hyperledger/fabric · error

administrators must be declared when no admin ou classificat

Error message

administrators must be declared when no admin ou classification is set

What it means

setupAdminsV142 enforces that an MSP has administrators either via explicit admin certificates or via OU-based admin classification (adminOU). If msp.admins is empty AND (OU enforcement is off or no admin OU is configured), the MSP would have no admins, which is rejected.

Source

Thrown at msp/mspimplsetup.go:195

		id, _, err := msp.getIdentityFromConf(admCert)
		if err != nil {
			return err
		}

		msp.admins[i] = id
	}

	return nil
}

func (msp *bccspmsp) setupAdminsV142(conf *m.FabricMSPConfig) error {
	// make and fill the set of admin certs (if present)
	if err := msp.setupAdminsPreV142(conf); err != nil {
		return err
	}

	if len(msp.admins) == 0 && (!msp.ouEnforcement || msp.adminOU == nil) {
		return errors.New("administrators must be declared when no admin ou classification is set")
	}

	return nil
}

func isECDSASignatureAlgorithm(algid asn1.ObjectIdentifier) bool {
	// This is the set of ECDSA algorithms supported by Go 1.14 for CRL
	// signatures.
	ecdsaSignaureAlgorithms := []asn1.ObjectIdentifier{
		{1, 2, 840, 10045, 4, 1},    // oidSignatureECDSAWithSHA1
		{1, 2, 840, 10045, 4, 3, 2}, // oidSignatureECDSAWithSHA256
		{1, 2, 840, 10045, 4, 3, 3}, // oidSignatureECDSAWithSHA384
		{1, 2, 840, 10045, 4, 3, 4}, // oidSignatureECDSAWithSHA512
	}
	for _, id := range ecdsaSignaureAlgorithms {
		if id.Equal(algid) {
			return true
		}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Add at least one admin certificate to the MSP admincerts/ directory and config.Admins
2. Or enable NodeOUs and set FabricNodeOus.AdminOuIdentifier with a valid OU and certificate
3. If intending no admins, configure the admin OU classification first, then remove static certs
4. Regenerate the org MSP definition in configtx.yaml with either admins or admin OU set

Example fix

// before: no admincerts, no AdminOuIdentifier
// after
// FabricNodeOus:
//   Enable: true
//   AdminOUIdentifier:
//     OrganizationalUnitIdentifier: admin
//     Certificate: cacerts/ca.pem
null

hasAdmins := len(conf.Admins) > 0
hasAdminOU := conf.FabricNodeOus != nil && conf.FabricNodeOus.Enable &&
    conf.FabricNodeOus.AdminOuIdentifier != nil &&
    len(conf.FabricNodeOus.AdminOuIdentifier.OrganizationalUnitIdentifier) > 0
if !hasAdmins && !hasAdminOU {
    return errors.New("org must define admin certs or an AdminOuIdentifier")
}

When it happens

Trigger: FabricMSPConfig has no admincerts and either FabricNodeOus.Enable is false or FabricNodeOus.AdminOuIdentifier is unset when setting up an MSP with the V142 setup path.

Common situations: Organizations intentionally removing static admin certs after enabling NodeOUs but forgetting to set the AdminOuIdentifier; migrating MSP config from pre-V1.4.2 format; configtx.yaml organization with empty admincerts list.

Related errors

• Failed adding OU. Certificate [%v] not in root or intermedia
• Failed setting up NodeOUs. ClientOU must be different from n
• NodeOUs not activated. Cannot tell apart identities.
• Identity type not recognized
• Failed getting certificate for [%v]: [%s]

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/843700f38fb8e92f. Report an issue: GitHub.