{"record":{"id":"6bdab8f828a694c5","repo":"hyperledger/fabric","slug":"the-identity-does-not-contain-ou-s-msp-s","errorCode":null,"errorMessage":"The identity does not contain OU [%s], MSP: [%s]","messagePattern":"The identity does not contain OU \\[(.+?)\\], MSP: \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":384,"sourceCode":"\tcase m.MSPRole_ADMIN:\n\t\tnodeOU = msp.adminOU\n\tcase m.MSPRole_ORDERER:\n\t\tnodeOU = msp.ordererOU\n\tdefault:\n\t\treturn errors.New(\"Invalid MSPRoleType. It must be CLIENT, PEER, ADMIN or ORDERER\")\n\t}\n\n\tif nodeOU == nil {\n\t\treturn errors.Errorf(\"cannot test for classification, node ou for type [%s], not defined, msp: [%s]\", mspRole, msp.name)\n\t}\n\n\tfor _, OU := range id.GetOrganizationalUnits() {\n\t\tif OU.OrganizationalUnitIdentifier == nodeOU.OrganizationalUnitIdentifier {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn errors.Errorf(\"The identity does not contain OU [%s], MSP: [%s]\", mspRole, msp.name)\n}\n\n// DeserializeIdentity returns an Identity given the byte-level\n// representation of a SerializedIdentity struct\nfunc (msp *bccspmsp) DeserializeIdentity(serializedID []byte) (Identity, error) {\n\tmspLogger.Debug(\"Obtaining identity\")\n\n\t// We first deserialize to a SerializedIdentity to get the MSP ID\n\tsId := &m.SerializedIdentity{}\n\terr := proto.Unmarshal(serializedID, sId)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"could not deserialize a SerializedIdentity\")\n\t}\n\n\tif sId.Mspid != msp.name {\n\t\treturn nil, errors.Errorf(\"expected MSP ID %s, received %s\", msp.name, sId.Mspid)\n\t}\n","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L366-L402","documentation":"hasOURoleInternal iterates the identity's OrganizationalUnits and returns this error when none matches the configured node OU identifier for the requested role. The identity is valid but was issued with an OU that does not classify it as the requested role (e.g. not an admin). Thrown at msp/mspimpl.go:384.","triggerScenarios":"Calling hasOURole (via satisfiesPrincipal NODE_OU evaluation) with an identity whose certificate's OU field differs from the NodeOUIdentifier configured for the requested MSPRole, e.g. cert has OU=client but policy requires OU=peer.","commonSituations":"Certificates issued by fabric-ca with the wrong OU affinity; NodeOUs classification changes after enrollment requiring re-enrollment; comparing identities across organizations where OU naming conventions differ; attempting to satisfy an admin policy with a plain client cert.","solutions":["Re-enroll (or re-issue) the identity's certificate with the OU identifier matching the configured node OU for the required role (fabric-ca-server or fabric-ca-client enroll with --id.affiliation / ou config).","Align the MSP config's OrganizationalUnitIdentifier for that role with the OU actually present in the user's certificate.","Verify the certificate's OU with `openssl x509 -text` and confirm the identity belongs to the correct MSP/organization."],"exampleFix":"# before: cert has OU=client, policy needs peer\nfabric-ca-client register --id.name peer1 --id.type peer\n# after: re-enroll with peer type so cert OU=peer matches PeerOUIdentifier\nfabric-ca-client enroll -u https://peer1:pw@ca:7054 -M peer1-msp","handlingStrategy":"validation","validationCode":"func identityHasOU(certPEM []byte, wantOU string) bool {\n  block, _ := pem.Decode(certPEM)\n  if block == nil {\n    return false\n  }\n  cert, err := x509.ParseCertificate(block.Bytes)\n  if err != nil {\n    return false\n  }\n  for _, ou := range cert.Subject.OrganizationalUnit {\n    if ou == wantOU {\n      return true\n    }\n  }\n  return false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check `openssl x509 -text -in cert.pem` OU fields against the MSP NodeOUs identifiers before enrolling into policies.","Register users with fabric-ca --id.type matching the intended role so the cert OU matches.","Re-enroll identities whenever NodeOUs classification rules change."],"tags":["msp","ou-mismatch","identity","policy"],"backgroundTag":"ou-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}