What causes "proto: IdentityCenterAccount: illegal tag %d (wire type %d)" in gravitational/teleport?

Ensure the full message bytes (correct length prefix / EOF check) reach the decoder.

proto: IdentityCenterAccount: illegal tag %d (wire type %d)

Error message

proto: IdentityCenterAccount: illegal tag %d (wire type %d)

What it means

The generated Unmarshal for IdentityCenterAccount validates that each field tag's field number is positive; tag 0 (or negative after truncation) is illegal in the protobuf encoding. Seeing this error means the decoder read a tag of 0 mid-message, i.e. the byte stream is corrupt, truncated, or was produced by a mismatched schema where field boundaries shifted.

Source

Thrown at api/client/proto/authservice.pb.go:60665

				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: IdentityCenterAccount: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: IdentityCenterAccount: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {

View on GitHub (pinned to 1283425b60)

Solutions

Ensure the full message bytes (correct length prefix / EOF check) reach the decoder.
Match Teleport api versions between producer and consumer.
Regenerate the proto bindings and re-serialize the data.
Hex-dump the payload around the failure to confirm tag alignment (each field should start with a valid key varint).

Example fix

// before: io.ReadFull with short count ignored
n, _ := f.Read(buf)
proto.Unmarshal(buf[:n], &acct)
// after: enforce full read / length framing
if err := binary.Read(r, binary.LittleEndian, &length); err != nil { return err }
buf := make([]byte, length)
io.ReadFull(r, buf)
proto.Unmarshal(buf, &acct)

Defensive patterns

Strategy: validation

Validate before calling

func checkFirstTag(data []byte) error {
  if len(data) == 0 { return errors.New("empty message") }
  key, n := binary.Uvarint(data)
  if n <= 0 { return errors.New("truncated or corrupt tag stream") }
  if key == 0 { return errors.New("illegal tag 0: truncation or misalignment") }
  return nil
}

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "illegal tag") {
    return fmt.Errorf("IdentityCenterAccount payload corrupt or version-skewed: %w", err)
  }
  return err
}

Prevention

Enforce full reads (io.ReadFull) and correct length-prefix handling before unmarshal.
Keep producer and consumer on the same teleport/api version.
Log a hex dump of failing payloads to speed corruption triage.
Re-sync AWS Identity Center data after detecting a corrupt record instead of retrying forever.

When it happens

Trigger: Unmarshaling a truncated or misaligned buffer as IdentityCenterAccount (AWS Identity Center account), or decoding bytes from a producer whose field numbering differs (e.g. fields removed/renumbered between Teleport api versions).

Common situations: Partial reads from disk/network, wrong length prefix handling, fuzzer input, restoring backend records written by a different Teleport version.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/585502624e9779a3. Report an issue: GitHub.