Styjun

We already have the the fabric network set up. There are ORG1 and ORG2 in the consortium defined in configtx.yaml already. Each organizations has its own Root CAs. And, ORG2 has an intermediate CA in addition.

configtx.yaml:

---
################################################################################
#
# ORGANIZATIONS
#
# This section defines the organizational identities that can be referenced
# in the configuration profiles.
#
################################################################################
Organizations:
 - &OrdererOrg
 Name: OrdererOrg
 ID: ORDERER
 MSPDir: crypto-config/ordererOrganizations/ordererorg/msp
 Policies: &OrdererOrgPolicies
 Readers:
 Type: Signature
 Rule: "OR('ORDERER.member')"
 Writers:
 Type: Signature
 Rule: "OR('ORDERER.member')"
 Admins:
 Type: Signature
 Rule: "OR('ORDERER.admin')"

 - &ORG1
 Name: ORG1
 ID: ORG1
 MSPDir: crypto-config/peerOrganizations/ORG1.com/msp
 Policies: &Org1Policies
 Readers:
 Type: Signature
 Rule: "OR('ORG1.member')"
 Writers:
 Type: Signature
 Rule: "OR('ORG1.member')"
 Admins:
 Type: Signature
 Rule: "OR('ORG1.admin')"
 AnchorPeers:
 - Host: peer0
 Port: 7051

 - &ORG2
 Name: ORG2
 ID: ORG2
 MSPDir: crypto-config/ORG2/ORG2.com/msp
 Policies: &Org2Policies
 Readers:
 Type: Signature
 Rule: "OR('ORG2.member')"
 Writers:
 Type: Signature
 Rule: "OR('ORG2.member')"
 Admins:
 Type: Signature
 Rule: "OR('ORG2.admin')"
 AnchorPeers:
 - Host: peer1
 Port: 7051

.
.
.
.
 SingleMSPSolo:
 <<: *ChannelDefaults
 Orderer:
 <<: *OrdererDefaults
 Addresses:
 - kiesnet-dev-orderer:7050
 Organizations:
 - *OrdererOrg
 Consortiums:
 DevConsortium:
 Organizations:
 - *ORG1
 - *ORG2

 SingleMSPChannel:
 Consortium: DevConsortium
 Application:
 <<: *ApplicationDefaults
 Organizations:
 - *ORG1
 - *ORG2

ORG2's root CA and the intermediate CA will have the same MSPIDs (which is "ORG2") and the end users will be only enrolled from the intermediate CA server.

Here's the problem.
in the above configtx.yaml, "MSPDir: crypto-config/ORG/ORG2.com/msp" is the the ROOT CA's msp directory path, NOT the intermediate's.

However, the end users are only enrolled from the intermediate server, and when those users are trying to query/invoke to ORG1's peer, we get this error:

Error: error endorsing query: rpc error: code = Unknown desc = access denied: channel [ORG1] creator org [ORG2] - proposal response: <nil>

If we test with the end user's certificate which was enrolled from ORG2's root CA, the user can query/invoke to ORG1's peer just fine.

How we tell the network(channel) to trust the users enrolled from the intermediate CA without doing the peer channel update or modifying the channel config file?

the business reason behind on this is that from ORG2, there can be many intermediate CA servers added in the future, so we don't want to update the channel configuration each time we have the new intermediate CAs. So once we registered the ORG2's ROOT CA(when we set up the network first time), we want to trust all users enrolled from it's intermediate CA(s).

I think there should be a way to tell the network to trust all the users enrolled from any intermediate CAs if the intermediate CA is from ORG2's root CA.