{"record":{"id":"113e8148c3a71242","repo":"hyperledger/fabric","slug":"nodeous-not-activated-cannot-tell-apart-identitie","errorCode":null,"errorMessage":"NodeOUs not activated. Cannot tell apart identities.","messagePattern":"NodeOUs not activated\\. Cannot tell apart identities\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":343,"sourceCode":"\tswitch id := id.(type) {\n\t// If this identity is of this specific type,\n\t// this is how I can validate it given the\n\t// root of trust this MSP has\n\tcase *identity:\n\t\treturn msp.validateIdentity(id)\n\tdefault:\n\t\treturn errors.New(\"identity type not recognized\")\n\t}\n}\n\n// hasOURole checks that the identity belongs to the organizational unit\n// associated to the specified MSPRole.\n// This function does not check the certifiers identifier.\n// Appropriate validation needs to be enforced before.\nfunc (msp *bccspmsp) hasOURole(id Identity, mspRole m.MSPRole_MSPRoleType) error {\n\t// Check NodeOUs\n\tif !msp.ouEnforcement {\n\t\treturn errors.New(\"NodeOUs not activated. Cannot tell apart identities.\")\n\t}\n\n\tmspLogger.Debugf(\"MSP %s checking if the identity is a client\", msp.name)\n\n\tswitch id := id.(type) {\n\t// If this identity is of this specific type,\n\t// this is how I can validate it given the\n\t// root of trust this MSP has\n\tcase *identity:\n\t\treturn msp.hasOURoleInternal(id, mspRole)\n\tdefault:\n\t\treturn errors.New(\"Identity type not recognized\")\n\t}\n}\n\nfunc (msp *bccspmsp) hasOURoleInternal(id *identity, mspRole m.MSPRole_MSPRoleType) error {\n\tvar nodeOU *OUIdentifier\n\tswitch mspRole {","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L325-L361","documentation":"hasOURole maps an identity to a NodeOUs role (CLIENT/PEER/ADMIN/ORDERER), but this only works when OU identification is enabled in the MSP configuration (FabricMSPConfig.FabricNodeOus.Enable). If msp.ouEnforcement is false, the MSP cannot distinguish identity roles and returns this error. It is a configuration prerequisite failure, not a certificate problem.","triggerScenarios":"A policy or postSetupV142 check calls hasOURole on an MSP whose config lacks NodeOUs settings (no config.yaml with NodeOUs: Enable: true in the MSP directory), typically when channel policies use roles like 'client'/'peer' (e.g. PeerRole, ClientRole principals) against an MSP that never enabled NodeOUs.","commonSituations":"Upgrading networks where new v1.4.2+ policies reference NodeOU roles while old MSP dirs still lack config.yaml NodeOUs; generating crypto material with older cryptogen versions that don't emit NodeOUs; manually editing MSP config and dropping the NodeOUs section.","solutions":["Enable NodeOUs in the MSP config.yaml: set NodeOUs.Enable: true and provide ClientOUIdentifier/PeerOUIdentifier/AdminOUIdentifier/OrdererOUIdentifier entries, then restart","Regenerate or update the org's MSP material (fabric-ca client or newer cryptogen) so the config.yaml contains the NodeOUs section","If NodeOUs cannot be enabled, change endorsement/ACL policies to use MSPRole/MSP_MEMBER principals instead of node-role (client/peer) principals","Ensure channel config's MSP definition includes FabricNodeOUs.Enable=true so ouEnforcement is set during Setup"],"exampleFix":"# before: msp/config.yaml without NodeOUs\nOrganizationalUnitIdentifiers: []\n\n# after\nNodeOUs:\n  Enable: true\n  ClientOUIdentifier:\n    Certificate: cacerts/ca.pem\n    OrganizationalUnitIdentifier: client\n  PeerOUIdentifier:\n    Certificate: cacerts/ca.pem\n    OrganizationalUnitIdentifier: peer","handlingStrategy":"validation","validationCode":"// verify NodeOUs enabled in MSP config.yaml before policies that need roles\ncfg, err := config.ReadMSPConfig(filepath.Join(mspDir, \"config.yaml\"))\nif err != nil || cfg.NodeOUs == nil || !cfg.NodeOUs.Enable {\n    return fmt.Errorf(\"NodeOUs must be enabled in %s for role-based policies\", mspDir)\n}","typeGuard":null,"tryCatchPattern":"if err := checkRole(id, m.MSPRole_CLIENT); err != nil {\n    if strings.Contains(err.Error(), \"NodeOUs not activated\") {\n        return fmt.Errorf(\"enable NodeOUs in MSP config.yaml or use MSPRole principals: %w\", err)\n    }\n    return err\n}","preventionTips":["Set NodeOUs.Enable: true with all four OU identifiers (client/peer/admin/orderer) in every MSP dir","Use current cryptogen or fabric-ca versions that emit NodeOUs config","When migrating to v1.4.2+, re-export MSP configs before deploying role-based policies","Prefer MSP_MEMBER/MSP_ADMIN principals when NodeOUs are not part of your config"],"tags":["hyperledger-fabric","msp","nodeous","configuration"],"backgroundTag":"nodeous-not-enabled","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}