{"record":{"id":"ced6a1429a217d2b","repo":"Tencent/WeKnora","slug":"invalid-external-user-id-external-user-id-too-lon","errorCode":null,"errorMessage":"invalid external user id: external user id too long (max %d)","messagePattern":"invalid external user id: external user id too long \\(max (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":401,"severity":"error","filePath":"internal/middleware/auth.go","lineNumber":665,"sourceCode":"\t}\n\tif got := principalTenantIDFromClaims(claims); got != tenantID {\n\t\treturn \"\", fmt.Errorf(\"workspace mismatch: got %d want %d\", got, tenantID)\n\t}\n\tsub, _ := claims[\"sub\"].(string)\n\tsub = strings.TrimSpace(sub)\n\tif sub == \"\" {\n\t\treturn \"\", errors.New(\"missing subject\")\n\t}\n\treturn sub, nil\n}\n\nfunc validateExternalUserID(id string) error {\n\tid = strings.TrimSpace(id)\n\tif id == \"\" {\n\t\treturn errors.New(\"empty external user id\")\n\t}\n\tif len(id) > maxExternalUserIDLen {\n\t\treturn fmt.Errorf(\"external user id too long (max %d)\", maxExternalUserIDLen)\n\t}\n\tfor _, r := range id {\n\t\tif r < 0x20 || r == 0x7f {\n\t\t\treturn errors.New(\"external user id contains invalid characters\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc apiPrincipalAuthErrorMessage(err error) string {\n\tswitch {\n\tcase errors.Is(err, errMissingDirectHeader):\n\t\treturn \"Unauthorized: missing external user id header\"\n\tcase errors.Is(err, errInvalidExternalUserID):\n\t\treturn \"Unauthorized: invalid external user id\"\n\tcase errors.Is(err, errInvalidExternalUserToken):\n\t\treturn \"Unauthorized: invalid external user token\"\n\tdefault:","sourceCodeStart":647,"sourceCodeEnd":683,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/middleware/auth.go#L647-L683","documentation":"validateExternalUserID in internal/middleware/auth.go:665 reports that the external user id exceeds maxExternalUserIDLen characters. External user IDs become part of the Principal ID (\"<tenantID>:<externalID>\") and are stored/logged, so their length is capped.","triggerScenarios":"resolveAPIPrincipal (either direct-header or signed-token mode) passes an id whose length after trimming exceeds maxExternalUserIDLen.","commonSituations":"Using long opaque identifiers (full JWTs, long SAML nameIDs, prefixed UUID chains) as external user IDs; concatenating namespace + user id on the client.","solutions":["Shorten the external user id to within maxExternalUserIDLen (use a hash or short UUID).","Trim client-side and check length before sending.","Map long provider IDs to short internal identifiers at your identity layer."],"exampleFix":"// before\nheader.Set(\"X-External-User-ID\", longProviderNameID) // > maxExternalUserIDLen\n// after\nshort := fmt.Sprintf(\"%x\", sha256.Sum256([]byte(longProviderNameID)))[:32]\nheader.Set(\"X-External-User-ID\", short)","handlingStrategy":"validation","validationCode":"id := strings.TrimSpace(externalID)\nif len(id) > maxExternalUserIDLen { // hash or truncate before sending\n}","typeGuard":"func idWithinLimit(id string, max int) bool { return len(strings.TrimSpace(id)) <= max }","tryCatchPattern":null,"preventionTips":["Cap external user id length at the identity-provider integration layer.","Use fixed-length identifiers (UUIDv4, hash prefixes).","Log near-limit ids to catch drift early."],"tags":["validation","authentication","input-length"],"backgroundTag":"invalid-external-user-id","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}