PK &Aoa,mimetypeapplication/epub+zipPK&AiTunesMetadata.plistd artistName Oracle Corporation book-info cover-image-hash 977224825 cover-image-path OEBPS/dcommon/oracle-logo.jpg package-file-hash 734355079 publisher-unique-id E10744-02 unique-id 263775599 genre Oracle Documentation itemName Oracle® Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2) releaseDate 2009-11-18T21:01:10Z year 2009 PKlidPK&AMETA-INF/container.xml PKYuPK&AOEBPS/configur.htm Enterprise User Security Configuration Tasks and Troubleshooting

4 Enterprise User Security Configuration Tasks and Troubleshooting

This chapter describes configuring Enterprise User Security using a sequence of steps. They include the initial database and directory preparation through connecting to the database as an enterprise user, where authentication can use passwords, Kerberos tickets, or SSL. A troubleshooting section helps you when you test your Enterprise User Security implementation.

This chapter contains the following topics:

4.1 Enterprise User Security Configuration Overview

Configuring Enterprise User Security means creating shared schemas and global roles in databases that you want accessible to enterprise users. You configure the identity management realm in the directory to reflect those database roles and schemas, and then associate directory users with them. These steps apply regardless of the authentication method you choose: password, Kerberos, or SSL.

The primary configuration differences among the authentication types are in network connection configuration. You must consider the following three connection types:

Enterprise User Security supports many combinations of authentication types between databases, directories, and clients. The three most common implementations of Enterprise User Security, described in this chapter, use the following authentication methods for client-database and database-directory connections:

You decide which of these to choose based primarily on your network environment, because the security and integrity of your enterprise data depend on creating secure network connections. Typical network environments can have all clients, databases, and directories residing within the same network behind a firewall, or distributed across several networks and perhaps exposed to the Internet. Different environments can dictate what authentication types you choose, in order to secure your Enterprise User Security network connections.

A second consideration in making such choices is the fact that more rigorous authentication types, such as SSL and Kerberos, require greater configuration complexity, additional software, and ongoing maintenance.

Figure 4-1 shows the configuration process for Enterprise User Security. It is a step-by-step process with decision points based on your implementation and how your users are authenticated. The configuration steps represented with broken lines are optional.

Figure 4-1 Enterprise User Security Configuration Flow Chart

Description of Figure 4-1 follows
Description of "Figure 4-1 Enterprise User Security Configuration Flow Chart"

For brevity, some product names and features have been abbreviated in this flow chart. The following table lists the abbreviations used and the meaning of each:

AbbreviationMeaning
DBCADatabase Configuration Assistant
EMOracle Enterprise Manager Database Control or Grid Control
IM RealmIdentity Management Realm
NetmgrOracle Net Manager
ODMOracle Directory Manager
OIDOracle Internet Directory
OID DASOracle Internet Directory Delegated Administration Services
OWMOracle Wallet Manager
SQLSQL*Plus


See Also:

Chapter 1, "Introducing Enterprise User Security" for information about the realm Oracle Context, its administrative groups, and entries that pertain to Enterprise User Security

4.2 Enterprise User Security Configuration Roadmap

This section provides detailed descriptions of the configuration steps that Figure 4-1 illustrates. They should be performed in the following order:

  1. "Preparing the Directory for Enterprise User Security (Phase One)"

  2. "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)"

  3. "Configure Enterprise User Security for the Authentication Method You Require (Phase Three)", which completes your Enterprise User Security configuration by establishing your chosen authentication method as one of the following three:

4.3 Preparing the Directory for Enterprise User Security (Phase One)

This configuration phase must be performed before you can configure any other part of Enterprise User Security.

Enterprise User Security for 11g Release 2 (11.2) requires Release 9.0.4 (or later) version of Oracle Internet Directory, which installs with the required version of the Oracle schema. This schema is backward compatible. After you have installed Oracle Internet Directory, perform the following directory usage configuration tasks:

Task 1: (Optional) Create an identity management realm in the directory

If necessary, use Oracle Internet Directory Self-Service Console (Delegated Administration Service) to create an identity management realm in the directory. You can use Oracle Internet Directory Configuration Assistant to upgrade an Oracle9i Oracle Context to a 9.0.4 or higher version Identity Management Realm.

You must have version 9.0.4 (or later) identity management realm to use Oracle Database 10g or Oracle Database 11g. Version 9.0.4 realms are backward compatible to Oracle9i, so you can register Oracle9i and Oracle Database 11g Release 2 (11.2) in the same realm and place them in the same domain, if desired.


See Also:

Oracle Identity Management Guide to Delegated Administration for more information on creating identity management realms in Oracle Internet Directory

Task 2: (Optional) Set identity management realm properties

Table 4-1 shows the defaults for a version 9.0.4 identity management realm.

Table 4-1 Identity Realm Defaults

User Search BaseGroup Search BaseLogin Name Attribute (nickname)

cn=Users,realm_DN

cn=Groups,realm_DN

uid, the user id


If you want different settings, then use Oracle Internet Directory Self-Service Console to set the user search base, group search base, and login name attribute (nickname). You can also set up the necessary context administrators in the identity management realm you plan to use in the directory.

To perform this task, see "Setting Properties of an Identity Management Realm".


Note:

Each identity management realm includes an orcladmin user who is the root user of that realm only. These realm-specific orcladmin users are represented by the directory entries cn=orcladmin,cn=Users,<realm_DN>. Note that when you are logged in to Enterprise User Security administration tools as a realm-specific orcladmin user, then you can only manage directory objects for that realm. To manage objects in another realm, you must log in to administration tools as the orcladmin user for that realm.

Task 3: Identify administrative users in the directory

Identify administrative users in the directory who are authorized to perform the following tasks:

If administrative users do not already exist who can perform these tasks, then see Chapter 5, "Administering Enterprise User Security" to create them.


Note:

Although one administrator can perform all Enterprise User Security administrative tasks, you can create many different kinds of administrators so security tasks can be assigned to different people. Separating security tasks in this way results in a more secure enterprise environment, but this requires coordination among the different administrators.

Task 4: (Optional) Set the default database-to-directory authentication type for the identity management realm

By default, the database-to-directory authentication type for the identity management realm is set to passwords. If you want a different default setting, then use the Oracle Enterprise Manager Database Control or Grid Control interface to change it. For example, if you are using a public key infrastructure (PKI), then you would need to set the authentication type to SSL. See "Setting the Default Database-to-Directory Authentication Type for an Identity Management Realm".


Note:

  • This default realmwide setting can be overridden on a database by setting the LDAP_DIRECTORY_ACCESS initialization parameter. See Oracle Database Reference for more information about this parameter.

  • If you are using SSL, then see Oracle Internet Directory Administrator's Guide for information about setting up SSL with two-way authentication for Oracle Internet Directory.


Task 5: (Optional) Configure your Oracle home for directory usage

This step is optional because users of Domain Name System (DNS) discovery (automatic domain name lookup to locate the directory on a network) do not need to perform this step. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)

If you are not using DNS discovery, then you must use Oracle Net Configuration Assistant (NetCA) to create an ldap.ora file for your Oracle home. This configuration file specifies the directory host and port information, and the location of the identity management realm so the database can connect to the directory. (See "Starting Oracle Net Configuration Assistant")

To create an ldap.ora file for your Oracle home:

  1. In the Oracle Net Configuration Assistant welcome page, choose Directory Service Usage Configuration, and click Next.

  2. On the Directory Usage Configuration page, select an option appropriate for your environment. Then follow the prompts in the wizard and refer to the online Help to create an ldap.ora file for your Oracle home.


    Note:

    • SSL authentication between your database and directory requires that the SSL port entered in the ldap.ora file support two-way authentication, in which both client and server send certificates to each other. Thus, you must acquire a PKI digital certificate and wallet for Oracle Internet Directory, and bring up Oracle Internet Directory in the SSL mutual authentication mode. The second port in the ldap.ora file should have the SSL mutual authentication port. (See Oracle Internet Directory Administrator's Guide.)

    • If you are using password authentication for your database-to-directory connection, then the SSL port entered in the ldap.ora file must support SSL with no authentication. No wallet or certificate is required for Oracle Internet Directory. The second port in the ldap.ora file should have the SSL no authentication port.



See Also:

"Configuring Your Database to Use the Directory" for an example of using NetCA to configure directory usage

Task 6: Register the database in the directory

After you have configured your Oracle home for directory usage, use Database Configuration Assistant to register the database in the directory. Registration creates an entry in the directory so the database can bind (log in) to it.


Note:

To perform this task, you must be the directory superuser or a member of either the OracleDBCreators group or the OracleContextAdmins group.

When registering a database in the directory, Database Configuration Assistant performs the following configuration tasks:


Note:

The database's password-based credentials for authentication to Oracle Internet Directory are placed in the wallet when an Oracle database is registered in Oracle Internet Directory.

To register a database with the directory:

See "Starting Database Configuration Assistant" to start this tool.

  1. After starting Database Configuration Assistant, select Configure Database Options in a Database and click Next.

  2. Select a database and click Next.

  3. To register the database, click Yes, Register the Database.

  4. Enter the directory credentials for a user in the OracleDBCreators group.

  5. Enter a password for the database wallet.


    Note:

    Remember the database wallet password you entered in Step 5. It cannot be retrieved after you finish database registration. If you do not know the password, a multistep process is required to generate a new wallet and reregister the database. See "About the Database Wallet and Password" for further information.

  6. Click Finish if you are only registering the database. Click Next if you want to configure additional database features.


    See Also:

    "Registering Your Database with the Directory" for an example of using DBCA to register the database

To change the database's directory password:

After starting Database Configuration Assistant, select Configure Database Options in a Database, and click Next.

  1. Select a database and click Next.

  2. Select Regenerate database password.

  3. Enter the directory credentials for a user in the OracleDBCreators group and a password for the database wallet. Click OK.

  4. Click Finish if you are only regenerating the password. Click Next if you want to configure additional database features.

To unregister a database from the directory:

See "Starting Database Configuration Assistant" to start this tool.

  1. After starting Database Configuration Assistant, select Configure Database Options in a Database and click Next.

  2. Select a database and click Next.

  3. To unregister the database, select the Unregister option.

  4. Enter the directory credentials for a user with the appropriate permissions.

  5. Enter a password for the database wallet.

When you unregister a database from the directory, Database Configuration Assistant performs the following configuration tasks:


Note:

To succeed at unregistering an Oracle Database from Oracle Internet Directory by using Database Configuration Assistant, you must be one of the following:

  • A member of the Oracle Context Admin group

  • A member of both the Database Admin group (for the database you are unregistering) and the Database Security Admin group

  • A member of both the Database Admin group (for the database you are unregistering) and the Domain Admin group (for the enterprise domain that contains the database).


4.3.1 About the Database Wallet and Password

The database requires the wallet even if no SSL (Secure Sockets Layer) is used to secure the connection between the database and the directory. If SSL is used, then this wallet should be used to store the database's digital PKI certificate.

The wallet password you enter when using Database Configuration Assistant to register a database in the directory is the password to the wallet itself. This password is not the database's directory login credentials.

You can change this wallet password later, using Oracle Wallet Manager. However, if you forget this wallet password, then you must generate an entirely new wallet and password. To do so, you must first delete the existing database wallet, create a new wallet (which can be empty) and put it at the default wallet location, $ORACLE_HOME/admin/Oracle_SID/wallet (in UNIX environment). Next, unregister the database from the directory, and reregister the database in the directory. During that registration, another database wallet and password can be generated.


See Also:

"Using Oracle Wallet Manager" in the Oracle Database Advanced Security Administrator's Guide for information about using Oracle Wallet Manager to change wallet passwords and, in general, to manage public key infrastructure (PKI) credentials

After you have prepared the directory for Enterprise User Security, then you can create the Enterprise User Security database and directory objects as described in "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)".


See Also:


4.3.1.1 Sharing Wallets and sqlnet.ora Files Among Multiple Databases

Multiple databases (that are not replicas) cannot share wallets, because wallets contain a database's identity. Therefore, if a sqlnet.ora file contains a wallet location, then multiple databases cannot share that sqlnet.ora file.

In order to share a single sqlnet.ora file among multiple databases, the following preconditions are required:

  • User authentication should use passwords or Kerberos.

  • The wallet containing the password should reside at the default wallet location, which is where Database Configuration Assistant creates it.

If the preceding conditions are met, then multiple databases can share the sqlnet.ora file because no wallet location information is stored in that file.

However, when SSL authentication is used between the user (client) and the database, the wallet location must be specified in the database server's sqlnet.ora file. Such a sqlnet.ora file cannot be shared by multiple databases for SSL-authenticated enterprise users.

4.4 Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)

This is the second phase of configuration steps required to implement Enterprise User Security. The configuration steps in this section assume the following recommended setup:

Note that databases must be in an enterprise domain that is in an identity management realm in order for enterprise user logins to work.


See Also:

If you do not use the OracleDefaultDomain or store your users in an identity management realm Users subtree, then see the following documentation:

  • Oracle Internet Directory Administrator's Guide for information about creating a new identity management realm or modifying an existing one, and for information about setting access control lists on directory objects

  • "Creating an Enterprise Domain" to create another domain in which to put your database. Then substitute your new domain name for OracleDefaultDomain in the following configuration steps


To configure Enterprise User Security objects in the database and directory perform the following tasks:

Task 1: Create Global Schemas and Global Roles in the Database

Although this step can also be completed by using Oracle Enterprise Manager, the following examples use SQL*Plus directly:

  1. Create a shared schema for enterprise users. The following syntax example creates a shared schema named guest:

    SQL> CREATE USER guest IDENTIFIED GLOBALLY AS '';

    If you do not want to use a shared schema, then specify a user DN between the single quotation marks to create an exclusive schema.

  2. Grant the CREATE SESSION privilege to the shared schema created in Step 1 so users can connect to it. The following syntax example grants the CREATE SESSION privilege to the guest shared schema:

    SQL> GRANT CREATE SESSION TO guest;

    Alternatively, you can grant the CREATE SESSION privilege to a global role, which you grant to specific users through an enterprise role. See Step 3.

  3. Create global roles for the database to hold relevant privileges. The following syntax examples create the emprole and custrole global roles:

    SQL> CREATE ROLE emprole IDENTIFIED GLOBALLY;
SQL> CREATE ROLE custrole IDENTIFIED GLOBALLY;

    Global roles are associated with enterprise roles, which are created later, and then are allocated to enterprise users.

  4. Grant privileges to the new global roles that were created in Step 3. The following syntax example grants the SELECT privilege to emprole and custrole global roles on the products table:

    SQL> GRANT select ON products TO custrole, emprole;

    See Also:

    Oracle Database SQL Language Reference for information about the syntax used for these steps

Task 2: Configure User-Schema Mappings for the Enterprise Domain

Use Enterprise Manager to configure user-schema mappings for the OracleDefaultDomain by using the following steps:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select OracleDefaultDomain. Click Configure.

    The Configure Domain page appears.

  6. Click the User-Schema Mappings tab. All user-schema maps created at the domain level are displayed. User-schema maps created at database levels are not displayed here.

  7. Click Create to create a new user-schema mapping for the domain.

    The Create Mapping page is displayed.

  8. Under the From section, select Users to map an individual enterprise user to a database schema. Alternatively, select Subtree to map a directory subtree containing multiple users. You can use the Search icon to search for the appropriate user or subtree.

  9. Under the To section, enter the name of the Schema to which the user or subtree should be mapped. This is the schema that you created in Task 1.

  10. Click Continue in the Create Mapping page.

  11. Click OK in the Configure Domain page.


Note:

You can also create user-schema mappings for an individual database in an enterprise domain. Such mappings apply only to that particular database and not to other databases in the domain.


See Also:

"Mapping Enterprise Users to the Shared Schema" for an example on creating user-schema mappings

Task 3: Create Enterprise Roles in the Enterprise Domain

Use Enterprise Manager to create enterprise roles in the OracleDefaultDomain by using the following steps:

  1. Select OracleDefaultDomain in the Manage Enterprise Domains page. Click Configure.

    The Configure Domain page appears.

  2. Click the Enterprise Roles tab.

  3. Click Create to create a new enterprise role.

    The Create Enterprise Role page appears.

  4. Enter a name for the enterprise role in the Name field. Click Continue.

    The new role is displayed in the Configure Domain page.


See Also:

"Using Enterprise Roles" for an example on creating and using enterprise roles

Task 4: Add Global Database Roles to Enterprise Roles

Use Enterprise Manager to add the global database roles that you created in Task 1 to the enterprise roles that you created in Task 3 by using the following steps:

  1. Select the enterprise role that you just created in the Configure Domain page. Click Edit.

    The Edit Enterprise Role page is displayed.

  2. Make sure that the DB Global Roles tab is selected. Click Add to add global roles from databases that are part of the enterprise domain.

    The Search and Select Database Global Roles page appears.

  3. Select the Database that contains the global roles you wish to add. Log in to the selected database by supplying a User Name and Password. Click Go.

  4. Select the global roles to add. Click Select.

    The selected roles appear in the Edit Enterprise Role page.


See Also:

"Using Enterprise Roles" for an example on creating and using enterprise roles

Task 5: Grant Enterprise Roles to Enterprise Users for Database Access

Use Enterprise Manager to grant enterprise roles that you created in Task 3 to the enterprise users by using the following steps:

  1. Click the Grantees tab in the Edit Enterprise Role page.

  2. Click Add.

    The Select Users or Groups page is displayed.

  3. Select the Search Base or the subtree that contains the user or group. Select User under View if you are granting the enterprise role to a user. Select Group under View, if you are granting the role to a group. Optionally, enter the common name of the user or group in the Name field. Click Go.

  4. Select the users or groups to be granted the enterprise role. Click Select.

  5. Click Continue in the Edit Enterprise Role page.

  6. Click OK in the Configure Domain page.


See Also:

"Using Enterprise Roles" for an example on creating and using enterprise roles

4.5 Configure Enterprise User Security for the Authentication Method You Require (Phase Three)

In the third phase, you complete the Enterprise User Security configuration based on the authentication method you have chosen. Go to one of the following sections:

4.5.1 Configuring Enterprise User Security for Password Authentication

By default, new enterprise domains are configured to accept all supported user authentication types (password, Kerberos, and SSL). If you want enterprise users to be authenticated by passwords, then you must configure that as described in the following tasks.

The configuration steps in this section assume the following:

To configure Enterprise User Security for password authentication, perform the following tasks:

Task 1: (Optional) Enable the Enterprise Domain to Accept Password Authentication

By default, OracleDefaultDomain is configured to accept password authentication. If this has been changed, then use Oracle Enterprise Manager Database Control or Grid Control to enable password authentication for OracleDefaultDomain using the following steps:

  1. Log in to Enterprise Manager.

  2. Click the Server tab for the database. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select OracleDefaultDomain. Click Configure.

    The Configure Domain page appears.

  6. Click the Configuration tab.

  7. Under User Authentication Types Accepted, select Password.

  8. Click OK.

Task 2: Connect as a Password-Authenticated Enterprise User

For an enterprise user whose directory login name is hscortea and whose password is Easy2rem, enter the following to connect to the database by using SQL*Plus:

SQL> connect hscortea@<Oracle Net Service Name>
Enter password:
/* Enter Easy2rem when prompted for the password*/

The database authenticates the enterprise user (hscortea) by verifying the username-password combination against the directory entry associated with this user. Then, it identifies the proper schema and retrieves the user's global roles. If successful, then the connection to the database is established.

If your connection succeeds, then the system responds Connected to:.... This is the confirmation message of a successful connect and setup. If an error message is displayed, then see "ORA-# Errors for Password-Authenticated Enterprise Users".

If you do connect successfully, then check that the appropriate global roles were retrieved from the directory, by entering the following at the SQL*Plus prompt:

select * from session_roles

If the global roles were not retrieved from the directory, then see "NO-GLOBAL-ROLES Checklist".

You have completed password-authenticated Enterprise User Security configuration.


See Also:


4.5.2 Configuring Enterprise User Security for Kerberos Authentication

The configuration steps in this section assume the following:

To configure Enterprise User Security for Kerberos authentication, perform the following tasks:

Task 1: Configure Oracle Internet Directory Self-Service Console to display the Kerberos principal name attribute

By default, the Oracle Internet Directory Self-Service Console user interface does not display the field where you can configure Kerberos principal names. The first time you create Kerberos-authenticated users in the directory, you must configure this tool to display the krbPrincipalName attribute in its Create User page by using the following steps:

  1. Log in to the Oracle Internet Directory Self-Service Console.

    Enter the URL to access the Oracle Internet Directory Self-Service Console in a browser window. For example:

    http://myhost1:7777/oiddas

    Log in as the orcladmin user.

  2. Click the Configuration tab. Click the User Entry subtab.

  3. Click Next until the Configure User Attributes page appears.

  4. In the Configure User Attributes page, click Add New Attribute.

    The Add New Attribute page appears.

  5. In the Add New Attribute page, select krbPrincipalName from the Directory Attribute Name box (or the attribute that you have configured for orclCommonKrbPrincipalAttribute in your identity management realm) and perform the following steps on this page:

    1. Enter a value, say Kerberos Principal Name, for the UI Label.

    2. Select Searchable and Viewable.

    3. Select Single Line Text from the UI Type.

    4. ClickDone.

  6. Click Next to navigate to the Configure Attribute Categories page. Select Basic Information and click Edit.

    The Edit Category page appears.

  7. Perform the following steps on the Edit Category page:

    1. Select krbPrincipalName in the left category list.

    2. Click Move, to move krbPrincipalName to the right-hand list.

    3. Click Done.

  8. Click Next until you reach the last step. Click Finish to save your work.

Task 2: (Optional) Configure the Kerberos Principal Name Directory Attribute for the Identity Management Realm

Use Oracle Internet Directory Self-Service Console to enter the directory attribute used to store the Kerberos principal name for the identity management realm you are using in the directory. By default, Kerberos principal names are stored in the krbPrincipalName attribute but can be changed to correspond to your directory configuration by changing orclCommonKrbPrincipalAttribute in the identity management realm. For more information about this task, see "Setting Login Name, Kerberos Principal Name, User Search Base, and Group Search Base Identity Management Realm Attributes".


Note:

By default, the Oracle Internet Directory Self-Service Console user interface does not display the field where you can configure Kerberos principal names. The first time you create Kerberos-authenticated users in the directory, you must configure the console to display the krbPrincipalName attribute in its Create User window.

Task 3: Specify the Enterprise User's Kerberos Principal Name in the krbPrincipalName Attribute

Use Oracle Internet Directory Self-Service Console to specify the enterprise user's Kerberos principal name (Kerberos_username@Kerberos_realm) in the krbPrincipalName attribute of the enterprise user's directory entry. For more information about this task, see "Creating New Enterprise Users".

Task 4: (Optional) Enable the Enterprise Domain to Accept Kerberos Authentication

By default, OracleDefaultDomain is configured to accept all types of authentication. If this has been changed or if you are using another domain, then use Oracle Enterprise Manager Database Control or Grid Control to enable Kerberos authentication for your enterprise domain by performing the following steps:

  1. Log in to Enterprise Manager.

  2. Click the Server tab for the database. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select OracleDefaultDomain. Click Configure.

    The Configure Domain page appears.

    6. 

  6. Click the Configuration tab.

  7. Under User Authentication Types Accepted, select Kerberos.

  8. Click OK.

Task 5: Connect as a Kerberos-Authenticated Enterprise User

If the KDC is not part of the operating system, such as Kerberos V5 from MIT, then the user must get an initial ticket with the FORWARDABLE flag set by using the okinit utility. See "Obtaining the Initial Ticket with the okinit Utility" in the Oracle Database Advanced Security Administrator's Guide.

If the KDC is part of the operating system, such as Windows 2000 or some versions of Linux or UNIX, then the operating system automatically picks up the user's ticket (with the FORWARDABLE flag set) from the cache when the user logs in.

The user connects to the database by launching SQL*Plus and entering the following at the command line:

SQL> connect /@<net_service_name>

The database uses Kerberos to authenticate the user. The database authenticates itself to the directory by password.

If your connection succeeds, then the system responds with Connected to:.... This is the confirmation message of a successful connect and setup. If an error message is displayed, then see "ORA-# Errors for Kerberos-Authenticated Enterprise Users".

If you do connect successfully, then check that the appropriate global roles were retrieved from the directory, by entering the following at the SQL*Plus prompt:

select * from session_roles

If the global roles were not retrieved from the directory, then see "NO-GLOBAL-ROLES Checklist".

You have completed Kerberos-authenticated Enterprise User Security configuration.


See Also:


4.5.3 Configuring Enterprise User Security for SSL Authentication

The configuration steps in this section assume the following:

  • You have obtained the appropriate PKI credentials and used Oracle Wallet Manager to create wallets for the directories, databases, and clients that you want to include in your Enterprise User Security implementation.

  • You have confirmed that each enterprise user entry in Oracle Internet Directory is provisioned with a unique PKI credential. However, in this release an enterprise user can have different DNs in his or her PKI certificate and Oracle Internet Directory entry. Also in this release, the database entry can have different DNs in its PKI certificate and Oracle Internet Directory entry.

    You must provision user certificates in their respective Oracle Internet Directory user entries in order to support using different DNs in the certificate and the directory. A user certificate is provisioned in to the usercertificate attribute of the user entry. If you prefer not to provision the certificates, then you must make sure that the subject DNs in the certificates match the user DNs in the directory.

    Oracle Internet Directory 10g Release2 (10.1.2) includes certificate matching rules to support the new functionality of being able to use different DNs in the certificate and the directory. The orclpkimatchingrule attribute in Oracle Internet Directory determines the type of match that is used.

    The default value of orclpkimatchingrule is 2. This enables you to support both provisioned and non-provisioned user entries. The database finds out a user's Oracle Internet Directory DN based on a search for the user's certificate provisioned in the directory. If the certificate search fails, then the database reverts to using an exact match between the user's certificate DN and his or her Oracle Internet Directory DN.

    If all users have certificates provisioned in Oracle Internet Directory, then you can set the orclpkimatchingrule to 1. This instructs Oracle Internet Directory to always conduct a certificate search. For instance, if your certificate authority does not support two common names in certificate DNs but the directory DNs are using two common names, then you would need to provision all user certificates into the directory. You can then set the orclpkimatchingrule to 1.

    If you do not want to support the functionality of using different DNs in the PKI certificate and Oracle Internet Directory, then you can set the orclpkimatchingrule value to 0. You use this setting if all certificate DNs match directory DNs and you do not wish to provision the certificates.

    You can also create your own mapping rules to map certificate DNs to directory DNs in Oracle Internet Directory 10g Release 2 (10.1.2.0.2). To use mapping rules, orclpkimatchingrule is set to 3 or 4.

    When you want to use the mapping rule for all users, set orclpkimatchingrule to 3. If you also need to support certificate-based search and exact match, then set orclpkimatchingrule to 4.

    Table 4-2 describes the values of the orclpkimatchingrule attribute.

    Table 4-2 Oracle Internet Directory Matching Rules

    ValueRule

    orclpkimatchingrule=0

    Exact match. The bind is based on the subject DN of the client certificate. This DN is compared with the DN of the user in the directory.

    orclpkimatchingrule=1

    Certificate hash. The bind is based on the hashed value of the certificate.

    orclpkimatchingrule=2

    (default)

    Certificate hash/exact match. The bind is based on the hashed value of the certificate. If this operation fails, then a bind based on the subject DN of the client certificate is performed.

    orclpkimatchingrule=3

    Mapping rule only.

    orclpkimatchingrule=4

    Mapping rule/certificate hash/exact match. The bind is based on the mapping rule. If this operation fails, a bind based on the hashed value of the certificate is performed. If this operation fails, then a bind based on an exact match of the certificate is performed.



    See Also:

    Oracle Internet Directory Administrator's Guide and Oracle Identity Management User Reference Guide for information on how to modify the orclpkimatchingrule attribute


    Note:

    A certificate search will fail if there is no user entry under the realm's user search base with that certificate, or if you are using an older version of Oracle Internet Directory that does not support the certificate search functionality. If the certificate search fails, then the database will revert to the old behavior of matching the user DN with the certificate DN for a successful connection.

  • You have enabled SSL for your client-database Oracle Net connections as described in "Enabling SSL" in the Oracle Database Advanced Security Administrator's Guide. Ensure that you included the following steps when you enabled SSL:

    • Enabled SSL for your database listener on TCPS and provided a corresponding TNS name

    • Stored your database PKI credentials in the database wallet that Database Configuration Assistant automatically created during database registration

  • You have configured an SSL instance with two-way authentication for Oracle Internet Directory as described in Oracle Internet Directory Administrator's Guide.

  • You have prepared your directory by completing the tasks described in "Preparing the Directory for Enterprise User Security (Phase One)".

  • You have configured your Enterprise User Security objects in the database and the directory by completing the tasks described in "Configuring Enterprise User Security Objects in the Database and the Directory (Phase Two)".

To configure Enterprise User Security for SSL authentication, perform the following tasks:

Task 1: Enable the Enterprise Domain to Accept SSL Authentication

By default, OracleDefaultDomain is configured to accept all types of authentication. If this has been changed or if you are using another domain, then use Oracle Enterprise Manager Database Control or Grid Control to enable SSL authentication for your enterprise domain by performing the following steps:

  1. Log in to Enterprise Manager.

  2. Click the Server tab for the database. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select OracleDefaultDomain. Click Configure.

    The Configure Domain page appears.

  6. Click the Configuration tab.

  7. Under User Authentication Types Accepted, select SSL.

  8. Click OK.

Task 2: Set the LDAP_DIRECTORY_ACCESS Initialization Parameter to SSL

You can change this initialization parameter either by editing your database initialization parameter file or by issuing an ALTER SYSTEM SQL command with the SET clause.

For example, the following ALTER SYSTEM command changes the LDAP_DIRECTORY_ACCESS parameter value to SSL in the server parameter file:

ALTER SYSTEM SET LDAP_DIRECTORY_ACCESS=SSL SCOPE=SPFILE

See Also:


Task 3: Connect as an SSL-Authenticated Enterprise User

Connecting as an SSL-authenticated enterprise user involves ensuring that you have the appropriate Oracle wallet features configured and that you do not have a wallet location specified in the client sqlnet.ora file. If the client sqlnet.ora file contains a wallet location, then multiple users and databases cannot share that file. Only the server sqlnet.ora file must have a value for the wallet location parameter.


See Also:

Oracle Database Advanced Security Administrator's Guide for the default location of a user's wallet when the authentication used between the user and the database is SSL

To connect as an SSL-authentication enterprise user, perform the following steps:

  1. Use Oracle Wallet Manager to download a user wallet from the directory. See "Downloading a Wallet from an LDAP Directory" in the Oracle Database Advanced Security Administrator's Guide.

  2. Use Oracle Wallet Manager to enable autologin for the user wallet. Enabling autologin generates a single sign-on (.sso) file and enables authentication to the SSL adapter. See Oracle Database Advanced Security Administrator's Guide for information about using the autologin feature of Oracle Wallet Manager.

  3. Set the TNS_ADMIN environment variable (to point to the client's sqlnet.ora file) for the client if the client Oracle home points to a server Oracle home. (Because a server must have a wallet location set in its sqlnet.ora file and a client cannot have a wallet location specified there, the server and client cannot share sqlnet.ora files.)

    If you have a separate client Oracle home, then you do not need to set the TNS_ADMIN environment variable.

  4. Launch SQL*Plus and enter the following at the command line:

    SQL> /@connect_identifier

    where connect_identifer is the Oracle Net service name you set up when you configured SSL for the database client.

    If your connection succeeds, then the system responds with Connected to:.... This is the confirmation message of a successful connect and setup. If an error message is displayed, then see "ORA-# Errors for SSL-Authenticated Enterprise Users".

    If you do connect successfully, then check that the appropriate global roles were retrieved from the directory, by entering the following at the SQL*Plus prompt:

    select * from session_roles

    If the global roles were not retrieved from the directory, then see "NO-GLOBAL-ROLES Checklist".

You have completed SSL-authenticated Enterprise User Security configuration.


Note:

For security purposes, ensure that you disable auto login for the user wallet after logging out from the enterprise user session with the database. This is especially important if the client computer is shared by more than one user. See Oracle Database Advanced Security Administrator's Guide for information about using Oracle Wallet Manager to disable auto login for an Oracle wallet.

4.5.3.1 Viewing the Database DN in the Wallet and in the Directory

When you use Database Configuration Assistant to register your database in the directory, this tool automatically creates identical DNs for the database wallet and the database directory entry. To view the database DN, use one of the following options:

Use Oracle Directory Manager to look in the directory under the realm Oracle Context for

cn=<short_database_name>,cn=OracleContext,<realm_DN>

where short_database_name is the first part of the fully qualified domain name for a database. For example, if you have a database named db1.us.example.com, then the short database name is db1.

  • Use the following mkstore utility syntax on the command line:

    mkstore -wrl <wallet_location> -viewEntry ORACLE.SECURITY.DN

    where wallet_location is the path to the database wallet.


    See Also:


4.6 Enabling Current User Database Links

Current user database links require SSL-enabled network connections between the databases. Before you can enable current user database links, you must enable SSL, create Oracle wallets, and obtain PKI credentials for all databases involved.

Then, use Oracle Enterprise Manager Database Control or Grid Control to enable current user database links between databases within the enterprise domain in the directory by using the following steps:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the Configuration tab.

  7. Select Enable Current User Database Links in this domain.

  8. Click OK.

4.7 Troubleshooting Enterprise User Security

This section describes potential problems and associated corrective actions in the following topics:

4.7.1 ORA-# Errors for Password-Authenticated Enterprise Users

If you receive an ORA-# error while using password-authenticated Enterprise User Security, then locate the error in the following section and take the recommended action.

ORA-1017: Invalid username/password; login denied
Cause: As in error message
Action: See "USER-SCHEMA ERROR Checklist"
ORA-28030: Server encountered problems accessing LDAP directory service
Cause: Indicates a problem with the connection between the database and the directory.
Action: Check the following:

  1. Check that the correct wallet_location value is specified in the database's sqlnet.ora file in case you are not using the default wallet location. You can use Oracle Net Manager to enter the wallet location. You do not need to specify a wallet location in the sqlnet.ora file if the default wallet location is being used. If a wallet location is specified in the sqlnet.ora file, then you must ensure that it is correct.

  2. If Domain Name System (DNS) server discovery of Oracle Internet Directory is not used, check that there is a correct ldap.ora file in $LDAP_ADMIN, $ORACLE_HOME/ldap/admin, $TNS_ADMIN, or $ORACLE_HOME/network/admin. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)

  3. Check that the SSL port used (by way of either DNS discovery or an ldap.ora file) supports SSL with no authentication.

  4. Check that the LDAP_DIRECTORY_ACCESS parameter is set to PASSWORD in the database initialization parameters file.

  5. Use Database Configuration Assistant to reset the database password used to authenticate the database to Oracle Internet Directory. This resets it both locally in the database wallet, and remotely in the database entry in Oracle Internet Directory.

  6. Check that the database wallet has autologin enabled. Either use Oracle Wallet Manager or check that there is a cwallet.sso file in $ORACLE_HOME/admin/<ORACLE_SID>/wallet/.

  7. Use the password stored in the database wallet to check that the database can bind to Oracle Internet Directory:

    • Use the mkstore command-line utility to retrieve the database password from the wallet by using the following syntax:

      mkstore -wrl <database wallet location> -viewEntry ORACLE.SECURITY.PASSWORD

    • Use the password returned from mkstore in the following ldapbind:

      ldapbind -h <directory host> -p <non-SSL directory port> -D "<database DN>" -q
Please enter bind password: Password returned by mkstore

  8. Check to ensure that the database belongs to only one enterprise domain.


    Note:

    The mkstore utility is for troubleshooting purposes only. The name and functionality of this tool may change in the future.

ORA-28043: Invalid bind credentials for DB/OID connection
Cause: The database directory password no longer synchronizes with the directory.
Action: Use the Regenerate Password button in Database Configuration Assistant to generate a new directory password for the database, synchronize it with the directory, and store it in the database wallet.
ORA-28271: No permission to read user entry in LDAP directory service
Cause: As in error message
Action: Check the following:

  1. Use Oracle Internet Directory Self-Service Console to check that a user search base containing this user is listed in the user search base attribute of the realm that you are using.

  2. Check the ACL on the User Search Base in Oracle Internet Directory to ensure that the verifierServices group has read permission on the user entry, and that this permission is not prevented by an ACL between the User Search Base entry and the user entry in the directory tree.

  3. Check that the enterprise domain is in the password-accessible domains group for that realm Oracle Context.

ORA-28272: Domain policy restricts password-based GLOBAL user authentication.
Cause: As in error message
Action: Use the Oracle Enterprise Manager interface to set the user authentication policy for this enterprise domain to Password or ALL.
ORA-28273: No mapping for user nickname to LDAP distinguished name exists
Cause: As in error message
Action: Check the following:

  1. Check that a user entry exists in Oracle Internet Directory for your user.

  2. Use Oracle Internet Directory Self-Service Console to check that a user search base containing this user is listed in the identity management realm that you are using.

  3. Check that the user entry contains the correct login name:

    • Use Oracle Internet Directory Self-Service Console to find the login name attribute that is configured for the directory in youDor realm, and

    • Check that the name provided during the attempted user database login is the value for that attribute in the user directory entry.

  4. If you have an exclusive schema for the global user in the database, then check that the DN in the database matches the DN of the user entry in Oracle Internet Directory.

ORA-28274: No ORACLE password attribute corresponding to user nickname exists
Cause: As in error message
Action: Check the following:

  1. Check that the user entry in the directory has the orcluser object class. If it does not, then perform the following steps:

    • Use Oracle Internet Directory Self-Service Console to check that the default object classes for new user creation include orcluser, and then

    • Use Oracle Internet Directory Self-Service Console to re-create the user, or

    • Add the orcluser and the orcluserV2 object classes.

  2. Check that there is a value for the attribute orclpassword in the user entry. If there is no value, then reset the user's directory password (userpassword attribute). This should prompt Oracle Internet Directory to regenerate the database password verifier for the user.

  3. Use Oracle Internet Directory Self-Service Console to check that the user search base containing this user is listed in the user search base attribute of the realm that you are using.

  4. Check that the ACL on the user search base attribute allows read and search access to the orclpassword attributes by the verifierServices group. This is set properly by default, but may have been altered.

ORA-28275: Multiple mappings for user nickname to LDAP distinguished name exist
Cause: There are multiple user DNs in the directory within the user search base whose login name for the user matches what was provided during the database connection.
Action: Use Oracle Internet Directory Self-Service Console to make the login name value unique (no two users share the same login name) within all user search bases associated with the realm Oracle Context.
ORA-28277: LDAP search, while authenticating global user with passwords, failed
Cause: As in error message
Action: Check that the relevant directory instance is up and running.
ORA-28278: No domain policy registered for password-based GLOBAL users
Cause: The database cannot read the enterprise domain information that it needs.
Action: See "DOMAIN-READ-ERROR Checklist"
ORA-28862: SSL connection failed
Cause: As in error message
Action: Check that you are using a non-SSL connect string.

4.7.2 ORA-# Errors for Kerberos-Authenticated Enterprise Users

If you receive an ORA-# error while using Kerberos-authenticated Enterprise User Security, then locate the error in the following section and take the recommended action.

ORA-1017: Invalid username/password; login denied
Cause: As in error message
Action: See "USER-SCHEMA ERROR Checklist"
ORA-28030: Problem accessing LDAP directory service
Cause: Indicates a problem with the connection between the database and the directory.
Action: See the actions listed for resolving "ORA-28030: Server encountered problems accessing LDAP directory service" in the troubleshooting section for password-authenticated enterprise users.
ORA-28271: No permission to read user entry in LDAP directory service
Cause: As in error message
Action: See the actions listed for resolving "ORA-28271: No permission to read user entry in LDAP directory service" in the troubleshooting section for password-authenticated enterprise users.
ORA-28292: No domain policy registered for Kerberos-based authentication
Cause: As in error message
Action: Perform the following actions:

  1. Use Oracle Enterprise Manager Database Control or Grid Control to set the user authentication policy for this enterprise domain to KERBEROS or ALL.

  2. See "DOMAIN-READ-ERROR Checklist"

ORA-28290: Multiple entries found for the same Kerberos principal name
Cause: The Kerberos principal name for this user is not unique within the user search base containing this user.
Action: Use Oracle Internet Directory Self-Service Console to change the Kerberos principal name, or to change the other copies so that it is unique.
ORA-28291: No Kerberos principal value found
Cause: As in error message
Action: Check the following:

  1. Check that the user entry in the directory has the krbprincipalname attribute.

    If it does not have the krbprincipalname attribute, then check the following:

    • Check that the default attributes for new user creation by using Oracle Internet Directory Self-Service Console include krbprincipalname, and then

    • Use Oracle Internet Directory Self-Service Console to create the user again, or

    • Add the orclcommonattributes object class.

  2. Check that there is a value for the attribute krbprincipalname in the user entry. If there is no value, then use Oracle Internet Directory Self-Service Console to enter one.

  3. Use Oracle Internet Directory Self-Service Console to check that the user search base containing this user is listed in the realm Oracle Context that you are using.

  4. Check that the ACL on the user search base attribute allows read and search access to the krbprincipalname attributes by the verifierServices group. This is set properly by default, but may have been altered.

ORA-28293: No matched Kerberos principal found in any user entry.
Cause: As in error message
Action: Check the following:

  1. Check that a user entry exists in Oracle Internet Directory for your user.

  2. Use Oracle Internet Directory Self-Service Console or ldapsearch to check that a user search base containing this user is listed in the identity management realm that you are using.

  3. Check that the user entry in the directory contains the correct Kerberos principal name, by using the following steps:

    • Use Oracle Internet Directory Self-Service Console to find the Kerberos principal name attribute that is configured for the directory in your realm, and

    • Check that the correct Kerberos principal name appears in that attribute in the user's directory entry.

  4. If you have an exclusive schema for the global user in the database, check that the DN in the database matches the DN of the user entry in Oracle Internet Directory.

ORA-28300: No permission to read user entry in LDAP directory service
Cause: As in error message
Action: Check that the database wallet contains the correct credentials for the database-to-directory connection. The wallet DN should be the DN of the database in Oracle Internet Directory. To retrieve the credentials, perform the following steps:

  1. Use the mkstore command-line utility to retrieve the database password for the wallet by using the following syntax:

    mkstore -wrl <database wallet location> -viewEntry ORACLE.SECURITY.PASSWORD -viewEntry ORACLE.SECURITY.DN

  2. If these values are incorrect, reset the database wallet by using Database Configuration Assistant.

  3. Use the DN and the password returned by mkstore in the following ldapbind:

    ldapbind -h <directory host> -p <non-SSL directory port> -D "<database DN>" -q
Please enter bind password: Password returned by mkstore

    Note:

    The mkstore utility is for troubleshooting purposes only. The name and functionality of this tool may change in the future.

ORA-28302: User does not exist in the LDAP directory service
Cause: As in error message
Action: Check that the user entry is present in the directory.

4.7.3 ORA-# Errors for SSL-Authenticated Enterprise Users

If you receive an ORA-# error while using SSL-authenticated Enterprise User Security, then locate the error in the following section and perform the recommended action.

ORA-1017: Invalid username/password; login denied
Cause: As in error message
Action: See "USER-SCHEMA ERROR Checklist"
ORA-28030: Problem accessing LDAP directory service
Cause: Indicates a problem with the connection between the database and the directory.
Action: Check the following:

  1. Check that there is a correct wallet_location value in the database's sqlnet.ora file. If not, then use Oracle Net Manager to enter one.

  2. If Domain Name System (DNS) server discovery of Oracle Internet Directory is not used, then check that there is a correct ldap.ora file in $LDAP_ADMIN, $ORACLE_HOME/ldap/admin, $TNS_ADMIN or $ORACLE_HOME/network/admin. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)

  3. Check that the Oracle Internet Directory SSL port used (by way of DNS discovery or an ldap.ora file) supports SSL with two-way authentication.

  4. Check that the LDAP_DIRECTORY_ACCESS parameter is set to SSL in the database initialization parameters file.

  5. Check that the database wallet has autologin enabled. Either use Oracle Wallet Manager or check that there is a cwallet.sso file in $ORACLE_HOME/admin/<ORACLE_SID>/wallet/.

  6. Use the mkstore command-line utility to check that the database wallet has the database DN in it by using the following syntax:

    mkstore -wrl <database_wallet_location> -viewEntry ORACLE.SECURITY.DN

    If the wallet does not contain the database DN, then use Database Configuration Assistant to reregister the database with Oracle Internet Directory.

  7. Check that the database can bind to Oracle Internet Directory, by using its wallet with the following ldapbind:

    ldapbind -h <directory_host> -p <directory_SSLport> -U 3 -W "file:<database wallet_location>" -Q
Please enter SSL wallet password: wallet_password

  8. Check to ensure that the database belongs to only one enterprise domain.


    Note:

    The mkstore utility is for troubleshooting purposes only. The name and functionality of this tool may change in the future.

ORA-28301: Domain policy has not been registered for SSL authentication
Cause: As in error message
Action: Use Oracle Enterprise Manager Database Control or Grid Control to set the user authentication policy for this enterprise domain to include SSL.
ORA-28862: SSL handshake failed
Cause: As in error message
Action: See the SSL (Secure Sockets Layer) chapter in Oracle Database Advanced Security Administrator's Guide for information about configuring your SSL connection.

4.7.4 NO-GLOBAL-ROLES Checklist

If the enterprise user can connect to the database but a select * from session_roles returns no global roles, then check the following:

  1. Check that the global role has been created in the database. To create global roles, use the following syntax:

    CREATE ROLE <role_name> IDENTIFIED GLOBALLY;

  2. Use Oracle Enterprise Manager to check that the global role is included in an enterprise role in the directory.

  3. Use Oracle Enterprise Manager to check that the enterprise role is assigned to the user in the directory.

  4. If these checks are fine, then see the "DOMAIN-READ-ERROR Checklist".

4.7.5 USER-SCHEMA ERROR Checklist

If your database cannot read the user schema, then check the following:

  1. If this is an SSL-authenticated enterprise user, then ensure that the correct user wallet is being used by checking the following:

    • There is no WALLET_LOCATION parameter value in the client sqlnet.ora file, and

    • The TNS_ADMIN parameter is set properly so that the correct sqlnet.ora file is being used.

  2. Check that the schema was created in the database as a global user, by using the following syntax:

    CREATE USER username IDENTIFIED GLOBALLY AS ' ';

    or by using the following syntax:

    CREATE USER username IDENTIFIED GLOBALLY AS '<DN>';

  3. Suppose the following is true:

    • The user schema is an exclusive schema (created with the CREATE USER username IDENTIFIED GLOBALLY AS 'user_DN'; syntax), and

    • This is an SSL-authenticated user.

    Then, ensure that the DN in the user wallet matches the DN that was used in the CREATE USER statement.

    Use Oracle Wallet Manager to view the DN in the user wallet.

    Use the following syntax to view the DN that was used with the CREATE USER statement:

    SELECT EXTERNAL_NAME FROM DBA_USERS WHERE USERNAME='schema';

  4. If you are using a shared schema, then check the following:

    • Use Oracle Enterprise Manager Database Control or Grid Control to ensure that you have created a user-schema mapping either for the entire enterprise domain or for the database.

    • If the user-schema mapping is intended to apply to this database (not to the entire enterprise domain), then check that the database can read its own entry and subtree in the directory.

      To check this, enter the following ldapsearch command for your database-to-directory connection type:

      • If the database connects to the directory over SSL, then use

        ldapsearch -h directory_host -p directory_SSLport -U 3 -W "file:database_wallet_path" -Q -b "database_DN" "objectclass=*"
Please enter SSL wallet password: wallet_password

        where wallet_password is the password to the wallet, which enables you to open or change the wallet.

      • If the database connects to the directory by using password authentication, then use

        ldapsearch -h directory_host -p directory_port -D database_DN -q -b "database_DN" "objectclass=*"
Please enter bind password: database_directory_password

        where database_directory_password is the database bind password returned by a utility like mkstore.

      You should see the database entry and the relevant mapping.

    • If the user-schema mapping applies to the entire enterprise domain rather than to only this individual database, then see "DOMAIN-READ-ERROR Checklist".

4.7.6 DOMAIN-READ-ERROR Checklist

If your database cannot read its enterprise domain information in Oracle Internet Directory, then check the following:

  1. Use Oracle Enterprise Manager Database Control or Grid Control to check that the database is a member of exactly one enterprise domain, and add it to one if it is not.

  2. Check that the database can see its domain, by entering one of the following at the command line:

    • If the database connects to the directory over SSL, then use

      ldapsearch -h directory_host -p directory_SSLport -U 3 -W "file:database_wallet_path" -Q -b "cn=OracleContext, realm_DN" "objectclass=orclDBEnterpriseDomain"
Please enter SSL wallet password: wallet_password

      where wallet_password is the password to the wallet, which enables you to open or change the wallet.

    • If the database connects to the directory by using password authentication, then use

      ldapsearch -h directory_host -p directory_port -D database_DN -q -b "cn=OracleContext, realm_DN" "objectclass=orclDBEnterpriseDomain"
Please enter bind password: database_directory_password

      where database_directory_password is the password in the database wallet, which is the database's password to Oracle Internet Directory.

    The ldapsearch command should return exactly one enterprise domain.

    If no domain is returned and Oracle Enterprise Manager shows the database as a member of a domain, then restart the database. Restarting the database updates the cached value for the enterprise domain.

    If more than one domain is returned, then use Oracle Enterprise Manager to remove the database from the additional domain.

  3. Check that the database can read the enterprise domain subtree and thus can read its enterprise roles and mappings, by entering one of the following at the command line:

    • If the database connects to the directory over SSL, then use

      ldapsearch -h directory_host -p directory_SSLport -U 3 -W "file:database_wallet_path" -Q -b "cn=OracleContext, realm_DN" "objectclass=orclDBEnterpriseRole"
Please enter SSL wallet password: wallet_password

      where wallet_password is the password to the wallet, which enables you to open or change the wallet.

    • If the database connects to the directory by using password authentication, then use

      ldapsearch -h directory_host -p directory_port -D database_DN -q -b "cn=OracleContext, realm_DN" "objectclass=orclDBEnterpriseRole"
Please enter bind password: database_directory_password

      where database_directory_password is the password in the database wallet, which is the database password to Oracle Internet Directory.

    This ldapsearch should return all of the enterprise roles that you have created for this domain. If it does not, then use Oracle Enterprise Manager to create enterprise roles and mappings.

  4. Use Oracle Enterprise Manager Database Control or Grid Control to set or reset the user authentication policy for the relevant enterprise domain. See "Configuring User Authentication Types and Enabling Current User Database Links" for information about setting the user authentication policy for an enterprise domain.

PK+8XDPK&AOEBPS/appd.htm) Upgrading from Oracle9i to Oracle Database 11g Release 2 (11.2)

D Upgrading from Oracle9i to Oracle Database 11g Release 2 (11.2)

This appendix discusses upgrading Oracle9i Database (9.2.0.8) to Oracle Database 11g Release 2 (11.2) with respect to Enterprise User Security. It includes the following sections:

D.1 Upgrading Oracle Internet Directory from Release 9.2 to Release 9.0.4

Oracle9i Database Release 2 can work with Oracle Internet Directory Release 9.2 or Release 9.0.4. Oracle Database 11g Release 2 (11.2) requires Oracle Internet Directory 9.0.4 or later. In case you are using Oracle Internet Directory Release 9.2, you need to upgrade it to Release 9.0.4.

The following list discusses upgrading Oracle Internet Directory Release 9.2 to Oracle Internet Directory Release 9.0.4:

  1. Use Oracle Internet Directory Configuration Assistant to upgrade Oracle Internet Directory. This is required if you want to register Oracle Database 11g Release 2 (11.2) instances in the directory.

  2. Upgrade Oracle Contexts used for Enterprise User Security to Identity Management Realms, if they are not root contexts. Use the Oracle Internet Directory Configuration Assistant command-line utility as follows:

    oidca mode=CTXTOIMR

    This step is required if you want to register an Oracle Database 11g Release 2 (11.2) instance in a realm.

    You cannot use the root Oracle Context for Oracle Database 11g Release 2 (11.2) databases because it is not an Identity Management Realm.

  3. Use Oracle Internet Directory tools, such as ldapmodify and bulkmodify, to add the orcluserV2 objectclass to existing user entries. This objectclass is required for users to change their database passwords, and for kerberos authentication to the database.

  4. In a realm that contains both Oracle9i Database and Oracle Database 11g Release 2 (11.2), use a DAS-based tool in Oracle Internet Directory Release 9.0.4 to create and manage users. You can use either Oracle Internet Directory Self-Service Console or Enterprise Security Manager Console. Do not use Enterprise Security Manager or Enterprise Login Assistant from Oracle9i installations.

D.2 Upgrading Oracle Database from Release 9.2.0.8 to Release 11.2

For each Oracle9i Database (9.2.0.8) instance that you upgrade to Oracle Database 11g Release 2 (11.2), perform the following steps:

  1. Use Oracle Wallet Manager to disable automatic login for the database wallet.

  2. Copy the database distinguished name (DN) from the initialization parameter rdbms_server_dn to a file in a secure location.

  3. Upgrade the database to Oracle Database 11g Release 2 (11.2).

  4. Depending on where your database admin directory is stored, move the database wallet either to $ORACLE_BASE/admin/olddbuniquename/wallet or $ORACLE_HOME/admin/olddbuniquename/wallet. Note that $ORACLE_HOME is for the new Oracle Database 11g Release 2 (11.2). You may have to create the wallet directory.

  5. Copy the old $ORACLE_HOME/network/admin/ldap.ora file to the new $ORACLE_HOME/ldap/admin/ldap.ora file. Alternatively, you can use Oracle Net Configuration Assistant to create a new ldap.ora file.

  6. Use the command-line utility, mkstore, to put the database DN (from the file in the previously created secure directory location) into the wallet by using the following syntax:

    mkstore -wrl database_wallet_location -createEntry 
ORACLE.SECURITY.DN database_DN

    You will be prompted for the wallet password.

    If you make a mistake in the mkstore command, then you can use the -modifyEntry option to correct it.

  7. Use Database Configuration Assistant to generate the database-to-directory password in the database wallet. Choose the Modify Database option.

  8. Use Oracle Wallet Manager to re-enable automatic login for the database wallet.

  9. Use Oracle Net Manager to set the new wallet location in the sqlnet.ora file to the directory specified in step 4.

The default for the nickname attribute, such as CN, remains unchanged. The upgrade process does not change the default nickname attribute setting. After upgrading from Oracle Internet Directory Release 9.2 to Release 9.0.4, if you are unable to log in to Oracle Database 11g Release 2 (11.2), then you must use the DAS-based Oracle Internet Directory Self-Service Console to reset your password.

PK.)PK&AOEBPS/cover.htmO Cover

Oracle Corporation

PK[pTOPK&AOEBPS/whatsnew.htm$s What's New in Enterprise User Security?

What's New in Enterprise User Security?

This section describes new features of Enterprise User Security and provides pointers to additional information. New features information from the previous releases is also retained to help users who are migrating to the current release.

The following sections describe the new features in Enterprise User Security:

Oracle Database 11g New Features in Enterprise User Security

Enterprise User Security 11g includes the following new feature:

Enterprise User Security can now be managed using the graphical user interface (GUI) provided by Oracle Enterprise Manager. Oracle Enterprise Manager can be used to conveniently configure enterprise users, groups, roles, domains, and so on.


See Also:

Chapter 2, "Getting Started with Enterprise User Security"

Oracle Database 10g Release 2 (10.2) New Features in Enterprise User Security

Enterprise User Security 10g Release 2 (10.2) includes the following new features:

Enterprise User Security 10g Release 2 (10.2) also introduces several new proxying features that enhance both security and ease of use:

New proxying features are described in "Enterprise User Proxy".

Oracle Database 10g Release 1 (10.1) New Features in Enterprise User Security

Enterprise User Security 10g Release 1 (10.1) included the following new features:

PKl$$PK&AOEBPS/title.htm Oracle Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2)

Oracle® Database

Enterprise User Security Administrator's Guide

11g Release 2 (11.2)

E10744-02

November 2009

Oracle Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2)

E10744-02

Copyright © 2000, 2009, Oracle and/or its affiliates. All rights reserved.

Primary Author:  Sumit Jeloka

Contributor:  Srividya Tata, Sarma Namuduri, Nina Lewis, Chi Ching Chui, Janaki Narasinghanallur, Min-Hank Ho, Sudha Iyer, Supriya Kalyanasundaram, Lakshmi Kethana, Van Le, Stella Li, Vikram Pesati, Andy Philips, Richard Smith, Deborah Steiner, Philip Thornton, Ramana Turlapati, Peter Wahl, Pat Huey, Sudheesh Varma, Hozefa Palitanawala, Manoj Kamani

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

PK PK&AOEBPS/appc.htm+% Integrating Enterprise User Security with Microsoft Active Directory

C Integrating Enterprise User Security with Microsoft Active Directory

Enterprise users make use of Oracle Internet Directory, which is a part of the Oracle Identity Management infrastructure. If your organization uses a third party directory like Active Directory to store and manage user entries, then you can integrate it with Oracle Internet Directory to manage Enterprise User Security.

Kerberos authentication for enterprise users can make use of tickets issued by a kerberos Key Distribution Center (KDC) running on a Microsoft Windows domain controller.

This appendix lists the steps involved in integrating Enterprise User Security with Microsoft Active Directory using kerberos for authentication. It includes the following sections:

C.1 Set Up Synchronization Between Active Directory and Oracle Internet Directory

Oracle components make use of Oracle Internet Directory for centralized security administration. Your organization might have a Microsoft Windows domain that uses Active Directory for centralized administration. You should set up synchronization between Oracle Internet Directory and Active Directory before you configure Enterprise User Security to work with Active Directory.

Synchronization profiles are used to synchronize the two directories. The profile contains configuration information required to synchronize the two directories. This includes direction of synchronization, mapping rules and formats, connection details of Microsoft Windows domain and the like. Mapping rules contain domain rules and attribute rules to map a domain and attributes in one directory to the other directory, optionally formatting the attributes.


See Also:

For step-by-step instructions on integrating Oracle Internet Directory with Microsoft Active Directory, refer to the Oracle Identity Management Integration Guide

C.2 Set Up a Windows 2000 Domain Controller to Interoperate with Oracle Client

The following tasks must be performed on the Windows 2000 domain controller:

  1. Create the Oracle Database Principal in Microsoft Active Directory

    This creates a new user for the database in Microsoft Active Directory.

  2. Use the ktpass command-line utility to create a kerberos keytab file

    The ktpass utility is a part of the Windows 2000 Support Tools. The keytab file is required to use a Windows 2000 domain controller as a KDC.

  3. Copy the keytab file created in the previous step to the computer on which the database server is installed


See Also:

Oracle Database Advanced Security Administrator's Guide for a detailed listing of the preceding steps.

C.3 Set Up Oracle Database to Interoperate with a Windows 2000 Domain Controller

The following task must be performed on the host computer where Oracle Database is installed:


See Also:

Oracle Database Advanced Security Administrator's Guide for a detailed description of the preceding step.

C.4 Set Up Oracle Database Client to Interoperate with a Windows 2000 KDC

The following steps must be performed on the Oracle kerberos client:

  1. Create client kerberos configuration files

    The client kerberos configuration files refer to the Windows 2000 domain controller as the kerberos KDC.

  2. Specify kerberos parameters in the client sqlnet.ora file

    You can either manually update the file or use Oracle Net Manager utility.


See Also:

Oracle Database Advanced Security Administrator's Guide for a detailed listing of the preceding steps.

C.5 Obtain an Initial Ticket for the Client

Before a client can connect to the database, the client must request for an initial ticket. The initial ticket identifies the client as having the rights to ask for additional service tickets. An initial ticket is requested using the okinit command.


See Also:

Oracle Database Advanced Security Administrator's Guide for more details on requesting an initial ticket with okinit.

C.6 Configure Enterprise User Security for Kerberos Authentication

To configure Enterprise User Security for Kerberos Authentication, use the following steps:

  1. Register the database in Oracle Internet Directory

    You can use Database Configuration Assistant for registering the database.

  2. Configure Enterprise User Security Objects in the database and Oracle Internet Directory

    Create global schemas and global roles in the database. Also create enterprise roles in the enterprise domain. Configure user schema mappings for the enterprise domain, add global database roles to enterprise roles and grant enterprise roles to enterprise users for database access.

  3. Configure the enterprise domain to accept kerberos authentication

    Use Oracle Enterprise Manager to enable kerberos authentication for your enterprise domain.

  4. Connect as kerberos authenticated enterprise user.

    Launch SQL*Plus and use the command, connect /@net_service_name to connect as a kerberos authenticated enterprise user.


See Also:

For detailed information on the preceding steps, refer to "Configuring Enterprise User Security for Kerberos Authentication" .

PK++PK&AOEBPS/glossary.htm Glossary

Glossary

access control

The ability of a system to grant or limit access to specific data for specific clients or groups of clients.

Access Control Lists (ACLs)

The group of access directives that you define. The directives grant levels of access to specific data for specific clients, or groups of clients, or both.

Advanced Encryption Standard

Advanced Encryption Standard (AES) is a new cryptographic algorithm that has been approved by the National Institute of Standards and Technology as a replacement for DES. The AES standard is available in Federal Information Processing Standards Publication 197. The AES algorithm is a symmetric block cipher that can process data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits.

AES

See Advanced Encryption Standard

attribute

An item of information that describes some aspect of an entry in an LDAP directory. An entry comprises a set of attributes, each of which belongs to an object class. Moreover, each attribute has both a type, which describes the kind of information in the attribute, and a value, which contains the actual data.

authentication

The process of verifying the identity of a user, device, or other entity in a computer system, often as a prerequisite to granting access to resources in a system. A recipient of an authenticated message can be certain of the message's origin (its sender). Authentication is presumed to preclude the possibility that another party has impersonated the sender.

authentication method

A security method that verifies a user's, client's, or server's identity in distributed environments. Network authentication methods can also provide the benefit of single sign-on (SSO) for users. The following authentication methods are supported in Oracle Database when Oracle Advanced Security is installed:

authorization

Permission given to a user, program, or process to access an object or set of objects. In Oracle, authorization is done through the role mechanism. A single person or a group of people can be granted a role or a group of roles. A role, in turn, can be granted other roles. The set of privileges available to an authenticated entity.

auto login wallet

An Oracle Wallet Manager feature that enables PKI- or password-based access to services without providing credentials at the time of access. This auto login access stays in effect until the auto login feature is disabled for that wallet. File system permissions provide the necessary security for auto login wallets. When auto login is enabled for a wallet, it is only available to the operating system user who created that wallet. Sometimes these are called "SSO wallets" because they provide single sign-on capability.

base

The root of a subtree search in an LDAP-compliant directory.

CA

See certificate authority

CDS

See Cell Directory Services (CDS)

Cell Directory Services (CDS)

An external naming method that enables users to use Oracle tools transparently and applications to access Oracle Database databases in a Distributed Computing Environment (DCE).

certificate

An ITU x.509 v3 standard data structure that securely binds an identify to a public key.

A certificate is created when an entity's public key is signed by a trusted identity, a certificate authority. The certificate ensures that the entity's information is correct and that the public key actually belongs to that entity.

A certificate contains the entity's name, identifying information, and public key. It is also likely to contain a serial number, expiration date, and information about the rights, uses, and privileges associated with the certificate. Finally, it contains information about the certificate authority that issued it.

certificate authority

A trusted third party that certifies that other entities—users, databases, administrators, clients, servers—are who they say they are. When it certifies a user, the certificate authority first seeks verification that the user is not on the certificate revocation list (CRL), then verifies the user's identity and grants a certificate, signing it with the certificate authority's private key. The certificate authority has its own certificate and public key which it publishes. Servers and clients use these to verify signatures the certificate authority has made. A certificate authority might be an external company that offers certificate services, or an internal organization such as a corporate MIS department.

certificate chain

An ordered list of certificates containing an end-user or subscriber certificate and its certificate authority certificates.

certificate request

A certificate request, which consists of three parts: certification request information, a signature algorithm identifier, and a digital signature on the certification request information. The certification request information consists of the subject's distinguished name, public key, and an optional set of attributes. The attributes may provide additional information about the subject identity, such as postal address, or a challenge password by which the subject entity may later request certificate revocation. See PKCS #10

certificate revocation lists

(CRLs) Signed data structures that contain a list of revoked certificates. The authenticity and integrity of the CRL is provided by a digital signature appended to it. Usually, the CRL signer is the same entity that signed the issued certificate.

checksumming

A mechanism that computes a value for a message packet, based on the data it contains, and passes it along with the data to authenticate that the data has not been tampered with. The recipient of the data recomputes the cryptographic checksum and compares it with the cryptographic checksum passed with the data; if they match, it is "probabilistic" proof the data was not tampered with during transmission.

Cipher Block Chaining (CBC)

An encryption method that protects against block replay attacks by making the encryption of a cipher block dependent on all blocks that precede it; it is designed to make unauthorized decryption incrementally more difficult. Oracle Advanced Security employs outer cipher block chaining because it is more secure than inner cipher block chaining, with no material performance penalty.

cipher suite

A set of authentication, encryption, and data integrity algorithms used for exchanging messages between network nodes. During an SSL handshake, for example, the two nodes negotiate to see which cipher suite they will use when transmitting messages back and forth.

cipher suite name

Cipher suites describe the kind of cryptographics protection that is used by connections in a particular session.

ciphertext

Message text that has been encrypted.

cleartext

Unencrypted plain text.

client

A client relies on a service. A client can sometimes be a user, sometimes a process acting on behalf of the user during a database link (sometimes called a proxy).

confidentiality

A function of cryptography. Confidentiality guarantees that only the intended recipient(s) of a message can view the message (decrypt the ciphertext).

connect descriptor

A specially formatted description of the destination for a network connection. A connect descriptor contains destination service and network route information. The destination service is indicated by using its service name for Oracle9i or Oracle8i databases or its Oracle system identifier (SID) for Oracle databases version 8.0. The network route provides, at a minimum, the location of the listener through use of a network address. See connect identifier

connect identifier

A connect descriptor or a name that maps to a connect descriptor. A connect identifier can be a net service name, database service name, or net service alias. Users initiate a connect request by passing a username and password along with a connect identifier in a connect string for the service to which they wish to connect:

CONNECT username@connect_identifier
Enter password:

connect string

Information the user passes to a service to connect, such as username, password and net service name. For example:

CONNECT username@net_service_name

Enter password:

credentials

A username, password, or certificate used to gain access to the database.

CRL

See certificate revocation lists

CRL Distribution Point

(CRL DP) An optional extension specified by the X.509 version 3 certificate standard, which indicates the location of the Partitioned CRL where revocation information for a certificate is stored. Typically, the value in this extension is in the form of a URL. CRL DPs allow revocation information within a single certificate authority domain to be posted in multiple CRLs. CRL DPs subdivide revocation information into more manageable pieces to avoid proliferating voluminous CRLs, thereby providing performance benefits. For example, a CRL DP is specified in the certificate and can point to a file on a Web server from which that certificate's revocation information can be downloaded.

CRL DP

See CRL Distribution Point

cryptography

The practice of encoding and decoding data, resulting in secure messages.

data dictionary

A set of read-only tables that provide information about a database.

Data Encryption Standard (DES)

The U.S. data encryption standard.

database administrator

(1) A person responsible for operating and maintaining an Oracle Server or a database application. (2) An Oracle username that has been given DBA privileges and can perform database administration functions. Usually the two meanings coincide. Many sites have multiple DBAs. (3) Members of the OracleDBAdmins directory administrative group, who manage the database user-schema mappings for a specific database entry in the directory. Database Configuration Assistant automatically adds the person who registers a database in the directory into the OracleDBAdmins group as the first member of this group for the database being registered.

database alias

See net service name

Database Installation Administrator

Also called a database creator. This administrator is in charge of creating new databases. This includes registering each database in the directory using the Database Configuration Assistant. This administrator has create and modify access to database service objects and attributes. This administrator can also modify the Default domain.

database link

A network object stored in the local database or in the network definition that identifies a remote database, a communication path to that database, and optionally, a username and password. Once defined, the database link is used to access the remote database.

A public or private database link from one database to another is created on the local database by a DBA or user.

A global database link is created automatically from each database to every other database in a network with Oracle Names. Global database links are stored in the network definition.

database method

See Oracle database method

database password verifier

A database password verifier is an irreversible value that is derived from the user's database password. This value is used during password authentication to the database to prove the identity of the connecting user.

Database Security Administrator

The highest level administrator for database enterprise user security. This administrator has permissions on all of the enterprise domains and is responsible for:

Creating new enterprise domains.

DCE

See Distributed Computing Environment (DCE)

decryption

The process of converting the contents of an encrypted message (ciphertext) back into its original readable format (plaintext).

DES

See Data Encryption Standard (DES)

dictionary attack

A common attack on passwords. the attacker creates a dictionary of many possible passwords and their corresponding verifiers. Through some means, the attacker then obtains the verifier corresponding to the target password, and obtains the target password by looking up the verifier in the dictionary.

Diffie-Hellman key negotiation algorithm

This is a method that lets two parties communicating over an insecure channel to agree upon a random number known only to them. Though the parties exchange information over the insecure channel during execution of the Diffie-Hellman key negotiation algorithm, it is computationally infeasible for an attacker to deduce the random number they agree upon by analyzing their network communications. Oracle Advanced Security uses the Diffie-Hellman key negotiation algorithm to generate session keys.

digital signature

A digital signature is created when a public key algorithm is used to sign the sender's message with the sender's private key. The digital signature assures that the document is authentic, has not been forged by another entity, has not been altered, and cannot be repudiated by the sender.

directory information tree (DIT)

A hierarchical tree-like structure consisting of the DNs of the entries in an LDAP directory. See distinguished name (DN)

directory naming

A naming method that resolves a database service, net service name, or net service alias to a connect descriptor stored in a central directory server. A

directory naming context

A subtree which is of significance within a directory server. It is usually the top of some organizational subtree. Some directories only permit one such context which is fixed; others permit none to many to be configured by the directory administrator.

Distributed Computing Environment (DCE)

A set of integrated network services that works across multiple systems to provide a distributed environment. The middleware between distributed applications and the operating system or network services; based on a client/server computing model. DCE is supported by the Open Group.

distinguished name (DN)

The unique name of a directory entry. It is comprised of all of the individual names of the parent entries back to the root entry of the directory information tree. See directory information tree (DIT)

domain

Any tree or subtree within the Domain Name System (DNS) namespace. Domain most commonly refers to a group of computers whose host names share a common suffix, the domain name.

Domain Name System (DNS)

A system for naming computers and network services that is organized into a hierarchy of domains. DNS is used in TCP/IP networks to locate computers through user-friendly names. DNS resolves a friendly name into an IP address, which is understood by computers.

In Oracle Net Services, DNS translates the host name in a TCP/IP address into an IP address.

encrypted text

Text that has been encrypted, using an encryption algorithm; the output stream of an encryption process. On its face, it is not readable or decipherable, without first being subject to decryption. Also called ciphertext. Encrypted text ultimately originates as plaintext.

encryption

The process of disguising a message rendering it unreadable to any but the intended recipient.

enterprise domain

A directory construct that consists of a group of databases and enterprise roles. A database should only exist in one enterprise domain at any time. Enterprise domains are different from Windows 2000 domains, which are collections of computers that share a common directory database.

enterprise domain administrator

User authorized to manage a specific enterprise domain, including the authority to add new enterprise domain administrators.

enterprise role

Access privileges assigned to enterprise users. A set of Oracle role-based authorizations across one or more databases in an enterprise domain. Enterprise roles are stored in the directory and contain one or more global roles.

enterprise user

A user defined and managed in a directory. Each enterprise user has a unique identity across an enterprise.

entry

The building block of a directory, it contains information about an object of interest to directory users.

external authentication

Verification of a user identity by a third party authentication service, such as Kerberos or RADIUS.

file system method

Storing fingerprint templates in files when configuring Identix Biometric authentication. The alternative is to use the Oracle database method.

Federal Information Processing Standard (FIPS)

A U.S. government standard that defines security requirements for cryptographic modules—employed within a security system protecting unclassified information within computer and telecommunication systems. Published by the National Institute of Standards and Technology (NIST).

FIPS

See Federal Information Processing Standard (FIPS)

forest

A group of one or more Active Directory trees that trust each other. All trees in a forest share a common schema, configuration, and global catalog. When a forest contains multiple trees, the trees do not form a contiguous namespace. All trees in a given forest trust each other through transitive bidirectional trust relationships.

forwardable ticket-granting ticket

In Kerberos. A service ticket with the FORWARDABLE flag set. This flag enables authentication forwarding without requiring the user to enter a password again.

GDS

See Global Directory Service (GDS)

Global Directory Service (GDS)

GDS is the DCE directory service that acts as an agent between DCE CDS and any X.500 directory service. Both GDS and CDS are obsolete; they are only used by DCE.

global role

A role managed in a directory, but its privileges are contained within a single database. A global role is created in a database by using the following syntax:

CREATE ROLE <role_name> IDENTIFIED GLOBALLY;

grid computing

A computing architecture that coordinates large numbers of servers and storage to act as a single large computer. Oracle Grid Computing creates a flexible, on-demand computing resource for all enterprise computing needs. Applications running on the Oracle 10g, or later, grid computing infrastructure can take advantage of common infrastructure services for failover, software provisioning, and management. Oracle Grid Computing analyzes demand for resources and adjusts supply accordingly.

HTTP

Hypertext Transfer Protocol: The set of rules for exchanging files (text, graphic images, sound, video, and other multimedia files) on the World Wide Web. Relative to the TCP/IP suite of protocols (which are the basis for information exchange on the Internet), HTTP is an application protocol.

HTTPS

The use of Secure Sockets Layer (SSL) as a sublayer under the regular HTTP application layer.

identity

The combination of the public key and any other public information for an entity. The public information may include user identification data such as, for example, an e-mail address. A user certified as being the entity it claims to be.

identity management

The creation, management, and use of online, or digital, entities. Identity management involves securely managing the full life cycle of a digital identity from creation (provisioning of digital identities) to maintenance (enforcing organizational policies regarding access to electronic resources), and, finally, to termination.

identity management realm

A subtree in Oracle Internet Directory, including not only an Oracle Context, but also additional subtrees for users and groups, each of which are protected with access control lists.

initial ticket

In Kerberos authentication, an initial ticket or ticket granting ticket (TGT) identifies the user as having the right to ask for additional service tickets. No tickets can be obtained without an initial ticket. An initial ticket is retrieved by running the okinit program and providing a password.

instance

Every running Oracle database is associated with an Oracle instance. When a database is started on a database server (regardless of the type of computer), Oracle allocates a memory area called the System Global Area (SGA) and starts an Oracle process. This combination of the SGA and an Oracle process is called an instance. The memory and the process of an instance manage the associated database's data efficiently and serve the one or more users of the database.

integrity

The guarantee that the contents of the message received were not altered from the contents of the original message sent.

java code obfuscation

Java code obfuscation is used to protect Java programs from reverse engineering. A special program (an obfuscator) is used to scramble Java symbols found in the code. The process leaves the original program structure intact, letting the program run correctly while changing the names of the classes, methods, and variables in order to hide the intended behavior. Although it is possible to decompile and read non-obfuscated Java code, the obfuscated Java code is sufficiently difficult to decompile to satisfy U.S. government export controls.

Java Database Connectivity (JDBC)

An industry-standard Java interface for connecting to a relational database from a Java program, defined by Sun Microsystems.

JDBC

See Java Database Connectivity (JDBC)

KDC

Key Distribution Center. In Kerberos authentication, the KDC maintains a list of user principals and is contacted through the kinit (okinit is the Oracle version) program for the user's initial ticket. Frequently, the KDC and the Ticket Granting Service are combined into the same entity and are simply referred to as the KDC. The Ticket Granting Service maintains a list of service principals and is contacted when a user wants to authenticate to a server providing such a service. The KDC is a trusted third party that must run on a secure host. It creates ticket-granting tickets and service tickets.

Kerberos

A network authentication service developed under Massachusetts Institute of Technology's Project Athena that strengthens security in distributed environments. Kerberos is a trusted third-party authentication system that relies on shared secrets and assumes that the third party is secure. It provides single sign-on capabilities and database link authentication (MIT Kerberos only) for users, provides centralized password storage, and enhances PC security.

key

When encrypting data, a key is a value which determines the ciphertext that a given algorithm will produce from given plaintext. When decrypting data, a key is a value required to correctly decrypt a ciphertext. A ciphertext is decrypted correctly only if the correct key is supplied.

With a symmetric encryption algorithm, the same key is used for both encryption and decryption of the same data. With an asymmetric encryption algorithm (also called a public-key encryption algorithm or public-key cryptosystem), different keys are used for encryption and decryption of the same data.

key pair

A public key and its associated private key. See public and private key pair

keytab file

A Kerberos key table file containing one or more service keys. Hosts or services use keytab files in the same way as users use their passwords.

kinstance

An instantiation or location of a Kerberos authenticated service. This is an arbitrary string, but the host computer name for a service is typically specified.

kservice

An arbitrary name of a Kerberos service object.

LDAP

See Lightweight Directory Access Protocol (LDAP)

ldap.ora file

A file created by Oracle Net Configuration Assistant that contains the following directory server access information:

Lightweight Directory Access Protocol (LDAP)

A standard, extensible directory access protocol. It is a common language that LDAP clients and servers use to communicate. The framework of design conventions supporting industry-standard directory products, such as the Oracle Internet Directory.

listener

A process that resides on the server whose responsibility is to listen for incoming client connection requests and manage the traffic to the server.

Every time a client requests a network session with a server, a listener receives the actual request. If the client information matches the listener information, then the listener grants a connection to the server.

listener.ora file

A configuration file for the listener that identifies the:

The listener.ora file typically resides in $ORACLE_HOME/network/admin on UNIX platforms and ORACLE_BASE\ORACLE_HOME\network\admin on Windows.

man-in-the-middle

A security attack characterized by the third-party, surreptitious interception of a message, wherein the third-party, the man-in-the-middle, decrypts the message, re-encrypts it (with or without alteration of the original message), and re-transmits it to the originally-intended recipient—all without the knowledge of the legitimate sender and receiver. This type of security attack works only in the absence of authentication.

MD5

An algorithm that assures data integrity by generating a 128-bit cryptographic message digest value from given data. If as little as a single bit value in the data is modified, the MD5 checksum for the data changes. Forgery of data in a way that will cause MD5 to generate the same result as that for the original data is considered computationally infeasible.

message authentication code

Also known as data authentication code (DAC). A checksumming with the addition of a secret key. Only someone with the key can verify the cryptographic checksum.

message digest

See checksumming

naming method

The resolution method used by a client application to resolve a connect identifier to a connect descriptor when attempting to connect to a database service.

National Institute of Standards and Technology (NIST)

An agency within the U.S. Department of Commerce responsible for the development of security standards related to the design, acquisition, and implementation of cryptographic-based security systems within computer and telecommunication systems, operated by a Federal agency or by a contractor of a Federal agency or other organization that processes information on behalf of the Federal Government to accomplish a Federal function.

net service alias

An alternative name for a directory naming object in a directory server. A directory server stores net service aliases for any defined net service name or database service. A net service alias entry does not have connect descriptor information. Instead, it only references the location of the object for which it is an alias. When a client requests a directory lookup of a net service alias, the directory determines that the entry is a net service alias and completes the lookup as if it was actually the entry it is referencing.

net service name

The name used by clients to identify a database server. A net service name is mapped to a port number and protocol. Also known as a connect string, or database alias.

network authentication service

A means for authenticating clients to servers, servers to servers, and users to both clients and servers in distributed environments. A network authentication service is a repository for storing information about users and the services on different servers to which they have access, as well as information about clients and servers on the network. An authentication server can be a physically separate computer, or it can be a facility co-located on another server within the system. To ensure availability, some authentication services may be replicated to avoid a single point of failure.

network listener

A listener on a server that listens for connection requests for one or more databases on one or more protocols. See listener

NIST

See Federal Information Processing Standard (FIPS)

non-repudiation

Incontestable proof of the origin, delivery, submission, or transmission of a message.

obfuscation

A process by which information is scrambled into a non-readable form, such that it is extremely difficult to de-scramble if the algorithm used for scrambling is not known.

obfuscator

A special program used to obfuscate Java source code. See obfuscation

object class

A named group of attributes. When you want to assign attributes to an entry, you do so by assigning to that entry the object classes that hold those attributes. All objects associated with the same object class share the same attributes.

Oracle Context

1. An entry in an LDAP-compliant internet directory called cn=OracleContext, under which all Oracle software relevant information is kept, including entries for Oracle Net Services directory naming and checksumming security.

There can be one or more Oracle Contexts in a directory. An Oracle Context is usually located in an identity management realm.

OracleContextAdmins

An administrative group in Oracle Internet Directory whose members have full access to all groups and entries within its associated realm Oracle Context.

Oracle database method

Using an Oracle database to store fingerprint templates when configuring Indentix Biometric authentication. The alternative is to use the file system method.

OracleDBAdmins

An administrative group in Oracle Internet Directory whose members manage the database user-schema mappings for a particular database that is registered in the directory.

OracleDBCreators

An administrative group in Oracle Internet Directory whose members create new databases and registers them in the directory by using Database Configuration Assistant.

OracleDBSecurityAdmins

An administrative group in Oracle Internet Directory whose members have permissions on all of the enterprise domains to configure the identity management realm for enterprise users.

Oracle Net Services

An Oracle product that enables two or more computers that run the Oracle server or Oracle tools such as Designer/2000 to exchange data through a third-party network. Oracle Net Services support distributed processing and distributed database capability. Oracle Net Services is an open system because it is independent of the communication protocol, and users can interface Oracle Net to many network environments.

OraclePasswordAccessibleDomains

See Password-Accessible Domains List

Oracle PKI certificate usages

Defines Oracle application types that a certificate supports.

OracleUserSecurityAdmins

An administrative group in Oracle Internet Directory whose members can administer Oracle database users' security in the directory.

Password-Accessible Domains List

A group of enterprise domains configured to accept connections from password-authenticated users.

PCMCIA cards

Small credit card-sized computing devices that comply with the Personal Computer Memory Card International Association (PCMCIA) standard. These devices, also called PC cards, are used for adding memory, modems, or as hardware security modules. PCMCIA cards used as hardware security modules securely store the private key component of a public and private key pair and some also perform the cryptographic operations as well.

peer identity

SSL connect sessions are between a particular client and a particular server. The identity of the peer may have been established as part of session setup. Peers are identified by X.509 certificate chains.

PEM

The Internet Privacy-Enhanced Mail protocols standard, adopted by the Internet Architecture Board to provide secure electronic mail over the Internet. The PEM protocols provide for encryption, authentication, message integrity, and key management. PEM is an inclusive standard, intended to be compatible with a wide range of key-management approaches, including both symmetric and public-key schemes to encrypt data-encrypting keys. The specifications for PEM come from four Internet Engineering Task Force (IETF) documents: RFCs 1421, 1422, 1423, and 1424.

PKCS #10

An RSA Security, Inc., Public-Key Cryptography Standards (PKCS) specification that describes a syntax for certification requests. A certification request consists of a distinguished name, a public key, and optionally a set of attributes, collectively signed by the entity requesting certification. Certification requests are referred to as certificate requests in this manual. See certificate request

PKCS #11

An RSA Security, Inc., Public-Key Cryptography Standards (PKCS) specification that defines an application programming interface (API), called Cryptoki, to devices which hold cryptographic information and perform cryptographic operations. See PCMCIA cards

PKCS #12

An RSA Security, Inc., Public-Key Cryptography Standards (PKCS) specification that describes a transfer syntax for storing and transferring personal authentication credentials—typically in a format called a wallet.

PKI

See public key infrastructure (PKI)

plaintext

Message text that has not been encrypted.

principal

A string that uniquely identifies a client or server to which a set of Kerberos credentials is assigned. It generally has three parts: kservice/kinstance@REALM. In the case of a user, kservice is the username. See also kservice, kinstance, and realm

private key

In public-key cryptography, this key is the secret key. It is primarily used for decryption but is also used for encryption with digital signatures. See public and private key pair

proxy authentication

A process typically employed in an environment with a middle tier such as a firewall, wherein the end user authenticates to the middle tier, which then authenticates to the directory on the user's behalf—as its proxy. The middle tier logs into the directory as a proxy user. A proxy user can switch identities and, once logged into the directory, switch to the end user's identity. It can perform operations on the end user's behalf, using the authorization appropriate to that particular end user.

public key

In public-key cryptography, this key is made public to all. It is primarily used for encryption but can be used for verifying signatures. See public and private key pair

public key encryption

The process where the sender of a message encrypts the message with the public key of the recipient. Upon delivery, the message is decrypted by the recipient using its private key.

public key infrastructure (PKI)

Information security technology utilizing the principles of public key cryptography. Public key cryptography involves encrypting and decrypting information using a shared public and private key pair. Provides for secure, private communications within a public network.

public and private key pair

A set of two numbers used for encryption and decryption, where one is called the private key and the other is called the public key. Public keys are typically made widely available, while private keys are held by their respective owners. Though mathematically related, it is generally viewed as computationally infeasible to derive the private key from the public key. Public and private keys are used only with asymmetric encryption algorithms, also called public-key encryption algorithms, or public-key cryptosystems. Data encrypted with either a public key or a private key from a key pair can be decrypted with its associated key from the key-pair. However, data encrypted with a public key cannot be decrypted with the same public key, and data enwrapped with a private key cannot be decrypted with the same private key.

RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a client/server protocol and software that enables remote access servers to communication with a central server to authenticate dial-in users and authorize their access to the requested system or service.

realm

1. Short for identity management realm. 2. A Kerberos object. A set of clients and servers operating under a single key distribution center/ticket-granting service (KDC/TGS). Services (see kservice) in different realms that share the same name are unique.

realm Oracle Context

An Oracle Context that is part of an identity management realm in Oracle Internet Directory.

registry

A Windows repository that stores configuration information for a computer.

remote computer

A computer on a network other than the local computer.

root key certificate

See trusted certificate

schema

1. Database schema: A named collection of objects, such as tables, views, clusters, procedures, packages, attributes, object classes, and their corresponding matching rules, which are associated with a particular user. 2. LDAP directory schema: The collection of attributes, object classes, and their corresponding matching rules.

schema mapping

See user-schema mapping

Secure Hash Algorithm (SHA)

An algorithm that assures data integrity by generating a 160-bit cryptographic message digest value from given data. If as little as a single bit in the data is modified, the Secure Hash Algorithm checksum for the data changes. Forgery of a given data set in a way that will cause the Secure Hash Algorithm to generate the same result as that for the original data is considered computationally infeasible.

An algorithm that takes a message of less than 264 bits in length and produces a 160-bit message digest. The algorithm is slightly slower than MD5, but the larger message digest makes it more secure against brute-force collision and inversion attacks.

Secure Sockets Layer (SSL)

An industry standard protocol designed by Netscape Communications Corporation for securing network connections. SSL provides authentication, encryption, and data integrity using public key infrastructure (PKI).

server

A provider of a service.

service

1. A network resource used by clients; for example, an Oracle database server.

2. An executable process installed in the Windows registry and administered by Windows. Once a service is created and started, it can run even when no user is logged on to the computer.

service name

For Kerberos-based authentication, the kservice portion of a service principal.

service principal

See principal

service table

In Kerberos authentication, a service table is a list of service principals that exist on a kinstance. This information must be extracted from Kerberos and copied to the Oracle server computer before Kerberos can be used by Oracle.

service ticket

Trusted information used to authenticate the client. A ticket-granting ticket, which is also known as the initial ticket, is obtained by directly or indirectly running okinit and providing a password, and is used by the client to ask for service tickets. A service ticket is used by a client to authenticate to a service.

session key

A key shared by at least two parties (usually a client and a server) that is used for data encryption for the duration of a single communication session. Session keys are typically used to encrypt network traffic; a client and a server can negotiate a session key at the beginning of a session, and that key is used to encrypt all network traffic between the parties for that session. If the client and server communicate again in a new session, they negotiate a new session key.

session layer

A network layer that provides the services needed by the presentation layer entities that enable them to organize and synchronize their dialogue and manage their data exchange. This layer establishes, manages, and terminates network sessions between the client and server. An example of a session layer is Network Session.

SHA

See Secure Hash Algorithm (SHA)

shared schema

A database or application schema that can be used by multiple enterprise users. Oracle Advanced Security supports the mapping of multiple enterprise users to the same shared schema on a database, which lets an administrator avoid creating an account for each user in every database. Instead, the administrator can create a user in one location, the enterprise directory, and map the user to a shared schema that other enterprise users can also map to. Sometimes called user/schema separation.

single key-pair wallet

A PKCS #12-format wallet that contains a single user certificate and its associated private key. The public key is imbedded in the certificate.

single password authentication

The ability of a user to authenticate with multiple databases by using a single password. In the Oracle Advanced Security implementation, the password is stored in an LDAP-compliant directory and protected with encryption and Access Control Lists.

single sign-on (SSO)

The ability of a user to authenticate once, combined with strong authentication occurring transparently in subsequent connections to other databases or applications. Single sign-on lets a user access multiple accounts and applications with a single password, entered during a single connection. Single password, single authentication. Oracle Advanced Security supports Kerberos, DCE, and SSL-based single sign-on.

smart card

A plastic card (like a credit card) with an embedded integrated circuit for storing information, including such information as user names and passwords, and also for performing computations associated with authentication exchanges. A smart card is read by a hardware device at any client or server.

A smartcard can generate random numbers which can be used as one-time use passwords. In this case, smartcards are synchronized with a service on the server so that the server expects the same password generated by the smart card.

sniffer

Device used to surreptitiously listen to or capture private data traffic from a network.

sqlnet.ora file

A configuration file for the client or server that specifies:

The sqlnet.ora file typically resides in $ORACLE_HOME/network/admin on UNIX platforms and ORACLE_BASE\ORACLE_HOME\network\admin on Windows platforms.

SSO

See single sign-on (SSO)

System Global Area (SGA)

A group of shared memory structures that contain data and control information for an Oracle instance.

system identifier (SID)

A unique name for an Oracle instance. To switch between Oracle databases, users must specify the desired SID. The SID is included in the CONNECT DATA parts of the connect descriptor in a tnsnames.ora file, and in the definition of the network listener in a listener.ora file.

ticket

A piece of information that helps identify who the owner is. See service ticket.

tnsnames.ora

A file that contains connect descriptors; each connect descriptor is mapped to a net service name. The file may be maintained centrally or locally, for use by all or individual clients. This file typically resides in the following locations depending on your platform:

token card

A device for providing improved ease-of-use for users through several different mechanisms. Some token cards offer one-time passwords that are synchronized with an authentication service. The server can verify the password provided by the token card at any given time by contacting the authentication service. Other token cards operate on a challenge-response basis. In this case, the server offers a challenge (a number) which the user types into the token card. The token card then provides another number (cryptographically-derived from the challenge), which the user then offers to the server.

transport layer

A networking layer that maintains end-to-end reliability through data flow control and error recovery methods. Oracle Net Services uses Oracle protocol supports for the transport layer.

trusted certificate

A trusted certificate, sometimes called a root key certificate, is a third party identity that is qualified with a level of trust. The trusted certificate is used when an identity is being validated as the entity it claims to be. Typically, the certificate authorities you trust are called trusted certificates. If there are several levels of trusted certificates, a trusted certificate at a lower level in the certificate chain does not need to have all its higher level certificates reverified.

trusted certificate authority

See certificate authority

trust point

See trusted certificate

username

A name that can connect to and access objects in a database.

user-schema mapping

An LDAP directory entry that contains a pair of values: the base in the directory at which users exist, and the name of the database schema to which they are mapped. The users referenced in the mapping are connected to the specified schema when they connect to the database. User-schema mapping entries can apply only to one database or they can apply to all databases in a domain. See shared schema

user/schema separation

See shared schema

user search base

The node in the LDAP directory under which the user resides.

views

Selective presentations of one or more tables (or other views), showing both their structure and their data.

wallet

A wallet is a data structure used to store and manage security credentials for an individual entity. A Wallet Resource Locator (WRL) provides all the necessary information to locate the wallet.

wallet obfuscation

Wallet obfuscation is used to store and access an Oracle wallet without querying the user for a password prior to access (supports single sign-on (SSO)).

Wallet Resource Locator

A wallet resource locator (WRL) provides all necessary information to locate a wallet. It is a path to an operating system directory that contains a wallet.

Windows native authentication

An authentication method that enables a client single login access to a Windows server and a database running on that server.

WRL

See Wallet Resource Locator

X.509

An industry-standard specification for digital certificates.

PK$e|QQPK&AOEBPS/preface.htmlk Preface

Preface

Welcome to the Oracle Database Enterprise User Security Administrator's Guide for the 11g Release 2 (11.2) Oracle Database.

Oracle Database contains a comprehensive suite of security features that protect your data. These features include database privileges, roles, and integration with the Oracle Identity Management infrastructure for identity management services. Identity management refers to the process by which the complete security lifecycle—account creation, suspension, modification, and deletion—for network entities is managed by an organization.

The Oracle Database Enterprise User Security Administrator's Guide describes how to implement, configure, and administer Oracle Database users in Oracle Internet Directory, the directory service provided by the Oracle Identity Management platform.

This preface contains these topics:

Intended Audience

The Oracle Database Enterprise User Security Administrator's Guide is intended for security administrators, DBAs, and application developers who perform one or more of the following tasks:

To use this document, you need a working knowledge of SQL and Oracle fundamentals. You should also be familiar with Oracle security features described in "Related Documents".

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible to all users, including users that are disabled. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

Deaf/Hard of Hearing Access to Oracle Support Services

To reach Oracle Support Services, use a telecommunications relay service (TRS) to call Oracle Support at 1.800.223.1711. An Oracle Support Services engineer will handle technical issues and provide customer support according to the Oracle service request process. Information about TRS is available at http://www.fcc.gov/cgb/consumerfacts/trs.html, and a list of phone numbers is available at http://www.fcc.gov/cgb/dro/trsphonebk.html.

Related Documents

For more information, see these Oracle resources:

Many of the examples in this book use the sample schemas, which are installed by default when you select the Basic Installation option with an Oracle Database installation. Refer to Oracle Database Sample Schemas for information on how these schemas were created and how you can use them yourself.

To download free release notes, installation documentation, white papers, or other collateral, please visit the Oracle Technology Network (OTN). You must register online before using OTN; registration is free and can be done at

http://www.oracle.com/technology/membership/index.html

If you already have a username and password for OTN, then you can go directly to the documentation section of the OTN Web site at

http://www.oracle.com/technology/documentation/index.html

For conceptual information about the security technologies supported by Enterprise User Security, you can refer to the following third-party publications:

Conventions

This section describes the conventions used in the text and code examples of this documentation set. It describes:

Conventions in Text

We use various conventions in text to help you more quickly identify special terms. The following table describes those conventions and provides examples of their use.

ConventionMeaningExample
BoldBold typeface indicates terms that are defined in the text or terms that appear in a glossary, or both.When you specify this clause, you create an index-organized table.
ItalicsItalic typeface indicates book titles or emphasis.Oracle Database Concepts

Ensure that the recovery catalog and target database do not reside on the same disk.

UPPERCASE monospace (fixed-width) fontUppercase monospace typeface indicates elements supplied by the system. Such elements include parameters, privileges, datatypes, RMAN keywords, SQL keywords, SQL*Plus or utility commands, packages and methods, as well as system-supplied column names, database objects and structures, usernames, and roles.You can specify this clause only for a NUMBER column.

You can back up the database by using the BACKUP command.

Query the TABLE_NAME column in the USER_TABLES data dictionary view.

Use the DBMS_STATS.GENERATE_STATS procedure.

lowercase monospace (fixed-width) fontLowercase monospace typeface indicates executable programs, filenames, directory names, and sample user-supplied elements. Such elements include computer and database names, net service names and connect identifiers, user-supplied database objects and structures, column names, packages and classes, usernames and roles, program units, and parameter values.

Note: Some programmatic elements use a mixture of UPPERCASE and lowercase. Enter these elements as shown.

Enter sqlplus to start SQL*Plus.

The password is specified in the orapwd file.

Back up the datafiles and control files in the /disk1/oracle/dbs directory.

The department_id, department_name, and location_id columns are in the hr.departments table.

Set the QUERY_REWRITE_ENABLED initialization parameter to true.

Connect as oe user.

The JRepUtil class implements these methods.

lowercase italic monospace (fixed-width) fontLowercase italic monospace font represents placeholders or variables.You can specify the parallel_clause.

Run old_release.SQL where old_release refers to the release you installed prior to upgrading.


Conventions in Code Examples

Code examples illustrate SQL, PL/SQL, SQL*Plus, or other command-line statements. They are displayed in a monospace (fixed-width) font and separated from normal text as shown in this example:

SELECT username FROM dba_users WHERE username = 'MIGRATE';

The following table describes typographic conventions used in code examples and provides examples of their use.

ConventionMeaningExample
[ ]
Anything enclosed in brackets is optional. 
DECIMAL (digits [ , precision ])

{ }
Braces are used for grouping items. 
{ENABLE | DISABLE}

|

A vertical bar represents a choice of two options. 
{ENABLE | DISABLE}
[COMPRESS | NOCOMPRESS]

...
Ellipsis points mean repetition in syntax descriptions.

In addition, ellipsis points can mean an omission in code examples or text.

 
CREATE TABLE ... AS subquery;

SELECT col1, col2, ... , coln FROM employees;
Other symbolsYou must use symbols other than brackets ([ ]), braces ({ }), vertical bars (|), and ellipsis points (...) exactly as shown. 
acctbal NUMBER(11,2);
acct    CONSTANT NUMBER(4) := 3;

Italics
Italicized text indicates placeholders or variables for which you must supply particular values. 
CONNECT SYSTEM
Enter password: password
DB_NAME = database_name

UPPERCASE
Uppercase typeface indicates elements supplied by the system. We show these terms in uppercase in order to distinguish them from terms you define. Unless terms appear in brackets, enter them in the order and with the spelling shown. Because these terms are not case sensitive, you can use them in either UPPERCASE or lowercase. 
SELECT last_name, employee_id FROM employees;
SELECT * FROM USER_TABLES;
DROP TABLE hr.employees;

lowercase
Lowercase typeface indicates user-defined programmatic elements, such as names of tables, columns, or files.

Note: Some programmatic elements use a mixture of UPPERCASE and lowercase. Enter these elements as shown.

 
SELECT last_name, employee_id FROM employees;
sqlplus hr/hr
CREATE USER mjones IDENTIFIED BY ty3MU9;

Conventions for Windows Operating Systems

The following table describes conventions for Windows operating systems and provides examples of their use.

ConventionMeaningExample
Choose Start > menu itemHow to start a program.To start the Database Configuration Assistant, choose Start > Programs > Oracle - HOME_NAME > Configuration and Migration Tools > Database Configuration Assistant.
File and directory namesFile and directory names are not case sensitive. The following special characters are not allowed: left angle bracket (<), right angle bracket (>), colon (:), double quotation marks ("), slash (/), pipe (|), and dash (-). The special character backslash (\) is treated as an element separator, even when it appears in quotes. If the filename begins with \\, then Windows assumes it uses the Universal Naming Convention.c:\winnt"\"system32 is the same as C:\WINNT\SYSTEM32
C:\>Represents the Windows command prompt of the current hard disk drive. The escape character in a command prompt is the caret (^). Your prompt reflects the subdirectory in which you are working. Referred to as the command prompt in this manual. 
C:\oracle\oradata>
Special charactersThe backslash (\) special character is sometimes required as an escape character for the double quotation mark (") special character at the Windows command prompt. Parentheses and the single quotation mark (') do not require an escape character. Refer to your Windows operating system documentation for more information on escape and special characters. 
C:\>exp HR/HR TABLES=employees QUERY=\"WHERE job_id='SA_REP' and salary<8000\"

HOME_NAME
Represents the Oracle home name. The home name can be up to 16 alphanumeric characters. The only special character allowed in the home name is the underscore. 
C:\> net start OracleHOME_NAMETNSListener
ORACLE_HOME and ORACLE_BASEIn releases prior to Oracle8i release 8.1.3, when you installed Oracle components, all subdirectories were located under a top level ORACLE_HOME directory. The default for Windows was C:\orant.

This release complies with Optimal Flexible Architecture (OFA) guidelines. All subdirectories are not under a top level ORACLE_HOME directory. There is a top level directory called ORACLE_BASE that by default is C:\oracle\product\10.1.0. If you install the latest Oracle release on a computer with no other Oracle software installed, then the default setting for the first Oracle home directory is C:\oracle\product\10.1.0\db_n, where n is the latest Oracle home number. The Oracle home directory is located directly under ORACLE_BASE.

All directory path examples in this guide follow OFA conventions.

Refer to Oracle Database Installation Guide for Microsoft Windows for additional information about OFA compliances and for information about installing Oracle products in non-OFA compliant directories.

Go to the ORACLE_BASE\ORACLE_HOME\rdbms\admin directory.

PK۶ qklkPK&AOEBPS/index.htm? Index

Index

A  C  D  E  G  K  M  N  O  P  R  S  U  V 

A

Active Directory Integration, C.1
ATTENTION_DESCRIPTION column, A.2.2

C

CASCADE parameter, A.2.3
CASCADE_FLAG column, A.2.2, A.2.2.1
CONNECT, 1.3, 1.3

D

database links
RADIUS not supported, 1.4
DBPASSWORD column, A.2.2
DBPASSWORD_EXIST_FLAG column, A.2.2, A.2.2.1
directory administrative groups
OracleContextAdmins, 1.1.3.6
OracleDBAdmins, 1.1.3.6
OracleDBCreators, 1.1.3.6
OracleDBSecurityAdmins, 1.1.3.6
OraclePasswordAccessibleDomains list, 1.1.3.6
OracleUserSecurityAdmins, 1.1.3.6
DIRPASSWORD column, A.2.2

E

enterprise user security
components, 1.5
configuration flow chart, 4.1
configuration roadmap, 4.2
directory entries, 1.1.3
enterprise domains, 1.1.3.3
enterprise roles, 1.1.3.2
enterprise users, 1.1.3.1
mapping, 1.2.3
global roles, 1.1.3.2
overview, 1.1
shared schemas, 1.2.1
configuring, 1.2.2
tools summary, 3.1
using third-party directories, 1.1.2

G

groups
OracleContextAdmins, 1.1.3.6
OracleDBAdmins, 1.1.3.6
OracleDBCreators, 1.1.3.6
OracleDBSecurityAdmins, 1.1.3.6
OraclePasswordAccessibleDomains list, 1.1.3.6
OracleUserSecurityAdmins, 1.1.3.6
GT GlossaryTitle, Glossary

K

KERBEROS_PNAME column, A.2.2

M

MAPPING_LEVEL column, A.2.2, A.2.2.1
MAPPING_TYPE column, A.2.2, A.2.2.1
mkstore utility, 4.5.3.1

N

NEEDS_ATTENTION_FLAG column, A.2.2
nickname, 4.3

O

OLD_SCHEMA_TYPE column, A.2.2
Oracle Internet Directory
version supported by Enterprise User Security, 1.1.2
Oracle JDBC OCI driver
used by user migration utility, A.2
OracleContextAdmins directory group, 1.1.3.6
defined, Glossary
OracleDBAdmins directory group, 1.1.3.6
concepts, 1.1.3.4
defined, Glossary
OracleDBCreators directory group, 1.1.3.6
defined, Glossary
OracleDBSecurityAdmins directory group, 1.1.3.6
defined, Glossary
OraclePasswordAccessibleDomains list directory group, 1.1.3.6
defined, Glossary
OracleUserSecurityAdmins directory group, 1.1.3.6
defined, Glossary
ORCL_GLOBAL_USR_MIGRATION_DATA interface table, A.2.1.1
access to, A.2.2
ATTENTION_DESCRIPTION column, A.2.2
CASCADE_FLAG column, A.2.2, A.2.2.1
DBPASSWORD column, A.2.2
DBPASSWORD_EXIST_FLAG column, A.2.2, A.2.2.1
DIRPASSWORD column, A.2.2
KERBEROS_PNAME column, A.2.2
MAPPING_LEVEL column, A.2.2, A.2.2.1
MAPPING_TYPE column, A.2.2, A.2.2.1
NEEDS_ATTENTION_FLAG column, A.2.2
OLD_SCHEMA_TYPE column, A.2.2
PASSWORD_VERIFIER column, A.2.2
PHASE_COMPLETED column, A.2.2, A.2.2.1
SHARED_SCHEMA column, A.2.2, A.2.2.1
USERDN column, A.2.2, A.2.2.1
USERDN_EXIST_FLAG column, A.2.2, A.2.2.1
USERNAME column, A.2.2

P

paragraph tags
GT GlossaryTitle, Glossary
Password Policies, 1.1.3.7
PASSWORD_VERIFIER column, A.2.2
PHASE_COMPLETED column, A.2.2, A.2.2.1
proxy
connect, 1.3, 1.3

R

RADIUS
database links not supported, 1.4

S

shared schemas, 1.2.2
SHARED_SCHEMA column, A.2.2, A.2.2.1
SSL External Users Conversion Script, B.1
SYS schema, A.2.1.1

U

Upgrade EUS, D.1
user migration utility
access to interface table, A.2.2
accessing help, A.6.1
ATTENTION_DESCRIPTION column, A.2.2
CASCADE parameter, A.2.3
CASCADE_FLAG column, A.2.2, A.2.2.1
certificate authenticated users, A.2.4
DBPASSWORD column, A.2.2
DBPASSWORD_EXIST_FLAG column, A.2.2, A.2.2.1
directory location of utility, A.3
DIRPASSWORD column, A.2.2
example
parameter text file (par.txt), A.7.3
users list text file (usrs.txt), A.7.3
using CASCADE=NO, A.7.2
using CASCADE=YES, A.7.2.1.2
using MAPSCHEMA=PRIVATE, A.7.1
using MAPSCHEMA=SHARED, A.7.2
using MAPTYPE options, A.7.2.2
using PARFILE, USERSFILE, and LOGFILE parameters, A.7.3
KERBEROS_PNAME column, A.2.2
LOGFILE precedence, A.7.3
MAPPING_LEVEL column, A.2.2, A.2.2.1
MAPPING_TYPE column, A.2.2, A.2.2.1
MAPSCHEMA parameter
PRIVATE, A.6.11
SHARED, A.6.11
MAPTYPE parameter
DB mapping type, A.6.12
DOMAIN mapping type, A.6.12
ENTRY mapping level, A.6.12
SUBTREE mapping level, A.6.12, A.7.2.2.1
NEEDS_ATTENTION_FLAG column, A.2.2
OLD_SCHEMA_TYPE column, A.2.2
ORCL_GLOBAL_USR_MIGRATION_DATA interface table, A.2.1.1
password authenticated users, A.2.4
PASSWORD_VERIFIER column, A.2.2
PHASE_COMPLETED column, A.2.2, A.2.2.1
retrieving dropped schema objects, A.7.2.1.2
shared schema mapping, A.2.3
SHARED_SCHEMA column, A.2.2, A.2.2.1
SSL authentication for current release, A.2.4
SYS schema, A.2.1.1
USER parameter
ALL_EXTERNAL, A.6.7
ALL_GLOBAL, A.6.7
LIST, A.6.7
USERSFILE, A.6.7
USERDN column, A.2.2, A.2.2.1
USERDN_EXIST_FLAG column, A.2.2, A.2.2.1
USERNAME column, A.2.2
uses Oracle JDBC OCI driver, A.2
X.509 v3 certificates, A.2.4
USERDN column, A.2.2, A.2.2.1
USERDN_EXIST_FLAG column, A.2.2, A.2.2.1
USERNAME column, A.2.2

V

viewing the database wallet DN, 4.5.3.1
PK 7??PK&AOEBPS/img/getstrtd1.gifMGIF89aΜBBBΜccc1cccck119BBJJ֭{{99RRZZ))cckk11ss!!便ss{Δޥ{{19Bckskks99BZZcBJJ{1c!,LMȳϿ˧$$pࠪ=|E-YBY AETa%3jܸɩ \l@d&,2adI ##B~Btpi2È&@BB:pPB!FVOqY5q"ŪSYqʵj|9t*PhTkn# .F@*]@h~AhREQ18Zc&Ӫ^mlm ,0Eн$Jؐ;T&XlH,J$tbUݣwuwVQyQ_˟/8qfa`}5 \`bBā'4[(\)d ("tEԐE(r7Eԭbz-H1zُߐD_J y "p^lup!P,Bf)+d j )Z7?ښZ4fi) ꢣ&8'0kR#t Є fmǹߵ{y(X-Z~rd 0LpeS{ I;X^xrn)élIohn);ky'<⾋NX WM 09_ 3"dQo`)/[߸o  ;M]X* H Z`+%H ƒ ,@A^(?@… c( p ?p&Lh pDb0=E)W̢H.z+B2&Їg(E5p$0‘ob(kt h c!=wԠ ;RIAVRkGJ^L% (CRCCβ|]KU~0`L1feΌ4ӷiZDnz 8IrL:vz xKMz|K3~LN;'LC0㴩{GL"61Wat1gLô1wJt1LD!'42<@%3s2>)S2|<-s<2(1>0|>3p3 9έQ3,;ϼ3LA3 E3ѩp4']bCS4)MCӞf4CQЦ>5Sj>x~5,Yùֶf3s]̾5-l.XپpMSf7SL==ںvqNx׭X.>@۽Swv􀒷O?Gt3:a𤓾e+r>ٖF~ {_k;ЏO[Ͼ{O_N>ӯ~0~?Y,'1bbW{FxM 1v8g 4Xcxʗxf؁ (L"8T&c[,H.A28e1X^t8Xd4KCB8DXFxHJL؄NPQ(D@>PXZ\؅^`b8dXfxeT؃+v\)T[etevdlh?ЇW$3+F@d$7 8> FcXAXt芚ȉ䉱芠 t8(($f؈p (hȌEdX0؋H nܨa(@x戍Xb˒XhxXɏaLa I䨎yMI?h>HDv峒)M.e3a+d5>0I>@B9DYFyHJLٔNN>(79WVyXiMRؕ^`bRIeWhjlٖiӓᓓL#CKf샗e~ȒxXK|Ye[q`舍ٙw!ɚ#ٚ蚲m1茭8%9əYHi> {8(xi ɘɒӜ؏Y zdeg乘јhG֞#PM؉H eْd :d >8 dZLLcj?L? ":$Z"Y9f١,a+3c9di.Lg:e1Z0z MY=jl7LAj .yEڂGzLIZ jLzi?,Qh0IY6zNa6Fz=[TJVq& bʆdpiڤ I@ىاI]_J鏇ީYzȥPB饓֜ 騃**C ƦԨy,Y J Jh٫ZI$iEi ))J ܪKY: ZzxXNZt`vzeW,jkFL [s6 б ";!EgI`,۲.0.2[ 1 :<+<Ct{f5гF{57 8L-F7M 3`P+^+@XE T벃0QKn+ 9cK0еj˲o }p+ Pv; i˷+ Si븍+[@y/[}˸/K{ =۸.{Aй;G@-D>{0P@+ 2뷀:A;7:=Bн ۾H` ۿk&|D& q̇ d|Ԥ< IW&|(*,. 2<4\6|8:<;PKoJPK&AOEBPS/img/getstrtd16.gif$GIF89a,@@@fff3fdcem02:tu}𛜡抋xzރإ˺񫭳{|}ɼgjp58@qrzmotZ[b΋stzвΈ<>EFIO텆3f!,,GHɂFFҲF H*\ȰÇ#JHŋ34p _4Iɓ(S\ɲ%:ҥ͛8sɳO09hdȟH*]ʴS򈤀ѨXjʵׯ`ÊKٳhӪ]˶۷pʝKW2gʷ߿ LÈ+^̸ǐ#KL˘3:t&-CMӨS^ͺװc˞M۸sͻo95vz7FbYG! g2:fI:&z"z2魸"7ଏz*lʫ.Z뫧byo~:fj쯾Zmv{HZ)[j˴z٧ͶfjKg:.)ܪEk0"鰕*Y-Ć kwq|},̹"&[q,r,a8<@-DmH'L7PG-T=U3g/o׸v dw)vhjvl-7;,`x|70u-܈E4G.?,^o~.q'.0O.뜯~1 yn#T>1 (CGA ;==_}#/ &G~k \W hH?y `"]`P?86gh<ca BFa"CP? XpL!ǑPBEprW!h F\!ƙ0 0roT" |j` YXɥ@b$3(O t^3Fn2E%@.t_@I<f8%-gK\F rKf1awAU=4Y]38rL:t2h׳}ny?Z߲6]^m` ]~s567EZ[5cpUZoR WS6XsԠÁ q 0*A*==dtqHN&;PKYhXβ.{`O*Ck_igydE~\Y\^FwΟE:yn%[ vSsZAItTF#ҤS{\ϙpf6g]tv7}\F8f5eXgww?q˗޽mق.S-Gm`]`ֺ2{Z]~\渼ck J#?b-DI85rB99aĊr4E@$9@d_3vTGmT^"2"GhG+ԉw4Ԉ8EcJh6Ո+TLT8ʴKĎ5Œ2MM8+ԏOH#8# P P9#ʷ i|USyّ Y5 D &I %'y,(ْ-2i4]69xcѓDICFpД RsPKiQMI^ ]Tua@@^ٕYiA[2)ɖa vpV`wf46zYjop h闂I)_iIdcBɘə`ɖUym|9#9j QIwٜƉ)3COYby͉̩ 霴Y9Ijc$i9iI9ΉZiٙ㙛d2i9Y  ʟ`PJ)Cڡ :$Z#[&,.6z8:<ڣ>@B:DZFzHJLڤNPR::ڛyZ\ڥ^`b:dZfzhjlڦnpr:tZvz]j!٧~:YXڨRs**کAHçZzJWS 6<#j8çJګz4 (y=C>C*ڬ59z3z*ښܺz` z蚮I#:I媬ʭካՊJ ʮAij*[{(33˱Z{(*O ƺ"{[պ<۳>-z:8;Ck?R;KXJZ\V몗ڵb;d4_Iel۶>s/T:t[v{xz|۷~I9xZ{۸ ;#{۹ +ۺ8K{MC ;Ƌsۼ{F%8۽ૻI᛾껾۾4$Y7؋{ 9ۻ\|ۿ9[PwTMKK\JS}[sk£Ǹ.°K`°ú< @29H|èA@II]ĚIJEKtdžBaFQd=vIsXJǂ>sDŽ@|DHj<{ Gy@: D]F}$J݅PMyV}v8X~c8S2 acm_1 km]i1 u w-sm087 =у}.&? ]Òԍ,ͬ|d@ٖ͋]JV8כ.vEH/dB$؍TH|یڹB H- ܮ<ܐ Ͷ ͵8ɘNLH\-⌲̜ۛ8҈ }lT8ݪ._܈|ۘ -߼]஝߷8E @} ~ŨI9 ,Ⱥ !#)︺ +-)( 573(@nN A^4RN LTPQJ|R\g_^nGi8f>FhKl>CnrN?5sxz4 ~>^~ ;PK w )$PK&AOEBPS/img/netca3.gifBqGIF87aXBAB΄cecZ9ekތBmZƜ{J}Z{{ss甾k{ΔJuRycJuޭkƌJukRBu)Y{s{քc9mR}9ms1e眾s1eBu{ޔޥZs޵ޜ1YkεޔֽsEkBmRZcƌ9m9a9a)QRRJ}JuBu{ckcc{{k4sRm1Y{scZcycekRiRu{uZc]RBiJ}{}{޵J]sýsϵkRMR{ƥ{έƾ޵ǔｺｲ۽snj9mϜלۥόׄkהیJJߔB}9u1m$k,XH*\ȰÇ#JHŋ3jȱǏ C$ (S\ɲ˗0cʜI͛8sɳϟ@ Jѣ'0ӧPJJիX>TjRׯ`ÊKٳ2 Э۷pʝKݻx˷߿ LÈ+^XqڥKL˘3k̹gLӨS^3MmCmM۸s޽wBj+'|}+M6q*ۀfϻ=6Ǜw=~홧T>}5_tH} tT@=XpÍz x偷mxx _g+j`1 F#EaNXpY~*d[^zQ\ݘ%1$~!I)fhy&/&)&cIfeNp*a g^rI'x9mf&Imrg%BZg$|'a"&ꦓklBJk֪d:kު啻F, ꪢbXl z}kAAD "^ݟ+I(b-"Hۚy07+1<1gʨ&cZЦIa⚬os'*eZ#6RG :0J'H Z37z.BGH(LD*D0 gH8̡w@ H"HLD%zPH*ZX̢E">` H2hL 6pHG!x̣>w IBP $"F:}T$$'IJZR$&7Nz(GIRFlk1*WV1,gIK;R ̥.wK҅I0IbL2f:49_̦6n& +ozL:)v$:Iz'i~ԧ@D~'AP gD9фn zΈr0?:L&I0)3Q*̐*SdiJRj8u!GezҞti1 ԕH=*2QJҏ6UL?jҚ&!Xh< T>W*բ*3AOZ֩Δ =fVP4xjWӚ׽tkk\}jU ~=&Q?JBjXJLUi%j[WlUժרM;JΖOYJMk٘V]UK\pBfe [ʶG-`vumPM\'vݧҶe.Wͻ6mz[%kZ^ÞW/}[7lO^5%kTl_1o-|] x./ {x1+࠶6pm5l8^qma!N ש2r)c#=W8Aze.+DϬ0Yp%9qY,r|c1|3`;Xz.q|8;z4\9T9ɓNB?jiDu'lI\4E=_=NMJNXԝ.57@\zӻVzy=lM;}FvsgfZě6=i`ӜNqȭv=vL:>n=ھ洪mPZ4}j~S4x[rNnh[~}l{ 6q=# NBXx K,״rkՖsjq3ڪ^ʅp\閸K?gy>u86uRyԑli:Mv58ց.u]~vc~:w >;-cmOܟ7;K<^;Ko1E드vŝ@>[I~|G {z>G=w|7g{sP~yzw~,{ķi}~{7zMpׁ'G(~G*8Fg X~5H2/ ~>|W&xXm#X=tROsvC6×7(7 6|c{z|0(fxwA3=HF'qb}SX{n8~xX@^y(HG*1,J:N = :T]EJGjېypk/ڦEЦb 8Dڣvc*f:r^S xOm sz{v:ڣ_Ijsz7Z kZJ*Jʪ- )z nɨyj}+J:JazjڬڕZtzʬYCjpdʬ̺ϚjxzljoZzꩆʪz*J:ź jj*j{:{Z  %kZgzDZ96K:窱8+'K+;˱ .JC* ۀC=9Kʵa˴ʪV[X r;\_۲Q0;pysyK+;*,Zli*yf۰ 5;o`k{[뺴 ˺{˷S;Cě[˴˹˼p;۸hۼ Ż{;hۼ ǫԋ뽺+[˾[k +k*+r[w;uʽLϫ ,\;֋!K ۼԻ/+8+Ĩ;Ӌ"<6|ø{LAl [Y|8,Ylc,b\1/ la6|L\.h N\G|ƀxr {P{WP ܥ$N.N (~jW=⿽]?>2ߤ{PCM ^֝G2 0  Gⳍ]p0 P ` j"nM.窍g拮M:P ʠ P p jn5nu^ P P  nܶNnUn.^Ṏw Ǟ}z}Pnʐ p p Nm#jpbN밎 > >>z>N^{4nǮP p p . " n#@b^  35OPM?? ~ oy~B?n~ ̰ O ZZ6_ ʐ PP 5"O. ȐnpP C_QP+ȾG.; ` \qon 0 1!]OOt P ^ o?/?Cno/w E `\r/3/m Zo /6o P p `@a F`Aٳ@-^ĘQF=~RH%MDRJ-]T ip΄(2_ȨQ[gȘ2uSjJRRU*mj,XZdǞ/IcfiT谮ބzy,ѡ6 FXbƍ?)MīC%K|UW[. iUd5{v,eɤ5Ý5޿,aS^ᘁ7~rJ/2K-ˊ2.jXrLh3Td/bq`|f?g- 1H!Q)C2GUl!&%QDsYd -Si.SKqMԴu`Jl͗er3W{VUtiCEC4`du]Ó=Uo}9`eD yٸwf~;noHhXjVZiltr_FflaыD8~)[>];vgP<_KGeex+)V[YF-Sf?zɆ^p`fm5V-N=a$=wߖv߇:;J_=}yܫ -z \-OeӼգWѻ6 .׭|;߇Bu/~'Da 3? CR a@-:+l EQ!kXy Չ#ї:~SaF p1Zded SF5k,G"G1tִյ_k_ϴ~\_K֎6-pZƕy f>U2״,ĩ۞ge_ivAe/+^nFK>*SKu~5mU˷ Wh@1`ٞտo\k֞w]ok&XV+K#%fA^=ahʹbNsalc#7NF1tUb t*sG,RWF0lQ~x`](;+ <=< 1>@=D7^(Z>( ܾʫ)1i@ы.BB/$LȄ:01Da(C2$DKCի T@]@Ŀ ;D7^HXDdء_>'D>K$*MBm E/URT:(24G2$GU\S,tT?{=k=ȃH#ƿ|EB ;$D7ЅUX`0aDgFHh4һFFmnF^Ur,q,ErLG,GC#;ĝǘIE7F7(DaʨNHdLW0$Ǐ4GLd3˵EDCt䈚,F D\K4BvYĄdh\JaM$@lȩTdt4Hɰ,VӁ> 9kM F<$_D,ĺDc䄒Xx&fpTJˣ4?4̋Mͫt tKU,<1LCǴ;h@}>t ( p  PT^8HDM|OmD߬OUM NGORTd= HɕdI,P %>Pɺ\Kepc \E.5?\QOH^xQQQ$Is,I6\ E'e=G }R$D P UQY!d_R/MQ.sUuب-]^{װY~YmցE[ٜh5IQEŠS8\;DˉPZu۩P\3WZZHTڕAJ-3ٛE۴5XQuL:}ۋE-uSuە+Pܲ]_FHWXU^ΝeE9m<˼]רHZ݀_7۽]][]I^mVXɥ\=[E^]彄}E[-]=ue_XF``ٕU_^_Tx_JU`VLTEa5 L<fcdQ~Nv棙Hx9~eހjM[Y['\)NA*K\bGm٭i^lffFf}.>Liff]M\Rȅp>[A6gEg=due]e`xgMczabe{fPg9~>隶iWif6_|nii @?芎eCƄ^fd.v~a.z-\V>hf꣞]l~0 glgfKf oe߁5]^fgOiE[U}.n78jKiik &6n6h2Ėfꃆ67cX`N}eYF^Fd\] km8$]E+Efnنiio.ph0oo;&Y>geFI`fy6~oi~n7HHqOii6FRxNpLSj%[hv?pX>6p+XUJqnoNqWq7W6wq!7s:r3o:mTxVH*'ggw]L`f0r-NGqKsDCLO܀3" iU"lI!GIaonaq;TteMh qFs1s1h~9Tv@坏AyzeyJ6y{P*IUZ };jRE6Y$2fwE!Roox(tRL!YO̍)1 dhh(Jv_EWR9Ez)QI{rٕթpͥS^*Tf9)9z_Mhd'quhg%=7>,e(Ǻ訴>5k-;.H|.|Z. ^kok}r d#ۤo}3;1Zn`b1VQǔ!clɍR2۲f\-Lsgv[rɂ|4҉]q_3%ȹ3Y 𑏃F<"H)&W!Pq7*υ!cDߝދ h+ĞnH;.rOv#?<C]i @*d ' C۝P$(C& ~;XNIITB"JBҕ\l ;W\L+H򄧬(efJQ-ya, knפ&7k9BmVsew9W^f7Up1'ҜKf#8ihЌgIɀs}AxP4fB9Nuԇ;'HC*RZ)AչMy'EZM[EK8O^J1ExTB9MmN}juJzy~ӟ=iM[Sʯ+6UB455a8S'W:ֲ&Ty*^אuϼ6VӧgR[EgV*u(RN+hC+Rš]*VWjZU,lzx֬a,[ ј*}iڰ6hhKw2}.t+Rֽ.v ]ђ(bsӚoO+ֶ7DM ^vUR%;m&W/,>03&hKv0ck [j^>CZWtgb,cNjzPv@ *.Ka  ;FqQwL.9Bo&oX-m^rc8yK>ud5+=64vVӼ8Vsv(f^`  ^5M` ` AA` * :` J_еA `za ar_ޭa B!Eay bzdđ=]@!0^@I"%$>%6#%*_%fb%.b"&#J#2"$: &+$,`Jb&΢,!V`Jh > #!!Ә bv"#f"ub45:4Nb ~",b-,%#4v)b"." ΕԜ[11"*b8b*))>:5*5`?b%:6@;fb:b53:$(#7ZAV2cQKXޤ@*?b3%OYN>JW>%YReA$Ob$X*R%ҼU^Pl]S%ON^$.>#Mb@>Nd[ddvQdYcbDi dh%XiFjMN @m"U9QƥZ%hDbfBh&^p2*oAo@k^ (F.i/륖mf fiko颦ү¯ojo& @@ozH\tADfxvm )diiBiF_.lv/ o.),ofo.fuȀ_"HDA*B*[f* ؀H񐖀isi qmʯp-^iRȀ  \h,Bh܁3 ABi~okn, uh-2..2sqW2E߲ pߦbjr.s2G m2Cst snA!H$fl@OŨ_)o &6cs07sɚ& HATAs@*-SY8A4B'B/R(5c4cjɢ@޳E_j1F+G-F7urtEO>@tA#ԁT`fL*2.Tp+>/"#r=tvw?A<@/ag=XARtt|VcjGu|&6tX5=gH{5HCsWo5V4F#s <A6& 0'  C>o\s1;i?* t@TKuIRuf2}\5WǵYu55\kjZu3vj_sv.lAt3k"iB@AAt \A<*j6~0PgsR;sh+Uљv2}o]_viw=[ct]wH|35=_shu>1 1 00AȀ p, `sho A  HAkv A%f1R>,7b7{O{Ҙ~YXwm&E6E}x@"=uRwCo4v@ $qs ucf  (AwwAAW@' t0"cs8TyېR6~8۷2s9\;~ǵ6=xx36 1z PA(+A\8wsi2b/g=66`z &z\V/XXϩwEܨXҥS{z|w}{@i#gcyQP`A0"@8!t ` x@( K:s9hJ#/ ]Wb^V':ӷ==;q lHzv BtiXw@*@(3A%! d&z Fuü_E| by(~U_%O3S>S>_Kt,[7zT 0A s{H$;  462 #{yC=/|dJ7 z7ߜ'{oyl7:{k3yS{?s)|66==@x!eȝ4nHD E Prd0ȉ,`D1`X҆'[2s$:йgO?:hQ= $-SRN6:NG 00`@R~+kXgѦUm[o5K`Vw -ZC(J.l(/NԘpɅ 'ly1ˇItYEKaH M̈1 4+HA! &Bʋ9ld<`J14 (s Jw[^|yZ 4zNZٱcտl:O ܉/*{m`L"c0"1Ĉ[5* M )+/fHܢ0b04*H.$Y!:똜 $1<#* 1 +/*rϧS/M3/º/;+=  ( !pBDU|"80mDVcK.IX&:H "7Bs R"5#,lHcד@1dl52T3>ONoM+g%*[]Euwu]]{UT4LC)ua=l!4$`!:2+VD) vb& yR4.RmR*=3)5[ ͠ʫ8 p.q]NsGnW^{]ŌjH&)8'PBe[q6V@`J!9 OhIB*&EU97iAirvEEKRy5m}Y]ZRX"𠄃Jƒ4 9@#b,|6:Y"%}ڽ Ӽs=ݡn c:ְ/kA )۱Nw "(C[;f2 wـ8@N2"Q  p XG  %YD!E~3r!NE 腺t)/4a2UA WpAi AC/A& 02(P8/Br 8 s ƒ.- ]IMKTZՅ4.TM @ ^WDX4e h%@p `bp!_pC F /0m$XA g Ux l1AqP$s(d@6-j'vJ;-ҵF<щFKVsgk^  53P^f5tøiUF @0+ '! 68%#fr.қ&"wpX\hE+>%eK`71<l"p-)Wi/!嫽Z[V%4׎uFA>,{yIO hz%]hmoۇmtO|)شűzՆfeB?voA D,LZ)@D (idǴA ~4 JH^ 8Jp !i8&*d%"t]]#&mt5۴j.a iml[ pdap"!pAR~u@p0T3C D D A"" 0 @I"7Zb],Uث7w!ONx}WLjA* Qh܊"8 1-{ [ !<h; PH1 @0'܁ S 0 zEuW]Rf۲-!yȏ/urS;-Lq0| >O <- o,b9 R@-$P/&>\ @ AG` @ @9 -k9ĤMdD. &ZNtx`pnv@`T ( @U!G .P GBCp:m Жqll@@r ` q`Z)y4Y [+o1iQE Ψm 4v ܀ .PNB4O >MlT` @4 e`.Bf`#` UT;Pe0lPy'eí}f`V@j6U[mlD1B :H@(=ml1(wC\ @ @C`΀R@R`H=@uxEavw [(6u}q, fxy:`h zc`@ G-@J |t v~ rKH1NwK ~t`x?]ˉWx:Aua,A > x@L 8 4  ZV LsJ& Ht}}؇쾖^wA=9Ey6Xu^wz0yؕwui9mG6؉q_w, 0x F, Ҁ> z`uqA  |-&4w9gMgy֊qYA֝O_[svEZŸ8qy {@@\7: 2@>`Z V 8 FS@v -EJP z1KY9xvS`vXI:-|kڜ؁[llzuw5Jw= >6 `Dd V`rqu]` 5OSAXsΙxX1@AQYv];{/:]TuYEv@?`t`\ql 82}?`}0:`p!t`Y@TQ1^]:)۔] S:@Z: +;[[28E[u`T畎?`AҀ qq \Z{ F%HwTN٧M {7ٔYװ-ْ[ExQ'GV:S}@ v 5$> \`\>&92b^c`@|)Y_ ZÍ' ˳|ɜ_<9<ု{`eÜWt@8wrqF{mδW~ ̗ܥUfش @AŵӼs;܉-IX t@] I[7,b{D{|aV۔U_;Ɨ`>=, L0o@&S£u;'֜Y՗x ~'`{  5ccnH4,c0 FiNKT }X}`89^^AF 20:t5L6CQ ٍӑn[]݀w3'[\,´},9>ҭu}P}9\I ~a` 0W0^@HC艽ҵ nK4Df@ ~M{A=W=c>M[=%›܁tٱ 6@ x1@HBC? >Z~@ ]HF`( FೌJ,`0.\H0!ƒ!~0 x2ȑ$K<2ʕ,[| 3̙4kڼsf3eEC*8NFǐ::px3,:D5 $v ">Di"ĉ(tP}I6XtX@WX`u) vjWYDaB`/xAI!F@`a$@ F"O#vҶCIEE4- ^^ЁfZĞ,04`8GX; EATeabhEym;z?(:|m`)h a(`RRAIҒ檹 c%\r2.JNx ?ABDpޕ P 8@`@:oD,U2?nz)E5+TAZ'Ԡ_] !V1Xq}l"hh(hA0 @20 ah ï 4 n/!B9'? %%Yc @fBTR d0-Ɖ > Z0`E @@*x t h` <$`HQ0xeά̷bLe(|kkfܬȄ"W .4` .`A$ށBm% Lt1f%b`#r BVlo``K"!/p$ A[ רϨJuI@Ā7@_Bgy CH q;VFJdm/uJoTЀ 8aW#!0'Z&0si07ZîB=@#$vmUKƑҬq(L V4%dH.@N p %"EdR2Tjk&!0Ad4H n&M&ml^q,ƶQ'SoiFS"}q#FDagxA hqMF `KuL pTY i^L=Ak@(<1ƒT+XK2PiD p, 4@wLfiIW Gp A-lg),2 3P&`: ʂ/0MA\kD" 7$.)a!yљ@/i>y$ ɀ2^HeE?P*W]TSq6ZQ~A+$ -(\#`,D:dLSq`XXG9d*L{ܠܴHxB|MU65s%pag; •Y no. a`!37Yفw, FM` pYfnggAYuQwG\7!` Ӧ cPH' Ha QtAX O`0f)|Ҭ/)sFVU`6zpy {Et|﮼eX&@mpv#@$`6p $W}~5J_ @ KTMr_x'_7j=xOa Da7uKd 6fo<Ѐy@& و['?SMw|5kUTMZ onn2vmGsi;UMpNt||#FF! * ~ aF0-"LGsrO'[;SdHs5InIGua'ͷCUP|cu^pr7orD"`&oZDЂ|$@#Yu5/0H"a7 |([8sK(Rj [L=4` xy׈6ICFd\6o$wa4};y t޶)7H0$0o-TCV| T) 5*\xtD荊Rx_ǂrUSpsŋFMFrCP6IExyw5PLƸ<Їf7n`@[L@t1;Px$'i((EHrgC FV}59|htEy?9d d&HHm!6m`&Ȑ+5"PCO5[LM8@5;0(0?"=Ɓp s "*E0ji8oC6FHgjzو&fu @ P0XC t$@sA[çvpv# 7@ OjW0-RQ5p04(*n9v؈tibw9Z*Zˇ=0xd}}HDJk}EL44 ` 0%r([ЌCfta9 ]A$;j)5x!ɩTՒg}0hCIePMՄe F*@QB@Cz` o4 ȂaPIcS/~vHy(0LA2q 0H]JzRŜz|YJG)ܷy7,*0}iuǝJpzuL@7Qi8L pF'`+Y@b0dB@Y_!C1A▎^jaOyٓIGIoTCpzj?>4 [IZ 0b}V95 IVU8C]rM$i9!y? 1 P @e% wJ pD0j  TW &D@j*` ;&VKP*K//5KbînZ 5aMH{S IT{&d8 fx,jÚ[eP4L  DMQ+BfcRjR{A2xvczsg `q D"U@9j;TP4I0qer<p!0s!B %?TPN-#'$ $! rx)!6yN Pf?)P S֘ }ofHLRENP4Ę< hԚ)$/5h!EuBXJJۻ݋V{0oӹ|fxdxVo{–鯫%ZMC@ 02"0hD–h@[6B-oBٴ1:Ƶ,Koװܫ*[sڑTMeW}m}W]-Dnu=ȍPι`~m~"Vn9~iߍyTUݒ䀾Z^%-[M ?K-XI%.ծ-:49mnT#3.7n#O>~ O=1}k!/#O%o')+-/1/3O5o79;=??)O;EzI]MtQO8UxYw]-aO6eDkmoqx+qwy{}2O?l}٘X(;s,;4gˤ0ch9h_94?#ٵ4339P=o9?ӟ_9!(Ο(O_b$1Rzpg}$XA  4P`B%<0 LG`HA(r1&TR`́8 ypfOAXsaE~Jlٔ#ψ 2-U*ؐWE42ԧ9b Z<ٲ6]yiFDJkGtzѥڈ}jkקb;-y2@ʸof2g}*QnN17r+k `h֩uhMԪ&hq^a/9Yb o׉tb7 UdJ31XYc?Yd^盃V)[9*rjzkɅkkQl%vm-{2i[n^W_o[&pW|ƒq#|rav3|s6sC}t>'tSWn^uctkvi}w{GYw߃~x]'x?rw匇~z_Hz~?E{|7|W}w}~~oP$` x@&P d "FP`-xA fP`=AP#$a MxBP+da ]BF3a mxCP;a}C QC$bxD$&QKdbD(FQSa@;PKMGqBqPK&AOEBPS/img/getstrtd4.gif!OGIF89aVc֌ΜΜccc1ccBBBcck119BBJJ֭便{{99ss{ZZRR))cc祭kk{{޽11ss!!99BZZckks19Bcks{BJJ1c!,VNOO'LȰÇBHA3j#Ǐ Cb(ɓH\ɲ,.c@͛8sɳ'O @VZQ ̅CP#`%"*"PyzCXx𰪪UcG-Y6YmCŵVTݥxY-0LJ wBWYR&&@:ł;xbD* -&tX0.qZ]XsR۸sIA@PC"U тs$J< a9H.( b-H0*  }'*6m64HW\g)`*Y),|0(< JLv%H0b>x=QW[w "mH#k>#)Vd)AL6ISPB%\R8K?<Ђ*0L W x ʉBBxЁg`*H`7 )Gb2:Fh蟏jf%KX>**|&\ "P~ ')s2C-փ=i@)g6jJfSo7%q) *PB :p8(0(  əjTHZ(0x( ;+&:-ZJxg|  zir &OP%:+Qlpp>/,iK]PGE:qp)Țu Ciq 2J.)9ru#|JAm- E ӈ&}J爵H$H`$@[v(*&&4?!``\Kt AK`3,tKt/N#LkB9 ީ@… X0Bڣ_~ |@@op9 zo#0 sRLp‚|#/,p)`Le.;_~Be+{S&f2c9.^_ƲYc4pA{ NA?yɌFt,7Ψr~2g̘th:‚.4)MiKҬ6_c?ʄ.k@Z֠Fnp;9$}zwָ6-dݺv'2NZ۾hzG[6xi箸V dz7~hׁ8 m[-A [lS\޽av׻9q tw5(5k?_rc.u[=6mW 1<绾[[i=ꑧY2a>6Sx-\V#-B3.iK׎9"`p=Ӡ{~)ox< N~"O}vV>o s>ǯ y>ן dҀ?,^Q-:o!E9̅7WB #22$, R=BpEL c f)gIPYٖe9l)5wY6vIYs)^obq)tya i`~)xəf}9 | N除ɘwy i▀ym ~yNٛiɛř)ٜ霫9ٛIYɚy)ѹƙɜY9)ՉI`깗ֹQɝIڒiɝIy)Z隱Iֹݩ#jʡ**Z VI޹ -|8Z=I4'* Ǚ9S*I*jJjQʤE \ZZ'zIz^hZg: (]J :czNڟsjyiX[Miqʨ7i9 nʩA:ڤi>*q* J ٝ/ iYry١J, ٫iY{i٧yZ)sʞٟzIxʫy:ݪjɟźd6~ q\MZ~Fj @Y{uկI)Wِ5'V) [z +;;)"PRɕD)Q"mJ'K7 D/{+бD * Hj8+!;Ty6z!ʢ̪ɬ*)ˊIڵTQ;a*:ZKڗZ)[{}ʮ\M[,;Z";BZ:NZ 蹮iʪKK먖J%kXɹډ\ʹ:z:OzBś2 j +ʨ+ ˫?*]KY;כы6r9tN) ; 긵[0ʋkK*ߋˤ{ [ \:+z,;V#0.ۨL¨ھ.\){5^{|ZKJ~R˼aKmkIZZL\;zczT̜ ڼ{jʴkfk&zh’C% `X_| 9yǾ  ۳D7Ek C)ɡl\e~/?3;=,([ɿT겲ʩ\BK8ʨ\ |¬Ĭ "ZͶ)u[˕;Ƌiڭ ٴb|Ő)qKj,ewK tlʪ֬\ ~ͼ,oG[3L8[]ѣ*Uia/el?i!|ɚz ,alƋ Yҝ n@U;, I<#hݿ $N8ἀ ,.02>4^6~8: p *P=.( APCE G~PI>K MNPOFB#̳0U_xcm< `Pb?4mϗ)H D hmǫheEKdu| @d鷠$鶀 >^~븞뺾뼾\P>UPḪ̌MnK 'ھC ?Mp!5ɰ^6A~ /qp>9`W'0n P_ 7`.aP$$+Op^ P&3o6g;2?_A/ P/?GI.PLOoH__9pY9O E .CPZ_F .w!w4@|gO '@Q _ / ?_OB_^._Vr^ C2f_P5?}B՟ O{ o_o_^_q?ONNȄъ٪LݍkB*\ȰÇ#JHŋ3jȱǏ txɓ(S\ɒĒ-cʜI˚8s ɳϟ@ m2@7xtFL:=uիXjXt6>ubXd-˶۷&|C}xޭ} L\7:9xq 9&^X=!KVXH5MO P̘ U&h+ױW.Xao6M ި(mޞ?~9yt̖=;||wֱ3h'bІӍǛtη@C^JwG|MaN(h䒂nЉXc63Hލ8DUb;cg6AB"q"X‡BQ4evmPE&PGր!kK*bB.൐ h%qP #=k&hOGƠ[{zPG4lX'w JdAZh{^#説e !-TD զ%$ Zyx*BJbbtPVkmDG!PVBNED~Pe{2_C!  D</ffDfo{d'fO14CLZ dVlWw @ID$(2$0o4qL<@,D9mH'PtT'zsXgui܄` 7Dhlp-tmx|߀.i]9gxxW8w.nn披밓n;3z;K,aO9.<<ʿGPDk?=怏嗃 c9w?&p{|"<. GJoң|׿ πٻ !=YD EXA0r ĠghAp6D WbЇ@<^9 H?LbGHB$Fc_?+Fq )OC4Z"wn]_o1~Tc G/:я)c"9A}TB@`<:1bpwp$$H>Ҍ\ e C8rL!CGы\!%uYPT%O V],I=*(Gh4*HbNr|%x6b~-iKR@)T.r, ?Kӟ.Lc:Is3G"BF2yŜ1ѸèJjUfяb&M]Hєn#J]Jʹ@)Ng>rb P epHMRԦ:PTfTkk*մUpYWZ̬d Zz-nmW\ړtA^*~V`"zUbׇ jc!*"P,!4R']Th?KR 0DYҾek!bZA5j[\uHp%KيU$wEljA!p#2݂HB|;fDƑ|p8%Hw'&m}{b?:/G*!m T/p;JWٕ%l ϗ05 b [- K*kdO2j >Xu#0}<8?N`l^qod. 1}|a"_=.C"XF&1K)LPzو8Vv2 ^ d6'9|.3R'Qw Bψ.r }DYјO,d6g*i'ݰ;z̘F bYѷq;^1ɫ&Zz}&)US3R'n{R~5hYMٵNMz[t]#~Oç.|O3 ;`8'NBϸ7 s CNO|&O>{0=P\4w@σNcFOq;h:ԧNuPHX${=\=e?ڡmWF+I{-qC`*3w\<,a涷<3sw +;}%Ul^ %0e'Go_z~x}3$ů_Q{e<i_TpO}B~T~~(Ͽÿxwẏyw(~yrwx5zwg}xA~ z "8$X&x(n0Hr463X87< ;؃@( ?D CXHh GL86؄P KTH SXXH|ͷ\؅^`b8dXfxhjl npr8;PKG5!!PK&AOEBPS/img/getstrtd17.gif:"GIF89a[c3fdcem02:@@@tu}씖犋FIOqrzZ[b<>Eز{|ɜ񤥩͋mot}stzxz58@΃gjpͺ˥!,[CD HS#JH"20f1UGX-I$ɏP,ɗ0cʜ1MT6o0'Nuz ž7:9hϦ*QIի0.݉kQ\::N~}lT"SʝKn.k͚e*gҎ[zwpۯ]̸1]#트Rȓ.43!C]ӛ+lyuׇ;ns iSJOhPE&?[1Y\ޞX_]]m]zbϯOxΞ;k UZɂ  R{4HN(z:ae y| 6)bq!nוgbv8bu5H"52H{>wB2x B#4&)e1_M*(K#9*db~idyJ8bD"IfNbe+yYR%EΙ$r茄9s f馜v駠i,2 dRnXgvaM&*'Fz (z(z)髱뙭*[ڙ,՚jm;,KYnBkgy.:anzk˪+Oy1+Ƌ!12zgK".^/GC!ІJWA(QviYV` ]ntl8Mu@淼)b}$>ixHBLg^؊X9= '1`W/Ő2$_ iBϑ8\-<2iNbAHAJS_ eET)XQ ėЈ4I0e$YLXҙl%$eK̦6aLdNS4ǹLhSW-ovx pS9]yN}^;IЂ*=iC{(+N{  .eBL3bg Azﭯ74dei*a/ Ws񄡟 }HlPOw)"="Mj8@BԩP͗>@H4 "E#[cW>Jf,0F0 lXWM\+zWжi`_0 2JV\XCkZwoY pKP;5dsux-kM AIԭu!"8z|K_vT$ ` ٱuͣb?)Vb;x=M]#pKẔJpm&.Ol㝰 l:׏C'*VX06b b lma'v7`mmݭe FaHga/&m͈eRF~&>ˍC=&1ᑄWs݄f'WCdmh4tγi=πEMBzІNٌE;ђm4'MJҘ4./N{1G}PԨ.SV#dծY5wkr66~-b>-d3ƅMjD[ą'ۖEf;ܶ+ re^M](EeeSຸV.p|7P!xP﷼Cq8Cqu#׸pGCnw32HxQn/*o^k ϙcq~;A}s\26Qr)O9ұNt[O\QeΝoHyփ=μ10M?|7n{>?a' ?|oz{wHMwƒz3{~;yꔿǎz~|_@B8DXFxHJL؄N:hM*8VTxfX\`8{&dxrfh0lp8e%txex"*~b }X"mo YO#0ЈUh zW44Q3 PՉpM9pT8X /4UT/ hRBO9H 8֧BON: hJՌxHtHR8QBIO+ՍR8HRXIՈ DO>PNPMODK4 8MeDM3Ԑ)xf )iN0H u !9KΤk/(OxP:%/>69 %09./ K CONYHHRBS8Q,HhSdJSRb[YPvyxz|ٗ~9I\ LՊL3UU -Ęyٙ9Y hV99P~y eY/Y4i5 gp\Õ\Yȥ\I p̉ U_u_y^䙝ǩ ɩgٝhƐRI6h&yp }fuMiڅY|A5 z  cZhǡ+ @)-ꢅkʟAzHj ٣# +*ʢD:RQ@S 9ʣRVz ):̠n: Mee*U1jg I TJ_*gU}Zj s Jyru31:g* *gm ڪ:Zzګ Zz ǚ* ڬ ԚkZؚϚڭ Jz0躮 *:ZӐ֨ }PתڞV o6JZ[` {Pp 萱t8Nfz[ʠGj6Z: />jp1 7 /[Jxtz&۟BmʲF[)k4?JKGX+M[[87::˵wJf;GH2:c-ˡKpkIZ{'n;}vJyuC*_Zl˸ K˸b:{ v۸l[%h۳;4sۦ[M};PD[KK{븝KۣIe ϻ;( 뼉+ Ik{۽x K[Ke˷۹vۻ{ K{{\ +n h?l˼<%( l ̿' &,3 8\;>x{g˷^ ?*KJ˵{] 3j`,f'zY ֫L{Yu[5+@KY"kl ȄcȀ ɒL ^~4  "*$&(2>4<~ !0D^l})p)FN R.1V~XZ\[Хlb.ʤ\zhNj}n~p.:t.v~ݙz|瀞>Y>ظn钎^xd>l:N: N*.D꥾6 塚~ ꣨^Kd̳qkRahLj ^O SngVLݮwŬ*i+4L5[ıX=LN"*!ܥ9l0CN8z>ϻ=,4̼ ߿k;*\i˯;z<,\۾B<@P,I?z.\-OFR?~?//[lo?#?ŵ 29h<,l,k\gX,;{Ę&O^>W|V_rv -aomNaɿVOٔKľO?`XυȟXO*ҟ_w?E,r_6) HГC|\Wŋ3jlGABp6TQH7\ɲ˗0^͑8WTϟ@ e', m*]u2ЧPJ J,S`Ê;U V Չ_ʝK.!~k R-+-Lag p [KL2k^%3ˠC}hČ SK83װc6@۸s>RO ȓ+_xLKN}zسk|}voӫ_Ͼ˟OϿ(h<I5F(Vhfv (A$8 ,0(+h8<@Y$11@\*&,PF)TVi)IiL)SdihIpC2jixglBf"p ZG8{&袌6h}>'"V7ϣv駠b#R)*aQ5!R7ڊDj뭸jᨍjȩtHZU.I6+#EZhlmC椊іk9"rmhVH۲l6H\krG,ĩ \k o$l2#15l_rkhN8s)U ;mъl`FegHG-d*]ǘZ@`Մ`}nhں&p!ك}Lq|+ׁ܀.x&Jr't G.Wngw^4褗.?ׂ2 ڮ[{GBoxG/J·H`Ցl?[S}`> >3¾凯|_!o` Q@1o{k2@joi Ѐ9BF5}0_ Q=޻a X G'C0>R³ >6" H5HOTh.^18D;ecإ4U#{x!1 d+HX' 4$!WC 4$% 8򕰤(e. II]f,UʲL2oG$WNrЌ.i*iZ0nz 8IrL:vOyjHJЂMBІ:D'JъZͨF7юz HGv)JWҖ0i*ӗ ԤoBiMwӞ@M*TP:%RԦ:C}nLJ'OTծz`V* nə9ŪZ׃<4}kJֺxi\*׼ǬmB+V{a:eMiy YOe:YŮmLSYϾY\U[ֺR\OZѮu2k*vjσXvå-p :5aK]U[vw}-\A 6z^Im^iZn~ co_bv`C><$/YLYe*{ <' rL6pL:9ȿ I>πMB}ƳBt9#jtdgAҘEi3ozBδGݠP'Z VV15gMUZ6^:FƭkMlRYݮXnű-viڱ!}7nYd$nCSI*4o {/F\on v%CWVǠkʗM"w C_8^q%S80;& g/|L[2w\uyɃ^4/yV\>͵7UAifr|S*q[S&up/HWCVG{v|'{=^v4LSw[,w9aﾳ=)azRwDl;2 /H#/g[ 9'^v͇^zT]Ww]|~_UM?/.}ڽ‰pPPi Qޯz -W}'G)t(7t[|:u"v hw@׀񀯧G*TjRׯ`ÊKٳ2 ۷pʝKݻx˷߿ LÈ+^XqڥKL˘3k̹gLӨS^3MmCmM۸s޽wBjsOμվ'_>`..{^yϷo}(@pÍ֗yم{޽})Ơ^`\| (lԍ(ZvĞ|}4*¸#5v$.L;"T(yv喥E~ 4]uE ^d6Ji飜SIu el*h|R(Q'9r]$%~&~iz蠤 *vg٨Rڣi"Gv,f`I)a ˪NJ 賥$:+jB +هa8h. ޷̮Im.6k:9-…'òk݀L>v Z<$sB扥&snWYV2lͽ58Wd@-i^"3demL7te TSM"Og\ `-'h]XpsM&ZtmxH߀.n'7G.Wngw9d~.褗n騧ꬷ塿.n/o<7;|Wog/wHBuc)эc'IIZldXIH!GyF Q GOґk`(a)I6r|$-+xKXq$0^VҖ.eIfJ *_Ls0DS^r| 0o MlZ2Ʉ&29IjN$2_rMhS<LXt"giyJS+Q( p^4E6@R8pbxҜ;-IԕdgD)OWԗԨPd> _آ mX//aG<0Q#)̀b35E~ \:Ӛ|a' PRH`)| 5H6|b5i51=jC9V"bU&\G;@SrV2c,|1[6(B Zb6 JdxE<Q S`ǮRun[{̭^[I]֠:aLE-9KZЂbȭ|p:b S2i"^@I>Nvmg/u9|tb#流m[ VV (-ls_^`a2_`9bpY)g#>=箲zՅKgMaV#Z0brŒ@f V ^k?mb \FV5pw8ɯu-n#zzojX@7m-\7l)-< m hP,Iʔwͭjo7K|ۺfg޽ޖ: pc#[ٔm|a >" 8GXъuw{߈Y g]ON:iv.7n܀-mF$ojˊFзQ a4 )9w[.y=o[}윿zW>z=>t"nmUڛB/ffW_p:x˝w^s"`:<^_~:/1w'ex#R} Rxm: $~+Gy|WyY||߇}vZ}}xGPXyQnQH }.~(oLxkRVe~bm8s^WX5hT8feif@U5E=ȇH8cJHtT^U]tP_hXUUUShcPu_qf@mȋnx(UȎȇvX;fxibpbetc*x@Xggfc P8X}%v X爓9ُ1㴺in.1МL GӼLERΘ^7`t8UZ5a~=5 \Э2 n.v5-楾Kt|GЉ.6G`_[F_F;pn՛~fhl]qٍ ^~1Nם u]UPuk05[N^pRE0pǾfq^:hyNٞr^-.yN`"F[ѸbUɊ\7ܚj+ >N _1BoSP8`"9SssU8]o9Ro^o8ZГp 0F󞘅 b7 m f/&2\sL,4o?_Nj@HOf/:e[89N_SO99goɃ_PlXm0F` W %xFP߁?E?O߿ݟO_O/K?A@` A *4p`Ą (1#FnLx!Ɗ%MDRʕ`K䥓'<8FSt @#ņ?Sah/#JCK+ZX7e͞E=ySܹ>{ҕ{^@sϚ Flq"É+Q2%Ct8b+Sy$EҗUCtXЯA^Xn.aʤ2'~{fkTLlLFbn hs#<㝎sEVջ}wI>⒇7\ 54A&:Ls+-Ó:PCOmDL4ɴ -E_ͷf &PVCx#b /Ҍ/ڐˆJa3L101,܃ 4d{s'Q6L4asC@1#(‘4q\IQ 4$F M\OQkO?i SF9RF0c)4/b&i0 LgLG&VkvZ/QMLN{4R!mP1mwtSEA?%EQQxeѶ|%RiIUp'oш!#4%18Je) ໣YZs2ZktVa`W_}_MBLBP祍)z:׬|cSwh 88'm5Jo0VvRdbIz3|b6:v1\>eoܛ'ZiN{g-\mj^{+OGWӪIjS9lStu^F+E5O$;HI%]ԲO]wf9])vn))j#)*:fa|F[sOU:ngO@6Ё*r`%l*;A-JG<1#9ے 1,0_ J1^|{BV縵,la8INU<~Qp$G(@'bf`E.&_@g#"'lhv;t[P 3 0 _ @G 0!А;$ȶ5Ml[斘@/R(%rROFRҔDe*S2F,D#Iy`}yB!6vG!pd)Y,S23h$JEDRF+YIPqHKhbQDg:չNUT5id#57nN16@h:1@C!p10 V8-ߘ?Ǖ'4t#٬A" KzD);e:St\I8tZƝԞ )ܠh@CPd1z BNfDZQQҧQtӡlB Bx)&g\SztSi^W2jP}ZW{.qQ/%a2lڨ(,nFk%l m#/6L*X֞m_u[V7M:!8q'o4B;EFA0,c&D1 9aDmUB#2Akd`dݠM.X()wiphĮj^/j};%nxCJ |20;YmoOwJf+Dz/{`H-ޚ`.XS.QMmYh>PE [$6puJ&XƇՆ_E63qע1/riıf ǦWEk[8W(FqpU]4O^Ge*:W"MiÌRGݵFuɂ:!>^ڱzvdfZNuIQUU9Re,6qEQF;ѭKEJ*FŋjMAxal!cyO f&q,M`K34~qiY X2^K;nS 8))7ڢn8y֌y)>1 ~4'z舆!xM#w.M;W5k5vbvIL^y;Le³-W3ݍEְ)EB&i" 0 YiVz6ұ jc'9sp4}Ɏ{np :w[{=/ڈ(ޥw7g?gouyaty2tHν|Yd6ſ꯿*c @˽A@/;a;w8<Ӿ>h#7{`k4HC?"RWQ"{+p?z==\@ A8"TB̌(TS>*@xXw@3uPB062Õ#h\4;u7C461{63>2#r)Zb+M?ȳӿ9?#B6$4 i5? O[]c,9  C0L0T6[E\08E]B]`V.0̆[-/h[Q~R0Hг[R8?{=]$F]Ebz- lÔb 4 ȁ03@^>8]ZȆ:Cj~j*a;:]2A2uAv̿]XF !ɝ$ G9[ȡ_Gx ʤ4H2d.Xx;< 1(#^ D<^ #i!'%َ[3vtjʤ J˽GGZLu0LGlL̡TLV`JȐ<+Sh{4_$:] v=E8xB0/FxD[F<ʁM!>UTV(0Vo˳#~r+KI)A(V5&H<I30C|23c \SS]LR`Se=e=ETeSɔL-Y!ӢJ$Z %yPc/bidbWUW|Sa-V>I_5 yMz=_Si5VŜ9}f-VC%T|VxH-#`v{ЋR@8,H1YV 9OuEYą8,Ѿj5dkSDLY Ub[ŔEޓ}WO`(!u--֥}!ڪ]ڧZ`hlhN}ȈFq? ,r8VH4r0Q[ۅ==+YԚ.[CqiF!͢|=ڬZ\U˵͝\%҇m|HDYVlEۏQZZx[a8(Ym\A\#y]#\s\.׬QmZuZg\UڨާXhNs}sdto pD^X`[Z Z(/Z#%)<#(Yuӕ-&L5Y[܀q5+d× I#5 V^-\5_ ߬^ʍ\Eae-mXhZZ\dlԥ"4rM"x۫b/h[#T)H`uGUY85_-"`k@I7^% uZ-cr(cUZ@~ac@vv&G~7*br )^h"r(j۠S`)f5n8)}<ޢ&A6@.AAΕf?dF4F}\YdVjTd%] `1)0eV(Zx)+rf0[e\xpP̅١N,G5TtE8ΝY^َ+ h`]eсCf~^imiBeMFv1rdB`@S&)FXүX%Z)h{n/}j;̡6[꼅iNa`pOG|;-i>iBFkVkv뙞f_eB@Ry"[/m:TQU6juxڎkV>wqKf~oodqq` d}g#"p/PGFxY?/t-XVU#@Uƒ;j4-XAthxNS똡J?Wo؅&trYu(ooq]Wt^v@7vY;d:Z %/#_ Sn#rN2=cuBugw]q^xa|uy\~TV48YM-6$Ӆ2gFFEsAv'yv|zOxw_Wy_yyya2FHe^BU^Lm4S$LYhOyx/wwy~7{^߅FPnj/)ժSt\q_YxwyqqLŗwnv|wV|_sn(w|{qr/b[) F2GgĶBX||7//}g|~o~/wa8f(~f8ap̗|~XVX:(J:A@Li&)̓J:SG$ iA9фN@C 3\B5 ){rʫe ,XIF1,םzB"STġW6ūPz.骻ny%'Dv{sLP0 sOO958zM03"Yn,F!-x3 -7T[r'h_E;.ˌOI.=Ц!Jr*1>k@_2`y 5XCM5M\F2lT2랰* 0|٬p߀m\vI*[xrˋ3x8;BB49+=KKc3,M2 /$c I M,z2q 1_W ,z,1 u3^ʾr,1n/;?>>/Q}/J{t—AX P4?`Pdl0XQe0AA(3.>f/hOl[VkAz,F`Y\w3`\!sȸ wk_$qc0lT @@Oڕ6kŸO1R)9^>"kXb[ReK ղ^EGy/! )HI0^¨!'J3qe0ȃM F7ATm@|r!X{4B B? z+ / aG\B|&4B>D#AlK?4fv :qcTcj.62,멤pShD/[RA8`/dD(ћ}+W#эrt0t+H ~19 B$әVX& )6ERmd0ъ!ESBx 19Y;ZG*ֱ:]AR_H_li1] =vp+ ih83kT WXiϡ F+_0e,Aէ8؂żD'*QIGҖmHZ) .RF78 0@%<u&s%cuKq<"z jP11# a$8A ٻWZmQ'-C2ؼCݗ5Lh~N8A;ءvnػłc[2l(M/xTX06; )@bL)T(-OY!Y>f1 q7-vWBb1q&`rlb aˆ >B8 h! UriϹYr_%>~B¤o.pvgL[5%r#w>r:u\2uF8DW%tT2h2(]g Ot4 gm&e A֍w&( (?&&ife"/X(VBAD TiJBpB΁/CetYAh# Diw$.h^w n%fJ)Fi*Z>d'r 0 fBp /觮ȨȀ[ :zƀ[&fN%qr"Vj*igj(N)+:Je&iv(&XAJBn.|j//;z( (܂m5%)j2+.z6f+Ke.0Bg 4XY§T,@yA#+t-HAX B%+[onirDzl̦ne%A' .dĊjh4B Ё iR+?YOˢo/-cоƭݺll,naT&ܺm%\B0JlL(LA#Xm)%͈;&mmڦ,r(mlm .o`i6-b¦BNBz~fqV~.[` n&)mzlڭJCۮxd0>.ӊ $V'@:+hoʯo  / 00/DϪp,XHXzJ^&Zh\xA!fRvҰ o.#ۚqְo04/xX`.BV)]՚)"ԚV X1\[xȲ0/TkUXr`Oq qrq+߭+2α-o[(qE0ހ )zGӊE82g*Z'gA, 8QޥI92:*r,+3,-ϳ*/0WV챋x)@ | q/.LA2qn@6k3 Xۄ3.Bs*2?޳s>>s>K>L=3O,44Mm2nE`3c vfЁʨD)Bos͈4*sߴ{'ǯ>5^]PJ`k.˴t,pHl#;B_nX4tj~kp `Ơ=}Gu8 9WIN4MK\^K5]t`7Bc^3+X=[A {],4qB3oU73Gm"%X 4Z1EeXbBܪ=3A_4]w+wmmouoWi5aBQ Ƕ^..44'4u3V FЁ50 ZY6n888+v6~8_q8A@mvjbSZգȎ|38X"dm6*8x~949,B%@/B 4|.jJxqd/p|A+̧ezۨ9|\w5ӹ>zߺ*sma;D"0TLAG-X8foEqxHwhzY98k#纍zB:{;:;D{*TAX&T+#c;X&j*+tͼ {S#ѣKQ7&Ӵ*:|:69{ y;4ΗydA+.B_%B+X+PY6 Uyzy{|Ϻʏ̧|^ث' X =3aA+h:j6;pcw]IWncj Z<%֩ Z{<ؗ${>ه̟}><>̛؟<̽}afDŽd=xy*A-/UkD,A,K?_iנA#Y1*>|蛾ۻ>=: R >GN~b=a@ȊU-Zfs !>"+ZdYdʫWTBN=vJ':lP疞?} VX*eD\EUU(RI6} TN@W_;lYgv-1"^ ۵@]v ԝ7޾{U/M b+9me˗1gּsg`hK"捬"3bOVhZXK_9؊GAU?Yn)R)UK#U`1QQGo5y[>u/_g1eЭas[̿+2s @0B( 14H3+(Hc+^6İ"M#84*8l>S;rC%*+Qc*Tr*3=.J/3o $dA7s |3NB;<,`UEM7xJ̢#c)>‘* *,ȡ?I=dQKd'MiN3PXJVXy!{9I>6eH0IGH&rt+?tӖ'E.󒡤?PŚe):zЉA8Jr3&E(bE( ?NJfԣ%9I QTeȁΔ5fAbώf=(D]ҏg(yT:ujK*ң:u@LmUn8(y `+jOQ5@X{k>A7UF (t@_|t:؁@ [O6:wd˾jǸ ^ܳ}g_o(>xE\Ϲ "  b8`~zs Aq,vоo/߽`/B\`X- &#!,aj6 0|Tpo:aOgpfc @ppOp-$ ,!PB!8nMmpȸ@n԰X J,/sp/PO ma  00 C @ؖcк DJRp0" fmg3 b 0/S(!.p"Qp-@  V6Am:"\Q0%-,ܑ,3{<aB\: ;1N P! @o1 { (1 -5 ` %@Ԡn .@1 |`M?2C'(QBr,:O: / E 2"'R,aPA! %1$G2.$-FQR6! *p&Vr% c'{f[{(3|.}$/2"3 {&s32Ig3)r,*9/*bP ?*`A!-Ӳ۲##0$-I2aD`g!鰎ijVR13˥22#?&rrسrdrf>h}R,\e:@g5sP6 0ln`!,+28-A9R.A!:!9CAV ; 61ZEs2WDsJ<ق1$=rг1>T\Zsh3>-(eA@E2)t2>ARn71#5#5p9Er$4D5B4a ~ ETJMTr,\VTVJeTU VcEoVau ~7XXNG9G4C;4AdB` .A .!P&SRT0 <0uF_V AEphd=-r.uKUTR_i$iU_"U;EaPY_WE Ulv@a!̔#S +VC74Y>cGn-dAoSP/!&MF0@ e[g^ͧht0OIq3C.4s|sES|D}j"JejUUqUF`LaTKa 5Ȇ@ CqxqC )c7yEdvoO6z v7DoQ_ ;EYZ@ qE@uU(P}[_a,XjmWkwwl7w[WF9a~ww!X3@M-v Wn-AyWya| ^VQulP1e UkeT_N}O~ޗ,vw]EYuw]t k`}AOnbwC8y5y%X @pKj4;{ !|77|I8Tx/J7ј~w_89a aN(-$Ԉy)aOYִ05GS~[@ d<( &mq>fq5 ~>@M a~I^M^~[ @` ` @폠m>󝠗 T`>7 ?w_g` R.8?}ٽIQ m^7f; ^ u_G@<0… :|1ĉ+Z1ƍ;zrc02gf8ch#g͘-{̹E;3:#) CT3Hլrz'=`ʚ5&mZ*Tܰek#HƐ,|de$J,1\&D:sT"ɔ+[9͜',y2%D-I\g͝tREUĄ| G Ukױb=[Vo cÊ#xnj0$䕘?ܤ̎D0K$rK/A?_I(Ri+Rc L3Bv!.HT2W)\sЁҭUuaȈ\GuvG1>`N. 7@@JNIeV^PQ  ަ ' & +l/!p~1r˥sg[]GuٰiЕ&:aIDb; k3aXfVNFPZjB.ADF~+CZҙ2IXJXZ  X+ę HbgX+"uehݎ6Dy>Vĥ].ke:jQ\kpgphy9l1aǖ& `!l* [5v;ַ-:[|ZI8ĻMīQF w)ľN,ٿK)0 ֮v`=٦-vڥ=r5\Zvm-6i=xS_\>')ƴ)dpᒲw0F1Aߺ1lDA{~cMKt@L"zvú xգB8[=e{=ۛOm3* k , QrlD]$ s(C Z` Sounq U.Ɏv0<:O AքMDo Q_xH-!fD"PL^İf{qsZ-qSB^- HKj @;fQ.3 E``,2˂ʳD.8WPMl\-L|_V7)vJ9$ n$UN-'). /?ܫ~ >?MDA ڴ417s[.:i@v S2`]$Mi^vi)"joԛǪt Boʈ2'}~|_(O<&"Y0;jəe=rP 62 ! }_x#EZ]IMHu&@i%)gь4 ![m>$k-ñ!xPRi*g0O{mW.#ER4@qOA@tʣ6Atv]3RALbЃK) 22iAq", ~-wSTPnCdk*=wk}űon%nAWViwWbA2@ mcA\2v ++KҐvf@LMv׭5c + +RUY+ k3ZT=w6 o"@ oȠ.BKC0D2Z` ,M 4Q^X8^!WM|u&hTkC+K,_E1zԤr2kgmEj:Cƀ&gͦ S und.zy1 \`13`@do*o%|R{Fܩb^V95@ö9N6/ M8s f+!redp-$2@R瓇ik2A <$ @6]|J:AL3̭MjkN0rx 6mHr\Np}ux^2+o 7}$,3MnU@{w.c4IR[*( BQFB% A Uԧ' [r q%myUXΧ$i (vvxڈw@," )r( OiKiaph f! HP)6o)AYGyeV"@pvOy藳9ٌj$ 9|閂W2[iwy0ٹ6)]ܩ )IYi鉞y))Ɋ雴IgْXUgiCI: ɐޘi29X yYY2 dY"ZxWZ +ʢYuigNv(2XG tX%"Ψ 8 Nh 9 m iREy| Тej iyRcY!z #0C&`ZٌVi#HZ rgʩjئa*~O ye\0Z"#Zh `fF*Ʉ(͘jvX kʧ o"r :@׬}ev:*2ầI{ حiZUj`jz@'rrL$P5*wv[mꮾxi:pЫzzc&( 8#ڨ<˳Z @vhZnbX#Dvs6K%+f3'{z˄ϹKZvh5 JG d) I~[O;$9t0a^RWq ɳ +1*wb; ~mpU5ѷ"Ǥ;JKkxk6x+BR4=7T8`S\MD6B6OeP]tB]Qcku ٴh I6&}») ܳºڳ Tmڳ+Rq\Q4]i=oV_65>EW" *j\[۸›ï»ΈZJkC&[ { W\HVPcƙD(& Vk5 뫁8˷:Ăͨ⊼: ;"ɏ9:  ١Rprd[Db%SKKbg,/|JVt/ǁ˳˥NȻjR嶿ͺܿƼ}P{˸@w 9'J+O[»oKQK\n5Ǽ w !ŹKx9LjÊD}>V 8ASI{NX@ yjTȀ[1+2k `cWm[턑 t_ӣ=lD%\۫C=JwsV\TD]\2vc   d-M T ֱּW]ּܾۚŸ:8 z |j-N!-cm ɃF ۥ}VIխ鼗J}kߵJ2  N(ܻ]~|WꍣN] A }1͐y=M,Unw=͂;^c0 ` -~Mְmn>>Tcޓ䳝 ZU.5o޷~|ڻMo T]׃^`^|MN5 @YHd..K";>9 >mN3n-{ۇj  >~ >ϲi~=|;)IYn~^fƾ9mNV~m Y\/.҈^=|N鼍ޒ,v}yգnd-0p-~_W$nNչ O ]>tN\B_߻'COmnb-,6!Zo^n/ i.P~ݼN:TO5v aoӁ| ZNtQZ=O P0~~o Yr{|_Pγ휮Oݎ~t`5ۼ^{OP/ ۿ;?$XA .dC%NXE5nx1@ ؐ'=PPСC L )W\CK=)9O"lx TX!Q'JCJ U' J[Z+ܢxOv_&\Ï!Gdsh 0 $I ,t{Tշ3!0}paԟ0>Ίug˗1{ە2;Śҳj J+=\uٵoHM[_<ȀyV ]債& @ΩrL'J '<-,PRZK*삮4Z;K4DSTcl!V`4玒j C`7L;  &H fRr&,2,0@P*VtM8sNZ\LƘ[€%)nM"ۍ*$S kk*tP6+/߻ %\$ QRtUXc#;3ҖHZJϮ2V& $S%5=!dr+RAm<'㏦FXtYUw]vEM4Ђ I\,QjN8~1EZ L=׬ 2 T⏅lwdK6wQ*8WyOjVb8@ <}--rհ2p`5iyT`Okv(冎 gg<3Θ㬟6K 6,5GeS:縙)õ6f 9K#|nL^L% ڬg*yxIϹ^BUY-wvΚ9̊㩝 *,#Na)x䓗r㤖ԚRnf_gkpof .5~-˭xQR~׎y}c-1 +%\gR?P}`B4ĨԝPq]Ao uNYFXf"Bn)_ 1 Y? #MxF8";wj^+SS T`!Q` F1]j XV.~:LEt{aXGP2=D7R4WR_W,E!?sJ<@֯YT7JJxjě$JhF<̇`0 k ?zlj1?˘ ,H{D^9/ӑD&&Mr4WXμ)1/ip&҃Ӈ01~H;ͥHE)jϙ{[XR1_.{f^RX6cnٱUR?Y@GΓ^$*Nԯ^i;}}{_z2g~|G_7E}g4~'k|7 Z?D?<{gu~'_SKhtkT 9A99@94>۟3dA \ \|Lt $@v)ƒ$,A*$%L>Pd(D+$2l0BX6$9̈74†!4>C#CÃB@,2$CSǂx=CIDD,4<BDJK3C0DK.SBE<SlcDtĞCJTāXCUEE:SL4M_a\F;AQ@R>$?+ƂHAdFpEIƇ0WeEALlCIYEy yE)̈M|GfNtChTiƁ047,ȃ쿂CAlE}|}$sDFlTGaGxdH{EzH}|FqB7Å$mTɖƆlIyȈ0GŅ04C[{9=GxGb,ʋGzn2Lɉ CIlVɥL]/ɪ$ JH]GLƳJ|H4I"~cNYb*0*1}ƚT.$qo'Y {7ix9B;01 x+2ON}p%2;ӟ)8(-șA/7hmZ*@ DzׅƉh <&Rxb0񷔦hY6Gi9Xs_@Vo#Z "g >3&d}0wEUw::/R#$!\d}Y+ ZjqP $1eTly8@T*rsb (գ`2XՔm[7}A!9֪IV򡉽F?: Qz,QBLqʍ$\Nn]4CM-oaV7Ynf*]Rc8tn-&2 0AfЕp鷽$FS7]LtļNC QqSB #2 bd R b>jajN~:& Br@"/ʉ\k*Y [9%Q+$}6'LƜm47+$" Vj~gk$ˬ.t@9k8 pݯT/OUۻ#ΣvVeY;~gJC NΩ}BNTs!Q =K>8p9( XQ;Dsiv:6D\A(ay\*4'yNȖMA. fU+F| Z{P4RjC; (g|8'Ժcᖄ\eXWB(x6['|vOJ8K 7NԔ_"ϓVO ITLJvsU!QTitlt3q@|4'lv6Q-IJJb5"x/gdS6It2KJ5d=~^vyuJW"}Z%uJ>IEX2+{PZ^S-/7jkv6-h@C`WbIΧd6X|!gl*A4<@4F(c/e18h=:th/rHZ1F0e-gacᄷDRH[ГJ$dP\6\Ebҥ,2v]*kHmh!h*E 4`~Gd{8gԆf !#vA6 (, @ - 03 vbQDž'kE_2z,Dh^S-|ԵdjA5bgS!8vi1A$ȋ vbx҇a7M> d.0ɸi 9& pa,,0i"s5))ҁ‚/w9(]6/hT! QG%--#7J;1 @9Z?֕IFvgYw 6Y&z6VT-VD3%R-׆IU 1OPE^w;5c W1 3Dgtyf9S:; uCpUthDi[ $eX=Wp  0(, 'mP<ѕ)v)C NgYnEV0 uMlyi /Jl \$i9**ڨʕ Ji> E<ɪ31jX*x9)T_,|_Yw9ʇ(<Jx6r: @ՊaiZY:FF5+jXcooJp0/H)'6jzz7 稤,ZTh)HR{OF;4W:>Гo#Jdwcʬ&:RGd1LhxϐCZLe XAuyG7SPz;'٬ L0-p68VՠR(xGm& ޚ+X z˲U칄D.J%)DxKo i,R=D3(*Kp{"JfOXe6PAwD8'{5{i)Tj~ 9:G'FC,(y竻 bATWG]E`(뺬;k*Ac0ִɶkZVvyjʸmK~C);(R ΫvwK' f[q+rq]љ-e҉#<⪰tcm[|$&w_I4I'ޫ.L,M|kHLùjˡ{ gpDV<lcB]OfjnprSA*+[Q5N8c g "nM}R+]RۀV˷~8' h攰uIU7H0@jlJ.z㜮9|756۲>@Eu F <@>}3X-5{Ozh *XFCYAM~hyJk Ȟ2C F#s F%):t >Y/0^, }=Ԋd9?UJA?WIlA6>>Lt4jQ)X=m.Ziy,dl>ޱsSfcIX0jٌnRTM^΄qx&=)Wۄj-@]vs2Y^#E4c:E "Zt8DKT DKډ uVã삾#Lx:͗XÂk3F#|plaߢXxߨ65KxNK~kH5*.Zܶ*F#샖~_[l}.*%ע@٠w6==35VIJ5d$iA4$/26NئalH&ͻ15o DDDB CBC DóˡCNJž ȺϖْDD5q$k"NJT48V'\t"D<Q?E%"rł:A{u,*C bp: IhھI>s7"( $   ;/rJs/I)A+'&V,lveTPF JrKojJ:RA`%E]/Cb I"C=naL'; ׈80K@FD褆i/! @ {E2Q$U? @4x O?#0 @FtYf}S `'24  SJH4x KD#(ed(-cTx!3z#D0Ҍ # zNX"tKQU\M8p $%aAyMRIu6 Le~HJpJ%q,@B盰ɧ )R2I3.qN@63AȣТMUb& ۴O 5k2Ec׬ps!)Va ;s@8Oma<0Lj!}VjXp0oi;y` (5Hc":94P!y U#?Al!C$& \Q8#͙+EQGa)C$ǟV>C5\=h<eIr, 1DY 5Db4ZUagÚ]$N(! @RtyN3sTĢ0J1ا.a^nIy#PB!EDOff'xnxxҒvyzr^ؓ)>fi]6rEÂ%Mi@)!tz>uk63^42F6 S`EO=KK1՚`, ~DxPdB+H*D:>CɰZӺK^'.nMKXUk,AUЋc'K5,Gz6e>KYbbTGCڳ HE%~1ReHW%mIZI*_M{ i0J'܀\[JB͝En]0nfX".9 "P%0MheAq1 l -]2&,yl Pjs=MʚKz(%8tn,^ZD 'Y5^ 1Wz]v13B̖pd &p`,=Ϥbi睶T~S+EG#S3竈 “3\<&OŖRjzZYll~&L7Nr3l4n@9g} +|L'zX8]8{(hOp?<^xϻ>wv9{w?OsBv@1'O[ϼ7 DGOҗ^8DLֻ4h<&C BjeP(OO Œ/W O>Ͼ}b/'O}O"O냂~wpW~@ g}ޗ 7|y "8$X&x(*0r1X6.7<؃>̰>8DX#atʲtKPXQȄSxQqXrM^`s]d8AW6hYrl`jr(t#5"qgw8y{؇~h}(yHhzvȈ7(y v,#5<(UhpȊ؇gH(5ȋX8hh8ϨM}x֘ @'pט܈瘎8(0DPHȍH؏h`bI؂ D i y 8y&Y(IܘP0ْ 98 ,#@)6i= <9>Yp1iBDД snWe99`iqY0֕_Ih lc flvp)^n9vyaryUzٕٗ~IZ|YY5uYXYW9{,Z.ǙWYuuW9>9Y9 !@ !p0) "0@ќZYř,gi ',$]_pN $p"0/8ޙYݙ C`) @#j:#_I$0#pD#0C"H)&pz9鍡pH%p ЂY)%0YCIɟٴ@z )pI0ǩLʠȉ0$)#0؉"pV:#*J'`y& 0`S* \:y `CJ9PT**88_Jup\ɉXJP:pɂ D#ȞvJxDI"ТCPګP**g^IʩɧΩ2ʤ]::`3*ٞGP,)ZDj7٩*J ƚz*z6Bꟓ0"JPúp'pc*J8Y*n:;1;0˱JK+ L@lB<o|LƯk~ ˵,mIWZ9!py{lupmu `-k-yU݁݋F"K,7,J3ZRSfSZdz k*k*^Qد=ZේH"0 8M3bM +ҭ 0 _@9){3i+UN.ZN ~S :[lbc^mvڜ3ʬtnJຫeKؚTIȚ}`=KM>s^L{>M> pY"!;^zzPJ={wN+!Ph瞭ʷ) # }>ܭ.O`Eޢ;N벋{BQoiFڂk}*?jϛWق+3ʒ  35oW "8_YvZ#P9>j3C{Ieoh|:7* 55&ЂyO:C8@OCF/nx[Ieyno_rNU qZyub}pm%ߐ.;?>yt$o4aX1_LNr/?쟚O͙,^ CCD C ɔ!CD N! Kx߅.ѝB)NtG"?z~%Jw-ąم!$@N=DZRM< jiԩ;ZUס^ 4Ӯdy%cߺ-졺jgUSͽ;R(L^'CS 8ǖ3/ꛌ0ѨNm Xnz6c׶sϮ[0?C7ȓK3繘/с~سkνYXӈ y_h>0DT&3" oMa .mV"m#n!9b!)V"%'c"MHč ĐHRlU0E"x@6DdfI..P#-5RhWz%C(a31g%kئp͜ԉr@H[`R(&$G2R@:jJJꤟty! *a0DlJk! @T  )+I@VgD#;ʪܸ*"RMUUZF=`HKP*b$#*b"(D /"o!"22 +vê+ԙ`$k)C 2‹ szoL<  ,-hsxta48M[7`5yjkӓHm9*xCЀз^!@3kl8'xEq[,^D8=|0B@)N테 3]/m-q2#ҀگҀ3=A>@`P0`l 0Z ,o#\ASˎ)Y(6LNZfmJxx| $70ORHh-`q% .[opb,Or@QSF":f@;GE=jYc͐(o0 &bc8 5> *5*]`[`hrx%=ЬWmYED'GNEâL.r]TX.wc|vBtN`g>LY^!El^[N2Blr^{@Bmܕ91Y#?j,ZkzͰq1O^^\6JX0!R-D" ,aa[#Q畀&de>as,;7Iv; ɖbȐ 5cbPFZ*qu-}GLƒPh5}Z|m1܈!xo2+ x^$vHh|c'vj{izۢ^R߹5$f4?Q뺫.Op#K 7#,("} W ǷAP_& C`2?yY++ yXJsx-gŜK!ԝJ1 ݪ75Zy4zkjFڨXNw_t2;~nC\{E%!wBuHP\y'՞կoV_%VTc=HEiG[*V%5`,z[l@@8ZZB7wnr#r;jlq }C6) 3V9 ϫaJRl3eWҗw7~R~ r~@DfYESk'4;fF-~׷ٷHj3Y9mxeކU{ r0hPh-duj@uHs!ra/HF#sq.H 0( 2Ȃ6oE7SPGd7&9}v3: L؄.€7Fo5hoS8%6T2[mV( iay@XO'~熜>r0Re9eCWe; :cK2 O%*EtB(K}"=EVG|$AUAC}>2^Rᑥ, I1!fFrpb ;uC,Uh"KC07H3EfVp4`7( 1)6.|* 'l>1m!U#cX(6G"fV5wGT)@.J Ղ^yHY Q4?…#88sJuK5 Hm#jHD;]H<8C ` bKD9agl8h˜8t2l ;/Ã_ə I 8-[t)C;D)x3I(xcpًbX47 qt(1H3bՙTIНr3=K~sSRif2z) 7J'`T"x$slʌ[Ep_9 SgeǢjxhSE7 =:zj{4DyexKJMz0zj95OI5AS :cz[@JG.ux舦E 2EQy R-r:ŀvą|e;89#=!]U;o>+oIMqɏj ]Ք]yF({Mz>r{UH5H$* j5sVC)+!Fihs/.JUb̹N᭄9*dd-a^coTXS(_p_60ւ`v1DN ڨuZj&)+*gنK`R/KNp 6{dh4/6d3_)|TO`#eba*f/dzK* kgr6Ew򚹙h>ӮRJY>72hMdG`gJY֥eVSN˅P;s#֊+99HZi\+pyej<ɲ|39і0(8 i?pуohEg(2YjX*"so^a/Ok-8.VH[`.;b[פ>UHu$+֗Ь&hs j-~$s&Z}2KĻ9ƻS@u9Ck[>+sqoH'6Xء%5w{ $aqaLwZ:k h%> , !g|׸ GM¥Å1˘:JUQZT(ěŪQ؈X ZLgk'N\ѕXĔ`F)r:K>A:Fs6?H|c9vGNF3HG4Kx<ԕXԺwԾ:q.'SY8O>D20:\Ҍpw1؂N\ITZY2x]2 ؋"u 5-eDpJM}RZ.يPAHU+Ab= Un2$:4WL4l6N*Ns3AzՖۙ̆H;dX(r<@E#E/NSC)0E ߼lNLͽ|ߪ7 #Hђ R>̧) Lg\Ym J͜v3c l, JrR+9(tvK#/3h?*+K:>=Fi.R5%./(5&$4<²Ϩ0h>|<~_3w#<(9J [aTJ_ۄB)cX&l6 ƒ:mNCաN9>!T^ Mnz++TX=fd,%@Y~Ĥ\pX/]Y]TDސ A?@ QhW_wSF.>&@-Zތq[Dﯙ$t=[4AI˯άˊ@"/4eIQd8N$s煰d4` ID+L^ @o1N$N'L5x?Pj39}8B3Ne?s´%Si_N.fKΒ o8[C #rߘR )R( 1uRr."koR`o F>rCN . R(*۬|8.w<θ8:\>oC>2H0sr\"~ٞo Qx,%AiJ B[khڜ5(E5'M(ԿӠo*0;ܣ]>DCBCCBC Dшڋ䝰C DD D( UԾev!n9HX[C `d MhGheʘ)(M i,Q[; %w.M >B4T`d!(ptMkrvfhӪ*RҶ \YuMv~]H7V@nC)6ZAE(㱶Erˤj5]CCz-$֍>>*א͒+_μУKf:سkߞj?5|hDΩ_Ͼ˟O_͘$Ͽ/WjIyBG( 6F(Vh pv衇xd |,-( Hb; @i!HڑPF)$&DFi%I2#Nn嗳( &ihYflfk؛tiE訅|ig砨F(iZdKLL褎餌VJȥj >)J)W)b(Z:kJʫ [J**>ઘhE!$m~mrkin. ;.q@ /[U pZ0!LD\QD 1զvmCEpvq:i $wqL-,ur uL392߬sW6M>MSBGtH7Dtҭ, u*NOmu]^Zw݊^gRudהuҌ|Ͷ+j]ԭr vs *]BQvk7w਄Ĉw {#x)#dk^w{zw z' ^{ { .ֶw횤_z"Hnչ|&qVW'h>DO83?=+ C|IuO_B_H*Ё _X2A j;H LHAP, SB5<mP%}DQb!H&P4H,H!-"x1f̢!84vPc!F'wHt#,BC $HF="xIǒ$ 9IN^\d%AIB',%0JB2Te,3yVy'ê]gYױIeŤ 2ie˄&2LaFS״49LDgC3ILAʙ$: es'0zt';O}ӟh=zrAOԡhAeřOf29Ѧ~r f4QM*IW:[0KU 24&n2~+;VsY)-8pJ U/,O _n9Ua @If1B(#!@4L+&u-+%`BVeO0C+TJ5Um Aj"{1u.xqL‡:Ū/^<{֯g:2euSᘜCQo0 aQ &zk dɇန7{t|k`uؓfy22`?.l$3&6 _[ipB&<Cp@] *Evr-h.J !62$́Xޭl ,63g{6=, -ϊ2qj/@ʲ2?j,>DsaJأ!>a8vWaƘ:g6ef@uͣv~w[]CD6>G/KD~$L6溯0Kn,xu5xi5='=iG%άHoyy q-6U4Ŧ}a8y&@GQI5`ϭx8n# Ap;Z>-+AL%Ϻz݊_1z!~xu6?~_(LϏ y*-"|tɘ-@fv87{X񈿥]nb= 5X27M@aes;MMp%R=K:' uoC>=lW|W46^pVW? 8z;Xq{s9mwZZ^ g^X#!m%56w/T&l aWd2w U x^E6Wq6ev' 6Gp}~`Y~93ϐK!`Sl aQQ{Y!݄TNJM(B aϠ CW< O1 -F`SƆTe8ƦfRTJxbOJpTe8P 8J]؈J8dge 6E2827U5Q;& 6(H{FE| Ǵ[7ThW?%( F (W ʸ KeV`lpWA^V@y,OXۨ x8\~*ôO3sbup`\bA}06ei6bzd`%{T}kt -f^e RU28 \h9ulRvo%{m{`]YgteuufEfcؔX$ xjFk?6_oVK?Pfm c@J` we ,pxL{Ip`aZyE()t Iw)o~d|lpYuee\7)WoU@o{ƚpZ`(i[~@g Qu pir(V^{ j,{Kx& i Fo)RDclruB}6/Kz@~6HځVquri"Uy7d 1Udu z4)PV(a)Vy rH3J2zbSHt2`@(PX8 ã Tڇ>*-Z2ƣSH2YI!3i ̨;YӦp2rZ-t vz$c~ 3BҒ,ڨZv|J":)ɏ:XI*,ڪ/檴Zʔ  vJkr{ʩ mWiʬ{X,$Ιv)ՊmҺKҭQ0jqzzJgz#z2Z tߊ*"J"0 0򣰍i,0 [p۱:&;o&`0+@# 8:$k1;j qpg M[o*vq?QEgTZs\ڵ~+ѺwwxfrUgxzyZ]`P {{" YxUeih0gWgeNbJv:6BUi 봕ʘ{\[]+m o掆ro҂`  0 hci7l(VVAeVdž;˶e cDVo%[ƨ7RdA qA{3)ҥ~zFCe ;k/$A܅EO9,ùpKY](u^]x@ef,^0 \+6 p RZ]\ dQpdelg \RsluUveyL/k\ lwm^h LdFLPRRεtl%ňILC(ackb>wKL2 ڜẗsl plJx )+*/q C EM̚Ӝ|i7E[V\0#V- G|˴L_S1uRkͯǦ4|LRg2T a,-7}QPMe yKj6TK]0 Më06]Ў׆ݿ*hP 6%Vc$K]0~2۷j&0k~)Fbj% W6~ʂ]]Y[ۼ`k jYݝ]AM o -G!adCnɯf{\.M+\|qܶ N@_ ^"?֑p>~@Eh4-[-VkZ ˰'lu֌ Y5室,- M`l1=slZ0i~K^Rz I!-?wa؄]6hUmm`S"aM*dR Ɖ\NgB"PTMS6RPsPI~ &0s 2>B  Kn}&ⰞTe'˴^#ЌZ\1NN;nn 01Q:͹=IvP4WC-ݽĮ1?Ƥ& n!aNݳ?ql Nnt-pL naj t̘0{5- *>՝E ?,lhP2  20XdleLG&uaKUd.BVH[Nd yQ\[LЧl^}rΌa Wox?X[!󢧡e2ey="qsW $t;PhJU6 evu4@ ٬M@ 8${,L+PNŴ'{31)@B|  %1 \ Py-K 8X ;^F. ^b 3ά2"+. ZXDkZB2e=ܮM 7˕N]XN2dq#% z:n lV(TڍAW9do-b׬gJ0^hk}9x{=i6ZvЧ\١kHL`Nuޖ?%;s{48ܿ4RW&P}Zroˌ }/ Z'z|%<"MۏL_1~\#> Ga%8#{_;A8$N8Xp":V=v }5n&!:&4: Sr0PL g>0Q|",bN MhqjI‹&z%a %/51wYE~kh! HML18=ш0-`@ DQ0cD.IA(%q1G΁Jm&2 !?%rpeIBIQ68&(XJp =z8 >-b3Xa0Fk% Xl% 9K@CO K&?Mo @P /5 Op D* 6?>/Ax(baLfOͭK'ֆ 1s>' !&B2"󨬐(7oa@@e" dCv)88GѤzDej1DLjKF#r*md ڑ^UtcGz SBiX"~rE#Y"zْ"Rs=X]8BUK_Zui7P'5&RHį< MBoɯ8<8'GB f FFR!~\=ҘY. sg&s,E\RQnW׳m 8`T4*TH!pkbPD!ΰ7{ Tw)4V< "*OlHg0TVbtW6ZUay+M!\C[XD3Q%[3z!:e˦T26_R0~bxγ>πB;/VRX0K>3P +I#9p7SݍGMqʱmnZ c\nH1E%#R5[-e*bcWyȠrlXWCakC?{B6jqK=rr"7a@ЇNH8Rm ^,8q6Q.x}:\9pmiSNHv]M@R 6Iꤻ:D"JnHQum=ulQj"lF>nq{7r#]IOWտً"ӓ8P,IbN8P;LMAһ%$A}Qx-v݆ͽ̒8#L M'o{υE> !G; Cd?Iv_"vp)xCLw~sbτrih ]R$ITt'" X= g~k tT~ ;2U´=!8>-'8z)}+A`}sS>K sQ:MR0e=3}52C8!b@S6ST;R~@T?%=C(x$&AZPic#6 R<0 V1F%6ׅEQ -"  # q8LdGCyeP`XQ-MQy v9`@[9H8Opah#&{8R䀬AU.߷Ui4 ŁlwI=Xnr&šh Aq;mPg9)EvEpi~JURo'lb8w?tHe;$[h1A rn#9294Y6y8:s2ǐ^ .0-+R3!GARB Ma5.mx:AGs\x(M 9a5$xc6W<#@y Qy5ax]STBȖwoT?i||qr}X3*kٚ(unXؒVB} r0d׃O7~)Q9)A-X^Jw){9]sQ{;胏i9qȜ؏ "Un健)%鹐ڞD4Ƞ)J- C7c'w |J3w p uLuȹo"8Y:5KA,oyȑKsElBd@<>I}:H -)#+Yd#vu_$nԥ%ѡ$`h[IHgڛG<⡤@6 v ^:8J$#p<虫bzfJYk{%Z.߁6.@%ħ#bZ=J=بta d#ZOoC*yp{\HD v3ZzP.?Mp @?%1q a8M8)Qdzg 7TD[PR2h  g#";$[&ڞۙiD7=k $P~);ٲH[7K|Ƴ+khɛZ?RN# {g phjjP?x,[)1}56 $Qwy ᪰>)GV+fsEu4JyLk=yp +=KqTKjE*̪%sqsK#=#Aط Q۰;[: [;t;;w A¢'* ˛PיS [- cwptC֦w,3HūںXۚ[Z+r6:a.+URC1zQ{TAKV:1;5q 'vlt *3,~l~+N_?M0N{KN|L1lU{WY|,C(Ǎ4hzSLF+|,b+ȌDȢYTCzǍ puj X%|>~TܣRɖ?7y[ʯ ;:`Zˍ|xLJڛȦ=+=LEk||ʺͮ:2|Yʜ,P,\L͗G< mѴy~Vy =zM$*g7H004]6}8::k"2B=D]FmC6 %P}P}S!Cž|b-W4h}td ih]֖0nsֿ%aws],L~}k HD ׊|uciג}٪eb}ؘ٢؎-ک٦z]ڰ۲=۴]۶}۸۹10=]}ȝʽ]=ԽPԝڍ=ܫ(؜Mޘ˒pc޿==]Mۂ=Cp*~Jգ^~w@И}K$^&~(*,H&j2>`98:<>c$\FͰJki|EJG^MIXA-Y>\-joKpޞC`jk~̱,b~.5 OoBоa:n^ >Gq~F5^'˩n%[ !dX 0I 6HB,@BNώR3_LCXP1 A0 ~HW^*;\sC\V Wf3?C!U!LbODZHE@9JRu@sMC,QcPߡ.BA#{[#972'pKS7I.L-4~z-DžVf#9A cOajl(S6-w7( do:Pt`OoK?HV^zMeGSA^{yl.QJ;Xg8/#`(/J6i}N޻ALz>?x!i!q xnsvo|ꭟ*T,޻Wk4fM n|R aXGQR5E L8bRU?'DC C B CCDCDDDij D DC D  ƴD  Cx9PÇ t"G@ 3R li'FD\d*"U.WʜH!wC #@<nyC$C(ދ]z AkBP=HF&#K!;UĘQFE >pMKzrnTKȮ,[-x@aoE!@ƶٳMQ @_H0` O͘r'@[᝸o_F aMЁ…>*'33)r2|! 4>_$V)y0FƦ )U9P!FWm Q; :B|핸rzts'h[o8!/@2AppEa $ xLV)WM]%l@P7CnLЍs[,K $(Rt|iĀhX0 TN'[S sYO$yd%K| 'q /HQ5Xر$agtt4K`j㓇\r2KhsY! 8D@P-gM f(_?.@=W`1^ 7",d>nK-v4?>u<V |f,F83MהEJ.9ph! 40f[uh2,3 b$!0߬4`3# o&Bp*ꀽ 4 aJ 9OɴѩFԎ`nΘG`߹vT~H15⨧:Ί[e$P^W&,nQ`'ƾϾ.^Ч.6t=_+ǧ IB~]$&F:򑐌$'IJZrI{CȈKz (GIRL*A:̴b,+h!\,w^ f/[)9L(kٌ["P4IjZl%" 8IrL:չFd%T:Iz̧>~ g 7CXp%,BBjD‰ZM3юz"!b$Ғԕ]E_ #P1d!\TNXTG_%BZ`eX-Q&[l%ja&\$`p<Z!|%̐ Ip# 3$!%|$_گ)0L5aN5C+\\Xh0][6H9_PP l@8 `EDt L$u5a`f%P}9 -WVchͿ"\|LBa9]`y%w^25`iEG[` Fa 24!h59g 3LQyU_^%f6?:Aem_cF_bg@TX'@=Qg ~OMT5r-kP $@J۩:\L%"V.85S0`ZOpDM R(B (`0}w:Ԑ\$BE28 ;ڟ "Q @80Fûe)S*娇:zw^D0tۓBFDyp$2uiHádVHQz^zr%9h[ PB@Ap!`hNAD.HVX(*') t$I@Bdd+/ HU @E?wD@XcΉ͵Fa E󼔔>6NHNxc8iJu(Np r  }UqR`d,/ Ժgb4wzC 0ڨx  SP@Ep1( B Oi; 0`:hgh `HQ`00M ;HZ``IpgȐ$`7E_J<("[@hCkBIy^MLgBrnv ωPɣKQנΫ(.%Q 3(CIP 7hi 2;X`<w ë0 dC`c :X%XP P.0Al``)P!)RE:eG$ v% NWЀ a-P?7N< b?L 8`npdftm NX4P@>CIL]2AQ=u#n .4ac8 n ^|"ǧaC/ 0eL6H7 L̠<{ H+}Kjo$_d@~ @M>0ǿ@ Z9vZ.@oP`P0<@ CZ_x7NP-(UaC.5PB I*md^r `;dK%`k3. oBXPE`*zLb ,Du*. 3@j`E6h M  i8gGka" pNO`* tV0?sQbR2R5{Hp:3l<FPS2Pt !T DsRX`1PV&UQ00K&@3-"0O0rDD؀3`2 MK1EGL-s<$<0!7p?gx u&p" @<@,a@8 a$CT3ph823(1hA`4VQ3DR~ODP$<HrSVm0YZT#ARs m Zv蒯:D@1@#_ꠚTF2P#˚4@>XR>m@sj `E0D3"!MO[pO!\Ye)DDI)Ѧ: .+P~֘aw%a|jmXWmplcV4n  -p_A)B\`7T7pC%DB5F031%Z_BWR%pY`PٕWuzsF΋p]4& ~'=nL7TYEb"')r/צ$T(KJc4gˁ;͠*7:=Kiy J{~'Td[(`$| B`dӰLf)f h2r b4p.9JMqvC<`)" DF^ r)7b0@Owl! ܀_QwXaزP80h0B8zhC$pXK1'#E'rH|Y)ܬ:]qXprD\K z ϴY bވK`Z¹ gcQ 0:-m5mq|L3ij?N4"3e:0-  .(B0/:vBU9f(Yd R :R0Y:( NRlYNʷd0l _ x02vņEH$UhcQF<&#FL8BFAf(-p(QXh " A &7hG^1'6ݠA8zaex4ơ&Ab8 (R528w%^x@@C D.8kdM(E3&a҆ .&0iaAfB ' %B FusAޢ.Hw$зسkν)fTpgA1N\*N8Rp@7A4&H ?Q G `iguس?c" }gL`B J(C 9Q W`@< C D|70VPY(!MEJ8AC e0Wdg`C#D-XaiN԰AuU\A3ܘVpA H #``ce% \b lP;h"& !D\C8׀!pT!Aa`ZmМm!qQ֎HGq\^|߶s a'Y@EVTs+GdĦ8 paxT-AŠ$Q:g:҂Y/"e\ $ԱG/vd Pf s"- D@HaF @]V- )8 7˄ B@ V3[2R@fz['9ɷF8BkPU2IE3Xvr̥,wKrq.qKD貘&|8*y3Yw9Ӛ΄c JPP ,#l`#L!l%-aLx&P0~A X KP >dN`rhX6`=~ .# 0#b'l>1"+N38Ӟ4!~JTI8E@Ȃ Lk9i{/H e` )T8 Dڀ- Kc.T`% ԈZ5^R.xa JU鉹ilW5+Β֩ |lM=ֺz]`iAUo0ޢ% VIJl ` (2_,;%A/5,kK^|L8W!,a~foɄ* ,43$k Mt-]W %R6t 0Ӵ:@Gx*vadƾq-<UҍFrp0(&ɾ  1b h2P:ˇ).-03{a0>ٌ 1`6 9V4DV7N{z;r-qPv_>s6oqMg9ÔH5sxin?P_Zp@!4+֔0p-B))рA{"N-fvK @@8]A^RxЧ~X}5@-4R >A>@`3wMb  (jiȊ$?B@?x(A KihAB'4L컅 P @T(uP+4c:;$ōHJn>[;>Da[|wta]  Hp*|8;* ox+Y1t@6\@PBK 6A?! -BppB>p>=1`7 +I'|6p!p"-\Fy8 :'XC!uPW6{pp( xP 6pV` %p10HP0'C@CCPPpp09pz.{? |f +]o1H"pUfVhsOG6?MJ &W*XfNo6VxTpCMp7EC_h!'`0xU~!pp{U7p'Wh @F8؍Xnp]PtHH~ H+!+?#Pjz?h w!wX0VMxxuˆ> 2~pOx ]p"` Hiȇ@8:Y&|@c/~52]o P60~ׇKL{|R^0&P>`>0~!!bR`!v.N!&ct]a`|hf;ٙzs?N1`  RRS&A W"ppA\I@- 1E)AN@"8-iyy1IJ1?p&)f К,r@"?``Fo'|Fvj!oJ$X@~ j ڠ Zڠ Kj8yn:4Zj64V%Y!g sßP&NdoTi0v Ue֡Hqr&b 6:d @34S&gb*oiuqpj8ZkQhlijlPffVml*֦-<j"fzoK ꢘXl&#TaIblg`Q5ClzjچIVnjC`}Z*Vl̤Uh!"Y/mbCcf|*fH"7)D2iz *Ŭ17hWfĄ-pT hZ ePbbE- Pjk6HVo`n3' ZsZ4u {˧Jڰ";!v<GO,۲ e@$[Bf0ӳfPONso+mK^14kN`Nڱf*HppT cQU8۟O;h//hjTdc݃n`fc6k{xPgE7pXP{k7@< <IU0t[yb!bbJ+U=po@[.O;Ѻ˺ xd&F`pțʻۼλ$U!Pڻۺc1[g/l껾 i˾;ۿ3P:qq*~  @P\ ~kj N?0<-L/ /\j:ly(@Fk/ BB+/`(D Y|B51 @*p@ j`rkj  *Z6# 0 ,Ia[<[p] =@;\6Yl],G0쾪. ^.ȐG \[@>3HvRƃF ,Z^p2 @c\M[,̭L˭İZ< EʦK,\/=ϟ|e<և&=MČğ?kWŴ%(1BVBͰ-,=.1t)  .] RroRR`Ls05p `P@:~@eA \FpaFM,@@@lHM˭]`!P@[D] KCp  ߒi"Rvo`C6 (1]`p;̵†)(#6qqq`> T0^Px() y@( ڀ`|7}a;P<E`< `<.8NM?鬾c"(/`>z^]^qz^ f"Nv໫.(`ݤ\X[^/͞)tn@dѩ|P]>ɿ@Nv`v@5]/2 ;8w`2>ڎ# IE@r`&rD@oP~3044,Z@J=0rm=@yPp N pOv[lo!z`(^"ny ޻go/+;Fm39?^Nc Tw= f q$>vu^0zdGr K^f]])vKo(/="]"qqB=R^qcR z>":B")= 0::GB,~`5b37*,&D3S3b`bF]o / cq/ ^XrJTRqP,# OEyPc|x SRH2e-cʜI͛8sɳϟ@ JѣHkfL{I͘7^r5c∀E8)T0Զr WIVz}͛uzPKOt~vD2 X#e r1W] y 3FqO#`E }7J@^](,D6;-c&q4|*l@@;L IDih3ЖH]0B/`8'@F xey&JHtzU`/@:H#(0+dmٿ`آ0pB#. ۶[%s `| E]-6/ : J,KG?1~FA9SkP oA sI\T/<0} tSx#-2@537 @\ᇟa9p " 2A0P` *2Pq`X^"1DES\( -Z J&PG:x ` \B8W,(H.RCVɂ)L$#(#?zr.pd#+}M`WްP\},T '!d&BB~R2VIhU"&FQVr3PS|8IrL:vل @JЂMBzP)uCD'JъͨF7 #r86p Z8JWҖ0LgJӚ8ͩNwӞ@ Pya@RԦ2N*T*ժRV*VUY̢` kXYղjfMkVS%5,(0T[9XBV̐.L8#ҕ3iL{zӟ4G-RԤF%ڽN﫥 ai;Si,"aj8jɽ6LfȠemĸA@0ՖP7%3>ȴ:^۩ظ# p`+e۳ bo8؀{'N񊯷et]~5a,26fA?Zqd'ܾ j0(0 1P׹y1|;(.p0 b#, N k1qqۮ.7qs?DA2׸yq]|3Ђ ]-,rȘ &_F6pg 8Y87 @f@6̏sІsН6s>xހ VCmr!77^}ga[`6ۥfqHwb}pTȈdJyeH,P([w8Q;<h0xQs(`2Е'QЉX<7{4rasQЄ~00G2MP@Yycqi\^8Tf&22EЗ 2lvb$D7' &pX@_r%:_)` ддPRO;V{P[X[ C۵`Rb[fkdki{l۶npr;t[v{xz|+0G+'P0=##۸븋۸K˸;;۹=K[;˹=K +빍;[{؛ڻ۽˽ۼk;ě{+ P4!0\| <\|  | |$l)L1p'+\+L(L-L$ :LX0><1l> 1pX@RtwGRnK1 O.y &;7ް+ GBm&2&@,ι O@bw)2@`%~2 ٽ镾< r" =ޛ@r@ %svT8 D`I{8@|  H'tpA8`@/la` [E P U( @ :R"4JU cp C"4Z1j\g#"A<|z # F 'n @ dAƬz` ZJ'F h:Jc` u!ȐrB!\A>8j;`(D<ظ4ȣ "Kz/ i1LcWi|\E!dY$qԢ+:K󺄤 $:,Ot_|.2'P#E跦! a)iȚP ) j&X5D+q$B ԑ3`"@ޖ`RajG?yJ(-C؞Kز; ]țJ@PW!b{ 0'w!Eʟ"m5O# "17ЄG H@UCf9d4I"`qB jESt P^"뙃YWb:C51= GV A>0a͟.6]fu[h6H*D!K !@ V=A~py( '8A8A0`J:ɰx+$l ȁ p H8 tPz/| ma94ρZ &T4dk"Np?Z'@  6\UlG@ eB d*N@`>sЈX!.x6+v` 9XMK콎P^J.)T` |5 VtB0MB$@T,a!!E8 `j`s.ڀq4%peWX*~ ;4lJsxA;8[A=۪2IVx#V@(2 5F jh 0@.U F@:?@;0|w$"cd@B2A20J`bq>-| پq HP HH8PC(' P@kRN2wiЀB?@Jc5)XՁ*PТ>l6+E @Bn 0 @Bf@BR zA L )7n`܀@AQp #KS\B,HDžPh4mXٍPAY@gdz Eg }W;<"!$LHnc_ 5Dpv]0P`u3$Ls?ΓyUPp`$} 2`7b/&‘2t;;&.(n}y~{phu1fy @R@vD*: 0@ ^pQE3JEEe5Z Di)69KcJEo p ]skC`ChD?9o9OYV.!uxoDŽy"IfP`_{} %~3@Nqm"]%Nv/*>y'Pff]0B@8dd(vAhBpvDPfMI3L"?لw pv0@e MP{ED G cs#}pHC8icnuC<&]v (4;Q,y@<+p3kQ>V@^L 6H~0cm !3D~A;TdkQ O W Q1ppnkPcPTk(hW8H0Ց.N"iU)9EXX+Yd. q;MFrHxdu Ё șhvn &  Dykf69CY+!YE 0 MD{7H!g!p0^@X[?*)}jњ)0lZps00`I :90'ڐ)Bs /(*gה#: ~+@;W`.IȚQ)L@WVP90p3@HgYAdPy7!ЉPuUHOMAN wP1T`;bc}ԗQ4{B0VicV0 *2)t=$L)p -k" \T@<Hg9 ?-!Ox Qqwxsgi@(0EAa`%0wakTCY`^nQ.("-#BkMPpu}Ó)m]" #?OUg`:}6ɰ Cs 8ʝ80dr#VY(`2)9B- [] Kp!Nf^P}*qb)>ɻ30 ]^h8Gcb+|@w(! %Sy0`E*"jQ#@hW+C)= ,n`n'f0Tp`+9A`P%#S"C2PG]0P+0}+3] >/B!> @KT |)`_,, M@ !,2xV=X!,hyVg=D<$P@(%{s  .L}"f-*1!e۵.0HP!`CA@AWQ^p^Onj>E?a>M}eт!<qLpkfLj(nC 9!|'pqAYp s' UUr 'a@ !">g1`c,&:ppqB ~Aj1^א4 mª`h UqN<; @aAYR L `:#$!ོ ;#ҀP*zU!"߸!aYaF A<̨ 1K=`:N< Lbps1ab.d>ty,U$_:0>iNjrHwTxk.Pb.o~l芞g}Aw.Lrr!+`憮^设x~,a$ eB 4%.@N.냞d Ԁ&cnNnKp ] Qٞ.nJ On>'0:Ō~~al.聮mN޲`.92wkVx:_:֢ 6$cm{) /5f8?*f"7LI'1oO)N&dL2 ,${6:^e_of`.׹DR)PkJH/_L2$-2ofo&aAMIkv;^ +D<G]QpB0f/ vJA`R2A{ ,  qS9~ OOI'̨-~!Pd) /=,n> #`ɿ&] 8       ͯ8̲ 8 τҠل:)~r fUb嚧W+L (njp;č0Il9 &N6P\(OXW+iY¬NfSƃ"y^?Iܘ|^үξiRp;mQ%,$b ZO?^ZI;`Pc e^: @~NbUaHp#9tܔX`C!cH0" Qm W^aaþГ9D!p<6JԎUt% ΁HAAՎ=VV.Q%`_ d a) {1-P1򡟯H4 K p5ojꩨH`6?=ɍ 6+x^t pd ʀ8Y38`Gf Ct! IoYnJ@ [TD.:^eM$a:%ݢ "n$\E)TPS8"P̕^nII HF5{=gt.`?Iq1R? bSOOG ]DAӘU1A@!N@YRuq |-Y(>ILM@$i`+SWp+wH_v/N}>zZ`?1-H}6l?Ђ"N(>ym 6tpB@ CCܹ p(T1Ȝj<S[Q+P,1py!Ff?TҐ'` \@C2[g8M@P kK80TE9O_`x,G9GHkWV#` Jpe!pf Ul  2(!iQQm!:ڱoBW(lu> 8P@|ȪA3 c(!` ^$B` @36XwD 1]*8HAm*ll<6BHB:%|p<5\!؞ a8`U ቭ Rp\`V` `%#rBY:5H]nH;;BˬdPF!0 A ) `aUx qKͭ+J*  Y C01s!?'H@̃dpŲ 2`A1@/TҦVɣIbeUW@8$AFb Ҏjal:IkY Gt0(p3Uaj f4 rfsEdCEㄘyt 0C C_Ri xef*p(\5<EIP@VNYY,'×_!KˢUp2 9`6 pw CH:XpJ 0<P6Ca(`Z>EB!-cQ}eg (,gN@iULD% >"9%f >:5!+TlaDp \[GQ1 VI_]p86:VV'D>P' Up9[aq`)([af,ՁPµBU%5Cp^BfIa=}tm)?~%~0q a`aM0/LW!;IQ\DmPr @25* 0@>>`|+`N( S xCtR5?/(%GpiP@tWd`q;P 6v(Y=a ]UTP0df 䌚'n@7]FQFTE~ S301tL$ Fȍ `DSmJ'dY>P577s, B1p @p 1'Z?[@Z+Bc`FGFF Hw|H䩭 >ޘ/0 #pZ$(z4adjDFaSf͑:ƪ f>aK8pJzO ::":"js*z劭*1* +J;бbs+- BmE.0He!k,G 3*">[б?#da +K`pr7?Q";f;3/Uq <5i#P еUR Ec0Q[ ͒A %2b da 'K ^@   0 aR7<{G,A?#8Ba  %3 n ɣ[tmz{>Gdyưi)p>c+nv;$r$b!L1{*˿y[*n| M\ $#q  P,R b" K.0*a5Tc`w QIW ½1|HW[ P[p9 #22k rP8P! { #-h@O~` .˷0t dh kjȂ<ʁbE@! `'BB$j#T0{:`-2tgLȨ{GBJtpW -/<< s%ŗΈwYR96+ \u9IVC E )@ (.|Pa|F[i`|_+IqD]5<:( , -ȣHP5WS]MWX)G 6}`sdF!vT0]C"VcW}(F8H, mGR0h,6H6 !hudk^1N7:t4+/pcKfc,\j=1ʑ@)P5,A+@YeD τٞ omZXgK,t.՟7u 8fNԂٸ °i}pdv9l]TƓ- !pY֧an "` )@Kh 0'd`-p( m]ߦT`\p8d@|ippA 49P5 ra>@ 59p$ 8Sy"~cD|>u`71ʚ8@VDN| 4}4!NpmTA7:NT[~YH1=qe!N;aZa5u^) 炮!w~vxw.x>|n>H߃^2xjk Vn՝>cbУ` n 'G #3SQ^>8 5/!10Uð?-Gxоeu ʻ7!2"n3~[;!} nL؞5_z~cb3 1b 0~L1qR .صP2 B |Დ|B6IUA%0lM*nf[.?/@(?,&70'?+]/HQ<5E 0_<FRUng_R;T/O @ SbRJ+~Su@ٮUP^Z\!'' p0~Fq\!@0/ @{S &ML \1 DZbbR O %`0ÃWJIJ%_#<#g<DS“ʏͽSSJW yBG=Y Uq+zđ3d?|F`:cMVAS W!]*QfYhjgGzRIJW:J޸I#\PYA `$=П)fqZtz$# %<{[Tdp$ &ͥp[RNPXD uN&c= kZEr,d9o'_v[4_"-E A mRh.=pXYI 9VuovV^=ffu)\[0f\^zcm%}ۂ @8!':6ZXզ͗ c 6F& h5[ VdQDwQFW&"m$)&W^8X/,"Obx~ &(6vNbeI(`oBQZQz^Ө*jҞ)n*6Ynh ꐑ>b֬fksb+(IogV5v^+,ɽƱZ}jjk\lnU&z캚^kM:I, m;"> +m*q 4mj ɩW7j(+Wo걼v.,Z癘Ԋ&%n??+ԢtҢ2: C}n 79'mBz(xG-V~%xE4ItHӁt=׍8y >{d;IR8D RW񸡉.:Oۗ;=>#9{<{_v5DwJ>glӏ@=|׸)ɧ@ԛGUKTs Fv"O XΗȏ/j5>+O׾!hfYяlLp0D+a^* j fZ5n~ ?`EBXo94 aQ~7< px;aGH /YT7D0kֻ Tce:v9x闪FBD_&CLzҒW:)PR0% /.rG,!yyY9F?lvT+& ^@Ιj0XF3@ PJԢHMRg& , *'&jp +U6 Q.H n*YJVF \(xQ\ATpm?]b:d#¹\ hV7k $ HV3k-hKZъֳ-*8tfCzv8-k[`Z͆Zh3\9);Zͮv Q BHZU ,+6*fà`M{^b"j1p%`zUxg p%x/}ս-{ '\@0pcM]ᮈGLĐM $,#AD@`# ` 62`{] `mE-$.A p2`0y  B!:xγ[8Ń*_ BR`* 8]1$ Vd|d j:! Pn B, %J 0 kWh2` f;jݴ6A~@ @!c/pNA #g8P !?` T$p @lt;A @WZ8T#}IJ{ vktL€5@y51n֞:wtІ@7  u͍+`H! LSHjƷꐛhO;<;1Jg dJ- . <C2ímܠ Rpk_\sp;"߹ + x|B6ֻ?j;Y OA=O)x2iW9J@xfMK):iK@AkUc=%0=~ĿRX/&;wR$T˰p?RPs}A^ cV5y ]|mgpoU l\Se`"S{ zu^pր>lo~280qbƕLYEYUj [Z%"lxM8}`Y^nZZZM@S[B00HprrdR)?Sz2X0z(^RE5r)ׂ9 fH 03(5Ѣ++bz7zx]noeI&%QLs؊<,B[R(٤XN^p0ԋx0^O(E3#7@3d)I6yq.$I >p`x蘎긎0:PKPSD?u:N+I*6 I9rؐ.At9oّ `K ɑ*ْ .1 IC>8Đ9DY8XC*XTLxIyhX6sP'3,$PO#CH6WYI4s tYj8 ?&SU8B7;S&47Px()iJn9PBIJ?p&Zr hVa-A~iR RNy{̔TWQ@&0&`P4Ði-U>b#$~%C0@p , l3b)X$0 əS`Q@0@Pp05`&`h& Jh0IRi_@&0pu_1<&ɟ8vS_#3rX`Q@NX@QZ &Z@b@7_$?$: TQTR4@Z:|?O5@2pX@0Pk;`F@Q`X@Ejy.g: AP,I;Щ?*Z7 8ЧګDS-"'p*Mj k$Q*,Tʴ{Rkb\hЪN 7@$qkg?)gQk& 0@ 3 EP30(I TP25XU3 50_gq,5{]?@U2(ɐ `Ҹ0Ֆ\$0}&U@'x:ÎX+R377H4yD0q-TSB>#< (oB3^HU~8>0fWh &a>q1?1&)-&dZ ƂP~b5p@J@?`9]r[OF0l< @*Oh0:bP_7@*?XQDj0XMjt 0z3(Nh7.9;MlJ3@ 3 QԞg2*Erkb`3Ѯ ?@K.S?c~+@?N=c(2pAt+& 㘪 0`` >fվ 2D.uB-~`&`40EN63G0Z΢DC:;8&SnD_9_tn32@+Q SZ7P߱,@jl<nk0w{DDSӮ]2 `0țo*3J;-ҪS`k0_`8FhX$`@`MPi]-%Q``⚀Ro]2[[&}n०-4}3D25_3< 53&7 5255 &;7&35E&%<&5D3I U¥µ 8y0 h@a|1X0vh ,;ʼnIɓ(S\ɲbs!R(sOh *g/+: 8$d8 ˆK&FSGOz 8@`|)Kݻxݻ2&߿ ntÈuJ'\˕1kތ@dʞ9_h )\k$ 2&׆xhq 1*A \@ӴBd|!>MU 70Hof[62'! W S niK׃0v"bcmdq(h>7i'wvtac8@&ҰM#9sg'8fVbB]_™N`$=Q6G1޹HֻN|p| tBA6٤7g3{%7[K9m^I<95}S,Cu7 dLtпO͓K$ sEy tD'}G-pE0B{ukn#q|I(!D{f=3z`o܃2O#rH!JW)sH J($E)7Egk m-Oyw=ĀJJPW$v(E=Kg{gO6_Edrv " i|#Bw@>wCrv-628+T({sRZ[$V26xD+ @DL/ckTXGSj-F=ʖljREߤw҃oqbڴzܶxSn1"eG2+QwؐD8NI0}G&Ԣy@DBM0D"KcEPdSveW`=rU U=Ff"e)F6d_vUa2T]_6jfY)(,`gfP e'uҘg%QP37C-ipza`be+i-p>8g!ppg" 4] 4+;9ANYatC+EAԲmU*+9;^23jPVHQ2$Յ, D! Qׄq{I>B9$|yǖ Ԩ Ռ!pI+v:!)L)PNi𚘲 `BL9y )`3隵YN`rֹٝ޹9Yy虞9d֙ I Y0ٌ9 aDTAbC%TП)Z)TyU :Y:j3D*TZXU$%z&%jrҐC-ޣi8:<ڣ>@B:DZFzE Lj 0!PI{-Q$OZ^ҥ^`]٤f2brYd'EFS>dy*٧~:Zz*f c, aom֒ZUNڨhj 9IUz)%^\6O؂ʖJ A6jjEIQMPW3 )hcW*iD P(<s50b)'KMWE q kI{˷]hgP; OcE `3/r6OM J*srפ=kYz疺n pP N4AEUr8sokGI0H`&t~;\VY3kg{ kQ5K4SGݒMK 4w,86KPh#$UUrW`U/ VxzOcedE,,? t#Ϙ&l(lJpf:SKmë uBlJ()J'&%<6`9Y73ߢcb\gdQv%4I;JfWщvambs,wvvC [#6|Mjk:Ɵ密 j t @s,پF׆G$#L#fl^?$s:tW_(hA8S _;B;E]O =UD@"rD4䇶@Jo]JHI/j3E#-̛臻!}y;OXIPm?N7lA:+rE`Pg88gXrdޯ4E6HSdǛ~|;92I{K%4mz L8 2`4Ej0= }w™~NEԆ5z͋ 䲢}8\lzYi 58 J4sף(t=EVDKnt KA-CυO|P]&:Q ,Hї4QSIu;MXOjŝaQcZ qڧrtz|zi>];Ffbo0;?_ϛ*'=sf>o>e6",<$I$˿$$eK2pOoI?J2_1oNoPxvW=#,_gؓ =$<9"J))JM %¬#"%  %eܺŗĿ ɣ@i~(d@ IHŋ3Z4#W>JmΗ .]9YBz"-!ȩ/'B @L:jʵׯ`_q kLJLޥ='c.1O.t`y l&a^)h@ X-,ȓ+_^sWa-AЕNB""R8G?C[=1bkpJq&KT_Y%0颋2UhfȊsY|0:.Dzgx# \!Hܤӕ xAh@ vK ,)w & aw^15ihn!W)URXp7y~'Bu3BEA"4a7Dheq"HCm櫰*8kjzI?xC'@Cbg17Q0\R" %ZRIpP- #UQ6櫯+nYhg =jl$Bh "gq@Lf 65d v j FOyN~L:)pAUk8/W* E@)Qiwg B^=˜'4MC ǻTOB065!ڎ]bUEM\EIxw;ۊ@DJDb& .( 1B@D)D@>"L KMl 4odNdurqUMHCJxoE[Ti[?Rƾ%6y`tչ~Mm>#BG@Q|LC!8`??@F TK؞A8`3Or" g(k"z0H|5|#|4r"ELPl"h-JQYD[E+KGB!"::>ёXc>걎p;F(X# 񑐴0Z̤&7INBw F93؁%VRMyF@Z.w^ wP(DA=d+IMLxXf 360,@6Ռ*A@JA<`ІDT v0`av`@X¥@`` pa@ `gM Sh*PUR8ăE!:d5#|fH9FE5sѹ;^ HJ`h@RT8MXK!/1 AxC 䔱TR:7+E .BXфq`p#[9bF70 XI' D|r3  q5C0@V&_BqK82)%sv`\(%2Gu 6r2 ‡?,$X)p)r0 [&@@%n? D.Tihb9$N`2  >\l,+N$@'E)HULq$LLqSޓ]7p}}BX0%L`&npWMO4y]L M@)`@|M zr(B-"P؀ k0Ȇ%:2z+Ӂ%.pUcME"r8Q,,Y8˒f  `ܝ D+dF6 $L¦kP 6/8~$Lr4-["MAփ/eDDLqV@WX@8h4PKp}X@B¯ZBI؁&=I7{M7S倿)r3|GRŐ]v.͓tq4K4:=R1 #52blV Ϫ] Wu3h@&p,XB6| EgO} ~ؾ+vm->%~$+E00I0`|&h@[ ̗wQL=XzsX7T1ErPvPIQPƶu|^ DN}94}7q}$M3Yr20)$#9p"]ZRm)x%` %`d@DÆb%N_q7`j00Y3D%FDTaD``_G?T &kTCIH&xr0LbByKyq Ѧ#q;8)9,G(Ǡ_MEj&`] 5#D@NUNXYU]C `^LXӰDS@diuU_@T=%Mxs`RpV5rjFq0$@4X @SDWN{h SSU *uS>iT<`iA` p%JpwpX" b<#?x=AqO\Lx 0R;p077S,T(%0FYSMNC.9pe`|@wwWwIXYI HQ'Е KGfyhjs5XrY_ N>]@SS.`TSUU P255GISXn@e^ PYٙ㰕 }yٚpЕML؅]kH)Ɓ:]0 yY裍ƙ ڴZ@%|֘y<9+Kٝ$OXTx 5*Yٞ؉C$VC4@SyٟI4 Xp<@DaJN7)+pzڡ4LR0P4Ld9w ( JMX$N4`N_ DhcIZO4Lwp dh; UE2$ 4jQ#]2JZpR=+R/XX8S<.IuSD <у;T9iUU ʥ!2?@oaV4Njk8Ub9w8ZAISIES ]%!ESjl[`[W% q2BQ"\K`ǩFG;v PP0*XVH;C@U?؁94|UFCu_Ee_P5uX^ĩ ˬ @yKtfcJWQ!Q#5Q %; %))0l<2Lj Ȋٙl"' QFg=}FMIВ.ށ yCSHYe U5{Ǻ9UUHxmm݇IP~f4 giti D3u 8 CA[V/EU8}ㅚ$|@:<kJNiR>{ 0bAS@^`b>dCg^jl.Z?xz|~ ]P]0^4!JMn^!71 :ި#.c+7OjꝹ3)pLݴ(A2Գpa?*Qť븾Ofz %0 B:` Ӟ&  [ Lp` R#?ϾŹbgK2{F;=2<r$¡ 9*'t30X0fm&T~p22~2Ꞝ !1}܂0'7 Ss:'p")Yf8@)"F*餎ُp 21.Sw>(YOë<0&f @CJ$g pgRfh)?,ʰtlXT0 0`6' !g FlȊ㓛!TЀv~j |٢ ~(gسj5!FPXc',_h@č)\g00#7̄Tq|5DqV:3 Tj,t=𝕄|5!5$!@ Sl@fO00^s( lo|[CRaXJ~`Pp PS9 <\A, LHh{!S`.ۻq-s=8q-}@L P FQlZ2 !0=Eg!Z# x~L1 2NvE$"fU^T@xP,'Aұ@x-@ DvԨvʞ#gz!j )>"լ?SVJʍR#3+ c J$6}=wSnd՗vD҈YAt*4*3@Cwh4T%(*PYޚI}ei'_N¿JPƙQBMm>֒HfQ$NX8~8*XF..yFE[w^p@z@|. :җ[BNԗ[;ַ{`NhOpNxϻ@;PK`޹1'PK&AOEBPS/img/getstrtd14.gifGIF89a-d:]]d^0e3hҞeGffggl105Hbv5ZhfYmuf-31[EEEwui{k[􀉺!YLXu d~!bɬqy󣥀ә֕y˟W!,zЂ Hp׾*\ȰÀJHŋuEȱǏ Cj(ɓ(Sf$˗0cc)͛8sϟ@M Jѣ"]ʴSsJJJ2'@O>5/8hAy4@<h͓lYDhpx"l5mǃ<&4cO_  oN(ИhžzA5 C 8 Y F P$3*i? 1-zC@{ ?bUT ($h(QAr(\be7pfUeAus4*`r}q }Z4(d=UoqPWQDu 'a- hk#\VX`k@ ?\uբZ I.4vjGvLVarj@\@ ? .jj<`k*v .P,<:p/&`i4 _@y8,`zyLv 2#'Cĕhp0|}|ːT| gj@ڇ!9l`F>@vx{VhMn\ʀN8#kr6  4:O0tF@ 0jeLЅ-?F0`YQ  24 /AL 0pG:E1JP3 h9 j(iYmy b5F  DM3PB< Wz 2#$(Z|&6 T@[ؓpٟ-qic񒙍AY\ieMC#y,P<lxp }K=+( ~괟:z , 5&m5c6,8|wޚa J˃`_%`'$F!a͐;P SSZkB 4c'?m4M3\:@A1 ` *8M:ްg 28y!&+`/ @uT5 9?A 7?$a70Yoq {L6&TpS/)U35䡆Ѕ-XbWP4 :@hXZq2p+d /!bDp d t1@415 f K2C'@qH S X\!s'=;HF{b1ZTD T#` YH)0 n*zbx@f!  X0 Z;ThH ),4C06<0¯V []oxTӬYBX%(a,@l{3xCֻ, C4 ׃278 H~_8(@L "j P4Wtc  @_@X LVrp`t/ @ ɀuXR5e`!k r v ȉ;IC.3a|)n<r(\ P4D H^‡?`fl C27]5q0HĀzm@)i <.@Ѐ@  AbXۀh@S AI  Um{` 'B`"h=5J!Q)B0| b)0# @>l!&>S`k@-#.`Q3wa`7'{{$?7#zb@ & 5:$.Bu2%0Wyp@"*PCۡRU6VPJB5y%!TCu:.f2T`gqbN7F@ `.lU4 T6Z Tځdbr.42cxAAPGc8.ES3C@ix)bG.rizG{@ 0* SB ZpQ3@Z)%9@~R)A>02"03+) (@}B"400$=I "dztAn[AB3I+pE")$.|B`%B+3B H@бPij"76}A6>i_9pLسD=" GuUR@A NP7dDaX14v7Cd2%$.6fqTpb"r!bֆ D-y@8@z%p@_r@F!gm':@_QC4cІ6 `.j" cfY'K0RPigg]{X H9X69B0!?0Yw+7& o  sp5 ~' 4F&j>|a5@v#*AZl 0ЀfJ-jd3 pNi`㳄.il'.Ni`_B@%=/ BfdDRjTK T%( WYX`6T''ndR/ABt@wc^# LqHqwT$PC$sTZQPBu&DPC @d.ZZ@zZvH~TF/"X"+"-#2B#5'<'g 050m0,dy2ْB<୑1:<= SP/X&| @{*I1ANS8Yt*5=P10)ڡ?kP8Ep=lIVP]>c-W#|H0%PdZBU6RuH%p~hwPv$@AGE{`SV/ g U7 j+#5彵'"3֊{@>~  aHbSYQGYP+oyP* @5ˢY1V~J,0`/pb%w(?9N ƅf*7?A{Ovs_al*`4`5=6NɅq|#REBdGyv41TP%PaV =&v&8 Qyv1 @e2Uۙ+2'dlu#y@1;b gAf68D1C. @1p:<T@vQ!zl"3G A )AB @+(<+5n<̱ AÌj˼+)֌X;BY`+P5`5)Üo`VV2ԼB05 Hp5+Ϋ|ڼp T6i68zCrv^T [iV?$}=kE+yodOF%-woQ/tl:VЩ<VP)ْR1CFvQ(R1S& v+EdRP<~oqU/M3߅!؊خB6ZbG; tQ7q'4I=Օ!t q0_֊ {Sr {&y'a |ْ #Ҡ&R|Av1,`'77>Bӵ#K  f#.s6B_{^1j=pF64 mAF7!3E!rB4f$R: 2&I3q2.e53Ld.*Y3#@ME46'kb30P2}2|Jt2#0`&⹢ 9Y{1w174bPɛqTGʸ{Pٖ ̾dG[kKЉ|!~@I*uq-ܚ4QoWUry'7c+.>A N>pn霞%d`(rZ-t ~uzYq|8d>&(uW0d:RzR;=7{rc)5ټz،.ߺ6 6Ge Z'zb%^M.KWaإ0Qڒ$n0Ј| rrUC5Cf@gɗ"VB.yVCr%T9e.vo9ݻp5o,1{pRY!"XY5B*%^ =2@1 z0A6sA5gY'A'֡]01]VWR/yQ8wm]#!Vc}u7th z{- |||C Pyy LLZL:ĬZX:Sy|zz . 4  ?D8$y',6I*y., 1pXpO$qt  p!< !10%$aa'Dp<,Dr*@G#  p0GPQ}GNh.\pa9 ]ȏRTB%}0Dw˘3klyekLӨS^ͺ[+ECt!1Oh3jzt tE,L)&KVdJņ7?ߔ[^Ɋa h !,0%{,`eH8* !.p(LB U4EAP(U !(X,@CH&L6PF)TV[X˼EȒ:b@K` 2w,ԙJ%`Y% tq pVh%~@aa\p XgCFP$z aP TL%RؒjI~FVk&65nyL)lfP+%t^)be izyJCn+95  jGK,ǥpGQ㠀PPIX-1M$` (!DY9«rsR(P@-Dmt!\uAh W10FABP .d"fĪ ^Wv L#]$4Eʃcn-Zk30<h@J?tk (AE2.f@& P [ z3ޢO\J-'`a{O ]@dR Ra\%y$UA!oش`B QPV &Xev$pb䆅 @ B-` j]jBC6.)"QES_7K=ecx$8%,dB Vdk)"ĄN^Y34p6FclÀEj!|`BXZewرLp{U{&u U%$8r>Q2Z% }xq @hGpXg!-ӈHs061@h/'!GX#,2)݇7R' -'p.^ 3'C|qϗ0.e F.c <G8Xxؘڸ؍8Xx蘎긎؎8TTD1e|9Yy ِ9YyِLE`|a0!Cב,ْ.0294Y6y8Hb-y1M 2:r/S0JB:Dn0$Є3h 9`0UEZVzqQK"GMZGIjSdZfZR H2R6@JgZvzCyP [Ip*tZ% q!I!y`U S5$Z:q$j!rJUd~ ',Q81P~|,#,I&?@ ! 0$@ahe5"$6 (q ;Y9y` `VI PoRp `  @ />#0FwP@1@/  @@ "@$Yn1 \kKT0sby$f % `0pFl^ccW`Chwbk2 #bT X`\\I2aW&<aWH!)]KC @T!#p!Z] 9::Up[`3],W* 8\BU%0@P! hc&@?\\"LbR! * ㊵QgvۿC,"Z@ajQ5ha;%`ț\=$2V$O `` )y&hJa 0q<{b% z p{ fR3&`*Ds[E0C>SqWGSI,yhPV!0` fV/D04 P $лpbmI|%EQ˥Sʢl,R4+ ;T ñ;%la:Pbpf@! ,7W`|R% :a.0#`@.@L߬ AߑY%v?@.\Z=X>UQ]s5I%+Jc0,/p5ok0'`51H=&g ]ļ?P5NA , HPJ4G3 !{ Ռ3D)aea)3 J@ p@%+f,m3`5 P! 9F @Y)y@U8pW?K==Q$ O'0/53B `a=:/1[sqf4 00: ?0H @p3|>S; Aߝ>r*y`@D ee@=|I`X)"ւa+pjgp)}MPPGI]۷ۻd=}ܥG#]!=,Pݝ0"HJ "P< s*@|aeC9/p.uOUy*{!3Xw$C!z舞!Q ~| 1$q$a@11`YQ|Vκ5 K#@JK 0BagJv0&0%BOJ/`. p D+߁ =C1$A!pG/`/ N "U`-"L ^PwJ8-"6?KRU?@ EI S-a9j7Q=5*,: <@ |2`NTך鄠  @YJQ#ߝ$pS$TL"lqļ4J-ܯ.]#_yp)-!P95ڛ=4l@ 6S$aLq2<b2bPbq Pr#AUW6鏾ʞ~yy6|~zz+5FF5+y)T0y mR)0JY2BA$B #Q q@qe% EA Aр0M `" QE B4l +bx#4D B82ry` I ́"@ѭ3pP Mu& @ = HA`AUl7#0)kP lN'Ҁ89—_lP @ 5(+<85>=E' B#ԀR ` FCPU@3L&Ё,B < 0Ĝ CL!8B @-5fjĈ$餕pGa@?>؋pA\|` p@0?HAGD)}^W(Y Tt,|`AP@"6!,y 86 P!gYO `<-DYPp/> łQ A<Cy6O$zLh/6GҴa8>d QdAmU'08 @| P{XD`4 ``A<@9A :p.@,{@@  !Hس,# ݀z^ l0b2m1$gf1fiD3! Ȉ@ArqR8hL4"9p y `T2m@&?QA y~`fH!Hp X.xג|mPt&O0  ]Ft<ɃLP8 %;_\:J|7A X` ByJ(0C489#-]TttR |ԀM @jt!khLFJ<$0`#0l@bڱ&{@X *ІB ! K!$hr3+|0@Qybe1D=pkKF1@- #yN`GJw#)Dq]r`TӰV@4^ |V vES 'wӡZa_er7Gu}އxW ~~~G/` 'iuD#c7HQ`"V 5@r3}R `T) @$wٷd0r?Rp?wz`0,B؋[ x{p@0'E@sX OwH>E`C=I`i.\чqS'UKH"pC`I @|ALD/92 D}M''Ӊ f40`4= :HM/5 b)d+84ayI8]wlЀ-F$)x!ea=G{:)pndTF=36x C a4 BjciAuYp3HU6pPė09@lmWAzӐ+GCa< $6rUeEOP`C|w|]57 t'CgA{tTt¥:7*j•AGBXBpb"EY2 #!.7PJj0$h*$@0 EJJ6 S-28 `pJF"&sb"p8Y0$TW5*8U d nj0  ~j 7S`2F1Pmcԇp `1T qsBc&BW@D+`|S"@ c9 uQ D6yB@7ypYЪ庨zp J P8IbJJ ^G0C$ާQQ P ;}~CN% UQKʩ䧡 rJ ǚ_2"Қjتꊓ9DY0S0! zK˨@"$0T x<=R늫HADQr$@OgCG֘AGzPmksEu*JAhA~v{+t9Gp-0Y0,7AO>#y q "4@'aiK FcK+!*P92@PBy4KNidG"C-<@С]*,@dM$E+ࠚ?(B SN*c02Dk0нdy*A$RS`K+Ƽty !{ zr4I[s#{19<2'CYC0d?Phc <[@@<0q y,E#ܽK Qɛ® R@+{y`i`4@' @6fi%IG`Ozt^ M Fk T!hS#>0I7D M,@C}Ny4t|4S0 |0>s9@ _dю0tV wukҎQ6 V*ю lWO&p&#MkcLFwRv* >ÎPR08L-R#9U`9! A=0Ѫ[M'!d} jl mnp폎 8&0_h&PCHP ơۗkK0$T 4SW t6 Al7gJw'?sܷ2:|s  t BP8+ C`hJ-7$|@@y6ȑȮ+Pb$aGA#c'~1/ NBG{6ؖjL!4m4141`Op18^VW.䔧[uSBzn=$HqY=IsD0beE-p.,䟴i]P:Ҙwv 6`yF%]x}#tQ } {n}p#E޵v!I{}oNU^h07nTܙ؜NBNͮ 4NXNG~x=?#tOu6E|'L2JBu ͩ6As+Zt8EǘCwTBLp@d4]G10PH6P7@?.n4Vr}! ,=9:`8INsO3|qU#\y&u3vk46)Vi0j10Nt?QH=Rmxk {1QO \vdkGӮq_eF7I u!ȧF#E Rgˎ l7kӎautD4I:pG.3 yy#y{| yy**>4>,,y68&*N |{||~~z| {z| z~z{~ ||z{{~  {z2g-Z<t Dh+^غE$^|܊"Qy ! @PQ#Z ]5@hΝy: ML㣔D 0^ H 8$˜:gr\yJl "HuEU?/sʤIQ|js+m Z'"F (4* ,p GARCԧ)ʑCJTIȾo1k!!e<@+  D>05-<'ΚVGN2|ÈrSN;PM"nI5C <a# GMh‡q8Cʈ~ 9c 6`1z@L>$3ʜc7`39~#;O>2$.!@r9 r' p\E@&i'QD "*c΍`#:Hb"#>IWZ0&qeyBՍ9g['w r!"Gx (} gNHG\" w !:lǚӈJZ|dlyJ Wg@@ex\ur W=wNJTBCb.t ڊkHR\O'egf:@o\q6qV#-c\d O9O$;X9&s509fS={85B#C:9 @ -X ɳ `YP OAbt+1V#4],3 ʌh[GntR]6[\,bT~(TD [ME7S19&!\G-$:6nMn|d!dYf]ezy"RF`UelX>+Jw4|5WVԪvgMZۺժvAK `|' 0L/F@ 0 `F g]JYD2[Dm2H9@` VqX;`̀un<]"yA]l]>if- UpAN  BAح; ( = ~H f#@:`ЃR."d5pQA v^ v)*."#PPrhO}@@xϻ=Wzp AnF DC1 vw0p/DI~;`?(@gnD՟v jy[iZD;y`S@XÁI AƔj z $AS9;:@"PB?wȏ "p-x" H`}H  "03 %`!6h|@Ai =  =ٟC kkaR HdXY}i4@JpGy5n&B `yP)BP}4"I`+`\!ψfr' 5 z~'@ @K\ON9Y5[/`BK5 @+D>scT sH0CJspgiyy3Bp Nf*)#`<$aOa0Y0,Q.񹫼ګ12;DzȚ梒@VeyP G DHNJԚf4+`8@o(z٤ A&`iZl!B p"dIR)ڤya10=0+86m))<`,W$@0b* = s'L+0IP-1)y;43:\Q䤘㺠5 H芙'`G`  AP` *v{x 0eXp!D%Z6kkx% L@b{|_̊ fjY /ɸ5หk+@ɭdKwEʘ 9,J20 hP?0Zz)>O[}}F@WOXL ;Z-Ў 0)TIH@˺|8YKVz@"iz<,]|H[ @w5500 Չ m$<a)$LRIJZ+pz:wXrY.TqՇ)I` TzN۷zYsr TX{H#pEb(ȌA&Jt =rH!;?׊)\[)@Ѭ<˴\˶|+lkȈ湕 6@t<2`"H${Y`" )q0pu#Yg"z@@pmsY f xmspm=H (f@``D7 8D@ŢC T)frTfI} 0"`O90 J} wLB6̼-0x 3HyR=T|U @ `g.P-r# ;GsqKqѬ:}z hr&yѸ/ i3 A|@1K  F 2g;0{`aIt@' Tgd$UX=/@!T<6*M~PТʴ$)bGv`vUɷpV.~e¡>CK; PJKKDAb! ;`(Udr2Ke@N=K7JVHB<>eQF`Gi4y(GpA)CP!@0>C d fn!|U-J?piǒiijƷVAJ8p`l5YcR-&VP@*)y/s.͖[)x 9PViOV;8Bs/d,p}$"(#f)8lL.zn8nf>Y?g^Q| [,p,8ͳ @ﮎ *UfWbG00`AbbMEfiO`s\!P4 yHX`biAc6ˆ eNuN(q*H\a8-a;O b{M{)c;gn7l[ ,@ }fh|{01`ۣ*$2H) n61"$BN;.TO'9wRO#,.u = fR/ʋ#3EhyZWp\i U%?0 o'Am/`[* t7@F7{ X%p "IC*CAg*xE.`zDG4 >|/p{y y*y||ijzzD yy&>44G y9y$C y#yDu(|8:. nui‚ #\`< `X|ЀJ"ǒ:DDӧPJJիX: УG"Q@N- d@v(`+&T4Q7 E?-x ʈKx?h@ĂX$@f(DA(V 43icz8:Ā,M02سkν;-  vT2 :QZ-J$HI0PE/ p,r}ED 0&hr &mWd <#@aA8ᨐC4T!Li %& d '҉2J9s.4?PݘdihixpB \ DpDϐ3A DƇ OD/(p[tMBW ؤV&>FxjPBv\h.]ǝVs1k h`^ [BWEe@@)ʚyW4` 'y"yAFB)mE萒I1N:\ANP,@W|`\1LcPp-s p\2耛x6\D-륢,nǁLp/:d%pP` =l@%G Fk P31| dg`td@30AO!` c# ʮ/Se7&7 *8A(}' NWH A{.8?G>&hLB+^1 G*`al ͬ`Cm,XK TMsFp1= y(OP44zpXր;4B?52xSG2hD6#(6&J:'wX F 2@@bX7<0 &PSl Skh!l.1݈ X5Gj5 $ ~8 Abi!@x'CkC <# 8i5o L `&<8!H;DIYET,p2Jā2 & d4}ꀾ~*@#!BIh=~|@hV2bSZ%HU 7\TfYOГOXͪVF) W08 xq%&@ l.&(M۸+@!|;2 $3C#A2$@N @JLF0A~!QKB&p.|ЂFX# %:X#p& ]u hL@~"% ٣UW @IKbq!d'yu ?łbW;ЅBXYUORJ\sZWp$ĥX}yppьz 8αM<U@ffLk+p@ J{`pC{`>U,@ (EK,`_*$ȀB05C Ɉi<4`D#j>c!JCᥠ}xzm E:-B{޷RuC*ei?uU äa/ PU fԁ 0P'! hslTф HPb !Fh5dPGyhMe ;  X„%, M[gZ#\(E 5h0F OXt|D"x,@ y0 XD3C(tA5s,y&8=d  6$t,0KJ^ފ洔 V3e[1$ pjѥ`O|VX;񐏼'Oy@VU{GOқOWֻgpU,b}Ƚw- OBp;ЏO[Ͼ{O~COg|pɱyϿX P c8`x ؀Xj0{p{fFq M8NXXF?}x(sC~!XF~P*X6xgit ˅B8DH ~тE&MPEQ8YVxXYxO8 ,X a4hjh 1 d \H 4X8Xx؈ґkX_~`cJ {8 Ȃ 8Xx؋X`؉8@qȘʸ(N txh/ 8 8 1`؎P|P0XxXMetxvȍ xpO;莭T I\6 &y(*,ْ&yM P\y.ٓ>.0 P`- K\p{Z\ٕ^`|v臢p ~ap`eJFx \q{NH蔀P\0r0 5 yy|pɐ&y 48@z0Ri{X`! IXǰ(~؄SYBx P @{c~X ۙ @~P Ж~ #e љ ߙ♟ۉ  ПI鞞hPPaz~jɡ١ hF(1,ڂCmX Tc )Pm9IСi|4 QhؖW퉥~PM P]i׉j09P9癞㹕kJ^Um߆ɡ} I jZiF,؆$٨j @6Xcɦy9pʞ 鞵X`YYzy niҺii) X9u*:J CXi`j_H"Z y{Z\=ZPc~ 剑j뗕L ׹ז Qʖ 0RP ٟ!˝Z~׉8kٱz KJ9y``pʡ,ڨ ~ȔHءIY *zuxZeʹk8iQ Ȑ@XI6kɱZIZZ 骟{갯Yj[{k1չՙm){} A5+ʗ4[\ːHڢFb )(j lp;Y49b;)ŠJQ0R 9ZE그u HK PxË鄍iiY[z˞c ʢ* QPE!;՛_¤)[*( K ʱ͊Z۬v;L &@ snHH j& ۹xLh\{"<-XZYJ32^/.1N196^?7<6~3H=><ފ_QX _ __qϕ c$_XF] X۪YnaL> llz(7?dh*8z侃2,ߵ+k.NF/ֶWJY Y/Foc^Y(nƻdbfL/I8n8nom ޔ , 4hI),)/z;~k)JnHZyOf ;FβO؇_mTHTοx_~|{ ||{|~~̈ϫ˧ݕգ嵎梞픡~ H*\OeiH*Uci*UvZ2zԌ&>z^Z3u(ӾCl5)ZOUd*V|$#+E4*Ogd(n|xzlj(iM;d^ӭ V=c[N&ydȸǐ#Kfp`} :m].y_u$K_qI$ RT!ё2RAR_z65,[*^xĆ8 /%WG7Mc*h!ӭvjQdHtO#+|XGXH'\vM 6dS_;p ,tEM8K}Vqe4|agн6pF9ELPQ#i*蠄 4h kaf v)Rkapi Se: fP-#Lc]{y)8Caz+Z)jV6 }쩻f&)b fV*VC쭢V{캼lHK"VN 1:jFKL[GG,Сb~vQ-ej颹2"1˝첯S[Ÿ>?O+ȖžS+p"l,_v%c:t?Z׵ŪK\&S_r&&S`+(_wX{c* J7Ha عróg!c\)vl0|kȑ2*,I r+JjG+:/iw_>u砂g'oYW1ȷųgJlVŸRjԴm7s _A[X&U,INq'#j65G`ʾ&T5Ue" W=G0]^sָ Qh\WE2]JZ-ͦ sehUE9:o\&Ye;Pv0LC9V ~ZƦݬ4P}9#2娤0lLCWq)A"r%=A6V#V3G[,Y. 8ƷHh~Uh[x%3FSR7a׺n.{ةL(NW4!5x%@uq%~&N lX H±09x^bƪhjk0 oY#<3\{lқOWֻg<&^+~-.`@H>;8@?p@yH>X ( `ڏ/0|`~# vw h C`G~Q @0CCb]KPP~C {**0 :<؃>@B8DXFxHJL؄NP{gP{|p}.@@` 1p}w} 0jx}1p1ppw|y0Χyf6~' χ|}&`hg|lihfVp (9 pvK0{ | @hPp'.p2PV*@p0H(P @Q8XxȘʸ،N8EvV'&`p|WF]*@|{p}'`>~jx0yF~긍>p}0 y} yxK~0P*kw'P5P1jP"}y/0p@B9DYFЈE0ը}̇|}oÇ |p}9 `khl_i}8@hԧpTg 9 RЉ 0R 2p` z(Gp|R )pj`.@D0yٚɄIY{K W{fH @y`P'.n68 ʷ ) i @`< ` <}jp}|y} C #`2AJUy` 6D J p$V`8V@0 *,ڢ. rԈNŗ2%:!gG.&np}2! pW I{ 1 =z80~ `i}gIV9hYH2<@$RC +H @w0I<@9@TyШ{ T𢪺ڪ1Z4ڔç=>F ک W2 `:` yP~8$py0@ $0'n#P{<G 4" m {"<J3 30J `mT`$3 K ڲ.0E86Z@azy0W!P!BK%JA /G;bHF`*[Уen˶f xJ@h@p (<0<  _*K <*Jgٯi? p|@Z BZ@@:=6LU>':`n̋g  8@?`Xv94 2@ HHI`bB0+)G`@ B<` H"," ` |{?ָg`$ $АR:`:`0$@i[dI&F0L>JaԙiV3 ؚ%d?УKQK{8wPP Dd@KF +0 lK<0b "01|!ɞɠ#'{!v}?$@ p,y`h@T=!>0НCK p@CkP,@^R\Dp:0%jp4Z Ƹp:hp$@(K'D 2 pFp=:hC` - |@1oW0LPb\л0|Y@B;C=x -pPMKC; ך,u|{R<4@=P}8@0 " dA#@p2H0?P@  >!ٚ.:3Z5zln' ]*` ͶȫUP^lZ/L%дpdl*=/ WU;L&mǏ)R`2иh P`$ ]w@,CsPZ\NM%}6 vlI LG|?j$?@h`::) I&Py1`J,){p]G)A `.P3pPa+=)0)P`^5N ~p>^" JIʠM.pי?b٥[zd8| 0yY4w>'p|bp~淖G880㝃G b]`8@DID0P0 @9 Θ K\V>Pw~FX7ǧ9~h~ }7~©@0aɍww|}LJ6~َGQ p,|/@ ߐg} @G`*?`b`G,*)/ G @9vԘ`b{nfho}0vxz|~?_ /! q\?__`xN˾?1-?_7ymtNu.u؟ڿtuCvG(Y&?_r B!`|{|~|{|zz̈εՋyy|ސEF*\ȰCAJHŋ3j4qǏ CIbǒ(S\ɲB'_ʜI͛bɳϟ/uJѣ"]ʴӧBJURjʵƬ^ÊK6زhӪ] ,۷pu+ݻT˷oO~ p\zА8]"rFHMY8Q` &!sbn̲j]3xЍ;o>d8Y ،!žcKm_3}y =qʺ'a4g?yV&96Hn p͢ lfeBo tZ!2d9# !Zwi } ,J{} LZp },t/:lFX$~aj/nrp-vZdaHd6߁ %}5G_їKΔ[h57d#Y'Gh{Azi&mR$ʨ ָr>_%) RV@udI+*drm/򸛘Jʫzf.VyP!".ǜ2B̧d&h&@Q%uMy(f,4fy SsPު _eVކ:m0Ji>y8mtҒ˓۶.o>G]ײ|ҙ"ίZ./hl[lvg7_A"2+ch u"][Щ-GhKڥ^jp/-w6uv[}dc:nx^z,}p0 CgӒ Qd_kو2 I͎˓Z"x! DS#l9MvcG ;Z(rmztd4@Z8á>H?R-ZFhH28xD>-+$## Bϕ*h,ARJWХ!3FOZ%,Ca2t)BmՑZJ D,eF+i)I=l%,{Ia]%d#_A%ӗc&=maʓ{dsztt?PLBmpf(sP1{ N1go᧰`9Ä ]RdFz9[ꃆ\iĈ.兏 i"S$~w[GD493Kp"\2s=JuDfm!S9r~_"9}T7aer*-4qtiBPy4[W :ҫ 6,3GV3*Gdx}#"Rd2ɣƇds0D\ݐ޴hfpCQteL!u t 2'y}L[ .=/W@,W|GkZmg[Tl+! ZZʴP$Qg,U{3)/pY@Uf9S%v)D3ʫ]YNTnoPl沗X*$\~YjuN!m U_7дv gZ+*N)Q 8S/ j+O1ZU{f-aw'{VaUC.Efr<$& KbUh͞(Z`=qo.Z\Odm#c{x9Qv{~:tѥ9kQH[uWMZ4#S&1:>dn3|I3AJ!9P<斕E&uMumu[PԽ'@dd[57~Ac,2Wx*H @1rȄA#mW G"c2 dp' 4 -'S/2')R7@(o !$ S5~B+0BۡAS084A/&-1q#"."C!(2䀣1gA/"h+%<E׈1H'q@*ÁR~ tᅋ%ޘxC.'AȆ$L!b<"~aS(5$5Q(;A47cȄz8B"#30~8/b,k~& #"b /REo';Yt7tB3$DN##=$%1I8+Ei.'%؁D쇘>'A4122@" !+2#/Y.іddd!.4{@EnēRY8f,*nq!Б0ٛٛ8})~)bũ"q0Mx- "B<>~")}@IAĘ/ِ QP r([@I<ڣ#A"61d1_ӡDeEy3TÎ^$A֓Y8l>ڥ^z"S]BLn1#&<$j_fg;h8&_2!^Y8Y!D7bTwdSQ7_4JD6yc}@=) H5JN#ƥ:j IYgam(6)jE}\U]3䩪8t U}5Wm4%W9zZ H6m.eem*GX I*Vmq6^5-CLgf:h꺮p_g iFo5]4Y,M:i\jRcY우 k I"@WTr\VIa7'$S>9U%T6i6u ,; V<ԳJkjx#I Lm:(#eeme$G_{ֲN!aG-ํ{~?9ʶ%7$;9BKdR#P-{*h'Ŷmb4#1 "*﹌r [-4Dl)G"7Y xm(f tEXD-R!~I)&[҄*YQ2Qλ;K ù ؞>P1ǂ+MNӝ;c[ P q*5J46)#H 7C;X;E"<$\&M@a&1]Vb TH/(+44e`LNLRм[B\, R~ WrKr:3+R{`wDlMݰRxǼep~"Ɗy~P p-kz\ɖ, GƎl',4 |p ,9c:8eP.{Ǘ˲ }P* :dBPcc(H:[ ˳) Ҳ%lNȵpOW Ȫ ɮ, Z ŧ*L:X2ȖT$jQϳ< "[BQIE^~ꨞꪾ.O`@.}>n^>Ȟʾݑ}[[0c.fPn[}un~E*n}pn.>_0]_.Q$Onf.O0<>= _->#_'@?TO| e`\ }PQh o3E Eiz|~?_.-o6ܾdo?_W0e`_%o%/u!p.f___?_؟ڿ?_.OPf_!`E>Qzz8yOfncEcfc}%QO_ccE[nQ[OE[fq}}Onnuu}[:&|aF`̖or1@ u@8`p /lKnh,M([ɲ˗0Ɂi&{\Re< Q$=P(ӾB D x) % D!@O6 L5"-r[L˷߿gN@ora TC"Y:0lRkL:UHI ^ͺuLjR?B4qĄ(QJ03 q_2)&y`wh~i*h(u=庽&\NQH2 TB_0A[@DuH0]CZf`waU5ua{e"[Q.tpdiZ==hhZQD_$áHjac$ lJoM!K0P%̫||(>`X}„""0s 9TR8 CaE=,]%Hp! gc^ Ym@ (Dx@ hTAX UbA"ZтF<@s(DrbwH2hL6ob9<8x̣G6α Z %E P(2l{*CW8RrJhNX("j#T V򕰌,_6PA)y`%@L0/Y: LYJyhf5nz 8Irܦ a2錧ͬf7z~hL){U}(<{2h4ܫFZwͨnmR@r:edzYZs^R(];;[v¥ o *`Cz/y+RAծLcwiu ;@?և^镯AU.qq+նquW_,7so~ ֽjL"Y9ao++|&;P@[8{1"-88z+JUD'nNua+;KH `_6QMh&K.h#O9lԍz`3=WY>]k-q sw̷2'~ `VZ=5KqW6vha&钫(J/}3H_V{\]Mym+!oFWӻh{qz4%v~CRxĚC*̓OϿQtix ؀G=}:6Z$B4JbDsIbDUvCzeU4H+0284X6x8:<؃>@B8bvT.QD؄NPR80)TZZh~~\8dXfxh|Ci؆n3&zvxxz{؇~xǧ by|uu(Ȃ/Xx2H8X؊U㊰8X؉F؋8xxȘƸ\،XxhԘ؍8䈌X蘎縎Xx8؏鏟0)yi;$U( 9Yyّ "9$Y&y(pW;C02MM(RJh3ٓ>@B9DYFyHJLٔNPR9TYVɔt0\s ߄by؈NthjlٖnprMƕm ߔk"uMPxWU0Yy)NZkE|7W~KzPY9YykQ9dS,%)ėxWd}ٛE[/[%z 09Yy9X4Q5e[OɹN깞ٞ^l4Pr%W01y @ A$P)@; ` `%RL@ $@/p@@V@ @)D%9y0)J JUD2 +P3@I/p .#y`2@BP2&# PKC`]`|ڧPd"6EU ypQyР8`F&`- I'U9Bz`'P-p@0Q '`%,z?P`3`2p ?K@F?jP5 `UGKPR@DR$@~Z{I Zz-Z%@8.5.#228LZ *Ð0y[;Pp F*8P,Db0$ jp>A J#+2`@"d@H "K5G`v;$J +;S +аi œM  <u!$lPZ0K/ ` ?`_aEaW  1:?*0IZ E{"& bY 2p 0 S) `D"J$0APG@ ܸە [`b<0 | ԫIP)LPyZ5{[!khث Žޫ . B@P@`00Hg,w2 @G =B J0<@ Ȋܧ,3EIU4, GZ K,: 5k8P0  pCz*]PL*q < EڛP[۵_Kh ` ^= @@U jFPT@hITF0)ϽȂZSLy$pz 0  .&y`CK  ЙQ"&P)&l J P3R9k@;%>к ` ?`kaXXPךڭ2*@+p@$PdP3@3ddP>`n=|<'ʳ -KG{F& )ޘ2>4^6~y_^9~>>ΐtU 9Z){@;2@;1Щ2@#V%DH{K 8 Zu^~sZ)6 '6zi.Eb^!@.Lm A+茾.K@>^~ꨞꪾ^0giXu 8C)K``njF`ER?'Ep `.GK5 𩕂 FpL4l޾&^{p0UK %9 ^?VfUC&[>z`9)`y~1<pP)W.<6`Uޒ"DV8#6&&19l9,/?Ghjlnpr?t_vxz|~pHA ̙ H"-T uHaY$$5b i饘hEx^1Fh*\>0W\F\:l}5[wJW-4!#Yi&E@G`d$PaK.+n.`y'66pnCeh n ` ەW7{$sm.M$ '@0l0,3軲"@MpqB[6 %6 t5T -y\ `3I;uJ{>_*YwlhGܛW{UW ;,n w4o3H URGm 4 |R#c}lڬzwD-y~xX};%zP!mÅĀxNӶܪ{\=1kFWz}q(㻇}o|[9Q?H:hclACE_,7<0v%T+^FO}(Lƚ\ZhIvzx\!Dq9X %Tmuʠ2n<Y𼁯~C.oET,NhLZ$7-=‡a5'w|c Vxux=ȵJt}hGEv;Mn7i1x!%V)rhn}Y޶M/:6 K-wE3ew1'AFP|h2E̔hE*JW9tSњZv:Jqwáq bkNc˞YEmϢZ%h`֮Ԟ@ z”*ҖpUZG(2huP7*Go~ռG[s~ oNOD eA&3hUQpg+1V#E8[Dw,0-.E$?W0cN'h6ϹΧ]@{@zԄsQ\;;>ԧ~uFȺַ{`NhOpNx;QUOO;񐏼'O[[H7{GOқOWֻgOϽu;PKV}PK&AOEBPS/img/getstrtd7.gifGIF89a(&"1dool~p?>8ig[͘ڬPPJhBKG;ڹ귏ra[P(R񰮐Ӣ3iC:-|š뭭wƧ_^D~ZMujº²ͩlҶOʋŵa!_Ǧŗן̷Edޯ̤i$Nv'YӶ>Zz?m`!,Ʋ+i}}D }} Dz}ޭ  H*\ȐWF,@ŋ)M~;@ɓ(S\dt,cʌTDɳO{ѣH*]ʴip7mtv ӤYl**ʵٳhӪ]K+CQ3ݺx; 8T.4È+^̸aA0\αˎC qΈ}BӉ\XʞMbo .Cu"8p@p o9\Q Ex ("Axb :0S2 "a8(D uA8tHcDid;ZQ PF)9|РB%qi)DC)^ k9"5|E1x"I VJAy)HB7墌6(Z|sv b |> ٦(ϙJ 8( 1}jHB!N+5j2g 5$я+>jfKP3ޘ\`p]*%\Pļ4AN ҕ-Po%@ $H#XP- A o*q h!"@BT:\a|%0 F<^hB |lFtB ҕ33Xg.6))V[T,@pq>(ComF  ab0 lL2P t;h2, h@0T* ,qw 20 9G@ 0HGе0A)뎗05pBäC:z Gp A`.C 2'k{ nJZBW Vomk"[o`! "00` jڬ@΍ hPwt$x P Ԡc28@ 0 ;paRt 0)>N$ @"w#<;N*eBAA`_% H`-H0F^3 28 0h#(psG?j5) (xMp @,P C 00^nC%  Vȋao$, _AXp-Ȁ7L@(e"utx@2Hd3v@59@'?QHGhC0a (v񟦋] 7BjNp™OPpb3i~LgJӳo_p-< XB/ ,Ѕwc'AtC*-q2SZ2@j3?  86<Ȁ? Iwn U$g W?6 O$Ԅ'+@R፧]ZHPtr,lgK[c+hºvj3a]!(LP(ssP84$:P)! !hI  ۝P` (YsfJڂ/SlAVw_صrX15zI* r!z+Dq&V` L=Y86`nzTUnpubT8D_:eAlW3 (Q%5ֈ3B"i28Ӄe%94$1Z5C&Th#6%# B1'E4cԨN- > `Zn{ 6NfݹXO,ԞE %lpl:vKB>'d0Sg;rJ; Nb @&mzс7}@.dv!;:(88ћxpã >65 p-aMb`EF2u5YFi:x=6㹢J`hr NϟsP+[2G O3RÆ[hַ.[%P*]rP-AnNݶ;nNٮ={绝g @>'O[ϼ7{GOқOWֻc D^ȽwOO5pA`(%-30B {OO⟸_/N` }hx@v8Xx%`~bv "8$X&x(*,؂ h30}͠ 8?<؃>@B8DXFxۗ1(4 "R8TXVxXZ\؅^`b8dXfxhjl؆npr8sFd"|؇~8Xx؈8Xxhv`}ȉXxȈ؉v(}8Xx؋8XxȘʸ،8Xx8-u؍PP-XH 8XxTqu؏h 9͠0 ِ9Yy#0蠏"y#@c1*)U0/1Y6y8:<ٓ>@B91IIPL 8$0pJ ]$]`ю  ]#_ o71.QCQUa%a] @8 Sٕd) eҔUR 6A БH)h9! YG  TѕRi?rR*~nLc_Ppɝ9yyٟ:Zz)()7+ XI +"PJՕI1D@0@ . t{DI0Е }%A{`ZZ7DY0  }@40bJڡ`@+ ya9 PJа(xLڎ+8ڡܰ@Zu`}P0`0 ( fj +ZJ5JϐD@7PXqX@`ϰ 2`)~*P*|J PIe L_ *~{ ۰;[{~)1]V@ +`w)+>pj 9z;;T . V`,P6+С$A /F]࢔ɪz7Б#05aDUkp]C`{M`Aqiڐ`FUakof 3:-}CZ**9a@6T{yK>0 6hFʪڕ`w YJz8ˑukCլ*)ХaAЩ P@M0u:(\xkP&kf>pN N[ @:\| "4J6}PM]ap=1J)pP=lM)K2k|"AK`JPQP= kȎT͆m/P3ùہ 5@ȑ `ғ-JzMXܭ@]f0n`P*0q8uQnpP銝]~|( gf``T/MpfJXJw. @|>||JJ @6pfq"T3Lr+۾/ .K,+N[kKab L M\ZpM C>`/4&{gb+?nw6JZ 3f@λ`\[T 7d@ r~hAN] c>`V] ̐J;-Mw0e>@ ] }fsNsyPTf D b iy q+k R j Jk/@Yn|ۍa 0e_@`kzy@uZ~(*Oب P]j\>0t0T0^jZRw40tj5tƊgJ/ $pƟB5d%9,+=ZBZ0Ges*FJw.1C}M}OMᒤqmĴ<ժJ@X6]0&Ցf{n 1P}j` &η \,eT\`:HEOď J3aa/`\""Kr@]LK6`V ["3>UU>]jt>J,a\CV>>#~ _aU`JCfv/V+x!aJ LnP_t`~S@>NJ\6`t@xI[P~)4fKC@@ z-1@Βq  tX,1  1`>+<ҐD遈,rI$%@`Eˈ+ `CYL|X hP :]tV %-offdB.X-},ѓq *xニA9`V,/b}9ARAF8'GD \nч.sD6`H.K4Z=*X S9A҂0kO%jLN+-E(8F ]҇VG/TD! Pɐh3ٴ#4h8N1v2ȭcRA^66jEj0]](Q7eL xe09f\w]=$B SAf `T6V>;m92-JsdKV~ oD}YxGr11V`F>iĝfT\reM(i}MY"A+u(V؝ ٚyoK+pP1 4%J `$J0r~ e*M 1%lV Vp I-U@ M2(4 [lJX3T /+p  J ˖%&H0P8A a8, @0Ѿ 8 a4Txx̣qG@?芝?`w8p(?<x-MK&we-,a$ #%Q̴+@L8}{A6ͅ( J*a ^,A )#XY9]X`;Ta2,=8f$uK~ Bа! &:GpP< yp !]X HNLPPe8yx@ E"4Ct>`OQVɕE *":X\ 8a~xBV@ /xyJH U 74 .@cT=M,H\#XP@u@ S3 p<uTXQ0ue6`5.%X8`.X %pz4X4<βНag&KL0@`D9pHL /4Bj 3fkyqw6 8>, ;iw. / ytBL(#,K @@  zw6`w\/%G cЧO[r{H佰ϞhN Ԁ< CϿӎGl' x ؀8Xx Ё "8$X&Hp zV*Vvܠwx<؃>@Bvzw'fφmL؄NPR8TXVxXZ\؅QHnDdXfxhjaXЂ߀2HvrXvV炜|؇wwwnb2Wx2𖈎 ǂPd@S@ 0{z臢8xϧ0؊)lXGLPUW8vvĈ0wX8ԘUh. @v[u*| V v!h* sEL uDG H{ڈ2h_v[ *vX N`N { GgN [wx~7W0u VNXG^u[U3 "Yո<ٓ>x@hphpV My h RPI9p] RG EV MYGPyt֔8h6u 9% ^ٕN9W'9X*`(Bgpi@v*v3Hh9{ @h|: 9 B i YvNy ~pg  0vhG`YLٕ^|xYSIgHvyL y wXC$|r93IW$@`0PȜ\鉵X2ÙT:x39uP$``%iHy O p f{-E "zhHhpxyh30/Zi4#!:-`Ȟ0pm`h֍p0 0=* Di#P%6J 2PQ0jI zH$p8ٌIxzgpO: 0I0h` p %0$`0Wʖ zh :):И G`*(N":`0=W0@GPz ~00 P)8 RI` W0 2 9xXw|;; ~Jܸ2@v9 j :3 @Z.. k%JP%+P:P!!8 P P8+90 ;P+ Bf*8[$FИdG.[B 0P;.0Pk*.9P kX Hzz`a-::/{P@I#0E )PQ `Z p)_`8Gy`p>9E0S`Q0ʥ s9   c0 00@$+kpuD;# B0:\:+ z-zwʹ,. 2"B#0P@X? @ ƒA[ChQ9l PWI:ɺ=PvL@ `*p< F-[H . b*#@ R ֟* /ʰ˭6ʱD2SyD 2v VB- 0- Z0,jm\`slAl`VmlL|L_ y9f|͚@| ?ƩZðʋZ<$]GPGݸ2@G 8^L8tHIʇ&~| p ;u]Y˩pŋ #p#rBGHr|hKf}*Le#F i|2~}훚.OǸ *tv&ٞ+҅&6Z5|"r2P=௕J ɐ/=ɯ;ʛP%61S00@20mE)- L[ֻ; PRzhp==y +NJ=yIBP- FP{t Ǹu 8)@@σŏRZPW @I(8Ai 'BLO3(GPI^XX`a ($h≵b Ђ FPO`?x#hAm*Bmv8aLj2BQ "0A+Cl u.(I)BHBjX-^$πe6p$fra:dh A?D-( :>vF"AxTOoP,KI8B ǀ qyN $#w`= 0ȁ(C1Z%l`Q54 쀂J/xdf@@O9L )s~3댣h*l+U aʵN^f\1ǭ\d3xcB }d&IF[3VFb ˍo~|A%0kOfi[;XXβAa4 %37@tiN %feUF;g-f.@lL]B@ 1 X|Mꁋ6Ӟ>Ƃ1UZH|eU$-]2ch8K '14<quL\d̾F?f<ؐw{$-ھLBQvQ tS941ix׶ɕvdخֶ6j=UG4]&No\qƽX{L Mr0%j%'&QVBS͍o(\*g>j2\⡎]eû-^[o% GSO3@mSRb2ϻ)۹ K_-'fT^p{Ku[򘧉օr:kxbi]);ij!Lt?<ڽ7|BA51=PVE=A:2?Ě>a4٪23B; b4# x\UcmaZ ) 6 2)8)[D~p4_z: 3} Ey#k Z*r~'D}`lq OZP誮kۤlс!;i=Y cpBJaڙL'P4Tp ZO^J q#G@,qP(ͪ 3]MBc^`|n DGA[ "P~qUBSp<"6!&>X0SY4I) \=|DPj1'y[DPDe[ ҪX ;:D{#r#d&^k қPvh %[QfGV&ui`֠+ȫp( ;~`"<[{@[L2n3{-1fjO*/پɫ - 7PRk0HPN` AQ<eg[|~`dZi‹YbŠAIE`2HP>L@q=Y;@P-Eb9LbWnĈ̬[pTx'TU9BPE9oE-9LEk+ȺRZ\:Hvpl^<E@5kHYpY`b̯\=N@[m6ˋ"[QZ<̐\qd֫E@˃I[@\ќs0bq_ļ L Tdȧ Wk'}ӕPLmP\o^Ø Bp Hf}TF Qtv |u—P. 5hQNTV$ 3tOe=_i֜} \+uE3PFz+2oTEfEPp 1\Pe2o EBmY#N\`zպ53 K9/Ca4 nS?|UNӊ\]cepg=f9bV]VL  Ѵ.r r`LM"4ii?`4k8 M*VD <`J޹*2 ZNZ^`chPI`*0WTf̂ۅVN U0d`*f0bPI#f^Z/62Um!#cb^Iq]F\QIk!\ @]S0#c91W y4DC!:m=QT FeIl/0DCQzKinϔN]v CAvοDo,H^-bRfA"XF "s90**  ~~ *[~ * L  P#2;2 䴆çJ1ďAVHAJH>hhNhğ 6!?"L1r(Tf(q3lrbs<jg (U' Qc84?l`0gYEAjLj۷pʝKݻx˷߸8zulq@Ɏ.0ƅ;:XG O6` 4G`02# Q( # ?Q:tpǑR,Ҡ+Oa@DŽdА j R&l .P#,@)H á4NZÏiAA| $'m9iT @考d@: B+K*ɗ8a C]I5F'=0KN}( O;]ђESfБc$Z$Fap)tig[ Fa| -Cup-pE=Ƞ$4SЁ: LX@ L?&jMU  |s; b8$;u>`#H X8bD\eIF&H `BPGa 7(43)h 454} k 4$Qɂ\z NQ"%5/͠i+ FparhGt # BB$0Bd> I$L5`@BT,&tBhQ64e B $v;* ##.PK8Bq Dd@(7ӸQ$: h@ ҅ǔ_H̅p t껀`9hd}5 * [e2B}kGA gK^( |Y sI!;OtvŦwHɄRTxN@aZmg`v.l^gd]h:ĵZ jYkOxv0x+O 7@y#@R1 ru1<Bx:pEZPȀM)4  x ZpQp#WF{Sx ,Ё(o\Kp?@-XlaJ} AZP LNH`7!AЏ1_s%pa(A0(T" R"Q1X@` eu&$el/H VM 7M PnVkU)n3>Ҝk6'604Y#.Lp5n-% 5CXOhk&yOײ HZF>AtA#M X dhF2GC* wf@&~p2h0$=2_`Ё-ֺ}i8%-n,qdݜ !{܏Ʊ'lnd&~O%C4SP: 0 0zS|@ q`t\ZI6`>$`vo%ڞ!mfyvOW(pm<1ݖM-Twl c|C0L' xO ,,F/$P *ov3{};ϖO {ᙦwLS3Q L0 `c&ԃ ޚbW0@\"L8A@Ak+Q@HA \ ڹ_*r`da>'dI}. ,7I"[p /0* 1.%=gL*`+Š}gLO "'[!B I@0@:.0hut{V{0_1vpeJ0wvV3\CcZcYl y `aT[Bgg&/p Pg8/`PhxvXy}pV3`4.`6NӋ%VWv(uxTP0u(yodyXhwa5Wi#|gŐ 7" )İ p~Cя 00L#S  aYǢ3*` *  А  I" * נ3P7 P QpGJ Đ N *p-ɐGuYjvb'& p&P" vv&7&53 }P0ц2 _D!yn|ӂ)&}p"/gl7x ?b "i(axi`. )(HlYZaNxq1 Xy3 Wioə&Nq8p).UV8w)i&8v× - a )OpE:L@:N[`F`  0~ !WQPY7LQ 0@ էɐ%p 7 '>Z2V+ 01O37ٖ ) ZL\J3nb陹4FlhPi*)k*)\0&`hxz"&r{i&Q6p)2ѩ&ѩ)X隼*Wq&/ V!Q`*9*x:wZccF 2AK) jy$ pӡ' [ O8tSlFѴh]xZ wn{wGl&H y}w4590EL_SR02u L; 4˵/<ޙE']uO_"[Us%xQ{ToOLTOTNpv]1_w1e/ C Sr?(<- I<@SDe$Sg$8O = 2  2II $8#c0.#~N? 0:9 F %$.-QLGWI;# #$)5:2@ .0 a@Qd]… ÑF%S\ɲ˗0c4QRA ) :oJѣH*]TMJJjO BرW@ m*BE@H G *)AE.^p`\-,da$:p\(u@7'L. ACSP](1Js|!?XWpp@ 4\P 7Jp:lv` DPM) ?& ?RaD_8pA _lU&a*$ W}H%dՆ+QPzR rh((M"0V~ecGp0&u` Ճ1`X@dP,G}@V ~X , tPZ<2p !i'lD*vdS&cD@XWPC $t i(`B\ Z6* M` chuTpE8A +9DP K-dTz%C[Nօ$RQ %.-5.覫R,n8cH56 Pu]c?ѕBmԥcv_ @ ;ypUPZ nD@ 9ht0 XmD` l؀CuB0s*399vʖM(~'~8C ہ jH(VЫ-H"uaGb嘃+w9Kne$@ X Pf;\S HwUO9`~Pd 0Am\G1F:D@;S,4 Ah 0@S?L:0W8&\Qa /K0z2.ȅC($@/A5~ 8|rA+ g*DNPE,}^+a2BHp[L a;& gL98J)},!0U!S I9r[XPn.')#^(Ea>-6b7đ82A#ЃB4&w68 )3K}"AZ DhD9*\sB%($;a\>}!,g>\CrUъ]tug1zsnj^SjTѺ>v=f{Pi@+~ueji[[Tup㞜ms֯nmw5׏NIGcPF8 k*K;'ﮉm^&gmY{76w}3;'&ġV@f9st@v=?x0"%7sj|6qg:guN|{]D7W2pp;K &*po3@vA ۭ> RqA=?~/wu <[ ?x}z^TP_l pTGk%07hh^`gPAl/n'mfp: !n1@z1:р3y޶w)QgPr:'h$o%1@1z DHoV$lpSEPRhP(Hz;9|6|%qGHolmpr8jtpS(.(<"{ps~Y4{%1(0}<' YP..}>h!X7!6P}0` 0~` ~"bP"P<{mxpЉ88"'p0z" Hj3<Ѐg Y(z'"P/<4~ͤ!xc[ (z­jE53J: `޴dzX.pem˕ۊA#۰r˩: !9}0Ъ;'mKضPb+ȉe9 ޕގWYjj ͗'$H6ݮ; zŐm~d;g͗'.-ᆜ"(l-Ycۨ{{ K@}%|mK:Ƭĺsu9&Ye[YY3PnZZڴ{6ͥpwڭhmxyU9Qwy (P~g93!1+"p@#D|EXx:i&Z""(p"3|&7"&3 ҏÞ}BA֓^jZElnEѧ`͕Ӏڮ.|zx΅".qb|7zknTD^!xzd칭Y Ϗήx.-鿾mP*@݀0S:m_0_;0Q{jjT/w~](((lZ!) *" >S-UH`k@?H-3B@H5ڳ]OpW],Hbچjo+8Vhi%vPkEIBr@Hp#b E?@p~HYP?w{jj Ufro(oL !o_$ELPoz_o oŸP7P<`n~~)4} }} *H5mmbEH[kY2YoHՔ t)N)|_sŋ5xDC)*ڴ}# n2@,83ɢ!"x"$p PJ&M<"ɵ-uK֗ Cj۷LfB 6B  cRԈ`@C ŗmѥʹϊ̚ӨS^ͺu\is%A vm1׈ѝn-6 @K  gj~%&=$*+­˟O}r[sR (`f"u uz=(t puPl! R=AZ0(㌱!"nA=D(dn0 "g<>RYP`@ *~ɈJP @R50A }tЁ$@*8<И!˶y(+i*ZQ#;BA Ԅu}% 6PI6\ R6i!>ң*Sr\-P`r9ȑp 2w=nHLHe*8p>L8EtNC"l[0$ L0EVQL@#@QD@)\c_`uG@P޷$\@]&O@7 ScT@0`#Htd7  hpnV_"`p̽CHЮ;;dRLL$`g2&@Ý >0SWUzx#D.`   ` @0 .2h,A\^,A` ?p1Lc!Г;Ԑ-\4$%A!@C Rnf:(o9@Q2BP. p@ <H%`01`ߛ@G)9Z0/!'eJQCgЌ4&F/*¼}tB `` <8& LA[K eZeh4 $HP`  H`- xhG|/Z3` #hAyH?6uNG@ `%Lj\'E1gH,n;poc.T1 )4#1ld}KR\]ٚٮg@Spc: ^ٞIRp# mzS-tQ&M ,p'H)$(fQF|?g Xgsi6xD L%/;p_ x @5~E$F ay"&D$OALX&|. ?RH NA~ߘT`8LQ>.5m 034ZU,p$DH l9 _p!Hu?E)@0}؃ RA9Dqg.p7} |EϷ$N`) GP[;2D LoEjwHxj!#Nb-EE&*W+TVB!#$B}+Bf8(̂i! V[]"T( V,2#$B&0.Mz[[!4i t ЄmSщaBaIWK8ԁX"y& fр-~?U-*? lNbNb(Aװf(,Q(64%x\/3.8˸-Ҍ $PZ% (x Cȋ!$Q`8($lr 6H"`SbcA^fb&N(˨(^Rr$/P0&,U&S- 3 (&@q(hR-Rv=6(ar) 3.NR’({$9ɍk**iM-A Yf+YL&@}1"m&x Z]*HLpR(L!P X)Q4(? ZxI&BIX!)%'A`& jq2 ? PI2cy9U V)xYJNRvH=Pd##Y%x B@ f(e0uxrVx<$@^i~~aS-q94E,3I Ĺ"i"[gT2@S,0dֲ !0 p?4J]D#0 Pq}a5*."hE;rQ$P 9@#ƃtD$2W=gg}Q^20V4kPם~)wAQס~0W&$ <.e9@20@3.@$a9pkQ?`*BFCOjL2H$01gWP>d~`Qq2 F`,j8 Bb8Gd$$ǩUǬp`+`bG -] yZ]-ze]ԯ0cZpElu;$y+e".[: ңj[; IPS"$Kl`B^H;&PUAD;IF GR0[:)V=7 tb;cQ"` 80?0O9nUBAD#G0d_;#0fx FK @BPh dTB99d8C1[B"zNpY$Ӷ@P.08FQ+Sk~XSQ@PgFA dYB`MO/D|5@g;-@G.WI5TdPDc 59NFg2} |ET$?MCx`j A7QE=: npfNw2/KG BRdT}c60'dW E)Yeاٵ ReÒ9'Q~ *)pRkHv9wUF[+LiUS$dC$ @ ‹UgbF'u`5ڼM.9'~bIeDŽkÁ_UY@twRmv%@rƒfz =O,-f[1B!V#=P8=Rb5[2%N2.c<շ#i&#5SnE 5q_#1sAXPlA=@JfR)Sؠ\c%cR߈QLh2"XJP9C "O$N>l,!9).=V!mQ]5: S)%c"` ?x^ ^̘hiH.L:O$tiqJ^c%q^N^s$j)4 Q4N{r"sn 8r&,8By1j𒿮.𕧣Frx`*.GN閞~J&R 3BY+ӑ&.iNڞj>سLϊ?  o $_ً!/7&.!(2Oa,6n=RV_i ,ceqP``H .`0IC- Xg1]Uq`0hi0y D>q:oD 98᷎0o "ߢ@XK -xqwY4~BL2x ) P,033Fl!xHE)+S"̈J P|BS]"XqD):Nza+ 8@&`Xpr0@jXaF2e\ 00@~Jjz*3@-Lك '`@w;Ё+dg=a$@j[4eDGd:@&5>A,7Ё L @`J\ tI`bxCM@ӞT$$4RH @`#@;3j :# `ty*,Ё;pHB.(cX't`Pg[%0N_x@#`0V` Xb D!X:߂x)b-WĿZ-x9Yz 2`Tww rUZ`ķ"m: 5YC_]A_gwX+x0 YKLViԴNOM$Z:vdPQTW@NVuRԤN0.rVe5[EGPie L0\F@P0umJl. Nw32M  |$Âc| LEbpLtPBd-`_ox8+x /r6SKf3%O0%]/h"Q"f0]lOpPڲ-8~O0Rv.p3[p6C$hƃ3=>QF` 4].ⲍ0 4?bE#hO-Nj~.gS 1*Moh8i&X 94.Cx"7* 8L,J0-t8w-!S H 9=6T+? 0!@<21Ӡ59 y1_A9Fw0/25V->S8 z-pupCY`R`%r#.B R* j5mi4Rr`1MF 0`8e*qٖ9?Io y8kEwc4 rbgw_)9A4󃙢"0G8 6rS!F# H#kS( FcYSy0?0BJ a43?P=IлP6 ~ F0~=F9 2S~)$# ?2O=eSB9d:8.G%$8.G2[B% ?=?05 N ~: O$9SHXR )e8 @F~F<0 CIdD-ICaā>6)xQF# aS'(a O+V\q/C l~" YcAbA T+:^K>OeL˘3k̹ϠCMӨSCJ'KS+A z%0`A\ JE/ePǀ 0WBP Lq7!r? P\v ؆awm1 Ǜ mhw_/P-@!\)ǁ "s zh(#H'!J-$Sdq6@g!,@$ tup6ݠl\ d`%Hd^P D7F,Ї'8Bc]AcLE0 Eڥf馜v駠kv PEХj[vҗjJ 28-' G浚@Ơ; FPJ-J,m–ұ rRPz.EKm'GOJ62/8j!x#K. |&HBg#(%=visH$l()lI%* ms0v 6- ;nΌ9 o&xe;nآjگ=nl̾yS*t0_5\`vj7!|/ t. y琈'~hC3~xCxys^9*n騧zj,٘vj@tt/[G '*gt 2a͹\kbRֺ˯y͂83(s񂢶kJL3(͠8a#[x^3 :c :\-(zp'%A/ԡ'+(Ax"[ gHpSsٌR_Lz V7- aAZ/zFs -kW@AzҐ<}]׹V6gkG^|~`- ܅Y<_5䆐$'IJ,}`B6 "gg³㵂 -8HhG"^2!0X@ĒL2LKboPB*t 9=f!ʐӢQ܌FPDGU <癰F̧>~^Y8cK4`8B@`<\Ce & H'` =gJӚ$>Ӟ.P+@<?.` 60h@0Pmh``IxR #7ͫ^b `:"l 8 )`j =BIu'0H+8 noI Kr;ޯ`xHq{'~`o ɜr@ HB%Lo[*7ogs~ ~xO dȺ "B )Ϯw4w[bW{o2:OWֻgO-‡G:2O;ЏO[Ͼ_| m OOϿ~# 81lwtX4pD0X$@6A3pZ0h#u+N7p}&Ir\rc0  @*B+_!0/4}@!h}tQ1A}+!0 W'.xir=с1-q@&DDps#0 $&7/&10OTxibi8&qlp'XX?B7`J!W)LX+p78cPrhҊ+tZrI%irX@!#8DQB8PrVX}0ȋhB +@-q hX8Pt $@-Q 7d#]h8QтL'(u}R@H"p  e9'P+H^; Z'#p8t[#}`S$4e8/>1(Xx\`eqpQ،b=xR]r1Zx 8p4@1'p1ei0G2puQz+0Fh&C?PG8C"7 7y@]'hH}@^pR?"Hyx%8Rɘ$@0Ad dX ''WpO9tLx4$_xi1'eAAF iP6NR<@10Jra%)CQ8iBKNAg3(zzHS@r^h3 jYP '8.i2QsQ9:- _ t12-؏d15V=1SB:T));զ#  @3 pF!l:5(@O1YR&'%B*7E'@&lp-R`44D!6_Љy:}e(3A!1Q_H)1q(0ydP-@Ep{RRS1= F;dzF  ha :6"(`YH"37J9:q;hrC0R  pV18+ =g@%.;@ɩ cp' A}=pp!c;R@!pVE!sx2I xw@!61]Sg/e ,Aq#0WY!@IRUm30KzA=11H ̐JP =%Qp:p?jVwrUp ^=6@1<'`<{(n,"`)ǻ. Y0AܴH&DFΣ;H=0AAо|: gp&8)ڄ3܆s F}Fm(=!p$`츽B@Hz{Oч锁=@L zAꗡ*sۨ?p?_ٜkXޤCQLIBڊO ȣO}PPF⤨WPR"_2 9M*jJ|ONZmϟNX_r.3хr }} 'F;<#$;^}'^;^s}}" &-:#'Zcبم33H^  H4n( *TА D[qAE o(HE64$QBᜉ D !>T0EBdĖ0!*$N `c9-R$p’PeҝBC]إP7F`? ^V) AN P {;PbQ VPJ>0BzâB!&$r 19 )usg ͻ~񠉳KʮS~yBC:<o,ܠZ3A|yE M/izOkIIEbI"(fuñg;Z y@z1;y(^-}(7;)uAG^z;X#x@%x' |hQdnR(yԔゑۛp9P? $b 0@AwT0Ap }h16GlF l,=@ 8010+(@,BĈ&P@90kPs$u=YG+vF+Vkf B 1j83" Ы (pBYN&p < PvC/pnw l0.`PO3 @ ڰ(pBcMp1H&0 Ӏ2#1" "8۫6 +szdmh s\ ځ "!PA00AҌT`T.<# 0,ǽ8l")7B4 p-L@wOpHw `w,_8?`w .~w̅#No觯]\TCiy!@Ab?d)SpU@&6PEH39 `6rTW1e8t@.\̆y [ 4KK ` 0F vՀ@/S8 Hy` h>QL.пr d;, ]Br &=\8n.bw =@3p6;r*]CKV Ы M3"PvC`76p3ppq|d4IjZSYDV11i,FW-vSMu)H۩4 ^= v,(9}օyjN07Ca{8'f?`V%[Pnp|̀yĀpOLֳf = <%^̩NwӞ-%wΡ\ VqW(j2Lj]Ű8(cVWj b0N] ZBWke ,&@;l@i0ۀ&װL^&WTa>#A ̺XUs\*apd Vbe> hGK[ 0860TGuFf,$Q_zOc.U&,Di8Va4#]Ǵͮv;Mou.yG`,@WK+VQ|ӫ}W:bD*wЩՑ:sN+K-vVo- o0~V˦L,.0$ڷ/cyJ#G.w"xXβ:wu,\zB3rYٜ:n>ϻ釠MBЈNF;ѐ'MJ[Ҙδ7N{ӠGMR+:;PK PK&AOEBPS/img/getstrtd10.gif!GIF89acșfff3f@@@dcem02:tu}mot͔퓕Ƀ<>EstzFIO줤Z[b58@}񧩯Τgjp溺qrz{|xz3f!,cGHɾ̭F Dg$U7U(\ȰÇ#JHŋ3jȱǏ CIɓ(S\"SS (в͛8sɳϟ@ X`#ʴӧPJJТ/cRZկ`ÊKٳ]dEj̮pʝKݻx˷߿ LÈ+^̸ǐ#u{R3k̹ϠCMӨS^ͺװc˞M۸s~Dk* Nȓ+_μУKNسkνËWnӫ_ϾO(h  6`Vhf̄v H!"h(x(0(㌨+.֒,;ң67(D~8ߎ?deTVieI$ e,䥘$d`fA9Y&\eshpjguy埀ytz枈r&\2H:z(2J&> *ꨤrdH 靖6櫙Nڧ+zBi묅:딥6٩,n, ʪ~CXΚ,**of Ϯ-{b 0 06p龕& )qRb›)|}쯥~)lq/DmLcIhJ7-!pTguz`-dmhlp-tmx|߀[nX7G.@N7nywN枇.:/.,`騧ꬷ-.KH,/| »7<򫀮ԣ g=0ۇ|H_g/_ BG r ^7/x 4 xĠAB+> Ex A(* Y; .̠ <HC1 }DE@Xba8*Jц`"k$r xE0a]Fmlcx3sud7"0",ɼ(ґ?|#I?Zr="k`&걋NDKrq)x; EZ~C `KSn.+b"2_ {@N2p* dR52BM x w `As/$895p daO|O@ց df S(C9Њ>LͨF7юzehҒ"^-RnA LgJӚ8 lҜ9ݩJ[JԢV|FMRiԥ:TzR-*V*Pr@ֲhMZֵub@׺xͫ^׼ X+J M, X [ca16VdzVT3FElhEY)+ui B n-+PZîNk6[|ȅ-xW­qo6PŕӶ+Z07}Q[,]6Mo Ŋwnn5,A$6j{\ _"!G,l V/{N9πL; jVNF;ѐeB؍,'[f^EWiV+ F!׷ԨN52T#Vcֲ,*^˧u6\BuG8c:vla_#hEi\VϮܬ*_{>kUn01=Ȏ{kn&Qp R~?ӭ bİ8|oC!khg /v];رUqNig/u;}*nAtxƻ=p{ 7ɓr- ft?mCή5׏?1賿+8u ؀€ XBD"h؁g8$6i&x(*Hi!#mc-/H#7528Q3rR:tMAxCEbECLcGXqǖyDÄKOxkvqG{@mcWxYqw{BFaH n_66e^8jІgz*ESv 68Ri14n}sǃr7!|(cC Xkh8Љ0DX "]FxXX ؋XU8 "C;Ss(<=̨;x"sN3S%"?d?8:("t@< 3 A%TU8WٕA`9b9!jlٖnpr9tYv 7S D`|I {w}9 hI ?ИGA}9! @ibpn @yu``y_ 雳 )9Upɜɛ) ٜ9ɜiI靱iJH )ɟϹɟ)IiQ)ɛ fI* ʠ :PꟴJ񙠇0jIY%T'*+:橢g4*ɣ;:7JT9ڢ 2Z4N*RZɝ9KR9zmaMڡhjilpoZ-5HgxZzi:Zzڨ:Zzک:z 8ڪ:Zzګ:ZzȚʺjƉp:ZzؚںgΚ:Zz蚮㭀᪮:Z7J6 7z;[֚ 5 A66 5F`[{DeD[6k6 ;{(*vɱ k 55[7;%{+,B;D. 3=6k1ڴLKP[Z\۵z9Uc`3R;<;K{8pr;o NThzN۴0K[{ocyy۶~k۸{zbkk=k{[m ۺAϺ {{ K{{[ڼ;[{؛DQì;[{蛾껾쫾ӽ;[{ۿ|+| ̘| <dH<(*,.!#We/|8:<13 5<'F|HJáĭ0SL\V|X+z ŻUDbm }LLR=3# 6*Y BAJe=9;;?_FA_CGNoI?K]Ŵњ\O>\#LQ=W<|Neв=inQom|Ȍl~q/(LDAtӴYϵl]HCt̐M̓pʏL_Q< =IδmMyԶo <]ӞΘm^_<`OZ^M՝J9 |m_ {ִϧoNQY-׻ϯo;D4 GEGEDHHHDǾšϢؕ͜Δѣԩݙ~CV_H!A Jq'>sO1D$I#rF+eG͛8sܩ) FGq%EZӧPJ'#Ȉ#J_k۵ٳhӪ=e0஝KݻxU&̭0" LÈ+^̸ǐ#KL˘3k̹ϠC^+Sװc˞M۸sͻ NxgmУKNسF9pËOӫtq˟O|h&õj  0 fv8ojF(,OɅYډ.iH&&*ZQa)\Jɤ/N҈զ1g6cySt֙Y#)pkV (qi硈bgP#Vɣ3irMzUiY)fצ) *2Bꥬ s9慢sY^f_Jkͺ*N[fk)V"mюh&[36ZfJ,b.В,j{jf ۪Ƭ+i K 1ktdK6Vڰ|&ü-*O oWHo{2«65O+s>+Rlnc]p8Wnlq^ 뭣xnu/< jB㭯jܳtGpfy堇~x罡碷zv3 n/o-V{5G/,f$(BXF6EH#XeTEqɏ I 'ID(M\G8fZr$%qI kdz*Bђ4e50xҘ`+U!Lz0da.ATe;TfRYJWBb|Y(=JR&=OGB50)p#dgALp3 e=P{FI\ѝv$dK91) ȍEJ$liFIBpTdA7 v1cрMͬhGKB%jW[;hYKڊεH(b0BG-l7HuN-I2 oek7["I#D&hr=F.*OYa ~.%˯7‘b@S퍰|Fd]f,_,#ښJFgYVbly+/9-/~o̷%+qv߭Amg2V}ߴXPp vX`ӚELɌJ~iq9'qΕ).pn%+#+^EFVa9ɒ;[e4;jU۳W׵7љqcpV gmw@7n1ohH:Mh6:~='׶qb#׶/mMj[v`n{;Eǝp規`Mzͻ~{nx_!8N);0XAS&D<':N\q\Oj H{e9h 1VΏ 84+y);]%K"Od Tu0xnHL2P8%TxeX\`8%dxeh{H2npr8tXvxxz|؇~8Xx؈8XxH;PK_!!PK&AOEBPS/img/getstrtd18.gifGIF89a'&&'ﾾ˩1fzwu0a;\MjP߷߳cceЫFFFqVVXNu╮䀀`~oܳ螽ڏ$Z?C򢡡ۮ >}WW|ĥ崴@a!J罹EqQ١x,YþKcʨMb|6m{!,'ʂ K*\Ȱ@@` yp ,>#G^Qb,XI`M-'`V\b̹ϠCsѡi$PoRG hZ%O>O-'-~9{B`cw}{ⶂ ^gXm 0`cOA̵HH@qk ^IeSDIZ00dNŇQ bQRZRIN""G!9 PNLdI/·!ꈗMW{$ْ>Q$UnvڕHfVڊBG) \ }XPGnnnh\MqW &@ETVN[=X-8UB#QdRn#STQL9`: T5]C]=ZP!)Ryp=5'UHBhY\]xnexKZ-ѱI@cEx.Zd*W[D x#ߖTIb,.e G) N$%ҦpPᇃJGl==Vqf~ s.ZT MN;XZ\Л{QQfkF0! .i{wVqlU ʐ Zep ! 09MAe]?( RATH;Zj mȈ'sY^D[ Rʵ# 6vG-bMع o$5L5Q TdG:(" /`m^hES IBL" y4_C׽YXb@<,*I8x@C " *#sH @: L7p(P܌h+C,CAh r`7MX@l`b|eCp(@aPKQkXbQ,@ 腡 M*YjDA߈s*D0Jȁ3vL)t- <*S/˜M! $H`>|0AnRYXͪVծzA`[ ʦhunP! `% ҅0" ] U'.+hC56DCZ$& 8pt}MYtфabT0ӛ4GX^pͥQ hll 7pqҨ.{(ȆH+I@]^HP? b\h8Y.pa7A bP ha8Ѕ` +$ *#pkR (c&C"8Tk p*pt3_#&;Ɏ)i9T@/H XtG% Ā$ Vx 5B9"aPHs89<0)@WuB(XY# { L2XTo2P< Ph<PL+Y? /!!?@r8PLjygׁF_Lx7{JMP8Ƞ1O4F!r\M]M&MSNDQ11O 6O+Bqb#w:~~5G&pRCB`Ep':;fV@6:F <LЀp@5 7:XQp-0*  C`pd&>G Ќ< RC,A#e3Y/tG0VݳuC7(@Bj/pv+ @pk: Whf'G/@{7o*fYPB6"m$7Q@p@P *J1*0 D/2Pd5L3s 47 -MD66 NN$|]3q)!k E"XPLĈr5^P @gQE-%q^m 0"aq| xhQ@ p^Eg0rk;kP0Hp0@|lps4s7HP#IӞ9ta)~0" pJ5z1@rGATPD$J*&w _Lu(7@{@PHT ='E`Y*j@FB @@71PqEDRwb%z{MbjAWOd3}tAbZMoOnMρ8Vn8:H_UP;.!\0 c;(EvF$ 婜_rOg`PɌ 5LƙGxuKi~!reʺO/0_U&:w#p+020I{6ЇPʭy#0ךyܪ vĮ#0#3#Q2:::ȉzvl)z1SOrAq\#4lcuBqkCߗ]}q.;&P5Pf` p E0M-%`f`hE0i`~'`$#E@^fZE4CAE.Rf`e$i PDPD`[۵PQS)yEp'f0fT@K"3^LT!M];{u)5SGB "Pn f9kVe8DoT8eA G붹[$@U5XE([VG$$lK@k˼з8{$`ok тQ{qt/q0O~Q;>6f$2T1'QkCY%G@i~pNTr~)cDa:e.c1-NaK"*R(A(,3 eqQ>Cc lF\B4 Da|ł f#L!*Ab] bArMͬ&ak ls J5 ȽopO0L45QrhPr%Ԣ@S&)pop[$.aQ#Jc5opP"lAC/ 3 c}۸ l!-@ u-km-jŒ^ҹ"w&AGa%An@cL@ݘ3i0o}pM2m}Rr= <Щw[ JA>305pdH- ad,) ]:@0p\Ssp A0YC|\) =rpN07So0>PiD2A Aw s>@So`D c)p0MW $ 2ɽSl$ {>x&L^m 1F`-lJr&_\,H0FH_(^ >s>>~ippsS>~i})Eަ=ii pўs`2jp pSpp >r /A,w 1p`в3l1R=ZC|H<0(@D:EP9 ~q H>n\lsl0? bprP0it A>?>sb5iD|j^)+s>i?OpusRkeȈ &-fP8Y?f8`C-oܭ۰A=P?bZUޘjOpiwl:AxB.c_wʿoi؟{ֽ6A7d0r/o 1"q`/pooi=nWiwArilnw==S? }i% pwnl%A)w=rA n ia3/!'G$D"Fp 2ǟQa6Z8DpQG.Q"@ږ#Y\?WܔKsM.Tr5%TC掦>EQ`Β-['. LÈ+^0 0SDubHK,^6#Aj8@ 3-" Cqc!IEIzm˛%mIEܥ&m]ŕ&TL\Qv)Xrmzȱ]c 6F(B"M A=5P*X@ @D L!BLp  P *1D1-/$ $ qP"xGxT֔ I ]*}T)&[~LsDh-s ( M4n lyxWvg^iAV2Se6裐F*i?< <(CH1Qr\D! )ꨢjC*"ē$=͟h=#ֱ<,Zl{#x+Z4K:#MeɆZ+Һ)LnZ.B40qX`4+WlCh ,"4SRd%$MZk$ P8< :,D<@3І uD HL:'H&^޿ Ab8:ؠ+UV0 gH8̡w@ H"HL%~8C@-mfl.z` H2hL6pH:x̣>я3 J F:򑐌$'IJZ̤&7Nz (GIRL*WVR  Hx~r^ 0IbL2f:Ќ4IjZ̦6Mm`{$n8L:׹.MT:Bz̧>~ @JЂMBІ:D'sD^юz ;.8u0 DJA($"FEYJYڴV" KUڴM DPױpæ)?:6-#+.O*šըDSSxTZe œe?0)4*ւtݪ%1?X \()YBR}K+!SdM"#m:H(pM+dG UtD sö k$r:ǾcJQj8YXDUZ(I;Z ] ִR2VÝ}xrA& hడl jHIwpwј_5N]Yoݪ4֣͵X%`3X'؃43@e $Mh͎EOւRtPd D)N uX{1A^iVXp;M[uhu]G{ںEY3KX"(r ~JxDmkboua ̢-k*%<% C=@Xx- "ڥz5Ň`KF pAr%i SL`%)@\   , `g:HbA @ɀ 8Av~Z<@|kNoPŅaC8Eqp{d s{`qguJ!?`EjJ):F|wƲm%g*0y E#g-zK9u+0 ˕2z'qeXMC6Kj -p%j`2CJ;" ;:Ӽ][ȼЬe\/K@ 5҃en[ px:%r\dc2 d@0O+w~/}C_>t0xM+" ~ 4T1b <9 26 x]R/RqyWBvͲ 32%ЂmE&26hXg`v'7U2T[mb3Q]'/la)188`WDžk@q( .P`EQ$P&DPEP>P@ayeT8rRDCIzPT2&`&_0W $@E`UpN""GPI""7z~(O(O"NNB`N$`d`;@Q Nx.Їu `LP~$D`&]UF@j iP$ ae5`R`SSp7WF&\`P2TbFPS?fFp7ȎTH _Yy0`DE'"V8 P#2D 0"[&r_+ nHXEr8\&pE,p2/n P `8\1;`C;  'R`S9| &`1FyAy{ k\C"P8\ uKLt@YV}K{Z>PUN"P9@; 2; V@p+`* l&F0  80g`2+" < aƙU*5p z& *ي-@-|f5@8;0B +McO@wxdYpG& EIU$Y;j0 y`Q'Z' vc1K EW$Q(/~  &PSi1S P0% _x3(@ТmF p16 ywB- Lz!.PҠN{ )r- rK!P !6ZE30!@DdHX% "H& JPp}PBP2)}`*P`(J2ɤFJ!(*(V#UѩLPBPL`}B5 ( +P` i(L@(`( V0gBb*(J`(p5tp/0n*jъ8$5(47PJ" (]pLj*5&5``+5/`(;W+bDJPKjJP@DЭ+#P1sгX)&`V@Vp1>/$ +Z3u;bΚ`@Ь@J@oPp%`3i@JТJ` XK۲Ls=FSFJ#@+@/ 7Pě2\$0k;V0&pe&U(U@YPPl;ѹ ꠱Z{ɠ UD#;u\dX`(:ƌ12PF Pj+ JkAPș\zA#I+ ;EU0(άtM{ʅ']0B(`B u\VP~f.$ϒBT+́ ;>8<ɐl˳<++HH Պ701`P+0+ E00*U0s5Y`.EQL{`VF}$ω*a80U,D \0p*Y x;.0p)1-ߤՉO6=`,,Y i }}@]H,żN`Ɠo,$N;7p9нm3PPӅi(;0$72δ̌)zV`5{+ J& pN'>Y-༧\5iU@E!cP'!VEӣh+(%B"#c&\ pi+F@#PT{нn5@0@fi+q<F@9}S2_ #{` :+`'P:p p"e2V/zaV6nVP&M&לj[i0iB`M2 Mf- bމ{P[2V0q._pMRMy%Knl UXLj>̴3V@jɃ]$(|(ePAa0P"80!r-Hٖ1hEIu@ 0X@Z)z&+#-L-"m7…4; -`KQ!pEÐ{ ƚmr K/ކ3Z&=hT:db5YD^*Q;}iFp\L=YeW ؽ/M'(:# I0δV6.`ت 2'=Pz@ǰCUp휥e DV2VLETJVF 5+*57U+++$cP#+(V$V5E*UU( V10+U#}E_E+5 +&U'&;* }'2;5 "ȢDC0UPy} qJ7addrpHx $,0(TD͍" ={c?fE/{!PSELGB9O?! Pœ?:B`,B 8O}Ez?Phؐ\!{@TH'?0UaPT 1F PL6E L (@n20(@ 00+@J4SE`FK.zRcF(Tћ7XIAZ`""D D(D@@U" 0GS$"! B V((`A hUى@0Sq55BDcְd6Ď0oEH!&BMSVQ !UBd5(BN?qBEP<Y9@X Z Gޠ&2\ń&`b*Y "S6*9 :8Qqfp%Oل? XG,)w|( @* c(b@ y<HC{h z_%?k/֛ A A`@FbFaZxBr 7Pr>L}H.P~q) `hb~8,KpK(qS,@ Npl0-8?6X^8 BB0;ʓj:CX-Q.?UN`Tg>U+hZu!-@*D;P g*ĩU.rC F=y |Gh9LS3݀˻Ā I ? h]@[w||(}37,F&o*v5CcZ ւv9 dzn-Z q'/VtZxӫL׆<24G }hHO/Dމl\nPwr)Rrs50Ls(.xaRjyZ?Q\WJ}`$fpT\# &!̀P-.pXE+:4"{`DCkG^%01Ppi66\/x@Ҙ"[8?4t-J&2Q24j*i]Q`@)D[F{H~pXLӘ}y5K+P dw )Pws^G"t3'7^;{>&){jK&@/ 87-4aGQAw#<:C@{75P{"6p\-/TN@=|w1uEpqjՇ;cQHPX%/ x/1 b1"}X/ D(b!aDpC{q$e3x  /j7D q1P vg js6E`gp70P07hP;eC`RP,X8>l]b[F*/PH\5e&PP% ZP@"P@ějE}5@- p<CPHCQ@L{8d-`q MP$` @k?-vg! M5pEPg@!&1` 8i M+Q;،MPfy7/ v>rC7\ ]5pbP0-H392+K.gqgf<@k *pDQS8 }= -11C>f͢V}@\@52|$ ޢ;ۜ  F-B!Z~3:լ5bM]r3 d2O p-H0Pd?\RX0g-p͏ M|Pa4# S0ө"> ݕuzu*\<- pA,֬ŝXZ P&z,5@`݆QRP `+K^AD`5T^Ǧઉ+;0kpA R\@ `P.rJ z~酰U,gk ^lt) -H {`1 $Pm uYB@ ] JpǞIR (QG Xll&YScE6G_XLŃ;6DH1NV!GKT(c"fXp4vثx˷߿ou ID "DN$h!Do$q]!D &=@q%]B O0Į.@8>]8:D\#Eex%lxQ`!"%'bq 0X;Xu]o}aV8 C?DFDC4^2khq4KH437l{5PD P&" ~P"@xރw~ <7&tw`gꬷk4G}(.Bη^{y^D@ 9 ? w\;NDj NP|1 ˄9 Xrp?[l(UBfˠ7躜 @'`}pTq#~%pY H ~p=h&H*J"Dj `B`E3 O$@c 0?k"v Z$\)ct`$@`8 `q C0@` ?h@I*YّЄ dсB 0&u4Y. 2ɻaE(L`aPwZ)Ņ g; yLoo(&I͂r%1 @ 3 R)Œ:'$o{g YLwZPeͩNw1הCz>``lp3K@E2Qqxp1Xm"Y*/vgZ8\JḾK'@-b`; `t{Wl}X9ுZ?D%Zֺv 0%*3J84?\(r-oձD lPۖt$<.,fYנ( нn#|o2:CW +1mk@ovA_ m獰*'o7{á B@KhNXB>2D Y@LJpCNra;`Xv±lE'.Xβe`OQLf7,jL6fQ[""R %>Ym x]BЈNt[X<Y"斢']qJNN{nVFRԨNWVհgMZָεw^ T [õҒF]Mj[;]I vV\vL;Nw] dv݅ H7ٽ![pi{6 n7|>w]C 8 }KM@0ʿl!y+\Rr|坋_aHy Xv73ok` ,w"Ok@8zzsV{N۽9sWJ=<)HK$x %pƒw ?`P Uz)&`A$tL~9"]x0Xʗ sA R %0 jhWݒ}Q9x =I; 0K&0{p"XUC)GД3rT E% _\<))Pp 闗z,G(wDYh %0#.f 0 $Gmx( zY0azyY; `#=ǓTT&10\CP0AE9)Və(1MxCFC1pWA`p8Ly?nAP* PR9@"<`Mp;H"_iK3}P0`h<{ؙ} #;ѕ1s)"sa7 7{P8"xjBX9]|1ڋ?/`JR T5@RY0hz7ڞ:)/@dڈ  YHs 1@"@S?U0aXX8ĩ\a Yp*.T^L2F@$P @x M] |{(wCBԛ'52`*`DZcCv/g[RZzXz)dw@_<&Ě*73YUe@$0{0nT`+yAe[}dh-D Q0p i A g g50z5ފaX)FˌCK]+5;ܘaj'@DY,d;?zdK jV (?#ti(d'U@2BPIZGK0@+Y@**@ k0y}`Y`;T&1P\M$@+FPA`J +,g`0P#J0]`{ 2 /J(0+@Q(T@15@5 [Y + ($00<$ (/@M+ P/@PC7   l:\v.PHP`FHJ|<\ Yp8p /@-\p-pDA]HRv@0gP5^`kQ/QRk  @ p.a yg[ C1B#ag..$2 $@J/({+J>Pf`J@(@"_ *[;}m<l#O{L L`#?&"@}8)H*0 ; JP? 1@7)(Alj~QOb_[ ( zLQy'fGMG$;L GDT~'TB  *d0 B(12D@2PJ05M'7VFYFGG$MF/AE#}ML#1S{C*GTDߓ;O/1Q \8*7QQH{EH-XCDS1Ku< .HHAE Cǣ9*`` ZxqEp0@ؓ-š=PhE@ JQ` `,D&q\F|YK5("#K#ƖB>pbA2Ppa (PB!1woD@4QGĈVHB%UI|ӨS^Z5L`N-@Ɗ&CÈ)x`BBFrWA& @FExP P郳"#>tƞ48‹@/(c2WC*F@ J +@ 5 &B(X#41 && E (B {@^x~UM. , 1L[%@ 1$x A(B|faP] rX(AP)@[t7HBڵ-A- p `[UFS$P&E5N??p8 `@ @xN mSr+^=4@ $կVYbJH\@D-/ o @ Z!TBs bY؃X# `,`@;A T`#E@ Ȅ3C #ol \@W} !@ PNrwf@Q&(T`ve  3p, v^."g7|0sY3i.p6"%.u_Z_"&~[.] m{/`Zΰ7{ ? (NWbA 4 vE2α[0 ?Q"ZL"%f툇$Pn1 #Xβ.{@ Da$l6Y{08xγgRnMBЈN `y(A $,E[BK`ₗGMR8nμհgMZָεw^=l `StlS:/-< &n{|@{cwNvMzη~٬A8[}>'N[7< s GhP3w,pP0y 8Ϲw@7̓NHOҗ3PԧNVϺַ{XN;SW; k8N绥lrM'ÇJӞv< xA;K9 yG$j#vٌT?}g/ }ES2ɫ>d};͗oOh\|O>ww'|y|usZuG|Wr|7o{wCGxz(^h|倩gx7xgf-(y 炢'r~{ᇂ}ɲyl8{NG?aΧ|Fs48p/8|Kz'aJ{fn)hR G}gj3旅57؄n~~0"8> mF8d6aw0e@ƀqׂ:/yi9@rar(y6Z z(j,p !DU戀({XzhE@ O`:|6} vh؇ݰH^ h IeV,=,8a ~lP3څ,w,4`3c}S6`4906pHc h9 <6^1v4IiF30KPF6 P~` Sb~3@:2 6ٓ6엔`+94`@V8FiIg3d`Kh 0i/aN9U^K(NdNZ@9e,t)i숺9ɛ<z@8, ~AO lUZ `:@늚4  ?ȏ4@8+ɺv:=Fni}L8aضOPFf<Փ} }j(ĊJV Ҏv\æ4{~4}{{,6{3 >ɠ>>>3 n2:O``BPŋ3jȱǏ CIɓ(S\ɲK`(1$Ul?! 4i>>gA:b.!GGRtBהB@9B@ aҒ;|icPZ  sFLr;R,f?.%,0ئcEFe쏟F;a,,s"CeIϚfp.fix^Oӫ_>fF@W`0؍[ܝ^EH~5$@rbHK4@Vaf`A"Ab`}`dm̰.!8}N@.f~,Y1 Vg f(|XjU6c `-qՉg衈&袌6JFޜ)brAb !Ov @},93P`M`U#XVO(pev#OneH5]i8֋1:1c\i2) lh\ rgr5[y  f^+(vWmv;ɯf;0jM0*hYVlg\J@)%hF֬FvTT7AM1ԪH2ɪ.N-TF Vhu]%ŊVuAcE]1TXN\]%?hP}R3֣֓d=OqXF֨+asS݄a)̎ճDb Z%iRF#HayEZ6ulZw2cX cU++8">n ;aL(ԐO K5dg5[y@qmaƶIg,#l){RFO)+TޗvM1:," ='*Ӂ~,vx4z0gLD %5 (? Q!'};pt6L* hUDj|V3n]HOp'􃚛,pL, (1/+H 'StP'#ce9[WNo'MJ[z :h P :Bp|I+#27v([ָεl'`~0ObD19t(PBE^ֻζ=6}W b*0W dknx0Çlu ;Xjv{&,lœ(OO*8gNǸ w@9 qH!f<@ʍXXϺַ{`NhOpN۝|E&QBx9g`_'/l#O\'8=(;H4@<>hc1fX'@7HT5xdf8 \& $lV1H)$ej@8DYFyHJ}؎,(`Ga$a0W$,} )byP{uP 5&&!R)68OP ug{br0X9%D9 Lyٙ蔓؂}P9&7~p6PYKQI`5D_`tOP(e^,{`p/]VQ9E 0fPdc,!|RmQ6f]ؐQ5MXD"^mu>jQ S0I w!2!5 p#R6ZpPdnLv JaK'`b5Hrex\)DUQeKrD./И1[8n ZzBFXY/hu&w,q$KMQu9jeW|u 05<&a=jP&y62=3D@&"=B <ʺڬ" Ie&awJ<9Fé 0:WUP( XRburKP!qڮ٧|s&\jœX;Ek9K ^QcPठ(dx 1Np`m$"v*5Lzk C څod]\hs! ~r r;!`?90\۵^;+u`aW'$U#b:` "l2I'h`^&W&#)pK@kPԡq2Ia\AVU#;[z6H!lF\?E WIhQ[Ki.'le x4p*l K4c~1P ,% j պ@"%]/kO#E6C!",<=Jnւaw+,$\L/ r]K|8Q^xQ^2 4p *rB<!jY"_@?DĈ wQ{pVrn-|xXt HbLƌ(H˨EP"u|vv\_5@< 떂 ]pDŽȂȎK|ɎȘz`|P{><\|v}T{< @O&1{bJY} 绳U-}s-@s.N~.$>;MK\0781Y.@m<ݖޚx\r- n@64bt ^E*0>8aP#apdXRb@t߷M-0n@Hb-0W(9 /t`t0 4SW~V-}Op8p1=2Yr#Y1-Yg0t0&9&b4 j1 2 nVm; - oOjt a  9p_b۶.H9D;.40$cO Oo@ TmP21 C(oC/gP P;8:<X@grBt"D2YMS=gxݎ@- \Ru8 \Oa)K/ -^C8J88\C1\-\*8(@-a|&H;4- L<-X\8 RTh"v$TmC/l%x ]$HOF'ˊ/nbH[tth [|Awa AC&,$Ā D/8L0eyPAlǭiiR4l6_p Cu"Ȥz-d\kc*qc7He!$h ;lqmA2gC*toLmp @HCױ[/>@3^4J$͆ 1@\ (C(E].e'^c@Fl"40 'Y @toȏ|P)4Ƞ  I H`QEA LA *hp@ =RGr`^0D4 h^ 0:${@#" BOJ9LBp :\X9<8 JĹ\(hј(,H $) B D CgEAs?8Y`"40Q!?@AYBv4) EA `BJ% d@pR ^ԡ@\AY@Eޠbr%n,0Pb H 0Ё,(?D ˋ@?`# Pn+& ,d!b @]"& erH юz HGJҒ(MJO&qT<5bv1R@ PZp8nT c٠JE&Z{ %VխF9@@@/2c/,|b `F=#ݓUZ>„ VЊ;("n[@Ħ KZ$5 Mr6@0/`A`1  pKMr:rی H[R lAE6Mz׫>`_-jTw .zy{]ߊ mwk6n jҶot/,\7cmw V-Wl\ ) $pՀ X p{%O|͢{\'y{!}N> J^OO@yW'|㧀}?7|N~@s{ { ~~%~?|{p{}}~'4PwG{ba{~ 0CQr}H̗{p{ }'ws)5Z\x~{@"]Xf+H&rgr؅h}Po8|؇7tـ9cx{ȋ6`xx1F|w&w PC0M``Rp{}C/`j ()Iiϸ.~!07rٗ* c 0P?HXrH`: |uIX@D1X1rd@:XG.0m(wv0F=ٛjy/%ɘG ZQ$gdC`)?05 1@TT 2P|/pG+ LL"1] x8HY OАT(ͩ{ y*)B7@|?G~*W@@##0 $iYC@PM 2BD@`Tp.%:O]ꇼ\:xC%Ǘlj'Cy{YN@[/YasY0 I;B@#*`(  DpP w+'pk:shOqig(0_}ڦAi)jyBV~TrD0]RחTYP @DP /(|ګeN څxp(c`rnX 9N'%p]f)DD`Fni" p1 2 ]D.`. G ;mI`Y{ $(  jʴd [.*:?؎P5$uEPz$P 0ag{{& (@}A@U>G˖x`N{:NK$thvG(ۀ?@j@C0;K ;j;*л[U02 JY([אRK9[ ;5FYo8okKP[E\\%U5_܅[{e"`[|  @8 L蘒a8p\&|(!)02"P0Dt\}@B@B=D]F}HJLNP }pMOv40Q`b=d]e:lnpr=t]v}xz|~׀؁F0q% &؎ْؐ=ٔ=96ً,`=iD3!qڰ۲=۴]۶}۸ۺۼ۾ tT9=]̮mڽZ0mtCʋ3 =߸}qZ ,WǾ}|ǘ"(~ w{r~*&(~hȗcX~rig~w ȫ}i%٘7r){ `i~5`= ,B͂cAY?p(Wh~'_{NNrNx'5{r~#r0&r76hr.@y(&r$~  ?0<4D6׷?мTG@DH.`}7wGs P鸧7FL@T2?% "Znd@ dp' p ' Ga.&G)N'N~9W?@@p@`A@֘JZ{)?GA`Gp^G 9D`}N%8+}r~]ک"A `@ x0PIh'*򧬑}%t c0rqGw4fr}0%`h0iPx @@OH`7~3}{΄G@$^.0'pr뭾 `n؎>P~f ^)`@oOx]) .]QM1@r0*tTs+?s{0t"/ 0N٘OW?:1*yJG&xX:Yx)`*  "J7?0v}?){00 T.5- MV>0 0G RRTT}D A~~}).A(;*22] >?} T%) ](''{?GG$U2MP[ {'#{}.? ))\!pB@7,=!8QS|&ͻ}Cjpށe(QER`d >G,aNđ"'~0w U50 pPD BYCTgP F54AD)Q P+ FJ A@Ġ  5Eop(} ȐJh L F61 (Y|B@5a?`+@#Ih;uAh:f = SBjP e )5%dB*50YE  `Bwv T(F ֩6t"x;P%`KFH%@14>'MAb @3tZA(%< )* d:"U0p3(U,- *#8M@.L$_s\A`5$V@pT8 Dp/ }H@cK!-H@j@yPN$ ,!p\"&3*TB@ {' U@O@#xܨy[(*ґ갎@IBsG|? ` 跿HO:ov'n7hRg* D #2@: $hG'A]w`/\$8H`&ʔN2˼ub&XAfи9 IЅ0]̀LA{@h ]`BF0\Cpda6YnR<z&H0m/\P @V1bnBm#8HPZ%p"`Ygƅe^^CZ_`g)*@Sa5 !pP/:qe&PGEP+pܥQiWP(fU`E@ס=Bps$@JA4Jz2T7Q}~2/Kf::'*|\b-]TK{""1<\*P1a Q+4d:EQW51@ 0f `"#3@!.jPQ~inn.}^{^~9=rr9|_΃h9i5N>g1^5~;΃|.b>j =IP>0uUIvnJl^+KJjSn?3v~+?_ "?$/%*,02(.?6?77.&}HJLNPR?T_VXZ\^JO``_fhjlnp/Y`vxzO,mەY /+Mq?N 1`PA `?_K?_/OND_@Z?幯 Oê/aLڿ9KO`3P۠?P}4}~).)%.{{"K:%}))O}}N{~~N 3"~~9yO.9w. 季Ǐ CIɓ(S2Hj{c`A?ըO=:52ؼr{,Q,Á|Cfu@#8KٳhӪ]=0XLpA}O:X@"`:K8ieOc8t,U2̍sꪬڑe],tP#Z0ƒFv@6uEHPw҇43L{{3,p\"8P*a覫Eά U:3]4,[>t|@@! O]0PHʜ.z˕!S?AUܡ{N6bs^@<PG-%5\h"x6@xyd{h1e pg[xe!N@74Մnᶉ2G. 9kMwxx}"nNnk..A;C=Yqou3G/ԧ}g\/>o{/pOfHvIL:'H Z̠7z GH(` ;PKKPK&AOEBPS/img/getstrtd2.gifFGIF89ah 1cΜcccΜccքBBBcck119J{cBBJJ֭{{ZZRR99Z))1kksccss{kk11{Bs!!9kssJ{{{祭1c9ke)ZBs19B99B{BJJތskksﭭcksZZc!R)Z1kRJs{{1ZJ{R{1c!,h ~Ŷ~ HÇ#Vc(ŋ3Ǐ q IɓF\ɲ`*_ʜI橘6Oɳϟ@ JtG/(i PsJRÄX'h8"+V X}ꃊ`|WkOK[uKvTߩW!@:B@qcB\`(cW` dOq1Fh9`Æ>pKk^ky*J>-@TӧQ= laЮ^+(a wa"4ܻP M}hU "0 }!G +ICnW)#r]%w)+/=D*EZ|*2=RA.Lh``BMiD~^h}"uWY!^ya^f¡no)i;!RAt.FQ%jtv6*)VzJ.h04A4b P)3p0+NBKe&̲'W.b v &o!駎*.+'6i & uKKoVĂ @BD ık( Ѫֺ2|*.,xsP1\с/ܢu"}B pUcJ۫% k0 &`$Ʀt`)kj=*;pЃ !7[ )k̈́'e1>3o8-VsLmKn5"ji֪~]*ʚ "D@68.9Kӧy3d&nssڧ/N)]F~>=:' ѝǏ5!}C9Tt3msRA6I0PNWYP!@+GL['|&0|*,1aND,t:U`HAXH:X4U:@*р#D"V`J@ bb`%z5^7,[7\,][CyO+ZFF2R$'IHR_${Q V HAB X4ORe$Bn  Dh Ø@ yX*Yepð*MkYL:vsq~LX F>T@r @JЂt nЋzm JъZYxЈzEGJҋfA $HWRL0i@Oץ8.tJhPKOpJQӟ"O0~XHUV1š ꬣt yX)z՛oEVi1UuxuHQ%XhYjւN j5[RԱXȲuudVVwͫhUÕgzz7 ?JػTiW 1W]pZ$a B*7Y,cY^m[1 Kߵx7lfK%x[([=撃?k0rcv^lgư9d9oP{Zle<2e >( zPH^rLY is:E-W!B İ>L--a6ӹN2<]59v4=D}q b&7:Xm 480ւ*zլeS 9-2\#l%s̎(OW0gN8Ϲw@ЇN*@;PԧN[X@` ZNhO 0Y_WNx{a`׻O/i^ ~񐏼'O[ϼ7{GOқOWֻ@pϽwOO;ЏO[}*{OOOϿbx8xP ؀pX x2B h$X&*؂Ȃ.2X GpO>h'聋 :X~MP:c AP#909Bo GCxa Z8Ixe jd(.m؄sX_(&S3tT9ÅyB+&H2a9hփh*S=srOXL88e8.T-8M2s9HB$ĈC0--D/qT^|v=r'x=,(zG,V2#XCbC㋶>x,dh8TGrH|Gy34$8'؎(XBqDx茂Shهče`TH(>h8Rx|I3I"Xi8 PƑX yg֊(6Gx؏ iyhDɓ@{$hxHY9CRiYَu(Gژ)HY[9BFrmI LJ9Ii^H7vXpdG}]I856%ٲ^jyȖ v;9Ɉ-i ICD)&w$9e隃5R|a%xbٛ4ٕ8щhǸԹIi| 8R_y?(QО Aٟ:Zz ڠ:ZzJ{١ "Z *,ڢ.0ʢ1Z6 9&@O@B:DZFzB5 >NF2$ǣP\zQ]:^ I{ V iqCk H]w Q R@2ুz@:8yᦍȦo΀k| JGQ ЩE*PʡzvЦ:mwJʫyz*pfʫĊZúh@̚ ?  BB*I j EJgڬ 7jzzzZZ6 zC * N z*{EJ:1;+Z ˯tڳ J7 jD* Q %K*뱨WkW[ S[[X۵DJ ˶sj>rkmq;ok˨E~nZQ ЭNjGbK{\k[t봂۷{+ ˷F۷w[;k [jk k&{+B*pDk@ڴ #88Kʪ;:  ;͛0 ;; I@{[c[F []{ۮ,ELb@ l gK< +%iʲl˲g 'LK*|ðM< 2f :{?$&Z] L|@PJůKN Lc \_|a<6l| pr;؃mͬz[6K׫r5 ׂk*_[]*kݯ=ϛڪhLڥ8GM m:I;ٱ ١+׺{ղ+?s[  $`l-ܶ] {Zۼ}m۝Eܲp,}ޫB 0ݻ -ݳݬ>ݺKᔍ m =l Jرp;0^M:^~~豀7L W^)^ ~^pnΙ$h !lMʦP9P>B ^ n$$Fw=$HhY%qٙXHx-~r&N~V-nn~&.=ޛVF^--j辌>m޾U3T rO OxZ%>^+8-.O9/?63:/2! ~2a]"&-MO3PP~&ɜXWoiLVѠNmݡ)LvqHԌz|?Ȃ?m\ňJÎЖ_P}Ң?_%"OxJv {{ߡ¡P^}֟{K6ߋٮ _+=9{~ ~}} ʴɯѡ٨ަܼϖߑ޶ ;}#KȰCJJ.UH+㥂Npɓ"\c1-IƜIsʚ8O'2> 8(ÝzmtӖ7JՆtjѦV6k ŠKٳhӪ]˶۷pzː+ݻxS)߿ ,.È+vjxǐ#+˘Y5̹DAMҨSzzװqMɷsޭo6-(#_<8C~R:uaOh/wNYvQܵG^ݛ6[qmܟش~3P%*{"`s$%)EEՄ0#~G΂ᴸ]|$؟sl߆7%袎4 gߑ@"}㑊.)HXDd\vYϖ^)f6`i晭lfpYt֙v{*hj盆&"6FZV!fZQK穦qۅi aD)@\, |g઻>tꏪ :jb9І'nӚs m{[Es߃+{ ,'L 7GرW<g,w\"<&ʴql*̦Ii$+9z4Wܳd~Z9hͭFq!Q2$6.OfOOӇnRGjع(ϑTm"(jko^תˣM/`/ݹbs+Ͳi78H at,u}mDE9. R,ߏ$_7K;Ҷ;f$s^yӷ7Jn;}a'͋v>.6eoׯ& `J(L4Ž@'H Z̠7z GH(L W@;PK.H۾PK&AOEBPS/img/getstrtd11.gifGIF89a~hpqqIII101ӧh/eQtܱ 'b1aR|*WݧˎK8m"J}Mambdţ,\ಲߒDp @@]ζ㌌TԣxvL%`%d]]^!,~ͮ߫ H*\ȰaJHŋ"bȱǏ ki Iɓ(Lɲ˗0I͛8yɳϟ!gͧfΜF*]ʴӧPJUЫXE\FB׮޼O50JXVBoHX 8~M6ְ&ܿ^W-XA9>4@͚8cUf7lY(9 8qؘ^F>Ah6j/5q@,6"gΚJ޴ jgTϿ(V <E?| XՄ,*stUuq`sv6s% p]6VmX^t&z]Wvj!uuXt fI!BYJ.@ hIBpqcr\v -`_wg x(D@ 2dwc! ^ɥ ze\eA!g9ցXci 'kQcyX(z,.zGDJUSgTZQ9+k/tб'aR(.FUp0$t1jPvBv(pBh >f޾1tyJ0Ѐ(.VoqX%z6ߥ~4 $PKD^0\w5C܁-p v`FY%]Z=&X]|@hndQBXᮒ@ 4.թT)ص` qW8F iX0d {Q<^`80"QxG(4E䚘0%""lLjֈBFmoQ!r 8`-d~0!@mdCf2uh !pc b` iphJp 0(YB*, J #9`H&d!(ݐJ=0d,0+Q"XR^ p"J7R Լ 0Ib&^ /Me=ߋ,?UA (N0PrAqم X`A+,a%o8p7 k:48X NZP6Ѓ F.\H\FPT c G%؀)Ċ1VD;\G-i3AWC DXO/ M]U$0CvKr02` D P,^q PZQ[@`C`0L8 0 ( L\?衲 @A,p j*x7r AP_`@X}%MrW] zJ󺬈, 401pf6Kzi+#p`O( / +` ?"@` W,8k`u+K\2JU` 8P%!L6%縅H3A>6KR㭵@ETtVg=wxֶ7B0*`h X~X,S HpV+^bd\@鴐0`'^җUdf)2UT:3LE0B+&(rHv݊U@ #Z{A gt`X .m#` \[p  0dRD9`&7,"?3s6`0?X`0:Ό2%5+́ s5-H.І|Sp &7>t"E.e0À4,2xPHE`  [gm %apH8D [a:끼F + jT|)BIt!M`AMȘUDTcV4.CFWVֻ_V L+-a J`%@6ةHl%P2{s"p`5=(k.Dr Ч3^{Fhn^|Tq0|`8'GSd ]SEe&C{3h5rBB#TpZ6+>Lu,REi0[Tuhp-XfcfippX`AoNɷ2Ym"cu,0xpM_ aiiMֆ$?B#z-!!l†L w%lC WoN.1z upK21[ P E Gu#pnn'M zPRb ZbCn.t!&sl`1 3 ;(.37OEd&p[hEd$X-u<vU$lP4 F.XJVfYgH)GKYX`OphxYp%/@(Mi%Z 0\j,.9\Vdy7<0 B8iAZeć#a..NR9TYVyN)//K%b]=1@`E@p6U`+6V {@gE6i0i1jk p8 88PMIIjyY`Voigbi (Bo7qCH52Cp`w.tdhLf+$5B)HPNWPeDBY4FYvaj$4zkqݩR# xY^H|֝ܔ M'@8Y? )?c){R !-"TP= ":Rl/_2WV>.tQbZ;?j>> F:rō@O,LǤ$ EONVC8.#f'M#.t,S5o(xlLx{g(c:&D:fkr!:`ST#1Z- !k'#&7?Z,)"{q!P(B526P5ڕ!HQ1Ȳ!!/Нkz6 Z.hj ))rdbQ`LL۴N ]Zex|2dR#R#_*s5A!je$0ab.-RZwi|˷!Hh!H+hyX< "R#O7*"A&/)l#wm"B/G89SկI6f!%u>E!$ra| ~®f!? .II~6jZB";u%*ѶC@t+:P#V=S!*u`ҶL+6G1!j@d PB+|baϢ3R,00$B eऽ21\>yU l&_jVYMv\%`B*iV3)bUR)l Z=#LִҧM3eo`| d PM3.1`Xq@4lfNC?tMh)&J n(tKP 0Hࣵ|pJH`(nRLh(zS|І8shHc Т @}DÁ?4A*:&WP ڟ 7H5+P^ %a WJЀ 80T A"xOE ͬfu",5WHA \P& p@1.%D#p0V1HARD MPA p(. -D\ x.`-hCl(`lMo!٠!Z\R?0w=\ 0XA*5`:i$&L"xzz 8D`Ke.> Lda lp"и0 h[ D>`q W3 {iә W~4y`\70?~Q:A `/mm^P L h%Xct@2jޛAFqzq%?|/Fח J"H9 AqGچA-(F; d8h.!EhH &~nBD-K||om^*,!e7ϵL"p֨ @-Z*,D߫"[oHtt/q>ߺ6́WdЀQa$8{@Qplp #V@8&kS`!Po7{1>bdd{{A{ky֤{Q!{bk@|q|ɷ|GIw@ k! R/U 8pJ }2r '"MUzf ! EYEe #o`!qk"o@^g 6 Uf_M8M@UPEaf$0Vej8`Wu8P8`VM6`p+Q+ u+PC!"tp`JM~O +`J^ww6`MPv` @!J8_s8p8`hvp60h8Mat'wЊ6p2kW5d8p Ќp 0t@y`hWkVPG؎}lw60 pt@`."'`fCaUMvnJpv w8P`p@F=Q q)8pvg7ҎV0$pel6j`eEvuogU8v00"OP'KXppt tzil@ ~h]p[kgM 2xؔxXeJ`ur8obp"NLV`yjB|f:~/@/0ڳE:09I/y۩%Н܉)ɝyWhh(j'P`Gv'R80w#@J0췙0]F^78K~wS0V@u,`i.Vwp_Q!"Њjb$S[9 0md#`@_g8ew0eH Sh|72v0TJK`u7qpH.zp\na`NGJ9j6 [7:J@Q)} : hK@ L%k8'h. 0fgrAup F!PԄi.7Bwh|5*G|Kp8'$ VbwmaruY{}:JpzHJـI'2S|gWZvQ6j#MLHkZ|/q8*UgW",۲+" .+L 16K,k;P '2"؀~lPr}GږVg @njv'qwᴕUu@gPUGt6S0WJ`)&.9kw g(oFx0r[vU GokMZSpev7  n{eob4] ~Gy2y61Su@{`wguyz{8@wsz*6 X֕`ȸ+p pLyWR8h O_ 0붡Q }xu/zqI$X +;Ue{[0v`{%"v Kzugkw)PWȻ8K$Јa/BkʱlU2MO T"q"HJ%_eHtkXw$l}n ^ejļ;k[_q|'q+_?wڕ/ŊK{ˮ:7X({?HXv/O2lch{Q W6@pЏ4۸hjslyfz(}[|w|Xz˻*r̆E0nu~e hW,js :{\K0FVp$ qZ 2ض%F @@mq̑$&_#Bmq@ !Wf$!q/AGq*IJ6͝c)ҝDYKC`$!qdJXaC pf&8H'.&8e98Lg.o,#$&h!<җjhi++g.o-iej"H 0E?r⬦Sۑ ` pBVTkRb2-KyjBnDI"zk.kzi.8oHkka&*y8F$AukG."P~g.$xRr9{wHͮQsH#98xJwJi{.I0B+{ Qzf˪` 4yo\R֡s@ !k-u{y-&H=CHZ۱%И '@ S'}~Pp=!v_*GzIZځn0`t>o˅uC|Dvs1iMD9K#U 5DH2=>SAހ(?rx<-EyF"vD8AA6O :Bm6#lD܍G}ҋlӲu(dJ8)L]N(o10DHpy6r}2H /ǻ  H3Q$u *Oنioå0?1\8[hDY2J%S CR"շ,u-M=PMg_BK\f=:Gd\V`)/g%asD*ɾ,ճlΪfXͪVw6?jpGj$BYSd }CyXꊀ@!6?HF30`%.05zBKqV$?1TaY%Ԛy\-r;Wz!2gM6p\R.,4$k! T7M]vu0uZrE58,TZ0;U=qfIhE0: SlAcn']>u#6;O 4%tL򒓼_P!`OPÖ g7(AHkTPW/x < X9(-@]f#|.J P")Ϙ8WN?+ ~[SLiй >Jޖ`阣5Ϥ䥿ZLA=z޹I2d{\4\ %Mp̙[j[ *nǧֶ78 f[xr jϽ& ͕Tu_;_8 ,3z풡K|iM FlZoP+[br ;SW@/B4 0R!P;"0 rgcd# @qDWte @#0&8h#4v.&|`,w^-3Evda.vj6@#%dwP@$&DGnSm\Ѐ@4y^njBr%Ąpr."Z;b$9/:,v 5U@>E.ƀ888a.GZBaP}FTwR0@^5ry%]8JqG"֤k-obEHa!h**RbkflT;FRTH$7(PA:/m:Z#镇(2Pq|x?Evo|x >CruP0}`i}P=;@%PY&y()Yp4ZRRB#_xb-odBl\;IAf^* ub| T $0;Z$du:0Pb? D"$fhES|:s+P҆qVTH-W~f'hg:gmp%{'$( @ӐYyy|C"pu9.7yyu9"4|#2&2_`;6z`WqHL=GCt; 6C#bSN$3UkPA$@d\t;0nD38R9 "m8$jG$M0 0+a11I_A8FN/B$=ٟ3Ur_: z  :Zz* I/Ҁ |;=p @ IP@M&u 3*`&0چw9P\1+4_]. ;7O9Pbp2SA= P8o)`W1(=eS xk,b5's:e>pwz!?[2ͤz"Ufm Jp.& v p-6p0pwJ.&t*ᐗJ-|7qpɥ>]j&h;)#MY2+x@rp '.sIjzTQ` ⮼*.VU`lb~~0Ђbsɫ}>EP'";$U|c&D"'[zF?.@  K 8` m0!6h6` O ` '<p 0Za@Q4P,@ @ '(l k@zdK.z$`𳬀SPḍa\6! oJPb,[ۻKaUUUp'Pƛʻ̛TF(@Bl` #@J𳦐 $+ٻK'Kث?; +*TKBPJ0`@; 60V6%b#`$ F+E"t@Q 0 W1 lE #|p$ SPP2jzpK\^`R"`w234۾3: o8 .-*k0p#p'$\@Ǽ$`roD<8>3| q0)ٻ'9zK𵟋 ÿao"8'k `0PH/MapƐذ4ޥ~ 0p~@'E6PA%3\^.(@pvp*  J-J6nr60r@6k;PM̒76M)$JJ$s4JJHjv`u~8"Oq~*n,M6-ͭFw"ckݺJpp}mNr.M0m0J:~=p?XzJ ;J$(p@ z}[ΐhZ:rDR?0^;%!O.9Id'*Kw=%d-$BM80#rDԫ.-Bv?Ă u$$#LGiN)T>LD p 5wfR;i~XXZ^`cb_fhdln^p?t_vƠyz|(~?__?ݓř?d?3__yO_?Ɵʯȿ|?M>r3b3YfT.__oA9\k=tYc$42'kk0oljq00o o>m kss s0"sj Emk"0>so"" kql qmqk660lo̜mjj z l@f50$(T#Ɯ8XH ;8{ Cӭ?@4Ф!hY(l$F5 وTLI 9"`y3MkYcK_GٳhӪ]˶۷pkc.\pŅNMhk`0Th!Z蛢 uAcITC>`הq r)\0RQ^#DIu'[p9-УKNu:(#®2d?n0B{@ A.+,I + 뉀R @ p@.Ѕ h)1`1p wlb a Bn \apqQn^}O^2l5PF)TC3^IE$E@[G+X}$ p08E q+q (xdd*F hyE]D8dD \L-8S6lMlسd6F+9W>$ U\ 8pm@pN A'qp@( '@) SJ`40G!nJ8`^fC"`pvq ̀P)b<% 'd2#X!4ѫ[0GcLv cT1+ Zd>.;҆BYlQ-B2= V,`1! p(s"`518k&s` q@4W3rJAī^ `a1LUx&'H Z- "$d nU#A#pAOzyoMr,61H:4PCv )K_ 'A^ /)?_O`p8 $;E D%/v Nbte,7t]eZC+y*BR-P F`ñ 8}Ѓ*95A4+ ` x8b d )T  \5tzЃfy`lr{j@B 9(G&&zp80"] BAAq:PsN3hC͇lB&AV ل52S@"3DfB{/T $Z ;++|1tq&Q+ |Z9Nc Dpʹ :E*ip9&!x k}P횂 ~0mͯ~LN;pq{ R  ^"8 UxW'%B^ XEq @%Xq"+(PAƱpWA RB 81(qLtY7r(@7LL߀+ V(Pxy)9PЈNF;ѐ'MJ[Ҙδ7N{ӠGMP%fcΎMu$ζ}m8 Pcs}ےk{:oh5tx>mxc`nΦsc }胿%Xϸ'@ǻa|zgo<ǀ7Ns 䅹Ǽ-BNHOҗ;P: #w`:N@ ~^ {t`bGNO ^zcC ~;sL:;񐏼'O[|ۣo{^0xc0ч jl r(=A<DǑ/y8oB6.%؁n(p{{?}7  @6@: _ԿwE ~w wLr{s^#wlj@zWs*rp0}rj{p})}}y){%W r@~}wn%`n()m0_@'7j٧{Pynw*pǧlaj:1;8Cj;r~@} G}}pr:(!v֠ 0~P;p  *r0}x0pkzLpװkAD E!WLy0zyry~H HGswGw{YW|Cz(4 LJx{I|@'P!G8(קj8y%X~pz(GY؃ ^{`{1kw P{P}Ǎ | mc}ЀP| 'ɘ[հ;Ot0{'%\ـdy_H'rpO@Fc@z - pE}[wL|#x~ nG}gg p yـz(Ir@|0'|vYX^[Lɡ0IX?Y`P {|X^uW* 'ɛwTکIɕJIIݩlg{yς%@ח"8"ȔJ}_QxL0AxH8$i&"IٷJP}հk  p P^P|9wxd d{ݸO1_(zI"wdySpgj9˹`^}X_wɀ*JNc)+L|;xLLY Hcp{?Z$ɜ?7x;l swJOJW&78twTGf$ P%vG8|}mJ ` Ц'Jj0ozG1UoHwowY{pE X{|~^EI *OzVy$~S0槍06IӬϺM4mQPz^u%!xBz7Gpو0{p׃{w?:aʞ}C.} s֐s)a{G7 X1ՐsɔG{ЉP{K:GTk*Ox}r} ؀p[~Y"PQ`( ;؇[}z}{+u׼jЈׁI~ʏ0pɷyk獣pp08*4Z 噆a#ٽ  D&˾ 쿺u;`w\wp5H T@ \vCsWؿlG^£(m-4\6|8:<>À( We p |p5]_} ܹ__ڭҼ]ۯ$ukM؅өuio[1٥bXeLr-(]MӅM[|VyD-սmZ}_]H-=};:WpwحwT#s: x^p==VGK(ӃG*&d:Ko0 ˅N :nʊ>nB;5l]ه>Ӎ-˗]sL}o{ɧ1 8& ׭.i Զ?Oq4фˁlz}چ t(z!.LCguB'uڶsG~̲n7 B~n `퀢>C.a Y]@O Z׌ Ȯ]jVwr2`ɈߕM/=ՀI]M ~ .P*OM:JǦUMrn:x "-@| ӶԀs xo/Ԝ1u|eOb?w~_A]yl0H_ ;˂6ujmٮ 5/̊Gr;@|.]O^#Ye {!(. {{{{r1r* ;*j|y~;{_jjy||r{{{;|^|1 |r*LLLԶ^r"i ! ? !'+^i$Z i@$ƋY*j' _  &#q nY~@:hhQ|Um'#O>"SĂȃyV,=RKy*XeZ-R_P-(`KAhe=&BF/(̬gL/, Ex5_>0@*B&I SVGnBG۞ <ǂ>bR !)wkr!ap) P߅/xh^U]S 0@ ^O1%TY{!5Xi/LW\?Ph1CȂ1B1@,2Q `I>B-r%p S`#m !!GXT=\"I xmĈ&_[;)%ܧA ylt5" C.tO,9"V-VVC;Ax Bf/$'QDj i/aa:Z " xeG$,-L0r0 @"`pe%Щ)0~KL `)ZI1|nBWj[qcŠ@I?J8j,%KIgPABQOUr*n0""/#&D''0)ϕhbG<'Ƹu?­E #Z0;65}%-T1RP g0"@ HOH~Rqi2%yOQ @yC8Hg l+_{,dlEJG~(B]Ib\0{yby 8Y^@Kɽ멊W@nh>ƾ(BgK vO*DXe/, BSV)Nr_- sYR'IpСU0֪[l+,Zctwyk%F4p@X AQ`q+(cenHS@#*kSȊZ!ayqY#Y֙\*yj1Y;ؔԐ5nqq&ZHF-0R,A]l ‚5C[H Z(NU9!Kce܆':_EW( u^ 1I5)Ɯ 8#;5f2RY9 V nϫ%tBͤlI !ik!IšnV;T<>@Q-nV[) SAh \ Y>yhvt'B}Pne` ́RnIr6sn@t *tLc||xtw#rY?ze:&jW"2cx=2|_gm!&cRxn/9crkZQL{&]1c'~%qX{ &TW)pD\k_0 !CD,&k7evHbYg!3{@10i =&re_DaV h'@C7:D<&E / }mZ̗옽ac[FT0k@V[:NS'F"XP>[{rnD d{T qï(b`0pict$jʆ_h$ y PdjXI&,';L> > ##C}RQ"L b{h 69gcf<bA JpJu'F&ptHRscҁeYbT ?<xAV XR5,&>,(}$JdDӽV8F(##-{l섌H~v\<EY30 ?Ĥ,SxJBe4od=Y'`| ^X>z~&.'^&yP9| d>"yxB\E>ު}d_]\0UB?n@ KpsO`-}.@V* @YWs'|;z" 91O0(42"B)_IE՛c 9YAz¨ jHP-`hb*D6`œ}h$6yh٨jzhTbWɓKY:/`G?>`yo9p3YZ Z0rP7So9Ԩ:]yRꭆ@ &`-"t*e1~5)!v(Ag(7Y p 3JX>!Iю ,b֚ꘊVz3 vu2)*Ru%:ˏ*w4VtFi:hhڌ_x͸` Ov,8[j\SHК9 XHBiE pLhL}ƤRe(^PbE!C9`D o mdp^? ] 4_Pc p굱6EpC`8 ckAN{QBv)_e$cO SbLjཁ20":D_y @ L^;{hL 4P, $D lLik )"b`V9[y@^o  l/.ncaL~+vgE`L 2s{(1]d2!$trżm=j t9RAnO|2;t?+R00iL!2!fREq1Ey ı{$bqoE}t fUE%0pO _˗D'$Ɍ 4nB/<W|ؠ37o^O_ 4d72B` Ur1!gt4NѥE Ԍt8/*rjf;e'%.\t̼32K/2dD)a"WƁ_0l/0EK"!3°9~'{xʼX(N'_P.$s-L8Sw衾n^t` ~X6-+ܡ !%ÿ|"8 MP`i ׌R =l}$!/;M8{^ $`\x MdR2͕@O` / y/q@LpgjOڋC2s_-`Q:D)n;<4/Y'a :Ǒ1pt FGPfѭg^~=)za\3^'#7̀e J50Iq6X-'p9t ^mVR=hCm@ !>^Q%#aP|;=_n&=@CDBfQY: G1^4=):sΉC# CZ,$Lu^jJ-vBCL3 cAU+q"`3 fSu,U^R[Q2R'rjWdX5~a=w:R'4SOHW"%!UD-2#Ma1` Χ;A ,341 ]CAadp$sJ2:hѴ!2lvpFՠr!@bȮ5.C'p`;+^KN1Aei7c^e3S)>%J24Ъ^WrMT" .be!~F` %BvY<ƂVb?S.Z" @㭸("-Uhu|AnZ(I@BQU:K%VVuXERKå-A {Ep2%AX=bm)N( 28F Xrr%#&C~FVȷJ~A/OU<}2NFN$ght(yyU Z/ MWO{גo Iv L%_| /j|Or;_|^y/^|n/{/|/1{O1y|L//j% %/**/1/%%;bp%>%ĝ3&AyE@00oLJ@|4xfEd1#Z 1Z;O÷,}%e^(v grG_[J`ڼTO;>*NVXvKg hb ]_j 2ONKcB)'KY%e.1!ݽh#>g,$if_#?c<7b2T 'M[%|}0ީ|x!bT?yPd86HО`S 0LU<FD'Nü(%t F5D&S1 6!&#IFBDŽ^H14|OMS1PT)E"˕Ҋ#Ђ| 'y_⁛@"JA&{DH _"PfiM_%m|&{9't"@5|x^]*p|Z0#{ngDsImSa\j R񣯆ah?m@]ץM{*^g'4/@ovhXb|[HA%f l_.¯t6U,t_(QP't?%^M샟T ;%(^h/H0*`36ot_eD 6"mxUM3_3򹰈 /hF$`hErix()2vт؈0X*1S8d ǭ42MVY'6|B}beF7oPjwiݴg .&d#f~ԤܓlH6͉s+00r-a*.h6{ֲSqA_y|fS'tʣ0YA=GW{B鷩cNB|H0`DJ ?q>Ǚz;Kv,nOٯol`ûU [pgϰ0gXp[y_g+֮.b@ЇNHOҗ;PԧNu;@ 0{;ֹއhO}NxϻOwǢ1'OgCϼw`cGOқOWֻgOϽw!>Ѐjկ;ЏO[g%:#"UO>$7!OϿ8Xx ~?"~`~~~7WW8!7 *,؂.0284x @X<؃" &% kslp IhE8]kЄG=~ԁ=psstp" wvt`0nIp@f(s>R9Yy OܔC s6`x~E0'o.M2S"> ll<@p~_44(P0@j@q`">X 0\ 'q0~Sr0jЏStprR |ٗ~9 \(x .)<И)[O &y(HT" p l Sy q px [k2ktjp=8,H'v`z`E'`H#`r `K`)r@>@9Yyh8 * Dhp @1)ӳ mp  p 0 1pX ))!JP8TiXɃnspkwK@oVVP6V`#6MVPYfzhj=ǟY@Yk2,q Ùi[ )@ГE(S2kxPH+W(PSsW;K6')v'pI86d0K`#Н`ɦڭ覈#)Z.W)P[M.z`Xp+Wwp [ (X`0IxDC=zKk#KKP J'Jpupz(L۴NP;s y` 6K8M2ਧ96H)7 .pSWZZ"paVpI 8MP'U0NV00#0`NpzL;īS LLP|Әʙ(W4( )1p.@WP[[x`@p[kt[r~F"z(.Jٓ 'A#jn q@pp2<4ǻ ~s 5.B x)@ ) 0Y0$M|Ol@tHYY)KL(k3l~%mV ,, qVpȃ l܍oPmP5ɞɠ,7 mx̄oP t000 0˫0Q\ _msp|̄|͌ȉȅ<\~pp= Ŭ8KIKhSKdM-Y_ @w" {h WYQOP:җ߼,.9*p,`qӨYXo""p|`F"~KSYmja'̿0fxw>p\?0@q4Џw~uuvv/]؆}ء,ث?x;=`t"NW`Ԛo* S{VZ| gj>mqb9jP>E _@=]tgi0ʽ=]}؝ڽ 0 @ <59mʗp]¨GMÎxsp0*p`]>Zp^ $N!>A.02>4^6~8:<>@B>D^F~H;.1oJ=*PR>Lƒy@^`b>d^f~hjlnpr>t^v~xvP;s!Ts^~舞芾~|W}<\ruAֳ薾Fbs'=֪.}x|U80f>JwhuoNeN~h>.>^^>t? 蕎_HG_lxpv%M6EHCsa$o_.t4SId]4^<—m,?'EGWaކ%9'pӗa '>uH/_/|BsC:?g_ƆJ67D?kIM(o6Qoc&ͅgAgKO%H1|葟tq\QiP'F>>BtE'^ &>dT&jeW>oenR[CUVsrroNeddYPi?H TISSJVnT+jb3jW>^jjjȅЪݝj㬬  ݈ńn@G?*,d!3JԱXe=I"Q!@aǪ"71ԍUK{v.B duЧP F+w* ^{#!ױ]0!9|4(~j#tڃ6K$KHB^dK4"_DYϭ`]r7ȄJEY_6 3<4S[ "@z =g k\qX$:@v쐞pۈLweW1|1I eE饐 8 X@!md',C ހ "ߤWʕV]{h4XdAfLxz|&C:Ag3'!%e*0jY+*vX_Za%oLt&V,9j| Q!◣X1x\$*l|bḘ_`0 co L= dl+h-tR U$yPM(;IESJ 2@8$ꕂntXGB{$ŷ!yzܲoMVKtjRjMu iXODzu*ibGR@O|Y,Y GLpq>>Mu~5vY{DB7ak3b)%%nf5׮A?R_iyvaD@$bx G ԰lFyNU*`+q!":և^[! rtM$~UoV KRRaӪ6uaױ̘D:k<?X5-ipGyl_<և2 EfqoHuLSb[ RJK"NuGH g$eө/6nC1E4fNW7JѿJY^jR14 4l}u(s+XURũ/B֒B7MASSu A*P[ђZCibvb周UV Vo=)OwSFDwk0abЕM UA ( L&dIyo@C ( Ҕ\m'+Jr5Ҽfy@/dLG B^L%WT8SLGBJ-cp6K ۬Y (iZ ]u"Y10MquHlW@+ok :&lǗ@|LƘX:pf b20Bkg, Fͳ) }JCùPGcW;ԉ@zÃPinQm}їA5]2aWF|&ɭru] @~ׅo L%ok4rHl7]X\{n$-T,ѤM8}Yx4'0e,Ł`O c)`wkope#1w˄u PG+%012 kY7%23i#j)vc#%Fv < d\ueOf'eg7)U.bL`4RU҉ $. _5/bQ.74GUNQՉ9{P^NՉ$!ZaBZg#05ȉ{@Bq2PWʸ@ҘؓVJ*BQS8RW*w[@:jT%\"0 =8n%VP;n[bRS/CFIrTL⏞ʘ8={@ )w~bihQ1 A7]0mZ |Љ%ygcnM87xYQ IPG Vy BB n@ҥ, ~X? ~|6)S 2mMY13ؙ AV9e' $ٚa蚜0rB)2V1O d! ҙ/¹HhIœ`^ yvܩ $I)y<yS`.Yne'` \0 f * _q) ᩠"j j#H2 ښ) ɢ؞1P):^ޡ:#!4 IJɣLPR:TNZXZ\ڥs^b:dZZ fjlڦˉnr:tZvz|ڦxڧ:`𧄺ڨ m 0 `@Ji:Z0> jZqVaWaګt Zƚ$*0k/@jA:ʬWz*̱ z |7 皮Zm@Ǫ:r n p n d  ֩:}`Z{yYr@Q"pP%0 s.0pg~ m`5? aP-HJp ~b*)Umx !b;dk 0m~ 5 cfӀZ6PϪ}R1Ҍ-1PJNP 04]֙]pU x1-7.}˿ض}۸ۺۼ۾Y/,z%61o}B% gm/-۩L]ք -`Y.P-} ..}Ɍڥ zz0Rxg}kZ%pʢ-7 } ">$^&^ E0oMR`6- )@}+4:}~HNՃ}pY ;E2/;sW..+ p!18,1W*$, /PI^~舞`).^@[78`2pU`WUPe岌}.Ko k,P*fi+-Y0!Mp[ Lz( > 1~~P6R~+)ph ` +yP. z ^|{jpHgxn #pXp)^ `/)#z*  8 :;2K\4S0>Ap ǽmH4XBM}ߣ4J@ H"L&:۫4;d<&ӳ=!|B9ؐ| mq=!HBLd"`Q(hBlQWܠX[{@0©|L@9L|jFXR7@=bbte )f:Ќ&DiZsRd8POP>U x`^T2!h+w9d E(#<@f^ͨF7JMGnE/ٻL~aAN 'T@<"7J1 >(_MUӄ"{{$HծzՁ"0GJ fl$)۠oOL] ӛbq@CN-@I+ U @OqjLwPe{eͬf7YU -D:mr9,>x@/LU1~*.vD\bgۥ6TYYAj`zkhKB2aX]u2H dk)bF9h^TpPU~®r+ېXJ;*  @roͰ7{ GL(NWjx#]L,.G(ѭ: 0`U @zr ;0_UPA >zHށ#1Vxγ>#&ЈNttou^q ?đ &!V$mJ^7]^wv@: ӟH=Q+ָεw[oOCMl3"W8Ў  n%| ClZz٫vkwv-]0vvǝnl`NO;'N?ȷ7{|%$ZMwu-f0/gLb0^kb%901ͼa ЇNHO1;P'$MZXϺַ{`NhO~NxϻW;OO 񐏼'O[3{G촒OWև}󮏽gOﰿw1=O=;p>O[>{O;^OW&mY]??E2'xuk~&TA7h3h6 XxHivuAu&x XIv!'>0xmp@\A{! 01<؃>@B8DXFxHJL؄NPR8TXVXGn@`axG bP_xbpr8tXvxxz|؇~8Xx_*8!X6^X#&u "hvr8!mjj6qPmtSjm0!׊xȘʸ،8Xxؘڸ؍،i?VQ}ip-j k; h㎴(xoj(YGP @t00>0~P0PPn v s 3)8cݵ<ٓ>YcBe?459ŏ1"ilq0lo !t>@hZj r ~tp,I=& $dy虞)A;?l k@h8o-}2iQ99ysX N7֣U0` >n9npYv CwIm<ڣ>ӞC?YEfGpJ N*] PP}2!}l[JʤNJs8WЖǩ7U<P's "4 P kviy7@Zz)y?vG:r (J/BmA} Jk xsz~p`+ 6 '`EJ۪m lY>F2 60 Я@P8 (p,K >0`*h9o E*jN"j@,DZf!+Q<`,hK (۷M`! )82pi د ) @ W(0Wo ;j h3+l<"E Kp9T+, 7 lvĦ|ʨ@C\CZ2`0jpSOzhŢp]|z;p!|)J@2H|S0`*k 9 ">`>(0 ijib:IοM طHx͐F|7y>^~ ">$^&~(*~ T8dmp㙲W~pN+B>D^F~HJL]j kVz5iYl\^`b>&T$jm@yG时t^v~xz|~>^~舞芾j'yH郘>^~ꨞꪾbLgV6΃?3ɓۺ?Y؁怰H{(~8V¾>.y;~վ{G ~~e;fjSwn-_ygxVtV xwiw6R _yaǴ VǤK!(Mۤ0_wya879>=6OC6 `@BCO>/A_Q^1\?xFypހA%A?we]jYO wU]~uOFBc=.~U#=G"]C>$4=> UFB{>XB[8գBKV8"Y]Fœ6K&|_W*iN}6<͉Uc!8͙Fkd>eAA?%TG{ocCOici5getj[SFFN=K~rjjnjj{rnn~n*j ;~~j~ Orn1njrj%mǕ y^|;~|{{0TB"{h'P(GO1}8r?|ّp<=- cs)KGѣH*]ʴӧP}˝?TB҇=G̀{|T TCHQ`+J|~'Ջz(lJe{Fbj64ϠCM>iѥ!EeSb/,u׮/aBA{=&Y7X!("1SkVdxlPGbBO?:u'qB |cd!Y%|U/쥑~Eu-לz_m /OFy{zfɷߎ<@0UO|m;"5"֡O\rI1W!|1OX|`e`dvtPnXMH+@Wa(䡈&袌&%:^@# @\*A`&*H"||Z{jc}{^8RmX@r5jftqfR*4; Jc*f%an{ Ik L"Cc$'ٔv̤&7Z,(GImPL*WV򕰌,gIZ̥.w^ 0IbL2 @;PK${qPK&AOEBPS/img/getstrtd8.gif5 GIF89aȀ@@@3f!,H0I8ͻ`(dihlp,t-x|pH,Ȥrl:ШtJZ}vzxL.Ozn8-~o|~DjAcGĀkVE{ |p!\N#:y(G /U@jDq$(EҤ.t2䀘`R@O7w6)-Q Q)75q?VĺR]*VZ.e U-ZXזCt.`-MƩ+8J\8Bnʉ{ n<^~bїeƀKnCx7UrfiZ~ڗ-gMg{w}t6i'O8sJG;-: o3y2iǟ7f~}_:}Bߔ', h| *. UFJV8Xf vh"&X*.Ƹ2h6 :(>BHd:J.)cNe*NIV^)bZze~ b)af>f n9`rGg݉}z_~h Jw:]h=*}0CbLX HS*~éVuꪤ~>#'~+:# :Y;hl:$Ͷ{~^՞}c.2tй;2+>o/z=7~_.x/w0<# mCngCE:48oRv@-sQεO}˄Bu i@stjkg~F |B Jհ}7r'R!$!bF%21LN|"(3Qj"ۤ-©^h11Of<#Ҩ?z# %9"v\=# IBL"F:򑐌"Ba@̤&7Nz (GIRL%(@I?a%8* XzGߠ/lY\rCt| `pwII\+_2,%p ̼3ksDLm>!ݴ7N.i{ ^bߦƕ,s ?: u `ky3sBA׼x 6y&E~HC4G~pC g:J97=) j@çjPiA|K.4܉9e+yԁ=v.퓂^i9ꌖƢ2 F;P ,h "d'KZͬf7z h5V> cSղX}X\ Iͭnw[F:TpK %cSt(3%mS3$Ø.*+v:܍BsQ]w(SZE:Z,Gy-( Ue{0@jACS;@ _d5[ 1G.5 G:6*w4gE*{_Y8jVT"-/XWJl- *_x[B{GR.%=8d@adEGfz.Ycfx<8{ߠs¢sN>oCV3. Ȏѐ'MJoV˲m3]hN14ڥ7h$%U:ލ;G֖u \־]3kN>6boBٞM6j8[%Yi_e kg"++n,;cnK{l=i~Kvޓw%MYpKv,5x~p+ ,!#pJ 7>\QqU}9+{"gYoX˜>Dž~ANLH`o9{n ]Te7^Kbf;̃l6x:^w=ƺ1>xW= nßwG&W|Ů{=|HK<'ҫ~=Y7}3wH1A/3ԈDK_GTk4*ȂfAs+ftpٗ^IyyrǘQFzd}ə晟 6]YuYa֚y u0y!in9!YrY 8ќ9S։Ciҹѝ) 9ga깞ٞ ;PK2'U : 5 PK&AOEBPS/img/asoag034.gifGIF89a.+,hefxvv YVWIFGӴļNKL^[\nkl}{|866c`aΗspqSPQ~ǰϩDBBЈ$ !ɯ@ABQRScbc'$&ߵ\]^trs{||مLMN?<= ono!,"@3 ͹3@   H+0-Ç#JHŋ6ȱǏ CI2ƒ(S\ɲK'_ʜI͛8Mɳϟ@)ѣH$ʍN .w@7(O:3@Ο+ސ 0СmLݻx1&gL";S#X:r@MGfӨF`6~1 5B``p,cNjaPPP P0bǟ0CbP` TB0C / Hb"N̈́HXxa,zDbA X05ZȐڄVjؐ\,~T6hO / BpGTFeGGae_ aXp b%!Y 2C54dk1@` Qy%C 0 i6aheM$"C1C"d$hxd'MFC^4AvpQ:@D $LE@s$ AFOh!f VPQ0A>9@!Fxv"Ycd1U E6ABa@jņ)E;p Y"("U CPQc.UPJ!$á 聬`V t@ho8N 6Ld@$@D@aEAe'r(1 R ~GA cX5dh~"C(6h!`Ke(i teD@@Ć xb). X8@@ Q@/ B BP V@ 9NF l` ́ `) ?`*xE&<"Jm2AyJe9l\@GF @3hb5`?&)  !@sD(ni@H xs& 300P) @@54p2A @@5N -Є3`#.dC :F+9HFXC0% 4jֈ<1 :00\  <`3ȃVH`;C GJU3hU1$!R&'_4$s,;xC 7?`B p3@kpAr:B;P2bV,*e=+5RCՀC s&@@@@E FbE*e-y0aZAV @%jٖ?f @h5:8 -@V*-h~}^v8i֡X,!Hp=c H)5`0G_&e|V _CHpjh *PAl, OC)`]hlC aA̰9 Zgf Qp ؙ9 =(]55#VZ ><'28T`PoG]7ԐL (ـz $@~xh`A†!jXv@ 8 oPT` n dIpEv[܁/zpA_q2X $Z?l@+  $ai'wk#260 P$ =B 4`Xi35ud <K 5@ќ`й?0\~A`C``2|)ŷx1ZA "PZaP@`F`O` u0ph,$@+.й.`!@ ̐D`w@J1`kf.Łp6i/u&_7 f9N.X7h2R $zV Ԑh(0 x.0zKx@Jۿþ@Xp@)}8KbolZA,pvs 0l`38{|Հ@3 ++!] P59X@.|נ L@ hg@a |BfPt`$s*5G 9V 00SASW9cqـqF& PWIh4qs ]%0?PR-~gZ5PnP[dG Lypc5-@8Z"@І8@ H0ڰug P"&saAJ?3lG.@pRopoQ Tm-0l;9P\i_V`J@>sW`_hPwT:.Hhprp!Hi @dv`R0$p ;:+@ : Mڡp^ s& dA,h `;@rMjf X-@P6 T@fpC=9jP80UX8PF@kT0U=R?pppQljS904d j-gP@P~esfrMvOts+'@Tf1X  -m޺@qp ,G0йp6hW90#]oāO:'`*w 0'}gt@@}ӷ@O0i'j0@opH!SoVO&@x`Z@!Pˈ0( -`.=MP@:B@w`0Z Z]={ p|T~s#F' P@y1q` s$CfT=4cp|O/"b`_—V\0@p?\ Ipf Z=Kl y԰hpj#(`v֠h-Pk!-C|e ~[$pRVɞ aw@pzZ0e@`,`N0Րt@0=$T1UR0DRlK]@8ТI}x g;9`vjF?p5L|7T"& N7E'>!P iq5$Pg$p+@0&u7OH k] * [R  h8= 1P 'Z` pgp p`002|``psyTF60 XIm` 2zK:rm og`\F<@!)JQM,PsFT |ۈMם\ 9SwjCҫcq؊;O`O@lۼ Zm@sK@o<`~P`GVGPk]'h_$`e@K Z poЇpdKE0$d 6R Ab md9 (0@ lGp Œz5 P9px PG -vP7G*`ltp (&pPVpc e]L + `[-Vp -Ԡ p=@+p$]{ =OC 90aMlۻvhH ;ʫ(`85`zGpHz.E T4aѓPp~@k:P&E z{Vcz`R6IՀl]^ ;L w`VH,NOΕ pLp瀟v @@ ܌\Mj':ws s0}l L],$;V@r h,j6c9R-G .j?~6-h>R*$w|c Si<0f*X M@z~V?'oJOմJQaa=lrdH,0@`ADO9 +qDJjY`ŽURHt@Cg59acHɊA - \Xa!ʀď4_.ӂE'XA:Dt0Pqዝ d@ -+BH@``2D7 *Dzu'ʁs: m7kA2\H:TH(aM 0HqQnHp&]5(P,;ʔ߉.5ؐ199# 9p D@@STg"MN?T z0yg$܄s]KÇP :d-A0D'xB t|ftq T$"6 OFؠ(d* M`qQ"=ymǃ>HP $'eQ'`P 0'" D"qh@ iO`,@GiC'irA΢0AG<* DZĖT ~Vi CdprbArk$b0im @`VqQp02#1iS"i,87@ | htaa@1:0 d3q<  A*zP" EBAtcƩ*|Q/Ar BS`ʼn(scQ/ܬ9D `$&PrD1iМJKQL3k4lƎ*kH0ޠ¸rءơX !ц>߽ rq( (M#6`yk,QsGЀ:Hj @A`Pd(PCʠ ȃN+L`fC0.aXx4&HA E s"HNp $8 '(POD%  ˢǸ_ +x:~0ed`?xz!Iyb4Ћ|S@<gN b\<6pJ@''n p"`C+aP7(Pc ~@(x 48 ~CF<:@p$Zpz,dإ1WA@E=}K@(hn!=8a08AyRgkmIZ]Ȃ7QV2Wp\A$-&`Xh ,\%'Z,4:< , H47@0 (B;xЋyJh0`YphJzRXTA  ,ЀAh@ЁHBB'@b7+ g5xhZ8v \ sh`o$~/vox(Z6 )@H7`P 0`}PaU < ,P, `gYlJ B8P1q,` R}8`,`=0 v$X0(@ $ 0ڠ3p]"cr|b I.cGl@Bl  ah8N&p@Jc\`ms$? 5Xt FhXa]'AL.#v (H p(*<L`fhq9{` &= ~:\'ƁD Bpo nu@PSp( @J|PWXQ` @vjWYeMp([bQ1ZpE\@B>GOhа0X OuI@]c e L . S' R@wp ``D~ kDrY'C 0Z`O Rs5H0'N07AmpFG% ?k0İ(0YpST@S?kXWIdya &@{ &|0#P+.z$"b}wO0*w@\ s0b(S:@d4(cwJ59$$Y1H-0vvYԦ0p0~pIr@$LI  fPsUk p*s@  p]`b, :ud@X5Pq|5jfhp D_@ϐ$ψs tD~bVB9hf''wy-V c-.DpZȋT00.twJ><L8-bc!]p]0.p.Q]@j10&g6F!z| Sd-'LY'@Io gnX'qOh/E;K`_Cp8'=Ne(h25yàE1s`c~ 3ô@zNG0hp3Kk`i,@Vp,2V,X 3u :K|TS (v5w?n8l3#D,0G:Z_>0:3r0s0#F2X­~vmc8aO_4pP vLFVM| |92ɕjmp(,('Spr02Qg М8:Zh0Vd@@@Bgj, rJpOEOPt MT= ?৘dF8r'QOJypG"!@)g0 Qj&}̴NP#% RjQ-_ &k,0 0п3Yo@ PPOzql80*yr] ~gL p mr 80P=ՈPՄv& rpw pv꽽 xS'0mpD;zr  [8d6IfZ9 Z qt `+H pPGĢd;m8s .l]{iiY`pkDv V!#?B?p(jQJ@1E`'a`g@ ot @d|Pw4nM*ɅV?@PL Vpp-X@k-p~(h@;V #eFE5J.'f~eބ@mGЮ[fh&Iv4 .g r0OBP&wb0wcpY]QP0B3E-TpA-pvoghJ9;Z hk@$| xu$pSI3 $@c Vi5s-zc`~0 `8eТ@`lpc XepgG7k„У &БVpw|p .@R]@` A޴. R p`@Rb Q&30I f0H0' wнrYٽ`Xx1@; KPNH[dQ/ AV29yro A{"E9qEpLpF@ ;J((h@*p9]WꙤK-@b|G ʒR  8j9vr: !m7 az09rw955ZdLa8isOM~ _(JgMh'+f - ~--:;d - HH mDiaސ?"2 2hHǏ i a.CF@'Ũ$A 3ri`fC 8!JԠ@(Sg0aR0`@ = Gsb]A' -OoK2J`!tPE< "0c!J.,.8 C\`a* '$9C \bŁecobp7Ay0LiB r( `!#AHP(pa4 B rD< L(0(#! TD@v$_`90tqVPС @||$4㗂TuUV[u% V\5e$cC*0хt,^|<OH$@p. b+8 Ԡ(xA!tO`@2-X P (P1La0; Llm@܆e\*T 9 @j$p(F lRTx/gP @gB aL8+LgC{FZ6Ij,x`  -`V DLx0,;`@ SH$p7$IgP?$b 'SZ؃|Hm l`$؎Te3K _+$7S@qЂ)J+h |P RpCZO@Ժ`1oU Bt &HnGiȁ-UƆXJeZ0A&gP횊 VA3x%/ IAA :X-(p _0ްᝂx{bwa akЄFyo߫A+#Y"( É V0RAx p F#)Z :0`VZ \@ls4>0@U3 #Hh'$K: -v ;tdFŢbC0l2`' 8\Y!^-ql$c a)`*M@ G !@^|%9NMṇchp 'ΝR08,d(rP(Wn `F -H jDj` @( l`=􀃙`6 lgh!t h(08 aX6PDY)f pV&dQ0`|lh;'\ t0\`8Ξ`8Q`0`́.0.,@8Оyb'HЂtd«ya:YWsce`+@ ~9`ch S8|NfA$(K:pp +Xo{u+ H`XMh p5K .p|Y.aVnK Md\9Mp w[Kd6L=0#pd0J +x+X(OjpP1C@ӕh@%0)e@3pUz1`iSPe! $T(z zJ!~P]/<t Yz 2>4~OY ;Mi5>݂P{!S<6s @pP  wbE I` m]!'PXhj!op"PO> Fns@-5d^1~ t .w jX}qDFإE@NƢ@PʍR-n6`yE] >~Ȟ4+CEt/0%0[0l`mU/lN ec'm.u `P0|qpU[E莐0,( PKPyA) JԄTdR3<U?Uo3Mjlv4 qׅ@.>8 i4Dp)`s#a@>0a@M,Bb@ZN_~oPLlUh/ΎD0Р^c F8otP.F"!'_+~"aNE$A/ڱy1`hT4kcP #+㔓1!A(m Ë8BJeB"j*:`EqB"8W*őRJ sck#vi DZ *Azpl H3 ot l<-O#"$ 7jÁGNo}Y_!Ac_ P@x|7G.X:pk@n`(efR1&t^8؂sh`)C -2#v1$;ήgh &QЇ/o~$N-=(lP}~0DV`|K% \\?^p6 aG=Ua%&B1abo@T )<$H,rֵM\_RЁ?#ZX̢ؿ=)@N/~K[LE= oxC  ( 6ḳ-& U`+"+ыY3F5#U h?Ph[V>W 2$,Uw^"@1dacP&]* YfZf%@D2r%$NbD< z5A8%*6xH΀9] oOxBюz G7 R\̡QLv"DJӒTb sqXjJԢHr@B@p>NJ/0 XͪVE,p$rRHyH[MZi L-oPV9$*@'H[z{XAO[w *s/|A>g (?unj[So@ HGGsIW/BG} @PxcCv~v`6xdAd( ggU>$p@Y>B(2CU0rm@xD8FxJvV5VxXxoihGK) W 'rA`y`t'`q!-p3YppqY" MU$pPds;l&F't /!/{~@2N-$dG+O1(q`xȊxAFTf8"w`h&9pX؍x$G*$|dRFVdsȋqePtVH Hh"bZ }\O30+1 [@ ($YAnb܇Х O@)+j/SRCC!\ #iR9Z㨊, yPbPXDp@/]"E))pHQ@E51P%K mBTiV# hPH/a"Tp!WM$J De`$" P,0Y O ` Q)fX[iQ)]``mRեx!|o0 0$YK)@CB2`!0y+I?@ PFct 1^Pz tx4$Z#/WYj[P47M`V Zi (6 1r"d :cXZEh_"W@)Y@*)|Y30IBYPu+ YסHJVZif:Zz+0^ `-ZX2_\ $^'0 Fը)]3@ap4R깨0KPq!@r Z`5 )yj z骮ɮ*!I o01l ډTʯ_p1tz D : )j Zv/mbPP1S8  +Kz  jhP A[P++(br0D3 ; "   Wj % @b0bp(1D+km+fQ[+ OC`Xi JhA+/yb@`y[k!@+/ֹ{-Y Ly@#PU@@Pw  jг A+H00 X H8+Y_/ "}YOA$4!*jf!^JKi>*ryǾѢSHP/PBz K}Z0QЗv|C!`!0`ɚ@Xla0 a L7pY+{W``u`K*R%p"iJws8DL -+)#O[v:"B.kka] Wlp$3pE!' *((X yjx |l`!Bl&F`4Z&s ]4@?9 P{6ܰ ˿* i Kv0rm }_d J LNے*k brbW-Д _r @@ԅRP; _k`z^S͓pݒݫ`ք@Bݍ +@S `c {pR -`(clYpC' F@-`R@Z0vv  H Ⓑↁ9l :PxfN( Pp~= p9pV@wՙ-+ۓ]йM6˟E[k @+@?`0 T9pr`$ppNtN/! @f -p`ivk o q seg58P ͞]P_àq5R*'%p'|>@`_v ".޷>ӻ @p!@yb4Lۇ fDQzp>cE/_pJYNmNSUWP]~pOp wN50]}- P ` @LN~Opw@-` MsO QoЛoޝ`a=*h`PAAL[ *htRJP67iRB8n?|!:~tLyj!!rtX*"$  oM"eм!D"*<""wXee絷oZ4{o״ji+m߷p JHEhɻq=\CwL䲁!Z۷DʜI毌Qd&&ÚhHRf@U&LKjZylD  -\+65YJj+n .fܿGJJ葷DA: v Fv _dѣE080Q@5zz`Gٳ8+sC>/yUzㄱIp"?@G1aB$8O6@6<lG%C&A ptpM0`p  bS-<1Fw=utsI^A8j]4l$Pd>5 pc@ RpJ<T-ȣ)AO>sx @f%t\ .1br܌ e#VjюLD9t t B[!Jf>0LA 9!@0b@-@,0}X&pTqo)e)9^bɨW5u)2V1AL |DqRрDa-8pO O klk8`E gP!~~̡BEޅ.sUH'=;9a @-g DS 0 rKPq@!t!Gt@$-&t2?WyQEKM܋t†ǚZ| -b[; {P+<)cbAw$p_)(-Ph0bB ϠR9EA77Est{.:2Gao$1JqL(1L s B 7@A%LaN??d@(`P _dq\N}Gt87^0P)p(rv=} +XCQx(E*:VE&aVCGՔc?bABgsFY4BEq!BGD+j 7Av tVHj:Zf`fo 1;Oy`-CYu!X\izXv@Gh@iE$ ,W @]h%  0 f&0Ȃ=0cј#*BmE cP-.l$2x0miS@!ζفY>p,wϻ{!R# d!r08@,3pk"O2yOldrP(o;B ^ , 0|PI vѰWJGO̧!S`\7}`H`T@22w`xm&Pod\ UQγf0zrpWf0c&*p @`u0 QGvVpV"؈L~PȰ؈`hz DpfcpopV#0G]%J`$' Zj 0>X_i0;q#im'?~@M0XUs`dK1j09 S$؏$ |wo`wY@pGQ80hG]m M0R_pE*0 @[pW9RP(@m _@P,)NYF~FP -0-@~f@1]a0r O 7 9Y~oqѰ `)5I4 鐯99P.yZ: 00$"PJCIe=`7S@WgpIt`&< ĩrg+|!N P`&`AzН!sT4`,jwaq@Y x  p@tt*ЗD ɠ>D# P G P,c@G@D3-YTV6 \dHb+|!@GXe@RQ?ptc@0 pp  pE7qo1}iJd@` @'S 7rY * pZwذZV y'P'jcn P<`$k p`X9:vcpp;00pvD,@T0nP|+pQÊ2 v??B܀O%05/W, O @$-`w`+ Pe3Ppݠ>hȀʡ YbJ} ,Js;@!7WA1( T0]os8Zt@#0.#0ZP & aE{,c`wFu 'L@8+P_ն `Orp2l03x: @ʘ }װ!:U59hpW8+yp | x @ p!OvhPjl׀&)0!e t v˨@(  K $jigbWjb*3*h`k ,Ry_{lpP'S`}"P:зw; h{+ y9s$> T@D@IvqpP sw@RFLpXp`@0p [ʻ] z@Ƀ 9A@i 'T,`XXue+ S@,r2Lf{6o0 wu0 2 4O+AD՚C1R|`As`1tĒ4@mx Q Qc:pqKxpZA尻|ۻL& eH@P]@'PYX4'(Y!ݠQ9w   \X ) J {.L0l,,>^~舞芞b'. ?l`7- SGq. s> uz z5ٴ^~.h|t@@%w jb . w~y0a>^"pə%0G;U1Ê6  ׮ܮ޾ ?jg+G0+4ZvD   o V^)Xw宽^>+oO^Q^ {BͶ㼥 zB?ez0fhi~^5`j?sN$ @~zpI/T?[Ml&o{h.T tG k0pʳCMJ 0yof$qgY@y p"pqc8nKPN%; JЀ`a[ 3ifC3`oL0?z\1)H#8m hPPPhTHYaVQr+gRRE @7a7okIw,d +Am5c ozs7ŝy+sr\TVhj;&ff:   H\@<ѥ˟.a#cLϙ@ \P ,\hĆrIp p|Zh1M2hS:d 0!AMga B] vn6&@#+| jF|`@7d8W3H z E@>s -L2wnj;w8FHp7dV7[ 0EX@ `@! @"M5VְSNxҞ# q{`4}!sM 0$P O R3D2 `L#2O=w|jP G 4 ]`үz?Jbgz.rPiAx mUpt\oł;pe!Itr$$Ht7@ppqfP$tpw3 0-pp[0v0-0 pB5CgupMD sPZۧzbzbBVpB%Cv`9@K4tSiCXaF@ PbHG0PVOyPP8t<',9GZ@8-PyCp@ x,9a'qup q>p@a80;;pV.yI]pp-Al@l0Vf p-T P<ńYᄏ3rvorVD`H<Mp- y@z06A#3A##5?@T g84-sVfܲ^>vv7 GLX9 +薾KTKc-cp#T+$N|' >9P-<Vl_75?u'y@`8'$1) nPT0+Тr@7 sP7tp(23Mr00"&p3\ړsr-< P-dAK ~zp'P@b6ajKv0fP>a'`:y" KlT  $pQRf; <9XT'>PNV.Mw3W@U@<4LFD'p (rp kO!tZ$0 fZLEG!0/?U#~P3N++!/A#p2 VU2} (+r&7}ҘϐКtbf"p0/Iw` u@CV7|hu3- `\I`)q7oDim0y h V Ete=Eg G:ohd-#s:spбr _ "_0Lr( l+=(~]rp`x\ pSpmtƅBT*KP*}QBnb zu@@JKۺ: &Jh@mAj-:0AQ<)P4|-;"ԧtqP0IP`q߈[ 0Xt|*{00 /?֚mp.IpStR_XpIPSxOpAPgORiWVvn'r't "=oeyt -0:py'$Ԉl+p^1Lr qP \~rT7] `!3bٮҦQ{2&` UaPm7mM0P|Άg}]}K%'0 P j@ J@2q ? @G\p'\^-!/c O,j3,'` G?7D,|\BlU4Os'/I\!!@PLт0ܼy&+THVb4e@ QTQHrY$gDGP@R]e+nyYhora`f@M-P  w)m· < ptRVp|NoЄ<\@] ҷ܄ 8`,A/,@&a x2A@ԢC(*p $`6B )&%Xj} 6p]0d`؀8$dP0= v0:iD L ](GtК ,& 49D;a DYHEA|,r@;zjdB  :2 ttЁM A 0 @3p@ P@`p& pJYGX, C,㐛[><4`f=5sO82 061)c@.`&(&|0 n.fV$W mo[ 9p/[Qlp@Q$X!LT'RnAlJxæRj i@{.*kLpKHɜ0`g`eH"Ѫ#\h@@f9tQ?Fw*Ѩ bP% MX2P'>\HЧxH2b9AQ=8L?0AZH?4OA; r??a`p hYYcj@<l@ B #Sx 4afx 8[0iV XEC`'pZ؂x %-跢$ 0S(rJ+؁.G i01` s8P ʁ/Aߦz@Ԇ h!~LBp']@,.\'4@Ao\@S?[ 6;@Ȱ }2 `Fz~@6#j.4[}q 911xA[ 8  !!X@`hƆ0tMڀ IPX|;τ)8aQK T}^@7F@^"q happ |:!Jom?MrU0[X[0 i$ E$Q`pyg -` ,P 95DHE 0CG4A0Vvn0FY IO9 X kP`pV vuhdE 'j0P:P0. RkO5~ bQgp"P07y8`2% ?p $1X6; sr) ؚ`WzJ q!,`Fz+0omT9twdfbLPg [ݥ: Q :y!op*!QBT:`I5k5P,z!| 85gp¡!@zyD5 &P a: 0DoXB6v'&7X9V9Y c;& 9 %AY=߀)OchcI` pHf:F7`fXYwf 1 51,0yba)%v-pt@mtZ`*B))])) (08HIcPuT( F]P:  -y @C $?]9'?Elp1w0` pi%h(92:+0#p,`f=,k@5tYg MA% + ac;?""(DѡPrT(󨍓K`c9V# (7k\Wsg@3*_ff8+%dp0oHc1f&m7vz`@hpT?~` 5e B`8BlaL j>{Y]#v*0?a _0A48 Q(.`0 sF~F/vPK LEyTu|4:HTH&0!; !V(riԋ 4Hu4@'؆-0 pw0Ic0cp8:9?9M@݄NO $.Ėf[U5 |Pq/`,]0,8; < ld~KI#`P{EI%HLqL GP 0& ޱ-Opz!)jQ!kpP  sH$l|-pVr@@ʼ ƥ Y'Yc`bU`dc_g @5 7e]e?g@Vt?P0`Z[ @7)`V`` `"W pՃb2 |_5KR50PzY+ :0U" @f 9|Tj'?/h\v_ϮfbII 9` pbPhxpf/<j 9si tip:@>_JC3q! iX@rp&QRP ~l6l޺Pc >bx2l@ya`yRZyywywGpPxG 77[aIm@YTzu0b-L kwGx1:j'xw+2 LjĠ -@Ί . $X]wue7G@Lv+=.Ep>=@2E7!t8`lV@N&PW%<P/nV1AP`pzgpT."I aC^6n'3<J(7pIV0uS{JaEP_-  `GHd`@T( Vau<@00T$0ˈ"LM$@=@'].0SLp)I T] $`YLbj| SEyy10!k,$B +orpQPM@3]hV *+pM 5ipR6j9 !nARB iS i ops`1tr)]_c&g)>p/ `>@r[Q 1$#ؓm@L0V0VBIyXp  f+:*OR|5rp t',< h0 kk8T 'rt ?0#? sw&  @!Jr$(b AB ?0ɘ;lH$!qƘMç"V""MY DDm@Q5"asB Nt@2$Zc .^kPI"J-k'̅v<ʝ[MKBR#:FD:LC! $0`>h Ra"JXEe#T+zK 2sA "cb=Yl *x@ Hd)0 H0KS֌9D! qkbd/uۗFID~$Ah@A L `+A@-H "p]…_H1Fm@yq `0DO F X0C $A"np@ A0D R‡QAU2Pw`"ܒlh,(6m&@W@t OAOA4ц;`A@ ܡ(Y%B<~0 kl%'p hq -t DR$@Py80gJA'pԚ`:pluAJ!(0zcPp-$G,C"]C mpX QEdD⏤!6)"dc@ $4[pL#A/1<?_&K8p*a! K<8"бwa魃 1k! @A(``D P !d H/=`Rt f^L.@e?0!֗I! cF}!"Vk 1 Av$Ap7ac%`Xv#>(JZrhH(*< 5LCڦa(86t$2l'L [ΰ7{ GL؇B|pD\+L3\ L"HN&;PL*[XNX@ophU f1xj9%:sγ=π泠<@ІNthF+ѐ~MHWzҖtW\Fp. sƴԚV6x5Xru"j\@εw^MbNf;`WR7E A* 9fA:jY;NzhA-D`A0k Lqw'NA + 6Crd54+C2Ûg.~``Tyw(ǵ1 ,IsadƜX:$x`^P rTw O`Zϻލ4QEO6Wp*Sݳx߻7?q8NmN<@"hQnsw5pcKku}O|@q, - jJ:*[ e@դxC~駵Ok~@M$a:4㼛߬_6'z] -(eyWoƢ'Yv,tP=ҷր".dD @pRzwb#84P`iU"pSFSCU~(k2XFx` |a P`5e U\؅@U$`PHVe@aXZtX|Z{"h1І{CjEh`?p{(r!"1cPD8d#Px_ Fs+pws(Jyo8q08U((,r0Y@Șʸ8"\8HqP8H$pP:؎؎*DxIypׄ`ȉ+aYPX  7tb:H8 ؏nmON-ZP *F vIr66neU xЍߨm@;@  (p- `hr8$~ z!kp9@]dop9Ep+YВܤ8 {H]`H QГQ`@p-n$Cрb]Vd5L yuIc@zYt-  Dv9ـҠ&xzPH]p$@ Kz-p 0.p0Rp[*!'0*$TyPZ ,fIJ y 'F @UM7ɑԠ@g@!k` PHcaڪ0mbM4$Pr8 +PQb4I`3c!-@ovU0AA*zp$B04֥ ƪz/yP`'te @m G)-} 0@%+P- M`)֢#gpT,5jIz Z:`rZPЗOG? qd0 o~y@ L YR>n ;Ny8c@dʠLsp;[{۸;[{+M1p)w")дš$?{Őr4\5{ 5 OS$Dd 8ES @a 8xa;PQ?~1 vY !CEpA|9z.]oŦ, @F& \p0+A P|:8i,;<;5:0g`ZQ!SR+7] 8`= p G@"vBwpܷZʧώʌ*w:1P$q$׆,@mz@g 9, g@߳'@_0O0 GK p! P'6 S]85 0:w%v QP s \O9sތ/S_Њ~p:?PwaK,M yF9(0@V̈3@}0* @c,.,3xOxւ;rI Q ^]_eʔ$(k^b@H*$@[\ CO+O M$ HM@; :$PRƌ0]Vp,`]ѷ@j1M) _թIf>(ڠLK0ap 'z|PvaVGǝ'@\=8p-bJ!F c0M`? S P3"@= KB6z ;N) Ѓ0Ky0t\8'`?="'LJ &1w0+@<ٯzV`S q8㦼p ]FP)b@Mnp1 /С`> sWjnd їnnC'0ɑQ,= (p;p"k! p~p^C- -*StT }[ȥ].W\ =iP0HEw0]P%%\P9Cc`'r@b~ q| v$ߏ`?,:0Jro`H cS*L:~P5̀Ds0PA2a62SzJ}f6~w xvxxE 4,o>ݺfpE   !`Ivd96 ^r_oT"@F3Wv#0IN09nJ-Mpե$B LTjoEQ L{aj`5N ZSm_[tlVm""e$y#D$G"  "kؖi> "@zKLλ hk@$%UD|]oǏ CI vjqD侌6uɳϟ@?Z@S'"p@'KAጊl'իXj:HŌe>y`?$jrU6u-nʝKw <?-~k+ˆ+KKFd cvMŠ[̹s5+S VIbN9װvJ.0EF:myЂQ$T qẉKA1rc\Xѹ`Ë+'NcrlO{]*e3{'}\6(*RC\a(kt0DAQFjχq Di 㒷`S qLȋF$\`)cA;TI>Hpƛp)gH ΄^"dAyӕi @i cVj饓2s!p8:h=nAŭkS@D@`〲nzHhgj[ 2=10npf"*j͎2; a)jQKD2)t( @t@GVX-,LæP0eLArHsﶥqAT^0wDh\2'+$D𴗴A8DlGPBdQl ܰV1'(@tmx|u+D>nTHN J,хx.n^ &qz'7..|e0.Jep;,Ug觯o#P xPs+`- LE ~?8 b4H(exʀ| h!$ qn= H"HL&:(:8\8P.z` ǨuN7’?,yh0KX` @H0> 84 jhCā?1 Y3փ8̀,l$ :p*\F 2ͨ,,+,O,$ń1(a^9A%!? J*Ǘ4ciT,*PI F $FL*Sʉ-\.YPl`I8جc`@3*ځ;H{Mnp"Tk? !`oj^G^V`a*p ; h~ַ-o& Kh@ʈb% #, 0a6@z`8G7@0h@B#jTP<V~a'5zp+Ua ` 6J"t0 :@;pK8AG&39ahp e +px PerϱrXQ rp; Xp'% j@x&P7(AH6-#CWg`[P ((8:J#VAL $P*(J EVPD9g5R0b0SoV@(0( `9?Q?qA*p Ks5@̈ %yTcpO_OFp$p.ia@pP   }/-$w-I@G k :p>>!ua@`[pcu0Wobi_ SY o@gerG 6ZWUiru pb2 qwG $w @|0H+p6Pznc&aHy-prt yyPNV'p9'Np'=M@ja_@o5`MJ`Yap@jfk+Vp I GF` TftS5 ,c\G9* G,~@p0Z'`_Yyc `|0aP5`G0c @`-  rpHP4AT y-t`tXP9@nH.@ w@'fD*z)+` pUf0+)yX`0GX)K@64( :.0'PqJ vzv`0rzvQ&$B``dy $p `{5Іp#0iQ`#|f+pV p)yUl`PXy~p0]@5&U?M?nwlP mz/-F!iv:| xq r!#Aڛ!jhІ pP?Y !pY繘.6 ip PU\/lyY[ a0A : }90-ml0pp'p&D  8f^ X /B pft XMXPPƖP-Y cQ*! E#q V0ҽ̾XxPm]@x a@@@1 p-Qap`t6Z=q|-tO`@SЖExwРVt> 0I MJ(~*{Z̫/I  G ,P Yu@PU޴vc |^ t-@ۆlYmi >?;y'~dh`-0fz@M Pd5[t@`Oq.CC0?t O!Ȥy +0spt<! ɗcsZi+0K'|Rz0+@s? $`-6Y $wQ'fJ0%?p@+|m0s_Ipw s-#'pwpG@ .|Z\ci?]P'aI+'] J#.5Rkj'P|&--+t]= ݂]5? 8z-a wD:LrT83?vB_3jȱǏ CI 40ɲ"DpI&!hA:"Аn?ptVRha&A 0(Ǫ5LDIª 8laN^4q'?\h,4>+䴠Ś*lN (YL$:DrVRx圠`OaLxNET˘3K'@(\ΪH l`Pɍ?*0ř J3&Ÿ. $Y7`_`` -Ap0`&!@\ h|KR4AH# cYQ-DmtA'hpR| 5d4q+h pLG-pÊAbCC<,0DAL|yr+'L2 jGrl@@|тwp`Q$:DEgtL |#ENrXj @ +0AtP!~AaoA |E 0pHL30prt * ԐXQ DP$vP Ŭ&/ZH`qy[AZDP (1(,0@13q'E,D\Fs.3wE8 iL\ot"- yFKV|ԂXqfSaq0|!>X`Axu yG\DU&_D@ZqAd|@] @@L0"y5%NA! sA '<αa*C܂A:qx 0wv#s)a;`z '#H !Sl033B@+d aC0 g%?pp5 ' &?rAЃY@ hfJP@, y 'HL '8C %Y0 " 8`@r6RPPԟO+h83W 4 h5p >@ˀ``z pA)猔Aո6pC-@ .Hp^c@C0\tAp̧>Jr #( <Z0 40dBjxB)&(m" ?" 5l t )L^0L02c6@?KW=5J3Ҭtl$>)N6OV` e HNS& Z(!+X@@mV4؇ЗZpe܇r}| y@HC=lANwnű۔gsCTO8+o}i7ntA ^|#N@p;$AYtc !T{ht`m W# tpe9 @x&O?- f@:L$ s$-7UwbjCO7rSGVw @ D9`kD'h(fpHGMP+OPO8pXSL`?I:JF@`@ph} 0PpFjz @+P9r0 2 t`HplvusBB ܅jP5X8>zB!c>Ec`A8).S`"0 h"=$['F  paZ6X(@*z0+9 pDfJt8QTEb\a@aoDH  ZVp0y J>kpa?~0Q E @c@8Zp!@\/-,~Tu 0@]0Xs2p$_q6 067MBJp/ {W(@r @Q;@oq! hPZ@y pTs y0Ƶ-<`QO pzcw0Rtv*׈+ 9 -&0?`/VB6 D:OPcj-PaTdI`uCt'9Lp B} $P$p Q9xq V L `W({B-`̀ `@׆aQ6y8@ ?Vv*PFvM'= ''!sqM`WC2'0'qafG wj 0ZѕL#v\ƀ~p.: `v{ KD @ U 2O=0y|e%8mq!Z014j#1j'-3w12|2p  vB QlgV9` &+ۓ8ntp0*`!pkz'(AG`ypB~*-4)m%=ipr3X 04q{@f]2~ r}OtP%ޞCcUy@S'@ew  L|WJV )Á&PP | @C9AP֞Zn. PJMVpPFdpуrY<[JejXa`k^ RwdS .Pjy]y ?@nnAOb&qNd B0̃mtp{ _V:&$ifU-'TC: @DŠk@+3VR9ql$ 5zˤJ,`OP38=2-@*pJl @zp&O  ph @"= p7dkeS:f<X?-tTet>8 -;5т;R*0t8HAraF cL@fn`@TP[~XqCnc0aG+qtC(wGs @tpd6 $T|kJ|BLV$\wm`*Հ+\+k\G _r;`cL(1 |\6#.Cc7; 1C'@_J3B>;GMAFd$a+' pld܂Ja|.H 8NA_2A8ͭԵ`p=`<@b ( zk':V0y@31vA*Q0P}v)6ȱ 2`xêDj  P.Lm 3| :ЅM@$v$I]j<!a@@&tE% ZNβm?28\ Q@t ! !@`0Sb {r] O +W+mJ(hBe,O̘t[pQmj[P0:"dv>!F()@,g0fj6A~+t {5r<P ?cCvU `z|vc~0+:' ; 5p V5S!P ]oĺ(x5w=B"GcU;< !BVC+.,@ jg|W(0z识 :x8 (D @;dPv ;u,yNz + pIwߵi)YsXn a8/z$zV)Va8|Bp'C <{><݆ʋ>7}z:`t߁^A*cdl@u#}Gb0 \@<@G  L1DxxtZ *010q=e'5{`5"%c"{ 7 0@pXrB'J`>`O16.@zP+z@!zbŐgp}El 82r ZbQwO*R;!2qP* H1/l=- ` f*`'8 ,=@G|rIBJӒ8w`(0B Q#>P` O:Ű1Csd%( cT<38O## &>z`;c0P &p*0s-KS Q7c~m@V) a y0 ('\KtЅ tp p,/֗P1@@pL1TNG613o%. `mV(/r b:1TfpyК5#?'z9  }r`-<Dd6fgm*?@J0ySo&wS2 . 0.`_P>m7t@fET >Z OLx-R`O90pТ`|"Jrw!-[;NV` f9 ;@0@.0'`B.Gá Q`= pg-bLʣ,W ~aO1Ieza AG++v` ;qv_ 1B/): P2- @m 90-s@&L PʴOeQVp0 j`hc Q "IQ2O` .8ܙ>J n w7`> <q6Cl+t]&<-Pr &۔:tyTsN81S?VL90@&ha9-P= @9&P @; A@DЦBt|t .h ȣ,i"o , "6BQp~L>A@ 2( Fz'f'PGf @e#wfR !'$0Ixp5<gp$d]0#eם"~`c@d(q!>0H6j:3fj9p#Zs˻Ñ op <:@ Pq- /lacbt2:k "< J1 MY#/VIj5D0pi%3@p$oi]\ A2 w`4_M<1% r:ܑ'<Ppw@bĔѠaB|@Gy MVdMePp0 Df"GgWպ?r\UyPp+P`iWN7X5@]tgv8uF Bah_ Q|p0` G`3; pP`0Sͭr3aݻ+6dp 0L0qp0W3ŠW gv7Bs d] N.p0!@e ]d`8uA*(`]7  @ڬq~`CeqhI /t @=a@`srp;:@e.rKq!2# <" P.5-]ªtpg_ X)Xvˋlx *@g1< qr}fh`\Gp Njn @]k o$+gtk0g!;(TdI?Gp``vR! 1o׶+T"js9\*5  r`Bata A t`ky f$Pe0I);5d 8IѮ@hP Q*:Y֠ria3rs,`L;0se&`(q#N$ "PD@ qpUsNc1_-Axx ` SpvV pWlx8U.#y7gw @uc:?y95s8etU@Jo .BOk{!k'! J/xwA q?DPY0`R o7 zb"UcEG0 0`j]"&$>`f0ݭ`W$ԊL*ŠH PH'@Gtp Lxr0p[*bLVICnچՂU KF3*. @#+ @kw6# fgJpr  jceD",mIws>,͗Vk00''k-=~-t]P (.$w;c9rGz-r X 9nX0PsLN:  Lyf(CC?cNs !`EᶴX?P1`(J t T ?*1R @џ;@afC9,cg.As|@]GB@@IIוAO ,l!x 1PX8dd Dm`%wT&(-RT,,GXqyp@-( @,`wЃjX`p>$ɉ'h( Q cHye -$\-%G\pܲB Y\ B;A Pޡƕ ŲF+-3=BIfztpT{LO `'hX læ9ం'8GU71m&`0%0x`A lPw@`0 -hL%6E PGk`@ `-Lʒ4=T,r `A gA<@ |)G F1@'AZRf,\ L@FTX h &-D B>,wP d@mHi\@od9Dv箻%^m%UPLCP0PD%>FftGq!E>?<`JP>@L, V p B Iȑn4tf8~žYhM ь -<J2tHF9 0vIw ġm&|05TBtДADA+ (;( lVDr)L `h"20 d"#h<`]8iq Ơ./; Ѐ1+0hxg9 ++(1A$ J@$XNɅH[1$/D %Sp!(a >`` @M*PNʴ.A 0zV)ӓA  0,;b.D y%p3(*XA`RTy e.1)lo"%z0G`&D@ w % 8[Ab(ҶVGt? GBpr% p,@jڰD=*x]Ƞh g&@@2VX$ =PK /m @ R I2P@ `9u<,&D`_P :Lr$r[CԭQx 7rQp>tPÆ $u^`fv[l/AO/aߺM`#w$A As3mH!i8K+Eؔ2@\ЄP @0 tSO0' \@7 ` F;r ؊<&@:'ct,11@@  A|GS>5x 8X:00Z`誡 (@Y 8X@nwoÄS(<}Qf펷Mz:w&~ H'mN#9&@[x' YGNr"dA<,P`\ 2A R`swF 6(%pB%rp XϺֵ. !`@hO;"0i! tS @ ,pPއJA[(:O` Jy`` >S.x'׆:}#c}3wSaa7=|2`~32p7q4`?f~RTWP^'T5q~J__~$}F {-(v B WopS1 ЀHx gǰ~qz0qf_Ȱ}@vORnv O7a%7{чyӧ9q"0qg 06O4q.\n 'fDG}`< Gf[pT0Dc=S dj$6󆆬D$pK4zpFDYGF0]8V(ox 8@Fx؋8X8 "p>Ѐ{$p px7@I aP蘎8 "0zI%x3XX (%׏9Yy#De!Ѩ}Y@j0%0| 3@9$ُ_Hjʧ R{_x8:<ٓ>@B9DYFyDYr"P- /Y tH9TJ) pБ`3UbOD@Ax3ɰRvyxz|ٗ~9Y9z"0 OI 9I@ riH(Z Y`!`/Xoe4Y "sPyٛ9Y]S'Y^{0jpY P'iP S k`Yi)7ePY@zI`p]S(w8q0`~H"@eL HHfpࠥʇ9eqvD"p;КC p; Ae Q @i+tG=f9pZ2Ꜣ`&!!'op>1 톥[v` BvrPKx qr x h 8nt vz) nיBFpVc )'|䘦?'(w>x i`ʀKzoɷ Z290JpȚʪ 0Z*)L`zؚ:Kpmc`pC0,̷o1گ w[rsS@)P1ps#Ey PN 3`ש;f(02;4 =p!p<۳>@۳RP EJEKV p F2Z[Tr,f{h`$vepr-]yo;z| u+wڷ[++;۸嗷[ ~{۹[ַ;~[}[w{;Vwc{6+ۼKiʻ[;d[ֻܫ;q۽;J蛾g +{0׶ۿF쫹-R[ | kpO7:̹ "\B~~~im:t8y ?pQ|  mh@=v 𧗋 'Lj0<``-MF< +VgR Q0'DywO% KX|m`k Ū @rmTXpzc0\0R8# 'h@B౔˲-0S;hbTXG0YPqc@kœܸ_o`P]OpT`oA8  O d23rnci`A-uwR0ui!l)\ IRL6`Q`  uA%h!|½ I@ ^!a0Heٍф*0Y] QR $ O@<a@! ppP=|PZx")]Tj|uRcQ>@+`ap`D,-g 0-+~g\l4u|)6m:@]@0ċ؉ݸ`B(pozVRB t8 78Fj pm`7 Xh[PR9;}ߖ+!Ҍmڻ[RQNT*[M9  H༠* |\ul% XzMB2P@3=¹ c]!."` P+`@au5ܓ@Q0`:ĕI XQ AlrnR77`7]wB JΝ{E۾A.GMp. wCra 0w0,Ρ^qo Y2/! s١|@M-  :ٔȹt~\l7q\~Ȟǎ ǔ @81'@A-I@iD vL PwmTf`!6qOtpJ] 0pȷsaGhu^Di&\IO]A3P iE s0!d spI 2frMTpZ#RpPvPR`l hatP51 톋@ z|{/B 0Spt[K%/P/UH@KP| 1P՛RBA  P0,ppBPo%L-p|],؍lP&0pP׽ (WSz?_o,j{79@ PWY@ 8:s=) ov E(1F[ _4JVaB6bYE4z= t lpz[S1 P1XDas&sValS" (ЌRk8s(8 b7,cyl9t&U7tj}GMx<4 Ѐ]`SQ@ U45qA&Kj$xVY4aUQ\H^8AA2if'u%˝ޤgx|BDjD{TPRr}' D $PD0ĠEDLa4a0Zjlх 4X &Rr A1d`HBf  ѵj/-K,;m$MKx1hL|P xD#( aP:(a 0EM%*Ҁ:HM8[E]CPHFt-!>78D..LyE6s0tD7 A^ޝVJbȡ~"Ęl=!IX ZDhJ)̵l!JЄiw"l%یDyD) >ˑk4Yw2<!B":%x*`=@;P0 z E8!aH &R XTPcza2(ta  W7&1`B PS2(VD~VGe5@" ,N{ɊJCA`cUx:BgE+fN#.2eB bF:򑐌$'IJZ̤&7IJb` a>ѐrTd'WV򕰌#1Ђ,lYs#2?f C"2vL2f:Ќ4IjZ؜fca 1rL:L3ĩYJgF_bQx1yLv @!"pp1D'JъZӝ.iG{^g*>;(MJWҖ0LgJӚ8}ʛAX!(8%ͩRԦ:Pep˗S%=jͭ'8'n @O[Bp@`@ b71x0Z W+B!$c^{ |%P4$!c#c7 UrW5k`7Xs@RFκ"kxI~_I{nNj_i'r JIM.D ۏUBY.FJKKޡ6#uk)+nEOϻ/|5 -tKBȗ"ե}E_eZ'ַBH50|;aMv".o%a;vr1@7C bǶp ̑~D .G\P|C&lfSHXЁ2hF3kŏS2@:xe0\,̵aI4F$IX, Mi;wBty)0c{5/`R/vˁMjNհyU:ָ0sk+aD߀{M3N@dVH,}Dѐ (Sfuܛe,6mF%BULȚ6@P J6 lBÆn씻kt_vu2`l ԡ2iw@00 ?@d(0 `C Y|,WACB`>tahaD.~n(0Q%$6;H(  pT-J!@80 P\tC x\@`9tβ tԓ ƠC`g S=<~2 X=6pA5 >doaHB x+ f@ ,V h@vT-%)pFDp0om4hs^fw|3v+-l'-0-`pwpc7`5-`<@@s@g pG2 Zk O@Wo`y$,pjp a{Ƈ @ 0q0rp^$:caL>SX8aV ,h$gWPVtQ 7Y0p=1H`T@w0;!b cr8g gr 0]k}p`5-og tr@ǃCgp@9 zE9paP.f ta@:]fPKP*y4'wXP`('@ PzG ZpQ`cPK@$\1bP1p8)Q/P.hA~Ö}@\hI`cbHp0Kb@ D\S0@rcl׸ hp@|' pVpI -A@`QR`g ghu(idQ$@56`I@$ojP" 0'̕935.p   t 990-G0dB&I ~ ]w jn"S;PD3N7 %CHb =[2+ث-a%rV|%w#tg~hH  JV?TY-'`MsQ0T]]hXP]9P IPW+ dwR77 pAj]P{1?@h2p* Θ_PfW&`7y_D] 2Њjy64s)5Y7R ($V:D-=Ilv H KHr- F:0fR*0j 0LKh?bW ( >Ztuk^  nC%=H4 OH`vB`K Y,C˿<::(\l,0Y4Cz!o% ]38#988VWv.!jz"*IZNzF>mϚ̿,@pχ:͜l<ԁ}-l'Xo/Ԡ Ӓ]'9gPcUO3?l3?o,uo.L̚!ؚ::CC@,D:,@"eDzmf j!p  tC߭$$,t@t@@tD _HaU?Dpǂ"C< O I"~ѥ˗0c#Y!-"B,y@ 6)c9&4CB\?B\XK h`BLlfD޸b jR`C{+~#/Y,Lr6ib@.!)\dA!@ `?-QNZ#င&ZS='$@T' H l,hyJ/Y7?{Yr8.#BXAL $|C]HLaCI u-(8r\@[ @vmPÂV̄Wx@/DaPĴ #p{BAv  H!+ A 8<!9ACafhKܠE A}s@.p@a`׎^*ꨤq@J" $0xpA $& hZjw0[ⷁ G,0BLqɆ`u`7NaTdp ( ! pwsdV`F ap^le!GZWY0 #t0 p,@`DGēG Ќ4!S,#r8M3t!$`'L @Kp!D]@L$Wu(>@0L뮝ml0& @# 6םbSڜ8c#`A$Dk{"f21Dļ |#s(8G.b՟(#6^(=Ox8sn(g%:p&8 E0byw.'Tv PEBHD! #te[TsZh}xFwXԝw_ WF}'[}}d?w"1<,4 : )& ;!ɭypg׶Aqv(@O}B{_ #܂@k{q{ח> zO٣'=MG8pܫu\ 0 Fo CoVQ  oaH`sXt@oo0pp w t/@ yr}A0o[PPs qqϧz@qQX S GUorg0 Eq70q`De@0l>r@vr 8$0sO~Gg Q s 6G amx ,Wsr-1 h  G3 lrPs7ЉRGk(VwҦj8x-q8 Ȃ$W *W 8 tEqB~C <|0 ∎ N玃rh h̶(uQ@HjGvP?0R :iy(X'09Q ^t|u%nWdgv]8ЊVP$)v&3v[8p) k<pz@v'wq|rscpF ipo#xs#wY#wYЙwP>pb9 ŚxٛRYipyʹ=xЙsY16֙ lιb0)  lPN Q0 sTpT L` P0\  b ZY♠e$ @2@:JːF%[WFZ"$ @0R0 * :r%s&Is`Ѵl" E9ФxP "SJs@ `3aP&MJmB0J2 XY@`zPo#EJ3r02!K KP:BM:6j 5ڨP"ZWPSO\ b~ =@ Pp`/  P |%EZT٠ "0@b@,@p'?p"zJ3 ) @D. P` =Fࡾ+PD@H  e3Pea$ PH0YPgP#@ЙI co0a]P\ e/pp}L09Z OK\BSgPI= :fzpP\08 Ka gf 8NAc 1$J 2P&"`h8# pO t \POP |ʸ`bjЏ\[Dz{-c5[Y$]5&*mk(.ҏ0=)4}i8lj@0 B=D]F}HJLNPR=T]V}XZ\^`b=N=\!jlnpr=t]v}xz|~׀؂=؄] ؆}؈";PKsf--PK&AOEBPS/img/asoag032.gifilGIF89ayyy<<<@@@???999ӗ---rrriiiZZZKKKߦ///OOO___ooo000```ֺ*** PPPUUUȝGGGdddppp軻>>>vvv:::|||!,N6 Mׅؗq獉A&*\Ȱᾁ-ġŋ3jDCI$!>N4ɲ˗PSY͛8sB9Ο@ SϡH*EZ4ѥPJ-өXj Xխ`ÊEױhӪVՈήK~mBݿOj-F$@@M>p׃|IϠ?Vd o#@4CP w 2߀G'2BkC89N5ikG+^'M‡6"2ҩwX9ӣ3ӛ^(P]Mӑ~}_ux6T`!o  RA bk)bba0І(8C#86M@id8B"b/ e$8fyX+z-dXhڒ!Ձ 70fxrD $7Yfyj,kRxs ڊVj"RMdN9)j#|e%jk6[n%qAtx밵:Ȓx0e+JCYm4fBb3㖫.|:fn3k/hR.+ZU0.'pV C-WPג 1-l2L#%,o5x0,4l8˼rc2YP(!>d ؏E"$#Hz(i; +e%QyMN% IҔN!0 -*0Hˉ򒸴.qJr(4W%s2OMlB4Ij^ x9(g($<`NUӝN`Μs--lԗ gІ3<'Aԙnd e?*L"vBDQlAYPF%5B!,1%R|sV$iKN8@<i8PԚR.O-^D5X #L < `&T`LxGrQcPqYUh0h``Z4AK}9/RU-KZp|A ,teB[kJؽvuv;jB;:aWs.n%[$qz$.ovh5&6MkUhUAڶ t+a ̗+ [Yf6~rdu.10 <>(M;TbD O A}/"6r,+sUڍ@-v TbYSf (< x <LTӘDJh7 +42,%N@˄  - Y-}l@Ҹ N\23Cx~F?aP4N"/3pJvUZpDp3:#)MjJIM0vfzr¯c XUh O`|#(H}d[l:lo;A1!~c-#A'i t(}3j|Hk fNĴW5Jڐ· oxa> Sۈbt#H?X'|1Ȓp$l㌺_5@B9DWِ7IYDFP邻 PVyXI ST^`%6ٔhjlٖln9tY> uٗ~Iw vyk9H7p4MYvc\əə5I6u7y7y\К,pșʹ̹FEМ9ԙ:Sڹ)2I "4)FM0A繞9$ yQ7PE:Z,P ڠJ96Zz<&^ ":$ZaԆǓ,ڢ./:4Z,*jWX(G£WR(EbFB5?¤@9">GCG?h8b1B^&byd!%0ShʥE>fzXMpz&ivk* 2`\M`y$}s ZUYѦ\-Prt #9`Pswp4(9Bf}c& a:QZ?,#YM"52bQQ4JMY #Ԛd*F4/(2V\}F05!j^jU8 zƪIXz3. 5kQfjJDi*z´e<,{W.;8II;{U=Q$}1I+TK :M8* WSY0kvŪqy1V۰c|mFJrtMŬM Q%uK׵(M}IzvMn( ŹCQ쨯{K9OBXX{ +N%p<jWP 6ZvQt8f'fM Faτ6sT;8 ju6XM`8Kr\$6~NѫZ7U3u_*]eg3E;G;J:~;8{eeVd|']F^6j5@i›4%a.̿с>~X)lT UMPjM`*Fb 링~k$YULl\58Wl+FlKjAČdX]F[5jWmPi6[6TViz5~G%}ĬZ:IqT<5}$-ӷJ7^iUVʋhpZ_Qc I}M`}P҃" xMOfzJ7UM5b5vZF0`Ve0ҵ (]WJ JEm|?K8u=8eXŪmZV&zfp,Vkمi  jਧ&8y['9>{Â3[ّEX7eT>]sj3W=8X^iWMl 0jmYCH3萶Yl8V&bi Xֆ%N_xւ-VahOV3XMХT=end/\8AaŃ`*meCa~V]iJ-z|eV{zKX0a-f_tUff·õWۃEKqBۇ}]2}iTeʪ*\x(Sx @(F Eeך݈ Pmk݄ӈ ` ]}ʌ?e^S\ 8ZZ$jL MM1/KK(4NM"MÃȰ%L LLLL Ԃ ML v1A`& 0Pv1A`hd([mJU-cʜIf\ɳCE8ha3ي,l& "'`B vm 0!+, Ȥɶ_ 0a[ , Rm30{h"``5QrɐEQcCM:NS>`үj8}<(0Cd`Gv8Nˀ7ʟKͺ 7IIB  !]j3'"sj&( kX&M$`NLG\!D7LP]=DĉȄMBRmE;nOhˬ-"QV9%k ֻ(lM8e}M_Z+/%.Xw|VM#(qp@\dp4 {1l` ;@ (X (XlP5/ b (8SOXh^Mo@=@@L+ $`.M?W΍rִ @e$0X.pu@2p휐C $hB>׹$n c5#[LM@j #"86 h.` w+̤ZBP4%`!Ehᐓey@jKՄM(wS % F54b|(" 1pDG,"#qL.d>  Kq"MnK!M%:L-';Ov&bL߲5R؊'^Be7b ҪW&EDu[vJY)la |"!IxZPw\>`yʳ+@`\ҟͪJ_0_AN"/!"B:޸r!M)i|聝j8ֵt=n|v0`f RBCDMda.F\?~lDm .x.S WEOlC-P&Hd>~`%`ETt?I꺇[_nde෿ ,wZ7N O҄-Hnomo8-!#n h$Iҡ_L`уи>"FbmUh `w8tdDh @A䛵)@J#`x  u B0Cvp{C*7>Fc-6e8(?z*/XF"?j*sC@^%YϰaȈ/RQ_bgsk; Py"P`;y&Jo*,j ͐fhV(@-@vvhz-}-5 0VXZv;3ѠIt.?᜴pI6vǪ2q0 +ګ *v.F oP8a*: 3!5-,Gr4Q355Щ6JJ V0oo*`hBWЖ@zÖ/ DԲCpvh4Uq7̄+ܧq v+8J @&8 0Vb f$/]yZ: $ _ vzyʲڨ u׍Bv˷W'ps4 i"W8T?}+EB~YTu@jK80g$?c-h1Ka:ax TK03A(SH`/ ;C`3OLuyB P`h j.˜<xP%5"- sK@<QC!f$FM+>#7c ]T([aqH%!F#v 8<~s.@Z #`IHˆdI pHfNsl17i :Us0` 0xw0Q݄baUJ5Q9 ۀL * cBpGM. =U湦a&},/:%$SanؖČ]˾k>fҬ o"<^k\UD^%i+Cflnn3ҎaƳg дOK%Q; +>4S7*N78g  3KNs "?$_&(':'8R0+668:<;>B?D_FHJL PK PVX? 3I5`G@d_fhgnp@ Pvx_H|~?_$\%P_V?__PP ?/1@şʿBO_ )pտݑ?-)Zݏ@. NLK MM :ǽ)͊ΰ֬M'LȰl JH"3jܴǏ CIɐ'8ɲː+6ʬW͛8sLdΟ@OH*]ʴӧPJHѫxRʵׯ`ÊvȪ])pǵKݻaKdƀ LÁM@̸3Kǘ3k؄ŜCher|'~zT_k(SZ6{M}})8TJqÕ?oN9uM֯˞.;qڗK);]{'<15?|WW~ !LEn Ƨ`s.Qp=i B_!h'+P"gf'4h8|5@Ic hXגx}bPeyDiTpKN5Adihlpi~"@xlML j衈&袌6(Vj饘f馜v~ICi ĩꪬ꫰*묧0*'@뮼뫶^kFD iOVk v-ڒv,nlC= +o.ۄ[lڍ￳ B[P [eC 6a*W!L |oL8[!%Ot]y'Fsgs~z>+;. gJ Q ?S7c+o_h;x wٸ>=N;⹫8 1߾ G2%;!=N.p d 2 HZ<\N`&b  G!.$e`{Cɐk_ {?zBp8!p.@!F $E@B5r؄[] W< Bh9bC@.|UWۍ0}D(: bH@EH/PcfDM>}MEE'`D A*WD"(ܴ^HrQ͔U hIi/J% 8 *T<4LW<0\1xZ4XO8Ϣh6zgϚfm dy>Ҟ>w+ XWqg\~@1.Y0 xVZ'G YQcyiwVUa"IK-kل Ӯ7uB*ೀ.9!{`hAⓨ@׵Í*+ p رj*S=Le@L`ņ9ndjמ =ս Jj0`RfvCVj}T` @VUe8L_=Dӛ*  [guTJ@f7t% *^ ^b-W6˱CmV0Ĥ3t0b6,ђvH@9b@h+|A %E';&xLpqLţW ].RLxMhQصChR,P s ]w@ f 1U B#f2=,Yk HNF A>@F\ceY\ pq $̬hOUZrz hޥ"J`B|[6H@Ȁ&%]j4ڄ/[Y,M-+g\ +hh ]` WW9Ath&n@-`T%.ŋF՛Hm58 l%VKYU[%`Zhlr$r'+mv5俵1E<s+mgUwPjGުj opo-  &ք^LCm l4j- %MWMj_L{m` 9h1r$Ԧ6T54ȝ9p wnWdY`?W_e[Wj 'cs:,Qd|j7L|m{;zVmE>`pB^':R5*jvݙ`a7ޢ2Cv!Sy>=g%/ a8bK`9P7d6L[bBzj'5kwmp&s9wr(um1W@7nJV[p3_%y}[os d$x1;oKw"0Fc0`0v*VfG"~UaDt7(w|WsB;qlXkUc#qM@S.Kf M:paO}b;;jc^dpbi$*u= p~v$as4nUW)ww;se^lI[M/C\@L{cdrL cp8Z:rz򇂷t@e~Xr6xXKQQ3(ZU,0ЌjV#i@S*N$@U=#yD?'@#y) 1<#SS3Q`\.\^yKPz* \qdrdQ8?YVĵ|lxSfUZ1F;n[e]8{d鋍slC&^)dQLfBYUd&pbPs"[P8s؁G&X>Qqfn3'g&lFy< =H2@ _tE=҃Fp@Jƛ / E0p=SU,mrV0(w\[d{|zU}ulG;H]m);#LfxdB <&nH2l8ocBrww[7MO Ht2U\wrܵU֗m8֍ dFlbNls/򹠆[yPP-畿Q6Z C%%D@ 7)XY4E0.53LD$>YvaUɷjGuyB&ol'5"7l"wVcl2@Js~^zpM[c: lmr P#` 0`rRD?iRd F6~r>pjېmHPÞRwTc";LfPhW'G[7((rZnMxoKnCPJ$ uj=7E@IDCK,*HĨ୪ M8ӹ%y 3]#ޢ4&ҰR(a/AJqM rQo{s< TWO#pS* &Y4Et굜ԭj % pdvcMY;:z03/c҈o3s/3r?2(׹+ۦ&g I+ y;4V D=?txB $=#DF@ ದ-RaJbwBv* 'l+P>fBwo|i;n/_Z\NZg{Yw3;kM3䆍;+oW8HIe/]T`BunY-{ j  =4-POýDj/BpKlMh+P> /ƍW0~cw/3Q]T28w'g*(dqSp3} Ɉ´k&7r;Էlu#7|,l DI DD7 ; 0El9qr/:'VM<f0X dчg\R82%xd)[PBqGܩE}J+ȥ 9n*P,5Vc -Yt@ m8U\<2v U 7M0Gt|-,GZ1ǎ}gg9'%$VG!VL+QUx9o#ʙɢ|-W |JHA`˳[6 Ch;vr\[,~dzUzHU:WLd"zp6u/ tHKͱ"[/U_5/Ϋ6m VW`Ԛ@԰K>cSҨZM;t;z 9 ]f|1suXXwĔ[y\&ur̦0,kуldh>]1w"+m]̾,̌dU%c V?AM_lA:˒rJ,RFD:F}7ڵhƝ6`ƆC{Q\,5y| 9n x.dɶuD%7$f2(Uw䨆&Eu)c*;8>[{-ؖ,Ę,ӱuw'| QU@ !`)kDeWQ$=Fy`d+5ڮdDNi ל,¬oٓK|Tݔ Q]PNQQQ[UQ*ߙJ+ˢsm ~Bկ6kdiş g4 0@rB@ln H$O.I  CeŸU8̴pae6tȥ\dx$߀Qg1cԱD! ..;ڱn S1.]cAVsd U&ݸ*F;<=P+Ȃ锚Ֆ_U5 X!\ϙg @gE?NE|$XjIMB]e9&Jlj(_^æU\|ܯ2nM~^R "cn)Գ_40I(`2 >rs -)ވbRb&F{sU}&VB+T%o&D D4S dA9I&Ou?AIA6 iKmYk3;9JZ6ͪ|Hxl<ւH2t{J Lj3$t  J]' !3[}~2l'[icUnMĻߴm)M/Mo _u۾ԜTM+55YL L   LLM MM;0K(4NKLMϤí䌩 M%, ThنT*z[Rb-Q"J'k&j(bx C~ҭk7KZaq"K's0Ʉp4$HEa\"jJ2ŗXTF+KYcl*!0׷DH1-)ՏcÈiIب,K6@` b ǵSw|Qꩅ'6uN+gvR|N= t>8v`O:M=dqc\qY43k Dӫ_ϾQpYϿ(ha$3F(*\wzt ($h(zX0(4h8c6@)DiH&d*ܥ,-)TVY ң\v;d|iU"[hL)g0B(8 K 7'*蠄j衈&袌6Jrß$襌 v( ),2 `F4ꪬ꫰*무pZ" +k&{lDBF+Vkf-h+.Z.X5ԫ/rs<lӖ{̹Kn6\˰1f,ؤ$ 1%.ų\n4, l-DmH'L74PGM*Hm5)8\w`-du^ܴ`l6W-tgLU׭|߀>y n'MxG.W>gwyb.褗nTꬷ:.n6߮y/ |'G/xOoK|w/o~觯K~o߯ 1+ @) ( Zy7 rFH(4 @—-0 gHC.8N wˡ!F X%2N|'*F"x-Ҭ^< 811fcMp@l'EF:$#9T`̤&)J >Ё6ި)oӷt)6$R0n6CKxh] e/L=~6? :k3ۜ/0WgwVn`.kF$  .Ä4!@ڌ8]kl,``D E9ygXX3QbXń@T< -/ (( `@傩%̾L`$Qp̛ y!B, 0D-y ,Vw>ü;=Fm,\Zp@E{F.3oR'Meԥ1$`s hL sY`@&?nL.ߗx~M`?u7!}{ qP ɒ-8|M/ 5$gwuʀvcM 7vw7'$Gr&rw~xg8 *wҰWsXY~w'  '=!LKHrRxxrrWA2xj45(fQTL &-RWPH8R&W|f؁Yh `L0(GWfWa Gfِz-a }yˀ|n' P2(Ĩ}X wFRnjRBq_w'8(GebO @0" {>FsOsLBkdPfQTnOGq~&}0qRgKő#o$W{w={XCQ䌂瀡{XcX8pڦTYT U`R  U!WlUN`R @p7+6n[o ~ 3X@pdk'gE0v`]i$ggƆl n/7y k`ei,CȕQG VUZYv_hw8tCW(J7A' #wV8 NI%Ge=YĜe֛359mYY?rQiW@yrjz)t!RUiPqy kqALڀPPz x?\ƟQ8hj?*@:ZP.r 0{>N)&!Z𙗕y Z? U3:)oOUĊ[9XVٝ)EG&Q WfOFYtNSyQyYkT٢XZOPXVf\ @0GUfWmk 'j>sYpx!z9 {E@צ6>ʝ[:DZoy^j|ʩyQPXwgZzɪѥ k#[5IRJ<j *s>V!tz k#0`J'UHƫ׊Z10`(M8RJ$ Mk\. :Jq5Ԯ k K.ԑ%s s!;${J7(?*#۲J:0#KB;D[!k:tJ_%{JD"H;+,X[,10Y۵r';@+HRf8e33$3Ѣx{-4 !BcԷ MK- BcԸ ;Z0kmQeU$ZJ\]i}Q>-RVuTԦ[#3V ] !}6,}PMXws֚ u4 ̎jK5fOQO]&\$jEYVRO]  i!i:ZOUOupR{ٹ<Ϯ1ᐈ P; {1ז!\w8!ЈkiP" M&H`S* m0`R"a}R2Z\POvvݰԬ#Bza^k%Sj;Ѿ{=p6Z mФ͙Ps]y_  m @9Rm:Z'WMѽ4vY-MDPMsevvz !uw{&v>V=fW cZLeUrZ6POQQ-_TC1^l{:ܴكuoOMDN!hXp!R^]%k@^$^{USάߥ:D؄! nxrQ/ ? ňnXwMM߁!nP ŦzOm6 -{kGW?PM]Y<Q]aV(TOfm6N"$M"#NNNM KN$N MMMLНKM LLL  L4P &@^…,@_ ׼y GJE6 'M>e@&hM*qI +1DIJry!h*:`MJ IX)[H",^ͪ]˶mgUco 5+4ܒ3W \!qx&D`r:6ƀA 8T(_l5M3ɵС >8!{7zN(h'w.Ѥwo!N'hzFmQ݋6 /5 \[c-~}&;kY?TPM`$YA EPiU,@֕v̆ tu"8 $@ &$Ao5]\" )'H!t/yp]vawPJ[,p ^3#zpPct[Ɍ{知b44Z(x3A,F&(`[-2@J=@6͊I#@Sh" j L]|%eSXA pKxϲA,NbM5dN4KYJQ)_s vQ:xp.0c@$hԞ '}nAѰ~ ^jLpjZ0<)0s/vylȥ%ILop t)?t&\ 1a70+"I4 +JIAUBZ#s{* B%-\ud U$y>KO872|&j-0Vq:'dǬşfh9HͨJvOz"|po;r4q$n|pS$ Ѿ}1"$ￕD90Bme+RBQ:xln8.׊ 1Ccc„`R+L-)['H]fSj)E%cJn2^ %Rф^eۖ٦VXb|HHJ (g9ЀL4PfryY"h.h̆h 64:5E%<@<-DQB 9KPMj(1!FE!͆,Fn L0NT"q%=fh U6 \a530&U*.P@GXqy hB΁'I HVBYR9$[%")cU͒d%FQayBIQEIXUnDI"`%.78]fcBHh1 /]\#JdLN/ ٩6`@X XMD%AiTvjNƚfb r%$$ -JJAXŇ oz*;/+wšnh!gēiM,a1'(i{>P5Ρ$&BL*O2tF9JڃyrS@Tg&P Ds4* @֪ @ 2FWb@$&IatW7E Q2i4>Ղu4$6>=j()@8*u2n .7@[¬\ȓ$G=_H(iSbmV*)V-:naN\  J%"BfTUq޳@Tqsݢ '.̹ w$y #6d'3iVΨ0m-[.Ѧѥ@h-ʲ%~; R$Ө@2:Т#{l\.IԅƗғ!RVae鞙vHlw,7G rb<{-W|@'lh`2I€>:6Et_Jϟoә^ NKc68Q+ .cX+CrY )[7؞@|`8/IuqGTXl@H]Kb@SKfPVm|LyoY.H@1,dc:{,o%ӛݲcb|-񚰼U˺HA"I/1WKėipxwelX*{:CГ$ +CTL+\Y(̗`#X6* Q)64RE o:L`bIIGn#`[ ݴm] Ӳx?@ nymBFAiq[Łv\ tT:@tu|3_wh<W7AS6w .c*/nְL h Z40-PepDHFwd?a-`4@/)pQc<-1 C`XWopP .c_UtCX?\\0iF*\q*9@hB7Dm}bH /|akw Y1? GV'7&Q896(aOV1$e ;$PnB̀%?!CHBߣW!6 wvfxhx7(iԠbns7\(xn'R|0F:S(xxBCx 'VXtU e%4&64O:b.g.?!0Yr7tVH&`q6i SHn z!P9RR)")x&95H3EG?5AWTumU| Sp' CNpwgqdWP# 85qN}7D9">2H/.RA7iWi @i ?,`iPn6 n)QrG'g`t  zT3uV i )k)Wp Qu .i~X<O ̙Vr8PV f @ EkFpCiWAI B dDM }a@s{9(@(TN+csDu 40-.>$*B0zu픋0Q^q#],X.COec-X,*ÛpPH8@.O#F鹞NzE2ٚ𚉖dfRR[\!3y`"Bi[jlɊJ5pDQ caqp QC=ZK(zq ID I& }0k¤K6s ):s@F0C`ۖd5WGҤ*Î0:VvA#Z]!h7Pe؁*7Kjbk"fb;PVZ+)A?_ iIv)UcܖF+yȦ|Lj%H@evv/*&/  a @M9ryG=H =XԔ83i$o! t)ZǵF:w 6"~8a k b{lp P -ڱ "Il@~-+˲8Ј@5!e(z1ei\`yq^ؕ::)rQ=Ư鯢fKwBI*$ W[5"PqWp~Rس%U/ު hHG; kjl4!{'H7%>:{tSrx+. \J-B2v!1+ni+"Cr:[\2EG:J 7Z$z0.Ik؁>X 5J_˻CS/]H7E}TC=~xǛC]<>A8 <.Pˆe^ڻy!H,fyM?mRzѮUT}!3NK4pq7*s[tW EpzNVD6\&/T rf)Uq\QP.A'5;$ȉI eD!I+ěJċgiCL)@|ŶZʏk:RbMk DXw+l_ǹW=$=2zɠGDv){~ͽ]څOp똘|gz.'iti!9|;ZiJk͸D[nBi%jǤNl~=r4xYf;C!Q(e[dtD릸x )<ƆHmS/ ]#xπlpR -+'f_7EYOg1H,C1>9T2[4=U+r8 \/9_ؐ$`N0zEص+̧ ģlh݆Y} [MZMTdz02MרmӅ:] g L `f}@H{'#[!۬`ܚ` ܴbϺ)4,rM{!/iЈbj?*ܽۍZ Rޱ~axf -Lצ-MhH}lUZ4^~NW "v}fy(*,.n94^6~)l8>1K+0F~Hl6NP<,Vn> 5p\*0=]>"=䤕  pr>t^v~xn`PlE>^.J >m LP难~ >꤮h~g^ꪾ~[>>~"w~.^nnՎ(;PK nlilPK&AOEBPS/img/getstrtd13.gifGIF89a..c煃)\A]~ú%Mvg``aRu334pqqr焙۷8hQQRW}=;?㛶ݍDDEޅȦIܑ˹▯Jgէڱݙ̫'+ϨΡ衭šGoпS<} 7j+[曞iJھ^(2!,.ɺ HP@>z"F@" s# #ʨ> )yp@/0 Qj! YQi <0#gMY$JJը*"UKO&`,%)y*bI|GT%ˊo^ *MaܕUק9V&>W_Ċv=$N=9DjN!ޠiT;3UX!ʊesIF 1snz=េ=Y寗%)&ÏM)nRo(vMlxP~$VhgIua?L!4*q$Y8eezDJCE 2`rҔTD?0Ē/=(Z?'q.-+E!T2 }' BU zTbPin0_B񠀽PFhj.8k .UNhٰICa}~x@N+Ы-hp !I D`"D,]  #(A epЂM&[`@[HD`D:%'0 p!bf;@׽D}X@a (GIRL(9 e:,ixR I H0%.\E f75x5X$"%?"0X6h &A88a =4*B0tnXE slHXHUqSBp 3?SI4z0!awpBTЀD |b0(Se@ 3` A>+Dj2HS5` A;"p@T!hȗ$ us%, ID`4HֺlgKڶ6x @>aY= "JaT&a3ħ9<p!! ɝB( !A~`)h5(P CbT.; Cj"\a'C:@ta=~PPE(B`p`(j3q9F*a>CN}0%k-t rxH8p$XNp/L@8U?A k 3-)` X ` p`M0pdF ._D |Η3nCp@9 ͵wU_`RXF zhn3wP5er| CtTH8x@?`6ޠ#hxpf # v?TKd̀(@ θ5 L ُ}(dtQ0}L|!#W07r11(1 zbE};P+tB`# s~P*c#sG#4p5$ ;-'#c&~>SDp e%(fS}yA:Tu+5Xa:Phs:B`pC|%09Gh1`W6efW{}gw-rrO8 8V6MVH9 @UB5-ukՕ`bd9fYh7}04D; ;<I<0m@qD<<~Z<;Pi|`*@I|`vIH $@D;pX7=ZP*C`|@8*`oL(bPBE.U!c 3 $66XStbaS.O@zpd r*ciR'Ol:U&X)*UB:'" 'eH"U/@y' $`V*.w/,!*zhex xJ;Jriz5@Z\(`"B]Zfj5i _lZ* dN AL@6u(LF5icJ6ީpAIVr"sq qC'U&AHǁ$1N/ϡ.17Tj"L CQ?"I]AP=zJ3; KY2$=(>,@K#Q8'PM ;KZ}v4M0vP.x['`8[3o$S$$@K>$H5& s!|0$c#w?"Ȕc<#w&}z=Bb;s>/  W[ eV6J>1?[76@@H=5LJZ0*K##:gc#+0{۹DipKv-D9?ad dY.(sU"QӲ1tL!1Q$ ?KA|pT~Q=Uk'8a ԡ;90NЊ}!#'tq $V/={z! 26={{aui<[Z[ =1t`(=r M[?Gד& 3+<~@3>T(#Oaa,Q("Ѵ<\I˫f1F!'P$r{,;ѱ33|e`’칠۹iLF㈝7 `A)&(_AQsu 0(j+S\ڣKyQ'x> KA&DU*-L q^{:U,[2+۴3 @!XT:Z|\ubdlZT{ɕɦɘ,ɢ;žKJn`fc}91>fУNWf8Ӕ=7>%0fv|>fPi]v7mۺ*  "V,VAi\zWwp$!,0ݕ;{"} `ѧ)qmm(XD7Xџ)q@JD%P٦9.)ZTJsp N۶ͪ *M[@ؘ{`^%Uu|%1p8UP0B U;=Α\7#0X#X庩p+)fp~0ffSn)>m$PdӳqM.>Mp`T~fanvZu]!.?7'0ep7~PW@ @T`*@0KBR~D`m`@6lF L}9n)M~n0n)}]nǎ:߁qnp-ٶpl^LzG~^"RXPU~)p-]'O@;PZ,ݖJ p>m.(_.m}M%+>ޛ=" ޺LO #j`P0g&i BS۟;&DApM ]h|o0mс)p+p ;7ɎCE_{oJPh;aPOYesCF?Z6z;"LKy -o]dnP;g /X1}@--B*HO+K',1S1;8Bl@A;d@S<1S]-eO},ff)v Xfs fJ vJfqO? 1S!>;u nXB:X$裧˗0cʜI͛8sɳϟ@ JѣH @ȶlPF 1҅C -N$Lq̒o4Rz*μ9=+_μУKNسkνËOkBGH3? }=*!]4!=8d@}$b *&x聅28%fp$ZP#^$~(# P1(8>&L6PF)TViXf\v`)`>؂jz虲ށtrf) J96H8C㈙ fcD IBL"8!A9Rd%I<2MHJ*WV򕰌, ΈY̥.w^q%ćgQBS4BDtb6-EKr1̦6n8&| 8jw`ԥ9pB"D9Y IRL<t A}'B[ͨF7neX xD1,1fEyњ8(V@j,  ;0&!N?\@5f&: .hVծz` X VBͩZֶ^BG@B0L@Dp `@(?fIP@&KZͬf7{jD43zRJ}qZKB2!NOG\o3;m!6Dݖga=60>D&5KN7uˈC5 :uۈ-6z0$ ~>跧FS / _}XP<mH~I0$ 1ȯ.c@<$6l"86 2AOKIĆ4 {hx GK5&MPV D6.bv!,3ةgP4 I)@`&U5k`-x MC $5{>i ]@ " X1+4LZrPm ( 0pL |E6K_0XH5=@-R@13 vj(SBs(,!@P~(C+ <`&`%zt Q$qnl{ _ yO` XѠEkM]%}dDük9P83:/8ɡ C]"S^7L (&9N$$4' He< H1‰,0R.çaMAOHG$&=2Qkv 5K I>-8+<oA: L!3,"@b*lXH^/E }0J~`?ϳ!=% \~+ 0{U.}gXRZ =P#:9l"2e"2^= =x)-2Hv3zp##0Qk@20EPz<'{6Taf2seLsJe!Ђly5Oe',ZQ*] F=pEy\+t@! |8TA@0}2`aMVP^hy! 7`Zr  L"ERR fe".%q, 5Va|e6xpx) sтB72҂2'la[G "-JNxu'JF 07{b ׈$u^EpAҘON G 'Wz'Ap_T(V&T]ovHy0| ` 1 Vpgag$~@ Z86OaB~Zc`XY90X%p9P=e/4//`\3 6(0ha?@!"0M60z0`QЈ&Z2ppYQPd^EPpCPI` K$06z&E);)"|zT?|ЈpC*0E` T(PI_Lpp`A60@,L fM'qSC0TT$<x< WPE"aa `C0i-XE@zCi\*p;`D 06I6`D*Z??` E^Ba0RXEoQTiDM+K-_EfY`b,'2@Y<E rECLCRg>9^0*IB]pR,?*;$F6CQ"P#0PCpCWI@P>@R`KCAE|fN qu%p)A':-H0* MuH$I *W(2O_ Hj@0Y бB|Fr0~WW~$/#=jI@}.P` 0qI@;:ȲGV),202#T&0pl׶2!'L6$\#p'0`P#0i' #=0~?0|VTa(PMP* (\w;<#`'`8`2 Cz(  @z@02`g#K :a2 '(tx`{aKp!a!2a0RL`|D0##i=(T00aP c16_:[FE  Kk\#K0T3WGA< ūN R0;0IhR`0 n l}@!@5`[ K\ R2*0!@;!7Ph2oK|klV3y#@;8_`0L' ?0[(!Q5Q cL[00)>pt0)ўk `Vre 7_NTz1 z"k4HG`F`(02P#gGS|ಢ~6kC%@P0&04K4`z9u 4@X4} v0) QS 9c[;@;@:&ƒ,]gPfC7`a:<+6M%lHY!H~2oa<6@)ƃf"gcD!ދjf + 8> I"gbu=q.ò+] !SCZ z808K 5 e[7,Ȉof5ق{Ff+r3@@z\=/{! \S0 UB@aPz@8=|!J-B bNą`b3P(!mDRh{ *P!2`10?#lv{!1Z7zKSxLuDpK@8eV8of@ZRi|@Z 2#VJyyH]yOV-}zdze 20X0z}{g-kB%'s8WYpQ  m94=6p `  } 0=G~Ohmu5W `+f*Iw \zn8I` bFd(x=@g[̃Dp]mD]!D\Gj+.hIުaIA!f1*8xk1`ypʘ3ߞ#0G<N`X@ FעM@ qF$PC$\}K}om#@+ 1@g#Nm!/]>'# :H?/#{ 2<@;?ɞh| F*$)k;(uLOz+ע`!p~ig;Q0(_Wjmm@8' | Qm0m;̟]'  _m*D* < ||< z |}}} ~~}$%  +&./9 {& %%4| z=2R2]#(zQ2Z26>a3]2TC |2Eؐ&R@0>!FԐ%!##BF?m€؆ &$P@vXI&2dPm@&D6񃋌$%As. GK.ԺQ[cDa`H"(>5 n|88!I=D0@OpVB.$M Ol[(`? !Cq5 фPT-vGh3%B ?RR?HC\ |PC $E5xE VVzP!" zC2p R(=C A @tN\TFp\\\o0jAvL<]A z$Ec? PDm' p{DJQQ@@$A>AP EqSEe1[D'LjmMMASă \p @F(=B]@`BzP R¾P a| 8 $!3`)TT0!

+lqTY./aɬ^ Џ`ħ@ 0`_q 0_@ " DNs zF =]@6qG`Pq}Y@21OH-=oD0 67 &-oI  *XoZگ,2^mg:j9 *iQ"iK0<8 E*PY_pPa9PP*Wajb[oĥ[]y_&\aĉ/f@0 r^=!SGR:81P1 aGbwRŊC5}<GLB2ǐ]Ll*B0dfNL ''"i4/O}p =Ƽ&}0@JHZdg >B3@TpAtA#T1"'92@d *2T+8q<2 )T6 ." O@tPB 5P 2,3L,DђL-`q@cGb 56k701 p n@nYdI( &*9D`o(F CUFQVث㔪HJN bG ;>Uw]vu]xߥ. rcY4Li@5!;Nz[U# V"f5#,Ki^i^;( @Xekv@%ES\[#HȨdV"J!xjyCGc8 Ky(D @.HS;G-c#R} XDV)(WpҤd[6 >yE+PReSX?uH 'QH*yE6a#Lꭋ7xWޯѼ'=QÂOZ~ۇm{GN(GHǍ`PqleȧLD(ZEU QHN;+Fq`;"P  ,H@+da ]BP3a mxCP;a}C Q6K{%':0Fd<JRLn3:B\D)Q n>_RHkܒTBwNx(*$$IXײ(*ȊSI+K+Q .p B '&`e+]JXRe-myK\Re/}K`S$&.#a׆ljܐ9F4t7.$Č(00)H! A1'd:HC/D'&|R@tI9!y 0:pt$e IRaEsgO @)SS#%iIMzRT+eiK]RT3iMkzLT%pY8m ?9LAC7g11d4z4 F@Ų0|AEBPLt/9P>с /QCLM^%+ %-I^k":Pe* `SfVlg=YІi\vjh?:'LA MB@P+Q*U08MhiuZ:`\Lƒ=ӍRP!ALz@]%A DJӽ{ FfE-ak Q$t]% B?8,@o%p |`'X%-^N6sQe`}pS݂X'a+)0 D W1b1Ȫ C;IRhDÁmdIXd|;>5E(.ހ|f4YkfK|%J&Hs[ 1S떷{k 7Br`@HHy+șl}NN+H0*JRhbț"\ IZ"5|{Kd e SZ2cmfvlhgvsX\b"I-`>|FGJrS54%wb&د8o-xIg?r( jԤy|$LY'V⸾(pMI, ![T5\*[J)W[ Yvcs&:}~h]C'jt &\*$flK&cשZ. 4`t\0G5)FYHU3O-'MBpe;HEpŰK0G7PKy.3gIN\g}]^ǥ {<I}ܧz(J};Bd,rA^KGIt_ -5]%HZ"$\L&!5ؼ C@9$c@39 D@҃@@@l9˹ܹ=\AD0)El$A** >+>s:"\2qr7w3 `ȘtbJ4y4؃;E89E58Y82Ë23 ?[<ГaMt <l@AA@B@C=CE,D 39DDDALKlAODPԬ4f3L( 0 {+7B$,C!,1`t+>(B*HXCW ۊq5۵7599\IC`)3p@GlAzt9Ջ {D L@{G~ E,HlQ [B LҨU $!.=J2I;#0 iŠ` x>Jӟ&.䴚ۑ3CnTɸE8ʣ"G CXE@Ƿ56<=F\@ |Yz7y; ?.,j2mԓ۹-/1Jp<ʥ5לC1Klyq F0!C@@N$ {DδMBTK`KQњKXHL  X4.$* 8 ;*lxCF}1hi%O(DRasPmJ|Js(P԰P xN \|@5$lQǘǵdNTLuKU 5żHP # 3#E *S5U! #R*UdU,(RO̓)?-@PE=3ߓqYrP 52Q15?I6LWyeM N˻}W3#D&%#8ӌh,`0,U8,(/B'5p'Ac;x$ Pse C9]?X(ٝ==Y3<ٻ>6%0vu׭yZ=%{N@B@4EVj ڀŅzՈ}p H,5@0='*K 0 65ڝ]q; ڠڪ,Z-W TZ}5WN .]i퀴iE@0,Vذ-u[u[xɌрW0e.0z'(#\$26DLk6Ł_ ]5ZМS]%.P]ݫY%҂]~ ڍ >3hZDX,`i-^R Ȁ78^*hu88  K;Eյj >>\Ub%J__2@P,?_ZPV`9&4^c6F3=ź`,i` Hi=^E  BR &HH `1ؾ )hdGێ=넃f"& R&q%nS@$N}sS\(!96+ 6^ff60d㼸`  ^H;? ( i=X `MnxE4荀Wq)PvV%1R봦&PQf9(( e9*L_!h3hhb %b.!X+:dNf~iiC`9ݏWȀ]?=]q( ؀ E0x~^`zLN|F|D lYgS$P!Mk >"eR%>O%pS^h!>i~lȎlĠh6`&Ѐ&mf XV ,@zn̾vdݦIg5k7 Lf$|7UL*hHݰ 0pb(9^_v QNo^o aH㛦 HAj ^|j#dDfс m΀E+jJkgGp.#p$1hhp1!"$8!%%hSu63(ѾNr%_r2l#!,p,cun8r;(ĉBU%xFp~i7ppX }s (d q '0RCwotG`ZH$v`rll&tOq򻠣:߀ [rN+h >f3^M+`p8d vGsdsjP;3= 8h1[hX  %x1=.p얁V#?rPw|xuR߷. U_=+E-^mf,@"_pbx8o&0vsBlt+yF_e"wǁq@r}z8 HNl,HwjY4k؀_vxj?X'. pMms- PL *t(Q` @Iah TT&x@c ) D`bf͚V Hِ )E(H޾~ ,x0y+A L 0A"8\9bƌ+>w8#JV@te֮_< {6ڶoέ{7޾.|8Ə#Oẉ/.m֭OΗA96h0)L@`kO8aA r7ɠYA^XaWx  0H1dMVB=E-`4SFE тW\k#P7☣;أ?CYG"K2dK1T0YUUaLؠ\pB ,&w'Z4ا 74} ^y&'i@ 0LvQ N|?0^ ' b /=Ayq>C?(B\B 2+ l{2˰^ᇷ,J0$t.M[8| < 4-?B!%?(RcZ `4f򀸵Id($x UU')/n1 h3,IB(]1\Z UWP0Z 4=A \@`Q F`(A X.nљˇOf$C>Ә_q0 _AA >yx6[syӞd9i:SO┞2i;׺ %/;]tyO^/Yh.ӣ>W#~69s'_={Ӥ-G uׯ]0yڿ}I~4 `K\[՝yz1\jr`ۥV۹_u5^ `|`Kԟ_e` "aM K$_Y] J ja&az:Z͟Eaǁ^ rTa .aN ":bd`JaE!"2" b#VN ~фDbᄌa~%'B(*#k(IL",uLhbPta}L^b.)"QbI"%ai"S9u~3;!VqYLy6Rc/zP76Mt1fbPؕVbP1VM:ԉa8Nc?/rD99b!%ybCc:2d-R$BdF?j$NU c%DWD `)=b=$:c1W;q>d6udN]ҙNGJBzB~YBdEcQ-eIVdR΢O$GRL|dʫ$dL$KB'2dhZ(uVrfsnh.~s舢(M(@hhh?(ٕhrh (rk(?h)8p2O 8.iJiN<7Fbi%fi[ rHL@s:IiiiĚLijn*:6JFZVjjfz*v꧊ꅆꨚꩪj~Vrjjjjꖮh뱂">2 BƦR뵖bRrRj릦R뺲^TN빮TST$*W"΄ҫ^iMF?_,Mb*]@^Rlbބ΄Xņfil\],ڄndɪ]lLle]κ,,ҬllLdlЎ m,JP%쫔9W ejVcOm,OXb^ȅmDt&K bWͮzڂnIM\Ummֺ-.L,Vl**U+ZY2 邙M,"T^|MHn_FbnLXھ6+j-"e[ii~ݗ;܂n.[.os&L эnM̢E6m)A%\*:(oRv/:d>Fѝ/(L2MpoN@oK#oJmJM`.k.pp7'>C".N`J`p skrL\/ʣJ [00[V6G.Ynoh-=6pc0%$cpɯo._+OgVl`/)%fc$ Uce0Mm5X2ͱmdhB2qOv,25#(1F&rI\H*,ꥬ+ol-?/F.2+,"'3/2GT/ NtvЕ3b63JlsOQ59 ]ʆp:#\%w|33͊9׈932ߞ) )d1@jJD3DsfFK@2+H IQ4KG4*4ƴL{j2޲M4N+74޴OjM uO55I#uRRP;6tJTc]uVs5#jRuXXuYYuZZu[[u\\u]]u^^u__v` `a#vb+b3vc;cCvdKdSveut@fkfsvg{gvhhviivjjvkkvllvmmvnnvo6wp pwqq#wr+r3ws;sCwtKtSwu[ucwvkvsww{wwxx7s;PKQ|siPK&AOEBPS/img/getstrtd5.gif)DGIF89arc1cΜcccΜcBBBcck119J{cBBJJ֭便ss{{{RR99ZZZ))1kktބcc{{kk11J{Bs!!ss{9kZZcBJJƽcks{޵kks99B19B9k)Zc1cBssJs{ޭkޥ)ZJ{1k!RRR{1Z1c!,r~ͬߩ H*\Ȱ`JHŋ"bȱǏ gi Iɓ(L2ց0cʜI͛8oZع f@ѣV0 VxX"?"D̚JjU}ҪvToU5ݻw &@%40bpa +eTplË?%L‡J Bm[7ڳiͻoSТxYKlyWϣE,F) ƒ " @ U( +B%@{& ,YkVeXvpXsztX/&ҢHD+E Zz-C5RA4 Le`BEhE|>sa!kUWQ!Vj`&\^Balg2*/OՁ'Yr{Z(~g) *"t gu! p@C B@bDI,fRe[%O&+N6뚶?J( }bz)nꜻ{.ҫlTB 2 8D pj+2$ʊ2Ϫ\r +*ok,psM G\}kҟo,]2o^JmtX_H~iȯ0p HH* % h A |DTjf mR,Nlˆ\2K5,{uHb/X. /"hZۋF":!0" ,D $DDZ0yK ~Ӈ9\".sWڷ 'BىGI7>:.4mE4TS  +D0֤EBj0aEݬ81y@zL@Y@z(ٴTaIL-LaŽWTq[Z5{0PvDT > #Ŵ paJ5aFb TpH;FDbT Q.>`F1V Ur⪇Ceiz[ 5ȥAt%?oٜ蔾"$#IZ򒘜d%3>pZ^D \U^-* uk+VQ#Xp?ArU\Z0uylVZlg9;ZU(fUKZ1Z}HRQE=h*+(!Co+bnH V,+̎-mj͎,zW{rwꕭ|J-1CX?dͭc#& % }8?WP1Ϛ ^9KZrNw_σl.Ǫł'!̵1\b\),R!Fmb[Y0ia&_m4as3@?8A /dhwv`xk*S^*b3hÏ.utpz hCg]NtY@Ѱ3KJ88INd\A8C _JM>RPPP#.1WTVvzKnR[eh}b wmxϻPR>`=n;!e]jm\==;Yq\ W-.ۼ%"s[ЇNHOҗ;PԧN[XϺַ{`Nv;)"عpNxo; OOn'O[ϼ7o 79OқOWq}gOϽwOO;ЏO?ڱ{OOOϿ{}ؖ Px ؀8Xx؁ "8$X&x((@s7ׂ.M,28x4x86<؃>B8@8FxQHL؄P |R5W]hBJdh^ g`je؆[,&sG'٢%pcsfxCiπnF9t--S_bU,jRV, c(xXU,VȉlX҉lv(؊ M8(H-H_ĨXLj(hh MCru,|x~臓9 X":?t HIx) IÐ@p @08"Y u( y.[3)(r  3?q$y?4 $yQ)`)jI43D5.}?7)MIIA. D4Y樒L)@8N(P'0<4P_)>ٕNhYR+7pyMr(l?Tfb{x(9)hi5CyO\IG)hw {ٗa0ٖI)ٚ}Z×HIɛٙny/稙yY)y(yY¹ԑ0:y虞깞ٞٞrɚmʩɟl I:P !Lڟj y#*j Z* I4 :<ڣ:ki3/FJK:YILJ !*Iڜa "\?% y"S-ZqQiWꛁɥj*p7 :`>zY0ji:,J`JVZsyiꠒZJ Z:5ڙUsZycړJ_J8~9) ɬJ&v#:.Zʠ隠⹭_."șjz9=ڠڡyٮi*(@Ȫɬ話۬!۞* [TSxx9TJD)yyJK)zcI Keʎ6zJɕ[Yk^dʲw*/[Zg9*^۳F[";jʱm۱ ;nw;˞>'{R2٦A`'pxJ ۱zK 8K+j+z˺ٹXf{ k{[詻ػΛQ9иj«Û[K>ШN5`Ӌ+KۺT{MZm뿭o붬k"7RYp|]|S J\^ *? &\P*+9̦R+@BCPf|hjlnk YõiH)Q뮇ɤxa KG sz*륔lkڔʲ)f:RXȞ:~ȖzC**JɨIO* }ʵ~Ǥ쫀j˷겲Jʑˮº¼aެŪʞL5ZɢfJεM8̧ëb[*,[\5LK=,r.sʰ=9܊,뚤У wJ|欴`<<l( ,`z<8FJOP]%VZ^֊b]/FfֲjօnNr]5Evz~0]g؆ނ؊xs }= Ma٠] Mټ7٣=cځSmVڔ&{3HHS=]2gW2í8Ex9t_R-B=G1,8h)tGG}C(TtHҍԽGN't=kBH-yz/ ｄmCmf|}sBڱnݔ8( ] ߢV-2L&%^33b=8½>n6hahG}L>H΍-GN?A.mHOBG૸E=M.HNO.+=\OhRYۣ(|x#H>=u9~Y$0ؐG ^n } Zen1P~Ϣ&~븞뺾>^~Ȟʾ>^~؞ijB^Nh^Fp)>: _ =ߣ@Z 0<ʨ0$_&!Ǻ : /Ͽ3؋5? 3X+;%+ B9&|>@߻h, |}+ StkɪpᶝK]o˷_y%'†˸ǮGJ|˕!k̹q޸C&|8sӨS kI/VME/Z z2lߡ+_|%نnNuhkËhTӫ_Ͼ˟OϿ(h&HUߍv]Vh+^` a"hv$҇=( ਓL:z#8?^S Z6bd,K.i9ى>Ce-^cQL9 AF YˏZr idf*9,pT'Bb&JYVRfMhV#'$J)PNZ)Ofjb%rZFEh6*YsRhº)jh6hj~ fy)ƪl$2)j h 2 ljުj촿B쪨*ZɖI̚+mB \\% G𨸪hwl1OZ2g|q'Lo(rVl3{lϬ'L1; P_t3Gݱ='Q;4:J\Us06G[w]sV'I+LN 2ɌKy?2ϋ4w; xݧ# NЩj&SS8 ί:K~6~Gwq~zz>y`UAgMRo9ǎkz͒NR>ގ-tB82OOڻ53_⭶'?߸sf<9@y}S ,׼5=qG]A Ƨ?}pb k) =a|/!ҷ jm!vC%l|t<|vs E}Xgص>oi3^y2`l)5tOL D"mys* T;T&"#ɰ哪gS^Q;s8^p(իa2]Ҫc^}G5*az;)bQڷpiZ(&1KLhIz8,K+Iv^U N VjF*-X+fԯUZ}jEu OMج-?ޑf$pj-$j4u4ePKaR*U~Ud#kޟB* _ oTޙe*da ',%XXË;)1gL㏴8αeXB< HL 8sa' $[*h9NaHxyNVgӉ.9WN3S&{YoNKt, wVĸ X@CΠ\hOZΠ!t hTјN( ;veCaiFԛ4mWM;y,widW:z#oџ'bKigB#jڭaU2mJqy-}#i+fZO^WjN7Q]Dyyny[>XȒ~m%|}qUlD"2⪸N`ºGd,QȋbJ4W"t9gM'9w"g@I[0З*;PԧN[XϺַtZҗhOpN\@:.v ۹;*p}~9#xSpA|o4A{'wugqfqyR@/'r4]qzɧ/ى3^DoyI I;6]Ԙ%`ۧ{~xӅV^ [:xU\ŪO {_~:I/d#>~9X|*#Iwt'tywgjn$? VA7+{Gz 'Peh'ԑ!IrxqMgp~8Xx nrt,sr((8jщxma!Y8[!xX抸HaI8áx7!ȸh,8x/bظءV8 xE"踎`@#8#0؏LRYD i'ِ N:"etбh  Yl #&)',-0I2yƱ8ٓ|C>9XFi LٔNPR9TYVyXZ ^)j_$deyej lٖpx'{zP~ oBTm\E+xb]|{g}TL9C=|)'V!w{F6k{|N P]P>ϗQ%_TS V}Ulll|v:i0D"7,7՛MT35Wv|&&p>u5ɵi|`/4esCcdW'UL.tBh4Z5 ($E-xUׅ;LuB0h67l?姟: X\D8nX5U,)3 D9GBJÓ ʞ`ÔBe <ՁcC;XW]'bjqx$%[F ZVĥ7:EʣQtZş6蟠m2tWuuVjUVLheGusˑd[0 d# '\ɧ-RY]<`9\Zeֆ njH>nbr6E^z^sI}* WFfTJJU[.<¨kd+Y4Y`m;>A)4crit}ZJ|:ʌ:XJ蚮ʋi\7ZzuJQ ~u; Vxh ۰yn![o%d" cP!1zkʙzp(f}fRYg.;O0#+^7*KgTZY 6T ִ9%<;iO`IK6V:izJeOC5O kca6Vʥ#e@3T1*ugD.HзjA[LڤUlYNiIh~ZFzZ ;S9:`CæKŅF|ہ(R;` XZ< \ e,^pV(@b\g,qloLs| {ukl8ĉ0g0Ȋ`pzzeŘșɏ ɒL (=ˀ|țʝʠ< P \ɸ ˱<˯˰ NjP˦, Y,˻ ̿ ǜˬ̮|̜\nL\b<ȧ"ˈ͞ lΊ ݼ9ʇ`ɠl\>Ġp˼ ϣ 5| |;@\ =[Yɯ\њ|#m7+mȟL},χ0|7 Π]ä@F-HJ&Q M= ` T]<|&- Z А 4EZ[bxzЪ!,DEǾʯ̾ݫ %NATI,!B.x 1:c8bÎRHɓ(SnB/+|E0TuSG3CѣH*gΜk>XΥԘQb*ѥ`ÊKdSh{vY;jxw۠-a=kJLr@jԨCV8Z7r\ȸ zJ0۪^m7/ߵ p]kONKcN緬cWW0cY>{T*/tÿܣb~_wrm#Tzw*E&:] Nؚm]j~_Be"_=(a#Φck$(!V(@Zx}E~(%dczF6I>h$j}9bUf|dp)tixyg,ߑ)(Bh.>5=z`jYc8i4 jhC:?bOB*ꥡB:jcb+i ,F+Vkf,`x~6B"+鐙.nLk{oh:n}&ܩ}Joz*,i>jۖl(oD ^-ȰnLj/NT*0d J\3f"e [\po.תs(KK1 /r*ltםm ,,uʼozqX4a|"D 1ơU (;W&r|6KyY9Xmi5"A߀76b8fN|sƜ J+KީV{Ksvmqcn5igt 3Zyyٺ׹+QQ%{׫.؅o7 G!G #~w ́lݝ$vb seMc_'вKل'{ 7h,%QCmfHm< d Z.{˹ru 2̷36_Cn xγ,>y|]@ЈްFvю? I[47YjӠd>-RZ,>WTհcMZcֶε]5M_Njf;~lj[ƶcs۰6}jqܠ67}iuݎv7}hy~7}g}Ñ" n 13Dx39Ѐf E*n -ҐO"r|C(%x5| HNؼ4 w\TɌMrty#NqEWz{rI;7zPs$Z7 s17ibse{yNǼ Oyխ\?]f'ןuO]e_w}9v{wD_0:ftg_onr#i?;K~_:/'8>r'o|>.;|kO>}y;G=wُ/c>+ܯ{]qyG|n1yvz[w{Pqqgg{'Gzxtrq(~Hs*u'7؁ {Ѧ#wc;xHуzIp>hB`Kx\BR8TXVxXZ\؅^`b8dXfxhjl؆npr8\JNxxx|88$xdƤ䈹Xx؉8| ؊8Xxi Hg؋s6H n'tb Xu h (gʸ,;2B 50k022+3 8UF ƀP\I^7x2x# Րw r02) J!u s- Q- )O-@e7/I ֏9`<"!<y#?YO&yP@*iM5 RG39;u8I3@9@YYFyMfɔN EFbOzNF`ՂM^PF$P}F_ p)HGY֑AE tY }L<ϒZZVNX\^Pbd^hgnp8tv~焘z||瀎P`e TƖN >Ün|K|[{nn犰黐N3ǛN>n촮®ƎzH+M/k?+A ?BN˷B{;[SL{L|O\Qū~őYk޳R឴g>&,ϴ|L޴+vֶ ?/ ll"%?^{ ¤>+E<?8R)/0,;_C;۞CCk۶E{k_e i[Z [cQ$|E˺ o+ x߿'|oU2Xnܽ{F?uį‰Y Ȩ/ l ,¾_J_?=o,BZEDEDLJǷɔϕ͉ʪݒҰm#ƍ8#k+[ !k0?fR0@uŻXe8ɜ͛8sϟ@y JXѣBEʌӧP{.JԪlbW*6Ra˪]k^dj}Kݻx˷_s LÈ+fܸlB6˘3k&ܘ&eƴͨS^Zp5ՊLZָs;Vו9_ږ0'#޻w<]_(xk2nb˟OCi1b#y'IW߂ 6`Uy{Gm](O8S,Qރ$h≻Dh)ᇦh`_F%L~cX@Y9̠78)t_y(L W1|n֌}Y-̡wW/\e=,~&:AI Cu.#v `t3mSzH2nQA/+eZbƲO x̣4C 9v.B̐;C F:TkO SuĢvvdd$GIRR{J%=u2+f+!]S̥R Uvf$,U6CL2H^ ŗ*Vj~q]_TӘnzL47E5fL:׉p| [z tg4誶̀r>JЂOI'І:A'JъRP('z },JҒNҖFGӚ8ͩNwӞ@ jRzHQKԦ:u&KSJTD5qUTZ>hJ ֲJE%Yz)$(J\JЕxm[Z,/׻u4. *dW/}Fd[ֵlfSYN0.,g!K[Vu-dKXf}oekZ1}kX6g[vӵ.tLr}Ĺ.cn/`{]b ~ 3^Ww 쎨pm#x>Ly_zw vm{q+u}#LLx.s[/b׾x3n.qK㾜XFuzLdتM&N"[-GVZeeAeByhVS26pL:xγ>πMBЈNFEE@J[Ҙδ7N{ӠGMRԨNWVհgMSC&Pw^ś4Mbnҷjf;66Mm_#=n{MkG0۲pnriwx!L~ޱ-uO8o'.|0x!pC 9.CW^S 1q(oxK^p\_-*gЇn<ϼz}\Oصsw] os˜/y ٖ]۱vǣ^қo|! ~og:O>z>O!O^{)>{JZygizGr;>җã}sW%7c^躞m3~xxwW4h8Xxh\Sk"8$X&x(*,؂.(H^޳R/UD6HAH܃9@G;8N#C3{T* Q8RXEDL߃ZDNQ 0dX`C…]УlC_R pz(>{(FqXT")Rg}xㆈBVsXt8CUXQyx*=K񓉖`.4GI*3ۂo8XHĈ=BAx؅s äڈEިIx=5* K\E(Lt4tDx=(Њ8xIHGD<_x ixtcLJ= Ia#(ih#Y09GWԒ$I؃6RٸE"=y1slhL?%bKZTY?Q dSyJh\)?YiU 8dYf:8fjy1n*mrY)q9vI(uyz'y~I'}&9i&y%I%#9I"y Y9y9iy6>R&Yyșʹٜ9YyY Σ( _<0♞E=i%ਫ਼iOY%9NI ԟW J! +<'J*zBڝ41E"*3ZE#*QQr)WC EWbG+ڤӢ4VS 78:7J!TWZ]zb:<*L:kZn:o@qvJ?P<: :ZY^:e 9dVʥ2HʤsʦB^Gz*?y 7{ [Zʡ\ʨ~JZ} **tjڦګdPJ:Ū :6pZtz ڭc#@Ϻj j0?J܊KگW#0ڥ*jXz4!:)V#H!Je;ecA!"Db',; 䲰&"4d%<;㳁D DٴNPR;T[V{XZ^kbc[9df~j۶PnVr[dkxp|[u}Ak7蓵8Q[;i9H@3*4 IɸGEA#+3 hTEB+2! D O5C02 ;Hp3K禺OUDFd0 ˒MUEXH@M"/ kَCTMkC{TmԼ3oDL *! 勽I$[Ӿ6MuIx,ؿ) ˑ)|qTlI8CH5y )GE)<:d0. ' [¡L22,ß3;p^TL7Ý#MؒMRLL4ĭ,TFKs*M#L9? e̩@gc9?f#o@q,m|9t?%y@{lw85ȄPCȊP\l7R<"RCɘɑC9Ȟl$,ʤ~|]ʥ웬ʺʰl<˲YC˺˼˾<\|Ȝʼ<\|;PKQ(L(PK&AOEBPS/img/dbca2.gifqNGIF87aBBB΄cccRJB)Zck)!1B!9RBBZZZsckks{)))cck1s)1s)BJB{1ZZZsƌ֥֭޽眽քkcRB{9s)Rs)Jc1RRR{ZJB1c1Z{1J)99Js!BZ9Js){s)RkRJ{R{{Ƶﭵs{sk֔J罜Rcc1s絔{cƜsJBZZZ֌ΜZkZc!1BBks))ֵ{Rcs9c{{cJJ{)9!RB1)!{c))9B9JZc)9kB))B9!1Z19!9ZBRJRc)J))s!R1111!!9BZZ))BB{{眜!!!k{c9kkc,H*\ȰÇ#JHŋ3jȱǏ CII Xɲ˗0cʜI͛8sɳϟ@ JѣH*]ʴӧ3pիXjʵׯ`ÊkPJhӪ]˶۷phj{x˷߿ LÈ+^̸ǐ#KL˘3kyLӨS^ͺװc<5^ [w NȓG 9^h~+ROvJMPM@>}K& r^B ۄCIg^s~v=`r'⊎a6ݨKX{"C>& &䒝=PP8=TPmCC@>"~#I,p sYg_x'y'jbNe1{W^9xmI]O#N- &yf|:=*Z'ZcY{Jln)ƺF 谇Vkm՜9JiM9PNW}_9f𣝲AΛlfIcko+0{l |;\p / Ĩ*׆,xhT:)nxm*>۵ 3j7B73[t|zZV uDjL ӊ4:dV2A'7rAL߹^)$WS7\*ހ7΀^4J`5 izuwolx竝=Q<2*)oa̜0~u>-xҶӮCnt+}7ő;מy//6g?YzRM:lzV2-&u d^J(BDF:򑐌$'IɐK̤&7Nz (GIRL*WV򕰌,gIZ̥.wIK 0IbL2f~ɗΌ4IjZ̦6Jhr 8Ir&:vWֳ @JЂ^MBІ:4}D'JъZF7юzHGJҒ_㹟V*h#?:f1 =hsz\>GC_̔F2s/LkFoѻk6zI޵^^:žvxkbڽ`uJ׌=mN^fK{f{X-zܾ|?NwrO!.񊷛81yhA.c&OcQ#fe̙ҧȹw|ЇNϣu\Po:ҡtwԃַ{}N=yK @{57(}Nwx:ލNt']`:qvOoqG'v[{9رͧ%m/Mnoؓ.=ŊAN]/`:?^둿<%ob9Wtϵuze/׾H_uwT/|yXW/k7}v[UmkcU`8`† }O~?G~ww~{NgxW "8"(tUuWywv}W4(0a}jdNfhVj}Ss7~'tzw"H TXTXx)uɷ^/8v'4`G9(kfeFhSi>XHu㇁Kh~N(t~Q{SHPX((*|_03gNܗj`^&zef^uzvxIHhwȇ}8t t(O'@W~7|Xdׂ7wWʸN-%jjsigb;~vJsK8聺~/ЎH Hx(H|\H3x$ xl5e=bfj_gcЮz*pa 𠗪zڱKdJ&y/p[(餳Jeڭ +D Q%Pj+d@q*| VYB۱]Ŗlnp۶qr[t{svw[)wDK˴]ׅ[ @*gXK9jS7ꐱ4JA+~DKMy %d +6۞z˱@۱[C+Kˡz 0^Pw 밳ەp:򐻸 ;{˂ % d+˕(z+;}37w@u d {x9xIԐ`3> v8HxSuky` azHJ谿#㐩7sw<9J \ӈ[Fh(N*È p]٤*Ze{jw=8[RmxŦ|`N5[H˞yʭ"LrGD}vjhkƶ5 a(Lwd[aGKɕ?!Lʣ|@ǥ<vv{F=|QD(NՔ_=vp:ݓ|l=ǟk\ܼz {QQ,OӤ’ ]wQiym㪝:@ީ>58 9meLЊ8uVNw7~]_Le4mW8 pNX>8z^N|{{x阾vm,a`,]pUCv\N]N~Y rH>xPײ:ݽݬھ8樮y^ nÓlXm1mx\Y Ƽh} n,݀>ϗ혜l.hYÍn y?Yљ2}1J<0G60LrNv~+S}W 9 S!?uƸNE/ݬ*. 2P칗$@@5.~(O*jOvj@t~Y #YNO.Ody0hV~Wxn~>Go/-/Y2 0P uw_&xxy/_Io/*2/pʸ>{0 ?a@<`B>a)8"F<~RH%MDRJ-]SL5męSN=} @dǮR:UZP2p9ԩC.u뮝mVڳ릭9*pD)j? FXbƍ?Y͠CE Im՝te͞keㆥ[]{!077Yr͝?]t sTQS@dL#;kر_ m:dk o{ 8C0\b&AfdA0B MP⬳ < X0s ,\{/lmsƅ0.2@P r H%dI'DBRz+ hi!a9Qrŷ? DIf,I Г (И$CGZJG4Ǥ$+;,B+r GY| y!93@9˜ܓ>FEOUPIeYgg“Ĵp$ /IӸZoŷXt .q`ՋVy48]#'{5I` v@?8сN4eaC^Єs⅟8cj"2z D1HWsatߚڭ+/g ^ݷ_" Vᤗ~`n8`ixizc{RԤ-([dRC)3a\s+//[3•@'_ y5_k'vjʟ:+:l?=3;;+q61ĐDrԁ=6ټ <1xO|04_;Q`zz q^п?Fcr!uCLauc鶱}OqGյqXVc媧9VPkd4 lsU4 @1u[/k{q3]*3 7trk0UÜ&'*WĢaN6)ͥy/ c__zߛPi&^i7.a@YVErdlHCX=SǔhBZqWy5.5 s%J&e iL _g&ο%~gh,խumЅF=썾wY e锭6,EKmbWKƐD! W:gq27mlݽv=ob|o%1 K&F.bե64!KHX1Vn7|@s… lg'G E妈aۍt[_{Wĥ EˍZ!'-u`?:W:pҥ.c%dgCI=DNpLowӡNu[TφɳxcorOc^Jc ]w3/p];x˻O|xQRq~Nt͞R>=7"/8`@[z'=}_}/rzx`GmK0!"h9,1˾d=k>sv@+?=GQY3S-g*iض{~Ҽ8A88#gD@Aۻgg7k5 7#?3?=#YBk?h_H3JmB3;b!섔f@=5\Ls=k7! ̆mCnK$T?L<=Qr"p9eE)t?2,6~<>c0H3bN?pA6dCg foc@A9::ӽ+YCBCQDF4Fph?C)֢A:?ALTFTTFgqLq$Ggx[ho{hEkGSkk?@CMTe-=hT$,E-. LLWЁG؅!sdOggU'W'Q-GHU]%hUX|TZԇ@G0 ?>7 ؼMLIMi֦AȐօ֕'Γ TYMoW-P)*rOŕHH%`x8_ym,R|M ~}W TX҂UWEX}L[$ȁ$Ђ'x* aț[ۇͲ) lkIhXX?nQ%8?PU۱R5(]&h'xhZ_pZTRW| xx& Uu ]0UX\m-%\ ][X`Eꅖ?<#%Y7>ғBٝ\=&)'x_P@!%GL$ȁ-BP`Bɕܷ\GU>?R"@,2_]dN=aqeF=?`Gx, __u՝Wf%$#x0KQZL%b)~}؃؃8=>ی5dhLaf'(KdŅM&X$eQ6.6\W+cm[3YN5ȃ58 ؀ր_XAa6hICa[acdNfnl?403 4ȃ4k lLZNv-0SNeNVg2 &_21-=8\^A}h>N`fI$@1@4NkNdfO+.e-nv1~3eZ|A>gfG-2k|m2; lz/ic m5i|hɦDcfa,j%kf\8mONo(T^g/~heW6cUV e2a9rzfWl4`jnVvT}ՙƂe'OmPVVqvngZz׀ Ȁ/ p'bPleOqۮrIi-&Ӗ'.qn1~qyz>U6 :Ѐ1!i_/WRF1gqٮk5oS׀9)x;X7wl[g?^Z0(S߬5GI/^.gM'b2bVw6- @ )?wYGvvW6+CvȎ추l&urՁra`m='d/Gg'hUvqkr6瀸xz|ޔdk.w&:Ѓdpl6`JXyDc-cl⛇OG݁t6VBwEv|~8f\Vw|wY%_wHNd:0{g7h?N]{`e,/v&g07Ox/mkv7ħⷤ|Ŏ:`6~8Nq=>tӷw,g}Wv UՂ`P.-nU||q5,h „ 2la!b1qy!=ɖ\L"!,P@^&"#I%KxIX~H0'O"DVbðX_)~0YEI$+4lԸqrkp;Ê$HrtF."jT <1&3l2̚7s3ТG.mtÈ+^dH1s@!ZtQٲN2JMԛNs#T(L6YTfkX)0A #m[^{#EItG2}1 d 0J8!Zx!j!QdQ ӃqqHX1zQGKlFFMPNz0O]Uu]W s/y6%[z8WIl1QTaQPcq'r >hPZVh%Т-hB6 )iR'j)Z!k!2b4RQDAĸK3"l6Ґ~IRaT9ɕVZI0`]rIdE[rz w}Yؒ%hr{l hB8Ф]Y뙿K@NZ0{0 [* Q**yKach;M*%1to'V=w]Q)V`\`nkWh+aeW)Qg!;@kh?j}v]]Pgc-a]vDח=x{=6r0Kĭ-THFx "t?/ m; xʉrqm.9i,FPi8Q%e>Ӓf'A wt h_Җnp% ;`ٸTEztP8@͋{>IbE(~R1z-m"hEQ |#h6)#:(Vl(ARs~ K;qBh, cݕ|mgA!]I/ٸ\2j} s}Ȕ3q1ʱ֔G19]gG 2`!SV'IvXh bH/TA~g V=/N5k @e@`k xэj|iĥ3A3R iPkB$Α{)x1uu'$JY6)<.nA@(&n骞80XjOSYLva<&gT.V4U|_YҔL͙Nw0JD8@.W-SH'T™1uJƸʣ}Ұ $@HM팝v`b :RMe;wphEMЍJƶuZ{Òȇ,vSH#نLfKRF˝0S!$gfz^T rrKl] t0.^Ӑ芥y;dĊ"1Sܰ&ytlP4#HGɡn5)pj T̳j% jO#,*U5UqL 0WHc>3+bXo|'K_^|AI) 0=sw$'x<*ObـΧLh44sӞ|6k 3hL|KH;F݀QC@+l'cْR)hTͩN2iPS־vEmRc LfL9GY1dG1pV|AzZ>P-xR|j{DzLpD6#.kHv&tQV+';Rab3 ށ0Q ƦH>sҐBÓ?ʎ\Lc?:ԣ.X AcAt\ E?V}`ep/G,:B ~ }Q v9қ>3@ZsFC"cYom D7keʯzo -wS ]B,ӥk}%H@2/+y18̈́S)Uޟ꥞.!p1Y$ aU^Y*ɝ $ `DIl׷XV1.T [ѰIڹpҕ v~ "B\ ʔ)T %.pBDBTZ? A1 :ܗ!$F$jD C`TYFߍ䈍 `V!ZљT0M B5b#N0#1.z FaMmA |0`$gm"a+a>mRk9W_-  /p<#=j"f'[h޷4);- A@BB-+j>!Z_VQ:ʉ 4";#I0 `F({!p`l__!m_ )F,-Db`Y!uI R;HG B4IVU~!JJ0&$? eM}d#*C&OB.%z?q,⹑RFdLoU&b&_VdJzեKapA4>դYPAN2d\D,#-B"}|5PbnN]V֎F<`x%"䪵E%ZNv"Cv.,%\*-Ͼq }(!z !n'}.1ZBtV>fƽdA?25NagVEL^uBvB.fe8zRr&%)]bӤKmpyY}(zJFRVfp'gX&R%@IbvVh0Gdh ܥ8: l-bc~)׋g$u8i|*n"[h-ƃFhD"*'tg͐e{!Je-j Y>*b}WBPCAnDKA\KXA9R|SbA0iDN*/i08An@Z@f[Qgv+D.+ Ym,ԨK"4ޞU) FWE !!‘Fd*Th+wȴ}Ef" P66Blb)L ^ſd5 S̡NuFd*쒖$ɅIL,]A.nϲЪe@x*N#y+Ʀ*F+ȦȎl ex?Q߿QF^v۾lCtE lwd1cu@@.庭*u*`-ֺ~% > I-膮iV*,u Z&k_-&~tj.k+hrjQ'*rI)̦TzKŋVvF~G0ME®#GBmvHbdBf>nFf٥,`|^0D-C 6p AUQZҖ5 eB00Ư[V1 P@LO+a"p(B0Wn^mb_85J /:n wAx&E$ zޖWm)B# .T30'ޱ'/l0:EtNmC SE G*H%_E{X%vKg,r&0nZq!+o]>Q *f[_2/p$gBqC%3q%UI'M.[0϶dŒ>E+0!+wjyjP^1&L%r&2s2B.0 '. qmA(n9$*I .n++2-s,!ozt:o$/o "113K./X80EY_9ڪΡ+ò8s08O #7IKȄtY%4X+4LY33p+54);q pFH[f4F0i,J5рy6m&o 4~Xd-eY4'@ Mͫޫ[$*QO@6 pB)_FBmsB x [?!(SPى]ZNsiecesfW 3  ]nKu 7'v0؂p ׶+dmv,C0h$, Az'|q~ @T%*>sG8esBXe[svY[7'.@vu ,BtxG$@x %8CjCJh\i|8v}8n0y/~/ KK&<&9/A+*g|V6_-Bfs2.03]/&C&f._xm9ry9f.(:3Gz..Xz7d+Ҹ8969 :/-eB'G+:[:cc,,B,;ָlE?{}?B--he_x3{;,*iVtRϷ|9OOx%R*B\;ׂoú9/<,\B ;{gg޹F5w|;<#<3<[|{ǷFv{LJ<<[.?}!o|}{}◺< ++>+>G~ <,(=(?ߋgk׫B>o|+~9oIR>+k>,̽#+)),B*L~:c?@Тj@&TK C!F8bE1fԸcGA9dI'QTeK/5 @25 U-Vj(FF% V)YVeu֩T J*f]Jm[l +teWX69paÇ'VqcǏQʤigF:Y <+P2]iQX UU]S سת}+@u ^ ⅼysϡG>F5oȉYN TZO *RPߟj묧h6jM@ͷ~- P ) [2,L6 <y*DZI4R,=]>hRוּxb@/L l'Rʔ4n;CDZWRD1OsQ5{MSTa3?q}:D)? *+QK.YFS[0U6ʒ,TMUUYmUB94QVFV-t4]'m_K59?/eCuT:Ov7WkuV[oU[Ë/'UK3MsM?VZi0X=6#pVaw\SX1ŔV&8ʼnTX4OqWSOUV87|WvwIaYW5XօvgoMg#Xb+ؔ`&%SbFͱdON?[N+͢[B/mu8-bQLјݎ=SY>kzO0-:m>:`Vwu:Ro ͚zң7ja]c B~\w%nָcQfsOCu硏~]p+GgoCxEnaL~ӏ9~_";5+)B/}ÜHS_O`h?D> p # @pӘ4W =]U5&Z*OVYٚX쩚\ЈFV%FyU+~bg ;数3khXÆEaϚΖ݆4jd}[Z"%qY=rVa+Zr-jEB7wZ)#(e++\ Z}?_њvoaX ܧxW]p}^ɲ}K",~ %NQܤ6¡<Ąʘ0{ c=A\b!)6#b}bu Ix4\]a=OxxD&1&>f5cHv5^YD8‹b` k84a,7ue/Yep՜4Ҕ gMoz1J%6 \!/ (a Ck֊1&,\kfs+-i_W(9leӍ8܆ H"ϾDT? #8D^7Xnkuv]l6{m^mO_ _ఁEmm rq=n[BF^k͟ Ѐ8d *Elb'|Ϝs.I[o  W ^GzwhzśtAT:& 7h]:1} y@Nm?v.ϝQxntAK, >^ӧxOUwzy똨;1k~'C.|DQ{q5@pQz/|Z6!C' P8a ld/ /o@ 6!/@ ` Hh9aq0`" -~o>0oK&  Ď p0 Cn  W-rp Sl2 .4P (N I7 00 q qA )0` 91VP pwad @ fm1e@.O0 1-q  ` :qcji,G[g`ghkml`mD5e@P PI1  2!RQ @pA428@f nՑQkdQP&@*@ &Q!! r(!$2  `r4R82<$o$cr,$ &Q ؠ ʀ ŀހ2/203 ) 3ƺ`,2 a $s**#+Fr`$g$u N 1Qʀ 55/aS/qS/ R (08 8s839')1i A#p` s2)*22+#!4rx ~  Ps=5Y5[5>R/o37s3 ?`  (@83Aӈ9H ۲1 ! VB[ C3:$CC[ | `ԓ=]s>RF3/k?3G| @]P @SAp)cO:C;J3CI&DQK[E`Fit>m66Mut?sGG)p@4OG9`:1n 8RS BFD@ $KTL7L5iF?mMS/M` TOaU1!5BʱPqUQD R`R "  E]tS7 bTTETSFMM[q N4VzOy3r|$}U<u D' YTLqZ)[u>U[4?O\7 \%6v  Ts QUQ R4YS5`UZSk6 5G56M3?6@ b'h4B a ,pٰW{W2XURefgZ``uv[o6״MVMq-hkvp n a0d{Udd |R`_YYZi6f1l6>ʹmT6Mtarh4oY6#Ҡp)j@1۰jC$r׌Vt7nx\XX&0b&`~Dx 2i$CrW_]vsøy`5 FC`8yX>@ 8EYPxJ@k qWq5kMV~XU!#@΀5-Ymm9T'  ByY^ $NZɷ8w%kJ2GqkyQ ಆ)- ` :` z z 2@8 ⠚5\y$0@w i:+E؊uq{yy9ƀ.}Zߒ@`;86 ZC?נ B4` Π \U9ģ L|MZ8932xy@XIDwujzq ֧ۧ}z` BC`; @Ơ u=IȺzYT[R:UDK:qZ ` @5`[":;7@9,v3?-$ O@ Cw bqE, ^w@ LQxKU8w};}[r @;;9@F  =|BB ˹m߹$K2^vQCTx5u;{;x|?|tB{ ysB- 4{Aٻ?˧CEp x` 2Lz=_;ŭVqXxXx{y@ 8G_`G =ы`;ɋC {< B@-=9"8&qۜqU{%mPV24Tx\ \pɅ]/ܨ+נ_=`9`` 8Ō;~ 9ɔ+[9ƒ $1RءF= 9$7pF㥎2gR&|3((L;oTE^Tn됬ܷO-l!w1< HeՌ?`H_dBZ )TjyHذAIpJL5NRAs.6 ]]wYM#CxFcAc0Vu  l ]uu_RNIeV^eZRyg ƠDFk"Dl)ݖ[L2M90O%-\1GTh8Ek1L`K6YEeJjb]&Z@iI !m}S4Ý@PB-9ŀ ɥV E 1mN0h{-xa|FNQh{i@u{fJoދo"g E R0Dgykl&eqJ8o"ڄSN'q,*,Td)l2Z# q J${MtFf~Wt>5tQp!q+swwOB,J9Rpr0r(oEJյDD: >j!tҒONyt=*?TE7Ёۺ550Kqw r+ٶ,sBk}0ŵQe{Fuy~e/Dwq57lE4hx+-v"Cc 8O~V-q >0T qJ>xPo$, OH>0!SZP0d$MpС#.bfBbġ]ƔC8`wK0`-/ÛUg;)rÙ d$c΀qllcR4iWpivPytI`JN"وec%)ocũp+SSYʴ@Qk⍼(g! PTl+_i%8FtdaN0&JBak`C~[B\ 9* %J:MdHguR*TT>3EyzE A(7$T=IYLHSddB)0sUb*50V-Rl"t6AOQ56鑖uY$v`K_ ӘnF jwִɆC{~iO[z"0#KZ- F!Tlm[OQtUOw^ I']xՋz Z7ŗdW7g%NYKzAu-- &j_^(Cm"^P``8FLP>20 Tܖ1,VGnd5kњvPːVVsCEQX"<qjT-X$O`R+xT/lCu-k/aRw!d[_Ia48_[d8(ߨz F0d72K &eI]xZ\dn\ +ti4PTkmBB K3Fxӑ '㒱̲k,"g@-ѳ?d( zЄBeN9!aSCK;MjfXQE- $O7\Q4{||d?oC 鋚i.Z7Wos,-`Y E^i#h h;,2"T.7u^L"U u=C'H7ڊvqdlsT6bjpY#0Nhtz A92쾪DF!W;:$nm2I<1pQA|xbFoc "p脌 ώ69팺9fx[},ٻETY[}vze4wb!$&PJtBDyugMaH"X;#U`$}DhsGyIkHсRC&5$t`vT,Hf'N!$|("N,50]xV)u8)j%x„25Xvet s{LDIl0HfmBpBv7b)y hv2ȁt2Ttoe[86LT7(|67\Ǘ|0G)1x.TaxIU҇I0tQx^WFiui>+X @msuc&2DYqdV8m!P( )3 (PHFwXtb Ҏ8Ui7!2#I #d4Y6"7H0W5TbcV!lIx ET`rUSe Fh8 pZI\"Zy%i[^vbx'Ty`(# D<2 h2c#ϢDBJ` 6K`& 5UȓEP'mI&4SĜ1w@ eGR$@N@ɝY,.0wwG`6l~ UH*ւyIs2 4sF8NYXT0ɠ AKyD!eORl @9| <.ڤ'j6X J5M A=Vcbe#e7HI0xb^LP":#|Q7QM(CvK 6*މѴD. * #03~T1r+-b)AB SQ}8;[E;b#R `cjɕH0v&p')*,iiz.zyXe˘R-5Oi U1mXc|3ƩۊEFȃ& 0$+)Y@uȚ*3yU%WGDIيu*S5m '0؇} 0u2ꑕ:;}Tӄׯz`z1Ju/1kTw`j X&chɭ*˭7K˴Mk Sf?#;X+Kdg7 kdKo?ʵ] ۚb˷|ӆe+K ; t+x RE۷kKzV˸zK%)z{{ 둻[kn۸,B ۷K˼: ǩ|k;{e˶ڼ{n4ȎK;e۶3*kkkubػEٵ˾K [ g+Pƿu<{ GIݛfO#dܸ+u}+kPK9a˵Lً4 6:ſ2h+yKĬ+;H J"aLZ;oA޻8h+uVl,,W, nI{ÔjljSV{%D+{/ܺڋ „8봊ǻKi<~lc{ėK]̶JɱLOT%=Ѫ<L+1.䲉޴9GpKO^hJSNNWV[]R_S^cnObNgJfkZoJjsnNwnE^xy^S{.>r.>4n~/荮v葮/.镮%nz靎՜類*.>>n.%..nnh..>Sn뼮ѮNn.ٮݮ..n..N.}Otn l dk`!/#O%o')+-/1/3O5o79_!=\ACOTnGILMOC.SUoT[]_a/cO`̾kmoq/s?Awyl}Poq__>bP?h2W^b/.r~*ok?*P/*?*/j$?BTɿկ%ܟ%ZrXRmɏj%o%_O$XA .dpa lر@GbG%3TK1eΤY̓$ yeƍA=4P@'ГQf<0Чâ8N5Q"E \׎?s ٚbe[o"))׳HAː@+4Д݅Q..iub[G˗ 88HI;[F3QƩUff߂uUw殀-YΕ3C58b 8Y䔗G^=wu a}ti'_> \? +±:`$7>01)b0:<Dl?fl;Sl!]4H$b0+.1.G~I6/I`tNFl0A 4(S3!?sN:iF&g>>\J4?)djS&1$PޓO4b3&7!<1E;S|̳K@4ѶJ5D48AE\28y5 ]%'mUvYV-ldT(!oV] Rcj ?u \urUj%R\v5YM/ruPWQw"NMM]95FA{%x&~>߅P-c>uX{%Vb8csSޔc yM^ Wְ 晋Yh;o&0g9e~#$h?zN{c鶞:bdj -iCm٦'i{TI_|p 7pE|qGn#q+\|/mnZrK7t V}uյucaGGvs])|/vl~x⋇ߍIxwyvJzuA{5W{Wg ߗ~ϿP x@֎lI``%A fP< AP#$a MxBP+da ]BP3a mxCP;a}C Q$xD$&QKdbD(FQS",fQ[bE0Qc$cxF4QkdcF8QscxG>>IIINNNBBBbbbRRRaaaCCCKKKDDDQQQGGGcccFFFYYYSSS TTT&&&UUU!!!!,QH*\Ȱ"JHŋ3jȱǏ CIɓ(S\ɲ%JtbʜI͛8s& t\ JѣH*]ʴ)FtNf$TիXjʵR;Vdǂ `$ՠ^ʝKݻ$N4o#`_t6v*ǐ#KLY^|*6A:n𜎀XhСX"U cu艳nt[УKN}|+K#6~0<؄_0@F_[]tN{0Ɵ_^|Q VF(G x C:? ['a5`ކ} L6U6d  S} cm$U!E 2(L6䓒UWT`X}Y#I%R/" Da`v&H`P*蠄.%u `a Sm9|%xi:=fb1g{nK꫰JaEM gbhhXg)6h{@@iv␗򹪒fz6hWw|k$#wOZX',U(VZaI@lޅbDby%XrbCDh ;\1,U]6%%r83S/e£6;m,\p&NwC*XgFJdYQ6G?G%W[6]~c3=6ZQ{eۀs!p&gl m@0DcFC[߂.zDbaPow}v:ܗ+>Z{`D`@A: {k_O8GzgoL-G^j:q]FxkMh)y![AS5IOβM0fh@;|3Ar'KUJ!Xϊ qes|zrftQxʓ1Z- ?(>z' >a2A*R)@hSL*A 9`Ӄ\z1mp$+bښI1w$+Jպ/) f2OmxEIEIMl#`XXZhd"bJe/Kږe"cc PoKF[I->GzF_&ORam2$>g*8x.@dxY\Az*¥C:[*^փ%-ԁ?{TоMp\񍭫 XTa_=;=x@п>9oM ܐb *Xmش!OK / %f,!#%@rL9Y2r.{`L2/B޲+s6 AL:w~:>Jޚ] ЈN} ѐMJzҘƴ3NҠ=M@oԨtW}8հgMZ'εwkVZ`򯇽`N46Be3 t6=iSڣ6 8msZ6m4q837M0ur7 +yރ7`;~Op!$/@"N@Mg3m CNɌ(S򹬼0cN̼8oss@σN H7ѓ,PӣNLv{`\w֩3pv"Ioޤ}|gO9&lx Y-Op#wNji~>zۊ:/}iOA^6dR{˲#‰Wh_޾" tA& }j @0'%RE&Sl爌A{vs}V>~Dr&*$1fF,&e ~W7 i4&!296Q_wgdR.a.#2]WT{FF6P9A*(;"E~\)(T9#9BO/2#BJr`(vE^6l1MBхAAh1|lHOn8{S%'ph| !]Z,x25S|hQ!V7#b.'HGwVyG~~#b, TXOϒ"1|q6m(-#D@5NS! 1"%BXM({R*a19QH,jr_1X~B72"^..C$kȎq|8HB&aRXQ(C1ႈ#Eۧ5)f؅a%gi}({0Ds8Xptz:YFu B!V.N 5R(fJpWp%fVdj1~z @wGm00L0z ੠ v* L0ګZ:L 'ک1t)@DɧQZ$qD0C zBpC7BPpD:vHZNqdB J +j+@v *0J;:D:)Ng) 0Q:pa3ꮟ:Pzpp0AayvGpN`E[G`P۲! *-0ɳMᳬ L0zf"j7 ]+[  +yJN1 ˨{L:-{#q;ḊGʮDK[cCЮc pB@oZ˻K{>n껁;+?tt7Q;J[zʪO@vz:ػrz: ۷|n æ}&hWtAy:Kw2CJ\pHPJB;jŀAK`K^]Kap+:+A  ojd)n-)((u[,L ;,*ʳ:lA:Xne"&/B1Tђ )b&`BQ#tT[̤} ˥xn&7)ĀAрO;+aLF?A?($}!*"$9Q=T"'< 'eDB=D]F}HJGq(}!6U )q2;`)6"_1)PԒYr=t]v}fN4hMybc]i89x/דam&9l]'lӢw}٘ٚ`(̃x/!/˒X7Pӥ185]$R;P_Q p=]fa##-~\ǂϲ&Ͱ[}&.fĔree ʿk&nAQkE'G/U|A1 8f n?]eܐ=`}]'H1|ɕJh^q5^l%\i)Nq؏$((3l7q'[A>#m` _ }d; >$Ο~!>k€I8BP$9LO6TLb^CYY2'TX%]=""# WwD>*Xc!iR S%b7 ^~KzK63BAlnpر1Q)MEm^<;f&4"'Hċj>n(B1ty1_z%I%YTcWEi#&R Dlj_zCojHp2O BP HJ 0{*LߵL J j:vzZL` >^o+< C_ DpLU˪>yKƁzYO;S~-ۮKЮV O> oʮU r8X `?so  $A *T`! %NL.(nL0 ' IP2A:tp!舤k I$J#N(x4OˉT+<02'W (Vnd֭侥[]yQa0 }h_3}j&;d '}x摙ĬtD2criӨ5;ܷVtcin3XaKJZƝwŏ/phA{>>H>BH "F4bK*j!#7 ͦPX8*TApcBB`bgK 8N:#̸j&)D+$!Xr*iΩ<K.K0%2/h jNL(Kǰ5KGo2Zq(زmA !"@M5H*Ht&̉FCRAb:6Mh Q",<: )"cAz I5CB^WmJDi-L-tYhk4L t0Ѷ1KIOLҡ> p"PQZ~ Yx. נ a= s3 /yL(SH`Sf `[v aܪ̨ fl xOOy. davz`zjejV7>:>:!{nn-zo:/ ?lw;`l0]hrsC}tK';u[vK"(!/mO{aw >~@[2}ywi]wyu髷_69GBЍZi|7|W`ߗ_[];WUm[nl])mw '@ E(, ~P- 1FjBB?l)uNǎkc SxEbY$XA>oXldT2+[9c6se6E LOVA$eȂNs:Cw9g^tBGІt]iL:Ӆ45iNO=b#:)H TV:ձ5_mkX#յֵ!Ymlbؿ>v=lVvldSm%޹,j W!3{󆊸ěn}ln{/8%Qۻ .ۙ vpPM?xT;<aUG㶹ngwJ)at tD==AB `x!@ࣀ'" !@cvG!Yj2A5^[I*?:B 0 t7w vAa`- ׭2.rg6(`"׮# t4@O!@D`ATh0fi5Ʈ8T}]X/ѓ^?9L6J.M4ѠrXT^wDOGZ ( `pܫ>K;K=0S=0t0>X&h1=ʹپ:H@둓3Q>ȫ;è<=ۓ3 !t "Ё ;h𽃐={#9;;D=lK=aD3s@:~ŀA3|4l5$(Q hE*ūr;;O<Y&Z#[4@\Eb ST,*4 `&(;FJƍp:H791ƽxƺ8<t=9: FjFS3;B<? }$='ټB+C8h>4LjF%k8m z{H ٣ěF ?@~ C0wˣkǝa| ǥdBi>Tw| ?˫ƨkB dˡDu1J?| i?@DԩJJJ? hGL;<<H̐F+Kxt]NGmJi"9Gf;LT|B:]lGCĔفͮCD:$D{ CWsF<@Jq;<9A1>@ASƠ:=h@!8=ftX۲PݴtS+D#TۊĭX5 mº[İ*a"eY-Z2ɘڱWIHAW POؘqXt>;>0Y3I1ޅCk;-i<=M ݅ѵ1ݯ1ٽȃ[f܈)I YItL:[Lk)-佻s˅_} Pk?qa<`a&532ie_ @0uqD:vīmі4>?)P샼mCAbvŊ8]@EB+~[-\%ZdUZKLLH Iʁh;C 5ĩ[̹JӺu9>Z«5)dꔜ@N ¸|ajB-F\kT޵m>9$ЁwȀxց+rxtТw.y8fj=67FrOrxV˯}8OOMT]0| a :h EdTxQÁ x !8bMQ(}+(~/v@OCW6hHh 6ʨ(ySUv'ߐ+X% ŘR@t^քЄQk}ۑ\F%"D= p@"G%x(fJTҕʹ2 )P?Dvfc@19Ɠ^i(j)QI)I 5x: $:,mTi~@@o}SzU+"oH44 pvEJT1z:ny{7Xt-:GYvKgFźÿ9,qRŏ>7,C>8ԥ^qDQ)UWmY/z3W6sm\r,Ҳ%Q.&CF`-QRk}7y`Ayݷdas9=BxOZ(wsGT7Am}%70KxH]Pya=kWXek⍴S:7J7ˉ. y*@3ߐ#'4FD]xD tRM|b ~Oz<:#B{yY}"|]9qQw? #vH%{\ 0j@E!4Bޕgj;(ΉpJ)C4Pd4T u+"vAҵ0q!9 oCx\DӀh=9@'tqS`51#TE}n璖.k:# vzۇ"L/45qB$CԸH6v)q**PdoO(y"!ܧ@1T"#;ɘ\:hK]$Ԅ_P;"f"} C,bIib ;?m;,JЖ , Erv% rE F1gw,(׸=I@߯V!=Hk?smj'ݜaJp[6|y2])Dx@[:`LpfK2>2 ]A`2"weƒ&E/ȏ- qfRgE Wk Z23a>W,$%  @u$R#$Q"[o*AdG0S*coe_X3.I`9Z9Aqh!?;\e2V $XoWVQD$0_]r0(nj1Ǭ@[5N?J6?`&_JRDu#: N%c 0VY.M$kW0h{D_x,u OwГ>$:@~ ( GS\ 4 \(D`_Y5RIU (؁Š! @ AU lߪ%>L ʈM^FD@ R  $D!AaetpߐD!:t$@a@@ LCL!PNwL0H HR_@EڀɢVAC":.bKa@ebsT d hFq(*G)U*>a¢."+&_.Ң,*b_EJ`(Ț\]N5G6*}c,b8&#.c8ޢA 2"`*F(^Y0HX csdwtbA$#:$L9*,C-^t5a1&AH|䡃I懽@1J@!4!W\dXZX*A7VEje/DAH(E4%ʏưD LĜ\^] #Ƥb.f9d^A  SaJ$c&ib!HYE$Mxfr,:hdibv8l!D] Ѐ^H&km&m %@;"9%op yZyzQ yDz'A'bz}~}h=@{Σ@(h{'.>(A((nBCgJRhZ@t(b|f:lbkj뷦>ܗ,¬֖arK@Ƞ$D6#>D8C9-Қ!#*E,:XrMkz|nmئ-ڎںmײ&km1ŐmAm-Z-AnnB%$.@ .*.NZn܎׼Y$~ =t%bc+׋ $9VeK :BʢH17b! &&m*@B^dF \.. oTfVSJK E\:-8&At-v"9"#'Pdm: Ҍ,rYZFt+ڨqrpe"[[" 0XqYe$@lr@ ro  LXj~' -PA ) AqWL @Hb72wF Jqر,-@ѹ|1 22W@#;r@(,$W%KJtr 0AS:r qd2 0-l+/&FF,(C2-ϱ-߱(s A9HuA)W @H-Hp4$-,5r-op~QiH(sc 2sdC2u_=[p`aP>s6Srp5up)/:'3;;4D?@X&E !\I+@G46it:$/'@*{U*1BR rC?tMG@\#LwaAp*:8A l]GsRk3@3xگ H nu'W?XE*"uT=ri\. @]Q?ij,'98/Du28Lud5Y_@ek @%LD.f[Aa!:w6juQ6H+ns8HpW0oCdwq  ds)Xt+Z+uA[ZwI\6x bwxxuyys~ }0(g;v;}S7r7 7`xP%<8E,7&,ADctw5R6%oAtnH0|7s}Ǹ} 7~ x@t@k28-:-|#z,A)S@ 8x \ 89Kgs8vHW1!|yߴL&Wm859V9Mdw7879 F { @l|x< p@ @ \;[:kzOox:y5©p 9zˇv<: 8 ӹ1K@'7 @O{_W\ dw{W9jLJxM- K|ɻUD;~x:z+{l(V~9`vmۻGD7wp8u `'œY{kGD0'fh&(d ,P7xF` 3:, :(!QP=PP"&'#H P|7^|z)(ta.(,Q:쪺*+NJV($CK<ػ\(!/ۯcP5d1 =Ag) <M M%fDq!dQ BbBQctCdбfD`l(I*Yd0@@DY ?ƈr$yb.t "m8+gŁ5 L ?f5P \I0(@t3<@ |%)u$NKnId@l"R/L<-裄41B!*`@eap Eg $L#8a%BĵEd+&!^]ض@F{t8ŷ~%V4'1bD@VTpP+xs͋>:Y |~kp%ؔz\^J؀=)Xy2D]#B6Ƿ&֖߅}H;j g qwr)or``#KdBOCusb7AvCxl4 V'PpaS< E7ŠpS[ G-;苜V׾o~@>>KA 곺)uikw;1w i0$(x&36kȻ %RB2ޤo7ý|:Pe,TzYDH% vTKwELQxVTD'XIKFD B W7K(\ hqrT_Z,B5CO XDB&1b(5ҁRMsE\%G4?d( |T@-)[FP4e"(#ȟ6D1.3439Cl苚6Ok+"EN23(l,)V Xg;yP#;<ш$l7z {ⓗB. f$(P@(&BE8я >*. %GRnp!`8_X)怎+ 9':j1 t66С{SCGҐ tfSʵqa@p@0th0qF|,/QBH:2c 2 :@ZF6mV[ OԢVJhӭyKNߺK:֠C)p7Ȯ ȢC# 『A{LlC+xP֌:@=k&,0\lNT H`*΅.aۈ@cC!,ԅ/y͋^p hqA_U&D4)hV,E&):W8}k` 0ʣ`D#]β,gY=xP"]i4C$j-7 0?cХDUKa*SYւү+'!P`D*W55$jV$6͛Dfuk : V #,S%>ҏA /"fQ gIq #7,[5^PW@ܝy lYO T Ҷo.q6.iPA`8Y j8pͭ6KC\j'Uc@aYp)anNZc2f׫oN:}_9=}xs\r)?y2\&ՠv'v,z9L`wp *>u"gA _|0ffB"o :>&ƛk?x ^ƏT@~'ek~_EdBޅmdH+ O< /pO>o/#? 4)yjk7oPTPp&p+L >"'YEeMT $0 NЯ/qL+."bcF ]R: y r@ gNl t0 a +h-76BzTO5Pm`ӏQ "2PE%D&(m, 21C nL'DпeJ6#hqal1 Pwzo+ŚB@ /#aQz`@1ӑ $IhU) Q q# ! r"@C6X!B!m p4%1r##I!(ihNRh-%%8a :O1 i"oP')P#Q !8(!b,e-K"_Rr HaQ,`-b#j1C;ăV..S 2l+r0'H 1B_԰4]cD&Q@'21%*[$b&+'20 34MC `R8ADϠ([#6؆bRrp d`@v{4ò`8CDDCn9%*C<Ѐ8ayu~3!P,; 2͓& 9_ܱ3Q n1RL`??1r T @2AwP6~aBHB *C=*/2 `:. RTmfAS%Fb) FGF̍$G'Pz0Qu(N@ae448\smET,t4zˍ TWL%3fR/ \`pkHa8V_ŠhAidab!%yOiWV obwd8Ap} q Ȑ 7S=u"&W*w.wD .h]mCD%l%-n Jo5b@Gu 8^ m;OVtQ-eiImRPVwF0@fo0$ 9ng/0uSXXDT ,@j8Ԋ)w%SK6FrRƉXN d X8.;:.{m6 ^v얘MU8[86 #I ĊNӋQ"i = 09Y.y xR!3nkE,q/ |wX\y` y]7` f; (=Oc"C%7S80<9VXY_+ygz9V B'6 29 1 9ٸ'4CJDPWWE 5A뙢_٢cY%ف@0DڧAD dw#!jhO] :q bz )xt:xZ668|WiD 9ܴR@gzk1z5ZDjZ~y%XG5o poZyi92 j ~1KO7#%~_O 9#۱!'"M:s0. Uq$C$ ;{)e`Hz7;T;[ҩ'ۮ9yi[N9x" ;W}ۛEP;$Eigh;[@Qeت( 8xw|J7| vC\w [Ŕ@$}`6[+<; \@ۼpU `FɟG| |# f%_\Ѣm4!^_yJ ɣ\1g \6&G0l+ܵ YD!P~w  =wڅIϒZwv"(e =KC cMs_}-`)Ϡ]G~ı b"#b[&w%PPfI8]7B!@%/An`-2!c= 1XR>A! lǵg2S:o^fU@ @ `|_`+Z@s* گX "G(a˞naJbS*6, 8kY> d[@c`_}éJás|/*``Tuwg@R@:@/{zWv! %t˥@ gDEAI0b+Z1F(:.ȑ$K$ :#&T@DDp!4X"@$*0`#RN J: $Hh5F7>xAX.8pHlۺe(,@"/ %Jl  !B,h-$0p2ɔ+[9͜OAGdѤKs[oN w@we,IȠլ[~ ;ٴ5F"E"]v_~&a܂(20&4Ga^eD('Z~xaB$!q&vE!`m0Pp;$Cq'hQI܅A$M6O> @YU Zq`%YfUC8'9 K,\2uW^/_F c5.h"='NJI%1^bF@#At$1D $iݒmdSgeyNe y^cw&}5'9gY`lPi{B@n :Nn)F0:A9&b'8|5߅W啿^_'&|eʇl txzyMą%Z2,n4\xso;lD`alC)-pS9iY1{`GB;x'_hX.8w~'0)DцNmtI#&0EL5E $1dw[*Mͱ̂ҖL XA| /BO/uӘ:6nNp$hK[FqJZEHrMl$k:k>@JD cD 7ˍ$LXH,G<`AK"P 'B Ƃ< #OH֡2s@q!ڗa`(VY"@9B,DYxC)fP|p ԧh*>!HS{Y$2Ƃ"@.Όjt\! iBK<]t@1K_ SL7 ̑n| FpHTb3A9B| ZpFfS+pBD=`^@R X@/u^hC8a ojӚP0* b 2S\^MQ qIAz䈱0A$! @\Dt b k0,08)e ȳ t] $L{B؆"62ԩI xp`4= mTD8IAcHi2BB?ի)6q*tyeN@a/_N)A"9fUb5/|/a-3He eB* =( XGd<+<_׼&0u]a]=$JLc0l r+;O7q`~rv}j` 9Ȉ0yOj RKr#9º@`hppjL D;#“3ZQΩݙVx ܵp E(mRn'C=k%0 ,kq";,atZi`t8a#b; Z`8-< LM9$vp'aпnI>zjb+:0@ {# esC~g-y7zP!^/Fs 5XO9= r 6c?H-wׁP'O[Rxu#\#1s:a5a68tW:$[X2z'zsPNsX `0L^UH}=a},_Zc7DCh~G膤tH/B)ȇ+>%?6CxmuLXO6X5}…`x,c orP ҲX 7Xh׈͡qӋM3D,(ŘH!Sl|HHRzhP >!r `F {@p08<5q& `cX! ?2TP2PnV0 0 Hz  JExxq`6#  P`@{!~08P 1\ O h#kf ?0#gdP n-{ l0 +\ ypA)LdHX + Ep`%_M1`S p10 S` @ZtyW rU z 'w@p3 &p9Hd9 0ߩDpxre Yp0 p>p0\}d¹&bp Q30zig'4ИLȝ Or/ə.@ @b bՖ1`^a /Bkb &np yzp 4} I Sz [Pee_܇~ 8I \P OP@obb0ffJn`j(fZ0^Z+% P`#'9 _b!9t# xh`8= j"݈>ߘF/WI1Az66uPJ4CI~苀%GQ@ A`AЃ}1똈׈ʄ*j4.EK0ި8ZŠ ˮ( 0+RNxg iڎ*~,ۆ[Jd1;QO}8ɳڋc#[AP@bIK@@RrBı+^ PqYc-`wj&k#=g{[@v <X 27`Op:@iY܀ A 0jخtu@0s˽[0`@^k<"x00 wPI{ HIp a` Ѽo @J;;IٻK*8 `]6I1 r 8; nr fPKp  <uD00lģaպ߻x;ˍ0ԀG"%21 gB˂n7jjҸ='D|wl!dāfMlP>8 V"'A c[(0 𫍀c,? 7| z0 q sLjD ǯL6K@0@{+[ #9^Y |ɕiCqpT{ \İ͔1E%<)vpO1] PG> ; Ow AY H 0qJt Ѐ ۲ {߬'[Lܱ_8p ?AK%˶f);kL =01Epj`҄(k ?nlVgp` 8E=ScPhԂ(IefجD [_וqV3a݋!溰nQ ډP}pyMٖ^!7~5T/2gM/&ʹh0ٕ "1tPt{G%8HmE}?tگ۱-v@} Jɉ#=ҬQfÍڪۀ5m#qx~-jBQV݅ K-m-ǎ-}Sx39Pߢ-ߩ߆@-^ѭOLݻr Mu n).-y^M-Kj@*> ΊႋQ)= ^6NL >RCį-E1}MdS=nmr8mg08cNMnOQsoRVBp0- i~Ӄ^臎N])|pP ~߀Ճ x韎 RwCֈ ~P x`빮r{ KnJ.v#p~JgZ.F #P\y}Msm#}(ÝY1 2 ] @྇I})Sqe~w m. 익DiBm e -X]쭰!+oN|}! YxI ~3r߫ !@Iω°X9%UQ'cn=؃dN k5v&/doge@n,0P` d.( QY&.v $E!ԅ~Ծ0 - @m M|\!?y __지+dal50Յ޻5%STN@ Lw *<$A"C#DpA Bn D$hC OR޼E1b|TTP6lP-Qb (< bUG@7~VXe͞EVZmݾW\GW!C%RQ#G R)y'ȕ-_Ɯy;\2Ks(rm @_1Fg+#L9PQD<@R\p'SH! tb,0-AB5,p 6>Cg,hF7߄3N9$ֺqAN0:Z!4Li>82%|2JtpF+K/[{-6H,7v ڤTSOE5U@<ÑAOLQe UUo7R;H':H+OtW@E0XWVQbE6I}.319DPrC(7b'?VX-us?5Xd{A7Qa-G]Rg2LMgCO5+:hF!V=B@WX8RPהQcMJiqVgl{y fmߞ*ieVA^!o?. p 34 efoԦW:0 TP%{ljR ?GB)(*TAp;&qDY5lHa(.3m0@kQVS: r% ]LNVA: < Em|.%(6;F|)@CaQJ5 ^p֊ev1 ntt Vʻf.] g g8[ ТHᢣ=2WA n~;r`iT#GK]A ۨ7H`\V5?@+ nK55op8/HA$0&̀=6$0@q\#<ͮ鄁aEБhAȃoKd,r4UӶ~3&AzË7ەD3ш:;{u` iR‘q;TR?րHt6 @ j"bL$Ѐ zё Um:[2:ʹ] j&G6$NA=);\0E S}涬ww\}*Bn_4 ^[rQ0v@>y; 'Pw=?Mv>dЅ+@m0a3LKyЅARIa A?pp=yxl$(vǾYT()5?\A!mB'()U? H>V86нȁ# !>s \ 1(,xH&Qj7` 0I([F.x'(H,\-Pgj'P;Š[H9 : ,L7B7ȆCh6, PH7(I0(9(p@  9T;PK#wwPK&AOEBPS/img/getstrtd3.gif'oGIF89a_vqqNNee ((}}^^11KK99RRmm%%--PPDDBB~~xxZZ>>``\\TTLLHHdccXX##cҙfff3f1e̙fԬFF kkGG<<44WWhh@@3f!,_v~ŭջ~M H>YC(Q"FBŋʱCG*N5#6|X  K6A`e@.\F L-j3j)ƧP&wʄ hժ/԰Uk zSr: +ib\EB/eat FLP&rJKRkJH4aСĉ]j)=iz3Ák:,8AᏌ Rv ƂvNe(`T#9 蘹R +Uu X&|8K/EY-XXo9Agllr)X` * W=*QL걨Dy4ԋ2XI8cR4i`LPC}FUid,+!@B < _PXJ G Р]$|*(@p᧟Ԗ z6A&(+c*ZMjh娤c J/Ar  `@,B)40`F ³ޠR 3bc'q֊ gIZsB dC0P8@u`A+vR!ՒK[c~-n+R *4kߘ6@C…  &$@7o)j0P?B 6T1ˑ/j*:aˌlJt׽ٓJ4%|c1,@H1@!¥hhX-0! x  2Û`amnv@r!ovۻ3Gc  2 (p`&0/,@CC,psPF ;@-LSsL2v`m@-0e6ȤwA)JzWF( # B #hC) _.H.{A +(UP

πM2wNtHF;z~'HSҘ3NbӞWQzԥ>9Uzҭ~kTudr^~[`־M fٳ} }0[V6 l?ۥ8e1f`w=T^vo}[ηOn|wl;|x oo[ݝf7 NpS| Gr79}mwro3G]nV8S^rq{7= ̡o=ÏrhVHC<(RxhHmaXpx\Ei`h 8H@.`Nzi$ x}Xc؇Xd(h(mxq芜8hPȊ rjjx茻h،ȋaLj{xXwhs؊gȆH^x聞8OMЈHW HBِƀxIIĐyMe$Y&y(*,ْ.0294Y6y8:<ٓ>@B9DHGL iٔPKT SYX9 W\ [ b `umT r wI qIJp}x9Ő ٖY`!gSt  ~9 `pIIjPi9 Io)9e)IY ɛf) I y)eI˙ɛٞ)xiYq9ɟYYɜ˩ :yitɞ):ZmY "ڛ!j *)J' %: y6=ڢB>J8ڣ{Y7Z2. .ZO & Mz8J< (TjhY?J**Hʟyl]9zvI|JiJg+Ju~uyʹڬŚ庣ƚ 㺮:ªjfaڦJy*ڭ[jyZjGZEj{Q:J'륞Nʰ; yjʣzș˳JYc詪Zyh):$ z\ :jjjkkWHR Z5 Պ / DB +qU~ ;4 [Pdy%p]YР`VB 鹪)zM+ +Pʗ!I˙}_ɺz ʋKhi;ʴۼыSɼ۽;W Oi{+`*uIFK :ʽ٧:r˭Zz;}fmk w{l?.;\Z7ߩ[l˿⺤t ʷ\ lx;j ĺbʰ; jH\CD̴Vk?7j;,; ;+ ;YZ_] { +z[EʶY!g+~,ZɅ_\즘ܬ`z Ή { ]f:̧^NRg^]n=DPhl eF~Ԓ ΋\.~TB@~y[[~[̣.{LH 4+e\mq,LIzzƑNlʾ>KWn?-Ρ|]*;-| R伎M Ǟ^~Қ.9L]ԪղJ?c̿2VMJ^;@'`}=z>eވyjXۍ[RofMۭqeBZ{b-~plOޙ{E9CX-&~!,O0)7}r; <k~vLLN^:T˨;ۨ\\<ˇ}\Ӵ۶o.n.ON!?Zo?8q ~~ɤϩܼ HÇ#JHÊ3jȱG`I$rȓF6SI$e/?ʜIfǐ,KًN6 Jc?#BiӜL.rΨHTN`UEӪ]vQTNtjNXzhߗw;7&\m+^ܮcâp\ZlT˔ =-ӨSStu׮7_ .Ve&uMU Ncޜ;\A 7a榋k}“%{O*uR&u4֏/o߽=?Nh& 6 (]DfXvᇍ$x&ơ02hЈ<(>)@i+LvdPF RVieqT9[sHQ]xae@)Ш қ|I[Sf0w*w跧3~O]5a*Z+}ZT4i?~.@j7M()RSh%vKkb(>z,ɫ&uB-+( 7κ&B>n+/p*N_.k+J,,-K+ꏯª.i; J1#3|( wܬL.q%g,,JoJ2 <6 3,_K:Włn<4/+lb=oHWjJ^-$G;Î+N538ݴא?M4HSɗ=ҥ7yfꍗ}sӎϟc |.:T/o;.2#O)3v+m~|S옯9-?Ư<<#v7jih9W:Yo~3e+ZޮFz.Y_ۻ%,Z-qt^BSrj ‹k. K8ٝ0(;'Cr!Tq 9=8jxy&^ɦx\\'e`VnXEl-!76Fn[]͜i69O2<.^X#fd/}i3qI;PU$2 Ӻ42|G=9r)f9|[+N^YxƠ.5>6YauE !Q EZ/4e|aX"&딣߂em-y837E"}%q=Ӱ{ȻehcsD8q-HQ5ä̈Tab .\t=\["G-YyzX"05X"˕v3LoUC!|NVf?Gf?K[|J ߞ}~DOs=W>ֻ^e8(g=s짋{8y&ow7SU䢥vS{^_a sbHI>_'o٭}6JOo;ey*R׶fIm϶cŦLfbc`m]-:ta"F>fal!6N#3t#yfkWVkd6dd`cJdh}?cއcjiEA ccKɤD~/RKHޅ=XjqsUhed3s:SE h1f4V]Xs8wViLagfմo6Nc#Nf:^cM(jM$AExjth9Mhֆk9g8LW#B8cj&hk}Lkk1kXdcjV扰j-xk d&lFl"l&`FajCln䖀ӆnF^DhXf8mHs/il04EdaG7Wp?b&}BRoWh&Y^@% )|wxqY6XQGqx tU>pp$װ`q7q4y఑-9!#r/%sYxL5?XNtr3w U'UuvZ9UgwVWnu<Ǖ~euS'tV}wWV!XIRv~UeGt7Wbytv{uٖnaɖtQgח`BeG'wpuŘeeXvbWprw{eCQəwDWUUrﱖSTXSg9p~Dɹ\TyYyY)jם)yyqy Ypٞ_9U ]̵\Y_ $kbAgN')^ {"7XF T^jpx>ӡ"#_J_F旡ՠi|b.ӋvlnC6b0ƀh7JNv.$=J%gFnƣ݆hH"Xnk:3*c&a!djKxc7ȃΖODN9Od0C3bz;=*sd\>f6ۨKu 3@k*mg:mAq0̄o.'XmWa4IbC 6i_dz`rX9ȇIa(9q{ !8JXc-b?9kʂ=_ڈfj襸ӥD(g3MO ZfMҍdo!d&IȪF8::JÄ".rA®(DG[ [& z*%ǒq$ 42[,{IiK)7 aweYEz%_5uDKG,]yhWɵ^;AE!yjHYOkb{mUfh$Y˵1׳z(yVtz`kU;rKEYy{$.kS0k[uKir>{>rkZLi;|${ͧGX;ŋz{6GʻKzzǼ;y{P۽ u; %+P蛾OM[tKԿI4H| LH ;D F "<$\&|(*,.02<4\6|8,l%@BTjRׯ`ÊKٳ2 Э۷pʝKݻx˷߿ LÈ+^XqڥKL˘3k̹gLӨS^3MmCmM۸s޽wBj+'|}+M6q*ۀfϻ=6Ǜw=~홧T>}5_tH|a[c 7Z_ǟ]Yʧ~}WH߉!~&_b*VFcI`; [u>~7#rF&^zqNRidKVyb."L6Uc],Z%I!tipH^Ie}e\9fRqIG*#1أB6DjhVja꧒gsZc*k暪j*:+&Klꪮ*(6:)6Hum _egJe.ʂ&좣꺮v)lײZἐ*i2aӢ,' ߸w^ n,ʗrܰ/v{.\[h@ }01\>?.9 c#K8J ` 'h.\j'sZ:C9wڱ3D/wJ3X8Х;viVge鎽N賛C\Cs|wtO=7)Σv~tM:ͳ+w{t I.d)}i˘Y_S"O?cCΗ}ۏZՔoo?+Hd:00{'H /\hɠ7z @(L W0 gH8̡w@ pHL&:PC#RX̢.z`TH2hLט1pH:Ѝṿ>x IB<"F:2|$'IJZ2̤&7ID"0 (GI/bL*WO򕰌,Sx&ᖸ̥.w^ 0IbsLkIBc:Ќ4KeZt nzĦ8IEfL:Ivs\lT[ZuouI-W֔ͭ5 ٭v{HOXҶĥ*r%ێ֦LuKYƳvm.QSS7ۅ,bMkZֻmoU[2q^{Tb7mWk[տu-y2PQ:VčoP`V8 fn/ k7y0vAUxPME?Xް++,x<1r;וqKarxPa=vr<[y\s|2_R-|7Ymf89sE7k_標-/xtcD']t iJzm^4(?:З3fyфN5#|iIkK iXi9Z̮sa}aHoֻFt;H{X6$T%a*ֽn[mnsػ+YG޶-}ng9t]G:9}a7vopjzoMr8Sp;s?zne.O7O~ho|m7-_Fzyټ6es]7lS5?vv&gh3~gu>8mwoۑmoߚNxSn׺ao~_h">vrvqO{n>Oq>Ob}{wr{u}}oxz}(| '~Zx{87|E}ݧ)xG7~ ,xz7V6*(? xf,{.Ȃ{(.x{3vW7,{g' d~w҇pD}7v=jXc8?8gWXYG|kH(OxDx}7qXLoAHZ؈n(h~Zȉ|&؉Lx8]{@8|GihDhh(}8vD~8hO8(v(DaX؊h`8H[(X稆Ȏ׍C8YȎhXI樎XII萴Cȑ 9iI-y*츑c8iC0市=?Eɓ5 >YCyCٔ?ɔ"يCGɑL)[ٕ/SiEd)C's]ٓhSKpylK l)K] ؔb)trF)q)yrie-ԋ8PL(s oy@I}ٗJə٘ymٙ9b+4GrIykIY9RٔIɛiIiBgOy owITix)ɜ9iNi ɔ)iyʛٞIY ɞɟI   ʠBٚJ : ڢz,"*Y (7J$y3:Dʣ7j) H:E*Eʠ(D*P)ʣK >J F @bZbzeڢ2.GyP:mjusڦ]:$eL pz?j2JijklʢJe YI*ښgJ*:Kzd* JzdZjZºRv ʚZlڪj*tJZڦ|J*<* jje*JjʨpJરOʭ˥*:ʭKڲ7˱ hڰ[ +d:$)? = MO@> ʭTOQkAP_۴e{8_K"kYh[TjdN}[dt[i x`szO]۷tp;u Kc[{+\+j;+K˹븦l˹pq(N A  =Ph۵‹ŋP뼬c۵ۺ;eʻhNu{d+ǻ;{+nkK_{[˶=@8ѫvٛsKLNȻ\!l[[|›KPhKNj6ܹ-|(,ܺ<l\B\JL 2̍竾&[G|Zk.L5]l`\ZM}ߨ=1mpm .!=^W88p>N>ݺM#~٠ .&$!ܞ.2 P j7!ڭ-m@  N}K~=pMF>}k=a-í:P P P  s{{0~V  P P `黽y.諮>뗾 }z. 苮 Ǡ  Ҏ m0jp^p~ y~޴~ {gN:  > @ ˭d>D~  π NOn^~>. ˀ _PŠ n.0 j &S). .mp`6?Jnt_=c@xIm~ڐ˰ &O Po+ ^ `oNo/^i` .~PŰ 2`NwO=>>g'F K 'b/'` jO @ ` n_zC?nov $PBq*ZܳGReQgϐ,y$JFf-L/]iX0zꋙ_E9ҴV(bԈ+:*ER1VXe͞EVZmݾW\u](Afb Jb7i|8gI,#(Od˒IkZtkYW`/ "Ɲ[n޽}\ނ*5Fle̚KŔ)G9rK)-'gК9-MkٲB\je?߾0@$0-:ί,F=4ل^ɺˮ6$&4, =@kFkȚ=6"j"\k),H#D2I% <иrC0AZK<\Z,U&9ڑV;u9Z4Xa%XM,_m3JKѮfn5`&̗eNM3SUs݄սUti:5:3RzmX}_E}jh8ZF&0Ӯln&\M<1EUt7?dr`]ޔkd qYgf,QF9f,Sf:23Ab0ָ\=~]]F@VNkV{gM9mff虢=Un=kiTCgUl>zFk|fn|1G?=&˃+oQdi&c|"eo3N\;vsU[Z̡<=/orӟoy;%G{O.gg u_dL9U'e%==sk6ˁς`'zS6qdX}04;EۘX WA-!6xywyr./zbx ň^Xx A,|p0\ѹh$U4L=%3Ɉ1;] hDAFozb"H 8"x6bGh db~xƨ nF7pvWM%MRe%S`D&2J~lC!\ёꀱL|Z(XJ4l4)6򕫔+CH2s%0w@sF'0O~Bq =-KxVC (FQ\}wq 9qW󕮐 zl&M*I ԃgLe*.Dͼ._jBTJyO4mwEǙqrN]e1V iթ0y0IXVêS}ԬgYM՛SzP&akD#щK'Tb@Dvր2vdH#ծrŬԚxrճd,ELYhHT^ԵИ`jXJUR$ ztl)4E֭EnrHe-g."Fm~k/zNEoaoXD#%EtlUn~{}t' W f$ˮO>]6CU–70zQ [b4ތ'FqT{J[oe!VL;Qब'E.81VOmz;\XatCuhB]Ag6M,wo3oU롒vA܆@8d0W0{%I.,4 (W8-8ialkB?FjTob6qu2gGx* CcV3ы~4-m'_Ûtm!K|:wn [Y6|gzu͖99k7T&OT1C<)>lHO.l* #0{9??^$ݭr{`/Xj|<%lQlϮ@UlF 6m%m)k[UE,. W"k5sZ:K݇/sU}i˃ o[ GT*ZJM/zE/腕1=L"QxԥLdZz懑uc}uAjw})v^5^}Wٻe BB<}&}wz|K]D7_gXpgۨ.5ϼMK>ks>^PU꫾<>>o2u2C;=[|s<=87C +a`ܰkԶs<\@JP EM8C>B\ 5 +FLȄ7-3B,$CTƞʛTT2ȹ ȚLtIh\JNjloH^(LWIDߜt=tXRƟLД(ɹt X A!K، ō|<ǏMM4K<<ܾs3,MU XUuвЄP( e m   Ncd!ITџ4MbąM:Tt܄OLLS0Mw>d KEDQKT}PP= Q.5 0E 1ҹNT5UQ,]^(O,=QMT"!%@̼%J++BH6]56H+PT, TPPRTQeRT.R,Q=UXM=mUM+U uT[T U^%V4ř= 6N66@@[ X;QH"? RAT"ŕ>7C3HK*J}SLPf``U.%VSV]X}V|W|ׁW_Մ X5WbUc |HT X6h Z;VWטIPcԯ ˌ6~KN7}W3-X}eڃZ׃}إMڄڦ}ZچUWڊI=ЎZJڎ`hMjmm Gn @֗5TKYлFOvTX70 ZW,UըmUիZ]-۪Eڮ\\}\}\ [EVXeֳ5H@V\x[%\DLRpKJt-DCD̃㷀\ׅ x5ڻUXuZ^]U%_WEݍ]]6B1_ͺuY!Rq[-^L3 tT<0J_ Xܰ\-\]حXuP-_6]X=ֽDz5[`7(QXR([o4`WU>VIcW4\abXɍU=UV шQ8԰xcҵc`լ}]ݲHaC>58!R plTJOEƄ)ƄIOh`C 4=},dC0.dWfeD`ya!S /C~~U_Fd[Y[0VT&NKdOe$tsSW,`m^ZaeV:&[& veceX`ee݄[Y \X@]bhYi&R(fNPVɿm &Me=q Uh^~_gqTXd݀hKL~MVhL*vqih. vWf{&rNFY&]&gaNj/ڕdݴ[ Bp=hfOhvԠbMLyhqf~~`ꤾjNVXRJ^>(r 95&uٗoXgNĮmDivN&BkLievhR6enh6mnm܆m%n۾e#W>4~6dfqlf jnҾ4\NmvmnlA& ^? gpܦFnټ=`oktE6S`Teppnrmp pTVh$Ԃ~J.eRo+pi.sFo3s7"s6r.r6q&ż(Nho>,m'/+m17l$o,C~T^//I7lliy/Sogܐs2ewL"WOPXtJh]t-^wvw`7s{vway{~Gysjoe?vƁMNH@rl*첊gtv r7Gztwa/yz2Oߵh7'sHK΄JHwG{gwv/-H.n]~`oyoyHpy}w 7oyC@|Gﮟ@PJP//p=GM&isx|`|w}Lg}2zG|{g}7}zX|a?|t4+(@(|7o&wz|'}{v}~o$nKP|7ş#zw~f"`XAhD 7 Ɗ (i$ʔ*Wl%̘2gҬi&Μ:w0@(L 7FIF#3>]**֫bR@Rk0E`m-ܸrҭkLD"}ih-ZC.*JGV=LP;vK^g*XP+b_1À 2H24 2z>x Bf`>8!!"aꕘb`w#9cjC֗KTfz"1$grdOZbhS z(Ҹapk{,ԩk詧"ۢ>쭱 -m5B:kʺ.2; `:{o;Ԇˢ" h Oo;;pĩ{17K<%+r!oh*2"{j,׌0# ,31E]-[2&̴撜o+ -T[4*Lvz^s^7&#|4qV,r3׫}2 UKwԞ]Mb.݄G}רy+ߧy{#yR:'_J:[;5wr|5=C4ew<ͼJ~yg=Wuw#_$r.5N~`~(<OAuj Hp} sMi%#\FXO?ܞh&qI b GPHbv-'!X L00a$F4PSlP`#)ȍ?/?1|c"x0z$#iLRr$Oy$'5G2d c)x$$F&Q%(-{eҗx$"f28̲M-K"g25siLi沘$%IuNs r}r0~0#, S03 sa!ĒckWeqnfiyK'^1[x(Fqk]c$5=Y )SV2-s^2,@S'Y#'Wk,co~ ir{5QvbHZֺfur}Y5l;ԶQpK?S}UZ.8-_ mRߘ*CnY+㠦65M o}m'Hɍ,l|1S퐷Bg5Uo$u+%!M:q5fW̧~t {8}kZ3Ok#<w~ߜ>j3ֽ3j;LP/&p_=NZO)wi{pWetK^7xȃ>Bd1_z]ؾG^O]7юmG?/%N_s'?_ J 1ƟD i1_Y}Ɓl ¹~ޡơ!!i D Pa@X a#[}!n!'aya>aJD!*vb)!!).,+^1Ja1K%^#Қ ra%Ρ52.##A x! ܂`P $RA_؀lH @>== !(Ѣ+bݍbAKb@-bBC~@Rd*J.&[J"%R %V_&VJVc JZ^dMKdL>dL P|Qh d_P HU $bA@<9ޣ`AУ=#b>`ZR@D(^BC'n*U$-"F%A"av$2Kdd4##^fQd:HN@Q%AA hAh Ub l@`|?%Z`%f cj"^d"_$_f[F.uƥs"wbrba雈eOd#deVK^N'eN|Z&{M$eQh@ ART X=`-#$V FzRVF dC> '}Ο`ʑ*aVdDjbh+h>'!]c'gb(1v(nez2fq&鑞pf_ f,ƀ@lln#|<(jWBi1=9n@fċRxꈑҩ&V:.|:*2Fj"*ihx@jz6*F*:+2jAf@\ 0gH cX$n(Rk&+)fKp( V'.jn_mpj: 4Nj^lVvpv,j @k)>kRdmJA0A=Nb 9RAH_9c=k,mfU],,+^,1מ,BJ,nȢ-W:I+- Ȁ^V"DA%UReʩF ؀H:b.:bmv.閮.Ixȣ㢚@nJV~hnkm9m` Ȁ0~"A8ցA| .Ae=):,έoƄ/֯/ĦjjܒmR+WF#Ğ7p/u@RnABoE*l 45"HA A@Q0RJATApPe0i mP-< v*C*q j81 jptA#ԁP d К# o֣R ر O1A"pvU/S0 0i 0H!q7sp6~²DKpw\{2L5nw\+ot df.:&g ot*S`A0"$5!t t (u@"t37+~Dp'\59wfn lHu673yQ"tx@e?@\Kz7A*@3A  q PvzHJ<9+z/9\/:I779<2?P%SplO@c9 +vAB.s02 -KA PK)w`3zvGzLG:?zu׷`s43zzA6+3榁+ ># Py#7OԴc;\Kt;IC;;1k rq7O{ L%UrQ A ۴< \:!&\ǁA AA=2S<"ǼK|׃_ǁATA GK |G AAydu"Jc @A f@~u rًٗs}q꛽|?AAGs>[t tܫk TAA& " K;A>Rķ{}?˼?̓S8 P%ݗ@I $FXӥ˘8VDb℉D?DHaD %KtP@M7qԹgO?:hQG&UiSO @RΜV% +ְfDە-,S<%.AxDJ$Ζ0Ê'AB†&qPVJNH ( '@~"!] #W_1Ɩ=vm۷qֽ[TV$0Xd-!&`ǍU,`̥Kb/•"Œ-)^Ŏiܔ!M!tAK52 a hH PB'^ ;0P 9򭪫 䖓[QӚi:뢛9; ;zB!),5fc2"pB;(A DcL0)@8@;S= #ų}QFRt./)C05 X13 0R"$(+lвN @SA0v#tlgVisiD8G_{nE }E$ BN4GRPS|tn FH/ȋ,͆+ lf0d8V sjAYI?rNTG#[P_ܘIX9VAiftx-rRxhcXA 4Hc744PB."-؊CZbb7: ̎%Zu[nj$1嘥9o;pGG?aV ERPIч @/HC"p#*"1N !VlCPF*a/xζKq ϛvolb yyk )j["B ;O:Ұ ܈!j<  x(F& a M D:-ۤp<% JJ]&p$` itV9/s Z(хb Q#^ ,m&帄^\ UC

q2 aQ[ 3\@t w`6 cL@B Z;b,r\]> eE6-v˓zwT+a#;P.0 \klIĽL0&t jB{*\Y L "(Fn8=A͘ /GH'bAڤ1މ ]ECAEo:]]ϜtΠHD6<[ 0 gscS#NW.\&5l! @A Z g 16m<-hZ`YhhD}b>ځE nB .Y HVQϠ0[ hN (9Sm'VaCP!t j3Ђ=`<6َrPS "]$v[vˏ휬"%iT҂w"a%+YթkLp1G;UJxߒ$ 4ߓ*C `M7 @@+/>M8!4B*2h`D <d 5b P.CH`j H rH)(G r":? @Бj4}oސ- /ymFktM3B8Rtڠ`|@f|P4v@d jPg BZ H@> 4$Rr2$J @4US@ '4KHu}FTTUJUZFKi%Ue:W-Ъ x@L@f`3@BPO` @ 2$h 2PTR%ULQ6@0^Q2SU$'@'@V?[`]quTI$CV4LG5X5Vt,0$I 0  >F v?`ư Ɂ€G+ߜaVVMU U%3_%S2Wa6V_S`TŔa^j Vy6])agJE@`&7 2 >Z V (5 FgS@r ! 5`_6k] UAUAS@AKa$6K2k4W-Wg]5LH7skw6kww@V= > `b`ȱDd VJ`t@]s @2gA^HvqITWr1 M$r,]qTrOugT-@}aVaEvT?`t`\4 @1<Tr?trַTOt`R@T@rq_1@h=Uzqϗz @_s5jaR~qn-wsO&@d)~N h @Vjpc `H xT 3^Ur7hK pI8yb-6_[@7]a}׆O5Rqz}@ $ >Hvu] \ TD "W2@"^`_c,r TMaط8_KX ' 9yY ƶKyxWe H?@Ttgebw:4nV3 JIݒ AUpS슕OR Kpr9kEbyTJbU 'I|T  $f z4r5ՠzx#$,ܠ2$/p]]ٷb'@T:W?T'$ 4ud U+b1@C:"@":9- 0 F4P Xz5zL@VHE1 hRQYSؔTp1Wڝ;{X{> jdB3:2bݨ=RnsTT݀4@#W\^%ظ;9{/:ۙ:eg? Tor 0fh_Qۺ3wTeo}L nǛ;ح'fQ _ W -|r1A܎n5I41 ţ<@R x`4`LIP; 5w L4U @3:ŋHF` F{c'H`WS< uyS|+6ᜄz͏zKS̛|_`@p`0@ b3%4,2{V |$3 >E-[uc@GL^ *ֱ|{xz]׍\<_L V`xHm5.9D <`M)= 24@$7uqj|.w; S|,@5lƒ;8ݫK9S ~nZ|sm=_?X@@h[;с༫-&e"2_>}'' P"z,LL>~r 'K[/:_mzS<|޴c4uaĒ`D 2B`a"B@@4KI`:&C0cI-|a=MM.%_dؑz-<~;8' Dnq}L+DN: .4&B1@K 4 \@nb _Q-@̍ ->``@Syӑzn9z!?_A΃=9_g.G. wEh;S  @Р^\p% /kx ;X`Ç 34xH#TEˍ h)sC+ 4СD=4ҥL:} 5ԩTZuj5)@&|H!aôT`BF@|I*OABD|!K('Y.bp\(,\А"N(O4x9XD0$ćABe̘y F mbȊ<̛;=[~ vEܱn7LURxB$D1D)vK9\ 20ɰjLp %d  '4 pb8  M0].c2H#UyVbm7/cf1-U)Y+8QC Qt؆'A`y( Z:tE9ᅊC"|`!GEBHp9^$@#: 7$Tc^inJF h>*.$2 $ 4A 3|}'d!IިnX^, 0Ƞ WA0 1CHDqlf@B*h\%>i pwu ý㨧q.^LЅ bvBDjAL؀aAfCFa +P`t BA†HlB0fX- ~9p^ v6iR,K  N,D$e ü' a_&GhݾEܬn P L%^ $BJ1XpBH<͘ ~&dw A'6+vߎ渣 Ve0p s{\B. -Vl.d3+qf>Jj B0$p栁*n@ .|n~Qxt%/4!` h1Qn l%eYj3 @v_WfDt&@؀?bR p!0bL,Ź42M@. 'NP; 0f#64,DA HhDcAy!v,ψƤDTG8 QxbJI#Gc׬5o_8Ø 2X : K vE! )K,w0.@EJ҈\겁k4[|C1 bx2yarI5Ӑ! "!5i*!d$& a#}=Йhr! Ko'(X" Ԛx4J 9@r@Ds I[T!tTƈ)4񢂞ņ{S )Ce~H 5&H6`J mK=c([s % iNAB:P N'0 v-d%P7jvMV'̦.ri3T҃*e/! $2ͺ^F  }" $Kbh(2 8A"[BUw ^ꐍw jV `j%RJ}/ Sp7lz90-@F@Sdr[@Y`IHP2@LȪZG8-{}dm×ڭ\}Ұz!x֢ ̺nyڅox0qv1DY'YL`$.k2 4O%V 8kD11|{=i\'KPwPDD6y_zy"0 >g}T 00h) 2A/3yU9z׻PeR\o p"-y1u|GQ]ڸ0K*[l,L^CVXASPB ( Z3(nҀܮ  ;e~m 5|e5RЮ=.RrVgCnC}@ԅ`T?cB 4(}` Ӂ fO?<(F[&.@c~}z[+ rd3 4#=?AL` =A OP-!(vPaEX# H/J(ݪ"Eݾs= R}ތS[ B\4X`+ش&OYv`A'@[P0'L/A ԘtGZ ;c~ҁu6Z!`o dWm6TEBuf1@uP*Af-<;(+)A-RB3HnxVP't(tɉI~f-ի8:4,04zB1Q./Nhkj!E56jGވyHd'Y{*\Dv> v)Iz5!$DjDC0JEh'/vIkAHkA}(G%297˰p6j;t'x˪X)X$J(ɬD/ ?$ ,۬ Ў4]k (Kǎ++*'!'b ka+rFe;(Hn[Gʰ w,4+…EKḛsK^䒰럓˻*V77K{2[@뵵[pOhKD?pkUk˄x"hͻkV(;kf˽i; K<2ɺ⋽ kѻ xyLlk{?1LU1jkח ;{}{+;L*k6_(l۬Z.+UlP CJ<5v[Q 0 jL͊(Y"PVǹc,8@[mk`7AEi5Ʃ NLRY[?} gBl*#Lw}`|~pFul~VN^.^.뱎Nsad>fܙ~nN!th0Gѓf᨞pHaɮtfBN6NvNWiY>j^]mU>~n. ӎ!Ka"o5n:^y>N~< ?_$_Do?K@[~]68Bㅾ"_,TdNH}5~-~W ,'î"/xM܎/g_;SC2~,>s?go΍ڹ1 S-oIQ52X.ړ\5qO^sx ^~ېz^.6lѯNQ] $XA .dH%NXE c b#I1a @41>OA%cQI"S NZh!nUQŎ5H&Ndծe[qZ]y;`%߼sS4{3g/fc^!OX-bʙ5oذ7[>,iԩUfMtֱeϦ]טoos'^q䉇'gs G^uӱoݻcŏ'_^fxկg/aϧo}}Mp@ 4@TpAtA#pB +B 3pC;<CqDK4DSTqE[,bqFkFsqG{G rH"4H$TrI&tI(/*J,rK.K0sL24L4TsM6tM8sN: ;PKKH$nnPK&AOEBPS/img/getstrtd6.gifGIF89a5ޥ.clgg1dm445Ez愄~ޒsONPZZ\Mp9yBBB,Vܲҗ窺Yx]~L]Π{KccccѶSv-2o؟+Z̀>vy?{\cZcơ@pˆHT_ϔ_Ԝzߦȹf!,5ͮ߫ H*\ȰaJ3jȱǏ _Huqɓ(ELRHFI6grɳO8 ѣHʴРNOVJoP"<0֯`e 0 x]˶۷pʝxA`d f'(@\CRf $89_>h"D^B?0VT A?'61+ê84fߊU!\Q*Z#UfWIZUx`fj1b˿(bW_ 1^tզbL-@y/AA}S%'r 1Au4!aE 7Zf}VQd#݆ $^[|J.E(KV$DeP|$iSZ_&`%id~\]Q% (c,D*z&(t٩qDIW1@EЅv&űx*3A3,6F무Nk-֕|mނ6dv~PM k%5t FW5/Rڃ 鑦Y.t\p Ԁm01 2 #HaZb94i_okMn P)trRdW.gytPTjJ/C wiYŠ1!ŤIV!ՁVCTpW1xY 9g]IB_HA*101j@K5̞m`yoy.z{B,`!0c߆+;/U 'h F5چ&Z?-qV(SbvhHZ p=^mH<_hYEMde%aTLTz 0$ԥ7c ~MT)AO CP0' ^CP(A @ 4OfVЀ a4P!8.=A 0kxAF!a@xAD&#:p?a@P`<\€phض83\ &IJZ̤&7IK.x_5R"2)zN%Hp8 ՠ H KV 6 ؀nV8<<. p\N`tfTt0Ft\26h \4ef@j5K{Ckr`)K2o|35  ($x 0'p ` JY>h !HJTB:+"/A  1hH@9A-S zp-J *WP k \q;dHTFGK `* BZͬf7kYRV``BJS @>h ~6@s6@oIAV IV(Pv H<Ё`M@ &/#g n~C(@l h@"@.RDW,l d$LI %i $xD_AI[ Q0-FM Ӈ572mh+h 5е Y0aK Z105PAPPJ^:^-4O]AP@ APa .Tı>Ppp?L0hP d> D(f0é V1*CD'Mc[i7 M)@bl ?;˖>h'>N%`;@Ro@ Z؁6 *:LhfPct * Ԁ `m]`n+u&`Al e2Q5?Liop‹-^JlEw+yox 0j`H+5BERr0J@F?@Axgp@J5(!b] ^@;jQ! C \Anf8y**R!5Ax P0u{{򎺽|W4'ϊx@`'w/%4B@[`ͯj2o @oi@nЂ(x ,H jO@*x HC̔G 3Y=t`fYj$``~i &V`e .՗ .p H3n=#R6A$\P+e0(Rq&1la5v3R+a FQ( 3Q"$6ٓ.A"1#α;p c00RA2!S{#<7R2R"ճ!0r7@VPмUKSQґ:a"Q"˽۽+( jh{ v1r;`v;o+f&򲩵 S 5\?.21jPq^{ IIc0%a(aE+ꡔZ&0z*]7J0LqBΠ7뿇C^|8oaLg` ,*2p\#5X*R7S[ F96ԽΗ8b\',=:bm:'!"?W$!9=B*!R/|5 Ǒ;%Q ś1a䴺P#%@h[;&YƎephr!%A9@{@g0*&[7=I1, QA@f[CO=@g+Sfh{5_,6`g[ İ ARg vN-^I;5 |%rPy= *T];`SgB'+t8/Sp7hEgz/0 @ln Qp@Sr݌:,8~0@7Γ4v]`/MOdp@;SAp IX`<`N0QV۾#B2q7E1TtFA0=t Apս}8( Ƈcd`-6 vP3m P d@}3@rPhxre@ߙ|e|r`N.v mv x@R.`{8GWВ#-`pJp%'P3(C+PL*9hjK3=ڂmp@peΦMv@vp|Agp00g0Q0gPp ͒t+Ω p4g`,0>fR0Eau(7E`wtg6jFLfqkXc.e x@ ើp}#uN roh`p0b\rmwٮ< n1 > TJP6$j01UZeAJ7@,@X.w3ͣo> <x n vXep >T@;:^ #Q+BW ?:pEneRST|81U^,08O&a \a7}^;l݌NN`dd1}jz ?GM/a?_ȟʿI`L r^T) P`0/0~0(B)qV*C=i/ &'errhh ,93p3vphNepNNhrN  h pep  rvXǛuer  HH@ɋ Ba>i (Q&Jҡ#4hI -5^`/`0 `dTu`[ \]v^p5Xo6Uc$wr% C+h*rh8#ቍ;.Wngw砇.褗n騧޸N/)3>;. O%Xkzi'7G/Wogw|pR) o~/< H^md# (~2?X̠7z GH(L W0 gH8 `A"dԠD},`7HL&:PH*ZX̢.z` H2hLh#~% x̣> IBL"F:򑐌$'IJZ̤&7I1:(GIRL*W9B,gIZ,X0+Qur4=.f:Ќ42 u63goYyv rϩ4vP93$p- ƐsQ:IЂ̑LX0)`s(J x/W wA/od ˕"s BK썼 Jԣ_FC{s)uYCɽky*xK &Gkne* q/>CI>A ``%zi-%\eKCKVT.qY !;N9.F n#cI|o{ ~"Q HfqP*ˋ$`S /0u%ȢAKSÒ8]V0A# XDaF0 `7B `a"Z_~Xth-Bf}Q8* Q#RgםntNwny)MoEq @h3p"]QK ɦBT P@ + ܋bGR!F`QQz:Fϑ36S'<WY8+W->1mЂ %_0 YAqsB95@%.OX9.=Gb\nXKDh"gdUYaop DNP+w{CY D/4peaVރ Vgc02W@WE Q\LFe*O@V@{ۚ+6 ,?N@XpR?0p#0 p)kR180V1%^J=A0xZP=B=p%-^NnoFxdf pS~3? $.oPZqtX5P?PA<bU?v]GRc<fM E@Rf` 4-`p- kvgNf0\&yW\%ѡPPPfmfe_G`5sXrmeeZER P>Qhq PpGpX$7z fh*ӵumGc1%eVq' ҥOcRp; YGN#mucsXLi`T %7Sst[^H'P*p$SG` \YdQr` QPjLS"W 0e rQ%8(J% H.^PC;bQW@]ei(  8`paQ n@`oWho4Ę;Q Oh"P 0!`)b8";WE pp>' Q@Q*Pl@?g@Tk rGP6ʼn?65MP~``- 1ܸ6@5lb`A ?1HP(@(TP#Pl`phpq #lM'`-VMQ> kq5`tY`9ף(`+TWq6'izYz*5 HS~{s8am#7-`(K $Y#:ܸ ]'$فGGP* Pi) J6P-`zw6 j(H:mzj5` ~M6pii`EZ(T! VpHpoڋ$`h6)Jpf %ى7ab~9N)8;+#p%@J+,JQs@u'W P^ ZQaVL.G~^! a2 2 0DppO@ Iqo PP()a]Zyo@Z09Y*^3i9Qcڛ0TɜژM0Ii6#Lf8ix*??P,b`gx)f@Vй8@+#W8 ,MН?5p؇_ (6-Т?H0hVpq^YyT99 +bP}bh#`?6PGp`#8`ϊYW7y5;+`zĚ(Pa1$R7~p i~٤|xS`q)ӘS+J-m)ZM>JJ+b@HK<0;  ;(^@Zp` mPQ`X$#pS, I`'`;p*`P^;?0Iyl0p% HIGKٔ{YQk0a m  m@pwvCpU%{K:R^%kS[Ff" ."@](2  P@F. AX?>;x$Uo2PqdzBbk jbpIflӇnm`lnbPI;BlPXYFRYu_͉: S @L8V_?jk@=GқXʦ(`h0~ ?ډgVG0?ƉLp7}_Wi'ZvOmzˉCv>ȍHhF?`?pj f -zp'0ibւeJY7)S(Xmz;Tfwbo{U'`QrHbj;p*p(Q;$ S `zDɉ\*k[;͛6 R7y 2*%P8p@Q]%+=1pCfm!Aw);`;%/,PuS.T@Y]@ѿKk+"`o@`kIf9Tb.|#) @5p;[z{.{]9G|xU`@"`K'  imWм*|ЮlV1' S kBJ NGʩ'aފuÉ#ZPp^|l;Q} 9cjb0=b*`y7ū$o*B1Bmr.*#6??`*ajq1ܤk.79Z B!9*_A ?Ե(. {@p*(; 7 p4;ml],ȲH[`liq0L0S, l40 ;5/aïQaf`r#vog08!>Ҡ.U!t .~"~"F2}G5 Y?Z?#GSAaIb*(86Gi(?-GM ;~(* JGHZbVG?*,Z5GL' (Lb-#*9r{aZ!)y'MTYp*U0pbf7dR-^s> Y3[4wdbb݈" 0J0 s|@&K%Y$9@$GFCq@Eɇ |J& I?bR8[S6T#-z4 00b3?S";Ggta 3*k 3-Fn[D1J -[;Vgy0Hfeőm\;vn^-8*\_!+ŇDÔb" J1O=T*4Dv  C 1R?4HG(&!0)A @DPT/XPHIB$lԈpHC 6 "h`@$Jll0$> 6 /p ʧ)Z h;P :# r?%! l@2v0!!K VP x! `pP,8lQ#R \Mc $2 V'MC!;b 0"(6a`8 €>@6NH$XA*H R U l#0 LAT(t ^{@ 5Me !90 !Z.\'Ё 2=P!9CA)TDR ?!# ;.'PBDB'Mh vP6H\cMRMaAHi>Fn@P Pa84HMP2Be$%GVQQk^񐲺y}0HwDb`A&B 0@WD8`F`$PVx@ FCzKF0P"-Q/J2Y,*=,h# 0(CZM/GF,ڣEeWҽRL(ZE&pEL!}L,Hw뻽kLw#젷J (EjчkLk]` Vi;k0/ 1a^4$mkHE!R0@`喆>A1H҄)`[X``CK1 qU)dEݦ;z@C@BtI9D8R ϪKšxhF'erVykɞCd FK91| vHs[TS@4IO3zkR(z>qp8zFYEUPkTUkit5mGe:gQmncV%WQkJ{FxɵȲJQ>RbYkԹCu:iFD8ɍc].M`ˈv(phpM 286ԠaK޻kn @8Qp`mlv.[F 0-\QĢ( m׌aΥ52=r#"@]; 09Î \(_Y7ݼ@\<9@`z"s-:JO2苌qWEG}kud M1Q˯-mQԽn,DkBЈy )mz9/׵R`T|Y7ז]nMc&(mn[u+?}b"}wg_ZOgFEVViGn6ZbWa(rlXf._c#Kn#d7F!^CE`b'_`5qfz<]wvFh`:>ȃ?hE` `FBЃH؃LMN`?\$a6Іy @.#vGlAj-reDj#%ka~G!"exe~6\9f_f:`|ȕIyXl~t/ o2~HRgIubl5\we8l׈j/ut~+ezvqmnxd&obg{l@z 8YFg[E~K^%f_jҥɵ_K}.sr@jHf0'}uSKq[FpJ}u8`oH5Fvd_gsAgE.AAyUWy [(#]z5{Fm0f[FƆGK0"5!1h)y"]7N]N{e.f6 VQ)[ޕmYd.En6Rn5aZI!4lIuI}g~p?C4P:`}):i}YEPBx99@g'{=*I!2r}TÖgGwJb9YyșʹxoqƜ/Y> C5yr{(~\#9YyYVvfE~IW/bnlihƆ::YV*5鐁nͣ*L OHYڡ JJV_ims"е=keeғr!z8:ٚHT%47BP*# N10p~bg<ڥ^`ڡD~1)_W=`Z#<^WDjVbH6!E1ez5*rq^C&)EEUF)01`K6C2 N@0P)s\t&|-bCp$@=6aڬΪT^~Z/@e:%ZFdgHv:jBUA*p0&F& \R~0ư9<-C!#8~S=] rpXVP&~ UWf Ve*+0_Z2֤ڳ>@+#&P/0EROLA0=0L 8#p=Ъ06=p=@-1'rp/@&0M0*0p %8pGB z;`#K1 CiOѴ= n^0">8 K +8pa:=q^ljWP &Hи=4+%@JPS0M{4 L(C/q/0La])1#pJp1P'+ (@'%PO0>>WP%/ GH;1%P@;0P Wqc3&+noC,`'1ppuÛ/p^p1p#k#D ńq>p(0WRHś+"%2AP(=5Qp%&9HLp6|RM 0L/G{˸9A@n0"8p>bA ߺ]PpV/>,nel#p(p pI\ C=p#n|%>0u0dBpk#L'ǀ>(LPάJ¬!u\>p"~0!$+"0 [`Ϻrt` > , RJ)g]=`*>/XZ4o s<;OϞ;d;`(!Ka`/ g}cea[0pN '0k= ߬~yD9m| }# b6#R=l,Nk%' C\ ClA06R τrD0MIP \8 PJjp0[߱AV"K6/pke}>Ъ>:0A\]pN6P"[(2 ,g=~=P,p 0t A>6W@O'|} IgkҥW]C`#1s{\00ܔol)/í] GW\cSfJqMϫ<7)L,zD;ϞZPaek~ثcس4ўJರs;¶+" Jc]HNCi}]`pR;/6 &"d %, -M=Rۘ^t-b7L)7`@6k_^- 0 ( ͽ߱, 8@߫ؐpe OVrBPa4@& GЌ/R0\dL /Bk`&+~`0k "J=PJP&0;`&p"K PJF#btDQ~1 t\-NB0/sO`OL`*ǧުCC,M"^ Z`#Pj: lO/0-'Lp2AOZ|/9):ƶ+^0A$^)U2/a(A@ + b4SP3f+FDE-?w0- ^^007^10+0^1~}~*1:#^T*1`01)O ,0B1(AA`J1*0#(Џ H߀@X \=D -((.1">(W6&X?~xi(Ut d5tO)`xs]XB E G+p`%t2gҒsT ˷߿ Lp<7(5 &U!;*@ޒ Uf|G}>mw!2#OIJ nZ5K<4φ+_μУ;(L )E 7)ཀyUp|u  @aUy\`'w Rd]wg}}Wry܉bRG"UDX Bhw^s\]zw]XaXEP9&(z\p0Gmg`OVޱ]S`H@O(tix|矀*蠄j衈&袈HP@ (A,L駓 ^:iN)Z+ ***() KiGꬦj$p,zk^)X TJ[k,l'p 6KI]u 4%gluuUJU]OkіU1M<&ɶ!=]tExT]vP\/9m!UdV<ރH*-EԪHȤ?D2AH 0A8C 8(Z ;T.`GL?zT6R>d%<"`'(?H ( 0BW8Zt"?H@v(( RH@MrS&| W:_܈/;Id~(\t!{)c0@,0!2h+M6ho 'Pz8';iώzs y1B20?$"x H@2&*C#PC_pDpEqPTWԨ;49@_LiJQzSDuIp(Cѩ5:hC`p'ZV+YQE(ovќT%7(@1:ֺi3p<@.' Uĭ,'gf6|S2G@q%0M3W o`L^*`EHq;gY$c ҷ"}h(&Ia4x#uoXTYTwa, @yXd@FW#Ba0ݡdʱcVǪ10KF)7ˑAZEqw,d@Ha8:.{Y~(B0f29h&sѼf6yc%@(3̽LB-M18zю iJGъ~!E$IYEgјCW1аe05F"te;Mb/9l f;ЎMj[ζn{l#,[N7׭v7-z7-=NXҒEʎ#N[3{ CN򑛼(?Sr@M|gN8Ϲw(@2~ ~`A}5?q**Gd))}rS~)@)r{.aI1!1#0 7 p W9s+#2А(2#BAAl]3X/M+p(09`0 g+h@X+,0$PIC7) S+5 jI},&V/Jh{pJ9P(eA@/:PL/@*4?/pN00%,C08|=pwOPJ#A %P`apAL/ JB0j0kθ 0W;R;tPJ@!aTHQZϟ A] 1Hծ@P;'p ψ_-5`ڨQp%-Ԣ/L-090^@L5@S$|1݋)S~PN\8Ǣ}Ǝ 9L'pe АR9/ E;3O(015H>)P@ܴ;h~TNq(:G P]8C8]01J0+ވ/%%(q//&@O-`Cɪ\WP p 8W]@ Z/W4=&A_7=HHl0 ;l0?ǐdL;) y78z 0wlA8})b?` p`*'QP6"~@Y :P~﹝Mp܁Rs( WWQTM*)P@1: P0TZS)~~)(~Q)Z7T1L)9 s1TI)0* )ǹ:)͹y+H0S' TZ0'QZ1*N V*0!Uk(%V*HR4D . ORL'&>{  0PC tㅆ W pLB#ȋ zѥ (pe͐ *3K`$8~10+"I謌Z (lبq0"f0UX!D 1q#7pL aA *~&V1aÔ#`HQPT@A-<) vF(VhFx!(;|,xC ;@ Zb`;2Xr;hB 1/P SPC 4D~plZI@Aؠ,p)A!'$q$ P7Ixg$Gѩ'Liĵ>tAJ` 0xE,Crisiq!Hf7 LUP`@MU,T9S g [e 'xgA-[B]RL+8 a %,fuMW"Kx 7uGЂTDV4ɣ)UbB(:6THn)(*>=` Q Ym$X}18 ( (bbp)CG.'v8$H@9L 0 &<nLxP:wi P@a H0Lg˹B+ ^S|R a}gRh@<#1̋.|pSi ?iПHAX<<'; B8ʄҭ %xJ,J =Vs;@e(A KD@C V@\2 R( !U  b*(P\V`) | 0xZtВ8b x,`3T`;(.ٓ^w) W ^d@$TфDC@#^<;E|&@vl%v[6 fI8QMH,iЄ,@s)Hh, VG։hӚ摶OisgLe3)(*CH2Ӝ<7LBӢ@֩zzto'q K3ߢUn\ B}K(xK@cNwoRHJB ,%q^;REPЄ  6}9DM|ӣ̜g 0T֜&4S@ PQ h5iQs[IMԯ(07br4&'b ^Ժv/U VU8Tu)rKZFVKb-V$1[jGLSW9-mfW (.ua+0JR!4ުCåJUESPGdEX %Tb ۾4j oIwRxª0/` 90ۭ@X)RzGLB1zr ҥ.pt+Uj>~7-]䖸7^2w;$ZʿנM`HI?)g ,sd&s!MnAd`A9s(؜rǬNtrqtNq0i aS3'iqmk>2cC.(B(lzxgVN{ +4/dIPu 6,$b y G)c7j/Nr*r&lHpiZ, XXSdԚ4Cԩ/[јCԛ54C)2}@B;9FyHJYLPR9TNYXZ\ Wٕ`b9d)Rhjl_ٖpr9@y9Zi&[*IX|~ zi9Viw90|)[)mؘ y)̥ٗəY)闎 )2YvIّ9@Л+SiyI%`)ٙk99F@I칙v9Z֙Yɑ}Gٝy%ʞ))*Iȉ"'wZiy'2P< I%ai,J) )b8jjh)Yp989 x6@Dy20 J!j 'e2 YiS*xly,I`9FzgIڠ}  6.P0ݙ)DPYITz (ៅa!Tɝ.pY*) * #*Y~96jh:캘zVy)Y jnjz,i) w {j 2Z*,:VʪyHج'@%[cz)!* =۟%"С:"ɩF[**Mˢ,I# F+,m;C ~@ `J} !ڷ60! `(}+@n!M(}+E};}[p[!0.0 ڸ;+C }@˻` ʹ;m۷}p+2˼}̫D@"2+z{'Kk2@*{+ 0pF!J#A*jJ!|۹[; ,, ˦KJ{R +!,+L;yj};}оzD  *+} `jL˭*A;;, ֛S;+ nj$!Z~0PW̦Lt{} [M}kʂ!ů*ɼ(p)QX|;! 8+ \ (,@.sl ۽jJ뾻{@; xk&ܩ ̿Ά*!p: \.@@!M ,,錻}JDX !P5JPE+:FL&\EZk<!`ڶM TϨ:?\gy^ ,쌪RF. ?k!מ}G7GL’l+w(!kͬzkʑ-Ѣ{D@j ӄlڞ =m~-zΠw 誩̩!m-+k}mJAE2 !7ؒp{`Ws<|<̡kɬ=XS*NͽčܓK$ A=9.Amz}Ъ7 v~εA=Թ9d;Kw|[mʈ!ͻ!n~ڸu. Hm mAfwԛW}̅^ђo>,}! B}λݫ J(rnKgu^s[\m{̹mǘ) !E @f^ \|d+‚NK^ъ .Kޭ?KާdD.,"005˦KĤtk^̬:Et6[Ԡjnܻ[ ˜GgR!^?t蒐ҿzN!!5 / ,k͵Pά|쯵lo Ž]Lϋ%#A,NhS2b|.퉭:k썯芎";l9>H*ዲm~]^#a~KMhwbʹ.hɯׂμ+~ x)|Pؐ_wOΦ˹_ D".}D~2 ~!  ..F~2@.~Dn!” ΰD.}D@!"%G wL 0瘹BQm!BՈ(̂ "|-; %B2Rg0_NʔP & "{Aw_NJj3„ x&N!3&b 婭v)Jhjв!jLZP4v } aYDH\mU to5sy]$RJA2[T0i"EU!: D(l5,4"@&b&\\=0ǵxJ1Z$#!QJbӁ Hb1AtX!Z\Eo$arO%"hbw=Hq C@~(_D8pM#G28OEw@dF(?$DчTp\Wi0)^z _xfGkfxuS*Ї ۞ $Mqjʞg`^9RI#yr`!`$/(&@ޝ4֎o]*Q{oY@xPɉ_ysP, B\me`-2D} T93'r#p1ʐ\5U+!H A} ) @Äp8;:0pC课ci^D ߎ.$PF2D'DК~M^Ǟ!:^/i Yg,H8`[kT;"D/ k!2#M, B$1wF02`2F[d?Bd"Gjl)/rU#))J%+hѣ.L<Ō$h f2$$H/XSѴ#)JqRnL?#nI) h’)/xc$((gg8] Qћ}p Pnq''w``A,7X"}hB)~,*Xϓ2PgG }şbMDl$VQ S泫OC΋fsB}j]ȗ&4,K:4v1Q4+@ZABR_OU5<UԯkgaNΔ_+)SYV'i_PѰQi@XNV%WVТRg!Ws>4ie9V֤5S&֩-n?K{\s]lJ6q/ꕺȍ#sKtMOWAm/{ֿ]s_YƷ.tKՏ -T^^ΰ7{ GL(NW_0.-8αw@2;XHN&;Prb{YXβ.{I&g; hN67 HGC:x3V3πM57Bh!8ѐ'-W.7N{Uv@(LRBl ؗG|̠gMZ{EX] X=lڑv3mf;Ў &0K\m^tb۵DiN9L" -'S%4^"kM\fcd)lRt( ABp=nJ7{ CP 4sqc u~w$+[ zFc\HH>DzXϺַa=%/-SAm)pQE75N-@8@P-(鏳Az徻'Oy?6PH ]1N M^~8@̨ʻP_wvB#!PNDJp,V|Np7[sü*$jCɫ䏿cȻ4Ͽ?2.oWG b8(Pau_g|_yT#8 hrEKibց28ve@A8<؃>@B8DXFxHJL؄NPR8TXVxXZT~fm2P@m2\gjHg0Pc8fX@xm|xgr&dH}Xx؈8XxsHn8OF7})uqE@HE: }<%@:@Ҋ} hǘʸ،8Xxؘڸ؍8XxHƗyf:0Xh8PB C F(x( I{9Yyّ "9$Y&y(* dR8luF`p%y b~2@o4HJLٔNPR9T92 z-M}FO}`ܶy ~`iTvyxz|ٗ~)l.Y@Figv\ .p$ h3Y ۖ1fT7rc!hL }3kٚ9y tcAqD)T FP`3 @" r) 7P`9Yy虞K*o~`p T"0۠'qvF('y0&~P<`  6m`YxƓyXfvn)s) pS Wgՙ?I4" 2A hZFzHJ 9r O'P€~oYpmV̓ O' g" GSf3uK:tZvzyNnizoV F1o$0J !p"v y2jx:Z٤Y 9(J YZ|n0w#30v0Av1 5h:wɧfjl#4.P <@.0Ar n %HO 0wB{&BC4 :(~`I 䉪 BwvSp$ w(l!8H0n`#B@r`Lo\Aʰ>@N l븧JOr)P͢FZԒlK+ &ڒ-}muB[f{h{:!BzcA7Iw;#y79&')HF*)#xD󙶐Jɓ"0c0UK;U"иi~0[۹N;k۸9[r`0!`J5[;k+A%(٫TSuK{K嫾䫮;[J zFoO,M1Hb/H\閵F 9* \)M@;1`ǀS,D\;p,ï8EpyĐqLہ\G,h,Ȝįh+/ikkiyE';u@`ll<5\u`n1|̼̹̽S ̽S3Ϳͼl˼l؜|n`ĬP <\|= v߬άI9͚Ѭ |, "= cɜޜML$4~Pp+4}P۱7p}pzb\qs0`=7 cP`70[qP_mc'Ph8]\k=7 cMck-\0gMUsX؂=؄]=R֓pRPU'P֢أMצ]ڨMڪ}ګڬڮۭ=۰M۲]۸}ۺmۼ۽۾ܲ`4<` ~0֓m z7MP\}p͍wcsw݈h=a]=۪=nzs0] 2}''`}}B`.߬ Ȫ;?]J<PA\,L'$Q@zbMUP (7N+pԪ,4'P9~:T*B֪LԖt^O@A\B(s|#LRƯHqNM2UjGmvu]t *^n"~3.I($ե.է\ζFM90 % cX+~&3B'4pd.lA`מdԬ\qP'UMpWm߮S^4j]>=k>ԼaU#00p<@CL Oe4 UCM -rMQ}N =y_Y\RXYL"ꘌMF7@DmTVPp1@`(>NmP:#qM%BO/#7':4:#'V(4wA,X1 :Qf!+(kO i 9Xǡp4rqRJ0ވF MVǐ#P@q(boT2K,H }*Z̡0|5H+ Β1 %V((!+乎&AW3IvȃOM!j"5h toĐC0 P rf^ a6DC0s .U@ i"%ISxB %(MD=`> BIF&J6NF RVIV6#8)\<"H 5+ LC ̂/ 0"AH% Bk&*<%!t @%aKA L%tK U0naj'@KBrpS(@.2Q@0t@}hR&Dmђ%: :<XTr=H 4>]@0p 4RBJDP} 40B  %"Up@̂sdQDkK 1B8Ak1b1Z@/wg3 p8gz| Cj^A4ā+F5U(CPhT)LPɍoӠTP s(p=*PPno< )^~[h`sLqÁ`p@Cp CH"R4`8 AtKԍ@lEtlA i/Ѐ GFɋpE LNT 07*4OKW e0xP$ x Za+NV "M1 }@`Ѐbx`IӚ p |J/0 TX 7QpDy`AM%xA"`k hT4̢G8E P܁XЁ t`Mj`(O@@U%4a ]^ J `Tp b58 D?0 xV܎Cm!tG)\Oc۪ r.(*8 W0R Z`bPp =ȭfqEnIVv]>P!A  @x["ΰvDaA; 8>$T <aJJ6@}冑6 FuFԃ '  2ccJ!XVWY8A 6C0pCb@(@1(t "PHA ю 0+X*jU@ :HPJx c1XAR 9) Á 0PI )HV='[ vQM-aG@N6*O$t P0kSAUhnt1@:^_Ab 8zCK/L ` oȃ6>/t,)?{hU>jٖ(}P`8DԳRr8+݌u.?nEK+ Iч9`] gpb;EMg.p<@,,ɅHÍ!'8+ pA9@,/[T& <-JnpSE]:vZ`T|N"0.G`@^޿>A,ݏ < dBm =3w/C%1X}`Ajش Ja-+VZG;*` X/WWgen\q@ {dIWWq3q@og7gUhp !1 PI` VlnA`04` (U@ 58 × D Xx< > %Ճ@ :| 4< 7z~ 4`nM(0XW{X@ pVU>q`5tX`qM#U U2HJ`tTH*h{!PI}8 #p`Q@n poE_ vUFRI%U'Gx8`ng( +C8 Fudu`e @iH 4ڸ؍~@8؍h8X帎(8Xx؏ȍpI 8ɐ9gApɍ~}*,ْ.0294Y6y8:<ٓ>@B96)* DJLIHFٔR97)Hy^~Q*"I9)pjlٖnp&I^ őrzٖg {}I @_Y ^pYy ٍ߱h)f h P Pٍci噽p)}PyК.` ityڹٝi9♗P(Й F"`^f 噟HȘ(@!@ P@&ixƩhI :(ڜXi#:4}9%ZyfꢑY'GڢBxɎj9ڤ<:穕Ɏ 0 0'9~PHzhhk!P8".0LjL२.@H飈&ɡ!΀ *kjoY. *٧Yz#}0JJo*u*B H Wzġ " d k* ` Ьjy m:@=z(ʦ j`20ƚ!`!`ji*jjتYy,*Ē h! SzɐczcZ,+ثpP` H丬ٚ+b#˪~3~0#9Sn89y)O@)It9̉9fi";3Mh ٚڵD0`"#I  ߺ! zIR[9e{+q뗡D[J˴~" yfٚ_8bڹ(kˍ2+4 Y Zt)P @Թ@2`+ ^Ju溳٩ &@~`$ ̰K Pkk! @  غ~ߺ @ܚ࿃ }0kI*0&^`‘@תI;M) w ٘#YP˯< gi̐.`L̐[M*+4 ̐b :y,1kzJkK@~З8LȰu .p D ˯!`kJߚ {ʧk.;*sŦjʯJL , 0M"`Clu2.ʫ bj.pΒTi9\~࿽[%'˥l }@ @XD.PuF YF0l- ܥV =9D K,IIDʹ I;؜ f p k< X2ʖ2@`z 0к  ,hՆp .,rW' .[ 9K{HiI̡p *`cpc:IZܦM u Plk:@LƧLϳ蘒B g}+p1mؑIҨ+^`B5K YݻR#k!  kʐͽ ӈk J,- jߠ\}@,, 2)%x nP ll"pȘ׎ ][-ym.кg P]J>м% =&iI-9q!` D+}}f `;"P׀ƞ9 .)J`߇^m]}e9Kΐ. ؒKR> !Pp\=`j"@ Pj *`Ǻ.Rۑ`ަ^YʖXl= ٝ}֋s.ᾑP PɉHx{z׭< FP@{Z lVY]*PY oG =ϸ-Yi8.g+ K}K O|o[q(0x`v=j|ʘfݫ幊t1k9sޭ7߾.8Ɠ#_8> +niЮzs࿋O~d=)E|Ss%ѥiYE1*VUxxu1 n1~H#Ӡ ?Bz'XA$U 7j@ bRp.n/+;b@ aJbsi=z\`w$4 ',-PjG`k+Մ^S7_*lF6H59:<((0^>=[D $.+` wSqe4p,Щt1TPx@ (Q ɔ;9@# 0uzFpjyQ`ùRj E4l?S=CT68՗( z7BMcDl`c?@3xɍ/Vt]c)B*Я~MC"2?t%"7wb RdwCX ;ӉP(l(%ZW;C`IH: .A]|WkP0=<Mx Z*p,H~V`)|Qw@U+70Jp6L`Q~t80(P`J ~dV66P~`# Llp,p~Z5``X(PhU} 88뷈&xh2I*:PH@0t`LPl +ДQГQ+ГXƖ0#Z6*`:j+p80QP`1LY]ؙQ(?H0`i; 6@-КdI`ZH A9*VpS,92 Gp+)L Y:P*H`=l878+s}OA(>pw1 =Cp 0>0)uA0.W~JPTz*z(@ 븂 *:qNƜJ5?~p-#XVTZwR-P8-:#`6 I+X.Ƞ-PIPXM0y`Y 0':`* V0b@76 {ٛ `b P0SPbp;Њ p?P5pJWI`+ Њ??pYp(Y0MH0yl0y)5Pwt;Pm0;{w * {Hb,GǩŌYpiP5pHp?I@Y;I ;Й-CPp#p/A'/0)=T{aO fW+pZO8PLC8B/#ȟ;=Pp]z ]+P8/P+/UW# #aCVwZ0L`z(@M ahpDYM`:* ;m?0;p5@I&sXjK2%0 )0pi캵Pp@V@7 a UU:Ġ/#`'7kx'*&wT0L00`SH0S`'l;)o MS lFIISpZ$+DtY6(pjjLT#PLpD͘Ad1=j>'0u;E`-k~()PPj$V}R;/:? CP]P# g[1 н> a(]08 a`4W /`0=Pϙ;=@RCp@.Opٺ 4ฃ+J>@7`a8f@8 D0`t5jXj) ##odJ0T'aJw%I)yS`j=@0|x@):`I@*~ FĎ_FH)p6T0+g8+iUi|YѪKrDsHw50)~`9Lt6`Um:6-1]/wD)_7܋Hw{AK ڣ?L1:Ze4͗`:0lۼP%0!: #R0s3(R9 &=0W>17/ +0NR +/@{k ->!%`#K/:N!4 ŞLpY( DZ]@0W4J;KDߍIrlAćؔ Hs{U-`J @=AM;"9kspخmv}Hw?ڃa}~pI-;Z;G~Vm`Q`1KEbz0P)I0Ѝe=r5Z; S@0ڎ+8Z`*wJ'_ Z05:ZBz` U'߭٪oaDi-#iFWpN`A䌬W< h?.ڃ=1( `]`L=pi'(>9;#0p/],W~(i.j **0 ,v}0z;cmݎ+0̩i0 V`v)S^pn^0pBR ]ZzVl',a]cxFU*pPt&H PNHPH**P~iiP +)H *L**ŋ*PP~L0ߕi PPѪ]t?"'A CzGG#CQ!A&BLp D(Q"ƊQ@(I %4)B@ :8g&M tj p ;i9g 1DɟF)xQ5 ) p& cdhkB¾!+/PLIIڧ`}燯`)ԷAI|%{^ywy'a }u_uT@` 0`;GyeAxx a)x` }€7y `*VAy! ,*EP@ y%JdR0tRCa`IATdIA, X&an9B5Ĵ W1l 7e{iW PY Xc)`CW{ xy% P@7a0*aj+aMyf`1ݺ\bb@IwIFAZ~il&{ v+1WJ|JjlI ] m lu -JBX||'K&-Ppq\ hT2%ljХr e|{y`I`(b*^)Չ[jR@C~|ȗY8C)58mÆb$sv׾~{gTI Puܹȝ){jJlRWqDgquos"7G/= DgwK0觯?|/cHpzN_:'?X̠$m GH;0 0 gH8̡w@ a( <@CL 2hH*ZXb Y(*H2hL6pH:xF>IBL"ը ?($'IJZ̤&7I>2!{(GIJ ⫔ )EV'aIZ̥.kE2q_3ztD0`% eBjܥ6nzԋB>QxXDu:d BxB%~ :g8w@HIp:D' ٳ&fƄRҨ,*LgJӚn9'b hJ:RÊ ~/ )PS PSZXͪVE pL2O05/#@ bN HӝN@.EHUJUU<0@DЗeS ~_>Def\Bj%aA86ͭnwM AP,?' DP .P!? ȀF%ʪ•.mv`0B^nդ /  e@ v"*>!`Z9@! Xp@ 3tMW  Dt T ]f2 ?TED .`bXβ=@kBH`~PLŎA"WY/4v4V;r!,'p>\W沢 ~e`@s0A+7̉Y!B"^]$/#l"Ѹε[j<624B vE_aAT:!x@,XuB0f'޵FC`0&jƄpǚapAj"M¼S yÄpA"`{|/(\66̓ɡ|! !jeϓkpAv磔?p\/2SP'fXz{YֻcaFس[#N=0B$nfY}χNB+esVOˏ?SI>6K{/{OOϿ8Xx;PKЧPK&AOEBPS/img_text/getstrtd1.htm@ Description of the illustration getstrtd1.gif

Description can be found in the procedure.

PK0"_PK&AOEBPS/img_text/getstrtd5.htm@ Description of the illustration getstrtd5.gif

Description can be found in the procedure.

PK$JPK&AOEBPS/img_text/getstrtd17.htm? Description of the illustration getstrtd17.gif

Description can be found in the procedure.

PKqPK&AOEBPS/img_text/getstrtd12.htm? Description of the illustration getstrtd12.gif

Description can be found in the procedure.

PKPK&AOEBPS/img_text/getstrtd4.htm@ Description of the illustration getstrtd4.gif

Description can be found in the procedure.

PKPPK&AOEBPS/img_text/getstrtd10.htm? Description of the illustration getstrtd10.gif

Description can be found in the procedure.

PKPK&AOEBPS/img_text/getstrtd16.htm? Description of the illustration getstrtd16.gif

Description can be found in the procedure.

PK@8PK&AOEBPS/img_text/getstrtd9.htm@ Description of the illustration getstrtd9.gif

Description can be found in the procedure.

PKPK&AOEBPS/img_text/dbca6.htmD Description of the illustration dbca6.gif

Description can be found in the procedure.

PKM.PK&AOEBPS/img_text/netca1.htmJ Description of the illustration netca1.gif

This is a text description of netca1.gif, which is an image of the opening screen in Oracle Net Configuration Assistant. This screen contains four radio buttons, which offer users the following options:

  • Listener configuration

  • Naming Methods configuration

  • Local Net Service Name configuration

  • Directory Usage configuration

Choose Directory Usage configuration to create an ldap.ora file for your Oracle home.

The following buttons are located at the bottom of the screen:

  • Cancel, which you can choose to exit the configuration assistant

  • Help, which you can choose to access the online help

  • Back, which is greyed out. Since this is the opening screen for the assistant, you cannot move to the previous screen.

  • Next, which you can choose to perform the next step in your configuration.

PKOJPK&AOEBPS/img_text/getstrtd18.htm? Description of the illustration getstrtd18.gif

Description can be found in the procedure.

PKnmdPK&AOEBPS/img_text/getstrtd13.htm? Description of the illustration getstrtd13.gif

Description can be found in the procedure.

PKPK&AOEBPS/img_text/getstrtd15.htm? Description of the illustration getstrtd15.gif

Description can be found in the procedure.

PK]δPK&AOEBPS/img_text/getstrtd2.htm@ Description of the illustration getstrtd2.gif

Description can be found in the procedure.

PKc oPK&AOEBPS/img_text/getstrtd11.htm? Description of the illustration getstrtd11.gif

Description can be found in the procedure.

PKѦPK&AOEBPS/img_text/getstrtd3.htm@ Description of the illustration getstrtd3.gif

Description can be found in the procedure.

PKRPK&AOEBPS/img_text/dbca2.htmD Description of the illustration dbca2.gif

Description can be found in the procedure.

PK;FPK&AOEBPS/img_text/netca2.htmC Description of the illustration netca2.gif

Description can be found in the procedure.

PKSPK&AOEBPS/img_text/asoag034.htm Description of the illustration asoag034.eps

The image displays a flowchart, which is a pictorial description of the EUS configuration process. This has been described in the chapter.

PK2p#PK&AOEBPS/img_text/asoag038.htm Description of the illustration asoag038.eps

This is a text description of asoag038.gif, an image which shows the Oracle Security Architecture and where Enterprise User Security fits in. The image depicts three layers as follows:

The Application Security layer is at the top and it includes the following elements:

  • Third-Party Applications, which provide Authorization and Auditing

  • Oracle E-Business Suite, which provides Responsibilities and Roles

  • Oracle Collaboration Suite, which provides S-MIME (secure e-mail), Interpersonal Rights, and File Privileges

  • OracleAS Portal and OracleAS Wireless, which provide Roles and Privilege Groups

The Oracle Platform Security layer is in the middle and it includes the following elements:

  • Oracle Application Server, which provides JAAS Roles, Web Services Security, and Java 2 Permissions

  • Oracle Database, which provides Enterprise User Security, Virtual Private Database, Encryption, and Label Security

The Oracle Identity Management Infrastructure layer is on the bottom and it includes the following elements:

  • OracleAS Certificate Authority

  • Oracle Delegated Administration Services

  • OracleAS Single Sign-On

  • Oracle Directory Integration Service

  • Oracle Internet Directory (which is at the very bottom, signifying that all the other identity management elements use the directory as their foundation)

The Oracle Identity Management Infrastructure communicates with External Security Services, which are located adjacent to the infrastructure to signify that the external services are at the same layer. External Security Services include the following elements:

  • Access Management

  • Directory Services

  • Provisioning Services

PK%[  PK&AOEBPS/img_text/asoag032.htm Description of the illustration asoag032.eps

This is a text description of asoag032.gif, an image which shows the structure of a typical Oracle Context. An Oracle Context is an entry in Oracle Internet Directory called cn=OracleContext. All Oracle software relevant information is kept in the Oracle Context, including entries for Oracle Net directory naming and enterprise user security. Each identity management realm in an Oracle Internet Directory instance has one Oracle Context.

This diagram shows a hierarchical structure that resembles an inverted tree. The identity management realm, labeled "realm DN" for realm distinguished name, is at the top of the tree. Branching off under the realm DN are containers for Users, Groups, and the Oracle Context. Branching off under the Oracle Context are containers for Products, Groups, and Database Servers (in this example, the Database Servers container is labeled "Sales.") Of these three containers that branch off of the Oracle Context container, Products and Groups are default container names. Under each of these containers additional sub-containers branch out as follows:

  1. The Products container holds two sub-containers. These are the subcontainer which holds the User Search Base and the Group Search Base, and the OracleDBSecurity subcontainer. These two subcontainers are both default containers. The OracleDBSecurity container has two sub-containers that branch off under it. These are: An Enterprise Domain container, labeled "Services" in this example, and the OracleDefaultDomain container. The OracleDefaultDomain container is a default container. Under the Enterprise Domain container that is labeled "Services," is one sub-container. This sub-container is the Services Domain container and it is labeled Domain Admins in this example. The second container under OracleDBSecurity, the OracleDefaultDomain container, has three sub-containers branching off under it. These are "Domain Admins," which is an example of a Default Domain container, "Schema Mapping," which is an example of a user-defined container, and the "Manager" sub-container, which is an example of an Enterprise Roles container.

  2. The Groups container is actually another subtree that branches off under the Oracle Context. It contains subtrees with root containers for the following groups: OracleDBCreators, OracleContextAdmins, OracleDBSecurityAdmins, OracleUserSecurityAdmins, and OraclePasswordAccessibleDomains.

  3. The Database Server container that is labeled "Sales" has three sub-containers that branch off under it. These sub-containers are OracleDBAdmins Group, Schema Mapping, and Networking. The Networking subcontainer is another subtree that branches off under the database server container. OracleDBAdminsGroup and Networking are default containers. User-Schema Mapping is an example of a user-defined container. All of these containers are described in the surrounding text.

PK6pۙ  PK&AOEBPS/img_text/getstrtd7.htm@ Description of the illustration getstrtd7.gif

Description can be found in the procedure.

PKb~?PK&AOEBPS/img_text/getstrtd6.htm@ Description of the illustration getstrtd6.gif

Description can be found in the procedure.

PKAd/PK&AOEBPS/img_text/getstrtd8.htm@ Description of the illustration getstrtd8.gif

Description can be found in the procedure.

PKPK&AOEBPS/img_text/netca4.htmC Description of the illustration netca4.gif

Description can be found in the procedure.

PKrPK&AOEBPS/img_text/netca3.htmC Description of the illustration netca3.gif

Description can be found in the procedure.

PKpPK&AOEBPS/img_text/getstrtd14.htm? Description of the illustration getstrtd14.gif

Description can be found in the procedure.

PK"~ԤPK&AOEBPS/img_text/asoag033.htmO Description of the illustration asoag033.eps

This is a text description of asoag033.gif, an image which shows an example of an enterprise role. This image depicts a section of an Oracle Internet Directory directory information tree where the enterprise roles are stored. A directory information tree is a hierarchical structure that resembles an inverted tree. It contains entries in the directory.

An identity management realm, labeled "Eastern Region," appears at the top of the image. An Oracle Context, a container specifically designed to store Oracle product information in Oracle Internet Directory, branches off from the identity management realm. An enterprise domain labeled "Acme Widgets" branches off from the Oracle Context. The enterprise role labeled "sales_manager" branches off from the enterprise domain. The sales_manager enterprise role contains two database global roles, "manage_leads" and "bonus_approval." The manage_leads global database role is defined in the Customer Relationship Management (CRM) database. The bonus_approval global role is defined in the Finance database. Both databases are registered in the Acme Widgets enterprise domain. When a database is registered in an enterprise domain, an entry for the database is created in the directory. This enables the database to bind with (log in to) the directory.

PKӛOPK&AOEBPS/appa.htm Using the User Migration Utility

A Using the User Migration Utility

This chapter describes the User Migration Utility. You can use it to perform bulk migrations of database users to an LDAP directory, where they can be stored and managed centrally as enterprise users. It contains the following topics:

A.1 Benefits of Migrating Local or External Users to Enterprise Users

Migrating from a database user model to an enterprise user model provides solutions to administrative, security, and usability challenges in an enterprise environment. In an enterprise user model, all user information is moved to an LDAP directory service.

Enterprise user security provides the ability to easily and securely manage enterprise wide users by providing the following benefits:

  • Centralized storage of user credentials, roles, and privileges in an LDAP version 3-compliant directory server

  • Provides the infrastructure to enable single sign-on using X.509v3-compliant certificates, typically deployed where end-to-end SSL is required

  • Enhanced security through more timely maintenance and fewer user passwords

    The centralization of user information inherent in the enterprise user model makes it easier to manage. Security administrators can perform necessary maintenance changes to user information immediately, thereby maintaining better control over access to critical network resources. In addition, users find the enterprise user model easier to use because they have fewer passwords to remember. So, they are less likely to choose easily guessed passwords or to write them down where others can copy them.


    See Also:

    "Introduction to Enterprise User Security" for detailed conceptual information about enterprise user security

A.2 Introduction to the User Migration Utility

The User Migration Utility is a command-line utility that enables enterprise user administrators to move their users from a local database model to an enterprise user model. You can easily migrate thousands of local and external database users to an enterprise user environment in an LDAP directory where they can be managed from a central location. The utility connects to the database using the Oracle JDBC OCI driver.

Enterprise user administrators can select for migration any combination of the following user subsets in a database:

    • List of users specified on the command line or in a file

    • All external users

    • All global users

In addition, enterprise user administrators can specify values for utility parameters that determine how the users are migrated such as

    • Where to put the migrated users in the LDAP directory tree

    • Map a user with multiple accounts on various databases to a single directory user entry

The following sections explain the migration process and the changes that occur to user schemas.


Note:

After external users are migrated, their external authentication and authorization mechanisms are replaced by directory-based mechanisms. New passwords are randomly generated for migrated users if they are mapped to newly created directory entries.

A.2.1 Bulk User Migration Process Overview

Bulk user migration is a two-phase process. In Phase One, you start the migration process by populating user information into an interface database table. Enterprise user administrators then verify that the information is accurate before completing the migration with Phase Two, which commits the changes to the database and the directory. The process is described in the following steps:

A.2.1.1 Step 1: (Phase One) Preparing for the Migration

In the first part of the migration process, the utility checks if the ORCL_GLOBAL_USR_MIGRATION_DATA interface table exists in the enterprise user administrator's schema. If it exists, then the administrator can choose to reuse the table (clearing its contents), reuse the table and its contents, or re-create the table. Phase One can be run multiple times, each time adding to the interface table. If the table does not exist, then the utility creates it in the administrator's schema. The interface table is populated with information about the migrating users from the database and the directory. The command-line options used determine what information populates this table.


Note:

The utility will not create the interface table in the SYS schema.

A.2.1.2 Step 2: Verify User Information

This is an intermediate step to allow the enterprise user administrator to verify that the user information is correct in the interface table before committing the changes to the database and the directory.

A.2.1.3 Step 3: (Phase Two) Completing the Migration

After the interface table user information is checked, Phase Two begins. The utility retrieves the information from the table and updates the directory and the database.

Depending on whether directory entries exist for migrating users, the utility creates random passwords as follows:

  • If migrating users are being mapped to newly created directory entries, then the utility generates random passwords, which are used as credentials for both the database and directory.

  • If migrating users are being mapped to existing directory entries with unset database passwords, then the utility generates random database passwords only.

In either case, after generating the required random passwords, the utility then stores them in the DBPASSWORD and DIRPASSWORD interface table columns. The enterprise user administrator can read these passwords from the interface table and inform migrating users.


See Also:

"User Migration Utility Parameters" for a list of command-line options and their descriptions

A.2.2 About the ORCL_GLOBAL_USR_MIGRATION_DATA Table

This is the interface table which is populated with information about the migrating users during Phase One of the bulk user migration process. The information that populates this table is pulled from the database and checked against existing entries in the directory. If there is corresponding information in the directory, then that is marked in the table for that user. After enterprise user administrators verify the information in this table, changes are made to the directory and the database in Phase Two.


Caution:

The ORCL_GLOBAL_USR_MIGRATION_DATA interface table contains very sensitive information. Access to it should be tightly controlled using database privileges.

The table columns are listed in Table A-1.

Table A-1 ORCL_GLOBAL_USR_MIGRATION_DATA Table Schema

Column NameData TypeNullDescription

USERNAME (Primary Key)

VARCHAR2(30)

NOT NULL

Database user name

OLD_SCHEMA_TYPE

VARCHAR2(10)

-

Old schema type in the database before migration

PASSWORD_VERIFIER

VARCHAR2(30)

-

Not used

USERDN

VARCHAR2(4000)

-

Distinguished Name (DN) of the user in the directory (new or existing)

USERDN_EXIST_FLAG

CHAR(1)

-

Flag indicating whether the DN already exists in the directory

SHARED_SCHEMA

VARCHAR2(30)

-

Shared schema name, if users are to be mapped to a shared schema during phase two

MAPPING_TYPE

VARCHAR2(10)

-

Mapping type (database or domain)

MAPPING_LEVEL

VARCHAR2(10)

-

Mapping level (entry or subtree)

CASCADE_FLAG

CHAR(1)

-

Cascade flag used when dropping a user (for shared schema mapping only)

DBPASSWORD_EXIST_FLAG

CHAR(1)

-

Flag indicating whether the database password verifier already exists in the directory for this user

DBPASSWORD

VARCHAR2(30)

-

Randomly generated database password verifiers to be stored in the directory

DIRPASSWORD

VARCHAR2(30)

-

Randomly generated directory password for new entries

PHASE_COMPLETED

VARCHAR2(10)

-

Information about the phase that has been completed successfully

NEEDS_ATTENTION_FLAG

CHAR(1)

-

Flag indicating whether the row contains abnormalities that require administrator attention

ATTENTION_DESCRIPTION

VARCHAR2(100)

-

Textual hint for the administrator if the attention flag is set

KERBEROS_PNAME

VARCHAR2(30)

-

Kerberos Principal Name for external kerberos users


A.2.2.1 Which Interface Table Column Values Can Be Modified Between Phase One and Phase Two?

After running phase one of the utility, if necessary, enterprise user administrators can change the interface table columns listed in Table A-2.

Table A-2 Interface Table Column Values That Can Be Modified Between Phase One and Phase Two

Column NameValid ValuesRestrictions

USERDN

DN of user

If this value is changed, then the administrator should verify that the USERDN_EXIST_FLAG and the DBPASSWORD_EXIST_FLAG values are set accordingly.

USERDN_EXIST_FLAG

T/F

If the USERDN column value changes, then this column value should also change to reflect the new USERDN status.

DBPASSWORD_EXIST_FLAG

T/F

If the USERDN column value changes, then this column value should also change to reflect whether a database password exists for the new USERDN.

SHARED_SCHEMA

Shared schema name

Specify only if a shared schema exists in the database.

MAPPING_TYPE

DB/DOMAIN

Set this value only if SHARED_SCHEMA is not set to NULL.

MAPPING_LEVEL

ENTRY/SUBTREE

Set this value only if SHARED_SCHEMA is not set to NULL.

CASCADE_FLAG

T/F

Set this value only if SHARED_SCHEMA is not set to NULL. If this column is set to true (T), then the users' schema objects are forcibly deleted. If this column is set to false (F), then the administrator must delete all user schema objects before going into Phase Two.

PHASE_COMPLETED

ZERO/ONE/TWO

If the administrator can resolve the conflicts or ambiguities specified with the NEEDS_ATTENTION_FLAG, then this column value can be changed to ONE so phase two can be run with the utility.


A.2.3 Migration Effects on Users' Old Database Schemas

If shared schema mapping is not used, then users retain their old database schemas. If shared schema mapping is used, then users' local schemas are dropped from the database, and they are mapped to a shared schema that the enterprise user administrator creates for this purpose before performing the migration. When migrated users own database objects in their old local database schemas, administrators can specify that the schema and objects are not to be dropped by setting the CASCADE parameter to NO. When the CASCADE parameter is set to NO, users who own database objects in their old local schemas do not migrate successfully so their objects are not dropped.

If some users want to retain the objects in their local database schemas and be mapped to a shared schema, then the administrator can manually migrate those objects to the shared schema before performing the bulk user migration. However, when objects are migrated to a shared schema, they are shared among all users who share that new schema.

Table A-3 summarizes the effects of setting the MAPSCHEMA and CASCADE parameters.

Table A-3 Effects of Choosing Shared Schema Mapping with CASCADE Options

MAPSCHEMA Parameter SettingCASCADEParameter SettingUser MigrationSuccessful?User SchemaObjects Dropped?

PRIVATE

NO (default setting)

Yes

No

SHARED

NO

YesFoot 1 

No

SHARED

YES

YesFoot 2 

Yes


Footnote 1 Users migrate successfully only if they do not own objects in their old database schemas; otherwise, they fail.

Footnote 2 Users migrate successfully, and their old database schemas are dropped.


See Also:

"User Migration Utility Parameters" for detailed information about the MAPSCHEMA, CASCADE, and other parameters that can be used with this utility

A.2.4 Migration Process

Enterprise users are defined and managed in the directory and can be authenticated to the database either with a password or with a certificate. Users who authenticate with a password require an Oracle Database password, which is stored in the directory. Users who authenticate with a certificate must have a valid X.509 v3 certificate.

This utility performs the following steps during migration:

  1. Selects the users from the database for migration.

  2. Creates corresponding user entries or uses existing entries in the directory.

  3. Creates new database passwords and copies the corresponding verifiers to the directory for migrating users.

  4. Puts the schema mapping information for the migrating users' entries in the directory. (optional)

  5. Drops or alters the migrating users' local database schemas. (optional)


    Note:

    In the current release, the utility migrates users with certificate-based authentication and makes them ready for password authentication. Previously, SSL-based authenticated users were required to reset their Oracle Database passwords. User wallets are not created as part of this process.


    See Also:

    The chapter about Oracle Wallet Manager in Oracle Database Advanced Security Administrator's Guide for information about creating, managing, and using Oracle wallets

A.3 Prerequisites for Performing Migration

The User Migration Utility is automatically installed in the following location when you install Oracle Database Client:

$ORACLE_HOME/rdbms/bin/umu

The following sections describe what programs must be running and what user privileges are required to successfully migrate users with the User Migration Utility.

A.3.1 Required Database Privileges

To successfully use this utility, enterprise user administrators must have the following database privileges:

  • ALTER USER

  • DROP USER

  • CREATE TABLE

  • SELECT_CATALOG_ROLE

These privileges enable the enterprise user administrator to alter users, drop users, look at dictionary views, and create the interface table that is used by this utility.

A.3.2 Required Directory Privileges

In addition to the required database privileges, enterprise user administrators must have the directory privileges which allow them to perform the following tasks:

  • Create entries in the directory under the specified user base and Oracle context location

  • Browse the user entries under the search bases

A.3.3 Required Setup to Run the User Migration Utility

Perform the following steps before using the User Migration Utility:

  1. Ensure that the directory server is running with SSL enabled for no authentication.

  2. Ensure that the database server is running with encryption and integrity enabled.

  3. Ensure that the database listener has a TCP listening end point.

  4. Create an identity management realm in the directory, if it does not already exist.

  5. Create the parent context for the user entries in the directory, if it does not already exist. The default (and recommended) location is in the orclcommonusercreatebase subtree in the common container in the Oracle Context.

  6. Set up directory access for the database Oracle home by using Oracle Net Configuration Assistant to create an ldap.ora file. Note that the ldap.ora file must include the identity management realm DN so the utility can locate the correct administrative context. The utility searches for this file under $LDAP_ADMIN, $ORACLE_HOME/ldap/admin, $TNS_ADMIN, $ORACLE_HOME/network/admin, and, finally, the Domain Name System (DNS) server, if you are using DNS discovery. (See Oracle Internet Directory Administrator's Guide for information about DNS server discovery.)


    Note:

    • If you plan to use shared schema mapping when migrating users, then you must create the shared schema before running this utility.

    • The same ldap.ora file must be used for both Phase One and Phase Two of a user migration.



    See Also:


A.4 User Migration Utility Command-Line Syntax

To perform a bulk migration of database users to enterprise users, use the following syntax:

umu parameter1 parameter2 ...

For parameters that take a single value use the following syntax:

keyword=value

For parameters that take multiple values, use a colon (:) to separate the values as in the following syntax:

keyword=value1:value2:...

Example A-1 shows the syntax used to run the utility through both phases of the bulk user migration process.

Example A-1 User Migration Utility Command-Line Syntax

umu PHASE=ONE

DBADMIN=dba_username:password
ENTADMIN=enterprise_admin_DN:password
USERS=[ALL_GLOBAL | ALL_EXTERNAL | LIST | FILE]
DBLOCATION=database_host:database_port:database_sid
DIRLOCATION=ldap_directory_host:ldap_directory_port
USERSLIST=username1:username2:username3:...
USERSFILE=filename
MAPSCHEMA=[PRIVATE | SHARED]:schema_name
MAPTYPE=[DB | DOMAIN]:[ENTRY | SUBTREE]
CASCADE=[YES | NO]
CONTEXT=user_entries_parent_location
LOGFILE=filename
PARFILE=filename
KREALM=EXAMPLE.COM

umu PHASE=TWO

DBADMIN=dba_username:password
ENTADMIN=enterprise_admin_DN:password
DBLOCATION=database_host:database_port:database_sid
DIRLOCATION=ldap_directory_host:ldap_directory_port
LOGFILE=filename
PARFILE=filename

Note:

If the enterprise user administrator does not specify the mandatory parameters on the command line, then the utility will prompt the user for those parameters interactively.


See Also:


A.5 Accessing Help for the User Migration Utility

To display the command-line syntax for using the User Migration Utility, enter the following command at the system prompt:

umu HELP=YES

While the HELP parameter is set to YES, the utility cannot run.

A.6 User Migration Utility Parameters

The following sections list the available parameter keywords and the values that can be used with them when running this utility. The keywords are not case-sensitive.

A.6.1 Keyword: HELP

AttributeDescription
Valid Values:YES or NO (These values are not case-sensitive.)
Default Setting:NO
Syntax Examples:HELP=YES
Description:This keyword is used to display Help for the utility. YES displays the complete command-line syntax. To run a command, set the value to NO, or do not specify a value for the parameter to accept the default.
Restrictions:None

A.6.2 Keyword: PHASE

AttributeDescription
Valid Values:ONE or TWO (These values are not case-sensitive.)
Default Setting:ONE
Syntax Examples:PHASE=ONE

PHASE=TWO

Description:Indicates the phase for the utility. If it is ONE, then the utility populates the interface table with the information specified in the command-line arguments and the existing user entries in the directory. If it is TWO, then the utility uses the information that is available in the interface table and updates the directory and the database.
Restrictions:None

A.6.3 Keyword: DBLOCATION

AttributeDescription
Valid Values:host:port:sid
Default Setting:No default setting
Syntax Examples:DBLOCATION=my_oracle.us.example.com:7777:ora902
Description:Provides the host name, port number, and SID for the database instance
Restrictions:
  • This parameter is mandatory.

  • The value for this parameter must be the same for both Phase One and Phase Two.

  • The database should be configured for encryption and integrity.


A.6.4 Keyword: DIRLOCATION

AttributeDescription
Valid Values:host:port
Default Setting:This value is automatically populated from the ldap.ora file by default.
Syntax Examples:DIRLOCATION=my_oracle.us.example.com:636
Description:Provides the host name and port number for the directory server where the LDAP server is running on SSL with no authentication
Restrictions:The value for this parameter must be the same for both Phase One and Phase Two.

A.6.5 Keyword: DBADMIN

AttributeDescription
Valid Values:username:password
Default Setting:No default setting
Syntax Examples:DBADMIN=system:manager
Description:User name and password for the database administrator with the required privileges for connecting to the database
Restrictions:
  • This parameter is mandatory.

  • The username value for this parameter must be the same for both Phase One and Phase Two.


A.6.6 Keyword: ENTADMIN

AttributeDescription
Valid Values:userDN:password
Default Setting:No default setting
Syntax Examples:ENTADMIN=cn=janeadmin,dc=acme,dc=com:Easy2rem
Description:User Distinguished Name (UserDN) and the directory password for the enterprise directory administrator with the required privileges for logging in to the directory. UserDN can also be specified within double quotation marks ("").
Restrictions:This parameter is mandatory.

A.6.7 Keyword: USERS

AttributeDescription
Valid Values:value1:value2...

Values can be:

  • ALL_EXTERNAL to select all external users, including those who use Kerberos and RADIUS authentication

  • ALL_GLOBAL to select all global users

  • LIST to specify users on the command line with "Keyword: USERSLIST"

  • USERSFILE for selecting users from the file that is specified with the "Keyword: USERSFILE"

This parameter takes multiple values. Separate values with a colon (:).

(These values are not case-sensitive.)

Default Setting:No default setting
Syntax Examples:
  • USERS=ALL_EXTERNAL:ALL_GLOBAL

    This usage instructs the utility to migrate all external users and all global users.

  • USERS=ALL_EXTERNAL:FILE

    This usage instructs the utility to migrate all external users and all users specified in USERSFILE.

Description:Specifies which users are to be migrated. If multiple values are specified for this parameter, then the utility uses the union of these sets of users.
Restrictions:This parameter is mandatory for Phase One only, and it is ignored in Phase Two.

A.6.8 Keyword: USERSLIST

AttributeDefinition
Valid Values:user1:user2:...

Separate user names with a colon (:).

Default Setting:No default setting
Syntax Examples:USERSLIST=jdoe:tchin:adesai
Description:Specifies a list of database users for migration. The users in this list are migrated with other users specified with the USERS parameter.
Restrictions:This optional parameter is effective only when LIST is specified with the USERS parameter.

A.6.9 Keyword: USERSFILE

AttributeDefinition
Valid Values:File name and path
Default Setting:No default setting
Syntax Examples:USERSFILE=/home/orahome/userslist/hr_users.txt
Description:Specifies a file that contains a list of database users (one user listed for each line) for migration. The users in this file are migrated with other users specified with the USERS parameter.
Restrictions:This optional parameter is effective only when FILE is specified with the USERS parameter.

A.6.10 Keyword: KREALM

AttributeDescription
Valid Values:kerberos realm
Default Setting:No default setting
Syntax Examples:KREALM=EXAMPLE.COM
Description:Kerberos REALM for external kerberos users, which will usually be the domain name of the database server.If this parameter is not specified, then all external users who are considered for migration are assumed to be non-Kerberos.
Restrictions:
  • This parameter is valid only for Phase One.

A.6.11 Keyword: MAPSCHEMA

AttributeDescription
Valid Values:schema_type:schema_name

Schema type can be:

  • PRIVATE

    Retains users' old local schemas. Schema name is ignored when schema type is PRIVATE. No mapping entries are created in the directory.

  • SHARED

    Maps users to a shared schema. Mapping entries are created in the directory. Schema name specifies the shared schema name. During shared schema mapping, whether users' local schemas are dropped from the database is determined by the "Keyword: CASCADE" setting.

(These values are not case-sensitive.)

Default Setting:PRIVATE
Syntax Examples:MAPSCHEMA=SHARED:HR_ALL
Description:Specifies whether the utility populates the interface table with schema mapping information.
Restrictions:
  • See the SHARED option under Valid Values.

  • This parameter is valid only for Phase One.


A.6.12 Keyword: MAPTYPE

AttributeDescription
Valid Values:mapping_type:mapping_level

Mapping type can be:

  • DB

  • DOMAIN

Mapping level can be:

  • ENTRY

  • SUBTREE

Separate mapping type from mapping level with a colon (:).

(These values are not case-sensitive.)

Default Setting:DB:ENTRY
Syntax Examples:MAPTYPE=DOMAIN:SUBTREE
Description:Specifies the type of schema mapping that is to be applied when "Keyword: MAPSCHEMA" is set to SHARED. If DB is specified as the mapping type, then the utility creates a mapping in the directory for the database. If DOMAIN is specified as the mapping type, then the utility creates a mapping in the directory for the domain containing the database. For domain mapping, the utility determines the domain that contains the database by an LDAP search in the relevant Oracle context.
Restrictions:This parameter is effective only when MAPSCHEMA is set to SHARED.


See Also:

"About Using the SUBTREE Mapping Level Option" for more information about using this mapping level option

A.6.13 Keyword: CASCADE

AttributeDescription
Valid Values:
  • NO

    When users are mapped to a shared schema, the utility tries to drop their local schemas from the database. If this parameter is set to NO, then users are migrated only if they do not own objects in their local schema. Users who own objects in their old local schemas do not migrate. An error message is logged in the migration log file for such users.

  • YES

    If this parameter is set to YES, then all users' schema objects are dropped along with their local schemas when they are migrated. Privileges and roles that were previously granted to the users are also revoked.

(These values are not case-sensitive.)

Default Setting:NO
Syntax Examples:CASCADE=YES
Description:Specifies whether a user's local schema is dropped when the user is mapped to a shared schema
Restrictions:This parameter is effective only when MAPSCHEMA is set to SHARED.

A.6.14 Keyword: CONTEXT

AttributeDescription
Valid Values:Distinguished Name (DN) of the parent for user entries. This is the same as the user search base or user create base in an Oracle Internet Directory identity management realm.

Parent DN can also be specified within double quotation marks ("").

Default Setting:Value set in orclCommonUserCreateBase attribute under cn=Common of Oracle Context

Refer to Figure 1-3, "Related Entries in a Realm Oracle Context" for a directory information tree diagram that shows an Oracle Context.

Syntax Examples:CONTEXT="c=Users, c=us"
Description:Specifies the DN of the parent entry under which user entries are created in the directory if there is no directory entry that matches the userID for the user
Restrictions:This parameter is valid only for phase one.

A.6.15 Keyword: LOGFILE

AttributeDescription
Valid Values:File name and path
Default Setting:$ORACLE_HOME/network/log/umu.log
Syntax Examples:LOGFILE=home/orahome/network/log/filename.log
Description:Specifies the log file where details about the migration for each user are written
Restrictions:None

A.6.16 Keyword: PARFILE

AttributeDescription
Valid Values:File name and path
Default Setting:No default setting
Syntax Examples:PARFILE=home/orahome/network/usr/par.txt
Description:Specifies a text file containing a list of parameters intended for use in a user migration. Each parameter must be listed on a separate line in the file. If a parameter is specified both in the parameter file and on the command line, then the one specified on the command line takes precedence.
Restrictions:None

A.7 User Migration Utility Usage Examples

The following sections contain examples of the syntax for some typical uses of this utility.

A.7.1 Migrating Users While Retaining Their Own Schemas

To migrate users while retaining their old database schemas, set the MAPSCHEMA parameter to PRIVATE, which is the default setting. For example, to migrate users scott1, scott2, and all external database users, retaining their old schemas, to the directory at c=Users, c=us with the newly generated database and directory passwords, use the syntax shown in Example A-2.


Note:

All external users being migrated are considered non-Kerberos by default. For existing Kerberos users, you can have the utility set their Kerberos principal name attribute in Oracle Internet Directory after migration. To do this, specify the KREALM parameter on the command line by using the Kerberos REALM value. For example, if the Kerberos REALM value is EXAMPLE.COM, then you would enter KREALM=EXAMPLE.COM. Once you do this, those users with names of the form user@kerberos_realm are considered Kerberos users. In Oracle Internet Directory, their Kerberos principal names are set by using their database user names.

See Also: "Keyword: KREALM"


Example A-2 Migrating Users with MAPSCHEMA=PRIVATE (Default)

umu PHASE=ONE

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
USERS=ALL_EXTERNAL:LIST
USERSLIST=scott1:scott2
DIRLOCATION=machine2:636
CONTEXT="c=Users,c=us"
ENTADMIN="cn=janeadmin":Easy2rem

umu PHASE=TWO

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
DIRLOCATION=machine2:636
ENTADMIN="cn=janeadmin":Easy2rem

After Phase One is completed successfully, the interface table is populated with the user migration information. Then, the enterprise user administrator can review the table to confirm its contents. Because no value was specified for the MAPSCHEMA parameter, the utility runs Phase One using the default value, PRIVATE, so all users' old database schemas and objects are retained.

A.7.2 Migrating Users and Mapping to a Shared Schema

To migrate users and map them to a new shared schema, dropping their old database schemas, set the MAPSCHEMA parameter to SHARED. The shared schema must already exist, or the enterprise user administrator must create it before running the utility with this parameter setting. In the following example, users scott1, scott2, and all external database users are migrated to the directory at c=Users, c=us with newly generated database and directory passwords, while mapping all migrated users to a new shared schema in the database.

Use the syntax shown in Example A-3 to run the migration process with MAPSCHEMA set to SHARED.

Example A-3 Migrating Users with MAPSCHEMA=SHARED

umu PHASE=ONE

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
USERS=ALL_EXTERNAL:LIST
USERSLIST=scott1:scott2
MAPSCHEMA=SHARED:schema_32
DIRLOCATION=machine2:636
CONTEXT="c=Users, c=us"
ENTADMIN="cn=janeadmin":Easy2rem

umu PHASE=TWO

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
DIRLOCATION=machine2:636
ENTADMIN="cn=janeadmin":Easy2rem

After Phase One is completed successfully, the interface table is populated with the user migration information. Then, the administrator can review the table to confirm its contents. Users scott1, scott2, and the external users are assigned new randomly generated database and directory passwords. Because no value was specified for the CASCADE parameter, the utility runs Phase One using the default value, NO, which means that migrating users who own database objects in their old database schemas will fail and their schemas will not be automatically dropped. To determine which users have failed, review the log file that is located at $ORACLE_HOME/network/log/umu.log by default.

A.7.2.1 Mapping Users to a Shared Schema Using Different CASCADE Options

The CASCADE parameter setting determines whether users' old database schemas are automatically dropped when mapping to a shared schema during migration. CASCADE can be used only when MAPSCHEMA is set to SHARED.

A.7.2.1.1 Mapping Users to a Shared Schema with CASCADE=NO

By default, the CASCADE parameter is set to NO. This setting means that when mapping migrating users to a shared schema, users who own database objects in their old schemas are not migrated. For users who do not own database objects, their old database schemas are automatically dropped, and they are mapped to the new shared schema.


See Also:

Example A-3 for a syntax example to map users to a shared schema with CASCADE set to NO. Note that because NO is the default setting for CASCADE, this parameter does not have to be specified in the utility command syntax

A.7.2.1.2 Mapping Users to a Shared Schema with CASCADE=YES

If it is known that no migrating users own database objects or want to retain the objects that they own in their old database schemas, then setting the CASCADE parameter to YES automatically drops all users' schemas and schema objects and maps them to the new shared schema. Example A-4 shows the syntax to use when setting CASCADE to YES. In this example, users scott1, scott2, and all external database users are migrated to the directory at c=Users, c=us, while mapping all migrating users to a new shared schema in the database.

Example A-4 Migrating Users with Shared Schema Mapping and CASCADE=YES

umu PHASE=ONE

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
USERS=ALL_EXTERNAL:LIST
USERSLIST=scott1:scott2
MAPSCHEMA=SHARED:schema_32
CASCADE=YES
DIRLOCATION=machine2:636
CONTEXT="c=Users, c=us"
ENTADMIN="cn=janeadmin":Easy2rem

umu PHASE=TWO

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
DIRLOCATION=machine2:636
ENTADMIN="cn=janeadmin":Easy2rem

After Phase One is completed successfully, the interface table is populated with the user migration information. Then, the administrator can review the table to confirm its contents. Because the CASCADE parameter is set to YES, all migrated users' old database schemas are automatically dropped, including those who own database objects.


Caution:

If you set the CASCADE parameter to YES, then Oracle recommends that enterprise user administrators back up the database or take an export dump of the users being migrated before running this utility. Then, if migrated users want their old database objects, then they can retrieve them from the export dump.

A.7.2.2 Mapping Users to a Shared Schema Using Different MAPTYPE Options

When MAPSCHEMA is set to SHARED, the mapping type can be set by specifying a value for the MAPTYPE parameter. This parameter takes two values, which are mapping type and mapping level.

Mapping type can be set at DB, for database, or DOMAIN, for enterprise domain. When mapping type DB is specified, the mapping is applied only to the database where the shared schema is stored. When DOMAIN is specified as the mapping type, the mapping is applied to the enterprise domain that contains the database where the shared schema is stored and also applies to all databases in that domain.

Mapping level can be set to ENTRY or SUBTREE. When ENTRY is specified, users are mapped to the shared schema using their full distinguished name (DN). This results in one mapping for each user. When SUBTREE is specified, groups of users who share part of their DNs are mapped together. This results in one mapping for user groups already grouped under some common root in the directory tree. Example A-5 shows the syntax to use when using the MAPTYPE parameter. In this example, users scott1, scott2, and all external database users are migrated to the directory at c=Users, c=us, while mapping all migrated users to a new shared schema in the database. In this example, the mapping will apply to the enterprise domain that contains the database, and the mapping will be performed at the entry level, resulting in a mapping for each user.

Example A-5 Migrating Users with Shared Schema Mapping Using the MAPTYPE Parameter

umu PHASE=ONE

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
USERS=ALL_EXTERNAL:LIST
USERSLIST=scott1:scott2
MAPSCHEMA=SHARED:schema_32
MAPTYPE=DOMAIN:ENTRY
DIRLOCATION=machine2:636
CONTEXT="c=Users, c=us"
ENTADMIN="cn=janeadmin":welcome

umu PHASE=TWO

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
DIRLOCATION=machine2:636
ENTADMIN="cn=janeadmin":welcome
A.7.2.2.1 About Using the SUBTREE Mapping Level Option

If a user (scott, for example) who is being migrated will have future user entries in a subtree under it, then it makes sense to create a subtree level mapping from this user entry (cn=scott) to a schema. However, the database does not interpret the user to be in the subtree so the mapping does not apply to scott himself. For example, if you are migrating the user scott with the DN cn=scott,o=acme, and you choose SUBTREE as the mapping level when you run the utility, then a new mapping is created from cn=scott,o=acme to the shared schema, but the user scott is not mapped to that schema. Only new users who are created under the scott directory entry are mapped to the shared schema. Consequently, the SUBTREE mapping level should only be specified when user directory entries are placed under other user directory entries, which would be an unusual directory configuration.

If you want an arbitrary subtree user to be mapped to a single shared schema with only one mapping entry, then you must use Oracle Enterprise Manager to create that mapping.


See Also:

"Creating User-Schema Mappings for an Enterprise Domain" for information about using Oracle Enterprise Manager

A.7.3 Migrating Users Using the PARFILE, USERSFILE, and LOGFILE Parameters

It is possible to enter user information and User Migration Utility parameters into a text file and pass the information and parameters to the utility using the PARFILE and USERSFILE parameters. The LOGFILE parameter sets the directory path for the log file where details about the migration for each user are written.

The PARFILE parameter tells the utility where a text file is located that contains the parameters for a bulk user migration. The USERSFILE parameter works like the PARFILE parameter, except that it contains database users instead of parameters. The parameters and users lists contain one parameter or user for each line. The LOGFILE parameter tells the utility where to write the system events that occur during a user migration, such as errors. Use the USERSFILE parameter during Phase One of the migration process. The PARFILE and LOGFILE parameters can be used in both phases.

Example A-6 shows the syntax for a typical parameter text file to migrate users scott1, scott2, and all external database users, while retaining their old schemas, to the directory at c=Users, c=us. In this example, a log of migration events is written to the file errorfile1 in the directory where the utility is run. If another location is desired, then include the path with the file name.

Example A-6 Parameter Text File (par.txt) to Use with the PARFILE Parameter

DBLOCATION=machine1:1521:ora_sid
DBADMIN=system:manager
USERS=ALL_EXTERNAL:LIST:FILE
USERSLIST=scott1:scott2
USERSFILE=usrs.txt
DIRLOCATION=machine2:636
CONTEXT="c=Users, c=us"
ENTADMIN="cn=janeadmin":Easy2rem
LOGFILE=errorfile1

Example A-7 shows the syntax for a typical users list text file.

Example A-7 Users List Text File (usrs.txt) to Use with the USERSFILE Parameter

user1
user2
user3

To run Phase One of the migration process with these parameters and users list text files, use the syntax shown in Example A-8.

Example A-8 Migrating Users Using the PARFILE, USERSFILE, and LOGFILE Parameters

umu PHASE=ONE

DBADMIN=system:manager
PARFILE=par.txt
LOGFILE=errorfile2

Note:

Although the LOGFILE parameter is specified twice, once in the parameter text file as errorfile1 (shown in Example A-6) and once on the command line as errorfile2 (shown in Example A-8), command-line parameters take precedence over those specified inside the parameter file. Consequently, in Example A-8, the log file will be written to errorfile2 because that value is specified on the command line.

A.8 Troubleshooting Using the User Migration Utility

Migration failures are reported to the enterprise user administrator with error messages and log messages. The following sections describe common error and log messages and what administrators can do to resolve them.


See Also:

"Summary of User Migration Utility Error and Log Messages" for an alphabetical listing of error and log messages and links to where they are described in this section

A.8.1 Common User Migration Utility Error Messages

When the utility encounters any error while running, it displays an error message and stops running. The following sections describe these messages and explain how to resolve the errors:

A.8.1.1 Resolving Error Messages Displayed for Both Phases

The following error messages may be displayed while the utility is running either Phase One or Phase Two of the migration:

Attribute value missing : : orclCommonNicknameAttribute
Cause: The nickname attribute is not set in the directory in the root identity management realm.
Action: Use Oracle Internet Directory Self-Service Console to set the nickname attribute for the identity management realm.
Database connection failure
Cause: The utility was unable to connect to the database.
Action: Perform these steps:

  1. Check the database status to determine whether it is configured for encryption and integrity.

  2. Check the privileges and credentials of the enterprise user administrator who is running the utility.

Database error: < database_error_message >
Cause: The utility encountered a database error.
Action: Check the database error message details for the database.

See Also:

Oracle Database Error Messages for information about resolving database error messages

Database not in any domain : : DB-NAME = < database_name >
Cause: The database is not a member of any enterprise domain.
Action: Use Oracle Enterprise Manager to add the database to an enterprise domain in the directory.
Database not registered with the directory : : DB-NAME = < dbName >
Cause: There is no entry for the database in the Oracle Context that the ldap.ora file points to.
Action: Use Database Configuration Assistant to register the database in the directory.
Directory connection failure
Cause: The utility was unable to connect to the directory.
Action: Perform these steps:

  1. Check the directory server status to determine whether the directory server port is configured for SSL with no authentication.

  2. Check the privileges and credentials of the enterprise user administrator who is running the utility.

Directory error : : < directory_error_message >
Cause: The utility encountered a directory error.
Action: Check the directory error message details for the directory.

See Also:

Oracle Internet Directory Administrator's Guide information about resolving error messages for Oracle Internet Directory

Multiple entries found : : uniqueMember = < database_DN >
Cause: The database belongs to more than one enterprise domain in the directory.
Action: Use Oracle Enterprise Manager to ensure that the database belongs to only one enterprise domain.

A.8.1.2 Resolving Error Messages Displayed for Phase One

While the utility is running Phase One of the migration, syntax or other types of errors may occur. The following error messages may be displayed while the utility is running Phase One of the migration:

Argument missing or duplicated : : < parameter >
Cause: Syntax error. A parameter is missing or has been entered multiple times.
Action: Check the usage syntax.
Database object missing : : SHARED-SCHEMA = <shared_schema_name >
Cause: The shared schema is not present in the database.
Action: Create the shared schema.
Error reading file : : < file_name > : : < io_error_message >
Cause: Syntax error. The utility cannot read the file that contains the users list that is specified in the USERSFILE parameter.
Action: Perform these steps:

  1. Check to ensure that the file exists.

  2. Check to ensure that the file has the correct permissions so the utility can read it.

Error reading file : : PARFILE = < file_name > : : < io_error_message>
Cause: Syntax error. The utility cannot read the file that contains the list of parameters that is specified in the PARFILE parameter.
Action: Perform these steps:

  1. Check to ensure that the file exists.

  2. Check to ensure that the file has the correct permissions so the utility can read it.

Getting local host name failed
Cause: Syntax error. The utility is unable to read the local host name for the database location or the directory location.
Action: Explicitly enter the host name information with the DBLOCATION and DIRLOCATION parameters.

See Also:

for information about how to use these parameters


Interface table creation in SYS schema not allowed
Cause: The interface table cannot be created in the SYS schema.
Action: Specify another user in the DBADMIN parameter.

See Also:

"Keyword: DBADMIN" for information about setting the DBADMIN parameter

Invalid argument or value : : < argument >
Cause: Syntax error. The argument name or value has been entered incorrectly.
Action: Check the usage syntax.
Invalid arguments for the phase
Cause: Syntax error. This occurs when you have used a command-line argument that is only intended for Phase One, but you are running Phase Two.
Action: Check the usage syntax.
Invalid value : : < user > [ USERSFILE ]
Cause: Syntax error. The user that is specified in this error message is invalid because he is not a user in the database that is specified in the DBLOCATION parameter.
Action: Remove the invalid user from the file that is specified with the USERSFILE parameter.
Invalid value : : < user > [ USERSFILE ] { = = DBADMIN }
Cause: Syntax error. The file that is specified in the USERSFILE parameter contains the user who is running the migration utility.
Action: Remove that user from the file.
Invalid value : : < user > [ USERSLIST ]
Cause: Syntax error. The user that is specified in this error message is invalid because they are not a user in the database that is specified in the DBLOCATION parameter.
Action: Remove the invalid user from the USERSLIST parameter.
Invalid value : : < user > [ USERSLIST ] { = = DBADMIN }
Cause: Syntax error. The USERSLIST parameter contains the user who is running the migration utility.
Action: Remove that user from the USERSLIST parameter.
Logging failure : : < io_error_message >
Cause: Syntax error. The utility cannot find the log file or it cannot open the file to write to it.
Action: Perform these steps:

  1. Check to ensure that the log file exists.

  2. Check to ensure that the log file has the correct permissions so the utility can write information to it.

No entry found : : CONTEXT = < context >
Cause: The CONTEXT entry is not present in the directory.
Action: Perform one of the following steps:

  • Use the directory management tool or the LDAP command-line utility to create an entry in the directory for the context value.

  • Specify another valid context value.

A.8.1.3 Resolving Error Messages Displayed for Phase Two

Most of the error messages that you encounter while running this utility occur in Phase One. After Phase One has completed successfully, and while Phase Two is running, the following error may occur:

Database object missing : : TABLE = ORCL_GLOBAL_USR_MIGRATION_DATA
Cause: The utility cannot find the interface table.
Action: Perform one of the following steps:

  • Run Phase One of the utility to create the interface table.

  • Check to ensure that the user who is specified in the DBADMIN parameter is the same user who was specified for that parameter for Phase One.

A.8.2 Common User Migration Utility Log Messages

Typically, log messages are written to the log file for each user who is migrated, whether the user was migrated successfully or not. The following sections describe these messages and explain how to resolve the errors:

A.8.2.1 Common Log Messages for Phase One

While the utility is running Phase One of the migration, messages that indicate that a user's information has not been successfully populated in the interface table may be written to the log file. After the utility completes Phase One, review the log file to check for the following messages:

Multiple entries found : : < nickname_attribute > = < username >
Cause: The nickname attribute matches multiple users or the user matches with multiple nickname attributes.
Action: Resolve the multiple matches and run the utility again for the users whose log file entry displayed this message.
No entry found : : < nickname_attribute > = < username > : : Entry found : DN = < dn >
Cause: No entry was found for the nickname matching, but an entry already exists for the DN in the directory.
Action: Specify a different DN for the user.

A.8.2.2 Common Log Messages for Phase Two

While the utility is running Phase Two of the migration, messages that indicate that a user has not successfully migrated may be written to the log file. After the utility completes Phase Two, review the log file to check for the following messages:

Attribute exists : : orclPassword
This message typically occurs with the message Invalid value::<column_name>=<column_value>.
Cause: The entry already contains a value for the orclPassword attribute.
Action: Check the DBPASSWORD_EXIST_FLAG column in the interface table for a T/F value that correctly reflects whether a database password exists for this user.
Attribute value missing : : orclPassword
This message typically occurs with the message Invalid value::<column_name>=<column_value>.
Cause: The orclPassword attribute of this user's entry has a null value.
Action: Check the DBPASSWORD_EXIST_FLAG column in the interface table for a T/F value that correctly reflects whether a database password exists for this user.
Database object missing : : SHARED-SCHEMA = < shared_schema >
Cause: The shared schema that was specified for this user does not exist in the database.
Action: Perform one of the following steps:

  • Check to ensure that the correct shared schema was specified for this user. If the shared schema name was incorrectly specified, then edit the SHARED_SCHEMA column of the interface table and run Phase Two of the utility for this user again.

  • Create the shared schema in the database and run Phase Two of the utility for this user again.

Entry found : : DN = < user_DN >
This message typically occurs with the message Invalid value::<column_name>=<column_value>.
Cause: An entry already exists for the specified user DN.
Action: Check the USERDN_EXIST_FLAG column in the interface table for a T/F value that correctly reflects whether a user entry already exists in the directory for this DN.
Invalid value : : <interface_table_column_name> = < interface_table_column_value >
Cause: The value in the interface table column for this user is invalid. Typically, this message is accompanied by additional log messages for this user.
Action: Check to ensure that the correct value has been entered for this user.
No entry found : : DN = < user_DN >
This message typically occurs with the message Invalid value::<column_name>=<column_value>.
Cause: The entry for the DN is missing in the directory.
Action: Check the USERDN_EXIST_FLAG column in the interface table for a T/F value that correctly reflects whether a user entry already exists in the directory for this DN.

A.8.3 Summary of User Migration Utility Error and Log Messages

Table A-4 and Table A-5 list all of the error and log messages in alphabetical order and provides links to the section in this chapter that describes the message and how to resolve it.

Table A-4 Alphabetical Listing of User Migration Utility Error Messages

User Migration Utility Error MessagePhase

Argument missing or duplicated : : < parameter >

1

Attribute value missing : : orclCommonNicknameAttribute

Both

Database connection failure

Both

Database error: < database_error_message >

Both

Database not in any domain : : DB-NAME = < database_name >

Both

Database not registered with the directory : : DB-NAME = < dbName >

Both

Database object missing : : SHARED-SCHEMA = <shared_schema_name >

1

Database object missing : : TABLE = ORCL_GLOBAL_USR_MIGRATION_DATA

2

Directory connection failure

Both

Directory error : : < directory_error_message >

Both

Error reading file : : < file_name > : : < io_error_message >

1

Error reading file : : PARFILE = < file_name > : : < io_error_message>

1

Getting local host name failed

1

Interface table creation in SYS schema not allowed

1

Invalid argument or value : : < argument >

1

Invalid arguments for the phase

1

Invalid value : : < user > [ USERSFILE ]

1

Invalid value : : < user > [ USERSFILE ] { = = DBADMIN }

1

Invalid value : : < user > [ USERSLIST ]

1

Invalid value : : < user > [ USERSLIST ] { = = DBADMIN }

1

Logging failure : : < io_error_message >

1

Multiple entries found : : uniqueMember = < database_DN >

Both

No entry found : : CONTEXT = < context >

1


Table A-5 Alphabetical Listing of User Migration Utility Log Messages

User Migration Utility Log MessagePhase

Attribute exists : : orclPassword

2

Attribute value missing : : orclPassword

2

Database object missing : : SHARED-SCHEMA = < shared_schema >

2

Entry found : : DN = < user_DN >

2

Invalid value : : <interface_table_column_name> = < interface_table_column_value >

2

Multiple entries found : : < nickname_attribute > = < username >

1

No entry found : : DN = < user_DN >

2

No entry found : : < nickname_attribute > = < username > : : Entry found : DN = < dn >

1


PKETnCUCPK&AOEBPS/concepts.htm Introducing Enterprise User Security

1 Introducing Enterprise User Security

Enterprise User Security is an important component of Oracle Database 11g Release 2 (11.2) Enterprise Edition. It enables you to address administrative and security challenges for a large number of enterprise database users. Enterprise users are those users that are defined in a directory. Their identity remains constant throughout the enterprise. Enterprise User Security relies on Oracle Identity Management infrastructure, which in turn uses an LDAP-compliant directory service to centrally store and manage users.

This chapter explains what Enterprise User Security is and how it works, in the following topics:

1.1 Introduction to Enterprise User Security

This overview of Enterprise User Security explains how it benefits an organization and how enterprise users authenticate and access resources across a distributed database system. It contains the following topics:

1.1.1 The Challenges of User Management

Administrators must keep user information up to date and secure for the entire enterprise. This task becomes more difficult as the number of applications and users increases. Typically, each user has multiple accounts on different databases, which means that each user must remember multiple passwords. The result is too many passwords for users to remember and too many accounts for administrators to effectively manage.

With thousands of users accessing database accounts, user administration requires substantial resources. Common information used by multiple applications, such as usernames, telephone numbers, and system roles and privileges, is typically fragmented across the enterprise. Such data increasingly becomes redundant, inconsistent, and difficult to manage.

In addition to user and account management problems, these conditions produce security problems as well. For example, any time a user leaves a company or changes jobs, that user's privileges should be changed the same day in order to guard against their misuse. However, large enterprises often have many user accounts distributed over multiple databases, and an administrator may be unable to make such timely changes.

Similarly, if your users have too many passwords, they may write them down, making them easy for others to copy. They may choose passwords that are easy to remember, making them easy for others to guess, and use the same password for multiple applications, risking wider consequences from a compromised password. All such user efforts to track multiple passwords can compromise enterprise security.

1.1.2 Enterprise User Security: The Big Picture

Enterprise User Security addresses user, administrative, and security challenges by relying on the identity management services supplied by Oracle Internet Directory, an LDAP-compliant directory service. Identity management is the process by which the complete security life cycle for network entities is managed in an organization. It typically refers to the management of an organization's application users, where steps in the security life cycle include account creation, suspension, privilege modification, and account deletion.

Figure 1-1 shows how Enterprise User Security fits into the Oracle security architecture, which uses the Oracle Identity Management infrastructure as its foundation.

Figure 1-1 Enterprise User Security and the Oracle Security Architecture

Description of Figure 1-1 follows
Description of "Figure 1-1 Enterprise User Security and the Oracle Security Architecture"

Users benefit from Enterprise User Security through single sign-on (SSO) or single password authentication, depending on the configuration chosen by the administrator. Using single sign-on, users need to authenticate only once and subsequent authentications take place transparently. This functionality requires SSL, which should not be confused with OracleAS Single Sign-On, a component of Oracle Identity Management infrastructure.

Single password authentication lets users authenticate to multiple databases with a single global password although each connection requires a unique authentication. The password is securely stored in the centrally located, LDAP-compliant directory, and protected with security mechanisms including encryption and Access Control Lists (ACLs). This approach improves usability by reducing the number of passwords to remember and manage, and by eliminating the overhead of setting up SSL.

Enterprise User Security requires Oracle Internet Directory 10g (9.0.4) or higher. Other LDAP-compliant directory services are supported by using Oracle Internet Directory Integration Platform to synchronize them with Oracle Internet Directory.

This section contains the following topics:

1.1.2.1 How Oracle Internet Directory Implements Identity Management

Oracle Internet Directory uses the concept of identity management realms to organize information in the directory information tree (DIT), which is a hierarchical tree-like structure consisting of directory object entries. In a directory, each collection of information about an object is called an entry. This object may be a person, but it can also be information about a networked device, such as configuration information. To name and identify the location of directory objects in the DIT, each entry is assigned a unique distinguished name (DN). The DN of an entry consists of the entry itself and its parent entries, connected in ascending order, from the entry itself up to the root (top) entry in the DIT.

1.1.2.1.1 About Identity Management Realms

An identity management realm is a subtree of directory entries, all of which are governed by the same administrative policies. For example, all employees in an enterprise who have access to the intranet may belong to one realm, while all external users who access the public applications of the enterprise may belong to another realm. Use of different realms enables an enterprise to isolate user populations and enforce different administrative policies, such as password policies or naming policies, in each realm. The default nickname attribute, used to identify the login identity, is uid, and it is set in each identity management realm

1.1.2.1.2 About Identity Management Realm-Specific Oracle Contexts

Each identity management realm has a realm-specific Oracle Context (realm Oracle Context) that stores Oracle product information for that realm. A realm Oracle Context stores application data, how users are named and located, how users must be authenticated, group locations, and privilege assignments, all specific to the particular identity management realm in which the realm Oracle Context is located.


See Also:


1.1.2.2 Enterprise Users Compared to Database Users

Database users are typically defined in the database by using the CREATE USER statement as follows:

CREATE USER username IDENTIFIED BY password;

This creates a database user, associated with a user schema, who can access the database and be authenticated by using a password with the CONNECT command as follows:

CONNECT username@database_service_name
Enter Password:

Database users must be created in each database they need to access, and they can choose a different password for each database. Database user privileges are controlled by local roles in each database.

In contrast, enterprise users are provisioned and managed centrally in an LDAP-compliant directory, such as Oracle Internet Directory, for database access. Enterprise users have a unique identity in the directory called the distinguished name (DN). When enterprise users log on to a database, the database authenticates those users by using their DN.

Enterprise users are defined in the database as global users. Global users can have their own schemas, or they can share a global schema in the databases they access. You can create enterprise users by using the GLOBALLY clause in the CREATE USER statement in two different ways.

You can specify a user's directory DN with an AS clause, which is shown in the following statement:

CREATE USER username IDENTIFIED GLOBALLY AS '<DN of directory user entry>';

In this case, they have a schema allocated exclusively to them.

Alternatively, you can specify a null string with the AS clause as the following statement shows:

CREATE USER username IDENTIFIED GLOBALLY AS '';

When you specify a null string with the AS clause, the directory maps authenticated users to the appropriate database schema. In this case, multiple users can be mapped to a shared schema based on the mapping information set up and stored in Oracle Internet Directory.


Note:

You can also use the following syntax to create a shared schema: 
CREATE USER username IDENTIFIED GLOBALLY;

This is the same as specifying a null string.


When enterprise users connect over SSL to the database, they do not use a password. Instead they use the following CONNECT command, which looks up the wallet location based on information in the client's sqlnet.ora file:

CONNECT /@database_service_name

Password-authenticated enterprise users use the same CONNECT statement to connect to the database as regular database users. For example, password-authenticated enterprise users connect to the database by using the following syntax:

CONNECT username@database_service_name
Enter password:

When the database receives a connection request from an enterprise user, the database refers to the directory for user authentication and authorization (role) information.


See Also:


1.1.2.3 About Enterprise User Schemas

Enterprise users can retain their individual database schemas (exclusive schemas) or share schemas if the enterprise security administrator maps them to a shared schema.

1.1.2.3.1 Private or Exclusive Schemas

If users want to retain their individual schemas in the databases that they access, then

  • Create enterprise users in the directory, and

  • Create a global user schema for each user in each database that they access.

Creating separate accounts for each enterprise user on each database that they access results in significant overhead. Instead, creating enterprise users who access a single, generic shared schema in each database increases the efficiency of the enterprise user solution.

1.1.2.3.2 Shared Schemas

To receive the real benefit of the enterprise user solution, you can use shared schemas for your enterprise users. For this strategy

  • Create enterprise users in the directory,

  • Create a single shared schema in each database, and

  • Create a single shared schema mapping in Oracle Internet Directory.

Mapping enterprise users to a generic, shared schema on each of the databases that they access greatly reduces the overhead of creating separate schemas for each enterprise user.

Shared schema enterprise users can be mapped to generic, shared schemas on all of the databases that they access, or they can have exclusive schemas on some databases and shared schemas on others. The shared schema mappings are stored in the directory.


See Also:


1.1.2.4 How Enterprise Users Access Database Resources with Database Links

Database links are network objects stored in the local database or in the network definition that identify a remote database, a communication path to that database, and optionally, a user name and password. Once defined, the database link is used to access the remote database. Oracle Database supports connected user links, fixed user links, and current user links.

Enterprise users can use all three types of database links. Connected user links are accessed by a local user who has an account on the remote server. Fixed user links contain a user name and password as part of the link definition. Current user database links allow enterprise users to access objects on remote databases without passing authentication information during link execution, or storing authentication information in the link definition. They require SSL for the database network connections, which means public key infrastructure (PKI) credentials must be obtained and maintained for the databases. Current user database links can be used to connect to the remote database only as an enterprise user.


See Also:


1.1.2.5 How Enterprise Users Are Authenticated

Enterprise User Security supports the following authentication methods:

    • Password-based authentication

    • SSL-based authentication

    • Kerberos-based authentication

Each authentication method has advantages and disadvantages. Table 1-1 summarizes the criteria for selecting which authentication method is best for your Enterprise User Security implementation.

Table 1-1 Enterprise User Security Authentication: Selection Criteria

Password AuthenticationSSL AuthenticationKerberos Authentication

Password-based authentication

Provides strong authentication over SSL

Provides strong authentication by using Kerberos, version 5 tickets

Provides centralized user and password management

Provides centralized user and PKI credential/wallet management

Provides centralized user and Kerberos credential management

Separate authentications required for each database connection

Supports single sign-on (SSO) using SSL

Supports SSO using Kerberos, version 5 encrypted tickets and authenticators, and authentication forwarding

Retains users' current authentication methods

Initial configuration maybe more difficult because PKI credentials must be generated for all users. (Dependent on administrators' PKI knowledge)

Initial configuration maybe more difficult because Kerberos must be installed and configured to authenticate database users

User identity can be used in two-tier or multitier applications. OracleAS Single Sign-On users and enterprise users use the same stored password

Compatible with either a two-tier or multitier environment

Compatible with either a two-tier or multitier environment

Supports Oracle Release 7.3 and later clients with Oracle Database 10g and later

Supports Oracle8i and later clients with Oracle Database 10g and later

Supports Oracle Database 10g and later clients with Oracle Database 10g and later

Supports current user database links only if the connection between databases is over SSL

Supports current user database links

Supports current user database links only if the connection between databases is over SSL

Can use third-party directories to store users if synchronized with Oracle Internet DirectoryFoot 1 

Can use third-party directories to store users if synchronized with Oracle Internet DirectoryFoot 2 

Can use third-party directories to store users if synchronized with Oracle Internet DirectoryFoot 3 


Footnote 1 If third-party directory is Microsoft Active Directory, then when user passwords change, they must be changed in both Active Directory and in Oracle Internet Directory.

Footnote 2 Must modify the Directory Integration Services agent to synchronize user PKCS #12 attributes.

Footnote 3 If third-party directory is Microsoft Active Directory, then login to Windows gives you single sign-on login to databases. However, you must modify the Directory Integration Services agent for other third-party directories to synchronize the KrbPrincipalName attribute. This synchronization is automatic for Microsoft Active Directory.


Note:

Enterprise User Security supports three-tier environments. Oracle Database proxy authentication features enable

(i) proxy of user names and passwords through multiple tiers, and

(ii) proxy of X.509 certificates and distinguished names through multiple tiers.



See Also:


1.1.3 About Enterprise User Security Directory Entries

In a directory, a collection of information about an object is called an entry. For Enterprise User Security, elements such as users, roles, and databases are directory objects, and information about these objects is stored as entries in the directory.

Each entry in the directory is uniquely identified by a DN. The DN tells you exactly where the entry resides in the directory entry hierarchy, which is commonly called the directory information tree (DIT).


Note:

For Oracle Database 10g and later, databases must be registered in a complete identity management realm of Oracle Internet Directory.


See Also:

Oracle Internet Directory Administrator's Guide for a complete discussion of directory entries

The following sections describe directory entries related to Enterprise User Security:

1.1.3.1 Enterprise Users

An enterprise user is one who is defined and managed in a directory. Each enterprise user has a unique identity across an enterprise. Enterprise user entries can reside at any location within the identity management realm, except within the realm Oracle Context.


Note:

When creating enterprise users in a 9.0.4 or later Oracle Internet Directory, use the tools that come with that 9.0.4 or later Oracle Internet Directory, such as Delegated Administration System (DAS). Even if your databases are 9i or 9iR2, do not use the 9i or 9iR2 Enterprise Security Manager GUI tool to create users in a 9.0.4 or later Oracle Internet Directory.

Use only DAS-based tools, like the Oracle Internet Directory Self-Service Console, that ship with Oracle Application Server 10g, to create enterprise users in identity management realms.


The entries described in the following sections can reside only within a realm Oracle Context.

1.1.3.2 Enterprise Roles

An enterprise role is a directory object that acts like a container to hold one or more database global roles. Each global role is defined in a specific database where it is assigned privileges, but then it is managed in the directory by using enterprise roles. Enterprise users can be assigned an enterprise role, which determines their access privileges on databases. Figure 1-3 shows an example of an enterprise role called Manager under OracleDefaultDomain.

As an example, consider the enterprise role sales_manager, which contains the global role manage_leads with its privileges on the Customer Relationship Management (CRM) database, and the bonus_approval global role with its privileges on the Finance database. Figure 1-2 illustrates this example.

Figure 1-2 Example of Enterprise Roles

Description of Figure 1-2 follows
Description of "Figure 1-2 Example of Enterprise Roles"

An enterprise role can be assigned to one or more enterprise users. For example, you could assign the enterprise role sales_manager to a number of enterprise users who hold the same job. This information is protected in the directory, and only a directory administrator can manage users and assign their roles. A user can be granted local roles and privileges in a database in addition to enterprise roles, by virtue of the privileges on the schema to which the user connects.

Enterprise role entries are stored in enterprise domain subtrees. Each enterprise role contains information about associated global roles on each database server and the associated enterprise users. The enterprise domain administrator creates and manages enterprise roles by using Oracle Enterprise Manager.


See Also:

"Configuring Enterprise Roles" for information about using Oracle Enterprise Manager to create and manage enterprise roles


Note:

The database obtains a user's global roles from the directory as part of the login process. If you change a user's global roles in the directory, then those changes do not take effect until the next time the user logs in to the database.

1.1.3.3 Enterprise Domains

An enterprise domain is a group of databases and enterprise roles. An example of a domain could be the engineering division in an enterprise or a small enterprise itself. Figure 1-3 shows an example of an enterprise domain called Services that resides under the OracleDBSecurity entry in an identity management realm. It is here, at the enterprise domain level, that the enterprise domain administrator, using Oracle Enterprise Manager, assigns enterprise roles to users and manages enterprise security.

An enterprise domain subtree in a directory is composed of three types of entries: enterprise role entries, user-schema mappings, and the enterprise domain administrator's group for that domain. Enterprise domains are used to manage information that applies to multiple databases. All user-schema mappings entries contained in an enterprise domain apply to all databases in the domain. If you need to apply different user-schema mappings to individual databases, then use database server entries, which are discussed in the following section.

Enterprise roles apply to specific databases in the domain, as explained in the previous section. Enterprise roles, domain-level mappings, and the domain administrators group are all administered by using Oracle Enterprise Manager.

1.1.3.4 Database Server Entries

A database server entry (represented as "Sales" in Figure 1-3) is a directory entry containing information about one database server. It is created by the Database Configuration Assistant during database registration. A database server entry is the parent of database-level mapping entries called user-schema mappings, which describe mappings between full or partial user DNs and database shared schema names. User-schema mapping entries are created by the database administrator by using Oracle Enterprise Manager.

Database administrators belong to the directory administrative group, OracleDBAdmins, which is also managed with Oracle Enterprise Manager. Only OracleDBAdmins or OracleContextAdmins group members can add or remove users from the OracleDBAdmins group. When a user registers a database in the directory, Database Configuration Assistant automatically puts the person who performs registration into the OracleDBAdmins group. The directory entry for this group is located under the database server entry in the DIT.

Figure 1-3 Related Entries in a Realm Oracle Context

Description of Figure 1-3 follows
Description of "Figure 1-3 Related Entries in a Realm Oracle Context"

1.1.3.5 User-Schema Mappings

A user-schema mapping is a directory entry that contains mapping information between a user's DN and an Oracle database schema. The users referenced in the mapping are connected to the specified schema when they connect to the database. User-schema mapping entries can apply to only one database or they can apply to all databases in a domain, depending on where they reside in the realm Oracle Context.

1.1.3.6 Administrative Groups

An identity management realm contains administrative groups related to Enterprise User Security. Figure 1-3 shows these administrative groups in a realm in the triangle labeled "Groups." Each administrative group includes Access Control Lists (ACLs) that control access to the group itself. ACLs elsewhere in the directory may refer to these groups, which allows directory administrators access to perform necessary administrative tasks. The administrative user who creates the realm automatically becomes the first member of each of these groups, thus gaining the associated privileges provided by each group. However, this user can be removed.

The relevant administrative groups in a realm are described in Table 1-2.


Note:

Observe the following practices. Using other methods may break the security configuration for Enterprise User Security objects and may break enterprise user functionality as well.

  • Do not modify the ACLs for the objects contained in a realm Oracle Context. Modified realm Oracle Context object ACLs are not supported.

  • Use only Oracle tools, such as Oracle Enterprise Manager, Oracle Internet Directory Self-Service Console, and Database Configuration Assistant, to modify Enterprise User Security directory entries.


Table 1-2 Administrative Groups in a Realm Oracle Context

Administrative GroupDescription

OracleContextAdmins

DN: (cn=OracleContextAdmins,cn=Groups,cn=OracleContext...)

Default owner: The user who created the identity management realm. (If it is the realm created during installation, then it is orcladmin.)

OracleContextAdmins have full access to all groups and entries within the associated realm Oracle Context.

OracleDBAdmins

DN: (cn=OracleDBAdmins,cn=<database_entry_name>,cn=OracleContext...)

Default owner: None. Database Configuration Assistant automatically makes the user who registers a database in the directory a member of this group.

Members of this group manage user-schema mappings specific to this database. Only users who are already members of this group or OracleContextAdmins can add or remove users from the OracleDBAdmins group.

OracleDBCreators

DN: (cn=OracleDBCreators,cn=OracleContext...)

Default owner: OracleContextAdmins

During default realm Oracle Context creation, Oracle Internet Directory Configuration Assistant sets up the following access rights/permissions for these group members:

  • Add permission for database service objects in the realm Oracle Context

  • Modify permission for the Default Domain

OracleDBCreators create new databases and register them in the directory by using Database Configuration Assistant

OracleDBSecurityAdmins

DN: (cn=OracleDBSecurityAdmins,cn=OracleContext...)

Default owner: All group members.

During default realm Oracle Context creation, Oracle Internet Directory Configuration Assistant sets up the following access rights/permissions for these group members:

  • All privileges in the OracleDBSecurity subtree

  • Modify privileges for membership in this group

OracleDBSecurityAdmins have permissions on all of the domains in the enterprise and perform the following tasks:

  • Sets Enterprise User Security configurations for the realm, such as the default database-to-directory authentication method

  • Group owner administers the OracleDBSecurityAdmins group

  • Creates and deletes enterprise domains

  • Moves databases from one domain to another within the enterprise

OracleDomainAdmins

DN: (cn=OracleDomainAdmins,cn=<enterprise_domain_name>,

cn=OracleDBSecurity,cn=Products,cn=OracleContext....)

Default owner: The user creating or updating the domain.

If a new context and OracleDefaultDomain are created, then the initial member will be the context creator.

Members of the OracleDomainAdmins group have full privileges for the enterprise domain. They manage mappings, enterprise roles, and proxy permissions specific to the entire domain. You should be a member of OracleDomainAdmins (for the domain), OracleDBSecurityAdmins, or OracleContextAdmins to modify membership of this group.

OracleUserSecurityAdmins

DN: (cn=OracleUserSecurityAdmins,cn=Groups,cn=OracleContext...)

Default owner: The user who created the identity management realm.

By default, an ACL is set at the directory root in Oracle Internet Directory that sets up the relevant permissions so OracleSecurityAdmins can administer Oracle user security.

OraclePasswordAccessibleDomains

DN: (cn=OraclePasswordAccessibleDomains,cn=Groups,cn=OracleContext...)

Default owner: Same as OracleDBSecurityAdmins

Group members are enterprise domains, which contain databases enabled for password-authorized enterprise users.


1.1.3.7 Password Policies

Password policies are a set of rules that apply to all user passwords in an identity management realm. Password policies include settings for password complexity, minimum password length, and the like. They also include account lockout and password expiration settings.

A password policy entry is defined in Oracle Internet Directory for every identity management realm. Password policies in Oracle Internet Directory are standard Oracle Internet Directory entries that can be used by Oracle Database for Enterprise User Security.

Oracle Internet Directory ensures that all enterprise user passwords meet the rules specified in the password policy entry for the realm. The database communicates with Oracle Internet Directory when authenticating an enterprise user. It requests Oracle Internet Directory to report any password policy violations. If the database gets a policy violation response from Oracle Internet Directory, then it flashes the appropriate warning or error message to the user.

The database reports the following events:

  • It flashes a warning when the user password is about to expire and displays the number of days left for the user to change his or her password.

  • It flashes a warning when the password has expired and informs the user about the number of grace logins that remain.

  • It displays an error when the user password has expired and the user does not have any grace logins left.

  • It displays an error when the user account has been locked due to repeated failed attempts at login.

  • It displays an error if the user account has been disabled by the administrator.

  • It displays an error if the user account is inactive.

Enterprise user login attempts to the database update the user account status in Oracle Internet Directory. For example, consecutive failed login attempts to the database results in the account getting locked in the directory, as per the directory's password policy.


See Also:

Oracle Internet Directory Administrator's Guide for detailed information on password policies and their management

1.2 About Using Shared Schemas for Enterprise User Security

The following sections describe shared schemas, and how to set them up:

1.2.1 Overview of Shared Schemas Used in Enterprise User Security

Users do not necessarily require individual accounts or schemas set up in each database. Alternatively, they can connect to a shared schema and be granted access to the objects associated with target applications. For example, suppose that users Tom, Dick, and Harriet require access to the Payroll application on the Finance database. They do not need to create unique objects in the database, and therefore do not need their own schemas, but they do need access to the objects in the Payroll schema.

Oracle Database supports mapping multiple users stored in an enterprise directory to a shared schema on an individual database. This separation of users from schemas reduces administration costs by reducing the number of user accounts on databases. It means that you do not need to create an account for each user (user schema) in addition to creating the user in the directory. Instead, you can create a user in the enterprise directory, and map that user to a shared schema. Other enterprise users can also be mapped to that schema.

For example, if Tom, Dick and Harriet all access both the Sales and the Finance databases, you do not need to create an account for each user on each database. Instead, you can create a single shared schema on each database, such as GUEST, that all three users can access. Then individual access to objects in the Sales or Finance database can be granted to these three users by using enterprise roles. A typical environment can have up to 5,000 enterprise users mapped to one shared schema and each user can be assigned a set of enterprise roles.

Oracle recommends that you create a separate shared schema that contains no objects to use as an entry point. Then, grant access to application objects in other schemas through enterprise roles. Otherwise, application objects can be inadvertently or maliciously deleted or altered.

In summary, shared schemas provide the following benefits:

  • Shared schemas eliminate the need to have a dedicated database schema on each database for each enterprise user.

  • Each enterprise user can be mapped to a shared schema on each database the user needs to access. The user connects to the shared schema when the user connects to a database.

  • Shared schemas lower the cost of managing users in an enterprise.

1.2.2 How Shared Schemas Are Configured for Enterprise Users

To configure shared schemas, the local database administrator (DBA) must create at least one database schema in a database. Enterprise users can be mapped to this schema.

In the following example, the administrator creates a shared schema and maps users to it:

  1. The administrator creates a global shared schema called EMPLOYEE and the global role HRMANAGER on the HR database.

  2. The administrator uses the Oracle Internet Directory Self-Service Console and Oracle Enterprise Manager to create and manage enterprise users and roles in the directory. For example, the administrator creates enterprise user Harriet and an enterprise role named MANAGER. The administrator then assigns the HR database global role of HRMANAGER to the enterprise role MANAGER.

  3. The administrator assigns enterprise roles to enterprise users in the directory. For example, the administrator assigns the enterprise role MANAGER to Harriet.

  4. The administrator uses Oracle Enterprise Manager to map the user Harriet in the directory to the shared schema EMPLOYEE on the HR database.

When Harriet connects to the HR database, she is automatically connected to the EMPLOYEE schema and is given the global role of HRMANAGER. Multiple enterprise users can be mapped to the same shared schema. For example, the enterprise security administrator can create another enterprise user Scott and map Scott to the EMPLOYEE schema. From that point on, both Harriet and Scott automatically use the EMPLOYEE schema when connecting to the HR database, but each can have different roles and can be individually audited.


See Also:

Oracle Database Security Guide for more information about auditing

1.2.3 How Enterprise Users Are Mapped to Schemas

Global schemas (those created with CREATE USER IDENTIFIED GLOBALLY AS '') can be owned by one enterprise user (exclusive schema) or shared among multiple enterprise users (shared schema). The mapping between a single enterprise user and his or her exclusive schema is stored in the database as an association between the user DN and the schema name. The mapping between enterprise users and a shared schema is done in the directory by means of one or more mapping objects. A mapping object is used to map the distinguished name (DN) of a user to a database schema that the user will access. You create a mapping object by using Oracle Enterprise Manager. This mapping can be one of the following:

  • Entry-level (full DN) mapping

    This method associates the DN of a single directory user with a particular schema on a database. It results in one mapping entry for each user.

  • Subtree-level (partial DN) mapping

    This method lets multiple enterprise users share part of their DN to access the same shared schema. This method is useful if multiple enterprise users are already grouped under some common root in the directory tree. The subtree that these users share can be mapped to a shared schema on a database. For example, you can map all enterprise users in the subtree for the engineering division to one shared schema, BUG_APP_USER, on the bug database. Note that the root of the subtree is not mapped to the specified schema.

    When an enterprise user connects to a database, the database retrieves a DN for the user, either from the network (in the case of SSL) or from the directory (in the case of password and Kerberos-authenticated enterprise users).

    When determining which schema to connect the user to, the database uses the user DN and the following precedence rules:

    1. It looks for an exclusive schema locally (in the database).

    2. If it does not find an exclusive schema locally, then it searches the directory. Within the directory, it looks under the database server entry, first for an entry-level mapping, and then for a subtree-level mapping.

    3. If it does not find a mapping entry under the server entry, then it looks under the enterprise domain entry, first for an entry-level mapping, and then for a subtree-level mapping.

    4. If it does not find an exclusive schema locally or an applicable mapping entry in the database, then the database refuses the connection. Otherwise, the database connects the user to the appropriate schema.

For example, suppose that Harriet is trying to connect to the HR database but the database does not find Harriet's exclusive schema (in the database). In this case, the following events occur:

  1. The HR database looks up a user schema mapping with Harriet's DN in the directory. The directory has a mapping of Harriet to the shared schema EMPLOYEE and returns this schema.

  2. The database logs Harriet in and connects her to the EMPLOYEE schema.

  3. The database retrieves this user's global roles for this database from the directory.

  4. The database also retrieves from its own tables any local roles and privileges associated with the database schema to which the user is mapped.

  5. The database uses both the global and the local roles to determine the information that the user can access.

Continuing this example, assume that the enterprise role MANAGER contains the global roles ANALYST on the HR database, and USER on the Payroll database. When Harriet, who has the enterprise role MANAGER, connects to the HR database, she uses the schema EMPLOYEE on that database.

  • Her privileges on the HR database are determined by:

    • The global role ANALYST

    • Any local roles and privileges associated with the EMPLOYEE schema on the HR database

  • When Harriet connects to the Payroll database, her privileges are determined by:

    • The global role USER

    • Any local roles and privileges associated with the EMPLOYEE schema on the Payroll database

You can grant privileges to a specified group of users by granting roles and privileges to a database schema. Every user sharing such a schema gets these local roles and privileges in addition to personal enterprise roles. However, you should exercise caution when doing this because every user who is mapped to this shared schema can exercise the privileges assigned to it. Accordingly, Oracle does not recommend granting roles and privileges to a shared schema.


See Also:


1.3 Enterprise User Proxy

Sometimes, an enterprise user needs to connect to a database as another user, temporarily having the target user's authorizations and privileges. This capability is particularly useful for midtier tools or applications, which often operate across various databases as enterprise users, their identities established as entries in Oracle Internet Directory. Such an application can maintain a single database connection while switching end user identities, thereby providing functionality in the name of each authorized user in turn.

Enterprise User Security 11g Release 1 (11.1) enhanced the efficiency of the proxy mechanism by introducing a single-session model. The two-session proxy model required maintaining separate sessions for the proxy user and the target user. In the new model, only one session is maintained in the security context of the target user. This leads to an improvement in performance.

Enterprise User Security 11g Release 1 (11.1), and later, allows greater granularity in assigning proxy permissions to enterprise users. Enterprise users can be individually granted permissions to proxy as local database users. The permissions no longer need to be associated with the user's shared schema in the database.

That you can assign proxy permissions individually to enterprise users means that the permissions can be more specific. Assigning permissions to a shared schema, on the other hand, forces you to assign the same permissions to all users who map to the schema. This can lead to unwarranted rights and privileges.

Enterprise user proxy permissions are created and stored in Oracle Internet Directory. A permission allows one or more enterprise users or groups to proxy as a target database user. Permissions can apply to specific databases or to all databases in the enterprise domain.

By default, domain administrators can manage proxy permissions in the directory for an enterprise domain. These permissions are configured and managed using Oracle Enterprise Manager.


See Also:

For more information on configuring enterprise user proxy permissions, see "Configuring Proxy Permissions"

Setting up such proxying has several stages:

  1. Identify all enterprise users who need permissions to proxy to various databases.

  2. Identify all the target users in each such database.

  3. Issue ALTER USER commands for each such target user, in the following form:

    • ALTER USER target_user GRANT CONNECT THROUGH ENTERPRISE USERS

    The target_user can now be proxied to by the enterprise users that have proxy permissions in Oracle Internet Directory. Revoking proxy permission uses similar syntax, replacing GRANT with REVOKE.


    See Also:

    For the full ALTER USER syntax, see Oracle Database SQL Language Reference

    For Oracle Call Interface usage, see Oracle Call Interface Programmer's Guide


  4. Grant proxy permissions to each enterprise user either individually or as a member of a group. See the section entitled "Granting Proxy Permissions to Enterprise Users" .


    Note:

    To establish a group representing those enterprise users who will proxy to the same database user, use Oracle Delegated Administration Services as described in the Oracle Identity Management Guide to Delegated Administration.

  5. With all four of the preceding steps accomplished, your identified enterprise users can proxy to any of the local database users you identified and associated with them. Two versions of the CONNECT command can be used. In (a), you supply the enterprise user's password in the command. In (b), you do not, relying instead on the password being in a wallet whose location was put in the sqlnet.ora file.

    1. To establish an enterprise user proxy connection as a database user, use the following SQL*Plus command syntax, supplying the enterprise user's password:

      • CONNECT joeproxy[targetuser]@database_service_name
Enter Password:

        where you would replace joeproxy with the name of the enterprise user wishing to proxy as targetuser, and replace targetuser with the name of the registered user of the target database. The square brackets are required. Enter the enterprise user's password when prompted for the password.

      Once these identities are validated, this connection request results in a single session, in which the proxy user operates in the target database as the target user. The identity of the original user is maintained through to the database, and the audit records can capture both the proxy and the target user's identity.

    2. To connect as an enterprise user proxy for a database user without specifying a password, ensure that the sqlnet.ora file contains the location of the wallet holding that user's password. Then, use the following command syntax:

      • CONNECT  [targetuser]/@database_service_name

        where you would replace targetuser with the name of the registered user of the target database. The square brackets are required. The current enterprise user proxies as the targetuser.


Note:

The regular proxy login mechanism using OCI calls can still be used. The CONNECT syntax is a new alternative. For more information on the OCI call mechanism, refer to Oracle Database Security Guide.

Although the enterprise user proxy permissions are assigned in Oracle Internet Directory, the database administrator can decide as to which local accounts are to be available as enterprise user proxy targets. The enterprise domain administrator can assign proxy permissions to only those targets that are available in the dba_proxies view of the database.

1.4 About Using Current User Database Links for Enterprise User Security

Oracle Database supports current user database links over an SSL-authenticated network connection. Current user database links let you connect to a second database as yourself, or as another user when used from within a stored procedure owned by that user. Such access is limited to the scope of the procedure. The security advantage of current user database links is that the other user's credentials are not stored in the database link definition and are not sent across the network connection between databases. Instead, security of these links is based on mutual trust, mutual authentication, and a secure network connection between the databases themselves.

For example, a current user database link lets Harriet, a user of the Finance database, procedurally access the Accounts Payable database by connecting as the enterprise user Scott.

For Harriet to access a current user database link to connect to the schema Scott, Scott must be a global schema (created as IDENTIFIED GLOBALLY) in both databases. Harriet, however, can be a user identified in one of three ways:

  • By a password

  • GLOBALLY

  • EXTERNALLY

To create Scott as a global user in the first database, Finance, you must enter

CREATE USER Scott IDENTIFIED GLOBALLY as 'CN=Scott,O=nmt'

so that Scott has an exclusive schema. Then Scott can map to a shared schema in the second database, Accounts Payable. In order for the current user database link to work, the schema created for Scott in the first database cannot be shared with other users.

Current user database links operate only between trusted databases within a single enterprise domain. Databases within the domain trust each other to authenticate users. You specify an enterprise domain as trusted by using Oracle Enterprise Manager. When you use Oracle Enterprise Manager to enable current user database links for a domain, they will work for all databases within that domain. However, each database in the domain must have its own PKI credentials and use SSL to authenticate to the other databases. To specify a database as untrusted that is part of a trusted enterprise domain, use the PL/SQL package DBMS_DISTRIBUTED_TRUST_ADMIN. To obtain a list of trusted servers, use the TRUSTED_SERVERS view.


Note:

Oracle Advanced Security, an option to the Oracle Database Enterprise Edition, does not support RADIUS authentication over database links.


See Also:


1.5 Enterprise User Security Deployment Considerations

Consider the following issues before deploying Enterprise User Security:

1.5.1 Security Aspects of Centralizing Security Credentials

Beyond the general benefits that flow from the centralization of enterprise users and their associated credentials, there are a number of security-related benefits and risks that should be reviewed.

1.5.1.1 Security Benefits Associated with Centralized Security Credential Management

Centralizing management makes it easier and faster to administer users, credentials, and roles, and to quickly revoke a user's privileges on all applications and databases across the enterprise. With centralized management, the administrator can delete a user in one place to revoke all global privileges, minimizing the risk of retaining unintended privileges.

Centralizing management makes it possible to centralize an organization's security expertise. Specialized, security-aware administrators can manage all aspects of enterprise user security, including directory security, user roles and privileges, and database access. This is a substantial improvement over the traditional model, where DBAs are typically responsible for everything on the databases they manage, including security.

1.5.1.2 Security Risks Associated with Centralized Security Credential Management

While Oracle Internet Directory is a secure repository, there is a security challenge and inherent risk in centralizing credentials in any publicly accessible repository. Although centralized credentials can be protected at least as securely as distributed credentials, the very nature of centralization increases the consequences of inadvertent credential exposure to unauthorized parties. It is therefore imperative to limit the privileges of administrators to set restrictive Access Control Lists (ACLs) in the directory, and to implement good security practices in the protection of security credentials when they are temporarily outside of the directory.

1.5.2 Security of Password-Authenticated Enterprise User Database Login Information

In all secure password-based authentication methods, a server authenticates a client with a password verifier, typically a hashed version of the password that must be rigorously protected. Password-based authentication to an Oracle database is no different. There is a password verifier, and it must be protected as well. This is true if the verifier is stored locally in the database or centrally in the directory. Note that a password verifier cannot be used to derive the original password.

An enterprise user's database password can be stored in a central directory service for access by multiple databases. It can be viewed and shared by all trusted databases to which the user has access. Although the password verifier stored in the directory is not the cleartext password, it is still necessary to protect it from casual or unauthorized access. It is therefore extremely important to define password-related ACLs in the directory that are as restrictive as possible while still enabling necessary access and usability. (Note that Oracle Database supports all verifier types that are supported by Oracle Internet Directory.)

Oracle tools help set up ACLs in the directory to protect these password verifiers during identity management realm creation. The approach that Oracle recommends is intended to balance security and usability considerations. If you require maximum security and can set up wallets for all users, you should require only SSL connections from users to databases. This SSL-only approach circumvents the entire directory password protection issue.

The following sections provide more information about trusted databases and protecting database password verifiers in the directory.

1.5.2.1 What Is Meant by Trusted Databases

SSL provides strong authentication so databases are ensured of each others identity. With password-authenticated Enterprise User Security where database password verifiers are stored centrally in a directory and shared among multiple databases, each database that allows password-authenticated enterprise users to log in must be a trusted database. Each database has access to the shared password verifiers, so it is important that each database can be trusted to observe the following security precautions:

  • Each database must be trusted to protect itself from tampering with the server code so a malicious user cannot misuse the database identity to gain access to password verifiers in the directory.

  • Each database must be trusted to protect its PKI and other credentials from theft so a malicious user cannot use them to gain access to the password verifiers stored in the directory.

1.5.2.2 Protecting Database Password Verifiers

The OraclePasswordAccessibleDomains group in each identity management realm is created automatically when the realm is created, and it can be managed by using Oracle Internet Directory tools like the Oracle Internet Directory Self-Service Console. Enterprise domains with member databases that must view users' database password verifiers in the directory are placed in this group.

For a selected realm, determine which databases can accept password-authenticated connections. Use Oracle Internet Directory Self-Service Console to place the domains containing those databases into the OraclePasswordAccessibleDomains group. An ACL on the user subtree permits access to the directory attribute that holds the password verifier used by the database.

All other users are denied access to this attribute. An ACL that prevents anonymous read access to the password verifier attributes is at the root of the directory tree.

Note that for usability, by default, OracleDefaultDomain is a member of the OraclePasswordAccessibleDomains group. It can be removed, if desired.

1.5.3 Considerations for Defining Database Membership in Enterprise Domains

Consider the following criteria when defining the database membership of a domain:

  • Current user database links operate only between databases within a single enterprise domain. Use of these links requires mutual trust between these databases and between the DBAs who administer them.

  • Accepted authentication types for enterprise users are defined at the domain level. Database membership in a domain should therefore be defined accordingly.


    Note:

    If one or more databases are intended to only support SSL-based certificate authentication, they cannot be combined in the same domain with password-authenticated databases.

  • Enterprise roles are defined at the domain level. To share an enterprise role across multiple databases, the databases must be members of the same domain.

1.5.4 Choosing Authentication Types between Clients, Databases, and Directories for Enterprise User Security

Enterprise User Security supports the authentication types listed in Table 1-3 for connections between clients, databases, and directories.

Table 1-3 Enterprise User Security: Supported Authentication Types for Connections between Clients, Databases, and Directories

ConnectionSupported Authentication Types

Clients-to-Databases

Passwords, SSL, and Kerberos

Databases-to-Databases (Current User Database Links)

SSL only

Databases-to-Directories

SSL and Passwords


However, some combinations of authentication types for connections make more sense than others. For example, it is unusual to have a high level of security for client-database connections by using SSL for all user connections, but then configuring the database to authenticate to the directory by using passwords. Although this configuration is supported, it does not provide consistent security for connections. Ideally, the database-directory connection should be at least as secure as that between users and databases.

1.5.4.1 Typical Configurations

The following combinations of authentication types between clients, databases, and directories are typical:

  • Password authentication for all connections with no need for current user database links

  • SSL authentication for all connections

  • Kerberos authentication for client-to-database connections, and password authentication for database-to-directory connections

PKllPK&A OEBPS/toc.ncxd Oracle® Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2) Cover Table of Contents Oracle Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2) Preface What's New in Enterprise User Security? Introducing Enterprise User Security Getting Started with Enterprise User Security Configuration and Administration Tools Overview Enterprise User Security Configuration Tasks and Troubleshooting Administering Enterprise User Security Using the User Migration Utility SSL External Users Conversion Script Integrating Enterprise User Security with Microsoft Active Directory Upgrading from Oracle9i to Oracle Database 11g Release 2 (11.2) Glossary Index Copyright PKfi d PK&AOEBPS/content.opf5 Oracle® Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2) en-US E10744-02 Oracle Corporation Oracle Corporation Oracle® Database Enterprise User Security Administrator's Guide, 11g Release 2 (11.2) 2009-11-18T21:01:10Z Explains how to configure and use enterprise users, which are users defined in a directory. The guide also covers administrative tasks related to enterprise user security. PKG55PK&AOEBPS/dcommon/prodbig.gif GIF87a!!!)))111BBBZZZsss{{ZRRcZZ!!1!91)JB9B9)kkcJJB991ssc絽Zcc!!{祽BZc!9B!c{!)c{9{Z{{cZB1)sJk{{Z{kBsZJ91)Z{!{BcsRsBc{9ZZk甽kBkR!BZ9c)JJc{!))BZks{BcR{JsBk9k)Zck!!BZ1k!ZcRBZcZJkBk1Z9c!R!c9kZRZRBZ9{99!R1{99R{1!1)c1J)1B!BJRkk{ƽ絵ތkk絵RRs{{{{JJsssBBkkk!!9ss{{ZZssccJJZZRRccRRZZ))cBBJJ99JJ!!c11991199Z11!c!!))Z!!!1BRck{)!cJBkZRZ,HP)XRÇEZ֬4jJ0 @ "8pYҴESY3CƊ@*U:lY0_0#  5tX1E: C_xޘeKTV%ȣOΏ9??:a"\fSrğjAsKJ:nOzO=}E1-I)3(QEQEQEQEQEQEQE֝Hza<["2"pO#f8M[RL(,?g93QSZ uy"lx4h`O!LŏʨXZvq& c՚]+: ǵ@+J]tQ]~[[eϸ (]6A&>ܫ~+כzmZ^(<57KsHf妬Ϧmnẁ&F!:-`b\/(tF*Bֳ ~V{WxxfCnMvF=;5_,6%S>}cQQjsOO5=)Ot [W9 /{^tyNg#ЄGsֿ1-4ooTZ?K Gc+oyڙoNuh^iSo5{\ܹ3Yos}$.nQ-~n,-zr~-|K4R"8a{]^;I<ȤL5"EԤP7_j>OoK;*U.at*K[fym3ii^#wcC'IIkIp$󿉵|CtĈpW¹l{9>⪦׺*ͯj.LfGߍԁw] |WW18>w.ӯ! VӃ :#1~ +މ=;5c__b@W@ +^]ևՃ7 n&g2I8Lw7uҭ$"&"b eZ":8)D'%{}5{; w]iu;_dLʳ4R-,2H6>½HLKܹR ~foZKZ࿷1[oZ7׫Z7R¢?«'y?A}C_iG5s_~^ J5?œ tp]X/c'r%eܺA|4ծ-Ե+ْe1M38Ǯ `|Kյ OVڅu;"d56, X5kYR<̭CiطXԮ];Oy)OcWj֩}=܅s۸QZ*<~%뺃ȶp f~Bðzb\ݳzW*y{=[ C/Ak oXCkt_s}{'y?AmCjޓ{ WRV7r. g~Q"7&͹+c<=,dJ1V߁=T)TR՜*N4 ^Bڥ%B+=@fE5ka}ędܤFH^i1k\Sgdk> ֤aOM\_\T)8靠㡮3ģR: jj,pk/K!t,=ϯZ6(((((((49 xn_kLk&f9sK`zx{{y8H 8b4>ÇНE|7v(z/]k7IxM}8!ycZRQ pKVr(RPEr?^}'ðh{x+ՀLW154cK@Ng C)rr9+c:׹b Жf*s^ fKS7^} *{zq_@8# pF~ [VPe(nw0MW=3#kȵz晨cy PpG#W:%drMh]3HH<\]ԁ|_W HHҡb}P>k {ZErxMX@8C&qskLۙOnO^sCk7ql2XCw5VG.S~H8=(s1~cV5z %v|U2QF=NoW]ո?<`~׮}=ӬfԵ,=;"~Iy7K#g{ñJ?5$y` zz@-~m7mG宝Gٱ>G&K#]؃y1$$t>wqjstX.b̐{Wej)Dxfc:8)=$y|L`xV8ߙ~E)HkwW$J0uʟk>6Sgp~;4֌W+חc"=|ř9bc5> *rg {~cj1rnI#G|8v4wĿhFb><^ pJLm[Dl1;Vx5IZ:1*p)إ1ZbAK(1ׅ|S&5{^ KG^5r>;X׻K^? s fk^8O/"J)3K]N)iL?5!ƾq:G_=X- i,vi2N3 |03Qas ! 7}kZU781M,->e;@Qz T(GK(ah(((((((Y[×j2F}o־oYYq $+]%$ v^rϭ`nax,ZEuWSܽ,g%~"MrsrY~Ҿ"Fت;8{ѰxYEfP^;WPwqbB:c?zp<7;SBfZ)dϛ; 7s^>}⍱x?Bix^#hf,*P9S{w[]GF?1Z_nG~]kk)9Sc5Ո<<6J-ϛ}xUi>ux#ţc'{ᛲq?Oo?x&mѱ'#^t)ϲbb0 F«kIVmVsv@}kҡ!ˍUTtxO̧]ORb|2yԵk܊{sPIc_?ħ:Ig)=Z~' "\M2VSSMyLsl⺿U~"C7\hz_ Rs$~? TAi<lO*>U}+'f>7_K N s8g1^CeКÿE ;{+Y\ O5|Y{/o+ LVcO;7Zx-Ek&dpzbӱ+TaB0gNy׭ 3^c T\$⫫?F33?t._Q~Nln:U/Ceb1-im WʸQM+VpafR3d׫é|Aү-q*I P7:y&]hX^Fbtpܩ?|Wu󭏤ʫxJ3ߴm"(uqA}j.+?S wV ~ [B&<^U?rϜ_OH\'.;|.%pw/ZZG'1j(#0UT` Wzw}>_*9m>󑓀F?EL3"zpubzΕ$+0܉&3zڶ+jyr1QE ( ( ( ( ( ( ( (UIdC0EZm+]Y6^![ ԯsmܶ捆?+me+ZE29)B[;я*wGxsK7;5w)}gH~.Ɣx?X\ߚ}A@tQ(:ͧ|Iq(CT?v[sKG+*רqҍck <#Ljα5݈`8cXP6T5i.K!xX*p&ќZǓϘ7 *oƽ:wlຈ:Q5yIEA/2*2jAҐe}k%K$N9R2?7ýKMV!{W9\PA+c4w` Wx=Ze\X{}yXI Ү!aOÎ{]Qx)#D@9E:*NJ}b|Z>_k7:d$z >&Vv󃏽WlR:RqJfGإd9Tm(ҝEtO}1O[xxEYt8,3v bFF )ǙrPNE8=O#V*Cc𹾾&l&cmCh<.P{ʦ&ۣY+Gxs~k5$> ӥPquŽўZt~Tl>Q.g> %k#ú:Kn'&{[yWQGqF}AЅ׮/}<;VYZa$wQg!$;_ $NKS}“_{MY|w7G!"\JtRy+贾d|o/;5jz_6fHwk<ѰJ#]kAȎ J =YNu%dxRwwbEQEQEQEQEQEQEQEQEQE'fLQZ(1F)hQ@X1KEQE-Q@ 1KE3h=iPb(((1GjZ(-ʹRPbR@ 1KE7`bڒyS0(-&)P+ ڎԴP11F)h&:LRmQ@Q@Š(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((?l:ϊw "{{-3j3%{sj~2= 7 ~MڅKrHb|P3 r=Ҁ +Ş/$iu7=q2dԂxn⸷9$l]H #WI񯄴;\[ݚD8C3p&0U9^AnK vI+!I8>5(zqj03Y.X ,@85ߛ8>pq8=} \xmm常8` $Q@$v7zwp]ɝA GX;y_]覮O&4 SPtY.X),@84U=7Vuv K4,$g{@<+uqtiGw3; I@ORմn5MBp%8'ƫ%u6uBJrHRN2@ϸ J(9i[[m}M(41)|ah޼gvgdH$F P+?St}ll<kH3um7Yk/P\Ik2ʡ RFpAǸ U=KVtku5 K,S,J[ g{xAѮTwWI8#>ƀ5(rjl::\j&eʦrG܁U?K<7 77c<ٷ9ݞ14E+U??mp|~LmnҀ.O<6\K0DF dOj;=N; .dɠHA#{O~)gc=ZI֗qŲB:VxBN/ߦCy7>rK237̀)zPAEgzy_ڭ/w c8FqQk>d7N<ϲ\$3gi8_C@QXpx·W[Fy\$q38$1@QEQEQEQEQEQEQEQEQEQEQEQEQEQEx( *m{xikc6y$(ܒI9z''~C?Us`on2Q\2;;dž~VrYqCw1t,`NzEy`5M7>{,j7T lRQK1!*m9}\h{= )-HLm㜜e de|?]{~ϝs.^Ѵ_'<3D$WAi:7s|%x2g̚ޠ!Eh#>\~uw_2_zW.d v#ʸ?.⯇Б4-Lcnp;QNӎotfoMPGkt\3(wv,|{I

bJ$=[~n|۶o-8q τ b &o*<6Bi`ETPp7r[??Ҹ_|?o7A]ic$s*G:<#< Z|f]GltK U<>!{M'Z֤t[VeH237FT gy5c[ԸB>B#3BB|xVjbOFSߩ”,p;lryG=o,I4;U1|Y xndu t7 %ߜH0O^gCCĿ9Cu%&9 7s(Ɍ:M{F]Yk}/[oT.$ d$$ ?OR7T}3rYZZk}P3cd-@JU}/WhYmE;Kg< c C²訨qºwa^}ldV=+ˍ;;/.N- H]ś%w'8+_'|Eo<!I)fHs9נxMO|3,K.i`dI^7 6༲mx϶(<)ovĞ>~kZy[ɪ$+Tem1~PjÏh)? {SvZ}.`!IT|n1$6U D1^Ũ_OwL+8bꠒ~;~m{C[ 4:X(#syV?-hh|+x}[W]M{/)~ҥrXYw?±k( 9h:-ئҼ'u(m 5_|LVyA# ; l9#q9?%9[qH 6iБ 3dg5eɫF V | " `+>KR6Wf̤<{( '1ָ x?oq8,Y%yٸc %nk#cqw.< {xz$ԥEܿt8 6$'.-]a"S[C)#l3?.98eGtm4 $FxZN,y Sr tтHIHZPT@>kZ͡1\hB߫.cr2>P8zp m-RֲEh o<ґ3"DGAz((((((((((((((?|;ol.'Gv7}\)//@)N[X]bR$(8gU(n%;yfE(ڷ"? fH&ՠ-D#R#]z_t l&vܧ  co߅|#_d# ?%(H$a؎?*(oľ t G mFr@9N:o6=ޗZN| + o  k34G>ϲ}vlۻ;}럸YK@m2 >dDvONQ@C L-$ew-nqf5]*\4N;;,OчG FPc:}wPr3VrJ1n35Q@7VEJ$E `+뛉gG.;A'<* =v:nn^ic9vK` aW(1ImtvcLxp(A_vWQ@W:K"0Y2F h~(,{{H0\y6! ۨ( [F%gKY%32y&\ ˒z(bC>*ƉC|̄P+cD4hi:M`Žn,ybIɭ (ï^k$#SdWm Qy_n}jGoop8*6euK^?X HtZآ+zuͅ~eO ɸzU}DӼ96gw}'O&(O[e}QOݤt #11.Ig5s~ׄ|áZI&CMB2ܖ83]^S Y1#`2+kO^7KI<9 = cagYgaiy rI8Q$5b(((((((((((((()ږ㯇vZݴzKᙑf_6S^^?J o^@WOVԴ|;.\ ̋2 8 0`ZJPTzկ^}%ֆE, o=jKA>,wvJ+? |H:KeYo-=I 9רxcC_]^K kl19 OEuW^~6Ğ%gӼ9$XVrʦߓ HT| j< _x3[{X%^]dIeJ\]`(7}o-nFi*pyu?Ÿ%񧄴O֑EKXv\d0;b<?ɠx?xN^KE" f`2z 2yhi:l:6c۴v*p=gPw [( +SnQFyh I^"|q> K-_&,r A#x[5Lj'3ZD~Yb'~7x_4}VD}MrI>}m(r9: duDѮ h3s5a0$J+; v~rY*bXN|"7+&j3M ndcho7ׁ$IZ$4Jd;U*a@(cwcǾ#׼G_^O}>D| AmvU+t׵uH4wQ*pB78ߟ{9Wr^Oooi2gt̳D rHSשL<RןN A`?$>] {ǭni?]f]ռCյw s$V@Cl>n1tw~CVhc1D7oG柎kx_^젴 jܴőwĹL0CQ6|dV7 4aIz:L*A6SO-[HK+dmE9r>|m<(&OVu   XIwh?+_- yzDBFpxkC᷅to6CHbݓuQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQExHo4|'mke@N捗$Iicвs^j:o1&N? ypEI}aggiݬ AS߳ς$u[( (p]=}8 _7xKBьs\+3$d:3aHg8 S zƻe&si_f(žP }NOs4m:8)K>ys\ _}ÚNEE}fdR2mps 5_F:r_!om[|70v򲭂2g^<[oqsA*92<G+|wy$˪F\)D^Ic @:f}qE$KbLcxHF@5߯hum`,^;2$,kpEbGJO =ׂIXywRDKu,$N'Hp1sHNncݡp*áVR  o\a~qzb39aA:< 7.AlJÃul7Jz0l`EzUѝ>;qj|b aݝo=gtqoe z*Fè `25M?>sOnLeI ڷ/g]I<2Q1 Q03sגzq]'4{I{)(@c}g, bB2[1@( *m{s~$VgB/g} Wm|$f1ЎJQ6ikc6y$(ܒI9zj>0{_ۋycg_((ۜz(򿅚x%ws9gXW͜a8QzPQEQEQ\4j!扫aL=T+6k(axW/4M_V6~nd1ڠ\a>os]QEW_<=qg}ɻko+sFݝc((JC}';wf|"ѷ^qڻ +>x?Zk֠I4Xr`uPEPEyfψ|5="OIlrw{+((?MԴ CBXו.[n)c#k Uܹ'=24/[+F4REd$}Ӷ2:pH&<oZ{HT}Y.۷aH(Ė5mrW|=shZ}F,Fs{((+YjZ"[w0Zja-fu|P0=zQEQEQEQEQEQEQEQEQEQEQEQEQEs~?uE r:*I\x=+# ngk$?۵PHIXG O㼚a _H ςZk VVӝ]UA@l' cgGy]V\ƨ#GbrxՐm\x}Izm1Ȟ`g[pf* 'nxxt,v[Il.daH@3Gµzwk^2ʞidEWW!o{<,O#ȯlxmm常8` $Q@$׍eO2PI}nFdր2cWڬm.䷴Q R3*Fܕw6V MN&munin9f'p,AU v}O<5`_!n=[RuPS)s32,00}kcG[H~D%~ap _§Fרk6:^>ַșm3@Wjj/kR/vv` ߻+*+W AjTS]*wj?g._c:|%gIADd 9O>(ֵT<9^g~lI3XI׼Q[/^MmjkD;dk$ςkvu ;{X4rXp9'$P**>6!J#/~ i{,I< ;m|$mxC6x]u3UDIۤ|׾?xkV)k(\$ }NB镡ڎApI#޴4~:}fZ׾"]G-ͅQ0ȸeQݎI4/CcaSm(VcGOvu qo,l1sݯRzËusxE"OAp]&~|!$s~+_ .%"F [rI'5 5mKPK{B ML%sLΰ8p Bյ)hroæ#h1m*?3rsYo?|E̵h_i*pyugmhc⯌u+þuYs$KՈcsVC#k'Gӿ׺1o[˼29d +=N9;zx6jMWTI/dΑ ,l ܆\q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@~_׌u]j1 x-!lYs Š(-t J GW%`/U2!hx_4?[XVU9 } p| ԥMվ!k7*F4jUG@Ri:?-YֺE~̊d*1~ }z(?N/>(j4?-~F<UhOI󼟷ZKmݳz݌9EhQ@|1w,t}g/vN1{V< _|1h>Wm6pzWaEq0/%~!ƭ_;^F?獶pZ6&>>?yͻdWu]i؞4; Vnݻ ]qd?4hm?#>fDv~; (+5oa7'KHm,8a߬q_W~]ϛyX"sQ@_O^(M}B݌dmsw4Zi;ϝنrxlQ@O}F+K'wu_ >><@ [žVDŽ~i_Ե;o#?rp9_J (+5oa7Z!k:0`wm /#FzWYo?KO믹ԯp7'q| k9;KƇy ʳG$qA#Ko|Bo4U@ahԪ :)ӌuEpqoG^εG+dS!TYdՍ;`xGд[o"WM{sQ@|CռeY Xr_\p| ԥMվ!k7*F4jUG@Ri:d88Mg{Zro2)n,p2q}O|3|o^-u @ s\Ҋ8~ 9X >DdȥHZGTdwzG4  x~EVAijSmĒ$+Rn-g\]-Vv re*q(y=b((((((((((((5/ ~g{KnE*yڌp 5{fi>^X})&" !RJ>h潂?t>T {p~5gfSeKYM#𫝩d^Xpz:xH8JZ+ 92`pcֽ"?6⽂ +_<:^a+d\K|Bĝ/D[u be dH,R6.(_xKLJk4-٤0]NBj'?x9#O}\+`1'b7c=wG>!Ill#[>#qڵ/v*n3@ _Ht/x҉+~=_Uy_Vqܠm_q+]gZD?(@B#n9 8$ho$:u^f{LbIs1qOzآ;㞫olW_.N^ǂ&]} t HcjX *1yQ@/ wy>Wi688ݞ1+sgz n^͒b$_`AО¼_ᘷxEО!k&?:V2c1 $e:O!qxy%cjB) %rsO ռW4x䍃+s^ m $%ݤE猢Tci(m>Y,ysB#ی` ( ( ( ( ( ( ( ( ( ( ( ( ( OR7Uxw41x?Sp$JL[[*2⧧cϯ|5wOm {H0\`C66G{N͇4lu-_>ȁ|nߜFrNk|Ha t<[a˹1?J(*?mz' !ILHK3I'W ~-h:xCTμ|_,s˷Lu`𵾻iH,>(x'þ1OguV}${wK>9ڽ}*4߂ ,l.ms,e)m@=''/ :A^eز.[H:ico6Q<3&7#dr2 @=f:`nYS$ꭂ@`r_:|,Ҿ$MjV~%-ݍcIv,brqgi}kA..-&SJNoFp8~.UyqGu-mgA巫s,  ZsayK[r0!EFA=+~Iuk_x;0H՗~.j5>fn U"*:y>ӤS\721r$€9_Ht/x҉+>i_&ѵ+? xMҒ1礻Te19PvQ׹;| wA%կbP`Fw«ˏ<ako: 7-Xۜg`U {|j hrZD̞X 2-2 ]>|oy7dRm2L^s̋8~.j5>fn U"*:y{/P2FϓM[HCoĀFcd nT#(_@vm_d;65+WU*k#G<;E{N< KIY睉xs FAv#62>qNޛ/m;Ft܈>՗`P>@qlxcΥᏉWI3MrYgiUʮc,䓸 xk⏀,/ۖ-:IeUr]$@-v5.0UދCnW& ps90~Py;ZCM,b$'6HC*Fҫ{KcPŭ{_7l짊uhYl3ԃEuoſ*hi*ǔ`ќ $On~?Lj4/QG-b۫(cF`9 dϢP^o%Ƒy<)Y}4#;x{_.w^QP|?4N8'x_|'`? {QiYMi `FۨH.i[}xݿ8:=z; +t\|Pum_Eua͐pXNI*?׼[T?c;\;I;IJñՐK/`8TMOh+<B:`BcƗ#HʷfsczÿM|KK@,A1Yܖ=I<:]ǂ:nvXⵌ+ w.$ha׸4<[Xii;QA,p98/ln->4PhwT:|ßOLV_ibE/- e',6S1d zžӴ;VA 1˾ 8Ŏ3p8 ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (SO[!\ *_t  Exr%*_}!#U #4 & ֩3|b]L ]t b+Da&R_2lEٱZ`aC)/яmvUkS r(-iPE Vv_{z GLt\2s!F A#葡JY r|AA,hB}q|B`du }00(䡆<pb,G+oB C0p/x$…– ]7 @2HFc ) @AD \0 LHG',(A` `@SC)_" PH`}Y+_|1.K8pAKMA @?3҄$[JPA)+NH I ,@8G0/@R T,`pF8Ѓ)$^$ DDTDlA@ s;PKPK&AOEBPS/dcommon/darbbook.cssPKPK&A!OEBPS/dcommon/O_signature_clr.JPG"(JFIF``C    $.' ",#(7),01444'9=82<.342C  2!!22222222222222222222222222222222222222222222222222" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ?( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( (?O '~MQ$Vz;OlJi8L%\]UFjޙ%ԯS;rA]5ފ<׈]j7Ouyq$z'TQuw7Ŀ KX߁M2=S'TQt?.5w'97;~pq=" ~k?`'9q6 E|yayM^Om'fkC&<5x' ?A?Zx'jß={=SßM gVC.5+Hd֪xc^)Җufz{Cީ|D Vkznq|+Xa+{50rx{|OG.OϞ~f/ xxX[2H )c+#jpUOZYX\=SG ߨC|K@;_߆'e?LT?]:?>w ڔ`D^So~xo[Ӡ3i7B:Q8 Vc-ďoi:FM292~y_*_闱YN\Fr=xZ3鳎OwW_QEzW~c]REeaSM}}Hӏ4&.E]u=gMѠ+mF`rNn$w9gMa꺢nTuhf2Xv>އ a(Û6߭?<=>z'TQuw7Ŀ KX߁M2=S'TQt?.5Kko\.8S$TOX߀Gw?Zx汴X)C7~.i6(Щ=+4{mGӭ¸-]&'t_kV*I<1)4thtIsqpQJ+> \m^[aJ5)ny:4o&QEnyAEPEEss 72,PDۢ׃K W{Wjr+wگ iM/;pd?~&?@;7E4gv8 $l'z'TQuw7Ŀ Gֱ=ɿ&G?. iR(5W*$|?w᫼gkmIbHe/_t>tg%y.l}N5[]+Mk0ĠeHdPrsst'UiC,y8`V%9ZIia|ܪvi מYG,o}+kk{YbyIeb*sAtի82zWoEK5z*o-eo;n(P u-I)4Š(HQEQEQEQEhz(X/Đ?}Bk˩ ݏrk0]4>8XzV? }6$}d^F>nU K ?Bտk_9׾x~w'ߞ  uDŽtL ؈5c-E/"|_Oo.IH쐍=i*Iw5(ںw?t5s.)+tQ2dUt5Vĺ.jZ"@IRrZƅY4ߡ_;}ų(KyQf1Aǵt?sZg+?F5_oQR&Dg߿]6FuRD u>ڿxl7?IT8'shj^=.=J1rj1Wl$얲cPx;E,p$֟ˏkw qg"45(ǛkV/=+ũ)bYl~K#˝J_כ5&\F'I#8/|wʾ_Xj Q:os^T1.M_|TO.;?_  jF?g N 8nA2F%i =qW,G=5OU u8]Rq?wr'˻S+۾.ܼ 87Q^elo/T*?L|ۚ<%<,/v_OKs B5f/29n0=zqQq(ª=VX@*J(э(f5qJN_EVǞQEOuoѕOuoa5}gO?:߂8Wא|cڽ~]N&O( (<]>͠@VQ=^~U ̴m&\խ5i:}|}r~9՝f}_>'vVֲ$~^f30^in{\_.O F8to}?${φ|#x^#^n~w=~k~?'KRtO.㌡h![3Zu*ٷճ(ԟ]z_/W1(ԟ]v~g|Yq<ז0 ; b8֮s,w9\?uEyStKaª@\,)) (!EPEPEPEPEPzѧts{v>C/"N6`d*J2gGӧWqBq_1ZuΓ\X]r?=Ey88Mp&pKtO-"wR2 K^-Z< \c>V0^@O7x2WFjs<׻kZ(<Т(OFw/6$1[:ޯԯ#q~4|,LVPem=@=YLUxӃV}AUbcUB.Ds5*kٸAeG>PJxt͝ b88?*$~@ׯD VkraiJs}Q.20x&mXξ,Z]“A-J#`+-E/"<]\a'tZGy.(|lދ~gMK OZdxDŽU9T6ϯ^<Ϡt5CZ]].t۫S=s`ڳ%8iVK:nqe+#<.T6U>zWoy3^I {F?J~=G}k)K$$;$de8*G Uӟ4Ocºw}|]4=ݣ\x$ʠms?q^ipw\"ȿPs^Z Q_0GڼU.t}ROM[G#]8wٞ ӫ87}Cgw vHȩBM55vof =A_٭`Ygx[6 P,5}>蚊(0(+?>+?> k|TuXq6_ +szk :u_ Z߶Ak_U}Jc2u/1[_»ݸG41-bሬ۴}}Eȹפ_c?5gi @cL\L<68hF_Ih>X4K7UТ sMj =J7CKo>Օ5s:߀t ~ηaٿ?|gdL8+gG%o?x`دOqȱwc¨&TW_V_aI=dpG!wu۞սZ1yL50$(l3(:~'ַo A}a3N*[0ǭ HKQV}G@֜$ 9of$ArNqUOgË05#m?D)^_h//5_/<?4}Jį+GkpG4"$ r| >S4Ђ"S 1%R:ȝ 8;PKPz PK&AOEBPS/dcommon/feedback.gif7GIF89a'%(hp|fdx?AN5:dfeDGHɾTdQc`g*6DC\?ؘ||{;=E6JUՄfeA= >@,4`H.|`a (Q 9:&[|ځ,4p Y&BDb,!2@, $wPA'ܠǃ@CO~/d.`I @8ArHx9H75j L 3B/` P#qD*s 3A:3,H70P,R@ p!(F oԥ D;"0 ,6QBRɄHhI@@VDLCk8@NBBL2&pClA?DAk%$`I2 #Q+l7 "=&dL&PRSLIP)PɼirqМ'N8[_}w;PK-PK&AOEBPS/dcommon/booklist.gifGIF89a1޵֥΄kZ{Jk1Rs!BZ)B),@I9Z͓Ca % Dz8Ȁ0FZЌ0P !x8!eL8aWȠFD(~@p+rMS|ӛR$ v "Z:]ZJJEc{*=AP  BiA ']j4$*   & 9q sMiO?jQ = , YFg4.778c&$c%9;PKː5PK&AOEBPS/dcommon/cpyr.htm1 Oracle Legal Notices

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2012, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in prerelease status:

This documentation is in prerelease status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Oracle Logo

PKN61PK&AOEBPS/dcommon/masterix.gif.GIF89a1ޜΌscJk1Rs!Bc1J),@IS@0"1 Ѿb$b08PbL,acr B@(fDn Jx11+\%1 p { display: none; } /* Class Selectors */ .ProductTitle { font-family: sans-serif; } .BookTitle { font-family: sans-serif; } .VersionNumber { font-family: sans-serif; } .PrintDate { font-family: sans-serif; font-size: small; } .PartNumber { font-family: sans-serif; font-size: small; } PKeӺ1,PK&AOEBPS/dcommon/larrow.gif#GIF87a絵ƌֵƽ{{ss֜ƔZZ{{{{ZZssZZccJJJJRRBBJJJJ991111))!!{,@pH,Ȥrl:ШtpHc`  өb[.64ꑈ53=Z]'yuLG*)g^!8C?-6(29K"Ĩ0Яl;U+K9^u2,@@ (\Ȱ Ë $P`lj 8x I$4H *(@͉0dа8tA  DсSP v"TUH PhP"Y1bxDǕ̧_=$I /& .)+ 60D)bB~=0#'& *D+l1MG CL1&+D`.1qVG ( "D2QL,p.;u. |r$p+5qBNl<TzB"\9e0u )@D,¹ 2@C~KU 'L6a9 /;<`P!D#Tal6XTYhn[p]݅ 7}B a&AƮe{EɲƮiEp#G}D#xTIzGFǂEc^q}) Y# (tۮNeGL*@/%UB:&k0{ &SdDnBQ^("@q #` @1B4i@ aNȅ@[\B >e007V[N(vpyFe Gb/&|aHZj@""~ӎ)t ? $ EQ.սJ$C,l]A `8A o B C?8cyA @Nz|`:`~7-G|yQ AqA6OzPbZ`>~#8=./edGA2nrBYR@ W h'j4p'!k 00 MT RNF6̙ m` (7%ꑀ;PKl-OJPK&AOEBPS/dcommon/index.gifGIF89a1޵ΥΥ{sc{BZs,@IM" AD B0 3.R~[D"0, ]ШpRNC  /& H&[%7TM/`vS+-+ q D go@" 4o'Uxcxcc&k/ qp zUm(UHDDJBGMԃ;PK(PK&AOEBPS/dcommon/bookbig.gif +GIF89a$!!!)))111999BBBJJJRRRZZZccckkksss{{{skkB991)))!!B11))1!JB9B9!!cZ9ƭƽssk{ZZRccZRRJJJBBB9c!!ν)1)k{s絽ƌkssֽZccJRRBJJ{9BB)11)99!!))11!!k!JZ!)RcJccBcs)1c)JZ!BR!)BZ)99J!Rk9!c11B)Z{)9Bkc1kB9BZ!Z{9Rs)Jkksk9kB1s1Jk9Rƥc{k9s)Z{1k91)s1Rk)Jc1J!))BZ!1k{csc{)19B!)Bcsc{ksc{kZs!RkJkJkքc{9Zks{ck9R)Bks9R9R1J!)Z1B!)c)9)99BR19kksBBJcc{ccBBZ))9kk!!199c11ZBB{9!!R!!Z!!c))!!kR!!s!!BcksRZ1c9B)R91c1)Z!R9B9k1)RcZ{)!1B9JB9B)!)J9B!& Imported from GIF image: bookbig.gif,$!!!)))111999BBBJJJRRRZZZccckkksss{{{skkB991)))!!B11))1!JB9B9!!cZ9ƭƽssk{ZZRccZRRJJJBBB9c!!ν)1)k{s絽ƌkssֽZccJRRBJJ{9BB)11)99!!))11!!k!JZ!)RcJccBcs)1c)JZ!BR!)BZ)99J!Rk9!c11B)Z{)9Bkc1kB9BZ!Z{9Rs)Jkksk9kB1s1Jk9Rƥc{k9s)Z{1k91)s1Rk)Jc1J!))BZ!1k{csc{)19B!)Bcsc{ksc{kZs!RkJkJkքc{9Zks{ck9R)Bks9R9R1J!)Z1B!)c)9)99BR19kksBBJcc{ccBBZ))9kk!!199c11ZBB{9!!R!!Z!!c))!!kR!!s!!BcksRZ1c9B)R91c1)Z!R9B9k1)RcZ{)!1B9JB9B)!)J9BH`\Ȑ:pظа"A6DBH,V@Dڹ'G"v Æ ܥ;n;!;>xAܽ[G.\rQC wr}BŊQ A9ᾑ#5Y0VȒj0l-GqF>ZpM rb ;=.ސW-WѻWo ha!}~ْ ; t 53 :\ 4PcD,0 4*_l0K3-`l.j!c Aa|2L4/1C`@@md;(H*80L0L(h*҇҆o#N84pC (xO@ A)J6rVlF r  fry†$r_pl5xhA+@A=F rGU a 1х4s&H Bdzt x#H%Rr (Ѐ7P`#Rщ'x" #0`@~i `HA'Tk?3!$`-A@1l"P LhʖRG&8A`0DcBH sq@AXB4@&yQhPAppxCQ(rBW00@DP1E?@lP1%T` 0 WB~nQ@;PKGC PK&AOEBPS/dcommon/rarrow.gif/GIF87a絵ƌֵƽ{{ss֜ƔZZ{{{{ZZssZZccJJJJRRBBJJJJ991111))!!{,@pH,Ȥrl:ШLlԸ NCqWEd)#34vwwpN|0yhX!'+-[F 'n5 H $/14w3% C .90" qF 7&E "D mnB|,c96) I @0BW{ᢦdN p!5"D`0 T 0-]ʜ$;PKJV^PK&AOEBPS/dcommon/mix.gifkGIF89aZZZBBBJJJkkk999sss!!!111cccֽ{{{RRR)))猌ƭ{s{sks!,@@pH,B$ 8 t:<8 *'ntPP DQ@rIBJLNPTVEMOQUWfj^!  hhG H  kCúk_a Ǥ^ h`B BeH mm  #F` I lpǎ,p B J\Y!T\(dǏ!Gdˆ R53ټ R;iʲ)G=@-xn.4Y BuU(*BL0PX v`[D! | >!/;xP` (Jj"M6 ;PK枰pkPK&AOEBPS/dcommon/doccd_epub.jsM /* Copyright 2006, 2012, Oracle and/or its affiliates. All rights reserved. Author: Robert Crews Version: 2012.3.17 */ function addLoadEvent(func) { var oldOnload = window.onload; if (typeof(window.onload) != "function") window.onload = func; else window.onload = function() { oldOnload(); func(); } } function compactLists() { var lists = []; var ul = document.getElementsByTagName("ul"); for (var i = 0; i < ul.length; i++) lists.push(ul[i]); var ol = document.getElementsByTagName("ol"); for (var i = 0; i < ol.length; i++) lists.push(ol[i]); for (var i = 0; i < lists.length; i++) { var collapsible = true, c = []; var li = lists[i].getElementsByTagName("li"); for (var j = 0; j < li.length; j++) { var p = li[j].getElementsByTagName("p"); if (p.length > 1) collapsible = false; for (var k = 0; k < p.length; k++) { if ( getTextContent(p[k]).split(" ").length > 12 ) collapsible = false; c.push(p[k]); } } if (collapsible) { for (var j = 0; j < c.length; j++) { c[j].style.margin = "0"; } } } function getTextContent(e) { if (e.textContent) return e.textContent; if (e.innerText) return e.innerText; } } addLoadEvent(compactLists); function processIndex() { try { if (!/\/index.htm(?:|#.*)$/.test(window.location.href)) return false; } catch(e) {} var shortcut = []; lastPrefix = ""; var dd = document.getElementsByTagName("dd"); for (var i = 0; i < dd.length; i++) { if (dd[i].className != 'l1ix') continue; var prefix = getTextContent(dd[i]).substring(0, 2).toUpperCase(); if (!prefix.match(/^([A-Z0-9]{2})/)) continue; if (prefix == lastPrefix) continue; dd[i].id = prefix; var s = document.createElement("a"); s.href = "#" + prefix; s.appendChild(document.createTextNode(prefix)); shortcut.push(s); lastPrefix = prefix; } var h2 = document.getElementsByTagName("h2"); for (var i = 0; i < h2.length; i++) { var nav = document.createElement("div"); nav.style.position = "relative"; nav.style.top = "-1.5ex"; nav.style.left = "1.5em"; nav.style.width = "90%"; while (shortcut[0] && shortcut[0].toString().charAt(shortcut[0].toString().length - 2) == getTextContent(h2[i])) { nav.appendChild(shortcut.shift()); nav.appendChild(document.createTextNode("\u00A0 ")); } h2[i].parentNode.insertBefore(nav, h2[i].nextSibling); } function getTextContent(e) { if (e.textContent) return e.textContent; if (e.innerText) return e.innerText; } } addLoadEvent(processIndex); PKo"nR M PK&AOEBPS/dcommon/toc.gifGIF89a1ΥΥ{c{Z{JkJk1Rk,@IK% 0| eJB,K-1i']Bt9dz0&pZ1o'q(؟dQ=3S SZC8db f&3v2@VPsuk2Gsiw`"IzE%< C !.hC IQ 3o?39T ҍ;PKv I PK&AOEBPS/dcommon/topnav.gifGIF89a1ֽ筽ޭƔkZZk{Bc{,@ ) l)-'KR$&84 SI) XF P8te NRtHPp;Q%Q@'#rR4P fSQ o0MX[) v + `i9gda/&L9i*1$#"%+ ( E' n7Ȇ(,҅(L@(Q$\x 8=6 'נ9tJ&"[Epljt p#ѣHb :f F`A =l|;&9lDP2ncH R `qtp!dȐYH›+?$4mBA9 i@@ ]@ꃤFxAD*^Ŵ#,(ε  $H}F.xf,BD Z;PK1FAPK&AOEBPS/dcommon/bp_layout.css# @charset "utf-8"; /* bp_layout.css Copyright 2007, Oracle and/or its affiliates. All rights reserved. */ body { margin: 0ex; padding: 0ex; } h1 { display: none; } #FOOTER { border-top: #0d4988 solid 10px; background-color: inherit; color: #e4edf3; clear: both; } #FOOTER p { font-size: 80%; margin-top: 0em; margin-left: 1em; } #FOOTER a { background-color: inherit; color: gray; } #LEFTCOLUMN { float: left; width: 50%; } #RIGHTCOLUMN { float: right; width: 50%; clear: right; /* IE hack */ } #LEFTCOLUMN div.portlet { margin-left: 2ex; margin-right: 1ex; } #RIGHTCOLUMN div.portlet { margin-left: 1ex; margin-right: 2ex; } div.portlet { margin: 2ex 1ex; padding-left: 0.5em; padding-right: 0.5em; border: 1px #bcc solid; background-color: #f6f6ff; color: black; } div.portlet h2 { margin-top: 0.5ex; margin-bottom: 0ex; font-size: 110%; } div.portlet p { margin-top: 0ex; } div.portlet ul { list-style-type: none; padding-left: 0em; margin-left: 0em; /* IE Hack */ } div.portlet li { text-align: right; } div.portlet li cite { font-style: normal; float: left; } div.portlet li a { margin: 0px 0.2ex; padding: 0px 0.2ex; font-size: 95%; } #NAME { margin: 0em; padding: 0em; position: relative; top: 0.6ex; left: 10px; width: 80%; } #PRODUCT { font-size: 180%; } #LIBRARY { color: #0b3d73; background: inherit; font-size: 180%; font-family: serif; } #RELEASE { position: absolute; top: 28px; font-size: 80%; font-weight: bold; } #TOOLS { list-style-type: none; position: absolute; top: 1ex; right: 2em; margin: 0em; padding: 0em; background: inherit; color: black; } #TOOLS a { background: inherit; color: black; } #NAV { float: left; width: 96%; margin: 3ex 0em 0ex 0em; padding: 2ex 0em 0ex 4%; /* Avoiding horizontal scroll bars. */ list-style-type: none; background: transparent url(../gifs/nav_bg.gif) repeat-x bottom; } #NAV li { float: left; margin: 0ex 0.1em 0ex 0em; padding: 0ex 0em 0ex 0em; } #NAV li a { display: block; margin: 0em; padding: 3px 0.7em; border-top: 1px solid gray; border-right: 1px solid gray; border-bottom: none; border-left: 1px solid gray; background-color: #a6b3c8; color: #333; } #SUBNAV { float: right; width: 96%; margin: 0ex 0em 0ex 0em; padding: 0.1ex 4% 0.2ex 0em; /* Avoiding horizontal scroll bars. */ list-style-type: none; background-color: #0d4988; color: #e4edf3; } #SUBNAV li { float: right; } #SUBNAV li a { display: block; margin: 0em; padding: 0ex 0.5em; background-color: inherit; color: #e4edf3; } #SIMPLESEARCH { position: absolute; top: 5ex; right: 1em; } #CONTENT { clear: both; } #NAV a:hover, #PORTAL_1 #OVERVIEW a, #PORTAL_2 #OVERVIEW a, #PORTAL_3 #OVERVIEW a, #PORTAL_4 #ADMINISTRATION a, #PORTAL_5 #DEVELOPMENT a, #PORTAL_6 #DEVELOPMENT a, #PORTAL_7 #DEVELOPMENT a, #PORTAL_11 #INSTALLATION a, #PORTAL_15 #ADMINISTRATION a, #PORTAL_16 #ADMINISTRATION a { background-color: #0d4988; color: #e4edf3; padding-bottom: 4px; border-color: gray; } #SUBNAV a:hover, #PORTAL_2 #SEARCH a, #PORTAL_3 #BOOKS a, #PORTAL_6 #WAREHOUSING a, #PORTAL_7 #UNSTRUCTURED a, #PORTAL_15 #INTEGRATION a, #PORTAL_16 #GRID a { position: relative; top: 2px; background-color: white; color: #0a4e89; } PK3( # PK&AOEBPS/dcommon/bookicon.gif:GIF87a!!!)))111999BBBJJJRRRZZZccckkksss{{{ޭ{{ZRRcZZRJJJBB)!!skRB9{sν{skskcZRJ1)!֭ƽ{ZZRccZJJBBB999111)JJ9BB1ZZB!!ﭵBJJ9BB!!))Jk{)1!)BRZJ{BsR!RRJsJ!J{s!JsBkks{RsB{J{c1RBs1ZB{9BJ9JZ!1BJRRs!9R!!9Z9!1)J19JJRk19R1Z)!1B9R1RB!)J!J1R)J119!9J91!9BkksBBJ119BBR!))9!!!JB1JJ!)19BJRZckތ1)1J9B,H*\hp >"p`ƒFF "a"E|ժOC&xCRz OBtX>XE*O>tdqAJ +,WxP!CYpQ HQzDHP)T njJM2ꔀJ2T0d#+I:<жk 'ꤱF AB @@nh Wz' H|-7f\A#yNR5 /PM09u UjćT|q~Yq@&0YZAPa`EzI /$AD Al!AAal 2H@$ PVAB&c*ؠ p @% p-`@b`uBa l&`3Ap8槖X~ vX$Eh`.JhAepA\"Bl, :Hk;PKx[?:PK&AOEBPS/dcommon/conticon.gif^GIF87a!!!)))111999BBBJJJRRRZZZccckkksss{{{ZRR޽{{ssskkkcccZ991ccRZZBBJJZck)19ZcsBJZ19J!k{k)Z1RZs1!B)!J91{k{)J!B!B911)k{cs!1s!9)s!9!B!k)k1c!)Z!R{9BJcckZZcBBJ99B119{{!!)BBRBBZ!))999R99Z!!999c1!9!)19B1)!B9R,  oua\h2SYPa aowwxYi 9SwyyxxyYSd $'^qYȵYvh ч,/?g{н.J5fe{ڶyY#%/}‚e,Z|pAܠ `KYx,ĉ&@iX9|`p ]lR1khٜ'E 6ÅB0J;t X b RP(*MÄ!2cLhPC <0Ⴁ  $4!B 6lHC%<1e H 4p" L`P!/,m*1F`#D0D^!AO@..(``_؅QWK>_*OY0J@pw'tVh;PKp*c^PK&AOEBPS/dcommon/blafdoc.cssL@charset "utf-8"; /* Copyright 2002, 2011, Oracle and/or its affiliates. All rights reserved. Author: Robert Crews Version: 2011.10.7 */ body { font-family: Tahoma, sans-serif; /* line-height: 125%; */ color: black; background-color: white; font-size: small; } * html body { /* http://www.info.com.ph/~etan/w3pantheon/style/modifiedsbmh.html */ font-size: x-small; /* for IE5.x/win */ f\ont-size: small; /* for other IE versions */ } h1 { font-size: 165%; font-weight: bold; border-bottom: 1px solid #ddd; width: 100%; } h2 { font-size: 152%; font-weight: bold; } h3 { font-size: 139%; font-weight: bold; } h4 { font-size: 126%; font-weight: bold; } h5 { font-size: 113%; font-weight: bold; display: inline; } h6 { font-size: 100%; font-weight: bold; font-style: italic; display: inline; } a:link { color: #039; background: inherit; } a:visited { color: #72007C; background: inherit; } a:hover { text-decoration: underline; } a img, img[usemap] { border-style: none; } code, pre, samp, tt { font-family: monospace; font-size: 110%; } caption { text-align: center; font-weight: bold; width: auto; } dt { font-weight: bold; } table { font-size: small; /* for ICEBrowser */ } td { vertical-align: top; } th { font-weight: bold; text-align: left; vertical-align: bottom; } ol ol { list-style-type: lower-alpha; } ol ol ol { list-style-type: lower-roman; } td p:first-child, td pre:first-child { margin-top: 0px; margin-bottom: 0px; } table.table-border { border-collapse: collapse; border-top: 1px solid #ccc; border-left: 1px solid #ccc; } table.table-border th { padding: 0.5ex 0.25em; color: black; background-color: #f7f7ea; border-right: 1px solid #ccc; border-bottom: 1px solid #ccc; } table.table-border td { padding: 0.5ex 0.25em; border-right: 1px solid #ccc; border-bottom: 1px solid #ccc; } span.gui-object, span.gui-object-action { font-weight: bold; } span.gui-object-title { } p.horizontal-rule { width: 100%; border: solid #cc9; border-width: 0px 0px 1px 0px; margin-bottom: 4ex; } div.zz-skip-header { display: none; } td.zz-nav-header-cell { text-align: left; font-size: 95%; width: 99%; color: black; background: inherit; font-weight: normal; vertical-align: top; margin-top: 0ex; padding-top: 0ex; } a.zz-nav-header-link { font-size: 95%; } td.zz-nav-button-cell { white-space: nowrap; text-align: center; width: 1%; vertical-align: top; padding-left: 4px; padding-right: 4px; margin-top: 0ex; padding-top: 0ex; } a.zz-nav-button-link { font-size: 90%; } div.zz-nav-footer-menu { width: 100%; text-align: center; margin-top: 2ex; margin-bottom: 4ex; } p.zz-legal-notice, a.zz-legal-notice-link { font-size: 85%; /* display: none; */ /* Uncomment to hide legal notice */ } /*************************************/ /* Begin DARB Formats */ /*************************************/ .bold, .codeinlinebold, .syntaxinlinebold, .term, .glossterm, .seghead, .glossaryterm, .keyword, .msg, .msgexplankw, .msgactionkw, .notep1, .xreftitlebold { font-weight: bold; } .italic, .codeinlineitalic, .syntaxinlineitalic, .variable, .xreftitleitalic { font-style: italic; } .bolditalic, .codeinlineboldital, .syntaxinlineboldital, .titleinfigure, .titleinexample, .titleintable, .titleinequation, .xreftitleboldital { font-weight: bold; font-style: italic; } .itemizedlisttitle, .orderedlisttitle, .segmentedlisttitle, .variablelisttitle { font-weight: bold; } .bridgehead, .titleinrefsubsect3 { font-weight: bold; } .titleinrefsubsect { font-size: 126%; font-weight: bold; } .titleinrefsubsect2 { font-size: 113%; font-weight: bold; } .subhead1 { display: block; font-size: 139%; font-weight: bold; } .subhead2 { display: block; font-weight: bold; } .subhead3 { font-weight: bold; } .underline { text-decoration: underline; } .superscript { vertical-align: super; } .subscript { vertical-align: sub; } .listofeft { border: none; } .betadraft, .alphabetanotice, .revenuerecognitionnotice { color: #e00; background: inherit; } .betadraftsubtitle { text-align: center; font-weight: bold; color: #e00; background: inherit; } .comment { color: #080; background: inherit; font-weight: bold; } .copyrightlogo { text-align: center; font-size: 85%; } .tocsubheader { list-style-type: none; } table.icons td { padding-left: 6px; padding-right: 6px; } .l1ix dd, dd dl.l2ix, dd dl.l3ix { margin-top: 0ex; margin-bottom: 0ex; } div.infoboxnote, div.infoboxnotewarn, div.infoboxnotealso { margin-top: 4ex; margin-right: 10%; margin-left: 10%; margin-bottom: 4ex; padding: 0.25em; border-top: 1pt solid gray; border-bottom: 1pt solid gray; } p.notep1 { margin-top: 0px; margin-bottom: 0px; } .tahiti-highlight-example { background: #ff9; text-decoration: inherit; } .tahiti-highlight-search { background: #9cf; text-decoration: inherit; } .tahiti-sidebar-heading { font-size: 110%; margin-bottom: 0px; padding-bottom: 0px; } /*************************************/ /* End DARB Formats */ /*************************************/ @media all { /* * * { line-height: 120%; } */ dd { margin-bottom: 2ex; } dl:first-child { margin-top: 2ex; } } @media print { body { font-size: 11pt; padding: 0px !important; } a:link, a:visited { color: black; background: inherit; } code, pre, samp, tt { font-size: 10pt; } #nav, #search_this_book, #comment_form, #comment_announcement, #flipNav, .noprint { display: none !important; } body#left-nav-present { overflow: visible !important; } } PKʍPK&AOEBPS/dcommon/rightnav.gif&GIF89a1ֽ筽ޭƔkZZk{Bc{,@ ) l)- $CҠҀ ! D1 #:aS( c4B0 AC8 ְ9!%MLj Z * ctypJBa H t>#Sb(clhUԂ̗4DztSԙ9ZQҀEPEPEPEPEPEPEPM=iԍP Gii c*yF 1׆@\&o!QY00_rlgV;)DGhCq7~..p&1c:u֫{fI>fJL$}BBP?JRWc<^j+χ5b[hֿ- 5_j?POkeQ^hֿ1L^ H ?Qi?z?+_xɔŪ\썽O]χ>)xxV/s)e6MI7*ߊޛv֗2J,;~E4yi3[nI`Ѱe9@zXF*W +]7QJ$$=&`a۾?]N T䏟'X)Ɣkf:j |>NBWzYx0t!* _KkoTZ?K Gc+UyڹgNuh^iSo5{\ܹ3Yos}.>if FqR5\/TӮ#]HS0DKu{($"2xִ{SBJ8=}Y=.|Tsц2UЫ%.InaegKo z ݎ3ֹxxwM&2S%';+I',kW&-"_¿_ Vq^ܫ6pfT2RV A^6RKetto^[{w\jPZ@ޢN4/XN#\42j\(z'j =~-I#:q[Eh|X:sp* bifp$TspZ-}NM*B-bb&*xUr#*$M|QWY ~p~- fTED6O.#$m+t$˙H"Gk=t9r娮Y? CzE[/*-{c*[w~o_?%ƔxZ:/5𨴟q}/]22p qD\H"K]ZMKR&\C3zĽ[PJm]AS)Ia^km M@dК)fT[ijW*hnu Ͳiw/bkExG£@f?Zu.s0(<`0ֹoxOaDx\zT-^ѧʧ_1+CP/p[w 9~U^[U<[tĽwPv[yzD1W='u$Oeak[^ |Gk2xv#2?¹TkSݕ| rݞ[Vi _Kz*{\c(Ck_܏|?u jVڔ6f t?3nmZ6f%QAjJf9Rq _j7Z-y.pG$Xb]0')[_k;$̭?&"0FOew7 z-cIX岛;$u=\an$ zmrILu uٞ% _1xcUW%dtÀx885Y^gn;}ӭ)場QEQ@Q@Q@Q@Q@Q@!4xPm3w*]b`F_931˜[ן+(> E ly;<;MF-qst+}DH @YKlLmؤciN<|]IU)Lw(8t9FS(=>og<\Z~u_+X1ylsj'eՃ*U3`C!N9Q_WܱhKc93^ua>H ƕGk=8~e#_?{ǀe-[2ٔ7;=&K挑5zsLdx(e8#{1wS+ΝVkXq9>&yஏh$zq^0~/j@:/«Vnce$$uoPp}MC{$-akH@ɫ1O !8R9s5ԦYmϧ'OUṡ5T,!Ԛ+s#1Veo=[)g>#< s)ƽُA^䠮ωFUj(ǩ|N3Jڷ睁ϱuږZYGOTsI<&drav?A^_f׻B$,O__ԿC`it{6>G׈C~&$y؎v1q9Sc1fH[ѽ>,gG'0'@Vw,BO [#>ﱺg5ΒFVD%Yr:O5 Tu+O멃]ی38Ze}R&ѝ_xzc1DXgس;<,_,{ƽY'AS#oF.M#~cBuEx7G+Y)(5q+GCV;qF+CLQ)qEC&6z𿊘z}?&w=+)??&\g{;V??׻xGœdٿ׼-Nc')3K]N)iLTӿCdb7Q^a N sd>Fz[0S^s'Zi 77D}kWus ab~~H(>.fif9,~|Jk;YN3H8Y(t6Q݉k͇_÷Z+2߄&[ +Tr^藺97~c܎=[f1RrBǓ^kEMhxYVm<[џ6| kqbѱ| YA{G8p?\UM7Z66 g1U1igU69 u5Pƪ:VVZC=[@ҹ¨$kSmɳО\vFz~i3^a Osŧυ9Q}_3 όO{/wgoet39 vO2ea;Ύ7$U#?k+Ek&dpzbӱ+TaB0gN{[N7Gי}U7&@?>Fz~E!a@s ?'67XxO*!?qi]֏TQN@tI+\^s8l0)2k!!iW8F$(yOּT.k,/#1:}8uT˾+5=O/`IW G֯b.-<= HOm;~so~hW5+kS8s.zwE| ?4ӿw/K N 9?j(#0UT` Wzw}:_*9m>󑓀F?ELzv=8q:=WgJ`nDr Zе<ֹ](Q@Q@Q@Q@Q@Q@Q@Q@ 'IdC0EYJVcMty_~u+Sw-aO n<[YJgL#6i g5ЖDZ14cʝ!!\/M}/_AYR__>oC? _?7_G#RERW쏞KB}JxGSkǕA pƱơP m]hwB7U$Zq M95"3q1ioATߚ{g.t uu2k=;h#YB= fgS :TdLԃ!44mFK{Hrd^7oz|BVr<{)6AXգV»|>*/hS܏z͆OM=Εq (s|s׊LKQI :9NJ)P+!ʣoAF>+=@I}"x/}۠1aנc¹4emC:>p_xWKX` >R3_S½èųp3޺u3N e یbmͺ<_ mnݮ1Op?Gm)Qb%N585'%Ahs\6yw!"&Ɨ._wk)}GP;Z!#\"< *oƾ\)}N>"լ/~]Lg}pBG X?<zZ#x69S=6) jzx=y9O&>+e!!? ?s~k5Gʏ)?*ce7Ox~k5􇔾Q/e7/Ԑ#3OgNC0] ;_FiRl>Q.g>!%k#ú:Kn'&}?U@\pџPtp)v<{_i}Oվֲ3XIYIx~b<D?(=_JXH=bbi=Oh?_ C_O)}oW쏜? %Ƶ;-RYFi`wۭ{ϖZMtQ$"c_+ԃx1*0b;ԕ݋ESQEQEQEQEQEQEQEQEQEQZ(1F)h1K@XLRE&9P (bf{RӨ&)PEPEPbԴPGKZ(iإbn(:A%S0(-&)P+ ڎԴP11F)h&:LRmQ@Q@Š(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((PKje88PK&AOEBPS/dcommon/help.gif!GIF89a1εֵ֜֜{kZsBc{,@ )sƠTQ$8(4ʔ%ŌCK$A HP`$h8ŒSd+ɡ\ H@%' 6M HO3SJM /:Zi[7 \( R9r ERI%  N=aq   qƦs *q-n/Sqj D XZ;PKއ{&!PK&A OEBPS/toc.htm\ Table of Contents

Contents

Title and Copyright Information

Preface

What's New in Enterprise User Security?

1 Introducing Enterprise User Security

2 Getting Started with Enterprise User Security

3 Configuration and Administration Tools Overview

4 Enterprise User Security Configuration Tasks and Troubleshooting

5 Administering Enterprise User Security

A Using the User Migration Utility

B SSL External Users Conversion Script

C Integrating Enterprise User Security with Microsoft Active Directory

D Upgrading from Oracle9i to Oracle Database 11g Release 2 (11.2)

Glossary

Index

PK9dq\\PK&AOEBPS/adminste.htm Administering Enterprise User Security

5 Administering Enterprise User Security

This chapter describes how to use Oracle Enterprise Manager to administer Enterprise User Security in Oracle Databases. This chapter contains the following topics:

5.1 Administering Identity Management Realms

An identity management realm is a subtree of directory entries, all of which are governed by the same administrative policies. A realm Oracle Context is a subtree in a directory identity management realm that contains the data used by any installed Oracle product that uses the directory.

You can set properties of an identity management realm using Oracle Internet Directory tools like the Oracle Internet Directory Self-Service Console.

The Oracle Enterprise Manager Database Control or Grid Control Web interface enables you to manage Enterprise User Security related entries in an identity management realm.

This section describes administering identity management realms for Enterprise User Security. It contains the following topics:

5.1.1 Identity Management Realm Versions

Enterprise User Security can only use an identity management realm supplied by Oracle Internet Directory 10g (9.0.4), or later, which ships with Oracle Application Server 10g (9.0.4), or later. You can manage Enterprise User Security directory entries in a version 9.0.4 (or later) identity management realm by using Oracle Enterprise Manager for Oracle Database 11g Release 2 (11.2).

5.1.2 Setting Properties of an Identity Management Realm

An identity management realm has a number of properties that can be viewed and managed by using Oracle Internet Directory tools like the Oracle Internet Directory Self-Service Console. These properties are described in Table 5-1.

Table 5-1 Identity Management Realm Properties

PropertyDescription

Attribute for Login Name

Name of the directory attribute used to store login names. By default, login names are stored in the uid attribute, but they can be changed to correspond to your directory configuration. In previous releases, this was the cn attribute.

Attribute for Kerberos Principal Name

Name of the directory attribute used to store Kerberos principal names. By default, Kerberos principal names are stored in the krbPrincipalName directory attribute, but they can be changed to correspond to your directory configuration by changing orclCommonKrbPrincipalAttribute in the identity management realm.

User Search Base

Full distinguished name (DN) for the node at which enterprise users are stored in the directory.

Group Search Base

Full DN for the node at which user groups are stored for this identity management realm in the directory.

Version Compatibility

This property is no longer used. However, you should ensure that it is not set to 81000, because release 8.1.7 and earlier databases cannot be in the same realm with Oracle Database 10g or later databases.



Note:

Each identity management realm includes an orcladmin user who is the root user of that realm only. These realm-specific orcladmin users are represented by the directory entries cn=orcladmin,cn=Users,realm_DN. Note that when you are logged in to Enterprise User Security administration tools as a realm-specific orcladmin user, then you can manage only directory objects for that realm. To manage objects in another realm, you must log in to administration tools as the orcladmin user for that realm.

5.1.2.1 Setting Login Name, Kerberos Principal Name, User Search Base, and Group Search Base Identity Management Realm Attributes

Setting these identity management realm attributes enables the database to locate Enterprise User Security entries.

To set Login Name, Kerberos Principal Name, User Search Base, and Group Search Base identity management realm attributes:

  1. Log in to the Oracle Internet Directory Self-Service Console.

    Enter the URL to access the Oracle Internet Directory Self-Service Console in a browser window. For example:

    http://myhost1:7777/oiddas

    Log in as the orcladmin user.

  2. Click the Configuration tab. Click the Identity Management Realm subtab.

    The Directory Configuration page appears.

  3. Enter the appropriate information into the available fields.

  4. Click Submit to save your changes to the directory.


See Also:

Oracle Identity Management Guide to Delegated Administration for detailed information on using the Oracle Internet Directory Self-Service Console

5.1.3 Setting the Default Database-to-Directory Authentication Type for an Identity Management Realm

The initial value for the LDAP_DIRECTORY_ACCESS parameter is picked from the default database-to-directory authentication attribute setting at the realm level. This parameter is set on individual databases when they are registered in Oracle Internet Directory.

The Oracle Enterprise Manager Database Control or Grid Control interface enables you to set the authentication mechanism that the database uses to authenticate to Oracle Internet Directory. The authentication mechanism can be set to password or SSL.

To set the default database-to-directory authentication type for an identity management realm:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click OID Realm Administration.

    The OID Realm Administration page appears. The current DB-OID authentication method is displayed.

  5. To change the current DB-OID authentication method, click Change.

    The Realm Configuration page appears.

  6. Select Password or SSL under DB-OID Authentication.

  7. If all the databases and clients in the realm are release 10g or higher, you can turn off the password verifiers feature. This feature is used by the directory to populate an additional password field for pre-10g databases. To turn off password verifiers, deselect Password Verifiers.

  8. Click OK.

5.1.4 Managing Identity Management Realm Administrators

An identity management realm contains administrative groups that have varying levels of privileges. The administrative groups for an identity management realm, which pertain to Enterprise User Security, are defined in Table 5-2. For more information about these groups, see "Administrative Groups".

Table 5-2 Enterprise User Security Identity Management Realm Administrators

Administrative GroupDefinition

Oracle Database Registration Administrators

(OracleDBCreators)

Registers new databases in the realm.

Oracle Database Security Administrators

(OracleDBSecurityAdmins)

Has all privileges on the OracleDBSecurity directory subtree. Creates, modifies, and can read all Enterprise User Security directory objects.

Oracle Context Administrators

(OracleContextAdmins)

Has full access to all groups and entries within its associated realm.

User Security Administrators

(OracleUserSecurityAdmins)

Has relevant permissions necessary to administer security aspects for enterprise users in the directory. For example, OracleUserSecurityAdmins can modify user passwords.


To manage identity management realm administrators:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click OID Realm Administration.

    The OID Realm Administration page appears. This page lists the Enterprise User Security related administrative groups in the identity management realm.

  5. Select the administrative group that you wish to edit. Click Edit.

    The Edit page appears. It lists the directory users that are currently members of the group selected in the OID Realm Administration page.

  6. To add a directory user to the group, click Add.

    The Select Users window appears.

  7. Select the Search Base. The Search Base is the directory subtree that you wish to search for locating the user. Click Go.

  8. Select the user that you wish to add as an administrator. Click Select.

    The user is added in the Edit page.

  9. Click OK.

5.2 Administering Enterprise Users

This section describes how to use Oracle Internet Directory Self-Service Console and Oracle Enterprise Manager to administer enterprise users. It contains the following topics:

5.2.1 Creating New Enterprise Users

You can use Oracle Internet Directory tools like the Oracle Internet Directory Self-Service Console to create users in the directory.


Note:

Before creating new enterprise users, you must first define the user search base in the directory and also verify the user create base. See "Setting Login Name, Kerberos Principal Name, User Search Base, and Group Search Base Identity Management Realm Attributes"

To create new enterprise users:

  1. Log in to the Oracle Internet Directory Self-Service Console.

    Enter the URL to access the Oracle Internet Directory Self-Service Console in a browser window. For example:

    http://myhost1:7777/oiddas

    Log in as the orcladmin user.

  2. Click the Directory tab. Click the Users subtab.

    The Users page appears.

  3. Click Create to create a new user.

    The Create User page appears.

  4. Enter the appropriate user information in the Create User page. Click Submit to create a new enterprise user.


Note:

Note that if your users are authenticated to the database by using Kerberos credentials, and the krbPrincipalName attribute is not there, then see "Task 1: Configure Oracle Internet Directory Self-Service Console to display the Kerberos principal name attribute" for information about how to configure this.

5.2.2 Setting Enterprise User Passwords

You can use Oracle Internet Directory Self-Service Console to set and maintain enterprise user passwords in Oracle Internet Directory.

The enterprise user password is used for:

  • Directory logon

  • Database logon, to databases that support password authentication for global users

To set the password for an enterprise user:

  1. Log in to the Oracle Internet Directory Self-Service Console.

    Enter the URL to access the Oracle Internet Directory Self-Service Console in a browser window. For example:

    http://myhost1:7777/oiddas

    Log in as the orcladmin user.

  2. Click the Directory tab. Click the Users subtab.

    The Users page appears.

  3. Enter part of the enterprise user's user name (login name) or e-mail address in the Search field. Click Go.

    A list of all users who match your search criteria displays.

  4. Select the user for whom you wish to create a new password. Click Edit.

    The Edit User page appears.

  5. Enter the new password in the Password field. Confirm the password in the Confirm Password field. Click Submit.

5.2.3 Granting Enterprise Roles to Enterprise Users

Enterprise roles are directory objects that allow you to group global roles from various databases. You can assign enterprise roles to enterprise users, which gives them privileges across enterprise databases.

To grant enterprise roles to enterprise users:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure Enterprise Users.

    The Configure Enterprise Users page appears.

  5. Select the Search Base in which the enterprise user is located. The search base is the subtree which contains the enterprise user entry. You can optionally enter the common name of the enterprise user in the Name field. Select User in the View box. Click Go.

    A list of users with matching criteria appears.

  6. Select the enterprise user that you wish to configure. Click Configure.

    The Configure User page appears.

  7. Click the Enterprise Roles tab.

  8. Click Grant.

    The Select Enterprise Roles window appears.

  9. Select the enterprise role that you wish to grant. Click Select.

  10. Click OK in the Configure User page.

5.2.4 Granting Proxy Permissions to Enterprise Users

Proxy permissions allow an enterprise user to proxy a local database user, which means that the enterprise user can log in to the database as the local database user. You can grant proxy permissions to individual users or groups. Proxy permissions are especially useful for middle tier applications that operate across multiple databases as enterprise users.

Proxy permissions are created at the enterprise domain level. After creating a proxy permission for an enterprise domain, you can grant it to an enterprise user.

To grant proxy permissions to enterprise users:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure Enterprise Users.

    The Configure Enterprise Users page appears.

  5. Select the Search Base in which the enterprise user is located. The search base is the subtree which contains the enterprise user entry. You can optionally enter the common name of the enterprise user in the Name field. Select User in the View box. Click Go.

    A list of users with matching criteria appears.

  6. Select the enterprise user that you wish to configure. Click Configure.

    The Configure User page appears.

  7. Click the Proxy Permissions tab.

  8. Click Grant.

    The Select Proxy Permissions window appears.

  9. Select the Proxy Permission to be granted. The proxy permission must have already been created for the enterprise domain. Click Select.

  10. Click OK in the Configure User page.

5.2.5 Creating User-Schema Mappings for Enterprise Users

A user-schema mapping maps an enterprise user to a global database schema. When the enterprise user logs in to the database, he is connected to the mapped schema, by default.

To create a user-schema mapping:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure Enterprise Users.

    The Configure Enterprise Users page appears.

  5. Select the Search Base in which the enterprise user is located. The search base is the subtree which contains the enterprise user entry. You can optionally enter the common name of the enterprise user in the Name field. Select User in the View box. Click Go.

    A list of users with matching criteria appears.

  6. Select the enterprise user that you wish to configure. Click Configure.

    The Configure User page appears.

  7. Click the User-Schema Mappings tab. All user-schema maps that apply to the user directly or indirectly are displayed.

    A user can be individually mapped to a schema. Alternatively, you can map a directory subtree containing multiple users to the database schema.

  8. Click Create.

    The Create Mapping page is displayed.

  9. Under the From section, select Users to map an individual enterprise user to a database schema. Alternatively, select Subtree to map a directory subtree containing multiple users.

  10. Under To, select Database to map to a database schema. Select Domain to map to a schema common to all databases in the enterprise domain.

    You can have multiple databases in an enterprise domain that have a common schema name. When you map an enterprise user to such a schema, the enterprise user is automatically mapped to the individual schemas in each database contained in the domain.

  11. If you selected Database in the preceding step, then select the name of the database that contains the schema. Next, enter the database schema name. You can also use the search icon to select the schema. You will be required to log in to the database to select the schema.

    If you selected Domain in the preceding step, then select the name of the domain and enter the common schema name in the Schema field.

  12. Click Continue in the Create Mapping page.

  13. Click OK in the Configure User page.

5.2.6 Creating Label Authorizations for Enterprise Users

An Oracle Label Security (OLS) policy stored in the directory can have multiple profiles associated with it. Each profile is a set of policy authorizations and privileges. These policy authorizations and privileges apply to all enterprise users who belong to the profile. You can assign a profile to an enterprise user.

To assign label authorizations to an enterprise user:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure Enterprise Users.

    The Configure Enterprise Users pag${ۄe appears.

  5. Select the Search Base in which the enterprise user is located. The search base is the subtree which contains the enterprise user entry. You can optionally enter the common name of the enterprise user in the Name field. Select User in the View box. Click Go.

    A list of users with matching criteria appears.

  6. Select the enterprise user that you wish to configure. Click Configure.

    The Configure User page appears.

  7. Click the Label Authorizations tab.

    A list of all user profiles associated with the user is displayed.

  8. Click Add.

    The Select User Profile window appears.

  9. Select the user profiles that you want the user to be added to, and click Select. You can only select one profile per policy.

  10. Click OK in the Configure User page.

5.3 Configuring User-Defined Enterprise Groups

User-defined enterprise groups help group together enterprise users that require the same roles or privileges across enterprise databases. Enterprise groups are stored in the directory.

5.3.1 Granting Enterprise Roles to User-Defined Enterprise Groups

Enterprise roles are directory objects that allow you to group global roles from various databases. You can assign an enterprise role to an enterprise group, which gives the group members privileges across enterprise databases.

To grant an enterprise role to an enterprise group:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure User Defined Enterprise Groups.

    The Configure Enterprise Groups page appears.

  5. Select the Search Base in which the enterprise group is located. The search base is the subtree which contains the enterprise group entry. Optionally, enter the common name of the enterprise group in the Name field. Select Group in the View box. Click Go.

    A list of groups with matching criteria appears.

  6. Select the enterprise group that you wish to configure. Click Configure.

    The Configure Group page appears.

  7. Click the Enterprise Roles tab.

    A list of enterprise roles granted to the enterprise group is displayed.

  8. Click Grant to grant a new enterprise role to the group.

    The Select Enterprise Roles window appears.

  9. Select the enterprise roles that you wish to grant. Click Select.

  10. Click OK in the Configure Group page.

5.4 Configuring Databases for Enterprise User Security

Enterprise User Security for databases registered with Oracle Internet Directory can be configured using Enterprise Manager. You can map users or subtrees to database schemas. You can also configure administrators in the directory that can modify schema mappings and enterprise domain membership of the database.

5.4.1 Creating User-Schema Mappings for a Database

A user-schema mapping maps an enterprise user to a global schema in the database. When the enterprise user logs in to the database, he is connected to the mapped schema, by default.

To create a user-schema mapping:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure Databases.

    The Configure Databases page appears. A list of databases registered in the identity management realm is displayed.

  5. Select the database name. Click Configure.

    The Configure Database page appears.

  6. Click the User-Schema Mappings tab. All user-schema maps created at the database level are displayed. User-schema maps created at the enterprise domain levels are not displayed here.

  7. Click Create to create a new user-schema mapping for the database.

    The Create Mapping page is displayed.

  8. Under the From section, select Users to map an individual enterprise user to a database schema. Alternatively, select Subtree to map a directory subtree containing multiple users. You can use the Search icon to search for the appropriate user or subtree.

  9. Under the To section, enter the name of the Schema to which the user or subtree should be mapped. You can use the search icon to search for the appropriate schema in the database. You will be required to log in to the database to access the schema names.

  10. Click Continue in the Create Mapping page.

  11. Click OK in the Configure Database page.

5.4.2 Adding Administrators to Manage Database Schema Mappings

Directory users who are authorized to manage database schema mappings for a database can create or delete database schema mappings for the database.

To add administrators for managing database schema mappings:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Configure Databases.

    The Configure Databases page appears. A list of databases registered in the identity management realm is displayed.

  5. Select the database name. Click Configure.

    The Configure Database page appears.

  6. Click the Administrators tab. A list of administrators who can manage database schema mappings is displayed.

  7. Click Add to add an administrator.

    The Select Users window appears.

  8. Select the Search Base. The Search Base is the directory subtree that you wish to search for locating the user. Click Go.

  9. Select the user that you wish to add as an administrator. Click Select.

    The user is added in the Configure Database page.

  10. If you want the user to be able to add or remove other administrators, then select the Admin Group Owner check box corresponding to the added user.

  11. Click OK.

5.5 Administering Enterprise Domains

Enterprise Domains are groups of databases that can share enterprise roles, proxy permissions, user-schema mappings, current user database links, and permitted authentication mechanisms. A database can belong to only one enterprise domain.

An enterprise domain can be thought of as an administrative domain, administered by the Domain Admins group for that domain. These administrators can add databases to the enterprise domain.

An identity management realm contains an enterprise domain called OracleDefaultDomain. OracleDefaultDomain is part of the realm when it is first created in the directory. When a new database is registered into a realm, it automatically becomes a member of OracleDefaultDomain in that realm. You can create and remove your own enterprise domains, but you must not remove OracleDefaultDomain from a realm.

This section describes how to use Oracle Enterprise Manager to administer enterprise domains in the directory. It contains the following topics:

5.5.1 Creating an Enterprise Domain

An enterprise domain is an administrative domain of databases that can share enterprise roles, proxy permissions, user-schema mappings, current user database links, and permitted authentication mechanisms.

If you do not want to use OracleDefaultDomain, then you can create a new enterprise domain in your identity management realm.

To create an enterprise domain:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Click Create to create a new enterprise domain.

    The Create Domain page appears.

  6. Enter the name for the new enterprise domain in the Name field. Click OK.

    The new enterprise domain is added to the list of enterprise domains in the Enterprise Domains page.

5.5.2 Adding Databases to an Enterprise Domain

A member of the Domain Admins group can add databases to the enterprise domain. You can add databases to an enterprise domain from the Configure Domain page. You can also add databases from the Create Domain page, if you are creating a new enterprise domain.


Note:

The following restrictions apply to adding databases to an enterprise domain:

  • You can add a database to an enterprise domain only if both the database and the enterprise domain exist in the same realm.

  • A database cannot be added as a member of two different enterprise domains.


To add databases to an enterprise domain:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Make sure that the Databases tab is selected. Click Add to add new databases to the enterprise domain.

    The Select Databases page appears. A list of databases, that are registered with the identity management realm, is displayed. You can add a database only if it is not part of any other enterprise domain.

  7. Select the databases to add. Click Select.

  8. Click OK in the Configure Domain page.

5.5.3 Creating User-Schema Mappings for an Enterprise Domain

A user-schema mapping maps an enterprise user to a global schema in the database. When the enterprise user logs in to the database, he is connected to the mapped schema, by default.

When you create a user-schema mapping for an enterprise domain, it applies to all databases in the domain. However, for the mapping to be effective in a database, that database must have a schema with the name used in the mapping.

To create a user-schema mapping for an enterprise domain:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the User-Schema Mappings tab. All user-schema maps created at the domain level are displayed. User-schema maps created at database levels are not displayed here.

  7. Click Create to create a new user-schema mapping for the domain.

    The Create Mapping page is displayed.

  8. Under the From section, select Users to map an individual enterprise user to a database schema. Alternatively, select Subtree to map a directory subtree containing multiple users. You can use the Search icon to search for the appropriate user or subtree.

  9. Under the To section, enter the name of the Schema to which the user or subtree should be mapped.

  10. Click Continue in the Create Mapping page.

  11. Click OK in the Configure Domain page.

5.5.4 Configuring Enterprise Roles

An enterprise domain within an identity management realm can contain multiple enterprise roles. An enterprise role is a set of Oracle role-based authorizations across one or more databases in an enterprise domain.

Enterprise roles allow you to group global roles from different databases that are part of the enterprise domain. Enterprise roles can be assigned to enterprise users.

To create enterprise roles:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the Enterprise Roles tab.

  7. Click Create to create a new enterprise role.

    The Create Enterprise Role page appears.

  8. Enter a name for the enterprise role in the Name field. Click Continue.

    The new role is displayed in the Configure Domain page.

Next, you can configure the enterprise role that you just created. Configuring an enterprise role includes adding database global roles to the enterprise role and assigning the enterprise role to enterprise users or groups.

To add database global roles to the enterprise role:

  1. Select the enterprise role that you just created in the Configure Domain page. Click Edit.

    The Edit Enterprise Role page is displayed.

  2. Make sure that the DB Global Roles tab is selected. Click Add to add global roles from databases that are part of the enterprise domain.

    The Search and Select Database Global Roles page appears.

  3. Select the Database that contains the global roles you wish to add. Log in to the selected database by supplying a User Name and Password. Click Go.

  4. Select the global roles to add. Click Select.

    The selected roles appear in the Edit Enterprise Role page.

  5. Repeat steps 2 to 4 for the other databases.

You can now assign the enterprise role to enterprise users or groups.

To assign the enterprise role to enterprise users or groups:

  1. Click the Grantees tab in the Edit Enterprise Role page.

  2. Click Add.

    The Select Users or Groups page is displayed.

  3. Select the Search Base or the subtree that contains the user or group. Select User under View if you are granting the enterprise role to a user. Select Group under View, if you are granting the role to a group. Optionally, enter the common name of the user or group in the Name field. Click Go.

  4. Select the users or groups to be granted the enterprise role. Click Select.

  5. Click Continue in the Edit Enterprise Role page.

  6. Click OK in the Configure Domain page.

5.5.5 Configuring Proxy Permissions

Proxy permissions are created at the enterprise domain level. Proxy permissions allow an enterprise user to proxy a local database user, which means that the enterprise user can log in to the database as the local database user. You can grant proxy permissions to individual enterprise users or groups. Proxy permissions are especially useful for middle tier applications that operate across multiple databases as enterprise users.

To create a proxy permission for an enterprise domain:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the Proxy Permissions tab.

  7. Click Create to create a new proxy permission.

    The Create Proxy Permission page appears.

  8. Enter the name for the proxy permission in the Name field. Click Continue.

    The proxy permission appears in the Configure Domain page.

Next, you need to add target database users for the permission. You also need to grant the permission to enterprise users or groups, who can then proxy the target database users.

To add target database users for the proxy permission:

  1. Select the proxy permission that you just created in the Configure Domain page. Click Edit.

    The Edit Proxy Permissions page appears.

  2. Ensure that the Target DB Users tab is selected. Click Add.

    The Search and Select window appears. A list of all database users that have been altered to allow enterprise user proxy is displayed.

  3. Select the target database users that you wish to proxy. Click Select.

You can now grant the proxy permission to enterprise users or groups.

To grant the proxy permission to an enterprise user or group:

  1. Click the Grantees tab in the Edit Proxy Permission page.

  2. Click Add.

    The Select Users or Groups window appears.

  3. Select the Search Base or the subtree that contains the user or group. Select User under View if you are granting the proxy permission to a user. Select Group under View, if you are granting the proxy permission to a group. Optionally, enter the common name of the user or group in the Name field. Click Go.

  4. Select the Users or Groups to grant them the proxy permission. Click Select.

  5. Click Continue in the Edit Proxy Permission page.

  6. Click OK in the Configure Domain page.

5.5.6 Configuring User Authentication Types and Enabling Current User Database Links

Enterprise users can be authenticated using password authentication, SSL authentication, or Kerberos authentication. You can set the authentication modes that are allowed for an enterprise domain using Enterprise Manager. You can also enable current user database links for databases in the enterprise domain. These links enable databases to trust each other to authenticate users.

To configure user authentication types and enable current user database links:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the Configuration tab.

  7. Under User Authentication Types Accepted, select the authentication types that you want to allow.

  8. If you wish to enable current user database links for the domain, then select Enable Current User Database Links in this domain.

  9. Click OK.

5.5.7 Configuring Domain Administrators

Domain administrators have full privileges in the domain. They can add or remove databases to the domain, create user-schema mappings, manage proxy permissions and modify domain configuration settings. You can add or remove domain administrators from Enterprise Manager.

To add an enterprise domain administrator:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the Administrators tab. A list of administrators for the enterprise domain is displayed.

  7. Click Add to add an administrator.

    The Select Users window appears.

  8. Select the Search Base. The Search Base is the directory subtree that you wish to search for locating the user. Click Go.

  9. Select the user that you wish to add as an administrator. Click Select.

    The user is added in the Configure Domain page.

  10. If you want the user to be able to add or remove other administrators, then select the Admin Group Owner check box corresponding to the added user.

  11. Click OK.

PKӵ.$PK&AOEBPS/appb.htmt SSL External Users Conversion Script

B SSL External Users Conversion Script

You should run the SSL external users conversion script after upgrading to Oracle Database 11g Release 2 (11.2), in case you were using SSL-authenticated external users in a pre-Oracle Database 10g Release 2 (10.2) release. The script converts SSL-authenticated external users in pre-Oracle Database 10g Release 2 (10.2) releases into SSL-authenticated external users in Oracle Database 11g Release 2 (11.2).


Note:

The SSL external users conversion script needs to be run only if you have upgraded from a pre-Oracle Database 10g Release 2 (10.2) release.

This chapter covers the following topics:

B.1 Using the SSL External Users Conversion Script

The SSL external users conversion script has the following syntax:

$ORACLE_HOME/rdbms/bin/extusrupgrade
--dbconnectstring database connect string
--dbuser database user
--dbuserpassword database user password
[-a]
[-l username1,username2,...]
[-f filename]
[-o]
[-h]

The database connect string should be in the format hostname:port_no:sid, where hostname is the name of the host on which the database is running, port_no is the listener port number and sid is the system identifier for the database instance.

Use the -a option to convert all SSL-authenticated external users. Here is an example:

extusrupgrade --dbconnectstring mymachine:1521:11gR2 --dbuser system --dbuserpassword manager -a

Use the -l option to specify a comma-delimited list of users to be converted. For example:

extusrupgrade --dbconnectstring mymachine:1521:11gR2 --dbuser system --dbuserpassword manager -l user1,user2,user3

Use the -f option to specify a file that has the list of users to be converted. For example:

extusrupgrade --dbconnectstring mymachine:1521:11gR2 --dbuser system --dbuserpassword manager -f usernames.txt

There should be one user name in each line in the specified file. Here is a sample usernames.txt file:

user#1
user>2
user,3
user4
user5

You must use the -f option to convert users who have special characters (such as #) in their user names.


Note:

You can combine the -l and -f options in the same command. The script combines the list of users from both the -l and -f options. If you use the -a option along with the -l option and the -f option, then the -a option is ignored.

You can use the -o option to print a list of SSL-authenticated external users to the standard output device. The output lists the users you can convert using the extusrupgrade script. The -o option cannot be combined with any other option.

extusrupgrade --dbconnectstring mymachine:1521:11gR2 --dbuser system --dbuserpassword manager -o

A sample output for this could be:

user1
user2
user3

Tip:

You can redirect the command output to a file to get a list of users who can be converted. You can then edit the file and use it with the -f option.

B.2 Converting Global Users into External Users

Oracle Database 10g and later allows SSL-authenticated external users and SSL-authenticated global users to coexist in the database. Previous releases had the restriction that all SSL users must be either global users or external users, depending on whether Oracle Internet Directory is being used or not for authenticating the users.

If you want a user to be able to connect to the database even when Oracle Internet Directory is not available, then the user should be configured as an external user. You can convert SSL-authenticated global users into SSL-authenticated external users by using the SSL external users conversion script.

For example:

extusrupgrade --dbconnectstring mymachine:1521:11gR2 --dbuser system --dbuserpassword manager -l user1,user2

The preceding example converts two global users into external users.

PKLUvytPK&AOEBPS/getstrtd.htmw- Getting Started with Enterprise User Security

2 Getting Started with Enterprise User Security

Enterprise User Security enables you to centrally manage database users across the enterprise. Enterprise users are created in Oracle Internet Directory, and can be assigned roles and privileges across various enterprise databases registered with the directory.

This chapter uses a tutorial approach to help you get started with Enterprise User Security. The following steps discuss configuring Enterprise User Security:

  1. Configuring Your Database to Use the Directory

  2. Registering Your Database with the Directory

  3. Creating a Shared Schema in the Database

  4. Mapping Enterprise Users to the Shared Schema

  5. Connecting to the Database as an Enterprise User

  6. Using Enterprise Roles

  7. Using Proxy Permissions

2.1 Configuring Your Database to Use the Directory

The first step in configuring Enterprise User Security is to configure the database to use the directory. Running the Net Configuration Assistant (NetCA) tool enables you to configure the directory host name and port that your database should use.

To configure your database for directory usage:

  1. Start NetCA using the netca command.

    • On Windows, you can also start NetCA from the Start menu:

      Click Start, All Programs, Oracle - OracleHomeName, Configuration and Migration Tools, Net Configuration Assistant.

    • On Unix systems, you can start NetCA using the following command:

      $ORACLE_HOME/bin/netca

    The Welcome screen appears.

    Description of netca1.gif follows
    Description of the illustration netca1.gif

  2. Select Directory Usage Configuration. Click Next.

    The Directory Type screen appears.

    Description of netca2.gif follows
    Description of the illustration netca2.gif

  3. Click Next.

    The Directory Location screen appears.

    Description of netca3.gif follows
    Description of the illustration netca3.gif

  4. Enter the name of the host on which the Oracle Internet Directory server is running. Also enter the LDAP non-SSL and SSL port numbers. These port numbers are 389 and 636 by default. Click Next.

    The Select Oracle Context screen appears.

    Description of netca4.gif follows
    Description of the illustration netca4.gif

  5. Select the default Oracle Context to use. You need to select this if there are multiple identity management realms on the directory server. Click Next.

    The Directory Usage Configuration, Done screen is displayed.

  6. Confirm that the directory usage configuration is successfully completed. Click Next.

  7. Click Finish.

    NetCA creates an ldap.ora file in the $ORACLE_HOME/network/admin directory. This is the $ORACLE_HOME\network\admin directory in Windows. The ldap.ora file stores the connection information details about the directory.

2.2 Registering Your Database with the Directory

The next step is to register the database with the directory service. The Database Configuration Assistant (DBCA) tool enables you to register the database with Oracle Internet Directory.

To register the database with the directory:

  1. Start DBCA using the dbca command.

    • On Windows, you can also start DBCA from the Start menu:

      Click Start, All Programs, Oracle - OracleHomeName, Configuration and Migration Tools, Database Configuration Assistant.

    • On Unix systems, you can start DBCA using the following command:

      $ORACLE_HOME/bin/dbca

    The Welcome screen appears.

  2. Click Next.

    The Operations screen is displayed.

    Description of dbca2.gif follows
    Description of the illustration dbca2.gif

  3. Select Configure Database Options. Click Next.

    The Database screen appears.

  4. Select the database name that you wish to configure. You might also be asked to enter SYS user credentials if you are not using operating system authentication. Click Next.

    The Management Options screen appears.

  5. Select Keep the database configured with Database Control if you want to continue using Database Control to manage the database. You also have the option of using Grid Control to manage the database. Click Next.

    The Security Settings screen appears.

  6. Select Keep the enhanced 11g default security settings to keep the 11g security settings. Click Next.

    The Network Configuration screen appears.

    Description of dbca6.gif follows
    Description of the illustration dbca6.gif

  7. Select Yes, register the database to register the database with the directory. Enter the distinguished name (DN) of a user who is authorized to register databases in Oracle Internet Directory. Also, enter the password for the directory user. Enter a wallet password. Reenter the password in the Confirm Password field. Click Next.


    Note:

    The database uses a randomly generated password to log in to the directory. This database password is stored in an Oracle wallet. The wallet can also be used to store certificates needed for SSL connections.

    The wallet password that you specify is different from the database password. The wallet password is used to protect the wallet.


    The Database Components screen appears.

  8. Click Next.

    The Connection Mode page appears.

  9. Select Dedicated Server Mode or Shared Server Mode. Click Finish.

    The Confirmation dialog box appears.

  10. Click OK.


Note:

After you register the database with the directory, make sure that auto login is enabled for the database wallet. The default wallet is created in the $ORACLE_BASE/admin/database_sid/wallet directory.

You can verify that auto login for the wallet is enabled by checking for the presence of the cwallet.sso file in the wallet directory. If the file is not present, you can enable auto login by opening the wallet using Oracle Wallet Manager, and using the option to enable auto login for the wallet.


2.3 Creating a Shared Schema in the Database

Creating a shared schema in the database enables you to map multiple enterprise users to the same schema. Example 2-1creates a shared schema, global_ident_schema_user, and grants the CONNECT role to it.

Example 2-1 Creating a Shared Schema

SQL> CREATE USER global_ident_schema_user IDENTIFIED GLOBALLY;
User created.
SQL> GRANT CONNECT TO global_ident_schema_user;
Grant succeeded.

2.4 Mapping Enterprise Users to the Shared Schema

Enterprise User Security can be managed using Enterprise Manager. Example 2-2 maps the DN, cn=users, dc=us, dc=oracle, dc=com to the shared database schema, global_ident_schema_user.

Example 2-2 Mapping Enterprise Users to the Shared Schema

To create the user-schema mapping:

  1. Log in to Enterprise Manager.

    Description of getstrtd1.gif follows
    Description of the illustration getstrtd1.gif

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

    Description of getstrtd2.gif follows
    Description of the illustration getstrtd2.gif

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

    Description of getstrtd3.gif follows
    Description of the illustration getstrtd3.gif

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears.

    Description of getstrtd4.gif follows
    Description of the illustration getstrtd4.gif

  5. Select the enterprise domain which contains the database. Click Configure.

    The Configure Domain page appears.

  6. Click the User-Schema Mappings tab. All user-schema maps that apply to the enterprise domain are displayed.

  7. Click Create.

    The Create Mapping page is displayed.

    Description of getstrtd5.gif follows
    Description of the illustration getstrtd5.gif

  8. Under the From section, select Subtree. Click the Search icon. Select the DN, cn=Users, dc=us,dc=oracle,dc=com.

  9. Under the To section, enter global_ident_schema_user in the Schema field. Click Continue.

    The user-schema mapping is added in the Configure Domain page.

    Description of getstrtd6.gif follows
    Description of the illustration getstrtd6.gif

  10. Click OK.

2.5 Connecting to the Database as an Enterprise User

All users in the mapped Oracle Internet Directory subtree can now connect to the database as enterprise users. Example 2-3 shows the cn=orcladmin, cn=users, dc=us,dc=oracle,dc=com user connecting to the database.

Example 2-3 Connecting to the Database as an Enterprise User

SQL> CONNECT orcladmin
Enter password:
Connected.

2.6 Using Enterprise Roles

Enterprise roles are created in the directory. Enterprise roles contain global roles from different databases that are part of the enterprise domain. Enterprise roles are used to assign database privileges to enterprise users.

Example 2-4 creates two enterprise users, Joe and Nina. Both these users are created in the subtree, cn=Users, dc=us,dc=oracle,dc=com, which is already mapped to the global_ident_schema_user in the EUSDB database.

Nina is an HR manager. She needs the SELECT privilege on the hr.employees table in the EUSDB database. Example 2-4 achieves this using enterprise roles.

Example 2-4 Using Enterprise Roles

We start by creating two enterprise users, Joe and Nina. You can create enterprise users using the Oracle Internet Directory Self Service Console.

To create enterprise users, Joe and Nina:

  1. Connect to the Oracle Internet Directory Self Service Console. Use the following URL:

    http://hostname:port/oiddas/

    Here, hostname is the name of the host that is running the Oracle Internet Directory server. The port number is the TCP port number on which the Oracle Internet Directory Self Service Console is running. This is 7777 by default.

    Description of getstrtd7.gif follows
    Description of the illustration getstrtd7.gif

  2. Click the Directory tab.

    The Sign In page appears.

    Description of getstrtd8.gif follows
    Description of the illustration getstrtd8.gif

  3. Log in as the user that can create users in Oracle Internet Directory.

    The User page appears.

  4. Click Create.

    The Create User page appears.

    Description of getstrtd9.gif follows
    Description of the illustration getstrtd9.gif

  5. Enter joe under User Name. Enter values for the other required fields. Select Enabled under Is Enabled.

  6. Click Submit.

  7. Click Create Another User.

    The Create User page appears.

  8. Enter Nina under User Name. Enter values for the other required fields. Select Enabled under Is Enabled.

  9. Click Submit. Click OK.

Next, we create a global role in the database that allows access to the hr.employees table. The following SQL*Plus statements create a global role, hr_access and grant the necessary privilege to it.

SQL> CREATE ROLE hr_access IDENTIFIED GLOBALLY;
Role created.
SQL> GRANT SELECT ON hr.employees TO hr_access;
Grant succeeded.

Next, we create an enterprise role called hr_access and assign the global role to it. We then assign this enterprise role to the enterprise user, Nina. The enterprise role can be created using Enterprise Manager.

To create the enterprise role, hr_access:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that contains the database. Click Configure.

    The Configure Domain page appears.

  6. Click the Enterprise Roles tab.

  7. Click Create.

    The Create Enterprise Role page appears.

  8. Enter hr_access in the Name field.

    Description of getstrtd11.gif follows
    Description of the illustration getstrtd11.gif

  9. Click Add to add the database global role to the enterprise role.

    The Search and Select Database Global Roles window is displayed.

    Description of getstrtd12.gif follows
    Description of the illustration getstrtd12.gif

  10. Select the hr_access global role in your database. Click Select.


    Note:

    You will be required to log in to the database before you can select the global role.

  11. Click the Grantees tab. Click Add.

    The Select Users or Groups window appears.

  12. Select user Nina. Click Select.

    Description of getstrtd10.gif follows
    Description of the illustration getstrtd10.gif

  13. Click Continue in the Create Enterprise Role page.

  14. Click OK in the Configure Domain page.

The enterprise user, Nina can now access the hr.employees table in the database. The following SQL*Plus statements illustrate this:

SQL> CONNECT Nina
Enter password:
Connected.
SQL> SELECT employee_id FROM hr.employees;
EMPLOYEE_ID
-----------
        100
        101
        102
...
...
107 rows selected.

The enterprise user, Joe cannot access the hr.employees table, as he does not have the enterprise role assigned to him.

SQL> CONNECT joe
Enter password:
Connected.
SQL> SELECT employee_id FROM hr.employees;
SELECT employee_id FROM hr.employees

ERROR at line 1:
ORA-00942: table or view does not exist

2.7 Using Proxy Permissions

Proxy permissions are created at the enterprise domain level. Proxy permissions allow an enterprise user to proxy a local database user, which means that the enterprise user can log in to the database as the local database user. You can grant proxy permissions to individual enterprise users or groups. Proxy permissions are especially useful for middle-tier applications that operate across multiple databases as enterprise users.

Example 2-5 illustrates the use of proxy permissions. The enterprise user, joe is a sales manager and needs to log in to enterprise databases as the target database user, SH. The SH user owns the sample SH schema that contains Sales History related tables.

Example 2-5 Using Proxy Permissions

The first step in allowing enterprise user proxy is to ALTER the target database user to allow CONNECT through enterprise users. The following SQL statements unlock the SH database account, set a password for it, and ALTER the account to allow enterprise user proxy:

SQL> CONNECT SYSTEM
Enter password:
Connected.
SQL> ALTER USER SH IDENTIFIED BY hrd2guess ACCOUNT UNLOCK;
User altered.
SQL> ALTER USER SH GRANT CONNECT THROUGH ENTERPRISE USERS;
User altered.

Next, use Enterprise Manager to configure the proxy permission. This allows the enterprise user joe to connect as the local database user, SH.

To configure the proxy permission for enterprise user, joe:

  1. Log in to Enterprise Manager.

  2. Click the Server tab. Under the Security section, click Enterprise User Security.

    The Oracle Internet Directory Login page appears.

  3. Enter the distinguished name (DN) of a directory user who can administer enterprise users in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

  4. Click Manage Enterprise Domains.

    The Manage Enterprise Domains page appears. This page lists the enterprise domains in the identity management realm.

  5. Select the enterprise domain that you wish to configure. Click Configure.

    The Configure Domain page appears.

  6. Click the Proxy Permissions tab.

    Description of getstrtd13.gif follows
    Description of the illustration getstrtd13.gif

  7. Click Create to create a new proxy permission.

    The Create Proxy Permission page appears.

  8. Enter SH_Proxy, as the name of the proxy permission, in the Name field.

    Description of getstrtd14.gif follows
    Description of the illustration getstrtd14.gif

  9. Ensure that the Target DB Users tab is selected. Click Add.

    The Search and Select window appears.

  10. Log in to the database that contains the SH user. A list of all database users that have been altered to allow enterprise user proxy is displayed.

  11. Select the SH user. Click Select.

    The SH user is added under Target DB Users in the Create Proxy Permission page.

    Description of getstrtd15.gif follows
    Description of the illustration getstrtd15.gif

  12. Click the Grantees tab.

  13. Click Add.

    The Select Users or Groups window appears.

  14. Select cn=users,dc=us,dc=oracle,dc=com under Search Base. Select User under View. Click Go.

    A list of users under the subtree, cn=users,dc=us,dc=oracle,dc=com is displayed.

    Description of getstrtd16.gif follows
    Description of the illustration getstrtd16.gif

  15. Select cn=joe,cn=users,dc=us,dc=oracle,dc=com. Click Select.

    The user joe is added under Grantees in the Create Proxy Permission page.

    Description of getstrtd17.gif follows
    Description of the illustration getstrtd17.gif

  16. Click Continue in the Create Proxy Permission page.

    The proxy permission, SH_Proxy is added in the Configure Domain page.

    Description of getstrtd18.gif follows
    Description of the illustration getstrtd18.gif

  17. Click OK.

The enterprise user, joe can now log in as the local database user SH. The following SQL statements illustrate this:

SQL> REMARK Joe uses his own password to connect as the local database user, SH.
SQL> CONNECT joe[SH]
Enter password:
Connected.
SQL> SELECT * FROM SH.sales WHERE cust_id=4;

   PROD_ID    CUST_ID TIME_ID   CHANNEL_ID   PROMO_ID QUANTITY_SOLD AMOUNT_SOLD
---------- ---------- --------- ---------- ---------- ------------- -----------
        37          4 31-MAY-00          3        999             1       60.43
        39          4 31-MAY-00          3        999             1       38.45
        40          4 31-MAY-00          3        999             1        48.1
...
...
72 rows selected.
PK+wwPK&AOEBPS/toolover.htm Configuration and Administration Tools Overview

3 Configuration and Administration Tools Overview

Configuring Enterprise User Security for an Oracle database primarily involves creating directory objects to store enterprise user and database information. For some implementations, it can also require creating special network configuration files (ldap.ora) that enable your databases to locate the correct directory server on the network.

While Oracle Enterprise Manager is your primary tool for both configuring Enterprise User Security and for administration tasks, this chapter introduces all the available tools, in the following topics:

3.1 Enterprise User Security Tools Overview

Enterprise users are database users whose identities are stored and centrally managed in an LDAP directory, such as Oracle Internet Directory. Table 3-1 provides a summary of Enterprise User Security configuration and management tasks and the tools to complete them. The tool names are links to sections that describe them.

Table 3-1 Enterprise User Security Tasks and Tools Summary

TaskTools

Create users and manage their passwords

Oracle Internet Directory Self-Service Console


Configure databases Oracle home for directory usage over the network

Oracle Net Configuration Assistant


Register and un-register databases in Oracle Internet Directory

Database Configuration Assistant


Manage Oracle wallets for Enterprise User Security

Oracle Wallet Manager


  • Configure enterprise domains and databases in Oracle Internet Directory including mappings, roles and proxy permissions

  • Manage identity management realm attributes and administrative groups that pertain to Enterprise User Security in Oracle Internet Directory

Oracle Enterprise Manager


Manage identity management realms in Oracle Internet Directory

For information about this tool and realms, refer to Oracle Identity Management Guide to Delegated Administration.

Oracle Internet Directory Self-Service Console


Perform bulk migrations of database users to Oracle Internet Directory

User Migration Utility



3.2 Oracle Internet Directory Self-Service Console

Oracle Internet Directory Self-Service Console is a tool based on Delegated Administration Services. This is a self service application that allows administrated access to the applications data managed in the directory. This tool comes ready to use with Oracle Internet Directory.

The Oracle Identity Management Guide to Delegated Administration discusses Delegated Administration Services and the Oracle Internet Directory Self-Service Console tool.

3.3 Oracle Net Configuration Assistant

Oracle Net Configuration Assistant is a wizard-based tool with a graphical user interface. Its primary uses are to configure basic Oracle Net network components, such as listener names and protocol addresses, and to configure your Oracle home for directory server usage. The latter use is what makes this tool important for configuring Enterprise User Security.

If you use Domain Name System (DNS) discovery (automatic domain name lookup) to locate Oracle Internet Directory on your network, then this assistant is not necessary. Note that using DNS discovery is the recommended configuration. See Oracle Internet Directory Administrator's Guide for information about this configuration.

Before you can register a database with the directory, you must do either one of the following two tasks:

  • Configure DNS discovery of Oracle Internet Directory on your network.


    See Also:

    Oracle Internet Directory Administrator's Guide for information about DNS server discovery

  • If DNS discovery is not configured on your network, then use Oracle Net Configuration Assistant to create an ldap.ora file for your Oracle home.

Your database initially uses the ldap.ora file to locate the correct Oracle Internet Directory server on your network. This configuration file contains the hostname, port number, and identity management realm information for your directory server.

Once database registration is complete, the realm is ascertained through the database DN stored in the database wallet.

3.3.1 Starting Oracle Net Configuration Assistant

To start Oracle Net Configuration Assistant:

  • (UNIX) From $ORACLE_HOME/bin, enter the following at the command line:

    netca

  • (Windows) Choose Start, Programs, Oracle-HOME_NAME, Configuration and Migration Tools, Net Configuration Assistant

After you start this tool, you will be presented with the opening page shown in Figure 3-1.

Choose the Directory Usage Configuration option on this page, click Next, and choose the directory server where you wish to store your enterprise users. Then, click Finish to create a properly configured ldap.ora file for your Oracle home.

Figure 3-1 Opening Page of Oracle Net Configuration Assistant

Description of Figure 3-1 follows
Description of "Figure 3-1 Opening Page of Oracle Net Configuration Assistant"


See Also:


3.4 Database Configuration Assistant

Database Configuration Assistant is a wizard-based tool used to create and configure Oracle databases.

Use Database Configuration Assistant to register a database with the directory. In that process, Database Configuration Assistant creates a distinguished name (DN) for the database and the corresponding entry and subtree in Oracle Internet Directory.

3.4.1 Starting Database Configuration Assistant

To start Database Configuration Assistant:

3.5 Oracle Wallet Manager

Security administrators use Oracle Wallet Manager to manage public key security credentials on Oracle clients and servers. The wallets it creates can be read by Oracle Database, Oracle Application Server 10g, and the Oracle Identity Management infrastructure.

3.5.1 Starting Oracle Wallet Manager

To start Oracle Wallet Manager:

  • (Windows) Select Start, Programs, Oracle-HOME_NAME, Integrated Management Tools, Wallet Manager

  • (UNIX) At the command line, enter owm.

3.5.2 The orapki Command-Line Utility

The orapki command line utility enables administrators to manage wallets, certificate revocation lists, and other public key infrastructure (PKI) elements from the command line. It can be used inside scripts, enabling administrators to automate many routine PKI tasks. The orapki commands enable you to do the following tasks:

Table 3-2 Summary of orapki Commands

Object AffectedOperations Possible with orapki Commands

Certificate

Create or display

CRL (certificate revocation list)

Delete, display, hash, list, or upload

Wallet

Create, display, add, or export


3.6 Oracle Enterprise Manager

Enterprise User Security employs Oracle Enterprise Manager to administer enterprise users, administrative groups, enterprise domains, and enterprise roles stored in Oracle Internet Directory. You can use the Web-based user interface provided by Enterprise Manager Database Control or Enterprise Manager Grid Control to administer Enterprise User Security.

Enterprise users are users provisioned and managed centrally in an LDAP-compliant directory, such as Oracle Internet Directory, for database access. Enterprise domains are directory constructs containing databases, enterprise roles (the access privileges assigned to enterprise users), and proxy permissions (which enable enterprise users to connect to databases as other users).


See Also:

Chapter 1, "Introducing Enterprise User Security" for a discussion of Enterprise User Security administrative groups, enterprise domains, enterprise roles, enterprise users, shared schemas, and user-schema mappings

Use the following steps to access the Enterprise User Security link in Oracle Enterprise Manager Database Control or Grid Control:

  1. Enter the URL for Database Control or Grid Control in a browser window. For example:

    https://mydbhost:1158/em

  2. Log in as an administrative database user.

  3. Click the Server tab. Under the Security section, click Enterprise User Security.


    Note:

    If you are using Enterprise Manager Grid Control, then you would need to navigate to the target database page before you can access the Server tab for the database.

    The Oracle Internet Directory Login page appears.

  4. Enter the distinguished name (DN) of a directory user, who has administrative privileges for the identity management realm, in the User field. Enter the user password in the Password field. Click Login.

    The Enterprise User Security page appears.

3.7 User Migration Utility

User Migration Utility is a command-line tool that enables you to perform bulk migrations of database users to Oracle Internet Directory where they are stored and managed as enterprise users. This tool performs a bulk migration in two phases: In phase one, it populates a table with database user information. During phase two, the database user information is migrated to the directory.

This tool is automatically installed in the following location when you install an Oracle Database client:

$ORACLE_HOME/rdbms/bin/umu

The basic syntax for this utility is as follows:

umu parameter_keyword_1=value1:value2

parameter_keyword_2=value
parameter_keyword_3=value1:value2:value3
...
parameter_keyword_n=value

Note that when a parameter takes multiple values, they are separated with colons (:).


See Also:

Appendix A, "Using the User Migration Utility" for complete instructions (including usage examples) for using this tool to migrate database users to a directory

3.8 Duties of an Enterprise User Security Administrator/DBA

Enterprise User Security administrators plan, implement, and administer enterprise users. Table 3-3 lists the primary tasks of Enterprise User Security administrators, the tools used to perform the tasks, and the links to where the tasks are documented.

Table 3-3 Common Enterprise User Security Administrator Configuration and Administrative Tasks

TaskTools UsedSee Also

Create an identity management realm in Oracle Internet Directory

Oracle Internet Directory Self-Service Console (Delegated Administration Service)

Oracle Internet Directory Administrator's Guide for information about how to perform this task

Upgrade an identity management realm in Oracle Internet Directory

Oracle Internet Directory Configuration Assistant

Oracle Internet Directory Administrator's Guide and the online Help for this tool

Set up DNS to enable automatic discovery of Oracle Internet Directory over the network. Note that this is the recommended configuration.

Oracle Internet Directory Configuration Assistant

Oracle Internet Directory Administrator's Guide (Domain Name System server discovery) and the online Help for this tool

Create an ldap.ora file to enable directory access

Oracle Net Configuration Assistant

"Task 5: (Optional) Configure your Oracle home for directory usage"


Register a database in the directory

Database Configuration Assistant

"Task 6: Register the database in the directory"


Configure password authentication for Enterprise User Security

Oracle Enterprise Manager

"Configuring Enterprise User Security for Password Authentication"


Configure Kerberos authentication for Enterprise User Security

  • Oracle Internet Directory Self-Service Console (Delegated Administration Service)

  • Oracle Enterprise Manager

"Configuring Enterprise User Security for Kerberos Authentication"


Configure SSL authentication for Enterprise User Security

  • Oracle Net Manager

  • Oracle Enterprise Manager

  • Oracle Wallet Manager

"Configuring Enterprise User Security for SSL Authentication"


Create or modify user entries and Oracle administrative groups in the directory

Oracle Internet Directory Self-Service Console (Delegated Administration Service)

Create or modify enterprise roles and domains in the directory

Oracle Enterprise Manager

Create or modify wallets for directory, databases, and clients

  • Oracle Wallet Manager

  • orapki command line utility

Oracle Database Advanced Security Administrator's Guide:

Change a user's database or directory password

Oracle Internet Directory Self-Service Console (Delegated Administration Service)

"Setting Enterprise User Passwords"


Change a database's directory password

Database Configuration Assistant

"To change the database's directory password:"


Manage user wallets on the local system or update database and directory wallet passwords

Oracle Wallet Manager

Oracle Database Advanced Security Administrator's Guide


Request initial Kerberos ticket when KDC is not part of the operating system, such as Kerberos V5 from MIT

okinit utility

Oracle Database Advanced Security Administrator's Guide for information about using the okinit utility to get an initial Kerberos ticket

Migrate large numbers of local or external database users to the directory for Enterprise User Security

User Migration Utility

Appendix A, "Using the User Migration Utility"



PKj9PK &Aoa,mimetypePK&Alid:iTunesMetadata.plistPK&AYuMETA-INF/container.xmlPK&A+8XDOEBPS/configur.htmPK&A.)OEBPS/appd.htmPK&A[pTOOEBPS/cover.htmPK&Al$$OEBPS/whatsnew.htmPK&A t:OEBPS/title.htmPK&A++NOEBPS/appc.htmPK&A$e|QQzOEBPS/glossary.htmPK&A۶ qklkOEBPS/preface.htmPK&A 7??8OEBPS/index.htmPK&AoJxOEBPS/img/getstrtd1.gifPK&A w )$OEBPS/img/getstrtd16.gifPK&AMGqBqZOEBPS/img/netca3.gifPK&AG5!!OEBPS/img/getstrtd4.gifPK&An?":"3OEBPS/img/getstrtd17.gifPK&AȉpD${{bVOEBPS/img/netca1.gifPK&Ap uuOEBPS/img/asoag038.gifPK&A`޹1'GOEBPS/img/getstrtd9.gifPK&AV}OEBPS/img/getstrtd14.gifPK&A XOEBPS/img/getstrtd7.gifPK&A_!!oOEBPS/img/getstrtd10.gifPK&AKܑOEBPS/img/getstrtd18.gifPK&A.H۾E OEBPS/img/getstrtd2.gifPK&A${qa OEBPS/img/getstrtd11.gifPK&A2'U : 5  OEBPS/img/getstrtd8.gifPK&Asf--# OEBPS/img/asoag034.gifPK&A nlilQ OEBPS/img/asoag032.gifPK&A';RH OEBPS/img/getstrtd13.gifPK&A |I| OEBPS/img/getstrtd12.gifPK&ALh!rr OEBPS/img/netca4.gifPK&AQ|sis OEBPS/img/dbca6.gifPK&A8Ʈ))' OEBPS/img/getstrtd5.gifPK&AQ(L(, OEBPS/img/getstrtd15.gifPK&Akqq OEBPS/img/dbca2.gifPK&A#wwaOEBPS/img/asoag033.gifPK&A%ؿ''OEBPS/img/getstrtd3.gifPK&AKH$nnOEBPS/img/netca2.gifPK&AЧpOEBPS/img/getstrtd6.gifPK&A0"_T)OEBPS/img_text/getstrtd1.htmPK&A$Jb+OEBPS/img_text/getstrtd5.htmPK&Aqp-OEBPS/img_text/getstrtd17.htmPK&A/OEBPS/img_text/getstrtd12.htmPK&AP1OEBPS/img_text/getstrtd4.htmPK&A3OEBPS/img_text/getstrtd10.htmPK&A@85OEBPS/img_text/getstrtd16.htmPK&A7OEBPS/img_text/getstrtd9.htmPK&AM.9OEBPS/img_text/dbca6.htmPK&AOJ;OEBPS/img_text/netca1.htmPK&AnmdhAOEBPS/img_text/getstrtd18.htmPK&AxCOEBPS/img_text/getstrtd13.htmPK&A]δEOEBPS/img_text/getstrtd15.htmPK&Ac oGOEBPS/img_text/getstrtd2.htmPK&AѦIOEBPS/img_text/getstrtd11.htmPK&ARKOEBPS/img_text/getstrtd3.htmPK&A;FMOEBPS/img_text/dbca2.htmPK&ASOOEBPS/img_text/netca2.htmPK&A2p#QOEBPS/img_text/asoag034.htmPK&A%[  >TOEBPS/img_text/asoag038.htmPK&A6pۙ  ]OEBPS/img_text/asoag032.htmPK&Ab~?kOEBPS/img_text/getstrtd7.htmPK&AAd/mOEBPS/img_text/getstrtd6.htmPK&A oOEBPS/img_text/getstrtd8.htmPK&Ar.qOEBPS/img_text/netca4.htmPK&Ap6sOEBPS/img_text/netca3.htmPK&A"~Ԥ>uOEBPS/img_text/getstrtd14.htmPK&AӛONwOEBPS/img_text/asoag033.htmPK&AETnCUCL~OEBPS/appa.htmPK&AllOEBPS/concepts.htmPK&Afi d /OEBPS/toc.ncxPK&AG55<OEBPS/content.opfPK&A_ rOEBPS/dcommon/prodbig.gifPK&AY@ 4yOEBPS/dcommon/doclib.gifPK&A5H||zOEBPS/dcommon/oracle-logo.jpgPK&AOEBPS/dcommon/contbig.gifPK&AOEBPS/dcommon/darbbook.cssPK&AMά""!OEBPS/dcommon/O_signature_clr.JPGPK&APz !OEBPS/dcommon/feedbck2.gifPK&A-q"OEBPS/dcommon/feedback.gifPK&Aː5)OEBPS/dcommon/booklist.gifPK&AN61*OEBPS/dcommon/cpyr.htmPK&A!:3.c=OEBPS/dcommon/masterix.gifPK&AeӺ1,>OEBPS/dcommon/doccd.cssPK&A7 TAOEBPS/dcommon/larrow.gifPK&A#{COEBPS/dcommon/indxicon.gifPK&AS'"EOEBPS/dcommon/leftnav.gifPK&Ahu,TGOEBPS/dcommon/uarrow.gifPK&Al-OJoJOEBPS/dcommon/oracle.gifPK&A(SOEBPS/dcommon/index.gifPK&AGC JTOEBPS/dcommon/bookbig.gifPK&AJV^j^OEBPS/dcommon/rarrow.gifPK&A枰pk`OEBPS/dcommon/mix.gifPK&Ao"nR M 8cOEBPS/dcommon/doccd_epub.jsPK&Av I mOEBPS/dcommon/toc.gifPK&A r~$ oOEBPS/dcommon/topnav.gifPK&A1FApOEBPS/dcommon/prodicon.gifPK&A3( # tOEBPS/dcommon/bp_layout.cssPK&Ax[?:OEBPS/dcommon/bookicon.gifPK&Ap*c^OEBPS/dcommon/conticon.gifPK&AʍOEBPS/dcommon/blafdoc.cssPK&A+&OEBPS/dcommon/rightnav.gifPK&Aje88-OEBPS/dcommon/oracle-small.JPGPK&Aއ{&!nOEBPS/dcommon/help.gifPK&A9dq\\ OEBPS/toc.htmPK&Aӵ.$:OEBPS/adminste.htmPK&ALUvytg6OEBPS/appb.htmPK&A+wwUOEBPS/getstrtd.htmPK&Aj93OEBPS/toolover.htmPKmmmR

Q+ fu6Ï"$$Y1 D`?P|/\>h.0a N!&! ڠa 6`DŽA 9A `"LC݄^H@|pQANej,-e V ,_ۃl:,NB.7 xKm%,9P^@Cr ? Eh@J4U ?hn3xq%Bw"p7$D+ͅ*n H;uZ~ dDD(JxD%eRM;*Q#(`? T/VRQ20ցn7)@$2J%[*~iWbZ5Rl8%rƟJo_XⷒsQ xaGPnS2]x4bĦ0S.$1%hyq)35a P`ջ{2# rˬpqae>R1v,:8oFKtp*d.ٴDbN2(8 ^;˺$rJ-]ނ0CD;=4w~q*eJ 9O%HbSD5 ` K9oCq(Z Ja")HeҕuDI ޢsIA&GݚFyT$XDqG;LVI-u&Aד) N j>f|H#`v\`7 }j6 |- v-O|,(GiR\TB&1%%rғ܈F]By!9 3HC!f1>+K;jEO7MnC> N =$jI(Q}hsy "hvlmW\(5u'v5Wrhp>)tyʪV%tq4Lw APVꈓCzÙ1cp)uscǭ6hC]xVLmHnr5L j{'[SVgu8۱ ";$[{ siMge'b%fQsZpo׌)46dU Ƀ .s6!8 yoIVpj&{XZ\۵^[p(뢲h%T שffCZ}7oOI wi&j C r%}Iwp^l;[zCt22zP`0ih{v+9r"fSV P849kk[Hwʻۼ+CK pƹY'%TpWmjgIw*{&ڐkVKw(g'Dv)kCV'| [%;]azOsz`%Fmlfڠ8 HF XѨoO% %q 1;0D<I;}%'&ܹZ\ZIlT0iW`Kp&{/os0QGveX 1 C0,c;c[.C2lH 01; ^dnjҽơF0 lr;KF}<{1E<^˼˾א bp7A@`@Pʜp0W@HKVm@,P(,@m@p@Rc-Fa`V$PVtr@e@8@TG V~^zrg Ubq@A8KPu+`Y `SYF t@ I[9VT@rDwWp<1p8 *r@$I0WNmg 0-.ī "pFߖmVe _>>Wr Sp'&2m~=Z=tc b]g0J@eV`HP:pz 3pd2"B Pq,w~FnK`>钜dRV.4+m`_016By3Fp/N` pe TPbT >#pm`!1kW2GBpN2n?7;vx= _R'~p^-V?(}g׃~.$ Y0o@`N'Au  mPoY}Fm@q܎zC"q(cjk*MmgPUWF8Z&dP8uBmSKP7pQOBp,3b}vV-SF'1-ZBF88FN~ zz-1I-z FBYF0'SeBVg'KFWHem AFY}] z҅1;Ie1'DIf/F- Q@#Vd/Y$#+2g@yaF'&Ih)%KqzAbd8#>@Pk櫯}R￝AÉ)A@!NDqjÈuw0p'}xpdI'$|a&)\q/zlɅx:L<C \Hd|(|E@!~ I Fl%ɑsx|ѿlݡԝ6'v;l I\ujґt0^&mƘ \XGɧ?A^㿏RI ߑ7z K@'suϽ!N4G`@>3hP˟?o@= {^?}88=π ]0|GP88!Ap0 gH8̡w@ C `?$p'0 H`D 8% YTE&61V" 4Z|TF6@W$.$BG {DDJf"xBQ~'E7ܤ(=9G9#Wftk9ZrM(IbL2f:Ќ4IjZ(6HIp2X!@{:p$>uywYr&Cg#@2%r9c/B>|-L@ Ojwp;m IS4h(YFRNgXw* pJcm踖ەLTH!ZSHMĶDQ/xGTXhbyggzVv"UY6rJTHUs  ]yAr0#[D6Tczj ҉:чy hU݊j̲X=W=iG#Mkc (Oͭnw; pKoJ(622g\ajZ.6 Iu[Qd`o%EwceE~?pnV4N3xb)V`8 E{P(NWb ؀2  8@WcUL"G_ , ,P,8'=$؈m*M'|\Rlp/~̇Ỏys=hJYЀ~YPKUJxCDcҞ 0Ay=9Ԩ3Y r@PkFI  :k@.8@!LگV@fb .( 4z$hFQT.n6Zʺ@t  V_a :Ё~ ء \Pe6zYC&7uM\؀=X(ʺ `;90A %9M:>J@K8F ރmD~{x;^ ?@=@@濉]taO,[:vx S74\'Oy$}bTt>`+El]+A@zP k<~׈.>oϕAAO[4+r>`eMl!>M]N{H \PR. ^@uzQ44 uQϿ?q^B xo 0zwrs 9z%tZ/`IV~Tqkc(/ȶk{Ff PH `v,,[Gp&a9x_ J&=bǧiN'a@~PĦgo\؅`'8&5m`vDv~egI6Y_ifV]4mM愺Gd#煆xVg'[5C% @ 02| @oTUh & y[XpF`As؊hBirxmHbp@xȘȌ͘H[w[L@Ljٸ4_8%8 7_g]8__rgdf/h#8]d0eVXY\:8\3=3^:^9c Y7C^ZQ=S#=8SHj*y~/04Y6y8:<ٓ>@B9DYFyHK NIR94)`TZ\ٕ^3$]{DQCjlٖnpr9tYvyxz|ٗ~~ȶ1@ymY9Yi33u}ő9Yyٚ,c9dٛ%0k`șʹٜ9Yyؙɜ V_eYy虞ꙝS4m\cOSd~XyK9 ğKM7iiiij~OX%àk t0ɠ):!j*(Z%J ڡzz`6v*Yvʢ,)*0zF PQ IB\ڥ^`jQ|^TWDKnH3hFKMrZH*ZI Ds5MgԦDDy |PN}PGyvD0yzꟛzJrJGƨP2TSTTgڜ|gN+eIlmzM4D~Dp D3jtĦ*Eɩ,ʦP^" ^0v0;@ztGdP5${[a^l e#E&*1ͫ?:$+047P+rЙ'dTpNi3E&__Eh]r6PMK6@3Dl201a0z* G0Nmp;0oNN߁ۜp#`0kKEV OĹ @3d3l[R7?`@¾0O3fhYGc9!B1`0XOY7zWB(`W @S@NBj.NO_A5%S۾ aT0r0\`WĭS4(0Ws35^\D0fe3|љf;EB3|(!|<WE BP$0zO͇3WQ@#pIo`Bpm0@=`м ?3($5"=0=_A߭]`{PxG$ &NR A#D5` RE=H*0 MN}E+c01p**B?P=H5v!Q_4Pi3d}F0 < @k1S9SK2@^  Q4 /$8PS1=]0= R"@#ZR¡3-3`<(` $뼀)؞0el*@ PB@,ZRO@R-O s_EмJ<S0.W]K6KTZ05'Nz(+N$ ;Z'E>=q5;=kS3('ZT\z~|*#TQ7d3`CTY7ZR0LM(K8\?6>6MRE,#=]dM=M5m*6A?2A*=Z8l$||~|'@>wP(Q7f<# Zj!LJLa FXDXP }ЅFAOTa||]a jBZ`@GQhE1A7 1C UIpJ@"P # d0Z 8[Q$ ?h #<FqQ0L5M8QpG <f`#m@q ed/x!h! b@| : b' L8ZH:!HX(}2,0͐##@)1BhB11gL q'8=03Є!NIu(Q U*Hbp KPS!!N8C֕#% -A@b `}ճDNH@b 1@;X@1>| =TZ|p>p4!Ch ~<" 0V-J/;" g5W%9B0$C yU{8 p6`JU„=0dNN2H GK}W!Fk^LE p6A`Pl f"DA9(PqH>  $ "|S`E?D `WB5f^Xm&Al9 7zAnE"< n05 VV⠀n;hL gL_x="\CP?`BL<"Ab0)d(@r@UVtTL"@+k.`'=<{" h84B~T  rS@ $ {^3! O0Ѿ- dx+<*8 ` hbH @O} )CP*g Ǻ G(0Ar v|Fzp@KZB=4H !U `A@V`[0T_$ t\on4:8mBR |n{1'!p5 ݇RB˄38=xj`F';ӷ._O 삍>RQ9O o6n֋-= lM>"= HpB 8a@~g\! =q$` +_`@i$Lz11 @ +0D?JW%!{7{5zK@/'sL%E>% xyJ7turv)q5s@@5cEyQuC[Ss%vLqvutPHt/rN%qAq2dqA@FMF>K>EKG״\ȅdFQxMb\OF;QiR(WKDyTyx|>\`>`[t與HsiDe4dN舐HMAw"f*G}xM'0uȉ0D؉i$KK[XT}(KdD}z}`7d&1Zeq+k-f`+.qOZA,d(xSj@B$ƆddNHMPT8cxM_Hr,]?@EdxGH]D'YTitTA4;8BL2NZ PBP`3'㸌eψ$PG$_ZZY@#P%YAfAY 0nٌ~Џ옌d3}nHfB O@u8gpY%Xw)h$e/ qS6g}>a9SQ{;@ӎGg 6+_C P I@ A4_q|0}1zjV$ :siIXfA {ə}،͸zEqs}gd$=_ÙÉz@^yᒙ `(s:2B; C7Cv$W:N3}y`]$A3;:$`0@KH2M]BJbHCڥ@:KM/f*$~Q Q,0(}@B/(x~Vtd" 9b]v6e] M:& %W'չ,qm/J]NO $ {ɘPY^TgWS_TI k^]9`3 QJfZnizwj@^:G_ Ps$ D:^O*):#OB*1]ƥaG'y2YNbb*]3R= k. 4}I}F -=`0("ۦz++Ug,ˎayO$hщMیO㗈 -H9 $4mV;s)Xf<2bP虧 \hgZؙ/@zP@fR^8uObɏ JǹCagC|&{a0`#If:I,}ܨS@@#;p 0ȏ gY,+oMK D[E۸ũEYZq۷M*Ixsuy;\|lؓ<X@l|{p \#,X Jp{0\P@A#, ?\%\Xp1l:PL4L1 XM/lWLPGplBLO\ I 1: (ElS,0\P$@bUϥBgϛdN ,%Ii8{Gg$`S.}9,'z@B=D}H ҉iINPRMaZ\^`b=d]f}hjk)pT-l]v}xz{SK6ׂ=؄]؆պ"Ԍّ͕ؐU+}٘ٚ7ٛ-٢=ڤSgVڮNmȰMء]۸ۅmɲw6غ-ܚ9܂Cmʽ:mij=]}H ؽ-]}=߯]}CM~} O,$}J $> N  ~M~NSF <E})#,'/N<-^&6>%2 >zL>)KNn.j-.Ȉ`N&P4:uա}+Tyd&enV58jkE  7˕DNW婍E蠮 &c.^5d|>嘮!N=QG]/4\?mZ>:Pn%Pa㋮驍 .F.PQ^/PA%P @>N]~C~: \7M  a&碎&PJ>n>瀩>.P& |N}P󾏻 |0v%.臾= 4}▎.l>0oZ&n&ɍ) 0C~> p/P T ]5n@N/Pe>9 4P$>xmW/4@oF> 9.;+`<L/N?2uO%x{9SCbP$ 0//@` /`d/`u94%% .}.4} 9. & //.& /:9 /.&9̢+̭ } % .b$K#G7lQ=b$P2)W4$LL<Ң>fQĨf+B"A܋ 8rf&2{Ѳ?MkS|*lȶ۷pʝKݻx+04VSDB3 O̴Ćg.^>tT HL@Ql )?,xmP^v9v?*YX ݆WBA/L01ݻ'TAJ#fYQ*QB /YX |ȁ&@I"gHh%p'd4taT\j{"$'GM64 7QZ,n@mHɑ,ˁ;TD0A0uHZG@NI>,Y{iيGi{Sz9H`T vdt c|5裐F*r1W`_bc% JdqH}90!p$& Nq^Q?:0!2&8D  _!F+"rD}[%h! IJb,V,*ךɇ !f,$ /6ا Һ P3Q*X :V~0 I~Yf^9G=e@͒sP&¤6zH Gޱeo83IH?# 1Xm7KtQj+}pZmxmm\O@o XycD!d*0CيhPH@|s$;Չ; Yڃ.'¶K޳:%@h;mhJr}9(l ʕڐp4 ټ/rEN*CG%0/ Sp#ߎT!yinP=ZQ%D8d;s7 [yM g5(Y@v/|cKb)t0C)l7Hp;h:0pR/^@š+RL!aA#] \ (8;bE@ۉN*w(d, X X8 gјwf:DJPERQJz!\:drꋑƬpT. ``\\8فgձp WkFQA;Ǥm&@M@pRxCb@m5tk57][im k(){럣lnawg(HV>ww-]ݔm7]nbg;˳.Z]N;|Ic4wO c>8 y75OC[]X!zn=p=Ͳs\Iǻ$7x'f.sPlpX?{yҴcbJsCNGg_(n8xw%2r_>.˛ $%7l>9Þ3 g;_sg T1e@s]tx,|dve4u!& 6`cN!;}ka" x /kzhbAg/Z4t[Lvarql=l!~b·~jgdx~y}R&$xW2V ICK:T qb7 EM/D3P7mEE4P%`XD&@dTd sDp/p$'+4~@kP n iT$% OۡPME94I/R+y;X U$U`1(&rB_xiF8xHhywO T&.卹@ 2Q'#%`D.`XJt 0z %@g( hĵ @+HQGEDCB H1 ]%O&P;2IWp Ƴ#@Hq eEC e@#x^aєXѐ}0Xո\ٕ[ MX7(cre8143C?$O#T(УJB+Āp" 4 +S`,A5"%p GA&{>/}z+,:ّ@ T<5*C/,=© ^rc^9Ov7!AsэQ?+pz`b, .S&RCԙ[PY76W /vYD ! $ (*$2*7X'rٚ2'r9s %ii# '_/q:c/鐜D#CGb#ۢFLڤNC HwWVzXXH.>bۑJp\Qq_4(s @ Ġ ՗JOq  d|>9`Y3gA 'U#v (| ؀%p_> ,9Fq!ʞPO^q6qz' ꢴ#7 @BQ) I OXd%BOzؚwqG|PT$:Z*ECUztop 7#1 tr@,PC &:.E!!3&]@D EA `[q43$P&`@cU^T;E@<KB NiJ Lt% {éb0I2&QQ𘮲Iad[f *Ю}p~pqr։(s6o=)@6{XXgly,HYW!aJ`YG!Wg{;16& ]Svd~.@+npi&c ')(PKgN͋wO{ػ@qGa;zja#Hn]{@ ҂2jmKumq_-&C& @W@,ap$V{ v؝{m;o|g*N# ub3` .1B՗);: @d;p6),u)(ui*wR|X,b\u^p_R+;@1.c+d˕|Y!Wy~LaS3kRT !9=p`# 8ey3yucxv,dv~)ɠ$wH; E$Q@5m{n|`JC|̹LA]8?Ӹ578J[C|Tճ8DXMS-R^b=dhЋ7wlqope]zA8H= z]Rt*אRehpP+ 0sq  p٘=='+Mk٪ڜi٫۲=۴]۶}۸ۺۼ۱ @ٍڔ}ٌMڪ}zݗmo@٢`܋+ڛmܘڱ}{mݝ-ޓMْ=܉ۧڔɽ m ૽nMD ! .{{0N|"[AG  P*@0{"^t0G"07^F~HJLNPR>Q.T>NWc^N8.Nf~hn@PGc@)c`]~>nv~V^^cPot@A0P#w<zA }ީ@nK Gc:[.T[UN]|.N~^䝪ApqGp0t'qPp~P' P o@P@^ھGt^ڎq:pxE~ (bGP>O$p^@{8(x0Ϟ~7"qN1~q{"3/O:|e{G#)LEUp +cp^ VXPP1Wp:POξckp[0A @f{n:^M?. Re?W0.T_1M/,P'[@VWt~A@eO7^?Kq@`@\ X^O"A`1^GK`~Trq{@:`מwD Omm!c OH31eRG3GcP'k1@{$N3_:P3'^PP{G38:{"GGP}_1OO: c:"7-O%['^Pc۫^ G]AmӰ`!5:a3dдC9edi7'zʇ.S?YPɺ#Aouq3bIPG#WGoD΃~j?p7KDJB?xHt߼'yÛOWֻ' 󛇽w{=q;Ck}Wp{O֗>3LYAGdO~ pa㯇S|@x~@('whPg x(*ȁz 284X~P&h<؃>Hvw0~Qayȃ}P"G0~5wR}7$I(Ѕ@pWhvxG ~!ȄS(xv}`Lay x$gx~$``xWj؇x0saH |Pȋ}p}8L7~ `I9pJq~% }c؎}p~ @X0~@(9YyH科 Љ~p"*, |a-94Y6Y؈%"ؒ `}  &&`"&P+`U %% JI 7ri}X8x(c~ yqw(w( ~a 0cY `P.@ɍٚ%% c/ y)I$)؅~`֩0yɋy~#xw~JIyPL /@9pL 9@ 0Z 44 &8剘zYHщ~:y$**W8+С+3l9j5/P I4 yKA٠p;Px\*+" _4Jhꑂiڦڢ֨07*/ylI~LY Hl% P|p`i}4ШD`9y O覨bzfzș*ʒpzwsOX Ix(X P/8`O ٞ  W(aiz)ʮqjk:z/ɒwՍyx~>ʰ1ihO^# #j'ߨz4[6{5˘淰h0[z?XP[ʰ`;P8;T[V{XZ5ɵ`b;Vk"O8djl[$mr;tSJG,з~۷1k~}k ˸뷒{;۹۹{0{ۊ+{+ wwH~};[{țʻۼkzyw⧷{wڻ۽;[{蛾껾۾;O-蘍ۿ<\|["% <\|ܿyۈٻ"<$\&|(L۫2<4\6|8Iw!@B}T D0p*0>>$$ ؍8@m8K@`smX-Ѫ/ =P= N E=}GMMQ >pR.=EcX 0@lD91nq NcEY 0|ax$zy| a8}|@P=*`q@nn>z z J0Pl@ܚ~r p~} l%B.N ln.m9MذZZ0a.ѫս~~R3녎p00PC@ 㴈7^L}`n3~P\ Ї~~/>=M(|@~" s(0d3/= 5,P^`nG~ mrͰ<@E49pnF]z}oXKlP~7P  lr| 10.L/+].^0 p G^鬎O?K?T= opӞD p7KP9>5 *,|}~}~z  }z VH} z  zD13 } z# | }z z˙~06>K'XQP?opd` 0sUKn@F~ACT\(qŠGO =j81]/ad-#@D#>5|P"%DP\(F <xi^G\lAD܅Wc S 5E 5lW 8B6cdAN^lLKh0.xFIR`qK]0R%" [02ܠ3p ! Vhp p U6,-n!R5A B8`0!;!ڤ@ a!@4&`! K vp Bv!< r=aP(Lv&? @ 9C ր/ R9=rЭPʬ/$(B %*@ ?XS2XV7 v@"(K(^& ! A`b`~!-AP |IX!2 #i_ppal8TD F>2Ĥb=p"El9c "%|P!hB XnB3b f \--A+00J@ I聐Lx06 TR%BJ 8[D@Bb;8`L*3`f' ruI1!a+b584 A' `He.cB DU`2!C!0!p@ʅ!>"& 4 h1Ҵh`U0p0A \A^`&@TUؙ@>hxKx LU Ȁ&R%ULKrBDQ +!@ʀ>< _}`XP!0c mm0p f#lH$pFjJiLq@e8 b:A.Faշ&i5^ $KB*ABQjp,VZbC@xa @@ Dk8] ۖ?`D6a88 BpRaR Cް,p[Y! Z`!yP)uV8ocWBg,Pa ~˻G{@7~`6., $3.ˣ@#P2L Y0u!TA! !#޾YKao/Pђ_>}log3."#,x( |)HQ8 ,ƅSP8C#;MFYe ~> ƶl2lx8A_ Np-p<@>T6nln `p]Wg#`oVhe*epBN0pEC)q`L:@J5Y#75aR5\8q0QBxW}oH{L&rM1lq:070C 50@p(r6 < xtA jTpZP8<p860lv;W0Q60g8R0aW8vv1@-ы|@\)\m $`u͸?z%mK\ 'iX@ OTFKSe\pm0F AI@ *0\|Q NlTc ?1m/azQ3*Y\*0DI+@3^@e"&S@1 A 1L]  H &}Ѐhp.hP*!-u z0| ;XzPV$;H1*1'10TBH'@3QS51Mԓ@qRP ;Ap0e>+? N$ 5 >A (ُ<*pI U9ab_iqӌ^ Ԑߙ ڠ pLB$pJs7# z@,@7 Fp=%*z;&:%74=z$z2L0-{ʰ˲<˲< 0V [<ʶ<R  ];k˽L|ʘpRsjYP)^[\לP8)\̾|C\ ֜Lܵ|X|о}  P}M- [[[=! -.-m$,].p#ӷj =CmI]ED-Dm =0M>O=PME_p.-6]`6:}rems}x 0؄]؆}؈؊،M{؏M؅ ّM٘ٚ{p-ؠ}ٓm؝٦=أMٓmِٰٙۤ=" ]X۽ ڨ-ܟ}G Xܕm-ؼM۫ ܣڃۈ}ٜ=ܥ-ڲ=ƽک=]M-ގ0>^~ >~ ΀G2Jܫ.2>4^6~8:m@@B>D^FNR,^}p+@O~C$c0;Z\^9~Ud^f~hj.I@mk `Щ`~.^|l&/2T `YߐϯI2p|> %LB0x,s&()~0}K)!5 'P>^~8޾m4̒ `%q,P$0^ :;06\a$H4 &gȞ ~8iɒ !EN:lB ${R^ / |@02?ӽ(R /06 9@}[3Yx)p P8@&D/Ohj\ mp/ P$9 %K4 +Z:f`{@]4$Q z~lnOQÖ39A`p/3V_%J}0J!@A_n&Y+@$s&N_ J/߰*C+%H % ~}4.|~~|& |&/ $| ÿ} z+.$}/{/.}|  H*dH~1gA/sAATb?X<樔޹?{:ӧ%\ǀ?c^y.=tmߧ~ JJիXj zA qA@A? 3Bpa?)(A&&}̺T{:ˠ'9ϠCMz3"M||(j>zrp 9{@iÂP֬ag͛JkνG᳤` V?>=zW+X??}/^6]bZ.g_z񗟃뽷 ]xfvhKM6P 9\DÉ%^bD"*"QD@1p%t+" g&L6](,`XbYYZWcؘ9  PjV) 5tixRSXFtc֧*]&袌^"%pRँh)hnd㎩訤j꩞ꪬꫯ 무jު뮼a+Vl&첲F}bfbx`;ݵk覫+k,B 4G,Wlgw ,$l(,3\ѤLr<:)PQD:ݠF7ӣ ZPWmYQ\w=^-خMh݉jl-NMxskwkQߞ,pq \d@' @ @'Plg #` Hyn>8Py'Pbp3^x @%{8{_:L]ߒC 0Hks R:%A F`ϝZ8]z<3 jA0^̔2! ~0w]c 69@ Az&]Al(H *hB j (/m/<! gpp'FT-\wd́",X"8@ 0YPAP$4F9X xfqH9g(D3IB3F/97meq !bWCO)A;qpq'5qrznDBU(skfr>p &S\83m)3@f29k4yd2;Е N5*,uP:W;|0Gsg]tPKcڣ:)BPKcBB{; c B1=Y9I;9vE]d&'Z ))r7O`qQlIB蹓55Y(E"M "`AM97<8xYڣ=7L<$d#973z3sڙj1) W(<<909Y6٣;qɟ7934CC )L*Ei AK4CG ='99QIZ&@4C3$8(=U7Z'=59?*E9C:Y>9@꣗ i z ੀ H⠛zy)eX4>nsBrUB糡cU9jj( Ь:Zzؚںڭ:Zz蚮꺮ڮ:;PK';RHPK&AOEBPS/img/getstrtd12.gif|GIF89a"fff3f@@@dcem02:tu}mot͜qrzstzFIOZ[b}xz<>Eި58@gjpɅ河{|3f!,"FH‚T1@*\ȰÇ#JHŋ3jȱǏ CIIGa5˗0cʜI͛8sɳϟ@ JѣH*]ʴӧPuXQjʵׯ`ÊKYP]jճpʝKݻxM;UTn `KÈ+^X"pU˘3k̹ϠCMӨS^ͺװc˞M۟)eI Nȓ+_μУKNسkν#]5ӫ_Ͼ˟OϿ(hς 6FdVhf2n (h(7%0(c--h8a:@#1.%S.G$4K+OeTVY 1,/eL斳% j)HVi'.%IpN)枩zʒn&h梬4(Rz祘N8^ %*0q瑎~h:iZ)ꓴ6j+Z*z럓 j):+"{wV5%떤j*Z*ɒ-~g,o&[/~k.[g޶l_[wJ,nO,o +O131 r(Wf^q [oZk-㮋3`e4 Φ,55"m=,'/KiIkmia %VG8؉swgy57W\mזwf+4|w˺8p/(0]l:\Mil#_jk oC~/8oCS HL:'H Z̠7z_FHB&L W 0 cHo6̡H"HLh !.P|H*'(.z` #EZ`QhL#Z5t H:q-4n WXtdQHD:$II*@xd #!0YGN~ѓ *!lrdcEp%i9Rі\0uH r,dTbS$6Ifj 0 8&3MNufS^`aNt.ӝlg4yp h {~Q;EBPx6T( !zЈz %C(OXpiJP0) u`{R4N (>yO/2M*PЃWtODAVJUT` Ihb7=3ETch7MҕZt+RW}  ⯂u$a վ:xBbe9"ce%fn,@fh@hXճ}fKͭnoˀb p{Fw":Ѝt\Bͮvk"՟qK"Myѫ~g;:þo1I ox)`1Ox* ^F '4 ~PZ p1b O3'x%a7LȜ81oka ocf:rZ~2,d+SχUS6pm2V\c4ynvs<Yj&3\g6Y_3g.rNtϼ>9Ƃ6_{4/Zt!lIK:Ӊ2+hB͐n7M_CWх65f<ֱvqU h"zрS~6vi}n]j89vkbԻ^M4Ϻ&}gC{2+9wMdZ.++ThWGnx7\iꑛ܇%?k򕻜-OfN8Ϲw\/aQvHOҗ;P =`EG{T #(:ŮBC^ `+CtۈolOxz'&:=><+rKS->fyX>'}mnw]m^{;/>ՠ63] bnok?8~_:ø~~_۝G Gwgoc}#7pvlEրȇu7T}zP|8~x7 us$Xwv uFv.>x<؃>@x7CXF*J؄>N.sVxXZ\؅9'@wRt4Xfxhjhh`Lw)obh'2h?tXpu|~h%(?8{cf>4Ur֠T$ As)  $$Y&y(*ui!ْ04i3Y87<)1@B9D=i;lLٔNRG_I)>R9PUȐZa\9^?`#W>gex98Жp wXy'@eps5mHgF`ɘ )W膎ykmYiB)fzqV~k"y>Fg狪Ǎ~y_iwǹМɠ=2+ٝ\g) y(蹞ɞ٘6DQE|I%gXlTGGs$Xğ=HIj4JdVjJ J0KׄWbL?#QtVEᔡ x?ROElE/EC'ET,UT/ C1 E$P6z>#@CSEpT?>Az#XUEUJj>W5KEz%G=XX\ڥ4YYc"\t\8]ە]݅ڒ:YAڨ:ZzX@oʟipꞪڞʩЪoHz P * zG w7 0͚ *͚h jƺ*_: :Ҋٺ)_: گ` :{* ۰܊ ˪ ⺱'˱j`ЪJJ[ݚ4{= +>K.T0{ 2;B[86K yM۲L5˲U{aH+VY;AZC;i{˵䵡ڳPFKTKqt+Xx [%˰pz%(uk;Q[kK+{۹縢+[ۺ;[{ۻ;[{țʻۼJA[{؛ڻ۽;[{蛾껾۾;[ _+ۿ<\4Ak <:K A,c@.@ *,.;¨Dt:|0@B\RzƁ,LjȊL"k|ƃlJ5 ɐ|„wȞɠʒ?lʓcɁ|ʅǯ,ʲ<˴\D%ʩ|,ȼ?<|{Ŷ|Ȝ̴ɔlaa}ɻiڼL<\εqΝ<\0 1λ=]} DZ^d=]} ]"=$]&}(*,.]ҿ$ /]6}8:<>13D]F}HJLEAMisHF4V}XZ\OQtTG]]f}hjm_=a cFUt]v}xׂ֭֝b4z=؄]؆}Y׳׬a$؈ْ=ٔ]#1ث`ٖ٠ڢ-ژ E4=Jx%QU9uP! Rhگ*QkX]_{ک^-iFL̝UNU-؝M\:M4U\EJͣVDT*D=]5ƍ 㭣$RMC5R 2SMnHF=rP$dB}ߺMR!(*NG.F)yص=M&N$"+>D-F@Խ3.^ lUQ ^Z}ڙTwQ6#~;uc~hr> .t|vd竅ei7X犾 %>-|阞Z .~ ^wȐ^y ^~ .v  >AWV..+GNȮz'1Eؐu\fKT~ xh𸳿g﯀֐蛈Hpn+7;aof)_IojߎOq(_Rsｇ~զ gd.qУNr&FXe`b/ů9f?rhl#9r?CDtK4Eo_C) }{oB{T ҉OHd ғB *zG! iTjD?j ?NGKӡtܾ_4M?W t?(UNRDODMVE-JoB9*>N]UP N3#׭N>R EEFF H:>˷ǂØ(=Ͽ̋9F H`@@B>\ 1T&GM7!dž,3Hɓ(S\)C 0cʄEM.giKX JѣH5A³!6:-uJU!LAjʵׯvP,9 4tKlYjGKݻB˷߿eÈ֔ǐ#KnED˘3k̹g&BULЌM^ͺװM5M۸ͻNȑ OμxCNүkν;ËOӫ~}O}ɳϿ(h& 6F(Vhf*X|(∺G(X*۰4֘6r@ebDiFH&L6PF)TViXf\v`)dih;PK |PK&AOEBPS/img/netca4.gifrGIF87aXBAB΄cecZ9ekތBmZƜ{J}Z{{ss甾k{ΔJuRycJuޭkƌJukRBu)Y{s{քc9mR}9ms1e眾s1eBu{ޔޥZs޵ޜ1YkεޔֽsEkBmRZcƌ9m9a9a)QRRJ}JuBu{ckcc{{k4sRm1Y{scZcycekRiRu{uZc]RBiJ}{}{޵J]sýsϵkRMR{ƥ{έƾ޵ǔｺｲ۽snj9mϜלۥόׄkהیJJߔB}9u1m$k,XH*\ȰÇ#JHŋ3jȱǏ C$ (S\ɲ˗0cʜI͛8sɳϟ@ Jѣ'0ӧPJJիX>TjRׯ`ÊKٳ2 ୭۷pʝKݻx˷߿ LÈ+^XqڥKL˘3k̹gLӨS^3MmCmM۸s޽wBj+'|qϗc7}nݞywm|[vOV~|/&^wp X~Ǘ޷ T@MXpÍAXy#Wbo ]sȝr!*!7H+F)l)ڌ{x^I{yCrVע^Vc ! `Z)釦lfig_ft|"vY}$|\z hu*(g&[X.z祆*uENH@aakf^>fc hS꭮b랏k,sri**mv*,抬~Rm^'[jA*9[о ,j9J܆kwl@c>.Zhjv1oB#Ldf *&! xow{2&c̲߰KMC=Z4]lCGL>O|Ejd;۳jkv"smkO> 6ل,^[7~vň˧f5yK9\8{$+;zަl Kh箚ło8,o:&|ʿBp׿}t IBLF:򑐌$'EFR̤&72Z (GIJI~L*W3,gIW̥.MY 0haL"{f:~Ӟ I@44DЊZԋF7ыzUh8Q&Ԥ}'HWR&T$6QRk5MMSpԚ4fOS~s5mR:ėUPMlVu>OUn2+9cU4HMSRuE+NYSzX&WjUf5QgM֣/*QW򕱎]XF5y[#ͫmHJVgjizUUsMQZdmfCۀf7[Yro-p)6Dmg;UmZfA-.j*ɊWW\vQŮ|Rvb=.V5ݷ׵%.q ]RE|>oY!lKx}0u[Y떹V+GlvaŰN!Z_%;X+S_V]IL`Tb8<c*'U1pOkyoXLf]?ޯmLF1norL(tr]K|.q4sf8/Zuv?GÉrcY5,9Hs@3MV4՛u @/:զ4OךӎVuTت4qang>ڭk!m@3vv]kig_cdnnjo{Ŭ^6oqgލ^;ߴu=s[?w[%xýfSx-f[ %g޸dS_7$AP|s/ҡ/nכԷO{w9'vcɏ 3nvwѿs@'}(q٧w2G~'G7~}ysw}wwwq0X|%~'؂؃xz}$~9E`GX(Ӈ(JX|6ThH]>XehJ.h}L5}FLX}Qgx7UJ}Hh'Ȁ%WgF˧x[8]Gu8w'~(1mXbXx8jq_(hxHx؊DjX{} ^~'HhFgxјhhb؊m$F؆8ָH؍~(y8؍᷏EۈٍwH8!)8/),)ɒב6ZJz@ 9'ڟFڣU*BYQ%bUJGfc cFzb nGi \**d  ZZ=zPLjeYnjJ{jj騎Z]JP*Jj*꧸wڣ * * ښ:iZ ꣷj*Zڭ:Jj:piz:ڬJHTz*:* Zz JzƊJ٧ ʰ*J+ mӊ9{8ۯ${ڮ4{گHˤʰ26+ݺU곆/;> ;۱BkGԳ]= kmk^\˴ުr˰moK_nۭ}8[V}+@K<9;r˸jKʸl{;۹;볖{~mk{˷ۓ 빦+; z k{ +˺PkFtl_빯=0kkkn˾˺{˾$IP[{ ۼ囹[ K+}۳\;⫸&= {{+%,8lk曾;HP{٥1ذm{<[m۷ڕVm՟ۻۥ ۤ֯ڗ]׶۵=xګmֶ}]=ƽ=m؝ۍ=hޗە]@ڼڀzߗM̍n= ".Mߌ.~"%31ؽmpm(ߍ?~7>3W88p26..-6~A^~۾⽽,D2~?޼3.2 ` jU?n 4mP >.^i$^kd:` ` ` 陎{;~t ` ` @ٝɎ쵞(웞|۠>ꩾ Ȱ Ȱ m0jP>P_ y`^~^o{pGP٭:0  P 2_p>D^ 1 `2/ /2#/N">_? ̐ 0?n3ư L@ Dq_G Lmp@T ohN?[~߾^zgM%p D_ nOI |/ ~OlO?p .~0 2@//[o _dԏ> i _EoEp !L`-a}uk0^AĈ"n1cE.vcE{7YـV4$(f_n.[_x닳_Ѝo#\Ţ5R! +Ɉ/8$.M2e< ʸqX=eGaݗ2Qc_èINє< a;wk$B n`ϤHe4X,f%ibʂ+JkHdc^i6PQ9NrP/YYK^ܳhDf2dVh;&imxC%mӢ]9]PpӡT+L/H=CEӥh6L&!;fNю^S9Uh5(MPbԨGF[t2Uc,ĭHhlӥrR=N?gJӱ|5JpdkD锭ՌP+TUJe]M@j1bX5`, ,kfa rPZWV ]'̵l%l+۠KQWqz%ҫuir ͞=( B0u?-iTQ5ލk[c;^+i+n]ܶan qR5n9+MTE" ')>Tfy%y9lkwki: JW:/R!9'^QUխ7LV&xk~}k:y4n}[=` m[zn"$1g`-r3Y5{p,zkbc 6^| V.ԆxҕGNok .qqo=Vkw+ؖxK3^nF/baX׽Nrw`4V^kZjW{վkBu;eO =6kdχ(f:%mX3nD/r'È@5jwb'}nӗk_;+8zrO5^wlAW%u>I;\2kSt]`fc8 ˾<۾纵#?;?dIxks;97:;<:6cj#$/s=s=(B;[`) @cfBc9)z@|+?AA׳t3L=9S6f;4x+Bų<,CC?< A B C CTDDxDhDCI 4BCI+BE8fgH BV{7-< A/0W8t??3C@;D+B7 AD6A\fDCitDkCHl$f\K |MT N}< daGy5k9.Z[|<1<d5=dӁ>=+2JKF(K[FCVh}֝ MlmEWh%MNKtIBR-S{˻l^`V}UX|4H۽SLg2"4ЌT4Vg 5QdTVgӐ=NeVӐ}YnV TDYj=ב}Y 'TXbNMIRQ%UY9yTOKUtO4؃-5Z݀]PmJDJ8US[JMTIJ۽}tʖL\\MΓ,͙4IeETtuԚ}WWMb{`ڴ[ZUځZUS8N8dOۿ-\LNbػTJ][M[%V,]_ک]]=د_-5ޅ}\Ҿ49CN==Nui4%ڹE`NIT]ۍBߝ' 5[O~>#`D!^az (b &ZH{b$ᬥMe,faJ`^,Ҫ(6ȃN<5b#a6.'bIX"c"`vaE+_-bLf6Uc:n]M4c7d% ښ!>#VcKNcTX΅>UeUV0WUMaDeń)`Fb[\΄L8`(<0nZ`cRvfyd]|'#y8>b9.RXR06gq^\&rFr]vdaKu6bieKFԩTiq \qFMfi.N0Z0*vXUjeqg.LLJs޹߃dQNh.{.iIHiZSV6WƚN͹k4gIx~L6. ƅXZVhDqƄjCt&v6e86km|.-J\]VV>STހmN\RĆX߇n,~lȎjlM`ffmn~2Ͷhӛm/=]֕8Xg\ؘ- gppl]kqkOo H?0X6^j,vꉆ΄ht e{_%nb&tp6֓p?%\ 7Jpr Ʒr1<]irrφriFY(l[(XBZZ_-Varޣo&r&cjWr?6)_sfS=4s%T]M:} rQHSQRpsso70qe7VY(ޤf+A7rj F;cQξp?vOvegqOur4OWSE s]3r{sYZ~Gג}Ya7 xv.hvCDopAosGaVwcxfwkz\O xo6n'zS=p/a/TQ~RNSq.Epgyg["68+u7v|yIzJz߆̼7M߮ܣ-mʵ}>?M-]MmRJ=ԉG|'O|f}eOwCɮlwFOHqjfMwW|}gyn)}։~yONhWUUoWjq`e>б& i7%n捤haE -1cF=h%̘2gҬi&Μ: 'P<-j(ҤJs @Mqv4y2dʔU9S+LN*[Zb1ejOYcnݻt`A `ئ6nxLQcF*j\G7\3ТG.m4jMFzS$ʎU¾JUUaўM۶q՛W޿ <(c=^3Q"Iڕg\5d?:#5׳oPQlͿQC(cX"\%䅗]՗rs-t]$VH'"wi_G"-"1$_kvwVj(\&pURIr*V5Cm]Yj#ZjR(#ey&i|لwpF8p҉''' r:fANB%EȆ:vyqn9ay_橹)zg4GUmiEB%{IIPbabSrXnlưZqZj^qFb)˞*Z{Yv;qҭ%:C %Fy@uqUbTJF;.3!Z|1ornߊ&]QH Qc&iFʆ+{"s:KI+4@qSF ’Bjݜ ?kl6d'j?v7}7y+m.isڂ^mv׉s=19C,9wʷMd^yᢷm:錻mǬ;ӭ첳}ܼ9"5.:󩋋zwG%OS ߿?;o~1tj5AtDUW` `C~ QH r`.8 ,` _8Є|!Ih0v9a%2.yL`DU{ڃ^ 6-a i*2OET]o'Cw`T! SXB rІN#E`І.i) 1C!xBb&R MG 갊A屔c2H34#+%1"Gr!!AHr ä+pL))ͤ&*Pb3I3Or2!$4g9XNGΒ&>Yj ;#MVPt'@it ; ЂѠg(Ag)ґ.CO.t+hK9ϖԥ1hJ+U=)+PEeLTRNE^GuxJjL͜*uL7MjUd Ѵ~[DI;x*^d+W/i[մ`bԞ?-?9:QvUkR굴- _ ԪZֲլ`{Sb _UvV<,VSrVͭf!ƚ3}.tUmф5.]Xb~}lf֯:Yj[Zlzk\v.~Ԏof޶wm{ٴ7׵,^ӵ L ULRvɥ/+` uruK$V1/j>',dX-1}x6\S1#9BK$;M>-e3stZ ^9wjN.W8Уm;krۜ.yӍt+}0ӟg]wÞGes ~#i?{ Q쌶~wB=mOrisڽX7xMLm3PW7=eh/~xO=wOO< vûj>;oOO^iyAyOxH:۩{YG᳟}7ܫ^k}zKɧ~m潝_p_]"]epR_]vV^ 69` zi v ].a$6!Ba1!2a a a!Ja!a]Ba!*MWD va!a!1!"Q!`9!q$ja"" |a !V"vV* a*_Z"#,a'6bۉ!+b.f6!! "4jLj+a*6#%" a-~!,#6¡7a),#1~a5V"1Rb#"1fa4Lc+#8!5R:c75"1j/b#za$,#jb5*d!NLdHG<ڣv$=F@NfdE#GdCbDQ dAP@QFR#8$U~Jބ֣B&dC$IbC¤H"DjR$XW  AN$ 4%]$4RRc@PQ$ZdV%a4 &I%b%bbd`Bf`&cLNbSB_BQ>bPR_`f+3l?&lR#i]SmBBoo+ivP#!DA xc5~\F &X"PF H`؀ P{'|lgkecڥ~>}&R&~ޥvnG""h%]v!~ |h 0eP H fA xev`Agzg_z&{eRA))&.)6>)FN)V^ݤ6dn>}DS&lA"gqvB@j(AA hAh b l@eh|(`jf fƦ\*fn*v~****@'N(~R#.(&(nqBhΪ֪*(efj@ 8Dz( lA`^H_me'n(Qr+ƫ+֫+櫾++l (^Mliid깚N** D*S@.k Dk\A<eS^ h"j|"--&.-6>-FN-,kHUQkؾ؊-پٮm٪m',:eSƩD\ gA|A< ~+]-6%Ԩh|ʨ_,V-v~.膮莮^m.mضnھ+ή뺮+m Ai@@#@ցuQu2D?KcDKt\tEKx@t*w@6D66ݒ`KN@t#ԁ\p0F@.p{0*zV/jtbgx1tAt3RTkWCPnp6[w5r7>UǫpGwsqC7Ywqv7p'V[v+R?w\D]gLj9a;66|g|S^4b˷|_w{G}wb@SvlhOWA!@jDSR @#p" @Jng xNy@vӄ]˄kk;w{-|5; XG $k4|vΰA\ AyHA z8Q|} P_6 [/"_4Wëuvs5cwyﶬ;wwwȏ?x SG1kz|Ly<{|[{~/{ 6#~n7_cY5u+9?Sē?[Y7SX5@,h@&,aÆ8D1fԸcG' @"?vҡC/]bJ+c|Λ>mF) %R^ Gmx 4ʝT萃 !L iuXq"iDy#G,@C`v Tti>;T1WZ Jk9 :fO$ / j (p/\AgDc;tA{ {;2* %X)Cc>jϸojzF @0+ ! P6g:/ sWշѢu\iJVoJBh,60ɩPCB#6 s/WT8$Gm @Jmv`l&r,lؐp{m*T Ir`MB q6/pAc#] @ @ƀmȀπx@R`qejqLP=3 2T@ Rj 4 tLB# 'Lt;{ D@%pM/a*KD@vH'Wea@BoT"q5SME1/` ~@@ P4kM0SkNmm  A<]LeUjLP,m5CB`D .N,2" L+F `1[  3_4 gb*3WZ aF  H0>-ₓoMQ@F &U_^g`VmjSW4j`b xL@ !^a>  2`M-x @Cf:Gu`82_ @`@ 5?OnSA f=4&u javP1K<5 6v5K`>. arn B4@ $)tQ5s*{G4 dRm ̊2VWU1 7<Kˠ n 3-8oZ` DsGye%Vz/׀Az]}ˀi7w=9iWtk_Xi hRQc0~}XAd+rV|s4* vN ʗnFtߔb: Z "* x1x|3sտ8}A \m`lo HZڄ| \^ENGGӗ@VV> [tY*WӀ%9C!k?"n`@f|\9v@dV, "V >M? v~PEgq wy< @H@\'ٛ\Zi٦Ź;'œ=¦A`bڀz 4@0 |X+ : @Bݾ@O` @}sx( @ն q^֘99iY\`#8p1Ewyڨ[YD7|3b @pkC77&>  Z >K Z1wl? %ǵ ' 5ձs:;#?;\ipyۚ_=z07;":z* :k t fw@ pZ V ; FS@w `HfU;;GUzS`_۲z9] i8t3A;E{3ѻ1B9"kwUv@ pX L6`l{OZ@`9 ,  |x`s.0 {?@@qZ?@k1 \sW X֥ś[?ۥS[lq|p `{t`\@ @M?S2:` Ot`\@T U1`qݦ21] U@3 }=7[iSqzA&@xlȏ \ *PY(q2 .^@cRĽ`ؽ@~o=~?^T^~}"ו~3>]7~Ҽ`~f]y]u@Q{:2Iq-ݙ} ^ 1p-T Uˀ x+>î yᾥC?Ui'<|E RF\*jW"h > z`7E_^>-,܀<зs`?`AQ{4^Et Hzp z1+S`D,QPP #\PŌbhQ1a 8v#zVxʎ1h/U˓ *9rdO~hႀҥL:} 5ԩTZ5֭\z 6رd @gtʢHo9G͌8#͝"B耰`6 DE`">1bq%+jNa64wB]-<2p\/<̛;=gӮmKvA1d佒D&\jReŝ&x:` Ad/"a1f7HęEuדwpDwhP MWHN. OB0‘M#>RDfŶ< ,p~E,KtK@dAJ .#0 `1i!.ЄL7Gx7!6`)D$ B ^= {#H##w1ř+|F22#: J #"8AL ̈BլsiF$Iit!6V, WgGusNA diHK ,@6Ђ tm9p#d` 2PQA'/$ ppx Ԫk_ p5*jJ+X f6_;uA".wĘY^_*:V|d W=< Q ~*zWb`x TUM`H ½-qsr {se ~QX~H .Z]l/ 6@ 28 mߞ@Y&!+X0`AQ`fxp.`|iMBE_ p.dޙL "Q%' mQmg6k?@ 8zv|)u O,M7J=U4O8__Z1?+PP:XW ^c wi[Z-X misRu40E5@ DG$fBũYXq)kL;# P+lP8_]qml.P+lЭR}[ ;ط- t@ɨ5׌kT K4)-tu)%h!_ !oM^vp9'ZtW=찛-@hfTXXb@+f\pqҢ]]8<צΔ+@ (2 _:Za|O{ceý]w~Z!~՜7 >y,&E yJvm_u+I~{~2p@0ө}~RnvܻOuqv'w!gq\n.LPy[4?'vR0@ v3S~-肙r~J!{%7HWfub7l~!W_tp0qzPcwvD8w hNF pt[F>>|@QTE=HPAxDp_N `qWw[ssH-z'zfff*U33pfk:{DH# Gq@ * $0hx24Q=wV%)A=z'`2yҫtmP,MZZ*\"ňs] / 0Է{7,`',*H3=%P7 56zLnnڶtU" P'&|Θpt޲Gf\Hi>;?>FNa~-C]-Zp0|Li;vʹ~jNYی! rG 8~(頻NP-N 0.E^ڐ>ž]=tӋn<:>^ATߎ+.Ϲ~vvþnlJI=_O.kBO,n\-sf_o,Gf KG\q/w(/oO阯ڠ/OΤoŨ_/o良ARqOoǏɯ/Oo׏ٯ/_OyOOe$XA .dpaE5nG!E$YI)UdD[ΤYM9u'ʗ+YQI,SQNZժԥF$qWaŎ%[Y=;H]y>vsrA[g8}2t쪽Onxxڝ3}+OZ^wT7}c 0`):ү@[@:鼋" P8Hđ<0HˆDt(3ņ\;%۸ZMq! p!3TPEʘdȸ! ,H-52:Ɂ,THk˼LJ6L1Nb3$)<*>(|1;_r6FltO\Ot!3BP;s3P=EQ9 tdTTGK4=U!*E%U[rQCW/WÍX[M3Y\shbuUX\4Y=Ut[{&=(QxלJLSou5[4d 7 A}P|W MP w_.WÈNAV$l/I)cKp܋VEO'Nb<&r=Y8}AR5f침[Njԅi}peHHl G3Pdm }#/oܣ$'IJZr0Ȥ&7Nzrx'GHƊL*WVF&,gIZTsɥ.w^ fHæbL2f:Ќ4IjZ̦6nz 8IrD&vٴ} @JЂf?І:D'Jo.ͨF7юzм(HGJҒ(M)7EҖ0L ҙ8ͩNw̚@ PJQHMRN2PTRRXͪVuԭz` C*ֲh'Yֶ *\J׺k^ר浯 `*_:6}d'KYFͬfZz=eCKҚV=jWZcmb_+vnwj* oOVv%2{rK]y>Wѽ]w^ٵvK^Ѧx^q~ױzKn|_lޗeӅYj25O pv+6'ឞG\&U,X800'<".;dB!>W"&)%x46rlU%m#CRs|){Hf2u6V˵r2f^Wl$ FVavŌ;w~9hB;ІEgFO:1In`ChIȰ~u<:9ϰ3QVq<+Zv]l,;n)]g6*.9lb[vo4Nv@&jnq; W[{{&] ~3V-NvBβx7g*ܮyq6#O97K>gr0gN6v@ЅHOҍOd]\~[9zϵrC6NKO{ѭ P{:._W9̹uo?;w^vmO5.Ɠ;'?sth7מxkw yS\Ǽ潾yc7zGēHꇯ;{ey7C#wOWD-|< _}#7}Cosӗt'zGzv}gLLWsZ^@7W퇀ۗO6kzLMLˆM/fL1Ԃ.X=N2dXL|X7{X!#}ٷx&LKhZh$8Ld8>(iҔh(P\XELG(sׄN}{Q{GVX%O'i_Vcvcbgt戴k{&hf,fgb*Vb6J&c(kO&8vj打Ȋ(ifVq87&YsLGèwׁR{x$x ]8fx֋ֈxkiefk8)Vh-8xk鸎8j؉hXxLWzyO{h}GـHR؍zvQVj(ّȏt-hlqWLG~IH?_zXv}JyYXQh5jS}hXg!I(gXɉfI)iXbIBx4\'u(}Wy에~ ؐMIa q*y6iv 6V8^9h657a{iXg|LyyW~!(K9XhaؒؕTj )^IةyəY9' TըYhLyW?t@x(}GgKwHL)؎Xd) hHd֑hHXhk*F6m٠x z3 chIY멓8y~Y~9zIɟ٘PnZC]/&h<~> }hvk'=hT[ťuPyHxy{7Y};}iWxON'1ד6kt9vo:IX xz|ȸ~I 矋کU&w|I~*7x< :jz}bړ~*xڦG9q:Zv:Jzzɸzxꐚ:Jt*r:Iʪp xuꩵZiCI})Zրٚ}ʩꀍZiItVʯX쪭ĭKq:HI` @ %K (@ +{z,˲ zrw{ȱه @0 D[F{H[0 )۴3KP۬􉐿yzzB{е^] p d{ b` DPrKkj*mP`{ ~p 0 k;f۸n#N:ڱi$K] ; { @; 'P{ڀ ڰ @ڌ= C; cۼ  kk[ ʐ!@۹[༺۾{qp;;qKȄKmb<c [{*뷥˼z z{{ {[w &|(,Ŀ-]%;[3 ;_:KC;`āņP @ʼnł!,w%b,t0{^2YN7M4gȚ0,^rΔ˛{,8d k9j^|pɅĚŜ\ S W|Z] $,!|rg,JOC\uSL P˾,~kȪ}zCȺ;;a0ɔlɘ PɟlŢŤ\łʮ]l,z(X(̠%Z,\r',ۼ0 Xb*q0vqI.4..]kD K`ĥBĥ@^>QNPtj^%@~YKLuw`숛î[̣KLG9˄N|ՎM..oSNVnުL/R;@=Pdžr #[ Wh P +&<\K|Fn10UZٮ.$ ǹm&~ p ,;B D_|ptO.^ oN"_+?0=@1@ j< >灠 0([m-(砏A@@ DPB >QD-^ĘQF=~@0dC9w\٣G AP2d( @|K;v@J ]Myҥ 9i(W@;  s/_Ԭ=K^t'R WArZ93QR95а;<#F xR͝=ZhҥMF-q$Ò'SdLo<PaI ťG8xWUվg voج1nmZk O@՛߿0״ɵĻyuVʖ=d&$@D0AhZCIXri6I>t(zP)ܒ*Z&Cc:_Cj*<`=h0o/2`d0J)J+^||T_!JS2S& NwtU޵X5ӱ[TQKe;\شC~mI[m{O쾽{֮rվ\q5s&k tAKޤyh"t`Z4?қs]GpI?tկ_}N|_6p~C?p%? psp%8 6~` ?VЄAh- +w}M[_2\X\=㓺D APr)|w }| ?y,$}!L 5Ѐe45fF5zql_F2w`Ήr<XB4qs Q‚06M`sH7͓Rhv9$M-J#2{>L4/QwTLe'3_\gH F[#'7 t\ƤFP. !"Mpv$:lΚ)p:s ǎsd$A,iMkLQ ̌`89a"NK\!ňxrE{`JtoZGkB8[$@(=QQR^tx0y42"Qh%fo@rE`Aw{j~ڥ5RF&j4ukDm^1jōnxho76d/-4{E?z_dܶxYi媲~.k&QC[X.ۣ|q78ﲬ_Z19rbMɺo$AգJX~۪SNIsi.Du/)nRtw==z<[2D +;G 8Ƃk9 3$K 2 0b*¾L@`S3LJ Q3 {Y˙:Ѻ! {AA4&3l4)(j+b>qBRyYr,D-d0- B4̰/}02C 3C&=2CRCܛh=)9CrEԈ;6jP! ,;;69_Z> xT)-,!=[d#\' rC**_b\F2'Պ\$$H'J*?']*߂*$Jd!b:k$89(ÙPUz+R:˷ʻ[JI:/B\Ȅ 9/r4Fk`쪇䰞 Z|xZlFתFגFHLC-k#̧HB /YXR(D(xk(a yGGH $My QOU ̈dDICLCH{0'8FbHd5tIC˻K~ ̡Ga,úŶǽt*Ĕm,LI2{`4^ȅ丳 " _=f<4ɓ[<@M:XS|S P0Z-Z¬,@NFTF}LTɒ#˚>**dɖq8붋`;u +ȅ\0\M6P^0|C"7F;@Up5%0$PST8hNa]|򼭋t˕ kьd3HJONDOCR^A/l-(ɌLLpK([_@^]`6u]PS_c{48尥%JX IpB-PC MM18 .BE0Kz SLO%tR ;D4°N XRyG,1UIK";9kUO[(J.ImQ_iicp_pWihͯs DC=XbMIA%UWIOńlTM (0K+D- U-U<(huk5UM}(8jXW7=ޛ!BxM,h p5^ڐ1XIOXG QP0P( ԁHXX(qL4ثjX58<0ےRaY^ Wi •u[AB}9/'7 N\WS 5\X@\R LV`Sʵe-5d:e]|aS4 hA[b@ DJxOȄ5TC%5PJp1x: 35[=C1r.݃.}x=_F8 H@FPrOWF(9^N_}-TShVX0XQ Z`YV1P -h (~9/pa AaME=L|Om8HHĕ)b7wh>كNvݸe|J&j"HN `!H,]gTHi S<W`⌑OfD?2IB-&Iu8le[Ħ|<TE7FHx غPH`p (GvЄ1xmSk܂$ҏ|OomHS ^icG4hhG]1SƬ/0beьˮ^̃6‡U$0 >jI")BFHQDKQuTS&J֥Dc.m9ҧSn:vMm>:ͫXl,ReJm[;H5ݼ{5\` XcmaqVeX^qU"Hp * Uv*($=p|`PRN0s#A 9$EɔSPIEUVGW^7zhV 1Ј.x_`i&ւA$HaLVYs|b"0"DxD(/Jp\t `T+)x$:*Zv5u$x57'RUXe \t٥K.zHagI`Z| 0]G$B<\D)ᾡI$)"((xHtnUqJ 2* <0Lp4]a+WEkV[q0 ˊ Ɗ,3  )-o&Idp-o1&@b"x>(%`,қ#|0Yk5]L 3iPvUXTrkZ\4|ȉi -Yf*b(<?2I(Ƣ)}!%tQĊ,\%|2F->5~;C-ح$'gGkry wƖܘqf + >&xLbA雘)ĒbdιĒx" /ա (a6Ȃr2^һlB[z*WK@&1b,]LA^23FA|K /s~\:9ys:t"tU%TV"ddOy21CP=۶4 ܥy$ =Y~$HH"]~"jXCt 0"&qrh;oifPbKщ2l,@-<䝱Ic "OK$~Fτ(Dza 1{cH20eXf%pI,~5#%րI0$`0ET|'<.ċt+#Z1m)/0Ger0iR=R+?, \ "r exf5cA4]d a bx&/qN+&()ԡ'KY6,m YPU Ver_.mKzЄ MF2FYcѹ \2xXDH7X$79Ŧb4]CLnrVfMGEr"RWTajiMUӦ60/|!7 b)pD Zѹ5P>גQXd+ +"6i3mLG,C/q=/zkЪd3i-|+_~{ыyY*`9PY}(\ @`26 fW." .Aʓwy>\+I2f谗.55(~c5Bˆ:.rшʘ,spT!.$`Hm?,VčQSUt$-V#fA0K!rokȵ2i2kzL=*['`托\c)_29Bվc]is;/hݳ->" E#B7!Zg܀ @AP  (pxx&8NSĎ8#`KpAeT'(A,(%ʭulYsd 7f]^L~of'Ds>tú[6Y9MӧCʱ.t|W.M>zku9*Bvo?/ p3xƸɝh5@! D|[|#~PЁ $Wp {Ga& ^N;W,:J7$13,9ҕsS|ڏ~c}/y}_4_~|Wwa]ߩPM0M V`9=4@^48C4Hޙa^ B/ֲt@H#D`[@A\^E]&!!4DAMQBPP*P,̘PP2`I `_ʟӍA!!_"!΍!ݡ୒̄4D4|"((n )j'~ *~ ]^ b2c0B.VW.Ҡ"@AF0^!A#4&8!dEՔrtơeۥI. :"]!= =X>" ~<"F?&]?]=<:cId$9ZdrGRM0_$_I"IJ1 :F.cF@\ qa AR*n4)\oH%%d4'(Ʌa;?> :b[>k꫾?>t|S76ǽf}Czg+w{Ds=y/G~;>{?8-e?=@#6P&L(l C FbE1fԸqA9dI'EPeK/aƔ9fM7qԹgO?jS`Ґɠ&Cu*թW"ӺkWȎi {l,XgѦU{XAmT8.ÆFoH}<0'VqcǏ!G(HJ:jWZlkqn`\|WbEys0zuױg׾{w?|yѧWhK)Coܢ?\,Gߴ&5gad`{БD_ƺy\w=o{ d xߥyDU0 ,/= Ƌփ2"U۬-9*К47LsAw$5h#]f Tۂ`IhBpxnmT^8B.v qZb"EBŝVd30劆 C!aq~( HCL"F:%2#''f"E8Ĥ&IiirXĠGyO^rD /Bp#R9Ivf)S6!DJRĒepW=v'ATNPMqVϛ9@[%x,Uc>Ao:ʊ^/W zPACÇ͜(EIem50Cjɞ֋JH=U?+πf+z\9U@Īћf0dI^WIV&ɉnuZȊ̱+㖺Q0K0#׾)~;2i؉>` baV.KJx$ jCj!O빈zUhbc]DյuDwHǨhT-i#aMw}_PmW>ݝU/5ɏ{-quՇ&r+_N8#ص1$dֻ#0( WV}UBХacϘu U=cZeB8^-!b/MvObcDP EjWb$ǷP6ќfKݱ mv^"XC>}`pfAЅ;_?ND{ٽ|f iMoӃA43\C<|-0iYϚֵtS>W 9.e0ҭs1XךvoMe™ԽR:Gn5ld/6m 7; jmfok 7laj%=l{#moO 8GT3(|KryϞj,`i?=W}[/~$ۇ}뮶-?/76>wg~}߲Ms 0? `an"BNIYF-00BǬLXEPA]U0QmouCi$I%CViP0 c>`! Ҡ0 ՠ` @ a-Ot yp0|p2*eY)CG #8P<$ AZ0 pڠ r!5q72 ,Q 0 ! ]O '+ǚTifttƊlxpzѤ&M$3Q1!1As /YP0"iJpToǣ;lEara!!!A!AR "(R(@xA JpP]Y4£Ncr11&eKD{`?!EE4D@Fgn4L1GwiG1BN/3'3<AHsI=4JA)G73?+`Vt@K+4Q3P5L$BHBC"4OA 73 R1#oU^Kat@_PVm̦QQP H.H2aN7#CAuDyD8ǯUYU5VPoUQuQu&yA,N5sSN)rIY7TTEmZ9ct9o_:A54N5ISEY1`c=cA _dMV6#vR(t] !]NIIOK U/vUAhh6ii:cdvjc,e1b!VL/vP&*]316s"!2O#vTI/SZhhm d0pwpQp o !jvq" wrg / !s6asN=9tO7GY^WPho V`v_ mqv_pveWqww"b~WwWp/M 6 ANmSVOZ1 o ː E||Eq ŷ }7x}Gex+~W P w}vuWMa9a>D+wW/591?~=D~) E-QUwI aX|uW vmvYTgDQ1] w9=)!!2"#""dAxND(91xR%؄W aak6YTOPT %5`0SD3>0!2C 9$Ъx9 !IX+" 3z5]6g^KvU_s /q(m(0w3)3)xR/xD90ؖ)҈yI%m ِ))Vm=4 |uy ~X@//cyso9 !)+}ٗYt:稯8B7s)!ٗ'#m=EII9^` >w` 8Y ^h` c97y7ysy ğڟp/$jڦ3ڏCY / )?wS@IEz۠X `4a 4 vY:X^Z/6e:KaCB>`jzH6ݙ>8sYYCEH@ QT3n@5@ 4A8`l5_ce9`BXeywsT j<tCoV ` 2^{ 0 l[7O7I{T;i!<B[$%*\h61$C,/N)|,3?SY;#8,I9Yܺ{iZpj ӻ4A 0`H`@ < 2A=IgSkt{6<b<{G"i7.<`{Pũ39[Z{\3-_7s3i3[~^U$лRݣSݑ>^3^);;#}ثy#vO}DAb{ iȑ\Օǀƀ}Kڜݠ<>ث#鉽؛^nٝB=eQ~"ia^>,ٝ?gq׿_Ų?޼Ξz$:T@*/^X$F5h@R'NSpϘ1Z3-S4&B 3hҥ)yJP 1l0"E;nB+F d*[L%$uBwݏWf[KV%\Jȣȩy&?r]]}xu%ԇ JB&EatQyd S4?3-a4iIAyGQ šR}z(tVw,Y55g+\oVij 6smbE^,VKPnlO+[X>6*+fnyd3Iםyx^TzՉCE%G 1R"rT̄H BAh˩N.TbVj+>Hsb+}EFj}~Wp=K|)~sS0j-̮vThLQ FAb&!=9Βע_ȇ5;aFp,Dނ>=хO0Z$ gHF@'FL$&'` ; PNO,Ļ 9)^EAL>+ $-l8qtL pr 4ΑP]H҈xB NܔDIq2b@m'+a< 7>6ql+_ X^m#v:ʵ`a$T5E@?CJ4ч)>T3 E(Jр-I M f}v8+R&,b!K8FYsl;߹BZŖ{c T0U!U"BPbR@'FsPt&!l_/-X`5`^<ϐt$-iIz(5PHj@88*(@Z@HQ EJ4-Ĩxg c/IӍ F *M ְudJբҹEOBn#CHH$ T*" J-,9kB%E"A YE2ʳ3E hJFShD{jY=Ғi. k;[iI+\hHQ]f:lHe{ؕ`9M`r8 K@1f TYP+| *4*`Ɉr-|#j=6}uҒ0X k  ؄[-S[%Pw\}S5q?!iK] $mpubz j!@8C| 1n~`$˂xdOŘ"&ȦQd{}7 ׻ztg[mHZRԆxIZtT.rsKQbٝn{Vw9;\v˩' y+fi 3hpG@`7 83 px*Q@E"J3wժG Ym&evQus[mC߅[xJ7wtS)NFo^yɋIھz)bK<Ҁ4]&A(pc|J2^>r {b:d"sr@Wslhf[e;ҥeܬsm?q{˥/v)Gi <|mPm/|BtP t k>@*DUcG}RFtsu=<&?{_ԇmtuuuhvvza}zh'A{)XmW{cu}W/e/9\1pOXp VwxKhh0@ERp]4]Hp p;MK?>1uYv+Yh=.ant{w8otm17g.؇ONLJR7/0Xm׈lbf'F%:o=(9sCH~T?4~6NhlrȔ䔁I9.ĉhoV:nX{KD1Pwي#c)4MȒj@;XSYQn'dQEvdqYɛ[}"bAYO#9") 69 .wm`b2prT0ZY+#D=FIiO 8l%\ap%Nqt畈c! "&Ip6pCrW^$I_>piFpH_y')t}iHy0w=Q"Ɋ Xx@wS#=cNd+Y [%1<<0vg i_Ijdcd9[ʨ!ե ?}o ^s/ PБ(>*]x (=vaV P|p+ 05`G:_7[_ F>-nј*=@ Ua@ bȜ٣wU匒JAH Ud= KQ4BȢ+ͺ`%{bK2 0 40x$ "VjɡNa @@?P  ,p_~5&f`f7F8e^qlgZe~h7c6eOf+RK pkZ0u :k SpHP~)hPqJ5{zJSpk0  [`+p 'j9.y-e7mGbVo_&u+$l8ȏ u3ȷs!iTVOc ;/ 3QIxg]P z(eéWA \C  -WʻX}&*vh{-t\&8ȁh@b%ZzGW¦!|Cׇ۷oaC-F6XM= E-'WQ ;Ӥ  a~d!~jm#nM: \)ů F XjgV, `HuM@M  hDܭݕ`0`a &Pn빮km-uCЭ;]T)0a IJ0 0@$)