{"record":{"id":"c994c7a3a78f2fd4","repo":"gravitational/teleport","slug":"want-attributevalue-found-q-s","errorCode":null,"errorMessage":"want '=' attributeValue, found %q: %s","messagePattern":"want '=' attributeValue, found %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/utils/pkixname/parser.go","lineNumber":515,"sourceCode":"\t\t\t\tbuf.WriteRune(r)\n\t\t\tcase r == '=':\n\t\t\t\temitBuffer(tokenAttrType)\n\t\t\t\temit(tokenEqual)\n\t\t\t\tstate = tokenizeStateStringStart\n\t\t\tcase r == ' ':\n\t\t\t\temitBuffer(tokenAttrType)\n\t\t\t\tstate = tokenizeStateAttrTypeEnd\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"want attributeType or '=', found %q: %s\", r, errTrace(pos))\n\t\t\t}\n\n\t\tcase tokenizeStateAttrTypeEnd:\n\t\t\tswitch r {\n\t\t\tcase '=':\n\t\t\t\temit(tokenEqual)\n\t\t\t\tstate = tokenizeStateStringStart\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"want '=' attributeValue, found %q: %s\", r, errTrace(pos))\n\t\t\t}\n\n\t\tcase tokenizeStateString:\n\t\t\tswitch r {\n\t\t\tcase '+', ',', ';':\n\t\t\t\temitBuffer(tokenString)\n\t\t\t\ttransitionToNameComponent(r)\n\t\t\tcase '\\\\':\n\t\t\t\tescapeStart()\n\t\t\tcase '<', '>', '\"':\n\t\t\t\t// We could '<' and '>', but let's be strict.\n\t\t\t\treturn nil, fmt.Errorf(\"special character %q not quoted: %s\", r, errTrace(pos))\n\t\t\tcase ' ':\n\t\t\t\ttrailingSpaceBuf.WriteRune(r)\n\t\t\t\tstate = tokenizeStateStringEnd\n\t\t\tcase '=', '#': // Go does this.\n\t\t\t\t// NOT OK per RFC, should be escaped.\n\t\t\t\tfallthrough","sourceCodeStart":497,"sourceCodeEnd":533,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L497-L533","documentation":"After a complete attribute type (and optional whitespace), the tokenizer only accepts '='. Any other character triggers this error naming the rune and position. It means the parser found an attribute type with no '=' assignment following it.","triggerScenarios":"Calling ParseDistinguishedName with a bare attribute type not followed by '=', e.g. \"CN,O=Example\" (missing '=' after CN), \"CN \\\"Bob\\\"\", or \"CN,CN=Bob\".","commonSituations":"Hand-edited DNs where a value or '=' was deleted, truncated config lines, or DNs composed by joining attribute names without assignments.","solutions":["Add the missing '=' and value, e.g. \"CN\" → \"CN=Bob\".","Remove the dangling attribute type if it is not intended.","Pre-validate the DN so every attribute type is followed by '=' value."],"exampleFix":"// before\nname, err := pkixname.ParseDistinguishedName(\"CN,O=Example\")\n// after\nname, err := pkixname.ParseDistinguishedName(\"CN=Bob,O=Example\")","handlingStrategy":"validation","validationCode":"func completePairs(dn string) bool {\n\tparts := strings.Split(dn, \",\")\n\tfor _, p := range parts {\n\t\tif !strings.Contains(p, \"=\") {\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}","typeGuard":null,"tryCatchPattern":"name, err := pkixname.ParseDistinguishedName(dn)\nif err != nil {\n\treturn nil, fmt.Errorf(\"DN %q has an attribute type without '=': %w\", dn, err)\n}","preventionTips":["Never emit a bare attribute type without '=value'","Guard against truncated DN strings from length-limited fields","Validate DNs when they are first persisted"],"tags":["x509","distinguished-name","parser","syntax"],"backgroundTag":"dn-malformed-syntax","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}