<H3>Special Instructions</H3><p> <p>PDQv3 Suppliers (X-Service Providers) run one instance of this test.</p> <p>Before the test:</p> <ul>     <li>The X-Service Provider (PDQ Supplier) must configure its system to not trust the assertion     provider (this is either the external X-Assertion Provider used by the PDQ Consumer, or the PDQ     Consumer itself if it is generating its own SAML assertions). The PDQ Supplier will receive the     assertion via the PDQ Consumer when the Consumer sends its query.</li>     <li>(this part of the test is deferred for XUA testing this year): The X-Service Provider (PDQ     Supplier) must configure its system to reject assertions received where the authentication     method used is 'InternetProtocol'. , eg it contains: </li> </ul> <p>     <i><saml:AuthnStatement AuthnInstant="2007-10-08T14:49:14Z">     ' ' ' ' <saml:AuthnContext> '     ' ' ' ' ' ' '     <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol</saml:AuthnContextClassRef>     ' ' ' ' </saml:AuthnContext>     </saml:AuthnStatement> </i> </p> </p><H3>Description</H3><p>This tests the X-Service Provider's (PDQ Supplier's) ability to deny access    in two cases:</p><ul>     <li>Valid assertion received from an assertion provider not trusted by the PDQ Supplier</li>     <li>(this part of the test is deferred for XUA testing this year) The 'Connectathon     Policy' states that 'InternetProtocol' is an invalid     authentication method in our instituion.' A SAML assertion is received, and the     authentication method -- 'InternetProtocol' ' is included in the     AuthnStatement of the assertion</li> </ul><H3>Evaluation</H3><p>The Connectathon Monitor may ask you to run these steps real-time. Verify that the PDQ Consumer    did not receive a query response because validation of the assertion failed. The PDQ Consumer has    no indication that the transaction failed because of the validation failure.</p> <p>If possible, verify that the X-Service-Provide (PDQ Supplier) send an Authentication Failure    ATNA audit message to the Audit Record Repository.</p>