puppet 4.1.0 → 4.10.0

data/spec/unit/util/windows/adsi_spec.rb

@@ -6,6 +6,10 @@ require 'puppet/util/windows'
 
 describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows? do
   let(:connection) { stub 'connection' }
+  let(:builtin_localized) { Puppet::Util::Windows::SID.sid_to_name('S-1-5-32') }
+  # SYSTEM is special as English can retrieve it via Windows API
+  # but will return localized names
+  let(:ntauthority_localized) { Puppet::Util::Windows::SID::Principal.lookup_account_name('SYSTEM').domain }
 
   before(:each) do
     Puppet::Util::Windows::ADSI.instance_variable_set(:@computer_name, 'testcomputername')
@@ -40,16 +44,16 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
   end
 
   describe ".sid_uri" do
-    it "should raise an error when the input is not a SID object" do
+    it "should raise an error when the input is not a SID Principal" do
       [Object.new, {}, 1, :symbol, '', nil].each do |input|
         expect {
           Puppet::Util::Windows::ADSI.sid_uri(input)
-        }.to raise_error(Puppet::Error, /Must use a valid SID object/)
+        }.to raise_error(Puppet::Error, /Must use a valid SID::Principal/)
       end
     end
 
     it "should return a SID uri for a well-known SID (SYSTEM)" do
-      sid = Win32::Security::SID.new('SYSTEM')
+      sid = Puppet::Util::Windows::SID::Principal.lookup_account_name('SYSTEM')
       expect(Puppet::Util::Windows::ADSI.sid_uri(sid)).to eq('WinNT://S-1-5-18')
     end
   end
@@ -60,15 +64,21 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     let(:domain_username) { "#{domain}\\#{username}"}
 
     it "should generate the correct URI" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
       expect(Puppet::Util::Windows::ADSI::User.uri(username)).to eq("WinNT://./#{username},user")
     end
 
     it "should generate the correct URI for a user with a domain" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
       expect(Puppet::Util::Windows::ADSI::User.uri(username, domain)).to eq("WinNT://#{domain}/#{username},user")
     end
 
+    it "should generate the correct URI for a BUILTIN user" do
+      expect(Puppet::Util::Windows::ADSI::User.uri(username, builtin_localized)).to eq("WinNT://./#{username},user")
+    end
+
+    it "should generate the correct URI for a NT AUTHORITY user" do
+      expect(Puppet::Util::Windows::ADSI::User.uri(username, ntauthority_localized)).to eq("WinNT://./#{username},user")
+    end
+
     it "should be able to parse a username without a domain" do
       expect(Puppet::Util::Windows::ADSI::User.parse_name(username)).to eq([username, '.'])
     end
@@ -96,25 +106,33 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should be able to check the existence of a user" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+      Puppet::Util::Windows::SID.expects(:name_to_sid_object).with(username).returns nil
       Puppet::Util::Windows::ADSI.expects(:connect).with("WinNT://./#{username},user").returns connection
+      connection.expects(:Class).returns('User')
       expect(Puppet::Util::Windows::ADSI::User.exists?(username)).to be_truthy
     end
 
     it "should be able to check the existence of a domain user" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+      Puppet::Util::Windows::SID.expects(:name_to_sid_object).with("#{domain}\\#{username}").returns nil
       Puppet::Util::Windows::ADSI.expects(:connect).with("WinNT://#{domain}/#{username},user").returns connection
+      connection.expects(:Class).returns('User')
       expect(Puppet::Util::Windows::ADSI::User.exists?(domain_username)).to be_truthy
     end
 
     it "should be able to confirm the existence of a user with a well-known SID" do
-
-      system_user = Win32::Security::SID::LocalSystem
+      system_user = Puppet::Util::Windows::SID::LocalSystem
       # ensure that the underlying OS is queried here
       Puppet::Util::Windows::ADSI.unstub(:connect)
       expect(Puppet::Util::Windows::ADSI::User.exists?(system_user)).to be_truthy
     end
 
+    it "should return false with a well-known Group SID" do
+      group = Puppet::Util::Windows::SID::BuiltinAdministrators
+      # ensure that the underlying OS is queried here
+      Puppet::Util::Windows::ADSI.unstub(:connect)
+      expect(Puppet::Util::Windows::ADSI::User.exists?(group)).to be_falsey
+    end
+
     it "should return nil with an unknown SID" do
 
       bogus_sid = 'S-1-2-3-4'
@@ -130,8 +148,6 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should return an enumeration of IADsUser wrapped objects" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
-
       name = 'Administrator'
       wmi_users = [stub('WMI', :name => name)]
       Puppet::Util::Windows::ADSI.expects(:execquery).with('select name from win32_useraccount where localaccount = "TRUE"').returns(wmi_users)
@@ -183,6 +199,19 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         user.password = 'pwd'
       end
 
+       it "should be able manage a user without a password" do
+        adsi_user.expects(:SetPassword).with('pwd').never
+        adsi_user.expects(:SetInfo).at_least_once
+
+        flagname = "UserFlags"
+        fADS_UF_DONT_EXPIRE_PASSWD = 0x10000
+
+        adsi_user.expects(:Get).with(flagname).returns(0)
+        adsi_user.expects(:Put).with(flagname, fADS_UF_DONT_EXPIRE_PASSWD)
+
+        user.password = nil
+      end
+
       it "should generate the correct URI" do
         Puppet::Util::Windows::SID.stubs(:octet_string_to_sid_object).returns(sid)
         expect(user.uri).to eq("WinNT://testcomputername/#{username},user")
@@ -190,20 +219,20 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
 
       describe "when given a set of groups to which to add the user" do
         let(:existing_groups) { ['group2','group3'] }
-        let(:group_sids) { existing_groups.each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i])} }
+        let(:group_sids) { existing_groups.each_with_index.map{|n,i| stub(:Name => n, :objectSID => stub(:sid => i))} }
 
         let(:groups_to_set) { 'group1,group2' }
-        let(:desired_sids) { groups_to_set.split(',').each_with_index.map{|n,i| stub(:Name => n, :objectSID => [i-1])} }
+        let(:desired_sids) { groups_to_set.split(',').each_with_index.map{|n,i| stub(:Name => n, :objectSID => stub(:sid => i-1))} }
 
         before(:each) do
-          user.expects(:group_sids).returns(group_sids.map {|s| s.objectSID})
+          user.expects(:group_sids).returns(group_sids.map {|s| s.objectSID })
         end
 
         describe "if membership is specified as inclusive" do
           it "should add the user to those groups, and remove it from groups not in the list" do
-            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns(Hash[ desired_sids.map { |s| [s.objectSID.to_s, s.objectSID] }])
-            user.expects(:add_group_sids).with([-1])
-            user.expects(:remove_group_sids).with([1])
+            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns(Hash[ desired_sids.map { |s| [s.objectSID.sid, s.objectSID] }])
+            user.expects(:add_group_sids).with { |value| value.sid == -1 }
+            user.expects(:remove_group_sids).with { |value| value.sid == 1 }
 
             user.set_groups(groups_to_set, false)
           end
@@ -211,7 +240,7 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
           it "should remove all users from a group if desired is empty" do
             Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns({})
             user.expects(:add_group_sids).never
-            user.expects(:remove_group_sids).with([0], [1])
+            user.expects(:remove_group_sids).with { |user1, user2| user1.sid == 0 && user2.sid == 1 }
 
             user.set_groups('', false)
           end
@@ -219,8 +248,8 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
 
         describe "if membership is specified as minimum" do
           it "should add the user to the specified groups without affecting its other memberships" do
-            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns(Hash[ desired_sids.map { |s| [s.objectSID.to_s, s.objectSID] }])
-            user.expects(:add_group_sids).with([-1])
+            Puppet::Util::Windows::ADSI::User.expects(:name_sid_hash).returns(Hash[ desired_sids.map { |s| [s.objectSID.sid, s.objectSID] }])
+            user.expects(:add_group_sids).with { |value| value.sid == -1 }
             user.expects(:remove_group_sids).never
 
             user.set_groups(groups_to_set, true)
@@ -257,7 +286,7 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         end
 
         it "and raise when passed a non-SID object to add" do
-          expect{ group.add_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID object/)
+          expect{ group.add_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID::Principal/)
         end
 
         it "to remove a member" do
@@ -267,7 +296,7 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         end
 
         it "and raise when passed a non-SID object to remove" do
-          expect{ group.remove_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID object/)
+          expect{ group.remove_member_sids(invalid)}.to raise_error(Puppet::Error, /Must use a valid SID::Principal/)
         end
       end
 
@@ -285,9 +314,9 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         it "should set the members of a group to only desired_members when inclusive" do
           names = ['DOMAIN\user1', 'user2']
           sids = [
-              stub(:account => 'user1', :domain => 'DOMAIN'),
-              stub(:account => 'user2', :domain => 'testcomputername'),
-              stub(:account => 'user3', :domain => 'DOMAIN2'),
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2),
+              stub(:account => 'user3', :domain => 'DOMAIN2', :sid => 3),
           ]
 
           # use stubbed objectSid on member to return stubbed SID
@@ -312,9 +341,9 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         it "should add the desired_members to an existing group when not inclusive" do
           names = ['DOMAIN\user1', 'user2']
           sids = [
-              stub(:account => 'user1', :domain => 'DOMAIN'),
-              stub(:account => 'user2', :domain => 'testcomputername'),
-              stub(:account => 'user3', :domain => 'DOMAIN2'),
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2),
+              stub(:account => 'user3', :domain => 'DOMAIN2', :sid => 3),
           ]
 
           # use stubbed objectSid on member to return stubbed SID
@@ -348,8 +377,8 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         it "should remove all members when desired_members is empty and inclusive" do
           names = ['DOMAIN\user1', 'user2']
           sids = [
-              stub(:account => 'user1', :domain => 'DOMAIN'),
-              stub(:account => 'user2', :domain => 'testcomputername')
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1 ),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2 ),
           ]
 
           # use stubbed objectSid on member to return stubbed SID
@@ -371,8 +400,8 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
         it "should do nothing when desired_members is empty and not inclusive" do
           names = ['DOMAIN\user1', 'user2']
           sids = [
-              stub(:account => 'user1', :domain => 'DOMAIN'),
-              stub(:account => 'user2', :domain => 'testcomputername')
+              stub(:account => 'user1', :domain => 'DOMAIN', :sid => 1 ),
+              stub(:account => 'user2', :domain => 'testcomputername', :sid => 2 ),
           ]
           # use stubbed objectSid on member to return stubbed SID
           Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(sids[0])
@@ -396,19 +425,26 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
       end
 
       it "should generate the correct URI" do
-        Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
         adsi_group.expects(:objectSID).returns([0])
-        Socket.expects(:gethostname).returns('testcomputername')
-        Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(stub(:account => groupname,:domain => 'testcomputername'))
+        Socket.expects(:gethostname).returns('TESTcomputerNAME')
+        computer_sid = stub(:account => groupname,:domain => 'testcomputername')
+        Puppet::Util::Windows::SID.expects(:octet_string_to_sid_object).with([0]).returns(computer_sid)
         expect(group.uri).to eq("WinNT://./#{groupname},group")
       end
     end
 
     it "should generate the correct URI" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
       expect(Puppet::Util::Windows::ADSI::Group.uri("people")).to eq("WinNT://./people,group")
     end
 
+    it "should generate the correct URI for a BUILTIN group" do
+      expect(Puppet::Util::Windows::ADSI::Group.uri(groupname, builtin_localized)).to eq("WinNT://./#{groupname},group")
+    end
+
+    it "should generate the correct URI for a NT AUTHORITY group" do
+      expect(Puppet::Util::Windows::ADSI::Group.uri(groupname, ntauthority_localized)).to eq("WinNT://./#{groupname},group")
+    end
+
     it "should be able to create a group" do
       adsi_group = stub("adsi")
 
@@ -422,20 +458,28 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should be able to confirm the existence of a group" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
+      Puppet::Util::Windows::SID.expects(:name_to_sid_object).with(groupname).returns nil
       Puppet::Util::Windows::ADSI.expects(:connect).with("WinNT://./#{groupname},group").returns connection
+      connection.expects(:Class).returns('Group')
 
       expect(Puppet::Util::Windows::ADSI::Group.exists?(groupname)).to be_truthy
     end
 
     it "should be able to confirm the existence of a group with a well-known SID" do
 
-      service_group = Win32::Security::SID::Service
+      service_group = Puppet::Util::Windows::SID::Service
       # ensure that the underlying OS is queried here
       Puppet::Util::Windows::ADSI.unstub(:connect)
       expect(Puppet::Util::Windows::ADSI::Group.exists?(service_group)).to be_truthy
     end
 
+    it "will return true with a well-known User SID, as there is no way to resolve it with a WinNT:// style moniker" do
+      user = Puppet::Util::Windows::SID::NtLocal
+      # ensure that the underlying OS is queried here
+      Puppet::Util::Windows::ADSI.unstub(:connect)
+      expect(Puppet::Util::Windows::ADSI::Group.exists?(user)).to be_truthy
+    end
+
     it "should return nil with an unknown SID" do
 
       bogus_sid = 'S-1-2-3-4'
@@ -451,8 +495,6 @@ describe Puppet::Util::Windows::ADSI, :if => Puppet.features.microsoft_windows?
     end
 
     it "should return an enumeration of IADsGroup wrapped objects" do
-      Puppet::Util::Windows::ADSI.stubs(:sid_uri_safe).returns(nil)
-
       name = 'Administrators'
       wmi_groups = [stub('WMI', :name => name)]
       Puppet::Util::Windows::ADSI.expects(:execquery).with('select name from win32_group where localaccount = "TRUE"').returns(wmi_groups)

data/spec/unit/util/windows/api_types_spec.rb

@@ -25,4 +25,46 @@ describe "FFI::MemoryPointer", :if => Puppet.features.microsoft_windows? do
       expect(read_string.encoding).to eq(Encoding::UTF_8)
     end
   end
+
+  context "read_arbitrary_wide_string_up_to" do
+    let (:string) { "foo_bar" }
+    let (:single_null_string) { string + "\x00" }
+    let (:double_null_string) { string + "\x00\x00" }
+
+    it "should read a short single null terminated string" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(single_null_string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to()
+      end
+
+      expect(read_string).to eq(string)
+    end
+
+    it "should read a short double null terminated string" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(double_null_string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to(512, :double_null)
+      end
+
+      expect(read_string).to eq(string)
+    end
+
+    it "should return a string of max_length characters when specified" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(single_null_string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to(3)
+      end
+
+      expect(read_string).to eq(string[0..2])
+    end
+
+    it "should return wide strings in UTF-8" do
+      read_string = nil
+      FFI::MemoryPointer.from_string_to_wide_string(string) do |ptr|
+        read_string = ptr.read_arbitrary_wide_string_up_to()
+      end
+
+      expect(read_string.encoding).to eq(Encoding::UTF_8)
+    end
+  end
 end

data/spec/unit/util/windows/file_spec.rb

@@ -0,0 +1,89 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet/util/windows'
+
+describe Puppet::Util::Windows::File, :if => Puppet::Util::Platform.windows? do
+  include PuppetSpec::Files
+
+  let(:nonexist_file) { 'C:\foo.bar' }
+  let(:nonexist_path) { 'C:\somefile\that\wont\ever\exist' }
+  let(:invalid_file_attributes) { 0xFFFFFFFF } #define INVALID_FILE_ATTRIBUTES (DWORD (-1))
+
+  describe "get_attributes" do
+    it "should raise an error for files that do not exist by default" do
+      expect {
+        described_class.get_attributes(nonexist_file)
+      }.to raise_error(Puppet::Error, /GetFileAttributes/)
+    end
+
+    it "should raise an error for files that do not exist when specified" do
+      expect {
+        described_class.get_attributes(nonexist_file, true)
+      }.to raise_error(Puppet::Error, /GetFileAttributes/)
+    end
+
+    it "should not raise an error for files that do not exist when specified" do
+      expect {
+        described_class.get_attributes(nonexist_file, false)
+      }.not_to raise_error
+    end
+
+    it "should return INVALID_FILE_ATTRIBUTES for files that do not exist when specified" do
+      expect(described_class.get_attributes(nonexist_file, false)).to eq(invalid_file_attributes)
+    end
+  end
+
+  describe "get_long_pathname" do
+    it "should raise an ERROR_FILE_NOT_FOUND for a file that does not exist in a valid path" do
+      expect {
+        described_class.get_long_pathname(nonexist_file)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(Puppet::Util::Windows::File::ERROR_FILE_NOT_FOUND)
+      end
+    end
+
+    it "should raise an ERROR_PATH_NOT_FOUND for a path that does not exist" do
+      expect {
+        described_class.get_long_pathname(nonexist_path)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(Puppet::Util::Windows::File::ERROR_PATH_NOT_FOUND)
+      end
+    end
+
+    it "should return the fully expanded path 'Program Files' given 'Progra~1'" do
+      # this test could be resolve some of these values at runtime rather than hard-coding
+      shortened = ENV['SystemDrive'] + '\\Progra~1'
+      expanded = ENV['SystemDrive'] + '\\Program Files'
+      expect(described_class.get_long_pathname(shortened)).to eq (expanded)
+    end
+  end
+
+  describe "get_short_pathname" do
+    it "should raise an ERROR_FILE_NOT_FOUND for a file that does not exist in a valid path" do
+      expect {
+        described_class.get_short_pathname(nonexist_file)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(Puppet::Util::Windows::File::ERROR_FILE_NOT_FOUND)
+      end
+    end
+
+    it "should raise an ERROR_PATH_NOT_FOUND for a path that does not exist" do
+      expect {
+        described_class.get_short_pathname(nonexist_path)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(Puppet::Util::Windows::File::ERROR_PATH_NOT_FOUND)
+      end
+    end
+
+    it "should return the shortened 'PROGRA~1' given fully expanded path 'Program Files'" do
+      # this test could be resolve some of these values at runtime rather than hard-coding
+      expanded = ENV['SystemDrive'] + '\\Program Files'
+      shortened = ENV['SystemDrive'] + '\\PROGRA~1'
+      expect(described_class.get_short_pathname(expanded)).to eq (shortened)
+    end
+  end
+end

data/spec/unit/util/windows/security_descriptor_spec.rb

@@ -4,9 +4,9 @@ require 'spec_helper'
 require 'puppet/util/windows'
 
 describe "Puppet::Util::Windows::SecurityDescriptor", :if => Puppet.features.microsoft_windows? do
-  let(:system_sid) { Win32::Security::SID::LocalSystem }
-  let(:admins_sid) { Win32::Security::SID::BuiltinAdministrators }
-  let(:group_sid) { Win32::Security::SID::Nobody }
+  let(:system_sid) { Puppet::Util::Windows::SID::LocalSystem }
+  let(:admins_sid) { Puppet::Util::Windows::SID::BuiltinAdministrators }
+  let(:group_sid) { Puppet::Util::Windows::SID::Nobody }
   let(:new_sid)   { 'S-1-5-32-500-1-2-3' }
 
   def empty_dacl

data/spec/unit/util/windows/sid_spec.rb

@@ -7,18 +7,23 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
   end
 
   let(:subject)      { Puppet::Util::Windows::SID }
-  let(:sid)          { Win32::Security::SID::LocalSystem }
+  let(:sid)          { Puppet::Util::Windows::SID::LocalSystem }
   let(:invalid_sid)  { 'bogus' }
   let(:unknown_sid)  { 'S-0-0-0' }
+  let(:null_sid)     { 'S-1-0-0' }
   let(:unknown_name) { 'chewbacca' }
 
   context "#octet_string_to_sid_object" do
-    it "should properly convert an array of bytes for a well-known SID" do
-      bytes = [1, 1, 0, 0, 0, 0, 0, 5, 18, 0, 0, 0]
+    it "should properly convert an array of bytes for a well-known non-localized SID" do
+      bytes = [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
       converted = subject.octet_string_to_sid_object(bytes)
 
-      expect(converted).to eq(Win32::Security::SID.new('SYSTEM'))
-      expect(converted).to be_an_instance_of Win32::Security::SID
+      expect(converted).to be_an_instance_of Puppet::Util::Windows::SID::Principal
+      expect(converted.sid_bytes).to eq(bytes)
+      expect(converted.sid).to eq(null_sid)
+
+      # carefully select a SID here that is not localized on international Windows
+      expect(converted.account).to eq('NULL SID')
     end
 
     it "should raise an error for non-array input" do
@@ -33,11 +38,25 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
       }.to raise_error(Puppet::Error, /Octet string must be an array of bytes/)
     end
 
+    it "should raise an error for a valid byte array with no mapping to a user" do
+      expect {
+        # S-1-1-1 which is not a valid account
+        valid_octet_invalid_user =[1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0]
+        subject.octet_string_to_sid_object(valid_octet_invalid_user)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(1332) # ERROR_NONE_MAPPED
+      end
+    end
+
     it "should raise an error for a malformed byte array" do
       expect {
-        invalid_octet = [1]
+        invalid_octet = [2]
         subject.octet_string_to_sid_object(invalid_octet)
-      }.to raise_error(SystemCallError, /No mapping between account names and security IDs was done./)
+      }.to raise_error do |error|
+        expect(error).to be_a(Puppet::Util::Windows::Error)
+        expect(error.code).to eq(87) # ERROR_INVALID_PARAMETER
+      end
     end
   end
 
@@ -47,16 +66,18 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should accept unqualified account name" do
+      # NOTE: lookup by name works in localized environments only for a few instances
+      # this works in French Windows, even though the account is really Syst\u00E8me
       expect(subject.name_to_sid('SYSTEM')).to eq(sid)
     end
 
     it "should return a SID for a passed user or group name" do
-      subject.expects(:name_to_sid_object).with('testers').returns 'S-1-5-32-547'
+      subject.expects(:name_to_sid_object).with('testers').returns stub(:sid => 'S-1-5-32-547')
       expect(subject.name_to_sid('testers')).to eq('S-1-5-32-547')
     end
 
     it "should return a SID for a passed fully-qualified user or group name" do
-      subject.expects(:name_to_sid_object).with('MACHINE\testers').returns 'S-1-5-32-547'
+      subject.expects(:name_to_sid_object).with('MACHINE\testers').returns stub(:sid => 'S-1-5-32-547')
       expect(subject.name_to_sid('MACHINE\testers')).to eq('S-1-5-32-547')
     end
 
@@ -69,12 +90,42 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should accept domain qualified account names" do
+      # NOTE: lookup by name works in localized environments only for a few instances
+      # this works in French Windows, even though the account is really AUTORITE NT\\Syst\u00E8me
       expect(subject.name_to_sid('NT AUTHORITY\SYSTEM')).to eq(sid)
     end
 
     it "should be the identity function for any sid" do
       expect(subject.name_to_sid(sid)).to eq(sid)
     end
+
+    describe "with non-US languages" do
+
+      UMLAUT = [195, 164].pack('c*').force_encoding(Encoding::UTF_8)
+      let(:username) { SecureRandom.uuid.to_s.gsub(/\-/, '')[0..13] + UMLAUT }
+
+      after(:each) {
+        Puppet::Util::Windows::ADSI::User.delete(username)
+      }
+
+      it "should properly resolve a username with an umlaut" do
+        # Ruby seems to use the local codepage when making COM calls
+        # if this fails, might want to use Windows API directly instead to ensure bytes
+        user = Puppet::Util::Windows::ADSI.create(username, 'user')
+        user.SetPassword('PUPPET_RULeZ_123!')
+        user.SetInfo()
+
+        # compare the new SID to the name_to_sid result
+        sid_bytes = user.objectSID.to_a
+        sid_string = ''
+        FFI::MemoryPointer.new(:byte, sid_bytes.length) do |sid_byte_ptr|
+          sid_byte_ptr.write_array_of_uchar(sid_bytes)
+          sid_string = Puppet::Util::Windows::SID.sid_ptr_to_string(sid_byte_ptr)
+        end
+
+        expect(subject.name_to_sid(username)).to eq(sid_string)
+      end
+    end
   end
 
   context "#name_to_sid_object" do
@@ -82,24 +133,32 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
       expect(subject.name_to_sid_object(unknown_name)).to be_nil
     end
 
-    it "should return a Win32::Security::SID instance for any valid sid" do
-      expect(subject.name_to_sid_object(sid)).to be_an_instance_of(Win32::Security::SID)
+    it "should return a Puppet::Util::Windows::SID::Principal instance for any valid sid" do
+      expect(subject.name_to_sid_object(sid)).to be_an_instance_of(Puppet::Util::Windows::SID::Principal)
     end
 
     it "should accept unqualified account name" do
-      expect(subject.name_to_sid_object('SYSTEM').to_s).to eq(sid)
+      # NOTE: lookup by name works in localized environments only for a few instances
+      # this works in French Windows, even though the account is really Syst\u00E8me
+      expect(subject.name_to_sid_object('SYSTEM').sid).to eq(sid)
     end
 
     it "should be case-insensitive" do
+      # NOTE: lookup by name works in localized environments only for a few instances
+      # this works in French Windows, even though the account is really Syst\u00E8me
       expect(subject.name_to_sid_object('SYSTEM')).to eq(subject.name_to_sid_object('system'))
     end
 
     it "should be leading and trailing whitespace-insensitive" do
+      # NOTE: lookup by name works in localized environments only for a few instances
+      # this works in French Windows, even though the account is really Syst\u00E8me
       expect(subject.name_to_sid_object('SYSTEM')).to eq(subject.name_to_sid_object(' SYSTEM '))
     end
 
     it "should accept domain qualified account names" do
-      expect(subject.name_to_sid_object('NT AUTHORITY\SYSTEM').to_s).to eq(sid)
+      # NOTE: lookup by name works in localized environments only for a few instances
+      # this works in French Windows, even though the account is really AUTORITE NT\\Syst\u00E8me
+      expect(subject.name_to_sid_object('NT AUTHORITY\SYSTEM').sid).to eq(sid)
     end
   end
 
@@ -109,7 +168,10 @@ describe "Puppet::Util::Windows::SID", :if => Puppet.features.microsoft_windows?
     end
 
     it "should accept a sid" do
-      expect(subject.sid_to_name(sid)).to eq("NT AUTHORITY\\SYSTEM")
+      # choose a value that is not localized, for instance
+      # S-1-5-18 can be NT AUTHORITY\\SYSTEM or AUTORITE NT\\Syst\u00E8me
+      # but NULL SID appears universal
+      expect(subject.sid_to_name(null_sid)).to eq('NULL SID')
     end
   end
 

data/spec/unit/util/yaml_spec.rb

@@ -47,8 +47,20 @@ describe Puppet::Util::Yaml do
     end
   end
 
+  it "should allow one to strip ruby tags that would otherwise not parse" do
+    write_file(filename, "---\nweirddata: !ruby/hash:Not::A::Valid::Class {}")
+
+    expect(Puppet::Util::Yaml.load_file(filename, {}, true)).to eq({"weirddata" => {}})
+  end
+
+  it "should not strip non-ruby tags" do
+    write_file(filename, "---\nweirddata: !binary |-\n          e21kNX04MTE4ZGY2NmM5MTc3OTg4ZWE4Y2JiOWEzMjMyNzFkYg==")
+
+    expect(Puppet::Util::Yaml.load_file(filename, {}, true)).to eq({"weirddata" => "{md5}8118df66c9177988ea8cbb9a323271db"})
+  end
+
   def write_file(name, contents)
-    File.open(name, "w") do |fh|
+    File.open(name, "w:UTF-8") do |fh|
       fh.write(contents)
     end
   end