OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/chromeos/login/supervised/supervised_user_login_flow.h" | 5 #include "chrome/browser/chromeos/login/supervised/supervised_user_login_flow.h" |
6 | 6 |
7 #include "base/base64.h" | 7 #include "base/base64.h" |
8 #include "base/command_line.h" | 8 #include "base/command_line.h" |
9 #include "base/logging.h" | 9 #include "base/logging.h" |
10 #include "base/metrics/histogram.h" | 10 #include "base/metrics/histogram.h" |
(...skipping 10 matching lines...) Expand all Loading... | |
21 #include "chrome/browser/chromeos/login/wizard_controller.h" | 21 #include "chrome/browser/chromeos/login/wizard_controller.h" |
22 #include "chrome/common/chrome_switches.h" | 22 #include "chrome/common/chrome_switches.h" |
23 #include "chromeos/login/auth/key.h" | 23 #include "chromeos/login/auth/key.h" |
24 #include "components/user_manager/user_manager.h" | 24 #include "components/user_manager/user_manager.h" |
25 #include "content/public/browser/browser_thread.h" | 25 #include "content/public/browser/browser_thread.h" |
26 | 26 |
27 using content::BrowserThread; | 27 using content::BrowserThread; |
28 | 28 |
29 namespace chromeos { | 29 namespace chromeos { |
30 | 30 |
31 SupervisedUserLoginFlow::SupervisedUserLoginFlow( | 31 SupervisedUserLoginFlow::SupervisedUserLoginFlow(const AccountId& account_id) |
32 const std::string& user_id) | 32 : ExtendedUserFlow(account_id), data_loaded_(false), weak_factory_(this) {} |
33 : ExtendedUserFlow(user_id), | |
34 data_loaded_(false), | |
35 weak_factory_(this) { | |
36 } | |
37 | 33 |
38 SupervisedUserLoginFlow::~SupervisedUserLoginFlow() {} | 34 SupervisedUserLoginFlow::~SupervisedUserLoginFlow() {} |
39 | 35 |
40 void SupervisedUserLoginFlow::AppendAdditionalCommandLineSwitches() { | 36 void SupervisedUserLoginFlow::AppendAdditionalCommandLineSwitches() { |
41 user_manager::UserManager* user_manager = user_manager::UserManager::Get(); | 37 user_manager::UserManager* user_manager = user_manager::UserManager::Get(); |
42 if (user_manager->IsCurrentUserNew()) { | 38 if (user_manager->IsCurrentUserNew()) { |
43 // Supervised users should launch into empty desktop on first run. | 39 // Supervised users should launch into empty desktop on first run. |
44 base::CommandLine::ForCurrentProcess()->AppendSwitch( | 40 base::CommandLine::ForCurrentProcess()->AppendSwitch( |
45 ::switches::kSilentLaunch); | 41 ::switches::kSilentLaunch); |
46 } | 42 } |
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
79 void SupervisedUserLoginFlow::ConfigureSync(const std::string& token) { | 75 void SupervisedUserLoginFlow::ConfigureSync(const std::string& token) { |
80 data_loaded_ = true; | 76 data_loaded_ = true; |
81 | 77 |
82 // TODO(antrim): add error handling (no token loaded). | 78 // TODO(antrim): add error handling (no token loaded). |
83 // See also: http://crbug.com/312751 | 79 // See also: http://crbug.com/312751 |
84 ChromeUserManager::Get()->GetSupervisedUserManager()->ConfigureSyncWithToken( | 80 ChromeUserManager::Get()->GetSupervisedUserManager()->ConfigureSyncWithToken( |
85 profile_, token); | 81 profile_, token); |
86 SupervisedUserAuthentication* auth = | 82 SupervisedUserAuthentication* auth = |
87 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 83 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
88 | 84 |
89 if (auth->HasScheduledPasswordUpdate(user_id())) { | 85 if (auth->HasScheduledPasswordUpdate(account_id().GetUserEmail())) { |
90 auth->LoadPasswordUpdateData( | 86 auth->LoadPasswordUpdateData( |
91 user_id(), | 87 account_id().GetUserEmail(), |
92 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoaded, | 88 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoaded, |
93 weak_factory_.GetWeakPtr()), | 89 weak_factory_.GetWeakPtr()), |
94 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoadFailed, | 90 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoadFailed, |
95 weak_factory_.GetWeakPtr())); | 91 weak_factory_.GetWeakPtr())); |
96 return; | 92 return; |
97 } | 93 } |
98 Finish(); | 94 Finish(); |
99 } | 95 } |
100 | 96 |
101 void SupervisedUserLoginFlow::HandleLoginSuccess( | 97 void SupervisedUserLoginFlow::HandleLoginSuccess( |
102 const UserContext& login_context) { | 98 const UserContext& login_context) { |
103 context_ = login_context; | 99 context_ = login_context; |
104 } | 100 } |
105 | 101 |
106 void SupervisedUserLoginFlow::OnPasswordChangeDataLoaded( | 102 void SupervisedUserLoginFlow::OnPasswordChangeDataLoaded( |
107 const base::DictionaryValue* password_data) { | 103 const base::DictionaryValue* password_data) { |
108 // Edge case, when manager has signed in and already updated the password. | 104 // Edge case, when manager has signed in and already updated the password. |
109 SupervisedUserAuthentication* auth = | 105 SupervisedUserAuthentication* auth = |
110 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 106 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
111 if (!auth->NeedPasswordChange(user_id(), password_data)) { | 107 if (!auth->NeedPasswordChange(account_id().GetUserEmail(), password_data)) { |
112 VLOG(1) << "Password already changed for " << user_id(); | 108 VLOG(1) << "Password already changed for " << account_id().Serialize(); |
113 auth->ClearScheduledPasswordUpdate(user_id()); | 109 auth->ClearScheduledPasswordUpdate(account_id().GetUserEmail()); |
114 Finish(); | 110 Finish(); |
115 return; | 111 return; |
116 } | 112 } |
117 | 113 |
118 // Two cases now - we can currently have either old-style password, or new | 114 // Two cases now - we can currently have either old-style password, or new |
119 // password. | 115 // password. |
120 std::string base64_signature; | 116 std::string base64_signature; |
121 std::string signature; | 117 std::string signature; |
122 std::string password; | 118 std::string password; |
123 int revision = 0; | 119 int revision = 0; |
(...skipping 17 matching lines...) Expand all Loading... | |
141 return; | 137 return; |
142 } | 138 } |
143 base::Base64Decode(base64_signature, &signature); | 139 base::Base64Decode(base64_signature, &signature); |
144 scoped_ptr<base::DictionaryValue> data_copy(password_data->DeepCopy()); | 140 scoped_ptr<base::DictionaryValue> data_copy(password_data->DeepCopy()); |
145 cryptohome::KeyDefinition key(password, | 141 cryptohome::KeyDefinition key(password, |
146 kCryptohomeSupervisedUserKeyLabel, | 142 kCryptohomeSupervisedUserKeyLabel, |
147 kCryptohomeSupervisedUserKeyPrivileges); | 143 kCryptohomeSupervisedUserKeyPrivileges); |
148 | 144 |
149 authenticator_ = ExtendedAuthenticator::Create(this); | 145 authenticator_ = ExtendedAuthenticator::Create(this); |
150 SupervisedUserAuthentication::Schema current_schema = | 146 SupervisedUserAuthentication::Schema current_schema = |
151 auth->GetPasswordSchema(user_id()); | 147 auth->GetPasswordSchema(account_id().GetUserEmail()); |
152 | 148 |
153 key.revision = revision; | 149 key.revision = revision; |
154 | 150 |
155 if (SupervisedUserAuthentication::SCHEMA_PLAIN == current_schema) { | 151 if (SupervisedUserAuthentication::SCHEMA_PLAIN == current_schema) { |
156 // We need to add new key, and block old one. As we don't actually have | 152 // We need to add new key, and block old one. As we don't actually have |
157 // signature key, use Migrate privilege instead of AuthorizedUpdate. | 153 // signature key, use Migrate privilege instead of AuthorizedUpdate. |
158 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; | 154 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; |
159 | 155 |
160 VLOG(1) << "Adding new schema key"; | 156 VLOG(1) << "Adding new schema key"; |
161 DCHECK(context_.GetKey()->GetLabel().empty()); | 157 DCHECK(context_.GetKey()->GetLabel().empty()); |
162 authenticator_->AddKey(context_, | 158 authenticator_->AddKey(context_, |
163 key, | 159 key, |
164 false /* no key exists */, | 160 false /* no key exists */, |
165 base::Bind(&SupervisedUserLoginFlow::OnNewKeyAdded, | 161 base::Bind(&SupervisedUserLoginFlow::OnNewKeyAdded, |
166 weak_factory_.GetWeakPtr(), | 162 weak_factory_.GetWeakPtr(), |
167 Passed(&data_copy))); | 163 Passed(&data_copy))); |
168 } else if (SupervisedUserAuthentication::SCHEMA_SALT_HASHED == | 164 } else if (SupervisedUserAuthentication::SCHEMA_SALT_HASHED == |
169 current_schema) { | 165 current_schema) { |
170 VLOG(1) << "Updating the key"; | 166 VLOG(1) << "Updating the key"; |
171 | 167 |
172 if (auth->HasIncompleteKey(user_id())) { | 168 if (auth->HasIncompleteKey(account_id().GetUserEmail())) { |
173 // We need to use Migrate instead of Authorized Update privilege. | 169 // We need to use Migrate instead of Authorized Update privilege. |
174 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; | 170 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; |
175 } | 171 } |
176 // Just update the key. | 172 // Just update the key. |
177 DCHECK_EQ(context_.GetKey()->GetLabel(), kCryptohomeSupervisedUserKeyLabel); | 173 DCHECK_EQ(context_.GetKey()->GetLabel(), kCryptohomeSupervisedUserKeyLabel); |
178 authenticator_->UpdateKeyAuthorized( | 174 authenticator_->UpdateKeyAuthorized( |
179 context_, | 175 context_, |
180 key, | 176 key, |
181 signature, | 177 signature, |
182 base::Bind(&SupervisedUserLoginFlow::OnPasswordUpdated, | 178 base::Bind(&SupervisedUserLoginFlow::OnPasswordUpdated, |
183 weak_factory_.GetWeakPtr(), | 179 weak_factory_.GetWeakPtr(), |
184 Passed(&data_copy))); | 180 Passed(&data_copy))); |
185 } else { | 181 } else { |
186 NOTREACHED() << "Unsupported password schema"; | 182 NOTREACHED() << "Unsupported password schema"; |
187 } | 183 } |
188 } | 184 } |
189 | 185 |
190 void SupervisedUserLoginFlow::OnNewKeyAdded( | 186 void SupervisedUserLoginFlow::OnNewKeyAdded( |
191 scoped_ptr<base::DictionaryValue> password_data) { | 187 scoped_ptr<base::DictionaryValue> password_data) { |
192 VLOG(1) << "New key added"; | 188 VLOG(1) << "New key added"; |
193 SupervisedUserAuthentication* auth = | 189 SupervisedUserAuthentication* auth = |
194 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 190 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
195 auth->StorePasswordData(user_id(), *password_data.get()); | 191 auth->StorePasswordData(account_id().GetUserEmail(), *password_data.get()); |
196 auth->MarkKeyIncomplete(user_id(), true /* incomplete */); | 192 auth->MarkKeyIncomplete(account_id().GetUserEmail(), true /* incomplete */); |
197 authenticator_->RemoveKey( | 193 authenticator_->RemoveKey( |
198 context_, | 194 context_, |
199 kLegacyCryptohomeSupervisedUserKeyLabel, | 195 kLegacyCryptohomeSupervisedUserKeyLabel, |
200 base::Bind(&SupervisedUserLoginFlow::OnOldKeyRemoved, | 196 base::Bind(&SupervisedUserLoginFlow::OnOldKeyRemoved, |
201 weak_factory_.GetWeakPtr())); | 197 weak_factory_.GetWeakPtr())); |
202 } | 198 } |
203 | 199 |
204 void SupervisedUserLoginFlow::OnOldKeyRemoved() { | 200 void SupervisedUserLoginFlow::OnOldKeyRemoved() { |
205 UMA_HISTOGRAM_ENUMERATION( | 201 UMA_HISTOGRAM_ENUMERATION( |
206 "ManagedUsers.ChromeOS.PasswordChange", | 202 "ManagedUsers.ChromeOS.PasswordChange", |
(...skipping 25 matching lines...) Expand all Loading... | |
232 } | 228 } |
233 | 229 |
234 void SupervisedUserLoginFlow::OnPasswordUpdated( | 230 void SupervisedUserLoginFlow::OnPasswordUpdated( |
235 scoped_ptr<base::DictionaryValue> password_data) { | 231 scoped_ptr<base::DictionaryValue> password_data) { |
236 VLOG(1) << "Updated password for supervised user"; | 232 VLOG(1) << "Updated password for supervised user"; |
237 | 233 |
238 SupervisedUserAuthentication* auth = | 234 SupervisedUserAuthentication* auth = |
239 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 235 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
240 | 236 |
241 // Incomplete state is not there in password_data, carry it from old state. | 237 // Incomplete state is not there in password_data, carry it from old state. |
242 bool was_incomplete = auth->HasIncompleteKey(user_id()); | 238 bool was_incomplete = auth->HasIncompleteKey(account_id().GetUserEmail()); |
achuithb
2015/12/04 10:12:52
const
Alexander Alekseev
2015/12/04 12:44:06
Done.
| |
243 auth->StorePasswordData(user_id(), *password_data.get()); | 239 auth->StorePasswordData(account_id().GetUserEmail(), *password_data.get()); |
244 if (was_incomplete) | 240 if (was_incomplete) |
245 auth->MarkKeyIncomplete(user_id(), true /* incomplete */); | 241 auth->MarkKeyIncomplete(account_id().GetUserEmail(), true /* incomplete */); |
246 | 242 |
247 UMA_HISTOGRAM_ENUMERATION( | 243 UMA_HISTOGRAM_ENUMERATION( |
248 "ManagedUsers.ChromeOS.PasswordChange", | 244 "ManagedUsers.ChromeOS.PasswordChange", |
249 SupervisedUserAuthentication::PASSWORD_CHANGED_IN_USER_SESSION, | 245 SupervisedUserAuthentication::PASSWORD_CHANGED_IN_USER_SESSION, |
250 SupervisedUserAuthentication::PASSWORD_CHANGE_RESULT_MAX_VALUE); | 246 SupervisedUserAuthentication::PASSWORD_CHANGE_RESULT_MAX_VALUE); |
251 Finish(); | 247 Finish(); |
252 } | 248 } |
253 | 249 |
254 void SupervisedUserLoginFlow::Finish() { | 250 void SupervisedUserLoginFlow::Finish() { |
255 UserSessionManager::GetInstance()->DoBrowserLaunch(profile_, host()); | 251 UserSessionManager::GetInstance()->DoBrowserLaunch(profile_, host()); |
256 profile_ = NULL; | 252 profile_ = NULL; |
257 UnregisterFlowSoon(); | 253 UnregisterFlowSoon(); |
258 } | 254 } |
259 | 255 |
260 void SupervisedUserLoginFlow::LaunchExtraSteps( | 256 void SupervisedUserLoginFlow::LaunchExtraSteps( |
261 Profile* profile) { | 257 Profile* profile) { |
262 profile_ = profile; | 258 profile_ = profile; |
263 ChromeUserManager::Get()->GetSupervisedUserManager()->LoadSupervisedUserToken( | 259 ChromeUserManager::Get()->GetSupervisedUserManager()->LoadSupervisedUserToken( |
264 profile, | 260 profile, |
265 base::Bind(&SupervisedUserLoginFlow::OnSyncSetupDataLoaded, | 261 base::Bind(&SupervisedUserLoginFlow::OnSyncSetupDataLoaded, |
266 weak_factory_.GetWeakPtr())); | 262 weak_factory_.GetWeakPtr())); |
267 } | 263 } |
268 | 264 |
269 } // namespace chromeos | 265 } // namespace chromeos |
OLD | NEW |