Properly handle failure modes in the wildcard login check.

chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 31 matching lines @@
     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayOAuth2Token";
 const char kUMAInitialFetchDelayPolicyFetch[] =
     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayPolicyFetch";
 const char kUMAInitialFetchDelayTotal[] =
     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayTotal";
 const char kUMAInitialFetchOAuth2Error[] =
     "Enterprise.UserPolicyChromeOS.InitialFetch.OAuth2Error";
 const char kUMAInitialFetchOAuth2NetworkError[] =
     "Enterprise.UserPolicyChromeOS.InitialFetch.OAuth2NetworkError";
 
-void OnWildcardCheckCompleted(const std::string& username, bool result) {
-  if (!result) {
+void OnWildcardCheckCompleted(const std::string& username,
+                              WildcardLoginChecker::Result result) {
+  if (result == WildcardLoginChecker::RESULT_BLOCKED) {
     LOG(ERROR) << "Online wildcard login check failed, terminating session.";
 
     // TODO(mnissler): This only removes the user pod from the login screen, but
     // the cryptohome remains. This is because deleting the cryptohome for a
     // logged-in session is not possible. Fix this either by delaying the
     // cryptohome deletion operation or by getting rid of the in-session
     // wildcard check.
     chromeos::UserManager::Get()->RemoveUserFromList(username);
     chrome::AttemptUserExit();
   }

[Joao da Silva, 2014/02/26 11:10:18]

If this CL is meant to just fix the signout problem then it's fine.

But we should retry on RESULT_FAILED here, otherwise turning wifi off right
after signing in may skip the whitelist check. RESULT_FAILED may also be a
consistent result for some configurations (user ONC, etc)

[Mattias Nissler (ping if slow), 2014/02/26 11:13:41]

Remember that this is just a best-effort to get already-created accounts that
would have failed the whitelist check pruned out. I'd like to wait for a
decision on how we want to implement the whitelist check moving forward (as
discussed on the separate mail thread and doc) before tackling reliability here
(and other shortcomings of this hack).

 }
 
 }  // namespace
 
 UserCloudPolicyManagerChromeOS::UserCloudPolicyManagerChromeOS(
     scoped_ptr<CloudPolicyStore> store,
     scoped_ptr<CloudExternalDataManager> external_data_manager,
     const base::FilePath& component_policy_cache_path,
     bool wait_for_policy_fetch,
     base::TimeDelta initial_policy_fetch_timeout,
@@ skipping 297 matching lines @@
     // OnComponentCloudPolicyUpdated() once it's ready.
     return;
   }
 
   core()->StartRefreshScheduler();
   core()->TrackRefreshDelayPref(local_state_,
                                 policy_prefs::kUserPolicyRefreshRate);
 }
 
 }  // namespace policy