Hyperledger Fabric: Registration of 'orderer1-ord' failed in affiliation validation: Failed getting affiliation 'ord.OU': : - hyperledger-fabric

Question

we have customized the fabric-ca sample to remove below line in env.sh
export FABRIC_CA_CLIENT_ID_AFFILIATION=org1
and add --id.affiliation $ORG.OU in all calls to fabric-ca-client register or enroll. Example:
scripts/env.sh: fabric-ca-client enroll -d --enrollment.profile tls -u $ENROLLMENT_URL -M /tmp/tls --csr.hosts $HOST_NAME --csr.names O=$ORG --id.affiliation $ORG.OU
scripts/env.sh: fabric-ca-client enroll -d -u https://$ADMIN_NAME:$ADMIN_PASS#$CA_HOST:7054 --csr.names O=$ORG --id.affiliation $ORG.OU
scripts/env.sh: fabric-ca-client enroll -d -u https://$USER_NAME:$USER_PASS#$CA_HOST:7054 --csr.names O=$ORG --id.affiliation $ORG.OU
scripts/setup-fabric.sh: fabric-ca-client register -d --id.name $ORDERER_NAME --id.secret $ORDERER_PASS --id.type orderer --id.affiliation $ORG.OU
scripts/setup-fabric.sh: fabric-ca-client register -d --id.name $ADMIN_NAME --id.secret $ADMIN_PASS --id.attrs "admin=true:ecert" --id.affiliation $ORG.OU
scripts/setup-fabric.sh: fabric-ca-client register -d --id.name $PEER_NAME --id.secret $PEER_PASS --id.type peer --id.affiliation $ORG.OU
scripts/setup-fabric.sh: fabric-ca-client register -d --id.name $ADMIN_NAME --id.secret $ADMIN_PASS --id.attrs "hf.Registrar.Roles=client,hf.Registrar.Attributes=*,hf.Revoker=true,hf.GenCRL=true,admin=true:ecert" --id.affiliation $ORG.OU
scripts/setup-fabric.sh: fabric-ca-client register -d --id.name $USER_NAME --id.secret $USER_PASS --id.affiliation $ORG.OU
scripts/setup-fabric.sh: fabric-ca-client getcacert -d -u https://$CA_HOST:7054 -M $ORG_MSP_DIR --id.affiliation $ORG.OU
scripts/start-orderer.sh:fabric-ca-client enroll -d --enrollment.profile tls -u $ENROLLMENT_URL -M /tmp/tls --csr.hosts $ORDERER_HOST --csr.names O=$ORG --id.affiliation $ORG.OU
scripts/start-orderer.sh:fabric-ca-client enroll -d -u $ENROLLMENT_URL -M $ORDERER_GENERAL_LOCALMSPDIR --csr.names O=$ORG --id.affiliation $ORG.OU
scripts/start-peer.sh:fabric-ca-client enroll -d --enrollment.profile tls -u $ENROLLMENT_URL -M /tmp/tls --csr.hosts $PEER_HOST --csr.names O=$ORG --id.affiliation $ORG.OU
scripts/start-peer.sh:fabric-ca-client enroll -d -u $ENROLLMENT_URL -M $CORE_PEER_MSPCONFIGPATH --csr.names O=$ORG --id.affiliation $ORG.OU
when we do this we see this error in setup.log:
Error: Response from server: Error Code: 0 - Registration of 'orderer1-ord' failed in affiliation validation: Failed getting affiliation 'ord.OU': : scode: 404, code: 63, msg: Failed to get Affiliation: sql: no rows in result set
If we modify enrollCAADmin to add:
# https://stackoverflow.com/a/48840929/147530
fabric-ca-client affiliation add $1
we now see this error:
Error: Response from server: Error Code: 60 - Affiliation already exists
How can we fix this?

Answer 1

Adding affiliation of $ORG.OU fails but adding affiliation of $ORG works. In setup-fabric.sh, function registerPeerIdentities
fabric-ca-client register -d --id.name $ADMIN_NAME --id.secret $ADMIN_PASS --id.attrs "hf.Registrar.Roles=client,hf.Registrar.Attributes=*,hf.Revoker=true,hf.GenCRL=true,admin=true:ecert,abac.init=true:ecert" --id.affiliation=$ORG
log "Registering user identity with $CA_NAME"
fabric-ca-client register -d --id.name $USER_NAME --id.secret $USER_PASS --id.affiliation=$ORG
note following section in $FABRIC_CA_SERVER_HOME/fabric-ca-server-config.yaml of rca-myorg1
root#cad23a1fb013:/etc/hyperledger/fabric-ca# cat fabric-ca-server-config.yaml
affiliations:
ord: []
myorg1: []
myorg2: []
myorg3: []
org1:
- department1
- department2
org2:
- department1
from https://hyperledger-fabric-ca.readthedocs.io/en/latest/users-guide.html#registering-a-new-identity
The affiliation of the registrar must be equal to or a prefix of the
affiliation of the identity being registered. For example, an
registrar with an affiliation of “a.b” may register an identity with
an affiliation of “a.b.c” but may not register an identity with an
affiliation of “a.c”. If root affiliation is required for an identity,
then the affiliation request should be a dot (”.”) and the registrar
must also have root affiliation. If no affiliation is specified in the
registration request, the identity being registered will be given the
affiliation of the registrar.
so not sure why setting affiliation to $ORG works but $ORG.OU does not