| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/login/supervised/supervised_user_login_flow.h" | 5 #include "chrome/browser/chromeos/login/supervised/supervised_user_login_flow.h" |
| 6 | 6 |
| 7 #include "base/base64.h" | 7 #include "base/base64.h" |
| 8 #include "base/command_line.h" | 8 #include "base/command_line.h" |
| 9 #include "base/logging.h" | 9 #include "base/logging.h" |
| 10 #include "base/metrics/histogram.h" | 10 #include "base/metrics/histogram.h" |
| (...skipping 10 matching lines...) Expand all Loading... |
| 21 #include "chrome/browser/chromeos/login/wizard_controller.h" | 21 #include "chrome/browser/chromeos/login/wizard_controller.h" |
| 22 #include "chrome/common/chrome_switches.h" | 22 #include "chrome/common/chrome_switches.h" |
| 23 #include "chromeos/login/auth/key.h" | 23 #include "chromeos/login/auth/key.h" |
| 24 #include "components/user_manager/user_manager.h" | 24 #include "components/user_manager/user_manager.h" |
| 25 #include "content/public/browser/browser_thread.h" | 25 #include "content/public/browser/browser_thread.h" |
| 26 | 26 |
| 27 using content::BrowserThread; | 27 using content::BrowserThread; |
| 28 | 28 |
| 29 namespace chromeos { | 29 namespace chromeos { |
| 30 | 30 |
| 31 SupervisedUserLoginFlow::SupervisedUserLoginFlow( | 31 SupervisedUserLoginFlow::SupervisedUserLoginFlow(const AccountId& account_id) |
| 32 const std::string& user_id) | 32 : ExtendedUserFlow(account_id), weak_factory_(this) {} |
| 33 : ExtendedUserFlow(user_id), | |
| 34 data_loaded_(false), | |
| 35 weak_factory_(this) { | |
| 36 } | |
| 37 | 33 |
| 38 SupervisedUserLoginFlow::~SupervisedUserLoginFlow() {} | 34 SupervisedUserLoginFlow::~SupervisedUserLoginFlow() {} |
| 39 | 35 |
| 40 void SupervisedUserLoginFlow::AppendAdditionalCommandLineSwitches() { | 36 void SupervisedUserLoginFlow::AppendAdditionalCommandLineSwitches() { |
| 41 user_manager::UserManager* user_manager = user_manager::UserManager::Get(); | 37 user_manager::UserManager* user_manager = user_manager::UserManager::Get(); |
| 42 if (user_manager->IsCurrentUserNew()) { | 38 if (user_manager->IsCurrentUserNew()) { |
| 43 // Supervised users should launch into empty desktop on first run. | 39 // Supervised users should launch into empty desktop on first run. |
| 44 base::CommandLine::ForCurrentProcess()->AppendSwitch( | 40 base::CommandLine::ForCurrentProcess()->AppendSwitch( |
| 45 ::switches::kSilentLaunch); | 41 ::switches::kSilentLaunch); |
| 46 } | 42 } |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 79 void SupervisedUserLoginFlow::ConfigureSync(const std::string& token) { | 75 void SupervisedUserLoginFlow::ConfigureSync(const std::string& token) { |
| 80 data_loaded_ = true; | 76 data_loaded_ = true; |
| 81 | 77 |
| 82 // TODO(antrim): add error handling (no token loaded). | 78 // TODO(antrim): add error handling (no token loaded). |
| 83 // See also: http://crbug.com/312751 | 79 // See also: http://crbug.com/312751 |
| 84 ChromeUserManager::Get()->GetSupervisedUserManager()->ConfigureSyncWithToken( | 80 ChromeUserManager::Get()->GetSupervisedUserManager()->ConfigureSyncWithToken( |
| 85 profile_, token); | 81 profile_, token); |
| 86 SupervisedUserAuthentication* auth = | 82 SupervisedUserAuthentication* auth = |
| 87 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 83 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
| 88 | 84 |
| 89 if (auth->HasScheduledPasswordUpdate(user_id())) { | 85 if (auth->HasScheduledPasswordUpdate(account_id().GetUserEmail())) { |
| 90 auth->LoadPasswordUpdateData( | 86 auth->LoadPasswordUpdateData( |
| 91 user_id(), | 87 account_id().GetUserEmail(), |
| 92 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoaded, | 88 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoaded, |
| 93 weak_factory_.GetWeakPtr()), | 89 weak_factory_.GetWeakPtr()), |
| 94 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoadFailed, | 90 base::Bind(&SupervisedUserLoginFlow::OnPasswordChangeDataLoadFailed, |
| 95 weak_factory_.GetWeakPtr())); | 91 weak_factory_.GetWeakPtr())); |
| 96 return; | 92 return; |
| 97 } | 93 } |
| 98 Finish(); | 94 Finish(); |
| 99 } | 95 } |
| 100 | 96 |
| 101 void SupervisedUserLoginFlow::HandleLoginSuccess( | 97 void SupervisedUserLoginFlow::HandleLoginSuccess( |
| 102 const UserContext& login_context) { | 98 const UserContext& login_context) { |
| 103 context_ = login_context; | 99 context_ = login_context; |
| 104 } | 100 } |
| 105 | 101 |
| 106 void SupervisedUserLoginFlow::OnPasswordChangeDataLoaded( | 102 void SupervisedUserLoginFlow::OnPasswordChangeDataLoaded( |
| 107 const base::DictionaryValue* password_data) { | 103 const base::DictionaryValue* password_data) { |
| 108 // Edge case, when manager has signed in and already updated the password. | 104 // Edge case, when manager has signed in and already updated the password. |
| 109 SupervisedUserAuthentication* auth = | 105 SupervisedUserAuthentication* auth = |
| 110 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 106 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
| 111 if (!auth->NeedPasswordChange(user_id(), password_data)) { | 107 if (!auth->NeedPasswordChange(account_id().GetUserEmail(), password_data)) { |
| 112 VLOG(1) << "Password already changed for " << user_id(); | 108 VLOG(1) << "Password already changed for " << account_id().Serialize(); |
| 113 auth->ClearScheduledPasswordUpdate(user_id()); | 109 auth->ClearScheduledPasswordUpdate(account_id().GetUserEmail()); |
| 114 Finish(); | 110 Finish(); |
| 115 return; | 111 return; |
| 116 } | 112 } |
| 117 | 113 |
| 118 // Two cases now - we can currently have either old-style password, or new | 114 // Two cases now - we can currently have either old-style password, or new |
| 119 // password. | 115 // password. |
| 120 std::string base64_signature; | 116 std::string base64_signature; |
| 121 std::string signature; | 117 std::string signature; |
| 122 std::string password; | 118 std::string password; |
| 123 int revision = 0; | 119 int revision = 0; |
| (...skipping 17 matching lines...) Expand all Loading... |
| 141 return; | 137 return; |
| 142 } | 138 } |
| 143 base::Base64Decode(base64_signature, &signature); | 139 base::Base64Decode(base64_signature, &signature); |
| 144 scoped_ptr<base::DictionaryValue> data_copy(password_data->DeepCopy()); | 140 scoped_ptr<base::DictionaryValue> data_copy(password_data->DeepCopy()); |
| 145 cryptohome::KeyDefinition key(password, | 141 cryptohome::KeyDefinition key(password, |
| 146 kCryptohomeSupervisedUserKeyLabel, | 142 kCryptohomeSupervisedUserKeyLabel, |
| 147 kCryptohomeSupervisedUserKeyPrivileges); | 143 kCryptohomeSupervisedUserKeyPrivileges); |
| 148 | 144 |
| 149 authenticator_ = ExtendedAuthenticator::Create(this); | 145 authenticator_ = ExtendedAuthenticator::Create(this); |
| 150 SupervisedUserAuthentication::Schema current_schema = | 146 SupervisedUserAuthentication::Schema current_schema = |
| 151 auth->GetPasswordSchema(user_id()); | 147 auth->GetPasswordSchema(account_id().GetUserEmail()); |
| 152 | 148 |
| 153 key.revision = revision; | 149 key.revision = revision; |
| 154 | 150 |
| 155 if (SupervisedUserAuthentication::SCHEMA_PLAIN == current_schema) { | 151 if (SupervisedUserAuthentication::SCHEMA_PLAIN == current_schema) { |
| 156 // We need to add new key, and block old one. As we don't actually have | 152 // We need to add new key, and block old one. As we don't actually have |
| 157 // signature key, use Migrate privilege instead of AuthorizedUpdate. | 153 // signature key, use Migrate privilege instead of AuthorizedUpdate. |
| 158 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; | 154 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; |
| 159 | 155 |
| 160 VLOG(1) << "Adding new schema key"; | 156 VLOG(1) << "Adding new schema key"; |
| 161 DCHECK(context_.GetKey()->GetLabel().empty()); | 157 DCHECK(context_.GetKey()->GetLabel().empty()); |
| 162 authenticator_->AddKey(context_, | 158 authenticator_->AddKey(context_, |
| 163 key, | 159 key, |
| 164 false /* no key exists */, | 160 false /* no key exists */, |
| 165 base::Bind(&SupervisedUserLoginFlow::OnNewKeyAdded, | 161 base::Bind(&SupervisedUserLoginFlow::OnNewKeyAdded, |
| 166 weak_factory_.GetWeakPtr(), | 162 weak_factory_.GetWeakPtr(), |
| 167 Passed(&data_copy))); | 163 Passed(&data_copy))); |
| 168 } else if (SupervisedUserAuthentication::SCHEMA_SALT_HASHED == | 164 } else if (SupervisedUserAuthentication::SCHEMA_SALT_HASHED == |
| 169 current_schema) { | 165 current_schema) { |
| 170 VLOG(1) << "Updating the key"; | 166 VLOG(1) << "Updating the key"; |
| 171 | 167 |
| 172 if (auth->HasIncompleteKey(user_id())) { | 168 if (auth->HasIncompleteKey(account_id().GetUserEmail())) { |
| 173 // We need to use Migrate instead of Authorized Update privilege. | 169 // We need to use Migrate instead of Authorized Update privilege. |
| 174 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; | 170 key.privileges = kCryptohomeSupervisedUserIncompleteKeyPrivileges; |
| 175 } | 171 } |
| 176 // Just update the key. | 172 // Just update the key. |
| 177 DCHECK_EQ(context_.GetKey()->GetLabel(), kCryptohomeSupervisedUserKeyLabel); | 173 DCHECK_EQ(context_.GetKey()->GetLabel(), kCryptohomeSupervisedUserKeyLabel); |
| 178 authenticator_->UpdateKeyAuthorized( | 174 authenticator_->UpdateKeyAuthorized( |
| 179 context_, | 175 context_, |
| 180 key, | 176 key, |
| 181 signature, | 177 signature, |
| 182 base::Bind(&SupervisedUserLoginFlow::OnPasswordUpdated, | 178 base::Bind(&SupervisedUserLoginFlow::OnPasswordUpdated, |
| 183 weak_factory_.GetWeakPtr(), | 179 weak_factory_.GetWeakPtr(), |
| 184 Passed(&data_copy))); | 180 Passed(&data_copy))); |
| 185 } else { | 181 } else { |
| 186 NOTREACHED() << "Unsupported password schema"; | 182 NOTREACHED() << "Unsupported password schema"; |
| 187 } | 183 } |
| 188 } | 184 } |
| 189 | 185 |
| 190 void SupervisedUserLoginFlow::OnNewKeyAdded( | 186 void SupervisedUserLoginFlow::OnNewKeyAdded( |
| 191 scoped_ptr<base::DictionaryValue> password_data) { | 187 scoped_ptr<base::DictionaryValue> password_data) { |
| 192 VLOG(1) << "New key added"; | 188 VLOG(1) << "New key added"; |
| 193 SupervisedUserAuthentication* auth = | 189 SupervisedUserAuthentication* auth = |
| 194 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 190 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
| 195 auth->StorePasswordData(user_id(), *password_data.get()); | 191 auth->StorePasswordData(account_id().GetUserEmail(), *password_data.get()); |
| 196 auth->MarkKeyIncomplete(user_id(), true /* incomplete */); | 192 auth->MarkKeyIncomplete(account_id().GetUserEmail(), true /* incomplete */); |
| 197 authenticator_->RemoveKey( | 193 authenticator_->RemoveKey( |
| 198 context_, | 194 context_, |
| 199 kLegacyCryptohomeSupervisedUserKeyLabel, | 195 kLegacyCryptohomeSupervisedUserKeyLabel, |
| 200 base::Bind(&SupervisedUserLoginFlow::OnOldKeyRemoved, | 196 base::Bind(&SupervisedUserLoginFlow::OnOldKeyRemoved, |
| 201 weak_factory_.GetWeakPtr())); | 197 weak_factory_.GetWeakPtr())); |
| 202 } | 198 } |
| 203 | 199 |
| 204 void SupervisedUserLoginFlow::OnOldKeyRemoved() { | 200 void SupervisedUserLoginFlow::OnOldKeyRemoved() { |
| 205 UMA_HISTOGRAM_ENUMERATION( | 201 UMA_HISTOGRAM_ENUMERATION( |
| 206 "ManagedUsers.ChromeOS.PasswordChange", | 202 "ManagedUsers.ChromeOS.PasswordChange", |
| (...skipping 25 matching lines...) Expand all Loading... |
| 232 } | 228 } |
| 233 | 229 |
| 234 void SupervisedUserLoginFlow::OnPasswordUpdated( | 230 void SupervisedUserLoginFlow::OnPasswordUpdated( |
| 235 scoped_ptr<base::DictionaryValue> password_data) { | 231 scoped_ptr<base::DictionaryValue> password_data) { |
| 236 VLOG(1) << "Updated password for supervised user"; | 232 VLOG(1) << "Updated password for supervised user"; |
| 237 | 233 |
| 238 SupervisedUserAuthentication* auth = | 234 SupervisedUserAuthentication* auth = |
| 239 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); | 235 ChromeUserManager::Get()->GetSupervisedUserManager()->GetAuthentication(); |
| 240 | 236 |
| 241 // Incomplete state is not there in password_data, carry it from old state. | 237 // Incomplete state is not there in password_data, carry it from old state. |
| 242 bool was_incomplete = auth->HasIncompleteKey(user_id()); | 238 const bool was_incomplete = |
| 243 auth->StorePasswordData(user_id(), *password_data.get()); | 239 auth->HasIncompleteKey(account_id().GetUserEmail()); |
| 240 auth->StorePasswordData(account_id().GetUserEmail(), *password_data.get()); |
| 244 if (was_incomplete) | 241 if (was_incomplete) |
| 245 auth->MarkKeyIncomplete(user_id(), true /* incomplete */); | 242 auth->MarkKeyIncomplete(account_id().GetUserEmail(), true /* incomplete */); |
| 246 | 243 |
| 247 UMA_HISTOGRAM_ENUMERATION( | 244 UMA_HISTOGRAM_ENUMERATION( |
| 248 "ManagedUsers.ChromeOS.PasswordChange", | 245 "ManagedUsers.ChromeOS.PasswordChange", |
| 249 SupervisedUserAuthentication::PASSWORD_CHANGED_IN_USER_SESSION, | 246 SupervisedUserAuthentication::PASSWORD_CHANGED_IN_USER_SESSION, |
| 250 SupervisedUserAuthentication::PASSWORD_CHANGE_RESULT_MAX_VALUE); | 247 SupervisedUserAuthentication::PASSWORD_CHANGE_RESULT_MAX_VALUE); |
| 251 Finish(); | 248 Finish(); |
| 252 } | 249 } |
| 253 | 250 |
| 254 void SupervisedUserLoginFlow::Finish() { | 251 void SupervisedUserLoginFlow::Finish() { |
| 255 UserSessionManager::GetInstance()->DoBrowserLaunch(profile_, host()); | 252 UserSessionManager::GetInstance()->DoBrowserLaunch(profile_, host()); |
| 256 profile_ = NULL; | 253 profile_ = NULL; |
| 257 UnregisterFlowSoon(); | 254 UnregisterFlowSoon(); |
| 258 } | 255 } |
| 259 | 256 |
| 260 void SupervisedUserLoginFlow::LaunchExtraSteps( | 257 void SupervisedUserLoginFlow::LaunchExtraSteps( |
| 261 Profile* profile) { | 258 Profile* profile) { |
| 262 profile_ = profile; | 259 profile_ = profile; |
| 263 ChromeUserManager::Get()->GetSupervisedUserManager()->LoadSupervisedUserToken( | 260 ChromeUserManager::Get()->GetSupervisedUserManager()->LoadSupervisedUserToken( |
| 264 profile, | 261 profile, |
| 265 base::Bind(&SupervisedUserLoginFlow::OnSyncSetupDataLoaded, | 262 base::Bind(&SupervisedUserLoginFlow::OnSyncSetupDataLoaded, |
| 266 weak_factory_.GetWeakPtr())); | 263 weak_factory_.GetWeakPtr())); |
| 267 } | 264 } |
| 268 | 265 |
| 269 } // namespace chromeos | 266 } // namespace chromeos |
| OLD | NEW |