{"record":{"id":"fff4f9928b866898","repo":"hashicorp/nomad","slug":"failed-to-identify-user-q-w","errorCode":null,"errorMessage":"failed to identify user %q: %w","messagePattern":"failed to identify user %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/validators/validators.go","lineNumber":72,"sourceCode":"\t\treturn nil, err\n\t}\n\tvalLogger.Debug(\"group range configured\", \"denied range\", deniedHostGIDs)\n\n\tv := &Validator{\n\t\tdeniedUIDs: idset.Parse[UserID](deniedHostUIDs),\n\t\tdeniedGIDs: idset.Parse[GroupID](deniedHostGIDs),\n\t\tlogger:     valLogger,\n\t}\n\n\treturn v, nil\n}\n\n// HasValidIDs is used when running a task to ensure the\n// given user is in the ID range defined in the task config\nfunc (v *Validator) HasValidIDs(userName string) error {\n\tuser, err := users.Lookup(userName)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to identify user %q: %w\", userName, err)\n\t}\n\n\tuid, err := getUserID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator: %w\", err)\n\t}\n\n\t// check uids\n\tif v.deniedUIDs.Contains(uid) {\n\t\treturn fmt.Errorf(\"running as uid %d is disallowed\", uid)\n\t}\n\n\tgids, err := getGroupsID(user)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"validator:  %w\", err)\n\t}\n\n\t// check gids","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/validators/validators.go#L54-L90","documentation":"HasValidIDs is a task-run validator that resolves the task's user via os/user lookup before checking UID/GID allow/deny ranges. This error means users.Lookup failed — the operating system could not resolve the username to a passwd entry. It wraps the underlying lookup error (user.UnknownUserError, user.UnknownUserIdError, or an NSS failure).","triggerScenarios":"A task specifies a User that does not exist on the Nomad client host (no /etc/passwd entry, no matching NSS source such as LDAP/SSSD), or the lookup subsystem fails (corrupt /etc/passwd, NSS misconfiguration, sssd down for domain users).","commonSituations":"Typo in the job's user field; user exists only inside container images but not on the host; domain/LDAP users when sssd or nsswitch is misconfigured; username removed from the host after the job was written.","solutions":["Verify the username exists on the client host: getent passwd <user> (or check /etc/passwd)","Create the user on the client (useradd) or use a UID-based user in the task config","If it is an LDAP/AD user, fix NSS/SSSD on the client so getent resolves the name","Check /etc/nsswitch.conf includes the right sources for passwd","Correct the typo in the job spec's user field"],"exampleFix":"// before (job HCL) — user not on host\nuser = \"appuser123\"\n// after — create it first, then reference\n// host: useradd -u 1500 appuser123\nuser = \"appuser123\"","handlingStrategy":"validation","validationCode":"// run before submitting the job, on the target client host\nif _, err := user.Lookup(userName); err != nil {\n    return fmt.Errorf(\"task user %q does not exist on host: %w\", userName, err)\n}","typeGuard":null,"tryCatchPattern":"if err := validator.HasValidIDs(userName); err != nil {\n    var unknown *user.UnknownUserError\n    if errors.As(err, &unknown) {\n        return fmt.Errorf(\"create the user on the client or pick another: %w\", err)\n    }\n    return err\n}","preventionTips":["Verify with getent passwd <user> on every client host before deploying jobs","Provision task users with configuration management across the fleet","Prefer numeric UID-based users for jobs targeting heterogeneous hosts","Check NSS/SSSD health when using LDAP/domain accounts"],"tags":["user-lookup","os-users","validation","security"],"backgroundTag":"user-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}