title: Implicit policy evaluation failed - 0 sub-policies were satisfied, but this policy requires 1 of the 'Admins' sub-policies to be satisfied
body: <p>I am trying to create a channel from the CLI container,</p>
  
  <p>I have set correct values for CORE_PEER_LOCALMSPID = Org1MSP and CORE_PEER_MSPCONFIGPATH = /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.com/users/Admin@org1.com/msp .                                                   </p>
  
  <p>But when trying to create the channel I am getting below error from orderer log </p>
  
  <p><code>identity 0 does not satisfy principal: This identity is not an admin</code></p>
  
  <p>and the response message is </p>
  
  <p><code>error validating DeltaSet: policy for [Group]  /Channel/Application not satisfied: implicit policy evaluation failed - 0 sub-policies were satisfied, but this policy requires 1 of the 'Admins' sub-policies to be satisfied</code></p>
  
  <p>Please find the configtx.yaml file below,</p>
  
  <pre><code># Copyright IBM Corp. All Rights Reserved.
  #
  # SPDX-License-Identifier: Apache-2.0
  #
  
  ---
  ################################################################################
  #
  #   Section: Organizations
  #
  #   - This section defines the different organizational identities which will
  #   be referenced later in the configuration.
  #
  ################################################################################
  Organizations:
  
      # SampleOrg defines an MSP using the sampleconfig.  It should never be used
      # in production but may be used as a template for other definitions
      - &amp;OrdererOrg
          # DefaultOrg defines the organization which is used in the sampleconfig
          # of the fabric.git development environment
          Name: OrdererOrg
  
          # ID to load the MSP definition as
          ID: OrdererMSP
  
          # MSPDir is the filesystem path which contains the MSP configuration
          MSPDir: crypto-config/ordererOrganizations/org1.com/msp
  
          # Policies defines the set of policies at this level of the config tree
          # For organization policies, their canonical path is usually
          #   /Channel/&lt;Application|Orderer&gt;/&lt;OrgName&gt;/&lt;PolicyName&gt;
          Policies:
              Readers:
                  Type: Signature
                  Rule: "OR('OrdererMSP.member')"
              Writers:
                  Type: Signature
                  Rule: "OR('OrdererMSP.member')"
              Admins:
                  Type: Signature
                  Rule: "OR('OrdererMSP.admin')"
  
      - &amp;Org1
          # DefaultOrg defines the organization which is used in the sampleconfig
          # of the fabric.git development environment
          Name: Org1MSP
  
          # ID to load the MSP definition as
          ID: Org1MSP
  
          MSPDir: crypto-config/peerOrganizations/org1.com/msp
  
          # Policies defines the set of policies at this level of the config tree
          # For organization policies, their canonical path is usually
          #   /Channel/&lt;Application|Orderer&gt;/&lt;OrgName&gt;/&lt;PolicyName&gt;
          Policies:
              Readers:
                  Type: Signature
                  Rule: "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')"
              Writers:
                  Type: Signature
                  Rule: "OR('Org1MSP.admin', 'Org1MSP.client')"
              Admins:
                  Type: Signature
                  Rule: "OR('Org1MSP.admin')"
  
          # leave this flag set to true.
          AnchorPeers:
              # AnchorPeers defines the location of peers which can be used
              # for cross org gossip communication.  Note, this value is only
              # encoded in the genesis block in the Application section context
              - Host: peer0.org1.com
                Port: 7051
  
      - &amp;Org2
          # DefaultOrg defines the organization which is used in the sampleconfig
          # of the fabric.git development environment
          Name: Org2MSP
  
          # ID to load the MSP definition as
          ID: Org2MSP
  
          MSPDir: crypto-config/peerOrganizations/org2.com/msp
  
          # Policies defines the set of policies at this level of the config tree
          # For organization policies, their canonical path is usually
          #   /Channel/&lt;Application|Orderer&gt;/&lt;OrgName&gt;/&lt;PolicyName&gt;
          Policies:
              Readers:
                  Type: Signature
                  Rule: "OR('Org2MSP.admin', 'Org2MSP.peer', 'Org2MSP.client')"
              Writers:
                  Type: Signature
                  Rule: "OR('Org2MSP.admin', 'Org2MSP.client')"
              Admins:
                  Type: Signature
                  Rule: "OR('Org2MSP.admin')"
  
          AnchorPeers:
              # AnchorPeers defines the location of peers which can be used
              # for cross org gossip communication.  Note, this value is only
              # encoded in the genesis block in the Application section context
              - Host: peer0.org2.com
                Port: 9051
  
  ################################################################################
  #
  #   SECTION: Capabilities
  #
  #   - This section defines the capabilities of fabric network. This is a new
  #   concept as of v1.1.0 and should not be utilized in mixed networks with
  #   v1.0.x peers and orderers.  Capabilities define features which must be
  #   present in a fabric binary for that binary to safely participate in the
  #   fabric network.  For instance, if a new MSP type is added, newer binaries
  #   might recognize and validate the signatures from this type, while older
  #   binaries without this support would be unable to validate those
  #   transactions.  This could lead to different versions of the fabric binaries
  #   having different world states.  Instead, defining a capability for a channel
  #   informs those binaries without this capability that they must cease
  #   processing transactions until they have been upgraded.  For v1.0.x if any
  #   capabilities are defined (including a map with all capabilities turned off)
  #   then the v1.0.x peer will deliberately crash.
  #
  ################################################################################
  Capabilities:
      # Channel capabilities apply to both the orderers and the peers and must be
      # supported by both.
      # Set the value of the capability to true to require it.
      Channel: &amp;ChannelCapabilities
          # V1.3 for Channel is a catchall flag for behavior which has been
          # determined to be desired for all orderers and peers running at the v1.3.x
          # level, but which would be incompatible with orderers and peers from
          # prior releases.
          # Prior to enabling V1.3 channel capabilities, ensure that all
          # orderers and peers on a channel are at v1.3.0 or later.
          V1_3: true
  
      # Orderer capabilities apply only to the orderers, and may be safely
      # used with prior release peers.
      # Set the value of the capability to true to require it.
      Orderer: &amp;OrdererCapabilities
          # V1.1 for Orderer is a catchall flag for behavior which has been
          # determined to be desired for all orderers running at the v1.1.x
          # level, but which would be incompatible with orderers from prior releases.
          # Prior to enabling V1.1 orderer capabilities, ensure that all
          # orderers on a channel are at v1.1.0 or later.
          V1_1: true
  
      # Application capabilities apply only to the peer network, and may be safely
      # used with prior release orderers.
      # Set the value of the capability to true to require it.
      Application: &amp;ApplicationCapabilities
          # V1.3 for Application enables the new non-backwards compatible
          # features and fixes of fabric v1.3.
          V1_3: true
          # V1.2 for Application enables the new non-backwards compatible
          # features and fixes of fabric v1.2 (note, this need not be set if
          # later version capabilities are set)
          V1_2: false
          # V1.1 for Application enables the new non-backwards compatible
          # features and fixes of fabric v1.1 (note, this need not be set if
          # later version capabilities are set).
          V1_1: false
  
  ################################################################################
  #
  #   SECTION: Application
  #
  #   - This section defines the values to encode into a config transaction or
  #   genesis block for application related parameters
  #
  ################################################################################
  Application: &amp;ApplicationDefaults
  
      # Organizations is the list of orgs which are defined as participants on
      # the application side of the network
      Organizations:
  
      # Policies defines the set of policies at this level of the config tree
      # For Application policies, their canonical path is
      #   /Channel/Application/&lt;PolicyName&gt;
      Policies:
          Readers:
              Type: ImplicitMeta
              Rule: "ANY Readers"
          Writers:
              Type: ImplicitMeta
              Rule: "ANY Writers"
          Admins:
              Type: ImplicitMeta
              Rule: "ANY Admins"
  
      Capabilities:
          &lt;&lt;: *ApplicationCapabilities
  ################################################################################
  #
  #   SECTION: Orderer
  #
  #   - This section defines the values to encode into a config transaction or
  #   genesis block for orderer related parameters
  #
  ################################################################################
  Orderer: &amp;OrdererDefaults
  
      # Orderer Type: The orderer implementation to start
      # Available types are "solo" and "kafka"
      OrdererType: solo
  
      Addresses:
          - orderer.org1.com:7050
  
      # Batch Timeout: The amount of time to wait before creating a batch
      BatchTimeout: 2s
  
      # Batch Size: Controls the number of messages batched into a block
      BatchSize:
  
          # Max Message Count: The maximum number of messages to permit in a batch
          MaxMessageCount: 10
  
          # Absolute Max Bytes: The absolute maximum number of bytes allowed for
          # the serialized messages in a batch.
          AbsoluteMaxBytes: 99 MB
  
          # Preferred Max Bytes: The preferred maximum number of bytes allowed for
          # the serialized messages in a batch. A message larger than the preferred
          # max bytes will result in a batch larger than preferred max bytes.
          PreferredMaxBytes: 512 KB
  
      Kafka:
          # Brokers: A list of Kafka brokers to which the orderer connects
          # NOTE: Use IP:port notation
          Brokers:
              - 127.0.0.1:9092
  
      # Organizations is the list of orgs which are defined as participants on
      # the orderer side of the network
      Organizations:
  
      # Policies defines the set of policies at this level of the config tree
      # For Orderer policies, their canonical path is
      #   /Channel/Orderer/&lt;PolicyName&gt;
      Policies:
          Readers:
              Type: ImplicitMeta
              Rule: "ANY Readers"
          Writers:
              Type: ImplicitMeta
              Rule: "ANY Writers"
          Admins:
              Type: ImplicitMeta
              Rule: "ANY Admins"
          # BlockValidation specifies what signatures must be included in the block
          # from the orderer for the peer to validate it.
          BlockValidation:
              Type: ImplicitMeta
              Rule: "ANY Writers"
  
  ################################################################################
  #
  #   CHANNEL
  #
  #   This section defines the values to encode into a config transaction or
  #   genesis block for channel related parameters.
  #
  ################################################################################
  Channel: &amp;ChannelDefaults
      # Policies defines the set of policies at this level of the config tree
      # For Channel policies, their canonical path is
      #   /Channel/&lt;PolicyName&gt;
      Policies:
          # Who may invoke the 'Deliver' API
          Readers:
              Type: ImplicitMeta
              Rule: "ANY Readers"
          # Who may invoke the 'Broadcast' API
          Writers:
              Type: ImplicitMeta
              Rule: "ANY Writers"
          # By default, who may modify elements at this config level
          Admins:
              Type: ImplicitMeta
              Rule: "ANY Admins"
  
      # Capabilities describes the channel level capabilities, see the
      # dedicated Capabilities section elsewhere in this file for a full
      # description
      Capabilities:
          &lt;&lt;: *ChannelCapabilities
  
  ################################################################################
  #
  #   Profile
  #
  #   - Different configuration profiles may be encoded here to be specified
  #   as parameters to the configtxgen tool
  #
  ################################################################################
  Profiles:
  
      TwoOrgsChannel:
          Consortium: SampleConsortium
          &lt;&lt;: *ChannelDefaults
          Application:
              &lt;&lt;: *ApplicationDefaults
              Organizations:
                  - *Org1
                  - *Org2
              Capabilities:
                  &lt;&lt;: *ApplicationCapabilities
  
  
      SampleMultiNodeEtcdRaft:
          &lt;&lt;: *ChannelDefaults
          Capabilities:
              &lt;&lt;: *ChannelCapabilities
          Orderer:
              &lt;&lt;: *OrdererDefaults
              OrdererType: etcdraft
              EtcdRaft:
                  Consenters:
                  - Host: orderer.org1.com
                    Port: 7050
                    ClientTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer.org1.com/tls/server.crt
                    ServerTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer.org1.com/tls/server.crt
                  - Host: orderer2.org1.com
                    Port: 7050
                    ClientTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer2.org1.com/tls/server.crt
                    ServerTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer2.org1.com/tls/server.crt
                  - Host: orderer3.org1.com
                    Port: 7050
                    ClientTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer3.org1.com/tls/server.crt
                    ServerTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer3.org1.com/tls/server.crt
                  - Host: orderer4.org1.com
                    Port: 7050
                    ClientTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer4.org1.com/tls/server.crt
                    ServerTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer4.org1.com/tls/server.crt
                  - Host: orderer5.org1.com
                    Port: 7050
                    ClientTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer5.org1.com/tls/server.crt
                    ServerTLSCert: crypto-config/ordererOrganizations/org1.com/orderers/orderer5.org1.com/tls/server.crt
              Addresses:
                  - orderer.org1.com:7050
                  - orderer2.org1.com:7050
                  - orderer3.org1.com:7050
                  - orderer4.org1.com:7050
                  - orderer5.org1.com:7050
  
              Organizations:
              - *OrdererOrg
              Capabilities:
                  &lt;&lt;: *OrdererCapabilities
          Application:
              &lt;&lt;: *ApplicationDefaults
              Organizations:
              - &lt;&lt;: *OrdererOrg
          Consortiums:
              SampleConsortium:
                  Organizations:
                  - *Org1
                  - *Org2
  </code></pre>