hyperledger/fabric · error

identity isn't an MSP Identity

Error message

identity isn't an MSP Identity

What it means

requestIDFromSigHeader unmarshals the SignatureHeader's Creator bytes as an msp.SerializedIdentity to derive a RequestInfo (ID, client, txID). If the creator bytes are not a serialized MSP identity, the proto unmarshal fails and the error is wrapped as 'identity isn't an MSP Identity'; the request is then rejected.

Source

Thrown at orderer/consensus/smartbft/util.go:162

	return &viewMetadata, nil
}

type request struct {
	sigHdr   *cb.SignatureHeader
	envelope *cb.Envelope
	chHdr    *cb.ChannelHeader
}

// RequestInspector inspects incoming requests and validates serialized identity
type RequestInspector struct {
	ValidateIdentityStructure func(identity *msp.SerializedIdentity) error
	Logger                    *flogging.FabricLogger
}

func (ri *RequestInspector) requestIDFromSigHeader(sigHdr *cb.SignatureHeader) (types.RequestInfo, error) {
	sID := &msp.SerializedIdentity{}
	if err := proto.Unmarshal(sigHdr.Creator, sID); err != nil {
		return types.RequestInfo{}, errors.Wrap(err, "identity isn't an MSP Identity")
	}

	if err := ri.ValidateIdentityStructure(sID); err != nil {
		return types.RequestInfo{}, err
	}

	var preimage []byte
	preimage = append(preimage, sigHdr.Nonce...)
	preimage = append(preimage, sigHdr.Creator...)
	txID := sha256.Sum256(preimage)
	clientID := sha256.Sum256(sigHdr.Creator)
	return types.RequestInfo{
		ID:       hex.EncodeToString(txID[:]),
		ClientID: hex.EncodeToString(clientID[:]),
	}, nil
}

func (ri *RequestInspector) requestIDFromEnvelope(envelope *cb.Envelope) (types.RequestInfo, error) {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure clients build envelopes via the Fabric SDK, which serializes an msp.SerializedIdentity into the creator field
2. Re-submit the transaction with a correctly signed envelope from an enrolled identity
3. Check SDK/tooling version compatibility with the network's Fabric version
4. Inspect the rejecting orderer's logs to identify the sender endpoint producing malformed headers

sID := &msp.SerializedIdentity{}
if err := proto.Unmarshal(sigHdr.Creator, sID); err != nil {
  return fmt.Errorf("creator is not a serialized identity, reject request")
}
if len(sID.Mspid) == 0 || len(sID.IdBytes) == 0 {
  return fmt.Errorf("serialized identity missing mspid or cert")
}

func isSerializedIdentity(creator []byte) (*msp.SerializedIdentity, bool) {
  sID := &msp.SerializedIdentity{}
  if err := proto.Unmarshal(creator, sID); err != nil || sID.Mspid == "" || len(sID.IdBytes) == 0 {
    return nil, false
  }
  return sID, true
}

reqID, err := ri.RequestIDFromSigHeader(sigHdr)
if err != nil {
  logger.Warnf("dropping malformed request: %v", err)
  return // reject, do not retry
}

When it happens

Trigger: RequestID or verifyRequest on a submitted envelope whose SignatureHeader.Creator is empty, truncated, or not a protobuf SerializedIdentity — e.g. malformed client submission or a request relayed from a non-Fabric source.

Common situations: Malicious or buggy client sending garbage creator bytes, a proxy rewriting the envelope, signature header built manually in tests/tools, or mixing proposals between incompatible Fabric versions.

Related errors

• failed unmarshaling identity %s
• marshalling failed
• failed unmarshalling peer's identity
• failed marshaling FabricMSPConfig
• failed unmarshalling fabric msp config

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/ef732e12ac5c63e3. Report an issue: GitHub.