iiq_decrypt

A standalone Python utility that reproduces SailPoint IdentityIQ’s configuration decryption logic. The script mirrors the Java Transformer, SPKeyStore, and AsyncHandler classes so that operators can recover the plaintext values of alias:ACP:<Base64> secrets without launching an IIQ instance.

Features

• Default-key decryption for 1:ACP: secrets using the globally shipped AES key.
• Keystore-backed decryption for aliases 2+ by unmasking iiq.cfg, unlocking iiq.dat, and extracting the per-alias AES keys.
• Keystore inspection (--list-keys) to verify which aliases are present before attempting decryption.

Requirements

• Python 3.9+
• pip install -r requirements.txt to fetch pycryptodome and pyjks

Usage

Default key mode

Use when the encrypted value starts with alias 1 and no iiq.cfg or iiq.dat is available:

python3 iiq_decrypt.py '1:ACP:wT9...'

Keystore-backed mode

When an alias 2+ value is encountered, provide paths to the matching iiq.cfg (masked password) and iiq.dat (JCEKS) so the script can derive the correct AES key:

python3 iiq_decrypt.py '2:ACP:azY...' --cfg /path/to/iiq.cfg --keystore /path/to/iiq.dat

Listing available aliases

Inspect the keystore contents before decrypting:

python3 iiq_decrypt.py --cfg /path/to/iiq.cfg --keystore /path/to/iiq.dat --list-keys

Operational notes

• The tool performs strict format validation and will abort with descriptive errors if Base64 decoding, padding, or key lookup fails.
• Alias comparison is case-sensitive; the literal string ascii short-circuits to return the stored value unchanged, matching IIQ’s behavior.
• Possession of iiq.cfg and iiq.dat is effectively equivalent to possession of the plaintext secrets. Handle these files and any decrypted output with the same controls you would apply to credential material.