{"record":{"id":"f72293c92dab0117","repo":"hyperledger/fabric","slug":"discovery-service-refused-our-request","errorCode":null,"errorMessage":"discovery service refused our Request","messagePattern":"discovery service refused our Request","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/client/client.go","lineNumber":183,"sourceCode":"\t}\n\n\tsig, err := c.signRequest(payload)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed signing Request\")\n\t}\n\n\tconn, err := c.createConnection()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed connecting to discovery service\")\n\t}\n\n\tcl := discovery.NewDiscoveryClient(conn)\n\tresp, err := cl.Discover(ctx, &discovery.SignedRequest{\n\t\tPayload:   payload,\n\t\tSignature: sig,\n\t})\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"discovery service refused our Request\")\n\t}\n\tif n := len(resp.Results); n != req.lastIndex {\n\t\treturn nil, errors.Errorf(\"Sent %d queries but received %d responses back\", req.lastIndex, n)\n\t}\n\treturn req.computeResponse(resp)\n}\n\ntype resultOrError any\n\ntype response map[key]resultOrError\n\ntype localResponse struct {\n\tresponse\n}\n\nfunc (cr *localResponse) Peers() ([]*Peer, error) {\n\treturn parsePeers(protoext.LocalMembershipQueryType, cr.response, \"\")\n}","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/discovery/client/client.go#L165-L201","documentation":"Client.Send in discovery/client/client.go:183 invokes the gRPC Discover RPC; if the server returns an error or the RPC fails, it is wrapped with 'discovery service refused our Request'. This happens after successful connect/serialize/sign, so the rejection comes from the server side (auth, channel, or request content).","triggerScenarios":"The Discover RPC returns a non-nil error: authentication failure (signature doesn't match the identity/TLS cert), unknown channel in the query, ineligible identity for the requested service, or server-side panic/stream error.","commonSituations":"Client identity not enrolled on the peer (peer.membership access control); AuthInfo identity mismatch with the actual TLS client cert; querying a channel the peer isn't a member of; discovery auth cache rejecting stale credentials.","solutions":["Inspect the wrapped underlying gRPC error for the server's specific reason (authentication/channel not found)","Ensure the AuthInfo identity matches the signer identity and, under mutual TLS, matches the TLS client certificate","Verify the client identity belongs to an organization allowed to use discovery on that channel (channel policies/acl)","Confirm the channel name in the queries exists on the target peer"],"exampleFix":"// before: TLS cert identity differs from signing identity\nauth := &discovery.AuthInfo{ClientIdentity: idA} // signed by signerB\n\n// after: same identity for AuthInfo and signing\nauth := &discovery.AuthInfo{ClientIdentity: idA}\nsigner := signerForIdentity(idA)","handlingStrategy":"retry","validationCode":"if auth.ClientIdentity == nil || !bytes.Equal(auth.ClientIdentity, signedIdentityBytes) {\n    return errors.New(\"AuthInfo identity must match the signing identity and TLS client cert\")\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Send(ctx, req, auth)\nif err != nil && strings.Contains(err.Error(), \"discovery service refused our Request\") {\n    // inspect wrapped gRPC status; fix identity/acl/channel, then retry\n}","preventionTips":["Use the same identity for AuthInfo, signing, and (mutual TLS) client certificate","Enroll the client identity with the peer's MSP and verify channel ACLs allow discovery","Confirm channel names in queries exist on the peer"],"tags":["hyperledger-fabric","discovery-client","grpc","authentication"],"backgroundTag":"grpc-unavailable","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}