ChromeOS cryptohome should be able to use gaia id as user identifier.

chrome/browser/chromeos/attestation/platform_verification_flow.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/attestation/platform_verification_flow.h"
 
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/chromeos/attestation/attestation_ca_client.h"
 #include "chrome/browser/chromeos/attestation/attestation_signed_data.pb.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/media/protected_media_identifier_permission_context.h"
 #include "chrome/browser/media/protected_media_identifier_permission_context_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chromeos/attestation/attestation_flow.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/cryptohome/async_method_caller.h"
+#include "chromeos/cryptohome/cryptohome_parameters.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/content_settings/core/common/content_settings_pattern.h"
 #include "components/user_manager/user.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/user_metrics.h"
@@ skipping 206 matching lines @@
   }
 
   // Permission allowed. Now proceed to get certificate.
   const user_manager::User* user = delegate_->GetUser(context.web_contents);
   if (!user) {
     ReportError(context.callback, INTERNAL_ERROR);
     LOG(ERROR) << "Profile does not map to a valid user.";
     return;
   }
 
-  GetCertificate(context, user->email(), false /* Don't force a new key */);
+  GetCertificate(context, user->GetAccountId(),
+                 false /* Don't force a new key */);
 }
 
 void PlatformVerificationFlow::GetCertificate(const ChallengeContext& context,
-                                              const std::string& user_id,
+                                              const AccountId& account_id,
                                               bool force_new_key) {
   scoped_ptr<base::Timer> timer(new base::Timer(false,    // Don't retain.
                                                 false));  // Don't repeat.
   base::Closure timeout_callback = base::Bind(
       &PlatformVerificationFlow::OnCertificateTimeout,
       this,
       context);
   timer->Start(FROM_HERE, timeout_delay_, timeout_callback);
 
-  AttestationFlow::CertificateCallback certificate_callback = base::Bind(
-      &PlatformVerificationFlow::OnCertificateReady,
-      this,
-      context,
-      user_id,
-      base::Passed(&timer));
-  attestation_flow_->GetCertificate(
-      PROFILE_CONTENT_PROTECTION_CERTIFICATE,
-      user_id,
-      context.service_id,
-      force_new_key,
-      certificate_callback);
+  AttestationFlow::CertificateCallback certificate_callback =
+      base::Bind(&PlatformVerificationFlow::OnCertificateReady, this, context,
+                 account_id, base::Passed(&timer));
+  attestation_flow_->GetCertificate(PROFILE_CONTENT_PROTECTION_CERTIFICATE,
+                                    account_id, context.service_id,
+                                    force_new_key, certificate_callback);
 }
 
 void PlatformVerificationFlow::OnCertificateReady(
     const ChallengeContext& context,
-    const std::string& user_id,
+    const AccountId& account_id,
     scoped_ptr<base::Timer> timer,
     bool operation_success,
     const std::string& certificate_chain) {
   // Log failure before checking the timer so all failures are logged, even if
   // they took too long.
   if (!operation_success) {
     LOG(WARNING) << "PlatformVerificationFlow: Failed to certify platform.";
   }
   if (!timer->IsRunning()) {
     LOG(WARNING) << "PlatformVerificationFlow: Certificate ready but call has "
                  << "already timed out.";
     return;
   }
   timer->Stop();
   if (!operation_success) {
     ReportError(context.callback, PLATFORM_NOT_VERIFIED);
     return;
   }
   ExpiryStatus expiry_status = CheckExpiry(certificate_chain);
   ReportExpiryStatus(expiry_status);
   if (expiry_status == EXPIRY_STATUS_EXPIRED) {
-    GetCertificate(context, user_id, true /* Force a new key */);
+    GetCertificate(context, account_id, true /* Force a new key */);
     return;
   }
   bool is_expiring_soon = (expiry_status == EXPIRY_STATUS_EXPIRING_SOON);
   cryptohome::AsyncMethodCaller::DataCallback cryptohome_callback =
       base::Bind(&PlatformVerificationFlow::OnChallengeReady, this, context,
-                 user_id, certificate_chain, is_expiring_soon);
+                 account_id, certificate_chain, is_expiring_soon);
   std::string key_name = kContentProtectionKeyPrefix;
   key_name += context.service_id;
-  async_caller_->TpmAttestationSignSimpleChallenge(KEY_USER,
-                                                   user_id,
-                                                   key_name,
-                                                   context.challenge,
-                                                   cryptohome_callback);
+  async_caller_->TpmAttestationSignSimpleChallenge(
+      KEY_USER, cryptohome::Identification(account_id), key_name,
+      context.challenge, cryptohome_callback);
 }
 
 void PlatformVerificationFlow::OnCertificateTimeout(
     const ChallengeContext& context) {
   LOG(WARNING) << "PlatformVerificationFlow: Timing out.";
   ReportError(context.callback, TIMEOUT);
 }
 
 void PlatformVerificationFlow::OnChallengeReady(
     const ChallengeContext& context,
-    const std::string& user_id,
+    const AccountId& account_id,
     const std::string& certificate_chain,
     bool is_expiring_soon,
     bool operation_success,
     const std::string& response_data) {
   if (!operation_success) {
     LOG(ERROR) << "PlatformVerificationFlow: Failed to sign challenge.";
     ReportError(context.callback, INTERNAL_ERROR);
     return;
   }
   SignedData signed_data_pb;
   if (response_data.empty() || !signed_data_pb.ParseFromString(response_data)) {
     LOG(ERROR) << "PlatformVerificationFlow: Failed to parse response data.";
     ReportError(context.callback, INTERNAL_ERROR);
     return;
   }
   VLOG(1) << "Platform verification successful.";
   UMA_HISTOGRAM_ENUMERATION(kAttestationResultHistogram, SUCCESS, RESULT_MAX);
   context.callback.Run(SUCCESS, signed_data_pb.data(),
                        signed_data_pb.signature(), certificate_chain);
   if (is_expiring_soon && renewals_in_progress_.count(certificate_chain) == 0) {
     renewals_in_progress_.insert(certificate_chain);
     // Fire off a certificate request so next time we'll have a new one.
     AttestationFlow::CertificateCallback renew_callback =
         base::Bind(&PlatformVerificationFlow::RenewCertificateCallback, this,
                    certificate_chain);
     attestation_flow_->GetCertificate(PROFILE_CONTENT_PROTECTION_CERTIFICATE,
-                                      user_id, context.service_id,
+                                      account_id, context.service_id,
                                       true,  // force_new_key
                                       renew_callback);
   }
 }
 
 bool PlatformVerificationFlow::IsAttestationAllowedByPolicy() {
   // Check the device policy for the feature.
   bool enabled_for_device = false;
   if (!CrosSettings::Get()->GetBoolean(kAttestationForContentProtectionEnabled,
                                        &enabled_for_device)) {
@@ skipping 62 matching lines @@
   if (!operation_success) {
     LOG(WARNING) << "PlatformVerificationFlow: Failed to renew platform "
                     "certificate.";
     return;
   }
   VLOG(1) << "Certificate successfully renewed.";
 }
 
 }  // namespace attestation
 }  // namespace chromeos