gravitational/teleport · error

found EOF (state=%d)

Error message

found EOF (state=%d)

What it means

This is the tokenizer's catch-all: when input ends in any state not explicitly handled (e.g. mid attribute-type, after '=', or after a comma), parsing aborts with "found EOF (state=%d)". The state number identifies exactly where the DN grammar was left incomplete. It signals a structurally truncated distinguished name.

Source

Thrown at api/utils/pkixname/parser.go:592

		// OK.
	case tokenizeStateNameComponent:
		return nil, fmt.Errorf("want attributeType, found EOF")
	case tokenizeStateAttrType:
		return nil, fmt.Errorf("want attributeType or '=', found EOF")
	case tokenizeStateAttrTypeEnd:
		return nil, fmt.Errorf("want '=' attributeValue, found EOF")
	case tokenizeStateStringStart, tokenizeStateString, tokenizeStateStringEnd:
		// OK.
		emitBuffer(tokenString)
	case tokenizeStateStringEscape:
		return nil, fmt.Errorf("want escaped character, found EOF")
	case tokenizeStateStringQuote:
		return nil, fmt.Errorf("want closing quote, found EOF")
	case tokenizeStateStringQuoteEnd:
		// OK.
	default:
		// This should not be reached. All states are handled above.
		return nil, fmt.Errorf("found EOF (state=%d)", state)
	}

	return tokens, nil
}

func isAttrType(r rune) bool {
	return r >= 'A' && r <= 'Z' ||
		r >= 'a' && r <= 'z' ||
		r >= '0' && r <= '9' ||
		r == '-' ||
		r == '.'
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Complete the DN so it ends after a full attributeType=attributeValue pair.
2. Use the state value in the message to locate the cut-off point: low states are early in the grammar (attr type), higher states mid-value.
3. Log/validate the raw DN input at the point it is produced (config load, env var read) to catch truncation at the source.

Example fix

// before
name, err := pkixname.ParseDistinguishedName("CN=proxy,O") // truncated
// after
name, err := pkixname.ParseDistinguishedName("CN=proxy,O=corp")

func looksLikeCompleteDN(dn string) bool {
	dn = strings.TrimSpace(dn)
	if dn == "" || strings.HasSuffix(dn, ",") || strings.HasSuffix(dn, "+") || strings.HasSuffix(dn, "=") {
		return false
	}
	return strings.Contains(dn, "=") // must have at least one attr=value pair
}
if !looksLikeCompleteDN(rawDN) { return errors.New("truncated/incomplete DN") }

if err != nil {
	if strings.Contains(err.Error(), "found EOF (state=") {
		// log raw DN + state; treat as invalid config input, surface to operator
	}
}

When it happens

Trigger: ParseDistinguishedName with a DN cut off mid-token, e.g. "CN" (no '='), "CN=" (no value), or "CN=a,O" — any prefix of a valid DN that stops between grammar elements.

Common situations: Config values truncated by line-length limits or secrets managers; DNs read from files with missing trailing content; programmatic DN construction that emits separators with empty following components.

Related errors

• want escaped character, found EOF
• want closing quote, found EOF
• distinguished name too large, refusing to parse
• unhandled size name: %v
• malformed RDNs: %w

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/5cb26ce4307405c3. Report an issue: GitHub.