Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/policy/network_configuration_updater.cc

Index: chrome/browser/policy/network_configuration_updater.cc
diff --git a/chrome/browser/policy/network_configuration_updater.cc b/chrome/browser/policy/network_configuration_updater.cc
index dcc2ead8be498098890ecffd0c1112a6267d46ce..8c9a30e767c9641eb328ff04d8efe36df6597afa 100644
--- a/chrome/browser/policy/network_configuration_updater.cc
+++ b/chrome/browser/policy/network_configuration_updater.cc
@@ -9,6 +9,8 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "chrome/browser/chromeos/cros/network_library.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/policy/policy_map.h"
 #include "policy/policy_constants.h"
 
@@ -19,10 +21,14 @@ const char NetworkConfigurationUpdater::kEmptyConfiguration[] =
 
 NetworkConfigurationUpdater::NetworkConfigurationUpdater(
     PolicyService* policy_service,
-    chromeos::NetworkLibrary* network_library)
+    BrowserPolicyConnector* connector,
+    chromeos::NetworkLibrary* network_library,
+    chromeos::UserManager* user_manager)
     : policy_change_registrar_(
           policy_service, POLICY_DOMAIN_CHROME, std::string()),
-      network_library_(network_library) {
+      connector_(connector),
+      network_library_(network_library),
+      user_manager_(user_manager) {
   DCHECK(network_library_);
   policy_change_registrar_.Observe(
       key::kDeviceOpenNetworkConfiguration,
@@ -73,10 +79,19 @@ void NetworkConfigurationUpdater::ApplyNetworkConfiguration(
   if (new_network_config.empty())
     new_network_config = kEmptyConfiguration;
 
+  // Web trust certificates are only allowed for managed users on managed
+  // devices of the same domain.
+  const bool allow_web_trust_from_policy =
+      user_manager_->IsUserLoggedIn() &&
+      !user_manager_->IsLoggedInAsGuest() &&
+      connector_->GetUserAffiliation(
+          user_manager_->GetLoggedInUser().email()) == USER_AFFILIATION_MANAGED;
+
   if (*cached_value != new_network_config) {
     *cached_value = new_network_config;
     std::string error;
     if (!network_library_->LoadOncNetworks(new_network_config, "", onc_source,
+                                           allow_web_trust_from_policy,
                                            &error)) {
       LOG(WARNING) << "Network library failed to load ONC configuration:"
                    << error;