puppet 7.34.0 → 8.0.1

data/spec/unit/provider/user/useradd_spec.rb

@@ -0,0 +1,849 @@
+require 'spec_helper'
+
+RSpec::Matchers.define_negated_matcher :excluding, :include
+
+describe Puppet::Type.type(:user).provider(:useradd) do
+  before :each do
+    allow(Puppet::Util::POSIX).to receive(:groups_of).and_return([])
+    allow(described_class).to receive(:command).with(:password).and_return('/usr/bin/chage')
+    allow(described_class).to receive(:command).with(:localpassword).and_return('/usr/sbin/lchage')
+    allow(described_class).to receive(:command).with(:add).and_return('/usr/sbin/useradd')
+    allow(described_class).to receive(:command).with(:localadd).and_return('/usr/sbin/luseradd')
+    allow(described_class).to receive(:command).with(:modify).and_return('/usr/sbin/usermod')
+    allow(described_class).to receive(:command).with(:localmodify).and_return('/usr/sbin/lusermod')
+    allow(described_class).to receive(:command).with(:delete).and_return('/usr/sbin/userdel')
+    allow(described_class).to receive(:command).with(:localdelete).and_return('/usr/sbin/luserdel')
+    allow(described_class).to receive(:command).with(:chpasswd).and_return('/usr/sbin/chpasswd')
+  end
+
+  let(:resource) do
+    Puppet::Type.type(:user).new(
+      :name       => 'myuser',
+      :managehome => :false,
+      :system     => :false,
+      :provider   => provider
+    )
+  end
+
+  let(:provider) { described_class.new(:name => 'myuser') }
+
+  let(:shadow_entry) {
+    return unless Puppet.features.libshadow?
+    entry = Etc::PasswdEntry.new
+    entry[:sp_namp]   = 'myuser' # login name
+    entry[:sp_pwdp]   = '$6$FvW8Ib8h$qQMI/CR9m.QzIicZKutLpBgCBBdrch1IX0rTnxuI32K1pD9.RXZrmeKQlaC.RzODNuoUtPPIyQDufunvLOQWF0' # encrypted password
+    entry[:sp_lstchg] = 15573    # date of last password change
+    entry[:sp_min]    = 10       # minimum password age
+    entry[:sp_max]    = 20       # maximum password age
+    entry[:sp_warn]   = 7        # password warning period
+    entry[:sp_inact]  = -1       # password inactivity period
+    entry[:sp_expire] = 15706    # account expiration date
+    entry
+  }
+
+  describe "#create" do
+    before do
+      allow(provider).to receive(:exists?).and_return(false)
+    end
+
+    it "should not redact the command from debug logs if there is no password" do
+      described_class.has_feature :manages_passwords
+      resource[:ensure] = :present
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
+      provider.create
+    end
+
+    it "should redact the command from debug logs if there is a password" do
+      described_class.has_feature :manages_passwords
+      resource2 = Puppet::Type.type(:user).new(
+        :name       => 'myuser',
+        :password   => 'a pass word',
+        :managehome => :false,
+        :system     => :false,
+        :provider   => provider,
+      )
+      resource2[:ensure] = :present
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true)).twice
+      provider.create
+    end
+
+    it "should add -g when no gid is specified and group already exists" do
+      allow(Puppet::Util).to receive(:gid).and_return(true)
+      resource[:ensure] = :present
+      expect(provider).to receive(:execute).with(include('-g'), kind_of(Hash))
+      provider.create
+    end
+
+    context "when setting groups" do
+      it "uses -G to set groups" do
+        allow(Facter).to receive(:value).with('os.family').and_return('Solaris')
+        allow(Facter).to receive(:value).with('os.release.major')
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+
+      it "uses -G to set groups with -M on supported systems" do
+        allow(Facter).to receive(:value).with('os.family').and_return('RedHat')
+        allow(Facter).to receive(:value).with('os.release.major')
+        resource[:ensure] = :present
+        resource[:groups] = ['group1', 'group2']
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', '-G', 'group1,group2', '-M', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+    end
+
+    it "should add -o when allowdupe is enabled and the user is being created" do
+      resource[:allowdupe] = true
+      expect(provider).to receive(:execute).with(include('-o'), kind_of(Hash))
+      provider.create
+    end
+
+    describe "on systems that support has_system", :if => described_class.system_users? do
+      it "should add -r when system is enabled" do
+        resource[:system] = :true
+        expect(provider).to be_system_users
+        expect(provider).to receive(:execute).with(include('-r'), kind_of(Hash))
+        provider.create
+      end
+    end
+
+    describe "on systems that do not support has_system", :unless => described_class.system_users? do
+      it "should not add -r when system is enabled" do
+        resource[:system] = :true
+        expect(provider).not_to be_system_users
+        expect(provider).to receive(:execute).with(['/usr/sbin/useradd', 'myuser'], kind_of(Hash))
+        provider.create
+      end
+    end
+
+    it "should set password age rules" do
+      described_class.has_feature :manages_password_age
+      resource[:password_min_age] = 5
+      resource[:password_max_age] = 10
+      resource[:password_warn_days] = 15
+      expect(provider).to receive(:execute).with(include('/usr/sbin/useradd'), kind_of(Hash))
+      expect(provider).to receive(:execute).with(['/usr/bin/chage', '-m', 5, '-M', 10, '-W', 15, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+      provider.create
+    end
+
+    describe "on systems with the libuser and forcelocal=true" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = true
+      end
+
+      it "should use luseradd instead of useradd" do
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should NOT use -o when allowdupe=true" do
+        resource[:allowdupe] = :true
+        expect(provider).to receive(:execute).with(excluding('-o'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should raise an exception for duplicate UIDs" do
+        resource[:uid] = 505
+        allow(provider).to receive(:finduser).and_return(true)
+        expect { provider.create }.to raise_error(Puppet::Error, "UID 505 already exists, use allowdupe to force user creation")
+      end
+
+      it "should not use -G for luseradd and should call usermod with -G after luseradd when groups property is set" do
+        resource[:groups] = ['group1', 'group2']
+        allow(provider).to receive(:localgroups)
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd').and(excluding('-G')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(include('/usr/sbin/usermod').and(include('-G')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should not use -m when managehome set" do
+        resource[:managehome] = :true
+        expect(provider).to receive(:execute).with(excluding('-m'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it "should not use -e with luseradd, should call usermod with -e after luseradd when expiry is set" do
+        resource[:expiry] = '2038-01-24'
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd').and(excluding('-e')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(include('/usr/sbin/usermod').and(include('-e')), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
+      end
+
+      it 'should set password age rules locally' do
+        described_class.has_feature :manages_password_age
+        resource[:password_min_age] = 5
+        resource[:password_max_age] = 10
+        resource[:password_warn_days] = 15
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luseradd'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-m', 5, '-M', 10, '-W', 15, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.create
+      end
+    end
+
+    describe "on systems that allow to set shell" do
+      it "should trigger shell validation" do
+        resource[:shell] = '/bin/bash'
+        expect(provider).to receive(:check_valid_shell)
+        expect(provider).to receive(:execute).with(include('-s'), kind_of(Hash))
+        provider.create
+      end
+    end
+  end
+
+  describe 'when modifying the password' do
+    before do
+      described_class.has_feature :manages_local_users_and_groups
+      described_class.has_feature :manages_passwords
+      #Setting any resource value here initializes needed variables and methods in the resource and provider
+      #Setting a password value here initializes the existence and management of the password parameter itself
+      #Otherwise, this value would not need to be initialized for the test
+      resource[:password] = ''
+    end
+
+    it "should not call execute with sensitive if non-sensitive data is changed" do
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: false))
+      provider.home = 'foo/bar'
+    end
+
+    it "should call execute with sensitive if sensitive data is changed" do
+      expect(provider).to receive(:execute).with(kind_of(Array), hash_including(sensitive: true)).and_return('')
+      provider.password = 'bird bird bird'
+    end
+  end
+
+  describe '#modify' do
+    describe "on systems with the libuser and forcelocal=false" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = false
+      end
+
+      it "should use usermod" do
+        expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-u', 150, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.uid = 150
+      end
+
+      it "should use -o when allowdupe=true" do
+        resource[:allowdupe] = :true
+        expect(provider).to receive(:execute).with(include('-o'), hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.uid = 505
+      end
+
+      it 'should use chage for password_min_age' do
+        expect(provider).to receive(:execute).with(['/usr/bin/chage', '-m', 100, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.password_min_age = 100
+      end
+
+      it 'should use chage for password_max_age' do
+        expect(provider).to receive(:execute).with(['/usr/bin/chage', '-M', 101, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.password_max_age = 101
+      end
+
+      it 'should use chage for password_warn_days' do
+        expect(provider).to receive(:execute).with(['/usr/bin/chage', '-W', 99, 'myuser'], hash_including(failonfail: true, combine: true, custom_environment: {}))
+        provider.password_warn_days = 99
+      end
+
+      it 'should not call check_allow_dup if not modifying the uid' do
+        expect(provider).not_to receive(:check_allow_dup)
+        expect(provider).to receive(:execute)
+        provider.home = 'foo/bar'
+      end
+    end
+
+    describe "on systems with the libuser and forcelocal=true" do
+      before do
+         described_class.has_feature :libuser
+         resource[:forcelocal] = true
+      end
+
+      it "should use lusermod and not usermod" do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lusermod', '-u', 150, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.uid = 150
+      end
+
+      it "should NOT use -o when allowdupe=true" do
+        resource[:allowdupe] = :true
+        expect(provider).to receive(:execute).with(excluding('-o'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.uid = 505
+      end
+
+      it "should raise an exception for duplicate UIDs" do
+        resource[:uid] = 505
+        allow(provider).to receive(:finduser).and_return(true)
+        expect { provider.uid = 505 }.to raise_error(Puppet::Error, "UID 505 already exists, use allowdupe to force user creation")
+      end
+
+      it 'should use lchage for password_warn_days' do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-W', 99, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.password_warn_days = 99
+      end
+
+      it 'should use lchage for password_min_age' do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-m', 100, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.password_min_age = 100
+      end
+
+      it 'should use lchage for password_max_age' do
+        expect(provider).to receive(:execute).with(['/usr/sbin/lchage', '-M', 101, 'myuser'], hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.password_max_age = 101
+      end
+    end
+  end
+
+  describe "#uid=" do
+    it "should add -o when allowdupe is enabled and the uid is being modified" do
+      resource[:allowdupe] = :true
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-u', 150, '-o', 'myuser'], hash_including(custom_environment: {}))
+      provider.uid = 150
+    end
+  end
+
+  describe "#expiry=" do
+    it "should pass expiry to usermod as MM/DD/YY when on Solaris" do
+      expect(Facter).to receive(:value).with('os.name').and_return('Solaris')
+      resource[:expiry] = '2012-10-31'
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '10/31/2012', 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = '2012-10-31'
+    end
+
+    it "should pass expiry to usermod as YYYY-MM-DD when not on Solaris" do
+      expect(Facter).to receive(:value).with('os.name').and_return('not_solaris')
+      resource[:expiry] = '2012-10-31'
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '2012-10-31', 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = '2012-10-31'
+    end
+
+    it "should use -e with an empty string when the expiry property is removed" do
+      resource[:expiry] = :absent
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', '', 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = :absent
+    end
+
+    it "should use -e with -1 when the expiry property is removed on SLES11" do
+      allow(Facter).to receive(:value).with('os.name').and_return('SLES')
+      allow(Facter).to receive(:value).with('os.release.major').and_return('11')
+      resource[:expiry] = :absent
+      expect(provider).to receive(:execute).with(['/usr/sbin/usermod', '-e', -1, 'myuser'], hash_including(custom_environment: {}))
+      provider.expiry = :absent
+    end
+  end
+
+  describe "#comment" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:x:local comment:x:x" }
+
+    it "should return the local comment string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.comment).to eq('local comment')
+    end
+
+    it "should fall back to nameservice comment string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:comment).and_return('remote comment')
+      expect(provider).not_to receive(:localcomment)
+      expect(provider.comment).to eq('remote comment')
+    end
+  end
+
+  describe "#shell" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:x:x:x:/bin/local_shell" }
+
+    it "should return the local shell string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.shell).to eq('/bin/local_shell')
+    end
+
+    it "should fall back to nameservice shell string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:shell).and_return('/bin/remote_shell')
+      expect(provider).not_to receive(:localshell)
+      expect(provider.shell).to eq('/bin/remote_shell')
+    end
+  end
+
+  describe "#home" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:x:x:/opt/local_home:x" }
+
+    it "should return the local home string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.home).to eq('/opt/local_home')
+    end
+
+    it "should fall back to nameservice home string when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:home).and_return('/opt/remote_home')
+      expect(provider).not_to receive(:localhome)
+      expect(provider.home).to eq('/opt/remote_home')
+    end
+  end
+
+  describe "#gid" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) { "myuser:x:x:999:x:x:x" }
+
+    it "should return the local GID when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+      expect(provider.gid).to eq(999)
+    end
+
+    it "should fall back to nameservice GID when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(provider).to receive(:get).with(:gid).and_return(1234)
+      expect(provider).not_to receive(:localgid)
+      expect(provider.gid).to eq(1234)
+    end
+  end
+
+  describe "#groups" do
+    before { described_class.has_feature :manages_local_users_and_groups }
+
+    let(:content) do
+      StringIO.new(<<~EOF)
+      group1:x:0:myuser
+      group2:x:999:
+      group3:x:998:myuser
+      EOF
+    end
+
+    let(:content_with_empty_line) do
+      StringIO.new(<<~EOF)
+      group1:x:0:myuser
+      group2:x:999:
+      group3:x:998:myuser
+
+      EOF
+    end
+
+    it "should return the local groups string when forcelocal is true" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/group').and_return(true)
+      allow(File).to receive(:open).with(Pathname.new('/etc/group')).and_yield(content)
+      expect(provider.groups).to eq(['group1', 'group3'])
+    end
+
+    it "does not raise when parsing empty lines in /etc/group" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/group').and_return(true)
+      allow(File).to receive(:open).with(Pathname.new('/etc/group')).and_yield(content_with_empty_line)
+      expect { provider.groups }.not_to raise_error
+    end
+
+    it "should fall back to nameservice groups when forcelocal is false" do
+      resource[:forcelocal] = false
+      allow(Puppet::Util::POSIX).to receive(:groups_of).with('myuser').and_return(['remote groups'])
+      expect(provider).not_to receive(:localgroups)
+      expect(provider.groups).to eq('remote groups')
+    end
+  end
+
+  describe "#finduser" do
+    before do
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/passwd').and_return(true)
+      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').and_yield(content)
+    end
+
+    let(:content) { "sample_account:sample_password:sample_uid:sample_gid:sample_gecos:sample_directory:sample_shell" }
+    let(:output) do
+      {
+        account: 'sample_account',
+        password: 'sample_password',
+        uid: 'sample_uid',
+        gid: 'sample_gid',
+        gecos: 'sample_gecos',
+        directory: 'sample_directory',
+        shell: 'sample_shell',
+      }
+    end
+
+    [:account, :password, :uid, :gid, :gecos, :directory, :shell].each do |key|
+      it "finds an user by #{key} when asked" do
+        expect(provider.finduser(key, "sample_#{key}")).to eq(output)
+      end
+    end
+
+    it "returns false when specified key/value pair is not found" do
+      expect(provider.finduser(:account, 'invalid_account')).to eq(false)
+    end
+
+    it "reads the user file only once per resource" do
+      expect(Puppet::FileSystem).to receive(:each_line).with('/etc/passwd').once
+      5.times { provider.finduser(:account, 'sample_account') }
+    end
+  end
+
+  describe "#check_allow_dup" do
+    it "should return an array with a flag if dup is allowed" do
+      resource[:allowdupe] = :true
+      expect(provider.check_allow_dup).to eq(["-o"])
+    end
+
+    it "should return an empty array if no dup is allowed" do
+      resource[:allowdupe] = :false
+      expect(provider.check_allow_dup).to eq([])
+    end
+  end
+
+  describe "#check_system_users" do
+    it "should check system users" do
+      expect(described_class).to receive(:system_users?).and_return(true)
+      expect(resource).to receive(:system?)
+      provider.check_system_users
+    end
+
+    it "should return an array with a flag if it's a system user" do
+      expect(described_class).to receive(:system_users?).and_return(true)
+      resource[:system] = :true
+      expect(provider.check_system_users).to eq(["-r"])
+    end
+
+    it "should return an empty array if it's not a system user" do
+      expect(described_class).to receive(:system_users?).and_return(true)
+      resource[:system] = :false
+      expect(provider.check_system_users).to eq([])
+    end
+
+    it "should return an empty array if system user is not featured" do
+      expect(described_class).to receive(:system_users?).and_return(false)
+      resource[:system] = :true
+      expect(provider.check_system_users).to eq([])
+    end
+  end
+
+  describe "#check_manage_home" do
+    it "should return an array with -m flag if home is managed" do
+      resource[:managehome] = :true
+      expect(provider).to receive(:execute).with(include('-m'), hash_including(custom_environment: {}))
+      provider.create
+    end
+
+    it "should return an array with -r flag if home is managed" do
+      resource[:managehome] = :true
+      resource[:ensure] = :absent
+      allow(provider).to receive(:exists?).and_return(true)
+      expect(provider).to receive(:execute).with(include('-r'), hash_including(custom_environment: {}))
+      provider.delete
+    end
+
+    it "should use -M flag if home is not managed on a supported system" do
+      allow(Facter).to receive(:value).with('os.family').and_return("RedHat")
+      allow(Facter).to receive(:value).with('os.release.major')
+      resource[:managehome] = :false
+      expect(provider).to receive(:execute).with(include('-M'), kind_of(Hash))
+      provider.create
+    end
+
+    it "should not use -M flag if home is not managed on an unsupported system" do
+      allow(Facter).to receive(:value).with('os.family').and_return("Suse")
+      allow(Facter).to receive(:value).with('os.release.major').and_return("11")
+      resource[:managehome] = :false
+      expect(provider).to receive(:execute).with(excluding('-M'), kind_of(Hash))
+      provider.create
+    end
+  end
+
+  describe "#addcmd" do
+    before do
+      resource[:allowdupe] = :true
+      resource[:managehome] = :true
+      resource[:system] = :true
+      resource[:groups] = [ 'somegroup' ]
+    end
+
+    it "should call command with :add" do
+      expect(provider).to receive(:command).with(:add)
+      provider.addcmd
+    end
+
+    it "should add properties" do
+      expect(provider).to receive(:add_properties).and_return(['-foo_add_properties'])
+      expect(provider.addcmd).to include '-foo_add_properties'
+    end
+
+    it "should check and add if dup allowed" do
+      expect(provider).to receive(:check_allow_dup).and_return(['-allow_dup_flag'])
+      expect(provider.addcmd).to include '-allow_dup_flag'
+    end
+
+    it "should check and add if home is managed" do
+      expect(provider).to receive(:check_manage_home).and_return(['-manage_home_flag'])
+      expect(provider.addcmd).to include '-manage_home_flag'
+    end
+
+    it "should add the resource :name" do
+      expect(provider.addcmd).to include 'myuser'
+    end
+
+    describe "on systems featuring system_users", :if => described_class.system_users? do
+      it "should return an array with -r if system? is true" do
+        resource[:system] = :true
+        expect(provider.addcmd).to include("-r")
+      end
+
+      it "should return an array without -r if system? is false" do
+        resource[:system] = :false
+        expect(provider.addcmd).not_to include("-r")
+      end
+    end
+
+    describe "on systems not featuring system_users", :unless => described_class.system_users? do
+      [:false, :true].each do |system|
+        it "should return an array without -r if system? is #{system}" do
+          resource[:system] = system
+          expect(provider.addcmd).not_to include("-r")
+        end
+      end
+    end
+
+    it "should return an array with the full command and expiry as MM/DD/YY when on Solaris" do
+      allow(Facter).to receive(:value).with('os.name').and_return('Solaris')
+      expect(described_class).to receive(:system_users?).and_return(true)
+      resource[:expiry] = "2012-08-18"
+      expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', '08/18/2012', '-G', 'somegroup', '-o', '-m', '-r', 'myuser'])
+    end
+
+    it "should return an array with the full command and expiry as YYYY-MM-DD when not on Solaris" do
+      allow(Facter).to receive(:value).with('os.name').and_return('not_solaris')
+      expect(described_class).to receive(:system_users?).and_return(true)
+      resource[:expiry] = "2012-08-18"
+      expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', '2012-08-18', '-G', 'somegroup', '-o', '-m', '-r', 'myuser'])
+    end
+
+    it "should return an array without -e if expiry is undefined full command" do
+      expect(described_class).to receive(:system_users?).and_return(true)
+      expect(provider.addcmd).to eq(["/usr/sbin/useradd", "-G", "somegroup", "-o", "-m", "-r", "myuser"])
+    end
+
+    it "should pass -e \"\" if the expiry has to be removed" do
+      expect(described_class).to receive(:system_users?).and_return(true)
+      resource[:expiry] = :absent
+
+      expect(provider.addcmd).to eq(['/usr/sbin/useradd', '-e', '', '-G', 'somegroup', '-o', '-m', '-r', 'myuser'])
+    end
+
+    it "should use lgroupadd with forcelocal=true" do
+      resource[:forcelocal] = :true
+      expect(provider.addcmd[0]).to eq('/usr/sbin/luseradd')
+    end
+
+    it "should not pass -o with forcelocal=true and allowdupe=true" do
+      resource[:forcelocal] = :true
+      resource[:allowdupe] = :true
+      expect(provider.addcmd).not_to include("-o")
+    end
+
+    context 'when forcelocal=true' do
+      before do
+        resource[:forcelocal] = :true
+      end
+
+      it 'does not pass lchage options to luseradd for password_max_age' do
+        resource[:password_max_age] = 100
+        expect(provider.addcmd).not_to include('-M')
+      end
+
+      it 'does not pass lchage options to luseradd for password_min_age' do
+        resource[:managehome] = false  # This needs to be set so that we don't pass in -m to create the home
+        resource[:password_min_age] = 100
+        expect(provider.addcmd).not_to include('-m')
+      end
+
+      it 'does not pass lchage options to luseradd for password_warn_days' do
+        resource[:password_warn_days] = 100
+        expect(provider.addcmd).not_to include('-W')
+      end
+    end
+  end
+
+  {
+    :password_min_age   => 10,
+    :password_max_age   => 20,
+    :password_warn_days => 30,
+    :password           => '$6$FvW8Ib8h$qQMI/CR9m.QzIicZKutLpBgCBBdrch1IX0rTnxuI32K1pD9.RXZrmeKQlaC.RzODNuoUtPPIyQDufunvLOQWF0'
+  }.each_pair do |property, expected_value|
+    describe "##{property}" do
+      before :each do
+        resource # just to link the resource to the provider
+      end
+
+      it "should return absent if libshadow feature is not present" do
+        allow(Puppet.features).to receive(:libshadow?).and_return(false)
+        # Shadow::Passwd.expects(:getspnam).never # if we really don't have libshadow we dont have Shadow::Passwd either
+        expect(provider.send(property)).to eq(:absent)
+      end
+
+      it "should return absent if user cannot be found", :if => Puppet.features.libshadow? do
+        expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(nil)
+        expect(provider.send(property)).to eq(:absent)
+      end
+
+      it "should return the correct value if libshadow is present", :if => Puppet.features.libshadow? do
+        expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(shadow_entry)
+        expect(provider.send(property)).to eq(expected_value)
+      end
+
+      # nameservice provider instances are initialized with a @canonical_name
+      # instance variable to track the original name of the instance on disk
+      # before converting it to UTF-8 if appropriate. When re-querying the
+      # system for attributes of this user such as password info, we need to
+      # supply the pre-UTF8-converted value.
+      it "should query using the canonical_name attribute of the user", :if => Puppet.features.libshadow? do
+        canonical_name = [253, 241].pack('C*').force_encoding(Encoding::EUC_KR)
+        provider = described_class.new(:name => '??', :canonical_name => canonical_name)
+
+        expect(Shadow::Passwd).to receive(:getspnam).with(canonical_name).and_return(shadow_entry)
+        provider.password
+      end
+    end
+  end
+
+  describe '#expiry' do
+    before :each do
+      resource # just to link the resource to the provider
+    end
+
+    it "should return absent if libshadow feature is not present" do
+      allow(Puppet.features).to receive(:libshadow?).and_return(false)
+      expect(provider.expiry).to eq(:absent)
+    end
+
+    it "should return absent if user cannot be found", :if => Puppet.features.libshadow? do
+      expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(nil)
+      expect(provider.expiry).to eq(:absent)
+    end
+
+    it "should return absent if expiry is -1", :if => Puppet.features.libshadow? do
+      shadow_entry.sp_expire = -1
+      expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(shadow_entry)
+      expect(provider.expiry).to eq(:absent)
+    end
+
+    it "should convert to YYYY-MM-DD", :if => Puppet.features.libshadow? do
+      expect(Shadow::Passwd).to receive(:getspnam).with('myuser').and_return(shadow_entry)
+      expect(provider.expiry).to eq('2013-01-01')
+    end
+  end
+
+  describe "#passcmd" do
+    before do
+      resource[:allowdupe] = :true
+      resource[:managehome] = :true
+      resource[:system] = :true
+      described_class.has_feature :manages_password_age
+    end
+
+    it "should call command with :pass" do
+      # command(:password) is only called inside passcmd if
+      # password_min_age or password_max_age is set
+      resource[:password_min_age] = 123
+      expect(provider).to receive(:command).with(:password)
+      provider.passcmd
+    end
+
+    it "should return nil if neither min nor max is set" do
+      expect(provider.passcmd).to be_nil
+    end
+
+    it "should return a chage command array with -m <value> and the user name if password_min_age is set" do
+      resource[:password_min_age] = 123
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-m', 123, 'myuser'])
+    end
+
+    it "should return a chage command array with -M <value> if password_max_age is set" do
+      resource[:password_max_age] = 999
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-M', 999, 'myuser'])
+    end
+
+    it "should return a chage command array with -W <value> if password_warn_days is set" do
+      resource[:password_warn_days] = 999
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-W', 999, 'myuser'])
+    end
+
+    it "should return a chage command array with -M <value> -m <value> if both password_min_age and password_max_age are set" do
+      resource[:password_min_age] = 123
+      resource[:password_max_age] = 999
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-m', 123, '-M', 999, 'myuser'])
+    end
+
+    it "should return a chage command array with -M <value> -m <value> -W <value> if password_min_age, password_max_age and password_warn_days are set" do
+      resource[:password_min_age] = 123
+      resource[:password_max_age] = 999
+      resource[:password_warn_days] = 555
+      expect(provider.passcmd).to eq(['/usr/bin/chage', '-m', 123, '-M', 999, '-W', 555, 'myuser'])
+    end
+
+    context 'with forcelocal=true' do
+      before do
+        resource[:forcelocal] = true
+      end
+
+      it 'should return a lchage command array with -M <value> -m <value> -W <value> if password_min_age, password_max_age and password_warn_days are set' do
+        resource[:password_min_age] = 123
+        resource[:password_max_age] = 999
+        resource[:password_warn_days] = 555
+        expect(provider.passcmd).to eq(['/usr/sbin/lchage', '-m', 123, '-M', 999, '-W', 555, 'myuser'])
+      end
+    end
+  end
+
+  describe "#check_valid_shell" do
+    it "should raise an error if shell does not exist" do
+      resource[:shell] = 'foo/bin/bash'
+      expect { provider.check_valid_shell }.to raise_error(Puppet::Error, /Shell foo\/bin\/bash must exist/)
+    end
+
+    it "should raise an error if the shell is not executable" do
+      allow(FileTest).to receive(:executable?).with('LICENSE').and_return(false)
+      resource[:shell] = 'LICENSE'
+      expect { provider.check_valid_shell }.to raise_error(Puppet::Error, /Shell LICENSE must be executable/)
+    end
+  end
+
+  describe "#delete" do
+    before do
+       allow(provider).to receive(:exists?).and_return(true)
+       resource[:ensure] = :absent
+    end
+
+    describe "on systems with the libuser and forcelocal=false" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = false
+      end
+
+      it "should use userdel to delete users" do
+        expect(provider).to receive(:execute).with(include('/usr/sbin/userdel'), hash_including(custom_environment: {}))
+        provider.delete
+      end
+    end
+
+    describe "on systems with the libuser and forcelocal=true" do
+      before do
+         described_class.has_feature :manages_local_users_and_groups
+         resource[:forcelocal] = true
+      end
+
+      it "should use luserdel to delete users" do
+        expect(provider).to receive(:execute).with(include('/usr/sbin/luserdel'), hash_including(custom_environment: hash_including('LIBUSER_CONF')))
+        provider.delete
+      end
+    end
+  end
+end