When using Puppet in a Beaker acceptance test to configure a user with a null password (in order to later test to ensure that null passwords would not be permitted to authenticate) I discovered a bug in Puppet when creating users with null passwords.
Given a manifest like:
user { 'testuser': password => '' }
It requires two Puppet runs to obtain the desired state.
The PR for this was closed and we're unlikely to work on this anytime soon, so I'm going to close this. Please reopen if you'd like to submit a new PR to confine the change to an empty password