<H3>Special Instructions</H3><p> <p>Form Managers must complete test <b> XUA_X-Service_Provider_Setup</b> before running this   test.</p> </p><H3>Description</H3><p>In this test, an RFD Form Manager (X-Service Provider) verifies a principal&rsquo;s    assertions before exchanging form data with a Form    Filler (X-Service User) .&nbsp; &nbsp;The Form Manager may optionally use an external    X-Assertion Provider to validate the contents of the assertion.</p><p>This test assumes the Form Filler gets the assertion when the user logs in to the system and    then uses that one for the session (or until the assertion expires).</p><p>This tests the &lsquo;success&rsquo; case.&nbsp;&nbsp; Denial of access based    on assertions is tested in a different test - <strong>XUA_Form_Mgr_Restrict_Access</strong>.</p><H3>Evaluation</H3><p>The <strong>X-Service User (Form Filler);</strong> </p><ul>     <li>Will demonstrate that it received a response from the Form Manager &ndash; and that it     was able to successfully submit the completed form.</li>     <li>Will demonstrate that it audited the export event (submit transaction).&nbsp; This may     need to be checked on the Audit Record Repository.&nbsp; The audit event record will include     the identity provided in the XUA Identity Assertion. &nbsp;the ATNA Audit message      <strong>EventID</strong> element is "Export" and the <strong>UserName </strong>element shall     record the X-User Assertion using the following encoding: </li>     <ul>      <li>alias"&lt;"user"@"issuer"&gt;"      &nbsp;&nbsp;where: </li>      <li> <strong>alias </strong>is the optional string within the SAML Assertion's Subject element      SPProvidedID attribute </li>      <li> <strong>user </strong>is the required content of the SAML Assertion's Subject element </li>      <li> <strong>issuer </strong>is the X-Assertion Provider entity ID contained with the content of      SAML Assertion's Issuer element </li>     </ul> </ul><p>The <strong>X-Service Provider (Form Manager):</strong> </p><ul>     <li>Will demonstrate for the Connectathon Monitor, through log files or other means, that the     SAML assertion was received from the Form Filler and that its contents were verified prior to     responding to the Form Filler's requests.</li> </ul> 