Use the --no-wallet parameter to deploy the canister prompt created on nns: code 4, message: "Caller is not authorized"

We have two computers configured with DFINITY development environment, two computers (e.g. called computerA, computerB), also corresponding to two different principals (prinicpalA, principalB),,

Created canister on nns and set principalA and principalA as controllers of canister.

Local deployment on both computers is perfectly fine, but there is a problem when deploying to the IC network.
In computerA first execute dfx start --clean --background, then execute dfx deploy --network ic --no-wallet, can successfully deploy to the main network (ic).

But in computerB execute the same operation, will return an error: code 4, message: “Caller is not authorized”:

The question:

1、principalA and principalB are both controllers of mcaxw-wyaaa-aaaai-qakfa-cai, why one can be deployed successfully, but the other is prompted with no authorization?
I think the two principals are controllers, the permission should be the same, and the execution order has nothing to do with it.

2、when using dfx canister update-settings command to modify the canister controller, the execution error and prompt: 5: Only the controllers of the canister mcaxw-wyaaa-aaaai-qakfa-cai can control it:

The dfx canister set-controller prompt in the development documentation does not exist:

How to fix them?

Reference:How to Deploy Your First Canister Smart Contract Using the NNS Dapp | by DFINITY | The Internet Computer Review | Medium

The “Caller is not authorized” method is coming from the certified assets canister. It maintains a separate list of principals that are authorized to alter its contents. This list is initialized with the creator of the canister (more precisely, the caller when the canister was initialized).

On computerA, using principalA, call the authorize method on the asset canister, passing principalB. Then computerB / principalB will also be able to deploy.

Something like this, though you might need --no-wallet:

dfx canister --network ic call dapp_assets authorize "(principal \"$PRINCIPALB\")"


That’s all right for question 1 !

Extension of question 2:
The first time I deployed the canister without the --no-wallet parameter, but then I wanted to deploy it with the --no-wallet parameter and the local principal control the canister。

How to do?