<H3>Special Instructions</H3><p> <p>Run test <strong>XUA_Retrieve_Doc</strong> before running this test, to ensure the 'success' case works first for patient  XUA, Xavier before running this test.</p> <p>To  save time, you may want to run test <strong>XUA_Registry_Restrict_Access</strong> in parallel with this one.</p> </p><H3>Description</H3><p>This test verifies that a X-Service Provider (XDS Document Repository) will not retrieve a document for a X-Service User (XDS Document Consumer) when the assertions indicate that Repository should not grant the user access to requested documents.</p>  <H3>Evaluation</H3> <p>Verify that the Document Consumer received no responses to  any retrieve request because validation of the assertion failed.' The Document Consumer has no indication that  the retrieve failed because of the validation failure.</p>  <p>Also, on the <strong>Audit Record  Repository</strong>, verify: </p><ul>     <li>An Authentication Failure event was logged by the Document Repository for each assertion validation failure.   This may need to be checked on the Audit Record Repository.  The audit event record will include the     identity provided in the XUA Identity Assertion.  The ATNA Audit message      <strong>UserName </strong>element records the X-User Assertion using the following     encoding: </li>     <ul>      <li><strong>alias</strong> <"user"@"issuer">"        where: </li>      <li> <strong>alias </strong>is the optional string within the SAML Assertion's Subject element      SPProvidedID attribute </li>      <li> <strong>user </strong>is the required content of the SAML Assertion's Subject element </li>      <li> <strong>issuer </strong>is the X-Assertion Provider entity ID contained with the content of      SAML Assertion's Issuer element </li>     </ul>  </ul> 