puppetlabs/puppet · error · ArgumentError

Cannot have both 'forcelocal' and 'ia_load_module' at the sa

Error message

Cannot have both 'forcelocal' and 'ia_load_module' at the same time!

What it means

AIX user/group providers pass a -R argument to AIX commands to select the Information & Authentication (I&A) database. ia_load_module targets an explicit module (e.g. LDAP) while forcelocal pins the local 'files' module; ia_module_args raises ArgumentError when a resource sets both, because the flags are contradictory and no valid command line could be built.

Source

Thrown at lib/puppet/provider/aix_object.rb:335

        # provider instance. The dup is necessary so that we do not
        # touch the class-level mapped object.
        @mappings[type][input] = mapped_object.dup
        @mappings[type][input].set_provider(self)
      end
    end

    @mappings
  end

  # Converts the given attributes hash to CLI args.
  def attributes_to_args(attributes)
    attributes.map do |attribute, value|
      "#{attribute}=#{value}"
    end
  end

  def ia_module_args
    raise ArgumentError, _("Cannot have both 'forcelocal' and 'ia_load_module' at the same time!") if @resource[:ia_load_module] && @resource[:forcelocal]
    return ["-R", @resource[:ia_load_module].to_s] if @resource[:ia_load_module]
    return ["-R", "files"] if @resource[:forcelocal]

    []
  end

  def lscmd
    [self.class.command(:list), '-c'] + ia_module_args + [@resource[:name]]
  end

  def addcmd(attributes)
    attribute_args = attributes_to_args(attributes)
    [self.class.command(:add)] + ia_module_args + attribute_args + [@resource[:name]]
  end

  def deletecmd
    [self.class.command(:delete)] + ia_module_args + [@resource[:name]]
  end

View on GitHub (pinned to e227c27540)

Solutions

1. Set only one of the two attributes on each resource.
2. Where ia_load_module is used, explicitly ensure forcelocal is undef/false in the layer that sets it.
3. Use Hiera merge strategies / lookup_options so a single layer owns both keys.

Example fix

# before (Puppet DSL)
user { 'svc': forcelocal => true, ia_load_module => 'LDAP' }   # ArgumentError

# after
user { 'svc': ia_load_module => 'LDAP' }                       # pick one target

# Puppet DSL: validate in the profile before declaring
if $forcelocal and $ia_load_module {
  fail('forcelocal and ia_load_module are mutually exclusive')
}

When it happens

Trigger: user { 'svc': forcelocal => true, ia_load_module => 'LDAP' } - both attributes on one resource; Hiera layering where one layer sets forcelocal and another adds ia_load_module to the same resource.

Common situations: Copy-paste from module READMEs that show each option separately; profile composition merging both keys onto the same resource; module class defaults combined with site data.

Related errors

• Invalid value %{value}: %{property} must be an Integer!
• Could not set %{property} on %{resource}[%{name}]: %{detail}
• Invalid value %{groups}: Groups must be comma separated!
• Could not reset the groups property back to %{cur_groups} af
• chpasswd said #{output}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/5619f6319e570442. Report an issue: GitHub.