{"record":{"id":"49c71f215dea02fe","repo":"hyperledger/fabric","slug":"error-parsing-principal-s","errorCode":null,"errorMessage":"error parsing principal %s","messagePattern":"error parsing principal (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/policydsl/policyparser.go","lineNumber":174,"sourceCode":"\n\t/* sanity check - t should be positive, permit equal to n+1, but disallow over n+1 */\n\tif t < 0 || t > n+1 {\n\t\treturn nil, fmt.Errorf(\"invalid t-out-of-n predicate, t %d, n %d\", t, n)\n\t}\n\n\tpolicies := make([]*cb.SignaturePolicy, 0)\n\n\t/* handle the rest of the arguments */\n\tfor _, principal := range args[2:] {\n\t\tswitch t := principal.(type) {\n\t\t/* if it's a string, we expect it to be formed as\n\t\t   <MSP_ID> . <ROLE>, where MSP_ID is the MSP identifier\n\t\t   and ROLE is either a member, an admin, a client, a peer or an orderer*/\n\t\tcase string:\n\t\t\t/* split the string */\n\t\t\tsubm := regex.FindAllStringSubmatch(t, -1)\n\t\t\tif subm == nil || len(subm) != 1 || len(subm[0]) != 4 {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing principal %s\", t)\n\t\t\t}\n\n\t\t\t/* get the right role */\n\t\t\tvar r mb.MSPRole_MSPRoleType\n\n\t\t\tswitch subm[0][3] {\n\t\t\tcase RoleMember:\n\t\t\t\tr = mb.MSPRole_MEMBER\n\t\t\tcase RoleAdmin:\n\t\t\t\tr = mb.MSPRole_ADMIN\n\t\t\tcase RoleClient:\n\t\t\t\tr = mb.MSPRole_CLIENT\n\t\t\tcase RolePeer:\n\t\t\t\tr = mb.MSPRole_PEER\n\t\t\tcase RoleOrderer:\n\t\t\t\tr = mb.MSPRole_ORDERER\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing role %s\", t)","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/policydsl/policyparser.go#L156-L192","documentation":"When a subject in secondPass is a string, it must match the principal regex ^<MSP_ID>.<ROLE>$ with ROLE one of member|admin|client|peer|orderer. A string that doesn't match (wrong separator, unknown role, spaces, nested-gate text landing in the wrong pass) fails with 'error parsing principal <s>'.","triggerScenarios":"Principals like 'Org1 Member', 'Org1/peer', 'Org1.owner' (unknown role), or an empty MSP ID ('.member'); also gate keywords ('And', 'or') reaching secondPass as subjects because of malformed nesting in the policy string.","commonSituations":"Typos in role names ('peers', 'Member' capitalized is actually matched since regex is case-sensitive lowercase — 'Member' fails); using ':' or '/' instead of '.' between MSP ID and role; copying peer CLI -s flag values that aren't principal strings; MSP IDs with characters outside [[:alnum:].-].","solutions":["Format every principal as '<MSP_ID>.<ROLE>' with a literal dot and lowercase role: 'Org1.member', 'Org1MSP.admin'.","Use only the supported roles: member, admin, client, peer, orderer.","Trim whitespace and verify the MSP ID contains only alphanumerics, dots, and dashes.","If you need a nested gate, wrap it in its gate call (e.g. And('Org1.member','Org2.member')) rather than passing it as a bare string subject."],"exampleFix":"// before\npolicydsl.FromString(\"OutOf(1, 'Org1/peer', 'Org2.member')\")\n// after\npolicydsl.FromString(\"OutOf(1, 'Org1.peer', 'Org2.member')\")","handlingStrategy":"validation","validationCode":"var principalRe = regexp.MustCompile(`^([[:alnum:].-]+)\\.(member|admin|client|peer|orderer)$`)\nfunc validPrincipal(p string) bool { return principalRe.MatchString(p) }\n// check each principal before composing the policy string","typeGuard":"func isPrincipal(s string) bool {\n\treturn principalRe.MatchString(s)\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error parsing principal\") {\n\treturn nil, fmt.Errorf(\"principals must look like 'Org1.member' with role in {member,admin,client,peer,orderer}: %w\", err)\n}","preventionTips":["Format principals strictly as <MSP_ID>.<ROLE> with a single dot and lowercase role.","Only use roles: member, admin, client, peer, orderer.","Trim whitespace; MSP IDs may only contain alphanumerics, dots, dashes.","Validate every principal string against the regex before building the policy."],"tags":["policydsl","hyperledger-fabric","principal","msp","validation"],"backgroundTag":"invalid-principal-format","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}