{"record":{"id":"af0bfab0b9a729a4","repo":"ramsey/uuid","slug":"a-local-identifier-must-be-provided-for-the-org-do","errorCode":null,"errorMessage":"A local identifier must be provided for the org domain","messagePattern":"A local identifier must be provided for the org domain","errorType":"exception","errorClass":"DceSecurityException","httpStatus":null,"severity":"error","filePath":"src/Generator/DceSecurityGenerator.php","lineNumber":85,"sourceCode":"    ): string {\n        if (!in_array($localDomain, self::DOMAINS)) {\n            throw new DceSecurityException('Local domain must be a valid DCE Security domain');\n        }\n\n        if ($localIdentifier && $localIdentifier->isNegative()) {\n            throw new DceSecurityException(\n                'Local identifier out of bounds; it must be a value between 0 and 4294967295',\n            );\n        }\n\n        if ($clockSeq > self::CLOCK_SEQ_HIGH || $clockSeq < self::CLOCK_SEQ_LOW) {\n            throw new DceSecurityException('Clock sequence out of bounds; it must be a value between 0 and 63');\n        }\n\n        switch ($localDomain) {\n            case Uuid::DCE_DOMAIN_ORG:\n                if ($localIdentifier === null) {\n                    throw new DceSecurityException('A local identifier must be provided for the org domain');\n                }\n\n                break;\n            case Uuid::DCE_DOMAIN_PERSON:\n                if ($localIdentifier === null) {\n                    $localIdentifier = $this->dceSecurityProvider->getUid();\n                }\n\n                break;\n            case Uuid::DCE_DOMAIN_GROUP:\n            default:\n                if ($localIdentifier === null) {\n                    $localIdentifier = $this->dceSecurityProvider->getGid();\n                }\n\n                break;\n        }\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/ramsey/uuid/blob/da5b521600a707d2dd097598464bd3090de850f5/src/Generator/DceSecurityGenerator.php#L67-L103","documentation":"DceSecurityGenerator can auto-derive the local identifier only for the person domain (via the DCE security provider's getUid()) and the group domain (getGid()); there is no system source for the org domain, so generate() throws DceSecurityException when $localIdentifier is null for DCE_DOMAIN_ORG.","triggerScenarios":"Uuid::uuid2(Uuid::DCE_DOMAIN_ORG) with no second argument; org-domain generation where the caller assumed uid/gid-style defaults apply.","commonSituations":"Switching a codebase from person to org domain UUIDs without adding an identifier; wrappers that always omit the identifier; running in an environment (container) where devs assumed everything auto-derives.","solutions":["Pass an explicit identifier for the org domain: Uuid::uuid2(Uuid::DCE_DOMAIN_ORG, new Integer($orgId)).","If you do not have a real org identifier, use the person or group domain, which default to the provider's uid/gid.","Supply a custom DceSecurityProviderInterface only if you can derive org ids yourself - the built-in provider still cannot."],"exampleFix":"// before\n$uuid = Uuid::uuid2(Uuid::DCE_DOMAIN_ORG); // DceSecurityException\n\n// after\n$uuid = Uuid::uuid2(Uuid::DCE_DOMAIN_ORG, new Integer(1337));","handlingStrategy":"validation","validationCode":"$identifier = $localDomain === Uuid::DCE_DOMAIN_ORG\n    ? new Integer($orgId ?? throw new InvalidArgumentException('org domain requires an explicit local identifier'))\n    : ($localId !== null ? new Integer($localId) : null);\n\n$uuid = Uuid::uuid2($localDomain, $identifier);","typeGuard":"function hasRequiredDceIdentifier(int $localDomain, ?\\Ramsey\\Uuid\\Type\\Integer $identifier): bool\n{\n    return $identifier !== null || $localDomain !== Uuid::DCE_DOMAIN_ORG;\n}","tryCatchPattern":"try {\n    $uuid = Uuid::uuid2(Uuid::DCE_DOMAIN_ORG);\n} catch (\\Ramsey\\Uuid\\Exception\\DceSecurityException $e) {\n    // no system source for org ids - require one from the caller\n    throw new InvalidConfigurationException('org domain needs an explicit identifier', $e);\n}","preventionTips":["Treat the local identifier as required whenever the domain is ORG.","Only person/group auto-derive (uid/gid via the DCE security provider).","Validate (domain, identifier) pairs together in one wrapper around uuid2().","Document the asymmetry in code that configures v2 UUID generation."],"tags":["php","ramsey-uuid","dce-security","uuid-v2","org-domain","missing-argument"],"backgroundTag":"missing-required-parameter","analyzedSha":"da5b521600a707d2dd097598464bd3090de850f5","analyzedAt":"2026-08-21T01:35:29.252Z","schemaVersion":2},"datasetVersion":"2026-08-21T03:17:12.404Z"}