ChromeOS: user whitelist check should happen before entering password.

chrome/browser/chromeos/login/existing_user_controller.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/existing_user_controller.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 434 matching lines @@
 }
 
 void ExistingUserController::ShowWrongHWIDScreen() {
   host_->StartWizard(WizardController::kWrongHWIDScreenName);
 }
 
 void ExistingUserController::Signout() {
   NOTREACHED();
 }
 
+bool ExistingUserController::IsUserWhitelisted(const std::string& user_id) {
+  bool wildcard_match = false;
+  if (login_performer_.get())
+    return login_performer_->IsUserWhitelisted(user_id, &wildcard_match);
+
+  return ChromeLoginPerformer(this).IsUserWhitelisted(user_id, &wildcard_match);

[Denis Kuznetsov (DE-MUC), 2015/06/18 11:13:31]

What is the case when we will not have login_performer_ at this point?
Does it really makes sense to create new object for just one check?

[Alexander Alekseev, 2015/06/19 00:54:08]

login_performer is created only in PerformLogin(), and should be used for one
user only. So at this point (before user has entered password), login_performer
is NULL.

I've added re-use of existing login_performer just in case this method would be
called from somewhere during active login process.

[Denis Kuznetsov (DE-MUC), 2015/06/25 19:21:11]

First, ChromeLoginPerfomer is somewhat large object to create (it has
not-so-obvious constructor).
Second, this approach is incorrect - if you create LoginPerformer in this way
there is a chance that it will not load policy, and you will get wrong results.
Third, this example shows that ChomeLoginPerformer is a wrong place for 
IsUserWhitelisted check - UserManager seem to be a more appropriate class for
that.

[Alexander Alekseev, 2015/07/11 01:02:05]

components/ cannot include chrome/ . But the check can be directly here.

+}
+
 void ExistingUserController::OnConsumerKioskAutoLaunchCheckCompleted(
     KioskAppManager::ConsumerKioskAutoLaunchStatus status) {
   if (status == KioskAppManager::CONSUMER_KIOSK_AUTO_LAUNCH_CONFIGURABLE)
     ShowKioskEnableScreen();
 }
 
 void ExistingUserController::OnEnrollmentOwnershipCheckCompleted(
     DeviceSettingsService::OwnershipStatus status) {
   if (status == DeviceSettingsService::OWNERSHIP_NONE) {
     ShowEnrollmentScreen();
@@ skipping 783 matching lines @@
   if (!success) {
     LOG(ERROR) << "OAuth2 token fetch failed.";
     OnAuthFailure(AuthFailure(AuthFailure::FAILED_TO_INITIALIZE_TOKEN));
     return;
   }
   UserSessionManager::GetInstance()->OnOAuth2TokensFetched(user_context);
   PerformLogin(user_context, LoginPerformer::AUTH_MODE_EXTENSION);
 }
 
 }  // namespace chromeos