hyperledger/fabric · error

error adding policies to orderer group

Error message

error adding policies to orderer group

What it means

NewOrdererGroup wraps failures from AddOrdererPolicies, which builds the policy set (e.g. the Admins policy) for the orderer config group. When policy construction fails — typically because a named policy is invalid or a referenced signature policy cannot be parsed — the encoder returns this wrapper message. The underlying cause is in the wrapped error.

Source

Thrown at internal/configtxgen/encoder/encoder.go:195

	channelGroup.ModPolicy = channelconfig.AdminsPolicyKey
	return channelGroup, nil
}

// NewOrdererGroup returns the orderer component of the channel configuration.  It defines parameters of the ordering service
// about how large blocks should be, how frequently they should be emitted, etc. as well as the organizations of the ordering network.
// It sets the mod_policy of all elements to "Admins".  This group is always present in any channel configuration.
func NewOrdererGroup(conf *genesisconfig.Orderer, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {
	if conf.OrdererType == "BFT" && !channelCapabilities["V3_0"] {
		return nil, errors.Errorf("orderer type BFT must be used with V3_0 channel capability: %v", channelCapabilities)
	}
	if len(conf.Addresses) > 0 && channelCapabilities["V3_0"] {
		return nil, errors.Errorf("global orderer endpoints exist, but can not be used with V3_0 capability: %v", conf.Addresses)
	}

	ordererGroup := protoutil.NewConfigGroup()
	if err := AddOrdererPolicies(ordererGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
		return nil, errors.Wrapf(err, "error adding policies to orderer group")
	}
	addValue(ordererGroup, channelconfig.BatchSizeValue(
		conf.BatchSize.MaxMessageCount,
		conf.BatchSize.AbsoluteMaxBytes,
		conf.BatchSize.PreferredMaxBytes,
	), channelconfig.AdminsPolicyKey)
	addValue(ordererGroup, channelconfig.BatchTimeoutValue(conf.BatchTimeout.String()), channelconfig.AdminsPolicyKey)
	addValue(ordererGroup, channelconfig.ChannelRestrictionsValue(conf.MaxChannels), channelconfig.AdminsPolicyKey)

	if len(conf.Capabilities) > 0 {
		addValue(ordererGroup, channelconfig.CapabilitiesValue(conf.Capabilities), channelconfig.AdminsPolicyKey)
	}

	var consensusMetadata []byte
	var err error

	switch conf.OrdererType {
	case ConsensusTypeSolo:

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Read the wrapped cause appended after this message — it names which policy failed and why
2. Restore the standard policy block (Readers/Writers/Admins) from the Fabric sample configtx.yaml
3. Validate your YAML structure: each policy needs Reader/Writer/Rule syntax exactly as in the samples
4. Regenerate with configtxgen once the policy definitions are fixed

Example fix

# before
Policies:
    Admins:
        Type: Signature
        Rule: "BAD SYNTAX"
# after
Policies:
    Admins:
        Type: Signature
        Rule: "OR('OrdererMSP.admin')"

func validateOrdererPolicies(conf *genesisconfig.Orderer) error {
    for name, pol := range conf.Policies {
        if pol.Rule == nil || pol.Rule.Type == 0 {
            return fmt.Errorf("orderer policy %q has empty or invalid rule", name)
        }
    }
    return nil
}

func hasPolicy(policies map[string]*genesisconfig.Policy, key string) bool {
    p, ok := policies[key]
    return ok && p != nil && p.Rule != nil
}

group, err := encoder.NewOrdererGroup(conf, caps)
if err != nil {
    var wrapped interface{ Unwrap() error }
    if errors.As(err, &wrapped) { /* log the cause: names the failing policy */ }
    return err
}

When it happens

Trigger: NewOrdererGroup is called with conf.Policies containing an orderer policy definition that AddOrdererPolicies fails to build, e.g. malformed implicitmeta or signature policies in configtx.yaml Orderer.Policies.

Common situations: Hand-edited configtx.yaml policy blocks: wrong indentation, invalid policy syntax (e.g. bad 'OR(...)' expressions), referencing undefined MSPs, or typos in policy names/keys.

Related errors

• organization %s not found
• error marshalling msp role: %s
• unrecognized type, expected a principal or a policy, got %s
• unrecognized token '%s' in policy string
• invalid policy string '%s'

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/5f2e702504988cf5. Report an issue: GitHub.