gravitational/teleport · error
found %s instead of %s, remaining tokens: %s
Error message
found %s instead of %s, remaining tokens: %s
What it means
requireTokenKind is the shared token-shape assertion for the DN parser: parseATV uses it to enforce the ATTR EQUAL STRING order, and parseRDNSequence uses it to force an error when an unexpected token appears between components. When the actual token kind differs from the expected kind, this error names both kinds plus the remaining token stream for diagnosis.
Source
Thrown at api/utils/pkixname/parser.go:228
if err != nil {
return fmt.Errorf(
"cannot parse OID component %q as int, OID=%q: %w", val, attr, err)
}
oid = append(oid, num)
}
dst.ExtraNames = append(dst.ExtraNames, pkix.AttributeTypeAndValue{
Type: oid,
Value: value,
})
return nil
}
func requireTokenKind(wantKind tokenKind, tok *token, tokens tokenList) error {
if tok.kind == wantKind {
return nil
}
return fmt.Errorf(
"found %s instead of %s, remaining tokens: %s",
tok.kind,
wantKind,
tokens,
)
}
type tokenKind int
const (
tokenAttrType = iota + 1
tokenString
tokenEqual
tokenPlus
tokenComma
)
func (k tokenKind) String() string {View on GitHub (pinned to 1283425b60)
Solutions
- Read the error's found/expected kinds: it should read ATTR ... EQUAL ... STRING per component; fix the component that breaks this order
- Ensure every attribute is followed by exactly one '=' and a non-empty value
- Quote values containing spaces with double quotes ('CN="My CA"') or escape inner specials with backslash
- Use single '=' only — remove duplicated '=' from templates
Example fix
// before
ParseDistinguishedName("CN==proxy")
// after
ParseDistinguishedName("CN=proxy") Defensive patterns
Strategy: validation
Validate before calling
func tokenShapeValid(dn string) error {
parts := strings.Split(dn, ",")
for _, part := range parts {
if strings.Count(part, "=") != 1 { return fmt.Errorf("component %q must contain exactly one '='", part) }
kv := strings.SplitN(part, "=", 2)
if strings.TrimSpace(kv[0]) == "" || strings.TrimSpace(kv[1]) == "" { return fmt.Errorf("empty attribute or value in %q", part) }
}
return nil
} Try / catch
if err := tokenShapeValid(dn); err != nil { return err }
name, err := pkixname.ParseDistinguishedName(dn)
if err != nil { return fmt.Errorf("invalid DN %q: %w", dn, err) } Prevention
- Every component must be exactly ATTR EQUAL STRING — one '=', no empty values
- Quote values with spaces: CN="My CA" — unquoted specials like '<', '>', '"' are rejected
- Use '=' only as the separator; escape literal '=' inside values with a backslash
- Check the found/expected kinds in the message to pinpoint the broken token
When it happens
Trigger: Any structural break in an ATV: 'CN value' (missing '='), 'CN==x' (double '='), 'CN=,CN=x' (empty value before comma forcing STRING mismatch), or stray '=' like 'C=US,=x' at component start. Also fires from parseRDNSequence's default branch when a non-comma token follows a completed ATV.
Common situations: Typos in DN strings in config files, spaces in unquoted values that were split elsewhere, double equals signs from templating, or semicolon/space-separated lists pasted into a comma-separated field.
Related errors
- malformed RDNs: %w
- repeated attributeType %q, remaining tokens: %s
- multi-valued RDN must refer to the same attribute, but found
- not enough tokens to parse AttributeTypeValue, remaining tok
- invalid attributeType (bad character set): %q
AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02).
Data as JSON: /api/errors/23100a242cc80b19.
Report an issue: GitHub.