Error when trying to run v0.4.0; KeyError: 'orgUnit'

[nuke101]

Greetings,

I was trying to test out v0.4.0 but keep getting this error after it scans:

C:\SCUBA> scubagoggles gws
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Scripts\scubagoggles.exe\__main__.py", line 7, in <module>
    sys.exit(dive())
             ~~~~^^
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\main.py", line 477, in dive
    args.dispatch(args)
    ~~~~~~~~~~~~~^^^^^^
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\main.py", line 53, in gws_dispatch
    Orchestrator(args).start_automation()
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\orchestrator.py", line 452, in start_automation
    self._run_gws_providers()
    ~~~~~~~~~~~~~~~~~~~~~~~^^
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\orchestrator.py", line 101, in _run_gws_providers
    provider_dict = provider.call_gws_providers(products, args.quiet)
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\provider.py", line 603, in call_gws_providers
    policies = policy_api.get_policies()
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\policy_api.py", line 409, in get_policies
    self._reduce(policies)
    ~~~~~~~~~~~~^^^^^^^^^^
  File "C:\Users\x\AppData\Local\Programs\Python\Python313\Lib\site-packages\scubagoggles\policy_api.py", line 611, in _reduce
    orgunit_id = policy['policyQuery']['orgUnit']
                 ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^
KeyError: 'orgUnit'

This is on Win 11, I tried using oauth and service account with the same result. Not sure how to troubleshoot or proceed, any assistance is appreciated.

-Mike

[kenyonbradley]

i'm getting the same thing

[rlxdev]

Hi, Thanks for reporting this issue. This is an existing issue (#573) that has a pending fix that is not in the current release (0.4.0). The issue arises if you have either no suborgunits or no groups within your organization. You can work around this issue if you are able to temporarily make a suborgunit and/or group before you run ScubaGoggles. Creating the empty suborgunit/group should allow you to avoid the error you’ve been getting. This work around will not be necessary for releases following 0.4.0.

[nuke101]

Thanks - sadly I do not think this is the same issue, as this GWS tenant has over 100 OUs (screenshot attached) and 100s of groups.

[nuke101]

Showing a screenshot of the Groups from admin panel. Let me know if you want anything from GAM or any additional info I can assist with.

[rlxdev]

Hi Mike,

I agree with you that this is a different issue. Would it be possible to work with me "offline" where I might be able to have you send me a bit of information (which wouldn't be any of your organization's data)?

Thanks,

Roy

[adhilto]

@nuke101, there is an environment variable that allows you to save the raw API output. Would you mind setting that variable, then review the output to identify which settings are problematic?

For example:

$env:SCUBAGOGGLES_DUMP_FILE = "debug.json"
scubagoggles gws # add any arguments needed for your specific setup

Then in Python:

import json

with open("debug.json") as f:
    data = json.load(f)

for policy in data['policies']:
    if 'orgUnit' not in policy['policyQuery']:
        print(policy['setting']['type'])

That should print the names of the settings that don't have an associated OU. Assuming the output doesn't contain any sensitive data (it shouldn't but double check), would you mind sending us the offending setting names? Either here or offline with @rlxdev.

[nuke101]

Thank you @adhilto for the excellent debugging instructions.

It showed:
settings/rule.dlp
settings/rule.dlp

Reviewing the JSON I was able to resolve it.

The issue (I think) was 2 DLP rules that had multiple OUs selected and or an OU and a group, see screenshots.

After I deleted the 2 offending rules I was able to run and generate a report successfully. Let me know if you require any additional information.

-removed images as they had some PII info in them, issue is now resolved in the v0.4.1 release, thanks for the quick attention

[rlxdev]

Hi Mike,

Thanks for sending this information. We've provided it to Google and are expecting a response from them.

Roy