Add a SigninAllowed policy.

chrome/browser/signin/signin_ui_util.cc

Index: chrome/browser/signin/signin_ui_util.cc
diff --git a/chrome/browser/signin/signin_ui_util.cc b/chrome/browser/signin/signin_ui_util.cc
index 61bd7306057c6fed97fbada9f8b148c6cae19f6c..350ded0367b3609b946fc400cc4507542f4d63eb 100644
--- a/chrome/browser/signin/signin_ui_util.cc
+++ b/chrome/browser/signin/signin_ui_util.cc
@@ -38,7 +38,7 @@ GlobalError* GetSignedInServiceError(Profile* profile) {
   // No auth error - now try other services. Currently the list is just hard-
   // coded but in the future if we add more we can create some kind of
   // registration framework.
-  if (profile->IsSyncAccessible()) {
+  if (profile->IsSyncAccessible() && profile->IsSigninAllowed()) {

[Andrew T Wilson (Slow), 2013/02/04 15:41:48]

Don't check IsSigninAllowed() here.

[Adrian Kuegel, 2013/02/05 10:55:15]

Done.

     ProfileSyncService* service =
         ProfileSyncServiceFactory::GetForProfile(profile);
     SyncGlobalError* error = service->sync_global_error();
@@ -54,8 +54,9 @@ string16 GetSigninMenuLabel(Profile* profile) {
     return error->MenuItemLabel();
 
   // No errors, so just display the signed in user, if any.
-  ProfileSyncService* service = profile->IsSyncAccessible() ?
-      ProfileSyncServiceFactory::GetForProfile(profile) : NULL;
+  ProfileSyncService* service =
+      profile->IsSyncAccessible() && profile->IsSigninAllowed() ?

[Andrew T Wilson (Slow), 2013/02/04 15:41:48]

Don't check IsSigninAllowed() here.

[Adrian Kuegel, 2013/02/05 10:55:15]

Done.

+          ProfileSyncServiceFactory::GetForProfile(profile) : NULL;
 
   // Even if the user is signed in, don't display the "signed in as..."
   // label if we're still setting up sync.