{"record":{"id":"8417174cf953c83e","repo":"argoproj/argo-workflows","slug":"failed-to-marshall-claims-w","errorCode":null,"errorMessage":"failed to marshall claims: %w","messagePattern":"failed to marshall claims: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth/gatekeeper.go","lineNumber":250,"sourceCode":"func (s *gatekeeper) getServiceAccount(claims *authTypes.Claims, namespace string) (*corev1.ServiceAccount, error) {\n\tlist, err := s.cache.ServiceAccountLister.ServiceAccounts(namespace).List(labels.Everything())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to list SSO RBAC service accounts: %w\", err)\n\t}\n\tvar serviceAccounts []*corev1.ServiceAccount\n\tfor _, serviceAccount := range list {\n\t\t_, ok := serviceAccount.Annotations[common.AnnotationKeyRBACRule]\n\t\tif !ok {\n\t\t\tcontinue\n\t\t}\n\t\tserviceAccounts = append(serviceAccounts, serviceAccount)\n\t}\n\tsort.Slice(serviceAccounts, func(i, j int) bool { return precedence(serviceAccounts[i]) > precedence(serviceAccounts[j]) })\n\tfor _, serviceAccount := range serviceAccounts {\n\t\trule := serviceAccount.Annotations[common.AnnotationKeyRBACRule]\n\t\tv, err := jsonutil.Jsonify(claims)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to marshall claims: %w\", err)\n\t\t}\n\t\tallow, err := argoexpr.EvalBool(rule, v)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to evaluate rule: %w\", err)\n\t\t}\n\t\tif !allow {\n\t\t\tcontinue\n\t\t}\n\t\treturn serviceAccount, nil\n\t}\n\treturn nil, fmt.Errorf(\"no service account rule matches\")\n}\n\nfunc (s *gatekeeper) canDelegateRBACToRequestNamespace(req any) bool {\n\tif s.namespaced || os.Getenv(\"SSO_DELEGATE_RBAC_TO_NAMESPACE\") != \"true\" {\n\t\treturn false\n\t}\n\tnamespace := getNamespace(req)","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/gatekeeper.go#L232-L268","documentation":"During SSO RBAC authorization, argo-server's getServiceAccount iterates ServiceAccounts annotated with workflows.argoproj.io/rbac-rule and evaluates each rule against the JSON-serialized OIDC claims. This error is returned when jsonutil.Jsonify(claims) fails to serialize the claims struct to the value map fed into the expr evaluator. In practice the claims struct is always plain JSON-marshalable data, so this almost always indicates an internal/unexpected failure rather than a user config problem; note the serialization is needlessly repeated inside the loop, so a marshal failure blocks matching any rule.","triggerScenarios":"An SSO-authenticated gRPC/HTTP request with RBAC enabled reaches rbacAuthorization -> getServiceAccount, and jsonutil.Jsonify(*authTypes.Claims) returns an error while preparing the expression input for a ServiceAccount's rbac-rule annotation.","commonSituations":"Practically only seen with a corrupted/non-standard claims object, a custom or forked build that changed the Claims type, or tampered middleware state; end users rarely hit this since authTypes.Claims is a simple marshalable struct.","solutions":["Restart argo-server and retry the request; if persistent, capture the full error (wrapped %w cause) and file an issue with server logs.","Check that your argo-server image is an unmodified official release; custom patches to server/auth or serviceaccount claims types are the most likely culprit.","Upgrade to a recent argo-workflows release, since the claims-to-JSON path has been refactored over versions."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// client side: gRPC unauthenticated error\n_, err := client.WorkflowService.ListWorkflows(ctx, req)\nif err != nil {\n    if st, ok := status.FromError(err); ok && st.Code() == codes.Unauthenticated && strings.Contains(st.Message(), \"not allowed\") {\n        // surface server logs; report bug if 'failed to marshall claims'\n    }\n    return err\n}","preventionTips":["Run unmodified official argo-server images","Keep argo-server upgraded; this path is an internal invariant, so treat occurrences as bugs","Capture the wrapped cause from server logs before retrying"],"tags":["sso","rbac","json-marshalling","authentication"],"backgroundTag":"claims-marshalling-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}