{"record":{"id":"4ba0802ad912f1f7","repo":"docker/cli","slug":"failed-to-parse-token-claims-w","errorCode":null,"errorMessage":"failed to parse token claims: %w","messagePattern":"failed to parse token claims: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/oauth/manager/manager.go","lineNumber":139,"sourceCode":"\tgo func() {\n\t\treader := bufio.NewReader(os.Stdin)\n\t\t_, _ = reader.ReadString('\\n')\n\t\t_ = m.openBrowser(state.VerificationURI)\n\t}()\n\n\t_, _ = fmt.Fprint(w, \"\\nWaiting for authentication in the browser…\\n\")\n\tvar tokenRes api.TokenResponse\n\tselect {\n\tcase <-ctx.Done():\n\t\treturn nil, errors.New(\"login canceled\")\n\tcase err := <-waitForTokenErrChan:\n\t\treturn nil, fmt.Errorf(\"failed waiting for authentication: %w\", err)\n\tcase tokenRes = <-tokenResChan:\n\t}\n\n\tclaims, err := oauth.GetClaims(tokenRes.AccessToken)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse token claims: %w\", err)\n\t}\n\n\terr = m.storeTokensInStore(tokenRes, claims.Domain.Username)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to store tokens: %w\", err)\n\t}\n\n\tpat, err := m.api.GetAutoPAT(ctx, m.audience, tokenRes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &types.AuthConfig{\n\t\tUsername:      claims.Domain.Username,\n\t\tPassword:      pat,\n\t\tServerAddress: registry.IndexServer,\n\t}, nil\n}","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/oauth/manager/manager.go#L121-L157","documentation":"Returned by OAuthManager.Login when oauth.GetClaims(tokenRes.AccessToken) fails. After the device flow returns an access token, the manager parses its JWT claims to extract the username/domain; if the token is malformed or claims cannot be extracted, login aborts before storing anything.","triggerScenarios":"The tenant issued an access token that is not a parseable JWT or whose claims do not contain the expected domain/username fields.","commonSituations":"Tenant returned a non-JWT bearer token; token was truncated/mangled by a proxy; tenant schema change; clock/signature verification failure inside GetClaims.","solutions":["Retry `docker login` to obtain a fresh access token.","Update the CLI to the latest version (GetClaims contract may have changed).","Check no proxy is mutating the token body.","If recurring, fall back to a manual PAT login."],"exampleFix":"# before\ndocker login  # -> failed to parse token claims\ndocker logout\ndocker login   # fresh token\n# fallback\ndocker login -u myuser  # PAT as password","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// claims parse failure -> retry once, then fall back to PAT login\nif strings.Contains(err.Error(), \"failed to parse token claims\") { fallBackToPAT() }","preventionTips":["Keep the CLI current with the tenant's token format.","Ensure no proxy truncates the JWT.","Maintain a PAT fallback path."],"tags":["oauth","jwt","claims","auth","docker-hub"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}