diff --git a/lib/puppet/type/resources.rb b/lib/puppet/type/resources.rb
index ae41b883b..3e25ea5aa 100644
--- a/lib/puppet/type/resources.rb
+++ b/lib/puppet/type/resources.rb
@@ -1,131 +1,131 @@
 require 'puppet'
 
 Puppet::Type.newtype(:resources) do
   @doc = "This is a metatype that can manage other resource types.  Any
     metaparams specified here will be passed on to any generated resources,
     so you can purge umanaged resources but set `noop` to true so the
     purging is only logged and does not actually happen."
 
 
   newparam(:name) do
     desc "The name of the type to be managed."
 
     validate do |name|
       raise ArgumentError, "Could not find resource type '#{name}'" unless Puppet::Type.type(name)
     end
 
     munge { |v| v.to_s }
   end
 
   newparam(:purge, :boolean => true) do
     desc "Purge unmanaged resources.  This will delete any resource
       that is not specified in your configuration
       and is not required by any specified resources."
 
     newvalues(:true, :false)
 
     validate do |value|
       if [:true, true, "true"].include?(value)
         unless @resource.resource_type.respond_to?(:instances)
           raise ArgumentError, "Purging resources of type #{@resource[:name]} is not supported, since they cannot be queried from the system"
         end
         raise ArgumentError, "Purging is only supported on types that accept 'ensure'" unless @resource.resource_type.validproperty?(:ensure)
       end
     end
   end
 
   newparam(:unless_system_user) do
     desc "This keeps system users from being purged.  By default, it
       does not purge users whose UIDs are less than or equal to 500, but you can specify
       a different UID as the inclusive limit."
 
     newvalues(:true, :false, /^\d+$/)
 
     munge do |value|
       case value
       when /^\d+/
         Integer(value)
       when :true, true
         500
       when :false, false
         false
       when Integer; value
       else
         raise ArgumentError, "Invalid value #{value.inspect}"
       end
     end
 
     defaultto {
       if @resource[:name] == "user"
         500
       else
         nil
       end
     }
   end
 
   def check(resource)
     @checkmethod ||= "#{self[:name]}_check"
     @hascheck ||= respond_to?(@checkmethod)
     if @hascheck
       return send(@checkmethod, resource)
     else
       return true
     end
   end
 
   def able_to_ensure_absent?(resource)
       resource[:ensure] = :absent
   rescue ArgumentError, Puppet::Error => detail
       err "The 'ensure' attribute on #{self[:name]} resources does not accept 'absent' as a value"
       false
   end
 
   # Generate any new resources we need to manage.  This is pretty hackish
   # right now, because it only supports purging.
   def generate
     return [] unless self.purge?
     resource_type.instances.
       reject { |r| catalog.resource_refs.include? r.ref }.
       select { |r| check(r) }.
       select { |r| r.class.validproperty?(:ensure) }.
       select { |r| able_to_ensure_absent?(r) }.
       each { |resource|
         @parameters.each do |name, param|
           resource[name] = param.value if param.metaparam?
         end
 
         # Mark that we're purging, so transactions can handle relationships
         # correctly
         resource.purging
       }
   end
 
   def resource_type
     unless defined?(@resource_type)
       unless type = Puppet::Type.type(self[:name])
         raise Puppet::DevError, "Could not find resource type"
       end
       @resource_type = type
     end
     @resource_type
   end
 
   # Make sure we don't purge users below a certain uid, if the check
   # is enabled.
   def user_check(resource)
     return true unless self[:name] == "user"
     return true unless self[:unless_system_user]
 
     resource[:audit] = :uid
-    current_values = resource.retrieve_resource
 
     return false if system_users.include?(resource[:name])
 
+    current_values = resource.retrieve_resource
     current_values[resource.property(:uid)] > self[:unless_system_user]
   end
 
   def system_users
     %w{root nobody bin noaccess daemon sys}
   end
 end
diff --git a/spec/unit/indirector/resource/ral_spec.rb b/spec/unit/indirector/resource/ral_spec.rb
index 2a3fec0d3..389ca2009 100755
--- a/spec/unit/indirector/resource/ral_spec.rb
+++ b/spec/unit/indirector/resource/ral_spec.rb
@@ -1,130 +1,135 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 describe "Puppet::Resource::Ral" do
   describe "find" do
     before do
       @request = stub 'request', :key => "user/root"
     end
 
     it "should find an existing instance" do
       my_resource    = stub "my user resource"
 
       wrong_instance = stub "wrong user", :name => "bob"
       my_instance    = stub "my user",    :name => "root", :to_resource => my_resource
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ wrong_instance, my_instance, wrong_instance ])
       Puppet::Resource::Ral.new.find(@request).should == my_resource
     end
 
     it "if there is no instance, it should create one", :'fails_on_ruby_1.9.2' => true do
       wrong_instance = stub "wrong user", :name => "bob"
+      root = mock "Root User"
+      root_resource = mock "Root Resource"
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ wrong_instance, wrong_instance ])
+      Puppet::Type::User.expects(:new).with(has_entry(:name => "root")).returns(root)
+      root.expects(:to_resource).returns(root_resource)
+
       result = Puppet::Resource::Ral.new.find(@request)
-      result.should be_is_a(Puppet::Resource)
-      result.title.should == "root"
+
+      result.should == root_resource
     end
   end
 
   describe "search" do
     before do
       @request = stub 'request', :key => "user/", :options => {}
     end
 
     it "should convert ral resources into regular resources" do
       my_resource = stub "my user resource"
       my_instance = stub "my user", :name => "root", :to_resource => my_resource
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ my_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [my_resource]
     end
 
     it "should filter results by name if there's a name in the key" do
       my_resource    = stub "my user resource"
       my_resource.stubs(:to_resource).returns(my_resource)
       my_resource.stubs(:[]).with(:name).returns("root")
 
       wrong_resource = stub "wrong resource"
       wrong_resource.stubs(:to_resource).returns(wrong_resource)
       wrong_resource.stubs(:[]).with(:name).returns("bad")
 
       my_instance    = stub "my user",    :to_resource => my_resource
       wrong_instance = stub "wrong user", :to_resource => wrong_resource
 
       @request = stub 'request', :key => "user/root", :options => {}
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ my_instance, wrong_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [my_resource]
     end
 
     it "should filter results by query parameters" do
       wrong_resource = stub "my user resource"
       wrong_resource.stubs(:to_resource).returns(wrong_resource)
       wrong_resource.stubs(:[]).with(:name).returns("root")
 
       my_resource = stub "wrong resource"
       my_resource.stubs(:to_resource).returns(my_resource)
       my_resource.stubs(:[]).with(:name).returns("bob")
 
       my_instance    = stub "my user",    :to_resource => my_resource
       wrong_instance = stub "wrong user", :to_resource => wrong_resource
 
       @request = stub 'request', :key => "user/", :options => {:name => "bob"}
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ my_instance, wrong_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [my_resource]
     end
 
     it "should return sorted results" do
       a_resource = stub "alice resource"
       a_resource.stubs(:to_resource).returns(a_resource)
       a_resource.stubs(:title).returns("alice")
 
       b_resource = stub "bob resource"
       b_resource.stubs(:to_resource).returns(b_resource)
       b_resource.stubs(:title).returns("bob")
 
       a_instance = stub "alice user", :to_resource => a_resource
       b_instance = stub "bob user",   :to_resource => b_resource
 
       @request = stub 'request', :key => "user/", :options => {}
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ b_instance, a_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [a_resource, b_resource]
     end
   end
 
   describe "save" do
     before do
       @rebuilt_res = stub 'rebuilt instance'
       @ral_res     = stub 'ral resource', :to_resource => @rebuilt_res
       @instance    = stub 'instance', :to_ral => @ral_res
       @request     = stub 'request',  :key => "user/", :instance => @instance
       @catalog     = stub 'catalog'
       @report      = stub 'report'
       @transaction = stub 'transaction', :report => @report
 
       Puppet::Resource::Catalog.stubs(:new).returns(@catalog)
       @catalog.stubs(:apply).returns(@transaction)
       @catalog.stubs(:add_resource)
     end
 
     it "should apply a new catalog with a ral object in it" do
       Puppet::Resource::Catalog.expects(:new).returns(@catalog)
       @catalog.expects(:add_resource).with(@ral_res)
       @catalog.expects(:apply).returns(@transaction)
       Puppet::Resource::Ral.new.save(@request).should
     end
 
     it "should return a regular resource that used to be the ral resource" do
       Puppet::Resource::Ral.new.save(@request).should == [@rebuilt_res, @report]
     end
   end
 end
diff --git a/spec/unit/type/group_spec.rb b/spec/unit/type/group_spec.rb
index afe28247a..f9e83c914 100755
--- a/spec/unit/type/group_spec.rb
+++ b/spec/unit/type/group_spec.rb
@@ -1,63 +1,54 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 describe Puppet::Type.type(:group) do
   before do
-    ENV["PATH"] += File::PATH_SEPARATOR + "/usr/sbin" unless ENV["PATH"].split(File::PATH_SEPARATOR).include?("/usr/sbin")
     @class = Puppet::Type.type(:group)
   end
 
-  it "should have a default provider" do
-    @class.defaultprovider.should_not be_nil
-  end
-
-  it "should have a default provider inheriting from Puppet::Provider" do
-    @class.defaultprovider.ancestors.should be_include(Puppet::Provider)
-  end
-
   it "should have a system_groups feature" do
     @class.provider_feature(:system_groups).should_not be_nil
   end
 
   describe "when validating attributes" do
     [:name, :allowdupe].each do |param|
       it "should have a #{param} parameter" do
         @class.attrtype(param).should == :param
       end
     end
 
     [:ensure, :gid].each do |param|
       it "should have a #{param} property" do
         @class.attrtype(param).should == :property
       end
     end
 
     it "should convert gids provided as strings into integers" do
       @class.new(:name => "foo", :gid => "15")[:gid].should == 15
     end
 
     it "should accepts gids provided as integers" do
       @class.new(:name => "foo", :gid => 15)[:gid].should == 15
     end
   end
 
   it "should have a boolean method for determining if duplicates are allowed", :'fails_on_ruby_1.9.2' => true do
     @class.new(:name => "foo").methods.should be_include("allowdupe?")
   end
 
   it "should have a boolean method for determining if system groups are allowed", :'fails_on_ruby_1.9.2' => true do
     @class.new(:name => "foo").methods.should be_include("system?")
   end
 
   it "should call 'create' to create the group" do
     group = @class.new(:name => "foo", :ensure => :present)
     group.provider.expects(:create)
     group.parameter(:ensure).sync
   end
 
   it "should call 'delete' to remove the group" do
     group = @class.new(:name => "foo", :ensure => :absent)
     group.provider.expects(:delete)
     group.parameter(:ensure).sync
   end
 end
diff --git a/spec/unit/type/resources_spec.rb b/spec/unit/type/resources_spec.rb
index 652a6e8b7..2aa0e18de 100755
--- a/spec/unit/type/resources_spec.rb
+++ b/spec/unit/type/resources_spec.rb
@@ -1,101 +1,100 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 resources = Puppet::Type.type(:resources)
 
 # There are still plenty of tests to port over from test/.
 describe resources do
   describe "when initializing" do
     it "should fail if the specified resource type does not exist" do
       Puppet::Type.stubs(:type).with { |x| x.to_s.downcase == "resources"}.returns resources
       Puppet::Type.expects(:type).with("nosuchtype").returns nil
       lambda { resources.new :name => "nosuchtype" }.should raise_error(Puppet::Error)
     end
 
     it "should not fail when the specified resource type exists" do
       lambda { resources.new :name => "file" }.should_not raise_error
     end
 
     it "should set its :resource_type attribute" do
       resources.new(:name => "file").resource_type.should == Puppet::Type.type(:file)
     end
   end
 
   describe "#generate" do
     before do
       @host1 = Puppet::Type.type(:host).new(:name => 'localhost', :ip => '127.0.0.1')
       @catalog = Puppet::Resource::Catalog.new
       @context = Puppet::Transaction.new(@catalog)
     end
 
       describe "when dealing with non-purging resources" do
         before do
           @resources = Puppet::Type.type(:resources).new(:name => 'host')
         end
 
         it "should not generate any resource" do
           @resources.generate.should be_empty
         end
       end
 
       describe "when the catalog contains a purging resource" do
         before do
           @resources = Puppet::Type.type(:resources).new(:name => 'host', :purge => true)
           @purgeable_resource = Puppet::Type.type(:host).new(:name => 'localhost', :ip => '127.0.0.1')
           @catalog.add_resource @resources
         end
 
         it "should not generate a duplicate of that resource" do
           Puppet::Type.type(:host).stubs(:instances).returns [@host1]
           @catalog.add_resource @host1
           @resources.generate.collect { |r| r.ref }.should_not include(@host1.ref)
         end
 
-        it "should not include the skipped users", :'fails_on_ruby_1.9.2' => true do
+        it "should not include the skipped system users", :'fails_on_ruby_1.9.2' => true do
           res = Puppet::Type.type(:resources).new :name => :user, :purge => true
           res.catalog = Puppet::Resource::Catalog.new
 
-          users = [
-            Puppet::Type.type(:user).new(:name => "root")
-          ]
-          Puppet::Type.type(:user).expects(:instances).returns users
+          root = Puppet::Type.type(:user).new(:name => "root")
+          Puppet::Type.type(:user).expects(:instances).returns [ root ]
+
           list = res.generate
 
           names = list.collect { |r| r[:name] }
           names.should_not be_include("root")
         end
 
         describe "when generating a purgeable resource" do
           it "should be included in the generated resources" do
             Puppet::Type.type(:host).stubs(:instances).returns [@purgeable_resource]
             @resources.generate.collect { |r| r.ref }.should include(@purgeable_resource.ref)
           end
         end
 
         describe "when the instance's do not have an ensure property" do
           it "should not be included in the generated resources" do
             @no_ensure_resource = Puppet::Type.type(:exec).new(:name => "#{File.expand_path('/usr/bin/env')} echo")
             Puppet::Type.type(:host).stubs(:instances).returns [@no_ensure_resource]
             @resources.generate.collect { |r| r.ref }.should_not include(@no_ensure_resource.ref)
           end
         end
 
         describe "when the instance's ensure property does not accept absent" do
           it "should not be included in the generated resources" do
             @no_absent_resource = Puppet::Type.type(:service).new(:name => 'foobar')
             Puppet::Type.type(:host).stubs(:instances).returns [@no_absent_resource]
             @resources.generate.collect { |r| r.ref }.should_not include(@no_absent_resource.ref)
           end
         end
 
         describe "when checking the instance fails" do
           it "should not be included in the generated resources" do
             @purgeable_resource = Puppet::Type.type(:host).new(:name => 'foobar')
             Puppet::Type.type(:host).stubs(:instances).returns [@purgeable_resource]
             @resources.expects(:check).with(@purgeable_resource).returns(false)
             @resources.generate.collect { |r| r.ref }.should_not include(@purgeable_resource.ref)
           end
         end
       end
   end
 end
diff --git a/spec/unit/type/user_spec.rb b/spec/unit/type/user_spec.rb
index 9f83e4eac..bb235b798 100755
--- a/spec/unit/type/user_spec.rb
+++ b/spec/unit/type/user_spec.rb
@@ -1,348 +1,340 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
       has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac
       mk_resource_methods
       def create; end
       def delete; end
       def exists?; get(:ensure) != :absent; end
       def flush; end
       def self.instances; []; end
     end
     described_class.stubs(:defaultprovider).returns @provider_class
   end
 
-  it "should have a default provider inheriting from Puppet::Provider" do
-    described_class.defaultprovider.ancestors.should be_include(Puppet::Provider)
-  end
-
   it "should be able to create a instance" do
     described_class.new(:name => "foo").should_not be_nil
   end
 
   it "should have an allows_duplicates feature" do
     described_class.provider_feature(:allows_duplicates).should_not be_nil
   end
 
   it "should have an manages_homedir feature" do
     described_class.provider_feature(:manages_homedir).should_not be_nil
   end
 
   it "should have an manages_passwords feature" do
     described_class.provider_feature(:manages_passwords).should_not be_nil
   end
 
   it "should have a manages_solaris_rbac feature" do
     described_class.provider_feature(:manages_solaris_rbac).should_not be_nil
   end
 
   it "should have a manages_expiry feature" do
     described_class.provider_feature(:manages_expiry).should_not be_nil
   end
 
   it "should have a manages_password_age feature" do
     described_class.provider_feature(:manages_password_age).should_not be_nil
   end
 
   it "should have a system_users feature" do
     described_class.provider_feature(:system_users).should_not be_nil
   end
 
   describe "instances" do
-    it "should have a valid provider" do
-      described_class.new(:name => "foo").provider.class.ancestors.should be_include(Puppet::Provider)
-    end
-
     it "should delegate existence questions to its provider" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       instance = described_class.new(:name => "foo", :provider => @provider)
       instance.exists?.should == false
 
       @provider.set(:ensure => :present)
       instance.exists?.should == true
     end
   end
 
   properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :password_min_age, :password_max_age, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
 
   properties.each do |property|
     it "should have a #{property} property" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property)
     end
 
     it "should have documentation for its #{property} property" do
       described_class.attrclass(property).doc.should be_instance_of(String)
     end
   end
 
   list_properties = [:groups, :roles, :auths]
 
   list_properties.each do |property|
     it "should have a list '#{property}'" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property::List)
     end
   end
 
   it "should have an ordered list 'profiles'" do
     described_class.attrclass(:profiles).ancestors.should be_include(Puppet::Property::OrderedList)
   end
 
   it "should have key values 'keys'" do
     described_class.attrclass(:keys).ancestors.should be_include(Puppet::Property::KeyValue)
   end
 
   describe "when retrieving all current values" do
     before do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present, :uid => 15, :gid => 15)
       @user = described_class.new(:name => "foo", :uid => 10, :provider => @provider)
     end
 
     it "should return a hash containing values for all set properties" do
       @user[:gid] = 10
       values = @user.retrieve
       [@user.property(:uid), @user.property(:gid)].each { |property| values.should be_include(property) }
     end
 
     it "should set all values to :absent if the user is absent" do
       @user.property(:ensure).expects(:retrieve).returns :absent
       @user.property(:uid).expects(:retrieve).never
       @user.retrieve[@user.property(:uid)].should == :absent
     end
 
     it "should include the result of retrieving each property's current value if the user is present" do
       @user.retrieve[@user.property(:uid)].should == 15
     end
   end
 
   describe "when managing the ensure property" do
     it "should support a :present value" do
       lambda { described_class.new(:name => 'foo', :ensure => :present) }.should_not raise_error
     end
 
     it "should support an :absent value" do
       lambda { described_class.new(:name => 'foo', :ensure => :absent) }.should_not raise_error
     end
 
     it "should call :create on the provider when asked to sync to the :present state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       @provider.expects(:create)
       described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).sync
     end
 
     it "should call :delete on the provider when asked to sync to the :absent state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present)
       @provider.expects(:delete)
       described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).sync
     end
 
     describe "and determining the current state" do
       it "should return :present when the provider indicates the user exists" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :present)
         described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).retrieve.should == :present
       end
 
       it "should return :absent when the provider indicates the user does not exist" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
         described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).retrieve.should == :absent
       end
     end
   end
 
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :uid => '50')[:uid].should == 50
     end
 
     it "should support UIDs as numbers" do
       described_class.new(:name => 'foo', :uid => 50)[:uid].should == 50
     end
 
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :uid => :absent)[:uid].should == :absent
     end
   end
 
   describe "when managing the gid" do
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :gid => :absent)[:gid].should == :absent
     end
 
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :gid => '50')[:gid].should == 50
     end
 
     it "should support GIDs specified as integers" do
       described_class.new(:name => 'foo', :gid => 50)[:gid].should == 50
     end
 
     it "should support groups specified by name" do
       described_class.new(:name => 'foo', :gid => 'foo')[:gid].should == 'foo'
     end
 
     describe "when testing whether in sync" do
       it "should return true if no 'should' values are set" do
         # this is currently not the case because gid has no default value, so we would never even
         # call insync? on that property
         if param = described_class.new(:name => 'foo').parameter(:gid)
           param.must be_safe_insync(500)
         end
       end
 
       it "should return true if any of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must be_safe_insync(500)
       end
 
       it "should return false if none of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must_not be_safe_insync(700)
       end
     end
 
     describe "when syncing" do
       it "should use the first found, specified group as the desired value and send it to the provider" do
         Puppet::Util.expects(:gid).with("foo").returns nil
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @provider = @provider_class.new(:name => 'foo')
         resource = described_class.new(:name => 'foo', :provider => @provider, :gid => [ 'foo', 'bar' ])
 
         @provider.expects(:gid=).with 500
         resource.parameter(:gid).sync
       end
     end
   end
 
   describe "when managing groups" do
     it "should support a singe group" do
       lambda { described_class.new(:name => 'foo', :groups => 'bar') }.should_not raise_error
     end
 
     it "should support multiple groups as an array" do
       lambda { described_class.new(:name => 'foo', :groups => [ 'bar' ]) }.should_not raise_error
       lambda { described_class.new(:name => 'foo', :groups => [ 'bar', 'baz' ]) }.should_not raise_error
     end
 
     it "should not support a comma separated list" do
       lambda { described_class.new(:name => 'foo', :groups => 'bar,baz') }.should raise_error(Puppet::Error, /Group names must be provided as an array/)
     end
 
     it "should not support an empty string" do
       lambda { described_class.new(:name => 'foo', :groups => '') }.should raise_error(Puppet::Error, /Group names must not be empty/)
     end
 
     describe "when testing is in sync" do
 
       before :each do
         # the useradd provider uses a single string to represent groups and so does Puppet::Property::List when converting to should values
         @provider = @provider_class.new(:name => 'foo', :groups => 'a,b,e,f')
       end
 
       it "should not care about order" do
         @property = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ]).property(:groups)
         @property.must be_safe_insync([ 'a', 'b', 'c' ])
         @property.must be_safe_insync([ 'a', 'c', 'b' ])
         @property.must be_safe_insync([ 'b', 'a', 'c' ])
         @property.must be_safe_insync([ 'b', 'c', 'a' ])
         @property.must be_safe_insync([ 'c', 'a', 'b' ])
         @property.must be_safe_insync([ 'c', 'b', 'a' ])
       end
 
       it "should merge current value and desired value if membership minimal" do
         @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
         @instance[:membership] = :minimum
         @instance[:groups].should == 'a,b,c,e,f'
       end
 
       it "should not treat a subset of groups insync if membership inclusive" do
         @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
         @instance[:membership] = :inclusive
         @instance[:groups].should == 'a,b,c'
       end
     end
   end
 
 
   describe "when managing expiry" do
     it "should fail if given an invalid date" do
       lambda { described_class.new(:name => 'foo', :expiry => "200-20-20") }.should raise_error(Puppet::Error, /Expiry dates must be YYYY-MM-DD/)
     end
   end
 
   describe "when managing minimum password age" do
     it "should accept a negative minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '-1') }.should_not raise_error
     end
 
     it "should fail with an empty minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '') }.should raise_error(Puppet::Error, /minimum age must be provided as a number/)
     end
   end
 
   describe "when managing maximum password age" do
     it "should accept a negative maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '-1') }.should_not raise_error
     end
 
     it "should fail with an empty maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '') }.should raise_error(Puppet::Error, /maximum age must be provided as a number/)
     end
   end
 
   describe "when managing passwords" do
     before do
       @password = described_class.new(:name => 'foo', :password => 'mypass').parameter(:password)
     end
 
     it "should not include the password in the change log when adding the password" do
       @password.change_to_s(:absent, "mypass").should_not be_include("mypass")
     end
 
     it "should not include the password in the change log when changing the password" do
       @password.change_to_s("other", "mypass").should_not be_include("mypass")
     end
 
     it "should redact the password when displaying the old value" do
       @password.is_to_s("currentpassword").should =~ /^\[old password hash redacted\]$/
     end
 
     it "should redact the password when displaying the new value" do
       @password.should_to_s("newpassword").should =~ /^\[new password hash redacted\]$/
     end
 
     it "should fail if a ':' is included in the password" do
       lambda { described_class.new(:name => 'foo', :password => "some:thing") }.should raise_error(Puppet::Error, /Passwords cannot include ':'/)
     end
 
     it "should allow the value to be set to :absent" do
       lambda { described_class.new(:name => 'foo', :password => :absent) }.should_not raise_error
     end
   end
 
   describe "when manages_solaris_rbac is enabled" do
     it "should support a :role value for ensure" do
       lambda { described_class.new(:name => 'foo', :ensure => :role) }.should_not raise_error
     end
   end
 
   describe "when user has roles" do
     it "should autorequire roles" do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
       config = Puppet::Resource::Catalog.new :testing do |conf|
         [testuser, testrole].each { |resource| conf.add_resource resource }
       end
       Puppet::Type::User::ProviderDirectoryservice.stubs(:get_macosx_version_major).returns "10.5"
 
       rel = testuser.autorequire[0]
       rel.source.ref.should == testrole.ref
       rel.target.ref.should == testuser.ref
     end
   end
 end