How can I decrypt ADFS-based SAML/p or WS-Trust claims?

Question

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication.

What private keys do I need and how would I decrypt this information?

If it makes any difference, I'm auditing Microsoft ADFSv2 and a SiteMinder implementation

Answer 1

SAML tokens, if they are encrypted, are encrypted against the X509 certificate of the relaying party, either the public HTTPS certificate, or an agreed upon certificate between the STS and RP.

So you'd need to private key for that certificate to decrypt.