What causes "proto: wrong wireType = %d for field AccountName" in gravitational/teleport?

Use the same Teleport version for all components communicating with the auth service.

proto: wrong wireType = %d for field AccountName

Error message

proto: wrong wireType = %d for field AccountName

What it means

Field AccountName of IdentityCenterAccount is a string requiring wire type 2; the generated Unmarshal throws this error when the field 3 tag carries a different wire type. It signals the decoder and encoder disagree on the message schema.

Source

Thrown at api/client/proto/authservice.pb.go:60734

					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			m.ARN = string(dAtA[iNdEx:postIndex])
			iNdEx = postIndex
		case 3:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field AccountName", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

Use the same Teleport version for all components communicating with the auth service.
Regenerate proto bindings if the .proto was changed.
Re-serialize or drop the corrupted record.
Capture a hex dump and verify field 3's key byte is 0x1a (tag 3, wire type 2).

Example fix

// before: decoding legacy bytes
err := proto.Unmarshal(legacyBytes, &acct) // mismatch
// after: migrate via a converter of matching schema version
legacy := unmarshalWithOldSchema(legacyBytes)
newBytes, _ := proto.Marshal(migrate(legacy))
err := proto.Unmarshal(newBytes, &acct)

Defensive patterns

Strategy: try-catch

Validate before calling

// Re-marshal after decode as a self-check before trusting the record:
_, err := proto.Marshal(&proto.IdentityCenterAccount{Id: "x", Arn: "arn", AccountName: "n"})
if err != nil { /* bindings out of sync */ }

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "field AccountName") {
    return fmt.Errorf("AccountName wire mismatch — check client/server api versions: %w", err)
  }
  return err
}

Prevention

Run rolling upgrades with wire-compatibility tests between adjacent releases.
Keep vendored api module fresh (`go get -u github.com/gravitational/teleport/api`).
Guard storage layers against truncated writes (checksums on records).
Use generated Marshal only; no manual tag construction for string fields.

When it happens

Trigger: Decoding an IdentityCenterAccount whose field 3 is not length-delimited — typically a payload from a different Teleport api version or bytes corrupted after field 2 (ARN), shifting tag alignment.

Common situations: Rolling upgrade skew, stale vendored api module, truncation/corruption in storage or wire, hand-rolled encoders.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/b3d68c8855b9ef0c. Report an issue: GitHub.