CHECK() that AD user policy is only created on AD-managed devices

chrome/browser/chromeos/policy/user_policy_manager_factory_chromeos.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_policy_manager_factory_chromeos.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 167 matching lines @@
     case AccountType::UNKNOWN:
     case AccountType::GOOGLE:
       // TODO(tnagel): Return nullptr for unknown accounts once AccountId
       // migration is finished.
       if (!user->HasGaiaAccount()) {
         return {};
       }
       is_active_directory = false;
       break;
     case AccountType::ACTIVE_DIRECTORY:
-      // Ensure install attributes are locked into Active Directory mode before
-      // allowing Active Directory policy which is not signed.
-      if (!connector->GetInstallAttributes()->IsActiveDirectoryManaged()) {
-        return {};
-      }
+      // Active Directory users only exist on devices whose install attributes
+      // are locked into Active Directory mode.
+      CHECK(connector->GetInstallAttributes()->IsActiveDirectoryManaged());
       is_active_directory = true;
       break;
   }
 
   const bool is_browser_restart =
       command_line->HasSwitch(chromeos::switches::kLoginUser);
   const user_manager::UserManager* const user_manager =
       user_manager::UserManager::Get();
 
   // We want to block for policy if the session has never been initialized
@@ skipping 120 matching lines @@
 
 bool UserPolicyManagerFactoryChromeOS::HasTestingFactory(
     content::BrowserContext* context) {
   return false;
 }
 
 void UserPolicyManagerFactoryChromeOS::CreateServiceNow(
     content::BrowserContext* context) {}
 
 }  // namespace policy