Don't reject server and CA certs during device ONC validation

chromeos/network/onc/onc_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/onc/onc_validator.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 955 matching lines @@
 
   const char* const kValidTypes[] = {kClient, kServer, kAuthority};
   const std::vector<const char*> valid_types(toVector(kValidTypes));
   if (FieldExistsAndHasNoValidValue(*result, kType, valid_types) ||
       FieldExistsAndIsEmpty(*result, kGUID)) {
     return false;
   }
 
   std::string type;
   result->GetStringWithoutPathExpansion(kType, &type);
-  if (onc_source_ == ::onc::ONC_SOURCE_DEVICE_POLICY &&
-      (type == kServer || type == kAuthority)) {
-    error_or_warning_found_ = true;
-    LOG(ERROR) << MessageHeader() << "Server and authority certificates are "
-               << "prohibited in ONC device policies.";
-    return false;
-  }
 
   if (!CheckGuidIsUniqueAndAddToSet(*result, kGUID, &certificate_guids_))
     return false;
 
   bool all_required_exist = RequireField(*result, kGUID);
 
   bool remove = false;
   result->GetBooleanWithoutPathExpansion(::onc::kRemove, &remove);
   if (remove) {
     error_or_warning_found_ = true;
@@ skipping 50 matching lines @@
 }
 
 std::string Validator::MessageHeader() {
   std::string path = path_.empty() ? "toplevel" : base::JoinString(path_, ".");
   std::string message = "At " + path + ": ";
   return message;
 }
 
 }  // namespace onc
 }  // namespace chromeos