NOTE: This page was generated from the Puppet source code on 2024-08-28 16:45:59 -0700
Manage groups. On most platforms this can only create groups. Group membership must be managed on individual users.
On some platforms such as OS X, group membership is managed as an attribute of the group, not the user record. Providers must have the feature ‘manages_members’ to manage the ‘members’ property of a group record.
group { 'resource title':
name => # (namevar) The group name. While naming limitations vary by
ensure => # Create or remove the group. Default: `present`
allowdupe => # Whether to allow duplicate GIDs. Default...
attribute_membership => # AIX only. Configures the behavior of the...
attributes => # Specify group AIX attributes, as an array of...
auth_membership => # Configures the behavior of the `members...
forcelocal => # Forces the management of local accounts when...
gid => # The group ID. Must be specified numerically....
ia_load_module => # The name of the I&A module to use to manage this
members => # The members of the group. For platforms or...
provider => # The specific backend to use for this `group...
system => # Whether the group is a system group with lower...
# ...plus any applicable metaparameters.
}
(Namevar: If omitted, this attribute’s value defaults to the resource’s title.)
The group name. While naming limitations vary by operating system, it is advisable to restrict names to the lowest common denominator, which is a maximum of 8 characters beginning with a letter.
Note that Puppet considers group names to be case-sensitive, regardless of the platform’s own rules; be sure to always use the same case when referring to a given group.
(Property: This attribute represents concrete state on the target system.)
Create or remove the group.
Default: present
Allowed values:
present
absent
Whether to allow duplicate GIDs.
Default: false
Allowed values:
true
false
yes
no
AIX only. Configures the behavior of the attributes
parameter.
minimum
(default) — The provided list of attributes is
partial, and Puppet ignores any attributes that aren’t
listed there.inclusive
— The provided list of attributes is
comprehensive, and Puppet purges any attributes that
aren’t listed there.Default: minimum
Allowed values:
inclusive
minimum
(Property: This attribute represents concrete state on the target system.)
Specify group AIX attributes, as an array of 'key=value'
strings. This parameter’s behavior can be configured with
attribute_membership
.
Requires features manages_aix_lam.
Configures the behavior of the members
parameter.
false
(default) — The provided list of group members is
partial, and Puppet ignores any members that aren’t
listed there.true
— The provided list of of group members is
comprehensive, and Puppet purges any members that
aren’t listed there.Default: false
Allowed values:
true
false
yes
no
Forces the management of local accounts when accounts are also being
managed by some other Name Switch Service (NSS). For AIX, refer to the
ia_load_module
parameter.
This option relies on your operating system’s implementation of
luser*
commands, such as luseradd
,
lgroupadd
, and lusermod
. The
forcelocal
option could behave unpredictably in some
circumstances. If the tools it depends on are not available, it might
have no effect at all.
Default: false
Allowed values:
true
false
yes
no
Requires features manages_local_users_and_groups.
(Property: This attribute represents concrete state on the target system.)
The group ID. Must be specified numerically. If no group ID is specified when creating a new group, then one will be chosen automatically according to local system standards. This will likely result in the same group having different GIDs on different systems, which is not recommended.
On Windows, this property is read-only and will return the group’s security identifier (SID).
The name of the I&A module to use to manage this group. This
should be set to files
if managing local groups.
Requires features manages_aix_lam.
(Property: This attribute represents concrete state on the target system.)
The members of the group. For platforms or directory services where
group membership is stored in the group objects, not the users. This
parameter’s behavior can be configured with
auth_membership
.
Requires features manages_members.
The specific backend to use for this group
resource. You
will seldom need to specify this — Puppet will usually discover the
appropriate provider for your platform.
Available providers are:
Whether the group is a system group with lower GID.
Default: false
Allowed values:
true
false
yes
no
Group management for AIX.
/usr/bin/chgroup
,
/usr/bin/mkgroup
, /usr/sbin/lsgroup
,
/usr/sbin/rmgroup
os.name == aix
["os.name", "aix"] ==
manages_aix_lam
,
manages_local_users_and_groups
,
manages_members
Group management using DirectoryService on OS X.
/usr/bin/dscl
os.name == darwin
["os.name", "darwin"] ==
manages_members
Group management via groupadd
and its ilk. The default
for most platforms.
To use the forcelocal
parameter, you need to install the
libuser
package (providing /usr/sbin/lgroupadd
and /usr/sbin/luseradd
).
groupadd
, groupdel
,
groupmod
Group management via LDAP.
This provider requires that you have valid values for all of the
LDAP-related settings in puppet.conf
, including
ldapbase
. You will almost definitely need settings for
ldapuser
and ldappassword
in order for your
clients to write to LDAP.
Note that this provider will automatically generate a GID for you if you do not specify one, but it is a potentially expensive operation, as it iterates across all existing groups to pick the appropriate next one.
feature == ldap
,
false == (Puppet[:ldapuser] == "")
Group management via pw
on FreeBSD and DragonFly
BSD.
pw
os.name == [:freebsd, :dragonfly]
["os.name", "[:freebsd, :dragonfly]"] ==
manages_members
Local group management for Windows. Group members can be both users and groups. Additionally, local groups can contain domain users.
os.name == windows
["os.name", "windows"] ==
manages_members
Available features:
manages_aix_lam
— The provider can manage AIX Loadable
Authentication Module (LAM) system.manages_local_users_and_groups
— Allows local groups to
be managed on systems that also use some other remote Name Switch
Service (NSS) method of managing accounts.manages_members
— For directories where membership is
an attribute of groups not users.system_groups
— The provider allows you to create
system groups with lower GIDs.Provider support: