What causes "proto: wrong wireType = %d for field Description" in gravitational/teleport?

Bring producer and consumer onto the same Teleport api version.

proto: wrong wireType = %d for field Description

Error message

proto: wrong wireType = %d for field Description

What it means

Field Description of IdentityCenterAccount is a string (wire type 2); the generated Unmarshal errors when the field 4 tag has a different wire type. Like its siblings, this guards against decoding a byte stream produced under a different schema revision.

Source

Thrown at api/client/proto/authservice.pb.go:60766

					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + intStringLen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			m.AccountName = string(dAtA[iNdEx:postIndex])
			iNdEx = postIndex
		case 4:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

Bring producer and consumer onto the same Teleport api version.
Regenerate api/client/proto bindings from the current .proto.
Discard and re-sync the corrupted IdentityCenterAccount records.
Inspect the payload's field 4 key byte; expect 0x22 ((4<<3)|2).

Example fix

// before: mismatched vendored api
replace github.com/gravitational/teleport/api => ../old-api
// after: use the api matching the deployed server
require github.com/gravitational/teleport/api vX.Y.Z

Defensive patterns

Strategy: validation

Validate before calling

func looksLikeIdentityCenterAccount(data []byte) bool {
  // leading key for field 1 (ID, string) must be 0x0a
  return len(data) > 0 && data[0] == 0x0a
}

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "field Description") {
    log.Warn("IdentityCenterAccount Description wire mismatch; likely version skew")
    return ErrIncompatiblePayload
  }
  return err
}

Prevention

Upgrade the whole cluster within one maintenance window to avoid mixed schema traffic.
Store AWS Identity Center sync data with a schema/serialization version.
Validate stored records at startup and re-sync on decode failure.
Keep pb.go regeneration automated in CI to prevent stale bindings.

When it happens

Trigger: Unmarshaling an IdentityCenterAccount whose field 4 is encoded with a non-length-delimited wire type — version skew between producer and this compiled pb.go, or corruption that misaligned the field boundary after AccountName.

Common situations: Cluster upgrades with mixed versions, plugins/pinned deps using an old api release, corrupted cached or persisted AWS Identity Center sync data, fuzzer input.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/3998f3fcf1e1d462. Report an issue: GitHub.