import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldReturnErrorResponseWhenAnAttributeQueryContainsAnExpiredAssertion() {
    AttributeQuery attributeQuery = AttributeQueryBuilder.anAttributeQuery()
            .withId(REQUEST_ID)
            .withIssuer(anIssuer().withIssuerId(HUB_ENTITY_ID).build())
            .withSubject(aSubjectWithAssertions(asList(
                    anAuthnStatementAssertion(),
                    aMatchingDatasetAssertion(Collections.emptyList(), true, REQUEST_ID)), REQUEST_ID, HUB_ENTITY_ID))
            .build();

    Response response = makeAttributeQueryRequest(MATCHING_SERVICE_URI, attributeQuery, signatureAlgorithmForHub, digestAlgorithmForHub, HUB_ENTITY_ID);

    assertThat(response.getStatus().getStatusCode().getValue()).isEqualTo(REQUESTER);
    assertThat(response.getStatus().getStatusMessage().getMessage()).contains("Bearer subject confirmation datas NotOnOrAfter timestamp");
    assertThat(response).is(signedBy(TEST_RP_MS_PUBLIC_SIGNING_CERT, TEST_RP_MS_PRIVATE_SIGNING_KEY));
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
/**
 * Create a new SAML response object.
 * @param id the id
 * @param issueInstant the issue instant
 * @param recipient the recipient
 * @param service the service
 * @return the response
 */
public Response newResponse(final String id, final DateTime issueInstant,
                            final String recipient, final WebApplicationService service) {

    final Response samlResponse = newSamlObject(Response.class);
    samlResponse.setID(id);
    samlResponse.setIssueInstant(issueInstant);
    samlResponse.setVersion(SAMLVersion.VERSION_20);
    if (service instanceof SamlService) {
        final SamlService samlService = (SamlService) service;

        final String requestId = samlService.getRequestID();
        if (StringUtils.isNotBlank(requestId)) {
            samlResponse.setInResponseTo(requestId);
        }
    }
    return samlResponse;
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
/**
 * Create a new SAML response object.
 *
 * @param id           the id
 * @param issueInstant the issue instant
 * @param recipient    the recipient
 * @param service      the service
 * @return the response
 */
public Response newResponse(final String id, final ZonedDateTime issueInstant,
                            final String recipient, final WebApplicationService service) {

    final Response samlResponse = newSamlObject(Response.class);
    samlResponse.setID(id);
    samlResponse.setIssueInstant(DateTimeUtils.dateTimeOf(issueInstant));
    samlResponse.setVersion(SAMLVersion.VERSION_20);
    if (StringUtils.isNotBlank(recipient)) {
        LOGGER.debug("Setting provided RequestId {} as InResponseTo", recipient);
        samlResponse.setInResponseTo(recipient);
    } else {
        LOGGER.debug("No recipient is provided. Skipping InResponseTo");
    }
    return samlResponse;
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Override
protected Response encode(final SamlRegisteredService service,
                          final Response samlResponse,
                          final HttpServletResponse httpResponse,
                          final SamlRegisteredServiceServiceProviderMetadataFacade adaptor,
                          final String relayState, 
                          final String binding) throws SamlException {
    try {
        if (httpResponse != null) {
            final HTTPPostEncoder encoder = new HTTPPostEncoder();
            encoder.setHttpServletResponse(httpResponse);
            encoder.setVelocityEngine(this.velocityEngineFactory.createVelocityEngine());
            final MessageContext outboundMessageContext = new MessageContext<>();
            outboundMessageContext.setMessage(samlResponse);
            SAMLBindingSupport.setRelayState(outboundMessageContext, relayState);
            SamlIdPUtils.preparePeerEntitySamlEndpointContext(outboundMessageContext, adaptor, binding);
            encoder.setMessageContext(outboundMessageContext);
            encoder.initialize();
            encoder.encode();
        }
        return samlResponse;
    } catch (final Exception e) {
        throw Throwables.propagate(e);
    }
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Inject
public SamlMessageSenderHandler(
        StringToOpenSamlObjectTransformer<Response> responseTransformer,
        StringToOpenSamlObjectTransformer<AuthnRequest> authnRequestTransformer,
        SamlMessageSignatureValidator samlMessageSignatureValidator,
        ExternalCommunicationEventLogger externalCommunicationEventLogger,
        ProtectiveMonitoringLogger protectiveMonitoringLogger,
        SessionProxy sessionProxy) {

    this.responseTransformer = responseTransformer;
    this.authnRequestTransformer = authnRequestTransformer;
    this.samlMessageSignatureValidator = samlMessageSignatureValidator;
    this.externalCommunicationEventLogger = externalCommunicationEventLogger;
    this.protectiveMonitoringLogger = protectiveMonitoringLogger;
    this.sessionProxy = sessionProxy;
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
public String formatAuthnResponse(Response samlResponse, Direction direction, Boolean validSignature) {
    Issuer issuer = samlResponse.getIssuer();
    String issuerString = issuer != null ? issuer.getValue() : "";

    Status status = samlResponse.getStatus();
    StatusCode subStatusCode = status.getStatusCode().getStatusCode();
    String subStatus = subStatusCode != null ? subStatusCode.getValue() : "";

    return String.format(AUTHN_RESPONSE,
            samlResponse.getID(),
            samlResponse.getInResponseTo(),
            direction,
            samlResponse.getDestination(),
            issuerString,
            validSignature,
            status.getStatusCode().getValue(),
            subStatus,
            getStatusDetailValues(status));
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void generateAuthnResponseFromHub_shouldAddExternalCommunicationEvent() throws Exception {
    SessionId sessionId = SessionId.createNewSessionId();
    String expectedSamlMessageId = UUID.randomUUID().toString();

    Response openSamlResponse = setUpAuthnResponseFromHub(sessionId, expectedSamlMessageId);

    SamlMessage authnResponse = samlMessageSenderHandler.generateAuthnResponseFromHub(sessionId, principalIpAddressAsSeenByHub);
    assertThat(authnResponse.getSamlMessage()).isEqualTo(samlRequest);
    assertThat(authnResponse.getPostEndpoint()).isEqualTo(postEndPoint.toString());
    assertThat(authnResponse.getRegistration().isPresent()).isFalse();
    assertThat(authnResponse.getRelayState().isPresent()).isTrue();
    assertThat(authnResponse.getRelayState().get()).isEqualTo(relayState.get());
    assertThat(authnResponse.getSamlMessageType()).isEqualTo(SamlMessageType.SAML_RESPONSE);

    verify(externalCommunicationEventLogger).logResponseFromHub(expectedSamlMessageId, sessionId, postEndPoint, principalIpAddressAsSeenByHub);
    verify(protectiveMonitoringLogger).logAuthnResponse(openSamlResponse, Direction.OUTBOUND, true);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldFormatAuthnCancelResponse() throws IOException, URISyntaxException {
    String cancelXml = readXmlFile("status-cancel.xml");
    Response cancelResponse = stringtoOpenSamlObjectTransformer.apply(cancelXml);

    String logString = new ProtectiveMonitoringLogFormatter().formatAuthnResponse(cancelResponse, Direction.INBOUND, true);

    String expectedLogMessage = "Protective Monitoring – Authn Response Event – " +
            "{responseId: _ccb1eabc4827928c9cbb3db34fdbe9df186dfcb8, " +
            "inResponseTo: _7081cbd6-a811-440a-949a-12a9521ed7cc, " +
            "direction: INBOUND, " +
            "destination: https://www.signin.service.gov.uk:443/SAML2/SSO/Response/POST, " +
            "issuerId: http://stub-idp, " +
            "validSignature: true, " +
            "status: urn:oasis:names:tc:SAML:2.0:status:Responder, " +
            "subStatus: urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext, " +
            "statusDetails: [authn-cancel]}";
    assertThat(logString).isEqualTo(expectedLogMessage);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldFormatAuthnSuccessResponse() throws IOException, URISyntaxException, MarshallingException, SignatureException {
    Response response = aResponse().build();

    String logString = new ProtectiveMonitoringLogFormatter().formatAuthnResponse(response, Direction.INBOUND, true);

    String expectedLogMessage = "Protective Monitoring – Authn Response Event – " +
            "{responseId: default-response-id, " +
            "inResponseTo: default-request-id, " +
            "direction: INBOUND, " +
            "destination: http://destination.com, " +
            "issuerId: a-test-entity, " +
            "validSignature: true, " +
            "status: urn:oasis:names:tc:SAML:2.0:status:Success, " +
            "subStatus: , " +
            "statusDetails: []}";
    assertThat(logString).isEqualTo(expectedLogMessage);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Provides
private CountryAuthnResponseTranslatorService getCountryAuthnResponseTranslatorService(StringToOpenSamlObjectTransformer<Response> stringToOpenSamlResponseTransformer,
                                                                                       ResponseFromCountryValidator responseFromCountryValidator,
                                                                                       IdpIdaStatusUnmarshaller idpIdaStatusUnmarshaller,
                                                                                       @Named("ResponseAssertionsFromCountryValidator") Optional<ResponseAssertionsFromCountryValidator> responseAssertionFromCountryValidator,
                                                                                       Optional<ValidateSamlResponseIssuedByIdpDestination> validateSamlResponseIssuedByIdpDestination,
                                                                                       @Named("AES256DecrypterWithGCM") AssertionDecrypter assertionDecrypter,
                                                                                       AssertionBlobEncrypter assertionBlobEncrypter,
                                                                                       @Named("CountrySamlResponseSignatureValidator") Optional<SamlResponseSignatureValidator> responseSignatureValidator,
                                                                                       @Named("CountrySamlAssertionsSignatureValidator") Optional<SamlAssertionsSignatureValidator> assertionSignatureValidator,
                                                                                       PassthroughAssertionUnmarshaller passthroughAssertionUnmarshaller) {
    if (!responseAssertionFromCountryValidator.isPresent() || !validateSamlResponseIssuedByIdpDestination.isPresent() || !responseSignatureValidator.isPresent() || !assertionSignatureValidator.isPresent()) {
        throw new InvalidConfigurationException("Eidas not configured correctly");
    }
    return new CountryAuthnResponseTranslatorService(stringToOpenSamlResponseTransformer,
            responseFromCountryValidator,
            idpIdaStatusUnmarshaller,
            responseAssertionFromCountryValidator.get(),
            validateSamlResponseIssuedByIdpDestination.get(),
            assertionDecrypter,
            assertionBlobEncrypter,
            responseSignatureValidator.get(),
            assertionSignatureValidator.get(),
            passthroughAssertionUnmarshaller);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
public InboundResponseFromMatchingServiceDto translate(SamlResponseDto samlResponseDto) {
    final Response response = responseUnmarshaller.apply(samlResponseDto.getSamlResponse());
    MdcHelper.addContextToMdc(response);
    final InboundResponseFromMatchingService responseFromMatchingService = responseToInboundResponseFromMatchingServiceTransformer.transform(response);

    Optional<String> assertionBlob = Optional.absent();
    Optional<LevelOfAssurance> levelOfAssurance = Optional.absent();
    // FIXME?: transformer can return null
    if(responseFromMatchingService.getMatchingServiceAssertion()!=null && responseFromMatchingService.getMatchingServiceAssertion().isPresent()) {
        assertionBlob = Optional.fromNullable(responseFromMatchingService.getMatchingServiceAssertion().get().getUnderlyingAssertionBlob());
        final Optional<AuthnContext> authnContext = responseFromMatchingService.getMatchingServiceAssertion().get().getAuthnContext();
        if(authnContext.isPresent()) {
            levelOfAssurance = Optional.of(LevelOfAssurance.valueOf(authnContext.get().name()));
        }
    }

    final InboundResponseFromMatchingServiceDto inboundResponseFromMatchingServiceDto = new InboundResponseFromMatchingServiceDto(
            responseFromMatchingService.getStatus(),
            responseFromMatchingService.getInResponseTo(),
            responseFromMatchingService.getIssuer(),
            assertionBlob,
            levelOfAssurance);

    return inboundResponseFromMatchingServiceDto;
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
private void setUpForTranslate(Optional<AuthnContext> authnContext, Optional<FraudDetectedDetails> fraudDetectedDetails, String underlyingAssertionBlob, String inResponseTo, String issuer, String samlResponse, MatchingServiceIdaStatus status) {
    final PassthroughAssertion assertion = new PassthroughAssertion(new PersistentId("persistentId"),
            authnContext,
            underlyingAssertionBlob,
            fraudDetectedDetails,
            Optional.of("principalIpAddressAsSeenByIdp"));
    final InboundResponseFromMatchingService inboundResponseFromMatchingService = InboundResponseFromMatchingServiceBuilder
            .anInboundResponseFromMatchingService()
            .withInResponseTo(inResponseTo)
            .withIssuerId(issuer)
            .withMatchingServiceAssertion(assertion)
            .withStatus(status)
            .build();
    Response response = mock(Response.class);
    Issuer responseIssuer = mock(Issuer.class);
    when(response.getIssuer()).thenReturn(responseIssuer);
    when(responseUnmarshaller.apply(samlResponse)).thenReturn(response);
    when(responseToInboundResponseFromMatchingServiceTransformer.transform(response)).thenReturn(inboundResponseFromMatchingService);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Inject
public MatchingServiceHealthChecker(
        final Function<Element, AttributeQuery> elementToAttributeQueryTransformer,
        final Function<Element, Response> elementToResponseTransformer,
        @Named("matchingRequestSignatureValidator") SamlMessageSignatureValidator matchingRequestSignatureValidator,
        final SupportedMsaVersionsRepository supportedMsaVersionsRepository,
        final SamlEngineProxy samlEngineProxy,
        final MatchingServiceHealthCheckClient matchingServiceHealthCheckClient,
        HealthCheckEventLogger eventLogger) {
    this.elementToAttributeQueryTransformer = elementToAttributeQueryTransformer;
    this.elementToResponseTransformer = elementToResponseTransformer;
    this.matchingRequestSignatureValidator = matchingRequestSignatureValidator;
    this.supportedMsaVersionsRepository = supportedMsaVersionsRepository;
    this.matchingServiceHealthCheckClient = matchingServiceHealthCheckClient;
    this.samlEngineProxy = samlEngineProxy;
    this.eventLogger = eventLogger;
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Before
public void setUp() throws Exception {
    attributeQueryContainerDto = anAttributeQueryContainerDto(anAttributeQuery().build())
            .withMatchingServiceUri(matchingServiceUri)
            .build();

    executeAttributeQueryRequest = new ExecuteAttributeQueryRequest(
            elementToAttributeQueryTransformer,
            elementToResponseTransformer,
            matchingRequestSignatureValidator,
            matchingResponseSignatureValidator,
            attributeQueryRequestClient,
            protectiveMonitoringLogger);

   DateTimeFreezer.freezeTime();

    when(matchingRequestSignatureValidator.validate(any(AttributeQuery.class), eq(AttributeAuthorityDescriptor.DEFAULT_ELEMENT_NAME))).thenReturn(SamlValidationResponse.aValidResponse());
    when(matchingRequestSignatureValidator.validate(any(Response.class), eq(AttributeAuthorityDescriptor.DEFAULT_ELEMENT_NAME))).thenReturn(SamlValidationResponse.anInvalidResponse(SamlTransformationErrorFactory.invalidMessageSignature()));
    when(matchingResponseSignatureValidator.validate(any(AttributeQuery.class), eq(AttributeAuthorityDescriptor.DEFAULT_ELEMENT_NAME))).thenReturn(SamlValidationResponse.anInvalidResponse(SamlTransformationErrorFactory.invalidMessageSignature()));
    when(matchingResponseSignatureValidator.validate(any(Response.class), eq(AttributeAuthorityDescriptor.DEFAULT_ELEMENT_NAME))).thenReturn(SamlValidationResponse.aValidResponse());
    when(elementToAttributeQueryTransformer.apply(any(Element.class))).thenReturn(attributeQuery);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldReturnFailureResponseWhenAttributesRequestedDoNotExist(){
    List<Attribute> requiredAttributes = asList(FIRST_NAME, MIDDLE_NAME).stream()
            .map(userAccountCreationAttribute -> new AttributeQueryAttributeFactory(new OpenSamlXmlObjectFactory()).createAttribute(userAccountCreationAttribute))
            .collect(toList());

    AttributeQuery attributeQuery = anAttributeQuery()
            .withId(REQUEST_ID)
            .withAttributes(requiredAttributes)
            .withIssuer(anIssuer().withIssuerId(applicationRule.getConfiguration().getHubEntityId()).build())
            .withSubject(aSubjectWithAssertions(asList(
                    anAuthnStatementAssertion(),
                    assertionWithOnlyFirstName()), REQUEST_ID, HUB_ENTITY_ID))
            .build();

    Response response = makeAttributeQueryRequest(UNKNOWN_USER_URI, attributeQuery, signatureAlgorithmForHub, digestAlgorithmForHub, HUB_ENTITY_ID);
    List<Assertion> decryptedAssertions = assertionDecrypter.decryptAssertions(response::getEncryptedAssertions);

    assertThat(response.getStatus().getStatusCode().getValue()).isEqualTo(RESPONDER);
    Assertions.assertThat(decryptedAssertions).hasSize(0);
    Assertions.assertThat(response.getInResponseTo()).isEqualTo(REQUEST_ID);
    Assertions.assertThat(response.getIssuer().getValue()).isEqualTo(TEST_RP_MS);
    assertThat(response).is(signedBy(TEST_RP_MS_PUBLIC_SIGNING_CERT, TEST_RP_MS_PRIVATE_SIGNING_KEY));
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldHandleSuccessMatchSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status successStatus = aStatus().
        withStatusCode(aStatusCode().withValue(StatusCode.SUCCESS).build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(successStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result).isEqualTo(new TranslatedResponseBody(
        SUCCESS_MATCH,
        "some-pid",
        LevelOfAssurance.LEVEL_2,
        null
    ));
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void createResponse_shouldReturnValidSamlResponse() throws Exception {
    PublicKeyFactory publicKeyFactory = new PublicKeyFactory(new X509CertificateFactory());
    PrivateKey privateKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.PRIVATE_SIGNING_KEYS.get(TestEntityIds.STUB_IDP_ONE)));
    PublicKey publicKey = publicKeyFactory.createPublicKey(TestCertificateStrings.getPrimaryPublicEncryptionCert(TestEntityIds.HUB_ENTITY_ID));

    PrivateKey privateEncryptionKey = new PrivateKeyFactory().createPrivateKey(Base64.decodeBase64(TestCertificateStrings.HUB_TEST_PRIVATE_ENCRYPTION_KEY));
    PublicKey publicEncryptionKey = publicKeyFactory.createPublicKey(TestCertificateStrings.HUB_TEST_PUBLIC_ENCRYPTION_CERT);

    KeyPair encryptionKeyPair = new KeyPair(publicEncryptionKey, privateEncryptionKey);

    KeyPair signingKeyPair = new KeyPair(publicKey, privateKey);
    IdaKeyStore keyStore = new IdaKeyStore(signingKeyPair, Arrays.asList(encryptionKeyPair));
    ExceptionResponseFactory exceptionResponseFactory = new ExceptionResponseFactory(new OpenSamlXmlObjectFactory(), new IdaKeyStoreCredentialRetriever(keyStore), new IdGenerator());

    String errorMessage = "some message";
    String requestId = UUID.randomUUID().toString();
    Element element = exceptionResponseFactory.createResponse(requestId, TEST_ENTITY_ID, errorMessage);

    Response attributeQueryResponse = (Response) XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(element).unmarshall(element);

    assertThat(attributeQueryResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.REQUESTER);
    assertThat(attributeQueryResponse.getStatus().getStatusMessage().getMessage()).isEqualTo(errorMessage);
    assertThat(attributeQueryResponse.getInResponseTo()).isEqualTo(requestId);
    assertThat(attributeQueryResponse.getIssuer().getValue()).isEqualTo(TEST_ENTITY_ID);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldHandleNoMatchSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(SamlStatusCode.NO_MATCH).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(NO_MATCH);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldHandleRequestErrorSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(StatusCode.REQUESTER).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(REQUEST_ERROR);
}
 

import org.opensaml.saml.saml2.core.Response; //导入依赖的package包/类
@Test
public void shouldHandleNoAuthnContextSaml() throws Exception {
    EntityDescriptor entityDescriptor = createEntityDescriptorWithSigningCertificate(TEST_RP_PUBLIC_SIGNING_CERT);
    when(hubMetadataResolver.resolve(any())).thenReturn(ImmutableList.of(entityDescriptor));

    Status noMatchStatus = aStatus().
        withStatusCode(
            aStatusCode()
                .withValue(StatusCode.RESPONDER)
                .withSubStatusCode(aStatusCode().withValue(StatusCode.NO_AUTHN_CONTEXT).build())
                .build())
        .build();
    Response response = signResponse(createNoAttributeResponseBuilder(noMatchStatus), testRpSigningCredential);

    TranslatedResponseBody result = responseService.convertTranslatedResponseBody(
        responseToBase64StringTransformer.apply(response),
        response.getInResponseTo(),
        LevelOfAssurance.LEVEL_2,
        VERIFY_SERVICE_PROVIDER_ENTITY_ID
    );

    assertThat(result.getScenario()).isEqualTo(CANCELLATION);
}