Enable policy-imported root CA certificates for kiosk and AD sessions

chrome/browser/chromeos/policy/user_network_configuration_updater_factory.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_network_configuration_updater_factory.h"
 
 #include "base/memory/singleton.h"
 #include "chrome/browser/chromeos/policy/user_network_configuration_updater.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/policy/profile_policy_connector.h"
@@ skipping 54 matching lines @@
     return NULL;  // On the login screen only device network policies apply.
 
   const user_manager::User* user =
       chromeos::ProfileHelper::Get()->GetUserByProfile(profile);
   DCHECK(user);
   // Currently, only the network policy of the primary user is supported. See
   // also http://crbug.com/310685 .
   if (user != user_manager::UserManager::Get()->GetPrimaryUser())
     return NULL;
 
-  const bool allow_trusted_certs_from_policy = user->HasGaiaAccount();
-
   ProfilePolicyConnector* profile_connector =
       ProfilePolicyConnectorFactory::GetForBrowserContext(context);
 
   return UserNetworkConfigurationUpdater::CreateForUserPolicy(
-      profile,
-      allow_trusted_certs_from_policy,
-      *user,
-      profile_connector->policy_service(),
-      chromeos::NetworkHandler::Get()->managed_network_configuration_handler())
+             profile, AllowTrustedCertsFromPolicy(user), *user,
+             profile_connector->policy_service(),
+             chromeos::NetworkHandler::Get()
+                 ->managed_network_configuration_handler())
       .release();
 }
 
+// static
+bool UserNetworkConfigurationUpdaterFactory::AllowTrustedCertsFromPolicy(
+    const user_manager::User* user) {
+  user_manager::UserType user_type = user->GetType();
+
+  // Disallow trusted root certs for public sessions.
+  // Also, guest sessions don't get user policy, but a
+  // UserNetworkCofnigurationUpdater can be created for them anyway.
+  return user_type != user_manager::USER_TYPE_GUEST &&
+         user_type != user_manager::USER_TYPE_PUBLIC_ACCOUNT;
+}
+
 }  // namespace policy