Add a SigninAllowed policy.

chrome/browser/profiles/profile.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/profiles/profile.h"
 
 #include <string>
 
 #include "build/build_config.h"
 #include "chrome/browser/prefs/pref_service.h"
@@ skipping 112 matching lines @@
 #if defined(OS_CHROMEOS)
   static bool is_guest_session =
       CommandLine::ForCurrentProcess()->HasSwitch(switches::kGuestSession);
   return is_guest_session;
 #else
   return false;
 #endif
 }
 
 bool Profile::IsSyncAccessible() {
+  if (GetPrefs()->GetBoolean(prefs::kManagedUserNoSignin))
+    return false;

[Andrew T Wilson (Slow), 2013/01/30 10:30:33]

I have a CL in flight that changes how this works
(https://codereview.chromium.org/12077030/) so changing IsSyncAccessible() will
stop sync from starting up but won't prohibit signin.

My suggestion is to add a new API ala "IsSigninAllowed()" and call that API from
every place in the UI that IsSyncAccessible() is currently called, like so:

if (IsSyncAccessible() && IsSigninAllowed()) {
  ...do signin ui stuff...
}

Then when we merge with my CL, we can just change that code to:

if (IsSigninAllowed()) {
   ...do signin ui stuff...
}

+
   browser_sync::SyncPrefs prefs(GetPrefs());
   return ProfileSyncService::IsSyncEnabled() && !prefs.IsManaged();
 }
 
 void Profile::MaybeSendDestroyedNotification() {
   if (!sent_destroyed_notification_) {
     sent_destroyed_notification_ = true;
     content::NotificationService::current()->Notify(
         chrome::NOTIFICATION_PROFILE_DESTROYED,
         content::Source<Profile>(this),
         content::NotificationService::NoDetails());
   }
 }