src/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
   6
   7 #include <algorithm>
   8
   9 #include "base/basictypes.h"
  10 #include "base/bind.h"
  11 #include "base/bind_helpers.h"
  12 #include "base/compiler_specific.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "base/message_loop/message_loop.h"
  15 #include "base/prefs/pref_registry_simple.h"
  16 #include "base/prefs/testing_pref_service.h"
  17 #include "base/run_loop.h"
  18 #include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
  19 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
  20 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
  21 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
  22 #include "chrome/browser/chromeos/settings/cros_settings.h"
  23 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
  24 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
  25 #include "chrome/browser/chromeos/settings/device_settings_service.h"
  26 #include "chrome/browser/chromeos/settings/device_settings_test_helper.h"
  27 #include "chrome/browser/prefs/browser_prefs.h"
  28 #include "chrome/test/base/testing_browser_process.h"
  29 #include "chromeos/cryptohome/system_salt_getter.h"
  30 #include "chromeos/dbus/dbus_client_implementation_type.h"
  31 #include "chromeos/dbus/dbus_thread_manager.h"
  32 #include "chromeos/dbus/fake_cryptohome_client.h"
  33 #include "chromeos/dbus/fake_session_manager_client.h"
  34 #include "chromeos/system/mock_statistics_provider.h"
  35 #include "chromeos/system/statistics_provider.h"
  36 #include "components/policy/core/common/cloud/cloud_policy_client.h"
  37 #include "components/policy/core/common/cloud/mock_device_management_service.h"
  38 #include "components/policy/core/common/external_data_fetcher.h"
  39 #include "components/policy/core/common/schema_registry.h"
  40 #include "google_apis/gaia/gaia_oauth_client.h"
  41 #include "net/url_request/test_url_fetcher_factory.h"
  42 #include "net/url_request/url_request_test_util.h"
  43 #include "policy/policy_constants.h"
  44 #include "policy/proto/device_management_backend.pb.h"
  45 #include "testing/gmock/include/gmock/gmock.h"
  46 #include "testing/gtest/include/gtest/gtest.h"
  47
  48 using testing::AnyNumber;
  49 using testing::AtMost;
  50 using testing::DoAll;
  51 using testing::Mock;
  52 using testing::Return;
  53 using testing::SaveArg;
  54 using testing::SetArgumentPointee;
  55 using testing::_;
  56
  57 namespace em = enterprise_management;
  58
  59 namespace policy {
  60 namespace {
  61
  62 void CopyLockResult(base::RunLoop* loop,
  63                     EnterpriseInstallAttributes::LockResult* out,
  64                     EnterpriseInstallAttributes::LockResult result) {
  65   *out = result;
  66   loop->Quit();
  67 }
  68
  69 class DeviceCloudPolicyManagerChromeOSTest
  70     : public chromeos::DeviceSettingsTestBase {
  71  protected:
  72   DeviceCloudPolicyManagerChromeOSTest()
  73       : fake_cryptohome_client_(new chromeos::FakeCryptohomeClient()),
  74         state_keys_broker_(&fake_session_manager_client_,
  75                            base::MessageLoopProxy::current()),
  76         store_(NULL) {
  77     EXPECT_CALL(mock_statistics_provider_,
  78                 GetMachineStatistic(_, _))
  79         .WillRepeatedly(Return(false));
  80     EXPECT_CALL(mock_statistics_provider_,
  81                 GetMachineStatistic("serial_number", _))
  82         .WillRepeatedly(DoAll(SetArgumentPointee<1>(std::string("test_sn")),
  83                               Return(true)));
  84     chromeos::system::StatisticsProvider::SetTestProvider(
  85         &mock_statistics_provider_);
  86     std::vector<std::string> state_keys;
  87     state_keys.push_back("1");
  88     state_keys.push_back("2");
  89     state_keys.push_back("3");
  90     fake_session_manager_client_.set_server_backed_state_keys(state_keys);
  91   }
  92
  93   virtual ~DeviceCloudPolicyManagerChromeOSTest() {
  94     chromeos::system::StatisticsProvider::SetTestProvider(NULL);
  95   }
  96
  97   virtual void SetUp() OVERRIDE {
  98     DeviceSettingsTestBase::SetUp();
  99     dbus_setter_->SetCryptohomeClient(
 100         scoped_ptr<chromeos::CryptohomeClient>(fake_cryptohome_client_));
 101
 102     install_attributes_.reset(
 103         new EnterpriseInstallAttributes(fake_cryptohome_client_));
 104     store_ =
 105         new DeviceCloudPolicyStoreChromeOS(&device_settings_service_,
 106                                            install_attributes_.get(),
 107                                            base::MessageLoopProxy::current());
 108     manager_.reset(new DeviceCloudPolicyManagerChromeOS(
 109         make_scoped_ptr(store_),
 110         base::MessageLoopProxy::current(),
 111         &state_keys_broker_));
 112
 113     chrome::RegisterLocalState(local_state_.registry());
 114     manager_->Init(&schema_registry_);
 115
 116     // DeviceOAuth2TokenService uses the system request context to fetch
 117     // OAuth tokens, then writes the token to local state, encrypting it
 118     // first with methods in CryptohomeTokenEncryptor.
 119     request_context_getter_ = new net::TestURLRequestContextGetter(
 120         base::MessageLoopProxy::current());
 121     TestingBrowserProcess::GetGlobal()->SetSystemRequestContext(
 122         request_context_getter_.get());
 123     TestingBrowserProcess::GetGlobal()->SetLocalState(&local_state_);
 124     // SystemSaltGetter is used in DeviceOAuth2TokenService.
 125     chromeos::SystemSaltGetter::Initialize();
 126     chromeos::DeviceOAuth2TokenServiceFactory::Initialize();
 127     url_fetcher_response_code_ = 200;
 128     url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
 129                                    "\"expires_in\":1234,"
 130                                    "\"refresh_token\":\"refreshToken4Test\"}";
 131   }
 132
 133   virtual void TearDown() OVERRIDE {
 134     manager_->Shutdown();
 135     if (initializer_)
 136       initializer_->Shutdown();
 137     DeviceSettingsTestBase::TearDown();
 138
 139     chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
 140     chromeos::SystemSaltGetter::Shutdown();
 141     TestingBrowserProcess::GetGlobal()->SetLocalState(NULL);
 142   }
 143
 144   void LockDevice() {
 145     base::RunLoop loop;
 146     EnterpriseInstallAttributes::LockResult result;
 147     install_attributes_->LockDevice(
 148         PolicyBuilder::kFakeUsername,
 149         DEVICE_MODE_ENTERPRISE,
 150         PolicyBuilder::kFakeDeviceId,
 151         base::Bind(&CopyLockResult, &loop, &result));
 152     loop.Run();
 153     ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
 154   }
 155
 156   void ConnectManager() {
 157     manager_->Initialize(&local_state_);
 158     initializer_.reset(new DeviceCloudPolicyInitializer(
 159         &local_state_,
 160         &device_management_service_,
 161         &consumer_device_management_service_,
 162         base::MessageLoopProxy::current(),
 163         install_attributes_.get(),
 164         &state_keys_broker_,
 165         store_,
 166         manager_.get(),
 167         &device_settings_service_,
 168         base::Bind(&base::DoNothing)));
 169     initializer_->Init();
 170   }
 171
 172   void VerifyPolicyPopulated() {
 173     PolicyBundle bundle;
 174     bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
 175         .Set(key::kDeviceMetricsReportingEnabled,
 176              POLICY_LEVEL_MANDATORY,
 177              POLICY_SCOPE_MACHINE,
 178              new base::FundamentalValue(false),
 179              NULL);
 180     EXPECT_TRUE(manager_->policies().Equals(bundle));
 181   }
 182
 183   scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
 184
 185   scoped_refptr<net::URLRequestContextGetter> request_context_getter_;
 186   net::TestURLFetcherFactory url_fetcher_factory_;
 187   int url_fetcher_response_code_;
 188   string url_fetcher_response_string_;
 189   TestingPrefServiceSimple local_state_;
 190   MockDeviceManagementService device_management_service_;
 191   MockDeviceManagementService consumer_device_management_service_;
 192   chromeos::ScopedTestDeviceSettingsService test_device_settings_service_;
 193   chromeos::ScopedTestCrosSettings test_cros_settings_;
 194   chromeos::system::MockStatisticsProvider mock_statistics_provider_;
 195   chromeos::FakeSessionManagerClient fake_session_manager_client_;
 196   chromeos::FakeCryptohomeClient* fake_cryptohome_client_;
 197   ServerBackedStateKeysBroker state_keys_broker_;
 198
 199   DeviceCloudPolicyStoreChromeOS* store_;
 200   SchemaRegistry schema_registry_;
 201   scoped_ptr<DeviceCloudPolicyManagerChromeOS> manager_;
 202   scoped_ptr<DeviceCloudPolicyInitializer> initializer_;
 203
 204  private:
 205   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSTest);
 206 };
 207
 208 TEST_F(DeviceCloudPolicyManagerChromeOSTest, FreshDevice) {
 209   owner_key_util_->Clear();
 210   FlushDeviceSettings();
 211   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 212
 213   manager_->Initialize(&local_state_);
 214
 215   PolicyBundle bundle;
 216   EXPECT_TRUE(manager_->policies().Equals(bundle));
 217 }
 218
 219 TEST_F(DeviceCloudPolicyManagerChromeOSTest, EnrolledDevice) {
 220   LockDevice();
 221   FlushDeviceSettings();
 222   EXPECT_EQ(CloudPolicyStore::STATUS_OK, store_->status());
 223   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 224   VerifyPolicyPopulated();
 225
 226   ConnectManager();
 227   VerifyPolicyPopulated();
 228
 229   manager_->Shutdown();
 230   VerifyPolicyPopulated();
 231
 232   EXPECT_EQ(store_->policy()->service_account_identity(),
 233             PolicyBuilder::kFakeServiceAccountIdentity);
 234 }
 235
 236 TEST_F(DeviceCloudPolicyManagerChromeOSTest, UnmanagedDevice) {
 237   device_policy_.policy_data().set_state(em::PolicyData::UNMANAGED);
 238   device_policy_.Build();
 239   device_settings_test_helper_.set_policy_blob(device_policy_.GetBlob());
 240
 241   LockDevice();
 242   FlushDeviceSettings();
 243   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 244   EXPECT_FALSE(store_->is_managed());
 245
 246   // Policy settings should be ignored for UNMANAGED devices.
 247   PolicyBundle bundle;
 248   EXPECT_TRUE(manager_->policies().Equals(bundle));
 249
 250   // Trigger a policy refresh.
 251   MockDeviceManagementJob* policy_fetch_job = NULL;
 252   EXPECT_CALL(device_management_service_,
 253               CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
 254       .Times(AtMost(1))
 255       .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
 256   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 257       .Times(AtMost(1));
 258   ConnectManager();
 259   base::RunLoop().RunUntilIdle();
 260   Mock::VerifyAndClearExpectations(&device_management_service_);
 261   ASSERT_TRUE(policy_fetch_job);
 262
 263   // Switch back to ACTIVE, service the policy fetch and let it propagate.
 264   device_policy_.policy_data().set_state(em::PolicyData::ACTIVE);
 265   device_policy_.Build();
 266   device_settings_test_helper_.set_policy_blob(device_policy_.GetBlob());
 267   em::DeviceManagementResponse policy_fetch_response;
 268   policy_fetch_response.mutable_policy_response()->add_response()->CopyFrom(
 269       device_policy_.policy());
 270   policy_fetch_job->SendResponse(DM_STATUS_SUCCESS, policy_fetch_response);
 271   FlushDeviceSettings();
 272
 273   // Policy state should now be active and the policy map should be populated.
 274   EXPECT_TRUE(store_->is_managed());
 275   VerifyPolicyPopulated();
 276 }
 277
 278 TEST_F(DeviceCloudPolicyManagerChromeOSTest, ConsumerDevice) {
 279   FlushDeviceSettings();
 280   EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
 281   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 282
 283   PolicyBundle bundle;
 284   EXPECT_TRUE(manager_->policies().Equals(bundle));
 285
 286   ConnectManager();
 287   EXPECT_TRUE(manager_->policies().Equals(bundle));
 288
 289   manager_->Shutdown();
 290   EXPECT_TRUE(manager_->policies().Equals(bundle));
 291 }
 292
 293 class DeviceCloudPolicyManagerChromeOSEnrollmentTest
 294     : public DeviceCloudPolicyManagerChromeOSTest {
 295  public:
 296   void Done(EnrollmentStatus status) {
 297     status_ = status;
 298     done_ = true;
 299   }
 300
 301  protected:
 302   DeviceCloudPolicyManagerChromeOSEnrollmentTest()
 303       : is_auto_enrollment_(false),
 304         management_mode_(em::PolicyData::ENTERPRISE_MANAGED),
 305         register_status_(DM_STATUS_SUCCESS),
 306         policy_fetch_status_(DM_STATUS_SUCCESS),
 307         robot_auth_fetch_status_(DM_STATUS_SUCCESS),
 308         store_result_(true),
 309         status_(EnrollmentStatus::ForStatus(EnrollmentStatus::STATUS_SUCCESS)),
 310         done_(false) {}
 311
 312   virtual void SetUp() OVERRIDE {
 313     DeviceCloudPolicyManagerChromeOSTest::SetUp();
 314
 315     // Set up test data.
 316     device_policy_.SetDefaultNewSigningKey();
 317     device_policy_.policy_data().set_timestamp(
 318         (base::Time::NowFromSystemTime() -
 319          base::Time::UnixEpoch()).InMilliseconds());
 320     device_policy_.Build();
 321
 322     register_response_.mutable_register_response()->set_device_management_token(
 323         PolicyBuilder::kFakeToken);
 324     policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
 325         device_policy_.policy());
 326     robot_auth_fetch_response_.mutable_service_api_access_response()
 327         ->set_auth_code("auth_code_for_test");
 328     loaded_blob_ = device_policy_.GetBlob();
 329
 330     // Initialize the manager.
 331     FlushDeviceSettings();
 332     EXPECT_EQ(CloudPolicyStore::STATUS_BAD_STATE, store_->status());
 333     EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 334
 335     PolicyBundle bundle;
 336     EXPECT_TRUE(manager_->policies().Equals(bundle));
 337
 338     ConnectManager();
 339   }
 340
 341   void ExpectFailedEnrollment(EnrollmentStatus::Status status) {
 342     EXPECT_EQ(status, status_.status());
 343     EXPECT_FALSE(store_->is_managed());
 344     PolicyBundle empty_bundle;
 345     EXPECT_TRUE(manager_->policies().Equals(empty_bundle));
 346   }
 347
 348   void ExpectSuccessfulEnrollment() {
 349     EXPECT_EQ(EnrollmentStatus::STATUS_SUCCESS, status_.status());
 350     ASSERT_TRUE(manager_->core()->client());
 351     EXPECT_TRUE(manager_->core()->client()->is_registered());
 352
 353     if (management_mode_ != em::PolicyData::CONSUMER_MANAGED) {
 354       EXPECT_EQ(DEVICE_MODE_ENTERPRISE, install_attributes_->GetMode());
 355       EXPECT_TRUE(store_->has_policy());
 356       EXPECT_TRUE(store_->is_managed());
 357       VerifyPolicyPopulated();
 358     }
 359   }
 360
 361   void RunTest() {
 362     // Trigger enrollment.
 363     MockDeviceManagementJob* register_job = NULL;
 364     EXPECT_CALL(device_management_service_,
 365                 CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION, _))
 366         .Times(AtMost(1))
 367         .WillOnce(device_management_service_.CreateAsyncJob(&register_job));
 368     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 369         .Times(AtMost(1))
 370         .WillOnce(DoAll(SaveArg<5>(&client_id_),
 371                         SaveArg<6>(&register_request_)));
 372     DeviceCloudPolicyInitializer::AllowedDeviceModes modes;
 373     modes[DEVICE_MODE_ENTERPRISE] = true;
 374     initializer_->StartEnrollment(
 375         management_mode_,
 376         &device_management_service_,
 377         "auth token", is_auto_enrollment_, modes,
 378         base::Bind(&DeviceCloudPolicyManagerChromeOSEnrollmentTest::Done,
 379                    base::Unretained(this)));
 380     base::RunLoop().RunUntilIdle();
 381     Mock::VerifyAndClearExpectations(&device_management_service_);
 382
 383     if (done_)
 384       return;
 385
 386     // Process registration.
 387     ASSERT_TRUE(register_job);
 388     MockDeviceManagementJob* policy_fetch_job = NULL;
 389     EXPECT_CALL(device_management_service_,
 390                 CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
 391         .Times(AtMost(1))
 392         .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
 393     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 394         .Times(AtMost(1));
 395     register_job->SendResponse(register_status_, register_response_);
 396     Mock::VerifyAndClearExpectations(&device_management_service_);
 397
 398     if (done_)
 399       return;
 400
 401     // Process policy fetch.
 402     ASSERT_TRUE(policy_fetch_job);
 403     policy_fetch_job->SendResponse(policy_fetch_status_,
 404                                    policy_fetch_response_);
 405
 406     if (done_)
 407       return;
 408
 409     // Process verification.
 410     MockDeviceManagementJob* robot_auth_fetch_job = NULL;
 411     EXPECT_CALL(device_management_service_, CreateJob(
 412         DeviceManagementRequestJob::TYPE_API_AUTH_CODE_FETCH, _))
 413         .Times(AtMost(1))
 414         .WillOnce(device_management_service_.CreateAsyncJob(
 415             &robot_auth_fetch_job));
 416     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
 417         .Times(AtMost(1));
 418     base::RunLoop().RunUntilIdle();
 419     Mock::VerifyAndClearExpectations(&device_management_service_);
 420
 421     if (done_)
 422       return;
 423
 424     // Process robot auth token fetch.
 425     ASSERT_TRUE(robot_auth_fetch_job);
 426     robot_auth_fetch_job->SendResponse(robot_auth_fetch_status_,
 427                                        robot_auth_fetch_response_);
 428     Mock::VerifyAndClearExpectations(&device_management_service_);
 429
 430     if (done_)
 431       return;
 432
 433     // Process robot refresh token fetch if the auth code fetch succeeded.
 434     // DeviceCloudPolicyInitializer holds an EnrollmentHandlerChromeOS which
 435     // holds a GaiaOAuthClient that fetches the refresh token during enrollment.
 436     // We return a successful OAuth response via a TestURLFetcher to trigger the
 437     // happy path for these classes so that enrollment can continue.
 438     if (robot_auth_fetch_status_ == DM_STATUS_SUCCESS) {
 439       net::TestURLFetcher* url_fetcher = url_fetcher_factory_.GetFetcherByID(
 440           gaia::GaiaOAuthClient::kUrlFetcherId);
 441       ASSERT_TRUE(url_fetcher);
 442       url_fetcher->SetMaxRetriesOn5xx(0);
 443       url_fetcher->set_status(net::URLRequestStatus());
 444       url_fetcher->set_response_code(url_fetcher_response_code_);
 445       url_fetcher->SetResponseString(url_fetcher_response_string_);
 446       url_fetcher->delegate()->OnURLFetchComplete(url_fetcher);
 447     }
 448
 449     if (management_mode_ == em::PolicyData::CONSUMER_MANAGED)
 450       FlushDeviceSettings();
 451     else
 452       base::RunLoop().RunUntilIdle();
 453
 454     if (done_)
 455       return;
 456
 457     // Process robot refresh token store.
 458     chromeos::DeviceOAuth2TokenService* token_service =
 459         chromeos::DeviceOAuth2TokenServiceFactory::Get();
 460     EXPECT_TRUE(token_service->RefreshTokenIsAvailable(
 461         token_service->GetRobotAccountId()));
 462
 463     // Process policy store.
 464     device_settings_test_helper_.set_store_result(store_result_);
 465     device_settings_test_helper_.FlushStore();
 466     EXPECT_EQ(device_policy_.GetBlob(),
 467               device_settings_test_helper_.policy_blob());
 468
 469     if (done_)
 470       return;
 471
 472     // Key installation and policy load.
 473     device_settings_test_helper_.set_policy_blob(loaded_blob_);
 474     owner_key_util_->SetPublicKeyFromPrivateKey(
 475         *device_policy_.GetNewSigningKey());
 476     ReloadDeviceSettings();
 477   }
 478
 479   bool is_auto_enrollment_;
 480   em::PolicyData::ManagementMode management_mode_;
 481
 482   DeviceManagementStatus register_status_;
 483   em::DeviceManagementResponse register_response_;
 484
 485   DeviceManagementStatus policy_fetch_status_;
 486   em::DeviceManagementResponse policy_fetch_response_;
 487
 488   DeviceManagementStatus robot_auth_fetch_status_;
 489   em::DeviceManagementResponse robot_auth_fetch_response_;
 490
 491   bool store_result_;
 492   std::string loaded_blob_;
 493
 494   em::DeviceManagementRequest register_request_;
 495   std::string client_id_;
 496   EnrollmentStatus status_;
 497
 498   bool done_;
 499
 500  private:
 501   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSEnrollmentTest);
 502 };
 503
 504 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Success) {
 505   RunTest();
 506   ExpectSuccessfulEnrollment();
 507 }
 508
 509 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, AutoEnrollment) {
 510   is_auto_enrollment_ = true;
 511   RunTest();
 512   ExpectSuccessfulEnrollment();
 513   EXPECT_TRUE(register_request_.register_request().auto_enrolled());
 514 }
 515
 516 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, Reenrollment) {
 517   LockDevice();
 518
 519   RunTest();
 520   ExpectSuccessfulEnrollment();
 521   EXPECT_TRUE(register_request_.register_request().reregister());
 522   EXPECT_EQ(PolicyBuilder::kFakeDeviceId, client_id_);
 523 }
 524
 525 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, RegistrationFailed) {
 526   register_status_ = DM_STATUS_REQUEST_FAILED;
 527   RunTest();
 528   ExpectFailedEnrollment(EnrollmentStatus::STATUS_REGISTRATION_FAILED);
 529   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 530 }
 531
 532 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 533        RobotAuthCodeFetchFailed) {
 534   robot_auth_fetch_status_ = DM_STATUS_REQUEST_FAILED;
 535   RunTest();
 536   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_AUTH_FETCH_FAILED);
 537 }
 538
 539 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 540        RobotRefreshTokenFetchResponseCodeFailed) {
 541   url_fetcher_response_code_ = 400;
 542   RunTest();
 543   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
 544   EXPECT_EQ(400, status_.http_status());
 545 }
 546
 547 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 548        RobotRefreshTokenFetchResponseStringFailed) {
 549   url_fetcher_response_string_ = "invalid response json";
 550   RunTest();
 551   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_FETCH_FAILED);
 552 }
 553
 554 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 555        RobotRefreshEncryptionFailed) {
 556   // The encryption lib is a noop for tests, but empty results from encryption
 557   // is an error, so we simulate an encryption error by returning an empty
 558   // refresh token.
 559   url_fetcher_response_string_ = "{\"access_token\":\"accessToken4Test\","
 560                                  "\"expires_in\":1234,"
 561                                  "\"refresh_token\":\"\"}";
 562   RunTest();
 563   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 564 }
 565
 566 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, PolicyFetchFailed) {
 567   policy_fetch_status_ = DM_STATUS_REQUEST_FAILED;
 568   RunTest();
 569   ExpectFailedEnrollment(EnrollmentStatus::STATUS_POLICY_FETCH_FAILED);
 570   EXPECT_EQ(DM_STATUS_REQUEST_FAILED, status_.client_status());
 571 }
 572
 573 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, ValidationFailed) {
 574   device_policy_.policy().set_policy_data_signature("bad");
 575   policy_fetch_response_.clear_policy_response();
 576   policy_fetch_response_.mutable_policy_response()->add_response()->CopyFrom(
 577       device_policy_.policy());
 578   RunTest();
 579   ExpectFailedEnrollment(EnrollmentStatus::STATUS_VALIDATION_FAILED);
 580   EXPECT_EQ(CloudPolicyValidatorBase::VALIDATION_BAD_INITIAL_SIGNATURE,
 581             status_.validation_status());
 582 }
 583
 584 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, StoreError) {
 585   store_result_ = false;
 586   RunTest();
 587   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
 588   EXPECT_EQ(CloudPolicyStore::STATUS_STORE_ERROR,
 589             status_.store_status());
 590 }
 591
 592 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest, LoadError) {
 593   loaded_blob_.clear();
 594   RunTest();
 595   ExpectFailedEnrollment(EnrollmentStatus::STATUS_STORE_ERROR);
 596   EXPECT_EQ(CloudPolicyStore::STATUS_LOAD_ERROR,
 597             status_.store_status());
 598 }
 599
 600 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentTest,
 601        SuccessfulConsumerManagementEnrollment) {
 602   management_mode_ = em::PolicyData::CONSUMER_MANAGED;
 603   owner_key_util_->SetPrivateKey(device_policy_.GetSigningKey());
 604   InitOwner(device_policy_.policy_data().username(), true);
 605   FlushDeviceSettings();
 606
 607   RunTest();
 608   ExpectSuccessfulEnrollment();
 609 }
 610
 611 // A subclass that runs with a blank system salt.
 612 class DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest
 613     : public DeviceCloudPolicyManagerChromeOSEnrollmentTest {
 614  protected:
 615   DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest() {
 616     // Set up a FakeCryptohomeClient with a blank system salt.
 617     fake_cryptohome_client_->set_system_salt(std::vector<uint8>());
 618   }
 619 };
 620
 621 TEST_F(DeviceCloudPolicyManagerChromeOSEnrollmentBlankSystemSaltTest,
 622        RobotRefreshSaveFailed) {
 623   // Without the system salt, the robot token can't be stored.
 624   RunTest();
 625   ExpectFailedEnrollment(EnrollmentStatus::STATUS_ROBOT_REFRESH_STORE_FAILED);
 626 }
 627
 628 }  // namespace
 629 }  // namespace policy