Don't start device cloud policy connection after Chromad enrollment

chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 261 matching lines @@
       !device_store_->has_policy() ||
       state_keys_broker_->pending() ||
       enrollment_handler_) {
     return;
   }
   StartConnection(CreateClient(enterprise_service_));
 }
 
 void DeviceCloudPolicyInitializer::StartConnection(
     std::unique_ptr<CloudPolicyClient> client) {
-  if (!manager_->core()->service())
+  if (!manager_->core()->service() &&
+      !install_attributes_->IsActiveDirectoryManaged()) {

[emaxx, 2017/01/18 15:33:56]

I think that it would be clearer if StartConnection() won't be called for the
Active Directory case in the first place. It's easy to miss the condition when
it's checked here, or to underestimate its importance in the AD workflow.

[Thiemo Nagel, 2017/01/18 17:27:04]

Done.

     manager_->StartConnection(std::move(client), install_attributes_);
+  }
 }
 
 bool DeviceCloudPolicyInitializer::GetMachineFlag(const std::string& key,
                                                   bool default_value) const {
   bool value = default_value;
   if (!statistics_provider_->GetMachineFlag(key, &value))
     return default_value;
 
   return value;
 }
@@ skipping 33 matching lines @@
   if (success && (success = att_signed_data.ParseFromString(signed_data))) {
     em_signed_data.set_data(att_signed_data.data());
     em_signed_data.set_signature(att_signed_data.signature());
     em_signed_data.set_extra_data_bytes(att_signed_data.data().size() -
                                         data.size());
   }
   callback.Run(success, em_signed_data);
 }
 
 }  // namespace policy