puppet 7.5.0-universal-darwin → 7.9.0-universal-darwin

data/spec/unit/provider/user/directoryservice_spec.rb

@@ -925,28 +925,75 @@ end
       }
     end
 
-    it 'should call set_salted_sha512 on 10.7 when given a salted-SHA512 password hash' do
-      expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-      expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(sha512_shadowhashdata)
-      expect(provider.class).to receive(:get_os_version).and_return('10.7')
-      expect(provider).to receive(:set_salted_sha512).with(sample_users_plist, sha512_shadowhashdata, sha512_password_hash)
-      provider.write_password_to_users_plist(sha512_password_hash)
+    before do
+      allow(provider).to receive(:merge_attribute_with_dscl).with('Users', username, 'AuthenticationAuthority', any_args)
     end
 
-    it 'should call set_salted_pbkdf2 on 10.8 when given a PBKDF2 password hash' do
-      expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
-      expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
-      expect(provider.class).to receive(:get_os_version).and_return('10.8')
-      expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
-      provider.write_password_to_users_plist(pbkdf2_password_hash)
+    describe 'when on macOS 11 (Big Sur) or greater' do
+      before do
+        allow(provider.class).to receive(:get_os_version).and_return('11.0.0')
+      end
+
+      it 'should add salted_sha512_pbkdf2 AuthenticationAuthority key if missing' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(true)
+
+        expect(Puppet).to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
+
+      it 'should not add salted_sha512_pbkdf2 AuthenticationAuthority key if not missing' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
+
+        expect(Puppet).not_to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
     end
 
-    it "should delete the SALTED-SHA512 key in the shadow_hash_data hash if it exists on a 10.8 system and write_password_to_users_plist has been called to set the user's password" do
-      expect(provider).to receive(:get_users_plist).and_return('users_plist')
-      expect(provider).to receive(:get_shadow_hash_data).with('users_plist').and_return(sha512_shadowhashdata)
-      expect(provider.class).to receive(:get_os_version).and_return('10.8')
-      expect(provider).to receive(:set_salted_pbkdf2).with('users_plist', {}, 'entropy', pbkdf2_password_hash)
-      provider.write_password_to_users_plist(pbkdf2_password_hash)
+    describe 'when on macOS version lower than 11' do
+      before do
+        allow(provider.class).to receive(:get_os_version)
+        allow(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
+      end
+
+      it 'should not add salted_sha512_pbkdf2 AuthenticationAuthority' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        expect(provider).to receive(:needs_sha512_pbkdf2_authentication_authority_to_be_added?).and_return(false)
+
+        expect(Puppet).not_to receive(:debug).with("Adding 'SALTED-SHA512-PBKDF2' AuthenticationAuthority key for ShadowHash to user 'nonexistent_user'")
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
+
+      it 'should call set_salted_sha512 on 10.7 when given a salted-SHA512 password hash' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(sha512_shadowhashdata)
+        expect(provider.class).to receive(:get_os_version).and_return('10.7')
+        expect(provider).to receive(:set_salted_sha512).with(sample_users_plist, sha512_shadowhashdata, sha512_password_hash)
+        provider.write_password_to_users_plist(sha512_password_hash)
+      end
+
+      it 'should call set_salted_pbkdf2 on 10.8 when given a PBKDF2 password hash' do
+        expect(provider).to receive(:get_users_plist).and_return(sample_users_plist)
+        expect(provider).to receive(:get_shadow_hash_data).with(sample_users_plist).and_return(pbkdf2_shadowhashdata)
+        expect(provider.class).to receive(:get_os_version).and_return('10.8')
+        expect(provider).to receive(:set_salted_pbkdf2).with(sample_users_plist, pbkdf2_shadowhashdata, 'entropy', pbkdf2_password_hash)
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
+
+      it "should delete the SALTED-SHA512 key in the shadow_hash_data hash if it exists on a 10.8 system and write_password_to_users_plist has been called to set the user's password" do
+        expect(provider).to receive(:get_users_plist).and_return('users_plist')
+        expect(provider).to receive(:get_shadow_hash_data).with('users_plist').and_return(sha512_shadowhashdata)
+        expect(provider.class).to receive(:get_os_version).and_return('10.8')
+        expect(provider).to receive(:set_salted_pbkdf2).with('users_plist', {}, 'entropy', pbkdf2_password_hash)
+        provider.write_password_to_users_plist(pbkdf2_password_hash)
+      end
     end
   end
 
@@ -974,16 +1021,7 @@ end
   describe '#set_shadow_hash_data' do
     let(:users_plist) { {'ShadowHashData' => ['string_data'] } }
 
-    it 'should flush the plist data to disk on OS X < 10.15' do
-      allow(provider.class).to receive(:get_os_version).and_return('10.12')
-
-      expect(provider).to receive(:write_users_plist_to_disk)
-      provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
-    end
-
-    it 'should flush the plist data a temporary file on OS X >= 10.15' do
-      allow(provider.class).to receive(:get_os_version).and_return('10.15')
-
+    it 'should flush the plist data to a temporary file' do
       expect(provider).to receive(:write_and_import_shadow_hash_data)
       provider.set_shadow_hash_data(users_plist, pbkdf2_embedded_plist)
     end
@@ -1033,13 +1071,6 @@ end
     end
   end
 
-  describe '#write_users_plist_to_disk' do
-    it 'should save the passed plist to disk and convert it to a binary plist' do
-      expect(Puppet::Util::Plist).to receive(:write_plist_file).with(user_plist_xml, "#{users_plist_dir}/nonexistent_user.plist", :binary)
-      provider.write_users_plist_to_disk(user_plist_xml)
-    end
-  end
-
   describe '#write_and_import_shadow_hash_data' do
     it 'should save the passed plist to a temporary file and import it' do
       tmpfile = double('tempfile', :path => "/tmp/dsimport_#{username}", :flush => nil)
@@ -1203,6 +1234,7 @@ end
     before :each do
       allow(provider.class).to receive(:get_all_users).and_return(all_users_hash)
       allow(provider.class).to receive(:get_list_of_groups).and_return(group_plist_hash_guid)
+      allow(provider).to receive(:merge_attribute_with_dscl).with('Users', username, 'AuthenticationAuthority', any_args)
       provider.class.prefetch({})
     end
 

data/spec/unit/provider/user/useradd_spec.rb

@@ -375,21 +375,36 @@ describe Puppet::Type.type(:user).provider(:useradd) do
     before { described_class.has_feature :manages_local_users_and_groups }
 
     let(:content) do
-      <<~EOF
+      StringIO.new(<<~EOF)
       group1:x:0:myuser
       group2:x:999:
       group3:x:998:myuser
       EOF
     end
 
+    let(:content_with_empty_line) do
+      StringIO.new(<<~EOF)
+      group1:x:0:myuser
+      group2:x:999:
+      group3:x:998:myuser
+
+      EOF
+    end
+
     it "should return the local groups string when forcelocal is true" do
       resource[:forcelocal] = true
-      group1, group2, group3 = content.split
       allow(Puppet::FileSystem).to receive(:exist?).with('/etc/group').and_return(true)
-      allow(Puppet::FileSystem).to receive(:each_line).with('/etc/group').and_yield(group1).and_yield(group2).and_yield(group3)
+      allow(File).to receive(:open).with(Pathname.new('/etc/group')).and_yield(content)
       expect(provider.groups).to eq(['group1', 'group3'])
     end
 
+    it "does not raise when parsing empty lines in /etc/group" do
+      resource[:forcelocal] = true
+      allow(Puppet::FileSystem).to receive(:exist?).with('/etc/group').and_return(true)
+      allow(File).to receive(:open).with(Pathname.new('/etc/group')).and_yield(content_with_empty_line)
+      expect { provider.groups }.not_to raise_error
+    end
+
     it "should fall back to nameservice groups when forcelocal is false" do
       resource[:forcelocal] = false
       allow(Puppet::Util::POSIX).to receive(:groups_of).with('myuser').and_return(['remote groups'])

data/spec/unit/resource/catalog_spec.rb

@@ -205,7 +205,7 @@ describe Puppet::Resource::Catalog, "when compiling" do
     end
 
     it "should set itself as the catalog for each converted resource" do
-      @catalog.vertices.each { |v| expect(v.catalog.object_id).to equal(@catalog.object_id) }
+      @catalog.vertices.each { |v| expect(v.catalog.object_id).to eql(@catalog.object_id) }
     end
 
     # This tests #931.

data/spec/unit/resource/type_collection_spec.rb

@@ -43,6 +43,14 @@ describe Puppet::Resource::TypeCollection do
     end.to raise_error(Puppet::ParseError, /cannot redefine/)
   end
 
+  it "should fail if a hostclass duplicates a node" do
+    @code.add(Puppet::Resource::Type.new(:node, "foo"))
+
+    expect do
+      @code.add(Puppet::Resource::Type.new(:hostclass, "foo"))
+    end.to raise_error(Puppet::ParseError, /Node 'foo' is already defined; cannot be redefined as a class/)
+  end
+
   it "should store hostclasses as hostclasses" do
     klass = Puppet::Resource::Type.new(:hostclass, "foo")
 
@@ -60,6 +68,14 @@ describe Puppet::Resource::TypeCollection do
     }.to raise_error(/.*is already defined; cannot redefine/)
   end
 
+  it "should fail if a node duplicates a hostclass" do
+    @code.add(Puppet::Resource::Type.new(:hostclass, "foo"))
+
+    expect do
+      @code.add(Puppet::Resource::Type.new(:node, "foo"))
+    end.to raise_error(Puppet::ParseError, /Class 'foo' is already defined; cannot be redefined as a node/)
+  end
+
   it "should store definitions as definitions" do
     define = Puppet::Resource::Type.new(:definition, "foo")
 

data/spec/unit/resource/type_spec.rb

@@ -462,9 +462,9 @@ describe Puppet::Resource::Type do
     end
 
     it "should be able to find parent nodes" do
-      parent = Puppet::Resource::Type.new(:node, "bar")
+      parent = Puppet::Resource::Type.new(:node, "node_bar")
       @krt.add parent
-      child = Puppet::Resource::Type.new(:node, "foo", :parent => "bar")
+      child = Puppet::Resource::Type.new(:node, "node_foo", :parent => "node_bar")
       @krt.add child
 
       expect(child.parent_type(@scope)).to equal(parent)

data/spec/unit/settings/config_file_spec.rb

@@ -135,16 +135,6 @@ badline
                                          with_setting(:var, "value changed", NO_META)))
   end
 
-  it "does not try to transform an entry named 'mode'" do
-    config = Puppet::Settings::ConfigFile.new(Proc.new { raise "Should not transform" })
-
-    result = config.parse_file(filename, "mode = value")
-
-    expect(result).to eq(Conf.new.
-                            with_section(Section.new(:main).
-                                         with_setting(:mode, "value", NO_META)))
-  end
-
   it "accepts non-UTF8 encoded text" do
     result = the_parse_of("var = value".encode("UTF-16LE"))
 
@@ -152,6 +142,6 @@ badline
                            with_section(Section.new(:main).
                                           with_setting(:var, "value", NO_META)))
 
-    end
+  end
 end
 

data/spec/unit/settings/value_translator_spec.rb

@@ -25,13 +25,12 @@ describe Puppet::Settings::ValueTranslator do
   end
 
   context "numbers" do
-    it "translates integer strings to integers" do
-      expect(translator["1"]).to eq(1)
-      expect(translator["2"]).to eq(2)
+    it "leaves integer strings" do
+      expect(translator["1"]).to eq("1")
     end
 
-    it "translates numbers starting with a 0 as octal" do
-      expect(translator["011"]).to eq(9)
+    it "leaves octal numbers as strings" do
+      expect(translator["011"]).to eq("011")
     end
 
     it "leaves hex numbers as strings" do

data/spec/unit/settings_spec.rb

@@ -29,6 +29,17 @@ describe Puppet::Settings do
     end
   end
 
+  def stub_config_with(content)
+    allow(Puppet.features).to receive(:root?).and_return(false)
+    expect(Puppet::FileSystem).to receive(:exist?).
+      with(user_config_file_default_location).
+      and_return(true).ordered
+    expect(@settings).to receive(:read_file).
+      with(user_config_file_default_location).
+      and_return(content).ordered
+    @settings.send(:parse_config_files)
+  end
+
   describe "when specifying defaults" do
     before do
       @settings = Puppet::Settings.new
@@ -264,23 +275,31 @@ describe Puppet::Settings do
       expect(@settings[:myval]).to eq("")
     end
 
-    it "should flag string settings from the CLI" do
+    it "should retrieve numeric settings from the CLI" do
       @settings.handlearg("--myval", "12")
-      expect(@settings.set_by_cli?(:myval)).to be_truthy
+      expect(@settings.set_by_cli(:myval)).to eq("12")
+      expect(@settings.set_by_cli?(:myval)).to be true
     end
 
-    it "should flag bool settings from the CLI" do
+    it "should retrieve string settings from the CLI" do
+      @settings.handlearg("--myval", "something")
+      expect(@settings.set_by_cli(:myval)).to eq("something")
+      expect(@settings.set_by_cli?(:myval)).to be true
+    end
+
+    it "should retrieve bool settings from the CLI" do
       @settings.handlearg("--bool")
-      expect(@settings.set_by_cli?(:bool)).to be_truthy
+      expect(@settings.set_by_cli(:bool)).to be true
+      expect(@settings.set_by_cli?(:bool)).to be true
     end
 
-    it "should not flag settings memory as from CLI" do
+    it "should not retrieve settings set in memory as from CLI" do
       @settings[:myval] = "12"
-      expect(@settings.set_by_cli?(:myval)).to be_falsey
+      expect(@settings.set_by_cli?(:myval)).to be false
     end
 
     it "should find no configured settings by default" do
-      expect(@settings.set_by_config?(:myval)).to be_falsey
+      expect(@settings.set_by_config?(:myval)).to be false
     end
 
     it "should identify configured settings in memory" do
@@ -304,64 +323,66 @@ describe Puppet::Settings do
       expect(@settings.set_by_config?(:manifest, Puppet[:environment])).to be_truthy
     end
 
-    it "should identify configured settings from the preferred run mode" do
-      user_config_text = "[#{@settings.preferred_run_mode}]\nmyval = foo"
+    context "when handling puppet.conf" do
+      describe "#set_by_config?" do
+        it "should identify configured settings from the preferred run mode" do
+          stub_config_with(<<~CONFIG)
+          [#{@settings.preferred_run_mode}]
+          myval = foo
+          CONFIG
 
-      allow(Puppet.features).to receive(:root?).and_return(false)
-      expect(Puppet::FileSystem).to receive(:exist?).
-        with(user_config_file_default_location).
-        and_return(true).ordered
-      expect(@settings).to receive(:read_file).
-        with(user_config_file_default_location).
-        and_return(user_config_text).ordered
+          expect(@settings.set_by_config?(:myval)).to be_truthy
+        end
 
-      @settings.send(:parse_config_files)
-      expect(@settings.set_by_config?(:myval)).to be_truthy
-    end
+        it "should identify configured settings from the specified run mode" do
+          stub_config_with(<<~CONFIG)
+          [server]
+          myval = foo
+          CONFIG
 
-    it "should identify configured settings from the specified run mode" do
-      user_config_text = "[server]\nmyval = foo"
+          expect(@settings.set_by_config?(:myval, nil, :server)).to be_truthy
+        end
 
-      allow(Puppet.features).to receive(:root?).and_return(false)
-      expect(Puppet::FileSystem).to receive(:exist?).
-        with(user_config_file_default_location).
-        and_return(true).ordered
-      expect(@settings).to receive(:read_file).
-        with(user_config_file_default_location).
-        and_return(user_config_text).ordered
+        it "should not identify configured settings from an unspecified run mode" do
+          stub_config_with(<<~CONFIG)
+          [zaz]
+          myval = foo
+          CONFIG
 
-      @settings.send(:parse_config_files)
-      expect(@settings.set_by_config?(:myval, nil, :server)).to be_truthy
-    end
+          expect(@settings.set_by_config?(:myval)).to be_falsey
+        end
 
-    it "should not identify configured settings from an unspecified run mode" do
-      user_config_text = "[zaz]\nmyval = foo"
+        it "should identify configured settings from the main section" do
+          stub_config_with(<<~CONFIG)
+          [main]
+          myval = foo
+          CONFIG
 
-      allow(Puppet.features).to receive(:root?).and_return(false)
-      expect(Puppet::FileSystem).to receive(:exist?).
-        with(user_config_file_default_location).
-        and_return(true).ordered
-      expect(@settings).to receive(:read_file).
-        with(user_config_file_default_location).
-        and_return(user_config_text).ordered
+          expect(@settings.set_by_config?(:myval)).to be_truthy
+        end
+      end
 
-      @settings.send(:parse_config_files)
-      expect(@settings.set_by_config?(:myval)).to be_falsey
-    end
+      describe "#set_in_section" do
+        it "should retrieve configured settings from the specified section" do
+          stub_config_with(<<~CONFIG)
+          [agent]
+          myval = foo
+          CONFIG
 
-    it "should identify configured settings from the main section" do
-      user_config_text = "[main]\nmyval = foo"
+          expect(@settings.set_in_section(:myval, :agent)).to eq("foo")
+          expect(@settings.set_in_section?(:myval, :agent)).to be true
+        end
 
-      allow(Puppet.features).to receive(:root?).and_return(false)
-      expect(Puppet::FileSystem).to receive(:exist?).
-        with(user_config_file_default_location).
-        and_return(true).ordered
-      expect(@settings).to receive(:read_file).
-        with(user_config_file_default_location).
-        and_return(user_config_text).ordered
+        it "should not retrieve configured settings from a different section" do
+          stub_config_with(<<~CONFIG)
+          [main]
+          myval = foo
+          CONFIG
 
-      @settings.send(:parse_config_files)
-      expect(@settings.set_by_config?(:myval)).to be_truthy
+          expect(@settings.set_in_section(:myval, :agent)).to be nil
+          expect(@settings.set_in_section?(:myval, :agent)).to be false
+        end
+      end
     end
 
     it "should clear the cache when setting getopt-specific values" do
@@ -1024,7 +1045,7 @@ describe Puppet::Settings do
       expect(@settings[:two]).to eq(false)
     end
 
-    it "should convert integers in the configuration file into Ruby Integers" do
+    it "doesn't convert integers in the configuration file" do
       File.write(@file, <<~CONF)
         [main]
         one = 65
@@ -1032,7 +1053,7 @@ describe Puppet::Settings do
 
       @settings.initialize_global_settings
 
-      expect(@settings[:one]).to eq(65)
+      expect(@settings[:one]).to eq('65')
     end
 
     it "should support specifying all metadata (owner, group, mode) in the configuration file" do
@@ -1087,10 +1108,10 @@ describe Puppet::Settings do
     context "when setting serverport and masterport" do
       before(:each) do
         @settings.define_settings :main, PuppetSpec::Settings::TEST_APP_DEFAULT_DEFINITIONS
-        @settings.define_settings :server, :masterport => { :desc => "a", :default => 1000 }
+        @settings.define_settings :server, :masterport => { :desc => "a", :default => 1000, :type => :port }
         @settings.define_settings :server, :serverport => { :type => :alias, :alias_for => :masterport }
-        @settings.define_settings :server, :ca_port => { :desc => "a", :default => "$serverport" }
-        @settings.define_settings :server, :report_port => { :desc => "a", :default => "$serverport" }
+        @settings.define_settings :server, :ca_port => { :desc => "a", :default => "$serverport", :type => :port }
+        @settings.define_settings :server, :report_port => { :desc => "a", :default => "$serverport", :type => :port }
 
         config_file = tmpfile('config')
         @settings[:config] = config_file
@@ -1111,8 +1132,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(444) }
-        it { expect(@settings[:ca_port]).to eq("444") }
-        it { expect(@settings[:report_port]).to eq("444") }
+        it { expect(@settings[:ca_port]).to eq(444) }
+        it { expect(@settings[:report_port]).to eq(444) }
         it { expect(@settings[:masterport]).to eq(445) }
       end
 
@@ -1125,8 +1146,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(444) }
       end
 
@@ -1139,8 +1160,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(444) }
       end
 
@@ -1156,8 +1177,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(444) }
       end
 
@@ -1171,8 +1192,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(444) }
-        it { expect(@settings[:ca_port]).to eq("444") }
-        it { expect(@settings[:report_port]).to eq("444") }
+        it { expect(@settings[:ca_port]).to eq(444) }
+        it { expect(@settings[:report_port]).to eq(444) }
         it { expect(@settings[:masterport]).to eq(445) }
       end
 
@@ -1184,8 +1205,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(445) }
       end
 
@@ -1197,8 +1218,8 @@ describe Puppet::Settings do
         end
 
         it { expect(@settings[:serverport]).to eq(445) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(445) }
       end
 
@@ -1211,8 +1232,8 @@ describe Puppet::Settings do
 
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(1000) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
       end
 
       context 'with serverport in main' do
@@ -1224,8 +1245,8 @@ describe Puppet::Settings do
 
         it { expect(@settings[:serverport]).to eq(445) }
         it { expect(@settings[:masterport]).to eq(1000) }
-        it { expect(@settings[:ca_port]).to eq("445") }
-        it { expect(@settings[:report_port]).to eq("445") }
+        it { expect(@settings[:ca_port]).to eq(445) }
+        it { expect(@settings[:report_port]).to eq(445) }
       end
     end
 
@@ -2137,7 +2158,7 @@ describe Puppet::Settings do
     end
 
     def a_user_type_for(username)
-      user = double('user')
+      user = double('user', 'suitable?': true, to_s: "User[#{username}]")
       expect(Puppet::Type.type(:user)).to receive(:new).with(hash_including(name: username)).and_return(user)
       user
     end
@@ -2170,6 +2191,16 @@ describe Puppet::Settings do
 
       expect(settings).to be_service_user_available
     end
+
+    it "raises if the user is not suitable" do
+      settings[:user] = "foo"
+
+      expect(a_user_type_for("foo")).to receive(:suitable?).and_return(false)
+
+      expect {
+        settings.service_user_available?
+      }.to raise_error(Puppet::Error, /Cannot manage owner permissions, because the provider for 'User\[foo\]' is not functional/)
+    end
   end
 
   describe "when determining if the service group is available" do
@@ -2180,7 +2211,7 @@ describe Puppet::Settings do
     end
 
     def a_group_type_for(groupname)
-      group = double('group')
+      group = double('group', 'suitable?': true, to_s: "Group[#{groupname}]")
       expect(Puppet::Type.type(:group)).to receive(:new).with(hash_including(name: groupname)).and_return(group)
       group
     end
@@ -2213,6 +2244,16 @@ describe Puppet::Settings do
 
       expect(settings).to be_service_group_available
     end
+
+    it "raises if the group is not suitable" do
+      settings[:group] = "foo"
+
+      expect(a_group_type_for("foo")).to receive(:suitable?).and_return(false)
+
+      expect {
+        settings.service_group_available?
+      }.to raise_error(Puppet::Error, /Cannot manage group permissions, because the provider for 'Group\[foo\]' is not functional/)
+    end
   end
 
   describe "when dealing with command-line options" do