We'd like to avoid porting this function, since ideally all error handling is done in views-side.

Is there something specific that is missing and this is needed?

We are using it for the Active Directory login [1]. How should we migrate?

[1] https://cs.chromium.org/chromium/src/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc?rcl=54c5c1788cab811a8fa6b1a6e9cd224b1bce29ac&l=708

Are there any tests covering active-directory?

One option is to add this as part of login_screen.mojom::AuthenticateUser, so that it returns success, an optional error message, and an optional help article id. But that may be limiting, since then chrome-side can only show an error after an authentication attempt.

https://cs.chromium.org/chromium/src/ash/public/interfaces/login_screen.mojom?l=147-149&rcl=787d420ba7e6e014e2d30ea4e791a69b287c777c

 Issue 851680  has been merged into this issue.

Maybe the existing mojo call ShowErrorMessage can be used in this case.

https://cs.chromium.org/chromium/src/ash/public/interfaces/login_screen.mojom?rcl=088a3d1c240e84134d4ca13069d3df5fe6694058&l=36

We don't actually have tests for that. Showing an error after auth attempt fine. let me investigate API. BTW, what is the good start read about mojo?

RE#6: Some high level introduction can be found here https://cs.chromium.org/chromium/src/mojo/README.md?q=mojo/README.md&dr=C&l=1

Also there's bunch of examples to follow in ash/public/interfaces

> Maybe the existing mojo call ShowErrorMessage can be used in this case.

This is currently unused, and if we can avoid implementing it that'd be good, as it gives chrome-side control over UI which should be avoided. Ideally long-term chrome-side is relatively stateless.

If active-directory only emits errors after a login attempt (I would expect that) then we should try to add this as part of AuthenticateUser.

mojo getting started docs are at https://chromium.googlesource.com/chromium/src/+/master/mojo/README.md

Hmm, Active Directory authentication happens completely on a Chrome side (https://cs.chromium.org/chromium/src/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc?rcl=17c29f0c17718f25788178a675037c5521ee8de7&l=724).
So we don't call "AuthenticateUser" at all. Should we somehow move the AD login screen into ash? WDYT?

All existing auth code is still in chrome, but it looks like that ad code still goes through LoginDisplayHost, ie, https://cs.chromium.org/chromium/src/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc?rcl=17c29f0c17718f25788178a675037c5521ee8de7&l=689.

If it looks like migrating away from ShowErrorMessage will be significant work we can do it later, we should focus on making sure everything works for 69.

The problem is before it goes through LoginDisplayHost, it first goes through Active Directory auth (https://cs.chromium.org/chromium/src/chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.cc?rcl=31f09165145291062c3d680400c450b66382070d&l=722). Which returns error we want to display a message about.

I guess it's a small bug if ShowSignInError would not work for us. But would be nice to fix it eventually

xiaoyinh@ has taken a closer look at this and we should be able to get ad error messages working again in views-login. Since ad-login implements its own signin UI it makes a lot of sense for it to go entirely through the existing webui, so we will not need to implement the mojo API.

This should be fixed with the CL in  crbug.com/857583