code: func (is *identityMapperImpl) Put(pkiID common.PKIidType, identity api.PeerIdentityType) error {
  	if pkiID == nil {
  		return errors.New("PKIID is nil")
  	}
  	if identity == nil {
  		return errors.New("identity is nil")
  	}
  
  	expirationDate, err := is.mcs.Expiration(identity)
  	if err != nil {
  		return errors.Wrap(err, "failed classifying identity")
  	}
  
  	if err := is.mcs.ValidateIdentity(identity); err != nil {
  		return err
  	}
  
  	id := is.mcs.GetPKIidOfCert(identity)
  	if !bytes.Equal(pkiID, id) {
  		return errors.New("identity doesn't match the computed pkiID")
  	}
  
  	is.Lock()
  	defer is.Unlock()
  	// Check if identity already exists.
  	// If so, no need to overwrite it.
  	if _, exists := is.pkiID2Cert[string(pkiID)]; exists {
  		return nil
  	}
  
  	var expirationTimer *time.Timer
  	if !expirationDate.IsZero() {
  		if time.Now().After(expirationDate) {
  			return errors.New("identity expired")
  		}
  		// Identity would be wiped out a millisecond after its expiration date
  		timeToLive := expirationDate.Add(time.Millisecond).Sub(time.Now())
  		expirationTimer = time.AfterFunc(timeToLive, func() {
  			is.delete(pkiID, identity)
  		})
  	}
  
  	is.pkiID2Cert[string(id)] = newStoredIdentity(pkiID, identity, expirationTimer, is.sa.OrgByPeerIdentity(identity))
  	return nil
  }
docs: // put associates an identity to its given pkiID, and returns an error
  // in case the given pkiID doesn't match the identity