{"record":{"id":"f8e367797e661f59","repo":"hyperledger/fabric","slug":"the-identity-does-not-have-an-ou-that-resolves-to-f8e367","errorCode":null,"errorMessage":"the identity does not have an OU that resolves to client, peer, orderer, or admin role. OUs: %s, MSP: [%s]","messagePattern":"the identity does not have an OU that resolves to client, peer, orderer, or admin role\\. OUs: (.+?), MSP: \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":284,"sourceCode":"\t\tnodeOU := validOUs[OU.OrganizationalUnitIdentifier]\n\t\tif nodeOU == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\t// Yes. Then, enforce the certifiers identifier in this is specified.\n\t\t// If is not specified, it means that any certification path is fine.\n\t\tif len(nodeOU.CertifiersIdentifier) != 0 && !bytes.Equal(nodeOU.CertifiersIdentifier, OU.CertifiersIdentifier) {\n\t\t\treturn errors.Errorf(\"certifiersIdentifier does not match: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t\t}\n\t\tcounter++\n\t\tif counter > 1 {\n\t\t\tbreak\n\t\t}\n\t}\n\n\t// the identity should have exactly one OU role, return an error if the counter is not 1.\n\tif counter == 0 {\n\t\treturn errors.Errorf(\"the identity does not have an OU that resolves to client, peer, orderer, or admin role. OUs: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t}\n\tif counter > 1 {\n\t\treturn errors.Errorf(\"the identity must have a client, a peer, an orderer, or an admin OU role to be valid, not a combination of them. OUs: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) getValidityOptsForCert(cert *x509.Certificate) x509.VerifyOptions {\n\t// First copy the opts to override the CurrentTime field\n\t// in order to make the certificate passing the expiration test\n\t// independently from the real local current time.\n\t// This is a temporary workaround for FAB-3678\n\n\tvar tempOpts x509.VerifyOptions\n\ttempOpts.Roots = msp.opts.Roots\n\ttempOpts.DNSName = msp.opts.DNSName\n\ttempOpts.Intermediates = msp.opts.Intermediates","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L266-L302","documentation":"Under V1.4.2 OU enforcement, an identity must have exactly one OU resolving to client, peer, orderer, or admin. Counter was 0, meaning no OU in the certificate matched any configured role identifier, so the identity cannot be classified and is rejected.","triggerScenarios":"msp.Validate(identity) (via validateIdentityOUsV142) when none of the identity's OUs equals the OrganizationalUnitIdentifier of Client/Peer/Orderer/Admin OU identifiers in NodeOUs.","commonSituations":"Pre-1.4 certificates without role OUs used after enabling NodeOUs; orderer identities run against an MSP config missing OrdererOUIdentifier; OU name typos (e.g. 'clients' vs 'client'); fabric-ca registration with wrong ou affiliation attributes.","solutions":["Reissue the certificate with the correct role OU (client/peer/orderer/admin) matching a configured identifier","Add the missing OU identifier section (e.g. OrdererOUIdentifier or AdminOUIdentifier) to the MSP config","Fix the OU attribute in fabric-ca enrollment (fabric-ca-client register --id.ou client)"],"exampleFix":"// before: orderer identity, config only has client/peer\nNodeOUs:\n  ClientOUIdentifier: {OrganizationalUnitIdentifier: client}\n  PeerOUIdentifier: {OrganizationalUnitIdentifier: peer}\n// after\nNodeOUs:\n  Enable: true\n  ClientOUIdentifier: {OrganizationalUnitIdentifier: client}\n  PeerOUIdentifier: {OrganizationalUnitIdentifier: peer}\n  OrdererOUIdentifier: {OrganizationalUnitIdentifier: orderer}","handlingStrategy":"validation","validationCode":"func resolvesToV142Role(cert *x509.Certificate, roles map[string]string) bool {\n    // roles: OU string -> role (client/peer/orderer/admin) from MSP NodeOUs\n    for _, ou := range cert.Subject.OU {\n        if _, ok := roles[ou]; ok { return true }\n    }\n    return false\n}\n// false means msp.Validate will fail with 'does not have an OU that resolves to...'.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure all four role identifiers (client/peer/orderer/admin) in V1.4.2+ NodeOUs","Set the correct OU at fabric-ca registration time (--id.ou orderer etc.)","After upgrading to 1.4.2+ OU enforcement, re-audit all certs for role OUs"],"tags":["fabric","msp","x509","configuration"],"backgroundTag":"msp-ou-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}