Home | History | Annotate | Download | only in policy 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_USER_CLOUD_POLICY_MANAGER_CHROMEOS_H_
      6 #define CHROME_BROWSER_CHROMEOS_POLICY_USER_CLOUD_POLICY_MANAGER_CHROMEOS_H_
      7 
      8 #include <string>
      9 
     10 #include "base/basictypes.h"
     11 #include "base/compiler_specific.h"
     12 #include "base/files/file_path.h"
     13 #include "base/memory/ref_counted.h"
     14 #include "base/memory/scoped_ptr.h"
     15 #include "base/time/time.h"
     16 #include "base/timer/timer.h"
     17 #include "components/keyed_service/core/keyed_service.h"
     18 #include "components/policy/core/common/cloud/cloud_policy_client.h"
     19 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
     20 #include "components/policy/core/common/cloud/cloud_policy_manager.h"
     21 #include "components/policy/core/common/cloud/cloud_policy_service.h"
     22 
     23 class GoogleServiceAuthError;
     24 class PrefService;
     25 
     26 namespace base {
     27 class SequencedTaskRunner;
     28 }
     29 
     30 namespace net {
     31 class URLRequestContextGetter;
     32 }
     33 
     34 namespace policy {
     35 
     36 class CloudExternalDataManager;
     37 class DeviceManagementService;
     38 class PolicyOAuth2TokenFetcher;
     39 class WildcardLoginChecker;
     40 
     41 // UserCloudPolicyManagerChromeOS implements logic for initializing user policy
     42 // on Chrome OS.
     43 class UserCloudPolicyManagerChromeOS : public CloudPolicyManager,
     44                                        public CloudPolicyClient::Observer,
     45                                        public CloudPolicyService::Observer,
     46                                        public KeyedService {
     47  public:
     48   // If |wait_for_policy_fetch| is true, IsInitializationComplete() will return
     49   // false as long as there hasn't been a successful policy fetch.
     50   // |task_runner| is the runner for policy refresh tasks.
     51   // |file_task_runner| is used for file operations. Currently this must be the
     52   // FILE BrowserThread.
     53   // |io_task_runner| is used for network IO. Currently this must be the IO
     54   // BrowserThread.
     55   UserCloudPolicyManagerChromeOS(
     56       scoped_ptr<CloudPolicyStore> store,
     57       scoped_ptr<CloudExternalDataManager> external_data_manager,
     58       const base::FilePath& component_policy_cache_path,
     59       bool wait_for_policy_fetch,
     60       base::TimeDelta initial_policy_fetch_timeout,
     61       const scoped_refptr<base::SequencedTaskRunner>& task_runner,
     62       const scoped_refptr<base::SequencedTaskRunner>& file_task_runner,
     63       const scoped_refptr<base::SequencedTaskRunner>& io_task_runner);
     64   virtual ~UserCloudPolicyManagerChromeOS();
     65 
     66   // Initializes the cloud connection. |local_state| and
     67   // |device_management_service| must stay valid until this object is deleted.
     68   void Connect(
     69       PrefService* local_state,
     70       DeviceManagementService* device_management_service,
     71       scoped_refptr<net::URLRequestContextGetter> system_request_context,
     72       UserAffiliation user_affiliation);
     73 
     74   // This class is one of the policy providers, and must be ready for the
     75   // creation of the Profile's PrefService; all the other
     76   // KeyedServices depend on the PrefService, so this class can't
     77   // depend on other BCKS to avoid a circular dependency. So instead of using
     78   // the ProfileOAuth2TokenService directly to get the access token, a 3rd
     79   // service (UserCloudPolicyTokenForwarder) will fetch it later and pass it
     80   // to this method once available.
     81   // The |access_token| can then be used to authenticate the registration
     82   // request to the DMServer.
     83   void OnAccessTokenAvailable(const std::string& access_token);
     84 
     85   // Returns true if the underlying CloudPolicyClient is already registered.
     86   bool IsClientRegistered() const;
     87 
     88   // Indicates a wildcard login check should be performed once an access token
     89   // is available.
     90   void EnableWildcardLoginCheck(const std::string& username);
     91 
     92   // ConfigurationPolicyProvider:
     93   virtual void Shutdown() OVERRIDE;
     94   virtual bool IsInitializationComplete(PolicyDomain domain) const OVERRIDE;
     95 
     96   // CloudPolicyService::Observer:
     97   virtual void OnInitializationCompleted(CloudPolicyService* service) OVERRIDE;
     98 
     99   // CloudPolicyClient::Observer:
    100   virtual void OnPolicyFetched(CloudPolicyClient* client) OVERRIDE;
    101   virtual void OnRegistrationStateChanged(CloudPolicyClient* client) OVERRIDE;
    102   virtual void OnClientError(CloudPolicyClient* client) OVERRIDE;
    103 
    104   // ComponentCloudPolicyService::Delegate:
    105   virtual void OnComponentCloudPolicyUpdated() OVERRIDE;
    106 
    107  protected:
    108   // CloudPolicyManager:
    109   virtual void GetChromePolicy(PolicyMap* policy_map) OVERRIDE;
    110 
    111  private:
    112   // Fetches a policy token using the authentication context of the signin
    113   // Profile, and calls back to OnOAuth2PolicyTokenFetched when done.
    114   void FetchPolicyOAuthTokenUsingSigninProfile();
    115 
    116   // Called once the policy access token is available, and starts the
    117   // registration with the policy server if the token was successfully fetched.
    118   void OnOAuth2PolicyTokenFetched(const std::string& policy_token,
    119                                   const GoogleServiceAuthError& error);
    120 
    121   // Completion handler for the explicit policy fetch triggered on startup in
    122   // case |wait_for_policy_fetch_| is true. |success| is true if the fetch was
    123   // successful.
    124   void OnInitialPolicyFetchComplete(bool success);
    125 
    126   // Called when |policy_fetch_timeout_| times out, to cancel the blocking
    127   // wait for the initial policy fetch.
    128   void OnBlockingFetchTimeout();
    129 
    130   // Cancels waiting for the policy fetch and flags the
    131   // ConfigurationPolicyProvider ready (assuming all other initialization tasks
    132   // have completed).
    133   void CancelWaitForPolicyFetch();
    134 
    135   void StartRefreshSchedulerIfReady();
    136 
    137   // Owns the store, note that CloudPolicyManager just keeps a plain pointer.
    138   scoped_ptr<CloudPolicyStore> store_;
    139 
    140   // Manages external data referenced by policies.
    141   scoped_ptr<CloudExternalDataManager> external_data_manager_;
    142 
    143   // Username for the wildcard login check if applicable, empty otherwise.
    144   std::string wildcard_username_;
    145 
    146   // Path where policy for components will be cached.
    147   base::FilePath component_policy_cache_path_;
    148 
    149   // Whether to wait for a policy fetch to complete before reporting
    150   // IsInitializationComplete().
    151   bool wait_for_policy_fetch_;
    152 
    153   // A timer that puts a hard limit on the maximum time to wait for the initial
    154   // policy fetch.
    155   base::Timer policy_fetch_timeout_;
    156 
    157   // The pref service to pass to the refresh scheduler on initialization.
    158   PrefService* local_state_;
    159 
    160   // Used to fetch the policy OAuth token, when necessary. This object holds
    161   // a callback with an unretained reference to the manager, when it exists.
    162   scoped_ptr<PolicyOAuth2TokenFetcher> token_fetcher_;
    163 
    164   // Keeps alive the wildcard checker while its running.
    165   scoped_ptr<WildcardLoginChecker> wildcard_login_checker_;
    166 
    167   // The access token passed to OnAccessTokenAvailable. It is stored here so
    168   // that it can be used if OnInitializationCompleted is called later.
    169   std::string access_token_;
    170 
    171   // Timestamps for collecting timing UMA stats.
    172   base::Time time_init_started_;
    173   base::Time time_init_completed_;
    174   base::Time time_token_available_;
    175   base::Time time_client_registered_;
    176 
    177   DISALLOW_COPY_AND_ASSIGN(UserCloudPolicyManagerChromeOS);
    178 };
    179 
    180 }  // namespace policy
    181 
    182 #endif  // CHROME_BROWSER_CHROMEOS_POLICY_USER_CLOUD_POLICY_MANAGER_CHROMEOS_H_
    183