Support for remote enrollment.

chrome/browser/chromeos/login/enrollment/enrollment_screen.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/enrollment/enrollment_screen.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/login/login_utils.h"
 #include "chrome/browser/chromeos/login/screens/screen_observer.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
 #include "chrome/browser/chromeos/login/wizard_controller.h"
 #include "chrome/browser/chromeos/policy/auto_enrollment_client.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_method_call_status.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/session_manager_client.h"
 #include "components/policy/core/common/cloud/enterprise_metrics.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "google_apis/gaia/google_service_auth_error.h"
 
 namespace chromeos {
 
@@ skipping 20 matching lines @@
   // have not done that yet).
   DBusThreadManager::Get()->GetCryptohomeClient()->TpmCanAttemptOwnership(
       EmptyVoidDBusMethodCallback());
 }
 
 EnrollmentScreen::~EnrollmentScreen() {}
 
 void EnrollmentScreen::SetParameters(
     EnrollmentScreenActor::EnrollmentMode enrollment_mode,
     const std::string& management_domain,
-    const std::string& user) {
+    const std::string& user,
+    const std::string& auth_token) {
   enrollment_mode_ = enrollment_mode;
   user_ = user.empty() ? user : gaia::CanonicalizeEmail(user);
+  auth_token_ = auth_token;
   actor_->SetParameters(this, enrollment_mode_, management_domain);
 }
 
 void EnrollmentScreen::PrepareToShow() {
   actor_->PrepareToShow();
 }
 
 void EnrollmentScreen::Show() {
   if (is_auto_enrollment() && !enrollment_failed_once_) {
     actor_->Show();
     UMA(policy::kMetricEnrollmentAutoStarted);
     actor_->ShowEnrollmentSpinnerScreen();
     actor_->FetchOAuthToken();
-  } else {
+  } else if (auth_token_.empty()) {
     actor_->ResetAuth(base::Bind(&EnrollmentScreen::ShowSigninScreen,
                                  weak_ptr_factory_.GetWeakPtr()));
+  } else {
+    actor_->Show();
+    actor_->ShowEnrollmentSpinnerScreen();
+    OnOAuthTokenAvailable(auth_token_);
   }
 }
 
 void EnrollmentScreen::Hide() {
   actor_->Hide();
   weak_ptr_factory_.InvalidateWeakPtrs();
 }
 
 std::string EnrollmentScreen::GetName() const {
   return WizardController::kEnrollmentScreenName;
@@ skipping 40 matching lines @@
     case GoogleServiceAuthError::NUM_STATES:
       break;
   }
 
   NOTREACHED();
   UMAFailure(policy::kMetricEnrollmentOtherFailed);
 }
 
 void EnrollmentScreen::OnOAuthTokenAvailable(
     const std::string& token) {
-  RegisterForDevicePolicy(token);
+  VLOG(1) << "OnOAuthTokenAvailable " << token;
+  const bool is_shark =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos()->
+      GetDeviceCloudPolicyManager()->IsSharkRequisition();

[bartfab (slow), 2014/07/16 10:09:15]

Nit: IsSharkRequisition() should not be a part of the
DeviceCloudPolicyManagerChromeOS. It is used during enrollment only and should
be moved to a class that handles enrollment, e.g. EnrollmentHandlerChromeOS.

[achuithb, 2014/08/13 01:57:42]

I tried doing this here:
https://codereview.chromium.org/408013003/

It doesn't work because EnrollmentHandlerChromeOS is created too late for our
needs. I've taken over the bug and am happy to implement a solution that would
be satisfactory to the enterprise team.

[bartfab (slow), 2014/08/13 14:20:14]

Yes, we can discuss this further in crbug.com/383695. I am fine with
IsSharkRequisition() living alongside the existing IsRemoraRequisition() until
we figure out a better home for both.

[achuithb, 2014/08/13 23:48:39]

Acknowledged.

+
+  if (is_shark && auth_token_.empty()) {
+    // Fetch a second token for shark devices.
+    auth_token_ = token;

[bartfab (slow), 2014/07/16 10:09:15]

|auth_token_| plays a dual role that makes it difficult to follow the code:

* On a shark device, |auth_token_| is used as Boolean indicator that tells us
whether we are currently fetching the first or the second token. The shark
device must never read and process |auth_token_| itself because that token was
sent to another device and will be used by it.

* On a device that receives a token from a shark, |auth_token_| holds the token
that will actually be used during enrollment.

How about introducing a Boolean |sent_token_| that is used on shark only to keep
track of whether a token was retrieved and sent to another device already?

[achuithb, 2014/08/13 01:57:42]

What you say is true. However, in the current implementation of the test code,
we use an asynchronous call to base::WriteFile to write the auth_token to a
file, and that function very inconveniently does not allow us to use base::Owned
or any other mechanism to delete the auth_token storage after we're done writing
it. Two options here are to simply leak the string, or use PostTaskAndReply
instead.

I've added a comment and opened a bug to track this for now.

[bartfab (slow), 2014/08/13 14:20:14]

Just make a wrapper around base::WriteFile that takes a |const std::string&|
instead of a |const char*|. You can then change CL 395983002 to do:

namespace {

void WriteStringToFile(const FilePath& filename, const std::string& data) {
  base::WriteFile(filename, data.c_str(), data.size());
}

}

void EnrollmentScreen::SendEnrollmentAuthToken(const std::string& token) {
  content::BrowserThread::GetBlockingPool()->PostTask(
      FROM_HERE,
      base::Bind(&WriteStringToFile,
                 base::FilePath::FromUTF8Unsafe("/var/tmp/auth_token"),
                 token));
}

Et voilà, no more need to keep the |auth_token_| around on shark.

On 2014/08/13 01:57:42, achuithb wrote:

[achuithb, 2014/08/13 23:48:39]

Done.

+    actor_->FetchOAuthToken();
+    SendEnrollmentAuthToken(token);
+  } else {
+    RegisterForDevicePolicy(token);
+  }
 }
 
 void EnrollmentScreen::OnRetry() {
   actor_->ResetAuth(base::Bind(&EnrollmentScreen::ShowSigninScreen,
                                weak_ptr_factory_.GetWeakPtr()));
 }
 
 void EnrollmentScreen::OnCancel() {
   if (enrollment_mode_ == EnrollmentScreenActor::ENROLLMENT_MODE_FORCED) {
     actor_->ResetAuth(
@@ skipping 61 matching lines @@
   policy::DeviceCloudPolicyInitializer* dcp_initializer =
       connector->GetDeviceCloudPolicyInitializer();
   CHECK(dcp_initializer);
   dcp_initializer->StartEnrollment(
       connector->device_management_service(),
       token, is_auto_enrollment(), device_modes,
       base::Bind(&EnrollmentScreen::ReportEnrollmentStatus,
                  weak_ptr_factory_.GetWeakPtr()));
 }
 
+void EnrollmentScreen::SendEnrollmentAuthToken(const std::string& token) {
+}

[bartfab (slow), 2014/07/16 10:09:15]

Nit: Add a TODO that briefly explains what this method will do in the future.

[achuithb, 2014/08/13 01:57:42]

Done. I'd like to keep this brief since this isn't public yet.

+
 void EnrollmentScreen::ShowEnrollmentStatusOnSuccess(
     const policy::EnrollmentStatus& status) {
   actor_->ShowEnrollmentStatus(status);
   StartupUtils::MarkOobeCompleted();
 }
 
 void EnrollmentScreen::ReportEnrollmentStatus(
     policy::EnrollmentStatus status) {
   bool success = status.status() == policy::EnrollmentStatus::STATUS_SUCCESS;
   enrollment_failed_once_ |= !success;
@@ skipping 82 matching lines @@
     sample = policy::kMetricEnrollmentAutoFailed;
   UMA(sample);
 }
 
 void EnrollmentScreen::ShowSigninScreen() {
   actor_->Show();
   actor_->ShowSigninScreen();
 }
 
 }  // namespace chromeos