{"record":{"id":"9805f1311cb36e71","repo":"hyperledger/fabric","slug":"satisfiesprincipalinternal-shall-not-be-called-wit","errorCode":null,"errorMessage":"SatisfiesPrincipalInternal shall not be called with a CombinedPrincipal","messagePattern":"SatisfiesPrincipalInternal shall not be called with a CombinedPrincipal","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":590,"sourceCode":"\t\t\t\treturn nil\n\t\t\t}\n\t\t}\n\n\t\t// if we are here, no match was found, return an error\n\t\treturn errors.New(\"The identities do not match\")\n\tdefault:\n\t\treturn errors.Errorf(\"invalid principal type %d\", int32(principal.PrincipalClassification))\n\t}\n}\n\n// satisfiesPrincipalInternalV13 takes as arguments the identity and the principal.\n// The function returns an error if one occurred.\n// The function implements the additional behavior expected of an MSP starting from v1.3.\n// For pre-v1.3 functionality, the function calls the satisfiesPrincipalInternalPreV13.\nfunc (msp *bccspmsp) satisfiesPrincipalInternalV13(id Identity, principal *m.MSPPrincipal) error {\n\tswitch principal.PrincipalClassification {\n\tcase m.MSPPrincipal_COMBINED:\n\t\treturn errors.New(\"SatisfiesPrincipalInternal shall not be called with a CombinedPrincipal\")\n\tcase m.MSPPrincipal_ANONYMITY:\n\t\tanon := &m.MSPIdentityAnonymity{}\n\t\terr := proto.Unmarshal(principal.Principal, anon)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not unmarshal MSPIdentityAnonymity from principal\")\n\t\t}\n\t\tswitch anon.AnonymityType {\n\t\tcase m.MSPIdentityAnonymity_ANONYMOUS:\n\t\t\treturn errors.New(\"Principal is anonymous, but X.509 MSP does not support anonymous identities\")\n\t\tcase m.MSPIdentityAnonymity_NOMINAL:\n\t\t\treturn nil\n\t\tdefault:\n\t\t\treturn errors.Errorf(\"Unknown principal anonymity type: %d\", anon.AnonymityType)\n\t\t}\n\n\tdefault:\n\t\t// Use the pre-v1.3 function to check other principal types\n\t\treturn msp.satisfiesPrincipalInternalPreV13(id, principal)","sourceCodeStart":572,"sourceCodeEnd":608,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L572-L608","documentation":"satisfiesPrincipalInternalV13 in msp/mspimpl.go refuses to evaluate an MSPPrincipal with classification COMBINED. Combined principals must be broken apart and each component evaluated by the appropriate inner MSP, so calling this single-MSP method with one is a programming error by the caller, not a property of the identity.","triggerScenarios":"Calling identity.SatisfiesPrincipal on a bccspmsp identity with a principal whose PrincipalClassification is m.MSPPrincipal_COMBINED; a caller that did not pre-split a combined principal into its nested sub-principals.","commonSituations":"Application code builds a combined (nested OR/AND) principal for endorsement policy but hands it straight to one MSP instead of using the combined-principal evaluation helper; copying policy code from newer fabric versions into a v1.3-era code path.","solutions":["Unwrap the combined principal and evaluate each of its sub-principals against the appropriate MSPs, combining results with the intended AND/OR logic.","Use the top-level policy/ACL evaluation entry point (e.g. policy evaluation via a PrincipalSet/policy provider) instead of calling a single MSP's satisfiesPrincipalInternal with a combined principal.","If you only intended a single-MSP check, change the principal to ROLE/ANONYMITY classification instead of COMBINED."],"exampleFix":"// before\nerr := identity.SatisfiesPrincipal(combinedPrincipal)\n// after\nfor _, sub := range combinedSubPrincipals {\n    if err := identity.SatisfiesPrincipal(sub); err == nil { break }\n}","handlingStrategy":"type-guard","validationCode":"if principal.PrincipalClassification == m.MSPPrincipal_COMBINED {\n\t// split into sub-principals and evaluate each against its MSP first\n}","typeGuard":"func isCombinedPrincipal(p *m.MSPPrincipal) bool {\n\treturn p != nil && p.PrincipalClassification == m.MSPPrincipal_COMBINED\n}","tryCatchPattern":null,"preventionTips":["Route combined principals to the policy-level evaluator, not single-MSP SatisfiesPrincipal.","Add an assertion early in policy code that combined principals are unwrapped before MSP evaluation."],"tags":["msp","policy","combined-principal","x509"],"backgroundTag":"invalid-principal-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}