Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/policy/network_configuration_updater.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/network_configuration_updater.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "chrome/browser/chromeos/cros/network_library.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/policy/policy_map.h"
 #include "policy/policy_constants.h"
 
 namespace policy {
 
 const char NetworkConfigurationUpdater::kEmptyConfiguration[] =
     "{\"NetworkConfigurations\":[],\"Certificates\":[]}";
 
 NetworkConfigurationUpdater::NetworkConfigurationUpdater(
     PolicyService* policy_service,
-    chromeos::NetworkLibrary* network_library)
+    BrowserPolicyConnector* connector,
+    chromeos::NetworkLibrary* network_library,
+    chromeos::UserManager* user_manager)
     : policy_change_registrar_(
           policy_service, POLICY_DOMAIN_CHROME, std::string()),
-      network_library_(network_library) {
+      connector_(connector),
+      network_library_(network_library),
+      user_manager_(user_manager) {
   DCHECK(network_library_);
   policy_change_registrar_.Observe(
       key::kDeviceOpenNetworkConfiguration,
       base::Bind(&NetworkConfigurationUpdater::ApplyNetworkConfiguration,
                  base::Unretained(this),
                  chromeos::NetworkUIData::ONC_SOURCE_DEVICE_POLICY,
                  &device_network_config_));
   policy_change_registrar_.Observe(
       key::kOpenNetworkConfiguration,
       base::Bind(&NetworkConfigurationUpdater::ApplyNetworkConfiguration,
@@ skipping 30 matching lines @@
     if (!current->GetAsString(&new_network_config))
       LOG(WARNING) << "Invalid network configuration.";
   }
 
   // We need to load an empty configuration to get rid of any configuration
   // that has been installed previously. An empty string also works, but
   // generates warnings and errors, which we'd like to avoid.
   if (new_network_config.empty())
     new_network_config = kEmptyConfiguration;
 
+  // Web trust certificates are only allowed for managed users on managed
+  // devices of the same domain.
+  const bool allow_web_trust_from_policy =
+      user_manager_->IsUserLoggedIn() &&
+      !user_manager_->IsLoggedInAsGuest() &&
+      connector_->GetUserAffiliation(
+          user_manager_->GetLoggedInUser().email()) == USER_AFFILIATION_MANAGED;
+
   if (*cached_value != new_network_config) {
     *cached_value = new_network_config;
     std::string error;
     if (!network_library_->LoadOncNetworks(new_network_config, "", onc_source,
+                                           allow_web_trust_from_policy,
                                            &error)) {
       LOG(WARNING) << "Network library failed to load ONC configuration:"
                    << error;
     }
   }
 }
 
 }  // namespace policy