cros: Ensure quick unlock is disabled by default for enterprise policy.

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 9249 matching lines @@
               ],
             },
             'id': 'QuickUnlockModeWhitelist',
           },
           'supported_on': ['chrome_os:56-'],
           'features': {
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': ['PIN'],
+          'default_for_enterprise_users': [],

[sammiequon, 2017/01/12 20:01:20]

Should this be a boolean value?

[jdufault, 2017/01/12 20:38:47]

Example value is a list? It looks like the C++ code which handles it also
assumes it is a list[1].

1:
https://cs.chromium.org/chromium/src/chrome/browser/chromeos/login/quick_unlo...

[sammiequon, 2017/01/12 20:42:29]

Ah, that's how it works, I just saw all the other instances in this file had a
boolean.

[pastarmovj, 2017/01/23 23:38:12]

Just making sure you understand the implications of this line is that the user
will not be able to enable any of the quick unlock modes if the device is
enrolled. It's not just the initial state but the only state. If this is what
you want you are good. :)

[jdufault, 2017/01/25 01:32:43]

Here's the desired behavior: the user is enterprise enrolled, admin console has
not been updated/no prefs have been pulled. All quick unlock modes are disabled.

For enterprise users, quick unlock needs to be explicitly enabled by the admin.

[pastarmovj, 2017/01/25 15:28:05]

Acknowledged.

           'id': 352,
           'caption': '''Configure allowed quick unlock modes.''',
           'tags': [],
           'desc': '''Controls which quick unlock modes are allowed to be set up and used.
           This setting white-lists the allowed quick unlock modes that can be set up and used to unlock the lock screen. The value is a list of strings, each of which should be one of the following: "all", "PIN". If "all" is selected, then all supported quick modes will be available, otherwise the modes in the list will be the ones available.
 
           If this setting is configured, quick unlock modes which have a type that is not on this list can not be set up or used.
 
           If this setting is left not configured, "PIN" mode will be enabled, and all other modes will be disabled.''',
         },
@@ skipping 258 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }