ramsey/uuid · error · DceSecurityException

Unable to get a group identifier using the system DCE Securi

Error message

Unable to get a group identifier using the system DCE Security provider; please provide a custom identifier or use a different provider

What it means

The GID counterpart of getUid(): SystemDceSecurityProvider::getGid() backs Uuid::uuid2() with DCE_DOMAIN_GROUP. getSystemGid() runs shell_exec('id -g') (or parses Windows net user output for group SIDs); when it returns an empty string, getGid() throws DceSecurityException because no group identifier could be determined for the DCE security domain.

Source

Thrown at src/Provider/Dce/SystemDceSecurityProvider.php:86

     * @throws DceSecurityException if unable to get a group identifier
     *
     * @inheritDoc
     */
    public function getGid(): IntegerObject
    {
        /** @var IntegerObject | int | float | string | null $gid */
        static $gid = null;

        if ($gid instanceof IntegerObject) {
            return $gid;
        }

        if ($gid === null) {
            $gid = $this->getSystemGid();
        }

        if ($gid === '') {
            throw new DceSecurityException(
                'Unable to get a group identifier using the system DCE Security provider; please provide a custom '
                . 'identifier or use a different provider',
            );
        }

        $gid = new IntegerObject($gid);

        return $gid;
    }

    /**
     * Returns the UID from the system
     */
    private function getSystemUid(): string
    {
        if (!$this->hasShellExec()) {
            return '';
        }

View on GitHub (pinned to da5b521600)

Solutions

1. Pass the GID explicitly: Uuid::uuid2(Uuid::DCE_DOMAIN_GROUP, posix_getgid()) or a known group number
2. Inject a custom DceSecurityProviderInterface into a UuidFactory for your environment
3. Verify shell_exec is not disabled and the id utility exists, or avoid uuid2 for group identifiers

Example fix

// before
$uuid = \Ramsey\Uuid\Uuid::uuid2(\Ramsey\Uuid\Uuid::DCE_DOMAIN_GROUP);

// after
$gid = function_exists('posix_getgid') ? posix_getgid() : 0;
$uuid = \Ramsey\Uuid\Uuid::uuid2(\Ramsey\Uuid\Uuid::DCE_DOMAIN_GROUP, $gid);

if (function_exists('posix_getgid')) {
    $uuid = \Ramsey\Uuid\Uuid::uuid2(\Ramsey\Uuid\Uuid::DCE_DOMAIN_GROUP, posix_getgid());
} else {
    $uuid = \Ramsey\Uuid\Uuid::uuid2(\Ramsey\Uuid\Uuid::DCE_DOMAIN_GROUP, 0);
}

function canResolveSystemGid(): bool
{
    return function_exists('shell_exec')
        && !str_contains(strtolower((string) ini_get('disable_functions')), 'shell_exec');
}

try {
    $uuid = \Ramsey\Uuid\Uuid::uuid2(\Ramsey\Uuid\Uuid::DCE_DOMAIN_GROUP);
} catch (\Ramsey\Uuid\Exception\DceSecurityException $e) {
    $gid = function_exists('posix_getgid') ? posix_getgid() : 0;
    $uuid = \Ramsey\Uuid\Uuid::uuid2(\Ramsey\Uuid\Uuid::DCE_DOMAIN_GROUP, $gid);
}

When it happens

Trigger: Calling Uuid::uuid2(Uuid::DCE_DOMAIN_GROUP) without an explicit identifier on systems where shell_exec is disabled via disable_functions, 'id -g' is absent from the container image, or Windows group output parsing fails. The empty result is cached in a static, so all later calls in the process throw too.

Common situations: Locked-down shared hosting; distroless/minimal Docker images; Windows deployments; generating group-scoped v2 UUIDs in long-lived workers where the first failed lookup is cached.

Related errors

• Unable to get a user identifier using the system DCE Securit
• Local domain must be a valid DCE Security domain
• Local identifier out of bounds; it must be a value between 0
• Clock sequence out of bounds; it must be a value between 0 a
• A local identifier must be provided for the org domain

AI-assisted analysis of ramsey/uuid@da5b521600 (2026-08-21). Data as JSON: /api/errors/46658988553f5346. Report an issue: GitHub.