diff --git a/lib/puppet/provider/nameservice.rb b/lib/puppet/provider/nameservice.rb
index 7339b646e..9830fab54 100644
--- a/lib/puppet/provider/nameservice.rb
+++ b/lib/puppet/provider/nameservice.rb
@@ -1,273 +1,274 @@
 require 'puppet'
 
 # This is the parent class of all NSS classes.  They're very different in
 # their backend, but they're pretty similar on the front-end.  This class
 # provides a way for them all to be as similar as possible.
 class Puppet::Provider::NameService < Puppet::Provider
   class << self
     def autogen_default(param)
       defined?(@autogen_defaults) ? @autogen_defaults[symbolize(param)] : nil
     end
 
     def autogen_defaults(hash)
       @autogen_defaults ||= {}
       hash.each do |param, value|
         @autogen_defaults[symbolize(param)] = value
       end
     end
 
     def initvars
       @checks = {}
       super
     end
 
     def instances
       objects = []
       listbyname do |name|
         objects << new(:name => name, :ensure => :present)
       end
 
       objects
     end
 
     def option(name, option)
       name = name.intern if name.is_a? String
       (defined?(@options) and @options.include? name and @options[name].include? option) ? @options[name][option] : nil
     end
 
     def options(name, hash)
       raise Puppet::DevError, "#{name} is not a valid attribute for #{resource_type.name}" unless resource_type.valid_parameter?(name)
       @options ||= {}
       @options[name] ||= {}
 
       # Set options individually, so we can call the options method
       # multiple times.
       hash.each do |param, value|
         @options[name][param] = value
       end
     end
 
     # List everything out by name.  Abstracted a bit so that it works
     # for both users and groups.
     def listbyname
       names = []
       Etc.send("set#{section()}ent")
       begin
         while ent = Etc.send("get#{section()}ent")
           names << ent.name
           yield ent.name if block_given?
         end
       ensure
         Etc.send("end#{section()}ent")
       end
 
       names
     end
 
     def resource_type=(resource_type)
       super
       @resource_type.validproperties.each do |prop|
         next if prop == :ensure
         define_method(prop) { get(prop) || :absent} unless public_method_defined?(prop)
         define_method(prop.to_s + "=") { |*vals| set(prop, *vals) } unless public_method_defined?(prop.to_s + "=")
       end
     end
 
     # This is annoying, but there really aren't that many options,
     # and this *is* built into Ruby.
     def section
       unless defined?(@resource_type)
         raise Puppet::DevError,
           "Cannot determine Etc section without a resource type"
 
       end
 
       if @resource_type.name == :group
         "gr"
       else
         "pw"
       end
     end
 
     def validate(name, value)
       name = name.intern if name.is_a? String
       if @checks.include? name
         block = @checks[name][:block]
         raise ArgumentError, "Invalid value #{value}: #{@checks[name][:error]}" unless block.call(value)
       end
     end
 
     def verify(name, error, &block)
       name = name.intern if name.is_a? String
       @checks[name] = {:error => error, :block => block}
     end
 
     private
 
     def op(property)
       @ops[property.name] || ("-#{property.name}")
     end
   end
 
   # Autogenerate a value.  Mostly used for uid/gid, but also used heavily
   # with DirectoryServices, because DirectoryServices is stupid.
   def autogen(field)
     field = symbolize(field)
     id_generators = {:user => :uid, :group => :gid}
     if id_generators[@resource.class.name] == field
       return autogen_id(field)
     else
       if value = self.class.autogen_default(field)
         return value
       elsif respond_to?("autogen_#{field}")
         return send("autogen_#{field}")
       else
         return nil
       end
     end
   end
 
   # Autogenerate either a uid or a gid.  This is hard-coded: we can only
   # generate one field type per class.
   def autogen_id(field)
     highest = 0
 
     group = method = nil
     case @resource.class.name
     when :user; group = :passwd; method = :uid
     when :group; group = :group; method = :gid
     else
       raise Puppet::DevError, "Invalid resource name #{resource}"
     end
 
     # Make sure we don't use the same value multiple times
     if defined?(@@prevauto)
       @@prevauto += 1
     else
       Etc.send(group) { |obj|
         if obj.gid > highest
           highest = obj.send(method) unless obj.send(method) > 65000
         end
       }
 
       @@prevauto = highest + 1
     end
 
     @@prevauto
   end
 
   def create
     if exists?
       info "already exists"
       # The object already exists
       return nil
     end
 
     begin
       execute(self.addcmd)
+      execute(self.passcmd) if self.feature? :manages_password_age
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not create #{@resource.class.name} #{@resource.name}: #{detail}"
     end
   end
 
   def delete
     unless exists?
       info "already absent"
       # the object already doesn't exist
       return nil
     end
 
     begin
       execute(self.deletecmd)
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not delete #{@resource.class.name} #{@resource.name}: #{detail}"
     end
   end
 
   def ensure
     if exists?
       :present
     else
       :absent
     end
   end
 
   # Does our object exist?
   def exists?
     !!getinfo(true)
   end
 
   # Retrieve a specific value by name.
   def get(param)
     (hash = getinfo(false)) ? hash[param] : nil
   end
 
   # Retrieve what we can about our object
   def getinfo(refresh)
     if @objectinfo.nil? or refresh == true
       @etcmethod ||= ("get" + self.class.section.to_s + "nam").intern
       begin
         @objectinfo = Etc.send(@etcmethod, @resource[:name])
       rescue ArgumentError => detail
         @objectinfo = nil
       end
     end
 
     # Now convert our Etc struct into a hash.
     @objectinfo ? info2hash(@objectinfo) : nil
   end
 
   # The list of all groups the user is a member of.  Different
   # user mgmt systems will need to override this method.
   def groups
     groups = []
 
     # Reset our group list
     Etc.setgrent
 
     user = @resource[:name]
 
     # Now iterate across all of the groups, adding each one our
     # user is a member of
     while group = Etc.getgrent
       members = group.mem
 
       groups << group.name if members.include? user
     end
 
     # We have to close the file, so each listing is a separate
     # reading of the file.
     Etc.endgrent
 
     groups.join(",")
   end
 
   # Convert the Etc struct into a hash.
   def info2hash(info)
     hash = {}
     self.class.resource_type.validproperties.each do |param|
       method = posixmethod(param)
       hash[param] = info.send(posixmethod(param)) if info.respond_to? method
     end
 
     hash
   end
 
   def initialize(resource)
     super
 
     @objectinfo = nil
   end
 
   def set(param, value)
     self.class.validate(param, value)
     cmd = modifycmd(param, value)
     raise Puppet::DevError, "Nameservice command must be an array" unless cmd.is_a?(Array)
     begin
       execute(cmd)
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}"
     end
   end
 end
 
diff --git a/lib/puppet/provider/nameservice/objectadd.rb b/lib/puppet/provider/nameservice/objectadd.rb
index 80c142982..dbb9f306f 100644
--- a/lib/puppet/provider/nameservice/objectadd.rb
+++ b/lib/puppet/provider/nameservice/objectadd.rb
@@ -1,32 +1,33 @@
 require 'puppet/provider/nameservice'
 
 class Puppet::Provider::NameService
 class ObjectAdd < Puppet::Provider::NameService
   def deletecmd
     [command(:delete), @resource[:name]]
   end
 
   # Determine the flag to pass to our command.
   def flag(name)
     name = name.intern if name.is_a? String
     self.class.option(name, :flag) || "-" + name.to_s[0,1]
   end
 
   def modifycmd(param, value)
-    cmd = [command(:modify), flag(param), value]
+    cmd = [command(param.to_s =~ /password_.+_age/ ? :password : :modify)]
+    cmd << flag(param) << value
     if @resource.allowdupe? && ((param == :uid) || (param == :gid and self.class.name == :groupadd))
       cmd << "-o"
     end
     cmd << @resource[:name]
 
     cmd
   end
 
   def posixmethod(name)
     name = name.intern if name.is_a? String
     method = self.class.option(name, :method) || name
 
     method
   end
 end
 end
diff --git a/lib/puppet/provider/user/hpux.rb b/lib/puppet/provider/user/hpux.rb
index 50506c4cd..983970935 100644
--- a/lib/puppet/provider/user/hpux.rb
+++ b/lib/puppet/provider/user/hpux.rb
@@ -1,30 +1,29 @@
 Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   desc "User management for hp-ux! Undocumented switch to special usermod because HP-UX regular usermod is TOO STUPID to change stuff while the user is logged in."
 
   defaultfor :operatingsystem => "hp-ux"
   confine :operatingsystem => "hp-ux"
 
   commands :modify => "/usr/sam/lbin/usermod.sam", :delete => "/usr/sam/lbin/userdel.sam", :add => "/usr/sbin/useradd"
   options :comment, :method => :gecos
   options :groups, :flag => "-G"
   options :home, :flag => "-d", :method => :dir
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
   end
 
   verify :groups, "Groups must be comma-separated" do |value|
     value !~ /\s/
   end
 
   has_features :manages_homedir, :allows_duplicates
 
   def deletecmd
     super.insert(1,"-F")
   end
 
   def modifycmd(param,value)
     super.insert(1,"-F")
   end
-
 end
diff --git a/lib/puppet/provider/user/user_role_add.rb b/lib/puppet/provider/user/user_role_add.rb
index c13125925..7e7ad78e5 100644
--- a/lib/puppet/provider/user/user_role_add.rb
+++ b/lib/puppet/provider/user/user_role_add.rb
@@ -1,178 +1,190 @@
 require 'puppet/util/user_attr'
 
 Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source => :useradd do
 
   desc "User management inherits `useradd` and adds logic to manage roles on Solaris using roleadd."
 
   defaultfor :operatingsystem => :solaris
 
-  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :role_add => "roleadd", :role_delete => "roledel", :role_modify => "rolemod"
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage", :role_add => "roleadd", :role_delete => "roledel", :role_modify => "rolemod"
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos
   options :groups, :flag => "-G"
   options :roles, :flag => "-R"
   options :auths, :flag => "-A"
   options :profiles, :flag => "-P"
+  options :password_min_age, :flag => "-m"
+  options :password_max_age, :flag => "-M"
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
   end
 
   verify :groups, "Groups must be comma-separated" do |value|
     value !~ /\s/
   end
 
-  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age
 
   #must override this to hand the keyvalue pairs
   def add_properties
     cmd = []
     Puppet::Type.type(:user).validproperties.each do |property|
       #skip the password because we can't create it with the solaris useradd
-      next if [:ensure, :password].include?(property)
+      next if [:ensure, :password, :password_min_age, :password_max_age].include?(property)
       # 1680 Now you can set the hashed passwords on solaris:lib/puppet/provider/user/user_role_add.rb
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
       if value = @resource.should(property) and value != ""
         if property == :keys
           cmd += build_keys_cmd(value)
         else
           cmd << flag(property) << value
         end
       end
     end
     cmd
   end
 
   def user_attributes
     @user_attributes ||= UserAttr.get_attributes_by_name(@resource[:name])
   end
 
   def flush
     @user_attributes = nil
   end
 
   def command(cmd)
     cmd = ("role_#{cmd}").intern if is_role? or (!exists? and @resource[:ensure] == :role)
     super(cmd)
   end
 
   def is_role?
     user_attributes and user_attributes[:type] == "role"
   end
 
   def run(cmd, msg)
       execute(cmd)
   rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not #{msg} #{@resource.class.name} #{@resource.name}: #{detail}"
   end
 
   def transition(type)
     cmd = [command(:modify)]
     cmd << "-K" << "type=#{type}"
     cmd += add_properties
     cmd << @resource[:name]
   end
 
   def create
     if is_role?
       run(transition("normal"), "transition role to")
     else
       run(addcmd, "create")
+      run(passcmd, "change password policy for")
     end
     # added to handle case when password is specified
     self.password = @resource[:password] if @resource[:password]
   end
 
   def destroy
     run(deletecmd, "delete "+ (is_role? ? "role" : "user"))
   end
 
   def create_role
     if exists? and !is_role?
       run(transition("role"), "transition user to")
     else
       run(addcmd, "create role")
     end
   end
 
   def roles
     user_attributes[:roles] if user_attributes
   end
 
   def auths
     user_attributes[:auths] if user_attributes
   end
 
   def profiles
     user_attributes[:profiles] if user_attributes
   end
 
   def project
     user_attributes[:project] if user_attributes
   end
 
   def managed_attributes
     [:name, :type, :roles, :auths, :profiles, :project]
   end
 
   def remove_managed_attributes
     managed = managed_attributes
     user_attributes.select { |k,v| !managed.include?(k) }.inject({}) { |hash, array| hash[array[0]] = array[1]; hash }
   end
 
   def keys
     if user_attributes
       #we have to get rid of all the keys we are managing another way
       remove_managed_attributes
     end
   end
 
   def build_keys_cmd(keys_hash)
     cmd = []
     keys_hash.each do |k,v|
       cmd << "-K" << "#{k}=#{v}"
     end
     cmd
   end
 
   def keys=(keys_hash)
     run([command(:modify)] + build_keys_cmd(keys_hash) << @resource[:name], "modify attribute key pairs")
   end
 
-  #Read in /etc/shadow, find the line for this user (skipping comments, because who knows) and return the hashed pw (the second entry)
+  #Read in /etc/shadow, find the line for this user (skipping comments, because who knows) and return it
   #No abstraction, all esoteric knowledge of file formats, yay
+  def shadow_entry
+    return @shadow_entry if defined? @shadow_entry
+    @shadow_entry = File.readlines("/etc/shadow").reject { |r| r =~ /^[^\w]/ }.collect { |l| l.chomp.split(':') }.find { |user, _| user == @resource[:name] }
+  end
+
   def password
-    #got perl?
-    if ary = File.readlines("/etc/shadow").reject { |r| r =~ /^[^\w]/}.collect { |l| l.split(':')[0..1] }.find { |user, passwd| user == @resource[:name] }
-      pass = ary[1]
-    end
-    pass
+    shadow_entry[1] if shadow_entry
+  end
+
+  def min_age
+    shadow_entry ? shadow_entry[3] : :absent
+  end
+
+  def max_age
+    shadow_entry ? shadow_entry[4] : :absent
   end
 
   #Read in /etc/shadow, find the line for our used and rewrite it with the new pw
   #Smooth like 80 grit
   def password=(cryptopw)
     begin
       File.open("/etc/shadow", "r") do |shadow|
         File.open("/etc/shadow_tmp", "w", 0600) do |shadow_tmp|
           while line = shadow.gets
             line_arr = line.split(':')
             if line_arr[0] == @resource[:name]
               line_arr[1] = cryptopw
               line = line_arr.join(':')
             end
             shadow_tmp.print line
           end
         end
       end
       File.rename("/etc/shadow_tmp", "/etc/shadow")
     rescue => detail
       fail "Could not write temporary shadow file: #{detail}"
     ensure
       # Make sure this *always* gets deleted
       File.unlink("/etc/shadow_tmp") if File.exist?("/etc/shadow_tmp")
     end
   end
 end
 
diff --git a/lib/puppet/provider/user/useradd.rb b/lib/puppet/provider/user/useradd.rb
index 7e68e4b32..9a62db464 100644
--- a/lib/puppet/provider/user/useradd.rb
+++ b/lib/puppet/provider/user/useradd.rb
@@ -1,79 +1,110 @@
 require 'puppet/provider/nameservice/objectadd'
 
 Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameService::ObjectAdd do
   desc "User management via `useradd` and its ilk.  Note that you will need to install the `Shadow Password` Ruby library often known as ruby-libshadow to manage user passwords."
 
-  commands :add => "useradd", :delete => "userdel", :modify => "usermod"
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage"
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos
   options :groups, :flag => "-G"
+  options :password_min_age, :flag => "-m"
+  options :password_max_age, :flag => "-M"
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
   end
 
   verify :groups, "Groups must be comma-separated" do |value|
     value !~ /\s/
   end
 
   has_features :manages_homedir, :allows_duplicates, :manages_expiry
 
-  has_feature :manages_passwords if Puppet.features.libshadow?
+  has_features :manages_passwords, :manages_password_age if Puppet.features.libshadow?
 
   def check_allow_dup
     @resource.allowdupe? ? ["-o"] : []
   end
 
   def check_manage_home
     cmd = []
     if @resource.managehome?
       cmd << "-m"
     elsif %w{Fedora RedHat CentOS OEL OVS}.include?(Facter.value("operatingsystem"))
       cmd << "-M"
     end
     cmd
   end
 
   def check_manage_expiry
     cmd = []
     if @resource[:expiry]
       cmd << "-e #{@resource[:expiry]}"
     end
 
     cmd
   end
 
   def add_properties
     cmd = []
     Puppet::Type.type(:user).validproperties.each do |property|
       next if property == :ensure
+      next if property.to_s =~ /password_.+_age/
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
       if value = @resource.should(property) and value != ""
         cmd << flag(property) << value
       end
     end
     cmd
   end
 
   def addcmd
     cmd = [command(:add)]
     cmd += add_properties
     cmd += check_allow_dup
     cmd += check_manage_home
     cmd += check_manage_expiry
     cmd << @resource[:name]
   end
 
+  def passcmd
+    cmd = [command(:password)]
+    [:password_min_age, :password_max_age].each do |property|
+      if value = @resource.should(property)
+        cmd << flag(property) << value
+      end
+    end
+    cmd << @resource[:name]
+  end
+
+  def min_age
+    if Puppet.features.libshadow?
+      if ent = Shadow::Passwd.getspnam(@resource.name)
+        return ent.sp_min
+      end
+    end
+    :absent
+  end
+
+  def max_age
+    if Puppet.features.libshadow?
+      if ent = Shadow::Passwd.getspnam(@resource.name)
+        return ent.sp_max
+      end
+    end
+    :absent
+  end
+
   # Retrieve the password using the Shadow Password library
   def password
     if Puppet.features.libshadow?
       if ent = Shadow::Passwd.getspnam(@resource.name)
         return ent.sp_pwdp
       end
     end
     :absent
   end
 end
 
diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index c524a7da9..c8110bb69 100755
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -1,397 +1,438 @@
 require 'etc'
 require 'facter'
 require 'puppet/property/list'
 require 'puppet/property/ordered_list'
 require 'puppet/property/keyvalue'
 
 module Puppet
   newtype(:user) do
     @doc = "Manage users.  This type is mostly built to manage system
       users, so it is lacking some features useful for managing normal
       users.
 
       This resource type uses the prescribed native tools for creating
       groups and generally uses POSIX APIs for retrieving information
       about them.  It does not directly modify `/etc/passwd` or anything."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
 
     feature :manages_homedir,
       "The provider can create and remove home directories."
 
     feature :manages_passwords,
       "The provider can modify user passwords, by accepting a password
       hash."
 
+    feature :manages_password_age,
+      "The provider can set age requirements and restrictions for
+      passwords."
+
     feature :manages_solaris_rbac,
       "The provider can manage roles and normal users"
 
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
 
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
       end
 
       newvalue(:absent, :event => :user_removed) do
         provider.delete
       end
 
       newvalue(:role, :event => :role_created, :required_features => :manages_solaris_rbac) do
         provider.create_role
       end
 
       desc "The basic state that the object should be in."
 
       # If they're talking about the thing at all, they generally want to
       # say it should exist.
       defaultto do
         if @resource.managed?
           :present
         else
           nil
         end
       end
 
       def retrieve
         if provider.exists?
           if provider.respond_to?(:is_role?) and provider.is_role?
             return :role
           else
             return :present
           end
         else
           return :absent
         end
       end
     end
 
     newproperty(:uid) do
       desc "The user ID.  Must be specified numerically.  For new users
         being created, if no user ID is specified then one will be
         chosen automatically, which will likely result in the same user
         having different IDs on different systems, which is not
         recommended.  This is especially noteworthy if you use Puppet
         to manage the same user on both Darwin and other platforms,
         since Puppet does the ID generation for you on Darwin, but the
         tools do so on other platforms."
 
       munge do |value|
         case value
         when String
           if value =~ /^[-0-9]+$/
             value = Integer(value)
           end
         end
 
         return value
       end
     end
 
     newproperty(:gid) do
       desc "The user's primary group.  Can be specified numerically or
         by name."
 
       munge do |value|
         if value.is_a?(String) and value =~ /^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
 
       def insync?(is)
         return true unless self.should
 
         # We know the 'is' is a number, so we need to convert the 'should' to a number,
         # too.
         @should.each do |value|
           return true if number = Puppet::Util.gid(value) and is == number
         end
 
         false
       end
 
       def sync
         found = false
         @should.each do |value|
           if number = Puppet::Util.gid(value)
             provider.gid = number
             found = true
             break
           end
         end
 
         fail "Could not find group(s) #{@should.join(",")}" unless found
 
         # Use the default event.
       end
     end
 
     newproperty(:comment) do
       desc "A description of the user.  Generally is a user's full name."
     end
 
     newproperty(:home) do
       desc "The home directory of the user.  The directory must be created
         separately and is not currently checked for existence."
     end
 
     newproperty(:shell) do
       desc "The user's login shell.  The shell must exist and be
         executable."
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
       desc "The user's password, in whatever encrypted format the local machine requires. Be sure to enclose any value that includes a dollar sign ($) in single quotes (\')."
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
       end
 
       def change_to_s(currentvalue, newvalue)
         if currentvalue == :absent
           return "created password"
         else
           return "changed password"
         end
       end
     end
 
+    newproperty(:password_min_age, :required_features => :manages_password_age) do
+      desc "The minimum amount of time in days a password must be used before it may be changed"
+
+      munge do |value|
+        case value
+        when String
+          Integer(value)
+        else
+          value
+        end
+      end
+
+      validate do |value|
+        if value.to_s !~ /^\d+$/
+          raise ArgumentError, "Password minimum age must be provided as a number"
+        end
+      end
+    end
+
+    newproperty(:password_max_age, :required_features => :manages_password_age) do
+      desc "The maximum amount of time in days a password may be used before it must be changed"
+
+      munge do |value|
+        case value
+        when String
+          Integer(value)
+        else
+          value
+        end
+      end
+
+      validate do |value|
+        if value.to_s !~ /^\d+$/
+          raise ArgumentError, "Password maximum age must be provided as a number"
+        end
+      end
+    end
 
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups of which the user is a member.  The primary
         group should not be listed.  Multiple groups should be
         specified as an array."
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Group names must be provided, not numbers"
         end
         raise ArgumentError, "Group names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:name) do
       desc "User name.  While limitations are determined for
         each operating system, it is generally a good idea to keep to
         the degenerate 8 characters, beginning with a letter."
       isnamevar
     end
 
     newparam(:membership) do
       desc "Whether specified groups should be treated as the only groups
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newparam(:allowdupe, :boolean => true) do
       desc "Whether to allow duplicate UIDs."
 
       newvalues(:true, :false)
 
       defaultto false
     end
 
     newparam(:managehome, :boolean => true) do
       desc "Whether to manage the home directory when managing the user."
 
       newvalues(:true, :false)
 
       defaultto false
 
       validate do |val|
         if val.to_s == "true"
           raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" unless provider.class.manages_homedir?
         end
       end
     end
 
     newproperty(:expiry, :required_features => :manages_expiry) do
       desc "The expiry date for this user. Must be provided in
            a zero padded YYYY-MM-DD format - e.g 2010-02-19."
 
       validate do |value|
         if value !~ /^\d{4}-\d{2}-\d{2}$/
           raise ArgumentError, "Expiry dates must be YYYY-MM-DD"
         end
       end
     end
 
     # Autorequire the group, if it's around
     autorequire(:group) do
       autos = []
 
       if obj = @parameters[:gid] and groups = obj.shouldorig
         groups = groups.collect { |group|
           if group =~ /^\d+$/
             Integer(group)
           else
             group
           end
         }
         groups.each { |group|
           case group
           when Integer
             if resource = catalog.resources.find { |r| r.is_a?(Puppet::Type.type(:group)) and r.should(:gid) == group }
               autos << resource
             end
           else
             autos << group
           end
         }
       end
 
       if obj = @parameters[:groups] and groups = obj.should
         autos += groups.split(",")
       end
 
       autos
     end
 
     # Provide an external hook.  Yay breaking out of APIs.
     def exists?
       provider.exists?
     end
 
     def retrieve
       absent = false
       properties.inject({}) { |prophash, property|
         current_value = :absent
 
         if absent
           prophash[property] = :absent
         else
           current_value = property.retrieve
           prophash[property] = current_value
         end
 
         if property.name == :ensure and current_value == :absent
           absent = true
         end
         prophash
       }
     end
 
     newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
 
       def membership
         :role_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Role names must be provided, not numbers"
         end
         raise ArgumentError, "Role names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     #autorequire the roles that the user has
     autorequire(:user) do
       reqs = []
 
       if roles_property = @parameters[:roles] and roles = roles_property.should
         reqs += roles.split(',')
       end
 
       reqs
     end
 
     newparam(:role_membership) do
       desc "Whether specified roles should be treated as the only roles
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:auths, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The auths the user has.  Multiple auths should be
         specified as an array."
 
       def membership
         :auth_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Auth names must be provided, not numbers"
         end
         raise ArgumentError, "Auth names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:auth_membership) do
       desc "Whether specified auths should be treated as the only auths
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:profiles, :parent => Puppet::Property::OrderedList, :required_features => :manages_solaris_rbac) do
       desc "The profiles the user has.  Multiple profiles should be
         specified as an array."
 
       def membership
         :profile_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Profile names must be provided, not numbers"
         end
         raise ArgumentError, "Profile names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:profile_membership) do
       desc "Whether specified roles should be treated as the only roles
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:keys, :parent => Puppet::Property::KeyValue, :required_features => :manages_solaris_rbac) do
       desc "Specify user attributes in an array of keyvalue pairs"
 
       def membership
         :key_membership
       end
 
       validate do |value|
         raise ArgumentError, "key value pairs must be seperated by an =" unless value.include?("=")
       end
     end
 
     newparam(:key_membership) do
       desc "Whether specified key value pairs should be treated as the only attributes
         of the user or whether they should merely
         be treated as the minimum list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:project, :required_features => :manages_solaris_rbac) do
       desc "The name of the project associated with a user"
     end
   end
 end
diff --git a/spec/unit/provider/user/user_role_add_spec.rb b/spec/unit/provider/user/user_role_add_spec.rb
index 211f4260a..b3244f19d 100644
--- a/spec/unit/provider/user/user_role_add_spec.rb
+++ b/spec/unit/provider/user/user_role_add_spec.rb
@@ -1,249 +1,266 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../../spec_helper'
 
 provider_class = Puppet::Type.type(:user).provider(:user_role_add)
 
 describe provider_class do
   before do
     @resource = stub("resource", :name => "myuser", :managehome? => nil)
     @resource.stubs(:should).returns "fakeval"
     @resource.stubs(:[]).returns "fakeval"
     @resource.stubs(:allowdupe?).returns false
     @provider = provider_class.new(@resource)
   end
 
   describe "when calling command" do
     before do
       klass = stub("provider")
       klass.stubs(:command).with(:foo).returns("userfoo")
       klass.stubs(:command).with(:role_foo).returns("rolefoo")
       @provider.stubs(:class).returns(klass)
     end
 
     it "should use the command if not a role and ensure!=role" do
       @provider.stubs(:is_role?).returns(false)
       @provider.stubs(:exists?).returns(false)
       @resource.stubs(:[]).with(:ensure).returns(:present)
       @provider.command(:foo).should == "userfoo"
     end
 
     it "should use the role command when a role" do
       @provider.stubs(:is_role?).returns(true)
       @provider.command(:foo).should == "rolefoo"
     end
 
     it "should use the role command when !exists and ensure=role" do
       @provider.stubs(:is_role?).returns(false)
       @provider.stubs(:exists?).returns(false)
       @resource.stubs(:[]).with(:ensure).returns(:role)
       @provider.command(:foo).should == "rolefoo"
     end
   end
 
   describe "when calling transition" do
     it "should return the type set to whatever is passed in" do
       @provider.expects(:command).with(:modify).returns("foomod")
       @provider.transition("bar").include?("type=bar")
     end
   end
 
   describe "when calling create" do
     before do
       @provider.stubs(:password=)
     end
 
     it "should use the add command when the user is not a role" do
       @provider.stubs(:is_role?).returns(false)
       @provider.expects(:addcmd).returns("useradd")
-      @provider.expects(:run)
+      @provider.expects(:run).at_least_once
       @provider.create
     end
 
     it "should use transition(normal) when the user is a role" do
       @provider.stubs(:is_role?).returns(true)
       @provider.expects(:transition).with("normal")
       @provider.expects(:run)
       @provider.create
     end
+
+    it "should set password age rules" do
+      @resource = Puppet::Type.type(:user).new :name => "myuser", :password_min_age => 5, :password_max_age => 10, :provider => :user_role_add
+      @provider = provider_class.new(@resource)
+      @provider.stubs(:user_attributes)
+      @provider.stubs(:execute)
+      @provider.expects(:execute).with { |cmd, *args| args == ["-m", 5, "-M", 10, "myuser"] }
+      @provider.create
+    end
   end
 
   describe "when calling destroy" do
     it "should use the delete command if the user exists and is not a role" do
       @provider.stubs(:exists?).returns(true)
       @provider.stubs(:is_role?).returns(false)
       @provider.expects(:deletecmd)
       @provider.expects(:run)
       @provider.destroy
     end
 
     it "should use the delete command if the user is a role" do
       @provider.stubs(:exists?).returns(true)
       @provider.stubs(:is_role?).returns(true)
       @provider.expects(:deletecmd)
       @provider.expects(:run)
       @provider.destroy
     end
   end
 
   describe "when calling create_role" do
     it "should use the transition(role) if the user exists" do
       @provider.stubs(:exists?).returns(true)
       @provider.stubs(:is_role?).returns(false)
       @provider.expects(:transition).with("role")
       @provider.expects(:run)
       @provider.create_role
     end
 
     it "should use the add command when role doesn't exists" do
       @provider.stubs(:exists?).returns(false)
       @provider.expects(:addcmd)
       @provider.expects(:run)
       @provider.create_role
     end
   end
 
   describe "when allow duplicate is enabled" do
     before do
       @resource.expects(:allowdupe?).returns true
       @provider.stubs(:is_role?).returns(false)
+      @provider.stubs(:execute)
       @provider.expects(:execute).with { |args| args.include?("-o") }
     end
 
     it "should add -o when the user is being created" do
       @provider.stubs(:password=)
       @provider.create
     end
 
     it "should add -o when the uid is being modified" do
       @provider.uid = 150
     end
   end
 
   [:roles, :auths, :profiles].each do |val|
     describe "when getting #{val}" do
       it "should get the user_attributes" do
         @provider.expects(:user_attributes)
         @provider.send(val)
       end
 
       it "should get the #{val} attribute" do
         attributes = mock("attributes")
         attributes.expects(:[]).with(val)
         @provider.stubs(:user_attributes).returns(attributes)
         @provider.send(val)
       end
     end
   end
 
   describe "when getting the keys" do
     it "should get the user_attributes" do
       @provider.expects(:user_attributes)
       @provider.keys
     end
 
     it "should call removed_managed_attributes" do
       @provider.stubs(:user_attributes).returns({ :type => "normal", :foo => "something" })
       @provider.expects(:remove_managed_attributes)
       @provider.keys
     end
 
     it "should removed managed attribute (type, auths, roles, etc)" do
       @provider.stubs(:user_attributes).returns({ :type => "normal", :foo => "something" })
       @provider.keys.should == { :foo => "something" }
     end
   end
 
   describe "when adding properties" do
     it "should call build_keys_cmd" do
       @resource.stubs(:should).returns ""
       @resource.expects(:should).with(:keys).returns({ :foo => "bar" })
       @provider.expects(:build_keys_cmd).returns([])
       @provider.add_properties
     end
 
     it "should add the elements of the keys hash to an array" do
       @resource.stubs(:should).returns ""
       @resource.expects(:should).with(:keys).returns({ :foo => "bar"})
       @provider.add_properties.must == ["-K", "foo=bar"]
     end
   end
 
   describe "when calling build_keys_cmd" do
     it "should build cmd array with keypairs seperated by -K ending with user" do
       @provider.build_keys_cmd({"foo" => "bar", "baz" => "boo"}).should.eql? ["-K", "foo=bar", "-K", "baz=boo"]
     end
   end
 
   describe "when setting the keys" do
     before do
       @provider.stubs(:is_role?).returns(false)
     end
 
     it "should run a command" do
       @provider.expects(:run)
       @provider.keys=({})
     end
 
     it "should build the command" do
       @resource.stubs(:[]).with(:name).returns("someuser")
       @provider.stubs(:command).returns("usermod")
       @provider.expects(:build_keys_cmd).returns(["-K", "foo=bar"])
       @provider.expects(:run).with(["usermod", "-K", "foo=bar", "someuser"], "modify attribute key pairs")
       @provider.keys=({})
     end
   end
 
   describe "when getting the hashed password" do
     before do
       @array = mock "array"
     end
 
     it "should readlines of /etc/shadow" do
       File.expects(:readlines).with("/etc/shadow").returns([])
       @provider.password
     end
 
     it "should reject anything that doesn't start with alpha numerics" do
       @array.expects(:reject).returns([])
       File.stubs(:readlines).with("/etc/shadow").returns(@array)
       @provider.password
     end
 
     it "should collect splitting on ':'" do
       @array.stubs(:reject).returns(@array)
       @array.expects(:collect).returns([])
       File.stubs(:readlines).with("/etc/shadow").returns(@array)
       @provider.password
     end
 
     it "should find the matching user" do
       @resource.stubs(:[]).with(:name).returns("username")
       @array.stubs(:reject).returns(@array)
       @array.stubs(:collect).returns([["username", "hashedpassword"], ["someoneelse", "theirpassword"]])
       File.stubs(:readlines).with("/etc/shadow").returns(@array)
       @provider.password.must == "hashedpassword"
     end
 
     it "should get the right password" do
       @resource.stubs(:[]).with(:name).returns("username")
       File.stubs(:readlines).with("/etc/shadow").returns(["#comment", "   nonsense", "  ", "username:hashedpassword:stuff:foo:bar:::", "other:pword:yay:::"])
       @provider.password.must == "hashedpassword"
     end
   end
 
   describe "when setting the password" do
     #how can you mock these blocks up?
     it "should open /etc/shadow for reading and /etc/shadow_tmp for writing" do
       File.expects(:open).with("/etc/shadow", "r")
       File.stubs(:rename)
       @provider.password=("hashedpassword")
     end
 
     it "should rename the /etc/shadow_tmp to /etc/shadow" do
       File.stubs(:open).with("/etc/shadow", "r")
       File.expects(:rename).with("/etc/shadow_tmp", "/etc/shadow")
       @provider.password=("hashedpassword")
     end
   end
+
+  describe "#shadow_entry" do
+    it "should return the line for the right user" do
+      File.stubs(:readlines).returns(["someuser:!:10:5:20:7:1::\n", "fakeval:*:20:10:30:7:2::\n", "testuser:*:30:15:40:7:3::\n"])
+      @provider.shadow_entry.should == ["fakeval", "*", "20", "10", "30", "7", "2"]
+    end
+  end
 end
diff --git a/spec/unit/provider/user/useradd_spec.rb b/spec/unit/provider/user/useradd_spec.rb
index 9869ba935..26367c584 100755
--- a/spec/unit/provider/user/useradd_spec.rb
+++ b/spec/unit/provider/user/useradd_spec.rb
@@ -1,124 +1,134 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../../spec_helper'
 
 provider_class = Puppet::Type.type(:user).provider(:useradd)
 
 describe provider_class do
   before do
     @resource = stub("resource", :name => "myuser", :managehome? => nil)
     @resource.stubs(:should).returns "fakeval"
     @resource.stubs(:[]).returns "fakeval"
     @provider = provider_class.new(@resource)
   end
 
   # #1360
   it "should add -o when allowdupe is enabled and the user is being created" do
     @resource.expects(:allowdupe?).returns true
+    @provider.stubs(:execute)
     @provider.expects(:execute).with { |args| args.include?("-o") }
     @provider.create
   end
 
   it "should add -o when allowdupe is enabled and the uid is being modified" do
     @resource.expects(:allowdupe?).returns true
     @provider.expects(:execute).with { |args| args.include?("-o") }
 
     @provider.uid = 150
   end
 
+  it "should set password age rules" do
+    provider_class.has_feature :manages_password_age
+    @resource = Puppet::Type.type(:user).new :name => "myuser", :password_min_age => 5, :password_max_age => 10, :provider => :useradd
+    @provider = provider_class.new(@resource)
+    @provider.stubs(:execute)
+    @provider.expects(:execute).with { |cmd, *args| args == ["-m", 5, "-M", 10, "myuser"] }
+    @provider.create
+  end
+
   describe "when checking to add allow dup" do
     it "should check allow dup" do
       @resource.expects(:allowdupe?)
       @provider.check_allow_dup
     end
 
     it "should return an array with a flag if dup is allowed" do
       @resource.stubs(:allowdupe?).returns true
       @provider.check_allow_dup.must == ["-o"]
     end
 
     it "should return an empty array if no dup is allowed" do
       @resource.stubs(:allowdupe?).returns false
       @provider.check_allow_dup.must == []
     end
   end
 
   describe "when checking manage home" do
     it "should check manage home" do
       @resource.expects(:managehome?)
       @provider.check_manage_home
     end
 
     it "should return an array with -m flag if home is managed" do
       @resource.stubs(:managehome?).returns true
       @provider.check_manage_home.must == ["-m"]
     end
 
     it "should return an array with -M if home is not managed and on Redhat" do
       Facter.stubs(:value).with("operatingsystem").returns("RedHat")
       @resource.stubs(:managehome?).returns false
       @provider.check_manage_home.must == ["-M"]
     end
 
     it "should return an empty array if home is not managed and not on Redhat" do
       Facter.stubs(:value).with("operatingsystem").returns("some OS")
       @resource.stubs(:managehome?).returns false
       @provider.check_manage_home.must == []
     end
   end
 
   describe "when adding properties" do
     it "should get the valid properties"
     it "should not add the ensure property"
     it "should add the flag and value to an array"
     it "should return and array of flags and values"
   end
 
   describe "when calling addcmd" do
     before do
       @resource.stubs(:allowdupe?).returns true
       @resource.stubs(:managehome?).returns true
     end
 
     it "should call command with :add" do
       @provider.expects(:command).with(:add)
       @provider.addcmd
     end
 
     it "should add properties" do
       @provider.expects(:add_properties).returns([])
       @provider.addcmd
     end
 
     it "should check and add if dup allowed" do
       @provider.expects(:check_allow_dup).returns([])
       @provider.addcmd
     end
 
     it "should check and add if home is managed" do
       @provider.expects(:check_manage_home).returns([])
       @provider.addcmd
     end
 
     it "should add the resource :name" do
       @resource.expects(:[]).with(:name)
       @provider.addcmd
     end
 
     it "should return an array with full command" do
       @provider.stubs(:command).with(:add).returns("useradd")
       @provider.stubs(:add_properties).returns(["-G", "somegroup"])
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:[]).with(:expiry).returns("somedate")
       @provider.addcmd.must == ["useradd", "-G", "somegroup", "-o", "-m", '-e somedate', "someuser"]
     end
 
     it "should return an array without -e if expery is undefined full command" do
       @provider.stubs(:command).with(:add).returns("useradd")
       @provider.stubs(:add_properties).returns(["-G", "somegroup"])
       @resource.stubs(:[]).with(:name).returns("someuser")
       @resource.stubs(:[]).with(:expiry).returns nil
       @provider.addcmd.must == ["useradd", "-G", "somegroup", "-o", "-m", "someuser"]
     end
   end
 end
diff --git a/spec/unit/type/user_spec.rb b/spec/unit/type/user_spec.rb
index f978b309c..ccea9ee4c 100755
--- a/spec/unit/type/user_spec.rb
+++ b/spec/unit/type/user_spec.rb
@@ -1,300 +1,304 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 user = Puppet::Type.type(:user)
 
 describe user do
   before do
     ENV["PATH"] += File::PATH_SEPARATOR + "/usr/sbin" unless ENV["PATH"].split(File::PATH_SEPARATOR).include?("/usr/sbin")
     @provider = stub 'provider'
     @resource = stub 'resource', :resource => nil, :provider => @provider, :line => nil, :file => nil
   end
 
   it "should have a default provider inheriting from Puppet::Provider" do
     user.defaultprovider.ancestors.should be_include(Puppet::Provider)
   end
 
   it "should be able to create a instance" do
     user.new(:name => "foo").should_not be_nil
   end
 
   it "should have an allows_duplicates feature" do
     user.provider_feature(:allows_duplicates).should_not be_nil
   end
 
   it "should have an manages_homedir feature" do
     user.provider_feature(:manages_homedir).should_not be_nil
   end
 
   it "should have an manages_passwords feature" do
     user.provider_feature(:manages_passwords).should_not be_nil
   end
 
   it "should have a manages_solaris_rbac feature" do
     user.provider_feature(:manages_solaris_rbac).should_not be_nil
   end
 
   it "should have a manages_expiry feature" do
     user.provider_feature(:manages_expiry).should_not be_nil
   end
 
+  it "should have a manages_password_age feature" do
+    user.provider_feature(:manages_password_age).should_not be_nil
+  end
+
   describe "instances" do
     it "should have a valid provider" do
       user.new(:name => "foo").provider.class.ancestors.should be_include(Puppet::Provider)
     end
 
     it "should delegate existence questions to its provider" do
       instance = user.new(:name => "foo")
       instance.provider.expects(:exists?).returns "eh"
       instance.exists?.should == "eh"
     end
   end
 
-  properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
+  properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :password_min_age, :password_max_age, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
 
   properties.each do |property|
     it "should have a #{property} property" do
       user.attrclass(property).ancestors.should be_include(Puppet::Property)
     end
 
     it "should have documentation for its #{property} property" do
       user.attrclass(property).doc.should be_instance_of(String)
     end
   end
 
   list_properties = [:groups, :roles, :auths]
 
   list_properties.each do |property|
     it "should have a list '#{property}'" do
       user.attrclass(property).ancestors.should be_include(Puppet::Property::List)
     end
   end
 
   it "should have an ordered list 'profiles'" do
     user.attrclass(:profiles).ancestors.should be_include(Puppet::Property::OrderedList)
   end
 
   it "should have key values 'keys'" do
     user.attrclass(:keys).ancestors.should be_include(Puppet::Property::KeyValue)
   end
 
   describe "when retrieving all current values" do
     before do
       @user = user.new(:name => "foo", :uid => 10)
     end
 
     it "should return a hash containing values for all set properties" do
       @user[:gid] = 10
       @user.property(:ensure).expects(:retrieve).returns :present
       @user.property(:uid).expects(:retrieve).returns 15
       @user.property(:gid).expects(:retrieve).returns 15
       values = @user.retrieve
       [@user.property(:uid), @user.property(:gid)].each { |property| values.should be_include(property) }
     end
 
     it "should set all values to :absent if the user is absent" do
       @user.property(:ensure).expects(:retrieve).returns :absent
       @user.property(:uid).expects(:retrieve).never
       @user.retrieve[@user.property(:uid)].should == :absent
     end
 
     it "should include the result of retrieving each property's current value if the user is present" do
       @user.property(:ensure).expects(:retrieve).returns :present
       @user.property(:uid).expects(:retrieve).returns 15
       @user.retrieve[@user.property(:uid)].should == 15
     end
   end
 
   describe "when managing the ensure property" do
     before do
       @ensure = user.attrclass(:ensure).new(:resource => @resource)
     end
 
     it "should support a :present value" do
       lambda { @ensure.should = :present }.should_not raise_error
     end
 
     it "should support an :absent value" do
       lambda { @ensure.should = :absent }.should_not raise_error
     end
 
     it "should call :create on the provider when asked to sync to the :present state" do
       @provider.expects(:create)
       @ensure.should = :present
       @ensure.sync
     end
 
     it "should call :delete on the provider when asked to sync to the :absent state" do
       @provider.expects(:delete)
       @ensure.should = :absent
       @ensure.sync
     end
 
     describe "and determining the current state" do
       it "should return :present when the provider indicates the user exists" do
         @provider.expects(:exists?).returns true
         @ensure.retrieve.should == :present
       end
 
       it "should return :absent when the provider indicates the user does not exist" do
         @provider.expects(:exists?).returns false
         @ensure.retrieve.should == :absent
       end
     end
   end
 
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       uid = user.attrclass(:uid).new(:resource => @resource)
       uid.should = "50"
       uid.should.must == 50
     end
 
     it "should support UIDs as numbers" do
       uid = user.attrclass(:uid).new(:resource => @resource)
       uid.should = 50
       uid.should.must == 50
     end
 
     it "should :absent as a value" do
       uid = user.attrclass(:uid).new(:resource => @resource)
       uid.should = :absent
       uid.should.must == :absent
     end
   end
 
   describe "when managing the gid" do
     it "should :absent as a value" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = :absent
       gid.should.must == :absent
     end
 
     it "should convert number-looking strings into actual numbers" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = "50"
       gid.should.must == 50
     end
 
     it "should support GIDs specified as integers" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = 50
       gid.should.must == 50
     end
 
     it "should support groups specified by name" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = "foo"
       gid.should.must == "foo"
     end
 
     describe "when testing whether in sync" do
       before do
         @gid = user.attrclass(:gid).new(:resource => @resource, :should => %w{foo bar})
       end
 
       it "should return true if no 'should' values are set" do
         @gid = user.attrclass(:gid).new(:resource => @resource)
 
         @gid.must be_insync(500)
       end
 
       it "should return true if any of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @gid.must be_insync(500)
       end
 
       it "should return false if none of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @gid.should_not be_insync(700)
       end
     end
 
     describe "when syncing" do
       before do
         @gid = user.attrclass(:gid).new(:resource => @resource, :should => %w{foo bar})
       end
 
       it "should use the first found, specified group as the desired value and send it to the provider" do
         Puppet::Util.expects(:gid).with("foo").returns nil
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @provider.expects(:gid=).with 500
 
         @gid.sync
       end
     end
   end
 
   describe "when managing expiry" do
     before do
       @expiry = user.attrclass(:expiry).new(:resource => @resource)
     end
 
     it "should fail if given an invalid date" do
       lambda { @expiry.should = "200-20-20" }.should raise_error(Puppet::Error)
     end
   end
 
   describe "when managing passwords" do
     before do
       @password = user.attrclass(:password).new(:resource => @resource, :should => "mypass")
     end
 
     it "should not include the password in the change log when adding the password" do
       @password.change_to_s(:absent, "mypass").should_not be_include("mypass")
     end
 
     it "should not include the password in the change log when changing the password" do
       @password.change_to_s("other", "mypass").should_not be_include("mypass")
     end
 
     it "should fail if a ':' is included in the password" do
       lambda { @password.should = "some:thing" }.should raise_error(Puppet::Error)
     end
 
     it "should allow the value to be set to :absent" do
       lambda { @password.should = :absent }.should_not raise_error
     end
   end
 
   describe "when manages_solaris_rbac is enabled" do
     before do
       @provider.stubs(:satisfies?).returns(false)
       @provider.expects(:satisfies?).with([:manages_solaris_rbac]).returns(true)
     end
 
     it "should support a :role value for ensure" do
       @ensure = user.attrclass(:ensure).new(:resource => @resource)
       lambda { @ensure.should = :role }.should_not raise_error
     end
   end
 
   describe "when user has roles" do
     before do
       # To test this feature, we have to support it.
       user.new(:name => "foo").provider.class.stubs(:feature?).returns(true)
     end
 
     it "should autorequire roles" do
       testuser = Puppet::Type.type(:user).new(:name => "testuser")
       testuser[:roles] = "testrole"
 
       testrole = Puppet::Type.type(:user).new(:name => "testrole")
 
       config = Puppet::Resource::Catalog.new :testing do |conf|
         [testuser, testrole].each { |resource| conf.add_resource resource }
       end
       Puppet::Type::User::ProviderDirectoryservice.stubs(:get_macosx_version_major).returns "10.5"
 
       rel = testuser.autorequire[0]
       rel.source.ref.should == testrole.ref
       rel.target.ref.should == testuser.ref
     end
   end
 end