{"record":{"id":"e06773f5c34355f1","repo":"hyperledger/fabric","slug":"the-identities-do-not-match","errorCode":null,"errorMessage":"The identities do not match","messagePattern":"The identities do not match","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":546,"sourceCode":"\t\t\t\treturn errors.Wrapf(err, \"The identity is not a [%s] under this MSP [%s]\", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)\n\t\t\t}\n\t\t\treturn nil\n\t\tdefault:\n\t\t\treturn errors.Errorf(\"invalid MSP role type %d\", int32(mspRole.Role))\n\t\t}\n\tcase m.MSPPrincipal_IDENTITY:\n\t\t// in this case we have to deserialize the principal's identity\n\t\t// and compare it byte-by-byte with our cert\n\t\tprincipalId, err := msp.DeserializeIdentity(principal.Principal)\n\t\tif err != nil {\n\t\t\treturn errors.WithMessage(err, \"invalid identity principal, not a certificate\")\n\t\t}\n\n\t\tif bytes.Equal(id.(*identity).cert.Raw, principalId.(*identity).cert.Raw) {\n\t\t\treturn principalId.Validate()\n\t\t}\n\n\t\treturn errors.New(\"The identities do not match\")\n\tcase m.MSPPrincipal_ORGANIZATION_UNIT:\n\t\t// Principal contains the OrganizationUnit\n\t\tOU := &m.OrganizationUnit{}\n\t\terr := proto.Unmarshal(principal.Principal, OU)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not unmarshal OrganizationUnit from principal\")\n\t\t}\n\n\t\t// at first, we check whether the MSP\n\t\t// identifier is the same as that of the identity\n\t\tif OU.MspIdentifier != msp.name {\n\t\t\treturn errors.Errorf(\"the identity is a member of a different MSP (expected %s, got %s)\", OU.MspIdentifier, id.GetMSPIdentifier())\n\t\t}\n\n\t\t// we then check if the identity is valid with this MSP\n\t\t// and fail if it is not\n\t\terr = msp.Validate(id)\n\t\tif err != nil {","sourceCodeStart":528,"sourceCodeEnd":564,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L528-L564","documentation":"Thrown when a policy principal of classification IDENTITY is being satisfied: the principal's certificate bytes were deserialized successfully, but they differ byte-for-byte from the raw certificate of the identity being checked. The library requires an exact certificate match for identity principals; there is no partial or alias matching.","triggerScenarios":"Calling policy evaluation (e.g. policy.Manager Evaluate / satisfiesPrincipal) where principal.PrincipalClassification == MSPPrincipal_IDENTITY and the signer's cert does not equal the cert embedded in the principal, e.g. signing with a different admin cert than the one named in the policy.","commonSituations":"Signed proposals rejected because the client enrolled with a non-admin cert while the policy pins the admin identity; rotated certificates so the policy's embedded cert no longer equals the current signer; using the TLS cert instead of the enrollment/signing cert.","solutions":["Sign/submit the operation with the exact identity whose certificate is embedded in the policy principal","Update the policy's IDENTITY principal bytes to the current signer's cert if the identity was rotated","Verify you are using the enrollment (signing) certificate, not the TLS certificate","Check that no intermediate transformation (PEM vs DER) changed the principal's cert bytes"],"exampleFix":"// before: policy pins admin cert, client signs with ordinary member cert\npolicy := &msp.MSPPrincipal{PrincipalClassification: msp.MSPPrincipal_IDENTITY, Principal: adminCertBytes}\n// after: sign with the identity matching the pinned cert\nsigner, _ := msp.DeserializeIdentity(adminCertBytes); signature, _ := signer.Sign(msg)","handlingStrategy":"validation","validationCode":"principalId, err := msp.DeserializeIdentity(principal.Principal)\nif err != nil {\n\treturn fmt.Errorf(\"principal is not a valid certificate: %w\", err)\n}\nif !bytes.Equal(signerCertRaw, principal.(*msp.identity).Cert().Raw) {\n\treturn fmt.Errorf(\"signer %x does not match principal pinned in policy\", signerCertRaw)\n}","typeGuard":"func isIdentityPrincipal(p *msp.MSPPrincipal, id msp.Identity) bool {\n\tif p.PrincipalClassification != msp.MSPPrincipal_IDENTITY {\n\t\treturn false\n\t}\n\treturn bytes.Equal(id.(*msp.identity).Cert().Raw, p.Principal)\n}","tryCatchPattern":"err := policy.Evaluate(sd)\nif err != nil && strings.Contains(err.Error(), \"The identities do not match\") {\n\t// wrong signer: re-sign with the identity whose cert the policy pins\n}","preventionTips":["Pin identities in policies by extracting the cert from the same enrollment you will sign with","Never confuse TLS certs with enrollment/signing certs","Re-sign with the pinned identity or update the policy when certificates are rotated"],"tags":["msp","identity","policy","x509"],"backgroundTag":"identity-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}