{"record":{"id":"cff77a9327f1dd3f","repo":"hyperledger/fabric","slug":"error-adding-policies-to-consortiums-org-group-s","errorCode":null,"errorMessage":"error adding policies to consortiums org group '%s'","messagePattern":"error adding policies to consortiums org group '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configtxgen/encoder/encoder.go","lineNumber":305,"sourceCode":"}\n\n// NewConsortiumOrgGroup returns an org component of the channel configuration.  It defines the crypto material for the\n// organization (its MSP).  It sets the mod_policy of all elements to \"Admins\".\nfunc NewConsortiumOrgGroup(conf *genesisconfig.Organization) (*cb.ConfigGroup, error) {\n\tconsortiumsOrgGroup := protoutil.NewConfigGroup()\n\tconsortiumsOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey\n\n\tif conf.SkipAsForeign {\n\t\treturn consortiumsOrgGroup, nil\n\t}\n\n\tmspConfig, err := msp.GetVerifyingMspConfig(conf.MSPDir, conf.ID, conf.MSPType)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"1 - Error loading MSP configuration for org: %s\", conf.Name)\n\t}\n\n\tif err := AddPolicies(consortiumsOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {\n\t\treturn nil, errors.Wrapf(err, \"error adding policies to consortiums org group '%s'\", conf.Name)\n\t}\n\n\taddValue(consortiumsOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)\n\n\treturn consortiumsOrgGroup, nil\n}\n\n// NewOrdererOrgGroup returns an orderer org component of the channel configuration.  It defines the crypto material for the\n// organization (its MSP).  It sets the mod_policy of all elements to \"Admins\".\n// channelCapabilities map[string]bool\nfunc NewOrdererOrgGroup(conf *genesisconfig.Organization, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {\n\tordererOrgGroup := protoutil.NewConfigGroup()\n\tordererOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey\n\n\tif conf.SkipAsForeign {\n\t\treturn ordererOrgGroup, nil\n\t}\n","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/configtxgen/encoder/encoder.go#L287-L323","documentation":"After loading the org MSP, NewConsortiumOrgGroup adds the org's policies (Readers/Writers/Admins) to the consortium org group via AddPolicies. If any policy in conf.Policies is malformed or references unknown principals, the failure is wrapped with this message.","triggerScenarios":"A consortium member org defines a policy in configtx.yaml (e.g. Readers/Admins) with invalid syntax, a signature rule referencing a nonexistent principal, or a missing required Admins policy needed for channelconfig.AdminsPolicyKey.","commonSituations":"Hand-edited policy signature rules (e.g. wrong 'OR(' / 'AND(' syntax), referencing an MSP role like 'Member' for an MSP not defined, YAML indentation errors putting policies under the wrong org, v1-to-v2 policy syntax changes.","solutions":["Review the org's Policies block in configtx.yaml for syntax and principal errors; compare against fabric-samples/configtx templates.","Ensure an Admins policy is defined for the org (it is required when adding the MSP value).","Regenerate configtx.yaml from the sample to get known-good policy definitions.","Use `configtxgen -printOrg` to validate the org config before including it in a consortium."],"exampleFix":"// before (malformed policy)\nPolicies:\n  Readers:\n    Type: Signature\n    Rule: OR(Org1MSP.member, Org2MSP.member\n// after\nPolicies:\n  Readers:\n    Type: Signature\n    Rule: \"OR('Org1MSP.member','Org2MSP.member')\"","handlingStrategy":"validation","validationCode":"required := []string{\"Readers\", \"Writers\", \"Admins\"}\nfor _, p := range required {\n    if _, ok := conf.Policies[p]; !ok {\n        return fmt.Errorf(\"org %s is missing required policy %s\", conf.Name, p)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := AddPolicies(group, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {\n    return fmt.Errorf(\"org %s: invalid policy definition (%v): %w\", conf.Name, conf.Policies, err)\n}","preventionTips":["Quote policy rules: Rule: \"OR('Org1MSP.member')\"","Always define Readers, Writers, and Admins policies per org","Copy policy blocks verbatim from fabric-samples instead of hand-writing","Test the org with `configtxgen -printOrg` before including it in a consortium"],"tags":["hyperledger-fabric","configtxgen","policy","configuration"],"backgroundTag":"policy-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}