Make an online wildcard login check for enterprise devices.

chrome/browser/chromeos/policy/user_cloud_policy_token_forwarder.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_cloud_policy_token_forwarder.h"
 
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h"
 #include "chrome/browser/signin/profile_oauth2_token_service.h"
 #include "components/policy/core/common/cloud/cloud_policy_core.h"
 #include "content/public/browser/notification_source.h"
 #include "google_apis/gaia/gaia_constants.h"
+#include "google_apis/gaia/gaia_urls.h"
 
 namespace policy {
 
 UserCloudPolicyTokenForwarder::UserCloudPolicyTokenForwarder(
     UserCloudPolicyManagerChromeOS* manager,
     ProfileOAuth2TokenService* token_service)
     : OAuth2TokenService::Consumer("policy_token_forwarder"),
       manager_(manager),
       token_service_(token_service) {
   // Start by waiting for the CloudPolicyService to be initialized, so that
@@ skipping 43 matching lines @@
   // enforces a cached policy.
   Shutdown();
 }
 
 void UserCloudPolicyTokenForwarder::OnInitializationCompleted(
     CloudPolicyService* service) {
   Initialize();
 }
 
 void UserCloudPolicyTokenForwarder::Initialize() {
-  if (manager_->IsClientRegistered()) {
-    // We already have a DMToken, so no need to ask for an access token.
-    // All done here.
-    Shutdown();
-    return;
-  }
+  // TODO(mnissler): Once a better way to reconfirm whether a user is on the
+  // login whitelist is available, there is no reason to fetch the OAuth2 token
+  // here if the client is already registered, so check and bail out here.
 

[Joao da Silva, 2014/01/28 14:45:46]

We never revoke this token; I don't know if the ProfileOAuth2TokenService takes
care of that for us. If it doesn't then this may hit a token limit.

[Mattias Nissler (ping if slow), 2014/01/28 15:44:22]

I don't think that's a problem here, ProfileOAuth2TokenService caches existing
tokens instead of recreating them all the time. Also, we're talking about an
access token here, which has limited validity time (60 min IIRC).

   if (token_service_->RefreshTokenIsAvailable(
           token_service_->GetPrimaryAccountId()))
     RequestAccessToken();
   else
     token_service_->AddObserver(this);
 }
 
 void UserCloudPolicyTokenForwarder::RequestAccessToken() {
   OAuth2TokenService::ScopeSet scopes;
   scopes.insert(GaiaConstants::kDeviceManagementServiceOAuth);
+  scopes.insert(GaiaUrls::GetInstance()->oauth_wrap_bridge_user_info_scope());
   request_ = token_service_->StartRequest(
       token_service_->GetPrimaryAccountId(), scopes, this);
 }
 
 }  // namespace policy