Make the policy fetch for first time login blocking

chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc

Index: chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc
diff --git a/chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc b/chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc
index 48091bdd93e4b5d9ad95797213f5aee74b2e0914..7003bc3dc2caaf9a1f30ec5c884defa3b1877bb9 100644
--- a/chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc
+++ b/chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.cc
@@ -138,14 +138,20 @@ scoped_ptr<UserCloudPolicyManagerChromeOS>
       BrowserPolicyConnector::IsNonEnterpriseUser(username)) {
     return scoped_ptr<UserCloudPolicyManagerChromeOS>();
   }
+  // If the user is known to be a non enterprise user, we don't reach this code.
+  DCHECK(!BrowserPolicyConnector::IsNonEnterpriseUser(username));

[bartfab (slow), 2014/07/07 17:40:13]

Nit: #include "components/policy/core/browser/browser_policy_connector.h"

 
   policy::BrowserPolicyConnectorChromeOS* connector =
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
   UserAffiliation affiliation = connector->GetUserAffiliation(username);
-  const bool is_managed_user = affiliation == USER_AFFILIATION_MANAGED;
   const bool is_browser_restart =
       command_line->HasSwitch(chromeos::switches::kLoginUser);
-  const bool wait_for_initial_policy = is_managed_user && !is_browser_restart;
+  const bool wait_for_initial_policy = !is_browser_restart;

[bartfab (slow), 2014/07/07 17:40:13]

This changes the logic more than you intended - it makes the policy fetch
blocking even for subsequent logins of non-affiliated users.

+
+  base::TimeDelta initial_policy_fetch_timeout =

[bartfab (slow), 2014/07/07 17:40:13]

Nit 1: const.
Nit 2: s/initial_policy_fetch_timeout/policy_fetch_timeout/

+      chromeos::UserManager::Get()->IsCurrentUserNew()

[bartfab (slow), 2014/07/07 17:40:13]

1: Nit: #include "chrome/browser/chromeos/login/users/user_manager.h"
2: The resulting code would still allow an enterprise user to evade policy:

* Enterprise user starts first login.
* After authenticating against GAIA, user immediately yanks the network cable.
* User reboots device.
* User logs in as existing user.

At this point, the |kInitialPolicyFetchTimeoutSeconds| timeout is in force and
the user can skip the policy fetch by keeping the network cable disconnected
until the timeout hits.

+          ? base::TimeDelta::Max()
+          : base::TimeDelta::FromSeconds(kInitialPolicyFetchTimeoutSeconds);
 
   DeviceManagementService* device_management_service =
       connector->device_management_service();
@@ -195,7 +201,7 @@ scoped_ptr<UserCloudPolicyManagerChromeOS>
           external_data_manager.Pass(),
           component_policy_cache_dir,
           wait_for_initial_policy,
-          base::TimeDelta::FromSeconds(kInitialPolicyFetchTimeoutSeconds),
+          initial_policy_fetch_timeout,
           base::MessageLoopProxy::current(),
           file_task_runner,
           io_task_runner));