{"record":{"id":"910937864a485864","repo":"hyperledger/fabric","slug":"invalid-principal-type-d","errorCode":null,"errorMessage":"invalid principal type %d","messagePattern":"invalid principal type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":454,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tfor _, principal := range principals {\n\t\terr = msp.internalSatisfiesPrincipalInternalFunc(id, principal)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\n// collectPrincipals collects principals from combined principals into a single MSPPrincipal slice.\nfunc collectPrincipals(principal *m.MSPPrincipal, mspVersion MSPVersion) ([]*m.MSPPrincipal, error) {\n\tswitch principal.PrincipalClassification {\n\tcase m.MSPPrincipal_COMBINED:\n\t\t// Combined principals are not supported in MSP v1.0 or v1.1\n\t\tif mspVersion <= MSPv1_1 {\n\t\t\treturn nil, errors.Errorf(\"invalid principal type %d\", int32(principal.PrincipalClassification))\n\t\t}\n\t\t// Principal is a combination of multiple principals.\n\t\tprincipals := &m.CombinedPrincipal{}\n\t\terr := proto.Unmarshal(principal.Principal, principals)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"could not unmarshal CombinedPrincipal from principal\")\n\t\t}\n\t\t// Return an error if there are no principals in the combined principal.\n\t\tif len(principals.Principals) == 0 {\n\t\t\treturn nil, errors.New(\"No principals in CombinedPrincipal\")\n\t\t}\n\t\t// Recursively call msp.collectPrincipals for all combined principals.\n\t\t// There is no limit for the levels of nesting for the combined principals.\n\t\tvar principalsSlice []*m.MSPPrincipal\n\t\tfor _, cp := range principals.Principals {\n\t\t\tinternalSlice, err := collectPrincipals(cp, mspVersion)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L436-L472","documentation":"collectPrincipals rejects MSPPrincipal values classified as COMBINED when the MSP version is v1.0 or v1.1, with 'invalid principal type %d' reporting the numeric classification. Combined principals (MSPv1_3+) allow nesting multiple principals into an AND-group, and older MSP versions explicitly do not understand them.","triggerScenarios":"Calling SatisfiesPrincipal (or any policy evaluation path that calls collectPrincipals) against an MSPPrincipal with PrincipalClassification=MSPPrincipal_COMBINED while the MSP's version is MSPv1_0 or MSPv1_1. Also produced directly by unit tests TestCollectEmptyCombinedPrincipal and TestCollectPrincipalContainingEmptyCombinedPrincipal which assert this rejection.","commonSituations":"Channel/application config still at MSP v1.1 (set via configtx Channel capabilities / MSPVersion) while an endorsement or ACL policy was authored with a combined principal; upgrading policies without upgrading channel capabilities to V1_3 or later.","solutions":["Enable the V1_3 (or later) channel capability and update the MSP version so combined principals are accepted","Rewrite the policy to avoid MSPPrincipal_COMBINED: use implicit meta policies or express the logic as a signature policy tree instead","If rejection is intended, nothing to fix — the error is the guard against using v1.3 features on an older MSP"],"exampleFix":"// before (channel config)\nCapabilities:\n  Channel: {V1_1: true}   # combined principals rejected\n// after\nCapabilities:\n  Channel: {V1_3: true}   # MSPv1_3, combined principals supported","handlingStrategy":"validation","validationCode":"func combinedPrincipalsSupported(version msp.MSPVersion) bool {\n    return version > msp.MSPv1_1 // e.g. MSPv1_3\n}\n// before evaluating a policy, check principal.PrincipalClassification != m.MSPPrincipal_COMBINED || combinedPrincipalsSupported(mspVersion)","typeGuard":"func isCombinedPrincipal(p *m.MSPPrincipal) bool {\n    return p != nil && p.PrincipalClassification == m.MSPPrincipal_COMBINED\n}","tryCatchPattern":"principals, err := msp.SatisfiesPrincipal(id, principal)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid principal type\") {\n        // COMBINED principal on an MSP <= v1.1; upgrade MSP version or rewrite policy\n    }\n    return err\n}","preventionTips":["Keep policy features aligned with channel capabilities: combined principals require V1_3+ capability / MSPv1_3","Prefer implicit meta policies or signature policy trees when targeting older MSP versions","Audit all channel/application configs for MSP version before deploying v1.3-era policies","Test policy evaluation against the exact MSP version configured in production"],"tags":["policy","principal","msp-version","hyperledger-fabric","policies"],"backgroundTag":"unsupported-principal-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}