chrome/browser/signin/chrome_signin_client.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/signin/chrome_signin_client.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/prefs/pref_service.h"
   9 #include "base/strings/utf_string_conversions.h"
  10 #include "chrome/browser/browser_process.h"
  11 #include "chrome/browser/content_settings/cookie_settings_factory.h"
  12 #include "chrome/browser/profiles/profile_info_cache.h"
  13 #include "chrome/browser/profiles/profile_manager.h"
  14 #include "chrome/browser/profiles/profile_metrics.h"
  15 #include "chrome/browser/profiles/profile_window.h"
  16 #include "chrome/browser/signin/local_auth.h"
  17 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
  18 #include "chrome/browser/web_data_service_factory.h"
  19 #include "chrome/common/chrome_version_info.h"
  20 #include "components/content_settings/core/browser/cookie_settings.h"
  21 #include "components/metrics/metrics_service.h"
  22 #include "components/signin/core/browser/profile_oauth2_token_service.h"
  23 #include "components/signin/core/browser/signin_cookie_changed_subscription.h"
  24 #include "components/signin/core/browser/signin_header_helper.h"
  25 #include "components/signin/core/common/profile_management_switches.h"
  26 #include "components/signin/core/common/signin_pref_names.h"
  27 #include "components/signin/core/common/signin_switches.h"
  28 #include "google_apis/gaia/gaia_constants.h"
  29 #include "google_apis/gaia/gaia_urls.h"
  30 #include "net/url_request/url_request_context_getter.h"
  31 #include "url/gurl.h"
  32
  33 #if defined(ENABLE_SUPERVISED_USERS)
  34 #include "chrome/browser/supervised_user/supervised_user_constants.h"
  35 #endif
  36
  37 #if defined(OS_CHROMEOS)
  38 #include "chrome/browser/chromeos/net/delay_network_call.h"
  39 #include "chrome/browser/chromeos/profiles/profile_helper.h"
  40 #include "components/user_manager/user_manager.h"
  41 #endif
  42
  43 #if !defined(OS_ANDROID)
  44 #include "chrome/browser/first_run/first_run.h"
  45 #endif
  46
  47 ChromeSigninClient::ChromeSigninClient(
  48     Profile* profile, SigninErrorController* signin_error_controller)
  49     : OAuth2TokenService::Consumer("chrome_signin_client"),
  50       profile_(profile),
  51       signin_error_controller_(signin_error_controller) {
  52   signin_error_controller_->AddObserver(this);
  53 #if !defined(OS_CHROMEOS)
  54   net::NetworkChangeNotifier::AddNetworkChangeObserver(this);
  55 #else
  56   // UserManager may not exist in unit_tests.
  57   if (!user_manager::UserManager::IsInitialized())
  58     return;
  59
  60   const user_manager::User* user =
  61       chromeos::ProfileHelper::Get()->GetUserByProfile(profile_);
  62   if (!user)
  63     return;
  64   auto* user_manager = user_manager::UserManager::Get();
  65   const std::string& user_id = user->GetUserID();
  66   if (user_manager->GetKnownUserDeviceId(user_id).empty()) {
  67     const std::string legacy_device_id =
  68         GetPrefs()->GetString(prefs::kGoogleServicesSigninScopedDeviceId);
  69     if (!legacy_device_id.empty()) {
  70       // Need to move device ID from the old location to the new one, if it has
  71       // not been done yet.
  72       user_manager->SetKnownUserDeviceId(user_id, legacy_device_id);
  73     } else {
  74       user_manager->SetKnownUserDeviceId(
  75           user_id,
  76           GenerateSigninScopedDeviceID(
  77               user_manager->IsUserNonCryptohomeDataEphemeral(user_id)));
  78     }
  79   }
  80   GetPrefs()->SetString(prefs::kGoogleServicesSigninScopedDeviceId,
  81                         std::string());
  82 #endif
  83 }
  84
  85 ChromeSigninClient::~ChromeSigninClient() {
  86   signin_error_controller_->RemoveObserver(this);
  87 }
  88
  89 void ChromeSigninClient::Shutdown() {
  90 #if !defined(OS_CHROMEOS)
  91   net::NetworkChangeNotifier::RemoveNetworkChangeObserver(this);
  92 #endif
  93 }
  94
  95 void ChromeSigninClient::DoFinalInit() {
  96   MaybeFetchSigninTokenHandle();
  97 }
  98
  99 // static
 100 bool ChromeSigninClient::ProfileAllowsSigninCookies(Profile* profile) {
 101   content_settings::CookieSettings* cookie_settings =
 102       CookieSettingsFactory::GetForProfile(profile).get();
 103   return signin::SettingsAllowSigninCookies(cookie_settings);
 104 }
 105
 106 PrefService* ChromeSigninClient::GetPrefs() { return profile_->GetPrefs(); }
 107
 108 scoped_refptr<TokenWebData> ChromeSigninClient::GetDatabase() {
 109   return WebDataServiceFactory::GetTokenWebDataForProfile(
 110       profile_, ServiceAccessType::EXPLICIT_ACCESS);
 111 }
 112
 113 bool ChromeSigninClient::CanRevokeCredentials() {
 114 #if defined(OS_CHROMEOS)
 115   // UserManager may not exist in unit_tests.
 116   if (user_manager::UserManager::IsInitialized() &&
 117       user_manager::UserManager::Get()->IsLoggedInAsSupervisedUser()) {
 118     // Don't allow revoking credentials for Chrome OS supervised users.
 119     // See http://crbug.com/332032
 120     LOG(ERROR) << "Attempt to revoke supervised user refresh "
 121                << "token detected, ignoring.";
 122     return false;
 123   }
 124 #else
 125   // Don't allow revoking credentials for legacy supervised users.
 126   // See http://crbug.com/332032
 127   if (profile_->IsLegacySupervised()) {
 128     LOG(ERROR) << "Attempt to revoke supervised user refresh "
 129                << "token detected, ignoring.";
 130     return false;
 131   }
 132 #endif
 133   return true;
 134 }
 135
 136 std::string ChromeSigninClient::GetSigninScopedDeviceId() {
 137   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
 138           switches::kDisableSigninScopedDeviceId)) {
 139     return std::string();
 140   }
 141
 142 #if !defined(OS_CHROMEOS)
 143   return SigninClient::GetOrCreateScopedDeviceIdPref(GetPrefs());
 144 #else
 145   // UserManager may not exist in unit_tests.
 146   if (!user_manager::UserManager::IsInitialized())
 147     return std::string();
 148
 149   const user_manager::User* user =
 150       chromeos::ProfileHelper::Get()->GetUserByProfile(profile_);
 151   if (!user)
 152     return std::string();
 153
 154   const std::string signin_scoped_device_id =
 155       user_manager::UserManager::Get()->GetKnownUserDeviceId(user->GetUserID());
 156   LOG_IF(ERROR, signin_scoped_device_id.empty())
 157       << "Device ID is not set for user.";
 158   return signin_scoped_device_id;
 159 #endif
 160 }
 161
 162 void ChromeSigninClient::OnSignedOut() {
 163   ProfileInfoCache& cache =
 164       g_browser_process->profile_manager()->GetProfileInfoCache();
 165   size_t index = cache.GetIndexOfProfileWithPath(profile_->GetPath());
 166
 167   // If sign out occurs because Sync setup was in progress and the Profile got
 168   // deleted, then the profile's no longer in the ProfileInfoCache.
 169   if (index == std::string::npos)
 170     return;
 171
 172   cache.SetLocalAuthCredentialsOfProfileAtIndex(index, std::string());
 173   cache.SetAuthInfoOfProfileAtIndex(index, std::string(), base::string16());
 174   cache.SetProfileSigninRequiredAtIndex(index, false);
 175 }
 176
 177 net::URLRequestContextGetter* ChromeSigninClient::GetURLRequestContext() {
 178   return profile_->GetRequestContext();
 179 }
 180
 181 bool ChromeSigninClient::ShouldMergeSigninCredentialsIntoCookieJar() {
 182   return !switches::IsEnableAccountConsistency();
 183 }
 184
 185 std::string ChromeSigninClient::GetProductVersion() {
 186   chrome::VersionInfo chrome_version;
 187   return chrome_version.CreateVersionString();
 188 }
 189
 190 bool ChromeSigninClient::IsFirstRun() const {
 191 #if defined(OS_ANDROID)
 192   return false;
 193 #else
 194   return first_run::IsChromeFirstRun();
 195 #endif
 196 }
 197
 198 base::Time ChromeSigninClient::GetInstallDate() {
 199   return base::Time::FromTimeT(
 200       g_browser_process->metrics_service()->GetInstallDate());
 201 }
 202
 203 bool ChromeSigninClient::AreSigninCookiesAllowed() {
 204   return ProfileAllowsSigninCookies(profile_);
 205 }
 206
 207 void ChromeSigninClient::AddContentSettingsObserver(
 208     content_settings::Observer* observer) {
 209   profile_->GetHostContentSettingsMap()->AddObserver(observer);
 210 }
 211
 212 void ChromeSigninClient::RemoveContentSettingsObserver(
 213     content_settings::Observer* observer) {
 214   profile_->GetHostContentSettingsMap()->RemoveObserver(observer);
 215 }
 216
 217 scoped_ptr<SigninClient::CookieChangedSubscription>
 218 ChromeSigninClient::AddCookieChangedCallback(
 219     const GURL& url,
 220     const std::string& name,
 221     const net::CookieStore::CookieChangedCallback& callback) {
 222   scoped_refptr<net::URLRequestContextGetter> context_getter =
 223       profile_->GetRequestContext();
 224   DCHECK(context_getter.get());
 225   scoped_ptr<SigninCookieChangedSubscription> subscription(
 226       new SigninCookieChangedSubscription(context_getter, url, name, callback));
 227   return subscription.Pass();
 228 }
 229
 230 void ChromeSigninClient::OnSignedIn(const std::string& account_id,
 231                                     const std::string& gaia_id,
 232                                     const std::string& username,
 233                                     const std::string& password) {
 234   ProfileManager* profile_manager = g_browser_process->profile_manager();
 235   ProfileInfoCache& cache = profile_manager->GetProfileInfoCache();
 236   size_t index = cache.GetIndexOfProfileWithPath(profile_->GetPath());
 237   if (index != std::string::npos) {
 238     cache.SetAuthInfoOfProfileAtIndex(index, gaia_id,
 239                                       base::UTF8ToUTF16(username));
 240     ProfileMetrics::UpdateReportedProfilesStatistics(profile_manager);
 241   }
 242 }
 243
 244 void ChromeSigninClient::PostSignedIn(const std::string& account_id,
 245                                       const std::string& username,
 246                                       const std::string& password) {
 247 #if !defined(OS_ANDROID) && !defined(OS_IOS) && !defined(OS_CHROMEOS)
 248   // Don't store password hash except when lock is available for the user.
 249   if (!password.empty() && profiles::IsLockAvailable(profile_))
 250     LocalAuth::SetLocalAuthCredentials(profile_, password);
 251 #endif
 252 }
 253
 254 bool ChromeSigninClient::UpdateAccountInfo(
 255     AccountTrackerService::AccountInfo* out_account_info) {
 256   return false;
 257 }
 258
 259 void ChromeSigninClient::OnErrorChanged() {
 260   // Some tests don't have a ProfileManager.
 261   if (g_browser_process->profile_manager() == nullptr)
 262     return;
 263
 264   ProfileInfoCache& cache = g_browser_process->profile_manager()->
 265       GetProfileInfoCache();
 266   size_t index = cache.GetIndexOfProfileWithPath(profile_->GetPath());
 267   if (index == std::string::npos)
 268     return;
 269
 270   cache.SetProfileIsAuthErrorAtIndex(index,
 271       signin_error_controller_->HasError());
 272 }
 273
 274 void ChromeSigninClient::OnGetTokenInfoResponse(
 275     scoped_ptr<base::DictionaryValue> token_info) {
 276   if (!token_info->HasKey("error")) {
 277     std::string handle;
 278     if (token_info->GetString("token_handle", &handle)) {
 279       ProfileInfoCache& info_cache =
 280           g_browser_process->profile_manager()->GetProfileInfoCache();
 281       size_t index = info_cache.GetIndexOfProfileWithPath(profile_->GetPath());
 282       info_cache.SetPasswordChangeDetectionTokenAtIndex(index, handle);
 283     } else {
 284       NOTREACHED();
 285     }
 286   }
 287   oauth_request_.reset();
 288 }
 289
 290 void ChromeSigninClient::OnOAuthError() {
 291   // Ignore the failure.  It's not essential and we'll try again next time.
 292     oauth_request_.reset();
 293 }
 294
 295 void ChromeSigninClient::OnNetworkError(int response_code) {
 296   // Ignore the failure.  It's not essential and we'll try again next time.
 297     oauth_request_.reset();
 298 }
 299
 300 void ChromeSigninClient::OnGetTokenSuccess(
 301     const OAuth2TokenService::Request* request,
 302     const std::string& access_token,
 303     const base::Time& expiration_time) {
 304   // Exchange the access token for a handle that can be used for later
 305   // verification that the token is still valid (i.e. the password has not
 306   // been changed).
 307     if (!oauth_client_) {
 308         oauth_client_.reset(new gaia::GaiaOAuthClient(
 309             profile_->GetRequestContext()));
 310     }
 311     oauth_client_->GetTokenInfo(access_token, 3 /* retries */, this);
 312 }
 313
 314 void ChromeSigninClient::OnGetTokenFailure(
 315     const OAuth2TokenService::Request* request,
 316     const GoogleServiceAuthError& error) {
 317   // Ignore the failure.  It's not essential and we'll try again next time.
 318   oauth_request_.reset();
 319 }
 320
 321 #if !defined(OS_CHROMEOS)
 322 void ChromeSigninClient::OnNetworkChanged(
 323     net::NetworkChangeNotifier::ConnectionType type) {
 324   if (type >= net::NetworkChangeNotifier::ConnectionType::CONNECTION_NONE)
 325     return;
 326
 327   for (const base::Closure& callback : delayed_callbacks_)
 328     callback.Run();
 329
 330   delayed_callbacks_.clear();
 331 }
 332 #endif
 333
 334 void ChromeSigninClient::DelayNetworkCall(const base::Closure& callback) {
 335 #if defined(OS_CHROMEOS)
 336   chromeos::DelayNetworkCall(
 337       base::TimeDelta::FromMilliseconds(chromeos::kDefaultNetworkRetryDelayMS),
 338       callback);
 339   return;
 340 #else
 341   // Don't bother if we don't have any kind of network connection.
 342   if (net::NetworkChangeNotifier::IsOffline()) {
 343     delayed_callbacks_.push_back(callback);
 344   } else {
 345     callback.Run();
 346   }
 347 #endif
 348 }
 349
 350 GaiaAuthFetcher* ChromeSigninClient::CreateGaiaAuthFetcher(
 351     GaiaAuthConsumer* consumer,
 352     const std::string& source,
 353     net::URLRequestContextGetter* getter) {
 354   return new GaiaAuthFetcher(consumer, source, getter);
 355 }
 356
 357 void ChromeSigninClient::MaybeFetchSigninTokenHandle() {
 358 #if !defined(OS_ANDROID) && !defined(OS_IOS) && !defined(OS_CHROMEOS)
 359   // We get a "handle" that can be used to reference the signin token on the
 360   // server.  We fetch this if we don't have one so that later we can check
 361   // it to know if the signin token to which it is attached has been revoked
 362   // and thus distinguish between a password mismatch due to the password
 363   // being changed and the user simply mis-typing it.
 364   if (profiles::IsLockAvailable(profile_)) {
 365     ProfileInfoCache& info_cache =
 366         g_browser_process->profile_manager()->GetProfileInfoCache();
 367     size_t index = info_cache.GetIndexOfProfileWithPath(profile_->GetPath());
 368     std::string token = info_cache.GetPasswordChangeDetectionTokenAtIndex(
 369         index);
 370     std::string account = profile_->GetProfileUserName();
 371     if (token.empty() && !oauth_request_) {
 372       // If we don't have a token for detecting a password change, create one.
 373       ProfileOAuth2TokenService* token_service =
 374           ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
 375       OAuth2TokenService::ScopeSet scopes;
 376       scopes.insert(GaiaConstants::kGoogleUserInfoEmail);
 377       oauth_request_ = token_service->StartRequest(account, scopes, this);
 378     }
 379   }
 380 #endif
 381 }