{"record":{"id":"5619f6319e570442","repo":"puppetlabs/puppet","slug":"cannot-have-both-forcelocal-and-ia-load-module","errorCode":null,"errorMessage":"Cannot have both 'forcelocal' and 'ia_load_module' at the same time!","messagePattern":"Cannot have both 'forcelocal' and 'ia_load_module' at the same time!","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/aix_object.rb","lineNumber":335,"sourceCode":"        # provider instance. The dup is necessary so that we do not\n        # touch the class-level mapped object.\n        @mappings[type][input] = mapped_object.dup\n        @mappings[type][input].set_provider(self)\n      end\n    end\n\n    @mappings\n  end\n\n  # Converts the given attributes hash to CLI args.\n  def attributes_to_args(attributes)\n    attributes.map do |attribute, value|\n      \"#{attribute}=#{value}\"\n    end\n  end\n\n  def ia_module_args\n    raise ArgumentError, _(\"Cannot have both 'forcelocal' and 'ia_load_module' at the same time!\") if @resource[:ia_load_module] && @resource[:forcelocal]\n    return [\"-R\", @resource[:ia_load_module].to_s] if @resource[:ia_load_module]\n    return [\"-R\", \"files\"] if @resource[:forcelocal]\n\n    []\n  end\n\n  def lscmd\n    [self.class.command(:list), '-c'] + ia_module_args + [@resource[:name]]\n  end\n\n  def addcmd(attributes)\n    attribute_args = attributes_to_args(attributes)\n    [self.class.command(:add)] + ia_module_args + attribute_args + [@resource[:name]]\n  end\n\n  def deletecmd\n    [self.class.command(:delete)] + ia_module_args + [@resource[:name]]\n  end","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/aix_object.rb#L317-L353","documentation":"AIX user/group providers pass a -R argument to AIX commands to select the Information & Authentication (I&A) database. ia_load_module targets an explicit module (e.g. LDAP) while forcelocal pins the local 'files' module; ia_module_args raises ArgumentError when a resource sets both, because the flags are contradictory and no valid command line could be built.","triggerScenarios":"user { 'svc': forcelocal => true, ia_load_module => 'LDAP' } - both attributes on one resource; Hiera layering where one layer sets forcelocal and another adds ia_load_module to the same resource.","commonSituations":"Copy-paste from module READMEs that show each option separately; profile composition merging both keys onto the same resource; module class defaults combined with site data.","solutions":["Set only one of the two attributes on each resource.","Where ia_load_module is used, explicitly ensure forcelocal is undef/false in the layer that sets it.","Use Hiera merge strategies / lookup_options so a single layer owns both keys."],"exampleFix":"# before (Puppet DSL)\nuser { 'svc': forcelocal => true, ia_load_module => 'LDAP' }   # ArgumentError\n\n# after\nuser { 'svc': ia_load_module => 'LDAP' }                       # pick one target","handlingStrategy":"validation","validationCode":"# Puppet DSL: validate in the profile before declaring\nif $forcelocal and $ia_load_module {\n  fail('forcelocal and ia_load_module are mutually exclusive')\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat forcelocal and ia_load_module as an either/or choice in profile code.","When layering Hiera, give one layer exclusive ownership of AIX I&A-related keys.","Assert the mutual exclusion in profile parameter validation so failures happen at compile time."],"tags":["puppet","aix","user-management","mutually-exclusive","puppet-dsl"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}