{"record":{"id":"2232e88cc1acc647","repo":"hashicorp/nomad","slug":"validator-w-2232e8","errorCode":null,"errorMessage":"validator:  %w","messagePattern":"validator:  %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/validators/validators.go","lineNumber":87,"sourceCode":"func (v *Validator) HasValidIDs(userName string) error {\n\tuser, err := users.Lookup(userName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to identify user %q: %w\", userName, err)\n\t}\n\n\tuid, err := getUserID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator: %w\", err)\n\t}\n\n\t// check uids\n\tif v.deniedUIDs.Contains(uid) {\n\t\treturn fmt.Errorf(\"running as uid %d is disallowed\", uid)\n\t}\n\n\tgids, err := getGroupsID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator:  %w\", err)\n\t}\n\n\t// check gids\n\tfor _, gid := range gids {\n\t\tif v.deniedGIDs.Contains(gid) {\n\t\t\treturn fmt.Errorf(\"running as gid %d is disallowed\", gid)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateIDRange is used to ensure that the configuration for ID ranges is valid\n// by checking the syntax and bounds.\nfunc validateIDRange(rangeType string, deniedRanges string) error {\n\n\tparts := strings.Split(deniedRanges, \",\")\n","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/validators/validators.go#L69-L105","documentation":"After UID checks, HasValidIDs fetches the user's supplementary group IDs via getGroupsID. This error means that enumeration failed — cgo-free user lookups or /etc/group parsing could not produce the group list. It wraps the low-level error with the same \"validator:\" prefix.","triggerScenarios":"users.Lookup returned a valid user, but the group lookup fails: /etc/group unreadable or corrupt, NSS group source (LDAP/SSSD) unavailable, or the group membership enumeration errors during task validation.","commonSituations":"Broken permissions on /etc/group; SSSD/LDAP outage for domain users; malformed group database entries; CGO_ENABLED=0 builds where group enumeration backends are limited.","solutions":["Verify group enumeration works on the host: id -G <user> and getent group","Fix /etc/group permissions/format or the NSS/SSSD configuration on the client","If using domain users, ensure the LDAP/SSSD provider is reachable","Rebuild with cgo enabled if a static build cannot enumerate groups on your platform"],"exampleFix":"// before: unreadable group database on client\n// -rw------- root root /etc/group\n// after: restore standard permissions\n// -rw-r--r-- root root /etc/group","handlingStrategy":"validation","validationCode":"// ensure group enumeration works before submitting tasks\nif _, err := u.GroupIds(); err != nil {\n    return fmt.Errorf(\"cannot enumerate groups for %q: %w\", userName, err)\n}","typeGuard":null,"tryCatchPattern":"gids, err := getGroupsID(user)\nif err != nil {\n    // treat as host configuration problem: check /etc/group and NSS before retrying\n    return fmt.Errorf(\"validator: %w\", err)\n}","preventionTips":["Verify id -G <user> works on client hosts during provisioning checks","Keep /etc/group readable (0644) and well-formed","Monitor SSSD/LDAP availability when using domain users"],"tags":["user-lookup","gid","os-groups","validation"],"backgroundTag":"group-lookup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}