diff --git a/lib/puppet/type/resources.rb b/lib/puppet/type/resources.rb
index ae41b883b..3e25ea5aa 100644
--- a/lib/puppet/type/resources.rb
+++ b/lib/puppet/type/resources.rb
@@ -1,131 +1,131 @@
 require 'puppet'
 
 Puppet::Type.newtype(:resources) do
   @doc = "This is a metatype that can manage other resource types.  Any
     metaparams specified here will be passed on to any generated resources,
     so you can purge umanaged resources but set `noop` to true so the
     purging is only logged and does not actually happen."
 
 
   newparam(:name) do
     desc "The name of the type to be managed."
 
     validate do |name|
       raise ArgumentError, "Could not find resource type '#{name}'" unless Puppet::Type.type(name)
     end
 
     munge { |v| v.to_s }
   end
 
   newparam(:purge, :boolean => true) do
     desc "Purge unmanaged resources.  This will delete any resource
       that is not specified in your configuration
       and is not required by any specified resources."
 
     newvalues(:true, :false)
 
     validate do |value|
       if [:true, true, "true"].include?(value)
         unless @resource.resource_type.respond_to?(:instances)
           raise ArgumentError, "Purging resources of type #{@resource[:name]} is not supported, since they cannot be queried from the system"
         end
         raise ArgumentError, "Purging is only supported on types that accept 'ensure'" unless @resource.resource_type.validproperty?(:ensure)
       end
     end
   end
 
   newparam(:unless_system_user) do
     desc "This keeps system users from being purged.  By default, it
       does not purge users whose UIDs are less than or equal to 500, but you can specify
       a different UID as the inclusive limit."
 
     newvalues(:true, :false, /^\d+$/)
 
     munge do |value|
       case value
       when /^\d+/
         Integer(value)
       when :true, true
         500
       when :false, false
         false
       when Integer; value
       else
         raise ArgumentError, "Invalid value #{value.inspect}"
       end
     end
 
     defaultto {
       if @resource[:name] == "user"
         500
       else
         nil
       end
     }
   end
 
   def check(resource)
     @checkmethod ||= "#{self[:name]}_check"
     @hascheck ||= respond_to?(@checkmethod)
     if @hascheck
       return send(@checkmethod, resource)
     else
       return true
     end
   end
 
   def able_to_ensure_absent?(resource)
       resource[:ensure] = :absent
   rescue ArgumentError, Puppet::Error => detail
       err "The 'ensure' attribute on #{self[:name]} resources does not accept 'absent' as a value"
       false
   end
 
   # Generate any new resources we need to manage.  This is pretty hackish
   # right now, because it only supports purging.
   def generate
     return [] unless self.purge?
     resource_type.instances.
       reject { |r| catalog.resource_refs.include? r.ref }.
       select { |r| check(r) }.
       select { |r| r.class.validproperty?(:ensure) }.
       select { |r| able_to_ensure_absent?(r) }.
       each { |resource|
         @parameters.each do |name, param|
           resource[name] = param.value if param.metaparam?
         end
 
         # Mark that we're purging, so transactions can handle relationships
         # correctly
         resource.purging
       }
   end
 
   def resource_type
     unless defined?(@resource_type)
       unless type = Puppet::Type.type(self[:name])
         raise Puppet::DevError, "Could not find resource type"
       end
       @resource_type = type
     end
     @resource_type
   end
 
   # Make sure we don't purge users below a certain uid, if the check
   # is enabled.
   def user_check(resource)
     return true unless self[:name] == "user"
     return true unless self[:unless_system_user]
 
     resource[:audit] = :uid
-    current_values = resource.retrieve_resource
 
     return false if system_users.include?(resource[:name])
 
+    current_values = resource.retrieve_resource
     current_values[resource.property(:uid)] > self[:unless_system_user]
   end
 
   def system_users
     %w{root nobody bin noaccess daemon sys}
   end
 end
diff --git a/spec/unit/indirector/resource/ral_spec.rb b/spec/unit/indirector/resource/ral_spec.rb
index 0205db52e..df68c9b24 100755
--- a/spec/unit/indirector/resource/ral_spec.rb
+++ b/spec/unit/indirector/resource/ral_spec.rb
@@ -1,130 +1,135 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 describe "Puppet::Resource::Ral" do
   describe "find" do
     before do
       @request = stub 'request', :key => "user/root"
     end
 
     it "should find an existing instance" do
       my_resource    = stub "my user resource"
 
       wrong_instance = stub "wrong user", :name => "bob"
       my_instance    = stub "my user",    :name => "root", :to_resource => my_resource
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ wrong_instance, my_instance, wrong_instance ])
       Puppet::Resource::Ral.new.find(@request).should == my_resource
     end
 
     it "if there is no instance, it should create one" do
       wrong_instance = stub "wrong user", :name => "bob"
+      root = mock "Root User"
+      root_resource = mock "Root Resource"
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ wrong_instance, wrong_instance ])
+      Puppet::Type::User.expects(:new).with(has_entry(:name => "root")).returns(root)
+      root.expects(:to_resource).returns(root_resource)
+
       result = Puppet::Resource::Ral.new.find(@request)
-      result.should be_is_a(Puppet::Resource)
-      result.title.should == "root"
+
+      result.should == root_resource
     end
   end
 
   describe "search" do
     before do
       @request = stub 'request', :key => "user/", :options => {}
     end
 
     it "should convert ral resources into regular resources" do
       my_resource = stub "my user resource"
       my_instance = stub "my user", :name => "root", :to_resource => my_resource
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ my_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [my_resource]
     end
 
     it "should filter results by name if there's a name in the key" do
       my_resource    = stub "my user resource"
       my_resource.stubs(:to_resource).returns(my_resource)
       my_resource.stubs(:[]).with(:name).returns("root")
 
       wrong_resource = stub "wrong resource"
       wrong_resource.stubs(:to_resource).returns(wrong_resource)
       wrong_resource.stubs(:[]).with(:name).returns("bad")
 
       my_instance    = stub "my user",    :to_resource => my_resource
       wrong_instance = stub "wrong user", :to_resource => wrong_resource
 
       @request = stub 'request', :key => "user/root", :options => {}
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ my_instance, wrong_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [my_resource]
     end
 
     it "should filter results by query parameters" do
       wrong_resource = stub "my user resource"
       wrong_resource.stubs(:to_resource).returns(wrong_resource)
       wrong_resource.stubs(:[]).with(:name).returns("root")
 
       my_resource = stub "wrong resource"
       my_resource.stubs(:to_resource).returns(my_resource)
       my_resource.stubs(:[]).with(:name).returns("bob")
 
       my_instance    = stub "my user",    :to_resource => my_resource
       wrong_instance = stub "wrong user", :to_resource => wrong_resource
 
       @request = stub 'request', :key => "user/", :options => {:name => "bob"}
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ my_instance, wrong_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [my_resource]
     end
 
     it "should return sorted results" do
       a_resource = stub "alice resource"
       a_resource.stubs(:to_resource).returns(a_resource)
       a_resource.stubs(:title).returns("alice")
 
       b_resource = stub "bob resource"
       b_resource.stubs(:to_resource).returns(b_resource)
       b_resource.stubs(:title).returns("bob")
 
       a_instance = stub "alice user", :to_resource => a_resource
       b_instance = stub "bob user",   :to_resource => b_resource
 
       @request = stub 'request', :key => "user/", :options => {}
 
       require 'puppet/type/user'
       Puppet::Type::User.expects(:instances).returns([ b_instance, a_instance ])
       Puppet::Resource::Ral.new.search(@request).should == [a_resource, b_resource]
     end
   end
 
   describe "save" do
     before do
       @rebuilt_res = stub 'rebuilt instance'
       @ral_res     = stub 'ral resource', :to_resource => @rebuilt_res
       @instance    = stub 'instance', :to_ral => @ral_res
       @request     = stub 'request',  :key => "user/", :instance => @instance
       @catalog     = stub 'catalog'
       @report      = stub 'report'
       @transaction = stub 'transaction', :report => @report
 
       Puppet::Resource::Catalog.stubs(:new).returns(@catalog)
       @catalog.stubs(:apply).returns(@transaction)
       @catalog.stubs(:add_resource)
     end
 
     it "should apply a new catalog with a ral object in it" do
       Puppet::Resource::Catalog.expects(:new).returns(@catalog)
       @catalog.expects(:add_resource).with(@ral_res)
       @catalog.expects(:apply).returns(@transaction)
       Puppet::Resource::Ral.new.save(@request).should
     end
 
     it "should return a regular resource that used to be the ral resource" do
       Puppet::Resource::Ral.new.save(@request).should == [@rebuilt_res, @report]
     end
   end
 end
diff --git a/spec/unit/type/group_spec.rb b/spec/unit/type/group_spec.rb
index e7da6abf6..c7fa1c724 100755
--- a/spec/unit/type/group_spec.rb
+++ b/spec/unit/type/group_spec.rb
@@ -1,63 +1,54 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 describe Puppet::Type.type(:group) do
   before do
-    ENV["PATH"] += File::PATH_SEPARATOR + "/usr/sbin" unless ENV["PATH"].split(File::PATH_SEPARATOR).include?("/usr/sbin")
     @class = Puppet::Type.type(:group)
   end
 
-  it "should have a default provider" do
-    @class.defaultprovider.should_not be_nil
-  end
-
-  it "should have a default provider inheriting from Puppet::Provider" do
-    @class.defaultprovider.ancestors.should be_include(Puppet::Provider)
-  end
-
   it "should have a system_groups feature" do
     @class.provider_feature(:system_groups).should_not be_nil
   end
 
   describe "when validating attributes" do
     [:name, :allowdupe].each do |param|
       it "should have a #{param} parameter" do
         @class.attrtype(param).should == :param
       end
     end
 
     [:ensure, :gid].each do |param|
       it "should have a #{param} property" do
         @class.attrtype(param).should == :property
       end
     end
 
     it "should convert gids provided as strings into integers" do
       @class.new(:name => "foo", :gid => "15")[:gid].should == 15
     end
 
     it "should accepts gids provided as integers" do
       @class.new(:name => "foo", :gid => 15)[:gid].should == 15
     end
   end
 
   it "should have a boolean method for determining if duplicates are allowed" do
     @class.new(:name => "foo").should respond_to "allowdupe?"
   end
 
   it "should have a boolean method for determining if system groups are allowed" do
     @class.new(:name => "foo").should respond_to "system?"
   end
 
   it "should call 'create' to create the group" do
     group = @class.new(:name => "foo", :ensure => :present)
     group.provider.expects(:create)
     group.parameter(:ensure).sync
   end
 
   it "should call 'delete' to remove the group" do
     group = @class.new(:name => "foo", :ensure => :absent)
     group.provider.expects(:delete)
     group.parameter(:ensure).sync
   end
 end
diff --git a/spec/unit/type/resources_spec.rb b/spec/unit/type/resources_spec.rb
index ca2ffdd1f..3c0850efb 100755
--- a/spec/unit/type/resources_spec.rb
+++ b/spec/unit/type/resources_spec.rb
@@ -1,101 +1,100 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 resources = Puppet::Type.type(:resources)
 
 # There are still plenty of tests to port over from test/.
 describe resources do
   describe "when initializing" do
     it "should fail if the specified resource type does not exist" do
       Puppet::Type.stubs(:type).with { |x| x.to_s.downcase == "resources"}.returns resources
       Puppet::Type.expects(:type).with("nosuchtype").returns nil
       lambda { resources.new :name => "nosuchtype" }.should raise_error(Puppet::Error)
     end
 
     it "should not fail when the specified resource type exists" do
       lambda { resources.new :name => "file" }.should_not raise_error
     end
 
     it "should set its :resource_type attribute" do
       resources.new(:name => "file").resource_type.should == Puppet::Type.type(:file)
     end
   end
 
   describe "#generate" do
     before do
       @host1 = Puppet::Type.type(:host).new(:name => 'localhost', :ip => '127.0.0.1')
       @catalog = Puppet::Resource::Catalog.new
       @context = Puppet::Transaction.new(@catalog)
     end
 
       describe "when dealing with non-purging resources" do
         before do
           @resources = Puppet::Type.type(:resources).new(:name => 'host')
         end
 
         it "should not generate any resource" do
           @resources.generate.should be_empty
         end
       end
 
       describe "when the catalog contains a purging resource" do
         before do
           @resources = Puppet::Type.type(:resources).new(:name => 'host', :purge => true)
           @purgeable_resource = Puppet::Type.type(:host).new(:name => 'localhost', :ip => '127.0.0.1')
           @catalog.add_resource @resources
         end
 
         it "should not generate a duplicate of that resource" do
           Puppet::Type.type(:host).stubs(:instances).returns [@host1]
           @catalog.add_resource @host1
           @resources.generate.collect { |r| r.ref }.should_not include(@host1.ref)
         end
 
-        it "should not include the skipped users" do
+        it "should not include the skipped system users" do
           res = Puppet::Type.type(:resources).new :name => :user, :purge => true
           res.catalog = Puppet::Resource::Catalog.new
 
-          users = [
-            Puppet::Type.type(:user).new(:name => "root")
-          ]
-          Puppet::Type.type(:user).expects(:instances).returns users
+          root = Puppet::Type.type(:user).new(:name => "root")
+          Puppet::Type.type(:user).expects(:instances).returns [ root ]
+
           list = res.generate
 
           names = list.collect { |r| r[:name] }
           names.should_not be_include("root")
         end
 
         describe "when generating a purgeable resource" do
           it "should be included in the generated resources" do
             Puppet::Type.type(:host).stubs(:instances).returns [@purgeable_resource]
             @resources.generate.collect { |r| r.ref }.should include(@purgeable_resource.ref)
           end
         end
 
         describe "when the instance's do not have an ensure property" do
           it "should not be included in the generated resources" do
             @no_ensure_resource = Puppet::Type.type(:exec).new(:name => "#{File.expand_path('/usr/bin/env')} echo")
             Puppet::Type.type(:host).stubs(:instances).returns [@no_ensure_resource]
             @resources.generate.collect { |r| r.ref }.should_not include(@no_ensure_resource.ref)
           end
         end
 
         describe "when the instance's ensure property does not accept absent" do
           it "should not be included in the generated resources" do
             @no_absent_resource = Puppet::Type.type(:service).new(:name => 'foobar')
             Puppet::Type.type(:host).stubs(:instances).returns [@no_absent_resource]
             @resources.generate.collect { |r| r.ref }.should_not include(@no_absent_resource.ref)
           end
         end
 
         describe "when checking the instance fails" do
           it "should not be included in the generated resources" do
             @purgeable_resource = Puppet::Type.type(:host).new(:name => 'foobar')
             Puppet::Type.type(:host).stubs(:instances).returns [@purgeable_resource]
             @resources.expects(:check).with(@purgeable_resource).returns(false)
             @resources.generate.collect { |r| r.ref }.should_not include(@purgeable_resource.ref)
           end
         end
       end
   end
 end
diff --git a/spec/unit/type/user_spec.rb b/spec/unit/type/user_spec.rb
index 2ca8d8823..c559be3c7 100755
--- a/spec/unit/type/user_spec.rb
+++ b/spec/unit/type/user_spec.rb
@@ -1,344 +1,335 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 user = Puppet::Type.type(:user)
 
 describe user do
   before do
-    ENV["PATH"] += File::PATH_SEPARATOR + "/usr/sbin" unless ENV["PATH"].split(File::PATH_SEPARATOR).include?("/usr/sbin")
     @provider = stub 'provider'
     @resource = stub 'resource', :resource => nil, :provider => @provider, :line => nil, :file => nil
   end
 
-  it "should have a default provider inheriting from Puppet::Provider" do
-    user.defaultprovider.ancestors.should be_include(Puppet::Provider)
-  end
-
   it "should be able to create a instance" do
     user.new(:name => "foo").should_not be_nil
   end
 
   it "should have an allows_duplicates feature" do
     user.provider_feature(:allows_duplicates).should_not be_nil
   end
 
   it "should have an manages_homedir feature" do
     user.provider_feature(:manages_homedir).should_not be_nil
   end
 
   it "should have an manages_passwords feature" do
     user.provider_feature(:manages_passwords).should_not be_nil
   end
 
   it "should have a manages_solaris_rbac feature" do
     user.provider_feature(:manages_solaris_rbac).should_not be_nil
   end
 
   it "should have a manages_expiry feature" do
     user.provider_feature(:manages_expiry).should_not be_nil
   end
 
   it "should have a manages_password_age feature" do
     user.provider_feature(:manages_password_age).should_not be_nil
   end
 
   it "should have a system_users feature" do
     user.provider_feature(:system_users).should_not be_nil
   end
 
   describe "instances" do
-    it "should have a valid provider" do
-      user.new(:name => "foo").provider.class.ancestors.should be_include(Puppet::Provider)
-    end
-
     it "should delegate existence questions to its provider" do
       instance = user.new(:name => "foo")
       instance.provider.expects(:exists?).returns "eh"
       instance.exists?.should == "eh"
     end
   end
 
   properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :password_min_age, :password_max_age, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
 
   properties.each do |property|
     it "should have a #{property} property" do
       user.attrclass(property).ancestors.should be_include(Puppet::Property)
     end
 
     it "should have documentation for its #{property} property" do
       user.attrclass(property).doc.should be_instance_of(String)
     end
   end
 
   list_properties = [:groups, :roles, :auths]
 
   list_properties.each do |property|
     it "should have a list '#{property}'" do
       user.attrclass(property).ancestors.should be_include(Puppet::Property::List)
     end
   end
 
   it "should have an ordered list 'profiles'" do
     user.attrclass(:profiles).ancestors.should be_include(Puppet::Property::OrderedList)
   end
 
   it "should have key values 'keys'" do
     user.attrclass(:keys).ancestors.should be_include(Puppet::Property::KeyValue)
   end
 
   describe "when retrieving all current values" do
     before do
       @user = user.new(:name => "foo", :uid => 10)
     end
 
     it "should return a hash containing values for all set properties" do
       @user[:gid] = 10
       @user.property(:ensure).expects(:retrieve).returns :present
       @user.property(:uid).expects(:retrieve).returns 15
       @user.property(:gid).expects(:retrieve).returns 15
       values = @user.retrieve
       [@user.property(:uid), @user.property(:gid)].each { |property| values.should be_include(property) }
     end
 
     it "should set all values to :absent if the user is absent" do
       @user.property(:ensure).expects(:retrieve).returns :absent
       @user.property(:uid).expects(:retrieve).never
       @user.retrieve[@user.property(:uid)].should == :absent
     end
 
     it "should include the result of retrieving each property's current value if the user is present" do
       @user.property(:ensure).expects(:retrieve).returns :present
       @user.property(:uid).expects(:retrieve).returns 15
       @user.retrieve[@user.property(:uid)].should == 15
     end
   end
 
   describe "when managing the ensure property" do
     before do
       @ensure = user.attrclass(:ensure).new(:resource => @resource)
     end
 
     it "should support a :present value" do
       lambda { @ensure.should = :present }.should_not raise_error
     end
 
     it "should support an :absent value" do
       lambda { @ensure.should = :absent }.should_not raise_error
     end
 
     it "should call :create on the provider when asked to sync to the :present state" do
       @provider.expects(:create)
       @ensure.should = :present
       @ensure.sync
     end
 
     it "should call :delete on the provider when asked to sync to the :absent state" do
       @provider.expects(:delete)
       @ensure.should = :absent
       @ensure.sync
     end
 
     describe "and determining the current state" do
       it "should return :present when the provider indicates the user exists" do
         @provider.expects(:exists?).returns true
         @ensure.retrieve.should == :present
       end
 
       it "should return :absent when the provider indicates the user does not exist" do
         @provider.expects(:exists?).returns false
         @ensure.retrieve.should == :absent
       end
     end
   end
 
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       uid = user.attrclass(:uid).new(:resource => @resource)
       uid.should = "50"
       uid.should.must == 50
     end
 
     it "should support UIDs as numbers" do
       uid = user.attrclass(:uid).new(:resource => @resource)
       uid.should = 50
       uid.should.must == 50
     end
 
     it "should :absent as a value" do
       uid = user.attrclass(:uid).new(:resource => @resource)
       uid.should = :absent
       uid.should.must == :absent
     end
   end
 
   describe "when managing the gid" do
     it "should :absent as a value" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = :absent
       gid.should.must == :absent
     end
 
     it "should convert number-looking strings into actual numbers" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = "50"
       gid.should.must == 50
     end
 
     it "should support GIDs specified as integers" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = 50
       gid.should.must == 50
     end
 
     it "should support groups specified by name" do
       gid = user.attrclass(:gid).new(:resource => @resource)
       gid.should = "foo"
       gid.should.must == "foo"
     end
 
     describe "when testing whether in sync" do
       before do
         @gid = user.attrclass(:gid).new(:resource => @resource, :should => %w{foo bar})
       end
 
       it "should return true if no 'should' values are set" do
         @gid = user.attrclass(:gid).new(:resource => @resource)
 
         @gid.must be_safe_insync(500)
       end
 
       it "should return true if any of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @gid.must be_safe_insync(500)
       end
 
       it "should return false if none of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @gid.should_not be_safe_insync(700)
       end
     end
 
     describe "when syncing" do
       before do
         @gid = user.attrclass(:gid).new(:resource => @resource, :should => %w{foo bar})
       end
 
       it "should use the first found, specified group as the desired value and send it to the provider" do
         Puppet::Util.expects(:gid).with("foo").returns nil
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @provider.expects(:gid=).with 500
 
         @gid.sync
       end
     end
   end
 
   describe "when managing expiry" do
     before do
       @expiry = user.attrclass(:expiry).new(:resource => @resource)
     end
 
     it "should fail if given an invalid date" do
       lambda { @expiry.should = "200-20-20" }.should raise_error(Puppet::Error)
     end
   end
 
   describe "when managing minimum password age" do
     before do
       @age = user.attrclass(:password_min_age).new(:resource => @resource)
     end
 
     it "should accept a negative minimum age" do
       expect { @age.should = -1 }.should_not raise_error
     end
 
     it "should fail with an empty minimum age" do
       expect { @age.should = '' }.should raise_error(Puppet::Error)
     end
   end
 
   describe "when managing maximum password age" do
     before do
       @age = user.attrclass(:password_max_age).new(:resource => @resource)
     end
 
     it "should accept a negative maximum age" do
       expect { @age.should = -1 }.should_not raise_error
     end
 
     it "should fail with an empty maximum age" do
       expect { @age.should = '' }.should raise_error(Puppet::Error)
     end
   end
 
   describe "when managing passwords" do
     before do
       @password = user.attrclass(:password).new(:resource => @resource, :should => "mypass")
     end
 
     it "should not include the password in the change log when adding the password" do
       @password.change_to_s(:absent, "mypass").should_not be_include("mypass")
     end
 
     it "should not include the password in the change log when changing the password" do
       @password.change_to_s("other", "mypass").should_not be_include("mypass")
     end
 
     it "should redact the password when displaying the old value" do
       @password.is_to_s("currentpassword").should =~ /^\[old password hash redacted\]$/
     end
 
     it "should redact the password when displaying the new value" do
       @password.should_to_s("newpassword").should =~ /^\[new password hash redacted\]$/
     end
 
     it "should fail if a ':' is included in the password" do
       lambda { @password.should = "some:thing" }.should raise_error(Puppet::Error)
     end
 
     it "should allow the value to be set to :absent" do
       lambda { @password.should = :absent }.should_not raise_error
     end
   end
 
   describe "when manages_solaris_rbac is enabled" do
     before do
       @provider.stubs(:satisfies?).returns(false)
       @provider.expects(:satisfies?).with([:manages_solaris_rbac]).returns(true)
     end
 
     it "should support a :role value for ensure" do
       @ensure = user.attrclass(:ensure).new(:resource => @resource)
       lambda { @ensure.should = :role }.should_not raise_error
     end
   end
 
   describe "when user has roles" do
     before do
       # To test this feature, we have to support it.
       user.new(:name => "foo").provider.class.stubs(:feature?).returns(true)
     end
 
     it "should autorequire roles" do
       testuser = Puppet::Type.type(:user).new(:name => "testuser")
       testuser.provider.stubs(:send).with(:roles).returns("")
       testuser[:roles] = "testrole"
 
       testrole = Puppet::Type.type(:user).new(:name => "testrole")
 
       config = Puppet::Resource::Catalog.new :testing do |conf|
         [testuser, testrole].each { |resource| conf.add_resource resource }
       end
       Puppet::Type::User::ProviderDirectoryservice.stubs(:get_macosx_version_major).returns "10.5"
 
       rel = testuser.autorequire[0]
       rel.source.ref.should == testrole.ref
       rel.target.ref.should == testuser.ref
     end
   end
 end