Add Zero-Touch to the options for initial enrollment

When the management server sends this new option, wire it to an
unescapable Zero-Touch flow.

Bug: chromium:891281
Test: N/A for now as the server doesn't return this option
Change-Id: Iaaa3dd531ccb8f8a5fb2788ca61171ad8abc487e
Reviewed-on: https://chromium-review.googlesource.com/1256906Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Cr-Commit-Position: refs/heads/master@{#595878}

chrome/browser/chromeos/policy/auto_enrollment_client_impl.cc

@@ -111,6 +111,9 @@ std::string ConvertInitialEnrollmentMode(
     case em::DeviceInitialEnrollmentStateResponse::
         INITIAL_ENROLLMENT_MODE_ENROLLMENT_ENFORCED:
       return kDeviceStateRestoreModeReEnrollmentEnforced;
+    case em::DeviceInitialEnrollmentStateResponse::
+        INITIAL_ENROLLMENT_MODE_ZERO_TOUCH_ENFORCED:
+      return kDeviceStateRestoreModeReEnrollmentZeroTouch;
   }
 }
 

components/policy/proto/device_management_backend.proto

@@ -1271,6 +1271,9 @@ message DeviceInitialEnrollmentStateResponse {
     INITIAL_ENROLLMENT_MODE_NONE = 0;
     // Enterprise enrollment is enforced and cannot be skipped.
     INITIAL_ENROLLMENT_MODE_ENROLLMENT_ENFORCED = 1;
+    // Zero-Touch (attestation-based) enrollment is enforced and cannot be
+    // skipped.
+    INITIAL_ENROLLMENT_MODE_ZERO_TOUCH_ENFORCED = 2;
   };
   // The server-indicated initial enrollment mode.
   optional InitialEnrollmentMode initial_enrollment_mode = 1