1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
// Copyright 2016 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/ash/arc/policy/arc_android_management_checker.h"
#include <algorithm>
#include <utility>
#include "base/functional/bind.h"
#include "base/task/single_thread_task_runner.h"
#include "chrome/browser/ash/arc/policy/arc_policy_util.h"
#include "chrome/browser/profiles/profile.h"
#include "components/policy/core/common/cloud/device_management_service.h"
#include "components/signin/public/base/consent_level.h"
#include "components/signin/public/identity_manager/account_managed_status_finder.h"
namespace arc {
namespace {
constexpr base::TimeDelta kRetryDelayMin = base::Seconds(10);
constexpr base::TimeDelta kRetryDelayMax = base::Hours(1);
} // namespace
ArcAndroidManagementChecker::ArcAndroidManagementChecker(
Profile* profile,
signin::IdentityManager* identity_manager,
const CoreAccountId& device_account_id,
bool retry_on_error,
std::unique_ptr<policy::AndroidManagementClient> android_management_client)
: profile_(profile),
identity_manager_(identity_manager),
device_account_id_(device_account_id),
retry_on_error_(retry_on_error),
retry_delay_(kRetryDelayMin),
android_management_client_(std::move(android_management_client)) {}
ArcAndroidManagementChecker::~ArcAndroidManagementChecker() {
identity_manager_->RemoveObserver(this);
}
void ArcAndroidManagementChecker::StartCheck(CheckCallback callback) {
DCHECK(callback_.is_null());
// No need to check Android Management if the user is a Chrome OS managed
// user, or belongs to a well-known non-enterprise domain.
if (policy_util::IsAccountManaged(profile_) ||
!signin::AccountManagedStatusFinder::MayBeEnterpriseUserBasedOnEmail(
profile_->GetProfileUserName())) {
std::move(callback).Run(CheckResult::ALLOWED);
return;
}
callback_ = std::move(callback);
EnsureRefreshTokenLoaded();
}
void ArcAndroidManagementChecker::EnsureRefreshTokenLoaded() {
if (identity_manager_->HasAccountWithRefreshToken(device_account_id_)) {
// If the refresh token is already available, just start the management
// check immediately.
StartCheckInternal();
return;
}
// Set the observer to the token service so the callback will be called
// when the token is loaded.
identity_manager_->AddObserver(this);
}
void ArcAndroidManagementChecker::OnRefreshTokenUpdatedForAccount(
const CoreAccountInfo& account_info) {
if (account_info.account_id != device_account_id_)
return;
OnRefreshTokensLoaded();
}
void ArcAndroidManagementChecker::OnRefreshTokensLoaded() {
identity_manager_->RemoveObserver(this);
StartCheckInternal();
}
void ArcAndroidManagementChecker::StartCheckInternal() {
DCHECK(!callback_.is_null());
if (!identity_manager_->HasAccountWithRefreshToken(device_account_id_)) {
LOG(ERROR) << "No refresh token is available for android management check.";
std::move(callback_).Run(CheckResult::ERROR);
return;
}
VLOG(2) << "Start android management check.";
android_management_client_->StartCheckAndroidManagement(
base::BindOnce(&ArcAndroidManagementChecker::OnAndroidManagementChecked,
weak_ptr_factory_.GetWeakPtr()));
}
void ArcAndroidManagementChecker::OnAndroidManagementChecked(
policy::AndroidManagementClient::Result management_result) {
DCHECK(!callback_.is_null());
VLOG(2) << "Android management check done " << management_result << ".";
if (retry_on_error_ &&
management_result == policy::AndroidManagementClient::Result::ERROR) {
ScheduleRetry();
return;
}
CheckResult check_result = CheckResult::ERROR;
switch (management_result) {
case policy::AndroidManagementClient::Result::MANAGED:
check_result = CheckResult::DISALLOWED;
break;
case policy::AndroidManagementClient::Result::UNMANAGED:
check_result = CheckResult::ALLOWED;
break;
case policy::AndroidManagementClient::Result::ERROR:
check_result = CheckResult::ERROR;
break;
}
std::move(callback_).Run(check_result);
}
void ArcAndroidManagementChecker::ScheduleRetry() {
DCHECK(retry_on_error_);
DCHECK(!callback_.is_null());
VLOG(2) << "Schedule next android management check in " << retry_delay_;
base::SingleThreadTaskRunner::GetCurrentDefault()->PostDelayedTask(
FROM_HERE,
base::BindOnce(&ArcAndroidManagementChecker::StartCheckInternal,
weak_ptr_factory_.GetWeakPtr()),
retry_delay_);
retry_delay_ = std::min(retry_delay_ * 2, kRetryDelayMax);
}
} // namespace arc
|
