0 sub-policies were satisfied, but this policy requires 1 of the ‘Admins‘

前情提要

今天在使用peer来创建通道的时候，报了如下的错误

2021-07-02 10:27:43.446 CST [common.deliver] Handle -> WARN 01a Error reading from 192.168.81.134:46572: rpc error: code = Canceled desc = context canceled
2021-07-02 10:27:43.447 CST [comm.grpc.server] 1 -> INFO 01b streaming call completed grpc.service=orderer.AtomicBroadcast grpc.method=Deliver grpc.peer_address=192.168.81.134:46572 error="rpc error: code = Canceled desc = context canceled" grpc.code=Canceled grpc.call_duration=6.21135ms
2021-07-02 10:27:45.623 CST [cauthdsl] deduplicate -> ERRO 01c Principal deserialization failure (MSP OrdererMSP is unknown) for identity 0
2021-07-02 10:27:45.623 CST [orderer.common.broadcast] ProcessMessage -> WARN 01d [channel: mychannel] Rejecting broadcast of config message from 192.168.81.134:46578 because of error: implicit policy evaluation failed - 0 sub-policies were satisfied, but this policy requires 1 of the 'Writers' sub-policies to be satisfied: permission denied
2021-07-02 10:27:45.623 CST [comm.grpc.server] 1 -> INFO 01e streaming call completed grpc.service=orderer.AtomicBroadcast grpc.method=Broadcast grpc.peer_address=192.168.81.134:46578 grpc.code=OK grpc.call_duration=2.682517ms

问题分析

对百度和google进行一番搜查：（0 sub-policies were satisfied, but this policy requires 1 of the ‘Admins’ sub-policies to be）

网上说有如下几个办法，都不是对的，至少对于我不是正确的：

• 1、解决方案: configtx.yaml Capabilities段落不正确，参考官方版本；实际上，我觉得这个加不加都无所谓，最后成功的configtx.json我也没写这个段
• 2、原因通过configtxgen命令生成创世区块时使用的通道名与创建通道时使用的通道名一样；我在创建创世块.block文件的时候并未带上-channelID name，使用的命令为…/bin/configtxgen -profile configtx.json -profile TwoOrgsOrdererGenesis -outputBlock ./genesis.block；默认会自动选择testchild的

正确应该排查的原因有如下三个

• 1、配置文件中orderer的LocalMSPID是否一致，比如我用的是OrdererMSP，但在configtx.json中写的却是OrderersMSP（也是这个没有定义成模板导致的问题）
• 2、一个就是我生成genesis.block的时候，并未指定配置文件；错误的时候使用： …/bin/configtxgen -profile TwoOrgsOrdererGenesis -outputBlock ./genesis.block -channelID mychannel；正确的应该为：…/bin/configtxgen -profile configtx.json -profile TwoOrgsOrdererGenesis -outputBlock ./genesis.block
• 3、检查一下configtx.json文件，因为我是web后端自己生成的configtx.json，这个configtx.json用的是配置文件的形式，在异步调用的时候有些参数是@4打头的，自己没处理好异步，模板还没被替换过来，就被用来生成genesis.block了，当然会报错

最后吐槽一下orderer的日志，咋什么都报：

ERRO 01c Principal deserialization failure (MSP OrdererMSP is unknown) for identity 0
2021-07-02 10:27:45.623 CST [orderer.common.broadcast] ProcessMessage -> WARN 01d [channel: mychannel] Rejecting broadcast of config message from 192.168.81.134:46578 because of error: implicit policy evaluation failed - 0 sub-policies were satisfied, but this policy requires 1 of the 'Writers' sub-policies to be satisfied: permission denied

上面的问题也报的这个提示，当一个节点没有权限的时候也提示的这个。

最后贴一下我最终生成的configtx.json

{"Organizations": [{"Name": "OrderersMSP","ID": "OrderersMSP","MSPDir": "./crypto-config/ordererOrganizations/zeng.com/msp","Policies": {"Readers": {"Type": "Signature","Rule": "OR('OrderersMSP.member')"},"Writers": {"Type": "Signature","Rule": "OR('OrderersMSP.member')"},"Admins": {"Type": "Signature","Rule": "OR('OrderersMSP.admin')"}}},{"Name": "Org1MSP","ID": "Org1MSP","MSPDir": "./crypto-config/peerOrganizations/org1.zeng.com/msp","Policies": {"Readers": {"Type": "Signature","Rule": "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')"},"Writers": {"Type": "Signature","Rule": "OR('Org1MSP.admin', 'Org1MSP.client')"},"Admins": {"Type": "Signature","Rule": "OR('Org1MSP.admin')"}},"AnchorPeers": []},{"Name": "Org2MSP","ID": "Org2MSP","MSPDir": "./crypto-config/peerOrganizations/org2.zeng.com/msp","Policies": {"Readers": {"Type": "Signature","Rule": "OR('Org2MSP.admin', 'Org2MSP.peer', 'Org2MSP.client')"},"Writers": {"Type": "Signature","Rule": "OR('Org2MSP.admin', 'Org2MSP.client')"},"Admins": {"Type": "Signature","Rule": "OR('Org2MSP.admin')"}},"AnchorPeers": []}],"Orderer": {"OrdererType": "solo","Addresses": ["orderer.zeng.com:7050"],"BatchTimeout": "2s","BatchSize": {"MaxMessageCount": 10,"AbsoluteMaxBytes": "99 MB","PreferredMaxBytes": "512 KB"},"Organizations": null,"Policies": {"Readers": {"Type": "ImplicitMeta","Rule": "ANY Readers"},"Writers": {"Type": "ImplicitMeta","Rule": "ANY Writers"},"Admins": {"Type": "ImplicitMeta","Rule": "MAJORITY Admins"},"BlockValidation": {"Type": "ImplicitMeta","Rule": "ANY Writers"}}},"Application": {"Organizations": null},"Profiles": {"TwoOrgsOrdererGenesis": {"Orderer": {"OrdererType": "solo","Addresses": ["orderer.zeng.com:7050"],"BatchTimeout": "2s","BatchSize": {"MaxMessageCount": 10,"AbsoluteMaxBytes": "99 MB","PreferredMaxBytes": "512 KB"},"Organizations": {"Name": "OrderersMSP","ID": "OrderersMSP","MSPDir": "./crypto-config/ordererOrganizations/zeng.com/msp","Policies": {"Readers": {"Type": "Signature","Rule": "OR('OrderersMSP.member')"},"Writers": {"Type": "Signature","Rule": "OR('OrderersMSP.member')"},"Admins": {"Type": "Signature","Rule": "OR('OrderersMSP.admin')"}}},"Policies": {"Readers": {"Type": "ImplicitMeta","Rule": "ANY Readers"},"Writers": {"Type": "ImplicitMeta","Rule": "ANY Writers"},"Admins": {"Type": "ImplicitMeta","Rule": "MAJORITY Admins"},"BlockValidation": {"Type": "ImplicitMeta","Rule": "ANY Writers"}}},"Consortiums": {"SampleConsortium": {"Organizations": [{"Name": "Org1MSP","ID": "Org1MSP","MSPDir": "./crypto-config/peerOrganizations/org1.zeng.com/msp","AnchorPeers": []},{"Name": "Org2MSP","ID": "Org2MSP","MSPDir": "./crypto-config/peerOrganizations/org2.zeng.com/msp","AnchorPeers": []}]}}},"TwoOrgsChannel": {"Consortium": "SampleConsortium","Application": {"Organizations": [{"Name": "Org1MSP","ID": "Org1MSP","MSPDir": "./crypto-config/peerOrganizations/org1.zeng.com/msp","AnchorPeers": []},{"Name": "Org2MSP","ID": "Org2MSP","MSPDir": "./crypto-config/peerOrganizations/org2.zeng.com/msp","AnchorPeers": []}]}}}
}

参考链接

• 成功解决0 sub-policies were satisfied, but this policy requires 1 of the ‘Writers‘ sub-policies to be sa
• Error: got unexpected status: FORBIDDEN — Failed to reach implicit threshold of 1 sub-policies, required 1 remaining: permission denied
• hyperledger fabric在创建peer通道时出现this policy requires 1 of the ‘Writers’ sub-policies to be
• 踩坑总结（七）