puppetlabs/puppet · error · ArgumentError

Invalid value %{groups}: Groups must be comma separated!

Error message

Invalid value %{groups}: Groups must be comma separated!

What it means

Raised by Puppet's AIX user provider when the `groups` property value contains whitespace. Before handing the value to AIX commands, groups_property_to_attribute enforces the AIX chuser expectation of a comma-separated list with no spaces; any `\s` character in the string raises ArgumentError ('must be comma separated!').

Source

Thrown at lib/puppet/provider/user/aix.rb:87

      unless (match_obj = /\A(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)\z/.match(expires))
        # TRANSLATORS 'AIX' is the name of an operating system and should not be translated
        Puppet.warning(_("Could not convert AIX expires date '%{expires}' on %{class_name}[%{resource_name}]") % { expires: expires, class_name: provider.resource.class.name, resource_name: provider.resource.name })
        return :absent
      end

      month = match_obj[1]
      day = match_obj[2]
      year = match_obj[-1]
      "20#{year}-#{month}-#{day}"
    end

    # We do some validation before-hand to ensure the value's an Array,
    # a String, etc. in the property. This routine does a final check to
    # ensure our value doesn't have whitespace before we convert it to
    # an attribute.
    def groups_property_to_attribute(groups)
      if groups =~ /\s/
        raise ArgumentError, _("Invalid value %{groups}: Groups must be comma separated!") % { groups: groups }
      end

      groups
    end

    # We do not directly use the groups attribute value because that will
    # always include the primary group, even if our user is not one of its
    # members. Instead, we retrieve our property value by parsing the etc/group file,
    # which matches what we do on our other POSIX platforms like Linux and Solaris.
    #
    # See https://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.files/group_security.htm
    def groups_attribute_to_property(provider, _groups)
      Puppet::Util::POSIX.groups_of(provider.resource[:name]).join(',')
    end
  end

  mapping puppet_property: :comment,
          aix_attribute: :gecos

View on GitHub (pinned to e227c27540)

Solutions

1. Use comma separation with no whitespace: `groups => 'staff,wheel'`.
2. Prefer an array: `groups => ['staff', 'wheel']` — Puppet joins it correctly.
3. Sanitize data at the source (Hiera/EPP templates): strip/`.split(/[,\s]+/).join(',')`.
4. Check for stray whitespace with a lint-style grep over group values if the value comes from external data.

Example fix

# before
user { 'deploy': ensure => present, groups => 'staff, wheel' }
# after
user { 'deploy': ensure => present, groups => ['staff', 'wheel'] }

groups = 'staff, wheel'
fail 'whitespace in groups' if groups.to_s =~ /\s/

def aix_groups_valid?(groups)
  str = groups.is_a?(Array) ? groups.join(',') : groups.to_s
  str !~ /\s/ && str.split(',').all? { |g| g =~ /\A\S+\z/ && !g.empty? }
end

When it happens

Trigger: Setting `groups => 'staff, wheel'` (space after comma), `groups => 'staff wheel'` (space-separated), or any group name containing whitespace on a user managed by the AIX provider. Arrays are joined earlier, so `['staff', 'wheel']` is fine but a hand-written string with spaces is not.

Common situations: Manifests copied from Linux examples using space or ', ' separators; group data from Hiera templated with spaces; a trailing newline or space introduced by an interpolation or external data source.

Related errors

• Could not reset the groups property back to %{cur_groups} af
• Invalid value %{value}: %{property} must be an Integer!
• Cannot have both 'forcelocal' and 'ia_load_module' at the sa
• Could not set %{property} on %{resource}[%{name}]: %{detail}
• chpasswd said #{output}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/8991485dd4343b48. Report an issue: GitHub.