cros: Honor DeviceLoginScreenInputMethods on the login screen.

Stop honor the policy on the lock screen.
Also tweaked LoginScreen*Policy tests a bit

Fixed: 1071012
Bug: 1067260, 1071010, 1071779
Change-Id: Icaa5fd108b66dbe22fde738f000b3eff49236347
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2149357
Commit-Queue: Roman Sorokin [CET] <rsorokin@chromium.org>
Reviewed-by: Alexander Alekseev <alemate@chromium.org>
Reviewed-by: Denis Kuznetsov [CET] <antrim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#760016}

chrome/browser/chromeos/login/lock/views_screen_locker.cc

@@ -100,8 +100,6 @@ ViewsScreenLocker::~ViewsScreenLocker() {
 void ViewsScreenLocker::Init() {
   lock_time_ = base::TimeTicks::Now();
   user_selection_screen_->Init(screen_locker_->GetUsersToShow());
-  if (!ime_state_.get())
-    ime_state_ = input_method::InputMethodManager::Get()->GetActiveIMEState();
 
   // Reset Caps Lock state when lock screen is shown.
   input_method::InputMethodManager::Get()->GetImeKeyboard()->SetCapsLockEnabled(
@@ -128,13 +126,6 @@ void ViewsScreenLocker::Init() {
                       base::TimeTicks::Now() - lock_time_);
   screen_locker_->ScreenLockReady();
   lock_screen_apps::StateController::Get()->SetFocusCyclerDelegate(this);
-
-  allowed_input_methods_subscription_ =
-      CrosSettings::Get()->AddSettingsObserver(
-          kDeviceLoginScreenInputMethods,
-          base::Bind(&ViewsScreenLocker::OnAllowedInputMethodsChanged,
-                     base::Unretained(this)));
-  OnAllowedInputMethodsChanged();
 }
 
 void ViewsScreenLocker::ShowErrorMessage(
@@ -310,10 +301,6 @@ void ViewsScreenLocker::UpdateChallengeResponseAuthAvailability(
       account_id, enable_challenge_response);
 }
 
-void ViewsScreenLocker::OnAllowedInputMethodsChanged() {
-  user_selection_screen_->OnAllowedInputMethodsChanged();
-}
-
 void ViewsScreenLocker::OnPinCanAuthenticate(const AccountId& account_id,
                                              bool can_authenticate) {
   ash::LoginScreen::Get()->GetModel()->SetPinEnabledForUser(account_id,

chrome/browser/chromeos/login/lock/views_screen_locker.h

@@ -84,7 +84,6 @@ class ViewsScreenLocker : public LoginScreenClient::Delegate,
  private:
   void UpdatePinKeyboardState(const AccountId& account_id);
   void UpdateChallengeResponseAuthAvailability(const AccountId& account_id);
-  void OnAllowedInputMethodsChanged();
   void OnPinCanAuthenticate(const AccountId& account_id, bool can_authenticate);
   void OnExternalBinaryAuthTimeout();
   void OnExternalBinaryEnrollmentTimeout();
@@ -98,12 +97,6 @@ class ViewsScreenLocker : public LoginScreenClient::Delegate,
   // Time when lock was initiated, required for metrics.
   base::TimeTicks lock_time_;
 
-  // Input Method Engine state used at lock screen.
-  scoped_refptr<input_method::InputMethodManager::State> ime_state_;
-
-  std::unique_ptr<CrosSettings::ObserverSubscription>
-      allowed_input_methods_subscription_;
-
   base::OnceCallback<void(bool)> authenticate_with_external_binary_callback_;
 
   base::OnceCallback<void(bool)> enroll_user_with_external_binary_callback_;

chrome/browser/chromeos/login/lock_screen_utils.cc

@@ -18,12 +18,14 @@ namespace chromeos {
 namespace lock_screen_utils {
 
 void SetUserInputMethod(const std::string& username,
-                        input_method::InputMethodManager::State* ime_state) {
+                        input_method::InputMethodManager::State* ime_state,
+                        bool honor_device_policy) {
   bool succeed = false;
 
   const std::string input_method = GetUserLastInputMethod(username);
 
-  EnforcePolicyInputMethods(input_method);
+  if (honor_device_policy)
+    EnforceDevicePolicyInputMethods(input_method);
 
   if (!input_method.empty())
     succeed = SetUserInputMethodImpl(username, input_method, ime_state);
@@ -92,7 +94,7 @@ bool SetUserInputMethodImpl(
   return true;
 }
 
-void EnforcePolicyInputMethods(std::string user_input_method) {
+void EnforceDevicePolicyInputMethods(std::string user_input_method) {
   chromeos::CrosSettings* cros_settings = chromeos::CrosSettings::Get();
   const base::ListValue* login_screen_input_methods = nullptr;
   if (!cros_settings->GetList(chromeos::kDeviceLoginScreenInputMethods,
@@ -129,6 +131,7 @@ void StopEnforcingPolicyInputMethods() {
   imm->GetActiveIMEState()->SetAllowedInputMethods(allowed_input_methods, true);
   if (ImeControllerClient::Get())  // Can be null in tests.
     ImeControllerClient::Get()->SetImesManagedByPolicy(false);
+  imm->GetActiveIMEState()->SetInputMethodLoginDefault();
 }
 
 void SetKeyboardSettings(const AccountId& account_id) {

chrome/browser/chromeos/login/lock_screen_utils.h

@@ -20,7 +20,8 @@ namespace lock_screen_utils {
 // Update current input method (namely keyboard layout) in the given IME state
 // to last input method used by this user.
 void SetUserInputMethod(const std::string& username,
-                        input_method::InputMethodManager::State* ime_state);
+                        input_method::InputMethodManager::State* ime_state,
+                        bool honor_device_policy);
 
 // Get user's last input method.
 std::string GetUserLastInputMethod(const std::string& username);
@@ -31,8 +32,8 @@ bool SetUserInputMethodImpl(const std::string& username,
                             input_method::InputMethodManager::State* ime_state);
 
 // Sets the currently allowed input method, including those that are enforced
-// by policy.
-void EnforcePolicyInputMethods(std::string user_input_method);
+// by device policy.
+void EnforceDevicePolicyInputMethods(std::string user_input_method);
 
 // Remove any policy limitations on allowed IMEs.
 void StopEnforcingPolicyInputMethods();

chrome/browser/chromeos/login/login_screen_policy_browsertest.cc

@@ -18,10 +18,13 @@
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
 #include "chrome/browser/chromeos/login/test/js_checker.h"
+#include "chrome/browser/chromeos/login/test/login_manager_mixin.h"
+#include "chrome/browser/chromeos/login/test/oobe_screen_waiter.h"
 #include "chrome/browser/chromeos/policy/device_policy_cros_browser_test.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
 #include "chrome/browser/ui/ash/login_screen_client.h"
+#include "chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "chromeos/constants/chromeos_switches.h"
@@ -52,26 +55,7 @@ class LoginScreenPolicyTest : public policy::DevicePolicyCrosBrowserTest {
       const char* cros_setting_name);
 
  protected:
-  void WaitForLoginScreen() {
-    content::WindowedNotificationObserver(
-        chrome::NOTIFICATION_LOGIN_OR_LOCK_WEBUI_VISIBLE,
-        content::NotificationService::AllSources())
-        .Wait();
-  }
-
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    policy::DevicePolicyCrosBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kLoginManager);
-    command_line->AppendSwitch(switches::kForceLoginManagerInTests);
-  }
-
-  void TearDownOnMainThread() override {
-    // This shuts down the login UI.
-    base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::BindOnce(&chrome::AttemptExit));
-    base::RunLoop().RunUntilIdle();
-    policy::DevicePolicyCrosBrowserTest::TearDownOnMainThread();
-  }
+  LoginManagerMixin login_manager_{&mixin_host_};
 
  private:
   DISALLOW_COPY_AND_ASSIGN(LoginScreenPolicyTest);
@@ -79,46 +63,11 @@ class LoginScreenPolicyTest : public policy::DevicePolicyCrosBrowserTest {
 
 void LoginScreenPolicyTest::RefreshDevicePolicyAndWaitForSettingChange(
     const char* cros_setting_name) {
-  scoped_refptr<content::MessageLoopRunner> runner(
-      new content::MessageLoopRunner);
-  std::unique_ptr<CrosSettings::ObserverSubscription> subscription(
-      chromeos::CrosSettings::Get()->AddSettingsObserver(
-          cros_setting_name,
-          base::BindLambdaForTesting([&]() { runner->Quit(); })));
-
-  RefreshDevicePolicy();
-  runner->Run();
-}
-
-IN_PROC_BROWSER_TEST_F(LoginScreenPolicyTest, RestrictInputMethods) {
-  WaitForLoginScreen();
-
-  input_method::InputMethodManager* imm =
-      input_method::InputMethodManager::Get();
-  ASSERT_TRUE(imm);
-
-  ASSERT_EQ(0U, imm->GetActiveIMEState()->GetAllowedInputMethods().size());
-
-  em::ChromeDeviceSettingsProto& proto(device_policy()->payload());
-  proto.mutable_login_screen_input_methods()->add_login_screen_input_methods(
-      "xkb:de::ger");
-  RefreshDevicePolicyAndWaitForSettingChange(
-      chromeos::kDeviceLoginScreenInputMethods);
-
-  ASSERT_EQ(1U, imm->GetActiveIMEState()->GetAllowedInputMethods().size());
-
-  // Remove the policy again
-  proto.mutable_login_screen_input_methods()
-      ->clear_login_screen_input_methods();
-  RefreshDevicePolicyAndWaitForSettingChange(
-      chromeos::kDeviceLoginScreenInputMethods);
-
-  ASSERT_EQ(0U, imm->GetActiveIMEState()->GetAllowedInputMethods().size());
+  policy_helper()->RefreshPolicyAndWaitUntilDeviceSettingsUpdated(
+      {cros_setting_name});
 }
 
 IN_PROC_BROWSER_TEST_F(LoginScreenPolicyTest, PolicyInputMethodsListEmpty) {
-  WaitForLoginScreen();
-
   input_method::InputMethodManager* imm =
       input_method::InputMethodManager::Get();
   ASSERT_TRUE(imm);
@@ -136,19 +85,18 @@ IN_PROC_BROWSER_TEST_F(LoginScreenPolicyTest, PolicyInputMethodsListEmpty) {
   ASSERT_EQ(0U, imm->GetActiveIMEState()->GetAllowedInputMethods().size());
 }
 
-class LoginScreenGuestButtonPolicy : public LoginScreenPolicyTest {
- public:
-  LoginScreenGuestButtonPolicy() {
-    device_state_.SetState(
-        DeviceStateMixin::State::OOBE_COMPLETED_CLOUD_ENROLLED);
+class LoginScreenGuestButtonPolicyTest : public LoginScreenPolicyTest {
+ protected:
+  void SetGuestModePolicy(bool enabled) {
+    em::ChromeDeviceSettingsProto& proto(device_policy()->payload());
+    proto.mutable_guest_mode_enabled()->set_guest_mode_enabled(enabled);
+    RefreshDevicePolicyAndWaitForSettingChange(
+        chromeos::kAccountsPrefAllowGuest);
   }
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(LoginScreenGuestButtonPolicy);
 };
 
-IN_PROC_BROWSER_TEST_F(LoginScreenGuestButtonPolicy, NoUsers) {
-  WaitForLoginScreen();
+IN_PROC_BROWSER_TEST_F(LoginScreenGuestButtonPolicyTest, NoUsers) {
+  OobeScreenWaiter(GaiaView::kScreenId).Wait();
 
   // Default.
   EXPECT_TRUE(ash::LoginScreenTestApi::IsGuestButtonShown());
@@ -160,31 +108,21 @@ IN_PROC_BROWSER_TEST_F(LoginScreenGuestButtonPolicy, NoUsers) {
   test::ExecuteOobeJS("chrome.send('showGuestInOobe', [true]);");
   EXPECT_TRUE(ash::LoginScreenTestApi::IsGuestButtonShown());
 
-  {
-    em::ChromeDeviceSettingsProto& proto(device_policy()->payload());
-    proto.mutable_guest_mode_enabled()->set_guest_mode_enabled(false);
-    RefreshDevicePolicyAndWaitForSettingChange(
-        chromeos::kAccountsPrefAllowGuest);
-
+  SetGuestModePolicy(false);
   EXPECT_FALSE(ash::LoginScreenTestApi::IsGuestButtonShown());
 
   test::ExecuteOobeJS("chrome.send('showGuestInOobe', [true]);");
   // Should not affect.
   EXPECT_FALSE(ash::LoginScreenTestApi::IsGuestButtonShown());
-  }
-
-  {
-    em::ChromeDeviceSettingsProto& proto(device_policy()->payload());
-    proto.mutable_guest_mode_enabled()->set_guest_mode_enabled(true);
-    RefreshDevicePolicyAndWaitForSettingChange(
-        chromeos::kAccountsPrefAllowGuest);
 
+  SetGuestModePolicy(true);
   EXPECT_TRUE(ash::LoginScreenTestApi::IsGuestButtonShown());
-  }
 }
 
-IN_PROC_BROWSER_TEST_F(LoginScreenGuestButtonPolicy, HasUsers) {
-  WaitForLoginScreen();
+IN_PROC_BROWSER_TEST_F(LoginScreenGuestButtonPolicyTest, HasUsers) {
+  OobeScreenWaiter(GaiaView::kScreenId).Wait();
+
+  // Default.
   EXPECT_TRUE(ash::LoginScreenTestApi::IsGuestButtonShown());
 
   ash::LoginScreen::Get()->GetModel()->SetUserList({{}});
@@ -212,7 +150,6 @@ class LoginScreenLocalePolicyTestBase : public LoginScreenPolicyTest {
 
   void SetUpInProcessBrowserTestFixture() override {
     LoginScreenPolicyTest::SetUpInProcessBrowserTestFixture();
-
     em::ChromeDeviceSettingsProto& proto(device_policy()->payload());
     proto.mutable_login_screen_locales()->add_login_screen_locales(locale_);
     RefreshDevicePolicy();
@@ -231,24 +168,12 @@ class LoginScreenLocalePolicyTest : public LoginScreenLocalePolicyTestBase {
 };
 
 IN_PROC_BROWSER_TEST_F(LoginScreenLocalePolicyTest,
-                       DISABLED_PRE_LoginLocaleEnforcedByPolicy) {
-  chromeos::StartupUtils::MarkOobeCompleted();
-}
-
-IN_PROC_BROWSER_TEST_F(LoginScreenLocalePolicyTest,
-                       DISABLED_LoginLocaleEnforcedByPolicy) {
+                       LoginLocaleEnforcedByPolicy) {
   // Verifies that the default locale can be overridden with policy.
   EXPECT_EQ("fr", g_browser_process->GetApplicationLocale());
-  base::string16 french_title =
-      l10n_util::GetStringUTF16(IDS_LOGIN_POD_SIGNING_IN);
-
-  // Make sure this is really French and differs from the English title.
-  std::string loaded =
-      ui::ResourceBundle::GetSharedInstance().ReloadLocaleResources("en-US");
-  EXPECT_EQ("en-US", loaded);
-  base::string16 english_title =
-      l10n_util::GetStringUTF16(IDS_LOGIN_POD_SIGNING_IN);
-  EXPECT_NE(french_title, english_title);
+
+  // TODO(https://crbug.com/1071010) Implement dynamic locale reload on policy
+  // change.
 }
 
 class LoginScreenButtonsLocalePolicy : public LoginScreenLocalePolicyTestBase {

chrome/browser/chromeos/login/login_ui_keyboard_browsertest.cc

@@ -14,9 +14,11 @@
 #include "chrome/browser/chromeos/login/login_manager_test.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
 #include "chrome/browser/chromeos/login/test/js_checker.h"
+#include "chrome/browser/chromeos/login/test/login_manager_mixin.h"
 #include "chrome/browser/chromeos/login/test/oobe_screen_waiter.h"
 #include "chrome/browser/chromeos/login/ui/login_display_host.h"
 #include "chrome/browser/chromeos/login/ui/user_adding_screen.h"
+#include "chrome/browser/chromeos/policy/device_policy_cros_browser_test.h"
 #include "chrome/browser/chromeos/settings/scoped_testing_cros_settings.h"
 #include "chrome/browser/chromeos/settings/stub_cros_settings_provider.h"
 #include "chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.h"
@@ -25,6 +27,8 @@
 #include "components/prefs/pref_service.h"
 #include "content/public/test/test_utils.h"
 
+namespace em = enterprise_management;
+
 namespace chromeos {
 
 namespace {
@@ -317,4 +321,57 @@ IN_PROC_BROWSER_TEST_F(LoginUIKeyboardTestWithUsersAndOwner,
                                         ->GetActiveIMEState()
                                         ->GetActiveInputMethodIds());
 }
+
+class LoginUIKeyboardPolicy : public policy::DevicePolicyCrosBrowserTest {
+ protected:
+  LoginManagerMixin login_manager_{&mixin_host_};
+};
+
+IN_PROC_BROWSER_TEST_F(LoginUIKeyboardPolicy, RestrictInputMethods) {
+  input_method::InputMethodManager* imm =
+      input_method::InputMethodManager::Get();
+  ASSERT_TRUE(imm);
+
+  ASSERT_EQ(imm->GetActiveIMEState()->GetAllowedInputMethods().size(), 0U);
+  std::vector<std::string> expected_input_methods;
+  Append_en_US_InputMethods(&expected_input_methods);
+  EXPECT_EQ(input_method::InputMethodManager::Get()
+                ->GetActiveIMEState()
+                ->GetActiveInputMethodIds(),
+            expected_input_methods);
+
+  std::vector<std::string> allowed_input_method{"xkb:de::ger"};
+
+  em::ChromeDeviceSettingsProto& proto(device_policy()->payload());
+  proto.mutable_login_screen_input_methods()->add_login_screen_input_methods(
+      allowed_input_method.front());
+  policy_helper()->RefreshPolicyAndWaitUntilDeviceSettingsUpdated(
+      {chromeos::kDeviceLoginScreenInputMethods});
+
+  ASSERT_EQ(imm->GetActiveIMEState()->GetAllowedInputMethods().size(), 1U);
+  ASSERT_EQ(imm->GetActiveIMEState()->GetNumActiveInputMethods(), 1U);
+
+  chromeos::input_method::InputMethodManager::Get()->MigrateInputMethods(
+      &allowed_input_method);
+  ASSERT_EQ(imm->GetActiveIMEState()->GetCurrentInputMethod().id(),
+            allowed_input_method.front());
+
+  // The policy method stored to language_prefs::kPreferredKeyboardLayout. So
+  // it will be there after the policy is gone.
+  expected_input_methods.insert(
+      expected_input_methods.begin(),
+      imm->GetActiveIMEState()->GetActiveInputMethodIds()[0]);
+
+  // Remove the policy again
+  proto.mutable_login_screen_input_methods()
+      ->clear_login_screen_input_methods();
+  policy_helper()->RefreshPolicyAndWaitUntilDeviceSettingsUpdated(
+      {chromeos::kDeviceLoginScreenInputMethods});
+
+  ASSERT_EQ(imm->GetActiveIMEState()->GetAllowedInputMethods().size(), 0U);
+  ASSERT_EQ(expected_input_methods, input_method::InputMethodManager::Get()
+                                        ->GetActiveIMEState()
+                                        ->GetActiveInputMethodIds());
+}
+
 }  // namespace chromeos

chrome/browser/chromeos/login/screens/user_selection_screen.cc

@@ -373,7 +373,16 @@ class UserSelectionScreen::DircryptoMigrationChecker {
 
 UserSelectionScreen::UserSelectionScreen(const std::string& display_type)
     : BaseScreen(UserBoardView::kScreenId, OobeScreenPriority::DEFAULT),
-      display_type_(display_type) {}
+      display_type_(display_type) {
+  if (display_type_ != OobeUI::kLoginDisplay)
+    return;
+  allowed_input_methods_subscription_ =
+      CrosSettings::Get()->AddSettingsObserver(
+          kDeviceLoginScreenInputMethods,
+          base::Bind(&UserSelectionScreen::OnAllowedInputMethodsChanged,
+                     base::Unretained(this)));
+  OnAllowedInputMethodsChanged();
+}
 
 UserSelectionScreen::~UserSelectionScreen() {
   proximity_auth::ScreenlockBridge::Get()->SetLockHandler(nullptr);
@@ -671,8 +680,9 @@ void UserSelectionScreen::HandleFocusPod(const AccountId& account_id) {
   if (focused_pod_account_id_ == account_id)
     return;
   CheckUserStatus(account_id);
-  lock_screen_utils::SetUserInputMethod(account_id.GetUserEmail(),
-                                        ime_state_.get());
+  lock_screen_utils::SetUserInputMethod(
+      account_id.GetUserEmail(), ime_state_.get(),
+      display_type_ == OobeUI::kLoginDisplay /* honor_device_policy */);
   lock_screen_utils::SetKeyboardSettings(account_id);
 
   bool use_24hour_clock = false;
@@ -688,16 +698,18 @@ void UserSelectionScreen::HandleFocusPod(const AccountId& account_id) {
 
 void UserSelectionScreen::HandleNoPodFocused() {
   focused_pod_account_id_ = EmptyAccountId();
-  lock_screen_utils::EnforcePolicyInputMethods(std::string());
+  if (display_type_ == OobeUI::kLoginDisplay)
+    lock_screen_utils::EnforceDevicePolicyInputMethods(std::string());
 }
 
 void UserSelectionScreen::OnAllowedInputMethodsChanged() {
+  DCHECK_EQ(display_type_, OobeUI::kLoginDisplay);
   if (focused_pod_account_id_.is_valid()) {
     std::string user_input_method = lock_screen_utils::GetUserLastInputMethod(
         focused_pod_account_id_.GetUserEmail());
-    lock_screen_utils::EnforcePolicyInputMethods(user_input_method);
+    lock_screen_utils::EnforceDevicePolicyInputMethods(user_input_method);
   } else {
-    lock_screen_utils::EnforcePolicyInputMethods(std::string());
+    lock_screen_utils::EnforceDevicePolicyInputMethods(std::string());
   }
 }
 

chrome/browser/chromeos/login/screens/user_selection_screen.h

@@ -18,6 +18,7 @@
 #include "chrome/browser/chromeos/login/screens/base_screen.h"
 #include "chrome/browser/chromeos/login/signin/token_handle_util.h"
 #include "chrome/browser/chromeos/login/ui/login_display.h"
+#include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chromeos/components/proximity_auth/screenlock_bridge.h"
 #include "components/account_id/account_id.h"
 #include "components/user_manager/user.h"
@@ -61,7 +62,6 @@ class UserSelectionScreen
   void CheckUserStatus(const AccountId& account_id);
   void HandleFocusPod(const AccountId& account_id);
   void HandleNoPodFocused();
-  void OnAllowedInputMethodsChanged();
   void OnBeforeShow();
 
   // Build list of users and send it to the webui.
@@ -145,6 +145,7 @@ class UserSelectionScreen
 
   void OnUserStatusChecked(const AccountId& account_id,
                            TokenHandleUtil::TokenHandleStatus status);
+  void OnAllowedInputMethodsChanged();
 
   LoginDisplayWebUIHandler* handler_ = nullptr;
 
@@ -173,6 +174,9 @@ class UserSelectionScreen
   // Input Method Engine state used at the user selection screen.
   scoped_refptr<input_method::InputMethodManager::State> ime_state_;
 
+  std::unique_ptr<CrosSettings::ObserverSubscription>
+      allowed_input_methods_subscription_;
+
   base::WeakPtrFactory<UserSelectionScreen> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(UserSelectionScreen);

chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc

@@ -1143,7 +1143,7 @@ void GaiaScreenHandler::HandleSecurityTokenPinEntered(
 
 void GaiaScreenHandler::OnShowAddUser() {
   signin_screen_handler_->is_account_picker_showing_first_time_ = false;
-  lock_screen_utils::EnforcePolicyInputMethods(std::string());
+  lock_screen_utils::EnforceDevicePolicyInputMethods(std::string());
   ShowGaiaAsync(EmptyAccountId());
 }
 
@@ -1405,8 +1405,8 @@ void GaiaScreenHandler::ShowGaiaScreenIfReady() {
 
   // Set Least Recently Used input method for the user.
   if (!populated_email_.empty()) {
-    lock_screen_utils::SetUserInputMethod(populated_email_,
-                                          gaia_ime_state.get());
+    lock_screen_utils::SetUserInputMethod(
+        populated_email_, gaia_ime_state.get(), true /*honor_device_policy*/);
   } else {
     std::vector<std::string> input_methods;
     if (gaia_ime_state->GetAllowedInputMethods().empty()) {

chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc

@@ -259,11 +259,6 @@ SigninScreenHandler::SigninScreenHandler(
       chromeos::input_method::InputMethodManager::Get()->GetImeKeyboard();
   if (keyboard)
     keyboard->AddObserver(this);
-  allowed_input_methods_subscription_ =
-      chromeos::CrosSettings::Get()->AddSettingsObserver(
-          chromeos::kDeviceLoginScreenInputMethods,
-          base::Bind(&SigninScreenHandler::OnAllowedInputMethodsChanged,
-                     base::Unretained(this)));
 
   ash::TabletMode* tablet_mode = ash::TabletMode::Get();
   tablet_mode->AddObserver(this);
@@ -1253,7 +1248,6 @@ void SigninScreenHandler::HandleLoginVisible(const std::string& source) {
   webui_visible_ = true;
   if (preferences_changed_delayed_)
     OnPreferencesChanged();
-  OnAllowedInputMethodsChanged();
 }
 
 void SigninScreenHandler::HandleCancelPasswordChangedFlow(
@@ -1337,8 +1331,12 @@ void SigninScreenHandler::HandleFocusPod(const AccountId& account_id,
   if (is_same_pod_focused)
     return;
 
+  // TODO(https://crbug.com/1071779): Migrate KioskTest to Views Account picker.
+  // DCHECK_EQ(session_manager::SessionManager::Get()->session_state(),
+  //           session_manager::SessionState::LOGIN_SECONDARY);
   lock_screen_utils::SetUserInputMethod(account_id.GetUserEmail(),
-                                        ime_state_.get());
+                                        ime_state_.get(),
+                                        false /*honor_device_policy*/);
   lock_screen_utils::SetKeyboardSettings(account_id);
 
   bool use_24hour_clock = false;
@@ -1353,7 +1351,6 @@ void SigninScreenHandler::HandleFocusPod(const AccountId& account_id,
 
 void SigninScreenHandler::HandleNoPodFocused() {
   focused_pod_account_id_.reset();
-  lock_screen_utils::EnforcePolicyInputMethods(std::string());
 }
 
 void SigninScreenHandler::HandleGetPublicSessionKeyboardLayouts(
@@ -1473,17 +1470,4 @@ void SigninScreenHandler::OnFeedbackFinished() {
   login_feedback_.reset();
 }
 
-void SigninScreenHandler::OnAllowedInputMethodsChanged() {
-  if (!webui_visible_)
-    return;
-
-  if (focused_pod_account_id_) {
-    std::string user_input_method = lock_screen_utils::GetUserLastInputMethod(
-        focused_pod_account_id_->GetUserEmail());
-    lock_screen_utils::EnforcePolicyInputMethods(user_input_method);
-  } else {
-    lock_screen_utils::EnforcePolicyInputMethods(std::string());
-  }
-}
-
 }  // namespace chromeos

chrome/browser/ui/webui/chromeos/login/signin_screen_handler.h

@@ -399,9 +399,6 @@ class SigninScreenHandler
   // Callback invoked after the feedback is finished.
   void OnFeedbackFinished();
 
-  // Called when the cros property controlling allowed input methods changes.
-  void OnAllowedInputMethodsChanged();
-
   // After proxy auth information has been supplied, this function re-enables
   // responding to network state notifications.
   void ReenableNetworkStateUpdatesAfterProxyAuth();
@@ -442,9 +439,6 @@ class SigninScreenHandler
 
   content::NotificationRegistrar registrar_;
 
-  std::unique_ptr<CrosSettings::ObserverSubscription>
-      allowed_input_methods_subscription_;
-
   // Whether we're currently ignoring network state updates because a proxy auth
   // UI pending (or we're waiting for a grace period after the proxy auth UI is
   // finished for the network to switch into the ONLINE state).