The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a66cf346250a2f66f6669c6ad7f0dcd891bb1a62

commit a66cf346250a2f66f6669c6ad7f0dcd891bb1a62
Author: Yves Arrouye <drcrash@google.com>
Date: Wed Nov 01 22:59:30 2017

Add a device policy for forced re-enrollment

BUG= chromium:778535 
TEST=N/A

Change-Id: I709f8928127c5fc7a93404d93ea88ce1a3c38eba
Reviewed-on: https://chromium-review.googlesource.com/748890
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Reviewed-by: Julian Pastarmov <pastarmovj@chromium.org>
Cr-Commit-Position: refs/heads/master@{#513308}
[modify] https://crrev.com/a66cf346250a2f66f6669c6ad7f0dcd891bb1a62/components/policy/proto/chrome_device_policy.proto

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2af9a3ce4820d875b437288d0f54359320e22694

commit 2af9a3ce4820d875b437288d0f54359320e22694
Author: Yves Arrouye <drcrash@google.com>
Date: Thu Nov 02 19:33:13 2017

Add a new re-enrollment mode using zero-touch

BUG= 778535 
TEST=unit_tests

Change-Id: I45056ef1dcfd8f3fd020d1b177d0b19a970f119d
Reviewed-on: https://chromium-review.googlesource.com/738803
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Alexander Alekseev <alemate@chromium.org>
Reviewed-by: Julian Pastarmov <pastarmovj@chromium.org>
Cr-Commit-Position: refs/heads/master@{#513583}
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/login/enrollment/auto_enrollment_check_screen.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/login/enrollment/auto_enrollment_controller.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/login/enrollment/enrollment_screen_unittest.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/login/enrollment/enrollment_uma.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/auto_enrollment_client.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/auto_enrollment_client.h
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/auto_enrollment_client_unittest.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/device_cloud_policy_initializer.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/enrollment_config.h
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/server_backed_device_state.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/chromeos/policy/server_backed_device_state.h
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/chrome/browser/ui/webui/chromeos/login/enrollment_screen_handler.cc
[modify] https://crrev.com/2af9a3ce4820d875b437288d0f54359320e22694/components/policy/proto/device_management_backend.proto

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e546621784e47eb7c4427ba58dd3d376fc436e57

commit e546621784e47eb7c4427ba58dd3d376fc436e57
Author: Yves Arrouye <drcrash@google.com>
Date: Fri Nov 10 06:47:53 2017

Upload identification for enrollment as required by policy

Set a CrOS setting from cloud's device settings' forced re-enrollment.
Add an enrollment policy observer which observes the setting and
uploads an enterprise enrollment certificate when identification is
needed. This certificate will be used by the server to obtain the
device's enrollment ID for automatic forced re-enrollment.

Bug:  778535 
Test: unit_tests
Change-Id: I7e95148e8101c27faa3dc1d21eb44971c79ee3c6
Reviewed-on: https://chromium-review.googlesource.com/758116
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Alexander Alekseev <alemate@chromium.org>
Cr-Commit-Position: refs/heads/master@{#515488}
[modify] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/BUILD.gn
[add] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/attestation/enrollment_policy_observer.cc
[add] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/attestation/enrollment_policy_observer.h
[add] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/attestation/enrollment_policy_observer_unittest.cc
[modify] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.cc
[modify] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h
[modify] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chrome/browser/chromeos/settings/device_settings_provider.cc
[modify] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chromeos/settings/cros_settings_names.cc
[modify] https://crrev.com/e546621784e47eb7c4427ba58dd3d376fc436e57/chromeos/settings/cros_settings_names.h

Yves,
I just saw a feedback report with the following line getting logged rapidly like this:
[1602:1602:1128/022349.114982:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022349.240392:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022349.363278:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022349.493285:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022349.618154:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022349.742319:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022349.876471:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed
[1602:1602:1128/022350.001050:WARNING:device_settings_provider.cc(683)] Changing settings from non-owner, setting=cros.device.enrollment_id_needed

...and a user reporting the device being really slow. Do you think the commit in c#4 could be related?
I see that change adds a "cros.device.enrollment_id_needed" constant.

https://listnr.corp.google.com/report/84713400360

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1ce0804417998926216f6e68d506fddfa8b3e253

commit 1ce0804417998926216f6e68d506fddfa8b3e253
Author: Yves Arrouye <drcrash@google.com>
Date: Thu Dec 14 17:51:42 2017

Set the type of certificates when uploading them.

This will allow certificates to be typed even if we send an empty
PEM certificate which the server can act on.

Bug:  778535 
Test: unit_tests
Change-Id: Iadc2d94c4cdd558dc46086b7cea629f7f92e8ae7
Reviewed-on: https://chromium-review.googlesource.com/822164
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: James Cook <jamescook@chromium.org>
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524108}
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/chrome/browser/chromeos/attestation/attestation_policy_observer.cc
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/chrome/browser/chromeos/attestation/attestation_policy_observer.h
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/chrome/browser/chromeos/attestation/attestation_policy_observer_unittest.cc
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/chrome/browser/chromeos/attestation/enrollment_policy_observer.cc
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/chrome/browser/chromeos/attestation/enrollment_policy_observer.h
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/chrome/browser/chromeos/attestation/enrollment_policy_observer_unittest.cc
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/components/policy/core/common/cloud/cloud_policy_client.cc
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/components/policy/core/common/cloud/cloud_policy_client.h
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/components/policy/core/common/cloud/cloud_policy_client_unittest.cc
[modify] https://crrev.com/1ce0804417998926216f6e68d506fddfa8b3e253/components/policy/core/common/cloud/mock_cloud_policy_client.h

The following revision refers to this bug:
  https://chromium.googlesource.com/aosp/platform/system/tpm/+/156f7dacdaf69636c5f3ef617d977e80c6149fb2

commit 156f7dacdaf69636c5f3ef617d977e80c6149fb2
Author: Igor <igorcov@chromium.org>
Date: Thu Dec 14 23:26:58 2017

trunks: Extract RSA endorsement key from NVRAM

The certificate for endorsement key for TPM2.0 is stored in NVRAM.
The GetPublicRSAEndorsementKey method implemented here allows to
extract the public RSA endorsement key from the certificate. It is
expected to  be used to generate the unique identifier (EID) for
zero-touch enrollment.

BUG= chromium:778535 
TEST=None

Change-Id: I81400a4e628c13cbca863b8d9a1cbe33f503858e
Reviewed-on: https://chromium-review.googlesource.com/763305
Commit-Ready: Igor <igorcov@chromium.org>
Tested-by: Igor <igorcov@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>

[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/trunks_factory_for_test.cc
[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/tpm_utility_test.cc
[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/trunks_client.cc
[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/tpm_utility.h
[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/mock_tpm_utility.h
[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/tpm_utility_impl.cc
[modify] https://crrev.com/156f7dacdaf69636c5f3ef617d977e80c6149fb2/trunks/tpm_utility_impl.h

https://m.facebook.com/story.php?story_fbid=1995888257354598&id=100008003281018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/312ddcdab0b16b3de40f5e198ed16fae78d709fa

commit 312ddcdab0b16b3de40f5e198ed16fae78d709fa
Author: Yves Arrouye <drcrash@google.com>
Date: Fri Dec 15 23:46:58 2017

Use policy data to determine whether to upload an enrollment ID

Act directly on changes to policy data. Do not store a CrOS setting
for when an enrollment identifier is needed. Do not convert the
current policy in ChromeDeviceSettingsProto to anything (it will be
removed).

BUG= chromium:778535 
TEST=unit_tests

Change-Id: I49fb2537556f9e3781267f9eb2ede1b2d5dee964
Reviewed-on: https://chromium-review.googlesource.com/827575
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524523}
[modify] https://crrev.com/312ddcdab0b16b3de40f5e198ed16fae78d709fa/chrome/browser/chromeos/attestation/enrollment_policy_observer.cc
[modify] https://crrev.com/312ddcdab0b16b3de40f5e198ed16fae78d709fa/chrome/browser/chromeos/attestation/enrollment_policy_observer.h
[modify] https://crrev.com/312ddcdab0b16b3de40f5e198ed16fae78d709fa/chrome/browser/chromeos/attestation/enrollment_policy_observer_unittest.cc
[modify] https://crrev.com/312ddcdab0b16b3de40f5e198ed16fae78d709fa/chrome/browser/chromeos/settings/device_settings_provider.cc
[modify] https://crrev.com/312ddcdab0b16b3de40f5e198ed16fae78d709fa/chromeos/settings/cros_settings_names.cc
[modify] https://crrev.com/312ddcdab0b16b3de40f5e198ed16fae78d709fa/chromeos/settings/cros_settings_names.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b7ed15b34f2adcb62ab31d88be15d00df27f9615

commit b7ed15b34f2adcb62ab31d88be15d00df27f9615
Author: Yves Arrouye <drcrash@google.com>
Date: Sat Dec 16 04:10:37 2017

Upload an empty enrollment cert if one cannot obtain one

We want to be able to recognize when the PCA rejects an improper
request versus a transient failure. We use the bad request status to
upload an empty enrollment certificate to the Cloud to indicate that
a machine cannot obtain en enrollment certificate because it is not
able (setup) to do attestation-based enrollment.

BUG= chromium:778535 
TEST=unit tests

Change-Id: Ic8b3684dc85895fe23bd192d534393fe45fc1a07
Reviewed-on: https://chromium-review.googlesource.com/823173
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#524584}
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/attestation_policy_observer.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/attestation_policy_observer.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/attestation_policy_observer_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/enrollment_policy_observer.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/enrollment_policy_observer.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/enrollment_policy_observer_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/platform_verification_flow.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/platform_verification_flow.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/attestation/platform_verification_flow_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/policy/enrollment_handler_chromeos.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/chromeos/policy/enrollment_handler_chromeos.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/extensions/api/enterprise_platform_keys/enterprise_platform_keys_api_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chromeos/attestation/attestation_constants.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chromeos/attestation/attestation_flow.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chromeos/attestation/attestation_flow.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chromeos/attestation/attestation_flow_unittest.cc
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chromeos/attestation/mock_attestation_flow.h
[modify] https://crrev.com/b7ed15b34f2adcb62ab31d88be15d00df27f9615/chromeos/cryptohome/async_method_caller.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ee61f08cd286f650f2d1634cde6221e02eb9b5e4

commit ee61f08cd286f650f2d1634cde6221e02eb9b5e4
Author: Yves Arrouye <drcrash@google.com>
Date: Wed Jan 17 01:07:30 2018

Request a fresh enrollment certificate

Since certificates should be requested only once (unless we cannot
talk to DMServer) we just ask for a fresh one to make sure that we do
not retrieve one off the keyed blob that may be expired (enrollment certs
are valid for only a few minutes).

Bug:  chromium:778535 
Test: unit tests pass
Change-Id: I8dca1211a0b50b80502d82f018c0faa12eaaa7aa
Reviewed-on: https://chromium-review.googlesource.com/868275
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#529536}
[modify] https://crrev.com/ee61f08cd286f650f2d1634cde6221e02eb9b5e4/chrome/browser/chromeos/attestation/enrollment_policy_observer.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ae58d1f8c0dcb9d77192788606952ce87afcfb80

commit ae58d1f8c0dcb9d77192788606952ce87afcfb80
Author: Yves Arrouye <drcrash@google.com>
Date: Thu Jan 18 22:34:41 2018

Change enrollment message for spinning screen

Bug:  chromium:778535 
Test: visual
Change-Id: I6fb9658b9d71c9614c4f5a1ed5326e0d8f236212
Reviewed-on: https://chromium-review.googlesource.com/874721
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Commit-Queue: Yves Arrouye <drcrash@chromium.org>
Cr-Commit-Position: refs/heads/master@{#530306}
[modify] https://crrev.com/ae58d1f8c0dcb9d77192788606952ce87afcfb80/chrome/app/chromeos_strings.grdp

The following revision refers to this bug:
  https://chromium.googlesource.com/aosp/platform/system/tpm/+/20c359aee878870d07ecbcda1de134908f3897d9

commit 20c359aee878870d07ecbcda1de134908f3897d9
Author: Igor <igorcov@chromium.org>
Date: Thu May 31 18:49:29 2018

trunks: Extract RSA endorsement key from NVRAM

The certificate for endorsement key for TPM2.0 is stored in NVRAM.
The GetPublicRSAEndorsementKey method implemented here allows to
extract the public RSA endorsement key from the certificate. It is
expected to  be used to generate the unique identifier (EID) for
zero-touch enrollment.

BUG= chromium:778535 
TEST=None

Change-Id: I81400a4e628c13cbca863b8d9a1cbe33f503858e
Reviewed-on: https://chromium-review.googlesource.com/763305
Commit-Ready: Igor <igorcov@chromium.org>
Tested-by: Igor <igorcov@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>

[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/trunks_factory_for_test.cc
[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/tpm_utility_test.cc
[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/trunks_client.cc
[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/tpm_utility.h
[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/mock_tpm_utility.h
[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/tpm_utility_impl.cc
[modify] https://crrev.com/20c359aee878870d07ecbcda1de134908f3897d9/trunks/tpm_utility_impl.h