puppetlabs/puppet · error · Puppet::Error

Cannot manage owner permissions, because the provider for '%

Error message

Cannot manage owner permissions, because the provider for '%{name}' is not functional

What it means

Settings#service_user_available? instantiates a Puppet user resource with audit => :ensure for the account named by the `user` setting (used when Puppet manages ownership of its run directories). If user.suitable? is false — no user provider on this host passes its confines — it raises Puppet::Error naming the resource, because Puppet cannot even inspect the account, let alone chown to it.

Source

Thrown at lib/puppet/settings.rb:892

  # @param run_mode [Symbol] symbolic reference to a Puppet run mode
  # @return [Array<SearchPathElement>]
  # @api private
  def searchpath(environment = nil, run_mode = preferred_run_mode)
    searchpath = configsearchpath(environment, run_mode)
    searchpath << SearchPathElement.new(:application_defaults, :values)
    searchpath << SearchPathElement.new(:overridden_defaults, :values)
  end

  def service_user_available?
    return @service_user_available if defined?(@service_user_available)

    if self[:user]
      user = Puppet::Type.type(:user).new :name => self[:user], :audit => :ensure

      if user.suitable?
        @service_user_available = user.exists?
      else
        raise Puppet::Error, (_("Cannot manage owner permissions, because the provider for '%{name}' is not functional") % { name: user })
      end
    else
      @service_user_available = false
    end
  end

  def service_group_available?
    return @service_group_available if defined?(@service_group_available)

    if self[:group]
      group = Puppet::Type.type(:group).new :name => self[:group], :audit => :ensure

      if group.suitable?
        @service_group_available = group.exists?
      else
        raise Puppet::Error, (_("Cannot manage group permissions, because the provider for '%{name}' is not functional") % { name: group })
      end
    else

View on GitHub (pinned to e227c27540)

Solutions

1. Install the OS packages the user provider confines on (shadow/useradd toolchain, getent) so a provider becomes suitable.
2. Verify with `puppet resource user <name>` that the provider works on this host.
3. If Puppet should not manage ownership here, remove or comment out the user setting — the method then returns false without raising.
4. Ensure the service account actually exists and is resolvable (getent passwd <user>).

Example fix

# before (puppet.conf)
[server]
user = puppet   # container has no functional user provider

# after — drop the setting on hosts that cannot manage the account
[server]
# user = puppet

if Puppet.settings[:user]
  probe = Puppet::Type.type(:user).new(name: Puppet.settings[:user], audit: :ensure)
  raise Puppet::Error, "no suitable user provider on this host" unless probe.suitable?
end

provider_suitable = ->(kind, name) { Puppet::Type.type(kind).new(name: name, audit: :ensure).suitable? rescue false }

begin
  Puppet.settings.service_user_available?
rescue Puppet::Error => e
  raise unless e.message.include?('provider')
  Puppet.warning("cannot verify service user; continuing without ownership management")
end

When it happens

Trigger: puppet.conf [main]/[server] user = puppet while the node has no suitable Puppet::Type::User provider (missing shadow tools, unsupported platform, provider confines on features like libuser that are absent); custom user providers whose `confine`/`exists?` prerequisites are unmet; minimal container images without useradd/getent.

Common situations: Running puppetserver or agent in stripped-down Docker/Alpine-style images; unusual platforms (NAS appliances, busybox) where the default provider is not suitable; test suites faking providers.

Related errors

• Cannot manage group permissions, because the provider for '%
• Invalid %{resource} provider '%{provider_class}'
• Could not find %{name} provider of %{provider}
• Unable to verify the SSL certificate at %{uri}
• Global option %{option} does not exist in Puppet.settings

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/e78d1966152dc945. Report an issue: GitHub.