hyperledger/fabric · error

Principal is anonymous, but X.509 MSP does not support anony

Error message

Principal is anonymous, but X.509 MSP does not support anonymous identities

What it means

X.509-based bccspmsp identities are always nominal (certificate-backed), never anonymous. When the requested ANONYMITY principal carries AnonymityType=ANONYMOUS, satisfiesPrincipalInternalV13 rejects it outright because this MSP implementation cannot certify anonymity. Identities need an X.509 credential, so they can never match an anonymous principal.

Source

Thrown at msp/mspimpl.go:599

}

// satisfiesPrincipalInternalV13 takes as arguments the identity and the principal.
// The function returns an error if one occurred.
// The function implements the additional behavior expected of an MSP starting from v1.3.
// For pre-v1.3 functionality, the function calls the satisfiesPrincipalInternalPreV13.
func (msp *bccspmsp) satisfiesPrincipalInternalV13(id Identity, principal *m.MSPPrincipal) error {
	switch principal.PrincipalClassification {
	case m.MSPPrincipal_COMBINED:
		return errors.New("SatisfiesPrincipalInternal shall not be called with a CombinedPrincipal")
	case m.MSPPrincipal_ANONYMITY:
		anon := &m.MSPIdentityAnonymity{}
		err := proto.Unmarshal(principal.Principal, anon)
		if err != nil {
			return errors.Wrap(err, "could not unmarshal MSPIdentityAnonymity from principal")
		}
		switch anon.AnonymityType {
		case m.MSPIdentityAnonymity_ANONYMOUS:
			return errors.New("Principal is anonymous, but X.509 MSP does not support anonymous identities")
		case m.MSPIdentityAnonymity_NOMINAL:
			return nil
		default:
			return errors.Errorf("Unknown principal anonymity type: %d", anon.AnonymityType)
		}

	default:
		// Use the pre-v1.3 function to check other principal types
		return msp.satisfiesPrincipalInternalPreV13(id, principal)
	}
}

// satisfiesPrincipalInternalV142 takes as arguments the identity and the principal.
// The function returns an error if one occurred.
// The function implements the additional behavior expected of an MSP starting from v2.0.
// For v1.3 functionality, the function calls the satisfiesPrincipalInternalPreV13.
func (msp *bccspmsp) satisfiesPrincipalInternalV142(id Identity, principal *m.MSPPrincipal) error {
	_, okay := id.(*identity)

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Change the principal's anonymity type to NOMINAL if the intent is ordinary certificate-based membership.
2. If anonymity is genuinely required, configure an idemix MSP and evaluate the principal against identities of that MSP, not the X.509 one.
3. Remove anonymous-principal requirements from policies that will be satisfied by X.509 organizations.

Example fix

// before
anon, _ := proto.Marshal(&m.MSPIdentityAnonymity{AnonymityType: m.MSPIdentityAnonymity_ANONYMOUS})
// after
anon, _ := proto.Marshal(&m.MSPIdentityAnonymity{AnonymityType: m.MSPIdentityAnonymity_NOMINAL})

anon := &m.MSPIdentityAnonymity{}
if err := proto.Unmarshal(principal.Principal, anon); err == nil && anon.AnonymityType == m.MSPIdentityAnonymity_ANONYMOUS {
	return errors.New("X.509 MSP cannot satisfy ANONYMOUS principal; use idemix MSP or NOMINAL type")
}

func requiresAnonymousIdentity(p *m.MSPPrincipal) bool {
	anon := &m.MSPIdentityAnonymity{}
	if p == nil || p.PrincipalClassification != m.MSPPrincipal_ANONYMITY || proto.Unmarshal(p.Principal, anon) != nil {
		return false
	}
	return anon.AnonymityType == m.MSPIdentityAnonymity_ANONYMOUS
}

When it happens

Trigger: Evaluating an X.509 identity against an MSPPrincipal{Classification: ANONYMITY, Principal: marshaled MSPIdentityAnonymity with AnonymityType: ANONYMOUS}; e.g. an endorsement policy written for an idemix (identity mixer) MSP applied to an X.509 MSP.

Common situations: Configuring channel policies designed for Identity Mixer (idemix) MSPs but deploying them in an org using a standard X.509 bccspmsp; mixing anonymous-credential requirements into CA-issued certificate networks.

Related errors

• failed deserializing signed data identity during channelless
• getCertFromPem error: failed to parse x509 cert
• parseCertificate failed
• The identities do not match
• SatisfiesPrincipalInternal shall not be called with a Combin

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/1c06ed06e88f0c0b. Report an issue: GitHub.