{"record":{"id":"ef732e12ac5c63e3","repo":"hyperledger/fabric","slug":"identity-isn-t-an-msp-identity","errorCode":null,"errorMessage":"identity isn't an MSP Identity","messagePattern":"identity isn't an MSP Identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/consensus/smartbft/util.go","lineNumber":162,"sourceCode":"\treturn &viewMetadata, nil\n}\n\ntype request struct {\n\tsigHdr   *cb.SignatureHeader\n\tenvelope *cb.Envelope\n\tchHdr    *cb.ChannelHeader\n}\n\n// RequestInspector inspects incoming requests and validates serialized identity\ntype RequestInspector struct {\n\tValidateIdentityStructure func(identity *msp.SerializedIdentity) error\n\tLogger                    *flogging.FabricLogger\n}\n\nfunc (ri *RequestInspector) requestIDFromSigHeader(sigHdr *cb.SignatureHeader) (types.RequestInfo, error) {\n\tsID := &msp.SerializedIdentity{}\n\tif err := proto.Unmarshal(sigHdr.Creator, sID); err != nil {\n\t\treturn types.RequestInfo{}, errors.Wrap(err, \"identity isn't an MSP Identity\")\n\t}\n\n\tif err := ri.ValidateIdentityStructure(sID); err != nil {\n\t\treturn types.RequestInfo{}, err\n\t}\n\n\tvar preimage []byte\n\tpreimage = append(preimage, sigHdr.Nonce...)\n\tpreimage = append(preimage, sigHdr.Creator...)\n\ttxID := sha256.Sum256(preimage)\n\tclientID := sha256.Sum256(sigHdr.Creator)\n\treturn types.RequestInfo{\n\t\tID:       hex.EncodeToString(txID[:]),\n\t\tClientID: hex.EncodeToString(clientID[:]),\n\t}, nil\n}\n\nfunc (ri *RequestInspector) requestIDFromEnvelope(envelope *cb.Envelope) (types.RequestInfo, error) {","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/smartbft/util.go#L144-L180","documentation":"requestIDFromSigHeader unmarshals the SignatureHeader's Creator bytes as an msp.SerializedIdentity to derive a RequestInfo (ID, client, txID). If the creator bytes are not a serialized MSP identity, the proto unmarshal fails and the error is wrapped as 'identity isn't an MSP Identity'; the request is then rejected.","triggerScenarios":"RequestID or verifyRequest on a submitted envelope whose SignatureHeader.Creator is empty, truncated, or not a protobuf SerializedIdentity — e.g. malformed client submission or a request relayed from a non-Fabric source.","commonSituations":"Malicious or buggy client sending garbage creator bytes, a proxy rewriting the envelope, signature header built manually in tests/tools, or mixing proposals between incompatible Fabric versions.","solutions":["Ensure clients build envelopes via the Fabric SDK, which serializes an msp.SerializedIdentity into the creator field","Re-submit the transaction with a correctly signed envelope from an enrolled identity","Check SDK/tooling version compatibility with the network's Fabric version","Inspect the rejecting orderer's logs to identify the sender endpoint producing malformed headers"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"sID := &msp.SerializedIdentity{}\nif err := proto.Unmarshal(sigHdr.Creator, sID); err != nil {\n  return fmt.Errorf(\"creator is not a serialized identity, reject request\")\n}\nif len(sID.Mspid) == 0 || len(sID.IdBytes) == 0 {\n  return fmt.Errorf(\"serialized identity missing mspid or cert\")\n}","typeGuard":"func isSerializedIdentity(creator []byte) (*msp.SerializedIdentity, bool) {\n  sID := &msp.SerializedIdentity{}\n  if err := proto.Unmarshal(creator, sID); err != nil || sID.Mspid == \"\" || len(sID.IdBytes) == 0 {\n    return nil, false\n  }\n  return sID, true\n}","tryCatchPattern":"reqID, err := ri.RequestIDFromSigHeader(sigHdr)\nif err != nil {\n  logger.Warnf(\"dropping malformed request: %v\", err)\n  return // reject, do not retry\n}","preventionTips":["Build envelopes only with the Fabric SDK / gateway service","Never hand-craft SignatureHeaders in tools or tests","Keep client SDK versions aligned with network Fabric version","Reject malformed submissions at the gateway edge with clear client errors"],"tags":["hyperledger-fabric","smartbft","msp","protobuf","request-validation"],"backgroundTag":"invalid-serialized-identity","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}