[Puppet Users] expiry attribut of users applied every time

Nicholas,

An easy way to reproduce the problem is to run `puppet resource` a number
of consecutive times. We expect subsequent executions of Puppet to be
idempotent, but they're clearly not:

root@puppetmaster:~# puppet resource user jefftest expiry=2012-01-01
/User[jefftest]/expiry: defined 'expiry' as '2012-01-01'
user { 'jefftest':
ensure => 'present',
}
root@puppetmaster:~# puppet resource user jefftest expiry=2012-01-01
/User[jefftest]/expiry: defined 'expiry' as '2012-01-01'
user { 'jefftest':
ensure => 'present',
}
root@puppetmaster:~# puppet resource user jefftest expiry=2012-01-01
/User[jefftest]/expiry: defined 'expiry' as '2012-01-01'
user { 'jefftest':
ensure => 'present',
}

A common trick I employ in situations like these is to run with debugging
turned on. This should display the value Puppet thinks the parameter
_should_ be, which is what we specify in the manifest or on the command
line, versus what the parameter _is_ on the system. If they mis-match,
then I change my manifest to match the "is" value and that usually makes
Puppet idempotent again.

Unfortunately, in this case we're not getting the "is" values in the debug
output. =(

root@puppetmaster:~# puppet resource user jefftest expiry=2012-01-01 --debug
Debug: Puppet::Type::User::ProviderLdap: true value when expecting false
Debug: Puppet::Type::User::ProviderPw: file pw does not exist
Debug: Puppet::Type::User::ProviderUser_role_add: file roleadd does not
exist
Debug: Puppet::Type::User::ProviderDirectoryservice: file /usr/bin/dscl
does not exist
Debug: Loaded state in 0.00 seconds
Debug: Executing '/usr/sbin/usermod -e 2012-01-01 jefftest'
/User[jefftest]/expiry: defined 'expiry' as '2012-01-01'
Debug: Finishing transaction 70035535867960
Debug: Storing state
Debug: Stored state in 0.00 seconds
user { 'jefftest':
ensure => 'present',
}

So then I dive into the ruby debugger. I used ack to search for "defined
'" in the l ib/ directory and came up with this:

https://github.com/puppetlabs/puppet/blob/3.0.x/lib/puppet/property.rb#L104-106

So Puppet is thinking the current value from the system is totally absent.
We can't make this idempotent as a result. This is definitely a bug,
would you mind filing it? If so, I'd be happy to do so on your behalf, but
bugs from users are always better than bugs I report.

Please feel free to add me as a watcher, I'll update it with the
information I found.

Hope this helps,
-Jeff