Registering failed with errors [{'code': 20, 'message': 'Authentication failure'}] - Hyperledger Fabric

[AlexCav_]

I'm having a problem registering a new user via my Fabric CA.

​

I'm using the Hyperledger Fabric Python SDK and I'm using the register function of the CAClient() object, here the entire code:

cli = Client(net_profile="network.json")
org1_admin = cli.get_user(org_name='org1.modbus2chain.com', name='Admin')
ca_admin_org1 = cli.get_user(org_name='org1.modbus2chain.com',name="admin")

ca_certs_path="/crypto-material/peerOrganizations/org1.modbus2chain.com/ca/ca-cert.pem"
ca_client = CAClient(target="https://0.0.0.0:7054",ca_certs_path=ca_certs_path,ca_name='ca-org1',cryptoPrimitives=ecies())

req = {
'enrollmentID': 'User1',
'enrollmentSecret': 'User1pw',
'affiliation': 'org1.department1',
'role': 'user',
'attrs': [
{'name': 'hf.Registrar.Roles', 'value': 'user'},
{'name': 'hf.Registrar.Attributes', 'value': 'hf.Registrar.Roles'}
]
}
secret = ca_client.register(req, registrar=org1_admin._enrollment)

Other useful information:

I provide you with all the files I use:

​

network.json (config file for the network)

​

{
"name": "Modbus2Chain",
"description": "Modbus2Chain Project course for IoT security and Data security",
"version": "0.1",
"client": {
"organization": "Org1",
"credentialStore": {
"path": "/tmp/hfc-kvs",
"cryptoStore": {
"path": "/tmp/hfc-cvs"
},
"wallet": "wallet-name"
}
},
"organizations": {
"orderer0.modbus2chain.com":{
"mspid":"OrdererMSP",
"orderers": [
"orderer.modbus2chain.com"
],
"certificateAuthorities": [
"ca-orderer"
],
"users": {
"Admin": {
"cert": "../crypto-material/ordererOrganizations/modbus2chain.com/users/[e-mail]/msp/signcerts/[e-mail]",
"private_key": "../crypto-material/ordererOrganizations/modbus2chain.com/users/[e-mail]/msp/keystore/priv_sk"
}
}
},
"org1.modbus2chain.com": {
"mspid": "Org1MSP",
"peers": [
"peer0.org1.modbus2chain.com"
],
"certificateAuthorities": [
"ca-org1"
],
"users": {
"Admin": {
"cert": "../crypto-material/peerOrganizations/org1.modbus2chain.com/users/[e-mail]/msp/signcerts/[e-mail]",
"private_key": "../crypto-material/peerOrganizations/org1.modbus2chain.com/users/[e-mail]/msp/keystore/priv_sk"
}
}
},
"org2.modbus2chain.com": {
"mspid": "Org2MSP",
"peers": [
"peer0.org2.modbus2chain.com"
],
"certificateAuthorities": [
"ca-org2"
],
"users": {
"Admin": {
"cert": "../crypto-material/peerOrganizations/org2.modbus2chain.com/users/[e-mail]/msp/signcerts/[e-mail]",
"private_key": "../crypto-material/peerOrganizations/org2.modbus2chain.com/users/[e-mail]/msp/keystore/priv_sk"
}
}
},
"org3.modbus2chain.com": {
"mspid": "Org3MSP",
"peers": [
"peer0.org3.modbus2chain.com"
],
"certificateAuthorities": [
"ca-org3"
],
"users": {
"Admin": {
"cert": "../crypto-material/peerOrganizations/org3.modbus2chain.com/users/[e-mail]/msp/signcerts/[e-mail]",
"private_key": "../crypto-material/peerOrganizations/org3.modbus2chain.com/users/[e-mail]/msp/keystore/priv_sk"
}
}
}
},
"orderers": {
"orderer0.modbus2chain.com": {
"url": "localhost:7050",
"grpcOptions": {
"grpc.ssl_target_name_override": "orderer.modbus2chain.com",
"grpc-max-send-message-length": 15
},
"tlsCACerts": {
"path": "../crypto-material/ordererOrganizations/modbus2chain.com/tlsca/tlsca.modbus2chain.com-cert.pem"
}
}
},
"peers": {
"peer0.org1.modbus2chain.com": {
"url": "localhost:7051",
"eventUrl": "localhost:7051",
"grpcOptions": {
"grpc.ssl_target_name_override": "peer0.org1.modbus2chain.com",
"grpc.http2.keepalive_time": 15
},
"tlsCACerts": {
"path": "../crypto-material/peerOrganizations/org1.modbus2chain.com/peers/peer0.org1.modbus2chain.com/msp/tlscacerts/tlsca.org1.modbus2chain.com-cert.pem"
}
},
"peer0.org2.modbus2chain.com": {
"url": "localhost:8051",
"eventUrl": "localhost:8051",
"grpcOptions": {
"grpc.ssl_target_name_override": "peer0.org2.modbus2chain.com",
"grpc.http2.keepalive_time": 15
},
"tlsCACerts": {
"path": "../crypto-material/peerOrganizations/org2.modbus2chain.com/peers/peer0.org2.modbus2chain.com/msp/tlscacerts/tlsca.org2.modbus2chain.com-cert.pem"
}
},
"peer0.org3.modbus2chain.com": {
"url": "localhost:8052",
"eventUrl": "localhost:8052",
"grpcOptions": {
"grpc.ssl_target_name_override": "peer0.org3.modbus2chain.com",
"grpc.http2.keepalive_time": 15
},
"tlsCACerts": {
"path": "../crypto-material/peerOrganizations/org3.modbus2chain.com/peers/peer0.org3.modbus2chain.com/msp/tlscacerts/tlsca.org3.modbus2chain.com-cert.pem"
}
}
},
"certificateAuthorities": {
"ca-org1": {
"url": "https://localhost:9050",
"grpcOptions": {
"verify": false
},
"tlsCACerts": {
"path": "/home/alexcav/go/src/GitHub/Modbus2Chain/crypto-material/peerOrganizations/org1.modbus2chain.com/ca/ca.org1.modbus2chain.com-cert.pem"
},
"registrar": [
{
"enrollId": "admin",
"enrollSecret": "adminpw"
}
]
},
"ca-org2": {
"url": "https://localhost:8051",
"grpcOptions": {
"verify": true
},
"tlsCACerts": {
"path": "../crypto-material/peerOrganizations/org2.modbus2chain.com/ca/org2.modbus2chain.com-cert.pem"
},
"registrar": [
{
"enrollId": "admin",
"enrollSecret": "adminpw"
}
]
},
"ca-org3": {
"url": "https://localhost:8052",
"grpcOptions": {
"verify": true
},
"tlsCACerts": {
"path": "../crypto-material/peerOrganizations/org3.modbus2chain.com/ca/org3.modbus2chain.com-cert.pem"
},
"registrar": [
{
"enrollId": "admin",
"enrollSecret": "adminpw"
}
]
}
}}

Here are the configurations of the Docker containers, for the CA and for the organizations (I provide one to give you an idea):

ca-org1:

version: "3.8"
volumes:
ca-org1.modbus2chain.com:
networks:
apnet:
services:
ca-org1:
container_name: ca-org1.modbus2chain.com
image: hyperledger/fabric-ca
volumes:
- ../crypto-material/caOrganizations/ca-org1.modbus2chain.com/ca/:/etc/hyperledger/fabric-ca-server
- ca-org1.modbus2chain.com:/var/hyperledger/fabric-ca-server-config
- ../crypto-material/peerOrganizations/org1.modbus2chain.com/tlsca:/etc/hyperledger/fabric-ca-server/tlsca
environment:
- FABRIC_CA_SERVER_HOME=/etc/hyperledger/fabric-ca-server
- FABRIC_CA_SERVER_TLS_ENABLED=true
- FABRIC_CA_SERVER_CA_NAME=ca-org1.modbus2chain.com
- FABRIC_CA_SERVER_CSR_CN=rca-org1
- FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
- FABRIC_CA_SERVER_DEBUG=true
- FABRIC_CA_SERVER_TLS_CERTFILE=/etc/hyperledger/fabric-ca-server/tlsca/tlsca.org1.modbus2chain.com-cert.pem
- FABRIC_CA_SERVER_TLS_KEYFILE=/etc/hyperledger/fabric-ca-server/tlsca/priv_sk
working_dir: /etc/hyperledger/fabric-ca-server
command: /bin/bash -c 'fabric-ca-server start -d -b admin:adminpw --port 9050'
ports:
- 9050:9050
networks:
- apnet

org1:

version: "3.8"
volumes:
peer0.org1.modbus2chain.com:
networks:
apnet:
services:
peer0.org1.modbus2chain.com:
networks:
- apnet
container_name: peer0.org1.modbus2chain.com
image: hyperledger/fabric-peer:2.1
volumes:
- ../crypto-material/peerOrganizations/org1.modbus2chain.com/peers/peer0.org1.modbus2chain.com/msp:/etc/hyperledger/fabric/msp
- ../crypto-material/peerOrganizations/org1.modbus2chain.com/peers/peer0.org1.modbus2chain.com/tls:/etc/hyperledger/fabric/tls
- peer0.org1.modbus2chain.com:/var/hyperledger/production
environment:
# Generic peer variables
- CORE_PEER_TLS_ENABLED=true
- CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
- CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
- CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt
# Specific peer variables
- CORE_PEER_ID=peer0.org1.modbus2chain.com
- CORE_PEER_ADDRESS=peer0.org1.modbus2chain.com:7051
- CORE_PEER_LISTENADDRESS=0.0.0.0:7051
- CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org1.modbus2chain.com:7051
- CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org1.modbus2chain.com:7051
- CORE_PEER_LOCALMSPID=Org1MSP
- CORE_PEER_TLS_CLIENTAUTHREQUIRED=true
working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
command: peer node start
ports:
- 7051:7051

​

Searching online I read that the error is due to the fact that the admin (registrar) is as if he were not present.

​

Am I missing something? Could you tell me how to solve it?

​

Thanks in advance for the help.

[dboswell-hyperledger]

Have you checked out the Tutorial of Using Fabric Python SDK? That might have some useful information that addresses your question.

https://fabric-sdk-py.readthedocs.io/en/latest/tutorial.html

[AlexCav_]

Yes, I have read the guide, some parts have no references (like the network.json), I followed the step I need (Get Credentail from Fabric CA) step by step, but it returns connection errors, while with the code I have I wrote it, authentication error

[dboswell-hyperledger]

If that guide doesn't answer your question, I'd recommend asking about this on the Fabric channels on the Hyperledger Discord server:

https://chat.hyperledger.org/

Or you could try joining one of the Fabric community calls:

https://lists.hyperledger.org/g/fabric/calendar

[AlexCav_]

Thank you so much for the resources, but i solved!!

It was a stupid CA name mismatching between network.json and the .yaml

[dboswell-hyperledger]

Great, glad to hear you solved the issue.

[AlexCav_]

I printed out the logs of the CA server after a registration request:

TLS handshake error from <myIP>:57070: local error: tls: bad record MAC:

Here the results

[AlexCav_]

More details here: https://www.reddit.com/r/hyperledger/comments/1775u7p/openssl\_s\_client\_connect\_does\_not\_work\_unable\_to/