Saml2EncryptedAssertion #1025

GeoK · 2018-09-26T01:43:18Z

Key Point:

AES-GCM is still not supported by System.Security.Cryptography. Therefore using IdentityModel extensions project to Encrypt/Decrypt a Saml2 Assertion, using an AES-GCM algorithm, will result with an exception. One should override CryptoProviderFactory and AuthenticationEncryptionProvider (similar to the ones developed for test) in order to use existing logic to Encrypt/Decrypt a Saml2 Assertion (using an AES-GCM algorithm).

Summary:

Saml2 tokens can have encrypted assertions. The goal of this PR is to enable basic support for encrypting and decrypting a Saml2Assertion, based on the latest xml enc standard, using modern authenticated encryption mechanism (AES-GCM) and key wrap (transport) mechanism (RSA-OAEP-MGF1P), and without introducing any breaking changes to the current project infrastructure.

The following scenarios are supported:

Encryption using a pre-shared symmetric key (session key) to encrypt an assertion: Session key will not be serialized and Relying Party must be able to locally determine the decryption key.
New session key will be created to encrypt an assertion and session key will be wrapped using a provided asymmetric public-key (X.509 certificate).

Saml2EncryptedAssertion support (basic profile):

When an assertion is to be signed and encrypted, the following rules apply. A relying party MUST perform signature validation and decryption in the reverse order that signing and encryption were performed. When a signed element is encrypted, the signature MUST first be calculated and placed within the element before the element is encrypted.
The following authenticated encryption algorithms are supported: AES128-GCM, AES192-GCM, and AES256-GCM
The following key-wrap algorithms is supported: RSA-OAEP-MGF1P
EncryptionMethod element is treated as required as there is no support for users to provide an encryption algorithm.
If an encrypted key is NOT included in the XML instance, then the relying party must be able to locally determine the decryption key.
EncryptedKey element (if available) must be next to associated EncryptedData element, within the enclosing Saml parent element. EncryptedKey element embedded in EncryptedData element is not currently supported.
If the encrypted key is included in the XML instance, then it SHOULD be referenced within the associated xenc:EncryptedData element. When an xenc:EncryptedKey element is used, the ds:KeyInfo element within xenc:EncryptedData SHOULD reference the xenc:EncryptedKey element using a ds:RetrievalMethod element of Type http://www.w3.org/2001/04/xmlenc#EncryptedKey. In addition, an xenc:EncryptedKey element SHOULD contain an xenc:ReferenceList element containing a xenc:DataReference that references the corresponding xenc:EncryptedData element(s) that the key was used to encrypt.
CarriedKeyName (multicast) is not supported.
Encoding attribute of EncryptedType is always set to base64 and MimeType attribute is ignored.

Implementation notes:

Current Saml2 project infrastructure is leverage to seamlessly include support for Saml2EncryptedAssertion, without introducing any breaking changes.
Saml2Assertion is enriched with a public bool property Encrypted which indicates if the assertion is Encrypted or not. In case when the assertion is encrypted, public string property EncryptedAssertion will be populated with raw assertion data. Any GET operation on encrypted Saml2Assertion will result with a corresponding exception being throw.
In order to encrypt a Saml2Assertion, one needs to set EncryptingCredentials on SecurityTokenDescriptor, while creating a Saml2SecurityToken. In case when EncryptingCredentials key is an asymmetric security key, an assertion will be encrypted using a new session key (and encryption algorithm) that will be wrapped using a provided asymmetric key and an algorithm. In case when EncryptingCredentials key is a symmetric security key, an assertion will be encrypted using a pre-shared symmetric key (session key) and a provided encryption algorithm.
In order to decrypt a Saml2EncryptedAssertion, one needs to set TokenDecryptionKey or TokenDecryptionKeyResolver delegate on TokenValidationParamaters when calling ValidateToken method.
New classes are added under Microsoft.IdentityModel.Xml project to support XML encryption data types used for Saml2EncryptedAssertion encryption operations.
KeyInfo class was not fully refactored to support KeyInfo clauses as that would lead to a breaking change.
Saml2EncryptedAssertion related logic is mostly concentrated in Saml2Serializer class.

Resolves: #734

henrik-me · 2018-09-27T22:25:39Z

src/Microsoft.IdentityModel.Tokens/LogMessages.cs

@@ -181,6 +184,7 @@ internal static class LogMessages
        public const string IDX10685 = "IDX10685: Unable to Sign, Internal SignFunction is not available.";
        public const string IDX10686 = "IDX10686: Unable to Verify, Internal VerifyFunction is not available.";
        public const string IDX10687 = "IDX10687: Unable to create a AsymmetricAdapter. For NET45 or NET451 only types: '{0}' or '{1}' are supported. RSA is of type: '{2}'..";
+        public const string IDX10688 = "IDX10688: The algorithm '{0}' is not currently supported. In order to use the algorithm '{0}' one should override CryptoProviderFactory and AuthenticatedEncryptionProvider to provide support.";


In order to use the algorithm '{0}' one should override CryptoProviderFactory and AuthenticatedEncryptionProvider to provide support. [](start = 98, length = 133)

suggestion, replace "in order...
with:
It's possible to provide your own implementation of the algorithm by overriding CryptoProviderFactory and AuthenticatedEncryptionProvider.

You can potentially add an aka.ms link which points to the test implementation you have. #Closed

Good point. I'll create the link and edit the log message #Closed

addressed with: b9c796d
#Closed

henrik-me · 2018-09-27T22:35:39Z

src/Microsoft.IdentityModel.Tokens/Encryption/AuthenticatedEncryptionProvider.cs

+                    throw LogHelper.LogExceptionMessage(new ArgumentException(LogHelper.FormatInvariant(LogMessages.IDX10649, Algorithm)));
+
+                Key = key;
+                Algorithm = algorithm;


suggestion: move setting key/algorithm to after if/else. This means you can make the above just an if (!isAes...)
objective: reduce nesting for readability.

I supose this algo can be considered "SupportedIfYouBringYourOwnImplementation" #Closed

I'll put a comment on top of AES-GCM algo definitions to improve clarity and set expectations.
Also, I'll refactor the constructor to increase current readability.
When we add AES-GCM support it might be better to return to if (isAesGcm) to separate support for AES-GCM from other authenticated encryption algorithms. #Closed

addressed with: c9daa02 and c80fbb9 #Closed

henrik-me · 2018-09-27T22:44:41Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2SecurityTokenHandler.cs

+#if NET45 || NET451
+                settings.XmlResolver = null;
+#endif
+                using (var reader = XmlReader.Create(stringReader, settings))


XmlReader.Create(stringReader, settings)) [](start = 36, length = 41)

Suggestion: The library could have a utility function to create this one ensuring that everyone creates the XmlReader with the appropriate (secure) XmlReaderSettings #Closed

agree - same settings are created more than once throughout the project. #Closed

addressed with: bfaa792 #Closed

henrik-me · 2018-09-27T22:46:24Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2SecurityTokenHandler.cs

+                        reader.MoveToContent();
+                        return reader.IsStartElement(Saml2Constants.Elements.EncryptedAssertion, Saml2Constants.Namespace);
+                    }
+                    catch (Exception)


is it possible to catch only specific exceptions? Ideally some system exceptions should not be swallowed. #Pending

I'll think about this. The goal of this method is just to return True if first/start element of provided string is EncryptedAssertion and return False otherwise. I don't really care at that point if the string is valid XML or not.

However, I think that it definitely adds value to include exception message to log information.

addressed with: 6434db7
#Closed

another reason for me asking is that it's a best practice to only catch exceptions you know what are. as mentioned certain system exceptions should ideally never be captured, it's better from a security perspective to let the code fail with an exception.

In reply to: 221345997 [](ancestors = 221345997)

henrik-me · 2018-09-27T22:48:46Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

+
+                // Set Digest method for EncryptedKey
+                if (SecurityAlgorithms.RsaOaepMgf1pKeyWrap.Equals(encryptingCredentials.Alg, StringComparison.Ordinal))
+                    encryptedAssertion.EncryptedKey.EncryptionMethod.DigestMethod = SecurityAlgorithms.Sha1Digest;


will thinks just work if the digest method is not set? otherwise perhaps you will have to throw an exception?

Other algorithms may not have DigestMethod (e.g. rsa-1_5) under EncryptionMethod element. For the current implementation we are using default rsa-oaep-mgf1p parameters.

henrik-me · 2018-09-27T22:49:45Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

+                    encryptedAssertion.EncryptedKey.EncryptionMethod.DigestMethod = SecurityAlgorithms.Sha1Digest;
+
+                // Set X509CertificateData
+                if (encryptingCredentials.Key is X509SecurityKey)


if (encryptingCredentials.Key is X509SecurityKey) [](start = 15, length = 50)

same though as above, what if this is not true, will the method still behave as expected? what about dependencies upstream? consider if an exception should be thrown.

this element is optional, but it's might be useful when when users are providing custom KeyResolving logic using TokenDecryptionKeyResolver delegate.
Current implementation is relying on using TokenDecryptionKey (set on TokenValidationParams) to decrypt an assertion, if TokenDecryptionKeyResolver delegate is not set.

henrik-me · 2018-09-27T22:51:54Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

+                var settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit };
+#if NET45 || NET451
+                settings.XmlResolver = null;
+#endif


as mentioned, a utility method for this and perhaps even for the variations of readers. #Closed

agree - same settings are created more than once throughout the project. #Closed

addressed with: bfaa792 #Closed

henrik-me · 2018-09-27T22:53:09Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

@@ -1516,7 +1752,7 @@ protected virtual void WriteAdvice(XmlWriter writer, Saml2Advice advice)
        }

        /// <summary>
-        /// Writes the &lt;Assertion> element.
+        /// Writes the &lt;Assertion> or &lt;EncryptedAssertion> element.


[](start = 36, length = 1)

consider : gt; ? ... same towards the end of the line..

Just being consistent - this pattern (&lt NODE >) is used across the library.

henrik-me · 2018-09-27T22:56:20Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

@@ -2250,6 +2518,89 @@ protected virtual void WriteSubjectLocality(XmlWriter writer, Saml2SubjectLocali
            writer.WriteEndElement();
        }

+        private EncryptedData CreateEncryptedDataHelper(SymmetricSecurityKey key, string algorithm, byte[] assertionData, EncryptingCredentials encryptingCredentials)


private E [](start = 8, length = 9)

it seems to me like the functions for creating the helper which essentially returns Encrypted data (I'm a bit confused about that), should be in another class? Or the methods names should simply not be called Helper #Closed

I'll think about refactoring these. #Closed

addressed with: ac21868
#Closed

henrik-me · 2018-09-29T00:45:30Z

src/Microsoft.IdentityModel.Xml/EncryptionMethod.cs

+
+                reader.ReadStartElement(XmlEncryptionConstants.Elements.EncryptionMethod, XmlEncryptionConstants.Namespace);
+
+                while (reader.IsStartElement())


while (reader.IsStartElement()) [](start = 16, length = 31)

what is reader.IsSTartElement supposed to do? Reading this code I would be afraid that it would either potentially just have one element to read, however if it never reads anything this will be an endless loop

IsStartElement checks if xml reader is pointing to a start tag or empty element tag.
In case where there is nothing to read, reader will be pointing to an EndElement and exit from the while loop.

This logic is implemented because EncryptionMethod supports any element as a child. For now, we care only about DigestMethod and we are ignoring (but logging) other elements that may appear.

That said, it might be better to use reader.Skip() instead of reader.Read() on ln. 109 as DigestMethod by xenc xsd schema might have child elements (it's usually an empty element)

henrik-me · 2018-09-29T00:48:04Z

src/Microsoft.IdentityModel.Xml/XMLEncryptionConstants.cs

+
+        public const string Prefix = "xenc";
+
+        public static class Attributes


does this library use embedding of types inside of other types? If not I would have suggested moving to separate files and separate by namespace instead of using embedded types, thoughts?

This is more of a utility class. While coding it's easy to find a specific constant i.e. an Attribute by typing XmlEncCostants.Attribute.

Not really sure if I understand - Are you suggesting that it would be a good idea to create a class hierarchy based on an xenc xsd schema e.g. EncryptionMethod contains only Algorithm as an attribute and KeySize, OAEPparams as elements.

addressed with: 3ebd2b7

henrik-me · 2018-09-29T00:48:46Z

test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandlerTests.cs

@@ -414,23 +414,23 @@ public static TheoryData<CreateTokenTheoryData> RoundTripJWEKeyWrappingTheoryDat
                        ValidationParameters = Default.TokenValidationParameters(KeyingMaterial.RsaSecurityKey_2048, Default.SymmetricSigningKey256),
                        Payload = Default.PayloadString,
                        SigningCredentials = Default.SymmetricSigningCredentials,
-                        EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256)


RsaOaepKeyWrap [](start = 129, length = 14)

don't you still need the old test?

that's a good point. We decided to support wrong RsaOaepKeyWrap identifier so we should have tests for that one too.

addressed with: 0b0abbf

henrik-me · 2018-09-29T00:49:21Z

test/Microsoft.IdentityModel.Tests/KeyingMaterial.cs

+        public static byte[] DefaultSymmetricKeyBytes_192 = Convert.FromBase64String(DefaultSymmetricKeyEncoded_192);
+        public static SymmetricSecurityKey DefaultSymmetricSecurityKey_192 = new SymmetricSecurityKey(DefaultSymmetricKeyBytes_192) { KeyId = "DefaultSymmetricSecurityKey_192" };
+
+


nit: one empty too many

addressed with: 86c0809

henrik-me · 2018-09-29T00:52:00Z

test/Microsoft.IdentityModel.Tokens.Saml.Tests/Helpers/AesGcmAuthenticatedEncryptionProvider.cs

+namespace Microsoft.IdentityModel.Tokens.Saml.Tests
+{
+    // Helper AuthenticatedEncryptionProvider class made to mimic AES-GCM
+    // remove when AES-GCM is released and supported


// [](start = 4, length = 2)

it seems like you are not using xml comments, I suggest using xml comments instead of this. Also in test code

Are we compiling doc for test code as well?
Is using xml comments in test projects needed by some process or it serves for readability purposes?

henrik-me · 2018-09-29T00:54:08Z

src/Microsoft.IdentityModel.Xml/XmlUtil.cs

@@ -430,5 +431,34 @@ internal static string[] TokenizeInclusiveNamespacesPrefixList(string inclusiveN
                return result;
            }
        }
+
+#if NET45 || NET451
+        private static readonly XmlReaderSettings SafeSettings = new XmlReaderSettings { XmlResolver = null, DtdProcessing = DtdProcessing.Prohibit };


suggestion: SafeXmlReaderSettings

addressed with: 81f395c

henrik-me · 2018-09-29T00:57:52Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

@@ -2250,6 +2466,172 @@ protected virtual void WriteSubjectLocality(XmlWriter writer, Saml2SubjectLocali
            writer.WriteEndElement();
        }

+        private EncryptedData CreateEncryptedData(byte[] assertionData, EncryptingCredentials encryptingCredentials, out SymmetricSecurityKey sessionKey)


EncryptedData [](start = 16, length = 13)

suggestion: instead of an out parameter you can also return a tuple (if the platforms this runs on support value tuples that might be even better.

I was thinking tuples while refactoring this method, and it seemed to me that using out param is a bit cleaner, considering that it works on each platform and that CreateEncryptedData is a private method.
Is there a reason why tuples (not ValueTuples) are preferable over out param, for this specific case?

henrik-me · 2018-09-29T01:00:07Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Serializer.cs

+            // AsymmetricSecurityKey is provided:
+            // New session key will be created to encrypt an assertion
+            // Session key will be wrapped with provided AsymmetricSecurityKey
+            if (encryptingCredentials.Key is AsymmetricSecurityKey)


if [](start = 12, length = 2)

consider inverting all your if's moving all the short functions on top (e.g. Symmetric does nothing, and not assymetric does nothing. this will give an easy overview of the various return statements from the function.

addressed with: a562057

henrik-me · 2018-09-29T01:05:04Z

src/Microsoft.IdentityModel.Tokens/SecurityAlgorithms.cs

@@ -39,6 +39,12 @@ public static class SecurityAlgorithms
        public const string Aes256Encryption = "http://www.w3.org/2001/04/xmlenc#aes256-cbc";
        public const string DesEncryption = "http://www.w3.org/2001/04/xmlenc#des-cbc";

+        // Currently not supported. It's possible to provide your own implementation of the algorithm by overriding CryptoProviderFactory and AuthenticatedEncryptionProvider.
+        // See: https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM


consider adding these as xml comments to all the consts. that way a developer will actually see these comments in the tooltip.

addressed with: c8e9d09

henrik-me · 2018-09-29T01:06:23Z

src/Microsoft.IdentityModel.Tokens/LogMessages.cs

@@ -180,7 +183,8 @@ internal static class LogMessages
        public const string IDX10684 = "IDX10684: Unable to create a AsymmetricAdapter, Algorithm: '{0}', Key: '{1}'.";
        public const string IDX10685 = "IDX10685: Unable to Sign, Internal SignFunction is not available.";
        public const string IDX10686 = "IDX10686: Unable to Verify, Internal VerifyFunction is not available.";
-        public const string IDX10687 = "IDX10687: Unable to create a AsymmetricAdapter. For NET45 or NET451 only types: '{0}' or '{1}' are supported. RSA is of type: '{2}'..";
+        public const string IDX10687 = "IDX10687: Unable to create a AsymmetricAdapter. For NET45 or NET451 only types: '{0}' or '{1}' are supported. RSA is of type: '{2}'.";
+        public const string IDX10688 = "IDX10688: The algorithm '{0}' is not currently supported. It's possible to provide your own implementation of the algorithm by overriding CryptoProviderFactory and AuthenticatedEncryptionProvider. Example: aka.ms/identitymodel-aesgcm-support";


aka.ms/identitymodel-aesgcm-support [](start = 246, length = 35)

did you add the wiki page/sample for this and enable the aka.ms link?

aka.ms links points to the code developed to support AES-GCM tests. Do you suggest that code sample doesn't give enough information/guidance to a developer and that I should add a wiki page as well?

henrik-me

🕐

brentschmaltz · 2018-11-20T04:47:55Z

src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2Assertion.cs

-            set;
+            get
+            {
+                if (Encrypted)


We could just return null here, and not throw.
The use case is a user created a SAML token with just encrypted assertion, that would be the only value that is not null.

This would allow us to remove the type Saml2SecurityTokenEncryptedAssertionException.

616b2f · 2019-03-11T11:09:32Z

Looks great! Any clue in which version this would be awailable?

GeoK · 2019-03-11T16:45:13Z

Looks great! Any clue in which version this would be awailable?

The plan is to make this feature available in the next major release, probably 6.x.
That being said, this is feature is currently on hold and requires more work.

616b2f · 2019-03-11T19:03:53Z

Thank you for your prompt reply. Looking forward to 6.x :)

thuannguy · 2020-04-15T01:12:16Z

I would love to have this feature. Encryption is mandatory for my customers :)

brentschmaltz · 2020-04-16T17:33:58Z

@thuannguy yep, we need this feature.
I will see if we can get a timeline established.

brentschmaltz · 2020-05-27T12:57:02Z

We may want to include aes-256cbc as AzureAD supports this.

GeoK requested a review from brentschmaltz September 26, 2018 01:43

GeoK changed the title ~~Saml2EncryptedAssertion~~ Saml2EncryptedAssertion (#734) Sep 26, 2018

GeoK changed the title ~~Saml2EncryptedAssertion (#734)~~ Saml2EncryptedAssertion Sep 26, 2018

GeoK added Enhancement The issue is a new feature PR Submitted labels Sep 26, 2018

GeoK requested a review from henrik-me September 27, 2018 21:58

henrik-me reviewed Sep 27, 2018

View reviewed changes

henrik-me reviewed Sep 29, 2018

View reviewed changes

henrik-me requested changes Sep 29, 2018

View reviewed changes

GeoK force-pushed the geok/Saml2EncryptedAssertion branch from e09cd2e to 0b0abbf Compare October 1, 2018 19:48

brentschmaltz reviewed Nov 20, 2018

View reviewed changes

GeoK force-pushed the geok/Saml2EncryptedAssertion branch from 3ebd2b7 to 1947555 Compare December 28, 2018 20:02

GeoK removed the PR Submitted label Dec 28, 2018

GeoK force-pushed the geok/Saml2EncryptedAssertion branch 2 times, most recently from c6a0aec to a685ca0 Compare January 2, 2019 17:56

616b2f mentioned this pull request Mar 7, 2019

[WIP] Port to netstandard2.0 IdentityServer/IdentityServer4.WsFederation#12

Closed

8 tasks

616b2f mentioned this pull request Sep 25, 2019

[WIP] Port to netstandard2.0 IdentityServer/IdentityServer4.WsFederation#14

Merged

8 tasks

brentschmaltz force-pushed the geok/Saml2EncryptedAssertion branch from a685ca0 to 9789c2c Compare May 14, 2020 21:50

brentschmaltz force-pushed the geok/Saml2EncryptedAssertion branch 4 times, most recently from 659a682 to e5f522b Compare May 27, 2020 15:41

SAML2 EncryptedAssertion

8ccee2f

brentschmaltz force-pushed the geok/Saml2EncryptedAssertion branch from e5f522b to 8ccee2f Compare May 27, 2020 15:42

gislikonrad mentioned this pull request Nov 24, 2020

AuthenticatedEncryptionProvider is impossible to override #1551

Open


		reader.ReadStartElement(XmlEncryptionConstants.Elements.EncryptionMethod, XmlEncryptionConstants.Namespace);

		while (reader.IsStartElement())


		public const string Prefix = "xenc";

		public static class Attributes

		public static byte[] DefaultSymmetricKeyBytes_192 = Convert.FromBase64String(DefaultSymmetricKeyEncoded_192);
		public static SymmetricSecurityKey DefaultSymmetricSecurityKey_192 = new SymmetricSecurityKey(DefaultSymmetricKeyBytes_192) { KeyId = "DefaultSymmetricSecurityKey_192" };

Saml2EncryptedAssertion #1025

Are you sure you want to change the base?

Saml2EncryptedAssertion #1025

Conversation

GeoK commented Sep 26, 2018 • edited Loading

Key Point:

Summary:

Saml2EncryptedAssertion support (basic profile):

Implementation notes:

henrik-me Sep 27, 2018 • edited Loading

Choose a reason for hiding this comment

GeoK Sep 28, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

GeoK Sep 29, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

henrik-me Sep 27, 2018 • edited Loading

Choose a reason for hiding this comment

GeoK Sep 28, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

GeoK Sep 29, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

henrik-me Sep 27, 2018 • edited Loading

Choose a reason for hiding this comment

GeoK Sep 28, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

GeoK Sep 29, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

henrik-me Sep 27, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GeoK Sep 29, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henrik-me Sep 27, 2018 • edited Loading

Choose a reason for hiding this comment

GeoK Sep 28, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

GeoK Sep 29, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henrik-me Sep 27, 2018 • edited Loading

Choose a reason for hiding this comment

GeoK Sep 28, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

GeoK Sep 29, 2018 • edited by henrik-me Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henrik-me Sep 29, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henrik-me Sep 29, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

henrik-me left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

616b2f commented Mar 11, 2019

GeoK commented Mar 11, 2019

GeoK commented Sep 26, 2018 •

edited

Loading

henrik-me Sep 27, 2018 •

edited

Loading

GeoK Sep 28, 2018 •

edited by henrik-me

Loading

GeoK Sep 29, 2018 •

edited by henrik-me

Loading

henrik-me Sep 27, 2018 •

edited

Loading

GeoK Sep 28, 2018 •

edited by henrik-me

Loading

GeoK Sep 29, 2018 •

edited by henrik-me

Loading

henrik-me Sep 27, 2018 •

edited

Loading

GeoK Sep 28, 2018 •

edited by henrik-me

Loading

GeoK Sep 29, 2018 •

edited by henrik-me

Loading

henrik-me Sep 27, 2018 •

edited

Loading

GeoK Sep 29, 2018 •

edited by henrik-me

Loading

henrik-me Sep 27, 2018 •

edited

Loading

GeoK Sep 28, 2018 •

edited by henrik-me

Loading

GeoK Sep 29, 2018 •

edited by henrik-me

Loading

henrik-me Sep 27, 2018 •

edited

Loading

GeoK Sep 28, 2018 •

edited by henrik-me

Loading

GeoK Sep 29, 2018 •

edited by henrik-me

Loading

henrik-me Sep 29, 2018 •

edited

Loading

henrik-me Sep 29, 2018 •

edited

Loading