puppet 6.0.5-x64-mingw32 → 8.8.1-x64-mingw32

data/lib/puppet/provider/user/directoryservice.rb

@@ -1,13 +1,15 @@
-require 'puppet'
-require 'puppet/util/plist' if Puppet.features.cfpropertylist?
+# frozen_string_literal: true
+
+require_relative '../../../puppet'
+require_relative '../../../puppet/util/plist' if Puppet.features.cfpropertylist?
 require 'base64'
 
 Puppet::Type.type(:user).provide :directoryservice do
   desc "User management on OS X."
 
-##                   ##
-## Provider Settings ##
-##                   ##
+  ##                   ##
+  ## Provider Settings ##
+  ##                   ##
 
   # Provider command declarations
   commands :uuidgen      => '/usr/bin/uuidgen'
@@ -16,9 +18,9 @@ Puppet::Type.type(:user).provide :directoryservice do
   commands :dscacheutil  => '/usr/bin/dscacheutil'
 
   # Provider confines and defaults
-  confine    :operatingsystem => :darwin
-  confine    :feature         => :cfpropertylist
-  defaultfor :operatingsystem => :darwin
+  confine    'os.name' => :darwin
+  confine    :feature => :cfpropertylist
+  defaultfor 'os.name' => :darwin
 
   # Need this to create getter/setter methods automagically
   # This command creates methods that return @property_hash[:value]
@@ -30,29 +32,29 @@ Puppet::Type.type(:user).provide :directoryservice do
   # 10.8 Passwords use a PBKDF2 salt value
   has_features :manages_password_salt
 
-  #provider can set the user's shell
+  # provider can set the user's shell
   has_feature :manages_shell
 
-##               ##
-## Class Methods ##
-##               ##
+  ##               ##
+  ## Class Methods ##
+  ##               ##
 
   # This method exists to map the dscl values to the correct Puppet
   # properties. This stays relatively consistent, but who knows what
   # Apple will do next year...
   def self.ds_to_ns_attribute_map
     {
-      'RecordName'       => :name,
-      'PrimaryGroupID'   => :gid,
+      'RecordName' => :name,
+      'PrimaryGroupID' => :gid,
       'NFSHomeDirectory' => :home,
-      'UserShell'        => :shell,
-      'UniqueID'         => :uid,
-      'RealName'         => :comment,
-      'Password'         => :password,
-      'GeneratedUID'     => :guid,
-      'IPAddress'        => :ip_address,
-      'ENetAddress'      => :en_address,
-      'GroupMembership'  => :members,
+      'UserShell' => :shell,
+      'UniqueID' => :uid,
+      'RealName' => :comment,
+      'Password' => :password,
+      'GeneratedUID' => :guid,
+      'IPAddress' => :ip_address,
+      'ENetAddress' => :en_address,
+      'GroupMembership' => :members,
     }
   end
 
@@ -71,7 +73,8 @@ Puppet::Type.type(:user).provide :directoryservice do
   # takes time and front-loads your Puppet run.
   def self.prefetch(resources)
     instances.each do |prov|
-      if resource = resources[prov.name]
+      resource = resources[prov.name]
+      if resource
         resource.provider = prov
       end
     end
@@ -84,14 +87,14 @@ Puppet::Type.type(:user).provide :directoryservice do
   # display its output.
   def self.instances
     get_all_users.collect do |user|
-      self.new(generate_attribute_hash(user))
+      new(generate_attribute_hash(user))
     end
   end
 
   # Return an array of hashes containing information about every user on
   # the system.
   def self.get_all_users
-    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Users')
+    Puppet::Util::Plist.parse_plist(dscl('-plist', '.', 'readall', '/Users'))
   end
 
   # This method accepts an individual user plist, passed as a hash, and
@@ -103,19 +106,20 @@ Puppet::Type.type(:user).provide :directoryservice do
     input_hash.each_key do |key|
       ds_attribute = key.sub("dsAttrTypeStandard:", "")
       next unless ds_to_ns_attribute_map.keys.include?(ds_attribute)
+
       ds_value = input_hash[key]
       case ds_to_ns_attribute_map[ds_attribute]
-        when :gid, :uid
-          # OS X stores objects like uid/gid as strings.
-          # Try casting to an integer for these cases to be
-          # consistent with the other providers and the group type
-          # validation
-          begin
-            ds_value = Integer(ds_value[0])
-          rescue ArgumentError
-            ds_value = ds_value[0]
-          end
-        else ds_value = ds_value[0]
+      when :gid, :uid
+        # OS X stores objects like uid/gid as strings.
+        # Try casting to an integer for these cases to be
+        # consistent with the other providers and the group type
+        # validation
+        begin
+          ds_value = Integer(ds_value[0])
+        rescue ArgumentError
+          ds_value = ds_value[0]
+        end
+      else ds_value = ds_value[0]
       end
       attribute_hash[ds_to_ns_attribute_map[ds_attribute]] = ds_value
     end
@@ -146,9 +150,9 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       embedded_binary_plist = get_embedded_binary_plist(attribute_hash[:shadowhashdata])
       if embedded_binary_plist['SALTED-SHA512-PBKDF2']
-        attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist)
-        attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist)
-        attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist)
+        attribute_hash[:password]   = get_salted_sha512_pbkdf2('entropy', embedded_binary_plist, attribute_hash[:name])
+        attribute_hash[:salt]       = get_salted_sha512_pbkdf2('salt', embedded_binary_plist, attribute_hash[:name])
+        attribute_hash[:iterations] = get_salted_sha512_pbkdf2('iterations', embedded_binary_plist, attribute_hash[:name])
       elsif embedded_binary_plist['SALTED-SHA512']
         attribute_hash[:password] = get_salted_sha512(embedded_binary_plist)
       end
@@ -158,20 +162,24 @@ Puppet::Type.type(:user).provide :directoryservice do
   end
 
   def self.get_os_version
-    @os_version ||= Facter.value(:macosx_productversion_major)
+    # rubocop:disable Naming/MemoizedInstanceVariableName
+    @os_version ||= Puppet.runtime[:facter].value('os.macosx.version.major')
+    # rubocop:enable Naming/MemoizedInstanceVariableName
   end
 
   # Use dscl to retrieve an array of hashes containing attributes about all
   # of the local groups on the machine.
   def self.get_list_of_groups
-    @groups ||= Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'readall', '/Groups')
+    # rubocop:disable Naming/MemoizedInstanceVariableName
+    @groups ||= Puppet::Util::Plist.parse_plist(dscl('-plist', '.', 'readall', '/Groups'))
+    # rubocop:enable Naming/MemoizedInstanceVariableName
   end
 
   # Perform a dscl lookup at the path specified for the specific keyname
   # value. The value returned is the first item within the array returned
   # from dscl
   def self.get_attribute_from_dscl(path, username, keyname)
-    Puppet::Util::Plist.parse_plist(dscl '-plist', '.', 'read', "/#{path}/#{username}", keyname)
+    Puppet::Util::Plist.parse_plist(dscl('-plist', '.', 'read', "/#{path}/#{username}", keyname))
   end
 
   # The plist embedded in the ShadowHashData key is a binary plist. The
@@ -197,23 +205,26 @@ Puppet::Type.type(:user).provide :directoryservice do
   # The salted-SHA512 password hash in 10.7 is stored in the 'SALTED-SHA512'
   # key as binary data. That data is extracted and converted to a hex string.
   def self.get_salted_sha512(embedded_binary_plist)
-    embedded_binary_plist['SALTED-SHA512'].unpack("H*")[0]
+    embedded_binary_plist['SALTED-SHA512'].unpack1("H*")
   end
 
   # This method reads the passed embedded_binary_plist hash and returns values
   # according to which field is passed.  Arguments passed are the hash
   # containing the value read from the 'ShadowHashData' key in the User's
   # plist, and the field to be read (one of 'entropy', 'salt', or 'iterations')
-  def self.get_salted_sha512_pbkdf2(field, embedded_binary_plist)
+  def self.get_salted_sha512_pbkdf2(field, embedded_binary_plist, user_name = "")
     case field
     when 'salt', 'entropy'
-      embedded_binary_plist['SALTED-SHA512-PBKDF2'][field].unpack('H*').first
+      value = embedded_binary_plist['SALTED-SHA512-PBKDF2'][field]
+      if value.nil?
+        raise Puppet::Error, "Invalid #{field} given for user #{user_name}"
+      end
+
+      value.unpack1('H*')
     when 'iterations'
       Integer(embedded_binary_plist['SALTED-SHA512-PBKDF2'][field])
     else
-      raise Puppet::Error, 'Puppet has tried to read an incorrect value from the ' +
-           "SALTED-SHA512-PBKDF2 hash. Acceptable fields are 'salt', " +
-           "'entropy', or 'iterations'."
+      raise Puppet::Error, "Puppet has tried to read an incorrect value from the user #{user_name} in the SALTED-SHA512-PBKDF2 hash. Acceptable fields are 'salt', 'entropy', or 'iterations'."
     end
   end
 
@@ -223,7 +234,8 @@ Puppet::Type.type(:user).provide :directoryservice do
     password_hash = nil
     password_hash_file = "#{password_hash_dir}/#{guid}"
     if Puppet::FileSystem.exist?(password_hash_file) and File.file?(password_hash_file)
-      raise Puppet::Error, "Could not read password hash file at #{password_hash_file}" if not File.readable?(password_hash_file)
+      raise Puppet::Error, "Could not read password hash file at #{password_hash_file}" unless File.readable?(password_hash_file)
+
       f = File.new(password_hash_file)
       password_hash = f.read
       f.close
@@ -231,10 +243,9 @@ Puppet::Type.type(:user).provide :directoryservice do
     password_hash
   end
 
-
-##                   ##
-## Ensurable Methods ##
-##                   ##
+  ##                   ##
+  ## Ensurable Methods ##
+  ##                   ##
 
   def exists?
     begin
@@ -261,6 +272,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     # Iterate through valid User type properties
     valid_properties.each do |attribute|
       next if attribute == :ensure
+
       value = @resource.should(attribute)
 
       # Value defaults
@@ -288,22 +300,22 @@ Puppet::Type.type(:user).provide :directoryservice do
       # For the :password and :groups properties, call the setter methods
       # to enforce those values. For everything else, use dscl with the
       # ns_to_ds_attribute_map to set the appropriate values.
-      if value != "" and not value.nil?
-        case attribute
-        when :password
-          self.password = value
-        when :iterations
-          self.iterations = value
-        when :salt
-          self.salt = value
-        when :groups
-          value.split(',').each do |group|
-            merge_attribute_with_dscl('Groups', group, 'GroupMembership', @resource.name)
-            merge_attribute_with_dscl('Groups', group, 'GroupMembers', @guid)
-          end
-        else
-          merge_attribute_with_dscl('Users', @resource.name, self.class.ns_to_ds_attribute_map[attribute], value)
+      next unless value != "" and !value.nil?
+
+      case attribute
+      when :password
+        self.password = value
+      when :iterations
+        self.iterations = value
+      when :salt
+        self.salt = value
+      when :groups
+        value.split(',').each do |group|
+          merge_attribute_with_dscl('Groups', group, 'GroupMembership', @resource.name)
+          merge_attribute_with_dscl('Groups', group, 'GroupMembers', @guid)
         end
+      else
+        create_attribute_with_dscl('Users', @resource.name, self.class.ns_to_ds_attribute_map[attribute], value)
       end
     end
   end
@@ -314,9 +326,9 @@ Puppet::Type.type(:user).provide :directoryservice do
     dscl '.', '-delete', "/Users/#{@resource.name}"
   end
 
-##                       ##
-## Getter/Setter Methods ##
-##                       ##
+  ##                       ##
+  ## Getter/Setter Methods ##
+  ##                       ##
 
   # In the setter method we're only going to take action on groups for which
   # the user is not currently a member.
@@ -346,7 +358,7 @@ Puppet::Type.type(:user).provide :directoryservice do
       end
     else
       if value.length != 256
-         raise Puppet::Error, "OS X versions > 10.7 require a Salted SHA512 PBKDF2 password hash of 256 characters. Please check your password and try again."
+        raise Puppet::Error, "OS X versions > 10.7 require a Salted SHA512 PBKDF2 password hash of 256 characters. Please check your password and try again."
       end
 
       assert_full_pbkdf2_password
@@ -383,10 +395,10 @@ Puppet::Type.type(:user).provide :directoryservice do
   # we have to treat the ds cache just like you would in the password=
   # method.
   def iterations=(value)
-    if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
+    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0
       assert_full_pbkdf2_password
 
-      sleep 2
+      sleep 3
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -400,10 +412,15 @@ Puppet::Type.type(:user).provide :directoryservice do
   # we have to treat the ds cache just like you would in the password=
   # method.
   def salt=(value)
-    if (Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0)
+    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.15') >= 0
+      if value.length != 64
+        self.fail "macOS versions 10.15 and higher require the salt to be 32-bytes. Since Puppet's user resource requires the value to be hex encoded, the length of the salt's string must be 64. Please check your salt and try again."
+      end
+    end
+    if Puppet::Util::Package.versioncmp(self.class.get_os_version, '10.7') > 0
       assert_full_pbkdf2_password
 
-      sleep 2
+      sleep 3
       flush_dscl_cache
       users_plist = get_users_plist(@resource.name)
       shadow_hash_data = get_shadow_hash_data(users_plist)
@@ -429,29 +446,32 @@ Puppet::Type.type(:user).provide :directoryservice do
   # the case we rescue the error from dscl and alert the user.
   #
   # In the event that the user doesn't HAVE a value for the attribute, the
-  # provider should use the -merge option with dscl to add the attribute value
+  # provider should use the -create option with dscl to add the attribute value
   # for the user record
-  ['home', 'uid', 'gid', 'comment', 'shell'].each do |setter_method|
+  %w[home uid gid comment shell].each do |setter_method|
     define_method("#{setter_method}=") do |value|
       if @property_hash[setter_method.intern]
+        if %w[home uid].include?(setter_method)
+          raise Puppet::Error, "OS X version #{self.class.get_os_version} does not allow changing #{setter_method} using puppet"
+        end
+
         begin
           dscl '.', '-change', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], @property_hash[setter_method.intern], value
         rescue Puppet::ExecutionFailure => e
-          raise Puppet::Error, "Cannot set the #{setter_method} value of '#{value}' for user " +
-               "#{@resource.name} due to the following error: #{e.inspect}", e.backtrace
+          raise Puppet::Error, "Cannot set the #{setter_method} value of '#{value}' for user " \
+                               "#{@resource.name} due to the following error: #{e.inspect}", e.backtrace
         end
       else
         begin
-          dscl '.', '-merge', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], value
+          dscl '.', '-create', "/Users/#{resource.name}", self.class.ns_to_ds_attribute_map[setter_method.intern], value
         rescue Puppet::ExecutionFailure => e
-          raise Puppet::Error, "Cannot set the #{setter_method} value of '#{value}' for user " +
-               "#{@resource.name} due to the following error: #{e.inspect}", e.backtrace
+          raise Puppet::Error, "Cannot set the #{setter_method} value of '#{value}' for user " \
+                               "#{@resource.name} due to the following error: #{e.inspect}", e.backtrace
         end
       end
     end
   end
 
-
   ##                ##
   ## Helper Methods ##
   ##                ##
@@ -459,8 +479,8 @@ Puppet::Type.type(:user).provide :directoryservice do
   def assert_full_pbkdf2_password
     missing = [:password, :salt, :iterations].select { |parameter| @resource[parameter].nil? }
 
-    if !missing.empty?
-       raise Puppet::Error, "OS X versions > 10\.7 use PBKDF2 password hashes, which requires all three of salt, iterations, and password hash. This resource is missing: #{missing.join(', ')}."
+    unless missing.empty?
+      raise Puppet::Error, "OS X versions > 10\.7 use PBKDF2 password hashes, which requires all three of salt, iterations, and password hash. This resource is missing: #{missing.join(', ')}."
     end
   end
 
@@ -472,31 +492,38 @@ Puppet::Type.type(:user).provide :directoryservice do
     '/var/db/shadow/hash'
   end
 
+  # This method will create a given value using dscl
+  def create_attribute_with_dscl(path, username, keyname, value)
+    set_attribute_with_dscl('-create', path, username, keyname, value)
+  end
+
   # This method will merge in a given value using dscl
   def merge_attribute_with_dscl(path, username, keyname, value)
-    begin
-      dscl '.', '-merge', "/#{path}/#{username}", keyname, value
-    rescue Puppet::ExecutionFailure => detail
-      raise Puppet::Error, "Could not set the dscl #{keyname} key with value: #{value} - #{detail.inspect}", detail.backtrace
-    end
+    set_attribute_with_dscl('-merge', path, username, keyname, value)
+  end
+
+  def set_attribute_with_dscl(dscl_command, path, username, keyname, value)
+    dscl '.', dscl_command, "/#{path}/#{username}", keyname, value
+  rescue Puppet::ExecutionFailure => detail
+    raise Puppet::Error, "Could not set the dscl #{keyname} key with value: #{value} - #{detail.inspect}", detail.backtrace
   end
 
   # Create the new user with dscl
   def create_new_user(username)
-    dscl '.', '-create',  "/Users/#{username}"
+    dscl '.', '-create', "/Users/#{username}"
   end
 
   # Get the next available uid on the system by getting a list of user ids,
   # sorting them, grabbing the last one, and adding a 1. Scientific stuff here.
-  def next_system_id(min_id=20)
+  def next_system_id(min_id = 20)
     dscl_output = dscl '.', '-list', '/Users', 'uid'
     # We're ok with throwing away negative uids here. Also, remove nil values.
-    user_ids = dscl_output.split.compact.collect { |l| l.to_i if l.match(/^\d+$/) }
-    ids = user_ids.compact!.sort! { |a,b| a.to_f <=> b.to_f }
+    user_ids = dscl_output.split.compact.collect { |l| l.to_i if l =~ /^\d+$/ }
+    ids = user_ids.compact!.sort_by!(&:to_f)
     # We're just looking for an unused id in our sorted array.
     ids.each_index do |i|
       next_id = ids[i] + 1
-      return next_id if ids[i+1] != next_id and next_id >= min_id
+      return next_id if ids[i + 1] != next_id and next_id >= min_id
     end
   end
 
@@ -520,9 +547,17 @@ Puppet::Type.type(:user).provide :directoryservice do
       # variable IS a Hash and contains the 'SALTED-SHA512' key (indicating an
       # older 10.7-style password hash), it will be deleted and a newer
       # 10.8-style (PBKDF2) password hash will be generated.
-      if (shadow_hash_data.class == Hash) && (shadow_hash_data.has_key?('SALTED-SHA512'))
+      if shadow_hash_data.instance_of?(Hash) && shadow_hash_data.has_key?('SALTED-SHA512')
         shadow_hash_data.delete('SALTED-SHA512')
       end
+
+      # Starting with macOS 11 Big Sur, the AuthenticationAuthority field
+      # could be missing entirely and without it the managed user cannot log in
+      if needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
+        Puppet.debug("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user '#{@resource.name}'")
+        merge_attribute_with_dscl('Users', @resource.name, 'AuthenticationAuthority', ERB::Util.html_escape(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY))
+      end
+
       set_salted_pbkdf2(users_plist, shadow_hash_data, 'entropy', value)
     end
   end
@@ -542,13 +577,24 @@ Puppet::Type.type(:user).provide :directoryservice do
   # ShadowHashData key of a user's plist, or false if it doesn't exist.
   def get_shadow_hash_data(users_plist)
     if users_plist['ShadowHashData']
-      password_hash_plist  = users_plist['ShadowHashData'][0]
+      password_hash_plist = users_plist['ShadowHashData'][0]
       self.class.convert_binary_to_hash(password_hash_plist)
     else
       false
     end
   end
 
+  # This method will check if authentication_authority key of a user's plist
+  # needs SALTED_SHA512_PBKDF2 to be added. This is a valid case for macOS 11 (Big Sur)
+  # where users created with `dscl` started to have this field missing
+  def needs_sha512_pbkdf2_authentication_authority_to_be_added?(users_plist)
+    authority = users_plist['authentication_authority']
+    return false if Puppet::Util::Package.versioncmp(self.class.get_os_version, '11.0.0') < 0 && authority && authority.include?(SHA512_PBKDF2_AUTHENTICATION_AUTHORITY)
+
+    Puppet.debug("User '#{@resource.name}' is missing the 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash")
+    true
+  end
+
   # This method will embed the binary plist data comprising the user's
   # password hash (and Salt/Iterations value if the OS is 10.8 or greater)
   # into the ShadowHashData key of the user's plist.
@@ -559,7 +605,28 @@ Puppet::Type.type(:user).provide :directoryservice do
     else
       users_plist['ShadowHashData'] = [binary_plist]
     end
-    write_users_plist_to_disk(users_plist)
+    write_and_import_shadow_hash_data(users_plist['ShadowHashData'].first)
+  end
+
+  # This method writes the ShadowHashData plist in a temporary file,
+  # then imports it using dsimport. macOS versions 10.15 and newer do
+  # not support directly managing binary plists, so we have to use an
+  # intermediary.
+  # dsimport is an archaic utilitary with hard-to-find documentation
+  #
+  # See http://web.archive.org/web/20090106120111/http://support.apple.com/kb/TA21305?viewlocale=en_US
+  # for information regarding the dsimport syntax
+  def write_and_import_shadow_hash_data(data_plist)
+    Tempfile.create("dsimport_#{@resource.name}", :encoding => Encoding::ASCII) do |dsimport_file|
+      dsimport_file.write <<~DSIMPORT
+        0x0A 0x5C 0x3A 0x2C dsRecTypeStandard:Users 2 dsAttrTypeStandard:RecordName base64:dsAttrTypeNative:ShadowHashData
+        #{@resource.name}:#{Base64.strict_encode64(data_plist)}
+      DSIMPORT
+      dsimport_file.flush
+      # Delete the user's existing ShadowHashData, since dsimport appends, not replaces
+      dscl('.', 'delete', "/Users/#{@resource.name}", 'ShadowHashData')
+      dsimport(dsimport_file.path, '/Local/Default', 'M')
+    end
   end
 
   # This method accepts an argument of a hex password hash, and base64
@@ -576,7 +643,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   def set_salted_sha512(users_plist, shadow_hash_data, value)
     unless shadow_hash_data
       shadow_hash_data = Hash.new
-      shadow_hash_data['SALTED-SHA512'] = ''
+      shadow_hash_data['SALTED-SHA512'] = ''.dup
     end
     shadow_hash_data['SALTED-SHA512'] = base64_decode_string(value)
     binary_plist = self.class.convert_hash_to_binary(shadow_hash_data)
@@ -592,7 +659,7 @@ Puppet::Type.type(:user).provide :directoryservice do
   # the user's plist itself, and the shadow_hash_data hash containing the
   # existing PBKDF2 values.
   def set_salted_pbkdf2(users_plist, shadow_hash_data, field, value)
-    shadow_hash_data = Hash.new unless shadow_hash_data
+    shadow_hash_data ||= Hash.new
     shadow_hash_data['SALTED-SHA512-PBKDF2'] = Hash.new unless shadow_hash_data['SALTED-SHA512-PBKDF2']
     case field
     when 'salt', 'entropy'
@@ -614,19 +681,7 @@ Puppet::Type.type(:user).provide :directoryservice do
     set_shadow_hash_data(users_plist, binary_plist)
   end
 
-  # This method will accept a plist in XML format, save it to disk, convert
-  # the plist to a binary format, and flush the dscl cache.
-  def write_users_plist_to_disk(users_plist)
-    Puppet::Util::Plist.write_plist_file(users_plist, "#{users_plist_dir}/#{@resource.name}.plist", :binary)
-  end
+  private
 
-  # This is a simple wrapper method for writing values to a file.
-  def write_to_file(filename, value)
-    Puppet.deprecation_warning("Puppet::Type.type(:user).provider(:directoryservice).write_to_file is deprecated and will be removed in Puppet 5.")
-    begin
-      File.open(filename, 'w') { |f| f.write(value)}
-    rescue Errno::EACCES => detail
-      raise Puppet::Error, "Could not write to file #{filename}: #{detail}", detail.backtrace
-    end
-  end
+  SHA512_PBKDF2_AUTHENTICATION_AUTHORITY = ';ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2>'
 end

data/lib/puppet/provider/user/hpux.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   desc "User management for HP-UX. This provider uses the undocumented `-F`
     switch to HP-UX's special `usermod` binary to work around the fact that
@@ -5,8 +7,8 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
     New functionality provides for changing trusted computing passwords and
     resetting password expirations under trusted computing."
 
-  defaultfor :operatingsystem => "hp-ux"
-  confine :operatingsystem => "hp-ux"
+  defaultfor 'os.name' => "hp-ux"
+  confine 'os.name' => "hp-ux"
 
   commands :modify => "/usr/sam/lbin/usermod.sam", :delete => "/usr/sam/lbin/userdel.sam", :add => "/usr/sam/lbin/useradd.sam"
   options :comment, :method => :gecos
@@ -24,72 +26,68 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   has_features :manages_homedir, :allows_duplicates, :manages_passwords
 
   def deletecmd
-    super.insert(1,"-F")
+    super.insert(1, "-F")
   end
 
-  def modifycmd(param,value)
-     cmd = super(param, value)
-     cmd << "-F"
-     if trusted then
-       # Append an additional command to reset the password age to 0
-       # until a workaround with expiry module can be found for trusted
-       # computing.
-       cmd << ";"
-       cmd << "/usr/lbin/modprpw"
-       cmd << "-v"
-       cmd << "-l"
-       cmd << "#{resource.name}"
-     end
-     cmd
+  def modifycmd(param, value)
+    cmd = super(param, value)
+    cmd.insert(1, "-F")
+    if trusted then
+      # Append an additional command to reset the password age to 0
+      # until a workaround with expiry module can be found for trusted
+      # computing.
+      cmd << ";"
+      cmd << "/usr/lbin/modprpw"
+      cmd << "-v"
+      cmd << "-l"
+      cmd << resource.name.to_s
+    end
+    cmd
   end
 
   def password
     # Password management routine for trusted and non-trusted systems
-    #temp=""
-    while ent = Etc.getpwent() do
+    # temp=""
+    while ent = Etc.getpwent() # rubocop:disable Lint/AssignmentInCondition
       if ent.name == resource.name
-        temp=ent.name
+        temp = ent.name
         break
       end
     end
     Etc.endpwent()
-    if !temp
+    unless temp
       return nil
     end
 
     ent = Etc.getpwnam(resource.name)
     if ent.passwd == "*"
       # Either no password or trusted password, check trusted
-      file_name="/tcb/files/auth/#{resource.name.chars.first}/#{resource.name}"
+      file_name = "/tcb/files/auth/#{resource.name.chars.first}/#{resource.name}"
       if File.file?(file_name)
         # Found the tcb user for the specific user, now get passwd
         File.open(file_name).each do |line|
-          if ( line =~ /u_pwd/ )
-            temp_passwd=line.split(":")[1].split("=")[1]
-            ent.passwd = temp_passwd
-            return ent.passwd
-          end
+          next unless line =~ /u_pwd/
+
+          temp_passwd = line.split(":")[1].split("=")[1]
+          ent.passwd = temp_passwd
+          return ent.passwd
         end
       else
         debug "No trusted computing user file #{file_name} found."
       end
     else
-      return ent.passwd
+      ent.passwd
     end
   end
 
   def trusted
     # Check to see if the HP-UX box is running in trusted compute mode
     # UID for root should always be 0
-    trusted_sys = exec_getprpw('root','-m uid')
-    if trusted_sys.chomp == "uid=0"
-      return true
-    else
-      return false
-    end
+    trusted_sys = exec_getprpw('root', '-m uid')
+    trusted_sys.chomp == "uid=0"
   end
 
-  def exec_getprpw(user,opts)
+  def exec_getprpw(user, opts)
     Puppet::Util::Execution.execute("/usr/lbin/getprpw #{opts} #{user}", { :combine => true })
   end
 end