puppet 5.3.4 → 6.29.0

data/spec/unit/provider/user/useradd_spec.rb

@@ -1,14 +1,19 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
-describe Puppet::Type.type(:user).provider(:useradd) do
+RSpec::Matchers.define_negated_matcher :excluding, :include
 
+describe Puppet::Type.type(:user).provider(:useradd) do
   before :each do
-    described_class.stubs(:command).with(:password).returns '/usr/bin/chage'
-    described_class.stubs(:command).with(:add).returns '/usr/sbin/useradd'
-    described_class.stubs(:command).with(:localadd).returns '/usr/sbin/luseradd'
-    described_class.stubs(:command).with(:modify).returns '/usr/sbin/usermod'
-    described_class.stubs(:command).with(:delete).returns '/usr/sbin/userdel'
+    allow(Puppet::Util::POSIX).to receive(:groups_of).and_return([])
+    allow(described_class).to receive(:command).with(:password).and_return('/usr/bin/chage')
+    allow(described_class).to receive(:command).with(:localpassword).and_return('/usr/sbin/lchage')
+    allow(described_class).to receive(:command).with(:add).and_return('/usr/sbin/useradd')
+    allow(described_class).to receive(:command).with(:localadd).and_return('/usr/sbin/luseradd')
+    allow(described_class).to receive(:command).with(:modify).and_return('/usr/sbin/usermod')
+    allow(described_class).to receive(:command).with(:localmodify).and_return('/usr/sbin/lusermod')
+    allow(described_class).to receive(:command).with(:delete).and_return('/usr/sbin/userdel')
+    allow(described_class).to receive(:command).with(:localdelete).and_return('/usr/sbin/luserdel')
+    allow(described_class).to receive(:command).with(:chpasswd).and_return('/usr/sbin/chpasswd')
   end
 
   let(:resource) do
@@ -22,7 +27,6 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
   let(:provider) { described_class.new(:name => 'myuser') }
 
-
   let(:shadow_entry) {
     return unless Puppet.features.libshadow?
     entry = Struct::PasswdEntry.new
@@ -38,37 +42,61 @@ describe Puppet::Type.type(:user).provider(:useradd) do
   }
 
   describe "#create" do
-
     before do
-      provider.stubs(:exists?).returns(false)
+      allow(provider).to receive(:exists?).and_return(false)
     end
 
-    it "should add -g when no gid is specified and group already exists" do
-      Puppet::Util.stubs(:gid).returns(true)
+    it "should not redact the command from debug logs if there is no password" do
+      described_class.has_feature :manages_passwords
       resource[:ensure] = :present
-      provider.expects(:execute).with(includes('-g'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
       provider.create
     end
 
-    it "should use -G to set groups" do
-      Facter.stubs(:value).with(:osfamily).returns('Not RedHat')
-      resource[:ensure] = :present
-      resource[:groups] = ['group1', 'group2']
-      provider.expects(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
+    it "should redact the command from debug logs if there is a password" do
+      described_class.has_feature :manages_passwords
+      resource2 = Puppet::Type.type(:user).new(
+        :name       => 'myuser',
+        :password   => 'a pass word',
+        :managehome => :false,
+        :system     => :false,
+        :provider   => provider,
+      )
+      resource2[:ensure] = :present
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true)).twice
       provider.create
     end
 
-    it "should use -G to set groups without -M on RedHat" do
-      Facter.stubs(:value).with(:osfamily).returns('RedHat')
+    it "should add -g when no gid is specified and group already exists" do
+      allow(Puppet::Util).to receive(:gid).and_return(true)
       resource[:ensure] = :present
-      resource[:groups] = ['group1', 'group2']
-      provider.expects(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
+      expect(provider).to receive(:execute).with(include('-g'), kind_of(Hash))
       provider.create
     end
 
+    context "when setting groups" do
+      it "uses -G to set groups" do
+        allow(Facter).to receive(:value).with(:osfamily).and_return('Solaris')
+        allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+
+      it "uses -G to set groups with -M on supported systems" do
+        allow(Facter).to receive(:value).with(:osfamily).and_return('RedHat')
+        allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+    end
+
     it "should add -o when allowdupe is enabled and the user is being created" do
       resource[:allowdupe] = true
-      provider.expects(:execute).with(includes('-o'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(include('-o'), kind_of(Hash))
       provider.create
     end
 
@@ -76,7 +104,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       it "should add -r when system is enabled" do
         resource[:system] = :true
         expect(provider).to be_system_users
-        provider.expects(:execute).with(includes('-r'), kind_of(Hash))
+        expect(provider).to receive(:execute).with(include('-r'), kind_of(Hash))
         provider.create
       end
     end
@@ -85,7 +113,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       it "should not add -r when system is enabled" do
         resource[:system] = :true
         expect(provider).not_to be_system_users
-        provider.expects(:execute).with(['/usr/sbin/useradd', 'myuser'], kind_of(Hash))
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', 'myuser'], kind_of(Hash))
         provider.create
       end
     end
@@ -94,104 +122,374 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       described_class.has_feature :manages_password_age
       resource[:password_min_age] = 5
       resource[:password_max_age] = 10
-      provider.expects(:execute).with(includes('/usr/sbin/useradd'), kind_of(Hash))
-      provider.expects(:execute).with(['/usr/bin/chage', '-m', 5, '-M', 10, 'myuser'])
+      resource[:password_warn_days] = 15
+      expect(provider).to receive(:execute).with(include('/usr/sbin/useradd'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(['/usr/bin/chage', '-m', 5, '-M', 10, '-W', 15, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
       provider.create
     end
 
     describe "on systems with the libuser and forcelocal=true" do
       before do
-         described_class.has_feature :libuser
+         described_class.has_feature :manages_local_users_and_groups
          resource[:forcelocal] = true
       end
+
       it "should use luseradd instead of useradd" do
-        provider.expects(:execute).with(includes('/usr/sbin/luseradd'), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
         provider.create
       end
 
       it "should NOT use -o when allowdupe=true" do
         resource[:allowdupe] = :true
-        provider.expects(:execute).with(Not(includes('-o')), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(excluding('-o'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
         provider.create
       end
 
       it "should raise an exception for duplicate UIDs" do
         resource[:uid] = 505
-        provider.stubs(:finduser).returns(true)
+        allow(provider).to receive(:finduser).and_return(true)
         expect { provider.create }.to raise_error(Puppet::Error, "UID 505 already exists, use allowdupe to force user creation")
       end
 
       it "should not use -G for luseradd and should call usermod with -G after luseradd when groups property is set" do
         resource[:groups] = ['group1', 'group2']
-        provider.expects(:execute).with(Not(includes("-G")), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
-        provider.expects(:execute).with(includes('/usr/sbin/usermod'))
+        allow(provider).to receive(:localgroups)
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd').and(excluding('-G')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(include('/usr/sbin/usermod').and(include('-G')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
         provider.create
       end
 
       it "should not use -m when managehome set" do
         resource[:managehome] = :true
-        provider.expects(:execute).with(Not(includes('-m')), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(excluding('-m'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
         provider.create
       end
 
       it "should not use -e with luseradd, should call usermod with -e after luseradd when expiry is set" do
         resource[:expiry] = '2038-01-24'
-        provider.expects(:execute).with(all_of(includes('/usr/sbin/luseradd'), Not(includes('-e'))), has_entry(:custom_environment, has_key('LIBUSER_CONF')))
-        provider.expects(:execute).with(all_of(includes('/usr/sbin/usermod'), includes('-e')))
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd').and(excluding('-e')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(include('/usr/sbin/usermod').and(include('-e')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
         provider.create
       end
 
-      it "should use userdel to delete users" do
-        resource[:ensure] = :absent
-        provider.stubs(:exists?).returns(true)
-        provider.expects(:execute).with(includes('/usr/sbin/userdel'))
-        provider.delete
+      it 'should set password age rules locally' do
+        described_class.has_feature :manages_password_age
+        resource[:password_min_age] = 5
+        resource[:password_max_age] = 10
+        resource[:password_warn_days] = 15
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-m', 5, '-M', 10, '-W', 15, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
       end
     end
 
     describe "on systems that allow to set shell" do
       it "should trigger shell validation" do
         resource[:shell] = '/bin/bash'
-        provider.expects(:check_valid_shell)
-        provider.expects(:execute).with(includes('-s'), kind_of(Hash))
+        expect(provider).to receive(:check_valid_shell)
+        expect(provider).to receive(:execute).with(include('-s'), kind_of(Hash))
         provider.create
       end
     end
+  end
+
+  describe 'when modifying the password' do
+    before do
+      described_class.has_feature :manages_local_users_and_groups
+      described_class.has_feature :manages_passwords
+      #Setting any resource value here initializes needed variables and methods in the resource and provider
+      #Setting a password value here initializes the existence and management of the password parameter itself
+      #Otherwise, this value would not need to be initialized for the test
+      resource[:password] = ''
+    end
+
+    it "should not call execute with sensitive if non-sensitive data is changed" do
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
+      provider.home = 'foo/bar'
+    end
+
+    it "should call execute with sensitive if sensitive data is changed" do
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true)).and_return('')
+      provider.password = 'bird bird bird'
+    end
+  end
+
+  describe '#modify' do
+    describe "on systems with the libuser and forcelocal=false" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = false
+      end
+
+      it "should use usermod" do
+        expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-u', 150, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.uid = 150
+      end
+
+      it "should use -o when allowdupe=true" do
+        resource[:allowdupe] = :true
+        expect(provider).to receive(:execute).with(include('-o'), hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.uid = 505
+      end
+
+      it 'should use chage for password_min_age' do
+        expect(provider).to receive(:execute).with(['/usr/bin/chage', '-m', 100, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.password_min_age = 100
+      end
+
+      it 'should use chage for password_max_age' do
+        expect(provider).to receive(:execute).with(['/usr/bin/chage', '-M', 101, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.password_max_age = 101
+      end
+
+      it 'should use chage for password_warn_days' do
+        expect(provider).to receive(:execute).with(['/usr/bin/chage', '-W', 99, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.password_warn_days = 99
+      end
+
+      it 'should not call check_allow_dup if not modifying the uid' do
+        expect(provider).not_to receive(:check_allow_dup)
+        expect(provider).to receive(:execute)
+        provider.home = 'foo/bar'
+      end
+    end
+
+    describe "on systems with the libuser and forcelocal=true" do
+      before do
+         described_class.has_feature :libuser
+         resource[:forcelocal] = true
+      end
+
+      it "should use lusermod and not usermod" do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lusermod', '-u', 150, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.uid = 150
+      end
+
+      it "should NOT use -o when allowdupe=true" do
+        resource[:allowdupe] = :true
+        expect(provider).to receive(:execute).with(excluding('-o'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.uid = 505
+      end
+
+      it "should raise an exception for duplicate UIDs" do
+        resource[:uid] = 505
+        allow(provider).to receive(:finduser).and_return(true)
+        expect { provider.uid = 505 }.to raise_error(Puppet::Error, "UID 505 already exists, use allowdupe to force user creation")
+      end
+
+      it 'should use lchage for password_warn_days' do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-W', 99, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.password_warn_days = 99
+      end
 
+      it 'should use lchage for password_min_age' do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-m', 100, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.password_min_age = 100
+      end
+
+      it 'should use lchage for password_max_age' do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-M', 101, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.password_max_age = 101
+      end
+    end
   end
 
   describe "#uid=" do
     it "should add -o when allowdupe is enabled and the uid is being modified" do
       resource[:allowdupe] = :true
-      provider.expects(:execute).with(['/usr/sbin/usermod', '-u', 150, '-o', 'myuser'])
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-u', 150, '-o', 'myuser'], hash_including(custom_environment: {}))
       provider.uid = 150
     end
   end
 
   describe "#expiry=" do
     it "should pass expiry to usermod as MM/DD/YY when on Solaris" do
-      Facter.expects(:value).with(:operatingsystem).returns 'Solaris'
+      expect(Facter).to receive(:value).with(:operatingsystem).and_return('Solaris')
       resource[:expiry] = '2012-10-31'
-      provider.expects(:execute).with(['/usr/sbin/usermod', '-e', '10/31/2012', 'myuser'])
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '10/31/2012', 'myuser'], hash_including(custom_environment: {}))
       provider.expiry = '2012-10-31'
     end
 
     it "should pass expiry to usermod as YYYY-MM-DD when not on Solaris" do
-      Facter.expects(:value).with(:operatingsystem).returns 'not_solaris'
+      expect(Facter).to receive(:value).with(:operatingsystem).and_return('not_solaris')
       resource[:expiry] = '2012-10-31'
-      provider.expects(:execute).with(['/usr/sbin/usermod', '-e', '2012-10-31', 'myuser'])
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '2012-10-31', 'myuser'], hash_including(custom_environment: {}))
       provider.expiry = '2012-10-31'
     end
 
     it "should use -e with an empty string when the expiry property is removed" do
       resource[:expiry] = :absent
-      provider.expects(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'])
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = :absent
+    end
+
+    it "should use -e with -1 when the expiry property is removed on SLES11" do
+      allow(Facter).to receive(:value).with(:operatingsystem).and_return('SLES')
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return('11')
+      resource[:expiry] = :absent
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', -1, 'myuser'], hash_including(custom_environment: {}))
       provider.expiry = :absent
     end
   end
 
-  describe "#check_allow_dup" do
+  describe "#comment" do
+    before { described_class.has_feature :manages_local_users_and_groups }
 
+    let(:content) { "myuser:x:x:x:local comment:x:x" }
+
+    it "should return the local comment string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.comment).to eq('local comment')
+    end
+
+    it "should fall back to nameservice comment string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:comment).and_return('remote comment')
+      expect(provider).not_to receive(:localcomment)
+      expect(provider.comment).to eq('remote comment')
+    end
+  end
+
+  describe "#shell" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:x:x:x:/bin/local_shell" }
+
+    it "should return the local shell string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.shell).to eq('/bin/local_shell')
+    end
+
+    it "should fall back to nameservice shell string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:shell).and_return('/bin/remote_shell')
+      expect(provider).not_to receive(:localshell)
+      expect(provider.shell).to eq('/bin/remote_shell')
+    end
+  end
+
+  describe "#home" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:x:x:/opt/local_home:x" }
+
+    it "should return the local home string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.home).to eq('/opt/local_home')
+    end
+
+    it "should fall back to nameservice home string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:home).and_return('/opt/remote_home')
+      expect(provider).not_to receive(:localhome)
+      expect(provider.home).to eq('/opt/remote_home')
+    end
+  end
+
+  describe "#gid" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:999:x:x:x" }
+
+    it "should return the local GID when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.gid).to eq(999)
+    end
+
+    it "should fall back to nameservice GID when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:gid).and_return(1234)
+      expect(provider).not_to receive(:localgid)
+      expect(provider.gid).to eq(1234)
+    end
+  end
+
+  describe "#groups" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) do
+      StringIO.new(<<~EOF)
+      group1:x:0:myuser
+      group2:x:999:
+      group3:x:998:myuser
+      EOF
+    end
+
+    let(:content_with_empty_line) do
+      StringIO.new(<<~EOF)
+      group1:x:0:myuser
+      group2:x:999:
+      group3:x:998:myuser
+
+      EOF
+    end
+
+    it "should return the local groups string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/group').and_return(true)
+      allow(File).to receive(:open).with(Pathname.new('/etc/group')).and_yield(content)
+      expect(provider.groups).to eq(['group1', 'group3'])
+    end
+
+    it "does not raise when parsing empty lines in /etc/group" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/group').and_return(true)
+      allow(File).to receive(:open).with(Pathname.new('/etc/group')).and_yield(content_with_empty_line)
+      expect { provider.groups }.not_to raise_error
+    end
+
+    it "should fall back to nameservice groups when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(Puppet::Util::POSIX).to receive(:groups_of).with('myuser').and_return(['remote groups'])
+      expect(provider).not_to receive(:localgroups)
+      expect(provider.groups).to eq('remote groups')
+    end
+  end
+
+  describe "#finduser" do
+    before do
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+    end
+
+    let(:content) { "sample_account:sample_password:sample_uid:sample_gid:sample_gecos:sample_directory:sample_shell" }
+    let(:output) do
+      {
+        account: 'sample_account',
+        password: 'sample_password',
+        uid: 'sample_uid',
+        gid: 'sample_gid',
+        gecos: 'sample_gecos',
+        directory: 'sample_directory',
+        shell: 'sample_shell',
+      }
+    end
+
+    [:account, :password, :uid, :gid, :gecos, :directory, :shell].each do |key|
+      it "finds an user by #{key} when asked" do
+        expect(provider.finduser(key, "sample_#{key}")).to eq(output)
+      end
+    end
+
+    it "returns false when specified key/value pair is not found" do
+      expect(provider.finduser(:account, 'invalid_account')).to eq(false)
+    end
+
+    it "reads the user file only once per resource" do
+      expect(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').once
+      5.times { provider.finduser(:account, 'sample_account') }
+    end
+  end
+
+  describe "#check_allow_dup" do
     it "should return an array with a flag if dup is allowed" do
       resource[:allowdupe] = :true
       expect(provider.check_allow_dup).to eq(["-o"])
@@ -205,25 +503,25 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
   describe "#check_system_users" do
     it "should check system users" do
-      described_class.expects(:system_users?).returns true
-      resource.expects(:system?)
+      expect(described_class).to receive(:system_users?).and_return(true)
+      expect(resource).to receive(:system?)
       provider.check_system_users
     end
 
     it "should return an array with a flag if it's a system user" do
-      described_class.expects(:system_users?).returns true
+      expect(described_class).to receive(:system_users?).and_return(true)
       resource[:system] = :true
       expect(provider.check_system_users).to eq(["-r"])
     end
 
     it "should return an empty array if it's not a system user" do
-      described_class.expects(:system_users?).returns true
+      expect(described_class).to receive(:system_users?).and_return(true)
       resource[:system] = :false
       expect(provider.check_system_users).to eq([])
     end
 
     it "should return an empty array if system user is not featured" do
-      described_class.expects(:system_users?).returns false
+      expect(described_class).to receive(:system_users?).and_return(false)
       resource[:system] = :true
       expect(provider.check_system_users).to eq([])
     end
@@ -232,29 +530,31 @@ describe Puppet::Type.type(:user).provider(:useradd) do
   describe "#check_manage_home" do
     it "should return an array with -m flag if home is managed" do
       resource[:managehome] = :true
-      provider.expects(:execute).with(includes('-m'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(include('-m'), hash_including(custom_environment: {}))
       provider.create
     end
 
     it "should return an array with -r flag if home is managed" do
       resource[:managehome] = :true
       resource[:ensure] = :absent
-      provider.stubs(:exists?).returns(true)
-      provider.expects(:execute).with(includes('-r'))
+      allow(provider).to receive(:exists?).and_return(true)
+      expect(provider).to receive(:execute).with(include('-r'), hash_including(custom_environment: {}))
       provider.delete
     end
 
-    it "should use -M flag if home is not managed and on Redhat" do
-      Facter.stubs(:value).with(:osfamily).returns("RedHat")
+    it "should use -M flag if home is not managed on a supported system" do
+      allow(Facter).to receive(:value).with(:osfamily).and_return("RedHat")
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease)
       resource[:managehome] = :false
-      provider.expects(:execute).with(includes('-M'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(include('-M'), kind_of(Hash))
       provider.create
     end
 
-    it "should not use -M flag if home is not managed and not on Redhat" do
-      Facter.stubs(:value).with(:osfamily).returns("not RedHat")
+    it "should not use -M flag if home is not managed on an unsupported system" do
+      allow(Facter).to receive(:value).with(:osfamily).and_return("Suse")
+      allow(Facter).to receive(:value).with(:operatingsystemmajrelease).and_return("11")
       resource[:managehome] = :false
-      provider.expects(:execute).with(Not(includes('-M')), kind_of(Hash))
+      expect(provider).to receive(:execute).with(excluding('-M'), kind_of(Hash))
       provider.create
     end
   end
@@ -268,22 +568,22 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     end
 
     it "should call command with :add" do
-      provider.expects(:command).with(:add)
+      expect(provider).to receive(:command).with(:add)
       provider.addcmd
     end
 
     it "should add properties" do
-      provider.expects(:add_properties).returns(['-foo_add_properties'])
+      expect(provider).to receive(:add_properties).and_return(['-foo_add_properties'])
       expect(provider.addcmd).to include '-foo_add_properties'
     end
 
     it "should check and add if dup allowed" do
-      provider.expects(:check_allow_dup).returns(['-allow_dup_flag'])
+      expect(provider).to receive(:check_allow_dup).and_return(['-allow_dup_flag'])
       expect(provider.addcmd).to include '-allow_dup_flag'
     end
 
     it "should check and add if home is managed" do
-      provider.expects(:check_manage_home).returns(['-manage_home_flag'])
+      expect(provider).to receive(:check_manage_home).and_return(['-manage_home_flag'])
       expect(provider.addcmd).to include '-manage_home_flag'
     end
 
@@ -313,36 +613,70 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     end
 
     it "should return an array with the full command and expiry as MM/DD/YY when on Solaris" do
-      Facter.stubs(:value).with(:operatingsystem).returns 'Solaris'
-      described_class.expects(:system_users?).returns true
+      allow(Facter).to receive(:value).with(:operatingsystem).and_return('Solaris')
+      expect(described_class).to receive(:system_users?).and_return(true)
       resource[:expiry] = "2012-08-18"
       expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', '08/18/2012', '-G', 'somegroup', '-o', '-m', '-r', 'myuser'])
     end
 
     it "should return an array with the full command and expiry as YYYY-MM-DD when not on Solaris" do
-      Facter.stubs(:value).with(:operatingsystem).returns 'not_solaris'
-      described_class.expects(:system_users?).returns true
+      allow(Facter).to receive(:value).with(:operatingsystem).and_return('not_solaris')
+      expect(described_class).to receive(:system_users?).and_return(true)
       resource[:expiry] = "2012-08-18"
       expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', '2012-08-18', '-G', 'somegroup', '-o', '-m', '-r', 'myuser'])
     end
 
     it "should return an array without -e if expiry is undefined full command" do
-      described_class.expects(:system_users?).returns true
+      expect(described_class).to receive(:system_users?).and_return(true)
       expect(provider.addcmd).to eq(["/usr/sbin/useradd", "-G", "somegroup", "-o", "-m", "-r", "myuser"])
     end
 
     it "should pass -e \"\" if the expiry has to be removed" do
-      described_class.expects(:system_users?).returns true
+      expect(described_class).to receive(:system_users?).and_return(true)
       resource[:expiry] = :absent
 
       expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', '', '-G', 'somegroup', '-o', '-m', '-r', 'myuser'])
     end
+
+    it "should use lgroupadd with forcelocal=true" do
+      resource[:forcelocal] = :true
+      expect(provider.addcmd[0]).to eq('/usr/sbin/luseradd')
+    end
+
+    it "should not pass -o with forcelocal=true and allowdupe=true" do
+      resource[:forcelocal] = :true
+      resource[:allowdupe] = :true
+      expect(provider.addcmd).not_to include("-o")
+    end
+
+    context 'when forcelocal=true' do
+      before do
+        resource[:forcelocal] = :true
+      end
+
+      it 'does not pass lchage options to luseradd for password_max_age' do
+        resource[:password_max_age] = 100
+        expect(provider.addcmd).not_to include('-M')
+      end
+
+      it 'does not pass lchage options to luseradd for password_min_age' do
+        resource[:managehome] = false  # This needs to be set so that we don't pass in -m to create the home
+        resource[:password_min_age] = 100
+        expect(provider.addcmd).not_to include('-m')
+      end
+
+      it 'does not pass lchage options to luseradd for password_warn_days' do
+        resource[:password_warn_days] = 100
+        expect(provider.addcmd).not_to include('-W')
+      end
+    end
   end
 
   {
-    :password_min_age => 10,
-    :password_max_age => 20,
-    :password         => '$6$FvW8Ib8h$qQMI/CR9m.QzIicZKutLpBgCBBdrch1IX0rTnxuI32K1pD9.RXZrmeKQlaC.RzODNuoUtPPIyQDufunvLOQWF0'
+    :password_min_age   => 10,
+    :password_max_age   => 20,
+    :password_warn_days => 30,
+    :password           => '$6$FvW8Ib8h$qQMI/CR9m.QzIicZKutLpBgCBBdrch1IX0rTnxuI32K1pD9.RXZrmeKQlaC.RzODNuoUtPPIyQDufunvLOQWF0'
   }.each_pair do |property, expected_value|
     describe "##{property}" do
       before :each do
@@ -350,18 +684,18 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       end
 
       it "should return absent if libshadow feature is not present" do
-        Puppet.features.stubs(:libshadow?).returns false
+        allow(Puppet.features).to receive(:libshadow?).and_return(false)
         # Shadow::Passwd.expects(:getspnam).never # if we really don't have libshadow we dont have Shadow::Passwd either
         expect(provider.send(property)).to eq(:absent)
       end
 
       it "should return absent if user cannot be found", :if => Puppet.features.libshadow? do
-        Shadow::Passwd.expects(:getspnam).with('myuser').returns nil
+        expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(nil)
         expect(provider.send(property)).to eq(:absent)
       end
 
       it "should return the correct value if libshadow is present", :if => Puppet.features.libshadow? do
-        Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
+        expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(shadow_entry)
         expect(provider.send(property)).to eq(expected_value)
       end
 
@@ -374,7 +708,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
         canonical_name = [253, 241].pack('C*').force_encoding(Encoding::EUC_KR)
         provider = described_class.new(:name => '??', :canonical_name => canonical_name)
 
-        Shadow::Passwd.expects(:getspnam).with(canonical_name).returns shadow_entry
+        expect(Shadow::Passwd).to receive(:getspnam).with(canonical_name).and_return(shadow_entry)
         provider.password
       end
     end
@@ -386,23 +720,23 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     end
 
     it "should return absent if libshadow feature is not present" do
-      Puppet.features.stubs(:libshadow?).returns false
+      allow(Puppet.features).to receive(:libshadow?).and_return(false)
       expect(provider.expiry).to eq(:absent)
     end
 
     it "should return absent if user cannot be found", :if => Puppet.features.libshadow? do
-      Shadow::Passwd.expects(:getspnam).with('myuser').returns nil
+      expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(nil)
       expect(provider.expiry).to eq(:absent)
     end
 
     it "should return absent if expiry is -1", :if => Puppet.features.libshadow? do
       shadow_entry.sp_expire = -1
-      Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
+      expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(shadow_entry)
       expect(provider.expiry).to eq(:absent)
     end
 
     it "should convert to YYYY-MM-DD", :if => Puppet.features.libshadow? do
-      Shadow::Passwd.expects(:getspnam).with('myuser').returns shadow_entry
+      expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(shadow_entry)
       expect(provider.expiry).to eq('2013-01-01')
     end
   end
@@ -419,7 +753,7 @@ describe Puppet::Type.type(:user).provider(:useradd) do
       # command(:password) is only called inside passcmd if
       # password_min_age or password_max_age is set
       resource[:password_min_age] = 123
-      provider.expects(:command).with(:password)
+      expect(provider).to receive(:command).with(:password)
       provider.passcmd
     end
 
@@ -429,18 +763,43 @@ describe Puppet::Type.type(:user).provider(:useradd) do
 
     it "should return a chage command array with -m <value> and the user name if password_min_age is set" do
       resource[:password_min_age] = 123
-      expect(provider.passcmd).to eq(['/usr/bin/chage','-m',123,'myuser'])
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-m', 123, 'myuser'])
     end
 
     it "should return a chage command array with -M <value> if password_max_age is set" do
       resource[:password_max_age] = 999
-      expect(provider.passcmd).to eq(['/usr/bin/chage','-M',999,'myuser'])
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-M', 999, 'myuser'])
+    end
+
+    it "should return a chage command array with -W <value> if password_warn_days is set" do
+      resource[:password_warn_days] = 999
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-W', 999, 'myuser'])
     end
 
     it "should return a chage command array with -M <value> -m <value> if both password_min_age and password_max_age are set" do
       resource[:password_min_age] = 123
       resource[:password_max_age] = 999
-      expect(provider.passcmd).to eq(['/usr/bin/chage','-m',123,'-M',999,'myuser'])
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-m', 123, '-M', 999, 'myuser'])
+    end
+
+    it "should return a chage command array with -M <value> -m <value> -W <value> if password_min_age, password_max_age and password_warn_days are set" do
+      resource[:password_min_age] = 123
+      resource[:password_max_age] = 999
+      resource[:password_warn_days] = 555
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-m', 123, '-M', 999, '-W', 555, 'myuser'])
+    end
+
+    context 'with forcelocal=true' do
+      before do
+        resource[:forcelocal] = true
+      end
+
+      it 'should return a lchage command array with -M <value> -m <value> -W <value> if password_min_age, password_max_age and password_warn_days are set' do
+        resource[:password_min_age] = 123
+        resource[:password_max_age] = 999
+        resource[:password_warn_days] = 555
+        expect(provider.passcmd).to eq(['/usr/sbin/lchage', '-m', 123, '-M', 999, '-W', 555, 'myuser'])
+      end
     end
   end
 
@@ -451,10 +810,40 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     end
 
     it "should raise an error if the shell is not executable" do
-      FileTest.stubs(:executable?).with('LICENSE').returns false
+      allow(FileTest).to receive(:executable?).with('LICENSE').and_return(false)
       resource[:shell] = 'LICENSE'
       expect { provider.check_valid_shell }.to raise_error(Puppet::Error, /Shell LICENSE must be executable/)
     end
   end
 
+  describe "#delete" do
+    before do
+       allow(provider).to receive(:exists?).and_return(true)
+       resource[:ensure] = :absent
+    end
+
+    describe "on systems with the libuser and forcelocal=false" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = false
+      end
+
+      it "should use userdel to delete users" do
+        expect(provider).to receive(:execute).with(include('/usr/sbin/userdel'), hash_including(custom_environment: {}))
+        provider.delete
+      end
+    end
+
+    describe "on systems with the libuser and forcelocal=true" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = true
+      end
+
+      it "should use luserdel to delete users" do
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luserdel'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.delete
+      end
+    end
+  end
 end