| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h" |
| 6 | 6 |
| 7 #include <set> | 7 #include <set> |
| 8 #include <utility> | 8 #include <utility> |
| 9 | 9 |
| 10 #include "base/bind.h" | 10 #include "base/bind.h" |
| 11 #include "base/bind_helpers.h" | 11 #include "base/bind_helpers.h" |
| 12 #include "base/command_line.h" | |
| 13 #include "base/logging.h" | 12 #include "base/logging.h" |
| 14 #include "base/metrics/histogram.h" | 13 #include "base/metrics/histogram.h" |
| 15 #include "base/metrics/sparse_histogram.h" | 14 #include "base/metrics/sparse_histogram.h" |
| 16 #include "base/sequenced_task_runner.h" | 15 #include "base/sequenced_task_runner.h" |
| 17 #include "base/values.h" | 16 #include "base/values.h" |
| 18 #include "chrome/browser/browser_process.h" | 17 #include "chrome/browser/browser_process.h" |
| 19 #include "chrome/browser/chromeos/login/helper.h" | 18 #include "chrome/browser/chromeos/login/helper.h" |
| 20 #include "chrome/browser/chromeos/login/session/user_session_manager.h" | 19 #include "chrome/browser/chromeos/login/session/user_session_manager.h" |
| 21 #include "chrome/browser/chromeos/login/users/affiliation.h" | 20 #include "chrome/browser/chromeos/login/users/affiliation.h" |
| 22 #include "chrome/browser/chromeos/login/users/chrome_user_manager_impl.h" | 21 #include "chrome/browser/chromeos/login/users/chrome_user_manager_impl.h" |
| 23 #include "chrome/browser/chromeos/policy/policy_oauth2_token_fetcher.h" | 22 #include "chrome/browser/chromeos/policy/policy_oauth2_token_fetcher.h" |
| 24 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chrom
eos.h" | 23 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chrom
eos.h" |
| 25 #include "chrome/browser/chromeos/policy/wildcard_login_checker.h" | 24 #include "chrome/browser/chromeos/policy/wildcard_login_checker.h" |
| 26 #include "chrome/browser/lifetime/application_lifetime.h" | 25 #include "chrome/browser/lifetime/application_lifetime.h" |
| 27 #include "chrome/common/chrome_content_client.h" | 26 #include "chrome/common/chrome_content_client.h" |
| 28 #include "chromeos/chromeos_switches.h" | |
| 29 #include "components/policy/core/common/cloud/cloud_external_data_manager.h" | 27 #include "components/policy/core/common/cloud/cloud_external_data_manager.h" |
| 30 #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h" | 28 #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h" |
| 31 #include "components/policy/core/common/cloud/device_management_service.h" | 29 #include "components/policy/core/common/cloud/device_management_service.h" |
| 32 #include "components/policy/core/common/cloud/system_policy_request_context.h" | 30 #include "components/policy/core/common/cloud/system_policy_request_context.h" |
| 33 #include "components/policy/core/common/policy_map.h" | 31 #include "components/policy/core/common/policy_map.h" |
| 34 #include "components/policy/core/common/policy_pref_names.h" | 32 #include "components/policy/core/common/policy_pref_names.h" |
| 35 #include "components/policy/core/common/policy_types.h" | 33 #include "components/policy/core/common/policy_types.h" |
| 36 #include "components/user_manager/user.h" | |
| 37 #include "components/user_manager/user_manager.h" | 34 #include "components/user_manager/user_manager.h" |
| 38 #include "net/url_request/url_request_context_getter.h" | 35 #include "net/url_request/url_request_context_getter.h" |
| 39 #include "policy/policy_constants.h" | 36 #include "policy/policy_constants.h" |
| 40 #include "url/gurl.h" | 37 #include "url/gurl.h" |
| 41 | 38 |
| 42 namespace em = enterprise_management; | 39 namespace em = enterprise_management; |
| 43 | 40 |
| 44 namespace policy { | 41 namespace policy { |
| 45 | 42 |
| 46 namespace { | 43 namespace { |
| (...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 95 store.get(), | 92 store.get(), |
| 96 task_runner, | 93 task_runner, |
| 97 file_task_runner, | 94 file_task_runner, |
| 98 io_task_runner), | 95 io_task_runner), |
| 99 store_(std::move(store)), | 96 store_(std::move(store)), |
| 100 external_data_manager_(std::move(external_data_manager)), | 97 external_data_manager_(std::move(external_data_manager)), |
| 101 component_policy_cache_path_(component_policy_cache_path), | 98 component_policy_cache_path_(component_policy_cache_path), |
| 102 wait_for_policy_fetch_(wait_for_policy_fetch), | 99 wait_for_policy_fetch_(wait_for_policy_fetch), |
| 103 policy_fetch_timeout_(false, false) { | 100 policy_fetch_timeout_(false, false) { |
| 104 time_init_started_ = base::Time::Now(); | 101 time_init_started_ = base::Time::Now(); |
| 105 | 102 if (wait_for_policy_fetch_ && !initial_policy_fetch_timeout.is_max()) { |
| 106 // Caller should pass a non-zero policy_fetch_timeout iff | |
| 107 // |wait_for_policy_fetch| is true. | |
| 108 DCHECK_NE(wait_for_policy_fetch_, initial_policy_fetch_timeout.is_zero()); | |
| 109 allow_failed_policy_fetches_ = | |
| 110 base::CommandLine::ForCurrentProcess()->HasSwitch( | |
| 111 chromeos::switches::kAllowFailedPolicyFetchForTest) || | |
| 112 !initial_policy_fetch_timeout.is_max(); | |
| 113 if (wait_for_policy_fetch_ && allow_failed_policy_fetches_) { | |
| 114 policy_fetch_timeout_.Start( | 103 policy_fetch_timeout_.Start( |
| 115 FROM_HERE, | 104 FROM_HERE, |
| 116 initial_policy_fetch_timeout, | 105 initial_policy_fetch_timeout, |
| 117 base::Bind(&UserCloudPolicyManagerChromeOS::OnBlockingFetchTimeout, | 106 base::Bind(&UserCloudPolicyManagerChromeOS::OnBlockingFetchTimeout, |
| 118 base::Unretained(this))); | 107 base::Unretained(this))); |
| 119 } | 108 } |
| 120 } | 109 } |
| 121 | 110 |
| 122 UserCloudPolicyManagerChromeOS::~UserCloudPolicyManagerChromeOS() {} | 111 UserCloudPolicyManagerChromeOS::~UserCloudPolicyManagerChromeOS() {} |
| 123 | 112 |
| (...skipping 140 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 264 | 253 |
| 265 // If we're blocked on the policy fetch, now is a good time to issue it. | 254 // If we're blocked on the policy fetch, now is a good time to issue it. |
| 266 if (client()->is_registered()) { | 255 if (client()->is_registered()) { |
| 267 service()->RefreshPolicy( | 256 service()->RefreshPolicy( |
| 268 base::Bind( | 257 base::Bind( |
| 269 &UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete, | 258 &UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete, |
| 270 base::Unretained(this))); | 259 base::Unretained(this))); |
| 271 } else { | 260 } else { |
| 272 // If the client has switched to not registered, we bail out as this | 261 // If the client has switched to not registered, we bail out as this |
| 273 // indicates the cloud policy setup flow has been aborted. | 262 // indicates the cloud policy setup flow has been aborted. |
| 274 CancelWaitForPolicyFetch(true); | 263 CancelWaitForPolicyFetch(); |
| 275 } | 264 } |
| 276 } | 265 } |
| 277 } | 266 } |
| 278 | 267 |
| 279 void UserCloudPolicyManagerChromeOS::OnClientError( | 268 void UserCloudPolicyManagerChromeOS::OnClientError( |
| 280 CloudPolicyClient* cloud_policy_client) { | 269 CloudPolicyClient* cloud_policy_client) { |
| 281 DCHECK_EQ(client(), cloud_policy_client); | 270 DCHECK_EQ(client(), cloud_policy_client); |
| 282 if (wait_for_policy_fetch_) { | 271 if (wait_for_policy_fetch_) { |
| 283 UMA_HISTOGRAM_SPARSE_SLOWLY(kUMAInitialFetchClientError, | 272 UMA_HISTOGRAM_SPARSE_SLOWLY(kUMAInitialFetchClientError, |
| 284 cloud_policy_client->status()); | 273 cloud_policy_client->status()); |
| 285 } | 274 } |
| 286 switch (client()->status()) { | 275 CancelWaitForPolicyFetch(); |
| 287 case DM_STATUS_SUCCESS: | |
| 288 case DM_STATUS_SERVICE_MANAGEMENT_NOT_SUPPORTED: | |
| 289 // If management is not supported for this user, then a registration | |
| 290 // error is to be expected. | |
| 291 CancelWaitForPolicyFetch(true); | |
| 292 break; | |
| 293 default: | |
| 294 // Unexpected error fetching policy. | |
| 295 CancelWaitForPolicyFetch(false); | |
| 296 break; | |
| 297 } | |
| 298 } | 276 } |
| 299 | 277 |
| 300 void UserCloudPolicyManagerChromeOS::OnComponentCloudPolicyUpdated() { | 278 void UserCloudPolicyManagerChromeOS::OnComponentCloudPolicyUpdated() { |
| 301 CloudPolicyManager::OnComponentCloudPolicyUpdated(); | 279 CloudPolicyManager::OnComponentCloudPolicyUpdated(); |
| 302 StartRefreshSchedulerIfReady(); | 280 StartRefreshSchedulerIfReady(); |
| 303 } | 281 } |
| 304 | 282 |
| 305 void UserCloudPolicyManagerChromeOS::OnStoreLoaded( | 283 void UserCloudPolicyManagerChromeOS::OnStoreLoaded( |
| 306 CloudPolicyStore* cloud_policy_store) { | 284 CloudPolicyStore* cloud_policy_store) { |
| 307 CloudPolicyManager::OnStoreLoaded(cloud_policy_store); | 285 CloudPolicyManager::OnStoreLoaded(cloud_policy_store); |
| (...skipping 61 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 369 } | 347 } |
| 370 | 348 |
| 371 if (error.state() == GoogleServiceAuthError::NONE) { | 349 if (error.state() == GoogleServiceAuthError::NONE) { |
| 372 // Start client registration. Either OnRegistrationStateChanged() or | 350 // Start client registration. Either OnRegistrationStateChanged() or |
| 373 // OnClientError() will be called back. | 351 // OnClientError() will be called back. |
| 374 client()->Register(em::DeviceRegisterRequest::USER, | 352 client()->Register(em::DeviceRegisterRequest::USER, |
| 375 em::DeviceRegisterRequest::FLAVOR_USER_REGISTRATION, | 353 em::DeviceRegisterRequest::FLAVOR_USER_REGISTRATION, |
| 376 policy_token, std::string(), std::string(), | 354 policy_token, std::string(), std::string(), |
| 377 std::string()); | 355 std::string()); |
| 378 } else { | 356 } else { |
| 357 // Failed to get a token, stop waiting and use an empty policy. |
| 358 CancelWaitForPolicyFetch(); |
| 359 |
| 379 UMA_HISTOGRAM_ENUMERATION(kUMAInitialFetchOAuth2Error, | 360 UMA_HISTOGRAM_ENUMERATION(kUMAInitialFetchOAuth2Error, |
| 380 error.state(), | 361 error.state(), |
| 381 GoogleServiceAuthError::NUM_STATES); | 362 GoogleServiceAuthError::NUM_STATES); |
| 382 if (error.state() == GoogleServiceAuthError::CONNECTION_FAILED) { | 363 if (error.state() == GoogleServiceAuthError::CONNECTION_FAILED) { |
| 383 // Network errors are negative in the code, but the histogram data type | 364 // Network errors are negative in the code, but the histogram data type |
| 384 // expects the corresponding positive value. | 365 // expects the corresponding positive value. |
| 385 UMA_HISTOGRAM_SPARSE_SLOWLY(kUMAInitialFetchOAuth2NetworkError, | 366 UMA_HISTOGRAM_SPARSE_SLOWLY(kUMAInitialFetchOAuth2NetworkError, |
| 386 -error.network_error()); | 367 -error.network_error()); |
| 387 } | 368 } |
| 388 // Failed to get a token, stop waiting if policy is not required for this | |
| 389 // user. | |
| 390 CancelWaitForPolicyFetch(false); | |
| 391 } | 369 } |
| 392 | 370 |
| 393 token_fetcher_.reset(); | 371 token_fetcher_.reset(); |
| 394 } | 372 } |
| 395 | 373 |
| 396 void UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete( | 374 void UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete( |
| 397 bool success) { | 375 bool success) { |
| 398 const base::Time now = base::Time::Now(); | 376 const base::Time now = base::Time::Now(); |
| 399 UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayPolicyFetch, | 377 UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayPolicyFetch, |
| 400 now - time_client_registered_); | 378 now - time_client_registered_); |
| 401 UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayTotal, | 379 UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayTotal, |
| 402 now - time_init_started_); | 380 now - time_init_started_); |
| 403 CancelWaitForPolicyFetch(success); | 381 CancelWaitForPolicyFetch(); |
| 404 } | 382 } |
| 405 | 383 |
| 406 void UserCloudPolicyManagerChromeOS::OnBlockingFetchTimeout() { | 384 void UserCloudPolicyManagerChromeOS::OnBlockingFetchTimeout() { |
| 407 if (!wait_for_policy_fetch_) | 385 if (!wait_for_policy_fetch_) |
| 408 return; | 386 return; |
| 409 LOG(WARNING) << "Timed out while waiting for the policy fetch. " | 387 LOG(WARNING) << "Timed out while waiting for the initial policy fetch. " |
| 410 << "The session will start with the cached policy."; | 388 << "The first session will start without policy."; |
| 411 CancelWaitForPolicyFetch(false); | 389 CancelWaitForPolicyFetch(); |
| 412 } | 390 } |
| 413 | 391 |
| 414 void UserCloudPolicyManagerChromeOS::CancelWaitForPolicyFetch(bool success) { | 392 void UserCloudPolicyManagerChromeOS::CancelWaitForPolicyFetch() { |
| 415 if (!wait_for_policy_fetch_) | 393 if (!wait_for_policy_fetch_) |
| 416 return; | 394 return; |
| 417 | 395 |
| 396 wait_for_policy_fetch_ = false; |
| 418 policy_fetch_timeout_.Stop(); | 397 policy_fetch_timeout_.Stop(); |
| 419 | |
| 420 // If there was an error, and we don't want to allow profile initialization | |
| 421 // to go forward after a failed policy fetch, then just return (profile | |
| 422 // initialization will not complete). | |
| 423 // TODO(atwilson): Add code to retry policy fetching. | |
| 424 if (!success && !allow_failed_policy_fetches_) { | |
| 425 LOG(ERROR) << "Policy fetch failed for " | |
| 426 << user_manager::UserManager::Get()->GetActiveUser()->email() | |
| 427 << " - aborting profile initialization"; | |
| 428 // Need to exit the current user, because we've already started this user's | |
| 429 // session. | |
| 430 chrome::AttemptUserExit(); | |
| 431 return; | |
| 432 } | |
| 433 | |
| 434 wait_for_policy_fetch_ = false; | |
| 435 CheckAndPublishPolicy(); | 398 CheckAndPublishPolicy(); |
| 436 // Now that |wait_for_policy_fetch_| is guaranteed to be false, the scheduler | 399 // Now that |wait_for_policy_fetch_| is guaranteed to be false, the scheduler |
| 437 // can be started. | 400 // can be started. |
| 438 StartRefreshSchedulerIfReady(); | 401 StartRefreshSchedulerIfReady(); |
| 439 } | 402 } |
| 440 | 403 |
| 441 void UserCloudPolicyManagerChromeOS::StartRefreshSchedulerIfReady() { | 404 void UserCloudPolicyManagerChromeOS::StartRefreshSchedulerIfReady() { |
| 442 if (core()->refresh_scheduler()) | 405 if (core()->refresh_scheduler()) |
| 443 return; // Already started. | 406 return; // Already started. |
| 444 | 407 |
| (...skipping 10 matching lines...) Expand all Loading... |
| 455 // OnComponentCloudPolicyUpdated() once it's ready. | 418 // OnComponentCloudPolicyUpdated() once it's ready. |
| 456 return; | 419 return; |
| 457 } | 420 } |
| 458 | 421 |
| 459 core()->StartRefreshScheduler(); | 422 core()->StartRefreshScheduler(); |
| 460 core()->TrackRefreshDelayPref(local_state_, | 423 core()->TrackRefreshDelayPref(local_state_, |
| 461 policy_prefs::kUserPolicyRefreshRate); | 424 policy_prefs::kUserPolicyRefreshRate); |
| 462 } | 425 } |
| 463 | 426 |
| 464 } // namespace policy | 427 } // namespace policy |
| OLD | NEW |