parameter 'user_list' entry '<username>' entry 'password' expects a String value, got Sensitive[String]

[dvjjoling]

Describe the Bug

When using a sensitive string for the password for a user in accounts::user_list it gives the following error:
parameter 'user_list' entry '<username>' entry 'password' expects a String value, got Sensitive[String]

Expected Behavior

Set the password for whatever is in the sensitive string.
This should work because the password entry accepts sensitive strings as the documentation says this.

Steps to Reproduce

Steps to reproduce the behavior:

1. Use a sensitive string as password with accounts::user_list

Environment

• Accounts module version: 8.1.0
• Puppetserver version: 8.2.1
• Platform: Ubuntu 22.04 LTS
• tragiccode-azure_key_vault v3.3.0

Additional Context

I am trying to get a secret from Azure Key Vault and set it as the users password.
I am using the tragiccode-azure_key_vault module to get the secret from Azure Key Vault.
The Azure Key Vault module is working for other (custom) Puppet modules.

In the node Hiera yaml for the node I do a lookup on the password as follows:

accounts::user_list:
  '<username>':
      ensure: 'present'
      password: "%{alias('<username>-unix-password-hash')}"

I am also converting it to a sensitive string because otherwise I get "Redacted" as my password (in /etc/shadow). I do this with the following in my node Hiera yaml:

lookup_options:
  '^.*-unix-password-hash':
    convert_to: 'Sensitive'

[djvanvliet]

When i append the file /types/user/resource.pp with
Optional[password] => Variant[String, Sensitive[String]],
instead of Optional[password] => String, it works for me, can you check?

[dvjjoling]

When i append the file /types/user/resource.pp with Optional[password] => Variant[String, Sensitive[String]], instead of Optional[password] => String, it works for me, can you check?

This solves the issue. The users password is now set correctly.

So it looks the Puppetlabs-Accounts module needs this fix.