diff --git a/.sync.yml b/.sync.yml
index 35424a92..12e16091 100644
--- a/.sync.yml
+++ b/.sync.yml
@@ -3,3 +3,6 @@ Gemfile:
   optional:
     ':test':
       - gem: puppet-lint-param-docs
+spec/spec_helper.rb:
+  spec_overrides:
+    - "require 'support/acceptance/constants.rb'"
diff --git a/manifests/init.pp b/manifests/init.pp
index 1457200f..20e84025 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -502,15 +502,24 @@
           ensure        => 'absent',
       }
     } else {
-      archive {
-        $target:
-          ensure        => 'present',
-          source        => $plugin_data['source'],
-          username      => $plugin_data['username'],
-          password      => $plugin_data['password'],
-          checksum      => $plugin_data['checksum'],
-          checksum_type => $plugin_data['checksum_type'],
+      $_target_defaults = {
+        ensure        => 'present',
+        source        => $plugin_data['source'],
+        checksum      => $plugin_data['checksum'],
+        checksum_type => $plugin_data['checksum_type'],
+      }
+      $_username = !empty($plugin_data['username']) ? {
+        default => {},
+        true    => { username => $plugin_data['username'] }
+      }
+      $_password = !empty($plugin_data['password']) ? {
+        default => {},
+        true    => { password => $plugin_data['password'] }
+      }
+      $_plugin_archive = {
+        $target => $_target_defaults + $_username + $_password
       }
+      create_resources(archive, $_plugin_archive)
     }
   }
 }
diff --git a/spec/acceptance/default_parameters_spec.rb b/spec/acceptance/default_parameters_spec.rb
index d9d2426a..a7d02f98 100644
--- a/spec/acceptance/default_parameters_spec.rb
+++ b/spec/acceptance/default_parameters_spec.rb
@@ -45,7 +45,7 @@ class { 'jira':
     EOS
 
     # jira just takes *ages* to start up :-(
-    WGET_CMD = 'wget -q --tries=24 --retry-connrefused --read-timeout=10 localhost:8080'
+    WGET_CMD = 'wget -q --tries=24 --retry-connrefused --read-timeout=10 localhost:8080'.freeze
     apply_manifest(pp, catch_failures: true)
     sleep 60
     shell WGET_CMD, acceptable_exit_codes: [0, 8]
diff --git a/spec/acceptance/mysql_spec.rb b/spec/acceptance/mysql_spec.rb
index f7ee8955..88859118 100644
--- a/spec/acceptance/mysql_spec.rb
+++ b/spec/acceptance/mysql_spec.rb
@@ -60,7 +60,7 @@ class { 'jira':
       }
     EOS
 
-    WGET_CMD='wget -q --tries=24 --retry-connrefused --read-timeout=10 --no-check-certificate localhost:8081'
+    WGET_CMD = 'wget -q --tries=24 --retry-connrefused --read-timeout=10 --no-check-certificate localhost:8081'.freeze
     apply_manifest(pp, catch_failures: true)
     sleep 60
     shell WGET_CMD, acceptable_exit_codes: [0, 8]
diff --git a/spec/classes/jira_config_spec.rb b/spec/classes/jira_config_spec.rb
index ab70d682..0436ef9d 100644
--- a/spec/classes/jira_config_spec.rb
+++ b/spec/classes/jira_config_spec.rb
@@ -1,13 +1,13 @@
 require 'spec_helper.rb'
 
 # set some constants to keep it DRY
-REGEXP_DISABLE_NOTIFICATIONS=%r{#DISABLE_NOTIFICATIONS=}
-REGEXP_POSTGRESQL_URL=%r{jdbc:postgresql://localhost:5432/jira}
-REGEXP_PUBLIC_SCHEMA=%r{<schema-name>public</schema-name>}
-
+REGEXP_DISABLE_NOTIFICATIONS = %r{#DISABLE_NOTIFICATIONS=}
+REGEXP_POSTGRESQL_URL = %r{jdbc:postgresql://localhost:5432/jira}
+REGEXP_PUBLIC_SCHEMA = %r{<schema-name>public</schema-name>}
+HTTP11 = 'HTTP/1.1'.freeze
+PLUGIN_SOURCE_URL = 'https://www.example.com/fine-jira-plugin.tgz'.freeze
 describe 'jira' do
   describe 'jira::config' do
-
     let(:params) do
       {
         javahome: '/opt/java',
@@ -89,7 +89,7 @@
                 connection_settings: 'TEST-SETTING;',
                 pool_max_size: 200,
                 pool_min_size: 10,
-                validation_query: 'SELECT myfunction();',
+                validation_query: 'SELECT myfunction();'
               )
             end
 
@@ -108,7 +108,7 @@
           context 'mysql params' do
             let(:params) do
               super().merge(
-                db: 'mysql',
+                db: 'mysql'
               )
             end
 
@@ -125,7 +125,7 @@
             let(:params) do
               super().merge(
                 db: 'oracle',
-                dbname: 'mydatabase',
+                dbname: 'mydatabase'
               )
             end
 
@@ -144,7 +144,7 @@
                 dbport: 1522,
                 dbserver: 'oracleserver',
                 oracle_use_sid: false,
-                dbname: 'mydatabase',
+                dbname: 'mydatabase'
               )
             end
 
@@ -162,7 +162,7 @@
                 dbserver: 'TheSQLServer',
                 dbname: 'TheJiraDB',
                 dbuser: 'TheDBUser',
-                dbpassword: 'TheDBPassword',
+                dbpassword: 'TheDBPassword'
               )
             end
 
@@ -185,7 +185,7 @@
                 dbserver: 'TheSQLServer',
                 dbname: 'TheJiraDB',
                 dbuser: 'TheDBUser',
-                dbpassword: 'TheDBPassword',
+                dbpassword: 'TheDBPassword'
               )
             end
 
@@ -227,7 +227,7 @@
                 dbserver: 'TheSQLServer',
                 dbname: 'TheJiraDB',
                 dbuser: 'TheDBUser',
-                dbpassword: 'TheDBPassword',
+                dbpassword: 'TheDBPassword'
               )
             end
 
@@ -309,7 +309,7 @@
             context 'version greater than 8' do
               let(:params) do
                 super().merge(
-                  version: '8.1.0',
+                  version: '8.1.0'
                 )
               end
 
@@ -350,7 +350,7 @@
           context 'tomcat port' do
             let(:params) do
               super().merge(
-                tomcat_port: 8888,
+                tomcat_port: 8888
               )
             end
 
@@ -363,7 +363,7 @@
           context 'tomcat acceptCount' do
             let(:params) do
               super().merge(
-                tomcat_accept_count: 200,
+                tomcat_accept_count: 200
               )
             end
 
@@ -376,7 +376,7 @@
           context 'tomcat MaxHttpHeaderSize' do
             let(:params) do
               super().merge(
-                tomcat_max_http_header_size: 4096,
+                tomcat_max_http_header_size: 4096
               )
             end
 
@@ -389,7 +389,7 @@
           context 'tomcat MinSpareThreads' do
             let(:params) do
               super().merge(
-                tomcat_min_spare_threads: 50,
+                tomcat_min_spare_threads: 50
               )
             end
 
@@ -402,7 +402,7 @@
           context 'tomcat ConnectionTimeout' do
             let(:params) do
               super().merge(
-                tomcat_connection_timeout: 25_000,
+                tomcat_connection_timeout: 25_000
               )
             end
 
@@ -415,7 +415,7 @@
           context 'tomcat EnableLookups' do
             let(:params) do
               super().merge(
-                tomcat_enable_lookups: true,
+                tomcat_enable_lookups: true
               )
             end
 
@@ -428,7 +428,7 @@
           context 'tomcat Protocol' do
             let(:params) do
               super().merge(
-                tomcat_protocol: 'HTTP/1.1',
+                tomcat_protocol: HTTP11
               )
             end
 
@@ -441,7 +441,7 @@
           context 'tomcat UseBodyEncodingForURI' do
             let(:params) do
               super().merge(
-                tomcat_use_body_encoding_for_uri: false,
+                tomcat_use_body_encoding_for_uri: false
               )
             end
 
@@ -454,7 +454,7 @@
           context 'tomcat DisableUploadTimeout' do
             let(:params) do
               super().merge(
-                tomcat_disable_upload_timeout: false,
+                tomcat_disable_upload_timeout: false
               )
             end
 
@@ -467,7 +467,7 @@
           context 'tomcat EnableLookups' do
             let(:params) do
               super().merge(
-                tomcat_enable_lookups: true,
+                tomcat_enable_lookups: true
               )
             end
 
@@ -480,7 +480,7 @@
           context 'tomcat maxThreads' do
             let(:params) do
               super().merge(
-                tomcat_max_threads: 300,
+                tomcat_max_threads: 300
               )
             end
 
@@ -497,7 +497,7 @@
                   'scheme'    => 'https',
                   'proxyName' => 'www.example.com',
                   'proxyPort' => '9999'
-                },
+                }
               )
             end
 
@@ -544,7 +544,7 @@
                   ajp: {
                     'port'     => '8009',
                     'protocol' => 'AJP/1.3'
-                  },
+                  }
                 )
               end
 
@@ -559,7 +559,7 @@
                   ajp: {
                     'port'     => '8009',
                     'protocol' => 'org.apache.coyote.ajp.AjpNioProtocol'
-                  },
+                  }
                 )
               end
 
@@ -578,7 +578,7 @@
                   8081 => {
                     'URIEncoding' => 'UTF-8',
                     'connectionTimeout' => '20000',
-                    'protocol' => 'HTTP/1.1',
+                    'protocol' => HTTP11,
                     'proxyName' => 'foo.example.com',
                     'proxyPort' => '8123',
                     'secure' => true,
@@ -587,12 +587,12 @@
                   8082 => {
                     'URIEncoding' => 'UTF-8',
                     'connectionTimeout' => '20000',
-                    'protocol' => 'HTTP/1.1',
+                    'protocol' => HTTP11,
                     'proxyName' => 'bar.example.com',
                     'proxyPort' => '8124',
                     'scheme' => 'http'
                   }
-                },
+                }
               )
             end
 
@@ -620,7 +620,7 @@
           context 'tomcat access log format' do
             let(:params) do
               super().merge(
-                tomcat_accesslog_format: '%a %{jira.request.id}r %{jira.request.username}r %t %I',
+                tomcat_accesslog_format: '%a %{jira.request.id}r %{jira.request.username}r %t %I'
               )
             end
 
@@ -633,7 +633,7 @@
           context 'tomcat access log format with x-forward-for handling' do
             let(:params) do
               super().merge(
-                tomcat_accesslog_enable_xforwarded_for: true,
+                tomcat_accesslog_enable_xforwarded_for: true
               )
             end
 
@@ -647,7 +647,7 @@
           context 'with script_check_java_managed enabled' do
             let(:params) do
               super().merge(
-                script_check_java_manage: true,
+                script_check_java_manage: true
               )
             end
 
@@ -660,7 +660,7 @@
           context 'context resources' do
             let(:params) do
               super().merge(
-                resources: { 'testdb' => { 'auth' => 'Container' } },
+                resources: { 'testdb' => { 'auth' => 'Container' } }
               )
             end
 
@@ -673,7 +673,7 @@
           context 'disable notifications' do
             let(:params) do
               super().merge(
-                disable_notifications: true,
+                disable_notifications: true
               )
             end
 
@@ -686,7 +686,7 @@
           context 'native ssl support default params' do
             let(:params) do
               super().merge(
-                tomcat_native_ssl: true,
+                tomcat_native_ssl: true
               )
             end
 
@@ -714,7 +714,7 @@
                 tomcat_key_alias: 'keystorealias',
                 tomcat_keystore_file: '/tmp/keyfile.ks',
                 tomcat_keystore_pass: 'keystorepass',
-                tomcat_keystore_type: 'PKCS12',
+                tomcat_keystore_type: 'PKCS12'
               )
             end
 
@@ -735,7 +735,7 @@
           context 'enable secure admin sessions' do
             let(:params) do
               super().merge(
-                enable_secure_admin_sessions: true,
+                enable_secure_admin_sessions: true
               )
             end
 
@@ -748,7 +748,7 @@
           context 'disable secure admin sessions' do
             let(:params) do
               super().merge(
-                enable_secure_admin_sessions: false,
+                enable_secure_admin_sessions: false
               )
             end
 
@@ -763,7 +763,7 @@
               super().merge(
                 jira_config_properties: {
                   'ops.bar.group.size.opsbar-transitions' => '4'
-                },
+                }
               )
             end
 
@@ -778,7 +778,7 @@
             let(:params) do
               super().merge(
                 datacenter: true,
-                shared_homedir: '/mnt/jira_shared_home_dir',
+                shared_homedir: '/mnt/jira_shared_home_dir'
               )
             end
 
@@ -796,7 +796,7 @@
                 shared_homedir: '/mnt/jira_shared_home_dir',
                 ehcache_listener_host: 'jira.foo.net',
                 ehcache_listener_port: 42,
-                ehcache_object_port: 401,
+                ehcache_object_port: 401
               )
             end
 
@@ -813,7 +813,7 @@
           context 'OpenJDK jvm params' do
             let(:params) do
               super().merge(
-                jvm_type: 'openjdk-11',
+                jvm_type: 'openjdk-11'
               )
             end
 
@@ -843,7 +843,7 @@
                 java_opts: '-XX:-TEST_OPTIONAL',
                 jvm_gc_args: '-XX:-TEST_GC_ARG',
                 jvm_code_cache_args: '-XX:-TEST_CODECACHE',
-                jvm_extra_args: '-XX:-TEST_EXTRA',
+                jvm_extra_args: '-XX:-TEST_EXTRA'
               )
             end
 
@@ -867,20 +867,108 @@
             it { is_expected.not_to contain_file(FILENAME_CHECK_JAVA_SH) }
           end
 
-          context 'simple plugin download' do
+          context 'simple plugin download without username and password' do
+            let(:params) do
+              super().merge(
+                plugins: [
+                  {
+                    installation_name: 'fine-jira-plugin.jar',
+                    source: PLUGIN_SOURCE_URL,
+                    ensure: 'present',
+                    checksum: '123abc',
+                    checksum_type: 'sha512'
+                  }
+                ]
+              )
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it do
+              is_expected.to contain_archive("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/lib/fine-jira-plugin.jar").
+                with({
+                       source: PLUGIN_SOURCE_URL,
+                       ensure: 'present',
+                       checksum: '123abc',
+                       checksum_type: 'sha512'
+                     })
+            end
+          end
+
+          context 'simple plugin download with username' do
+            let(:params) do
+              super().merge(
+                plugins: [
+                  {
+                    installation_name: 'fine-jira-plugin.jar',
+                    source: PLUGIN_SOURCE_URL,
+                    ensure: 'present',
+                    username: 'TheUser',
+                    checksum: '123abc',
+                    checksum_type: 'sha512'
+                  }
+                ]
+              )
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it do
+              is_expected.to contain_archive("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/lib/fine-jira-plugin.jar").
+                with({
+                       source: PLUGIN_SOURCE_URL,
+                       ensure: 'present',
+                       username: 'TheUser',
+                       checksum: '123abc',
+                       checksum_type: 'sha512'
+                     })
+            end
+          end
+
+          context 'simple plugin download with password' do
+            let(:params) do
+              super().merge(
+                plugins: [
+                  {
+                    installation_name: 'fine-jira-plugin.jar',
+                    source: PLUGIN_SOURCE_URL,
+                    ensure: 'present',
+                    password: 'ThePassword',
+                    checksum: '123abc',
+                    checksum_type: 'sha512'
+                  }
+                ]
+              )
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it do
+              is_expected.to contain_archive("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/lib/fine-jira-plugin.jar").
+                with({
+                       source: PLUGIN_SOURCE_URL,
+                       ensure: 'present',
+                       password: 'ThePassword',
+                       checksum: '123abc',
+                       checksum_type: 'sha512'
+                     })
+            end
+          end
+
+          context 'simple plugin download with username and password' do
             let(:params) do
               super().merge(
                 plugins: [
                   {
                     installation_name: 'fine-jira-plugin.jar',
-                    source: 'https://www.example.com/fine-jira-plugin.tgz',
+                    source: PLUGIN_SOURCE_URL,
                     ensure: 'present',
                     username: 'TheUser',
                     password: 'ThePassword',
                     checksum: '123abc',
-                    checksum_type: 'sha512',
+                    checksum_type: 'sha512'
                   }
-                ],
+                ]
               )
             end
 
@@ -889,12 +977,12 @@
             it do
               is_expected.to contain_archive("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/lib/fine-jira-plugin.jar").
                 with({
-                       source: 'https://www.example.com/fine-jira-plugin.tgz',
+                       source: PLUGIN_SOURCE_URL,
                        ensure: 'present',
                        username: 'TheUser',
                        password: 'ThePassword',
                        checksum: '123abc',
-                       checksum_type: 'sha512',
+                       checksum_type: 'sha512'
                      })
             end
 
@@ -906,7 +994,7 @@
                       'installation_name' => 'fine-jira-plugin.jar',
                       'ensure' => 'absent'
                     }
-                  ],
+                  ]
                 )
               end
 
diff --git a/spec/classes/jira_install_spec.rb b/spec/classes/jira_install_spec.rb
index 64744ac8..2438bddd 100644
--- a/spec/classes/jira_install_spec.rb
+++ b/spec/classes/jira_install_spec.rb
@@ -1,17 +1,16 @@
 require 'spec_helper.rb'
 
 # set some constants to keep it DRY
-DOWNLOAD_URL='https://product-downloads.atlassian.com/software/jira/downloads'
+DOWNLOAD_URL = 'https://product-downloads.atlassian.com/software/jira/downloads'.freeze
 
 describe 'jira' do
   describe 'jira::install' do
-
     let(:params) do
       {
         javahome: PATH_JAVA_HOME,
         installdir: PATH_JIRA_DIR,
         version: DEFAULT_VERSION,
-        product: 'jira',
+        product: 'jira'
       }
     end
 
diff --git a/spec/classes/jira_mysql_connector_spec.rb b/spec/classes/jira_mysql_connector_spec.rb
index 2b0cceb4..048439cb 100644
--- a/spec/classes/jira_mysql_connector_spec.rb
+++ b/spec/classes/jira_mysql_connector_spec.rb
@@ -1,17 +1,16 @@
 require 'spec_helper.rb'
 
 # set some constants to keep it DRY
-PATH_MYSQL_CONNECTOR='/opt/MySQL-connector'
-PATH_MYSQL_CONNECTOR_LIB="#{PATH_INSTALLATION_BASE}/lib/mysql-connector-java.jar"
+PATH_MYSQL_CONNECTOR = '/opt/MySQL-connector'.freeze
+PATH_MYSQL_CONNECTOR_LIB = "#{PATH_INSTALLATION_BASE}/lib/mysql-connector-java.jar".freeze
 
 describe 'jira' do
   describe 'jira::mysql_connector' do
-
     let(:params) do
       {
         javahome: PATH_JAVA_HOME,
         version: DEFAULT_VERSION,
-        db: 'mysql',
+        db: 'mysql'
       }
     end
 
diff --git a/spec/classes/jira_sso_spec.rb b/spec/classes/jira_sso_spec.rb
index 4124f7e5..8c6c1b8e 100644
--- a/spec/classes/jira_sso_spec.rb
+++ b/spec/classes/jira_sso_spec.rb
@@ -1,11 +1,10 @@
 require 'spec_helper.rb'
 
 # set some constants to keep it DRY
-PATH_CROWD_PROPS="#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/classes/crowd.properties"
+PATH_CROWD_PROPS = "#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/classes/crowd.properties".freeze
 
 describe 'jira' do
   describe 'jira::sso' do
-
     let(:params) do
       {
         javahome: '/opt/java',
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 63aae7cf..57a70076 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -16,19 +16,4 @@
   end
 end
 
-# set some constants to keep it DRY
-DEFAULT_VERSION = '8.13.5'
-PRODUCT_VERSION_STRING="atlassian-jira-software-#{DEFAULT_VERSION}"
-PRODUCT_VERSION_STRING_CORE = "atlassian-jira-core-#{DEFAULT_VERSION}"
-
-PATH_JAVA_HOME='/opt/java'
-PATH_JIRA_DIR='/opt/jira'
-PATH_INSTALLATION_BASE = "#{PATH_JIRA_DIR}/#{PRODUCT_VERSION_STRING}-standalone"
-
-FILENAME_SETENV_SH = "#{PATH_INSTALLATION_BASE}/bin/setenv.sh"
-FILENAME_USER_SH = "#{PATH_INSTALLATION_BASE}/bin/user.sh"
-FILENAME_CHECK_JAVA_SH = "#{PATH_INSTALLATION_BASE}/bin/check-java.sh"
-FILENAME_SERVER_XML = "#{PATH_INSTALLATION_BASE}/conf/server.xml"
-FILENAME_DBCONFIG_XML = '/home/jira/dbconfig.xml'
-FILENAME_CLUSTER_PROPS='/home/jira/cluster.properties'
-FILENAME_JIRA_CONFIG_PROPS='/home/jira/jira-config.properties'
+require 'support/acceptance/constants.rb'
diff --git a/spec/support/acceptance/constants.rb b/spec/support/acceptance/constants.rb
new file mode 100644
index 00000000..aeb8f814
--- /dev/null
+++ b/spec/support/acceptance/constants.rb
@@ -0,0 +1,16 @@
+# set some constants to keep it DRY
+DEFAULT_VERSION = '8.13.5'.freeze
+PRODUCT_VERSION_STRING = "atlassian-jira-software-#{DEFAULT_VERSION}".freeze
+PRODUCT_VERSION_STRING_CORE = "atlassian-jira-core-#{DEFAULT_VERSION}".freeze
+
+PATH_JAVA_HOME = '/opt/java'.freeze
+PATH_JIRA_DIR = '/opt/jira'.freeze
+PATH_INSTALLATION_BASE = "#{PATH_JIRA_DIR}/#{PRODUCT_VERSION_STRING}-standalone".freeze
+
+FILENAME_SETENV_SH = "#{PATH_INSTALLATION_BASE}/bin/setenv.sh".freeze
+FILENAME_USER_SH = "#{PATH_INSTALLATION_BASE}/bin/user.sh".freeze
+FILENAME_CHECK_JAVA_SH = "#{PATH_INSTALLATION_BASE}/bin/check-java.sh".freeze
+FILENAME_SERVER_XML = "#{PATH_INSTALLATION_BASE}/conf/server.xml".freeze
+FILENAME_DBCONFIG_XML = '/home/jira/dbconfig.xml'.freeze
+FILENAME_CLUSTER_PROPS = '/home/jira/cluster.properties'.freeze
+FILENAME_JIRA_CONFIG_PROPS = '/home/jira/jira-config.properties'.freeze