{"record":{"id":"d5a1ffb6888629ed","repo":"hyperledger/fabric","slug":"the-identity-is-a-member-of-a-different-msp-expec","errorCode":null,"errorMessage":"the identity is a member of a different MSP (expected %s, got %s)","messagePattern":"the identity is a member of a different MSP \\(expected (.+?), got (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":501,"sourceCode":"// satisfiesPrincipalInternalPreV13 takes as arguments the identity and the principal.\n// The function returns an error if one occurred.\n// The function implements the behavior of an MSP up to and including v1.1.\nfunc (msp *bccspmsp) satisfiesPrincipalInternalPreV13(id Identity, principal *m.MSPPrincipal) error {\n\tswitch principal.PrincipalClassification {\n\t// in this case, we have to check whether the\n\t// identity has a role in the msp - member or admin\n\tcase m.MSPPrincipal_ROLE:\n\t\t// Principal contains the msp role\n\t\tmspRole := &m.MSPRole{}\n\t\terr := proto.Unmarshal(principal.Principal, mspRole)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not unmarshal MSPRole from principal\")\n\t\t}\n\n\t\t// at first, we check whether the MSP\n\t\t// identifier is the same as that of the identity\n\t\tif mspRole.MspIdentifier != msp.name {\n\t\t\treturn errors.Errorf(\"the identity is a member of a different MSP (expected %s, got %s)\", mspRole.MspIdentifier, id.GetMSPIdentifier())\n\t\t}\n\n\t\t// now we validate the different msp roles\n\t\tswitch mspRole.Role {\n\t\tcase m.MSPRole_MEMBER:\n\t\t\t// in the case of member, we simply check\n\t\t\t// whether this identity is valid for the MSP\n\t\t\tmspLogger.Debugf(\"Checking if identity satisfies MEMBER role for %s\", msp.name)\n\t\t\treturn msp.Validate(id)\n\t\tcase m.MSPRole_ADMIN:\n\t\t\tmspLogger.Debugf(\"Checking if identity satisfies ADMIN role for %s\", msp.name)\n\t\t\t// in the case of admin, we check that the\n\t\t\t// id is exactly one of our admins\n\t\t\tif msp.isInAdmins(id.(*identity)) {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn errors.New(\"This identity is not an admin\")\n\t\tcase m.MSPRole_CLIENT:","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L483-L519","documentation":"Raised when checking a MSPPrincipal_ROLE principal: the principal's MSPRole.MspIdentifier does not match the name of the MSP performing the check (msp.name). The identity may belong to a different organization's MSP than the one the principal references, so the principal can never be satisfied by this MSP and evaluation fails with the expected/got MSP identifiers in the message.","triggerScenarios":"A policy principal names MSP 'Org1MSP' but the identity being validated resolves to 'Org2MSP' (id.GetMSPIdentifier() differs), during endorsement checks, ACL enforcement, or identity/chaincode policy evaluation.","commonSituations":"Typo in the MSP ID inside a signature policy; policy written against the wrong organization; channel config where the MSP ID differs from what clients use (e.g. case mismatch); using an identity from the wrong org to sign/endorse; renamed organizations in configtx without updating policies.","solutions":["Compare the 'expected' and 'got' MSP IDs in the message and use an identity issued by the MSP the policy actually references.","Fix the policy principal to reference the correct MspIdentifier (decode/encode with configtxlator if it's channel config).","Verify channel configtx 'Organization' MSP IDs match the values used in policies and by fabric-ca when enrolling identities.","Ensure the correct signing identity/wallet is being used by the client SDK for endorsement."],"exampleFix":"// before: wrong org in policy principal\n&MSPRole{MspIdentifier: \"Org1MSP\", Role: MSPRole_MEMBER} // identity is from Org2MSP\n\n// after: policy principal matches the signer's MSP\n&MSPRole{MspIdentifier: \"Org2MSP\", Role: MSPRole_MEMBER}","handlingStrategy":"validation","validationCode":"// confirm signer MSP matches the policy principal before submitting\nfunc mspMatches(principalMSP string, id fabric.Identity) bool {\n\treturn principalMSP == id.GetMSPIdentifier()\n}","typeGuard":"func sameMSP(principal *msp.MSPRole, id msp.Identity) bool {\n\treturn principal.MspIdentifier == id.GetMSPIdentifier()\n}","tryCatchPattern":"err := policy.Evaluate(id)\nif err != nil && strings.Contains(err.Error(), \"different MSP\") {\n\treturn fmt.Errorf(\"wrong identity for policy: need MSP %s, have %s — switch wallet identity\", expected, got)\n}","preventionTips":["Keep MSP IDs in configtx, fabric-ca and SDK code in one shared constant/config file.","Verify MSP ID case-sensitivity — IDs are case-sensitive.","When renaming orgs, update all signature policies via config update.","Pick the wallet identity matching the org the policy targets before endorsement."],"tags":["hyperledger-fabric","msp","policy","organization"],"backgroundTag":"msp-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}