gravitational/teleport · error

proto: wrong wireType = %d for field ARN

Error message

proto: wrong wireType = %d for field ARN

What it means

Field ARN of IdentityCenterAccount is a string (wire type 2, length-delimited); the generated Unmarshal rejects field 2 tags with any other wire type. As with all wireType errors, it means the serialized stream disagrees with the compiled proto schema.

Source

Thrown at api/client/proto/authservice.pb.go:60702

					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			m.ID = string(dAtA[iNdEx:postIndex])
			iNdEx = postIndex
		case 2:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

  1. Align Teleport api versions across auth server, proxies, and plugins.
  2. Regenerate api/client/proto from the current .proto.
  3. Validate/discard corrupted payloads; re-create the record.
  4. If writing raw proto by hand, emit tag (2<<3)|2 followed by the ARN length and bytes.

Example fix

// before: wrong wire type produced manually
buf = proto.AppendVarint(buf, (2<<3)|0) // varint tag for a string field
// after: length-delimited tag for strings
buf = proto.AppendVarint(buf, (2<<3)|2)
buf = proto.AppendVarint(buf, uint64(len(arn)))
buf = append(buf, arn...)
Defensive patterns

Strategy: validation

Validate before calling

func validIdentityCenterAccountTags(data []byte) bool {
  // expected leading key: field 1, wire type 2 (0x0a)
  return len(data) >= 1 && data[0] == 0x0a
}

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "field ARN") {
    log.WithField("len", len(data)).Warn("IdentityCenterAccount ARN wire mismatch")
    return ErrSchemaSkew
  }
  return err
}

Prevention

When it happens

Trigger: Unmarshaling an IdentityCenterAccount payload whose field 2 is encoded as varint/fixed instead of length-delimited — schema mismatch between producer and consumer, or byte-stream corruption that shifted the field start.

Common situations: Mixed Teleport versions in a cluster upgrade, plugins built against an older api module, corrupt backend values, feeding non-proto bytes into proto.Unmarshal.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/17615a9db2518208. Report an issue: GitHub.