Minimal attestation-based enrollment flow.

chrome/browser/chromeos/login/wizard_controller.cc

Index: chrome/browser/chromeos/login/wizard_controller.cc
diff --git a/chrome/browser/chromeos/login/wizard_controller.cc b/chrome/browser/chromeos/login/wizard_controller.cc
index e2274e20c12d40933f7ce0c913e4289a2f887a2a..9d40ba9469f5e246e6cdf7c3a404bd5f8ddbd8d8 100644
--- a/chrome/browser/chromeos/login/wizard_controller.cc
+++ b/chrome/browser/chromeos/login/wizard_controller.cc
@@ -461,7 +461,7 @@ void WizardController::ShowEnrollmentScreen() {
   prescribed_enrollment_config_ = g_browser_process->platform_part()
                                       ->browser_policy_connector_chromeos()
                                       ->GetPrescribedEnrollmentConfig();
-  StartEnrollmentScreen();
+  StartEnrollmentScreen(false);
 }
 
 void WizardController::ShowResetScreen() {
@@ -791,7 +791,7 @@ void WizardController::OnDeviceDisabledChecked(bool device_disabled) {
     ShowDeviceDisabledScreen();
   } else if (skip_update_enroll_after_eula_ ||
              prescribed_enrollment_config_.should_enroll()) {
-    StartEnrollmentScreen();
+    StartEnrollmentScreen(skip_update_enroll_after_eula_);
   } else {
     PerformOOBECompletedActions();
     ShowLoginScreen(LoginScreenContext());
@@ -1384,14 +1384,15 @@ void WizardController::OnSetHostNetworkFailed() {
       pairing_chromeos::HostPairingController::CONNECTIVITY_NONE);
 }
 
-void WizardController::StartEnrollmentScreen() {
+void WizardController::StartEnrollmentScreen(bool force_interactive) {
   VLOG(1) << "Showing enrollment screen.";
 
   // Determine the effective enrollment configuration. If there is a valid
   // prescribed configuration, use that. If not, figure out which variant of
   // manual enrollment is taking place.
   policy::EnrollmentConfig effective_config = prescribed_enrollment_config_;
-  if (!effective_config.should_enroll()) {
+  if (!effective_config.should_enroll() ||
+      (force_interactive && !effective_config.should_enroll_interactively())) {

[pastarmovj, 2016/08/19 10:29:18]

Can't quite follow the logic here - why do you want force_iteractive to be true
but at the same time should_enroll_interactively to be false?

[The one and only Dr. Crash, 2016/08/19 17:49:29]

effective_config is set from environmental factors by the DCP initializer. So
that represents what the device thinks it should do. The force_interactive flag,
on the other hand, represents that the user has asked for enrollment by typing
CTRL+ALT+E. So if you take an out of the box Chromebook or Chromebox for
example, effective_config.should_enroll_interactively() will be false (and
therefore we would get there only if the user typed CTRL+ALT+E). If you take
anything that sets a requisition through the OEM partition or other means it, or
if the AutoEnrollmentScreen has determined that one needs to re-enroll forcibly
for example, it will be true.

     effective_config.mode =
         prescribed_enrollment_config_.management_domain.empty()
             ? policy::EnrollmentConfig::MODE_MANUAL