Make sure the device recovers from policy loss in the consumer case.

chrome/browser/chromeos/login/parallel_authenticator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/parallel_authenticator.h"
 
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "base/synchronization/lock.h"
 #include "chrome/browser/chromeos/cros/cert_library.h"
 #include "chrome/browser/chromeos/cros/cryptohome_library.h"
+#include "chrome/browser/chromeos/cros_settings.h"
 #include "chrome/browser/chromeos/login/auth_response_handler.h"
 #include "chrome/browser/chromeos/login/authentication_notification_details.h"
 #include "chrome/browser/chromeos/login/login_status_consumer.h"
 #include "chrome/browser/chromeos/login/ownership_service.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
@@ skipping 16 matching lines @@
 using file_util::ReadFileToString;
 
 namespace chromeos {
 
 // static
 const int ParallelAuthenticator::kClientLoginTimeoutMs = 10000;
 
 ParallelAuthenticator::ParallelAuthenticator(LoginStatusConsumer* consumer)
     : Authenticator(consumer),
       already_reported_success_(false),
+      owner_is_verified_(false),
+      user_can_login_(false),
       using_oauth_(
           CommandLine::ForCurrentProcess()->HasSwitch(
               switches::kWebUILogin) &&
           !CommandLine::ForCurrentProcess()->HasSwitch(
                   switches::kSkipOAuthLogin)) {
   // If not already owned, this is a no-op.  If it is, this loads the owner's
   // public key off of disk.
   OwnershipService::GetSharedInstance()->StartLoadOwnerKeyAttempt();
 }
 
 ParallelAuthenticator::~ParallelAuthenticator() {}
 
 void ParallelAuthenticator::AuthenticateToLogin(
     Profile* profile,
     const std::string& username,
     const std::string& password,
     const std::string& login_token,
     const std::string& login_captcha) {
   std::string canonicalized = Authenticator::Canonicalize(username);
   authentication_profile_ = profile;
   current_state_.reset(
       new AuthAttemptState(
           canonicalized,
           password,
           CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password),
           login_token,
           login_captcha,
           !UserManager::Get()->IsKnownUser(canonicalized)));
+  {
+    LOG(ERROR) << "@@@ Resetting for " << username;
+    // Reset the verified flag.
+    base::AutoLock for_this_block(owner_verified_lock_);
+    owner_is_verified_ = false;
+  }
   mounter_ = CryptohomeOp::CreateMountAttempt(current_state_.get(),
                                               this,
                                               false /* don't create */);
   // Sadly, this MUST be on the UI thread due to sending DBus traffic :-/
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
-
       base::Bind(&CryptohomeOp::Initiate, mounter_.get()));
   // ClientLogin authentication check should happen immediately here.
   // We should not try OAuthLogin check until the profile loads.
   if (!using_oauth_) {
     // Initiate ClientLogin-based post authentication.
     current_online_ = new OnlineAttempt(using_oauth_,
                                         current_state_.get(),
                                         this);
     current_online_->Initiate(profile);
   }
 }
 
 void ParallelAuthenticator::CompleteLogin(Profile* profile,
                                           const std::string& username,
                                           const std::string& password) {
   std::string canonicalized = Authenticator::Canonicalize(username);
   authentication_profile_ = profile;
   current_state_.reset(
       new AuthAttemptState(
           canonicalized,
           password,
           CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password),
           !UserManager::Get()->IsKnownUser(canonicalized)));
+  {
+    LOG(ERROR) << "@@@ Resetting for " << username;
+    // Reset the verified flag.
+    base::AutoLock for_this_block(owner_verified_lock_);
+    owner_is_verified_ = false;
+  }
   mounter_ = CryptohomeOp::CreateMountAttempt(current_state_.get(),
                                               this,
                                               false /* don't create */);
   // Sadly, this MUST be on the UI thread due to sending DBus traffic :-/
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CryptohomeOp::Initiate, mounter_.get()));
 
   if (!using_oauth_) {
     // Test automation needs to disable oauth, but that leads to other
@@ skipping 122 matching lines @@
 }
 
 void ParallelAuthenticator::ResyncRecoverHelper(CryptohomeOp* to_initiate) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   current_state_->ResetCryptohomeStatus();
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CryptohomeOp::Initiate, to_initiate));
 }
 
+void ParallelAuthenticator::VerifyOwnerOnUIThread() {
+  // Check if policy data is fine and continue in safe mode if needed.
+  bool is_safe_mode = false;
+  CrosSettings::Get()->GetBoolean(kPolicyMissingMitigationMode, &is_safe_mode);
+  if (!is_safe_mode) {
+    base::AutoLock for_this_block(owner_verified_lock_);
+    // Now we can continue reading the private key.
+    user_can_login_ = true;
+    owner_is_verified_ = true;
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::Bind(&ParallelAuthenticator::Resolve, this));
+    return;
+  }
+  // First we have to make sure the current user's cert store is available.
+  UserManager::Get()->LoadKeyStore();
+  // Now we can continue reading the private key.
+  BrowserThread::PostTask(
+      BrowserThread::FILE, FROM_HERE,
+      base::Bind(&ParallelAuthenticator::FinishVerifyOwnerOnFileThread, this));
+}
+
+void ParallelAuthenticator::FinishVerifyOwnerOnFileThread() {
+  base::AutoLock for_this_block(owner_verified_lock_);
+  // Now we can continue reading the private key.
+  user_can_login_ =
+      OwnershipService::GetSharedInstance()->CurrentUserIsOwner();
+  owner_is_verified_ = true;
+  BrowserThread::PostTask(
+      BrowserThread::IO, FROM_HERE,
+      base::Bind(&ParallelAuthenticator::Resolve, this));
+  LOG(ERROR) << "@@@ Check finished: " << user_can_login_;
+}
+
 void ParallelAuthenticator::RetryAuth(Profile* profile,
                                       const std::string& username,
                                       const std::string& password,
                                       const std::string& login_token,
                                       const std::string& login_captcha) {
   reauth_state_.reset(
       new AuthAttemptState(
           Authenticator::Canonicalize(username),
           password,
           CrosLibrary::Get()->GetCryptohomeLibrary()->HashPassword(password),
@@ skipping 144 matching lines @@
       break;
     case LOGIN_FAILED:
       current_state_->ResetCryptohomeStatus();
       BrowserThread::PostTask(BrowserThread::UI,
                               FROM_HERE,
                               base::Bind(
                                   &ParallelAuthenticator::OnLoginFailure,
                                   this,
                                   current_state_->online_outcome()));
       break;
+    case OWNER_REQUIRED:
+      current_state_->ResetCryptohomeStatus();

[Chris Masone, 2012/02/24 18:49:45]

Hm.  This doesn't actually unmount the user's cryptohome, does it?  It'd be cool
if we could do that as well, just to be sure that we really can't proceed with a
login.

[pastarmovj, 2012/03/13 15:21:55]

Done.

+      BrowserThread::PostTask(BrowserThread::UI,
+                              FROM_HERE,
+                              base::Bind(
+                                  &ParallelAuthenticator::OnLoginFailure,
+                                  this,
+                                  LoginFailure(LoginFailure::OWNER_REQUIRED)));
+      break;
     default:
       NOTREACHED();
       break;
   }
 }
 
 ParallelAuthenticator::AuthState ParallelAuthenticator::ResolveState() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   // If we haven't mounted the user's home dir yet, we can't be done.
   // We never get past here if a cryptohome op is still pending.
@@ skipping 95 matching lines @@
 ParallelAuthenticator::ResolveCryptohomeSuccessState() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   if (data_remover_.get())
     return CREATE_NEW;
   if (guest_mounter_.get())
     return GUEST_LOGIN;
   if (key_migrator_.get())
     return RECOVER_MOUNT;
   if (key_checker_.get())
     return UNLOCK;
-  return OFFLINE_LOGIN;
+
+  base::AutoLock for_this_block(owner_verified_lock_);
+  LOG(ERROR) << "@@@ cryptohome state " << owner_is_verified_;
+  if (!owner_is_verified_) {
+    BrowserThread::PostTask(
+        BrowserThread::UI, FROM_HERE,
+        base::Bind(&ParallelAuthenticator::VerifyOwnerOnUIThread, this));
+    return CONTINUE;
+  }
+  return user_can_login_ ? OFFLINE_LOGIN : OWNER_REQUIRED;
 }
 
 namespace {
 bool WasConnectionIssue(const LoginFailure& online_outcome) {
   return ((online_outcome.reason() == LoginFailure::LOGIN_TIMED_OUT) ||
           (online_outcome.error().state() ==
            GoogleServiceAuthError::CONNECTION_FAILED) ||
           (online_outcome.error().state() ==
            GoogleServiceAuthError::REQUEST_CANCELED));
 }
@@ skipping 36 matching lines @@
 }
 
 void ParallelAuthenticator::ResolveLoginCompletionStatus() {
   // Shortcut online state resolution process.
   current_state_->RecordOnlineLoginStatus(GaiaAuthConsumer::ClientLoginResult(),
                                           LoginFailure::None());
   Resolve();
 }
 
 }  // namespace chromeos