hyperledger/fabric · error

error adding policies to orderer org group '%s'

Error message

error adding policies to orderer org group '%s'

What it means

In NewOrdererOrgGroup, after the MSP config loads, AddPolicies registers the org's Readers/Writers/Admins policies on the orderer org group. A malformed or missing policy definition causes this wrapped error, aborting genesis/printOrg generation.

Source

Thrown at internal/configtxgen/encoder/encoder.go:330

// NewOrdererOrgGroup returns an orderer org component of the channel configuration.  It defines the crypto material for the
// organization (its MSP).  It sets the mod_policy of all elements to "Admins".
// channelCapabilities map[string]bool
func NewOrdererOrgGroup(conf *genesisconfig.Organization, channelCapabilities map[string]bool) (*cb.ConfigGroup, error) {
	ordererOrgGroup := protoutil.NewConfigGroup()
	ordererOrgGroup.ModPolicy = channelconfig.AdminsPolicyKey

	if conf.SkipAsForeign {
		return ordererOrgGroup, nil
	}

	mspConfig, err := msp.GetVerifyingMspConfig(conf.MSPDir, conf.ID, conf.MSPType)
	if err != nil {
		return nil, errors.Wrapf(err, "1 - Error loading MSP configuration for org: %s", conf.Name)
	}

	if err := AddPolicies(ordererOrgGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
		return nil, errors.Wrapf(err, "error adding policies to orderer org group '%s'", conf.Name)
	}

	addValue(ordererOrgGroup, channelconfig.MSPValue(mspConfig), channelconfig.AdminsPolicyKey)

	if len(conf.OrdererEndpoints) > 0 {
		addValue(ordererOrgGroup, channelconfig.EndpointsValue(conf.OrdererEndpoints), channelconfig.AdminsPolicyKey)
	} else if channelCapabilities["V3_0"] {
		return nil, errors.Errorf("orderer endpoints for organization %s are missing and must be configured when capability V3_0 is enabled", conf.Name)
	}

	return ordererOrgGroup, nil
}

// NewApplicationGroup returns the application component of the channel configuration.  It defines the organizations which are involved
// in application logic like chaincodes, and how these members may interact with the orderer.  It sets the mod_policy of all elements to "Admins".
func NewApplicationGroup(conf *genesisconfig.Application) (*cb.ConfigGroup, error) {
	applicationGroup := protoutil.NewConfigGroup()
	if err := AddPolicies(applicationGroup, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Validate the Orderer org Policies block in configtx.yaml: correct Type (Signature/ImplicitMeta) and Rule syntax, with quotes around OR/AND expressions.
2. Ensure the Admins policy is defined for the orderer org.
3. Compare against fabric-samples first-network configtx.yaml policy templates and adopt them.
4. Run `configtxgen -printOrg OrdererOrgMSP` to surface the exact failing policy.

Example fix

// before
Policies:
  Admins:
    Type: Signature
    Rule: OR(OrdererMSP.admin
// after
Policies:
  Admins:
    Type: Signature
    Rule: "OR('OrdererMSP.admin')"

if _, ok := conf.Policies["Admins"]; !ok {
    return fmt.Errorf("orderer org %s must define an Admins policy", conf.Name)
}
for name, pol := range conf.Policies {
    if pol.Type == "Signature" && !strings.Contains(pol.Rule, "'") {
        log.Printf("warning: org %s policy %s rule should quote principals: %s", conf.Name, name, pol.Rule)
    }
}

if err := AddPolicies(group, conf.Policies, channelconfig.AdminsPolicyKey); err != nil {
    return fmt.Errorf("orderer org %s: invalid policies %v: %w", conf.Name, conf.Policies, err)
}

When it happens

Trigger: An Orderer org in configtx.yaml defines Policies with invalid rule syntax, references principals whose MSP is not loaded, or omits the Admins policy required by channelconfig.AdminsPolicyKey.

Common situations: YAML indentation placing policies at the wrong level; signature rules with unquoted special characters; stale v1 policy syntax after upgrading to Fabric v2.x; copying peer-org policies that reference peer MSP IDs into an orderer org.

Related errors

• error adding policies to consortiums org group '%s'
• malformed org definition for org: %s
• organization %s not found
• Empty policy element
• OrdererOrg config does not allow sub-groups

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/1d824369be2bff21. Report an issue: GitHub.