| OLD | NEW |
| (Empty) |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 #ifndef CHROME_BROWSER_CHROMEOS_LOGIN_MANAGED_SUPERVISED_USER_AUTHENTICATION_H_ | |
| 5 #define CHROME_BROWSER_CHROMEOS_LOGIN_MANAGED_SUPERVISED_USER_AUTHENTICATION_H_ | |
| 6 | |
| 7 #include "base/basictypes.h" | |
| 8 #include "base/compiler_specific.h" | |
| 9 #include "base/memory/weak_ptr.h" | |
| 10 #include "base/strings/string16.h" | |
| 11 #include "base/values.h" | |
| 12 #include "chrome/browser/chromeos/login/managed/supervised_user_login_flow.h" | |
| 13 #include "chromeos/login/auth/user_context.h" | |
| 14 | |
| 15 namespace chromeos { | |
| 16 | |
| 17 class SupervisedUserManager; | |
| 18 | |
| 19 // This is a class that encapsulates all details of password handling for | |
| 20 // supervised users. | |
| 21 // Main property is the schema used to handle password. For now it can be either | |
| 22 // plain password schema, when plain text password is passed to standard | |
| 23 // cryprohome authentication algorithm without modification, or hashed password | |
| 24 // schema, when password is additioUpdateContextToChecknally hashed with | |
| 25 // user-specific salt. | |
| 26 // Second schema is required to allow password syncing across devices for | |
| 27 // supervised users. | |
| 28 class SupervisedUserAuthentication { | |
| 29 public: | |
| 30 enum Schema { | |
| 31 SCHEMA_PLAIN = 1, | |
| 32 SCHEMA_SALT_HASHED = 2 | |
| 33 }; | |
| 34 | |
| 35 enum SupervisedUserPasswordChangeResult { | |
| 36 PASSWORD_CHANGED_IN_MANAGER_SESSION = 0, | |
| 37 PASSWORD_CHANGED_IN_USER_SESSION = 1, | |
| 38 PASSWORD_CHANGE_FAILED_NO_MASTER_KEY = 2, | |
| 39 PASSWORD_CHANGE_FAILED_NO_SIGNATURE_KEY = 3, | |
| 40 PASSWORD_CHANGE_FAILED_NO_PASSWORD_DATA = 4, | |
| 41 PASSWORD_CHANGE_FAILED_MASTER_KEY_FAILURE = 5, | |
| 42 PASSWORD_CHANGE_FAILED_LOADING_DATA = 6, | |
| 43 PASSWORD_CHANGE_FAILED_INCOMPLETE_DATA = 7, | |
| 44 PASSWORD_CHANGE_FAILED_AUTHENTICATION_FAILURE = 8, | |
| 45 PASSWORD_CHANGE_FAILED_STORE_DATA = 9, | |
| 46 PASSWORD_CHANGE_RESULT_MAX_VALUE = 10 | |
| 47 }; | |
| 48 | |
| 49 typedef base::Callback<void(const base::DictionaryValue* password_data)> | |
| 50 PasswordDataCallback; | |
| 51 | |
| 52 explicit SupervisedUserAuthentication(SupervisedUserManager* owner); | |
| 53 virtual ~SupervisedUserAuthentication(); | |
| 54 | |
| 55 // Returns current schema for whole ChromeOS. It defines if users with older | |
| 56 // schema should be migrated somehow. | |
| 57 Schema GetStableSchema(); | |
| 58 | |
| 59 // Transforms key according to schema specified in Local State. | |
| 60 UserContext TransformKey(const UserContext& context); | |
| 61 | |
| 62 // Fills |password_data| with |password|-specific data for |user_id|, | |
| 63 // depending on target schema. Does not affect Local State. | |
| 64 bool FillDataForNewUser(const std::string& user_id, | |
| 65 const std::string& password, | |
| 66 base::DictionaryValue* password_data, | |
| 67 base::DictionaryValue* extra_data); | |
| 68 | |
| 69 // Stores |password_data| for |user_id| in Local State. Only public parts | |
| 70 // of |password_data| will be stored. | |
| 71 void StorePasswordData(const std::string& user_id, | |
| 72 const base::DictionaryValue& password_data); | |
| 73 | |
| 74 bool NeedPasswordChange(const std::string& user_id, | |
| 75 const base::DictionaryValue* password_data); | |
| 76 | |
| 77 // Checks if given user should update password upon signin. | |
| 78 bool HasScheduledPasswordUpdate(const std::string& user_id); | |
| 79 void ClearScheduledPasswordUpdate(const std::string& user_id); | |
| 80 | |
| 81 // Checks if password was migrated to new schema by supervised user. | |
| 82 // In this case it does not have encryption key, and should be updated by | |
| 83 // manager even if password versions match. | |
| 84 bool HasIncompleteKey(const std::string& user_id); | |
| 85 void MarkKeyIncomplete(const std::string& user_id, bool incomplete); | |
| 86 | |
| 87 // Loads password data stored by ScheduleSupervisedPasswordChange. | |
| 88 void LoadPasswordUpdateData(const std::string& user_id, | |
| 89 const PasswordDataCallback& success_callback, | |
| 90 const base::Closure& failure_callback); | |
| 91 | |
| 92 // Creates a random string that can be used as a master key for managed | |
| 93 // user's homedir. | |
| 94 std::string GenerateMasterKey(); | |
| 95 | |
| 96 // Called by supervised user to store password data for migration upon signin. | |
| 97 void ScheduleSupervisedPasswordChange( | |
| 98 const std::string& supervised_user_id, | |
| 99 const base::DictionaryValue* password_data); | |
| 100 | |
| 101 // Utility method that gets schema version for |user_id| from Local State. | |
| 102 Schema GetPasswordSchema(const std::string& user_id); | |
| 103 | |
| 104 static std::string BuildPasswordSignature( | |
| 105 const std::string& password, | |
| 106 int revision, | |
| 107 const std::string& base64_signature_key); | |
| 108 | |
| 109 private: | |
| 110 SupervisedUserManager* owner_; | |
| 111 | |
| 112 // Controls if migration is enabled. | |
| 113 bool migration_enabled_; | |
| 114 | |
| 115 // Target schema version. Affects migration process and new user creation. | |
| 116 Schema stable_schema_; | |
| 117 | |
| 118 | |
| 119 DISALLOW_COPY_AND_ASSIGN(SupervisedUserAuthentication); | |
| 120 }; | |
| 121 | |
| 122 } // namespace chromeos | |
| 123 | |
| 124 #endif // CHROME_BROWSER_CHROMEOS_LOGIN_MANAGED_SUPERVISED_USER_AUTHENTICATION_
H_ | |
| OLD | NEW |