{"record":{"id":"8e2737fd70000e7b","repo":"puppetlabs/puppet","slug":"no-such-user-user","errorCode":null,"errorMessage":"No such user %{user}","messagePattern":"No such user %(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/suidmanager.rb","lineNumber":119,"sourceCode":"  def change_group(group, permanently = false)\n    gid = convert_xid(:gid, group)\n    raise Puppet::Error, _(\"No such group %{group}\") % { group: group } unless gid\n\n    return if Process.egid == gid\n\n    if permanently\n      Process::GID.change_privilege(gid)\n    else\n      Process.egid = gid\n    end\n  end\n  module_function :change_group\n\n  # As change_group, but operates on uids. If changing user permanently,\n  # supplementary groups will be set the to default groups for the new uid.\n  def change_user(user, permanently = false)\n    uid = convert_xid(:uid, user)\n    raise Puppet::Error, _(\"No such user %{user}\") % { user: user } unless uid\n\n    return if Process.euid == uid\n\n    if permanently\n      # If changing uid, we must be root. So initgroups first here.\n      initgroups(uid)\n\n      Process::UID.change_privilege(uid)\n    elsif Process.euid == 0\n      # We must be root to initgroups, so initgroups before dropping euid if\n      # we're root, otherwise elevate euid before initgroups.\n      # change euid (to root) first.\n      initgroups(uid)\n      Process.euid = uid\n    else\n      Process.euid = uid\n      initgroups(uid)\n    end","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/suidmanager.rb#L101-L137","documentation":"Raised by Puppet::Util::SUIDManager.change_user when the requested user cannot be resolved to a numeric UID. The manager first translates the name through Puppet::Util.uid (Etc/getpwnam via NSS); if no passwd entry exists it refuses to switch identity, because setuid to an unknown account is never safe.","triggerScenarios":"Calling Puppet::Util::SUIDManager.change_user('deploy') directly, or an exec resource with a user attribute, when 'deploy' has no /etc/passwd or NSS entry (typo, account not yet created, LDAP/SSSD unreachable) so Puppet::Util.uid returns nil.","commonSituations":"Manifests referencing a service account that another module creates later in the same run; agents with flaky LDAP/SSSD name resolution; typos in the user attribute of exec resources.","solutions":["Verify the account exists on the node: run `getent passwd <user>`. If nothing returns, create the user before the code that switches to it.","Fix the spelling of the user name in the manifest or calling code.","If the account lives in LDAP/AD, confirm sssd/nsswitch is running and reachable on the agent.","Pass a numeric UID instead of a name when resolution through NSS is unreliable."],"exampleFix":"# before\nPuppet::Util::SUIDManager.change_user('deplooy') # typo, raises No such user\n\n# after\nuid = Puppet::Util.uid('deploy')\nraise ArgumentError, \"user 'deploy' missing\" if uid.nil?\nPuppet::Util::SUIDManager.change_user('deploy')","handlingStrategy":"validation","validationCode":"uid = Puppet::Util.uid(username) # Etc.getpwnam lookup\nraise ArgumentError, \"cannot switch to unknown user '#{username}'\" if uid.nil?\nPuppet::Util::SUIDManager.change_user(username, permanently)","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::SUIDManager.change_user(user, permanently)\nrescue Puppet::Error => e\n  raise \"privilege change to #{user.inspect} failed (does the account exist?): #{e.message}\"\nend","preventionTips":["Create service accounts before resources that run as them (use before/require in manifests).","Smoke-test names with `getent passwd` when authoring modules.","Prefer numeric UIDs when NSS resolution is unreliable."],"tags":["puppet","suid","user-lookup","unix","privileges"],"backgroundTag":"user-lookup-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}