CODEWITHSUNDEEP
blockchainhyperledgerhyperledger-fabric
Narayan Prusty
Narayan Prusty

Reputation: 2581

What is the difference between roles, affiliations and attributes?

I am adding users to my ca-server's config file. I want to know what are the differences between roles, affiliations and attributes?

In tutorials I can see that roles is assigned to one of these: "client,user,peer,validator,auditor,ca". I want to know can be use some other role? If a user is assigned "client" role then can he have a validating role running with that identity. What's the difference between "client" and "user"? What's the difference between "peer" and "validator"? And also what is auditor specifically.

I think affiliations are used to categorize identities. Is that right?

Upvotes: 2

Views: 1527

Answers (1)

Anil Ambati
Anil Ambati

Reputation: 31

Identity type can be any arbitrary string as far as Fabric CA is concerned.

I think of affiliations as hierarchical tags. Each identity can be tagged (affiliated) to (with) one affiliation in the hierarchy. When an identity is associated with an affiliation, it is affiliated with that and all the child affiliations.

1) Affiliations are currently used during registration and revocation. You can read more about registration/revocation at https://hyperledger-fabric-ca.readthedocs.io/en/latest/users-guide.html

Attributes are key-value pairs that can be associated with an identity. hf.Registrar.Roles, hf.Registrar.DelegateRoles, hf.Revoker, and hf.IntermediateCA are currently in use with in Fabric CA server. These are used to make access control decisions. Currently attributes are not used in any other Fabric components, afaik.

For example, if an identity with “hf.Registrar.Roles” attribute set to “peer,app,user” and affiliated to org1.dept1, can register identities of type peer, app, and user, (but not orderer) that are affiliated with org1.dept1 (but not identities affiliated with org1 or org1.dept2)

I hope this is helps

Upvotes: 2

Related Questions