hyperledger/fabric · error

error adding policies to consortiums org group

Error message

error adding policies to consortiums org group '%s'

What it means

After loading the org MSP, NewConsortiumOrgGroup adds the org's policies (Readers/Writers/Admins) to the consortium org group via AddPolicies. If any policy in conf.Policies is malformed or references unknown principals, the failure is wrapped with this message.

Solutions

1. Review the org's Policies block in configtx.yaml for syntax and principal errors; compare against fabric-samples/configtx templates.
2. Ensure an Admins policy is defined for the org (it is required when adding the MSP value).
3. Regenerate configtx.yaml from the sample to get known-good policy definitions.
4. Use `configtxgen -printOrg` to validate the org config before including it in a consortium.

Example fix

// before (malformed policy)
Policies:
  Readers:
    Type: Signature
    Rule: OR(Org1MSP.member, Org2MSP.member
// after
Policies:
  Readers:
    Type: Signature
    Rule: "OR('Org1MSP.member','Org2MSP.member')"

required := []string{"Readers", "Writers", "Admins"}
for _, p := range required {
    if _, ok := conf.Policies[p]; !ok {
        return fmt.Errorf("org %s is missing required policy %s", conf.Name, p)
    }
}

if err := AddPolicies(group, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
    return fmt.Errorf("org %s: invalid policy definition (%v): %w", conf.Name, conf.Policies, err)
}

When it happens

Trigger: A consortium member org defines a policy in configtx.yaml (e.g. Readers/Admins) with invalid syntax, a signature rule referencing a nonexistent principal, or a missing required Admins policy needed for channelconfig.AdminsPolicyKey.

Common situations: Hand-edited policy signature rules (e.g. wrong 'OR(' / 'AND(' syntax), referencing an MSP role like 'Member' for an MSP not defined, YAML indentation errors putting policies under the wrong org, v1-to-v2 policy syntax changes.

Related errors

• 1 - Error loading MSP configuration for org
• Empty policy element
• error adding policies to orderer org group
• supplied channel creation profile does not contain an…
• supplied system channel group is missing

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/cff77a9327f1dd3f. Report an issue: GitHub.

Appendix: source

Thrown at internal/configtxgen/encoder/encoder.go:305

}

// NewConsortiumOrgGroup returns an org component of the channel configuration.  It defines the crypto material for the
// organization (its MSP).  It sets the mod_policy of all elements to "Admins".
func NewConsortiumOrgGroup(conf *genesisconfig.Organization) (*cb.ConfigGroup, error) {
	consortiumsOrgGroup := protoutil.NewConfigGroup()
	consortiumsOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey

	if conf.SkipAsForeign {
		return consortiumsOrgGroup, nil
	}

	mspConfig, err := msp.GetVerifyingMspConfig(conf.MSPDir, conf.ID, conf.MSPType)
	if err != nil {
		return nil, errors.Wrapf(err, "1 - Error loading MSP configuration for org: %s", conf.Name)
	}

	if err := AddPolicies(consortiumsOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
		return nil, errors.Wrapf(err, "error adding policies to consortiums org group '%s'", conf.Name)
	}

	addValue(consortiumsOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)

	return consortiumsOrgGroup, nil
}

// NewOrdererOrgGroup returns an orderer org component of the channel configuration.  It defines the crypto material for the
// organization (its MSP).  It sets the mod_policy of all elements to "Admins".
// channelCapabilities map[string]bool
func NewOrdererOrgGroup(conf *genesisconfig.Organization, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {
	ordererOrgGroup := protoutil.NewConfigGroup()
	ordererOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey

	if conf.SkipAsForeign {
		return ordererOrgGroup, nil
	}

View on GitHub (pinned to 2736b63f8f)