cros: Terminate if merge session fails for online sign-in

chrome/browser/chromeos/login/session/user_session_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
 
 #include <stddef.h>
 
 #include <set>
 #include <string>
@@ skipping 849 matching lines @@
   // error. http://crbug.com/295245
   if (!connection_error) {
     // We are in one of "done" states here.
     user_manager::UserManager::Get()->SaveUserOAuthStatus(
         user_manager::UserManager::Get()->GetActiveUser()->GetAccountId(),
         user_status);
   }
 
   login_manager->RemoveObserver(this);
 
+  const bool is_online_signin =

[achuithb, 2017/05/25 19:44:17]

I think a comment explaining that this is necessary to prevent a policy exploit
and a link to the bug might me useful?

[xiyuan, 2017/05/25 20:24:09]

Done.

+      user_context_.GetAuthFlow() == UserContext::AUTH_FLOW_GAIA_WITH_SAML ||
+      user_context_.GetAuthFlow() == UserContext::AUTH_FLOW_GAIA_WITHOUT_SAML;
+  if (is_online_signin && state == OAuth2LoginManager::SESSION_RESTORE_FAILED) {
+    LOG(ERROR)
+        << "Session restore failed for online sign-in, terminating session.";
+    chrome::AttemptUserExit();
+    return;
+  }
+
   if (exit_after_session_restore_ &&
       (state  == OAuth2LoginManager::SESSION_RESTORE_DONE ||
        state  == OAuth2LoginManager::SESSION_RESTORE_FAILED ||
        state  == OAuth2LoginManager::SESSION_RESTORE_CONNECTION_FAILED)) {
     LOG(WARNING) << "Restarting Chrome after session restore finishes, "
                  << "most likely due to custom flags.";
 
     // We need to restart cleanly in this case to make sure OAuth2 RT is
     // actually saved.
     chrome::AttemptRestart();
@@ skipping 1064 matching lines @@
           ->browser_policy_connector_chromeos()
           ->IsEnterpriseManaged()) {
     return false;
   }
 
   // Do not show end of life notification if this is a guest session
   return !profile->IsGuestSession();
 }
 
 }  // namespace chromeos