What causes "proto: wrong wireType = %d for field ID" in gravitational/teleport?

Upgrade/downgrade so both sides share the same api/client/proto version.

proto: wrong wireType = %d for field ID

Error message

proto: wrong wireType = %d for field ID

What it means

Field ID of IdentityCenterAccount is declared as a string, which requires wire type 2 (length-delimited). The generated Unmarshal checks the wire type of field 1 and fails with this error when it differs. This indicates the bytes being decoded were not produced by the same compiled schema.

Source

Thrown at api/client/proto/authservice.pb.go:60670

			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: IdentityCenterAccount: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: IdentityCenterAccount: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
			}
			var stringLen uint64
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				stringLen |= uint64(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			intStringLen := int(stringLen)
			if intStringLen < 0 {

View on GitHub (pinned to 1283425b60)

Solutions

Upgrade/downgrade so both sides share the same api/client/proto version.
Run make proto / regenerate bindings to match the current .proto.
Re-serialize or discard the corrupted record.
Confirm the producer marshals ID as string (wire type 2).

Example fix

// before: sender writes ID as int32
AcctID: proto.Int64(id)
// after: string ID matching schema
ID: strconv.FormatInt(id, 10)

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure both sides agree on schema by checking the api module version at startup
if apiVersion := version.API(); apiVersion != serverAPIVersion {
  return fmt.Errorf("api version mismatch: client %s server %s", apiVersion, serverAPIVersion)
}

Type guard

func isStringField1(data []byte) bool {
  // IdentityCenterAccount.ID is field 1, wire type 2 => key byte 0x0a
  return len(data) > 0 && data[0] == 0x0a
}

Try / catch

if err := proto.Unmarshal(data, &acct); err != nil {
  if strings.Contains(err.Error(), "field ID") {
    return fmt.Errorf("schema mismatch on IdentityCenterAccount.ID (upgrade client/server to same version): %w", err)
  }
  return err
}

Prevention

Bump the api dependency in plugins at the same time as server upgrades.
Commit regenerated pb.go files in the same PR as .proto changes.
Add integration tests that decode records written by the previous release.
Avoid editing proto field names/types in place; add new fields instead.

When it happens

Trigger: Decoding an IdentityCenterAccount where field 1 (ID) carries a non-length-delimited wire type — e.g. an older schema where ID was an int, or corrupted framing that misreads the tag.

Common situations: Teleport version skew (auth server vs aws-integration agent), stale generated code after .proto edits, binary corruption in cached/stored records.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/300066e7cfa53c6c. Report an issue: GitHub.