{"record":{"id":"9511c2a7c0d5d718","repo":"hyperledger/fabric","slug":"permission-denied","errorCode":null,"errorMessage":"permission denied","messagePattern":"permission denied","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/msgprocessor/msgprocessor.go","lineNumber":32,"sourceCode":"\t\"github.com/hyperledger/fabric-lib-go/common/flogging\"\n\tcb \"github.com/hyperledger/fabric-protos-go-apiv2/common\"\n)\n\nconst (\n\t// These should eventually be derived from the channel support once enabled\n\tmsgVersion = int32(0)\n\tepoch      = 0\n)\n\nvar logger = flogging.MustGetLogger(\"orderer.common.msgprocessor\")\n\n// ErrChannelDoesNotExist is returned by the system channel for transactions which\n// are not for the system channel ID and are not attempting to create a new channel\nvar ErrChannelDoesNotExist = errors.New(\"channel does not exist\")\n\n// ErrPermissionDenied is returned by errors which are caused by transactions\n// which are not permitted due to an authorization failure.\nvar ErrPermissionDenied = errors.New(\"permission denied\")\n\n// ErrMaintenanceMode is returned when transactions are rejected because the orderer is in \"maintenance mode\",\n// as defined by ConsensusType.State != NORMAL. This typically happens during consensus-type migration.\nvar ErrMaintenanceMode = errors.New(\"maintenance mode\")\n\n// Classification represents the possible message types for the system.\ntype Classification int\n\nconst (\n\t// NormalMsg is the class of standard (endorser or otherwise non-config) messages.\n\t// Messages of this type should be processed by ProcessNormalMsg.\n\tNormalMsg Classification = iota\n\n\t// ConfigUpdateMsg indicates messages of type CONFIG_UPDATE.\n\t// Messages of this type should be processed by ProcessConfigUpdateMsg.\n\tConfigUpdateMsg\n\n\t// ConfigMsg indicates message of type CONFIG.","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/msgprocessor/msgprocessor.go#L14-L50","documentation":"ErrPermissionDenied is a sentinel error returned when a transaction fails the channel's write-set / message policy evaluation — the submitting principal is not authorized. broadcast.ClassifyError maps it to FORBIDDEN, and ProcessConfigMsg/Apply surface it whenever the signature set does not satisfy the required config policy.","triggerScenarios":"Broadcasting a config or normal message whose creator MSP / signature set fails the channel Writers policy or the applicable config update policy (e.g. Orderer group admins policy during maintenance-mode updates).","commonSituations":"Using an identity from an org lacking write rights; missing or stale signatures on config update envelopes; MSP certificates expired or from the wrong organization.","solutions":["Submit the transaction with an identity whose organization satisfies the channel Writers (or config update admins) policy.","Collect the required policy signatures (e.g. majority of orderer org admins) for config updates before broadcasting.","Check that the submitting peer's MSP certificates are current and correctly enrolled."],"exampleFix":"// before\nenv := signWith(clientOrgIdentity, payload) // org lacks write rights\n// after\nenv := signWith(ordererAdminIdentity, payload)","handlingStrategy":"try-catch","validationCode":"// ensure principal satisfies Writers policy before submit\nif !channelWriterPolicy.Evaluate([]*msp.Identity{submitter}) {\n    return errors.New(\"submitter does not satisfy channel Writers policy\")\n}","typeGuard":null,"tryCatchPattern":"err := broadcastClient.Send(env)\nif errors.Cause(err) == statusError(cb.Status_FORBIDDEN) {\n    // authorization failure: fix identity/signatures, do not retry blindly\n}","preventionTips":["Sign config updates with identities from organizations in the applicable admins policy.","Collect all required policy signatures before broadcasting.","Keep MSP certificates current and verify org membership at enrollment."],"tags":["hyperledger-fabric","authorization","msp"],"backgroundTag":"permission-denied","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}