puppet 6.13.0 → 6.18.0

data/spec/unit/type/file_spec.rb

@@ -3,6 +3,34 @@ require 'spec_helper'
 describe Puppet::Type.type(:file) do
   include PuppetSpec::Files
 
+  # precomputed checksum values for FILE_CONTENT
+  FILE_CONTENT = 'file content'.freeze
+  CHECKSUM_VALUES = {
+    md5: 'd10b4c3ff123b26dc068d43a8bef2d23',
+    md5lite: 'd10b4c3ff123b26dc068d43a8bef2d23',
+    sha256: 'e0ac3601005dfa1864f5392aabaf7d898b1b5bab854f1acb4491bcd806b76b0c',
+    sha256lite: 'e0ac3601005dfa1864f5392aabaf7d898b1b5bab854f1acb4491bcd806b76b0c',
+    sha1: '87758871f598e1a3b4679953589ae2f57a0bb43c',
+    sha1lite: '87758871f598e1a3b4679953589ae2f57a0bb43c',
+    sha224: '2aefaaa5f4d8f17f82f3e1bb407e190cede9aa1311fa4533ce505531',
+    sha384: '61c7783501ebd90233650357fefbe5a141b7618f907b8f043bbaa92c0f610c785a641ddd479fa81d650cd86e29aa6858',
+    sha512: '2fb1877301854ac92dd518018f97407a0a88bb696bfef0a51e9efbd39917353500009e15bd72c3f0e4bf690115870bfab926565d5ad97269d922dbbb41261221',
+    mtime: 'Jan 26 13:59:49 2016',
+    ctime: 'Jan 26 13:59:49 2016'
+  }.freeze
+
+  INVALID_CHECKSUM_VALUES = {
+    md5: '00000000000000000000000000000000',
+    md5lite: '00000000000000000000000000000000',
+    sha256: '0000000000000000000000000000000000000000000000000000000000000000',
+    sha256lite: '0000000000000000000000000000000000000000000000000000000000000000',
+    sha1: '0000000000000000000000000000000000000000',
+    sha1lite: '0000000000000000000000000000000000000000',
+    sha224: '00000000000000000000000000000000000000000000000000000000',
+    sha384: '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
+    sha512: '00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'
+  }.freeze
+
   let(:path) { tmpfile('file_testing') }
   let(:file) { described_class.new(:path => path, :catalog => catalog) }
   let(:provider) { file.provider }
@@ -791,7 +819,7 @@ describe Puppet::Type.type(:file) do
       let(:sources) do
         h = {}
         %w{/a /b /c /d}.each do |key|
-          h[key] = URI.unescape(Puppet::Util.path_to_uri(File.expand_path(key)).to_s)
+          h[key] = Puppet::Util.uri_unescape(Puppet::Util.path_to_uri(File.expand_path(key)).to_s)
         end
         h
       end
@@ -1108,38 +1136,6 @@ describe Puppet::Type.type(:file) do
   end
 
   describe "#write" do
-    describe "when validating the checksum" do
-      before { allow(file).to receive(:validate_checksum?).and_return(true) }
-
-      it "should fail if the checksum parameter and content checksums do not match" do
-        checksum = double('checksum_parameter',  :sum => 'checksum_b', :sum_file => 'checksum_b')
-        allow(file).to receive(:parameter).with(:checksum).and_return(checksum)
-        allow(file).to receive(:parameter).with(:source).and_return(nil)
-
-
-        property = double('content_property', :actual_content => "something", :length => "something".length, :write => 'checksum_a')
-        allow(file).to receive(:property).with(:content).and_return(property)
-
-        expect { file.write property }.to raise_error(Puppet::Error) end
-    end
-
-    describe "when not validating the checksum" do
-      before do
-        allow(file).to receive(:validate_checksum?).and_return(false)
-      end
-
-      it "should not fail if the checksum property and content checksums do not match" do
-        checksum = double('checksum_parameter',  :sum => 'checksum_b')
-        allow(file).to receive(:parameter).with(:checksum).and_return(checksum)
-        allow(file).to receive(:parameter).with(:source).and_return(nil)
-
-        property = double('content_property', :actual_content => "something", :length => "something".length, :write => 'checksum_a')
-        allow(file).to receive(:property).with(:content).and_return(property)
-
-        expect { file.write property }.to_not raise_error
-      end
-    end
-
     describe "when resource mode is supplied" do
       before do
         allow(file).to receive(:property_fix)
@@ -1191,7 +1187,7 @@ describe Puppet::Type.type(:file) do
     describe "when resource mode is not supplied" do
       context "and content is supplied" do
         it "should default to 0644 mode" do
-          file = described_class.new(:path => path, :content => "file content")
+          file = described_class.new(:path => path, :content => FILE_CONTENT)
 
           file.write file.parameter(:content)
 
@@ -1214,35 +1210,6 @@ describe Puppet::Type.type(:file) do
     end
   end
 
-  describe "#fail_if_checksum_is_wrong" do
-    it "should fail if the checksum of the file doesn't match the expected one" do
-      expect do
-        allow(file.parameter(:checksum)).to receive(:sum_file).and_return('wrong!!')
-        file.instance_eval do
-          fail_if_checksum_is_wrong(self[:path], 'anything!')
-        end
-      end.to raise_error(Puppet::Error, /File written to disk did not match checksum/)
-    end
-
-    it "should not fail if the checksum is correct" do
-      expect do
-        allow(file.parameter(:checksum)).to receive(:sum_file).and_return('anything!')
-        file.instance_eval do
-          fail_if_checksum_is_wrong(self[:path], 'anything!')
-        end
-      end.not_to raise_error
-    end
-
-    it "should not fail if the checksum is absent" do
-      expect do
-        allow(file.parameter(:checksum)).to receive(:sum_file).and_return(nil)
-        file.instance_eval do
-          fail_if_checksum_is_wrong(self[:path], 'anything!')
-        end
-      end.not_to raise_error
-    end
-  end
-
   describe "#write_temporary_file?" do
     it "should be true if the file has specified content" do
       file[:content] = 'some content'
@@ -1462,7 +1429,7 @@ describe Puppet::Type.type(:file) do
       expect(Puppet::FileServing::Metadata.indirection).to receive(:find).with(source, anything).and_return(metadata)
 
       uri = file.parameters[:source].uri
-      expect(URI.unescape(uri.path)).to eq(filename)
+      expect(Puppet::Util.uri_unescape(uri.path)).to eq(filename)
       expect(uri.path.encoding).to eq(Encoding::UTF_8)
     end
 
@@ -1486,29 +1453,16 @@ describe Puppet::Type.type(:file) do
       expect_any_instance_of(Puppet::Indirector::FileMetadata::Rest).to receive(:find).with(request_key(filename[1..-1])).and_return(metadata)
 
       uri = file.parameters[:source].uri
-      expect(URI.unescape(uri.path)).to eq(filename)
+      expect(Puppet::Util.uri_unescape(uri.path)).to eq(filename)
       expect(uri.path.encoding).to eq(Encoding::UTF_8)
     end
   end
 
   describe "when using source" do
+    let(:source) { tmpfile('file_source') }
+
     before do
-      file[:source] = File.expand_path('/one')
-      # Contents of an empty file generate the below hash values
-      # in case you need to add support for additional algorithms in future
-      @checksum_values = {
-        :md5 => 'd41d8cd98f00b204e9800998ecf8427e',
-        :md5lite => 'd41d8cd98f00b204e9800998ecf8427e',
-        :sha256 => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha256lite => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha1 => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha1lite => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha224 => 'd14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f',
-        :sha384 => '38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b',
-        :sha512 => 'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e',
-        :mtime => 'Jan 26 13:59:49 2016',
-        :ctime => 'Jan 26 13:59:49 2016'
-      }
+      file[:source] = source
     end
 
     Puppet::Type::File::ParameterChecksum.value_collection.values.reject {|v| v == :none}.each do |checksum_type|
@@ -1527,9 +1481,51 @@ describe Puppet::Type.type(:file) do
         end
 
         it 'should validate a valid checksum_value' do
-          file[:checksum_value] = @checksum_values[checksum_type]
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
           expect { file.validate }.to_not raise_error
         end
+
+        it 'fails if the checksum_value parameter and written file do not match' do
+          skip if checksum_type =~ /^(ctime|mtime)/
+
+          File.write(source, FILE_CONTENT)
+          file[:checksum_value] = INVALID_CHECKSUM_VALUES[checksum_type]
+
+          expect {
+            file.property(:checksum_value).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'fails if the checksum_value parameter does not match, but the metadata does' do
+          skip if checksum_type =~ /^(ctime|mtime)/
+
+          File.write(source, FILE_CONTENT)
+          file[:checksum_value] = INVALID_CHECKSUM_VALUES[checksum_type]
+          allow(file.parameter(:source).metadata).to receive(:checksum).and_return(file[:checksum_value])
+
+          expect {
+            file.property(:checksum_value).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'replaces a file from a source when the checksum matches' do
+          File.write(source, FILE_CONTENT)
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
+
+          file.property(:checksum_value).sync
+          checksum = file.parameter(:checksum).sum_file(file[:path])
+
+          if checksum_type =~ /^(ctime|mtime)/
+            # file on disk ctime/mtime will be later than expected time
+            expect(checksum).to match(/{#{checksum_type}}/)
+          else
+            expect(checksum).to eq("{#{checksum_type}}#{file[:checksum_value]}")
+          end
+        end
       end
     end
 
@@ -1591,19 +1587,8 @@ describe Puppet::Type.type(:file) do
   end
 
   describe "when using content" do
-    before do
-      file[:content] = 'file contents'
-      @checksum_values = {
-        :md5 => 'd41d8cd98f00b204e9800998ecf8427e',
-        :md5lite => 'd41d8cd98f00b204e9800998ecf8427e',
-        :sha256 => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha256lite => 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-        :sha1 => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha1lite => 'da39a3ee5e6b4b0d3255bfef95601890afd80709',
-        :sha224 => 'd14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f',
-        :sha384 => '38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b',
-        :sha512 => 'cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e',
-      }
+    before :each do
+      file[:content] = FILE_CONTENT
     end
 
     (Puppet::Type::File::ParameterChecksum.value_collection.values - SOURCE_ONLY_CHECKSUMS).each do |checksum_type|
@@ -1622,9 +1607,43 @@ describe Puppet::Type.type(:file) do
         end
 
         it 'should validate a valid checksum_value' do
-          file[:checksum_value] = @checksum_values[checksum_type]
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
           expect { file.validate }.to_not raise_error
         end
+
+        it 'fails if the checksum_value parameter and written file do not match' do
+          file[:checksum_value] = INVALID_CHECKSUM_VALUES[checksum_type]
+
+          expect {
+            file.property(:content).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'fails if the calculated checksum for the content and written file do not match' do
+          allow(file.parameter(:checksum)).to receive(:sum).and_return(INVALID_CHECKSUM_VALUES[checksum_type])
+
+          expect {
+            file.property(:content).sync
+          }.to raise_error(Puppet::Error, /File written to disk did not match desired checksum/)
+
+          expect(Puppet::FileSystem).to_not be_exist(file[:path])
+        end
+
+        it 'replaces a file from content when the checksum matches' do
+          file[:checksum_value] = CHECKSUM_VALUES[checksum_type]
+
+          file.property(:content).sync
+          checksum = file.parameter(:checksum).sum_file(file[:path])
+
+          if checksum_type =~ /^(ctime|mtime)/
+            # file on disk ctime/mtime will be later than expected time
+            expect(checksum).to match(/{#{checksum_type}}/)
+          else
+            expect(checksum).to eq("{#{checksum_type}}#{file[:checksum_value]}")
+          end
+        end
       end
     end
 
@@ -1657,6 +1676,13 @@ describe Puppet::Type.type(:file) do
       file[:checksum_value] = ''
       expect { file.validate }.to_not raise_error
     end
+
+    it 'writes a file' do
+      file[:ensure] = :file
+      file.property(:ensure).sync
+
+      expect(file.parameter(:checksum).sum_file(file[:path])).to eq('{none}')
+    end
   end
 
   describe "when auditing" do

data/spec/unit/type/service_spec.rb

@@ -145,6 +145,199 @@ describe test_title, "when validating attribute values" do
     end
   end
 
+  describe "the service logon credentials" do 
+    before do
+      provider_class_with_logon_credentials = Puppet::Type.type(:service).provide(:simple) do
+        has_features :manages_logon_credentials
+        def logonpassword=(value) end
+      end
+      allow(Puppet::Type.type(:service)).to receive(:defaultprovider).and_return(provider_class_with_logon_credentials)
+    end
+
+    describe "the 'logonaccount' property" do
+      it "should not be munged nor checked when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'NonWindowsUser')
+
+        expect { service }.not_to raise_error
+        expect(service[:logonaccount]).to eq('NonWindowsUser')
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should fail when the `Log On As A Service` right is missing from given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" is missing the 'Log On As A Service' right./)
+        end
+
+        it "should fail when the `Log On As A Service` right is set to denied for given user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeDenyServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.to raise_error(Puppet::Error, /"myPC\\myUser" has the 'Log On As A Service' right set to denied./)
+        end
+
+        it "should not fail when given user has the `Log On As A Service` right" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with('myPC\\myUser').and_return("SeServiceLogonRight")
+
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
+
+          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser') }.not_to raise_error
+        end
+
+        ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input|
+          it "should succesfully munge #{user_input} to 'LocalSystem'" do
+            service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => user_input)
+
+            expect { service }.not_to raise_error
+            expect(service[:logonaccount]).to eq('LocalSystem')
+          end
+        end
+
+        it "should succesfully munge local account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('.\myUser')
+        end
+
+        it "should succesfully munge domain account" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("DomainUser", nil, nil, "myDomain", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'DomainUser')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('myDomain\DomainUser')
+        end
+
+        it "should succesfully munge well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalService')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE')
+        end
+
+        it "should succesfully munge a SID" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser))
+          service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'S-1-5-20')
+
+          expect { service }.not_to raise_error
+          expect(service[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE')
+        end
+
+        it "should fail when account is invalid" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(nil)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'InvalidUser') }.to raise_error(Puppet::Error, /"InvalidUser" is not a valid account/)
+        end
+
+        it "should fail when sid type is not user or well known user" do
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias))
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'Administrators') }.to raise_error(Puppet::Error, /"Administrators" is not a valid account/)
+        end
+      end
+    end
+
+    describe "the logonpassword parameter" do
+      it "should fail when logonaccount is not being managed as well" do
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonpassword => 'myPass') }.to raise_error(Puppet::Error, /The 'logonaccount' parameter is mandatory when setting 'logonpassword'./)
+      end
+
+      it "should default to empty string when only logonaccount is being managed" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        service = Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser')
+
+        expect { service }.not_to raise_error
+        expect(service[:logonpassword]).to eq("")
+      end
+
+      it "should default to nil when not even logonaccount is being managed" do
+        service = Puppet::Type.type(:service).new(:name => "yay")
+        expect(service[:logonpassword]).to eq(nil)
+      end
+
+      it "should fail when logonpassword includes the ':' character" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'my:Pass') }.to raise_error(Puppet::Error, /Passwords cannot include ':'/)
+      end
+
+      it "should not further check the password against given account when not on Windows" do
+        allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+        expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+      end
+
+      context "when on Windows", :if => Puppet::Util::Platform.windows? do
+        before do
+          allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return("myPC")
+          allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(name_to_principal_result)
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        end
+
+        it "should pass validation when given account is 'LocalSystem'" do
+          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true)
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(false)
+
+          expect(Puppet::Util::Windows::SID).not_to receive(:name_to_principal)
+          expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+          expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'LocalSystem') }.not_to raise_error
+        end
+
+        ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account|
+          describe "when given account is #{predefined_local_account}" do
+            let(:name_to_principal_result) do
+              Puppet::Util::Windows::SID::Principal.new(predefined_local_account, nil, nil, "NT AUTHORITY", :SidTypeUser)
+            end
+
+            it "should pass validation" do
+              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(predefined_local_account).and_return(false)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(predefined_local_account).and_return(true)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with("NT AUTHORITY\\#{predefined_local_account}").and_return(true)
+
+              expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+              expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => predefined_local_account) }.not_to raise_error
+            end
+          end
+        end
+
+        let(:name_to_principal_result) do
+          Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, "myPC", :SidTypeUser)
+        end
+
+        describe "when given logonaccount is not a predefined local account" do
+          before do
+            allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('myUser').and_return(false)
+            allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('.\\myUser').and_return(false)
+          end
+
+          it "should pass validation if password is proven correct" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myPass') }.not_to raise_error
+          end
+
+          it "should not pass validation if password check fails" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false)
+            expect { Puppet::Type.type(:service).new(:name => "yay", :logonaccount => 'myUser', :logonpassword => 'myWrongPass') }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/)
+          end
+        end
+      end
+    end
+  end
+
   it "should support :true as a value to :hasstatus" do
     srv = Puppet::Type.type(:service).new(:name => "yay", :hasstatus => :true)
     expect(srv[:hasstatus]).to eq(:true)
@@ -284,20 +477,21 @@ describe test_title, "when changing the host" do
     @service.property(:enable).sync
   end
 
-  it "should always consider the enable state of a static service to be in sync" do
+  it "should let superclass implementation resolve insyncness when provider does not respond to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
-    expect(@service.provider).to receive(:cached_enabled?).and_return('static')
-    @service[:enable] = false
-    expect(Puppet).to receive(:debug).with("Unable to enable or disable static service yay")
+    @service[:enable] = true
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(false)
+
     expect(@service.property(:enable).insync?(:true)).to eq(true)
   end
 
-  it "should determine insyncness normally when the service is not static" do
+  it "insyncness should be resolved by provider instead of superclass implementation when provider responds to the 'enabled_insync?' method" do
     allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
-    expect(@service.provider).to receive(:cached_enabled?).and_return('true')
     @service[:enable] = true
-    expect(Puppet).not_to receive(:debug)
-    expect(@service.property(:enable).insync?(:true)).to eq(true)
+    allow(@service.provider).to receive(:respond_to?).with(:enabled_insync?).and_return(true)
+    allow(@service.provider).to receive(:enabled_insync?).and_return(false)
+
+    expect(@service.property(:enable).insync?(:true)).to eq(false)
   end
 
   it "should sync the service's enable state when changing the state of :ensure if :enable is being managed" do
@@ -313,6 +507,22 @@ describe test_title, "when changing the host" do
 
     @service.property(:ensure).sync
   end
+
+  it "should sync the service's logonaccount state when changing the state of :ensure if :logonaccount is being managed" do
+    allow(@service.provider.class).to receive(:supports_parameter?).and_return(true)
+    allow(Puppet::Util::Platform).to receive(:windows?).and_return(false)
+
+    @service[:ensure] = :stopped
+    @service[:logonaccount] = 'LocalSystem'
+
+    expect(@service.property(:logonaccount)).to receive(:retrieve).and_return("MyUser")
+    expect(@service.property(:logonaccount)).to receive(:insync?).and_return(false)
+    expect(@service.property(:logonaccount)).to receive(:sync)
+
+    allow(@service.provider).to receive(:stop)
+
+    @service.property(:ensure).sync
+  end
 end
 
 describe test_title, "when refreshing the service" do