Added code to persist downloaded cloud policy to disk.

chrome/browser/policy/user_policy_signin_service.cc

Index: chrome/browser/policy/user_policy_signin_service.cc
diff --git a/chrome/browser/policy/user_policy_signin_service.cc b/chrome/browser/policy/user_policy_signin_service.cc
index 32137bed32844b32707c8e458b47f3748daa9974..d386c9713e14b325b074edc60fd0ff5cd1166a29 100644
--- a/chrome/browser/policy/user_policy_signin_service.cc
+++ b/chrome/browser/policy/user_policy_signin_service.cc
@@ -125,13 +125,20 @@ void UserPolicySigninService::ConfigureUserCloudPolicyManager() {
       DCHECK(manager_->cloud_policy_service());
     }
 
-    // Register the CloudPolicyService if needed.
-    if (!manager_->IsClientRegistered())
+    // Register the CloudPolicyService if the cloud policy store is complete.
+    // TODO(atwilson): If there's a problem loading the stored policy, we could
+    // be left with no policy, so we should move this code to
+    // UserCloudPolicyManager and have it initiate a DMToken fetch only once
+    // the policy load is complete (http://crbug.com/143187).
+    if (!manager_->IsClientRegistered() &&
+        manager_->cloud_policy_service()->store()->is_initialized()) {

[Mattias Nissler (ping if slow), 2012/08/20 15:29:30]

Isn't this racy? What if the store just hasn't initialized yet?

[Andrew T Wilson (Slow), 2012/08/20 18:04:37]

It is indeed racy. The solution is to move the registration code into
UserCloudPolicyManager, per the TODO. I didn't want to bother trying to address
the race condition in this code, only to have to re-address it a different way
when I move it to UCPM.

The race condition is OK for now, since there are basically only 3 situations:

a) there are no downloaded policies yet - in this case, it seems that we always
initialize the store before the token DB finishes loading (since they share the
same thread). Obviously this is fragile, but it's good enough until we address
the TODO.
b) There are stored policies, and they fail to validate
c) There are stored policies, and they don't fail to validate - in that case,
when the store finishes initializing, the CloudPolicyService will register the
client using the DM token from the policy.

So the only case that fails currently is b), which I've mentioned in the
comment. I think this is fine for now, but obviously the TODO must be addressed
in short order/before launch.

[Mattias Nissler (ping if slow), 2012/08/21 10:45:16]

Fair enough. Also mention a) in the comment?

[Andrew T Wilson (Slow), 2012/08/21 23:18:19]

Done.

       RegisterCloudPolicyService();
+    }
   }
 }
 
 void UserPolicySigninService::RegisterCloudPolicyService() {
+  DVLOG(1) << "Fetching new DM Token";
   // TODO(atwilson): Move the code to mint the devicemanagement token into
   // TokenService.
   std::string token = TokenServiceFactory::GetForProfile(profile_)->
@@ -170,6 +177,7 @@ void UserPolicySigninService::OnGetTokenSuccess(
     const std::string& access_token,
     const base::Time& expiration_time) {
   // Pass along the new access token to the CloudPolicyClient.
+  DVLOG(1) << "Fetched new scoped OAuth token:" << access_token;
   manager_->RegisterClient(access_token);
   oauth2_access_token_fetcher_.reset();
 }