What causes "want attributeType or '=', found %q: %s" in gravitational/teleport?

Replace the offending delimiter with '=' between attribute type and value, e.g. "CN:Bob" → "CN=Bob".

want attributeType or '=', found %q: %s

Error message

want attributeType or '=', found %q: %s

What it means

While reading an attribute type, the tokenizer only accepts more type characters, whitespace (moving to AttrTypeEnd), or '='. Any other rune after the type starts is rejected with this error, which identifies the offending rune and position.

Source

Thrown at api/utils/pkixname/parser.go:506

				state = tokenizeStateAttrType
				buf.WriteRune(r)
			default:
				return nil, fmt.Errorf("want attributeType, found %q: %s", r, errTrace(pos))
			}

		case tokenizeStateAttrType:
			switch {
			case isAttrType(r):
				buf.WriteRune(r)
			case r == '=':
				emitBuffer(tokenAttrType)
				emit(tokenEqual)
				state = tokenizeStateStringStart
			case r == ' ':
				emitBuffer(tokenAttrType)
				state = tokenizeStateAttrTypeEnd
			default:
				return nil, fmt.Errorf("want attributeType or '=', found %q: %s", r, errTrace(pos))
			}

		case tokenizeStateAttrTypeEnd:
			switch r {
			case '=':
				emit(tokenEqual)
				state = tokenizeStateStringStart
			default:
				return nil, fmt.Errorf("want '=' attributeValue, found %q: %s", r, errTrace(pos))
			}

		case tokenizeStateString:
			switch r {
			case '+', ',', ';':
				emitBuffer(tokenString)
				transitionToNameComponent(r)
			case '\\':
				escapeStart()

View on GitHub (pinned to 1283425b60)

Solutions

Replace the offending delimiter with '=' between attribute type and value, e.g. "CN:Bob" → "CN=Bob".
Ensure the DN is a sequence of type=value pairs separated by ',' or '+'.
Pre-validate that every component matches `attrtype[ ]*=` before parsing.

Example fix

// before
name, err := pkixname.ParseDistinguishedName("CN:Bob")
// after
name, err := pkixname.ParseDistinguishedName("CN=Bob")

Defensive patterns

Strategy: validation

Validate before calling

var atvRe = regexp.MustCompile(`^[A-Za-z0-9.-]+\s*=`)
func startsWithTypeEquals(component string) bool {
	return atvRe.MatchString(strings.TrimSpace(component))
}

Try / catch

name, err := pkixname.ParseDistinguishedName(dn)
if err != nil {
	return nil, fmt.Errorf("malformed DN %q (expected type=value): %w", dn, err)
}

Prevention

Always use '=' (not ':' or other delimiters) between type and value
Lint DN templates for the pattern attr=value
Test DN generation code with example output

When it happens

Trigger: Calling ParseDistinguishedName where a value or separator appears before '=' in an attribute, e.g. "CN:Bob", "CN=Bob,O=" followed by another char, or "CN?Bob", or typing the DN in the wrong order like "Bob=CN".

Common situations: Using ':' instead of '=' (common LDAP ldif-style confusion), typos in key=value syntax, or DNs copied from formats that use different delimiters.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/0b4257cf6e3a582e. Report an issue: GitHub.