hyperledger/fabric · error

Unmapped channelless policy for %s

Error message

Unmapped channelless policy for %s

What it means

CheckACLNoChannel handles channelless resources (peer-level operations like join chaincode or admin operations) by looking the resource up in pResourcePolicyMap. If no default policy is registered for the given resource name, evaluation cannot proceed and this error is returned.

Source

Thrown at core/aclmgmt/defaultaclprovider.go:163

			return err
		}
		return d.policyChecker.CheckPolicyBySignedData(channelID, policy, sd)
	case *protoutil.SignedData:
		return d.policyChecker.CheckPolicyBySignedData(channelID, policy, []*protoutil.SignedData{typedData})
	case []*protoutil.SignedData:
		return d.policyChecker.CheckPolicyBySignedData(channelID, policy, typedData)
	default:
		aclLogger.Errorf("Unmapped id on checkACL %s", resName)
		return fmt.Errorf("Unknown id on checkACL %s", resName)
	}
}

// CheckACLNoChannel provides default behavior by mapping channelless resources to their ACL.
func (d *defaultACLProviderImpl) CheckACLNoChannel(resName string, idinfo any) error {
	policy := d.pResourcePolicyMap[resName]
	if policy == "" {
		aclLogger.Errorf("Unmapped channelless policy for %s", resName)
		return fmt.Errorf("Unmapped channelless policy for %s", resName)
	}

	switch typedData := idinfo.(type) {
	case *pb.SignedProposal:
		return d.policyChecker.CheckPolicyNoChannel(policy, typedData)
	case *common.Envelope:
		sd, err := protoutil.EnvelopeAsSignedData(typedData)
		if err != nil {
			return err
		}
		return d.policyChecker.CheckPolicyNoChannelBySignedData(policy, sd)
	case []*protoutil.SignedData:
		return d.policyChecker.CheckPolicyNoChannelBySignedData(policy, typedData)
	default:
		aclLogger.Errorf("Unmapped id on channelless checkACL %s", resName)
		return fmt.Errorf("Unknown id on channelless checkACL %s", resName)
	}
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Use the channel-based CheckACL for channel-scoped resources instead of CheckACLNoChannel.
2. Verify the resource constant against aclmgmt/resources definitions for your Fabric version.
3. If the resource is legitimately channelless, add a mapping in peer config/defaultaclprovider registration.
4. Read the logged resource name from 'Unmapped channelless policy for <res>' and correct it.

var channellessResources = map[string]bool{
    aclmgmt.Resources_Proposer: true,
    // ... populate from defaultaclprovider pResourcePolicyMap registrations
}
if !channellessResources[resName] {
    return fmt.Errorf("resource %q is not a channelless resource", resName)
}

if err := aclProvider.CheckACLNoChannel(resName, idinfo); err != nil {
    if strings.HasPrefix(err.Error(), "Unmapped channelless policy") {
        return fmt.Errorf("%q is not channelless; use CheckACL instead", resName)
    }
    return err
}

When it happens

Trigger: Calling CheckACLNoChannel(resName, idinfo) with a resource string not present in pResourcePolicyMap — e.g. a channel-scoped resource mistakenly passed to the channelless provider, or a typo in resource name.

Common situations: Custom chaincode/services calling the channelless variant with resources like _lifecycle/* that are channel-scoped; Fabric version mismatch where the channelless resource was renamed; hand-written resource constants.

Related errors

• Unmapped policy for %s
• Unknown id on checkACL %s
• Unknown id on channelless checkACL %s
• could not find policy %s
• permission denied

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/36cf3fef96e1ddda. Report an issue: GitHub.