You can probably add a validate block to check if someone specifies both :password_file and :password, like so: https://github.com/puppetlabs/puppetlabs-firewall/blob/master/lib/puppet/type/firewall.rb#L727-L729