Split UserCloudPolicyManager implementation.

Create different implementations for desktop Chrome / CrOS, and change
initialization to keep the CrOS version in BrowserPolicyConnector
instead of the Profile.

BUG=chromium:108928
TEST=compiles and passes tests, cloud policy works as before.
TBR=phajdan.jr@chromium.org,ben@chromium.org

Review URL: https://codereview.chromium.org/11415094

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@170742 0039d316-1c4b-4281-b951-d872f2087c98

38 files changed, 890 insertions, 605 deletions

diff --git a/chrome/browser/chromeos/login/login_utils.cc b/chrome/browser/chromeos/login/login_utils.cc
index ae8d4da..635dc8f 100644
--- a/chrome/browser/chromeos/login/login_utils.cc
+++ b/chrome/browser/chromeos/login/login_utils.cc
@@ -53,7 +53,6 @@
 #include "chrome/browser/policy/cloud_policy_client.h"
 #include "chrome/browser/policy/cloud_policy_service.h"
 #include "chrome/browser/policy/network_configuration_updater.h"
-#include "chrome/browser/policy/user_cloud_policy_manager.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
@@ -500,18 +499,6 @@ void LoginUtilsImpl::PrepareProfile(
   ProfileManager::CreateDefaultProfileAsync(
       base::Bind(&LoginUtilsImpl::OnProfileCreated, AsWeakPtr()));
 
-  // The default profile is only partially initialized at this point.
-  // Setup the UserCloudPolicyManager so profile initialization can complete.
-  Profile* user_profile = ProfileManager::GetDefaultProfile();
-
-  // Initialize the new cloud policy framework, if enabled.
-  if (user_profile->GetUserCloudPolicyManager()) {
-    user_profile->GetUserCloudPolicyManager()->Initialize(
-        g_browser_process->local_state(),
-        connector->device_management_service(),
-        connector->GetUserAffiliation(username));
-  }
-
   if (wait_for_policy_fetch) {
     // Profile creation will block until user policy is fetched, which
     // requires the DeviceManagement token. Try to fetch it now.
diff --git a/chrome/browser/chromeos/login/policy_oauth_fetcher.cc b/chrome/browser/chromeos/login/policy_oauth_fetcher.cc
index bcd3118..b7b95b9 100644
--- a/chrome/browser/chromeos/login/policy_oauth_fetcher.cc
+++ b/chrome/browser/chromeos/login/policy_oauth_fetcher.cc
@@ -7,7 +7,7 @@
 #include "base/logging.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
-#include "chrome/browser/policy/user_cloud_policy_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_chromeos.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ -95,13 +95,13 @@ void PolicyOAuthFetcher::OnOAuthWrapBridgeFailure(
 
 void PolicyOAuthFetcher::SetPolicyToken(const std::string& token) {
   policy_token_ = token;
-  g_browser_process->browser_policy_connector()->RegisterForUserPolicy(token);
 
-  // The Profile object passed in to the constructor is destroyed after the
-  // login process is complete. Get the UserCloudPolicyManager from the user's
-  // default profile instead.
-  policy::UserCloudPolicyManager* cloud_policy_manager =
-      ProfileManager::GetDefaultProfile()->GetUserCloudPolicyManager();
+  policy::BrowserPolicyConnector* browser_policy_connector =
+      g_browser_process->browser_policy_connector();
+  browser_policy_connector->RegisterForUserPolicy(token);
+
+  policy::UserCloudPolicyManagerChromeOS* cloud_policy_manager =
+      browser_policy_connector->GetUserCloudPolicyManager();
   if (cloud_policy_manager) {
     if (token.empty())
       cloud_policy_manager->CancelWaitForPolicyFetch();
diff --git a/chrome/browser/policy/browser_policy_connector.cc b/chrome/browser/policy/browser_policy_connector.cc
index 2cb3c6f..9311afe 100644
--- a/chrome/browser/policy/browser_policy_connector.cc
+++ b/chrome/browser/policy/browser_policy_connector.cc
@@ -21,7 +21,6 @@
 #include "chrome/browser/policy/managed_mode_policy_provider.h"
 #include "chrome/browser/policy/policy_service_impl.h"
 #include "chrome/browser/policy/policy_statistics_collector.h"
-#include "chrome/browser/policy/user_cloud_policy_manager.h"
 #include "chrome/browser/policy/user_policy_cache.h"
 #include "chrome/browser/policy/user_policy_token_cache.h"
 #include "chrome/browser/profiles/profile.h"
@@ -62,7 +61,12 @@
 #include "chrome/browser/policy/device_local_account_policy_service.h"
 #include "chrome/browser/policy/device_policy_cache.h"
 #include "chrome/browser/policy/network_configuration_updater.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_chromeos.h"
+#include "chrome/browser/policy/user_cloud_policy_store_chromeos.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
+#else
+#include "chrome/browser/policy/user_cloud_policy_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
 #endif
 
 using content::BrowserThread;
@@ -162,7 +166,6 @@ void BrowserPolicyConnector::Shutdown() {
   // policy subsystems, which own the caches that |cloud_provider_| uses.
   if (cloud_provider_)
     cloud_provider_->Shutdown();
-  user_cloud_policy_provider_.Shutdown();
 
 #if defined(OS_CHROMEOS)
   // Shutdown device cloud policy.
@@ -178,6 +181,9 @@ void BrowserPolicyConnector::Shutdown() {
     device_cloud_policy_manager_->Shutdown();
   if (device_local_account_policy_service_)
     device_local_account_policy_service_->Shutdown();
+  if (user_cloud_policy_manager_)
+    user_cloud_policy_manager_->Shutdown();
+  global_user_cloud_policy_provider_.Shutdown();
 #endif
 
   // Shutdown user cloud policy.
@@ -190,59 +196,22 @@ void BrowserPolicyConnector::Shutdown() {
   device_management_service_.reset();
 }
 
-scoped_ptr<UserCloudPolicyManager>
-    BrowserPolicyConnector::CreateCloudPolicyManager(
-        Profile* profile,
-        bool force_immediate_policy_load) {
-  scoped_ptr<UserCloudPolicyManager> manager;
-  const CommandLine* command_line = CommandLine::ForCurrentProcess();
-  if (command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
-    UserCloudPolicyManager::PolicyInit policy_init =
-        UserCloudPolicyManager::POLICY_INIT_IN_BACKGROUND;
-#if defined(OS_CHROMEOS)
-    // TODO(mnissler): Revisit once Chrome OS gains multi-profiles support.
-    // Don't wait for a policy fetch if there's no logged in user.
-    if (chromeos::UserManager::Get()->IsUserLoggedIn()) {
-      std::string email =
-          chromeos::UserManager::Get()->GetLoggedInUser()->email();
-      if (GetUserAffiliation(email) == USER_AFFILIATION_MANAGED)
-        policy_init = UserCloudPolicyManager::POLICY_INIT_REFRESH_FROM_SERVER;
-    }
-#else
-    // On desktop, there's no way to figure out if a user is logged in yet
-    // because prefs are not yet initialized, and further there's no way to know
-    // if the user is managed. So this code does not request a policy refresh
-    // from the server because that would inhibit startup for non-signed-in
-    // users. This code relies on the fact that a signed-in profile should
-    // already have policy downloaded. If no policy is available
-    // (due to a previous fetch failing), the normal policy refresh mechanism
-    // will cause it to get downloaded eventually.
-    if (force_immediate_policy_load) {
-      // On desktop, profile creation on startup requires that policies get
-      // loaded immediately (the normal asynchronous policy initialization
-      // does not happen because services are initialized before the
-      // MessageLoop runs). So load policy immediately if desired.
-      policy_init = UserCloudPolicyManager::POLICY_INIT_IMMEDIATELY;
-    }
-#endif
-    manager = UserCloudPolicyManager::Create(profile, policy_init);
-  }
-  return manager.Pass();
-}
-
 scoped_ptr<PolicyService> BrowserPolicyConnector::CreatePolicyService(
     Profile* profile) {
   DCHECK(profile);
+  ConfigurationPolicyProvider* user_cloud_policy_provider = NULL;
+#if !defined(OS_CHROMEOS)
+  user_cloud_policy_provider =
+      UserCloudPolicyManagerFactory::GetForProfile(profile);
+#endif
   return CreatePolicyServiceWithProviders(
-      profile->GetUserCloudPolicyManager(),
+      user_cloud_policy_provider,
       profile->GetManagedModePolicyProvider());
 }
 
 PolicyService* BrowserPolicyConnector::GetPolicyService() {
-  if (!policy_service_) {
-    policy_service_ =
-        CreatePolicyServiceWithProviders(&user_cloud_policy_provider_, NULL);
-  }
+  if (!policy_service_)
+    policy_service_ = CreatePolicyServiceWithProviders(NULL, NULL);
   return policy_service_.get();
 }
 
@@ -353,6 +322,12 @@ void BrowserPolicyConnector::InitializeUserPolicy(
   // and before user policy is loaded.
   GetNetworkConfigurationUpdater()->set_allow_web_trust(
       GetUserAffiliation(user_name) == USER_AFFILIATION_MANAGED);
+
+  if (user_cloud_policy_manager_.get()) {
+    global_user_cloud_policy_provider_.SetDelegate(NULL);
+    user_cloud_policy_manager_->Shutdown();
+    user_cloud_policy_manager_.reset();
+  }
 #endif
 
   // Throw away the old backend.
@@ -367,16 +342,33 @@ void BrowserPolicyConnector::InitializeUserPolicy(
   int64 startup_delay =
       wait_for_policy_fetch ? 0 : kServiceInitializationStartupDelay;
 
-  if (!command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
-    FilePath profile_dir;
-    PathService::Get(chrome::DIR_USER_DATA, &profile_dir);
+  FilePath profile_dir;
+  PathService::Get(chrome::DIR_USER_DATA, &profile_dir);
 #if defined(OS_CHROMEOS)
-    profile_dir = profile_dir.Append(
-        command_line->GetSwitchValuePath(switches::kLoginProfile));
+  profile_dir = profile_dir.Append(
+      command_line->GetSwitchValuePath(switches::kLoginProfile));
 #endif
-    const FilePath policy_dir = profile_dir.Append(kPolicyDir);
-    const FilePath policy_cache_file = policy_dir.Append(kPolicyCacheFile);
-    const FilePath token_cache_file = policy_dir.Append(kTokenCacheFile);
+  const FilePath policy_dir = profile_dir.Append(kPolicyDir);
+  const FilePath policy_cache_file = policy_dir.Append(kPolicyCacheFile);
+  const FilePath token_cache_file = policy_dir.Append(kTokenCacheFile);
+
+  if (command_line->HasSwitch(switches::kEnableCloudPolicyService)) {
+#if defined(OS_CHROMEOS)
+    scoped_ptr<CloudPolicyStore> store(
+        new UserCloudPolicyStoreChromeOS(
+            chromeos::DBusThreadManager::Get()->GetSessionManagerClient(),
+            policy_cache_file, token_cache_file));
+    user_cloud_policy_manager_.reset(
+        new UserCloudPolicyManagerChromeOS(store.Pass(),
+                                           wait_for_policy_fetch));
+    user_cloud_policy_manager_->Init();
+    user_cloud_policy_manager_->Initialize(g_browser_process->local_state(),
+                                           device_management_service_.get(),
+                                           GetUserAffiliation(user_name));
+    global_user_cloud_policy_provider_.SetDelegate(
+        user_cloud_policy_manager_.get());
+#endif
+  } else {
     CloudPolicyCacheBase* user_policy_cache = NULL;
 
     user_data_store_.reset(CloudPolicyDataStore::CreateForUserPolicies());
@@ -572,9 +564,9 @@ void BrowserPolicyConnector::CompleteInitialization() {
     platform_provider_->Init();
   if (cloud_provider_)
     cloud_provider_->Init();
-  user_cloud_policy_provider_.Init();
 
 #if defined(OS_CHROMEOS)
+  global_user_cloud_policy_provider_.Init();
 
   // Create the AppPackUpdater to start updating the cache. It requires the
   // system request context, which isn't available in Init(); therefore it is
@@ -667,6 +659,8 @@ scoped_ptr<PolicyService>
 #if defined(OS_CHROMEOS)
     if (device_cloud_policy_manager_.get())
       providers.push_back(device_cloud_policy_manager_.get());
+    if (!user_cloud_policy_provider)
+    user_cloud_policy_provider = &global_user_cloud_policy_provider_;
 #endif
 
     if (user_cloud_policy_provider)
diff --git a/chrome/browser/policy/browser_policy_connector.h b/chrome/browser/policy/browser_policy_connector.h
index df350fc..b11ae71 100644
--- a/chrome/browser/policy/browser_policy_connector.h
+++ b/chrome/browser/policy/browser_policy_connector.h
@@ -33,7 +33,7 @@ class DeviceManagementService;
 class NetworkConfigurationUpdater;
 class PolicyService;
 class PolicyStatisticsCollector;
-class UserCloudPolicyManager;
+class UserCloudPolicyManagerChromeOS;
 class UserPolicyTokenCache;
 
 // Manages the lifecycle of browser-global policy infrastructure, such as the
@@ -63,16 +63,6 @@ class BrowserPolicyConnector : public content::NotificationObserver {
   // Returns true if Init() has been called but Shutdown() hasn't been yet.
   bool is_initialized() const { return is_initialized_; }
 
-  // Creates a UserCloudPolicyManager for the given profile, or returns NULL if
-  // it is not supported on this platform. If |force_immediate_policy_load| is
-  // true, then any underlying policy files will be loaded before this routine
-  // returns - this is used when the caller (such as
-  // CreateProfile(CREATE_MODE_SYNCHRONOUS)) needs to access the policy values
-  // immediately without waiting for tasks to complete.
-  scoped_ptr<UserCloudPolicyManager> CreateCloudPolicyManager(
-      Profile* profile,
-      bool force_immediate_policy_load);
-
   // Creates a new policy service for the given profile.
   scoped_ptr<PolicyService> CreatePolicyService(Profile* profile);
 
@@ -175,6 +165,9 @@ class BrowserPolicyConnector : public content::NotificationObserver {
   DeviceCloudPolicyManagerChromeOS* GetDeviceCloudPolicyManager() {
     return device_cloud_policy_manager_.get();
   }
+  UserCloudPolicyManagerChromeOS* GetUserCloudPolicyManager() {
+    return user_cloud_policy_manager_.get();
+  }
 #endif
 
   // Sets a |provider| that will be included in PolicyServices returned by
@@ -235,8 +228,14 @@ class BrowserPolicyConnector : public content::NotificationObserver {
   scoped_ptr<DeviceCloudPolicyManagerChromeOS> device_cloud_policy_manager_;
   scoped_ptr<DeviceLocalAccountPolicyService>
       device_local_account_policy_service_;
+  scoped_ptr<UserCloudPolicyManagerChromeOS> user_cloud_policy_manager_;
+
+  // This policy provider is used on Chrome OS to feed user policy into the
+  // global PolicyService instance. This works by installing
+  // |user_cloud_policy_manager_| as the delegate once the former is
+  // initialized.
+  ProxyPolicyProvider global_user_cloud_policy_provider_;
 #endif
-  ProxyPolicyProvider user_cloud_policy_provider_;
 
   // Must be deleted before all the policy providers.
   scoped_ptr<PolicyService> policy_service_;
diff --git a/chrome/browser/policy/cloud_policy_browsertest.cc b/chrome/browser/policy/cloud_policy_browsertest.cc
index 38629ad..f0fa0f9 100644
--- a/chrome/browser/policy/cloud_policy_browsertest.cc
+++ b/chrome/browser/policy/cloud_policy_browsertest.cc
@@ -19,7 +19,6 @@
 #include "chrome/browser/policy/policy_service.h"
 #include "chrome/browser/policy/proto/chrome_settings.pb.h"
 #include "chrome/browser/policy/proto/cloud_policy.pb.h"
-#include "chrome/browser/policy/user_cloud_policy_manager.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/common/chrome_notification_types.h"
@@ -37,7 +36,10 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_chromeos.h"
 #else
+#include "chrome/browser/policy/user_cloud_policy_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
 #include "chrome/browser/signin/signin_manager.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #endif
@@ -125,25 +127,29 @@ void SetUpNewStackBeforeCreatingBrowser() {
 }
 
 void SetUpNewStackAfterCreatingBrowser(Browser* browser) {
-#if !defined(OS_CHROMEOS)
+  BrowserPolicyConnector* connector =
+      g_browser_process->browser_policy_connector();
+  connector->ScheduleServiceInitialization(0);
+
+#if defined(OS_CHROMEOS)
+  connector->InitializeUserPolicy(GetTestUser(), true);
+  UserCloudPolicyManagerChromeOS* policy_manager =
+      connector->GetUserCloudPolicyManager();
+  ASSERT_TRUE(policy_manager);
+#else
   // Mock a signed-in user. This is used by the UserCloudPolicyStore to pass the
   // username to the UserCloudPolicyValidator.
   SigninManager* signin_manager =
       SigninManagerFactory::GetForProfile(browser->profile());
   ASSERT_TRUE(signin_manager);
   signin_manager->SetAuthenticatedUsername(GetTestUser());
-#endif
-
-  BrowserPolicyConnector* connector =
-      g_browser_process->browser_policy_connector();
-  connector->ScheduleServiceInitialization(0);
 
   UserCloudPolicyManager* policy_manager =
-      browser->profile()->GetUserCloudPolicyManager();
+      UserCloudPolicyManagerFactory::GetForProfile(browser->profile());
   ASSERT_TRUE(policy_manager);
   policy_manager->Initialize(g_browser_process->local_state(),
-                             connector->device_management_service(),
-                             policy::USER_AFFILIATION_MANAGED);
+                             connector->device_management_service());
+#endif  // defined(OS_CHROMEOS)
 
   ASSERT_TRUE(policy_manager->cloud_policy_client());
   base::RunLoop run_loop;
diff --git a/chrome/browser/policy/cloud_policy_manager.cc b/chrome/browser/policy/cloud_policy_manager.cc
index e0a7186..a80fe69 100644
--- a/chrome/browser/policy/cloud_policy_manager.cc
+++ b/chrome/browser/policy/cloud_policy_manager.cc
@@ -14,8 +14,8 @@
 
 namespace policy {
 
-CloudPolicyManager::CloudPolicyManager(scoped_ptr<CloudPolicyStore> store)
-    : store_(store.Pass()),
+CloudPolicyManager::CloudPolicyManager(CloudPolicyStore* store)
+    : store_(store),
       waiting_for_policy_refresh_(false) {
   store_->AddObserver(this);
 
@@ -27,12 +27,16 @@ CloudPolicyManager::CloudPolicyManager(scoped_ptr<CloudPolicyStore> store)
     store_->Load();
 }
 
-CloudPolicyManager::~CloudPolicyManager() {}
+CloudPolicyManager::~CloudPolicyManager() {
+  DCHECK(!store_) << "Shutdown() must be called before destruction!";
+}
 
 void CloudPolicyManager::Shutdown() {
   ShutdownService();
-  store_->RemoveObserver(this);
+  if (store_)
+    store_->RemoveObserver(this);
   ConfigurationPolicyProvider::Shutdown();
+  store_ = NULL;
 }
 
 bool CloudPolicyManager::IsInitializationComplete() const {
@@ -51,12 +55,12 @@ void CloudPolicyManager::RefreshPolicies() {
 }
 
 void CloudPolicyManager::OnStoreLoaded(CloudPolicyStore* store) {
-  DCHECK_EQ(store_.get(), store);
+  DCHECK_EQ(store_, store);
   CheckAndPublishPolicy();
 }
 
 void CloudPolicyManager::OnStoreError(CloudPolicyStore* store) {
-  DCHECK_EQ(store_.get(), store);
+  DCHECK_EQ(store_, store);
   // No action required, the old policy is still valid.
 }
 
@@ -65,7 +69,7 @@ void CloudPolicyManager::InitializeService(
   CHECK(!client_.get());
   CHECK(client.get());
   client_ = client.Pass();
-  service_.reset(new CloudPolicyService(client_.get(), store_.get()));
+  service_.reset(new CloudPolicyService(client_.get(), store_));
 }
 
 void CloudPolicyManager::ShutdownService() {
@@ -80,7 +84,7 @@ void CloudPolicyManager::StartRefreshScheduler(
   if (!refresh_scheduler_.get()) {
     refresh_scheduler_.reset(
         new CloudPolicyRefreshScheduler(
-            client_.get(), store_.get(), local_state, refresh_rate_pref,
+            client_.get(), store_, local_state, refresh_rate_pref,
             MessageLoop::current()->message_loop_proxy()));
   }
 }
diff --git a/chrome/browser/policy/cloud_policy_manager.h b/chrome/browser/policy/cloud_policy_manager.h
index 82b73c6..aa53d5a 100644
--- a/chrome/browser/policy/cloud_policy_manager.h
+++ b/chrome/browser/policy/cloud_policy_manager.h
@@ -22,9 +22,9 @@ class CloudPolicyRefreshScheduler;
 class CloudPolicyService;
 
 // CloudPolicyManager is the main switching central between cloud policy and the
-// upper layers of the policy stack. It owns CloudPolicyStore,
-// CloudPolicyClient, and CloudPolicyService, is responsible for receiving and
-// keeping policy from the cloud and exposes the decoded policy via the
+// upper layers of the policy stack. It owns CloudPolicyClient and
+// CloudPolicyService, is responsible for receiving and keeping policy from the
+// cloud and exposes the decoded policy from a CloudPolicyStore via the
 // ConfigurationPolicyProvider interface.
 //
 // This class contains the base functionality, there are subclasses that add
@@ -33,14 +33,14 @@ class CloudPolicyService;
 class CloudPolicyManager : public ConfigurationPolicyProvider,
                            public CloudPolicyStore::Observer {
  public:
-  explicit CloudPolicyManager(scoped_ptr<CloudPolicyStore> store);
+  explicit CloudPolicyManager(CloudPolicyStore* store);
   virtual ~CloudPolicyManager();
 
   CloudPolicyClient* cloud_policy_client() { return client_.get(); }
   const CloudPolicyClient* cloud_policy_client() const { return client_.get(); }
 
-  CloudPolicyStore* cloud_policy_store() { return store_.get(); }
-  const CloudPolicyStore* cloud_policy_store() const { return store_.get(); }
+  CloudPolicyStore* cloud_policy_store() { return store_; }
+  const CloudPolicyStore* cloud_policy_store() const { return store_; }
 
   CloudPolicyService* cloud_policy_service() { return service_.get(); }
   const CloudPolicyService* cloud_policy_service() const {
@@ -76,7 +76,7 @@ class CloudPolicyManager : public ConfigurationPolicyProvider,
   // Completion handler for policy refresh operations.
   void OnRefreshComplete();
 
-  scoped_ptr<CloudPolicyStore> store_;
+  CloudPolicyStore* store_;
   scoped_ptr<CloudPolicyClient> client_;
   scoped_ptr<CloudPolicyService> service_;
   scoped_ptr<CloudPolicyRefreshScheduler> refresh_scheduler_;
diff --git a/chrome/browser/policy/cloud_policy_manager_unittest.cc b/chrome/browser/policy/cloud_policy_manager_unittest.cc
index b833721..92c1b2f 100644
--- a/chrome/browser/policy/cloud_policy_manager_unittest.cc
+++ b/chrome/browser/policy/cloud_policy_manager_unittest.cc
@@ -53,7 +53,7 @@ class TestHarness : public PolicyProviderTestHarness {
   static PolicyProviderTestHarness* CreateRecommended();
 
  private:
-  MockCloudPolicyStore* store_;
+  MockCloudPolicyStore store_;
 
   DISALLOW_COPY_AND_ASSIGN(TestHarness);
 };
@@ -68,11 +68,9 @@ void TestHarness::SetUp() {}
 ConfigurationPolicyProvider* TestHarness::CreateProvider(
     const PolicyDefinitionList* policy_definition_list) {
   // Create and initialize the store.
-  store_ = new MockCloudPolicyStore();
-  store_->NotifyStoreLoaded();
-  ConfigurationPolicyProvider* provider =
-      new CloudPolicyManager(scoped_ptr<CloudPolicyStore>(store_));
-  Mock::VerifyAndClearExpectations(store_);
+  store_.NotifyStoreLoaded();
+  ConfigurationPolicyProvider* provider = new CloudPolicyManager(&store_);
+  Mock::VerifyAndClearExpectations(&store_);
   return provider;
 }
 
@@ -80,33 +78,33 @@ void TestHarness::InstallEmptyPolicy() {}
 
 void TestHarness::InstallStringPolicy(const std::string& policy_name,
                                       const std::string& policy_value) {
-  store_->policy_map_.Set(policy_name, policy_level(), policy_scope(),
-                          base::Value::CreateStringValue(policy_value));
+  store_.policy_map_.Set(policy_name, policy_level(), policy_scope(),
+                         base::Value::CreateStringValue(policy_value));
 }
 
 void TestHarness::InstallIntegerPolicy(const std::string& policy_name,
                                        int policy_value) {
-  store_->policy_map_.Set(policy_name, policy_level(), policy_scope(),
-                          base::Value::CreateIntegerValue(policy_value));
+  store_.policy_map_.Set(policy_name, policy_level(), policy_scope(),
+                         base::Value::CreateIntegerValue(policy_value));
 }
 
 void TestHarness::InstallBooleanPolicy(const std::string& policy_name,
                                        bool policy_value) {
-  store_->policy_map_.Set(policy_name, policy_level(), policy_scope(),
-                          base::Value::CreateBooleanValue(policy_value));
+  store_.policy_map_.Set(policy_name, policy_level(), policy_scope(),
+                         base::Value::CreateBooleanValue(policy_value));
 }
 
 void TestHarness::InstallStringListPolicy(const std::string& policy_name,
                                           const base::ListValue* policy_value) {
-  store_->policy_map_.Set(policy_name, policy_level(), policy_scope(),
-                          policy_value->DeepCopy());
+  store_.policy_map_.Set(policy_name, policy_level(), policy_scope(),
+                         policy_value->DeepCopy());
 }
 
 void TestHarness::InstallDictionaryPolicy(
     const std::string& policy_name,
     const base::DictionaryValue* policy_value) {
-  store_->policy_map_.Set(policy_name, policy_level(), policy_scope(),
-                          policy_value->DeepCopy());
+  store_.policy_map_.Set(policy_name, policy_level(), policy_scope(),
+                         policy_value->DeepCopy());
 }
 
 // static
@@ -128,8 +126,8 @@ INSTANTIATE_TEST_CASE_P(
 
 class TestCloudPolicyManager : public CloudPolicyManager {
  public:
-  explicit TestCloudPolicyManager(scoped_ptr<CloudPolicyStore> store)
-      : CloudPolicyManager(store.Pass()) {}
+  explicit TestCloudPolicyManager(CloudPolicyStore* store)
+      : CloudPolicyManager(store) {}
   virtual ~TestCloudPolicyManager() {}
 
   // Publish the protected members for testing.
@@ -161,12 +159,10 @@ class CloudPolicyManagerTest : public testing::Test {
         "http://www.example.com");
     policy_.Build();
 
-    store_ = new MockCloudPolicyStore();
-    EXPECT_CALL(*store_, Load());
-    manager_.reset(
-        new TestCloudPolicyManager(scoped_ptr<CloudPolicyStore>(store_)));
+    EXPECT_CALL(store_, Load());
+    manager_.reset(new TestCloudPolicyManager(&store_));
     manager_->Init();
-    Mock::VerifyAndClearExpectations(store_);
+    Mock::VerifyAndClearExpectations(&store_);
     manager_->AddObserver(&observer_);
   }
 
@@ -185,7 +181,7 @@ class CloudPolicyManagerTest : public testing::Test {
 
   // Policy infrastructure.
   MockConfigurationPolicyObserver observer_;
-  MockCloudPolicyStore* store_;
+  MockCloudPolicyStore store_;
   scoped_ptr<TestCloudPolicyManager> manager_;
 
  private:
@@ -201,10 +197,10 @@ TEST_F(CloudPolicyManagerTest, InitAndShutdown) {
   manager_->CheckAndPublishPolicy();
   Mock::VerifyAndClearExpectations(&observer_);
 
-  store_->policy_map_.CopyFrom(policy_map_);
-  store_->policy_.reset(new em::PolicyData(policy_.policy_data()));
+  store_.policy_map_.CopyFrom(policy_map_);
+  store_.policy_.reset(new em::PolicyData(policy_.policy_data()));
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
   EXPECT_TRUE(expected_bundle_.Equals(manager_->policies()));
   EXPECT_TRUE(manager_->IsInitializationComplete());
@@ -227,7 +223,7 @@ TEST_F(CloudPolicyManagerTest, InitAndShutdown) {
 
 TEST_F(CloudPolicyManagerTest, RegistrationAndFetch) {
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
   EXPECT_TRUE(manager_->IsInitializationComplete());
 
@@ -238,28 +234,28 @@ TEST_F(CloudPolicyManagerTest, RegistrationAndFetch) {
   client->NotifyRegistrationStateChanged();
 
   client->SetPolicy(policy_.policy());
-  EXPECT_CALL(*store_, Store(ProtoMatches(policy_.policy())));
+  EXPECT_CALL(store_, Store(ProtoMatches(policy_.policy())));
   client->NotifyPolicyFetched();
-  Mock::VerifyAndClearExpectations(store_);
+  Mock::VerifyAndClearExpectations(&store_);
 
-  store_->policy_map_.CopyFrom(policy_map_);
+  store_.policy_map_.CopyFrom(policy_map_);
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
   EXPECT_TRUE(expected_bundle_.Equals(manager_->policies()));
 }
 
 TEST_F(CloudPolicyManagerTest, Update) {
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
   EXPECT_TRUE(manager_->IsInitializationComplete());
   PolicyBundle empty_bundle;
   EXPECT_TRUE(empty_bundle.Equals(manager_->policies()));
 
-  store_->policy_map_.CopyFrom(policy_map_);
+  store_.policy_map_.CopyFrom(policy_map_);
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
   EXPECT_TRUE(expected_bundle_.Equals(manager_->policies()));
   EXPECT_TRUE(manager_->IsInitializationComplete());
@@ -270,7 +266,7 @@ TEST_F(CloudPolicyManagerTest, RefreshNotRegistered) {
   manager_->InitializeService(scoped_ptr<CloudPolicyClient>(client));
 
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
 
   // A refresh on a non-registered store should not block.
@@ -284,10 +280,10 @@ TEST_F(CloudPolicyManagerTest, RefreshSuccessful) {
   manager_->InitializeService(scoped_ptr<CloudPolicyClient>(client));
 
   // Simulate a store load.
-  store_->policy_.reset(new em::PolicyData(policy_.policy_data()));
+  store_.policy_.reset(new em::PolicyData(policy_.policy_data()));
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
   EXPECT_CALL(*client, SetupRegistration(_, _));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(client);
   Mock::VerifyAndClearExpectations(&observer_);
 
@@ -300,24 +296,24 @@ TEST_F(CloudPolicyManagerTest, RefreshSuccessful) {
   manager_->RefreshPolicies();
   Mock::VerifyAndClearExpectations(client);
   Mock::VerifyAndClearExpectations(&observer_);
-  store_->policy_map_.CopyFrom(policy_map_);
+  store_.policy_map_.CopyFrom(policy_map_);
 
   // A stray reload should be suppressed until the refresh completes.
   EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   Mock::VerifyAndClearExpectations(&observer_);
 
   // Respond to the policy fetch, which should trigger a write to |store_|.
   EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
-  EXPECT_CALL(*store_, Store(_));
+  EXPECT_CALL(store_, Store(_));
   client->SetPolicy(policy_.policy());
   client->NotifyPolicyFetched();
   Mock::VerifyAndClearExpectations(&observer_);
-  Mock::VerifyAndClearExpectations(store_);
+  Mock::VerifyAndClearExpectations(&store_);
 
   // The load notification from |store_| should trigger the policy update.
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
+  store_.NotifyStoreLoaded();
   EXPECT_TRUE(expected_bundle_.Equals(manager_->policies()));
   Mock::VerifyAndClearExpectations(&observer_);
 }
diff --git a/chrome/browser/policy/cloud_policy_store.cc b/chrome/browser/policy/cloud_policy_store.cc
index 44de655..88ea9c4 100644
--- a/chrome/browser/policy/cloud_policy_store.cc
+++ b/chrome/browser/policy/cloud_policy_store.cc
@@ -15,13 +15,6 @@ CloudPolicyStore::CloudPolicyStore()
 
 CloudPolicyStore::~CloudPolicyStore() {}
 
-void CloudPolicyStore::Clear() {
-  RemoveStoredPolicy();
-  policy_.reset();
-  policy_map_.Clear();
-  NotifyStoreLoaded();
-}
-
 void CloudPolicyStore::AddObserver(CloudPolicyStore::Observer* observer) {
   observers_.AddObserver(observer);
 }
diff --git a/chrome/browser/policy/cloud_policy_store.h b/chrome/browser/policy/cloud_policy_store.h
index 2ead103..e767df0 100644
--- a/chrome/browser/policy/cloud_policy_store.h
+++ b/chrome/browser/policy/cloud_policy_store.h
@@ -12,8 +12,6 @@
 #include "chrome/browser/policy/policy_map.h"
 #include "chrome/browser/policy/proto/device_management_backend.pb.h"
 
-class Profile;
-
 namespace policy {
 
 // Defines the low-level interface used by the cloud policy code to:
@@ -89,32 +87,17 @@ class CloudPolicyStore {
   // Otherwise, OnStoreError() reports the reason for failure.
   virtual void Load() = 0;
 
-  // Deletes any existing policy blob and notifies observers via OnStoreLoaded()
-  // that the blob has changed. Virtual for mocks.
-  virtual void Clear();
-
   // Registers an observer to be notified when policy changes.
   void AddObserver(Observer* observer);
 
   // Removes the specified observer.
   void RemoveObserver(Observer* observer);
 
-  // Factory method to create a CloudPolicyStore appropriate for the current
-  // platform, for storing user policy for the user associated with the passed
-  // |profile|. Implementation is defined in the individual platform store
-  // files.
-  static scoped_ptr<CloudPolicyStore> CreateUserPolicyStore(
-      Profile* profile,
-      bool force_immediate_policy_load);
-
  protected:
   // Invokes the corresponding callback on all registered observers.
   void NotifyStoreLoaded();
   void NotifyStoreError();
 
-  // Invoked by Clear() to remove stored policy.
-  virtual void RemoveStoredPolicy() = 0;
-
   // Decoded version of the currently effective policy.
   PolicyMap policy_map_;
 
diff --git a/chrome/browser/policy/device_cloud_policy_manager_chromeos.cc b/chrome/browser/policy/device_cloud_policy_manager_chromeos.cc
index c90d509..81af6aa 100644
--- a/chrome/browser/policy/device_cloud_policy_manager_chromeos.cc
+++ b/chrome/browser/policy/device_cloud_policy_manager_chromeos.cc
@@ -49,8 +49,8 @@ const char* kMachineInfoSerialNumberKeys[] = {
 DeviceCloudPolicyManagerChromeOS::DeviceCloudPolicyManagerChromeOS(
     scoped_ptr<DeviceCloudPolicyStoreChromeOS> store,
     EnterpriseInstallAttributes* install_attributes)
-    : CloudPolicyManager(make_scoped_ptr<CloudPolicyStore>(store.get())),
-      device_store_(store.release()),  // Hack: retain |store| till here.
+    : CloudPolicyManager(store.get()),
+      device_store_(store.Pass()),
       install_attributes_(install_attributes),
       device_management_service_(NULL),
       local_state_(NULL) {}
@@ -79,7 +79,7 @@ void DeviceCloudPolicyManagerChromeOS::StartEnrollment(
 
   enrollment_handler_.reset(
       new EnrollmentHandlerChromeOS(
-          device_store_, install_attributes_, CreateClient(), auth_token,
+          device_store_.get(), install_attributes_, CreateClient(), auth_token,
           allowed_device_modes,
           base::Bind(&DeviceCloudPolicyManagerChromeOS::EnrollmentCompleted,
                      base::Unretained(this), callback)));
diff --git a/chrome/browser/policy/device_cloud_policy_manager_chromeos.h b/chrome/browser/policy/device_cloud_policy_manager_chromeos.h
index 630e06c..e2ee44a 100644
--- a/chrome/browser/policy/device_cloud_policy_manager_chromeos.h
+++ b/chrome/browser/policy/device_cloud_policy_manager_chromeos.h
@@ -76,7 +76,7 @@ class DeviceCloudPolicyManagerChromeOS : public CloudPolicyManager {
 
   // Points to the same object as the base CloudPolicyManager::store(), but with
   // actual device policy specific type.
-  DeviceCloudPolicyStoreChromeOS* device_store_;
+  scoped_ptr<DeviceCloudPolicyStoreChromeOS> device_store_;
   EnterpriseInstallAttributes* install_attributes_;
 
   DeviceManagementService* device_management_service_;
diff --git a/chrome/browser/policy/device_cloud_policy_store_chromeos.cc b/chrome/browser/policy/device_cloud_policy_store_chromeos.cc
index e52a441..8309258 100644
--- a/chrome/browser/policy/device_cloud_policy_store_chromeos.cc
+++ b/chrome/browser/policy/device_cloud_policy_store_chromeos.cc
@@ -55,11 +55,6 @@ void DeviceCloudPolicyStoreChromeOS::Load() {
   device_settings_service_->Load();
 }
 
-void DeviceCloudPolicyStoreChromeOS::RemoveStoredPolicy() {
-  // Device policy cannot and should not be removed on Chrome OS.
-  NOTREACHED();
-}
-
 void DeviceCloudPolicyStoreChromeOS::InstallInitialPolicy(
     const em::PolicyFetchResponse& policy) {
   // Cancel all pending requests.
diff --git a/chrome/browser/policy/device_cloud_policy_store_chromeos.h b/chrome/browser/policy/device_cloud_policy_store_chromeos.h
index fbc06d7..1b9f343 100644
--- a/chrome/browser/policy/device_cloud_policy_store_chromeos.h
+++ b/chrome/browser/policy/device_cloud_policy_store_chromeos.h
@@ -36,7 +36,6 @@ class DeviceCloudPolicyStoreChromeOS
   virtual void Store(
       const enterprise_management::PolicyFetchResponse& policy) OVERRIDE;
   virtual void Load() OVERRIDE;
-  virtual void RemoveStoredPolicy() OVERRIDE;
 
   // Installs initial policy. This is different from Store() in that it skips
   // the signature validation step against already-installed policy. The checks
diff --git a/chrome/browser/policy/mock_cloud_policy_store.h b/chrome/browser/policy/mock_cloud_policy_store.h
index 2749f0b..5298c06 100644
--- a/chrome/browser/policy/mock_cloud_policy_store.h
+++ b/chrome/browser/policy/mock_cloud_policy_store.h
@@ -17,8 +17,6 @@ class MockCloudPolicyStore : public CloudPolicyStore {
 
   MOCK_METHOD1(Store, void(const enterprise_management::PolicyFetchResponse&));
   MOCK_METHOD0(Load, void(void));
-  MOCK_METHOD0(Clear, void(void));
-  MOCK_METHOD0(RemoveStoredPolicy, void(void));
 
   // Publish the protected members.
   using CloudPolicyStore::NotifyStoreLoaded;
diff --git a/chrome/browser/policy/mock_user_cloud_policy_store.cc b/chrome/browser/policy/mock_user_cloud_policy_store.cc
new file mode 100644
index 0000000..e4cdcc2
--- /dev/null
+++ b/chrome/browser/policy/mock_user_cloud_policy_store.cc
@@ -0,0 +1,14 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/mock_user_cloud_policy_store.h"
+
+namespace policy {
+
+MockUserCloudPolicyStore::MockUserCloudPolicyStore()
+    : UserCloudPolicyStore(NULL, FilePath()) {}
+
+MockUserCloudPolicyStore::~MockUserCloudPolicyStore() {}
+
+}  // namespace policy
diff --git a/chrome/browser/policy/mock_user_cloud_policy_store.h b/chrome/browser/policy/mock_user_cloud_policy_store.h
new file mode 100644
index 0000000..46de01f
--- /dev/null
+++ b/chrome/browser/policy/mock_user_cloud_policy_store.h
@@ -0,0 +1,37 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_MOCK_USER_CLOUD_POLICY_STORE_H_
+#define CHROME_BROWSER_POLICY_MOCK_USER_CLOUD_POLICY_STORE_H_
+
+#include "chrome/browser/policy/user_cloud_policy_store.h"
+#include "testing/gmock/include/gmock/gmock.h"
+
+namespace policy {
+
+class MockUserCloudPolicyStore : public UserCloudPolicyStore {
+ public:
+  MockUserCloudPolicyStore();
+  virtual ~MockUserCloudPolicyStore();
+
+  MOCK_METHOD1(Store, void(const enterprise_management::PolicyFetchResponse&));
+  MOCK_METHOD0(Load, void(void));
+  MOCK_METHOD0(LoadImmediately, void(void));
+  MOCK_METHOD0(Clear, void(void));
+
+  // Publish the protected members.
+  using CloudPolicyStore::NotifyStoreLoaded;
+  using CloudPolicyStore::NotifyStoreError;
+
+  using CloudPolicyStore::policy_map_;
+  using CloudPolicyStore::policy_;
+  using CloudPolicyStore::status_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MockUserCloudPolicyStore);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_MOCK_USER_CLOUD_POLICY_STORE_H_
diff --git a/chrome/browser/policy/user_cloud_policy_manager.cc b/chrome/browser/policy/user_cloud_policy_manager.cc
index e1804ad..e571ad8 100644
--- a/chrome/browser/policy/user_cloud_policy_manager.cc
+++ b/chrome/browser/policy/user_cloud_policy_manager.cc
@@ -8,75 +8,39 @@
 #include "base/bind_helpers.h"
 #include "chrome/browser/policy/cloud_policy_service.h"
 #include "chrome/browser/policy/policy_types.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
+#include "chrome/browser/policy/user_cloud_policy_store.h"
 #include "chrome/common/pref_names.h"
 
 namespace policy {
 
 UserCloudPolicyManager::UserCloudPolicyManager(
-    scoped_ptr<CloudPolicyStore> store,
-    bool wait_for_policy_fetch)
-    : CloudPolicyManager(store.Pass()),
-      wait_for_policy_fetch_(wait_for_policy_fetch) {}
-
-UserCloudPolicyManager::~UserCloudPolicyManager() {}
-
-// static
-scoped_ptr<UserCloudPolicyManager> UserCloudPolicyManager::Create(
     Profile* profile,
-    PolicyInit policy_init) {
-  scoped_ptr<CloudPolicyStore> store =
-      CloudPolicyStore::CreateUserPolicyStore(
-          profile, policy_init == POLICY_INIT_IMMEDIATELY);
-  return make_scoped_ptr(new UserCloudPolicyManager(
-      store.Pass(), policy_init == POLICY_INIT_REFRESH_FROM_SERVER));
+    scoped_ptr<UserCloudPolicyStore> store)
+    : CloudPolicyManager(store.get()),
+      profile_(profile),
+      store_(store.Pass()) {
+  UserCloudPolicyManagerFactory::GetInstance()->Register(profile_, this);
+}
+
+UserCloudPolicyManager::~UserCloudPolicyManager() {
+  UserCloudPolicyManagerFactory::GetInstance()->Unregister(profile_, this);
 }
 
 void UserCloudPolicyManager::Initialize(
     PrefService* local_state,
-    DeviceManagementService* device_management_service,
-    UserAffiliation user_affiliation) {
-  DCHECK(device_management_service);
-  DCHECK(local_state);
-  local_state_ = local_state;
-  scoped_ptr<CloudPolicyClient> client(
-      new CloudPolicyClient(std::string(), std::string(), user_affiliation,
-                            POLICY_SCOPE_USER, NULL,
-                            device_management_service));
-  InitializeService(client.Pass());
-  cloud_policy_client()->AddObserver(this);
-
-  if (wait_for_policy_fetch_) {
-    // If we are supposed to wait for a policy fetch, we trigger an explicit
-    // policy refresh at startup that allows us to unblock initialization once
-    // done. The refresh scheduler only gets started once that refresh
-    // completes. Note that we might have to wait for registration to happen,
-    // see OnRegistrationStateChanged() below.
-    if (cloud_policy_client()->is_registered()) {
-      cloud_policy_service()->RefreshPolicy(
-          base::Bind(&UserCloudPolicyManager::OnInitialPolicyFetchComplete,
-                     base::Unretained(this)));
-    }
-  } else {
-    CancelWaitForPolicyFetch();
-  }
+    DeviceManagementService* device_management_service) {
+  InitializeService(
+      make_scoped_ptr(new CloudPolicyClient(std::string(), std::string(),
+                                            USER_AFFILIATION_NONE,
+                                            POLICY_SCOPE_USER, NULL,
+                                            device_management_service)));
+  StartRefreshScheduler(local_state, prefs::kUserPolicyRefreshRate);
 }
 
 void UserCloudPolicyManager::ShutdownAndRemovePolicy() {
-  if (cloud_policy_client())
-    cloud_policy_client()->RemoveObserver(this);
   ShutdownService();
-  local_state_ = NULL;
-  cloud_policy_store()->Clear();
-}
-
-void UserCloudPolicyManager::CancelWaitForPolicyFetch() {
-  wait_for_policy_fetch_ = false;
-  CheckAndPublishPolicy();
-
-  // Now that |wait_for_policy_fetch_| is guaranteed to be false, the scheduler
-  // can be started.
-  if (cloud_policy_service() && local_state_)
-    StartRefreshScheduler(local_state_, prefs::kUserPolicyRefreshRate);
+  store_->Clear();
 }
 
 bool UserCloudPolicyManager::IsClientRegistered() const {
@@ -91,46 +55,4 @@ void UserCloudPolicyManager::RegisterClient(const std::string& access_token) {
   }
 }
 
-void UserCloudPolicyManager::Shutdown() {
-  if (cloud_policy_client())
-    cloud_policy_client()->RemoveObserver(this);
-  CloudPolicyManager::Shutdown();
-}
-
-bool UserCloudPolicyManager::IsInitializationComplete() const {
-  return CloudPolicyManager::IsInitializationComplete() &&
-      !wait_for_policy_fetch_;
-}
-
-void UserCloudPolicyManager::OnPolicyFetched(CloudPolicyClient* client) {
-  // No action required. If we're blocked on a policy fetch, we'll learn about
-  // completion of it through OnInitialPolicyFetchComplete().
-}
-
-void UserCloudPolicyManager::OnRegistrationStateChanged(
-    CloudPolicyClient* client) {
-  DCHECK_EQ(cloud_policy_client(), client);
-  if (wait_for_policy_fetch_) {
-    // If we're blocked on the policy fetch, now is a good time to issue it.
-    if (cloud_policy_client()->is_registered()) {
-      cloud_policy_service()->RefreshPolicy(
-          base::Bind(&UserCloudPolicyManager::OnInitialPolicyFetchComplete,
-                     base::Unretained(this)));
-    } else {
-      // If the client has switched to not registered, we bail out as this
-      // indicates the cloud policy setup flow has been aborted.
-      CancelWaitForPolicyFetch();
-    }
-  }
-}
-
-void UserCloudPolicyManager::OnClientError(CloudPolicyClient* client) {
-  DCHECK_EQ(cloud_policy_client(), client);
-  CancelWaitForPolicyFetch();
-}
-
-void UserCloudPolicyManager::OnInitialPolicyFetchComplete() {
-  CancelWaitForPolicyFetch();
-}
-
 }  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_manager.h b/chrome/browser/policy/user_cloud_policy_manager.h
index 2129bb65..2b95c80 100644
--- a/chrome/browser/policy/user_cloud_policy_manager.h
+++ b/chrome/browser/policy/user_cloud_policy_manager.h
@@ -10,8 +10,6 @@
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_ptr.h"
-#include "chrome/browser/policy/cloud_policy_client.h"
-#include "chrome/browser/policy/cloud_policy_constants.h"
 #include "chrome/browser/policy/cloud_policy_manager.h"
 
 class PrefService;
@@ -19,53 +17,23 @@ class Profile;
 
 namespace policy {
 
+class CloudPolicyClient;
 class DeviceManagementService;
+class UserCloudPolicyStore;
 
-// UserCloudPolicyManager keeps track of all things user policy, drives the
-// corresponding cloud policy service and publishes policy through the
-// ConfigurationPolicyProvider interface.
-class UserCloudPolicyManager : public CloudPolicyManager,
-                               public CloudPolicyClient::Observer {
+// UserCloudPolicyManager handles initialization of user policy for Chrome
+// Profiles on the desktop platforms.
+class UserCloudPolicyManager : public CloudPolicyManager {
  public:
-  // If |wait_for_policy_fetch| is true, IsInitializationComplete() will return
-  // false as long as there hasn't been a successful policy fetch.
-  UserCloudPolicyManager(scoped_ptr<CloudPolicyStore> store,
-                         bool wait_for_policy_fetch);
+  UserCloudPolicyManager(Profile* profile,
+                         scoped_ptr<UserCloudPolicyStore> store);
   virtual ~UserCloudPolicyManager();
 
-  // Enumeration describing how to initialize the UserCloudPolicyManager.
-  enum PolicyInit {
-    // Forces policy to be loaded immediately (as part of the constructor). This
-    // will block the caller while file I/O happens, and the resulting object
-    // will start in an initialized state. This is only supported on desktop
-    // platforms, as those platforms are the only ones that initialize Profile
-    // objects synchronously (on ChromeOS, Profiles are initialized
-    // asynchronously, and the underlying policy mechanism is also
-    // asynchronous).
-    POLICY_INIT_IMMEDIATELY,
-
-    // Loads policy via a background task. UserCloudPolicyManager will mark
-    // itself as initialized once the policy has finished loading.
-    POLICY_INIT_IN_BACKGROUND,
-
-    // Attempts to download the latest policy from the server, and if the
-    // request fails, just uses the existing cached policy. The object will
-    // mark itself as initialized once the request is complete.
-    POLICY_INIT_REFRESH_FROM_SERVER
-  };
-
-  // Creates a UserCloudPolicyManager instance associated with the passed
-  // |profile|. If |policy_init| is passed as POLICY_INIT_IMMEDIATELY, then
-  // the CloudPolicyStore will be fully initialized before this call returns.
-  static scoped_ptr<UserCloudPolicyManager> Create(Profile* profile,
-                                                   PolicyInit policy_init);
-
-  // Initializes the cloud connection. |local_state| and |service| must stay
-  // valid until this object is deleted or ShutdownAndRemovePolicy() gets
-  // called. Virtual for mocking.
+  // Initializes the cloud connection. |local_state| and
+  // |device_management_service| must stay valid until this object is deleted or
+  // ShutdownAndRemovePolicy() gets called. Virtual for mocking.
   virtual void Initialize(PrefService* local_state,
-                          DeviceManagementService* device_management_service,
-                          UserAffiliation user_affiliation);
+                          DeviceManagementService* device_management_service);
 
   // Shuts down the UserCloudPolicyManager (removes and stops refreshing the
   // cached cloud policy). This is typically called when a profile is being
@@ -73,11 +41,6 @@ class UserCloudPolicyManager : public CloudPolicyManager,
   // provided by this object until the next time Initialize() is invoked.
   void ShutdownAndRemovePolicy();
 
-  // Cancels waiting for the policy fetch and flags the
-  // ConfigurationPolicyProvider ready (assuming all other initialization tasks
-  // have completed).
-  void CancelWaitForPolicyFetch();
-
   // Returns true if the underlying CloudPolicyClient is already registered.
   // Virtual for mocking.
   virtual bool IsClientRegistered() const;
@@ -85,26 +48,13 @@ class UserCloudPolicyManager : public CloudPolicyManager,
   // Register the CloudPolicyClient using the passed OAuth token.
   void RegisterClient(const std::string& access_token);
 
-  // ConfigurationPolicyProvider:
-  virtual void Shutdown() OVERRIDE;
-  virtual bool IsInitializationComplete() const OVERRIDE;
-
-  // CloudPolicyClient::Observer:
-  virtual void OnPolicyFetched(CloudPolicyClient* client) OVERRIDE;
-  virtual void OnRegistrationStateChanged(CloudPolicyClient* client) OVERRIDE;
-  virtual void OnClientError(CloudPolicyClient* client) OVERRIDE;
-
  private:
-  // Completion handler for the explicit policy fetch triggered on startup in
-  // case |wait_for_policy_fetch_| is true.
-  void OnInitialPolicyFetchComplete();
-
-  // Whether to wait for a policy fetch to complete before reporting
-  // IsInitializationComplete().
-  bool wait_for_policy_fetch_;
+  // The profile this instance belongs to.
+  Profile* profile_;
 
-  // The pref service to pass to the refresh scheduler on initialization.
-  PrefService* local_state_;
+  // Typed pointer to the store owned by UserCloudPolicyManager. Note that
+  // CloudPolicyManager only keeps a plain CloudPolicyStore pointer.
+  scoped_ptr<UserCloudPolicyStore> store_;
 
   DISALLOW_COPY_AND_ASSIGN(UserCloudPolicyManager);
 };
diff --git a/chrome/browser/policy/user_cloud_policy_manager_chromeos.cc b/chrome/browser/policy/user_cloud_policy_manager_chromeos.cc
new file mode 100644
index 0000000..5df3ea0
--- /dev/null
+++ b/chrome/browser/policy/user_cloud_policy_manager_chromeos.cc
@@ -0,0 +1,122 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/user_cloud_policy_manager_chromeos.h"
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "chrome/browser/policy/cloud_policy_service.h"
+#include "chrome/browser/policy/policy_types.h"
+#include "chrome/common/pref_names.h"
+
+namespace policy {
+
+UserCloudPolicyManagerChromeOS::UserCloudPolicyManagerChromeOS(
+    scoped_ptr<CloudPolicyStore> store,
+    bool wait_for_policy_fetch)
+    : CloudPolicyManager(store.get()),
+      store_(store.Pass()),
+      wait_for_policy_fetch_(wait_for_policy_fetch) {}
+
+UserCloudPolicyManagerChromeOS::~UserCloudPolicyManagerChromeOS() {}
+
+void UserCloudPolicyManagerChromeOS::Initialize(
+    PrefService* local_state,
+    DeviceManagementService* device_management_service,
+    UserAffiliation user_affiliation) {
+  DCHECK(device_management_service);
+  DCHECK(local_state);
+  local_state_ = local_state;
+  scoped_ptr<CloudPolicyClient> client(
+      new CloudPolicyClient(std::string(), std::string(), user_affiliation,
+                            POLICY_SCOPE_USER, NULL,
+                            device_management_service));
+  InitializeService(client.Pass());
+  cloud_policy_client()->AddObserver(this);
+
+  if (wait_for_policy_fetch_) {
+    // If we are supposed to wait for a policy fetch, we trigger an explicit
+    // policy refresh at startup that allows us to unblock initialization once
+    // done. The refresh scheduler only gets started once that refresh
+    // completes. Note that we might have to wait for registration to happen,
+    // see OnRegistrationStateChanged() below.
+    if (cloud_policy_client()->is_registered()) {
+      cloud_policy_service()->RefreshPolicy(
+          base::Bind(
+              &UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete,
+              base::Unretained(this)));
+    }
+  } else {
+    CancelWaitForPolicyFetch();
+  }
+}
+
+void UserCloudPolicyManagerChromeOS::CancelWaitForPolicyFetch() {
+  wait_for_policy_fetch_ = false;
+  CheckAndPublishPolicy();
+
+  // Now that |wait_for_policy_fetch_| is guaranteed to be false, the scheduler
+  // can be started.
+  if (cloud_policy_service() && local_state_)
+    StartRefreshScheduler(local_state_, prefs::kUserPolicyRefreshRate);
+}
+
+bool UserCloudPolicyManagerChromeOS::IsClientRegistered() const {
+  return cloud_policy_client() && cloud_policy_client()->is_registered();
+}
+
+void UserCloudPolicyManagerChromeOS::RegisterClient(
+    const std::string& access_token) {
+  DCHECK(cloud_policy_client()) << "Callers must invoke Initialize() first";
+  if (!cloud_policy_client()->is_registered()) {
+    DVLOG(1) << "Registering client with access token: " << access_token;
+    cloud_policy_client()->Register(access_token);
+  }
+}
+
+void UserCloudPolicyManagerChromeOS::Shutdown() {
+  if (cloud_policy_client())
+    cloud_policy_client()->RemoveObserver(this);
+  CloudPolicyManager::Shutdown();
+}
+
+bool UserCloudPolicyManagerChromeOS::IsInitializationComplete() const {
+  return CloudPolicyManager::IsInitializationComplete() &&
+      !wait_for_policy_fetch_;
+}
+
+void UserCloudPolicyManagerChromeOS::OnPolicyFetched(
+    CloudPolicyClient* client) {
+  // No action required. If we're blocked on a policy fetch, we'll learn about
+  // completion of it through OnInitialPolicyFetchComplete().
+}
+
+void UserCloudPolicyManagerChromeOS::OnRegistrationStateChanged(
+    CloudPolicyClient* client) {
+  DCHECK_EQ(cloud_policy_client(), client);
+  if (wait_for_policy_fetch_) {
+    // If we're blocked on the policy fetch, now is a good time to issue it.
+    if (cloud_policy_client()->is_registered()) {
+      cloud_policy_service()->RefreshPolicy(
+          base::Bind(
+              &UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete,
+              base::Unretained(this)));
+    } else {
+      // If the client has switched to not registered, we bail out as this
+      // indicates the cloud policy setup flow has been aborted.
+      CancelWaitForPolicyFetch();
+    }
+  }
+}
+
+void UserCloudPolicyManagerChromeOS::OnClientError(CloudPolicyClient* client) {
+  DCHECK_EQ(cloud_policy_client(), client);
+  CancelWaitForPolicyFetch();
+}
+
+void UserCloudPolicyManagerChromeOS::OnInitialPolicyFetchComplete() {
+  CancelWaitForPolicyFetch();
+}
+
+}  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_manager_chromeos.h b/chrome/browser/policy/user_cloud_policy_manager_chromeos.h
new file mode 100644
index 0000000..ba6d4ec
--- /dev/null
+++ b/chrome/browser/policy/user_cloud_policy_manager_chromeos.h
@@ -0,0 +1,80 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_USER_CLOUD_POLICY_MANAGER_CHROMEOS_H_
+#define CHROME_BROWSER_POLICY_USER_CLOUD_POLICY_MANAGER_CHROMEOS_H_
+
+#include <string>
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "base/memory/scoped_ptr.h"
+#include "chrome/browser/policy/cloud_policy_client.h"
+#include "chrome/browser/policy/cloud_policy_constants.h"
+#include "chrome/browser/policy/cloud_policy_manager.h"
+
+class PrefService;
+
+namespace policy {
+
+class DeviceManagementService;
+
+// UserCloudPolicyManagerChromeOS implements logic for initializing user policy
+// on Chrome OS.
+class UserCloudPolicyManagerChromeOS : public CloudPolicyManager,
+                                       public CloudPolicyClient::Observer {
+ public:
+  // If |wait_for_policy_fetch| is true, IsInitializationComplete() will return
+  // false as long as there hasn't been a successful policy fetch.
+  UserCloudPolicyManagerChromeOS(scoped_ptr<CloudPolicyStore> store,
+                                 bool wait_for_policy_fetch);
+  virtual ~UserCloudPolicyManagerChromeOS();
+
+  // Initializes the cloud connection. |local_state| and
+  // |device_management_service| must stay valid until this object is deleted.
+  void Initialize(PrefService* local_state,
+                  DeviceManagementService* device_management_service,
+                  UserAffiliation user_affiliation);
+
+  // Cancels waiting for the policy fetch and flags the
+  // ConfigurationPolicyProvider ready (assuming all other initialization tasks
+  // have completed).
+  void CancelWaitForPolicyFetch();
+
+  // Register the CloudPolicyClient using the passed OAuth token.
+  void RegisterClient(const std::string& access_token);
+
+  // Returns true if the underlying CloudPolicyClient is already registered.
+  bool IsClientRegistered() const;
+
+  // ConfigurationPolicyProvider:
+  virtual void Shutdown() OVERRIDE;
+  virtual bool IsInitializationComplete() const OVERRIDE;
+
+  // CloudPolicyClient::Observer:
+  virtual void OnPolicyFetched(CloudPolicyClient* client) OVERRIDE;
+  virtual void OnRegistrationStateChanged(CloudPolicyClient* client) OVERRIDE;
+  virtual void OnClientError(CloudPolicyClient* client) OVERRIDE;
+
+ private:
+  // Completion handler for the explicit policy fetch triggered on startup in
+  // case |wait_for_policy_fetch_| is true.
+  void OnInitialPolicyFetchComplete();
+
+  // Owns the store, note that CloudPolicyManager just keeps a plain pointer.
+  scoped_ptr<CloudPolicyStore> store_;
+
+  // Whether to wait for a policy fetch to complete before reporting
+  // IsInitializationComplete().
+  bool wait_for_policy_fetch_;
+
+  // The pref service to pass to the refresh scheduler on initialization.
+  PrefService* local_state_;
+
+  DISALLOW_COPY_AND_ASSIGN(UserCloudPolicyManagerChromeOS);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_USER_CLOUD_POLICY_MANAGER_CHROMEOS_H_
diff --git a/chrome/browser/policy/user_cloud_policy_manager_chromeos_unittest.cc b/chrome/browser/policy/user_cloud_policy_manager_chromeos_unittest.cc
new file mode 100644
index 0000000..2a891c3
--- /dev/null
+++ b/chrome/browser/policy/user_cloud_policy_manager_chromeos_unittest.cc
@@ -0,0 +1,160 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/user_cloud_policy_manager_chromeos.h"
+
+#include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/message_loop.h"
+#include "chrome/browser/policy/mock_cloud_policy_store.h"
+#include "chrome/browser/policy/mock_configuration_policy_provider.h"
+#include "chrome/browser/policy/mock_device_management_service.h"
+#include "chrome/browser/policy/proto/device_management_backend.pb.h"
+#include "chrome/browser/prefs/browser_prefs.h"
+#include "chrome/test/base/testing_pref_service.h"
+#include "policy/policy_constants.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace em = enterprise_management;
+
+using testing::AnyNumber;
+using testing::AtLeast;
+using testing::Mock;
+using testing::_;
+
+namespace policy {
+namespace {
+
+class UserCloudPolicyManagerChromeOSTest : public testing::Test {
+ protected:
+  UserCloudPolicyManagerChromeOSTest()
+      : store_(NULL) {}
+
+  virtual void SetUp() OVERRIDE {
+    chrome::RegisterLocalState(&prefs_);
+
+    // Set up a policy map for testing.
+    policy_map_.Set("key", POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+                    base::Value::CreateStringValue("value"));
+    expected_bundle_.Get(POLICY_DOMAIN_CHROME, std::string()).CopyFrom(
+        policy_map_);
+
+    // Create a fake policy blob to deliver to the client.
+    em::PolicyData policy_data;
+    em::PolicyFetchResponse* policy_response =
+        policy_blob_.mutable_policy_response()->add_response();
+    ASSERT_TRUE(policy_data.SerializeToString(
+        policy_response->mutable_policy_data()));
+
+    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
+        .Times(AnyNumber());
+  }
+
+  virtual void TearDown() OVERRIDE {
+    if (manager_) {
+      manager_->RemoveObserver(&observer_);
+      manager_->Shutdown();
+    }
+  }
+
+  void CreateManagerWithPendingFetch() {
+    store_ = new MockCloudPolicyStore();
+    manager_.reset(
+        new UserCloudPolicyManagerChromeOS(scoped_ptr<CloudPolicyStore>(store_),
+                                           true));
+    manager_->Init();
+    manager_->AddObserver(&observer_);
+    manager_->Initialize(&prefs_, &device_management_service_,
+                         USER_AFFILIATION_NONE);
+    EXPECT_FALSE(manager_->IsInitializationComplete());
+
+    // Finishing the Load() operation shouldn't set the initialized flag.
+    EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
+    store_->NotifyStoreLoaded();
+    EXPECT_FALSE(manager_->IsInitializationComplete());
+    Mock::VerifyAndClearExpectations(&observer_);
+  }
+
+  // Required by the refresh scheduler that's created by the manager.
+  MessageLoop loop_;
+
+  // Convenience policy objects.
+  em::DeviceManagementResponse policy_blob_;
+  PolicyMap policy_map_;
+  PolicyBundle expected_bundle_;
+
+  // Policy infrastructure.
+  TestingPrefService prefs_;
+  MockConfigurationPolicyObserver observer_;
+  MockDeviceManagementService device_management_service_;
+  MockCloudPolicyStore* store_;
+  scoped_ptr<UserCloudPolicyManagerChromeOS> manager_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(UserCloudPolicyManagerChromeOSTest);
+};
+
+TEST_F(UserCloudPolicyManagerChromeOSTest, WaitForPolicyFetch) {
+  CreateManagerWithPendingFetch();
+
+  // Setting the token should trigger the policy fetch.
+  EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
+  MockDeviceManagementJob* fetch_request = NULL;
+  EXPECT_CALL(device_management_service_,
+              CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH))
+      .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
+  manager_->cloud_policy_client()->SetupRegistration("dm_token", "client_id");
+  ASSERT_TRUE(fetch_request);
+  EXPECT_FALSE(manager_->IsInitializationComplete());
+  Mock::VerifyAndClearExpectations(&observer_);
+
+  // Respond to the policy fetch, which should trigger a write to |store_|.
+  EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
+  EXPECT_CALL(*store_, Store(_));
+  fetch_request->SendResponse(DM_STATUS_SUCCESS, policy_blob_);
+  EXPECT_FALSE(manager_->IsInitializationComplete());
+  Mock::VerifyAndClearExpectations(&observer_);
+
+  // The load notification from |store_| should trigger the policy update and
+  // flip the initialized bit.
+  EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
+  store_->NotifyStoreLoaded();
+  EXPECT_TRUE(manager_->IsInitializationComplete());
+  Mock::VerifyAndClearExpectations(&observer_);
+}
+
+TEST_F(UserCloudPolicyManagerChromeOSTest, WaitForPolicyFetchError) {
+  CreateManagerWithPendingFetch();
+
+  // Setting the token should trigger the policy fetch.
+  EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
+  MockDeviceManagementJob* fetch_request = NULL;
+  EXPECT_CALL(device_management_service_,
+              CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH))
+      .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
+  manager_->cloud_policy_client()->SetupRegistration("dm_token", "client_id");
+  ASSERT_TRUE(fetch_request);
+  EXPECT_FALSE(manager_->IsInitializationComplete());
+  Mock::VerifyAndClearExpectations(&observer_);
+
+  // Make the policy fetch fail, at which point the manager should bail out.
+  EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get())).Times(AtLeast(1));
+  fetch_request->SendResponse(DM_STATUS_REQUEST_FAILED, policy_blob_);
+  EXPECT_TRUE(manager_->IsInitializationComplete());
+  Mock::VerifyAndClearExpectations(&observer_);
+}
+
+TEST_F(UserCloudPolicyManagerChromeOSTest, WaitForPolicyFetchCancel) {
+  CreateManagerWithPendingFetch();
+
+  // Cancelling the initial fetch should flip the flag.
+  EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
+  manager_->CancelWaitForPolicyFetch();
+  EXPECT_TRUE(manager_->IsInitializationComplete());
+  Mock::VerifyAndClearExpectations(&observer_);
+}
+
+}  // namespace
+}  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_manager_factory.cc b/chrome/browser/policy/user_cloud_policy_manager_factory.cc
new file mode 100644
index 0000000..850acf3
--- /dev/null
+++ b/chrome/browser/policy/user_cloud_policy_manager_factory.cc
@@ -0,0 +1,85 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
+
+#include "base/logging.h"
+#include "chrome/browser/policy/user_cloud_policy_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_store.h"
+#include "chrome/browser/profiles/profile_dependency_manager.h"
+
+namespace policy {
+
+// static
+UserCloudPolicyManagerFactory* UserCloudPolicyManagerFactory::GetInstance() {
+  return Singleton<UserCloudPolicyManagerFactory>::get();
+}
+
+// static
+UserCloudPolicyManager* UserCloudPolicyManagerFactory::GetForProfile(
+    Profile* profile) {
+  return GetInstance()->GetManagerForProfile(profile);
+}
+
+// static
+scoped_ptr<UserCloudPolicyManager>
+    UserCloudPolicyManagerFactory::CreateForProfile(Profile* profile,
+                                                    bool force_immediate_load) {
+  return GetInstance()->CreateManagerForProfile(profile, force_immediate_load);
+}
+
+UserCloudPolicyManagerFactory::UserCloudPolicyManagerFactory()
+    : ProfileKeyedBaseFactory("UserCloudPolicyManager",
+                              ProfileDependencyManager::GetInstance()) {}
+
+UserCloudPolicyManagerFactory::~UserCloudPolicyManagerFactory() {}
+
+UserCloudPolicyManager* UserCloudPolicyManagerFactory::GetManagerForProfile(
+    Profile* profile) {
+  ManagerMap::const_iterator it = managers_.find(profile);
+  return it != managers_.end() ? it->second : NULL;
+}
+
+scoped_ptr<UserCloudPolicyManager>
+    UserCloudPolicyManagerFactory::CreateManagerForProfile(
+        Profile* profile,
+        bool force_immediate_load) {
+  scoped_ptr<policy::UserCloudPolicyStore> store(
+      policy::UserCloudPolicyStore::Create(profile));
+  if (force_immediate_load)
+    store->LoadImmediately();
+  return make_scoped_ptr(
+      new policy::UserCloudPolicyManager(profile, store.Pass()));
+}
+
+void UserCloudPolicyManagerFactory::ProfileShutdown(Profile* profile) {
+  UserCloudPolicyManager* manager = GetManagerForProfile(profile);
+  if (manager)
+    manager->Shutdown();
+}
+
+void UserCloudPolicyManagerFactory::SetEmptyTestingFactory(Profile* profile) {}
+
+void UserCloudPolicyManagerFactory::CreateServiceNow(Profile* profile) {}
+
+void UserCloudPolicyManagerFactory::Register(Profile* profile,
+                                             UserCloudPolicyManager* instance) {
+  UserCloudPolicyManager*& entry = managers_[profile];
+  DCHECK(!entry);
+  entry = instance;
+}
+
+void UserCloudPolicyManagerFactory::Unregister(
+    Profile* profile,
+    UserCloudPolicyManager* instance) {
+  ManagerMap::iterator entry = managers_.find(profile);
+  if (entry != managers_.end()) {
+    DCHECK_EQ(instance, entry->second);
+    managers_.erase(entry);
+  } else {
+    NOTREACHED();
+  }
+}
+
+}  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_manager_factory.h b/chrome/browser/policy/user_cloud_policy_manager_factory.h
new file mode 100644
index 0000000..097cc09
--- /dev/null
+++ b/chrome/browser/policy/user_cloud_policy_manager_factory.h
@@ -0,0 +1,82 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_USER_CLOUD_POLICY_MANAGER_FACTORY_H_
+#define CHROME_BROWSER_POLICY_USER_CLOUD_POLICY_MANAGER_FACTORY_H_
+
+#include <map>
+
+#include "base/basictypes.h"
+#include "base/memory/singleton.h"
+#include "chrome/browser/profiles/profile_keyed_base_factory.h"
+
+class Profile;
+
+namespace policy {
+
+class UserCloudPolicyManager;
+
+// ProfileKeyedBaseFactory implementation for UserCloudPolicyManager
+// instances that initialize per-profile cloud policy settings on the desktop
+// platforms.
+//
+// UserCloudPolicyManager is handled different than other ProfileKeyedServices
+// because it is a dependency of PrefService. Therefore, lifetime of instances
+// is managed by Profile, Profile startup code invokes CreateForProfile()
+// explicitly, takes ownership, and the instance is only deleted after
+// PrefService destruction.
+//
+// TODO(mnissler): Remove the special lifetime management in favor of
+// PrefService directly depending on UserCloudPolicyManager once the former has
+// been converted to a ProfileKeyedService. See also http://crbug.com/131843 and
+// http://crbug.com/131844.
+class UserCloudPolicyManagerFactory : public ProfileKeyedBaseFactory {
+ public:
+  // Returns an instance of the UserCloudPolicyManagerFactory singleton.
+  static UserCloudPolicyManagerFactory* GetInstance();
+
+  // Returns the UserCloudPolicyManager instance associated with |profile|.
+  static UserCloudPolicyManager* GetForProfile(Profile* profile);
+
+  // Creates an instance for |profile|. Note that the caller is responsible for
+  // managing the lifetime of the instance. Subsequent calls to GetForProfile()
+  // will return the created instance as long as it lives.
+  //
+  // If |force_immediate_load| is true, policy is loaded synchronously from
+  // UserCloudPolicyStore at startup.
+  static scoped_ptr<UserCloudPolicyManager> CreateForProfile(
+      Profile* profile,
+      bool force_immediate_load);
+
+ private:
+  friend class UserCloudPolicyManager;
+  friend struct DefaultSingletonTraits<UserCloudPolicyManagerFactory>;
+
+  UserCloudPolicyManagerFactory();
+  virtual ~UserCloudPolicyManagerFactory();
+
+  // See comments for the static versions above.
+  UserCloudPolicyManager* GetManagerForProfile(Profile* profile);
+  scoped_ptr<UserCloudPolicyManager> CreateManagerForProfile(
+      Profile* profile,
+      bool force_immediate_load);
+
+  // ProfileKeyedBaseFactory:
+  virtual void ProfileShutdown(Profile* profile) OVERRIDE;
+  virtual void SetEmptyTestingFactory(Profile* profile) OVERRIDE;
+  virtual void CreateServiceNow(Profile* profile) OVERRIDE;
+
+  // Invoked by UserCloudPolicyManager to register/unregister instances.
+  void Register(Profile* profile, UserCloudPolicyManager* instance);
+  void Unregister(Profile* profile, UserCloudPolicyManager* instance);
+
+  typedef std::map<Profile*, UserCloudPolicyManager*> ManagerMap;
+  ManagerMap managers_;
+
+  DISALLOW_COPY_AND_ASSIGN(UserCloudPolicyManagerFactory);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_USER_CLOUD_POLICY_MANAGER_FACTORY_H_
diff --git a/chrome/browser/policy/user_cloud_policy_manager_unittest.cc b/chrome/browser/policy/user_cloud_policy_manager_unittest.cc
index 7359268..32042c3 100644
--- a/chrome/browser/policy/user_cloud_policy_manager_unittest.cc
+++ b/chrome/browser/policy/user_cloud_policy_manager_unittest.cc
@@ -7,13 +7,8 @@
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop.h"
-#include "chrome/browser/policy/mock_cloud_policy_store.h"
 #include "chrome/browser/policy/mock_configuration_policy_provider.h"
-#include "chrome/browser/policy/mock_device_management_service.h"
-#include "chrome/browser/policy/proto/device_management_backend.pb.h"
-#include "chrome/browser/prefs/browser_prefs.h"
-#include "chrome/test/base/testing_pref_service.h"
-#include "policy/policy_constants.h"
+#include "chrome/browser/policy/mock_user_cloud_policy_store.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -33,23 +28,11 @@ class UserCloudPolicyManagerTest : public testing::Test {
       : store_(NULL) {}
 
   virtual void SetUp() OVERRIDE {
-    chrome::RegisterLocalState(&prefs_);
-
     // Set up a policy map for testing.
     policy_map_.Set("key", POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
                     base::Value::CreateStringValue("value"));
     expected_bundle_.Get(POLICY_DOMAIN_CHROME, std::string()).CopyFrom(
         policy_map_);
-
-    // Create a fake policy blob to deliver to the client.
-    em::PolicyData policy_data;
-    em::PolicyFetchResponse* policy_response =
-        policy_blob_.mutable_policy_response()->add_response();
-    ASSERT_TRUE(policy_data.SerializeToString(
-        policy_response->mutable_policy_data()));
-
-    EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
-        .Times(AnyNumber());
   }
 
   virtual void TearDown() OVERRIDE {
@@ -59,43 +42,27 @@ class UserCloudPolicyManagerTest : public testing::Test {
     }
   }
 
-  void CreateManager(bool wait_for_policy_fetch) {
-    store_ = new MockCloudPolicyStore();
+  void CreateManager() {
+    store_ = new MockUserCloudPolicyStore();
     EXPECT_CALL(*store_, Load());
     manager_.reset(
-        new UserCloudPolicyManager(scoped_ptr<CloudPolicyStore>(store_),
-                                   wait_for_policy_fetch));
+        new UserCloudPolicyManager(NULL,
+                                   scoped_ptr<UserCloudPolicyStore>(store_)));
     manager_->Init();
     manager_->AddObserver(&observer_);
     Mock::VerifyAndClearExpectations(store_);
   }
 
-  void CreateManagerWithPendingFetch() {
-    CreateManager(true);
-    manager_->Initialize(&prefs_, &device_management_service_,
-                         USER_AFFILIATION_NONE);
-    EXPECT_FALSE(manager_->IsInitializationComplete());
-
-    // Finishing the Load() operation shouldn't set the initialized flag.
-    EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
-    store_->NotifyStoreLoaded();
-    EXPECT_FALSE(manager_->IsInitializationComplete());
-    Mock::VerifyAndClearExpectations(&observer_);
-  }
-
   // Required by the refresh scheduler that's created by the manager.
   MessageLoop loop_;
 
   // Convenience policy objects.
-  em::DeviceManagementResponse policy_blob_;
   PolicyMap policy_map_;
   PolicyBundle expected_bundle_;
 
   // Policy infrastructure.
-  TestingPrefService prefs_;
   MockConfigurationPolicyObserver observer_;
-  MockDeviceManagementService device_management_service_;
-  MockCloudPolicyStore* store_;
+  MockUserCloudPolicyStore* store_;
   scoped_ptr<UserCloudPolicyManager> manager_;
 
  private:
@@ -104,7 +71,7 @@ class UserCloudPolicyManagerTest : public testing::Test {
 
 TEST_F(UserCloudPolicyManagerTest, ShutdownAndRemovePolicy) {
   // Load policy, make sure it goes away when ShutdownAndRemove() is called.
-  CreateManager(false);
+  CreateManager();
   store_->policy_map_.CopyFrom(policy_map_);
   EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
   store_->NotifyStoreLoaded();
@@ -115,65 +82,5 @@ TEST_F(UserCloudPolicyManagerTest, ShutdownAndRemovePolicy) {
   EXPECT_FALSE(manager_->cloud_policy_service());
 }
 
-TEST_F(UserCloudPolicyManagerTest, WaitForPolicyFetch) {
-  CreateManagerWithPendingFetch();
-
-  // Setting the token should trigger the policy fetch.
-  EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
-  MockDeviceManagementJob* fetch_request = NULL;
-  EXPECT_CALL(device_management_service_,
-              CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH))
-      .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
-  manager_->cloud_policy_client()->SetupRegistration("dm_token", "client_id");
-  ASSERT_TRUE(fetch_request);
-  EXPECT_FALSE(manager_->IsInitializationComplete());
-  Mock::VerifyAndClearExpectations(&observer_);
-
-  // Respond to the policy fetch, which should trigger a write to |store_|.
-  EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
-  EXPECT_CALL(*store_, Store(_));
-  fetch_request->SendResponse(DM_STATUS_SUCCESS, policy_blob_);
-  EXPECT_FALSE(manager_->IsInitializationComplete());
-  Mock::VerifyAndClearExpectations(&observer_);
-
-  // The load notification from |store_| should trigger the policy update and
-  // flip the initialized bit.
-  EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  store_->NotifyStoreLoaded();
-  EXPECT_TRUE(manager_->IsInitializationComplete());
-  Mock::VerifyAndClearExpectations(&observer_);
-}
-
-TEST_F(UserCloudPolicyManagerTest, WaitForPolicyFetchError) {
-  CreateManagerWithPendingFetch();
-
-  // Setting the token should trigger the policy fetch.
-  EXPECT_CALL(observer_, OnUpdatePolicy(_)).Times(0);
-  MockDeviceManagementJob* fetch_request = NULL;
-  EXPECT_CALL(device_management_service_,
-              CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH))
-      .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
-  manager_->cloud_policy_client()->SetupRegistration("dm_token", "client_id");
-  ASSERT_TRUE(fetch_request);
-  EXPECT_FALSE(manager_->IsInitializationComplete());
-  Mock::VerifyAndClearExpectations(&observer_);
-
-  // Make the policy fetch fail, at which point the manager should bail out.
-  EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get())).Times(AtLeast(1));
-  fetch_request->SendResponse(DM_STATUS_REQUEST_FAILED, policy_blob_);
-  EXPECT_TRUE(manager_->IsInitializationComplete());
-  Mock::VerifyAndClearExpectations(&observer_);
-}
-
-TEST_F(UserCloudPolicyManagerTest, WaitForPolicyFetchCancel) {
-  CreateManagerWithPendingFetch();
-
-  // Cancelling the initial fetch should flip the flag.
-  EXPECT_CALL(observer_, OnUpdatePolicy(manager_.get()));
-  manager_->CancelWaitForPolicyFetch();
-  EXPECT_TRUE(manager_->IsInitializationComplete());
-  Mock::VerifyAndClearExpectations(&observer_);
-}
-
 }  // namespace
 }  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_store.cc b/chrome/browser/policy/user_cloud_policy_store.cc
index b47ea90..0ab5477 100644
--- a/chrome/browser/policy/user_cloud_policy_store.cc
+++ b/chrome/browser/policy/user_cloud_policy_store.cc
@@ -97,7 +97,14 @@ UserCloudPolicyStore::UserCloudPolicyStore(Profile* profile,
       backing_file_path_(path) {
 }
 
-UserCloudPolicyStore::~UserCloudPolicyStore() {
+UserCloudPolicyStore::~UserCloudPolicyStore() {}
+
+// static
+scoped_ptr<UserCloudPolicyStore> UserCloudPolicyStore::Create(
+    Profile* profile) {
+  FilePath path =
+      profile->GetPath().Append(kPolicyDir).Append(kPolicyCacheFile);
+  return make_scoped_ptr(new UserCloudPolicyStore(profile, path));
 }
 
 void UserCloudPolicyStore::LoadImmediately() {
@@ -110,6 +117,17 @@ void UserCloudPolicyStore::LoadImmediately() {
   PolicyLoaded(false, result);
 }
 
+void UserCloudPolicyStore::Clear() {
+  content::BrowserThread::PostTask(
+      content::BrowserThread::FILE, FROM_HERE,
+      base::Bind(base::IgnoreResult(&file_util::Delete),
+                 backing_file_path_,
+                 false));
+  policy_.reset();
+  policy_map_.Clear();
+  NotifyStoreLoaded();
+}
+
 void UserCloudPolicyStore::Load() {
   DVLOG(1) << "Initiating policy load from disk";
   // Cancel any pending Load/Store/Validate operations.
@@ -173,14 +191,6 @@ void UserCloudPolicyStore::InstallLoadedPolicyAfterValidation(
   NotifyStoreLoaded();
 }
 
-void UserCloudPolicyStore::RemoveStoredPolicy() {
-  content::BrowserThread::PostTask(
-      content::BrowserThread::FILE, FROM_HERE,
-      base::Bind(base::IgnoreResult(&file_util::Delete),
-                 backing_file_path_,
-                 false));
-}
-
 void UserCloudPolicyStore::Store(const em::PolicyFetchResponse& policy) {
   // Stop any pending requests to store policy, then validate the new policy
   // before storing it.
@@ -239,16 +249,4 @@ void UserCloudPolicyStore::StorePolicyAfterValidation(
   NotifyStoreLoaded();
 }
 
-// static
-scoped_ptr<CloudPolicyStore> CloudPolicyStore::CreateUserPolicyStore(
-    Profile* profile,
-    bool force_immediate_policy_load) {
-  FilePath path =
-      profile->GetPath().Append(kPolicyDir).Append(kPolicyCacheFile);
-  UserCloudPolicyStore* store = new UserCloudPolicyStore(profile, path);
-  if (force_immediate_policy_load)
-    store->LoadImmediately();
-  return scoped_ptr<CloudPolicyStore>(store);
-}
-
 }  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_store.h b/chrome/browser/policy/user_cloud_policy_store.h
index 95e8d0f..3702a89 100644
--- a/chrome/browser/policy/user_cloud_policy_store.h
+++ b/chrome/browser/policy/user_cloud_policy_store.h
@@ -13,6 +13,8 @@
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/policy/user_cloud_policy_store_base.h"
 
+class Profile;
+
 namespace policy {
 
 // Implements a cloud policy store that is stored in a simple file in the user's
@@ -25,19 +27,22 @@ class UserCloudPolicyStore : public UserCloudPolicyStoreBase {
   UserCloudPolicyStore(Profile* profile, const FilePath& policy_file);
   virtual ~UserCloudPolicyStore();
 
-  // Loads policy immediately on the current thread.
+  // Factory method for creating a UserCloudPolicyStore for |profile|.
+  static scoped_ptr<UserCloudPolicyStore> Create(Profile* profile);
+
+  // Loads policy immediately on the current thread. Virtual for mocks.
   virtual void LoadImmediately();
 
+  // Deletes any existing policy blob and notifies observers via OnStoreLoaded()
+  // that the blob has changed. Virtual for mocks.
+  virtual void Clear();
+
   // CloudPolicyStore implementation.
   virtual void Load() OVERRIDE;
   virtual void Store(
       const enterprise_management::PolicyFetchResponse& policy) OVERRIDE;
 
- protected:
-  virtual void RemoveStoredPolicy() OVERRIDE;
-
  private:
-
   // Callback invoked when a new policy has been loaded from disk. If
   // |validate_in_background| is true, then policy is validated via a background
   // thread.
diff --git a/chrome/browser/policy/user_cloud_policy_store_chromeos.cc b/chrome/browser/policy/user_cloud_policy_store_chromeos.cc
index 850d5aac..21f30bc 100644
--- a/chrome/browser/policy/user_cloud_policy_store_chromeos.cc
+++ b/chrome/browser/policy/user_cloud_policy_store_chromeos.cc
@@ -9,18 +9,13 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
-#include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/memory/ref_counted.h"
-#include "base/path_service.h"
 #include "chrome/browser/chromeos/login/user_manager.h"
 #include "chrome/browser/policy/proto/cloud_policy.pb.h"
 #include "chrome/browser/policy/proto/device_management_local.pb.h"
 #include "chrome/browser/policy/user_policy_disk_cache.h"
 #include "chrome/browser/policy/user_policy_token_cache.h"
-#include "chrome/common/chrome_paths.h"
-#include "chrome/common/chrome_switches.h"
-#include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/session_manager_client.h"
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
@@ -182,13 +177,6 @@ void UserCloudPolicyStoreChromeOS::Load() {
                  weak_factory_.GetWeakPtr()));
 }
 
-void UserCloudPolicyStoreChromeOS::RemoveStoredPolicy() {
-  // This should never be called on ChromeOS since it is not possible to sign
-  // out of a Profile. The underlying policy store is only removed if the
-  // Profile itself is deleted.
-  NOTREACHED();
-}
-
 void UserCloudPolicyStoreChromeOS::OnPolicyRetrieved(
     const std::string& policy_blob) {
   if (policy_blob.empty()) {
@@ -358,25 +346,4 @@ void UserCloudPolicyStoreChromeOS::RemoveLegacyCacheDir(const FilePath& dir) {
     LOG(ERROR) << "Failed to remove cache dir " << dir.value();
 }
 
-// static
-scoped_ptr<CloudPolicyStore> CloudPolicyStore::CreateUserPolicyStore(
-    Profile* profile, bool force_immediate_policy_load) {
-  // On ChromeOS, callers should never try to load policy synchronously
-  // (profile initialization is always asynchronous).
-  DCHECK(!force_immediate_policy_load);
-  FilePath profile_dir;
-  CHECK(PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
-  CommandLine* command_line = CommandLine::ForCurrentProcess();
-  const FilePath policy_dir =
-      profile_dir
-          .Append(command_line->GetSwitchValuePath(switches::kLoginProfile))
-          .Append(kPolicyDir);
-  const FilePath policy_cache_file = policy_dir.Append(kPolicyCacheFile);
-  const FilePath token_cache_file = policy_dir.Append(kTokenCacheFile);
-
-  return scoped_ptr<CloudPolicyStore>(new UserCloudPolicyStoreChromeOS(
-      chromeos::DBusThreadManager::Get()->GetSessionManagerClient(),
-      token_cache_file, policy_cache_file));
-}
-
 }  // namespace policy
diff --git a/chrome/browser/policy/user_cloud_policy_store_chromeos.h b/chrome/browser/policy/user_cloud_policy_store_chromeos.h
index 109590c..c6653bd 100644
--- a/chrome/browser/policy/user_cloud_policy_store_chromeos.h
+++ b/chrome/browser/policy/user_cloud_policy_store_chromeos.h
@@ -43,9 +43,6 @@ class UserCloudPolicyStoreChromeOS : public UserCloudPolicyStoreBase {
       const enterprise_management::PolicyFetchResponse& policy) OVERRIDE;
   virtual void Load() OVERRIDE;
 
- protected:
-  virtual void RemoveStoredPolicy() OVERRIDE;
-
  private:
   // Called back from SessionManagerClient for policy load operations.
   void OnPolicyRetrieved(const std::string& policy_blob);
diff --git a/chrome/browser/policy/user_policy_signin_service.cc b/chrome/browser/policy/user_policy_signin_service.cc
index 7a67872..2eb6812 100644
--- a/chrome/browser/policy/user_policy_signin_service.cc
+++ b/chrome/browser/policy/user_policy_signin_service.cc
@@ -8,6 +8,7 @@
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/policy/cloud_policy_service.h"
 #include "chrome/browser/policy/user_cloud_policy_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/signin_manager.h"
@@ -35,10 +36,8 @@ const int64 kPolicyServiceInitializationDelayMilliseconds = 2000;
 namespace policy {
 
 UserPolicySigninService::UserPolicySigninService(
-    Profile* profile,
-    UserCloudPolicyManager* manager)
-    : profile_(profile),
-      manager_(manager) {
+    Profile* profile)
+    : profile_(profile) {
 
   // Initialize/shutdown the UserCloudPolicyManager when the user signs in or
   // out.
@@ -61,13 +60,12 @@ UserPolicySigninService::UserPolicySigninService(
                  content::Source<Profile>(profile));
 }
 
-UserPolicySigninService::~UserPolicySigninService() {
-  StopObserving();
-}
+UserPolicySigninService::~UserPolicySigninService() {}
 
 void UserPolicySigninService::StopObserving() {
-  if (manager_ && manager_->cloud_policy_service())
-    manager_->cloud_policy_service()->RemoveObserver(this);
+  UserCloudPolicyManager* manager = GetManager();
+  if (manager && manager->cloud_policy_service())
+    manager->cloud_policy_service()->RemoveObserver(this);
 }
 
 void UserPolicySigninService::Observe(
@@ -108,17 +106,18 @@ void UserPolicySigninService::ConfigureUserCloudPolicyManager() {
 
   // Either startup or shutdown the UserCloudPolicyManager depending on whether
   // the user is signed in or not.
-  if (!manager_)
+  UserCloudPolicyManager* manager = GetManager();
+  if (!manager)
     return;  // Can be null in unit tests.
 
   SigninManager* signin_manager = SigninManagerFactory::GetForProfile(profile_);
   if (signin_manager->GetAuthenticatedUsername().empty()) {
     // User has signed out - remove existing policy.
     StopObserving();
-    manager_->ShutdownAndRemovePolicy();
+    manager->ShutdownAndRemovePolicy();
   } else {
     // Initialize the UserCloudPolicyManager if it isn't already initialized.
-    if (!manager_->cloud_policy_service()) {
+    if (!manager->cloud_policy_service()) {
       // Make sure we've initialized the DeviceManagementService. It's OK to
       // call this multiple times so we do it every time we initialize the
       // UserCloudPolicyManager.
@@ -129,17 +128,15 @@ void UserPolicySigninService::ConfigureUserCloudPolicyManager() {
       // the OnInitializationCompleted() callback is invoked.
       policy::DeviceManagementService* service = g_browser_process->
           browser_policy_connector()->device_management_service();
-      manager_->Initialize(g_browser_process->local_state(),
-                           service,
-                           policy::USER_AFFILIATION_NONE);
-      DCHECK(manager_->cloud_policy_service());
-      manager_->cloud_policy_service()->AddObserver(this);
+      manager->Initialize(g_browser_process->local_state(), service);
+      DCHECK(manager->cloud_policy_service());
+      manager->cloud_policy_service()->AddObserver(this);
     }
 
     // If the CloudPolicyService is initialized, but the CloudPolicyClient still
     // needs to be registered, kick off registration.
-    if (manager_->cloud_policy_service()->IsInitializationComplete() &&
-        !manager_->IsClientRegistered()) {
+    if (manager->cloud_policy_service()->IsInitializationComplete() &&
+        !manager->IsClientRegistered()) {
       RegisterCloudPolicyService();
     }
   }
@@ -147,14 +144,15 @@ void UserPolicySigninService::ConfigureUserCloudPolicyManager() {
 
 void UserPolicySigninService::OnInitializationCompleted(
     CloudPolicyService* service) {
-  DCHECK_EQ(service, manager_->cloud_policy_service());
+  UserCloudPolicyManager* manager = GetManager();
+  DCHECK_EQ(service, manager->cloud_policy_service());
   DCHECK(service->IsInitializationComplete());
   // The service is now initialized - if the client is not yet registered, then
   // it means that there is no cached policy and so we need to initiate a new
   // client registration.
-  DVLOG_IF(1, manager_->IsClientRegistered())
+  DVLOG_IF(1, manager->IsClientRegistered())
       << "Client already registered - not fetching DMToken";
-  if (!manager_->IsClientRegistered())
+  if (!manager->IsClientRegistered())
     RegisterCloudPolicyService();
 }
 
@@ -191,16 +189,24 @@ void UserPolicySigninService::OnGetTokenFailure(
   DLOG(WARNING) << "Could not fetch access token for "
                 << kServiceScopeChromeOSDeviceManagement;
   oauth2_access_token_fetcher_.reset();
-  manager_->CancelWaitForPolicyFetch();
 }
 
 void UserPolicySigninService::OnGetTokenSuccess(
     const std::string& access_token,
     const base::Time& expiration_time) {
+  UserCloudPolicyManager* manager = GetManager();
   // Pass along the new access token to the CloudPolicyClient.
   DVLOG(1) << "Fetched new scoped OAuth token:" << access_token;
-  manager_->RegisterClient(access_token);
+  manager->RegisterClient(access_token);
   oauth2_access_token_fetcher_.reset();
 }
 
+void UserPolicySigninService::Shutdown() {
+  StopObserving();
+}
+
+UserCloudPolicyManager* UserPolicySigninService::GetManager() {
+  return UserCloudPolicyManagerFactory::GetForProfile(profile_);
+}
+
 }  // namespace policy
diff --git a/chrome/browser/policy/user_policy_signin_service.h b/chrome/browser/policy/user_policy_signin_service.h
index c39bd48..8fab6fa3 100644
--- a/chrome/browser/policy/user_policy_signin_service.h
+++ b/chrome/browser/policy/user_policy_signin_service.h
@@ -35,7 +35,7 @@ class UserPolicySigninService
       public content::NotificationObserver {
  public:
   // Creates a UserPolicySigninService associated with the passed |profile|.
-  UserPolicySigninService(Profile* profile, UserCloudPolicyManager* manager);
+  explicit UserPolicySigninService(Profile* profile);
   virtual ~UserPolicySigninService();
 
   // content::NotificationObserver implementation.
@@ -51,6 +51,9 @@ class UserPolicySigninService
                                  const base::Time& expiration_time) OVERRIDE;
   virtual void OnGetTokenFailure(const GoogleServiceAuthError& error) OVERRIDE;
 
+  // ProfileKeyedService implementation:
+  virtual void Shutdown() OVERRIDE;
+
  private:
   // Initializes the UserCloudPolicyManager to reflect the currently-signed-in
   // user.
@@ -63,16 +66,15 @@ class UserPolicySigninService
   // Helper routine to unregister for CloudPolicyService notifications.
   void StopObserving();
 
+  // Convenience helper to get the UserCloudPolicyManager for |profile_|.
+  UserCloudPolicyManager* GetManager();
+
   // Weak pointer to the profile this service is associated with.
   Profile* profile_;
 
   content::NotificationRegistrar registrar_;
   scoped_ptr<OAuth2AccessTokenFetcher> oauth2_access_token_fetcher_;
 
-  // Weak pointer to the UserCloudPolicyManager (allows dependency injection
-  // for tests).
-  UserCloudPolicyManager* manager_;
-
   DISALLOW_COPY_AND_ASSIGN(UserPolicySigninService);
 };
 
diff --git a/chrome/browser/policy/user_policy_signin_service_factory.cc b/chrome/browser/policy/user_policy_signin_service_factory.cc
index 6ffeb82..6f939af 100644
--- a/chrome/browser/policy/user_policy_signin_service_factory.cc
+++ b/chrome/browser/policy/user_policy_signin_service_factory.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/policy/user_policy_signin_service_factory.h"
 
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
 #include "chrome/browser/policy/user_policy_signin_service.h"
 #include "chrome/browser/prefs/pref_service.h"
 #include "chrome/browser/profiles/profile.h"
@@ -19,6 +20,7 @@ UserPolicySigninServiceFactory::UserPolicySigninServiceFactory()
                                  ProfileDependencyManager::GetInstance()) {
   DependsOn(TokenServiceFactory::GetInstance());
   DependsOn(SigninManagerFactory::GetInstance());
+  DependsOn(UserCloudPolicyManagerFactory::GetInstance());
 }
 
 UserPolicySigninServiceFactory::~UserPolicySigninServiceFactory() {}
@@ -37,8 +39,7 @@ UserPolicySigninServiceFactory* UserPolicySigninServiceFactory::GetInstance() {
 
 ProfileKeyedService* UserPolicySigninServiceFactory::BuildServiceInstanceFor(
     Profile* profile) const {
-  return new UserPolicySigninService(profile,
-                                     profile->GetUserCloudPolicyManager());
+  return new UserPolicySigninService(profile);
 }
 
 bool UserPolicySigninServiceFactory::ServiceIsCreatedWithProfile() const {
diff --git a/chrome/browser/policy/user_policy_signin_service_unittest.cc b/chrome/browser/policy/user_policy_signin_service_unittest.cc
index ab7d849..f407452 100644
--- a/chrome/browser/policy/user_policy_signin_service_unittest.cc
+++ b/chrome/browser/policy/user_policy_signin_service_unittest.cc
@@ -5,7 +5,7 @@
 #include "base/message_loop.h"
 #include "base/run_loop.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
-#include "chrome/browser/policy/mock_cloud_policy_store.h"
+#include "chrome/browser/policy/mock_user_cloud_policy_store.h"
 #include "chrome/browser/policy/user_cloud_policy_manager.h"
 #include "chrome/browser/policy/user_policy_signin_service.h"
 #include "chrome/browser/policy/user_policy_signin_service_factory.h"
@@ -30,6 +30,9 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+using testing::AnyNumber;
+using testing::Mock;
+
 namespace policy {
 
 namespace {
@@ -50,22 +53,22 @@ class UserPolicySigninServiceTest : public testing::Test {
     static_cast<TestingBrowserProcess*>(g_browser_process)->SetLocalState(
         local_state_.get());
 
-    // Create a UserCloudPolicyManager with a MockCloudPolicyStore, and build a
-    // TestingProfile that uses it.
-    mock_store_ = new MockCloudPolicyStore();
-    scoped_ptr<UserCloudPolicyManager> manager(new UserCloudPolicyManager(
-        scoped_ptr<CloudPolicyStore>(mock_store_), false));
-    TestingProfile::Builder builder;
-    builder.SetUserCloudPolicyManager(manager.Pass());
-    profile_ = builder.Build().Pass();
+    // Create a testing profile and bring up a UserCloudPolicyManager with a
+    // MockUserCloudPolicyStore.
+    profile_.reset(new TestingProfile());
     profile_->CreateRequestContext();
     profile_->GetPrefs()->SetBoolean(prefs::kLoadCloudPolicyOnSignin, true);
+
+    mock_store_ = new MockUserCloudPolicyStore();
+    EXPECT_CALL(*mock_store_, Load()).Times(AnyNumber());
+    manager_.reset(new UserCloudPolicyManager(
+        profile_.get(), scoped_ptr<UserCloudPolicyStore>(mock_store_)));
     SigninManagerFactory::GetInstance()->SetTestingFactory(
         profile_.get(), FakeSigninManager::Build);
 
     // Make sure the UserPolicySigninService is created.
     UserPolicySigninServiceFactory::GetForProfile(profile_.get());
-    testing::Mock::VerifyAndClearExpectations(mock_store_);
+    Mock::VerifyAndClearExpectations(mock_store_);
   }
 
   virtual void TearDown() OVERRIDE {
@@ -85,9 +88,10 @@ class UserPolicySigninServiceTest : public testing::Test {
   }
 
   scoped_ptr<TestingProfile> profile_;
-  // Weak pointer to a MockCloudPolicyStore - lifetime is managed by the
+  // Weak pointer to a MockUserCloudPolicyStore - lifetime is managed by the
   // UserCloudPolicyManager.
-  MockCloudPolicyStore* mock_store_;
+  MockUserCloudPolicyStore* mock_store_;
+  scoped_ptr<UserCloudPolicyManager> manager_;
 
   // BrowserPolicyConnector and UrlFetcherFactory want to initialize and free
   // various components asynchronously via tasks, so create fake threads here.
@@ -114,7 +118,7 @@ TEST_F(UserPolicySigninServiceTest, InitWhileSignedOut) {
       content::NotificationService::NoDetails());
 
   // UserCloudPolicyManager should not be initialized.
-  ASSERT_FALSE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_FALSE(manager_->cloud_policy_service());
 }
 
 TEST_F(UserPolicySigninServiceTest, InitWhileSignedIn) {
@@ -129,7 +133,7 @@ TEST_F(UserPolicySigninServiceTest, InitWhileSignedIn) {
       content::NotificationService::NoDetails());
 
   // UserCloudPolicyManager should be initialized.
-  ASSERT_TRUE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_TRUE(manager_->cloud_policy_service());
 
   // Complete initialization of the store.
   mock_store_->NotifyStoreLoaded();
@@ -155,7 +159,7 @@ TEST_F(UserPolicySigninServiceTest, SignInAfterInit) {
 
   // UserCloudPolicyManager should not be initialized since there is no
   // signed-in user.
-  ASSERT_FALSE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_FALSE(manager_->cloud_policy_service());
 
   // Now sign in the user.
   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
@@ -169,7 +173,7 @@ TEST_F(UserPolicySigninServiceTest, SignInAfterInit) {
       GaiaConstants::kGaiaOAuth2LoginRefreshToken, "oauth_login_refresh_token");
 
   // UserCloudPolicyManager should be initialized.
-  ASSERT_TRUE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_TRUE(manager_->cloud_policy_service());
 
   // Client registration should be in progress since we have an oauth token.
   ASSERT_TRUE(IsRequestActive());
@@ -185,7 +189,7 @@ TEST_F(UserPolicySigninServiceTest, UnregisteredClient) {
 
   // UserCloudPolicyManager should not be initialized since there is no
   // signed-in user.
-  ASSERT_FALSE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_FALSE(manager_->cloud_policy_service());
 
   // Now sign in the user.
   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
@@ -196,7 +200,7 @@ TEST_F(UserPolicySigninServiceTest, UnregisteredClient) {
       GaiaConstants::kGaiaOAuth2LoginRefreshToken, "oauth_login_refresh_token");
 
   // UserCloudPolicyManager should be initialized.
-  ASSERT_TRUE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_TRUE(manager_->cloud_policy_service());
 
   // Client registration should not be in progress since the store is not
   // yet initialized.
@@ -219,7 +223,7 @@ TEST_F(UserPolicySigninServiceTest, RegisteredClient) {
 
   // UserCloudPolicyManager should not be initialized since there is no
   // signed-in user.
-  ASSERT_FALSE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_FALSE(manager_->cloud_policy_service());
 
   // Now sign in the user.
   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
@@ -230,11 +234,11 @@ TEST_F(UserPolicySigninServiceTest, RegisteredClient) {
       GaiaConstants::kGaiaOAuth2LoginRefreshToken, "oauth_login_refresh_token");
 
   // UserCloudPolicyManager should be initialized.
-  ASSERT_TRUE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_TRUE(manager_->cloud_policy_service());
 
   // Client registration should not be in progress since the store is not
   // yet initialized.
-  ASSERT_FALSE(profile_->GetUserCloudPolicyManager()->IsClientRegistered());
+  ASSERT_FALSE(manager_->IsClientRegistered());
   ASSERT_FALSE(IsRequestActive());
 
   mock_store_->policy_.reset(new enterprise_management::PolicyData());
@@ -246,7 +250,7 @@ TEST_F(UserPolicySigninServiceTest, RegisteredClient) {
 
   // Client registration should not be in progress since the client should be
   // already registered.
-  ASSERT_TRUE(profile_->GetUserCloudPolicyManager()->IsClientRegistered());
+  ASSERT_TRUE(manager_->IsClientRegistered());
   ASSERT_FALSE(IsRequestActive());
 }
 
@@ -263,13 +267,13 @@ TEST_F(UserPolicySigninServiceTest, SignOutAfterInit) {
       content::NotificationService::NoDetails());
 
   // UserCloudPolicyManager should be initialized.
-  ASSERT_TRUE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_TRUE(manager_->cloud_policy_service());
 
   // Now sign out.
   SigninManagerFactory::GetForProfile(profile_.get())->SignOut();
 
   // UserCloudPolicyManager should be shut down.
-  ASSERT_FALSE(profile_->GetUserCloudPolicyManager()->cloud_policy_service());
+  ASSERT_FALSE(manager_->cloud_policy_service());
 }
 
 }  // namespace
diff --git a/chrome/browser/profiles/off_the_record_profile_impl.cc b/chrome/browser/profiles/off_the_record_profile_impl.cc
index 0935531..6beec98 100644
--- a/chrome/browser/profiles/off_the_record_profile_impl.cc
+++ b/chrome/browser/profiles/off_the_record_profile_impl.cc
@@ -229,11 +229,6 @@ GAIAInfoUpdateService* OffTheRecordProfileImpl::GetGAIAInfoUpdateService() {
   return NULL;
 }
 
-policy::UserCloudPolicyManager*
-    OffTheRecordProfileImpl::GetUserCloudPolicyManager() {
-  return profile_->GetUserCloudPolicyManager();
-}
-
 policy::ManagedModePolicyProvider*
     OffTheRecordProfileImpl::GetManagedModePolicyProvider() {
   return profile_->GetManagedModePolicyProvider();
diff --git a/chrome/browser/profiles/off_the_record_profile_impl.h b/chrome/browser/profiles/off_the_record_profile_impl.h
index bbfacbb..87c7095 100644
--- a/chrome/browser/profiles/off_the_record_profile_impl.h
+++ b/chrome/browser/profiles/off_the_record_profile_impl.h
@@ -43,7 +43,6 @@ class OffTheRecordProfileImpl : public Profile,
   virtual ExtensionSpecialStoragePolicy*
       GetExtensionSpecialStoragePolicy() OVERRIDE;
   virtual GAIAInfoUpdateService* GetGAIAInfoUpdateService() OVERRIDE;
-  virtual policy::UserCloudPolicyManager* GetUserCloudPolicyManager() OVERRIDE;
   virtual policy::ManagedModePolicyProvider*
       GetManagedModePolicyProvider() OVERRIDE;
   virtual policy::PolicyService* GetPolicyService() OVERRIDE;
diff --git a/chrome/browser/profiles/profile.h b/chrome/browser/profiles/profile.h
index 412387e..47f1bb6 100644
--- a/chrome/browser/profiles/profile.h
+++ b/chrome/browser/profiles/profile.h
@@ -68,7 +68,6 @@ class SSLConfigService;
 namespace policy {
 class ManagedModePolicyProvider;
 class PolicyService;
-class UserCloudPolicyManager;
 }
 
 class Profile : public content::BrowserContext {
@@ -209,10 +208,6 @@ class Profile : public content::BrowserContext {
   // Accessor. The instance is created upon first access.
   virtual GAIAInfoUpdateService* GetGAIAInfoUpdateService() = 0;
 
-  // Returns the UserCloudPolicyManager (if any) that handles this profile's
-  // connection to the cloud-based management service.
-  virtual policy::UserCloudPolicyManager* GetUserCloudPolicyManager() = 0;
-
   // Returns the ManagedModePolicyProvider for this profile, if it exists.
   virtual policy::ManagedModePolicyProvider* GetManagedModePolicyProvider() = 0;
 
diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/profile_impl.cc
index 2f6f65ea..19c0ff8 100644
--- a/chrome/browser/profiles/profile_impl.cc
+++ b/chrome/browser/profiles/profile_impl.cc
@@ -92,7 +92,10 @@
 #if defined(ENABLE_CONFIGURATION_POLICY)
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/policy/managed_mode_policy_provider.h"
+#if !defined(OS_CHROMEOS)
 #include "chrome/browser/policy/user_cloud_policy_manager.h"
+#include "chrome/browser/policy/user_cloud_policy_manager_factory.h"
+#endif
 #else
 #include "chrome/browser/policy/policy_service_stub.h"
 #endif  // defined(ENABLE_CONFIGURATION_POLICY)
@@ -340,25 +343,30 @@ ProfileImpl::ProfileImpl(
       g_browser_process->profile_manager() == NULL);
 
 #if defined(ENABLE_CONFIGURATION_POLICY)
-  // TODO(atwilson): Change these to ProfileKeyedServices once PrefService is
-  // a ProfileKeyedService (policy must be initialized before PrefService
-  // because PrefService depends on policy loading to get overridden pref
-  // values).
-  policy::BrowserPolicyConnector* connector =
-      g_browser_process->browser_policy_connector();
   // If we are creating the profile synchronously, then we should load the
   // policy data immediately.
   bool force_immediate_policy_load = (create_mode == CREATE_MODE_SYNCHRONOUS);
-  cloud_policy_manager_ =
-      connector->CreateCloudPolicyManager(this, force_immediate_policy_load);
-  if (cloud_policy_manager_)
+
+  // TODO(atwilson): Change |cloud_policy_manager_| and
+  // |managed_mode_policy_provider_| to proper ProfileKeyedServices once
+  // PrefService is a ProfileKeyedService (policy must be initialized before
+  // PrefService because PrefService depends on policy loading to get overridden
+  // pref values).
+#if !defined(OS_CHROMEOS)
+  if (command_line->HasSwitch(switches::kLoadCloudPolicyOnSignin)) {
+    cloud_policy_manager_ =
+        policy::UserCloudPolicyManagerFactory::CreateForProfile(
+            this, force_immediate_policy_load);
     cloud_policy_manager_->Init();
+  }
+#endif
   managed_mode_policy_provider_ =
       policy::ManagedModePolicyProvider::Create(this,
                                                 sequenced_task_runner,
                                                 force_immediate_policy_load);
   managed_mode_policy_provider_->Init();
-  policy_service_ = connector->CreatePolicyService(this);
+  policy_service_ =
+      g_browser_process->browser_policy_connector()->CreatePolicyService(this);
 #else
   policy_service_.reset(new policy::PolicyServiceStub());
 #endif
@@ -606,8 +614,6 @@ ProfileImpl::~ProfileImpl() {
     host_content_settings_map_->ShutdownOnUIThread();
 
 #if defined(ENABLE_CONFIGURATION_POLICY)
-  if (cloud_policy_manager_)
-    cloud_policy_manager_->Shutdown();
   if (managed_mode_policy_provider_)
     managed_mode_policy_provider_->Shutdown();
 #endif
@@ -752,14 +758,6 @@ Profile::ExitType ProfileImpl::GetLastSessionExitType() {
   return last_session_exit_type_;
 }
 
-policy::UserCloudPolicyManager* ProfileImpl::GetUserCloudPolicyManager() {
-#if defined(ENABLE_CONFIGURATION_POLICY)
-  return cloud_policy_manager_.get();
-#else
-  return NULL;
-#endif
-}
-
 policy::ManagedModePolicyProvider* ProfileImpl::GetManagedModePolicyProvider() {
 #if defined(ENABLE_CONFIGURATION_POLICY)
   return managed_mode_policy_provider_.get();
diff --git a/chrome/browser/profiles/profile_impl.h b/chrome/browser/profiles/profile_impl.h
index ed3918e..1e0096a 100644
--- a/chrome/browser/profiles/profile_impl.h
+++ b/chrome/browser/profiles/profile_impl.h
@@ -46,6 +46,10 @@ namespace extensions {
 class ExtensionSystem;
 }
 
+namespace policy {
+class UserCloudPolicyManager;
+}
+
 // The default profile implementation.
 class ProfileImpl : public Profile,
                     public content::NotificationObserver {
@@ -95,7 +99,6 @@ class ProfileImpl : public Profile,
   virtual ExtensionSpecialStoragePolicy*
       GetExtensionSpecialStoragePolicy() OVERRIDE;
   virtual GAIAInfoUpdateService* GetGAIAInfoUpdateService() OVERRIDE;
-  virtual policy::UserCloudPolicyManager* GetUserCloudPolicyManager() OVERRIDE;
   virtual policy::ManagedModePolicyProvider*
       GetManagedModePolicyProvider() OVERRIDE;
   virtual policy::PolicyService* GetPolicyService() OVERRIDE;
@@ -207,8 +210,10 @@ class ProfileImpl : public Profile,
   // |prefs_| depends on |policy_service_|, which depends on
   // |user_cloud_policy_manager_| and |managed_mode_policy_provider_|.
   // TODO(bauerb, mnissler): Once |prefs_| is a ProfileKeyedService, these
-  // should become ProfileKeyedServices as well.
+  // should become proper ProfileKeyedServices as well.
+#if !defined(OS_CHROMEOS)
   scoped_ptr<policy::UserCloudPolicyManager> cloud_policy_manager_;
+#endif
   scoped_ptr<policy::ManagedModePolicyProvider> managed_mode_policy_provider_;
 #endif
   scoped_ptr<policy::PolicyService> policy_service_;