{"record":{"id":"21ae74ea878fc4c1","repo":"hyperledger/fabric","slug":"none-of-the-identity-s-organizational-units-s-are","errorCode":null,"errorMessage":"none of the identity's organizational units %s are in MSP %s","messagePattern":"none of the identity's organizational units (.+?) are in MSP (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":175,"sourceCode":"\n\t\tfor _, OU := range id.GetOrganizationalUnits() {\n\t\t\tcertificationIDs, exists := msp.ouIdentifiers[OU.OrganizationalUnitIdentifier]\n\n\t\t\tif exists {\n\t\t\t\tfor _, certificationID := range certificationIDs {\n\t\t\t\t\tif bytes.Equal(certificationID, OU.CertifiersIdentifier) {\n\t\t\t\t\t\tfound = true\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif !found {\n\t\t\tif len(id.GetOrganizationalUnits()) == 0 {\n\t\t\t\treturn errors.New(\"the identity certificate does not contain an Organizational Unit (OU)\")\n\t\t\t}\n\t\t\treturn errors.Errorf(\"none of the identity's organizational units %s are in MSP %s\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) validateIdentityOUsV11(id *identity) error {\n\t// Run the same checks as per V1\n\terr := msp.validateIdentityOUsV1(id)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Perform V1_1 additional checks:\n\t//\n\t// -- Check for OU enforcement\n\tif !msp.ouEnforcement {\n\t\t// No enforcement required","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L157-L193","documentation":"Fabric's MSP (Membership Service Provider) rejects an identity because none of the OUs in its x509 certificate match any OU configured in the MSP's NodeOUs section. This check (validateIdentityOUsV1) ensures identities belong to the organization governed by this MSP. Thrown when OU enforcement is enabled and no OU in the certificate resolves to a configured NodeOU.","triggerScenarios":"Calling msp.Validate(identity) (directly or via channel/gossip identity validation) where id.GetOrganizationalUnits() contains OUs not listed under fabric_msp_config NodeOUs for this MSP.","commonSituations":"crypto-config regenerated with different OU names; certificate issued by a different CA than the MSP config expects; NodeOUs enabled (OrganizationalUnitIdentifiersEnable) but certificate has generic or missing OUs; copying certs between organizations.","solutions":["Regenerate or reissue the identity certificate with an OU matching a NodeOU OrganizationalUnitIdentifier in the MSP config","Update the MSP config (config.yaml NodeOUs) so OrganizationalUnitIdentifier matches the OU in the certificate (e.g. 'client' or 'peer')","Verify NodeOUs.Enable is intentional; if OU enforcement is not needed, disable it so only the cert chain is checked"],"exampleFix":"// before (MSP config.yaml NodeOUs)\nNodeOUs:\n  Enable: true\n  ClientOUIdentifier: {OrganizationalUnitIdentifier: client}\n// after: certificate OU is 'admin' but only 'client' is allowed\nNodeOUs:\n  Enable: true\n  AdminOUIdentifier: {OrganizationalUnitIdentifier: admin}","handlingStrategy":"validation","validationCode":"import (\"crypto/x509\"; \"encoding/pem\")\nfunc ousOfCertPEM(certPEM []byte) ([]string, error) {\n    blk, _ := pem.Decode(certPEM)\n    if blk == nil { return nil, fmt.Errorf(\"not PEM\") }\n    cert, err := x509.ParseCertificate(blk.Bytes)\n    if err != nil { return nil, err }\n    var ous []string\n    for _, u := range cert.Subject.OU { ous = append(ous, u) }\n    return ous, nil\n}\n// Compare ousOfCertPEM output against the OU identifiers in the MSP config\n// (FabricMSPConfig.NodeOUs) before calling msp.Validate.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep OU names in certs and MSP config.yaml in sync; check after any cryptogen/fabric-ca regeneration","Enable NodeOUs deliberately and document the exact OU strings (client/peer/orderer/admin)","Test identity validation in CI after any CA or MSP config change","Never reuse certificates across organizations"],"tags":["fabric","msp","x509","configuration"],"backgroundTag":"msp-ou-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}