<H3>Special Instructions</H3><p> <p>QED Clinical Data Source actors must complete test <b> XUA_X-Service_Provider_Setup</b> before running this    test.</p> </p> <H3>Description</H3> <p>In this test, a QED Clinical Data Source (X-Service Provider) verifies a principal's assertions    before responding to a query from a QED Clinical Data Consumer (X-Service User) .   The   QED Clinical Data Source may optionally use an external X-Assertion Provider to validate the contents of the    assertion.</p> <p>This test assumes the QED Clinical Data Consumer gets the assertion when the user logs in to the system and    then uses that one for the session (or until the assertion expires).</p> <p>This tests the 'success' case.   Denial of access based    on assertions is tested in a different test -   <strong>XUA_QED_Source_Restrict_Access</strong>.</p> <H3>Evaluation</H3> <p>The <strong>X-Service User (QED Clinical Data Consumer);</strong> </p> <ul>     <li>Will demonstrate that it received a response from the QED Source ' matches for     patient XUA, Xavier, in response to the queries.</li>     <li>Will demonstrate that it audited the query event.  This may need to be checked on     the Audit Record Repository.  The audit event record will include the identity provided     in the XUA Identity Assertion.  the ATNA Audit message <strong>EventID</strong> element     is "Query" and the <strong>UserName </strong>element shall record the X-User Assertion using the     following encoding: </li>     <ul>      <li>alias"<"user"@"issuer">"        where: </li>      <li> <strong>alias </strong>is the optional string within the SAML Assertion's Subject element      SPProvidedID attribute </li>      <li> <strong>user </strong>is the required content of the SAML Assertion's Subject element </li>      <li> <strong>issuer </strong>is the X-Assertion Provider entity ID contained with the content of      SAML Assertion's Issuer element </li>     </ul> </ul><p>The <strong>X-Service Provider (QED Clinical Data Source):</strong> </p><ul>     <li>Will demonstrate for the Connectathon Monitor, through log files or other means, that the     SAML assertion was received from the QED Consumer and that its contents were verified     prior to responding to the QED query.</li> </ul> 