{"record":{"id":"0759d0a888d2efce","repo":"rustfs/rustfs","slug":"cluster-mismatch","errorCode":"CLUSTER_MISMATCH","errorMessage":"the response names a different cluster than the challenge it answers","messagePattern":"the response names a different cluster than the challenge it answers","errorType":"exception","errorClass":"EnrollmentError","httpStatus":null,"severity":"error","filePath":"rustfs/src/connect/offline/enrollment.rs","lineNumber":202,"sourceCode":"    #[error(\"the trust chain is not issued by a root pinned in this build\")]\n    EnrollmentRootUnknown,\n\n    #[error(\"a trust link is invalid, misordered, or outside its validity at the challenge issuedAt\")]\n    TrustChainInvalid,\n\n    #[error(\"connectKeyId is not the subject of the last trust link\")]\n    ConnectKeyUnchained,\n\n    #[error(\"no issued challenge matches this challengeId\")]\n    ChallengeUnknown,\n\n    #[error(\"the challenge is not yet valid at the evaluation time\")]\n    ChallengeNotYetValid,\n\n    #[error(\"the challenge has expired at the evaluation time\")]\n    ChallengeExpired,\n\n    #[error(\"the response nonce or challengeProof is not the one issued for this challenge\")]\n    ChallengeProofInvalid,\n\n    #[error(\"the response does not prove possession of the device key it presents\")]\n    DeviceProofInvalid,\n\n    #[error(\"the challenge was already consumed\")]\n    EnrollmentReplayed,\n\n    #[error(\"the response names a different organization than the challenge it answers\")]\n    OrganizationMismatch,\n\n    #[error(\"the response names a different cluster than the challenge it answers\")]\n    ClusterMismatch,\n\n    /// The artifact could not be read as a signed enrolment document at all: the\n    /// envelope, the base64 of the signed octets, or a field the frozen order\n    /// reads before the signature verifies did not parse.\n    #[error(\"the offline enrollment document is not well formed\")]","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/rustfs/rustfs/blob/5dca076efed96e7b842de07c4c2111035ae7c7a2/rustfs/src/connect/offline/enrollment.rs#L184-L220","documentation":"The cluster identifier in the enrollment response does not match the cluster bound into the challenge it answers. Like the organization check, this ensures the response targets the exact cluster the challenge was minted for; a mismatch indicates cross-cluster confusion or tampering, and enrollment is rejected.","triggerScenarios":"Thrown at rustfs/src/connect/offline/enrollment.rs:198 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the exchange for the intended cluster","Verify cluster identifiers match between challenge and response","Restart enrollment against the correct cluster"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5dca076efed96e7b842de07c4c2111035ae7c7a2","analyzedAt":"2026-08-23T16:57:04.676Z","contentChangedAt":"2026-08-23T16:57:04.676Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}