22 files changed, 856 insertions, 440 deletions
diff --git a/chrome/browser/policy/configuration_policy_pref_store.cc b/chrome/browser/policy/configuration_policy_pref_store.cc
index 83916e8..7c3d17d 100644
--- a/chrome/browser/policy/configuration_policy_pref_store.cc
+++ b/chrome/browser/policy/configuration_policy_pref_store.cc
@@ -23,6 +23,7 @@
 #endif
 #include "chrome/browser/policy/device_management_policy_provider.h"
 #include "chrome/browser/policy/dummy_configuration_policy_provider.h"
+#include "chrome/browser/policy/profile_policy_context.h"
 #include "chrome/browser/search_engines/search_terms_data.h"
 #include "chrome/browser/search_engines/template_url.h"
 #include "chrome/common/chrome_paths.h"
@@ -374,7 +375,7 @@ ConfigurationPolicyPrefStore::CreateDeviceManagementPolicyPrefStore(
       Singleton<ConfigurationPolicyProviderKeeper>::get();
   ConfigurationPolicyProvider* provider = NULL;
   if (profile)
-    provider = profile->GetDeviceManagementPolicyProvider();
+    provider = profile->GetPolicyContext()->GetDeviceManagementPolicyProvider();
   if (!provider)
     provider = keeper->device_management_provider();
   return new ConfigurationPolicyPrefStore(provider);
diff --git a/chrome/browser/policy/device_management_backend_impl.cc b/chrome/browser/policy/device_management_backend_impl.cc
index c0e9b07..2808c19 100644
--- a/chrome/browser/policy/device_management_backend_impl.cc
+++ b/chrome/browser/policy/device_management_backend_impl.cc
@@ -7,22 +7,10 @@
 #include <utility>
 #include <vector>
 
-#include "base/stl_util-inl.h"
 #include "base/stringprintf.h"
-#include "chrome/browser/browser_thread.h"
-#include "chrome/common/net/url_request_context_getter.h"
-#include "net/base/cookie_monster.h"
 #include "net/base/escape.h"
-#include "net/base/host_resolver.h"
-#include "net/base/ssl_config_service_defaults.h"
-#include "net/http/http_auth_handler_factory.h"
-#include "net/http/http_network_layer.h"
-#include "net/proxy/proxy_service.h"
-#include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_status.h"
-#include "chrome/browser/browser_process.h"
-#include "chrome/browser/io_thread.h"
-#include "chrome/browser/net/chrome_net_log.h"
+#include "chrome/browser/policy/device_management_service.h"
 #include "chrome/common/chrome_version_info.h"
 
 namespace policy {
@@ -32,98 +20,20 @@ namespace {
 // Name constants for URL query parameters.
 const char kServiceParamRequest[] = "request";
 const char kServiceParamDeviceType[] = "devicetype";
+const char kServiceParamAppType[] = "apptype";
 const char kServiceParamDeviceID[] = "deviceid";
 const char kServiceParamAgent[] = "agent";
 
-// String constants for the device type and agent we report to the service.
-const char kServiceValueDeviceType[] = "Chrome";
+// String constants for the device and app type we report to the server.
+const char kServiceValueDeviceType[] = "Chrome OS";
+const char kServiceValueAppType[] = "Chrome";
+
 const char kServiceValueAgent[] =
     "%s enterprise management client version %s (%s)";
 
 const char kServiceTokenAuthHeader[] = "Authorization: GoogleLogin auth=";
 const char kDMTokenAuthHeader[] = "Authorization: GoogleDMToken token=";
 
-}  // namespace
-
-// Custom request context implementation that allows to override the user agent,
-// amongst others. Using the default request context is not an option since this
-// service may be constructed before the default request context is created
-// (i.e. before the profile has been loaded).
-class DeviceManagementBackendRequestContext : public URLRequestContext {
- public:
-  explicit DeviceManagementBackendRequestContext(IOThread::Globals* io_globals);
-  virtual ~DeviceManagementBackendRequestContext();
-
- private:
-  virtual const std::string& GetUserAgent(const GURL& url) const;
-
-  std::string user_agent_;
-};
-
-DeviceManagementBackendRequestContext::DeviceManagementBackendRequestContext(
-    IOThread::Globals* io_globals) {
-  net_log_ = io_globals->net_log.get();
-  host_resolver_ = io_globals->host_resolver.get();
-  proxy_service_ = net::ProxyService::CreateDirect();
-  ssl_config_service_ = net::SSLConfigService::CreateSystemSSLConfigService();
-  http_auth_handler_factory_ =
-      net::HttpAuthHandlerFactory::CreateDefault(host_resolver_);
-  http_transaction_factory_ =
-      net::HttpNetworkLayer::CreateFactory(host_resolver_,
-                                           io_globals->dnsrr_resolver.get(),
-                                           NULL /* ssl_host_info_factory */,
-                                           proxy_service_,
-                                           ssl_config_service_,
-                                           http_auth_handler_factory_,
-                                           NULL /* network_delegate */,
-                                           net_log_);
-  cookie_store_ = new net::CookieMonster(NULL, NULL);
-  user_agent_ = DeviceManagementBackendImpl::GetAgentString();
-  accept_language_ = "*";
-  accept_charset_ = "*";
-}
-
-DeviceManagementBackendRequestContext
-    ::~DeviceManagementBackendRequestContext() {
-  delete http_transaction_factory_;
-  delete http_auth_handler_factory_;
-}
-
-const std::string&
-DeviceManagementBackendRequestContext::GetUserAgent(const GURL& url) const {
-  return user_agent_;
-}
-
-// Request context holder.
-class DeviceManagementBackendRequestContextGetter
-    : public URLRequestContextGetter {
- public:
-  DeviceManagementBackendRequestContextGetter()
-      : io_thread_(g_browser_process->io_thread()) {}
-
-  // URLRequestContextGetter overrides.
-  virtual URLRequestContext* GetURLRequestContext();
-  virtual scoped_refptr<base::MessageLoopProxy> GetIOMessageLoopProxy() const;
-
- private:
-  scoped_refptr<URLRequestContext> context_;
-  IOThread* io_thread_;
-};
-
-
-URLRequestContext*
-DeviceManagementBackendRequestContextGetter::GetURLRequestContext() {
-  if (!context_)
-    context_ = new DeviceManagementBackendRequestContext(io_thread_->globals());
-
-  return context_.get();
-}
-
-scoped_refptr<base::MessageLoopProxy>
-DeviceManagementBackendRequestContextGetter::GetIOMessageLoopProxy() const {
-  return BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO);
-}
-
 // Helper class for URL query parameter encoding/decoding.
 class URLQueryParameters {
  public:
@@ -162,31 +72,96 @@ std::string URLQueryParameters::Encode() {
   return result;
 }
 
-// Wraps common response parsing and handling functionality.
-class ResponseHandler {
+}  // namespace
+
+// A base class containing the common code for the jobs created by the backend
+// implementation. Subclasses provide custom code for handling actual register,
+// unregister, and policy jobs.
+class DeviceManagementJobBase
+    : public DeviceManagementService::DeviceManagementJob {
  public:
-  ResponseHandler() {}
-  virtual ~ResponseHandler() {}
+  virtual ~DeviceManagementJobBase() {
+    backend_impl_->JobDone(this);
+  }
 
-  // Handles the URL request response.
-  void HandleResponse(const URLRequestStatus& status,
-                      int response_code,
-                      const ResponseCookies& cookies,
-                      const std::string& data);
+  // DeviceManagementJob overrides:
+  virtual void HandleResponse(const URLRequestStatus& status,
+                              int response_code,
+                              const ResponseCookies& cookies,
+                              const std::string& data);
+  virtual GURL GetURL(const std::string& server_url);
+  virtual void ConfigureRequest(URLFetcher* fetcher);
+
+ protected:
+  // Constructs a device management job running for the given backend.
+  DeviceManagementJobBase(DeviceManagementBackendImpl* backend_impl,
+                      const std::string& request_type)
+      : backend_impl_(backend_impl) {
+    query_params_.Put(kServiceParamRequest, request_type);
+    query_params_.Put(kServiceParamDeviceType, kServiceValueDeviceType);
+    query_params_.Put(kServiceParamAppType, kServiceValueAppType);
+    chrome::VersionInfo version_info;
+    std::string agent = base::StringPrintf(kServiceValueAgent,
+                                           version_info.Name().c_str(),
+                                           version_info.Version().c_str(),
+                                           version_info.LastChange().c_str());
+    query_params_.Put(kServiceParamAgent, agent);
+  }
 
-  // Forwards the given error to the delegate.
-  virtual void OnError(DeviceManagementBackend::ErrorCode error) = 0;
+  void SetQueryParam(const std::string& name, const std::string& value) {
+    query_params_.Put(name, value);
+  }
+
+  void SetAuthToken(const std::string& auth_token) {
+    auth_token_ = auth_token;
+  }
+
+  void SetDeviceManagementToken(const std::string& device_management_token) {
+    device_management_token_ = device_management_token;
+  }
+
+  void SetDeviceID(const std::string& device_id) {
+    query_params_.Put(kServiceParamDeviceID, device_id);
+  }
+
+  void SetPayload(const em::DeviceManagementRequest& request) {
+    if (!request.SerializeToString(&payload_)) {
+      NOTREACHED();
+      LOG(ERROR) << "Failed to serialize request.";
+    }
+  }
 
  private:
-  // Implemented by subclasses to handle the decoded response.
-  virtual void ProcessResponse(
+  // Implemented by subclasses to handle decoded responses and errors.
+  virtual void OnResponse(
       const em::DeviceManagementResponse& response) = 0;
+  virtual void OnError(DeviceManagementBackend::ErrorCode error) = 0;
+
+  // The backend this job is handling a request for.
+  DeviceManagementBackendImpl* backend_impl_;
+
+  // Query parameters.
+  URLQueryParameters query_params_;
+
+  // Auth token (if applicaple).
+  std::string auth_token_;
+
+  // Device management token (if applicable).
+  std::string device_management_token_;
+
+  // The payload.
+  std::string payload_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceManagementJobBase);
 };
 
-void ResponseHandler::HandleResponse(const URLRequestStatus& status,
-                                     int response_code,
-                                     const ResponseCookies& cookies,
-                                     const std::string& data) {
+void DeviceManagementJobBase::HandleResponse(const URLRequestStatus& status,
+                                             int response_code,
+                                             const ResponseCookies& cookies,
+                                             const std::string& data) {
+  // Delete ourselves when this is done.
+  scoped_ptr<DeviceManagementJob> scoped_killer(this);
+
   if (status.status() != URLRequestStatus::SUCCESS) {
     OnError(DeviceManagementBackend::kErrorRequestFailed);
     return;
@@ -226,77 +201,162 @@ void ResponseHandler::HandleResponse(const URLRequestStatus& status,
       return;
   }
 
-  ProcessResponse(response);
+  OnResponse(response);
+}
+
+GURL DeviceManagementJobBase::GetURL(
+    const std::string& server_url) {
+  return GURL(server_url + '?' + query_params_.Encode());
+}
+
+void DeviceManagementJobBase::ConfigureRequest(URLFetcher* fetcher) {
+  fetcher->set_upload_data("application/octet-stream", payload_);
+  std::string extra_headers;
+  if (!auth_token_.empty())
+    extra_headers += kServiceTokenAuthHeader + auth_token_ + "\n";
+  if (!device_management_token_.empty())
+    extra_headers += kDMTokenAuthHeader + device_management_token_ + "\n";
+  fetcher->set_extra_request_headers(extra_headers);
 }
 
-// Handles device registration responses.
-class RegisterResponseHandler : public ResponseHandler {
+// Handles device registration jobs.
+class DeviceManagementRegisterJob : public DeviceManagementJobBase {
  public:
-  RegisterResponseHandler(
-      DeviceManagementBackend::DeviceRegisterResponseDelegate* delegate)
-      : delegate_(delegate) {}
+  DeviceManagementRegisterJob(
+      DeviceManagementBackendImpl* backend_impl,
+      const std::string& auth_token,
+      const std::string& device_id,
+      const em::DeviceRegisterRequest& request,
+      DeviceManagementBackend::DeviceRegisterResponseDelegate* delegate);
+  virtual ~DeviceManagementRegisterJob() {}
 
  private:
-  // ResponseHandler overrides.
+  // DeviceManagementJobBase overrides.
   virtual void OnError(DeviceManagementBackend::ErrorCode error) {
     delegate_->OnError(error);
   }
-  virtual void ProcessResponse(const em::DeviceManagementResponse& response) {
+  virtual void OnResponse(const em::DeviceManagementResponse& response) {
     delegate_->HandleRegisterResponse(response.register_response());
   }
 
   DeviceManagementBackend::DeviceRegisterResponseDelegate* delegate_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceManagementRegisterJob);
 };
 
-// Handles device unregister responses.
-class UnregisterResponseHandler : public ResponseHandler {
+DeviceManagementRegisterJob::DeviceManagementRegisterJob(
+    DeviceManagementBackendImpl* backend_impl,
+    const std::string& auth_token,
+    const std::string& device_id,
+    const em::DeviceRegisterRequest& request,
+    DeviceManagementBackend::DeviceRegisterResponseDelegate* delegate)
+    : DeviceManagementJobBase(backend_impl, "register"),
+      delegate_(delegate) {
+  SetDeviceID(device_id);
+  SetAuthToken(auth_token);
+  em::DeviceManagementRequest request_wrapper;
+  request_wrapper.mutable_register_request()->CopyFrom(request);
+  SetPayload(request_wrapper);
+}
+
+// Handles device unregistration jobs.
+class DeviceManagementUnregisterJob : public DeviceManagementJobBase {
  public:
-  UnregisterResponseHandler(
-      DeviceManagementBackend::DeviceUnregisterResponseDelegate* delegate)
-      : delegate_(delegate) {}
+  DeviceManagementUnregisterJob(
+      DeviceManagementBackendImpl* backend_impl,
+      const std::string& device_management_token,
+      const em::DeviceUnregisterRequest& request,
+      DeviceManagementBackend::DeviceUnregisterResponseDelegate* delegate);
+  virtual ~DeviceManagementUnregisterJob() {}
 
  private:
-  // ResponseHandler overrides.
+  // DeviceManagementJobBase overrides.
   virtual void OnError(DeviceManagementBackend::ErrorCode error) {
     delegate_->OnError(error);
   }
-  virtual void ProcessResponse(const em::DeviceManagementResponse& response) {
+  virtual void OnResponse(const em::DeviceManagementResponse& response) {
     delegate_->HandleUnregisterResponse(response.unregister_response());
   }
 
   DeviceManagementBackend::DeviceUnregisterResponseDelegate* delegate_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceManagementUnregisterJob);
 };
 
-// Handles device policy responses.
-class PolicyResponseHandler : public ResponseHandler {
+DeviceManagementUnregisterJob::DeviceManagementUnregisterJob(
+    DeviceManagementBackendImpl* backend_impl,
+    const std::string& device_management_token,
+    const em::DeviceUnregisterRequest& request,
+    DeviceManagementBackend::DeviceUnregisterResponseDelegate* delegate)
+    : DeviceManagementJobBase(backend_impl, "unregister"),
+      delegate_(delegate) {
+  SetDeviceManagementToken(device_management_token);
+  em::DeviceManagementRequest request_wrapper;
+  request_wrapper.mutable_unregister_request()->CopyFrom(request);
+  SetPayload(request_wrapper);
+}
+
+// Handles policy request jobs.
+class DeviceManagementPolicyJob : public DeviceManagementJobBase {
  public:
-  PolicyResponseHandler(
-      DeviceManagementBackend::DevicePolicyResponseDelegate* delegate)
-      : delegate_(delegate) {}
+  DeviceManagementPolicyJob(
+      DeviceManagementBackendImpl* backend_impl,
+      const std::string& device_management_token,
+      const em::DevicePolicyRequest& request,
+      DeviceManagementBackend::DevicePolicyResponseDelegate* delegate);
+  virtual ~DeviceManagementPolicyJob() {}
 
  private:
-  // ResponseHandler overrides.
+  // DeviceManagementJobBase overrides.
   virtual void OnError(DeviceManagementBackend::ErrorCode error) {
     delegate_->OnError(error);
   }
-  virtual void ProcessResponse(const em::DeviceManagementResponse& response) {
+  virtual void OnResponse(const em::DeviceManagementResponse& response) {
     delegate_->HandlePolicyResponse(response.policy_response());
   }
 
   DeviceManagementBackend::DevicePolicyResponseDelegate* delegate_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceManagementPolicyJob);
 };
 
+DeviceManagementPolicyJob::DeviceManagementPolicyJob(
+    DeviceManagementBackendImpl* backend_impl,
+    const std::string& device_management_token,
+    const em::DevicePolicyRequest& request,
+    DeviceManagementBackend::DevicePolicyResponseDelegate* delegate)
+    : DeviceManagementJobBase(backend_impl, "policy"),
+      delegate_(delegate) {
+  SetDeviceManagementToken(device_management_token);
+  em::DeviceManagementRequest request_wrapper;
+  request_wrapper.mutable_policy_request()->CopyFrom(request);
+  SetPayload(request_wrapper);
+}
+
 DeviceManagementBackendImpl::DeviceManagementBackendImpl(
-    const std::string& server_url)
-    : server_url_(server_url),
-      request_context_getter_(
-          new DeviceManagementBackendRequestContextGetter()) {
+    DeviceManagementService* service)
+    : service_(service) {
 }
 
 DeviceManagementBackendImpl::~DeviceManagementBackendImpl() {
-  // Cancel all pending requests.
-  STLDeleteContainerPairPointers(response_handlers_.begin(),
-                                 response_handlers_.end());
+  // Swap to a helper, so we don't interfere with the unregistration on delete.
+  JobSet to_be_deleted;
+  to_be_deleted.swap(pending_jobs_);
+  for (JobSet::iterator job(to_be_deleted.begin());
+       job != to_be_deleted.end();
+       ++job) {
+    service_->RemoveJob(*job);
+    delete *job;
+  }
+}
+
+void DeviceManagementBackendImpl::JobDone(DeviceManagementJobBase* job) {
+  pending_jobs_.erase(job);
+}
+
+void DeviceManagementBackendImpl::AddJob(DeviceManagementJobBase* job) {
+  pending_jobs_.insert(job);
+  service_->AddJob(job);
 }
 
 void DeviceManagementBackendImpl::ProcessRegisterRequest(
@@ -304,112 +364,24 @@ void DeviceManagementBackendImpl::ProcessRegisterRequest(
     const std::string& device_id,
     const em::DeviceRegisterRequest& request,
     DeviceRegisterResponseDelegate* delegate) {
-  em::DeviceManagementRequest request_wrapper;
-  request_wrapper.mutable_register_request()->CopyFrom(request);
-
-  URLQueryParameters params;
-  PutCommonQueryParameters(&params);
-  params.Put(kServiceParamRequest, "register");
-  params.Put(kServiceParamDeviceID, device_id);
-
-  CreateFetcher(request_wrapper,
-                new RegisterResponseHandler(delegate),
-                params.Encode(),
-                kServiceTokenAuthHeader + auth_token);
+  AddJob(new DeviceManagementRegisterJob(this, auth_token, device_id, request,
+                                         delegate));
 }
 
 void DeviceManagementBackendImpl::ProcessUnregisterRequest(
     const std::string& device_management_token,
     const em::DeviceUnregisterRequest& request,
     DeviceUnregisterResponseDelegate* delegate) {
-  em::DeviceManagementRequest request_wrapper;
-  request_wrapper.mutable_unregister_request()->CopyFrom(request);
-
-  URLQueryParameters params;
-  PutCommonQueryParameters(&params);
-  params.Put(kServiceParamRequest, "unregister");
-
-  CreateFetcher(request_wrapper,
-                new UnregisterResponseHandler(delegate),
-                params.Encode(),
-                kDMTokenAuthHeader + device_management_token);
+  AddJob(new DeviceManagementUnregisterJob(this, device_management_token,
+                                           request, delegate));
 }
 
 void DeviceManagementBackendImpl::ProcessPolicyRequest(
     const std::string& device_management_token,
     const em::DevicePolicyRequest& request,
     DevicePolicyResponseDelegate* delegate) {
-  em::DeviceManagementRequest request_wrapper;
-  request_wrapper.mutable_policy_request()->CopyFrom(request);
-
-  URLQueryParameters params;
-  PutCommonQueryParameters(&params);
-  params.Put(kServiceParamRequest, "policy");
-
-  CreateFetcher(request_wrapper,
-                new PolicyResponseHandler(delegate),
-                params.Encode(),
-                kDMTokenAuthHeader + device_management_token);
-}
-
-// static
-std::string DeviceManagementBackendImpl::GetAgentString() {
-  chrome::VersionInfo version_info;
-  return base::StringPrintf(kServiceValueAgent,
-                            version_info.Name().c_str(),
-                            version_info.Version().c_str(),
-                            version_info.LastChange().c_str());
-}
-
-void DeviceManagementBackendImpl::OnURLFetchComplete(
-    const URLFetcher* source,
-    const GURL& url,
-    const URLRequestStatus& status,
-    int response_code,
-    const ResponseCookies& cookies,
-    const std::string& data) {
-  ResponseHandlerMap::iterator entry(response_handlers_.find(source));
-  if (entry != response_handlers_.end()) {
-    ResponseHandler* handler = entry->second;
-    handler->HandleResponse(status, response_code, cookies, data);
-    response_handlers_.erase(entry);
-    delete handler;
-  } else {
-    NOTREACHED() << "Callback from foreign URL fetcher";
-  }
-  delete source;
-}
-
-void DeviceManagementBackendImpl::CreateFetcher(
-    const em::DeviceManagementRequest& request,
-    ResponseHandler* handler,
-    const std::string& query_params,
-    const std::string& extra_headers) {
-  scoped_ptr<ResponseHandler> handler_ptr(handler);
-
-  // Construct the payload.
-  std::string payload;
-  if (!request.SerializeToString(&payload)) {
-    handler->OnError(DeviceManagementBackend::kErrorRequestInvalid);
-    return;
-  }
-
-  // Instantiate the fetcher.
-  GURL url(server_url_ + '?' + query_params);
-  URLFetcher* fetcher = URLFetcher::Create(0, url, URLFetcher::POST, this);
-  fetcher->set_request_context(request_context_getter_.get());
-  fetcher->set_upload_data("application/octet-stream", payload);
-  fetcher->set_extra_request_headers(extra_headers);
-  response_handlers_[fetcher] = handler_ptr.release();
-
-  // Start the request. The fetcher will call OnURLFetchComplete when done.
-  fetcher->Start();
-}
-
-void DeviceManagementBackendImpl::PutCommonQueryParameters(
-    URLQueryParameters* params) {
-  params->Put(kServiceParamDeviceType, kServiceValueDeviceType);
-  params->Put(kServiceParamAgent, GetAgentString());
+  AddJob(new DeviceManagementPolicyJob(this, device_management_token, request,
+                                       delegate));
 }
 
 }  // namespace policy
diff --git a/chrome/browser/policy/device_management_backend_impl.h b/chrome/browser/policy/device_management_backend_impl.h
index 648ca55..aa43681 100644
--- a/chrome/browser/policy/device_management_backend_impl.h
+++ b/chrome/browser/policy/device_management_backend_impl.h
@@ -6,29 +6,37 @@
 #define CHROME_BROWSER_POLICY_DEVICE_MANAGEMENT_BACKEND_IMPL_H_
 #pragma once
 
-#include <map>
+#include <set>
 #include <string>
 
+#include "base/basictypes.h"
 #include "chrome/browser/policy/device_management_backend.h"
-#include "chrome/common/net/url_fetcher.h"
-#include "googleurl/src/gurl.h"
-
-class URLRequestContextGetter;
 
 namespace policy {
 
-class ResponseHandler;
-class URLQueryParameters;
+class DeviceManagementService;
+class DeviceManagementJobBase;
 
-// Device management backend implementation. This implementation makes HTTP
-// requests to the policy server through the net layer.
-class DeviceManagementBackendImpl : public DeviceManagementBackend,
-                                    public URLFetcher::Delegate {
+// Implements the actual backend interface. It creates device management jobs
+// and passes them on to the service for processing.
+class DeviceManagementBackendImpl : public DeviceManagementBackend {
  public:
-  explicit DeviceManagementBackendImpl(const std::string& server_url);
+  explicit DeviceManagementBackendImpl(DeviceManagementService* service);
   virtual ~DeviceManagementBackendImpl();
 
-  // GoogleAppsPolicyService overrides:
+ private:
+  friend class DeviceManagementJobBase;
+
+  typedef std::set<DeviceManagementJobBase*> JobSet;
+
+  // Called by the DeviceManagementJobBase dtor so we can clean up.
+  void JobDone(DeviceManagementJobBase* job);
+
+  // Add a job to the pending job set and register it with the service (if
+  // available).
+  void AddJob(DeviceManagementJobBase* job);
+
+  // DeviceManagementBackend overrides.
   virtual void ProcessRegisterRequest(
       const std::string& auth_token,
       const std::string& device_id,
@@ -43,38 +51,10 @@ class DeviceManagementBackendImpl : public DeviceManagementBackend,
       const em::DevicePolicyRequest& request,
       DevicePolicyResponseDelegate* response_delegate);
 
-  // Get the agent string (used for HTTP user agent and as agent passed to the
-  // server).
-  static std::string GetAgentString();
-
- private:
-  typedef std::map<const URLFetcher*, ResponseHandler*> ResponseHandlerMap;
-
-  // URLFetcher::Delegate override.
-  virtual void OnURLFetchComplete(const URLFetcher* source,
-                                  const GURL& url,
-                                  const URLRequestStatus& status,
-                                  int response_code,
-                                  const ResponseCookies& cookies,
-                                  const std::string& data);
-
-  // Create a URLFetcher for a given request message and response handler.
-  void CreateFetcher(const em::DeviceManagementRequest& request,
-                     ResponseHandler* handler,
-                     const std::string& query_params,
-                     const std::string& extra_headers);
-
-  // Fill in the common query parameters.
-  void PutCommonQueryParameters(URLQueryParameters* params);
-
-  // Server at which to contact the service.
-  const std::string server_url_;
-
-  // The request context we use.
-  scoped_refptr<URLRequestContextGetter> request_context_getter_;
+  // Keeps track of the jobs currently in flight.
+  JobSet pending_jobs_;
 
-  // Keeps track of all in-flight requests an their response handlers.
-  ResponseHandlerMap response_handlers_;
+  DeviceManagementService* service_;
 
   DISALLOW_COPY_AND_ASSIGN(DeviceManagementBackendImpl);
 };
diff --git a/chrome/browser/policy/device_management_backend_mock.h b/chrome/browser/policy/device_management_backend_mock.h
index 170fe3a..9e082a6 100644
--- a/chrome/browser/policy/device_management_backend_mock.h
+++ b/chrome/browser/policy/device_management_backend_mock.h
@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_POLICY_DEVICE_MANAGEMENT_BACKEND_MOCK_H_
 #define CHROME_BROWSER_POLICY_DEVICE_MANAGEMENT_BACKEND_MOCK_H_
 
+#include "chrome/browser/policy/device_management_backend.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace policy {
diff --git a/chrome/browser/policy/device_management_policy_provider.cc b/chrome/browser/policy/device_management_policy_provider.cc
index fbf36ce..dc7bc00 100644
--- a/chrome/browser/policy/device_management_policy_provider.cc
+++ b/chrome/browser/policy/device_management_policy_provider.cc
@@ -11,7 +11,6 @@
 #include "base/time.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/policy/device_management_backend.h"
-#include "chrome/browser/policy/device_management_backend_impl.h"
 #include "chrome/browser/policy/device_management_policy_cache.h"
 #include "chrome/browser/policy/device_token_fetcher.h"
 #include "chrome/common/chrome_paths.h"
@@ -19,16 +18,12 @@
 #include "chrome/common/notification_service.h"
 #include "chrome/common/notification_type.h"
 
-namespace {
+namespace policy {
 
-const char kChromePolicyScope[] = "cros/device";
+const char kChromePolicyScope[] = "chromeos/device";
 const char kChromeDevicePolicySettingKey[] = "chrome-policy";
 const int64 kPolicyRefreshRateInMinutes = 3 * 60;  // 3 hours
 
-}  // namespace
-
-namespace policy {
-
 // Ensures that the portion of the policy provider implementation that requires
 // the IOThread is deferred until the IOThread is fully initialized. The policy
 // provider posts this task on the UI thread during its constructor, thereby
@@ -111,14 +106,6 @@ void DeviceManagementPolicyProvider::Shutdown() {
     token_fetcher_->Shutdown();
 }
 
-DeviceManagementBackend* DeviceManagementPolicyProvider::GetBackend() {
-  if (!backend_.get()) {
-    backend_.reset(new DeviceManagementBackendImpl(
-        GetDeviceManagementURL()));
-  }
-  return backend_.get();
-}
-
 void DeviceManagementPolicyProvider::Initialize() {
   registrar_.Add(this,
                  NotificationType::DEVICE_TOKEN_AVAILABLE,
@@ -140,7 +127,7 @@ void DeviceManagementPolicyProvider::InitializeAfterIOThreadExists() {
       FILE_PATH_LITERAL("Token"));
   if (token_service_) {
     token_fetcher_ =
-        new DeviceTokenFetcher(GetBackend(), token_service_, token_path);
+        new DeviceTokenFetcher(backend_.get(), token_service_, token_path);
     token_fetcher_->StartFetching();
   }
 }
@@ -152,9 +139,8 @@ void DeviceManagementPolicyProvider::SendPolicyRequest() {
     em::DevicePolicySettingRequest* setting =
         policy_request.add_setting_request();
     setting->set_key(kChromeDevicePolicySettingKey);
-    GetBackend()->ProcessPolicyRequest(token_fetcher_->GetDeviceToken(),
-                                       policy_request,
-                                       this);
+    backend_->ProcessPolicyRequest(token_fetcher_->GetDeviceToken(),
+                                   policy_request, this);
     policy_request_pending_ = true;
   }
 }
diff --git a/chrome/browser/policy/device_management_policy_provider.h b/chrome/browser/policy/device_management_policy_provider.h
index d73afc5..d91e22b 100644
--- a/chrome/browser/policy/device_management_policy_provider.h
+++ b/chrome/browser/policy/device_management_policy_provider.h
@@ -66,10 +66,6 @@ class DeviceManagementPolicyProvider
  private:
   class InitializeAfterIOThreadExistsTask;
 
-  // Returns the device management backend to use for backend requests, lazily
-  // creating a new one if one doesn't already exist.
-  DeviceManagementBackend* GetBackend();
-
   // Called by constructors to perform shared initialization. Initialization
   // requiring the IOThread must not be performed directly in this method,
   // rather must be deferred until the IOThread is fully initialized. This is
diff --git a/chrome/browser/policy/device_management_service.cc b/chrome/browser/policy/device_management_service.cc
new file mode 100644
index 0000000..44b1804
--- /dev/null
+++ b/chrome/browser/policy/device_management_service.cc
@@ -0,0 +1,185 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/device_management_service.h"
+
+#include "chrome/browser/browser_thread.h"
+#include "net/base/cookie_monster.h"
+#include "net/base/host_resolver.h"
+#include "net/base/load_flags.h"
+#include "net/base/ssl_config_service_defaults.h"
+#include "net/http/http_auth_handler_factory.h"
+#include "net/http/http_network_layer.h"
+#include "net/proxy/proxy_service.h"
+#include "net/url_request/url_request_context.h"
+#include "net/url_request/url_request_status.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/io_thread.h"
+#include "chrome/browser/net/chrome_net_log.h"
+#include "chrome/browser/policy/device_management_backend_impl.h"
+#include "chrome/common/net/url_request_context_getter.h"
+
+namespace policy {
+
+namespace {
+
+// Custom request context implementation that allows to override the user agent,
+// amongst others. Wraps a baseline request context from which we reuse the
+// networking components.
+class DeviceManagementBackendRequestContext : public URLRequestContext {
+ public:
+  explicit DeviceManagementBackendRequestContext(
+      URLRequestContext* base_context);
+  virtual ~DeviceManagementBackendRequestContext();
+};
+
+DeviceManagementBackendRequestContext::DeviceManagementBackendRequestContext(
+    URLRequestContext* base_context) {
+  // Share resolver, proxy service and ssl bits with the baseline context. This
+  // is important so we don't make redundant requests (e.g. when resolving proxy
+  // auto configuration).
+  net_log_ = base_context->net_log();
+  host_resolver_ = base_context->host_resolver();
+  proxy_service_ = base_context->proxy_service();
+  ssl_config_service_ = base_context->ssl_config_service();
+
+  // Share the http session.
+  http_transaction_factory_ = net::HttpNetworkLayer::CreateFactory(
+      base_context->http_transaction_factory()->GetSession());
+
+  // No cookies, please.
+  cookie_store_ = new net::CookieMonster(NULL, NULL);
+
+  // Initialize these to sane values for our purposes.
+  accept_language_ = "*";
+  accept_charset_ = "*";
+}
+
+DeviceManagementBackendRequestContext
+    ::~DeviceManagementBackendRequestContext() {
+  delete http_transaction_factory_;
+  delete http_auth_handler_factory_;
+}
+
+// Request context holder.
+class DeviceManagementBackendRequestContextGetter
+    : public URLRequestContextGetter {
+ public:
+  DeviceManagementBackendRequestContextGetter(
+      URLRequestContextGetter* base_context_getter)
+      : base_context_getter_(base_context_getter) {}
+
+  // URLRequestContextGetter overrides.
+  virtual URLRequestContext* GetURLRequestContext();
+  virtual scoped_refptr<base::MessageLoopProxy> GetIOMessageLoopProxy() const;
+
+ private:
+  scoped_refptr<URLRequestContext> context_;
+  scoped_refptr<URLRequestContextGetter> base_context_getter_;
+};
+
+
+URLRequestContext*
+DeviceManagementBackendRequestContextGetter::GetURLRequestContext() {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
+  if (!context_) {
+    context_ = new DeviceManagementBackendRequestContext(
+        base_context_getter_->GetURLRequestContext());
+  }
+
+  return context_.get();
+}
+
+scoped_refptr<base::MessageLoopProxy>
+DeviceManagementBackendRequestContextGetter::GetIOMessageLoopProxy() const {
+  return BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO);
+}
+
+}  // namespace
+
+DeviceManagementService::~DeviceManagementService() {
+  // All running jobs should have been canceled by now. If not, there are
+  // backend objects still around, which is an error.
+  DCHECK(pending_jobs_.empty());
+  DCHECK(queued_jobs_.empty());
+}
+
+DeviceManagementBackend* DeviceManagementService::CreateBackend() {
+  return new DeviceManagementBackendImpl(this);
+}
+
+void DeviceManagementService::Initialize(
+    URLRequestContextGetter* request_context_getter) {
+  DCHECK(!request_context_getter_);
+  request_context_getter_ = request_context_getter;
+  while (!queued_jobs_.empty()) {
+    StartJob(queued_jobs_.front());
+    queued_jobs_.pop_front();
+  }
+}
+
+void DeviceManagementService::Shutdown() {
+  for (JobFetcherMap::iterator job(pending_jobs_.begin());
+       job != pending_jobs_.end();
+       ++job) {
+    delete job->first;
+    queued_jobs_.push_back(job->second);
+  }
+}
+
+DeviceManagementService::DeviceManagementService(
+    const std::string& server_url)
+    : server_url_(server_url) {
+}
+
+void DeviceManagementService::AddJob(DeviceManagementJob* job) {
+  if (request_context_getter_.get())
+    StartJob(job);
+  else
+    queued_jobs_.push_back(job);
+}
+
+void DeviceManagementService::RemoveJob(DeviceManagementJob* job) {
+  for (JobFetcherMap::iterator entry(pending_jobs_.begin());
+       entry != pending_jobs_.end();
+       ++entry) {
+    if (entry->second == job) {
+      delete entry->first;
+      pending_jobs_.erase(entry);
+      break;
+    }
+  }
+}
+
+void DeviceManagementService::StartJob(DeviceManagementJob* job) {
+  URLFetcher* fetcher = URLFetcher::Create(0, job->GetURL(server_url_),
+                                           URLFetcher::POST, this);
+  fetcher->set_load_flags(net::LOAD_DO_NOT_SEND_COOKIES |
+                          net::LOAD_DO_NOT_SAVE_COOKIES |
+                          net::LOAD_DISABLE_CACHE);
+  fetcher->set_request_context(request_context_getter_.get());
+  job->ConfigureRequest(fetcher);
+  pending_jobs_[fetcher] = job;
+  fetcher->Start();
+}
+
+void DeviceManagementService::OnURLFetchComplete(
+    const URLFetcher* source,
+    const GURL& url,
+    const URLRequestStatus& status,
+    int response_code,
+    const ResponseCookies& cookies,
+    const std::string& data) {
+  JobFetcherMap::iterator entry(pending_jobs_.find(source));
+  if (entry != pending_jobs_.end()) {
+    DeviceManagementJob* job = entry->second;
+    job->HandleResponse(status, response_code, cookies, data);
+    pending_jobs_.erase(entry);
+  } else {
+    NOTREACHED() << "Callback from foreign URL fetcher";
+  }
+  delete source;
+}
+
+}  // namespace policy
diff --git a/chrome/browser/policy/device_management_service.h b/chrome/browser/policy/device_management_service.h
new file mode 100644
index 0000000..eab4c21
--- /dev/null
+++ b/chrome/browser/policy/device_management_service.h
@@ -0,0 +1,104 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_DEVICE_MANAGEMENT_SERVICE_H_
+#define CHROME_BROWSER_POLICY_DEVICE_MANAGEMENT_SERVICE_H_
+#pragma once
+
+#include <deque>
+#include <map>
+#include <string>
+
+#include "base/basictypes.h"
+#include "chrome/browser/policy/device_management_backend.h"
+#include "chrome/common/net/url_fetcher.h"
+#include "googleurl/src/gurl.h"
+
+class Profile;
+class URLRequestContextGetter;
+
+namespace policy {
+
+class DeviceManagementBackendImpl;
+
+// The device management service is responsible for everything related to
+// communication with the device management server. It creates the backends
+// objects that the device management policy provider and friends use to issue
+// requests.
+class DeviceManagementService : public URLFetcher::Delegate {
+ public:
+  // Describes a device management job handled by the service.
+  class DeviceManagementJob {
+   public:
+    virtual ~DeviceManagementJob() {}
+
+    // Handles the URL request response.
+    virtual void HandleResponse(const URLRequestStatus& status,
+                        int response_code,
+                        const ResponseCookies& cookies,
+                        const std::string& data) = 0;
+
+    // Gets the URL to contact.
+    virtual GURL GetURL(const std::string& server_url) = 0;
+
+    // Configures the fetcher, setting up payload and headers.
+    virtual void ConfigureRequest(URLFetcher* fetcher) = 0;
+  };
+
+  explicit DeviceManagementService(const std::string& server_url);
+  virtual ~DeviceManagementService();
+
+  // Constructs a device management backend for use by client code. Ownership of
+  // the returned backend object is transferred to the caller.
+  DeviceManagementBackend* CreateBackend();
+
+  // Provides the backend with a request context so it can make actual network
+  // requests. This will also fire any requests queued earlier.
+  void Initialize(URLRequestContextGetter* request_context_getter);
+
+  // Makes the service stop all requests and drop the reference to the request
+  // context.
+  void Shutdown();
+
+  // Adds a job. Caller must make sure the job pointer stays valid until the job
+  // completes or gets cancelled via RemoveJob().
+  void AddJob(DeviceManagementJob* job);
+
+  // Removes a job. The job will be removed and won't receive a completion
+  // callback.
+  void RemoveJob(DeviceManagementJob* job);
+
+ private:
+  typedef std::map<const URLFetcher*, DeviceManagementJob*> JobFetcherMap;
+  typedef std::deque<DeviceManagementJob*> JobQueue;
+
+  // Starts the given job.
+  void StartJob(DeviceManagementJob* job);
+
+  // URLFetcher::Delegate override.
+  virtual void OnURLFetchComplete(const URLFetcher* source,
+                                  const GURL& url,
+                                  const URLRequestStatus& status,
+                                  int response_code,
+                                  const ResponseCookies& cookies,
+                                  const std::string& data);
+
+  // Server at which to contact the service.
+  const std::string server_url_;
+
+  // The request context we use.
+  scoped_refptr<URLRequestContextGetter> request_context_getter_;
+
+  // The jobs we currently have in flight.
+  JobFetcherMap pending_jobs_;
+
+  // Jobs that are registered, but not started yet.
+  JobQueue queued_jobs_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeviceManagementService);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_DEVICE_MANAGEMENT_SERVICE_H_
diff --git a/chrome/browser/policy/device_management_backend_impl_browsertest.cc b/chrome/browser/policy/device_management_service_browsertest.cc
index 770317b..b7205b5 100644
--- a/chrome/browser/policy/device_management_backend_impl_browsertest.cc
+++ b/chrome/browser/policy/device_management_service_browsertest.cc
@@ -2,11 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/policy/device_management_backend_impl.h"
-
 #include "base/message_loop.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/policy/device_management_backend_mock.h"
+#include "chrome/browser/policy/device_management_service.h"
+#include "chrome/browser/profile.h"
+#include "chrome/browser/ui/browser.h"
 #include "chrome/test/in_process_browser_test.h"
 #include "net/test/test_server.h"
 #include "net/url_request/url_request.h"
@@ -21,9 +22,8 @@ using testing::InvokeWithoutArgs;
 
 namespace policy {
 
-namespace {
-
-const char kServiceUrl[] = "http://example.com/service";
+// Dummy service URL for testing with request interception enabled.
+const char kServiceUrl[] = "http://example.com/device_management";
 
 // Binary representation of successful register response containing a token.
 const char kServiceResponseRegister[] =
@@ -41,8 +41,6 @@ const char kServiceResponseUnregister[] =
 
 #define PROTO_STRING(name) (std::string(name, arraysize(name) - 1))
 
-}  // namespace
-
 // Interceptor implementation that returns test data back to the service.
 class CannedResponseInterceptor : public URLRequest::Interceptor {
  public:
@@ -75,7 +73,7 @@ class CannedResponseInterceptor : public URLRequest::Interceptor {
   const std::string response_data_;
 };
 
-class DeviceManagementBackendImplIntegrationTest : public InProcessBrowserTest {
+class DeviceManagementServiceIntegrationTest : public InProcessBrowserTest {
  public:
   void CaptureToken(const em::DeviceRegisterResponse& response) {
     token_ = response.device_management_token();
@@ -89,21 +87,23 @@ static void QuitMessageLoop() {
   MessageLoop::current()->Quit();
 }
 
-IN_PROC_BROWSER_TEST_F(DeviceManagementBackendImplIntegrationTest,
+IN_PROC_BROWSER_TEST_F(DeviceManagementServiceIntegrationTest,
                        CannedResponses) {
   URLFetcher::enable_interception_for_tests(true);
-  DeviceManagementBackendImpl service(kServiceUrl);
+  DeviceManagementService service(kServiceUrl);
+  service.Initialize(browser()->profile()->GetRequestContext());
+  scoped_ptr<DeviceManagementBackend> backend(service.CreateBackend());
 
   {
     CannedResponseInterceptor interceptor(
         GURL(kServiceUrl), PROTO_STRING(kServiceResponseRegister));
     DeviceRegisterResponseDelegateMock delegate;
     EXPECT_CALL(delegate, HandleRegisterResponse(_))
-        .WillOnce(DoAll(Invoke(this, &DeviceManagementBackendImplIntegrationTest
+        .WillOnce(DoAll(Invoke(this, &DeviceManagementServiceIntegrationTest
                                           ::CaptureToken),
                         InvokeWithoutArgs(QuitMessageLoop)));
     em::DeviceRegisterRequest request;
-    service.ProcessRegisterRequest("token", "device id", request, &delegate);
+    backend->ProcessRegisterRequest("token", "device id", request, &delegate);
     MessageLoop::current()->Run();
   }
 
@@ -118,7 +118,7 @@ IN_PROC_BROWSER_TEST_F(DeviceManagementBackendImplIntegrationTest,
     em::DevicePolicySettingRequest* setting_request =
         request.add_setting_request();
     setting_request->set_key("policy");
-    service.ProcessPolicyRequest(token_, request, &delegate);
+    backend->ProcessPolicyRequest(token_, request, &delegate);
 
     MessageLoop::current()->Run();
   }
@@ -130,29 +130,31 @@ IN_PROC_BROWSER_TEST_F(DeviceManagementBackendImplIntegrationTest,
     EXPECT_CALL(delegate, HandleUnregisterResponse(_))
         .WillOnce(InvokeWithoutArgs(QuitMessageLoop));
     em::DeviceUnregisterRequest request;
-    service.ProcessUnregisterRequest(token_, request, &delegate);
+    backend->ProcessUnregisterRequest(token_, request, &delegate);
 
     MessageLoop::current()->Run();
   }
 }
 
-IN_PROC_BROWSER_TEST_F(DeviceManagementBackendImplIntegrationTest,
+IN_PROC_BROWSER_TEST_F(DeviceManagementServiceIntegrationTest,
                        WithTestServer) {
-  net::TestServer test_server(
+  net::TestServer test_server_(
       net::TestServer::TYPE_HTTP,
       FilePath(FILE_PATH_LITERAL("chrome/test/data/policy")));
-  ASSERT_TRUE(test_server.Start());
-  DeviceManagementBackendImpl service(
-      test_server.GetURL("device_management").spec());
+  ASSERT_TRUE(test_server_.Start());
+  DeviceManagementService service(
+      test_server_.GetURL("device_management").spec());
+  service.Initialize(browser()->profile()->GetRequestContext());
+  scoped_ptr<DeviceManagementBackend> backend(service.CreateBackend());
 
   {
     DeviceRegisterResponseDelegateMock delegate;
     EXPECT_CALL(delegate, HandleRegisterResponse(_))
-        .WillOnce(DoAll(Invoke(this, &DeviceManagementBackendImplIntegrationTest
+        .WillOnce(DoAll(Invoke(this, &DeviceManagementServiceIntegrationTest
                                           ::CaptureToken),
                         InvokeWithoutArgs(QuitMessageLoop)));
     em::DeviceRegisterRequest request;
-    service.ProcessRegisterRequest("token", "device id", request, &delegate);
+    backend->ProcessRegisterRequest("token", "device id", request, &delegate);
     MessageLoop::current()->Run();
   }
 
@@ -167,7 +169,7 @@ IN_PROC_BROWSER_TEST_F(DeviceManagementBackendImplIntegrationTest,
     em::DevicePolicySettingRequest* setting_request =
         request.add_setting_request();
     setting_request->set_key("policy");
-    service.ProcessPolicyRequest(token_, request, &delegate);
+    backend->ProcessPolicyRequest(token_, request, &delegate);
 
     MessageLoop::current()->Run();
   }
@@ -177,7 +179,7 @@ IN_PROC_BROWSER_TEST_F(DeviceManagementBackendImplIntegrationTest,
     EXPECT_CALL(delegate, HandleUnregisterResponse(_))
         .WillOnce(InvokeWithoutArgs(QuitMessageLoop));
     em::DeviceUnregisterRequest request;
-    service.ProcessUnregisterRequest(token_, request, &delegate);
+    backend->ProcessUnregisterRequest(token_, request, &delegate);
 
     MessageLoop::current()->Run();
   }
diff --git a/chrome/browser/policy/device_management_backend_impl_unittest.cc b/chrome/browser/policy/device_management_service_unittest.cc
index 1e93f3a..cabc7f7 100644
--- a/chrome/browser/policy/device_management_backend_impl_unittest.cc
+++ b/chrome/browser/policy/device_management_service_unittest.cc
@@ -2,15 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/policy/device_management_backend_impl.h"
-
 #include "base/message_loop.h"
 #include "base/string_split.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/policy/device_management_backend_mock.h"
+#include "chrome/browser/policy/device_management_service.h"
 #include "chrome/common/net/test_url_fetcher_factory.h"
+#include "chrome/test/test_url_request_context_getter.h"
 #include "net/base/escape.h"
 #include "net/url_request/url_request_status.h"
+#include "net/url_request/url_request_unittest.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
@@ -18,9 +19,7 @@ using testing::_;
 
 namespace policy {
 
-namespace {
-
-const char kServiceURL[] = "https://example.com/management_service";
+const char kServiceUrl[] = "https://example.com/management_service";
 
 // Encoded error response messages for testing the error code paths.
 const char kResponseEmpty[] = "\x08\x00";
@@ -31,17 +30,18 @@ const char kResponseErrorActivationPending[] = "\x08\x04";
 
 #define PROTO_STRING(name) (std::string(name, arraysize(name) - 1))
 
-}  // namespace
-
-// Unit tests for the google apps policy backend. The pattern here is each test
-// case triggeres a request and installs a mock delegate. The test will run and
-// the default action installed on the test delegate will quit the loop.
+// Unit tests for the device management policy service. The tests are run
+// against a TestURLFetcherFactory that is used to short-circuit the request
+// without calling into the actual network stack.
 template<typename TESTBASE>
-class DeviceManagementBackendImplTestBase : public TESTBASE {
+class DeviceManagementServiceTestBase : public TESTBASE {
  protected:
-  DeviceManagementBackendImplTestBase()
-      : io_thread_(BrowserThread::IO, &loop_),
-        service_(kServiceURL) {}
+  DeviceManagementServiceTestBase()
+      : request_context_(new TestURLRequestContextGetter()),
+        io_thread_(BrowserThread::IO, &loop_) {
+    ResetService();
+    service_->Initialize(request_context_.get());
+  }
 
   virtual void SetUp() {
     URLFetcher::set_factory(&factory_);
@@ -49,13 +49,26 @@ class DeviceManagementBackendImplTestBase : public TESTBASE {
 
   virtual void TearDown() {
     URLFetcher::set_factory(NULL);
+    backend_.reset();
+    service_.reset();
+    request_context_ = NULL;
     loop_.RunAllPending();
   }
 
+  void ResetService() {
+    backend_.reset();
+    service_.reset(new DeviceManagementService(kServiceUrl));
+    backend_.reset(service_->CreateBackend());
+  }
+
+  TestURLFetcherFactory factory_;
+  scoped_refptr<TestURLRequestContextGetter> request_context_;
+  scoped_ptr<DeviceManagementService> service_;
+  scoped_ptr<DeviceManagementBackend> backend_;
+
+ private:
   MessageLoopForUI loop_;
   BrowserThread io_thread_;
-  TestURLFetcherFactory factory_;
-  DeviceManagementBackendImpl service_;
 };
 
 struct FailedRequestParams {
@@ -76,44 +89,44 @@ struct FailedRequestParams {
 
 // A parameterized test case for erroneous response situations, they're mostly
 // the same for all kinds of requests.
-class DeviceManagementBackendImplFailedRequestTest
-    : public DeviceManagementBackendImplTestBase<
+class DeviceManagementServiceFailedRequestTest
+    : public DeviceManagementServiceTestBase<
           testing::TestWithParam<FailedRequestParams> > {
 };
 
-TEST_P(DeviceManagementBackendImplFailedRequestTest, RegisterRequest) {
+TEST_P(DeviceManagementServiceFailedRequestTest, RegisterRequest) {
   DeviceRegisterResponseDelegateMock mock;
   EXPECT_CALL(mock, OnError(GetParam().expected_error_));
   em::DeviceRegisterRequest request;
-  service_.ProcessRegisterRequest("token", "device id", request, &mock);
+  backend_->ProcessRegisterRequest("token", "device id", request, &mock);
   TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
   ASSERT_TRUE(fetcher);
 
   fetcher->delegate()->OnURLFetchComplete(fetcher,
-                                          GURL(kServiceURL),
+                                          GURL(kServiceUrl),
                                           GetParam().request_status_,
                                           GetParam().http_status_,
                                           ResponseCookies(),
                                           GetParam().response_);
 }
 
-TEST_P(DeviceManagementBackendImplFailedRequestTest, UnregisterRequest) {
+TEST_P(DeviceManagementServiceFailedRequestTest, UnregisterRequest) {
   DeviceUnregisterResponseDelegateMock mock;
   EXPECT_CALL(mock, OnError(GetParam().expected_error_));
   em::DeviceUnregisterRequest request;
-  service_.ProcessUnregisterRequest("token", request, &mock);
+  backend_->ProcessUnregisterRequest("token", request, &mock);
   TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
   ASSERT_TRUE(fetcher);
 
   fetcher->delegate()->OnURLFetchComplete(fetcher,
-                                          GURL(kServiceURL),
+                                          GURL(kServiceUrl),
                                           GetParam().request_status_,
                                           GetParam().http_status_,
                                           ResponseCookies(),
                                           GetParam().response_);
 }
 
-TEST_P(DeviceManagementBackendImplFailedRequestTest, PolicyRequest) {
+TEST_P(DeviceManagementServiceFailedRequestTest, PolicyRequest) {
   DevicePolicyResponseDelegateMock mock;
   EXPECT_CALL(mock, OnError(GetParam().expected_error_));
   em::DevicePolicyRequest request;
@@ -121,12 +134,12 @@ TEST_P(DeviceManagementBackendImplFailedRequestTest, PolicyRequest) {
   em::DevicePolicySettingRequest* setting_request =
       request.add_setting_request();
   setting_request->set_key("policy");
-  service_.ProcessPolicyRequest("token", request, &mock);
+  backend_->ProcessPolicyRequest("token", request, &mock);
   TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
   ASSERT_TRUE(fetcher);
 
   fetcher->delegate()->OnURLFetchComplete(fetcher,
-                                          GURL(kServiceURL),
+                                          GURL(kServiceUrl),
                                           GetParam().request_status_,
                                           GetParam().http_status_,
                                           ResponseCookies(),
@@ -134,8 +147,8 @@ TEST_P(DeviceManagementBackendImplFailedRequestTest, PolicyRequest) {
 }
 
 INSTANTIATE_TEST_CASE_P(
-    DeviceManagementBackendImplFailedRequestTestInstance,
-    DeviceManagementBackendImplFailedRequestTest,
+    DeviceManagementServiceFailedRequestTestInstance,
+    DeviceManagementServiceFailedRequestTest,
     testing::Values(
         FailedRequestParams(
             DeviceManagementBackend::kErrorRequestFailed,
@@ -173,8 +186,8 @@ INSTANTIATE_TEST_CASE_P(
             200,
             PROTO_STRING(kResponseErrorActivationPending))));
 
-class DeviceManagementBackendImplTest
-    : public DeviceManagementBackendImplTestBase<testing::Test> {
+class DeviceManagementServiceTest
+    : public DeviceManagementServiceTestBase<testing::Test> {
 };
 
 MATCHER_P(MessageEquals, reference, "") {
@@ -225,19 +238,19 @@ class QueryParams {
   ParamMap params_;
 };
 
-TEST_F(DeviceManagementBackendImplTest, RegisterRequest) {
+TEST_F(DeviceManagementServiceTest, RegisterRequest) {
   DeviceRegisterResponseDelegateMock mock;
   em::DeviceRegisterResponse expected_response;
   expected_response.set_device_management_token("mtoken");
   EXPECT_CALL(mock, HandleRegisterResponse(MessageEquals(expected_response)));
   em::DeviceRegisterRequest request;
-  service_.ProcessRegisterRequest("token", "device id", request, &mock);
+  backend_->ProcessRegisterRequest("token", "device id", request, &mock);
   TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
   ASSERT_TRUE(fetcher);
 
   // Check the data the fetcher received.
   const GURL& request_url(fetcher->original_url());
-  const GURL service_url(kServiceURL);
+  const GURL service_url(kServiceUrl);
   EXPECT_EQ(service_url.scheme(), request_url.scheme());
   EXPECT_EQ(service_url.host(), request_url.host());
   EXPECT_EQ(service_url.port(), request_url.port());
@@ -261,25 +274,25 @@ TEST_F(DeviceManagementBackendImplTest, RegisterRequest) {
   ASSERT_TRUE(response_wrapper.SerializeToString(&response_data));
   URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
   fetcher->delegate()->OnURLFetchComplete(fetcher,
-                                          GURL(kServiceURL),
+                                          GURL(kServiceUrl),
                                           status,
                                           200,
                                           ResponseCookies(),
                                           response_data);
 }
 
-TEST_F(DeviceManagementBackendImplTest, UnregisterRequest) {
+TEST_F(DeviceManagementServiceTest, UnregisterRequest) {
   DeviceUnregisterResponseDelegateMock mock;
   em::DeviceUnregisterResponse expected_response;
   EXPECT_CALL(mock, HandleUnregisterResponse(MessageEquals(expected_response)));
   em::DeviceUnregisterRequest request;
-  service_.ProcessUnregisterRequest("dmtokenvalue", request, &mock);
+  backend_->ProcessUnregisterRequest("dmtokenvalue", request, &mock);
   TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
   ASSERT_TRUE(fetcher);
 
   // Check the data the fetcher received.
   const GURL& request_url(fetcher->original_url());
-  const GURL service_url(kServiceURL);
+  const GURL service_url(kServiceUrl);
   EXPECT_EQ(service_url.scheme(), request_url.scheme());
   EXPECT_EQ(service_url.host(), request_url.host());
   EXPECT_EQ(service_url.port(), request_url.port());
@@ -303,18 +316,18 @@ TEST_F(DeviceManagementBackendImplTest, UnregisterRequest) {
   ASSERT_TRUE(response_wrapper.SerializeToString(&response_data));
   URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
   fetcher->delegate()->OnURLFetchComplete(fetcher,
-                                          GURL(kServiceURL),
+                                          GURL(kServiceUrl),
                                           status,
                                           200,
                                           ResponseCookies(),
                                           response_data);
 }
 
-TEST_F(DeviceManagementBackendImplTest, PolicyRequest) {
+TEST_F(DeviceManagementServiceTest, PolicyRequest) {
   DevicePolicyResponseDelegateMock mock;
   em::DevicePolicyResponse expected_response;
   em::DevicePolicySetting* policy_setting = expected_response.add_setting();
-  policy_setting->set_policy_key("policy");
+  policy_setting->set_policy_key("chrome-policy");
   policy_setting->set_watermark("fresh");
   em::GenericSetting* policy_value = policy_setting->mutable_policy_value();
   em::GenericNamedValue* named_value = policy_value->add_named_value();
@@ -330,18 +343,18 @@ TEST_F(DeviceManagementBackendImplTest, PolicyRequest) {
   EXPECT_CALL(mock, HandlePolicyResponse(MessageEquals(expected_response)));
 
   em::DevicePolicyRequest request;
-  request.set_policy_scope("chromium");
+  request.set_policy_scope("chromeos/device");
   em::DevicePolicySettingRequest* setting_request =
       request.add_setting_request();
   setting_request->set_key("policy");
   setting_request->set_watermark("stale");
-  service_.ProcessPolicyRequest("dmtokenvalue", request, &mock);
+  backend_->ProcessPolicyRequest("dmtokenvalue", request, &mock);
   TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
   ASSERT_TRUE(fetcher);
 
   // Check the data the fetcher received.
   const GURL& request_url(fetcher->original_url());
-  const GURL service_url(kServiceURL);
+  const GURL service_url(kServiceUrl);
   EXPECT_EQ(service_url.scheme(), request_url.scheme());
   EXPECT_EQ(service_url.host(), request_url.host());
   EXPECT_EQ(service_url.port(), request_url.port());
@@ -365,7 +378,83 @@ TEST_F(DeviceManagementBackendImplTest, PolicyRequest) {
   ASSERT_TRUE(response_wrapper.SerializeToString(&response_data));
   URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
   fetcher->delegate()->OnURLFetchComplete(fetcher,
-                                          GURL(kServiceURL),
+                                          GURL(kServiceUrl),
+                                          status,
+                                          200,
+                                          ResponseCookies(),
+                                          response_data);
+}
+
+TEST_F(DeviceManagementServiceTest, CancelRegisterRequest) {
+  DeviceRegisterResponseDelegateMock mock;
+  EXPECT_CALL(mock, HandleRegisterResponse(_)).Times(0);
+  em::DeviceRegisterRequest request;
+  backend_->ProcessRegisterRequest("token", "device id", request, &mock);
+  TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
+  ASSERT_TRUE(fetcher);
+
+  // There shouldn't be any callbacks.
+  backend_.reset();
+}
+
+TEST_F(DeviceManagementServiceTest, CancelUnregisterRequest) {
+  DeviceUnregisterResponseDelegateMock mock;
+  EXPECT_CALL(mock, HandleUnregisterResponse(_)).Times(0);
+  em::DeviceUnregisterRequest request;
+  backend_->ProcessUnregisterRequest("dmtokenvalue", request, &mock);
+  TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
+  ASSERT_TRUE(fetcher);
+
+  // There shouldn't be any callbacks.
+  backend_.reset();
+}
+
+TEST_F(DeviceManagementServiceTest, CancelPolicyRequest) {
+  DevicePolicyResponseDelegateMock mock;
+  EXPECT_CALL(mock, HandlePolicyResponse(_)).Times(0);
+  em::DevicePolicyRequest request;
+  request.set_policy_scope("chromium");
+  em::DevicePolicySettingRequest* setting_request =
+      request.add_setting_request();
+  setting_request->set_key("policy");
+  setting_request->set_watermark("stale");
+  backend_->ProcessPolicyRequest("dmtokenvalue", request, &mock);
+  TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
+  ASSERT_TRUE(fetcher);
+
+  // There shouldn't be any callbacks.
+  backend_.reset();
+}
+
+TEST_F(DeviceManagementServiceTest, JobQueueing) {
+  // Start with a non-initialized service.
+  ResetService();
+
+  // Make a request. We should not see any fetchers being created.
+  DeviceRegisterResponseDelegateMock mock;
+  em::DeviceRegisterResponse expected_response;
+  expected_response.set_device_management_token("mtoken");
+  EXPECT_CALL(mock, HandleRegisterResponse(MessageEquals(expected_response)));
+  em::DeviceRegisterRequest request;
+  backend_->ProcessRegisterRequest("token", "device id", request, &mock);
+  TestURLFetcher* fetcher = factory_.GetFetcherByID(0);
+  ASSERT_FALSE(fetcher);
+
+  // Now initialize the service. That should start the job.
+  service_->Initialize(request_context_.get());
+  fetcher = factory_.GetFetcherByID(0);
+  ASSERT_TRUE(fetcher);
+  factory_.RemoveFetcherFromMap(0);
+
+  // Check that the request is processed as expected.
+  std::string response_data;
+  em::DeviceManagementResponse response_wrapper;
+  response_wrapper.set_error(em::DeviceManagementResponse::SUCCESS);
+  response_wrapper.mutable_register_response()->CopyFrom(expected_response);
+  ASSERT_TRUE(response_wrapper.SerializeToString(&response_data));
+  URLRequestStatus status(URLRequestStatus::SUCCESS, 0);
+  fetcher->delegate()->OnURLFetchComplete(fetcher,
+                                          GURL(kServiceUrl),
                                           status,
                                           200,
                                           ResponseCookies(),
diff --git a/chrome/browser/policy/profile_policy_context.cc b/chrome/browser/policy/profile_policy_context.cc
new file mode 100644
index 0000000..23b6758
--- /dev/null
+++ b/chrome/browser/policy/profile_policy_context.cc
@@ -0,0 +1,52 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/command_line.h"
+#include "chrome/browser/policy/configuration_policy_pref_store.h"
+#include "chrome/browser/policy/device_management_policy_provider.h"
+#include "chrome/browser/policy/device_management_service.h"
+#include "chrome/browser/policy/profile_policy_context.h"
+#include "chrome/browser/profile.h"
+#include "chrome/common/chrome_switches.h"
+
+namespace policy {
+
+ProfilePolicyContext::ProfilePolicyContext(Profile* profile)
+    : profile_(profile) {
+  CommandLine* command_line = CommandLine::ForCurrentProcess();
+  if (command_line->HasSwitch(switches::kDeviceManagementUrl)) {
+    device_management_service_.reset(new DeviceManagementService(
+        command_line->GetSwitchValueASCII(switches::kDeviceManagementUrl)));
+    device_management_policy_provider_.reset(
+        new policy::DeviceManagementPolicyProvider(
+            ConfigurationPolicyPrefStore::GetChromePolicyDefinitionList(),
+            device_management_service_->CreateBackend(),
+            profile_->GetTokenService(),
+            profile_->GetPath()));
+  }
+}
+
+ProfilePolicyContext::~ProfilePolicyContext() {
+  device_management_policy_provider_.reset();
+  device_management_service_.reset();
+}
+
+void ProfilePolicyContext::Initialize() {
+  if (device_management_service_.get())
+    device_management_service_->Initialize(profile_->GetRequestContext());
+}
+
+void ProfilePolicyContext::Shutdown() {
+  if (device_management_service_.get())
+    device_management_service_->Shutdown();
+  if (device_management_policy_provider_.get())
+    device_management_policy_provider_->Shutdown();
+}
+
+DeviceManagementPolicyProvider*
+ProfilePolicyContext::GetDeviceManagementPolicyProvider() {
+  return device_management_policy_provider_.get();
+}
+
+}  // namespace policy
diff --git a/chrome/browser/policy/profile_policy_context.h b/chrome/browser/policy/profile_policy_context.h
new file mode 100644
index 0000000..b343e15
--- /dev/null
+++ b/chrome/browser/policy/profile_policy_context.h
@@ -0,0 +1,51 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_PROFILE_POLICY_CONTEXT_H_
+#define CHROME_BROWSER_POLICY_PROFILE_POLICY_CONTEXT_H_
+#pragma once
+
+#include "base/scoped_ptr.h"
+
+class Profile;
+
+namespace policy {
+
+class DeviceManagementPolicyProvider;
+class DeviceManagementService;
+
+// This class is a container for the profile-specific policy bits located in the
+// profile. Since the context owns the policy provider, it's vital that it gets
+// initialized before the profile's prefs and destroyed after the prefs are
+// gone.
+class ProfilePolicyContext {
+ public:
+  explicit ProfilePolicyContext(Profile* profile);
+  ~ProfilePolicyContext();
+
+  // Initializes the context. Should be called only after the profile's request
+  // context is up.
+  void Initialize();
+
+  // Shuts the context down. This must be called before the networking
+  // infrastructure in the profile goes away.
+  void Shutdown();
+
+  // Get the policy provider.
+  DeviceManagementPolicyProvider* GetDeviceManagementPolicyProvider();
+
+ private:
+  // The profile this context is associated with.
+  Profile* profile_;
+
+  // The device management service.
+  scoped_ptr<DeviceManagementService> device_management_service_;
+
+  // Our provider.
+  scoped_ptr<DeviceManagementPolicyProvider> device_management_policy_provider_;
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_PROFILE_POLICY_CONTEXT_H_
diff --git a/chrome/browser/profile.cc b/chrome/browser/profile.cc
index 7b0c27f..2b10639 100644
--- a/chrome/browser/profile.cc
+++ b/chrome/browser/profile.cc
@@ -582,8 +582,7 @@ class OffTheRecordProfileImpl : public Profile,
     return profile_->GetExtensionInfoMap();
   }
 
-  virtual policy::DeviceManagementPolicyProvider*
-      GetDeviceManagementPolicyProvider() {
+  virtual policy::ProfilePolicyContext* GetPolicyContext() {
     return NULL;
   }
 
diff --git a/chrome/browser/profile.h b/chrome/browser/profile.h
index f76a273..ac70b74 100644
--- a/chrome/browser/profile.h
+++ b/chrome/browser/profile.h
@@ -31,7 +31,7 @@ class SSLConfigService;
 }
 
 namespace policy {
-class DeviceManagementPolicyProvider;
+class ProfilePolicyContext;
 }
 
 namespace webkit_database {
@@ -476,9 +476,8 @@ class Profile {
   // Returns the PromoCounter for Instant, or NULL if not applicable.
   virtual PromoCounter* GetInstantPromoCounter() = 0;
 
-  // Get the device management policy provider for this profile.
-  virtual policy::DeviceManagementPolicyProvider*
-      GetDeviceManagementPolicyProvider() = 0;
+  // Gets the device management service associated with this profile.
+  virtual policy::ProfilePolicyContext* GetPolicyContext() = 0;
 
 #if defined(OS_CHROMEOS)
   // Returns ChromeOS's ProxyConfigServiceImpl, creating if not yet created.
diff --git a/chrome/browser/profile_impl.cc b/chrome/browser/profile_impl.cc
index 8b62962e..464c45c 100644
--- a/chrome/browser/profile_impl.cc
+++ b/chrome/browser/profile_impl.cc
@@ -56,8 +56,7 @@
 #include "chrome/browser/password_manager/password_store_default.h"
 #include "chrome/browser/policy/configuration_policy_provider.h"
 #include "chrome/browser/policy/configuration_policy_pref_store.h"
-#include "chrome/browser/policy/device_management_backend_impl.h"
-#include "chrome/browser/policy/device_management_policy_provider.h"
+#include "chrome/browser/policy/profile_policy_context.h"
 #include "chrome/browser/prefs/browser_prefs.h"
 #include "chrome/browser/prefs/pref_value_store.h"
 #include "chrome/browser/printing/cloud_print/cloud_print_proxy_service.h"
@@ -355,6 +354,8 @@ ProfileImpl::ProfileImpl(const FilePath& path)
 
   extension_info_map_ = new ExtensionInfoMap();
 
+  GetPolicyContext()->Initialize();
+
   // Log the profile size after a reasonable startup delay.
   BrowserThread::PostDelayedTask(BrowserThread::FILE, FROM_HERE,
                                  new ProfileSizeTask(path_), 112000);
@@ -489,6 +490,8 @@ ProfileImpl::~ProfileImpl() {
       Source<Profile>(this),
       NotificationService::NoDetails());
 
+  GetPolicyContext()->Shutdown();
+
   tab_restore_service_ = NULL;
 
   StopCreateSessionServiceTimer();
@@ -514,10 +517,6 @@ ProfileImpl::~ProfileImpl() {
   // Delete the NTP resource cache so we can unregister pref observers.
   ntp_resource_cache_.reset();
 
-  // Shut down the DM policy provider before the token service dies.
-  if (device_management_policy_provider_.get())
-    device_management_policy_provider_->Shutdown();
-
   // The sync service needs to be deleted before the services it calls.
   sync_service_.reset();
 
@@ -1319,24 +1318,11 @@ ExtensionInfoMap* ProfileImpl::GetExtensionInfoMap() {
   return extension_info_map_.get();
 }
 
-policy::DeviceManagementPolicyProvider*
-ProfileImpl::GetDeviceManagementPolicyProvider() {
-  CommandLine* command_line = CommandLine::ForCurrentProcess();
-  if (!command_line->HasSwitch(switches::kDeviceManagementUrl))
-    return NULL;
+policy::ProfilePolicyContext* ProfileImpl::GetPolicyContext() {
+  if (!profile_policy_context_.get())
+    profile_policy_context_.reset(new policy::ProfilePolicyContext(this));
 
-  if (!device_management_policy_provider_.get()) {
-    device_management_policy_provider_.reset(
-        new policy::DeviceManagementPolicyProvider(
-            policy::ConfigurationPolicyPrefStore::
-                GetChromePolicyDefinitionList(),
-            new policy::DeviceManagementBackendImpl(
-                command_line->GetSwitchValueASCII(
-                    switches::kDeviceManagementUrl)),
-            GetTokenService(),
-            GetPath()));
-  }
-  return device_management_policy_provider_.get();
+  return profile_policy_context_.get();
 }
 
 PromoCounter* ProfileImpl::GetInstantPromoCounter() {
diff --git a/chrome/browser/profile_impl.h b/chrome/browser/profile_impl.h
index b5fd6f8..ea64bda 100644
--- a/chrome/browser/profile_impl.h
+++ b/chrome/browser/profile_impl.h
@@ -124,8 +124,7 @@ class ProfileImpl : public Profile,
   virtual ExtensionInfoMap* GetExtensionInfoMap();
   virtual PromoCounter* GetInstantPromoCounter();
   virtual BrowserSignin* GetBrowserSignin();
-  virtual policy::DeviceManagementPolicyProvider*
-      GetDeviceManagementPolicyProvider();
+  virtual policy::ProfilePolicyContext* GetPolicyContext();
 
 #if defined(OS_CHROMEOS)
   virtual chromeos::ProxyConfigServiceImpl* GetChromeOSProxyConfigServiceImpl();
@@ -180,6 +179,7 @@ class ProfileImpl : public Profile,
       transport_security_state_;
   scoped_refptr<TransportSecurityPersister>
       transport_security_persister_;
+  scoped_ptr<policy::ProfilePolicyContext> profile_policy_context_;
   scoped_ptr<PrefService> prefs_;
   scoped_ptr<NetPrefObserver> net_pref_observer_;
   scoped_ptr<TemplateURLFetcher> template_url_fetcher_;
@@ -273,9 +273,6 @@ class ProfileImpl : public Profile,
 
   scoped_refptr<ExtensionInfoMap> extension_info_map_;
 
-  scoped_ptr<policy::DeviceManagementPolicyProvider>
-      device_management_policy_provider_;
-
 #if defined(OS_CHROMEOS)
   scoped_ptr<chromeos::Preferences> chromeos_preferences_;
 
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index 7a547cd..1073f1a 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -2413,6 +2413,8 @@
         'browser/policy/device_management_backend.h',
         'browser/policy/device_management_backend_impl.cc',
         'browser/policy/device_management_backend_impl.h',
+        'browser/policy/device_management_service.cc',
+        'browser/policy/device_management_service.h',
         'browser/policy/device_management_policy_cache.cc',
         'browser/policy/device_management_policy_cache.h',
         'browser/policy/device_management_policy_provider.cc',
@@ -2424,6 +2426,8 @@
         'browser/policy/file_based_policy_provider.h',
         'browser/policy/managed_prefs_banner_base.cc',
         'browser/policy/managed_prefs_banner_base.h',
+        'browser/policy/profile_policy_context.cc',
+        'browser/policy/profile_policy_context.h',
         # TODO(danno): Find a better way to include these files
         '<(protoc_out_dir)/chrome/browser/policy/proto/device_management_backend.pb.cc',
         '<(protoc_out_dir)/chrome/browser/policy/proto/device_management_backend.pb.h',
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index 5ddfcdc..dcad7d7 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -119,6 +119,7 @@
         'test/test_location_bar.h',
         'test/test_switches.cc',
         'test/test_switches.h',
+        'test/test_url_request_context_getter.h',
         'test/testing_pref_service.cc',
         'test/testing_pref_service.h',
         'test/testing_profile.cc',
@@ -1396,8 +1397,8 @@
         'browser/policy/configuration_policy_provider_win_unittest.cc',
         'browser/policy/device_token_fetcher_unittest.cc',
         'browser/policy/file_based_policy_provider_unittest.cc',
-        'browser/policy/device_management_backend_impl_unittest.cc',
         'browser/policy/device_management_backend_mock.h',
+        'browser/policy/device_management_service_unittest.cc',
         'browser/policy/device_management_policy_cache_unittest.cc',
         'browser/policy/device_management_policy_provider_unittest.cc',
         'browser/policy/managed_prefs_banner_base_unittest.cc',
@@ -2039,8 +2040,8 @@
         'browser/net/cookie_policy_browsertest.cc',
         'browser/net/ftp_browsertest.cc',
         'browser/plugin_service_browsertest.cc',
-        'browser/policy/device_management_backend_impl_browsertest.cc',
         'browser/policy/device_management_backend_mock.h',
+        'browser/policy/device_management_service_browsertest.cc',
         'browser/popup_blocker_browsertest.cc',
         'browser/printing/print_dialog_cloud_uitest.cc',
         'browser/renderer_host/test/render_process_host_browsertest.cc',
diff --git a/chrome/test/test_url_request_context_getter.h b/chrome/test/test_url_request_context_getter.h
new file mode 100644
index 0000000..8ac7b05
--- /dev/null
+++ b/chrome/test/test_url_request_context_getter.h
@@ -0,0 +1,33 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_TEST_TEST_URL_REQUEST_CONTEXT_GETTER_H_
+#define CHROME_TEST_TEST_URL_REQUEST_CONTEXT_GETTER_H_
+
+#include "base/ref_counted.h"
+#include "chrome/browser/browser_thread.h"
+#include "chrome/common/net/url_request_context_getter.h"
+#include "net/url_request/url_request_unittest.h"
+
+// Used to return a dummy context (normally the context is on the IO thread).
+// The one here can be run on the main test thread. Note that this can lead to
+// a leak if your test does not have a BrowserThread::IO in it because
+// URLRequestContextGetter is defined as a ReferenceCounted object with a
+// special trait that deletes it on the IO thread.
+class TestURLRequestContextGetter : public URLRequestContextGetter {
+ public:
+  virtual URLRequestContext* GetURLRequestContext() {
+    if (!context_)
+      context_ = new TestURLRequestContext();
+    return context_.get();
+  }
+  virtual scoped_refptr<base::MessageLoopProxy> GetIOMessageLoopProxy() const {
+    return BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO);
+  }
+
+ private:
+  scoped_refptr<URLRequestContext> context_;
+};
+
+#endif  // CHROME_TEST_TEST_URL_REQUEST_CONTEXT_GETTER_H_
diff --git a/chrome/test/testing_profile.cc b/chrome/test/testing_profile.cc
index 546e779..184a703 100644
--- a/chrome/test/testing_profile.cc
+++ b/chrome/test/testing_profile.cc
@@ -39,6 +39,7 @@
 #include "chrome/common/notification_service.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/testing_pref_service.h"
+#include "chrome/test/test_url_request_context_getter.h"
 #include "chrome/test/ui_test_utils.h"
 #include "net/base/cookie_monster.h"
 #include "net/url_request/url_request_context.h"
@@ -111,26 +112,6 @@ class BookmarkLoadObserver : public BookmarkModelObserver {
   DISALLOW_COPY_AND_ASSIGN(BookmarkLoadObserver);
 };
 
-// Used to return a dummy context (normally the context is on the IO thread).
-// The one here can be run on the main test thread. Note that this can lead to
-// a leak if your test does not have a BrowserThread::IO in it because
-// URLRequestContextGetter is defined as a ReferenceCounted object with a
-// special trait that deletes it on the IO thread.
-class TestURLRequestContextGetter : public URLRequestContextGetter {
- public:
-  virtual URLRequestContext* GetURLRequestContext() {
-    if (!context_)
-      context_ = new TestURLRequestContext();
-    return context_.get();
-  }
-  virtual scoped_refptr<base::MessageLoopProxy> GetIOMessageLoopProxy() const {
-    return BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO);
-  }
-
- private:
-  scoped_refptr<URLRequestContext> context_;
-};
-
 class TestExtensionURLRequestContext : public URLRequestContext {
  public:
   TestExtensionURLRequestContext() {
diff --git a/chrome/test/testing_profile.h b/chrome/test/testing_profile.h
index 126dfcf..dbfa266 100644
--- a/chrome/test/testing_profile.h
+++ b/chrome/test/testing_profile.h
@@ -308,10 +308,7 @@ class TestingProfile : public Profile {
   virtual ChromeBlobStorageContext* GetBlobStorageContext() { return NULL; }
   virtual ExtensionInfoMap* GetExtensionInfoMap() { return NULL; }
   virtual PromoCounter* GetInstantPromoCounter() { return NULL; }
-  virtual policy::DeviceManagementPolicyProvider*
-      GetDeviceManagementPolicyProvider() {
-    return NULL;
-  }
+  virtual policy::ProfilePolicyContext* GetPolicyContext() { return NULL; }
 
  protected:
   base::Time start_time_;
diff --git a/net/tools/testserver/device_management.py b/net/tools/testserver/device_management.py
index 7037608..aec323a 100644
--- a/net/tools/testserver/device_management.py
+++ b/net/tools/testserver/device_management.py
@@ -186,7 +186,7 @@ class RequestHandler(object):
 
     # Respond only if the client requested policy for the cros/device scope,
     # since that's where chrome policy is supposed to live in.
-    if msg.policy_scope == 'cros/device':
+    if msg.policy_scope == 'chromeos/device':
       setting = response.policy_response.setting.add()
       setting.policy_key = 'chrome-policy'
       policy_value = dm.GenericSetting()
@@ -226,17 +226,17 @@ class RequestHandler(object):
       will contain the error response to send back.
     """
     error = None
-
+    dmtoken = None
     match = re.match('GoogleDMToken token=(\\w+)',
                      self._headers.getheader('Authorization', ''))
     if match:
       dmtoken = match.group(1)
-      if not dmtoken:
-        error = dm.DeviceManagementResponse.DEVICE_MANAGEMENT_TOKEN_INVALID
-      elif not self._server.LookupDevice(dmtoken):
-        error = dm.DeviceManagementResponse.DEVICE_NOT_FOUND
-      else:
-        return (dmtoken, None)
+    if not dmtoken:
+      error = dm.DeviceManagementResponse.DEVICE_MANAGEMENT_TOKEN_INVALID
+    elif not self._server.LookupDevice(dmtoken):
+      error = dm.DeviceManagementResponse.DEVICE_NOT_FOUND
+    else:
+      return (dmtoken, None)
 
     response = dm.DeviceManagementResponse()
     response.error = error