Lock profile before sign in when force sign in is enabled.

chrome/browser/profiles/profile_attributes_entry.h

Index: chrome/browser/profiles/profile_attributes_entry.h
diff --git a/chrome/browser/profiles/profile_attributes_entry.h b/chrome/browser/profiles/profile_attributes_entry.h
index dbe978290f50e9e69e4e78cdf0acb87aa980eef8..19e2380ba81cda8a5de98a107dd020716263d0a1 100644
--- a/chrome/browser/profiles/profile_attributes_entry.h
+++ b/chrome/browser/profiles/profile_attributes_entry.h
@@ -124,6 +124,9 @@ class ProfileAttributesEntry {
 
   void SetAuthInfo(const std::string& gaia_id, const base::string16& user_name);
 
+  // Lock/Unlock the profile, should be called only if force-sign-in is enabled.
+  void LockForceSigninProfile(bool is_lock);
+
  private:
   // These members are an implementation detail meant to smooth the migration
   // of the ProfileInfoCache to the ProfileAttributesStorage interface. They can
@@ -137,6 +140,12 @@ class ProfileAttributesEntry {
   ProfileInfoCache* profile_info_cache_;
   base::FilePath profile_path_;
 
+  // A separate boolean flag indicates whether the signin is required when force
+  // signin is enabled. So that the profile locked status will be stored in
+  // memory only and can be easily reset once the policy is turned off.
+  bool is_force_signin_profile_locked_ = false;
+  bool is_force_signin_enabled_;

[anthonyvd, 2016/11/04 21:31:02]

Why store this instead of just checking the pref? It seems like this would be a
failure point if the pref changes at runtime, no?

[zmin, 2016/11/04 22:11:53]

The value of force sign in policy won't be changed during runtime
('dynamic_refresh': False,):
So I think it should be safe to cache it.

https://cs.chromium.org/chromium/src/components/policy/resources/policy_templ...

+
   DISALLOW_COPY_AND_ASSIGN(ProfileAttributesEntry);
 };