What causes "proto: wrong wireType = %d for field ContextUser" in gravitational/teleport?

proto: wrong wireType = %d for field ContextUser

Error message

proto: wrong wireType = %d for field ContextUser

What it means

Protobuf unmarshal guard in generated code: while decoding CreateAuthenticateChallengeRequest, the ContextUser oneof field arrived with an unexpected wire type instead of the length-delimited type expected for a message.

Source

Thrown at api/client/proto/authservice.pb.go:60105

					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			m.Request = &CreateAuthenticateChallengeRequest_RecoveryStartTokenID{string(dAtA[iNdEx:postIndex])}
			iNdEx = postIndex
		case 3:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ContextUser", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			if msglen < 0 {
				return ErrInvalidLengthAuthservice

View on GitHub (pinned to 1283425b60)

Solutions

Use the generated oneof wrapper CreateAuthenticateChallengeRequest_ContextUser when building the request
Align proto definitions and regenerate code on both sides
Verify the payload belongs to CreateAuthenticateChallengeRequest
Validate the raw bytes with protoc --decode_raw

Example fix

// before
m.Field = 3 // manual tagging
// after
m.Request = &proto.CreateAuthenticateChallengeRequest_ContextUser{ContextUser: &proto.ContextUser{User: "alice"}}

Defensive patterns

Strategy: type-guard

Validate before calling

if req.GetContextUser() == nil && req.GetRequest() == nil { return errors.New("no request variant set") }

Type guard

func isContextUser(r *proto.CreateAuthenticateChallengeRequest) (*proto.ContextUser, bool) {
  v, ok := r.GetRequest().(*proto.CreateAuthenticateChallengeRequest_ContextUser)
  if !ok { return nil, false }
  return v.ContextUser, true
}

Prevention

Use the generated oneof wrapper types when assigning Request
Keep oneof field numbers reserved across refactors
Rebuild all services together when oneofs change shape
Prefer Marshal/Unmarshal round-trip tests over manual byte fixtures

When it happens

Trigger: Bytes where tag 3 is not length-delimited — produced by serializing an incompatible struct, hand-built bytes, or cross-version field type changes.

Common situations: Mixed client/server versions after the oneof was reshaped; corrupted stream; message-type confusion in a test or proxy.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/274f533dac884d35. Report an issue: GitHub.