Device robot refresh token integrity validation.

Before using the robot account refresh token stored in an enterprise
device's Local State, verify that the token is owned by the service
account id found in the device policy.

BUG=245121

Review URL: https://chromiumcodereview.appspot.com/17109006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@208019 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 5 insertions, 11 deletions

diff --git a/remoting/host/setup/host_starter.cc b/remoting/host/setup/host_starter.cc
index d44059d..1d69ef0 100644
--- a/remoting/host/setup/host_starter.cc
+++ b/remoting/host/setup/host_starter.cc
@@ -34,12 +34,10 @@ HostStarter::~HostStarter() {
 }
 
 scoped_ptr<HostStarter> HostStarter::Create(
-    const std::string& oauth2_token_url,
     const std::string& chromoting_hosts_url,
     net::URLRequestContextGetter* url_request_context_getter) {
   scoped_ptr<gaia::GaiaOAuthClient> oauth_client(
-      new gaia::GaiaOAuthClient(
-          oauth2_token_url, url_request_context_getter));
+      new gaia::GaiaOAuthClient(url_request_context_getter));
   scoped_ptr<remoting::ServiceClient> service_client(
       new remoting::ServiceClient(
           chromoting_hosts_url, url_request_context_getter));
diff --git a/remoting/host/setup/host_starter.h b/remoting/host/setup/host_starter.h
index e743a75..a8b90f2 100644
--- a/remoting/host/setup/host_starter.h
+++ b/remoting/host/setup/host_starter.h
@@ -33,7 +33,6 @@ class HostStarter : public gaia::GaiaOAuthClient::Delegate,
 
   // Creates a HostStarter.
   static scoped_ptr<HostStarter> Create(
-      const std::string& oauth2_token_url,
       const std::string& chromoting_hosts_url,
       net::URLRequestContextGetter* url_request_context_getter);
 
diff --git a/remoting/host/setup/start_host.cc b/remoting/host/setup/start_host.cc
index 1338156..fc2390d 100644
--- a/remoting/host/setup/start_host.cc
+++ b/remoting/host/setup/start_host.cc
@@ -10,7 +10,6 @@
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
 #include "base/threading/thread.h"
-#include "google_apis/gaia/gaia_urls.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "remoting/host/service_urls.h"
@@ -160,7 +159,6 @@ int main(int argc, char** argv) {
 
   // Start the host.
   scoped_ptr<HostStarter> host_starter(HostStarter::Create(
-      GaiaUrls::GetInstance()->oauth2_token_url(),
       remoting::ServiceUrls::GetInstance()->directory_hosts_url(),
       url_request_context_getter.get()));
   if (redirect_url.empty()) {
diff --git a/remoting/host/setup/win/start_host_window.cc b/remoting/host/setup/win/start_host_window.cc
index 87bd9eb..3712dae 100644
--- a/remoting/host/setup/win/start_host_window.cc
+++ b/remoting/host/setup/win/start_host_window.cc
@@ -22,7 +22,6 @@ namespace remoting {
 StartHostWindow::StartHostWindow(
     scoped_refptr<net::URLRequestContextGetter> url_request_context_getter)
     : host_starter_(remoting::HostStarter::Create(
-          GaiaUrls::GetInstance()->oauth2_token_url(),
           remoting::ServiceUrls::GetInstance()->directory_hosts_url(),
           url_request_context_getter)),
       consent_to_collect_data_(true),
diff --git a/remoting/host/signaling_connector.cc b/remoting/host/signaling_connector.cc
index 29298f7..36af665 100644
--- a/remoting/host/signaling_connector.cc
+++ b/remoting/host/signaling_connector.cc
@@ -6,7 +6,6 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
-#include "google_apis/gaia/gaia_urls.h"
 #include "google_apis/google_api_keys.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_context_getter.h"
@@ -61,8 +60,7 @@ void SignalingConnector::EnableOAuth(
     scoped_ptr<OAuthCredentials> oauth_credentials) {
   oauth_credentials_ = oauth_credentials.Pass();
   gaia_oauth_client_.reset(
-      new gaia::GaiaOAuthClient(GaiaUrls::GetInstance()->oauth2_token_url(),
-                                url_request_context_getter_.get()));
+      new gaia::GaiaOAuthClient(url_request_context_getter_.get()));
 }
 
 void SignalingConnector::OnSignalStrategyStateChange(
@@ -239,8 +237,10 @@ void SignalingConnector::RefreshOAuthToken() {
   };
 
   refreshing_oauth_token_ = true;
+  std::vector<std::string> empty_scope_list;  // (Use scope from refresh token.)
   gaia_oauth_client_->RefreshToken(
-      client_info, oauth_credentials_->refresh_token, 1, this);
+      client_info, oauth_credentials_->refresh_token, empty_scope_list,
+      1, this);
 }
 
 }  // namespace remoting