<H3>Special Instructions</H3><p> <p>Document Repositories (X-Service Providers) run one instance of this test.</p> <p>Before the test:</p> <ul>     <li>The X-Service Provider (Document Repository) must configure its system to not trust the     assertion provider (this is either the external     X-Assertion Provider used by the Document Consumer, or the Document Consumer itself if it is     generating its own SAML assertions).  The Repository will receive the assertion via the Document Consumer when the Consumer makes its retrieve request.</li>     <li>(this part of the test is not run this year): The X-Service Provider     (Document Repository) must configure its system to reject assertions received where the     authentication method used is 'InternetProtocol'. , eg it contains: </li> </ul> <p>     <i><saml:AuthnStatement AuthnInstant="2007-10-08T14:49:14Z">     ' ' ' ' <saml:AuthnContext> '     ' ' ' ' ' ' '     <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol</saml:AuthnContextClassRef>     ' ' ' ' </saml:AuthnContext>     </saml:AuthnStatement> </i> </p> </p><H3>Description</H3><p>This tests the X-Service Provider's (Document Repository's) ability to deny    access in two cases:</p><ul>     <li>Valid assertion received from an assertion provider not trusted by the Repository</li>     <li>(this part of the test is deferred for XUA testing this year) The 'Connectathon     Policy' states that 'InternetProtocol' is an invalid     authentication method in our instituion.' A SAML assertion is received, and the     authentication method -- 'InternetProtocol' ' is included in the     AuthnStatement of the assertion</li> </ul><H3>Evaluation</H3><p>The Connectathon Monitor may ask you to run these retrieves real-time. Verify that the Document    Consumer received no responses to any of the requests because validation of the assertion failed.    The Document Consumer has no indication that the transaction failed because of the validation    failure.</p> <p>An Authentication Failure event was logged by the Doc Repository for each assertion     validation failure.</p>