Decrypt SAML2.0 token returned from Thinktecture IdentityServer

Question

i'm currently trying to use the Thinktecture IdentityServer as my STS (token issuer). When i get back an encrypted token from the IdentityServer, how does one decrypt the token so that I could extrapolate the claims information from it?

thank you for your help.

Answer 1

If configured correctly WIF should handle the decryption for you, and then you should be able to access the claims from the current claims principal.

The Relying Party WIF configuration part to define which certificate should be used for decryption:

 <federationConfiguration>
  <serviceCertificate>
    <certificateReference findValue="the-encryption-certificate-thumbprint" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" />
  </serviceCertificate>
</federationConfiguration>

The code to access the claims from the context:

HttpContext.Current.User.Identity.Name

Or

Claim myClaim = (HttpContext.Current.User as ClaimsPrincipal).FindFirst("http://identityserver.thinktecture.com/claims/profileclaims/myclaim");