The initial OP explained he wanted an action ONLY if user exists.. Aaron -- not your assumption that he wants to run again even if the user exists. Example:
I want to disable the password for a user, IF exists.. but NOT add a user, and a disabled password to systems where the user never existed.
I have not found this answer elsewhere, and it should be a simple check within puppet, not requiring external exec cmds.
I hoped for a simpler method - researched at puppetlabs - that I could leave the ensure out, but for user 'bob' the password should always be :!!: Same result if you set shell to /bin/false or /bin/nologin.
The answer - if you leave out ensure present - Puppet will default to ensure present before it can change all other settings. It can't just act on it without
Without doing some external shell check and setting a value or fact - puppet can't make changes only if the user isn't there. It has to either ensure its there, make the change, or ensure its GONE.
Most sysadmin don't like to remove a user - leaving a hole where the UID used to be defined. Instead they disable. That way existing files and procs with the UID are labeled, etc.
I guess I'd rather have a user thats gone added, then to miss a host where accounts or access is still present. But the above is a concept that maybe puppet devs should consider.