Built a network, added orderers to the channel here referenced as: channelname The following folders are mounted on the container
# docker-compose.yaml
volumes:
- "~/container-volumes/$docker_peer0/production:/var/hyperledger/production"
- "~/organizations/peerOrganizations/$company/peers/$docker_peer0/msp:/etc/hyperledger/fabric/msp"
- "~/organizations/peerOrganizations/$company/peers/$docker_peer0/tls:/etc/hyperledger/fabric/tls"
Trying to join a peer to a channel, but gives bad proposal response 500: access denied.
- Build the channel configuration block with the following command:
./configtxgen -profile SampleAppChannelEtcdRaft -outputBlock genesis_block.pb -channelID channelname
- Next joined the orderers to the channel using the following command with an identity enrolled with role admin
./osnadmin channel join --channel-id channelname --config-block ~/Downloads/bin/genesis_block.pb -o localhost:9440 --ca-file $OSN_TLS_CA_ROOT_CERT --client-cert $ADMIN_TLS_SIGN_CERT --client-key $ADMIN_TLS_PRIVATE_KEY
- Next I copy the generated genesis_block.pb to a mounted folder on the container so it is reachable for the following command which we use to join the peer to the channel:
docker exec -it peer0 peer channel join -b /var/hyperledger/production/genesis_block.pb -o vm01:9440 --clientauth --cafile /etc/hyperledger/fabric/msp/tls/tls-ca-cert.pem --certfile /etc/hyperledger/fabric/msp/user/peer-admin/tls/cert.pem --keyfile /etc/hyperledger/fabric/msp/user/peer-admin/tls/key.pem
- This results in the following error
[channelCmd] InitCmdFactory -> INFO 001 Endorser and orderer connections initialized
Error: proposal failed (err: bad proposal response 500: access denied for [JoinChain][channelname]: [Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [The identity is not an admin under this MSP [org1msp]: The identity does not contain OU [ADMIN], MSP: [org1msp]]])
The admin used for this command is peer-admin that was enrolled with the TLS-CA and the organizational CA. Also the config.yaml for OU's is present in peer-admin msp.
I also tried to set the CORE_PEER_MSPCONFIGPATH to the msp dir of peer-admin (peer0/msp/user/peer-admin/msp), but this results on a hard exit of the container on startup. fabric-chaincode-500-access-errors
I can't seem to figure out where it goes wrong, has it something to do with the --cafile, --certfile or --keyfile that you have to set within the peer channel join command or something else?
Edit:
This is the config file.
$docker_peer1_service_name:
image: hyperledger/fabric-peer:2.3
container_name: $docker_peer1_container_name
environment:
- FABRIC_CFG_PATH=/etc/hyperledger/fabric
- CORE_PEER_ID=$docker_peer1
- CORE_PEER_NETWORKID=test
- CORE_PEER_LISTENADDRESS=0.0.0.0:7081
- CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:7082
- CORE_PEER_CHAINCODEADDRESS=localhost:7082
- CORE_PEER_ADDRESS=localhost:7081
- CORE_PEER_MSPCONFIGPATH=msp
- CORE_PEER_LOCALMSPID=$company
- CORE_PEER_FILESYSTEMPATH=/var/hyperledger/production
- CORE_PEER_GOSSIP_BOOTSTRAP=127.0.0.1:7091
- CORE_PEER_GOSSIP_ENDPOINT=localhost:7081
- CORE_PEER_GOSSIP_EXTERNALENDPOINT=localhost:7081
- CORE_PEER_TLS_ENABLED=true
- CORE_PEER_TLS_CLIENTAUTHREQUIRED=true
- CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/cert.pem
- CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/key.pem
- CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/tls-ca-cert.pem
- CORE_PEER_TLS_CLIENTROOTCAS_FILES=tls/tls-ca-cert.pem
- CORE_PEER_TLS_CLIENTCERT_FILE=/etc/hyperledger/fabric/tls/cert.pem
- CORE_PEER_TLS_CLIENTKEY_FILE=/etc/hyperledger/fabric/tls/key.pem
- CORE_PEER_LEDGER_STATE_STATEDATABASE=CouchDB
- CORE_PEER_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS=peer1-couchdb:5985
- CORE_PEER_LEDGER_STATE_COUCHDBCONFIG_USERNAME=$docker_peer1_couchdb_username
- CORE_PEER_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=$docker_peer1_couchdb_pass
- CORE_PEER_LEDGER_SNAPSHOTS=var/hyperledger/production/snapshots
#- CORE_PEER_OPERATIONS_LISTENADDRESS=127.0.0.1:9443
#- CORE_PEER_OPERATIONS_TLS_ENABLED=true
#- CORE_PEER_OPERATIONS_TLS_CERT_FILE=
#- CORE_PEER_OPERATIONS_TLS_KEY_FILE=
#- CORE_PEER_OPERATIONS_TLS_CLIENTAUTHREQUIRED=true
- CORE_PEER_METRICS_PROVIDER=disabled
#- CORE_PEER_METRICS_STATSD_ADDRESS=127.0.0.1:8125
#- FABRIC_CA_SERVER_OPERATIONS_LISTENADDRESS=127.0.0.1:9444
ports:
- "7081:7081"
- "7082:7082"
- "7091:7091"
volumes:
- "~/container-volumes/$docker_peer1/production:/var/hyperledger/production"
- "~/organizations/peerOrganizations/$company/peers/$docker_peer1/msp:/etc/hyperledger/fabric/msp"
- "~/organizations/peerOrganizations/$company/peers/$docker_peer1/tls:/etc/hyperledger/fabric/tls"
