signin: pull basic SigninManager functionality into new SigninManagerBase class.

Removes chrome os ifdefs from SigninManager. SigninManagerBase provides
all necessary functionality for that platform.

I plan to change most callers of SigninManagerFactory::GetForProfile to use
GetBaseForProfile in a follow up CL, and ultimately have the factory only
create an SMB (versus a full SigninManager) on Chrome OS.

TBR=sky@chromium.org
for chrome/, chrome/browser, chrome/browser/ui, and chrome/test.

TBR=zelidrag@chromium.org
for chrome/browser/chromeos/login

TBR=mpcomplete@chromium.org
for chrome/browser/extensions/api/identity

BUG=181451, 174927

Review URL: https://codereview.chromium.org/12502017

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@195410 0039d316-1c4b-4281-b951-d872f2087c98

58 files changed, 1080 insertions, 647 deletions

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 1b41027..c55c6be 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -65,8 +65,6 @@
 #include "chrome/browser/search/instant_service_factory.h"
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/search_engines/search_provider_install_state_message_filter.h"
-#include "chrome/browser/signin/signin_manager.h"
-#include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/speech/chrome_speech_recognition_manager_delegate.h"
 #include "chrome/browser/spellchecker/spellcheck_message_filter.h"
 #include "chrome/browser/ssl/ssl_add_certificate.h"
@@ -167,6 +165,11 @@
 #include "chrome/browser/ui/crypto_module_password_dialog.h"
 #endif
 
+#if !defined(OS_CHROMEOS)
+#include "chrome/browser/signin/signin_manager.h"
+#include "chrome/browser/signin/signin_manager_factory.h"
+#endif
+
 using base::FileDescriptor;
 using content::AccessTokenStore;
 using content::BrowserChildProcessHostIterator;
@@ -457,6 +460,7 @@ GURL GetEffectiveURLForInstant(const GURL& url, Profile* profile) {
   return effective_url;
 }
 
+#if !defined(OS_CHROMEOS)
 GURL GetEffectiveURLForSignin(const GURL& url) {
   CHECK(SigninManager::IsWebBasedSigninFlowURL(url));
 
@@ -469,6 +473,7 @@ GURL GetEffectiveURLForSignin(const GURL& url) {
   effective_url = effective_url.ReplaceComponents(replacements);
   return effective_url;
 }
+#endif
 
 void SetApplicationLocaleOnIOThread(const std::string& locale) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
@@ -742,12 +747,14 @@ GURL ChromeContentBrowserClient::GetEffectiveURL(
   if (chrome::ShouldAssignURLToInstantRenderer(url, profile))
     return GetEffectiveURLForInstant(url, profile);
 
+#if !defined(OS_CHROMEOS)
   // If the input |url| should be assigned to the Signin renderer, make its
   // effective URL distinct from other URLs on the signin service's domain.
   // Note that the signin renderer will be allowed to sign the user in to
   // Chrome.
   if (SigninManager::IsWebBasedSigninFlowURL(url))
     return GetEffectiveURLForSignin(url);
+#endif
 
   // If the input |url| is part of an installed app, the effective URL is an
   // extension URL with the ID of that extension as the host. This has the
@@ -786,8 +793,10 @@ bool ChromeContentBrowserClient::ShouldUseProcessPerSite(
   if (chrome::ShouldAssignURLToInstantRenderer(effective_url, profile))
     return true;
 
+#if !defined(OS_CHROMEOS)
   if (SigninManager::IsWebBasedSigninFlowURL(effective_url))
     return true;
+#endif
 
   if (!effective_url.SchemeIs(extensions::kExtensionScheme))
     return false;
@@ -871,9 +880,11 @@ bool ChromeContentBrowserClient::IsSuitableHost(
       return is_instant_process && should_be_in_instant_process;
   }
 
+#if !defined(OS_CHROMEOS)
   SigninManager* signin_manager = SigninManagerFactory::GetForProfile(profile);
   if (signin_manager && signin_manager->IsSigninProcess(process_host->GetID()))
     return SigninManager::IsWebBasedSigninFlowURL(site_url);
+#endif
 
   ExtensionService* service =
       extensions::ExtensionSystem::Get(profile)->extension_service();
@@ -971,6 +982,7 @@ void ChromeContentBrowserClient::SiteInstanceGotProcess(
       instant_service->AddInstantProcess(site_instance->GetProcess()->GetID());
   }
 
+#if !defined(OS_CHROMEOS)
   // We only expect there to be one signin process as we use process-per-site
   // for signin URLs. The signin process will be cleared from SigninManager
   // when the renderer is destroyed.
@@ -980,6 +992,7 @@ void ChromeContentBrowserClient::SiteInstanceGotProcess(
     if (signin_manager)
       signin_manager->SetSigninProcess(site_instance->GetProcess()->GetID());
   }
+#endif
 
   ExtensionService* service =
       extensions::ExtensionSystem::Get(profile)->extension_service();
@@ -1174,10 +1187,12 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
           instant_service->IsInstantProcess(process->GetID()))
         command_line->AppendSwitch(switches::kInstantProcess);
 
+#if !defined(OS_CHROMEOS)
       SigninManager* signin_manager =
           SigninManagerFactory::GetForProfile(profile);
       if (signin_manager && signin_manager->IsSigninProcess(process->GetID()))
         command_line->AppendSwitch(switches::kSigninProcess);
+#endif
     }
 
     if (content::IsThreadedCompositingEnabled())
diff --git a/chrome/browser/chromeos/login/login_utils.cc b/chrome/browser/chromeos/login/login_utils.cc
index 63e3d35..8ad9fa1 100644
--- a/chrome/browser/chromeos/login/login_utils.cc
+++ b/chrome/browser/chromeos/login/login_utils.cc
@@ -650,9 +650,10 @@ void LoginUtilsImpl::InitRlz(Profile* user_profile, bool disabled) {
 
 void LoginUtilsImpl::StartSignedInServices(Profile* user_profile) {
   // Fetch/Create the SigninManager - this will cause the TokenService to load
-  // tokens for the currently signed-in user if the SigninManager hasn't already
-  // been initialized.
-  SigninManager* signin = SigninManagerFactory::GetForProfile(user_profile);
+  // tokens for the currently signed-in user if the SigninManager hasn't
+  // already been initialized.
+  SigninManagerBase* signin =
+      SigninManagerFactory::GetForProfile(user_profile);
   DCHECK(signin);
   // Make sure SigninManager is connected to our current user (this should
   // happen automatically because we set kGoogleServicesUsername in
diff --git a/chrome/browser/chromeos/login/screen_locker.cc b/chrome/browser/chromeos/login/screen_locker.cc
index 1ed42df..853d6215 100644
--- a/chrome/browser/chromeos/login/screen_locker.cc
+++ b/chrome/browser/chromeos/login/screen_locker.cc
@@ -200,7 +200,7 @@ void ScreenLocker::OnLoginSuccess(
   if (profile && !user_context.password.empty()) {
     // We have a non-empty password, so notify listeners (such as the sync
     // engine).
-    SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+    SigninManagerBase* signin = SigninManagerFactory::GetForProfile(profile);
     DCHECK(signin);
     GoogleServiceSigninSuccessDetails details(
         signin->GetAuthenticatedUsername(),
diff --git a/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc b/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
index 336dbf6..740b19b 100644
--- a/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
+++ b/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
@@ -328,10 +328,10 @@ bool EPKPChallengeUserKey::IsRemoteAttestationEnabledForUser() const {
 }
 
 std::string EPKPChallengeUserKey::GetUserDomain() const {
-  SigninManager* signin_manager =
+  SigninManagerBase* signin_manager =
       SigninManagerFactory::GetForProfile(profile());
   if (!signin_manager)
-    return "";
+    return std::string();
 
   return gaia::ExtractDomainName(
       gaia::CanonicalizeEmail(signin_manager->GetAuthenticatedUsername()));
diff --git a/chrome/browser/extensions/api/identity/identity_api.h b/chrome/browser/extensions/api/identity/identity_api.h
index be90e32..f7b4448 100644
--- a/chrome/browser/extensions/api/identity/identity_api.h
+++ b/chrome/browser/extensions/api/identity/identity_api.h
@@ -24,6 +24,7 @@ class GetAuthTokenFunctionTest;
 class MockGetAuthTokenFunction;
 class GoogleServiceAuthError;
 class Profile;
+class SigninManagerBase;
 
 namespace extensions {
 
@@ -194,7 +195,7 @@ class IdentityAPI : public ProfileKeyedAPI,
   static const bool kServiceIsNULLWhileTesting = true;
 
   Profile* profile_;
-  SigninManager* signin_manager_;
+  SigninManagerBase* signin_manager_;
   GoogleServiceAuthError error_;
   // Used to listen to notifications from the TokenService.
   content::NotificationRegistrar registrar_;
diff --git a/chrome/browser/first_run/first_run.cc b/chrome/browser/first_run/first_run.cc
index fbac471..ec28ab1 100644
--- a/chrome/browser/first_run/first_run.cc
+++ b/chrome/browser/first_run/first_run.cc
@@ -565,7 +565,7 @@ void FirstRunBubbleLauncher::Observe(
     if (contents->GetURL().host() == chrome::kChromeUINewTabHost) {
       Profile* profile =
           Profile::FromBrowserContext(contents->GetBrowserContext());
-      SigninManager* manager =
+      SigninManagerBase* manager =
           SigninManagerFactory::GetForProfile(profile);
       bool signin_in_progress = manager &&
           (!manager->GetAuthenticatedUsername().empty() &&
diff --git a/chrome/browser/policy/cloud/user_policy_signin_service_unittest.cc b/chrome/browser/policy/cloud/user_policy_signin_service_unittest.cc
index 4922d5b..9dc136d 100644
--- a/chrome/browser/policy/cloud/user_policy_signin_service_unittest.cc
+++ b/chrome/browser/policy/cloud/user_policy_signin_service_unittest.cc
@@ -60,6 +60,25 @@ static const char kHostedDomainResponse[] =
     "  \"hd\": \"test.com\""
     "}";
 
+namespace {
+class SigninManagerFake : public FakeSigninManager {
+ public:
+  explicit SigninManagerFake(Profile* profile)
+      : FakeSigninManager(profile) {
+  }
+
+  void ForceSignOut() {
+    // Allow signing out now.
+    prohibit_signout_ = false;
+    SignOut();
+  }
+
+  static ProfileKeyedService* Build(Profile* profile) {
+    return new SigninManagerFake(profile);
+  }
+};
+}  // namespace
+
 class UserPolicySigninServiceTest : public testing::Test {
  public:
   UserPolicySigninServiceTest()
@@ -113,9 +132,9 @@ class UserPolicySigninServiceTest : public testing::Test {
     EXPECT_CALL(*mock_store_, Load()).Times(AnyNumber());
     manager_.reset(new UserCloudPolicyManager(
         profile_.get(), scoped_ptr<UserCloudPolicyStore>(mock_store_)));
-    signin_manager_ = static_cast<FakeSigninManager*>(
+    signin_manager_ = static_cast<SigninManagerFake*>(
         SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
-            profile_.get(), FakeSigninManager::Build));
+            profile_.get(), SigninManagerFake::Build));
 
     // Make sure the UserPolicySigninService is created.
     UserPolicySigninServiceFactory::GetForProfile(profile_.get());
@@ -251,7 +270,7 @@ class UserPolicySigninServiceTest : public testing::Test {
 
   net::TestURLFetcherFactory url_factory_;
 
-  FakeSigninManager* signin_manager_;
+  SigninManagerFake* signin_manager_;
 
   // Used in conjunction with OnRegisterCompleted() to test client registration
   // callbacks.
diff --git a/chrome/browser/policy/url_blacklist_manager.cc b/chrome/browser/policy/url_blacklist_manager.cc
index c99a89ea..e757b5d 100644
--- a/chrome/browser/policy/url_blacklist_manager.cc
+++ b/chrome/browser/policy/url_blacklist_manager.cc
@@ -11,7 +11,6 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/net/url_fixer_upper.h"
-#include "chrome/browser/signin/signin_manager.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/pref_names.h"
 #include "components/user_prefs/pref_registry_syncable.h"
@@ -23,6 +22,10 @@
 #include "net/base/load_flags.h"
 #include "net/url_request/url_request.h"
 
+#if !defined(OS_CHROMEOS)
+#include "chrome/browser/signin/signin_manager.h"
+#endif
+
 using content::BrowserThread;
 using extensions::URLMatcher;
 using extensions::URLMatcherCondition;
@@ -58,6 +61,8 @@ bool IsStandardScheme(const std::string& scheme) {
   return false;
 }
 
+#if !defined(OS_CHROMEOS)
+
 bool IsSigninFlowURL(const GURL& url) {
   // Whitelist all the signin flow URLs flagged by the SigninManager.
   if (SigninManager::IsWebBasedSigninFlowURL(url))
@@ -69,6 +74,8 @@ bool IsSigninFlowURL(const GURL& url) {
   return url.path() == kServiceLoginAuth;
 }
 
+#endif  // !defined(OS_CHROMEOS)
+
 // A task that builds the blacklist on the FILE thread.
 scoped_ptr<URLBlacklist> BuildBlacklist(scoped_ptr<base::ListValue> block,
                                         scoped_ptr<base::ListValue> allow) {
@@ -382,8 +389,12 @@ bool URLBlacklistManager::IsRequestBlocked(
   int filter_flags = net::LOAD_MAIN_FRAME | net::LOAD_SUB_FRAME;
   if ((request.load_flags() & filter_flags) == 0)
     return false;
+
+#if !defined(OS_CHROMEOS)
   if (IsSigninFlowURL(request.url()))
     return false;
+#endif
+
   return IsURLBlocked(request.url());
 }
 
diff --git a/chrome/browser/policy/url_blacklist_manager_unittest.cc b/chrome/browser/policy/url_blacklist_manager_unittest.cc
index b1f69d1..7fed421 100644
--- a/chrome/browser/policy/url_blacklist_manager_unittest.cc
+++ b/chrome/browser/policy/url_blacklist_manager_unittest.cc
@@ -515,12 +515,20 @@ TEST_F(URLBlacklistManagerTest, DontBlockResources) {
   request.set_load_flags(net::LOAD_MAIN_FRAME);
   EXPECT_TRUE(blacklist_manager_->IsRequestBlocked(request));
 
-  // Sync gets a free pass.
+  // On most platforms, sync gets a free pass due to signin flows.
+  bool block_signin_urls = false;
+#if defined(OS_CHROMEOS)
+  // There are no sync specific signin flows on Chrome OS, so no special
+  // treatment.
+  block_signin_urls = true;
+#endif
+
   GURL sync_url(
       GaiaUrls::GetInstance()->service_login_url() + "?service=chromiumsync");
   net::URLRequest sync_request(sync_url, NULL, &context);
   sync_request.set_load_flags(net::LOAD_MAIN_FRAME);
-  EXPECT_FALSE(blacklist_manager_->IsRequestBlocked(sync_request));
+  EXPECT_EQ(block_signin_urls,
+            blacklist_manager_->IsRequestBlocked(sync_request));
 }
 
 }  // namespace policy
diff --git a/chrome/browser/signin/fake_signin_manager.cc b/chrome/browser/signin/fake_signin_manager.cc
index 38a1b66..fcb2dc0 100644
--- a/chrome/browser/signin/fake_signin_manager.cc
+++ b/chrome/browser/signin/fake_signin_manager.cc
@@ -14,17 +14,17 @@
 #include "chrome/common/pref_names.h"
 #include "content/public/browser/notification_service.h"
 
-FakeSigninManager::FakeSigninManager(Profile* profile) {
+FakeSigninManagerBase::FakeSigninManagerBase(Profile* profile) {
   profile_ = profile;
   signin_global_error_.reset(new SigninGlobalError(this, profile));
   GlobalErrorServiceFactory::GetForProfile(profile_)->AddGlobalError(
       signin_global_error_.get());
   signin_allowed_.Init(prefs::kSigninAllowed, profile_->GetPrefs(),
-                       base::Bind(&SigninManager::OnSigninAllowedPrefChanged,
-                                  base::Unretained(this)));
+      base::Bind(&SigninManagerBase::OnSigninAllowedPrefChanged,
+      base::Unretained(this)));
 }
 
-FakeSigninManager::~FakeSigninManager() {
+FakeSigninManagerBase::~FakeSigninManagerBase() {
   if (signin_global_error_.get()) {
     GlobalErrorServiceFactory::GetForProfile(profile_)->RemoveGlobalError(
         signin_global_error_.get());
@@ -32,6 +32,31 @@ FakeSigninManager::~FakeSigninManager() {
   }
 }
 
+void FakeSigninManagerBase::SignOut() {
+  authenticated_username_.clear();
+  content::NotificationService::current()->Notify(
+      chrome::NOTIFICATION_GOOGLE_SIGNED_OUT,
+      content::Source<Profile>(profile_),
+      content::NotificationService::NoDetails());
+}
+
+// static
+ProfileKeyedService* FakeSigninManagerBase::Build(Profile* profile) {
+  return new FakeSigninManagerBase(profile);
+}
+
+#if !defined (OS_CHROMEOS)
+
+FakeSigninManager::FakeSigninManager(Profile* profile) {
+  Initialize(profile);
+}
+
+FakeSigninManager::~FakeSigninManager() {
+}
+
+void FakeSigninManager::InitTokenService() {
+}
+
 void FakeSigninManager::StartSignIn(const std::string& username,
                                     const std::string& password,
                                     const std::string& login_token,
@@ -61,13 +86,9 @@ void FakeSigninManager::SignOut() {
       content::NotificationService::NoDetails());
 }
 
-void FakeSigninManager::ForceSignOut() {
-  // Allow signing out now.
-  prohibit_signout_ = false;
-  SignOut();
-}
-
 // static
 ProfileKeyedService* FakeSigninManager::Build(Profile* profile) {
   return new FakeSigninManager(profile);
 }
+
+#endif  // !defined (OS_CHROMEOS)
diff --git a/chrome/browser/signin/fake_signin_manager.h b/chrome/browser/signin/fake_signin_manager.h
index 162e87b..a11ca9f 100644
--- a/chrome/browser/signin/fake_signin_manager.h
+++ b/chrome/browser/signin/fake_signin_manager.h
@@ -13,6 +13,19 @@
 class Profile;
 class ProfileKeyedService;
 
+class FakeSigninManagerBase : public SigninManagerBase {
+ public:
+  explicit FakeSigninManagerBase(Profile* profile);
+  virtual ~FakeSigninManagerBase();
+
+  virtual void SignOut() OVERRIDE;
+
+  // Helper function to be used with ProfileKeyedService::SetTestingFactory().
+  static ProfileKeyedService* Build(Profile* profile);
+};
+
+#if !defined(OS_CHROMEOS)
+
 // A signin manager that bypasses actual authentication routines with servers
 // and accepts the credentials provided to StartSignIn.
 class FakeSigninManager : public SigninManager {
@@ -20,26 +33,27 @@ class FakeSigninManager : public SigninManager {
   explicit FakeSigninManager(Profile* profile);
   virtual ~FakeSigninManager();
 
+  void set_auth_in_progress(const std::string& username) {
+    possibly_invalid_username_ = username;
+  }
+
+  virtual void SignOut() OVERRIDE;
+  virtual void InitTokenService() OVERRIDE;
   virtual void StartSignIn(const std::string& username,
                            const std::string& password,
                            const std::string& login_token,
                            const std::string& login_captcha) OVERRIDE;
+
   virtual void StartSignInWithCredentials(const std::string& session_index,
                                           const std::string& username,
                                           const std::string& password) OVERRIDE;
   virtual void StartSignInWithOAuth(const std::string& username,
                                     const std::string& password) OVERRIDE;
-  virtual void SignOut() OVERRIDE;
-
-  // Helper function to force a signout.
-  virtual void ForceSignOut();
-
-  void set_auth_in_progress(const std::string& username) {
-    possibly_invalid_username_ = username;
-  }
 
   // Helper function to be used with ProfileKeyedService::SetTestingFactory().
   static ProfileKeyedService* Build(Profile* profile);
 };
 
+#endif  // !defined (OS_CHROMEOS)
+
 #endif  // CHROME_BROWSER_SIGNIN_FAKE_SIGNIN_MANAGER_H_
diff --git a/chrome/browser/signin/signin_global_error.cc b/chrome/browser/signin/signin_global_error.cc
index 1e84099..4418ebab 100644
--- a/chrome/browser/signin/signin_global_error.cc
+++ b/chrome/browser/signin/signin_global_error.cc
@@ -18,7 +18,8 @@
 #include "grit/generated_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 
-SigninGlobalError::SigninGlobalError(SigninManager* manager, Profile* profile)
+SigninGlobalError::SigninGlobalError(SigninManagerBase* manager,
+                                     Profile* profile)
     : auth_error_(GoogleServiceAuthError::AuthErrorNone()),
       signin_manager_(manager),
       profile_(profile) {
diff --git a/chrome/browser/signin/signin_global_error.h b/chrome/browser/signin/signin_global_error.h
index 9a24569..8242115 100644
--- a/chrome/browser/signin/signin_global_error.h
+++ b/chrome/browser/signin/signin_global_error.h
@@ -12,7 +12,7 @@
 #include "google_apis/gaia/google_service_auth_error.h"
 
 class Profile;
-class SigninManager;
+class SigninManagerBase;
 
 // Shows auth errors on the wrench menu using a bubble view and a
 // menu item. Services that wish to expose auth errors to the user should
@@ -31,7 +31,7 @@ class SigninGlobalError : public GlobalError {
     virtual GoogleServiceAuthError GetAuthStatus() const = 0;
   };
 
-  SigninGlobalError(SigninManager* signin_manager, Profile* profile);
+  SigninGlobalError(SigninManagerBase* signin_manager, Profile* profile);
   virtual ~SigninGlobalError();
 
   // Adds a provider which the SigninGlobalError object will start querying for
@@ -69,7 +69,7 @@ class SigninGlobalError : public GlobalError {
   GoogleServiceAuthError auth_error_;
 
   // The SigninManager that owns this object.
-  SigninManager* signin_manager_;
+  SigninManagerBase* signin_manager_;
 
   // The Profile this object belongs to.
   Profile* profile_;
diff --git a/chrome/browser/signin/signin_global_error_unittest.cc b/chrome/browser/signin/signin_global_error_unittest.cc
index 4fe13c4..aaa1524 100644
--- a/chrome/browser/signin/signin_global_error_unittest.cc
+++ b/chrome/browser/signin/signin_global_error_unittest.cc
@@ -21,11 +21,10 @@ class SigninGlobalErrorTest : public testing::Test {
     // Create a signed-in profile.
     profile_.reset(new TestingProfile());
 
-    SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
-        profile_.get(), FakeSigninManager::Build);
-    SigninManager* manager =
-        SigninManagerFactory::GetForProfile(profile_.get());
-      manager->SetAuthenticatedUsername("testuser@test.com");
+    SigninManagerBase* manager = static_cast<SigninManagerBase*>(
+        SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
+            profile_.get(), FakeSigninManagerBase::Build));
+    manager->SetAuthenticatedUsername("testuser@test.com");
     global_error_ = manager->signin_global_error();
   }
 
diff --git a/chrome/browser/signin/signin_manager.cc b/chrome/browser/signin/signin_manager.cc
index 6b953c0..2598aca 100644
--- a/chrome/browser/signin/signin_manager.cc
+++ b/chrome/browser/signin/signin_manager.cc
@@ -47,7 +47,7 @@
 #include "net/url_request/url_request_context.h"
 #include "third_party/icu/public/i18n/unicode/regex.h"
 
-#if defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+#if defined(ENABLE_CONFIGURATION_POLICY)
 #include "chrome/browser/policy/cloud/user_policy_signin_service.h"
 #include "chrome/browser/policy/cloud/user_policy_signin_service_factory.h"
 #endif
@@ -61,8 +61,6 @@ namespace {
 const char kGetInfoDisplayEmailKey[] = "displayEmail";
 const char kGetInfoEmailKey[] = "email";
 
-const char kGoogleAccountsUrl[] = "https://accounts.google.com";
-
 const int kInvalidProcessId = -1;
 
 const char kChromiumSyncService[] = "service=chromiumsync";
@@ -94,56 +92,8 @@ bool SigninManager::IsWebBasedSigninFlowURL(const GURL& url) {
           .find(kChromiumSyncService) != std::string::npos;
 }
 
-// static
-bool SigninManager::AreSigninCookiesAllowed(Profile* profile) {
-  CookieSettings* cookie_settings =
-      CookieSettings::Factory::GetForProfile(profile);
-  return AreSigninCookiesAllowed(cookie_settings);
-}
-
-// static
-bool SigninManager::AreSigninCookiesAllowed(CookieSettings* cookie_settings) {
-  return cookie_settings &&
-      cookie_settings->IsSettingCookieAllowed(GURL(kGoogleAccountsUrl),
-                                              GURL(kGoogleAccountsUrl));
-}
-
-// static
-bool SigninManager::IsAllowedUsername(const std::string& username,
-                                      const std::string& policy) {
-  if (policy.empty())
-    return true;
-
-  // Patterns like "*@foo.com" are not accepted by our regex engine (since they
-  // are not valid regular expressions - they should instead be ".*@foo.com").
-  // For convenience, detect these patterns and insert a "." character at the
-  // front.
-  string16 pattern = UTF8ToUTF16(policy);
-  if (pattern[0] == L'*')
-    pattern.insert(pattern.begin(), L'.');
-
-  // See if the username matches the policy-provided pattern.
-  UErrorCode status = U_ZERO_ERROR;
-  const icu::UnicodeString icu_pattern(pattern.data(), pattern.length());
-  icu::RegexMatcher matcher(icu_pattern, UREGEX_CASE_INSENSITIVE, status);
-  if (!U_SUCCESS(status)) {
-    LOG(ERROR) << "Invalid login regex: " << pattern << ", status: " << status;
-    // If an invalid pattern is provided, then prohibit *all* logins (better to
-    // break signin than to quietly allow users to sign in).
-    return false;
-  }
-  string16 username16 = UTF8ToUTF16(username);
-  icu::UnicodeString icu_input(username16.data(), username16.length());
-  matcher.reset(icu_input);
-  status = U_ZERO_ERROR;
-  UBool match = matcher.matches(status);
-  DCHECK(U_SUCCESS(status));
-  return !!match;  // !! == convert from UBool to bool.
-}
-
 SigninManager::SigninManager()
-    : profile_(NULL),
-      prohibit_signout_(false),
+    : prohibit_signout_(false),
       had_two_factor_error_(false),
       type_(SIGNIN_TYPE_NONE),
       weak_pointer_factory_(this),
@@ -173,88 +123,16 @@ bool SigninManager::HasSigninProcess() const {
 }
 
 SigninManager::~SigninManager() {
-  DCHECK(!signin_global_error_.get()) <<
-      "SigninManager::Initialize called but not SigninManager::Shutdown";
-}
-
-void SigninManager::Initialize(Profile* profile) {
-  // Should never call Initialize() twice.
-  DCHECK(!IsInitialized());
-  profile_ = profile;
-  signin_global_error_.reset(new SigninGlobalError(this, profile));
-  GlobalErrorServiceFactory::GetForProfile(profile_)->AddGlobalError(
-      signin_global_error_.get());
-  PrefService* local_state = g_browser_process->local_state();
-  // local_state can be null during unit tests.
-  if (local_state) {
-    local_state_pref_registrar_.Init(local_state);
-    local_state_pref_registrar_.Add(
-        prefs::kGoogleServicesUsernamePattern,
-        base::Bind(&SigninManager::OnGoogleServicesUsernamePatternChanged,
-                   weak_pointer_factory_.GetWeakPtr()));
-  }
-  signin_allowed_.Init(prefs::kSigninAllowed, profile_->GetPrefs(),
-                       base::Bind(&SigninManager::OnSigninAllowedPrefChanged,
-                                  base::Unretained(this)));
-
-  // If the user is clearing the token service from the command line, then
-  // clear their login info also (not valid to be logged in without any
-  // tokens).
-  CommandLine* cmd_line = CommandLine::ForCurrentProcess();
-  if (cmd_line->HasSwitch(switches::kClearTokenService))
-    profile->GetPrefs()->ClearPref(prefs::kGoogleServicesUsername);
-
-  std::string user = profile_->GetPrefs()->GetString(
-      prefs::kGoogleServicesUsername);
-  if (!user.empty())
-    SetAuthenticatedUsername(user);
-  // TokenService can be null for unit tests.
-  TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
-  if (token_service) {
-    token_service->Initialize(GaiaConstants::kChromeSource, profile_);
-    // ChromeOS will kick off TokenService::LoadTokensFromDB from
-    // OAuthLoginManager once the rest of the Profile is fully initialized.
-    // Starting it from here would cause OAuthLoginManager mismatch the origin
-    // of OAuth2 tokens.
-#if !defined(OS_CHROMEOS)
-    if (!authenticated_username_.empty()) {
-      token_service->LoadTokensFromDB();
-    }
-#endif
-  }
-  if ((!user.empty() && !IsAllowedUsername(user)) || !IsSigninAllowed()) {
-    // User is signed in, but the username is invalid - the administrator must
-    // have changed the policy since the last signin, so sign out the user.
-    SignOut();
-  }
-}
-
-bool SigninManager::IsInitialized() const {
-  return profile_ != NULL;
-}
-
-bool SigninManager::IsAllowedUsername(const std::string& username) const {
-  PrefService* local_state = g_browser_process->local_state();
-  if (!local_state)
-    return true; // In a unit test with no local state - all names are allowed.
-
-  std::string pattern = local_state->GetString(
-      prefs::kGoogleServicesUsernamePattern);
-  return IsAllowedUsername(username, pattern);
-}
-
-bool SigninManager::IsSigninAllowed() const {
-  return signin_allowed_.GetValue();
 }
 
-// static
-bool SigninManager::IsSigninAllowedOnIOThread(ProfileIOData* io_data) {
-  DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
-  return io_data->signin_allowed()->GetValue();
+void SigninManager::InitTokenService() {
+  SigninManagerBase::InitTokenService();
+  TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
+  if (token_service && !GetAuthenticatedUsername().empty())
+    token_service->LoadTokensFromDB();
 }
 
 void SigninManager::CleanupNotificationRegistration() {
-#if !defined(OS_CHROMEOS)
   content::Source<TokenService> token_service(
       TokenServiceFactory::GetForProfile(profile_));
   if (registrar_.IsRegistered(this,
@@ -264,31 +142,6 @@ void SigninManager::CleanupNotificationRegistration() {
                       chrome::NOTIFICATION_TOKEN_AVAILABLE,
                       token_service);
   }
-#endif
-}
-
-const std::string& SigninManager::GetAuthenticatedUsername() const {
-  return authenticated_username_;
-}
-
-void SigninManager::SetAuthenticatedUsername(const std::string& username) {
-  if (!authenticated_username_.empty()) {
-    DLOG_IF(ERROR, username != authenticated_username_) <<
-        "Tried to change the authenticated username to something different: " <<
-        "Current: " << authenticated_username_ << ", New: " << username;
-    return;
-  }
-  authenticated_username_ = username;
-  // TODO(tim): We could go further in ensuring kGoogleServicesUsername and
-  // authenticated_username_ are consistent once established (e.g. remove
-  // authenticated_username_ altogether). Bug 107160.
-
-  NotifyDiagnosticsObservers(USERNAME, username);
-
-  // Go ahead and update the last signed in username here as well. Once a
-  // user is signed in the two preferences should match. Doing it here as
-  // opposed to on signin allows us to catch the upgrade scenario.
-  profile_->GetPrefs()->SetString(prefs::kGoogleServicesLastUsername, username);
 }
 
 std::string SigninManager::SigninTypeToString(
@@ -346,8 +199,8 @@ void SigninManager::StartSignIn(const std::string& username,
                                 const std::string& password,
                                 const std::string& login_token,
                                 const std::string& login_captcha) {
-  DCHECK(authenticated_username_.empty() ||
-         gaia::AreEmailsSame(username, authenticated_username_));
+  DCHECK(GetAuthenticatedUsername().empty() ||
+         gaia::AreEmailsSame(username, GetAuthenticatedUsername()));
 
   if (!PrepareForSignin(SIGNIN_TYPE_CLIENT_LOGIN, username, password))
     return;
@@ -360,17 +213,13 @@ void SigninManager::StartSignIn(const std::string& username,
                                   GaiaAuthFetcher::HostedAccountsNotAllowed);
 
   // Register for token availability.  The signin manager will pre-login the
-  // user when the GAIA service token is ready for use.  Only do this if we
-  // are not running in ChomiumOS, since it handles pre-login itself, and if
-  // cookies are not disabled for Google accounts.
-#if !defined(OS_CHROMEOS)
+  // user when the GAIA service token is ready for use.
   if (AreSigninCookiesAllowed(profile_)) {
     TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
     registrar_.Add(this,
                    chrome::NOTIFICATION_TOKEN_AVAILABLE,
                    content::Source<TokenService>(token_service));
   }
-#endif
 }
 
 void SigninManager::ProvideSecondFactorAccessCode(
@@ -393,8 +242,8 @@ void SigninManager::ProvideSecondFactorAccessCode(
 void SigninManager::StartSignInWithCredentials(const std::string& session_index,
                                                const std::string& username,
                                                const std::string& password) {
-  DCHECK(authenticated_username_.empty() ||
-         gaia::AreEmailsSame(username, authenticated_username_));
+  DCHECK(GetAuthenticatedUsername().empty() ||
+         gaia::AreEmailsSame(username, GetAuthenticatedUsername()));
 
   if (!PrepareForSignin(SIGNIN_TYPE_WITH_CREDENTIALS, username, password))
     return;
@@ -458,7 +307,7 @@ void SigninManager::OnGaiaCookiesFetched(
 
 void SigninManager::StartSignInWithOAuth(const std::string& username,
                                          const std::string& password) {
-  DCHECK(authenticated_username_.empty());
+  DCHECK(GetAuthenticatedUsername().empty());
 
   if (!PrepareForSignin(SIGNIN_TYPE_CLIENT_OAUTH, username, password))
     return;
@@ -471,17 +320,13 @@ void SigninManager::StartSignInWithOAuth(const std::string& username,
       username, password, scopes, std::string(), locale);
 
   // Register for token availability.  The signin manager will pre-login the
-  // user when the GAIA service token is ready for use.  Only do this if we
-  // are not running in ChomiumOS, since it handles pre-login itself, and if
-  // cookies are not disabled for Google accounts.
-#if !defined(OS_CHROMEOS)
+  // user when the GAIA service token is ready for use.
   if (AreSigninCookiesAllowed(profile_)) {
     TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
     registrar_.Add(this,
                    chrome::NOTIFICATION_TOKEN_AVAILABLE,
                    content::Source<TokenService>(token_service));
   }
-#endif
 }
 
 void SigninManager::ProvideOAuthChallengeResponse(
@@ -502,7 +347,7 @@ void SigninManager::ClearTransientSigninData() {
 
   CleanupNotificationRegistration();
   client_login_.reset();
-#if defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+#if defined(ENABLE_CONFIGURATION_POLICY)
   policy_client_.reset();
 #endif
   last_result_ = ClientLoginResult();
@@ -532,7 +377,7 @@ void SigninManager::HandleAuthError(const GoogleServiceAuthError& error,
 void SigninManager::SignOut() {
   DCHECK(IsInitialized());
 
-  if (authenticated_username_.empty()) {
+  if (GetAuthenticatedUsername().empty()) {
     if (AuthInProgress()) {
       // If the user is in the process of signing in, then treat a call to
       // SignOut as a cancellation request.
@@ -552,26 +397,10 @@ void SigninManager::SignOut() {
     DVLOG(1) << "Ignoring attempt to sign out while signout is prohibited";
     return;
   }
-  DCHECK(!authenticated_username_.empty());
-  GoogleServiceSignoutDetails details(authenticated_username_);
 
   ClearTransientSigninData();
-  authenticated_username_.clear();
-  profile_->GetPrefs()->ClearPref(prefs::kGoogleServicesUsername);
-
-  // Erase (now) stale information from AboutSigninInternals.
-  NotifyDiagnosticsObservers(USERNAME, std::string());
-  NotifyDiagnosticsObservers(LSID, std::string());
-  NotifyDiagnosticsObservers(signin_internals_util::SID, std::string());
-
-  TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
-  content::NotificationService::current()->Notify(
-      chrome::NOTIFICATION_GOOGLE_SIGNED_OUT,
-      content::Source<Profile>(profile_),
-      content::Details<const GoogleServiceSignoutDetails>(&details));
   RevokeOAuthLoginToken();
-  token_service->ResetCredentialsInMemory();
-  token_service->EraseTokensFromDB();
+  SigninManagerBase::SignOut();
 }
 
 void SigninManager::RevokeOAuthLoginToken() {
@@ -703,7 +532,7 @@ void SigninManager::OnGetUserInfoSuccess(const UserInfoMap& data) {
 
   possibly_invalid_username_ = email_iter->second;
 
-#if defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+#if defined(ENABLE_CONFIGURATION_POLICY)
   // TODO(atwilson): Move this code out to OneClickSignin instead of having
   // it embedded in SigninManager - we don't want UI logic in SigninManager.
   // If this is a new signin (authenticated_username_ is not set) and we have
@@ -711,7 +540,7 @@ void SigninManager::OnGetUserInfoSuccess(const UserInfoMap& data) {
   // services are initialized. If there's no oauth token (the user is using the
   // old ClientLogin flow) then policy will get loaded once the TokenService
   // finishes initializing (not ideal, but it's a reasonable fallback).
-  if (authenticated_username_.empty() &&
+  if (GetAuthenticatedUsername().empty() &&
       !temp_oauth_login_tokens_.refresh_token.empty()) {
     policy::UserPolicySigninService* policy_service =
         policy::UserPolicySigninServiceFactory::GetForProfile(profile_);
@@ -728,7 +557,7 @@ void SigninManager::OnGetUserInfoSuccess(const UserInfoMap& data) {
   CompleteSigninAfterPolicyLoad();
 }
 
-#if defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+#if defined(ENABLE_CONFIGURATION_POLICY)
 void SigninManager::OnRegisteredForPolicy(
     scoped_ptr<policy::CloudPolicyClient> client) {
   // If there's no token for the user (no policy) just finish signing in.
@@ -834,9 +663,9 @@ void SigninManager::CompleteSigninAfterPolicyLoad() {
   SetAuthenticatedUsername(possibly_invalid_username_);
   possibly_invalid_username_.clear();
   profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername,
-                                  authenticated_username_);
+                                  GetAuthenticatedUsername());
 
-  GoogleServiceSigninSuccessDetails details(authenticated_username_,
+  GoogleServiceSigninSuccessDetails details(GetAuthenticatedUsername(),
                                             password_);
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
@@ -887,7 +716,6 @@ void SigninManager::Observe(int type,
                             const content::NotificationSource& source,
                             const content::NotificationDetails& details) {
   switch (type) {
-#if !defined(OS_CHROMEOS)
     case chrome::NOTIFICATION_TOKEN_AVAILABLE: {
       TokenService::TokenAvailableDetails* tok_details =
           content::Details<TokenService::TokenAvailableDetails>(
@@ -919,20 +747,11 @@ void SigninManager::Observe(int type,
       }
       break;
     }
-#endif
     default:
       NOTREACHED();
   }
 }
 
-void SigninManager::Shutdown() {
-  if (signin_global_error_.get()) {
-    GlobalErrorServiceFactory::GetForProfile(profile_)->RemoveGlobalError(
-        signin_global_error_.get());
-    signin_global_error_.reset();
-  }
-}
-
 void SigninManager::ProhibitSignout(bool prohibit_signout) {
   prohibit_signout_ = prohibit_signout;
 }
@@ -940,43 +759,3 @@ void SigninManager::ProhibitSignout(bool prohibit_signout) {
 bool SigninManager::IsSignoutProhibited() const {
   return prohibit_signout_;
 }
-
-void SigninManager::OnGoogleServicesUsernamePatternChanged() {
-  if (!authenticated_username_.empty() &&
-      !IsAllowedUsername(authenticated_username_)) {
-    // Signed in user is invalid according to the current policy so sign
-    // the user out.
-    SignOut();
-  }
-}
-
-void SigninManager::OnSigninAllowedPrefChanged() {
-  if (!IsSigninAllowed())
-    SignOut();
-}
-
-void SigninManager::AddSigninDiagnosticsObserver(
-    SigninDiagnosticsObserver* observer) {
-  signin_diagnostics_observers_.AddObserver(observer);
-}
-
-void SigninManager::RemoveSigninDiagnosticsObserver(
-    SigninDiagnosticsObserver* observer) {
-  signin_diagnostics_observers_.RemoveObserver(observer);
-}
-
-void SigninManager::NotifyDiagnosticsObservers(
-    const UntimedSigninStatusField& field,
-    const std::string& value) {
-  FOR_EACH_OBSERVER(SigninDiagnosticsObserver,
-                    signin_diagnostics_observers_,
-                    NotifySigninValueChanged(field, value));
-}
-
-void SigninManager::NotifyDiagnosticsObservers(
-    const TimedSigninStatusField& field,
-    const std::string& value) {
-  FOR_EACH_OBSERVER(SigninDiagnosticsObserver,
-                    signin_diagnostics_observers_,
-                    NotifySigninValueChanged(field, value));
-}
diff --git a/chrome/browser/signin/signin_manager.h b/chrome/browser/signin/signin_manager.h
index 81c11d2..674d0b2 100644
--- a/chrome/browser/signin/signin_manager.h
+++ b/chrome/browser/signin/signin_manager.h
@@ -3,20 +3,24 @@
 // found in the LICENSE file.
 //
 // The signin manager encapsulates some functionality tracking
-// which user is signed in. When a user is signed in, a ClientLogin
-// request is run on their behalf. Auth tokens are fetched from Google
-// and the results are stored in the TokenService.
+// which user is signed in. See SigninManagerBase for full description of
+// responsibilities. The class defined in this file provides functionality
+// required by all platforms except Chrome OS.
 //
-// **NOTE** on semantics of SigninManager:
-//
-// Once a signin is successful, the username becomes "established" and will not
-// be cleared until a SignOut operation is performed (persists across
-// restarts). Until that happens, the signin manager can still be used to
-// refresh credentials, but changing the username is not permitted.
+// When a user is signed in, a ClientLogin request is run on their behalf.
+// Auth tokens are fetched from Google and the results are stored in the
+// TokenService.
+// TODO(tim): Bug 92948, 226464. ClientLogin is all but gone from use.
 
 #ifndef CHROME_BROWSER_SIGNIN_SIGNIN_MANAGER_H_
 #define CHROME_BROWSER_SIGNIN_SIGNIN_MANAGER_H_
 
+#if defined(OS_CHROMEOS)
+// On Chrome OS, SigninManagerBase is all that exists.
+#include "chrome/browser/signin/signin_manager_base.h"
+
+#else
+
 #include <string>
 
 #include "base/compiler_specific.h"
@@ -29,6 +33,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_keyed_service.h"
 #include "chrome/browser/signin/signin_internals_util.h"
+#include "chrome/browser/signin/signin_manager_base.h"
 #include "chrome/browser/signin/ubertoken_fetcher.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
@@ -46,45 +51,11 @@ namespace policy {
 class CloudPolicyClient;
 }
 
-// Details for the Notification type GOOGLE_SIGNIN_SUCCESSFUL.
-// A listener might use this to make note of a username / password
-// pair for encryption keys.
-struct GoogleServiceSigninSuccessDetails {
-  GoogleServiceSigninSuccessDetails(const std::string& in_username,
-                                    const std::string& in_password)
-      : username(in_username),
-        password(in_password) {}
-  std::string username;
-  std::string password;
-};
-
-// Details for the Notification type NOTIFICATION_GOOGLE_SIGNED_OUT.
-struct GoogleServiceSignoutDetails {
-  explicit GoogleServiceSignoutDetails(const std::string& in_username)
-      : username(in_username) {}
-  std::string username;
-};
-
-class SigninManager : public GaiaAuthConsumer,
+class SigninManager : public SigninManagerBase,
+                      public GaiaAuthConsumer,
                       public UbertokenConsumer,
-                      public content::NotificationObserver,
-                      public ProfileKeyedService {
+                      public content::NotificationObserver {
  public:
-  // Methods to register or remove SigninDiagnosticObservers
-  void AddSigninDiagnosticsObserver(
-      signin_internals_util::SigninDiagnosticsObserver* observer);
-  void RemoveSigninDiagnosticsObserver(
-      signin_internals_util::SigninDiagnosticsObserver* observer);
-
-  // Returns true if the cookie policy for the given profile allows cookies
-  // for the Google signin domain.
-  static bool AreSigninCookiesAllowed(Profile* profile);
-  static bool AreSigninCookiesAllowed(CookieSettings* cookie_settings);
-
-  // Returns true if the username is allowed based on the policy string.
-  static bool IsAllowedUsername(const std::string& username,
-                                const std::string& policy);
-
   // Returns true if |url| is a web signin URL and should be hosted in an
   // isolated, privileged signin process.
   static bool IsWebBasedSigninFlowURL(const GURL& url);
@@ -99,33 +70,6 @@ class SigninManager : public GaiaAuthConsumer,
   SigninManager();
   virtual ~SigninManager();
 
-  // If user was signed in, load tokens from DB if available.
-  void Initialize(Profile* profile);
-  bool IsInitialized() const;
-
-  // Returns true if the passed username is allowed by policy. Virtual for
-  // mocking in tests.
-  virtual bool IsAllowedUsername(const std::string& username) const;
-
-  // Returns true if a signin to Chrome is allowed (by policy or pref).
-  bool IsSigninAllowed() const;
-
-  // Checks if signin is allowed for the profile that owns |io_data|. This must
-  // be invoked on the IO thread, and can be used to check if signin is enabled
-  // on that thread.
-  static bool IsSigninAllowedOnIOThread(ProfileIOData* io_data);
-
-  // If a user has previously established a username and SignOut has not been
-  // called, this will return the username.
-  // Otherwise, it will return an empty string.
-  const std::string& GetAuthenticatedUsername() const;
-
-  // Sets the user name.  Note: |username| should be already authenticated as
-  // this is a sticky operation (in contrast to StartSignIn).
-  // TODO(tim): Remove this in favor of passing username on construction by
-  // (by platform / depending on StartBehavior). Bug 88109.
-  void SetAuthenticatedUsername(const std::string& username);
-
   // Attempt to sign in this user with ClientLogin. If successful, set a
   // preference indicating the signed in user and send out a notification,
   // then start fetching tokens for the user.
@@ -164,11 +108,10 @@ class SigninManager : public GaiaAuthConsumer,
 
   // Sign a user out, removing the preference, erasing all keys
   // associated with the user, and canceling all auth in progress.
-  virtual void SignOut();
+  virtual void SignOut() OVERRIDE;
 
-  // Returns true if there's a signin in progress. Virtual so it can be
-  // overridden by mocks.
-  virtual bool AuthInProgress() const;
+  // Returns true if there's a signin in progress.
+  virtual bool AuthInProgress() const OVERRIDE;
 
   // If an authentication is in progress, return the username being
   // authenticated. Returns an empty string if no auth is in progress.
@@ -203,16 +146,6 @@ class SigninManager : public GaiaAuthConsumer,
                        const content::NotificationSource& source,
                        const content::NotificationDetails& details) OVERRIDE;
 
-  SigninGlobalError* signin_global_error() {
-    return signin_global_error_.get();
-  }
-
-  const SigninGlobalError* signin_global_error() const {
-    return signin_global_error_.get();
-  }
-
-  // ProfileKeyedService implementation.
-  virtual void Shutdown() OVERRIDE;
 
   // Tells the SigninManager whether to prohibit signout for this profile.
   // If |prohibit_signout| is true, then signout will be prohibited.
@@ -232,14 +165,8 @@ class SigninManager : public GaiaAuthConsumer,
   bool HasSigninProcess() const;
 
  protected:
-  // Weak pointer to parent profile (protected so FakeSigninManager can access
-  // it).
-  Profile* profile_;
-
-  // Used to show auth errors in the wrench menu. The SigninGlobalError is
-  // different than most GlobalErrors in that its lifetime is controlled by
-  // SigninManager (so we can expose a reference for use in the wrench menu).
-  scoped_ptr<SigninGlobalError> signin_global_error_;
+  // If user was signed in, load tokens from DB if available.
+  virtual void InitTokenService() OVERRIDE;
 
   // Flag saying whether signing out is allowed.
   bool prohibit_signout_;
@@ -292,7 +219,7 @@ class SigninManager : public GaiaAuthConsumer,
   // token.
   void RevokeOAuthLoginToken();
 
-#if defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+#if defined(ENABLE_CONFIGURATION_POLICY)
   // Callback invoked once policy registration is complete. If registration
   // fails, |client| will be null.
   void OnRegisteredForPolicy(scoped_ptr<policy::CloudPolicyClient> client);
@@ -316,7 +243,8 @@ class SigninManager : public GaiaAuthConsumer,
 
   // Cancels the in-progress signin for this profile.
   void CancelSignin();
-#endif  // defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+
+#endif  // defined(ENABLE_CONFIGURATION_POLICY)
 
   // Invoked once policy has been loaded to complete user signin.
   void CompleteSigninAfterPolicyLoad();
@@ -328,18 +256,6 @@ class SigninManager : public GaiaAuthConsumer,
 
   void CleanupNotificationRegistration();
 
-  void OnGoogleServicesUsernamePatternChanged();
-
-  void OnSigninAllowedPrefChanged();
-
-  // Helper methods to notify all registered diagnostics observers with.
-  void NotifyDiagnosticsObservers(
-      const signin_internals_util::UntimedSigninStatusField& field,
-      const std::string& value);
-  void NotifyDiagnosticsObservers(
-      const signin_internals_util::TimedSigninStatusField& field,
-      const std::string& value);
-
   // Result of the last client login, kept pending the lookup of the
   // canonical email.
   ClientLoginResult last_result_;
@@ -356,16 +272,6 @@ class SigninManager : public GaiaAuthConsumer,
   // OAuth revocation fetcher for sign outs.
   scoped_ptr<GaiaAuthFetcher> revoke_token_fetcher_;
 
-  // Helper object to listen for changes to signin preferences stored in non-
-  // profile-specific local prefs (like kGoogleServicesUsernamePattern).
-  PrefChangeRegistrar local_state_pref_registrar_;
-
-  // Helper object to listen for changes to the signin allowed preference.
-  BooleanPrefMember signin_allowed_;
-
-  // Actual username after successful authentication.
-  std::string authenticated_username_;
-
   // The type of sign being performed.  This value is valid only between a call
   // to one of the StartSigninXXX methods and when the sign in is either
   // successful or not.
@@ -376,17 +282,13 @@ class SigninManager : public GaiaAuthConsumer,
   // not need to mint new ones.
   ClientOAuthResult temp_oauth_login_tokens_;
 
-  // The list of SigninDiagnosticObservers.
-  ObserverList<signin_internals_util::SigninDiagnosticsObserver, true>
-      signin_diagnostics_observers_;
-
   base::WeakPtrFactory<SigninManager> weak_pointer_factory_;
 
   // See SetSigninProcess.  Tracks the currently active signin process
   // by ID, if there is one.
   int signin_process_id_;
 
-#if defined(ENABLE_CONFIGURATION_POLICY) && !defined(OS_CHROMEOS)
+#if defined(ENABLE_CONFIGURATION_POLICY)
   // CloudPolicyClient reference we keep while determining whether to create
   // a new profile for an enterprise user or not.
   scoped_ptr<policy::CloudPolicyClient> policy_client_;
@@ -395,4 +297,6 @@ class SigninManager : public GaiaAuthConsumer,
   DISALLOW_COPY_AND_ASSIGN(SigninManager);
 };
 
+#endif  // !defined(OS_CHROMEOS)
+
 #endif  // CHROME_BROWSER_SIGNIN_SIGNIN_MANAGER_H_
diff --git a/chrome/browser/signin/signin_manager_base.cc b/chrome/browser/signin/signin_manager_base.cc
new file mode 100644
index 0000000..0433e44
--- /dev/null
+++ b/chrome/browser/signin/signin_manager_base.cc
@@ -0,0 +1,276 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/signin/signin_manager_base.h"
+
+#include <string>
+#include <vector>
+
+#include "base/command_line.h"
+#include "base/memory/ref_counted.h"
+#include "base/prefs/pref_service.h"
+#include "base/string_util.h"
+#include "base/strings/string_split.h"
+#include "base/utf_string_conversions.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/content_settings/cookie_settings.h"
+#include "chrome/browser/profiles/profile_info_cache.h"
+#include "chrome/browser/profiles/profile_io_data.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/signin/about_signin_internals.h"
+#include "chrome/browser/signin/about_signin_internals_factory.h"
+#include "chrome/browser/signin/signin_global_error.h"
+#include "chrome/browser/signin/signin_manager_cookie_helper.h"
+#include "chrome/browser/signin/token_service.h"
+#include "chrome/browser/signin/token_service_factory.h"
+#include "chrome/browser/sync/sync_prefs.h"
+#include "chrome/browser/ui/global_error/global_error_service.h"
+#include "chrome/browser/ui/global_error/global_error_service_factory.h"
+#include "chrome/common/chrome_notification_types.h"
+#include "chrome/common/chrome_switches.h"
+#include "chrome/common/pref_names.h"
+#include "content/public/browser/browser_thread.h"
+#include "google_apis/gaia/gaia_constants.h"
+#include "google_apis/gaia/gaia_urls.h"
+#include "third_party/icu/public/i18n/unicode/regex.h"
+
+using namespace signin_internals_util;
+
+using content::BrowserThread;
+
+// static
+bool SigninManagerBase::AreSigninCookiesAllowed(Profile* profile) {
+  CookieSettings* cookie_settings =
+      CookieSettings::Factory::GetForProfile(profile);
+  return AreSigninCookiesAllowed(cookie_settings);
+}
+
+// static
+bool SigninManagerBase::AreSigninCookiesAllowed(
+    CookieSettings* cookie_settings) {
+  return cookie_settings &&
+      cookie_settings->IsSettingCookieAllowed(
+          GURL(GaiaUrls::GetInstance()->gaia_origin_url()),
+          GURL(GaiaUrls::GetInstance()->gaia_origin_url()));
+}
+
+// static
+bool SigninManagerBase::IsAllowedUsername(const std::string& username,
+                                          const std::string& policy) {
+  if (policy.empty())
+    return true;
+
+  // Patterns like "*@foo.com" are not accepted by our regex engine (since they
+  // are not valid regular expressions - they should instead be ".*@foo.com").
+  // For convenience, detect these patterns and insert a "." character at the
+  // front.
+  string16 pattern = UTF8ToUTF16(policy);
+  if (pattern[0] == L'*')
+    pattern.insert(pattern.begin(), L'.');
+
+  // See if the username matches the policy-provided pattern.
+  UErrorCode status = U_ZERO_ERROR;
+  const icu::UnicodeString icu_pattern(pattern.data(), pattern.length());
+  icu::RegexMatcher matcher(icu_pattern, UREGEX_CASE_INSENSITIVE, status);
+  if (!U_SUCCESS(status)) {
+    LOG(ERROR) << "Invalid login regex: " << pattern << ", status: " << status;
+    // If an invalid pattern is provided, then prohibit *all* logins (better to
+    // break signin than to quietly allow users to sign in).
+    return false;
+  }
+  string16 username16 = UTF8ToUTF16(username);
+  icu::UnicodeString icu_input(username16.data(), username16.length());
+  matcher.reset(icu_input);
+  status = U_ZERO_ERROR;
+  UBool match = matcher.matches(status);
+  DCHECK(U_SUCCESS(status));
+  return !!match;  // !! == convert from UBool to bool.
+}
+
+SigninManagerBase::SigninManagerBase()
+    : profile_(NULL),
+      weak_pointer_factory_(this) {
+}
+
+SigninManagerBase::~SigninManagerBase() {
+  DCHECK(!signin_global_error_.get()) <<
+      "SigninManagerBase::Initialize called but not "
+      "SigninManagerBase::Shutdown";
+}
+
+void SigninManagerBase::Initialize(Profile* profile) {
+  // Should never call Initialize() twice.
+  DCHECK(!IsInitialized());
+  profile_ = profile;
+  signin_global_error_.reset(new SigninGlobalError(this, profile));
+  GlobalErrorServiceFactory::GetForProfile(profile_)->AddGlobalError(
+      signin_global_error_.get());
+  PrefService* local_state = g_browser_process->local_state();
+  // local_state can be null during unit tests.
+  if (local_state) {
+    local_state_pref_registrar_.Init(local_state);
+    local_state_pref_registrar_.Add(
+        prefs::kGoogleServicesUsernamePattern,
+        base::Bind(&SigninManagerBase::OnGoogleServicesUsernamePatternChanged,
+                   weak_pointer_factory_.GetWeakPtr()));
+  }
+  signin_allowed_.Init(prefs::kSigninAllowed, profile_->GetPrefs(),
+      base::Bind(&SigninManagerBase::OnSigninAllowedPrefChanged,
+                 base::Unretained(this)));
+
+  // If the user is clearing the token service from the command line, then
+  // clear their login info also (not valid to be logged in without any
+  // tokens).
+  CommandLine* cmd_line = CommandLine::ForCurrentProcess();
+  if (cmd_line->HasSwitch(switches::kClearTokenService))
+    profile->GetPrefs()->ClearPref(prefs::kGoogleServicesUsername);
+
+  std::string user = profile_->GetPrefs()->GetString(
+      prefs::kGoogleServicesUsername);
+  if (!user.empty())
+    SetAuthenticatedUsername(user);
+
+  InitTokenService();
+
+  if ((!user.empty() && !IsAllowedUsername(user)) || !IsSigninAllowed()) {
+    // User is signed in, but the username is invalid - the administrator must
+    // have changed the policy since the last signin, so sign out the user.
+    SignOut();
+  }
+}
+
+void SigninManagerBase::InitTokenService() {
+  // TokenService can be null for unit tests.
+  TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
+  if (token_service)
+    token_service->Initialize(GaiaConstants::kChromeSource, profile_);
+  // Note: ChromeOS will kick off TokenService::LoadTokensFromDB from
+  // OAuthLoginManager once the rest of the Profile is fully initialized.
+}
+
+bool SigninManagerBase::IsInitialized() const {
+  return profile_ != NULL;
+}
+
+bool SigninManagerBase::IsAllowedUsername(const std::string& username) const {
+  PrefService* local_state = g_browser_process->local_state();
+  if (!local_state)
+    return true; // In a unit test with no local state - all names are allowed.
+
+  std::string pattern = local_state->GetString(
+      prefs::kGoogleServicesUsernamePattern);
+  return IsAllowedUsername(username, pattern);
+}
+
+bool SigninManagerBase::IsSigninAllowed() const {
+  return signin_allowed_.GetValue();
+}
+
+// static
+bool SigninManagerBase::IsSigninAllowedOnIOThread(ProfileIOData* io_data) {
+  DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
+  return io_data->signin_allowed()->GetValue();
+}
+
+const std::string& SigninManagerBase::GetAuthenticatedUsername() const {
+  return authenticated_username_;
+}
+
+void SigninManagerBase::SetAuthenticatedUsername(const std::string& username) {
+  if (!authenticated_username_.empty()) {
+    DLOG_IF(ERROR, username != authenticated_username_) <<
+        "Tried to change the authenticated username to something different: " <<
+        "Current: " << authenticated_username_ << ", New: " << username;
+    return;
+  }
+  authenticated_username_ = username;
+  // TODO(tim): We could go further in ensuring kGoogleServicesUsername and
+  // authenticated_username_ are consistent once established (e.g. remove
+  // authenticated_username_ altogether). Bug 107160.
+
+  NotifyDiagnosticsObservers(USERNAME, username);
+
+  // Go ahead and update the last signed in username here as well. Once a
+  // user is signed in the two preferences should match. Doing it here as
+  // opposed to on signin allows us to catch the upgrade scenario.
+  profile_->GetPrefs()->SetString(prefs::kGoogleServicesLastUsername, username);
+}
+
+void SigninManagerBase::SignOut() {
+  DCHECK(IsInitialized());
+
+  if (authenticated_username_.empty() && !AuthInProgress())
+    return;
+
+  GoogleServiceSignoutDetails details(authenticated_username_);
+  authenticated_username_.clear();
+  profile_->GetPrefs()->ClearPref(prefs::kGoogleServicesUsername);
+
+  // Erase (now) stale information from AboutSigninInternals.
+  NotifyDiagnosticsObservers(USERNAME, "");
+  NotifyDiagnosticsObservers(LSID, "");
+  NotifyDiagnosticsObservers(
+      signin_internals_util::SID, "");
+
+  TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
+  content::NotificationService::current()->Notify(
+      chrome::NOTIFICATION_GOOGLE_SIGNED_OUT,
+      content::Source<Profile>(profile_),
+      content::Details<const GoogleServiceSignoutDetails>(&details));
+  token_service->ResetCredentialsInMemory();
+  token_service->EraseTokensFromDB();
+}
+
+bool SigninManagerBase::AuthInProgress() const {
+  // SigninManagerBase never kicks off auth processes itself.
+  return false;
+}
+
+void SigninManagerBase::Shutdown() {
+  if (signin_global_error_.get()) {
+    GlobalErrorServiceFactory::GetForProfile(profile_)->RemoveGlobalError(
+        signin_global_error_.get());
+    signin_global_error_.reset();
+  }
+}
+
+void SigninManagerBase::OnGoogleServicesUsernamePatternChanged() {
+  if (!authenticated_username_.empty() &&
+      !IsAllowedUsername(authenticated_username_)) {
+    // Signed in user is invalid according to the current policy so sign
+    // the user out.
+    SignOut();
+  }
+}
+
+void SigninManagerBase::OnSigninAllowedPrefChanged() {
+  if (!IsSigninAllowed())
+    SignOut();
+}
+
+void SigninManagerBase::AddSigninDiagnosticsObserver(
+    SigninDiagnosticsObserver* observer) {
+  signin_diagnostics_observers_.AddObserver(observer);
+}
+
+void SigninManagerBase::RemoveSigninDiagnosticsObserver(
+    SigninDiagnosticsObserver* observer) {
+  signin_diagnostics_observers_.RemoveObserver(observer);
+}
+
+void SigninManagerBase::NotifyDiagnosticsObservers(
+    const UntimedSigninStatusField& field,
+    const std::string& value) {
+  FOR_EACH_OBSERVER(SigninDiagnosticsObserver,
+                    signin_diagnostics_observers_,
+                    NotifySigninValueChanged(field, value));
+}
+
+void SigninManagerBase::NotifyDiagnosticsObservers(
+    const TimedSigninStatusField& field,
+    const std::string& value) {
+  FOR_EACH_OBSERVER(SigninDiagnosticsObserver,
+                    signin_diagnostics_observers_,
+                    NotifySigninValueChanged(field, value));
+}
diff --git a/chrome/browser/signin/signin_manager_base.h b/chrome/browser/signin/signin_manager_base.h
new file mode 100644
index 0000000..cca866e
--- /dev/null
+++ b/chrome/browser/signin/signin_manager_base.h
@@ -0,0 +1,177 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// The signin manager encapsulates some functionality tracking
+// which user is signed in.
+//
+// **NOTE** on semantics of SigninManager:
+//
+// Once a signin is successful, the username becomes "established" and will not
+// be cleared until a SignOut operation is performed (persists across
+// restarts). Until that happens, the signin manager can still be used to
+// refresh credentials, but changing the username is not permitted.
+//
+// On Chrome OS, because of the existence of other components that handle login
+// and signin at a higher level, all that is needed from a SigninManager is
+// caching / handling of the "authenticated username" field, and TokenService
+// initialization, so that components that depend on these two things
+// (i.e on desktop) can continue using it / don't need to change. For this
+// reason, SigninManagerBase is all that exists on Chrome OS. For desktop,
+// see signin/signin_manager.h.
+
+#ifndef CHROME_BROWSER_SIGNIN_SIGNIN_MANAGER_BASE_H_
+#define CHROME_BROWSER_SIGNIN_SIGNIN_MANAGER_BASE_H_
+
+#include <string>
+
+#include "base/compiler_specific.h"
+#include "base/gtest_prod_util.h"
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/observer_list.h"
+#include "base/prefs/pref_change_registrar.h"
+#include "base/prefs/pref_member.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/profiles/profile_keyed_service.h"
+#include "chrome/browser/signin/signin_internals_util.h"
+
+class CookieSettings;
+class ProfileIOData;
+class PrefService;
+class SigninGlobalError;
+
+// Details for the Notification type GOOGLE_SIGNIN_SUCCESSFUL.
+// A listener might use this to make note of a username / password
+// pair for encryption keys.
+struct GoogleServiceSigninSuccessDetails {
+  GoogleServiceSigninSuccessDetails(const std::string& in_username,
+                                    const std::string& in_password)
+      : username(in_username),
+        password(in_password) {}
+  std::string username;
+  std::string password;
+};
+
+// Details for the Notification type NOTIFICATION_GOOGLE_SIGNED_OUT.
+struct GoogleServiceSignoutDetails {
+  explicit GoogleServiceSignoutDetails(const std::string& in_username)
+      : username(in_username) {}
+  std::string username;
+};
+
+class SigninManagerBase : public ProfileKeyedService {
+ public:
+  // Returns true if the cookie policy for the given profile allows cookies
+  // for the Google signin domain.
+  static bool AreSigninCookiesAllowed(Profile* profile);
+  static bool AreSigninCookiesAllowed(CookieSettings* cookie_settings);
+
+  // Returns true if the username is allowed based on the policy string.
+  static bool IsAllowedUsername(const std::string& username,
+                                const std::string& policy);
+
+  SigninManagerBase();
+  virtual ~SigninManagerBase();
+
+  // If user was signed in, load tokens from DB if available.
+  void Initialize(Profile* profile);
+  bool IsInitialized() const;
+
+  // Returns true if the passed username is allowed by policy. Virtual for
+  // mocking in tests.
+  virtual bool IsAllowedUsername(const std::string& username) const;
+
+  // Returns true if a signin to Chrome is allowed (by policy or pref).
+  bool IsSigninAllowed() const;
+
+  // Checks if signin is allowed for the profile that owns |io_data|. This must
+  // be invoked on the IO thread, and can be used to check if signin is enabled
+  // on that thread.
+  static bool IsSigninAllowedOnIOThread(ProfileIOData* io_data);
+
+  // If a user has previously established a username and SignOut has not been
+  // called, this will return the username.
+  // Otherwise, it will return an empty string.
+  const std::string& GetAuthenticatedUsername() const;
+
+  // Sets the user name.  Note: |username| should be already authenticated as
+  // this is a sticky operation (in contrast to StartSignIn).
+  // TODO(tim): Remove this in favor of passing username on construction by
+  // (by platform / depending on StartBehavior). Bug 88109.
+  void SetAuthenticatedUsername(const std::string& username);
+
+  // Sign a user out, removing the preference, erasing all keys
+  // associated with the user, and canceling all auth in progress.
+  // TODO(tim): Remove SignOut here, it belongs in the derived class.
+  // Bug 174927.
+  virtual void SignOut();
+
+  // Returns true if there's a signin in progress.
+  virtual bool AuthInProgress() const;
+
+  SigninGlobalError* signin_global_error() {
+    return signin_global_error_.get();
+  }
+
+  const SigninGlobalError* signin_global_error() const {
+    return signin_global_error_.get();
+  }
+
+  // ProfileKeyedService implementation.
+  virtual void Shutdown() OVERRIDE;
+
+    // Methods to register or remove SigninDiagnosticObservers
+  void AddSigninDiagnosticsObserver(
+      signin_internals_util::SigninDiagnosticsObserver* observer);
+  void RemoveSigninDiagnosticsObserver(
+      signin_internals_util::SigninDiagnosticsObserver* observer);
+
+ protected:
+  // Lets different platforms initialize TokenService in their own way.
+  virtual void InitTokenService();
+
+  // Pointer to parent profile (protected so FakeSigninManager can access
+  // it).
+  Profile* profile_;
+
+  // Used to show auth errors in the wrench menu. The SigninGlobalError is
+  // different than most GlobalErrors in that its lifetime is controlled by
+  // SigninManager (so we can expose a reference for use in the wrench menu).
+  scoped_ptr<SigninGlobalError> signin_global_error_;
+
+  // Helper methods to notify all registered diagnostics observers with.
+  void NotifyDiagnosticsObservers(
+      const signin_internals_util::UntimedSigninStatusField& field,
+      const std::string& value);
+  void NotifyDiagnosticsObservers(
+      const signin_internals_util::TimedSigninStatusField& field,
+      const std::string& value);
+
+ private:
+  friend class FakeSigninManagerBase;
+  friend class FakeSigninManager;
+  void OnGoogleServicesUsernamePatternChanged();
+
+  void OnSigninAllowedPrefChanged();
+
+  // Helper object to listen for changes to signin preferences stored in non-
+  // profile-specific local prefs (like kGoogleServicesUsernamePattern).
+  PrefChangeRegistrar local_state_pref_registrar_;
+
+  // Helper object to listen for changes to the signin allowed preference.
+  BooleanPrefMember signin_allowed_;
+
+  // Actual username after successful authentication.
+  std::string authenticated_username_;
+
+  // The list of SigninDiagnosticObservers.
+  ObserverList<signin_internals_util::SigninDiagnosticsObserver, true>
+      signin_diagnostics_observers_;
+
+  base::WeakPtrFactory<SigninManagerBase> weak_pointer_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(SigninManagerBase);
+};
+
+#endif  // CHROME_BROWSER_SIGNIN_SIGNIN_MANAGER_BASE_H_
diff --git a/chrome/browser/signin/signin_manager_base_unittest.cc b/chrome/browser/signin/signin_manager_base_unittest.cc
new file mode 100644
index 0000000..b31f5b5
--- /dev/null
+++ b/chrome/browser/signin/signin_manager_base_unittest.cc
@@ -0,0 +1,92 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/signin/signin_manager_base.h"
+
+#include "base/compiler_specific.h"
+#include "base/prefs/pref_service.h"
+#include "base/prefs/testing_pref_service.h"
+#include "base/stringprintf.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/prefs/browser_prefs.h"
+#include "chrome/browser/signin/token_service.h"
+#include "chrome/browser/signin/token_service_unittest.h"
+#include "chrome/common/pref_names.h"
+#include "chrome/common/url_constants.h"
+#include "chrome/test/base/testing_browser_process.h"
+#include "chrome/test/base/testing_profile.h"
+
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+class SigninManagerBaseTest : public TokenServiceTestHarness {
+ public:
+  virtual void SetUp() OVERRIDE {
+    prefs_.reset(new TestingPrefServiceSimple);
+    chrome::RegisterLocalState(prefs_->registry());
+    TestingBrowserProcess::GetGlobal()->SetLocalState(
+        prefs_.get());
+    TokenServiceTestHarness::SetUp();
+    manager_.reset(new SigninManagerBase());
+  }
+
+  virtual void TearDown() OVERRIDE {
+    // Destroy the SigninManager here, because it relies on profile_ which is
+    // freed in the base class.
+    manager_->Shutdown();
+    manager_.reset(NULL);
+    TestingBrowserProcess::GetGlobal()->SetLocalState(NULL);
+    prefs_.reset(NULL);
+    TokenServiceTestHarness::TearDown();
+  }
+
+  scoped_ptr<SigninManagerBase> manager_;
+  scoped_ptr<TestingPrefServiceSimple> prefs_;
+};
+
+TEST_F(SigninManagerBaseTest, Prohibited) {
+  g_browser_process->local_state()->SetString(
+      prefs::kGoogleServicesUsernamePattern, ".*@google.com");
+  manager_->Initialize(profile_.get());
+  EXPECT_TRUE(manager_->IsAllowedUsername("test@google.com"));
+  EXPECT_TRUE(manager_->IsAllowedUsername("happy@google.com"));
+  EXPECT_FALSE(manager_->IsAllowedUsername("test@invalid.com"));
+  EXPECT_FALSE(manager_->IsAllowedUsername("test@notgoogle.com"));
+  EXPECT_FALSE(manager_->IsAllowedUsername(std::string()));
+}
+
+TEST_F(SigninManagerBaseTest, TestAlternateWildcard) {
+  // Test to make sure we accept "*@google.com" as a pattern (treat it as if
+  // the admin entered ".*@google.com").
+  g_browser_process->local_state()->SetString(
+      prefs::kGoogleServicesUsernamePattern, "*@google.com");
+  manager_->Initialize(profile_.get());
+  EXPECT_TRUE(manager_->IsAllowedUsername("test@google.com"));
+  EXPECT_TRUE(manager_->IsAllowedUsername("happy@google.com"));
+  EXPECT_FALSE(manager_->IsAllowedUsername("test@invalid.com"));
+  EXPECT_FALSE(manager_->IsAllowedUsername("test@notgoogle.com"));
+  EXPECT_FALSE(manager_->IsAllowedUsername(std::string()));
+}
+
+TEST_F(SigninManagerBaseTest, ProhibitedAtStartup) {
+  profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername,
+                                  "monkey@invalid.com");
+  g_browser_process->local_state()->SetString(
+      prefs::kGoogleServicesUsernamePattern, ".*@google.com");
+  manager_->Initialize(profile_.get());
+  // Currently signed in user is prohibited by policy, so should be signed out.
+  EXPECT_EQ("", manager_->GetAuthenticatedUsername());
+}
+
+TEST_F(SigninManagerBaseTest, ProhibitedAfterStartup) {
+  std::string user("monkey@invalid.com");
+  profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername, user);
+  manager_->Initialize(profile_.get());
+  EXPECT_EQ(user, manager_->GetAuthenticatedUsername());
+  // Update the profile - user should be signed out.
+  g_browser_process->local_state()->SetString(
+      prefs::kGoogleServicesUsernamePattern, ".*@google.com");
+  EXPECT_EQ("", manager_->GetAuthenticatedUsername());
+}
+
diff --git a/chrome/browser/signin/signin_manager_factory.cc b/chrome/browser/signin/signin_manager_factory.cc
index 11dd5e6..b7b3052 100644
--- a/chrome/browser/signin/signin_manager_factory.cc
+++ b/chrome/browser/signin/signin_manager_factory.cc
@@ -21,6 +21,22 @@ SigninManagerFactory::SigninManagerFactory()
 
 SigninManagerFactory::~SigninManagerFactory() {}
 
+#if defined(OS_CHROMEOS)
+// static
+SigninManagerBase* SigninManagerFactory::GetForProfileIfExists(
+    Profile* profile) {
+  return static_cast<SigninManagerBase*>(
+      GetInstance()->GetServiceForProfile(profile, false));
+}
+
+// static
+SigninManagerBase* SigninManagerFactory::GetForProfile(
+    Profile* profile) {
+  return static_cast<SigninManagerBase*>(
+      GetInstance()->GetServiceForProfile(profile, true));
+}
+
+#else
 // static
 SigninManager* SigninManagerFactory::GetForProfile(Profile* profile) {
   return static_cast<SigninManager*>(
@@ -32,6 +48,7 @@ SigninManager* SigninManagerFactory::GetForProfileIfExists(Profile* profile) {
   return static_cast<SigninManager*>(
       GetInstance()->GetServiceForProfile(profile, false));
 }
+#endif
 
 // static
 SigninManagerFactory* SigninManagerFactory::GetInstance() {
@@ -62,7 +79,14 @@ void SigninManagerFactory::RegisterPrefs(PrefRegistrySimple* registry) {
 
 ProfileKeyedService* SigninManagerFactory::BuildServiceInstanceFor(
     Profile* profile) const {
-  SigninManager* service = new SigninManager();
+
+  SigninManagerBase* service = NULL;
+#if defined(OS_CHROMEOS)
+  service = new SigninManagerBase();
+#else
+  service = new SigninManager();
+#endif
+
   service->Initialize(profile);
   return service;
 }
diff --git a/chrome/browser/signin/signin_manager_factory.h b/chrome/browser/signin/signin_manager_factory.h
index 7cb2b81..4df297f 100644
--- a/chrome/browser/signin/signin_manager_factory.h
+++ b/chrome/browser/signin/signin_manager_factory.h
@@ -9,6 +9,7 @@
 #include "chrome/browser/profiles/profile_keyed_service_factory.h"
 
 class SigninManager;
+class SigninManagerBase;
 class PrefRegistrySimple;
 class PrefRegistrySyncable;
 class Profile;
@@ -18,15 +19,23 @@ class Profile;
 // the associated SigninManager.
 class SigninManagerFactory : public ProfileKeyedServiceFactory {
  public:
+
+#if defined(OS_CHROMEOS)
   // Returns the instance of SigninManager associated with this profile
   // (creating one if none exists). Returns NULL if this profile cannot have a
   // SigninManager (for example, if |profile| is incognito).
-  static SigninManager* GetForProfile(Profile* profile);
+  static SigninManagerBase* GetForProfile(Profile* profile);
 
   // Returns the instance of SigninManager associated with this profile. Returns
   // null if no SigninManager instance currently exists (will not create a new
   // instance).
+  static SigninManagerBase* GetForProfileIfExists(Profile* profile);
+#else
+  // On non-ChromeOS platforms, the SigninManager the factory creates will be
+  // an instance of the extended SigninManager class.
+  static SigninManager* GetForProfile(Profile* profile);
   static SigninManager* GetForProfileIfExists(Profile* profile);
+#endif
 
   // Returns an instance of the SigninManagerFactory singleton.
   static SigninManagerFactory* GetInstance();
diff --git a/chrome/browser/signin/signin_manager_unittest.cc b/chrome/browser/signin/signin_manager_unittest.cc
index 7eb1109..104053c 100644
--- a/chrome/browser/signin/signin_manager_unittest.cc
+++ b/chrome/browser/signin/signin_manager_unittest.cc
@@ -333,51 +333,6 @@ TEST_F(SigninManagerTest, SignInClientLogin) {
   EXPECT_EQ("user@gmail.com", manager_->GetAuthenticatedUsername());
 }
 
-TEST_F(SigninManagerTest, Prohibited) {
-  g_browser_process->local_state()->SetString(
-      prefs::kGoogleServicesUsernamePattern, ".*@google.com");
-  manager_->Initialize(profile_.get());
-  EXPECT_TRUE(manager_->IsAllowedUsername("test@google.com"));
-  EXPECT_TRUE(manager_->IsAllowedUsername("happy@google.com"));
-  EXPECT_FALSE(manager_->IsAllowedUsername("test@invalid.com"));
-  EXPECT_FALSE(manager_->IsAllowedUsername("test@notgoogle.com"));
-  EXPECT_FALSE(manager_->IsAllowedUsername(std::string()));
-}
-
-TEST_F(SigninManagerTest, TestAlternateWildcard) {
-  // Test to make sure we accept "*@google.com" as a pattern (treat it as if
-  // the admin entered ".*@google.com").
-  g_browser_process->local_state()->SetString(
-      prefs::kGoogleServicesUsernamePattern, "*@google.com");
-  manager_->Initialize(profile_.get());
-  EXPECT_TRUE(manager_->IsAllowedUsername("test@google.com"));
-  EXPECT_TRUE(manager_->IsAllowedUsername("happy@google.com"));
-  EXPECT_FALSE(manager_->IsAllowedUsername("test@invalid.com"));
-  EXPECT_FALSE(manager_->IsAllowedUsername("test@notgoogle.com"));
-  EXPECT_FALSE(manager_->IsAllowedUsername(std::string()));
-}
-
-TEST_F(SigninManagerTest, ProhibitedAtStartup) {
-  profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername,
-                                  "monkey@invalid.com");
-  g_browser_process->local_state()->SetString(
-      prefs::kGoogleServicesUsernamePattern, ".*@google.com");
-  manager_->Initialize(profile_.get());
-  // Currently signed in user is prohibited by policy, so should be signed out.
-  EXPECT_EQ("", manager_->GetAuthenticatedUsername());
-}
-
-TEST_F(SigninManagerTest, ProhibitedAfterStartup) {
-  std::string user("monkey@invalid.com");
-  profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername, user);
-  manager_->Initialize(profile_.get());
-  EXPECT_EQ(user, manager_->GetAuthenticatedUsername());
-  // Update the profile - user should be signed out.
-  g_browser_process->local_state()->SetString(
-      prefs::kGoogleServicesUsernamePattern, ".*@google.com");
-  EXPECT_EQ("", manager_->GetAuthenticatedUsername());
-}
-
 TEST_F(SigninManagerTest, SignInWithCredentials) {
   manager_->Initialize(profile_.get());
   EXPECT_TRUE(manager_->GetAuthenticatedUsername().empty());
diff --git a/chrome/browser/signin/signin_tracker.cc b/chrome/browser/signin/signin_tracker.cc
index eed00d7..cdddc49 100644
--- a/chrome/browser/signin/signin_tracker.cc
+++ b/chrome/browser/signin/signin_tracker.cc
@@ -181,7 +181,7 @@ bool SigninTracker::AreServicesSignedIn(Profile* profile) {
 SigninTracker::LoginState SigninTracker::GetSigninState(
     Profile* profile,
     GoogleServiceAuthError* error) {
-  SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+  SigninManagerBase* signin = SigninManagerFactory::GetForProfile(profile);
   if (signin->GetAuthenticatedUsername().empty()) {
     // User is signed out, trigger a signin failure.
     if (error)
diff --git a/chrome/browser/signin/signin_tracker_unittest.cc b/chrome/browser/signin/signin_tracker_unittest.cc
index 6d32616..8510a43 100644
--- a/chrome/browser/signin/signin_tracker_unittest.cc
+++ b/chrome/browser/signin/signin_tracker_unittest.cc
@@ -70,9 +70,9 @@ class SigninTrackerTest : public testing::Test {
             ProfileSyncServiceMock::BuildMockProfileSyncService));
     mock_pss_->Initialize();
 
-    mock_signin_manager_ = static_cast<FakeSigninManager*>(
+    mock_signin_manager_ = static_cast<FakeSigninManagerBase*>(
         SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
-            profile_.get(), FakeSigninManager::Build));
+            profile_.get(), FakeSigninManagerBase::Build));
 
     // Make gmock not spam the output with information about these uninteresting
     // calls.
@@ -87,7 +87,7 @@ class SigninTrackerTest : public testing::Test {
   scoped_ptr<SigninTracker> tracker_;
   scoped_ptr<TestingProfile> profile_;
   ProfileSyncServiceMock* mock_pss_;
-  FakeSigninManager* mock_signin_manager_;
+  FakeSigninManagerBase* mock_signin_manager_;
   MockTokenService* mock_token_service_;
   MockObserver observer_;
 };
@@ -144,8 +144,7 @@ TEST_F(SigninTrackerTest, GaiaSigninWhenServicesAlreadyRunning) {
   EXPECT_CALL(observer_, SigninSuccess());
   GoogleServiceAuthError error(GoogleServiceAuthError::NONE);
   ExpectSignedInSyncService(mock_pss_, mock_token_service_, error);
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
   GoogleServiceSigninSuccessDetails details("username@gmail.com", "password");
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
@@ -184,8 +183,7 @@ TEST_F(SigninTrackerTest, GaiaSigninAfterOAuthTokenBecomesAvailable) {
   EXPECT_CALL(*mock_token_service_,
               HasTokenForService(GaiaConstants::kGaiaOAuth2LoginRefreshToken))
       .WillRepeatedly(Return(false));
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
   GoogleServiceSigninSuccessDetails details("username@gmail.com", "password");
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
@@ -256,8 +254,7 @@ TEST_F(SigninTrackerTest, GaiaSigninAfterSyncStarts) {
       Return(false));
   EXPECT_CALL(*mock_token_service_, HasTokenForService(_))
       .WillRepeatedly(Return(true));
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
   GoogleServiceSigninSuccessDetails details("username@gmail.com", "password");
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
@@ -281,8 +278,7 @@ TEST_F(SigninTrackerTest, SyncSigninError) {
       Return(false));
   EXPECT_CALL(*mock_token_service_, HasTokenForService(_))
       .WillRepeatedly(Return(true));
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
   GoogleServiceSigninSuccessDetails details("username@gmail.com", "password");
   content::NotificationService::current()->Notify(
       chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
@@ -310,8 +306,8 @@ TEST_F(SigninTrackerTest, SigninSuccess) {
   tracker_.reset();
   GoogleServiceAuthError error(GoogleServiceAuthError::NONE);
   ExpectSignedInSyncService(mock_pss_, mock_token_service_, error);
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
+
   // Finally SigninSuccess() is expected to be called when everything is ready.
   EXPECT_CALL(observer_, SigninSuccess());
   tracker_.reset(new SigninTracker(profile_.get(), &observer_,
@@ -322,8 +318,7 @@ TEST_F(SigninTrackerTest, SigninFailedSyncTokenUnavailable) {
   tracker_.reset();
   EXPECT_CALL(*mock_token_service_, HasTokenForService(_))
       .WillRepeatedly(Return(true));
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
   GoogleServiceAuthError error(GoogleServiceAuthError::NONE);
   EXPECT_CALL(*mock_pss_, IsSyncEnabledAndLoggedIn()).WillRepeatedly(
       Return(true));
@@ -345,8 +340,7 @@ TEST_F(SigninTrackerTest, SigninFailedGoogleServiceAuthError) {
   tracker_.reset();
   EXPECT_CALL(*mock_token_service_, HasTokenForService(_))
       .WillRepeatedly(Return(true));
-  mock_signin_manager_->StartSignInWithCredentials("0", "username@gmail.com",
-                                                   "password");
+  mock_signin_manager_->SetAuthenticatedUsername("username@gmail.com");
   // Inject authentication error.
   GoogleServiceAuthError error(GoogleServiceAuthError::SERVICE_UNAVAILABLE);
   FakeAuthStatusProvider provider(mock_signin_manager_->signin_global_error());
diff --git a/chrome/browser/signin/signin_ui_util.cc b/chrome/browser/signin/signin_ui_util.cc
index d1db4dd..70eeead 100644
--- a/chrome/browser/signin/signin_ui_util.cc
+++ b/chrome/browser/signin/signin_ui_util.cc
@@ -30,7 +30,8 @@ namespace signin_ui_util {
 GlobalError* GetSignedInServiceError(Profile* profile) {
   // Auth errors have the highest priority - after that, individual service
   // errors.
-  SigninManager* signin_manager = SigninManagerFactory::GetForProfile(profile);
+  SigninManagerBase* signin_manager =
+      SigninManagerFactory::GetForProfile(profile);
   SigninGlobalError* signin_error = signin_manager->signin_global_error();
   if (signin_error && signin_error->HasMenuItem())
     return signin_error;
@@ -61,7 +62,7 @@ string16 GetSigninMenuLabel(Profile* profile) {
   // label if we're still setting up sync.
   if (!service || !service->FirstSetupInProgress()) {
     std::string username;
-    SigninManager* signin_manager =
+    SigninManagerBase* signin_manager =
         SigninManagerFactory::GetForProfileIfExists(profile);
     if (signin_manager)
       username = signin_manager->GetAuthenticatedUsername();
@@ -79,7 +80,7 @@ string16 GetSigninMenuLabel(Profile* profile) {
 
 // Given an authentication state this helper function returns various labels
 // that can be used to display information about the state.
-void GetStatusLabelsForAuthError(const SigninManager& signin_manager,
+void GetStatusLabelsForAuthError(const SigninManagerBase& signin_manager,
                                  string16* status_label,
                                  string16* link_label) {
   string16 username = UTF8ToUTF16(signin_manager.GetAuthenticatedUsername());
diff --git a/chrome/browser/signin/signin_ui_util.h b/chrome/browser/signin/signin_ui_util.h
index 11fc60c..821fd0e 100644
--- a/chrome/browser/signin/signin_ui_util.h
+++ b/chrome/browser/signin/signin_ui_util.h
@@ -9,7 +9,7 @@
 
 class GlobalError;
 class Profile;
-class SigninManager;
+class SigninManagerBase;
 
 // Utility functions to gather status information from the various signed in
 // services and construct messages suitable for showing in UI.
@@ -23,7 +23,7 @@ GlobalError* GetSignedInServiceError(Profile* profile);
 // "Sign in to Chromium", "Signin Error...", etc).
 string16 GetSigninMenuLabel(Profile* profile);
 
-void GetStatusLabelsForAuthError(const SigninManager& signin_manager,
+void GetStatusLabelsForAuthError(const SigninManagerBase& signin_manager,
                                  string16* status_label,
                                  string16* link_label);
 
diff --git a/chrome/browser/sync/profile_sync_service.cc b/chrome/browser/sync/profile_sync_service.cc
index f7a87e9..14312e58 100644
--- a/chrome/browser/sync/profile_sync_service.cc
+++ b/chrome/browser/sync/profile_sync_service.cc
@@ -130,7 +130,7 @@ bool ShouldShowActionOnUI(
 
 ProfileSyncService::ProfileSyncService(ProfileSyncComponentsFactory* factory,
                                        Profile* profile,
-                                       SigninManager* signin_manager,
+                                       SigninManagerBase* signin_manager,
                                        StartBehavior start_behavior)
     : last_auth_error_(AuthError::AuthErrorNone()),
       passphrase_required_reason_(syncer::REASON_PASSPHRASE_NOT_REQUIRED),
@@ -2052,7 +2052,7 @@ void ProfileSyncService::UpdateInvalidatorRegistrarState() {
 
 void ProfileSyncService::ResetForTest() {
   Profile* profile = profile_;
-  SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+  SigninManagerBase* signin = SigninManagerFactory::GetForProfile(profile);
   ProfileSyncService::StartBehavior behavior =
       browser_defaults::kSyncAutoStarts ? ProfileSyncService::AUTO_START
                                         : ProfileSyncService::MANUAL_START;
diff --git a/chrome/browser/sync/profile_sync_service.h b/chrome/browser/sync/profile_sync_service.h
index e25167c..61b5700 100644
--- a/chrome/browser/sync/profile_sync_service.h
+++ b/chrome/browser/sync/profile_sync_service.h
@@ -47,7 +47,7 @@
 
 class Profile;
 class ProfileSyncComponentsFactory;
-class SigninManager;
+class SigninManagerBase;
 class SyncGlobalError;
 
 namespace browser_sync {
@@ -219,7 +219,7 @@ class ProfileSyncService : public ProfileSyncServiceBase,
   // Takes ownership of |factory|.
   ProfileSyncService(ProfileSyncComponentsFactory* factory,
                      Profile* profile,
-                     SigninManager* signin,
+                     SigninManagerBase* signin,
                      StartBehavior start_behavior);
   virtual ~ProfileSyncService();
 
@@ -569,7 +569,7 @@ class ProfileSyncService : public ProfileSyncServiceBase,
 
   const GURL& sync_service_url() const { return sync_service_url_; }
   bool auto_start_enabled() const { return auto_start_enabled_; }
-  SigninManager* signin() const { return signin_; }
+  SigninManagerBase* signin() const { return signin_; }
   bool setup_in_progress() const { return setup_in_progress_; }
 
   // Stops the sync backend and sets the flag for suppressing sync startup.
@@ -846,7 +846,7 @@ class ProfileSyncService : public ProfileSyncServiceBase,
 
   // Encapsulates user signin - used to set/get the user's authenticated
   // email address.
-  SigninManager* signin_;
+  SigninManagerBase* signin_;
 
   // Information describing an unrecoverable error.
   UnrecoverableErrorReason unrecoverable_error_reason_;
diff --git a/chrome/browser/sync/profile_sync_service_autofill_unittest.cc b/chrome/browser/sync/profile_sync_service_autofill_unittest.cc
index d536223..232635f 100644
--- a/chrome/browser/sync/profile_sync_service_autofill_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_autofill_unittest.cc
@@ -522,7 +522,8 @@ class ProfileSyncServiceAutofillTest
                         bool will_fail_association,
                         syncer::ModelType type) {
     AbstractAutofillFactory* factory = GetFactory(type);
-    SigninManager* signin = SigninManagerFactory::GetForProfile(profile_.get());
+    SigninManagerBase* signin =
+        SigninManagerFactory::GetForProfile(profile_.get());
     signin->SetAuthenticatedUsername("test_user");
     sync_service_ = static_cast<TestProfileSyncService*>(
         ProfileSyncServiceFactory::GetInstance()->SetTestingFactoryAndUse(
diff --git a/chrome/browser/sync/profile_sync_service_factory.cc b/chrome/browser/sync/profile_sync_service_factory.cc
index 013e488..c6fa790 100644
--- a/chrome/browser/sync/profile_sync_service_factory.cc
+++ b/chrome/browser/sync/profile_sync_service_factory.cc
@@ -85,7 +85,7 @@ ProfileKeyedService* ProfileSyncServiceFactory::BuildServiceInstanceFor(
       browser_defaults::kSyncAutoStarts ? ProfileSyncService::AUTO_START
                                         : ProfileSyncService::MANUAL_START;
 
-  SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+  SigninManagerBase* signin = SigninManagerFactory::GetForProfile(profile);
 
   // TODO(atwilson): Change AboutSigninInternalsFactory to load on startup
   // once http://crbug.com/171406 has been fixed.
diff --git a/chrome/browser/sync/profile_sync_service_harness.cc b/chrome/browser/sync/profile_sync_service_harness.cc
index eb0b074..c7367cc 100644
--- a/chrome/browser/sync/profile_sync_service_harness.cc
+++ b/chrome/browser/sync/profile_sync_service_harness.cc
@@ -20,12 +20,19 @@
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/message_loop.h"
+#include "base/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/signin/signin_manager.h"
+#include "chrome/browser/signin/signin_manager_base.h"
+#include "chrome/browser/signin/token_service.h"
+#include "chrome/browser/signin/token_service_factory.h"
 #include "chrome/browser/sync/about_sync_util.h"
 #include "chrome/browser/sync/glue/data_type_controller.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
+#include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/common/pref_names.h"
+#include "content/public/browser/notification_service.h"
+#include "google_apis/gaia/gaia_constants.h"
 #include "sync/internal_api/public/base/progress_marker_map.h"
 #include "sync/internal_api/public/sessions/sync_session_snapshot.h"
 #include "sync/internal_api/public/util/sync_string_conversions.h"
@@ -179,8 +186,16 @@ bool ProfileSyncServiceHarness::SetupSync(
   service_->SetSetupInProgress(true);
 
   // Authenticate sync client using GAIA credentials.
-  service_->signin()
-      ->StartSignIn(username_, password_, std::string(), std::string());
+  service_->signin()->SetAuthenticatedUsername(username_);
+  profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername,
+                                  username_);
+  GoogleServiceSigninSuccessDetails details(username_, password_);
+  content::NotificationService::current()->Notify(
+      chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
+      content::Source<Profile>(profile_),
+      content::Details<const GoogleServiceSigninSuccessDetails>(&details));
+  TokenServiceFactory::GetForProfile(profile_)->IssueAuthTokenForTest(
+      GaiaConstants::kSyncService, "sync_token");
 
   // Wait for the OnBackendInitialized() callback.
   if (!AwaitBackendInitialized()) {
diff --git a/chrome/browser/sync/profile_sync_service_password_unittest.cc b/chrome/browser/sync/profile_sync_service_password_unittest.cc
index a936bd7..e7cd303 100644
--- a/chrome/browser/sync/profile_sync_service_password_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_password_unittest.cc
@@ -98,7 +98,7 @@ class PasswordTestProfileSyncService : public TestProfileSyncService {
   PasswordTestProfileSyncService(
       ProfileSyncComponentsFactory* factory,
       Profile* profile,
-      SigninManager* signin)
+      SigninManagerBase* signin)
       : TestProfileSyncService(factory,
                                profile,
                                signin,
@@ -129,7 +129,8 @@ class PasswordTestProfileSyncService : public TestProfileSyncService {
   }
 
   static ProfileKeyedService* Build(Profile* profile) {
-    SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+    SigninManagerBase* signin =
+        SigninManagerFactory::GetForProfile(profile);
     ProfileSyncComponentsFactoryMock* factory =
         new ProfileSyncComponentsFactoryMock();
     return new PasswordTestProfileSyncService(factory, profile, signin);
@@ -198,7 +199,8 @@ class ProfileSyncServicePasswordTest : public AbstractProfileSyncServiceTest {
   void StartSyncService(const base::Closure& root_callback,
                         const base::Closure& node_callback) {
     if (!sync_service_) {
-      SigninManager* signin = SigninManagerFactory::GetForProfile(&profile_);
+      SigninManagerBase* signin =
+          SigninManagerFactory::GetForProfile(&profile_);
       signin->SetAuthenticatedUsername("test_user");
       token_service_ = static_cast<TokenService*>(
           TokenServiceFactory::GetInstance()->SetTestingFactoryAndUse(
diff --git a/chrome/browser/sync/profile_sync_service_preference_unittest.cc b/chrome/browser/sync/profile_sync_service_preference_unittest.cc
index b34a6eb..110d100 100644
--- a/chrome/browser/sync/profile_sync_service_preference_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_preference_unittest.cc
@@ -149,7 +149,8 @@ class ProfileSyncServicePreferenceTest
     if (sync_service_)
       return false;
 
-    SigninManager* signin = SigninManagerFactory::GetForProfile(profile_.get());
+    SigninManagerBase* signin =
+         SigninManagerFactory::GetForProfile(profile_.get());
     signin->SetAuthenticatedUsername("test");
     sync_service_ = static_cast<TestProfileSyncService*>(
         ProfileSyncServiceFactory::GetInstance()->SetTestingFactoryAndUse(
diff --git a/chrome/browser/sync/profile_sync_service_session_unittest.cc b/chrome/browser/sync/profile_sync_service_session_unittest.cc
index 4ed28ab..7ed9194 100644
--- a/chrome/browser/sync/profile_sync_service_session_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_session_unittest.cc
@@ -74,7 +74,7 @@ class FakeProfileSyncService : public TestProfileSyncService {
   FakeProfileSyncService(
       ProfileSyncComponentsFactory* factory,
       Profile* profile,
-      SigninManager* signin,
+      SigninManagerBase* signin,
       ProfileSyncService::StartBehavior behavior,
       bool synchronous_backend_initialization)
       : TestProfileSyncService(factory,
@@ -261,7 +261,8 @@ class ProfileSyncServiceSessionTest
                         bool will_fail_association) {
     if (sync_service_.get())
       return false;
-    SigninManager* signin = SigninManagerFactory::GetForProfile(profile());
+    SigninManagerBase* signin =
+        SigninManagerFactory::GetForProfile(profile());
     signin->SetAuthenticatedUsername("test_user");
     ProfileSyncComponentsFactoryMock* factory =
         new ProfileSyncComponentsFactoryMock();
diff --git a/chrome/browser/sync/profile_sync_service_startup_unittest.cc b/chrome/browser/sync/profile_sync_service_startup_unittest.cc
index 7a46b15..f6b3353 100644
--- a/chrome/browser/sync/profile_sync_service_startup_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_startup_unittest.cc
@@ -22,6 +22,8 @@
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/testing_profile.h"
+#include "content/public/browser/notification_service.h"
+#include "content/public/browser/notification_source.h"
 #include "content/public/test/test_browser_thread.h"
 #include "google_apis/gaia/gaia_auth_consumer.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ -99,10 +101,21 @@ class ProfileSyncServiceStartupTest : public testing::Test {
     ui_loop_.RunUntilIdle();
   }
 
+  void Signin() {
+    sync_->signin()->SetAuthenticatedUsername("test_user");
+    profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername,
+                                    "test_user");
+    GoogleServiceSigninSuccessDetails details("test_user", "");
+    content::NotificationService::current()->Notify(
+        chrome::NOTIFICATION_GOOGLE_SIGNIN_SUCCESSFUL,
+        content::Source<Profile>(profile_.get()),
+        content::Details<const GoogleServiceSigninSuccessDetails>(&details));
+  }
+
   static ProfileKeyedService* BuildService(Profile* profile) {
-    SigninManager* signin = static_cast<SigninManager*>(
+    SigninManagerBase* signin = static_cast<SigninManagerBase*>(
         SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
-            profile, FakeSigninManager::Build));
+            profile, FakeSigninManagerBase::Build));
     signin->SetAuthenticatedUsername("test_user");
     return new TestProfileSyncService(
         new ProfileSyncComponentsFactoryMock(),
@@ -141,7 +154,8 @@ class ProfileSyncServiceStartupTest : public testing::Test {
 class ProfileSyncServiceStartupCrosTest : public ProfileSyncServiceStartupTest {
  public:
     static ProfileKeyedService* BuildCrosService(Profile* profile) {
-      SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+      SigninManagerBase* signin =
+           SigninManagerFactory::GetForProfile(profile);
       signin->SetAuthenticatedUsername("test_user");
       return new TestProfileSyncService(
           new ProfileSyncComponentsFactoryMock(),
@@ -150,6 +164,7 @@ class ProfileSyncServiceStartupCrosTest : public ProfileSyncServiceStartupTest {
           ProfileSyncService::AUTO_START,
           true);
     }
+
  protected:
   virtual void CreateSyncService() OVERRIDE {
     sync_ = static_cast<TestProfileSyncService*>(
@@ -189,10 +204,9 @@ TEST_F(ProfileSyncServiceStartupTest, StartFirstTime) {
   // Create some tokens in the token service; the service will startup when
   // it is notified that tokens are available.
   sync_->SetSetupInProgress(true);
-  sync_->signin()
-      ->StartSignIn("test_user", std::string(), std::string(), std::string());
-  TokenServiceFactory::GetForProfile(profile_.get())
-      ->IssueAuthTokenForTest(GaiaConstants::kSyncService, "sync_token");
+  Signin();
+  TokenServiceFactory::GetForProfile(profile_.get())->IssueAuthTokenForTest(
+      GaiaConstants::kSyncService, "sync_token");
   TokenServiceFactory::GetForProfile(profile_.get())->IssueAuthTokenForTest(
       GaiaConstants::kGaiaOAuth2LoginRefreshToken, "oauth2_login_token");
   sync_->SetSetupInProgress(false);
@@ -236,8 +250,7 @@ TEST_F(ProfileSyncServiceStartupTest, StartNoCredentials) {
   EXPECT_CALL(observer_, OnStateChanged()).Times(AnyNumber());
 
   sync_->SetSetupInProgress(true);
-  sync_->signin()
-      ->StartSignIn("test_user", std::string(), std::string(), std::string());
+  Signin();
   // NOTE: Unlike StartFirstTime, this test does not issue any auth tokens.
   token_service->LoadTokensFromDB();
   sync_->SetSetupInProgress(false);
@@ -271,10 +284,9 @@ TEST_F(ProfileSyncServiceStartupTest, StartInvalidCredentials) {
   EXPECT_CALL(*data_type_manager, Stop()).Times(1);
   EXPECT_CALL(observer_, OnStateChanged()).Times(AnyNumber());
   sync_->SetSetupInProgress(true);
-  sync_->signin()
-      ->StartSignIn("test_user", std::string(), std::string(), std::string());
-  token_service->IssueAuthTokenForTest(GaiaConstants::kSyncService,
-                                       "sync_token");
+  Signin();
+  token_service->IssueAuthTokenForTest(
+      GaiaConstants::kSyncService, "sync_token");
   sync_->SetSetupInProgress(false);
   MessageLoop::current()->Run();
 
diff --git a/chrome/browser/sync/profile_sync_service_typed_url_unittest.cc b/chrome/browser/sync/profile_sync_service_typed_url_unittest.cc
index 34e5ccd..0070353 100644
--- a/chrome/browser/sync/profile_sync_service_typed_url_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_typed_url_unittest.cc
@@ -196,7 +196,8 @@ class ProfileSyncServiceTypedUrlTest : public AbstractProfileSyncServiceTest {
   TypedUrlModelAssociator* StartSyncService(const base::Closure& callback) {
     TypedUrlModelAssociator* model_associator = NULL;
     if (!sync_service_) {
-      SigninManager* signin = SigninManagerFactory::GetForProfile(&profile_);
+      SigninManagerBase* signin =
+          SigninManagerFactory::GetForProfile(&profile_);
       signin->SetAuthenticatedUsername("test");
       token_service_ = static_cast<TokenService*>(
           TokenServiceFactory::GetInstance()->SetTestingFactoryAndUse(
diff --git a/chrome/browser/sync/profile_sync_service_unittest.cc b/chrome/browser/sync/profile_sync_service_unittest.cc
index dba84a3..6b6a146 100644
--- a/chrome/browser/sync/profile_sync_service_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_unittest.cc
@@ -96,7 +96,7 @@ class ProfileSyncServiceTestHarness {
       bool sync_setup_completed,
       syncer::StorageOption storage_option) {
     if (!service.get()) {
-      SigninManager* signin =
+      SigninManagerBase* signin =
           SigninManagerFactory::GetForProfile(profile.get());
       signin->SetAuthenticatedUsername("test");
       ProfileSyncComponentsFactoryMock* factory =
@@ -176,7 +176,7 @@ class ProfileSyncServiceTest : public testing::Test {
 };
 
 TEST_F(ProfileSyncServiceTest, InitialState) {
-  SigninManager* signin =
+  SigninManagerBase* signin =
       SigninManagerFactory::GetForProfile(harness_.profile.get());
   harness_.service.reset(new TestProfileSyncService(
       new ProfileSyncComponentsFactoryMock(),
@@ -210,7 +210,7 @@ TEST_F(ProfileSyncServiceTest, DisabledByPolicy) {
   harness_.profile->GetTestingPrefService()->SetManagedPref(
       prefs::kSyncManaged,
       Value::CreateBooleanValue(true));
-  SigninManager* signin =
+  SigninManagerBase* signin =
       SigninManagerFactory::GetForProfile(harness_.profile.get());
   harness_.service.reset(new TestProfileSyncService(
       new ProfileSyncComponentsFactoryMock(),
@@ -223,7 +223,7 @@ TEST_F(ProfileSyncServiceTest, DisabledByPolicy) {
 }
 
 TEST_F(ProfileSyncServiceTest, AbortedByShutdown) {
-  SigninManager* signin =
+  SigninManagerBase* signin =
       SigninManagerFactory::GetForProfile(harness_.profile.get());
   signin->SetAuthenticatedUsername("test");
   ProfileSyncComponentsFactoryMock* factory =
@@ -248,7 +248,7 @@ TEST_F(ProfileSyncServiceTest, AbortedByShutdown) {
 }
 
 TEST_F(ProfileSyncServiceTest, DisableAndEnableSyncTemporarily) {
-  SigninManager* signin =
+  SigninManagerBase* signin =
       SigninManagerFactory::GetForProfile(harness_.profile.get());
   signin->SetAuthenticatedUsername("test");
   ProfileSyncComponentsFactoryMock* factory =
@@ -283,7 +283,7 @@ TEST_F(ProfileSyncServiceTest, DisableAndEnableSyncTemporarily) {
 }
 
 TEST_F(ProfileSyncServiceTest, EnableSyncAndSignOut) {
-  SigninManager* signin =
+  SigninManagerBase* signin =
       SigninManagerFactory::GetForProfile(harness_.profile.get());
   signin->SetAuthenticatedUsername("test@test.com");
   ProfileSyncComponentsFactoryMock* factory =
diff --git a/chrome/browser/sync/sync_global_error.cc b/chrome/browser/sync/sync_global_error.cc
index 11c2a2c..e329719 100644
--- a/chrome/browser/sync/sync_global_error.cc
+++ b/chrome/browser/sync/sync_global_error.cc
@@ -22,7 +22,7 @@
 #include "ui/base/l10n/l10n_util.h"
 
 SyncGlobalError::SyncGlobalError(ProfileSyncService* service,
-                                 SigninManager* signin)
+                                 SigninManagerBase* signin)
     : service_(service),
       signin_(signin) {
   DCHECK(service_);
diff --git a/chrome/browser/sync/sync_global_error.h b/chrome/browser/sync/sync_global_error.h
index 5f6de1c..8a114cc 100644
--- a/chrome/browser/sync/sync_global_error.h
+++ b/chrome/browser/sync/sync_global_error.h
@@ -11,14 +11,14 @@
 #include "chrome/browser/ui/global_error/global_error.h"
 
 class ProfileSyncService;
-class SigninManager;
+class SigninManagerBase;
 
 // Shows sync errors on the wrench menu using a bubble view and a
 // menu item.
 class SyncGlobalError : public GlobalError,
                         public ProfileSyncServiceObserver {
  public:
-  SyncGlobalError(ProfileSyncService* service, SigninManager* signin);
+  SyncGlobalError(ProfileSyncService* service, SigninManagerBase* signin);
   virtual ~SyncGlobalError();
 
   virtual bool HasMenuItem() OVERRIDE;
@@ -43,7 +43,7 @@ class SyncGlobalError : public GlobalError,
   string16 bubble_message_;
   string16 menu_label_;
   ProfileSyncService* service_;
-  SigninManager* signin_;
+  SigninManagerBase* signin_;
 
   DISALLOW_COPY_AND_ASSIGN(SyncGlobalError);
 };
diff --git a/chrome/browser/sync/sync_global_error_unittest.cc b/chrome/browser/sync/sync_global_error_unittest.cc
index 021e367..6abddb4 100644
--- a/chrome/browser/sync/sync_global_error_unittest.cc
+++ b/chrome/browser/sync/sync_global_error_unittest.cc
@@ -159,7 +159,8 @@ TEST_F(SyncGlobalErrorTest, PassphraseGlobalError) {
   scoped_ptr<Profile> profile(
       ProfileSyncServiceMock::MakeSignedInTestingProfile());
   NiceMock<ProfileSyncServiceMock> service(profile.get());
-  SigninManager* signin = SigninManagerFactory::GetForProfile(profile.get());
+  SigninManagerBase* signin =
+      SigninManagerFactory::GetForProfile(profile.get());
   FakeLoginUIService* login_ui_service = static_cast<FakeLoginUIService*>(
       LoginUIServiceFactory::GetInstance()->SetTestingFactoryAndUse(
           profile.get(), BuildMockLoginUIService));
diff --git a/chrome/browser/sync/sync_ui_util.cc b/chrome/browser/sync/sync_ui_util.cc
index 4e95d33..a8cd618 100644
--- a/chrome/browser/sync/sync_ui_util.cc
+++ b/chrome/browser/sync/sync_ui_util.cc
@@ -12,7 +12,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/signin/signin_global_error.h"
-#include "chrome/browser/signin/signin_manager.h"
+#include "chrome/browser/signin/signin_manager_base.h"
 #include "chrome/browser/signin/signin_ui_util.h"
 #include "chrome/browser/sync/profile_sync_service.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
@@ -45,7 +45,7 @@ namespace {
 // and can connect to the sync server. If the user hasn't yet authenticated, an
 // empty string is returned.
 string16 GetSyncedStateStatusLabel(ProfileSyncService* service,
-                                   const SigninManager& signin,
+                                   const SigninManagerBase& signin,
                                    StatusLabelStyle style) {
   string16 user_name = UTF8ToUTF16(signin.GetAuthenticatedUsername());
 
@@ -115,7 +115,7 @@ void GetStatusForActionableError(
 
 // status_label and link_label must either be both NULL or both non-NULL.
 MessageType GetStatusInfo(ProfileSyncService* service,
-                          const SigninManager& signin,
+                          const SigninManagerBase& signin,
                           StatusLabelStyle style,
                           string16* status_label,
                           string16* link_label) {
@@ -253,7 +253,7 @@ MessageType GetStatusInfo(ProfileSyncService* service,
 // Returns the status info for use on the new tab page, where we want slightly
 // different information than in the settings panel.
 MessageType GetStatusInfoForNewTabPage(ProfileSyncService* service,
-                                       const SigninManager& signin,
+                                       const SigninManagerBase& signin,
                                        string16* status_label,
                                        string16* link_label) {
   DCHECK(status_label);
@@ -291,7 +291,7 @@ MessageType GetStatusInfoForNewTabPage(ProfileSyncService* service,
 }  // namespace
 
 MessageType GetStatusLabels(ProfileSyncService* service,
-                            const SigninManager& signin,
+                            const SigninManagerBase& signin,
                             StatusLabelStyle style,
                             string16* status_label,
                             string16* link_label) {
@@ -302,7 +302,7 @@ MessageType GetStatusLabels(ProfileSyncService* service,
 }
 
 MessageType GetStatusLabelsForNewTabPage(ProfileSyncService* service,
-                                         const SigninManager& signin,
+                                         const SigninManagerBase& signin,
                                          string16* status_label,
                                          string16* link_label) {
   DCHECK(status_label);
@@ -312,7 +312,7 @@ MessageType GetStatusLabelsForNewTabPage(ProfileSyncService* service,
 }
 
 void GetStatusLabelsForSyncGlobalError(ProfileSyncService* service,
-                                       const SigninManager& signin,
+                                       const SigninManagerBase& signin,
                                        string16* menu_label,
                                        string16* bubble_message,
                                        string16* bubble_accept_label) {
@@ -343,7 +343,7 @@ void GetStatusLabelsForSyncGlobalError(ProfileSyncService* service,
 }
 
 MessageType GetStatus(
-    ProfileSyncService* service, const SigninManager& signin) {
+    ProfileSyncService* service, const SigninManagerBase& signin) {
   return sync_ui_util::GetStatusInfo(service, signin, WITH_HTML, NULL, NULL);
 }
 
diff --git a/chrome/browser/sync/sync_ui_util.h b/chrome/browser/sync/sync_ui_util.h
index c533803..e201201 100644
--- a/chrome/browser/sync/sync_ui_util.h
+++ b/chrome/browser/sync/sync_ui_util.h
@@ -8,7 +8,7 @@
 #include "base/string16.h"
 
 class ProfileSyncService;
-class SigninManager;
+class SigninManagerBase;
 
 // Utility functions to gather current sync status information from the sync
 // service and constructs messages suitable for showing in UI.
@@ -34,7 +34,7 @@ enum StatusLabelStyle {
 // by querying |service|.
 // |style| sets the link properties, see |StatusLabelStyle|.
 MessageType GetStatusLabels(ProfileSyncService* service,
-                            const SigninManager& signin,
+                            const SigninManagerBase& signin,
                             StatusLabelStyle style,
                             string16* status_label,
                             string16* link_label);
@@ -42,7 +42,7 @@ MessageType GetStatusLabels(ProfileSyncService* service,
 // Same as above but for use specifically on the New Tab Page.
 // |status_label| may contain an HTML-formatted link.
 MessageType GetStatusLabelsForNewTabPage(ProfileSyncService* service,
-                                         const SigninManager& signin,
+                                         const SigninManagerBase& signin,
                                          string16* status_label,
                                          string16* link_label);
 
@@ -50,12 +50,13 @@ MessageType GetStatusLabelsForNewTabPage(ProfileSyncService* service,
 // |menu_item_label|, |bubble_message|, and |bubble_accept_label| must not be
 // NULL.
 void GetStatusLabelsForSyncGlobalError(ProfileSyncService* service,
-                                       const SigninManager& signin,
+                                       const SigninManagerBase& signin,
                                        string16* menu_item_label,
                                        string16* bubble_message,
                                        string16* bubble_accept_label);
 
-MessageType GetStatus(ProfileSyncService* service, const SigninManager& signin);
+MessageType GetStatus(ProfileSyncService* service,
+                      const SigninManagerBase& signin);
 
 }  // namespace sync_ui_util
 #endif  // CHROME_BROWSER_SYNC_SYNC_UI_UTIL_H_
diff --git a/chrome/browser/sync/sync_ui_util_unittest.cc b/chrome/browser/sync/sync_ui_util_unittest.cc
index 16efe7b..50bdf2e 100644
--- a/chrome/browser/sync/sync_ui_util_unittest.cc
+++ b/chrome/browser/sync/sync_ui_util_unittest.cc
@@ -45,7 +45,7 @@ namespace {
 // Utility function to test that GetStatusLabelsForSyncGlobalError returns
 // the correct results for the given states.
 void VerifySyncGlobalErrorResult(NiceMock<ProfileSyncServiceMock>* service,
-                                 const SigninManager& signin,
+                                 const SigninManagerBase& signin,
                                  GoogleServiceAuthError::State error_state,
                                  bool is_signed_in,
                                  bool is_error) {
@@ -74,7 +74,7 @@ TEST(SyncUIUtilTest, PassphraseGlobalError) {
   scoped_ptr<Profile> profile(
       ProfileSyncServiceMock::MakeSignedInTestingProfile());
   NiceMock<ProfileSyncServiceMock> service(profile.get());
-  FakeSigninManager signin(profile.get());
+  FakeSigninManagerBase signin(profile.get());
   browser_sync::SyncBackendHost::Status status;
   EXPECT_CALL(service, QueryDetailedSyncStatus(_))
               .WillRepeatedly(Return(false));
@@ -94,7 +94,7 @@ TEST(SyncUIUtilTest, AuthAndPassphraseGlobalError) {
   scoped_ptr<Profile> profile(
       ProfileSyncServiceMock::MakeSignedInTestingProfile());
   NiceMock<ProfileSyncServiceMock> service(profile.get());
-  FakeSigninManager signin(profile.get());
+  FakeSigninManagerBase signin(profile.get());
   browser_sync::SyncBackendHost::Status status;
   EXPECT_CALL(service, QueryDetailedSyncStatus(_))
               .WillRepeatedly(Return(false));
@@ -145,16 +145,46 @@ TEST(SyncUIUtilTest, AuthStateGlobalError) {
     GoogleServiceAuthError::HOSTED_NOT_ALLOWED
   };
 
-  FakeSigninManager signin(profile.get());
+  FakeSigninManagerBase signin(profile.get());
   for (size_t i = 0; i < arraysize(table); ++i) {
     VerifySyncGlobalErrorResult(&service, signin, table[i], true, false);
     VerifySyncGlobalErrorResult(&service, signin, table[i], false, false);
   }
 }
+
+// TODO(tim): This shouldn't be required. r194857 removed the
+// AuthInProgress override from FakeSigninManager, which meant this test started
+// using the "real" SigninManager AuthInProgress logic. Without that override,
+// it's no longer possible to test both chrome os + desktop flows as part of the
+// same test, because AuthInProgress is always false on chrome os. Most of the
+// tests are unaffected, but STATUS_CASE_AUTHENTICATING can't exist in both
+// versions, so it we will require two separate tests, one using SigninManager
+// and one using SigninManagerBase (which require different setup procedures.
+class FakeSigninManagerForSyncUIUtilTest : public FakeSigninManagerBase {
+ public:
+  explicit FakeSigninManagerForSyncUIUtilTest(Profile* profile)
+      : FakeSigninManagerBase(profile), auth_in_progress_(false) {
+  }
+
+  virtual ~FakeSigninManagerForSyncUIUtilTest() {
+  }
+
+  virtual bool AuthInProgress() const OVERRIDE {
+    return auth_in_progress_;
+  }
+
+  void set_auth_in_progress() {
+    auth_in_progress_ = true;
+  }
+
+ private:
+  bool auth_in_progress_;
+};
+
 // Loads a ProfileSyncServiceMock to emulate one of a number of distinct cases
 // in order to perform tests on the generated messages.
 void GetDistinctCase(ProfileSyncServiceMock& service,
-                     FakeSigninManager* signin,
+                     FakeSigninManagerForSyncUIUtilTest* signin,
                      FakeAuthStatusProvider* provider,
                      int caseNumber) {
   // Auth Error object is returned by reference in mock and needs to stay in
@@ -197,7 +227,7 @@ void GetDistinctCase(ProfileSyncServiceMock& service,
                                   Return(false)));
       EXPECT_CALL(service, HasUnrecoverableError())
                   .WillRepeatedly(Return(false));
-      signin->set_auth_in_progress("test_user@test.com");
+      signin->set_auth_in_progress();
       return;
     }
     case STATUS_CASE_AUTH_ERROR: {
@@ -294,7 +324,7 @@ TEST(SyncUIUtilTest, DistinctCasesReportUniqueMessageSets) {
     scoped_ptr<Profile> profile(
         ProfileSyncServiceMock::MakeSignedInTestingProfile());
     ProfileSyncServiceMock service(profile.get());
-    FakeSigninManager signin(profile.get());
+    FakeSigninManagerForSyncUIUtilTest signin(profile.get());
     signin.SetAuthenticatedUsername("test_user@test.com");
     FakeAuthStatusProvider provider(signin.signin_global_error());
     GetDistinctCase(service, &signin, &provider, idx);
@@ -327,7 +357,7 @@ TEST(SyncUIUtilTest, HtmlNotIncludedInStatusIfNotRequested) {
     scoped_ptr<Profile> profile(
         ProfileSyncServiceMock::MakeSignedInTestingProfile());
     ProfileSyncServiceMock service(profile.get());
-    FakeSigninManager signin(profile.get());
+    FakeSigninManagerForSyncUIUtilTest signin(profile.get());
     signin.SetAuthenticatedUsername("test_user@test.com");
     FakeAuthStatusProvider provider(signin.signin_global_error());
     GetDistinctCase(service, &signin, &provider, idx);
diff --git a/chrome/browser/sync/test_profile_sync_service.cc b/chrome/browser/sync/test_profile_sync_service.cc
index 7d2d0d3..71f2a3d 100644
--- a/chrome/browser/sync/test_profile_sync_service.cc
+++ b/chrome/browser/sync/test_profile_sync_service.cc
@@ -207,7 +207,7 @@ browser_sync::SyncBackendHostForProfileSyncTest*
 TestProfileSyncService::TestProfileSyncService(
     ProfileSyncComponentsFactory* factory,
     Profile* profile,
-    SigninManager* signin,
+    SigninManagerBase* signin,
     ProfileSyncService::StartBehavior behavior,
     bool synchronous_backend_initialization)
         : ProfileSyncService(factory,
@@ -229,7 +229,8 @@ TestProfileSyncService::~TestProfileSyncService() {
 // static
 ProfileKeyedService* TestProfileSyncService::BuildAutoStartAsyncInit(
     Profile* profile) {
-  SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
+  SigninManagerBase* signin =
+      SigninManagerFactory::GetForProfile(profile);
   ProfileSyncComponentsFactoryMock* factory =
       new ProfileSyncComponentsFactoryMock();
   return new TestProfileSyncService(
diff --git a/chrome/browser/sync/test_profile_sync_service.h b/chrome/browser/sync/test_profile_sync_service.h
index 6b52b214c..7951360 100644
--- a/chrome/browser/sync/test_profile_sync_service.h
+++ b/chrome/browser/sync/test_profile_sync_service.h
@@ -113,7 +113,7 @@ class TestProfileSyncService : public ProfileSyncService {
   TestProfileSyncService(
       ProfileSyncComponentsFactory* factory,
       Profile* profile,
-      SigninManager* signin,
+      SigninManagerBase* signin,
       ProfileSyncService::StartBehavior behavior,
       bool synchronous_backend_initialization);
 
diff --git a/chrome/browser/ui/app_list/chrome_signin_delegate.cc b/chrome/browser/ui/app_list/chrome_signin_delegate.cc
index 3d2e35a..b9d7c10 100644
--- a/chrome/browser/ui/app_list/chrome_signin_delegate.cc
+++ b/chrome/browser/ui/app_list/chrome_signin_delegate.cc
@@ -23,7 +23,7 @@
 
 namespace {
 
-SigninManager* GetSigninManager(Profile* profile) {
+SigninManagerBase* GetSigninManager(Profile* profile) {
   return SigninManagerFactory::GetForProfile(profile);
 }
 
diff --git a/chrome/browser/ui/auto_login_prompter.cc b/chrome/browser/ui/auto_login_prompter.cc
index 43d93d7..77efa14 100644
--- a/chrome/browser/ui/auto_login_prompter.cc
+++ b/chrome/browser/ui/auto_login_prompter.cc
@@ -42,7 +42,7 @@ bool FetchUsernameThroughSigninManager(Profile* profile, std::string* output) {
   if (!TokenServiceFactory::GetForProfile(profile)->AreCredentialsValid())
     return false;
 
-  SigninManager* signin_manager =
+  SigninManagerBase* signin_manager =
       SigninManagerFactory::GetInstance()->GetForProfile(profile);
   if (!signin_manager)
     return false;
diff --git a/chrome/browser/ui/chrome_pages.cc b/chrome/browser/ui/chrome_pages.cc
index 7fed38a..be15b3a 100644
--- a/chrome/browser/ui/chrome_pages.cc
+++ b/chrome/browser/ui/chrome_pages.cc
@@ -192,7 +192,7 @@ void ShowSearchEngineSettings(Browser* browser) {
 
 void ShowBrowserSignin(Browser* browser, SyncPromoUI::Source source) {
   Profile* original_profile = browser->profile()->GetOriginalProfile();
-  SigninManager* manager =
+  SigninManagerBase* manager =
       SigninManagerFactory::GetForProfile(original_profile);
   DCHECK(manager->IsSigninAllowed());
   // If we're signed in, just show settings.
diff --git a/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc b/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
index 155b4a2..9cd6449 100644
--- a/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
+++ b/chrome/browser/ui/sync/one_click_signin_helper_unittest.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/profiles/profile_io_data.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/signin/fake_signin_manager.h"
+#include "chrome/browser/signin/signin_manager.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/signin/signin_names_io_thread.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
@@ -53,8 +54,8 @@ const char kImplicitURLString[] =
 
 class SigninManagerMock : public FakeSigninManager {
  public:
-  explicit SigninManagerMock(Profile* profile)
-      : FakeSigninManager(profile) {}
+  explicit SigninManagerMock(Profile* profile) : FakeSigninManager(profile) {
+  }
   MOCK_CONST_METHOD1(IsAllowedUsername, bool(const std::string& username));
 };
 
@@ -267,10 +268,10 @@ void OneClickSigninHelperTest::CreateSigninManager(
           profile_, BuildSigninManagerMock));
   if (signin_manager_)
     signin_manager_->SetSigninProcess(trusted_signin_process_id_);
+
   if (!username.empty()) {
     ASSERT_TRUE(signin_manager_);
-    signin_manager_->StartSignIn(username, std::string(), std::string(),
-                                std::string());
+    signin_manager_->SetAuthenticatedUsername(username);
   }
 }
 
diff --git a/chrome/browser/ui/webui/ntp/new_tab_page_sync_handler.cc b/chrome/browser/ui/webui/ntp/new_tab_page_sync_handler.cc
index b184298..a5df8c9 100644
--- a/chrome/browser/ui/webui/ntp/new_tab_page_sync_handler.cc
+++ b/chrome/browser/ui/webui/ntp/new_tab_page_sync_handler.cc
@@ -94,7 +94,7 @@ void NewTabPageSyncHandler::HideSyncStatusSection() {
 
 void NewTabPageSyncHandler::BuildAndSendSyncStatus() {
   DCHECK(!waiting_for_initial_page_load_);
-  SigninManager* signin = SigninManagerFactory::GetForProfile(
+  SigninManagerBase* signin = SigninManagerFactory::GetForProfile(
       Profile::FromWebUI(web_ui()));
 
   // Hide the sync status section if sync is managed or disabled entirely.
diff --git a/chrome/browser/ui/webui/options/browser_options_handler.cc b/chrome/browser/ui/webui/options/browser_options_handler.cc
index e0e0c8e..29f249c 100644
--- a/chrome/browser/ui/webui/options/browser_options_handler.cc
+++ b/chrome/browser/ui/webui/options/browser_options_handler.cc
@@ -1171,12 +1171,17 @@ scoped_ptr<DictionaryValue> BrowserOptionsHandler::GetSyncStateDictionary() {
     return sync_status.Pass();
   }
 
+  bool signout_prohibited = false;
+#if !defined(OS_CHROMEOS)
   // Signout is not allowed if the user has policy (crbug.com/172204).
-  SigninManager* signin = SigninManagerFactory::GetForProfile(profile);
-  DCHECK(signin);
-  sync_status->SetBoolean("signoutAllowed", !signin->IsSignoutProhibited());
+  signout_prohibited =
+      SigninManagerFactory::GetForProfile(profile)->IsSignoutProhibited();
+#endif
+
   ProfileSyncService* service(
       ProfileSyncServiceFactory::GetInstance()->GetForProfile(profile));
+  SigninManagerBase* signin = service->signin();
+  sync_status->SetBoolean("signoutAllowed", !signout_prohibited);
   sync_status->SetBoolean("signinAllowed", signin->IsSigninAllowed());
   sync_status->SetBoolean("syncSystemEnabled", !!service);
   sync_status->SetBoolean("setupCompleted",
diff --git a/chrome/browser/ui/webui/sync_setup_handler.cc b/chrome/browser/ui/webui/sync_setup_handler.cc
index fa17f33..74ec39c 100644
--- a/chrome/browser/ui/webui/sync_setup_handler.cc
+++ b/chrome/browser/ui/webui/sync_setup_handler.cc
@@ -23,7 +23,6 @@
 #include "chrome/browser/profiles/profile_info_cache.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/profiles/profile_metrics.h"
-#include "chrome/browser/signin/signin_manager.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/sync/profile_sync_service.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
@@ -47,6 +46,12 @@
 #include "grit/locale_settings.h"
 #include "ui/base/l10n/l10n_util.h"
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/signin/signin_manager_base.h"
+#else
+#include "chrome/browser/signin/signin_manager.h"
+#endif
+
 using content::WebContents;
 using l10n_util::GetStringFUTF16;
 using l10n_util::GetStringUTF16;
@@ -570,10 +575,6 @@ void SyncSetupHandler::RegisterMessages() {
       base::Bind(&SyncSetupHandler::OnDidClosePage,
                  base::Unretained(this)));
   web_ui()->RegisterMessageCallback(
-      "SyncSetupSubmitAuth",
-      base::Bind(&SyncSetupHandler::HandleSubmitAuth,
-                 base::Unretained(this)));
-  web_ui()->RegisterMessageCallback(
       "SyncSetupConfigure",
       base::Bind(&SyncSetupHandler::HandleConfigure,
                  base::Unretained(this)));
@@ -599,10 +600,12 @@ void SyncSetupHandler::RegisterMessages() {
   web_ui()->RegisterMessageCallback("SyncSetupStopSyncing",
       base::Bind(&SyncSetupHandler::HandleStopSyncing,
                  base::Unretained(this)));
-}
-
-SigninManager* SyncSetupHandler::GetSignin() const {
-  return SigninManagerFactory::GetForProfile(GetProfile());
+#if !defined(OS_CHROMEOS)
+  web_ui()->RegisterMessageCallback(
+      "SyncSetupSubmitAuth",
+      base::Bind(&SyncSetupHandler::HandleSubmitAuth,
+                 base::Unretained(this)));
+#endif
 }
 
 void SyncSetupHandler::DisplayGaiaLogin(bool fatal_error) {
@@ -687,7 +690,8 @@ void SyncSetupHandler::DisplayGaiaLoginWithErrorMessage(
   } else {
     // Fresh login attempt - lock in the authenticated username if there is
     // one (don't let the user change it).
-    user = GetSignin()->GetAuthenticatedUsername();
+    user = SigninManagerFactory::GetForProfile(GetProfile())->
+        GetAuthenticatedUsername();
     error = 0;
     editable_user = user.empty();
   }
@@ -792,6 +796,7 @@ void SyncSetupHandler::OnDidClosePage(const ListValue* args) {
   CloseSyncSetup();
 }
 
+#if !defined (OS_CHROMEOS)
 void SyncSetupHandler::HandleSubmitAuth(const ListValue* args) {
   std::string json;
   if (!args->GetString(0, &json)) {
@@ -849,7 +854,7 @@ void SyncSetupHandler::TryLogin(const std::string& username,
   GoogleServiceAuthError current_error = last_signin_error_;
   last_signin_error_ = GoogleServiceAuthError::AuthErrorNone();
 
-  SigninManager* signin = GetSignin();
+  SigninManager* signin = SigninManagerFactory::GetForProfile(GetProfile());
 
   // If we're just being called to provide an ASP, then pass it to the
   // SigninManager and wait for the next step.
@@ -869,6 +874,7 @@ void SyncSetupHandler::TryLogin(const std::string& username,
   signin->StartSignIn(username, password, current_error.captcha().token,
                       solution);
 }
+#endif  // !defined (OS_CHROMEOS)
 
 void SyncSetupHandler::GaiaCredentialsValid() {
   DCHECK(IsActiveLogin());
@@ -1062,7 +1068,7 @@ void SyncSetupHandler::HandleStopSyncing(const ListValue* args) {
   if (GetSyncService())
     ProfileSyncService::SyncEvent(ProfileSyncService::STOP_FROM_OPTIONS);
 
-  GetSignin()->SignOut();
+  SigninManagerFactory::GetForProfile(GetProfile())->SignOut();
 }
 
 void SyncSetupHandler::HandleCloseTimeout(const ListValue* args) {
@@ -1115,7 +1121,7 @@ void SyncSetupHandler::CloseSyncSetup() {
         // the user checks the "advanced setup" checkbox, then cancels out of
         // the setup box, which is a much more common scenario, so we do the
         // right thing for the one-click case.
-        GetSignin()->SignOut();
+        SigninManagerFactory::GetForProfile(GetProfile())->SignOut();
       }
       sync_service->DisableForUser();
       browser_sync::SyncPrefs sync_prefs(GetProfile()->GetPrefs());
@@ -1155,7 +1161,8 @@ void SyncSetupHandler::OpenSyncSetup(bool force_login) {
   // 7) One-click signin (credentials are already available, so should display
   //    sync configure UI, not login UI).
   // 8) ChromeOS re-enable after disabling sync.
-  SigninManager* signin = GetSignin();
+  SigninManagerBase* signin =
+      SigninManagerFactory::GetForProfile(GetProfile());
   if (force_login ||
       signin->GetAuthenticatedUsername().empty() ||
 #if !defined(OS_CHROMEOS)
@@ -1292,7 +1299,8 @@ bool SyncSetupHandler::IsLoginAuthDataValid(const std::string& username,
   if (!web_ui())
     return true;
 
-  if (!GetSignin()->IsAllowedUsername(username)) {
+  if (!SigninManagerFactory::GetForProfile(
+          GetProfile())->IsAllowedUsername(username)) {
     *error_message = l10n_util::GetStringUTF16(IDS_SYNC_LOGIN_NAME_PROHIBITED);
     return false;
   }
diff --git a/chrome/browser/ui/webui/sync_setup_handler.h b/chrome/browser/ui/webui/sync_setup_handler.h
index 1f4d276..b8cc309 100644
--- a/chrome/browser/ui/webui/sync_setup_handler.h
+++ b/chrome/browser/ui/webui/sync_setup_handler.h
@@ -16,7 +16,7 @@
 class LoginUIService;
 class ProfileManager;
 class ProfileSyncService;
-class SigninManager;
+class SigninManagerBase;
 
 namespace content {
 class WebContents;
@@ -70,9 +70,6 @@ class SyncSetupHandler : public options::OptionsPageUIHandler,
   void CloseSyncSetup();
 
  protected:
-  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, GaiaErrorInitializingSync);
-  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, HandleCaptcha);
-  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, HandleGaiaAuthFailure);
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, SelectCustomEncryption);
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, SuccessfullySetPassphrase);
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, TestSyncEverything);
@@ -80,10 +77,15 @@ class SyncSetupHandler : public options::OptionsPageUIHandler,
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, TestPassphraseStillRequired);
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, TestSyncIndividualTypes);
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, TurnOnEncryptAll);
-  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest,
-                           UnrecoverableErrorInitializingSync);
   FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, UnsuccessfullySetPassphrase);
-  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerTest, SubmitAuthWithInvalidUsername);
+  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerNonCrosTest,
+                           UnrecoverableErrorInitializingSync);
+  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerNonCrosTest,
+                           GaiaErrorInitializingSync);
+  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerNonCrosTest, HandleCaptcha);
+  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerNonCrosTest, HandleGaiaAuthFailure);
+  FRIEND_TEST_ALL_PREFIXES(SyncSetupHandlerNonCrosTest,
+                           SubmitAuthWithInvalidUsername);
 
   bool is_configuring_sync() const { return configuring_sync_; }
   bool have_signin_tracker() const { return signin_tracker_; }
@@ -117,7 +119,6 @@ class SyncSetupHandler : public options::OptionsPageUIHandler,
  private:
   // Callbacks from the page.
   void OnDidClosePage(const base::ListValue* args);
-  void HandleSubmitAuth(const base::ListValue* args);
   void HandleConfigure(const base::ListValue* args);
   void HandlePassphraseEntry(const base::ListValue* args);
   void HandlePassphraseCancel(const base::ListValue* args);
@@ -127,6 +128,15 @@ class SyncSetupHandler : public options::OptionsPageUIHandler,
   void HandleDoSignOutOnAuthError(const base::ListValue* args);
   void HandleStopSyncing(const base::ListValue* args);
   void HandleCloseTimeout(const base::ListValue* args);
+#if !defined(OS_CHROMEOS)
+  void HandleSubmitAuth(const base::ListValue* args);
+
+  // Initiates a login via the signin manager.
+  void TryLogin(const std::string& username,
+                const std::string& password,
+                const std::string& captcha,
+                const std::string& access_code);
+#endif
 
   // Helper routine that gets the Profile associated with this object (virtual
   // so tests can override).
@@ -169,12 +179,6 @@ class SyncSetupHandler : public options::OptionsPageUIHandler,
   // Returns true if this object is the active login object.
   bool IsActiveLogin() const;
 
-  // Initiates a login via the signin manager.
-  void TryLogin(const std::string& username,
-                const std::string& password,
-                const std::string& captcha,
-                const std::string& access_code);
-
   // If a wizard already exists, focus it and return true.
   bool FocusExistingWizardIfPresent();
 
@@ -191,9 +195,6 @@ class SyncSetupHandler : public options::OptionsPageUIHandler,
   bool IsLoginAuthDataValid(const std::string& username,
                             string16* error_message);
 
-  // Returns the SigninManager for the parent profile.
-  SigninManager* GetSignin() const;
-
   // The SigninTracker object used to determine when the user has fully signed
   // in (this requires waiting for various services to initialize and tracking
   // errors from multiple sources). Should only be non-null while the login UI
diff --git a/chrome/browser/ui/webui/sync_setup_handler_unittest.cc b/chrome/browser/ui/webui/sync_setup_handler_unittest.cc
index d0b74c4..da0eb53 100644
--- a/chrome/browser/ui/webui/sync_setup_handler_unittest.cc
+++ b/chrome/browser/ui/webui/sync_setup_handler_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/values.h"
 #include "chrome/browser/signin/fake_auth_status_provider.h"
 #include "chrome/browser/signin/fake_signin_manager.h"
+#include "chrome/browser/signin/signin_manager.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/browser/sync/profile_sync_service_mock.h"
@@ -319,14 +320,15 @@ class TestingSyncSetupHandler : public SyncSetupHandler {
   DISALLOW_COPY_AND_ASSIGN(TestingSyncSetupHandler);
 };
 
-class SigninManagerMock : public FakeSigninManager {
+class SigninManagerBaseMock : public FakeSigninManagerBase {
  public:
-  explicit SigninManagerMock(Profile* profile) : FakeSigninManager(profile) {}
+  explicit SigninManagerBaseMock(Profile* profile)
+      : FakeSigninManagerBase(profile) {}
   MOCK_CONST_METHOD1(IsAllowedUsername, bool(const std::string& username));
 };
 
-static ProfileKeyedService* BuildSigninManagerMock(Profile* profile) {
-  return new SigninManagerMock(profile);
+static ProfileKeyedService* BuildSigninManagerBaseMock(Profile* profile) {
+  return new SigninManagerBaseMock(profile);
 }
 
 // The boolean parameter indicates whether the test is run with ClientOAuth
@@ -362,9 +364,9 @@ class SyncSetupHandlerTest : public testing::TestWithParam<bool> {
         Return(base::Time()));
     ON_CALL(*mock_pss_, GetExplicitPassphraseTime()).WillByDefault(
         Return(base::Time()));
-    mock_signin_ = static_cast<SigninManagerMock*>(
+    mock_signin_ = static_cast<SigninManagerBase*>(
         SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
-            profile_.get(), BuildSigninManagerMock));
+            profile_.get(), BuildSigninManagerBaseMock));
     handler_.reset(new TestingSyncSetupHandler(&web_ui_, profile_.get()));
   }
 
@@ -415,7 +417,7 @@ class SyncSetupHandlerTest : public testing::TestWithParam<bool> {
   GoogleServiceAuthError error_;
   // MessageLoop instance is required to work with OneShotTimer.
   MessageLoop message_loop_;
-  SigninManagerMock* mock_signin_;
+  SigninManagerBase* mock_signin_;
   TestWebUI web_ui_;
   scoped_ptr<TestingSyncSetupHandler> handler_;
 };
@@ -663,7 +665,41 @@ TEST_P(SyncSetupHandlerTest,
                 profile_.get())->current_login_ui());
 }
 
-TEST_P(SyncSetupHandlerTest, HandleGaiaAuthFailure) {
+#if !defined(OS_CHROMEOS)
+
+namespace {
+class SigninManagerMock : public FakeSigninManager {
+ public:
+  explicit SigninManagerMock(Profile* profile) : FakeSigninManager(profile) {
+  }
+
+  virtual void StartSignIn(const std::string& username,
+                           const std::string& password,
+                           const std::string& login_token,
+                           const std::string& login_captcha) OVERRIDE {
+    SetAuthenticatedUsername(username);
+  }
+
+  MOCK_CONST_METHOD1(IsAllowedUsername, bool(const std::string& username));
+};
+}
+
+static ProfileKeyedService* BuildSigninManagerMock(Profile* profile) {
+  return new SigninManagerMock(profile);
+}
+
+class SyncSetupHandlerNonCrosTest : public SyncSetupHandlerTest {
+ public:
+  SyncSetupHandlerNonCrosTest() {}
+  virtual void SetUp() OVERRIDE {
+    SyncSetupHandlerTest::SetUp();
+    mock_signin_ = static_cast<SigninManagerMock*>(
+        SigninManagerFactory::GetInstance()->SetTestingFactoryAndUse(
+            profile_.get(), BuildSigninManagerMock));
+  }
+};
+
+TEST_P(SyncSetupHandlerNonCrosTest, HandleGaiaAuthFailure) {
   EXPECT_CALL(*mock_pss_, IsSyncEnabledAndLoggedIn())
       .WillRepeatedly(Return(false));
   EXPECT_CALL(*mock_pss_, IsSyncTokenAvailable())
@@ -706,7 +742,7 @@ TEST_P(SyncSetupHandlerTest, HandleGaiaAuthFailure) {
   }
 }
 
-TEST_P(SyncSetupHandlerTest, HandleCaptcha) {
+TEST_P(SyncSetupHandlerNonCrosTest, HandleCaptcha) {
   EXPECT_CALL(*mock_pss_, IsSyncEnabledAndLoggedIn())
       .WillRepeatedly(Return(false));
   EXPECT_CALL(*mock_pss_, IsSyncTokenAvailable())
@@ -750,7 +786,7 @@ TEST_P(SyncSetupHandlerTest, HandleCaptcha) {
 }
 
 // TODO(kochi): We need equivalent tests for ChromeOS.
-TEST_P(SyncSetupHandlerTest, UnrecoverableErrorInitializingSync) {
+TEST_P(SyncSetupHandlerNonCrosTest, UnrecoverableErrorInitializingSync) {
   EXPECT_CALL(*mock_pss_, IsSyncEnabledAndLoggedIn())
       .WillRepeatedly(Return(false));
   EXPECT_CALL(*mock_pss_, IsSyncTokenAvailable())
@@ -799,7 +835,7 @@ TEST_P(SyncSetupHandlerTest, UnrecoverableErrorInitializingSync) {
   }
 }
 
-TEST_P(SyncSetupHandlerTest, GaiaErrorInitializingSync) {
+TEST_P(SyncSetupHandlerNonCrosTest, GaiaErrorInitializingSync) {
   EXPECT_CALL(*mock_pss_, IsSyncEnabledAndLoggedIn())
       .WillRepeatedly(Return(false));
   EXPECT_CALL(*mock_pss_, IsSyncTokenAvailable())
@@ -849,6 +885,57 @@ TEST_P(SyncSetupHandlerTest, GaiaErrorInitializingSync) {
   }
 }
 
+// Tests that trying to log in with an invalid username results in an error
+// displayed to the user.
+TEST_P(SyncSetupHandlerNonCrosTest, SubmitAuthWithInvalidUsername) {
+  SigninManagerMock* mock_signin =
+      static_cast<SigninManagerMock*>(mock_signin_);
+  EXPECT_CALL(*mock_signin, IsAllowedUsername(_)).
+      WillRepeatedly(Return(false));
+
+  // Generate a blob of json that matches what would be submitted by the login
+  // javascript code.
+  DictionaryValue args;
+  args.SetString("user", "user@not_allowed.com");
+  args.SetString("pass", "password");
+  args.SetString("captcha", std::string());
+  args.SetString("otp", std::string());
+  args.SetString("accessCode", std::string());
+  std::string json;
+  base::JSONWriter::Write(&args, &json);
+  ListValue list_args;
+  list_args.Append(new StringValue(json));
+
+  // Mimic a login attempt from the UI.
+  handler_->HandleSubmitAuth(&list_args);
+
+  // Should result in the login page being displayed again.
+  ASSERT_EQ(1U, web_ui_.call_data().size());
+  const TestWebUI::CallData& data = web_ui_.call_data()[0];
+  EXPECT_EQ("SyncSetupOverlay.showSyncSetupPage", data.function_name);
+  std::string page;
+  ASSERT_TRUE(data.arg1->GetAsString(&page));
+  EXPECT_EQ(page, "login");
+
+  // Also make sure that the appropriate error message is being passed.
+  DictionaryValue* dictionary;
+  ASSERT_TRUE(data.arg2->GetAsDictionary(&dictionary));
+  std::string err = l10n_util::GetStringUTF8(IDS_SYNC_LOGIN_NAME_PROHIBITED);
+  CheckShowSyncSetupArgs(dictionary,
+                         err,
+                         false,
+                         GoogleServiceAuthError::NONE,
+                         std::string(),
+                         true,
+                         std::string());
+  handler_->CloseSyncSetup();
+  EXPECT_EQ(NULL,
+            LoginUIServiceFactory::GetForProfile(
+                profile_.get())->current_login_ui());
+}
+
+#endif  // #if !defined(OS_CHROMEOS)
+
 TEST_P(SyncSetupHandlerTest, TestSyncEverything) {
   std::string args = GetConfiguration(
       NULL, SYNC_ALL_DATA, GetAllTypes(), std::string(), ENCRYPT_PASSWORDS);
@@ -1253,53 +1340,6 @@ TEST_P(SyncSetupHandlerTest, ShowSetupEncryptAll) {
   CheckBool(dictionary, "encryptAllData", true);
 }
 
-// Tests that trying to log in with an invalid username results in an error
-// displayed to the user.
-TEST_P(SyncSetupHandlerTest, SubmitAuthWithInvalidUsername) {
-  EXPECT_CALL(*mock_signin_, IsAllowedUsername(_)).
-      WillRepeatedly(Return(false));
-
-  // Generate a blob of json that matches what would be submitted by the login
-  // javascript code.
-  DictionaryValue args;
-  args.SetString("user", "user@not_allowed.com");
-  args.SetString("pass", "password");
-  args.SetString("captcha", std::string());
-  args.SetString("otp", std::string());
-  args.SetString("accessCode", std::string());
-  std::string json;
-  base::JSONWriter::Write(&args, &json);
-  ListValue list_args;
-  list_args.Append(new StringValue(json));
-
-  // Mimic a login attempt from the UI.
-  handler_->HandleSubmitAuth(&list_args);
-
-  // Should result in the login page being displayed again.
-  ASSERT_EQ(1U, web_ui_.call_data().size());
-  const TestWebUI::CallData& data = web_ui_.call_data()[0];
-  EXPECT_EQ("SyncSetupOverlay.showSyncSetupPage", data.function_name);
-  std::string page;
-  ASSERT_TRUE(data.arg1->GetAsString(&page));
-  EXPECT_EQ(page, "login");
-
-  // Also make sure that the appropriate error message is being passed.
-  DictionaryValue* dictionary;
-  ASSERT_TRUE(data.arg2->GetAsDictionary(&dictionary));
-  std::string err = l10n_util::GetStringUTF8(IDS_SYNC_LOGIN_NAME_PROHIBITED);
-  CheckShowSyncSetupArgs(dictionary,
-                         err,
-                         false,
-                         GoogleServiceAuthError::NONE,
-                         std::string(),
-                         true,
-                         std::string());
-  handler_->CloseSyncSetup();
-  EXPECT_EQ(NULL,
-            LoginUIServiceFactory::GetForProfile(
-                profile_.get())->current_login_ui());
-}
-
 INSTANTIATE_TEST_CASE_P(SyncSetupHandlerTestWithParam,
                         SyncSetupHandlerTest,
                         Values(true, false));
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index d9ad58d..a228b9f 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -1735,6 +1735,8 @@
         'browser/signin/signin_global_error.h',
         'browser/signin/signin_internals_util.cc',
         'browser/signin/signin_internals_util.h',
+	    'browser/signin/signin_manager_base.cc',
+	    'browser/signin/signin_manager_base.h',
         'browser/signin/signin_manager.cc',
         'browser/signin/signin_manager.h',
         'browser/signin/signin_manager_cookie_helper.cc',
@@ -2434,6 +2436,7 @@
             'browser/policy/cloud/user_policy_signin_service.h',
             'browser/policy/cloud/user_policy_signin_service_factory.cc',
             'browser/policy/cloud/user_policy_signin_service_factory.h',
+            'browser/signin/signin_manager.cc',
             'browser/speech/tts_linux.cc',
             'browser/storage_monitor/mtab_watcher_linux.cc',
             'browser/storage_monitor/mtab_watcher_linux.h',
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index 9497196..9cac7ed 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -1780,6 +1780,7 @@
             'browser/printing/cloud_print/test/cloud_print_policy_browsertest.cc',
             'browser/printing/cloud_print/test/cloud_print_proxy_process_browsertest.cc',
             'browser/service/service_process_control_browsertest.cc',
+            'browser/signin/signin_browsertest.cc',
             # chromeos does not use cross-platform panels
             'browser/ui/panels/panel_extension_browsertest.cc',
           ],
diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index b48ebf7..442dee7 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi
@@ -1068,6 +1068,7 @@
         'browser/signin/profile_oauth2_token_service_unittest.cc',
         'browser/signin/signin_global_error_unittest.cc',
         'browser/signin/signin_manager_unittest.cc',
+        'browser/signin/signin_manager_base_unittest.cc',
         'browser/signin/signin_names_io_thread_unittest.cc',
         'browser/signin/signin_tracker_unittest.cc',
         'browser/signin/token_service_unittest.cc',
@@ -1953,7 +1954,9 @@
             'browser/policy/cloud/user_cloud_policy_store_unittest.cc',
             'browser/policy/cloud/user_policy_signin_service_unittest.cc',
             'browser/safe_browsing/download_protection_service_unittest.cc',
+            'browser/signin/signin_manager_unittest.cc',
             'browser/storage_monitor/storage_monitor_linux_unittest.cc',
+            'browser/ui/sync/one_click_signin_helper_unittest.cc',
           ],
           'sources': [
             'browser/ui/webui/feedback_ui_unittest.cc',
diff --git a/chrome/test/base/chrome_render_view_host_test_harness.cc b/chrome/test/base/chrome_render_view_host_test_harness.cc
index 8357213..d4fc77e 100644
--- a/chrome/test/base/chrome_render_view_host_test_harness.cc
+++ b/chrome/test/base/chrome_render_view_host_test_harness.cc
@@ -36,7 +36,11 @@ RenderViewHostTester* ChromeRenderViewHostTestHarness::rvh_tester() {
 }
 
 static ProfileKeyedService* BuildSigninManagerFake(Profile* profile) {
+#if defined (OS_CHROMEOS)
+  return new FakeSigninManagerBase(profile);
+#else
   return new FakeSigninManager(profile);
+#endif
 }
 
 void ChromeRenderViewHostTestHarness::SetUp() {