{"record":{"id":"585502624e9779a3","repo":"gravitational/teleport","slug":"proto-identitycenteraccount-illegal-tag-d-wire","errorCode":null,"errorMessage":"proto: IdentityCenterAccount: illegal tag %d (wire type %d)","messagePattern":"proto: IdentityCenterAccount: illegal tag (.+?) \\(wire type (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/client/proto/authservice.pb.go","lineNumber":60665,"sourceCode":"\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t}\n\t\t\tif iNdEx >= l {\n\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t}\n\t\t\tb := dAtA[iNdEx]\n\t\t\tiNdEx++\n\t\t\twire |= uint64(b&0x7F) << shift\n\t\t\tif b < 0x80 {\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tfieldNum := int32(wire >> 3)\n\t\twireType := int(wire & 0x7)\n\t\tif wireType == 4 {\n\t\t\treturn fmt.Errorf(\"proto: IdentityCenterAccount: wiretype end group for non-group\")\n\t\t}\n\t\tif fieldNum <= 0 {\n\t\t\treturn fmt.Errorf(\"proto: IdentityCenterAccount: illegal tag %d (wire type %d)\", fieldNum, wire)\n\t\t}\n\t\tswitch fieldNum {\n\t\tcase 1:\n\t\t\tif wireType != 2 {\n\t\t\t\treturn fmt.Errorf(\"proto: wrong wireType = %d for field ID\", wireType)\n\t\t\t}\n\t\t\tvar stringLen uint64\n\t\t\tfor shift := uint(0); ; shift += 7 {\n\t\t\t\tif shift >= 64 {\n\t\t\t\t\treturn ErrIntOverflowAuthservice\n\t\t\t\t}\n\t\t\t\tif iNdEx >= l {\n\t\t\t\t\treturn io.ErrUnexpectedEOF\n\t\t\t\t}\n\t\t\t\tb := dAtA[iNdEx]\n\t\t\t\tiNdEx++\n\t\t\t\tstringLen |= uint64(b&0x7F) << shift\n\t\t\t\tif b < 0x80 {","sourceCodeStart":60647,"sourceCodeEnd":60683,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/client/proto/authservice.pb.go#L60647-L60683","documentation":"The generated Unmarshal for IdentityCenterAccount validates that each field tag's field number is positive; tag 0 (or negative after truncation) is illegal in the protobuf encoding. Seeing this error means the decoder read a tag of 0 mid-message, i.e. the byte stream is corrupt, truncated, or was produced by a mismatched schema where field boundaries shifted.","triggerScenarios":"Unmarshaling a truncated or misaligned buffer as IdentityCenterAccount (AWS Identity Center account), or decoding bytes from a producer whose field numbering differs (e.g. fields removed/renumbered between Teleport api versions).","commonSituations":"Partial reads from disk/network, wrong length prefix handling, fuzzer input, restoring backend records written by a different Teleport version.","solutions":["Ensure the full message bytes (correct length prefix / EOF check) reach the decoder.","Match Teleport api versions between producer and consumer.","Regenerate the proto bindings and re-serialize the data.","Hex-dump the payload around the failure to confirm tag alignment (each field should start with a valid key varint)."],"exampleFix":"// before: io.ReadFull with short count ignored\nn, _ := f.Read(buf)\nproto.Unmarshal(buf[:n], &acct)\n// after: enforce full read / length framing\nif err := binary.Read(r, binary.LittleEndian, &length); err != nil { return err }\nbuf := make([]byte, length)\nio.ReadFull(r, buf)\nproto.Unmarshal(buf, &acct)","handlingStrategy":"validation","validationCode":"func checkFirstTag(data []byte) error {\n  if len(data) == 0 { return errors.New(\"empty message\") }\n  key, n := binary.Uvarint(data)\n  if n <= 0 { return errors.New(\"truncated or corrupt tag stream\") }\n  if key == 0 { return errors.New(\"illegal tag 0: truncation or misalignment\") }\n  return nil\n}","typeGuard":null,"tryCatchPattern":"if err := proto.Unmarshal(data, &acct); err != nil {\n  if strings.Contains(err.Error(), \"illegal tag\") {\n    return fmt.Errorf(\"IdentityCenterAccount payload corrupt or version-skewed: %w\", err)\n  }\n  return err\n}","preventionTips":["Enforce full reads (io.ReadFull) and correct length-prefix handling before unmarshal.","Keep producer and consumer on the same teleport/api version.","Log a hex dump of failing payloads to speed corruption triage.","Re-sync AWS Identity Center data after detecting a corrupt record instead of retrying forever."],"tags":["protobuf","grpc","wire-format","data-corruption","teleport"],"backgroundTag":"protobuf-wire-type-mismatch","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}