puppet 7.5.0-x64-mingw32 → 7.9.0-x64-mingw32

data/spec/unit/provider/service/src_spec.rb

@@ -4,10 +4,6 @@ describe 'Puppet::Type::Service::Provider::Src',
          unless: Puppet::Util::Platform.windows? || Puppet::Util::Platform.jruby? do
   let(:provider_class) { Puppet::Type.type(:service).provider(:src) }
 
-  before :all do
-    `exit 0`
-  end
-
   before :each do
     @resource = double('resource')
     allow(@resource).to receive(:[]).and_return(nil)
@@ -110,20 +106,19 @@ _EOF_
 
   context "when checking if it is enabled" do
     it "should execute the lsitab command" do
-      expect(@provider).to receive(:execute).with(['/usr/sbin/lsitab', 'myservice'], {:combine => true, :failonfail => false})
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(@provider).to receive(:execute)
+        .with(['/usr/sbin/lsitab', 'myservice'], {:combine => true, :failonfail => false})
+        .and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))
       @provider.enabled?
     end
 
     it "should return false when lsitab returns non-zero" do
-      allow(@provider).to receive(:execute)
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+      expect(@provider).to receive(:execute).and_return(Puppet::Util::Execution::ProcessOutput.new('', 1))
       expect(@provider.enabled?).to eq(:false)
     end
 
     it "should return true when lsitab returns zero" do
-      allow(@provider).to receive(:execute)
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      allow(@provider).to receive(:execute).and_return(Puppet::Util::Execution::ProcessOutput.new('', 0))
       expect(@provider.enabled?).to eq(:true)
     end
   end

data/spec/unit/provider/service/systemd_spec.rb

@@ -10,19 +10,14 @@ describe 'Puppet::Type::Service::Provider::Systemd',
     allow(provider_class).to receive(:which).with('systemctl').and_return('/bin/systemctl')
   end
 
-  # `execute` and `texecute` start a new process, consequently setting $CHILD_STATUS to a Process::Status instance,
-  # but because they are mocked, an external process is never executed and $CHILD_STATUS remain nil.
-  # In order to execute some parts of the code under test and to mock $CHILD_STATUS, we need this variable to be a
-  # Process::Status instance. We can achieve this by starting a process that does nothing (exit 0). By doing this,
-  # $CHILD_STATUS will be initialised with a instance of Process::Status and we will be able to mock it.
-  before(:all) do
-    `exit 0`
-  end
-
   let :provider do
     provider_class.new(:name => 'sshd.service')
   end
 
+  let :process_output do
+    Puppet::Util::Execution::ProcessOutput.new('', 0)
+  end
+
   osfamilies = [ 'archlinux', 'coreos' ]
 
   osfamilies.each do |osfamily|
@@ -200,6 +195,17 @@ describe 'Puppet::Type::Service::Provider::Systemd',
       })
     end
 
+    it "correctly parses services when list-unit-files has an additional column" do
+      expect(provider_class).to receive(:systemctl).with('list-unit-files', '--type', 'service', '--full', '--all', '--no-pager').and_return(File.read(my_fixture('list_unit_files_services_vendor_preset')))
+      expect(provider_class.instances.map(&:name)).to match_array(%w{
+        arp-ethers.service
+        auditd.service
+        dbus.service
+        umountnfs.service
+        urandom.service
+      })
+    end
+
     it "should print a debug message when a service with the state `bad` is found" do
       expect(provider_class).to receive(:systemctl).with('list-unit-files', '--type', 'service', '--full', '--all', '--no-pager').and_return(File.read(my_fixture('list_unit_files_services')))
       expect(Puppet).to receive(:debug).with("apparmor.service marked as bad by `systemctl`. It is recommended to be further checked.")
@@ -324,6 +330,16 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
                             and_return(Puppet::Util::Execution::ProcessOutput.new("masked\n", 1))
       expect(provider.enabled?).to eq(:mask)
     end
+
+    it "should consider nonexistent services to be disabled" do
+      provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'doesnotexist'))
+      expect(provider).to receive(:execute).with(['/bin/systemctl','is-enabled', '--', 'doesnotexist'], :failonfail => false)
+                            .and_return(Puppet::Util::Execution::ProcessOutput.new("", 1))
+      expect(provider).to receive(:execute).with(["/usr/sbin/invoke-rc.d", "--quiet", "--query", "doesnotexist", "start"], :failonfail => false)
+                            .and_return(Puppet::Util::Execution::ProcessOutput.new("", 1))
+
+      expect(provider.enabled?).to be(:false)
+    end
   end
 
   describe "#enable" do
@@ -346,6 +362,9 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
   describe "#mask" do
     it "should run systemctl to disable and mask a service" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
+      expect(provider).to receive(:execute).
+                            with(['/bin/systemctl','cat', '--', 'sshd.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("# /lib/systemd/system/sshd.service\n...", 0))
       # :disable is the only call in the provider that uses a symbol instead of
       # a string.
       # This should be made consistent in the future and all tests updated.
@@ -353,30 +372,43 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
       expect(provider).to receive(:systemctl).with(:mask, '--', 'sshd.service')
       provider.mask
     end
+
+    it "masks a service that doesn't exist" do
+      provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'doesnotexist.service'))
+      expect(provider).to receive(:execute).
+                            with(['/bin/systemctl','cat', '--', 'doesnotexist.service'], :failonfail => false).
+                            and_return(Puppet::Util::Execution::ProcessOutput.new("No files found for doesnotexist.service.\n", 1))
+      expect(provider).to receive(:systemctl).with(:mask, '--', 'doesnotexist.service')
+      provider.mask
+    end
   end
 
   # Note: systemd provider does not care about hasstatus or a custom status
   # command. I just assume that it does not make sense for systemd.
   describe "#status" do
-    it "should return running if if the command returns 0" do
+    it "should return running if the command returns 0" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-      expect(provider).to receive(:execute).with(['/bin/systemctl','is-active', '--', 'sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true).and_return("active\n")
-      allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:execute)
+        .with(['/bin/systemctl','is-active', '--', 'sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+        .and_return(Puppet::Util::Execution::ProcessOutput.new("active\n", 0))
       expect(provider.status).to eq(:running)
     end
 
     [-10,-1,3,10].each { |ec|
       it "should return stopped if the command returns something non-0" do
         provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-        expect(provider).to receive(:execute).with(['/bin/systemctl','is-active', '--', 'sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true).and_return("inactive\n")
-        allow($CHILD_STATUS).to receive(:exitstatus).and_return(ec)
+        expect(provider).to receive(:execute)
+          .with(['/bin/systemctl','is-active', '--', 'sshd.service'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(Puppet::Util::Execution::ProcessOutput.new("inactive\n", ec))
         expect(provider.status).to eq(:stopped)
       end
     }
 
     it "should use the supplied status command if specified" do
       provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service', :status => '/bin/foo'))
-      expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+      expect(provider).to receive(:execute)
+        .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+        .and_return(process_output)
       provider.status
     end
   end
@@ -419,8 +451,7 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     [104, 106].each do |status|
       it "should return true when invoke-rc.d returns #{status}" do
         provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-        allow(provider).to receive(:system)
-        expect($CHILD_STATUS).to receive(:exitstatus).and_return(status)
+        allow(provider).to receive(:execute).and_return(Puppet::Util::Execution::ProcessOutput.new('', status))
         expect(provider.debian_enabled?).to eq(:true)
       end
     end
@@ -428,17 +459,15 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     [101, 105].each do |status|
       it "should return true when status is #{status} and there are at least 4 start links" do
         provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-        allow(provider).to receive(:system)
+        allow(provider).to receive(:execute).and_return(Puppet::Util::Execution::ProcessOutput.new('', status))
         expect(provider).to receive(:get_start_link_count).and_return(4)
-        expect($CHILD_STATUS).to receive(:exitstatus).twice.and_return(status)
         expect(provider.debian_enabled?).to eq(:true)
       end
 
       it "should return false when status is #{status} and there are less than 4 start links" do
         provider = provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service'))
-        allow(provider).to receive(:system)
+        allow(provider).to receive(:execute).and_return(Puppet::Util::Execution::ProcessOutput.new('', status))
         expect(provider).to receive(:get_start_link_count).and_return(1)
-        expect($CHILD_STATUS).to receive(:exitstatus).twice.and_return(status)
         expect(provider.debian_enabled?).to eq(:false)
       end
     end
@@ -456,17 +485,39 @@ Jun 14 21:43:23 foo.example.com systemd[1]: sshd.service lacks both ExecStart= a
     context 'when service state is static' do
       let(:service_state) { 'static' }
 
-      it 'is always enabled_insync even if current value is the same as expected' do
-        expect(provider).to be_enabled_insync(:false)
-      end
+      context 'when enable is not mask' do
+        it 'is always enabled_insync even if current value is the same as expected' do
+          expect(provider).to be_enabled_insync(:false)
+        end
 
-      it 'is always enabled_insync even if current value is not the same as expected' do
-        expect(provider).to be_enabled_insync(:true)
+        it 'is always enabled_insync even if current value is not the same as expected' do
+          expect(provider).to be_enabled_insync(:true)
+        end
+
+        it 'logs a debug messsage' do
+          expect(Puppet).to receive(:debug).with("Unable to enable or disable static service sshd.service")
+          provider.enabled_insync?(:true)
+        end
       end
 
-      it 'logs a debug messsage' do
-        expect(Puppet).to receive(:debug).with("Unable to enable or disable static service sshd.service")
-        provider.enabled_insync?(:true)
+      context 'when enable is mask' do
+        let(:provider) do
+          provider_class.new(Puppet::Type.type(:service).new(:name => 'sshd.service',
+                                                             :enable => 'mask'))
+        end
+
+        it 'is enabled_insync if current value is the same as expected' do
+          expect(provider).to be_enabled_insync(:mask)
+        end
+
+        it 'is not enabled_insync if current value is not the same as expected' do
+          expect(provider).not_to be_enabled_insync(:true)
+        end
+
+        it 'logs no debug messsage' do
+          expect(Puppet).not_to receive(:debug)
+          provider.enabled_insync?(:true)
+        end
       end
     end
 

data/spec/unit/provider/service/upstart_spec.rb

@@ -5,10 +5,7 @@ describe 'Puppet::Type::Service::Provider::Upstart',
   let(:manual) { "\nmanual" }
   let(:start_on_default_runlevels) {  "\nstart on runlevel [2,3,4,5]" }
   let!(:provider_class) { Puppet::Type.type(:service).provider(:upstart) }
-
-  before :each do
-    `exit 0`
-  end
+  let(:process_output) { Puppet::Util::Execution::ProcessOutput.new('', 0) }
 
   def given_contents_of(file, content)
     File.open(file, 'w') do |f|
@@ -121,8 +118,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
       provider = provider_class.new(resource)
       allow(provider).to receive(:is_upstart?).and_return(true)
 
-      expect(provider).to receive(:status_exec).with(["foo"]).and_return("foo start/running, process 1000")
-      allow_any_instance_of(Process::Status).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:status_exec)
+        .with(["foo"])
+        .and_return(Puppet::Util::Execution::ProcessOutput.new("foo start/running, process 1000", 0))
       expect(provider.status).to eq(:running)
     end
 
@@ -133,8 +131,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
         allow(provider).to receive(:is_upstart?).and_return(true)
 
         expect(provider).not_to receive(:status_exec).with(['foo'])
-        expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
-        allow_any_instance_of(Process::Status).to receive(:exitstatus).and_return(0)
+        expect(provider).to receive(:execute)
+          .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(process_output)
         provider.status
       end
 
@@ -144,8 +143,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
         allow(provider).to receive(:is_upstart?).and_return(true)
 
         expect(provider).not_to receive(:status_exec).with(['foo'])
-        expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
-        allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+        expect(provider).to receive(:execute)
+          .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(Puppet::Util::Execution::ProcessOutput.new('', 1))
         expect(provider.status).to eq(:stopped)
       end
 
@@ -155,8 +155,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
         allow(provider).to receive(:is_upstart?).and_return(true)
 
         expect(provider).not_to receive(:status_exec).with(['foo'])
-        expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
-        allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+        expect(provider).to receive(:execute)
+          .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(process_output)
         expect(provider.status).to eq(:running)
       end
     end
@@ -190,8 +191,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
         allow(provider).to receive(:is_upstart?).and_return(true)
 
         expect(provider).not_to receive(:status_exec).with(['foo'])
-        expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
-        allow_any_instance_of(Process::Status).to receive(:exitstatus).and_return(0)
+        expect(provider).to receive(:execute)
+          .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(process_output)
         provider.status
       end
 
@@ -201,8 +203,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
         allow(provider).to receive(:is_upstart?).and_return(true)
 
         expect(provider).not_to receive(:status_exec).with(['foo'])
-        expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
-        allow($CHILD_STATUS).to receive(:exitstatus).and_return(1)
+        expect(provider).to receive(:execute)
+          .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(Puppet::Util::Execution::ProcessOutput.new('', 1))
         expect(provider.status).to eq(:stopped)
       end
 
@@ -212,8 +215,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
         allow(provider).to receive(:is_upstart?).and_return(true)
 
         expect(provider).not_to receive(:status_exec).with(['foo'])
-        expect(provider).to receive(:execute).with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
-        allow($CHILD_STATUS).to receive(:exitstatus).and_return(0)
+        expect(provider).to receive(:execute)
+          .with(['/bin/foo'], :failonfail => false, :override_locale => false, :squelch => false, :combine => true)
+          .and_return(process_output)
         expect(provider.status).to eq(:running)
       end
     end
@@ -245,8 +249,9 @@ describe 'Puppet::Type::Service::Provider::Upstart',
       provider = provider_class.new(resource)
       allow(provider).to receive(:is_upstart?).and_return(true)
 
-      expect(provider).to receive(:status_exec).with(["foostartbar"]).and_return("foostartbar stop/waiting")
-      allow_any_instance_of(Process::Status).to receive(:exitstatus).and_return(0)
+      expect(provider).to receive(:status_exec)
+        .with(["foostartbar"]).and_return("foostartbar stop/waiting")
+        .and_return(process_output)
       expect(provider.status).to eq(:stopped)
     end
   end

data/spec/unit/provider/service/windows_spec.rb

@@ -270,4 +270,206 @@ describe 'Puppet::Type::Service::Provider::Windows',
       }.to raise_error(Puppet::Error, /Cannot enable #{name}/)
     end
   end
+
+  describe "when managing logon credentials" do
+    before do
+      allow(Puppet::Util::Windows::ADSI).to receive(:computer_name).and_return(computer_name)
+      allow(Puppet::Util::Windows::SID).to receive(:name_to_principal).and_return(principal)
+      allow(Puppet::Util::Windows::Service).to receive(:set_startup_configuration).and_return(nil)
+    end
+
+    let(:computer_name) { 'myPC' }
+
+    describe "#logonaccount=" do
+      before do
+        allow(Puppet::Util::Windows::User).to receive(:password_is?).and_return(true)
+        resource[:logonaccount] = user_input
+        provider.logonaccount_insync?(user_input)
+      end
+
+      let(:user_input) { principal.account }
+      let(:principal) do
+        Puppet::Util::Windows::SID::Principal.new("myUser", nil, nil, computer_name, :SidTypeUser)
+      end
+
+      context "when given user is 'myUser'" do
+        it "should fail when the `Log On As A Service` right is missing from given user" do
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("")
+          expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /".\\#{principal.account}" is missing the 'Log On As A Service' right./)
+        end
+
+        it "should fail when the `Log On As A Service` right is set to denied for given user" do
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeDenyServiceLogonRight")
+          expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /".\\#{principal.account}" has the 'Log On As A Service' right set to denied./)
+        end
+
+        it "should not fail when given user has the `Log On As A Service` right" do
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeServiceLogonRight")
+          expect { provider.logonaccount=(user_input) }.not_to raise_error
+        end
+
+        ['myUser', 'myPC\\myUser', ".\\myUser", "MYPC\\mYuseR"].each do |user_input_variant|
+          let(:user_input) { user_input_variant }
+
+          it "should succesfully munge #{user_input_variant} to '.\\myUser'" do
+            allow(Puppet::Util::Windows::User).to receive(:get_rights).with(principal.domain_account).and_return("SeServiceLogonRight")
+            expect { provider.logonaccount=(user_input) }.not_to raise_error
+            expect(resource[:logonaccount]).to eq(".\\myUser")
+          end
+        end
+      end
+
+      context "when given user is a system account" do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).and_return(true)
+        end
+
+        let(:user_input) { principal.account }
+        let(:principal) do
+          Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser)
+        end
+
+        it "should not fail when given user is a default system account even if the `Log On As A Service` right is missing" do
+          expect(Puppet::Util::Windows::User).not_to receive(:get_rights)
+          expect { provider.logonaccount=(user_input) }.not_to raise_error
+        end
+
+        ['LocalSystem', '.\LocalSystem', 'myPC\LocalSystem', 'lOcALsysTem'].each do |user_input_variant|
+          let(:user_input) { user_input_variant }
+
+          it "should succesfully munge #{user_input_variant} to 'LocalSystem'" do
+            expect { provider.logonaccount=(user_input) }.not_to raise_error
+            expect(resource[:logonaccount]).to eq('LocalSystem')
+          end
+        end
+      end
+
+      context "when domain is different from computer name" do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return("SeServiceLogonRight")
+        end
+
+        context "when given user is from AD" do
+          let(:user_input) { 'myRemoteUser' }
+          let(:principal) do
+            Puppet::Util::Windows::SID::Principal.new("myRemoteUser", nil, nil, "AD", :SidTypeUser)
+          end
+
+          it "should not raise any error" do
+            expect { provider.logonaccount=(user_input) }.not_to raise_error
+          end
+
+          it "should succesfully be munged" do
+            expect { provider.logonaccount=(user_input) }.not_to raise_error
+            expect(resource[:logonaccount]).to eq('AD\myRemoteUser')
+          end
+        end
+
+        context "when given user is LocalService" do
+          let(:user_input) { 'LocalService' }
+          let(:principal) do
+            Puppet::Util::Windows::SID::Principal.new("LOCAL SERVICE", nil, nil, "NT AUTHORITY", :SidTypeWellKnownGroup)
+          end
+
+          it "should succesfully munge well known user" do
+            expect { provider.logonaccount=(user_input) }.not_to raise_error
+            expect(resource[:logonaccount]).to eq('NT AUTHORITY\LOCAL SERVICE')
+          end
+        end
+
+        context "when given user is in SID form" do
+          let(:user_input) { 'S-1-5-20' }
+          let(:principal) do
+            Puppet::Util::Windows::SID::Principal.new("NETWORK SERVICE", nil, nil, "NT AUTHORITY", :SidTypeUser)
+          end
+
+          it "should succesfully munge" do
+            expect { provider.logonaccount=(user_input) }.not_to raise_error
+            expect(resource[:logonaccount]).to eq('NT AUTHORITY\NETWORK SERVICE')
+          end
+        end
+
+        context "when given user is actually a group" do
+          let(:principal) do
+            Puppet::Util::Windows::SID::Principal.new("Administrators", nil, nil, "BUILTIN", :SidTypeAlias)
+          end
+          let(:user_input) { 'Administrators' }
+
+          it "should fail when sid type is not user or well known user" do
+            expect { provider.logonaccount=(user_input) }.to raise_error(Puppet::Error, /"BUILTIN\\#{user_input}" is not a valid account/)
+          end
+        end
+      end
+    end
+
+    describe "#logonpassword=" do
+      before do
+        allow(Puppet::Util::Windows::User).to receive(:get_rights).and_return('SeServiceLogonRight')
+        resource[:logonaccount] = account
+        resource[:logonpassword] = user_input
+        provider.logonaccount_insync?(account)
+      end
+
+      let(:account) { 'LocalSystem' }
+
+      describe "when given logonaccount is a predefined_local_account" do
+        let(:user_input) { 'pass' }
+        let(:principal) { nil }
+
+        it "should pass validation when given account is 'LocalSystem'" do
+          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with('LocalSystem').and_return(true)
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with('LocalSystem').and_return(true)
+
+          expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+          expect { provider.logonpassword=(user_input) }.not_to raise_error
+        end
+
+        ['LOCAL SERVICE', 'NETWORK SERVICE', 'SYSTEM'].each do |predefined_local_account|
+          describe "when given account is #{predefined_local_account}" do
+            let(:account) { 'predefined_local_account' }
+            let(:principal) do
+              Puppet::Util::Windows::SID::Principal.new(account, nil, nil, "NT AUTHORITY", :SidTypeUser)
+            end
+
+            it "should pass validation" do
+              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(principal.account).and_return(false)
+              allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(principal.domain_account).and_return(false)
+              expect(Puppet::Util::Windows::User).to receive(:default_system_account?).with(principal.domain_account).and_return(true).twice
+
+              expect(Puppet::Util::Windows::User).not_to receive(:password_is?)
+              expect { provider.logonpassword=(user_input) }.not_to raise_error
+            end
+          end
+        end
+      end
+
+      describe "when given logonaccount is not a predefined local account" do
+        before do
+          allow(Puppet::Util::Windows::User).to receive(:localsystem?).with(".\\#{principal.account}").and_return(false)
+          allow(Puppet::Util::Windows::User).to receive(:default_system_account?).with(".\\#{principal.account}").and_return(false)
+        end
+
+        let(:account) { 'myUser' }
+        let(:principal) do
+          Puppet::Util::Windows::SID::Principal.new(account, nil, nil, computer_name, :SidTypeUser)
+        end
+
+        describe "when password is proven correct" do
+          let(:user_input) { 'myPass' }
+          it "should pass validation" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myPass', '.').and_return(true)
+            expect { provider.logonpassword=(user_input) }.not_to raise_error
+          end
+        end
+
+        describe "when password is not proven correct" do
+          let(:user_input) { 'myWrongPass' }
+          it "should not pass validation" do
+            allow(Puppet::Util::Windows::User).to receive(:password_is?).with('myUser', 'myWrongPass', '.').and_return(false)
+            expect { provider.logonpassword=(user_input) }.to raise_error(Puppet::Error, /The given password is invalid for user '.\\myUser'/)
+          end
+        end
+      end
+    end
+  end
 end