title: Failed creating channel in Hyperledger Fabric (permission denied)
body: <p>I configured manually a Hyperledger Fabric environment using the binary files (without using Docker or fabric samples scripts). I deployed successfully 1 orderer node and 2 peers node (one peer per org), but fails creating the channel.
  I used crytogen for crypto material  and cryptotxgen to create the genesis block and the channel transaction.</p>
  
  <p><strong>Orderer Logs:</strong></p>
  
  <pre><code>2019-01-06 19:01:05.601 UTC [cauthdsl] func1 -&gt; DEBU 176 0xc0001b8ea0 gate 1546801265601901160 evaluation starts
  2019-01-06 19:01:05.601 UTC [cauthdsl] func2 -&gt; DEBU 177 0xc0001b8ea0 signed by 0 principal evaluation starts (used [false])
  2019-01-06 19:01:05.601 UTC [cauthdsl] func2 -&gt; DEBU 178 0xc0001b8ea0 processing identity 0 with bytes of ebff60
  2019-01-06 19:01:05.602 UTC [cauthdsl] func2 -&gt; DEBU 179 0xc0001b8ea0 identity 0 does not satisfy principal: the identity is a member of a different MSP (expected OrdererMSP, got TheChainMSP)
  2019-01-06 19:01:05.602 UTC [cauthdsl] func2 -&gt; DEBU 17a 0xc0001b8ea0 principal evaluation fails
  2019-01-06 19:01:05.602 UTC [cauthdsl] func2 -&gt; DEBU 17b 0xc0001b8ea0 signed by 1 principal evaluation starts (used [false])
  2019-01-06 19:01:05.602 UTC [cauthdsl] func2 -&gt; DEBU 17c 0xc0001b8ea0 processing identity 0 with bytes of ebff60
  2019-01-06 19:01:05.602 UTC [cauthdsl] func2 -&gt; DEBU 17d 0xc0001b8ea0 identity 0 does not satisfy principal: the identity is a member of a different MSP (expected OrdererMSP, got TheChainMSP)
  2019-01-06 19:01:05.602 UTC [cauthdsl] func2 -&gt; DEBU 17e 0xc0001b8ea0 principal evaluation fails
  2019-01-06 19:01:05.602 UTC [cauthdsl] func1 -&gt; DEBU 17f 0xc0001b8ea0 gate 1546801265601901160 evaluation fails
  2019-01-06 19:01:05.602 UTC [policies] Evaluate -&gt; DEBU 180 Signature set did not satisfy policy /Channel/Orderer/OrdererTheChain/Writers
  2019-01-06 19:01:05.602 UTC [policies] Evaluate -&gt; DEBU 181 == Done Evaluating *cauthdsl.policy Policy /Channel/Orderer/OrdererTheChain/Writers
  2019-01-06 19:01:05.602 UTC [policies] func1 -&gt; DEBU 182 Evaluation Failed: Only 0 policies were satisfied, but needed 1 of [ OrdererTheChain.Writers ]
  2019-01-06 19:01:05.602 UTC [policies] Evaluate -&gt; DEBU 183 Signature set did not satisfy policy /Channel/Orderer/Writers
  2019-01-06 19:01:05.602 UTC [policies] Evaluate -&gt; DEBU 184 == Done Evaluating *policies.implicitMetaPolicy Policy /Channel/Orderer/Writers
  2019-01-06 19:01:05.602 UTC [policies] func1 -&gt; DEBU 185 Evaluation Failed: Only 0 policies were satisfied, but needed 1 of [ Consortiums.Writers Orderer.Writers ]
  2019-01-06 19:01:05.602 UTC [policies] Evaluate -&gt; DEBU 186 Signature set did not satisfy policy /Channel/Writers
  2019-01-06 19:01:05.602 UTC [policies] Evaluate -&gt; DEBU 187 == Done Evaluating *policies.implicitMetaPolicy Policy /Channel/Writers
  2019-01-06 19:01:05.602 UTC [orderer.common.broadcast] ProcessMessage -&gt; WARN 188 [channel: privatechannel] Rejecting broadcast of config message from 127.0.0.1:53992 because of error: Failed to reach implicit threshold of 1 sub-policies, required 1 remaining: permission denied
  2019-01-06 19:01:05.602 UTC [orderer.common.server] func1 -&gt; DEBU 189 Closing Broadcast stream
  2019-01-06 19:01:05.602 UTC [comm.grpc.server] 1 -&gt; INFO 18a streaming call completed {"grpc.start_time": "2019-01-06T19:01:05.599Z", "grpc.service": "orderer.AtomicBroadcast", "grpc.method": "Broadcast", "grpc.peer_address": "127.0.0.1:53992", "grpc.code": "OK", "grpc.call_duration": "3.042122ms"}
  2019-01-06 19:01:05.605 UTC [common.deliver] Handle -&gt; WARN 18b Error reading from 127.0.0.1:53988: rpc error: code = Canceled desc = context canceled
  2019-01-06 19:01:05.605 UTC [grpc] warningf -&gt; DEBU 18c transport: http2Server.HandleStreams failed to read frame: read tcp 127.0.0.1:7050-&gt;127.0.0.1:53992: read: connection reset by peer
  2019-01-06 19:01:05.605 UTC [orderer.common.server] func1 -&gt; DEBU 18d Closing Deliver stream
  2019-01-06 19:01:05.605 UTC [grpc] infof -&gt; DEBU 18f transport: loopyWriter.run returning. connection error: desc = "transport is closing"
  2019-01-06 19:01:05.605 UTC [comm.grpc.server] 1 -&gt; INFO 18e streaming call completed {"grpc.start_time": "2019-01-06T19:01:05.599Z", "grpc.service": "orderer.AtomicBroadcast", "grpc.method": "Deliver", "grpc.peer_address": "127.0.0.1:53988", "error": "rpc error: code = Canceled desc = context canceled", "grpc.code": "Canceled", "grpc.call_duration": "6.48536ms"}
  2019-01-06 19:01:05.605 UTC [grpc] infof -&gt; DEBU 190 transport: loopyWriter.run returning. connection error: desc = "transport is closing"
  </code></pre>
  
  <p><strong>peer channel create Logs:</strong></p>
  
  <pre><code>2019-01-06 19:21:13.795 UTC [msp] setupSigningIdentity -&gt; DEBU 035 Signing identity expires at 2029-01-03 00:49:00 +0000 UTC
  2019-01-06 19:21:13.795 UTC [msp] Validate -&gt; DEBU 036 MSP TheChainMSP validating identity
  2019-01-06 19:21:13.795 UTC [msp] GetDefaultSigningIdentity -&gt; DEBU 037 Obtaining default signing identity
  2019-01-06 19:21:13.795 UTC [grpc] DialContext -&gt; DEBU 038 parsed scheme:""
  2019-01-06 19:21:13.795 UTC [grpc] DialContext -&gt; DEBU 039 scheme "" not registered, fallback to default scheme
  2019-01-06 19:21:13.795 UTC [grpc] watcher -&gt; DEBU 03a ccResolverWrapper: sending new addresses to cc: [{localhost:7050 0  &lt;nil&gt;}]
  2019-01-06 19:21:13.795 UTC [grpc] switchBalancer -&gt; DEBU 03b ClientConn switching balancer to "pick_first"
  2019-01-06 19:21:13.796 UTC [grpc] HandleSubConnStateChange -&gt; DEBU 03c pickfirstBalancer: HandleSubConnStateChange: 0xc00032a490, CONNECTING
  2019-01-06 19:21:13.798 UTC [grpc] HandleSubConnStateChange -&gt; DEBU 03d pickfirstBalancer: HandleSubConnStateChange: 0xc00032a490, READY
  2019-01-06 19:21:13.798 UTC [channelCmd] InitCmdFactory -&gt; INFO 03e Endorser and orderer connections initialized
  2019-01-06 19:21:13.799 UTC [msp] GetDefaultSigningIdentity -&gt; DEBU 03f Obtaining default signing identity
  2019-01-06 19:21:13.800 UTC [msp] GetDefaultSigningIdentity -&gt; DEBU 040 Obtaining default signing identity
  2019-01-06 19:21:13.800 UTC [msp.identity] Sign -&gt; DEBU 041 Sign: plaintext: 0A96060A0B546865436861696E4D5350...53616D706C65436F6E736F727469756D
  2019-01-06 19:21:13.800 UTC [msp.identity] Sign -&gt; DEBU 042 Sign: digest: EDB773D3B4483F960DA91D9CE5E21CA9F0512B808C9AE15B56B2CB1CE663B494
  2019-01-06 19:21:13.800 UTC [msp] GetDefaultSigningIdentity -&gt; DEBU 043 Obtaining default signing identity
  2019-01-06 19:21:13.800 UTC [msp] GetDefaultSigningIdentity -&gt; DEBU 044 Obtaining default signing identity
  2019-01-06 19:21:13.800 UTC [msp.identity] Sign -&gt; DEBU 045 Sign: plaintext: 0AD2060A1A08021A0608A9AAC9E10522...898F89F93F5DEF87555ED63A455E5CFF
  2019-01-06 19:21:13.800 UTC [msp.identity] Sign -&gt; DEBU 046 Sign: digest: BAA15E471F224FBF378D144154CF6B126823800A73EF3F9122CB30888C69645F
  2019-01-06 19:21:13.800 UTC [grpc] DialContext -&gt; DEBU 047 parsed scheme: ""
  2019-01-06 19:21:13.800 UTC [grpc] DialContext -&gt; DEBU 048 scheme "" not registered, fallback to default scheme
  2019-01-06 19:21:13.800 UTC [grpc] watcher -&gt; DEBU 049 ccResolverWrapper: sending new addresses to cc: [{localhost:7050 0  &lt;nil&gt;}]
  2019-01-06 19:21:13.800 UTC [grpc] switchBalancer -&gt; DEBU 04a ClientConn switching balancer to "pick_first"
  2019-01-06 19:21:13.800 UTC [grpc] HandleSubConnStateChange -&gt; DEBU 04b pickfirstBalancer: HandleSubConnStateChange: 0xc000242cc0, CONNECTING
  2019-01-06 19:21:13.801 UTC [grpc] HandleSubConnStateChange -&gt; DEBU 04c pickfirstBalancer: HandleSubConnStateChange: 0xc000242cc0, READY
  Error: got unexpected status: FORBIDDEN -- Failed to reach implicit threshold of 1 sub-policies, required 1 remaining: permission denied
  </code></pre>
  
  <p>Im not using TLS</p>
  
  <p>My server is ubuntu 16.04, im using Hyperledger Fabric v1.4 release 2 (20 dec). I tried creating new crypto material and modify the configtx.yaml file, but no ones worked, i get the same error.</p>
  
  <p><strong>crypto-config.yaml:</strong></p>
  
  <pre><code>OrdererOrgs:
    - Name: Orderer
      Domain: thechain.tech
      Specs:
        - Hostname: orderer
  PeerOrgs:
    - Name: AirMed Foundation
      Domain: airmedfoundation.tech
      Template:
        Count: 2
      Users:
        Count: 3
    - Name: The Chain
      Domain: thechain.tech
      Template:
        Count: 2
      Users:
        Count: 3
  </code></pre>
  
  <p><strong>configtxgen.yaml:</strong></p>
  
  <pre><code>---
  
  Capabilities:
      # Channel capabilities apply to both the orderers and the peers and must be
      # supported by both.
      # Set the value of the capability to true to require it.
      Channel: &amp;ChannelCapabilities
          # V1.3 for Channel is a catchall flag for behavior which has been
          # determined to be desired for all orderers and peers running at the v1.3.x
          # level, but which would be incompatible with orderers and peers from
          # prior releases.
          # Prior to enabling V1.3 channel capabilities, ensure that all
          # orderers and peers on a channel are at v1.3.0 or later.
          V1_3: true
  
      # Orderer capabilities apply only to the orderers, and may be safely
      # used with prior release peers.
      # Set the value of the capability to true to require it.
      Orderer: &amp;OrdererCapabilities
          # V1.1 for Orderer is a catchall flag for behavior which has been
          # determined to be desired for all orderers running at the v1.1.x
          # level, but which would be incompatible with orderers from prior releases.
          # Prior to enabling V1.1 orderer capabilities, ensure that all
          # orderers on a channel are at v1.1.0 or later.
          V1_1: true
  
      # Application capabilities apply only to the peer network, and may be safely
      # used with prior release orderers.
      # Set the value of the capability to true to require it.
      Application: &amp;ApplicationCapabilities
          # V1.3 for Application enables the new non-backwards compatible
          # features and fixes of fabric v1.3.
          V1_3: true
          # V1.2 for Application enables the new non-backwards compatible
          # features and fixes of fabric v1.2 (note, this need not be set if
          # later version capabilities are set)
          V1_2: false
          # V1.1 for Application enables the new non-backwards compatible
          # features and fixes of fabric v1.1 (note, this need not be set if
          # later version capabilities are set).
          V1_1: false
  
  
  Organizations:
  
      - &amp;OrdererOrg
          Name: OrdererTheChain
          ID: OrdererMSP
          MSPDir: /home/medical/fabric/crypto-material/crypto-config/ordererOrganizations/thechain.tech/orderers/orderer.thechain.tech/msp
          AdminPrincipal: Role.ADMIN
          Policies:
              Readers:
                  Type: Signature
                  Rule: "OR('OrdererMSP.admin', 'OrdererMSP.member')"
              Writers:
                  Type: Signature
                  Rule: "OR('OrdererMSP.admin', 'OrdererMSP.member')"
              Admins:
                  Type: Signature
                  Rule: "OR('OrdererMSP.admin')"
  
      - &amp;TheChainOrg
          Name: TheChain
          ID: TheChainMSP
          AdminPrincipal: Role.ADMIN
          AnchorPeers:
              - Host: 127.0.0.1
              Port: 7051
          MSPDir: /home/medical/fabric/crypto-material/crypto-config/peerOrganizations/thechain.tech/users/Admin@thechain.tech/msp
          Policies:
              Readers:
                  Type: Signature
                  Rule: "OR('TheChainMSP.admin', 'TheChainMSP.peer', 'TheChainMSP.client')"
              Writers:
                  Type: Signature
                  Rule: "OR('TheChainMSP.admin', 'TheChainMSP.client')"
              Admins:
                  Type: Signature
                  Rule: "OR('TheChainMSP.admin')"
  
      - &amp;AirMedFoundationOrg
          Name: AirMedFoundation
          ID: AirMedFoundationMSP
          AdminPrincipal: Role.ADMIN
          AnchorPeers:
              - Host: 127.0.0.1
              Port: 17051
          MSPDir: /home/medical/fabric/crypto-material/crypto-config/peerOrganizations/airmedfoundation.tech/users/Admin@airmedfoundation.tech/msp
          Policies:
              Readers:
                  Type: Signature
                  Rule: "OR('AirMedFoundationMSP.admin', 'AirMedFoundationMSP.peer', 'AirMedFoundationMSP.client')"
              Writers:
                  Type: Signature
                  Rule: "OR('AirMedFoundationMSP.admin', 'AirMedFoundationMSP.client')"
              Admins:
                  Type: Signature
                  Rule: "OR('AirMedFoundationMSP.admin')"
  
  Orderer: &amp;OrdererDefaults
  
      # Orderer Type: The orderer implementation to start.
      # Available types are "solo" and "kafka".
      OrdererType: solo
  
      Addresses:
          - localhost:7050
  
      # Batch Timeout: The amount of time to wait before creating a batch.
      BatchTimeout: 2s
  
      # Batch Size: Controls the number of messages batched into a block.
      BatchSize:
  
          # Max Message Count: The maximum number of messages to permit in a
          # batch.
          MaxMessageCount: 10
  
          # Absolute Max Bytes: The absolute maximum number of bytes allowed for
          # the serialized messages in a batch. If the "kafka" OrdererType is
          # selected, set 'message.max.bytes' and 'replica.fetch.max.bytes' on the
          # Kafka brokers to a value that is larger than this one.
          AbsoluteMaxBytes: 98 MB
  
          # Preferred Max Bytes: The preferred maximum number of bytes allowed for
          # the serialized messages in a batch. A message larger than the
          # preferred max bytes will result in a batch larger than preferred max
          # bytes.
          PreferredMaxBytes: 512 KB
  
      # Max Channels is the maximum number of channels to allow on the ordering
      # network. When set to 0, this implies no maximum number of channels.
      MaxChannels: 0
  
      Kafka:
          # Brokers: A list of Kafka brokers to which the orderer connects. Edit
          # this list to identify the brokers of the ordering service.
          # NOTE: Use IP:port notation.
          Brokers:
              - kafka0:9092
              - kafka1:9092
              - kafka2:9092
              - kafka3:9092
  
      # Organizations is the list of orgs which are defined as participants on
      # the orderer side of the network.
      Organizations:
  
      # Policies defines the set of policies at this level of the config tree
      # For Orderer policies, their canonical path is
      #   /Channel/Orderer/&lt;PolicyName&gt;
      Policies:
          Readers:
              Type: ImplicitMeta
              Rule: "ANY Readers"
          Writers:
              Type: ImplicitMeta
              Rule: "ANY Writers"
          Admins:
              Type: ImplicitMeta
              Rule: "MAJORITY Admins"
          # BlockValidation specifies what signatures must be included in the block
          # from the orderer for the peer to validate it.
          BlockValidation:
              Type: ImplicitMeta
              Rule: "ANY Writers"
  
      # Capabilities describes the orderer level capabilities, see the
      # dedicated Capabilities section elsewhere in this file for a full
      # description
      Capabilities:
          &lt;&lt;: *OrdererCapabilities
  
  
  Channel: &amp;ChannelDefaults
      # Policies defines the set of policies at this level of the config tree
      # For Channel policies, their canonical path is
      #   /Channel/&lt;PolicyName&gt;
      Policies:
          # Who may invoke the 'Deliver' API
          Readers:
              Type: ImplicitMeta
              Rule: "ANY Readers"
          # Who may invoke the 'Broadcast' API
          Writers:
              Type: ImplicitMeta
              Rule: "ANY Writers"
          # By default, who may modify elements at this config level
          Admins:
              Type: ImplicitMeta
              Rule: "MAJORITY Admins"
  
  
      # Capabilities describes the channel level capabilities, see the
      # dedicated Capabilities section elsewhere in this file for a full
      # description
      Capabilities:
          &lt;&lt;: *ChannelCapabilities
  
  Application: &amp;ApplicationDefaults
  
      # Organizations is the list of orgs which are defined as participants on
      # the application side of the network
      Organizations:
  
      # Policies defines the set of policies at this level of the config tree
      # For Application policies, their canonical path is
      #   /Channel/Application/&lt;PolicyName&gt;
      Policies:
          Readers:
              Type: ImplicitMeta
              Rule: "ANY Readers"
          Writers:
              Type: ImplicitMeta
              Rule: "ANY Writers"
          Admins:
              Type: ImplicitMeta
              Rule: "MAJORITY Admins"
  
      Capabilities:
          &lt;&lt;: *ApplicationCapabilities
  
  
  Profiles:
  
      TwoOrgsOrdererGenesis:
          &lt;&lt;: *ChannelDefaults
          Orderer:
              &lt;&lt;: *OrdererDefaults
              Organizations:
                  - *OrdererOrg
              Capabilities:
                  &lt;&lt;: *OrdererCapabilities
          Consortiums:
              SampleConsortium:
                  Organizations:
                      - *TheChainOrg
                      - *AirMedFoundationOrg
      TwoOrgsChannel:
          Consortium: SampleConsortium
          Application:
              &lt;&lt;: *ApplicationDefaults
              Organizations:
                  - *TheChainOrg
                  - *AirMedFoundationOrg
              Capabilities:
                  &lt;&lt;: *ApplicationCapabilities
  </code></pre>
  
  <p>I found this question that have a similar problem
  <a href="https://stackoverflow.com/questions/45726536/peer-channel-creation-fails-in-hyperledger-fabric">peer channel creation fails in Hyperledger Fabric</a>, i tried his solution and nothing change. I think the problem is for policy problems and my peers are not sign the transaction with the correct credentials, but i dont know how to fix it.</p>