{"record":{"id":"1d824369be2bff21","repo":"hyperledger/fabric","slug":"error-adding-policies-to-orderer-org-group-s","errorCode":null,"errorMessage":"error adding policies to orderer org group '%s'","messagePattern":"error adding policies to orderer org group '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configtxgen/encoder/encoder.go","lineNumber":330,"sourceCode":"\n// NewOrdererOrgGroup returns an orderer org component of the channel configuration.  It defines the crypto material for the\n// organization (its MSP).  It sets the mod_policy of all elements to \"Admins\".\n// channelCapabilities map[string]bool\nfunc NewOrdererOrgGroup(conf *genesisconfig.Organization, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {\n\tordererOrgGroup := protoutil.NewConfigGroup()\n\tordererOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey\n\n\tif conf.SkipAsForeign {\n\t\treturn ordererOrgGroup, nil\n\t}\n\n\tmspConfig, err := msp.GetVerifyingMspConfig(conf.MSPDir, conf.ID, conf.MSPType)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"1 - Error loading MSP configuration for org: %s\", conf.Name)\n\t}\n\n\tif err := AddPolicies(ordererOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"error adding policies to orderer org group '%s'\", conf.Name)\n\t}\n\n\taddValue(ordererOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)\n\n\tif len(conf.OrdererEndpoints) > 0 {\n\t\taddValue(ordererOrgGroup, channelconfig.EndpointsValue(conf.OrdererEndpoints), channelconfig.AdminsPolicyKey)\n\t} else if channelCapabilities[\"V3_0\"] {\n\t\treturn nil, errors.Errorf(\"orderer endpoints for organization %s are missing and must be configured when capability V3_0 is enabled\", conf.Name)\n\t}\n\n\treturn ordererOrgGroup, nil\n}\n\n// NewApplicationGroup returns the application component of the channel configuration.  It defines the organizations which are involved\n// in application logic like chaincodes, and how these members may interact with the orderer.  It sets the mod_policy of all elements to \"Admins\".\nfunc NewApplicationGroup(conf *genesisconfig.Application) (*cb.ConfigGroup, error) {\n\tapplicationGroup := protoutil.NewConfigGroup()\n\tif err := AddPolicies(applicationGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/configtxgen/encoder/encoder.go#L312-L348","documentation":"In NewOrdererOrgGroup, after the MSP config loads, AddPolicies registers the org's Readers/Writers/Admins policies on the orderer org group. A malformed or missing policy definition causes this wrapped error, aborting genesis/printOrg generation.","triggerScenarios":"An Orderer org in configtx.yaml defines Policies with invalid rule syntax, references principals whose MSP is not loaded, or omits the Admins policy required by channelconfig.AdminsPolicyKey.","commonSituations":"YAML indentation placing policies at the wrong level; signature rules with unquoted special characters; stale v1 policy syntax after upgrading to Fabric v2.x; copying peer-org policies that reference peer MSP IDs into an orderer org.","solutions":["Validate the Orderer org Policies block in configtx.yaml: correct Type (Signature/ImplicitMeta) and Rule syntax, with quotes around OR/AND expressions.","Ensure the Admins policy is defined for the orderer org.","Compare against fabric-samples first-network configtx.yaml policy templates and adopt them.","Run `configtxgen -printOrg OrdererOrgMSP` to surface the exact failing policy."],"exampleFix":"// before\nPolicies:\n  Admins:\n    Type: Signature\n    Rule: OR(OrdererMSP.admin\n// after\nPolicies:\n  Admins:\n    Type: Signature\n    Rule: \"OR('OrdererMSP.admin')\"","handlingStrategy":"validation","validationCode":"if _, ok := conf.Policies[\"Admins\"]; !ok {\n    return fmt.Errorf(\"orderer org %s must define an Admins policy\", conf.Name)\n}\nfor name, pol := range conf.Policies {\n    if pol.Type == \"Signature\" && !strings.Contains(pol.Rule, \"'\") {\n        log.Printf(\"warning: org %s policy %s rule should quote principals: %s\", conf.Name, name, pol.Rule)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := AddPolicies(group, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {\n    return fmt.Errorf(\"orderer org %s: invalid policies %v: %w\", conf.Name, conf.Policies, err)\n}","preventionTips":["Quote all signature-rule expressions in configtx.yaml","Include Admins, Readers, and Writers for every orderer org","Use ImplicitMeta policies (e.g. \"MAJORITY Admins\") where possible to reduce syntax errors","Validate the generated org config with `configtxgen -printOrg` before genesis creation"],"tags":["hyperledger-fabric","configtxgen","policy","orderer"],"backgroundTag":"policy-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}