gravitational/teleport · error

want '=' attributeValue, found %q: %s

Error message

want '=' attributeValue, found %q: %s

What it means

After a complete attribute type (and optional whitespace), the tokenizer only accepts '='. Any other character triggers this error naming the rune and position. It means the parser found an attribute type with no '=' assignment following it.

Source

Thrown at api/utils/pkixname/parser.go:515

				buf.WriteRune(r)
			case r == '=':
				emitBuffer(tokenAttrType)
				emit(tokenEqual)
				state = tokenizeStateStringStart
			case r == ' ':
				emitBuffer(tokenAttrType)
				state = tokenizeStateAttrTypeEnd
			default:
				return nil, fmt.Errorf("want attributeType or '=', found %q: %s", r, errTrace(pos))
			}

		case tokenizeStateAttrTypeEnd:
			switch r {
			case '=':
				emit(tokenEqual)
				state = tokenizeStateStringStart
			default:
				return nil, fmt.Errorf("want '=' attributeValue, found %q: %s", r, errTrace(pos))
			}

		case tokenizeStateString:
			switch r {
			case '+', ',', ';':
				emitBuffer(tokenString)
				transitionToNameComponent(r)
			case '\\':
				escapeStart()
			case '<', '>', '"':
				// We could '<' and '>', but let's be strict.
				return nil, fmt.Errorf("special character %q not quoted: %s", r, errTrace(pos))
			case ' ':
				trailingSpaceBuf.WriteRune(r)
				state = tokenizeStateStringEnd
			case '=', '#': // Go does this.
				// NOT OK per RFC, should be escaped.
				fallthrough

View on GitHub (pinned to 1283425b60)

Solutions

  1. Add the missing '=' and value, e.g. "CN" → "CN=Bob".
  2. Remove the dangling attribute type if it is not intended.
  3. Pre-validate the DN so every attribute type is followed by '=' value.

Example fix

// before
name, err := pkixname.ParseDistinguishedName("CN,O=Example")
// after
name, err := pkixname.ParseDistinguishedName("CN=Bob,O=Example")
Defensive patterns

Strategy: validation

Validate before calling

func completePairs(dn string) bool {
	parts := strings.Split(dn, ",")
	for _, p := range parts {
		if !strings.Contains(p, "=") {
			return false
		}
	}
	return true
}

Try / catch

name, err := pkixname.ParseDistinguishedName(dn)
if err != nil {
	return nil, fmt.Errorf("DN %q has an attribute type without '=': %w", dn, err)
}

Prevention

When it happens

Trigger: Calling ParseDistinguishedName with a bare attribute type not followed by '=', e.g. "CN,O=Example" (missing '=' after CN), "CN \"Bob\"", or "CN,CN=Bob".

Common situations: Hand-edited DNs where a value or '=' was deleted, truncated config lines, or DNs composed by joining attribute names without assignments.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/c994c7a3a78f2fd4. Report an issue: GitHub.