puppetlabs/puppet · error · Puppet::Error

No such user %{user}

Error message

No such user %{user}

What it means

Raised by Puppet::Util::SUIDManager.change_user when the requested user cannot be resolved to a numeric UID. The manager first translates the name through Puppet::Util.uid (Etc/getpwnam via NSS); if no passwd entry exists it refuses to switch identity, because setuid to an unknown account is never safe.

Source

Thrown at lib/puppet/util/suidmanager.rb:119

  def change_group(group, permanently = false)
    gid = convert_xid(:gid, group)
    raise Puppet::Error, _("No such group %{group}") % { group: group } unless gid

    return if Process.egid == gid

    if permanently
      Process::GID.change_privilege(gid)
    else
      Process.egid = gid
    end
  end
  module_function :change_group

  # As change_group, but operates on uids. If changing user permanently,
  # supplementary groups will be set the to default groups for the new uid.
  def change_user(user, permanently = false)
    uid = convert_xid(:uid, user)
    raise Puppet::Error, _("No such user %{user}") % { user: user } unless uid

    return if Process.euid == uid

    if permanently
      # If changing uid, we must be root. So initgroups first here.
      initgroups(uid)

      Process::UID.change_privilege(uid)
    elsif Process.euid == 0
      # We must be root to initgroups, so initgroups before dropping euid if
      # we're root, otherwise elevate euid before initgroups.
      # change euid (to root) first.
      initgroups(uid)
      Process.euid = uid
    else
      Process.euid = uid
      initgroups(uid)
    end

View on GitHub (pinned to e227c27540)

Solutions

1. Verify the account exists on the node: run `getent passwd <user>`. If nothing returns, create the user before the code that switches to it.
2. Fix the spelling of the user name in the manifest or calling code.
3. If the account lives in LDAP/AD, confirm sssd/nsswitch is running and reachable on the agent.
4. Pass a numeric UID instead of a name when resolution through NSS is unreliable.

Example fix

# before
Puppet::Util::SUIDManager.change_user('deplooy') # typo, raises No such user

# after
uid = Puppet::Util.uid('deploy')
raise ArgumentError, "user 'deploy' missing" if uid.nil?
Puppet::Util::SUIDManager.change_user('deploy')

uid = Puppet::Util.uid(username) # Etc.getpwnam lookup
raise ArgumentError, "cannot switch to unknown user '#{username}'" if uid.nil?
Puppet::Util::SUIDManager.change_user(username, permanently)

begin
  Puppet::Util::SUIDManager.change_user(user, permanently)
rescue Puppet::Error => e
  raise "privilege change to #{user.inspect} failed (does the account exist?): #{e.message}"
end

When it happens

Trigger: Calling Puppet::Util::SUIDManager.change_user('deploy') directly, or an exec resource with a user attribute, when 'deploy' has no /etc/passwd or NSS entry (typo, account not yet created, LDAP/SSSD unreachable) so Puppet::Util.uid returns nil.

Common situations: Manifests referencing a service account that another module creates later in the same run; agents with flaky LDAP/SSSD name resolution; typos in the user attribute of exec resources.

Related errors

• Invalid %{klass}: %{id}
• No such group %{group}
• Cannot symlink on this platform version
• Could not retrieve user %{user}: %{detail}
• Calling `#{method_name}` returned 'Win32 Error Code 0x%08X'.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/8e2737fd70000e7b. Report an issue: GitHub.