Wire up component cloud policy to device local accounts.

chrome/browser/policy/test/policy_testserver.py

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """A bare-bones test server for testing cloud policy support.
 
 This implements a simple cloud policy test server that can be used to test
 chrome's device management service client. The policy information is read from
 the file named device_management in the server's data directory. It contains
 enforced and recommended policies for the device and user scope, and a list
@@ skipping 425 matching lines @@
     """
     token_info, error = self.CheckToken()
     if not token_info:
       return error
 
     key_update_request = msg.device_state_key_update_request
     if len(key_update_request.server_backed_state_key) > 0:
       self.server.UpdateStateKeys(token_info['device_token'],
                                   key_update_request.server_backed_state_key)
 
+    # If this is a publicaccount request then get the username now and use it

[bartfab (slow), 2014/06/20 09:17:25]

Nit 1: s/publicaccount/|publicaccount|/
Nit 2: s/username/|username|/

[Joao da Silva, 2014/06/20 11:48:46]

Done.

+    # in every PolicyFetchResponse produced. This is required to validate
+    # policy for extensions in public accounts.

[bartfab (slow), 2014/06/20 09:17:25]

1: Nit: s/accounts/sessions/
2: Do we use the |publicaccount| type for single-app kiosk mode as well? If so,
the comment should say "device-local accounts" instead of "public sessions."

[Joao da Silva, 2014/06/20 11:48:46]

Done.

+    username = self.server.GetPolicies().get('policy_user', None)

[bartfab (slow), 2014/06/20 09:17:25]

1: Why is this needed? The code is prepared to handle |username == None|.
2: In ProcessCloudPolicy(), there is a comment that explains why the |username|
is read from global configuration. Here, it is done without any further comment.

[Joao da Silva, 2014/06/20 11:48:46]

Done.

+    for request in msg.policy_request.request:
+      if request.policy_type == 'google/chromeos/publicaccount':
+        username = request.settings_entity_id

[bartfab (slow), 2014/06/20 09:17:25]

What happens if we get requests for multiple public sessions together?

[Joao da Silva, 2014/06/20 11:48:46]

Then this doesn't work :-) The current client implementation has one separate
broker for each account, so there is one request to the server per account and
this works.

+
     response = dm.DeviceManagementResponse()
     for request in msg.policy_request.request:
       if (request.policy_type in
              ('google/android/user',
               'google/chromeos/device',
               'google/chromeos/publicaccount',
               'google/chromeos/user',
               'google/chrome/user',
               'google/ios/user')):
         fetch_response = response.policy_response.response.add()
         self.ProcessCloudPolicy(request, token_info, fetch_response)
       elif request.policy_type == 'google/chrome/extension':
         self.ProcessCloudPolicyForExtensions(
-            request, response.policy_response, token_info)
+            request, response.policy_response, token_info, username)
       else:
         fetch_response.error_code = 400
         fetch_response.error_message = 'Invalid policy_type'
 
     return (200, response)
 
   def ProcessAutoEnrollment(self, msg):
     """Handles an auto-enrollment check request.
 
     The reply depends on the value of the modulus:
@@ skipping 151 matching lines @@
       else:
         continue
 
       # Create protobuf message for this policy.
       policy_message = eval('cp.' + field.message_type.name + '()')
       policy_message.policy_options.mode = mode
       field_descriptor = policy_message.DESCRIPTOR.fields_by_name['value']
       self.SetProtobufMessageField(policy_message, field_descriptor, value)
       settings.__getattribute__(field.name).CopyFrom(policy_message)
 
-  def ProcessCloudPolicyForExtensions(self, request, response, token_info):
+  def ProcessCloudPolicyForExtensions(self, request, response, token_info,
+                                      username):
     """Handles a request for policy for extensions.
 
     A request for policy for extensions is slightly different from the other
     cloud policy requests, because it can trigger 0, one or many
     PolicyFetchResponse messages in the response.
 
     Args:
       request: The PolicyFetchRequest that triggered this handler.
       response: The DevicePolicyResponse message for the response. Multiple
       PolicyFetchResponses will be appended to this message.
       token_info: The token extracted from the request.
+      username: The username for the response.

[bartfab (slow), 2014/06/20 09:17:25]

Nit: Add "May be None."

[Joao da Silva, 2014/06/20 11:48:46]

Done.

     """
     # Send one PolicyFetchResponse for each extension that has
     # configuration data at the server.
     ids = self.server.ListMatchingComponents('google/chrome/extension')
     for settings_entity_id in ids:
       # Reuse the extension policy request, to trigger the same signature
       # type in the response.
       request.settings_entity_id = settings_entity_id
       fetch_response = response.response.add()
-      self.ProcessCloudPolicy(request, token_info, fetch_response)
+      self.ProcessCloudPolicy(request, token_info, fetch_response, username)
       # Don't do key rotations for these messages.
       fetch_response.ClearField('new_public_key')
       fetch_response.ClearField('new_public_key_signature')
       fetch_response.ClearField('new_public_key_verification_signature')
 
-  def ProcessCloudPolicy(self, msg, token_info, response):
+  def ProcessCloudPolicy(self, msg, token_info, response, username=None):
     """Handles a cloud policy request. (New protocol for policy requests.)
 
     Encodes the policy into protobuf representation, signs it and constructs
     the response.
 
     Args:
       msg: The CloudPolicyRequest message received from the client.
       token_info: The token extracted from the request.
       response: A PolicyFetchResponse message that should be filled with the
                 response data.
+      username: The username for the response. May be None.
     """
 
     if msg.machine_id:
       self.server.UpdateMachineId(token_info['device_token'], msg.machine_id)
 
     # Response is only given if the scope is specified in the config file.
     # Normally 'google/chromeos/device', 'google/chromeos/user' and
     # 'google/chromeos/publicaccount' should be accepted.
     policy = self.server.GetPolicies()
     policy_value = ''
@@ skipping 60 matching lines @@
     if invalidation_source is not None:
       policy_data.invalidation_source = invalidation_source
     # Since invalidation_name is type bytes in the proto, the Unicode name
     # provided needs to be encoded as ASCII to set the correct byte pattern.
     invalidation_name = policy.get('invalidation_name')
     if invalidation_name is not None:
       policy_data.invalidation_name = invalidation_name.encode('ascii')
 
     if signing_key:
       policy_data.public_key_version = current_key_index + 1
-    if msg.policy_type == 'google/chromeos/publicaccount':
+
+    if username:
+      policy_data.username = username

[bartfab (slow), 2014/06/20 09:17:25]

Why can we not extract the username from |msg| here as we normally do for public
sessions?

[Joao da Silva, 2014/06/20 11:48:46]

Because the |msg| here is one of the repeated PolicyFetchRequests and doesn't
necessarily have the username. If this is a request for policy-for-extensions
then it doesn't have the username, for example. That's why it's extracted from
the sibling PolicyFetchRequest (for publicaccounts policy) and then passed in
here.

+    elif msg.policy_type == 'google/chromeos/publicaccount':
       policy_data.username = msg.settings_entity_id
     else:
       # For regular user/device policy, there is no way for the testserver to
       # know the user name belonging to the GAIA auth token we received (short
       # of actually talking to GAIA). To address this, we read the username from
       # the policy configuration dictionary, or use a default.
       policy_data.username = policy.get('policy_user', 'user@example.com')
     policy_data.device_id = token_info['device_id']
     signed_data = policy_data.SerializeToString()
 
@@ skipping 193 matching lines @@
       dm.DeviceRegisterRequest.BROWSER: [
           'google/chrome/user',
           'google/chrome/extension'
       ],
       dm.DeviceRegisterRequest.USER: [
           'google/chromeos/user',
           'google/chrome/extension'
       ],
       dm.DeviceRegisterRequest.DEVICE: [
           'google/chromeos/device',
-          'google/chromeos/publicaccount'
+          'google/chromeos/publicaccount',
+          'google/chrome/extension'
       ],
       dm.DeviceRegisterRequest.ANDROID_BROWSER: [
           'google/android/user'
       ],
       dm.DeviceRegisterRequest.IOS_BROWSER: [
           'google/ios/user'
       ],
       dm.DeviceRegisterRequest.TT: ['google/chromeos/user',
                                     'google/chrome/user'],
     }
@@ skipping 251 matching lines @@
     if (self.options.log_to_console):
       logger.addHandler(logging.StreamHandler())
     if (self.options.log_file):
       logger.addHandler(logging.FileHandler(self.options.log_file))
 
     testserver_base.TestServerRunner.run_server(self)
 
 
 if __name__ == '__main__':
   sys.exit(PolicyServerRunner().main())