{"record":{"id":"6a5f51056083f2a2","repo":"argoproj/argo-workflows","slug":"failed-to-unmarshal-bearer-token-s-jwt-payload-w","errorCode":null,"errorMessage":"failed to unmarshal bearer token's JWT payload: %w","messagePattern":"failed to unmarshal bearer token's JWT payload: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/serviceaccount/claims.go","lineNumber":58,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"failed to read bearer token file: %w\", err)\n\t\t}\n\t\tbearerToken = string(data)\n\t}\n\n\tparts := strings.SplitN(bearerToken, \".\", 3)\n\tif len(parts) != 3 {\n\t\treturn nil, fmt.Errorf(\"expected bearer token to be a JWT and therefore have 3 dot-delimited parts\")\n\t}\n\tpayload := parts[1]\n\tdata, err := base64.RawStdEncoding.DecodeString(payload)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode bearer token's JWT payload: %w\", err)\n\t}\n\n\tclaims := &types.Claims{}\n\terr = json.Unmarshal(data, &claims)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to unmarshal bearer token's JWT payload: %w\", err)\n\t}\n\n\t// attempt to derive SA name and namespace from Subject\n\t// \"system:serviceaccount:argo:jenkins\" -> \"argo\", \"jenkins\"\n\t// note that the SA name can have a colon in it, although the rest cannot\n\tparts = strings.SplitN(claims.Subject, \":\", 4)\n\tif len(parts) < 4 {\n\t\treturn claims, nil\n\t}\n\tclaims.ServiceAccountNamespace = parts[2]\n\tclaims.ServiceAccountName = parts[3]\n\n\treturn claims, nil\n}\n\nfunc ClaimSetWithX509(restConfig *rest.Config) (*types.Claims, error) {\n\tvar cert *x509.Certificate\n\tvar err error","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/serviceaccount/claims.go#L40-L76","documentation":"The JWT payload decoded to bytes but json.Unmarshal into types.Claims failed — the payload is valid base64 but not the expected claims JSON object. This blocks extracting the service-account identity in server auth mode.","triggerScenarios":"Thrown at server/auth/serviceaccount/claims.go:58 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the token payload is a standard Kubernetes SA claims JSON","Regenerate the token from a real service account"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}