{"record":{"id":"4d572837a3ff5000","repo":"hashicorp/nomad","slug":"unable-to-lookup-user-s-group-membership-v","errorCode":null,"errorMessage":"unable to lookup user's group membership: %v","messagePattern":"unable to lookup user's group membership: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor_unix.go","lineNumber":70,"sourceCode":"\tif err := proc.Signal(sig); err != nil && err.Error() != finishedErr {\n\t\treturn fmt.Errorf(\"executor shutdown error: %v\", err)\n\t}\n\n\treturn nil\n}\n\n// setCmdUser takes a user id as a string and looks up the user, and sets the command\n// to execute as that user.\nfunc setCmdUser(cmd *exec.Cmd, userid string) error {\n\tu, err := users.Lookup(userid)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to identify user %v: %v\", userid, err)\n\t}\n\n\t// Get the groups the user is a part of\n\tgidStrings, err := u.GroupIds()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to lookup user's group membership: %v\", err)\n\t}\n\n\tgids := make([]uint32, len(gidStrings))\n\tfor _, gidString := range gidStrings {\n\t\tu, err := strconv.ParseUint(gidString, 10, 32)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to convert user's group to uint32 %s: %v\", gidString, err)\n\t\t}\n\n\t\tgids = append(gids, uint32(u))\n\t}\n\n\t// Convert the uid and gid\n\tuid, err := strconv.ParseUint(u.Uid, 10, 32)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to convert userid to uint32: %w\", err)\n\t}\n\tgid, err := strconv.ParseUint(u.Gid, 10, 32)","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor_unix.go#L52-L88","documentation":"After resolving the user, setCmdUser enumerates the user's supplementary groups via u.GroupIds(). If the group membership query fails (getgrouplist/ NSS failure), the error is wrapped and returned so the command is not started with a wrong or partial group set.","triggerScenarios":"users.Lookup succeeds but u.GroupIds() errors — typically NSS backend failure (sssd/ldap/nscd down), corrupted group database, or resource limits during group enumeration.","commonSituations":"Host joined to LDAP/AD where the group lookup backend is unreachable; /etc/group unreadable in minimal containers; nscd returning stale/failed responses.","solutions":["Run 'id <username>' as the Nomad user to reproduce and see the underlying group-lookup failure.","Restart/repair the NSS backend (sssd, nscd, nslcd) or fix /etc/nsswitch.conf group line.","Ensure /etc/group exists and is readable in the container/chroot.","As a workaround, run the task as a user whose groups resolve locally (e.g. in /etc/group)."],"exampleFix":"// before\n$ id appuser\nid: 'appuser': failed to find groups\n// after\n$ systemctl restart sssd  # or fix /etc/nsswitch.conf: group: files ldap","handlingStrategy":"validation","validationCode":"// Go: confirm group enumeration works before scheduling\nif u, err := user.Lookup(taskUser); err == nil {\n    if _, err := u.GroupIds(); err != nil {\n        return fmt.Errorf(\"cannot enumerate groups for %q: %w\", taskUser, err)\n    }\n}","typeGuard":"func groupsResolve(userid string) bool {\n    u, err := user.Lookup(userid)\n    if err != nil {\n        return false\n    }\n    _, err = u.GroupIds()\n    return err == nil\n}","tryCatchPattern":"if err := exec.SetUser(cmd, userid); err != nil {\n    if strings.Contains(err.Error(), \"group membership\") {\n        // NSS/group backend issue: alert on sssd/nscd health\n    }\n    return err\n}","preventionTips":["Monitor sssd/nscd/ldap health on Nomad clients.","Keep a local /etc/group fallback in nsswitch.conf ('group: files ldap').","Validate group resolution in client health checks.","Avoid exotic NSS backends for task users in containers."],"tags":["unix","groups","nss","nomad-executor"],"backgroundTag":"group-lookup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}