{"record":{"id":"ed7e9c2d49ec72da","repo":"hyperledger/fabric","slug":"invalid-identity-type-expected-identity","errorCode":null,"errorMessage":"invalid identity type, expected *identity","messagePattern":"invalid identity type, expected \\*identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":619,"sourceCode":"\t\t\treturn nil\n\t\tdefault:\n\t\t\treturn errors.Errorf(\"Unknown principal anonymity type: %d\", anon.AnonymityType)\n\t\t}\n\n\tdefault:\n\t\t// Use the pre-v1.3 function to check other principal types\n\t\treturn msp.satisfiesPrincipalInternalPreV13(id, principal)\n\t}\n}\n\n// satisfiesPrincipalInternalV142 takes as arguments the identity and the principal.\n// The function returns an error if one occurred.\n// The function implements the additional behavior expected of an MSP starting from v2.0.\n// For v1.3 functionality, the function calls the satisfiesPrincipalInternalPreV13.\nfunc (msp *bccspmsp) satisfiesPrincipalInternalV142(id Identity, principal *m.MSPPrincipal) error {\n\t_, okay := id.(*identity)\n\tif !okay {\n\t\treturn errors.New(\"invalid identity type, expected *identity\")\n\t}\n\n\tswitch principal.PrincipalClassification {\n\tcase m.MSPPrincipal_ROLE:\n\t\tif !msp.ouEnforcement {\n\t\t\tbreak\n\t\t}\n\n\t\t// Principal contains the msp role\n\t\tmspRole := &m.MSPRole{}\n\t\terr := proto.Unmarshal(principal.Principal, mspRole)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not unmarshal MSPRole from principal\")\n\t\t}\n\n\t\t// at first, we check whether the MSP\n\t\t// identifier is the same as that of the identity\n\t\tif mspRole.MspIdentifier != msp.name {","sourceCodeStart":601,"sourceCodeEnd":637,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L601-L637","documentation":"satisfiesPrincipalInternalV142 implements v2.0+ principal-satisfaction behavior for a bccspmsp. Before evaluating the principal it asserts that the passed Identity is the concrete internal type *identity; if the caller supplied any other implementation of the Identity interface (e.g. a mock, a wrapped identity, or a foreign MSP's implementation), the type assertion fails and this error is returned. It is an internal-invariant error, not something a correct caller should ever produce.","triggerScenarios":"Calling msp.SatisfiesPrincipal (or the internal v142 path) with an Identity value that is not the unexported *identity struct returned by this MSP's own methods — for example an identity deserialized/created by a different MSP manager, a test mock implementing fabric.Identity, or a nil/wrong pointer type.","commonSituations":"Unit tests passing mock identities into SatisfiesPrincipal; mixing identities produced by one MSP provider with another MSP's principal evaluation; wiring a custom identity implementation; accidentally passing an *identitydata or wrapper struct instead of the identity itself.","solutions":["Obtain the identity from the same MSP (msp.DeserializeIdentity, msp.GetIdentityFromConf, etc.) so it is the concrete *identity type","In tests, replace mock Identity types with real identities built via msp.New with valid provider and cert PEM bytes","Verify the identity was not wrapped or re-created by another layer before being passed to SatisfiesPrincipal","If you need cross-MSP evaluation, call SatisfiesPrincipal on the MSP that owns the identity"],"exampleFix":"// before\nvar id fabric.Identity = myMockIdentity()\nerr := msp.SatisfiesPrincipal(id, principal)\n// after\nid, err := msp.DeserializeIdentity(certPEM)\nif err != nil { return err }\nerr = msp.SatisfiesPrincipal(id, principal)","handlingStrategy":"type-guard","validationCode":"// ensure the identity comes from this MSP before evaluation\nid, err := msp.DeserializeIdentity(certPEM)\nif err != nil { return fmt.Errorf(\"cannot load identity for this MSP: %w\", err) }\n_ = id // safe to pass to msp.SatisfiesPrincipal","typeGuard":"func isConcreteIdentity(id msp.Identity) bool {\n\t_, ok := id.(*msp.Identity) // internal *identity; prefer obtaining ids from the owning MSP\n\treturn ok\n}","tryCatchPattern":"if err := msp.SatisfiesPrincipal(id, principal); err != nil {\n\tif strings.Contains(err.Error(), \"invalid identity type\") {\n\t\t// reload the identity via msp.DeserializeIdentity and retry once\n\t}\n\treturn err\n}","preventionTips":["Always obtain identities from the same MSP that evaluates the principal","Never wrap or re-implement the Identity interface before passing to SatisfiesPrincipal","In tests, generate real identities via msp.New instead of mocking the interface","Keep identity creation and policy evaluation within one MSP manager instance"],"tags":["fabric","msp","type-assertion","identity"],"backgroundTag":"invalid-identity-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}