1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
|
// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_BROWSER_CHROMEOS_POLICY_ENROLLMENT_HANDLER_CHROMEOS_H_
#define CHROME_BROWSER_CHROMEOS_POLICY_ENROLLMENT_HANDLER_CHROMEOS_H_
#include <string>
#include "base/basictypes.h"
#include "base/compiler_specific.h"
#include "base/memory/ref_counted.h"
#include "base/memory/scoped_ptr.h"
#include "base/memory/weak_ptr.h"
#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
#include "chrome/browser/chromeos/policy/device_cloud_policy_validator.h"
#include "chrome/browser/chromeos/policy/enrollment_config.h"
#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
#include "components/policy/core/common/cloud/cloud_policy_client.h"
#include "components/policy/core/common/cloud/cloud_policy_constants.h"
#include "components/policy/core/common/cloud/cloud_policy_store.h"
#include "google_apis/gaia/gaia_oauth_client.h"
#include "policy/proto/device_management_backend.pb.h"
namespace base {
class SequencedTaskRunner;
}
namespace chromeos {
class DeviceSettingsService;
class OwnerSettingsServiceChromeOS;
}
namespace policy {
class DeviceCloudPolicyStoreChromeOS;
class ServerBackedStateKeysBroker;
// Implements the logic that establishes enterprise enrollment for Chromium OS
// devices. The process is as follows:
// 1. Given an auth token, register with the policy service.
// 2. Download the initial policy blob from the service.
// 3. Verify the policy blob. Everything up to this point doesn't touch device
// state.
// 4. Download the OAuth2 authorization code for device-level API access.
// 5. Download the OAuth2 refresh token for device-level API access and store
// it.
// 6. Establish the device lock in installation-time attributes.
// 7. Store the policy blob and API refresh token.
class EnrollmentHandlerChromeOS : public CloudPolicyClient::Observer,
public CloudPolicyStore::Observer,
public gaia::GaiaOAuthClient::Delegate {
public:
typedef DeviceCloudPolicyInitializer::AllowedDeviceModes
AllowedDeviceModes;
typedef DeviceCloudPolicyInitializer::EnrollmentCallback
EnrollmentCallback;
// |store| and |install_attributes| must remain valid for the life time of the
// enrollment handler. |allowed_device_modes| determines what device modes
// are acceptable. If the mode specified by the server is not acceptable,
// enrollment will fail with an EnrollmentStatus indicating
// STATUS_REGISTRATION_BAD_MODE.
// |management_mode| should be either ENTERPRISE_MANAGED or CONSUMER_MANAGED.
EnrollmentHandlerChromeOS(
DeviceCloudPolicyStoreChromeOS* store,
EnterpriseInstallAttributes* install_attributes,
ServerBackedStateKeysBroker* state_keys_broker,
chromeos::DeviceSettingsService* device_settings_service,
chromeos::OwnerSettingsServiceChromeOS* owner_settings_service,
scoped_ptr<CloudPolicyClient> client,
scoped_refptr<base::SequencedTaskRunner> background_task_runner,
const EnrollmentConfig& enrollment_config,
const std::string& auth_token,
const std::string& client_id,
const std::string& requisition,
const AllowedDeviceModes& allowed_device_modes,
ManagementMode management_mode,
const EnrollmentCallback& completion_callback);
virtual ~EnrollmentHandlerChromeOS();
// Starts the enrollment process and reports the result to
// |completion_callback_|.
void StartEnrollment();
// Releases the client.
scoped_ptr<CloudPolicyClient> ReleaseClient();
// CloudPolicyClient::Observer:
virtual void OnPolicyFetched(CloudPolicyClient* client) override;
virtual void OnRegistrationStateChanged(CloudPolicyClient* client) override;
virtual void OnRobotAuthCodesFetched(CloudPolicyClient* client) override;
virtual void OnClientError(CloudPolicyClient* client) override;
// CloudPolicyStore::Observer:
virtual void OnStoreLoaded(CloudPolicyStore* store) override;
virtual void OnStoreError(CloudPolicyStore* store) override;
// GaiaOAuthClient::Delegate:
virtual void OnGetTokensResponse(const std::string& refresh_token,
const std::string& access_token,
int expires_in_seconds) override;
virtual void OnRefreshTokenResponse(const std::string& access_token,
int expires_in_seconds) override;
virtual void OnOAuthError() override;
virtual void OnNetworkError(int response_code) override;
private:
// Indicates what step of the process is currently pending. These steps need
// to be listed in the order they are traversed in.
enum EnrollmentStep {
STEP_PENDING, // Not started yet.
STEP_STATE_KEYS, // Waiting for state keys to become available.
STEP_LOADING_STORE, // Waiting for |store_| to initialize.
STEP_REGISTRATION, // Currently registering the client.
STEP_POLICY_FETCH, // Fetching policy.
STEP_VALIDATION, // Policy validation.
STEP_ROBOT_AUTH_FETCH, // Fetching device API auth code.
STEP_ROBOT_AUTH_REFRESH, // Fetching device API refresh token.
STEP_LOCK_DEVICE, // Writing installation-time attributes.
STEP_STORE_TOKEN_AND_ID, // Storing DM token and virtual device ID.
STEP_STORE_ROBOT_AUTH, // Encrypting & writing robot refresh token.
STEP_STORE_POLICY, // Storing policy and API refresh token.
STEP_FINISHED, // Enrollment process finished, no further action.
};
// Handles the response to a request for server-backed state keys.
void HandleStateKeysResult(const std::vector<std::string>& state_keys);
// Starts registration if the store is initialized.
void StartRegistration();
// Handles the policy validation result, proceeding with device lock if
// successful.
void HandlePolicyValidationResult(DeviceCloudPolicyValidator* validator);
// Calls InstallAttributes::LockDevice() for enterprise enrollment and
// DeviceSettingsService::SetManagementSettings() for consumer
// enrollment.
void StartLockDevice();
// Called after SetManagementSettings() is done. Proceeds to robot
// auth code storing if successful.
void HandleSetManagementSettingsDone(bool success);
// Handle callback from InstallAttributes::LockDevice() and retry on failure.
void HandleLockDeviceResult(
EnterpriseInstallAttributes::LockResult lock_result);
// Initiates storing of robot auth token.
void StartStoreRobotAuth();
// Handles completion of the robot token store operation.
void HandleStoreRobotAuthTokenResult(bool result);
// Drops any ongoing actions.
void Stop();
// Reports the result of the enrollment process to the initiator.
void ReportResult(EnrollmentStatus status);
DeviceCloudPolicyStoreChromeOS* store_;
EnterpriseInstallAttributes* install_attributes_;
ServerBackedStateKeysBroker* state_keys_broker_;
chromeos::DeviceSettingsService* device_settings_service_;
chromeos::OwnerSettingsServiceChromeOS* owner_settings_service_;
scoped_ptr<CloudPolicyClient> client_;
scoped_refptr<base::SequencedTaskRunner> background_task_runner_;
scoped_ptr<gaia::GaiaOAuthClient> gaia_oauth_client_;
EnrollmentConfig enrollment_config_;
std::string auth_token_;
std::string client_id_;
std::string requisition_;
std::string current_state_key_;
std::string refresh_token_;
AllowedDeviceModes allowed_device_modes_;
ManagementMode management_mode_;
EnrollmentCallback completion_callback_;
// The device mode as received in the registration request.
DeviceMode device_mode_;
// The validated policy response info to be installed in the store.
scoped_ptr<enterprise_management::PolicyFetchResponse> policy_;
std::string username_;
std::string device_id_;
std::string request_token_;
// Current enrollment step.
EnrollmentStep enrollment_step_;
// Total amount of time in milliseconds spent waiting for lockbox
// initialization.
int lockbox_init_duration_;
base::WeakPtrFactory<EnrollmentHandlerChromeOS> weak_ptr_factory_;
DISALLOW_COPY_AND_ASSIGN(EnrollmentHandlerChromeOS);
};
} // namespace policy
#endif // CHROME_BROWSER_CHROMEOS_POLICY_ENROLLMENT_HANDLER_CHROMEOS_H_
|
