{"record":{"id":"451d3745f20004b3","repo":"argoproj/argo-workflows","slug":"expected-bearer-token-to-be-a-jwt-and-therefore-ha","errorCode":null,"errorMessage":"expected bearer token to be a JWT and therefore have 3 dot-delimited parts","messagePattern":"expected bearer token to be a JWT and therefore have 3 dot-delimited parts","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/serviceaccount/claims.go","lineNumber":47,"sourceCode":"\t\treturn ClaimSetWithX509(restConfig)\n\t}\n\treturn nil, nil\n}\n\nfunc ClaimSetWithBearerToken(restConfig *rest.Config) (*types.Claims, error) {\n\tbearerToken := restConfig.BearerToken\n\tif bearerToken == \"\" {\n\t\t// should only ever be used for service accounts\n\t\tdata, err := os.ReadFile(restConfig.BearerTokenFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read bearer token file: %w\", err)\n\t\t}\n\t\tbearerToken = string(data)\n\t}\n\n\tparts := strings.SplitN(bearerToken, \".\", 3)\n\tif len(parts) != 3 {\n\t\treturn nil, fmt.Errorf(\"expected bearer token to be a JWT and therefore have 3 dot-delimited parts\")\n\t}\n\tpayload := parts[1]\n\tdata, err := base64.RawStdEncoding.DecodeString(payload)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode bearer token's JWT payload: %w\", err)\n\t}\n\n\tclaims := &types.Claims{}\n\terr = json.Unmarshal(data, &claims)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to unmarshal bearer token's JWT payload: %w\", err)\n\t}\n\n\t// attempt to derive SA name and namespace from Subject\n\t// \"system:serviceaccount:argo:jenkins\" -> \"argo\", \"jenkins\"\n\t// note that the SA name can have a colon in it, although the rest cannot\n\tparts = strings.SplitN(claims.Subject, \":\", 4)\n\tif len(parts) < 4 {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/serviceaccount/claims.go#L29-L65","documentation":"ClaimSetWithBearerToken split the bearer token on '.' and did not get 3 parts, so the token is not a JWT and its claims cannot be extracted. This guards the server-auth mode where the server's own SA token is decoded into an identity.","triggerScenarios":"Thrown at server/auth/serviceaccount/claims.go:47 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the configured bearer token is a JWT (standard Kubernetes SA tokens are)","Use a token file containing the full three-segment JWT"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}