puppetlabs / puppetlabs-firewall

Puppet Firewall Module
http://forge.puppetlabs.com/puppetlabs/firewall
Apache License 2.0
275 stars 458 forks source link

gid match fails if no user by the same name exists. #1229

Open cFire opened 4 months ago

cFire commented 4 months ago

Describe the Bug

Recently updated from 6.0.0 to 8.0.1. Now when using the gid match it looks for a user by the same name as the group. If no such user exists it fails with the error "can't find user for group name".

Expected Behavior

Should do a gid lookup for the group name and not need or care if a user by the same name exists.

Steps to Reproduce

Steps to reproduce the behavior:

  1. Create a new group (called power-users in below example)
  2. Make sure no user called "power-users" exists
  3. Run example code below

Environment

Additional Context

Example puppet code:

firewall {
  default:
    chain => 'OUTPUT',
    jump  => 'accept',
    proto => 'tcp',
    dport => 123;
  '013 Accept for power-users':
    gid => 'power-users';
  # Removed other rules for brevity
}

Error:

Info: Unknown failure using insync_values? on type: Firewall[013 Accept for power-users] / property: gid to compare values ["power-users"] and 1420                                                               
Error: /Stage[main]/Profile::Lydia::Outbound_mail_firewall/Firewall[013 Accept for power-users]/gid: change from '1420' to 'power-users' failed: can't find user for power-users                                  
Error: can't find user for power-users