Hm, I think it's *supposed* to get reset in ProfileSyncService::OnConnectionStatusChange, starting from here: https://cs.chromium.org/chromium/src/components/sync/engine_impl/sync_manager_impl.cc?rcl=189708d4ceca532ad679530e85c153ef4c9d1bfa&l=564

If we go from HttpResponse::SYNC_AUTH_ERROR to SERVER_CONNECTION_OK, then that should result in the auth error getting reset. Is that not happening?

Yes, I see that supposed call too. I'm looking in to why it's not getting set back now.

Ah, this may be an error on my side. 

I'm getting this issue when using the flag "Enabled Dice", but this appears to work fine when setting the flag to "Enabled Dice (migration)".

Mihai, it looks like we should be testing with "Enabled Dice (migration)", and ignore "Enabled Dice". Is that right?

"Enabled Dice" and "Enabled Dice (migration)" should both work the same. I'm very curious why you a get a different behavior here.

OK, the difference between "Enable Dice" and "Enable Dice (migration)" was a red-herring. (see below)

The actual problem seems to be that last_auth_error_ is set from two routes:
1. Observable from OAuth2TokenService
2. ProfileSyncService::OnConnectionStatusChange

But OnConnectionStatusChange is the only thing that unsets it. This means that if last_auth_error_ is set by the OAuth2TokenService observable, but Sync hasn't seen the error through OnConnectionStatusChange (because there hasn't been a sync cycle since the error), the error won't be cleared when the user signs back in.

On the difference between flags:
Mihai clarified offline that the only difference between "Enable Dice" and "Enable Dice (migration)" is:

With "Enabled Dice", The user is force-migrated into Dice, even if there was no consistency yet.

With "Enabled Dice (migration)" Chrome waits until the user is in a consistent state before turning on Dice. The actual migration happens the chrome start after consistency is achieved.

Do you think it would be straightforward to also reset the last_auth_error_ in the case where Sync hasn't seen it?

Yes, I think that's the right way. Cl for review: https://chromium-review.googlesource.com/c/chromium/src/+/964334

Thanks for the quick turnaround time :)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a4d587066de6d0b6a2e6202eb63915127a7aa528

commit a4d587066de6d0b6a2e6202eb63915127a7aa528
Author: Florian Uunk <feuunk@chromium.org>
Date: Mon Mar 19 11:27:52 2018

Clear Sync auth error state on token fetch success

last_auth_error_ was set from OnGetTokenFailure, but then never cleared
in onGetTokenSuccess. This meant that the error could stay around, even
if the causing token issue was resolved.

BUG= 822182 

Change-Id: I135baa55d8e81860313dd02f2ca432f0482c3c10
Reviewed-on: https://chromium-review.googlesource.com/964334
Commit-Queue: Florian Uunk <feuunk@chromium.org>
Reviewed-by: Mikel Astiz <mastiz@chromium.org>
Reviewed-by: Marc Treib <treib@chromium.org>
Cr-Commit-Position: refs/heads/master@{#544008}
[modify] https://crrev.com/a4d587066de6d0b6a2e6202eb63915127a7aa528/components/browser_sync/profile_sync_service.cc
[modify] https://crrev.com/a4d587066de6d0b6a2e6202eb63915127a7aa528/components/browser_sync/profile_sync_service_unittest.cc