gravitational/teleport · error

proto: wrong wireType = %d for field Passwordless

Error message

proto: wrong wireType = %d for field Passwordless

What it means

Protobuf unmarshal guard in generated code: while decoding CreateAuthenticateChallengeRequest, the Passwordless oneof field arrived with an unexpected wire type instead of the length-delimited type expected for a message.

Source

Thrown at api/client/proto/authservice.pb.go:60140

			if msglen < 0 {
				return ErrInvalidLengthAuthservice
			}
			postIndex := iNdEx + msglen
			if postIndex < 0 {
				return ErrInvalidLengthAuthservice
			}
			if postIndex > l {
				return io.ErrUnexpectedEOF
			}
			v := &ContextUser{}
			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
				return err
			}
			m.Request = &CreateAuthenticateChallengeRequest_ContextUser{v}
			iNdEx = postIndex
		case 4:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field Passwordless", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			if msglen < 0 {
				return ErrInvalidLengthAuthservice

View on GitHub (pinned to 1283425b60)

Solutions

1. Populate Request via &CreateAuthenticateChallengeRequest_Passwordless{...} and Marshal normally
2. Ensure both peers compile the same authservice.proto
3. Check for byte-stream offset/corruption issues in the transport
4. Regenerate .pb.go files from current protos

Example fix

// before
// bytes written with wrong encoding for field 4
// after
m.Request = &proto.CreateAuthenticateChallengeRequest_Passwordless{
  Passwordless: &proto.Passwordless{User: "alice"},
}
b, _ := m.Marshal()

if req.GetPasswordless() == nil && req.GetRequest() == nil { return errors.New("no request variant set") }

func isPasswordless(r *proto.CreateAuthenticateChallengeRequest) (*proto.Passwordless, bool) {
  v, ok := r.GetRequest().(*proto.CreateAuthenticateChallengeRequest_Passwordless)
  if !ok { return nil, false }
  return v.Passwordless, true
}

When it happens

Trigger: Decoding bytes where tag 4 carries a non-length-delimited value — incompatible serialization, hand-assembled frames, or version skew between peers.

Common situations: Older client sending a pre-oneof shape of the request; test fixture bytes built manually; intermediary rewriting fields.

Related errors

• proto: wrong wireType = %d for field UserCredentials
• proto: wrong wireType = %d for field ContextUser
• proto: Passwordless: wiretype end group for non-group
• proto: Passwordless: illegal tag %d (wire type %d)
• proto: CreateAuthenticateChallengeRequest: wiretype end grou

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/fec37c53c1359213. Report an issue: GitHub.