<H3>Special Instructions</H3><p> <p>Document Repositories (X-Service Providers) run one instance of this test.</p> <p>Before the test:</p> <ul> <li>The X-Service Provider (Document Repository) must configure its system to not trust the assertion provider (this is either the external X-Assertion Provider used by the Document Consumer, or the Document Consumer itself if it is generating its own SAML assertions). The Repository will receive the assertion via the Document Consumer when the Consumer makes its retrieve request.</li> <li>(this part of the test is not run this year): The X-Service Provider (Document Repository) must configure its system to reject assertions received where the authentication method used is 'InternetProtocol'. , eg it contains: </li> </ul> <p> <i><saml:AuthnStatement AuthnInstant="2007-10-08T14:49:14Z"> ' ' ' ' <saml:AuthnContext> ' ' ' ' ' ' ' ' <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol</saml:AuthnContextClassRef> ' ' ' ' </saml:AuthnContext> </saml:AuthnStatement> </i> </p> </p><H3>Description</H3><p>This tests the X-Service Provider's (Document Repository's) ability to deny access in two cases:</p><ul> <li>Valid assertion received from an assertion provider not trusted by the Repository</li> <li>(this part of the test is deferred for XUA testing this year) The 'Connectathon Policy' states that 'InternetProtocol' is an invalid authentication method in our instituion.' A SAML assertion is received, and the authentication method -- 'InternetProtocol' ' is included in the AuthnStatement of the assertion</li> </ul><H3>Evaluation</H3><p>The Connectathon Monitor may ask you to run these retrieves real-time. Verify that the Document Consumer received no responses to any of the requests because validation of the assertion failed. The Document Consumer has no indication that the transaction failed because of the validation failure.</p> <p>An Authentication Failure event was logged by the Doc Repository for each assertion validation failure.</p>