OLD | NEW |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ |
6 #define CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ | 6 #define CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ |
7 | 7 |
8 #include <memory> | 8 #include <memory> |
9 | 9 |
| 10 #include "base/bind.h" |
10 #include "base/macros.h" | 11 #include "base/macros.h" |
11 #include "base/memory/weak_ptr.h" | 12 #include "base/memory/weak_ptr.h" |
| 13 #include "base/time/time.h" |
| 14 #include "base/timer/timer.h" |
12 #include "components/policy/core/common/cloud/cloud_policy_store.h" | 15 #include "components/policy/core/common/cloud/cloud_policy_store.h" |
13 #include "components/policy/core/common/configuration_policy_provider.h" | 16 #include "components/policy/core/common/configuration_policy_provider.h" |
14 #include "components/policy/core/common/policy_scheduler.h" | 17 #include "components/policy/core/common/policy_scheduler.h" |
15 #include "components/signin/core/account_id/account_id.h" | 18 #include "components/signin/core/account_id/account_id.h" |
16 | 19 |
17 namespace policy { | 20 namespace policy { |
18 | 21 |
19 // ConfigurationPolicyProvider for device or user policy from Active Directory. | 22 // ConfigurationPolicyProvider for device or user policy from Active Directory. |
20 // The choice of constructor determines whether device or user policy is | 23 // The choice of constructor determines whether device or user policy is |
21 // provided. The policy is fetched from the Domain Controller by authpolicyd | 24 // provided. |
22 // which stores it in session manager and from where it is loaded by | 25 // Data flow: Triggered by DoPolicyFetch(), policy is fetched by authpolicyd and |
23 // ActiveDirectoryPolicyManager. | 26 // stored in session manager with completion indicated by OnPolicyFetched(). |
| 27 // From there policy load from session manager is triggered, completion of which |
| 28 // is notified via OnStoreLoaded()/OnStoreError(). |
24 class ActiveDirectoryPolicyManager : public ConfigurationPolicyProvider, | 29 class ActiveDirectoryPolicyManager : public ConfigurationPolicyProvider, |
25 public CloudPolicyStore::Observer { | 30 public CloudPolicyStore::Observer { |
26 public: | 31 public: |
27 ~ActiveDirectoryPolicyManager() override; | 32 ~ActiveDirectoryPolicyManager() override; |
28 | 33 |
29 // Create manager for device policy. | 34 // Create manager for device policy. |
30 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForDevicePolicy( | 35 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForDevicePolicy( |
31 std::unique_ptr<CloudPolicyStore> store); | 36 std::unique_ptr<CloudPolicyStore> store); |
32 | 37 |
33 // Create manager for |accound_id| user policy. | 38 // Create manager for |accound_id| user policy. |
34 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForUserPolicy( | 39 static std::unique_ptr<ActiveDirectoryPolicyManager> CreateForUserPolicy( |
35 const AccountId& account_id, | 40 const AccountId& account_id, |
| 41 bool wait_for_policy_fetch, |
| 42 base::TimeDelta initial_policy_fetch_timeout, |
| 43 base::OnceClosure exit_session, |
36 std::unique_ptr<CloudPolicyStore> store); | 44 std::unique_ptr<CloudPolicyStore> store); |
37 | 45 |
38 // ConfigurationPolicyProvider: | 46 // ConfigurationPolicyProvider: |
39 void Init(SchemaRegistry* registry) override; | 47 void Init(SchemaRegistry* registry) override; |
40 void Shutdown() override; | 48 void Shutdown() override; |
41 bool IsInitializationComplete(PolicyDomain domain) const override; | 49 bool IsInitializationComplete(PolicyDomain domain) const override; |
42 void RefreshPolicies() override; | 50 void RefreshPolicies() override; |
43 | 51 |
44 // CloudPolicyStore::Observer: | 52 // CloudPolicyStore::Observer: |
45 void OnStoreLoaded(CloudPolicyStore* cloud_policy_store) override; | 53 void OnStoreLoaded(CloudPolicyStore* cloud_policy_store) override; |
46 void OnStoreError(CloudPolicyStore* cloud_policy_store) override; | 54 void OnStoreError(CloudPolicyStore* cloud_policy_store) override; |
47 | 55 |
48 CloudPolicyStore* store() const { return store_.get(); } | 56 CloudPolicyStore* store() const { return store_.get(); } |
49 | 57 |
| 58 // Helper function to force a policy fetch timeout. |
| 59 void ForceTimeoutForTest(); |
| 60 |
50 private: | 61 private: |
51 // |account_id| specifies the user to manage policy for. If |account_id| is | 62 // |account_id| specifies the user to manage policy for. If |account_id| is |
52 // empty, device policy is managed. | 63 // empty, device policy is managed. |
| 64 // |
| 65 // The following applies to user policy only: If |wait_for_policy_fetch| is |
| 66 // true, IsInitializationComplete() is forced to false until either there has |
| 67 // been a successful policy fetch from the server and a subsequent successful |
| 68 // load from session manager or |initial_policy_fetch_timeout| has expired and |
| 69 // there has been a successful load from session manager. The timeout may be |
| 70 // set to TimeDelta::Max() to enforce successful policy fetch. In case the |
| 71 // conditions for signaling initialization complete are not met, the user |
| 72 // session is aborted by calling |exit_session|. |
53 ActiveDirectoryPolicyManager(const AccountId& account_id, | 73 ActiveDirectoryPolicyManager(const AccountId& account_id, |
| 74 bool wait_for_policy_fetch, |
| 75 base::TimeDelta initial_policy_fetch_timeout, |
| 76 base::OnceClosure exit_session, |
54 std::unique_ptr<CloudPolicyStore> store); | 77 std::unique_ptr<CloudPolicyStore> store); |
55 | 78 |
56 // Publish the policy that's currently cached in the store. | 79 // Publish the policy that's currently cached in the store. |
57 void PublishPolicy(); | 80 void PublishPolicy(); |
58 | 81 |
59 // Calls into authpolicyd to fetch policy. Reports success or failure via | 82 // Calls into authpolicyd to fetch policy. Reports success or failure via |
60 // |callback|. | 83 // |callback|. |
61 void DoFetch(PolicyScheduler::TaskCallback callback); | 84 void DoPolicyFetch(PolicyScheduler::TaskCallback callback); |
62 | 85 |
63 // Called by scheduler with result of policy fetch. | 86 // Called by scheduler with result of policy fetch. This covers policy |
| 87 // download, parsing and storing into session manager. (To access and publish |
| 88 // the policy, the store needs to be reloaded from session manager.) |
64 void OnPolicyFetched(bool success); | 89 void OnPolicyFetched(bool success); |
65 | 90 |
| 91 // Called when |initial_policy_timeout_| times out, to cancel the blocking |
| 92 // wait for the initial policy fetch. |
| 93 void OnBlockingFetchTimeout(); |
| 94 |
| 95 // Cancels waiting for the initial policy fetch/load and flags the |
| 96 // ConfigurationPolicyProvider ready (assuming all other initialization tasks |
| 97 // have completed) or exits the session in case the requirements to continue |
| 98 // have not been met. |success| denotes whether the policy fetch was |
| 99 // successful. |
| 100 void CancelWaitForInitialPolicy(bool success); |
| 101 |
66 const AccountId account_id_; | 102 const AccountId account_id_; |
| 103 |
| 104 // Whether we're waiting for a policy fetch to complete before reporting |
| 105 // IsInitializationComplete(). |
| 106 bool waiting_for_initial_policy_fetch_; |
| 107 |
| 108 // Whether the user session is continued in case of failure of initial policy |
| 109 // fetch. |
| 110 bool initial_policy_fetch_may_fail_; |
| 111 |
| 112 // Whether policy fetch has ever been reported as completed by authpolicyd. |
| 113 bool fetch_ever_completed_ = false; |
| 114 |
| 115 // Whether policy fetch has ever been reported as successful by authpolicyd. |
| 116 bool fetch_ever_succeeded_ = false; |
| 117 |
| 118 // A timer that puts a hard limit on the maximum time to wait for the initial |
| 119 // policy fetch/load. |
| 120 base::Timer initial_policy_timeout_{false /* retain_user_task */, |
| 121 false /* is_repeating */}; |
| 122 |
| 123 // Callback to exit the session. |
| 124 base::OnceClosure exit_session_; |
| 125 |
67 std::unique_ptr<CloudPolicyStore> store_; | 126 std::unique_ptr<CloudPolicyStore> store_; |
68 | |
69 std::unique_ptr<PolicyScheduler> scheduler_; | 127 std::unique_ptr<PolicyScheduler> scheduler_; |
70 | 128 |
71 // Must be last member. | 129 // Must be last member. |
72 base::WeakPtrFactory<ActiveDirectoryPolicyManager> weak_ptr_factory_{this}; | 130 base::WeakPtrFactory<ActiveDirectoryPolicyManager> weak_ptr_factory_{this}; |
73 | 131 |
74 DISALLOW_COPY_AND_ASSIGN(ActiveDirectoryPolicyManager); | 132 DISALLOW_COPY_AND_ASSIGN(ActiveDirectoryPolicyManager); |
75 }; | 133 }; |
76 | 134 |
77 } // namespace policy | 135 } // namespace policy |
78 | 136 |
79 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ | 137 #endif // CHROME_BROWSER_CHROMEOS_POLICY_ACTIVE_DIRECTORY_POLICY_MANAGER_H_ |
OLD | NEW |