Resolve #11042 

I’ve just pushed https://github.com/nhemingway/puppet/commit/b5b292d09ed283a0e2930ee7cfedf8fa64108a8c. Is this the kind of thing you were looking for?

Incidentally, I now notice that puppet is spamming the log because @should=&lt;groupname&gt;, whereas is=&lt;gid&gt;, and it thinks they don’t match. I’ve investigated a couple of ways of teaching puppet that they do match, but I’m not convinced I’ve got the best place.

The first solution I tried was to convert the gid back to the groupname in Puppet::Type::user using is_to_s and should_to_s.

My second try replaced the call of Puppet::util.gid with one to a new function provider.group2id, but: (a) this would also require adding support functions to the other providers and I’ve no means of testing those (b) I wasn’t sure whether it was a design decision to indirect through posix to ensure that not only does the group exist in ldap, but that the local machine can also see it.