puppet 6.29.0 → 7.0.0

data/spec/unit/provider/service/systemd_spec.rb

@@ -34,7 +34,7 @@ describe 'Puppet::Type::Service::Provider::Systemd',
     end
   end
 
-  [7, 8, 9].each do |ver|
+  [7, 8].each do |ver|
     it "should be the default provider on rhel#{ver}" do
       allow(Facter).to receive(:value).with(:osfamily).and_return(:redhat)
       allow(Facter).to receive(:value).with(:operatingsystem).and_return(:redhat)
@@ -200,17 +200,6 @@ describe 'Puppet::Type::Service::Provider::Systemd',
       })
     end
 
-    it "correctly parses services when list-unit-files has an additional column" do
-      expect(provider_class).to receive(:systemctl).with('list-unit-files', '--type', 'service', '--full', '--all', '--no-pager').and_return(File.read(my_fixture('list_unit_files_services_vendor_preset')))
-      expect(provider_class.instances.map(&:name)).to match_array(%w{
-        arp-ethers.service
-        auditd.service
-        dbus.service
-        umountnfs.service
-        urandom.service
-      })
-    end
-
     it "should print a debug message when a service with the state `bad` is found" do
       expect(provider_class).to receive(:systemctl).with('list-unit-files', '--type', 'service', '--full', '--all', '--no-pager').and_return(File.read(my_fixture('list_unit_files_services')))
       expect(Puppet).to receive(:debug).with("apparmor.service marked as bad by `systemctl`. It is recommended to be further checked.")
@@ -357,9 +346,6 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#mask" do
     it "should run systemctl to disable and mask a service" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).
-                            with(['/bin/systemctl','cat', '--', 'sshd.service'], :failonfail => false).
-                            and_return(Puppet::Util::Execution::ProcessOutput.new("# /lib/systemd/system/sshd.service\n...", 0))
       # :disable is the only call in the provider that uses a symbol instead of
       # a string.
       # This should be made consistent in the future and all tests updated.
@@ -367,15 +353,6 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
       expect(provider).to receive(:systemctl).with(:mask, '--', 'sshd.service')
       provider.mask
     end
-
-    it "masks a service that doesn't exist" do
-      provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'doesnotexist.service'))
-      expect(provider).to receive(:execute).
-                            with(['/bin/systemctl','cat', '--', 'doesnotexist.service'], :failonfail => false).
-                            and_return(Puppet::Util::Execution::ProcessOutput.new("No files found for doesnotexist.service.\n", 1))
-      expect(provider).to receive(:systemctl).with(:mask, '--', 'doesnotexist.service')
-      provider.mask
-    end
   end
 
   # Note: systemd provider does not care about hasstatus or a custom status
@@ -479,39 +456,17 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     context 'when service state is static' do
       let(:service_state) { 'static' }
 
-      context 'when enable is not mask' do
-        it 'is always enabled_insync even if current value is the same as expected' do
-          expect(provider).to be_enabled_insync(:false)
-        end
-
-        it 'is always enabled_insync even if current value is not the same as expected' do
-          expect(provider).to be_enabled_insync(:true)
-        end
-
-        it 'logs a debug messsage' do
-          expect(Puppet).to receive(:debug).with("Unable to enable or disable static service sshd.service")
-          provider.enabled_insync?(:true)
-        end
+      it 'is always enabled_insync even if current value is the same as expected' do
+        expect(provider).to be_enabled_insync(:false)
       end
 
-      context 'when enable is mask' do
-        let(:provider) do
-          provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service',
-                                                             :enable => 'mask'))
-        end
-
-        it 'is enabled_insync if current value is the same as expected' do
-          expect(provider).to be_enabled_insync(:mask)
-        end
-
-        it 'is not enabled_insync if current value is not the same as expected' do
-          expect(provider).not_to be_enabled_insync(:true)
-        end
+      it 'is always enabled_insync even if current value is not the same as expected' do
+        expect(provider).to be_enabled_insync(:true)
+      end
 
-        it 'logs no debug messsage' do
-          expect(Puppet).not_to receive(:debug)
-          provider.enabled_insync?(:true)
-        end
+      it 'logs a debug messsage' do
+        expect(Puppet).to receive(:debug).with("Unable to enable or disable static service sshd.service")
+        provider.enabled_insync?(:true)
       end
     end
 

data/spec/unit/provider/service/windows_spec.rb

@@ -1,5 +1,4 @@
 require 'spec_helper'
-require 'win32/service' if Puppet::Util::Platform.windows?
 
 describe 'Puppet::Type::Service::Provider::Windows',
     :if => Puppet::Util::Platform.windows? && !Puppet::Util::Platform.jruby? do
@@ -271,206 +270,4 @@ describe 'Puppet::Type::Service::Provider::Windows',
       }.to raise_error(Puppet::Error, /Cannot enable #{name}/)
     end
   end
-
-  describe "when managing logon credentials" do
-    before do
-      allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return(computer_name)
-      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(principal)
-      allow(Puppet::Util::Windows::Service).to receive(:set_startup_configuration).and_return(nil)
-    end
-
-    let(:computer_name) { 'myPC' }
-
-    describe "#logonaccount=" do
-      before do
-        allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
-        resource[:logonaccount] = user_input
-        provider.logonaccount_insync?(user_input)
-      end
-
-      let(:user_input) { principal.account }
-      let(:principal) do
-        Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, computer_name, :SidTypeUser)
-      end
-
-      context "when given user is 'myUser'" do
-        it "should fail when the `Log On As A Service` right is missing from given user" do
-          allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("")
-          expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /".\\#{principal.account}" is missing the 'Log On As A Service' right./)
-        end
-
-        it "should fail when the `Log On As A Service` right is set to denied for given user" do
-          allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeDenyServiceLogonRight")
-          expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /".\\#{principal.account}" has the 'Log On As A Service' right set to denied./)
-        end
-
-        it "should not fail when given user has the `Log On As A Service` right" do
-          allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeServiceLogonRight")
-          expect { provider.logonaccount=(user_input) }.not_to raise_error
-        end
-
-        ['myUser', 'myPC\\myUser', ".\\myUser", "MYPC\\mYuseR"].each do |user_input_variant|
-          let(:user_input) { user_input_variant }
-
-          it "should succesfully munge #{user_input_variant} to '.\\myUser'" do
-            allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeServiceLogonRight")
-            expect { provider.logonaccount=(user_input) }.not_to raise_error
-            expect(resource[:logonaccount]).to eq(".\\myUser")
-          end
-        end
-      end
-
-      context "when given user is a system account" do
-        before do
-          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
-        end
-
-        let(:user_input) { principal.account }
-        let(:principal) do
-          Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser)
-        end
-
-        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
-          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
-          expect { provider.logonaccount=(user_input) }.not_to raise_error
-        end
-
-        ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input_variant|
-          let(:user_input) { user_input_variant }
-
-          it "should succesfully munge #{user_input_variant} to 'LocalSystem'" do
-            expect { provider.logonaccount=(user_input) }.not_to raise_error
-            expect(resource[:logonaccount]).to eq('LocalSystem')
-          end
-        end
-      end
-
-      context "when domain is different from computer name" do
-        before do
-          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return("SeServiceLogonRight")
-        end
-
-        context "when given user is from AD" do
-          let(:user_input) { 'myRemoteUser' }
-          let(:principal) do
-            Puppet::Util::Windows::SID::Principal.new("myRemoteUser", nil, nil, "AD", :SidTypeUser)
-          end
-
-          it "should not raise any error" do
-            expect { provider.logonaccount=(user_input) }.not_to raise_error
-          end
-
-          it "should succesfully be munged" do
-            expect { provider.logonaccount=(user_input) }.not_to raise_error
-            expect(resource[:logonaccount]).to eq('AD\myRemoteUser')
-          end
-        end
-
-        context "when given user is LocalService" do
-          let(:user_input) { 'LocalService' }
-          let(:principal) do
-            Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup)
-          end
-
-          it "should succesfully munge well known user" do
-            expect { provider.logonaccount=(user_input) }.not_to raise_error
-            expect(resource[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE')
-          end
-        end
-
-        context "when given user is in SID form" do
-          let(:user_input) { 'S-1-5-20' }
-          let(:principal) do
-            Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser)
-          end
-
-          it "should succesfully munge" do
-            expect { provider.logonaccount=(user_input) }.not_to raise_error
-            expect(resource[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE')
-          end
-        end
-
-        context "when given user is actually a group" do
-          let(:principal) do
-            Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias)
-          end
-          let(:user_input) { 'Administrators' }
-
-          it "should fail when sid type is not user or well known user" do
-            expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /"BUILTIN\\#{user_input}" is not a valid account/)
-          end
-        end
-      end
-    end
-
-    describe "#logonpassword=" do
-      before do
-        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
-        resource[:logonaccount] = account
-        resource[:logonpassword] = user_input
-        provider.logonaccount_insync?(account)
-      end
-
-      let(:account) { 'LocalSystem' }
-
-      describe "when given logonaccount is a predefined_local_account" do
-        let(:user_input) { 'pass' }
-        let(:principal) { nil }
-
-        it "should pass validation when given account is 'LocalSystem'" do
-          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true)
-          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(true)
-
-          expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
-          expect { provider.logonpassword=(user_input) }.not_to raise_error
-        end
-
-        ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account|
-          describe "when given account is #{predefined_local_account}" do
-            let(:account) { 'predefined_local_account' }
-            let(:principal) do
-              Puppet::Util::Windows::SID::Principal.new(account, nil, nil, "NT AUTHORITY", :SidTypeUser)
-            end
-
-            it "should pass validation" do
-              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(principal.account).and_return(false)
-              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(principal.domain_account).and_return(false)
-              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(principal.domain_account).and_return(true).twice
-
-              expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
-              expect { provider.logonpassword=(user_input) }.not_to raise_error
-            end
-          end
-        end
-      end
-
-      describe "when given logonaccount is not a predefined local account" do
-        before do
-          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(".\\#{principal.account}").and_return(false)
-          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with(".\\#{principal.account}").and_return(false)
-        end
-
-        let(:account) { 'myUser' }
-        let(:principal) do
-          Puppet::Util::Windows::SID::Principal.new(account, nil, nil, computer_name, :SidTypeUser)
-        end
-
-        describe "when password is proven correct" do
-          let(:user_input) { 'myPass' }
-          it "should pass validation" do
-            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true)
-            expect { provider.logonpassword=(user_input) }.not_to raise_error
-          end
-        end
-
-        describe "when password is not proven correct" do
-          let(:user_input) { 'myWrongPass' }
-          it "should not pass validation" do
-            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false)
-            expect { provider.logonpassword=(user_input) }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/)
-          end
-        end
-      end
-    end
-  end
 end

data/spec/unit/provider/user/aix_spec.rb

@@ -143,11 +143,6 @@ describe 'Puppet::Type::User::Provider::Aix' do
     it "returns the user's password" do
       expect(call_parse_password).to eql('some_password')
     end
-
-    it "returns the user's password with tabs" do
-      resource[:name] = 'tab_password_user'
-      expect(call_parse_password).to eql('some_password')
-    end
   end
 
   # TODO: If we move from using Mocha to rspec's mocks,
@@ -217,104 +212,4 @@ describe 'Puppet::Type::User::Provider::Aix' do
       provider.create
     end
   end
-
-  describe '#list_all_homes' do
-    it "should return empty array and output debug on failure" do
-      allow(Puppet::Util::Execution).to receive(:execute).and_raise(Puppet::ExecutionFailure, 'Execution failed')
-      expect(Puppet).to receive(:debug).with('Could not list home of all users: Execution failed')
-      expect(provider.list_all_homes).to eql({})
-    end
-  end
-
-  describe '#delete' do
-    before(:each) do
-      allow(File).to receive(:realpath).and_call_original
-      allow(FileUtils).to receive(:remove_entry_secure).and_call_original
-
-      allow(provider.resource).to receive(:should).with(anything).and_return(nil)
-      allow(provider).to receive(:home).and_return(Dir.tmpdir)
-      allow(provider).to receive(:execute).and_return(nil)
-      allow(provider).to receive(:object_info).and_return(nil)
-      allow(FileUtils).to receive(:remove_entry_secure).with(Dir.tmpdir, true).and_return(nil)
-    end
-
-    context 'with managehome true' do
-      before(:each) do
-        allow(provider.resource).to receive(:managehome?).and_return(true)
-        allow(provider).to receive(:list_all_homes).and_return([])
-      end
-
-      it 'should delete the user without error' do
-        expect{ provider.delete }.not_to raise_error
-      end
-
-      it "should not remove home when relative" do
-        allow(provider).to receive(:home).and_return('relative_path')
-
-        expect(Puppet).to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
-        provider.delete
-      end
-
-      it "should not remove home when '/'" do
-        allow(provider).to receive(:home).and_return('/')
-
-        expect(Puppet).to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
-        provider.delete
-      end
-
-      it "should not remove home when symlink" do
-        allow(Puppet::FileSystem).to receive(:symlink?).with(Dir.tmpdir).and_return(true)
-
-        expect(Puppet).to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
-        provider.delete
-      end
-
-      it "should not remove home when other users would be affected" do
-        allow(provider).to receive(:home).and_return('/special')
-        allow(File).to receive(:realpath).with('/special').and_return('/special')
-        allow(Puppet::Util).to receive(:absolute_path?).with('/special').and_return(true)
-        allow(provider).to receive(:list_all_homes).and_return([{:name => 'other_user', :home => '/special/other_user'}])
-
-        expect(Puppet).to receive(:debug).with(/it would remove the home directory '\/special\/other_user' of user 'other_user' also./)
-        provider.delete
-      end
-
-      it 'should remove homedir' do
-        expect(FileUtils).to receive(:remove_entry_secure).with(Dir.tmpdir, true)
-        provider.delete
-      end
-    end
-
-    context 'with managehome false' do
-      before(:each) do
-        allow(provider.resource).to receive(:managehome?).and_return(false)
-      end
-
-      it 'should delete the user without error' do
-        expect{ provider.delete }.not_to raise_error
-      end
-
-      it 'should not remove homedir' do
-        expect(FileUtils).not_to receive(:remove_entry_secure).with(Dir.tmpdir, true)
-      end
-
-      it 'should not print manage home debug messages' do
-        expect(Puppet).not_to receive(:debug).with(/Please make sure the path is not relative, symlink or '\/'./)
-        expect(Puppet).not_to receive(:debug).with(/it would remove the home directory '\/special\/other_user' of user 'other_user' also./)
-
-        provider.delete
-      end
-    end
-  end
-
-  describe '#deletecmd' do
-    it 'uses the -p flag when removing the user' do
-      allow(provider.class).to receive(:command).with(:delete).and_return('delete')
-      allow(provider).to receive(:ia_module_args).and_return(['ia_module_args'])
-
-      expect(provider.deletecmd).to eql(
-        ['delete', '-p', 'ia_module_args', provider.resource.name]
-      )
-    end
-  end
 end

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -925,75 +925,28 @@ end
       }
     end
 
-    before do
-      allow(provider).to receive(:merge_attribute_with_dscl).with('Users', username, 'AuthenticationAuthority', any_args)
+    it 'should call set_salted_sha512 on 10.7 when given a salted-SHA512 password hash' do
+      expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+      expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(sha512_shadowhashdata)
+      expect(provider.class).to receive(:get_os_version).and_return('10.7')
+      expect(provider).to receive(:set_salted_sha512).with(sample_users_plist, sha512_shadowhashdata, sha512_password_hash)
+      provider.write_password_to_users_plist(sha512_password_hash)
     end
 
-    describe 'when on macOS 11 (Big Sur) or greater' do
-      before do
-        allow(provider.class).to receive(:get_os_version).and_return('11.0.0')
-      end
-
-      it 'should add salted_sha512_pbkdf2 AuthenticationAuthority key if missing' do
-        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
-        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
-        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(true)
-
-        expect(Puppet).to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
-        provider.write_password_to_users_plist(pbkdf2_password_hash)
-      end
-
-      it 'should not add salted_sha512_pbkdf2 AuthenticationAuthority key if not missing' do
-        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
-        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
-        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
-
-        expect(Puppet).not_to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
-        provider.write_password_to_users_plist(pbkdf2_password_hash)
-      end
+    it 'should call set_salted_pbkdf2 on 10.8 when given a PBKDF2 password hash' do
+      expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+      expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+      expect(provider.class).to receive(:get_os_version).and_return('10.8')
+      expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+      provider.write_password_to_users_plist(pbkdf2_password_hash)
     end
 
-    describe 'when on macOS version lower than 11' do
-      before do
-        allow(provider.class).to receive(:get_os_version)
-        allow(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
-      end
-
-      it 'should not add salted_sha512_pbkdf2 AuthenticationAuthority' do
-        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
-        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
-        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
-
-        expect(Puppet).not_to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
-        provider.write_password_to_users_plist(pbkdf2_password_hash)
-      end
-
-      it 'should call set_salted_sha512 on 10.7 when given a salted-SHA512 password hash' do
-        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(sha512_shadowhashdata)
-        expect(provider.class).to receive(:get_os_version).and_return('10.7')
-        expect(provider).to receive(:set_salted_sha512).with(sample_users_plist, sha512_shadowhashdata, sha512_password_hash)
-        provider.write_password_to_users_plist(sha512_password_hash)
-      end
-
-      it 'should call set_salted_pbkdf2 on 10.8 when given a PBKDF2 password hash' do
-        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
-        expect(provider.class).to receive(:get_os_version).and_return('10.8')
-        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
-        provider.write_password_to_users_plist(pbkdf2_password_hash)
-      end
-
-      it "should delete the SALTED-SHA512 key in the shadow_hash_data hash if it exists on a 10.8 system and write_password_to_users_plist has been called to set the user's password" do
-        expect(provider).to receive(:get_users_plist).and_return('users_plist')
-        expect(provider).to receive(:get_shadow_hash_data).with('users_plist').and_return(sha512_shadowhashdata)
-        expect(provider.class).to receive(:get_os_version).and_return('10.8')
-        expect(provider).to receive(:set_salted_pbkdf2).with('users_plist', {}, 'entropy', pbkdf2_password_hash)
-        provider.write_password_to_users_plist(pbkdf2_password_hash)
-      end
+    it "should delete the SALTED-SHA512 key in the shadow_hash_data hash if it exists on a 10.8 system and write_password_to_users_plist has been called to set the user's password" do
+      expect(provider).to receive(:get_users_plist).and_return('users_plist')
+      expect(provider).to receive(:get_shadow_hash_data).with('users_plist').and_return(sha512_shadowhashdata)
+      expect(provider.class).to receive(:get_os_version).and_return('10.8')
+      expect(provider).to receive(:set_salted_pbkdf2).with('users_plist', {}, 'entropy', pbkdf2_password_hash)
+      provider.write_password_to_users_plist(pbkdf2_password_hash)
     end
   end
 
@@ -1021,7 +974,16 @@ end
   describe '#set_shadow_hash_data' do
     let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
 
-    it 'should flush the plist data to a temporary file' do
+    it 'should flush the plist data to disk on OS X < 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.12')
+
+      expect(provider).to receive(:write_users_plist_to_disk)
+      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
+    end
+
+    it 'should flush the plist data a temporary file on OS X >= 10.15' do
+      allow(provider.class).to receive(:get_os_version).and_return('10.15')
+
       expect(provider).to receive(:write_and_import_shadow_hash_data)
       provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
     end
@@ -1071,6 +1033,13 @@ end
     end
   end
 
+  describe '#write_users_plist_to_disk' do
+    it 'should save the passed plist to disk and convert it to a binary plist' do
+      expect(Puppet::Util::Plist).to receive(:write_plist_file).with(user_plist_xml, "#{users_plist_dir}/nonexistent_user.plist", :binary)
+      provider.write_users_plist_to_disk(user_plist_xml)
+    end
+  end
+
   describe '#write_and_import_shadow_hash_data' do
     it 'should save the passed plist to a temporary file and import it' do
       tmpfile = double('tempfile', :path => "/tmp/dsimport_#{username}", :flush => nil)
@@ -1142,7 +1111,7 @@ end
       provider.class.instance_variable_set(:@os_version, nil) if provider.class.instance_variable_defined? :@os_version
     end
 
-    it 'should call Puppet.runtime[:facter].value(:macosx_productversion_major) ONLY ONCE no matter how ' +
+    it 'should call Facter.value(:macosx_productversion_major) ONLY ONCE no matter how ' +
        'many times get_os_version() is called' do
       expect(Facter).to receive(:value).with(:macosx_productversion_major).once.and_return('10.8')
       expect(provider.class.get_os_version).to eq('10.8')
@@ -1234,7 +1203,6 @@ end
     before :each do
       allow(provider.class).to receive(:get_all_users).and_return(all_users_hash)
       allow(provider.class).to receive(:get_list_of_groups).and_return(group_plist_hash_guid)
-      allow(provider).to receive(:merge_attribute_with_dscl).with('Users', username, 'AuthenticationAuthority', any_args)
       provider.class.prefetch({})
     end
 

data/spec/unit/provider/user/hpux_spec.rb

@@ -33,7 +33,7 @@ describe Puppet::Type.type(:user).provider(:hpuxuseradd),
     before :each do
       allow(Etc).to receive(:getpwent).and_return(pwent)
       allow(Etc).to receive(:getpwnam).and_return(pwent)
-      allow(provider).to receive(:command).with(:modify).and_return('/usr/sam/lbin/usermod.sam')
+      allow(resource).to receive(:command).with(:modify).and_return('/usr/sam/lbin/usermod.sam')
     end
 
     it "should have feature manages_passwords" do

data/spec/unit/provider/user/pw_spec.rb

@@ -53,14 +53,12 @@ describe Puppet::Type.type(:user).provider(:pw) do
 
     it "should use -G with the correct argument when the groups property is set" do
       resource[:groups] = "group1"
-      allow(Puppet::Util::POSIX).to receive(:groups_of).with('testuser').and_return([])
       expect(provider).to receive(:execute).with(include("-G").and(include("group1")), kind_of(Hash))
       provider.create
     end
 
     it "should use -G with all the given groups when the groups property is set to an array" do
       resource[:groups] = ["group1", "group2"]
-      allow(Puppet::Util::POSIX).to receive(:groups_of).with('testuser').and_return([])
       expect(provider).to receive(:execute).with(include("-G").and(include("group1,group2")), kind_of(Hash))
       provider.create
     end