{"record":{"id":"2bd05ecec9c8e6c4","repo":"hyperledger/fabric","slug":"the-identity-certificate-does-not-contain-an-organ","errorCode":null,"errorMessage":"the identity certificate does not contain an Organizational Unit (OU)","messagePattern":"the identity certificate does not contain an Organizational Unit \\(OU\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":173,"sourceCode":"\tif len(msp.ouIdentifiers) > 0 {\n\t\tfound := false\n\n\t\tfor _, OU := range id.GetOrganizationalUnits() {\n\t\t\tcertificationIDs, exists := msp.ouIdentifiers[OU.OrganizationalUnitIdentifier]\n\n\t\t\tif exists {\n\t\t\t\tfor _, certificationID := range certificationIDs {\n\t\t\t\t\tif bytes.Equal(certificationID, OU.CertifiersIdentifier) {\n\t\t\t\t\t\tfound = true\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif !found {\n\t\t\tif len(id.GetOrganizationalUnits()) == 0 {\n\t\t\t\treturn errors.New(\"the identity certificate does not contain an Organizational Unit (OU)\")\n\t\t\t}\n\t\t\treturn errors.Errorf(\"none of the identity's organizational units %s are in MSP %s\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) validateIdentityOUsV11(id *identity) error {\n\t// Run the same checks as per V1\n\terr := msp.validateIdentityOUsV1(id)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Perform V1_1 additional checks:\n\t//\n\t// -- Check for OU enforcement","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L155-L191","documentation":"validateIdentityOUsV1 guard: OU identifier enforcement is active (msp.ouIdentifiers is non-empty) but the identity certificate contains no Organizational Unit at all, so it cannot match any configured OU-to-certifier mapping.","triggerScenarios":"Thrown at msp/mspimplvalidate.go:173 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reissue the certificate with an OU matching a configured OrganizationalUnitIdentifier","Add the certificate's OU to the MSP config's OU identifiers","Disable OU enforcement if the channel does not require it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}