hyperledger/fabric · error

collection-name: %s -- principal type %v is not supported

Error message

collection-name: %s -- principal type %v is not supported

What it means

Collection member orgs policies only support ROLE, ORGANIZATION_UNIT, and IDENTITY principal classifications. This error is thrown when a principal uses any other classification (e.g. ANONYMITY or COMPOSITE).

Source

Thrown at core/chaincode/lifecycle/scc.go:895

			mspou := &mspprotos.OrganizationUnit{}
			err := proto.Unmarshal(principal.Principal, mspou)
			if err != nil {
				return errors.Wrapf(err, "collection-name: %s -- cannot unmarshal identity bytes into OrganizationUnit", coll.GetName())
			}
			orgID = mspou.MspIdentifier
			// the msp map is indexed using msp IDs - this behavior is implementation specific, making the following check a bit of a hack
			_, ok := msps[orgID]
			if !ok {
				return errors.Errorf("collection-name: %s -- collection member '%s' is not part of the channel", coll.GetName(), orgID)
			}

		case mspprotos.MSPPrincipal_IDENTITY:
			if _, err := mspMgr.DeserializeIdentity(principal.Principal); err != nil {
				return errors.Errorf("collection-name: %s -- contains an identity that is not part of the channel", coll.GetName())
			}

		default:
			return errors.Errorf("collection-name: %s -- principal type %v is not supported", coll.GetName(), principal.PrincipalClassification)
		}
	}
	return nil
}

// validateSpOrConcat checks if the supplied signature policy is just an OR-concatenation of identities
func validateSpOrConcat(sp *common.SignaturePolicy) error {
	if sp.GetNOutOf() == nil {
		return nil
	}
	// check if N == 1 (OR concatenation)
	if sp.GetNOutOf().N != 1 {
		return errors.Errorf("signature policy is not an OR concatenation, NOutOf %d", sp.GetNOutOf().N)
	}
	// recurse into all sub-rules
	for _, rule := range sp.GetNOutOf().Rules {
		err := validateSpOrConcat(rule)
		if err != nil {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Rewrite the member orgs policy using only ROLE, ORGANIZATION_UNIT, or IDENTITY principals.
2. Wrap OR-of-principals via NOutOf(N=1) rules, which are allowed by validateSpOrConcat.
3. Check for zero-valued PrincipalClassification fields indicating an uninitialized principal.
4. Use standard collection policy tooling instead of reusing generic signature policies.

Example fix

// before
principal := &mspprotos.MSPPrincipal{PrincipalClassification: mspprotos.MSPPrincipal_ANONYMITY, Principal: anonBytes}
// after
role, _ := proto.Marshal(&mspprotos.MSPRole{MspIdentifier: "Org1MSP", Role: mspprotos.MSPRole_MEMBER})
principal := &mspprotos.MSPPrincipal{PrincipalClassification: mspprotos.MSPPrincipal_ROLE, Principal: role}

allowed := map[mspprotos.MSPPrincipal_Classification]bool{
  mspprotos.MSPPrincipal_ROLE: true,
  mspprotos.MSPPrincipal_ORGANIZATION_UNIT: true,
  mspprotos.MSPPrincipal_IDENTITY: true,
}
for _, p := range policy.Identities {
  if !allowed[p.PrincipalClassification] {
    return fmt.Errorf("principal classification %v not allowed in collection policy", p.PrincipalClassification)
  }
}

func isCollectionAllowedPrincipal(p *mspprotos.MSPPrincipal) bool {
  switch p.GetPrincipalClassification() {
  case mspprotos.MSPPrincipal_ROLE, mspprotos.MSPPrincipal_ORGANIZATION_UNIT, mspprotos.MSPPrincipal_IDENTITY:
    return true
  }
  return false
}

if err := commitDefinition(...); err != nil {
  if strings.Contains(err.Error(), "principal type") && strings.Contains(err.Error(), "is not supported") {
    // rewrite policy with supported principal classifications
  }
  return err
}

When it happens

Trigger: Submitting a chaincode definition whose collection config member_orgs_policy contains an MSPPrincipal with a classification other than ROLE, ORGANIZATION_UNIT, or IDENTITY.

Common situations: Reusing endorsement/signature policies that permit anonymity or composite principals as collection member policies; hand-built policy structs with a zero-value or wrong enum.

Related errors

• collection-name: %s -- cannot unmarshal identity bytes into
• collection-name: %s -- collection member '%s' is not part of
• collection-name: %s -- cannot unmarshal identity bytes into
• signature policy is not an OR concatenation, NOutOf %d
• the proposed collection config does not contain previously d

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/ff0e1d62eea188d2. Report an issue: GitHub.