{"record":{"id":"256fb9263af2522b","repo":"hyperledger/fabric","slug":"node-identity-is-missing-in-channel","errorCode":null,"errorMessage":"node identity is missing in channel","messagePattern":"node identity is missing in channel","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/commauth.go","lineNumber":191,"sourceCode":"\t\t\t\treturn errors.Errorf(\"connection to %d(%s) is in state %s\", stub.ID, stub.Endpoint, connState)\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\n\t\tclusterClient := orderer.NewClusterNodeServiceClient(conn)\n\t\tgetStepClientStream := func(ctx context.Context) (StepClientStream, error) {\n\t\t\tstream, err := clusterClient.Step(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\n\t\t\tmembersMapping, exists := ac.Chan2Members[channel]\n\t\t\tif !exists {\n\t\t\t\treturn nil, errors.Errorf(\"channel members not initialized\")\n\t\t\t}\n\t\t\tnodeStub := membersMapping.LookupByIdentity(ac.NodeIdentity)\n\t\t\tif nodeStub == nil {\n\t\t\t\treturn nil, errors.Errorf(\"node identity is missing in channel\")\n\t\t\t}\n\n\t\t\tstepClientStream := &NodeClientStream{\n\t\t\t\tVersion:           0,\n\t\t\t\tStepClient:        stream,\n\t\t\t\tSourceNodeID:      nodeStub.ID,\n\t\t\t\tDestinationNodeID: stub.ID,\n\t\t\t\tSigner:            ac.Signer,\n\t\t\t\tChannel:           channel,\n\t\t\t}\n\t\t\treturn stepClientStream, nil\n\t\t}\n\n\t\tworkerCountReporter := workerCountReporter{\n\t\t\tchannel: channel,\n\t\t}\n\n\t\trc := &RemoteContext{","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/commauth.go#L173-L209","documentation":"After locating the channel's membership mapping, getStepClientStream looks up the local node's own stub via LookupByIdentity(ac.NodeIdentity). This error means this orderer's identity (its TLS/ enrollment identity bytes) is not present among the channel's configured members - the node is trying to open an authenticated cluster stream to a peer for a channel in which it is not itself a consenter.","triggerScenarios":"ac.NodeIdentity (set at manager construction) does not match any member's identity in the channel mapping: the node was removed from the channel config, NodeIdentity was populated from the wrong MSP/identity (e.g. client vs server TLS cert or wrong channel), or identity serialization differences (different MSP config) make LookupByIdentity fail.","commonSituations":"Orderer removed from the consenters set by a channel reconfiguration but still running the chain; misconfigured GeneralTLS/ identity material (wrong cert chain or MSP); crypto material regenerated after which NodeIdentity no longer matches stored membership; joining a node to the wrong channel.","solutions":["Verify this orderer is a consenter in the channel's current config (compare its identity with the channel's consenter MSP/identity list) - re-add it via config update if it was removed.","Confirm NodeIdentity is loaded from the correct local MSP (orderer identity, not admin/client) and that the same identity was used when members were configured.","Regenerate or refresh channel configuration so membership includes the node's current identity after any TLS/MSP material rotation.","Check for duplicate/renumbered consenter IDs after config updates and re-run Configure with correct identities."],"exampleFix":"// before\ncomm := &cluster.AuthCommMgr{NodeIdentity: wrongClientCertBytes, ...}\nstream, err := ... // node identity is missing in channel\n// after\nid, _ := msp.GetDefaultSigningIdentity() // orderer's own MSP identity\nserialized, _ := id.Serialize()\ncomm := &cluster.AuthCommMgr{NodeIdentity: serialized, ...}\ncomm.Configure(channel, membersIncludingSelf)","handlingStrategy":"validation","validationCode":"func selfIsMember(mgr *cluster.AuthCommMgr, channel string) bool {\n    mgr.Lock.RLock()\n    defer mgr.Lock.RUnlock()\n    mapping, ok := mgr.Chan2Members[channel]\n    if !ok { return false }\n    return mapping.LookupByIdentity(mgr.NodeIdentity) != nil\n}\nif !selfIsMember(mgr, \"mychannel\") {\n    return errors.New(\"this orderer's identity is not in mychannel's consenter set\")\n}","typeGuard":"func identityInMapping(mapping cluster.MemberMapping, identity []byte) bool {\n    return mapping.LookupByIdentity(identity) != nil\n}","tryCatchPattern":"stream, err := getStream(ctx)\nif err != nil {\n    if strings.Contains(err.Error(), \"node identity is missing in channel\") {\n        // self not a member: verify channel config, re-add node or correct NodeIdentity material\n        return fmt.Errorf(\"cannot stream on %s: local identity not in membership\", channel)\n    }\n    return err\n}","preventionTips":["Confirm the orderer's identity is listed in the channel's consenter configuration before joining it to consensus.","Load NodeIdentity from the orderer's own local MSP, not an admin or client identity.","Re-run Configure with refreshed identities after any TLS/MSP material rotation.","Audit membership after every channel config update to catch removals of this node's identity."],"tags":["hyperledger-fabric","orderer","identity","msp","membership"],"backgroundTag":"node-identity-not-in-channel","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}