device_cloud_policy_manager_chromeos_unittest.cc revision 1e9bf3e0803691d0a228da41fc608347b6db4340 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
6
7#include "base/basictypes.h"
8#include "base/compiler_specific.h"
9#include "base/memory/scoped_ptr.h"
10#include "base/message_loop/message_loop.h"
11#include "base/prefs/pref_registry_simple.h"
12#include "base/prefs/testing_pref_service.h"
13#include "base/run_loop.h"
14#include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
15#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
16#include "chrome/browser/chromeos/settings/cros_settings.h"
17#include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
18#include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
19#include "chrome/browser/chromeos/settings/device_settings_service.h"
20#include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
21#include "chrome/browser/policy/cloud/cloud_policy_client.h"
22#include "chrome/browser/policy/cloud/mock_device_management_service.h"
23#include "chrome/browser/policy/external_data_fetcher.h"
24#include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h"
25#include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
26#include "chrome/browser/prefs/browser_prefs.h"
27#include "chrome/test/base/testing_browser_process.h"
28#include "chromeos/cryptohome/system_salt_getter.h"
29#include "chromeos/dbus/dbus_client_implementation_type.h"
30#include "chromeos/dbus/dbus_thread_manager.h"
31#include "chromeos/system/mock_statistics_provider.h"
32#include "chromeos/system/statistics_provider.h"
33#include "google_apis/gaia/gaia_oauth_client.h"
34#include "net/url_request/test_url_fetcher_factory.h"
35#include "net/url_request/url_request_test_util.h"
36#include "policy/policy_constants.h"
37#include "testing/gmock/include/gmock/gmock.h"
38#include "testing/gtest/include/gtest/gtest.h"
39
40using testing::AnyNumber;
41using testing::AtMost;
42using testing::DoAll;
43using testing::Mock;
44using testing::Return;
45using testing::SaveArg;
46using testing::SetArgumentPointee;
47using testing::_;
48
49namespace em = enterprise_management;
50
51namespace policy {
52namespace {
53
54void CopyLockResult(base::RunLoop* loop,
55                    EnterpriseInstallAttributes::LockResult* out,
56                    EnterpriseInstallAttributes::LockResult result) {
57  *out = result;
58  loop->Quit();
59}
60
61void CopyTokenService(chromeos::DeviceOAuth2TokenService** out_token_service,
62                      chromeos::DeviceOAuth2TokenService* in_token_service) {
63  *out_token_service = in_token_service;
64}
65
66class DeviceCloudPolicyManagerChromeOSTest
67    : public chromeos::DeviceSettingsTestBase {
68 protected:
69  DeviceCloudPolicyManagerChromeOSTest() : store_(NULL) {
70    EXPECT_CALL(mock_statistics_provider_,
71                GetMachineStatistic(_, _))
72        .WillRepeatedly(Return(false));
73    EXPECT_CALL(mock_statistics_provider_,
74                GetMachineStatistic("serial_number", _))
75        .WillRepeatedly(DoAll(SetArgumentPointee<1>(std::string("test_sn")),
76                              Return(true)));
77    chromeos::system::StatisticsProvider::SetTestProvider(
78        &mock_statistics_provider_);
79  }
80
81  virtual ~DeviceCloudPolicyManagerChromeOSTest() {
82    chromeos::system::StatisticsProvider::SetTestProvider(NULL);
83  }
84
85  virtual void SetUp() OVERRIDE {
86    DeviceSettingsTestBase::SetUp();
87
88    // DBusThreadManager is set up in DeviceSettingsTestBase::SetUp().
89    install_attributes_.reset(new EnterpriseInstallAttributes(
90        chromeos::DBusThreadManager::Get()->GetCryptohomeClient()));
91    store_ = new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
92                                                install_attributes_.get(),
93                                                loop_.message_loop_proxy());
94    manager_.reset(new DeviceCloudPolicyManagerChromeOS(
95        make_scoped_ptr(store_),
96        loop_.message_loop_proxy(),
97        loop_.message_loop_proxy(),
98        install_attributes_.get()));
99
100    chrome::RegisterLocalState(local_state_.registry());
101    manager_->Init();
102
103    // DeviceOAuth2TokenService uses the system request context to fetch
104    // OAuth tokens, then writes the token to local state, encrypting it
105    // first with methods in CryptohomeTokenEncryptor.
106    request_context_getter_ = new net::TestURLRequestContextGetter(
107        loop_.message_loop_proxy());
108    TestingBrowserProcess::GetGlobal()->SetSystemRequestContext(
109        request_context_getter_.get());
110    TestingBrowserProcess::GetGlobal()->SetLocalState(&local_state_);
111    // SystemSaltGetter is used in DeviceOAuth2TokenServiceFactory.
112    chromeos::SystemSaltGetter::Initialize();
113    chromeos::DeviceOAuth2TokenServiceFactory::Initialize();
114    url_fetcher_response_code_ = 200;
115    url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
116                                   "\"expires_in\":1234,"
117                                   "\"refresh_token\":\"refreshToken4Test\"}";
118  }
119
120  virtual void TearDown() OVERRIDE {
121    manager_->Shutdown();
122    DeviceSettingsTestBase::TearDown();
123
124    chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
125    chromeos::SystemSaltGetter::Shutdown();
126    TestingBrowserProcess::GetGlobal()->SetLocalState(NULL);
127  }
128
129  scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
130
131  scoped_refptr<net::URLRequestContextGetter> request_context_getter_;
132  net::TestURLFetcherFactory url_fetcher_factory_;
133  int url_fetcher_response_code_;
134  string url_fetcher_response_string_;
135  TestingPrefServiceSimple local_state_;
136  MockDeviceManagementService device_management_service_;
137  chromeos::ScopedTestDeviceSettingsService test_device_settings_service_;
138  chromeos::ScopedTestCrosSettings test_cros_settings_;
139  chromeos::system::MockStatisticsProvider mock_statistics_provider_;
140
141  DeviceCloudPolicyStoreChromeOS* store_;
142  scoped_ptr<DeviceCloudPolicyManagerChromeOS> manager_;
143
144 private:
145  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSTest);
146};
147
148TEST_F(DeviceCloudPolicyManagerChromeOSTest, FreshDevice) {
149  owner_key_util_->Clear();
150  FlushDeviceSettings();
151  EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
152
153  manager_->Connect(&local_state_,
154                    &device_management_service_,
155                    scoped_ptr<CloudPolicyClient::StatusProvider>());
156
157  PolicyBundle bundle;
158  EXPECT_TRUE(manager_->policies().Equals(bundle));
159}
160
161TEST_F(DeviceCloudPolicyManagerChromeOSTest, EnrolledDevice) {
162  base::RunLoop loop;
163  EnterpriseInstallAttributes::LockResult result;
164  install_attributes_->LockDevice(PolicyBuilder::kFakeUsername,
165                                  DEVICE_MODE_ENTERPRISE,
166                                  PolicyBuilder::kFakeDeviceId,
167                                  base::Bind(&CopyLockResult, &loop, &result));
168  loop.Run();
169  ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
170
171  FlushDeviceSettings();
172  EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
173  EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
174
175  PolicyBundle bundle;
176  bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
177      .Set(key::kDeviceMetricsReportingEnabled,
178           POLICY_LEVEL_MANDATORY,
179           POLICY_SCOPE_MACHINE,
180           Value::CreateBooleanValue(false),
181           NULL);
182  EXPECT_TRUE(manager_->policies().Equals(bundle));
183
184  manager_->Connect(&local_state_,
185                    &device_management_service_,
186                    scoped_ptr<CloudPolicyClient::StatusProvider>());
187  EXPECT_TRUE(manager_->policies().Equals(bundle));
188
189  manager_->Shutdown();
190  EXPECT_TRUE(manager_->policies().Equals(bundle));
191
192  EXPECT_EQ(manager_->GetRobotAccountId(),
193            PolicyBuilder::kFakeServiceAccountIdentity);
194}
195
196TEST_F(DeviceCloudPolicyManagerChromeOSTest, ConsumerDevice) {
197  FlushDeviceSettings();
198  EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
199  EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
200
201  PolicyBundle bundle;
202  EXPECT_TRUE(manager_->policies().Equals(bundle));
203
204  manager_->Connect(&local_state_,
205                    &device_management_service_,
206                    scoped_ptr<CloudPolicyClient::StatusProvider>());
207  EXPECT_TRUE(manager_->policies().Equals(bundle));
208
209  manager_->Shutdown();
210  EXPECT_TRUE(manager_->policies().Equals(bundle));
211}
212
213class DeviceCloudPolicyManagerChromeOSEnrollmentTest
214    : public DeviceCloudPolicyManagerChromeOSTest {
215 public:
216  void Done(EnrollmentStatus status) {
217    status_ = status;
218    done_ = true;
219  }
220
221 protected:
222  DeviceCloudPolicyManagerChromeOSEnrollmentTest()
223      : is_auto_enrollment_(false),
224        register_status_(DM_STATUS_SUCCESS),
225        policy_fetch_status_(DM_STATUS_SUCCESS),
226        robot_auth_fetch_status_(DM_STATUS_SUCCESS),
227        store_result_(true),
228        status_(EnrollmentStatus::ForStatus(EnrollmentStatus::STATUS_SUCCESS)),
229        done_(false) {}
230
231  virtual void SetUp() OVERRIDE {
232    DeviceCloudPolicyManagerChromeOSTest::SetUp();
233
234    // Set up test data.
235    device_policy_.SetDefaultNewSigningKey();
236    device_policy_.policy_data().set_timestamp(
237        (base::Time::NowFromSystemTime() -
238         base::Time::UnixEpoch()).InMilliseconds());
239    device_policy_.Build();
240
241    register_response_.mutable_register_response()->set_device_management_token(
242        PolicyBuilder::kFakeToken);
243    policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
244        device_policy_.policy());
245    robot_auth_fetch_response_.mutable_service_api_access_response()
246        ->set_auth_code("auth_code_for_test");
247    loaded_blob_ = device_policy_.GetBlob();
248
249    // Initialize the manager.
250    FlushDeviceSettings();
251    EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
252    EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
253
254    PolicyBundle bundle;
255    EXPECT_TRUE(manager_->policies().Equals(bundle));
256
257    manager_->Connect(&local_state_,
258                      &device_management_service_,
259                      scoped_ptr<CloudPolicyClient::StatusProvider>());
260  }
261
262  void ExpectFailedEnrollment(EnrollmentStatus::Status status) {
263    EXPECT_EQ(status, status_.status());
264    EXPECT_FALSE(store_->is_managed());
265    PolicyBundle empty_bundle;
266    EXPECT_TRUE(manager_->policies().Equals(empty_bundle));
267  }
268
269  void ExpectSuccessfulEnrollment() {
270    EXPECT_EQ(EnrollmentStatus::STATUS_SUCCESS, status_.status());
271    EXPECT_EQ(DEVICE_MODE_ENTERPRISE, install_attributes_->GetMode());
272    EXPECT_TRUE(store_->has_policy());
273    EXPECT_TRUE(store_->is_managed());
274    ASSERT_TRUE(manager_->core()->client());
275    EXPECT_TRUE(manager_->core()->client()->is_registered());
276
277    PolicyBundle bundle;
278    bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
279        .Set(key::kDeviceMetricsReportingEnabled,
280             POLICY_LEVEL_MANDATORY,
281             POLICY_SCOPE_MACHINE,
282             Value::CreateBooleanValue(false),
283             NULL);
284    EXPECT_TRUE(manager_->policies().Equals(bundle));
285  }
286
287  void RunTest() {
288    // Trigger enrollment.
289    MockDeviceManagementJob* register_job = NULL;
290    EXPECT_CALL(device_management_service_,
291                CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION))
292        .Times(AtMost(1))
293        .WillOnce(device_management_service_.CreateAsyncJob(&register_job));
294    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
295        .Times(AtMost(1))
296        .WillOnce(DoAll(SaveArg<5>(&client_id_),
297                        SaveArg<6>(&register_request_)));
298    DeviceCloudPolicyManagerChromeOS::AllowedDeviceModes modes;
299    modes[DEVICE_MODE_ENTERPRISE] = true;
300    manager_->StartEnrollment(
301        "auth token", is_auto_enrollment_, modes,
302        base::Bind(&DeviceCloudPolicyManagerChromeOSEnrollmentTest::Done,
303                   base::Unretained(this)));
304    Mock::VerifyAndClearExpectations(&device_management_service_);
305
306    if (done_)
307      return;
308
309    // Process registration.
310    ASSERT_TRUE(register_job);
311    MockDeviceManagementJob* policy_fetch_job = NULL;
312    EXPECT_CALL(device_management_service_,
313                CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH))
314        .Times(AtMost(1))
315        .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
316    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
317        .Times(AtMost(1));
318    register_job->SendResponse(register_status_, register_response_);
319    Mock::VerifyAndClearExpectations(&device_management_service_);
320
321    if (done_)
322      return;
323
324    // Process policy fetch.
325    ASSERT_TRUE(policy_fetch_job);
326    policy_fetch_job->SendResponse(policy_fetch_status_,
327                                   policy_fetch_response_);
328
329    if (done_)
330      return;
331
332    // Process verification.
333    MockDeviceManagementJob* robot_auth_fetch_job = NULL;
334    EXPECT_CALL(device_management_service_,
335                CreateJob(DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH))
336        .Times(AtMost(1))
337        .WillOnce(device_management_service_.CreateAsyncJob(
338            &robot_auth_fetch_job));
339    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
340        .Times(AtMost(1));
341    base::RunLoop().RunUntilIdle();
342    Mock::VerifyAndClearExpectations(&device_management_service_);
343
344    if (done_)
345      return;
346
347    // Process robot auth token fetch.
348    ASSERT_TRUE(robot_auth_fetch_job);
349    robot_auth_fetch_job->SendResponse(robot_auth_fetch_status_,
350                                       robot_auth_fetch_response_);
351    Mock::VerifyAndClearExpectations(&device_management_service_);
352
353    if (done_)
354      return;
355
356    // Process robot refresh token fetch if the auth code fetch succeeded.
357    // DeviceCloudPolicyManagerChromeOS holds an EnrollmentHandlerChromeOS which
358    // holds a GaiaOAuthClient that fetches the refresh token during enrollment.
359    // We return a successful OAuth response via a TestURLFetcher to trigger the
360    // happy path for these classes so that enrollment can continue.
361    if (robot_auth_fetch_status_ == DM_STATUS_SUCCESS) {
362      net::TestURLFetcher* url_fetcher = url_fetcher_factory_.GetFetcherByID(
363          gaia::GaiaOAuthClient::kUrlFetcherId);
364      ASSERT_TRUE(url_fetcher);
365      url_fetcher->SetMaxRetriesOn5xx(0);
366      url_fetcher->set_status(net::URLRequestStatus());
367      url_fetcher->set_response_code(url_fetcher_response_code_);
368      url_fetcher->SetResponseString(url_fetcher_response_string_);
369      url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
370    }
371    base::RunLoop().RunUntilIdle();
372
373    if (done_)
374      return;
375
376    // Process robot refresh token store.
377    chromeos::DeviceOAuth2TokenService* token_service = NULL;
378    chromeos::DeviceOAuth2TokenServiceFactory::Get(
379        base::Bind(&CopyTokenService, &token_service));
380    base::RunLoop().RunUntilIdle();
381    ASSERT_TRUE(token_service);
382    EXPECT_EQ("refreshToken4Test", token_service->GetRefreshToken(""));
383
384    // Process policy store.
385    device_settings_test_helper_.set_store_result(store_result_);
386    device_settings_test_helper_.FlushStore();
387    EXPECT_EQ(device_policy_.GetBlob(),
388              device_settings_test_helper_.policy_blob());
389
390    if (done_)
391      return;
392
393    // Key installation and policy load.
394    device_settings_test_helper_.set_policy_blob(loaded_blob_);
395    owner_key_util_->SetPublicKeyFromPrivateKey(
396        *device_policy_.GetNewSigningKey());
397    ReloadDeviceSettings();
398  }
399
400  bool is_auto_enrollment_;
401
402  DeviceManagementStatus register_status_;
403  em::DeviceManagementResponse register_response_;
404
405  DeviceManagementStatus policy_fetch_status_;
406  em::DeviceManagementResponse policy_fetch_response_;
407
408  DeviceManagementStatus robot_auth_fetch_status_;
409  em::DeviceManagementResponse robot_auth_fetch_response_;
410
411  bool store_result_;
412  std::string loaded_blob_;
413
414  em::DeviceManagementRequest register_request_;
415  std::string client_id_;
416  EnrollmentStatus status_;
417
418  bool done_;
419
420 private:
421  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSEnrollmentTest);
422};
423
424TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
425  RunTest();
426  ExpectSuccessfulEnrollment();
427}
428
429TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, AutoEnrollment) {
430  is_auto_enrollment_ = true;
431  RunTest();
432  ExpectSuccessfulEnrollment();
433  EXPECT_TRUE(register_request_.register_request().auto_enrolled());
434}
435
436TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
437  base::RunLoop loop;
438  EnterpriseInstallAttributes::LockResult result;
439  install_attributes_->LockDevice(PolicyBuilder::kFakeUsername,
440                                  DEVICE_MODE_ENTERPRISE,
441                                  PolicyBuilder::kFakeDeviceId,
442                                  base::Bind(&CopyLockResult, &loop, &result));
443  loop.Run();
444  ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
445
446  RunTest();
447  ExpectSuccessfulEnrollment();
448  EXPECT_TRUE(register_request_.register_request().reregister());
449  EXPECT_EQ(PolicyBuilder::kFakeDeviceId, client_id_);
450}
451
452TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RegistrationFailed) {
453  register_status_ = DM_STATUS_REQUEST_FAILED;
454  RunTest();
455  ExpectFailedEnrollment(EnrollmentStatus::STATUS_REGISTRATION_FAILED);
456  EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
457}
458
459TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
460       RobotAuthCodeFetchFailed) {
461  robot_auth_fetch_status_ = DM_STATUS_REQUEST_FAILED;
462  RunTest();
463  ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_AUTH_FETCH_FAILED);
464}
465
466TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
467       RobotRefreshTokenFetchResponseCodeFailed) {
468  url_fetcher_response_code_ = 400;
469  RunTest();
470  ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
471  EXPECT_EQ(400, status_.http_status());
472}
473
474TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
475       RobotRefreshTokenFetchResponseStringFailed) {
476  url_fetcher_response_string_ = "invalid response json";
477  RunTest();
478  ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
479}
480
481TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RobotRefreshSaveFailed) {
482  // Without a DeviceOAuth2TokenService, the refresh token can't be saved.
483  chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
484  RunTest();
485  ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
486}
487
488TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
489       RobotRefreshEncryptionFailed) {
490  // The encryption lib is a noop for tests, but empty results from encryption
491  // is an error, so we simulate an encryption error by returning an empty
492  // refresh token.
493  url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
494                                 "\"expires_in\":1234,"
495                                 "\"refresh_token\":\"\"}";
496  RunTest();
497  ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
498}
499
500TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, PolicyFetchFailed) {
501  policy_fetch_status_ = DM_STATUS_REQUEST_FAILED;
502  RunTest();
503  ExpectFailedEnrollment(EnrollmentStatus::STATUS_POLICY_FETCH_FAILED);
504  EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
505}
506
507TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, ValidationFailed) {
508  device_policy_.policy().set_policy_data_signature("bad");
509  policy_fetch_response_.clear_policy_response();
510  policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
511      device_policy_.policy());
512  RunTest();
513  ExpectFailedEnrollment(EnrollmentStatus::STATUS_VALIDATION_FAILED);
514  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
515            status_.validation_status());
516}
517
518TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, StoreError) {
519  store_result_ = false;
520  RunTest();
521  ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
522  EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR,
523            status_.store_status());
524}
525
526TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
527  loaded_blob_.clear();
528  RunTest();
529  ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
530  EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR,
531            status_.store_status());
532}
533
534}  // namespace
535}  // namespace policy
536