Well, that's issue with puppet and such decorative approach in general I suppose. One would have to first set openldap to absent, then wait once it synced to all nodes, then add `package { 'ldap-utils':`

Or maybe you know of a work around?