Extract the enrollment and connection initialization part out of DeviceCloudPolicyManager to DeviceCloudPolicyInitializer.

Add the logic to select between enterprise and consumer device management service.

TEST=unit_tests
BUG=353050
R=bartfab@chromium.org, mnissler@chromium.org

Review URL: https://codereview.chromium.org/290313003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@279348 0039d316-1c4b-4281-b951-d872f2087c98

14 files changed, 533 insertions, 259 deletions

diff --git a/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc b/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc
index ac6546f..f68556c 100644
--- a/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc
+++ b/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc
@@ -16,7 +16,7 @@
 #include "chrome/browser/chromeos/login/wizard_controller.h"
 #include "chrome/browser/chromeos/policy/auto_enrollment_client.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
-#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_method_call_status.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
@@ -202,12 +202,17 @@ void EnrollmentScreen::RegisterForDevicePolicy(
     return;
   }
 
-  policy::DeviceCloudPolicyManagerChromeOS::AllowedDeviceModes device_modes;
+  policy::DeviceCloudPolicyInitializer::AllowedDeviceModes device_modes;
   device_modes[policy::DEVICE_MODE_ENTERPRISE] = true;
   device_modes[policy::DEVICE_MODE_RETAIL_KIOSK] =
       enrollment_mode_ == EnrollmentScreenActor::ENROLLMENT_MODE_MANUAL;
   connector->ScheduleServiceInitialization(0);
-  connector->GetDeviceCloudPolicyManager()->StartEnrollment(
+
+  policy::DeviceCloudPolicyInitializer* dcp_initializer =
+      connector->GetDeviceCloudPolicyInitializer();
+  CHECK(dcp_initializer);
+  dcp_initializer->StartEnrollment(
+      connector->device_management_service(),
       token, is_auto_enrollment(), device_modes,
       base::Bind(&EnrollmentScreen::ReportEnrollmentStatus,
                  weak_ptr_factory_.GetWeakPtr()));
diff --git a/chrome/browser/chromeos/login/wizard_controller.cc b/chrome/browser/chromeos/login/wizard_controller.cc
index 147667a..74363db 100644
--- a/chrome/browser/chromeos/login/wizard_controller.cc
+++ b/chrome/browser/chromeos/login/wizard_controller.cc
@@ -51,7 +51,7 @@
 #include "chrome/browser/chromeos/net/delay_network_call.h"
 #include "chrome/browser/chromeos/net/network_portal_detector.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
-#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/timezone/timezone_provider.h"
 #include "chrome/browser/profiles/profile.h"
@@ -1008,21 +1008,26 @@ void WizardController::SkipPostLoginScreensForTesting() {
 bool WizardController::ShouldAutoStartEnrollment() {
   policy::BrowserPolicyConnectorChromeOS* connector =
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
-  return connector->GetDeviceCloudPolicyManager()->ShouldAutoStartEnrollment();
+  policy::DeviceCloudPolicyInitializer* dcp_initializer =
+      connector->GetDeviceCloudPolicyInitializer();
+  return dcp_initializer && dcp_initializer->ShouldAutoStartEnrollment();
 }
 
 // static
 bool WizardController::CanExitEnrollment() {
   policy::BrowserPolicyConnectorChromeOS* connector =
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
-  return connector->GetDeviceCloudPolicyManager()->CanExitEnrollment();
+  CHECK(connector);
+  return connector->GetDeviceCloudPolicyInitializer()->CanExitEnrollment();
 }
 
 // static
 std::string WizardController::GetForcedEnrollmentDomain() {
   policy::BrowserPolicyConnectorChromeOS* connector =
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
-  return connector->GetDeviceCloudPolicyManager()->GetForcedEnrollmentDomain();
+  CHECK(connector);
+  return connector->GetDeviceCloudPolicyInitializer()
+      ->GetForcedEnrollmentDomain();
 }
 
 void WizardController::OnLocalStateInitialized(bool /* succeeded */) {
diff --git a/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc b/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc
index af19adc..95e57c4 100644
--- a/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc
+++ b/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc
@@ -5,9 +5,13 @@
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 
 #include <string>
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
+#include "base/location.h"
 #include "base/logging.h"
+#include "base/message_loop/message_loop.h"
 #include "base/message_loop/message_loop_proxy.h"
 #include "base/path_service.h"
 #include "base/prefs/pref_registry_simple.h"
@@ -15,12 +19,12 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "chrome/browser/chromeos/policy/app_pack_updater.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
 #include "chrome/browser/chromeos/policy/device_local_account.h"
 #include "chrome/browser/chromeos/policy/device_local_account_policy_service.h"
 #include "chrome/browser/chromeos/policy/device_network_configuration_updater.h"
-#include "chrome/browser/chromeos/policy/device_status_collector.h"
 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
@@ -36,7 +40,6 @@
 #include "chromeos/settings/cros_settings_names.h"
 #include "chromeos/settings/cros_settings_provider.h"
 #include "chromeos/settings/timezone_settings.h"
-#include "chromeos/system/statistics_provider.h"
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h"
 #include "components/policy/core/common/proxy_policy_provider.h"
@@ -77,7 +80,7 @@ std::string GetConsumerDeviceManagementServerUrl() {
         chromeos::switches::kConsumerDeviceManagementUrl);
   }
   return kDefaultConsumerDeviceManagementServerUrl;
-};
+}
 
 }  // namespace
 
@@ -119,8 +122,6 @@ BrowserPolicyConnectorChromeOS::BrowserPolicyConnectorChromeOS()
     device_cloud_policy_manager_ =
         new DeviceCloudPolicyManagerChromeOS(device_cloud_policy_store.Pass(),
                                              base::MessageLoopProxy::current(),
-                                             GetBackgroundTaskRunner(),
-                                             install_attributes_.get(),
                                              state_keys_broker_.get());
     AddPolicyProvider(
         scoped_ptr<ConfigurationPolicyProvider>(device_cloud_policy_manager_));
@@ -152,13 +153,21 @@ void BrowserPolicyConnectorChromeOS::Init(
     // cloud policy for extensions is introduced. That means it'd have to be
     // initialized from here instead of BrowserPolicyConnector::Init().
 
-    scoped_ptr<CloudPolicyClient::StatusProvider> status_provider(
-        new DeviceStatusCollector(
+    device_cloud_policy_manager_->Initialize(local_state);
+
+    device_cloud_policy_initializer_.reset(
+        new DeviceCloudPolicyInitializer(
             local_state,
-            chromeos::system::StatisticsProvider::GetInstance(),
-            NULL));
-    device_cloud_policy_manager_->Connect(
-        local_state, device_management_service(), status_provider.Pass());
+            device_management_service(),
+            consumer_device_management_service(),
+            GetBackgroundTaskRunner(),
+            install_attributes_.get(),
+            state_keys_broker_.get(),
+            device_cloud_policy_manager_->device_store(),
+            device_cloud_policy_manager_,
+            base::Bind(&BrowserPolicyConnectorChromeOS::
+                           OnDeviceCloudPolicyManagerConnected,
+                       base::Unretained(this))));
   }
 
   device_local_account_policy_service_.reset(
@@ -201,6 +210,9 @@ void BrowserPolicyConnectorChromeOS::Shutdown() {
   if (device_local_account_policy_service_)
     device_local_account_policy_service_->Shutdown();
 
+  if (device_cloud_policy_initializer_)
+    device_cloud_policy_initializer_->Shutdown();
+
   ChromeBrowserPolicyConnector::Shutdown();
 }
 
@@ -285,4 +297,14 @@ void BrowserPolicyConnectorChromeOS::SetTimezoneIfPolicyAvailable() {
   }
 }
 
+void BrowserPolicyConnectorChromeOS::OnDeviceCloudPolicyManagerConnected() {
+  // This function is invoked by DCPInitializer, so we should release the
+  // initializer after this function returns.
+  if (device_cloud_policy_initializer_) {
+    device_cloud_policy_initializer_->Shutdown();
+    base::MessageLoop::current()->DeleteSoon(
+        FROM_HERE, device_cloud_policy_initializer_.release());
+  }
+}
+
 }  // namespace policy
diff --git a/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h b/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h
index 19f0497..fc3c6f1 100644
--- a/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h
+++ b/chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h
@@ -24,6 +24,7 @@ class URLRequestContextGetter;
 namespace policy {
 
 class AppPackUpdater;
+class DeviceCloudPolicyInitializer;
 class DeviceCloudPolicyManagerChromeOS;
 class DeviceLocalAccountPolicyService;
 class DeviceManagementService;
@@ -68,6 +69,10 @@ class BrowserPolicyConnectorChromeOS : public ChromeBrowserPolicyConnector {
     return device_cloud_policy_manager_;
   }
 
+  DeviceCloudPolicyInitializer* GetDeviceCloudPolicyInitializer() {
+    return device_cloud_policy_initializer_.get();
+  }
+
   DeviceLocalAccountPolicyService* GetDeviceLocalAccountPolicyService() {
     return device_local_account_policy_service_.get();
   }
@@ -110,10 +115,13 @@ class BrowserPolicyConnectorChromeOS : public ChromeBrowserPolicyConnector {
   // Set the timezone as soon as the policies are available.
   void SetTimezoneIfPolicyAvailable();
 
+  void OnDeviceCloudPolicyManagerConnected();
+
   // Components of the device cloud policy implementation.
   scoped_ptr<ServerBackedStateKeysBroker> state_keys_broker_;
   scoped_ptr<EnterpriseInstallAttributes> install_attributes_;
   DeviceCloudPolicyManagerChromeOS* device_cloud_policy_manager_;
+  scoped_ptr<DeviceCloudPolicyInitializer> device_cloud_policy_initializer_;
   scoped_ptr<DeviceLocalAccountPolicyService>
       device_local_account_policy_service_;
 
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_browsertest.cc b/chrome/browser/chromeos/policy/device_cloud_policy_browsertest.cc
new file mode 100644
index 0000000..e5a13d4
--- /dev/null
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_browsertest.cc
@@ -0,0 +1,61 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/compiler_specific.h"
+#include "base/logging.h"
+#include "base/macros.h"
+#include "base/message_loop/message_loop.h"
+#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_policy_cros_browser_test.h"
+#include "chrome/test/base/testing_browser_process.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace policy {
+namespace {
+
+// A test fixture simulating a browser that is already managed.
+class DeviceCloudPolicyManagedBrowserTest : public DevicePolicyCrosBrowserTest {
+ protected:
+  DeviceCloudPolicyManagedBrowserTest() {}
+
+  virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
+    DevicePolicyCrosBrowserTest::SetUpInProcessBrowserTestFixture();
+    InstallOwnerKey();
+    MarkAsEnterpriseOwned();
+    RefreshDevicePolicy();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagedBrowserTest);
+};
+
+IN_PROC_BROWSER_TEST_F(DeviceCloudPolicyManagedBrowserTest, NoInitializer) {
+  BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  EXPECT_FALSE(connector->GetDeviceCloudPolicyInitializer());
+}
+
+// A test fixture simulating a browser that is still unmanaged.
+class DeviceCloudPolicyUnmanagedBrowserTest
+    : public DevicePolicyCrosBrowserTest {
+ protected:
+  DeviceCloudPolicyUnmanagedBrowserTest() {}
+
+  virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
+    DevicePolicyCrosBrowserTest::SetUpInProcessBrowserTestFixture();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyUnmanagedBrowserTest);
+};
+
+IN_PROC_BROWSER_TEST_F(DeviceCloudPolicyUnmanagedBrowserTest,
+                       StillHasInitializer) {
+  BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  EXPECT_TRUE(connector->GetDeviceCloudPolicyInitializer());
+}
+
+}  // namespace
+}  // namespace policy
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
new file mode 100644
index 0000000..612e301
--- /dev/null
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
@@ -0,0 +1,229 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/logging.h"
+#include "base/prefs/pref_service.h"
+#include "base/sequenced_task_runner.h"
+#include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_status_collector.h"
+#include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h"
+#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
+#include "chrome/browser/chromeos/policy/server_backed_device_state.h"
+#include "chrome/common/chrome_content_client.h"
+#include "chrome/common/pref_names.h"
+#include "chromeos/system/statistics_provider.h"
+#include "components/policy/core/common/cloud/cloud_policy_constants.h"
+#include "components/policy/core/common/cloud/cloud_policy_core.h"
+#include "components/policy/core/common/cloud/system_policy_request_context.h"
+#include "net/url_request/url_request_context_getter.h"
+#include "policy/proto/device_management_backend.pb.h"
+
+namespace em = enterprise_management;
+
+namespace policy {
+
+namespace {
+
+// Gets a machine flag from StatisticsProvider, returning the given
+// |default_value| if not present.
+bool GetMachineFlag(const std::string& key, bool default_value) {
+  bool value = default_value;
+  chromeos::system::StatisticsProvider* provider =
+      chromeos::system::StatisticsProvider::GetInstance();
+  if (!provider->GetMachineFlag(key, &value))
+    return default_value;
+
+  return value;
+}
+
+}  // namespace
+
+DeviceCloudPolicyInitializer::DeviceCloudPolicyInitializer(
+    PrefService* local_state,
+    DeviceManagementService* enterprise_service,
+    DeviceManagementService* consumer_service,
+    const scoped_refptr<base::SequencedTaskRunner>& background_task_runner,
+    EnterpriseInstallAttributes* install_attributes,
+    ServerBackedStateKeysBroker* state_keys_broker,
+    DeviceCloudPolicyStoreChromeOS* device_store,
+    DeviceCloudPolicyManagerChromeOS* manager,
+    const base::Closure& on_connected_callback)
+    : local_state_(local_state),
+      enterprise_service_(enterprise_service),
+      consumer_service_(consumer_service),
+      background_task_runner_(background_task_runner),
+      install_attributes_(install_attributes),
+      state_keys_broker_(state_keys_broker),
+      device_store_(device_store),
+      manager_(manager),
+      on_connected_callback_(on_connected_callback) {
+  device_store_->AddObserver(this);
+  state_keys_update_subscription_ = state_keys_broker_->RegisterUpdateCallback(
+      base::Bind(&DeviceCloudPolicyInitializer::TryToCreateClient,
+                 base::Unretained(this)));
+
+  device_status_provider_.reset(
+      new DeviceStatusCollector(
+          local_state_,
+          chromeos::system::StatisticsProvider::GetInstance(),
+          NULL));
+
+  TryToCreateClient();
+}
+
+DeviceCloudPolicyInitializer::~DeviceCloudPolicyInitializer() {
+}
+
+void DeviceCloudPolicyInitializer::Shutdown() {
+  device_store_->RemoveObserver(this);
+  device_status_provider_.reset();
+  enrollment_handler_.reset();
+  state_keys_update_subscription_.reset();
+}
+
+void DeviceCloudPolicyInitializer::StartEnrollment(
+    DeviceManagementService* device_management_service,
+    const std::string& auth_token,
+    bool is_auto_enrollment,
+    const AllowedDeviceModes& allowed_device_modes,
+    const EnrollmentCallback& enrollment_callback) {
+  CHECK(!enrollment_handler_);
+
+  manager_->core()->Disconnect();
+  enrollment_handler_.reset(new EnrollmentHandlerChromeOS(
+      device_store_,
+      install_attributes_,
+      state_keys_broker_,
+      CreateClient(device_management_service),
+      background_task_runner_,
+      auth_token,
+      install_attributes_->GetDeviceId(),
+      is_auto_enrollment,
+      manager_->GetDeviceRequisition(),
+      allowed_device_modes,
+      base::Bind(&DeviceCloudPolicyInitializer::EnrollmentCompleted,
+                 base::Unretained(this),
+                 enrollment_callback)));
+  enrollment_handler_->StartEnrollment();
+}
+
+bool DeviceCloudPolicyInitializer::ShouldAutoStartEnrollment() const {
+  std::string restore_mode = GetRestoreMode();
+  if (restore_mode == kDeviceStateRestoreModeReEnrollmentRequested ||
+      restore_mode == kDeviceStateRestoreModeReEnrollmentEnforced) {
+    return true;
+  }
+
+  if (local_state_->HasPrefPath(prefs::kDeviceEnrollmentAutoStart))
+    return local_state_->GetBoolean(prefs::kDeviceEnrollmentAutoStart);
+
+  return GetMachineFlag(chromeos::system::kOemIsEnterpriseManagedKey, false);
+}
+
+bool DeviceCloudPolicyInitializer::CanExitEnrollment() const {
+  if (GetRestoreMode() == kDeviceStateRestoreModeReEnrollmentEnforced)
+    return false;
+
+  if (local_state_->HasPrefPath(prefs::kDeviceEnrollmentCanExit))
+    return local_state_->GetBoolean(prefs::kDeviceEnrollmentCanExit);
+
+  return GetMachineFlag(chromeos::system::kOemCanExitEnterpriseEnrollmentKey,
+                        true);
+}
+
+std::string
+DeviceCloudPolicyInitializer::GetForcedEnrollmentDomain() const {
+  const base::DictionaryValue* device_state_dict =
+      local_state_->GetDictionary(prefs::kServerBackedDeviceState);
+  std::string management_domain;
+  device_state_dict->GetString(kDeviceStateManagementDomain,
+                               &management_domain);
+  return management_domain;
+}
+
+void DeviceCloudPolicyInitializer::OnStoreLoaded(CloudPolicyStore* store) {
+  TryToCreateClient();
+}
+
+void DeviceCloudPolicyInitializer::OnStoreError(CloudPolicyStore* store) {
+  // Do nothing.
+}
+
+void DeviceCloudPolicyInitializer::EnrollmentCompleted(
+    const EnrollmentCallback& enrollment_callback,
+    EnrollmentStatus status) {
+  scoped_ptr<CloudPolicyClient> client = enrollment_handler_->ReleaseClient();
+  enrollment_handler_.reset();
+
+  if (status.status() == EnrollmentStatus::STATUS_SUCCESS) {
+    StartConnection(client.Pass());
+  } else {
+    // Some attempts to create a client may be blocked because the enrollment
+    // was in progress. We give it a try again.
+    TryToCreateClient();
+  }
+
+  if (!enrollment_callback.is_null())
+    enrollment_callback.Run(status);
+}
+
+scoped_ptr<CloudPolicyClient> DeviceCloudPolicyInitializer::CreateClient(
+    DeviceManagementService* device_management_service) {
+  scoped_refptr<net::URLRequestContextGetter> request_context =
+      new SystemPolicyRequestContext(
+          g_browser_process->system_request_context(), GetUserAgent());
+
+  return make_scoped_ptr(
+      new CloudPolicyClient(DeviceCloudPolicyManagerChromeOS::GetMachineID(),
+                            DeviceCloudPolicyManagerChromeOS::GetMachineModel(),
+                            kPolicyVerificationKeyHash,
+                            USER_AFFILIATION_NONE,
+                            device_status_provider_.get(),
+                            device_management_service,
+                            request_context));
+}
+
+void DeviceCloudPolicyInitializer::TryToCreateClient() {
+  if (device_store_->is_initialized() &&
+      device_store_->has_policy() &&
+      !state_keys_broker_->pending() &&
+      !enrollment_handler_) {
+    DeviceManagementService* service;
+    if (device_store_->policy()->management_mode() ==
+        em::PolicyData::CONSUMER_MANAGED) {
+      service = consumer_service_;
+    } else {
+      service = enterprise_service_;
+    }
+    StartConnection(CreateClient(service));
+  }
+}
+
+void DeviceCloudPolicyInitializer::StartConnection(
+    scoped_ptr<CloudPolicyClient> client) {
+  if (!manager_->core()->service())
+    manager_->StartConnection(client.Pass(), device_status_provider_.Pass());
+
+  if (!on_connected_callback_.is_null()) {
+    on_connected_callback_.Run();
+    on_connected_callback_.Reset();
+  }
+}
+
+std::string DeviceCloudPolicyInitializer::GetRestoreMode() const {
+  const base::DictionaryValue* device_state_dict =
+      local_state_->GetDictionary(prefs::kServerBackedDeviceState);
+  std::string restore_mode;
+  device_state_dict->GetString(kDeviceStateRestoreMode, &restore_mode);
+  return restore_mode;
+}
+
+}  // namespace policy
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h
new file mode 100644
index 0000000..36505fa
--- /dev/null
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer.h
@@ -0,0 +1,122 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_CLOUD_POLICY_INITIALIZER_H_
+#define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_CLOUD_POLICY_INITIALIZER_H_
+
+#include <bitset>
+#include <string>
+
+#include "base/callback.h"
+#include "base/compiler_specific.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "chrome/browser/chromeos/policy/enrollment_status_chromeos.h"
+#include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
+#include "components/policy/core/common/cloud/cloud_policy_client.h"
+#include "components/policy/core/common/cloud/cloud_policy_store.h"
+
+class PrefService;
+
+namespace base {
+class SequencedTaskRunner;
+}
+
+namespace policy {
+
+class DeviceCloudPolicyManagerChromeOS;
+class DeviceCloudPolicyStoreChromeOS;
+class DeviceManagementService;
+class EnrollmentHandlerChromeOS;
+class EnterpriseInstallAttributes;
+
+// This class connects DCPM to the correct device management service, and
+// handles the enrollment process.
+class DeviceCloudPolicyInitializer : public CloudPolicyStore::Observer {
+ public:
+  typedef std::bitset<32> AllowedDeviceModes;
+  typedef base::Callback<void(EnrollmentStatus)> EnrollmentCallback;
+
+  // |background_task_runner| is used to execute long-running background tasks
+  // that may involve file I/O.
+  // |on_connected_callback| is invoked after the device cloud policy manager
+  // is connected.
+  DeviceCloudPolicyInitializer(
+      PrefService* local_state,
+      DeviceManagementService* enterprise_service,
+      DeviceManagementService* consumer_service,
+      const scoped_refptr<base::SequencedTaskRunner>& background_task_runner,
+      EnterpriseInstallAttributes* install_attributes,
+      ServerBackedStateKeysBroker* state_keys_broker,
+      DeviceCloudPolicyStoreChromeOS* device_store,
+      DeviceCloudPolicyManagerChromeOS* manager,
+      const base::Closure& on_connected_callback);
+
+  virtual ~DeviceCloudPolicyInitializer();
+
+  void Shutdown();
+
+  // Starts enrollment or re-enrollment. Once the enrollment process completes,
+  // |enrollment_callback| is invoked and gets passed the status of the
+  // operation.
+  // |allowed_modes| specifies acceptable DEVICE_MODE_* constants for
+  // enrollment.
+  void StartEnrollment(DeviceManagementService* device_management_service,
+                       const std::string& auth_token,
+                       bool is_auto_enrollment,
+                       const AllowedDeviceModes& allowed_modes,
+                       const EnrollmentCallback& enrollment_callback);
+
+  // Checks whether enterprise enrollment should be a regular step during OOBE.
+  bool ShouldAutoStartEnrollment() const;
+
+  // Checks whether the user can cancel enrollment.
+  bool CanExitEnrollment() const;
+
+  // Gets the domain this device is supposed to be enrolled to.
+  std::string GetForcedEnrollmentDomain() const;
+
+  // CloudPolicyStore::Observer:
+  virtual void OnStoreLoaded(CloudPolicyStore* store) OVERRIDE;
+  virtual void OnStoreError(CloudPolicyStore* store) OVERRIDE;
+
+ private:
+  // Handles completion signaled by |enrollment_handler_|.
+  void EnrollmentCompleted(const EnrollmentCallback& enrollment_callback,
+                           EnrollmentStatus status);
+
+  // Creates a new CloudPolicyClient.
+  scoped_ptr<CloudPolicyClient> CreateClient(
+      DeviceManagementService* device_management_service);
+
+  void TryToCreateClient();
+  void StartConnection(scoped_ptr<CloudPolicyClient> client);
+
+  // Gets the device restore mode as stored in |local_state_|.
+  std::string GetRestoreMode() const;
+
+  PrefService* local_state_;
+  DeviceManagementService* enterprise_service_;
+  DeviceManagementService* consumer_service_;
+  scoped_refptr<base::SequencedTaskRunner> background_task_runner_;
+  EnterpriseInstallAttributes* install_attributes_;
+  ServerBackedStateKeysBroker* state_keys_broker_;
+  DeviceCloudPolicyStoreChromeOS* device_store_;
+  DeviceCloudPolicyManagerChromeOS* manager_;
+  base::Closure on_connected_callback_;
+
+  // Non-NULL if there is an enrollment operation pending.
+  scoped_ptr<EnrollmentHandlerChromeOS> enrollment_handler_;
+
+  ServerBackedStateKeysBroker::Subscription state_keys_update_subscription_;
+
+  scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyInitializer);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_CLOUD_POLICY_INITIALIZER_H_
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
index efc50b8..2e87370 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
@@ -12,24 +12,16 @@
 #include "base/prefs/pref_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/time/time.h"
-#include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/attestation/attestation_policy_observer.h"
 #include "chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
-#include "chrome/browser/chromeos/policy/enrollment_handler_chromeos.h"
-#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
-#include "chrome/browser/chromeos/policy/server_backed_device_state.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
-#include "chrome/common/chrome_content_client.h"
 #include "chrome/common/pref_names.h"
 #include "chromeos/chromeos_constants.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/system/statistics_provider.h"
-#include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/core/common/cloud/cloud_policy_store.h"
-#include "components/policy/core/common/cloud/device_management_service.h"
-#include "components/policy/core/common/cloud/system_policy_request_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "crypto/sha2.h"
 #include "policy/proto/device_management_backend.pb.h"
@@ -107,8 +99,6 @@ bool ForcedReEnrollmentEnabled() {
 DeviceCloudPolicyManagerChromeOS::DeviceCloudPolicyManagerChromeOS(
     scoped_ptr<DeviceCloudPolicyStoreChromeOS> store,
     const scoped_refptr<base::SequencedTaskRunner>& task_runner,
-    const scoped_refptr<base::SequencedTaskRunner>& background_task_runner,
-    EnterpriseInstallAttributes* install_attributes,
     ServerBackedStateKeysBroker* state_keys_broker)
     : CloudPolicyManager(
           PolicyNamespaceKey(dm_protocol::kChromeDevicePolicyType,
@@ -118,66 +108,22 @@ DeviceCloudPolicyManagerChromeOS::DeviceCloudPolicyManagerChromeOS(
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE),
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO)),
       device_store_(store.Pass()),
-      background_task_runner_(background_task_runner),
-      install_attributes_(install_attributes),
       state_keys_broker_(state_keys_broker),
-      device_management_service_(NULL),
       local_state_(NULL) {
 }
 
 DeviceCloudPolicyManagerChromeOS::~DeviceCloudPolicyManagerChromeOS() {}
 
-void DeviceCloudPolicyManagerChromeOS::Connect(
-    PrefService* local_state,
-    DeviceManagementService* device_management_service,
-    scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider) {
-  CHECK(!device_management_service_);
-  CHECK(device_management_service);
+void DeviceCloudPolicyManagerChromeOS::Initialize(PrefService* local_state) {
   CHECK(local_state);
 
   local_state_ = local_state;
-  device_management_service_ = device_management_service;
-  device_status_provider_ = device_status_provider.Pass();
 
   state_keys_update_subscription_ = state_keys_broker_->RegisterUpdateCallback(
       base::Bind(&DeviceCloudPolicyManagerChromeOS::OnStateKeysUpdated,
                  base::Unretained(this)));
 
   InitializeRequisition();
-  StartIfManaged();
-}
-
-void DeviceCloudPolicyManagerChromeOS::StartEnrollment(
-    const std::string& auth_token,
-    bool is_auto_enrollment,
-    const AllowedDeviceModes& allowed_device_modes,
-    const EnrollmentCallback& callback) {
-  CHECK(device_management_service_);
-  CHECK(!enrollment_handler_);
-  core()->Disconnect();
-
-  enrollment_handler_.reset(new EnrollmentHandlerChromeOS(
-      device_store_.get(),
-      install_attributes_,
-      state_keys_broker_,
-      CreateClient(),
-      background_task_runner_,
-      auth_token,
-      install_attributes_->GetDeviceId(),
-      is_auto_enrollment,
-      GetDeviceRequisition(),
-      allowed_device_modes,
-      base::Bind(&DeviceCloudPolicyManagerChromeOS::EnrollmentCompleted,
-                 base::Unretained(this),
-                 callback)));
-  enrollment_handler_->StartEnrollment();
-}
-
-void DeviceCloudPolicyManagerChromeOS::CancelEnrollment() {
-  if (enrollment_handler_) {
-    enrollment_handler_.reset();
-    StartIfManaged();
-  }
 }
 
 std::string DeviceCloudPolicyManagerChromeOS::GetDeviceRequisition() const {
@@ -213,49 +159,9 @@ void DeviceCloudPolicyManagerChromeOS::SetDeviceRequisition(
   }
 }
 
-bool DeviceCloudPolicyManagerChromeOS::ShouldAutoStartEnrollment() const {
-  std::string restore_mode = GetRestoreMode();
-  if (restore_mode == kDeviceStateRestoreModeReEnrollmentRequested ||
-      restore_mode == kDeviceStateRestoreModeReEnrollmentEnforced) {
-    return true;
-  }
-
-  if (local_state_->HasPrefPath(prefs::kDeviceEnrollmentAutoStart))
-    return local_state_->GetBoolean(prefs::kDeviceEnrollmentAutoStart);
-
-  return GetMachineFlag(chromeos::system::kOemIsEnterpriseManagedKey, false);
-}
-
-bool DeviceCloudPolicyManagerChromeOS::CanExitEnrollment() const {
-  if (GetRestoreMode() == kDeviceStateRestoreModeReEnrollmentEnforced)
-    return false;
-
-  if (local_state_->HasPrefPath(prefs::kDeviceEnrollmentCanExit))
-    return local_state_->GetBoolean(prefs::kDeviceEnrollmentCanExit);
-
-  return GetMachineFlag(chromeos::system::kOemCanExitEnterpriseEnrollmentKey,
-                        true);
-}
-
-std::string
-DeviceCloudPolicyManagerChromeOS::GetForcedEnrollmentDomain() const {
-  const base::DictionaryValue* device_state_dict =
-      local_state_->GetDictionary(prefs::kServerBackedDeviceState);
-  std::string management_domain;
-  device_state_dict->GetString(kDeviceStateManagementDomain,
-                               &management_domain);
-  return management_domain;
-}
-
 void DeviceCloudPolicyManagerChromeOS::Shutdown() {
   state_keys_update_subscription_.reset();
   CloudPolicyManager::Shutdown();
-  device_status_provider_.reset();
-}
-
-void DeviceCloudPolicyManagerChromeOS::OnStoreLoaded(CloudPolicyStore* store) {
-  CloudPolicyManager::OnStoreLoaded(store);
-  StartIfManaged();
 }
 
 // static
@@ -292,49 +198,13 @@ std::string DeviceCloudPolicyManagerChromeOS::GetMachineModel() {
   return GetMachineStatistic(chromeos::system::kHardwareClassKey);
 }
 
-scoped_ptr<CloudPolicyClient> DeviceCloudPolicyManagerChromeOS::CreateClient() {
-  scoped_refptr<net::URLRequestContextGetter> request_context =
-      new SystemPolicyRequestContext(
-          g_browser_process->system_request_context(), GetUserAgent());
-
-  scoped_ptr<CloudPolicyClient> client(
-      new CloudPolicyClient(GetMachineID(), GetMachineModel(),
-                            kPolicyVerificationKeyHash,
-                            USER_AFFILIATION_NONE,
-                            device_status_provider_.get(),
-                            device_management_service_,
-                            request_context));
-
-  return client.Pass();
-}
-
-void DeviceCloudPolicyManagerChromeOS::EnrollmentCompleted(
-    const EnrollmentCallback& callback,
-    EnrollmentStatus status) {
-  if (status.status() == EnrollmentStatus::STATUS_SUCCESS)
-    StartConnection(enrollment_handler_->ReleaseClient());
-  else
-    StartIfManaged();
-
-  enrollment_handler_.reset();
-  if (!callback.is_null())
-    callback.Run(status);
-}
+void DeviceCloudPolicyManagerChromeOS::StartConnection(
+    scoped_ptr<CloudPolicyClient> client_to_connect,
+    scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider) {
+  CHECK(!service());
 
-void DeviceCloudPolicyManagerChromeOS::StartIfManaged() {
-  if (device_management_service_ &&
-      local_state_ &&
-      store()->is_initialized() &&
-      store()->has_policy() &&
-      !state_keys_broker_->pending() &&
-      !enrollment_handler_ &&
-      !service()) {
-    StartConnection(CreateClient());
-  }
-}
+  device_status_provider_ = device_status_provider.Pass();
 
-void DeviceCloudPolicyManagerChromeOS::StartConnection(
-    scoped_ptr<CloudPolicyClient> client_to_connect) {
   // Set state keys here so the first policy fetch submits them to the server.
   if (ForcedReEnrollmentEnabled())
     client_to_connect->SetStateKeysToUpload(state_keys_broker_->state_keys());
@@ -348,12 +218,8 @@ void DeviceCloudPolicyManagerChromeOS::StartConnection(
 }
 
 void DeviceCloudPolicyManagerChromeOS::OnStateKeysUpdated() {
-  if (client()) {
-    if (ForcedReEnrollmentEnabled())
-      client()->SetStateKeysToUpload(state_keys_broker_->state_keys());
-  } else {
-    StartIfManaged();
-  }
+  if (client() && ForcedReEnrollmentEnabled())
+    client()->SetStateKeysToUpload(state_keys_broker_->state_keys());
 }
 
 void DeviceCloudPolicyManagerChromeOS::InitializeRequisition() {
@@ -387,12 +253,4 @@ void DeviceCloudPolicyManagerChromeOS::InitializeRequisition() {
   }
 }
 
-std::string DeviceCloudPolicyManagerChromeOS::GetRestoreMode() const {
-  const base::DictionaryValue* device_state_dict =
-      local_state_->GetDictionary(prefs::kServerBackedDeviceState);
-  std::string restore_mode;
-  device_state_dict->GetString(kDeviceStateRestoreMode, &restore_mode);
-  return restore_mode;
-}
-
 }  // namespace policy
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
index 0520567..de38c83 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
@@ -5,20 +5,16 @@
 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_CLOUD_POLICY_MANAGER_CHROMEOS_H_
 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_CLOUD_POLICY_MANAGER_CHROMEOS_H_
 
-#include <bitset>
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
-#include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
-#include "chrome/browser/chromeos/policy/enrollment_status_chromeos.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_manager.h"
-#include "components/policy/core/common/cloud/cloud_policy_store.h"
 
 namespace base {
 class SequencedTaskRunner;
@@ -36,65 +32,29 @@ class PrefService;
 namespace policy {
 
 class DeviceCloudPolicyStoreChromeOS;
-class DeviceManagementService;
-class EnrollmentHandlerChromeOS;
-class EnterpriseInstallAttributes;
 
-// CloudPolicyManager specialization for device policy on Chrome OS. The most
-// significant addition is support for device enrollment.
+// CloudPolicyManager specialization for device policy on Chrome OS.
 class DeviceCloudPolicyManagerChromeOS : public CloudPolicyManager {
  public:
-  typedef std::bitset<32> AllowedDeviceModes;
-  typedef base::Callback<void(EnrollmentStatus)> EnrollmentCallback;
-
   // |task_runner| is the runner for policy refresh tasks.
-  // |background_task_runner| is used to execute long-running background tasks
-  // that may involve file I/O.
   DeviceCloudPolicyManagerChromeOS(
       scoped_ptr<DeviceCloudPolicyStoreChromeOS> store,
       const scoped_refptr<base::SequencedTaskRunner>& task_runner,
-      const scoped_refptr<base::SequencedTaskRunner>& background_task_runner,
-      EnterpriseInstallAttributes* install_attributes,
       ServerBackedStateKeysBroker* state_keys_broker);
   virtual ~DeviceCloudPolicyManagerChromeOS();
 
-  // Establishes the connection to the cloud, updating policy as necessary.
-  void Connect(
-      PrefService* local_state,
-      DeviceManagementService* device_management_service,
-      scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider);
-
-  // Starts enrollment or re-enrollment. Once the enrollment process completes,
-  // |callback| is invoked and gets passed the status of the operation.
-  // |allowed_modes| specifies acceptable DEVICE_MODE_* constants for
-  // enrollment.
-  void StartEnrollment(const std::string& auth_token,
-                       bool is_auto_enrollment,
-                       const AllowedDeviceModes& allowed_modes,
-                       const EnrollmentCallback& callback);
-
-  // Cancels a pending enrollment operation, if any.
-  void CancelEnrollment();
+  // Initializes state keys and requisition information.
+  void Initialize(PrefService* local_state);
 
+  // TODO(davidyu): Move these two functions to a more appropriate place. See
+  // http://crbug.com/383695.
   // Gets/Sets the device requisition.
   std::string GetDeviceRequisition() const;
   void SetDeviceRequisition(const std::string& requisition);
 
-  // Checks whether enterprise enrollment should be a regular step during OOBE.
-  bool ShouldAutoStartEnrollment() const;
-
-  // Checks whether the user can cancel enrollment.
-  bool CanExitEnrollment() const;
-
-  // Gets the domain this device is supposed to be enrolled to.
-  std::string GetForcedEnrollmentDomain() const;
-
   // CloudPolicyManager:
   virtual void Shutdown() OVERRIDE;
 
-  // CloudPolicyStore::Observer:
-  virtual void OnStoreLoaded(CloudPolicyStore* store) OVERRIDE;
-
   // Pref registration helper.
   static void RegisterPrefs(PrefRegistrySimple* registry);
 
@@ -109,51 +69,40 @@ class DeviceCloudPolicyManagerChromeOS : public CloudPolicyManager {
   // during enterprise enrollment.
   std::string GetRobotAccountId();
 
- private:
-  // Creates a new CloudPolicyClient.
-  scoped_ptr<CloudPolicyClient> CreateClient();
-
-  // Starts policy refreshes if |store_| indicates a managed device and the
-  // necessary dependencies have been provided via Initialize().
-  void StartIfManaged();
-
-  // Handles completion signaled by |enrollment_handler_|.
-  void EnrollmentCompleted(const EnrollmentCallback& callback,
-                           EnrollmentStatus status);
-
   // Starts the connection via |client_to_connect|.
-  void StartConnection(scoped_ptr<CloudPolicyClient> client_to_connect);
+  void StartConnection(scoped_ptr<CloudPolicyClient> client_to_connect,
+                       scoped_ptr<CloudPolicyClient::StatusProvider>
+                           device_status_provider);
+
+  DeviceCloudPolicyStoreChromeOS* device_store() {
+    return device_store_.get();
+  }
 
+ private:
   // Saves the state keys received from |session_manager_client_|.
   void OnStateKeysUpdated();
 
   // Initializes requisition settings at OOBE with values from VPD.
   void InitializeRequisition();
 
-  // Gets the device restore mode as stored in |local_state_|.
-  std::string GetRestoreMode() const;
-
   // Points to the same object as the base CloudPolicyManager::store(), but with
   // actual device policy specific type.
   scoped_ptr<DeviceCloudPolicyStoreChromeOS> device_store_;
-  scoped_refptr<base::SequencedTaskRunner> background_task_runner_;
-  EnterpriseInstallAttributes* install_attributes_;
   ServerBackedStateKeysBroker* state_keys_broker_;
 
   ServerBackedStateKeysBroker::Subscription state_keys_update_subscription_;
 
-  DeviceManagementService* device_management_service_;
-  scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider_;
-
   // PrefService instance to read the policy refresh rate from.
   PrefService* local_state_;
 
-  // Non-null if there is an enrollment operation pending.
-  scoped_ptr<EnrollmentHandlerChromeOS> enrollment_handler_;
-
   scoped_ptr<chromeos::attestation::AttestationPolicyObserver>
       attestation_policy_observer_;
 
+  // TODO(davidyu): Currently we need to keep this object alive while
+  // CloudPolicyClient is in use. We should have CPC take over the
+  // ownership of this object instead. See http://crbug.com/383696.
+  scoped_ptr<CloudPolicyClient::StatusProvider> device_status_provider_;
+
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOS);
 };
 
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
index 1dfedb5..b42c1720 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
@@ -7,12 +7,15 @@
 #include <algorithm>
 
 #include "base/basictypes.h"
+#include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/prefs/pref_registry_simple.h"
 #include "base/prefs/testing_pref_service.h"
 #include "base/run_loop.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
@@ -104,8 +107,6 @@ class DeviceCloudPolicyManagerChromeOSTest
     manager_.reset(new DeviceCloudPolicyManagerChromeOS(
         make_scoped_ptr(store_),
         base::MessageLoopProxy::current(),
-        base::MessageLoopProxy::current(),
-        install_attributes_.get(),
         &state_keys_broker_));
 
     chrome::RegisterLocalState(local_state_.registry());
@@ -130,6 +131,8 @@ class DeviceCloudPolicyManagerChromeOSTest
 
   virtual void TearDown() OVERRIDE {
     manager_->Shutdown();
+    if (initializer_)
+      initializer_->Shutdown();
     DeviceSettingsTestBase::TearDown();
 
     chromeos::DeviceOAuth2TokenServiceFactory::Shutdown();
@@ -149,6 +152,20 @@ class DeviceCloudPolicyManagerChromeOSTest
     ASSERT_EQ(EnterpriseInstallAttributes::LOCK_SUCCESS, result);
   }
 
+  void ConnectManager() {
+    manager_->Initialize(&local_state_);
+    initializer_.reset(new DeviceCloudPolicyInitializer(
+        &local_state_,
+        &device_management_service_,
+        &consumer_device_management_service_,
+        base::MessageLoopProxy::current(),
+        install_attributes_.get(),
+        &state_keys_broker_,
+        store_,
+        manager_.get(),
+        base::Bind(&base::DoNothing)));
+  }
+
   void VerifyPolicyPopulated() {
     PolicyBundle bundle;
     bundle.Get(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()))
@@ -168,6 +185,7 @@ class DeviceCloudPolicyManagerChromeOSTest
   string url_fetcher_response_string_;
   TestingPrefServiceSimple local_state_;
   MockDeviceManagementService device_management_service_;
+  MockDeviceManagementService consumer_device_management_service_;
   chromeos::ScopedTestDeviceSettingsService test_device_settings_service_;
   chromeos::ScopedTestCrosSettings test_cros_settings_;
   chromeos::system::MockStatisticsProvider mock_statistics_provider_;
@@ -177,6 +195,7 @@ class DeviceCloudPolicyManagerChromeOSTest
   DeviceCloudPolicyStoreChromeOS* store_;
   SchemaRegistry schema_registry_;
   scoped_ptr<DeviceCloudPolicyManagerChromeOS> manager_;
+  scoped_ptr<DeviceCloudPolicyInitializer> initializer_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(DeviceCloudPolicyManagerChromeOSTest);
@@ -187,9 +206,7 @@ TEST_F(DeviceCloudPolicyManagerChromeOSTest, FreshDevice) {
   FlushDeviceSettings();
   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
 
-  manager_->Connect(&local_state_,
-                    &device_management_service_,
-                    scoped_ptr<CloudPolicyClient::StatusProvider>());
+  manager_->Initialize(&local_state_);
 
   PolicyBundle bundle;
   EXPECT_TRUE(manager_->policies().Equals(bundle));
@@ -202,9 +219,7 @@ TEST_F(DeviceCloudPolicyManagerChromeOSTest, EnrolledDevice) {
   EXPECT_TRUE(manager_->IsInitializationComplete(POLICY_DOMAIN_CHROME));
   VerifyPolicyPopulated();
 
-  manager_->Connect(&local_state_,
-                    &device_management_service_,
-                    scoped_ptr<CloudPolicyClient::StatusProvider>());
+  ConnectManager();
   VerifyPolicyPopulated();
 
   manager_->Shutdown();
@@ -236,9 +251,7 @@ TEST_F(DeviceCloudPolicyManagerChromeOSTest, UnmanagedDevice) {
       .WillOnce(device_management_service_.CreateAsyncJob(&policy_fetch_job));
   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
       .Times(AtMost(1));
-  manager_->Connect(&local_state_,
-                    &device_management_service_,
-                    scoped_ptr<CloudPolicyClient::StatusProvider>());
+  ConnectManager();
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&device_management_service_);
   ASSERT_TRUE(policy_fetch_job);
@@ -266,9 +279,7 @@ TEST_F(DeviceCloudPolicyManagerChromeOSTest, ConsumerDevice) {
   PolicyBundle bundle;
   EXPECT_TRUE(manager_->policies().Equals(bundle));
 
-  manager_->Connect(&local_state_,
-                    &device_management_service_,
-                    scoped_ptr<CloudPolicyClient::StatusProvider>());
+  ConnectManager();
   EXPECT_TRUE(manager_->policies().Equals(bundle));
 
   manager_->Shutdown();
@@ -319,9 +330,7 @@ class DeviceCloudPolicyManagerChromeOSEnrollmentTest
     PolicyBundle bundle;
     EXPECT_TRUE(manager_->policies().Equals(bundle));
 
-    manager_->Connect(&local_state_,
-                      &device_management_service_,
-                      scoped_ptr<CloudPolicyClient::StatusProvider>());
+    ConnectManager();
   }
 
   void ExpectFailedEnrollment(EnrollmentStatus::Status status) {
@@ -353,9 +362,10 @@ class DeviceCloudPolicyManagerChromeOSEnrollmentTest
         .Times(AtMost(1))
         .WillOnce(DoAll(SaveArg<5>(&client_id_),
                         SaveArg<6>(&register_request_)));
-    DeviceCloudPolicyManagerChromeOS::AllowedDeviceModes modes;
+    DeviceCloudPolicyInitializer::AllowedDeviceModes modes;
     modes[DEVICE_MODE_ENTERPRISE] = true;
-    manager_->StartEnrollment(
+    initializer_->StartEnrollment(
+        &device_management_service_,
         "auth token", is_auto_enrollment_, modes,
         base::Bind(&DeviceCloudPolicyManagerChromeOSEnrollmentTest::Done,
                    base::Unretained(this)));
diff --git a/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc b/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
index d9b2793..67728038 100644
--- a/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
+++ b/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
@@ -12,6 +12,7 @@
 #include "chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
 #include "chrome/browser/chromeos/policy/proto/chrome_device_policy.pb.h"
+#include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
 #include "chromeos/chromeos_switches.h"
diff --git a/chrome/browser/chromeos/policy/enrollment_handler_chromeos.h b/chrome/browser/chromeos/policy/enrollment_handler_chromeos.h
index c54eb51..f016ce7 100644
--- a/chrome/browser/chromeos/policy/enrollment_handler_chromeos.h
+++ b/chrome/browser/chromeos/policy/enrollment_handler_chromeos.h
@@ -12,7 +12,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
-#include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
+#include "chrome/browser/chromeos/policy/device_cloud_policy_initializer.h"
 #include "chrome/browser/chromeos/policy/device_cloud_policy_validator.h"
 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
@@ -29,6 +29,7 @@ class PolicyFetchResponse;
 
 namespace policy {
 
+class DeviceCloudPolicyStoreChromeOS;
 class ServerBackedStateKeysBroker;
 
 // Implements the logic that establishes enterprise enrollment for Chromium OS
@@ -46,9 +47,9 @@ class EnrollmentHandlerChromeOS : public CloudPolicyClient::Observer,
                                   public CloudPolicyStore::Observer,
                                   public gaia::GaiaOAuthClient::Delegate {
  public:
-  typedef DeviceCloudPolicyManagerChromeOS::AllowedDeviceModes
+  typedef DeviceCloudPolicyInitializer::AllowedDeviceModes
       AllowedDeviceModes;
-  typedef DeviceCloudPolicyManagerChromeOS::EnrollmentCallback
+  typedef DeviceCloudPolicyInitializer::EnrollmentCallback
       EnrollmentCallback;
 
   // |store| and |install_attributes| must remain valid for the life time of the
diff --git a/chrome/chrome_browser_chromeos.gypi b/chrome/chrome_browser_chromeos.gypi
index a353ef1..7c21ea6 100644
--- a/chrome/chrome_browser_chromeos.gypi
+++ b/chrome/chrome_browser_chromeos.gypi
@@ -786,6 +786,8 @@
         'browser/chromeos/policy/cloud_external_data_store.h',
         'browser/chromeos/policy/configuration_policy_handler_chromeos.cc',
         'browser/chromeos/policy/configuration_policy_handler_chromeos.h',
+        'browser/chromeos/policy/device_cloud_policy_initializer.cc',
+        'browser/chromeos/policy/device_cloud_policy_initializer.h',
         'browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc',
         'browser/chromeos/policy/device_cloud_policy_manager_chromeos.h',
         'browser/chromeos/policy/device_cloud_policy_store_chromeos.cc',
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index e829b83..e20c037 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -1007,6 +1007,7 @@
         'browser/chromeos/login/wizard_controller_browsertest.cc',
         'browser/chromeos/memory/oom_priority_manager_browsertest.cc',
         'browser/chromeos/net/network_portal_detector_impl_browsertest.cc',
+        'browser/chromeos/policy/device_cloud_policy_browsertest.cc',
         'browser/chromeos/policy/device_local_account_browsertest.cc',
         'browser/chromeos/policy/device_policy_cros_browser_test.cc',
         'browser/chromeos/policy/device_policy_cros_browser_test.h',