Enable client certificate patterns in device ONC policy

chrome/browser/chromeos/enrollment_dialog_view.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/enrollment_dialog_view.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 252 matching lines @@
   const NetworkState* network =
       NetworkHandler::Get()->network_state_handler()->GetNetworkStateFromGuid(
           network_id);
   if (!network) {
     NET_LOG_ERROR("Enrolling Unknown network", network_id);
     return false;
   }
   Browser* browser = chrome::FindBrowserWithWindow(owning_window);
   Profile* profile =
       browser ? browser->profile() : ProfileManager::GetPrimaryUserProfile();
+  if (chromeos::ProfileHelper::IsSigninProfile(profile)) {
+    NET_LOG_EVENT("Skipping enrollment on sign-in profile", network_id);

[emaxx, 2017/04/20 20:10:39]

Is this log message really helpful?

[pmarko, 2017/04/24 14:49:55]

Done.
(No, removed :-) )

+    return false;
+  }
   std::string username_hash = ProfileHelper::GetUserIdHashFromProfile(profile);
 
   onc::ONCSource onc_source = onc::ONC_SOURCE_NONE;
   const base::DictionaryValue* policy =
       NetworkHandler::Get()
           ->managed_network_configuration_handler()
           ->FindPolicyByGUID(username_hash, network_id, &onc_source);
 
-  // We skip certificate patterns for device policy ONC so that an unmanaged
-  // user can't get to the place where a cert is presented for them
-  // involuntarily.
-  if (!policy || onc_source == onc::ONC_SOURCE_DEVICE_POLICY)

[emaxx, 2017/04/20 20:10:39]

We should also check whether the enrollment dialog should be suppressed in some
use cases, like kiosks - don't know whether this dialog would make sense for
them (need to check the product side and the technical side effects, like not
having ability to access browser in kiosks).

[emaxx, 2017/04/20 20:10:39]

Shouldn't the "!policy" exit route be preserved?
The policy pointer is even dereferenced in the next couple of lines.

[pmarko, 2017/04/24 14:49:55]

Whoops. Done.

-    return false;
-
   client_cert::ClientCertConfig cert_config;
-  OncToClientCertConfig(*policy, &cert_config);
+  OncToClientCertConfig(onc_source, *policy, &cert_config);
 
   if (cert_config.client_cert_type != onc::client_cert::kPattern)
     return false;
 
   if (cert_config.pattern.Empty())
     NET_LOG_ERROR("Certificate pattern is empty", network_id);
 
   if (cert_config.pattern.enrollment_uri_list().empty()) {
     NET_LOG_EVENT("No enrollment URIs", network_id);
     return false;
   }
 
   NET_LOG_USER("Enrolling", network_id);
 
   DialogEnrollmentDelegate* enrollment =
       new DialogEnrollmentDelegate(owning_window, network->name(), profile);
   return enrollment->Enroll(cert_config.pattern.enrollment_uri_list(),
                             base::Bind(&EnrollmentComplete, network_id));
 }
 
 }  // namespace enrollment
 
 }  // namespace chromeos