Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i am using the puppet user module, its able to create the users and add them to the correct group, however i have moved one user to another group and puppet moved the user to that group on the remote server, but did not remove the user from the previous group?

define account ($ensure = present, $password = '!!', $groups = [], $shell = '/bin/bash', $dotfile = false, $key = false) {
    $username = $name
    # Default user settings
    user { "$username":
        ensure     => $ensure,
        gid        => $username,
        password   => $password,
        groups     => $groups,
        comment    => ",,,",
        home       => "/home/$username",
        shell      => $shell,
        allowdupe  => false,
        managehome => true,
    }

    # Default group settings
    group { "$username":
        ensure    => $ensure,
        allowdupe => false,
    }

    # Ordering of dependencies, just in case
    case $ensure {
        present: {
                User <| title == "$username" |> {
                           require =>  Group["$username"]
                }
        }
        absent: { Group <| title == "$username" |> { require => User["$username"] } }
    }

    file { "/home/${username}":
        ensure  => $ensure ? {
                present => directory,
                absent  => absent,
                },
        owner   => $username,
        group   => $username,
        mode    => 644,
        require   => User["${username}"],
   }

   file { "/home/${username}/.ssh":
        ensure  => directory,
        owner   => $username,
        group   => $username,
        mode    => 700,
        require => File["/home/${username}"],
   }

   if ($key != false) {
     ssh_authorized_key { "${name}_key":
       key => $key,
       type => "ssh-rsa",
       user => $name,
     }
   }
}
share|improve this question

1 Answer 1

This is by-design to prevent removing users from system groups.

You can work around that by using the membership => inclusive attribute.

More info: http://projects.puppetlabs.com/issues/7241

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.