policy_cert_service_factory.cc revision 5d1f7b1de12d16ceb2c938c56701a3e8bfa558f7
1f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// Copyright 2013 The Chromium Authors. All rights reserved. 2f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 3f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// found in the LICENSE file. 4f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 5f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/browser/chromeos/policy/policy_cert_service_factory.h" 6f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 7f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "base/memory/singleton.h" 85d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/prefs/pref_registry_simple.h" 95d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/prefs/pref_service.h" 105d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "base/prefs/scoped_user_pref_update.h" 115d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "chrome/browser/browser_process.h" 125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "chrome/browser/chromeos/login/user_manager.h" 13f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/browser/chromeos/policy/policy_cert_service.h" 14f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/browser/chromeos/policy/policy_cert_verifier.h" 15f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/browser/chromeos/policy/user_network_configuration_updater_factory.h" 165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#include "chrome/browser/lifetime/application_lifetime.h" 17f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/browser/profiles/incognito_helpers.h" 18f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/browser/profiles/profile.h" 19f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "chrome/common/pref_names.h" 20f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "components/browser_context_keyed_service/browser_context_dependency_manager.h" 21f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)#include "components/user_prefs/pref_registry_syncable.h" 22f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 23f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)namespace policy { 24f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 25f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// static 26f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)PolicyCertService* PolicyCertServiceFactory::GetForProfile(Profile* profile) { 27f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return static_cast<PolicyCertService*>( 28f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) GetInstance()->GetServiceForBrowserContext(profile, false)); 29f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 30f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 31f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// static 32f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)scoped_ptr<PolicyCertVerifier> PolicyCertServiceFactory::CreateForProfile( 33f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) Profile* profile) { 34f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DCHECK(!GetInstance()->GetServiceForBrowserContext(profile, false)); 35f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) PolicyCertService* service = static_cast<PolicyCertService*>( 36f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) GetInstance()->GetServiceForBrowserContext(profile, true)); 37f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!service) 38f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return scoped_ptr<PolicyCertVerifier>(); 39f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return service->CreatePolicyCertVerifier(); 40f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 41f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 42f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)// static 43f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)PolicyCertServiceFactory* PolicyCertServiceFactory::GetInstance() { 44f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return Singleton<PolicyCertServiceFactory>::get(); 45f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 46f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 475d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// static 485d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)void PolicyCertServiceFactory::SetUsedPolicyCertificates( 495d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const std::string& user_id) { 505d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (UsedPolicyCertificates(user_id)) 515d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return; 525d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ListPrefUpdate update(g_browser_process->local_state(), 535d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) prefs::kUsedPolicyCertificates); 545d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) update->AppendString(user_id); 555d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 565d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 575d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// static 585d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)void PolicyCertServiceFactory::ClearUsedPolicyCertificates( 595d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const std::string& user_id) { 605d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) ListPrefUpdate update(g_browser_process->local_state(), 615d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) prefs::kUsedPolicyCertificates); 625d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) update->Remove(base::StringValue(user_id), NULL); 635d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 645d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 655d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// static 665d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)bool PolicyCertServiceFactory::UsedPolicyCertificates( 675d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const std::string& user_id) { 685d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) base::StringValue value(user_id); 695d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) const base::ListValue* list = 705d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) g_browser_process->local_state()->GetList(prefs::kUsedPolicyCertificates); 715d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!list) { 725d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) NOTREACHED(); 735d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return false; 745d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 755d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return list->Find(value) != list->end(); 765d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 775d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 785d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// static 795d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)void PolicyCertServiceFactory::RegisterPrefs(PrefRegistrySimple* local_state) { 805d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) local_state->RegisterListPref(prefs::kUsedPolicyCertificates); 815d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 825d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 83f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)PolicyCertServiceFactory::PolicyCertServiceFactory() 84f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) : BrowserContextKeyedServiceFactory( 85f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) "PolicyCertService", 86f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) BrowserContextDependencyManager::GetInstance()) { 87f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) DependsOn(UserNetworkConfigurationUpdaterFactory::GetInstance()); 88f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 89f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 90f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)PolicyCertServiceFactory::~PolicyCertServiceFactory() {} 91f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 92f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)BrowserContextKeyedService* PolicyCertServiceFactory::BuildServiceInstanceFor( 93f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) content::BrowserContext* context) const { 94f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) Profile* profile = static_cast<Profile*>(context); 955d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 965d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) chromeos::UserManager* user_manager = chromeos::UserManager::Get(); 975d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) chromeos::User* user = 985d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) user_manager->GetUserByProfile(profile->GetOriginalProfile()); 995d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!user) 1005d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return NULL; 1015d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1025d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Backwards compatibility: profiles that used policy-pushed certificates used 1035d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // to have this condition marked in their prefs. This signal has moved to 1045d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // local_state though, to support checking it before the profile is loaded. 1055d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Check the profile here and update the local_state, if appropriate. 1065d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // TODO(joaodasilva): remove this, eventually. 1075d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) PrefService* prefs = profile->GetOriginalProfile()->GetPrefs(); 1085d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (prefs->GetBoolean(prefs::kUsedPolicyCertificatesOnce)) { 1095d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) SetUsedPolicyCertificates(user->email()); 1105d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) prefs->ClearPref(prefs::kUsedPolicyCertificatesOnce); 1115d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (user_manager->GetLoggedInUsers().size() > 1u) { 1135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // This login should not have been allowed. After rebooting, local_state 1145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // will contain the updated list of users that used policy-pushed 1155d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // certificates and this won't happen again. 1165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Note that a user becomes logged in before his profile is created. 1175d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) LOG(ERROR) << "Shutdown session because a tainted profile was added."; 1185d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) g_browser_process->local_state()->CommitPendingWrite(); 1195d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) prefs->CommitPendingWrite(); 1205d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) chrome::AttemptUserExit(); 1215d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1225d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) } 1235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 124f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) UserNetworkConfigurationUpdater* net_conf_updater = 125f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) UserNetworkConfigurationUpdaterFactory::GetForProfile(profile); 126f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) if (!net_conf_updater) 127f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return NULL; 128f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 1295d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return new PolicyCertService(user->email(), net_conf_updater, user_manager); 130f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 131f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 132f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)content::BrowserContext* PolicyCertServiceFactory::GetBrowserContextToUse( 133f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) content::BrowserContext* context) const { 134f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return chrome::GetBrowserContextOwnInstanceInIncognito(context); 135f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 136f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 137f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)void PolicyCertServiceFactory::RegisterProfilePrefs( 138f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) user_prefs::PrefRegistrySyncable* registry) { 1395d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // TODO(joaodasilva): this is used for backwards compatibility. 1405d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // Remove once it's not necessary anymore. 141f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) registry->RegisterBooleanPref( 142f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) prefs::kUsedPolicyCertificatesOnce, 143f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) false, 144f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF); 145f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 146f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 147f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)bool PolicyCertServiceFactory::ServiceIsNULLWhileTesting() const { 148f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) return true; 149f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} 150f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles) 151f2477e01787aa58f445919b809d89e252beef54fTorne (Richard Coles)} // namespace policy 152