puppet 4.0.0 → 4.5.0

data/spec/unit/util/windows/adsi_spec.rb

@@ -40,16 +40,16 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
   end
 
   describe ".sid_uri" do
-    it "should raise an error when the input is not a SID object" do
+    it "should raise an error when the input is not a SID Principal" do
       [Object.new, {}, 1, :symbol, '', nil].each do |input|
         expect {
           Puppet::Util::Windows::ADSI.sid_uri(input)
-        }.to raise_error(Puppet::Error, /Must use a valid SID object/)
+        }.to raise_error(Puppet::Error, /Must use a valid SID::Principal/)
       end
     end
 
     it "should return a SID uri for a well-known SID (SYSTEM)" do
-      sid = Win32::Security::SID.new('SYSTEM')
+      sid = Puppet::Util::Windows::SID::Principal.lookup_account_name('SYSTEM')
       expect(Puppet::Util::Windows::ADSI.sid_uri(sid)).to eq('WinNT://S-1-5-18')
     end
   end
@@ -60,12 +60,10 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     let(:domain_username) { "#{domain}\\#{username}"}
 
     it "should generate the correct URI" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
       expect(Puppet::Util::Windows::ADSI::User.uri(username)).to eq("WinNT://./#{username},user")
     end
 
     it "should generate the correct URI for a user with a domain" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
       expect(Puppet::Util::Windows::ADSI::User.uri(username, domain)).to eq("WinNT://#{domain}/#{username},user")
     end
 
@@ -96,25 +94,33 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should be able to check the existence of a user" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+      Puppet::Util::Windows::SID.expects(:name_to_sid_object).with(username).returns nil
       Puppet::Util::Windows::ADSI.expects(:connect).with("WinNT://./#{username},user").returns connection
+      connection.expects(:Class).returns('User')
       expect(Puppet::Util::Windows::ADSI::User.exists?(username)).to be_truthy
     end
 
     it "should be able to check the existence of a domain user" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+      Puppet::Util::Windows::SID.expects(:name_to_sid_object).with("#{domain}\\#{username}").returns nil
       Puppet::Util::Windows::ADSI.expects(:connect).with("WinNT://#{domain}/#{username},user").returns connection
+      connection.expects(:Class).returns('User')
       expect(Puppet::Util::Windows::ADSI::User.exists?(domain_username)).to be_truthy
     end
 
     it "should be able to confirm the existence of a user with a well-known SID" do
-
-      system_user = Win32::Security::SID::LocalSystem
+      system_user = Puppet::Util::Windows::SID::LocalSystem
       # ensure that the underlying OS is queried here
       Puppet::Util::Windows::ADSI.unstub(:connect)
       expect(Puppet::Util::Windows::ADSI::User.exists?(system_user)).to be_truthy
     end
 
+    it "should return false with a well-known Group SID" do
+      group = Puppet::Util::Windows::SID::BuiltinAdministrators
+      # ensure that the underlying OS is queried here
+      Puppet::Util::Windows::ADSI.unstub(:connect)
+      expect(Puppet::Util::Windows::ADSI::User.exists?(group)).to be_falsey
+    end
+
     it "should return nil with an unknown SID" do
 
       bogus_sid = 'S-1-2-3-4'
@@ -130,8 +136,6 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should return an enumeration of IADsUser wrapped objects" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
-
       name = 'Administrator'
       wmi_users = [stub('WMI', :name => name)]
       Puppet::Util::Windows::ADSI.expects(:execquery).with('select name from win32_useraccount where localaccount = "TRUE"').returns(wmi_users)
@@ -183,45 +187,69 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         user.password = 'pwd'
       end
 
+       it "should be able manage a user without a password" do
+        adsi_user.expects(:SetPassword).with('pwd').never
+        adsi_user.expects(:SetInfo).at_least_once
+
+        flagname = "UserFlags"
+        fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
+
+        adsi_user.expects(:Get).with(flagname).returns(0)
+        adsi_user.expects(:Put).with(flagname, fADS_UF_DONT_EXPIRE_PASSWD)
+
+        user.password = nil
+      end
+
       it "should generate the correct URI" do
         Puppet::Util::Windows::SID.stubs(:octet_string_to_sid_object).returns(sid)
         expect(user.uri).to eq("WinNT://testcomputername/#{username},user")
       end
 
       describe "when given a set of groups to which to add the user" do
+        let(:existing_groups) { ['group2','group3'] }
+        let(:group_sids) { existing_groups.each_with_index.map{|n,i| stub(:Name => n, :objectSID => stub(:sid => i))} }
+
         let(:groups_to_set) { 'group1,group2' }
+        let(:desired_sids) { groups_to_set.split(',').each_with_index.map{|n,i| stub(:Name => n, :objectSID => stub(:sid => i-1))} }
 
         before(:each) do
-          Puppet::Util::Windows::SID.stubs(:octet_string_to_sid_object).returns(sid)
-          user.expects(:groups).returns ['group2', 'group3']
+          user.expects(:group_sids).returns(group_sids.map {|s| s.objectSID })
         end
 
         describe "if membership is specified as inclusive" do
           it "should add the user to those groups, and remove it from groups not in the list" do
-            group1 = stub 'group1'
-            group1.expects(:Add).with("WinNT://testcomputername/#{username},user")
+            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns(Hash[ desired_sids.map { |s| [s.objectSID.sid, s.objectSID] }])
+            user.expects(:add_group_sids).with { |value| value.sid == -1 }
+            user.expects(:remove_group_sids).with { |value| value.sid == 1 }
 
-            group3 = stub 'group1'
-            group3.expects(:Remove).with("WinNT://testcomputername/#{username},user")
+            user.set_groups(groups_to_set, false)
+          end
 
-            Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sid).returns("WinNT://testcomputername/#{username},user").twice
-            Puppet::Util::Windows::ADSI.expects(:connect).with('WinNT://./group1,group').returns group1
-            Puppet::Util::Windows::ADSI.expects(:connect).with('WinNT://./group3,group').returns group3
+          it "should remove all users from a group if desired is empty" do
+            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns({})
+            user.expects(:add_group_sids).never
+            user.expects(:remove_group_sids).with { |user1, user2| user1.sid == 0 && user2.sid == 1 }
 
-            user.set_groups(groups_to_set, false)
+            user.set_groups('', false)
           end
         end
 
         describe "if membership is specified as minimum" do
           it "should add the user to the specified groups without affecting its other memberships" do
-            group1 = stub 'group1'
-            group1.expects(:Add).with("WinNT://testcomputername/#{username},user")
-
-            Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sid).returns("WinNT://testcomputername/#{username},user")
-            Puppet::Util::Windows::ADSI.expects(:connect).with('WinNT://./group1,group').returns group1
+            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns(Hash[ desired_sids.map { |s| [s.objectSID.sid, s.objectSID] }])
+            user.expects(:add_group_sids).with { |value| value.sid == -1 }
+            user.expects(:remove_group_sids).never
 
             user.set_groups(groups_to_set, true)
           end
+
+          it "should do nothing if desired is empty" do
+            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns({})
+            user.expects(:remove_group_sids).never
+            user.expects(:add_group_sids).never
+
+            user.set_groups('', true)
+          end
         end
       end
     end
@@ -246,7 +274,7 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         end
 
         it "and raise when passed a non-SID object to add" do
-          expect{ group.add_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID object/)
+          expect{ group.add_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID::Principal/)
         end
 
         it "to remove a member" do
@@ -256,7 +284,7 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         end
 
         it "and raise when passed a non-SID object to remove" do
-          expect{ group.remove_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID object/)
+          expect{ group.remove_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID::Principal/)
         end
       end
 
@@ -270,48 +298,129 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         expect(group.members).to match(names)
       end
 
-      it "should be able to add a list of users to a group" do
-        names = ['DOMAIN\user1', 'user2']
-        sids = [
-          stub(:account => 'user1', :domain => 'DOMAIN'),
-          stub(:account => 'user2', :domain => 'testcomputername'),
-          stub(:account => 'user3', :domain => 'DOMAIN2'),
-        ]
+      context "calling .set_members" do
+        it "should set the members of a group to only desired_members when inclusive" do
+          names = ['DOMAIN\user1', 'user2']
+          sids = [
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2),
+              stub(:account => 'user3', :domain => 'DOMAIN2', :sid => 3),
+          ]
 
-        # use stubbed objectSid on member to return stubbed SID
-        Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(sids[0])
-        Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([1]).returns(sids[1])
+          # use stubbed objectSid on member to return stubbed SID
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(sids[0])
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([1]).returns(sids[1])
 
-        Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('user2').returns(sids[1])
-        Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('DOMAIN2\user3').returns(sids[2])
+          Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('user2').returns(sids[1])
+          Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('DOMAIN2\user3').returns(sids[2])
 
-        Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[0]).returns("WinNT://DOMAIN/user1,user")
-        Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[2]).returns("WinNT://DOMAIN2/user3,user")
+          Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[0]).returns("WinNT://DOMAIN/user1,user")
+          Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[2]).returns("WinNT://DOMAIN2/user3,user")
 
-        members = names.each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i])}
-        adsi_group.expects(:Members).returns members
+          members = names.each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i])}
+          adsi_group.expects(:Members).returns members
 
-        adsi_group.expects(:Remove).with('WinNT://DOMAIN/user1,user')
-        adsi_group.expects(:Add).with('WinNT://DOMAIN2/user3,user')
+          adsi_group.expects(:Remove).with('WinNT://DOMAIN/user1,user')
+          adsi_group.expects(:Add).with('WinNT://DOMAIN2/user3,user')
 
-        group.set_members(['user2', 'DOMAIN2\user3'])
-      end
+          group.set_members(['user2', 'DOMAIN2\user3'])
+        end
 
-      it "should raise an error when a username does not resolve to a SID" do
-        expect {
-          adsi_group.expects(:Members).returns []
-          group.set_members(['foobar'])
-        }.to raise_error(Puppet::Error, /Could not resolve username: foobar/)
+        it "should add the desired_members to an existing group when not inclusive" do
+          names = ['DOMAIN\user1', 'user2']
+          sids = [
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2),
+              stub(:account => 'user3', :domain => 'DOMAIN2', :sid => 3),
+          ]
+
+          # use stubbed objectSid on member to return stubbed SID
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(sids[0])
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([1]).returns(sids[1])
+
+          Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('user2').returns(sids[1])
+          Puppet::Util::Windows::SID.expects(:name_to_sid_object).with('DOMAIN2\user3').returns(sids[2])
+
+          Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[2]).returns("WinNT://DOMAIN2/user3,user")
+
+          members = names.each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i])}
+          adsi_group.expects(:Members).returns members
+
+          adsi_group.expects(:Remove).with('WinNT://DOMAIN/user1,user').never
+
+          adsi_group.expects(:Add).with('WinNT://DOMAIN2/user3,user')
+
+          group.set_members(['user2', 'DOMAIN2\user3'],false)
+        end
+
+        it "should return immediately when desired_members is nil" do
+          adsi_group.expects(:Members).never
+
+          adsi_group.expects(:Remove).never
+          adsi_group.expects(:Add).never
+
+          group.set_members(nil)
+        end
+
+        it "should remove all members when desired_members is empty and inclusive" do
+          names = ['DOMAIN\user1', 'user2']
+          sids = [
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1 ),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2 ),
+          ]
+
+          # use stubbed objectSid on member to return stubbed SID
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(sids[0])
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([1]).returns(sids[1])
+
+          Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[0]).returns("WinNT://DOMAIN/user1,user")
+          Puppet::Util::Windows::ADSI.expects(:sid_uri).with(sids[1]).returns("WinNT://testcomputername/user2,user")
+
+          members = names.each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i])}
+          adsi_group.expects(:Members).returns members
+
+          adsi_group.expects(:Remove).with('WinNT://DOMAIN/user1,user')
+          adsi_group.expects(:Remove).with('WinNT://testcomputername/user2,user')
+
+          group.set_members([])
+        end
+
+        it "should do nothing when desired_members is empty and not inclusive" do
+          names = ['DOMAIN\user1', 'user2']
+          sids = [
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1 ),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2 ),
+          ]
+          # use stubbed objectSid on member to return stubbed SID
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(sids[0])
+          Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([1]).returns(sids[1])
+
+          members = names.each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i])}
+          adsi_group.expects(:Members).returns members
+
+          adsi_group.expects(:Remove).never
+          adsi_group.expects(:Add).never
+
+          group.set_members([],false)
+        end
+
+        it "should raise an error when a username does not resolve to a SID" do
+          expect {
+            adsi_group.expects(:Members).returns []
+            group.set_members(['foobar'])
+          }.to raise_error(Puppet::Error, /Could not resolve name: foobar/)
+        end
       end
 
       it "should generate the correct URI" do
-        Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+        adsi_group.expects(:objectSID).returns([0])
+        Socket.expects(:gethostname).returns('testcomputername')
+        Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(stub(:account => groupname,:domain => 'testcomputername'))
         expect(group.uri).to eq("WinNT://./#{groupname},group")
       end
     end
 
     it "should generate the correct URI" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
       expect(Puppet::Util::Windows::ADSI::Group.uri("people")).to eq("WinNT://./people,group")
     end
 
@@ -328,20 +437,28 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should be able to confirm the existence of a group" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+      Puppet::Util::Windows::SID.expects(:name_to_sid_object).with(groupname).returns nil
       Puppet::Util::Windows::ADSI.expects(:connect).with("WinNT://./#{groupname},group").returns connection
+      connection.expects(:Class).returns('Group')
 
       expect(Puppet::Util::Windows::ADSI::Group.exists?(groupname)).to be_truthy
     end
 
     it "should be able to confirm the existence of a group with a well-known SID" do
 
-      service_group = Win32::Security::SID::Service
+      service_group = Puppet::Util::Windows::SID::Service
       # ensure that the underlying OS is queried here
       Puppet::Util::Windows::ADSI.unstub(:connect)
       expect(Puppet::Util::Windows::ADSI::Group.exists?(service_group)).to be_truthy
     end
 
+    it "will return true with a well-known User SID, as there is no way to resolve it with a WinNT:// style moniker" do
+      user = Puppet::Util::Windows::SID::NtLocal
+      # ensure that the underlying OS is queried here
+      Puppet::Util::Windows::ADSI.unstub(:connect)
+      expect(Puppet::Util::Windows::ADSI::Group.exists?(user)).to be_truthy
+    end
+
     it "should return nil with an unknown SID" do
 
       bogus_sid = 'S-1-2-3-4'
@@ -357,8 +474,6 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should return an enumeration of IADsGroup wrapped objects" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
-
       name = 'Administrators'
       wmi_groups = [stub('WMI', :name => name)]
       Puppet::Util::Windows::ADSI.expects(:execquery).with('select name from win32_group where localaccount = "TRUE"').returns(wmi_groups)
@@ -381,7 +496,7 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should warn on 2003" do
-      connection.expects(:Delete).raises(RuntimeError,
+      connection.expects(:Delete).raises(WIN32OLERuntimeError,
  "Delete (WIN32OLERuntimeError)
     OLE error code:80041010 in SWbemServicesEx
       Invalid class

data/spec/unit/util/windows/api_types_spec.rb

@@ -25,4 +25,46 @@ describe "FFI::MemoryPointer", :if => Puppet.features.microsoft_windows? do
       expect(read_string.encoding).to eq(Encoding::UTF_8)
     end
   end
+
+  context "read_arbitrary_wide_string_up_to" do
+    let (:string) { "foo_bar" }
+    let (:single_null_string) { string + "\x00" }
+    let (:double_null_string) { string + "\x00\x00" }
+
+    it "should read a short single null terminated string" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(single_null_string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to()
+      end
+
+      expect(read_string).to eq(string)
+    end
+
+    it "should read a short double null terminated string" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(double_null_string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to(512, :double_null)
+      end
+
+      expect(read_string).to eq(string)
+    end
+
+    it "should return a string of max_length characters when specified" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(single_null_string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to(3)
+      end
+
+      expect(read_string).to eq(string[0..2])
+    end
+
+    it "should return wide strings in UTF-8" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to()
+      end
+
+      expect(read_string.encoding).to eq(Encoding::UTF_8)
+    end
+  end
 end

data/spec/unit/util/windows/file_spec.rb

@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe Puppet::Util::Windows::File, :if => Puppet::Util::Platform.windows? do
+  include PuppetSpec::Files
+
+  let(:nonexist_file) { 'C:\somefile\that\wont\ever\exist' }
+  let(:invalid_file_attributes) { 0xFFFFFFFF } #define INVALID_FILE_ATTRIBUTES (DWORD (-1))
+
+  describe "get_attributes" do
+    it "should raise an error for files that do not exist by default" do
+      expect {
+        described_class.get_attributes(nonexist_file)
+      }.to raise_error(Puppet::Error, /GetFileAttributes/)
+    end
+
+    it "should raise an error for files that do not exist when specified" do
+      expect {
+        described_class.get_attributes(nonexist_file, true)
+      }.to raise_error(Puppet::Error, /GetFileAttributes/)
+    end
+
+    it "should not raise an error for files that do not exist when specified" do
+      expect {
+        described_class.get_attributes(nonexist_file, false)
+      }.not_to raise_error
+    end
+
+    it "should return INVALID_FILE_ATTRIBUTES for files that do not exist when specified" do
+      expect(described_class.get_attributes(nonexist_file, false)).to eq(invalid_file_attributes)
+    end
+  end
+end

data/spec/unit/util/windows/security_descriptor_spec.rb

@@ -4,9 +4,9 @@ require 'spec_helper'
 require 'puppet/util/windows'
 
 describe "Puppet::Util::Windows::SecurityDescriptor", :if => Puppet.features.microsoft_windows? do
-  let(:system_sid) { Win32::Security::SID::LocalSystem }
-  let(:admins_sid) { Win32::Security::SID::BuiltinAdministrators }
-  let(:group_sid) { Win32::Security::SID::Nobody }
+  let(:system_sid) { Puppet::Util::Windows::SID::LocalSystem }
+  let(:admins_sid) { Puppet::Util::Windows::SID::BuiltinAdministrators }
+  let(:group_sid) { Puppet::Util::Windows::SID::Nobody }
   let(:new_sid)   { 'S-1-5-32-500-1-2-3' }
 
   def empty_dacl

data/spec/unit/util/windows/sid_spec.rb

@@ -7,28 +7,20 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
   end
 
   let(:subject)      { Puppet::Util::Windows::SID }
-  let(:sid)          { Win32::Security::SID::LocalSystem }
+  let(:sid)          { Puppet::Util::Windows::SID::LocalSystem }
   let(:invalid_sid)  { 'bogus' }
   let(:unknown_sid)  { 'S-0-0-0' }
   let(:unknown_name) { 'chewbacca' }
 
   context "#octet_string_to_sid_object" do
-    it "should properly convert an array of bytes for the local Administrator SID" do
-      host = '.'
-      username = 'Administrator'
-      admin = WIN32OLE.connect("WinNT://#{host}/#{username},user")
-      converted = subject.octet_string_to_sid_object(admin.objectSID)
-
-      expect(converted).to eq(Win32::Security::SID.new(username, host))
-      expect(converted).to be_an_instance_of Win32::Security::SID
-    end
-
     it "should properly convert an array of bytes for a well-known SID" do
       bytes = [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0]
       converted = subject.octet_string_to_sid_object(bytes)
 
-      expect(converted).to eq(Win32::Security::SID.new('SYSTEM'))
-      expect(converted).to be_an_instance_of Win32::Security::SID
+      expect(converted).to be_an_instance_of Puppet::Util::Windows::SID::Principal
+      expect(converted.sid_bytes).to eq(bytes)
+      expect(converted.sid).to eq(sid)
+      expect(converted.account).to eq('SYSTEM')
     end
 
     it "should raise an error for non-array input" do
@@ -43,11 +35,19 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
       }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
     end
 
+    it "should raise an error for a valid byte array with no mapping to a user" do
+      expect {
+        # S-1-1-1 which is not a valid account
+        valid_octet_invalid_user =[1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0]
+        subject.octet_string_to_sid_object(valid_octet_invalid_user)
+      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountSidW:  No mapping between account names and security IDs was done./)
+    end
+
     it "should raise an error for a malformed byte array" do
       expect {
-        invalid_octet = [1]
+        invalid_octet = [2]
         subject.octet_string_to_sid_object(invalid_octet)
-      }.to raise_error(SystemCallError, /No mapping between account names and security IDs was done./)
+      }.to raise_error(Puppet::Util::Windows::Error, /Failed to call LookupAccountSidW:  The parameter is incorrect./)
     end
   end
 
@@ -61,12 +61,12 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should return a SID for a passed user or group name" do
-      subject.expects(:name_to_sid_object).with('testers').returns 'S-1-5-32-547'
+      subject.expects(:name_to_sid_object).with('testers').returns stub(:sid => 'S-1-5-32-547')
       expect(subject.name_to_sid('testers')).to eq('S-1-5-32-547')
     end
 
     it "should return a SID for a passed fully-qualified user or group name" do
-      subject.expects(:name_to_sid_object).with('MACHINE\testers').returns 'S-1-5-32-547'
+      subject.expects(:name_to_sid_object).with('MACHINE\testers').returns stub(:sid => 'S-1-5-32-547')
       expect(subject.name_to_sid('MACHINE\testers')).to eq('S-1-5-32-547')
     end
 
@@ -85,6 +85,33 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     it "should be the identity function for any sid" do
       expect(subject.name_to_sid(sid)).to eq(sid)
     end
+
+    describe "with non-US languages" do
+
+      UMLAUT = [195, 164].pack('c*').force_encoding(Encoding::UTF_8)
+      let(:username) { SecureRandom.uuid.to_s.gsub(/\-/, '')[0..13] + UMLAUT }
+
+      after(:each) {
+        Puppet::Util::Windows::ADSI::User.delete(username)
+      }
+
+      it "should properly resolve a username with an umlaut" do
+        # Ruby seems to use the local codepage when making COM calls
+        # if this fails, might want to use Windows API directly instead to ensure bytes
+        user = Puppet::Util::Windows::ADSI.create(username, 'user')
+        user.SetInfo()
+
+        # compare the new SID to the name_to_sid result
+        sid_bytes = user.objectSID.to_a
+        sid_string = ''
+        FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_byte_ptr|
+          sid_byte_ptr.write_array_of_uchar(sid_bytes)
+          sid_string = Puppet::Util::Windows::SID.sid_ptr_to_string(sid_byte_ptr)
+        end
+
+        expect(subject.name_to_sid(username)).to eq(sid_string)
+      end
+    end
   end
 
   context "#name_to_sid_object" do
@@ -92,12 +119,12 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
       expect(subject.name_to_sid_object(unknown_name)).to be_nil
     end
 
-    it "should return a Win32::Security::SID instance for any valid sid" do
-      expect(subject.name_to_sid_object(sid)).to be_an_instance_of(Win32::Security::SID)
+    it "should return a Puppet::Util::Windows::SID::Principal instance for any valid sid" do
+      expect(subject.name_to_sid_object(sid)).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
     end
 
     it "should accept unqualified account name" do
-      expect(subject.name_to_sid_object('SYSTEM').to_s).to eq(sid)
+      expect(subject.name_to_sid_object('SYSTEM').sid).to eq(sid)
     end
 
     it "should be case-insensitive" do
@@ -109,7 +136,7 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should accept domain qualified account names" do
-      expect(subject.name_to_sid_object('NT AUTHORITY\SYSTEM').to_s).to eq(sid)
+      expect(subject.name_to_sid_object('NT AUTHORITY\SYSTEM').sid).to eq(sid)
     end
   end