gravitational/teleport · error

cannot parse OID component %q as int, OID=%q: %w

Error message

cannot parse OID component %q as int, OID=%q: %w

What it means

When an attribute type matches the OID shape (^\d+(\.\d+)*$), parseOIDExtraName splits it on '.' and converts each component with strconv.Atoi. Although the regexp guarantees digits, a component that overflows int (e.g. a very long digit run) makes Atoi fail, producing this wrapped error. The original Atoi error is preserved via %w.

Source

Thrown at api/utils/pkixname/parser.go:211

	case "L":
		dst.Locality = append(dst.Locality, value)
	case "ST":
		dst.Province = append(dst.Province, value)
	case "C":
		dst.Country = append(dst.Country, value)
	default:
		return "", fmt.Errorf("unknown attributeType %q, remaining tokens: %s", attr, tokens)
	}
	return attr, nil
}

func parseOIDExtraName(dst *pkix.Name, attr, value string) error {
	parts := strings.Split(attr, ".")
	oid := make(asn1.ObjectIdentifier, 0, len(parts))
	for _, val := range parts {
		num, err := strconv.Atoi(val)
		if err != nil {
			return fmt.Errorf(
				"cannot parse OID component %q as int, OID=%q: %w", val, attr, err)
		}
		oid = append(oid, num)
	}

	dst.ExtraNames = append(dst.ExtraNames, pkix.AttributeTypeAndValue{
		Type:  oid,
		Value: value,
	})
	return nil
}

func requireTokenKind(wantKind tokenKind, tok *token, tokens tokenList) error {
	if tok.kind == wantKind {
		return nil
	}
	return fmt.Errorf(
		"found %s instead of %s, remaining tokens: %s",

View on GitHub (pinned to 1283425b60)

Solutions

1. Fix the OID so every dot-separated component fits in a machine int (each arc is a small integer, typically < 2^31)
2. Use the standard short attribute name (CN, O, etc.) instead of a custom OID if one exists
3. Validate OID components are plain integers within range before building the DN string

Example fix

// before
ParseDistinguishedName("1.2.99999999999999999999=custom")
// after
ParseDistinguishedName("1.2.3.4=custom")

func oidComponentsFit(oid string) error {
	for _, c := range strings.Split(oid, ".") {
		if _, err := strconv.Atoi(c); err != nil {
			return fmt.Errorf("OID component %q out of int range", c)
		}
	}
	return nil
}

if err := oidComponentsFit(oidAttr); err != nil { return err }
name, err := pkixname.ParseDistinguishedName(oidAttr + "=value")
if err != nil { return fmt.Errorf("invalid DN: %w", err) }

When it happens

Trigger: An attribute type like '1.2.8401135494' style with a component exceeding int range (e.g. '1.99999999999999999999') — matches the digit regexp but fails Atoi on overflow.

Common situations: Hand-typed or concatenated OIDs with an oversized/typo'd arc, or programmatic generation of OIDs from big-number encodings that weren't re-split into per-arc integers.

Related errors

• distinguished name too large, refusing to parse
• malformed RDNs: %w
• repeated attributeType %q, remaining tokens: %s
• multi-valued RDN must refer to the same attribute, but found
• not enough tokens to parse AttributeTypeValue, remaining tok

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/2231b1b521f6871c. Report an issue: GitHub.