new repository

1 files changed, 48 insertions, 0 deletions

diff --git a/devdocs/docker/engine%2Fextend%2Fplugins_authorization%2Findex.html b/devdocs/docker/engine%2Fextend%2Fplugins_authorization%2Findex.html
new file mode 100644
index 00000000..89f8c6f3
--- /dev/null
+++ b/devdocs/docker/engine%2Fextend%2Fplugins_authorization%2Findex.html
@@ -0,0 +1,48 @@
+ <h1 id="access-authorization-plugin">Access authorization plugin</h1> <p>This document describes the Docker Engine plugins generally available in Docker Engine. To view information on plugins managed by Docker Engine, refer to <a href="../index">Docker Engine plugin system</a>.</p> <p>Docker’s out-of-the-box authorization model is all or nothing. Any user with permission to access the Docker daemon can run any Docker client command. The same is true for callers using Docker’s Engine API to contact the daemon. If you require greater access control, you can create authorization plugins and add them to your Docker daemon configuration. Using an authorization plugin, a Docker administrator can configure granular access policies for managing access to the Docker daemon.</p> <p>Anyone with the appropriate skills can develop an authorization plugin. These skills, at their most basic, are knowledge of Docker, understanding of REST, and sound programming knowledge. This document describes the architecture, state, and methods information available to an authorization plugin developer.</p> <h2 id="basic-principles">Basic principles</h2> <p>Docker’s <a href="../plugin_api/index">plugin infrastructure</a> enables extending Docker by loading, removing and communicating with third-party components using a generic API. The access authorization subsystem was built using this mechanism.</p> <p>Using this subsystem, you don’t need to rebuild the Docker daemon to add an authorization plugin. You can add a plugin to an installed Docker daemon. You do need to restart the Docker daemon to add a new plugin.</p> <p>An authorization plugin approves or denies requests to the Docker daemon based on both the current authentication context and the command context. The authentication context contains all user details and the authentication method. The command context contains all the relevant request data.</p> <p>Authorization plugins must follow the rules described in <a href="../plugin_api/index">Docker Plugin API</a>. Each plugin must reside within directories described under the <a href="../plugin_api/index#plugin-discovery">Plugin discovery</a> section.</p> <blockquote> <p><strong>Note</strong></p> <p>The abbreviations <code class="language-plaintext highlighter-rouge">AuthZ</code> and <code class="language-plaintext highlighter-rouge">AuthN</code> mean authorization and authentication respectively.</p> </blockquote> <h2 id="default-user-authorization-mechanism">Default user authorization mechanism</h2> <p>If TLS is enabled in the <a href="../../security/protect-access/index">Docker daemon</a>, the default user authorization flow extracts the user details from the certificate subject name. That is, the <code class="language-plaintext highlighter-rouge">User</code> field is set to the client certificate subject common name, and the <code class="language-plaintext highlighter-rouge">AuthenticationMethod</code> field is set to <code class="language-plaintext highlighter-rouge">TLS</code>.</p> <h2 id="basic-architecture">Basic architecture</h2> <p>You are responsible for registering your plugin as part of the Docker daemon startup. You can install multiple plugins and chain them together. This chain can be ordered. Each request to the daemon passes in order through the chain. Only when all the plugins grant access to the resource, is the access granted.</p> <p>When an HTTP request is made to the Docker daemon through the CLI or via the Engine API, the authentication subsystem passes the request to the installed authentication plugin(s). The request contains the user (caller) and command context. The plugin is responsible for deciding whether to allow or deny the request.</p> <p>The sequence diagrams below depict an allow and deny authorization flow:</p> <p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfoAAAIECAMAAADGuxyPAAAAnFBMVEX///8KCgoGBgYZGRmHh4d4eHhGRkYAAACIiIh3d3f7+/shISH39/dPT08PDw/Q0NDb29uLi4vg4OAxMTE/Pz8TExNzc3P+/v7s7OyQkJC+vr7o6OgpKSmlpaVoaGjX19fk5OT09PTw8PCbm5t/f387OztTU1OWlpY3Nze4uLhubm7Jycmrq6uDg4OysrJfX1+goKDDw8NZWVlKSkpnwBSyAAAgAElEQVR42uydaXeiTBCFmyah3gjiBq4EjUbjbtT//9/eqmbrVpMZM9E4Y90PagzVfemH3vCcQggWi8VisVgsFovFYrFYLBaLxWKxWCwWi3XH2gBEp75fL/AlBqh8Fjz/7P+qhPkvSjhZ4JlBX9a16rlNeT4ALI6+ru9h/Wfo0xIY/c3qGclDfPR1B34L/fNmU//gX2kJnxzx8+jPNPePyQEZgu99Ef0nSkv4Uj+87954JQ0AnCbAczrrUx/woSH2NBZg8xP6lSsbS3Xw0glltHrBT2Vwu64cJ4xmkGomxHZvy3CMxWUlZBSL2Bhke27L6L1wkUcdoM+DxmDjnzuALS4hAEZpXKvTsKQ9Ucd6qwjLUEZ7sS3dee+wrqIWw75h7o70APC+QPwfo2+oj+kQQIra1HY+rhE2R+i7Mvn0fohei0UcEUjQBoUiykRfBP0H0BfCBlipfw6KMYLk48HeOPn8H17OrvpkD8y6tFoM+4a5O1IE1hBfFHMNfQVb43X2Qo1ivS3wtSzECCB8eJuqz2X8/PawTdqut0Rhy0dD7J3+86JGl1JWQtK6eiz+w63QfLDPTBRRBnotqA/QEVVQh0QwTeOGALt6Gw+bC/EKEKyfbZADMve6rUmYmHVptRj2DXP3I+zw2EArbCsTvTbXYz8rWbT/i1Q7eRF1wDKh0JfI79j3qkL0nynKpcPTEpIj9NhYdbyWVewptSgdvR7kIhdEBFapriwlmwiAcdcTlaGgEcHHt7XTrPTUOVGHHxp1abWY9vV67kex4oPdyW19hH6r2tWlVUFAIdhv3qjtKjr6hVQzPS0elk2cIlwTvREbJ5tJKrNYcmRRGnojaA5+aQMOho6KJWArooshqPVEfjAK5x/XcZyIrJt15bUY9o167mdTH2bTNHRz9JaJvqK6iisqOLqmu8EVtd1AQz/AWfiBWPRpxpXysNcbsXHSu9wcvR6loTeCkOfWhbcG1CbaJVOdKu/WkmaEib5dTRcoel1aLYZ9o5670TJvJTr7jWqnEpxG3ys6x4jarl2g96Zpw3s4185nL9EheiP2CL0epaE3gko+kL0m7H3jLkRl5Vg415TSrutVPNoBPGqjWlaXXoth36jnboTL8PiVJGm1F6u+v8jQL030+KKujGyuHxboEcpU3RnYAjTxLUzRL/Mj9Ngj9HqUPtfrQWJCa3bCms0stEboxDgdeQGNVjZYPdVz3/AqoHXgY/zm6XXptZj2jXruRD0Jdkt9mtA8h7Aa27Wr0OOMuu9UDfS1bCE8OWi7N8TRrKFmOHbuW1SOm5eQtK4ee4Rej9LR60G0jsSRaUhbufz+EwZG2x5OBPjVI35+64R0FeCKIK6M1Glodem1mOiNeu5EHbUtSkf+qRjQ7XxwG9RmlXyuzNG3dsnU0GgftN0kmzTiFraf6+JG2iplJSStq8cez/ValI5eD6JhmVZhDQPQY1rxKJl0SLhyr4b5bl+rS6/FRG/UcydqJOv39EecvlgEVhi3HUIvVraMugb67KaXJz5EL3obWzZGHTUoJyWYN8w8cQK9HnXqbl7Sy6cqrKl2a7nWji1DR80AL3Q3L1C3iQaxLe1d/6AurRYTvVnPHavFZlksFovFYrFYLBaLxWKxWCwWi8VisVgsFmv6dBmd5+J5/3RdzW7Awxc8fqvgv4sIznOxu5CNj+Q//ryHr3j8XvQ3UezD43XHulP1XdvDj7cJo2f0jJ7RM3pGz+gZPaNn9Iye0TN6Rs/oGT2jZ/SMntEzekbP6Bk9o2f0jJ7RM/rbQ7+II8sfjyijgAOemEDvowIW3QuhryX5ytxN/2fRO0W2zYOzLkOeGWWcZwhbpcZlGDynrXdan7TpD6JvUa6g/VRCufQr9LPTicC+Bb0bBOOGBXL9k+h7YOWpcg/OWkM/DxJJqCXGg3GkUoP+behfIaLcj/UppY4j88PeRxlFni+IXuUYLT2AVf1B9DV4VdldT5y1hj5Vh/L3psbFTMrBJ+g/btMfRN+XYXJBtv1PzV8FPaWv2vwg+obv+W7r99BvpVXRjO/g/Retd3PoHynjt9KoNigG/GHTlXZMF0XZrk5COZ2pzPEnEwB+J/oXy8J5p7KzpT9WY79upF/2LaffjkPfUTYoRb0dDwyTf4K+AhOxSZInJhSHUM7Ougz9OLTGeQ09W2Xd0q7ZjgoqAoWo7mz0G02TAf9cjxdH3zAeDZGhH0Ywbk7AxSYvW+F+VAspRf0Gdp3hZdGLABZiYfmb5kQSBMOIv3ufgxs5o1fp4gVStyGYB2BXdZN/gr4JS5zZJyb69KzL4Nqbff5En1KQpFbNjZcx9gB91YZ97Pphhv5MjxdHH0LpBPpYJfVdU5LbshqC13SmVxjwsdet0QU18JIqPjLiQNCi3HRbyshKQW+UjFYz+XX0Jdv3RCmUbQN9PuCPX6iyOOvkDU83/kxJYQ/Ql+k5IC9jyNCf6fHi6KUUx+g9K5nxpvIFHW/VuTjXQR9je61VNW3caB0baapxdoRHtdOnF0yhrpv8OvqZYhPjuv0k+pny5KSH+vViaxKMbZVc00Sf+lsU6M/zeHH0Nrwco69ApBIcN7D7ldV2p0R96xrodyr1dbs7ak7psReGkbrqbrTLfscLoKsyE9PFsNZNfh39TtHdqqcpnECvWMOYXuth9qCVdF9vl2fiEH03SRjbkjn68zxeHP04n3t6/Rx9F4onzyRL26uhn6KfuspYvUP0x0YeVd8h9Os003wHRwDN5JfRD62sru1J9O0cfWmaZ0gvjB+hf1bZ/IVwc/Tt20K/ylP1P+GWNkW/SPL4p+uXa6JvS79UiiDutkUP0R8bKdB301nz1bw+v4x+BNOYFNC476jBcHAa/Ryc1sfos8BZen34t4q+KsNkwzqgtWeK/kWtoLFDrYZXRk/7+kXyqKAtoj82UqBvQ6OV7Anq34I+SNM612nFlozOs5Pol2D3xEfoi8Be4qYPt4oeO3tEQ36lkVzsyQp/p65YnPZauuOlWgFdEL3XAauOEzx1LVwaB+LYSIE+XeG/Jyv8P0Zfh+xmjoOsn6hstFDOzrpAX/XlVnyIXgvc02MbvP3toi/Ro4f3DQDnpUDfc2Ha3Elra7TqAtJ7KZe5hx+k9/BLDXAemnYUNsSxEQ097uudppPs6/8c/Sqfv58RVl/CfmM3wnJ21gX6GML0Jn7QPEavBVZ9KM+jkC7k20QvWrOyK/3g3fjlrj130yc86o7nvrW+EHr1y10Uqzv4g41Nz4Wc0Nh5aERDr1LUJw+c/Ab0UX6j0vNx6uuOrTAe2uXsrHX0uZxj9Hog3X3c92k3d6Por13s3fxeX1XLlMHv/CrB6P8t9KHr5fegGP1doX8Cd94cqxvPjP6+0LdGU9+KHjzB6O8N/S21CaNn9Iye0TN6Rs/oGT2jZ/SMntEzekbP6Bk9o2f0jJ7RM3pGz+hvFP1lnuBwLnq47gMm4PHnPXzF47fqjMcyOMEZB5/nYvHFJ0WcZUlX9/s8fJun3/D4z45A/4Slm/TE6Bk9o2f0jJ7RM3pGz+gZPaNn9Iye0TN6Rs+WGD1bYvRsidF/q4Y9Rv/XnJO/pFenKcpJmgE3exeS0olNz0txHc0Y/d+Hvj0YxMFg0MvehXwfDKpNOTinPpvR/4XoUc00A2TyrnLae0ma4WoY+28Vx3dHQswifz+pVSnriFMTyZetJzsMKjhyhCNG/9eglyT4AL1Xk2r2rkKzXbdXpYq9HlhLykaVoh8mX87cdomiPun1HqO/NfSd/v/s3Yt2ojoUBuAAlVhBFBARr3jXarXa93+3Q2DTQqfOEXvqQfJnrQ6aBAx8gyCQnSgtv6NXFYVrI5bQT9jIiF68NtduNFmm9JR5UuoT/+9f+E0T9A/zhT9vt9MTdgH9qlqWpbgLMazMMaWnTLbvqMbor/RcN0H/SMf6DP2biDc8GMQTPaKfMebalOm02HTNB3+lVxJ70D8efc8LGqH7PNOCxoHbphKYI9WmzJHWZntlyoz17CI92YP+8ehZq2NpLyZrLa3mxo4O/cr5aFOmX9MUN9rjF+riMn1iD/rHXifdLjwLJ3vQS0kv7EEvJ31k/wr6+6yTXp5OSUlSOejvRF8vSwK9tOuEL3y56XGaJys9ftzJSo9LOrLS40KurPS4fSMtPW7ayrpOeFRD2nXCA1rSrxPoQY82gR5tKvk6XexT9W3B5R5YoH+AdXrhu8y74ZY58aDuX1NUEPLZNZmgf5B1Mr3jOfNWu0QfFZj7xjWZoH+QdXrbOGpIT2TqtuhT5XDbUI4N6mzlWHVXOzZEgdjBdxvFeGNs71rW2UwzT0vLCHyqCfpHWafNnDVrH/TJXn/uTbw36mzl8K7f00aiIFLuWUFjp7Qctc8c7Y0yHWUd1ZynNUH/GOvUsqZs65l5eoex5oI6W9E7Uo4zWzOzzWY7t06ZtuikFWzSmkmTPF4gaecT6O+9TmPV8zw+z9NHx/pzjTpbxe9WKb3diefyF5r2bjxR5vMqyjloac3iTWqEc2PcAP1d12mmHMIwrLmMelhl6NPOVjn6eK+fn0Q3HLZM6eOumbZ7O71oiD4G/V3XaS0oI+w+9bASfaqInjpbpaBRQaQ889aNndUKjJk/4mnmwBLH+uBH9Gxm7EB/z3VyEym9mfawWqgLoqfOViloVBCf4Ucn8yM2XXnDcXeVZooz/Lr/M3o2P4K+EutUvEmOAXpJ6Rsc9JLSM9BXjL4Peknp+xz0ctL3FdDLSR/JXw2K07wq0Qv5q0Hx465C9LH81fS4pFMd+kT+WnpcyK0OPclfST/TXxjoq0F/Jvlr6BvOGjdtq0PPCz2qccSjGnLu9fJuJhzrQS/zGT7o5f1dD/oK0Re7mgf6KtEXuoYP+krRF7pzB/pK0Re5Xw/6atEXeEoH9BWjR5tAjzaBHm0CPdoEetCDHvSgBz3oQQ960IMe9KAHPehBL1WTLkfnBX3pmvQxjnozeVzTSKdMFcNhbg6Flj/cgv7x6HthOO6E4SCdMvUtDNtdNSyyfA30D0gfpa6e5CVTVezwJo8x297YWifRedl2aL2v7DSYY5LpP2tep8VEdN50wVSBSqhevBzQl4ReFYlfoDdtdZA4dntOEp03VPZsz1N6Ctm7NXoNMVdmr6cKVEL1xHJ6VKEP+v+ZPphEafkdvaoonOIqt/mEUXTeOAjnMqWnzJNSn/jsO3oqoXpiOWnifdCX9Qt/3m4PMo4UnXfxHr0/pvSUyfYd1Rh9R08lVC/OTOmVPuhLfKzPOFJ03nii2xS9Nw3Z22LTNR/k6eMKVEL1cvRkD/rS01N03pkWNA7cpui9lCkCM++VqYjOy7bJdzpVoBKql6dP7EFfenqKzstaS6u5sdPovUmmX9MUN9rjF+qCufQZSYW0JKn3hT62B/1DNSk6hl9MJ/u6ZXCyB31l6GuDAvSRPegrQ39tohgPyhj0d2lSobFv7pRAL1uTsNdLTo9jvaz0OMOXlR6/62Wlx9U8WelxDV9Wety5k5Ye9+tlbRKe0pG9Sfk23eXy4dAEfQnp7/CBr8OmCXop6Z+6zd+2B31J6Wvmb9uDvqz07LftQV9a+t+2B3156X/ZHvTlpH/ZPEepawxBLxv9oVsX6ZWDXjZ6//c/C/TlpGegBz3o5aL/CPoC+lLS3xLN5cr0EfQF9OWkvyGay5VJA3256SmaSxyB5bS0jMBnu41ivLF8CJc0Xgu7IegL6EtLL6K5iAgsLWXdaGnznhU0dkorH8IljeTCbgj6Avpy0lM0FxGBxRYhXIJNHJOlNcuHcEkjubAbgr6Avpz0FM1F6D2vohcHze7EJV9CuNCE3RD0BfTlPdaTZ7wP2268885P+RAuaSQXdkPQF9CXnn5giWN9MPPWjZ3VyodwSSO5sGJBX0D/GPRMnOHXozP8aDJi+RAuabwWVizoC+jLS/8fpH8N/wB60IMe9KCvBv2/JtCDHvSgBz3oQQ960IMe9KAHPehBD3rQ/zf090ygR5tAjzaBHvSgBz3oQQ960IMe9KAHPehBD3rQgx70aBLo0STQo0mgf6gmvfAdi/u2ZcciB70E9KZ3PINeSvq3jaOGH/RJgBt3znyvy9hyBPoHoe/fMPNmzpq1lN5JAtzUzqyluKyn9kD/GPT9Gx5OallTtvVMoqcANzvPt8fqbNTBF/5j0PeVG+jHqud5fE70FODG11r6dnk4B6B/CPpIvjj9TDmEYVhziZ4C3LDxqzVdjD0H9I9AL+SL069FFCPm8H5CTwFu2MFbRgt0cYb/CPSxfHF6N4lAozczZ/h1n5nKIv4DffnpE3mOzSQdPcmDXjr6s8JBLyc9L1/yQI+9HvQ41oMeZ/igL8PvetA/Pv2NV/NAXwH6267hg74K9LfduQN9Fehvul8P+krQ3/SUDugrQY82gR5tAj3aBHq0CfSg/9E6icG4rffJPT6OxnqxLWV3sXMM6O9I/xY6u9VPHlgtSj98HbRBXwZ6MVRfwx0ztnct62zSgNqOtxh6iyD6Y9SDybHqrnZsxDPSaN1U8Fk1O1eyuHSu7VBZLWP6jeqNL/eLAv2d6dliyBy1zxztjQbUdviCnfjYn3CHejA5vOv3tFiIRuv+KPismnmZLI7mCpVR443TXr9nl/tFPenP16fFvA36n9KvNWa22Wzn1mlAbYc7zBRdlq0T9WASOawZP9RMo3VnCqhq5iUtjuYKRNVNlv5Cv6gnvX59WhwNfQL6H+71LvMXmvZuPNGA2g6fsgaPtqvXFz2Y/IMmctgqpqfRujMFVDXzkhZHc9WaUf1zlp5m/tovquBmbgTaDvQ/offdLhPjKLPlUzqg9ici9WDK0NNo3ZmCP+lpcTRXXHWZpb/QL6rwZj4YU9DffoZ/WmkhC4yZP+ILGlA7g0g9mDL0NFp3puBPeloczTWw5o197lh/oV9U8c18tEF/++967RztodOVNxx3VzSgdgaRejBl6NPRuj8L/qSnxaVznVxFf8/SX+gXVXwz7zagl/Rq3swCvaT0vz8QEejv2yQT9JLSm03Qy0lv6hz0UtKbugJ6KemF/NWgOMOvEH0sfzU9ftdXhz6Rv5r+GIC+IvQkfy09ruFXhr6rF+lfjzt3FaLnKkXVuOZZjaOG+/UVpL/mWY23tqSbCV/40m4mnOaBXuofd6CvDn3BSzqgrxB9sQu5oK8SfbHbN6CvEn2hm7agrxR9kUc1QF8temZiM8lKjzaBHm0CPdoEerQJ9KAHPehBD3rQgx70oAc96EEPetCDvrxNsvbiX73LmsmTmkY6jcPAqJsD6CtP3wvDcScMB+lUBH8K2101BH3V6aPU1ZO8ZBqHfDP5Vrxue2NrnYR39Z81r9NijlJbDhd+PsIrlVEg2DTF0Xp1O18YLxH0/yu9KhK/QG/a6iDR6/acJLzr1ug1ogoOf2Ezd52P8EplFAj2C32+UCyx9/nIAOj/B/pgEqXld/SqovAkYG+kN2EU3vWk1Cc+i+gjuKCTj/BKZVTzC32+UCwxSk0T9CX8wp+324OMHoV3ZfuOaoyYo0bZo6GIxco+I7wmZWnNPH2+kGK2c90EfTmP9Rm9NLxri03XfODw6L/Fq56P8EplVPNz5hljrp0vTOmVxB70Zaan8K4iMO9emTr8aLa0UT7CK5VRTbZNuuiaSmCOVDtfmNKTPejLTE/hXf2aprjb6Fjf1bSA5SO8Utk/7N2LdqJIEAbgBiKVkYsXQIkXvDuoiSb6/u+23dAoRrOjJCiGv87Z0SWNFHzYQKuFbMkcuaC+oWw3jeM/7ulje9A/TkoR9j/i499VlUnag/530Ve6F9ELe9D/LvoLgqT9G+hvktI1977JOWR5D5VAfxv658IE6EubEjr8ctPjNK+s9Li4Kys9hnTKSo+B3LLS4+Ob0tLjQ9uypoSvapQ2pbNf0ApvOqC4eQd9YXKimw4ohkoH9IWhv+2it14H9OWkr3TysQd98elZPvagfwD6fOxB/wj0udiD/iHo87AHfcHp24H8ugiBvmzv+tyWCnrQgx70oAc96EEP+vP0N63mA/pC0d+ymg/oC0Uvq/lEdXfioj1sFSrGe1KQR5bnSar0sG8V/QF9wehFNR9Rd6cWF+3x7ZfqSqmNj+r6yIeIPnvRH9AXiV5W8xF1d2TRnqgST218XNdHPsT0mYv+gL5I9LKajyjDIIv2NNzoL8d1fZIH9q2iP6Av2rFeesqiPdH7dPLxqa5P/JA0zVj0B/QFpZdFe8be3+rKrh3X9ZEPSdPri/6Avsj0smgPW/GH/qe6PkmVHpa16A/oi0b/I3Fx+Q/Qgx70oAf9Y9NfHKAHPehBD3rQgx70oAc96EEPetCD/kfo71OuF/T3z+lO9XpBj5xAD3rQgx70oAc96EEPetCDHvSgBz3oQQ96pAR6pAR6pAT6R0ppSSsW/cBJ3oYc9GWhN73NFvSlpH8Pm+pwTx9XKXEmrO21GJv1Qf8g9FneteGEWZWEXlYpqWxZTXGYr/qgfwx607p+3po9YgvPlPSySsnKazcCddx30eE/Br2pZ/g2WqB6nkcTSS+qlLTXWlur6YvZevsC+oegN3Xlevqxsh4OhxVH0ssqJSx4s0fTwGuC/hHohfz19H9FKRvWpE5ML6uUsLU3Y52kHBHoi00fyV9P70yjB91KneE/t5mpTKP/QF98+liesJlKRy/lQV86+paUB33p6EmVN/r5U5jYgf629M+FCQv06PBBj9M80OPiDvRFGNIB/ePTZxzIBf0voM/28Q3ofwN9tg9tQf8b6DN9VQP0v4KemdhMZaVHTqBHTqBHTqBHTjmvk/0q/tVbzIo/TjGSx1xv4gz6ItH7w2HgDofd5DHXmziDvkj0POT9eOVjchNn8fwbd2cGfVEvom1VBH1BL27iHNFnvzsz6AuwTmeHzuyXAY/ZOXp5E+eYPvPdmUF//3U6P2D+Px2+vIlzTJ/57sygv/s6ffEx2T+O9Sn6jHdnBv291+mrD8cvp894d2bQ33mdvvxKzOX0Ge/ODPr7rtPPfxHu4vu0gv6u65TD119B/xD0eXzpHfQPQV+8XzntQH9jevzICR0+NjNO87CZcXGHzVy6IR1s5t9OX7BfOYH+lutUqF85gf6m61SkXzmB/rbrVKBfOYH+GxFePnTmJm1bFzS+Lov+LttonhtmHAZc/FwOP5bTBTn+aOQ0MnflMWF74wFCu3L/HLLk+LP0hXjZW3eS55ZXtI76CfSgBz3oQQ960IMe9KAHPehBD3rQgx70oAc96EEPetCDHvSgBz3oQV8++lXQU+zZpM2f6mSyOX1Z22LVyYm+Ef3aQzE2g/vS67T7Yq0t2t/lfkZJvMnEVc/ty613Pv5nm96Rvl0h6u1Clazqv+gXNMmN3nDdmaOQur4nfZcUGp5f6xT90o1DpUacuDvrEU0fj35KvRV/aIYUxMmPu+0v5u/nSB/dRL76REr9jvQNmtL0/Fqn6GW8UG+cJM4Wqjr8H/qvt+kd6QeqF++Qvv2/yd+EnrEKbe5I79imbbQvo/9QlVoq8S29/2PrFY6+Qs/y2aQxPHT445ahaoHYKSytPvfUcCHWjscgX/qRovDjTm2rqfYs6vvTiQwsW9EHfuDZepRGN9D434ZHSX6HvkZztolLfcaKY7KStbZoEHjKbL+Ersatj/bZl2imw4yM1bcaz7cXxh3+tTnmTu9Q7eg0J6Yf92jWmpPBN7mleLtJw+PNFhvavozzpWcurdhKsTetuSoQjhKxt+9LMnr6ZKoafAdpauQuXdLq6SS/Q9+iV35knx/Ty7W2yNA2O6JV3LTqiuNjKnGLz/uJvq7RLjBsL6G/Msfc6T2qnqEP+MkrY2vainXaRE+Dm3T4/F235lmIDfwqFnySiE4u75GX9MHYLprpL7lHSWanr2q2yaqe6h/R7zv82UgsLEje5I6ZTrxPyvgzvUX8tH80o4T+yhxzp1dVdkpvKvERL1RHPOOPaF3029AHfHuto8X4/ELrNJFW1M9OeCtfbFPxN2qmk8xOv4hsAn7efpZ+EeWky6Z283Bp4s40Eo2O6WV+qwP9dTnmTq8dlTaS9DXqTUU4/O1nRZc7VfHeugX9lsQh3u9MWiHfSMeJNKO3m7jKfuc7QCeuz8x3hnU6yez020j3g3rn6SNrmol/mx6t0wMSqmYt2Gf6Di2ji2d1T39djrnTz/bHnu5gT9/ZD1os5KntzehDnk9zzpesbTn9aSKV6L0j6NfRsUBcZPXTSWamHyvJsj7O0vt7+mpIlZPET+j79BRNNfb0frHo3+QGZOwPv6SV9CtxbGXJ+cst6X3VrlZ7FHR81uX0p4kc6DvyqDk93j8z008oDES4ot/Xo85weJ5+SXr7a/pkxoXcP+yi0tdVL75gHYpzT0k/is6g+RvqbXxjenFdv4qujHjPq7PTRA70Pjnt+Jqg+SP0bvTKorqfMpa98+Is/StpXfYV/WHGbpzNgIpKz9/sPdHl15x4Z4/P8LfRHssPe+10xq/RGVCO9OYLKU1+gBdvLX5q7LLTRA708gz/PT7D/zZ9k5LBHJ1b/xGvzVOwkrU+0Ndt9YN9SZ+accev95i5Ky59dSPG8B0ifXSg7xoUtraq8nG0VVckx1LyGcN35Rh+1SH9qaX1PIedJpKi59f1ekuPr+u/T/+2P373OdZApd1GczwrWesDfUCeHMR3W6f0qRnrNlnLnid25GLSs/bCMlTbfT/65M5fGqo2rx0f69nSVtY50Uef3PWCaAR/uNHU3ttoLvrOz4mk6Nkw0FRj2WU/Qt/bD1SaNj/0dWaKF4w1K1nrNP0+9FP69Ixi9HE3EFdzBaW/9cuW5vP6enSaMrzkUwnQ/y56zzD3Y1CgLxX9HzKWrVk08Az6ctG3J6Gt9J5MBvqy0Rdpm4Ae9KAHPehBD3rQgx70oAc96EEPetCDHvSgBz3oQQ/6gtLnc7PZa+lvfJtcqtw/h9NrxgAAAANhSURBVCw5/mjkdQ+H67JY3foWE50C5JAhRwQCgUAgEAgEAoFAIBA5hU/1n3qpRsjGNMAmLSe9WfGxSctJj7hTOC+MWQ5jr8a5Z8ct2NBStJbJ6RuashE1tQzVWbBkMhu4avgUsqGovCNM980nhqoP4/+fpprP1Fkr7vBXrqLozWiS89RjXWrY22SiT31D2dZmymy4X6II+WrNue0tzeNWiEvij8XanjpmwfLcs+MWLJwPPpwl38xG58MIWE1ZNCv2KJlsGptmX0nR75uHQ98JWLWn1zre5NB8O5ioEf3Ia9VXvU006V0R9GFnlUz0yfXrqrby+TzJEnnIVzONXa3Dc0m3QlwUHbtdM3oLZqzPPfvUQjFFjVTTFxUz1qq5tgfMXJjJ5LUw2RzoD8356zQc1lG7vO/of27O6btvVcaeQ/YqJi0FPV9AMtEXtb34nsOmLpNLjNKKX+1VGYsSLuN0K8RFYSq1l81m2lRH554dt/hLCg8a+KLsw5AGZkjOtMmSyc/8qMAmB/pD8xrvqXu8s46WmEx+Es3/xh3++G/gqg6bimIyfUEvyknIidHssyfGnmZMLjF6mfjVpuJVxrRKt0JcFruX+fvEnej/tXO2vQnCQBwvZSOGDkEa5CFo3VBEpyj6/b/b7mhvYuZesDdLtt6r8ue8Nv3ZoyXkHrfuPHIRocEyzrCGesTSYi4SRXKOFM4GPTzzb+6qR19pWCQ/mX8KoF+5m2N7lOzYEHrYR5LY/5yg6h4xjIk2aQi9suhHWh64kXKC/HHrzmOHq/29BpYdJFnHL2ZYYHVLcoG5d9/oNQuZ/Oau0XdYhXV2Ibk17oB+66aMLSUkfMjlc4OexCFU0yOOykRrdcLPLPrxpriLZUPV49Z5MbhK5SYMJVZB9V6zZg2zv1gdeEdyKgN1gG1eKuqwSpqBu0aP9wu3IvmlrBXuCgH9gncZbu98cQLJoCdxCNX0iMMy0fwyUJ24MIv+ByZqxmrxTcurh1dx4CSnNzzclcnex6TLRfUps9jjcgkJuCi5Bw/xm7tGz+IrdydDd0c+9+j95XR6aeEUETYQQWr0JN5BNT3isEy06Ook/QnSov9lG/GO5mutlRV+qrX27Cz+dfRfLeZVvEsqO4v/Dz3s7rmYpXYWrVmzNtI+AC0GjHECTN/OAAAAAElFTkSuQmCC" alt="Authorization Allow flow"></p> <p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcYAAAF3CAMAAAAIKhvLAAAAn1BMVEX///9HR0cGBgZPT0+Hh4d4eHgKCgoAAAB3d3eIiIgdHR37+/s5OTns7Oz39/c/Pz8TExNzc3MODg6cnJyLi4sXFxcxMTHc3NwjIyPQ0NDo6Oijo6Pk5OSQkJD+/v7AwMC5ubng4OArKyvw8PCWlpb09PR/f3/Y2NhTU1NtbW2tra1mZmaDg4PHx8dfX1+0tLTV1dVDQ0NZWVnLy8uoqKjBCfIoAAAb6klEQVR42uyd63qqOhCGIbbM2oiAKIiKJ6z1fEC9/2vbmQCSeGiXtta693w/VlmYSSZ5ySSkj1NNI5FIJBKJRCKRSCQSiUQikUgkEolEIh1rDhCfu79e8n+mAJuPjPnnzYsf5jU0/9KTAIyf6/YVfj2DbA8Alie3BzrMvoaxqIEw3l9tThHmJ7c78FcY26vV4MJHWQ0flHgoxiv8egbpwFzw7BsxfqCshiv0oxj/W4oA9CpAG69XAPiAehBwuKimCD0LkwV7UXiWuCxejPhVCcxeyKw0NPUhU1/TerrJXGevKTWotlNglanJ4rbkxco1kmaKsTX3mTltqQUnaeDfAawyk24nMJg/EXXbi5g3Kh6as9aSW6rnil/PrBeOkA9OchljIC7X6WYIFVdwMDwPh/QYY4+lV+1jjJItH98YWFanUMvEzwwXMUbiGsxIKTgDqPKCrwC9Ym1DeTxY2FZ6/c8la8kt1XPFr2dWDMZQC1N+EsYm7957f4SdNd6W/D8lTasBuC9vgbgu8eu3l146GK0ZFx/KeKhZ4LWXdXwspBqaqi2/YzYx5uq5E7xhqz/jXhii5vdlncFEKVh2weQFQ/C7qckQYDuo8GqnmvYO4MzaJrDogrXkluq54tcTawnY4wXvvIpRWhsXmlY28J0kFB23Y1wu+WB05P1el++UvLGmjfc4xUwsXtTQVG35nRq3MA7vOV0PDD4bNoixJRzik4QNlYL8eoclqvk+mJPv2dpuyK998PiPdVLdXLKW3FI9l/16Yk3FWDf4g9u9hLEnBiDEVdRBE/5Qv+FgNGWMS5bHyGhf5Q93qGJUbAURrNMskIigbnKMPECbSZKEuBbKBXngf8XHLX9J6MYYhpN6SyzvSXb3krXkluK54tcTvzS6IG1POMYGv2moGJvZWDR5GEObPU5QPhiRhDHyAV7w/xtcphg7xqjYZrvfAuM4+xS3OPuDQ2u1YMzrDKSDinG6IBozNJ9kNy9ZS24pnit+Pa9mh25jdzhGHhfLoGLMx6JVPLk1HIxKgRH3GGIkbb5ATfuj8DioKrZT0YyEMcqWSZyNa5x1RagoCv7Dq1MHu7lIDB7Ky9mUsnf2JWvZLcVzxa/nFe/T9B3FcKeTRtDdBYy4jvDrcozDww2HBUbcotjZUouLl3tubTzYnmDki5tri9BuINIAt6TTN1styD/w06CfTsbOlPtqO3jLB6MlZtTbBWvZLdVz2a+nVYvlO78JLg584IMlbhgDsYUrdRoKxrrY1aUTTxmMNz6Zq3WuPt+DlLpYTyjX0FRtTzHyF9dVpWGJnWoCMN/VhA9qQf4BWMVU5G0sW70QTy74a0j41nGR6Hlr2S0Vo+zX06oj9utZdLW0CI9XIQxwEHanC0x3m4bfoHI0GJM8MM+7fEDMkL+tGWWphqZqe4pxGIsPQ8Q4Tpdrb3dcEE8NpX3Ia9ZmrXhv7Fyylt1SMcp+Pa2Cw6E4HpBvtJ1j+PNKIgLTwmdh72g7shcnHrZ2EaPWWvksqHXEjulQQ1O1PcWoVeaukfTm4hQnmpvM3I5PCo4YMHmwZ4nPXL0vPlrEzHfETvm8teSWilH265nVfRpPe9J5Aek5VcFTmmuP2km/8ASfr95dGognj/0hM+cVGgcSiUQikUgkEolEIpFIJBKJdJ2sP/fRvev/tOGHOXCtg98i+OcugjvX/3nDj3Lgage/B6N232rhh6ML/FAHf9mAE0bCSBgJI2EkjISRMBJGwkgYCSNhJIyEkTASRsJIGAkjYSSMhJEwEkbC+Jsw7uah4Vk1/OKYDrY2gdalCpa9qzHW08wl4XzzQIz6ue+ois6U4PBNK+uQV2SRec1cp50Nynl9MFQ/jbH7ChDrFoNS+TOM/fOJQz7BGDqOExjA1g/D2AIjTWdz2hkJ49RJxaCeeW3FIgHXU2B8hxjzMQ0sTMiAHg9bl77Q2b4Jo8jOVX4BY/wojHV4F/nQznRGwpipA+Ew91rrMxZ9gPHyUP00xg3z0yeq4n3o8RcxYvKL1aMwxq7tmd2/w9hjxkbyeivSSdrfOW/ugvEVM1AK1epREVSH1TDLLFryGxOXWX3sEpxN5PN3GEeGwaN2c2syL01eKjVhjkueoY8rc9dLxBramprMnEdK8zdjbMJEW0FfOyxzQyjlnSnBeO4aRfUtX2SHlR6+jjAqDDWtsfUNfRNbaVC9ysG7YQyU7IM5xmEMTnUCIR/kkuHrtbqLmU9XsO0Mb8WoObDTloa3qk4YjqnShLttTyGMk9o7CznsgQnONAG/ITd/M8YqzPhKOFExZp0pgemv9DTPH8Z+J025ffC6BPtjjA0fStPQc3OM1zh4N4wulM9gnIv8amvMBVcSwXCN3ftSUOUTYq0lYrz2WOVJEwk4Xcw4s8QbaPSWZjA9NH8jxrLv2fwfkRZHopEHVWuELU3zyRfYstdtTKN2hLGE83XkQI7xGgfvhpEx7RSjbaRLicVG3M2l6ID+VYxz3v2ZqKDCK1Ob6IlJ0xbs9vzzIHsFGMjN34ixL8Z5yvefZzH2M4fSou5A2l9bvshjpWKspEnLlgXGKxy8G0YfRqcYmxCKnH4Bd7Ek9uplTFb4NYxbkZmm0qtVLd5ntYmBmAkIs8bb6GX5azEaSs3fiHErSC1FGs4zGAW3FM3AzVNfZ++NfqmvHWPspzO3yw4Yr3DwbhitQ1BvjQ8Ye1Ki1HQv9w0YA97SAFOLmVuO8bSJAuMsS5nZ4fNTav42jEMjb2h5FmPlgLFsHRJxFl6fYNynuV8184Cx8gswLg5ZRv/wd6sM4y7N95ot8t+DscK8cjmGaa/CX8d17bQJeTbOs1fa/tcx1iCYoxyMrbqIPdF5jFNIupcx5obrjLX3qzA2mJu+OUW42cowjpgpNj6dxfDbML5yNss0uXqPYzxtosBYgbib7m0HX8foZOn+B7hbSSNg/yzGGZgt7RLGwrCVujKGX4WRT8IYw+omSJ/WdKe6FY9cD8Ku7OZebBNuwmh3wBjwBRGf+pGFlZ00UWDkbnTEpaN9GeMA8hf/BN54Zzui/VLemQJjw2NL7SJGyVD82SVb/2UYyys8U40BklGBsRWCVd0yo6eM4xKyt/Nbz1TLAegvVTP2+XbjpAkJ48CHpKqDP/46xsVhvWvz/e+Ggb7yA7eUd6bAOAU3O1R1qqcYJcOxi++N7i/DqHX7pZB5jvobDvyTMKb4qzGym1PPWN/2G454Lo5/opWPf0VmgiHquAkJY5rYND3h+SLG8HC8YXt81ehZhjsfmqW8MwXGeZE5XT/FKBuKI6cNvtT+JozfV+3/4/eNY7GmR39zREwYfy9GN7QPhxWE8Wkx/oFwWrXEySFhfF6M3ZrlGvGLrRHGZ8b48AEnjISRMBJGwkgYCSNhJIyEkTASRsJIGAkjYSSMhJEwEkbCeEWt90nhC3eu//OGH+XA1Q5+i67Iy6s7VxS+oX41CfCthl/o4H0c+szBn9bL69PHnv+SQ4SRMBJGwkgYCSNhJIyEkTASRsJIGAkjYSSMhJEwEsb/M8ZhizA+BKMn0oPpVa2UfpHTzH9qDBOPWNdlZ4z7hPGxGCtRNHeiqJX/1Fg7isZVFl1TuU8YH4yRq5rlY0p/ijSpdppYr+HOvbdN4oU1TevHrj6pN/D71npdS292//iu0+Qz2q0RxodgZCi4gNGuM7HaNaBaGfiLctNcR8Yec11kGIfpzX5YKVeTw2wsE8afxtgZc1nnMDLjX/budDFVHAwDcISanCJFRMEFFXGhLqO16v1f2yQQFM/YjlpBoG9+1BaCBJ6GJeQjlNkHEjG+E1fjv/yjTsVb3/SYUU706Ot2eDqoDjww5uag2my34wtPgfaPYlkWdQLxyopNzCgnkmVd0dwj40q+eAiMOTk3Jhhd8Ya9Xi/8+OSME0Kclpzod8lsynox4wujHhjzyfhmDmp958/EHtSWrGXQgeEqLTnR1d7Jks6INp1EjNIRjLljJN26aS8M0tUtVW8Rt0N3m5acOKzaVNwzBkogGSNHMOa6FafS+n4dTDqCsfCMwhGMxWfkjmBMjfEz/a7x9eO79sCYFmPlNfVUAWMhDqr/tw4cVMvDiEucMjDihqMMjLj9LwMjGuPKwIim8RIw4kFVKRjx2LgUjOjEUQpGAkYwghGMYDylSe+WGV/mBmPWjOHAw8c0HhH/bCzWxIw+m1wzEYxPYDTM1S7xp/0VI59hLGvXTATjExibji+CNWTnU9GH32ctjW5qsnO/b7069qYmZoiKt9apCANYOqa1M04Trc5gKHOC8RmMepOo1SNjVBt3b1vTlZ37fdYYvtkHMYOLiV6Na7r3FY/4tisn+nRa69rNOCcYs2fsWjMyMo1zRp8QNZCd++VfUsztiGUmRptM9s6rnNgSQQEDPc4p99otieovMzD+gHGlmKbJmueMfJfuqrJzf/jXPGZsRQNTDgNNUzsvcuKfOZ+01OKcd+y12Xqj7cF4N+OEfvT7/apDZI/+BGPcuf+M8SBq49Rz7TY/HMeMYYhOy/kBo/g3MNtgvJdxKlg4nCd79Is+/JJRdu6PcfgMLjYxp7W1tR9ok+GBxRN7Fj83aoOfMZJpBYz3MjrRXq+ocY/+QAkko+zcH+PwGeKidM8vSg9kNjfHi8Y8nsivVLXX4Q8Za1objI9qxXniXls1wVgCxiAAYwkYUy4eGH+y1wwPjMVnNKwNGAvPaFSiN32AsciMRoWyq1eKS5ycMgrF6xlxw5FPxlDxasZaB7f/eWSMFK9mRGNcLhml4rWMaBrPJ6NUvIpx4u3woCqfjLckS3/FY+Pi18YM2yPAmOq5EYzluFIFYynuG8GYU8YbW3HAmFPG29pUwZhXxpuecIAxt4zEMDdgLD7jDU//wZhjxtwkMIIRjGAEIxjBCEYwghGMYAQjGMEIRjCCEYxg/LWM37ysDoxpMqY7PD0Ys2ZMZXh6MGbNSB48PL3MIOfIfOH3gDEFxjSGp08wyjkyn/iet3D23gDjIxnTGJ4+wSjnyHzie6K0UAwwZnJQvX94+gSjnCPzhRPDFLCKAcaszo0JkxuGp48WCTPIOTLfifGF0cgRjNkyXjs8/WgbLiIzyDkyX5JROoIxW8Zrh6d35OZEGeI5Ub4zxsgRjM9rxfluQGyvddVGM+kIxnwyVntXMwpHMOaT8cqNlq/BroDxLsbcJTA+rTY+YKNRG8vDiHNjGRhxpVoGRtw3loERrThlYESbagkY8YSjFIwLC88bS8CIp/+lYLxYoHomzUYeGNMtUCZ7gpkeGEvA6KXjCMZsGUk6jmDMmDEdRzBmzZiKIxgzZ0zDEYzZMv4RaUddMBaZcfUaJn0FxiIzprUuMIIRjGD8hYzHsHYwps54T7z6lWk8AmNmjHfEq1+ZbDBmxyjj1cMY87VudQZDstapCFk/C1KPI9LJHWHtYMyEUcSrixjzLp3WunZTRNat6f48SD2OVSd3hLWDMX1GGa8uYsxbIkh9oLsd/tGdnAepx7Hq5I6wdjCmzyjj1YXEnzn/Zam16uGcv4LU5Qe5I6wdjNmcG6VNWLdazkHUxql3HqQex6qTO8LawZgpY8/i50ZtMDGntbW1Pw9Sj2PVyW1h7WDMnpFfolra65Ds+QXrgZwHqccR6eS2sHYwFqYV538DacEIRjCCEYx53utgBCMYwQhGMIIRjGAEIxjBCEYwgvEqxizfVQfGUhcIjGAEIxjBCEYwghGMYAQjGMEIRjCCEYxgBCMYwQhGMOacUcTYW5UtGAvO6Pb99dz0wVhsRhG5VHMWcUi9b7069qa22vHJzumdaqfB3hunYPx47HffDMZ2MBibwReB+UvHtHYGGY0tdVeVWcD4IEbDixlJMI7Hc/dZY/hmHzw6I9sobFCkxGDv61Mwfjz2u88C4rHV8J35FwPzfcUjvu32abN2YFWZBYyPYTSszZFxasdR8z7jx1c1IB2XVDfHRRKDvSeC8eOx38UyBtsTYnoXA/ONNpnsndeBzud9VmUWMD6E0aiwRrI2ygB5n/EqOA9IoA610XGRxGDviWD8eJhisUxNkJrexcD8YaBpauelIZZaVeMsYHwAo1GhYY+ikHHoNOKo+ZixrYzs4ak2ngZ7TwTjX2C8GJjv2m1C9JewNlaqMgsYH8AoFCPG8ErV7sdR8zEj0R1RWeXQ74nB3hPB+BcYLwbmD7TJ8MCCHnWNJavKLGD8OWOoGDHyT3vHa4sMkD8yTpl491M89PtpsPdEMP4FxouB+bO5OV7wQ+pHh6r1IA7PB+NPGSPF77tpfoRnL6/1uPX2xf/F5xT3jQ9ilIrfMU66eri/rxv6/bq0pfvhB30H44MYpeJ3jF2q1h6+4mmHjpdoxXkUIwaM/y21MdMExrTOjWAsyZUqGIt03wjGUrTigLHIjMc2VTAWmjF+wgHGYjMSw9yAsfiM0dN/MBadMTcJjGAEIxjBCEYw/gbGqN2agrHgjM2+SGAsOKN8Qp5SV3swps/oJRnT6WoPxtQZPbFFVKE8LUhKXe3BmDajR0PGabstRr1Lqas9GFNm5Irs7KCaSld7MKbLKBTZ6Uq1llJXezCmyhgqsuN9I9um1NUejGkyRoqP26Ivu9qDMUVGqfi4Lfqyqz0Y02Pc0Yd3oP6qqz0Y02P81X3tURtLsddwbgRjya9Uwfjk+0YwlqIVB4yFZozbVMFYbEb5hAOMBWeMnjeCseiMxANj7kqXciPM09+08DteBcFS/t9lz6407FfUajCCEYxgBCMYwQhGMIIRjGAEIxjBCEYwghGMYAQjGMEIRjCCMU+M+1WHWnpTDABVYQaZsy+Hulh7NzO2opexdFbbJzJWWOWLjVHZW/y3fnzY+48stWLWXblTLqdvdlXWjMMqY+OKrjAxzsX3jCPWvIOxU6/XHcqUj6cx9hhl/csbk2Bc1KOksJYstT5mLCgIY8DGe/7h62wRlXjSG36xvHsX40B81F7YxZi4TBhbLBAclzYmwSjTgHUmcanJSFH63zB+vauyZtwqdvQf9WZ9W+IfMhJSZZtnMY5Nw9KG1zF6Ct0mSr1j7v/slHwwVtmr/K3Z6p8OqpNGR9EWAli123NT0Udik3h6v5dxRik/and3mmLVwyjHxCq0d9Wilfe3lWl9hufQ3kJTtFX/bPV3M3bZnGzYiBxPcxOmxhujsveVSU9f37OZe/7PNwgXOi1ISHtn08p2rEcH1ZsKmBqjw7Zn1wIR42TM6o056/CdrFK70myZrEtGG7YbTO5lJHW2J2tqbRpzRezTs1WYO3fBOuPPZqB0OLavsfrik4k3eJxWfzdjgy35mXB+zig3RmWavakw8Vaf8NhfZ6uzUqvs8Ddj22bqomOZMeMtBUyN0WS1C4wrfrVGyAfbiQ3ZhL+ufnhQ5RXig3yG++sgvvI/q/hkdX7gW7C1mCAWmrLPs9XfyVizLYP/UN7OGI8HVX0m1rSIK59jJEvtMjr5m1EV9XVWZzHjLQVMjVFRyH8ZDRqdSnRlxou5Djeg8lPGFd/8ZfgFb/zLzlfhhZXGDe0OfL4jbwH85OrvZByF+3nBWpcZR7JAUVbTT1xf6zYTmc4Z34Qfv105Md5QwNQYbTb7L2OXdQKRHF5ENbxWr7H6Txl3TJwS37xmQ+fbfL4KP6wJArPJ1+HJkRzE0TCx+jsZd6HUmo0vM4ZuEY1vso/k3a5iqyPyN+O/7Z3rlqI4EIBDsJNpBERRREUQvCDetX3/Z9tUIICjfc5O657VseqPsSyqQj5TuXiIk7znhrTE+AcV/M8wmmVSH6YlxqhcCU+KudwDMHoiUrwUPo2TwHgdosK4kvkW5v6jevifYZyqp9+h19zAaJUYm2b5fy5Vra8wnnlDao0So/UEGDdFkxHyS6ytCoxfMGIRNcg/BqNFO81mwrPIEstxjVyHqPfGdbGkndyP0eXeGqQFuVWTuSe4jTHjx/B7jOrCfcG681QY+9TJV04BTLYKjHNqyInPeDN9GMYPwWYrJ+wCk0auQ1QYLZ6E+dw2vh9ji+c7iDHMVvIMOLmJccWNIfkOY3XhMK9Kyp8Ko+iECaTVg5d/W/OZ6kl+5SLuh/Vqnnn3pxjtMWexGBDhWz83wdlViAqjqMZYFlvkbowxVwv/I5+Jmx3L+Lq6mQpjv0O35FuMtQs1GONt7ckwNnewp5pwfpxXGIc+N9snyqKLdtzyYnX+0z3Vpse1RttIemK6cRWihjHu8WNb4730foybcrwbifnvgXJt1/McXd1MhTHjTrGp2mpfY6xdmDqwbnSeDCMJJ7pPO63LXzgs2EZZDi7HRpJ12P5nv3Aka7n9E+x6NNnMl5Cifg9Rw0iCtaF2eO7E6JfbG3ZHjBqRyZz11NDVzVQY19XjbNo1xvqFcsvpAIvaZ8L4OLfv8XtjKsf04N9sESPG58Xo+Ha5WYEYXxbjL+5nbVPuHCLG18UYuqbDkoZNEOMrY/zfGxwxIkbEiBgRI2JEjIgRMSJGxIgYESNiRIyIETEiRsSIGBEjYnw3jHi68d9wujEKCgoKCgoKCgoKCgoKCsofi8X7j3LVNcmUp9ikr4/R/rCwSV8fI8oDxBsTonuErPxbpUsLEujMaNsCY9dgOzhXxaDehCg1ObSo2TBJAKc8AJ/S3PXpMZDve4uauUnNdp5Uv1qMHWPpwWv4ZMi7nZNSWnxksNPBZK2gjAhSeIuXjpPZl1bvJ790Ejp0StbZrdKlBTGXh62XiSYzoq2/JgM2iT86c6W2jV08YjWMpbkZWOK1mWiDyHEr81PqUolx7rT722QHqoPLAKMZbZXS4i0rpb0vcKEiCim82b4+iPzswuoNJXLCge9PiL+/VfrNgok+tKW2BU+Br6i976TEnthKvYf2XVcYK3Php+uRiA4JOZ+VegXmO4lxuGkS8mmSlSNUGWAUAZTSgvNdAM7iSIqIslq5tzObwhED07rVG4rNBuPdbtGn81ulS4sZZ0J4asGzzwE/2Cb3FjFR6k84Y8mtMFbmA5ENEzKTObpUN8B8lifV6Wwt0ilZwEg5AozwTHWhtODxZ7NBiMjXRUTpJve2AS9T/lW3ekfRxkvXbc2026ULi7HRBxHdy4IzV/skjNq+kyr1uI5RtGZlnkqMbt7wSt0ozAXGwDA3ewFkU2IUcyillJcrQHlEcFN4+8wxbi+s3lDGeq+fMn18u3RhMYFe+LUUXLYikbFm1BVDlDFT6gjyW2bmfUlky8o8xxjBKXTdk1LvC3OBcdYLRTr2yKoj8mW7wKiUdUBFxDypSm/7PKla745RzAvgBLX0dsk9196FXmswSOAUuOPc8hZigBsFK7pV6tDT05WY4oTGcuA6Zs08xwifRz1XqW1/mZ6ZxDiikeWyRBDapSPxKjEqZR1QERGqVXhrJvoh8k/k3TESY0nI0vimdFzW38U6c3ZTWHD4TtaE8Yn6bqkmsUY9McUhUUI1MehV5jlG+Nz4rMz7R+Z9SIzNtdM57cVseGBSLyswKuUFoCIiVKvw1tdYT65q3hzjY+Wu9XwAS8KFhq342hhj6sZ7x8VWfG2M5JxQoxtiK6Kg/DXyDxV9nWTmVk1ZAAAAAElFTkSuQmCC" alt="Authorization Deny flow"></p> <p>Each request sent to the plugin includes the authenticated user, the HTTP headers, and the request/response body. Only the user name and the authentication method used are passed to the plugin. Most importantly, no user credentials or tokens are passed. Finally, not all request/response bodies are sent to the authorization plugin. Only those request/response bodies where the <code class="language-plaintext highlighter-rouge">Content-Type</code> is either <code class="language-plaintext highlighter-rouge">text/*</code> or <code class="language-plaintext highlighter-rouge">application/json</code> are sent.</p> <p>For commands that can potentially hijack the HTTP connection (<code class="language-plaintext highlighter-rouge">HTTP Upgrade</code>), such as <code class="language-plaintext highlighter-rouge">exec</code>, the authorization plugin is only called for the initial HTTP requests. Once the plugin approves the command, authorization is not applied to the rest of the flow. Specifically, the streaming data is not passed to the authorization plugins. For commands that return chunked HTTP response, such as <code class="language-plaintext highlighter-rouge">logs</code> and <code class="language-plaintext highlighter-rouge">events</code>, only the HTTP request is sent to the authorization plugins.</p> <p>During request/response processing, some authorization flows might need to do additional queries to the Docker daemon. To complete such flows, plugins can call the daemon API similar to a regular user. To enable these additional queries, the plugin must provide the means for an administrator to configure proper authentication and security policies.</p> <h2 id="docker-client-flows">Docker client flows</h2> <p>To enable and configure the authorization plugin, the plugin developer must support the Docker client interactions detailed in this section.</p> <h3 id="setting-up-docker-daemon">Setting up Docker daemon</h3> <p>Enable the authorization plugin with a dedicated command line flag in the <code class="language-plaintext highlighter-rouge">--authorization-plugin=PLUGIN_ID</code> format. The flag supplies a <code class="language-plaintext highlighter-rouge">PLUGIN_ID</code> value. This value can be the plugin’s socket or a path to a specification file. Authorization plugins can be loaded without restarting the daemon. Refer to the <a href="../../reference/commandline/dockerd/index#configuration-reload-behavior"><code class="language-plaintext highlighter-rouge">dockerd</code> documentation</a> for more information.</p> <div class="highlight"><pre class="highlight" data-language="">$ dockerd --authorization-plugin=plugin1 --authorization-plugin=plugin2,...
+</pre></div> <p>Docker’s authorization subsystem supports multiple <code class="language-plaintext highlighter-rouge">--authorization-plugin</code> parameters.</p> <h3 id="calling-authorized-command-allow">Calling authorized command (allow)</h3> <div class="highlight"><pre class="highlight" data-language="">$ docker pull centos
+&lt;...&gt;
+f1b10cd84249: Pull complete
+&lt;...&gt;
+</pre></div> <h3 id="calling-unauthorized-command-deny">Calling unauthorized command (deny)</h3> <div class="highlight"><pre class="highlight" data-language="">$ docker pull centos
+&lt;...&gt;
+docker: Error response from daemon: authorization denied by plugin PLUGIN_NAME: volumes are not allowed.
+</pre></div> <h3 id="error-from-plugins">Error from plugins</h3> <div class="highlight"><pre class="highlight" data-language="">$ docker pull centos
+&lt;...&gt;
+docker: Error response from daemon: plugin PLUGIN_NAME failed with error: AuthZPlugin.AuthZReq: Cannot connect to the Docker daemon. Is the docker daemon running on this host?.
+</pre></div> <h2 id="api-schema-and-implementation">API schema and implementation</h2> <p>In addition to Docker’s standard plugin registration method, each plugin should implement the following two methods:</p> <ul> <li> <p><code class="language-plaintext highlighter-rouge">/AuthZPlugin.AuthZReq</code> This authorize request method is called before the Docker daemon processes the client request.</p> </li> <li> <p><code class="language-plaintext highlighter-rouge">/AuthZPlugin.AuthZRes</code> This authorize response method is called before the response is returned from Docker daemon to the client.</p> </li> </ul> <h4 id="authzpluginauthzreq">/AuthZPlugin.AuthZReq</h4> <p><strong>Request</strong>:</p> <div class="highlight"><pre class="highlight" data-language="">{
+    "User":              "The user identification",
+    "UserAuthNMethod":   "The authentication method used",
+    "RequestMethod":     "The HTTP method",
+    "RequestURI":        "The HTTP request URI",
+    "RequestBody":       "Byte array containing the raw HTTP request body",
+    "RequestHeader":     "Byte array containing the raw HTTP request header as a map[string][]string "
+}
+</pre></div> <p><strong>Response</strong>:</p> <div class="highlight"><pre class="highlight" data-language="">{
+    "Allow": "Determined whether the user is allowed or not",
+    "Msg":   "The authorization message",
+    "Err":   "The error message if things go wrong"
+}
+</pre></div> <h4 id="authzpluginauthzres">/AuthZPlugin.AuthZRes</h4> <p><strong>Request</strong>:</p> <div class="highlight"><pre class="highlight" data-language="">{
+    "User":              "The user identification",
+    "UserAuthNMethod":   "The authentication method used",
+    "RequestMethod":     "The HTTP method",
+    "RequestURI":        "The HTTP request URI",
+    "RequestBody":       "Byte array containing the raw HTTP request body",
+    "RequestHeader":     "Byte array containing the raw HTTP request header as a map[string][]string",
+    "ResponseBody":      "Byte array containing the raw HTTP response body",
+    "ResponseHeader":    "Byte array containing the raw HTTP response header as a map[string][]string",
+    "ResponseStatusCode":"Response status code"
+}
+</pre></div> <p><strong>Response</strong>:</p> <div class="highlight"><pre class="highlight" data-language="">{
+   "Allow":              "Determined whether the user is allowed or not",
+   "Msg":                "The authorization message",
+   "Err":                "The error message if things go wrong"
+}
+</pre></div> <h3 id="request-authorization">Request authorization</h3> <p>Each plugin must support two request authorization messages formats, one from the daemon to the plugin and then from the plugin to the daemon. The tables below detail the content expected in each message.</p> <h4 id="daemon---plugin">Daemon -&gt; Plugin</h4> <table> <thead> <tr> <th>Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>User</td> <td>string</td> <td>The user identification</td> </tr> <tr> <td>Authentication method</td> <td>string</td> <td>The authentication method used</td> </tr> <tr> <td>Request method</td> <td>enum</td> <td>The HTTP method (GET/DELETE/POST)</td> </tr> <tr> <td>Request URI</td> <td>string</td> <td>The HTTP request URI including API version (e.g., v.1.17/containers/json)</td> </tr> <tr> <td>Request headers</td> <td>map[string]string</td> <td>Request headers as key value pairs (without the authorization header)</td> </tr> <tr> <td>Request body</td> <td>[]byte</td> <td>Raw request body</td> </tr> </tbody> </table> <h4 id="plugin---daemon">Plugin -&gt; Daemon</h4> <table> <thead> <tr> <th>Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Allow</td> <td>bool</td> <td>Boolean value indicating whether the request is allowed or denied</td> </tr> <tr> <td>Msg</td> <td>string</td> <td>Authorization message (will be returned to the client in case the access is denied)</td> </tr> <tr> <td>Err</td> <td>string</td> <td>Error message (will be returned to the client in case the plugin encounter an error. The string value supplied may appear in logs, so should not include confidential information)</td> </tr> </tbody> </table> <h3 id="response-authorization">Response authorization</h3> <p>The plugin must support two authorization messages formats, one from the daemon to the plugin and then from the plugin to the daemon. The tables below detail the content expected in each message.</p> <h4 id="daemon---plugin-1">Daemon -&gt; Plugin</h4> <table> <thead> <tr> <th>Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>User</td> <td>string</td> <td>The user identification</td> </tr> <tr> <td>Authentication method</td> <td>string</td> <td>The authentication method used</td> </tr> <tr> <td>Request method</td> <td>string</td> <td>The HTTP method (GET/DELETE/POST)</td> </tr> <tr> <td>Request URI</td> <td>string</td> <td>The HTTP request URI including API version (e.g., v.1.17/containers/json)</td> </tr> <tr> <td>Request headers</td> <td>map[string]string</td> <td>Request headers as key value pairs (without the authorization header)</td> </tr> <tr> <td>Request body</td> <td>[]byte</td> <td>Raw request body</td> </tr> <tr> <td>Response status code</td> <td>int</td> <td>Status code from the docker daemon</td> </tr> <tr> <td>Response headers</td> <td>map[string]string</td> <td>Response headers as key value pairs</td> </tr> <tr> <td>Response body</td> <td>[]byte</td> <td>Raw docker daemon response body</td> </tr> </tbody> </table> <h4 id="plugin---daemon-1">Plugin -&gt; Daemon</h4> <table> <thead> <tr> <th>Name</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Allow</td> <td>bool</td> <td>Boolean value indicating whether the response is allowed or denied</td> </tr> <tr> <td>Msg</td> <td>string</td> <td>Authorization message (will be returned to the client in case the access is denied)</td> </tr> <tr> <td>Err</td> <td>string</td> <td>Error message (will be returned to the client in case the plugin encounter an error. The string value supplied may appear in logs, so should not include confidential information)</td> </tr> </tbody> </table> 
+<p><a href="https://docs.docker.com/search/?q=security">security</a>, <a href="https://docs.docker.com/search/?q=authorization">authorization</a>, <a href="https://docs.docker.com/search/?q=authentication">authentication</a>, <a href="https://docs.docker.com/search/?q=docker">docker</a>, <a href="https://docs.docker.com/search/?q=documentation">documentation</a>, <a href="https://docs.docker.com/search/?q=plugin">plugin</a>, <a href="https://docs.docker.com/search/?q=extend">extend</a></p>
+<div class="_attribution">
+  <p class="_attribution-p">
+    &copy; 2019 Docker, Inc.<br>Licensed under the Apache License, Version 2.0.<br>Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. in the United States and/or other countries.<br>Docker, Inc. and other parties may also have trademark rights in other terms used herein.<br>
+    <a href="https://docs.docker.com/engine/extend/plugins_authorization/" class="_attribution-link">https://docs.docker.com/engine/extend/plugins_authorization/</a>
+  </p>
+</div>