puppetlabs/puppet — pull request #554 by glarizza (2012-03-02 22:50:18+00:00)
Title: (#12833) Handle PBKDF2 passwords in OS X

Handling PBKDF2 password introduces a unique problem with Puppet.
Previously, Puppet utilized a password hash for the 'password' property
with the User resource on OS X. The hashing algorithm changed between
versions of OS X and so we had to chase down this moving target. PBKDF2
is another change to the hashing algoritm, but it also changes the way
that passwords must be set in a Puppet manifest for OS X clients.

PBKDF2 passwords are generated when a plaintext password is salted
(given a separate 32-byte salt string) and hashed a number of times. The
number of times this password hashing algorithm is run is based on a
parameter known as 'iterations', and is usually recommended to be
between 10,000 and 15,000. The resultant value is the password hash,
HOWEVER, that password hash is useless unless you know the value of the
salt that was used and the value for the iterations parameter. Since we
can no longer support a single 'password' property in Puppet, we must
support two additional properties called 'salt' and 'iterations'.

This commit introduces the 'salt' and 'iterations' properties and also
refactors the way salted-sha512 and salted-sha512-pbkdf2 passwords are
retrieved and set in OS X.

I ran spec tests against 10.7, a future version of OS X, centos5, and ubuntu lucid. All were passing at the time.