As a side comment, requiring the primary group for a user resource is unnecessary.  The user type auto-requires the group.  `autorequire` is magic that can be done from inside a custom type but not the DSL that will introduce a dependency but only if the resouce exists in the manifest and it's not parser order dependent.

See: https://github.com/puppetlabs/puppet/blob/stable/lib/puppet/type/user.rb#L332-L334