device_cloud_policy_manager_chromeos_unittest.cc revision 8bcbed890bc3ce4d7a057a8f32cab53fa534672e 
1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
6
7#include "base/basictypes.h"
8#include "base/compiler_specific.h"
9#include "base/memory/scoped_ptr.h"
10#include "base/message_loop/message_loop.h"
11#include "base/prefs/pref_registry_simple.h"
12#include "base/prefs/testing_pref_service.h"
13#include "base/run_loop.h"
14#include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
15#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
16#include "chrome/browser/chromeos/settings/cros_settings.h"
17#include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
18#include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
19#include "chrome/browser/chromeos/settings/device_settings_service.h"
20#include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
21#include "chrome/browser/policy/cloud/cloud_policy_client.h"
22#include "chrome/browser/policy/cloud/mock_device_management_service.h"
23#include "chrome/browser/policy/external_data_fetcher.h"
24#include "chrome/browser/policy/proto/chromeos/chrome_device_policy.pb.h"
25#include "chrome/browser/policy/proto/cloud/device_management_backend.pb.h"
26#include "chrome/browser/prefs/browser_prefs.h"
27#include "chrome/test/base/testing_browser_process.h"
28#include "chromeos/cryptohome/system_salt_getter.h"
29#include "chromeos/dbus/dbus_client_implementation_type.h"
30#include "chromeos/dbus/dbus_thread_manager.h"
31#include "chromeos/system/mock_statistics_provider.h"
32#include "chromeos/system/statistics_provider.h"
33#include "google_apis/gaia/gaia_oauth_client.h"
34#include "net/url_request/test_url_fetcher_factory.h"
35#include "net/url_request/url_request_test_util.h"
36#include "policy/policy_constants.h"
37#include "testing/gmock/include/gmock/gmock.h"
38#include "testing/gtest/include/gtest/gtest.h"
39
40using testing::AnyNumber;
41using testing::AtMost;
42using testing::DoAll;
43using testing::Mock;
44using testing::Return;
45using testing::SaveArg;
46using testing::SetArgumentPointee;
47using testing::_;
48
49namespace em = enterprise_management;
50
51namespace policy {
52namespace {
53
54void CopyLockResult(base::RunLoop* loop,
55                    EnterpriseInstallAttributes::LockResult* out,
56                    EnterpriseInstallAttributes::LockResult result) {
57  *out = result;
58  loop->Quit();
59}
60
61class DeviceCloudPolicyManagerChromeOSTest
62    : public chromeos::DeviceSettingsTestBase {
63 protected:
64  DeviceCloudPolicyManagerChromeOSTest() : store_(NULL) {
65    EXPECT_CALL(mock_statistics_provider_,
66                GetMachineStatistic(_, _))
67        .WillRepeatedly(Return(false));
68    EXPECT_CALL(mock_statistics_provider_,
69                GetMachineStatistic("serial_number", _))
70        .WillRepeatedly(DoAll(SetArgumentPointee<1>(std::string("test_sn")),
71                              Return(true)));
72    chromeos::system::StatisticsProvider::SetTestProvider(
73        &mock_statistics_provider_);
74  }
75
76  virtual ~DeviceCloudPolicyManagerChromeOSTest() {
77    chromeos::system::StatisticsProvider::SetTestProvider(NULL);
78  }
79
80  virtual void SetUp() OVERRIDE {
81    DeviceSettingsTestBase::SetUp();
82
83    // DBusThreadManager is set up in DeviceSettingsTestBase::SetUp().
84    install_attributes_.reset(new EnterpriseInstallAttributes(
85        chromeos::DBusThreadManager::Get()->GetCryptohomeClient()));
86    store_ = new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
87                                                install_attributes_.get(),
88                                                loop_.message_loop_proxy());
89    manager_.reset(new DeviceCloudPolicyManagerChromeOS(
90        make_scoped_ptr(store_),
91        loop_.message_loop_proxy(),
92        loop_.message_loop_proxy(),
93        install_attributes_.get()));
94
95    chrome::RegisterLocalState(local_state_.registry());
96    manager_->Init();
97
98    // DeviceOAuth2TokenService uses the system request context to fetch
99    // OAuth tokens, then writes the token to local state, encrypting it
100    // first with methods in CryptohomeTokenEncryptor.
101    request_context_getter_ = new net::TestURLRequestContextGetter(
102        loop_.message_loop_proxy());
103    TestingBrowserProcess::GetGlobal()->SetSystemRequestContext(
104        request_context_getter_.get());
105    TestingBrowserProcess::GetGlobal()->SetLocalState(&local_state_);
106    chromeos::DeviceOAuth2TokenServiceFactory::Initialize();
107    // This is needed as SystemSaltGetter is used for encrypting tokens in
108    // CryptohomeTokenEncryptor.
109    chromeos::SystemSaltGetter::Initialize();
110    url_fetcher_response_code_ = 200;
111    url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
112                                   "\"expires_in\":1234,"
113                                   "\"refresh_token\":\"refreshToken4Test\"}";
114  }
115
116  virtual void TearDown() OVERRIDE {
117    manager_->Shutdown();
118    DeviceSettingsTestBase::TearDown();
119
120    chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
121    chromeos::SystemSaltGetter::Shutdown();
122    TestingBrowserProcess::GetGlobal()->SetLocalState(NULL);
123  }
124
125  scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
126
127  scoped_refptr<net::URLRequestContextGetter> request_context_getter_;
128  net::TestURLFetcherFactory url_fetcher_factory_;
129  int url_fetcher_response_code_;
130  string url_fetcher_response_string_;
131  TestingPrefServiceSimple local_state_;
132  MockDeviceManagementService device_management_service_;
133  chromeos::ScopedTestDeviceSettingsService test_device_settings_service_;
134  chromeos::ScopedTestCrosSettings test_cros_settings_;
135  chromeos::system::MockStatisticsProvider mock_statistics_provider_;
136
137  DeviceCloudPolicyStoreChromeOS* store_;
138  scoped_ptr<DeviceCloudPolicyManagerChromeOS> manager_;
139
140 private:
141  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSTest);
142};
143
144TEST_F(DeviceCloudPolicyManagerChromeOSTest, FreshDevice) {
145  owner_key_util_->Clear();
146  FlushDeviceSettings();
147  EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
148
149  manager_->Connect(&local_state_,
150                    &device_management_service_,
151                    scoped_ptr<CloudPolicyClient::StatusProvider>());
152
153  PolicyBundle bundle;
154  EXPECT_TRUE(manager_->policies().Equals(bundle));
155}
156
157TEST_F(DeviceCloudPolicyManagerChromeOSTest, EnrolledDevice) {
158  base::RunLoop loop;
159  EnterpriseInstallAttributes::LockResult result;
160  install_attributes_->LockDevice(PolicyBuilder::kFakeUsername,
161                                  DEVICE_MODE_ENTERPRISE,
162                                  PolicyBuilder::kFakeDeviceId,
163                                  base::Bind(&CopyLockResult, &loop, &result));
164  loop.Run();
165  ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
166
167  FlushDeviceSettings();
168  EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
169  EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
170
171  PolicyBundle bundle;
172  bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
173      .Set(key::kDeviceMetricsReportingEnabled,
174           POLICY_LEVEL_MANDATORY,
175           POLICY_SCOPE_MACHINE,
176           Value::CreateBooleanValue(false),
177           NULL);
178  EXPECT_TRUE(manager_->policies().Equals(bundle));
179
180  manager_->Connect(&local_state_,
181                    &device_management_service_,
182                    scoped_ptr<CloudPolicyClient::StatusProvider>());
183  EXPECT_TRUE(manager_->policies().Equals(bundle));
184
185  manager_->Shutdown();
186  EXPECT_TRUE(manager_->policies().Equals(bundle));
187
188  EXPECT_EQ(manager_->GetRobotAccountId(),
189            PolicyBuilder::kFakeServiceAccountIdentity);
190}
191
192TEST_F(DeviceCloudPolicyManagerChromeOSTest, ConsumerDevice) {
193  FlushDeviceSettings();
194  EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
195  EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
196
197  PolicyBundle bundle;
198  EXPECT_TRUE(manager_->policies().Equals(bundle));
199
200  manager_->Connect(&local_state_,
201                    &device_management_service_,
202                    scoped_ptr<CloudPolicyClient::StatusProvider>());
203  EXPECT_TRUE(manager_->policies().Equals(bundle));
204
205  manager_->Shutdown();
206  EXPECT_TRUE(manager_->policies().Equals(bundle));
207}
208
209class DeviceCloudPolicyManagerChromeOSEnrollmentTest
210    : public DeviceCloudPolicyManagerChromeOSTest {
211 public:
212  void Done(EnrollmentStatus status) {
213    status_ = status;
214    done_ = true;
215  }
216
217 protected:
218  DeviceCloudPolicyManagerChromeOSEnrollmentTest()
219      : is_auto_enrollment_(false),
220        register_status_(DM_STATUS_SUCCESS),
221        policy_fetch_status_(DM_STATUS_SUCCESS),
222        robot_auth_fetch_status_(DM_STATUS_SUCCESS),
223        store_result_(true),
224        status_(EnrollmentStatus::ForStatus(EnrollmentStatus::STATUS_SUCCESS)),
225        done_(false) {}
226
227  virtual void SetUp() OVERRIDE {
228    DeviceCloudPolicyManagerChromeOSTest::SetUp();
229
230    // Set up test data.
231    device_policy_.SetDefaultNewSigningKey();
232    device_policy_.policy_data().set_timestamp(
233        (base::Time::NowFromSystemTime() -
234         base::Time::UnixEpoch()).InMilliseconds());
235    device_policy_.Build();
236
237    register_response_.mutable_register_response()->set_device_management_token(
238        PolicyBuilder::kFakeToken);
239    policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
240        device_policy_.policy());
241    robot_auth_fetch_response_.mutable_service_api_access_response()
242        ->set_auth_code("auth_code_for_test");
243    loaded_blob_ = device_policy_.GetBlob();
244
245    // Initialize the manager.
246    FlushDeviceSettings();
247    EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
248    EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
249
250    PolicyBundle bundle;
251    EXPECT_TRUE(manager_->policies().Equals(bundle));
252
253    manager_->Connect(&local_state_,
254                      &device_management_service_,
255                      scoped_ptr<CloudPolicyClient::StatusProvider>());
256  }
257
258  void ExpectFailedEnrollment(EnrollmentStatus::Status status) {
259    EXPECT_EQ(status, status_.status());
260    EXPECT_FALSE(store_->is_managed());
261    PolicyBundle empty_bundle;
262    EXPECT_TRUE(manager_->policies().Equals(empty_bundle));
263  }
264
265  void ExpectSuccessfulEnrollment() {
266    EXPECT_EQ(EnrollmentStatus::STATUS_SUCCESS, status_.status());
267    EXPECT_EQ(DEVICE_MODE_ENTERPRISE, install_attributes_->GetMode());
268    EXPECT_TRUE(store_->has_policy());
269    EXPECT_TRUE(store_->is_managed());
270    ASSERT_TRUE(manager_->core()->client());
271    EXPECT_TRUE(manager_->core()->client()->is_registered());
272
273    PolicyBundle bundle;
274    bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
275        .Set(key::kDeviceMetricsReportingEnabled,
276             POLICY_LEVEL_MANDATORY,
277             POLICY_SCOPE_MACHINE,
278             Value::CreateBooleanValue(false),
279             NULL);
280    EXPECT_TRUE(manager_->policies().Equals(bundle));
281  }
282
283  void RunTest() {
284    // Trigger enrollment.
285    MockDeviceManagementJob* register_job = NULL;
286    EXPECT_CALL(device_management_service_,
287                CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION))
288        .Times(AtMost(1))
289        .WillOnce(device_management_service_.CreateAsyncJob(&register_job));
290    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
291        .Times(AtMost(1))
292        .WillOnce(DoAll(SaveArg<5>(&client_id_),
293                        SaveArg<6>(&register_request_)));
294    DeviceCloudPolicyManagerChromeOS::AllowedDeviceModes modes;
295    modes[DEVICE_MODE_ENTERPRISE] = true;
296    manager_->StartEnrollment(
297        "auth token", is_auto_enrollment_, modes,
298        base::Bind(&DeviceCloudPolicyManagerChromeOSEnrollmentTest::Done,
299                   base::Unretained(this)));
300    Mock::VerifyAndClearExpectations(&device_management_service_);
301
302    if (done_)
303      return;
304
305    // Process registration.
306    ASSERT_TRUE(register_job);
307    MockDeviceManagementJob* policy_fetch_job = NULL;
308    EXPECT_CALL(device_management_service_,
309                CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH))
310        .Times(AtMost(1))
311        .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
312    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
313        .Times(AtMost(1));
314    register_job->SendResponse(register_status_, register_response_);
315    Mock::VerifyAndClearExpectations(&device_management_service_);
316
317    if (done_)
318      return;
319
320    // Process policy fetch.
321    ASSERT_TRUE(policy_fetch_job);
322    policy_fetch_job->SendResponse(policy_fetch_status_,
323                                   policy_fetch_response_);
324
325    if (done_)
326      return;
327
328    // Process verification.
329    MockDeviceManagementJob* robot_auth_fetch_job = NULL;
330    EXPECT_CALL(device_management_service_,
331                CreateJob(DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH))
332        .Times(AtMost(1))
333        .WillOnce(device_management_service_.CreateAsyncJob(
334            &robot_auth_fetch_job));
335    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
336        .Times(AtMost(1));
337    base::RunLoop().RunUntilIdle();
338    Mock::VerifyAndClearExpectations(&device_management_service_);
339
340    if (done_)
341      return;
342
343    // Process robot auth token fetch.
344    ASSERT_TRUE(robot_auth_fetch_job);
345    robot_auth_fetch_job->SendResponse(robot_auth_fetch_status_,
346                                       robot_auth_fetch_response_);
347    Mock::VerifyAndClearExpectations(&device_management_service_);
348
349    if (done_)
350      return;
351
352    // Process robot refresh token fetch if the auth code fetch succeeded.
353    // DeviceCloudPolicyManagerChromeOS holds an EnrollmentHandlerChromeOS which
354    // holds a GaiaOAuthClient that fetches the refresh token during enrollment.
355    // We return a successful OAuth response via a TestURLFetcher to trigger the
356    // happy path for these classes so that enrollment can continue.
357    if (robot_auth_fetch_status_ == DM_STATUS_SUCCESS) {
358      net::TestURLFetcher* url_fetcher = url_fetcher_factory_.GetFetcherByID(
359          gaia::GaiaOAuthClient::kUrlFetcherId);
360      ASSERT_TRUE(url_fetcher);
361      url_fetcher->SetMaxRetriesOn5xx(0);
362      url_fetcher->set_status(net::URLRequestStatus());
363      url_fetcher->set_response_code(url_fetcher_response_code_);
364      url_fetcher->SetResponseString(url_fetcher_response_string_);
365      url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
366    }
367    base::RunLoop().RunUntilIdle();
368
369    // Process policy store.
370    device_settings_test_helper_.set_store_result(store_result_);
371    device_settings_test_helper_.FlushStore();
372    EXPECT_EQ(device_policy_.GetBlob(),
373              device_settings_test_helper_.policy_blob());
374
375    if (done_)
376      return;
377
378    // Key installation, policy load and refresh token save.
379    device_settings_test_helper_.set_policy_blob(loaded_blob_);
380    owner_key_util_->SetPublicKeyFromPrivateKey(
381        *device_policy_.GetNewSigningKey());
382    ReloadDeviceSettings();
383
384    if (done_)
385      return;
386
387    chromeos::DeviceOAuth2TokenService* token_service =
388        chromeos::DeviceOAuth2TokenServiceFactory::Get();
389    // Process robot refresh token store.
390    EXPECT_EQ(
391        "refreshToken4Test",
392        token_service->GetRefreshToken(token_service->GetRobotAccountId()));
393  }
394
395  bool is_auto_enrollment_;
396
397  DeviceManagementStatus register_status_;
398  em::DeviceManagementResponse register_response_;
399
400  DeviceManagementStatus policy_fetch_status_;
401  em::DeviceManagementResponse policy_fetch_response_;
402
403  DeviceManagementStatus robot_auth_fetch_status_;
404  em::DeviceManagementResponse robot_auth_fetch_response_;
405
406  bool store_result_;
407  std::string loaded_blob_;
408
409  em::DeviceManagementRequest register_request_;
410  std::string client_id_;
411  EnrollmentStatus status_;
412
413  bool done_;
414
415 private:
416  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSEnrollmentTest);
417};
418
419TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
420  RunTest();
421  ExpectSuccessfulEnrollment();
422}
423
424TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, AutoEnrollment) {
425  is_auto_enrollment_ = true;
426  RunTest();
427  ExpectSuccessfulEnrollment();
428  EXPECT_TRUE(register_request_.register_request().auto_enrolled());
429}
430
431TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
432  base::RunLoop loop;
433  EnterpriseInstallAttributes::LockResult result;
434  install_attributes_->LockDevice(PolicyBuilder::kFakeUsername,
435                                  DEVICE_MODE_ENTERPRISE,
436                                  PolicyBuilder::kFakeDeviceId,
437                                  base::Bind(&CopyLockResult, &loop, &result));
438  loop.Run();
439  ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
440
441  RunTest();
442  ExpectSuccessfulEnrollment();
443  EXPECT_TRUE(register_request_.register_request().reregister());
444  EXPECT_EQ(PolicyBuilder::kFakeDeviceId, client_id_);
445}
446
447TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RegistrationFailed) {
448  register_status_ = DM_STATUS_REQUEST_FAILED;
449  RunTest();
450  ExpectFailedEnrollment(EnrollmentStatus::STATUS_REGISTRATION_FAILED);
451  EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
452}
453
454// Policy server implementations are not required to support robot auth
455// tokens, so the following 4 Robot* tests verify that enrollment succeeds
456// even if the robot auth token fetch fails.
457TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
458       RobotAuthCodeFetchFailed) {
459  robot_auth_fetch_status_ = DM_STATUS_REQUEST_FAILED;
460  RunTest();
461  ExpectSuccessfulEnrollment();
462}
463
464TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
465       RobotRefreshTokenFetchResponseCodeFailed) {
466  url_fetcher_response_code_ = 400;
467  RunTest();
468  ExpectSuccessfulEnrollment();
469}
470
471TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
472       RobotRefreshTokenFetchResponseStringFailed) {
473  url_fetcher_response_string_ = "invalid response json";
474  RunTest();
475  ExpectSuccessfulEnrollment();
476}
477
478TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RobotRefreshSaveFailed) {
479  // Without a DeviceOAuth2TokenService, the refresh token can't be saved.
480  chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
481  RunTest();
482  ExpectSuccessfulEnrollment();
483}
484
485TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, PolicyFetchFailed) {
486  policy_fetch_status_ = DM_STATUS_REQUEST_FAILED;
487  RunTest();
488  ExpectFailedEnrollment(EnrollmentStatus::STATUS_POLICY_FETCH_FAILED);
489  EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
490}
491
492TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, ValidationFailed) {
493  device_policy_.policy().set_policy_data_signature("bad");
494  policy_fetch_response_.clear_policy_response();
495  policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
496      device_policy_.policy());
497  RunTest();
498  ExpectFailedEnrollment(EnrollmentStatus::STATUS_VALIDATION_FAILED);
499  EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
500            status_.validation_status());
501}
502
503TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, StoreError) {
504  store_result_ = false;
505  RunTest();
506  ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
507  EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR,
508            status_.store_status());
509}
510
511TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
512  loaded_blob_.clear();
513  RunTest();
514  ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
515  EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR,
516            status_.store_status());
517}
518
519}  // namespace
520}  // namespace policy
521