{"record":{"id":"dbec32b03c658180","repo":"puppetlabs/puppet","slug":"could-not-reset-the-groups-property-back-to-cur","errorCode":null,"errorMessage":"Could not reset the groups property back to %{cur_groups} after setting the primary group on %{resource}[%{name}]. This means that the previous primary group of %{old_pgrp} and the new primary group of %{new_pgrp} have been added to %{cur_groups}. You will need to manually reset the groups property if this is undesirable behavior. Detail: %{detail}","messagePattern":"Could not reset the groups property back to %(.+?) after setting the primary group on %(.+?)\\[%(.+?)\\]\\. This means that the previous primary group of %(.+?) and the new primary group of %(.+?) have been added to %(.+?)\\. You will need to manually reset the groups property if this is undesirable behavior\\. Detail: %(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/provider/user/aix.rb","lineNumber":155,"sourceCode":"  # the resource methods (property getters + setters for our mapped\n  # properties + a getter for the attributes property).\n  mk_resource_methods\n\n  # Setting the primary group (pgrp attribute) on AIX causes both the\n  # current and new primary groups to be included in our user's groups,\n  # which is undesirable behavior. Thus, this custom setter resets the\n  # 'groups' property back to its previous value after setting the primary\n  # group.\n  def gid=(value)\n    old_pgrp = gid\n    cur_groups = groups\n\n    set(:gid, value)\n\n    begin\n      self.groups = cur_groups\n    rescue Puppet::Error => detail\n      raise Puppet::Error, _(\"Could not reset the groups property back to %{cur_groups} after setting the primary group on %{resource}[%{name}]. This means that the previous primary group of %{old_pgrp} and the new primary group of %{new_pgrp} have been added to %{cur_groups}. You will need to manually reset the groups property if this is undesirable behavior. Detail: %{detail}\") % { cur_groups: cur_groups, resource: @resource.class.name, name: @resource.name, old_pgrp: old_pgrp, new_pgrp: value, detail: detail }, detail.backtrace\n    end\n  end\n\n  # Helper function that parses the password from the given\n  # password filehandle. This is here to make testing easier\n  # for #password since we cannot configure Mocha to mock out\n  # a method and have it return a block's value, meaning we\n  # cannot test #password directly (not in a simple and obvious\n  # way, at least).\n  # @api private\n  def parse_password(f)\n    # From the docs, a user stanza is formatted as (newlines are explicitly\n    # stated here for clarity):\n    #   <user>:\\n\n    #     <attribute1>=<value1>\\n\n    #     <attribute2>=<value2>\\n\n    #\n    # First, find our user stanza","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/provider/user/aix.rb#L137-L173","documentation":"Raised by Puppet's AIX user provider after a primary-group (gid) change succeeded but the follow-up reset of the groups property failed. AIX's chuser automatically adds both old and new primary groups to the supplementary list when pgrp changes, so the provider snapshots groups, sets gid, then restores groups; if that restore raises Puppet::Error, this message reports the divergence and tells you to fix it manually.","triggerScenarios":"Changing `gid` on an AIX user whose current supplementary groups are invalid at reset time (e.g., a listed group was deleted concurrently, membership limits exceeded, or lsecf/stanza errors from chuser), causing the `self.groups = cur_groups` inside gid= to fail after set(:gid, value) succeeded.","commonSituations":"Modules managing both gid and groups on AIX; a group referenced by the user removed earlier in the same run; concurrent manual admin changes to the user during the Puppet run; long supplementary lists tripping AIX limits.","solutions":["Inspect the user's current groups: `lsgroup -a users <group>` / `grep ^user: /etc/group` (the provider parses /etc/group).","Manually reset the list with `chuser groups=<comma-list> <user>` to drop the stale primary group the message names.","Fix or remove references to deleted groups before changing gid again.","Re-run Puppet afterwards and confirm the user converges to the manifest state."],"exampleFix":"# manual remediation on the AIX node\n# before: primary group change left 'oldgrp,newgrp' appended\nchuser groups=appgrp,webgrp deploy\ngrep '^deploy:' /etc/group   # verify membership matches manifest","handlingStrategy":"try-catch","validationCode":"# before changing gid, confirm every current supplementary group still exists\nFile.readlines('/etc/group').map { |l| l.split(':').first }\nmissing = cur_groups.split(',') - existing_groups\nPuppet.warning \"stale groups: #{missing}\" unless missing.empty?","typeGuard":null,"tryCatchPattern":"begin\n  provider.gid = new_gid\nrescue Puppet::Error => e\n  raise unless e.message.start_with?('Could not reset the groups property')\n  # compensate: rewrite the supplementary list to the intended value\n  Puppet::Util::Execution.execute(['chuser', \"groups=#{cur_groups}\", resource[:name]])\nend","preventionTips":["Ensure groups referenced by a user are managed (and present) before any gid change.","Avoid changing gid and group membership in the same transaction on AIX unless required.","After gid changes, audit /etc/group membership for duplicated primary groups."],"tags":["aix","user-management","groups","gid","puppet"],"backgroundTag":"gid-change-group-reset-failure","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}