Only import certificates with Web trust from ONC if the user is managed and matches the enterprise …

chrome/browser/policy/network_configuration_updater.h

Index: chrome/browser/policy/network_configuration_updater.h
diff --git a/chrome/browser/policy/network_configuration_updater.h b/chrome/browser/policy/network_configuration_updater.h
index 325d10fcf7adff36a5344a343e69030a82c5af0f..b83818f3ef713f490f75d5f4459856d4759e185a 100644
--- a/chrome/browser/policy/network_configuration_updater.h
+++ b/chrome/browser/policy/network_configuration_updater.h
@@ -30,6 +30,11 @@ class NetworkConfigurationUpdater {
                               chromeos::NetworkLibrary* network_library);
   virtual ~NetworkConfigurationUpdater();
 
+  // Web trust isn't given to certificates imported from ONC by default.
+  // Setting |allow_web_trust| to true allows giving Web trust to the
+  // certificates that request it.
+  void set_allow_web_trust(bool allow) { allow_web_trust_ = allow; }
+
   // Empty network configuration blob.
   static const char kEmptyConfiguration[];
 
@@ -48,6 +53,9 @@ class NetworkConfigurationUpdater {
   // Network library to write network configuration to.
   chromeos::NetworkLibrary* network_library_;
 
+  // Whether Web trust is allowed or not.
+  bool allow_web_trust_;
+
   // Current settings.
   std::string device_network_config_;
   std::string user_network_config_;