AD group causes corrective action every puppet run

[ghost]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 5.3.5
• Ruby:
• Distribution: CentOS 7
• Module version: 1.0.0

How to reproduce (e.g Puppet code you use)

posix_acl { '/mnt/test':
        action     => exact,
        permission => [
            'default:user::rwx',
            'default:group::rwx',
            'default:mask::rwx',
            'default:other::---',
            'user::rwx',
            'group::rwx',
            'mask::rwx',
            'other::---',
            "user:${ad_domain_short_caps}\\tmashos:rwx",
        ],
        recursive  => true,
        require    => Package['acl'],
    }

What are you seeing

Puppet tries to correct the ACL every time

What behaviour did you expect instead

Puppet doesn't change the ACL when it's correct

Output log

Notice: /Stage[main]/Profile::Mssql::Linux_server/Posix_acl[/mnt/test]/permission: permission changed ["default:group::rwx", "default:mask::rwx", "default:other::---", "default:user::rwx", "group::rwx", "mask::rwx", "other::---", "user::rwx", "user:HOSTING-US\134tmashos:rwx"] to ["default:group::rwx", "default:mask::rwx", "default:other::---", "default:user::rwx", "group::rwx", "mask::rwx", "other::---", "user::rwx", "user:HOSTING-US\tmashos:rwx"]

Any additional information you'd like to impart

This is using a LDAP (Active Directory) user in an ACL called "HOSTING-US\tmashos". getfacl formats the \ as \134 so it doesn't match what is set it puppet when it's returned.