{"record":{"id":"9162bafdde5b88be","repo":"hyperledger/fabric","slug":"failed-setting-up-nodeous-clientou-must-be-differ","errorCode":null,"errorMessage":"Failed setting up NodeOUs. ClientOU must be different from nil.","messagePattern":"Failed setting up NodeOUs\\. ClientOU must be different from nil\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplsetup.go","lineNumber":290,"sourceCode":"\t\t\treturn errors.WithMessagef(err, \"failed getting validation chain, (SN: %s)\", id.(*identity).cert.SerialNumber)\n\t\t}\n\n\t\t// Recall chain[0] is id.(*identity).id so it does not count as a parent\n\t\tfor i := 1; i < len(chain); i++ {\n\t\t\tmsp.certificationTreeInternalNodesMap[string(chain[i].Raw)] = true\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) setupNodeOUs(config *m.FabricMSPConfig) error {\n\tif config.FabricNodeOus != nil {\n\n\t\tmsp.ouEnforcement = config.FabricNodeOus.Enable\n\n\t\tif config.FabricNodeOus.ClientOuIdentifier == nil || len(config.FabricNodeOus.ClientOuIdentifier.OrganizationalUnitIdentifier) == 0 {\n\t\t\treturn errors.New(\"Failed setting up NodeOUs. ClientOU must be different from nil.\")\n\t\t}\n\n\t\tif config.FabricNodeOus.PeerOuIdentifier == nil || len(config.FabricNodeOus.PeerOuIdentifier.OrganizationalUnitIdentifier) == 0 {\n\t\t\treturn errors.New(\"Failed setting up NodeOUs. PeerOU must be different from nil.\")\n\t\t}\n\n\t\t// ClientOU\n\t\tmsp.clientOU = &OUIdentifier{OrganizationalUnitIdentifier: config.FabricNodeOus.ClientOuIdentifier.OrganizationalUnitIdentifier}\n\t\tif len(config.FabricNodeOus.ClientOuIdentifier.Certificate) != 0 {\n\t\t\tcertifiersIdentifier, err := msp.getCertifiersIdentifier(config.FabricNodeOus.ClientOuIdentifier.Certificate)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tmsp.clientOU.CertifiersIdentifier = certifiersIdentifier\n\t\t}\n\n\t\t// PeerOU\n\t\tmsp.peerOU = &OUIdentifier{OrganizationalUnitIdentifier: config.FabricNodeOus.PeerOuIdentifier.OrganizationalUnitIdentifier}","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L272-L308","documentation":"setupNodeOUs (V1.1 NodeOU setup path) requires that when FabricNodeOus is configured, the ClientOU identifier is present and non-empty. A nil ClientOuIdentifier or empty OrganizationalUnitIdentifier makes client OU enforcement impossible, so setup fails.","triggerScenarios":"config.FabricNodeOus is non-nil but ClientOuIdentifier is nil or its OrganizationalUnitIdentifier is an empty string, when the MSP is set up via setupV11.","commonSituations":"configtx.yaml NodeOUs block enabled but ClientOUIdentifier omitted; empty OU field after YAML editing; NodeOUs config carried over from older Fabric versions where only some OU identifiers were defined.","solutions":["Set FabricNodeOus.ClientOuIdentifier with a non-empty OrganizationalUnitIdentifier and certificate","Complete the NodeOUs section: ClientOU, PeerOU (and AdminOU/OrdererOU on newer versions)","Regenerate the NodeOUs config with configtxgen after fixing configtx.yaml","If OU enforcement is not desired, remove/nil the FabricNodeOus section entirely rather than partially filling it"],"exampleFix":"// before\n// FabricNodeOus:\n//   Enable: true\n// after\n// FabricNodeOus:\n//   Enable: true\n//   ClientOUIdentifier:\n//     OrganizationalUnitIdentifier: client\n//     Certificate: cacerts/ca.pem\nnull","handlingStrategy":"validation","validationCode":"if conf.FabricNodeOus != nil {\n    if conf.FabricNodeOus.ClientOuIdentifier == nil ||\n        len(conf.FabricNodeOus.ClientOuIdentifier.OrganizationalUnitIdentifier) == 0 {\n        return errors.New(\"ClientOuIdentifier must be set when NodeOUs config is present\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When enabling NodeOUs, fill in all required OU identifiers (client, peer, and admin/orderer per version)","Run configtxgen to validate configtx.yaml before deploying","Remove the FabricNodeOus section entirely if OU enforcement is not intended"],"tags":["msp-setup","nodeous","config-validation","hyperledger-fabric"],"backgroundTag":"missing-nodeou-identifier","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}