hyperledger/fabric · error

invalid MSP role type %d

Error message

invalid MSP role type %d

What it means

This error is thrown by satisfiesPrincipalInternalPreV13 when a policy principal of type MSPRole carries a Role enum value the X.509 BCCSP MSP does not recognize. Only MEMBER, ADMIN, CLIENT and PEER are handled; anything else falls into the default branch. It means the serialized MSPPrincipal passed to policy evaluation contains a corrupt or unsupported role value.

Source

Thrown at msp/mspimpl.go:532

			// id is exactly one of our admins
			if msp.isInAdmins(id.(*identity)) {
				return nil
			}
			return errors.New("This identity is not an admin")
		case m.MSPRole_CLIENT:
			fallthrough
		case m.MSPRole_PEER:
			mspLogger.Debugf("Checking if identity satisfies role [%s] for %s", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)
			if err := msp.Validate(id); err != nil {
				return errors.Wrapf(err, "The identity is not valid under this MSP [%s]", msp.name)
			}

			if err := msp.hasOURole(id, mspRole.Role); err != nil {
				return errors.Wrapf(err, "The identity is not a [%s] under this MSP [%s]", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)
			}
			return nil
		default:
			return errors.Errorf("invalid MSP role type %d", int32(mspRole.Role))
		}
	case m.MSPPrincipal_IDENTITY:
		// in this case we have to deserialize the principal's identity
		// and compare it byte-by-byte with our cert
		principalId, err := msp.DeserializeIdentity(principal.Principal)
		if err != nil {
			return errors.WithMessage(err, "invalid identity principal, not a certificate")
		}

		if bytes.Equal(id.(*identity).cert.Raw, principalId.(*identity).cert.Raw) {
			return principalId.Validate()
		}

		return errors.New("The identities do not match")
	case m.MSPPrincipal_ORGANIZATION_UNIT:
		// Principal contains the OrganizationUnit
		OU := &m.OrganizationUnit{}
		err := proto.Unmarshal(principal.Principal, OU)

View on GitHub (pinned to 2736b63f8f)

Solutions

  1. Regenerate the policy/config with the fabric-protos version matching the running peer so MSPRole.Role is a valid enum value
  2. Inspect the MSPPrincipal bytes (decode MSPRole from principal.Principal) and confirm Role is one of MEMBER, ADMIN, CLIENT, PEER
  3. Recreate the endorsement policy using standard tooling (e.g. 'Org1MSP.member' style policy strings or fabric-ca/policygen) instead of hand-built protobuf
  4. If a new role type is genuinely needed, upgrade both the peer and protos so the switch handles it

Example fix

// before: hand-built principal with unknown role
role := &msp.MSPRole{MspIdentifier: "Org1MSP", Role: msp.MSPRole_MSPRoleType(9)}
// after: use a defined enum value
role := &msp.MSPRole{MspIdentifier: "Org1MSP", Role: msp.MSPRole_PEER}
Defensive patterns

Strategy: validation

Validate before calling

role := &msp.MSPRole{}
if err := proto.Unmarshal(principal.Principal, role); err != nil {
	return fmt.Errorf("bad MSPRole principal: %w", err)
}
if role.Role != msp.MSPRole_MEMBER && role.Role != msp.MSPRole_ADMIN &&
	role.Role != msp.MSPRole_CLIENT && role.Role != msp.MSPRole_PEER {
	return fmt.Errorf("unsupported MSPRole %d in policy", role.Role)
}

Type guard

func isValidMSPRole(r msp.MSPRole_MSPRoleType) bool {
	_, ok := msp.MSPRole_MSPRoleType_name[int32(r)]
	return ok && (r == msp.MSPRole_MEMBER || r == msp.MSPRole_ADMIN || r == msp.MSPRole_CLIENT || r == msp.MSPRole_PEER)
}

Try / catch

err := policy.Evaluate(signedData)
var badRoleErr interface{ Error() string }
if err != nil && strings.Contains(err.Error(), "invalid MSP role type") {
	// policy contains an unknown role; rebuild policy with a valid MSPRole
}

Prevention

When it happens

Trigger: Evaluating a signature policy/ACL whose MSPPrincipal contains an MSPRole with a Role value outside {MEMBER=0, ADMIN=1, CLIENT=2, PEER=3}, typically after deserializing a principal from a different Hyperledger Fabric version or hand-crafted protobuf.

Common situations: Policies generated or edited with a newer/older fabric-protos than the peer binary; channel config or collection config hand-edited or patched programmatically; a fabricated MSPPrincipal supplied via SDK when endorsing or checking policy satisfaction.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/310cf0f8ba89aef1. Report an issue: GitHub.