Providing more information on why certain users can't be added to multi-profile

ash/system/user/user_view.cc

Index: ash/system/user/user_view.cc
diff --git a/ash/system/user/user_view.cc b/ash/system/user/user_view.cc
index f3646a7a7aa3ca238418c8b359c03101a1c49cd0..5fc06c48adb2da15d4386b37f3624925f4d69d10 100644
--- a/ash/system/user/user_view.cc
+++ b/ash/system/user/user_view.cc
@@ -493,8 +493,13 @@ void UserView::ToggleAddUserMenuOption() {
 
   const SessionStateDelegate* delegate =
       Shell::GetInstance()->session_state_delegate();
-  add_user_disabled_ = delegate->NumberOfLoggedInUsers() >=
-                       delegate->GetMaximumNumberOfLoggedInUsers();
+  SessionStateDelegate::PrimaryUserPolicy primary_user_policy =
+      delegate->GetPrimaryUserPolicy();
+  add_user_disabled_ =
+      (delegate->NumberOfLoggedInUsers() >=
+       delegate->GetMaximumNumberOfLoggedInUsers()) ||
+      (primary_user_policy != SessionStateDelegate::PRIMARY_USER_POLICY_ALLOW);
+
   ButtonFromView* button = new ButtonFromView(
       add_user_view,
       add_user_disabled_ ? NULL : this,
@@ -508,9 +513,19 @@ void UserView::ToggleAddUserMenuOption() {
 
   if (add_user_disabled_) {
     ui::ResourceBundle& bundle = ui::ResourceBundle::GetSharedInstance();
+    int messageId;
+    switch (primary_user_policy) {
+      case SessionStateDelegate::PRIMARY_USER_POLICY_FORBIDS:
+      case SessionStateDelegate::PRIMARY_USER_POLICY_CERT_TAINTED:
+        messageId = IDS_ASH_STATUS_TRAY_MESSAGE_NOT_ALLOWED_PRIMARY_USER;
+        break;
+      default:
+        messageId = IDS_ASH_STATUS_TRAY_MESSAGE_CANNOT_ADD_USER;
+    }
+
     popup_message_.reset(new PopupMessage(
         bundle.GetLocalizedString(IDS_ASH_STATUS_TRAY_CAPTION_CANNOT_ADD_USER),
-        bundle.GetLocalizedString(IDS_ASH_STATUS_TRAY_MESSAGE_CANNOT_ADD_USER),
+        bundle.GetLocalizedString(messageId),
         PopupMessage::ICON_WARNING,
         add_user_view->anchor(),
         views::BubbleBorder::TOP_LEFT,