Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i am using the puppet user module, its able to create the users and add them to the correct group, however i have moved one user to another group and puppet moved the user to that group on the remote server, but did not remove the user from the previous group?

define account ($ensure = present, $password = '!!', $groups = [], $shell = '/bin/bash', $dotfile = false, $key = false) {
    $username = $name
    # Default user settings
    user { "$username":
        ensure     => $ensure,
        gid        => $username,
        password   => $password,
        groups     => $groups,
        comment    => ",,,",
        home       => "/home/$username",
        shell      => $shell,
        allowdupe  => false,
        managehome => true,
    }

    # Default group settings
    group { "$username":
        ensure    => $ensure,
        allowdupe => false,
    }

    # Ordering of dependencies, just in case
    case $ensure {
        present: {
                User <| title == "$username" |> {
                           require =>  Group["$username"]
                }
        }
        absent: { Group <| title == "$username" |> { require => User["$username"] } }
    }

    file { "/home/${username}":
        ensure  => $ensure ? {
                present => directory,
                absent  => absent,
                },
        owner   => $username,
        group   => $username,
        mode    => 644,
        require   => User["${username}"],
   }

   file { "/home/${username}/.ssh":
        ensure  => directory,
        owner   => $username,
        group   => $username,
        mode    => 700,
        require => File["/home/${username}"],
   }

   if ($key != false) {
     ssh_authorized_key { "${name}_key":
       key => $key,
       type => "ssh-rsa",
       user => $name,
     }
   }
}
share|improve this question
add comment

1 Answer

This is by-design to prevent removing users from system groups.

You can work around that by using the membership => inclusive attribute.

More info: http://projects.puppetlabs.com/issues/7241

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.