    public void ecpFlowCreatesTransientSessions() {
        // Disable ECP_FLOW_ENABLED switch
        getCleanup().addCleanup(ClientAttributeUpdater.forClient(adminClient, REALM_NAME, SAML_CLIENT_ID_ECP_SP)
                .setAttribute(SamlConfigAttributes.SAML_SERVER_SIGNATURE, "false")
                .setAttribute(SamlConfigAttributes.SAML_CLIENT_SIGNATURE_ATTRIBUTE, "false")
                .update());

        // Successfully login using ECP flow
        SAML2Object samlObject = new SamlClientBuilder()
                .authnRequest(getAuthServerSamlEndpoint(REALM_NAME), SAML_CLIENT_ID_ECP_SP, SAML_ASSERTION_CONSUMER_URL_ECP_SP, SOAP)
                .basicAuthentication(bburkeUser)
                .build()
                .executeAndTransform(SOAP::extractResponse).getSamlObject();

        assertThat(samlObject, isSamlResponse(JBossSAMLURIConstants.STATUS_SUCCESS));
        ResponseType loginResp1 = (ResponseType) samlObject;
        AuthnStatementType sessionId = (AuthnStatementType) loginResp1.getAssertions().get(0).getAssertion().getStatements().iterator().next();

        String userSessionId = sessionId.getSessionIndex().split("::")[0];

        // Test that the user session with the given ID does not exist
        testingClient.server().run(session -> {
            RealmModel realmByName = session.realms().getRealmByName(REALM_NAME);
            UserSessionModel userSession = session.sessions().getUserSession(realmByName, userSessionId);

            assertThat(userSession, nullValue());
        });


    }
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.