adding Restrict-view label, please change if not required.

It's likely one of two things:

1) We've managed to break enterprise signin to Chrome through some Gaia-side change.
2) bookmarks@managedchrome.com has some weird SAML config setup for its OU (shouldn't be possible, since I don't think you can setup SAML signin for just a portion of your domain)

I'm traveling with a chromebook today so can't easily test this myself - Julian, do you have cycles to try this out (I don't have the credentials for bookmarks@managedchrome.com, but you can probably just put your own managedchrome.com acct in the same OU).

Hmmm, this looks an awful lot like https://bugs.chromium.org/p/chromium/issues/detail?id=673725, but that doesn't jibe with the bug reporter's claim that this was happening all the way back to M30.

I am not sure I will have much time to check it out this week. But at least there are a few things that will help us investigate this.

Can you please restart chrome with --enable-logging and send us the log file chrome_debug.log generated next to the chrome executable or in the chrome profile in case of system installation.

Another way to investiage what happens is through chrome://net-internals please follow the instructions on https://sites.google.com/a/chromium.org/dev/for-testers/providing-network-details for that. It captures all the network trafic.

Lastly I see that the Chrome icon is an yellow exclamation mark. Is this due to an old Chrome version or is it covering some other error message?

For now I don't see a reason to restrict this bug. I will make it public as it is not a security issue.

Adding some desktop Chrome signin folks

Roger would you have some time to look into this please?

I am knee-deep in GCP and roaming profiles fun until XMas.

I do not know this piece of code as well as Roger, but I'll take a look and see if I can reproduce this.

I have an even more weird behavior here. On the chrome://chrome-signin tab I enter the username "bookmarks@managedchrome.com" and then I get redirected to www.google.com (see attached screenshot). Note that I see this behavior both on M54 stable and on ToT.
What is even worse, is that the URL in the bar is chrome://chrome-signin. Doing a Google search from this page keeps the same chrome://chrome-signin URL.

However, I cannot reproduce this issue with a @google.com account.

Deleted: signin_enterprise_broken.PNG 39.1 KB

	signin_enterprise_broken.PNG 39.1 KB View Download

I checked again and I see the same behavior when signing in for gmail. I expect there is a problem on the server-side for these accounts. I'll follow-up with the concerned team.

Internal bug b/33687102

somebody has messed up the SSO settings for this domain. I cleared the broken settings it should be all good now. Sorry for the confusion and involving people from so many teams for something that should have been caught early. 

WontFix-ing as there is nothing to be fixed in Chrome.