puppet 6.17.0-x64-mingw32 → 6.21.0-x64-mingw32

data/spec/unit/type/tidy_spec.rb

@@ -191,7 +191,6 @@ describe tidy do
     describe "and recursion is used" do
       before do
         @tidy[:recurse] = true
-        allow_any_instance_of(Puppet::FileServing::Fileset).to receive(:stat).and_return(double("stat"))
         @fileset = Puppet::FileServing::Fileset.new(@basepath)
         allow(Puppet::FileServing::Fileset).to receive(:new).and_return(@fileset)
       end

data/spec/unit/type/user_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
-      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_shell
+      has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_roles, :manages_shell
       mk_resource_methods
       def create; end
       def delete; end
@@ -35,6 +35,10 @@ describe Puppet::Type.type(:user) do
     expect(described_class.provider_feature(:manages_solaris_rbac)).not_to be_nil
   end
 
+  it "should have a manages_roles feature" do
+    expect(described_class.provider_feature(:manages_roles)).not_to be_nil
+  end
+
   it "should have a manages_expiry feature" do
     expect(described_class.provider_feature(:manages_expiry)).not_to be_nil
   end
@@ -401,7 +405,7 @@ describe Puppet::Type.type(:user) do
   end
 
   describe "when user has roles" do
-    it "should autorequire roles" do
+    it "should autorequire roles on non-Windows", :unless => Puppet::Util::Platform.windows? do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
@@ -413,6 +417,31 @@ describe Puppet::Type.type(:user) do
       expect(rel.source.ref).to eq(testrole.ref)
       expect(rel.target.ref).to eq(testuser.ref)
     end
+
+    it "should not autorequire roles on Windows", :if => Puppet::Util::Platform.windows? do
+      testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
+      testrole = described_class.new(:name => "testrole")
+
+      Puppet::Resource::Catalog.new :testing do |conf|
+        [testuser, testrole].each { |resource| conf.add_resource resource }
+      end
+
+      expect(testuser.autorequire).to be_empty
+    end
+
+    it "should sync the user roles when changing the state of :ensure if :roles is being managed" do
+      user = Puppet::Type.type(:user).new(:name => "myUser", :ensure => :present)
+      user[:roles] = 'testRole'
+
+      allow(user.provider.class).to receive(:supports_parameter?).and_return(true)
+      expect(user.property(:roles)).to receive(:retrieve).and_return("other")
+      expect(user.property(:roles)).to receive(:insync?).and_return(false)
+      expect(user.property(:roles)).to receive(:sync)
+
+      allow(user.provider).to receive(:create)
+
+      user.property(:ensure).sync
+    end
   end
 
   describe "when setting shell" do

data/spec/unit/type_spec.rb

@@ -912,8 +912,8 @@ describe Puppet::Type, :unless => Puppet::Util::Platform.windows? do
 
     it "should always retrieve the ensure value by default" do
       @ensurable_resource = Puppet::Type.type(:file).new(:name => "/not/existent", :mode => "0644")
-      allow(Puppet::Type::File::Ensure).to receive(:ensure).and_return(:absent)
-      expect_any_instance_of(Puppet::Type::File::Ensure).to receive(:retrieve).once
+      # the ensure property is lazily metaprogrammed...
+      allow_any_instance_of(Puppet::Type::File::Ensure).to receive(:retrieve).and_return(:absent)
       @ensurable_resource.retrieve_resource
     end
 

data/spec/unit/util/at_fork_spec.rb

@@ -50,8 +50,8 @@ describe 'Puppet::Util::AtFork' do
               const_set(:TYPE_VOID,  nil)
               const_set(:TYPE_INT,   nil)
               const_set(:DLError,    Class.new(StandardError))
-              const_set(:Handle,     Class.new)
-              const_set(:Function,   Class.new)
+              const_set(:Handle,     Class.new { def initialize(library = nil, flags = 0); end })
+              const_set(:Function,   Class.new { def initialize(ptr, args, ret_type, abi = 0); end })
             end)
           end
         end

data/spec/unit/util/autoload_spec.rb

@@ -157,7 +157,7 @@ describe Puppet::Util::Autoload do
     end
 
     it "should load the first file in the searchpath" do
-      allow(@autoload).to receive(:search_directories).and_return([make_absolute("/a"), make_absolute("/b")])
+      allow(@autoload.class).to receive(:search_directories).and_return([make_absolute("/a"), make_absolute("/b")])
       allow(FileTest).to receive(:directory?).and_return(true)
       allow(Puppet::FileSystem).to receive(:exist?).and_return(true)
       expect(Kernel).to receive(:load).with(make_absolute("/a/tmp/myfile.rb"), any_args)
@@ -298,6 +298,10 @@ describe Puppet::Util::Autoload do
       it "should convert c:\ to c:/" do
         expect(Puppet::Util::Autoload.cleanpath('c:\\')).to eq('c:/')
       end
+
+      it "should convert all backslashes to forward slashes" do
+        expect(Puppet::Util::Autoload.cleanpath('c:\projects\ruby\bug\test.rb')).to eq('c:/projects/ruby/bug/test.rb')
+      end
     end
   end
 

data/spec/unit/util/backups_spec.rb

@@ -119,8 +119,7 @@ describe Puppet::Util::Backups do
       file = Puppet::Type.type(:file).new(:name => path, :backup => 'foo', :recurse => true)
 
       expect(bucket).not_to receive(:backup)
-      stub_file = double('file', :stat => double('stat', :ftype => 'directory'))
-      allow(Puppet::FileSystem).to receive(:new).with(path).and_return(stub_file)
+      allow(Puppet::FileSystem).to receive(:stat).with(path).and_return(double('stat', :ftype => 'directory'))
       expect(Find).not_to receive(:find)
 
       file.perform_backup

data/spec/unit/util/character_encoding_spec.rb

@@ -21,7 +21,7 @@ describe Puppet::Util::CharacterEncoding do
         let(:invalid_utf8_string) { "\xfd\xf1".force_encoding(Encoding::UTF_8) }
 
         it "should issue a debug message" do
-          expect(Puppet).to receive(:debug).with(/encoding is invalid/)
+          expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/encoding is invalid/) }
           Puppet::Util::CharacterEncoding.convert_to_utf_8(invalid_utf8_string)
         end
 
@@ -80,7 +80,7 @@ describe Puppet::Util::CharacterEncoding do
         end
 
         it "should issue a debug message that the string was not transcodable" do
-          expect(Puppet).to receive(:debug).with(/cannot be transcoded/)
+          expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/cannot be transcoded/) }
           PuppetSpec::CharacterEncoding.with_external_encoding(Encoding::Windows_31J) do
             Puppet::Util::CharacterEncoding.convert_to_utf_8(invalid_win_31j)
           end
@@ -124,7 +124,7 @@ describe Puppet::Util::CharacterEncoding do
           let(:euc_kr) { [253, 241].pack('C*').force_encoding(Encoding::ASCII) }
 
           it "should issue a debug message" do
-            expect(Puppet).to receive(:debug).with(/cannot be transcoded/)
+            expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/cannot be transcoded/) }
             Puppet::Util::CharacterEncoding.convert_to_utf_8(euc_kr)
           end
 
@@ -168,7 +168,7 @@ describe Puppet::Util::CharacterEncoding do
       let(:foo) { 'foo' }
 
       it "should issue a debug message" do
-        expect(Puppet).to receive(:debug).with(/not valid UTF-8/)
+        expect(Puppet).to receive(:debug) { |&b| expect(b.call).to match(/not valid UTF-8/) }
         Puppet::Util::CharacterEncoding.override_encoding_to_utf_8(oslash)
       end
 

data/spec/unit/util/command_line_spec.rb

@@ -62,7 +62,7 @@ describe Puppet::Util::CommandLine do
       it "should print the version and exit if #{arg} is given" do
         expect do
           described_class.new("puppet", [arg]).execute
-        end.to have_printed(/^#{Regexp.escape(Puppet.version)}$/)
+        end.to output(/^#{Regexp.escape(Puppet.version)}$/).to_stdout
       end
     end
 
@@ -73,7 +73,8 @@ describe Puppet::Util::CommandLine do
 
         expect {
           commandline.execute
-        }.to have_printed(/Usage: puppet <subcommand> \[options\] <action> \[options\]/).and_exit_with(0)
+        }.to exit_with(0)
+         .and output(/Usage: puppet <subcommand> \[options\] <action> \[options\]/).to_stdout
       end
     end
 
@@ -95,7 +96,8 @@ describe Puppet::Util::CommandLine do
 
       expect {
         commandline.execute
-      }.to have_printed(/Usage: puppet <subcommand> \[options\] <action> \[options\]/).and_exit_with(0)
+      }.to exit_with(0)
+       .and output(/Usage: puppet <subcommand> \[options\] <action> \[options\]/).to_stdout
     end
   end
 
@@ -124,7 +126,8 @@ describe Puppet::Util::CommandLine do
 
           expect {
             commandline.execute
-          }.to have_printed(/Unknown Puppet subcommand 'whatever'/).and_exit_with(1)
+          }.to exit_with(1)
+           .and output(/Unknown Puppet subcommand 'whatever'/).to_stdout
         end
 
         it "should abort and show the help message" do
@@ -134,7 +137,8 @@ describe Puppet::Util::CommandLine do
 
           expect {
             commandline.execute
-          }.to have_printed(/See 'puppet help' for help on available puppet subcommands/).and_exit_with(1)
+          }.to exit_with(1)
+           .and output(/See 'puppet help' for help on available puppet subcommands/).to_stdout
         end
 
         %w{--version -V}.each do |arg|
@@ -145,7 +149,8 @@ describe Puppet::Util::CommandLine do
 
             expect {
               commandline.execute
-            }.to have_printed(%r[^#{Regexp.escape(Puppet.version)}$]).and_exit_with(1)
+            }.to exit_with(1)
+             .and output(%r[^#{Regexp.escape(Puppet.version)}$]).to_stdout
           end
         end
       end

data/spec/unit/util/execution_spec.rb

@@ -639,6 +639,8 @@ describe Puppet::Util::Execution, if: !Puppet::Util::Platform.jruby? do
 
     describe "#execute (debug logging)" do
       before :each do
+        Puppet[:log_level] = 'debug'
+
         stub_process_wait(0)
 
         if Puppet::Util::Platform.windows?
@@ -649,47 +651,47 @@ describe Puppet::Util::Execution, if: !Puppet::Util::Platform.jruby? do
       end
 
       it "should log if no uid or gid specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello')
       end
 
       it "should log numeric uid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with uid=100: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with uid=100: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:uid => 100})
       end
 
       it "should log numeric gid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with gid=500: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with gid=500: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:gid => 500})
       end
 
       it "should log numeric uid and gid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with uid=100 gid=500: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with uid=100 gid=500: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:uid => 100, :gid => 500})
       end
 
       it "should log string uid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with uid=myuser: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with uid=myuser: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:uid => 'myuser'})
       end
 
       it "should log string gid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with gid=mygroup: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with gid=mygroup: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:gid => 'mygroup'})
       end
 
       it "should log string uid and gid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with uid=myuser gid=mygroup: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with uid=myuser gid=mygroup: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:uid => 'myuser', :gid => 'mygroup'})
       end
 
       it "should log numeric uid and string gid if specified" do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing with uid=100 gid=mygroup: 'echo hello'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing with uid=100 gid=mygroup: 'echo hello'")
         Puppet::Util::Execution.execute('echo hello', {:uid => 100, :gid => 'mygroup'})
       end
 
       it 'should redact commands in debug output when passed sensitive option' do
-        expect(Puppet::Util::Execution).to receive(:debug).with("Executing: '[redacted]'")
+        expect(Puppet).to receive(:send_log).with(:debug, "Executing: '[redacted]'")
         Puppet::Util::Execution.execute('echo hello', {:sensitive => true})
       end
     end
@@ -903,14 +905,16 @@ describe Puppet::Util::Execution, if: !Puppet::Util::Platform.jruby? do
     end
 
     it "should print meaningful debug message for string argument" do
-      expect(Puppet::Util::Execution).to receive(:debug).with("Executing 'echo hello'")
+      Puppet[:log_level] = 'debug'
+      expect(Puppet).to receive(:send_log).with(:debug, "Executing 'echo hello'")
       expect(Puppet::Util::Execution).to receive(:open).with('| echo hello 2>&1').and_return('hello')
       expect(Puppet::Util::Execution).to receive(:exitstatus).and_return(0)
       Puppet::Util::Execution.execpipe('echo hello')
     end
 
     it "should print meaningful debug message for array argument" do
-      expect(Puppet::Util::Execution).to receive(:debug).with("Executing 'echo hello'")
+      Puppet[:log_level] = 'debug'
+      expect(Puppet).to receive(:send_log).with(:debug, "Executing 'echo hello'")
       expect(Puppet::Util::Execution).to receive(:open).with('| echo hello 2>&1').and_return('hello')
       expect(Puppet::Util::Execution).to receive(:exitstatus).and_return(0)
       Puppet::Util::Execution.execpipe(['echo','hello'])

data/spec/unit/util/inifile_spec.rb

@@ -443,13 +443,9 @@ describe Puppet::Util::IniConfig::FileCollection do
     end
 
     it "yields every section from every file" do
-      [sect_a1, sect_a2, sect_b1, sect_b2].each do |sect|
-        expect(sect).to receive(:touch).once
-      end
-
-      subject.each_section do |sect|
-        sect.touch
-      end
+      expect { |b|
+        subject.each_section(&b)
+      }.to yield_successive_args(sect_a1, sect_a2, sect_b1, sect_b2)
     end
   end
 
@@ -460,13 +456,9 @@ describe Puppet::Util::IniConfig::FileCollection do
     end
 
     it "yields the path to every file in the collection" do
-      seen = []
-      subject.each_file do |file|
-        seen << file
-      end
-
-      expect(seen).to include(path_a)
-      expect(seen).to include(path_b)
+      expect { |b|
+        subject.each_file(&b)
+      }.to yield_successive_args(path_a, path_b)
     end
   end
 

data/spec/unit/util/log_spec.rb

@@ -111,16 +111,20 @@ describe Puppet::Util::Log do
     end
 
     it "should fall back to :eventlog" do
-      allow(Puppet.features).to receive(:syslog?).and_return(false)
-      allow(Puppet.features).to receive(:eventlog?).and_return(true)
+      without_partial_double_verification do
+        allow(Puppet.features).to receive(:syslog?).and_return(false)
+        allow(Puppet.features).to receive(:eventlog?).and_return(true)
+      end
       expect(Puppet::Util::Log).to receive(:newdestination).with(:eventlog)
 
       Puppet::Util::Log.setup_default
     end
 
     it "should fall back to :file" do
-      allow(Puppet.features).to receive(:syslog?).and_return(false)
-      allow(Puppet.features).to receive(:eventlog?).and_return(false)
+      without_partial_double_verification do
+        allow(Puppet.features).to receive(:syslog?).and_return(false)
+        allow(Puppet.features).to receive(:eventlog?).and_return(false)
+      end
       expect(Puppet::Util::Log).to receive(:newdestination).with(Puppet[:puppetdlog])
 
       Puppet::Util::Log.setup_default
@@ -224,9 +228,6 @@ describe Puppet::Util::Log do
   describe Puppet::Util::Log::DestEventlog, :if => Puppet.features.eventlog? do
     before :each do
       allow(Puppet::Util::Windows::EventLog).to receive(:open).and_return(double('mylog', :close => nil))
-      allow(Puppet::Util::Windows::EventLog).to receive(:report_event)
-      allow(Puppet::Util::Windows::EventLog).to receive(:close)
-      allow(Puppet.features).to receive(:eventlog?).and_return(true)
     end
 
     it "should restrict its suitability to Windows" do

data/spec/unit/util/logging_spec.rb

@@ -552,7 +552,7 @@ original
 
     describe 'does support debugging' do
       before :each do
-        allow(Facter).to receive(:respond_to?).with(:debugging).and_return(true)
+        allow(Facter).to receive(:respond_to?).with(:debugging, any_args).and_return(true)
       end
 
       it 'enables Facter debugging when debug level' do
@@ -568,7 +568,7 @@ original
 
     describe 'does support trace' do
       before :each do
-        allow(Facter).to receive(:respond_to?).with(:trace).and_return(true)
+        allow(Facter).to receive(:respond_to?).with(:trace, any_args).and_return(true)
       end
 
       it 'enables Facter trace when enabled' do
@@ -584,7 +584,7 @@ original
 
     describe 'does support on_message' do
       before :each do
-        allow(Facter).to receive(:respond_to?).with(:on_message).and_return(true)
+        allow(Facter).to receive(:respond_to?).with(:on_message, any_args).and_return(true)
       end
 
       def setup(level, message)

data/spec/unit/util/posix_spec.rb

@@ -1,5 +1,6 @@
 require 'spec_helper'
 
+require 'puppet/ffi/posix'
 require 'puppet/util/posix'
 
 class PosixTest
@@ -11,35 +12,344 @@ describe Puppet::Util::POSIX do
     @posix = PosixTest.new
   end
 
-  describe '.groups_of' do
+  describe '.groups_of' do 
+    let(:mock_user_data) { double(user, :gid => 1000) }
+
+    let(:ngroups_ptr) { double('FFI::MemoryPointer', :address => 0x0001, :size => 4) }
+    let(:groups_ptr) { double('FFI::MemoryPointer', :address => 0x0002, :size => Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS) }
+
     let(:mock_groups) do
       [
-        ['group1', ['user1', 'user2']],
-        ['group2', ['user2']],
-        ['group1', ['user1', 'user2']],
-        ['group3', ['user1']],
-        ['group4', ['user2']]
-      ].map do |(name, members)|
+        ['root', ['root'], 0],
+        ['nomembers', [], 5 ],
+        ['group1', ['user1', 'user2'], 1001],
+        ['group2', ['user2'], 2002],
+        ['group1', ['user1', 'user2'], 1001],
+        ['group3', ['user1'], 3003],
+        ['group4', ['user2'], 4004],
+        ['user1', [], 1111],
+        ['user2', [], 2222]
+      ].map do |(name, members, gid)|
         group_struct = double("Group #{name}")
         allow(group_struct).to receive(:name).and_return(name)
         allow(group_struct).to receive(:mem).and_return(members)
+        allow(group_struct).to receive(:gid).and_return(gid)
 
         group_struct
       end
     end
 
+    def prepare_user_and_groups_env(user, groups)
+      groups_gids = []
+      groups_and_user = []
+      groups_and_user.replace(groups)
+      groups_and_user.push(user)
+
+      groups_and_user.each do |group|
+        mock_group = mock_groups.find { |m| m.name == group }
+        groups_gids.push(mock_group.gid)
+
+        allow(Puppet::Etc).to receive(:getgrgid).with(mock_group.gid).and_return(mock_group)
+      end
+
+      if groups_and_user.size > Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS
+        allow(ngroups_ptr).to receive(:read_int).and_return(Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS, groups_and_user.size)
+      else
+        allow(ngroups_ptr).to receive(:read_int).and_return(groups_and_user.size)
+      end
+
+      allow(groups_ptr).to receive(:get_array_of_uint).with(0, groups_and_user.size).and_return(groups_gids)
+      allow(Puppet::Etc).to receive(:getpwnam).with(user).and_return(mock_user_data)
+    end
+
     before(:each) do
-      etc_stub = receive(:group)
-      mock_groups.each do |mock_group|
-        etc_stub = etc_stub.and_yield(mock_group)
+      allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+    end
+
+    describe 'when it uses FFI function getgrouplist' do
+      before(:each) do
+        allow(FFI::MemoryPointer).to receive(:new).with(:int).and_yield(ngroups_ptr)
+        allow(FFI::MemoryPointer).to receive(:new).with(:uint, Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS).and_yield(groups_ptr)
+        allow(ngroups_ptr).to receive(:write_int).with(Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS).and_return(ngroups_ptr)
+      end
+
+      describe 'when there are groups' do
+        context 'for user1' do
+          let(:user) { 'user1' }
+          let(:expected_groups) { ['group1', 'group3'] }
+
+          before(:each) do
+            prepare_user_and_groups_env(user, expected_groups)
+            allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(1)
+          end
+
+          it "should return the groups for given user" do
+            expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+          end
+
+          it 'should not print any debug message about falling back to Puppet::Etc.group' do
+            expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+            Puppet::Util::POSIX.groups_of(user)
+          end
+        end
+
+        context 'for user2' do
+          let(:user) { 'user2' }
+          let(:expected_groups) { ['group1', 'group2', 'group4'] }
+
+          before(:each) do
+            prepare_user_and_groups_env(user, expected_groups)
+            allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+            allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(1)
+          end
+
+          it "should return the groups for given user" do
+            expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+          end
+
+          it 'should not print any debug message about falling back to Puppet::Etc.group' do
+            expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+            Puppet::Util::POSIX.groups_of(user)
+          end
+        end
+      end
+
+      describe 'when there are no groups' do
+        let(:user) { 'nomembers' }
+        let(:expected_groups) { [] }
+
+        before(:each) do
+          prepare_user_and_groups_env(user, expected_groups)
+          allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+          allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(1)
+        end
+
+        it "should return no groups for given user" do
+          expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+        end
+
+        it 'should not print any debug message about falling back to Puppet::Etc.group' do
+          expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+      describe 'when primary group explicitly contains user' do
+        let(:user) { 'root' }
+        let(:expected_groups) { ['root'] }
+
+        before(:each) do
+          prepare_user_and_groups_env(user, expected_groups)
+          allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+          allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(1)
+        end
+
+        it "should return the groups, including primary group, for given user" do
+          expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+        end
+
+        it 'should not print any debug message about falling back to Puppet::Etc.group' do
+          expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+      describe 'when primary group does not explicitly contain user' do
+        let(:user) { 'user1' }
+        let(:expected_groups) { ['group1', 'group3'] }
+
+        before(:each) do
+          prepare_user_and_groups_env(user, expected_groups)
+          allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+          allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(1)
+        end
+
+        it "should not return primary group for given user" do
+          expect(Puppet::Util::POSIX.groups_of(user)).not_to include(user)
+        end
+
+        it 'should not print any debug message about falling back to Puppet::Etc.group' do
+          expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+      context 'number of groups' do
+        before(:each) do
+          stub_const("Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS", 2)
+          prepare_user_and_groups_env(user, expected_groups)
+
+          allow(FFI::MemoryPointer).to receive(:new).with(:uint, Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS).and_yield(groups_ptr)
+          allow(ngroups_ptr).to receive(:write_int).with(Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS).and_return(ngroups_ptr)
+        end
+
+        describe 'when there are less than maximum expected number of groups' do
+          let(:user) { 'root' }
+          let(:expected_groups) { ['root'] }
+
+          before(:each) do
+            allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+            allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(1)
+          end
+
+          it "should return the groups for given user, after one 'getgrouplist' call" do
+            expect(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).once
+            expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+          end
+
+          it 'should not print any debug message about falling back to Puppet::Etc.group' do
+            expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+            Puppet::Util::POSIX.groups_of(user)
+          end
+        end
+
+        describe 'when there are more than maximum expected number of groups' do
+          let(:user) { 'user1' }
+          let(:expected_groups) { ['group1', 'group3'] }
+
+          before(:each) do
+            allow(FFI::MemoryPointer).to receive(:new).with(:uint, Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS * 2).and_yield(groups_ptr)
+            allow(ngroups_ptr).to receive(:write_int).with(Puppet::FFI::POSIX::Constants::MAXIMUM_NUMBER_OF_GROUPS * 2).and_return(ngroups_ptr)
+
+            allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(true)
+            allow(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).and_return(-1, 1)
+          end
+
+          it "should return the groups for given user, after two 'getgrouplist' calls" do
+            expect(Puppet::FFI::POSIX::Functions).to receive(:getgrouplist).twice
+            expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+          end
+
+          it 'should not print any debug message about falling back to Puppet::Etc.group' do
+            expect(Puppet).not_to receive(:debug).with(/Falling back to Puppet::Etc.group:/)
+            Puppet::Util::POSIX.groups_of(user)
+          end
+        end
       end
-      allow(Puppet::Etc).to etc_stub
     end
 
-    it 'returns the groups of the given user' do
-      expect(Puppet::Util::POSIX.groups_of('user1')).to eql(
-        ['group1', 'group3']
-      )
+    describe 'when it falls back to Puppet::Etc.group method' do
+      before(:each) do
+        etc_stub = receive(:group)
+        mock_groups.each do |mock_group|
+          etc_stub = etc_stub.and_yield(mock_group)
+        end
+        allow(Puppet::Etc).to etc_stub
+
+        allow(Puppet::Etc).to receive(:getpwnam).with(user).and_raise(ArgumentError, "can't find user for #{user}")
+        allow(Puppet).to receive(:debug)
+
+        allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist, any_args).and_return(false)
+      end
+
+      describe 'when there are groups' do
+        context 'for user1' do
+          let(:user) { 'user1' }
+          let(:expected_groups) { ['group1', 'group3'] }
+
+          it "should return the groups for given user" do
+            expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+          end
+
+          it 'logs a debug message' do
+            expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: The 'getgrouplist' method is not available")
+            Puppet::Util::POSIX.groups_of(user)
+          end
+        end
+
+        context 'for user2' do
+          let(:user) { 'user2' }
+          let(:expected_groups) { ['group1', 'group2', 'group4'] }
+
+          it "should return the groups for given user" do
+            expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+          end
+
+          it 'logs a debug message' do
+            expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: The 'getgrouplist' method is not available")
+            Puppet::Util::POSIX.groups_of(user)
+          end
+        end
+      end
+
+      describe 'when there are no groups' do
+        let(:user) { 'nomembers' }
+        let(:expected_groups) { [] }
+
+        it "should return no groups for given user" do
+          expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+        end
+
+        it 'logs a debug message' do
+          expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: The 'getgrouplist' method is not available")
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+      describe 'when primary group explicitly contains user' do
+        let(:user) { 'root' }
+        let(:expected_groups) { ['root'] }
+
+        it "should return the groups, including primary group, for given user" do
+          expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+        end
+
+        it 'logs a debug message' do
+          expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: The 'getgrouplist' method is not available")
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+      describe 'when primary group does not explicitly contain user' do
+        let(:user) { 'user1' }
+        let(:expected_groups) { ['group1', 'group3'] }
+
+        it "should not return primary group for given user" do
+          expect(Puppet::Util::POSIX.groups_of(user)).not_to include(user)
+        end
+
+        it 'logs a debug message' do
+          expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: The 'getgrouplist' method is not available")
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+      describe "when the 'getgrouplist' method is not available" do
+        let(:user) { 'user1' }
+        let(:expected_groups) { ['group1', 'group3'] }
+
+        before(:each) do
+          allow(Puppet::FFI::POSIX::Functions).to receive(:respond_to?).with(:getgrouplist).and_return(false)
+        end
+
+        it "should return the groups" do
+          expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+        end
+
+        it 'logs a debug message' do
+          expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: The 'getgrouplist' method is not available")
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
+
+
+      describe "when ffi is not available on the machine" do
+        let(:user) { 'user1' }
+        let(:expected_groups) { ['group1', 'group3'] }
+
+        before(:each) do
+          allow(Puppet::Util::POSIX).to receive(:require).with('puppet/ffi/posix').and_raise(LoadError, 'cannot load such file -- ffi')
+        end
+
+        it "should return the groups" do
+          expect(Puppet::Util::POSIX.groups_of(user)).to eql(expected_groups)
+        end
+
+        it 'logs a debug message' do
+          expect(Puppet).to receive(:debug).with("Falling back to Puppet::Etc.group: cannot load such file -- ffi")
+          Puppet::Util::POSIX.groups_of(user)
+        end
+      end
     end
   end
 
@@ -189,6 +499,25 @@ describe Puppet::Util::POSIX do
         expect(@posix.gid("asdf")).to eq(100)
       end
 
+      it "returns the id without full groups query if multiple groups have the same id" do
+        expect(@posix).to receive(:get_posix_field).with(:group, :gid, "asdf").and_return(100)
+        expect(@posix).to receive(:get_posix_field).with(:group, :name, 100).and_return("boo")
+        expect(@posix).to receive(:get_posix_field).with(:group, :gid, "boo").and_return(100)
+
+        expect(@posix).not_to receive(:search_posix_field)
+        expect(@posix.gid("asdf")).to eq(100)
+      end
+
+      it "returns the id with full groups query if name is nil" do
+        expect(@posix).to receive(:get_posix_field).with(:group, :gid, "asdf").and_return(100)
+        expect(@posix).to receive(:get_posix_field).with(:group, :name, 100).and_return(nil)
+        expect(@posix).not_to receive(:get_posix_field).with(:group, :gid, nil)
+
+
+        expect(@posix).to receive(:search_posix_field).with(:group, :gid, "asdf").and_return(100)
+        expect(@posix.gid("asdf")).to eq(100)
+      end
+
       it "should use :search_posix_field if the discovered name does not match the passed-in name" do
         expect(@posix).to receive(:get_posix_field).with(:group, :gid, "asdf").and_return(100)
         expect(@posix).to receive(:get_posix_field).with(:group, :name, 100).and_return("boo")
@@ -265,6 +594,25 @@ describe Puppet::Util::POSIX do
         expect(@posix.uid("asdf")).to eq(100)
       end
 
+      it "returns the id without full users query if multiple users have the same id" do
+        expect(@posix).to receive(:get_posix_field).with(:passwd, :uid, "asdf").and_return(100)
+        expect(@posix).to receive(:get_posix_field).with(:passwd, :name, 100).and_return("boo")
+        expect(@posix).to receive(:get_posix_field).with(:passwd, :uid, "boo").and_return(100)
+
+        expect(@posix).not_to receive(:search_posix_field)
+        expect(@posix.uid("asdf")).to eq(100)
+      end
+
+      it "returns the id with full users query if name is nil" do
+        expect(@posix).to receive(:get_posix_field).with(:passwd, :uid, "asdf").and_return(100)
+        expect(@posix).to receive(:get_posix_field).with(:passwd, :name, 100).and_return(nil)
+        expect(@posix).not_to receive(:get_posix_field).with(:passwd, :uid, nil)
+
+
+        expect(@posix).to receive(:search_posix_field).with(:passwd, :uid, "asdf").and_return(100)
+        expect(@posix.uid("asdf")).to eq(100)
+      end
+
       it "should use :search_posix_field if the discovered name does not match the passed-in name" do
         expect(@posix).to receive(:get_posix_field).with(:passwd, :uid, "asdf").and_return(100)
         expect(@posix).to receive(:get_posix_field).with(:passwd, :name, 100).and_return("boo")