Credential passing is the only way for passwords now.

chrome/browser/resources/gaia_auth_host/authenticator.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 <include src="saml_handler.js">
 
 /**
  * @fileoverview An UI component to authenciate to Chrome. The component hosts
  * IdP web pages in a webview. A client who is interested in monitoring
  * authentication events should pass a listener object of type
@@ skipping 494 matching lines @@
    * @param {object} e Payload of the received HTML5 message.
    * @private
    */
   Authenticator.prototype.onMessageFromWebview_ = function(e) {
     if (!this.isGaiaMessage(e))
       return;
 
     var msg = e.data;
     if (msg.method == 'attemptLogin') {
       this.email_ = msg.email;
-      this.password_ = msg.password;
       this.chooseWhatToSync_ = msg.chooseWhatToSync;
       // We need to dispatch only first event, before user enters password.
-      if (!msg.password) {
-        this.dispatchEvent(
-            new CustomEvent('attemptLogin', {detail: msg.email}));
-      }
+      this.dispatchEvent(
+          new CustomEvent('attemptLogin', {detail: msg.email}));
     } else if (msg.method == 'dialogShown') {
       this.dispatchEvent(new Event('dialogShown'));
     } else if (msg.method == 'dialogHidden') {
       this.dispatchEvent(new Event('dialogHidden'));
     } else if (msg.method == 'backButton') {
       this.dispatchEvent(new CustomEvent('backButton', {detail: msg.show}));
     } else if (msg.method == 'showView') {
       this.dispatchEvent(new Event('showView'));
     } else if (msg.method == 'identifierEntered') {
       this.dispatchEvent(new CustomEvent(
@@ skipping 43 matching lines @@
 
     if (this.samlHandler_.samlApiUsed) {
       if (this.samlApiUsedCallback) {
         this.samlApiUsedCallback();
       }
       this.password_ = this.samlHandler_.apiPasswordBytes;
       this.onAuthCompleted_();
       return;
     }
 
-    // TODO(achuith): Eliminate this branch when credential passing api is
-    // stable on prod. crbug.com/467778.
-    if (this.authFlow != AuthFlow.SAML) {
-      this.onAuthCompleted_();
-      return;
-    }
-
     if (this.samlHandler_.scrapedPasswordCount == 0) {
       if (this.noPasswordCallback) {
         this.noPasswordCallback(this.email_);
         return;
       }
 
       // Fall through to finish the auth flow even if this.needPassword
       // is true. This is because the flag is used as an intention to get
       // password when it is available but not a mandatory requirement.
       console.warn('Authenticator: No password scraped for SAML.');
@@ skipping 175 matching lines @@
   Authenticator.AuthMode = AuthMode;
   Authenticator.SUPPORTED_PARAMS = SUPPORTED_PARAMS;
 
   return {
     // TODO(guohui, xiyuan): Rename GaiaAuthHost to Authenticator once the old
     // iframe-based flow is deprecated.
     GaiaAuthHost: Authenticator,
     Authenticator: Authenticator
   };
 });