Do not try to enroll past OOBE/enrollment.

chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 
 #include "base/command_line.h"
 #include "base/memory/ptr_util.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/policy/enrollment_config.h"
 #include "chrome/browser/chromeos/policy/server_backed_device_state.h"
 #include "chrome/browser/chromeos/policy/stub_enterprise_install_attributes.h"
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/attestation/mock_attestation_flow.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/system/fake_statistics_provider.h"
 #include "chromeos/system/statistics_provider.h"
 #include "components/prefs/testing_pref_service.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace policy {
 
 struct ZeroTouchParam {
   const char* enable_zero_touch_flag;
   EnrollmentConfig::AuthMechanism auth_mechanism;
+  EnrollmentConfig::AuthMechanism auth_mechanism_after_oobe;
 
-  ZeroTouchParam(const char* flag, EnrollmentConfig::AuthMechanism auth)
-      : enable_zero_touch_flag(flag), auth_mechanism(auth) {}
+  ZeroTouchParam(const char* flag,
+                 EnrollmentConfig::AuthMechanism auth,
+                 EnrollmentConfig::AuthMechanism auth_after_oobe)
+      : enable_zero_touch_flag(flag),
+        auth_mechanism(auth),
+        auth_mechanism_after_oobe(auth_after_oobe) {}
 };
 
 class DeviceCloudPolicyInitializerTest
     : public testing::TestWithParam<ZeroTouchParam> {
  protected:
   DeviceCloudPolicyInitializerTest()
       : device_cloud_policy_initializer_(
             &local_state_,
             nullptr,
             nullptr,
@@ skipping 102 matching lines @@
        GetPrescribedEnrollmentConfigAfterOOBE) {
   SetupZeroTouchFlag();
 
   // If OOBE is complete, we may re-enroll to the domain configured in install
   // attributes. This is only enforced after detecting enrollment loss.
   local_state_.SetBoolean(prefs::kOobeComplete, true);
   EnrollmentConfig config =
       device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_NONE, config.mode);
   EXPECT_TRUE(config.management_domain.empty());
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 
   // Advertised enrollment gets ignored.
   local_state_.SetBoolean(prefs::kDeviceEnrollmentAutoStart, true);
   statistics_provider_.SetMachineFlag(
       chromeos::system::kOemIsEnterpriseManagedKey, true);
   config = device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_NONE, config.mode);
   EXPECT_TRUE(config.management_domain.empty());
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 
   // If the device is enterprise-managed, the management domain gets pulled from
   // install attributes.
   install_attributes_.SetRegistrationUser("user@example.com");
   install_attributes_.SetDomain("example.com");
   config = device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_NONE, config.mode);
   EXPECT_EQ("example.com", config.management_domain);
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 
   // If enrollment recovery is on, this is signaled in |config.mode|.
   local_state_.SetBoolean(prefs::kEnrollmentRecoveryRequired, true);
   config = device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_RECOVERY, config.mode);
   EXPECT_EQ("example.com", config.management_domain);
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 }
 
 INSTANTIATE_TEST_CASE_P(
     ZeroTouchFlag,
     DeviceCloudPolicyInitializerTest,
     ::testing::Values(
         ZeroTouchParam(nullptr,  // No flag set.
+                       EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE,
                        EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE),
         ZeroTouchParam("",  // Flag set without a set value.
-                       EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE),
+                       EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE,
+                       EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE),
         ZeroTouchParam("forced",
+                       EnrollmentConfig::AUTH_MECHANISM_ATTESTATION,
                        EnrollmentConfig::AUTH_MECHANISM_ATTESTATION)));
 
 }  // namespace policy