Puppet

Below are the classes and definitions used to reproduce this problem. And, according to the TypeReference, arrays are only needed when specifying multiple groups.

Class which realizes the user

class dev_userconf {

   realize( Group["alpha"], Group["tango"], Group["charlie"], Group["bravo"] )
   realize( User_account["foo"] )

}

Class which passes some user attributes to the user_accts virtual define. Start out with this, then after the client runs once, change the ‘groups’ to: [“charlie”, “bravo”], or even just [“bravo”] – any array will throw an exception.

class user_accts {

   @user_account { "foo":
      comment => "Foo Bar",
      type    => "dev",
      groups  => "bravo"; 
   }
}

The virtual definition

define user_account ( ensure = present, type, comment, shell = false, groups = false ) {
# Define the appropriate shell and supplementary groups
  case $type {
     dev: {
        $supp_groups = $groups ? {
           false   => ["alpha", "tango"],
           default => ["alpha", "tango", $groups]
        }
        $user_shell = $shell ? {
           false   => "/bin/bash",
           default => $shell
        }
     }
     nondev: {
        $supp_groups = $groups ? {
           false   => "charlie",
           default => ["charlie", $groups]
        }
        $user_shell = "/sbin/nologin"
     }
  }
  user { $name:
     ensure  => $ensure,
     groups  => $supp_groups,
     comment => $comment,
     shell   => $user_shell,
  }

}

Also worth noting is even if you start out with an array for the ‘groups’ attribute, if you ever switch to using a single string, you can never switch back.

After re-reading my configuration, I see the problem: I’ve got a define that accepts an argument “groups”, which defaults to false. I use a selector to check what the value of $groups is. But, sometimes the value passed in to $groups is an array (for example, [“alpha”, “tango”]). Thus, when the selector tries to compare ‘false’ to [‘foo’, ‘bar’], it freaks out because it’s making a string to array comparison. I would have thought it would just fall back to the default when it couldn’t produce a match for ‘false’, but apparently not.