{"record":{"id":"1df3b2b1f6231d0d","repo":"hyperledger/fabric","slug":"access-denied-channel-s-creator-org-unknown-c","errorCode":null,"errorMessage":"access denied: channel [%s] creator org unknown, creator is malformed","messagePattern":"access denied: channel \\[(.+?)\\] creator org unknown, creator is malformed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/endorser/msgvalidation.go","lineNumber":173,"sourceCode":"\n\texpectedTxID := protoutil.ComputeTxID(up.SignatureHeader.Nonce, up.SignatureHeader.Creator)\n\tif up.TxID() != expectedTxID {\n\t\treturn errors.Errorf(\"incorrectly computed txid '%s' -- expected '%s'\", up.TxID(), expectedTxID)\n\t}\n\n\tif up.SignedProposal.ProposalBytes == nil {\n\t\treturn errors.Errorf(\"empty proposal bytes\")\n\t}\n\n\tif up.SignedProposal.Signature == nil {\n\t\treturn errors.Errorf(\"empty signature bytes\")\n\t}\n\n\t// get the identity of the creator\n\tcreator, err := idDeserializer.DeserializeIdentity(up.SignatureHeader.Creator)\n\tif err != nil {\n\t\tlogger.Warnw(\"access denied\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(up.SignatureHeader.Creator))\n\t\treturn errors.Errorf(\"access denied: channel [%s] creator org unknown, creator is malformed\", up.ChannelID())\n\t}\n\n\tgenericAuthError := errors.Errorf(\"access denied: channel [%s] creator org [%s]\", up.ChannelID(), creator.GetMSPIdentifier())\n\t// ensure that creator is a valid certificate\n\terr = creator.Validate()\n\tif err != nil {\n\t\tlogger.Warnw(\"access denied: identity is not valid\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(up.SignatureHeader.Creator))\n\t\treturn genericAuthError\n\t}\n\n\tlogger = logger.With(\"mspID\", creator.GetMSPIdentifier())\n\n\tlogger.Debug(\"creator is valid\")\n\n\t// validate the signature\n\terr = creator.Verify(up.SignedProposal.ProposalBytes, up.SignedProposal.Signature)\n\tif err != nil {\n\t\tlogger.Warnw(\"access denied: creator's signature over the proposal is not valid\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(up.SignatureHeader.Creator))","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/endorser/msgvalidation.go#L155-L191","documentation":"The endorser could not deserialize the creator bytes in the SignatureHeader into a valid MSP identity. This is the deliberately opaque 'access denied' returned when the serialized identity is malformed (as opposed to valid-but-unauthorized, which yields the generic creator-org message). The actual deserialization error is only logged server-side.","triggerScenarios":"ProcessProposal -> preProcess -> Validate when idDeserializer.DeserializeIdentity(SignatureHeader.Creator) fails — creator bytes are not a valid mspprotos.SerializedIdentity, reference an MSP unknown to the peer, or contain an unparseable x509 cert.","commonSituations":"Client's MSP ID not present in the peer/channel configuration, corrupted or wrong-format certificate PEM, using an identity from a different network, Fabric version mismatch in identity protobuf serialization, peer missing the org's MSP config (update channel config).","solutions":["Verify the org's MSP definition (with the client's CA cert) is included in the channel configuration for the target channel.","Ensure SignatureHeader.Creator is a marshaled mspprotos.SerializedIdentity{Mspid, IdBytes} with a valid PEM x509 certificate.","Check peer logs (the 'access denied' Warnw entry) for the underlying deserialization error and fix the certificate format/MSP ID accordingly.","Regenerate client certs from the correct org CA and confirm mspId matches the organization name in configtx."],"exampleFix":"// before\ncreator := certPEM // raw PEM, not a SerializedIdentity\n// after\ncreator, _ := proto.Marshal(&mspprotos.SerializedIdentity{Mspid: \"Org1MSP\", IdBytes: certPEM})","handlingStrategy":"try-catch","validationCode":"var sid mspprotos.SerializedIdentity\nif err := proto.Unmarshal(shdr.Creator, &sid); err != nil {\n    return fmt.Errorf(\"creator is not a SerializedIdentity: %w\", err)\n}\nif _, err := x509.ParseCertificate(certDER); err != nil {\n    return fmt.Errorf(\"creator cert unparseable: %w\", err)\n}","typeGuard":"func isWellFormedIdentity(creator []byte) bool {\n    var sid mspprotos.SerializedIdentity\n    return proto.Unmarshal(creator, &sid) == nil && len(sid.Mspid) > 0 && len(sid.IdBytes) > 0\n}","tryCatchPattern":"// client side\ncatch (err) {\n  if (String(err).includes('creator org unknown, creator is malformed')) {\n    // inspect peer logs, verify MSP config + cert format, then rebuild identity\n    await reloadWalletIdentity();\n  }\n  throw err;\n}","preventionTips":["Confirm the client org's MSP is defined in the channel config","Keep mspId identical between client identity and configtx org name","Use standard PEM certificates issued by the org's CA","Read peer logs for the underlying deserialization cause"],"tags":["hyperledger-fabric","endorser","identity","msp","access-denied"],"backgroundTag":"identity-deserialization-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}