{"record":{"id":"b1265415dce6f500","repo":"hyperledger/fabric","slug":"failed-getting-local-msp-principal-during-channell","errorCode":null,"errorMessage":"Failed getting local MSP principal during channelless check policy with policy [%s]: [%s]","messagePattern":"Failed getting local MSP principal during channelless check policy with policy \\[(.+?)\\]: \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/policy/policy.go","lineNumber":141,"sourceCode":"\t\treturn fmt.Errorf(\"Failing extracting header during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\tshdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Invalid Proposal's SignatureHeader during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Deserialize proposal's creator with the local MSP\n\tid, err := p.localMSP.DeserializeIdentity(shdr.Creator)\n\tif err != nil {\n\t\tlogger.Warnw(\"Failed deserializing proposal creator during channelless check policy\", \"error\", err, \"policyName\", policyName, \"identity\", protoutil.LogMessageForSerializedIdentity(shdr.Creator))\n\t\treturn fmt.Errorf(\"Failed deserializing proposal creator during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Load MSPPrincipal for policy\n\tprincipal, err := p.principalGetter.Get(policyName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed getting local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Verify that proposal's creator satisfies the principal\n\terr = id.SatisfiesPrincipal(principal)\n\tif err != nil {\n\t\tlogger.Warnw(\"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy\", \"error\", err, \"policyName\", policyName, \"requiredPrincipal\", principal, \"signingIdentity\", protoutil.LogMessageForSerializedIdentity(shdr.Creator))\n\t\treturn fmt.Errorf(\"Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [%s]: [%s]\", policyName, err)\n\t}\n\n\t// Verify the signature\n\treturn id.Verify(signedProp.ProposalBytes, signedProp.Signature)\n}\n\n// CheckPolicyBySignedData checks that the passed signed data is valid with the respect to\n// passed policy on the passed channel.\nfunc (p *policyChecker) CheckPolicyBySignedData(channelID, policyName string, sd []*protoutil.SignedData) error {\n\tif channelID == \"\" {\n\t\treturn errors.New(\"Invalid channel ID name during check policy on signed data. Name must be different from nil.\")","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/policy/policy.go#L123-L159","documentation":"p.principalGetter.Get(policyName) failed while loading the MSPPrincipal needed to evaluate the channelless (local) policy. The principal getter resolves a policy name into an MSPPrincipal for the peer's local MSP; failure means the requested principal does not exist in the local MSP configuration, so the policy cannot be evaluated.","triggerScenarios":"Calling CheckPolicy with a policyName the local MSP principal getter doesn't recognize (e.g. 'Admins'/'Members'/'Client'/'Peer' misspelled or unsupported by the configured local MSP, or requesting an OU/role the local MSP config doesn't define).","commonSituations":"Mistyped policy names in code or configuration using the local/channelless policy path; Fabric version differences in supported principal classes (e.g. NodeRole names); local MSP config.yaml missing the OU/role declaration the code requests.","solutions":["Use an exact, supported principal name ('Admins', 'Members', 'Client', 'Peer', 'Orderer') matching the local MSP's config.","Inspect the peer's local MSP directory (msp/config.yaml) and ensure the OU/role you request is declared.","Update the client code to the principal names supported by the running Fabric version.","If a custom principal is needed, configure the local MSP accordingly or use a channel policy instead of the channelless check."],"exampleFix":"// before: unsupported name\nerr := policyMgr.CheckPolicyNoChannel(\"ADMIN\", signedProp)\n\n// after: exact MSP principal role\nerr := policyMgr.CheckPolicyNoChannel(\"Admins\", signedProp)","handlingStrategy":"validation","validationCode":"var supportedPrincipals = map[string]bool{\"Admins\": true, \"Members\": true, \"Client\": true, \"Peer\": true, \"Orderer\": true}\nif !supportedPrincipals[policyName] {\n    return fmt.Errorf(\"policy %q is not a known local MSP principal\", policyName)\n}","typeGuard":"func isKnownMSPPrincipal(name string) bool {\n    switch name {\n    case \"Admins\", \"Members\", \"Client\", \"Peer\", \"Orderer\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"err := policyMgr.CheckPolicy(policyName, signedProp)\nif err != nil && strings.Contains(err.Error(), \"Failed getting local MSP principal\") {\n    // fall back to a known principal name or surface a config error to the operator\n}","preventionTips":["Use exact principal role names from the Fabric MSP spec","Verify the peer's local MSP config.yaml declares the OU/roles your code requests","Check Fabric release notes for principal/NodeRole naming changes before upgrading","Centralize policy name constants instead of hardcoding strings at call sites"],"tags":["hyperledger-fabric","msp","policy"],"backgroundTag":"msp-principal-not-found","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}