I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication.

What private keys do I need and how would I decrypt this information?

If it makes any difference, I'm auditing Microsoft ADFSv2 and a SiteMinder implementation


SAML tokens, if they are encrypted, are encrypted against the X509 certificate of the relaying party, either the public HTTPS certificate, or an agreed upon certificate between the STS and RP.

So you'd need to private key for that certificate to decrypt.

| improve this answer | |
  • I will be attempting this in the near future, so if it's that simple, then I'm all set. Thanks! – goodguys_activate Nov 23 '10 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.