### Question:
WebSSOProfileConsumerImpl extends AbstractProfileBase implements WebSSOProfileConsumer { protected void verifyAuthenticationStatement(AuthnStatement auth, RequestedAuthnContext requestedAuthnContext, SAMLMessageContext context) throws AuthenticationException { if (!isDateTimeSkewValid(getMaxAuthenticationAge(), auth.getAuthnInstant())) { log.debug("Authentication statement is too old to be used", auth.getAuthnInstant()); throw new CredentialsExpiredException("Users authentication data is too old"); } if (auth.getSessionNotOnOrAfter() != null && !(new DateTime()).isBefore(auth.getSessionNotOnOrAfter())) { log.debug("Authentication session is not valid anymore", auth.getSessionNotOnOrAfter()); throw new CredentialsExpiredException("Users authentication is expired"); } verifyAuthnContext(requestedAuthnContext, auth.getAuthnContext(), context); } WebSSOProfileConsumerImpl();  WebSSOProfileConsumerImpl(SAMLProcessor processor, MetadataManager manager); SAMLCredential processAuthenticationResponse(SAMLMessageContext context, SAMLMessageStorage protocolCache); int getMaxAuthenticationAge(); void setMaxAuthenticationAge(int maxAuthenticationAge);  }### Answer:
@Test public void testDefaultAuthNStatementPasses() throws Exception { AuthnStatement statement = helper.getValidAuthStatement(); profile.verifyAuthenticationStatement(statement, null, messageContext); }
@Test(expected = CredentialsExpiredException.class) public void testAuthNStatementWithExpiredSessionTime() throws Exception { AuthnStatement statement = helper.getValidAuthStatement(); DateTime past = new DateTime(); past.minusHours(3); statement.setSessionNotOnOrAfter(past); profile.verifyAuthenticationStatement(statement, null, messageContext); }