chrome/browser/policy/cloud/user_policy_signin_service_base.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/policy/cloud/user_policy_signin_service_base.h"
   6
   7 #include "base/bind.h"
   8 #include "base/command_line.h"
   9 #include "base/message_loop/message_loop.h"
  10 #include "chrome/browser/chrome_notification_types.h"
  11 #include "chrome/browser/policy/cloud/user_cloud_policy_manager_factory.h"
  12 #include "chrome/browser/profiles/profile.h"
  13 #include "chrome/browser/signin/signin_manager_factory.h"
  14 #include "chrome/common/chrome_content_client.h"
  15 #include "chrome/common/chrome_switches.h"
  16 #include "components/policy/core/browser/browser_policy_connector.h"
  17 #include "components/policy/core/common/cloud/device_management_service.h"
  18 #include "components/policy/core/common/cloud/system_policy_request_context.h"
  19 #include "components/policy/core/common/cloud/user_cloud_policy_manager.h"
  20 #include "components/policy/core/common/cloud/user_policy_request_context.h"
  21 #include "components/signin/core/browser/signin_manager.h"
  22 #include "content/public/browser/notification_source.h"
  23 #include "net/url_request/url_request_context_getter.h"
  24
  25 namespace policy {
  26
  27 UserPolicySigninServiceBase::UserPolicySigninServiceBase(
  28     Profile* profile,
  29     PrefService* local_state,
  30     DeviceManagementService* device_management_service,
  31     UserCloudPolicyManager* policy_manager,
  32     SigninManager* signin_manager,
  33     scoped_refptr<net::URLRequestContextGetter> system_request_context)
  34     : policy_manager_(policy_manager),
  35       signin_manager_(signin_manager),
  36       local_state_(local_state),
  37       device_management_service_(device_management_service),
  38       system_request_context_(system_request_context),
  39       weak_factory_(this) {
  40   // Register a listener to be called back once the current profile has finished
  41   // initializing, so we can startup/shutdown the UserCloudPolicyManager.
  42   registrar_.Add(this,
  43                  chrome::NOTIFICATION_PROFILE_ADDED,
  44                  content::Source<Profile>(profile));
  45 }
  46
  47 UserPolicySigninServiceBase::~UserPolicySigninServiceBase() {}
  48
  49 void UserPolicySigninServiceBase::FetchPolicyForSignedInUser(
  50     const std::string& username,
  51     const std::string& dm_token,
  52     const std::string& client_id,
  53     scoped_refptr<net::URLRequestContextGetter> profile_request_context,
  54     const PolicyFetchCallback& callback) {
  55   scoped_ptr<CloudPolicyClient> client(
  56       UserCloudPolicyManager::CreateCloudPolicyClient(
  57           device_management_service_,
  58           CreateUserRequestContext(profile_request_context)).Pass());
  59   client->SetupRegistration(dm_token, client_id);
  60   DCHECK(client->is_registered());
  61   // The user has just signed in, so the UserCloudPolicyManager should not yet
  62   // be initialized. This routine will initialize the UserCloudPolicyManager
  63   // with the passed client and will proactively ask the client to fetch
  64   // policy without waiting for the CloudPolicyService to finish initialization.
  65   UserCloudPolicyManager* manager = policy_manager();
  66   DCHECK(manager);
  67   DCHECK(!manager->core()->client());
  68   InitializeUserCloudPolicyManager(username, client.Pass());
  69   DCHECK(manager->IsClientRegistered());
  70
  71   // Now initiate a policy fetch.
  72   manager->core()->service()->RefreshPolicy(callback);
  73 }
  74
  75 void UserPolicySigninServiceBase::GoogleSignedOut(const std::string& username) {
  76   ShutdownUserCloudPolicyManager();
  77 }
  78
  79 void UserPolicySigninServiceBase::Observe(
  80     int type,
  81     const content::NotificationSource& source,
  82     const content::NotificationDetails& details) {
  83   switch (type) {
  84     case chrome::NOTIFICATION_PROFILE_ADDED:
  85       // A new profile has been loaded - if it's signed in, then initialize the
  86       // UCPM, otherwise shut down the UCPM (which deletes any cached policy
  87       // data). This must be done here instead of at constructor time because
  88       // the Profile is not fully initialized when this object is constructed
  89       // (DoFinalInit() has not yet been called, so ProfileIOData and
  90       // SSLConfigServiceManager have not been created yet).
  91       // TODO(atwilson): Switch to using a timer instead, to avoid contention
  92       // with other services at startup (http://crbug.com/165468).
  93       InitializeOnProfileReady(content::Source<Profile>(source).ptr());
  94       break;
  95     default:
  96       NOTREACHED();
  97   }
  98 }
  99
 100 void UserPolicySigninServiceBase::OnInitializationCompleted(
 101     CloudPolicyService* service) {
 102   // This is meant to be overridden by subclasses. Starting and stopping to
 103   // observe the CloudPolicyService from this base class avoids the need for
 104   // more virtuals.
 105 }
 106
 107 void UserPolicySigninServiceBase::OnPolicyFetched(CloudPolicyClient* client) {}
 108
 109 void UserPolicySigninServiceBase::OnRegistrationStateChanged(
 110     CloudPolicyClient* client) {}
 111
 112 void UserPolicySigninServiceBase::OnClientError(CloudPolicyClient* client) {
 113   if (client->is_registered()) {
 114     // If the client is already registered, it means this error must have
 115     // come from a policy fetch.
 116     if (client->status() == DM_STATUS_SERVICE_MANAGEMENT_NOT_SUPPORTED) {
 117       // OK, policy fetch failed with MANAGEMENT_NOT_SUPPORTED - this is our
 118       // trigger to revert to "unmanaged" mode (we will check for management
 119       // being re-enabled on the next restart and/or login).
 120       DVLOG(1) << "DMServer returned NOT_SUPPORTED error - removing policy";
 121
 122       // Can't shutdown now because we're in the middle of a callback from
 123       // the CloudPolicyClient, so queue up a task to do the shutdown.
 124       base::MessageLoop::current()->PostTask(
 125           FROM_HERE,
 126           base::Bind(
 127               &UserPolicySigninServiceBase::ShutdownUserCloudPolicyManager,
 128               weak_factory_.GetWeakPtr()));
 129     } else {
 130       DVLOG(1) << "Error fetching policy: " << client->status();
 131     }
 132   }
 133 }
 134
 135 void UserPolicySigninServiceBase::Shutdown() {
 136   if (signin_manager())
 137     signin_manager()->RemoveObserver(this);
 138   PrepareForUserCloudPolicyManagerShutdown();
 139 }
 140
 141 void UserPolicySigninServiceBase::PrepareForUserCloudPolicyManagerShutdown() {
 142   UserCloudPolicyManager* manager = policy_manager();
 143   if (manager && manager->core()->client())
 144     manager->core()->client()->RemoveObserver(this);
 145   if (manager && manager->core()->service())
 146     manager->core()->service()->RemoveObserver(this);
 147 }
 148
 149 scoped_ptr<CloudPolicyClient>
 150 UserPolicySigninServiceBase::CreateClientForRegistrationOnly(
 151     const std::string& username) {
 152   DCHECK(!username.empty());
 153   // We should not be called with a client already initialized.
 154 #if !defined(OS_IOS)
 155   // On iOS we check if an account has policy while the profile is signed in
 156   // to another account.
 157   DCHECK(!policy_manager() || !policy_manager()->core()->client());
 158 #endif
 159
 160   // If the user should not get policy, just bail out.
 161   if (!policy_manager() || !ShouldLoadPolicyForUser(username)) {
 162     DVLOG(1) << "Signed in user is not in the whitelist";
 163     return scoped_ptr<CloudPolicyClient>();
 164   }
 165
 166   // If the DeviceManagementService is not yet initialized, start it up now.
 167   device_management_service_->ScheduleInitialization(0);
 168
 169   // Create a new CloudPolicyClient for fetching the DMToken.
 170   return UserCloudPolicyManager::CreateCloudPolicyClient(
 171       device_management_service_, CreateSystemRequestContext());
 172 }
 173
 174 bool UserPolicySigninServiceBase::ShouldLoadPolicyForUser(
 175     const std::string& username) {
 176   if (username.empty())
 177     return false;  // Not signed in.
 178
 179   return !BrowserPolicyConnector::IsNonEnterpriseUser(username);
 180 }
 181
 182 void UserPolicySigninServiceBase::InitializeOnProfileReady(Profile* profile) {
 183   // If using a TestingProfile with no SigninManager or UserCloudPolicyManager,
 184   // skip initialization.
 185   if (!policy_manager() || !signin_manager()) {
 186     DVLOG(1) << "Skipping initialization for tests due to missing components.";
 187     return;
 188   }
 189
 190   // Shutdown the UserCloudPolicyManager when the user signs out. We start
 191   // observing the SigninManager here because we don't want to get signout
 192   // notifications until after the profile has started initializing
 193   // (http://crbug.com/316229).
 194   signin_manager()->AddObserver(this);
 195
 196   std::string username = signin_manager()->GetAuthenticatedUsername();
 197   if (username.empty())
 198     ShutdownUserCloudPolicyManager();
 199   else
 200     InitializeForSignedInUser(username, profile->GetRequestContext());
 201 }
 202
 203 void UserPolicySigninServiceBase::InitializeForSignedInUser(
 204     const std::string& username,
 205     scoped_refptr<net::URLRequestContextGetter> profile_request_context) {
 206   DCHECK(!username.empty());
 207   if (!ShouldLoadPolicyForUser(username)) {
 208     DVLOG(1) << "Policy load not enabled for user: " << username;
 209     return;
 210   }
 211
 212   UserCloudPolicyManager* manager = policy_manager();
 213   // Initialize the UCPM if it is not already initialized.
 214   if (!manager->core()->service()) {
 215     // If there is no cached DMToken then we can detect this when the
 216     // OnInitializationCompleted() callback is invoked and this will
 217     // initiate a policy fetch.
 218     InitializeUserCloudPolicyManager(
 219         username,
 220         UserCloudPolicyManager::CreateCloudPolicyClient(
 221             device_management_service_,
 222             CreateUserRequestContext(profile_request_context)).Pass());
 223   } else {
 224     manager->SetSigninUsername(username);
 225   }
 226
 227   // If the CloudPolicyService is initialized, kick off registration.
 228   // Otherwise OnInitializationCompleted is invoked as soon as the service
 229   // finishes its initialization.
 230   if (manager->core()->service()->IsInitializationComplete())
 231     OnInitializationCompleted(manager->core()->service());
 232 }
 233
 234 void UserPolicySigninServiceBase::InitializeUserCloudPolicyManager(
 235     const std::string& username,
 236     scoped_ptr<CloudPolicyClient> client) {
 237   DCHECK(client);
 238   UserCloudPolicyManager* manager = policy_manager();
 239   manager->SetSigninUsername(username);
 240   DCHECK(!manager->core()->client());
 241   scoped_refptr<net::URLRequestContextGetter> context =
 242       client->GetRequestContext();
 243   manager->Connect(local_state_, context, client.Pass());
 244   DCHECK(manager->core()->service());
 245
 246   // Observe the client to detect errors fetching policy.
 247   manager->core()->client()->AddObserver(this);
 248   // Observe the service to determine when it's initialized.
 249   manager->core()->service()->AddObserver(this);
 250 }
 251
 252 void UserPolicySigninServiceBase::ShutdownUserCloudPolicyManager() {
 253   PrepareForUserCloudPolicyManagerShutdown();
 254   UserCloudPolicyManager* manager = policy_manager();
 255   if (manager)
 256     manager->DisconnectAndRemovePolicy();
 257 }
 258
 259 scoped_refptr<net::URLRequestContextGetter>
 260 UserPolicySigninServiceBase::CreateSystemRequestContext() {
 261   return new SystemPolicyRequestContext(
 262       system_request_context(), GetUserAgent());
 263 }
 264
 265 scoped_refptr<net::URLRequestContextGetter>
 266 UserPolicySigninServiceBase::CreateUserRequestContext(
 267     scoped_refptr<net::URLRequestContextGetter> profile_request_context) {
 268   return new UserPolicyRequestContext(
 269       profile_request_context, system_request_context(), GetUserAgent());
 270 }
 271
 272 }  // namespace policy