{"record":{"id":"d0b0c444eb2d281d","repo":"puppetlabs/puppet","slug":"could-not-set-param-on-resource-name","errorCode":null,"errorMessage":"Could not set %{param} on %{resource}[%{name}]: %{detail}","messagePattern":"Could not set %(.+?) on %(.+?)\\[%(.+?)\\]: %(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/nameservice.rb","lineNumber":274,"sourceCode":"    @custom_environment = {}\n    @objectinfo = nil\n    if resource.is_a?(Hash) && !resource[:canonical_name].nil?\n      @canonical_name = resource[:canonical_name]\n    else\n      @canonical_name = resource[:name]\n    end\n  end\n\n  def set(param, value)\n    self.class.validate(param, value)\n    cmd = modifycmd(param, munge(param, value))\n    raise Puppet::DevError, _(\"Nameservice command must be an array\") unless cmd.is_a?(Array)\n\n    sensitive = has_sensitive_data?(param)\n    begin\n      execute(cmd, { :failonfail => true, :combine => true, :custom_environment => @custom_environment, :sensitive => sensitive })\n    rescue Puppet::ExecutionFailure => detail\n      raise Puppet::Error, _(\"Could not set %{param} on %{resource}[%{name}]: %{detail}\") % { param: param, resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace\n    end\n  end\n\n  # Derived classes can override to declare sensitive data so a flag can be passed to execute\n  def has_sensitive_data?(property = nil)\n    false\n  end\n\n  # From overriding Puppet::Property#insync? Ruby Etc::getpwnam < 2.1.0 always\n  # returns a struct with binary encoded string values, and >= 2.1.0 will return\n  # binary encoded strings for values incompatible with current locale charset,\n  # or Encoding.default_external if compatible. Compare a \"should\" value with\n  # encoding of \"current\" value, to avoid unnecessary property syncs and\n  # comparison of strings with different encodings. (PUP-6777)\n  #\n  # return basic string comparison after re-encoding (same as\n  # Puppet::Property#property_matches)\n  def comments_insync?(current, should)","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/nameservice.rb#L256-L292","documentation":"Raised by nameservice.rb:274 when the modify command for a property (built by modifycmd after munge/validate, e.g. `usermod -s /bin/zsh <name>`) exits non-zero. It wraps the underlying Puppet::ExecutionFailure into Puppet::Error with the param, resource type, resource name and the command output as %{detail}. When the property is sensitive (has_sensitive_data? is true, e.g. passwords) the command output was already redacted by execute(:sensitive => true), so %{detail} will not leak the secret.","triggerScenarios":"A property sync on a user/group/provider derived from Nameservice: usermod/groupmod failing due to invalid values accepted by Puppet but rejected by the OS (bad shell path not in /etc/shells, login class that does not exist, UID already in use when uniqueness tools run, password rejected by PAM/chpasswd policy), or the tool being missing/broken.","commonSituations":"Managing User['joe'] { shell => '/bin/fish' } on a node without /bin/fish installed; setting a password that violates system policy so `chpasswd`/usermod -p fails; AIX `chuser` rejecting a nonexistent group as primary; typo'd attribute values that pass Puppet validation but fail OS-level validation.","solutions":["Read %{detail} — it embeds the exact usermod/groupmod stderr. Run the same modifycmd by hand to reproduce.","Fix the offending property value in the manifest (existing shell path, existing group, policy-compliant password).","If the tool is missing, fix the provider confine or install the sysadmin package that provides usermod/groupmod.","For password policy failures, generate a compliant hash or relax the policy; Puppet passes the hash verbatim."],"exampleFix":"# before: usermod fails 'shell /bin/fish does not exist'\nuser { 'joe': shell => '/bin/fish' }\n\n# after: point at a shell that exists on the node\nuser { 'joe': shell => '/bin/bash' }","handlingStrategy":"try-catch","validationCode":"# dry-run the modify command for risky attributes\nPuppet::Util.safe_posix_fork rescue nil\n# simpler: validate values against the OS before the agent run\nFile.read('/etc/shells').include?('/bin/fish') or raise 'shell not present on node'","typeGuard":null,"tryCatchPattern":"begin\n  user { 'joe' => { shell: '/bin/fish' } }  # pseudo\nrescue Puppet::Error => e\n  raise unless e.message =~ /Could not set \\S+ on \\w+/\n  # fall back to leaving the attribute unmanaged and file a report\n  notify { \"usermod failed: #{e.message}\": }\nend","preventionTips":["Derive attribute values from facts (existing shells, existing groups) instead of hardcoding them in shared profiles.","Smoke-test usermod/groupmod manually on one node of each OS before rolling out.","Treat any 'Could not set' as data drift: fix the value, don't wrap the error."],"tags":["puppet","nameservice","user-management","command-execution"],"backgroundTag":"command-execution-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}