Hyperledger composer admin certificate not being able to deploy network - hyperledger-fabric

Question

I have an issue with the deployment of business network (composer version 0.14.2):
I request an identity to the fabric-ca (enrolling as admin password adminpw , same as the bootstrapping identity of the fabric-ca-server)
I receive a certificate and a private key back, I import that identity into the userID adminCC (matching the previous certificate and key to this userID) and I try to deploy a network with enrollmentID adminCC and businessnetworkadmin adminCC
I get an error saying that Error: Error trying deploy. Error: Error trying install composer runtime. Error: chaincode error (status: 500, message: Authorization for INSTALL has been denied (error-Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [Admins]: [This identity is not an admin]))
Any help with this issue? Shouldn't the certificate requested to the fabric-ca be one with admin rights?

Answer 1

The error you have received is from the peer saying the identity you have used does not have admin rights so is not permitted to install the chaincode onto it.
The admin identity in your fabric-ca-server setup is just a bootstrap identity for the fabric-ca-server and as such has only issuer rights on the fabric-ca-server from which you obtained it and has no admin rights on any part of the fabric network.

Answer 2

If you were running on v0.13.2 or lower before, there was a breaking change when they upgrade to v0.14.0 or v0.14.2. You can read about it more here. But the gist of it was all previous releases of Composer, all digital certificates with admin in the name (case insensitive) have had "privileged access" to the business network - essentially it acted as if the access control rules were disabled. They replace this with a more secure model. So you can change your permissions.pcl file and add:
rule NetworkAdminUser {
description: "Grant business network administrators full access to user resources"
participant: "org.hyperledger.composer.system.NetworkAdmin"
operation: ALL
resource: "**"
action: ALLOW
}
rule NetworkAdminSystem {
description: "Grant business network administrators full access to
system resources"
participant: "org.hyperledger.composer.system.NetworkAdmin"
operation: ALL
resource: "org.hyperledger.composer.system.**"
action: ALLOW
}
Then after you archive your BNA, in order to deploy properly use:
composer network deploy -p hlfv1 -a {ban_location/ban_name.bna} -i PeerAdmin -s randomString -A admin -S adminpw
After this you can the old commands using admin and adminpw as before like:
composer-rest-server -p hlfv1 -n my-network -i admin -s adminpw -N never