Added policy for disabling locally managed users.

Added policy for disabling locally managed users.
By default LMU disabled for managed devices.

Also added support of new policy in ChromeOS part.

BUG=229298
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=207978

[dzhioev (left Google), 2013-06-21 11:04:20]

Hi, please take a look.
Denis, ChromeOS part.
Mattias, policy and ChromeOS settings.
Bernhard, check if I defined policy right.

[Bernhard Bauer, 2013-06-21 11:59:25]

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
'chrome_os:29-'],
Is this policy really supported on Chrome?

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
disable locally managed users creation and login.'''
This doesn't seem right. The policy needs to be configured to enable the
feature?

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/user_manager.h (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/user_manager.h:353: virtual bool
AreLocallyManagedUsersAllowed() const = 0;
Nit: new line before private section.

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/user_manager_impl.h (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/user_manager_impl.h:361: // Cached flag indicating
whether the locally managed users enabled by policy.
Nit: This sentence doesn't parse. I think you want to write "[...] whether
locally managed users are enabled [...]"?

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/user_manager_unittest.cc (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/user_manager_unittest.cc:87: return
reinterpret_cast<UserManagerImpl*>(UserManager::Get())->
I know this is copy-and-pasted from other code here, but is there a reason
you're using a reinterpret_cast instead of a static_cast? Static cast is usually
preferred.

[Denis Kuznetsov (DE-MUC), 2013-06-21 12:28:52]

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4885: 'name':
'LocallyManagedUsersEnabled',
As final name for feature is "Supervised user", please update local strings as
well.

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/existing_user_controller.cc (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/existing_user_controller.cc:184: if
(((*it)->GetType() != User::USER_TYPE_LOCALLY_MANAGED ||
Please extract this as a boolean var, so that it would be easier to read.

[dzhioev (left Google), 2013-06-21 13:13:23]

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
'chrome_os:29-'],
On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> Is this policy really supported on Chrome?
Not yet. But we want this policy to be supported in Chrome too, don't we?

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
disable locally managed users creation and login.'''
On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> This doesn't seem right. The policy needs to be configured to enable the
> feature?

In http://crbug.com/229298#c9 it's said: "managed user functionality must be
disabled for enterprise before we ship". So as I understood, this feature should
be disabled by default.

[dzhioev (left Google), 2013-06-21 13:42:29]

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/existing_user_controller.cc (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/existing_user_controller.cc:184: if
(((*it)->GetType() != User::USER_TYPE_LOCALLY_MANAGED ||
On 2013/06/21 12:28:52, Denis Kuznetsov wrote:
> Please extract this as a boolean var, so that it would be easier to read.

Done.

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/user_manager.h (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/user_manager.h:353: virtual bool
AreLocallyManagedUsersAllowed() const = 0;
On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> Nit: new line before private section.

Done.

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/user_manager_unittest.cc (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/user_manager_unittest.cc:87: return
reinterpret_cast<UserManagerImpl*>(UserManager::Get())->
On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> I know this is copy-and-pasted from other code here, but is there a reason
> you're using a reinterpret_cast instead of a static_cast? Static cast is
usually
> preferred.

Yes, reinterpret_cast is unnecessary here. Removed all occurrences.

[Mattias Nissler (ping if slow), 2013-06-21 14:25:16]

policy bits LGTM w/ nits.

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
disable locally managed users creation and login.'''
Please also spell out behavior if set to true. Additionally, it's worth stating
here that the default handling is odd (i.e. LMU are allowed on consumer devices
but not on enterprise devices).

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
File chrome/browser/chromeos/login/user_manager_impl.h (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
chrome/browser/chromeos/login/user_manager_impl.h:361: // Cached flag indicating
whether the locally managed users enabled by policy.
grammar nit: sentence missing a verb

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
File chrome/browser/chromeos/login/user_manager_unittest.cc (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
chrome/browser/chromeos/login/user_manager_unittest.cc:204: 
nit: remove newline

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/ui/webui/c...
File chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/ui/webui/c...
chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc:1007:
UserManager::Get()->AreLocallyManagedUsersAllowed();
nit: indentation

[Bernhard Bauer, 2013-06-21 14:38:35]

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
'chrome_os:29-'],
On 2013/06/21 13:13:24, dzhioev wrote:
> On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > Is this policy really supported on Chrome?
> Not yet. But we want this policy to be supported in Chrome too, don't we?

We do, I just wasn't sure whether that was supposed to be part of this CL or
not.

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
disable locally managed users creation and login.'''
On 2013/06/21 13:13:24, dzhioev wrote:
> On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > This doesn't seem right. The policy needs to be configured to enable the
> > feature?
> 
> In http://crbug.com/229298#c9 it's said: "managed user functionality must be
> disabled for enterprise before we ship". So as I understood, this feature
should
> be disabled by default.

But we don't want it to be disabled by default for consumer devices, right? If
you explain that in the policy description (and make sure that it's implemented
that way), then ok.

[Mattias Nissler (ping if slow), 2013-06-21 14:41:16]

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
'chrome_os:29-'],
One more thing: I don't see any code for chrome desktop in this CL. Please
remove the chrome:29- part.

[dzhioev (left Google), 2013-06-21 14:52:51]

On 2013/06/21 14:38:35, Bernhard Bauer wrote:
>
https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
> File chrome/app/policy/policy_templates.json (right):
> 
>
https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
> chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
> 'chrome_os:29-'],
> On 2013/06/21 13:13:24, dzhioev wrote:
> > On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > > Is this policy really supported on Chrome?
> > Not yet. But we want this policy to be supported in Chrome too, don't we?
> 
> We do, I just wasn't sure whether that was supposed to be part of this CL or
> not.

No, it's not. Chrome support should be implemented in other CL.
I'm afraid policy definition produces strings that should be translated, so
if we want to land it in M29 we should lock description right now.
Mattias, can we change description after branch point?  

>
https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
> chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
> false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
> OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
> disable locally managed users creation and login.'''
> On 2013/06/21 13:13:24, dzhioev wrote:
> > On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > > This doesn't seem right. The policy needs to be configured to enable the
> > > feature?
> > 
> > In http://crbug.com/229298#c9 it's said: "managed user functionality must be
> > disabled for enterprise before we ship". So as I understood, this feature
> should
> > be disabled by default.
> 
> But we don't want it to be disabled by default for consumer devices, right? If
> you explain that in the policy description (and make sure that it's
implemented
> that way), then ok.

[Denis Kuznetsov (DE-MUC), 2013-06-21 15:46:56]

https://chromiumcodereview.appspot.com/17546004/diff/13001/chrome/browser/chr...
File chrome/browser/chromeos/settings/cros_settings_names.cc (right):

https://chromiumcodereview.appspot.com/17546004/diff/13001/chrome/browser/chr...
chrome/browser/chromeos/settings/cros_settings_names.cc:36:
"cros.accounts.locallyManagedUsersEnabled";
Please rename to Supervised user.

[Mattias Nissler (ping if slow), 2013-06-21 16:29:25]

On 2013/06/21 14:52:51, dzhioev wrote:
> On 2013/06/21 14:38:35, Bernhard Bauer wrote:
> >
>
https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
> > File chrome/app/policy/policy_templates.json (right):
> > 
> >
>
https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
> > chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
> > 'chrome_os:29-'],
> > On 2013/06/21 13:13:24, dzhioev wrote:
> > > On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > > > Is this policy really supported on Chrome?
> > > Not yet. But we want this policy to be supported in Chrome too, don't we?
> > 
> > We do, I just wasn't sure whether that was supposed to be part of this CL or
> > not.
> 
> No, it's not. Chrome support should be implemented in other CL.
> I'm afraid policy definition produces strings that should be translated, so
> if we want to land it in M29 we should lock description right now.
> Mattias, can we change description after branch point?  

Please make the policy description accurate to what this CL does (supported_on
and description). Updating later is OK.

> 
> >
>
https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
> > chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set
to
> > false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
> > OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
> > disable locally managed users creation and login.'''
> > On 2013/06/21 13:13:24, dzhioev wrote:
> > > On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > > > This doesn't seem right. The policy needs to be configured to enable the
> > > > feature?
> > > 
> > > In http://crbug.com/229298#c9 it's said: "managed user functionality must
be
> > > disabled for enterprise before we ship". So as I understood, this feature
> > should
> > > be disabled by default.
> > 
> > But we don't want it to be disabled by default for consumer devices, right?
If
> > you explain that in the policy description (and make sure that it's
> implemented
> > that way), then ok.

[dzhioev (left Google), 2013-06-21 16:48:17]

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4885: 'name':
'LocallyManagedUsersEnabled',
On 2013/06/21 12:28:52, Denis Kuznetsov wrote:
> As final name for feature is "Supervised user", please update local strings as
> well.

Done.

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
'chrome_os:29-'],
On 2013/06/21 14:38:35, Bernhard Bauer wrote:
> On 2013/06/21 13:13:24, dzhioev wrote:
> > On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > > Is this policy really supported on Chrome?
> > Not yet. But we want this policy to be supported in Chrome too, don't we?
> 
> We do, I just wasn't sure whether that was supposed to be part of this CL or
> not. 
Done. Removed "Chrome" mentions.

https://codereview.chromium.org/17546004/diff/3001/chrome/app/policy/policy_t...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
disable locally managed users creation and login.'''
On 2013/06/21 14:38:35, Bernhard Bauer wrote:
> On 2013/06/21 13:13:24, dzhioev wrote:
> > On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> > > This doesn't seem right. The policy needs to be configured to enable the
> > > feature?
> > 
> > In http://crbug.com/229298#c9 it's said: "managed user functionality must be
> > disabled for enterprise before we ship". So as I understood, this feature
> should
> > be disabled by default.
> 
> But we don't want it to be disabled by default for consumer devices, right? If
> you explain that in the policy description (and make sure that it's
implemented
> that way), then ok.

Done.

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
File chrome/browser/chromeos/login/user_manager_impl.h (right):

https://codereview.chromium.org/17546004/diff/3001/chrome/browser/chromeos/lo...
chrome/browser/chromeos/login/user_manager_impl.h:361: // Cached flag indicating
whether the locally managed users enabled by policy.
On 2013/06/21 11:59:25, Bernhard Bauer wrote:
> Nit: This sentence doesn't parse. I think you want to write "[...] whether
> locally managed users are enabled [...]"?

Done.

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4888: 'supported_on': ['chrome:29-',
'chrome_os:29-'],
On 2013/06/21 14:41:16, Mattias Nissler wrote:
> One more thing: I don't see any code for chrome desktop in this CL. Please
> remove the chrome:29- part.

Done.

https://codereview.chromium.org/17546004/diff/13001/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If this policy set to
false or not configured, <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome
OS</ex></ph> and <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
disable locally managed users creation and login.'''
On 2013/06/21 14:25:16, Mattias Nissler wrote:
> Please also spell out behavior if set to true. Additionally, it's worth
stating
> here that the default handling is odd (i.e. LMU are allowed on consumer
devices
> but not on enterprise devices).

Done.

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
File chrome/browser/chromeos/login/user_manager_impl.h (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
chrome/browser/chromeos/login/user_manager_impl.h:361: // Cached flag indicating
whether the locally managed users enabled by policy.
On 2013/06/21 14:25:16, Mattias Nissler wrote:
> grammar nit: sentence missing a verb

Done.

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
File chrome/browser/chromeos/login/user_manager_unittest.cc (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/chromeos/l...
chrome/browser/chromeos/login/user_manager_unittest.cc:204: 
On 2013/06/21 14:25:16, Mattias Nissler wrote:
> nit: remove newline

Done.

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/ui/webui/c...
File chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc (right):

https://codereview.chromium.org/17546004/diff/13001/chrome/browser/ui/webui/c...
chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc:1007:
UserManager::Get()->AreLocallyManagedUsersAllowed();
On 2013/06/21 14:25:16, Mattias Nissler wrote:
> nit: indentation

Done.

[Denis Kuznetsov (DE-MUC), 2013-06-21 17:06:16]

lgtm

[Bernhard Bauer, 2013-06-21 17:16:14]

LGTM w/ nits:

https://codereview.chromium.org/17546004/diff/13003/chrome/app/policy/policy_...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/13003/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If set to true,
supervised users can be created and used to login into session.
Nit: The passive voice is used a bit much here :) How about "If set to true, it
is possible to create and log in as a supervised user"?

https://codereview.chromium.org/17546004/diff/13003/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4900: NOTE: Default behavior for
consumer and enterprise devices differs: on consumer devices supervised users
are enabled by default, but on enterprice devices they aren't.'''
Nit: "The default behavior [...]".

[dzhioev (left Google), 2013-06-21 17:25:11]

https://codereview.chromium.org/17546004/diff/13003/chrome/app/policy/policy_...
File chrome/app/policy/policy_templates.json (right):

https://codereview.chromium.org/17546004/diff/13003/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4896: 'desc': '''If set to true,
supervised users can be created and used to login into session.
On 2013/06/21 17:16:14, Bernhard Bauer wrote:
> Nit: The passive voice is used a bit much here :) How about "If set to true,
it
> is possible to create and log in as a supervised user"?

Done.

https://codereview.chromium.org/17546004/diff/13003/chrome/app/policy/policy_...
chrome/app/policy/policy_templates.json:4900: NOTE: Default behavior for
consumer and enterprise devices differs: on consumer devices supervised users
are enabled by default, but on enterprice devices they aren't.'''
On 2013/06/21 17:16:14, Bernhard Bauer wrote:
> Nit: "The default behavior [...]".

Done.

[commit-bot: I haz the power, 2013-06-21 17:26:42]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dzhioev@chromium.org/17546004/16002

[commit-bot: I haz the power, 2013-06-21 17:41:37]

Sorry for I got bad news for ya.
Compile failed with a clobber build on linux_clang.
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_clan...
Your code is likely broken or HEAD is junk. Please ensure your
code is not broken then alert the build sheriffs.
Look at the try server FAQ for more details.

[commit-bot: I haz the power, 2013-06-21 17:58:24]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dzhioev@chromium.org/17546004/8018

[commit-bot: I haz the power, 2013-06-21 19:09:32]

Retried try job too often on linux_rel for step(s) sync_integration_tests
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_rel&...

[commit-bot: I haz the power, 2013-06-21 19:26:47]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dzhioev@chromium.org/17546004/8018

[commit-bot: I haz the power, 2013-06-21 19:26:50]

Failed to apply patch for chrome/app/policy/policy_templates.json:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file chrome/app/policy/policy_templates.json
  Hunk #1 FAILED at 112.
  Hunk #2 succeeded at 4982 (offset 101 lines).
  1 out of 2 hunks FAILED -- saving rejects to file
chrome/app/policy/policy_templates.json.rej

Patch:       chrome/app/policy/policy_templates.json
Index: chrome/app/policy/policy_templates.json
diff --git a/chrome/app/policy/policy_templates.json
b/chrome/app/policy/policy_templates.json
index
fbd4a5bc36fc09825eb321ad100088416610b50a..13c5acd97d0f5061a64750f2d05d4f81eb1ecd58
100644
--- a/chrome/app/policy/policy_templates.json
+++ b/chrome/app/policy/policy_templates.json
@@ -112,7 +112,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 214
+#   For your editing convenience: highest ID currently used: 215
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -4881,6 +4881,24 @@
 
           This policy is for internal use by Chrome itself.''',
         },
+        {
+          'name': 'SupervisedUsersEnabled',
+          'type': 'main',
+          'schema': { 'type': 'boolean' },
+          'supported_on': ['chrome_os:29-'],
+          'device_only': True,
+          'features': {
+            'dynamic_refresh': False,
+          },
+          'example_value': True,
+          'id': 215,
+          'caption': '''Enable supervised users.''',
+          'desc': '''If set to true, it is possible to create and log in as a
supervised user.
+
+          If set to false or not configured, supervised users creation and
login will be disabled. All existing supervised users will be hidden.
+
+          NOTE: The default behavior for consumer and enterprise devices
differs: on consumer devices supervised users are enabled by default, but on
enterprice devices they aren't.'''
+        },
       ],
     },
   ],

[commit-bot: I haz the power, 2013-06-21 20:03:23]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dzhioev@chromium.org/17546004/41001

[commit-bot: I haz the power, 2013-06-22 00:38:16]

Change committed as 207978