gravitational/teleport · error

want attributeType or '=', found EOF

Error message

want attributeType or '=', found EOF

What it means

The DN string ended after an attribute type was read but before '=' appeared — i.e. the input terminated in the middle of an attribute type with no assignment. This is the EOF variant of the 'want attributeType or =' error, raised in the end-of-input state check.

Source

Thrown at api/utils/pkixname/parser.go:578

		case tokenizeStateStringQuoteEnd:
			switch r {
			case '+', ',', ';':
				transitionToNameComponent(r)
			default:
				return nil, fmt.Errorf("want '+' or ',', found %q: %s", r, errTrace(pos))
			}
		}
	}

	// Input ended, check the final state.
	switch state {
	case tokenizeStateInit:
		// OK.
	case tokenizeStateNameComponent:
		return nil, fmt.Errorf("want attributeType, found EOF")
	case tokenizeStateAttrType:
		return nil, fmt.Errorf("want attributeType or '=', found EOF")
	case tokenizeStateAttrTypeEnd:
		return nil, fmt.Errorf("want '=' attributeValue, found EOF")
	case tokenizeStateStringStart, tokenizeStateString, tokenizeStateStringEnd:
		// OK.
		emitBuffer(tokenString)
	case tokenizeStateStringEscape:
		return nil, fmt.Errorf("want escaped character, found EOF")
	case tokenizeStateStringQuote:
		return nil, fmt.Errorf("want closing quote, found EOF")
	case tokenizeStateStringQuoteEnd:
		// OK.
	default:
		// This should not be reached. All states are handled above.
		return nil, fmt.Errorf("found EOF (state=%d)", state)
	}

	return tokens, nil
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Complete the pair: append '=value', e.g. "CN" → "CN=Bob".
2. Remove the incomplete trailing attribute type.
3. Check where the DN string is produced/truncated (length limits, sprintf args) and fix the generator.

Example fix

// before
name, err := pkixname.ParseDistinguishedName("O=Corp,CN")
// after
name, err := pkixname.ParseDistinguishedName("O=Corp,CN=Bob")

func danglingAttrType(dn string) bool {
	parts := strings.Split(dn, ",")
	last := strings.TrimSpace(parts[len(parts)-1])
	return !strings.Contains(last, "=")
}

name, err := pkixname.ParseDistinguishedName(dn)
if err != nil {
	if strings.Contains(err.Error(), "found EOF") {
		return nil, fmt.Errorf("DN %q is truncated: an attribute type lacks '=value'", dn)
	}
	return nil, err
}

When it happens

Trigger: Calling ParseDistinguishedName with a DN that is just a bare attribute type, e.g. "CN", "O=Corp,CN" (truncated after the last type), or "CN=Bob,O".

Common situations: Truncated config values, DN strings cut off at a length limit, typos dropping '=value', or building DNs with fmt.Sprintf and a missing argument.

Related errors

• want attributeType, found EOF
• want '=' attributeValue, found EOF
• not enough tokens to parse AttributeTypeValue, remaining tok
• hexstring not supported: %s
• want attributeType, found %q: %s

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/8d679860f4f21b6c. Report an issue: GitHub.