<H3>Special Instructions</H3><p> <p>XDR Document Recipient (X-Service Providers) run one instance of this test.</p> <p>Before the test:</p> <ul>     <li>The X-Service Provider (Doc Recipient) must configure its system to not trust the assertion     provider (this is either the external X-Assertion Provider used by the Document Source, or the     Doc Source itself if it is generating its own SAML assertions). The Document Recipient will     receive the assertion via the Doc Source when the Doc Source Provice-and-Registers its document.</li>     <li>(this part of the test is deferred for XUA testing this year): The X-Service Provider (Doc     Recipient) must configure its system to reject assertions received where the authentication     method used is 'InternetProtocol'. , eg it contains: </li> </ul> <p>     <i><saml:AuthnStatement AuthnInstant="2007-10-08T14:49:14Z">     ' ' ' ' <saml:AuthnContext> '     ' ' ' ' ' ' '     <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol</saml:AuthnContextClassRef>     ' ' ' ' </saml:AuthnContext>     </saml:AuthnStatement> </i> </p> </p><H3>Description</H3><p>This tests the X-Service Provider's (Document Recipient's) ability to deny    access in two cases:</p><ul>     <li>Valid assertion received from an assertion provider not trusted by the Doc Recipient</li>     <li>(this part of the test is deferred for XUA testing this year) The 'Connectathon     Policy' states that 'InternetProtocol' is an invalid     authentication method in our instituion.' A SAML assertion is received, and the     authentication method -- 'InternetProtocol' ' is included in the     AuthnStatement of the assertion</li> </ul><H3>Evaluation</H3><p>The Connectathon Monitor may ask you to run these steps real-time. Verify that the Document    Source was not allowed to submit a document because validation of the assertion failed. The    Document Source has no indication that the transaction failed because of the validation failure.</p> <p>An Authentication Failure event was logged by the Doc Recipient for each assertion     validation failure.</p>