Allow re-enrollment to the same domain in case of policy data loss.

chrome/browser/policy/enterprise_install_attributes.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/enterprise_install_attributes.h"
 
 #include "base/logging.h"
 #include "chrome/browser/chromeos/cros/cryptohome_library.h"
 
 namespace policy {
 
 namespace {
 // Constants for the possible device modes that can be stored in the lockbox.
 const char kConsumerDeviceMode[] = "consumer";
 const char kEnterpiseDeviceMode[] = "enterprise";
 const char kKioskDeviceMode[] = "kiosk";
 const char kUnknownDeviceMode[] = "unknown";
 
 // Field names in the lockbox.
 const char kAttrEnterpriseDeviceId[] = "enterprise.device_id";
 const char kAttrEnterpriseDomain[] = "enterprise.domain";
 const char kAttrEnterpriseMode[] = "enterprise.mode";
 const char kAttrEnterpriseOwned[] = "enterprise.owned";
 const char kAttrEnterpriseUser[] = "enterprise.user";
 
-// Extract the domain from a given email.
-std::string ExtractDomainName(const std::string& email) {
-  size_t separator_pos = email.find('@');
-  if (separator_pos != email.npos && separator_pos < email.length() - 1)
-    return email.substr(separator_pos + 1);
-  else
-    NOTREACHED() << "Not a proper email address: " << email;
-  return std::string();
-}
-
 // Translates DeviceMode constants to strings used in the lockbox.
 std::string GetDeviceModeString(DeviceMode mode) {
   switch (mode) {
     case DEVICE_MODE_CONSUMER:
       return kConsumerDeviceMode;
     case DEVICE_MODE_ENTERPRISE:
       return kEnterpiseDeviceMode;
     case DEVICE_MODE_KIOSK:
       return kKioskDeviceMode;
     case DEVICE_MODE_PENDING:
@@ skipping 25 matching lines @@
       device_locked_(false),
       registration_mode_(DEVICE_MODE_PENDING) {}
 
 EnterpriseInstallAttributes::LockResult EnterpriseInstallAttributes::LockDevice(
     const std::string& user,
     DeviceMode device_mode,
     const std::string& device_id) {
   CHECK_NE(device_mode, DEVICE_MODE_PENDING);
   CHECK_NE(device_mode, DEVICE_MODE_NOT_SET);
 
+  std::string domain = ExtractDomainName(user);
+
   // Check for existing lock first.
   if (device_locked_) {
-    return !registration_user_.empty() && user == registration_user_ ?
+    return !registration_domain_.empty() && domain == registration_domain_ ?
         LOCK_SUCCESS : LOCK_WRONG_USER;
   }
 
   if (!cryptohome_ || !cryptohome_->InstallAttributesIsReady())
     return LOCK_NOT_READY;
 
   // Clearing the TPM password seems to be always a good deal.
   if (cryptohome_->TpmIsEnabled() &&
       !cryptohome_->TpmIsBeingOwned() &&
       cryptohome_->TpmIsOwned()) {
     cryptohome_->TpmClearStoredPassword();
   }
 
   // Make sure we really have a working InstallAttrs.
   if (cryptohome_->InstallAttributesIsInvalid()) {
     LOG(ERROR) << "Install attributes invalid.";
     return LOCK_BACKEND_ERROR;
   }
 
   if (!cryptohome_->InstallAttributesIsFirstInstall())
     return LOCK_WRONG_USER;
 
-  std::string domain = ExtractDomainName(user);
   std::string mode = GetDeviceModeString(device_mode);
 
   // Set values in the InstallAttrs and lock it.
   if (!cryptohome_->InstallAttributesSet(kAttrEnterpriseOwned, "true") ||
       !cryptohome_->InstallAttributesSet(kAttrEnterpriseUser, user) ||
       !cryptohome_->InstallAttributesSet(kAttrEnterpriseDomain, domain) ||
       !cryptohome_->InstallAttributesSet(kAttrEnterpriseMode, mode) ||
       !cryptohome_->InstallAttributesSet(kAttrEnterpriseDeviceId, device_id)) {
     LOG(ERROR) << "Failed writing attributes";
     return LOCK_BACKEND_ERROR;
@@ skipping 35 matching lines @@
     return std::string();
 
   return registration_device_id_;
 }
 
 DeviceMode EnterpriseInstallAttributes::GetMode() {
   ReadImmutableAttributes();
   return registration_mode_;
 }
 
+// static
+std::string EnterpriseInstallAttributes::ExtractDomainName(
+    const std::string& email) {
+  size_t separator_pos = email.find('@');
+  if (separator_pos != email.npos && separator_pos < email.length() - 1)
+    return email.substr(separator_pos + 1);
+  else
+    NOTREACHED() << "Not a proper email address: " << email;
+  return std::string();
+}
+
 void EnterpriseInstallAttributes::ReadImmutableAttributes() {
   if (device_locked_)
     return;
 
   if (cryptohome_ && cryptohome_->InstallAttributesIsReady()) {
     registration_mode_ = DEVICE_MODE_NOT_SET;
     if (!cryptohome_->InstallAttributesIsInvalid() &&
         !cryptohome_->InstallAttributesIsFirstInstall()) {
       device_locked_ = true;
       std::string enterprise_owned;
@@ skipping 27 matching lines @@
           registration_mode_ = GetDeviceModeFromString(mode);
       } else if (enterprise_user.empty() && enterprise_owned != "true") {
         // |registration_user_| is empty on consumer devices.
         registration_mode_ = DEVICE_MODE_CONSUMER;
       }
     }
   }
 }
 
 }  // namespace policy