Set Service property ManagedCredentials for managed networks.

chromeos/network/policy_util.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chromeos/network/policy_util.h"
 
 #include "base/logging.h"
 #include "base/values.h"
 #include "chromeos/network/network_profile.h"
 #include "chromeos/network/network_ui_data.h"
@@ skipping 107 matching lines @@
     policy_wifi->GetStringWithoutPathExpansion(::onc::wifi::kSSID,
                                                &policy_ssid);
     std::string actual_ssid;
     actual_wifi->GetStringWithoutPathExpansion(::onc::wifi::kSSID,
                                                &actual_ssid);
     return (policy_ssid == actual_ssid);
   }
   return false;
 }
 
+// Returns true if AutoConnect is enabled by |policy| (as mandatory or
+// recommended setting). Otherwise and on error returns false.
+bool IsAutoConnectEnabledInPolicy(const base::DictionaryValue& policy) {
+  std::string type;
+  policy.GetStringWithoutPathExpansion(::onc::network_config::kType, &type);
+
+  std::string autoconnect_key;
+  std::string network_dict_key;
+  if (type == ::onc::network_type::kWiFi) {
+    network_dict_key = ::onc::network_config::kWiFi;
+    autoconnect_key = ::onc::wifi::kAutoConnect;
+  } else if (type == ::onc::network_type::kVPN) {
+    network_dict_key = ::onc::network_config::kVPN;
+    autoconnect_key = ::onc::vpn::kAutoConnect;
+  } else {
+    VLOG(2) << "Network type without autoconnect property.";
+    return false;
+  }
+
+  const base::DictionaryValue* network_dict = NULL;
+  policy.GetDictionaryWithoutPathExpansion(network_dict_key, &network_dict);
+  if (!network_dict) {
+    LOG(ERROR) << "ONC doesn't contain a " << network_dict_key
+               << " dictionary.";
+    return false;
+  }
+
+  bool autoconnect = false;
+  network_dict->GetBooleanWithoutPathExpansion(autoconnect_key, &autoconnect);
+  return autoconnect;
+}
+
 base::DictionaryValue* GetOrCreateDictionary(const std::string& key,
                                              base::DictionaryValue* dict) {
   base::DictionaryValue* inner_dict = NULL;
   if (!dict->GetDictionaryWithoutPathExpansion(key, &inner_dict)) {
     inner_dict = new base::DictionaryValue;
     dict->SetWithoutPathExpansion(key, inner_dict);
   }
   return inner_dict;
 }
 
@@ skipping 179 matching lines @@
   effective = normalizer.NormalizeObject(&onc::kNetworkConfigurationSignature,
                                          *effective);
 
   scoped_ptr<base::DictionaryValue> shill_dictionary(
       onc::TranslateONCObjectToShill(&onc::kNetworkConfigurationSignature,
                                      *effective));
 
   shill_dictionary->SetStringWithoutPathExpansion(shill::kProfileProperty,
                                                   profile.path);
 
+  // If AutoConnect is enabled by policy, set the ManagedCredentials property to
+  // indicate to Shill that this network can be used for autoconnect even
+  // without a manual and successful connection attempt.
+  if (network_policy && IsAutoConnectEnabledInPolicy(*network_policy)) {
+    VLOG(1) << "Enable ManagedCredentials for managed network with GUID "
+            << guid;
+    shill_dictionary->SetBooleanWithoutPathExpansion(
+        shill::kManagedCredentialsProperty, true);

[Paul Stewart, 2014/10/30 15:32:42]

It's okay to do this even if auto-connect is unset / set false.  The two are
orthogonal.

[pneubeck (no reviews), 2014/10/30 15:46:40]

The question is however, what behavior we want to trigger if policy didn't set
autoconnect and the user is setting autoconnect=true.
The current implementation should be the conservative choice in this case.

+  }
+
   if (!network_policy && global_policy) {
     // The network isn't managed. Global network policies have to be applied.
     SetShillPropertiesForGlobalPolicy(
         *shill_dictionary, *global_policy, shill_dictionary.get());
   }
 
   scoped_ptr<NetworkUIData> ui_data(NetworkUIData::CreateFromONC(onc_source));
 
   if (user_settings) {
     // Shill doesn't know that sensitive data is contained in the UIData
@@ skipping 24 matching lines @@
        it != policies.end(); ++it) {
     if (IsPolicyMatching(*it->second, actual_network))
       return it->second;
   }
   return NULL;
 }
 
 }  // namespace policy_util
 
 }  // namespace chromeos