could you please help triage this issue ?

This seems WAI?

If the proxy is enforced, it is applied regardless of the "Allow proxies for shared networks"; the pref is not relevant and therefore not shown.

Am I misunderstanding? Is the behavior different for a logged in user?

Resolving as WontFix. Please re-open and clarify if this  is incorrect.

stevenjb@
From the  crbug.com/397751 ,
“For Guest session the behavior is as intended on ChromeOS:
Proxy settings from device policy are only used in guest session if the 'Allow proxies for shared networks' is enabled”
However, the option is not available with the new material design UI if an Admin policy is already pushed for the same network.

The option to allow proxies disappears if the network is pushed for the devices: https://drive.google.com/open?id=0B01YYztUbOCuUWYtVGxlS2FZdG8

We tried to go to chrome://settings-frame to get to the old view, but we get an error message after version 61: https://drive.google.com/open?id=0B01YYztUbOCuUHBJVjZlMHRpNE0

From the previous comment #1,
It was working when M-58, since M-61, there is no workaround.

So, is it current behavior and is there another way to enable this setting in Guest mode? 

Please ignore the delted comment #7, I was thinking about something else.

Please instead answer my quesitons in comment #3:

1. Is the proxy enfoced by the Device policy or recommended?
2. Is the behavior different for non guest users?

So, I looked at the code, and we are hiding the toggle if a policy is controlling the setting, even if it is not enforcing it. I will have a fix up shortly. The issue does not appear to be specific to Guest mode.

At this point we can not merge this to 61 and it may not make it into 62, but we will definitely get it in to 63.

Targeting 63; 62 is about to hit stable.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e92c0f6988a0fe486c5a679f9a4492f5667c0dc4

commit e92c0f6988a0fe486c5a679f9a4492f5667c0dc4
Author: Steven Bennetts <stevenjb@chromium.org>
Date: Tue Oct 24 23:48:26 2017

Settings: Network: Show 'allow shared' in guest mode + unenforced policy

Currently we hide the control if any policy exists, even if it is not
enforced. This prevents enabling 'allow shared proxies' which prevents 
user editing of the proxy values.

Bug:  774507 
Cq-Include-Trybots: master.tryserver.chromium.linux:closure_compilation
Change-Id: I38a42400aa4929b4b43990cf10c22613e1118115
Reviewed-on: https://chromium-review.googlesource.com/736059
Reviewed-by: Toni Barzic <tbarzic@chromium.org>
Commit-Queue: Steven Bennetts <stevenjb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#511307}
[modify] https://crrev.com/e92c0f6988a0fe486c5a679f9a4492f5667c0dc4/chrome/browser/resources/settings/internet_page/network_proxy_section.js

stevenjb@
Thanks for all your support.

This should be fixed now in ToT, but I don't have a test case set up for this to confirm.

Small low risk CrOS only change.

This bug requires manual review: M63 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), gkihumba@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f785ff95f9ba88dde8570d9c8ba0d7a0912fa9cb

commit f785ff95f9ba88dde8570d9c8ba0d7a0912fa9cb
Author: Steven Bennetts <stevenjb@chromium.org>
Date: Tue Oct 31 17:27:46 2017

Settings: Network: Show 'allow shared' in guest mode + unenforced policy

Currently we hide the control if any policy exists, even if it is not
enforced. This prevents enabling 'allow shared proxies' which prevents
user editing of the proxy values.

TBR=stevenjb@chromium.org

(cherry picked from commit e92c0f6988a0fe486c5a679f9a4492f5667c0dc4)

Bug:  774507 
Cq-Include-Trybots: master.tryserver.chromium.linux:closure_compilation
Change-Id: I38a42400aa4929b4b43990cf10c22613e1118115
Reviewed-on: https://chromium-review.googlesource.com/736059
Reviewed-by: Toni Barzic <tbarzic@chromium.org>
Commit-Queue: Steven Bennetts <stevenjb@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#511307}
Reviewed-on: https://chromium-review.googlesource.com/747065
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Cr-Commit-Position: refs/branch-heads/3239@{#315}
Cr-Branched-From: adb61db19020ed8ecee5e91b1a0ea4c924ae2988-refs/heads/master@{#508578}
[modify] https://crrev.com/f785ff95f9ba88dde8570d9c8ba0d7a0912fa9cb/chrome/browser/resources/settings/internet_page/network_proxy_section.js

I've tried with beta 63.0.3239.70 but it's not displaying the "Allow proxies for shared networks"
version: https://drive.google.com/open?id=1auZn8csENsV-vblpxnN1u4ldkJgiGeAV
policy: 
(pdf) https://drive.google.com/open?id=1pDshnKipXTliSCQYp1n9hMC8RuqlZiOg
(json) https://drive.google.com/open?id=10fGrE64VPbP-EMbC7wCHKX8A-7-nzKHb
screenshot: https://drive.google.com/open?id=1rxa6zc9SunOipsllJuI3iEr7M4UJbAD9
I have something wrong in the configuration ?

The fix is definitely in 63.0.3239.7.

I'm not an expert on policies, but it looks to me like there is a device level enforced policy in that json file. Enforced policies are always applied so we do not show the 'allow shared proxies' control. The issue was that 'recommended' policies were also not showing the control.

Snippet from json file:

"DeviceOpenNetworkConfiguration": {
         "level": "mandatory",
         "scope": "machine",
         "source": "sourceCloud",
         "value": "{
   \"GlobalNetworkConfiguration\": {
      \"AllowOnlyPolicyNetworksToAutoconnect\": false,
      \"AllowOnlyPolicyNetworksToConnect\": false
   },
   \"NetworkConfigurations\": [ {
      \"GUID\": \"{110cbc4e-c47e-4b51-a9b4-b616223258b0}\",
      \"Name\": \"GoogleGuest\",
      \"ProxySettings\": {
         \"Manual\": {
 ...
           }
         },
         \"Type\": \"Manual\"
      },
      \"Type\": \"WiFi\",
      \"WiFi\": {
         \"AutoConnect\": true,
         \"HiddenSSID\": false,
         \"SSID\": \"GoogleGuest\",
         \"Security\": \"None\"
      }
   } ]
}
"
},

Steven, on the Admin Console I have only this type of policy for network, and has been always like this.

Hmm, rereading through the comments I see:

"Proxy settings from device policy are only used in guest session if the 'Allow proxies for shared networks' is enabled”.

I'm not sure that statement is true, but we should be able to test that. I assumed that the policy was "recommended" and not "enforced". If it is "enforced" I *think* it is applied, even in guest mode, regardless of the 'allow shared proxies' setting.


Can you check whether or not the proxy is actually being applied? 

i.e. try the following:

1. Apply the policy as described in comment #1 or #20.
2. Test whether the proxy is applied when connected to the policy network with a proxy set (e.g. GoogleGuest).
3. Go to the details page for a *different* *shared* network without a policy. (You may need to be connected first and set 'share this network'). The 'Allow shared proxies' setting should be visible on that page.
4. Note the current setting, then toggle the setting.
5. Connect to the policy controlled network (e.g. GoogleGuest).
6. Test whether the proxy is applied.

The 'Allow shared proxies' affects *all* networks, but we only want to show it where it actually affects whether the proxy is applied.

Steven, 
for "Proxy settings from device policy are only used in guest session if the 'Allow proxies for shared networks' is enabled”.
is WAI as explained here: https://bugs.chromium.org/p/chromium/issues/detail?id=397751#c3

I've tried your steps, and the proxy is used.
but this is what the customer is trying to avoid :-)
in the old M58 the Allow proxies was OUTSIDE the specific network configuration.
as you are saying, it's a general settings, affecting all networks.
OLD M58 settings: https://screenshot.googleplex.com/WtaGakWqU1N.png

Ah, I understand the confusion now.

The Setting has not changed. It still affects all networks.

We just changed where we placed the Setting to improve its context. We inform users when they change the setting that it affects all networks, even though the Setting is displayed on each individual detail page (except where it would not apply).

That is why steps 3-6 would allow you to workaround the issue if it were just a UI issue.

So if "Allow shared proxies" used to affect device policy proxies in Guest mode but does not any more, that sounds like it either was a bug in policy application or is a bug in policy application.  Either way this is an enterprise issue.

atwilson@ / emaxx@ - If we decide that "Allow shared proxies" should affect Device policy in guest mode we will need to add some custom logic to the Settings UI to show that setting for networks with Device policy proxies. The change should be straightforward and I am happy to review or make the change.

Thanks for digging up that comment from pneubeck@; That's interesting -- I think the behavior should be at least consistent between guest session and non-affiliated user session, WDYT? Should we involve PM in the discussion?

I can't think of any reason why "Guest" should be special. I agree that a PM should be involved, but I'm not sure who that should be.

+tbuckley@ who at least has some familiarity with network configuration, but this is really a policy application issue.

Adding the two PMs from Enterprise side that might care about this discussion.

I have another customer (case# 14406502) that is confused by this option, he is trying to use it in a normal user (enterprise enrolled) session, not a guest session.
If I've understood correctly how this option works, what I'd like to have is:
1) the "Allow proxies for shared networks" knob in the general network settings
2) displayed with or without network policy enforcing
3) the possibility to enable/disable (toggle knob) only in guest mode

what do you think of this ?

Hi,

Do we have any updates on this issue?

Thanks!

Any updates on this issue? thank you

As determined in issue 798553, the root cause of this issue is the logic in ProxyConfigServiceImpl::IgnoreProxy where we do not apply device policy proxies unless the user is in the device's domain or the use_shared_proxies pref is set. The "quick" fix is the same for both this and issue 798553 which is to always show the UI when a shared network is controlled by device policy:

https://cs.chromium.org/chromium/src/chromeos/network/proxy/proxy_config_service_impl.cc?l=164