Make sure the device recovers from policy loss in the consumer case.

chrome/browser/chromeos/login/user_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/user_manager.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 766 matching lines @@
       SetDeferImeStartup(false);
   // Shut down the IME so that it will reload the user's settings.
   chromeos::input_method::InputMethodManager::GetInstance()->
       StopInputMethodDaemon();
 
 #if defined(TOOLKIT_USES_GTK)
   // Let the window manager know that we're logged in now.
   WmIpc::instance()->SetLoggedInProperty(true);
 #endif
 
+  LoadKeyStore();
+
+  // Schedules current user ownership check on file thread.
+  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
+                          base::Bind(&UserManager::CheckOwnership,
+                                     base::Unretained(this)));
+}
+
+void UserManager::LoadKeyStore() {
+  CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  if (key_store_loaded_)
+    return;
+
   // Ensure we've opened the real user's key/certificate database.
   crypto::OpenPersistentNSSDB();
 
   // Only load the Opencryptoki library into NSS if we have this switch.
   // TODO(gspencer): Remove this switch once cryptohomed work is finished:
   // http://crosbug.com/12295 and http://crosbug.com/12304
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kLoadOpencryptoki)) {
     crypto::EnableTPMTokenForNSS(new RealTPMTokenInfoDelegate());
     CertLibrary* cert_library;
     cert_library = chromeos::CrosLibrary::Get()->GetCertLibrary();
     // Note: this calls crypto::EnsureTPMTokenReady()
     cert_library->RequestCertificates();
   }
-
-  // Schedules current user ownership check on file thread.
-  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
-                          base::Bind(&UserManager::CheckOwnership,
-                                     base::Unretained(this)));
+  key_store_loaded_ = true;
 }
 
 void UserManager::SetInitialUserImage(const std::string& username) {
   // Choose a random default image.
   int image_id = base::RandInt(0, kDefaultImagesCount - 1);
   SaveUserDefaultImageIndex(username, image_id);
 }
 
 void UserManager::SetUserImage(const std::string& username,
                                int image_index,
@@ skipping 223 matching lines @@
 
 User* UserManager::CreateUser(const std::string& email) const {
   User* user = new User(email, email == kGuestUser);
   user->set_oauth_token_status(LoadUserOAuthStatus(email));
   // Used to determine whether user's display name is unique.
   ++display_name_count_[user->GetDisplayName()];
   return user;
 }
 
 }  // namespace chromeos