gravitational/teleport · error

want '=' attributeValue, found EOF

Error message

want '=' attributeValue, found EOF

What it means

The DN string ended after a complete attribute type (and optional whitespace) but before '='. Like error 168 but for the state where the type was terminated by whitespace, e.g. "CN " — the parser then requires '=' and instead hits end of input.

Source

Thrown at api/utils/pkixname/parser.go:580

			switch r {
			case '+', ',', ';':
				transitionToNameComponent(r)
			default:
				return nil, fmt.Errorf("want '+' or ',', found %q: %s", r, errTrace(pos))
			}
		}
	}

	// Input ended, check the final state.
	switch state {
	case tokenizeStateInit:
		// OK.
	case tokenizeStateNameComponent:
		return nil, fmt.Errorf("want attributeType, found EOF")
	case tokenizeStateAttrType:
		return nil, fmt.Errorf("want attributeType or '=', found EOF")
	case tokenizeStateAttrTypeEnd:
		return nil, fmt.Errorf("want '=' attributeValue, found EOF")
	case tokenizeStateStringStart, tokenizeStateString, tokenizeStateStringEnd:
		// OK.
		emitBuffer(tokenString)
	case tokenizeStateStringEscape:
		return nil, fmt.Errorf("want escaped character, found EOF")
	case tokenizeStateStringQuote:
		return nil, fmt.Errorf("want closing quote, found EOF")
	case tokenizeStateStringQuoteEnd:
		// OK.
	default:
		// This should not be reached. All states are handled above.
		return nil, fmt.Errorf("found EOF (state=%d)", state)
	}

	return tokens, nil
}

func isAttrType(r rune) bool {

View on GitHub (pinned to 1283425b60)

Solutions

1. Append the missing '=value' after the attribute type, e.g. "CN " → "CN=Bob".
2. Remove the dangling attribute type and its trailing space.
3. Fix the upstream string construction so type and value are always emitted together.

Example fix

// before
name, err := pkixname.ParseDistinguishedName("O=Corp, CN ")
// after
name, err := pkixname.ParseDistinguishedName("O=Corp,CN=Bob")

func danglingAttrTypeWithSpace(dn string) bool {
	parts := strings.Split(dn, ",")
	last := strings.TrimSpace(parts[len(parts)-1])
	return !strings.Contains(last, "=")
}

name, err := pkixname.ParseDistinguishedName(dn)
if err != nil {
	if strings.Contains(err.Error(), "want '=' attributeValue, found EOF") {
		return nil, fmt.Errorf("DN %q ends after an attribute type; append '=value'", dn)
	}
	return nil, err
}

When it happens

Trigger: Calling ParseDistinguishedName with input like "CN " or "O=Corp, CN" (trailing type with space, no '='), or strings that were trimmed right after an attribute type.

Common situations: DNs truncated at whitespace boundaries by formatters or templating, typo dropping '=value', or split/join logic that lost the value part.

Related errors

• want attributeType, found EOF
• want attributeType or '=', found EOF
• not enough tokens to parse AttributeTypeValue, remaining tok
• hexstring not supported: %s
• want attributeType, found %q: %s

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/f8351c5926e01439. Report an issue: GitHub.