Validate your assumptions.
If this is supposed to be a black box test, they should not get or require any passwords whatsoever.
If this is supposed to be a config review, or white box tests, some passwords should be handed over. The correct procedure is to change them before the test to something unique (random string), and then change them again after the test.
Check with your management and explicitly ask if proper NDAs and contracts have been signed.
Is this normal for a pentest?
The scenario as you described it is unusual, but not entirely implausible. It all depends on what exactly was agreed for the test scope and activities.
I assumed it would mostly be black box. How should I proceed?
Check with the manager responsible for signing this pentesting team. Your CISO or CSO or IT manager or whoever it may be. Voice your concerns and ask if this approach was agreed upon.
Giving Passwords / Source Code
Personally, I would not give any passwords or source code to anyone without a proper NDA signed. I would also never, ever, give them the actual passwords. In all the pentests I've been involved in, on both sides as both customer and project manager (I'm not a pentester, but I've managed pentesters) there were always user accounts created for the pentest and passwords changed. We even recommend to our customers to change them after the test is done (some don't, that's always a sad finding for the next report).
As for what some answers wrote about "evaluating password strength" - that's a load of hogwash. Yes, there is a "best practice" on good passwords, which some guy pulled out of thin air some decades ago and is terribly sorry for today. All the math on the subject is full of holes and unverified assumptions and a lot of password policies actually reduce the search space instead of enlarging it.
The only real test for password strength has two parts: One, get the top 10,000 or so passwords from one of the 20 or so lists that float around the Internet and use that as a blacklist. Two, run the same cracking software that bad guys use (most of them are Free Software) on your password hashes. If your instance of John cracks it, so will theirs.