{"record":{"id":"c363534c1b421196","repo":"hyperledger/fabric","slug":"invalid-msproletype-it-must-be-client-peer-admi","errorCode":null,"errorMessage":"Invalid MSPRoleType. It must be CLIENT, PEER, ADMIN or ORDERER","messagePattern":"Invalid MSPRoleType\\. It must be CLIENT, PEER, ADMIN or ORDERER","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":371,"sourceCode":"\t\treturn msp.hasOURoleInternal(id, mspRole)\n\tdefault:\n\t\treturn errors.New(\"Identity type not recognized\")\n\t}\n}\n\nfunc (msp *bccspmsp) hasOURoleInternal(id *identity, mspRole m.MSPRole_MSPRoleType) error {\n\tvar nodeOU *OUIdentifier\n\tswitch mspRole {\n\tcase m.MSPRole_CLIENT:\n\t\tnodeOU = msp.clientOU\n\tcase m.MSPRole_PEER:\n\t\tnodeOU = msp.peerOU\n\tcase m.MSPRole_ADMIN:\n\t\tnodeOU = msp.adminOU\n\tcase m.MSPRole_ORDERER:\n\t\tnodeOU = msp.ordererOU\n\tdefault:\n\t\treturn errors.New(\"Invalid MSPRoleType. It must be CLIENT, PEER, ADMIN or ORDERER\")\n\t}\n\n\tif nodeOU == nil {\n\t\treturn errors.Errorf(\"cannot test for classification, node ou for type [%s], not defined, msp: [%s]\", mspRole, msp.name)\n\t}\n\n\tfor _, OU := range id.GetOrganizationalUnits() {\n\t\tif OU.OrganizationalUnitIdentifier == nodeOU.OrganizationalUnitIdentifier {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn errors.Errorf(\"The identity does not contain OU [%s], MSP: [%s]\", mspRole, msp.name)\n}\n\n// DeserializeIdentity returns an Identity given the byte-level\n// representation of a SerializedIdentity struct\nfunc (msp *bccspmsp) DeserializeIdentity(serializedID []byte) (Identity, error) {","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L353-L389","documentation":"bccspmsp.hasOURoleInternal validates an identity against a NodeOUs classification (CLIENT, PEER, ADMIN, ORDERER). This error means the caller passed an m.MSPRole value that is not one of the four supported role types, so the MSP cannot map it to a configured node OU. It is thrown from the default branch of the role switch in msp/mspimpl.go.","triggerScenarios":"Calling hasOURole/hasOURoleInternal with an MSPRole proto whose Role field is MSPRole_MEMBERS (or 0/unset, or any value outside CLIENT/PEER/ADMIN/ORDERER), typically via policy principal evaluation (satisfiesPrincipal) with a NODE_OU principal carrying an invalid role.","commonSituations":"Hand-crafted or corrupted endorsement/ACL policy definitions referencing MSPRoleType values; proto messages deserialized from a newer or older Fabric version with added role types; zero-value MSPRole enums passed programmatically when building principals.","solutions":["Set the MSPRole.Role field to one of MSPRole_CLIENT, MSPRole_PEER, MSPRole_ADMIN, or MSPRole_ORDERER before invoking policy evaluation.","If the role came from a policy config, fix the policy YAML/JSON so the node OU role is a valid value (client/peer/admin/orderer).","Check for proto zero-value (MSPRole_MEMBERS / unset) leaking from deserialization and default it explicitly to the intended role."],"exampleFix":"// before\nrole := &common.MSPRole{} // Role unset (MEMBERS/0)\npolicy.Principal = role\n// after\nrole := &common.MSPRole{Role: common.MSPRole_CLIENT}\npolicy.Principal = role","handlingStrategy":"validation","validationCode":"var validRoles = map[common.MSPRole_MSPRoleType]bool{\n  common.MSPRole_CLIENT: true,\n  common.MSPRole_PEER: true,\n  common.MSPRole_ADMIN: true,\n  common.MSPRole_ORDERER: true,\n}\nif !validRoles[role.GetRole()] {\n  return fmt.Errorf(\"unsupported MSPRoleType %v; must be CLIENT, PEER, ADMIN or ORDERER\", role.GetRole())\n}","typeGuard":"func isValidMSPRole(r common.MSPRole_MSPRoleType) bool {\n  return r == common.MSPRole_CLIENT || r == common.MSPRole_PEER ||\n    r == common.MSPRole_ADMIN || r == common.MSPRole_ORDERER\n}","tryCatchPattern":null,"preventionTips":["Never rely on proto zero-values; set MSPRole.Role explicitly when building principals.","Keep policy authoring within configtx/tooling that validates role enums.","Add a unit test asserting all NODE_OU principals use known role constants."],"tags":["msp","policy","node-ou","enum-validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}