hyperledger/fabric · error

Identity type not recognized

Error message

Identity type not recognized

What it means

Like Validate, hasOURole switches on the concrete type of the Identity and only the internal *identity type supports OU-role lookup via hasOURoleInternal. Any other Identity implementation reaches the default branch and produces this (capitalized) error. It indicates the caller passed an identity object the fabric MSP does not implement.

Source

Thrown at msp/mspimpl.go:355

// associated to the specified MSPRole.
// This function does not check the certifiers identifier.
// Appropriate validation needs to be enforced before.
func (msp *bccspmsp) hasOURole(id Identity, mspRole m.MSPRole_MSPRoleType) error {
	// Check NodeOUs
	if !msp.ouEnforcement {
		return errors.New("NodeOUs not activated. Cannot tell apart identities.")
	}

	mspLogger.Debugf("MSP %s checking if the identity is a client", msp.name)

	switch id := id.(type) {
	// If this identity is of this specific type,
	// this is how I can validate it given the
	// root of trust this MSP has
	case *identity:
		return msp.hasOURoleInternal(id, mspRole)
	default:
		return errors.New("Identity type not recognized")
	}
}

func (msp *bccspmsp) hasOURoleInternal(id *identity, mspRole m.MSPRole_MSPRoleType) error {
	var nodeOU *OUIdentifier
	switch mspRole {
	case m.MSPRole_CLIENT:
		nodeOU = msp.clientOU
	case m.MSPRole_PEER:
		nodeOU = msp.peerOU
	case m.MSPRole_ADMIN:
		nodeOU = msp.adminOU
	case m.MSPRole_ORDERER:
		nodeOU = msp.ordererOU
	default:
		return errors.New("Invalid MSPRoleType. It must be CLIENT, PEER, ADMIN or ORDERER")
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the identity passed to policy evaluation was produced by this fabric MSP's DeserializeIdentity/GetIdentityFromBytes so it is the internal *identity type
2. Guard against nil identities before invoking principal-satisfaction checks
3. Separate Idemix identities onto Idemix MSP providers and keep NodeOU role policies on X.509 identities only
4. Review any custom Identity implementations that might reach MSP policy code and remove or adapt them

Example fix

// before: role check on wrong identity type
err := mspSatisfier(idemixIdentity, clientRole) // "Identity type not recognized"

// after: only route x509 identities from this MSP
id, _, err := fabricMsp.DeserializeIdentity(certBytes)
if err != nil { return err }
err = fabricMsp.(*bccspmsp).hasOURole(id, m.MSPRole_CLIENT)

func canCheckOURole(id msp.Identity) bool {
    if id == nil { return false }
    _, ok := id.(*identity) // internal fabric identity type
    return ok
}

func toInternalIdentity(id msp.Identity) (*identity, bool) {
    ident, ok := id.(*identity)
    return ident, ok && ident != nil
}

if err := hasOURoleChecked(id, m.MSPRole_PEER); err != nil {
    if strings.Contains(err.Error(), "Identity type not recognized") {
        return fmt.Errorf("only X.509 identities from this fabric MSP support OU roles: %w", err)
    }
    return err
}

When it happens

Trigger: Calling hasOURole (via satisfiesPrincipalInternalPreV13, satisfiesPrincipalInternalV142, or postSetupV142) with a non-*identity Identity — e.g. an Idemix identity, a nil Identity, or a foreign/custom Identity implementation — while NodeOUs enforcement is enabled.

Common situations: Mixing Idemix and X.509 identities in one policy evaluation path that checks node roles; custom Identity wrappers used by applications or tests; a deserialization failure upstream returning a wrong-typed identity object.

Related errors

• failed unmarshaling identity %s
• Could not serialize the signing identity: %s
• access denied: channel [%s] creator org unknown, creator is
• Failed deserializing proposal creator during channelless che
• failed unmarshalling peer's identity

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/7c1ede35475c4cfa. Report an issue: GitHub.