{"record":{"id":"05c5b305debf24be","repo":"hyperledger/fabric","slug":"failed-getting-local-msp-principal-during-channell-05c5b3","errorCode":null,"errorMessage":"failed getting local MSP principal during channelless check policy with policy [%s]: [%s]","messagePattern":"failed getting local MSP principal during channelless check policy with policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/policy/policy.go","lineNumber":211,"sourceCode":"\t\treturn errors.New(\"invalid policy name during channelless check policy. Name must be different from nil.\")\n\t}\n\n\tif len(signedData) == 0 {\n\t\treturn fmt.Errorf(\"no signed data during channelless check policy with policy [%s]\", policyName)\n\t}\n\n\tfor _, data := range signedData {\n\t\t// Deserialize identity with the local MSP\n\t\tid, err := p.localMSP.DeserializeIdentity(data.Identity)\n\t\tif err != nil {\n\t\t\tlogger.Warnw(\"Failed deserializing signed data identity during channelless check policy\", \"error\", err, \"policyName\", policyName, \"identity\", protoutil.LogMessageForSerializedIdentity(data.Identity))\n\t\t\treturn fmt.Errorf(\"failed deserializing signed data identity during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t\t}\n\n\t\t// Load MSPPrincipal for policy\n\t\tprincipal, err := p.principalGetter.Get(policyName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed getting local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t\t}\n\n\t\t// Verify that proposal's creator satisfies the principal\n\t\terr = id.SatisfiesPrincipal(principal)\n\t\tif err != nil {\n\t\t\tlogger.Warnw(\"failed verifying that the signed data identity satisfies local MSP principal during channelless check policy\", \"error\", err, \"policyName\", policyName, \"requiredPrincipal\", principal, \"identity\", protoutil.LogMessageForSerializedIdentity(data.Identity))\n\t\t\treturn fmt.Errorf(\"failed verifying that the signed data identity satisfies local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t\t}\n\n\t\t// Verify the signature\n\t\tif err = id.Verify(data.Data, data.Signature); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/policy/policy.go#L193-L229","documentation":"This error is returned when MSPPrincipalGetter.Get(policyName) fails to build an MSPPrincipal from the given name on the local MSP. The getter resolves the policy name to an MSP role principal (e.g. an MSP ID with Admins/Member/Peer role); failure means the name is not a recognizable principal string or the named MSP is not configured locally. It is thrown before any signature or role check happens, once per signed data entry in the loop.","triggerScenarios":"Calling CheckPolicyNoChannelBySignedData with a policyName that is not a valid MSP identifier/principal representation (e.g. a channel policy name like 'Writers' that has no meaning in the channelless path, a typo'd MSP ID, or an MSP not present in the peer's local MSP config).","commonSituations":"Reusing a channel policy name (e.g. 'Application/Writers') with the channelless API which expects an MSP principal name; passing an OU or role string in the wrong format; referencing an org MSP that exists on the channel but is missing from the peer's local MSP directory; typo in config producing an unknown MSP ID.","solutions":["Pass an MSP principal name the local MSP can resolve — typically the MSP ID, not a channel policy path like 'Writers'.","Check the peer's local MSP configuration includes an MSP matching the given name.","Review MSPPrincipalGetter.Get's accepted formats (MSP ID, or ROLE/OU-based principal strings) and match your input.","If you meant to check a channel policy (e.g. 'Writers'), call CheckPolicyBySignedData with the channelID instead of the channelless variant."],"exampleFix":"// before: channel policy name used in channelless check\nerr := policyChecker.CheckPolicyNoChannelBySignedData(\"Writers\", sd) // not an MSP principal\n// after: use the MSP ID / principal resolvable by the local MSP\nerr := policyChecker.CheckPolicyNoChannelBySignedData(\"Org1MSP\", sd)","handlingStrategy":"validation","validationCode":"// Resolve the principal yourself first to fail with a clearer error\nprincipal, err := principalGetter.Get(policyName)\nif err != nil {\n    return fmt.Errorf(\"policy name %q is not a valid local MSP principal: %w\", policyName, err)\n}\nerr = policyChecker.CheckPolicyNoChannelBySignedData(policyName, signedData)","typeGuard":"func resolvablePrincipal(g policy.MSPPrincipalGetter, name string) bool {\n    _, err := g.Get(name)\n    return err == nil\n}","tryCatchPattern":"if err := policyChecker.CheckPolicyNoChannelBySignedData(policyName, signedData); err != nil {\n    if strings.Contains(err.Error(), \"failed getting local MSP principal\") {\n        return fmt.Errorf(\"%q is not a resolvable local MSP principal; use an MSP ID known to this peer\", policyName)\n    }\n    return err\n}","preventionTips":["Pass MSP IDs (e.g. 'Org1MSP') to channelless checks, not channel policy names like 'Writers'.","Verify the MSP named in policyName exists in the peer's local MSP configuration.","Centralize valid principal names as constants instead of free-form config strings.","Use CheckPolicyBySignedData with a channelID when the intent is a channel policy evaluation."],"tags":["hyperledger-fabric","msp","msp-principal","input-validation","configuration"],"backgroundTag":"invalid-policy-principal","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}