We should use UserID object to identify users instead of username.

chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc

Index: chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
diff --git a/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc b/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
index 8db319d9ca139a50e6e58fef7d0b38c660b01b82..ed7cd893248a7a77b55b102a970a5a19e345ccc6 100644
--- a/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
+++ b/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
@@ -54,7 +54,7 @@ const char EPKPChallengeKeyBase::kUserNotManaged[] =
 
 EPKPChallengeKeyBase::PrepareKeyContext::PrepareKeyContext(
     chromeos::attestation::AttestationKeyType key_type,
-    const std::string& user_id,
+    const user_manager::UserID& user_id,
     const std::string& key_name,
     chromeos::attestation::AttestationCertificateProfile certificate_profile,
     bool require_user_consent,
@@ -138,25 +138,25 @@ bool EPKPChallengeKeyBase::IsExtensionWhitelisted() const {
 }
 
 bool EPKPChallengeKeyBase::IsUserManaged() const {
-  std::string email = GetUserEmail();
+  const user_manager::UserID user_id = GetUserID();
 
   // TODO(davidyu): Use BrowserPolicyConnector::GetUserAffiliation() and fix
   // the test.
-  return email.empty() ? false :
-      gaia::ExtractDomainName(email) == GetEnterpriseDomain();
+  return user_id.empty() ? false :
+      gaia::ExtractDomainName(user_id.GetUserEmail()) == GetEnterpriseDomain();
 }
 
 std::string EPKPChallengeKeyBase::GetEnterpriseDomain() const {
   return install_attributes_->GetDomain();
 }
 
-std::string EPKPChallengeKeyBase::GetUserEmail() const {
+user_manager::UserID EPKPChallengeKeyBase::GetUserID() const {
   SigninManagerBase* signin_manager =
       SigninManagerFactory::GetForProfile(GetProfile());
   if (!signin_manager)
-    return std::string();
+    return user_manager::UserID(std::string(), std::string());

[Denis Kuznetsov (DE-MUC), 2015/06/10 16:50:46]

EmptyUserID

 
-  return gaia::CanonicalizeEmail(signin_manager->GetAuthenticatedUsername());
+  return user_manager::UserID::FromUserEmail(gaia::CanonicalizeEmail(signin_manager->GetAuthenticatedUsername()));
 }
 
 std::string EPKPChallengeKeyBase::GetDeviceId() const {
@@ -165,7 +165,7 @@ std::string EPKPChallengeKeyBase::GetDeviceId() const {
 
 void EPKPChallengeKeyBase::PrepareKey(
     chromeos::attestation::AttestationKeyType key_type,
-    const std::string& user_id,
+    const user_manager::UserID& user_id,
     const std::string& key_name,
     chromeos::attestation::AttestationCertificateProfile certificate_profile,
     bool require_user_consent,
@@ -245,7 +245,7 @@ void EPKPChallengeKeyBase::AskForUserConsentCallback(
   attestation_flow_->GetCertificate(
       context.certificate_profile,
       context.user_id,
-      std::string(),  // Not used.
+      std::string(),
       true,  // Force a new key to be generated.
       base::Bind(&EPKPChallengeKeyBase::GetCertificateCallback, this,
                  context.callback));
@@ -335,7 +335,7 @@ void EPKPChallengeMachineKey::GetDeviceAttestationEnabledCallback(
   }
 
   PrepareKey(chromeos::attestation::KEY_DEVICE,
-             std::string(),  // Not used.
+             user_manager::UserID(std::string(), std::string()), // Not used.

[Denis Kuznetsov (DE-MUC), 2015/06/10 16:50:46]

EmptyUserID

              kKeyName,
              chromeos::attestation::PROFILE_ENTERPRISE_MACHINE_CERTIFICATE,
              false,  // user consent is not required.
@@ -354,7 +354,7 @@ void EPKPChallengeMachineKey::PrepareKeyCallback(
   // Everything is checked. Sign the challenge.
   async_caller_->TpmAttestationSignEnterpriseChallenge(
       chromeos::attestation::KEY_DEVICE,
-      std::string(),  // Not used.
+      user_manager::UserID(std::string(), std::string()), // Not used.

[Denis Kuznetsov (DE-MUC), 2015/06/10 16:50:46]

EmptyUserId

       kKeyName,
       GetEnterpriseDomain(),
       GetDeviceId(),
@@ -474,7 +474,7 @@ void EPKPChallengeUserKey::GetDeviceAttestationEnabledCallback(
   }
 
   PrepareKey(chromeos::attestation::KEY_USER,
-             GetUserEmail(),
+             GetUserID(),
              kKeyName,
              chromeos::attestation::PROFILE_ENTERPRISE_USER_CERTIFICATE,
              require_user_consent,
@@ -494,9 +494,9 @@ void EPKPChallengeUserKey::PrepareKeyCallback(const std::string& challenge,
   // Everything is checked. Sign the challenge.
   async_caller_->TpmAttestationSignEnterpriseChallenge(
       chromeos::attestation::KEY_USER,
-      GetUserEmail(),
+      GetUserID(),
       kKeyName,
-      GetUserEmail(),
+      GetUserID().GetUserEmail(),
       GetDeviceId(),
       register_key ?
           chromeos::attestation::CHALLENGE_INCLUDE_SIGNED_PUBLIC_KEY :
@@ -518,7 +518,7 @@ void EPKPChallengeUserKey::SignChallengeCallback(bool register_key,
   if (register_key) {
     async_caller_->TpmAttestationRegisterKey(
         chromeos::attestation::KEY_USER,
-        GetUserEmail(),
+        GetUserID(),
         kKeyName,
         base::Bind(&EPKPChallengeUserKey::RegisterKeyCallback, this, response));
   } else {