chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_chromeos.h"
   6
   7 #include "base/bind.h"
   8 #include "base/bind_helpers.h"
   9 #include "base/logging.h"
  10 #include "base/metrics/histogram.h"
  11 #include "base/metrics/sparse_histogram.h"
  12 #include "base/sequenced_task_runner.h"
  13 #include "base/values.h"
  14 #include "chrome/browser/browser_process.h"
  15 #include "chrome/browser/chromeos/login/helper.h"
  16 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
  17 #include "chrome/browser/chromeos/policy/policy_oauth2_token_fetcher.h"
  18 #include "chrome/browser/chromeos/policy/user_cloud_policy_manager_factory_chromeos.h"
  19 #include "chrome/browser/chromeos/policy/wildcard_login_checker.h"
  20 #include "chrome/browser/lifetime/application_lifetime.h"
  21 #include "chrome/common/chrome_content_client.h"
  22 #include "components/policy/core/common/cloud/cloud_external_data_manager.h"
  23 #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h"
  24 #include "components/policy/core/common/cloud/device_management_service.h"
  25 #include "components/policy/core/common/cloud/system_policy_request_context.h"
  26 #include "components/policy/core/common/policy_map.h"
  27 #include "components/policy/core/common/policy_pref_names.h"
  28 #include "components/policy/core/common/policy_types.h"
  29 #include "components/user_manager/user_manager.h"
  30 #include "net/url_request/url_request_context_getter.h"
  31 #include "policy/policy_constants.h"
  32 #include "url/gurl.h"
  33
  34 namespace em = enterprise_management;
  35
  36 namespace policy {
  37
  38 namespace {
  39
  40 // UMA histogram names.
  41 const char kUMADelayInitialization[] =
  42     "Enterprise.UserPolicyChromeOS.DelayInitialization";
  43 const char kUMAInitialFetchClientError[] =
  44     "Enterprise.UserPolicyChromeOS.InitialFetch.ClientError";
  45 const char kUMAInitialFetchDelayClientRegister[] =
  46     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayClientRegister";
  47 const char kUMAInitialFetchDelayOAuth2Token[] =
  48     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayOAuth2Token";
  49 const char kUMAInitialFetchDelayPolicyFetch[] =
  50     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayPolicyFetch";
  51 const char kUMAInitialFetchDelayTotal[] =
  52     "Enterprise.UserPolicyChromeOS.InitialFetch.DelayTotal";
  53 const char kUMAInitialFetchOAuth2Error[] =
  54     "Enterprise.UserPolicyChromeOS.InitialFetch.OAuth2Error";
  55 const char kUMAInitialFetchOAuth2NetworkError[] =
  56     "Enterprise.UserPolicyChromeOS.InitialFetch.OAuth2NetworkError";
  57
  58 void OnWildcardCheckCompleted(const std::string& username,
  59                               WildcardLoginChecker::Result result) {
  60   if (result == WildcardLoginChecker::RESULT_BLOCKED) {
  61     LOG(ERROR) << "Online wildcard login check failed, terminating session.";
  62
  63     // TODO(mnissler): This only removes the user pod from the login screen, but
  64     // the cryptohome remains. This is because deleting the cryptohome for a
  65     // logged-in session is not possible. Fix this either by delaying the
  66     // cryptohome deletion operation or by getting rid of the in-session
  67     // wildcard check.
  68     user_manager::UserManager::Get()->RemoveUserFromList(username);
  69     chrome::AttemptUserExit();
  70   }
  71 }
  72
  73 }  // namespace
  74
  75 UserCloudPolicyManagerChromeOS::UserCloudPolicyManagerChromeOS(
  76     scoped_ptr<CloudPolicyStore> store,
  77     scoped_ptr<CloudExternalDataManager> external_data_manager,
  78     const base::FilePath& component_policy_cache_path,
  79     bool wait_for_policy_fetch,
  80     base::TimeDelta initial_policy_fetch_timeout,
  81     const scoped_refptr<base::SequencedTaskRunner>& task_runner,
  82     const scoped_refptr<base::SequencedTaskRunner>& file_task_runner,
  83     const scoped_refptr<base::SequencedTaskRunner>& io_task_runner)
  84     : CloudPolicyManager(dm_protocol::kChromeUserPolicyType,
  85                          std::string(),
  86                          store.get(),
  87                          task_runner,
  88                          file_task_runner,
  89                          io_task_runner),
  90       store_(store.Pass()),
  91       external_data_manager_(external_data_manager.Pass()),
  92       component_policy_cache_path_(component_policy_cache_path),
  93       wait_for_policy_fetch_(wait_for_policy_fetch),
  94       policy_fetch_timeout_(false, false) {
  95   time_init_started_ = base::Time::Now();
  96   if (wait_for_policy_fetch_ && !initial_policy_fetch_timeout.is_max()) {
  97     policy_fetch_timeout_.Start(
  98         FROM_HERE,
  99         initial_policy_fetch_timeout,
 100         base::Bind(&UserCloudPolicyManagerChromeOS::OnBlockingFetchTimeout,
 101                    base::Unretained(this)));
 102   }
 103 }
 104
 105 UserCloudPolicyManagerChromeOS::~UserCloudPolicyManagerChromeOS() {}
 106
 107 void UserCloudPolicyManagerChromeOS::Connect(
 108     PrefService* local_state,
 109     DeviceManagementService* device_management_service,
 110     scoped_refptr<net::URLRequestContextGetter> system_request_context) {
 111   DCHECK(device_management_service);
 112   DCHECK(local_state);
 113   local_state_ = local_state;
 114   scoped_refptr<net::URLRequestContextGetter> request_context;
 115   if (system_request_context.get()) {
 116     // |system_request_context| can be null for tests.
 117     // Use the system request context here instead of a context derived
 118     // from the Profile because Connect() is called before the profile is
 119     // fully initialized (required so we can perform the initial policy load).
 120     // TODO(atwilson): Change this to use a UserPolicyRequestContext once
 121     // Connect() is called after profile initialization. http://crbug.com/323591
 122     request_context = new SystemPolicyRequestContext(
 123         system_request_context, GetUserAgent());
 124   }
 125   scoped_ptr<CloudPolicyClient> cloud_policy_client(new CloudPolicyClient(
 126       std::string(), std::string(), kPolicyVerificationKeyHash,
 127       device_management_service, request_context));
 128   CreateComponentCloudPolicyService(component_policy_cache_path_,
 129                                     request_context, cloud_policy_client.get());
 130   core()->Connect(cloud_policy_client.Pass());
 131   client()->AddObserver(this);
 132
 133   external_data_manager_->Connect(request_context);
 134
 135   // Determine the next step after the CloudPolicyService initializes.
 136   if (service()->IsInitializationComplete()) {
 137     OnInitializationCompleted(service());
 138   } else {
 139     service()->AddObserver(this);
 140   }
 141 }
 142
 143 void UserCloudPolicyManagerChromeOS::OnAccessTokenAvailable(
 144     const std::string& access_token) {
 145   access_token_ = access_token;
 146
 147   if (!wildcard_username_.empty()) {
 148     wildcard_login_checker_.reset(new WildcardLoginChecker());
 149     wildcard_login_checker_->StartWithAccessToken(
 150         access_token,
 151         base::Bind(&OnWildcardCheckCompleted, wildcard_username_));
 152   }
 153
 154   if (service() && service()->IsInitializationComplete() &&
 155       client() && !client()->is_registered()) {
 156     OnOAuth2PolicyTokenFetched(
 157         access_token, GoogleServiceAuthError(GoogleServiceAuthError::NONE));
 158   }
 159 }
 160
 161 bool UserCloudPolicyManagerChromeOS::IsClientRegistered() const {
 162   return client() && client()->is_registered();
 163 }
 164
 165 void UserCloudPolicyManagerChromeOS::EnableWildcardLoginCheck(
 166     const std::string& username) {
 167   DCHECK(access_token_.empty());
 168   wildcard_username_ = username;
 169 }
 170
 171 void UserCloudPolicyManagerChromeOS::Shutdown() {
 172   if (client())
 173     client()->RemoveObserver(this);
 174   if (service())
 175     service()->RemoveObserver(this);
 176   token_fetcher_.reset();
 177   external_data_manager_->Disconnect();
 178   CloudPolicyManager::Shutdown();
 179 }
 180
 181 bool UserCloudPolicyManagerChromeOS::IsInitializationComplete(
 182     PolicyDomain domain) const {
 183   if (!CloudPolicyManager::IsInitializationComplete(domain))
 184     return false;
 185   if (domain == POLICY_DOMAIN_CHROME)
 186     return !wait_for_policy_fetch_;
 187   return true;
 188 }
 189
 190 void UserCloudPolicyManagerChromeOS::OnInitializationCompleted(
 191     CloudPolicyService* cloud_policy_service) {
 192   DCHECK_EQ(service(), cloud_policy_service);
 193   cloud_policy_service->RemoveObserver(this);
 194
 195   time_init_completed_ = base::Time::Now();
 196   UMA_HISTOGRAM_MEDIUM_TIMES(kUMADelayInitialization,
 197                              time_init_completed_ - time_init_started_);
 198
 199   // If the CloudPolicyClient isn't registered at this stage then it needs an
 200   // OAuth token for the initial registration.
 201   //
 202   // If |wait_for_policy_fetch_| is true then Profile initialization is blocking
 203   // on the initial policy fetch, so the token must be fetched immediately.
 204   // In that case, the signin Profile is used to authenticate a Gaia request to
 205   // fetch a refresh token, and then the policy token is fetched.
 206   //
 207   // If |wait_for_policy_fetch_| is false then the UserCloudPolicyTokenForwarder
 208   // service will eventually call OnAccessTokenAvailable() once an access token
 209   // is available. That call may have already happened while waiting for
 210   // initialization of the CloudPolicyService, so in that case check if an
 211   // access token is already available.
 212   if (!client()->is_registered()) {
 213     if (wait_for_policy_fetch_) {
 214       FetchPolicyOAuthToken();
 215     } else if (!access_token_.empty()) {
 216       OnAccessTokenAvailable(access_token_);
 217     }
 218   }
 219
 220   if (!wait_for_policy_fetch_) {
 221     // If this isn't blocking on a policy fetch then
 222     // CloudPolicyManager::OnStoreLoaded() already published the cached policy.
 223     // Start the refresh scheduler now, which will eventually refresh the
 224     // cached policy or make the first fetch once the OAuth2 token is
 225     // available.
 226     StartRefreshSchedulerIfReady();
 227   }
 228 }
 229
 230 void UserCloudPolicyManagerChromeOS::OnPolicyFetched(
 231     CloudPolicyClient* client) {
 232   // No action required. If we're blocked on a policy fetch, we'll learn about
 233   // completion of it through OnInitialPolicyFetchComplete().
 234 }
 235
 236 void UserCloudPolicyManagerChromeOS::OnRegistrationStateChanged(
 237     CloudPolicyClient* cloud_policy_client) {
 238   DCHECK_EQ(client(), cloud_policy_client);
 239
 240   if (wait_for_policy_fetch_) {
 241     time_client_registered_ = base::Time::Now();
 242     if (!time_token_available_.is_null()) {
 243       UMA_HISTOGRAM_MEDIUM_TIMES(
 244           kUMAInitialFetchDelayClientRegister,
 245           time_client_registered_ - time_token_available_);
 246     }
 247
 248     // If we're blocked on the policy fetch, now is a good time to issue it.
 249     if (client()->is_registered()) {
 250       service()->RefreshPolicy(
 251           base::Bind(
 252               &UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete,
 253               base::Unretained(this)));
 254     } else {
 255       // If the client has switched to not registered, we bail out as this
 256       // indicates the cloud policy setup flow has been aborted.
 257       CancelWaitForPolicyFetch();
 258     }
 259   }
 260 }
 261
 262 void UserCloudPolicyManagerChromeOS::OnClientError(
 263     CloudPolicyClient* cloud_policy_client) {
 264   DCHECK_EQ(client(), cloud_policy_client);
 265   if (wait_for_policy_fetch_) {
 266     UMA_HISTOGRAM_SPARSE_SLOWLY(kUMAInitialFetchClientError,
 267                                 cloud_policy_client->status());
 268   }
 269   CancelWaitForPolicyFetch();
 270 }
 271
 272 void UserCloudPolicyManagerChromeOS::OnComponentCloudPolicyUpdated() {
 273   CloudPolicyManager::OnComponentCloudPolicyUpdated();
 274   StartRefreshSchedulerIfReady();
 275 }
 276
 277 void UserCloudPolicyManagerChromeOS::GetChromePolicy(PolicyMap* policy_map) {
 278   CloudPolicyManager::GetChromePolicy(policy_map);
 279
 280   // If the store has a verified policy blob received from the server then apply
 281   // the defaults for policies that haven't been configured by the administrator
 282   // given that this is an enterprise user.
 283   if (!store()->has_policy())
 284     return;
 285   SetEnterpriseUsersDefaults(policy_map);
 286 }
 287
 288 void UserCloudPolicyManagerChromeOS::FetchPolicyOAuthToken() {
 289   const std::string& refresh_token = chromeos::UserSessionManager::GetInstance()
 290                                          ->user_context()
 291                                          .GetRefreshToken();
 292   if (!refresh_token.empty()) {
 293     token_fetcher_.reset(new PolicyOAuth2TokenFetcher());
 294     token_fetcher_->StartWithRefreshToken(
 295         refresh_token, g_browser_process->system_request_context(),
 296         base::Bind(&UserCloudPolicyManagerChromeOS::OnOAuth2PolicyTokenFetched,
 297                    base::Unretained(this)));
 298     return;
 299   }
 300
 301   scoped_refptr<net::URLRequestContextGetter> signin_context =
 302       chromeos::login::GetSigninContext();
 303   if (!signin_context.get()) {
 304     LOG(ERROR) << "No signin context for policy oauth token fetch!";
 305     OnOAuth2PolicyTokenFetched(
 306         std::string(), GoogleServiceAuthError(GoogleServiceAuthError::NONE));
 307     return;
 308   }
 309
 310   token_fetcher_.reset(new PolicyOAuth2TokenFetcher());
 311   token_fetcher_->StartWithSigninContext(
 312       signin_context.get(), g_browser_process->system_request_context(),
 313       base::Bind(&UserCloudPolicyManagerChromeOS::OnOAuth2PolicyTokenFetched,
 314                  base::Unretained(this)));
 315 }
 316
 317 void UserCloudPolicyManagerChromeOS::OnOAuth2PolicyTokenFetched(
 318     const std::string& policy_token,
 319     const GoogleServiceAuthError& error) {
 320   DCHECK(!client()->is_registered());
 321   time_token_available_ = base::Time::Now();
 322   if (wait_for_policy_fetch_) {
 323     UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayOAuth2Token,
 324                                time_token_available_ - time_init_completed_);
 325   }
 326
 327   if (error.state() == GoogleServiceAuthError::NONE) {
 328     // Start client registration. Either OnRegistrationStateChanged() or
 329     // OnClientError() will be called back.
 330     client()->Register(em::DeviceRegisterRequest::USER,
 331                        em::DeviceRegisterRequest::FLAVOR_USER_REGISTRATION,
 332                        policy_token, std::string(), std::string(),
 333                        std::string());
 334   } else {
 335     // Failed to get a token, stop waiting and use an empty policy.
 336     CancelWaitForPolicyFetch();
 337
 338     UMA_HISTOGRAM_ENUMERATION(kUMAInitialFetchOAuth2Error,
 339                               error.state(),
 340                               GoogleServiceAuthError::NUM_STATES);
 341     if (error.state() == GoogleServiceAuthError::CONNECTION_FAILED) {
 342       // Network errors are negative in the code, but the histogram data type
 343       // expects the corresponding positive value.
 344       UMA_HISTOGRAM_SPARSE_SLOWLY(kUMAInitialFetchOAuth2NetworkError,
 345                                   -error.network_error());
 346     }
 347   }
 348
 349   token_fetcher_.reset();
 350 }
 351
 352 void UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete(
 353     bool success) {
 354   const base::Time now = base::Time::Now();
 355   UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayPolicyFetch,
 356                              now - time_client_registered_);
 357   UMA_HISTOGRAM_MEDIUM_TIMES(kUMAInitialFetchDelayTotal,
 358                              now - time_init_started_);
 359   CancelWaitForPolicyFetch();
 360 }
 361
 362 void UserCloudPolicyManagerChromeOS::OnBlockingFetchTimeout() {
 363   if (!wait_for_policy_fetch_)
 364     return;
 365   LOG(WARNING) << "Timed out while waiting for the initial policy fetch. "
 366                << "The first session will start without policy.";
 367   CancelWaitForPolicyFetch();
 368 }
 369
 370 void UserCloudPolicyManagerChromeOS::CancelWaitForPolicyFetch() {
 371   if (!wait_for_policy_fetch_)
 372     return;
 373
 374   wait_for_policy_fetch_ = false;
 375   policy_fetch_timeout_.Stop();
 376   CheckAndPublishPolicy();
 377   // Now that |wait_for_policy_fetch_| is guaranteed to be false, the scheduler
 378   // can be started.
 379   StartRefreshSchedulerIfReady();
 380 }
 381
 382 void UserCloudPolicyManagerChromeOS::StartRefreshSchedulerIfReady() {
 383   if (core()->refresh_scheduler())
 384     return;  // Already started.
 385
 386   if (wait_for_policy_fetch_)
 387     return;  // Still waiting for the initial, blocking fetch.
 388
 389   if (!service() || !local_state_)
 390     return;  // Not connected.
 391
 392   if (component_policy_service() &&
 393       !component_policy_service()->is_initialized()) {
 394     // If the client doesn't have the list of components to fetch yet then don't
 395     // start the scheduler. The |component_policy_service_| will call back into
 396     // OnComponentCloudPolicyUpdated() once it's ready.
 397     return;
 398   }
 399
 400   core()->StartRefreshScheduler();
 401   core()->TrackRefreshDelayPref(local_state_,
 402                                 policy_prefs::kUserPolicyRefreshRate);
 403 }
 404
 405 }  // namespace policy