!Q)yEfHpw4e3`NIYmHQt^Kg-xL`&dQvgqfkX#4PBavC3MK z+Qo@U8uMx3R4$>RJvLf)68AT2HW@PCd+Rlari+(X!S?+3{?}Pv zOuS}AQjARLg;4MHiVFG0nEEMhvfHWdJKvnnKW}9^)%;?ETt`mRkN-!RYRp@=t*>SH zju5z=q)yI^5^pVCH^VPBodv&kl5(#ED}{_>6d3o08&Z6`4i~!S-^uIh{#>*b*7{pO z)snpLw%N-_%`hXf6Hpxcc;MY~E{j_Hm&|PndeL8Bz-rk9sqv-{r-N2h3 zk)>wCH>Na}f~o1GEV3?My~~6*8=KpP_*eqVvEv(Q105~ldBrlm>0pmof9SAR@OQ%f zcE*t?(@0}O4NLzX{*bwd-SK?@2z^xo0nQPmNYYf`bRzvAT97Tl!Vp zzE4(>m^l#u(!AfLkbBDF_ zRz51m<6}_*4Bh6HTd11%e?k?T#k@K{2yNCmh~7wwNl0&);zSYu_Yv>-!ewaOHwNzGw07AUtN_+hrBhome&i$4{+MxASDMxGKc%tmVdC2RYkxP8PX45r zfacuX2Br-U>e8XoxTtc!2tFuhzb|N4?1TH%QRO3B2Xycnuw7rke#ly;y_!U(a+E`B z;1bJlQeraxfwxz!LmsKgo26>=jWXbu#nvq0>(|QX^X^-L>OQ_c$$GlFo5@%E6Hv*F z(*2Rg>MaC-+0991Fb&NE(%S0s-jdQ%r`7}1WPb-?jGtLSaQWI>$(!=ET4&s=_cGF1 zl)HO`4UY+!PRWPf=73(itE7q8zYqSYSAh#e3qM~7t67u1LPwH`J{v@&{3hISdq0jbxbo%_$qS zk`TubDJ~+k=i~%R;dxmibKS<0t}1?j2aGLtKxfu1R!pC8^X?i5KKB} zC$&5+m)S-(ORAL|OW3k8o18`rwBjNsPJl>SXQ?kbxA_KbvMPmA+9qe=V;gU1Q)%FCUUgZitt7w*KZ)_fw zqFRh;tS3_i-NP_GuS)w#BOK&>}DS`yRy&H7|g%|y8TRt1>w+>2ogYx@6j-`(7Q|JoUmx9 zk*0wK6%)gTk%kUGZ!3Q=Cn6y?De>{pI%$k@QXyo_OI_q>HVZXsxg`_jmQdJ1ik znAX{OYgV(qiHW1(L&C?sJTj$z1gKVG8Ep|hw_!V1Jc2@bY!Z3}wL^b8!kp`oV1h-c?F%^OB(k9XUWr@pa1~n84R?{f}FQhimmP+X{Zxn}>EQ)>0d5b6d;*m>6i% z)g@1Sz(g>8-G<9&yQ=as<|GD5>R+9so<}0YIk;f!0C$+L3cOm5&tuOdBfV2!=H64P z$0+OYmSZ;9W7z%J%gX@V?m<5@yf50HLB$qQ+#`UPeKTuX*5{BB0SZ0Zt)r4=F$16@0fFg7?^3g zGA?RKBPE&6`i=vQD6Lh}-2+B0p)KbYt72Kj7l9LSvW275;5Sajt~R>5x;+X9yFMxf zVqm&@M<;218a70bT)3V7bZroNeIlnnUY@5!!sOp-T2{7TCizUr^It;wSmwbAQJ-<; zMlvCMI3s9&aZ$z*OgUvF+t5dL6Wv+6YOmBAIQe9~Ye)a!AgZFq4XBjVeMNuEieJ?- zF*vEbRu16W{#!28K@g)dzG!5qSa<QQo1J1kd=ew4R{H1D|9k7tOS^=4;J%uXk0L z#MsA&h8BGuZJU2yzFDf4oj1_eA%9o09d^i46EOZ?`5u7n*%=&Wh*s}e_pC1xkyEj6w#u227d@ZRsJz6{LwXRp74NRaBE zTI1dyFH=n9)OF2%>VHUfzS%hmOO-6~t%4mBKV!q@v*ezYWjKp%VMWpyI{E{0mTE+W z&F>>plu{E1!9!0##1H5KeL%|B_}0)+czY9_*luNIrPyuu?_M0@B>{~1z4zXP#((!a z{iYcnL#nn$6tV9QM0|Ar^BZN_tVgyfCQJ=<$EJJCb_}k(oa`DX->hnuo?~HzzHO(2 zLj70Pzr(%xyWeGy@UC&jrqcYJ+L{@674o7)Y4QE=C}SDEz;=#kzun&6jusm|MGr`RF{IPWyCnI?HDPMF?iDe zjN451=SOs({Zu zL>J<3Ad)F1-kyQ>^mjBif##WrDCQ{nDP9%qpiwPb=f}*S|9~iQLd+KBMI|J`k^9Jl zKiS(?A$4%|eN*pZCWcgnQF=8YBcplm-%Ra}hlht`a%Sq}4|&~ySx=;MK5>&&)4_x* zXx-3Ymg|Ac?cft!h1jI$rDIL|`crYRb_?&b-@AeXnk3zjeM$#(N2kzkZS44B->OZD z1LF4^f^DPAyWL${EsAh1-}8EIZ5#2skIt`hbZ@_4k5$uITb-M5?!Qeg3ky=*G{dd% z#~U82oa#y{qTYN;9b|+5Z5%!(a;^*Xgq9uu+;L*2KCqduxEHn2k<&3iPxI*$%U)T2 zF_vh1!UleuSy*;Se;!!RUkVj0F8!@~G<<6vQ=p_{nuOhuYqROF#}9Z;Sd4TYcaIQB zVoq3^5(U60?aKA5DO<{A8bKj@boWm0WL(T(iuhVxW!tLdYrlPczy%ET>EeEyjUN^8 z*^^67_j|X~2hu(rvK$9ZsV&$KS7wR(y^e~GF4-`CYkYAyQ00{Y^&lxKEZs@@Oljt9 zm+g?}G)Hj4khBag2KC=1o7xde54+t}DoMBBDLx>a`wDp&>YYmK{!&F^slc=;W}$|R zL0oWTVy1etCT+*CXljE9zMP$x!qX$)bE5uGWAJ@_q@Ks&hR!zlK+mylqbUkaRZEpq zes@TNJC{n)G-yr;48f3i_C7Z0nJY1h8`z?S&*-to zr$t`a9aT4H$R}l#m^62fwkehz?h=fB+GeDe*#eFIDbnFBYMH@O~DJZew(ctFU zG{hu1m5TurRz*yHUr(caNg6m8^`_3+8V0%+`7CAqPmZb^(=H17@sq=FP^*{5WOjYj1Oi^5PN_lf67VT%x>1>vWzt zg-fon1xm2e0;+Xus`(;XYw@ zVQgW`arX_!GXUwzQH>YI%QKC- zMwF) zoNvq{*9MHzHYdJh#7|@ZUgFzmqOcCq$z~yroXXG)`9ex3^WW$yp}jo4T&o|vdwV;- zTtSv3u<0>*UE`+q+HW-DmikUk@}?mR0anhFY(4YgMTysSh|K5JR?{W!Cr{C=4c-{d zEgJNLgldp%a6RKG(ObH_!f`kli;JljZ-nXTyh*{x(InsZv>C8G!9?)20<AkZW16!Sj0!) zrMG9lAM(p+@%fFgsIDxKZa6cksjXDz85tiOk?)yIQU_y`0q|ehFlyEfvp)8O3b+@s zPm&?&!Ru5UrDcFiPBVW1A;#AmSU@qTCG8=V^6TbhK)-k6-g3wcXZH1J8UFxcerA67ma6y+-0n zzw}J$QD`2W#>FpISC^NF-4hX~;~t-KD&4UnS^fDDNsEe>OfWtA*`z!)xxDUi{yL{T z*VI{b*R7ODn0+fYx%tLURkeCzILN7SuQY5>H46k%5%f9bi|chiil>Jx-;#>@rOjTv zxvzuEZ^SUCINT{NA*l<<+4xJc_+|g%3a+cZ zBsgZ;Zv)Yi`s6=t6J5Tg{RlTb92HX17?GNqCYj@7GK0l>`D71I@n%zJ9Dso#?OuGi z#Qo&^GmVYD<4L;FBkP4zTU)9ZYY+Z4B3QsWbAD-om#2q|Fm&wa*hV3kuLU`yGtXNl zhv&vFB5dveH8nMf#NYbQ>Iu}nhi8Wzqet}pV@Z!mR{;%;lwDHR2^GQ9TfncOWjH^a zp4FcJ5Wd7H{chfXp;?t07(=$@$a;9WmDYAHqtP03ZBMxdyz5fpMRd!?s6iV@hWm%F zbW?LH5yPl$MU71k=|dYGUM0_as>UCT5kO#kg)@%BBOhe`=Gptf4prnjH>um_bXGYueVwJ zzo8+Sg|@}-9Qk@#RqULkx>jqJ#~C8Nr86VBAYA(aVv4k1`Tvo3VR^VkD;z*<)88>z zX=?haVC{m0L7eR_T05JXdKJPn>nU!@YvQeUa&Y$XY{kCrxBl>IUH@gr#9u}-V0G|n;3{J-yo4TV$)ZQwsn)<>BC_O4cY?ZVj+1tb4P8Oa5G zihksIE*egJ&)7i&Fmy=&v~KyVDFnC@N48D>g}HYKQSevWyj&J)wvcP;{0 znhdO~0BM3w-OM0>rU!;PvzV=(-Q<4pd-!u{`VSHpk^P0Oadf{z#zfM?0M1*S*Ju-9 z8nkm*xXC^D9ru$_@y%w%?#Lh?2BwpLi*H(k0tt+PQ)^*r-NXeZrVK6Mo4VY~?w!y% zWl&yJ0{Efy%;bXWC+*odm7XsiqWJjn0Y6W&mr*g&c2a>m<4BM&PC0Z`pB%q>UH|#r zt=Rf&^m(*6^<;Cm?IG6Xq{7m6KKrsHL4@K6Pwzh>$RW5jmmvDXw3VlnMrbua7SQja zjeMv1+z6q@B>BL5XWGis`uL+!%f*pH9?*)y6&0=&Ym*~{4w z+2Zr#5N4CBn4XN-3_WdajD#f$s|xT3{rxdL?Jm$W^f=uYn|Im73=%=GoLK1cviY+h zYHUHsYH0i{?AcHMWy}1fMfOHn29PB3Y{sR1MWcf32xBq*(NTBJv`jTyL^)614uc}} z8}+AYGOov^U&eqgl}DvfHU+g9|4XZEC)^noUP<=oC&$xS zZ=We;kWKLvar2NodGN)_6Qtz2MrO75&8`k-rg#aG$H?Z-*7GDs%biRD^zwdi@|}Tn z_7+XWbY;Xg-)@|K?DHHM&1F#QSF|+i`&w={cg{$lSg`TL{ZP`RdE`U(owWBO`YY!X z>RB!0bFx0lZ~M*!ZZU1>WvDC!C=WW>`Z!QE*Ltza;~(6Ly7H>=N(4;`nGl&!^PUeF z{u-W>*O?v>86gcyBX9+Uj}F`07-gz2Lkre64rwCr(e10vCa|hueYxM7wLRxstsVho zY1GdfOID#1>)77!N-sF54QgEOH)uR|zGxkD&GW)LB#s*3tJ_Zfk|~uPjQ!>)Pe`oJ z3x?g(^R?ldwY9l}G$ZG_s}mW>!x=*P6O3$Dz|P`C+MBut@y69o&h7>4oT({Z=ekB; z9gnT~Kr4I2K9l}80UOg$R-dpD+p1T?Dn#`MNso&Fb5KxT8|<}=fwYB=s;3h##Q8lu zi&-s7I>S5O4E${=yg4SQ^@5R+k;pkSa4QCsxYYaj23W*g$N$>+c^ouKIsN?+yem_+ zk^`!~YRz_&?It;&Vx)b!c^lq#us9?g9+NHl%SZ%uu3pZ^sRkxZ*7-c~-yhyen)7(K zw6~plP+m)^c?8nTny*Aqo6XAwa9ua%L%&~`MyN|Rvj4K#MS?C9DxhX>+kEctD>gd;J*6lM$)&=|7Vt}xO-Z(saYfMuKBLUSdP(f z7L_(7^Xb2}VT|7ep))RGoahN|A|L$#U6VmOs9tON?~=Bf{8lkK?C5iDy1@Ie{p=Z^ zh;d*4MvKpN1_Nho294+Wc0pbK7{v`2*MOO$gM(h&XU5j)p-EnNcjwF-DBiO!vqe-C zvVm&k0Ct~L1}BpU-3l}aba(T2%Q$?>CV+3dcTc+qf6Dgqa#QmVts6J$@Dvr#6K60M z6n5GeQX8t)j`Citu+-HklQ9FK%=xDb;=n)pr+*%}9q^L8TPl@j1J*tLtX+gVY14_1 za_7_2iStO*hK_OxNz^`x+k`610Mj$G6SRyZ0_=pbL1l%7qe6llm%Sh{KKT6*Zpu9F z{SxDW9_=E#ZqyFrO#{IgA){o=ZZufN3BE<{+keL-Onw;L_5hYhCek)RUn}Gnr+=HC zVf?go4eWIyCoDFY2vFs}l6!tO6bD>u4SKgKdRjs01D5GS%>6#@9H(rNN1n zPK?;XRRiVZ4El?+i{N-#i0d!!Vo}frkZg0GT}eEkOHbdLc``jcozi)g2)TsnfKubc zL|1jqz=Od?xI3TOjWei(g|_E(WR?^ZxH8Mwjw{=Dq|Ipm3v_UClS%%}80>ARxOs?1 zeKwO?XeMo-H7@NdZLd|1od5w*eVo9bSn6aN!m|tfAc^4a!D=DC+9i*ZbI{RPZV3Qb zAGxVD=rk1T_jD9o;rx34Kh48_b-v8QAlL|6iZgLm=uwohd^?Z}zlcc&u1$mh zAOD)7k{)kf{c}+B@M^4d6U@7HbN}QR6K|07U#3;I{j3SRmBd)uLIP#;i;EBMLg~)m z!aSx|IO5A^psyAy*IQT`ypJyG>wbu1U8X~(-Y#b+Z@$!<>1rPkSXS-t#bc~E!&bdLbKM!`C8?ZBcgx2qR@8xC&$c-6E~;5@Lj1R z)WJc5V#Q2=ubH2>F?%H>8H2E+8_ z`kev^phl{;%1#jLmsd@FWEKJ{a~mPjp)KzmC9Y$9{C#Y^G2@uZ$)uc;gJg|K*!bOm zqG3Yd5#WOtaDSoL`Rn5^-Jdh!H+KL0bM;$CQC!fIF6^hw0Y9o;T)iYPo6BAWe?IG_ z#X7`Qwn=Dlwh-7p0mZWE?4`pSYFB}}1WAT;cFdqY6g&(3m_FR9bj!|#ZJ!V;g=hpA z39-EJcSc*UC#3$*NscP6G4#~W5IPEyN7>cDGT?#3pDG}_K4{qxvwr6yO!=HXQh3{9_9Tl_-!jVvgP-XY;#*iV~G3QA;O; zq~rcag(B~sz6usm2xM9&30h8>pmLlAGSO~^($e<=B!0dkGs{_Hlc$6ZS*d-kP>N{QY$q6uUKYycrrRr(jx>HY zU#sT6oAmdHHTyfvqwB6N?C%TMF}+w%(G$*xwK=D)mHFzH4~w6Vhw#!|h9d(MQg}!m zN2J1nV3tSxG^+Ew|2A!LUHvGR+NTX^ZQ`8F*zAvY3=0qEI~(UsS9ae1yVBbHP|`Q3 z`+LmHm)ClSB?_7#lsxREYrTnU_ac3iu+!KVcOXCM- zG-2UkwU()n&r!+RKh{x(vW8#+CuIJIdJ^OC2lsrLsePBm2i9^Exu#V?vqC|*5Ysxpx-`MV*s)u0}|Gb zpn$h-3N0{fzZ^(v-mg2pbp!-KeyNUA$N$c2MIS@edI4g%wc%mI84{)%S)$F8Z^W_NB;0 z0KH}mFM94#(bB3}+f?tvO;-Vg++d|L9-5=njOHYnZPVl-qEYxP0q{{9?|q@k>x>BY zqzY?jXfk#$BMvBwe5X4TjEhpF=4C)F6mFRUFS-tfD25L|67;pHj+6Y{hQlPXbU%*V zO)dJ^M7QjG(VbA8DwP2Q@a#7|vQ*VOI{{dXzv_4%*d?~+AuoO*&A8g<$yyTffA;`Q zP8>I3z&m@*kM7ib9^TkbIrmXSz&j(O+&5gIpAtMp5OZCT0;W>a?#s_-acLiMqe2V8 zIy6HaxvMnk<@#_~S9NwV6%a*Z*UDkKt^vd=blrsIBb#AT3eO+oq_8eOqvkt~W{WEM z>`a2-1rE`3t%3l%0fmClzL`X?#p>allKHGKbM;N)C05V~?mDB_ zN}oj1Vk?I+Kmf4l!VKY8oWCeqKJy^oJ4Bm_a4BXk05F_Wg~vUVnz?BY=`A!Tp}^Cz z`3o6f$?!>8SR3?7ZDf5K;p~)7l)akCpv$ckzUJA_D&c}sJN8ao@z$ADzex4+L_C(e(jFb~-}lTmPW>Xfnc&Ic(>xmD-Ovxr z7rkzLV-Q&pL-6bFW%KymR8@e(;K{{s8?>GZ)^hT`Hrn3m>W&Y?F*#uKXYv8!`DL&Y zd*8L1t{+RN_h%aUb&mYausbXebD-{RutGu)-k&nAEqyGe%&`qh`xwo1=$b8MN_jGB z;6CgqZxAZR{1{F0#o3{MEMoP)&lRK-bzOx#`7ThLk<<5L*Tg82ul!56(|p%@2}efU zH)`z|qQo?!QzHNPx;OX7TSe@`Ag8LA!QchANqH&`MpVyou!6x-&Rsa+Vu<@MEz?2G z$=6Dq&#BiGDHKbJliv^X>R(9M_bnUfUM{}r^ZcS{%?VsDD+E)?ed=?*s}r5w7s#xW zW9zco4G>ponZ^NL_VY57tKSEzgcS|Q>|ird8XwKbWM(yDopveqy(p$042=K$`9c&2 z&Dk!Se>a{W=;yzJs}{!)k#g6DH0 zw-|$F%t=8hUFo)*6QPT~XUUsMZ4|Y;vub+ium3jgdwwSlIN+(ixC@?v-veq4pIlf( zb6r@l6+iO{+tntrJB##h)mzDgjO;09R0NHvGzAyUC)8MeYiD6F7 ztz2$Bv2Vwf6=kSIEt1o!9CiR>=tfbuuThB~@aeB8cB7sU@6By&&FoFhw94r61SfwCbQY^R0ZlPR<(4q+P(rW|p9 zp@@SfzLw#!qoEwZMX$Oc1dhYOt6X16WkeR3F0b#Qs2y!ogEsw)Uc(-UIEla#B6#L- z-L3YkKKkE-@Li~WtvJD9!KCF-okFt*ZTNh8h}!>UbJjTt5W$}k(+r_R<@sDbI&K&k z7N+^5veLeOnng11$rxM2<5YbS5#QUzOyXjJ-H&1ym*`fCiD(aPjr*grDC&@EA5~SO z=MKdG@D~qs_sj5p0ZlfAigN~BFUABQ^Z!K&6 z`xIOPrn!df`F>WfVX-0V2L>y+-P44H4kZ>jY)TS73;ZEGaW| zC=JOxa{U#+XSo01(#XRr0oU)Tw6X$+^Y||IYmxWhGd-Z>TXDE8eVs+;bF4`3KjCrk zlrR1w5Di{&D1sAlzL!=0SdhPE@hSA=^5PeV(;=JR>@iSS74iC`n{6lmc(lepkTFQ{*vYzCKL$MXefV}tALbuN=M8g!;Y}d+#3yl9TOXh*nj_}8 z7qF>0cpoq*tf<2?&D<2W{(gN2OE#{T^6$TMvd3(=U>i8MPbmE`Ee~h55Rfa>y(pSY zOVJe~X0MIHFx+1if*`yUo!Ag8I#b%Ns{6j|zWL7CAl4t!Qa^ zbxL(g?=0zq;%18=D2u%*|Ge#o74dQ4vdPRM%$m%!bR^L7_>mh@7Fpo}#8e~ral@~5 ze-)7DxQ=W{L(FCB;!-7oaBoI`)9Mq2i@!f{RkW?S9oHw$ipVlGHKU z6r_BE@^>zK-}+6SwF%|9 zoI&U82jovCwIzPi{E$J`5(FL=E7P@*A<)xz22w~{0yGIM*502JSeqfl))_i0b!8b! zL{1eQJas;V<1U$K)Cb)QI6RT5dojy9s!?X3PT<^Gi#(T5`LQ)W;1(b!Rh9+Ilt(4Y zE>d3OwkZ{PhdYq{e5zyj;l0snEW|8Xn!WGvu5Jn?Am*^&g5a65RF|(>0k5Q~5t=2X z0x}V05dPQHN)9B~L_UOj(pb`NTCC_6scy<0z~TSt>nr1;c%y%3>5!I=B?J_tyAhWz z5v5Z=x=VT$6p#k#lI{lS5(Vk*6zOK^+&ldK_kQkubziYF%sg}EJm;D7J^2W%fA@_Q z!S?kQr9PW3mH)cgM%zM1K)UTMRI}$uvRy`WX7d>C`Q|<|kn7nkw1Hy~q9N6U1I~w@ z{a!&}vLL=MVWsrH^G(VmY}5Kr?Uw;1>eVT)YtLrTFh^BZ8v<#TJ7{H`0DQM z7!z5;Vgz@B+LepH`TGSG9Qah8cm%ch1Nb&jmeBWunt}j}_Q~dIQWe#J8&fpo# zM^9fmbSdh4LtBdx>8n!AqjUvU;)U!h4y+u(w+%5XIp^jR?ms7t1-CS&8I)1AMep8% z;4A}sNkb9CiK64Ns-!-HsH@h_7FV&T(u(G9y{=}{6&?)vhc4@K_Y6 z;dhWi(J3rGeAJS2R#PY?4;h&HH48`vX8Y%>qY7itD}NicnK(4a3*^Eq9QS&(5G#(~ z(p5{?F`UBP)hU*`y}~EKJ~9v)tKi6a*&K(x)QOaFg;snTHp&YXozh-EL|LLkD_T%! zu$Jn)Mg95JU|h|vX~QRwWYpw{ToB!W(y%3;(x_m>y;i6p*IpX7{LvHEZM#6*A^$v( z((Jg5(IEZ#E@X|b`=Gu1s^L=WnyO z+Sd{@%O4uw%v29FK{{YAi?8r>&v;I=K||LZ|GJM>`{J3MYh8Q}=v2iA?IxOW&?@^h>gU*BZ)T%@NEc zzIN+RN{A5#lK&q|_Y9OH`3L9-QFs!dt!HPh3Oj@ci1N#`?bxCc4Knh{Qw#D$Fu)#< zz2;Q}Z(f^oo$S*~`+fE7QYe{EZ_Lg3b?~do_LZFocTtEAvxi|USi#flF0CA1+74NM z8h~TA=Y*Tf$}`*#_?v|5&eb$j*+G_jOR~yD{wo2JYbX}5W%Q==y+}F+i{^Yfl*)-2 zae!r^rp?Lx-QhzXAyyas#%*dG<$R2iNK0oiOub zbE*fIPAzRpUTNr43SZ=+C8b%jp4O94N|}-BRMa%>Ja+IsV+GaX;suDjK0<>kzw(@W z^@ly-dC9H!N|(d0ZsDE+W&o_W=An{m?fUx*3l98hBwfc%cooOA(UVZJ?it-9 zCW1N-ltW;qqzNDM2m_82Kfn2kHu0$kr_ZB~`DvKWe{>2*=+^jCE>LVYi6k6y_00q4 zgroZ5Rj&b)@YWps4vH{UtkOQd8vr7M?^F=9}Eh7#J=%3RKuj-SMe-a9| z4A6kNK><%7PdjG90;uQfR^ebue&ANQ0A2(r4wYJTL!*Kw;r4bP`DOHF{wvbD_0oAW z1#=^S`>*%}{3o4^*31J`Nuh>)_Yd`WIzyT4u@7TBAr?rGn?gdI@E33l5SycsAx-uF zyB!bT2MEBU6+o`cNQHMVGGfx5w7~yQ{Zq&kYSP%83wUQ}?%;8-h(#;5G@04n->DeI z|HcbV@g83Ri()%y08~ABng?bmJkhJgcuxQbvlX=ePxYDD1e>k%WtSh&W+UPJAcKrC zRvJ;In_;`iy4dIc9V-lc*P0?gy)??u%+Wjfh zE+)h-{_FoV3;Ge9U5adPy}^%K6}`Z`_w%fiC3S!E>P2=SEM}Yb5ym5o`IS#qp|tbD zYH6uPegVCHF3PLKiNa3=IVmcw^M&T!#(A(9o$gj7t7ET3w7)D|iSt zI?^3X=Cd3cC_P^k;d2ESijQ|SV>nMYg{#_2m>v)aG1%Gel z!YrI;BM75|8@Q4Qnae1D1Ri%g1Cxl#cvz=4Dz5qN#LNCBE{R7N@0!)0mXz@Oj=9-N2Y2GJPO zjPRiU`yXL~mA3!q2txlUWYxQg7rd0BIbIG+12B<-ll%Oi6TBH`H$VmpV;g(g!>jQq zRW6}_$LSdMuH<~U!}U`T;TRNl0@y*g4X~W+0v|@`12Nu_C|o^s3yny%ja}e@y%cbd zhtYd&fp^>7($b@8~ZV`OP>c9ukVW${G5e=H8=HLYf z?&*?zWHOJj7>s}s>W)L;5vo&UNICK74eazWk*u5i`j3OfTBojacXhj&wu8_zA0ZC$ z54XG6+q&9m39a^r8^MBh#uqSW>zE4ByVrBSlkn!JB}~cB9RePkuJ3sIH~QbqvCj9M zj9y@e}VK%b$hR%J>5HZ9u;+eKhNPK z$hmXiazVG?h17?(cnHxY-VR-FvN|Gd{tXQ$xOp~$m0PKZivZ-=+_H`uVMrx6unVWZI{_7e6@xd+quuk-()9 zs}X7y`}Hb*A+VoQe{1LVnRnca0!LR`8^Kgnvno9SGTWNAl3jEA8l4pP!G!l_o{95z z)`EJa37kmvCEOGavevxW)uqLC!Q(bd&T@UpG?|ch0JM*bP(wJkBORc}@8|;FK|T;_ zaKMRVLee6?(QZLM++jwwA7%0S?c9c5j&G`qpRWIv=)Vq%izLpO7cU#i8q^7}}EHK`gErk zXI$yL4%hW%>t0}_D}X}Md@XC6Cxf>-> zdx{Gb7L|A`H{8{b7u%NH)#{Z=i07)yY1eC3*(~-!eSB`dNmV(`$^lkZcHDMzSF?z( z#a{_i2lIKT9t~o5_4o={4@{iwtW!}@w;=1T7mX(bCcJDz2&os5Kf6v6_TFr?pLN;> zgj4h1rj{;*#|WGW_@l|dbj+_w!V>JAN(1Nql3;clw)mRLX~yXu=DXKmVxSrN`2MXH zkP95e0ib^OhtS4mpNXe8Skassj}u9M-&>8%&l&M!)VBgSH*t-1}kr>%U48s?Bff)-D;H%ejUXaAqKX zO-=1gFD$J6aNgWhkB?7;>6DTQwJw=Z3UVLJloq+RTiZ4Z?&(~7_U&fG%xvC3uc5oIbu?FT);?cvd)aK6YiUTy3YF4VaMC$2 z!%g(hcO9Sg^l!Cy@G#o=b9KRGuvl>j--S`#b*`{X^$oG6@m0*^^ z7s~o?$UswVkA_-|yg`u197Mvj$_D7p78QO7rE-zEh7C-M`He~MacMVtlP1^h*Y z((Rp)46Fqp1MC(PCb_hx-=L!e&20HAMh*Db$!qWYF_<>AKPQrT{Gv%@|Hm&pstmua z%lrJf>p6ONQKHb!yWq5@ByUqhUTqkUbKn}~-nAe!3%*JipgA3+@r-<`1Ed*G!>8PY( zt)ZenFGTp$vL>U-dEa> zXekm))|Ay+xjBTNJ_#^i@WbRZR7{D@aJP7)r04S0WxHd+e2O_QEtBXmp|Abrh=x3; zu_|SvX0*iC#1+Z$KN1!eu@dcfi2A^xCmCt~{wAZ5aRCqCAC+MZErHv-QKXubh zKw@%Ok8!FE3^Y=;`yeB~T-A{Iua}mW2>D&+G&Sk9Z~aMHODgo&=FDeNlT5tbe*`@= zdTS=H+OTGqY=6_H6P=jJ*Wl^&r;Y)2Rn1sMH7zAQk+k4o?f8L1Jwr5Jf9CrOBpLh% zgtA(@aJWGJS=8y(_T7f>ood+c_lzu=>Vj2vA{an3!Cq3j%lc~2QM9DUOU&PyLw$o3 z2_UcS#v_L_y>~{}ZJ}vbBZ=(V?X>NiD?{sC$Q7yk1np=N7Y1f$ZykjXKM;*oIw=u; zOz&df<=hw-l~kNGeoNrLI=vz}Vf@K>VwQbPiVAP+U5kl{lVt1Qsx%*)DVi@gP^AnI zV7LE;X?ssuHfh5_BBwr=oE*nfz2fb^cU&V+@(r4@!BTUqB)20hW!#P^`e*5&sM^ji z$tq?0=Z9Y^xwyDzFK5Ax|G!}N;$n7hdD&Cd?P*VGCB%9zHn}F3%K7P0vHd>M=i(!6 z4XC?TKcV`NR+_+0->b zI_ecIzZmo?(2h^F5#aBo3t3(V218a#n0yMDjYNe8hkGhS8T?PR+a%j2L7B=a(<&hY zBsZP|Yw6U-?g-ABxeN z4U%WJWDjZU8}Axx8&l6{>7L=ax2EN78usIrmlk7%?2-7r6+xxrd$;hrUh2bLRKXB! zrjVP-f)aCuBUd}3fL!Y48E_g!8QlshRbvbD0s>9r%?re7x$gbt2^1pz^Jw&$V=J;A zInX;yHKkX1FStE`s#m7favO-e6a&KB9bb~PY);=8NNU%*LYZp~XkLGj+9Qo1b~@$eW4^qb3*U6ynl#_tbc08Z)^_Wv|13 z_5N}3J_3*qj?QZ(IU94?x3V3TACC*j28>QgfpD6H==<~HX=L=b6yer7lk~Vmk%gWD z?Fg4p%Yi@6&m04euAwPqgQCpCS7DZ$TMKUIP^p_5p>MSes9)9>XQIyP+V=P5LCC|l zepr&M-FCA*AB{s$I^++6M-Q>F`$)z&FaIeXXTI z%**ZJls#s{@1i4fEhXuFQeR}9$Wl*M%2!>nw7I^%_}y2lJDesFaS-fyJ7g}n*g)|2 zVNKWRm3_FHMSghsk_rNV^*gQ3a)!&VHpiFRJcX!s}59<1z z?d{1C6B{d{l^n+FB`jiy|Hm`%w2cj~SJ6q(=b!@ifZYW*kDSh#2@ofZ&RtUvMi?y_ zNeb-LZiTcxn^wlj0d;{H>Rn*0Xf-YPr57%75ZuQ~PaP`1M<|9sUC$o`*mfHCo!leZ zcvD^hZ!kl%zu28U;E^@INcF6pDDbCmF#P-+QC^2D_EYA%mZGFJG0NEMt-GwFdrCkB zoUBX=a{mz>eHwuwT%xUIv_TI%WqU?b39dkY6d6N+I!c{n#P^hc9=|66y*_>V7G*;3(RywJh629X%VQ1}8KWCSF zJM(pi#88yY|Mb3wTy5B6+~&6#fy5bCnU+sZ-jjB2uB}}rpTvo&Ni-dMK|Fes`uU=) ztfh+Ik|(&&-`opQg=+;a&FuZ#*UTFF=inqH=D+0YcdK_Bf{%kWG}t#7QZs9pTaF2s zujLXv29(&9vbD?fugol#_3Z_PN+$DPvZtgDUPpf~G;mL8H#RXf)p$|LyJ%%|db+!A zT#jZVKhC-opywA_%E98AQ(n~A%TcUeJD$*Xx>u{vOo&B*=XgAOdUniFQCws*>P?Yt zQ+`NIskxUw`IR2ILY>JJV2t!`RdeJ^rf%(Q({79Foa5Xx=S>xF5pT6k8_bkEz8`A7dFr2sRV2s8Jj=Gs;+s*l{Z>o}~eP?9aD+Z>TLa*59Qi z6x$jYP^?iG%?IHe*e<5or&cF8Rm-+chlAtb{@m%JP+L7NZl8xDoTCpC<1~=N5=1Xl zrXL1{9>{r;08a-4)e>vw^%sHz_D*ANUXR7i?_qO2r59HBOV{~#)HTr6)ujS};FAp4 z^AOv1yJl%O^8d}zk1gY5ayXVUX9JaP3N)5j9vm#w{l0!tm71zwq>T5?pWxG33vwj1Xe^jhWR}vevFc?=9zOaDe$%vv13}rUoTuP*0z911C0*6 zJ)t!>^UT81m5wFSOvkHJ(q=2KaCZm%GnS4)hKP_LCyK>hkVsiNa1zLX=O6_ot&IVY z?~S@mOv@m!HfWU$Fb>$FjjZ|kz9xonHQ`!>&Xr+rO^3WLrvN{q(O1CYo$U$a0fh~L zhEZEdP;yG}|TtI(tC1Z0$6+0^P~dX6XJG}NdavTQc;6(KmzJOMCQ~i8inkP}uM=S7 zH-DMHZAeNf5``L3rD~!~3C)2~dbBgkR%o(RAB&QM)0HZNHjlc?MBl3%;t!rx~1{W3J zVdOMEXuzg=EH~9bRR^%R0P;7Bh!k)VJf5%uUz`52$>4p>?>Rf2mX%(Pp*~QMOU`NM zK7ZQvdI>CCGQ4@KN%?MsTF>{H_M7+%4fVwMM7dqJYqF0rM8q@+i3wiJAgvnpM<3jibfkeH3-8#-ZDH?=Uv}{oJ4k+>;6#+zezZVZTGYL+PLJR1&4)bMfuF zT646F*G@ne8@hS$0QC(|Bb%-xE#wd6qPoWrv4zUk@_*Z;{gX^4CXa(EDS& z~%n10qN-Q4^&TA6_xN=BrnNK7IVFy!c82C zdd|ifes*?V7J(J^95a`1;FGNvDt@Lgw*zPsJ;Q9fa)~?*{O$Cw-{S$7JYbt`6+^6! zgFCT=MXB|Vs&572{S*0Kvr^&7?al;YlS53T2RdrVxmZ>8E`IM=b~CF8k33l5=+h^t z>X}lK_Pw9-j2oyWo`1Z5VPQdP@%ILQKSjj!bS>@%|G>yfF!l5$W_P+qMF}|BuDeUB zVei$`n;nrt#zW<06=$K5Td6yxMi16mrn0Dn5c}p%VJoJm0N5bwq_ESZHbXMt-3K$X zoQpe6I$;b2&t6m^=mqXRZH6HT+um<#>u(Mv@$Zg+jsvnJm577f#@RhlZjYmF+-I8w z<+HcPHE}&^^V34S`Ii%o|Cp|WWR1c=wqy#wS6cnWqe(2*M8Ncukrz?Ejz0r3_jg>k zio|0wVk0jBu`+d=xjYSmVg2fwA8k_~E`OP%a>N3_y1Xt*>U3fw?RGDE zuz9)ywB-g7mI=2YmV<7rKaZ^TnZ68mL~F4h{|mmyLuaN}GO&u6(pU zi3B=!B1$sqb)L(u%XNXWbP5{%f%W@0?>bAL5%}Is#L4h&u%``LY<$_XuH zFJ?nIr<z@@lktxePK~j>|hnl5J|KJIyF*T*URVF{b}E}?edZ|&!3JiBOf$wuj1cw3{#2qkB^sVluYWi&$OC;HpHSh z#n=TITdH0DY$)|=1Oj>o;^R|Ad`}MWxNHRUOzY?W^pD?kN7#gIa2nNsle-!BnoFe( z^quemr`Qn#{!UXrxh8jaNXU|7Kn#7c)Z-XI2zOH#*4eZiS+x7_tJDPN?m*=^L8!mCvwq;nG_ z`<{%0j9bF!^3X^M(H#ZQS29lU@Zq@rb)!x|OX2za z%4MwfV!Gvm8uD@J1;eyGVmE+kq@+;lodd`#CXG*QuD#p_6nMOF(WV5 zK6mY=H23?sXuJ0x12ARG`NB=>Dl!}sSnhTGBGY$azB5N_&9>5UAF$gGtl52+^ zvH@E6zPreq-^TY9^6aZYzimdrr^yGM;d5zvwvAcL@7t%^tYH!FtuzU{u= zKKt|A9Z0(=hJk>YMEm6|7(9M^1on>I6K9-Za6>1a`UWwP`Hb5b0b{7|y zpK4@0^X%r_a}!|a_!I)lMElSAJL4K1j+D~@_EC`bxEiyiDa#YiUhlo%!BbcaAEH^v z{~;`=BosIEYf7N;+l2>P5@q@2b9bj#ab~G00}glB=k4nn#Y-O<1X@vFHl39kmVr*W zmGx~yfq?Vu#mEyk2hry1WCzP{mJZFSpkJc<++Vn^9(m_?x0{acEN|}@D)w*t@9bkK zb6CC^7-w<#pktLuW2uS+oql!u=ugVD*e9a!7CFJcO>Ftk+{D zj(U2r=TC(Bmw8^Hj%gC_-w}>SZ~VB3PZ?6R)RvOmF3ibP^*H=%vY#E9E+TqmqcxWV z`jd5YR^^Qw=XXJGh=aH3Y=7A~il-1!%t-V}&uNpNAr)~$MB74oD3q6RT$j+2gD8d` z&wbaK4)hq`gH2o{4~BRtcd-{94N;h>bPld?_Aw8Yo|Lc80Cs!ZV2;O(#KDil8dJ|N z%4xc&Gf#t7=sdybUNBKi`f#b?u;)FTP~($$inhMj7b1=29|&PxmTw`%qKzuzM6&Mh zDZyA@sl@V?3Em2r;xymu`dGT8Yp-tAuyJol7$?~D1tl2ToL?uNE_EEo2WWRTs^Sh{ z$zUK)r=amPS%65EC}xSFOo*r`xcl}Qd=TF&99En35I&lCk-A<@yZcxf)*t$`Exjo! zes|?>G@SzM9<_WB5jz9p#vV~FvnGqAFmtp@Drt0hD1d=diF)MvM-)f;iKrz9JPTMt z{f>EL419v@x%?p~Fd+Z}fD_0TAnegch`NFTe+7&KSU`!WF7$!qki#wk+qz6?oJb^d zkT5m?t3`wVdzHckY)vfw1vVg0Nn~0W)se{|bQs)eA^b8}d7I2}gff)k<^)8f(l|pl zS`5E@uMUYBn;v}+VBPHk!>x43t)ev;+y?%}WlyjeVj;B@6*^cNPlJS)daEN|MF_CZ zGqsmMk6mb#c*x}_5Y8UAgYBxf58%ilzTY~Tob8iVweR%FWlZPmPe|NZtp+a_7oX-184%=0h)o(K#;-QgkRsJMe1G zqrY z+nG~V9L@yLp_^bFLEy*Hbd9ggUx;cRa5MZ$g_#3K)PN(v4Y^dnI&NXp=Y&5BmgR$> z375`0->%vLo^HM-;Cw6_ibu<{hivh~pEAHw?;`oSXD+Y_*8Zkk!iDJ>@rd?OoS>r1 zLc(C|dTL)-XSolr0}Eh>h);L9Kjah`+^3uwvIbdUtjv4{_haIjGP@i|0bktJnWhw! zejaj9bqrfZ1VgqWEH|dWFVyNac^{=RtkcktYnO_VN*?x6!jJ$=B+x&Y{C+G9H;a~Q zMai|Sj}nQLScI@LxF?KhD6gN1dgy!4uQ|7A6OP6qw#=3-3xL~)1ON&%&;C}b(l~$y z{gr3x`X2hx*}itcZpaohqfO96QJ*oy7wdaW2wRBNd-bUZaNS)vZJVfqdlIcNNZqu+ zL*CJD4BK$f6KS9jNyx*-L;oC?Uxa}>(J;{X5bu^II=QZKShRXGrl`WgLjM%hp@;qn z3rQf>XnEO0O(ffUD97lX79v;wx?2cXLO)6&{Hcodmo?}ph=1r@8)#$6UaqgUGiLNo z3BeG~4HgyT>7Rd`Cux>gkVrJjG<2=2jp(1RiVn%9*%)TXF2c8_@)Bvi)!Wl)|3Nrv z<(28NF$N22fszr%EGhc2{F&bt7JfvtbB#sxS!}>q8b%_jM-HYq#1m%A8%KACmfKon z0F~5m^w-EGlnzscm#+nj#>Qw9N@B)S*FE{*vc*?if42W3PPx{t3EpNr0vzi#J*nYu zi?=P;n{XN(Jb;RljrJ$QKI-xEz)W5rpS+rW9@|Smc)Rid8N}~B{n$$n)#M2f!8ZK5 zF*5FrwFZD#=e2)G31S{zX0LGl)YZm~iuJ8Py|2Hh{_IdKa#64`vQKai!mTLDsiYVC zauE&Afj{q02Ty%DyK{F<50?wJpBo#hI>C(2E^fyg`~JM|7CXAB;Vra4qWCJyWe&qj zmwDJ*A=CQI1A4fP9RdGs;oh(`XXuDx_~Z=Ww1SH9=o9+GBNa3BO`T^Ngei0^|~191Mv1#A~OW*u$R4`^`m+}#S4 z4nmPA;!f)t`t+fff`E!DgqVRT71ow6OMpXYe`Lng^$tB=1|rL#{JLl8B)aJxI$T;I@$nvTEk+}T3)fz|_J39|iF(=UyEoNujk{)% z{igp;$>_jOWZyox+Bgw;{^{}U3H@CNUvYw0d4!p#+|ogO!_~`m^vPQs1t}mw24_#{ zE`VuR`;&WIi+cfNea_?k z{kgTg0kPsp*I+kXxNq?A>I>E$L>e21mfDT0IScxF{n_GbO+ zO9=36q`0WRH?Cg4F+m&?@zfB;kMjEH>LX$H;|?uGQCySCwCPW&5|e`o%iy;KXR@hw zhZL6q%&4)A9)kA=5%y1>gl+{e)EQYZpu2~Omt=Mc`fk6k; zeBC;Ue&pb^#?`)OwFUsjYmr>(I}ErKHUm}Y)>|N;GrcvdobGir7RsydNwDQoPU&u!o^1$sopd{ zGTIXm8`(Q=H+ME$J<8=eT*hJewsQK$5;sPSdwbxdFL?bT@vVi*=hMKaMK!yQJ(3HL ztjOungVon9%gANsF#9Nv9w|%*K(^ajcs zs4Ys`qB^e~quW}dh)2OP0krKVQ_Ht6C()Ma7=E!SeB7Ug)y9O};}?lc;HICSY zqdGBVXJRvyM*GwMLVfzhjl_sI*W`u|Xn!o@%Q;2@ z34#-e9g8o3!e=+s8FqwsH#S4@`qgiQH%+P{`?@`l`#rn7B%1=^fopAExeWP`9)f|* zAo*Bk3wT5*1B&xJJws41&42@;%yYCOmfV_O(-2=^d+(;f_x#cpkpE2Bo^WFPWkP>O znlXiwyawfU+_ewT-8Vixf+($_Lb$uf^DcP5_okJOd^s2JLe!z+MbrGvv<%kS*}98D zROYjH5E_7+W~}aBh`~@_lEpF5uw4CzjnpkoN9H;LiLpHfzizxdc1gZ?(G>I!^(e_j z1Q_Ef{o-aYQS7v9`QvfD|9eWa(k=xBPvn^aXoW&RbbfR&`qeFVfk=TgwOJSNRYV&3+~<_hF;{prfUC4XtvYEUmeEOTw?TqJ{MOJomAk~LK)=sQs<{&wqbLYO-3L^O_*2o|Gh;G4WxGE>w9DY$a9lCZ@qjj) zQw=0^xBw?ZtiQr3ueE70xhqru=O!F&f~l;ASxXO3VFGDoSfm*--vfdD7J+rXt#hay zlMc_%3vZX^Mnb?xB=tMbnhb)H$rIX-Ve6H)AqSu~Rn7DwZk8OL$2~kJ$3Rf0|0^V@ zge2r?Qiu_AHbZgkXV~di8$GT~%FS0xe$ihd+-Mw=9)O@ODBTwjEGEWQwtYz;08*(E z527Q-;(XLKaVgiQjwtX_u~+IKHG7fHXC`;J3TAT13N{Xsv50reg=1|%rLuq_>*j31 zlRuWLRe({OX1v7%8_*J=jBz277?nC$&dq*-P?QmEtkDaPKGX23Lq0mjae>A&H+0bz zR=^In=9+pJ2t_@*aVRDMU&>>;;WinZn5yPr(8eQy5`xbj`2D}LXK65P|38OmCE}L* ovM>;Wpn(IuQrCtr?jTXA5FRC{cyt-yCaQp + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + DN: cn=all,ou=aliases,dc=example,dc=comcn: allobjectClass: nisMailAliaslabeledURI: ldap:///ou=People,dc=example,dc=com?mail? one?(objectClass=inetOrgPerson)mail: john@example.commail: mary@example.com + + + searchresults + + + + + diff --git a/doc/guide/images/src/allusersgroup-en.svg b/doc/guide/images/src/allusersgroup-en.svg new file mode 100644 index 0000000000..75b8ee0737 --- /dev/null +++ b/doc/guide/images/src/allusersgroup-en.svg @@ -0,0 +1,184 @@ + + + + + + + + + + + + + + + + image/svg+xml + + + + + + DN: cn=allusers,ou=group,dc=example,dc=comcn: allobjectClass: groupOfNameslabeledURI: ldap:///ou=People,dc=example,dc=com?? one?(objectClass=inetOrgPerson)member: uid=john,ou=people,dc=example,dc=commember: uid=mary,ou=people,dc=example,dc=com + + + DNs ofsearchresults + + + diff --git a/doc/guide/images/src/refint.svg b/doc/guide/images/src/refint.svg new file mode 100644 index 0000000000..5a118f762c --- /dev/null +++ b/doc/guide/images/src/refint.svg @@ -0,0 +1,199 @@ + + + + + + + + + + + + + image/svg+xml + + + + + + + + DN: uid=john,ou=people,dc=example,dc=comuid: johnmail: john@example.com(...) + + + + DN: uid=john,ou=people,dc=example,dc=comuid: johnmail: john@example.com(...) + + + + DN: cn=tech,ou=group,dc=example,dc=comcn: techmember: uid=john,ou=people,dc=example,dc=commember: uid=mary,ou=people,dc=example,dc=com(...) + + + + + -- 2.39.5