gravitational/teleport · error
proto: IdentityCenterAccountAssignment: illegal tag %d (wire
Error message
proto: IdentityCenterAccountAssignment: illegal tag %d (wire type %d)
What it means
Generic protobuf decoding guard in the generated Unmarshal for IdentityCenterAccountAssignment. It fires when the binary wire data contains a field tag that is zero or negative (fieldNum <= 0), which is illegal in the protobuf wire format — a symptom of corrupted, maliciously crafted, or wrongly-versioned serialized bytes rather than a valid message.
Source
Thrown at api/client/proto/authservice.pb.go:60959
return ErrIntOverflowAuthservice
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
wire |= uint64(b&0x7F) << shift
if b < 0x80 {
break
}
}
fieldNum := int32(wire >> 3)
wireType := int(wire & 0x7)
if wireType == 4 {
return fmt.Errorf("proto: IdentityCenterAccountAssignment: wiretype end group for non-group")
}
if fieldNum <= 0 {
return fmt.Errorf("proto: IdentityCenterAccountAssignment: illegal tag %d (wire type %d)", fieldNum, wire)
}
switch fieldNum {
case 1:
if wireType != 2 {
return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
}
var stringLen uint64
for shift := uint(0); ; shift += 7 {
if shift >= 64 {
return ErrIntOverflowAuthservice
}
if iNdEx >= l {
return io.ErrUnexpectedEOF
}
b := dAtA[iNdEx]
iNdEx++
stringLen |= uint64(b&0x7F) << shift
if b < 0x80 {View on GitHub (pinned to 1283425b60)
Solutions
- Verify sender and receiver use compatible protobuf definitions/versions of authservice
- Check for truncated or corrupted payloads and re-send the request
Defensive patterns
Strategy: validation
When it happens
Trigger: Thrown at api/client/proto/authservice.pb.go:60959 when the library encounters an invalid state.
Common situations: See trigger scenarios.
AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02).
Data as JSON: /api/errors/d9ce8d93ecb6b7fc.
Report an issue: GitHub.