puppetlabs/puppet · error · ArgumentError

Group names must be provided as an array, not a comma-separa

Error message

Group names must be provided as an array, not a comma-separated list.

What it means

Raised by the validate block of the `groups` property on the `user` type when a member string contains a comma. The property descends from Puppet::Property::List and expects an array of group names; a single comma-joined string is explicitly rejected so that 'a,b' is never treated as one weird group name. The comma check runs after the numeric check, so '1,2' raises the GID error first.

Source

Thrown at lib/puppet/type/user.rb:349

      end

      validate do |value|
        if value.to_s !~ /^-?\d+$/
          raise ArgumentError, "Password warning days must be provided as a number."
        end
      end
    end

    newproperty(:groups, :parent => Puppet::Property::List) do
      desc "The groups to which the user belongs.  The primary group should
        not be listed, and groups should be identified by name rather than by
        GID.  Multiple groups should be specified as an array."

      validate do |value|
        if value =~ /^\d+$/
          raise ArgumentError, _("Group names must be provided, not GID numbers.")
        end
        raise ArgumentError, _("Group names must be provided as an array, not a comma-separated list.") if value.include?(",")
        raise ArgumentError, _("Group names must not be empty. If you want to specify \"no groups\" pass an empty array") if value.empty?
      end

      def change_to_s(currentvalue, newvalue)
        newvalue = newvalue.split(",") if newvalue != :absent

        if provider.respond_to?(:groups_to_s)
          # for Windows ADSI
          # de-dupe the "newvalue" when the sync event message is generated,
          # due to final retrieve called after the resource has been modified
          newvalue = provider.groups_to_s(newvalue).split(',').uniq
        end

        super(currentvalue, newvalue)
      end

      # override Puppet::Property::List#retrieve
      def retrieve

View on GitHub (pinned to e227c27540)

Solutions

1. Pass a real array: `groups => ['wheel', 'audio']`
2. In Hiera store a YAML list, not a comma-joined string
3. If the value arrives as a string, split it before use: `groups => $raw.split(',')`

Example fix

# before
user { 'alice':
  ensure => present,
  groups => 'wheel,audio',
}

# after
user { 'alice':
  ensure => present,
  groups => ['wheel', 'audio'],
}

# Normalize incoming data before the user resource
$group_list = $raw_groups ? {
  String => $raw_groups.split(','),
  default => $raw_groups,
}

When it happens

Trigger: `user { 'alice': groups => 'wheel,audio' }`; a template or Hiera lookup that joins an array with join(','); passing output of `id -Gn` verbatim.

Common situations: Refactoring shell scripts that used `usermod -G wheel,audio`; string interpolation of a Ruby array into a manifest; ENC/classifier APIs that only accept strings for parameters.

Related errors

• Group names must be provided, not GID numbers.
• Group names must not be empty. If you want to specify "no gr
• Role names must be provided as an array, not a comma-separat
• Auth names must be provided as an array, not a comma-separat
• Profile names must be provided as an array, not a comma-sepa

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/abda23af37fb14bd. Report an issue: GitHub.