Add a SigninAllowed policy.

chrome/browser/signin/signin_manager.cc

Index: chrome/browser/signin/signin_manager.cc
diff --git a/chrome/browser/signin/signin_manager.cc b/chrome/browser/signin/signin_manager.cc
index 7237ec6a15deeaa7d3dba47ecaa34bf375622ee1..b6ede82ba96331a1d7b80e80c6b0f8bd5688fb13 100644
--- a/chrome/browser/signin/signin_manager.cc
+++ b/chrome/browser/signin/signin_manager.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/content_settings/cookie_settings.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profile_io_data.h"
 #include "chrome/browser/signin/about_signin_internals.h"
 #include "chrome/browser/signin/about_signin_internals_factory.h"
 #include "chrome/browser/signin/signin_global_error.h"
@@ -211,6 +212,9 @@ void SigninManager::Initialize(Profile* profile) {
         base::Bind(&SigninManager::OnGoogleServicesUsernamePatternChanged,
                    base::Unretained(this)));
   }
+  signin_allowed_.Init(prefs::kSigninAllowed, profile_->GetPrefs(),
+                       base::Bind(&SigninManager::OnSigninAllowedPrefChanged,
+                                  base::Unretained(this)));
 
   // If the user is clearing the token service from the command line, then
   // clear their login info also (not valid to be logged in without any
@@ -237,7 +241,7 @@ void SigninManager::Initialize(Profile* profile) {
     }
 #endif
   }
-  if (!user.empty() && !IsAllowedUsername(user)) {
+  if ((!user.empty() && !IsAllowedUsername(user)) || !IsSigninAllowed()) {
     // User is signed in, but the username is invalid - the administrator must
     // have changed the policy since the last signin, so sign out the user.
     SignOut();
@@ -258,6 +262,16 @@ bool SigninManager::IsAllowedUsername(const std::string& username) const {
   return IsAllowedUsername(username, pattern);
 }
 
+bool SigninManager::IsSigninAllowed() const {
+  return signin_allowed_.GetValue();
+}
+
+// static
+bool SigninManager::IsSigninAllowedOnIOThread(ProfileIOData* io_data) {
+  DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
+  return io_data->signin_allowed()->GetValue();
+}
+
 void SigninManager::CleanupNotificationRegistration() {
 #if !defined(OS_CHROMEOS)
   content::Source<TokenService> token_service(
@@ -760,6 +774,11 @@ void SigninManager::OnGoogleServicesUsernamePatternChanged() {
   }
 }
 
+void SigninManager::OnSigninAllowedPrefChanged() {
+  if (!IsSigninAllowed())
+    SignOut();
+}
+
 void SigninManager::AddSigninDiagnosticsObserver(
     SigninDiagnosticsObserver* observer) {
   signin_diagnostics_observers_.AddObserver(observer);