Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/policy/browser_policy_connector.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/browser_policy_connector.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/file_path.h"
@@ skipping 38 matching lines @@
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/chromeos/cros/cros_library.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/cros_settings_provider.h"
 #include "chrome/browser/chromeos/system/statistics_provider.h"
 #include "chrome/browser/chromeos/system/timezone_settings.h"
 #include "chrome/browser/policy/app_pack_updater.h"
 #include "chrome/browser/policy/cros_user_policy_cache.h"
 #include "chrome/browser/policy/device_policy_cache.h"
+#include "chrome/browser/policy/network_configuration_updater.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #endif
 
 using content::BrowserThread;
 
 namespace policy {
 
 namespace {
 
 // Subdirectory in the user's profile for storing user policies.
@@ skipping 102 matching lines @@
 scoped_ptr<UserCloudPolicyManager>
     BrowserPolicyConnector::CreateCloudPolicyManager(Profile* profile) {
   scoped_ptr<UserCloudPolicyManager> manager;
   const CommandLine* command_line = CommandLine::ForCurrentProcess();
   if (command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
     bool wait_for_policy_fetch = false;
 #if defined(OS_CHROMEOS)
     // TODO(mnissler): Revisit once Chrome OS gains multi-profiles support.
     // Don't wait for a policy fetch if there's no logged in user.
     if (chromeos::UserManager::Get()->IsUserLoggedIn()) {
+      std::string email =
+          chromeos::UserManager::Get()->GetLoggedInUser().email();
       wait_for_policy_fetch =
-          g_browser_process->browser_policy_connector()->GetUserAffiliation(
-              chromeos::UserManager::Get()->GetLoggedInUser().email()) ==
-                  policy::USER_AFFILIATION_MANAGED;
+          GetUserAffiliation(email) == USER_AFFILIATION_MANAGED;

[Mattias Nissler (ping if slow), 2012/09/05 11:19:05]

Ah, I guess I should have refrained from publishing that hacked-up CL back then
;)

     }
 #else
     // On desktop, there's no way to figure out if a user is logged in yet
     // because prefs are not yet initialized. So we do not block waiting for
     // the policy fetch to happen (because that would inhibit startup for
     // non-signed-in users) and instead rely on the fact that a signed-in
     // profile will already have policy downloaded. If no policy is available
     // (due to a previous fetch failing), the normal policy refresh mechanism
     // will cause it to get downloaded eventually.
 #endif
@@ skipping 144 matching lines @@
   if (device_cloud_policy_subsystem_.get()) {
     device_cloud_policy_subsystem_->
         ScheduleServiceInitialization(delay_milliseconds);
   }
 #endif
 }
 
 void BrowserPolicyConnector::InitializeUserPolicy(
     const std::string& user_name,
     bool wait_for_policy_fetch) {
+#if defined(OS_CHROMEOS)
+  // If the user is managed then importing certificates from ONC policy is
+  // allowed, otherwise it's not. Update this flag once the user has signed in,
+  // and before user policy is loaded.
+  GetNetworkConfigurationUpdater()->set_allow_web_trust(
+      GetUserAffiliation(user_name) == USER_AFFILIATION_MANAGED);
+#endif
+
   // Throw away the old backend.
   user_cloud_policy_subsystem_.reset();
   user_policy_token_cache_.reset();
   user_data_store_.reset();
   token_service_ = NULL;
   registrar_.RemoveAll();
 
   CommandLine* command_line = CommandLine::ForCurrentProcess();
 
   int64 startup_delay =
@@ skipping 119 matching lines @@
         g_browser_process->system_request_context();
     if (request_context)
       app_pack_updater_.reset(new AppPackUpdater(request_context, this));
   }
   return app_pack_updater_.get();
 #else
   return NULL;
 #endif
 }
 
+NetworkConfigurationUpdater*
+    BrowserPolicyConnector::GetNetworkConfigurationUpdater() {
+#if defined(OS_CHROMEOS)
+  if (!network_configuration_updater_.get()) {
+    network_configuration_updater_.reset(new NetworkConfigurationUpdater(
+        g_browser_process->policy_service(),
+        chromeos::CrosLibrary::Get()->GetNetworkLibrary()));
+  }
+  return network_configuration_updater_.get();
+#else
+  return NULL;
+#endif
+}
+
 // static
 void BrowserPolicyConnector::SetPolicyProviderForTesting(
     ConfigurationPolicyProvider* provider) {
   DCHECK(!g_testing_provider);
   g_testing_provider = provider;
 }
 
 // static
 std::string BrowserPolicyConnector::GetDeviceManagementUrl() {
   CommandLine* command_line = CommandLine::ForCurrentProcess();
@@ skipping 142 matching lines @@
     return new AsyncPolicyProvider(loader.Pass());
   } else {
     return NULL;
   }
 #else
   return NULL;
 #endif
 }
 
 }  // namespace policy