{"record":{"id":"c871b632b95c461e","repo":"hyperledger/fabric","slug":"the-identity-must-be-a-client-or-a-peer-identity-t","errorCode":null,"errorMessage":"the identity must be a client or a peer identity to be valid, not a combination of them. OUs: %s, MSP: [%s]","messagePattern":"the identity must be a client or a peer identity to be valid, not a combination of them\\. OUs: (.+?), MSP: \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":228,"sourceCode":"\t\t}\n\n\t\t// Yes. Then, enforce the certifiers identifier is this is specified.\n\t\t// It is not specified, it means that any certification path is fine.\n\t\tif len(nodeOU.CertifiersIdentifier) != 0 && !bytes.Equal(nodeOU.CertifiersIdentifier, OU.CertifiersIdentifier) {\n\t\t\treturn errors.Errorf(\"certifiersIdentifier does not match: %v, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t\t}\n\t\tcounter++\n\t\tif counter > 1 {\n\t\t\tbreak\n\t\t}\n\t}\n\n\t// the identity should have exactly one OU role, return an error if the counter is not 1.\n\tif counter == 0 {\n\t\treturn errors.Errorf(\"the identity does not have an OU that resolves to client or peer. OUs: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t}\n\tif counter > 1 {\n\t\treturn errors.Errorf(\"the identity must be a client or a peer identity to be valid, not a combination of them. OUs: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) validateIdentityOUsV142(id *identity) error {\n\t// Run the same checks as per V1\n\terr := msp.validateIdentityOUsV1(id)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// -- Check for OU enforcement\n\tif !msp.ouEnforcement {\n\t\t// No enforcement required\n\t\treturn nil\n\t}\n","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L210-L246","documentation":"The identity has more than one OU that resolves to a client/peer role, so Fabric cannot assign it a single unambiguous role. validateIdentityOUsV11 requires exactly one matching role OU and rejects combinations (e.g. a certificate containing both 'client' and 'peer' OUs that match configured identifiers).","triggerScenarios":"msp.Validate(identity) where multiple of id.GetOrganizationalUnits() match both ClientOUIdentifier and PeerOUIdentifier (or two OUs matching the same identifier class), incrementing counter past 1.","commonSituations":"Certificate issued with multiple OU RDNs (e.g. OU=client, OU=peer) by mistake; MSP config where client and peer identifiers use the same OrganizationalUnitIdentifier; duplicate OU entries in NodeOUs.","solutions":["Reissue the certificate with exactly one role OU","Ensure ClientOUIdentifier and PeerOUIdentifier have distinct OrganizationalUnitIdentifier values","Remove duplicate role OUs from the certificate subject"],"exampleFix":"// before: cert subject CN=x, OU=client, OU=peer\nOU=client, OU=peer\n// after\nOU=client","handlingStrategy":"validation","validationCode":"func singleRoleOU(cert *x509.Certificate, allowed map[string]struct{}) int {\n    n := 0\n    for _, ou := range cert.Subject.OU {\n        if _, ok := allowed[ou]; ok { n++ }\n    }\n    return n\n}\n// n != 1 means the identity will be rejected (0: no role, >1: ambiguous).","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Issue certificates with exactly one role OU in the subject","Keep ClientOUIdentifier and PeerOUIdentifier distinct","Review CSR subjects before signing"],"tags":["fabric","msp","x509"],"backgroundTag":"msp-ou-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}