<H3>Special Instructions</H3><p> <p>Run test <strong>XUA_Stored_Query</strong> before running this test, to ensure the    'success' case works first. </p> <p>To save time, you may want to run test <strong>XUA_Repository_Restrict_Access</strong> in    parallel with this one.</p> </p><H3>Description</H3><p>This test verifies that a X-Service Provider (XDS Document Registry) will not provide a query    response to a X-Service User (XDS Document Consumer) when validation of the assertion fails.</p><H3>Evaluation</H3><p>Verify that the Document Consumer received no responses to any of the queries because    validation of the assertion failed.' The Document Consumer has no indication that the    query failed because of the validation failure.</p>  <p>Also, on the <strong>Audit Record Repository</strong>, verify: </p><ul>     <li>An Authentication Failure event was logged by the Document Registry for each assertion     validation failure.' This may need to be checked on the Audit Record Repository.  The audit event record will include the     identity provided in the XUA Identity Assertion.  The ATNA Audit message      <strong>UserName </strong>element records the X-User Assertion using the following     encoding: </li>     <ul>      <li><strong>alias</strong> <"user"@"issuer">"        where: </li>      <li> <strong>alias </strong>is the optional string within the SAML Assertion's Subject element      SPProvidedID attribute </li>      <li> <strong>user </strong>is the required content of the SAML Assertion's Subject element </li>      <li> <strong>issuer </strong>is the X-Assertion Provider entity ID contained with the content of      SAML Assertion's Issuer element </li>     </ul>  </ul> 