You can't expect an objective experience when the service offers a higher service to businesses for money. And the paid search results aren't even relevant.
I once had the displeasure of using Fogbugz (hosted version). You could only reply to a bug if it was sent in via E-mail. Any other correspondence was to be performed via actually editing the ticket data, inline.
I called to ask if there was a way and the dude I talked to actually insinuated that I had not taken time to read the documentation. WTF?
Apparently that requirement was a "feature" -- they assumed that a bug entered manually did not require correspondence.
What I mean is that in order to manage user accounts, the management tool (Puppet) will have to know what the encrypted password is so it can insert it into /etc/shadow. Otherwise you have no password and must rely on NOPASSWD in sudoers if you want to log into that managed machine and use sudo.
If the system doesn't have a password for you in /etc/shadow, sudo can't authenticate you via getpwent or whatever.
So your only two options are to write a tool for users to update their password in Puppet directly/indirectly, or allow NOPASSWD and religiously check for empty passphrases on SSH keypairs.
...NOT!