To register an entity in the Fabric CA, an entity should have a set of roles. Fabric CA is configured with the following default roles:

hf.Registrar.Roles = client, user, peer, validator, auditor

A Fabric CA can register any entity that has one of these roles:

hf.Registrar.DelegateRoles = client, user, validator, auditor

A Fabric CA can revoke a role:

hf.Revoker = true

A Fabric CA can also register an intermediate CA:

hf.IntermediateCA

To register an identity in Fabric CA, an entity must have the hf.Registrar. Roles are attributed with a comma-separated list of values, where one of the values equals the type of identity being registered.

Secondly, the affiliation of the invoker's identity must be equal to or a prefix of the affiliation of the identity being registered. For example, an invoker with an affiliation of a.b may register an identity with an affiliation of a.b.c, but may not register an identity with an affiliation of a.c.