gravitational/teleport · error

proto: wrong wireType = %d for field UserCredentials

Error message

proto: wrong wireType = %d for field UserCredentials

What it means

The decoder for CreateAuthenticateChallengeRequest case 1 expects field UserCredentials to have wire type 2 (length-delimited, since it is a oneof message). A different wire type was found on tag 1, so decoding aborts with this error.

Source

Thrown at api/client/proto/authservice.pb.go:60038

			b := dAtA[iNdEx]
			iNdEx++
			wire |= uint64(b&0x7F) << shift
			if b < 0x80 {
				break
			}
		}
		fieldNum := int32(wire >> 3)
		wireType := int(wire & 0x7)
		if wireType == 4 {
			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: wiretype end group for non-group")
		}
		if fieldNum <= 0 {
			return fmt.Errorf("proto: CreateAuthenticateChallengeRequest: illegal tag %d (wire type %d)", fieldNum, wire)
		}
		switch fieldNum {
		case 1:
			if wireType != 2 {
				return fmt.Errorf("proto: wrong wireType = %d for field UserCredentials", wireType)
			}
			var msglen int
			for shift := uint(0); ; shift += 7 {
				if shift >= 64 {
					return ErrIntOverflowAuthservice
				}
				if iNdEx >= l {
					return io.ErrUnexpectedEOF
				}
				b := dAtA[iNdEx]
				iNdEx++
				msglen |= int(b&0x7F) << shift
				if b < 0x80 {
					break
				}
			}
			if msglen < 0 {
				return ErrInvalidLengthAuthservice

View on GitHub (pinned to 1283425b60)

Solutions

  1. Marshal the request with the generated struct and oneof setter (m.Request = &CreateAuthenticateChallengeRequest_UserCredentials{...}) instead of hand-crafted bytes
  2. Confirm both sides use identical proto definitions for field 1
  3. Check that the bytes are not from a different message type
  4. Re-run codegen (protoc/gogo) so generated Unmarshal matches the schema

Example fix

// before
// manually appended varint for field 1
buf = append(buf, 0x08, 0x01)
// after
req := &proto.CreateAuthenticateChallengeRequest{
  Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{
    UserCredentials: &proto.UserCredentials{...},
  },
}
b, _ := req.Marshal()
Defensive patterns

Strategy: validation

Validate before calling

// ensure the oneof is set via the generated wrapper before sending
if req.GetRequest() == nil { return errors.New("Request oneof must be set") }
if _, ok := req.Request.(*proto.CreateAuthenticateChallengeRequest_UserCredentials); !ok && req.GetRecoveryStartTokenID() == "" && req.GetContextUser() == nil && req.GetPasswordless() == nil {
  return errors.New("expected UserCredentials variant")
}

Type guard

func isUserCredentials(r *proto.CreateAuthenticateChallengeRequest) bool {
  _, ok := r.GetRequest().(*proto.CreateAuthenticateChallengeRequest_UserCredentials)
  return ok
}

Prevention

When it happens

Trigger: Sending CreateAuthenticateChallengeRequest where field 1 carries a non-length-delimited value (e.g. varint/fixed64) — caused by serializing a mismatched struct, hand-built bytes, or a proto where field 1 changed type.

Common situations: Version skew after a proto refactor moved the oneof; a test harness constructing bytes manually; message type confusion on the wire.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/f464b227fc853964. Report an issue: GitHub.