diff --git a/lib/puppet/provider/ssh_authorized_key/parsed.rb b/lib/puppet/provider/ssh_authorized_key/parsed.rb
index 6a3855c0e..5243477ff 100644
--- a/lib/puppet/provider/ssh_authorized_key/parsed.rb
+++ b/lib/puppet/provider/ssh_authorized_key/parsed.rb
@@ -1,96 +1,97 @@
 require 'puppet/provider/parsedfile'
 
 
       Puppet::Type.type(:ssh_authorized_key).provide(
         :parsed,
   :parent => Puppet::Provider::ParsedFile,
   :filetype => :flat,
         
   :default_target => ''
 ) do
   desc "Parse and generate authorized_keys files for SSH."
 
   text_line :comment, :match => /^#/
   text_line :blank, :match => /^\s+/
 
   record_line :parsed,
     :fields   => %w{options type key name},
     :optional => %w{options},
     :rts => /^\s+/,
     :match    => /^(?:(.+) )?(ssh-dss|ssh-rsa) ([^ ]+) ?(.*)$/,
     :post_parse => proc { |h|
       h[:name] = "" if h[:name] == :absent
       h[:options] ||= [:absent]
       h[:options] = Puppet::Type::Ssh_authorized_key::ProviderParsed.parse_options(h[:options]) if h[:options].is_a? String
     },
     :pre_gen => proc { |h|
       h[:options] = [] if h[:options].include?(:absent)
       h[:options] = h[:options].join(',')
     }
 
   record_line :key_v1,
     :fields   => %w{options bits exponent modulus name},
     :optional => %w{options},
     :rts      => /^\s+/,
     :match    => /^(?:(.+) )?(\d+) (\d+) (\d+)(?: (.+))?$/
 
   def dir_perm
     0700
   end
 
   def file_perm
     0600
   end
 
   def target
       @resource.should(:target) || File.expand_path("~#{@resource.should(:user)}/.ssh/authorized_keys")
   rescue
       raise Puppet::Error, "Target not defined and/or specified user does not exist yet"
   end
 
   def user
     uid = File.stat(target).uid
     Etc.getpwuid(uid).name
   end
 
   def flush
     raise Puppet::Error, "Cannot write SSH authorized keys without user"    unless @resource.should(:user)
     raise Puppet::Error, "User '#{@resource.should(:user)}' does not exist" unless uid = Puppet::Util.uid(@resource.should(:user))
-    unless File.exist?(dir = File.dirname(target))
-      Puppet.debug "Creating #{dir}"
-      Dir.mkdir(dir, dir_perm)
-      File.chown(uid, nil, dir)
-    end
-
     # ParsedFile usually calls backup_target much later in the flush process,
     # but our SUID makes that fail to open filebucket files for writing.
     # Fortunately, there's already logic to make sure it only ever happens once,
     # so calling it here supresses the later attempt by our superclass's flush method.
     self.class.backup_target(target)
 
-    Puppet::Util::SUIDManager.asuser(@resource.should(:user)) { super }
-    File.chown(uid, nil, target)
-    File.chmod(file_perm, target)
+    Puppet::Util::SUIDManager.asuser(@resource.should(:user)) do
+        unless File.exist?(dir = File.dirname(target))
+          Puppet.debug "Creating #{dir}"
+          Dir.mkdir(dir, dir_perm)
+        end
+
+        super
+
+        File.chmod(file_perm, target)
+    end
   end
 
   # parse sshv2 option strings, wich is a comma separated list of
   # either key="values" elements or bare-word elements
   def self.parse_options(options)
     result = []
     scanner = StringScanner.new(options)
     while !scanner.eos?
       scanner.skip(/[ \t]*/)
       # scan a long option
       if out = scanner.scan(/[-a-z0-9A-Z_]+=\".*?\"/) or out = scanner.scan(/[-a-z0-9A-Z_]+/)
         result << out
       else
         # found an unscannable token, let's abort
         break
       end
       # eat a comma
       scanner.skip(/[ \t]*,[ \t]*/)
     end
     result
   end
 end
 
diff --git a/spec/unit/provider/ssh_authorized_key/parsed_spec.rb b/spec/unit/provider/ssh_authorized_key/parsed_spec.rb
index 2e5be165a..64935df52 100755
--- a/spec/unit/provider/ssh_authorized_key/parsed_spec.rb
+++ b/spec/unit/provider/ssh_authorized_key/parsed_spec.rb
@@ -1,230 +1,230 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../../spec_helper'
 
 require 'puppet_spec/files'
 require 'puppettest/support/utils'
 require 'puppettest/fileparsing'
 require 'puppettest/fakes'
 
 provider_class = Puppet::Type.type(:ssh_authorized_key).provider(:parsed)
 
 describe provider_class do
   include PuppetSpec::Files
   extend PuppetTest::Support::Utils
   include PuppetTest
   include PuppetTest::FileParsing
 
   before :each do
     @sshauthkey_class = Puppet::Type.type(:ssh_authorized_key)
     @provider = @sshauthkey_class.provider(:parsed)
     @keyfile = tmpfile('authorized_keys')
     @provider.any_instance.stubs(:target).returns @keyfile
     @user = 'random_bob'
     Puppet::Util.stubs(:uid).with(@user).returns 12345
   end
 
   after :each do
     @provider.initvars
   end
 
   def mkkey(args)
     fakeresource = fakeresource(:ssh_authorized_key, args[:name])
     fakeresource.stubs(:should).with(:user).returns @user
     fakeresource.stubs(:should).with(:target).returns @keyfile
 
     key = @provider.new(fakeresource)
     args.each do |p,v|
       key.send(p.to_s + "=", v)
     end
 
     key
   end
 
   def genkey(key)
     @provider.stubs(:filetype).returns(Puppet::Util::FileType::FileTypeRam)
     File.stubs(:chown)
     File.stubs(:chmod)
     Puppet::Util::SUIDManager.stubs(:asuser).yields
     key.flush
     @provider.target_object(@keyfile).read
   end
 
   fakedata("data/providers/ssh_authorized_key/parsed").each { |file|
     it "should be able to parse example data in #{file}" do
       fakedataparse(file)
     end
   }
 
   it "should be able to generate a basic authorized_keys file" do
 
     key = mkkey(
       {
         :name => "Just Testing",
         :key => "AAAAfsfddsjldjgksdflgkjsfdlgkj",
         :type => "ssh-dss",
         :ensure => :present,
 
         :options => [:absent]
     })
 
     genkey(key).should == "ssh-dss AAAAfsfddsjldjgksdflgkjsfdlgkj Just Testing\n"
   end
 
   it "should be able to generate a authorized_keys file with options" do
 
     key = mkkey(
       {
         :name => "root@localhost",
         :key => "AAAAfsfddsjldjgksdflgkjsfdlgkj",
         :type => "ssh-rsa",
         :ensure => :present,
 
         :options => ['from="192.168.1.1"', "no-pty", "no-X11-forwarding"]
     })
 
     genkey(key).should == "from=\"192.168.1.1\",no-pty,no-X11-forwarding ssh-rsa AAAAfsfddsjldjgksdflgkjsfdlgkj root@localhost\n"
   end
 
   it "should be able to parse options containing commas via its parse_options method" do
     options = %w{from="host1.reductlivelabs.com,host.reductivelabs.com" command="/usr/local/bin/run" ssh-pty}
     optionstr = options.join(", ")
 
     @provider.parse_options(optionstr).should == options
   end
 
   it "should use '' as name for entries that lack a comment" do
     line = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAut8aOSxenjOqF527dlsdHWV4MNoAsX14l9M297+SQXaQ5Z3BedIxZaoQthkDALlV/25A1COELrg9J2MqJNQc8Xe9XQOIkBQWWinUlD/BXwoOTWEy8C8zSZPHZ3getMMNhGTBO+q/O+qiJx3y5cA4MTbw2zSxukfWC87qWwcZ64UUlegIM056vPsdZWFclS9hsROVEa57YUMrehQ1EGxT4Z5j6zIopufGFiAPjZigq/vqgcAqhAKP6yu4/gwO6S9tatBeEjZ8fafvj1pmvvIplZeMr96gHE7xS3pEEQqnB3nd4RY7AF6j9kFixnsytAUO7STPh/M3pLiVQBN89TvWPQ=="
 
     @provider.parse(line)[0][:name].should == ""
   end
 end
 
 describe provider_class do
   before :each do
     @resource = stub("resource", :name => "foo")
     @resource.stubs(:[]).returns "foo"
     @resource.class.stubs(:key_attributes).returns( [:name] )
 
     @provider = provider_class.new(@resource)
     provider_class.stubs(:filetype).returns(Puppet::Util::FileType::FileTypeRam)
     Puppet::Util::SUIDManager.stubs(:asuser).yields
   end
 
   describe "when flushing" do
     before :each do
       # Stub file and directory operations
       Dir.stubs(:mkdir)
       File.stubs(:chmod)
       File.stubs(:chown)
     end
 
     describe "and both a user and a target have been specified" do
       before :each do
         Puppet::Util.stubs(:uid).with("random_bob").returns 12345
         @resource.stubs(:should).with(:user).returns "random_bob"
         target = "/tmp/.ssh_dir/place_to_put_authorized_keys"
         @resource.stubs(:should).with(:target).returns target
       end
 
       it "should create the directory" do
         File.stubs(:exist?).with("/tmp/.ssh_dir").returns false
         Dir.expects(:mkdir).with("/tmp/.ssh_dir", 0700)
         @provider.flush
       end
 
-      it "should chown the directory to the user" do
+      it "should absolutely not chown the directory to the user" do
         uid = Puppet::Util.uid("random_bob")
-        File.expects(:chown).with(uid, nil, "/tmp/.ssh_dir")
+        File.expects(:chown).never
         @provider.flush
       end
 
-      it "should chown the key file to the user" do
+      it "should absolutely not chown the key file to the user" do
         uid = Puppet::Util.uid("random_bob")
-        File.expects(:chown).with(uid, nil, "/tmp/.ssh_dir/place_to_put_authorized_keys")
+        File.expects(:chown).never
         @provider.flush
       end
 
       it "should chmod the key file to 0600" do
         File.expects(:chmod).with(0600, "/tmp/.ssh_dir/place_to_put_authorized_keys")
         @provider.flush
       end
     end
 
     describe "and a user has been specified with no target" do
       before :each do
         @resource.stubs(:should).with(:user).returns "nobody"
         @resource.stubs(:should).with(:target).returns nil
         #
         # I'd like to use random_bob here and something like
         #
         #    File.stubs(:expand_path).with("~random_bob/.ssh").returns "/users/r/random_bob/.ssh"
         #
         # but mocha objects strenuously to stubbing File.expand_path
         # so I'm left with using nobody.
         @dir = File.expand_path("~nobody/.ssh")
       end
 
       it "should create the directory if it doesn't exist" do
         File.stubs(:exist?).with(@dir).returns false
         Dir.expects(:mkdir).with(@dir,0700)
         @provider.flush
       end
 
       it "should not create or chown the directory if it already exist" do
         File.stubs(:exist?).with(@dir).returns false
         Dir.expects(:mkdir).never
         @provider.flush
       end
 
-      it "should chown the directory to the user if it creates it" do
+      it "should absolutely not chown the directory to the user if it creates it" do
         File.stubs(:exist?).with(@dir).returns false
         Dir.stubs(:mkdir).with(@dir,0700)
         uid = Puppet::Util.uid("nobody")
-        File.expects(:chown).with(uid, nil, @dir)
+        File.expects(:chown).never
         @provider.flush
       end
 
       it "should not create or chown the directory if it already exist" do
         File.stubs(:exist?).with(@dir).returns false
         Dir.expects(:mkdir).never
         File.expects(:chown).never
         @provider.flush
       end
 
-      it "should chown the key file to the user" do
+      it "should absolutely not chown the key file to the user" do
         uid = Puppet::Util.uid("nobody")
-        File.expects(:chown).with(uid, nil, File.expand_path("~nobody/.ssh/authorized_keys"))
+        File.expects(:chown).never
         @provider.flush
       end
 
       it "should chmod the key file to 0600" do
         File.expects(:chmod).with(0600, File.expand_path("~nobody/.ssh/authorized_keys"))
         @provider.flush
       end
     end
 
     describe "and a target has been specified with no user" do
       before :each do
         @resource.stubs(:should).with(:user).returns nil
         @resource.stubs(:should).with(:target).returns("/tmp/.ssh_dir/place_to_put_authorized_keys")
       end
 
       it "should raise an error" do
         proc { @provider.flush }.should raise_error
       end
     end
 
     describe "and a invalid user has been specified with no target" do
       before :each do
         @resource.stubs(:should).with(:user).returns "thisusershouldnotexist"
         @resource.stubs(:should).with(:target).returns nil
       end
 
       it "should catch an exception and raise a Puppet error" do
         lambda { @provider.flush }.should raise_error(Puppet::Error)
       end
     end
 
   end
 end