grpc/grpc-go · error

rbac: incorrect config type provided (%T): %v

Error message

rbac: incorrect config type provided (%T): %v

What it means

BuildServerInterceptor asserts the listener-level config is the RBAC builder's own unexported config struct. A different concrete type means a config produced by another filter builder was dispatched into the RBAC builder.

Source

Thrown at internal/xds/httpfilter/rbac/rbac.go:180

func (builder) BuildServerFilter() httpfilter.ServerFilter {
	return serverFilter{}
}

var _ httpfilter.ServerFilterBuilder = builder{}

type serverFilter struct{}

func (serverFilter) Close() {}

func (serverFilter) BuildServerInterceptor(cfg httpfilter.FilterConfig, override httpfilter.FilterConfig) (resolver.ServerInterceptor, error) {
	if cfg == nil {
		return nil, fmt.Errorf("rbac: nil config provided")
	}

	c, ok := cfg.(config)
	if !ok {
		return nil, fmt.Errorf("rbac: incorrect config type provided (%T): %v", cfg, cfg)
	}

	if override != nil {
		// override completely replaces the listener configuration; but we
		// still validate the listener config type.
		c, ok = override.(config)
		if !ok {
			return nil, fmt.Errorf("rbac: incorrect override config type provided (%T): %v", override, override)
		}
	}

	// RBAC HTTP Filter is a no op from one of these two cases:
	// "If absent, no enforcing RBAC policy will be applied" - RBAC
	// Documentation for Rules field.
	// "At this time, if the RBAC.action is Action.LOG then the policy will be
	// completely ignored, as if RBAC was not configured." - A41
	if c.chainEngine == nil {
		return nil, nil

View on GitHub (pinned to 03255a9237)

Solutions

1. Confirm no two registered httpfilter builders advertise the same TypeURL.
2. Ensure the builder that produced the config is the RBAC builder (check httpfilter registration order and TypeURLs).

// Inside the rbac package the config type is unexported; outside callers
// can only assert via the httpfilter.FilterConfig interface. Ensure the same
// builder that parsed the config also builds the interceptor.
func sameBuilder(parsedBy, buildBy httpfilter.Builder) bool { return parsedBy == buildBy }

When it happens

Trigger: The httpfilter registry hands a non-RBAC config to the RBAC BuildServerInterceptor - e.g. two filters share or collide on a TypeURL, or the filter chain was misrouted.

Common situations: Filter misregistration; TypeURL collision between custom and built-in filters; internal dispatch bug.

Related errors

• rbac: incorrect override config type provided (%T): %v
• rbac: error parsing config %v: unknown type %T
• rbac: error parsing override config %v: unknown type %T
• rbac: nil config provided
• router: incorrect config type provided (%T): %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/21d05b602a019dbc. Report an issue: GitHub.