{"record":{"id":"eae400699239f3cb","repo":"owasp-amass/amass","slug":"failed-to-obtain-the-subject-organizations","errorCode":null,"errorMessage":"failed to obtain the subject organizations","messagePattern":"failed to obtain the subject organizations","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"engine/plugins/horizontals/tls_cert.go","lineNumber":53,"sourceCode":"\tif e.Session.Config().Rigid {\n\t\treturn nil\n\t}\n\n\tif orgs, err := h.lookup(e.Session, e.Entity); err == nil && len(orgs) > 0 {\n\t\th.process(e, c, orgs)\n\t}\n\treturn nil\n}\n\nfunc (h *horTlsCert) lookup(sess et.Session, tlsent *dbt.Entity) ([]*dbt.Entity, error) {\n\tcr, err := h.plugin.getContactRecord(sess, tlsent, \"subject_contact\")\n\tif err != nil {\n\t\treturn nil, errors.New(\"failed to obtain the subject contact record\")\n\t}\n\n\torgs, err := h.plugin.getContactRecordOrganizations(sess, cr)\n\tif err != nil {\n\t\treturn nil, errors.New(\"failed to obtain the subject organizations\")\n\t}\n\n\treturn orgs, nil\n}\n\nfunc (h *horTlsCert) process(e *et.Event, c *oamcert.TLSCertificate, orgs []*dbt.Entity) {\n\t// check if the TLS certificate subject common name is in scope\n\tif _, conf := e.Session.Scope().IsAssetInScope(&oamdns.FQDN{Name: c.SubjectCommonName}, 0); conf > 0 {\n\t\treturn\n\t}\n\n\tvar found bool\n\tfor _, o := range orgs {\n\t\tif h.plugin.isEntityInScope(e.Session, o) {\n\t\t\tfound = true\n\t\t\tbreak\n\t\t}\n\t}","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/owasp-amass/amass/blob/79299dce87b0085db0f2f4ef3e9c52cccb49f514/engine/plugins/horizontals/tls_cert.go#L35-L71","documentation":"After obtaining the subject contact record, horTlsCert.lookup calls getContactRecordOrganizations(sess, cr) to resolve the organizations linked to that contact; on any error this generic message replaces the cause. It means the organizations for the certificate's subject contact could not be retrieved from the graph.","triggerScenarios":"The subject contact record exists but has no organization relation, or getContactRecordOrganizations' DB query fails; the original error is masked by errors.New here.","commonSituations":"Contact records created without linked Organization entities by certain data sources; graph DB connectivity issues during long scans; TTL cleanup removing organization relations mid-scan.","solutions":["Wrap the original error: fmt.Errorf(\"failed to obtain the subject organizations: %w\", err)","Check that data sources creating Organization entities and their relations are enabled","Treat missing organizations as non-fatal: return (nil, nil) so the certificate is skipped without failing the event"],"exampleFix":"// before\norgs, err := h.plugin.getContactRecordOrganizations(sess, cr)\nif err != nil {\n\treturn nil, errors.New(\"failed to obtain the subject organizations\")\n}\n\n// after\norgs, err := h.plugin.getContactRecordOrganizations(sess, cr)\nif err != nil {\n\treturn nil, fmt.Errorf(\"failed to obtain the subject organizations: %w\", err)\n}","handlingStrategy":"fallback","validationCode":"orgs, err := h.plugin.getContactRecordOrganizations(sess, cr)\nif err != nil || len(orgs) == 0 {\n\treturn nil, nil // nothing to expand; skip\n}","typeGuard":null,"tryCatchPattern":"orgs, err := h.lookup(sess, tlsent)\nif err != nil {\n\tlog.WithError(err).Debug(\"subject organizations unavailable; skipping\")\n\treturn nil\n}","preventionTips":["Verify Organization entities and relations are produced by your enabled data sources","Preserve the wrapped error with fmt.Errorf + %w for debugging","Treat missing organization links as informational, not fatal"],"tags":["go","graph-database","missing-relation"],"backgroundTag":"entity-not-found","analyzedSha":"79299dce87b0085db0f2f4ef3e9c52cccb49f514","analyzedAt":"2026-09-06T08:22:48.198Z","contentChangedAt":"2026-09-06T08:22:48.198Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}