| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "chrome/browser/policy/enrollment_handler_chromeos.h" | |
| 6 | |
| 7 #include "base/bind.h" | |
| 8 #include "base/logging.h" | |
| 9 #include "base/message_loop.h" | |
| 10 #include "chrome/browser/policy/cloud_policy_constants.h" | |
| 11 #include "chrome/browser/policy/device_cloud_policy_store_chromeos.h" | |
| 12 #include "chrome/browser/policy/enterprise_install_attributes.h" | |
| 13 #include "chrome/browser/policy/proto/device_management_backend.pb.h" | |
| 14 | |
| 15 namespace em = enterprise_management; | |
| 16 | |
| 17 namespace policy { | |
| 18 | |
| 19 namespace { | |
| 20 | |
| 21 // Retry for InstallAttrs initialization every 500ms. | |
| 22 const int kLockRetryIntervalMs = 500; | |
| 23 // Maximum time to retry InstallAttrs initialization before we give up. | |
| 24 const int kLockRetryTimeoutMs = 10 * 60 * 1000; // 10 minutes. | |
| 25 | |
| 26 } // namespace | |
| 27 | |
| 28 EnrollmentHandlerChromeOS::EnrollmentHandlerChromeOS( | |
| 29 DeviceCloudPolicyStoreChromeOS* store, | |
| 30 EnterpriseInstallAttributes* install_attributes, | |
| 31 scoped_ptr<CloudPolicyClient> client, | |
| 32 const std::string& auth_token, | |
| 33 const std::string& client_id, | |
| 34 bool is_auto_enrollment, | |
| 35 const AllowedDeviceModes& allowed_device_modes, | |
| 36 const EnrollmentCallback& completion_callback) | |
| 37 : store_(store), | |
| 38 install_attributes_(install_attributes), | |
| 39 client_(client.Pass()), | |
| 40 auth_token_(auth_token), | |
| 41 client_id_(client_id), | |
| 42 is_auto_enrollment_(is_auto_enrollment), | |
| 43 allowed_device_modes_(allowed_device_modes), | |
| 44 completion_callback_(completion_callback), | |
| 45 device_mode_(DEVICE_MODE_NOT_SET), | |
| 46 enrollment_step_(STEP_PENDING), | |
| 47 lockbox_init_duration_(0), | |
| 48 ALLOW_THIS_IN_INITIALIZER_LIST(weak_factory_(this)) { | |
| 49 CHECK(!client_->is_registered()); | |
| 50 CHECK_EQ(DM_STATUS_SUCCESS, client_->status()); | |
| 51 store_->AddObserver(this); | |
| 52 client_->AddObserver(this); | |
| 53 client_->AddNamespaceToFetch(PolicyNamespaceKey( | |
| 54 dm_protocol::kChromeDevicePolicyType, std::string())); | |
| 55 } | |
| 56 | |
| 57 EnrollmentHandlerChromeOS::~EnrollmentHandlerChromeOS() { | |
| 58 Stop(); | |
| 59 store_->RemoveObserver(this); | |
| 60 } | |
| 61 | |
| 62 void EnrollmentHandlerChromeOS::StartEnrollment() { | |
| 63 CHECK_EQ(STEP_PENDING, enrollment_step_); | |
| 64 enrollment_step_ = STEP_LOADING_STORE; | |
| 65 AttemptRegistration(); | |
| 66 } | |
| 67 | |
| 68 scoped_ptr<CloudPolicyClient> EnrollmentHandlerChromeOS::ReleaseClient() { | |
| 69 Stop(); | |
| 70 return client_.Pass(); | |
| 71 } | |
| 72 | |
| 73 void EnrollmentHandlerChromeOS::OnPolicyFetched(CloudPolicyClient* client) { | |
| 74 DCHECK_EQ(client_.get(), client); | |
| 75 CHECK_EQ(STEP_POLICY_FETCH, enrollment_step_); | |
| 76 | |
| 77 enrollment_step_ = STEP_VALIDATION; | |
| 78 | |
| 79 // Validate the policy. | |
| 80 const em::PolicyFetchResponse* policy = client_->GetPolicyFor( | |
| 81 PolicyNamespaceKey(dm_protocol::kChromeDevicePolicyType, std::string())); | |
| 82 if (!policy) { | |
| 83 ReportResult(EnrollmentStatus::ForFetchError( | |
| 84 DM_STATUS_RESPONSE_DECODING_ERROR)); | |
| 85 return; | |
| 86 } | |
| 87 | |
| 88 scoped_ptr<DeviceCloudPolicyValidator> validator( | |
| 89 DeviceCloudPolicyValidator::Create( | |
| 90 scoped_ptr<em::PolicyFetchResponse>( | |
| 91 new em::PolicyFetchResponse(*policy)))); | |
| 92 | |
| 93 validator->ValidateTimestamp(base::Time(), base::Time::NowFromSystemTime(), | |
| 94 false); | |
| 95 if (install_attributes_->IsEnterpriseDevice()) | |
| 96 validator->ValidateDomain(install_attributes_->GetDomain()); | |
| 97 validator->ValidateDMToken(client->dm_token()); | |
| 98 validator->ValidatePolicyType(dm_protocol::kChromeDevicePolicyType); | |
| 99 validator->ValidatePayload(); | |
| 100 validator->ValidateInitialKey(); | |
| 101 validator.release()->StartValidation( | |
| 102 base::Bind(&EnrollmentHandlerChromeOS::PolicyValidated, | |
| 103 weak_factory_.GetWeakPtr())); | |
| 104 } | |
| 105 | |
| 106 void EnrollmentHandlerChromeOS::OnRegistrationStateChanged( | |
| 107 CloudPolicyClient* client) { | |
| 108 DCHECK_EQ(client_.get(), client); | |
| 109 | |
| 110 if (enrollment_step_ == STEP_REGISTRATION && client_->is_registered()) { | |
| 111 enrollment_step_ = STEP_POLICY_FETCH, | |
| 112 device_mode_ = client_->device_mode(); | |
| 113 if (device_mode_ == DEVICE_MODE_NOT_SET) | |
| 114 device_mode_ = DEVICE_MODE_ENTERPRISE; | |
| 115 if (!allowed_device_modes_.test(device_mode_)) { | |
| 116 LOG(ERROR) << "Bad device mode " << device_mode_; | |
| 117 ReportResult(EnrollmentStatus::ForStatus( | |
| 118 EnrollmentStatus::STATUS_REGISTRATION_BAD_MODE)); | |
| 119 return; | |
| 120 } | |
| 121 client_->FetchPolicy(); | |
| 122 } else { | |
| 123 LOG(FATAL) << "Registration state changed to " << client_->is_registered() | |
| 124 << " in step " << enrollment_step_; | |
| 125 } | |
| 126 } | |
| 127 | |
| 128 void EnrollmentHandlerChromeOS::OnClientError(CloudPolicyClient* client) { | |
| 129 DCHECK_EQ(client_.get(), client); | |
| 130 | |
| 131 if (enrollment_step_ < STEP_POLICY_FETCH) | |
| 132 ReportResult(EnrollmentStatus::ForRegistrationError(client_->status())); | |
| 133 else | |
| 134 ReportResult(EnrollmentStatus::ForFetchError(client_->status())); | |
| 135 } | |
| 136 | |
| 137 void EnrollmentHandlerChromeOS::OnStoreLoaded(CloudPolicyStore* store) { | |
| 138 DCHECK_EQ(store_, store); | |
| 139 | |
| 140 if (enrollment_step_ == STEP_LOADING_STORE) { | |
| 141 AttemptRegistration(); | |
| 142 } else if (enrollment_step_ == STEP_STORE_POLICY) { | |
| 143 ReportResult(EnrollmentStatus::ForStatus(EnrollmentStatus::STATUS_SUCCESS)); | |
| 144 } | |
| 145 } | |
| 146 | |
| 147 void EnrollmentHandlerChromeOS::OnStoreError(CloudPolicyStore* store) { | |
| 148 DCHECK_EQ(store_, store); | |
| 149 ReportResult(EnrollmentStatus::ForStoreError(store_->status(), | |
| 150 store_->validation_status())); | |
| 151 } | |
| 152 | |
| 153 void EnrollmentHandlerChromeOS::AttemptRegistration() { | |
| 154 CHECK_EQ(STEP_LOADING_STORE, enrollment_step_); | |
| 155 if (store_->is_initialized()) { | |
| 156 enrollment_step_ = STEP_REGISTRATION; | |
| 157 client_->Register(em::DeviceRegisterRequest::DEVICE, | |
| 158 auth_token_, client_id_, is_auto_enrollment_); | |
| 159 } | |
| 160 } | |
| 161 | |
| 162 void EnrollmentHandlerChromeOS::PolicyValidated( | |
| 163 DeviceCloudPolicyValidator* validator) { | |
| 164 CHECK_EQ(STEP_VALIDATION, enrollment_step_); | |
| 165 if (validator->success()) { | |
| 166 policy_ = validator->policy().Pass(); | |
| 167 enrollment_step_ = STEP_LOCK_DEVICE; | |
| 168 WriteInstallAttributes(validator->policy_data()->username(), device_mode_, | |
| 169 validator->policy_data()->device_id()); | |
| 170 } else { | |
| 171 ReportResult(EnrollmentStatus::ForValidationError(validator->status())); | |
| 172 } | |
| 173 } | |
| 174 | |
| 175 void EnrollmentHandlerChromeOS::WriteInstallAttributes( | |
| 176 const std::string& user, | |
| 177 DeviceMode device_mode, | |
| 178 const std::string& device_id) { | |
| 179 CHECK_EQ(STEP_LOCK_DEVICE, enrollment_step_); | |
| 180 // Since this method is also called directly. | |
| 181 weak_factory_.InvalidateWeakPtrs(); | |
| 182 | |
| 183 EnterpriseInstallAttributes::LockResult lock_result = | |
| 184 install_attributes_->LockDevice(user, device_mode, device_id); | |
| 185 switch (lock_result) { | |
| 186 case EnterpriseInstallAttributes::LOCK_SUCCESS: | |
| 187 enrollment_step_ = STEP_STORE_POLICY; | |
| 188 store_->InstallInitialPolicy(*policy_); | |
| 189 return; | |
| 190 case EnterpriseInstallAttributes::LOCK_NOT_READY: | |
| 191 // We wait up to |kLockRetryTimeoutMs| milliseconds and if it hasn't | |
| 192 // succeeded by then show an error to the user and stop the enrollment. | |
| 193 if (lockbox_init_duration_ < kLockRetryTimeoutMs) { | |
| 194 // InstallAttributes not ready yet, retry later. | |
| 195 LOG(WARNING) << "Install Attributes not ready yet will retry in " | |
| 196 << kLockRetryIntervalMs << "ms."; | |
| 197 MessageLoop::current()->PostDelayedTask( | |
| 198 FROM_HERE, | |
| 199 base::Bind(&EnrollmentHandlerChromeOS::WriteInstallAttributes, | |
| 200 weak_factory_.GetWeakPtr(), | |
| 201 user, device_mode, device_id), | |
| 202 base::TimeDelta::FromMilliseconds(kLockRetryIntervalMs)); | |
| 203 lockbox_init_duration_ += kLockRetryIntervalMs; | |
| 204 } else { | |
| 205 ReportResult(EnrollmentStatus::ForStatus( | |
| 206 EnrollmentStatus::STATUS_LOCK_TIMEOUT)); | |
| 207 } | |
| 208 return; | |
| 209 case EnterpriseInstallAttributes::LOCK_BACKEND_ERROR: | |
| 210 ReportResult(EnrollmentStatus::ForStatus( | |
| 211 EnrollmentStatus::STATUS_LOCK_ERROR)); | |
| 212 return; | |
| 213 case EnterpriseInstallAttributes::LOCK_WRONG_USER: | |
| 214 LOG(ERROR) << "Enrollment cannot proceed because the InstallAttrs " | |
| 215 << "has been locked already!"; | |
| 216 ReportResult(EnrollmentStatus::ForStatus( | |
| 217 EnrollmentStatus::STATUS_LOCK_WRONG_USER)); | |
| 218 return; | |
| 219 } | |
| 220 | |
| 221 NOTREACHED() << "Invalid lock result " << lock_result; | |
| 222 ReportResult(EnrollmentStatus::ForStatus( | |
| 223 EnrollmentStatus::STATUS_LOCK_ERROR)); | |
| 224 } | |
| 225 | |
| 226 void EnrollmentHandlerChromeOS::Stop() { | |
| 227 if (client_.get()) | |
| 228 client_->RemoveObserver(this); | |
| 229 enrollment_step_ = STEP_FINISHED; | |
| 230 weak_factory_.InvalidateWeakPtrs(); | |
| 231 completion_callback_.Reset(); | |
| 232 } | |
| 233 | |
| 234 void EnrollmentHandlerChromeOS::ReportResult(EnrollmentStatus status) { | |
| 235 EnrollmentCallback callback = completion_callback_; | |
| 236 Stop(); | |
| 237 | |
| 238 if (status.status() != EnrollmentStatus::STATUS_SUCCESS) { | |
| 239 LOG(WARNING) << "Enrollment failed: " << status.status() | |
| 240 << " " << status.client_status() | |
| 241 << " " << status.validation_status() | |
| 242 << " " << status.store_status(); | |
| 243 } | |
| 244 | |
| 245 if (!callback.is_null()) | |
| 246 callback.Run(status); | |
| 247 } | |
| 248 | |
| 249 } // namespace policy | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 12189011:
Split up chrome/browser/policy subdirectory (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src