We should use UserID object to identify users instead of username.

chrome/browser/chromeos/policy/policy_cert_service.h

Index: chrome/browser/chromeos/policy/policy_cert_service.h
diff --git a/chrome/browser/chromeos/policy/policy_cert_service.h b/chrome/browser/chromeos/policy/policy_cert_service.h
index 0220b88dc966adc7e35cb7328057ecd75b980961..cb845d4c80f2aa13c9ada8026584aa4d66158ace 100644
--- a/chrome/browser/chromeos/policy/policy_cert_service.h
+++ b/chrome/browser/chromeos/policy/policy_cert_service.h
@@ -15,6 +15,7 @@
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/chromeos/policy/user_network_configuration_updater.h"
 #include "components/keyed_service/core/keyed_service.h"
+#include "components/user_manager/user_id.h"
 
 namespace user_manager {
 class UserManager;
@@ -38,7 +39,7 @@ class PolicyCertService
     : public KeyedService,
       public UserNetworkConfigurationUpdater::WebTrustedCertsObserver {
  public:
-  PolicyCertService(const std::string& user_id,
+  PolicyCertService(const user_manager::UserID& user_id,
                     UserNetworkConfigurationUpdater* net_conf_updater,
                     user_manager::UserManager* user_manager);
   ~PolicyCertService() override;
@@ -62,17 +63,17 @@ class PolicyCertService
   void Shutdown() override;
 
   static scoped_ptr<PolicyCertService> CreateForTesting(
-      const std::string& user_id,
+      const user_manager::UserID& user_id,
       PolicyCertVerifier* verifier,
       user_manager::UserManager* user_manager);
 
  private:
-  PolicyCertService(const std::string& user_id,
+  PolicyCertService(const user_manager::UserID& user_id,
                     PolicyCertVerifier* verifier,
                     user_manager::UserManager* user_manager);
 
   PolicyCertVerifier* cert_verifier_;
-  std::string user_id_;
+  user_manager::UserID user_id_;
   UserNetworkConfigurationUpdater* net_conf_updater_;
   user_manager::UserManager* user_manager_;
   bool has_trust_anchors_;