puppetlabs/puppet · error · ArgumentError

Password warning days must be provided as a number.

Error message

Password warning days must be provided as a number.

What it means

Raised by the validate block of the `password_warn_days` property on the Puppet `user` type (shadow password aging: days before expiry during which the user is warned). The property requires value.to_s to match /^-?\d+$/, so any value whose string form is not a plain, optionally signed integer is rejected with this ArgumentError. A String that does pass (e.g. "7") is additionally converted with Integer(value) by the munge block. The property also requires the provider feature :manages_password_age (useradd with ruby-shadow, Solaris user_role_add, AIX).

Source

Thrown at lib/puppet/type/user.rb:335

        end
      end
    end

    newproperty(:password_warn_days, :required_features => :manages_password_age) do
      desc "The number of days before a password is going to expire (see the maximum password age) during which the user should be warned."

      munge do |value|
        case value
        when String
          Integer(value)
        else
          value
        end
      end

      validate do |value|
        if value.to_s !~ /^-?\d+$/
          raise ArgumentError, "Password warning days must be provided as a number."
        end
      end
    end

    newproperty(:groups, :parent => Puppet::Property::List) do
      desc "The groups to which the user belongs.  The primary group should
        not be listed, and groups should be identified by name rather than by
        GID.  Multiple groups should be specified as an array."

      validate do |value|
        if value =~ /^\d+$/
          raise ArgumentError, _("Group names must be provided, not GID numbers.")
        end
        raise ArgumentError, _("Group names must be provided as an array, not a comma-separated list.") if value.include?(",")
        raise ArgumentError, _("Group names must not be empty. If you want to specify \"no groups\" pass an empty array") if value.empty?
      end

      def change_to_s(currentvalue, newvalue)

View on GitHub (pinned to e227c27540)

Solutions

1. Pass a plain integer: `password_warn_days => 7` (or a numeric string like '7')
2. Fix the Hiera/YAML data to store an integer without units or quotes
3. Type the class parameter as Optional[Integer] so Puppet 4 data types reject bad values before the resource compiles
4. If you need the property, ensure a provider with manages_password_age is used (ruby-shadow installed for useradd)

Example fix

# before
user { 'bob':
  ensure               => present,
  password_warn_days  => '7 days',
}

# after
user { 'bob':
  ensure               => present,
  password_warn_days  => 7,
}

# Puppet DSL: catch it at data-typing time in the profile
class profile::users (
  Optional[Integer] $password_warn_days = undef,
) {
  user { 'bob': password_warn_days => $password_warn_days }
}

# Ruby API: pre-check before creating the resource
raw = params[:password_warn_days]
raise ArgumentError, 'password_warn_days must be an integer' unless raw.nil? || raw.to_s.match?(/\A-?\d+\z/)

begin
  Puppet::Type.type(:user).new(name: 'bob', password_warn_days: raw)
rescue ArgumentError => e
  # e.message == "Password warning days must be provided as a number."
  raise Puppet::Error, "bad password_warn_days data: #{e.message}"
end

When it happens

Trigger: Declaring `user { 'bob': password_warn_days => 'soon' }`, `=> 7.5`, `=> '7 days'`, or an empty string; supplying the value from Hiera as a float-string or a string with units/whitespace; setting it on a platform whose selected provider lacks :manages_password_age also fails property setup.

Common situations: Hiera YAML storing "7 days" or "7.0" instead of 7; profile classes interpolating text into the value; copy-pasting output of `chage -l`; unit suffixes added by well-meaning data owners.

Related errors

• Group names must be provided, not GID numbers.
• Role names must be provided, not numbers
• Auth names must be provided, not numbers
• Profile names must be provided, not numbers
• Each entry for purge_ssh_keys must be a string, not a %{klas

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/916bbf23c0295a14. Report an issue: GitHub.