Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication.

What private keys do I need and how would I decrypt this information?

If it makes any difference, I'm auditing Microsoft ADFSv2 and a SiteMinder implementation

share|improve this question

1 Answer 1

up vote 0 down vote accepted

SAML tokens, if they are encrypted, are encrypted against the X509 certificate of the relaying party, either the public HTTPS certificate, or an agreed upon certificate between the STS and RP.

So you'd need to private key for that certificate to decrypt.

share|improve this answer
    
I will be attempting this in the near future, so if it's that simple, then I'm all set. Thanks! –  makerofthings7 Nov 23 '10 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.