hyperledger/fabric · error

error adding policies to consortiums org group '%s'

Error message

error adding policies to consortiums org group '%s'

What it means

After loading the org MSP, NewConsortiumOrgGroup adds the org's policies (Readers/Writers/Admins) to the consortium org group via AddPolicies. If any policy in conf.Policies is malformed or references unknown principals, the failure is wrapped with this message.

Source

Thrown at internal/configtxgen/encoder/encoder.go:305

}

// NewConsortiumOrgGroup returns an org component of the channel configuration.  It defines the crypto material for the
// organization (its MSP).  It sets the mod_policy of all elements to "Admins".
func NewConsortiumOrgGroup(conf *genesisconfig.Organization) (*cb.ConfigGroup, error) {
	consortiumsOrgGroup := protoutil.NewConfigGroup()
	consortiumsOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey

	if conf.SkipAsForeign {
		return consortiumsOrgGroup, nil
	}

	mspConfig, err := msp.GetVerifyingMspConfig(conf.MSPDir, conf.ID, conf.MSPType)
	if err != nil {
		return nil, errors.Wrapf(err, "1 - Error loading MSP configuration for org: %s", conf.Name)
	}

	if err := AddPolicies(consortiumsOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
		return nil, errors.Wrapf(err, "error adding policies to consortiums org group '%s'", conf.Name)
	}

	addValue(consortiumsOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)

	return consortiumsOrgGroup, nil
}

// NewOrdererOrgGroup returns an orderer org component of the channel configuration.  It defines the crypto material for the
// organization (its MSP).  It sets the mod_policy of all elements to "Admins".
// channelCapabilities map[string]bool
func NewOrdererOrgGroup(conf *genesisconfig.Organization, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {
	ordererOrgGroup := protoutil.NewConfigGroup()
	ordererOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey

	if conf.SkipAsForeign {
		return ordererOrgGroup, nil
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Review the org's Policies block in configtx.yaml for syntax and principal errors; compare against fabric-samples/configtx templates.
2. Ensure an Admins policy is defined for the org (it is required when adding the MSP value).
3. Regenerate configtx.yaml from the sample to get known-good policy definitions.
4. Use `configtxgen -printOrg` to validate the org config before including it in a consortium.

Example fix

// before (malformed policy)
Policies:
  Readers:
    Type: Signature
    Rule: OR(Org1MSP.member, Org2MSP.member
// after
Policies:
  Readers:
    Type: Signature
    Rule: "OR('Org1MSP.member','Org2MSP.member')"

required := []string{"Readers", "Writers", "Admins"}
for _, p := range required {
    if _, ok := conf.Policies[p]; !ok {
        return fmt.Errorf("org %s is missing required policy %s", conf.Name, p)
    }
}

if err := AddPolicies(group, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
    return fmt.Errorf("org %s: invalid policy definition (%v): %w", conf.Name, conf.Policies, err)
}

When it happens

Trigger: A consortium member org defines a policy in configtx.yaml (e.g. Readers/Admins) with invalid syntax, a signature rule referencing a nonexistent principal, or a missing required Admins policy needed for channelconfig.AdminsPolicyKey.

Common situations: Hand-edited policy signature rules (e.g. wrong 'OR(' / 'AND(' syntax), referencing an MSP role like 'Member' for an MSP not defined, YAML indentation errors putting policies under the wrong org, v1-to-v2 policy syntax changes.

Related errors

• Empty policy element
• 1 - Error loading MSP configuration for org: %s
• error adding policies to orderer org group '%s'
• supplied system channel group is missing '%s' consortium
• supplied channel creation profile does not contain an applic

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/cff77a9327f1dd3f. Report an issue: GitHub.