Public Sessions: fetch device robot api token during enterprise enrollment.

chrome/browser/policy/cloud/cloud_policy_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/cloud/cloud_policy_client.h"
 
 #include "base/bind.h"
 #include "base/guid.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "chrome/browser/policy/cloud/device_management_service.h"
 
 namespace em = enterprise_management;
 
 namespace policy {
 
 namespace {
 
+const char kAnyApiOAuth2Scope[] = "https://www.googleapis.com/auth/any-api";

[Mattias Nissler (ping if slow), 2013/03/19 06:33:08]

This should probably go into gaia_constants.h (or whereever the scope strings
are right now).

[David Roche, 2013/04/02 01:59:25]

Done.

+
 // Translates the DeviceRegisterResponse::DeviceMode |mode| to the enum used
 // internally to represent different device modes.
 DeviceMode TranslateProtobufDeviceMode(
     em::DeviceRegisterResponse::DeviceMode mode) {
   switch (mode) {
     case em::DeviceRegisterResponse::ENTERPRISE:
       return DEVICE_MODE_ENTERPRISE;
     case em::DeviceRegisterResponse::RETAIL:
       return DEVICE_MODE_KIOSK;
   }
@@ skipping 141 matching lines @@
             request->mutable_session_status_report_request())) {
       request->clear_session_status_report_request();
     }
   }
 
   // Fire the job.
   request_job_->Start(base::Bind(&CloudPolicyClient::OnPolicyFetchCompleted,
                                  base::Unretained(this)));
 }
 
+void CloudPolicyClient::FetchRobotAuthTokens(const std::string& auth_token) {
+  CHECK(is_registered());
+  DCHECK(!auth_token.empty());
+
+  request_job_.reset(service_->CreateJob(
+      DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH));
+  // The credentials of a domain user are needed in order to mint a new OAuth2
+  // authorization token for the robot account.
+  request_job_->SetOAuthToken(auth_token);
+  request_job_->SetClientID(client_id_);
+
+  em::DeviceServiceApiAccessRequest* request =
+      request_job_->GetRequest()->mutable_service_api_access_request();
+  request->add_auth_scope(kAnyApiOAuth2Scope);
+
+  request_job_->Start(
+      base::Bind(&CloudPolicyClient::OnFetchRobotAuthTokensCompleted,
+                 base::Unretained(this)));
+}
+
 void CloudPolicyClient::Unregister() {
   DCHECK(service_);
   request_job_.reset(
       service_->CreateJob(DeviceManagementRequestJob::TYPE_UNREGISTRATION));
   request_job_->SetDMToken(dm_token_);
   request_job_->SetClientID(client_id_);
   request_job_->GetRequest()->mutable_unregister_request();
   request_job_->Start(base::Bind(&CloudPolicyClient::OnUnregisterCompleted,
                                  base::Unretained(this)));
 }
@@ skipping 52 matching lines @@
       device_mode_ = TranslateProtobufDeviceMode(
           response.register_response().enrollment_type());
     }
 
     NotifyRegistrationStateChanged();
   } else {
     NotifyClientError();
   }
 }
 
+void CloudPolicyClient::OnFetchRobotAuthTokensCompleted(
+    DeviceManagementStatus status,
+    const em::DeviceManagementResponse& response) {
+  if (status == DM_STATUS_SUCCESS &&
+      (!response.has_service_api_access_response() ||
+       response.service_api_access_response().auth_code().empty())) {
+    // TODO: retry on transient errors?

[Mattias Nissler (ping if slow), 2013/03/19 06:33:08]

Not needed for now - the user can retry manually.

[David Roche, 2013/04/02 01:59:25]

Done.

+    LOG(WARNING) << "Invalid service api access response.";
+    status = DM_STATUS_RESPONSE_DECODING_ERROR;
+  }
+
+  status_ = status;
+  if (status == DM_STATUS_SUCCESS) {
+    robot_api_auth_code_ = response.service_api_access_response().auth_code();
+    DVLOG(1) << "Device robot account auth code fetch complete - code = "
+             << robot_api_auth_code_;
+
+    NotifyRobotAuthCodesFetched();
+  } else {
+    NotifyClientError();
+  }
+}
+
 void CloudPolicyClient::OnPolicyFetchCompleted(
     DeviceManagementStatus status,
     const em::DeviceManagementResponse& response) {
   if (status == DM_STATUS_SUCCESS) {
     if (!response.has_policy_response() ||
         response.policy_response().response_size() == 0) {
       LOG(WARNING) << "Empty policy response.";
       status = DM_STATUS_RESPONSE_DECODING_ERROR;
     }
   }
@@ skipping 50 matching lines @@
 }
 
 void CloudPolicyClient::NotifyPolicyFetched() {
   FOR_EACH_OBSERVER(Observer, observers_, OnPolicyFetched(this));
 }
 
 void CloudPolicyClient::NotifyRegistrationStateChanged() {
   FOR_EACH_OBSERVER(Observer, observers_, OnRegistrationStateChanged(this));
 }
 
+void CloudPolicyClient::NotifyRobotAuthCodesFetched() {
+  FOR_EACH_OBSERVER(Observer, observers_, OnRobotAuthCodesFetched(this));
+}
+
 void CloudPolicyClient::NotifyClientError() {
   FOR_EACH_OBSERVER(Observer, observers_, OnClientError(this));
 }
 
 }  // namespace policy