Don't verify the policy timestamp when loading from cache.

chrome/browser/chromeos/settings/session_manager_operation.cc

Index: chrome/browser/chromeos/settings/session_manager_operation.cc
diff --git a/chrome/browser/chromeos/settings/session_manager_operation.cc b/chrome/browser/chromeos/settings/session_manager_operation.cc
index c4fc8d132051ae0c9f17b39f5d03c3f8f14bc4db..e3718f969a1039959d358ffe87b2bfa5a96a5340 100644
--- a/chrome/browser/chromeos/settings/session_manager_operation.cc
+++ b/chrome/browser/chromeos/settings/session_manager_operation.cc
@@ -162,15 +162,23 @@ void SessionManagerOperation::ValidateDeviceSettings(
       policy::DeviceCloudPolicyValidator::Create(policy.Pass(),
                                                  background_task_runner);
 
-  // Policy auto-generated by session manager doesn't include a timestamp, so we
-  // need to allow missing timestamps.
-  const bool require_timestamp =
-      policy_data_.get() && policy_data_->has_request_token();
+
+  // Policy auto-generated by session manager doesn't include a timestamp, so
+  // the timestamp shouldn't be verified in that case.
+  //
+  // Additionally, offline devices can get their clock set backwards in time
+  // under some hardware conditions; checking the timestamp now could likely
+  // find a value in the future, and prevent the user from signing-in or
+  // starting guest mode. Tlsdate will eventually fix the clock when the device
+  // is back online, but the network configuration may come from device ONC.
+  //
+  // To prevent all of these issues the timestamp is just not verified when
+  // loading the device policy from the cache. Note that the timestamp is still
+  // verified during enrollment and when a new policy is fetched from the
+  // server.
   validator->ValidateAgainstCurrentPolicy(
       policy_data_.get(),
-      require_timestamp ?
-          policy::CloudPolicyValidatorBase::TIMESTAMP_REQUIRED :
-          policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
+      policy::CloudPolicyValidatorBase::TIMESTAMP_NOT_REQUIRED,
       policy::CloudPolicyValidatorBase::DM_TOKEN_NOT_REQUIRED);
   validator->ValidatePolicyType(policy::dm_protocol::kChromeDevicePolicyType);
   validator->ValidatePayload();