Chrome-side lockbox bindings

chrome/browser/chromeos/login/enterprise_enrollment_screen.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/enterprise_enrollment_screen.h"
 
 #include "base/logging.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/cros/cros_library.h"
+#include "chrome/browser/chromeos/cros/cryptohome_library.h"
 #include "chrome/browser/chromeos/login/screen_observer.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
 
 namespace chromeos {
 
+// Retry for lockbox initialization every 500ms.
+const int kLockboxRetryIntervalMs = 500;
+
 EnterpriseEnrollmentScreen::EnterpriseEnrollmentScreen(
     WizardScreenDelegate* delegate)
-    : ViewScreen<EnterpriseEnrollmentView>(delegate) {}
+    : ViewScreen<EnterpriseEnrollmentView>(delegate),
+      ALLOW_THIS_IN_INITIALIZER_LIST(runnable_method_factory_(this)) {}
 
 EnterpriseEnrollmentScreen::~EnterpriseEnrollmentScreen() {}
 
 void EnterpriseEnrollmentScreen::Authenticate(const std::string& user,
                                               const std::string& password,
                                               const std::string& captcha,
                                               const std::string& access_code) {
   captcha_token_.clear();
   user_ = user;
   auth_fetcher_.reset(
@@ skipping 22 matching lines @@
 }
 
 void EnterpriseEnrollmentScreen::CloseConfirmation() {
   auth_fetcher_.reset();
   ScreenObserver* observer = delegate()->GetObserver(this);
   observer->OnExit(ScreenObserver::ENTERPRISE_ENROLLMENT_COMPLETED);
 }
 
 void EnterpriseEnrollmentScreen::OnClientLoginSuccess(
     const ClientLoginResult& result) {
-  auth_fetcher_->StartIssueAuthToken(result.sid, result.lsid,
-                                     GaiaConstants::kDeviceManagementService);
+  WriteLockboxData(result);
 }
 
 void EnterpriseEnrollmentScreen::OnClientLoginFailure(
     const GoogleServiceAuthError& error) {
   HandleAuthError(error);
 }
 
 void EnterpriseEnrollmentScreen::OnIssueAuthTokenSuccess(
     const std::string& service,
     const std::string& auth_token) {
@@ skipping 98 matching lines @@
       // fall through.
     case GoogleServiceAuthError::REQUEST_CANCELED:
       LOG(ERROR) << "Unexpected GAIA auth error: " << error.state();
       view()->ShowFatalAuthError();
       return;
   }
 
   NOTREACHED() << error.state();
 }
 
+void EnterpriseEnrollmentScreen::WriteLockboxData(
+    const ClientLoginResult& result) {
+  // Since this method is also called directly.
+  runnable_method_factory_.RevokeAll();
+
+  chromeos::CryptohomeLibrary* cryptohome =
+      chromeos::CrosLibrary::Get()->GetCryptohomeLibrary();
+  if (!cryptohome->InstallAttributesIsReady()) {
+    // Lockbox is not read yet, reschedule pulling.

[kmixter1, 2011/04/15 02:06:51]

ready

[pastarmovj, 2011/04/15 10:05:01]

Done.

+    LOG(WARNING) << "Lockbox is not ready yet will retry in "
+                 << kLockboxRetryIntervalMs << "ms.";
+    MessageLoop::current()->PostDelayedTask(
+        FROM_HERE,
+        runnable_method_factory_.NewRunnableMethod(
+            &EnterpriseEnrollmentScreen::WriteLockboxData, result),
+        kLockboxRetryIntervalMs);
+  } else {
+    // Clearing the TPM password seems to be always a good deal.
+    if (cryptohome->TpmIsEnabled() && !cryptohome->TpmIsBeingOwned() &&
+        cryptohome->TpmIsOwned()) {
+      cryptohome->TpmClearStoredPassword();
+    }
+    // Make sure we really have a working lockbox.
+    if (cryptohome->InstallAttributesIsInvalid()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "is corrupt or failed to initialize!";
+      view()->ShowFatalEnrollmentError();
+    }
+    if (!cryptohome->InstallAttributesIsFirstInstall()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "has been altered already!";

[Will Drewry, 2011/04/15 02:38:19]

s/altered/finalized  (or locked :)

[pastarmovj, 2011/04/15 10:05:01]

Done.

+      view()->ShowFatalEnrollmentError();
+    }
+    // Set values in the lockbox and lock it.
+    DCHECK(cryptohome->InstallAttributesIsFirstInstall());
+    cryptohome->InstallAttributesSet("enterprise.owned", "true");
+    cryptohome->InstallAttributesSet("enterprise.user", user_);
+    DCHECK(cryptohome->InstallAttributesCount() == 2);
+    cryptohome->InstallAttributesFinalize();
+    if (cryptohome->InstallAttributesIsFirstInstall()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "can not be sealed!";
+      view()->ShowFatalEnrollmentError();
+    } else {
+      auth_fetcher_->StartIssueAuthToken(
+          result.sid, result.lsid, GaiaConstants::kDeviceManagementService);
+    }
+  }
+}
+
 }  // namespace chromeos