Enable fetching of admin policies for login screen apps

chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc

Index: chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
index 20a8fd91e06d41f9f9d0ecb9489d95281841608e..f6302b798e39bbe985cbbb30964208db04ba6063 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
@@ -237,6 +237,10 @@ void DeviceCloudPolicyInitializer::EnrollmentCompleted(
 
   if (status.status() == EnrollmentStatus::STATUS_SUCCESS) {
     StartConnection(std::move(client));
+    // Request policy refresh, as some new policy types (e.g. component
+    // policies) could be added for fetching when the connection was started by
+    // the device cloud policy manager.
+    manager_->RefreshPolicies();

[Andrew T Wilson (Slow), 2016/10/28 14:49:56]

This is fine, but curious why StartConnection() doesn't refresh policies if this
is a known side effect?

[emaxx, 2016/10/31 15:51:20]

Usually the first policy fetch happens as the result of the
DeviceCloudPolicyManagerChromeOS::StartConnection call: it calls
CloudPolicyCore::StartRefreshScheduler which creates a
CloudPolicyRefreshScheduler that schedules an immediate refresh because there's
no previous policy fetch time.

During enrollment, the first policy fetch happens earlier, before calling
DeviceCloudPolicyManagerChromeOS::StartConnection, that's why the new
CloudPolicyRefreshScheduler instance doesn't schedule an immediate policy
refresh.


Though I agree this my solution looks more like a workaround.
Maybe you have an idea for a better approach?

[Andrew T Wilson (Slow), 2016/10/31 20:44:11]

I don't have a great idea here - I've never really had to dive into the
enrollment code so I don't have a deep understanding about how the
initialization order works.

   } else {
     // Some attempts to create a client may be blocked because the enrollment
     // was in progress. We give it a try again.