<H3>Special Instructions</H3><p> <p>PIXv3 Managers (X-Service Providers) run one instance of this test.</p> <p>Before the test:</p> <ul>     <li>The X-Service Provider (PIX Manager) must configure its system to not trust the assertion     provider (this is either the external X-Assertion Provider used by the PIX Consumer, or the PIX     Consumer itself if it is generating its own SAML assertions). The PIX Manager will receive the     assertion via the PIX Consumer when the Consumer sends its query.</li>     <li>(this part of the test is deferred for XUA testing this year): The X-Service Provider (PIX     Manager) must configure its system to reject assertions received where the authentication method     used is &ldquo;InternetProtocol&rdquo;. , eg it contains: </li> </ul> <p>     <i>&lt;saml:AuthnStatement AuthnInstant="2007-10-08T14:49:14Z"&gt;     &nbsp; &nbsp; &nbsp; &nbsp; &lt;saml:AuthnContext&gt; &nbsp;     &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;     &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol&lt;/saml:AuthnContextClassRef&gt;     &nbsp; &nbsp; &nbsp; &nbsp; &lt;/saml:AuthnContext&gt;     &lt;/saml:AuthnStatement&gt; </i> </p> </p><H3>Description</H3><p>This tests the X-Service Provider&rsquo;s (PIX Manager&rsquo;s) ability to deny access    in two cases:</p><ul>     <li>Valid assertion received from an assertion provider not trusted by the PIX Manager</li>     <li>(this part of the test is deferred for XUA testing this year) The &ldquo;Connectathon     Policy&rdquo; states that &ldquo;InternetProtocol&rdquo; is an invalid     authentication method in our instituion.&nbsp; A SAML assertion is received, and the     authentication method -- &ldquo;InternetProtocol&rdquo; &ndash; is included in the     AuthnStatement of the assertion</li> </ul><H3>Evaluation</H3><p>The Connectathon Monitor may ask you to run these steps real-time. Verify that the PIX Consumer    did not receive a query response because validation of the assertion failed. The PIX Consumer has    no indication that the transaction failed because of the validation failure.</p><p>If possible, verify that the X-Service-Provide (PIX Manager) send an Authentication Failure    ATNA audit message to the Audit Record Repository.</p> 