collection-name: %s -- contains an identity that is not part

Error message

collection-name: %s -- contains an identity that is not part of the channel

What it means

For IDENTITY-class principals in a collection member orgs policy, the raw identity bytes are deserialized via the channel's MSP manager. This error is thrown when the bytes are not a valid identity of any channel member, meaning the collection contains an identity outside the channel.

Source

Thrown at core/chaincode/lifecycle/scc.go:891

				return errors.Errorf("collection-name: %s -- collection member '%s' is not part of the channel", coll.GetName(), orgID)
			}

		case mspprotos.MSPPrincipal_ORGANIZATION_UNIT:
			mspou := &mspprotos.OrganizationUnit{}
			err := proto.Unmarshal(principal.Principal, mspou)
			if err != nil {
				return errors.Wrapf(err, "collection-name: %s -- cannot unmarshal identity bytes into OrganizationUnit", coll.GetName())
			}
			orgID = mspou.MspIdentifier
			// the msp map is indexed using msp IDs - this behavior is implementation specific, making the following check a bit of a hack
			_, ok := msps[orgID]
			if !ok {
				return errors.Errorf("collection-name: %s -- collection member '%s' is not part of the channel", coll.GetName(), orgID)
			}

		case mspprotos.MSPPrincipal_IDENTITY:
			if _, err := mspMgr.DeserializeIdentity(principal.Principal); err != nil {
				return errors.Errorf("collection-name: %s -- contains an identity that is not part of the channel", coll.GetName())
			}

		default:
			return errors.Errorf("collection-name: %s -- principal type %v is not supported", coll.GetName(), principal.PrincipalClassification)
		}
	}
	return nil
}

// validateSpOrConcat checks if the supplied signature policy is just an OR-concatenation of identities
func validateSpOrConcat(sp *common.SignaturePolicy) error {
	if sp.GetNOutOf() == nil {
		return nil
	}
	// check if N == 1 (OR concatenation)
	if sp.GetNOutOf().N != 1 {
		return errors.Errorf("signature policy is not an OR concatenation, NOutOf %d", sp.GetNOutOf().N)
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

Use identities (serialized identity protobufs) issued by MSPs on the channel.
Prefer ROLE-based principals over raw identities for collection policies.
Verify the identity deserializes against a channel MSP before submitting.
Regenerate the collection config with tooling that produces valid principals.

Example fix

// before
principal := &mspprotos.MSPPrincipal{PrincipalClassification: mspprotos.MSPPrincipal_IDENTITY, Principal: []byte(pemCertString)}
// after: use a role principal for the peer's org
role, _ := proto.Marshal(&mspprotos.MSPRole{MspIdentifier: "Org1MSP", Role: mspprotos.MSPRole_PEER})
principal := &mspprotos.MSPPrincipal{PrincipalClassification: mspprotos.MSPPrincipal_ROLE, Principal: role}

Defensive patterns

Strategy: validation

Validate before calling

for _, p := range policy.Identities {
  if p.PrincipalClassification == mspprotos.MSPPrincipal_IDENTITY {
    if _, err := mspMgr.DeserializeIdentity(p.Principal); err != nil {
      return fmt.Errorf("identity principal not valid on channel: %w", err)
    }
  }
}

Type guard

func isChannelIdentity(p *mspprotos.MSPPrincipal, mspMgr msp.MSPManager) bool {
  if p == nil || p.PrincipalClassification != mspprotos.MSPPrincipal_IDENTITY {
    return false
  }
  _, err := mspMgr.DeserializeIdentity(p.Principal)
  return err == nil
}

Try / catch

if err := approve(...); err != nil {
  if strings.Contains(err.Error(), "contains an identity that is not part of the channel") {
    // replace raw identity principals with ROLE principals and resubmit
  }
  return err
}

Prevention

Avoid IDENTITY principals in collection configs; use ROLE instead.
Never paste PEM certs or base64 strings as principal bytes.
Ensure identities come from MSPs enrolled on this channel/network.

When it happens

Trigger: A collection config member_orgs_policy with an MSPPrincipal_IDENTITY whose principal bytes fail mspMgr.DeserializeIdentity during approve/commit validation.

Common situations: Raw certificate bytes or base64 strings passed instead of a serialized identity; identity issued by an MSP not on the channel; identity from another network/environment pasted into the collection config.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/59452936697af6b2. Report an issue: GitHub.