It seems that I'm having a conversation with myself. https://github.com/puppetlabs/puppet/pull/1942/files#L5R183 _will_ call the right method, but this test is faulty because the :ensure value isn't specified on the provider. Since it's not set, then it defaults to absent.

When the ResourceHarness is applying a resource, it checks if the `ensure` property is in sync. If not, then it _only_ syncs the ensure property then returns. This means that we completely bypass the behavior of the `sync` method on the property.

Furthermore, this stubbed provider doesn't inherit from useradd, so `#create` is empty and doesn't invoke the check_valid_shell.

So two things from this:

  1) In order to actually validate the behavior of this, we need to actually create a catalog, add a resource instance, and apply it. Otherwise we can easily bypass the actual behavior. For instance, if the property `#insync?` value returns true all the time this will silently fail.
  2) We need to set the ensure value on the provid