wo{|y^HNR%Z1XE>@|Yj
zsy0e8VkNZyR8l}uch@%>WhD)Jb4|7g`w9Pq``$)(=O(#{l$8R;QCn5KE5Y(T+_xnn
z8)p%_Yez!AkOrLrG&|lR6_<_cOJQ}1TxxFWQgbI0m(319E&q|SE7fR%6P`tq0xL>1
zk7@hgx=#L-(&zx$yTWt3oY|NUSo|GHB29vDMw`Mu)d;|8xeQ^>XMxE~!+Vf%k{crL
zDPr}65cU&(8j_Koybj3Xg!`CXjIoR9tuqg6XaLuA3K1nYGzO0?ca0bve+S%H6Un~g$&p?~TlaoK9#fKGDQY8WPwf6G54$dl3T0lT%c)C{+{W-%U>_Lcge
z%nu92^b?m)3Z^d#hGvFPlp}qb{!#UG_tGlqlkyu=^5By-F?=oFYW;vKJx%?Wt8472A=t3iGx$MKX^3_^VPSX7|hdZ6ro1i(9-U7
zy+idVMA=6Va3y3l>`DYTw_2u)cexX@GSjLAL2
zXXv_5b|-Ef&dQQYeOMpdXv*V97HTMF944NCOh#zI&s+xrK61|*&3l|4p!UTs{hBuRoQ{qZ_aq&XjGOb=;17>6cC&K(&QDi45@&cfIq8
zBpIK-2WGtepiW-mf>R;wxvSNAll@u&&HDVy(3lBa0jV+1lfM@432)d}h+}CtYpvSN
z^eX7*Yi_Tq`NaqSo%PZ%mTv#*qRAXFNQQ_vN1VjRa;YoXUFPuJN6h!*mJ4|}nDq6m
zh9(%kT+lwrlG5dM)EFieJFz-s2h>PirZS~c^N{V2Kx281*lqWV59;bY$-`6@-6q(*
zlX?>Gmusg$o^5wyOqLM4{jcJ!&&=puzPbVlmnO!xu{qTh5uLqU#c3Czz{`o6
zW>?{{kui%Hvfb!Xx0N^>79b&h=I2Ic`XHC?ipiT?sPzdo@^XX8R&a41xARE5z%Dt?
z>^w=-EB%=RM|`{OoS7kAP+<-=gt>B=waK&R%Ym&uqX?@hhNK!2r@a;G{Uc|O)p66$
zTRC*&5|3eGv}HTP>5Eg0
za#df5>
zO^mpoj~21frxqHrMHVVg66G=x^gznLbp?R09M!nM<=eZk?L!UN;k!~hj-74TzVoE(nU4E~ZexgftZ&tD
ztuTD+o@6hPyG?ZuysvlXP@ArQYjeXShnTbpY#o{Z-(j;Sp{5diTCIHclQvO%-QVzj
zDn<*jW(e{syn*;oOV!u?xm9e2H`OASl280^9kw!0p+{-SwKrd&8BI%_1lENn+ZR7a
z@t+p=l{|2IL7>EWHu^4p@PGM`-bA>rj$n=J7iJN)Xqk`S-Yqt+NzZ3PT(Qt*830H)Oa?7RBdS|
z<2zL-zdh&7q9cFlF&2l<0Ai7Z4dVXJx&|yF+bTB#|AJ5pHtjqYIUmS@uhqufuOj}r
z^R3e~?sefJ9aom5+CrTgh>k0B(uMI)usWyBQEr$WkwBTz`YVT`EPsNZGceCTg*G^}
zn1e5<13D=GOQuWw_1vcHwHL;VlL-bcHdWo3OxXR;!GbqorP(nY_vwYlBi%D72hfTK
zP<<)u{YClA6G?t_0$`IVW|8OOeAD-${5q3;9a^9F!t>Rz+@12;u8lg*0g~QLKEGYd
zN%d>s)cOTd%0WcyC2<2sZ!tW)Lzu6!Nz(#GK_C6
z5}Y{+W#Hg*_9kw%`^GPEg}uTXt_SA&^mX^{GVv&iWDdN1@%vCHZG|wiwSp*li
z>UUVxOZx}aa>9oUlI5kCnYcQoio32HdccDVsDytH%kPk=dQZ(MQw}b$`)tb#*3ojw
zhs!~AK`^Dw{JwHtd{
zG|dCX%YN0rzj*IK5$AA`_b!c7=dEgq@HuU@a=5s}D*kxhYe#{7{F!@yo_7jkf--j5
z1I@3L>9p7do#MWdP2pRwC93ICII4@K%m?S))FA7KV%WbnbvV8FtrKGP1!5E&Cw!)|
z`0B>%l_c!2Q6f2ODf7pkxw0<3#97`L4;}Z8u~XBL@ajgT8kEITx_FVe%g6&BkGH_ndFF~gErxBs`ebp){
z@vr2W_Pnzz*VTdeQCMP*O8BN&7=LTat~6y-
z5TjwM2CwhS665pne_{1#h~Ut133d
z^(H^VC_H!bHWTFQnXhYuYwy?b;Id3l*FA~y#!{B75aX-)ItecUytEiK1MM{xni`wLv19`ISMUEsQw};|q
z683mJZUX9$$2Zi&2;~|4$s|5Kv%@BQks>$9!6>J|IQo22;l4hukM&qmGs%}kKHi(Z
ztHkPvHA~#ui?fRlzFX8ISkKLl);?8QDu1z5-)QCeJ{?E?>&XmfxKLPG6Ii2!KD6$iLVZedX8z-Qv)C7nj2_`>RKJ}>BN?uX
z4ZAfoj5}G1`7;y~O{zL=^XPjVJc`sPX;!iFc0P)uTrTe{gy-hoQi1U9Iw#H0@t!tKWhe7sj&|6R!LL
zmdf=LfdJcRN}N9;!L4j+Kb%IRp&6x4$f@0@yGvqHeSAE9RSkhao>xs^uQ70Vra?#o
zF^3nt#7CJvhl^WF=Fo}N~JCW0rSh?)x$JJzE9*W?g=U3!0dO|NmO7R}@4)+xe+
za%BI~G>EPqd6#h+x!3HNnRR~BNRSqwR`G3;F1<{qBPdw(Nf76_(2DT)uz*^Dw(bHEj;zS_>QUqBcr{&tHL)v<_svkNzG+{YU9YP=5c7
zg~_9YmyqYwH5p&?c~6{3_wC~iQ}g?%TKckBM1|XJ351f6W86(jk6-BB<#yCGZuh55
z$yb$m7JH4*o`rG!qoKuYjw}7V{6Pj=jyFK8YC0_Ha7R<|k=(?jUl71hO{>6=Teos>v+=U=
zDWYZf=x`^~rNKd0W(GqHOfNCjB;IjBe{^9;r+nMrbf=d+KfdEoe_ifhi(tCA*`TAc
z;+pfTTI{<0*&PR4dgg?0O1NX|sSwZl^na*dFlr^C0>CKlEz6kvhjn%`t*4FrZnq~*
zB&A|j4voBy9(L*!LrpmY4v$^Y(%K^7$(wMJvusa1`WMaxS%zOV1^0t8G?yBp_wI-!-7V1s`qEA<;$~^XFTcbZIy-R`6D{ZjnI>>NEb&#=&T8r>0Th>*nTdmF+Dw<8z{NSvZ(9IG$Bdh5XKEq@t`Z12nPI)Qw%(
z(>L{Y&>5-{e(DSMV+B$FH)$?kT8l{IWHRsp#XS3#ZlXuEPn&?)v23-L6d&s~id%hF
zcYI}(ib#&mjE$!sM_S^A+ce)OLYgQ-iL3)U&7z9m`lvs0)g~Ky@yE_7(!$Yv?$;&B
z7Tvo5$;QJ{M_s_C&eEyxUY}l~-|F0nqk}!NbS7O21=tb>mfl@WOeMY9Kyc4D8E5_4
zO}Z0O^n%sT_X>(^q)FxuvrHN^Lb*MxvsI4>AzlHzNzs=u$xnE3DGSm=3zh+EouwC}%CHsjnHz)Sd!N
zn7KugIY&MTgPD`js+o@L!Oy^GZ7bS8;UD=s8QVODcguU&AcsT8ayb+}pJJa1G&Mx4
zzyX)XJ+|R`yAN}(e1Gl~dd)NHQoT{wqZ(svWx${s!UPzV%Lp&mq~Ach@ghdl>c@1(
zLVwnjqB8e4Ves$Qxs7wEA9aVSJl_M{jE=0chFdJ0HfdE);K$A@)>$yLDI5_j7RZ`c_*JErbmf0w&4zT%Qx%o<`f;<@|F#U9%
z-1ceEgWU0aR;G5Qv?2$SuTV^HIo?Ib_|~fZq8JSSa@9(TjUh3hpuNJpHPE5e(WNhd
z#`*rVE(Z3o9(8ZEH#4p4XQx(()=Aa#*>fw~)m|+4`o=EIY@A&*`Ysaa!@3rx?W;vw
z+_5E-u@0oZKAR{tw}KqCQB-lpb{lPO8YR^L^Z;Cu=?-aQ=GT6kvD4PIqXPKFW%SG4
zs?h@uX>3^lY8wa7eU*7u99W6ZvEae16Pl6yUq1wFxhs#Wlq8zTriMxz7m+(+E+{Lf
zJHqT{XJ$yghNeUTbFBM}s-}$r&tiwL9sw42L5E2YD7~N(q_h13n4?Um8(Sb+96%0<
z@RKwYUHa*_Te6>?B)nKXhV0QVZM#xA-x8jeyw$qT)Yy=1TlRTX*rVzP|M~iBW3(Bu
zNL;OYwJXIiOp5}i3!dAKd?bOpW8C~FAAgSC|0K`Stk6<@swVYKc52q~=y20JLUqiR
z0VilI3j=BK!(VEFJeko9CcEu#7rARD;xB6R2+&1d1pofw%@5>;<;vUX=2Th}CBGX9
zOCBg+5`s;;MOjJYI2rfWG|q=K`ipUL&SS8ZBv%NnKMVIZ8smMU?5-)rm&|_I{BkZA
zny%f9^mPcbbl42bZaT>gNllX9s2>{nA)e(lvYV%Re&(to-42+{ewQOjG)bYB4#`xf
zoLv6MupSaVc+4|Q3_O7tk@$VBL6fm^J1Zco&`laP-&0pj=hj+z-Ex7#5ZT0=IKth+
z39RT?oL{p{4^<~?DOpLWuC366@qd6AXua#TixYc;zB%pC@3M!kQFjzRLynO>B{{b!
z{G4#}Zglm}9|6e2PK$`|wO7Q{3>32YlFErY;d?;2c^tlP!+IC@b{;#{+5PZ?k~|~*
z>42TYlO1f1DxWu6cy(-F)7opLodL}co`eC-=%AJT@Lmr5`IO+|XPW#P)H4@P-IOPQ
z54w8A(A&q3NS&X2$<7X8C_`Z^`~QL3g>N
z{kkhLDG{IAC%T>mjo{V;5KMF}xYcAFY(;wrr!}o(;qCGVJ$brLqf`X@wD^g78JeMK
z))H>@4?TFf9pzmKSfP7x=E3O^
z!ytSOjnvY4fV{t0xo`~YO~mo1wxWq)M-fc&Rt4-B^RL)xBIZRkKxxls4&|>HUW4+f)3hIND5W=lljQ+iqG+-h1q*Z^
zVG?8oKDzzzQ_&muOdG{!XEOK?MOq#6X{k&@ZqiscMF%`B9qZ&0AWU#|x!`Cx^o$=9
znpS;QFWph5D{R$0D9RKb@TE=0Kn84({7dpT*gg^iq<8E7#X)dN4IyOeb7_p+L@_c@WV94a(cK(HC}(R!}eBh_vBPwOJ@tZ2Q(L{VvZo9&&ysX|TJ
zlY*(qjJ3g0da0#;eZ_x0yZ&D8Q@|9_XwFwOXnEEZBjqVU=Xx$)0MnNu)1R-M1B(Vt
znUVNl+0zI{L1vr&&qdfwhaHY~MC;4H0ce{qR16_{G4U_~EYQeI_+*c2b$R6%nH5(&
zXQJ2C;Ms*8a>|m5tR4$SSrl4SUt}(OFJ^!?G>}dS=%YXn+s|`?H-bK+3qO!kY7}uf
zCHEeqY5@NPHZ|um8~UFLc;|dfR@1o0M>$$w#=cWI^~6zO&1o;>^}~y(zibXX)s}JX
z_)mQQ8gz_H*UDe;b5jlFjQVcKs+3PA7}jr*v%~jZ{k^P<4L&-;
z&PsQCRGikIWC!72&`4b#w8o|+d~>;jUybuWPIW~rXofJldI6mimhaTiE-sJI10HeuEq7c9L*=KibM#{wq0x|T8DctCBOI6=q9SLlJ<
z_Lo^q`m-mJ0zci3(ca)R?fBYvw4ySoF5*X`krjg7L+$vr(im`&fKGtkbAX5P?;KWWpc=fR#j|K6OZy`Ep*3rk2W{#hk5
zRc2cL*#PyDZ6^+VLdg+J@}H(C_3gmmu%lVA6CvZ^{>@<$CTzyKDLX-x=lK6j06bq_
z`!nbXk`)KCH8eKPIn-0r$A*HFV8bh2VVckL%ZR)F6Nk0nzO}$}*Za&jE}Pyr?8XpZ
zjHo(-|7wFyDV}V5!N=ZXb}*$G7erXxUpya_`ZuFNSQg?o4h}*Y!Z*eIk6naU_O?zo
z5KKp89skv^v}teX-rW~Dn&=!|9=nfke6K!vdwa{ucJWre`A_Vkumicx3kwT-^T2ue
z`LaCLcOvflloQ%rK&!k&zj1
zu~{iFe-tuORt`ryL;f`y#3E|nRS@$!S;v8N+B!JU`4<=)3};Kxr+mWBl4IPuVp(KJJX4Z=RQ$kwF8S0snQM#3`M!yZZQn@zYPGM&d_^utYKQ
zS%gTrCGy?08~c3#t;+Y;W-jj+?1nk(CNfX
zI1cSd5g|%VJIZ~@${MRE2JKtJJ^skxEg1XoIhS|+n-iYx-CZaYIu7FRjZl8hu0D|P
zgh}B!RWPu{^R=)rg*!DzXC43d9
za#6if@&K-0YAg$xV|=meBaz$%QsdJy2@!kKb7|B-)vwV}w9)48Pa;wBQQ%IiYBOQ=
zss#te$*C#njyyK1qvuh$8={V1qm%fphqo76v%-CT+@KlfL?aaB}gP_#i%?n};vgf%f#oIdy6?8zPRfX?LhkMn960c1P@}NgrVx3~sBn$1{iAy9Vb3
zzeizxYF@+%evWQoXx2{~!-fLcbIroUguzOO?l9%dipAG5S!U{#4_or@>
zJhE^pv~8m)FAM+7oYd_aj
zf1WdM^?DG|g+@~FU~PW?%af-}pt*7=%lhG!nIY~qzIIGGg|>R+rPO|yJ>tQHjTXO?
z;|%WP|7D)@7CpuhM^9%T8~%hQq@{_vrjVd{Jsl}BuCA`XezOuv-z*Ym#f|*)PMRN|
z(B7!t-Z!2#czr!R9gR4irBG;ScEo4&Y=rJL7J3+?KZ-WIdj1s4!u+3(M1}vgq%eIa
z%^oY^Q#S4?VfJ^rj4Dywcx|4CIrwk8qmG403z>fcqK)6xBK@eY$iYkKD_4o$K;Aw7
zXTkFnq@Ita7iXM?5gD6l0nqxNi;4Q|!KBds@PJ@#nak)My>wfV2P0TM_@A%idN+;F
zVcIbHoiRROs7;qc`->m-PvO6Is#q2(#OuFu9|ByzEUJK7pN}%pjG4&(D)@!OgP&T%mT@`}?#4
z>fW|?0d(_sy^0c=bJ!_cqQj-3q*rPv(-fsAReDN{#2K7)WFYLW!{4@^QjQD}F
Myt-V4jA_vS2Z@5O@&Et;
literal 0
HcmV?d00001
diff --git a/3-desktop/console-html-browser/AppCreationScripts/AppCreationScripts.md b/3-desktop/console-html-browser/AppCreationScripts/AppCreationScripts.md
new file mode 100644
index 0000000..ae8be6a
--- /dev/null
+++ b/3-desktop/console-html-browser/AppCreationScripts/AppCreationScripts.md
@@ -0,0 +1,166 @@
+# Registering the sample apps with Microsoft identity platform and updating the configuration files using PowerShell scripts
+
+## Overview
+
+### Quick summary
+
+1. On Windows run PowerShell and navigate to the root of the cloned directory
+1. In PowerShell run:
+ ```PowerShell
+ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
+ ```
+1. Run the script to create your Microsoft Entra application and configure the code of the sample application accordingly. (Other ways of running the scripts are described below)
+ ```PowerShell
+ cd .\AppCreationScripts\
+ .\Configure.ps1
+ ```
+1. Open the Visual Studio solution and click start
+
+### More details
+
+The following paragraphs:
+
+- [Present the scripts](#presentation-of-the-scripts) and explain their [usage patterns](#usage-pattern-for-tests-and-devops-scenarios) for test and DevOps scenarios.
+- Explain the [pre-requisites](#pre-requisites)
+- Explain [four ways of running the scripts](#four-ways-to-run-the-script):
+ - [Interactively](#option-1-interactive) to create the app in your home tenant
+ - [Passing credentials](#option-2-non-interactive) to create the app in your home tenant
+ - [Interactively in a specific tenant](#option-3-interactive-but-create-apps-in-a-specified-tenant)
+ - [Passing credentials in a specific tenant](#option-4-non-interactive-and-create-apps-in-a-specified-tenant)
+ - [Passing environment name, for Sovereign clouds](#running-the-script-on-azure-sovereign-clouds)
+
+## Goal of the scripts
+
+### Presentation of the scripts
+
+This sample comes with two PowerShell scripts, which automate the creation of the Microsoft Entra applications, and the configuration of the code for this sample. Once you run them, you will only need to build the solution and you are good to test.
+
+These scripts are:
+
+- `Configure.ps1` which:
+ - creates Microsoft Entra applications and their related objects (permissions, dependencies, secrets),
+ - changes the configuration files in the C# and JavaScript projects.
+ - creates a summary file named `createdApps.html` in the folder from which you ran the script, and containing, for each Microsoft Entra application it created:
+ - the identifier of the application
+ - the AppId of the application
+ - the url of its registration in the [Microsoft Entra admin center](https://entra.microsoft.com).
+
+- `Cleanup.ps1` which cleans-up the Microsoft Entra objects created by `Configure.ps1`. Note that this script does not revert the changes done in the configuration files, though. You will need to undo the change from source control (from Visual Studio, or from the command line using, for instance, git reset).
+
+### Usage pattern for tests and DevOps scenarios
+
+The `Configure.ps1` will stop if it tries to create a Microsoft Entra application which already exists in the tenant. For this, if you are using the script to try/test the sample, or in DevOps scenarios, you might want to run `Cleanup.ps1` just before `Configure.ps1`. This is what is shown in the steps below.
+
+## How to use the app creation scripts?
+
+### Pre-requisites
+
+1. Open PowerShell (On Windows, press `Windows-R` and type `PowerShell` in the search window)
+2. Navigate to the root directory of the project.
+3. Until you change it, the default [Execution Policy](https:/go.microsoft.com/fwlink/?LinkID=135170) for scripts is usually `Restricted`. In order to run the PowerShell script you need to set the Execution Policy to `RemoteSigned`. You can set this just for the current PowerShell process by running the command:
+ ```PowerShell
+ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process
+ ```
+### (Optionally) install AzureAD PowerShell modules
+The scripts install the required PowerShell module (AzureAD) for the current user if needed. However, if you want to install if for all users on the machine, you can follow the following steps:
+
+4. If you have never done it already, in the PowerShell window, install the AzureAD PowerShell modules. For this:
+
+ 1. Open PowerShell as admin (On Windows, Search Powershell in the search bar, right click on it and select Run as administrator).
+ 2. Type:
+ ```PowerShell
+ Install-Module AzureAD
+ ```
+
+ or if you cannot be administrator on your machine, run:
+ ```PowerShell
+ Install-Module AzureAD -Scope CurrentUser
+ ```
+
+### Run the script and start running
+
+5. Go to the `AppCreationScripts` sub-folder. From the folder where you cloned the repo,
+ ```PowerShell
+ cd AppCreationScripts
+ ```
+6. Run the scripts. See below for the [four options](#four-ways-to-run-the-script) to do that.
+7. Open the Visual Studio solution, and in the solution's context menu, choose **Set Startup Projects**.
+8. select **Start** for the projects
+
+You're done. this just works!
+
+### Four ways to run the script
+
+We advise four ways of running the script:
+
+- Interactive: you will be prompted for credentials, and the scripts decide in which tenant to create the objects,
+- non-interactive: you will provide credentials, and the scripts decide in which tenant to create the objects,
+- Interactive in specific tenant: you will provide the tenant in which you want to create the objects and then you will be prompted for credentials, and the scripts will create the objects,
+- non-interactive in specific tenant: you will provide tenant in which you want to create the objects and credentials, and the scripts will create the objects.
+
+Here are the details on how to do this.
+
+#### Option 1 (interactive)
+
+- Just run ``. .\Configure.ps1``, and you will be prompted to sign-in (email address, password, and if needed MFA).
+- The script will be run as the signed-in user and will use the tenant in which the user is defined.
+
+Note that the script will choose the tenant in which to create the applications, based on the user. Also to run the `Cleanup.ps1` script, you will need to re-sign-in.
+
+#### Option 2 (non-interactive)
+
+When you know the identity and credentials of the user in the name of whom you want to create the applications, you can use the non-interactive approach. It's more adapted to DevOps. Here is an example of script you'd want to run in a PowerShell Window
+
+```PowerShell
+$secpasswd = ConvertTo-SecureStringΒ "[Password here]" -AsPlainText -Force
+$mycreds = New-Object System.Management.Automation.PSCredential ("[login@tenantName here]", $secpasswd)
+. .\Cleanup.ps1 -Credential $mycreds
+. .\Configure.ps1 -Credential $mycreds
+```
+
+Of course, in real life, you might already get the password as a `SecureString`. You might also want to get the password from KeyVault.
+
+#### Option 3 (Interactive, but create apps in a specified tenant)
+
+ if you want to create the apps in a particular tenant, you can use the following option:
+- open the [Microsoft Entra admin center](https://entra.microsoft.com)
+- Select the Microsoft Entra ID you are interested in (in the combo-box below your name on the top right of the browser window)
+- Find the "Active Directory" object in this tenant
+- Go to **Properties** and copy the content of the **Directory Id** property
+- Then use the full syntax to run the scripts:
+
+```PowerShell
+$tenantId = "yourTenantIdGuid"
+. .\Cleanup.ps1 -TenantId $tenantId
+. .\Configure.ps1 -TenantId $tenantId
+```
+
+#### Option 4 (non-interactive, and create apps in a specified tenant)
+
+This option combines option 2 and option 3: it creates the application in a specific tenant. See option 3 for the way to get the tenant Id. Then run:
+
+```PowerShell
+$secpasswd = ConvertTo-SecureStringΒ "[Password here]" -AsPlainText -Force
+$mycreds = New-Object System.Management.Automation.PSCredential ("[login@tenantName here]", $secpasswd)
+$tenantId = "yourTenantIdGuid"
+. .\Cleanup.ps1 -Credential $mycreds -TenantId $tenantId
+. .\Configure.ps1 -Credential $mycreds -TenantId $tenantId
+```
+
+### Running the script on Azure Sovereign clouds
+
+All the four options listed above, can be used on any Azure Sovereign clouds. By default, the script targets `AzureCloud`, but it can be changed using the parameter `-AzureEnvironmentName`.
+
+The acceptable values for this parameter are:
+
+- AzureCloud
+- AzureChinaCloud
+- AzureUSGovernment
+- AzureGermanyCloud
+
+Example:
+
+ ```PowerShell
+ . .\Cleanup.ps1 -AzureEnvironmentName "AzureGermanyCloud"
+ . .\Configure.ps1 -AzureEnvironmentName "AzureGermanyCloud"
+ ```
diff --git a/3-desktop/console-html-browser/AppCreationScripts/Cleanup.ps1 b/3-desktop/console-html-browser/AppCreationScripts/Cleanup.ps1
new file mode 100644
index 0000000..f482b34
--- /dev/null
+++ b/3-desktop/console-html-browser/AppCreationScripts/Cleanup.ps1
@@ -0,0 +1,77 @@
+[CmdletBinding()]
+param(
+ [PSCredential] $Credential,
+ [Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
+ [string] $tenantId,
+ [Parameter(Mandatory=$False, HelpMessage='Azure environment to use while running the script (it defaults to AzureCloud)')]
+ [string] $azureEnvironmentName
+)
+
+if ($null -eq (Get-Module -ListAvailable -Name "AzureAD")) {
+ Install-Module "AzureAD" -Scope CurrentUser
+}
+Import-Module AzureAD
+$ErrorActionPreference = "Stop"
+
+Function Cleanup
+{
+ if (!$azureEnvironmentName)
+ {
+ $azureEnvironmentName = "AzureCloud"
+ }
+
+ <#
+ .Description
+ This function removes the Azure AD applications for the sample. These applications were created by the Configure.ps1 script
+ #>
+
+ # $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
+ # into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
+
+ # Login to Azure PowerShell (interactive if credentials are not already provided:
+ # you'll need to sign-in with creds enabling your to create apps in the tenant)
+ if (!$Credential -and $TenantId)
+ {
+ $creds = Connect-AzureAD -TenantId $tenantId -AzureEnvironmentName $azureEnvironmentName
+ }
+ else
+ {
+ if (!$TenantId)
+ {
+ $creds = Connect-AzureAD -Credential $Credential -AzureEnvironmentName $azureEnvironmentName
+ }
+ else
+ {
+ $creds = Connect-AzureAD -TenantId $tenantId -Credential $Credential -AzureEnvironmentName $azureEnvironmentName
+ }
+ }
+
+ if (!$tenantId)
+ {
+ $tenantId = $creds.Tenant.Id
+ }
+ $tenant = Get-AzureADTenantDetail
+ $tenantName = ($tenant.VerifiedDomains | Where-Object { $_._Default -eq $True }).Name
+
+ # Removes the applications
+ Write-Host "Cleaning-up applications from tenant '$tenantName'"
+
+ Write-Host "Removing 'client' (Console-Interactive-MultiTarget-v2) if needed"
+ Get-AzureADApplication -Filter "DisplayName eq 'Console-Interactive-MultiTarget-v2'" | ForEach-Object {Remove-AzureADApplication -ObjectId $_.ObjectId }
+ $apps = Get-AzureADApplication -Filter "DisplayName eq 'Console-Interactive-MultiTarget-v2'"
+ if ($apps)
+ {
+ Remove-AzureADApplication -ObjectId $apps.ObjectId
+ }
+
+ foreach ($app in $apps)
+ {
+ Remove-AzureADApplication -ObjectId $app.ObjectId
+ Write-Host "Removed Console-Interactive-MultiTarget-v2.."
+ }
+ # also remove service principals of this app
+ Get-AzureADServicePrincipal -filter "DisplayName eq 'Console-Interactive-MultiTarget-v2'" | ForEach-Object {Remove-AzureADServicePrincipal -ObjectId $_.Id -Confirm:$false}
+
+}
+
+Cleanup -Credential $Credential -tenantId $TenantId
\ No newline at end of file
diff --git a/3-desktop/console-html-browser/AppCreationScripts/Configure.ps1 b/3-desktop/console-html-browser/AppCreationScripts/Configure.ps1
new file mode 100644
index 0000000..3e1bf0c
--- /dev/null
+++ b/3-desktop/console-html-browser/AppCreationScripts/Configure.ps1
@@ -0,0 +1,224 @@
+[CmdletBinding()]
+param(
+ [PSCredential] $Credential,
+ [Parameter(Mandatory=$False, HelpMessage='Tenant ID (This is a GUID which represents the "Directory ID" of the AzureAD tenant into which you want to create the apps')]
+ [string] $tenantId,
+ [Parameter(Mandatory=$False, HelpMessage='Azure environment to use while running the script (it defaults to AzureCloud)')]
+ [string] $azureEnvironmentName
+)
+
+<#
+ This script creates the Azure AD applications needed for this sample and updates the configuration files
+ for the visual Studio projects from the data in the Azure AD applications.
+
+ Before running this script you need to install the AzureAD cmdlets as an administrator.
+ For this:
+ 1) Run Powershell as an administrator
+ 2) in the PowerShell window, type: Install-Module AzureAD
+
+ There are four ways to run this script. For more information, read the AppCreationScripts.md file in the same folder as this script.
+#>
+
+# Adds the requiredAccesses (expressed as a pipe separated string) to the requiredAccess structure
+# The exposed permissions are in the $exposedPermissions collection, and the type of permission (Scope | Role) is
+# described in $permissionType
+Function AddResourcePermission($requiredAccess, `
+ $exposedPermissions, [string]$requiredAccesses, [string]$permissionType)
+{
+ foreach($permission in $requiredAccesses.Trim().Split("|"))
+ {
+ foreach($exposedPermission in $exposedPermissions)
+ {
+ if ($exposedPermission.Value -eq $permission)
+ {
+ $resourceAccess = New-Object Microsoft.Open.AzureAD.Model.ResourceAccess
+ $resourceAccess.Type = $permissionType # Scope = Delegated permissions | Role = Application permissions
+ $resourceAccess.Id = $exposedPermission.Id # Read directory data
+ $requiredAccess.ResourceAccess.Add($resourceAccess)
+ }
+ }
+ }
+}
+
+#
+# Example: GetRequiredPermissions "Microsoft Graph" "Graph.Read|User.Read"
+# See also: http://stackoverflow.com/questions/42164581/how-to-configure-a-new-azure-ad-application-through-powershell
+Function GetRequiredPermissions([string] $applicationDisplayName, [string] $requiredDelegatedPermissions, [string]$requiredApplicationPermissions, $servicePrincipal)
+{
+ # If we are passed the service principal we use it directly, otherwise we find it from the display name (which might not be unique)
+ if ($servicePrincipal)
+ {
+ $sp = $servicePrincipal
+ }
+ else
+ {
+ $sp = Get-AzureADServicePrincipal -Filter "DisplayName eq '$applicationDisplayName'"
+ }
+ $appid = $sp.AppId
+ $requiredAccess = New-Object Microsoft.Open.AzureAD.Model.RequiredResourceAccess
+ $requiredAccess.ResourceAppId = $appid
+ $requiredAccess.ResourceAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.ResourceAccess]
+
+ # $sp.Oauth2Permissions | Select Id,AdminConsentDisplayName,Value: To see the list of all the Delegated permissions for the application:
+ if ($requiredDelegatedPermissions)
+ {
+ AddResourcePermission $requiredAccess -exposedPermissions $sp.Oauth2Permissions -requiredAccesses $requiredDelegatedPermissions -permissionType "Scope"
+ }
+
+ # $sp.AppRoles | Select Id,AdminConsentDisplayName,Value: To see the list of all the Application permissions for the application
+ if ($requiredApplicationPermissions)
+ {
+ AddResourcePermission $requiredAccess -exposedPermissions $sp.AppRoles -requiredAccesses $requiredApplicationPermissions -permissionType "Role"
+ }
+ return $requiredAccess
+}
+
+
+Function UpdateLine([string] $line, [string] $value)
+{
+ $index = $line.IndexOf('=')
+ $delimiter = ';'
+ if ($index -eq -1)
+ {
+ $index = $line.IndexOf(':')
+ $delimiter = ','
+ }
+ if ($index -ige 0)
+ {
+ $line = $line.Substring(0, $index+1) + " "+'"'+$value+'"'+$delimiter
+ }
+ return $line
+}
+
+Function UpdateTextFile([string] $configFilePath, [System.Collections.HashTable] $dictionary)
+{
+ $lines = Get-Content $configFilePath
+ $index = 0
+ while($index -lt $lines.Length)
+ {
+ $line = $lines[$index]
+ foreach($key in $dictionary.Keys)
+ {
+ if ($line.Contains($key))
+ {
+ $lines[$index] = UpdateLine $line $dictionary[$key]
+ }
+ }
+ $index++
+ }
+
+ Set-Content -Path $configFilePath -Value $lines -Force
+}
+
+Set-Content -Value "" -Path createdApps.html
+Add-Content -Value "| Application | AppId | Url in the Azure portal |
|---|
" -Path createdApps.html
+
+$ErrorActionPreference = "Stop"
+
+Function ConfigureApplications
+{
+<#.Description
+ This function creates the Azure AD applications for the sample in the provided Azure AD tenant and updates the
+ configuration files in the client and service project of the visual studio solution (App.Config and Web.Config)
+ so that they are consistent with the Applications parameters
+#>
+ $commonendpoint = "common"
+
+ if (!$azureEnvironmentName)
+ {
+ $azureEnvironmentName = "AzureCloud"
+ }
+
+ # $tenantId is the Active Directory Tenant. This is a GUID which represents the "Directory ID" of the AzureAD tenant
+ # into which you want to create the apps. Look it up in the Azure portal in the "Properties" of the Azure AD.
+
+ # Login to Azure PowerShell (interactive if credentials are not already provided:
+ # you'll need to sign-in with creds enabling your to create apps in the tenant)
+ if (!$Credential -and $TenantId)
+ {
+ $creds = Connect-AzureAD -TenantId $tenantId -AzureEnvironmentName $azureEnvironmentName
+ }
+ else
+ {
+ if (!$TenantId)
+ {
+ $creds = Connect-AzureAD -Credential $Credential -AzureEnvironmentName $azureEnvironmentName
+ }
+ else
+ {
+ $creds = Connect-AzureAD -TenantId $tenantId -Credential $Credential -AzureEnvironmentName $azureEnvironmentName
+ }
+ }
+
+ if (!$tenantId)
+ {
+ $tenantId = $creds.Tenant.Id
+ }
+
+
+
+ $tenant = Get-AzureADTenantDetail
+ $tenantName = ($tenant.VerifiedDomains | Where { $_._Default -eq $True }).Name
+
+ # Get the user running the script to add the user as the app owner
+ $user = Get-AzureADUser -ObjectId $creds.Account.Id
+
+ # Create the client AAD application
+ Write-Host "Creating the AAD application (Console-Interactive-MultiTarget-v2)"
+ # create the application
+ $clientAadApplication = New-AzureADApplication -DisplayName "Console-Interactive-MultiTarget-v2" `
+ -ReplyUrls "https://login.microsoftonline.com/common/oauth2/nativeclient", "http://localhost" `
+ -AvailableToOtherTenants $True `
+ -PublicClient $True
+
+ # create the service principal of the newly created application
+ $currentAppId = $clientAadApplication.AppId
+ $clientServicePrincipal = New-AzureADServicePrincipal -AppId $currentAppId -Tags {WindowsAzureActiveDirectoryIntegratedApp}
+
+ # add the user running the script as an app owner if needed
+ $owner = Get-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId
+ if ($owner -eq $null)
+ {
+ Add-AzureADApplicationOwner -ObjectId $clientAadApplication.ObjectId -RefObjectId $user.ObjectId
+ Write-Host "'$($user.UserPrincipalName)' added as an application owner to app '$($clientServicePrincipal.DisplayName)'"
+ }
+
+
+ Write-Host "Done creating the client application (Console-Interactive-MultiTarget-v2)"
+
+ # URL of the AAD application in the Azure portal
+ # Future? $clientPortalUrl = "https://portal.azure.com/#@"+$tenantName+"/blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
+ $clientPortalUrl = "https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/CallAnAPI/appId/"+$clientAadApplication.AppId+"/objectId/"+$clientAadApplication.ObjectId+"/isMSAApp/"
+ Add-Content -Value "| client | $currentAppId | Console-Interactive-MultiTarget-v2 |
" -Path createdApps.html
+
+ $requiredResourcesAccess = New-Object System.Collections.Generic.List[Microsoft.Open.AzureAD.Model.RequiredResourceAccess]
+
+ # Add Required Resources Access (from 'client' to 'Microsoft Graph')
+ Write-Host "Getting access from 'client' to 'Microsoft Graph'"
+ $requiredPermissions = GetRequiredPermissions -applicationDisplayName "Microsoft Graph" `
+ -requiredDelegatedPermissions "User.Read" `
+
+ $requiredResourcesAccess.Add($requiredPermissions)
+
+
+ Set-AzureADApplication -ObjectId $clientAadApplication.ObjectId -RequiredResourceAccess $requiredResourcesAccess
+ Write-Host "Granted permissions."
+
+ # Update config file for 'client'
+ $configFile = $pwd.Path + "\..\Console-Interactive-CustomWebUI\appsettings.json"
+ Write-Host "Updating the sample code ($configFile)"
+ $dictionary = @{ "ClientId" = $clientAadApplication.AppId;"TenantId" = $tenantId };
+ UpdateTextFile -configFilePath $configFile -dictionary $dictionary
+
+ Add-Content -Value "
" -Path createdApps.html
+}
+
+# Pre-requisites
+if ((Get-Module -ListAvailable -Name "AzureAD") -eq $null) {
+ Install-Module "AzureAD" -Scope CurrentUser
+}
+
+Import-Module AzureAD
+
+# Run interactively (will ask you for the tenant ID)
+ConfigureApplications -Credential $Credential -tenantId $TenantId
\ No newline at end of file
diff --git a/3-desktop/console-html-browser/AppCreationScripts/sample.json b/3-desktop/console-html-browser/AppCreationScripts/sample.json
new file mode 100644
index 0000000..8b7636d
--- /dev/null
+++ b/3-desktop/console-html-browser/AppCreationScripts/sample.json
@@ -0,0 +1,52 @@
+{
+ "Sample": {
+ "Title": "Using the Microsoft identity platform to call Microsoft Graph API with custom web ui.",
+ "Level": 300,
+ "Client": ".NET Desktop (Console)",
+ "Service": "Microsoft Graph",
+ "RepositoryUrl": "ms-identity-dotnet-desktop-tutorial",
+ "Endpoint": "AAD v2.0"
+ },
+
+ /*
+ This section describes the Azure AD Applications to configure, and their dependencies
+ */
+ "AADApps": [
+ {
+ "Id": "client",
+ "Name": "Console-Interactive-MultiTarget-v2",
+ "Kind": "Desktop",
+ "ReplyUrls": "https://login.microsoftonline.com/common/oauth2/nativeclient, http://localhost",
+ "RequiredResourcesAccess": [
+ {
+ "Resource": "Microsoft Graph",
+ "DelegatedPermissions": [ "User.Read" ]
+ }
+ ]
+ }
+ ],
+
+ /*
+ This section describes how to update the code in configuration files from the apps coordinates, once the apps
+ are created in Azure AD.
+ Each section describes a configuration file, for one of the apps, it's type (XML, JSon, plain text), its location
+ with respect to the root of the sample, and the mappping (which string in the config file is mapped to which value
+ */
+ "CodeConfiguration": [
+ {
+ "App": "client",
+ "SettingKind": "JSon",
+ "SettingFile": "\\..\\Console-Interactive-CustomWebUI\\appsettings.json",
+ "Mappings": [
+ {
+ "key": "ClientId",
+ "value": ".AppId"
+ },
+ {
+ "key": "TenantId",
+ "value": "$tenantId"
+ }
+ ]
+ }
+ ]
+}
diff --git a/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/Console-Interactive-CustomWebUI.csproj b/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/Console-Interactive-CustomWebUI.csproj
new file mode 100644
index 0000000..57fc6d2
--- /dev/null
+++ b/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/Console-Interactive-CustomWebUI.csproj
@@ -0,0 +1,25 @@
+ο»Ώ
+
+
+ Exe
+ netcoreapp3.1; net472
+ Console_Interactive_CustomWebUI
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ PreserveNewest
+
+
+
+
diff --git a/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/Program.cs b/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/Program.cs
new file mode 100644
index 0000000..e605666
--- /dev/null
+++ b/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/Program.cs
@@ -0,0 +1,161 @@
+ο»Ώusing Microsoft.Extensions.Configuration;
+using Microsoft.Graph;
+using Microsoft.Identity.Client;
+using System;
+using System.Linq;
+using System.Net.Http.Headers;
+using System.Threading.Tasks;
+
+namespace Console_Interactive_CustomWebUI
+{
+ class Program
+ {
+ private static PublicClientApplicationOptions appConfiguration = null;
+ private static IConfiguration configuration;
+ private static string graphURL;
+
+ // The MSAL Public client app
+ private static IPublicClientApplication application;
+
+ // Object with the custom HTML
+ private static SystemWebViewOptions _customWebView = GetCustomHTML();
+
+ static async Task Main(string[] args)
+ {
+ // Using appsettings.json as our configuration settings
+ var builder = new ConfigurationBuilder()
+ .SetBasePath(System.IO.Directory.GetCurrentDirectory())
+ .AddJsonFile("appsettings.json");
+
+ configuration = builder.Build();
+
+ appConfiguration = configuration
+ .Get();
+
+ // We intend to obtain a token for Graph for the following scopes (permissions)
+ string[] scopes = new[] { "user.read" };
+
+ graphURL = configuration.GetValue("GraphApiUrl");
+
+ // Sign-in user using MSAL and obtain an access token for MS Graph
+ GraphServiceClient graphClient = await SignInAndInitializeGraphServiceClient(appConfiguration, scopes);
+
+ // Call the /me endpoint of MS Graph
+ await CallMSGraph(graphClient);
+
+ Console.ReadKey();
+ }
+
+ ///
+ /// Sign in user using MSAL and obtain a token for MS Graph
+ ///
+ ///
+ private async static Task SignInAndInitializeGraphServiceClient(PublicClientApplicationOptions configuration, string[] scopes)
+ {
+ GraphServiceClient graphClient = new GraphServiceClient(graphURL,
+ new DelegateAuthenticationProvider(async (requestMessage) =>
+ {
+ requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", await SignInUserAndGetTokenUsingMSAL(configuration, scopes));
+ }));
+
+ return await Task.FromResult(graphClient);
+ }
+
+ ///
+ /// Signs in the user using the device code flow and obtains an Access token for MS Graph
+ ///
+ ///
+ ///
+ ///
+ private static async Task SignInUserAndGetTokenUsingMSAL(PublicClientApplicationOptions configuration, string[] scopes)
+ {
+ // build the AAd authority Url
+ string authority = string.Concat(configuration.Instance, configuration.TenantId);
+
+ // Initialize the MSAL library by building a public client application
+ application = PublicClientApplicationBuilder.Create(configuration.ClientId)
+ .WithAuthority(authority)
+ .WithRedirectUri(configuration.RedirectUri)
+ .Build();
+
+
+ AuthenticationResult result;
+
+ try
+ {
+ var accounts = await application.GetAccountsAsync();
+
+ // Try to acquire an access token from the cache, if UI interaction is required, MsalUiRequiredException will be thrown.
+ result = await application.AcquireTokenSilent(scopes, accounts.FirstOrDefault()).ExecuteAsync();
+ }
+ catch (MsalUiRequiredException)
+ {
+ // Acquiring an access token interactively using the custom html.
+ result = await application.AcquireTokenInteractive(scopes)
+ .WithSystemWebViewOptions(_customWebView) // Using the custom html
+ .ExecuteAsync();
+ }
+
+ return result.AccessToken;
+ }
+
+ ///
+ /// Call MS Graph and print results
+ ///
+ ///
+ ///
+ private static async Task CallMSGraph(GraphServiceClient graphClient)
+ {
+ var me = await graphClient.Me.Request().GetAsync();
+
+ // Printing the results
+ Console.Write(Environment.NewLine);
+ Console.WriteLine("-------- Data from call to MS Graph --------");
+ Console.Write(Environment.NewLine);
+ Console.WriteLine($"Id: {me.Id}");
+ Console.WriteLine($"Display Name: {me.DisplayName}");
+ Console.WriteLine($"Email: {me.Mail}");
+ }
+
+ ///
+ /// Returns a custom HTML for the authorization success or failure, and redirect url.
+ /// For more available options, please inspect the SystemWebViewOptions class.
+ ///
+ ///
+ private static SystemWebViewOptions GetCustomHTML()
+ {
+ return new SystemWebViewOptions
+ {
+ HtmlMessageSuccess = @"
+ Authentication Complete
+
+
+
+ Authentication complete
+ You can return to the application. Feel free to close this browser tab.
+
+
+
+ ",
+
+ HtmlMessageError = @"
+ Authentication Failed
+
+
+
+ Authentication failed
+ Error details: error {0} error_description: {1}
+
+ You can return to the application. Feel free to close this browser tab.
+
+
+
+ "
+ };
+ }
+ }
+}
diff --git a/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/appsettings.json b/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/appsettings.json
new file mode 100644
index 0000000..070f49e
--- /dev/null
+++ b/3-desktop/console-html-browser/Console-Interactive-CustomWebUI/appsettings.json
@@ -0,0 +1,7 @@
+{
+ "Instance": "https://login.microsoftonline.com/",
+ "ClientId": "[Enter the Client Id (Application ID obtained from the Azure portal), e.g. ba74781c2-53c2-442a-97c2-3d60re42f403]",
+ "TenantId": "[Enter 'common', or 'organizations' or the Tenant Id (Obtained from the Azure portal. Select 'Endpoints' from the 'App registrations' blade and use the GUID in any of the URLs), e.g. da41245a5-11b3-996c-00a8-4d99re19f292]",
+ "RedirectUri": "http://localhost",
+ "GraphApiUrl": "https://graph.microsoft.com/beta/"
+}
diff --git a/3-desktop/console-html-browser/Console-Interactive.sln b/3-desktop/console-html-browser/Console-Interactive.sln
new file mode 100644
index 0000000..bf66cc9
--- /dev/null
+++ b/3-desktop/console-html-browser/Console-Interactive.sln
@@ -0,0 +1,25 @@
+ο»Ώ
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.29709.97
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Console-Interactive-CustomWebUI", "Console-Interactive-CustomWebUI\Console-Interactive-CustomWebUI.csproj", "{509D5688-3BD1-4650-8A43-3CEF5B64198E}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Any CPU = Debug|Any CPU
+ Release|Any CPU = Release|Any CPU
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {509D5688-3BD1-4650-8A43-3CEF5B64198E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {509D5688-3BD1-4650-8A43-3CEF5B64198E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {509D5688-3BD1-4650-8A43-3CEF5B64198E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {509D5688-3BD1-4650-8A43-3CEF5B64198E}.Release|Any CPU.Build.0 = Release|Any CPU
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(ExtensibilityGlobals) = postSolution
+ SolutionGuid = {42EE218E-9522-4DBA-9DFE-2EC0FB0CD3D5}
+ EndGlobalSection
+EndGlobal
diff --git a/3-desktop/console-html-browser/README.md b/3-desktop/console-html-browser/README.md
new file mode 100644
index 0000000..9b1b631
--- /dev/null
+++ b/3-desktop/console-html-browser/README.md
@@ -0,0 +1,255 @@
+---
+services: active-directory
+platforms: dotnet
+author: TiagoBrenck
+level: 200
+client: .NET Desktop (Console)
+service: Microsoft Graph
+endpoint: Microsoft identity platform
+page_type: sample
+languages:
+ - csharp
+products:
+ - azure
+ - microsoft-entra-id
+ - dotnet
+ - office-ms-graph
+description: "This sample demonstrates a .NET Desktop (Console) application calling Microsoft Graph using custom web UI HTML"
+---
+
+# Using the Microsoft identity platform to call Microsoft Graph API with custom web UI HTML.
+
+
+
+## About this sample
+
+### Overview
+
+This sample demonstrates how to use a custom web UI HTML on MSAL.NET.
+
+1. The .NET Desktop (Console) application uses the Microsoft Authentication Library (MSAL) to obtain a JWT access token from Microsoft Entra ID.
+1. Once the authorization request is finished (successfully or not), the customized HTML will be shown and the browser will return the response to MSAL.
+
+### Scenario
+
+The console application:
+
+- gets an access token from Microsoft Entra ID interactively using a custom web UI HTML
+- and then calls the Microsoft Graph `/me` endpoint to get the user information, which it then displays in the console.
+
+
+
+## How to run this sample
+
+To run this sample, you'll need:
+
+- [Visual Studio 2019](https://aka.ms/vsdownload)
+- An Internet connection
+- a Microsoft Entra tenant. For more information on how to get a Microsoft Entra tenant, see [How to get a Microsoft Entra tenant](https://azure.microsoft.com/documentation/articles/active-directory-howto-tenant/)
+- A user account in your Microsoft Entra tenant. This sample will not work with a Microsoft account (formerly Windows Live account). Therefore, if you signed in to the [Microsoft Entra admin center](https://entra.microsoft.com) with a Microsoft account and have never created a user account in your directory before, you need to do that now.
+
+### Step 1: Clone or download this repository
+
+From your shell or command line:
+
+```Shell
+git clone https://github.com/Azure-Samples/ms-identity-dotnet-desktop-tutorial.git
+```
+
+or download and extract the repository .zip file.
+
+> Given that the name of the sample is quiet long, and so are the names of the referenced NuGet packages, you might want to clone it in a folder close to the root of your hard drive, to avoid file size limitations on Windows.
+
+### Step 2: Register the sample application with your Microsoft Entra tenant
+
+There is one project in this sample. To register it, you can:
+
+- either follow the steps [Step 2: Register the sample with your Microsoft Entra tenant](#step-2-register-the-sample-with-your-azure-active-directory-tenant) and [Step 3: Configure the sample to use your Microsoft Entra tenant](#choose-the-azure-ad-tenant-where-you-want-to-create-your-applications)
+- or use PowerShell scripts that:
+ - **automatically** creates the Microsoft Entra applications and related objects (passwords, permissions, dependencies) for you. Note that this works for Visual Studio only.
+ - modify the Visual Studio projects' configuration files.
+
+
+ Expand this section if you want to use this automation:
+
+1. On Windows, run PowerShell and navigate to the root of the cloned directory
+1. In PowerShell run:
+
+ ```PowerShell
+ Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process -Force
+ ```
+
+1. Run the script to create your Microsoft Entra application and configure the code of the sample application accordingly.
+1. In PowerShell run:
+
+ ```PowerShell
+ cd .\AppCreationScripts\
+ .\Configure.ps1
+ ```
+
+ > Other ways of running the scripts are described in [App Creation Scripts](./AppCreationScripts/AppCreationScripts.md)
+ > The scripts also provide a guide to automated application registration, configuration and removal which can help in your CI/CD scenarios.
+
+1. Open the Visual Studio solution and click start to run the code.
+
+
+
+Follow the steps below to manually walk through the steps to register and configure the applications.
+
+#### Choose the Microsoft Entra tenant where you want to create your applications
+
+As a first step you'll need to:
+
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using either a work or school account or a personal Microsoft account.
+1. If your account is present in more than one Microsoft Entra tenant, select your profile at the top right corner in the menu on top of the page, and then **switch directory**.
+ Change your portal session to the desired Microsoft Entra tenant.
+
+#### Register the client app (Console-Interactive-MultiTarget-v2)
+
+1. Navigate to the Microsoft identity platform for developers [App registrations](https://go.microsoft.com/fwlink/?linkid=2083908) page.
+1. Click **New registration** on top.
+1. In the **Register an application page** that appears, enter your application's registration information:
+ - In the **Name** section, enter a meaningful application name that will be displayed to users of the app, for example `Console-Interactive-MultiTarget-v2`.
+ - Change **Supported account types** to **Accounts in any organizational directory and personal Microsoft accounts (e.g. Skype, Xbox, Outlook.com)**.
+1. Click on the **Register** button in bottom to create the application.
+1. In the app's registration screen, find the **Application (client) ID** value and record it for use later. You'll need it to configure the configuration file(s) later in your code.
+1. In the app's registration screen, click on the **Authentication** blade in the left.
+ - If you don't have a platform added yet, click on **Add a platform** and select the **Public client (mobile & desktop)** option.
+ - In the **Redirect URIs** section, enter the following redirect URIs.
+ - `http://localhost`
+ - In the **Redirect URIs** | **Suggested Redirect URIs for public clients (mobile, desktop)** section, select **https://login.microsoftonline.com/common/oauth2/nativeclient**
+
+1. Click the **Save** button on top to save the changes.
+1. In the app's registration screen, click on the **API permissions** blade in the left to open the page where we add access to the Apis that your application needs.
+ - Click the **Add a permission** button and then,
+ - Ensure that the **Microsoft APIs** tab is selected.
+ - In the *Commonly used Microsoft APIs* section, click on **Microsoft Graph**
+ - In the **Delegated permissions** section, select the **User.Read** in the list. Use the search box if necessary.
+ - Click on the **Add permissions** button at the bottom.
+
+##### Configure the client app (Console-Interactive-MultiTarget-v2) to use your app registration
+
+Open the project in your IDE (like Visual Studio) to configure the code.
+>In the steps below, "ClientID" is the same as "Application ID" or "AppId".
+
+1. Open the `Console-Interactive-MultiTarget\appsettings.json` file
+1. Find the app key `ClientId` and replace the existing value with the application ID (clientId) of the `Console-Interactive-MultiTarget-v2` application copied from the Microsoft Entra admin center.
+1. Find the app key `TenantId` and replace the existing value with your Microsoft Entra tenant ID.
+
+### Step 4: Run the sample
+
+Clean the solution, rebuild the solution, and run it.
+
+Start the application, sign-in and check the result in the console.
+
+> [Consider taking a moment to share your experience with us.](https://forms.office.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR73pcsbpbxNJuZCMKN0lURpUREhEVDBOTFBMUVRPUElBUE5WMjdPQ1RaMiQlQCN0PWcu)
+
+## About the code
+
+MSAL has the class [SystemWebViewOptions.cs](https://docs.microsoft.com/dotnet/api/microsoft.identity.client.systemwebviewoptions?view=azure-dotnet) which allows you to set properties to customize the UI after the authentication request.
+
+In this sample, we customized the HTML for successful and failure authorization requests, but more options are available. Please refer to the [SystemWebViewOptions.cs documentation](https://docs.microsoft.com/dotnet/api/microsoft.identity.client.systemwebviewoptions?view=azure-dotnet) for more options.
+
+1- Customizing the success or failure HTML message:
+
+```csharp
+private static SystemWebViewOptions GetCustomHTML()
+{
+ return new SystemWebViewOptions
+ {
+ HtmlMessageSuccess = @"
+ Authentication Complete
+
+
+
+ Authentication complete
+ You can return to the application. Feel free to close this browser tab.
+
+
+
+ ",
+
+ HtmlMessageError = @"
+ Authentication Failed
+
+
+
+ Authentication failed
+ Error details: error {0} error_description: {1}
+
+ You can return to the application. Feel free to close this browser tab.
+
+
+
+ "
+ };
+}
+```
+
+2- Using `.WithSystemWebViewOptions()` on the `AcquireTokenInteractive` request, passing the customized SystemWebViewOptions object so MSAL can use it to display the response.
+
+```csharp
+var app = PublicClientApplicationBuilder.Create(appConfiguration.ClientId)
+ .WithAuthority(_authority)
+ .WithRedirectUri(appConfiguration.RedirectUri)
+ .Build();
+
+string[] scopes = new[] { "user.read" };
+AuthenticationResult result;
+
+try
+{
+ var accounts = await app.GetAccountsAsync();
+ result = await app.AcquireTokenSilent(scopes, accounts.FirstOrDefault())
+ .ExecuteAsync();
+}
+catch (MsalUiRequiredException)
+{
+ result = await app.AcquireTokenInteractive(scopes)
+ .WithSystemWebViewOptions(_customWebView) // Using the custom html
+ .ExecuteAsync();
+}
+```
+
+3- Once the authorization response gets back, the opened tab will display the custom successful or failure message.
+
+Success custom message:
+
+
+Failure custom message:
+
+
+## Community Help and Support
+
+Use [Stack Overflow](http://stackoverflow.com/questions/tagged/msal) to get support from the community.
+Ask your questions on Stack Overflow first and browse existing issues to see if someone has asked your question before.
+Make sure that your questions or comments are tagged with [`azure-active-directory` `msal` `dotnet`].
+
+If you find a bug in the sample, please raise the issue on [GitHub Issues](../../../../issues).
+
+To provide a recommendation, visit the following [User Voice page](https://feedback.azure.com/forums/169401-azure-active-directory).
+
+## Contributing
+
+If you'd like to contribute to this sample, see [CONTRIBUTING.MD](/CONTRIBUTING.md).
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information, see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
+
+## More information
+
+For more information, see MSAL.NET's conceptual documentation:
+
+- [MSAL.NET's conceptual documentation](https://aka.ms/msal-net)
+- [Microsoft identity platform (Microsoft Entra ID for developers)](https://docs.microsoft.com/azure/active-directory/develop/)
+- [Quickstart: Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app)
+- [Quickstart: Configure a client application to access web APIs](https://docs.microsoft.com/azure/active-directory/develop/quickstart-configure-app-access-web-apis)
+
+- [Understanding Microsoft Entra application consent experiences](https://docs.microsoft.com/azure/active-directory/develop/application-consent-experience)
+- [Understand user and admin consent](https://docs.microsoft.com/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#understand-user-and-admin-consent)
+- [Application and service principal objects in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/develop/app-objects-and-service-principals)
+
+For more information about how OAuth 2.0 protocols work in this scenario and other scenarios, see [Authentication Scenarios for Microsoft Entra ID](http://go.microsoft.com/fwlink/?LinkId=394414).
diff --git a/3-desktop/console-html-browser/ReadmeFiles/failureMessage.png b/3-desktop/console-html-browser/ReadmeFiles/failureMessage.png
new file mode 100644
index 0000000000000000000000000000000000000000..8d682a4c237ec1cdeb55b45f364a3448140fd512
GIT binary patch
literal 50277
zcmd@6byOQ+*FKE4g(AhFxEC)F+^u+9inX}ATd)wcxNET%_fp)0ySrO}BEj7P1o`Om
zyzlq-`RknX{l2v(D{Cf``<{EYUHjU5CR{~H9_tO+n-?!$V14>1^Yz6GB-$4*Uh1Kt
zJReybt?GULdg=02Ug|~p7{%W64zi`BqU4JgRk0ZN#;>3E(VaeOyS#XT@A~iaa@B&`
z4UcCM=QSc2}Cp3sg#$o-aDO+Jm%M9ilf@GNW
zLlZZM`YgfQyC7S}qe*v4tL
z!tnv~()DYy#O#%W(_{2TM`I-MB@G66#_#^N(OYN3P*zfqdlKULe#@xP{FBWmtk2HW
zQaj5DT$|m_fz#`0(+h|`nM?aMoN@a<@jGp6Gnyy8=X*%FK;2iq7h@7Y)l8=Q9AcE%
z#AZ+NmEZ^G`S9}%Lgpld`g5Z2datck2#?w^!Sg(l{{KWR$jAI^38R&%
zEtKy3OGi3~($LW<#03L3sy%JsK#E-7%-aV%({u`4P2La-nDND<&CDDZXJ11N-|vM+Ol|2rc~cl<0$
z|I`QtL8T32HZXRhX#$-9;I7Z>>W0L9wQKlE!phjj8jJO8&3Jatx*KMjY{BvX~D<49k?PrYr9Kk}A-xXq4i9fcyH=$+}hlw3ry2M@=i)0}rSh
z3^x5S!IE2txkiSUac6vUDQfp
z=V4bK34LST=Zu~xlDIvDuj$Y>mbPw8_@hc*=ba;Z(^eoH#;j6GNNr|d%OYwE4QG!b6{J0J;1
zusMaDjBr%XeO*-dEqNm(@ijBmb-K==+_EU0v2ifwU)aphWU`Z!Wi`7UaTkgfj!0$j_4bFI<1eRWMwTcRkeiAG#ykFsk7t7|NXq3G@!hb9
z+Be-Ek>|!f_b4}u2hP4^N7jx_kd4hzUR%q~&XK1CW~BGd{dN@&Km>k$@u>OvjwG4ALAk);C_lg9fix4eWeC?s*`
zsh%TP58r24O7m7`yubePaBE4tj~1uNyNLTLiX*{<=&dt_Umg}5$KSUYbNaiZbpv7E
zw-od!TNH$wNh2>Zd#Am}?OWrIL4}l(*V2A{g~Rp1%el5KZn*}fOEE~!n&tv?i)=r{
z&sRlgq0j~Yr<}}*i&f#n#OC+r3k`F>+ENk6GN_FwIfZEBJrdvNU$L`QDJe;1Pk-Z(
zyiR{Xgrc6__cL3F8ZF>P{KG$wm#21IXLwU)i5jWxex-5`y0?yn!f}J+FCr@2n~2;@
zB8*pfyZ5T*Xs>oOzx2Io4W<-(c>r@mb+IE_lqQ?Af)g&^p-)r@s~TRD`SMi_^i5z&
zKSh}@XtQjpYes&iDvEkEJ_k{D36Y(7BAF_d%0#D!=5m9dYWgd!V^-*23F}pT9AAt5
zRr8MB5@MdWq$%`AzyTbR*@9t4*mtpH)=Y;9`(CZ%fU_3f0(+l)esO(>jbvg7
z0VDtu7vVKCZ62Q`At^q5t&xqAe`C;`mf-2iqC@!^xj;7lMai%eELgLqZV^z?2P?7=
z8Vxw+gpD=^q+8qskDtdA!Q@=^-h6#Z420Q&ayJYMZtSxkCMk*~JF}*Y+~B!!8XmX@
z7KPcCiBXzXB)J~x7Ud#gUAzZ9{X3DFJ*D0*Omvpe;^2iwvp2_&#VvjZS=mq1j+=aG
z#X$8YQ>8PameWW8q_|GdAv)_aD*&|W{qc5o0KJsY<4tt_yirtQvq6N)Wurib`m%WS
zw&DH5Zl0p`Y(36#!%axRjaK`8)6u(NI^ao0p|kik6}Nq1WaQ^z`7_o$QFB5vqTok@
zbCvWgi;P^)Zr2v73Cni?jN9G;0`5N+EzVDwEF4C|#}xDng73%++gFhdbDv{wo9;ir
zva!S<`jSIKWAksa`ORJV1FPGckCkGgCYH{MJYaW0u2*v
z%)-q+cLZ*^p871&9O2gQm__#L0NFBr7m+b2{xZy*P53(;ji>_pdc9
zd-4B=B%mw5X|T#1wooL4RbTP4WDhE1t?xEpY3@Ku}}g;
zNi5Sf8v6grmrg&l!CC5AWetMyZ4KEVp_iPlX$0%_+B+|aNCQ2Vqws1wJKi4b-d%tX
zDCXXCZT5Y`!9JzM$k~m*5iA905cq^Y!=M}Ne?a?LP1m6$l#Y9C&d4VZj4v~~yKyI3
z&`oQct4xMprdzoe_&rpmvav7t~p*
zf1AQTdit=?8LQJDY^N3au)!lYD7>XDZXDI~*T7km&YhF0E^2(B|N6nC-#5PN=^5C-
zdE0tkHXDBxFmyag|Fk5x5S1fbML?+TyvEetk)gj;P9S!?)wFc|)u@U@hA8?0WBGZ$VJVq95put@4{nh}IC&?XO1*{xjp!H%?l%hV>$0P=C>
zDR-QJN6JJg;xt`cDV{M5jToyTV4`@)l6vC*b?u>mYf~it`dIx1vMW`krZ>&FDCT&r}8~E
zP9A$zZB|*l#0;a=MmhP%0e(uW>)n-xgD`}gR@p3eqiV{_z`L&tBo3&X@zUTA@@E-`7wChh|&2xsW
zG}0Ro@S^ne*DJQvl7oKdN951R;~l34(x;jQ%8#(GkvvQ=2b$VPbkD+j6vwv|vPX+#
zhifeqLVjd{Jys2Fm;o^tvU@l1lnA6pGP43PhdM-JRT;%2=D~-fPxs%B_xH%{9fJ%<
zT^lcmot69Lsn_Wm4>}*vP(;8uVkq6!9(T8PBZKv0O4pGns3soa<3hXoNQ~c)WDi0~
z$=%TnYhJ!LZpc?2f$7}MuUS!!#A0a`VfLNH{;_EuctR5};P?mdz5f$UYoIZRq6J@!
z&gEjiOPAndvbPUhg#0xVuU5VRvwDr9Z7$1|~1!rX5wH~A+
zU!)t}hyz->mf8OeBiKqARI~R#48k@>F8qirQarnJM3?
zh}JYMi5pzaYCVjgX%Qd0)3HCiyy0p-QU8e3BepQ185M$ca@q#(Zn6o*(>%}EeGebK
zgm4fhQ$;XUb8W+AujRlG4kJh8{!01@oY#wNTjg5)2SY$_%8o6}9nGlDT`0G%_HT~i
z-h9ha*3oRlN6eN(12E8|!@}J6jG>m^g+>@NH2^w}{TCw6wbQnJRr2D3`Y3{m;OM{?
z9*?AWQ1Q&U2zERppFW|%xqMl!9PD2fktTb#%7b3ILUqoyqkP^jz15fZ+#0$}QW@ra
zh{%PJd`?8=P;%cKGbl0rE;Smo80=EDz~rno`Dg=nl%y;vTOE(sjy8j0)))|Ebz=|3
zdB$*1SzryHWSwu*Qkha6{CZP=LEXFnmX-@Br8uf?9P7=MAKm0u%S&{TKHu90oBBrhwAqrUOuA;UrI#5a
zE~d3h14UyEtdoM|fUaER7KkW0hw{l0A)C&4x@UJq^$#fokar~6!EOqjWc1i*i`4k?
z)16$2UafplLfiSP)Ebj8)45}0ARYe@q5@!IPT>SO71G7mkmF2nIg#r073dA}Alr
zq^MNtD#zOl3iBep4Qkg&sK1TlO`Va5;fbq?ePA8+DCCvojL|H5@o
zWsQkKmK42UNGS-wV`-q4(3m`#6zbph_bXsIXrRp>THT5Q!4zH$mT0Y6z2b
zePds)fly^=iIAS8k9A1Gy-qG2Yh89T;O7(A_x&HJYiz;R1PIX$+u^c-mOvq4QO$k(H*VE(5PX3Di0P+^Q!?A1mavo(4Vq97&UJwEwY3
zy#ExW>%&1zd&kK5pR>`b46URKrl?O*l3(&C1<@m;B=tVOe@v`-BNFQq7|2?*Nld9b
zZ1^B4EZWa+tSa|r!xau{%)4#niL0?;icxp$y3CSAwt|NBz9}+=bvioP?Y!T*XCY((
za)r64iK3>EPjUf2ej1fq-R4dgy#8r8j_(*Fv1S;QJ{TV272(m}Q$Rzv!*coPFKV5u
zIRAD8>WW`yo)(|NzCnoPQ#(^z^v;V^86kigFOY-tuAFoj@Ky{(1e2B8UE)sIJG~lr
zl^8CvV&R0-ZqCAM6UN4BFlXZPlf+c}?DO~3RGFy3vF`0^opdNKfpjjJs+K*9(Osbp
zpkz2sjB!$BUPerT;z#s-HNip_oY?^523>_oF3RUS74#|CQ#(=e)KyD*0HdhettLN)h*-t9e6?@&9G}fd#gE{e6VtUTC{
z!TEvZBojRk2lSRV_e^M{@TZACt)eYUHwG!N*OjfZ5D1V!YnJ72t{{lgse2Ty(TzqY
z|5OnjM9Q1$r9mtvvDOb0XbR1nX&ZDD%yMjY
zO{p6_%~0SvUd>}kI)8Zfk>#TQqRuNp2w_UhppT>(ac#?m
zJD8>z8mXY}oJAAXHyQ9t|5=@1{u}vK%DLsb$(iPP7;8w7<)qE2tlmh5sjCu-lH6__
z_IbxpFZ_`jaFl}jD)e-0CAxHl_wdwp#c4mr%^3&a`!z@*6udRA|3c^Sg%x=q5z>#z
z^BC&E4(#;ej$Sw0j%&^D8R8|G7+6TY(ATtLo0ES)iJoIoLV(Xp%l6x5N%mu8ab=t!DqYc76-cjS
z=(gMip1d%0T)BmC5%9kW&{pn7Nl5h}V+OnCD^PAMy{fM9Z=sv4{;k35cJ}f0TcNdiYpl1AOmD7bLDis=kLx
zJaANsW&NG99bfM%3f;Q3*qSlW8+dSZ^yEdA`O8w20#0{vs=80V&v|L{NIMOQCx2=p
zEgj2vB|vUP0Y0t--n
zLtO#2eZEr`dB0K)VupV_QzgUyDL@G$hB_|mbzDKUanu-6O)JLfjXMY9z`bl}JHAjO
zcFG&j0VWd;PZy{eupbU}csF
zZ(149S{Qq?%hs>AKpLw@TBVsh<$RTAG@!4-@LpW2EZW5+2ixueU(ZVE7B|FmOsdjU
zxW7Am2?=s}EULG#5_h43b-f;eGUY+W<_G2(!vzIz)eNl7udT;uA>HbZQ|3OwVlsQV
z2&VDc{S}(MeI7T!+O-si`Ome!jb8=kjPl0<H0kiEh*rxmyPL7wN;lBW0dDyMv(
zwOSL_YD9R@DT)Grddcn^m8`!sWJ+h}NSpfj+FDJbHmXgP%ELI6
z-=A`lbnV!|3M@~*)`-V`$Cv|K;W9!*`t$6MznaviyTm)w#n-Vi-G1uD+TmW&RcD;S
z3yJf`$(hYFoj6}@p4iwXGD-?{9eXWs2{_-mgv=fo`RGPPDu}E4evOBF?5fsMa3ixf
z-KUZ(5_Sko36@A;U;E)%EnfBSS9MfCW-d6B?gjY5Zkz+}4kq8#=i#Ts?fQSdliHUM
z*pA%|xSFX*T$}O6r|2%I^MbW~mtb|L(Sg$72-&TOKrS1{mTXCb;}Q+?W={=sVShb>
z^x%XXh8dmAQNxjxljlVOCH>79PQWw=Pi^4C0B=x?2QE8mZ(cAWmqkoZyvxMwr=f+m
zfggGMW05e^jUb?Hm@=-yb!|h+FDkBQ(u!{bkI!#;4f(plnF?z!nEP>}8>(`=ioxzG
zmKxr|
zzgINz`M$8=r21TY%IJ}godE;E+@0W0|?#sa*UiZ6*w4N$;YW`T5N>$2LhB
znIO?=(TNn?=NNSBE&xJvm6IO^pzRfAh0Kp)ot8Trer=*AegGRI^tqhabe`9R+Z$^W
z9d|rvwb(yXcBod?iDI%`PtuNZ<)hUa%I$&&8gba`r3??nbN+Ex({-!}*`1-2&3oD`
zgkVY!izu3Y{qk%TLry>@fdR2oSLpCXp@;x9$?O4_9VL2uj6^xHnE)jIV{&7ix3;OM
zhD^^1@nFSw2doV{@Q+LL`yMALYS{F#B*~C^%7pJ3xKkJc)ci
z&%+yW2C=>MTK-UbcO_$B(9}t@0|6S;>QV`w5d=k%j9}_M)^n5RnGcG}YvaSlP(Q
zyoqy-6|saY-qpZo9*XEcJXFZh!t275CRbg{+PLcgxsPy?m1VWDMoOdRay1TmGIo>G|h5C%Fj
zsVMbXclF@(I8#ESI|D8DX1e@}+Y&X_+Ap{4Qs1&V3Y|jM2R}Ok?UaXvg6QW35`txt*je0EssYA
z^rIc!4CQ_$u+n5{?-9!hZMkI!GkEFd^d4&tl*6?N6@{RW3=91l;PxUu5^x+If++?2G#XktyBCe
z=!ID?G5L&69wlZZELQ*yb8evZ$_gxEGV5DM(UYyV%ru|pAR=_^BVFcnF*;Ub_`2)$
zF)t-d?jgim&%=iw;9zZp@|$rzyDANrDc`3QTC?u1uPM?gWY8xMYojcC8l7XtZtOh7
zM2@G~xhUA@fMuH5#@JK-_H&8Gq`BSCpLzYnJsNb46m-8}%-C9Q-y6#Mj8cIA<$8zk
zH!qvJ8gHC_MX$$)D;TC4&{4ndF0dfa_aY4n<=enIkflaiB=49{10LHg^uhko2LwNVYE9mk|A#>
zR_ws(!!nI#qwUjw>s=ggC?IBdKF0FY;$$hJcdYYQLhw-zx2Nvazb2AsXX_KC#(6Y=
zFLr(RWuX`@U=M|uKodaR*410^9D&IlwTsx>a@Wt@_`(;|)5f3EoaoT!<`xK}(07Fb
ztmr@2Sggy7y8!LO#46qCq+qR{BR||bFA0A0$&QjBIYHl)Il#u)A8XGwKLnSQ3Cg>z
zo!D&H%~}qu!zc=!3si$BA_@3A5^Td2|04#aE#13cPw2K(nyucN=_2`vt5ywwhKji<
z;hi)o^tT1d@En5vbx}cx7F!hrjvVNO`Y3FL>PU(orxi$J{DS6jUG_03wa>JQ>>&t8_>YGthvpM5
zGH_Pxw9d|R;c|}X8v{JmF?jA6=cgO&0C;W
zI`Z1{VDHsJ{cQB{JHKAs#Yx`YL*Gom0Wov^t=r7_&q$0&%?*=5Up?Uhw?hH=*$#L{
zQa4W~aP6eT$d%HjcX)u;baAx~;XWnYsYWoK5y(Tn{-zGT0bf7
zM~S{UmS9bDSANAG>FFC7X)C~c$NK&`_n`idRz^EEd{5eoj^szRc)f
z*Mo%e-(VN!Q+t+Hc=khU1r_UER7WmFBWo#sk$0Lzf2G7L=n6!m%5~L0X8HD2i+>AH
zaBL5ZG#pZPvV89Z+%p7Pw^tOGp$9-T{$*9=Tnm{GeRYx!5G3~d>dCH&4gTrn-HL|4
z_zlK<1_ys6nSo|LMe#C)5Y(yHmA!llhY2@K28@V^m6JLBkekA|ap8Sm*sJfLC
z){jWLr*fg>_7K!@g(y)00lrw*d&7`8^Y=J7#`nLP&ATV2Yn>Q&PT%XLvs$R6g<$yk
zkRMh?bAkI>jz4`%GDofTbYhme#7K@LT-5{yYW=8aSVI-bIXGY<;-xsN9MvJz#D8w=
zNEwc{61v$zLr)3~;4wEEHc%P!R3yRIGdB)
zw@TA#`ULYJxyby^^Nyd%t$y3yS)S5QNsKwNT|caTc4V*_0_V|oz;o$+_6>rYx_)9i
zNTid`xrexLyhyBXsp8Z*V-UTPOo_oSNod4Qe>>fl1$AGp^C$;i?s%xFp-!QrLv{82
z+4zJFlsO3E7L!D
z-yOR%@deSAQDr!Rmec7
z*6uM&p(B5+nDtO~%dJxF=LfoRYJlkq_;GiWVQP~lkIU+IbDJ%XF~9h{k!9BjXIz9T
z#p`5ye3QH4iQ6POrL$p>`f|Y2tO&`s>tL2+3RjpGoz~3fnI=$vZkm0t*t{5*knfM7
z1U_8do$UUX9(#`IpVEa~PzVVLcjwB|{(;2i|KU2HyBh!hrziIRdU+=YsqQEMs>6_?VF>&lxIvrMHUHQvC2-Kd_JR0kY
z*-L$Eo<>ijZsyVs$*s`p&&OeN@kpnjwjf-rJmyWWICdQLjpqFO(e+)CGgEK&*yk{z
z7ZC^4<=&=fVUDf9cK5q~a}8N>GR1kk9AmT${V;wUdp1Pn8%@4&Q3R?i&WUV#!k;cw
zrGv(5W5q<#^=w7?Cm~pS_gSYDsqU0v>pB6^aGV)
zV%}F?bQfCQlc9_H-ml*jtc$Ku9Y;~W*97X{JWB754BPkh6NcS@|J)&NB+)8vNO%$)
zrFYP81sS_Nf3tM)_}pz&wP$o7`5D9n1c-i#SPDv^BLAL$+Z=6OT-I~^wSy25#)a)1
z85_5bd}Th+TEUv|q!+Vbd69?^_v-f@`FtFKa2^G#1?F1bIf*@r>*2IV!Cnuaopbnu
zn672BEFAi(s{rvU%$CtGKU29m
zqSk3ej=y_!Q&cznvhFou&wbYO%`RmTWuR##PQQk+
z3_a70@SUBzakGHH{B}y*4TTdJA3OD^-dCy?^W(pgK~Iw0Lw)RN0|B%}@pB&%4i3_D
z4~cD-M>}BQYdaQoF){6}e<&9w6DPb*d7?wTK1dF$HvnfRTO`J4EMMU7(SmwR^vTh>
zUsjKw@@|yMRemUcRlDTeG!$8a8{?!Ley|)Zwv2JM1a=s^cfiMA8gL=YQ6;&9ve9pf
zYP2Mt966}9VUD-^P^}nxkP-+Vm=G3<%`Ro)1Ay4kUg3s&J!
zkFLGw5e