From 3528add55665ea8b4b6456c5776c9cb30f3f1b6e Mon Sep 17 00:00:00 2001 From: Philippe Vaucher Date: Wed, 19 Feb 2025 10:17:58 +0100 Subject: [PATCH 1/4] Remove outdated documentation --- .../self-hosted/azure-ad.md | 153 ------------------ 1 file changed, 153 deletions(-) delete mode 100644 docs/integrations/identity-providers/self-hosted/azure-ad.md diff --git a/docs/integrations/identity-providers/self-hosted/azure-ad.md b/docs/integrations/identity-providers/self-hosted/azure-ad.md deleted file mode 100644 index 8c447351..00000000 --- a/docs/integrations/identity-providers/self-hosted/azure-ad.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -id: using-netbird-with-azure-ad -title: Using NetBird with Azure AD -sidebar_position: 4 -tags: -- integrations -- idp -- azure -- oidc -- how-to ---- - -This guide is a part of the [NetBird Self-hosting Guide](/getting-started/self-hosting) and explains how to integrate **self-hosted** NetBird with [Azure AD](https://azure.microsoft.com/en-us/products/active-directory/). - -Azure AD is a an enterprise identity service that provides single sign-on and multifactor authentication to your applications. -It is a 3rd party managed service and can't be self-hosted. - -:::tip self-hosted idp -If you prefer to have full control over authentication and authorization of your NetBird network, there are good -self-hosted alternatives to the managed Auth0 service like [Keycloak](/integrations/identity-providers/self-hosted/using-netbird-with-keycloak). -::: - -Before you start creating and configuring an Azure AD application, ensure that you have the following: -- An Azure account: To create an Azure AD application, you must have an Azure account. If you don't have one, sign up for a free account at https://azure.microsoft.com/free/. - -- User account with appropriate permissions: You must have an Azure AD user account with the appropriate permissions to create and manage Azure AD applications. If you don't have the required permissions, ask your Azure AD administrator to grant them to you. - - -### 1. Create and configure Azure AD application -In this step, we will create and configure Netbird application in azure AD. -- Navigate to [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) -- Click `App Registrations` in the left menu then click on the `+ New registration` button to create a new application. -- Fill in the form with the following values and click Register - - Name: `Netbird` - - Account Types: `Accounts in this organizational directory only (Default Directory only - Single tenant)` - - Redirect URI: select `Single-page application (SPA)` and URI as `https:///silent-auth` - -![](/img/integrations/identity-providers/self-hosted/azure-new-application.png) - -### 2. Platform configurations -- Click `Authentication` on the left side menu -- Under the `Single-page application` Section, add another URI `https:///auth` - ![](/img/integrations/identity-providers/self-hosted/azure-spa-uri-setup.png) - -- Scroll down and setup other options as on the screenshot below and click Save - -![](/img/integrations/identity-providers/self-hosted/azure-flows-setup.png) - -### 3. Create a NetBird application scope -- Click `Expose an API` on the left menu -- Under `Application ID URI` click `Set` and then `Save` -- Click `+ Add a Scope` -- Fill in the form with the following values and click `Add scope` - - Scope name: `api` - -![](/img/integrations/identity-providers/self-hosted/azure-add-scope.png) - -- Under `Authorized client Applications`, click on `+ add a client application` and enter the following: -- Fill in the form with the following values and click `Add application` - - Client ID: same as your Application ID URI minus the `api://` - -![](/img/integrations/identity-providers/self-hosted/azure-add-application-scope.png) - - -### 4. Add API permissions -- Add `Netbird` permissions - - Click `API permissions` on the left menu - - Click `Add a permission` - - Click `My APIs` tab, and select `Netbird`. Next check `api` permission checkbox and click `Add permissions`. - - ![](/img/integrations/identity-providers/self-hosted/azure-netbird-api-permisssions.png) - -- Add `Delagated permissions` to Microsoft Graph - - Click `Add a permission` - - Click `Microsoft Graph` and then click `Delagated permissions` tab and check all permissions under the `OpenId permissions` section and click `Add permissions` - - ![](/img/integrations/identity-providers/self-hosted/azure-openid-permissions.png) - - -- Add `Application permissions` to Microsoft Graph - - Click `Add a permission` - - Click `Microsoft Graph` and then click `Application permissions` tab - - Search for `User.ReadWrite.All` and under `User` sections and check `User.ReadWrite.All` checkbox section - - ![](/img/integrations/identity-providers/self-hosted/azure-user-permissions.png) - - - Search for `Application.ReadWrite.All` and under `Application` sections and check `Application.ReadWrite.All` checkbox section and click `Add permissions` - - ![](/img/integrations/identity-providers/self-hosted/azure-applications-permissions.png) - - - Click `Grant admin conset for Default Directory` and click `Yes` - - ![](/img/integrations/identity-providers/self-hosted/azure-grant-admin-conset.png) - -### 4. Update token version -- Click `Manifest` on left menu -- Search for `accessTokenAcceptedVersion` and change the value from `null` to `2` -- Click `Save` - -### 5. Generate client secret -- Click `Certificates & secrets` on left menu -- Click `New client secret` -- Fill in the form with the following values and click `Add` - - Description: `Netbird` -- Copy `Value` and save it as it can be viewed only once after creation. - -![](/img/integrations/identity-providers/self-hosted/azure-client-secret.png) - -Your authority OIDC configuration will be available under: -``` -https://login.microsoftonline.com//v2.0/.well-known/openid-configuration -``` -:::caution -Double-check if the endpoint returns a JSON response by calling it from your browser. -::: - -- Set properties in the `setup.env` file: - ```json - NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.microsoftonline.com//v2.0/.well-known/openid-configuration" - NETBIRD_USE_AUTH0=false - NETBIRD_AUTH_CLIENT_ID="" - NETBIRD_AUTH_AUDIENCE="" - NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="" - NETBIRD_AUTH_REDIRECT_URI="/auth" - NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" - NETBIRD_AUTH_USER_ID_CLAIM="oid" - ``` - -- You can now continue with the [NetBird Self-hosting Guide](/getting-started/self-hosting#step-3-configure-identity-provider). - -- Set property `IdpManagerConfig` in the `management.json` file with: - :::caution - The file management.json is created automatically. Please refer [here](/getting-started/self-hosting#step-5-run-configuration-script) for more information. - ::: - - ```json - { - "ManagerType": "azure", - "AzureClientCredentials": { - "ClientID": "", - "ClientSecret": "", - "GrantType": "client_credentials", - "ObjectID": "", - "TokenEndpoint": "https://login.microsoftonline.com//oauth2/v2.0/token", - "GraphAPIEndpoint": "https://graph.microsoft.com/v1.0" - } - } - ``` - -- Modify the value of the `AUTH_SUPPORTED_SCOPES` environment variable for the dashboard service in the docker-compose.yml file to `openid profile email offline_access api:///api`. - -- Modify `Scope` value in `DeviceAuthorizationFlow` within the `management.json` to `api:///api`. - From 483767aa21ccf96622f632a474f21797e657b174 Mon Sep 17 00:00:00 2001 From: Philippe Vaucher Date: Wed, 19 Feb 2025 10:21:59 +0100 Subject: [PATCH 2/4] Correct wrong image when adding platform --- .../self-hosted/azure-add-platform.png | Bin 0 -> 27730 bytes src/pages/selfhosted/identity-providers.mdx | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 public/docs-static/img/integrations/identity-providers/self-hosted/azure-add-platform.png diff --git a/public/docs-static/img/integrations/identity-providers/self-hosted/azure-add-platform.png b/public/docs-static/img/integrations/identity-providers/self-hosted/azure-add-platform.png new file mode 100644 index 0000000000000000000000000000000000000000..b3cf8e5c8f78c4aba44d59a8bcd13a9c88637a89 GIT binary patch literal 27730 zcmd3tcU02x|L<*S%dBjcE6#;=ueeXTLbMO80{{Fb0!|~1gaL(uR-mmBL{dgtbGdB|6FTP(uKtTBJ zotqB?1a^%H2<))fE6A_;u)gWT|FLJNx{+HcehGvEW0yU`zwjb@`f8Y1y zj$N>Tz@e_cpB?CcGIs$1(9+$Th7ZG?DYGKJQn=hnc0ORU$2{koGq$Z>@tX$F;{rI@ zqtFc7ywigjo9Y*LVmMv2Y=4s~tm?d563#Dgx8L>h*9x^M=f+hG7wm)j(Z@{ct}CjB zUu50Wf2@>rKjYR>t(m1>HASd1;N3vODPB@t=(`5y5OpA{#fvmFklS+p!aG*XvosPf zM=RL#YKN8=$ypV&m;br~0v8tnGrWJL0)d^te+A>yZ~rz|pkViZXGQbli66UW~ma{{Lmg0g{V|)7!bN zt}8YEOOUKUOPK6`y6a0E`1krWEr8l?n72(co(A&r^H~yr5Mb;7>H*ks1?%QBe_JI$ zlY(&l@SJbMGxvTNsc;`~&AT$j{(NBI=d1iwWc>IVtIXWvKR0^sR|F3$2wP2WIeDvfHYm#KFoMA?>zA<%xN|;ht`k;#}D-pqjLYLU)t&jLE z=>D>2RECOl@|1b%RN9;ClATU%v#ZrG9*)NwJ_Twjsbu{@DhfZ%7ZtTsE@1R6xKu8V zVw3_fW-n;oTn=ZtI#aj;krp5oeS_=Wm7wA?NKJK)LTfI?%p)LvIuu->3I3;Wk%hkd zPSj&VpTm+vkY_e83IvnBbVrBRT^6wr5cu-IbLWV`fw*6J)3X;tBI}Sdn;<-IQNn-s zJ8`OWdja_A?-|5OLi@W}l^AATRU&sAl9Q=p5ZbVfX(Z1aJ&EqvvOr9RmCA@k&W27Q z7BXwQUC!wd6yjTA$TnrAVK#K`-s97l+_5mv9q*wFQ>N z1=2p4Wi=@x+!k%1A~NZTqxLV!Xm)j-q{`N>i z*V{{L0OI6wM`8#Rv2Cya2i_6b7x#R(=#v-&(?H9@6Niw597CYQG z6ykrXdAEJ2uH3LR(nfsd&sU$c+>!yAU(Ht?b_ocWe0ky0kF9R%4{(u}s%|fgGVm({Rm96xWMslyBa5)(GMRyi`RMp9@ctWd3Xz`#_b32R6Rk-XxXDZ}=`* z(U__#S2cDpk~$Drec4D<^8@LQQH^#&kUYVDqF}315@;t@%y_m>C2f)6jy&4IO6L=-G>Z*YSa+9tH;OM9s-%y;vs%Ix z4FuIqAHM{GY7I+8focJN)}~V|%lQb3>cE#a5pT6vORwpdZGLJ5Ir(kW>oNz%YtJ!j zG@|dVnO>OOY=_bIEq~Tx$YmoMUB1Pv4=Z3eomDn%`rqBw02EZ6Q|sdUH@SC!Pa=Y@ zg{B6)ZPcmj&^(DUa9R%1uO|{>Q%Gi-!AjdHPyaXrKlnwIW3zqxB`a;3Wby%peZl?Q zoDk^i&(xn07_Zf^s;DdFn^m_(e?FO>Hp+vYn>OY3IEw*@u8f{1$c}Z>%c&jQ@>H}3 z(P@+cv20AU*N=0%uRvXSYUUP;G%B#h00Bzf?jD{!HZcBEq^S5-D+|yYKK!g@JOzGL`{G!1hp(}o zWxNDuB2QLKpOd3YZk=B>#J>wY2O-_Zql}7FvKeom0`J{F{W-D5u+KAV#UO9ev&uE% zx}edtyY3W9xir>oBPc$%qS%H-U&5v~Wc{cEm(`-yHdXNtenrzxQyX)Z>0`lnih}Fj zOQu##4F%#s50;kTg7?=JTuF9B*^-fKftW9X_{fLwV-QnKDRqn_1!}#oXIcAWNsnd+ z4zp^NFw@#_1?}$|>~l|>IoW7S(9`+u(LceO>Rj*JAqGN7V#}h6qA1b6!#-lur-r;} zv*|8+o>sB*Q5jmniwvOjo$c_DmQNa(%t#MItbEnH_94$4o7;W52q$L^&RX#8)B^$n zww3y49i|YO&cVDT$eR6}2MV}y$tFqsyR;0rXZ)FSxKm0v{pAY#tD6dXLiD$H%iWZs zn0<~Nto8@euqI+(IdPpsVf0m1kJk!rX5=rmuA>a1j8}6Gfj%HqV`&aFv@@kvxOT(v zTQaV%xja|!=GL-$>}Nk(jP9m>*bTIy z=(pxr-A9CCVuHl}-P5D%4;!(k;nJ^`rt$Kk$grkJbmu_bIgZqv@!?$2Ua)TroMO;+ zE;Rj0>g-lIdx6TXp7z+)TQ8)c>WSKl{MxxoT8n=D>=Sji&(78QD48h5Bkn^sS<@YM zf*Jzm)e8O4qaGE{YQfHRNb`=<(2q(c$Ya^tB!}Gs0*a4W(zKI^v~z?6gui&CjrNrI z$FLl~E5w?*&UFK}12f#7?pO6_obkSJ<9wXwY>IG6!{#_|B$MCgmLun9_T+Y=d&G;| z%sy^#*4C}GG{$7o+6E~DUt@d+q6Y>_@ViHYZv63Y%H2GIr*%s#EVehII^mA*W|pHL($;wvkQe5w_+KWhkDHT3N?(!{5j$CR+u6y zAbu)Y$Q(%5B*?Nve?nD=d%mFdiD7@lfYk0d%A3jVl*+#}@>zQuuR?JQCVdL_&$it7 zb2@8ixzv3?6P#Lly~+N&_cO66S^5nDnxS);Y^Re#kW^CJHk#@sjQf%slt#hmV2j3Bj6JZ^9ntq^)lI^7JUOH(NU2dgDyP zVgmljeWfg;V~r;i$|?I}Xyw|j!h^kwVz@|Ee0D>DJm}cxN&ohh>J3$OM&9o!^H1ur z)#W>sf6Wx_d-vPwEOjMRUBGxX0J*PuqW7g)8D+h`1VftisiRMDxp9W|^ECG3y>n}` zXER6xjq>ZoBw7J8Gv{)IK4v0r5uCL0oy4tT?Z0{NWw?R3z_a4AqgSot932&L&KwEa zoNP=QOJ{6KFXpEivps_v7VP2(c|v9v&)=XzNpmgz|A{|}EpgQG(7`vlK06zfff!#F z{`8<0^+#rgMA4R`nFEaB98{U4@nU1JH%+g)#rLCpgpP;ARhuoYPuB7kQoXw$@?K~N?v7F;y;MeMHWM+N^4(h(#Q?H3J#yOba)nI;kmMpe|?jn!HaR7at+vQi=p92&ehSV>FhK&PiDDi1CZW2SLWY}7see^pC97P zl8^e*LvSvyL6;mj#lcNf4R=!Rpoj%2l-3*u#AZJLeRjI^eyA^CdIi~P7dVA%l#fh2 z4S1UY(_*52H-;a0ZDLFMt?Ur82)3KoA--^a!GGar<3SiU(So`TcMW|7Jv;%=VURibD#W>U22NyCe@*>#_$s>b){R%U?wV;tN z%5KOCfgQ9NSIh=;R4#*pC(Wa6u97Q$0Kd9+u%dq?a==tbtG%ni=b(myjeQ+YQTh`% zLp_U1Lq&tnZ8uM6+KR61!~94(ytc z1XE&HZ*9Go#6;U5Q*;sCMP4o|QGwKGKt^OeU${N%ezfs=E*-MYmPv2p&Em6Xd9)vP z%=#=wBY&1DwW}*uU7MQu#&7iT{pth4JVVZ>-2O<|rj!jEYA$c)XeMx(uTH)9U_TA!ZTioF7_CFhH4WlBa3+U5Z@|7!|J&&d|-aAX|p=T60;g0OVZ4IS5}j%(EChec~=3x)n){ zcFl3{$$TwQ`r#fbvXnDXXQ?)v#1F(&I$M9b+!gw(4T2V3X3tYO`10$sz47D15EmoNB8UF{(EhI$IV^J{9tcLm-J4i^{4_B{)`8*ueh-0YqfXr<%NI%y~6Y$ z@|(|p1aWiy|D}w>js8jGC-?=a|0wtqd;h6B0f7sL@9-mRzFye*e^z|;5W8cs;-Um% zSTvsjASs^*n)zyq|5vLxbuGfv9bW0=wsXdo@%G`@IikGSBKsZoHF5O$%9RC1?$h|c zKYXTTH={9D6|EM-(gII}bj`-sdhCc>&Xn@x2vIWx0m#$l`sqg(hvJjcjsE@q%R8T` z+1iD-Py5nM&D)NYU6|EcoYMH6Y!W;5hqS%X><45IW|oO>mF6o#N}D zG;Jii!m9}}m&v4POjwQ2Obxi<=Cr&^eEe!sT)v1er0bSH2B8;#{PR*k;8@-Boj}na ztIHW{t85R;LJ7CHiHXrhV=SpKS`EJ}gcZLTklDvwxQ|_0D>3rGJcH-BA(!r_3B`GY zR$n=%{)%u_*3W3R(Od@B?xl&2yC?kKAu`*2(vOVC+Uu-jr-%SuVDLs0`<0{gD(%$r zUolV3`v~3!aq2t&KK`}cOze6%qW-o-mk z=#B2B_^RkJ++<- zyQ7i0@?90^*HKZO`l>;*>S?skZP{UOr480(V;pHJMX;>Oul7uZZ1{&o;{EK9Sx;0! zB6IUd%pZOrC?L>pf7Yx`!X4XrV@!juM{B|gx=O|p{bPM>+g?6sY;YZ{$Mp9Xp3k+w zM&HSvjo-2JuRkVm(SKk2x!JQ$90~W&*yyr~HBDfqp%_M3{8o=qzVY`F!3GRb{SLj{ z7`pZl05Bo*cM!RZyZLi1wGdj_}1!T$!gxAyPg z4u!4@4ZfoYq3nyy<`T?zCto=y(s$(KK;zTRtRIaw5$)o*tTbu7-m0LnH@=K|BOnEG zJc{*s$$wr02Vzv~Gbot#J zb&-f6{cX{+kC_io`@t_vi$v|&Q57Q`*{rjD_fr8V*9Q@Gcwl#vP|9XvI8~Ej45>*? zzECyo(Sg*Pw8KwKB}2zZ(Y=-0dhlCc#TPG*Oss)5dh9J%PGVFe8c2h$Ox8ZZ(^t+-lT;11qw)>1 zdm5$>VIFJyz#O#3I8JSlHRo96iM99CDBBfg1m5;2#4Vmop4!vgqpY!s97UD|u1yaKjtcwdLqyMYJoYMXD(>f@7=X5rd2!0d35I~9UOd$ zUHEe}UeYPtLjPfgAn)T!{y>sV(uyu8XT@8HVfD=)Oq80Pm7^}-Z_jNZ-JoqdJ2G3>t^943t;OWMlmQQ~ zoJ;L@Wt;(PB70=3p)ld#DxJ$C7rJC+PEcEd)B5L-JmEYZi172|N-zy&)7BlK(s-D0 zlgY>v6N#(ezJ)93k4Kf!5g`%n_MV;Y_c3dd_RnLV#`|h}tJ(7|{}q9Okn^Tt1q(-? zi>#)GywB?!GU2Ho5_o1R?wY#{UAq<4HCDUOyrM_nJGBUc~m#p_3j%;y%ox9 zFS4So;;|7`)5u@ao{wV`XTyp(Q$N2!rPxK&W^i1ocXHTW2XeZp=l1;YT($l(J^%3q zxKua%`uCZHNvuj2DdFUzkp)sMFK^rxv@*NtMz)F}$TelD={G7ndhfQ7uUE@@Bi%6oH<|EoiZNx4+q8%EYIT|vhJHoM7X+z%< z)QR7)A@%D^e`0z*_b_3|qa0bG+fnyw))RnX(8;$^-W!LI^Q(Softwsf3~*TRoXIOV=X6f3P_-uyu-0>y_&J zOZ)RItkB9t$A080dN}vHTUtc2u|?Qt>ST;65f<1LNhw2BlYh2fa&EC9E!RyOfU$X-WkJV%&*S;uUZb;2x? za0u7RP_#gVNVwCA*SE{cLiAZ+cWo7_hRkDj3Fg93#p_Ds&?%XcPMy_0H}X=TB4=MG zSX5C$x~;!9aRK#k!1HR@Y7V*WxpU0p(COcZA?~EGedr8zs2ac2Gc{jTm*8?pP(>1N zpQRc3X!Fm+TrOuSb*4a0-=#a10jBeQRjh%ZhLc4-t9Ce{8_#v#n_xw8x3gCfej6{_ z{fBEh5p zY&FirB1j6qY-tA^&?g11A@^den%f85-cIJn3)f})gM%X1o-S){ zM<-Jw37SiF$cd?@k7$EN$Lp5^Lb*MS&KnkJ)csdVbap zw@e1!Yt6f8QGtp4qz-0!VxHUNtvpGlJYRl23@XW@8`v({EKJjAco*mHm!fppR3KNM z6&HM7Q>o5WmL~giBF$FT-fI?EHH5wP7}=x`AO6H%Hd!^=2z`fE$dn^&zGI5dp*jfe z(tEl(>nl0xk3FrwBict)y6&8Xzi9X{0*!fTI>|<$JkrajpzmS3JK zTUKrr5gtSS=11+HO)xe0(;7n)U&;+Xz3VVb71Zc0k;>rs;wOnL)88qFjBz8%i4Smr z2#SS_!8s%8D+^6MI1PO(aNgw9oC;ig_Dicjep>sYo0di0rP{GF=2?wY@Sl`fPKF8-O;HzsSHHu+7u|aYTS7auyNMV~s&*BUj8$Rvo{kmfhkE^&q1BTbXT0}WEh2^0?*_l8TFq<>PRm46GE}ulbE6uv`cqv+Gs z$UGyD{#lb5v5bQjNh@#qufHX+JTfwv9Qb|JIb7M7ZAUh}$OY=-f^G)}H+$U$STN>d z#DlBBM0%}BqtW0<@R&L$z2)b|T^IF$B;RZtiEK!Ibvou$Mk7{8f&KOzJ?bg=;a$Yt z8m7)M0`#~Imug<{D-f_e6gLrem~GOG~nO?1ZXG8>AA^)xwHw! zEx{ndk{VeBNn-_XT=58*_2fYJjdb<#s} zSMU*o%jZ{jY9)9Yu+W1WK3uEplY0jHUYAb^IR#jAS<^WqkjcN_} zV1CsKPMK74v&D4f#wW(rEB*AG3-ktW6!7gr1U)z7(^}=1!GKF8)0fIw5w*4QOC^== z_`51lR?LqxM*vC)u)S`;ZwnBqp>0vi-^;?Do$eKB zaEp1JF|^;F(b$hmegx)w(*QzzuVgWA_2FG%IV_t)!k zY^@z1qW5Pq^kH_TF?u7u!-QW&sDzIe&J87B9lx9Xn0|bqP$Gr1cBxTBb7a*1NU)*z z#FU}ZbN{R12G!;fH+Z&nZxW`ZY57VXxwdu-fL=l&A;ufVe9^uAOjj0=%t9NXg-#|_ zO8i{h!(B;-xV;TNI56n@*^G{sr%R=OT=xuYH}w;4Dm>`~`1GvY;K2p%)d3gqpe1Pw zhMj`wq6l#oQ7R?dYNS4;VLIp$O^G6F9&k@4qvY2XEZjIZNN*GgLV4&Ln>%M6M6Fi< zGlp^)4eGYZ`ZV=_>ux*Mu~j+3$AyekdV1xZu5%v<(ZUth$dVXYOb+YpFtd8?1XUn~ zI^|4oe>rK_o9I?gu2pd$x10B$J6 zedd0CKw#V@(GX9Jjs70_AUdet)z4yM<9u&h3$ps? zC3{&Yz{HdHF`=web+7*ul0p@spypI!yL!5_Ck60C3=&* z$_7S}bpz6q=-w7m z1_o1LYO&DYxO*Sg z0xWkfom&L@mAY4>odwMHCGB+5d(^YgaI%|mW~=bZ>a0M6uezM2r)bIJuR?7Mg6^k=4!fSO9!Hr0bG+WIpvR%&4YGx`RZ2k@IbIUJ z!E#lBf%MfQ_*K0}!@7d@!KYHD|9LWPX`az6=b}|ei-CEGWY3tY{9w#rQgm1i&1&M* zY=W)WA)hC&bq#ZdY1yR{YX}G07VsoDtz7%WJeW+*# zcIkARsSoAhRsZ%k4Kj?OV&U2*pn7&=q!qFC0mQzp+G-pE|EjAJN)QBSW+VuVqm{u( zU(l=c5InMW>A@3@0=KCT7Hu{m4qLa+5yy2GeG94OlFhB{>4-C*hz4O%Ssf~ScqL-O zQjBT%yer{8P+^8YNwTcs)w~^~i?Ix8IE7hGUQPRCl>xHjhGLuwf9r=@;W*7ST-iIE zwM!xh;;W-69E0y~md$8M@tUnue8#F4xx~)4QC6w&DDCs5*SnMeFzIcGKK67`Ip!Dt zK9j+7et2Lw?J*+(xa6kRUO~KuUF&Z+&Cu`sdwweQ=}J#ug(&G{#wn~Pxm6pGwwd(W z$KCq@y9W%S&x*Gl7Qp0WGHa4=!A%|oj==5wxGh`GQoZWYwvBL!A=Dco_oR5jNR|Xj zDDxgl+07At;si5E?V<|II_p%p80ws`K+;>kT7b+TG*-Mm)Es2`TJr*Ox9lcp5XI1N zcGRA7+gaeE++oOdHKvj&6IL}d@m&m5%(hfcCv)J1&1v`%gYvOY_m`t@!en?wc; z!-55}QPj1BTbqU%ygdt(UGH;*Op4R@9sK;37XMVwT=p&V9Zqli-M(?suO5fR-uMa+ zOtOEtzIQ<$v~ivD2G+%=fs&{o#ZwNI9-3Egb4q7^NJjZ!C~9rQvxM*CS3S$`Wxpfa zy`ou-&2>EyBFBt)%Co;(2jcNK)hkt$2BG9Lb0<>USXl1M?Io0*QRfY z=PNBO`J>it*YY^7w>t+O(Q`OblTdRHgckKMSvBjj`8|oiwPI9XsdZxh&=?O&ffuxWs|(?uK|HM{DUFC# z$fYETy>!PsYk$U+3T%$cd}puxl{r(ezY&@lr(FqxRj>8sfZkcU@{(!?wVbL7T#`;9 zRCCg)?1coEpoUUyf<}N|v6=4dcGlpHS)_&eZE|Bnq&oXZauu zGnHR78ByW$o3QDV0M#gL6(Q6TP(Fljjh}$^Ac)TrC;?kkmcL({2}`7BO_hdav; zklqv!lYNvN$~^WaX$jJtGFf9T**2+Or^3rWB+~9S!Oom+rY@AoDKMo<$yy5efaz5!H9E_KbUa`-u{J%UDMGPJU67-) zXBlxR$zQ4_cqnCX0P3z)gON+M>t`;M-aW3pSwk!Si9Q34`Ss*NG;?_~SDTN+@v%Uw ze+<|!k>e1qfjK5urp=z~F&*N+PjNs0S{68ztFy#XPL`pvXYqbU%FQ3}_yb0bL)CVi zwmKJf8UVSGh<8nq8IJMWn80_bOvmE!GSTC35|$Yg7CMNMX?v7W=lfXCQ2Z-6qy>=; zQBWUz#CnIZ-ju6p?|p&qa%d-3JhVt%icM>oyB#!zu^8~D)4v`{ST^>>nDZBPZ^;?Q z1plsll^RE1=Nt6%*#?>j9rODU@$=u2eN#&V+ZMjKJ0&Iw@!()u=O!9crqVL>R*FhV zk{X&B-r95{nk?)0q~zyAoW(F^6&UiQs_7v%cw>C4<);~)ZrjZmG&MN7F2r=Xn=fVF zr;y=jw9?$ldA(%l(Z1&PHae!8M5n2ukZ6nejNSl9#AD|+bBMFcEE{_D<)xb0#hShn za>(>L?d%V#*W>(ihW54nPu@(=*|yTgs_1g`TGyC|OOa=tYNE|bv@SsOtiToQA4?8a z`mBLgQTE|V1qH~0F$IR9y63$BB36uocp+Eyl$ME?^gBvM^GjLH#Z_&STpOf5d#l4h zkG-YfKSHPF=jUahyN)kM8Dvq|iDbw&!m~?WPMUXDJ>Q9B!P#inoo1AJvN}YTL|(>k zoNobl`EeKb)KxG3IZ!7T_rcX+G(tF6`cMbWrcTNepJD)+HGhC-L*2*H-m5sK&e}kD zkAbg;E1q(n*fvou>VWHG)L{oR9Aycl%V|MhYRpg6ZDbxRF;F#Qf_=_2Y|1yXQ<==S|DPk*&o3x`U#k}=#(*ugGO}O&F+$O)~IMPu+x*-7}R+-Cn*16 zZplq;q?_chkp=C2agITV6x)`$e=MWTTm`c2=Uy^Bsrd(2r<0&E5JT)Wtz=tRw5zfS zk#%*vb-2nfH-X2{05Dd3F)){)XxqIWkAD=8*SE3Xt~j1t*POx2R;_;89Ox}nn~a7K z+k0l@2omlAUPMmoiig)?uUq_B!-g~P2~=F0j4n z>IAJ1#15b4+F@a-wx3I{$yFy73tjXbv@db0IGoXl^~s_ot2DK|`!6f{9pZhx=iWNM zR9lq3F}&@3 zd_*Coq@TO284zWZ_kF6#@(K;irxz0&fwU5eeQoGp2}7kV30hH$I+Mx!)Yk5%DiSxvbcOJ2{rkfW z80Ug2#B!bTa;D)gTdTY_beaO{<>5@Vr z@${0luxhn#B5V()5W?O1t-E<^C{@S*Rf^?;6z)y}=*3&us*HL2ITv=RaBbL6y zB)^wZ)i&_>DR@vYJ?PKdSMU=cO$U3ZI(mpD2z0ih4kjp*BQikO#fn_u87J)mLSm|X zX#xJwWhHYQ)Y#yV#`)Urk}HI56+NEiuR+gKIm^kvE>U~xtD`PYP~NR=*0|zrp`_veAkMc1&FD;uV+)6!*_h*&<>2z4QmC<9#Ie5l)lyENA@-*{ELRi zo$h77R39D)63&|D9#iJ!B^JhyO~t_QwfzU;>JVk8kOk~}p-Vw?A((ZLSG}j!E50T@1p`_2KZ~7B& z&w>2?;K7+sKyJF1tLChNK#FCf1;3rZYsUe$7rY=xw>>MgT^dinO;Sf0NZ*^;ieZL( zLKkaI?~w>;`hf{}m@4nKlGofj;H5rIt59+SdP-0|0RBZWi$_<8Fq+!UJ?C~MYjD<} z!K2tWdvDyTJ9O@K0W<2ejG^d?;u?*q-x4CdQ0LHgYG=Y;>cTaZ-}a$Xs42QstUUcNe?#PE_OkatY2b^B2&-+>WukrD&Jyh zL7nA~u7dh2|J+uCDQfg=mFeZUj^~zR!!+=ti7S|M)>IvGOGi&|2N zSuJr@wL1}8A00u!TH<7;Ry^WKe(|YRJ|BJSZsBCq_2}8;+^F7|r?Q84dp2~KYQspN zsTrniltfJ3K+8zUr(JN9iJi^czt??Ul*Z>*0P6sO%I!BYT-_g++5AqCAG&U z-P?8Lw42x0b@345jfRhA&;71YCpR6h+&?)#HZe@3ilv zWc*BO3K&;o?{U>7iyr!KyeEJQ?P{mYu%3&zWNwbP9_j%;bNbYYE70)Mxxh95j`U<2 z`aTiv)7DgyfV=zlI*M{mXz#PaiM#R12g{VH!6U|{h;?-sE0RL#h`Cs0O@4dI?rfS&Mxeo~4H-lxYWuFW9QjF6^Iv6PaD$c}D zFwdrI6)XGm-CD!S?`<9z3Zz@rnT5KE>{!3?zyM0n(SMJRvXhaFidrGQ5lMVen+*p2 zA?vL)|7n$!Kek)YY%$VEfvv$=B#)6Y+`uZTQQdqrSv8S=gxuntBhaXa{HUauN z>+b_G5dl~1N*J$vhog;JPuCIjd0W!s+MTZ#wcv{R4ki7#O4y}^eSI`*GP&<=7Wy(+ zc|2NJzI1?_uFNZW2s#Wq@et2QugG5TbVU24&)fGGMf(5SM$9oDrPu!CUz9h;8# z9$z~sYqBgu{fRo>nrG)c4ARiIvVb+9_XxR+Hc%5I7V^_gEYDSSfFeJRg1(kFENW>) z*s-CV!IhVdenuIGU2uJ*GlviAnRuX?dkXDTPK6U5>M>5KX3};hJCTaUX4f12^FzH za!iFu>rF2<&OEart>&Ptoz0_#w7*}R^^^S*b(MeILjCHbTRyy-JHi+_lS3WmTI)N1 zzOCKDgDB#N-#sBW8|z)1IOD4a!C)OgpPTbtixrdU8xQ2$8dB`8N25_a%(Qb?X2q&` zKWc&M$V#UVF8rjPzqxS#$pqV7uUTre82fXuC+!A=@NG9Zde5$N0@rfaBjBRnZLqGP z52yAIiwKmV=P1m4+5$JV^@Gn;Jv)y_M@mxc%BXW+_$gteKq2KcKK)V}HY8KCLtwzb z@3+A+r*(&b>m$d=jeuSVeCyV4>KzbcD-l3sSfl0!le?c^6F)ilEvAD>h`_i1ek<9# z#k?r+k}YN=5KPu3*ztqFGT8;R`r<*wT3ScV<8HI(;U zqV?MfH+y}6t&heGeVp=g45Ejkh7^?QDm>=y0+ZYH$BjChs%W?di@3tcbt}d0KZiY zn_V~?pPRvq%P!mJ5P9_bl`=C2~f&nd;^dQLUJHOqGh2&p3$?DM)z zIg>S#z47PvtY(Pj!gfsVD#-$26+HOf=n@^j9*JSHp_REw#TuCb3Gq*FH~7c2nw>nL zyba`XJ(WZk>6x*A!u1qIiX=N`{7wwzKY_#nLm`6^m(cowQ7aK$z*XC#I~V{F_Gybo zOtHLZH)I@uBVyCMTU;Rura@GqD$OzIT z)alot>XvaYdLli%j4tT<<0mihA%=_jyF}F{vFE2lP~ybPdV|@3KH4hH1p9$ZOQ{-* z+DF%K9J-m;Q*vSA!^+cutjdt(&7ZiTmHJ`Wjf6veHYnQhX}zr<@r^(R1I5t8H-KPK zWQVzrp8x^^dwm| z^65ZbLQ@2mZ&Y2uAPCx#TONSxFguP_o$M7xT2&or6PS;Pkm|e|AY~nuq) zV&bpel=Kox4r8Ax>B`4#%9UQgemF}0JZ*8vW^AE!oD>U7Fwp<&50NPGCSmodw>|WL z;1XKqzF$u~S{5UG6!YN**>cNh^lF`*@{GBz$WM$Ftmc|E>H-=KQwhu2nJtvD{=LBo zX3@t<6~<-tTxY{irNE%uoFv5XKpR5MEEV`(*=a~cE;PS=qbNg%*ZKpY@X2S^7<+su z-{DXl*0;2~zs+THJEpixdCm=dwDJnaHXBG_O2Xw#Zw$5i+Fzkx%-Uo{%^z@iAI+bh zGb1Z2IMikX{=S`2)hQP<+z zq)?`(vBH&2aAVu5C+}eZvh#wtJ)4LL)<8>3q1xcYvEf*V(;Y;Jrn&z4sz-ytH;30g z8RyyB5kC{uLC#g~ug#wSq{j>m0U}XJpQk|Lx;r!sE5nB_r+2p3XbqBuKhf2a4@B3-Py`6LG zOwSZ&BCbH5=2qjxCmn&mTRrOzTI)UU#WXF3n^|`L(7%PuaY9l~*!Z{g(VJMhU zW_@&n8){}ov8ozS#K$Y8{a{`eks{sS*DYo11E9j6(1sWKALRlkzJ&ZK(=4ezG~);L zf#hm_Q3C7hER&7X-Wi?5k`W#L@yjyXKZG{h`MB>B=GnKX^PcWB(+eXFE}!){j)(7+ zB0GTorR1$%+mO?Np}%d3h4zUO<5{p0$GPIS)|RmGj`>XO%tXLqVT?ynLgaJD&bDO--P;{g!-CmrC+;P1zNM^1IsfZ zIH#aN4P0-j0S5?XEtk$7piAGkBCkSm%dfoZ0)qJ&zC{4|Or!?ORFz??i1AFrk z z=dyl4mU`cUO(+vw(6ONR{d^mMZ~RkCuy)K$$pFwfa{0W8ir0aT*`VKZ{xuvr4mUEY z5;^=Zdp0#Oj1Z2CYXC*uY~1Y5J~JIgu0T!Y4heSDkT_E>T(F1ctdwN|gPw@7Y8(A& zWTfk*OpA!-r* zznd}e+k_m+#<=+BLAYS8kl*S5qqy$?YHIJdMG(+~fQpKA6a}UCUPVypN9i4@AtWG3 zhXA5rp@?*lq7;G9JA_aUM|urC0fN$n&_YW>c{})>ckj%dZ|;5bX5QPwB$=IL@6FCG zYyEy}tv_xy2(K%1gMxw^^NBvUtmUL`fp1W8KB8yD(VK%ge70Pqly`(U>wYBA&?{$4 z87c@jDNCxT5cB`}j?e9zZX>W_SF_5^#~}v@p2`p`%pX@{GLzy7xJ)X%BB#CdBiX1Z z>ZiA30EClVCN8!GtmGU;iu-vWb;PonZ1gDzr$MP4{a~CisAUYAqawc{C_#P%rUU~3 z_QPj>zgFcwgPy7v|9SJ@&-k#jTsBK2q?a<1zv>~^u&>VL6U@xq0(9YlN%i6pd3%6~ z4j>5R=l@9Kuh?$Lr@Rhs+1lvw1~mZ)`!63)LmC9eu|knD zg@q+CKW8x2)&QZ7nyzZT`Z`^;$h%s%16Ms?dC<2+0L7I@NdmtNB{+LVQL>I!v&Llz zp~28F@7$OJxxGC7a15s_G2=%{sa_h*2Di2>>SW0+A#xpoTPScjqN01*SJt$nMc7FO z`VLJy?}PB^*gGizL)yChnAuy{jn}+TsNTfQ<=I)p7+FRSro0 z>9uUD;5@Tpu(Z9EjK|AeO)#@s#y7@H`u}ixSHfc*^J?c)aLnOR5aYxZ!4O$lYfQ7y z=~S_Eud0@Eq>eemH9rbRygI%ukuRjh+q{}ljxbU)te^nEGF>^$DC^cXEN(`9OpaYi zcH6a!Z9_85e^9k&y8!z|J#s<7hVUN88MLK_sU`(tNtx^D8tvx268GUzAo!-0`=jte z$~sIZcW|7Q45H4|B4fh!n zdn-<;A{%7Tk&D%xPe@ocDR;p-U<0QV03D zO2Y7<+~hJ>32}d?aD`d5kdgkjYimnRAdal!KVk%QxLbzT?M&N`L%YH!xkE8@i%0fAAMsFgNqgJo6 z=xuz^ok-A0G7S+@IbPLw94j)~nHq$R``8@*#q2PcskGCr4}03t(XqgWJ)|Mi(fai( zkC`jg_LVQswswH2Ke*yH%SHuD*QDDFJ)X^aXvcS@GOz3UYJ|IqhpAo;mF1(=$@UCs zVsS;wYJ-hwbua&*Rs;z8K9u>w%5M~}8~QCwKVO)I0qa{Uv(f3$5|W$+_6BO%qA z@Ja=ODv$bDZ4HeQ&%FUbXX?RZ^8vj?73*4-n!t}&16RJ%NSo|H`kmqhtc5C${j%hI zgtKFoZT?V-Dd}Ij5ZUN(=#r(AR6J#U0YD9n^!XuM;armk`G8+j*yKDa`C*e;DdaX3 zS`7*PNX+z5;$nd_+>`QqtK6J$!Pdz-%`=!z6}(bi=vus5jph!_S^BF~8x$b`Gq@Vh zo`srjD5#E&x*M)2(pu5qPuBS=agMDI$N(K0Nc^HH9ksxVs6pKxKS2t3Qt@^yZGwNN zdV1cPEPcUo=)ie@mj3eiB6BvE012)Y2d-Z9vNpt9>C(vf&D!tkdkqu6kd&8S-sch< z2@SYsO_$XHgESqN`ZZ5FN@a;yi6Q~jU&C4{Vj&G&8mAvZ9NF0&(MQ||Zs*Bdl&c>c zrb*mGeUD?;W2h6tw5p7PRVGfkO&VgOK#)vnb&mDjS8S*ATD7Z%r<|qI@ulB1r7{QH z(3buN9TB`p3bm1xoy^L`G8q@vjX@c)ug7Ea;Y*Wa1ak{-UH_CvCxL^o(42EFc@akG zStdLB;niB@4wOHp4+inN>l40HBk8;7{NdO)q%zWF_q2>_O@SnryO*mR|JqyTWVF$e za6i~v5h~=mMRy)EyPkMG*}6JUlSKxFYdUwxft>yBZX`8<@XTh zoVX4;@y{&c7E&i$(9-b-HuvAUNNg8H-thACGyEidz<^CZ>2p?|?*L4imYElFmwTF% z*FrKTsb$}lQP=Iu^rnD`AQj3bSK`r9TOk*dIQZUPoEYCBv5ZCrI>W~27`Pi(aAOLT z{=N}pKA%d8*`1zRnxT4DAqi%UG@umYIUlU$Hkm8N*fzvRU0^zAY)>mrYQ0fQz1_7Fm!;Yss^su z;P81j*(Uj3ZN1nu1t%NdfD9>$-s^uS@}hIcNWtP6G^R#w^XRCWOAC*^8!L5@vBxw3 zeu*!@<;RX$FLVh`hMK1LO!}OTWLE&|JLFmOcP)4Mnv08;eVy{}hs=3ZE(mC}jKgjE z_T8IDI{M>i?h!TC8d3FsuWkt;ia3888ab9LjD&sg9n-I%mb))*C zFIu5X+XRqxo0>Q?tvKqYJA4bi=2kf5o4;JRu6%lg_xv?_AA=+;r9%aQWmO6S)nwvY zh&H)|3@uQ!GM;!L<}!zSDj)pA6C9u0Hvg{L z|4%r>KdhqsUdYL>lB||hBCv75DIX73*|nSSeX*_ZFHX|B`8#r;T=l=?6eO)Hps>dq zZ`ZMPHr9bSBbofqYh|ZGQ~yDQfF;&jTHWAcBhmWK-lt{cOu!=M8Gz4aDdMBtFtxfT zo$r{Sm&j|L^Yk_ga?=5SU8Db+C~V;lkv^Nd^IZXzJo)#@SY@z72fdI6xd^Ymgryb* zgve!PLf{Fvc%DI*Q%Z<)W?z(Bd<}`&{trN(Bpn|)0`<63&@v77x3DBt9)5iE<%7T8 zEWko{8U}-fYXT2{L@pu^X1%;9DMA-RRRjJUX0xSd7nlKv!zVlUKiWZFO>$8s0xa2@ z=Zbyqx_9X-Cm?4(@kRt_5CKK&H^!cPwwW$VR?!HI@Rfpw<2}55EKS%jkUYkVG)==v z*KtUDnb5^7TJAJ9PEQSBGFt{KBs+TEXGPXbq=Fe7MK=|@6@0wpTHbR~Wr+AkjdUbF z$GZx5s@w}#W1W7{i#|>8x|{S3)X9%OLP7d*tYW?=&4V*Mv5L2`gaO~@Gh18bO#qkP z*((dN5}(Zlu2$NY!*;&{Rl{#t5^eTFILl?tbc&iY261@CAmpZx`n$v$RL~tB2ib1# zpr8Ar7c&9A>~lJ`{-WfSnuG9%G}lAow8H+(K#Q3 z+B-?zJvp+^nmHv%oQY~1mMm9&+V$L~fS$**^_%)#lc91+3VmYi zH=`FVSYZA!$=7{@l~-|Kbh|>Ja%XJ1)wc|jL4=yzM@4I|mn%cJ2t6jv&k?j-K||8G zli7o2K7%occKq zOvX@X6Cw1b__Em><=1R|0`mdujhKFK4~Dj)q~*+fE$xgI`72uMa5-8yr|ndvqIIfx z=X8i_E=f$;XeaC${r`}wY2OTcd5eu-t+mm|t2d23^V5?+p2Bmg=FyfP)~Bz`s?ye^ z6tZq6QvK+EUVO2H=AKW?AN1x{WwSbuq=NS&hWFNVD=+2{zoxIRn7zoHi55~zt_y^t!3nZ6m>mWVA@G)})h*7ruO$t34j9}v9-Jwc|aD|Ofz zju-i>Dka@WqD7CR|K3Ejm&Ka)-r^NKM?rBPPy+mGDgX!)2nk+hx$!Cn8 zz(isZx~%Q0d}WvTy-qZwdhK%L}6iD&yb z4lCU&Z!5CtwRvk18Ip;{_b|TyunzvZ_ZBG~;3ytYAl?FPCO9=5?_=y|9;p!jWCH@P ze!+uYU!n-T8>Jdx4WjUP{19Bsr1qYxujWQT7V3PSIR*k2kWyvr(0qO_hDJuIIJW*tES^ON7ZZ+c@Y?UTqso>ZI)YXr`AQ$W;QnaQX3QX~*AK zE4_^tdRAmmlv4RcP=hBj$;1gYt6gU9%uoN)%DrDa<#L|bsUm3VO7-&#v1_K!CfOC- z8xqj2@Nu!XBjYUQ>1)esd-YLxKhDENQC@#RC1U6U%Q-k>@>8x)1zXcT=e%FeXpj4> zwO?gwju0|_4<87b$ttF$G9wjDymkqB8q@iGm$+7ju_e-~9EJtE17%)8rSmAf@FhdZ zYzF9w)Z5ycDq%mC&B6LY-4uUN&tBof&_bEkTHYt_&Bw8BskUu^8g;aC(%jKx-ZkBx zR8#TJ+~}PvmP5o~IJ9uAWh!P&+-YTB*>It;Z%+DtfWaKK-JA1Vk*u3$Ty*Bu-LOf+ zrZJe%w0<(psoKbzX>^bwTbdp=Y~aW?jZTukCMeN-f4RnZ8hPM4GAXyhDX(~k$-G?w zrsIQ1JMB@Zv@1^yx*7L$KCK5iXr6ewZ4d2rJPg$gpH)I%Z4H#Y8ecPztJP|bxWwzi z66I=CHNcd|*vQ{m-Fx0U(Uu?Bmyrrmv0);(@aNqxqz2~Sd_p(24hPxf>Hf7B1S%?x z)agp0QrsfvvevI4CgD@ZwELFnyzKjUK4TfQ^i$(COIQah{qA?BGd zB1i_%J_z1DkD}8AH@sp~MXrJ&f3WG(Y>wrpviNr)E;7DCW}7)&wxw5IlG2Vz+jRZ7 zFg7_k*SCk^?LHw*GI>5E>27)5F}8rdl4h1XlxjFf|N5^oXK+<_@lu78YvpRbuC^Yo zAm2T^&!lW#SN9-w4&^Rw?r$=a*V~+)%4;paMk7R2t{pExr@==Lo`oMDP|33iK0KE! zHW!RD#b))>-G;dVSQy969eb(p^9ui&)yZX22)}*HoII!*(B{s60Z9O zS%s9Y1RH0;EOnafH)J+_YbvcJ*7yt8E=2`y&Y{ba5&5+QM+4w*l?Y&kDurI@!r+BKN@jd z@bvi%>&kjHm#b$lE;V7P;QbRS%@9nwqgHra2gadCN@ZdImcsA$zzv-EH(cZWx11vX zbNz>U+-zbFITTtdQ1vo1N`-ZZSc_}4+bqSWyiE2;-hf$qOQ6C>?dmT(;+ z4-5H%*2R3~4w!pphpmW-X-JCPN^#v<9_xw7m>5+8XB3fbv(w`H_D`vMvxE6+pV+Vs zf!1&ntvS4lsmt$v1T)*>G>@l*HzyYaow4=@J;rMV%De)4c4b1URXFOir($IfQ1?+y6L6A%jqU)B(AtaW=Xo-Q=Ivt4_zDJ! zu4~f42VAuP9#7ak7v6lJ(n%|;9j?4Sx+!}Y=7+A|*+6V6Pu00+P5aG9`eiRCxHC`?5)q1q%Vw!<_{mRz-9nb_IcRv zguqbh|IPmY;q(8#OZfW}p^e9DU+8w&Li~8gaYrH&&|f30^A zP0)Iz)1y&rePQp&^{R-q*!y__?!6m)u%!q}m4NN!9beYcga}6DAj9C% zkre@++LEYJzjy2-TYXR^(?yK6nvb}V1$08iOX4y=27_z6<3KX?H+9Yu#>DSi+$1N( z@5f~mUSrR?m-xIN=!5QG*MYEmAb{R;A`R?TH$O7bjSSgDyO@%^EoF=Gzr-8YJ%QF7 zPMPqrc*e(+|H~3tEN8wCBpL3ZY~^aLc_7oD;=IaD4x5b!aNt-zs*gdM$(e6U{v*4S(32T$&a+ z+AD*6JC=vaSX_%gNCf9SjgJqPXL)Gel=n*Hwj)LJhqK+h07ect}I zm3c4ASbmx*f}FPa$9PaCdt%#$PvPrmO|+~)flx)Q7ue;e}+>Os1CUx01-F@aC z2}o5uB0UTU5KosPfw(rL{l%{3PoM8#3(S+VjGa2D9o`eZHx9B#`AB}Q?aftE2nmwz zig~s9lIam`9yq5r8t_yAJj>k*z^_^kJ9p!0_w>k3=Fktez@`K06)L--2_U&GW3+VkcI%{%DwH<%y3Fx!_?In{svbwKZ(&_NaQuJ=R z*;2Oh>kAR)KCi>-Xn@R!?`0(iuH&83#!0FEApVu@VmGwyY1!FvM`3v>xnBY0#aR0) zZP2i`;YGUJg>Y!1^Z+y5NQxB*+u4312YxX0FNUhj>++Q2e7>63+5;%`hRPBYV!ldb z&wx@v=sz;Pt4A*eC^wIjg&+NyTy)@`y)WT(m6({cy+&@tkEDFt#z*OI;Q`;yf;qpp zc6R*H%iys_>`H;(iqQcgI!pSmzODz={KfjPEV;164(C2J-N-rr%-Jf72`pTq+u(i7 zYA}Jl3eRt$s(Ntm^=JpROE3c1ZI%9u1vJ79_e~ur@)7tvZjQ4X1`>C1DC>-lh>M<=XT`lyjT<7Rz`O`lX-eSP#&fo zlL5mpxSM)K15p7*NA;&UK8Hj|yytGOK;B}~0p`c|BArV*BO46`%RKhv1(in~wUulp z1D9g`G++n`45%f>VxS;yz@S+3O!Ofv(#^VRo@5^_`8zu{yL@@zR7-i5q_TKAl}b!U zim^gYa)Or^_-v3GP*Mhbdh+|b-+Ga9Tj}6=N5V$ztfxBRq|SSyha7zyaYN)k-{&gM zG}Ql-`mwX9l&? zzxf&F|1sv7^)f9^>XjdPds{0jx~Nt`EH@Ea#0|eknTm^=Ru4EJ0*?D_nDA0OKjA0~ z>G1SyoSyp6f*Y#DQIXt(7)GtZO&cL(h#5yEvF2}J(U@p@UF{IVz$OYQbX|x6QTV8& zX@!P-3R5IUYH&ObITgXiHDlc`y&8A6j+Mz!mbx#aYsn*mVEy@M!J80NT(~#*P~Hl+ z9nO`&7diW4WT|sEz6`^C`V4xLybuq6)26W9H^~mC5+=Pfb!)0Q)4`nx&xO=2B`2nP zv1#0h;~Nrphx`t7cMhYWbE8o~)}@J1M6qi^<^bF(tRNq-yZ23kSI@>8DxVe_P(@4iGhjm)5XqR?Wo7yOD-DS6 zyRpX2X%MWL&v9F1>ru8v%L#-Me<|A6l857+Z+VN#QPs3>wo1(+4dHOI_h{klShRGy z;mBRW#j@toP+A14<=T>-MVjkLHs6)e*c7xe@qc8FeRl$QQFcGV`%h3J3mZ+ox$aFG zF)M>+O2E)Ez%U8YVL=-TL(!-iUZ>PI$I)Q&{%ZZ{`Mns3qa4Um5h0J7q)whmA!q}5 zu)mZ3g%@w!`hRll|MzFd|L;%yyMd;}sQ{=AOa{^U|L2mq{}wLW-9A;hEcS-MPR08w Qc`Z*g^d6QzuzmHv0KmzCXaE2J literal 0 HcmV?d00001 diff --git a/src/pages/selfhosted/identity-providers.mdx b/src/pages/selfhosted/identity-providers.mdx index ce9793c3..dbecb766 100644 --- a/src/pages/selfhosted/identity-providers.mdx +++ b/src/pages/selfhosted/identity-providers.mdx @@ -647,7 +647,7 @@ In this step, we will create and configure NetBird application in azure AD. - Fill in the form with the following values and click Configure - Custom redirect URIs: `http://localhost:53000`

- high-level-dia + high-level-dia

#### Step 3. Create a NetBird application scope From d2e99d0648c43d1d71da953c575b29c6ab2c6f3e Mon Sep 17 00:00:00 2001 From: Philippe Vaucher Date: Wed, 19 Feb 2025 10:25:10 +0100 Subject: [PATCH 3/4] Correct Client ID instructions --- src/pages/selfhosted/identity-providers.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pages/selfhosted/identity-providers.mdx b/src/pages/selfhosted/identity-providers.mdx index dbecb766..cfb4d8a7 100644 --- a/src/pages/selfhosted/identity-providers.mdx +++ b/src/pages/selfhosted/identity-providers.mdx @@ -663,7 +663,7 @@ In this step, we will create and configure NetBird application in azure AD. - Under `Authorized client Applications`, click on `+ add a client application` and enter the following: - Fill in the form with the following values and click `Add application` -- Client ID: same as your Application ID URI minus the `api://` +- Client ID: same as your Application ID URI minus the starting `api://` and the ending `/api`

high-level-dia From 4a04ddaf46150dcee2b4c095bd6108af9e1709f8 Mon Sep 17 00:00:00 2001 From: Philippe Vaucher Date: Wed, 19 Feb 2025 10:27:34 +0100 Subject: [PATCH 4/4] Remove outdated step 5 --- src/pages/selfhosted/identity-providers.mdx | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/src/pages/selfhosted/identity-providers.mdx b/src/pages/selfhosted/identity-providers.mdx index cfb4d8a7..6ec67086 100644 --- a/src/pages/selfhosted/identity-providers.mdx +++ b/src/pages/selfhosted/identity-providers.mdx @@ -698,12 +698,7 @@ Add `Delegated permissions` to Microsoft Graph high-level-dia

-#### Step 5. Update token version -- Click `Manifest` on left menu -- Search for `accessTokenAcceptedVersion` and change the value from `null` to `2` -- Click `Save` - -#### Step 6. Generate client secret +#### Step 5. Generate client secret - Click `Certificates & secrets` on left menu - Click `New client secret` - Fill in the form with the following values and click `Add` @@ -748,7 +743,7 @@ NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://graph.microsoft.com/v1.0" ``` -#### Step 7: Continue with the NetBird Self-hosting Guide +#### Step 6: Continue with the NetBird Self-hosting Guide You've configured all required resources in Azure AD. You can now continue with the [NetBird Self-hosting Guide](/selfhosted/selfhosted-guide#step-4-disable-single-account-mode-optional). ### Okta