{"record":{"id":"d58b3f5b9b7ac0ca","repo":"hyperledger/fabric","slug":"unknown-id-on-checkacl-s","errorCode":null,"errorMessage":"Unknown id on checkACL %s","messagePattern":"Unknown id on checkACL (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/defaultaclprovider.go","lineNumber":154,"sourceCode":"\t}\n\taclLogger.Debugw(\"Applying default access policy for resource\", \"channel\", channelID, \"policy\", policy, \"resource\", resName)\n\n\tswitch typedData := idinfo.(type) {\n\tcase *pb.SignedProposal:\n\t\treturn d.policyChecker.CheckPolicy(channelID, policy, typedData)\n\tcase *common.Envelope:\n\t\tsd, err := protoutil.EnvelopeAsSignedData(typedData)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn d.policyChecker.CheckPolicyBySignedData(channelID, policy, sd)\n\tcase *protoutil.SignedData:\n\t\treturn d.policyChecker.CheckPolicyBySignedData(channelID, policy, []*protoutil.SignedData{typedData})\n\tcase []*protoutil.SignedData:\n\t\treturn d.policyChecker.CheckPolicyBySignedData(channelID, policy, typedData)\n\tdefault:\n\t\taclLogger.Errorf(\"Unmapped id on checkACL %s\", resName)\n\t\treturn fmt.Errorf(\"Unknown id on checkACL %s\", resName)\n\t}\n}\n\n// CheckACLNoChannel provides default behavior by mapping channelless resources to their ACL.\nfunc (d *defaultACLProviderImpl) CheckACLNoChannel(resName string, idinfo any) error {\n\tpolicy := d.pResourcePolicyMap[resName]\n\tif policy == \"\" {\n\t\taclLogger.Errorf(\"Unmapped channelless policy for %s\", resName)\n\t\treturn fmt.Errorf(\"Unmapped channelless policy for %s\", resName)\n\t}\n\n\tswitch typedData := idinfo.(type) {\n\tcase *pb.SignedProposal:\n\t\treturn d.policyChecker.CheckPolicyNoChannel(policy, typedData)\n\tcase *common.Envelope:\n\t\tsd, err := protoutil.EnvelopeAsSignedData(typedData)\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/defaultaclprovider.go#L136-L172","documentation":"In CheckACL, after resolving a policy, the identity payload must be one of the supported types (*pb.SignedProposal, *protoutil.SignedData, or []*protoutil.SignedData). Any other type falls to the default branch and returns 'Unknown id on checkACL'. The ACL checker cannot evaluate policy against that identity representation.","triggerScenarios":"Calling CheckACL with idinfo of an unexpected type — e.g. a *common.Envelope, *msp.SerializedIdentity, or a typed nil — through a custom peer extension or system chaincode that invokes the ACL provider directly.","commonSituations":"Custom service code ported from CheckACLNoChannel (which accepts Envelope) into channel-based CheckACL; wrapper code passing context values instead of SignedProposal/SignedData.","solutions":["Pass a *pb.SignedProposal for proposal-based checks or protoutil.SignedData / []*protoutil.SignedData for pre-extracted identities.","For Envelope payloads use CheckACLNoChannel or convert the envelope into SignedData first.","Inspect the caller to ensure it isn't forwarding a raw gRPC request object as idinfo."],"exampleFix":"// before\naclProvider.CheckACL(resName, chID, envelope)\n// after\nsd := protoutil.NewSignedData(envelope.Payload, envelope.Signature, envelope.SignatureHeaderBytes? ) // or use proposal:\naclProvider.CheckACL(resName, chID, signedProposal)","handlingStrategy":"type-guard","validationCode":"switch v := idinfo.(type) {\ncase *pb.SignedProposal, *protoutil.SignedData, []*protoutil.SignedData:\n    // ok\ndefault:\n    return fmt.Errorf(\"CheckACL requires SignedProposal or SignedData, got %T\", v)\n}","typeGuard":"func isCheckableID(v any) bool {\n    switch v.(type) {\n    case *pb.SignedProposal, *protoutil.SignedData, []*protoutil.SignedData:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := aclProvider.CheckACL(resName, channelID, idinfo); err != nil {\n    if strings.HasPrefix(err.Error(), \"Unknown id on checkACL\") {\n        return fmt.Errorf(\"wrap id as SignedProposal or SignedData before ACL check: %w\", err)\n    }\n    return err\n}","preventionTips":["CheckACL (channel-based) accepts only SignedProposal/SignedData forms; convert Envelopes before calling","Use CheckACLNoChannel for Envelope-based channelless resources","Add compile-time checks at call sites so idinfo is always a supported concrete type"],"tags":["acl","policy","type-mismatch"],"backgroundTag":"unsupported-identity-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}