Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication.

What private keys do I need and how would I decrypt this information?

If it makes any difference, I'm auditing Microsoft ADFSv2 and a SiteMinder implementation

share|improve this question
up vote 1 down vote accepted

SAML tokens, if they are encrypted, are encrypted against the X509 certificate of the relaying party, either the public HTTPS certificate, or an agreed upon certificate between the STS and RP.

So you'd need to private key for that certificate to decrypt.

share|improve this answer
I will be attempting this in the near future, so if it's that simple, then I'm all set. Thanks! – LamonteCristo Nov 23 '10 at 17:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.