New error message when a consumer account with packaged license enrolls

This CL adds handles the status code 417 from DMServer on an enrollment
request, which occurs when the user has a packaged license and tries to
enroll with a consumer account. The new error message hints the user to
create an admin console.

Bug: 871203
Change-Id: I9ddf696a252809f80104502b6df6744b1620e009
Reviewed-on: https://chromium-review.googlesource.com/1180961Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Alexander Alekseev <alemate@chromium.org>
Commit-Queue: Alexander Hendrich <hendrich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#586239}

chrome/app/chromeos_strings.grdp

@@ -4239,6 +4239,9 @@
   <message name="IDS_ENTERPRISE_ENROLLMENT_DOMAIN_MISMATCH_ERROR" desc="Error message shown when the device doesn't belong to the domain the user tried to enroll it to.">
     This device cannot be enrolled to the domain your account belongs to because the device is marked for management by a different domain.
   </message>
+  <message name="IDS_ENTERPRISE_ENROLLMENT_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE" desc="Error message to show when the user tries to enroll a device with a packaged license using a consumer account.">
+    Your device includes a Chrome license, but your username is not associated with an Admin console. Please create an Admin console account to proceed with enrollment. Note: If you choose to use your own domain to create a new Admin console account, you must also complete domain verification after signup. https://g.co/ChromeEnterpriseAccount
+  </message>
   <message name="IDS_ENTERPRISE_ENROLLMENT_ATTRIBUTE_ERROR" desc="Error message shown when successfully enrolled, but the device attribute update has failed.">
     Your <ph name="DEVICE_TYPE">$1<ex>Chromebook</ex></ph> has successfully been enrolled for enterprise management, but failed to send its asset and location information. Please manually enter this information from your Admin console for this device.
   </message>

chrome/browser/chromeos/login/enrollment/enterprise_enrollment_helper_impl.cc

@@ -429,6 +429,10 @@ void EnterpriseEnrollmentHelperImpl::ReportEnrollmentStatus(
         case policy::DM_STATUS_SERVICE_ARC_DISABLED:
           NOTREACHED();
           break;
+        case policy::DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE:
+          UMA(policy::
+                  kMetricEnrollmentRegisterConsumerAccountWithPackagedLicense);
+          break;
       }
       break;
     case policy::EnrollmentStatus::REGISTRATION_BAD_MODE:

chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc

@@ -208,11 +208,13 @@ void EnrollmentHandlerChromeOS::CheckAvailableLicenses(
 void EnrollmentHandlerChromeOS::HandleAvailableLicensesResult(
     DeviceManagementStatus status,
     const CloudPolicyClient::LicenseMap& license_map) {
-  if (status == DM_STATUS_SERVICE_MANAGEMENT_NOT_SUPPORTED) {
+  if (status == DM_STATUS_SERVICE_MANAGEMENT_NOT_SUPPORTED ||
+      status == DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::BindOnce(&EnrollmentHandlerChromeOS::ReportResult,
-                              weak_ptr_factory_.GetWeakPtr(),
-                              EnrollmentStatus::ForRegistrationError(status)));
+        FROM_HERE,
+        base::BindOnce(&EnrollmentHandlerChromeOS::ReportResult,
+                       weak_ptr_factory_.GetWeakPtr(),
+                       EnrollmentStatus::ForRegistrationError(status)));
     return;
   } else if (status != DM_STATUS_SUCCESS) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(

chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc

@@ -419,6 +419,11 @@ void EnrollmentScreenHandler::ShowEnrollmentStatus(
         case policy::DM_STATUS_SERVICE_DOMAIN_MISMATCH:
           ShowError(IDS_ENTERPRISE_ENROLLMENT_DOMAIN_MISMATCH_ERROR, true);
           break;
+        case policy::DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE:
+          ShowError(
+              IDS_ENTERPRISE_ENROLLMENT_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE,
+              true);
+          break;
         default:
           ShowErrorMessage(
               l10n_util::GetStringFUTF8(

chrome/browser/ui/webui/chromeos/login/host_pairing_screen_handler.cc

@@ -168,6 +168,9 @@ std::string HostPairingScreenHandler::GetErrorStringFromEnrollmentError(
         case policy::DM_STATUS_SERVICE_DOMAIN_MISMATCH:
           return l10n_util::GetStringUTF8(
               IDS_ENTERPRISE_ENROLLMENT_DOMAIN_MISMATCH_ERROR);
+        case policy::DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE:
+          return l10n_util::GetStringUTF8(
+              IDS_ENTERPRISE_ENROLLMENT_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE);
         default:
           return l10n_util::GetStringFUTF8(
               IDS_ENTERPRISE_ENROLLMENT_STATUS_REGISTRATION_FAILED,

components/policy/core/browser/cloud/message_util.cc

@@ -51,6 +51,8 @@ int GetIDSForDMStatus(DeviceManagementStatus status) {
     case DM_STATUS_SERVICE_ARC_DISABLED:
       // This error is never shown on the UI.
       return IDS_POLICY_DM_STATUS_UNKNOWN_ERROR;
+    case DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE:
+      return IDS_POLICY_DM_STATUS_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE;
   }
   NOTREACHED() << "Unhandled DM status " << status;
   return IDS_POLICY_DM_STATUS_UNKNOWN_ERROR;

components/policy/core/common/cloud/cloud_policy_constants.h

@@ -121,6 +121,8 @@ enum DeviceManagementStatus {
   DM_STATUS_SERVICE_POLICY_NOT_FOUND = 902,
   // Service error: ARC is not enabled on this domain.
   DM_STATUS_SERVICE_ARC_DISABLED = 904,
+  // Service error: Non-dasher account with packaged license can't enroll.
+  DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE = 905,
 };
 
 // List of modes that the device can be locked into.

components/policy/core/common/cloud/cloud_policy_refresh_scheduler.cc

@@ -309,6 +309,7 @@ void CloudPolicyRefreshScheduler::ScheduleRefresh() {
     case DM_STATUS_SERVICE_MISSING_LICENSES:
     case DM_STATUS_SERVICE_DEPROVISIONED:
     case DM_STATUS_SERVICE_DOMAIN_MISMATCH:
+    case DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE:
       // Need a re-registration, no use in retrying.
       CancelRefresh();
       return;

components/policy/core/common/cloud/cloud_policy_refresh_scheduler_unittest.cc

@@ -496,6 +496,7 @@ static const ClientErrorTestParam kClientErrorTestCases[] = {
     {DM_STATUS_SERVICE_MISSING_LICENSES, -1, 1},
     {DM_STATUS_SERVICE_DEVICE_ID_CONFLICT, -1, 1},
     {DM_STATUS_SERVICE_POLICY_NOT_FOUND, kPolicyRefreshRate, 1},
+    {DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE, -1, 1},
 };
 
 class CloudPolicyRefreshSchedulerClientErrorTest

components/policy/core/common/cloud/device_management_service.cc

@@ -52,6 +52,7 @@ const int kDomainMismatch = 406;
 const int kDeviceIdConflict = 409;
 const int kDeviceNotFound = 410;
 const int kPendingApproval = 412;
+const int kConsumerAccountWithPackagedLicense = 417;
 const int kInternalServerError = 500;
 const int kServiceUnavailable = 503;
 const int kPolicyNotFound = 902;
@@ -341,6 +342,9 @@ void DeviceManagementRequestJobImpl::HandleResponse(int net_error,
     case kPendingApproval:
       ReportError(DM_STATUS_SERVICE_ACTIVATION_PENDING);
       return;
+    case kConsumerAccountWithPackagedLicense:
+      ReportError(DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE);
+      return;
     case kInvalidURL:
     case kInternalServerError:
     case kServiceUnavailable:

components/policy/core/common/cloud/device_management_service_unittest.cc

@@ -434,6 +434,11 @@ INSTANTIATE_TEST_CASE_P(
             DM_STATUS_SERVICE_MISSING_LICENSES,
             net::OK,
             402,
+            PROTO_STRING(kResponseEmpty)),
+        FailedRequestParams(
+            DM_STATUS_SERVICE_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE,
+            net::OK,
+            417,
             PROTO_STRING(kResponseEmpty))));
 
 // Simple query parameter parser for testing.

components/policy/core/common/cloud/enterprise_metrics.h

@@ -232,6 +232,8 @@ enum MetricEnrollment {
   kMetricEnrollmentStoreDMTokenFailed = 56,
   // Failed to get available licenses.
   kMetricEnrollmentLicenseRequestFailed = 57,
+  // Registration failed: Consumer account with packaged license.
+  kMetricEnrollmentRegisterConsumerAccountWithPackagedLicense = 58,
 };
 
 // Events related to policy refresh.

components/policy_strings.grdp

@@ -55,6 +55,9 @@
   <message name="IDS_POLICY_DM_STATUS_CANNOT_SIGN_REQUEST" desc="Message indicating a failure to sign a request.">
     Request could not be signed
   </message>
+  <message name="IDS_POLICY_DM_STATUS_CONSUMER_ACCOUNT_WITH_PACKAGED_LICENSE" desc="Message to show when the user tries to enroll a device with a packaged license using a consumer account.">
+    Can't enroll with consumer account (packaged license available).
+  </message>
 
   <message name="IDS_POLICY_VALIDATION_OK" desc="Message indicating successful policy validation.">
     Validation successful