chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
   6
   7 #include "base/basictypes.h"
   8 #include "base/compiler_specific.h"
   9 #include "base/memory/scoped_ptr.h"
  10 #include "base/message_loop/message_loop.h"
  11 #include "base/prefs/pref_registry_simple.h"
  12 #include "base/prefs/testing_pref_service.h"
  13 #include "base/run_loop.h"
  14 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
  15 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
  16 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
  17 #include "chrome/browser/chromeos/settings/cros_settings.h"
  18 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
  19 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
  20 #include "chrome/browser/chromeos/settings/device_settings_service.h"
  21 #include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
  22 #include "chrome/browser/prefs/browser_prefs.h"
  23 #include "chrome/test/base/testing_browser_process.h"
  24 #include "chromeos/cryptohome/system_salt_getter.h"
  25 #include "chromeos/dbus/dbus_client_implementation_type.h"
  26 #include "chromeos/dbus/dbus_thread_manager.h"
  27 #include "chromeos/system/mock_statistics_provider.h"
  28 #include "chromeos/system/statistics_provider.h"
  29 #include "components/policy/core/common/cloud/cloud_policy_client.h"
  30 #include "components/policy/core/common/cloud/mock_device_management_service.h"
  31 #include "components/policy/core/common/external_data_fetcher.h"
  32 #include "components/policy/core/common/schema_registry.h"
  33 #include "google_apis/gaia/gaia_oauth_client.h"
  34 #include "net/url_request/test_url_fetcher_factory.h"
  35 #include "net/url_request/url_request_test_util.h"
  36 #include "policy/policy_constants.h"
  37 #include "policy/proto/device_management_backend.pb.h"
  38 #include "testing/gmock/include/gmock/gmock.h"
  39 #include "testing/gtest/include/gtest/gtest.h"
  40
  41 using testing::AnyNumber;
  42 using testing::AtMost;
  43 using testing::DoAll;
  44 using testing::Mock;
  45 using testing::Return;
  46 using testing::SaveArg;
  47 using testing::SetArgumentPointee;
  48 using testing::_;
  49
  50 namespace em = enterprise_management;
  51
  52 namespace policy {
  53 namespace {
  54
  55 void CopyLockResult(base::RunLoop* loop,
  56                     EnterpriseInstallAttributes::LockResult* out,
  57                     EnterpriseInstallAttributes::LockResult result) {
  58   *out = result;
  59   loop->Quit();
  60 }
  61
  62 void CopyTokenService(chromeos::DeviceOAuth2TokenService** out_token_service,
  63                       chromeos::DeviceOAuth2TokenService* in_token_service) {
  64   *out_token_service = in_token_service;
  65 }
  66
  67 class DeviceCloudPolicyManagerChromeOSTest
  68     : public chromeos::DeviceSettingsTestBase {
  69  protected:
  70   DeviceCloudPolicyManagerChromeOSTest() : store_(NULL) {
  71     EXPECT_CALL(mock_statistics_provider_,
  72                 GetMachineStatistic(_, _))
  73         .WillRepeatedly(Return(false));
  74     EXPECT_CALL(mock_statistics_provider_,
  75                 GetMachineStatistic("serial_number", _))
  76         .WillRepeatedly(DoAll(SetArgumentPointee<1>(std::string("test_sn")),
  77                               Return(true)));
  78     chromeos::system::StatisticsProvider::SetTestProvider(
  79         &mock_statistics_provider_);
  80   }
  81
  82   virtual ~DeviceCloudPolicyManagerChromeOSTest() {
  83     chromeos::system::StatisticsProvider::SetTestProvider(NULL);
  84   }
  85
  86   virtual void SetUp() OVERRIDE {
  87     DeviceSettingsTestBase::SetUp();
  88
  89     // DBusThreadManager is set up in DeviceSettingsTestBase::SetUp().
  90     install_attributes_.reset(new EnterpriseInstallAttributes(
  91         chromeos::DBusThreadManager::Get()->GetCryptohomeClient()));
  92     store_ = new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
  93                                                 install_attributes_.get(),
  94                                                 loop_.message_loop_proxy());
  95     manager_.reset(new DeviceCloudPolicyManagerChromeOS(
  96         make_scoped_ptr(store_),
  97         loop_.message_loop_proxy(),
  98         loop_.message_loop_proxy(),
  99         install_attributes_.get()));
 100
 101     chrome::RegisterLocalState(local_state_.registry());
 102     manager_->Init(&schema_registry_);
 103
 104     // DeviceOAuth2TokenService uses the system request context to fetch
 105     // OAuth tokens, then writes the token to local state, encrypting it
 106     // first with methods in CryptohomeTokenEncryptor.
 107     request_context_getter_ = new net::TestURLRequestContextGetter(
 108         loop_.message_loop_proxy());
 109     TestingBrowserProcess::GetGlobal()->SetSystemRequestContext(
 110         request_context_getter_.get());
 111     TestingBrowserProcess::GetGlobal()->SetLocalState(&local_state_);
 112     // SystemSaltGetter is used in DeviceOAuth2TokenServiceFactory.
 113     chromeos::SystemSaltGetter::Initialize();
 114     chromeos::DeviceOAuth2TokenServiceFactory::Initialize();
 115     url_fetcher_response_code_ = 200;
 116     url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
 117                                    "\"expires_in\":1234,"
 118                                    "\"refresh_token\":\"refreshToken4Test\"}";
 119   }
 120
 121   virtual void TearDown() OVERRIDE {
 122     manager_->Shutdown();
 123     DeviceSettingsTestBase::TearDown();
 124
 125     chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
 126     chromeos::SystemSaltGetter::Shutdown();
 127     TestingBrowserProcess::GetGlobal()->SetLocalState(NULL);
 128   }
 129
 130   void LockDevice() {
 131     base::RunLoop loop;
 132     EnterpriseInstallAttributes::LockResult result;
 133     install_attributes_->LockDevice(
 134         PolicyBuilder::kFakeUsername,
 135         DEVICE_MODE_ENTERPRISE,
 136         PolicyBuilder::kFakeDeviceId,
 137         base::Bind(&CopyLockResult, &loop, &result));
 138     loop.Run();
 139     ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
 140   }
 141
 142   void VerifyPolicyPopulated() {
 143     PolicyBundle bundle;
 144     bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
 145         .Set(key::kDeviceMetricsReportingEnabled,
 146              POLICY_LEVEL_MANDATORY,
 147              POLICY_SCOPE_MACHINE,
 148              base::Value::CreateBooleanValue(false),
 149              NULL);
 150     EXPECT_TRUE(manager_->policies().Equals(bundle));
 151   }
 152
 153   scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
 154
 155   scoped_refptr<net::URLRequestContextGetter> request_context_getter_;
 156   net::TestURLFetcherFactory url_fetcher_factory_;
 157   int url_fetcher_response_code_;
 158   string url_fetcher_response_string_;
 159   TestingPrefServiceSimple local_state_;
 160   MockDeviceManagementService device_management_service_;
 161   chromeos::ScopedTestDeviceSettingsService test_device_settings_service_;
 162   chromeos::ScopedTestCrosSettings test_cros_settings_;
 163   chromeos::system::MockStatisticsProvider mock_statistics_provider_;
 164
 165   DeviceCloudPolicyStoreChromeOS* store_;
 166   SchemaRegistry schema_registry_;
 167   scoped_ptr<DeviceCloudPolicyManagerChromeOS> manager_;
 168
 169  private:
 170   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSTest);
 171 };
 172
 173 TEST_F(DeviceCloudPolicyManagerChromeOSTest, FreshDevice) {
 174   owner_key_util_->Clear();
 175   FlushDeviceSettings();
 176   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 177
 178   manager_->Connect(&local_state_,
 179                     &device_management_service_,
 180                     scoped_ptr<CloudPolicyClient::StatusProvider>());
 181
 182   PolicyBundle bundle;
 183   EXPECT_TRUE(manager_->policies().Equals(bundle));
 184 }
 185
 186 TEST_F(DeviceCloudPolicyManagerChromeOSTest, EnrolledDevice) {
 187   LockDevice();
 188   FlushDeviceSettings();
 189   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
 190   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 191   VerifyPolicyPopulated();
 192
 193   manager_->Connect(&local_state_,
 194                     &device_management_service_,
 195                     scoped_ptr<CloudPolicyClient::StatusProvider>());
 196   VerifyPolicyPopulated();
 197
 198   manager_->Shutdown();
 199   VerifyPolicyPopulated();
 200
 201   EXPECT_EQ(manager_->GetRobotAccountId(),
 202             PolicyBuilder::kFakeServiceAccountIdentity);
 203 }
 204
 205 TEST_F(DeviceCloudPolicyManagerChromeOSTest, UnmanagedDevice) {
 206   device_policy_.policy_data().set_state(em::PolicyData::UNMANAGED);
 207   device_policy_.Build();
 208   device_settings_test_helper_.set_policy_blob(device_policy_.GetBlob());
 209
 210   LockDevice();
 211   FlushDeviceSettings();
 212   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 213   EXPECT_FALSE(store_->is_managed());
 214
 215   // Policy settings should be ignored for UNMANAGED devices.
 216   PolicyBundle bundle;
 217   EXPECT_TRUE(manager_->policies().Equals(bundle));
 218
 219   manager_->Connect(&local_state_,
 220                     &device_management_service_,
 221                     scoped_ptr<CloudPolicyClient::StatusProvider>());
 222
 223   // Trigger a policy refresh.
 224   MockDeviceManagementJob* policy_fetch_job = NULL;
 225   EXPECT_CALL(device_management_service_,
 226               CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
 227       .Times(AtMost(1))
 228       .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
 229   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 230       .Times(AtMost(1));
 231   manager_->RefreshPolicies();
 232   Mock::VerifyAndClearExpectations(&device_management_service_);
 233   ASSERT_TRUE(policy_fetch_job);
 234
 235   // Switch back to ACTIVE, service the policy fetch and let it propagate.
 236   device_policy_.policy_data().set_state(em::PolicyData::ACTIVE);
 237   device_policy_.Build();
 238   device_settings_test_helper_.set_policy_blob(device_policy_.GetBlob());
 239   em::DeviceManagementResponse policy_fetch_response;
 240   policy_fetch_response.mutable_policy_response()->add_response()->CopyFrom(
 241       device_policy_.policy());
 242   policy_fetch_job->SendResponse(DM_STATUS_SUCCESS, policy_fetch_response);
 243   FlushDeviceSettings();
 244
 245   // Policy state should now be active and the policy map should be populated.
 246   EXPECT_TRUE(store_->is_managed());
 247   VerifyPolicyPopulated();
 248 }
 249
 250 TEST_F(DeviceCloudPolicyManagerChromeOSTest, ConsumerDevice) {
 251   FlushDeviceSettings();
 252   EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
 253   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 254
 255   PolicyBundle bundle;
 256   EXPECT_TRUE(manager_->policies().Equals(bundle));
 257
 258   manager_->Connect(&local_state_,
 259                     &device_management_service_,
 260                     scoped_ptr<CloudPolicyClient::StatusProvider>());
 261   EXPECT_TRUE(manager_->policies().Equals(bundle));
 262
 263   manager_->Shutdown();
 264   EXPECT_TRUE(manager_->policies().Equals(bundle));
 265 }
 266
 267 class DeviceCloudPolicyManagerChromeOSEnrollmentTest
 268     : public DeviceCloudPolicyManagerChromeOSTest {
 269  public:
 270   void Done(EnrollmentStatus status) {
 271     status_ = status;
 272     done_ = true;
 273   }
 274
 275  protected:
 276   DeviceCloudPolicyManagerChromeOSEnrollmentTest()
 277       : is_auto_enrollment_(false),
 278         register_status_(DM_STATUS_SUCCESS),
 279         policy_fetch_status_(DM_STATUS_SUCCESS),
 280         robot_auth_fetch_status_(DM_STATUS_SUCCESS),
 281         store_result_(true),
 282         status_(EnrollmentStatus::ForStatus(EnrollmentStatus::STATUS_SUCCESS)),
 283         done_(false) {}
 284
 285   virtual void SetUp() OVERRIDE {
 286     DeviceCloudPolicyManagerChromeOSTest::SetUp();
 287
 288     // Set up test data.
 289     device_policy_.SetDefaultNewSigningKey();
 290     device_policy_.policy_data().set_timestamp(
 291         (base::Time::NowFromSystemTime() -
 292          base::Time::UnixEpoch()).InMilliseconds());
 293     device_policy_.Build();
 294
 295     register_response_.mutable_register_response()->set_device_management_token(
 296         PolicyBuilder::kFakeToken);
 297     policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
 298         device_policy_.policy());
 299     robot_auth_fetch_response_.mutable_service_api_access_response()
 300         ->set_auth_code("auth_code_for_test");
 301     loaded_blob_ = device_policy_.GetBlob();
 302
 303     // Initialize the manager.
 304     FlushDeviceSettings();
 305     EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
 306     EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 307
 308     PolicyBundle bundle;
 309     EXPECT_TRUE(manager_->policies().Equals(bundle));
 310
 311     manager_->Connect(&local_state_,
 312                       &device_management_service_,
 313                       scoped_ptr<CloudPolicyClient::StatusProvider>());
 314   }
 315
 316   void ExpectFailedEnrollment(EnrollmentStatus::Status status) {
 317     EXPECT_EQ(status, status_.status());
 318     EXPECT_FALSE(store_->is_managed());
 319     PolicyBundle empty_bundle;
 320     EXPECT_TRUE(manager_->policies().Equals(empty_bundle));
 321   }
 322
 323   void ExpectSuccessfulEnrollment() {
 324     EXPECT_EQ(EnrollmentStatus::STATUS_SUCCESS, status_.status());
 325     EXPECT_EQ(DEVICE_MODE_ENTERPRISE, install_attributes_->GetMode());
 326     EXPECT_TRUE(store_->has_policy());
 327     EXPECT_TRUE(store_->is_managed());
 328     ASSERT_TRUE(manager_->core()->client());
 329     EXPECT_TRUE(manager_->core()->client()->is_registered());
 330
 331     VerifyPolicyPopulated();
 332   }
 333
 334   void RunTest() {
 335     // Trigger enrollment.
 336     MockDeviceManagementJob* register_job = NULL;
 337     EXPECT_CALL(device_management_service_,
 338                 CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION, _))
 339         .Times(AtMost(1))
 340         .WillOnce(device_management_service_.CreateAsyncJob(&register_job));
 341     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 342         .Times(AtMost(1))
 343         .WillOnce(DoAll(SaveArg<5>(&client_id_),
 344                         SaveArg<6>(&register_request_)));
 345     DeviceCloudPolicyManagerChromeOS::AllowedDeviceModes modes;
 346     modes[DEVICE_MODE_ENTERPRISE] = true;
 347     manager_->StartEnrollment(
 348         "auth token", is_auto_enrollment_, modes,
 349         base::Bind(&DeviceCloudPolicyManagerChromeOSEnrollmentTest::Done,
 350                    base::Unretained(this)));
 351     Mock::VerifyAndClearExpectations(&device_management_service_);
 352
 353     if (done_)
 354       return;
 355
 356     // Process registration.
 357     ASSERT_TRUE(register_job);
 358     MockDeviceManagementJob* policy_fetch_job = NULL;
 359     EXPECT_CALL(device_management_service_,
 360                 CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
 361         .Times(AtMost(1))
 362         .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
 363     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 364         .Times(AtMost(1));
 365     register_job->SendResponse(register_status_, register_response_);
 366     Mock::VerifyAndClearExpectations(&device_management_service_);
 367
 368     if (done_)
 369       return;
 370
 371     // Process policy fetch.
 372     ASSERT_TRUE(policy_fetch_job);
 373     policy_fetch_job->SendResponse(policy_fetch_status_,
 374                                    policy_fetch_response_);
 375
 376     if (done_)
 377       return;
 378
 379     // Process verification.
 380     MockDeviceManagementJob* robot_auth_fetch_job = NULL;
 381     EXPECT_CALL(device_management_service_, CreateJob(
 382         DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH, _))
 383         .Times(AtMost(1))
 384         .WillOnce(device_management_service_.CreateAsyncJob(
 385             &robot_auth_fetch_job));
 386     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 387         .Times(AtMost(1));
 388     base::RunLoop().RunUntilIdle();
 389     Mock::VerifyAndClearExpectations(&device_management_service_);
 390
 391     if (done_)
 392       return;
 393
 394     // Process robot auth token fetch.
 395     ASSERT_TRUE(robot_auth_fetch_job);
 396     robot_auth_fetch_job->SendResponse(robot_auth_fetch_status_,
 397                                        robot_auth_fetch_response_);
 398     Mock::VerifyAndClearExpectations(&device_management_service_);
 399
 400     if (done_)
 401       return;
 402
 403     // Process robot refresh token fetch if the auth code fetch succeeded.
 404     // DeviceCloudPolicyManagerChromeOS holds an EnrollmentHandlerChromeOS which
 405     // holds a GaiaOAuthClient that fetches the refresh token during enrollment.
 406     // We return a successful OAuth response via a TestURLFetcher to trigger the
 407     // happy path for these classes so that enrollment can continue.
 408     if (robot_auth_fetch_status_ == DM_STATUS_SUCCESS) {
 409       net::TestURLFetcher* url_fetcher = url_fetcher_factory_.GetFetcherByID(
 410           gaia::GaiaOAuthClient::kUrlFetcherId);
 411       ASSERT_TRUE(url_fetcher);
 412       url_fetcher->SetMaxRetriesOn5xx(0);
 413       url_fetcher->set_status(net::URLRequestStatus());
 414       url_fetcher->set_response_code(url_fetcher_response_code_);
 415       url_fetcher->SetResponseString(url_fetcher_response_string_);
 416       url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
 417     }
 418     base::RunLoop().RunUntilIdle();
 419
 420     if (done_)
 421       return;
 422
 423     // Process robot refresh token store.
 424     chromeos::DeviceOAuth2TokenService* token_service = NULL;
 425     chromeos::DeviceOAuth2TokenServiceFactory::Get(
 426         base::Bind(&CopyTokenService, &token_service));
 427     base::RunLoop().RunUntilIdle();
 428     ASSERT_TRUE(token_service);
 429     EXPECT_EQ("refreshToken4Test", token_service->GetRefreshToken(""));
 430
 431     // Process policy store.
 432     device_settings_test_helper_.set_store_result(store_result_);
 433     device_settings_test_helper_.FlushStore();
 434     EXPECT_EQ(device_policy_.GetBlob(),
 435               device_settings_test_helper_.policy_blob());
 436
 437     if (done_)
 438       return;
 439
 440     // Key installation and policy load.
 441     device_settings_test_helper_.set_policy_blob(loaded_blob_);
 442     owner_key_util_->SetPublicKeyFromPrivateKey(
 443         *device_policy_.GetNewSigningKey());
 444     ReloadDeviceSettings();
 445   }
 446
 447   bool is_auto_enrollment_;
 448
 449   DeviceManagementStatus register_status_;
 450   em::DeviceManagementResponse register_response_;
 451
 452   DeviceManagementStatus policy_fetch_status_;
 453   em::DeviceManagementResponse policy_fetch_response_;
 454
 455   DeviceManagementStatus robot_auth_fetch_status_;
 456   em::DeviceManagementResponse robot_auth_fetch_response_;
 457
 458   bool store_result_;
 459   std::string loaded_blob_;
 460
 461   em::DeviceManagementRequest register_request_;
 462   std::string client_id_;
 463   EnrollmentStatus status_;
 464
 465   bool done_;
 466
 467  private:
 468   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSEnrollmentTest);
 469 };
 470
 471 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
 472   RunTest();
 473   ExpectSuccessfulEnrollment();
 474 }
 475
 476 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, AutoEnrollment) {
 477   is_auto_enrollment_ = true;
 478   RunTest();
 479   ExpectSuccessfulEnrollment();
 480   EXPECT_TRUE(register_request_.register_request().auto_enrolled());
 481 }
 482
 483 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
 484   LockDevice();
 485
 486   RunTest();
 487   ExpectSuccessfulEnrollment();
 488   EXPECT_TRUE(register_request_.register_request().reregister());
 489   EXPECT_EQ(PolicyBuilder::kFakeDeviceId, client_id_);
 490 }
 491
 492 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RegistrationFailed) {
 493   register_status_ = DM_STATUS_REQUEST_FAILED;
 494   RunTest();
 495   ExpectFailedEnrollment(EnrollmentStatus::STATUS_REGISTRATION_FAILED);
 496   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 497 }
 498
 499 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 500        RobotAuthCodeFetchFailed) {
 501   robot_auth_fetch_status_ = DM_STATUS_REQUEST_FAILED;
 502   RunTest();
 503   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_AUTH_FETCH_FAILED);
 504 }
 505
 506 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 507        RobotRefreshTokenFetchResponseCodeFailed) {
 508   url_fetcher_response_code_ = 400;
 509   RunTest();
 510   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
 511   EXPECT_EQ(400, status_.http_status());
 512 }
 513
 514 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 515        RobotRefreshTokenFetchResponseStringFailed) {
 516   url_fetcher_response_string_ = "invalid response json";
 517   RunTest();
 518   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
 519 }
 520
 521 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RobotRefreshSaveFailed) {
 522   // Without a DeviceOAuth2TokenService, the refresh token can't be saved.
 523   chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
 524   RunTest();
 525   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 526 }
 527
 528 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 529        RobotRefreshEncryptionFailed) {
 530   // The encryption lib is a noop for tests, but empty results from encryption
 531   // is an error, so we simulate an encryption error by returning an empty
 532   // refresh token.
 533   url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
 534                                  "\"expires_in\":1234,"
 535                                  "\"refresh_token\":\"\"}";
 536   RunTest();
 537   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 538 }
 539
 540 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, PolicyFetchFailed) {
 541   policy_fetch_status_ = DM_STATUS_REQUEST_FAILED;
 542   RunTest();
 543   ExpectFailedEnrollment(EnrollmentStatus::STATUS_POLICY_FETCH_FAILED);
 544   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 545 }
 546
 547 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, ValidationFailed) {
 548   device_policy_.policy().set_policy_data_signature("bad");
 549   policy_fetch_response_.clear_policy_response();
 550   policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
 551       device_policy_.policy());
 552   RunTest();
 553   ExpectFailedEnrollment(EnrollmentStatus::STATUS_VALIDATION_FAILED);
 554   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
 555             status_.validation_status());
 556 }
 557
 558 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, StoreError) {
 559   store_result_ = false;
 560   RunTest();
 561   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
 562   EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR,
 563             status_.store_status());
 564 }
 565
 566 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
 567   loaded_blob_.clear();
 568   RunTest();
 569   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
 570   EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR,
 571             status_.store_status());
 572 }
 573
 574 }  // namespace
 575 }  // namespace policy