{"record":{"id":"7c1ede35475c4cfa","repo":"hyperledger/fabric","slug":"identity-type-not-recognized-7c1ede","errorCode":null,"errorMessage":"Identity type not recognized","messagePattern":"Identity type not recognized","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":355,"sourceCode":"// associated to the specified MSPRole.\n// This function does not check the certifiers identifier.\n// Appropriate validation needs to be enforced before.\nfunc (msp *bccspmsp) hasOURole(id Identity, mspRole m.MSPRole_MSPRoleType) error {\n\t// Check NodeOUs\n\tif !msp.ouEnforcement {\n\t\treturn errors.New(\"NodeOUs not activated. Cannot tell apart identities.\")\n\t}\n\n\tmspLogger.Debugf(\"MSP %s checking if the identity is a client\", msp.name)\n\n\tswitch id := id.(type) {\n\t// If this identity is of this specific type,\n\t// this is how I can validate it given the\n\t// root of trust this MSP has\n\tcase *identity:\n\t\treturn msp.hasOURoleInternal(id, mspRole)\n\tdefault:\n\t\treturn errors.New(\"Identity type not recognized\")\n\t}\n}\n\nfunc (msp *bccspmsp) hasOURoleInternal(id *identity, mspRole m.MSPRole_MSPRoleType) error {\n\tvar nodeOU *OUIdentifier\n\tswitch mspRole {\n\tcase m.MSPRole_CLIENT:\n\t\tnodeOU = msp.clientOU\n\tcase m.MSPRole_PEER:\n\t\tnodeOU = msp.peerOU\n\tcase m.MSPRole_ADMIN:\n\t\tnodeOU = msp.adminOU\n\tcase m.MSPRole_ORDERER:\n\t\tnodeOU = msp.ordererOU\n\tdefault:\n\t\treturn errors.New(\"Invalid MSPRoleType. It must be CLIENT, PEER, ADMIN or ORDERER\")\n\t}\n","sourceCodeStart":337,"sourceCodeEnd":373,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L337-L373","documentation":"Like Validate, hasOURole switches on the concrete type of the Identity and only the internal *identity type supports OU-role lookup via hasOURoleInternal. Any other Identity implementation reaches the default branch and produces this (capitalized) error. It indicates the caller passed an identity object the fabric MSP does not implement.","triggerScenarios":"Calling hasOURole (via satisfiesPrincipalInternalPreV13, satisfiesPrincipalInternalV142, or postSetupV142) with a non-*identity Identity — e.g. an Idemix identity, a nil Identity, or a foreign/custom Identity implementation — while NodeOUs enforcement is enabled.","commonSituations":"Mixing Idemix and X.509 identities in one policy evaluation path that checks node roles; custom Identity wrappers used by applications or tests; a deserialization failure upstream returning a wrong-typed identity object.","solutions":["Ensure the identity passed to policy evaluation was produced by this fabric MSP's DeserializeIdentity/GetIdentityFromBytes so it is the internal *identity type","Guard against nil identities before invoking principal-satisfaction checks","Separate Idemix identities onto Idemix MSP providers and keep NodeOU role policies on X.509 identities only","Review any custom Identity implementations that might reach MSP policy code and remove or adapt them"],"exampleFix":"// before: role check on wrong identity type\nerr := mspSatisfier(idemixIdentity, clientRole) // \"Identity type not recognized\"\n\n// after: only route x509 identities from this MSP\nid, _, err := fabricMsp.DeserializeIdentity(certBytes)\nif err != nil { return err }\nerr = fabricMsp.(*bccspmsp).hasOURole(id, m.MSPRole_CLIENT)","handlingStrategy":"validation","validationCode":"func canCheckOURole(id msp.Identity) bool {\n    if id == nil { return false }\n    _, ok := id.(*identity) // internal fabric identity type\n    return ok\n}","typeGuard":"func toInternalIdentity(id msp.Identity) (*identity, bool) {\n    ident, ok := id.(*identity)\n    return ident, ok && ident != nil\n}","tryCatchPattern":"if err := hasOURoleChecked(id, m.MSPRole_PEER); err != nil {\n    if strings.Contains(err.Error(), \"Identity type not recognized\") {\n        return fmt.Errorf(\"only X.509 identities from this fabric MSP support OU roles: %w\", err)\n    }\n    return err\n}","preventionTips":["Route NodeOU role checks only for identities from the fabric MSP's own DeserializeIdentity","Exclude Idemix identities from node-role principal evaluation","Nil-check identities before principal satisfaction to avoid the default branch","Keep NodeOU policies and identity providers consistent across channel members"],"tags":["hyperledger-fabric","msp","identity","nodeous"],"backgroundTag":"identity-type-not-recognized","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}