revoker | Java implementation of a CRL Distribution Point | TLS library

I have a Hyperledger Fabric Blockchain using V1.4, I am connected through LDAP to my organization's Active Directory and I want to be able to change the roles of my users from my AD.

Basically I need two roles: user and admin, a user can run contracts and an admin can install and upgrade contracts.

So what I'm trying to do its to add a converter in my ldap configuration on fabric-ca-server-config.yaml and a map that changes my "memberOf" AD property to hf.Registrar.Roles like this:

I'm attempting to make an administration role within firebase using claims and check the role in onCall methods within the Cloud Functions environment. I was under the assumption that the context.auth.token would be verified, but it seems that a user, when changed from admin to regular user (or any other edit on a user, which revokes the auth token using admin.auth().revokeRefreshTokens(uid)) doesn't actually revoke the rights immediately, OR the token isn't verified on the subsequent onCall by the edited user:

While reading the Fabric CA Operations Guide I noticed that the admins of the Org 1 and 2 were not assigned the type of admin when registering them in the corresponding CA as shown below:

I'm trying to enroll & register an admin to perform peer operations. This is the bash code:

I am trying to setup a fabric-ca with tls enabled. Started the server, enrolled the admin with tls enabled successfully. But when I try to register the user, I'm getting the error

So, I am trying to create a fabric network with a root CA, and several intermediate CAs, one for each org, everything with TLS enabled and self signed certs (no cryptogen). After running the root CA, I enroll the admin for it, and create affiliations and register identities for the intermediate CAs using the flag hf.IntermediateCA=true. Then I copy the tls-cert.pem from the root CA to the volume to be used by the intermediate CA, and then I try to start the intermediate CA issuing:

I know the problem "This identity is not an admin" is widely reported, but this is a specific case. I have read a lot of issues here and at Jira and I see no problem close to mine.

What I am trying to do is to join a channel from a peer in a full custom Hyperledger 1.4 network where I have not used cryptogen. The problem I am getting is exactly this one:

I have enabled the PKCS11 in fabric ca , but when starting the fabric-ca-server natively then throwing below error. Please note it works fine with default SW option.

1. Checkout the fabric-ca v1.3.0
2. Update BCCSP property as below

bccsp: default: PKCS11 pkcs11: library: /usr/local/lib/softhsm/libsofthsm2.so pin: daily123 label: org1label hash: SHA2 security: 256 filekeystore: # The directory used for the software file-based keystore keystore: msp/keystore

1. Run server with command ./fabric-ca-server start -b admin:adminpw -d

Error2018/10/12 07:27:01 [INFO] Configuration file location: /opt/gopath/bin/fabric-ca-server-config.yaml 2018/10/12 07:27:01 [INFO] Starting server in home directory: /opt/gopath/bin 2018/10/12 07:27:01 [INFO] Server Version: 1.3.0 2018/10/12 07:27:01 [INFO] Server Levels: &{Identity:1 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1} 2018/10/12 07:27:01 [DEBUG] Making server filenames absolute 2018/10/12 07:27:01 [DEBUG] Initializing default CA in directory /opt/gopath/bin 2018/10/12 07:27:01 [DEBUG] Init CA with home /opt/gopath/bin and config {Version:1.3.0 Cfg:{Identities:{AllowRemove:false} Affiliations:{AllowRemove:false}} CA:{Name: Keyfile: Certfile:ca-cert.pem Chainfile:ca-chain.pem} Signing:0xc4204ce7d0 CSR:{CN:fabric-ca-server Names:[{C:US ST:North Carolina L: O:Hyperledger OU:Fabric SerialNumber:}] Hosts:[safenet localhost] KeyRequest:0xc4204b1ac0 CA:0xc4204b1b40 SerialNumber:} Registry:{MaxEnrollments:-1 Identities:[{ Name:**** Pass:**** Type:client Affiliation: MaxEnrollments:0 Attrs:map[hf.Registrar.Roles:* hf.Registrar.DelegateRoles:* hf.Revoker:1 hf.IntermediateCA:1 hf.GenCRL:1 hf.Registrar.Attributes:* hf.AffiliationMgr:1] }]} Affiliations:map[org2:[department1] org1:[department1 department2]] LDAP:{ Enabled:false URL:ldap://****:****@:/ UserFilter:(uid=%s) GroupFilter:(memberUid=%s) Attribute:{[uid member] [{ }] map[groups:[{ }]]} TLS:{false [] { }} } DB:{ Type:sqlite3 Datasource:fabric-ca-server.db TLS:{false [] { }} } CSP:0xc4204de060 Client: Intermediate:{ParentServer:{ URL: CAName: } TLS:{Enabled:false CertFiles:[] Client:{KeyFile: CertFile:}} Enrollment:{ Name: Secret:**** CAName: AttrReqs:[] Profile: Label: CSR: Type:x509 }} CRL:{Expiry:24h0m0s} Idemix:{IssuerPublicKeyfile: IssuerSecretKeyfile: RevocationPublicKeyfile: RevocationPrivateKeyfile: RHPoolSize:1000 NonceExpiration:15s NonceSweepInterval:15m}} 2018/10/12 07:27:01 [DEBUG] CA Home Directory: /opt/gopath/bin 2018/10/12 07:27:01 [DEBUG] Checking configuration file version '1.3.0' against server version: '1.3.0' 2018/10/12 07:27:01 [DEBUG] Initializing BCCSP: &{ProviderName:PKCS11 SwOpts: PluginOpts:} 2018/10/12 07:27:01 [DEBUG] Closing server DBs Error: Failed to initialize BCCSP Factories: %!s() Could not find defaultPKCS11BCCSP

I'm trying to set some property in user metadata. I'm trying to do this using https://firebase.google.com/docs/auth/admin/manage-sessions#revoke_refresh_tokens and then https://firebase.google.com/docs/auth/admin/manage-sessions#update_user-specific_metadata_in.

Probably I'm doing something wrong, because it's not working. If I do this like in this article, and then call auth().listUsers to get the users data, 'metadata' has only default properties: creationTime and lastSignInTime, but without the new property revokeTime, any idea?

Edit:

My revoke function: