Failed to install chaincode on local network - error "This identity is not an admin"

[Ksloveyuan]

I am following the guide and use local network, I create the admin cert by fabric-sample/fabcar's 3 scripts and it works right.

The version I am using: Node 6.9.5 Hyperledger: latest I think, as I setup it from the prerequisites tutorial

But when I try to install chain code, it gives me below error message.

Lius-MacBook-Pro:scripts jeremy$ node install_chaincode.js
info: Loaded config file /Users/jeremy/Programming/github/marbles/config/marbles_local.json
info: Loaded creds file /Users/jeremy/Programming/github/marbles/config/blockchain_creds_local.json
---------------------------------------
info: Lets install some chaincode - marbles v4
---------------------------------------
info: First we enroll
info: [fcw] Going to enroll with admin cert!  peer_urls=[grpc://localhost:7051], channel_id=mychannel, uuid=marbles-Docker Compose Network-mychannel-fabric-peer-org1, orderer_url=grpc://localhost:7050, msp_id=Org1MSP
debug: added peer grpc://localhost:7051
debug: [fcw] Successfully got enrollment marbles-Docker Compose Network-mychannel-fabric-peer-org1
---------------------------------------
info: Now we install
---------------------------------------
debug: [fcw] Installing Chaincode
debug: [fcw] Sending install req targets=[grpc.http2.keepalive_time=300, grpc.keepalive_time_ms=300000, grpc.http2.keepalive_timeout=35, grpc.keepalive_timeout_ms=3500, grpc.primary_user_agent=grpc-node/1.10.0, _url=grpc://localhost:7051, addr=localhost:7051, , _request_timeout=90000, , _name=null], chaincodePath=marbles, chaincodeId=marbles, chaincodeVersion=v4
info: [packager/Golang.js]: packaging GOLANG from marbles
error: [client-utils.js]: sendPeersProposal - Promise is rejected: Error: 2 UNKNOWN: chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
    at new createStatusError (/Users/jeremy/Programming/github/marbles/node_modules/grpc/src/client.js:64:15)
    at /Users/jeremy/Programming/github/marbles/node_modules/grpc/src/client.js:583:15
error: [fcw] Failed to obtain endorsement for transaction. code=2, , details=chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
error: [fcw] Error in install catch block object code=2, , details=chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creatorsatisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
---------------------------------------
info: Install done. Errors: parsed=Blockchain network error - [This identity is not an admin])), raw=[code=2, , details=chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))]
---------------------------------------

I tried to debug, and the certificate I get is the admin's certification.

I am new to hyperledger, I don't know why it complains the [This identity is not an admin])).

[zhulg]

The same problem..

[forestwater]

I am running into the same problem. Could anybody take a look? Thanks!

[fengshenju2018]

I am running into the same problem. Could anybody take a look? Thanks!

[Ksloveyuan]

I find out one thing may help, in Use Local Hyperledger Network,

the container version are 1.0

CONTAINER ID        IMAGE                                     COMMAND                  CREATED              STATUS              PORTS                                            NAMES
8bfa753977b1        dev-peer0.org1.example.com-fabcar-1.0     "chaincode -peer.a..."   About a minute ago   Up About a minute                                                    dev-peer0.org1.example.com-fabcar-1.0
56a7a5f0fb4d        hyperledger/fabric-tools:x86_64-1.0.0     "/bin/bash"              2 minutes ago        Up 2 minutes                                                         cli
b1600301db8f        hyperledger/fabric-peer:x86_64-1.0.0      "peer node start"        2 minutes ago        Up 2 minutes        0.0.0.0:7051->7051/tcp, 0.0.0.0:7053->7053/tcp   peer0.org1.example.com
16c045817270        hyperledger/fabric-orderer:x86_64-1.0.0   "orderer"                2 minutes ago        Up 2 minutes        0.0.0.0:7050->7050/tcp                           orderer.example.com
36fcbc7d2a44        hyperledger/fabric-couchdb:x86_64-1.0.0   "tini -- /docker-e..."   2 minutes ago        Up 2 minutes        4369/tcp, 9100/tcp, 0.0.0.0:5984->5984/tcp       couchdb
a7bd6802bcf4        hyperledger/fabric-ca:x86_64-1.0.0        "sh -c 'fabric-ca-..."   2 minutes ago        Up 2 minutes        0.0.0.0:7054->7054/tcp                           ca.example.com

while I am using the latest version, which is 1.1.

Could anybody take a look? Thanks!

[forestwater]

I am using 1.10 too. @Ksloveyuan

[fengshenju2018]

I am using 1.04 too. @forestwater @Ksloveyuan

[zhulg]

I am using 1.0.6 too @dshuffma-ibm @Ksloveyuan

[CodeToSurvive1]

the same problem

[linghanweiyu]

the same problem

[slugout01]

the same problem

[dshuffma-ibm]

I haven't had time to look at this yet, I'm betting we need to upgrade the SDK though. v1.1.0 is the latest.

[pinvondev]

I have the same problem. My fabric version is v1.1.0.

[Ksloveyuan]

@dhyey-ibm After update package.json and use the latest fabric-client and fabric-client-ca, I got the same error. By the way, the node version is 8.9.4.

[jhsea3do]

I have the same problem. My fabric version is v1.1.0

$ docker ps 
81637d5ea703        dev-peer0.org1.example.com-fabcar-1.0-5c906e402ed29f20260ae42283216aa75549c571e2e380f3615826365d8269ba   "chaincode -peer.add…"   7 hours ago         Up 7 hours                                                           dev-peer0.org1.example.com-fabcar-1.0
0abcd87e91fd        hyperledger/fabric-tools                                                                                 "/bin/bash"              7 hours ago         Up 7 hours                                                           cli
fc02e25b7b5d        hyperledger/fabric-peer                                                                                  "peer node start"        7 hours ago         Up 7 hours          0.0.0.0:7051->7051/tcp, 0.0.0.0:7053->7053/tcp   peer0.org1.example.com
bf2e9d272e53        hyperledger/fabric-ca                                                                                    "sh -c 'fabric-ca-se…"   7 hours ago         Up 7 hours          0.0.0.0:7054->7054/tcp                           ca.example.com
019f9c080929        hyperledger/fabric-couchdb                                                                               "tini -- /docker-ent…"   7 hours ago         Up 7 hours          4369/tcp, 9100/tcp, 0.0.0.0:5984->5984/tcp       couchdb
f00fc49a53be        hyperledger/fabric-orderer                                                                               "orderer"                7 hours ago         Up 7 hours          0.0.0.0:7050->7050/tcp                           orderer.example.com

$ pwd
/home/jhsea3do/workspace/marbles

$ node scripts/install_chaincode.js marbles_local.json marbles v4
....
---------------------------------------
info: Lets install some chaincode - marbles v4
---------------------------------------
info: First we enroll
info: [fcw] Going to enroll with admin cert!  peer_urls=[grpc://localhost:7051], channel_id=mychannel, uuid=marblesDockerComposeNetworkmychannelOrg1MSPfabricpeerorg1, orderer_url=grpc://localhost:7050, msp_id=Org1MSP
debug: added peer grpc://localhost:7051
debug: [fcw] Successfully got enrollment marblesDockerComposeNetworkmychannelOrg1MSPfabricpeerorg1
---------------------------------------
info: Now we install
---------------------------------------
debug: [fcw] Installing Chaincode
debug: [fcw] Sending install req targets=[grpc.http2.keepalive_time=300, grpc.keepalive_time_ms=300000, grpc.http2.keepalive_timeout=35, grpc.keepalive_timeout_ms=3500, grpc.max_receive_message_length=-1, grpc.max_send_message_length=-1, grpc.primary_user_agent=grpc-node/1.10.1, _url=grpc://localhost:7051, addr=localhost:7051, , _request_timeout=90000, , _name=null], chaincodePath=marbles, chaincodeId=marbles, chaincodeVersion=v4
info: [packager/Golang.js]: packaging GOLANG from marbles
error: [client-utils.js]: sendPeersProposal - Promise is rejected: Error: 2 UNKNOWN: chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
    at new createStatusError (/home/jhsea3do/workspace/marbles/node_modules/grpc/src/client.js:64:15)
    at /home/jhsea3do/workspace/marbles/node_modules/grpc/src/client.js:583:15
error: [fcw] Failed to obtain endorsement for transaction. code=2, , details=chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
error: [fcw] Error in install catch block object code=2, , details=chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
---------------------------------------
info: Install done. Errors: parsed=Blockchain network error - [This identity is not an admin])), raw=[code=2, , details=chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))]
---------------------------------------

// config/connection_profile_local.json
{
    "name": "Docker Compose Network",
    "x-networkId": "not-important",
    "x-type": "hlfv1",
    "description": "Connection Profile for an Hyperledger Fabric network on a local machine",
    "version": "1.0.0",
    "client": {
        "organization": "Org1MSP",
        "credentialStore": {
            "path": "/home/jhsea3do/go/src/github.com/hyperledger/fabric-samples/fabcar/hfc-key-store"
        }
    },
    "channels": {
        "mychannel": {
            "orderers": [
                "fabric-orderer"
            ],
            "peers": {
                "fabric-peer-org1": {
                    "endorsingPeer": true,
                    "chaincodeQuery": true,
                    "ledgerQuery": true,
                    "eventSource": true
                }
            },
            "chaincodes": [
                "marbles:v4"
            ],
            "x-blockDelay": 10000
        }
    },
    "organizations": {
        "Org1MSP": {
            "mspid": "Org1MSP",
            "peers": [
                "fabric-peer-org1"
            ],
            "certificateAuthorities": [
                "fabric-ca"
            ],
            "x-certJson": {
                "path": "/home/jhsea3do/go/src/github.com/hyperledger/fabric-samples/fabcar/hfc-key-store/admin"
            }
        }
    },
    "orderers": {
        "fabric-orderer": {
            "url": "grpc://localhost:7050"
        }
    },
    "peers": {
        "fabric-peer-org1": {
            "url": "grpc://localhost:7051",
            "eventUrl": "grpc://localhost:7053"
        }
    },
    "certificateAuthorities": {
        "fabric-ca": {
            "url": "http://localhost:7054",
            "httpOptions": {
                    "trustedRoots": [],
                    "verify": false
            },
            "registrar": [
                {
                    "enrollId": "admin",
                    "enrollSecret": "adminpw"
                }
            ],
            "caName": null
        }
    }
}

[ghost]

Exactly the same problem as well

[694469927]

Has anyone solved this problem

[WuCh1k1n]

the same problem...

[dmohebz]

Exactly the same problem, someone on stackoverflow said that solved it (a similar problem) but I didn't understand that!

https://stackoverflow.com/a/48698606/9596717

I'm new to hyperledger. Any ideas?

[ferrmin]

omg! help!

[ferrmin]

Use crypto files from a locally hosted Hyperledger Fabric Network. These certificates will be created with the fabric-samples example called fabcar. If you have already created the certs you should still re-run this step. Create Crypto Files with Fabcar

[WuCh1k1n]

Could you tell me how to re-run this step in detail?

[ghost]

Yes. We need the solution in details please

[dshuffma-ibm]

alright guys this commit should get you local hyperledger people rolling.

i've changed the connection profile file to use the peer's admin cert from the basic network folder of fabric-samples. you may want to change the path to this cert in your connection profile depending on where you cloned fabric-samples.

this commit has more than just the cp file change. there was also some changes to the parsing of the cp file to navigate the certs folder. i'd recommend to pull the latest commit rather than trying to manually add the same changes.

I originally wanted to install the generated certs onto the peer, but that proved to be elusive. the solution above will work fine though.

[WuCh1k1n]

The problem is fixed.Thanks a lot! Maybe you should run the install command with sudo.

[dshuffma-ibm]

@Ksloveyuan fabcar is not the the repo that needs to be cleaned. you need to pull changes on the marbles repo. So from the marbles directory type git pull to get the latest changes. make sure the command says it updated some files and there were no issues merging the changes. you may run into merge conflicts if you have been modifying files... you can either resolve those yourself or if all else fails, delete the marbles folder and clone it again. that's kind of a last resort. just depends how familiar you are with git.

@WuCh1k1n great! thanks for reporting back.

[jhsea3do]

Thank you, @dshuffma-ibm, it was solved :+1:

[zhulg]

@dshuffma-ibm thank you. This problem has been fixed

[ghost]

Working now but I got the below error in the last step when I run

gulp marbles_local

Note: I am installing marbles local with a user ibmadmin

info: [fcw] Going to enroll peer_urls=[grpc://localhost:7051], channel_id=mychannel, uuid=marblesDockerComposeNetworkmychannelOrg1MSPfabricpeerorg1, ca_url=http://localhost:7054, orderer_url=grpc://localhost:7050, enroll_id=admin, enroll_secret=adminpw, msp_id=Org1MSP, kvs_path=/home/ibmadmin/fabric-samples/fabcar/hfc-key-store error: [Client.js]: Failed to load user "admin" from local key value store. Error: Error: Private key missing from key store. Can not establish the signing identity for user admin at _cryptoSuite.importKey.then.then (/home/ibmadmin/marbles/node_modules/fabric-client/lib/User.js:255:11) error: [Client.js]: Failed to load an instance of requested user "admin" from the state store on this Client instance. Error: Error: Private key missing from key store. Can not establish the signing identity for user admin at _cryptoSuite.importKey.then.then (/home/ibmadmin/marbles/node_modules/fabric-client/lib/User.js:255:11) error: [fcw] Failed to get enrollment marblesDockerComposeNetworkmychannelOrg1MSPfabricpeerorg1 Error: Private key missing from key store. Can not establish the signing identity for user admin at _cryptoSuite.importKey.then.then (/home/ibmadmin/marbles/node_modules/fabric-client/lib/User.js:255:11) error: [fcw] could not format error error: Exhausted all CAs. There are no more CAs to try. error: could not enroll... warn: removing older kvs and trying to enroll again warn: removed older kvs info: [fcw] Going to enroll peer_urls=[grpc://localhost:7051], channel_id=mychannel, uuid=marblesDockerComposeNetworkmychannelOrg1MSPfabricpeerorg1, ca_url=http://localhost:7054, orderer_url=grpc://localhost:7050, enroll_id=admin, enroll_secret=adminpw, msp_id=Org1MSP, kvs_path=/home/ibmadmin/fabric-samples/fabcar/hfc-key-store error: [Client.js]: Failed to load user "admin" from local key value store. Error: Error: Private key missing from key store. Can not establish the signing identity for user admin at _cryptoSuite.importKey.then.then (/home/ibmadmin/marbles/node_modules/fabric-client/lib/User.js:255:11) error: [Client.js]: Failed to load an instance of requested user "admin" from the state store on this Client instance. Error: Error: Private key missing from key store. Can not establish the signing identity for user admin at _cryptoSuite.importKey.then.then (/home/ibmadmin/marbles/node_modules/fabric-client/lib/User.js:255:11) error: [fcw] Failed to get enrollment marblesDockerComposeNetworkmychannelOrg1MSPfabricpeerorg1 Error: Private key missing from key store. Can not establish the signing identity for user admin at _cryptoSuite.importKey.then.then (/home/ibmadmin/marbles/node_modules/fabric-client/lib/User.js:255:11) error: [fcw] could not format error error: Exhausted all CAs. There are no more CAs to try. error: could not enroll... warn: Error enrolling admin

[jhsea3do]

@kgamal i got the same problem, but i've fixed it.

please copy /home/ibmadmin/fabric-samples/fabcar/hfc-key-store to your home directory $HOME/.hfc-key-store

then change connection_profile_local.json attr client.credentialStore.path value to $HOME/.hfc-key-store.

https://jira.hyperledger.org/browse/FAB-2593

[Ksloveyuan]

@dshuffma-ibm Thanks a lot. It is working.

@WuCh1k1n You are right, I run the command with sudo.

[ghost]

@jhsea3do Thanks . It Works Now !!

[dmohebz]

@dshuffma-ibm Thanks a lot, It works now. I also did what @jhsea3do commented (thanks @jhsea3do) to get it to work. The new problem was when I logged in to Marbles it only created the first owner "Amy" - everything else was fine. I got these errors in different runs:

error: [client-utils.js]: sendPeersProposal - Promise is rejected: Error: 2 UNKNOWN: chaincode error (status: 500, message: Owner does not exist - o01523272372381cufrZ, '' '') at new createStatusError (/home/mohsen/fabric/samples/marbles/node_modules/grpc/src/client.js:64:15) at /home/mohsen/fabric/samples/marbles/node_modules/grpc/src/client.js:583:15 error: [fcw] Failed to obtain endorsement for transaction. code=2, , details=chaincode error (status: 500, message: Owner does not exist - o01523272372381cufrZ, '' '') error: [fcw] Error in invoke catch block object code=2, , details=chaincode error (status: 500, message: Owner does not exist - o01523272372381cufrZ, '' '') debug: [fcw] transaction event is disconnected error: Exhausted all peers. There are no more peers to try.

or

error: error creating the marble owner { parsed: 'Blockchain network error - 4) is being launched', raw: [ { Error: 2 UNKNOWN: error executing chaincode: premature execution - chaincode (marbles:v4) is being launched at new createStatusError (/home/mohsen/fabric/samples/marbles/node_modules/grpc/src/client.js:64:15) at /home/mohsen/fabric/samples/marbles/node_modules/grpc/src/client.js:583:15 code: 2, metadata: [Object], details: 'error executing chaincode: premature execution - chaincode (marbles:v4) is being launched' } ] } id=o01523274950984r2n9i

I didn't know what the problem was, but if this does any help, I removed gulp and installed gulp-cli (npm install -g gulp-cli) and the problem is fixed now.

[sm86]

@jhsea3do thanks, that last comment saved my day! May be the documentation needs to be updated!

[Emanab]

Hello,

I'm trying to working on hyperledger fabric locally and practice on (Marbles) example ..

When I ran the command of (gulp marbles_tls)

I got the below error: Failed to get enrollment marblesBenNevisNetworkFMVbestmarblesorg1org1peer1 Error: Failed to obtain an enrolled user

Any help ?!

Thanks :)

[ollieh-m]

Hi,

I'm getting this error - [JoinChain][composerchannel2]: [Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]] - when I try to get a peer to join a newly created channel.

I cannot work out what identity needs to be an admin and how I make them an admin.

My code for trying to get the peer to join the channel is:

  var newChannel = fabric_client.newChannel('composerchannel2');
  var orderer  = fabric_client.newOrderer('grpc://localhost:7050');
  var peer = fabric_client.newPeer('grpc://localhost:7051');

  newChannel.addOrderer(orderer);
  newChannel.addPeer(peer);

  tx_id = fabric_client.newTransactionID();
  let g_request = {
    txId: tx_id
  };

  // get the genesis block from the orderer
  newChannel.getGenesisBlock(g_request).then((block) =>{
    genesis_block = block;
    tx_id = fabric_client.newTransactionID();
    let j_request = {
      targets: ['localhost:7051'],
      block: genesis_block,
      txId: tx_id
    };

    console.log(j_request)

    // send genesis block to the peer
    return newChannel.joinChannel(j_request);

I have an admin enrolled but calling fabric_client.getUserContext('admin', true) or fabric_client.setUserContent('admin', true) doesn't help. I'm not sure which of those two should be right anyway...

Any help much appreciated!

[dshuffma-ibm]

@ollieh-m you need to install a cert on the peer. this will promote the cert to be an "admin". you can do this by copying the cert into the peer's docker container filesystem. but I can't exactly remember where it goes, some hyperledger doc will have it. look for admin cert. after its copied in restart the peer so it picks up the new cert.

don't let the name of admin of your enroll id confuse you... what you need is an admin cert.

[GuillaumeCisco]

I'm experimenting a weird behavior. Copying the admincerts cert of an admin member to the admincerts folder of my peer make it works. BUT, I'm not a big fan of copying stuff from docker instances. I tried to enroll the admin member inside my peer node docker instance, with an msp folder set to /tmp, then I copy the signcerts cert file generated into the msp admincert folder of the peer, and then start the peer. It does not work. The same This identity is not an admin error appears though it is an admin. The admincerts generated with this method hardly the same as the one copied except for serial and some public signatures due to a new enroll.

Am I missing something? Are we doomed to copy an admincertfile from the outside? Is it possible to directly register a peer with admin rights (or an admincert folder automatically generated)?

EDIT, just found out, from this code: https://github.com/hyperledger/fabric-sdk-go/blob/master/internal/github.com/hyperledger/fabric/msp/mspimpl.go#L460

The admin cert need to be exactly the same as the admin cert used to make the query. As mine is different, since I reenroll the admin, it could not work. Copying seems to be the only way (either GET from a web API) or using a binded volume.

[dshuffma-ibm]

@GuillaumeCisco makes sense, thanks for the update