gravitational/teleport · error

proto: wrong wireType =

Error message

proto: wrong wireType = %d for field ARN

What it means

Field ARN of IdentityCenterAccount is a string (wire type 2, length-delimited); the generated Unmarshal rejects field 2 tags with any other wire type. As with all wireType errors, it means the serialized stream disagrees with the compiled proto schema.

Solutions

  1. Align Teleport api versions across auth server, proxies, and plugins.
  2. Regenerate api/client/proto from the current .proto.
  3. Validate/discard corrupted payloads; re-create the record.
  4. If writing raw proto by hand, emit tag (2<<3)|2 followed by the ARN length and bytes.

Example fix

// before: wrong wire type produced manually
buf = proto.AppendVarint(buf, (2<<3)|0) // varint tag for a string field
// after: length-delimited tag for strings
buf = proto.AppendVarint(buf, (2<<3)|2)
buf = proto.AppendVarint(buf, uint64(len(arn)))
buf = append(buf, arn...)
Defensive patterns

Strategy: validation

Validate before calling

func validIdentityCenterAccountTags(data []byte) bool {
  // expected leading key: field 1, wire type 2 (0x0a)
  return len(data) >= 1 && data[0] == 0x0a
}

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "field ARN") {
    log.WithField("len", len(data)).Warn("IdentityCenterAccount ARN wire mismatch")
    return ErrSchemaSkew
  }
  return err
}

Prevention

When it happens

Trigger: Unmarshaling an IdentityCenterAccount payload whose field 2 is encoded as varint/fixed instead of length-delimited — schema mismatch between producer and consumer, or byte-stream corruption that shifted the field start.

Common situations: Mixed Teleport versions in a cluster upgrade, plugins built against an older api module, corrupt backend values, feeding non-proto bytes into proto.Unmarshal.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/17615a9db2518208. Report an issue: GitHub.

Appendix: source

Thrown at api/client/proto/authservice.pb.go:60702

					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			m.ID = string(dAtA[iNdEx:postIndex])
			iNdEx = postIndex
		case 2:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ARN", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)