Fix Chrome OS enrollment with SAML accounts

chrome/browser/resources/gaia_auth/main.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * Authenticator class wraps the communications between Gaia and its host.
  */
 function Authenticator() {
 }
 
@@ skipping 39 matching lines @@
   email_: null,
   gaiaId_: null,
 
   // Depending on the key type chosen, this will contain the plain text password
   // or a credential derived from it along with the information required to
   // repeat the derivation, such as a salt. The information will be encoded so
   // that it contains printable ASCII characters only. The exact encoding is TBD
   // when support for key types other than plain text password is added.
   passwordBytes_: null,
 
+  needPassword_: false,
   chooseWhatToSync_: false,
   skipForNow_: false,
   sessionIndex_: null,
   attemptToken_: null,
 
   // Input params from extension initialization URL.
   inputLang_: undefined,
   intputEmail_: undefined,
 
   isSAMLFlow_: false,
@@ skipping 13 matching lines @@
     this.gaiaUrl_ = params.gaiaUrl || this.GAIA_URL;
     this.gaiaPath_ = params.gaiaPath || this.GAIA_PAGE_PATH;
     this.inputLang_ = params.hl;
     this.inputEmail_ = params.email;
     this.service_ = params.service || this.SERVICE_ID;
     this.continueUrl_ = params.continueUrl || this.CONTINUE_URL;
     this.desktopMode_ = params.desktopMode == '1';
     this.isConstrainedWindow_ = params.constrained == '1';
     this.initialFrameUrl_ = params.frameUrl || this.constructInitialFrameUrl_();
     this.initialFrameUrlWithoutParams_ = stripParams(this.initialFrameUrl_);
+    this.needPassword_ = params.needPassword == '1';
 
     // For CrOS 'ServiceLogin' we assume that Gaia is loaded if we recieved
     // 'clearOldAttempts' message. For other scenarios Gaia doesn't send this
     // message so we have to rely on 'load' event.
     // TODO(dzhioev): Do not rely on 'load' event after b/16313327 is fixed.
     this.assumeLoadedOnLoadEvent_ =
         this.gaiaPath_.indexOf('ServiceLogin') !== 0 ||
         this.service_ !== 'chromeoslogin';
 
     document.addEventListener('DOMContentLoaded', this.onPageLoad_.bind(this));
@@ skipping 272 matching lines @@
     }
 
     this.email_ = msg.email;
     this.gaiaId_ = msg.gaiaId;
     // Password from |msg| is not used because ChromeOS SAML flow
     // gets password by asking user to confirm.
     this.skipForNow_ = msg.skipForNow;
     this.sessionIndex_ = msg.sessionIndex;
 
     if (this.passwordBytes_) {
+      // If the credentials passing API was used, login is complete.
       window.parent.postMessage({method: 'samlApiUsed'}, this.parentPage_);
       this.completeLogin_(msg);
+    } else if (!this.needPassword_) {
+      // If the credentials passing API was not used, the password was obtained
+      // by scraping. It must be verified before use. However, the host may not
+      // be interested in the password at all. In that case, verification is
+      // unnecessary and login is complete.
+      this.completeLogin_(msg);
     } else {
       this.supportChannel_.sendWithCallback(
           {name: 'getScrapedPasswords'},
           function(passwords) {
             if (passwords.length == 0) {
               window.parent.postMessage(
                   {method: 'noPassword', email: this.email_},
                   this.parentPage_);
             } else {
               window.parent.postMessage({method: 'confirmPassword',
@@ skipping 59 matching lines @@
     } else if (msg.method == 'redirectToSignin' &&
                this.isParentMessage_(e)) {
       $('gaia-frame').src = this.constructInitialFrameUrl_();
     } else {
        console.error('Authenticator.onMessage: unknown message + origin!?');
     }
   }
 };
 
 Authenticator.getInstance().initialize();