hashicorp/nomad · error

failed to identify user %q: %w

Error message

failed to identify user %q: %w

What it means

HasValidIDs is a task-run validator that resolves the task's user via os/user lookup before checking UID/GID allow/deny ranges. This error means users.Lookup failed — the operating system could not resolve the username to a passwd entry. It wraps the underlying lookup error (user.UnknownUserError, user.UnknownUserIdError, or an NSS failure).

Source

Thrown at drivers/shared/validators/validators.go:72

		return nil, err
	}
	valLogger.Debug("group range configured", "denied range", deniedHostGIDs)

	v := &Validator{
		deniedUIDs: idset.Parse[UserID](deniedHostUIDs),
		deniedGIDs: idset.Parse[GroupID](deniedHostGIDs),
		logger:     valLogger,
	}

	return v, nil
}

// HasValidIDs is used when running a task to ensure the
// given user is in the ID range defined in the task config
func (v *Validator) HasValidIDs(userName string) error {
	user, err := users.Lookup(userName)
	if err != nil {
		return fmt.Errorf("failed to identify user %q: %w", userName, err)
	}

	uid, err := getUserID(user)
	if err != nil {
		return fmt.Errorf("validator: %w", err)
	}

	// check uids
	if v.deniedUIDs.Contains(uid) {
		return fmt.Errorf("running as uid %d is disallowed", uid)
	}

	gids, err := getGroupsID(user)
	if err != nil {
		return fmt.Errorf("validator:  %w", err)
	}

	// check gids

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Verify the username exists on the client host: getent passwd <user> (or check /etc/passwd)
2. Create the user on the client (useradd) or use a UID-based user in the task config
3. If it is an LDAP/AD user, fix NSS/SSSD on the client so getent resolves the name
4. Check /etc/nsswitch.conf includes the right sources for passwd
5. Correct the typo in the job spec's user field

Example fix

// before (job HCL) — user not on host
user = "appuser123"
// after — create it first, then reference
// host: useradd -u 1500 appuser123
user = "appuser123"

// run before submitting the job, on the target client host
if _, err := user.Lookup(userName); err != nil {
    return fmt.Errorf("task user %q does not exist on host: %w", userName, err)
}

if err := validator.HasValidIDs(userName); err != nil {
    var unknown *user.UnknownUserError
    if errors.As(err, &unknown) {
        return fmt.Errorf("create the user on the client or pick another: %w", err)
    }
    return err
}

When it happens

Trigger: A task specifies a User that does not exist on the Nomad client host (no /etc/passwd entry, no matching NSS source such as LDAP/SSSD), or the lookup subsystem fails (corrupt /etc/passwd, NSS misconfiguration, sssd down for domain users).

Common situations: Typo in the job's user field; user exists only inside container images but not on the host; domain/LDAP users when sssd or nsswitch is misconfigured; username removed from the host after the job was written.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• validator: %w
• running as user %q is disallowed
• failed to get current user: %w
• running as uid %d is disallowed
• validator: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/fff4f9928b866898. Report an issue: GitHub.