puppetlabs/puppet · error · ArgumentError

Group names must not be empty. If you want to specify "no gr

Error message

Group names must not be empty. If you want to specify "no groups" pass an empty array

What it means

Raised by the validate block of the `groups` property on the `user` type when a member string is empty. An empty string cannot name a group, and Puppet cannot tell it apart from an accidental value, so the error message tells you to pass an explicit empty array when the intent is 'no supplementary groups'.

Source

Thrown at lib/puppet/type/user.rb:350

      validate do |value|
        if value.to_s !~ /^-?\d+$/
          raise ArgumentError, "Password warning days must be provided as a number."
        end
      end
    end

    newproperty(:groups, :parent => Puppet::Property::List) do
      desc "The groups to which the user belongs.  The primary group should
        not be listed, and groups should be identified by name rather than by
        GID.  Multiple groups should be specified as an array."

      validate do |value|
        if value =~ /^\d+$/
          raise ArgumentError, _("Group names must be provided, not GID numbers.")
        end
        raise ArgumentError, _("Group names must be provided as an array, not a comma-separated list.") if value.include?(",")
        raise ArgumentError, _("Group names must not be empty. If you want to specify \"no groups\" pass an empty array") if value.empty?
      end

      def change_to_s(currentvalue, newvalue)
        newvalue = newvalue.split(",") if newvalue != :absent

        if provider.respond_to?(:groups_to_s)
          # for Windows ADSI
          # de-dupe the "newvalue" when the sync event message is generated,
          # due to final retrieve called after the resource has been modified
          newvalue = provider.groups_to_s(newvalue).split(',').uniq
        end

        super(currentvalue, newvalue)
      end

      # override Puppet::Property::List#retrieve
      def retrieve
        if provider.respond_to?(:groups_to_s)

View on GitHub (pinned to e227c27540)

Solutions

1. Pass an explicit empty array for no groups: `groups => []`
2. Or omit the attribute entirely when you have no opinion about supplementary groups
3. Fix upstream data/templates to emit undef instead of ''

Example fix

# before
user { 'alice':
  ensure => present,
  groups => '',
}

# after
user { 'alice':
  ensure => present,
  groups => [],   # explicitly no supplementary groups
}

# In profiles, translate empty scalars into 'no groups' explicitly
$groups = $raw_groups ? {
  String  => $raw_groups.empty? ? [] : $raw_groups.split(',')
  default => $raw_groups,
}

When it happens

Trigger: `user { 'alice': groups => '' }` or an array containing '' (e.g. from a join/split round-trip or an undefined template variable interpolated to empty); a class parameter defaulting to '' instead of undef.

Common situations: ERB/EPP templates interpolating an unset variable; data pipelines that produce empty strings for 'no value'; splitting an empty string (''.split(',') yields []) is safe but literal '' in data is not.

Related errors

• Group names must be provided, not GID numbers.
• Group names must be provided as an array, not a comma-separa
• Invalid terminus name %{terminus_class}
• Invalid value %{groups}: Groups must be comma separated!
• Could not reset the groups property back to %{cur_groups} af

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/89a5d040f35f9c43. Report an issue: GitHub.