Add a SigninAllowed policy.

chrome/browser/signin/signin_tracker.cc

Index: chrome/browser/signin/signin_tracker.cc
diff --git a/chrome/browser/signin/signin_tracker.cc b/chrome/browser/signin/signin_tracker.cc
index abc4fbe6fc6b5bbd316cef9f0d84ab3a24e53cfa..3310d40b2007abe673fa786a073695fc94bd4306 100644
--- a/chrome/browser/signin/signin_tracker.cc
+++ b/chrome/browser/signin/signin_tracker.cc
@@ -130,7 +130,8 @@ void SigninTracker::HandleServiceStateChange() {
   }
 
   SigninManager* signin = SigninManagerFactory::GetForProfile(profile_);
-  if (signin->GetAuthenticatedUsername().empty()) {
+  if (signin->GetAuthenticatedUsername().empty() ||
+      !signin->IsSigninAllowed()) {
     // User is signed out, trigger a signin failure.
     state_ = WAITING_FOR_GAIA_VALIDATION;
     observer_->SigninFailed(
@@ -142,8 +143,9 @@ void SigninTracker::HandleServiceStateChange() {
   // Long term, we should separate out service auth failures from the signin
   // process, but for the current UI flow we'll validate service signin status
   // also.
-  ProfileSyncService* service = profile_->IsSyncAccessible() ?
-      ProfileSyncServiceFactory::GetForProfile(profile_) : NULL;
+  ProfileSyncService* service =
+      profile_->IsSyncAccessible() ?
+          ProfileSyncServiceFactory::GetForProfile(profile_) : NULL;
   if (service && service->waiting_for_auth()) {
     // Still waiting for an auth token to come in so stay in the INITIALIZING
     // state (we do this to avoid triggering an early signin error in the case