diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index 6556a249a..f3496a8fa 100755
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -1,523 +1,524 @@
 require 'etc'
 require 'facter'
 require 'puppet/property/list'
 require 'puppet/property/ordered_list'
 require 'puppet/property/keyvalue'
 
 module Puppet
   newtype(:user) do
     @doc = "Manage users.  This type is mostly built to manage system
       users, so it is lacking some features useful for managing normal
       users.
 
       This resource type uses the prescribed native tools for creating
       groups and generally uses POSIX APIs for retrieving information
       about them.  It does not directly modify `/etc/passwd` or anything.
 
       **Autorequires:** If Puppet is managing the user's primary group (as
       provided in the `gid` attribute), the user resource will autorequire
       that group. If Puppet is managing any role accounts corresponding to the
       user's roles, the user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
 
     feature :manages_homedir,
       "The provider can create and remove home directories."
 
     feature :manages_passwords,
       "The provider can modify user passwords, by accepting a password
       hash."
 
     feature :manages_password_age,
       "The provider can set age requirements and restrictions for
       passwords."
 
     feature :manages_solaris_rbac,
       "The provider can manage roles and normal users"
 
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
 
    feature :system_users,
      "The provider allows you to create system users with lower UIDs."
 
     feature :manages_aix_lam,
       "The provider can manage AIX Loadable Authentication Module (LAM) system."
 
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
       end
 
       newvalue(:absent, :event => :user_removed) do
         provider.delete
       end
 
       newvalue(:role, :event => :role_created, :required_features => :manages_solaris_rbac) do
         provider.create_role
       end
 
       desc "The basic state that the object should be in."
 
       # If they're talking about the thing at all, they generally want to
       # say it should exist.
       defaultto do
         if @resource.managed?
           :present
         else
           nil
         end
       end
 
       def retrieve
         if provider.exists?
           if provider.respond_to?(:is_role?) and provider.is_role?
             return :role
           else
             return :present
           end
         else
           return :absent
         end
       end
     end
 
     newproperty(:home) do
       desc "The home directory of the user.  The directory must be created
         separately and is not currently checked for existence."
     end
 
     newproperty(:uid) do
       desc "The user ID; must be specified numerically. If no user ID is
         specified when creating a new user, then one will be chosen
         automatically. This will likely result in the same user having
         different UIDs on different systems, which is not recommended. This is
         especially noteworthy when managing the same user on both Darwin and
         other platforms, since Puppet does UID generation on Darwin, but
         the underlying tools do so on other platforms.
 
         On Windows, this property is read-only and will return the user's
         security identifier (SID)."
 
       munge do |value|
         case value
         when String
           if value =~ /^[-0-9]+$/
             value = Integer(value)
           end
         end
 
         return value
       end
     end
 
     newproperty(:gid) do
       desc "The user's primary group.  Can be specified numerically or by name.
 
         Note that users on Windows systems do not have a primary group; manage groups
         with the `groups` attribute instead."
 
       munge do |value|
         if value.is_a?(String) and value =~ /^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
 
       def insync?(is)
         # We know the 'is' is a number, so we need to convert the 'should' to a number,
         # too.
         @should.each do |value|
           return true if number = Puppet::Util.gid(value) and is == number
         end
 
         false
       end
 
       def sync
         found = false
         @should.each do |value|
           if number = Puppet::Util.gid(value)
             provider.gid = number
             found = true
             break
           end
         end
 
         fail "Could not find group(s) #{@should.join(",")}" unless found
 
         # Use the default event.
       end
     end
 
     newproperty(:comment) do
       desc "A description of the user.  Generally the user's full name."
     end
 
     newproperty(:shell) do
       desc "The user's login shell.  The shell must exist and be
         executable.
 
         This attribute cannot be managed on Windows systems."
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
       desc %q{The user's password, in whatever encrypted format the local
         system requires.
 
         * Most modern Unix-like systems use salted SHA1 password hashes. You can use
           Puppet's built-in `sha1` function to generate a hash from a password.
         * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
         * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs [stdlib][]
           module contains a `str2saltedsha512` function which can generate password
           hashes for Lion.
         * Windows passwords can only be managed in cleartext, as there is no Windows API
           for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
         Be sure to enclose any value that includes a dollar sign ($) in single
         quotes (') to avoid accidental variable interpolation.}
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
       end
 
       def change_to_s(currentvalue, newvalue)
         if currentvalue == :absent
           return "created password"
         else
           return "changed password"
         end
       end
 
       def is_to_s( currentvalue )
         return '[old password hash redacted]'
       end
       def should_to_s( newvalue )
         return '[new password hash redacted]'
       end
 
     end
 
     newproperty(:password_min_age, :required_features => :manages_password_age) do
       desc "The minimum number of days a password must be used before it may be changed."
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password minimum age must be provided as a number."
         end
       end
     end
 
     newproperty(:password_max_age, :required_features => :manages_password_age) do
       desc "The maximum number of days a password may be used before it must be changed."
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password maximum age must be provided as a number."
         end
       end
     end
 
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups to which the user belongs.  The primary group should
         not be listed, and groups should be identified by name rather than by
         GID.  Multiple groups should be specified as an array."
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Group names must be provided, not GID numbers."
         end
         raise ArgumentError, "Group names must be provided as an array, not a comma-separated list." if value.include?(",")
+        raise ArgumentError, "Group names must not be empty. If you want to specify \"no groups\" pass an empty array" if value.empty?
       end
     end
 
     newparam(:name) do
       desc "The user name. While naming limitations vary by operating system,
         it is advisable to restrict names to the lowest common denominator,
         which is a maximum of 8 characters beginning with a letter.
 
         Note that Puppet considers user names to be case-sensitive, regardless
         of the platform's own rules; be sure to always use the same case when
         referring to a given user."
       isnamevar
     end
 
     newparam(:membership) do
       desc "Whether specified groups should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of groups to which
         the user belongs. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newparam(:system, :boolean => true) do
       desc "Whether the user is a system user, according to the OS's criteria;
       on most platforms, a UID less than or equal to 500 indicates a system
       user. Defaults to `false`."
 
       newvalues(:true, :false)
 
       defaultto false
     end
 
     newparam(:allowdupe, :boolean => true) do
       desc "Whether to allow duplicate UIDs. Defaults to `false`."
 
       newvalues(:true, :false)
 
       defaultto false
     end
 
     newparam(:managehome, :boolean => true) do
       desc "Whether to manage the home directory when managing the user.
         Defaults to `false`."
 
       newvalues(:true, :false)
 
       defaultto false
 
       validate do |val|
         if val.to_s == "true"
           raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" unless provider.class.manages_homedir?
         end
       end
     end
 
     newproperty(:expiry, :required_features => :manages_expiry) do
       desc "The expiry date for this user. Must be provided in
            a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19."
 
       validate do |value|
         if value !~ /^\d{4}-\d{2}-\d{2}$/
           raise ArgumentError, "Expiry dates must be YYYY-MM-DD"
         end
       end
     end
 
     # Autorequire the group, if it's around
     autorequire(:group) do
       autos = []
 
       if obj = @parameters[:gid] and groups = obj.shouldorig
         groups = groups.collect { |group|
           if group =~ /^\d+$/
             Integer(group)
           else
             group
           end
         }
         groups.each { |group|
           case group
           when Integer
             if resource = catalog.resources.find { |r| r.is_a?(Puppet::Type.type(:group)) and r.should(:gid) == group }
               autos << resource
             end
           else
             autos << group
           end
         }
       end
 
       if obj = @parameters[:groups] and groups = obj.should
         autos += groups.split(",")
       end
 
       autos
     end
 
     # Provide an external hook.  Yay breaking out of APIs.
     def exists?
       provider.exists?
     end
 
     def retrieve
       absent = false
       properties.inject({}) { |prophash, property|
         current_value = :absent
 
         if absent
           prophash[property] = :absent
         else
           current_value = property.retrieve
           prophash[property] = current_value
         end
 
         if property.name == :ensure and current_value == :absent
           absent = true
         end
         prophash
       }
     end
 
     newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
 
       def membership
         :role_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Role names must be provided, not numbers"
         end
         raise ArgumentError, "Role names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     #autorequire the roles that the user has
     autorequire(:user) do
       reqs = []
 
       if roles_property = @parameters[:roles] and roles = roles_property.should
         reqs += roles.split(',')
       end
 
       reqs
     end
 
     newparam(:role_membership) do
       desc "Whether specified roles should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of roles the user
         has. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:auths, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The auths the user has.  Multiple auths should be
         specified as an array."
 
       def membership
         :auth_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Auth names must be provided, not numbers"
         end
         raise ArgumentError, "Auth names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:auth_membership) do
       desc "Whether specified auths should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of auths the user
         has. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:profiles, :parent => Puppet::Property::OrderedList, :required_features => :manages_solaris_rbac) do
       desc "The profiles the user has.  Multiple profiles should be
         specified as an array."
 
       def membership
         :profile_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Profile names must be provided, not numbers"
         end
         raise ArgumentError, "Profile names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:profile_membership) do
       desc "Whether specified roles should be treated as the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of roles
         of which the user is a member. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:keys, :parent => Puppet::Property::KeyValue, :required_features => :manages_solaris_rbac) do
       desc "Specify user attributes in an array of key = value pairs."
 
       def membership
         :key_membership
       end
 
       validate do |value|
         raise ArgumentError, "Key/value pairs must be separated by an =" unless value.include?("=")
       end
     end
 
     newparam(:key_membership) do
       desc "Whether specified key/value pairs should be considered the
         **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
         the user's attributes. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:project, :required_features => :manages_solaris_rbac) do
       desc "The name of the project associated with a user."
     end
 
     newparam(:ia_load_module, :required_features => :manages_aix_lam) do
       desc "The name of the I&A module to use to manage this user."
     end
 
     newproperty(:attributes, :parent => Puppet::Property::KeyValue, :required_features => :manages_aix_lam) do
       desc "Specify AIX attributes for the user in an array of attribute = value pairs."
 
       def membership
         :attribute_membership
       end
 
       def delimiter
         " "
       end
 
       validate do |value|
         raise ArgumentError, "Attributes value pairs must be separated by an =" unless value.include?("=")
       end
     end
 
     newparam(:attribute_membership) do
       desc "Whether specified attribute value pairs should be treated as the
         **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
         attribute/value pairs for the user. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
 
   end
 end
diff --git a/spec/unit/type/user_spec.rb b/spec/unit/type/user_spec.rb
index 189807fc0..9f83e4eac 100755
--- a/spec/unit/type/user_spec.rb
+++ b/spec/unit/type/user_spec.rb
@@ -1,298 +1,348 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
       has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac
       mk_resource_methods
       def create; end
       def delete; end
       def exists?; get(:ensure) != :absent; end
       def flush; end
       def self.instances; []; end
     end
     described_class.stubs(:defaultprovider).returns @provider_class
   end
 
   it "should have a default provider inheriting from Puppet::Provider" do
     described_class.defaultprovider.ancestors.should be_include(Puppet::Provider)
   end
 
   it "should be able to create a instance" do
     described_class.new(:name => "foo").should_not be_nil
   end
 
   it "should have an allows_duplicates feature" do
     described_class.provider_feature(:allows_duplicates).should_not be_nil
   end
 
   it "should have an manages_homedir feature" do
     described_class.provider_feature(:manages_homedir).should_not be_nil
   end
 
   it "should have an manages_passwords feature" do
     described_class.provider_feature(:manages_passwords).should_not be_nil
   end
 
   it "should have a manages_solaris_rbac feature" do
     described_class.provider_feature(:manages_solaris_rbac).should_not be_nil
   end
 
   it "should have a manages_expiry feature" do
     described_class.provider_feature(:manages_expiry).should_not be_nil
   end
 
   it "should have a manages_password_age feature" do
     described_class.provider_feature(:manages_password_age).should_not be_nil
   end
 
   it "should have a system_users feature" do
     described_class.provider_feature(:system_users).should_not be_nil
   end
 
   describe "instances" do
     it "should have a valid provider" do
       described_class.new(:name => "foo").provider.class.ancestors.should be_include(Puppet::Provider)
     end
 
     it "should delegate existence questions to its provider" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       instance = described_class.new(:name => "foo", :provider => @provider)
       instance.exists?.should == false
 
       @provider.set(:ensure => :present)
       instance.exists?.should == true
     end
   end
 
   properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :password_min_age, :password_max_age, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
 
   properties.each do |property|
     it "should have a #{property} property" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property)
     end
 
     it "should have documentation for its #{property} property" do
       described_class.attrclass(property).doc.should be_instance_of(String)
     end
   end
 
   list_properties = [:groups, :roles, :auths]
 
   list_properties.each do |property|
     it "should have a list '#{property}'" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property::List)
     end
   end
 
   it "should have an ordered list 'profiles'" do
     described_class.attrclass(:profiles).ancestors.should be_include(Puppet::Property::OrderedList)
   end
 
   it "should have key values 'keys'" do
     described_class.attrclass(:keys).ancestors.should be_include(Puppet::Property::KeyValue)
   end
 
   describe "when retrieving all current values" do
     before do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present, :uid => 15, :gid => 15)
       @user = described_class.new(:name => "foo", :uid => 10, :provider => @provider)
     end
 
     it "should return a hash containing values for all set properties" do
       @user[:gid] = 10
       values = @user.retrieve
       [@user.property(:uid), @user.property(:gid)].each { |property| values.should be_include(property) }
     end
 
     it "should set all values to :absent if the user is absent" do
       @user.property(:ensure).expects(:retrieve).returns :absent
       @user.property(:uid).expects(:retrieve).never
       @user.retrieve[@user.property(:uid)].should == :absent
     end
 
     it "should include the result of retrieving each property's current value if the user is present" do
       @user.retrieve[@user.property(:uid)].should == 15
     end
   end
 
   describe "when managing the ensure property" do
     it "should support a :present value" do
       lambda { described_class.new(:name => 'foo', :ensure => :present) }.should_not raise_error
     end
 
     it "should support an :absent value" do
       lambda { described_class.new(:name => 'foo', :ensure => :absent) }.should_not raise_error
     end
 
     it "should call :create on the provider when asked to sync to the :present state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       @provider.expects(:create)
       described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).sync
     end
 
     it "should call :delete on the provider when asked to sync to the :absent state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present)
       @provider.expects(:delete)
       described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).sync
     end
 
     describe "and determining the current state" do
       it "should return :present when the provider indicates the user exists" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :present)
         described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).retrieve.should == :present
       end
 
       it "should return :absent when the provider indicates the user does not exist" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
         described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).retrieve.should == :absent
       end
     end
   end
 
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :uid => '50')[:uid].should == 50
     end
 
     it "should support UIDs as numbers" do
       described_class.new(:name => 'foo', :uid => 50)[:uid].should == 50
     end
 
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :uid => :absent)[:uid].should == :absent
     end
   end
 
   describe "when managing the gid" do
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :gid => :absent)[:gid].should == :absent
     end
 
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :gid => '50')[:gid].should == 50
     end
 
     it "should support GIDs specified as integers" do
       described_class.new(:name => 'foo', :gid => 50)[:gid].should == 50
     end
 
     it "should support groups specified by name" do
       described_class.new(:name => 'foo', :gid => 'foo')[:gid].should == 'foo'
     end
 
     describe "when testing whether in sync" do
       it "should return true if no 'should' values are set" do
         # this is currently not the case because gid has no default value, so we would never even
         # call insync? on that property
         if param = described_class.new(:name => 'foo').parameter(:gid)
           param.must be_safe_insync(500)
         end
       end
 
       it "should return true if any of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must be_safe_insync(500)
       end
 
       it "should return false if none of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must_not be_safe_insync(700)
       end
     end
 
     describe "when syncing" do
       it "should use the first found, specified group as the desired value and send it to the provider" do
         Puppet::Util.expects(:gid).with("foo").returns nil
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @provider = @provider_class.new(:name => 'foo')
         resource = described_class.new(:name => 'foo', :provider => @provider, :gid => [ 'foo', 'bar' ])
 
         @provider.expects(:gid=).with 500
         resource.parameter(:gid).sync
       end
     end
   end
 
+  describe "when managing groups" do
+    it "should support a singe group" do
+      lambda { described_class.new(:name => 'foo', :groups => 'bar') }.should_not raise_error
+    end
+
+    it "should support multiple groups as an array" do
+      lambda { described_class.new(:name => 'foo', :groups => [ 'bar' ]) }.should_not raise_error
+      lambda { described_class.new(:name => 'foo', :groups => [ 'bar', 'baz' ]) }.should_not raise_error
+    end
+
+    it "should not support a comma separated list" do
+      lambda { described_class.new(:name => 'foo', :groups => 'bar,baz') }.should raise_error(Puppet::Error, /Group names must be provided as an array/)
+    end
+
+    it "should not support an empty string" do
+      lambda { described_class.new(:name => 'foo', :groups => '') }.should raise_error(Puppet::Error, /Group names must not be empty/)
+    end
+
+    describe "when testing is in sync" do
+
+      before :each do
+        # the useradd provider uses a single string to represent groups and so does Puppet::Property::List when converting to should values
+        @provider = @provider_class.new(:name => 'foo', :groups => 'a,b,e,f')
+      end
+
+      it "should not care about order" do
+        @property = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ]).property(:groups)
+        @property.must be_safe_insync([ 'a', 'b', 'c' ])
+        @property.must be_safe_insync([ 'a', 'c', 'b' ])
+        @property.must be_safe_insync([ 'b', 'a', 'c' ])
+        @property.must be_safe_insync([ 'b', 'c', 'a' ])
+        @property.must be_safe_insync([ 'c', 'a', 'b' ])
+        @property.must be_safe_insync([ 'c', 'b', 'a' ])
+      end
+
+      it "should merge current value and desired value if membership minimal" do
+        @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
+        @instance[:membership] = :minimum
+        @instance[:groups].should == 'a,b,c,e,f'
+      end
+
+      it "should not treat a subset of groups insync if membership inclusive" do
+        @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
+        @instance[:membership] = :inclusive
+        @instance[:groups].should == 'a,b,c'
+      end
+    end
+  end
+
+
   describe "when managing expiry" do
     it "should fail if given an invalid date" do
       lambda { described_class.new(:name => 'foo', :expiry => "200-20-20") }.should raise_error(Puppet::Error, /Expiry dates must be YYYY-MM-DD/)
     end
   end
 
   describe "when managing minimum password age" do
     it "should accept a negative minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '-1') }.should_not raise_error
     end
 
     it "should fail with an empty minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '') }.should raise_error(Puppet::Error, /minimum age must be provided as a number/)
     end
   end
 
   describe "when managing maximum password age" do
     it "should accept a negative maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '-1') }.should_not raise_error
     end
 
     it "should fail with an empty maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '') }.should raise_error(Puppet::Error, /maximum age must be provided as a number/)
     end
   end
 
   describe "when managing passwords" do
     before do
       @password = described_class.new(:name => 'foo', :password => 'mypass').parameter(:password)
     end
 
     it "should not include the password in the change log when adding the password" do
       @password.change_to_s(:absent, "mypass").should_not be_include("mypass")
     end
 
     it "should not include the password in the change log when changing the password" do
       @password.change_to_s("other", "mypass").should_not be_include("mypass")
     end
 
     it "should redact the password when displaying the old value" do
       @password.is_to_s("currentpassword").should =~ /^\[old password hash redacted\]$/
     end
 
     it "should redact the password when displaying the new value" do
       @password.should_to_s("newpassword").should =~ /^\[new password hash redacted\]$/
     end
 
     it "should fail if a ':' is included in the password" do
       lambda { described_class.new(:name => 'foo', :password => "some:thing") }.should raise_error(Puppet::Error, /Passwords cannot include ':'/)
     end
 
     it "should allow the value to be set to :absent" do
       lambda { described_class.new(:name => 'foo', :password => :absent) }.should_not raise_error
     end
   end
 
   describe "when manages_solaris_rbac is enabled" do
     it "should support a :role value for ensure" do
       lambda { described_class.new(:name => 'foo', :ensure => :role) }.should_not raise_error
     end
   end
 
   describe "when user has roles" do
     it "should autorequire roles" do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
       config = Puppet::Resource::Catalog.new :testing do |conf|
         [testuser, testrole].each { |resource| conf.add_resource resource }
       end
       Puppet::Type::User::ProviderDirectoryservice.stubs(:get_macosx_version_major).returns "10.5"
 
       rel = testuser.autorequire[0]
       rel.source.ref.should == testrole.ref
       rel.target.ref.should == testuser.ref
     end
   end
 end