hyperledger/fabric · error · msgprocessor.ErrPermissionDenied

permission denied

Error message

permission denied

What it means

chainACL.Evaluate in orderer/consensus/smartbft/chain.go:666 wraps msgprocessor.ErrPermissionDenied ("permission denied") when the channel's ChannelWriters policy fails to evaluate the signature set of an incoming envelope. The SmartBFT orderer node rejected the message because the submitting identity is not authorized as a channel writer. The underlying policy error is logged at debug level and only the wrapped permission-denied error is returned.

Source

Thrown at orderer/consensus/smartbft/chain.go:666

	}
}

type chainACL struct {
	policyManager policies.Manager
	Logger        *flogging.FabricLogger
}

// Evaluate evaluates signed data
func (c *chainACL) Evaluate(signatureSet []*protoutil.SignedData) error {
	policy, ok := c.policyManager.GetPolicy(policies.ChannelWriters)
	if !ok {
		return fmt.Errorf("could not find policy %s", policies.ChannelWriters)
	}

	err := policy.EvaluateSignedData(signatureSet)
	if err != nil {
		c.Logger.Debugf("SigFilter evaluation failed: %s, policyName: %s", err.Error(), policies.ChannelWriters)
		return errors.Wrap(errors.WithStack(msgprocessor.ErrPermissionDenied), err.Error())
	}
	return nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check orderer debug logs for 'SigFilter evaluation failed' to see the underlying policy error and which identity was rejected.
2. Verify the submitting identity satisfies the channel's /Channel/Writers policy (org MSP role, NODE OU, or explicit principal).
3. Update the channel Writers policy via a config update if the identity should be authorized, then restart submission.
4. Ensure the client signs with the same MSP identity set as the envelope creator (creator header matches signature certificate).
5. Confirm the MSP certs of the submitter are included in the channel config and not expired/revoked.

Example fix

// before: client signs config update with non-writer identity
env, _ := protoutil.CreateSignedEnvelope(...) // signed by reader-only identity
// after: sign with an identity satisfying /Channel/Writers
signer, _ := mspmgmt.GetLocalMSP().GetDefaultSigningIdentity()
env, _ := protoutil.CreateSignedEnvelopeWithSigningIdentity(
    common.HeaderType_CONFIG, channelID, signer, configUpdate, 0, 0)

policy, ok := policyManager.GetPolicy(policies.ChannelWriters)
if !ok {
    return fmt.Errorf("channel has no %s policy", policies.ChannelWriters)
}
if err := policy.EvaluateSignedData(signatureSet); err != nil {
    return fmt.Errorf("submitter identity does not satisfy %s: %w", policies.ChannelWriters, err)
}

func isPermissionDenied(err error) bool {
    return errors.Is(err, msgprocessor.ErrPermissionDenied)
}

if err := acl.Evaluate(signatureSet); err != nil {
    if errors.Is(err, msgprocessor.ErrPermissionDenied) {
        // unauthorized submitter: reject with 403-equivalent, do not retry
        return status.Errorf(codes.PermissionDenied, "submitter not in channel Writers policy")
    }
    return err
}

When it happens

Trigger: An envelope (typically a config update or normal transaction) is submitted to a SmartBFT ordering node; AccessController.Evaluate is called with the envelope's signature set; policyManager.GetPolicy(policies.ChannelWriters) succeeds but policy.EvaluateSignedData(signatureSet) returns an error (signature invalid, identity not a member, signer not satisfying Writers policy).

Common situations: Submitting config updates or transactions with an identity not listed in the channel Writers policy; using an org's admin cert where only writer certs satisfy the policy; signature verification failures due to cert rotation/expiry; misconfigured Writers policy (e.g. ANY Writers removed or restricted to a different org); submitting from an SDK with a signing identity that mismatches the envelope creator.

Related errors

• access denied
• Empty policy element
• missing policy at path: %s
• ConfigPolicy not found at policy path: %s
• unexpected missing policy %s for item %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f0438d7956ccdc45. Report an issue: GitHub.