Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/resources/options/managed_user_set_passphrase.js

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+cr.define('options', function() {
+  /** @const */ var OptionsPage = options.OptionsPage;
+
+  //////////////////////////////////////////////////////////////////////////////
+  // ManagedUserSetPassphraseOverlay class:
+
+  /**
+   * Encapsulated handling of XXX.

[Bernhard Bauer, 2013/01/07 14:20:22]

Wait, that does not sound right ;-)

+   * @constructor
+   */
+  function ManagedUserSetPassphraseOverlay() {
+    //this.activeNavTab = null;

[Bernhard Bauer, 2013/01/07 14:20:22]

Please remove.

+    OptionsPage.call(
+      this,
+      'setPassphrase',
+      loadTimeData.getString('setPassphraseTitle'),
+      'managed-user-set-passphrase-overlay');
+  }
+
+  cr.addSingletonGetter(ManagedUserSetPassphraseOverlay);
+
+  ManagedUserSetPassphraseOverlay.prototype = {
+    __proto__: OptionsPage.prototype,
+
+    initializePage: function() {
+      OptionsPage.prototype.initializePage.call(this);
+      $('save-passphrase').onclick = function() {
+        if ($('passphrase-foo').value != $('passphrase-confirm').value) {
+          alert('passwords are not equal');
+          // TODO display proper error message here

[Bernhard Bauer, 2013/01/07 14:20:22]

Format TODOs as TODO(ldap), to make it easier to grep for them.

[Pam (message me for reviews), 2013/01/07 14:51:49]

With a colon after the userid; i.e.,

TODO(akuegel): display...

Seems like it would be pretty easy to change the message in the "wrong password"
error div to report these errors.

+          return;
+        }
+        if ($('passphrase-foo').value == '') {
+          alert('password should not be empty');
+          // TODO display proper error message here
+          return;
+        }
+        chrome.send('setPassphrase', [$('passphrase-foo').value]);

[Pam (message me for reviews), 2013/01/07 14:51:49]

Is chrome.send sufficiently robust to be sending a plaintext password across it?
I realize that JavaScript itself isn't guaranteed 100% attack-proof, but this
adds even more attack surface. Perhaps check with the security team?

[Bernhard Bauer, 2013/01/08 17:43:14]

FWIW, sync also sends the passphrase in plaintext over chrome.send().

[Pam (message me for reviews), 2013/01/14 15:37:50]

Fair enough, then.

+        $('passphrase-foo').value = '';
+        $('passphrase-confirm').value = '';
+        OptionsPage.closeOverlay();
+      };
+    },
+  };
+
+  // Export
+  return {
+    ManagedUserSetPassphraseOverlay: ManagedUserSetPassphraseOverlay
+  };
+
+});