Add policy that forces SAML users to log in online periodically

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 100 matching lines @@
 #   templates and documentation. The policy definition list that Chrome sees
 #   will include policies marked with 'future'. If a WIP policy isn't meant to
 #   be seen by the policy providers either, the 'supported_on' key should be set
 #   to an empty list.
 #
 # IDs:
 #   Since a Protocol Buffer definition is generated from this file, unique and
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 252
+#   For your editing convenience: highest ID currently used: 253
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
 #     $1 -> Google Chrome / Chromium
 #     $2 -> Google Chrome OS / Chromium OS
 #     $3 -> Google Chrome Frame / Chromium Frame
 #     $6 is reserved for doc_writer
 #
 # Device Policy:
 #   An additional flag device_only (optional, defaults to False) indicates
@@ skipping 3293 matching lines @@
       'caption': '''Ephemeral profile''',
       'desc': '''If set to enabled this policy forces the profile to be switched to ephemeral mode. If this policy is specified as an OS policy (e.g. GPO on Windows) it will apply to every profile on the system; if the policy is set as a Cloud policy it will apply only to a profile signed in with a managed account.
 
       In this mode the profile data is persisted on disk only for the length of the user session. Features like browser history, extensions and their data, web data like cookies and web databases are not preserved after the browser is closed. However this does not prevent the user from downloading any data to disk manually, save pages or print them.
 
       If the user has enabled sync all this data is preserved in his sync profile just like with regular profiles. Incognito mode is also available if not explicitly disabled by policy.
 
       If the policy is set to disabled or left not set signing in leads to regular profiles.'''
     },
     {
+      'name': 'SAMLOfflineSigninTimeLimit',
+      'type': 'int',
+      'schema': { 'type': 'integer', 'minimum': -1 },
+      'supported_on': ['chrome_os:34-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 32,
+      'id': 253,
+      'caption': '''Limit the time for which a user authenticated via SAML can log in offline''',
+      'desc': '''Limit the time for which a user authenticated via SAML can log in offline.
+
+      During login, Chrome OS can authenticate against a server (online) or using a cached password (offline).
+
+      When this policy is set to a value of -1, the user can authenticate offline indefinitely. When this policy is set to any other value, it specifies the length of time since the last online authentication after which the user must use online authentication again.
+
+      Leaving this policy not set will make <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> use a default value for the time limit after which the user must use online authentication again.

[dconnelly, 2014/01/23 08:40:56]

is this default value specified anywhere?

[bartfab (slow), 2014/01/23 09:47:23]

I had intentionally left it out because the default is not 100% decided yet. But
I see no harm in including it here. If we decide to change the defaults, I will
just update policy_templates.json.

Done.

+
+      This policy affects only users who authenticated using SAML.
+
+      The policy value should be specified in seconds.''',
+    },
+    {
       'name': 'AutoCleanUpStrategy',
       'type': 'string-enum',
       'schema': {
         'type': 'string',
         'enum': [ 'remove-lru', 'remove-lru-if-dormant' ],
       },
       'items': [
         {
           'name': 'RemoveLRU',
           'value': 'remove-lru',
@@ skipping 2527 matching lines @@
       'desc': '''Text appended in parentheses to the policy name to indicate that it has been deprecated''',
       'text': 'deprecated',
     },
     'doc_recommended': {
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
   },
   'placeholders': [],
 }