Chromad: Add authentication flow

chromeos/dbus/auth_policy_client.h

Index: chromeos/dbus/auth_policy_client.h
diff --git a/chromeos/dbus/auth_policy_client.h b/chromeos/dbus/auth_policy_client.h
index 1947b4a5d1d67a945d1abc0b374c8dd2c5b6df84..2ebc05c5ca995654b7fbd3967782d6f0068e6894 100644
--- a/chromeos/dbus/auth_policy_client.h
+++ b/chromeos/dbus/auth_policy_client.h
@@ -10,6 +10,7 @@
 #include "base/callback.h"
 #include "chromeos/chromeos_export.h"
 #include "chromeos/dbus/dbus_client.h"
+#include "third_party/cros_system_api/dbus/service_constants.h"
 
 // TODO(rsorokin): Switch to service constants when it's landed.
 // (see crbug.com/659732)
@@ -30,6 +31,10 @@ namespace chromeos {
 // initializes the DBusThreadManager instance.
 class CHROMEOS_EXPORT AuthPolicyClient : public DBusClient {
  public:
+  // |user_id| is a unique id for the users. Using objectGUID from Active
+  // Directory server.
+  using AuthCallback = base::Callback<void(authpolicy::AuthUserErrorType error,
+                                           const std::string& user_id)>;
   using JoinCallback = base::Callback<void(int error_code)>;
   using RefreshPolicyCallback = base::Callback<void(bool success)>;
 
@@ -41,16 +46,24 @@ class CHROMEOS_EXPORT AuthPolicyClient : public DBusClient {
 
   // Calls JoinADDomain. It runs "net ads join ..." which joins machine to
   // Active directory domain.
-  // |machine_name| is a name for a local machine. |user|,
+  // |machine_name| is a name for a local machine. |user_principal_name|,
   // |password_fd| are credentials of the Active directory account which has
   // right to join the machine to the domain. |password_fd| is a file descriptor
   // password is read from. The caller should close it after the call.
-  // |callback| is called after the method call succeeds.
+  // |callback| is called after getting (or failing to get) D-BUS response.
   virtual void JoinAdDomain(const std::string& machine_name,
-                            const std::string& user,
+                            const std::string& user_principal_name,
                             int password_fd,
                             const JoinCallback& callback) = 0;
 
+  // Calls AuthenticateUser. It runs "kinit <user_principal_name> .. " which
+  // does kerberos authentication against Active Directory server.
+  // |password_fd| is similar to the one in the JoinAdDomain.
+  // |callback| is called after getting (or failing to get) D-BUS response.
+  virtual void AuthenticateUser(const std::string& user_principal_name,
+                                int password_fd,
+                                const AuthCallback& callback) = 0;
+
   // Calls RefreshDevicePolicy - handle policy for the device.
   // Fetch GPO files from Active directory server, parse it, encode it into
   // protobuf and send to SessionManager. Callback is called after that.