{"record":{"id":"2bac0f70cf590dbf","repo":"hashicorp/nomad","slug":"unable-to-lookup-user-s-group-membership-w","errorCode":null,"errorMessage":"unable to lookup user's group membership: %w","messagePattern":"unable to lookup user's group membership: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/validators/validators_unix.go","lineNumber":26,"sourceCode":"import (\n\t\"fmt\"\n\t\"os/user\"\n\t\"strconv\"\n)\n\nfunc getUserID(user *user.User) (UserID, error) {\n\tid, err := strconv.ParseUint(user.Uid, 10, 32)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"unable to convert userid %s to integer\", user.Uid)\n\t}\n\n\treturn UserID(id), nil\n}\n\nfunc getGroupsID(user *user.User) ([]GroupID, error) {\n\tgidStrings, err := user.GroupIds()\n\tif err != nil {\n\t\treturn []GroupID{}, fmt.Errorf(\"unable to lookup user's group membership: %w\", err)\n\t}\n\n\tgids := make([]GroupID, len(gidStrings))\n\n\tfor _, gidString := range gidStrings {\n\t\tu, err := strconv.ParseUint(gidString, 10, 32)\n\t\tif err != nil {\n\t\t\treturn []GroupID{}, fmt.Errorf(\"unable to convert user's group %q to integer: %w\", gidString, err)\n\t\t}\n\n\t\tgids = append(gids, GroupID(u))\n\t}\n\n\treturn gids, nil\n}\n","sourceCodeStart":8,"sourceCodeEnd":42,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/validators/validators_unix.go#L8-L42","documentation":"getGroupsID calls user.GroupIds() to enumerate all groups the user belongs to; this error wraps any failure of that lookup. The validator cannot determine the user's group memberships, so HasValidIDs fails before it can check denied GIDs.","triggerScenarios":"Calling Validator.HasValidIDs(userName) when the underlying group membership lookup fails — typically the OS call getgrouplist / NSS group enumeration errors out for the given user.","commonSituations":"Broken NSS configuration (misconfigured sssd/ldap/nsswitch.conf), directory service timeouts or outages, extremely large group membership lists, or permissions issues reading group databases.","solutions":["Run 'id <username>' on the host to reproduce the group lookup failure outside Nomad","Check /etc/nsswitch.conf group line and fix the misbehaving NSS module (sssd/ldap)","Verify the directory service (LDAP/AD) is reachable and responding","Restart sssd or clear its cache (sss_cache -E) if group enumeration is stuck"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"cmd := exec.Command(\"id\", username)\nif err := cmd.Run(); err != nil {\n\treturn fmt.Errorf(\"group lookup for %s currently fails on this host\", username)\n}","typeGuard":null,"tryCatchPattern":"if err := validator.HasValidIDs(user); err != nil {\n\tvar ctxErr error\n\tif errors.As(err, &ctxErr) && errors.Is(err, context.DeadlineExceeded) {\n\t\t// retry later; NSS/directory service may be transiently down\n\t}\n\treturn err\n}","preventionTips":["Keep /etc/nsswitch.conf group sources minimal and healthy","Monitor sssd/LDAP availability; cache group data where possible","Test 'id <task-user>' in host health checks","Avoid enormous supplemental group lists that can time out enumeration"],"tags":["unix","groups","nss","user-lookup"],"backgroundTag":"group-lookup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}