hyperledger/fabric · error

This identity is not an admin

Error message

This identity is not an admin

What it means

Raised when a MSPPrincipal_ROLE principal with Role=ADMIN is evaluated: the identity passes the MSP-ID check but is not found in the MSP's admin certificate list (isInAdmins fails). Only identities whose certificate exactly matches one of the configured admin certs satisfy an ADMIN principal.

Source

Thrown at msp/mspimpl.go:518

		if mspRole.MspIdentifier != msp.name {
			return errors.Errorf("the identity is a member of a different MSP (expected %s, got %s)", mspRole.MspIdentifier, id.GetMSPIdentifier())
		}

		// now we validate the different msp roles
		switch mspRole.Role {
		case m.MSPRole_MEMBER:
			// in the case of member, we simply check
			// whether this identity is valid for the MSP
			mspLogger.Debugf("Checking if identity satisfies MEMBER role for %s", msp.name)
			return msp.Validate(id)
		case m.MSPRole_ADMIN:
			mspLogger.Debugf("Checking if identity satisfies ADMIN role for %s", msp.name)
			// in the case of admin, we check that the
			// id is exactly one of our admins
			if msp.isInAdmins(id.(*identity)) {
				return nil
			}
			return errors.New("This identity is not an admin")
		case m.MSPRole_CLIENT:
			fallthrough
		case m.MSPRole_PEER:
			mspLogger.Debugf("Checking if identity satisfies role [%s] for %s", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)
			if err := msp.Validate(id); err != nil {
				return errors.Wrapf(err, "The identity is not valid under this MSP [%s]", msp.name)
			}

			if err := msp.hasOURole(id, mspRole.Role); err != nil {
				return errors.Wrapf(err, "The identity is not a [%s] under this MSP [%s]", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)
			}
			return nil
		default:
			return errors.Errorf("invalid MSP role type %d", int32(mspRole.Role))
		}
	case m.MSPPrincipal_IDENTITY:
		// in this case we have to deserialize the principal's identity
		// and compare it byte-by-byte with our cert

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Use the actual admin identity (one whose cert appears in the MSP's admincerts) to sign the operation.
2. Add or update the admin certificate in the organization definition (configtx yaml / peer msp admincerts) and update channel config.
3. If using OU-based roles, ensure the MSP config has OUIdentifiers set and FabricNodeOUs enabled, and the policy matches an OU the identity actually has.
4. Re-enroll the identity from fabric-ca with the admin affiliation/type so its certificate is issued as an admin.

Example fix

// before: signing with a regular client identity
ctx, err := gateway.Evaluate(...) // identity: client cert -> 'This identity is not an admin'

// after: use the org admin identity from the wallet
adminIdentity, _ := wallet.Get("orgAdmin")
ctx, err := gateway.Evaluate(...) // identity: admin cert present in MSP admincerts

// check the cert is listed among the MSP admin certs before attempting admin ops
def isAdmin(certPEM []byte, adminCerts [][]byte) bool {
	parsed, _ := x509.ParseCertificate(pemToDER(certPEM))
	for _, a := range adminCerts {
		ap, _ := x509.ParseCertificate(pemToDER(a))
		if parsed.Equal(ap) {
			return true
		}
	}
	return false
}

func hasAdminCert(id fabric.Identity, adminCerts [][]byte) bool {
	certPEM, _ := id.Certificate()
	return isAdmin(certPEM, adminCerts)
}

err := adminOp(ctx)
if err != nil && strings.Contains(err.Error(), "not an admin") {
	log.Fatalf("identity is not in MSP admincerts; use the org admin identity or update channel config")
}

When it happens

Trigger: A policy requires an ADMIN principal (e.g. lifecycle/chaincode or channel-admin policies, _lifecycle commit checks) and the supplied identity is a member/client/peer of the MSP but not one of the admins listed in the MSP configuration (fabricCA admin cert in configtx / admincerts folder).

Common situations: MSP config deployed without admincerts (common with newer fabric-ca setups that rely on OUs, while the policy still demands ADMIN); identity enrolled with a non-admin role; admin cert rotated/expired in channel config; peer MSP directory missing the admincerts file.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Failed getting local MSP principal during channelless check
• failed verifying that the signed data identity satisfies loc
• MSP Principal role [%s] not recognized
• No principals in CombinedPrincipal
• could not unmarshal MSPRole from principal

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/7ea60619144c43ee. Report an issue: GitHub.