{"record":{"id":"310cf0f8ba89aef1","repo":"hyperledger/fabric","slug":"invalid-msp-role-type-d","errorCode":null,"errorMessage":"invalid MSP role type %d","messagePattern":"invalid MSP role type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":532,"sourceCode":"\t\t\t// id is exactly one of our admins\n\t\t\tif msp.isInAdmins(id.(*identity)) {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn errors.New(\"This identity is not an admin\")\n\t\tcase m.MSPRole_CLIENT:\n\t\t\tfallthrough\n\t\tcase m.MSPRole_PEER:\n\t\t\tmspLogger.Debugf(\"Checking if identity satisfies role [%s] for %s\", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)\n\t\t\tif err := msp.Validate(id); err != nil {\n\t\t\t\treturn errors.Wrapf(err, \"The identity is not valid under this MSP [%s]\", msp.name)\n\t\t\t}\n\n\t\t\tif err := msp.hasOURole(id, mspRole.Role); err != nil {\n\t\t\t\treturn errors.Wrapf(err, \"The identity is not a [%s] under this MSP [%s]\", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)\n\t\t\t}\n\t\t\treturn nil\n\t\tdefault:\n\t\t\treturn errors.Errorf(\"invalid MSP role type %d\", int32(mspRole.Role))\n\t\t}\n\tcase m.MSPPrincipal_IDENTITY:\n\t\t// in this case we have to deserialize the principal's identity\n\t\t// and compare it byte-by-byte with our cert\n\t\tprincipalId, err := msp.DeserializeIdentity(principal.Principal)\n\t\tif err != nil {\n\t\t\treturn errors.WithMessage(err, \"invalid identity principal, not a certificate\")\n\t\t}\n\n\t\tif bytes.Equal(id.(*identity).cert.Raw, principalId.(*identity).cert.Raw) {\n\t\t\treturn principalId.Validate()\n\t\t}\n\n\t\treturn errors.New(\"The identities do not match\")\n\tcase m.MSPPrincipal_ORGANIZATION_UNIT:\n\t\t// Principal contains the OrganizationUnit\n\t\tOU := &m.OrganizationUnit{}\n\t\terr := proto.Unmarshal(principal.Principal, OU)","sourceCodeStart":514,"sourceCodeEnd":550,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L514-L550","documentation":"This error is thrown by satisfiesPrincipalInternalPreV13 when a policy principal of type MSPRole carries a Role enum value the X.509 BCCSP MSP does not recognize. Only MEMBER, ADMIN, CLIENT and PEER are handled; anything else falls into the default branch. It means the serialized MSPPrincipal passed to policy evaluation contains a corrupt or unsupported role value.","triggerScenarios":"Evaluating a signature policy/ACL whose MSPPrincipal contains an MSPRole with a Role value outside {MEMBER=0, ADMIN=1, CLIENT=2, PEER=3}, typically after deserializing a principal from a different Hyperledger Fabric version or hand-crafted protobuf.","commonSituations":"Policies generated or edited with a newer/older fabric-protos than the peer binary; channel config or collection config hand-edited or patched programmatically; a fabricated MSPPrincipal supplied via SDK when endorsing or checking policy satisfaction.","solutions":["Regenerate the policy/config with the fabric-protos version matching the running peer so MSPRole.Role is a valid enum value","Inspect the MSPPrincipal bytes (decode MSPRole from principal.Principal) and confirm Role is one of MEMBER, ADMIN, CLIENT, PEER","Recreate the endorsement policy using standard tooling (e.g. 'Org1MSP.member' style policy strings or fabric-ca/policygen) instead of hand-built protobuf","If a new role type is genuinely needed, upgrade both the peer and protos so the switch handles it"],"exampleFix":"// before: hand-built principal with unknown role\nrole := &msp.MSPRole{MspIdentifier: \"Org1MSP\", Role: msp.MSPRole_MSPRoleType(9)}\n// after: use a defined enum value\nrole := &msp.MSPRole{MspIdentifier: \"Org1MSP\", Role: msp.MSPRole_PEER}","handlingStrategy":"validation","validationCode":"role := &msp.MSPRole{}\nif err := proto.Unmarshal(principal.Principal, role); err != nil {\n\treturn fmt.Errorf(\"bad MSPRole principal: %w\", err)\n}\nif role.Role != msp.MSPRole_MEMBER && role.Role != msp.MSPRole_ADMIN &&\n\trole.Role != msp.MSPRole_CLIENT && role.Role != msp.MSPRole_PEER {\n\treturn fmt.Errorf(\"unsupported MSPRole %d in policy\", role.Role)\n}","typeGuard":"func isValidMSPRole(r msp.MSPRole_MSPRoleType) bool {\n\t_, ok := msp.MSPRole_MSPRoleType_name[int32(r)]\n\treturn ok && (r == msp.MSPRole_MEMBER || r == msp.MSPRole_ADMIN || r == msp.MSPRole_CLIENT || r == msp.MSPRole_PEER)\n}","tryCatchPattern":"err := policy.Evaluate(signedData)\nvar badRoleErr interface{ Error() string }\nif err != nil && strings.Contains(err.Error(), \"invalid MSP role type\") {\n\t// policy contains an unknown role; rebuild policy with a valid MSPRole\n}","preventionTips":["Always build MSPPrincipal/MSPRole via proto.Marshal of the generated structs, never by hand-assembling bytes","Keep fabric-protos versions aligned between tools that write policies and the peer binary","Validate policies (deserialization round-trip) before committing them to channel or collection config"],"tags":["msp","policy","protobuf","hyperledger-fabric"],"backgroundTag":"invalid-enum-value","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}