I just try Leon device with Ethernet connection. It has the same sign-in error. So it seems nothing to do with connection type. 
Chrome OS 10908.0.0

Deleted: debug-logs_20180726-160204.tgz 300 KB

debug-logs_20180726-160204.tgz 300 KB Download

I see this too, over Ethernet. ExistingUserController is showing error IDS_LOGIN_ERROR_OWNER_KEY_LOST (2258), which seems to happen here:

https://cs.chromium.org/chromium/src/chrome/browser/chromeos/login/existing_user_controller.cc?type=cs&q=logindisplay+showerror&sq=package:chromium&g=0&l=1615

because CrosSettings are PERMANENTLY_UNTRUSTED...

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8ea21472646cc55f31cca9b37c92db6686a25058

commit 8ea21472646cc55f31cca9b37c92db6686a25058
Author: Aga Wronska <agawronska@chromium.org>
Date: Tue Aug 07 17:05:36 2018

Mark device as registered at the end of demo mode setup flow (both
online and offline).

Bug: 868025
Test: Run DemoSetupTest, DemoSetupControllerTest and WizardControllerDemoSetupTest.
Change-Id: Ifca8bc7f4c053d2ff060ee0fc529f38690124a65
Reviewed-on: https://chromium-review.googlesource.com/1157543
Reviewed-by: Jacob Dufault <jdufault@chromium.org>
Reviewed-by: Michael Giuffrida <michaelpg@chromium.org>
Commit-Queue: Aga Wronska <agawronska@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581260}
[modify] https://crrev.com/8ea21472646cc55f31cca9b37c92db6686a25058/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.cc
[modify] https://crrev.com/8ea21472646cc55f31cca9b37c92db6686a25058/chrome/browser/chromeos/login/demo_mode/demo_setup_controller.h
[modify] https://crrev.com/8ea21472646cc55f31cca9b37c92db6686a25058/chrome/browser/chromeos/login/demo_mode/demo_setup_controller_unittest.cc
[modify] https://crrev.com/8ea21472646cc55f31cca9b37c92db6686a25058/chrome/browser/chromeos/login/demo_setup_browsertest.cc
[modify] https://crrev.com/8ea21472646cc55f31cca9b37c92db6686a25058/chrome/browser/chromeos/login/wizard_controller_browsertest.cc

Some observations:

This error/race condition occurs also for regular enterprise enrollment. You can see it in logs, but the message is not displayed in web ui, because enrollment screen does not implement showErrorBubble function

[3384:3384:0810/093543.296966:VERBOSE1:wizard_controller.cc(326)] Starting OOBE wizard with screen: oauth-enrollment
[3384:3384:0810/093543.299730:VERBOSE1:wizard_controller.cc(1976)] Showing enrollment screen. Forcing interactive enrollment: 0.
[3384:3384:0810/093543.299835:VERBOSE1:wizard_controller.cc(1279)] SetCurrentScreenSmooth: oauth-enrollment
[3384:3384:0810/093543.303139:WARNING:enrollment_screen_handler.cc(665)] EnrollmentScreenHandler::UpdateState(): state=online, reason=update
[3384:3384:0810/093543.308865:INFO:signin_screen_handler.cc(1483)] Login WebUI >> active: 0, source: gaia-signin
[3384:3384:0810/093543.891793:WARNING:enrollment_screen_handler.cc(665)] EnrollmentScreenHandler::UpdateState(): state=online, reason=update
[3384:3384:0810/093544.073340:WARNING:CONSOLE(18807)] "Unrecognized message from GAIA: showConfirmCancel", source: chrome://oobe/oobe.js (18807)
[3384:3384:0810/093553.673410:WARNING:CONSOLE(18807)] "Unrecognized message from GAIA: clearOldAttempts", source: chrome://oobe/oobe.js (18807)
[3384:3384:0810/093554.455638:WARNING:CONSOLE(18807)] "Unrecognized message from GAIA: showConfirmCancel", source: chrome://oobe/oobe.js (18807)
[3384:3384:0810/093559.190986:WARNING:enrollment_screen_handler.cc(665)] EnrollmentScreenHandler::UpdateState(): state=online, reason=update
[3384:3384:0810/093600.199574:WARNING:CONSOLE(18852)] "Forcing empty services.", source: chrome://oobe/oobe.js (18852)
[3384:3384:0810/093600.204111:WARNING:CONSOLE(18896)] "Authenticator: No password scraped for SAML.", source: chrome://oobe/oobe.js (18896)
[3384:3384:0810/093600.204708:VERBOSE1:enrollment_screen_handler.cc(765)] HandleCompleteLogin
[3384:3384:0810/093600.869530:WARNING:cloud_policy_client.cc(84)] Duplicate license type in response :1
[3384:3384:0810/093608.273172:INFO:remote_commands_service.cc(38)] Fetching remote commands.
[3384:3384:0810/093608.274404:INFO:system_log_uploader.cc(237)] Creating system log uploader.
[3384:3384:0810/093608.274521:INFO:system_log_uploader.cc(389)] Scheduling next system log upload 0 s from now.
[3384:3384:0810/093608.276982:ERROR:object_proxy.cc(616)] Failed to call method: org.chromium.UpdateEngineInterface.SetChannel: object_path= /org/chromium/UpdateEngine: org.freedesktop.DBus.Error.Failed: update_engine/org.chromium.UpdateEngine.Error.Failed:Cannot set target channel explicitly when channel policy/settings is not delegated
[3384:3384:0810/093608.277011:ERROR:update_engine_client.cc(394)] Failed to request setting channel
[3384:3384:0810/093608.277395:INFO:system_log_uploader.cc(359)] System log upload is disabled, rescheduling.
[3384:3384:0810/093608.277444:INFO:system_log_uploader.cc(389)] Scheduling next system log upload 43200 s from now.
[3384:3384:0810/093608.277704:ERROR:existing_user_controller.cc(1214)] [XXX] PolicyLoadFailed
[3384:3384:0810/093608.277729:VERBOSE1:existing_user_controller.cc(1489)] 
[3384:3384:0810/093608.277742:VERBOSE1:login_display_webui.cc(109)] Show error, error_id: 2259, attempts:1, help_topic_id: 188036
[3384:3384:0810/093608.277760:ERROR:core_oobe_handler.cc(226)] CoreOobeHandler::ShowSignInError: error_text=Sign-in failed, please connect to the internet and try again.
[3384:3384:0810/093608.550033:ERROR:object_proxy.cc(616)] Failed to call method: org.chromium.UpdateEngineInterface.SetChannel: object_path= /org/chromium/UpdateEngine: org.freedesktop.DBus.Error.Failed: update_engine/org.chromium.UpdateEngine.Error.Failed:Cannot set target channel explicitly when channel policy/settings is not delegated
[3384:3384:0810/093608.550077:ERROR:update_engine_client.cc(394)] Failed to request setting channel
[3384:3384:0810/093608.557035:INFO:remote_commands_service.cc(165)] Remote commands fetched.
[1:1:0810/093608.583475:ERROR:webthread_impl_for_utility_thread.cc(19)] Not implemented reached in virtual blink::ThreadScheduler *blink::scheduler::WebThreadImplForUtilityThread::Scheduler() const
[3384:3384:0810/093609.205816:INFO:remote_commands_invalidator.cc(32)] Initialize RemoteCommandsInvalidator. 

Thanks, Aga. Looks like we can assign this to the enterprise team. Is there anything for us to do here? Would restarting Chrome help or is it just a matter of waiting?

We do not need to restart chrome. 

The race condition that we have here is between auto-login and storing policy in device local account policy store. First auto-login attempt fails, but it is repeated and then it succeeds.

If we need quick hack we could try to delay the first auto login attempt. Maybe augmenting the condition that is done here: 

https://cs.chromium.org/chromium/src/chrome/browser/chromeos/login/existing_user_controller.cc?rcl=1765353f3e592cc34c422b6146c0f4b5c1dd0dee&l=1455

Other hack would be suppressing error bubble for demo mode. 

So I guess this is more of an OOBE/login issue. I'd be fine with skipping the auto-login timer by checking policy availability for now, but it seems like a real fix would also have the policy store success trigger the auto-login (or even delay the login screen so there's no race condition).

I'm also seeing this in relation to 902 errors, where rebooting is required to fix the issue.

[1448:1448:0924/155948.046819:VERBOSE1:demo_setup_controller.cc(372)] Demo mode setup finished successfully.
[1448:1448:0924/155948.049149:VERBOSE1:wizard_controller.cc(1528)] Wizard screen exit code: DEMO_MODE_SETUP_FINISHED
[1448:1448:0924/155948.049227:VERBOSE1:wizard_controller.cc(570)] Showing login screen.
[1448:1448:0924/155948.049314:VERBOSE1:login_display_host_webui.cc(628)] Login WebUI >> sign in
[1448:1448:0924/155948.080729:ERROR:device_event_log_impl.cc(159)] [15:59:48.080] Login: cryptohome_util.cc:131 GetKeyDataEx failed with no GetKeyDataReply extension in reply.
[1448:1448:0924/155948.096551:INFO:signin_screen_handler.cc(1483)] Login WebUI >> active: 1, source: account-picker
[1448:1448:0924/155948.148350:ERROR:proximity_auth_local_state_pref_manager.cc(146)] Failed to find prefs for current user.
[1448:1448:0924/155948.148391:ERROR:proximity_auth_local_state_pref_manager.cc(80)] Failed to get easyunlock_allowed.
[1448:1448:0924/155948.148408:ERROR:proximity_auth_local_state_pref_manager.cc(146)] Failed to find prefs for current user.
[1448:1448:0924/155948.148421:ERROR:proximity_auth_local_state_pref_manager.cc(92)] Failed to get easyunlock_enabled.
[1448:1448:0924/155948.214128:WARNING:device_management_service.cc(312)] DMServer sent an error response: 902
[1448:1448:0924/155948.214369:WARNING:device_management_service.cc(312)] DMServer sent an error response: 902
[1448:1448:0924/155948.341818:INFO:signin_screen_handler.cc(1371)] Login WebUI >> AccountPickerReady
[1448:1448:0924/155948.342057:VERBOSE1:gaia_screen_handler.cc(314)] MaybePreloadAuthExtension
[1448:1448:0924/155948.342119:VERBOSE1:gaia_screen_handler.cc(1171)] LoadAuthExtension, force: 1, offline: 0
[1448:1448:0924/155948.343670:VERBOSE1:signin_screen_handler.cc(1437)] Login WebUI >> loginVisible, src: account-picker, webui_visible_: 1
[1448:1448:0924/155948.344644:VERBOSE1:existing_user_controller.cc(1497)] 
[1448:1448:0924/155948.344668:VERBOSE1:login_display_webui.cc(109)] Show error, error_id: 2272, attempts:1, help_topic_id: 188036
[1448:1448:0924/155948.344685:ERROR:core_oobe_handler.cc(236)] CoreOobeHandler::ShowSignInError: error_text=Sign-in failed, please connect to the internet and try again.

Let my team know if there's anything we can do to help here re: delaying auto-start. I would figure that auto-start would be delayed until policy is installed anyway (since auto-start comes from policy).