<H3>Special Instructions</H3><p>
 <p>This is not a real test; its purpose is to explain the structure of the connectathon tests you
    will perform for the XUA profile and to describe items to set up prior to starting testing. </p>
 </p>
 <H3>Description</H3>
 <p>Actors in the XUA profile can be grouped with actors in any profile with web services
    transactions (XDS.b, XDR, PDQv3, PIXv3, QED, RFD, XCA). Thus, you will be testing the exchange of XUA
    assertions in conjunction with transactions from another profile. This means you not only need to
    find your XUA test partners, you also have to find a partner which supports a web services
    transaction you support; a spreadsheet is created for each connectathon to help you with this. </p>
 <p>Here is the sequence of activities you must do to accomplish your XUA connectathon testing:</p>
 <ol>
    
 <li>Access the <a  href=http://ihewiki.wustl.edu/wiki/index.php/Europe_2009#Reference_Documents_for_Connectathon_week>'partners' spreadsheet</a>.  On the XUA tab, find partners who support a web services
     profile that you also support. 
      </li>
    
 <li>The XUA profile allows X-Service User actors to get their assertions from an external
     assertion provider (the Tiani-Spirit system will provide this service at the connectathon), or generate
     their own. You need to talk to your test partners about how your system works in this regard.</li>
    
 <li>There are 3 'flavors' of XUA tests for each web-services-based profile:</li>
    
 <ul>
     
 <li>The 'success' case (tests XUA_Doc_Source_ProvideandRegister, XUA_Stored_Query,
      XUA_Retrieve_Doc, XUA_RFD_Retrieve_Submit, XUA_PIXv3_Query, and XUA_PDQv3_Query). Your system
      can run any combination of 3 of these, eg one PIX test and 2 XDS tests. </li>
     
 <li>The 'fail' case (XUA_*_Restrict_Access tests). Again, run any 3 of these.</li>
     
 <li>A test where the X-Service_Provider does not trust the Assertion Provider
      (XUA_*_Policy_Test). Each X-Service_Provider runs just <b>one</b> of these tests.</li>
     
    
 </ul>
    
 <li>XUA tests use TLS and include ATNA logging.</li>
    
 <li>Before any of these tests can be run, each X-Service Provider actor must run one instance of
     test <b>XUA_X-Service_Provider_Setup</b>. Do that now.</li>
 </ol>
 
 <p><strong>These notes apply to testing of the XUA  profile at the Connectathon:</strong></p>
 <ol>
   <li>The method that the X-Service  User uses to get the SAML Identity Assertion is not constrained by the  profile.' Test cases for this profile cover  two methods:</li>
 </ol>
 <ul>
   <ul>
     <li><span dir="ltr"><u>Self-assertion</u> ' TheX-Service_User  does not rely on an external assertion provider; rather, it generates its own  valid SAML assertions</span></li>
     <li><span dir="ltr"><u>SAML Assertion Provider</u> ' The  X-Service_User will authenticate against an identity provide (XUA X-Assertion  Provider).' <br />
       For Connectathon testing, we will provide an Security Token Service ' STS - (X-Assertion  Provider) from which X-Service_Users can (optionally) request assertions, and  against which X-Service_Providers can validate assertions received from  Document Consumers.  This is provided by the IBM and Tiani-Spirit STS systems.<br />
     </span></li>
   </ul>
 </ul>
 <ol>
   <li value="2"><span dir="ltr">XUA X-Service Providers need to be able to 'trust' assertions provided  by a mix of X-Service_Users who either</span>
     <ul>
       <li><span dir="ltr">do self-assertion</span></li>
       <li><span dir="ltr">or, send an assertion which  originated at an external STS (X-Assertion Provider.  This is the more common case.</span></li>
     </ul>
   </li>
 
   <li><span dir="ltr">X-Service Providers need to be able to be configured to 'not trust'  assertions from a selected assertion provider.' </span></li>
   <li><span dir="ltr">(This test has been deferred for this year):' X-Service Providers need to be able to be  configured to 'not trust' assertions containing certain parameters.' For example, for the Connectathon, we will  define a 'policy' that assertions containing an authentication method of  'InternetProtocol' in its AuthnStatment should fail validation.' </span></li>
   <li><span dir="ltr">The XUA Profile constrains only a subset of the possible parameters  that can be included in a SAML assertion.'  The proper use of these specific parameters are tested; it is valid to  include other parameters in the assertion, but these are not tested.' Other parameters will not affect the validity  of the assertion.' The XUA X-Service  Provider must accept all valid SAML assertions and process attributes profiled  in ITI-40.</span></li>
   <li><span dir="ltr">In these tests XDS.b Document Registry and Document Repository actors  which are also XUA X-Service Providers do not need to support a scenario where  some Document Consumers 'in the Affinity  Domain support XUA, and some do not.' This  will not be a required test in the connectathon, although vendors are welcome  to test this scenario for 'extra credit'.</span></li>
   <li><span dir="ltr">All transactions, including those with the X-Assertion Provider, will  be done using TLS.</span></li>
   <li><span dir="ltr">Auditing will be tested:</span>
     <ul>
       <li><span dir="ltr">The XUA profile requires that the  X-Service Provider generate an ATNA audit event for 'Authentication Failure'  whenever its validation of the assertion fails.'  Eg. The Document Consumer must send an audit message when it initiates a  Registry Stored Query.' These audit events  are tested in these tests. </span></li>
       <li><span dir="ltr">The XUA profile requires that </span>"Any ATNA Audit  Messages recorded by Actor grouped with the X-Service Provider Actor, shall  have the user identity recorded according to the XUA specific ATNA encoding  rules" (See 3.40.4.2 ATNA Audit encoding). For example: when the XDS.b Document  Consumer Actor records the Stored Query event, this event record will include  the identity provided in the XUA Identity Assertion. This assures that the  X-Service User and X-Service Provider ATNA Audit messages can be correlated at  the ATNA Audit Repository." This will be tested in the XUA tests. </li>
     </ul>
   </li>
   <li><span dir="ltr">Authorization is out-of-scope for XUA, ie there are no tests that allow  or restrict a user's access to a document based on who a user (prinicpal) is,  nor are there tests that allow a user to see a subset of a patient's document  based on the contents of the assertion.'  Either the validation succeeds at the X-Service Provider, and all of a  patient's record is returned to the X-Service User, or validation fails, and  the X-Service User receives nothing.</span></li>
 </ol>
 
 <b>Configuration Items: </b><br />
 <ol><li><span dir="ltr">For X-Service Users who will request assertions from the Connectathon (IBM or Tiani)  STS, three configuration items have been identified.' The X-Service User needs to provide the  X-Assertion Provider with:<br />
 (a). </span><span dir="ltr">A user name<br />
 (b). </span><span dir="ltr">A valid password<br />
   (c). </span><span dir="ltr">The '<b>AudienceRestriction</b>' of the X-Service Provider<br />
     </span>
       </li>
 </ol>
 <blockquote>
   <p><span dir="ltr">For item (c.) at the Connectathon, to ease configuration, we will apply the  same URL to all X-Service Providers, ie all Registries and Repositories.' (Note that this URL is **not** the URL the  Document Consumer will use to query the Registry or retrieve documents from the  Repository).'' This same, general URL  used as the value of '<strong>AudienceRestriction</strong>'  for all service providers will simplify the STS configuration and will ensure  that users can' access any  Registry/Repository with the SAML token obtained from the STS.<br />
     <br />
     The required URL is :<br />
     <br />
   '  ' <b><i>http://ihe.connecthaton.XUA/X-ServiceProvider-IHE-Connectathon</b></i>
 
 <ol start="2">
   <li>The  XUA profile requires that all assertions contain a <strong>Subject (principal</strong>).' The  following table identifies pre-defined prinicipals we will use in XUA  Connectathon testing .' (The  'Subject'' in the assertion could be a  user; could be an 'application'.)' <br />
     <br />
     These principals are defined to have different combinations of assertions for  the <em>XUA "success" </em> tests   and <em>XUA_*Restrict_Access_*</em> tests, as  follows.'<br />
   <br />
   </li>
   <li><span dir="ltr">ITI-40 profiles the SAML 2.0 Assertion in ITI TF-2:3.40.4.1.2.''' The green column headings in the table  below represent the parameters profiled for the assertion.' Each row in the table represents the  requirements for the contents of one assertion that will belong to a unique  Subject.' Yellow cells identify  parameters in the assertion intended to cause the test to 'fail'.'' We assume that 'external' X-Assertion  Providers provided for use at the connectathon will be able to generate  assertions with the failure conditions contained in the following tables.' We expect that X-Service Users that are  generating their own assertions will have less flexibility. </span></li>
 </ol>
 <table border="1" cellspacing="0" cellpadding="0">
   <tr>
     <td width="117" valign="top"><p><strong>'</strong></p></td>
     <td width="226" valign="top"><p><strong>'</strong></p></td>
     <td width="281" colspan="4" valign="top"><p align="center"><strong>Conditions</strong></p></td>
     <td width="146" valign="top"><p><strong>'</strong></p></td>
     <td width="80" valign="top"><p><strong>'</strong></p></td>
     <td width="136" valign="top"><p>'</p></td>
     <td width="63" valign="top"><p><strong>'</strong></p></td>
   </tr>
   <tr>
     <td width="117" valign="top" bgcolor="#99FFFF"><p><strong>Username / password</strong></p>
         <p><strong>Will be included in:</strong><br />
             <strong>Subject <br />
     (ie principal) </strong></p></td>
     <td width="226" valign="top" bgcolor="#99FFFF"><p><strong>Subject/SubjectConfirmation</strong></p></td>
     <td width="281" valign="top" bgcolor="#99FFFF"><p><strong>Not Before</strong></p></td>
     <td width="78" valign="top" bgcolor="#99FFFF"><p><strong>NotOnOrAfter</strong></p></td>
     <td width="121" valign="top" bgcolor="#99FFFF"><p><strong>Audience</strong><br />
             <strong>Restriction</strong></p></td>
     <td width="16" valign="top" bgcolor="#99FFFF"><p><strong>'</strong></p></td>
     <td width="146" valign="top" bgcolor="#99FFFF"><p><strong>Authn</strong><br />
             <strong>Statement -></strong><br />
             <strong>AuthnContext</strong><br />
             <strong>Class Ref</strong><br />
       Or<br />
       <strong>AuthContext</strong><br />
     <strong>DeclRef</strong></p></td>
     <td width="80" valign="top" bgcolor="#99FFFF"><p><strong>Other Characteristic</strong></p></td>
     <td width="136" valign="top" bgcolor="#99FFFF"><p><strong>Used in Test</strong></p></td>
     <td width="63" valign="top" bgcolor="#99FFFF"><p><strong>Expected Result</strong></p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1">Xuagood^User /<br />
       'xua</p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top"><p>Unexpired date</p></td>
     <td width="121" valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top"><p>See Note A.</p></td>
     <td width="80" valign="top"><p>n/a</p></td>
     <td width="136" valign="top"><p>variety of XUA "success" tests </p></td>
     <td width="63" valign="top"><p>Return results</p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1"><em>Xuabaduri^User / xua</em></p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top"><p>Unexpired date</p></td>
     <td width="121" valign="top" bgcolor="#FFFF00"><p>URI of 'unknown' <br />
     X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top"><p>See Note A.</p></td>
     <td width="80" valign="top"><p>n/a</p></td>
     <td width="136" valign="top"><p>XUA_*Restrict_<br />
       Access</p></td>
     <td width="63" valign="top"><p>Deny access</p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1"><em>Xuanotyetvalid / xua</em></p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top" bgcolor="#FFFF00"><p>Vaue indicating that the    assertion is not yet valid</p></td>
     <td width="121" valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top"><p>See Note A.</p></td>
     <td width="80" valign="top"><p>n/a</p></td>
     <td width="136" valign="top"><p>XUA_*Restrict_<br />
       Access</p></td>
     <td width="63" valign="top"><p>Deny access</p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1"><em>Xuaexpired^User / xua</em></p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top" bgcolor="#FFFF00"><p>Value indicating expired    assertion</p></td>
     <td width="121" valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top"><p>See Note A.</p></td>
     <td width="80" valign="top"><p>n/a</p></td>
     <td width="136" valign="top"><p>XUA_*Restrict_<br />
       Access</p></td>
     <td width="63" valign="top"><p>Deny access</p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1"><em>Xuaunsined^user / xua</em></p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top"><p>Unexpired date</p></td>
     <td width="121" valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top"><p>See Note A.</p></td>
     <td width="80" valign="top" bgcolor="#FFFF00"><p>Unsigned assertion</p></td>
     <td width="136" valign="top"><p>XUA_*Restrict_<br />
       Access</p></td>
     <td width="63" valign="top"><p>Deny access</p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1">N/A this year</p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top"><p>Unexpired date</p></td>
     <td width="121" valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top" bgcolor="#FFFF00"><p class="style1">Invalid    AuthenStatement parameters</p></td>
     <td width="80" valign="top"><p>n/a</p></td>
     <td width="136" valign="top"><p>XUA_*Restrict_<br />
       Access</p></td>
     <td width="63" valign="top"><p>Test deferred for this year </p></td>
   </tr>
   <tr>
     <td width="117" valign="top"><p class="style1">N/A this year</p></td>
     <td width="226" valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td width="281" valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td width="78" valign="top"><p>Unexpired date</p></td>
     <td width="121" valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td width="16" valign="top"><p>'</p></td>
     <td width="146" valign="top" bgcolor="#FFFF00"><p class="style1">AuthnConextClassRef    is 'InternetProtocol' which 'policy' says is an unacceptable authentication    method</p></td>
     <td width="80" valign="top"><p>n/a</p></td>
     <td width="136" valign="top"><p>XUA_*Policy_Test</p></td>
     <td width="63" valign="top"><p>Test deferred for this year </p></td>
   </tr>
   <tr>
     <td valign="top"><p class="style1">N/A this year </p></td>
     <td valign="top"><p>Method="urn:oasis:names:<br />
       tc:SAML:2.0:cm:bearer"</p></td>
     <td valign="top"><p>Issue' instant <br />
       of the assertion</p></td>
     <td valign="top"><p>Unexpired date</p></td>
     <td valign="top"><p>URI of <br />
       X-Service_Provider</p></td>
     <td valign="top"><p>'</p></td>
     <td valign="top"><p>See Note A.</p></td>
     <td valign="top" bgcolor="#FFFF00"><p>Contains other assertions    not profiled in XUA</p></td>
     <td valign="top"><p>XUA_Stored_Query<br />
       XUA_Retrieve_Doc</p></td>
     <td valign="top"><p>Return results / <br />
       Test deferred for this year </p></td>
   </tr>
 </table>
 <p>Note  A.' Many options are possible for the  AuthnStatement parameter.' For the Connectathon,  the assertions provided to the X-Service Users by the X-Assertion Providers  will encode a timestamp representing when the authentication occurred and that  the password class was used, eg:<br />
     <br />
   '<br />
   <saml:AuthnStatement  AuthnInstant="2007-10-08T14:49:14Z"> <br />
   ' ' '  ' <saml:AuthnContext> <br />
   ' ' '  ' ' ' ' '  <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef> <br />
   ' ' '  ' </saml:AuthnContext> <br />
   </saml:AuthnStatement> </p>
 
 <H3>Evaluation</H3>
 <p>There is no evaluation for this informational 'test'. </p>
 