Add support for loading user cloud policy on desktop.

chrome/browser/policy/browser_policy_connector.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/browser_policy_connector.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/file_path.h"
 #include "base/path_service.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/policy/async_policy_provider.h"
 #include "chrome/browser/policy/cloud_policy_client.h"
 #include "chrome/browser/policy/cloud_policy_provider.h"
 #include "chrome/browser/policy/cloud_policy_service.h"
 #include "chrome/browser/policy/cloud_policy_subsystem.h"
 #include "chrome/browser/policy/configuration_policy_provider.h"
 #include "chrome/browser/policy/device_management_service.h"
 #include "chrome/browser/policy/managed_mode_policy_provider.h"
 #include "chrome/browser/policy/managed_mode_policy_provider_factory.h"
 #include "chrome/browser/policy/policy_service_impl.h"
 #include "chrome/browser/policy/user_cloud_policy_manager.h"
 #include "chrome/browser/policy/user_policy_cache.h"
 #include "chrome/browser/policy/user_policy_token_cache.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/token_service.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/common/net/gaia/gaia_auth_util.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
 #include "chrome/common/pref_names.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_source.h"
 #include "grit/generated_resources.h"
 #include "policy/policy_constants.h"
 
 #if defined(OS_WIN)
 #include "chrome/browser/policy/policy_loader_win.h"
 #elif defined(OS_MACOSX)
 #include "chrome/browser/policy/policy_loader_mac.h"
 #include "chrome/browser/preferences_mac.h"
 #elif defined(OS_POSIX)
 #include "chrome/browser/policy/config_dir_policy_loader.h"
 #endif
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/cros/cros_library.h"
+#include "chrome/browser/chromeos/login/authenticator.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/chromeos/system/statistics_provider.h"
 #include "chrome/browser/policy/app_pack_updater.h"
 #include "chrome/browser/policy/cros_user_policy_cache.h"
 #include "chrome/browser/policy/device_policy_cache.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #endif
 
 using content::BrowserThread;
 
 namespace policy {
 
 namespace {
 
 // Subdirectory in the user's profile for storing user policies.
 const FilePath::CharType kPolicyDir[] = FILE_PATH_LITERAL("Device Management");
 // File in the above directory for stroing user policy dmtokens.
 const FilePath::CharType kTokenCacheFile[] = FILE_PATH_LITERAL("Token");
 // File in the above directory for storing user policy data.
 const FilePath::CharType kPolicyCacheFile[] = FILE_PATH_LITERAL("Policy");
 
 // The following constants define delays applied before the initial policy fetch
 // on startup. (So that displaying Chrome's GUI does not get delayed.)
 // Delay in milliseconds from startup.
 const int64 kServiceInitializationStartupDelay = 5000;
 
+// The URL for the device management server.
+const char kDefaultDeviceManagementServerUrl[] =
+    "https://m.google.com/devicemanagement/data/api";
+
 #if defined(OS_CHROMEOS)
 // MachineInfo key names.
 const char kMachineInfoSystemHwqual[] = "hardware_class";
 
 // These are the machine serial number keys that we check in order until we
 // find a non-empty serial number. The VPD spec says the serial number should be
 // in the "serial_number" key for v2+ VPDs. However, legacy devices used a
 // different keys to report their serial number, which we fall back to if
 // "serial_number" is not present.
 const char* kMachineInfoSerialNumberKeys[] = {
@@ skipping 24 matching lines @@
   device_data_store_.reset();
 #endif
 
   // Shutdown user cloud policy.
   if (user_cloud_policy_subsystem_.get())
     user_cloud_policy_subsystem_->Shutdown();
   user_cloud_policy_subsystem_.reset();
   user_policy_token_cache_.reset();
   user_data_store_.reset();
 
-  if (user_cloud_policy_manager_.get())
-    user_cloud_policy_manager_->Shutdown();
-  user_cloud_policy_manager_.reset();
-
   device_management_service_.reset();
 }
 
 void BrowserPolicyConnector::Init() {
-  platform_provider_.reset(CreatePlatformProvider());
+  DCHECK(!device_management_service_.get()) <<
+      "BrowserPolicyConnector::Init() called twice.";
+  // Don't create platform providers if running in a unit test, since
+  // AsyncPlatformLoader requires deletion on the FILE thread.
+  if (MessageLoop::current())
+    platform_provider_.reset(CreatePlatformProvider());
+
+  device_management_service_.reset(
+      new DeviceManagementService(GetDeviceManagementUrl()));
 
 #if defined(OS_CHROMEOS)
-  // The CloudPolicyProvider blocks asynchronous Profile creation until a login
-  // is performed. This is used to ensure that the Profile's PrefService sees
-  // managed preferences on managed Chrome OS devices. However, this also
-  // prevents creation of new Profiles in Desktop Chrome. The implementation of
-  // cloud policy on the Desktop requires a refactoring of the cloud provider,
-  // but for now it just isn't created.
   CommandLine* command_line = CommandLine::ForCurrentProcess();
-  if (command_line->HasSwitch(switches::kDeviceManagementUrl)) {
-    device_management_service_.reset(
-        new DeviceManagementService(
-            command_line->GetSwitchValueASCII(switches::kDeviceManagementUrl)));
-    if (!command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
-      managed_cloud_provider_.reset(new CloudPolicyProvider(
-          this,
-          POLICY_LEVEL_MANDATORY));
-      recommended_cloud_provider_.reset(new CloudPolicyProvider(
-          this,
-          POLICY_LEVEL_RECOMMENDED));
-    }
+  if (!command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
+    managed_cloud_provider_.reset(new CloudPolicyProvider(
+        this,
+        POLICY_LEVEL_MANDATORY));
+    recommended_cloud_provider_.reset(new CloudPolicyProvider(
+        this,
+        POLICY_LEVEL_RECOMMENDED));
   }
 
   InitializeDevicePolicy();
 
+  // Don't bother updating the cache if this is a unit test.
+  if (!MessageLoop::current())
+    return;
+
   // Create the AppPackUpdater to start updating the cache. It requires the
   // system request context, which isn't available yet; therefore it is
   // created only once the loops are running.
   MessageLoop::current()->PostTask(
       FROM_HERE,
       base::Bind(base::IgnoreResult(&BrowserPolicyConnector::GetAppPackUpdater),
                  weak_ptr_factory_.GetWeakPtr()));
 #endif
 }
 
-PolicyService* BrowserPolicyConnector::CreatePolicyService(
+scoped_ptr<UserCloudPolicyManager>
+    BrowserPolicyConnector::CreateCloudPolicyManager(Profile* profile) {
+  scoped_ptr<UserCloudPolicyManager> manager;
+  const CommandLine* command_line = CommandLine::ForCurrentProcess();
+  if (command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
+    bool wait_for_policy_fetch = false;
+#if defined(OS_CHROMEOS)
+    // TODO(mnissler): Revisit once Chrome OS gains multi-profiles support.
+    // Don't wait for a policy fetch if there's no logged in user.
+    if (chromeos::UserManager::Get()->IsUserLoggedIn()) {
+      wait_for_policy_fetch =
+          g_browser_process->browser_policy_connector()->GetUserAffiliation(
+              chromeos::UserManager::Get()->GetLoggedInUser().email()) ==
+                  policy::USER_AFFILIATION_MANAGED;
+    }
+#else
+    // On desktop, there's no way to figure out if a user is logged in yet
+    // because prefs are not yet initialized. So we do not block waiting for
+    // the policy fetch to happen (because that would inhibit startup for
+    // non-signed-in users) and instead rely on the fact that a signed-in
+    // profile will already have policy downloaded. If no policy is available
+    // (due to a previous fetch failing), the normal policy refresh mechanism
+    // will cause it to get downloaded eventually.
+#endif
+    manager = UserCloudPolicyManager::Create(profile, wait_for_policy_fetch);
+  }
+  return manager.Pass();
+}
+
+scoped_ptr<PolicyService> BrowserPolicyConnector::CreatePolicyService(
     Profile* profile) {
   // |providers| in decreasing order of priority.
   PolicyServiceImpl::Providers providers;
   if (g_testing_provider)
     providers.push_back(g_testing_provider);
   if (platform_provider_.get())
     providers.push_back(platform_provider_.get());
   if (managed_cloud_provider_.get())
     providers.push_back(managed_cloud_provider_.get());
   if (recommended_cloud_provider_.get())
     providers.push_back(recommended_cloud_provider_.get());
 
   // The global policy service uses the proxy provider to allow for swapping in
   // user policy after startup, while profiles use |user_cloud_policy_manager_|
   // directly as their provider, which may also block initialization on a policy
   // fetch at login time.
   if (profile) {
-    if (user_cloud_policy_manager_.get())
-      providers.push_back(user_cloud_policy_manager_.get());
+    UserCloudPolicyManager* manager = profile->GetUserCloudPolicyManager();
+    if (manager)
+      providers.push_back(manager);
 
     providers.push_back(
         ManagedModePolicyProviderFactory::GetForProfile(profile));
   } else {
     providers.push_back(&user_cloud_policy_provider_);
   }
 
-  return new PolicyServiceImpl(providers);
+  return scoped_ptr<PolicyService>(new PolicyServiceImpl(providers)).Pass();
 }
 
 void BrowserPolicyConnector::RegisterForDevicePolicy(
     const std::string& owner_email,
     const std::string& token,
     bool known_machine_id,
     bool reregister) {
 #if defined(OS_CHROMEOS)
   if (device_data_store_.get()) {
     if (!device_data_store_->device_token().empty()) {
@@ skipping 96 matching lines @@
     user_cloud_policy_subsystem_->
         ScheduleServiceInitialization(delay_milliseconds);
   }
 #if defined(OS_CHROMEOS)
   if (device_cloud_policy_subsystem_.get()) {
     device_cloud_policy_subsystem_->
         ScheduleServiceInitialization(delay_milliseconds);
   }
 #endif
 }
+
 void BrowserPolicyConnector::InitializeUserPolicy(
     const std::string& user_name,
     bool wait_for_policy_fetch) {
   // Throw away the old backend.
-  user_cloud_policy_manager_.reset();
-
   user_cloud_policy_subsystem_.reset();
   user_policy_token_cache_.reset();
   user_data_store_.reset();
   token_service_ = NULL;
   registrar_.RemoveAll();
 
   CommandLine* command_line = CommandLine::ForCurrentProcess();
 
-  if (command_line->HasSwitch(switches::kDeviceManagementUrl)) {
-    int64 startup_delay =
-        wait_for_policy_fetch ? 0 : kServiceInitializationStartupDelay;
+  int64 startup_delay =
+      wait_for_policy_fetch ? 0 : kServiceInitializationStartupDelay;
 
-    if (command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
+  if (!command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
+    FilePath profile_dir;
+    PathService::Get(chrome::DIR_USER_DATA, &profile_dir);
 #if defined(OS_CHROMEOS)
-      user_cloud_policy_manager_ =
-          UserCloudPolicyManager::Create(wait_for_policy_fetch);
-      user_cloud_policy_manager_->Initialize(g_browser_process->local_state(),
-                                             device_management_service_.get(),
-                                             GetUserAffiliation(user_name));
-      user_cloud_policy_provider_.SetDelegate(user_cloud_policy_manager_.get());
+    profile_dir = profile_dir.Append(
+        command_line->GetSwitchValuePath(switches::kLoginProfile));
+#endif
+    const FilePath policy_dir = profile_dir.Append(kPolicyDir);
+    const FilePath policy_cache_file = policy_dir.Append(kPolicyCacheFile);
+    const FilePath token_cache_file = policy_dir.Append(kTokenCacheFile);
+    CloudPolicyCacheBase* user_policy_cache = NULL;
 
-      device_management_service_->ScheduleInitialization(startup_delay);
-#endif
-    } else {
-      FilePath profile_dir;
-      PathService::Get(chrome::DIR_USER_DATA, &profile_dir);
+    user_data_store_.reset(CloudPolicyDataStore::CreateForUserPolicies());
 #if defined(OS_CHROMEOS)
-      profile_dir = profile_dir.Append(
-          command_line->GetSwitchValuePath(switches::kLoginProfile));
-#endif
-      const FilePath policy_dir = profile_dir.Append(kPolicyDir);
-      const FilePath policy_cache_file = policy_dir.Append(kPolicyCacheFile);
-      const FilePath token_cache_file = policy_dir.Append(kTokenCacheFile);
-      CloudPolicyCacheBase* user_policy_cache = NULL;
+    user_policy_cache =
+        new CrosUserPolicyCache(
+            chromeos::DBusThreadManager::Get()->GetSessionManagerClient(),
+            user_data_store_.get(),
+            wait_for_policy_fetch,
+            token_cache_file,
+            policy_cache_file);
+#else
+    user_policy_cache = new UserPolicyCache(policy_cache_file,
+                                            wait_for_policy_fetch);
+    user_policy_token_cache_.reset(
+        new UserPolicyTokenCache(user_data_store_.get(), token_cache_file));
 
-      user_data_store_.reset(CloudPolicyDataStore::CreateForUserPolicies());
-#if defined(OS_CHROMEOS)
-      user_policy_cache =
-          new CrosUserPolicyCache(
-              chromeos::DBusThreadManager::Get()->GetSessionManagerClient(),
-              user_data_store_.get(),
-              wait_for_policy_fetch,
-              token_cache_file,
-              policy_cache_file);
-#else
-      user_policy_cache = new UserPolicyCache(policy_cache_file,
-                                              wait_for_policy_fetch);
-      user_policy_token_cache_.reset(
-          new UserPolicyTokenCache(user_data_store_.get(), token_cache_file));
-
-      // Initiate the DM-Token load.
-      user_policy_token_cache_->Load();
+    // Initiate the DM-Token load.
+    user_policy_token_cache_->Load();
 #endif
 
-      user_cloud_policy_subsystem_.reset(new CloudPolicySubsystem(
-          user_data_store_.get(),
-          user_policy_cache));
+    user_cloud_policy_subsystem_.reset(new CloudPolicySubsystem(
+        user_data_store_.get(),
+        user_policy_cache,
+        GetDeviceManagementUrl()));
 
-      user_data_store_->set_user_name(user_name);
-      user_data_store_->set_user_affiliation(GetUserAffiliation(user_name));
+    user_data_store_->set_user_name(user_name);
+    user_data_store_->set_user_affiliation(GetUserAffiliation(user_name));
 
-      user_cloud_policy_subsystem_->CompleteInitialization(
-          prefs::kUserPolicyRefreshRate,
-          startup_delay);
+    user_cloud_policy_subsystem_->CompleteInitialization(
+        prefs::kUserPolicyRefreshRate,
+        startup_delay);
 
-      managed_cloud_provider_->SetUserPolicyCache(user_policy_cache);
-      recommended_cloud_provider_->SetUserPolicyCache(user_policy_cache);
-    }
+    managed_cloud_provider_->SetUserPolicyCache(user_policy_cache);
+    recommended_cloud_provider_->SetUserPolicyCache(user_policy_cache);
   }
 }
 
 void BrowserPolicyConnector::SetUserPolicyTokenService(
     TokenService* token_service) {
   token_service_ = token_service;
   registrar_.Add(this,
                  chrome::NOTIFICATION_TOKEN_AVAILABLE,
                  content::Source<TokenService>(token_service_));
 
@@ skipping 11 matching lines @@
     // the user policy cache of this, so that a potential blocked login
     // proceeds without waiting for user policy.
     if (user_cloud_policy_subsystem_.get()) {
       user_cloud_policy_subsystem_->GetCloudPolicyCacheBase()->
           SetFetchingDone();
     }
   } else {
     if (user_data_store_.get())
       user_data_store_->SetOAuthToken(oauth_token);
   }
-  if (user_cloud_policy_manager_.get()) {
-    CloudPolicyService* service =
-        user_cloud_policy_manager_->cloud_policy_service();
-    if (service->client() &&
-        !service->client()->is_registered() &&
-        !oauth_token.empty()) {
-      service->client()->Register(oauth_token);
-    } else {
-      user_cloud_policy_manager_->CancelWaitForPolicyFetch();
-    }
-  }
 }
 
 CloudPolicyDataStore* BrowserPolicyConnector::GetDeviceCloudPolicyDataStore() {
 #if defined(OS_CHROMEOS)
   return device_data_store_.get();
 #else
   return NULL;
 #endif
 }
 
 CloudPolicyDataStore* BrowserPolicyConnector::GetUserCloudPolicyDataStore() {
   return user_data_store_.get();
 }
 
 const ConfigurationPolicyHandlerList*
     BrowserPolicyConnector::GetHandlerList() const {
   return &handler_list_;
 }
 
 UserAffiliation BrowserPolicyConnector::GetUserAffiliation(
     const std::string& user_name) {
 #if defined(OS_CHROMEOS)
   if (install_attributes_.get()) {
-    size_t pos = user_name.find('@');
+    std::string canonicalized_user_name(gaia::CanonicalizeEmail(user_name));
+    size_t pos = canonicalized_user_name.find('@');
     if (pos != std::string::npos &&
-        user_name.substr(pos + 1) == install_attributes_->GetDomain()) {
+        canonicalized_user_name.substr(pos + 1) ==
+            install_attributes_->GetDomain()) {
       return USER_AFFILIATION_MANAGED;
     }
   }
 #endif
 
   return USER_AFFILIATION_NONE;
 }
 
 AppPackUpdater* BrowserPolicyConnector::GetAppPackUpdater() {
 #if defined(OS_CHROMEOS)
@@ skipping 10 matching lines @@
 #endif
 }
 
 // static
 void BrowserPolicyConnector::SetPolicyProviderForTesting(
     ConfigurationPolicyProvider* provider) {
   DCHECK(!g_testing_provider);
   g_testing_provider = provider;
 }
 
+// static
+std::string BrowserPolicyConnector::GetDeviceManagementUrl() {
+  CommandLine* command_line = CommandLine::ForCurrentProcess();
+  if (command_line->HasSwitch(switches::kDeviceManagementUrl))
+    return command_line->GetSwitchValueASCII(switches::kDeviceManagementUrl);
+  else
+    return kDefaultDeviceManagementServerUrl;
+}
+
 void BrowserPolicyConnector::Observe(
     int type,
     const content::NotificationSource& source,
     const content::NotificationDetails& details) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   if (type == chrome::NOTIFICATION_TOKEN_AVAILABLE) {
     const TokenService* token_source =
         content::Source<const TokenService>(source).ptr();
     DCHECK_EQ(token_service_, token_source);
     const TokenService::TokenAvailableDetails* token_details =
@@ skipping 27 matching lines @@
       install_attributes_.reset(new EnterpriseInstallAttributes(cryptohome));
       DevicePolicyCache* device_policy_cache =
           new DevicePolicyCache(device_data_store_.get(),
                                 install_attributes_.get());
 
       managed_cloud_provider_->SetDevicePolicyCache(device_policy_cache);
       recommended_cloud_provider_->SetDevicePolicyCache(device_policy_cache);
 
       device_cloud_policy_subsystem_.reset(new CloudPolicySubsystem(
           device_data_store_.get(),
-          device_policy_cache));
+          device_policy_cache,
+          GetDeviceManagementUrl()));
+
+      // Skip the final initialization if this is a unit test.
+      if (!MessageLoop::current())
+        return;
 
       // Initialize the subsystem once the message loops are spinning.
       MessageLoop::current()->PostTask(
           FROM_HERE,
           base::Bind(&BrowserPolicyConnector::CompleteInitialization,
                      weak_ptr_factory_.GetWeakPtr()));
     }
   }
 #endif
 }
@@ skipping 54 matching lines @@
     return new AsyncPolicyProvider(loader.Pass());
   } else {
     return NULL;
   }
 #else
   return NULL;
 #endif
 }
 
 }  // namespace policy