puppet 5.3.4 → 6.29.0

data/lib/puppet/provider/user/directoryservice.rb

@@ -71,7 +71,8 @@ Puppet::Type.type(:user).provide :directoryservice do
   # takes time and front-loads your Puppet run.
   def self.prefetch(resources)
     instances.each do |prov|
-      if resource = resources[prov.name]
+      resource = resources[prov.name]
+      if resource
         resource.provider = prov
       end
     end
@@ -158,7 +159,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   end
 
   def self.get_os_version
-    @os_version ||= Facter.value(:macosx_productversion_major)
+    @os_version ||= Puppet.runtime[:facter].value(:macosx_productversion_major)
   end
 
   # Use dscl to retrieve an array of hashes containing attributes about all
@@ -302,7 +303,7 @@ Puppet::Type.type(:user).provide :directoryservice do
             merge_attribute_with_dscl('Groups', group, 'GroupMembers', @guid)
           end
         else
-          merge_attribute_with_dscl('Users', @resource.name, self.class.ns_to_ds_attribute_map[attribute], value)
+          create_attribute_with_dscl('Users', @resource.name, self.class.ns_to_ds_attribute_map[attribute], value)
         end
       end
     end
@@ -386,7 +387,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
       assert_full_pbkdf2_password
 
-      sleep 2
+      sleep 3
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -400,10 +401,15 @@ Puppet::Type.type(:user).provide :directoryservice do
   # we have to treat the ds cache just like you would in the password=
   # method.
   def salt=(value)
+    if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.15') >= 0)
+      if value.length != 64
+        self.fail "macOS versions 10.15 and higher require the salt to be 32-bytes. Since Puppet's user resource requires the value to be hex encoded, the length of the salt's string must be 64. Please check your salt and try again."
+      end
+    end
     if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
       assert_full_pbkdf2_password
 
-      sleep 2
+      sleep 3
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -429,11 +435,14 @@ Puppet::Type.type(:user).provide :directoryservice do
   # the case we rescue the error from dscl and alert the user.
   #
   # In the event that the user doesn't HAVE a value for the attribute, the
-  # provider should use the -merge option with dscl to add the attribute value
+  # provider should use the -create option with dscl to add the attribute value
   # for the user record
   ['home', 'uid', 'gid', 'comment', 'shell'].each do |setter_method|
     define_method("#{setter_method}=") do |value|
       if @property_hash[setter_method.intern]
+        if %w(home uid).include?(setter_method)
+          raise Puppet::Error, "OS X version #{self.class.get_os_version} does not allow changing #{setter_method} using puppet"
+        end
         begin
           dscl '.', '-change', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], @property_hash[setter_method.intern], value
         rescue Puppet::ExecutionFailure => e
@@ -442,7 +451,7 @@ Puppet::Type.type(:user).provide :directoryservice do
         end
       else
         begin
-          dscl '.', '-merge', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], value
+          dscl '.', '-create', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], value
         rescue Puppet::ExecutionFailure => e
           raise Puppet::Error, "Cannot set the #{setter_method} value of '#{value}' for user " +
                "#{@resource.name} due to the following error: #{e.inspect}", e.backtrace
@@ -472,10 +481,19 @@ Puppet::Type.type(:user).provide :directoryservice do
     '/var/db/shadow/hash'
   end
 
+  # This method will create a given value using dscl
+  def create_attribute_with_dscl(path, username, keyname, value)
+    set_attribute_with_dscl('-create', path, username, keyname, value)
+  end
+
   # This method will merge in a given value using dscl
   def merge_attribute_with_dscl(path, username, keyname, value)
+    set_attribute_with_dscl('-merge', path, username, keyname, value)
+  end
+
+  def set_attribute_with_dscl(dscl_command, path, username, keyname, value)
     begin
-      dscl '.', '-merge', "/#{path}/#{username}", keyname, value
+      dscl '.', dscl_command, "/#{path}/#{username}", keyname, value
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not set the dscl #{keyname} key with value: #{value} - #{detail.inspect}", detail.backtrace
     end
@@ -491,7 +509,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   def next_system_id(min_id=20)
     dscl_output = dscl '.', '-list', '/Users', 'uid'
     # We're ok with throwing away negative uids here. Also, remove nil values.
-    user_ids = dscl_output.split.compact.collect { |l| l.to_i if l.match(/^\d+$/) }
+    user_ids = dscl_output.split.compact.collect { |l| l.to_i if l =~ /^\d+$/ }
     ids = user_ids.compact!.sort! { |a,b| a.to_f <=> b.to_f }
     # We're just looking for an unused id in our sorted array.
     ids.each_index do |i|
@@ -523,6 +541,14 @@ Puppet::Type.type(:user).provide :directoryservice do
       if (shadow_hash_data.class == Hash) && (shadow_hash_data.has_key?('SALTED-SHA512'))
         shadow_hash_data.delete('SALTED-SHA512')
       end
+
+      # Starting with macOS 11 Big Sur, the AuthenticationAuthority field
+      # could be missing entirely and without it the managed user cannot log in
+      if needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
+        Puppet.debug("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user '#{@resource.name}'")
+        merge_attribute_with_dscl('Users', @resource.name, 'AuthenticationAuthority', ERB::Util.html_escape(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY))
+      end
+
       set_salted_pbkdf2(users_plist, shadow_hash_data, 'entropy', value)
     end
   end
@@ -549,6 +575,17 @@ Puppet::Type.type(:user).provide :directoryservice do
     end
   end
 
+  # This method will check if authentication_authority key of a user's plist
+  # needs SALTED_SHA512_PBKDF2 to be added. This is a valid case for macOS 11 (Big Sur)
+  # where users created with `dscl` started to have this field missing
+  def needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
+    authority = users_plist['authentication_authority']
+    return false if Puppet::Util::Package.versioncmp(self.class.get_os_version, '11.0.0') < 0 && authority && authority.include?(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY)
+
+    Puppet.debug("User '#{@resource.name}' is missing the 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash")
+    true
+  end
+
   # This method will embed the binary plist data comprising the user's
   # password hash (and Salt/Iterations value if the OS is 10.8 or greater)
   # into the ShadowHashData key of the user's plist.
@@ -559,7 +596,28 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       users_plist['ShadowHashData'] = [binary_plist]
     end
-    write_users_plist_to_disk(users_plist)
+    write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
+  end
+
+  # This method writes the ShadowHashData plist in a temporary file,
+  # then imports it using dsimport. macOS versions 10.15 and newer do
+  # not support directly managing binary plists, so we have to use an
+  # intermediary.
+  # dsimport is an archaic utilitary with hard-to-find documentation
+  #
+  # See http://web.archive.org/web/20090106120111/http://support.apple.com/kb/TA21305?viewlocale=en_US
+  # for information regarding the dsimport syntax
+  def write_and_import_shadow_hash_data(data_plist)
+    Tempfile.create("dsimport_#{@resource.name}", :encoding => Encoding::ASCII) do |dsimport_file|
+      dsimport_file.write <<-DSIMPORT
+0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData
+#{@resource.name}:#{Base64.strict_encode64(data_plist)}
+      DSIMPORT
+      dsimport_file.flush
+      # Delete the user's existing ShadowHashData, since dsimport appends, not replaces
+      dscl('.', 'delete', "/Users/#{@resource.name}", 'ShadowHashData')
+      dsimport(dsimport_file.path, '/Local/Default', 'M')
+    end
   end
 
   # This method accepts an argument of a hex password hash, and base64
@@ -614,12 +672,6 @@ Puppet::Type.type(:user).provide :directoryservice do
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
-  # This method will accept a plist in XML format, save it to disk, convert
-  # the plist to a binary format, and flush the dscl cache.
-  def write_users_plist_to_disk(users_plist)
-    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
-  end
-
   # This is a simple wrapper method for writing values to a file.
   def write_to_file(filename, value)
     Puppet.deprecation_warning("Puppet::Type.type(:user).provider(:directoryservice).write_to_file is deprecated and will be removed in Puppet 5.")
@@ -629,4 +681,8 @@ Puppet::Type.type(:user).provide :directoryservice do
       raise Puppet::Error, "Could not write to file #{filename}: #{detail}", detail.backtrace
     end
   end
+
+  private
+
+  SHA512_PBKDF2_AUTHENTICATION_AUTHORITY = ';ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2>'
 end

data/lib/puppet/provider/user/hpux.rb

@@ -29,7 +29,7 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
 
   def modifycmd(param,value)
      cmd = super(param, value)
-     cmd << "-F"
+     cmd.insert(1,"-F")
      if trusted then
        # Append an additional command to reset the password age to 0
        # until a workaround with expiry module can be found for trusted
@@ -46,7 +46,7 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   def password
     # Password management routine for trusted and non-trusted systems
     #temp=""
-    while ent = Etc.getpwent() do
+    while ent = Etc.getpwent() do # rubocop:disable Lint/AssignmentInCondition
       if ent.name == resource.name
         temp=ent.name
         break

data/lib/puppet/provider/user/ldap.rb

@@ -34,9 +34,11 @@ Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
   provider = self
   manager.generates(:uidNumber).with do
     largest = 500
-    if existing = provider.manager.search
+    existing = provider.manager.search
+    if existing
       existing.each do |hash|
-        next unless value = hash[:uid]
+        value = hash[:uid]
+        next unless value
         num = value[0].to_i
         largest = num if num > largest
       end
@@ -56,7 +58,8 @@ Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
     # We want to cache the current result, so we know if we
     # have to remove old values.
     unless @property_hash[:groups]
-      unless result = group_manager.search("memberUid=#{name}")
+      result = group_manager.search("memberUid=#{name}")
+      unless result
         return @property_hash[:groups] = :absent
       end
 
@@ -88,7 +91,8 @@ Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
     end
 
     modes.each do |group, form|
-      self.fail "Could not find ldap group #{group}" unless ldap_group = group_manager.find(group)
+      ldap_group = group_manager.find(group)
+      self.fail "Could not find ldap group #{group}" unless ldap_group
 
       current = ldap_group[:members]
 

data/lib/puppet/provider/user/openbsd.rb

@@ -39,13 +39,14 @@ Puppet::Type.type(:user).provide :openbsd, :parent => :useradd do
   [:expiry, :password, :loginclass].each do |shadow_property|
     define_method(shadow_property) do
       if Puppet.features.libshadow?
-        if ent = Shadow::Passwd.getspnam(@resource.name)
+        ent = Shadow::Passwd.getspnam(@resource.name)
+        if ent
           method = self.class.option(shadow_property, :method)
           # ruby-shadow may not be new enough (< 2.4.1) and therefore lack the
           # sp_loginclass field.
           begin
             return unmunge(shadow_property, ent.send(method))
-          rescue => detail
+          rescue
             #TRANSLATORS 'ruby-shadow' is a Ruby gem library
             Puppet.warning _("ruby-shadow doesn't support %{method}") % { method: method }
           end

data/lib/puppet/provider/user/pw.rb

@@ -31,7 +31,8 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
     cmd = [command(:pw), "useradd", @resource[:name]]
     @resource.class.validproperties.each do |property|
       next if property == :ensure or property == :password
-      if value = @resource.should(property) and value != ""
+      value = @resource.should(property)
+      if value and value != ""
         cmd << flag(property) << munge(property,value)
       end
     end
@@ -66,11 +67,11 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
 
   # use pw to update password hash
   def password=(cryptopw)
-    Puppet.debug "change password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
-    stdin, stdout, stderr = Open3.popen3("pw user mod #{@resource[:name]} -H 0")
+    Puppet.debug "change password for user '#{@resource[:name]}' method called with hash [redacted]"
+    stdin, _, _ = Open3.popen3("pw user mod #{@resource[:name]} -H 0")
     stdin.puts(cryptopw)
     stdin.close
-    Puppet.debug "finished password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called with hash [redacted]"
   end
 
   # get password from /etc/master.passwd
@@ -78,10 +79,19 @@ Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::
     Puppet.debug "checking password for user '#{@resource[:name]}' method called"
     current_passline = `getent passwd #{@resource[:name]}`
     current_password = current_passline.chomp.split(':')[1] if current_passline
-    Puppet.debug "finished password for user '#{@resource[:name]}' method called : '#{current_password}'"
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called : [redacted]"
     current_password
   end
 
+  def has_sensitive_data?(property = nil)
+    #Check for sensitive values?
+    properties = property ? [property] : Puppet::Type.type(:user).validproperties
+    properties.any? do |prop|
+      p = @resource.parameter(prop)
+      p && p.respond_to?(:is_sensitive) && p.is_sensitive
+    end
+  end
+
   # Get expiry from system and convert to Puppet-style date
   def expiry
     expiry = self.get(:expiry)

data/lib/puppet/provider/user/user_role_add.rb

@@ -18,6 +18,7 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
   options :profiles, :flag => "-P"
   options :password_min_age, :flag => "-n"
   options :password_max_age, :flag => "-x"
+  options :password_warn_days, :flag => "-w"
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
@@ -32,10 +33,10 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     set("shell", value)
   end
 
-  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age, :manages_shell
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_roles, :manages_passwords, :manages_password_age, :manages_shell
 
   def check_valid_shell
-    unless File.exists?(@resource.should(:shell))
+    unless File.exist?(@resource.should(:shell))
       raise(Puppet::Error, "Shell #{@resource.should(:shell)} must exist")
     end
     unless File.executable?(@resource.should(:shell).to_s)
@@ -48,11 +49,12 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     cmd = []
     Puppet::Type.type(:user).validproperties.each do |property|
       #skip the password because we can't create it with the solaris useradd
-      next if [:ensure, :password, :password_min_age, :password_max_age].include?(property)
+      next if [:ensure, :password, :password_min_age, :password_max_age, :password_warn_days].include?(property)
       # 1680 Now you can set the hashed passwords on solaris:lib/puppet/provider/user/user_role_add.rb
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
-      if value = @resource.should(property) and value != ""
+      value = @resource.should(property)
+      if value && value != ""
         if property == :keys
           cmd += build_keys_cmd(value)
         else
@@ -98,7 +100,8 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
       run(transition("normal"), "transition role to")
     else
       run(addcmd, "create")
-      if cmd = passcmd
+      cmd = passcmd
+      if cmd
         run(cmd, "change password policy for")
       end
     end
@@ -196,6 +199,15 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     shadow_entry[4].empty? ? -1 : shadow_entry[4]
   end
 
+  def password_warn_days
+    return :absent unless shadow_entry
+    shadow_entry[5].empty? ? -1 : shadow_entry[5]
+  end
+
+  def has_sensitive_data?(property = nil)
+    false
+  end
+
   # Read in /etc/shadow, find the line for our used and rewrite it with the
   # new pw.  Smooth like 80 grit sandpaper.
   #