Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc

Index: chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc
diff --git a/chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc b/chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc
index a5e1a2ad1304b20911a154d633a9b94274ec6a2e..89e198015a3cfe059d23918c0122cfad3bf5352b 100644
--- a/chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc
+++ b/chrome/browser/chromeos/login/multi_profile_user_controller_unittest.cc
@@ -9,6 +9,7 @@
 #include "chrome/browser/chromeos/login/fake_user_manager.h"
 #include "chrome/browser/chromeos/login/multi_profile_user_controller_delegate.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/scoped_testing_local_state.h"
@@ -263,4 +264,21 @@ TEST_F(MultiProfileUserControllerTest, NoSecondaryOwner) {
   EXPECT_EQ(1, user_not_allowed_count());
 }
 
+TEST_F(MultiProfileUserControllerTest,
+       UsedPolicyCertificatesAllowedForPrimary) {
+  policy::PolicyCertServiceFactory::SetUsedPolicyCertificates(kUsers[0]);
+  EXPECT_TRUE(controller()->IsUserAllowedInSession(kUsers[0]));
+  EXPECT_TRUE(controller()->IsUserAllowedInSession(kUsers[1]));

[Nikita (slow), 2013/12/17 18:42:05]

nit: It seems that you're actually checking both users here and they are both
allowed?

[Joao da Silva, 2013/12/17 20:44:21]

Yes; this test verifies that both "normal" and "tainted" users can become the
primary user. Note that none of them have logged in yet.

+  policy::PolicyCertServiceFactory::ClearUsedPolicyCertificates(kUsers[0]);
+}
+
+TEST_F(MultiProfileUserControllerTest,
+       UsedPolicyCertificatesDisallowedForSecondary) {
+  LoginUser(1);
+  EXPECT_TRUE(controller()->IsUserAllowedInSession(kUsers[0]));
+  policy::PolicyCertServiceFactory::SetUsedPolicyCertificates(kUsers[0]);
+  EXPECT_FALSE(controller()->IsUserAllowedInSession(kUsers[0]));
+  policy::PolicyCertServiceFactory::ClearUsedPolicyCertificates(kUsers[0]);
+}
+
 }  // namespace chromeos