Chrome Version: 69.0.3449.0
OS: ChromeOS (10756.0.0)

The AllowOnlyPolicyNetworksToConnect (and AllowOnlyPolicyNetworksToAutoconnect) policy is not enforced in Shill, only in chrome. This is a problem, as we can easily auto-connect to a previously connected unmanaged network. Additionally, due to another bug, the unmanaged network is not even disconnected once the policy is applied.

Scenario:
1) Connect to unmanaged network "U".
2) Set up device policy with AllowOnlyPolicyNetworksToConnect=true and provide a network configuration for the managed network "M".
3) Reload policies on device.
4) The device does not even disconnect from the unmanaged network! (unexpected behavior due to applied_autoconnect_policy_ implemented incorrectly)
5) Manually connect to network M.
6) Manual connections to U are not possible now (expected behavior)
7) Manually disconnect from network M.
8) AutoConnect will re-connect to network U (unexpected behavior)

So apart from fixing the existing bug in 4), we also need to prevent Shill from connecting to the disallowed networks when AllowOnlyPolicyNetworksToConnect (or AllowOnlyPolicyNetworksToAutoconnect) is enabled.

We can do this by either disabling auto-connect for all unmanaged network configurations, which prevents Shill from re-connecting to those networks again. For the AllowOnlyPolicyNetworksToConnect policy, we could even delete the network configuration, although disabling auto-connect is enough.

I have already started workin on a fix for both problems.