proto: IdentityCenterPermissionSet: wiretype end group for n

Error message

proto: IdentityCenterPermissionSet: wiretype end group for non-group

What it means

Same structural sanity check as error 133, but for IdentityCenterPermissionSet: an end-group wire type (4) was read for one of its fields, which cannot happen for a valid stream of this non-group message. It indicates invalid framing — corrupted, truncated, misaligned, or foreign bytes being handed to the Unmarshal routine.

Source

Thrown at api/client/proto/authservice.pb.go:60841

		var wire uint64
		for shift := uint(0); ; shift += 7 {
			if shift >= 64 {
				return ErrIntOverflowAuthservice
			}
			if iNdEx >= l {
				return io.ErrUnexpectedEOF
			}
			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: IdentityCenterPermissionSet: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: IdentityCenterPermissionSet: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]

View on GitHub (pinned to 1283425b60)

Solutions

Check the framing code: unmarshal exactly one length-prefixed record, starting at tag 0x0a (field 1, wire type 2).
Confirm the payload originates from the same Teleport schema version.
Regenerate pb.go if the message fields were recently changed.
Discard corrupted records and re-run the AWS Identity Center sync.

Example fix

// before: resuming mid-record after a partial decode
rest := buf[consumed:] // consumed counted wrong
proto.Unmarshal(rest, &ps)
// after: track offsets from Unmarshal's return
consumed, err := proto.Unmarshal(buf, &ps)
rest := buf[consumed:]

Defensive patterns

Strategy: validation

Validate before calling

func validatePermissionSetFrame(data []byte) error {
  if len(data) == 0 { return errors.New("empty payload") }
  key, n := binary.Uvarint(data)
  if n <= 0 { return errors.New("unreadable tag") }
  if int(key)&0x7 == 4 { return errors.New("end-group byte: misaligned or corrupt frame") }
  if int(key) != 0x0a { return fmt.Errorf("unexpected first tag 0x%x; expected 0x0a", key) }
  return nil
}

Try / catch

if err := proto.Unmarshal(data, &ps); err != nil {
  if strings.Contains(err.Error(), "end group for non-group") {
    log.Warn("IdentityCenterPermissionSet frame corrupt; trigger re-sync")
  }
  return err
}

Prevention

Frame every stored/transferred protobuf record with an explicit length prefix.
Verify record boundaries (offsets) when resuming partial decodes.
Pin teleport/api versions across all components.
Add fuzz tests over the record-framing path to catch alignment bugs early.

When it happens

Trigger: Decoding an IdentityCenterPermissionSet (AWS Identity Center permission set in the Auth Service) where a field key's wire type bits equal 4 — caused by parsing a sub-slice starting mid-record, corrupt storage bytes, or feeding non-proto data.

Common situations: Wrong offset/length when reading framed protobuf from disk or a queue, restoring data written by a different schema version, fuzz tests, misrouted binary payloads.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/70622385710e77f4. Report an issue: GitHub.