Added affiliation IDs for the new affiliation determination.

chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc

Index: chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc
diff --git a/chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc b/chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc
index 6cdf4b8b7590d1bf93e697480f119cf4516a0d63..c029411f45aded2ae52b47989e7d11794b7aa5e5 100644
--- a/chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc
+++ b/chrome/browser/chromeos/login/users/chrome_user_manager_impl.cc
@@ -29,6 +29,7 @@
 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
 #include "chrome/browser/chromeos/login/signin/auth_sync_observer.h"
 #include "chrome/browser/chromeos/login/signin/auth_sync_observer_factory.h"
+#include "chrome/browser/chromeos/login/users/affiliation.h"
 #include "chrome/browser/chromeos/login/users/avatar/user_image_manager_impl.h"
 #include "chrome/browser/chromeos/login/users/multi_profile_user_controller.h"
 #include "chrome/browser/chromeos/login/users/supervised_user_manager_impl.h"
@@ -94,6 +95,7 @@ void ChromeUserManagerImpl::RegisterPrefs(PrefRegistrySimple* registry) {
 
   registry->RegisterListPref(kPublicAccounts);
   registry->RegisterStringPref(kPublicAccountPendingDataRemoval, std::string());
+
   SupervisedUserManager::RegisterPrefs(registry);
   SessionLengthLimiter::RegisterPrefs(registry);
   BootstrapManager::RegisterPrefs(registry);
@@ -721,6 +723,26 @@ bool ChromeUserManagerImpl::HasPendingBootstrap(
   return bootstrap_manager_->HasPendingBootstrap(user_id);
 }
 
+std::set<std::string> ChromeUserManagerImpl::GetDeviceAffiliationIDs() const {

[Mattias Nissler (ping if slow), 2015/07/29 20:08:13]

Any good reason to have this as a separate function?

[peletskyi, 2015/07/30 11:02:27]

Done.

+  return g_browser_process->platform_part()
+      ->browser_policy_connector_chromeos()
+      ->GetDeviceAffiliationIDs();
+}
+
+std::string ChromeUserManagerImpl::GetEnterpriseDomain() const {

[Mattias Nissler (ping if slow), 2015/07/29 20:08:13]

ditto, can't this simply be inlined in IsUserAffiliated?

[peletskyi, 2015/07/30 11:02:27]

Done.

+  return g_browser_process->platform_part()
+      ->browser_policy_connector_chromeos()
+      ->GetEnterpriseDomain();
+}
+
+bool ChromeUserManagerImpl::IsUserAffiliated(
+    const std::set<std::string>& user_affiliation_ids,
+    const std::string& user_email) const {
+  return chromeos::IsUserAffiliated(user_affiliation_ids,
+                                    GetDeviceAffiliationIDs(), user_email,
+                                    GetEnterpriseDomain());
+}
+
 void ChromeUserManagerImpl::PublicAccountUserLoggedIn(
     user_manager::User* user) {
   SetIsCurrentUserNew(true);
@@ -1121,4 +1143,15 @@ void ChromeUserManagerImpl::UpdateUserTimeZoneRefresher(Profile* profile) {
   }
 }
 
+void ChromeUserManagerImpl::SetUserAffiliation(
+    const std::string& user_id,
+    const std::set<std::string>& user_affiliation_ids) {
+  LOG(ERROR) << "SetUserAffiliation is not implemented yet. Called for user: "
+             << user_id;
+  if (user_manager::User* user = FindUserAndModify(user_id)) {
+    LOG(ERROR) << "Affiliation to set: "
+               << IsUserAffiliated(user_affiliation_ids, user->GetEmail());

[Mattias Nissler (ping if slow), 2015/07/29 20:08:13]

If you really just need to set the affiliation field in the user object, you
might just as well compute the affiliation in the caller, and then pass it in
here. However, neither solution will handle the case where the device-level
affiliation IDs change after policy fetch, and hence user affiliation needs to
be adjusted. Or maybe that is an edge case we don't care about?

On a related note: Wasn't the whole reason we decided to move the affiliation
field to User to enable caching there? Will we still cache something? If not, it
might actually not make much sense to move the affiliation field into the User
class at all... I might be missing something though.

[peletskyi, 2015/07/30 11:02:27]

Many features are not updated when affiliation is changed after user is
logged-in. Thus we only care about login-time value and guarantee that new
affiliation will fully work after user would log in again. On that time new
device affiliation IDs are fetched and will have affect. Besides this after each
user policy fetch affiliation status is updated. So, if admin wants to have
updated affiliation at any time, he can just enforce user policy update.
The whole idea was that we should keep affiliation value somewhere. And User
seems to be the best place.

[Mattias Nissler (ping if slow), 2015/07/30 12:10:57]

OK, fair.
OK - now that components/User doesn't do any data caching etc., please make sure
that components/user/OWNERS are fine with this. I see you already added
dpolukhin@, so let's see what he says.

+  }
+}
+
 }  // namespace chromeos