How can I have puppet only set password when creating a user?

I want Puppet not to manage a password (i.e., reset it when it's changed) but to set the initial password when Puppet creates the user.

I was thinking of doing a notify to an Exec resource that sets the password but this is triggered when any property that Puppet manages is modified (e.g., group membership, home directory, etc.). I do not want that.

Any ideas?

Puppet itself doesn't natively support "set password at user creation but not otherwise".

One option would be to set up an external auth source, such as LDAP.

Another would be your notify to an Exec idea, but the make the Exec a little smarter.

exec {
  "/usr/sbin/usermod -p '${password}' ${user}":
    onlyif => "/bin/egrep -q '^${user}:[*!]' /etc/shadow",
    require => User[$user];
}

I haven't tested that, but by checking if the password hasn't been set in the Exec resource, you should get the result you were looking for. I think set up that way, the notify/refreshonly stuff isn't necessary, but probably wouldn't hurt.