OLD | NEW |
---|---|
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ |
6 #define CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ | 6 #define CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ |
7 | 7 |
8 #include <memory> | 8 #include <memory> |
9 | 9 |
10 #include "base/bind.h" | |
10 #include "base/macros.h" | 11 #include "base/macros.h" |
11 #include "base/memory/weak_ptr.h" | 12 #include "base/memory/weak_ptr.h" |
13 #include "base/time/time.h" | |
14 #include "base/timer/timer.h" | |
12 #include "components/policy/core/common/cloud/cloud_policy_store.h" | 15 #include "components/policy/core/common/cloud/cloud_policy_store.h" |
13 #include "components/policy/core/common/configuration_policy_provider.h" | 16 #include "components/policy/core/common/configuration_policy_provider.h" |
14 #include "components/policy/core/common/policy_scheduler.h" | 17 #include "components/policy/core/common/policy_scheduler.h" |
15 #include "components/signin/core/account_id/account_id.h" | 18 #include "components/signin/core/account_id/account_id.h" |
16 | 19 |
17 namespace policy { | 20 namespace policy { |
18 | 21 |
19 // ConfigurationPolicyProvider for device or user policy from Active Directory. | 22 // ConfigurationPolicyProvider for device or user policy from Active Directory. |
20 // The choice of constructor determines whether device or user policy is | 23 // The choice of constructor determines whether device or user policy is |
21 // provided. The policy is fetched from the Domain Controller by authpolicyd | 24 // provided. |
22 // which stores it in session manager and from where it is loaded by | 25 // Data flow: Triggered by DoPolicyFetch(), policy is fetched by authpolicyd and |
23 // ActiveDirectoryPolicyManager. | 26 // stored in session manager with completion indicated by OnPolicyFetched(). |
27 // From there policy load from session manager is triggered, completion of which | |
28 // is notified via OnStoreLoaded()/OnStoreError(). | |
24 class ActiveDirectoryPolicyManager : public ConfigurationPolicyProvider, | 29 class ActiveDirectoryPolicyManager : public ConfigurationPolicyProvider, |
25 public CloudPolicyStore::Observer { | 30 public CloudPolicyStore::Observer { |
26 public: | 31 public: |
27 ~ActiveDirectoryPolicyManager() override; | 32 ~ActiveDirectoryPolicyManager() override; |
28 | 33 |
29 // Create manager for device policy. | 34 // Create manager for device policy. |
30 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForDevicePolicy( | 35 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForDevicePolicy( |
31 std::unique_ptr<CloudPolicyStore> store); | 36 std::unique_ptr<CloudPolicyStore> store); |
32 | 37 |
33 // Create manager for |accound_id| user policy. | 38 // Create manager for |accound_id| user policy. |
34 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForUserPolicy( | 39 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForUserPolicy( |
35 const AccountId& account_id, | 40 const AccountId& account_id, |
41 bool wait_for_policy_fetch, | |
42 base::TimeDelta initial_policy_fetch_timeout, | |
43 base::OnceClosure exit_session, | |
36 std::unique_ptr<CloudPolicyStore> store); | 44 std::unique_ptr<CloudPolicyStore> store); |
37 | 45 |
38 // ConfigurationPolicyProvider: | 46 // ConfigurationPolicyProvider: |
39 void Init(SchemaRegistry* registry) override; | 47 void Init(SchemaRegistry* registry) override; |
40 void Shutdown() override; | 48 void Shutdown() override; |
41 bool IsInitializationComplete(PolicyDomain domain) const override; | 49 bool IsInitializationComplete(PolicyDomain domain) const override; |
42 void RefreshPolicies() override; | 50 void RefreshPolicies() override; |
43 | 51 |
44 // CloudPolicyStore::Observer: | 52 // CloudPolicyStore::Observer: |
45 void OnStoreLoaded(CloudPolicyStore* cloud_policy_store) override; | 53 void OnStoreLoaded(CloudPolicyStore* cloud_policy_store) override; |
46 void OnStoreError(CloudPolicyStore* cloud_policy_store) override; | 54 void OnStoreError(CloudPolicyStore* cloud_policy_store) override; |
47 | 55 |
48 CloudPolicyStore* store() const { return store_.get(); } | 56 CloudPolicyStore* store() const { return store_.get(); } |
49 | 57 |
58 // Helper function to force a policy fetch timeout. | |
59 void ForceTimeoutForTest(); | |
60 | |
50 private: | 61 private: |
51 // |account_id| specifies the user to manage policy for. If |account_id| is | 62 // |account_id| specifies the user to manage policy for. If |account_id| is |
52 // empty, device policy is managed. | 63 // empty, device policy is managed. If |wait_for_policy_fetch| is true, |
64 // IsInitializationComplete() is forced to false until either there has been a | |
65 // successful policy fetch from the server or |initial_policy_fetch_timeout| | |
emaxx
2017/07/14 13:56:40
nit: The description seems to be a bit inaccurate:
Thiemo Nagel
2017/07/17 09:29:35
Thanks. I've added more text, hopefully it's clear
| |
66 // has expired. (The timeout may be set to TimeDelta::Max() to block | |
67 // permanently.) | |
53 ActiveDirectoryPolicyManager(const AccountId& account_id, | 68 ActiveDirectoryPolicyManager(const AccountId& account_id, |
69 bool wait_for_policy_fetch, | |
70 base::TimeDelta initial_policy_fetch_timeout, | |
71 base::OnceClosure exit_session, | |
54 std::unique_ptr<CloudPolicyStore> store); | 72 std::unique_ptr<CloudPolicyStore> store); |
55 | 73 |
56 // Publish the policy that's currently cached in the store. | 74 // Publish the policy that's currently cached in the store. |
57 void PublishPolicy(); | 75 void PublishPolicy(); |
58 | 76 |
59 // Calls into authpolicyd to fetch policy. Reports success or failure via | 77 // Calls into authpolicyd to fetch policy. Reports success or failure via |
60 // |callback|. | 78 // |callback|. |
61 void DoFetch(PolicyScheduler::TaskCallback callback); | 79 void DoPolicyFetch(PolicyScheduler::TaskCallback callback); |
62 | 80 |
63 // Called by scheduler with result of policy fetch. | 81 // Called by scheduler with result of policy fetch. This covers policy |
82 // download, parsing and storing into session manager. (To access and publish | |
83 // the policy, the store needs to be reloaded from session manager.) | |
64 void OnPolicyFetched(bool success); | 84 void OnPolicyFetched(bool success); |
65 | 85 |
86 // Called when |initial_policy_timeout_| times out, to cancel the blocking | |
87 // wait for the initial policy fetch. | |
88 void OnBlockingFetchTimeout(); | |
89 | |
90 // Cancels waiting for the initial policy fetch/load and flags the | |
emaxx
2017/07/14 13:56:40
nit: Worth explaning that it doesn't do this uncon
Thiemo Nagel
2017/07/17 09:29:35
Good point. Done.
| |
91 // ConfigurationPolicyProvider ready (assuming all other initialization tasks | |
92 // have completed). |success| denotes whether the policy fetch was successful. | |
93 void CancelWaitForInitialPolicy(bool success); | |
94 | |
66 const AccountId account_id_; | 95 const AccountId account_id_; |
96 | |
97 // Whether we're waiting for a policy fetch to complete before reporting | |
98 // IsInitializationComplete(). | |
99 bool waiting_for_initial_policy_fetch_; | |
100 | |
101 // Whether the user session is continued in case of failure of initial policy | |
102 // fetch. | |
103 bool initial_policy_fetch_may_fail_; | |
104 | |
105 // Whether policy fetch has ever been reported as completed by authpolicyd. | |
106 bool fetch_ever_completed_ = false; | |
107 | |
108 // Whether policy fetch has ever been reported as successful by authpolicyd. | |
109 bool fetch_ever_succeeded_ = false; | |
110 | |
111 // A timer that puts a hard limit on the maximum time to wait for the initial | |
112 // policy fetch/load. | |
113 base::Timer initial_policy_timeout_{false /* retain_user_task */, | |
114 false /* is_repeating */}; | |
115 | |
116 // Callback to exit the session. | |
117 base::OnceClosure exit_session_; | |
118 | |
67 std::unique_ptr<CloudPolicyStore> store_; | 119 std::unique_ptr<CloudPolicyStore> store_; |
68 | |
69 std::unique_ptr<PolicyScheduler> scheduler_; | 120 std::unique_ptr<PolicyScheduler> scheduler_; |
70 | 121 |
71 // Must be last member. | 122 // Must be last member. |
72 base::WeakPtrFactory<ActiveDirectoryPolicyManager> weak_ptr_factory_{this}; | 123 base::WeakPtrFactory<ActiveDirectoryPolicyManager> weak_ptr_factory_{this}; |
73 | 124 |
74 DISALLOW_COPY_AND_ASSIGN(ActiveDirectoryPolicyManager); | 125 DISALLOW_COPY_AND_ASSIGN(ActiveDirectoryPolicyManager); |
75 }; | 126 }; |
76 | 127 |
77 } // namespace policy | 128 } // namespace policy |
78 | 129 |
79 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ | 130 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ |
OLD | NEW |