ChromeOS cryptohome should be able to use gaia id as user identifier.

chrome/browser/chromeos/attestation/attestation_policy_observer.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/attestation/attestation_policy_observer.h"
 
 #include <string>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/location.h"
 #include "base/time/time.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/chromeos/attestation/attestation_ca_client.h"
 #include "chrome/browser/chromeos/attestation/attestation_key_payload.pb.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chromeos/attestation/attestation_flow.h"
 #include "chromeos/cryptohome/async_method_caller.h"
+#include "chromeos/cryptohome/cryptohome_parameters.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_method_call_status.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_manager.h"
+#include "components/signin/core/account_id/account_id.h"
+#include "components/user_manager/known_user.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_details.h"
 #include "net/cert/pem_tokenizer.h"
 #include "net/cert/x509_certificate.h"
 
 namespace {
 
 // The number of days before a certificate expires during which it is
 // considered 'expiring soon' and replacement is initiated.  The Chrome OS CA
 // issues certificates with an expiry of at least two years.  This value has
@@ skipping 129 matching lines @@
 
   // Start a dbus call to check if an Enterprise Machine Key already exists.
   base::Closure on_does_exist =
       base::Bind(&AttestationPolicyObserver::GetExistingCertificate,
                  weak_factory_.GetWeakPtr());
   base::Closure on_does_not_exist =
       base::Bind(&AttestationPolicyObserver::GetNewCertificate,
                  weak_factory_.GetWeakPtr());
   cryptohome_client_->TpmAttestationDoesKeyExist(
       KEY_DEVICE,
-      std::string(),  // Not used.
+      cryptohome::Identification(EmptyAccountId()).id(),  // Not used.

[Darren Krahn, 2016/02/17 20:48:05]

Would a default constructor for cryptohome::Identification make sense?

[Alexander Alekseev, 2016/02/18 13:45:14]

Hmm. Actually only tests would benefit from this. Do you think we should add it
for tests?

       kEnterpriseMachineKey,
-      base::Bind(DBusBoolRedirectCallback,
-                 on_does_exist,
-                 on_does_not_exist,
+      base::Bind(DBusBoolRedirectCallback, on_does_exist, on_does_not_exist,
                  base::Bind(&AttestationPolicyObserver::Reschedule,
                             weak_factory_.GetWeakPtr()),
                  FROM_HERE));
 }
 
 void AttestationPolicyObserver::GetNewCertificate() {
   // We can reuse the dbus callback handler logic.
   attestation_flow_->GetCertificate(
       PROFILE_ENTERPRISE_MACHINE_CERTIFICATE,
-      std::string(),  // Not used.
-      std::string(),  // Not used.
-      true,  // Force a new key to be generated.
+      EmptyAccountId(),  // Not used.
+      std::string(),     // Not used.
+      true,              // Force a new key to be generated.
       base::Bind(DBusStringCallback,
                  base::Bind(&AttestationPolicyObserver::UploadCertificate,
                             weak_factory_.GetWeakPtr()),
                  base::Bind(&AttestationPolicyObserver::Reschedule,
                             weak_factory_.GetWeakPtr()),
-                 FROM_HERE,
-                 DBUS_METHOD_CALL_SUCCESS));
+                 FROM_HERE, DBUS_METHOD_CALL_SUCCESS));
 }
 
 void AttestationPolicyObserver::GetExistingCertificate() {
   cryptohome_client_->TpmAttestationGetCertificate(
       KEY_DEVICE,
-      std::string(),  // Not used.
+      cryptohome::Identification(EmptyAccountId()).id(),  // Not used.
       kEnterpriseMachineKey,
       base::Bind(DBusStringCallback,
                  base::Bind(&AttestationPolicyObserver::CheckCertificateExpiry,
                             weak_factory_.GetWeakPtr()),
                  base::Bind(&AttestationPolicyObserver::Reschedule,
                             weak_factory_.GetWeakPtr()),
                  FROM_HERE));
 }
 
 void AttestationPolicyObserver::CheckCertificateExpiry(
@@ skipping 51 matching lines @@
     // Already uploaded... nothing more to do.
     return;
   }
   UploadCertificate(pem_certificate_chain);
 }
 
 void AttestationPolicyObserver::GetKeyPayload(
     base::Callback<void(const std::string&)> callback) {
   cryptohome_client_->TpmAttestationGetKeyPayload(
       KEY_DEVICE,
-      std::string(),  // Not used.
+      cryptohome::Identification(EmptyAccountId()).id(),  // Not used.
       kEnterpriseMachineKey,
-      base::Bind(DBusStringCallback,
-                 callback,
+      base::Bind(DBusStringCallback, callback,
                  base::Bind(&AttestationPolicyObserver::Reschedule,
                             weak_factory_.GetWeakPtr()),
                  FROM_HERE));
 }
 
 void AttestationPolicyObserver::OnUploadComplete(bool status) {
   if (!status)
     return;
   VLOG(1) << "Enterprise Machine Certificate uploaded to DMServer.";
   GetKeyPayload(base::Bind(&AttestationPolicyObserver::MarkAsUploaded,
                            weak_factory_.GetWeakPtr()));
 }
 
 void AttestationPolicyObserver::MarkAsUploaded(const std::string& key_payload) {
   AttestationKeyPayload payload_pb;
   if (!key_payload.empty())
     payload_pb.ParseFromString(key_payload);
   payload_pb.set_is_certificate_uploaded(true);
   std::string new_payload;
   if (!payload_pb.SerializeToString(&new_payload)) {
     LOG(WARNING) << "Failed to serialize key payload.";
     return;
   }
   cryptohome_client_->TpmAttestationSetKeyPayload(
       KEY_DEVICE,
-      std::string(),  // Not used.
-      kEnterpriseMachineKey,
-      new_payload,
-      base::Bind(DBusBoolRedirectCallback,
-                 base::Closure(),
-                 base::Closure(),
-                 base::Closure(),
-                 FROM_HERE));
+      cryptohome::Identification(EmptyAccountId()).id(),  // Not used.
+      kEnterpriseMachineKey, new_payload,
+      base::Bind(DBusBoolRedirectCallback, base::Closure(), base::Closure(),
+                 base::Closure(), FROM_HERE));
 }
 
 void AttestationPolicyObserver::Reschedule() {
   if (++num_retries_ < kRetryLimit) {
     content::BrowserThread::PostDelayedTask(
         content::BrowserThread::UI, FROM_HERE,
         base::Bind(&AttestationPolicyObserver::Start,
                    weak_factory_.GetWeakPtr()),
         base::TimeDelta::FromSeconds(retry_delay_));
   } else {
     LOG(WARNING) << "AttestationPolicyObserver: Retry limit exceeded.";
   }
 }
 
 }  // namespace attestation
 }  // namespace chromeos