title: access denied: channel [mychannel] creator org [Org2MSP]
body: <p>Im trying to setup a hyperledger fabric network wtih 2 organizations base on byfn. The network consist of the following nodes:</p>
  
  <pre><code>cli 
  peer1.org1.example.com 
  peer0.org2.example.com 
  peer1.org2.example.com 
  peer0.org1.example.com 
  orderer.example.com 
  couchdb3 
  couchdb2 
  couchdb1 
  ca.org1.example.com 
  couchdb0 
  ca.org2.example.com 
  </code></pre>
  
  <p>I using fabcar chaincode for this network and have no problem enrolling Admin, registering User and query from peer in Org1. </p>
  
  <p>But when i try to perform the same query from a peer in Org2, I get the following error :</p>
  
  <p><em>Error: 2 UNKNOWN: access denied: channel [mychannel] creator org [Org2MSP]</em></p>
  
  <p>Would like to ask if anyone know what this error means and how can I fix this?</p>
  
  <p>Following are the steps and configuration files I have used:</p>
  
  <pre><code>./byfn.sh -m down
  
  # clean the keystore
  rm -rf ./hfc-key-store
  rm -rf ./hfc-key-store2
  
  #Generate artifacts
  ../bin/cryptogen generate --config=./crypto-config.yaml
  export FABRIC_CFG_PATH=$PWD
  ../bin/configtxgen -profile TwoOrgsOrdererGenesis -outputBlock ./channel-artifacts/genesis.block
  export CHANNEL_NAME=mychannel  &amp;&amp; ../bin/configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/channel.tx -channelID $CHANNEL_NAME
  ../bin/configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ./channel-artifacts/Org1MSPanchors.tx -channelID $CHANNEL_NAME -asOrg Org1MSP
  ../bin/configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ./channel-artifacts/Org2MSPanchors.tx -channelID $CHANNEL_NAME -asOrg Org2MSP
  </code></pre>
  
  <p>Then replace ca0 and ca1 keyfile in docker-compose-cli.yaml :</p>
  
  <pre><code># Copyright IBM Corp. All Rights Reserved.
  #
  # SPDX-License-Identifier: Apache-2.0
  #
  
  version: '2'
  
  volumes:
    orderer.example.com:
    peer0.org1.example.com:
    peer1.org1.example.com:
    peer0.org2.example.com:
    peer1.org2.example.com:
  
  networks:
    byfn:
  
  services:
  
    ca0:
      image: hyperledger/fabric-ca:$IMAGE_TAG
      environment:
        - CORE_LOGGING_LEVEL=DEBUG
        - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
        - FABRIC_CA_SERVER_CA_NAME=ca-org1
        - FABRIC_CA_SERVER_CA_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org1.example.com-cert.pem
        - FABRIC_CA_SERVER_CA_KEYFILE=/etc/hyperledger/fabric-ca-server-config/f6aa4b99b3177c86e00e55e4ed5dea88ec0c67f27327955eb978b9bf80d6116e_sk
      ports:
        - "7054:7054"
      command: sh -c 'fabric-ca-server start -b admin:adminpw -d'
      volumes:
        - ./crypto-config/peerOrganizations/org1.example.com/ca/:/etc/hyperledger/fabric-ca-server-config
      container_name: ca.org1.example.com
      networks:
        - byfn
  
    ca1:
      image: hyperledger/fabric-ca:$IMAGE_TAG
      environment:
        - CORE_LOGGING_LEVEL=DEBUG
        - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
        - FABRIC_CA_SERVER_CA_NAME=ca-org2
        - FABRIC_CA_SERVER_TLS_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org2.example.com-cert.pem
        - FABRIC_CA_SERVER_TLS_KEYFILE=/etc/hyperledger/fabric-ca-server-config/e6a77b168161b5032d393f9590ad6e61c9d4cde51ca6cfeb8b9dc4d1932b2be9_sk
      ports:
        - "8054:7054"
      command: sh -c 'fabric-ca-server start -b admin:adminpw -d'
      volumes:
        - ./crypto-config/peerOrganizations/org2.example.com/ca/:/etc/hyperledger/fabric-ca-server-config
      container_name: ca.org2.example.com
      networks:
        - byfn
  
    orderer.example.com:
      extends:
        file:   base/docker-compose-base.yaml
        service: orderer.example.com
      container_name: orderer.example.com
      networks:
        - byfn
  
    peer0.org1.example.com:
      container_name: peer0.org1.example.com
      extends:
        file:  base/docker-compose-base.yaml
        service: peer0.org1.example.com
      networks:
        - byfn
  
    peer1.org1.example.com:
      container_name: peer1.org1.example.com
      extends:
        file:  base/docker-compose-base.yaml
        service: peer1.org1.example.com
      networks:
        - byfn
  
    peer0.org2.example.com:
      container_name: peer0.org2.example.com
      extends:
        file:  base/docker-compose-base.yaml
        service: peer0.org2.example.com
      networks:
        - byfn
  
    peer1.org2.example.com:
      container_name: peer1.org2.example.com
      extends:
        file:  base/docker-compose-base.yaml
        service: peer1.org2.example.com
      networks:
        - byfn
  
    cli:
      container_name: cli
      image: hyperledger/fabric-tools:$IMAGE_TAG
      tty: true
      stdin_open: true
      environment:
        - GOPATH=/opt/gopath
        - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        - CORE_LOGGING_LEVEL=DEBUG
        #- CORE_LOGGING_LEVEL=INFO
        - CORE_PEER_ID=cli
        - CORE_PEER_ADDRESS=peer0.org1.example.com:7051
        - CORE_PEER_LOCALMSPID=Org1MSP
        #- CORE_PEER_TLS_ENABLED=true
        #- CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt
        #- CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key
        #- CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt
        - CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp
      working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
      command: /bin/bash
      volumes:
          - /var/run/:/host/var/run/
          - ./../chaincode/:/opt/gopath/src/github.com/chaincode
          - ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
          - ./scripts:/opt/gopath/src/github.com/hyperledger/fabric/peer/scripts/
          - ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts
      depends_on:
        - orderer.example.com
        - peer0.org1.example.com
        - peer1.org1.example.com
        - peer0.org2.example.com
        - peer1.org2.example.com
      networks:
        - byfn
  </code></pre>
  
  <p>Then run the following to setup the network and install the chaincodes</p>
  
  <pre><code>#Startup dockers
  docker-compose -f docker-compose-cli.yaml -f docker-compose-couch.yaml up -d
  sleep 30
  
  docker exec cli peer channel create -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/channel.tx
  sleep 10
  docker exec cli peer channel join -b mychannel.block
  
  docker exec -e "CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp" -e "CORE_PEER_ADDRESS=peer0.org2.example.com:7051" -e "CORE_PEER_LOCALMSPID=Org2MSP" cli peer channel join -b mychannel.block
  
  docker exec cli peer channel update -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/Org1MSPanchors.tx 
  
  docker exec -e "CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp" -e "CORE_PEER_ADDRESS=peer0.org2.example.com:7051" -e "CORE_PEER_LOCALMSPID=Org2MSP" cli peer channel update -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/Org2MSPanchors.tx
  
  #Install chaincode
  docker exec cli peer chaincode install -n fabcar -v 1.0 -p github.com/chaincode/fabcar/go
  
  docker exec -e "CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp" -e "CORE_PEER_ADDRESS=peer0.org2.example.com:7051" -e "CORE_PEER_LOCALMSPID=Org2MSP" cli peer chaincode install -n fabcar -v 1.0 -p github.com/chaincode/fabcar/go
  
  docker exec cli peer chaincode instantiate -o orderer.example.com:7050 -C mychannel -n fabcar -v 1.0 -c '{"Args":[""]}' -P "OR ('Org1MSP.member','Org2MSP.member')"
  sleep 10
  docker exec cli peer chaincode invoke -o orderer.example.com:7050 -C mychannel -n fabcar -c '{"function":"initLedger","Args":[""]}'
  </code></pre>
  
  <p>Next I run node enrollAdmin.js</p>
  
  <pre><code>'use strict';
  /*
  * Copyright IBM Corp All Rights Reserved
  *
  * SPDX-License-Identifier: Apache-2.0
  */
  /*
   * Enroll the admin user
   */
  
  var Fabric_Client = require('fabric-client');
  var Fabric_CA_Client = require('fabric-ca-client');
  
  var path = require('path');
  var util = require('util');
  var os = require('os');
  
  //
  var fabric_client = new Fabric_Client();
  var fabric_ca_client = null;
  var admin_user = null;
  var member_user = null;
  var store_path = path.join(__dirname, 'hfc-key-store2');
  console.log(' Store path:'+store_path);
  
  // create the key value store as defined in the fabric-client/config/default.json 'key-value-store' setting
  Fabric_Client.newDefaultKeyValueStore({ path: store_path
  }).then((state_store) =&gt; {
      // assign the store to the fabric client
      fabric_client.setStateStore(state_store);
      var crypto_suite = Fabric_Client.newCryptoSuite();
      // use the same location for the state store (where the users' certificate are kept)
      // and the crypto store (where the users' keys are kept)
      var crypto_store = Fabric_Client.newCryptoKeyStore({path: store_path});
      crypto_suite.setCryptoKeyStore(crypto_store);
      fabric_client.setCryptoSuite(crypto_suite);
      var tlsOptions = {
          trustedRoots: [],
          verify: false
      };
      // be sure to change the http to https when the CA is running TLS enabled
      fabric_ca_client = new Fabric_CA_Client('http://localhost:8054', tlsOptions , 'ca-org2', crypto_suite);
  
      // first check to see if the admin is already enrolled
      return fabric_client.getUserContext('admin', true);
  }).then((user_from_store) =&gt; {
      if (user_from_store &amp;&amp; user_from_store.isEnrolled()) {
          console.log('Successfully loaded admin from persistence');
          admin_user = user_from_store;
          return null;
      } else {
          // need to enroll it with CA server
          return fabric_ca_client.enroll({
            enrollmentID: 'admin',
            enrollmentSecret: 'adminpw'
          }).then((enrollment) =&gt; {
            console.log('Successfully enrolled admin user "admin"');
            return fabric_client.createUser(
                {username: 'admin',
                    mspid: 'Org2MSP',
                    cryptoContent: { privateKeyPEM: enrollment.key.toBytes(), signedCertPEM: enrollment.certificate }
                });
          }).then((user) =&gt; {
            admin_user = user;
            return fabric_client.setUserContext(admin_user);
          }).catch((err) =&gt; {
            console.error('Failed to enroll and persist admin. Error: ' + err.stack ? err.stack : err);
            throw new Error('Failed to enroll admin');
          });
      }
  }).then(() =&gt; {
      console.log('Assigned the admin user to the fabric client ::' + admin_user.toString());
  }).catch((err) =&gt; {
      console.error('Failed to enroll admin: ' + err);
  });
  </code></pre>
  
  <p>Then run node registerUser.js</p>
  
  <pre><code>'use strict';
  /*
  * Copyright IBM Corp All Rights Reserved
  *
  * SPDX-License-Identifier: Apache-2.0
  */
  /*
   * Register and Enroll a user
   */
  
  var Fabric_Client = require('fabric-client');
  var Fabric_CA_Client = require('fabric-ca-client');
  
  var path = require('path');
  var util = require('util');
  var os = require('os');
  
  //
  var fabric_client = new Fabric_Client();
  var fabric_ca_client = null;
  var admin_user = null;
  var member_user = null;
  var store_path = path.join(__dirname, 'hfc-key-store2');
  console.log(' Store path:'+store_path);
  
  // create the key value store as defined in the fabric-client/config/default.json 'key-value-store' setting
  Fabric_Client.newDefaultKeyValueStore({ path: store_path
  }).then((state_store) =&gt; {
      // assign the store to the fabric client
      fabric_client.setStateStore(state_store);
      var crypto_suite = Fabric_Client.newCryptoSuite();
      // use the same location for the state store (where the users' certificate are kept)
      // and the crypto store (where the users' keys are kept)
      var crypto_store = Fabric_Client.newCryptoKeyStore({path: store_path});
      crypto_suite.setCryptoKeyStore(crypto_store);
      fabric_client.setCryptoSuite(crypto_suite);
      var tlsOptions = {
          trustedRoots: [],
          verify: false
      };
      // be sure to change the http to https when the CA is running TLS enabled
      fabric_ca_client = new Fabric_CA_Client('http://localhost:8054', null , '', crypto_suite);
  
      // first check to see if the admin is already enrolled
      return fabric_client.getUserContext('admin', true);
  }).then((user_from_store) =&gt; {
      if (user_from_store &amp;&amp; user_from_store.isEnrolled()) {
          console.log('Successfully loaded admin from persistence');
          admin_user = user_from_store;
      } else {
          throw new Error('Failed to get admin.... run enrollAdmin.js');
      }
  
      // at this point we should have the admin user
      // first need to register the user with the CA server
      return fabric_ca_client.register({enrollmentID: 'User1', affiliation: 'org2.department1',role: 'client'}, admin_user);
  }).then((secret) =&gt; {
      // next we need to enroll the user with CA server
      console.log('Successfully registered user2 - secret:'+ secret);
  
      return fabric_ca_client.enroll({enrollmentID: 'User1', enrollmentSecret: secret});
  }).then((enrollment) =&gt; {
    console.log('Successfully enrolled member user "User1" ');
    return fabric_client.createUser(
       {username: 'User1',
       mspid: 'Org2MSP',
       cryptoContent: { privateKeyPEM: enrollment.key.toBytes(), signedCertPEM: enrollment.certificate }
       });
  }).then((user) =&gt; {
       member_user = user;
  
       return fabric_client.setUserContext(member_user);
  }).then(()=&gt;{
       console.log('User1 was successfully registered and enrolled and is ready to intreact with the fabric network');
  
  }).catch((err) =&gt; {
      console.error('Failed to register: ' + err);
      if(err.toString().indexOf('Authorization') &gt; -1) {
          console.error('Authorization failures may be caused by having admin credentials from a previous CA instance.\n' +
          'Try again after deleting the contents of the store directory '+store_path);
      }
  });
  </code></pre>
  
  <p>Then node query.js</p>
  
  <pre><code>'use strict';
  /*
  * Copyright IBM Corp All Rights Reserved
  *
  * SPDX-License-Identifier: Apache-2.0
  */
  /*
   * Chaincode query
   */
  
  var Fabric_Client = require('fabric-client');
  var path = require('path');
  var util = require('util');
  var os = require('os');
  
  //
  var fabric_client = new Fabric_Client();
  
  // setup the fabric network
  var channel = fabric_client.newChannel('mychannel');
  var peer = fabric_client.newPeer('grpc://localhost:9051');
  channel.addPeer(peer);
  
  //
  var member_user = null;
  var store_path = path.join(__dirname, 'hfc-key-store2');
  console.log('Store path:'+store_path);
  var tx_id = null;
  
  // create the key value store as defined in the fabric-client/config/default.json 'key-value-store' setting
  Fabric_Client.newDefaultKeyValueStore({ path: store_path
  }).then((state_store) =&gt; {
      // assign the store to the fabric client
      fabric_client.setStateStore(state_store);
      var crypto_suite = Fabric_Client.newCryptoSuite();
      // use the same location for the state store (where the users' certificate are kept)
      // and the crypto store (where the users' keys are kept)
      var crypto_store = Fabric_Client.newCryptoKeyStore({path: store_path});
      crypto_suite.setCryptoKeyStore(crypto_store);
      fabric_client.setCryptoSuite(crypto_suite);
  
      // get the enrolled user from persistence, this user will sign all requests
      return fabric_client.getUserContext('User1', true);
  }).then((user_from_store) =&gt; {
      if (user_from_store &amp;&amp; user_from_store.isEnrolled()) {
          console.log('Successfully loaded User1 from persistence');
          member_user = user_from_store;
      } else {
          throw new Error('Failed to get User1.... run registerUser.js');
      }
  console.log('1');
      // queryCar chaincode function - requires 1 argument, ex: args: ['CAR4'],
      // queryAllCars chaincode function - requires no arguments , ex: args: [''],
      const request = {
          //targets : --- letting this default to the peers assigned to the channel
          chaincodeId: 'fabcar',
          fcn: 'queryAllCars',
          args: ['']
      };
  console.log('2');
      // send the query proposal to the peer
      return channel.queryByChaincode(request);
  }).then((query_responses) =&gt; {
      console.log("Query has completed, checking results");
      // query_responses could have more than one  results if there multiple peers were used as targets
      if (query_responses &amp;&amp; query_responses.length == 1) {
          if (query_responses[0] instanceof Error) {
              console.error("error from query = ", query_responses[0]);
          } else {
              console.log("Response is ", query_responses[0].toString());
          }
      } else {
          console.log("No payloads were returned from query");
      }
  }).catch((err) =&gt; {
  console.log('3');
      console.error('Failed to query successfully :: ' + err);
  });
  </code></pre>