Chromad: Add authentication flow

Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

The account_ids should be fixed properly, once mirgration to GaiaIds will be done

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Committed: https://crrev.com/7ebd295d2ce1f07a33b4b4231c8f81963a574358
Cr-Commit-Position: refs/heads/master@{#440631}

[Roman Sorokin (ftl), 2016-11-23 14:12:12]

Description was changed from

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

BUG=656992
TEST=manual
==========

to

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

[Roman Sorokin (ftl), 2016-11-23 14:13:19]

The CQ bit was checked by rsorokin@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-23 14:13:34]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Roman Sorokin (ftl), 2016-11-23 14:13:36]

rsorokin@chromium.org changed reviewers:
+ alemate@chromium.org, tnagel@chromium.org

[Roman Sorokin (ftl), 2016-11-23 14:13:37]

PTAL

[commit-bot: I haz the power, 2016-11-23 15:10:39]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-23 15:10:40]

Dry run: Try jobs failed on following builders:
  linux_chromium_chromeos_ozone_rel_ng on master.tryserver.chromium.linux
(JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Alexander Alekseev, 2016-11-24 07:12:40]

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:506: AccountId
ac_id(GetAccountId(username, uid));
Could you add account_type parameter to GetAccountId() call?
(And, probably, down to AccountId constructor).
So that you could have constant account_is here.

https://codereview.chromium.org/2519823006/diff/1/components/signin/core/acco...
File components/signin/core/account_id/account_id.cc (right):

https://codereview.chromium.org/2519823006/diff/1/components/signin/core/acco...
components/signin/core/account_id/account_id.cc:192: *account_id =
FromUserEmailGaiaId(user_email, gaia_id);
Could you just add function "FromAccountTypeUserEmailGaiaId()" ?

[Roman Sorokin (ftl), 2016-11-24 15:22:27]

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:506: AccountId
ac_id(GetAccountId(username, uid));
On 2016/11/24 07:12:40, Alexander Alekseev wrote:
> Could you add account_type parameter to GetAccountId() call?
> (And, probably, down to AccountId constructor).
> So that you could have constant account_is here.

And change all the usages of known_user::GetAccountId ?

[Roman Sorokin (ftl), 2016-11-24 16:43:51]

rsorokin@chromium.org changed reviewers:
+ xiyuan@chromium.org

[Roman Sorokin (ftl), 2016-11-24 16:43:51]

xiyuan@chromium.org: Please take a look

[Roman Sorokin (ftl), 2016-11-24 16:44:55]

Description was changed from

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

to

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

The account_ids should be fixed properly, once mirgration to GaiaIds will be
done

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

[Alexander Alekseev, 2016-11-25 08:07:07]

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:506: AccountId
ac_id(GetAccountId(username, uid));
On 2016/11/24 15:22:26, Roman Sorokin wrote:
> On 2016/11/24 07:12:40, Alexander Alekseev wrote:
> > Could you add account_type parameter to GetAccountId() call?
> > (And, probably, down to AccountId constructor).
> > So that you could have constant account_is here.
> 
> And change all the usages of known_user::GetAccountId ?

Yes, it seems to be a best solution.
Otherwise this is goin to be more error-prone.

I see about 20 calls to GetAccountId:
https://cs-staging.chromium.org/chromium/src/components/user_manager/known_us...


It should not be too difficult to add one more constant parameter to all of
them.

[hashimoto, 2016-11-28 03:28:50]

hashimoto@chromium.org changed reviewers:
+ hashimoto@chromium.org

[hashimoto, 2016-11-28 03:28:51]

chromeos/dbus lgtm

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
File chromeos/dbus/auth_policy_client.h (right):

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:16: namespace authpolicy {
nit: Please put a blank line here.

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:27: };
ditto.

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:52: // |machine_name| is a name for a local
machine. |user|,
user -> user_principal_name

[xiyuan, 2016-11-28 23:43:05]

lgtm but please wait for alemate@

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/chromeos/log...
File chrome/browser/chromeos/login/helper.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/chromeos/log...
chrome/browser/chromeos/login/helper.cc:105: }
nit: insert an empty line between this line and the next line.

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/chromeos/log...
chrome/browser/chromeos/login/helper.cc:271: // data
nit: Move the comment to header. And end it with a ".".

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:506: AccountId
ac_id(GetAccountId(username, uid));
nit: ac_id -> account_id to make it easier to read

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
File chromeos/dbus/auth_policy_client.h (right):

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:65: // |callback| is called after the method
call succeeds.
Think |callback| is invoked when auth fails as well. Please update the comment
to avoid confusions.

[Roman Sorokin (ftl), 2016-12-02 12:35:13]

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/chromeos/log...
File chrome/browser/chromeos/login/helper.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/chromeos/log...
chrome/browser/chromeos/login/helper.cc:105: }
On 2016/11/28 23:43:05, xiyuan wrote:
> nit: insert an empty line between this line and the next line.

Done.

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/chromeos/log...
chrome/browser/chromeos/login/helper.cc:271: // data
On 2016/11/28 23:43:05, xiyuan wrote:
> nit: Move the comment to header. And end it with a ".".

Done.

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:506: AccountId
ac_id(GetAccountId(username, uid));
On 2016/11/25 08:07:07, Alexander Alekseev wrote:
> On 2016/11/24 15:22:26, Roman Sorokin wrote:
> > On 2016/11/24 07:12:40, Alexander Alekseev wrote:
> > > Could you add account_type parameter to GetAccountId() call?
> > > (And, probably, down to AccountId constructor).
> > > So that you could have constant account_is here.
> > 
> > And change all the usages of known_user::GetAccountId ?
> 
> Yes, it seems to be a best solution.
> Otherwise this is goin to be more error-prone.
> 
> I see about 20 calls to GetAccountId:
>
https://cs-staging.chromium.org/chromium/src/components/user_manager/known_us...
> 
> 
> It should not be too difficult to add one more constant parameter to all of
> them.

Done.

https://codereview.chromium.org/2519823006/diff/1/chrome/browser/ui/webui/chr...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:506: AccountId
ac_id(GetAccountId(username, uid));
On 2016/11/28 23:43:05, xiyuan wrote:
> nit: ac_id -> account_id to make it easier to read

Done.

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
File chromeos/dbus/auth_policy_client.h (right):

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:16: namespace authpolicy {
On 2016/11/28 03:28:50, hashimoto wrote:
> nit: Please put a blank line here.

Done.

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:27: };
On 2016/11/28 03:28:50, hashimoto wrote:
> ditto.

Done.

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:52: // |machine_name| is a name for a local
machine. |user|,
On 2016/11/28 03:28:50, hashimoto wrote:
> user -> user_principal_name

Done.

https://codereview.chromium.org/2519823006/diff/1/chromeos/dbus/auth_policy_c...
chromeos/dbus/auth_policy_client.h:65: // |callback| is called after the method
call succeeds.
On 2016/11/28 23:43:05, xiyuan wrote:
> Think |callback| is invoked when auth fails as well. Please update the comment
> to avoid confusions.

Done.

https://codereview.chromium.org/2519823006/diff/1/components/signin/core/acco...
File components/signin/core/account_id/account_id.cc (right):

https://codereview.chromium.org/2519823006/diff/1/components/signin/core/acco...
components/signin/core/account_id/account_id.cc:192: *account_id =
FromUserEmailGaiaId(user_email, gaia_id);
On 2016/11/24 07:12:40, Alexander Alekseev wrote:
> Could you just add function "FromAccountTypeUserEmailGaiaId()" ?

Done.

[Roman Sorokin (ftl), 2016-12-02 12:35:23]

The CQ bit was checked by rsorokin@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-02 12:35:36]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-02 12:37:38]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-02 12:37:39]

Dry run: Try jobs failed on following builders:
  mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[Roman Sorokin (ftl), 2016-12-16 14:23:08]

The CQ bit was checked by rsorokin@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-16 14:23:17]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Roman Sorokin (ftl), 2016-12-16 14:26:43]

rsorokin@chromium.org changed reviewers:
+ jam@chromium.org

[Roman Sorokin (ftl), 2016-12-16 14:26:44]

jam@chromium.org: Please review changes in 
ash/public/interfaces/*
Thanks!

[commit-bot: I haz the power, 2016-12-16 15:53:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-16 15:53:56]

Dry run: This issue passed the CQ dry run.

[jam, 2016-12-16 18:20:53]

On 2016/12/16 14:26:44, Roman Sorokin wrote:
> mailto:jam@chromium.org: Please review changes in 
> ash/public/interfaces/*
> Thanks!

pick an owner in ash/

[Roman Sorokin (ftl), 2016-12-19 13:54:35]

rsorokin@chromium.org changed reviewers:
- jam@chromium.org

[Roman Sorokin (ftl), 2016-12-19 13:57:27]

rsorokin@chromium.org changed reviewers:
+ dcheng@chromium.org

[Roman Sorokin (ftl), 2016-12-19 13:57:27]

dcheng@, please review ash/public/interfaces/session_controller.mojom

[Roman Sorokin (ftl), 2016-12-19 13:58:33]

rsorokin@chromium.org changed reviewers:
+ oshima@chromium.org

[Roman Sorokin (ftl), 2016-12-19 13:58:34]

oshima@chromium.org: Please review changes in 
ash/public/interfaces/session_controller_traits.h

[dcheng, 2016-12-20 09:26:26]

https://codereview.chromium.org/2519823006/diff/60001/ash/public/interfaces/s...
File ash/public/interfaces/session_controller.mojom (right):

https://codereview.chromium.org/2519823006/diff/60001/ash/public/interfaces/s...
ash/public/interfaces/session_controller.mojom:64: AD,
Nit: Let's write this as ACTIVE_DIRECTORY, per the style guide convention of
avoiding abbreviations. Similar comment throughout the rest of this CL (AdUser
=> ActiveDirectoryUser, IsADUser => IsActiveDirectoryUser, etc)

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/chromeos...
File chrome/browser/chromeos/login/helper.cc (right):

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/chromeos...
chrome/browser/chromeos/login/helper.cc:92: LOG(ERROR) << "Failed to create
pipe";
Is there a reason this code uses LOG instead of DLOG? This costs us size in
official builds by bloating it with additional strings. Similar comment applies
to other LOG statements in this CL.

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/ui/webui...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/ui/webui...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:517: LOG(ERROR) <<
"Failed to auth " << username << ", code " << code;
For example, I could see this being useful for devs, but not so much for end
users, thus DLOG?

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/ui/webui...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:539: LOG(ERROR) <<
"Got invalid password_fd";
Similarly, we already logged that pipe creation failed, so I don't think this
adds much as an official build LOG.

[Roman Sorokin (ftl), 2016-12-20 12:42:16]

The CQ bit was checked by rsorokin@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-20 12:42:23]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Roman Sorokin (ftl), 2016-12-20 12:43:59]

dcheng@, PTAL. Thanks!

https://codereview.chromium.org/2519823006/diff/60001/ash/public/interfaces/s...
File ash/public/interfaces/session_controller.mojom (right):

https://codereview.chromium.org/2519823006/diff/60001/ash/public/interfaces/s...
ash/public/interfaces/session_controller.mojom:64: AD,
On 2016/12/20 09:26:26, dcheng wrote:
> Nit: Let's write this as ACTIVE_DIRECTORY, per the style guide convention of
> avoiding abbreviations. Similar comment throughout the rest of this CL (AdUser
> => ActiveDirectoryUser, IsADUser => IsActiveDirectoryUser, etc)

Done.

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/chromeos...
File chrome/browser/chromeos/login/helper.cc (right):

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/chromeos...
chrome/browser/chromeos/login/helper.cc:92: LOG(ERROR) << "Failed to create
pipe";
On 2016/12/20 09:26:26, dcheng wrote:
> Is there a reason this code uses LOG instead of DLOG? This costs us size in
> official builds by bloating it with additional strings. Similar comment
applies
> to other LOG statements in this CL.

Done.

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/ui/webui...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/ui/webui...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:517: LOG(ERROR) <<
"Failed to auth " << username << ", code " << code;
On 2016/12/20 09:26:26, dcheng wrote:
> For example, I could see this being useful for devs, but not so much for end
> users, thus DLOG?

Done.

https://codereview.chromium.org/2519823006/diff/60001/chrome/browser/ui/webui...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:539: LOG(ERROR) <<
"Got invalid password_fd";
On 2016/12/20 09:26:26, dcheng wrote:
> Similarly, we already logged that pipe creation failed, so I don't think this
> adds much as an official build LOG.

Done.

[commit-bot: I haz the power, 2016-12-20 13:41:53]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-20 13:41:54]

Dry run: This issue passed the CQ dry run.

[dcheng, 2016-12-20 19:52:20]

mojo lgtm

[Alexander Alekseev, 2016-12-21 15:03:13]

lgtm

https://codereview.chromium.org/2519823006/diff/80001/chrome/browser/ui/webui...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/80001/chrome/browser/ui/webui...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:502: void
GaiaScreenHandler::HandleAdAuth(const std::string& username,
This does not handle any JS->chrome message.
Could you rename it to "DoAdAuth" for example?

[Roman Sorokin (ftl), 2016-12-21 17:41:36]

rsorokin@chromium.org changed reviewers:
+ derat@chromium.org
- oshima@chromium.org

[Roman Sorokin (ftl), 2016-12-21 17:41:37]

Hi Dan,

Could you please review ash/public/interfaces/session_controller_traits.h?
Seems like all the other owners are OOO. Thanks!

[Daniel Erat, 2016-12-21 18:23:24]

rubberstamp lgtm for ash/

[Thiemo Nagel, 2016-12-22 11:40:09]

Note that for a logged-in user, chrome://policy device policy status shows
"Invalid request or request parameters" on a Linux build whereas it works well
without your CLs.  It seems that you're breaking something.

[Roman Sorokin (ftl), 2016-12-23 13:30:10]

The CQ bit was checked by rsorokin@chromium.org

[Roman Sorokin (ftl), 2016-12-23 13:30:11]

The patchset sent to the CQ was uploaded after l-g-t-m from
hashimoto@chromium.org, xiyuan@chromium.org, alemate@chromium.org,
derat@chromium.org, dcheng@chromium.org
Link to the patchset: https://codereview.chromium.org/2519823006/#ps100001
(title: "Rename HandleAdAuth. Use system_api enums")

[commit-bot: I haz the power, 2016-12-23 13:30:16]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Roman Sorokin (ftl), 2016-12-23 13:30:22]

https://codereview.chromium.org/2519823006/diff/80001/chrome/browser/ui/webui...
File chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc (right):

https://codereview.chromium.org/2519823006/diff/80001/chrome/browser/ui/webui...
chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc:502: void
GaiaScreenHandler::HandleAdAuth(const std::string& username,
On 2016/12/21 15:03:13, Alexander Alekseev wrote:
> This does not handle any JS->chrome message.
> Could you rename it to "DoAdAuth" for example?

Done.

[commit-bot: I haz the power, 2016-12-23 15:46:25]

CQ is committing da patch.

Bot data: {"patchset_id": 100001, "attempt_start_ts": 1482499810534930,
"parent_rev": "5de7f59f2995e74e9b2a25e0053f48b459445948", "commit_rev":
"92159d19d5ab44898b041e0567342b16564ff7e6"}

[commit-bot: I haz the power, 2016-12-23 15:46:56]

Description was changed from

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

The account_ids should be fixed properly, once mirgration to GaiaIds will be
done

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

to

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

The account_ids should be fixed properly, once mirgration to GaiaIds will be
done

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Review-Url: https://codereview.chromium.org/2519823006
==========

[commit-bot: I haz the power, 2016-12-23 15:46:58]

Committed patchset #6 (id:100001)

[commit-bot: I haz the power, 2016-12-23 15:49:08]

Description was changed from

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

The account_ids should be fixed properly, once mirgration to GaiaIds will be
done

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Review-Url: https://codereview.chromium.org/2519823006
==========

to

==========
Chromad: Add authentication flow

Don't allow Google accounts on Active Directory enrolled devices.
Always enforce online auth for the Active Directory accounts.
Add new type of AccountId for Active directory.

The account_ids should be fixed properly, once mirgration to GaiaIds will be
done

BUG=656992
TEST=manual
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Committed: https://crrev.com/7ebd295d2ce1f07a33b4b4231c8f81963a574358
Cr-Commit-Position: refs/heads/master@{#440631}
==========

[commit-bot: I haz the power, 2016-12-23 15:49:09]

Patchset 6 (id:??) landed as
https://crrev.com/7ebd295d2ce1f07a33b4b4231c8f81963a574358
Cr-Commit-Position: refs/heads/master@{#440631}