puppetlabs/puppet · error · Puppet::Error

Could not set %{property} on %{resource}[%{name}]: %{detail}

Error message

Could not set %{property} on %{resource}[%{name}]: %{detail}

What it means

The AIX providers change entities by executing commands such as chuser/chgroup; set() maps the Puppet property to its AIX attribute and calls modify_object. When the command exits non-zero, Puppet::ExecutionFailure is wrapped into Puppet::Error including the property, resource type, resource title and the command output (detail), with the original backtrace attached. The message is a wrapper - the real reason is in the AIX command output carried in the detail.

Source

Thrown at lib/puppet/provider/aix_object.rb:380

    execute(modifycmd(new_attributes))
    object_info(true)
  end

  # Gets a Puppet property's value from object_info
  def get(property)
    return :absent unless exists?

    object_info[property] || :absent
  end

  # Sets a mapped Puppet property's value.
  def set(property, value)
    aix_attribute = mappings[:aix_attribute][property]
    modify_object(
      { aix_attribute.name => aix_attribute.convert_property_value(value) }
    )
  rescue Puppet::ExecutionFailure => detail
    raise Puppet::Error, _("Could not set %{property} on %{resource}[%{name}]: %{detail}") % { property: property, resource: @resource.class.name, name: @resource.name, detail: detail }, detail.backtrace
  end

  # This routine validates our new attributes property value to ensure
  # that it does not contain any Puppet properties.
  def validate_new_attributes(new_attributes)
    # Gather all of the <puppet property>, <aix attribute> conflicts to print
    # them all out when we create our error message. This makes it easy for the
    # user to update their manifest based on our error message.
    conflicts = {}
    mappings[:aix_attribute].each do |property, aix_attribute|
      next unless new_attributes.key?(aix_attribute.name)

      conflicts[:properties] ||= []
      conflicts[:properties].push(property)

      conflicts[:attributes] ||= []
      conflicts[:attributes].push(aix_attribute.name)
    end

View on GitHub (pinned to e227c27540)

Solutions

1. Run the AIX command shown in the detail message manually as the same user to see the real error.
2. Run puppet with sufficient privileges on AIX (normally root).
3. Check that forcelocal / ia_load_module point at the I&A database where the entity actually lives.
4. Verify the attribute/value is legal for the entity type (man chuser / man chgroup).

begin
  provider.set(:uid, 1001)
rescue Puppet::Error => e
  # e.message carries the property, resource title and AIX command output
  Puppet.err("AIX update failed for #{resource.title}: #{e.message}")
  raise
end

When it happens

Trigger: user { 'bob': uid => 1001 } where chuser fails: insufficient privileges (agent not root), the attribute is rejected by AIX policy, or the user lives in a different I&A module than the one targeted; group changes hitting chgroup errors.

Common situations: Running the agent as non-root on AIX; forcelocal/ia_load_module mismatching where the account actually resides; AIX security settings (e.g. LDAP restrictions) refusing attribute changes; values outside the legal range for the entity.

Related errors

• puppet.tasks/invalid-metadata
• Invalid value %{value}: %{property} must be an Integer!
• Cannot have both 'forcelocal' and 'ia_load_module' at the sa
• Could not delete %{resource} %{name}: %{detail}
• Could not set %{param} on %{resource}[%{name}]: %{detail}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/b8bd03f5fba1285f. Report an issue: GitHub.