Add device disabling to OOBE flow

Chrome OS retrieves device state from DMServer during OOBE. If this
state indicates that the device should be disabled, it will show a
corresponding screen and prevent the user from proceeding further.

The feature is on by default because we are aiming for M40 but a flag
is provided that can easily be flipped to turn it off if we do not
make the deadline.

BUG=425574
TEST=Unit and browser tests

Review URL: https://codereview.chromium.org/676773002

Cr-Commit-Position: refs/heads/master@{#301092}

chrome/app/chromeos_strings.grdp

@@ -5079,9 +5079,6 @@ Battery full
   <message name="IDS_DEVICE_DISABLED_HEADING" desc="Heading of the message shown to the user when the device has been disabled by its owner.">
     Locked
   </message>
-  <message name="IDS_DEVICE_DISABLED_DEFAULT_MESSAGE" desc="Messsage shown to the user when the device has been disabled by its owner.">
-    Please return this device to its owner.
-  </message>
   <message name="IDS_DEVICE_DISABLED_EXPLANATION" desc="Explanation shown to the user when the device has been disabled by its owner.">
     This device was locked by its owner. Only an approved administrator can unlock it. Take this device to Tech Support for assistance.
   </message>

chrome/browser/chromeos/login/screens/device_disabled_screen.cc

@@ -6,17 +6,30 @@
 
 #include <string>
 
+#include "base/bind.h"
+#include "base/command_line.h"
 #include "base/logging.h"
+#include "base/prefs/pref_service.h"
 #include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/browser_process_platform_part.h"
 #include "chrome/browser/chromeos/login/screens/screen_observer.h"
 #include "chrome/browser/chromeos/login/wizard_controller.h"
+#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
+#include "chrome/browser/chromeos/policy/server_backed_device_state.h"
+#include "chrome/common/pref_names.h"
+#include "chromeos/chromeos_switches.h"
+#include "components/policy/core/common/cloud/cloud_policy_constants.h"
 
 namespace chromeos {
 
 DeviceDisabledScreen::DeviceDisabledScreen(ScreenObserver* observer,
                                            DeviceDisabledScreenActor* actor)
     : BaseScreen(observer),
-      actor_(actor) {
+      showing_(false),
+      actor_(actor),
+      weak_factory_(this) {
   DCHECK(actor_);
   if (actor_)
     actor_->SetDelegate(this);
@@ -24,18 +37,61 @@ DeviceDisabledScreen::DeviceDisabledScreen(ScreenObserver* observer,
 
 DeviceDisabledScreen::~DeviceDisabledScreen() {
   if (actor_)
-    actor_->SetDelegate(NULL);
+    actor_->SetDelegate(nullptr);
 }
 
 void DeviceDisabledScreen::PrepareToShow() {
 }
 
 void DeviceDisabledScreen::Show() {
-  if (actor_)
-    actor_->Show();
+  if (!actor_ || showing_)
+    return;
+
+  bool is_device_disabled = false;
+  g_browser_process->local_state()->GetDictionary(
+      prefs::kServerBackedDeviceState)->GetBoolean(policy::kDeviceStateDisabled,
+                                                   &is_device_disabled);
+  if (!is_device_disabled ||
+      CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableDeviceDisabling)) {
+    // Skip the screen if the device is not marked as disabled or device
+    // disabling has been turned off by flag.
+    IndicateDeviceNotDisabled();
+    return;
+  }
+
+  policy::BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  if (connector->GetDeviceMode() == policy::DEVICE_MODE_PENDING) {
+    // Ensure that the device mode is known before proceeding.
+    connector->GetInstallAttributes()->ReadImmutableAttributes(
+        base::Bind(&DeviceDisabledScreen::Show,
+                   weak_factory_.GetWeakPtr()));
+    return;
+  }
+
+  if (connector->GetDeviceMode() != policy::DEVICE_MODE_NOT_SET) {
+    // Skip the screen if the device is owned already. The device disabling
+    // screen should only be shown during OOBE.
+    IndicateDeviceNotDisabled();
+    return;
+  }
+
+  showing_ = true;
+
+  std::string message;
+  g_browser_process->local_state()->GetDictionary(
+      prefs::kServerBackedDeviceState)->GetString(
+          policy::kDeviceStateDisabledMessage,
+          &message);
+  actor_->Show(message);
 }
 
 void DeviceDisabledScreen::Hide() {
+  if (!showing_)
+    return;
+  showing_ = false;
+
   if (actor_)
     actor_->Hide();
 }
@@ -46,7 +102,11 @@ std::string DeviceDisabledScreen::GetName() const {
 
 void DeviceDisabledScreen::OnActorDestroyed(DeviceDisabledScreenActor* actor) {
   if (actor_ == actor)
-    actor_ = NULL;
+    actor_ = nullptr;
+}
+
+void DeviceDisabledScreen::IndicateDeviceNotDisabled() {
+  get_screen_observer()->OnExit(ScreenObserver::DEVICE_NOT_DISABLED);
 }
 
 }  // namespace chromeos

chrome/browser/chromeos/login/screens/device_disabled_screen.h

@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_CHROMEOS_LOGIN_SCREENS_DEVICE_DISABLED_SCREEN_H_
 
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "chrome/browser/chromeos/login/screens/base_screen.h"
 #include "chrome/browser/chromeos/login/screens/device_disabled_screen_actor.h"
 
@@ -31,8 +32,17 @@ class DeviceDisabledScreen : public BaseScreen,
   void OnActorDestroyed(DeviceDisabledScreenActor* actor) override;
 
  private:
+  // Indicate to the observer that the screen was skipped because the device is
+  // not disabled.
+  void IndicateDeviceNotDisabled();
+
+  // Whether the screen is currently showing.
+  bool showing_;
+
   DeviceDisabledScreenActor* actor_;
 
+  base::WeakPtrFactory<DeviceDisabledScreen> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(DeviceDisabledScreen);
 };
 

chrome/browser/chromeos/login/screens/device_disabled_screen_actor.h

@@ -5,6 +5,8 @@
 #ifndef CHROME_BROWSER_CHROMEOS_LOGIN_SCREENS_DEVICE_DISABLED_SCREEN_ACTOR_H_
 #define CHROME_BROWSER_CHROMEOS_LOGIN_SCREENS_DEVICE_DISABLED_SCREEN_ACTOR_H_
 
+#include <string>
+
 namespace chromeos {
 
 // Interface between the device disabled screen and its representation.
@@ -24,7 +26,7 @@ class DeviceDisabledScreenActor {
   virtual ~DeviceDisabledScreenActor() {
   }
 
-  virtual void Show() = 0;
+  virtual void Show(const std::string& message) = 0;
   virtual void Hide() = 0;
   virtual void SetDelegate(Delegate* delegate) = 0;
 };

chrome/browser/chromeos/login/screens/device_disabled_screen_unittest.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/login/screens/device_disabled_screen.h"
+
+#include "base/command_line.h"
+#include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/prefs/scoped_user_pref_update.h"
+#include "base/prefs/testing_pref_service.h"
+#include "chrome/browser/browser_process_platform_part.h"
+#include "chrome/browser/chromeos/login/screens/mock_device_disabled_screen_actor.h"
+#include "chrome/browser/chromeos/login/screens/screen_observer.h"
+#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
+#include "chrome/browser/chromeos/policy/server_backed_device_state.h"
+#include "chrome/browser/chromeos/policy/stub_enterprise_install_attributes.h"
+#include "chrome/common/pref_names.h"
+#include "chrome/test/base/testing_browser_process.h"
+#include "chromeos/chromeos_switches.h"
+#include "components/policy/core/common/cloud/cloud_policy_constants.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using ::testing::_;
+
+namespace chromeos {
+
+namespace {
+
+const char kDisabledMessage[] = "Device disabled.";
+
+}
+
+class DeviceDisabledScreenTest : public testing::Test, public ScreenObserver {
+ public:
+  DeviceDisabledScreenTest();
+  ~DeviceDisabledScreenTest() override;
+
+  // testing::Test:
+  void SetUp() override;
+  void TearDown() override;
+
+  // ScreenObserver:
+  MOCK_METHOD1(OnExit, void(ExitCodes));
+  void ShowCurrentScreen() override;
+  void OnSetUserNamePassword(const std::string& username,
+                             const std::string& password) override;
+  void SetUsageStatisticsReporting(bool val) override;
+  bool GetUsageStatisticsReporting() const override;
+  void SetHostConfiguration() override;
+  void ConfigureHost(bool accepted_eula,
+                     const std::string& lang,
+                     const std::string& timezone,
+                     bool send_reports,
+                     const std::string& keyboard_layout) override;
+  ErrorScreen* GetErrorScreen() override;
+  void ShowErrorScreen() override;
+  void HideErrorScreen(BaseScreen* parent_screen) override;
+
+  void SetDeviceDisabled(bool disabled);
+  void SetDeviceMode(policy::DeviceMode device_mode);
+
+  void ExpectScreenToNotShow();
+  void ExpectScreenToShow();
+
+  void TryToShowScreen();
+
+ private:
+  scoped_ptr<DeviceDisabledScreen> screen_;
+  scoped_ptr<MockDeviceDisabledScreenActor> actor_;
+  TestingPrefServiceSimple local_state_;
+  policy::ScopedStubEnterpriseInstallAttributes install_attributes_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceDisabledScreenTest);
+};
+
+DeviceDisabledScreenTest::DeviceDisabledScreenTest()
+    : install_attributes_("", "", "", policy::DEVICE_MODE_NOT_SET) {
+}
+
+DeviceDisabledScreenTest::~DeviceDisabledScreenTest() {
+}
+
+void DeviceDisabledScreenTest::SetUp() {
+  TestingBrowserProcess::GetGlobal()->SetLocalState(&local_state_);
+  policy::DeviceCloudPolicyManagerChromeOS::RegisterPrefs(
+      local_state_.registry());
+
+  actor_.reset(new MockDeviceDisabledScreenActor);
+  screen_.reset(new DeviceDisabledScreen(this, actor_.get()));
+}
+
+void DeviceDisabledScreenTest::TearDown() {
+  TestingBrowserProcess::GetGlobal()->SetLocalState(nullptr);
+}
+
+void DeviceDisabledScreenTest::ShowCurrentScreen() {
+}
+
+void DeviceDisabledScreenTest::OnSetUserNamePassword(
+    const std::string& username,
+    const std::string& password) {
+}
+
+void DeviceDisabledScreenTest::SetUsageStatisticsReporting(bool val) {
+}
+
+bool DeviceDisabledScreenTest::GetUsageStatisticsReporting() const {
+  return false;
+}
+
+void DeviceDisabledScreenTest::SetHostConfiguration() {
+}
+
+void DeviceDisabledScreenTest::ConfigureHost(
+    bool accepted_eula,
+    const std::string& lang,
+    const std::string& timezone,
+    bool send_reports,
+    const std::string& keyboard_layout) {
+}
+
+ErrorScreen* DeviceDisabledScreenTest::GetErrorScreen() {
+  return nullptr;
+}
+
+void DeviceDisabledScreenTest::ShowErrorScreen() {
+}
+
+void DeviceDisabledScreenTest::HideErrorScreen(BaseScreen* parent_screen) {
+}
+
+void DeviceDisabledScreenTest::SetDeviceDisabled(bool disabled) {
+  DictionaryPrefUpdate dict(&local_state_, prefs::kServerBackedDeviceState);
+  dict->SetBoolean(policy::kDeviceStateDisabled, disabled);
+  if (disabled)
+    dict->SetString(policy::kDeviceStateDisabledMessage, kDisabledMessage);
+}
+
+void DeviceDisabledScreenTest::SetDeviceMode(policy::DeviceMode device_mode) {
+  reinterpret_cast<policy::StubEnterpriseInstallAttributes*>(
+      TestingBrowserProcess::GetGlobal()->platform_part()->
+          browser_policy_connector_chromeos()->GetInstallAttributes())->
+              SetMode(device_mode);
+}
+
+void DeviceDisabledScreenTest::ExpectScreenToNotShow() {
+  EXPECT_CALL(*actor_, Show(_)).Times(0);
+  EXPECT_CALL(*this, OnExit(ScreenObserver::DEVICE_NOT_DISABLED)).Times(1);
+}
+
+void DeviceDisabledScreenTest::ExpectScreenToShow() {
+  EXPECT_CALL(*actor_, Show(kDisabledMessage)).Times(1);
+  EXPECT_CALL(*this, OnExit(ScreenObserver::DEVICE_NOT_DISABLED)).Times(0);
+}
+
+void DeviceDisabledScreenTest::TryToShowScreen() {
+  screen_->Show();
+}
+
+// Verifies that the device disabled screen is not shown by default.
+TEST_F(DeviceDisabledScreenTest, DoNotShowByDefault) {
+  ExpectScreenToNotShow();
+  TryToShowScreen();
+}
+
+// Verifies that the device disabled screen is not shown when the device is
+// explicitly marked as not disabled.
+TEST_F(DeviceDisabledScreenTest, DoNotShowWhenNotDisabled) {
+  SetDeviceDisabled(false);
+  ExpectScreenToNotShow();
+  TryToShowScreen();
+}
+
+// Verifies that the device disabled screen is not shown when device disabling
+// is turned off by flag, even if the device is marked as disabled.
+TEST_F(DeviceDisabledScreenTest, DoNotShowWhenTurnedOffByFlag) {
+  CommandLine::ForCurrentProcess()->AppendSwitch(
+      switches::kDisableDeviceDisabling);
+  SetDeviceDisabled(true);
+  ExpectScreenToNotShow();
+  TryToShowScreen();
+}
+
+// Verifies that the device disabled screen is not shown when the device is
+// already enrolled, even if the device is marked as disabled.
+TEST_F(DeviceDisabledScreenTest, DoNotShowWhenEnterpriseOwned) {
+  SetDeviceMode(policy::DEVICE_MODE_ENTERPRISE);
+  SetDeviceDisabled(true);
+  ExpectScreenToNotShow();
+  TryToShowScreen();
+}
+
+// Verifies that the device disabled screen is not shown when the device is
+// already owned by a consumer, even if the device is marked as disabled.
+TEST_F(DeviceDisabledScreenTest, DoNotShowWhenConsumerOwned) {
+  SetDeviceMode(policy::DEVICE_MODE_CONSUMER);
+  SetDeviceDisabled(true);
+  ExpectScreenToNotShow();
+  TryToShowScreen();
+}
+
+// Verifies that the device disabled screen is shown when the device is marked
+// as disabled, device disabling is not turned off by flag and the device is not
+// owned yet.
+TEST_F(DeviceDisabledScreenTest, ShowWhenDisabledAndNotOwned) {
+  SetDeviceDisabled(true);
+  ExpectScreenToShow();
+  TryToShowScreen();
+}
+
+}  // namespace chromeos

chrome/browser/chromeos/login/screens/mock_device_disabled_screen_actor.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/login/screens/mock_device_disabled_screen_actor.h"
+
+using ::testing::AtLeast;
+using ::testing::AtMost;
+using ::testing::NotNull;
+
+namespace chromeos {
+
+MockDeviceDisabledScreenActor::MockDeviceDisabledScreenActor()
+    : delegate_(nullptr) {
+  EXPECT_CALL(*this, MockSetDelegate(NotNull())).Times(AtLeast(1));
+  EXPECT_CALL(*this, MockSetDelegate(nullptr)).Times(AtMost(1));
+}
+
+MockDeviceDisabledScreenActor::~MockDeviceDisabledScreenActor() {
+  if (delegate_)
+    delegate_->OnActorDestroyed(this);
+}
+
+void MockDeviceDisabledScreenActor::SetDelegate(Delegate* delegate) {
+  delegate_ = delegate;
+  MockSetDelegate(delegate);
+}
+
+}  // namespace chromeos

chrome/browser/chromeos/login/screens/mock_device_disabled_screen_actor.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_LOGIN_SCREENS_MOCK_DEVICE_DISABLED_SCREEN_ACTOR_H_
+#define CHROME_BROWSER_CHROMEOS_LOGIN_SCREENS_MOCK_DEVICE_DISABLED_SCREEN_ACTOR_H_
+
+#include "chrome/browser/chromeos/login/screens/device_disabled_screen_actor.h"
+#include "testing/gmock/include/gmock/gmock.h"
+
+namespace chromeos {
+
+class MockDeviceDisabledScreenActor : public DeviceDisabledScreenActor {
+ public:
+  MockDeviceDisabledScreenActor();
+  ~MockDeviceDisabledScreenActor() override;
+
+  void SetDelegate(Delegate* delegate) override;
+
+  MOCK_METHOD1(Show, void(const std::string&));
+  MOCK_METHOD0(Hide, void());
+
+ private:
+  MOCK_METHOD1(MockSetDelegate, void(Delegate* delegate));
+
+  Delegate* delegate_;
+};
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_LOGIN_SCREENS_MOCK_DEVICE_DISABLED_SCREEN_ACTOR_H_

chrome/browser/chromeos/login/screens/screen_observer.h

@@ -49,6 +49,7 @@ class ScreenObserver {
     WRONG_HWID_WARNING_SKIPPED = 20,
     CONTROLLER_PAIRING_FINISHED = 21,
     HOST_PAIRING_FINISHED = 22,
+    DEVICE_NOT_DISABLED = 23,
     EXIT_CODES_COUNT  // not a real code, must be the last
   };
 

chrome/browser/chromeos/login/wizard_controller.cc

@@ -534,7 +534,7 @@ void WizardController::SkipToLoginForTesting(
   VLOG(1) << "SkipToLoginForTesting.";
   StartupUtils::MarkEulaAccepted();
   PerformPostEulaActions();
-  OnAutoEnrollmentCheckCompleted();
+  OnDeviceNotDisabled();
 }
 
 void WizardController::AddObserver(Observer* observer) {
@@ -731,15 +731,6 @@ void WizardController::OnAutoEnrollmentDone() {
   ResumeLoginScreen();
 }
 
-void WizardController::OnAutoEnrollmentCheckCompleted() {
-  if (ShouldAutoStartEnrollment() || enrollment_recovery_) {
-    ShowEnrollmentScreen();
-  } else {
-    PerformOOBECompletedActions();
-    ShowLoginScreen(LoginScreenContext());
-  }
-}
-
 void WizardController::OnTermsOfServiceDeclined() {
   // If the user declines the Terms of Service, end the session and return to
   // the login screen.
@@ -759,6 +750,17 @@ void WizardController::OnHostPairingFinished() {
   InitiateOOBEUpdate();
 }
 
+void WizardController::OnDeviceNotDisabled() {
+  if (skip_update_enroll_after_eula_ ||
+      ShouldAutoStartEnrollment() ||
+      enrollment_recovery_) {
+    ShowEnrollmentScreen();
+  } else {
+    PerformOOBECompletedActions();
+    ShowLoginScreen(LoginScreenContext());
+  }
+}
+
 void WizardController::InitiateOOBEUpdate() {
   VLOG(1) << "InitiateOOBEUpdate";
   PerformPostEulaActions();
@@ -968,10 +970,7 @@ void WizardController::OnExit(ExitCodes exit_code) {
       ShowNetworkScreen();
       break;
     case ENTERPRISE_AUTO_ENROLLMENT_CHECK_COMPLETED:
-      if (skip_update_enroll_after_eula_)
-        ShowEnrollmentScreen();
-      else
-        OnAutoEnrollmentCheckCompleted();
+      ShowDeviceDisabledScreen();
       break;
     case ENTERPRISE_ENROLLMENT_COMPLETED:
       OnEnrollmentDone();
@@ -1009,6 +1008,9 @@ void WizardController::OnExit(ExitCodes exit_code) {
     case HOST_PAIRING_FINISHED:
       OnHostPairingFinished();
       break;
+    case DEVICE_NOT_DISABLED:
+      OnDeviceNotDisabled();
+      break;
     default:
       NOTREACHED();
   }

chrome/browser/chromeos/login/wizard_controller.h

@@ -209,11 +209,11 @@ class WizardController : public ScreenObserver, public ScreenManager {
   void OnKioskAutolaunchConfirmed();
   void OnKioskEnableCompleted();
   void OnWrongHWIDWarningSkipped();
-  void OnAutoEnrollmentCheckCompleted();
   void OnTermsOfServiceDeclined();
   void OnTermsOfServiceAccepted();
   void OnControllerPairingFinished();
   void OnHostPairingFinished();
+  void OnDeviceNotDisabled();
 
   // Callback function after setting MetricsReporting.
   void InitiateMetricsReportingChangeCallback(bool enabled);

chrome/browser/chromeos/login/wizard_controller_browsertest.cc

@@ -25,8 +25,10 @@
 #include "chrome/browser/chromeos/login/enrollment/mock_auto_enrollment_check_screen.h"
 #include "chrome/browser/chromeos/login/enrollment/mock_enrollment_screen.h"
 #include "chrome/browser/chromeos/login/existing_user_controller.h"
+#include "chrome/browser/chromeos/login/screens/device_disabled_screen.h"
 #include "chrome/browser/chromeos/login/screens/error_screen.h"
 #include "chrome/browser/chromeos/login/screens/hid_detection_screen.h"
+#include "chrome/browser/chromeos/login/screens/mock_device_disabled_screen_actor.h"
 #include "chrome/browser/chromeos/login/screens/mock_eula_screen.h"
 #include "chrome/browser/chromeos/login/screens/mock_network_screen.h"
 #include "chrome/browser/chromeos/login/screens/mock_update_screen.h"
@@ -41,6 +43,7 @@
 #include "chrome/browser/chromeos/login/ui/webui_login_view.h"
 #include "chrome/browser/chromeos/net/network_portal_detector_test_impl.h"
 #include "chrome/browser/chromeos/policy/server_backed_device_state.h"
+#include "chrome/browser/chromeos/policy/stub_enterprise_install_attributes.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/chromeos/timezone/timezone_request.h"
 #include "chrome/browser/ui/webui/chromeos/login/oobe_ui.h"
@@ -64,6 +67,7 @@
 #include "chromeos/settings/timezone_settings.h"
 #include "chromeos/system/fake_statistics_provider.h"
 #include "chromeos/system/statistics_provider.h"
+#include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "net/test/spawned_test_server/spawned_test_server.h"
@@ -77,6 +81,7 @@
 
 using ::testing::Exactly;
 using ::testing::Invoke;
+using ::testing::Mock;
 using ::testing::Return;
 
 namespace chromeos {
@@ -106,6 +111,8 @@ const char kTimezoneResponseBody[] =
     "    \"timeZoneName\" : \"Pacific Standard Time\"\n"
     "}";
 
+const char kDisabledMessage[] = "This device has been disabled.";
+
 class PrefStoreStub : public TestingPrefStore {
  public:
   // TestingPrefStore overrides:
@@ -390,7 +397,9 @@ class WizardControllerFlowTest : public WizardControllerTest {
     WizardControllerTest::SetUpOnMainThread();
 
     // Make sure that OOBE is run as an "official" build.
-    WizardController::default_controller()->is_official_build_ = true;
+    WizardController* wizard_controller =
+        WizardController::default_controller();
+    wizard_controller->is_official_build_ = true;
 
     // Clear portal list (as it is by default in OOBE).
     NetworkHandler::Get()->network_state_handler()->SetCheckPortalList("");
@@ -416,12 +425,22 @@ class WizardControllerFlowTest : public WizardControllerTest {
          kAutoEnrollmentCheckScreenName,
          MockAutoEnrollmentCheckScreen,
          MockAutoEnrollmentCheckScreenActor);
+    device_disabled_screen_actor_.reset(new MockDeviceDisabledScreenActor);
+    wizard_controller->screens_[WizardController::kDeviceDisabledScreenName] =
+        make_linked_ptr(new DeviceDisabledScreen(
+            wizard_controller,
+            device_disabled_screen_actor_.get()));
+    EXPECT_CALL(*device_disabled_screen_actor_, Show(_)).Times(0);
 
     // Switch to the initial screen.
-    EXPECT_EQ(NULL, WizardController::default_controller()->current_screen());
+    EXPECT_EQ(NULL, wizard_controller->current_screen());
     EXPECT_CALL(*mock_network_screen_, Show()).Times(1);
-    WizardController::default_controller()->AdvanceToScreen(
-        WizardController::kNetworkScreenName);
+    wizard_controller->AdvanceToScreen(WizardController::kNetworkScreenName);
+  }
+
+  void TearDownOnMainThread() override {
+    device_disabled_screen_actor_.reset();
+    WizardControllerTest::TearDownOnMainThread();
   }
 
   virtual void TearDown() {
@@ -488,6 +507,7 @@ class WizardControllerFlowTest : public WizardControllerTest {
       MockEnrollmentScreenActor>* mock_enrollment_screen_;
   MockOutShowHide<MockAutoEnrollmentCheckScreen,
       MockAutoEnrollmentCheckScreenActor>* mock_auto_enrollment_check_screen_;
+  scoped_ptr<MockDeviceDisabledScreenActor> device_disabled_screen_actor_;
 
  private:
   NetworkPortalDetectorTestImpl* network_portal_detector_;
@@ -525,6 +545,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerFlowTest, ControlFlowMain) {
   InitTimezoneResolver();
   OnExit(ScreenObserver::EULA_ACCEPTED);
   EXPECT_TRUE(GetGeolocationProvider());
+
   // Let update screen smooth time process (time = 0ms).
   content::RunAllPendingInMessageLoop();
 
@@ -534,7 +555,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerFlowTest, ControlFlowMain) {
   OnExit(ScreenObserver::UPDATE_INSTALLED);
 
   CheckCurrentScreen(WizardController::kAutoEnrollmentCheckScreenName);
-  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(0);
+  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(1);
   EXPECT_CALL(*mock_eula_screen_, Show()).Times(0);
   OnExit(ScreenObserver::ENTERPRISE_AUTO_ENROLLMENT_CHECK_COMPLETED);
 
@@ -562,6 +583,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerFlowTest, ControlFlowErrorUpdate) {
   EXPECT_CALL(*mock_update_screen_, StartNetworkCheck()).Times(1);
   EXPECT_CALL(*mock_update_screen_, Show()).Times(1);
   OnExit(ScreenObserver::EULA_ACCEPTED);
+
   // Let update screen smooth time process (time = 0ms).
   content::RunAllPendingInMessageLoop();
 
@@ -571,7 +593,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerFlowTest, ControlFlowErrorUpdate) {
   OnExit(ScreenObserver::UPDATE_ERROR_UPDATING);
 
   CheckCurrentScreen(WizardController::kAutoEnrollmentCheckScreenName);
-  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(0);
+  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(1);
   EXPECT_CALL(*mock_eula_screen_, Show()).Times(0);
   OnExit(ScreenObserver::ENTERPRISE_AUTO_ENROLLMENT_CHECK_COMPLETED);
 
@@ -700,9 +722,13 @@ IN_PROC_BROWSER_TEST_F(WizardControllerFlowTest,
   EXPECT_FALSE(ExistingUserController::current_controller() == NULL);
 }
 
-class WizardControllerEnrollmentFlowTest : public WizardControllerFlowTest {
+class WizardControllerDeviceStateTest : public WizardControllerFlowTest {
  protected:
-  WizardControllerEnrollmentFlowTest() {
+  WizardControllerDeviceStateTest()
+      : install_attributes_(std::string(),
+                            std::string(),
+                            std::string(),
+                            policy::DEVICE_MODE_NOT_SET) {
     fake_statistics_provider_.SetMachineStatistic("serial_number", "test");
     fake_statistics_provider_.SetMachineStatistic(system::kActivateDateKey,
                                                   "2000-01");
@@ -723,10 +749,12 @@ class WizardControllerEnrollmentFlowTest : public WizardControllerFlowTest {
   system::ScopedFakeStatisticsProvider fake_statistics_provider_;
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(WizardControllerEnrollmentFlowTest);
+  policy::ScopedStubEnterpriseInstallAttributes install_attributes_;
+
+  DISALLOW_COPY_AND_ASSIGN(WizardControllerDeviceStateTest);
 };
 
-IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
+IN_PROC_BROWSER_TEST_F(WizardControllerDeviceStateTest,
                        ControlFlowForcedReEnrollment) {
   CheckCurrentScreen(WizardController::kNetworkScreenName);
   EXPECT_CALL(*mock_network_screen_, Hide()).Times(1);
@@ -738,6 +766,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
   EXPECT_CALL(*mock_update_screen_, StartNetworkCheck()).Times(1);
   EXPECT_CALL(*mock_update_screen_, Show()).Times(1);
   OnExit(ScreenObserver::EULA_ACCEPTED);
+
   // Let update screen smooth time process (time = 0ms).
   content::RunAllPendingInMessageLoop();
 
@@ -752,6 +781,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
             WizardController::default_controller()->current_screen());
   EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(1);
   screen->Start();
+
   // Wait for auto-enrollment controller to encounter the connection error.
   WaitForAutoEnrollmentState(policy::AUTO_ENROLLMENT_STATE_CONNECTION_ERROR);
 
@@ -780,7 +810,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
   EXPECT_TRUE(StartupUtils::IsOobeCompleted());
 }
 
-IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
+IN_PROC_BROWSER_TEST_F(WizardControllerDeviceStateTest,
                        ControlFlowNoForcedReEnrollmentOnFirstBoot) {
   fake_statistics_provider_.ClearMachineStatistic(system::kActivateDateKey);
   EXPECT_NE(policy::AUTO_ENROLLMENT_STATE_NO_ENROLLMENT,
@@ -798,6 +828,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
   EXPECT_CALL(*mock_update_screen_, StartNetworkCheck()).Times(1);
   EXPECT_CALL(*mock_update_screen_, Show()).Times(1);
   OnExit(ScreenObserver::EULA_ACCEPTED);
+
   // Let update screen smooth time process (time = 0ms).
   content::RunAllPendingInMessageLoop();
 
@@ -810,6 +841,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
       AutoEnrollmentCheckScreen::Get(WizardController::default_controller());
   EXPECT_EQ(screen,
             WizardController::default_controller()->current_screen());
+  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(1);
   screen->Start();
   EXPECT_EQ(policy::AUTO_ENROLLMENT_STATE_NO_ENROLLMENT,
             LoginDisplayHostImpl::default_host()
@@ -817,6 +849,57 @@ IN_PROC_BROWSER_TEST_F(WizardControllerEnrollmentFlowTest,
                 ->state());
 }
 
+IN_PROC_BROWSER_TEST_F(WizardControllerDeviceStateTest,
+                       ControlFlowDeviceDisabled) {
+  CheckCurrentScreen(WizardController::kNetworkScreenName);
+  EXPECT_CALL(*mock_network_screen_, Hide()).Times(1);
+  EXPECT_CALL(*mock_eula_screen_, Show()).Times(1);
+  OnExit(ScreenObserver::NETWORK_CONNECTED);
+
+  CheckCurrentScreen(WizardController::kEulaScreenName);
+  EXPECT_CALL(*mock_eula_screen_, Hide()).Times(1);
+  EXPECT_CALL(*mock_update_screen_, StartNetworkCheck()).Times(1);
+  EXPECT_CALL(*mock_update_screen_, Show()).Times(1);
+  OnExit(ScreenObserver::EULA_ACCEPTED);
+
+  // Let update screen smooth time process (time = 0ms).
+  content::RunAllPendingInMessageLoop();
+
+  CheckCurrentScreen(WizardController::kUpdateScreenName);
+  EXPECT_CALL(*mock_update_screen_, Hide()).Times(1);
+  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Show()).Times(1);
+  OnExit(ScreenObserver::UPDATE_INSTALLED);
+
+  AutoEnrollmentCheckScreen* screen =
+      AutoEnrollmentCheckScreen::Get(WizardController::default_controller());
+  EXPECT_EQ(screen,
+            WizardController::default_controller()->current_screen());
+  EXPECT_CALL(*mock_auto_enrollment_check_screen_, Hide()).Times(1);
+  screen->Start();
+
+  // Wait for auto-enrollment controller to encounter the connection error.
+  WaitForAutoEnrollmentState(policy::AUTO_ENROLLMENT_STATE_CONNECTION_ERROR);
+
+  // The error screen shows up if device state could not be retrieved.
+  EXPECT_FALSE(StartupUtils::IsOobeCompleted());
+  EXPECT_EQ(GetErrorScreen(),
+            WizardController::default_controller()->current_screen());
+  base::DictionaryValue device_state;
+  device_state.SetBoolean(policy::kDeviceStateDisabled, true);
+  device_state.SetString(policy::kDeviceStateDisabledMessage, kDisabledMessage);
+  g_browser_process->local_state()->Set(prefs::kServerBackedDeviceState,
+                                        device_state);
+  EXPECT_CALL(*device_disabled_screen_actor_, Show(kDisabledMessage)).Times(1);
+  OnExit(ScreenObserver::ENTERPRISE_AUTO_ENROLLMENT_CHECK_COMPLETED);
+
+  ResetAutoEnrollmentCheckScreen();
+
+  // Make sure the device disabled screen is shown.
+  CheckCurrentScreen(WizardController::kDeviceDisabledScreenName);
+
+  EXPECT_FALSE(StartupUtils::IsOobeCompleted());
+}
+
 class WizardControllerBrokenLocalStateTest : public WizardControllerTest {
  protected:
   WizardControllerBrokenLocalStateTest()
@@ -845,11 +928,6 @@ class WizardControllerBrokenLocalStateTest : public WizardControllerTest {
     WizardController::default_controller()->is_official_build_ = true;
   }
 
-  virtual void TearDownInProcessBrowserTestFixture() override {
-    WizardControllerTest::TearDownInProcessBrowserTestFixture();
-  }
-
-
   FakeSessionManagerClient* fake_session_manager_client() const {
     return fake_session_manager_client_;
   }
@@ -970,6 +1048,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerKioskFlowTest,
   EXPECT_CALL(*mock_update_screen_, StartNetworkCheck()).Times(1);
   EXPECT_CALL(*mock_update_screen_, Show()).Times(1);
   OnExit(ScreenObserver::EULA_ACCEPTED);
+
   // Let update screen smooth time process (time = 0ms).
   content::RunAllPendingInMessageLoop();
 
@@ -1014,6 +1093,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerKioskFlowTest,
   EXPECT_CALL(*mock_update_screen_, StartNetworkCheck()).Times(1);
   EXPECT_CALL(*mock_update_screen_, Show()).Times(1);
   OnExit(ScreenObserver::EULA_ACCEPTED);
+
   // Let update screen smooth time process (time = 0ms).
   content::RunAllPendingInMessageLoop();
 
@@ -1113,7 +1193,7 @@ IN_PROC_BROWSER_TEST_F(WizardControllerOobeResumeTest,
 // TODO(dzhioev): Add tests for controller/host pairing flow.
 // http://crbug.com/375191
 
-COMPILE_ASSERT(ScreenObserver::EXIT_CODES_COUNT == 23,
+COMPILE_ASSERT(ScreenObserver::EXIT_CODES_COUNT == 24,
                add_tests_for_new_control_flow_you_just_introduced);
 
 }  // namespace chromeos

chrome/browser/chromeos/policy/auto_enrollment_client.cc

@@ -410,6 +410,17 @@ bool AutoEnrollmentClient::OnDeviceStateRequestCompletion(
                  kDeviceStateRestoreMode,
                  !restore_mode.empty(),
                  new base::StringValue(restore_mode));
+
+      UpdateDict(dict.Get(),
+                 kDeviceStateDisabled,
+                 true /* set_or_clear */,
+                 new base::FundamentalValue(
+                     state_response.has_disabled_state()));
+      UpdateDict(dict.Get(),
+                 kDeviceStateDisabledMessage,
+                 state_response.has_disabled_state(),
+                 new base::StringValue(
+                     state_response.disabled_state().message()));
     }
     local_state_->CommitPendingWrite();
     device_state_available_ = true;

chrome/browser/chromeos/policy/auto_enrollment_client_unittest.cc

@@ -35,6 +35,7 @@ const char kStateKey[] = "state_key";
 const char kStateKeyHash[] =
     "\xde\x74\xcd\xf0\x03\x36\x8c\x21\x79\xba\xb1\x5a\xc4\x32\xee\xd6"
     "\xb3\x4a\x5e\xff\x73\x7e\x92\xd9\xf8\x6e\x72\x44\xd0\x97\xc3\xe6";
+const char kDisabledMessage[] = "This device has been disabled.";
 
 using ::testing::InSequence;
 using ::testing::Mock;
@@ -116,12 +117,18 @@ class AutoEnrollmentClientTest : public testing::Test {
 
   void ServerWillSendState(
       const std::string& management_domain,
-      em::DeviceStateRetrievalResponse::RestoreMode restore_mode) {
+      em::DeviceStateRetrievalResponse::RestoreMode restore_mode,
+      scoped_ptr<std::string> device_disabled_message) {
     em::DeviceManagementResponse response;
     em::DeviceStateRetrievalResponse* state_response =
         response.mutable_device_state_retrieval_response();
     state_response->set_restore_mode(restore_mode);
     state_response->set_management_domain(management_domain);
+    if (device_disabled_message) {
+      em::DisabledState* disabled_state =
+          state_response->mutable_disabled_state();
+      disabled_state->set_message(*device_disabled_message);
+    }
     EXPECT_CALL(
         *service_,
         CreateJob(DeviceManagementRequestJob::TYPE_DEVICE_STATE_RETRIEVAL, _))
@@ -153,8 +160,10 @@ class AutoEnrollmentClientTest : public testing::Test {
     return local_state_->GetUserPref(prefs::kServerBackedDeviceState);
   }
 
-  void VerifyServerBackedState(const std::string& expected_management_domain,
-                               const std::string& expected_restore_mode) {
+  void VerifyServerBackedState(
+      const std::string& expected_management_domain,
+      const std::string& expected_restore_mode,
+      scoped_ptr<std::string> expected_disabled_message) {
     const base::Value* state =
         local_state_->GetUserPref(prefs::kServerBackedDeviceState);
     ASSERT_TRUE(state);
@@ -166,10 +175,29 @@ class AutoEnrollmentClientTest : public testing::Test {
                                       &actual_management_domain));
     EXPECT_EQ(expected_management_domain, actual_management_domain);
 
-    std::string actual_restore_mode;
-    EXPECT_TRUE(state_dict->GetString(kDeviceStateRestoreMode,
-                                      &actual_restore_mode));
-    EXPECT_EQ(expected_restore_mode, actual_restore_mode);
+    if (!expected_restore_mode.empty()) {
+      std::string actual_restore_mode;
+      EXPECT_TRUE(state_dict->GetString(kDeviceStateRestoreMode,
+                                        &actual_restore_mode));
+      EXPECT_EQ(expected_restore_mode, actual_restore_mode);
+    } else {
+      EXPECT_FALSE(state_dict->HasKey(kDeviceStateRestoreMode));
+    }
+
+    const bool expected_disabled_state = expected_disabled_message;
+    bool actual_disabled_state = false;
+    EXPECT_TRUE(state_dict->GetBoolean(kDeviceStateDisabled,
+                                       &actual_disabled_state));
+    EXPECT_EQ(expected_disabled_state, actual_disabled_state);
+
+    if (expected_disabled_message) {
+      std::string actual_disabled_message;
+      EXPECT_TRUE(state_dict->GetString(kDeviceStateDisabledMessage,
+                                        &actual_disabled_message));
+      EXPECT_EQ(*expected_disabled_message, actual_disabled_message);
+    } else {
+      EXPECT_FALSE(state_dict->HasKey(kDeviceStateDisabledMessage));
+    }
   }
 
   const em::DeviceAutoEnrollmentRequest& auto_enrollment_request() {
@@ -243,12 +271,14 @@ TEST_F(AutoEnrollmentClientTest, AskForLess) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyCachedResult(true, 8);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 }
 
 TEST_F(AutoEnrollmentClientTest, AskForSame) {
@@ -257,12 +287,14 @@ TEST_F(AutoEnrollmentClientTest, AskForSame) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyCachedResult(true, 8);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 }
 
 TEST_F(AutoEnrollmentClientTest, AskForSameTwice) {
@@ -310,16 +342,18 @@ TEST_F(AutoEnrollmentClientTest, ConsumerDevice) {
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_NO_ENROLLMENT, state_);
 }
 
-TEST_F(AutoEnrollmentClientTest, EnterpriseDevice) {
+TEST_F(AutoEnrollmentClientTest, ForcedReEnrollment) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      nullptr);
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyCachedResult(true, 8);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          nullptr);
 
   // Network changes don't trigger retries after obtaining a response from
   // the server.
@@ -327,6 +361,34 @@ TEST_F(AutoEnrollmentClientTest, EnterpriseDevice) {
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
 }
 
+TEST_F(AutoEnrollmentClientTest, RequestedReEnrollment) {
+  ServerWillReply(-1, true, true);
+  ServerWillSendState(
+      "example.com",
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_REQUESTED,
+      nullptr);
+  client_->Start();
+  EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
+  VerifyCachedResult(true, 8);
+  VerifyServerBackedState("example.com",
+                          kDeviceStateRestoreModeReEnrollmentRequested,
+                          nullptr);
+}
+
+TEST_F(AutoEnrollmentClientTest, DeviceDisabled) {
+  ServerWillReply(-1, true, true);
+  ServerWillSendState(
+      "example.com",
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_NONE,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
+  client_->Start();
+  EXPECT_EQ(AUTO_ENROLLMENT_STATE_NO_ENROLLMENT, state_);
+  VerifyCachedResult(true, 8);
+  VerifyServerBackedState("example.com",
+                          "",
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
+}
+
 TEST_F(AutoEnrollmentClientTest, NoSerial) {
   CreateClient("", true, 4, 8);
   client_->Start();
@@ -372,12 +434,14 @@ TEST_F(AutoEnrollmentClientTest, MoreThan32BitsUploaded) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyCachedResult(true, 37);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 }
 
 TEST_F(AutoEnrollmentClientTest, ReuseCachedDecision) {
@@ -388,11 +452,13 @@ TEST_F(AutoEnrollmentClientTest, ReuseCachedDecision) {
                             new base::FundamentalValue(8));
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
   AutoEnrollmentClient::CancelAutoEnrollment();
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_NO_ENROLLMENT, state_);
@@ -408,11 +474,13 @@ TEST_F(AutoEnrollmentClientTest, RetryIfPowerLargerThanCached) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 }
 
 TEST_F(AutoEnrollmentClientTest, NetworkChangeRetryAfterErrors) {
@@ -433,12 +501,14 @@ TEST_F(AutoEnrollmentClientTest, NetworkChangeRetryAfterErrors) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->OnNetworkChanged(net::NetworkChangeNotifier::CONNECTION_ETHERNET);
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   EXPECT_TRUE(HasCachedDecision());
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 
   // Subsequent network changes don't trigger retries.
   client_->OnNetworkChanged(net::NetworkChangeNotifier::CONNECTION_NONE);
@@ -446,7 +516,8 @@ TEST_F(AutoEnrollmentClientTest, NetworkChangeRetryAfterErrors) {
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   EXPECT_TRUE(HasCachedDecision());
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 }
 
 TEST_F(AutoEnrollmentClientTest, CancelAndDeleteSoonWithPendingRequest) {
@@ -504,11 +575,13 @@ TEST_F(AutoEnrollmentClientTest, CancelAndDeleteSoonAfterCompletion) {
   ServerWillReply(-1, true, true);
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   client_->Start();
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
 
   // The client will delete itself immediately if there are no pending
   // requests.
@@ -552,7 +625,8 @@ TEST_F(AutoEnrollmentClientTest, NetworkFailureThenRequireUpdatedModulus) {
   // State download triggers.
   ServerWillSendState(
       "example.com",
-      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED);
+      em::DeviceStateRetrievalResponse::RESTORE_MODE_REENROLLMENT_ENFORCED,
+      make_scoped_ptr(new std::string(kDisabledMessage)));
   EXPECT_CALL(*service_, StartJob(_, _, _, _, _, _, _));
 
   // Trigger a network change event.
@@ -560,7 +634,8 @@ TEST_F(AutoEnrollmentClientTest, NetworkFailureThenRequireUpdatedModulus) {
   EXPECT_EQ(AUTO_ENROLLMENT_STATE_TRIGGER_ENROLLMENT, state_);
   EXPECT_TRUE(HasCachedDecision());
   VerifyServerBackedState("example.com",
-                          kDeviceStateRestoreModeReEnrollmentEnforced);
+                          kDeviceStateRestoreModeReEnrollmentEnforced,
+                          make_scoped_ptr(new std::string(kDisabledMessage)));
   Mock::VerifyAndClearExpectations(service_.get());
 }
 

chrome/browser/chromeos/policy/server_backed_device_state.cc

@@ -8,6 +8,8 @@ namespace policy {
 
 const char kDeviceStateManagementDomain[] = "management_domain";
 const char kDeviceStateRestoreMode[] = "device_mode";
+const char kDeviceStateDisabled[] = "disabled";
+const char kDeviceStateDisabledMessage[] = "disabled_message";
 
 const char kDeviceStateRestoreModeReEnrollmentRequested[] =
     "re-enrollment-requested";

chrome/browser/chromeos/policy/server_backed_device_state.h

@@ -10,6 +10,8 @@ namespace policy {
 // Dictionary key constants for prefs::kServerBackedDeviceState.
 extern const char kDeviceStateManagementDomain[];
 extern const char kDeviceStateRestoreMode[];
+extern const char kDeviceStateDisabled[];
+extern const char kDeviceStateDisabledMessage[];
 
 // Values for kDeviceStateRestoreMode.
 extern const char kDeviceStateRestoreModeReEnrollmentEnforced[];

chrome/browser/resources/chromeos/login/screen_device_disabled.js

@@ -20,14 +20,12 @@ login.createScreen('DeviceDisabledScreen', 'device-disabled', function() {
     },
 
     /**
-      * Sets the message to show to the user. If |message| is empty, a default
-      * message will be shown.
+      * Sets the message to show to the user.
       * @param {string} message The message to show to the user.
       * @private
       */
     setMessage: function(message) {
-      $('device-disabled-message').textContent =
-          message || loadTimeData.getString('deviceDisabledDefaultMessage');
+      $('device-disabled-message').textContent = message;
     }
   };
 });

chrome/browser/ui/webui/chromeos/login/device_disabled_screen_handler.cc

@@ -27,12 +27,14 @@ DeviceDisabledScreenHandler::~DeviceDisabledScreenHandler() {
     delegate_->OnActorDestroyed(this);
 }
 
-void DeviceDisabledScreenHandler::Show() {
+void DeviceDisabledScreenHandler::Show(const std::string& message) {
   if (!page_is_ready()) {
     show_on_init_ = true;
+    message_ = message;
     return;
   }
 
+  CallJS("setMessage", message);
   ShowScreen(OobeUI::kScreenDeviceDisabled, NULL);
 }
 
@@ -49,8 +51,6 @@ void DeviceDisabledScreenHandler::SetDelegate(Delegate* delegate) {
 void DeviceDisabledScreenHandler::DeclareLocalizedValues(
     LocalizedValuesBuilder* builder) {
   builder->Add("deviceDisabledHeading", IDS_DEVICE_DISABLED_HEADING);
-  builder->Add("deviceDisabledDefaultMessage",
-               IDS_DEVICE_DISABLED_DEFAULT_MESSAGE);
   builder->Add("deviceDisabledExplanation", IDS_DEVICE_DISABLED_EXPLANATION);
 }
 
@@ -59,7 +59,7 @@ void DeviceDisabledScreenHandler::Initialize() {
     return;
 
   if (show_on_init_) {
-    Show();
+    Show(message_);
     show_on_init_ = false;
   }
 }

chrome/browser/ui/webui/chromeos/login/device_disabled_screen_handler.h

@@ -5,6 +5,8 @@
 #ifndef CHROME_BROWSER_UI_WEBUI_CHROMEOS_LOGIN_DEVICE_DISABLED_SCREEN_HANDLER_H_
 #define CHROME_BROWSER_UI_WEBUI_CHROMEOS_LOGIN_DEVICE_DISABLED_SCREEN_HANDLER_H_
 
+#include <string>
+
 #include "base/macros.h"
 #include "chrome/browser/chromeos/login/screens/device_disabled_screen_actor.h"
 #include "chrome/browser/ui/webui/chromeos/login/base_screen_handler.h"
@@ -19,7 +21,7 @@ class DeviceDisabledScreenHandler : public DeviceDisabledScreenActor,
   ~DeviceDisabledScreenHandler() override;
 
   // DeviceDisabledScreenActor:
-  void Show() override;
+  void Show(const std::string& message) override;
   void Hide() override;
   void SetDelegate(Delegate* delegate) override;
 
@@ -36,6 +38,9 @@ class DeviceDisabledScreenHandler : public DeviceDisabledScreenActor,
   // Indicates whether the screen should be shown right after initialization.
   bool show_on_init_;
 
+  // The message to show to the user.
+  std::string message_;
+
   DISALLOW_COPY_AND_ASSIGN(DeviceDisabledScreenHandler);
 };
 

chrome/chrome_tests_unit.gypi

@@ -204,6 +204,7 @@
       'browser/chromeos/login/hwid_checker_unittest.cc',
       'browser/chromeos/login/profile_auth_data_unittest.cc',
       'browser/chromeos/login/saml/saml_offline_signin_limiter_unittest.cc',
+      'browser/chromeos/login/screens/device_disabled_screen_unittest.cc',
       'browser/chromeos/login/screens/screen_context_unittest.cc',
       'browser/chromeos/login/signin/merge_session_load_page_unittest.cc',
       'browser/chromeos/login/supervised/supervised_user_authentication_unittest.cc',
@@ -1713,14 +1714,8 @@
             'browser/chromeos/login/fake_login_utils.h',
             'browser/chromeos/login/mock_login_utils.cc',
             'browser/chromeos/login/mock_login_utils.h',
-            'browser/chromeos/login/users/avatar/mock_user_image_manager.cc',
-            'browser/chromeos/login/users/avatar/mock_user_image_manager.h',
-            'browser/chromeos/login/users/fake_supervised_user_manager.cc',
-            'browser/chromeos/login/users/fake_supervised_user_manager.h',
-            'browser/chromeos/login/users/fake_user_manager.cc',
-            'browser/chromeos/login/users/fake_user_manager.h',
-            'browser/chromeos/login/users/mock_user_manager.cc',
-            'browser/chromeos/login/users/mock_user_manager.h',
+            'browser/chromeos/login/screens/mock_device_disabled_screen_actor.cc',
+            'browser/chromeos/login/screens/mock_device_disabled_screen_actor.h',
             'browser/chromeos/login/test/oobe_screen_waiter.cc',
             'browser/chromeos/login/test/oobe_screen_waiter.h',
             'browser/chromeos/login/test/js_checker.cc',
@@ -1729,6 +1724,14 @@
             'browser/chromeos/login/ui/mock_login_display.h',
             'browser/chromeos/login/ui/mock_login_display_host.cc',
             'browser/chromeos/login/ui/mock_login_display_host.h',
+            'browser/chromeos/login/users/avatar/mock_user_image_manager.cc',
+            'browser/chromeos/login/users/avatar/mock_user_image_manager.h',
+            'browser/chromeos/login/users/fake_supervised_user_manager.cc',
+            'browser/chromeos/login/users/fake_supervised_user_manager.h',
+            'browser/chromeos/login/users/fake_user_manager.cc',
+            'browser/chromeos/login/users/fake_user_manager.h',
+            'browser/chromeos/login/users/mock_user_manager.cc',
+            'browser/chromeos/login/users/mock_user_manager.h',
             'browser/chromeos/net/network_portal_detector_test_utils.cc',
             'browser/chromeos/net/network_portal_detector_test_utils.h',
             'browser/chromeos/policy/cloud_external_data_manager_base_test_util.cc',

chromeos/chromeos_switches.cc

@@ -85,6 +85,9 @@ const char kEnableCloudBackup[] = "enable-cloud-backup";
 // locate the device.
 const char kEnableConsumerManagement[] = "enable-consumer-management";
 
+// If this switch is set, the device cannot be remotely disabled by its owner.
+const char kDisableDeviceDisabling[] = "disable-device-disabling";
+
 // If this switch is set, Chrome OS login screen uses |EmbeddedSignin| endpoint
 // of GAIA.
 const char kEnableEmbeddedSignin[] = "enable-embedded-signin";

chromeos/chromeos_switches.h

@@ -44,6 +44,7 @@ CHROMEOS_EXPORT extern const char kEnableCarrierSwitching[];
 CHROMEOS_EXPORT extern const char kEnableChromeVoxNext[];
 CHROMEOS_EXPORT extern const char kEnableCloudBackup[];
 CHROMEOS_EXPORT extern const char kEnableConsumerManagement[];
+CHROMEOS_EXPORT extern const char kDisableDeviceDisabling[];
 CHROMEOS_EXPORT extern const char kEnableEmbeddedSignin[];
 CHROMEOS_EXPORT extern const char kEnableExtensionAssetsSharing[];
 CHROMEOS_EXPORT extern const char kEnableFirstRunUITransitions[];

components/policy/proto/device_management_backend.proto

@@ -599,6 +599,11 @@ message DeviceStateKeyUpdateRequest {
   repeated bytes server_backed_state_key = 1;
 }
 
+message DisabledState {
+  // A message to the finder/thief that should be shown on the screen.
+  optional string message = 1;
+}
+
 // Server to client message carrying the device state response. Because the
 // request is not authenticated, the only protection against state extraction
 // from server is the unpredictability of the server-backed state ID. Thus, the
@@ -620,6 +625,9 @@ message DeviceStateRetrievalResponse {
 
   // Primary domain the device is associated with.
   optional string management_domain = 2;
+
+  // The device is disabled and no logins are possible when this is set.
+  optional DisabledState disabled_state = 3;
 }
 
 // Sent by the client to the server to pair the Host device with the Controller