ChromeOS cryptohome should be able to use gaia id as user identifier.

chromeos/attestation/attestation_flow.h

Index: chromeos/attestation/attestation_flow.h
diff --git a/chromeos/attestation/attestation_flow.h b/chromeos/attestation/attestation_flow.h
index a5ced3c1b4297cb63a5896119787c6da6197ca5a..d6453fdac83314aa98d672cd4b076ef8083aa65d 100644
--- a/chromeos/attestation/attestation_flow.h
+++ b/chromeos/attestation/attestation_flow.h
@@ -16,6 +16,8 @@
 #include "chromeos/dbus/dbus_method_call_status.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
+class AccountId;
+
 namespace cryptohome {
 
 class AsyncMethodCaller;
@@ -69,9 +71,8 @@ class CHROMEOS_EXPORT AttestationFlow {
   // Parameters
   //   certificate_profile - Specifies what kind of certificate should be
   //                         requested from the CA.
-  //   user_id - Identifies the currently active user.  For normal GAIA users
-  //             this is a canonical email address.  This is ignored when using
-  //             the enterprise machine cert profile.
+  //   account_id - Identifies the currently active user. This is ignored when
+  //                using the enterprise machine cert profile.
   //   request_origin - For content protection profiles, certificate requests
   //                    are origin-specific.  This string must uniquely identify
   //                    the origin of the request.
@@ -82,7 +83,7 @@ class CHROMEOS_EXPORT AttestationFlow {
   //              On success |result| will be true and |data| will contain the
   //              PCA-issued certificate chain in PEM format.
   virtual void GetCertificate(AttestationCertificateProfile certificate_profile,
-                              const std::string& user_id,
+                              const AccountId& account_id,
                               const std::string& request_origin,
                               bool force_new_key,
                               const CertificateCallback& callback);
@@ -143,13 +144,13 @@ class CHROMEOS_EXPORT AttestationFlow {
   // Parameters
   //   certificate_profile - Specifies what kind of certificate should be
   //                         requested from the CA.
-  //   user_id - Identifies the active user.
+  //   account_id - Identifies the active user.
   //   request_origin - An identifier for the origin of this request.
   //   generate_new_key - If set to true a new key is generated.
   //   callback - Called when the operation completes.
   void StartCertificateRequest(
       const AttestationCertificateProfile certificate_profile,
-      const std::string& user_id,
+      const AccountId& account_id,
       const std::string& request_origin,
       bool generate_new_key,
       const CertificateCallback& callback);
@@ -160,13 +161,13 @@ class CHROMEOS_EXPORT AttestationFlow {
   //
   // Parameters
   //   key_type - The type of the key for which a certificate is requested.
-  //   user_id - Identifies the active user.
+  //   account_id - Identifies the active user.
   //   key_name - The name of the key for which a certificate is requested.
   //   callback - Called when the operation completes.
   //   success - The status of request creation.
   //   data - The request data for the Privacy CA.
   void SendCertificateRequestToPCA(AttestationKeyType key_type,
-                                   const std::string& user_id,
+                                   const AccountId& account_id,
                                    const std::string& key_name,
                                    const CertificateCallback& callback,
                                    bool success,
@@ -178,13 +179,13 @@ class CHROMEOS_EXPORT AttestationFlow {
   //
   // Parameters
   //   key_type - The type of the key for which a certificate is requested.
-  //   user_id - Identifies the active user.
+  //   account_id - Identifies the active user.
   //   key_name - The name of the key for which a certificate is requested.
   //   callback - Called when the operation completes.
   //   success - The status of the Privacy CA operation.
   //   data - The response data from the Privacy CA.
   void SendCertificateResponseToDaemon(AttestationKeyType key_type,
-                                       const std::string& user_id,
+                                       const AccountId& account_id,
                                        const std::string& key_name,
                                        const CertificateCallback& callback,
                                        bool success,
@@ -194,11 +195,11 @@ class CHROMEOS_EXPORT AttestationFlow {
   //
   // Parameters
   //   key_type - The type of the key for which a certificate is requested.
-  //   user_id - Identifies the active user.
+  //   account_id - Identifies the active user.
   //   key_name - The name of the key for which a certificate is requested.
   //   callback - Called when the operation completes.
   void GetExistingCertificate(AttestationKeyType key_type,
-                              const std::string& user_id,
+                              const AccountId& account_id,
                               const std::string& key_name,
                               const CertificateCallback& callback);