gravitational/teleport · error

want '+' or ',', found

Error message

want '+' or ',', found %q: %s

What it means

After a closing quote of a quoted attribute value, the tokenizer only accepts a '+' (multi-valued RDN) or ','/' ;' (next RDN). Any other character after the quoted string is rejected. Whitespace is skipped before this check, so the error means real stray content follows the quoted value.

Solutions

1. Insert the missing separator ',' or '+' after the quoted value.
2. Remove the stray characters following the closing quote.
3. Move any extra characters inside the quoted string if they are part of the value: "CN=\"Bob x\"".

Example fix

// before
name, err := pkixname.ParseDistinguishedName("CN=\"Bob\"O=Corp")
// after
name, err := pkixname.ParseDistinguishedName("CN=\"Bob\",O=Corp")

var afterQuoteRe = regexp.MustCompile(`"[^,+;]`)
func strayAfterQuote(dn string) bool { return afterQuoteRe.MatchString(dn) }

name, err := pkixname.ParseDistinguishedName(dn)
if err != nil {
	return nil, fmt.Errorf("malformed DN %q: content after quoted value: %w", dn, err)
}

When it happens

Trigger: Calling ParseDistinguishedName with content after a quoted value, e.g. "CN=\"Bob\"x", "CN=\"Bob\"=x", or "O=\"Corp\"CN=a" (missing comma).

Common situations: Values with unescaped trailing characters after quotes, hand-written DNs missing a separator between RDNs, or concatenation bugs when building DNs programmatically.

Related errors

• want attributeType, found
• want attributeType or '=', found
• want '=' attributeValue, found
• hexstring not supported
• special character not quoted

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/7e22d5d83b76a02d. Report an issue: GitHub.

Appendix: source

Thrown at api/utils/pkixname/parser.go:566

			}

		case tokenizeStateStringQuote:
			switch r {
			case '\\':
				escapeStart()
			case '"':
				emitBuffer(tokenString)
				state = tokenizeStateStringQuoteEnd
			default:
				buf.WriteRune(r)
			}

		case tokenizeStateStringQuoteEnd:
			switch r {
			case '+', ',', ';':
				transitionToNameComponent(r)
			default:
				return nil, fmt.Errorf("want '+' or ',', found %q: %s", r, errTrace(pos))
			}
		}
	}

	// Input ended, check the final state.
	switch state {
	case tokenizeStateInit:
		// OK.
	case tokenizeStateNameComponent:
		return nil, fmt.Errorf("want attributeType, found EOF")
	case tokenizeStateAttrType:
		return nil, fmt.Errorf("want attributeType or '=', found EOF")
	case tokenizeStateAttrTypeEnd:
		return nil, fmt.Errorf("want '=' attributeValue, found EOF")
	case tokenizeStateStringStart, tokenizeStateString, tokenizeStateStringEnd:
		// OK.
		emitBuffer(tokenString)
	case tokenizeStateStringEscape:

View on GitHub (pinned to 1283425b60)