puppet 3.6.2-x86-mingw32 → 3.7.0-x86-mingw32

data/spec/integration/ssl/certificate_authority_spec.rb

@@ -99,6 +99,32 @@ describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft
     end
   end
 
+  describe "when revoking certificate" do
+    it "should work for one certificate" do
+      certificate_request_for("luke.madstop.com")
+
+      ca.sign("luke.madstop.com")
+      ca.revoke("luke.madstop.com")
+
+      expect { ca.verify("luke.madstop.com") }.to raise_error(
+        Puppet::SSL::CertificateAuthority::CertificateVerificationError,
+        "certificate revoked"
+      )
+    end
+
+    it "should work for several certificates" do
+      3.times.each do |c|
+        certificate_request_for("luke.madstop.com")
+        ca.sign("luke.madstop.com")
+        ca.destroy("luke.madstop.com")
+      end
+      ca.revoke("luke.madstop.com")
+
+      ca.crl.content.revoked.map { |r| r.serial }.should == [2,3,4] # ca has serial 1
+    end
+
+  end
+
   it "allows autosigning certificates concurrently", :unless => Puppet::Util::Platform.windows? do
     Puppet[:autosign] = true
     hosts = (0..4).collect { |i| certificate_request_for("host#{i}") }

data/spec/integration/ssl/certificate_request_spec.rb

@@ -10,8 +10,6 @@ describe Puppet::SSL::CertificateRequest do
     # Get a safe temporary file
     dir = tmpdir("csr_integration_testing")
 
-    Puppet.settings.clear
-
     Puppet.settings[:confdir] = dir
     Puppet.settings[:vardir] = dir
     Puppet.settings[:group] = Process.gid
@@ -26,10 +24,6 @@ describe Puppet::SSL::CertificateRequest do
     Puppet::SSL::CertificateRequest.indirection.termini.clear
   end
 
-  after do
-    Puppet.settings.clear
-  end
-
   it "should be able to generate CSRs" do
     @csr.generate(@key)
   end

data/spec/integration/ssl/certificate_revocation_list_spec.rb

@@ -20,8 +20,6 @@ describe Puppet::SSL::CertificateRevocationList do
   after {
     Puppet::SSL::Host.ca_location = :none
 
-    Puppet.settings.clear
-
     # This is necessary so the terminus instances don't lie around.
     Puppet::SSL::Host.indirection.termini.clear
   }

data/spec/integration/ssl/host_spec.rb

@@ -22,8 +22,6 @@ describe Puppet::SSL::Host do
 
   after {
     Puppet::SSL::Host.ca_location = :none
-
-    Puppet.settings.clear
   }
 
   it "should be considered a CA host if its name is equal to 'ca'" do

data/spec/integration/transaction_spec.rb

@@ -193,6 +193,22 @@ describe Puppet::Transaction do
     Puppet::FileSystem.exist?(file2).should be_true
   end
 
+  it "should apply no resources whatsoever if a pre_run_check fails" do
+    path = tmpfile("path")
+    file = Puppet::Type.type(:file).new(
+      :path => path,
+      :ensure => "file"
+    )
+    notify = Puppet::Type.type(:notify).new(
+      :title => "foo"
+    )
+    notify.expects(:pre_run_check).raises(Puppet::Error, "fail for testing")
+
+    catalog = mk_catalog(file, notify)
+    catalog.apply
+    Puppet::FileSystem.exist?(path).should_not be_true
+  end
+
   it "should not let one failed refresh result in other refreshes failing" do
     path = tmpfile("path")
     newfile = tmpfile("file")

data/spec/integration/type/file_spec.rb

@@ -78,7 +78,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
   it "should not attempt to manage files that do not exist if no means of creating the file is specified" do
     source = tmpfile('source')
 
-    catalog.add_resource described_class.new :path => source, :mode => 0755
+    catalog.add_resource described_class.new :path => source, :mode => '0755'
 
     status = catalog.apply.report.resource_statuses["File[#{source}]"]
     status.should_not be_failed
@@ -155,7 +155,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
         it "should set executable bits for existing readable directories" do
           set_mode(0600, target)
 
-          catalog.add_resource described_class.new(:path => target, :ensure => :directory, :mode => 0644)
+          catalog.add_resource described_class.new(:path => target, :ensure => :directory, :mode => '0644')
           catalog.apply
 
           (get_mode(target) & 07777).should == 0755
@@ -992,13 +992,13 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
 
     describe "on Windows systems", :if => Puppet.features.microsoft_windows? do
       def expects_sid_granted_full_access_explicitly(path, sid)
-        inherited_ace = Windows::Security::INHERITED_ACE
+        inherited_ace = Puppet::Util::Windows::AccessControlEntry::INHERITED_ACE
 
         aces = get_aces_for_path_by_sid(path, sid)
         aces.should_not be_empty
 
         aces.each do |ace|
-          ace.mask.should == Windows::File::FILE_ALL_ACCESS
+          ace.mask.should == Puppet::Util::Windows::File::FILE_ALL_ACCESS
           (ace.flags & inherited_ace).should_not == inherited_ace
         end
       end
@@ -1008,13 +1008,13 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
       end
 
       def expects_at_least_one_inherited_ace_grants_full_access(path, sid)
-        inherited_ace = Windows::Security::INHERITED_ACE
+        inherited_ace = Puppet::Util::Windows::AccessControlEntry::INHERITED_ACE
 
         aces = get_aces_for_path_by_sid(path, sid)
         aces.should_not be_empty
 
         aces.any? do |ace|
-          ace.mask == Windows::File::FILE_ALL_ACCESS &&
+          ace.mask == Puppet::Util::Windows::File::FILE_ALL_ACCESS &&
             (ace.flags & inherited_ace) == inherited_ace
         end.should be_true
       end
@@ -1045,10 +1045,10 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
       describe "when processing SYSTEM ACEs" do
         before do
           @sids = {
-            :current_user => Puppet::Util::Windows::Security.name_to_sid(Sys::Admin.get_login),
+            :current_user => Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name),
             :system => Win32::Security::SID::LocalSystem,
-            :admin => Puppet::Util::Windows::Security.name_to_sid("Administrator"),
-            :guest => Puppet::Util::Windows::Security.name_to_sid("Guest"),
+            :admin => Puppet::Util::Windows::SID.name_to_sid("Administrator"),
+            :guest => Puppet::Util::Windows::SID.name_to_sid("Guest"),
             :users => Win32::Security::SID::BuiltinUsers,
             :power_users => Win32::Security::SID::PowerUsers,
             :none => Win32::Security::SID::Nobody
@@ -1132,7 +1132,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
               system_aces.should_not be_empty
 
               system_aces.each do |ace|
-                ace.mask.should == Windows::File::FILE_GENERIC_READ
+                ace.mask.should == Puppet::Util::Windows::File::FILE_GENERIC_READ
               end
             end
 
@@ -1173,8 +1173,9 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
             sd = Puppet::Util::Windows::Security.get_security_descriptor(path)
             sd.dacl.allow(
               'S-1-1-0', #everyone
-              Windows::File::FILE_ALL_ACCESS,
-              Windows::File::OBJECT_INHERIT_ACE | Windows::File::CONTAINER_INHERIT_ACE)
+              Puppet::Util::Windows::File::FILE_ALL_ACCESS,
+              Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE |
+              Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE)
             Puppet::Util::Windows::Security.set_security_descriptor(path, sd)
           end
 
@@ -1252,7 +1253,7 @@ describe Puppet::Type.type(:file), :uses_checksums => true do
 
                 system_aces.each do |ace|
                   # unlike files, Puppet sets execute bit on directories that are readable
-                  ace.mask.should == Windows::File::FILE_GENERIC_READ | Windows::File::FILE_GENERIC_EXECUTE
+                  ace.mask.should == Puppet::Util::Windows::File::FILE_GENERIC_READ | Puppet::Util::Windows::File::FILE_GENERIC_EXECUTE
                 end
               end
 

data/spec/integration/type/nagios_spec.rb

@@ -6,9 +6,11 @@ require 'puppet/file_bucket/dipper'
 describe "Nagios file creation" do
   include PuppetSpec::Files
 
+  let(:initial_mode) { 0600 }
+
   before :each do
     FileUtils.touch(target_file)
-    File.chmod(0600, target_file)
+    Puppet::FileSystem.chmod(initial_mode, target_file)
     Puppet::FileBucket::Dipper.any_instance.stubs(:backup) # Don't backup to filebucket
   end
 
@@ -33,13 +35,6 @@ describe "Nagios file creation" do
     catalog.apply
   end
 
-  # These three helpers are from file_spec.rb
-  #
-  # @todo Define those centrally as well?
-  def get_mode(file)
-    Puppet::FileSystem.stat(file).mode
-  end
-
   context "when creating a nagios config file" do
     context "which is not managed" do
       it "should choose the file mode if requested" do
@@ -51,14 +46,12 @@ describe "Nagios file creation" do
           :mode   => '0640'
         )
         run_in_catalog(resource)
-        # sticky bit only applies to directories in Windows
-        mode = Puppet.features.microsoft_windows? ? "640" : "100640"
-        ( "%o" % get_mode(target_file) ).should == mode
+        expect_file_mode(target_file, "640")
       end
     end
 
     context "which is managed" do
-      it "should not the mode" do
+      it "should not override the mode" do
         file_res = Puppet::Type.type(:file).new(
           :name   => target_file,
           :ensure => :present
@@ -71,10 +64,8 @@ describe "Nagios file creation" do
           :mode   => '0640'
         )
         run_in_catalog(file_res, nag_res)
-        ( "%o" % get_mode(target_file) ).should_not == "100640"
+        expect_file_mode(target_file, initial_mode.to_s(8))
       end
     end
-
   end
-
 end

data/spec/integration/type/sshkey_spec.rb

@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet_spec/files'
+require 'puppet_spec/compiler'
+
+describe Puppet::Type.type(:sshkey), '(integration)', :unless => Puppet.features.microsoft_windows? do
+  include PuppetSpec::Files
+  include PuppetSpec::Compiler
+
+  let(:target) { tmpfile('ssh_known_hosts') }
+  let(:manifest) { "sshkey { 'test':
+    ensure => 'present',
+    type => 'rsa',
+    key => 'TESTKEY',
+    target => '#{target}' }"
+  }
+
+  it "should create a new known_hosts file with mode 0644" do
+    apply_compiled_manifest(manifest)
+    expect_file_mode(target, "644")
+  end
+end

data/spec/integration/type/tidy_spec.rb

@@ -23,6 +23,9 @@ describe Puppet::Type.type(:tidy) do
 
     catalog = Puppet::Resource::Catalog.new
     catalog.add_resource(tidy)
+    # avoid crude failures because of nil resources that result
+    # from implicit containment and lacking containers
+    catalog.stubs(:container_of).returns tidy
 
     catalog.apply
 

data/spec/integration/type/user_spec.rb

@@ -8,22 +8,27 @@ describe Puppet::Type.type(:user), '(integration)', :unless => Puppet.features.m
   include PuppetSpec::Compiler
 
   context "when set to purge ssh keys from a file" do
-    let(:tempfile) { file_containing('user_spec', "# comment\nssh-rsa KEY-DATA key-name") }
+    let(:tempfile) { file_containing('user_spec', "# comment\nssh-rsa KEY-DATA key-name\nssh-rsa KEY-DATA key name\n") }
     # must use an existing user, or the generated key resource
     # will fail on account of an invalid user for the key
     # - root should be a safe default
     let(:manifest) { "user { 'root': purge_ssh_keys => '#{tempfile}' }" }
 
     it "should purge authorized ssh keys" do
-      apply_compiled_manifest(manifest, Puppet::Graph::RandomPrioritizer.new)
+      apply_compiled_manifest(manifest)
       File.read(tempfile).should_not =~ /key-name/
     end
 
+    it "should purge keys with spaces in the comment string" do
+      apply_compiled_manifest(manifest)
+      File.read(tempfile).should_not =~ /key name/
+    end
+
     context "with other prefetching resources evaluated first" do
       let(:manifest) { "host { 'test': before => User[root] } user { 'root': purge_ssh_keys => '#{tempfile}' }" }
 
       it "should purge authorized ssh keys" do
-        apply_compiled_manifest(manifest, Puppet::Graph::RandomPrioritizer.new)
+        apply_compiled_manifest(manifest)
         File.read(tempfile).should_not =~ /key-name/
       end
     end

data/spec/integration/util/autoload_spec.rb

@@ -95,12 +95,12 @@ describe Puppet::Util::Autoload do
 
     file = File.join(libdir, "plugin.rb")
 
-    Puppet[:modulepath] = modulepath
-
-    with_loader("foo", "foo") do |dir, loader|
-      with_file(:plugin, file.split("/")) do
-        loader.load(:plugin)
-        loader.class.should be_loaded("foo/plugin.rb")
+    Puppet.override(:environments => Puppet::Environments::Static.new(Puppet::Node::Environment.create(:production, [modulepath]))) do
+      with_loader("foo", "foo") do |dir, loader|
+        with_file(:plugin, file.split("/")) do
+          loader.load(:plugin)
+          loader.class.should be_loaded("foo/plugin.rb")
+        end
       end
     end
   end

data/spec/integration/util/rdoc/parser_spec.rb

@@ -127,6 +127,13 @@ end
     end.should_not(be_empty, "Could not match #{content_patterns} in any of the files found in #{glob}")
   end
 
+  around(:each) do |example|
+    env = Puppet::Node::Environment.create(:doc_test_env, [modules_dir], manifests_dir)
+    Puppet.override({:environments => Puppet::Environments::Static.new(env), :current_environment => env}) do
+      example.run
+    end
+  end
+
   before :each do
     prepare_manifests_and_modules
     Puppet.settings[:document_all] = document_all

data/spec/integration/util/windows/process_spec.rb

@@ -18,5 +18,17 @@ describe "Puppet::Util::Windows::Process", :if => Puppet.features.microsoft_wind
       Puppet::Util::Windows::User.should be_admin
       Puppet::Util::Windows::Process.process_privilege_symlink?.should be_false
     end
+
+    it "should be able to lookup a standard Windows process privilege" do
+      Puppet::Util::Windows::Process.lookup_privilege_value('SeShutdownPrivilege') do |luid|
+        luid.should_not be_nil
+        luid.should be_instance_of(Puppet::Util::Windows::Process::LUID)
+      end
+    end
+
+    it "should raise an error for an unknown privilege name" do
+      fail_msg = /LookupPrivilegeValue\(, foo, .*\):  A specified privilege does not exist/
+      expect { Puppet::Util::Windows::Process.lookup_privilege_value('foo') }.to raise_error(Puppet::Util::Windows::Error, fail_msg)
+    end
   end
 end

data/spec/integration/util/windows/security_spec.rb

@@ -1,8 +1,6 @@
 #!/usr/bin/env ruby
 require 'spec_helper'
 
-require 'puppet/util/adsi'
-
 if Puppet.features.microsoft_windows?
   class WindowsSecurityTester
     require 'puppet/util/windows/security'
@@ -15,11 +13,11 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
   before :all do
     @sids = {
-      :current_user => Puppet::Util::Windows::Security.name_to_sid(Sys::Admin.get_login),
+      :current_user => Puppet::Util::Windows::SID.name_to_sid(Puppet::Util::Windows::ADSI::User.current_user_name),
       :system => Win32::Security::SID::LocalSystem,
-      :admin => Puppet::Util::Windows::Security.name_to_sid("Administrator"),
+      :admin => Puppet::Util::Windows::SID.name_to_sid("Administrator"),
       :administrators => Win32::Security::SID::BuiltinAdministrators,
-      :guest => Puppet::Util::Windows::Security.name_to_sid("Guest"),
+      :guest => Puppet::Util::Windows::SID.name_to_sid("Guest"),
       :users => Win32::Security::SID::BuiltinUsers,
       :power_users => Win32::Security::SID::PowerUsers,
       :none => Win32::Security::SID::Nobody,
@@ -31,11 +29,12 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
     # (like \\localhost) to fail with unhelpful error messages.
     # Put a check for this upfront to aid debug should this strike again.
     service = Puppet::Type.type(:service).new(:name => 'lmhosts')
-    service.provider.status.should == :running
+    expect(service.provider.status).to eq(:running), 'lmhosts service is not running'
   end
 
   let (:sids) { @sids }
   let (:winsec) { WindowsSecurityTester.new }
+  let (:klass) { Puppet::Util::Windows::File }
 
   def set_group_depending_on_current_user(path)
     if sids[:current_user] == sids[:system]
@@ -53,8 +52,8 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
   def grant_everyone_full_access(path)
     sd = winsec.get_security_descriptor(path)
     everyone = 'S-1-1-0'
-    inherit = WindowsSecurityTester::OBJECT_INHERIT_ACE | WindowsSecurityTester::CONTAINER_INHERIT_ACE
-    sd.dacl.allow(everyone, Windows::File::FILE_ALL_ACCESS, inherit)
+    inherit = Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE | Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
+    sd.dacl.allow(everyone, klass::FILE_ALL_ACCESS, inherit)
     winsec.set_security_descriptor(path, sd)
   end
 
@@ -178,7 +177,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           # when running under SYSTEM account, multiple ACEs come back
           # so we only care that we have at least one of these
           system_aces.any? do |ace|
-            ace.mask == Windows::File::FILE_ALL_ACCESS
+            ace.mask == klass::FILE_ALL_ACCESS
           end.should be_true
 
           # changing the owner/group will no longer make the SD protected
@@ -186,7 +185,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           winsec.set_owner(sids[:administrators], path)
 
           system_aces.find do |ace|
-            ace.mask == Windows::File::FILE_ALL_ACCESS && ace.inherited?
+            ace.mask == klass::FILE_ALL_ACCESS && ace.inherited?
           end.should_not be_nil
         end
 
@@ -227,7 +226,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             # when running under SYSTEM account, multiple ACEs come back
             # so we only care that we have at least one of these
             system_aces.any? do |ace|
-              ace.mask == WindowsSecurityTester::FILE_ALL_ACCESS
+              ace.mask == klass::FILE_ALL_ACCESS
             end.should be_true
 
             # changing the mode will make the SD protected
@@ -237,7 +236,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             # and should have a non-inherited SYSTEM ACE(s)
             system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
             system_aces.each do |ace|
-              ace.mask.should == Windows::File::FILE_ALL_ACCESS && ! ace.inherited?
+              ace.mask.should == klass::FILE_ALL_ACCESS && ! ace.inherited?
             end
           end
 
@@ -259,25 +258,25 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             before :each do
               winsec.set_group(sids[:none], path)
               winsec.set_mode(0600, path)
-              winsec.add_attributes(path, WindowsSecurityTester::FILE_ATTRIBUTE_READONLY)
-              (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should be_nonzero
+              Puppet::Util::Windows::File.add_attributes(path, klass::FILE_ATTRIBUTE_READONLY)
+              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should be_nonzero
             end
 
             it "should make them writable if any sid has write permission" do
               winsec.set_mode(WindowsSecurityTester::S_IWUSR, path)
-              (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should == 0
+              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should == 0
             end
 
             it "should leave them read-only if no sid has write permission and should allow full access for SYSTEM" do
               winsec.set_mode(WindowsSecurityTester::S_IRUSR | WindowsSecurityTester::S_IXGRP, path)
-              (winsec.get_attributes(path) & WindowsSecurityTester::FILE_ATTRIBUTE_READONLY).should be_nonzero
+              (Puppet::Util::Windows::File.get_attributes(path) & klass::FILE_ATTRIBUTE_READONLY).should be_nonzero
 
               system_aces = winsec.get_aces_for_path_by_sid(path, sids[:system])
 
               # when running under SYSTEM account, and set_group / set_owner hasn't been called
               # SYSTEM full access will be restored
               system_aces.any? do |ace|
-                ace.mask == Windows::File::FILE_ALL_ACCESS
+                ace.mask == klass::FILE_ALL_ACCESS
               end.should be_true
             end
           end
@@ -291,7 +290,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           it "should report when extra aces are encounted" do
             sd = winsec.get_security_descriptor(path)
             (544..547).each do |rid|
-              sd.dacl.allow("S-1-5-32-#{rid}", WindowsSecurityTester::STANDARD_RIGHTS_ALL)
+              sd.dacl.allow("S-1-5-32-#{rid}", klass::STANDARD_RIGHTS_ALL)
             end
             winsec.set_security_descriptor(path, sd)
 
@@ -301,12 +300,12 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
           it "should return deny aces" do
             sd = winsec.get_security_descriptor(path)
-            sd.dacl.deny(sids[:guest], WindowsSecurityTester::FILE_GENERIC_WRITE)
+            sd.dacl.deny(sids[:guest], klass::FILE_GENERIC_WRITE)
             winsec.set_security_descriptor(path, sd)
 
             guest_aces = winsec.get_aces_for_path_by_sid(path, sids[:guest])
             guest_aces.find do |ace|
-              ace.type == WindowsSecurityTester::ACCESS_DENIED_ACE_TYPE
+              ace.type == Puppet::Util::Windows::AccessControlEntry::ACCESS_DENIED_ACE_TYPE
             end.should_not be_nil
           end
 
@@ -314,12 +313,12 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             sd = winsec.get_security_descriptor(path)
             dacl = Puppet::Util::Windows::AccessControlList.new
             dacl.allow(
-              sids[:current_user], WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL
+              sids[:current_user], klass::STANDARD_RIGHTS_ALL | klass::SPECIFIC_RIGHTS_ALL
             )
             dacl.allow(
               sids[:everyone],
-              WindowsSecurityTester::FILE_GENERIC_READ,
-              WindowsSecurityTester::INHERIT_ONLY_ACE | WindowsSecurityTester::OBJECT_INHERIT_ACE
+              klass::FILE_GENERIC_READ,
+              Puppet::Util::Windows::AccessControlEntry::INHERIT_ONLY_ACE | Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE
             )
             winsec.set_security_descriptor(path, sd)
 
@@ -344,8 +343,8 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
           it "should be present when the access control list is unprotected" do
             # add a bunch of aces to the parent with permission to add children
-            allow = WindowsSecurityTester::STANDARD_RIGHTS_ALL | WindowsSecurityTester::SPECIFIC_RIGHTS_ALL
-            inherit = WindowsSecurityTester::OBJECT_INHERIT_ACE | WindowsSecurityTester::CONTAINER_INHERIT_ACE
+            allow = klass::STANDARD_RIGHTS_ALL | klass::SPECIFIC_RIGHTS_ALL
+            inherit = Puppet::Util::Windows::AccessControlEntry::OBJECT_INHERIT_ACE | Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
 
             sd = winsec.get_security_descriptor(parent)
             sd.dacl.allow(
@@ -356,7 +355,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
             (544..547).each do |rid|
               sd.dacl.allow(
                 "S-1-5-32-#{rid}",
-                WindowsSecurityTester::STANDARD_RIGHTS_ALL,
+                klass::STANDARD_RIGHTS_ALL,
                 inherit
               )
             end
@@ -371,10 +370,12 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
       describe "for an administrator", :if => Puppet.features.root? do
         before :each do
+          is_dir = Puppet::FileSystem.directory?(path)
           winsec.set_mode(WindowsSecurityTester::S_IRWXU | WindowsSecurityTester::S_IRWXG, path)
           set_group_depending_on_current_user(path)
           winsec.set_owner(sids[:guest], path)
-          lambda { File.open(path, 'r') }.should raise_error(Errno::EACCES)
+          expected_error = RUBY_VERSION =~ /^2\./ && is_dir ? Errno::EISDIR : Errno::EACCES
+          lambda { File.open(path, 'r') }.should raise_error(expected_error)
         end
 
         after :each do
@@ -446,14 +447,14 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         describe "when the sid refers to a deleted trustee" do
           it "should retrieve the user sid" do
             sid = nil
-            user = Puppet::Util::ADSI::User.create("delete_me_user")
+            user = Puppet::Util::Windows::ADSI::User.create("delete_me_user")
             user.commit
             begin
-              sid = Sys::Admin::get_user(user.name).sid
+              sid = Puppet::Util::Windows::ADSI::User.new(user.name).sid.to_s
               winsec.set_owner(sid, path)
               winsec.set_mode(WindowsSecurityTester::S_IRWXU, path)
             ensure
-              Puppet::Util::ADSI::User.delete(user.name)
+              Puppet::Util::Windows::ADSI::User.delete(user.name)
             end
 
             winsec.get_owner(path).should == sid
@@ -462,14 +463,14 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
 
           it "should retrieve the group sid" do
             sid = nil
-            group = Puppet::Util::ADSI::Group.create("delete_me_group")
+            group = Puppet::Util::Windows::ADSI::Group.create("delete_me_group")
             group.commit
             begin
-              sid = Sys::Admin::get_group(group.name).sid
+              sid = Puppet::Util::Windows::ADSI::Group.new(group.name).sid.to_s
               winsec.set_group(sid, path)
               winsec.set_mode(WindowsSecurityTester::S_IRWXG, path)
             ensure
-              Puppet::Util::ADSI::Group.delete(group.name)
+              Puppet::Util::Windows::ADSI::Group.delete(group.name)
             end
             winsec.get_group(path).should == sid
             winsec.get_mode(path).should == WindowsSecurityTester::S_IRWXG
@@ -813,7 +814,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
         Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
 
       sd = winsec.get_security_descriptor(dir)
-      sd.dacl.allow(sd.owner, Windows::File::FILE_ALL_ACCESS, inherit_flags)
+      sd.dacl.allow(sd.owner, klass::FILE_ALL_ACCESS, inherit_flags)
       winsec.set_security_descriptor(dir, sd)
 
       sd = winsec.get_security_descriptor(dir)
@@ -834,7 +835,7 @@ describe "Puppet::Util::Windows::Security", :if => Puppet.features.microsoft_win
           Puppet::Util::Windows::AccessControlEntry::CONTAINER_INHERIT_ACE
 
       sd = winsec.get_security_descriptor(dir)
-      sd.dacl.deny(sids[:guest], Windows::File::FILE_ALL_ACCESS, inherit_flags)
+      sd.dacl.deny(sids[:guest], klass::FILE_ALL_ACCESS, inherit_flags)
       winsec.set_security_descriptor(dir, sd)
 
       sd = winsec.get_security_descriptor(dir)