<H3>Special Instructions</H3><p>  <p>Run test <strong>XUA_Stored_Query</strong> before running this test, to ensure the     'success' case works first. </p>  <p>To save time, you may want to run test <strong>XUA_Repository_Restrict_Access</strong> in     parallel with this one.</p>  </p>  <p>Send your audit messages to the NIST Audit Record Repository.</p>  <H3>Description</H3><p>This test verifies that a X-Service Provider (XDS Document Registry) will not provide a query     response to a X-Service User (XDS Document Consumer) when validation of the assertion fails.</p>  <H3>Evaluation</H3>  <p>Verify that the Document Consumer received no responses to any of the queries because     validation of the assertion failed.' The Document Consumer has no indication that the     query failed because of the validation failure.</p>    <p>Also, on the <strong>NIST Audit Record Repository</strong>, verify: </p><ul>       <li>An Authentication Failure event was logged by the Document Registry for each assertion      validation failure.' This may need to be checked on the Audit Record Repository.  The audit event record will include the      identity provided in the XUA Identity Assertion.  The ATNA Audit message       <strong>UserName </strong>element records the X-User Assertion using the following      encoding: </li>       <ul>        <li><strong>alias</strong> <"user"@"issuer">"         where: </li>        <li>  <strong>alias </strong>is the optional string within the SAML Assertion's Subject element       SPProvidedID attribute </li>        <li>  <strong>user </strong>is the required content of the SAML Assertion's Subject element </li>        <li>  <strong>issuer </strong>is the X-Assertion Provider entity ID contained with the content of       SAML Assertion's Issuer element </li>       </ul>    </ul>  