Add a SigninAllowed policy.

chrome/browser/ui/sync/one_click_signin_helper.cc

Index: chrome/browser/ui/sync/one_click_signin_helper.cc
diff --git a/chrome/browser/ui/sync/one_click_signin_helper.cc b/chrome/browser/ui/sync/one_click_signin_helper.cc
index 692331f774339cc7646f50294b1df7786c3cc96c..07091994516a10310f7b55f1112ede295944bd7c 100644
--- a/chrome/browser/ui/sync/one_click_signin_helper.cc
+++ b/chrome/browser/ui/sync/one_click_signin_helper.cc
@@ -540,6 +540,11 @@ bool OneClickSigninHelper::CanOffer(content::WebContents* web_contents,
   if (!profile)
     return false;
 
+  SigninManager* manager =
+      SigninManagerFactory::GetForProfile(profile);
+  if (manager && !manager->IsSigninAllowed())
+    return false;
+
   if (can_offer_for == CAN_OFFER_FOR_INTERSTITAL_ONLY &&
       !profile->GetPrefs()->GetBoolean(prefs::kReverseAutologinEnabled))
     return false;
@@ -548,8 +553,6 @@ bool OneClickSigninHelper::CanOffer(content::WebContents* web_contents,
     return false;
 
   if (!email.empty()) {
-    SigninManager* manager =
-        SigninManagerFactory::GetForProfile(profile);
     if (!manager)
       return false;
 
@@ -658,6 +661,9 @@ OneClickSigninHelper::Offer OneClickSigninHelper::CanOfferOnIOThreadImpl(
   if (io_data->is_incognito())
     return DONT_OFFER;
 
+  if (!SigninManager::IsSigninAllowedOnIOThread(io_data))
+    return DONT_OFFER;
+
   if (!io_data->reverse_autologin_enabled()->GetValue())
     return DONT_OFFER;