{"record":{"id":"23fefd2d090672fa","repo":"grpc/grpc-go","slug":"extauthz-failed-to-parse-grpc-service-v","errorCode":null,"errorMessage":"extauthz: failed to parse grpc_service: %v","messagePattern":"extauthz: failed to parse grpc_service: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/httpfilter/ext_authz/ext_authz.go","lineNumber":107,"sourceCode":"\treturn codes.Unknown\n}\n\nfunc (builder) ParseFilterConfig(cfg proto.Message) (httpfilter.FilterConfig, error) {\n\tm, ok := cfg.(*anypb.Any)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"extauthz: error parsing config %v: unknown type %T, want *anypb.Any\", cfg, cfg)\n\t}\n\tmsg := new(v3extauthzpb.ExtAuthz)\n\tif err := m.UnmarshalTo(msg); err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to unmarshal config: %v\", err)\n\t}\n\n\tif msg.GetGrpcService() == nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: empty grpc_service provided in config %v\", cfg)\n\t}\n\tserver, err := parseGRPCServiceConfig(msg.GetGrpcService())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"extauthz: failed to parse grpc_service: %v\", err)\n\t}\n\n\tfilterEnabled, err := parseFilterEnabled(msg.GetFilterEnabled())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar denyAtDisable bool\n\tif denyAtDisableFlag := msg.GetDenyAtDisable(); denyAtDisableFlag != nil {\n\t\tif denyAtDisableFlag.GetDefaultValue() == nil {\n\t\t\treturn nil, fmt.Errorf(\"extauthz: missing default_value in deny_at_disable\")\n\t\t}\n\t\tdenyAtDisable = denyAtDisableFlag.GetDefaultValue().GetValue()\n\t}\n\n\thttpStatus := int32(http.StatusForbidden)\n\tif st := msg.GetStatusOnError().GetCode(); st != 0 {\n\t\thttpStatus = int32(st)","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/httpfilter/ext_authz/ext_authz.go#L89-L125","documentation":"Raised by ParseFilterConfig (ext_authz.go:107) when parseGRPCServiceConfig rejects the supplied GrpcService proto. In this build parseGRPCServiceConfig (ext_authz.go:48) is a placeholder that returns 'parseGRPCServiceConfig not implemented' until gRFC A102 lands; the test override additionally rejects anything that is not a google_grpc with a non-empty target_uri.","triggerScenarios":"msg.GetGrpcService() is non-nil, but parseGRPCServiceConfig returns an error: either the stub 'not implemented' error (the A102 parser isn't wired in yet), or a real parse error such as an envoy_grpc specifier or an empty target_uri.","commonSituations":"Running an ext_authz filter on a gRPC build where gRFC A102 grpc_service parsing is not yet enabled (stub returns not-implemented); the control plane emits envoy_grpc instead of google_grpc; target_uri is blank in the google_grpc block.","solutions":["If you hit 'parseGRPCServiceConfig not implemented', this gRPC version has not wired in A102 grpc_service parsing for ext_authz; use a build/feature flag that enables it or a gRPC version where the parser is registered.","Ensure the grpc_service uses google_grpc (GrpcService_GoogleGrpc) rather than envoy_grpc.","Set a non-empty target_uri on google_grpc pointing at your authorization server.","Confirm there are no unsupported fields (call credentials / channel credentials JSON) the active parser cannot consume."],"exampleFix":"// before: envoy_grpc is not parseable by the current parser\n//   grpc_service: { envoy_grpc: { cluster_name: \"authz\" } }\n//\n// after: google_grpc with a concrete target\n//   grpc_service: {\n//     google_grpc: { target_uri: \"dns:///authz-server.ns:9091\" }\n//   }","handlingStrategy":"validation","validationCode":"// Pre-validate the grpc_service the way the parser will (see ext_authz.go:105-108\n// and the test parser testParseGRPCServiceConfig).\nfunc validateAuthzGrpcService(gs *v3corepb.GrpcService) error {\n    if gs == nil {\n        return fmt.Errorf(\"grpc_service is nil\")\n    }\n    if gs.GetGoogleGrpc() == nil {\n        return fmt.Errorf(\"only google_grpc grpc_service is supported\")\n    }\n    if gs.GetGoogleGrpc().GetTargetUri() == \"\" {\n        return fmt.Errorf(\"target_uri must be a non-empty string\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm your gRPC build has gRFC A102 grpc_service parsing enabled; otherwise ext_authz parsing returns 'not implemented'.","Always use google_grpc with a non-empty target_uri for ext_authz grpc_service.","Avoid envoy_grpc / cluster-based services in xDS consumed by gRPC clients."],"tags":["grpc","xds","config","ext-authz","grpc-service"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}