Chrome-side lockbox bindings

chrome/browser/chromeos/login/enterprise_enrollment_screen.cc

Index: chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
diff --git a/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc b/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
index ec775dc7b4b8bfbb170becf21c8cabac17b4ec08..71b791ad6f89ba391ec5ec926bb6dca56a354836 100644
--- a/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
+++ b/chrome/browser/chromeos/login/enterprise_enrollment_screen.cc
@@ -6,15 +6,21 @@
 
 #include "base/logging.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/cros/cros_library.h"
+#include "chrome/browser/chromeos/cros/cryptohome_library.h"
 #include "chrome/browser/chromeos/login/screen_observer.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
 
 namespace chromeos {
 
+// Retry for lockbox initialization every 500ms.
+const int kLockboxRetryIntervalMs = 500;
+
 EnterpriseEnrollmentScreen::EnterpriseEnrollmentScreen(
     WizardScreenDelegate* delegate)
-    : ViewScreen<EnterpriseEnrollmentView>(delegate) {}
+    : ViewScreen<EnterpriseEnrollmentView>(delegate),
+      ALLOW_THIS_IN_INITIALIZER_LIST(runnable_method_factory_(this)) {}
 
 EnterpriseEnrollmentScreen::~EnterpriseEnrollmentScreen() {}
 
@@ -57,8 +63,7 @@ void EnterpriseEnrollmentScreen::CloseConfirmation() {
 
 void EnterpriseEnrollmentScreen::OnClientLoginSuccess(
     const ClientLoginResult& result) {
-  auth_fetcher_->StartIssueAuthToken(result.sid, result.lsid,
-                                     GaiaConstants::kDeviceManagementService);
+  WriteLockboxData(result);
 }
 
 void EnterpriseEnrollmentScreen::OnClientLoginFailure(
@@ -177,4 +182,54 @@ void EnterpriseEnrollmentScreen::HandleAuthError(
   NOTREACHED() << error.state();
 }
 
+void EnterpriseEnrollmentScreen::WriteLockboxData(
+    const ClientLoginResult& result) {
+  // Since this method is also called directly.
+  runnable_method_factory_.RevokeAll();
+
+  chromeos::CryptohomeLibrary* cryptohome =
+      chromeos::CrosLibrary::Get()->GetCryptohomeLibrary();
+  if (!cryptohome->InstallAttributesIsReady()) {
+    // Lockbox is not read yet, reschedule pulling.

[kmixter1, 2011/04/15 02:06:51]

ready

[pastarmovj, 2011/04/15 10:05:01]

Done.

+    LOG(WARNING) << "Lockbox is not ready yet will retry in "
+                 << kLockboxRetryIntervalMs << "ms.";
+    MessageLoop::current()->PostDelayedTask(
+        FROM_HERE,
+        runnable_method_factory_.NewRunnableMethod(
+            &EnterpriseEnrollmentScreen::WriteLockboxData, result),
+        kLockboxRetryIntervalMs);
+  } else {
+    // Clearing the TPM password seems to be always a good deal.
+    if (cryptohome->TpmIsEnabled() && !cryptohome->TpmIsBeingOwned() &&
+        cryptohome->TpmIsOwned()) {
+      cryptohome->TpmClearStoredPassword();
+    }
+    // Make sure we really have a working lockbox.
+    if (cryptohome->InstallAttributesIsInvalid()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "is corrupt or failed to initialize!";
+      view()->ShowFatalEnrollmentError();
+    }
+    if (!cryptohome->InstallAttributesIsFirstInstall()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "has been altered already!";

[Will Drewry, 2011/04/15 02:38:19]

s/altered/finalized  (or locked :)

[pastarmovj, 2011/04/15 10:05:01]

Done.

+      view()->ShowFatalEnrollmentError();
+    }
+    // Set values in the lockbox and lock it.
+    DCHECK(cryptohome->InstallAttributesIsFirstInstall());
+    cryptohome->InstallAttributesSet("enterprise.owned", "true");
+    cryptohome->InstallAttributesSet("enterprise.user", user_);
+    DCHECK(cryptohome->InstallAttributesCount() == 2);
+    cryptohome->InstallAttributesFinalize();
+    if (cryptohome->InstallAttributesIsFirstInstall()) {
+      LOG(ERROR) << "Enrollment can not proceed because the lockbox "
+                 << "can not be sealed!";
+      view()->ShowFatalEnrollmentError();
+    } else {
+      auth_fetcher_->StartIssueAuthToken(
+          result.sid, result.lsid, GaiaConstants::kDeviceManagementService);
+    }
+  }
+}
+
 }  // namespace chromeos