proto: IdentityCenterAccount: wiretype end group for non-gro

Error message

proto: IdentityCenterAccount: wiretype end group for non-group

What it means

Protobuf groups (wire type 4 = end-group) are a legacy proto2 construct; this message's fields are not groups, so seeing an end-group wire type inside IdentityCenterAccount means the byte stream is structurally invalid or from an incompatible schema. The generated Unmarshal rejects it immediately as a framing sanity check.

Source

Thrown at api/client/proto/authservice.pb.go:60662

		var wire uint64
		for shift := uint(0); ; shift += 7 {
			if shift >= 64 {
				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: IdentityCenterAccount: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: IdentityCenterAccount: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]

View on GitHub (pinned to 1283425b60)

Solutions

Verify you are unmarshaling the complete, correctly offset protobuf message (not a sub-slice).
Confirm the payload is actually protobuf (e.g. marshal a fresh IdentityCenterAccount and compare the tag bytes).
Upgrade both producer and consumer to the same Teleport version.
Regenerate pb.go files from the current .proto if fields were edited.

Example fix

// before: passing a mid-buffer slice
data := blob[offset:] // offset from stale index
proto.Unmarshal(data, &acct)
// after: read the full record with its length prefix
rec := readLengthPrefixed(blob) // exact frame
proto.Unmarshal(rec, &acct)

Defensive patterns

Strategy: validation

Validate before calling

func validateIdentityCenterAccountFrame(data []byte) error {
  if len(data) == 0 { return errors.New("empty payload") }
  key, n := binary.Uvarint(data)
  if n <= 0 { return errors.New("truncated tag") }
  if int(key)&0x7 == 4 { return errors.New("end-group wire type: misaligned or foreign payload") }
  if int(key)>>3 <= 0 { return errors.New("illegal field number") }
  return nil
}

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "end group for non-group") {
    log.Warn("corrupt/misaligned IdentityCenterAccount bytes; resync required")
  }
  return err
}

Prevention

Always store/transfer protobuf with a length prefix so records cannot be sliced mid-frame.
Validate framing (first tag byte) before unmarshaling stored records.
Refuse payloads written by unknown schema versions (store a version header).
Watch for this error under fuzz/chaos tests as a framing bug signal.

When it happens

Trigger: Decoding an IdentityCenterAccount (AWS Identity Center account listing in the Auth Service) whose field tag encodes wire type 4 — caused by corrupted bytes, offset misalignment (parsing a sub-slice starting mid-record), or a non-proto payload fed to proto.Unmarshal.

Common situations: Slicing stored protobuf data at wrong byte offsets, feeding JSON/other binary to a proto decoder, fuzzing, or truncation during persistence that shifted field boundaries.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/50c7c2d0aa7d5db8. Report an issue: GitHub.