puppet 4.0.0 → 5.0.0

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -1,7 +1,9 @@
 #! /usr/bin/env ruby -S rspec
 # encoding: ASCII-8BIT
 require 'spec_helper'
-require 'plist'
+
+module Puppet::Util::Plist
+end
 
 describe Puppet::Type.type(:user).provider(:directoryservice) do
   let(:username) { 'nonexistent_user' }
@@ -14,7 +16,6 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
   end
   let(:provider) { resource.provider }
   let(:users_plist_dir) { '/var/db/dslocal/nodes/Default/users' }
-  let(:stringio_object) { StringIO.new('new_stringio_object') }
 
   # This is the output of doing `dscl -plist . read /Users/<username>` which
   # will return a hash of keys whose values are all arrays.
@@ -59,12 +60,18 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     }
   end
 
+  let(:sha512_shadowhashdata_array) do
+    ['62706c69 73743030 d101025d 53414c54 45442d53 48413531 324f1044 7ea7d592 131f57b2 c8f8bdbc '\
+     'ec8d9df1 2128a386 393a4f00 c7619bac 2622a44d 451419d1 1da512d5 915ab98e 39718ac9 4083fe2e '\
+     'fd6bf710 a54d477f 8ff735b1 2587192d 080b1900 00000000 00010100 00000000 00000300 00000000 '\
+     '00000000 00000000 000060']
+  end
   # The below value is the result of executing
   # `dscl -plist . read /Users/<username> ShadowHashData` on a 10.7
   # system and converting it to a native Ruby Hash with Plist.parse_xml
   let(:sha512_shadowhashdata_hash) do
     {
-      'dsAttrTypeNative:ShadowHashData' => ['62706c69 73743030 d101025d 53414c54 45442d53 48413531 324f1044 7ea7d592 131f57b2 c8f8bdbc ec8d9df1 2128a386 393a4f00 c7619bac 2622a44d 451419d1 1da512d5 915ab98e 39718ac9 4083fe2e fd6bf710 a54d477f 8ff735b1 2587192d 080b1900 00000000 00010100 00000000 00000300 00000000 00000000 00000000 000060']
+      'dsAttrTypeNative:ShadowHashData' => sha512_shadowhashdata_array
     }
   end
 
@@ -82,9 +89,9 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
 
   # The below is the result of converting sha512_embedded_bplist to XML and
   # parsing it with Plist.parse_xml. It is a Ruby Hash whose value is a
-  # StringIO object holding a Base64 encoded salted-SHA512 password hash.
+  # Base64 encoded salted-SHA512 password hash.
   let(:sha512_embedded_bplist_hash) do
-    { 'SALTED-SHA512' => StringIO.new(sha512_pw_string) }
+    { 'SALTED-SHA512' => sha512_pw_string }
   end
 
   # The value below is the result of converting sha512_pw_string to Hex.
@@ -92,12 +99,21 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     '7ea7d592131f57b2c8f8bdbcec8d9df12128a386393a4f00c7619bac2622a44d451419d11da512d5915ab98e39718ac94083fe2efd6bf710a54d477f8ff735b12587192d'
   end
 
+  let(:pbkdf2_shadowhashdata_array) do
+    ['62706c69 73743030 d101025f 10145341 4c544544 2d534841 3531322d 50424b44 4632d303 04050607 '\
+     '0857656e 74726f70 79547361 6c745a69 74657261 74696f6e 734f1080 0590ade1 9e6953c1 35ae872a '\
+     'e7761823 5df7d46c 63de7f9a 0fcdf2cd 9e7d85e4 b7ca8681 01235b61 58e05a30 9805ee48 14b027a4 '\
+     'be9c23ec 2926bc81 72269aff ba5c9a59 85e81091 fa689807 6d297f1f aa75fa61 7551ef16 71d75200 '\
+     '55c4a0d9 7b9b9c58 05aa322b aedbcd8e e9c52381 1653ac2e a9e9c8d8 f1ac519a 0f2b595e 4f102093 '\
+     '77c46908 a1c8ac2c 3e45c0d4 4da8ad0f cd85ec5c 14d9a59f fc40c9da 31f0ec11 60b0080b 22293136 '\
+     '41c4e700 00000000 00010100 00000000 00000900 00000000 00000000 00000000 0000ea']
+  end
   # The below value is the result of executing
   # `dscl -plist . read /Users/<username> ShadowHashData` on a 10.8
   # system and converting it to a native Ruby Hash with Plist.parse_xml
   let(:pbkdf2_shadowhashdata_hash) do
     {
-      "dsAttrTypeNative:ShadowHashData"=>["62706c69 73743030 d101025f 10145341 4c544544 2d534841 3531322d 50424b44 4632d303 04050607 0857656e 74726f70 79547361 6c745a69 74657261 74696f6e 734f1080 0590ade1 9e6953c1 35ae872a e7761823 5df7d46c 63de7f9a 0fcdf2cd 9e7d85e4 b7ca8681 01235b61 58e05a30 9805ee48 14b027a4 be9c23ec 2926bc81 72269aff ba5c9a59 85e81091 fa689807 6d297f1f aa75fa61 7551ef16 71d75200 55c4a0d9 7b9b9c58 05aa322b aedbcd8e e9c52381 1653ac2e a9e9c8d8 f1ac519a 0f2b595e 4f102093 77c46908 a1c8ac2c 3e45c0d4 4da8ad0f cd85ec5c 14d9a59f fc40c9da 31f0ec11 60b0080b 22293136 41c4e700 00000000 00010100 00000000 00000900 00000000 00000000 00000000 0000ea"]
+      "dsAttrTypeNative:ShadowHashData"=> pbkdf2_shadowhashdata_array
     }
   end
 
@@ -106,8 +122,8 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
   let(:pbkdf2_embedded_bplist_hash) do
     {
       'SALTED-SHA512-PBKDF2' => {
-        'entropy'    => StringIO.new(pbkdf2_pw_string),
-        'salt'       => StringIO.new(pbkdf2_salt_string),
+        'entropy'    => pbkdf2_pw_string,
+        'salt'       => pbkdf2_salt_string,
         'iterations' => pbkdf2_iterations_value
       }
     }
@@ -141,18 +157,53 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     "9377c46908a1c8ac2c3e45c0d44da8ad0fcd85ec5c14d9a59ffc40c9da31f0ec"
   end
 
-  # The below value is a Fixnum iterations value used in the PBKDF2
+  # The below value is an Integer iterations value used in the PBKDF2
   # key stretching algorithm
   let(:pbkdf2_iterations_value) do
     24752
   end
 
+  let(:pbkdf2_and_ssha512_shadowhashdata_array) do
+    ['62706c69 73743030 d2010203 0a5f1014 53414c54 45442d53 48413531 322d5042 4b444632 5d53414c '\
+     '5445442d 53484135 3132d304 05060708 0957656e 74726f70 79547361 6c745a69 74657261 74696f6e '\
+     '734f1080 0590ade1 9e6953c1 35ae872a e7761823 5df7d46c 63de7f9a 0fcdf2cd 9e7d85e4 b7ca8681 '\
+     '01235b61 58e05a30 9805ee48 14b027a4 be9c23ec 2926bc81 72269aff ba5c9a59 85e81091 fa689807 '\
+     '6d297f1f aa75fa61 7551ef16 71d75200 55c4a0d9 7b9b9c58 05aa322b aedbcd8e e9c52381 1653ac2e '\
+     'a9e9c8d8 f1ac519a 0f2b595e 4f102093 77c46908 a1c8ac2c 3e45c0d4 4da8ad0f cd85ec5c 14d9a59f '\
+     'fc40c9da 31f0ec11 60b04f10 447ea7d5 92131f57 b2c8f8bd bcec8d9d f12128a3 86393a4f 00c7619b '\
+     'ac2622a4 4d451419 d11da512 d5915ab9 8e39718a c94083fe 2efd6bf7 10a54d47 7f8ff735 b1258719 '\
+     '2d000800 0d002400 32003900 41004600 5100d400 f700fa00 00000000 00020100 00000000 00000b00 '\
+     '00000000 00000000 00000000 000141']
+  end
+
+  let(:pbkdf2_and_ssha512_shadowhashdata_hash) do
+    {
+      'dsAttrTypeNative:ShadowHashData' => pbkdf2_and_ssha512_shadowhashdata_array
+    }
+  end
+
+  let (:pbkdf2_and_ssha512_embedded_plist) do
+    "bplist00\xD2\x01\x02\x03\n_\x10\x14SALTED-SHA512-PBKDF2]SALTED-SHA512\xD3\x04\x05\x06\a\b\tWentropyTsaltZiterationsO\x10\x80\x05\x90\xAD\xE1\x9EiS\xC15\xAE\x87*\xE7v\x18#]\xF7\xD4lc\xDE\x7F\x9A\x0F\xCD\xF2\xCD\x9E}\x85\xE4\xB7\xCA\x86\x81\x01#[aX\xE0Z0\x98\x05\xEEH\x14\xB0'\xA4\xBE\x9C#\xEC)&\xBC\x81r&\x9A\xFF\xBA\\\x9AY\x85\xE8\x10\x91\xFAh\x98\am)\x7F\x1F\xAAu\xFAauQ\xEF\x16q\xD7R\x00U\xC4\xA0\xD9{\x9B\x9CX\x05\xAA2+\xAE\xDB\xCD\x8E\xE9\xC5#\x81\x16S\xAC.\xA9\xE9\xC8\xD8\xF1\xACQ\x9A\x0F+Y^O\x10 \x93w\xC4i\b\xA1\xC8\xAC,>E\xC0\xD4M\xA8\xAD\x0F\xCD\x85\xEC\\\x14\xD9\xA5\x9F\xFC@\xC9\xDA1\xF0\xEC\x11`\xB0O\x10D~\xA7\xD5\x92\x13\x1FW\xB2\xC8\xF8\xBD\xBC\xEC\x8D\x9D\xF1!(\xA3\x869:O\x00\xC7a\x9B\xAC&\"\xA4ME\x14\x19\xD1\x1D\xA5\x12\xD5\x91Z\xB9\x8E9q\x8A\xC9@\x83\xFE.\xFDk\xF7\x10\xA5MG\x7F\x8F\xF75\xB1%\x87\x19-\x00\b\x00\r\x00$\x002\x009\x00A\x00F\x00Q\x00\xD4\x00\xF7\x00\xFA\x00\x00\x00\x00\x00\x00\x02\x01\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01A"
+  end
+
+  let (:pbkdf2_and_ssha512_embedded_bplist_hash) do
+    {
+      "SALTED-SHA512-PBKDF2" => {
+        "entropy"     => pbkdf2_pw_string,
+        "salt"        => pbkdf2_salt_value,
+        "iterations"  => pbkdf2_iterations_value,
+      },
+      "SALTED-SHA512" => sha512_password_hash
+    }
+  end
+
   # The below represents output of 'dscl -plist . readall /Users' converted to
   # a native Ruby hash if only one user were installed on the system.
   # This lets us check the behavior of all the methods necessary to return a
   # user's groups property by controlling the data provided by dscl
-  let(:testuser_hash) do
-    [{"dsAttrTypeStandard:RecordName"             =>["nonexistent_user"],
+  let(:testuser_base) do
+    {
+      "dsAttrTypeStandard:RecordName"             =>["nonexistent_user"],
       "dsAttrTypeStandard:UniqueID"               =>["1000"],
       "dsAttrTypeStandard:AuthenticationAuthority"=>
        [";Kerberosv5;;testuser@LKDC:SHA1.4383E152D9D394AA32D13AE98F6F6E1FE8D00F81;LKDC:SHA1.4383E152D9D394AA32D13AE98F6F6E1FE8D00F81",
@@ -171,7 +222,14 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
        ["<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n          <!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n          <plist version=\"1.0\">\n          <dict>\n            <key>failedLoginCount</key>\n            <integer>0</integer>\n            <key>failedLoginTimestamp</key>\n            <date>2001-01-01T00:00:00Z</date>\n            <key>lastLoginTimestamp</key>\n            <date>2001-01-01T00:00:00Z</date>\n            <key>passwordTimestamp</key>\n            <date>2012-08-10T23:53:50Z</date>\n          </dict>\n          </plist>\n          "],
       "dsAttrTypeStandard:UserShell"              =>["/bin/bash"],
       "dsAttrTypeNative:ShadowHashData"           =>
-       ["62706c69 73743030 d101025d 53414c54 45442d53 48413531 324f1044 7ea7d592 131f57b2 c8f8bdbc ec8d9df1 2128a386 393a4f00 c7619bac 2622a44d 451419d1 1da512d5 915ab98e 39718ac9 4083fe2e fd6bf710 a54d477f 8ff735b1 2587192d 080b1900 00000000 00010100 00000000 00000300 00000000 00000000 00000000 000060"]}]
+       ["62706c69 73743030 d101025d 53414c54 45442d53 48413531 324f1044 7ea7d592 131f57b2 c8f8bdbc ec8d9df1 2128a386 393a4f00 c7619bac 2622a44d 451419d1 1da512d5 915ab98e 39718ac9 4083fe2e fd6bf710 a54d477f 8ff735b1 2587192d 080b1900 00000000 00010100 00000000 00000300 00000000 00000000 00000000 000060"]
+     }
+  end
+  let(:testuser_hash) do
+    [
+      testuser_base.merge(sha512_shadowhashdata_hash),
+      testuser_base.merge(pbkdf2_shadowhashdata_hash),
+    ]
   end
 
   # The below represents the result of running Plist.parse_xml on XML
@@ -290,7 +348,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
   end
 
-  describe 'self#get_all_users' do
+  describe 'self#get_all_users', :if => Puppet.features.cfpropertylist? do
     let(:empty_plist) do
       '<?xml version="1.0" encoding="UTF-8"?>
       <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -319,7 +377,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
         :groups         => 'testgroup,third',
         :comment        => username,
         :password       => sha512_password_hash,
-        :shadowhashdata => sha512_shadowhashdata_hash,
+        :shadowhashdata => sha512_shadowhashdata_array,
         :name           => username,
         :uid            => 1000,
         :gid            => 22,
@@ -330,36 +388,78 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     before :each do
       provider.class.stubs(:get_os_version).returns('10.7')
       provider.class.stubs(:get_all_users).returns(testuser_hash)
-      provider.class.stubs(:get_attribute_from_dscl).with('Users', username, 'ShadowHashData').returns(sha512_shadowhashdata_hash)
       provider.class.stubs(:get_list_of_groups).returns(group_plist_hash_guid)
-      provider.class.stubs(:convert_binary_to_xml).with(sha512_embedded_bplist).returns(sha512_embedded_bplist_hash)
+      provider.class.stubs(:convert_binary_to_hash).with(sha512_embedded_bplist).returns(sha512_embedded_bplist_hash)
+      provider.class.stubs(:convert_binary_to_hash).with(pbkdf2_embedded_plist).returns(pbkdf2_embedded_bplist_hash)
       provider.class.prefetch({})
     end
 
-    it 'should return :uid values as a Fixnum' do
-      expect(provider.class.generate_attribute_hash(user_plist_hash)[:uid]).to be_a_kind_of Fixnum
+    it 'should return :uid values as an Integer' do
+      expect(provider.class.generate_attribute_hash(user_plist_hash)[:uid]).to be_a Integer
     end
 
-    it 'should return :gid values as a Fixnum' do
-      expect(provider.class.generate_attribute_hash(user_plist_hash)[:gid]).to be_a_kind_of Fixnum
+    it 'should return :gid values as an Integer' do
+      expect(provider.class.generate_attribute_hash(user_plist_hash)[:gid]).to be_a Integer
     end
 
     it 'should return a hash of resource attributes' do
-      expect(provider.class.generate_attribute_hash(user_plist_hash)).to eq(user_plist_resource)
+      expect(provider.class.generate_attribute_hash(user_plist_hash.merge(sha512_shadowhashdata_hash))).to eq(user_plist_resource)
+    end
+  end
+
+  describe 'self#generate_attribute_hash with pbkdf2 and ssha512' do
+    let(:user_plist_resource) do
+      {
+        :ensure         => :present,
+        :provider       => :directoryservice,
+        :groups         => 'testgroup,third',
+        :comment        => username,
+        :password       => pbkdf2_password_hash,
+        :iterations     => pbkdf2_iterations_value,
+        :salt           => pbkdf2_salt_value,
+        :shadowhashdata => pbkdf2_and_ssha512_shadowhashdata_array,
+        :name           => username,
+        :uid            => 1000,
+        :gid            => 22,
+        :home           => user_path
+      }
+    end
+
+    before :each do
+      provider.class.stubs(:get_os_version).returns('10.7')
+      provider.class.stubs(:get_all_users).returns(testuser_hash)
+      provider.class.stubs(:get_list_of_groups).returns(group_plist_hash_guid)
+      provider.class.prefetch({})
     end
+
+    it 'should return a hash of resource attributes' do
+      expect(provider.class.generate_attribute_hash(user_plist_hash.merge(pbkdf2_and_ssha512_shadowhashdata_hash))).to eq(user_plist_resource)
+    end
+
   end
 
-  describe '#exists?' do
-    # This test expects an error to be raised
-    # I'm PROBABLY doing this wrong...
-    it 'should return false if the dscl command errors out' do
-      provider.expects(:dscl).with('.', 'read', user_path).raises(Puppet::ExecutionFailure, 'Dscl Fails')
-      expect(provider.exists?).to eq(false)
+  describe 'self#generate_attribute_hash empty shadowhashdata' do
+    let(:user_plist_resource) do
+      {
+        :ensure         => :present,
+        :provider       => :directoryservice,
+        :groups         => 'testgroup,third',
+        :comment        => username,
+        :password       => '*',
+        :shadowhashdata => nil,
+        :name           => username,
+        :uid            => 1000,
+        :gid            => 22,
+        :home           => user_path
+      }
     end
 
-    it 'should return true if the dscl command does not error' do
-      provider.expects(:dscl).with('.', 'read', user_path).returns(user_plist_xml)
-      expect(provider.exists?).to eq(true)
+    it 'should handle empty shadowhashdata' do
+      provider.class.stubs(:get_os_version).returns('10.7')
+      provider.class.stubs(:get_all_users).returns([testuser_base])
+      provider.class.stubs(:get_list_of_groups).returns(group_plist_hash_guid)
+      provider.class.prefetch({})
+      expect(provider.class.generate_attribute_hash(user_plist_hash)).to eq(user_plist_resource)
     end
   end
 
@@ -417,16 +517,17 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
 
     before :each do
       provider.class.stubs(:get_all_users).returns(testuser_hash)
-      provider.class.stubs(:get_attribute_from_dscl).with('Users', username, 'ShadowHashData').returns([])
       provider.class.stubs(:get_os_version).returns('10.7')
     end
 
     it "should return a list of groups if the user's name matches GroupMembership" do
+      provider.class.expects(:get_list_of_groups).returns(group_plist_hash)
       provider.class.expects(:get_list_of_groups).returns(group_plist_hash)
       expect(provider.class.prefetch({}).first.groups).to eq('second,testgroup')
     end
 
     it "should return a list of groups if the user's GUID matches GroupMembers" do
+      provider.class.expects(:get_list_of_groups).returns(group_plist_hash_guid)
       provider.class.expects(:get_list_of_groups).returns(group_plist_hash_guid)
       expect(provider.class.prefetch({}).first.groups).to eq('testgroup,third')
     end
@@ -477,7 +578,6 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
 
     it 'should call dscl to add necessary groups' do
-      provider.class.expects(:get_attribute_from_dscl).with('Users', username, 'ShadowHashData').returns([])
       provider.class.expects(:get_attribute_from_dscl).with('Users', username, 'GeneratedUID').returns({'dsAttrTypeStandard:GeneratedUID' => ['guidnonexistent_user']})
       provider.expects(:groups).returns('two,three')
       provider.expects(:dscl).with('.', '-merge', '/Groups/one', 'GroupMembership', 'nonexistent_user')
@@ -487,15 +587,15 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
 
     it 'should call the get_salted_sha512 method on 10.7 and return the correct hash' do
-      provider.class.expects(:get_attribute_from_dscl).with('Users', username, 'ShadowHashData').returns(sha512_shadowhashdata_hash)
-      provider.class.expects(:convert_binary_to_xml).with(sha512_embedded_bplist).returns(sha512_embedded_bplist_hash)
+      provider.class.expects(:convert_binary_to_hash).with(sha512_embedded_bplist).returns(sha512_embedded_bplist_hash)
+      provider.class.expects(:convert_binary_to_hash).with(pbkdf2_embedded_plist).returns(pbkdf2_embedded_bplist_hash)
       expect(provider.class.prefetch({}).first.password).to eq(sha512_password_hash)
     end
 
     it 'should call the get_salted_sha512_pbkdf2 method on 10.8 and return the correct hash' do
-      provider.class.expects(:get_attribute_from_dscl).with('Users', username,'ShadowHashData').returns(pbkdf2_shadowhashdata_hash)
-      provider.class.expects(:convert_binary_to_xml).with(pbkdf2_embedded_plist).returns(pbkdf2_embedded_bplist_hash)
-      expect(provider.class.prefetch({}).first.password).to eq(pbkdf2_password_hash)
+      provider.class.expects(:convert_binary_to_hash).with(sha512_embedded_bplist).returns(sha512_embedded_bplist_hash)
+      provider.class.expects(:convert_binary_to_hash).with(pbkdf2_embedded_plist).returns(pbkdf2_embedded_bplist_hash)
+      expect(provider.class.prefetch({}).last.password).to eq(pbkdf2_password_hash)
     end
 
   end
@@ -566,7 +666,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
   end
 
-  describe '#get_list_of_groups' do
+  describe '#get_list_of_groups', :if => Puppet.features.cfpropertylist? do
     # The below value is the result of running `dscl -plist . readall /Groups`
     # on an OS X system.
     let(:groups_xml) do
@@ -633,7 +733,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
   end
 
-  describe '#get_attribute_from_dscl' do
+  describe '#get_attribute_from_dscl', :if => Puppet.features.cfpropertylist? do
     # The below value is the result of executing
     # `dscl -plist . read /Users/<username/ GeneratedUID`
     # on an OS X system.
@@ -662,30 +762,17 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
   end
 
-  describe '#convert_xml_to_binary' do
-    # Because this method relies on a binary that only exists on OS X, a stub
-    # object is needed to expect the calls. This makes testing somewhat...uneventful
-    let(:stub_io_object) { stub('connection') }
-
+  describe '#convert_hash_to_binary' do
     it 'should use plutil to successfully convert an xml plist to a binary plist' do
-      IO.expects(:popen).with('plutil -convert binary1 -o - -', 'r+').yields stub_io_object
-      Plist::Emit.expects(:dump).with('ruby_hash').returns('xml_plist_data')
-      stub_io_object.expects(:write).with('xml_plist_data')
-      stub_io_object.expects(:close_write)
-      stub_io_object.expects(:read).returns('binary_plist_data')
-      expect(provider.class.convert_xml_to_binary('ruby_hash')).to eq('binary_plist_data')
+      Puppet::Util::Plist.expects(:dump_plist).with('ruby_hash', :binary).returns('binary_plist_data')
+      expect(provider.class.convert_hash_to_binary('ruby_hash')).to eq('binary_plist_data')
     end
   end
 
-  describe '#convert_binary_to_xml' do
-    let(:stub_io_object) { stub('connection') }
-
+  describe '#convert_binary_to_hash' do
     it 'should accept a binary plist and return a ruby hash containing the plist data' do
-      IO.expects(:popen).with('plutil -convert xml1 -o - -', 'r+').yields stub_io_object
-      stub_io_object.expects(:write).with('binary_plist_data')
-      stub_io_object.expects(:close_write)
-      stub_io_object.expects(:read).returns(user_plist_xml)
-      expect(provider.class.convert_binary_to_xml('binary_plist_data')).to eq(user_plist_hash)
+      Puppet::Util::Plist.expects(:parse_plist).with('binary_plist_data').returns(user_plist_hash)
+      expect(provider.class.convert_binary_to_hash('binary_plist_data')).to eq(user_plist_hash)
     end
   end
 
@@ -697,7 +784,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
   end
 
   describe '#get_salted_sha512' do
-    it "should accept a hash whose 'SALTED-SHA512' key contains a StringIO object with a base64 encoded salted-SHA512 password hash and return the hex value of that password hash" do
+    it "should accept a hash whose 'SALTED-SHA512' key contains a base64 encoded salted-SHA512 password hash and return the hex value of that password hash" do
       expect(provider.class.get_salted_sha512(sha512_embedded_bplist_hash)).to eq(sha512_password_hash)
     end
   end
@@ -712,8 +799,8 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     it "should accept a hash containing a PBKDF2 password hash, salt, and iterations value and return the correct iterations value" do
         expect(provider.class.get_salted_sha512_pbkdf2('iterations', pbkdf2_embedded_bplist_hash)).to eq(pbkdf2_iterations_value)
     end
-    it "should return a Fixnum value when looking up the PBKDF2 iterations value" do
-        expect(provider.class.get_salted_sha512_pbkdf2('iterations', pbkdf2_embedded_bplist_hash)).to be_a_kind_of(Fixnum)
+    it "should return an Integer value when looking up the PBKDF2 iterations value" do
+        expect(provider.class.get_salted_sha512_pbkdf2('iterations', pbkdf2_embedded_bplist_hash)).to be_a(Integer)
     end
     it "should raise an error if a field other than 'entropy', 'salt', or 'iterations' is passed" do
       expect { provider.class.get_salted_sha512_pbkdf2('othervalue', pbkdf2_embedded_bplist_hash) }.to raise_error(Puppet::Error, /Puppet has tried to read an incorrect value from the SALTED-SHA512-PBKDF2 hash. Acceptable fields are 'salt', 'entropy', or 'iterations'/)
@@ -764,15 +851,15 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
 
     let(:sha512_shadowhashdata) do
       {
-        'SALTED-SHA512' => StringIO.new('blankvalue')
+        'SALTED-SHA512' => 'blankvalue'
       }
     end
 
     let(:pbkdf2_shadowhashdata) do
       {
         'SALTED-SHA512-PBKDF2' => {
-          'entropy'    => StringIO.new('blank_entropy'),
-          'salt'       => StringIO.new('blank_salt'),
+          'entropy'    => 'blank_entropy',
+          'salt'       => 'blank_salt',
           'iterations' => 100
         }
       }
@@ -797,7 +884,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
           ";Kerberosv5;;puppet@LKDC:S HA1.35580B1D6366D2890A35D430373FF653297F377D;LKDC:SHA1.35580B1D6366D2890A35D430373FF653297F377D"],
         "_writers_realname"        => ["puppet"],
         "_writers_hint"            => ["puppet"],
-        "ShadowHashData"           => [StringIO.new('blank')]
+        "ShadowHashData"           => ['blank']
       }
     end
 
@@ -827,34 +914,33 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
   end
 
   describe '#set_salted_sha512' do
-    let(:users_plist) { {'ShadowHashData' => [StringIO.new('string_data')] } }
+    let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
     let(:sha512_shadow_hash_data) do
       {
-        'SALTED-SHA512' => stringio_object
+        'SALTED-SHA512' => sha512_pw_string
       }
     end
 
     it 'should set the SALTED-SHA512 password hash for a user in 10.7 and call the set_shadow_hash_data method to write the plist to disk' do
-      provider.class.expects(:convert_xml_to_binary).with(sha512_embedded_bplist_hash).returns(sha512_embedded_bplist)
+      provider.class.expects(:convert_hash_to_binary).with(sha512_embedded_bplist_hash).returns(sha512_embedded_bplist)
       provider.expects(:set_shadow_hash_data).with(users_plist, sha512_embedded_bplist)
       provider.set_salted_sha512(users_plist, sha512_embedded_bplist_hash, sha512_password_hash)
     end
 
     it 'should set the salted-SHA512 password, even if a blank shadow_hash_data hash is passed' do
-      provider.expects(:new_stringio_object).returns(stringio_object)
-      provider.class.expects(:convert_xml_to_binary).with(sha512_shadow_hash_data).returns(sha512_embedded_bplist)
+      provider.class.expects(:convert_hash_to_binary).with(sha512_shadow_hash_data).returns(sha512_embedded_bplist)
       provider.expects(:set_shadow_hash_data).with(users_plist, sha512_embedded_bplist)
       provider.set_salted_sha512(users_plist, false, sha512_password_hash)
     end
   end
 
   describe '#set_salted_pbkdf2' do
-    let(:users_plist) { {'ShadowHashData' => [StringIO.new('string_data')] } }
+    let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
     let(:entropy_shadow_hash_data) do
       {
         'SALTED-SHA512-PBKDF2' =>
         {
-          'entropy' => stringio_object
+          'entropy' => 'binary_string'
         }
       }
     end
@@ -862,29 +948,30 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     # This will also catch the edge-case where a 10.6-style user exists on
     # a 10.8 system and Puppet attempts to set a password
     it 'should not fail if shadow_hash_data is not a Hash' do
-      provider.expects(:new_stringio_object).returns(stringio_object)
-      provider.expects(:base64_decode_string).with(pbkdf2_password_hash).returns('binary_string')
-      provider.class.expects(:convert_xml_to_binary).with(entropy_shadow_hash_data).returns('binary_plist')
+      Puppet::Util::Plist.expects(:string_to_blob).with(provider.base64_decode_string(pbkdf2_password_hash)).returns('binary_string')
+      provider.class.expects(:convert_hash_to_binary).with(entropy_shadow_hash_data).returns('binary_plist')
       provider.expects(:set_shadow_hash_data).with({'passwd' => '********'}, 'binary_plist')
       provider.set_salted_pbkdf2({}, false, 'entropy', pbkdf2_password_hash)
     end
 
     it "should set the PBKDF2 password hash when the 'entropy' field is passed with a valid password hash" do
-      provider.class.expects(:convert_xml_to_binary).with(pbkdf2_embedded_bplist_hash).returns(pbkdf2_embedded_plist)
+      Puppet::Util::Plist.expects(:string_to_blob).with(provider.base64_decode_string(pbkdf2_password_hash))
+      provider.class.expects(:convert_hash_to_binary).with(pbkdf2_embedded_bplist_hash).returns(pbkdf2_embedded_plist)
       provider.expects(:set_shadow_hash_data).with(users_plist, pbkdf2_embedded_plist)
       users_plist.expects(:[]=).with('passwd', '********')
       provider.set_salted_pbkdf2(users_plist, pbkdf2_embedded_bplist_hash, 'entropy', pbkdf2_password_hash)
     end
 
     it "should set the PBKDF2 password hash when the 'salt' field is passed with a valid password hash" do
-      provider.class.expects(:convert_xml_to_binary).with(pbkdf2_embedded_bplist_hash).returns(pbkdf2_embedded_plist)
+      Puppet::Util::Plist.expects(:string_to_blob).with(provider.base64_decode_string(pbkdf2_salt_value))
+      provider.class.expects(:convert_hash_to_binary).with(pbkdf2_embedded_bplist_hash).returns(pbkdf2_embedded_plist)
       provider.expects(:set_shadow_hash_data).with(users_plist, pbkdf2_embedded_plist)
       users_plist.expects(:[]=).with('passwd', '********')
       provider.set_salted_pbkdf2(users_plist, pbkdf2_embedded_bplist_hash, 'salt', pbkdf2_salt_value)
     end
 
     it "should set the PBKDF2 password hash when the 'iterations' field is passed with a valid password hash" do
-      provider.class.expects(:convert_xml_to_binary).with(pbkdf2_embedded_bplist_hash).returns(pbkdf2_embedded_plist)
+      provider.class.expects(:convert_hash_to_binary).with(pbkdf2_embedded_bplist_hash).returns(pbkdf2_embedded_plist)
       provider.expects(:set_shadow_hash_data).with(users_plist, pbkdf2_embedded_plist)
       users_plist.expects(:[]=).with('passwd', '********')
       provider.set_salted_pbkdf2(users_plist, pbkdf2_embedded_bplist_hash, 'iterations', pbkdf2_iterations_value)
@@ -893,8 +980,7 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
 
   describe '#write_users_plist_to_disk' do
     it 'should save the passed plist to disk and convert it to a binary plist' do
-      Plist::Emit.expects(:save_plist).with(user_plist_xml, "#{users_plist_dir}/nonexistent_user.plist")
-      provider.expects(:plutil).with('-convert', 'binary1', "#{users_plist_dir}/nonexistent_user.plist")
+      Puppet::Util::Plist.expects(:write_plist_file).with(user_plist_xml, "#{users_plist_dir}/nonexistent_user.plist", :binary)
       provider.write_users_plist_to_disk(user_plist_xml)
     end
   end
@@ -907,10 +993,6 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
   end
 
   describe '#get_users_plist' do
-    let(:test_plist) do
-      "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>shell</key>\n\t<string>/bin/bash</string>\n\t<key>user</key>\n\t<string>puppet</string>\n</dict>\n</plist>\n"
-    end
-
     let(:test_hash) do
       {
         'user'  => 'puppet',
@@ -919,15 +1001,15 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     end
 
     it 'should convert a plist to a valid Ruby hash' do
-      provider.expects(:plutil).with('-convert', 'xml1', '-o', '/dev/stdout', "#{users_plist_dir}/#{username}.plist").returns(test_plist)
-      expect(provider.get_users_plist(username)).to eq(test_hash)
+      Puppet::Util::Plist.expects(:read_plist_file).with("#{users_plist_dir}/#{username}.plist").returns(test_hash)
+      expect(provider.get_users_plist(username)).to eq(test_hash, )
     end
   end
 
   describe '#get_shadow_hash_data' do
     let(:shadow_hash) do
       {
-        'ShadowHashData' => [StringIO.new('test')]
+        'ShadowHashData' => ['test']
       }
     end
 
@@ -941,10 +1023,10 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
       expect(provider.get_shadow_hash_data(no_shadow_hash)).to eq(false)
     end
 
-    it 'should call convert_binary_to_xml() with the contents of the StringIO Object ' +
+    it 'should call convert_binary_to_hash() with the string ' +
        'located in the first element of the array of the ShadowHashData key if the ' +
        'passed users_plist contains a ShadowHashData key' do
-      provider.class.expects(:convert_binary_to_xml).with('test').returns('returnvalue')
+      provider.class.expects(:convert_binary_to_hash).with('test').returns('returnvalue')
       expect(provider.get_shadow_hash_data(shadow_hash)).to eq('returnvalue')
     end
   end
@@ -1047,7 +1129,6 @@ describe Puppet::Type.type(:user).provider(:directoryservice) do
     before :each do
       provider.class.stubs(:get_all_users).returns(all_users_hash)
       provider.class.stubs(:get_list_of_groups).returns(group_plist_hash_guid)
-      provider.class.stubs(:get_attribute_from_dscl).with('Users', 'testuser', 'ShadowHashData').returns({})
       provider.class.prefetch({})
     end
 

data/spec/unit/provider/user/useradd_spec.rb

@@ -364,6 +364,19 @@ describe Puppet::Type.type(:user).provider(:useradd) do
         Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
         expect(provider.send(property)).to eq(expected_value)
       end
+
+      # nameservice provider instances are initialized with a @canonical_name
+      # instance variable to track the original name of the instance on disk
+      # before converting it to UTF-8 if appropriate. When re-querying the
+      # system for attributes of this user such as password info, we need to
+      # supply the pre-UTF8-converted value.
+      it "should query using the canonical_name attribute of the user", :if => Puppet.features.libshadow? do
+        canonical_name = [253, 241].pack('C*').force_encoding(Encoding::EUC_KR)
+        provider = described_class.new(:name => '??', :canonical_name => canonical_name)
+
+        Shadow::Passwd.expects(:getspnam).with(canonical_name).returns shadow_entry
+        provider.password
+      end
     end
   end
 
@@ -438,6 +451,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     end
 
     it "should raise an error if the shell is not executable" do
+      FileTest.stubs(:executable?).with('LICENSE').returns false
       resource[:shell] = 'LICENSE'
       expect { provider.check_valid_shell }.to raise_error(Puppet::Error, /Shell LICENSE must be executable/)
     end