diff --git a/spec/fixtures/unit/type/user/authorized_keys b/spec/fixtures/unit/type/user/authorized_keys
index dd1807e56..d58c62008 100644
--- a/spec/fixtures/unit/type/user/authorized_keys
+++ b/spec/fixtures/unit/type/user/authorized_keys
@@ -1,5 +1,6 @@
 # fixture for testing ssh key purging
 
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTXvM7AslzjNUYrPLiNVBsF5VnqL2RmqrkzscdVdHzVxvieNwmLGeUkg8EfXPiz7j5F/Lr0J8oItTCWzyN2KmM+DhUMjvP4AbELO/VYbnVrZICRiUNYSO3EN9/uapKAuiev88d7ynbonCU0VZoTPg/ug4OondOrLCtcGri5ltF+mausGfAYiFAQVEWqXV+1tyejoawJ884etb3n4ilpsrH9JK6AtOkEWVD3TDrNi29O1mQQ/Cn88g472zAJ+DhsIn+iehtfX5nmOtDNN/1t1bGMIBzkSYEAYwUiRJbRXvbobT7qKZQPA3dh0m8AYQS5/hd4/c4pmlxL8kgr24SnBY5 key1 name
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTXvM7AslzjNUYrPLiNVBsF5VnqL2RmqrkzscdVdHzVxvieNwmLGeUkg8EfXPiz7j5F/Lr0J8oItTCWzyN2KmM+DhUMjvP4AbELO/VYbnVrZICRiUNYSO3EN9/uapKAuiev88d7ynbonCU0VZoTPg/ug4OondOrLCtcGri5ltF+mausGfAYiFAQVEWqXV+1tyejoawJ884etb3n4ilpsrH9JK6AtOkEWVD3TDrNi29O1mQQ/Cn88g472zAJ+DhsIn+iehtfX5nmOtDNN/1t1bGMIBzkSYEAYwUiRJbRXvbobT7qKZQPA3dh0m8AYQS5/hd4/c4pmlxL8kgr24SnBY5 keyname2
 #ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTXvM7AslzjNUYrPLiNVBsF5VnqL2RmqrkzscdVdHzVxvieNwmLGeUkg8EfXPiz7j5F/Lr0J8oItTCWzyN2KmM+DhUMjvP4AbELO/VYbnVrZICRiUNYSO3EN9/uapKAuiev88d7ynbonCU0VZoTPg/ug4OondOrLCtcGri5ltF+mausGfAYiFAQVEWqXV+1tyejoawJ884etb3n4ilpsrH9JK6AtOkEWVD3TDrNi29O1mQQ/Cn88g472zAJ+DhsIn+iehtfX5nmOtDNN/1t1bGMIBzkSYEAYwUiRJbRXvbobT7qKZQPA3dh0m8AYQS5/hd4/c4pmlxL8kgr24SnBY5 keyname3
+ssh-rsa KEY-WITH-NO-NAME
diff --git a/spec/unit/provider/ssh_authorized_key/parsed_spec.rb b/spec/unit/provider/ssh_authorized_key/parsed_spec.rb
index 2e88c57df..78abec901 100755
--- a/spec/unit/provider/ssh_authorized_key/parsed_spec.rb
+++ b/spec/unit/provider/ssh_authorized_key/parsed_spec.rb
@@ -1,261 +1,276 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'shared_behaviours/all_parsedfile_providers'
 require 'puppet_spec/files'
 
 provider_class = Puppet::Type.type(:ssh_authorized_key).provider(:parsed)
 
 describe provider_class, :unless => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   before :each do
     @keyfile = tmpfile('authorized_keys')
     @provider_class = provider_class
     @provider_class.initvars
     @provider_class.any_instance.stubs(:target).returns @keyfile
     @user = 'random_bob'
     Puppet::Util.stubs(:uid).with(@user).returns 12345
   end
 
   def mkkey(args)
     args[:target] = @keyfile
     args[:user]   = @user
     resource = Puppet::Type.type(:ssh_authorized_key).new(args)
     key = @provider_class.new(resource)
     args.each do |p,v|
       key.send(p.to_s + "=", v)
     end
     key
   end
 
   def genkey(key)
     @provider_class.stubs(:filetype).returns(Puppet::Util::FileType::FileTypeRam)
     File.stubs(:chown)
     File.stubs(:chmod)
     Puppet::Util::SUIDManager.stubs(:asuser).yields
     key.flush
     @provider_class.target_object(@keyfile).read
   end
 
   it_should_behave_like "all parsedfile providers", provider_class
 
   it "should be able to generate a basic authorized_keys file" do
 
     key = mkkey(:name    => "Just_Testing",
                 :key     => "AAAAfsfddsjldjgksdflgkjsfdlgkj",
                 :type    => "ssh-dss",
                 :ensure  => :present,
                 :options => [:absent]
               )
 
     genkey(key).should == "ssh-dss AAAAfsfddsjldjgksdflgkjsfdlgkj Just_Testing\n"
   end
 
   it "should be able to generate an authorized_keys file with options" do
 
     key = mkkey(:name    => "root@localhost",
                 :key     => "AAAAfsfddsjldjgksdflgkjsfdlgkj",
                 :type    => "ssh-rsa",
                 :ensure  => :present,
                 :options => ['from="192.168.1.1"', "no-pty", "no-X11-forwarding"]
                 )
 
     genkey(key).should == "from=\"192.168.1.1\",no-pty,no-X11-forwarding ssh-rsa AAAAfsfddsjldjgksdflgkjsfdlgkj root@localhost\n"
   end
 
   it "should parse comments" do
     result = [{ :record_type => :comment, :line => "# hello" }]
     @provider_class.parse("# hello\n").should == result
   end
 
   it "should parse comments with leading whitespace" do
     result = [{ :record_type => :comment, :line => "  # hello" }]
     @provider_class.parse("  # hello\n").should == result
   end
 
   it "should skip over lines with only whitespace" do
     result = [{ :record_type => :comment, :line => "#before" },
               { :record_type => :blank,   :line => "  " },
               { :record_type => :comment, :line => "#after" }]
     @provider_class.parse("#before\n  \n#after\n").should == result
   end
 
   it "should skip over completely empty lines" do
     result = [{ :record_type => :comment, :line => "#before"},
               { :record_type => :blank,   :line => ""},
               { :record_type => :comment, :line => "#after"}]
     @provider_class.parse("#before\n\n#after\n").should == result
   end
 
   it "should be able to parse name if it includes whitespace" do
     @provider_class.parse_line('ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC7pHZ1XRj3tXbFpPFhMGU1bVwz7jr13zt/wuE+pVIJA8GlmHYuYtIxHPfDHlkixdwLachCpSQUL9NbYkkRFRn9m6PZ7125ohE4E4m96QS6SGSQowTiRn4Lzd9LV38g93EMHjPmEkdSq7MY4uJEd6DUYsLvaDYdIgBiLBIWPA3OrQ== fancy user')[:name].should == 'fancy user'
     @provider_class.parse_line('from="host1.reductlivelabs.com,host.reductivelabs.com",command="/usr/local/bin/run",ssh-pty ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC7pHZ1XRj3tXbFpPFhMGU1bVwz7jr13zt/wuE+pVIJA8GlmHYuYtIxHPfDHlkixdwLachCpSQUL9NbYkkRFRn9m6PZ7125ohE4E4m96QS6SGSQowTiRn4Lzd9LV38g93EMHjPmEkdSq7MY4uJEd6DUYsLvaDYdIgBiLBIWPA3OrQ== fancy user')[:name].should == 'fancy user'
   end
 
   it "should be able to parse options containing commas via its parse_options method" do
     options = %w{from="host1.reductlivelabs.com,host.reductivelabs.com" command="/usr/local/bin/run" ssh-pty}
     optionstr = options.join(", ")
 
     @provider_class.parse_options(optionstr).should == options
   end
 
   it "should parse quoted options" do
     line = 'command="/usr/local/bin/mybin \"$SSH_ORIGINAL_COMMAND\"" ssh-rsa xxx mykey'
 
     @provider_class.parse(line)[0][:options][0].should == 'command="/usr/local/bin/mybin \"$SSH_ORIGINAL_COMMAND\""'
   end
 
   it "should use '' as name for entries that lack a comment" do
     line = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAut8aOSxenjOqF527dlsdHWV4MNoAsX14l9M297+SQXaQ5Z3BedIxZaoQthkDALlV/25A1COELrg9J2MqJNQc8Xe9XQOIkBQWWinUlD/BXwoOTWEy8C8zSZPHZ3getMMNhGTBO+q/O+qiJx3y5cA4MTbw2zSxukfWC87qWwcZ64UUlegIM056vPsdZWFclS9hsROVEa57YUMrehQ1EGxT4Z5j6zIopufGFiAPjZigq/vqgcAqhAKP6yu4/gwO6S9tatBeEjZ8fafvj1pmvvIplZeMr96gHE7xS3pEEQqnB3nd4RY7AF6j9kFixnsytAUO7STPh/M3pLiVQBN89TvWPQ=="
 
     @provider_class.parse(line)[0][:name].should == ""
   end
 
   {
     # ssh-keygen -t dsa -b 1024
     'ssh-dss' => 'AAAAB3NzaC1kc3MAAACBANGTefWMXS780qLMMgysq3GNMKzg55LXZODif6Tqv1vtTh4Wuk3J5X5u644jTyNdAIn1RiBI9MnwnZMZ6nXKvucMcMQWMibYS9W2MhkRj3oqsLWMMsdGXJL18SWM5A6oC3oIRC4JHJZtkm0OctR2trKxmX+MGhdCd+Xpsh9CNK8XAAAAFQD4olFiwv+QQUFdaZbWUy1CLEG9xQAAAIByCkXKgoriZF8bQ0OX1sKuR69M/6n5ngmQGVBKB7BQkpUjbK/OggB6iJgst5utKkDcaqYRnrTYG9q3jJ/flv7yYePuoSreS0nCMMx9gpEYuq+7Sljg9IecmN/IHrNd9qdYoASy5iuROQMvEZM7KFHA8vBv0tWdBOsp4hZKyiL1DAAAAIEAjkZlOps9L+cD/MTzxDj7toYYypdLOvjlcPBaglkPZoFZ0MAKTI0zXlVX1cWAnkd0Yfo4EpP+6XAjlZkod+QXKXM4Tb4PnR34ASMeU6sEjM61Na24S7JD3gpPKataFU/oH3hzXsBdK2ttKYmoqvf61h32IA/3Z5PjCCD9pPLPpAY',
     # ssh-keygen -t rsa -b 2048
     'ssh-rsa' => 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDYtEaWa1mlxaAh9vtiz6RCVKDiJHDY15nsqqWU7F7A1+U1498+sWDyRDkZ8vXWQpzyOMBzBSHIxhsprlKhkjomy8BuJP+bHDBIKx4zgSFDrklrPIf467Iuug8J0qqDLxO4rOOjeAiLEyC0t2ZGnsTEea+rmat0bJ2cv3g5L4gH/OFz2pI4ZLp1HGN83ipl5UH8CjXQKwo3Db1E3WJCqKgszVX0Z4/qjnBRxFMoqky/1mGb/mX1eoT9JyQ8OhU9uENZOShkksSpgUqjlrjpj0Yd14hBlnE3M18pE4ivxjzectA/XRKNZaxOL1YREtU8sXusAwmlEY4aJ64aR0JrXfgx',
     # ssh-keygen -t ecdsa -b 256
     'ecdsa-sha2-nistp256' => 'AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBO5PfBf0c2jAuqD+Lj3j+SuXOXNT2uqESLVOn5jVQfEF9GzllOw+CMOpUvV1CiOOn+F1ET15vcsfmD7z05WUTA=',
     # ssh-keygen -t ecdsa -b 384
     'ecdsa-sha2-nistp384' => 'AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJIfxNoVK4FX3RuMlkHOwwxXwAh6Fqx5uAp4ftXrJ+64qYuIzb+/zSAkJV698Sre1b1lb0G4LyDdVAvXwaYK9kN25vy8umV3WdfZeHKXJGCcrplMCbbOERWARlpiPNEblg==',
     # ssh-keygen -t ecdsa -b 521
     'ecdsa-sha2-nistp521' => 'AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBADLK+u12xwB0JOwpmaxYXv8KnPK4p+SE2405qoo+vpAQ569fMwPMgKzltd770amdeuFogw/MJu17PN9LDdrD3o0uwHMjWee6TpHQDkuEetaxiou6K0WAzgbxx9QsY0MsJgXf1BuMLqdK+xT183wOSXwwumv99G7T32dOJZ5tYrH0y4XMw==',
     # ssh-keygen -t ed25519
     'ssh-ed25519' => 'AAAAC3NzaC1lZDI1NTE5AAAAIBWvu7D1KHBPaNXQcEuBsp48+JyPelXAq8ds6K5Du9gd',
   }.each_pair do |keytype, keydata|
     it "should be able to parse a #{keytype} key entry" do
       comment = 'sample_key'
 
       record = @provider_class.parse_line("#{keytype} #{keydata} #{comment}")
       record.should_not be_nil
       record[:name].should == comment
       record[:key].should == keydata
       record[:type].should == keytype
     end
   end
 
+  describe "prefetch_hook" do
+    let(:path) { '/path/to/keyfile' }
+    let(:input) do
+      { :type        => 'rsa',
+        :key         => 'KEYDATA',
+        :name        => '',
+        :record_type => :parsed,
+        :target      => path,
+      }
+    end
+    it "adds an indexed name to unnamed resources" do
+      @provider_class.prefetch_hook([input])[0][:name].should =~ /^#{path}:unnamed-\d+/
+    end
+  end
+
 end
 
 describe provider_class, :unless => Puppet.features.microsoft_windows? do
   before :each do
     @resource = Puppet::Type.type(:ssh_authorized_key).new(:name => "foo", :user => "random_bob")
 
     @provider = provider_class.new(@resource)
     provider_class.stubs(:filetype).returns(Puppet::Util::FileType::FileTypeRam)
     Puppet::Util::SUIDManager.stubs(:asuser).yields
 
     provider_class.initvars
   end
 
   describe "when flushing" do
     before :each do
       # Stub file and directory operations
       Dir.stubs(:mkdir)
       File.stubs(:chmod)
       File.stubs(:chown)
     end
 
     describe "and both a user and a target have been specified" do
       before :each do
         Puppet::Util.stubs(:uid).with("random_bob").returns 12345
         @resource[:user] = "random_bob"
         target = "/tmp/.ssh_dir/place_to_put_authorized_keys"
         @resource[:target] = target
       end
 
       it "should create the directory" do
         Puppet::FileSystem.stubs(:exist?).with("/tmp/.ssh_dir").returns false
         Dir.expects(:mkdir).with("/tmp/.ssh_dir", 0700)
         @provider.flush
       end
 
       it "should absolutely not chown the directory to the user" do
         uid = Puppet::Util.uid("random_bob")
         File.expects(:chown).never
         @provider.flush
       end
 
       it "should absolutely not chown the key file to the user" do
         uid = Puppet::Util.uid("random_bob")
         File.expects(:chown).never
         @provider.flush
       end
 
       it "should chmod the key file to 0600" do
         File.expects(:chmod).with(0600, "/tmp/.ssh_dir/place_to_put_authorized_keys")
         @provider.flush
       end
     end
 
     describe "and a user has been specified with no target" do
       before :each do
         @resource[:user] = "nobody"
         #
         # I'd like to use random_bob here and something like
         #
         #    File.stubs(:expand_path).with("~random_bob/.ssh").returns "/users/r/random_bob/.ssh"
         #
         # but mocha objects strenuously to stubbing File.expand_path
         # so I'm left with using nobody.
         @dir = File.expand_path("~nobody/.ssh")
       end
 
       it "should create the directory if it doesn't exist" do
         Puppet::FileSystem.stubs(:exist?).with(@dir).returns false
         Dir.expects(:mkdir).with(@dir,0700)
         @provider.flush
       end
 
       it "should not create or chown the directory if it already exist" do
         Puppet::FileSystem.stubs(:exist?).with(@dir).returns false
         Dir.expects(:mkdir).never
         @provider.flush
       end
 
       it "should absolutely not chown the directory to the user if it creates it" do
         Puppet::FileSystem.stubs(:exist?).with(@dir).returns false
         Dir.stubs(:mkdir).with(@dir,0700)
         uid = Puppet::Util.uid("nobody")
         File.expects(:chown).never
         @provider.flush
       end
 
       it "should not create or chown the directory if it already exist" do
         Puppet::FileSystem.stubs(:exist?).with(@dir).returns false
         Dir.expects(:mkdir).never
         File.expects(:chown).never
         @provider.flush
       end
 
       it "should absolutely not chown the key file to the user" do
         uid = Puppet::Util.uid("nobody")
         File.expects(:chown).never
         @provider.flush
       end
 
       it "should chmod the key file to 0600" do
         File.expects(:chmod).with(0600, File.expand_path("~nobody/.ssh/authorized_keys"))
         @provider.flush
       end
     end
 
     describe "and a target has been specified with no user" do
       it "should raise an error" do
         @resource = Puppet::Type.type(:ssh_authorized_key).new(:name => "foo", :target => "/tmp/.ssh_dir/place_to_put_authorized_keys")
         @provider = provider_class.new(@resource)
 
         proc { @provider.flush }.should raise_error
       end
     end
 
     describe "and an invalid user has been specified with no target" do
       it "should catch an exception and raise a Puppet error" do
         @resource[:user] = "thisusershouldnotexist"
 
         lambda { @provider.flush }.should raise_error(Puppet::Error)
       end
     end
   end
 end
diff --git a/spec/unit/type/user_spec.rb b/spec/unit/type/user_spec.rb
index f5a351752..974054309 100755
--- a/spec/unit/type/user_spec.rb
+++ b/spec/unit/type/user_spec.rb
@@ -1,514 +1,519 @@
 #! /usr/bin/env ruby
 # encoding: UTF-8
 require 'spec_helper'
 
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
       has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_shell
       mk_resource_methods
       def create; end
       def delete; end
       def exists?; get(:ensure) != :absent; end
       def flush; end
       def self.instances; []; end
     end
     described_class.stubs(:defaultprovider).returns @provider_class
   end
 
   it "should be able to create an instance" do
     described_class.new(:name => "foo").should_not be_nil
   end
 
   it "should have an allows_duplicates feature" do
     described_class.provider_feature(:allows_duplicates).should_not be_nil
   end
 
   it "should have a manages_homedir feature" do
     described_class.provider_feature(:manages_homedir).should_not be_nil
   end
 
   it "should have a manages_passwords feature" do
     described_class.provider_feature(:manages_passwords).should_not be_nil
   end
 
   it "should have a manages_solaris_rbac feature" do
     described_class.provider_feature(:manages_solaris_rbac).should_not be_nil
   end
 
   it "should have a manages_expiry feature" do
     described_class.provider_feature(:manages_expiry).should_not be_nil
   end
 
   it "should have a manages_password_age feature" do
     described_class.provider_feature(:manages_password_age).should_not be_nil
   end
 
   it "should have a system_users feature" do
     described_class.provider_feature(:system_users).should_not be_nil
   end
 
   it "should have a manages_shell feature" do
     described_class.provider_feature(:manages_shell).should_not be_nil
   end
 
   describe :managehome do
     let (:provider) { @provider_class.new(:name => 'foo', :ensure => :absent) }
     let (:instance) { described_class.new(:name => 'foo', :provider => provider) }
 
     it "defaults to false" do
       instance[:managehome].should be_false
     end
 
     it "can be set to false" do
       instance[:managehome] = 'false'
     end
 
     it "cannot be set to true for a provider that does not manage homedirs" do
       provider.class.stubs(:manages_homedir?).returns false
       expect { instance[:managehome] = 'yes' }.to raise_error(Puppet::Error, /can not manage home directories/)
     end
 
     it "can be set to true for a provider that does manage homedirs" do
       provider.class.stubs(:manages_homedir?).returns true
       instance[:managehome] = 'yes'
     end
   end
 
   describe "instances" do
     it "should delegate existence questions to its provider" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       instance = described_class.new(:name => "foo", :provider => @provider)
       instance.exists?.should == false
 
       @provider.set(:ensure => :present)
       instance.exists?.should == true
     end
   end
 
   properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :password_min_age, :password_max_age, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
 
   properties.each do |property|
     it "should have a #{property} property" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property)
     end
 
     it "should have documentation for its #{property} property" do
       described_class.attrclass(property).doc.should be_instance_of(String)
     end
   end
 
   list_properties = [:groups, :roles, :auths]
 
   list_properties.each do |property|
     it "should have a list '#{property}'" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property::List)
     end
   end
 
   it "should have an ordered list 'profiles'" do
     described_class.attrclass(:profiles).ancestors.should be_include(Puppet::Property::OrderedList)
   end
 
   it "should have key values 'keys'" do
     described_class.attrclass(:keys).ancestors.should be_include(Puppet::Property::KeyValue)
   end
 
   describe "when retrieving all current values" do
     before do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present, :uid => 15, :gid => 15)
       @user = described_class.new(:name => "foo", :uid => 10, :provider => @provider)
     end
 
     it "should return a hash containing values for all set properties" do
       @user[:gid] = 10
       values = @user.retrieve
       [@user.property(:uid), @user.property(:gid)].each { |property| values.should be_include(property) }
     end
 
     it "should set all values to :absent if the user is absent" do
       @user.property(:ensure).expects(:retrieve).returns :absent
       @user.property(:uid).expects(:retrieve).never
       @user.retrieve[@user.property(:uid)].should == :absent
     end
 
     it "should include the result of retrieving each property's current value if the user is present" do
       @user.retrieve[@user.property(:uid)].should == 15
     end
   end
 
   describe "when managing the ensure property" do
     it "should support a :present value" do
       expect { described_class.new(:name => 'foo', :ensure => :present) }.to_not raise_error
     end
 
     it "should support an :absent value" do
       expect { described_class.new(:name => 'foo', :ensure => :absent) }.to_not raise_error
     end
 
     it "should call :create on the provider when asked to sync to the :present state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       @provider.expects(:create)
       described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).sync
     end
 
     it "should call :delete on the provider when asked to sync to the :absent state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present)
       @provider.expects(:delete)
       described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).sync
     end
 
     describe "and determining the current state" do
       it "should return :present when the provider indicates the user exists" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :present)
         described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).retrieve.should == :present
       end
 
       it "should return :absent when the provider indicates the user does not exist" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
         described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).retrieve.should == :absent
       end
     end
   end
 
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :uid => '50')[:uid].should == 50
     end
 
     it "should support UIDs as numbers" do
       described_class.new(:name => 'foo', :uid => 50)[:uid].should == 50
     end
 
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :uid => :absent)[:uid].should == :absent
     end
   end
 
   describe "when managing the gid" do
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :gid => :absent)[:gid].should == :absent
     end
 
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :gid => '50')[:gid].should == 50
     end
 
     it "should support GIDs specified as integers" do
       described_class.new(:name => 'foo', :gid => 50)[:gid].should == 50
     end
 
     it "should support groups specified by name" do
       described_class.new(:name => 'foo', :gid => 'foo')[:gid].should == 'foo'
     end
 
     describe "when testing whether in sync" do
       it "should return true if no 'should' values are set" do
         # this is currently not the case because gid has no default value, so we would never even
         # call insync? on that property
         if param = described_class.new(:name => 'foo').parameter(:gid)
           param.must be_safe_insync(500)
         end
       end
 
       it "should return true if any of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must be_safe_insync(500)
       end
 
       it "should return false if none of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must_not be_safe_insync(700)
       end
     end
 
     describe "when syncing" do
       it "should use the first found, specified group as the desired value and send it to the provider" do
         Puppet::Util.expects(:gid).with("foo").returns nil
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @provider = @provider_class.new(:name => 'foo')
         resource = described_class.new(:name => 'foo', :provider => @provider, :gid => [ 'foo', 'bar' ])
 
         @provider.expects(:gid=).with 500
         resource.parameter(:gid).sync
       end
     end
   end
 
   describe "when managing groups" do
     it "should support a singe group" do
       expect { described_class.new(:name => 'foo', :groups => 'bar') }.to_not raise_error
     end
 
     it "should support multiple groups as an array" do
       expect { described_class.new(:name => 'foo', :groups => [ 'bar' ]) }.to_not raise_error
       expect { described_class.new(:name => 'foo', :groups => [ 'bar', 'baz' ]) }.to_not raise_error
     end
 
     it "should not support a comma separated list" do
       expect { described_class.new(:name => 'foo', :groups => 'bar,baz') }.to raise_error(Puppet::Error, /Group names must be provided as an array/)
     end
 
     it "should not support an empty string" do
       expect { described_class.new(:name => 'foo', :groups => '') }.to raise_error(Puppet::Error, /Group names must not be empty/)
     end
 
     describe "when testing is in sync" do
 
       before :each do
         # the useradd provider uses a single string to represent groups and so does Puppet::Property::List when converting to should values
         @provider = @provider_class.new(:name => 'foo', :groups => 'a,b,e,f')
       end
 
       it "should not care about order" do
         @property = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ]).property(:groups)
         @property.must be_safe_insync([ 'a', 'b', 'c' ])
         @property.must be_safe_insync([ 'a', 'c', 'b' ])
         @property.must be_safe_insync([ 'b', 'a', 'c' ])
         @property.must be_safe_insync([ 'b', 'c', 'a' ])
         @property.must be_safe_insync([ 'c', 'a', 'b' ])
         @property.must be_safe_insync([ 'c', 'b', 'a' ])
       end
 
       it "should merge current value and desired value if membership minimal" do
         @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
         @instance[:membership] = :minimum
         @instance[:groups].should == 'a,b,c,e,f'
       end
 
       it "should not treat a subset of groups insync if membership inclusive" do
         @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
         @instance[:membership] = :inclusive
         @instance[:groups].should == 'a,b,c'
       end
     end
   end
 
 
   describe "when managing expiry" do
     it "should fail if given an invalid date" do
       expect { described_class.new(:name => 'foo', :expiry => "200-20-20") }.to raise_error(Puppet::Error, /Expiry dates must be YYYY-MM-DD/)
     end
   end
 
   describe "when managing minimum password age" do
     it "should accept a negative minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '-1') }.to_not raise_error
     end
 
     it "should fail with an empty minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '') }.to raise_error(Puppet::Error, /minimum age must be provided as a number/)
     end
   end
 
   describe "when managing maximum password age" do
     it "should accept a negative maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '-1') }.to_not raise_error
     end
 
     it "should fail with an empty maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '') }.to raise_error(Puppet::Error, /maximum age must be provided as a number/)
     end
   end
 
   describe "when managing passwords" do
     before do
       @password = described_class.new(:name => 'foo', :password => 'mypass').parameter(:password)
     end
 
     it "should not include the password in the change log when adding the password" do
       @password.change_to_s(:absent, "mypass").should_not be_include("mypass")
     end
 
     it "should not include the password in the change log when changing the password" do
       @password.change_to_s("other", "mypass").should_not be_include("mypass")
     end
 
     it "should redact the password when displaying the old value" do
       @password.is_to_s("currentpassword").should =~ /^\[old password hash redacted\]$/
     end
 
     it "should redact the password when displaying the new value" do
       @password.should_to_s("newpassword").should =~ /^\[new password hash redacted\]$/
     end
 
     it "should fail if a ':' is included in the password" do
       expect { described_class.new(:name => 'foo', :password => "some:thing") }.to raise_error(Puppet::Error, /Passwords cannot include ':'/)
     end
 
     it "should allow the value to be set to :absent" do
       expect { described_class.new(:name => 'foo', :password => :absent) }.to_not raise_error
     end
   end
 
   describe "when managing comment on Ruby 1.9", :if => String.method_defined?(:encode) do
     it "should force value encoding to ASCII-8BIT" do
       value = 'abcd™'
       value.encoding.should == Encoding::UTF_8
       user = described_class.new(:name => 'foo', :comment => value)
       user[:comment].encoding.should == Encoding::ASCII_8BIT
       user[:comment].should == value.force_encoding(Encoding::ASCII_8BIT)
     end
   end
 
   describe "when manages_solaris_rbac is enabled" do
     it "should support a :role value for ensure" do
       expect { described_class.new(:name => 'foo', :ensure => :role) }.to_not raise_error
     end
   end
 
   describe "when user has roles" do
     it "should autorequire roles" do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
       config = Puppet::Resource::Catalog.new :testing do |conf|
         [testuser, testrole].each { |resource| conf.add_resource resource }
       end
       Puppet::Type::User::ProviderDirectoryservice.stubs(:get_macosx_version_major).returns "10.5"
 
       rel = testuser.autorequire[0]
       rel.source.ref.should == testrole.ref
       rel.target.ref.should == testuser.ref
     end
   end
 
   describe "when setting shell" do
     before :each do
       @shell_provider_class = described_class.provide(:shell_manager) do
         has_features :manages_shell
         mk_resource_methods
         def create; check_valid_shell;end
         def shell=(value); check_valid_shell; end
         def delete; end
         def exists?; get(:ensure) != :absent; end
         def flush; end
         def self.instances; []; end
         def check_valid_shell; end
       end
 
       described_class.stubs(:defaultprovider).returns @shell_provider_class
     end
 
     it "should call :check_valid_shell on the provider when changing shell value" do
       @provider = @shell_provider_class.new(:name => 'foo', :shell => '/bin/bash', :ensure => :present)
       @provider.expects(:check_valid_shell)
       resource = described_class.new(:name => 'foo', :shell => '/bin/zsh', :provider => @provider)
       Puppet::Util::Storage.stubs(:load)
       Puppet::Util::Storage.stubs(:store)
       catalog = Puppet::Resource::Catalog.new
       catalog.add_resource resource
       catalog.apply
     end
 
     it "should call :check_valid_shell on the provider when changing ensure from present to absent" do
       @provider = @shell_provider_class.new(:name => 'foo', :shell => '/bin/bash', :ensure => :absent)
       @provider.expects(:check_valid_shell)
       resource = described_class.new(:name => 'foo', :shell => '/bin/zsh', :provider => @provider)
       Puppet::Util::Storage.stubs(:load)
       Puppet::Util::Storage.stubs(:store)
       catalog = Puppet::Resource::Catalog.new
       catalog.add_resource resource
       catalog.apply
     end
   end
 
   describe "when purging ssh keys" do
     it "should not accept a keyfile with a relative path" do
       expect {
         described_class.new(:name => "a", :purge_ssh_keys => "keys")
       }.to raise_error(Puppet::Error, /Paths to keyfiles must be absolute, not keys/)
     end
 
     context "with a home directory specified" do
       it "should accept true" do
         described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => true)
       end
       it "should accept the ~ wildcard" do
         described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => "~/keys")
       end
       it "should accept the %h wildcard" do
         described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => "%h/keys")
       end
       it "raises when given a relative path" do
         expect {
           described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => "keys")
         }.to raise_error(Puppet::Error, /Paths to keyfiles must be absolute/)
       end
     end
 
     context "with no home directory specified" do
       it "should not accept true" do
         expect {
           described_class.new(:name => "a", :purge_ssh_keys => true)
         }.to raise_error(Puppet::Error, /purge_ssh_keys can only be true for users with a defined home directory/)
       end
       it "should not accept the ~ wildcard" do
         expect {
           described_class.new(:name => "a", :purge_ssh_keys => "~/keys")
         }.to raise_error(Puppet::Error, /meta character ~ or %h only allowed for users with a defined home directory/)
       end
       it "should not accept the %h wildcard" do
         expect {
           described_class.new(:name => "a", :purge_ssh_keys => "%h/keys")
         }.to raise_error(Puppet::Error, /meta character ~ or %h only allowed for users with a defined home directory/)
       end
     end
 
     context "with a valid parameter" do
       let(:paths) do
         [ "/dev/null", "/tmp/keyfile" ].map { |path| File.expand_path(path) }
       end
       subject do
         res = described_class.new(:name => "test", :purge_ssh_keys => paths)
         res.catalog = Puppet::Resource::Catalog.new
         res
       end
       it "should not just return from generate" do
         subject.expects :find_unmanaged_keys
         subject.generate
       end
       it "should check each keyfile for readability" do
         paths.each do |path|
           File.expects(:readable?).with(path)
         end
         subject.generate
       end
     end
 
     describe "generated keys" do
       subject do
         res = described_class.new(:name => "test_user_name", :purge_ssh_keys => purge_param)
         res.catalog = Puppet::Resource::Catalog.new
         res
       end
       context "when purging is disabled" do
         let(:purge_param) { false }
         its(:generate) { should be_empty }
       end
       context "when purging is enabled" do
         let(:purge_param) { my_fixture('authorized_keys') }
         let(:resources) { subject.generate }
         it "should contain a resource for each key" do
           names = resources.collect { |res| res.name }
           names.should include("key1 name")
           names.should include("keyname2")
         end
         it "should not include keys in comment lines" do
           names = resources.collect { |res| res.name }
           names.should_not include("keyname3")
         end
+        it "should generate names for unnamed keys" do
+          names = resources.collect { |res| res.name }
+          fixture_path = File.join(my_fixture_dir, 'authorized_keys')
+          names.should include("#{fixture_path}:unnamed-1")
+        end
         it "should each have a value for the user property" do
           resources.map { |res|
             res[:user]
           }.reject { |user_name|
             user_name == "test_user_name"
           }.should be_empty
         end
       end
     end
   end
 end