Perform online reauth when password is changed for a locked profile.

chrome/browser/ui/webui/signin/user_manager_screen_handler.cc

Index: chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
diff --git a/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc b/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
index 6887224827e7b10446995c7b751d0b0e0774d125..c08699855b6882f707201df82a36ab776d194b5b 100644
--- a/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
+++ b/chrome/browser/ui/webui/signin/user_manager_screen_handler.cc
@@ -453,29 +453,18 @@ void UserManagerScreenHandler::HandleAuthenticatedLaunchUser(
     oauth_client_.reset(new gaia::GaiaOAuthClient(
         web_ui()->GetWebContents()->GetBrowserContext()->GetRequestContext()));
   }
+
   std::string token = info_cache.GetPasswordChangeDetectionTokenAtIndex(
-      profile_index);
+      authenticating_profile_index_);
   if (!token.empty()) {
     oauth_client_->GetTokenHandleInfo(token, kMaxOAuthRetries, this);
     return;
   }
 
   // In order to support the upgrade case where we have a local hash but no
-  // password token, we fall back on (deprecated) ClientLogin.  This will
-  // have to be removed in future versions as the service gets turned down
-  // but by then we'll have seamlessly updated the majority of users.
-  client_login_.reset(new GaiaAuthFetcher(
-      this,
-      GaiaConstants::kChromeSource,
-      web_ui()->GetWebContents()->GetBrowserContext()->GetRequestContext()));
-
-  client_login_->StartClientLogin(
-      base::UTF16ToUTF8(email_address),
-      password,
-      GaiaConstants::kSyncService,
-      std::string(),
-      std::string(),
-      GaiaAuthFetcher::HostedAccountsAllowed);
+  // password token, the user perform a full online reauth.
+  UserManager::ShowReauthDialog(web_ui()->GetWebContents()->GetBrowserContext(),
+      base::UTF16ToUTF8(email_address_), authenticating_profile_index_);
 }
 
 void UserManagerScreenHandler::HandleRemoveUser(const base::ListValue* args) {
@@ -579,23 +568,11 @@ void UserManagerScreenHandler::OnGetTokenInfoResponse(
 
 void UserManagerScreenHandler::OnOAuthError() {
   // Password has changed.  Go through online signin flow.
-  // ... if we had it.  Until then, use deprecated ClientLogin to validate
-  // the password.  This will have to be changed soon.  (TODO: bcwhite)
-    oauth_client_.reset();
-    client_login_.reset(new GaiaAuthFetcher(
-      this,
-      GaiaConstants::kChromeSource,
-      web_ui()->GetWebContents()->GetBrowserContext()->GetRequestContext()));
-
   DCHECK(!email_address_.empty());
-  DCHECK(!password_attempt_.empty());
-  client_login_->StartClientLogin(
-      base::UTF16ToUTF8(email_address_),
-      password_attempt_,
-      GaiaConstants::kSyncService,
-      std::string(),
-      std::string(),
-      GaiaAuthFetcher::HostedAccountsAllowed);
+  DCHECK_NE(std::string::npos, authenticating_profile_index_);
+  oauth_client_.reset();
+  UserManager::ShowReauthDialog(web_ui()->GetWebContents()->GetBrowserContext(),
+      base::UTF16ToUTF8(email_address_), authenticating_profile_index_);
 }
 
 void UserManagerScreenHandler::OnNetworkError(int response_code) {
@@ -604,43 +581,6 @@ void UserManagerScreenHandler::OnNetworkError(int response_code) {
     ReportAuthenticationResult(false, ProfileMetrics::AUTH_FAILED_OFFLINE);
 }
 
-void UserManagerScreenHandler::OnClientLoginSuccess(
-    const ClientLoginResult& result) {
-  oauth_client_.reset();
-  LocalAuth::SetLocalAuthCredentials(authenticating_profile_index_,
-                                     password_attempt_);
-  ReportAuthenticationResult(true, ProfileMetrics::AUTH_ONLINE);
-}
-
-void UserManagerScreenHandler::OnClientLoginFailure(
-    const GoogleServiceAuthError& error) {
-  const GoogleServiceAuthError::State state = error.state();
-  // Some "error" results mean the password was correct but some other action
-  // should be taken.  For our purposes, we only care that the password was
-  // correct so count those as a success.
-  bool success = (state == GoogleServiceAuthError::NONE ||
-                  state == GoogleServiceAuthError::CAPTCHA_REQUIRED ||
-                  state == GoogleServiceAuthError::TWO_FACTOR ||
-                  state == GoogleServiceAuthError::ACCOUNT_DELETED ||
-                  state == GoogleServiceAuthError::ACCOUNT_DISABLED ||
-                  state == GoogleServiceAuthError::WEB_LOGIN_REQUIRED);
-
-  // If the password was correct, the user must have changed it since the
-  // profile was locked.  Save the password to streamline future unlocks.
-  if (success) {
-    DCHECK(!password_attempt_.empty());
-    LocalAuth::SetLocalAuthCredentials(authenticating_profile_index_,
-                                       password_attempt_);
-  }
-
-  bool offline = error.IsTransientError();
-  ProfileMetrics::ProfileAuth failure_metric =
-      offline ? ProfileMetrics::AUTH_FAILED_OFFLINE :
-                ProfileMetrics::AUTH_FAILED;
-  ReportAuthenticationResult(
-      success, success ? ProfileMetrics::AUTH_ONLINE : failure_metric);
-}
-
 void UserManagerScreenHandler::RegisterMessages() {
   web_ui()->RegisterMessageCallback(kJsApiUserManagerInitialize,
       base::Bind(&UserManagerScreenHandler::HandleInitialize,