Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/chromeos/chrome_browser_main_chromeos.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/chrome_browser_main_chromeos.h"
 
 #include <string>
 #include <vector>
 
 #include "ash/shell.h"
@@ skipping 397 matching lines @@
       g_browser_process->browser_policy_connector()->InitializeUserPolicy(
           username, false  /* wait_for_policy_fetch */);
     }
     chromeos::UserManager::Get()->SessionStarted();
   }
 
   // In Aura builds this will initialize ash::Shell.
   ChromeBrowserMainPartsLinux::PreProfileInit();
 }
 
 void ChromeBrowserMainPartsChromeos::PostProfileInit() {

[Mattias Nissler (ping if slow), 2012/09/04 09:57:04]

Does this also run for the login profile? I guess not, in which case the code
below will never get a logged-in user and therefore fail.

[Joao da Silva, 2012/09/04 12:52:55]

Yikes, of course. This means that the NetworkConfigurationUpdater has to be
created before sign-in (for device-level ONC before sign-in), and after sign-in
it has to receive an updated flag (once we can determine if the user is managed
or not). It also means that it can't be owned from here, since the instance
isn't exposed anywhere.

I've moved ownership of the NCU to the BrowserPolicyConnector for this reason,
and update the flag from there after the user signs in.

   // -- This used to be in ChromeBrowserMainParts::PreMainMessageLoopRun()
   // -- just after CreateProfile().
 
+  policy::BrowserPolicyConnector* connector =
+      g_browser_process->browser_policy_connector();
+
   if (parsed_command_line().HasSwitch(switches::kLoginUser) &&
       !parsed_command_line().HasSwitch(switches::kLoginPassword)) {
     // Pass the TokenService pointer to the policy connector so user policy can
     // grab a token and register with the policy server.
     // TODO(mnissler): Remove once OAuth is the only authentication mechanism.
-    g_browser_process->browser_policy_connector()->SetUserPolicyTokenService(
+    connector->SetUserPolicyTokenService(
         TokenServiceFactory::GetForProfile(profile()));
 
     // Make sure we flip every profile to not share proxies if the user hasn't
     // specified so explicitly.
     const PrefService::Preference* use_shared_proxies_pref =
         profile()->GetPrefs()->FindPreference(prefs::kUseSharedProxies);
     if (use_shared_proxies_pref->IsDefaultValue())
       profile()->GetPrefs()->SetBoolean(prefs::kUseSharedProxies, false);
   }
 
+  // Web trust certificates are only allowed for managed users on managed
+  // devices of the same domain.
+  chromeos::UserManager* user_manager = chromeos::UserManager::Get();
+  const std::string email = user_manager->GetLoggedInUser().email();
+  const bool allow_web_trust_from_policy =
+      !user_manager->IsLoggedInAsGuest() &&

[Mattias Nissler (ping if slow), 2012/09/04 09:57:04]

I guess we should rather check of regular logins to avoid retail and other
upcoming stuff?

[Joao da Silva, 2012/09/04 12:52:55]

Yes, that's more future-proof :-) With the NCU in the BPC this isn't an issue,
since InitializeUserPolicy() is only called for "real" users.

+      connector->GetUserAffiliation(email) == policy::USER_AFFILIATION_MANAGED;
   network_config_updater_.reset(
       new policy::NetworkConfigurationUpdater(
           g_browser_process->policy_service(),
-          chromeos::CrosLibrary::Get()->GetNetworkLibrary()));
+          chromeos::CrosLibrary::Get()->GetNetworkLibrary(),
+          allow_web_trust_from_policy));
 
   // Make sure that wallpaper boot transition and other delays in OOBE
   // are disabled for tests by default.
   // Individual tests may enable them if they want.
   if (parsed_command_line().HasSwitch(switches::kTestType))
     chromeos::WizardController::SetZeroDelays();
 
   // Tests should be able to tune login manager before showing it.
   // Thus only show login manager in normal (non-testing) mode.
   if (!parameters().ui_task)
@@ skipping 159 matching lines @@
       LOG(WARNING) << "low_mem: Part of '100MB' experiment";
       chromeos::LowMemoryObserver::SetLowMemoryMargin(100);
     } else if (trial->group() == margin_200mb) {
       LOG(WARNING) << "low_mem: Part of '200MB' experiment";
       chromeos::LowMemoryObserver::SetLowMemoryMargin(200);
     } else {
       LOG(WARNING) << "low_mem: Part of 'default' experiment";
     }
   }
 }