{"record":{"id":"843700f38fb8e92f","repo":"hyperledger/fabric","slug":"administrators-must-be-declared-when-no-admin-ou-c","errorCode":null,"errorMessage":"administrators must be declared when no admin ou classification is set","messagePattern":"administrators must be declared when no admin ou classification is set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplsetup.go","lineNumber":195,"sourceCode":"\t\tid, _, err := msp.getIdentityFromConf(admCert)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tmsp.admins[i] = id\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) setupAdminsV142(conf *m.FabricMSPConfig) error {\n\t// make and fill the set of admin certs (if present)\n\tif err := msp.setupAdminsPreV142(conf); err != nil {\n\t\treturn err\n\t}\n\n\tif len(msp.admins) == 0 && (!msp.ouEnforcement || msp.adminOU == nil) {\n\t\treturn errors.New(\"administrators must be declared when no admin ou classification is set\")\n\t}\n\n\treturn nil\n}\n\nfunc isECDSASignatureAlgorithm(algid asn1.ObjectIdentifier) bool {\n\t// This is the set of ECDSA algorithms supported by Go 1.14 for CRL\n\t// signatures.\n\tecdsaSignaureAlgorithms := []asn1.ObjectIdentifier{\n\t\t{1, 2, 840, 10045, 4, 1},    // oidSignatureECDSAWithSHA1\n\t\t{1, 2, 840, 10045, 4, 3, 2}, // oidSignatureECDSAWithSHA256\n\t\t{1, 2, 840, 10045, 4, 3, 3}, // oidSignatureECDSAWithSHA384\n\t\t{1, 2, 840, 10045, 4, 3, 4}, // oidSignatureECDSAWithSHA512\n\t}\n\tfor _, id := range ecdsaSignaureAlgorithms {\n\t\tif id.Equal(algid) {\n\t\t\treturn true\n\t\t}","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L177-L213","documentation":"setupAdminsV142 enforces that an MSP has administrators either via explicit admin certificates or via OU-based admin classification (adminOU). If msp.admins is empty AND (OU enforcement is off or no admin OU is configured), the MSP would have no admins, which is rejected.","triggerScenarios":"FabricMSPConfig has no admincerts and either FabricNodeOus.Enable is false or FabricNodeOus.AdminOuIdentifier is unset when setting up an MSP with the V142 setup path.","commonSituations":"Organizations intentionally removing static admin certs after enabling NodeOUs but forgetting to set the AdminOuIdentifier; migrating MSP config from pre-V1.4.2 format; configtx.yaml organization with empty admincerts list.","solutions":["Add at least one admin certificate to the MSP admincerts/ directory and config.Admins","Or enable NodeOUs and set FabricNodeOus.AdminOuIdentifier with a valid OU and certificate","If intending no admins, configure the admin OU classification first, then remove static certs","Regenerate the org MSP definition in configtx.yaml with either admins or admin OU set"],"exampleFix":"// before: no admincerts, no AdminOuIdentifier\n// after\n// FabricNodeOus:\n//   Enable: true\n//   AdminOUIdentifier:\n//     OrganizationalUnitIdentifier: admin\n//     Certificate: cacerts/ca.pem\nnull","handlingStrategy":"validation","validationCode":"hasAdmins := len(conf.Admins) > 0\nhasAdminOU := conf.FabricNodeOus != nil && conf.FabricNodeOus.Enable &&\n    conf.FabricNodeOus.AdminOuIdentifier != nil &&\n    len(conf.FabricNodeOus.AdminOuIdentifier.OrganizationalUnitIdentifier) > 0\nif !hasAdmins && !hasAdminOU {\n    return errors.New(\"org must define admin certs or an AdminOuIdentifier\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When removing static admin certs, first configure the admin OU classification","Keep at least one admin cert during migration periods","Validate organization definitions in configtx.yaml with configtxgen before channel creation"],"tags":["msp-setup","admin-certificates","nodeous","hyperledger-fabric"],"backgroundTag":"missing-admin-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}