<H3>Special Instructions</H3><p> <p>XDR Document Recipient (X-Service Providers) run one instance of this test.</p> <p>Before the test:</p> <ul> <li>The X-Service Provider (Doc Recipient) must configure its system to not trust the assertion provider (this is either the external X-Assertion Provider used by the Document Source, or the Doc Source itself if it is generating its own SAML assertions). The Document Recipient will receive the assertion via the Doc Source when the Doc Source Provice-and-Registers its document.</li> <li>(this part of the test is deferred for XUA testing this year): The X-Service Provider (Doc Recipient) must configure its system to reject assertions received where the authentication method used is 'InternetProtocol'. , eg it contains: </li> </ul> <p> <i><saml:AuthnStatement AuthnInstant="2007-10-08T14:49:14Z"> ' ' ' ' <saml:AuthnContext> ' ' ' ' ' ' ' ' <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol</saml:AuthnContextClassRef> ' ' ' ' </saml:AuthnContext> </saml:AuthnStatement> </i> </p> </p><H3>Description</H3><p>This tests the X-Service Provider's (Document Recipient's) ability to deny access in two cases:</p><ul> <li>Valid assertion received from an assertion provider not trusted by the Doc Recipient</li> <li>(this part of the test is deferred for XUA testing this year) The 'Connectathon Policy' states that 'InternetProtocol' is an invalid authentication method in our instituion.' A SAML assertion is received, and the authentication method -- 'InternetProtocol' ' is included in the AuthnStatement of the assertion</li> </ul><H3>Evaluation</H3><p>The Connectathon Monitor may ask you to run these steps real-time. Verify that the Document Source was not allowed to submit a document because validation of the assertion failed. The Document Source has no indication that the transaction failed because of the validation failure.</p> <p>An Authentication Failure event was logged by the Doc Recipient for each assertion validation failure.</p>