{"record":{"id":"9d6c804681be46b6","repo":"puppetlabs/puppet","slug":"invalid-klass-id","errorCode":null,"errorMessage":"Invalid %{klass}: %{id}","messagePattern":"Invalid %(.+?): %(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/suidmanager.rb","lineNumber":150,"sourceCode":"      initgroups(uid)\n      Process.euid = uid\n    else\n      Process.euid = uid\n      initgroups(uid)\n    end\n  end\n  module_function :change_user\n\n  # Make sure the passed argument is a number.\n  def convert_xid(type, id)\n    return id if id.is_a? Integer\n\n    map = { :gid => :group, :uid => :user }\n    raise ArgumentError, _(\"Invalid id type %{type}\") % { type: type } unless map.include?(type)\n\n    ret = Puppet::Util.send(type, id)\n    if ret.nil?\n      raise Puppet::Error, _(\"Invalid %{klass}: %{id}\") % { klass: map[type], id: id }\n    end\n\n    ret\n  end\n  module_function :convert_xid\n\n  # Initialize primary and supplemental groups to those of the target user.  We\n  # take the UID and manually look up their details in the system database,\n  # including username and primary group. This method will fail on Windows, or\n  # if used without root to initgroups of another user.\n  def initgroups(uid)\n    pwent = Etc.getpwuid(uid)\n    Process.initgroups(pwent.name, pwent.gid)\n  end\n\n  module_function :initgroups\nend\n","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/suidmanager.rb#L132-L168","documentation":"Raised by Puppet::Util::SUIDManager.convert_xid when a user or group name cannot be translated into an id. convert_xid is the shared helper behind change_group and change_user; it calls Puppet::Util.uid or Puppet::Util.gid, and raises this Puppet::Error when the lookup returns nil.","triggerScenarios":"Puppet::Util::SUIDManager.change_group('wheel') or change_user('puppet') where the name has no passwd/group entry, or any direct call like convert_xid(:gid, 'nonexistent') / convert_xid(:uid, 'ghost').","commonSituations":"Dropping privileges to an account or group that is created later in the catalog; minimal container images missing expected system groups; NSS/LDAP outages during the agent run.","solutions":["Confirm the id resolves: `getent group <name>` / `getent passwd <name>`, then create the missing account or fix the typo.","Order the catalog so users/groups are managed before the resources that drop privileges to them.","Pass an Integer uid/gid to bypass name resolution entirely."],"exampleFix":"# before\nPuppet::Util::SUIDManager.change_group('appgrp') # raises Invalid group: appgrp\n\n# after\ngid = Puppet::Util.gid('appgrp') or raise ArgumentError, \"group 'appgrp' missing\"\nPuppet::Util::SUIDManager.change_group(gid)","handlingStrategy":"validation","validationCode":"def xid_resolves?(type, id)\n  id.is_a?(Integer) || !Puppet::Util.send(type, id).nil?\nend\nraise ArgumentError, \"#{id.inspect} does not resolve as #{type}\" unless xid_resolves?(:gid, id)\nPuppet::Util::SUIDManager.change_group(id)","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::Util::SUIDManager.convert_xid(type, id)\nrescue Puppet::Error, ArgumentError => e\n  raise \"cannot resolve #{type} #{id.inspect}: #{e.message}\"\nend","preventionTips":["Manage prerequisite users/groups earlier in the catalog.","Validate names against getent in acceptance tests.","Accept Integer ids in your own APIs to avoid NSS dependence."],"tags":["puppet","suid","group-lookup","user-lookup","unix"],"backgroundTag":"user-group-lookup-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}