{"record":{"id":"1c06ed06e88f0c0b","repo":"hyperledger/fabric","slug":"principal-is-anonymous-but-x-509-msp-does-not-sup","errorCode":null,"errorMessage":"Principal is anonymous, but X.509 MSP does not support anonymous identities","messagePattern":"Principal is anonymous, but X\\.509 MSP does not support anonymous identities","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":599,"sourceCode":"}\n\n// satisfiesPrincipalInternalV13 takes as arguments the identity and the principal.\n// The function returns an error if one occurred.\n// The function implements the additional behavior expected of an MSP starting from v1.3.\n// For pre-v1.3 functionality, the function calls the satisfiesPrincipalInternalPreV13.\nfunc (msp *bccspmsp) satisfiesPrincipalInternalV13(id Identity, principal *m.MSPPrincipal) error {\n\tswitch principal.PrincipalClassification {\n\tcase m.MSPPrincipal_COMBINED:\n\t\treturn errors.New(\"SatisfiesPrincipalInternal shall not be called with a CombinedPrincipal\")\n\tcase m.MSPPrincipal_ANONYMITY:\n\t\tanon := &m.MSPIdentityAnonymity{}\n\t\terr := proto.Unmarshal(principal.Principal, anon)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not unmarshal MSPIdentityAnonymity from principal\")\n\t\t}\n\t\tswitch anon.AnonymityType {\n\t\tcase m.MSPIdentityAnonymity_ANONYMOUS:\n\t\t\treturn errors.New(\"Principal is anonymous, but X.509 MSP does not support anonymous identities\")\n\t\tcase m.MSPIdentityAnonymity_NOMINAL:\n\t\t\treturn nil\n\t\tdefault:\n\t\t\treturn errors.Errorf(\"Unknown principal anonymity type: %d\", anon.AnonymityType)\n\t\t}\n\n\tdefault:\n\t\t// Use the pre-v1.3 function to check other principal types\n\t\treturn msp.satisfiesPrincipalInternalPreV13(id, principal)\n\t}\n}\n\n// satisfiesPrincipalInternalV142 takes as arguments the identity and the principal.\n// The function returns an error if one occurred.\n// The function implements the additional behavior expected of an MSP starting from v2.0.\n// For v1.3 functionality, the function calls the satisfiesPrincipalInternalPreV13.\nfunc (msp *bccspmsp) satisfiesPrincipalInternalV142(id Identity, principal *m.MSPPrincipal) error {\n\t_, okay := id.(*identity)","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L581-L617","documentation":"X.509-based bccspmsp identities are always nominal (certificate-backed), never anonymous. When the requested ANONYMITY principal carries AnonymityType=ANONYMOUS, satisfiesPrincipalInternalV13 rejects it outright because this MSP implementation cannot certify anonymity. Identities need an X.509 credential, so they can never match an anonymous principal.","triggerScenarios":"Evaluating an X.509 identity against an MSPPrincipal{Classification: ANONYMITY, Principal: marshaled MSPIdentityAnonymity with AnonymityType: ANONYMOUS}; e.g. an endorsement policy written for an idemix (identity mixer) MSP applied to an X.509 MSP.","commonSituations":"Configuring channel policies designed for Identity Mixer (idemix) MSPs but deploying them in an org using a standard X.509 bccspmsp; mixing anonymous-credential requirements into CA-issued certificate networks.","solutions":["Change the principal's anonymity type to NOMINAL if the intent is ordinary certificate-based membership.","If anonymity is genuinely required, configure an idemix MSP and evaluate the principal against identities of that MSP, not the X.509 one.","Remove anonymous-principal requirements from policies that will be satisfied by X.509 organizations."],"exampleFix":"// before\nanon, _ := proto.Marshal(&m.MSPIdentityAnonymity{AnonymityType: m.MSPIdentityAnonymity_ANONYMOUS})\n// after\nanon, _ := proto.Marshal(&m.MSPIdentityAnonymity{AnonymityType: m.MSPIdentityAnonymity_NOMINAL})","handlingStrategy":"validation","validationCode":"anon := &m.MSPIdentityAnonymity{}\nif err := proto.Unmarshal(principal.Principal, anon); err == nil && anon.AnonymityType == m.MSPIdentityAnonymity_ANONYMOUS {\n\treturn errors.New(\"X.509 MSP cannot satisfy ANONYMOUS principal; use idemix MSP or NOMINAL type\")\n}","typeGuard":"func requiresAnonymousIdentity(p *m.MSPPrincipal) bool {\n\tanon := &m.MSPIdentityAnonymity{}\n\tif p == nil || p.PrincipalClassification != m.MSPPrincipal_ANONYMITY || proto.Unmarshal(p.Principal, anon) != nil {\n\t\treturn false\n\t}\n\treturn anon.AnonymityType == m.MSPIdentityAnonymity_ANONYMOUS\n}","tryCatchPattern":null,"preventionTips":["Use NOMINAL anonymity for certificate-based organizations.","Reserve ANONYMOUS principals for idemix MSP networks and keep them out of X.509 org policies."],"tags":["msp","anonymity","x509","idemix"],"backgroundTag":"unsupported-anonymous-identity","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}