{"record":{"id":"0bcef5cc7a56d352","repo":"hyperledger/fabric","slug":"failed-verifying-that-proposal-s-creator-satisfies","errorCode":null,"errorMessage":"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [%s]: [%s]","messagePattern":"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/policy/policy.go","lineNumber":148,"sourceCode":"\n\t// Deserialize proposal's creator with the local MSP\n\tid, err := p.localMSP.DeserializeIdentity(shdr.Creator)\n\tif err != nil {\n\t\tlogger.Warnw(\"Failed deserializing proposal creator during channelless check policy\", \"error\", err, \"policyName\", policyName, \"identity\", protoutil.LogMessageForSerializedIdentity(shdr.Creator))\n\t\treturn fmt.Errorf(\"Failed deserializing proposal creator during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Load MSPPrincipal for policy\n\tprincipal, err := p.principalGetter.Get(policyName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed getting local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Verify that proposal's creator satisfies the principal\n\terr = id.SatisfiesPrincipal(principal)\n\tif err != nil {\n\t\tlogger.Warnw(\"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy\", \"error\", err, \"policyName\", policyName, \"requiredPrincipal\", principal, \"signingIdentity\", protoutil.LogMessageForSerializedIdentity(shdr.Creator))\n\t\treturn fmt.Errorf(\"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Verify the signature\n\treturn id.Verify(signedProp.ProposalBytes, signedProp.Signature)\n}\n\n// CheckPolicyBySignedData checks that the passed signed data is valid with the respect to\n// passed policy on the passed channel.\nfunc (p *policyChecker) CheckPolicyBySignedData(channelID, policyName string, sd []*protoutil.SignedData) error {\n\tif channelID == \"\" {\n\t\treturn errors.New(\"Invalid channel ID name during check policy on signed data. Name must be different from nil.\")\n\t}\n\n\tif policyName == \"\" {\n\t\treturn fmt.Errorf(\"Invalid policy name during check policy on signed data on channel [%s]. Name must be different from nil.\", channelID)\n\t}\n\n\tif sd == nil {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/policy/policy.go#L130-L166","documentation":"This error is returned by the channelless policy check path when the proposal creator's identity (from the local MSP) does not satisfy the principal required by the named policy. `id.SatisfiesPrincipal(principal)` failed, meaning the signer is not who the local MSP policy demands (wrong MSP, wrong role, or an unresolvable identity). The message embeds the policy name and the underlying MSP error.","triggerScenarios":"Calling CheckPolicyNoChannel (directly or via CheckPolicy) with a SignedProposal whose Creator serialized identity does not satisfy the principal required by the given policyName against the local MSP — e.g. identity from a different MSP ID, a member where an admin/peer role is required, or a corrupted/unparseable creator certificate.","commonSituations":"Peer-to-peer system chaincode invocations (e.g. qscc/cscc) where the caller's organization is not in the local MSP's allowed principals; misconfigured local MSP directory missing the caller's org's CA certs; client signing with an identity whose OU/role does not match the policy (admin required but client cert used); expired or rotated certificates.","solutions":["Check the error's [%s] fields in the peer log (requiredPrincipal, signingIdentity) to see which principal was demanded and what identity was presented.","Ensure the caller's organization's root/intermediate CA certs are present in the peer's local MSP (msp/config.yaml + cacerts) and the peer was restarted/re-anchored after changes.","Sign the proposal with an identity holding the role the policy requires (e.g. use the admin cert for admin-level system chaincode calls).","Verify the policy referenced by policyName (e.g. from configtx) lists principals matching the caller's MSP ID and role; update the policy or use the correct one.","Re-enroll/re-issue client certificates if they are expired or were issued by a removed CA."],"exampleFix":"// before: signing system chaincode proposal with a plain client cert\nproposal, _, err := utils.CreateProposalFromCISAndSign(certs.Signer, channelID, ccInput)\n// after: sign with an identity that satisfies the required principal (e.g. admin)\nsigner, err := mspmgr.GetDefaultSigningIdentity() // ensure this MSP identity has the admin/peer role\nproposal, _, err := utils.CreateProposalFromCISAndSign(signer, channelID, ccInput)","handlingStrategy":"try-catch","validationCode":"// before calling CheckPolicy: verify creator identity exists and matches local MSP\ncreator, err := signer.Serialize()\nif err != nil { return err }\nmspID := mspmgr.GetIdentityIdentifier(creator).Mspid\nif mspID != expectedLocalMSPID { return fmt.Errorf(\"identity MSP %s does not match local MSP %s\", mspID, expectedLocalMSPID) }","typeGuard":"func hasValidCreator(shdr *common.ChannelHeader) bool {\n    return shdr != nil && len(shdr.Creator) > 0\n}","tryCatchPattern":"err := checker.CheckPolicy(proposal)\nif err != nil {\n    if strings.Contains(err.Error(), \"satisfies local MSP principal\") {\n        // inspect policyName + requiredPrincipal embedded in message; log signing identity\n        return fmt.Errorf(\"creator identity not authorized for policy %s: %w\", policyName, err)\n    }\n    return err\n}","preventionTips":["Always sign system-chaincode proposals with an identity whose MSP/role satisfies the target policy (admin certs for admin operations).","Keep the peer's local MSP cacerts current with all organizations that may call the peer.","Log protoutil.LogMessageForSerializedIdentity of the creator on failure to quickly spot MSP mismatches.","Validate that client enrollment certs are not expired before submitting proposals."],"tags":["fabric","msp","policy","identity"],"backgroundTag":"msp-principal-check-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}