puppet 3.7.0-x64-mingw32

data/spec/unit/provider/user/user_role_add_spec.rb

@@ -0,0 +1,357 @@
+require 'spec_helper'
+require 'puppet_spec/files'
+require 'tempfile'
+
+describe Puppet::Type.type(:user).provider(:user_role_add), :unless => Puppet.features.microsoft_windows? do
+  include PuppetSpec::Files
+  let(:resource) { Puppet::Type.type(:user).new(:name => 'myuser', :managehome => false, :allowdupe => false) }
+  let(:provider) { described_class.new(resource) }
+
+  before do
+    resource.stubs(:should).returns "fakeval"
+    resource.stubs(:should).with(:keys).returns Hash.new
+    resource.stubs(:[]).returns "fakeval"
+  end
+
+
+  describe "#command" do
+    before do
+      klass = stub("provider")
+      klass.stubs(:command).with(:foo).returns("userfoo")
+      klass.stubs(:command).with(:role_foo).returns("rolefoo")
+      provider.stubs(:class).returns(klass)
+    end
+
+    it "should use the command if not a role and ensure!=role" do
+      provider.stubs(:is_role?).returns(false)
+      provider.stubs(:exists?).returns(false)
+      resource.stubs(:[]).with(:ensure).returns(:present)
+      provider.class.stubs(:foo)
+      provider.command(:foo).should == "userfoo"
+    end
+
+    it "should use the role command when a role" do
+      provider.stubs(:is_role?).returns(true)
+      provider.command(:foo).should == "rolefoo"
+    end
+
+    it "should use the role command when !exists and ensure=role" do
+      provider.stubs(:is_role?).returns(false)
+      provider.stubs(:exists?).returns(false)
+      resource.stubs(:[]).with(:ensure).returns(:role)
+      provider.command(:foo).should == "rolefoo"
+    end
+  end
+
+  describe "#transition" do
+    it "should return the type set to whatever is passed in" do
+      provider.expects(:command).with(:modify).returns("foomod")
+      provider.transition("bar").include?("type=bar")
+    end
+  end
+
+  describe "#create" do
+    before do
+      provider.stubs(:password=)
+    end
+
+    it "should use the add command when the user is not a role" do
+      provider.stubs(:is_role?).returns(false)
+      provider.expects(:addcmd).returns("useradd")
+      provider.expects(:run).at_least_once
+      provider.create
+    end
+
+    it "should use transition(normal) when the user is a role" do
+      provider.stubs(:is_role?).returns(true)
+      provider.expects(:transition).with("normal")
+      provider.expects(:run)
+      provider.create
+    end
+
+    it "should set password age rules" do
+      resource = Puppet::Type.type(:user).new :name => "myuser", :password_min_age => 5, :password_max_age => 10, :provider => :user_role_add
+      provider = described_class.new(resource)
+      provider.stubs(:user_attributes)
+      provider.stubs(:execute)
+      provider.expects(:execute).with { |cmd, *args| args == ["-n", 5, "-x", 10, "myuser"] }
+      provider.create
+    end
+  end
+
+  describe "#destroy" do
+    it "should use the delete command if the user exists and is not a role" do
+      provider.stubs(:exists?).returns(true)
+      provider.stubs(:is_role?).returns(false)
+      provider.expects(:deletecmd)
+      provider.expects(:run)
+      provider.destroy
+    end
+
+    it "should use the delete command if the user is a role" do
+      provider.stubs(:exists?).returns(true)
+      provider.stubs(:is_role?).returns(true)
+      provider.expects(:deletecmd)
+      provider.expects(:run)
+      provider.destroy
+    end
+  end
+
+  describe "#create_role" do
+    it "should use the transition(role) if the user exists" do
+      provider.stubs(:exists?).returns(true)
+      provider.stubs(:is_role?).returns(false)
+      provider.expects(:transition).with("role")
+      provider.expects(:run)
+      provider.create_role
+    end
+
+    it "should use the add command when role doesn't exists" do
+      provider.stubs(:exists?).returns(false)
+      provider.expects(:addcmd)
+      provider.expects(:run)
+      provider.create_role
+    end
+  end
+
+  describe "with :allow_duplicates" do
+    before do
+      resource.stubs(:allowdupe?).returns true
+      provider.stubs(:is_role?).returns(false)
+      provider.stubs(:execute)
+      resource.stubs(:system?).returns false
+      provider.expects(:execute).with { |args| args.include?("-o") }
+    end
+
+    it "should add -o when the user is being created" do
+      provider.stubs(:password=)
+      provider.create
+    end
+
+    it "should add -o when the uid is being modified" do
+      provider.uid = 150
+    end
+  end
+
+  [:roles, :auths, :profiles].each do |val|
+    context "#send" do
+      describe "when getting #{val}" do
+        it "should get the user_attributes" do
+          provider.expects(:user_attributes)
+          provider.send(val)
+        end
+
+        it "should get the #{val} attribute" do
+          attributes = mock("attributes")
+          attributes.expects(:[]).with(val)
+          provider.stubs(:user_attributes).returns(attributes)
+          provider.send(val)
+        end
+      end
+    end
+  end
+
+  describe "#keys" do
+    it "should get the user_attributes" do
+      provider.expects(:user_attributes)
+      provider.keys
+    end
+
+    it "should call removed_managed_attributes" do
+      provider.stubs(:user_attributes).returns({ :type => "normal", :foo => "something" })
+      provider.expects(:remove_managed_attributes)
+      provider.keys
+    end
+
+    it "should removed managed attribute (type, auths, roles, etc)" do
+      provider.stubs(:user_attributes).returns({ :type => "normal", :foo => "something" })
+      provider.keys.should == { :foo => "something" }
+    end
+  end
+
+  describe "#add_properties" do
+    it "should call build_keys_cmd" do
+      resource.stubs(:should).returns ""
+      resource.expects(:should).with(:keys).returns({ :foo => "bar" })
+      provider.expects(:build_keys_cmd).returns([])
+      provider.add_properties
+    end
+
+    it "should add the elements of the keys hash to an array" do
+      resource.stubs(:should).returns ""
+      resource.expects(:should).with(:keys).returns({ :foo => "bar"})
+      provider.add_properties.must == ["-K", "foo=bar"]
+    end
+  end
+
+  describe "#build_keys_cmd" do
+    it "should build cmd array with keypairs seperated by -K ending with user" do
+      provider.build_keys_cmd({"foo" => "bar", "baz" => "boo"}).should.eql? ["-K", "foo=bar", "-K", "baz=boo"]
+    end
+  end
+
+  describe "#keys=" do
+    before do
+      provider.stubs(:is_role?).returns(false)
+    end
+
+    it "should run a command" do
+      provider.expects(:run)
+      provider.keys=({})
+    end
+
+    it "should build the command" do
+      resource.stubs(:[]).with(:name).returns("someuser")
+      provider.stubs(:command).returns("usermod")
+      provider.expects(:build_keys_cmd).returns(["-K", "foo=bar"])
+      provider.expects(:run).with(["usermod", "-K", "foo=bar", "someuser"], "modify attribute key pairs")
+      provider.keys=({})
+    end
+  end
+
+  describe "#password" do
+    before do
+      @array = mock "array"
+    end
+
+    it "should readlines of /etc/shadow" do
+      File.expects(:readlines).with("/etc/shadow").returns([])
+      provider.password
+    end
+
+    it "should reject anything that doesn't start with alpha numerics" do
+      @array.expects(:reject).returns([])
+      File.stubs(:readlines).with("/etc/shadow").returns(@array)
+      provider.password
+    end
+
+    it "should collect splitting on ':'" do
+      @array.stubs(:reject).returns(@array)
+      @array.expects(:collect).returns([])
+      File.stubs(:readlines).with("/etc/shadow").returns(@array)
+      provider.password
+    end
+
+    it "should find the matching user" do
+      resource.stubs(:[]).with(:name).returns("username")
+      @array.stubs(:reject).returns(@array)
+      @array.stubs(:collect).returns([["username", "hashedpassword"], ["someoneelse", "theirpassword"]])
+      File.stubs(:readlines).with("/etc/shadow").returns(@array)
+      provider.password.must == "hashedpassword"
+    end
+
+    it "should get the right password" do
+      resource.stubs(:[]).with(:name).returns("username")
+      File.stubs(:readlines).with("/etc/shadow").returns(["#comment", "   nonsense", "  ", "username:hashedpassword:stuff:foo:bar:::", "other:pword:yay:::"])
+      provider.password.must == "hashedpassword"
+    end
+  end
+
+  describe "#password=" do
+    let(:path) { tmpfile('etc-shadow') }
+
+    before :each do
+      provider.stubs(:target_file_path).returns(path)
+    end
+
+    def write_fixture(content)
+      File.open(path, 'w') { |f| f.print(content) }
+    end
+
+    it "should update the target user" do
+      write_fixture <<FIXTURE
+fakeval:seriously:15315:0:99999:7:::
+FIXTURE
+      provider.password = "totally"
+      File.read(path).should =~ /^fakeval:totally:/
+    end
+
+    it "should only update the target user" do
+      Date.expects(:today).returns Date.new(2011,12,07)
+      write_fixture <<FIXTURE
+before:seriously:15315:0:99999:7:::
+fakeval:seriously:15315:0:99999:7:::
+fakevalish:seriously:15315:0:99999:7:::
+after:seriously:15315:0:99999:7:::
+FIXTURE
+      provider.password = "totally"
+      File.read(path).should == <<EOT
+before:seriously:15315:0:99999:7:::
+fakeval:totally:15315:0:99999:7:::
+fakevalish:seriously:15315:0:99999:7:::
+after:seriously:15315:0:99999:7:::
+EOT
+    end
+
+    # This preserves the current semantics, but is it right? --daniel 2012-02-05
+    it "should do nothing if the target user is missing" do
+      fixture = <<FIXTURE
+before:seriously:15315:0:99999:7:::
+fakevalish:seriously:15315:0:99999:7:::
+after:seriously:15315:0:99999:7:::
+FIXTURE
+
+      write_fixture fixture
+      provider.password = "totally"
+      File.read(path).should == fixture
+    end
+
+    it "should update the lastchg field" do
+      Date.expects(:today).returns Date.new(2013,5,12) # 15837 days after 1970-01-01
+      write_fixture <<FIXTURE
+before:seriously:15315:0:99999:7:::
+fakeval:seriously:15629:0:99999:7:::
+fakevalish:seriously:15315:0:99999:7:::
+after:seriously:15315:0:99999:7:::
+FIXTURE
+      provider.password = "totally"
+      File.read(path).should == <<EOT
+before:seriously:15315:0:99999:7:::
+fakeval:totally:15837:0:99999:7:::
+fakevalish:seriously:15315:0:99999:7:::
+after:seriously:15315:0:99999:7:::
+EOT
+    end
+  end
+
+  describe "#shadow_entry" do
+    it "should return the line for the right user" do
+      File.stubs(:readlines).returns(["someuser:!:10:5:20:7:1::\n", "fakeval:*:20:10:30:7:2::\n", "testuser:*:30:15:40:7:3::\n"])
+      provider.shadow_entry.should == ["fakeval", "*", "20", "10", "30", "7", "2", "", ""]
+    end
+  end
+
+  describe "#password_max_age" do
+    it "should return a maximum age number" do
+      File.stubs(:readlines).returns(["fakeval:NP:12345:0:50::::\n"])
+      provider.password_max_age.should == "50"
+    end
+
+    it "should return -1 for no maximum" do
+      File.stubs(:readlines).returns(["fakeval:NP:12345::::::\n"])
+      provider.password_max_age.should == -1
+    end
+
+    it "should return -1 for no maximum when failed attempts are present" do
+      File.stubs(:readlines).returns(["fakeval:NP:12345::::::3\n"])
+      provider.password_max_age.should == -1
+    end
+  end
+
+  describe "#password_min_age" do
+    it "should return a minimum age number" do
+      File.stubs(:readlines).returns(["fakeval:NP:12345:10:50::::\n"])
+      provider.password_min_age.should == "10"
+    end
+
+    it "should return -1 for no minimum" do
+      File.stubs(:readlines).returns(["fakeval:NP:12345::::::\n"])
+      provider.password_min_age.should == -1
+    end
+
+    it "should return -1 for no minimum when failed attempts are present" do
+      File.stubs(:readlines).returns(["fakeval:NP:12345::::::3\n"])
+      provider.password_min_age.should == -1
+    end
+  end
+end

data/spec/unit/provider/user/useradd_spec.rb

@@ -0,0 +1,430 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+
+describe Puppet::Type.type(:user).provider(:useradd) do
+
+  before :each do
+    described_class.stubs(:command).with(:password).returns '/usr/bin/chage'
+    described_class.stubs(:command).with(:add).returns '/usr/sbin/useradd'
+    described_class.stubs(:command).with(:localadd).returns '/usr/sbin/luseradd'
+    described_class.stubs(:command).with(:modify).returns '/usr/sbin/usermod'
+    described_class.stubs(:command).with(:delete).returns '/usr/sbin/userdel'
+  end
+
+  let(:resource) do
+    Puppet::Type.type(:user).new(
+      :name       => 'myuser',
+      :managehome => :false,
+      :system     => :false,
+      :provider   => provider
+    )
+  end
+
+  let(:provider) { described_class.new(:name => 'myuser') }
+
+
+  let(:shadow_entry) {
+    return unless Puppet.features.libshadow?
+    entry = Struct::PasswdEntry.new
+    entry[:sp_namp]   = 'myuser' # login name
+    entry[:sp_pwdp]   = '$6$FvW8Ib8h$qQMI/CR9m.QzIicZKutLpBgCBBdrch1IX0rTnxuI32K1pD9.RXZrmeKQlaC.RzODNuoUtPPIyQDufunvLOQWF0' # encrypted password
+    entry[:sp_lstchg] = 15573    # date of last password change
+    entry[:sp_min]    = 10       # minimum password age
+    entry[:sp_max]    = 20       # maximum password age
+    entry[:sp_warn]   = 7        # password warning period
+    entry[:sp_inact]  = -1       # password inactivity period
+    entry[:sp_expire] = 15706    # account expiration date
+    entry
+  }
+
+  describe "#create" do
+
+    before do
+      provider.stubs(:exists?).returns(false)
+    end
+
+    it "should add -g when no gid is specified and group already exists" do
+      Puppet::Util.stubs(:gid).returns(true)
+      resource[:ensure] = :present
+      provider.expects(:execute).with(includes('-g'), kind_of(Hash))
+      provider.create
+    end
+
+    it "should add -o when allowdupe is enabled and the user is being created" do
+      resource[:allowdupe] = true
+      provider.expects(:execute).with(includes('-o'), kind_of(Hash))
+      provider.create
+    end
+
+    describe "on systems that support has_system", :if => described_class.system_users? do
+      it "should add -r when system is enabled" do
+        resource[:system] = :true
+        provider.should be_system_users
+        provider.expects(:execute).with(includes('-r'), kind_of(Hash))
+        provider.create
+      end
+    end
+
+    describe "on systems that do not support has_system", :unless => described_class.system_users? do
+      it "should not add -r when system is enabled" do
+        resource[:system] = :true
+        provider.should_not be_system_users
+        provider.expects(:execute).with(['/usr/sbin/useradd', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+    end
+
+    it "should set password age rules" do
+      described_class.has_feature :manages_password_age
+      resource[:password_min_age] = 5
+      resource[:password_max_age] = 10
+      provider.expects(:execute).with(includes('/usr/sbin/useradd'), kind_of(Hash))
+      provider.expects(:execute).with(['/usr/bin/chage', '-m', 5, '-M', 10, 'myuser'])
+      provider.create
+    end
+
+    describe "on systems with the libuser and forcelocal=true" do
+      before do
+         described_class.has_feature :libuser
+         resource[:forcelocal] = true
+      end
+      it "should use luseradd instead of useradd" do
+        provider.expects(:execute).with(includes('/usr/sbin/luseradd'), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should NOT use -o when allowdupe=true" do
+        resource[:allowdupe] = :true
+        provider.expects(:execute).with(Not(includes('-o')), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should raise an exception for duplicate UIDs" do
+        resource[:uid] = 505
+        provider.stubs(:finduser).returns(true)
+        lambda { provider.create }.should raise_error(Puppet::Error, "UID 505 already exists, use allowdupe to force user creation")
+      end
+
+      it "should not use -G for luseradd and should call usermod with -G after luseradd when groups property is set" do
+        resource[:groups] = ['group1', 'group2']
+        provider.expects(:execute).with(Not(includes("-G")), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        provider.expects(:execute).with(includes('/usr/sbin/usermod'))
+        provider.create
+      end
+
+      it "should not use -m when managehome set" do
+        resource[:managehome] = :true
+        provider.expects(:execute).with(Not(includes('-m')), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should not use -e with luseradd, should call usermod with -e after luseradd when expiry is set" do
+        resource[:expiry] = '2038-01-24'
+        provider.expects(:execute).with(all_of(includes('/usr/sbin/luseradd'), Not(includes('-e'))), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        provider.expects(:execute).with(all_of(includes('/usr/sbin/usermod'), includes('-e')))
+        provider.create
+      end
+
+      it "should use userdel to delete users" do
+        resource[:ensure] = :absent
+        provider.stubs(:exists?).returns(true)
+        provider.expects(:execute).with(includes('/usr/sbin/userdel'))
+        provider.delete
+      end
+    end
+
+    describe "on systems that allow to set shell" do
+      it "should trigger shell validation" do
+        resource[:shell] = '/bin/bash'
+        provider.expects(:check_valid_shell)
+        provider.expects(:execute).with(includes('-s'), kind_of(Hash))
+        provider.create
+      end
+    end
+
+  end
+
+  describe "#uid=" do
+    it "should add -o when allowdupe is enabled and the uid is being modified" do
+      resource[:allowdupe] = :true
+      provider.expects(:execute).with(['/usr/sbin/usermod', '-u', 150, '-o', 'myuser'])
+      provider.uid = 150
+    end
+  end
+
+  describe "#expiry=" do
+    it "should pass expiry to usermod as MM/DD/YY when on Solaris" do
+      Facter.expects(:value).with(:operatingsystem).returns 'Solaris'
+      resource[:expiry] = '2012-10-31'
+      provider.expects(:execute).with(['/usr/sbin/usermod', '-e', '10/31/2012', 'myuser'])
+      provider.expiry = '2012-10-31'
+    end
+
+    it "should pass expiry to usermod as YYYY-MM-DD when not on Solaris" do
+      Facter.expects(:value).with(:operatingsystem).returns 'not_solaris'
+      resource[:expiry] = '2012-10-31'
+      provider.expects(:execute).with(['/usr/sbin/usermod', '-e', '2012-10-31', 'myuser'])
+      provider.expiry = '2012-10-31'
+    end
+
+    it "should use -e with an empty string when the expiry property is removed" do
+      resource[:expiry] = :absent
+      provider.expects(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'])
+      provider.expiry = :absent
+    end
+  end
+
+  describe "#check_allow_dup" do
+
+    it "should return an array with a flag if dup is allowed" do
+      resource[:allowdupe] = :true
+      provider.check_allow_dup.must == ["-o"]
+    end
+
+    it "should return an empty array if no dup is allowed" do
+      resource[:allowdupe] = :false
+      provider.check_allow_dup.must == []
+    end
+  end
+
+  describe "#check_system_users" do
+    it "should check system users" do
+      described_class.expects(:system_users?).returns true
+      resource.expects(:system?)
+      provider.check_system_users
+    end
+
+    it "should return an array with a flag if it's a system user" do
+      described_class.expects(:system_users?).returns true
+      resource[:system] = :true
+      provider.check_system_users.must == ["-r"]
+    end
+
+    it "should return an empty array if it's not a system user" do
+      described_class.expects(:system_users?).returns true
+      resource[:system] = :false
+      provider.check_system_users.must == []
+    end
+
+    it "should return an empty array if system user is not featured" do
+      described_class.expects(:system_users?).returns false
+      resource[:system] = :true
+      provider.check_system_users.must == []
+    end
+  end
+
+  describe "#check_manage_home" do
+    it "should return an array with -m flag if home is managed" do
+      resource[:managehome] = :true
+      provider.expects(:execute).with(includes('-m'), kind_of(Hash))
+      provider.create
+    end
+
+    it "should return an array with -r flag if home is managed" do
+      resource[:managehome] = :true
+      resource[:ensure] = :absent
+      provider.stubs(:exists?).returns(true)
+      provider.expects(:execute).with(includes('-r'))
+      provider.delete
+    end
+
+    it "should use -M flag if home is not managed and on Redhat" do
+      Facter.stubs(:value).with(:osfamily).returns("RedHat")
+      resource[:managehome] = :false
+      provider.expects(:execute).with(includes('-M'), kind_of(Hash))
+      provider.create
+    end
+
+    it "should not use -M flag if home is not managed and not on Redhat" do
+      Facter.stubs(:value).with(:osfamily).returns("not RedHat")
+      resource[:managehome] = :false
+      provider.expects(:execute).with(Not(includes('-M')), kind_of(Hash))
+      provider.create
+    end
+  end
+
+  describe "#addcmd" do
+    before do
+      resource[:allowdupe] = :true
+      resource[:managehome] = :true
+      resource[:system] = :true
+      resource[:groups] = [ 'somegroup' ]
+    end
+
+    it "should call command with :add" do
+      provider.expects(:command).with(:add)
+      provider.addcmd
+    end
+
+    it "should add properties" do
+      provider.expects(:add_properties).returns(['-foo_add_properties'])
+      provider.addcmd.should include '-foo_add_properties'
+    end
+
+    it "should check and add if dup allowed" do
+      provider.expects(:check_allow_dup).returns(['-allow_dup_flag'])
+      provider.addcmd.should include '-allow_dup_flag'
+    end
+
+    it "should check and add if home is managed" do
+      provider.expects(:check_manage_home).returns(['-manage_home_flag'])
+      provider.addcmd.should include '-manage_home_flag'
+    end
+
+    it "should add the resource :name" do
+      provider.addcmd.should include 'myuser'
+    end
+
+    describe "on systems featuring system_users", :if => described_class.system_users? do
+      it "should return an array with -r if system? is true" do
+        resource[:system] = :true
+        provider.addcmd.should include("-r")
+      end
+
+      it "should return an array without -r if system? is false" do
+        resource[:system] = :false
+        provider.addcmd.should_not include("-r")
+      end
+    end
+
+    describe "on systems not featuring system_users", :unless => described_class.system_users? do
+      [:false, :true].each do |system|
+        it "should return an array without -r if system? is #{system}" do
+          resource[:system] = system
+          provider.addcmd.should_not include("-r")
+        end
+      end
+    end
+
+    it "should return an array with the full command and expiry as MM/DD/YY when on Solaris" do
+      Facter.stubs(:value).with(:operatingsystem).returns 'Solaris'
+      described_class.expects(:system_users?).returns true
+      resource[:expiry] = "2012-08-18"
+      provider.addcmd.must == ['/usr/sbin/useradd', '-e', '08/18/2012', '-G', 'somegroup', '-o', '-m', '-r', 'myuser']
+    end
+
+    it "should return an array with the full command and expiry as YYYY-MM-DD when not on Solaris" do
+      Facter.stubs(:value).with(:operatingsystem).returns 'not_solaris'
+      described_class.expects(:system_users?).returns true
+      resource[:expiry] = "2012-08-18"
+      provider.addcmd.must == ['/usr/sbin/useradd', '-e', '2012-08-18', '-G', 'somegroup', '-o', '-m', '-r', 'myuser']
+    end
+
+    it "should return an array without -e if expiry is undefined full command" do
+      described_class.expects(:system_users?).returns true
+      provider.addcmd.must == ["/usr/sbin/useradd", "-G", "somegroup", "-o", "-m", "-r", "myuser"]
+    end
+
+    it "should pass -e \"\" if the expiry has to be removed" do
+      described_class.expects(:system_users?).returns true
+      resource[:expiry] = :absent
+
+      provider.addcmd.must == ['/usr/sbin/useradd', '-e', '', '-G', 'somegroup', '-o', '-m', '-r', 'myuser']
+    end
+  end
+
+  {
+    :password_min_age => 10,
+    :password_max_age => 20,
+    :password         => '$6$FvW8Ib8h$qQMI/CR9m.QzIicZKutLpBgCBBdrch1IX0rTnxuI32K1pD9.RXZrmeKQlaC.RzODNuoUtPPIyQDufunvLOQWF0'
+  }.each_pair do |property, expected_value|
+    describe "##{property}" do
+      before :each do
+        resource # just to link the resource to the provider
+      end
+
+      it "should return absent if libshadow feature is not present" do
+        Puppet.features.stubs(:libshadow?).returns false
+        # Shadow::Passwd.expects(:getspnam).never # if we really don't have libshadow we dont have Shadow::Passwd either
+        provider.send(property).should == :absent
+      end
+
+      it "should return absent if user cannot be found", :if => Puppet.features.libshadow? do
+        Shadow::Passwd.expects(:getspnam).with('myuser').returns nil
+        provider.send(property).should == :absent
+      end
+
+      it "should return the correct value if libshadow is present", :if => Puppet.features.libshadow? do
+        Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
+        provider.send(property).should == expected_value
+      end
+    end
+  end
+
+  describe '#expiry' do
+    before :each do
+      resource # just to link the resource to the provider
+    end
+
+    it "should return absent if libshadow feature is not present" do
+      Puppet.features.stubs(:libshadow?).returns false
+      provider.expiry.should == :absent
+    end
+
+    it "should return absent if user cannot be found", :if => Puppet.features.libshadow? do
+      Shadow::Passwd.expects(:getspnam).with('myuser').returns nil
+      provider.expiry.should == :absent
+    end
+
+    it "should return absent if expiry is -1", :if => Puppet.features.libshadow? do
+      shadow_entry.sp_expire = -1
+      Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
+      provider.expiry.should == :absent
+    end
+
+    it "should convert to YYYY-MM-DD", :if => Puppet.features.libshadow? do
+      Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
+      provider.expiry.should == '2013-01-01'
+    end
+  end
+
+  describe "#passcmd" do
+    before do
+      resource[:allowdupe] = :true
+      resource[:managehome] = :true
+      resource[:system] = :true
+      described_class.has_feature :manages_password_age
+    end
+
+    it "should call command with :pass" do
+      # command(:password) is only called inside passcmd if
+      # password_min_age or password_max_age is set
+      resource[:password_min_age] = 123
+      provider.expects(:command).with(:password)
+      provider.passcmd
+    end
+
+    it "should return nil if neither min nor max is set" do
+      provider.passcmd.must be_nil
+    end
+
+    it "should return a chage command array with -m <value> and the user name if password_min_age is set" do
+      resource[:password_min_age] = 123
+      provider.passcmd.must == ['/usr/bin/chage','-m',123,'myuser']
+    end
+
+    it "should return a chage command array with -M <value> if password_max_age is set" do
+      resource[:password_max_age] = 999
+      provider.passcmd.must == ['/usr/bin/chage','-M',999,'myuser']
+    end
+
+    it "should return a chage command array with -M <value> -m <value> if both password_min_age and password_max_age are set" do
+      resource[:password_min_age] = 123
+      resource[:password_max_age] = 999
+      provider.passcmd.must == ['/usr/bin/chage','-m',123,'-M',999,'myuser']
+    end
+  end
+
+  describe "#check_valid_shell" do
+    it "should raise an error if shell does not exist" do
+      resource[:shell] = 'foo/bin/bash'
+      lambda { provider.check_valid_shell }.should raise_error(Puppet::Error, /Shell foo\/bin\/bash must exist/)
+    end
+
+    it "should raise an error if the shell is not executable" do
+      resource[:shell] = 'LICENSE'
+      lambda { provider.check_valid_shell }.should raise_error(Puppet::Error, /Shell LICENSE must be executable/)
+    end
+  end
+
+end