Device registration using an enrollment certificate from the PCA.

chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/chromeos/attestation/attestation_ca_client.h"
 #include "chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.h"
 #include "chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
 #include "chrome/browser/chromeos/policy/enrollment_status_chromeos.h"
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
@@ skipping 40 matching lines @@
   NOTREACHED() << "Bad enrollment mode: " << mode;
   return em::DeviceRegisterRequest::FLAVOR_ENROLLMENT_MANUAL;
 }
 
 }  // namespace
 
 EnrollmentHandlerChromeOS::EnrollmentHandlerChromeOS(
     DeviceCloudPolicyStoreChromeOS* store,
     EnterpriseInstallAttributes* install_attributes,
     ServerBackedStateKeysBroker* state_keys_broker,
-    cryptohome::AsyncMethodCaller* async_method_caller,
-    chromeos::CryptohomeClient* cryptohome_client,
+    chromeos::attestation::AttestationFlow* attestation_flow,
     std::unique_ptr<CloudPolicyClient> client,
     scoped_refptr<base::SequencedTaskRunner> background_task_runner,
     const EnrollmentConfig& enrollment_config,
     const std::string& auth_token,
     const std::string& client_id,
     const std::string& requisition,
     const AllowedDeviceModes& allowed_device_modes,
     const EnrollmentCallback& completion_callback)
     : store_(store),
       install_attributes_(install_attributes),
       state_keys_broker_(state_keys_broker),
-      async_method_caller_(async_method_caller),
-      cryptohome_client_(cryptohome_client),
+      attestation_flow_(attestation_flow),
       client_(std::move(client)),
       background_task_runner_(background_task_runner),
       enrollment_config_(enrollment_config),
       auth_token_(auth_token),
       client_id_(client_id),
       requisition_(requisition),
       allowed_device_modes_(allowed_device_modes),
       completion_callback_(completion_callback),
       device_mode_(DEVICE_MODE_NOT_SET),
       skip_robot_auth_(false),
       enrollment_step_(STEP_PENDING),
       lockbox_init_duration_(0),
       weak_ptr_factory_(this) {
   CHECK(!client_->is_registered());
   CHECK_EQ(DM_STATUS_SUCCESS, client_->status());
   CHECK((enrollment_config_.mode == EnrollmentConfig::MODE_ATTESTATION ||
          enrollment_config_.mode ==
              EnrollmentConfig::MODE_ATTESTATION_FORCED) == auth_token_.empty());
   CHECK(enrollment_config_.auth_mechanism !=
             EnrollmentConfig::AUTH_MECHANISM_ATTESTATION ||
-        (async_method_caller_ != nullptr && cryptohome_client_ != nullptr));
+        attestation_flow_);
   store_->AddObserver(this);
   client_->AddObserver(this);
   client_->AddPolicyTypeToFetch(dm_protocol::kChromeDevicePolicyType,
                                 std::string());
 }
 
 EnrollmentHandlerChromeOS::~EnrollmentHandlerChromeOS() {
   Stop();
   store_->RemoveObserver(this);
 }
@@ skipping 142 matching lines @@
 }
 
 void EnrollmentHandlerChromeOS::StartRegistration() {
   CHECK_EQ(STEP_LOADING_STORE, enrollment_step_);
   if (!store_->is_initialized()) {
     // Do nothing. StartRegistration() will be called again from OnStoreLoaded()
     // after the CloudPolicyStore has initialized.
     return;
   }
   enrollment_step_ = STEP_REGISTRATION;
-  if (enrollment_config_.should_enroll_with_attestation()) {
+  if (enrollment_config_.is_mode_attestation()) {
     StartAttestationBasedEnrollmentFlow();
   } else {
     client_->Register(
         em::DeviceRegisterRequest::DEVICE,
         EnrollmentModeToRegistrationFlavor(enrollment_config_.mode),
         auth_token_, client_id_, requisition_, current_state_key_);
   }
 }
 
 void EnrollmentHandlerChromeOS::StartAttestationBasedEnrollmentFlow() {
-  if (!attestation_flow_) {
-    std::unique_ptr<chromeos::attestation::ServerProxy> attestation_ca_client(
-        new chromeos::attestation::AttestationCAClient());
-    attestation_flow_.reset(new chromeos::attestation::AttestationFlow(
-        async_method_caller_, cryptohome_client_,
-        std::move(attestation_ca_client)));
-  }
   const chromeos::attestation::AttestationFlow::CertificateCallback callback =
       base::Bind(
           &EnrollmentHandlerChromeOS::HandleRegistrationCertificateResult,
           weak_ptr_factory_.GetWeakPtr());
   attestation_flow_->GetCertificate(
       chromeos::attestation::PROFILE_ENTERPRISE_ENROLLMENT_CERTIFICATE,
       EmptyAccountId(), "" /* request_origin */, false /* force_new_key */,
       callback);
 }
 
 void EnrollmentHandlerChromeOS::HandleRegistrationCertificateResult(
     bool success,
     const std::string& pem_certificate_chain) {
-  LOG(WARNING) << "Enrolling with a registration certificate"
-                  " is not supported yet.";
-  // TODO(drcrash): Invert success/fail tests, mocking as always failed now.
-  if (success) {
-    // TODO(drcrash): Implement new call in client_ to register with cert.
-  }
-  ReportResult(EnrollmentStatus::ForStatus(
-      EnrollmentStatus::STATUS_REGISTRATION_CERTIFICATE_FETCH_FAILED));
+  if (success)
+    client_->RegisterWithCertificate(
+        em::DeviceRegisterRequest::DEVICE,
+        EnrollmentModeToRegistrationFlavor(enrollment_config_.mode),
+        pem_certificate_chain, client_id_, requisition_, current_state_key_);
+  else
+    ReportResult(EnrollmentStatus::ForStatus(
+        EnrollmentStatus::STATUS_REGISTRATION_CERTIFICATE_FETCH_FAILED));
 }
 
 void EnrollmentHandlerChromeOS::HandlePolicyValidationResult(
     DeviceCloudPolicyValidator* validator) {
   CHECK_EQ(STEP_VALIDATION, enrollment_step_);
   if (validator->success()) {
     policy_ = std::move(validator->policy());
     username_ = validator->policy_data()->username();
     device_id_ = validator->policy_data()->device_id();
     request_token_ = validator->policy_data()->request_token();
@@ skipping 181 matching lines @@
                  << ", validation: " << status.validation_status()
                  << ", store: " << status.store_status()
                  << ", lock: " << status.lock_status();
   }
 
   if (!callback.is_null())
     callback.Run(status);
 }
 
 }  // namespace policy