I suggest to add msp support into chaincode to authenticate identitis in client applications. The getCreator api only get the creator and take it as authenticated already.
A way to do: for an endorsing peer, it has a function to get CA from configure block and autheniticate the transaction creator. Just copy the function to chaicode part. Is it feasible?