puppetlabs/puppet · error · ArgumentError

Role names must be provided as an array, not a comma-separat

Error message

Role names must be provided as an array, not a comma-separated list

What it means

Raised by the validate block of the `roles` property on the `user` type when a member string contains a comma. Like `groups`, the property expects an array of role names (Puppet::Property::List); a single comma-joined string is rejected instead of being silently split or misread as one role name.

Source

Thrown at lib/puppet/type/user.rb:529

    # @return [Boolean] if the user exists on the system
    # @api private
    def exists?
      provider.exists?
    end

    newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_roles) do
      desc "The roles the user has.  Multiple roles should be
        specified as an array."

      def membership
        :role_membership
      end

      validate do |value|
        if value =~ /^\d+$/
          raise ArgumentError, _("Role names must be provided, not numbers")
        end
        raise ArgumentError, _("Role names must be provided as an array, not a comma-separated list") if value.include?(",")
      end
    end

    # autorequire the roles that the user has
    autorequire(:user) do
      reqs = []

      roles_property = @parameters[:roles]
      roles = roles_property.should if roles_property
      if roles
        reqs += roles.split(',')
      end

      reqs
    end unless Puppet::Util::Platform.windows?

    newparam(:role_membership) do
      desc "Whether specified roles should be considered the **complete list**

View on GitHub (pinned to e227c27540)

Solutions

1. Pass an array: `roles => ['sysadmin', 'webadmin']`
2. Store a YAML list in Hiera instead of a joined string
3. Split incoming strings in the profile: `roles => $raw.split(',')`

Example fix

# before
user { 'alice':
  ensure => present,
  roles  => 'sysadmin,webadmin',
}

# after
user { 'alice':
  ensure => present,
  roles  => ['sysadmin', 'webadmin'],
}

# Accept scalar or array, normalize to array of names
roles = raw.is_a?(String) ? raw.split(',').map(&:strip).reject(&:empty?) : Array(raw)

When it happens

Trigger: `user { 'alice': roles => 'sysadmin,webadmin' }` on a provider with manages_roles; a Hiera string built by joining an array; ENC output that only carries string parameters.

Common situations: Porting `usermod -R sysadm,audit` style commands; Ruby interpolation of arrays into role parameters; older YAML data authored as comma lists.

Related errors

• Role names must be provided, not numbers
• Auth names must be provided as an array, not a comma-separat
• Profile names must be provided as an array, not a comma-sepa
• Group names must be provided as an array, not a comma-separa
• Auth names must be provided, not numbers

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/9b1c367ee82ad72d. Report an issue: GitHub.