What causes "error parsing role %s" in hyperledger/fabric?

Use one of the five supported roles: member, admin, client, peer, orderer.

error parsing role %s

Error message

error parsing role %s

What it means

secondPass maps the captured role substring to an mb.MSPRole_MSPRoleType; because the principal regex only admits the five known roles, this default branch is a defensive guard for internal inconsistency (regex/pass mismatch) or custom role constants. Hitting it means the role text extracted from the principal was not one of member/admin/client/peer/orderer.

Source

Thrown at common/policydsl/policyparser.go:192

				return nil, fmt.Errorf("error parsing principal %s", t)
			}

			/* get the right role */
			var r mb.MSPRole_MSPRoleType

			switch subm[0][3] {
			case RoleMember:
				r = mb.MSPRole_MEMBER
			case RoleAdmin:
				r = mb.MSPRole_ADMIN
			case RoleClient:
				r = mb.MSPRole_CLIENT
			case RolePeer:
				r = mb.MSPRole_PEER
			case RoleOrderer:
				r = mb.MSPRole_ORDERER
			default:
				return nil, fmt.Errorf("error parsing role %s", t)
			}

			/* build the principal we've been told */
			mspRole, err := proto.Marshal(&mb.MSPRole{MspIdentifier: subm[0][1], Role: r})
			if err != nil {
				return nil, fmt.Errorf("error marshalling msp role: %s", err)
			}

			p := &mb.MSPPrincipal{
				PrincipalClassification: mb.MSPPrincipal_ROLE,
				Principal:               mspRole,
			}
			ctx.principals = append(ctx.principals, p)

			/* create a SignaturePolicy that requires a signature from
			   the principal we've just built*/
			dapolicy := SignedBy(int32(ctx.IDNum))
			policies = append(policies, dapolicy)

View on GitHub (pinned to 2736b63f8f)

Solutions

Use one of the five supported roles: member, admin, client, peer, orderer.
If you need a new role, update both the regex (line 39) and the role switch (line 180) consistently in your fork.
Check that vendored copies of policydsl aren't mismatched — align to a single upstream version.
If the error appears with stock Fabric, report/inspect for a modified regex or constants (RoleAdmin etc.).

Example fix

// before (fork)
regex admits "owner" but switch has no case RoleOwner -> default: error parsing role
// after
case RoleOwner: r = mb.MSPRole(6) // add the case, and keep regex and constants in sync

Defensive patterns

Strategy: validation

Validate before calling

switch role {
case "member", "admin", "client", "peer", "orderer":
	// ok
default:
	return fmt.Errorf("unsupported role %q", role)
}

Type guard

func knownRole(r string) bool {
	switch r {
	case "member", "admin", "client", "peer", "orderer":
		return true
	}
	return false
}

Try / catch

if err != nil && strings.Contains(err.Error(), "error parsing role") {
	return nil, fmt.Errorf("role not mapped in policydsl; use member/admin/client/peer/orderer: %w", err)
}

Prevention

Restrict roles to member, admin, client, peer, orderer in all config surfaces.
In forks, keep the principal regex, Role* constants, and the role switch in sync.
Pin a single version of the policydsl package across modules to avoid skew.
Add table tests covering every supported role through FromString.

When it happens

Trigger: Practically only reachable if the principal regex is altered, a fork adds roles without updating this switch, or the Role* constants are redefined so the regex and switch disagree; also via direct secondPass calls with doctored inputs.

Common situations: Patched/forked Fabric policydsl where a new role was added to the regex but not to the switch (or vice versa); build/version skew between vendored copies of the package; tests injecting synthetic principal strings bypassing the regex path.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b2f49f4013c52c19. Report an issue: GitHub.