| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h" | 5 #include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h" |
| 6 | 6 |
| 7 #include <utility> | 7 #include <utility> |
| 8 | 8 |
| 9 #include "base/bind.h" | 9 #include "base/bind.h" |
| 10 #include "base/location.h" | 10 #include "base/location.h" |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 60 NOTREACHED() << "Bad enrollment mode: " << mode; | 60 NOTREACHED() << "Bad enrollment mode: " << mode; |
| 61 return em::DeviceRegisterRequest::FLAVOR_ENROLLMENT_MANUAL; | 61 return em::DeviceRegisterRequest::FLAVOR_ENROLLMENT_MANUAL; |
| 62 } | 62 } |
| 63 | 63 |
| 64 } // namespace | 64 } // namespace |
| 65 | 65 |
| 66 EnrollmentHandlerChromeOS::EnrollmentHandlerChromeOS( | 66 EnrollmentHandlerChromeOS::EnrollmentHandlerChromeOS( |
| 67 DeviceCloudPolicyStoreChromeOS* store, | 67 DeviceCloudPolicyStoreChromeOS* store, |
| 68 EnterpriseInstallAttributes* install_attributes, | 68 EnterpriseInstallAttributes* install_attributes, |
| 69 ServerBackedStateKeysBroker* state_keys_broker, | 69 ServerBackedStateKeysBroker* state_keys_broker, |
| 70 chromeos::OwnerSettingsServiceChromeOS* owner_settings_service, | |
| 71 std::unique_ptr<CloudPolicyClient> client, | 70 std::unique_ptr<CloudPolicyClient> client, |
| 72 scoped_refptr<base::SequencedTaskRunner> background_task_runner, | 71 scoped_refptr<base::SequencedTaskRunner> background_task_runner, |
| 73 const EnrollmentConfig& enrollment_config, | 72 const EnrollmentConfig& enrollment_config, |
| 74 const std::string& auth_token, | 73 const std::string& auth_token, |
| 75 const std::string& client_id, | 74 const std::string& client_id, |
| 76 const std::string& requisition, | 75 const std::string& requisition, |
| 77 const AllowedDeviceModes& allowed_device_modes, | 76 const AllowedDeviceModes& allowed_device_modes, |
| 78 ManagementMode management_mode, | |
| 79 const EnrollmentCallback& completion_callback) | 77 const EnrollmentCallback& completion_callback) |
| 80 : store_(store), | 78 : store_(store), |
| 81 install_attributes_(install_attributes), | 79 install_attributes_(install_attributes), |
| 82 state_keys_broker_(state_keys_broker), | 80 state_keys_broker_(state_keys_broker), |
| 83 owner_settings_service_(owner_settings_service), | |
| 84 client_(std::move(client)), | 81 client_(std::move(client)), |
| 85 background_task_runner_(background_task_runner), | 82 background_task_runner_(background_task_runner), |
| 86 enrollment_config_(enrollment_config), | 83 enrollment_config_(enrollment_config), |
| 87 auth_token_(auth_token), | 84 auth_token_(auth_token), |
| 88 client_id_(client_id), | 85 client_id_(client_id), |
| 89 requisition_(requisition), | 86 requisition_(requisition), |
| 90 allowed_device_modes_(allowed_device_modes), | 87 allowed_device_modes_(allowed_device_modes), |
| 91 management_mode_(management_mode), | |
| 92 completion_callback_(completion_callback), | 88 completion_callback_(completion_callback), |
| 93 device_mode_(DEVICE_MODE_NOT_SET), | 89 device_mode_(DEVICE_MODE_NOT_SET), |
| 94 skip_robot_auth_(false), | 90 skip_robot_auth_(false), |
| 95 enrollment_step_(STEP_PENDING), | 91 enrollment_step_(STEP_PENDING), |
| 96 lockbox_init_duration_(0), | 92 lockbox_init_duration_(0), |
| 97 weak_ptr_factory_(this) { | 93 weak_ptr_factory_(this) { |
| 98 CHECK(!client_->is_registered()); | 94 CHECK(!client_->is_registered()); |
| 99 CHECK_EQ(DM_STATUS_SUCCESS, client_->status()); | 95 CHECK_EQ(DM_STATUS_SUCCESS, client_->status()); |
| 100 CHECK(management_mode_ == MANAGEMENT_MODE_ENTERPRISE_MANAGED || | |
| 101 management_mode_ == MANAGEMENT_MODE_CONSUMER_MANAGED); | |
| 102 store_->AddObserver(this); | 96 store_->AddObserver(this); |
| 103 client_->AddObserver(this); | 97 client_->AddObserver(this); |
| 104 client_->AddPolicyTypeToFetch(dm_protocol::kChromeDevicePolicyType, | 98 client_->AddPolicyTypeToFetch(dm_protocol::kChromeDevicePolicyType, |
| 105 std::string()); | 99 std::string()); |
| 106 } | 100 } |
| 107 | 101 |
| 108 EnrollmentHandlerChromeOS::~EnrollmentHandlerChromeOS() { | 102 EnrollmentHandlerChromeOS::~EnrollmentHandlerChromeOS() { |
| 109 Stop(); | 103 Stop(); |
| 110 store_->RemoveObserver(this); | 104 store_->RemoveObserver(this); |
| 111 } | 105 } |
| (...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 151 // previously-enrolled domain. | 145 // previously-enrolled domain. |
| 152 std::string domain; | 146 std::string domain; |
| 153 if (install_attributes_->IsEnterpriseDevice()) { | 147 if (install_attributes_->IsEnterpriseDevice()) { |
| 154 domain = install_attributes_->GetDomain(); | 148 domain = install_attributes_->GetDomain(); |
| 155 validator->ValidateDomain(domain); | 149 validator->ValidateDomain(domain); |
| 156 } | 150 } |
| 157 validator->ValidateDMToken(client->dm_token(), | 151 validator->ValidateDMToken(client->dm_token(), |
| 158 CloudPolicyValidatorBase::DM_TOKEN_REQUIRED); | 152 CloudPolicyValidatorBase::DM_TOKEN_REQUIRED); |
| 159 validator->ValidatePolicyType(dm_protocol::kChromeDevicePolicyType); | 153 validator->ValidatePolicyType(dm_protocol::kChromeDevicePolicyType); |
| 160 validator->ValidatePayload(); | 154 validator->ValidatePayload(); |
| 161 if (management_mode_ == MANAGEMENT_MODE_CONSUMER_MANAGED) { | 155 // If |domain| is empty here, the policy validation code will just use the |
| 162 // For consumer-managed devices, although we don't store the policy, we | 156 // domain from the username field in the policy itself to do key validation. |
| 163 // still need to verify its integrity since we use the request token in it. | 157 // TODO(mnissler): Plumb the enrolling user's username into this object so we |
| 164 // The consumer device management server does not have the verification | 158 // can validate the username on the resulting policy, and use the domain from |
| 165 // key, and we need to skip checking on that by passing an empty key to | 159 // that username to validate the key below (http://crbug.com/343074). |
| 166 // ValidateInitialKey(). ValidateInitialKey() still checks that the policy | 160 validator->ValidateInitialKey(GetPolicyVerificationKey(), domain); |
| 167 // data is correctly signed by the new public key when the verification key | |
| 168 // is empty. | |
| 169 validator->ValidateInitialKey(std::string(), std::string()); | |
| 170 } else { | |
| 171 // If |domain| is empty here, the policy validation code will just use the | |
| 172 // domain from the username field in the policy itself to do key validation. | |
| 173 // TODO(mnissler): Plumb the enrolling user's username into this object so | |
| 174 // we can validate the username on the resulting policy, and use the domain | |
| 175 // from that username to validate the key below (http://crbug.com/343074). | |
| 176 validator->ValidateInitialKey(GetPolicyVerificationKey(), domain); | |
| 177 } | |
| 178 validator.release()->StartValidation( | 161 validator.release()->StartValidation( |
| 179 base::Bind(&EnrollmentHandlerChromeOS::HandlePolicyValidationResult, | 162 base::Bind(&EnrollmentHandlerChromeOS::HandlePolicyValidationResult, |
| 180 weak_ptr_factory_.GetWeakPtr())); | 163 weak_ptr_factory_.GetWeakPtr())); |
| 181 } | 164 } |
| 182 | 165 |
| 183 void EnrollmentHandlerChromeOS::OnRegistrationStateChanged( | 166 void EnrollmentHandlerChromeOS::OnRegistrationStateChanged( |
| 184 CloudPolicyClient* client) { | 167 CloudPolicyClient* client) { |
| 185 DCHECK_EQ(client_.get(), client); | 168 DCHECK_EQ(client_.get(), client); |
| 186 | 169 |
| 187 if (enrollment_step_ == STEP_REGISTRATION && client_->is_registered()) { | 170 if (enrollment_step_ == STEP_REGISTRATION && client_->is_registered()) { |
| (...skipping 174 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 362 << response_code; | 345 << response_code; |
| 363 ReportResult( | 346 ReportResult( |
| 364 EnrollmentStatus::ForRobotRefreshFetchError(response_code)); | 347 EnrollmentStatus::ForRobotRefreshFetchError(response_code)); |
| 365 } | 348 } |
| 366 | 349 |
| 367 void EnrollmentHandlerChromeOS::StartLockDevice() { | 350 void EnrollmentHandlerChromeOS::StartLockDevice() { |
| 368 CHECK_EQ(STEP_LOCK_DEVICE, enrollment_step_); | 351 CHECK_EQ(STEP_LOCK_DEVICE, enrollment_step_); |
| 369 // Since this method is also called directly. | 352 // Since this method is also called directly. |
| 370 weak_ptr_factory_.InvalidateWeakPtrs(); | 353 weak_ptr_factory_.InvalidateWeakPtrs(); |
| 371 | 354 |
| 372 if (management_mode_ == MANAGEMENT_MODE_CONSUMER_MANAGED) { | 355 install_attributes_->LockDevice( |
| 373 CHECK(owner_settings_service_); | 356 username_, device_mode_, device_id_, |
| 374 | 357 base::Bind(&EnrollmentHandlerChromeOS::HandleLockDeviceResult, |
| 375 // Consumer device enrollment doesn't use install attributes. Instead, | 358 weak_ptr_factory_.GetWeakPtr())); |
| 376 // we put the information in the owners settings. | |
| 377 enrollment_step_ = STEP_STORE_TOKEN_AND_ID; | |
| 378 chromeos::OwnerSettingsServiceChromeOS::ManagementSettings settings; | |
| 379 settings.management_mode = management_mode_; | |
| 380 settings.request_token = request_token_; | |
| 381 settings.device_id = device_id_; | |
| 382 owner_settings_service_->SetManagementSettings( | |
| 383 settings, | |
| 384 base::Bind(&EnrollmentHandlerChromeOS::HandleSetManagementSettingsDone, | |
| 385 weak_ptr_factory_.GetWeakPtr())); | |
| 386 } else { | |
| 387 install_attributes_->LockDevice( | |
| 388 username_, device_mode_, device_id_, | |
| 389 base::Bind(&EnrollmentHandlerChromeOS::HandleLockDeviceResult, | |
| 390 weak_ptr_factory_.GetWeakPtr())); | |
| 391 } | |
| 392 } | 359 } |
| 393 | 360 |
| 394 void EnrollmentHandlerChromeOS::HandleSetManagementSettingsDone(bool success) { | 361 void EnrollmentHandlerChromeOS::HandleSetManagementSettingsDone(bool success) { |
| 395 CHECK_EQ(STEP_STORE_TOKEN_AND_ID, enrollment_step_); | 362 CHECK_EQ(STEP_STORE_TOKEN_AND_ID, enrollment_step_); |
| 396 if (!success) { | 363 if (!success) { |
| 397 ReportResult(EnrollmentStatus::ForStatus( | 364 ReportResult(EnrollmentStatus::ForStatus( |
| 398 EnrollmentStatus::STATUS_STORE_TOKEN_AND_ID_FAILED)); | 365 EnrollmentStatus::STATUS_STORE_TOKEN_AND_ID_FAILED)); |
| 399 return; | 366 return; |
| 400 } | 367 } |
| 401 | 368 |
| (...skipping 54 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 456 void EnrollmentHandlerChromeOS::HandleStoreRobotAuthTokenResult(bool result) { | 423 void EnrollmentHandlerChromeOS::HandleStoreRobotAuthTokenResult(bool result) { |
| 457 CHECK_EQ(STEP_STORE_ROBOT_AUTH, enrollment_step_); | 424 CHECK_EQ(STEP_STORE_ROBOT_AUTH, enrollment_step_); |
| 458 | 425 |
| 459 if (!result) { | 426 if (!result) { |
| 460 LOG(ERROR) << "Failed to store API refresh token."; | 427 LOG(ERROR) << "Failed to store API refresh token."; |
| 461 ReportResult(EnrollmentStatus::ForStatus( | 428 ReportResult(EnrollmentStatus::ForStatus( |
| 462 EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED)); | 429 EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED)); |
| 463 return; | 430 return; |
| 464 } | 431 } |
| 465 | 432 |
| 466 if (management_mode_ == MANAGEMENT_MODE_CONSUMER_MANAGED) { | |
| 467 // For consumer management enrollment, we don't store the policy. | |
| 468 ReportResult(EnrollmentStatus::ForStatus(EnrollmentStatus::STATUS_SUCCESS)); | |
| 469 return; | |
| 470 } | |
| 471 | |
| 472 enrollment_step_ = STEP_STORE_POLICY; | 433 enrollment_step_ = STEP_STORE_POLICY; |
| 473 store_->InstallInitialPolicy(*policy_); | 434 store_->InstallInitialPolicy(*policy_); |
| 474 } | 435 } |
| 475 | 436 |
| 476 void EnrollmentHandlerChromeOS::Stop() { | 437 void EnrollmentHandlerChromeOS::Stop() { |
| 477 if (client_.get()) | 438 if (client_.get()) |
| 478 client_->RemoveObserver(this); | 439 client_->RemoveObserver(this); |
| 479 enrollment_step_ = STEP_FINISHED; | 440 enrollment_step_ = STEP_FINISHED; |
| 480 weak_ptr_factory_.InvalidateWeakPtrs(); | 441 weak_ptr_factory_.InvalidateWeakPtrs(); |
| 481 completion_callback_.Reset(); | 442 completion_callback_.Reset(); |
| 482 } | 443 } |
| 483 | 444 |
| 484 void EnrollmentHandlerChromeOS::ReportResult(EnrollmentStatus status) { | 445 void EnrollmentHandlerChromeOS::ReportResult(EnrollmentStatus status) { |
| 485 EnrollmentCallback callback = completion_callback_; | 446 EnrollmentCallback callback = completion_callback_; |
| 486 Stop(); | 447 Stop(); |
| 487 | 448 |
| 488 if (status.status() != EnrollmentStatus::STATUS_SUCCESS) { | 449 if (status.status() != EnrollmentStatus::STATUS_SUCCESS) { |
| 489 LOG(WARNING) << "Enrollment failed: " << status.status() | 450 LOG(WARNING) << "Enrollment failed: " << status.status() |
| 490 << ", client: " << status.client_status() | 451 << ", client: " << status.client_status() |
| 491 << ", validation: " << status.validation_status() | 452 << ", validation: " << status.validation_status() |
| 492 << ", store: " << status.store_status() | 453 << ", store: " << status.store_status() |
| 493 << ", lock: " << status.lock_status(); | 454 << ", lock: " << status.lock_status(); |
| 494 } | 455 } |
| 495 | 456 |
| 496 if (!callback.is_null()) | 457 if (!callback.is_null()) |
| 497 callback.Run(status); | 458 callback.Run(status); |
| 498 } | 459 } |
| 499 | 460 |
| 500 } // namespace policy | 461 } // namespace policy |
| OLD | NEW |