puppet 6.11.1 → 6.16.0

data/spec/unit/node/facts_spec.rb

@@ -88,7 +88,8 @@ describe Puppet::Node::Facts, "when indirecting" do
       @facts.sanitize
       fact_value = @facts.values['test']
       expect(fact_value).to eq(an_alien.to_s)
-      expect(fact_value.encoding).to eq(Encoding::UTF_8)
+      # JRuby 9.2.8 reports US-ASCII which is a subset of UTF-8
+      expect(fact_value.encoding).to eq(Encoding::UTF_8).or eq(Encoding::US_ASCII)
     end
 
   end

data/spec/unit/node_spec.rb

@@ -417,7 +417,9 @@ end
 
 describe Puppet::Node, "when generating the list of names to search through" do
   before do
-    @node = Puppet::Node.new("foo.domain.com", :parameters => {"hostname" => "yay", "domain" => "domain.com"})
+    Puppet[:strict_hostname_checking] = false
+    @node = Puppet::Node.new("foo.domain.com",
+                             :parameters => {"hostname" => "yay", "domain" => "domain.com"})
   end
 
   it "returns an array of names" do
@@ -448,7 +450,6 @@ describe Puppet::Node, "when generating the list of names to search through" do
 
   describe "and :node_name is set to 'cert'" do
     before do
-      Puppet[:strict_hostname_checking] = false
       Puppet[:node_name] = "cert"
     end
 
@@ -457,8 +458,11 @@ describe Puppet::Node, "when generating the list of names to search through" do
     end
 
     describe "and strict hostname checking is enabled" do
-      it "only uses the passed-in key" do
+      before do
         Puppet[:strict_hostname_checking] = true
+      end
+
+      it "only uses the passed-in key" do
         expect(@node.names).to eq(["foo.domain.com"])
       end
     end
@@ -466,7 +470,6 @@ describe Puppet::Node, "when generating the list of names to search through" do
 
   describe "and :node_name is set to 'facter'" do
     before do
-      Puppet[:strict_hostname_checking] = false
       Puppet[:node_name] = "facter"
     end
 

data/spec/unit/pops/evaluator/evaluating_parser_spec.rb

@@ -478,21 +478,26 @@ describe 'Puppet::Pops::Evaluator::EvaluatorImpl' do
       }.each do |source, coerced_val|
           it "should warn about numeric coercion in '#{source}' when strict = warning" do
             Puppet[:strict] = :warning
+            expect(Puppet::Pops::Evaluator::Runtime3Support::EvaluationError).not_to receive(:new)
             collect_notices(source)
             expect(warnings).to include(/The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/)
           end
 
           it "should not warn about numeric coercion in '#{source}' if strict = off" do
             Puppet[:strict] = :off
+            expect(Puppet::Pops::Evaluator::Runtime3Support::EvaluationError).not_to receive(:new)
             collect_notices(source)
             expect(warnings).to_not include(/The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/)
           end
 
         it "should error when finding numeric coercion in '#{source}' if strict = error" do
           Puppet[:strict] = :error
-          expect { parser.evaluate_string(scope, source, __FILE__) }.to raise_error(
-            /The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/
-            )
+          expect {
+            parser.evaluate_string(scope, source, __FILE__)
+          }.to raise_error {|error|
+            expect(error.message).to match(/The string '#{coerced_val}' was automatically coerced to the numerical value #{coerced_val}/)
+            expect(error.backtrace.first).to match(/runtime3_support\.rb.+optionally_fail/)
+          }
         end
       end
 

data/spec/unit/pops/serialization/to_from_hr_spec.rb

@@ -296,10 +296,15 @@ module Serialization
           expect(val2).to be_a(Types::PObjectTypeExtension)
           expect(val2).to eql(val)
         end
+
+        it 'with POjbectTypeExtension type being converted' do
+          val = { 'ObjectExtension' => type.create(34) }
+          expect(to_converter.convert(val))
+            .to eq({"ObjectExtension"=>{"__ptype"=>"MyType", "x"=>34}})
+        end
       end
     end
 
-
     it 'Array of rich data' do
       # Sensitive omitted because it doesn't respond to ==
       val = [

data/spec/unit/pops/validator/validator_spec.rb

@@ -486,10 +486,15 @@ describe "validating 4x" do
         expect(acceptor).to have_issue(Puppet::Pops::Issues::EXPRESSION_NOT_SUPPORTED_WHEN_SCRIPTING)
       end
 
-      it 'produces an error for node expressions' do
+      it 'allows node expressions' do
         acceptor = validate(parse('apply("foo.example.com") { node default {} }'))
+        expect(acceptor.error_count).to eql(0)
+      end
+
+      it 'produces an error for node expressions nested in a block' do
+        acceptor = validate(parse('apply("foo.example.com") { if true { node default {} } }'))
         expect(acceptor.error_count).to eql(1)
-        expect(acceptor).to have_issue(Puppet::Pops::Issues::EXPRESSION_NOT_SUPPORTED_WHEN_SCRIPTING)
+        expect(acceptor).to have_issue(Puppet::Pops::Issues::NOT_TOP_LEVEL)
       end
 
       it 'produces an error for resource definitions' do

data/spec/unit/provider/aix_object_spec.rb

@@ -418,15 +418,29 @@ bin:2
   end
 
   describe '#ia_module_args' do
-    it 'returns no arguments if the ia_load_module parameter is not specified' do
+    it 'returns no arguments if ia_load_module parameter or forcelocal parameter are not specified' do
       allow(provider.resource).to receive(:[]).with(:ia_load_module).and_return(nil)
+      allow(provider.resource).to receive(:[]).with(:forcelocal).and_return(nil)
       expect(provider.ia_module_args).to eql([])
     end
 
-    it 'returns the ia_load_module as a CLI argument' do
+    it 'returns the ia_load_module as a CLI argument when ia_load_module is specified' do
       allow(provider.resource).to receive(:[]).with(:ia_load_module).and_return('module')
+      allow(provider.resource).to receive(:[]).with(:forcelocal).and_return(nil)
       expect(provider.ia_module_args).to eql(['-R', 'module'])
     end
+
+    it 'returns "files" as a CLI argument when forcelocal is specified' do
+      allow(provider.resource).to receive(:[]).with(:ia_load_module).and_return(nil)
+      allow(provider.resource).to receive(:[]).with(:forcelocal).and_return(true)
+      expect(provider.ia_module_args).to eql(['-R', 'files'])
+    end
+
+    it 'raises argument error when both ia_load_module and forcelocal parameters are set' do
+      allow(provider.resource).to receive(:[]).with(:ia_load_module).and_return('files')
+      allow(provider.resource).to receive(:[]).with(:forcelocal).and_return(true)
+      expect { provider.ia_module_args }.to raise_error(ArgumentError, "Cannot have both 'forcelocal' and 'ia_load_module' at the same time!")
+    end
   end
 
   describe '#lscmd' do

data/spec/unit/provider/group/groupadd_spec.rb

@@ -14,10 +14,11 @@ describe Puppet::Type.type(:group).provider(:groupadd) do
 
   let(:resource) { Puppet::Type.type(:group).new(:name => 'mygroup', :provider => provider) }
   let(:provider) { described_class.new(:name => 'mygroup') }
+  let(:members) { ['user2', 'user1', 'user3'] }
 
   describe "#create" do
     before do
-       allow(provider).to receive(:exists?).and_return(false)
+      allow(provider).to receive(:exists?).and_return(false)
     end
 
     it "should add -o when allowdupe is enabled and the group is being created" do
@@ -42,77 +43,149 @@ describe Puppet::Type.type(:group).provider(:groupadd) do
       end
     end
 
-    describe "on systems with the libuser and forcelocal=true" do
-      before do
-        described_class.has_feature(:libuser)
-        resource[:forcelocal] = :true
-      end
- 
-      it "should use lgroupadd instead of groupadd" do
-        expect(provider).to receive(:execute).with(including('/usr/sbin/lgroupadd'), hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
-        provider.create
-      end
+    describe "on systems with libuser" do
+      describe "with forcelocal=true" do
+        before do
+          described_class.has_feature(:manages_local_users_and_groups)
+          resource[:forcelocal] = :true
+        end
 
-      it "should NOT pass -o to lgroupadd" do
-        resource[:allowdupe] = :true
-        expect(provider).to receive(:execute).with(excluding('-o'), hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
-        provider.create
+        it "should use lgroupadd instead of groupadd" do
+          expect(provider).to receive(:execute).with(including('/usr/sbin/lgroupadd'), hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
+          provider.create
+        end
+
+        it "should NOT pass -o to lgroupadd" do
+          resource[:allowdupe] = :true
+          expect(provider).to receive(:execute).with(excluding('-o'), hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
+          provider.create
+        end
+
+        it "should raise an exception for duplicate GID if allowdupe is not set and duplicate GIDs exist" do
+          resource[:gid] = 505
+          allow(provider).to receive(:findgroup).and_return(true)
+          expect { provider.create }.to raise_error(Puppet::Error, "GID 505 already exists, use allowdupe to force group creation")
+        end
       end
 
-      it "should raise an exception for duplicate GID if allowdupe is not set and duplicate GIDs exist" do
-        resource[:gid] = 505
-        allow(provider).to receive(:findgroup).and_return(true)
-        expect { provider.create }.to raise_error(Puppet::Error, "GID 505 already exists, use allowdupe to force group creation")
-     end
+      describe "with a list of members" do
+        before do
+          members.each { |m| allow(Etc).to receive(:getpwnam).with(m).and_return(true) }
+
+          described_class.has_feature(:manages_members)
+          resource[:forcelocal] = false
+          resource[:members] = members
+        end
+
+        it "should use lgroupmod to add the members" do
+          allow(provider).to receive(:execute).with(['/usr/sbin/groupadd', 'mygroup'], hash_including({:failonfail => true, :combine => true, :custom_environment => {}})).and_return(true)
+          expect(provider).to receive(:execute).with(['/usr/sbin/lgroupmod', '-M', members.join(','), 'mygroup'], hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
+          provider.create
+        end
+      end
     end
   end
 
   describe "#modify" do
     before do
-       allow(provider).to receive(:exists?).and_return(true)
+      allow(provider).to receive(:exists?).and_return(true)
     end
 
-    describe "on systems with the libuser and forcelocal=false" do
-      before do
-        described_class.has_feature(:libuser)
-        resource[:forcelocal] = :false
-      end
+    describe "on systems with libuser" do
+      describe "with forcelocal=false" do
+        before do
+          described_class.has_feature(:manages_local_users_and_groups)
+          resource[:forcelocal] = :false
+        end
 
-      it "should use groupmod" do
-        expect(provider).to receive(:execute).with(['/usr/sbin/groupmod', '-g', 150, 'mygroup'], hash_including({:failonfail => true, :combine => true, :custom_environment => {}}))
-        provider.gid = 150
-      end
+        it "should use groupmod" do
+          expect(provider).to receive(:execute).with(['/usr/sbin/groupmod', '-g', 150, 'mygroup'], hash_including({:failonfail => true, :combine => true, :custom_environment => {}}))
+          provider.gid = 150
+        end
 
-      it "should pass -o to groupmod" do
-        resource[:allowdupe] = :true
-        expect(provider).to receive(:execute).with(['/usr/sbin/groupmod', '-g', 150, '-o', 'mygroup'], hash_including({:failonfail => true, :combine => true, :custom_environment => {}}))
-        provider.gid = 150
+        it "should pass -o to groupmod" do
+          resource[:allowdupe] = :true
+          expect(provider).to receive(:execute).with(['/usr/sbin/groupmod', '-g', 150, '-o', 'mygroup'], hash_including({:failonfail => true, :combine => true, :custom_environment => {}}))
+          provider.gid = 150
+        end
       end
-    end
 
-    describe "on systems with the libuser and forcelocal=true" do
-      before do
-        described_class.has_feature(:libuser)
-        resource[:forcelocal] = :true
-      end
+      describe "with forcelocal=true" do
+        before do
+          described_class.has_feature(:manages_local_users_and_groups)
+          resource[:forcelocal] = :true
+        end
 
-      it "should use lgroupmod instead of groupmod" do
-        expect(provider).to receive(:execute).with(['/usr/sbin/lgroupmod', '-g', 150, 'mygroup'], hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
-        provider.gid = 150
-      end
+        it "should use lgroupmod instead of groupmod" do
+          expect(provider).to receive(:execute).with(['/usr/sbin/lgroupmod', '-g', 150, 'mygroup'], hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
+          provider.gid = 150
+        end
+
+        it "should NOT pass -o to lgroupmod" do
+          resource[:allowdupe] = :true
+          expect(provider).to receive(:execute).with(['/usr/sbin/lgroupmod', '-g', 150, 'mygroup'], hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
+          provider.gid = 150
+        end
 
-      it "should NOT pass -o to lgroupmod" do
-        resource[:allowdupe] = :true
-        expect(provider).to receive(:execute).with(['/usr/sbin/lgroupmod', '-g', 150, 'mygroup'], hash_including(:custom_environment => hash_including('LIBUSER_CONF')))
-        provider.gid = 150
+        it "should raise an exception for duplicate GID if allowdupe is not set and duplicate GIDs exist" do
+          resource[:gid] = 150
+          resource[:allowdupe] = :false
+          allow(provider).to receive(:findgroup).and_return(true)
+          expect { provider.gid = 150 }.to raise_error(Puppet::Error, "GID 150 already exists, use allowdupe to force group creation")
+        end
       end
 
-      it "should raise an exception for duplicate GID if allowdupe is not set and duplicate GIDs exist" do
-        resource[:gid] = 150
-        resource[:allowdupe] = :false
-        allow(provider).to receive(:findgroup).and_return(true)
-        expect { provider.gid = 150 }.to raise_error(Puppet::Error, "GID 150 already exists, use allowdupe to force group creation")
-     end
+      describe "with members=something" do
+        before do
+          described_class.has_feature(:manages_members)
+          allow(Etc).to receive(:getpwnam).and_return(true)
+          resource[:members] = members
+        end
+
+        describe "with auth_membership on" do
+          before { resource[:auth_membership] = true }
+
+          it "should purge existing users before adding" do
+            allow(provider).to receive(:members).and_return(members)
+            expect(provider).to receive(:localmodify).with('-m', members.join(','), 'mygroup')
+            provider.modifycmd(:members, ['user1'])
+          end
+        end
+
+        describe "with auth_membership off" do
+          before { resource[:auth_membership] = false }
+
+          it "should add to the existing users" do
+            new_members = ['user1', 'user2', 'user3', 'user4']
+            allow(provider).to receive(:members).and_return(members)
+            expect(provider).not_to receive(:localmodify).with('-m', members.join(','), 'mygroup')
+            expect(provider).to receive(:execute).with(['/usr/sbin/lgroupmod', '-M', new_members.join(','), 'mygroup'], kind_of(Hash))
+            provider.members = new_members
+          end
+        end
+
+        it "should validate members" do
+          expect(Etc).to receive(:getpwnam).with('user3').and_return(true)
+          provider.modifycmd(:members, ['user3'])
+        end
+
+        it "should validate members list " do
+          expect(Etc).to receive(:getpwnam).with('user3').and_return(true)
+          expect(Etc).to receive(:getpwnam).with('user4').and_return(true)
+          provider.modifycmd(:members, ['user3', 'user4'])
+        end
+
+        it "should validate members list separated by commas" do
+          expect(Etc).to receive(:getpwnam).with('user3').and_return(true)
+          expect(Etc).to receive(:getpwnam).with('user4').and_return(true)
+          provider.modifycmd(:members, ['user3, user4'])
+        end
+
+        it "should raise is validation fails" do
+          expect(Etc).to receive(:getpwnam).with('user3').and_throw(ArgumentError)
+          expect { provider.modifycmd(:members, ['user3']) }.to raise_error(ArgumentError)
+        end
+      end
     end
   end
 
@@ -124,6 +197,35 @@ describe Puppet::Type.type(:group).provider(:groupadd) do
     end
   end
 
+  describe "#findgroup" do
+    before { allow(File).to receive(:read).with('/etc/group').and_return(content) }
+
+    let(:content) { "sample_group_name:sample_password:sample_gid:sample_user_list" }
+    let(:output) do
+      {
+        group_name: 'sample_group_name',
+        password: 'sample_password',
+        gid: 'sample_gid',
+        user_list: 'sample_user_list',
+      }
+    end
+
+    [:group_name, :password, :gid, :user_list].each do |key|
+      it "finds a group by #{key} when asked" do
+        expect(provider.send(:findgroup, key, "sample_#{key}")).to eq(output)
+      end
+    end
+
+    it "returns false when specified key/value pair is not found" do
+      expect(provider.send(:findgroup, :group_name, 'invalid_group_name')).to eq(false)
+    end
+
+    it "reads the group file only once per resource" do
+      expect(File).to receive(:read).with('/etc/group').once
+      5.times { provider.send(:findgroup, :group_name, 'sample_group_name') }
+    end
+  end
+
   describe "#delete" do
     before do
       allow(provider).to receive(:exists?).and_return(true)
@@ -131,7 +233,7 @@ describe Puppet::Type.type(:group).provider(:groupadd) do
 
     describe "on systems with the libuser and forcelocal=false" do
       before do
-        described_class.has_feature(:libuser)
+        described_class.has_feature(:manages_local_users_and_groups)
         resource[:forcelocal] = :false
       end
 
@@ -143,7 +245,7 @@ describe Puppet::Type.type(:group).provider(:groupadd) do
 
     describe "on systems with the libuser and forcelocal=true" do
       before do
-        described_class.has_feature(:libuser)
+        described_class.has_feature(:manages_local_users_and_groups)
         resource[:forcelocal] = :true
       end
 
@@ -153,4 +255,27 @@ describe Puppet::Type.type(:group).provider(:groupadd) do
       end
     end
   end
+
+  describe "group type :members property helpers" do
+    describe "#members_to_s" do
+      it "should return an empty string on non-array input" do
+        [Object.new, {}, 1, :symbol, ''].each do |input|
+          expect(provider.members_to_s(input)).to be_empty
+        end
+      end
+
+      it "should return an empty string on empty or nil users" do
+        expect(provider.members_to_s([])).to be_empty
+        expect(provider.members_to_s(nil)).to be_empty
+      end
+
+      it "should return a user string for a single user" do
+        expect(provider.members_to_s(['user1'])).to eq('user1')
+      end
+
+      it "should return a user string for multiple users" do
+        expect(provider.members_to_s(['user1', 'user2'])).to eq('user1,user2')
+      end
+    end
+  end
 end

data/spec/unit/provider/group/windows_adsi_spec.rb

@@ -33,13 +33,18 @@ describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet::Util:
     let(:user1) { double(:account => 'user1', :domain => '.', :sid => 'user1sid') }
     let(:user2) { double(:account => 'user2', :domain => '.', :sid => 'user2sid') }
     let(:user3) { double(:account => 'user3', :domain => '.', :sid => 'user3sid') }
+    let(:user_without_domain) { double(:account => 'user_without_domain', :domain => nil, :sid => 'user_without_domain_sid') }
+
     let(:invalid_user) { SecureRandom.uuid }
+    let(:invalid_user_principal) { double(:account => "#{invalid_user}", :domain => nil, :sid => "#{invalid_user}") }
 
     before :each do
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user1').and_return(user1)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user2').and_return(user2)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user3').and_return(user3)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user1', any_args).and_return(user1)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user2', any_args).and_return(user2)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user3', any_args).and_return(user3)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user_without_domain', any_args).and_return(user_without_domain)
       allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with(invalid_user).and_return(nil)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with(invalid_user, true).and_return(invalid_user_principal)
     end
 
     describe "#members_insync?" do
@@ -199,7 +204,15 @@ describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet::Util:
           ]
           expect(provider.members_insync?(current, ['user2','user1'])).to be_truthy
         end
+
+      it "should return true even if a current user is unresolvable if should is included" do
+        current = [
+            "#{invalid_user}",
+            'user2',
+          ]
+          expect(provider.members_insync?(current, ['user2'])).to be_truthy
       end
+     end
     end
 
     describe "#members_to_s" do
@@ -222,8 +235,8 @@ describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet::Util:
         expect(provider.members_to_s(['user1', 'user2'])).to eq('.\user1,.\user2')
       end
 
-      it "should return the username when it cannot be resolved to a SID (for the sake of resource_harness error messages)" do
-        expect(provider.members_to_s([invalid_user])).to eq("#{invalid_user}")
+      it "should return a user string without domain if domain is not set" do
+        expect(provider.members_to_s(['user_without_domain'])).to eq('user_without_domain')
       end
 
       it "should return the username when it cannot be resolved to a SID (for the sake of resource_harness error messages)" do
@@ -237,10 +250,14 @@ describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet::Util:
     let(:user2) { double(:account => 'user2', :domain => '.', :sid => 'user2sid') }
     let(:user3) { double(:account => 'user3', :domain => '.', :sid => 'user3sid') }
 
+    let(:invalid_user) { SecureRandom.uuid }
+    let(:invalid_user_principal) { double(:account => "#{invalid_user}", :domain => nil, :sid => "#{invalid_user}") }
+
     before :each do
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user1').and_return(user1)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user2').and_return(user2)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user3').and_return(user3)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user1', any_args).and_return(user1)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user2', any_args).and_return(user2)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user3', any_args).and_return(user3)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).with(invalid_user, true).and_return(invalid_user_principal)
 
       resource[:auth_membership] = true
     end
@@ -261,6 +278,22 @@ describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet::Util:
       expect(provider.members).to match_array(expected_members)
     end
 
+    it "should be able to handle unresolvable SID in list of members" do
+      allow(provider.group).to receive(:members).and_return([
+        'user1',
+        "#{invalid_user}",
+        'user3',
+      ])
+
+      expected_member_sids = [user1.sid, invalid_user_principal.sid, user3.sid]
+      expected_members = ['user1', "#{invalid_user}", 'user3']
+      allow(provider).to receive(:members_to_s)
+        .with(expected_member_sids)
+        .and_return(expected_members.join(','))
+
+      expect(provider.members).to match_array(expected_members)
+    end
+
     it "should be able to set group members" do
       allow(provider.group).to receive(:members).and_return(['user1', 'user2'])
 
@@ -272,8 +305,8 @@ describe Puppet::Type.type(:group).provider(:windows_adsi), :if => Puppet::Util:
 
       allow(provider.group).to receive(:member_sids).and_return(member_sids[0..1])
 
-      expect(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user2').and_return(member_sids[1])
-      expect(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user3').and_return(member_sids[2])
+      expect(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user2', any_args).and_return(member_sids[1])
+      expect(Puppet::Util::Windows::SID).to receive(:name_to_principal).with('user3', any_args).and_return(member_sids[2])
 
       expect(provider.group).to receive(:remove_member_sids).with(member_sids[0])
       expect(provider.group).to receive(:add_member_sids).with(member_sids[2])