Add group policy for sync service URL #25498

bsclifton · 2024-09-09T23:00:55Z

Fixes brave/brave-browser#20431

Security review https://github.com/brave/reviews/issues/1744

Submitter Checklist:

I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
There is a ticket for my issue
Used GitHub auto-closing keywords in the PR description above
Wrote a good PR/commit description
Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
Checked the PR locally:
- npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
- npm run presubmit wiki, npm run gn_check, npm run tslint
Ran git rebase master (if needed)

Reviewer Checklist:

A security review is not needed, or a link to one is included in the PR description
New files have MPL-2.0 license header
Adequate test coverage exists to prevent regressions
Major classes, functions and non-trivial code blocks are well-commented
Changes in component dependencies are properly reflected in gn
Code follows the style guide
Test plan is specified in PR before merging

After-merge Checklist:

The associated issue milestone is set to the smallest version that the
changes has landed on
All relevant documentation has been updated, for instance:

Test Plan:

Windows

Using regedit.exe

Open regedit.exe
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Create the key (folders) BraveSoftware\Brave\ if they don't already exist
Create a new string value (REG_SZ) with the name BraveSyncUrl and the value https://sync-v2.brave.com/v2.
Load Brave; verify it shows under brave://policy/

Adding using a `.reg` file (also on Windows)

Create a new empty file called sync-policy.reg
Open it in Notepad and put this for the content:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\BraveSoftware\Brave]
"BraveSyncUrl"="https://sync-v2.brave.com/v2"

Save the file and close it
Double click the sync-policy.reg file to run it (you should get prompted)
Load Brave; verify it shows under brave://policy/

macOS

You can set via the command line.

For Brave, you'd use a bundle ID of com.brave.Browser, com.brave.Browser.beta, or com.brave.Browser.nightly (depending on your channel.
The key name will be BraveSyncUrl
The value would be the sync server. For example, https://sync-v2.brave.com/v2

Steps for Release channel (change bundle ID for other channels)

Run the following from command line:

defaults write com.brave.Browser BraveSyncUrl -string https://sync-v2.brave.com/v2

Load Brave; verify it shows under brave://policy/

Linux

You can set the options via /etc/brave/policies/managed

Basically, you will make a file with JSON matching the keys/values you'd like to set. Full overview here:
https://source.chromium.org/chromium/chromium/src/+/main:docs/website/site/administrators/linux-quick-start/index.md

Example of how to set the sync URL

create a file

vim /etc/brave/policies/managed/sync_url_policy.json

paste in:

{
    "BraveSyncUrl": "https://sync-v2.brave.com/v2"
}

Save the file and exit (escape; :wq, enter)
Load Brave; verify it shows under brave://policy/
Delete the file after testing is complete

fmarier · 2024-09-12T18:24:26Z

chromium_src/components/sync/service/sync_service_impl.cc

+      std::string value(prefs->GetString(brave_sync::kManagedBraveSyncUrl));
+      if (!value.empty()) {
+        GURL custom_sync_url(value);
+        if (custom_sync_url.is_valid()) {


Let's make sure it's an HTTPS URL too.

components/brave_sync/brave_sync_prefs.h

chromium_src/components/policy/tools/generate_policy_source.py

bsclifton · 2024-09-13T08:07:59Z

OK pushed fixes - however, I am getting a presubmit error...

Update: SOLVED - was missing a , 😂

github-actions · 2024-09-13T08:33:56Z

The security team is monitoring all repositories for certain keywords. This PR includes the word(s) "policy" and so security team members have been added as reviewers to take a look.

No need to request a full security review at this stage, the security team will take a look shortly and either clear the label or request more information/changes.

Notifications have already been sent, but if this is blocking your merge feel free to reach out directly to the security team on Slack so that we can expedite this check.

goodov · 2024-09-13T09:58:47Z

chromium_src/components/sync/service/sync_service_impl.cc

+  // This has a higher priority than the --sync-url command-line param.
+  // https://github.com/brave/brave-browser/issues/20431
+  if (prefs) {
+    if (prefs->IsManagedPreference(brave_sync::kCustomSyncServiceUrl)) {


instead of 2 nested ifs:
if (prefs && prefs->IsManagedPreference(brave_sync::kCustomSyncServiceUrl) {

Fixed! 😄

Fixes brave/brave-browser#20431

AlexeyBarabash · 2024-09-13T17:22:25Z

chromium_src/components/sync/service/sync_service_impl.cc


 #define SyncAuthManager BraveSyncAuthManager
 #define SyncStoppedReporter BraveSyncStoppedReporter
+#define GetSyncServiceURL(...) \
+  BraveGetSyncServiceURL(__VA_ARGS__, sync_client_->GetPrefService())


Thanks again for your help here! 😄

AlexeyBarabash

looks good

bsclifton · 2024-09-13T17:48:58Z

Updated to add test plan for Windows / macOS / Linux.

Trying to find an Android group policy example....

I can't find documentation about Android administration and the build fails with sync url set. We need to find the Android equivalent of `chromium_src/components/policy/tools/generate_policy_source.py`

bsclifton self-assigned this Sep 9, 2024

bsclifton changed the title ~~WIP: Add group policy for sync URL~~ WIP: Add group policy for sync service URL Sep 9, 2024

github-actions bot added the chromium-version-mismatch The Chromium version on the PR branch does not match the version on the target branch label Sep 12, 2024

fmarier reviewed Sep 12, 2024

View reviewed changes

bsclifton force-pushed the bsc-sync-gpo branch from 8d5467b to 15fd905 Compare September 13, 2024 00:11

github-actions bot removed the chromium-version-mismatch The Chromium version on the PR branch does not match the version on the target branch label Sep 13, 2024

bsclifton force-pushed the bsc-sync-gpo branch 4 times, most recently from 3cfde18 to e2594f7 Compare September 13, 2024 03:18

goodov reviewed Sep 13, 2024

View reviewed changes

components/brave_sync/brave_sync_prefs.h Outdated Show resolved Hide resolved

chromium_src/components/policy/tools/generate_policy_source.py Outdated Show resolved Hide resolved

bsclifton force-pushed the bsc-sync-gpo branch from e2594f7 to 717da64 Compare September 13, 2024 07:26

bsclifton changed the title ~~WIP: Add group policy for sync service URL~~ Add group policy for sync service URL Sep 13, 2024

bsclifton force-pushed the bsc-sync-gpo branch from 717da64 to 08e0234 Compare September 13, 2024 08:05

bsclifton marked this pull request as ready for review September 13, 2024 08:05

bsclifton requested review from a team as code owners September 13, 2024 08:05

github-actions bot added the needs-security-review label Sep 13, 2024

github-actions bot assigned thypon Sep 13, 2024

bsclifton force-pushed the bsc-sync-gpo branch from 4ac12a4 to eaf5f78 Compare September 13, 2024 08:37

goodov approved these changes Sep 13, 2024

View reviewed changes

Create group policy for sync URL

f201239

Fixes brave/brave-browser#20431

bsclifton force-pushed the bsc-sync-gpo branch from eaf5f78 to f201239 Compare September 13, 2024 16:54

bsclifton mentioned this pull request Sep 13, 2024

Group policy/settings: configuration for --sync-url= argument brave/brave-browser#20431

Closed

AlexeyBarabash reviewed Sep 13, 2024

View reviewed changes

AlexeyBarabash approved these changes Sep 13, 2024

View reviewed changes

fmarier removed the needs-security-review label Sep 13, 2024

fmarier unassigned thypon Sep 13, 2024

Restricting group policy to Desktop

18cf485

I can't find documentation about Android administration and the build fails with sync url set. We need to find the Android equivalent of `chromium_src/components/policy/tools/generate_policy_source.py`

fmarier approved these changes Sep 13, 2024

View reviewed changes

github-actions bot added the needs-security-review label Sep 13, 2024

github-actions bot assigned thypon Sep 13, 2024

bsclifton enabled auto-merge September 13, 2024 23:29

bsclifton merged commit bbb1f49 into master Sep 14, 2024
17 checks passed

bsclifton deleted the bsc-sync-gpo branch September 14, 2024 00:25

github-actions bot added this to the 1.72.x - Nightly milestone Sep 14, 2024

bsclifton mentioned this pull request Sep 25, 2024

[Sync] Add an option in setting page to Enter Custom Sync Url #25484

Open

24 tasks

bsclifton mentioned this pull request Oct 14, 2024

Change sync server to self-hosted sync server on mobile devices brave/brave-browser#41611

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add group policy for sync service URL #25498

Add group policy for sync service URL #25498

bsclifton commented Sep 9, 2024 •

edited

Loading

fmarier Sep 12, 2024

bsclifton Sep 13, 2024

bsclifton commented Sep 13, 2024 •

edited

Loading

github-actions bot commented Sep 13, 2024

goodov Sep 13, 2024

bsclifton Sep 13, 2024

AlexeyBarabash Sep 13, 2024

bsclifton Sep 13, 2024

AlexeyBarabash left a comment

bsclifton commented Sep 13, 2024

Add group policy for sync service URL #25498

Add group policy for sync service URL #25498

Conversation

bsclifton commented Sep 9, 2024 • edited Loading

Submitter Checklist:

Reviewer Checklist:

After-merge Checklist:

Test Plan:

Windows

Using regedit.exe

Adding using a .reg file (also on Windows)

macOS

Linux

Example of how to set the sync URL

fmarier Sep 12, 2024

Choose a reason for hiding this comment

bsclifton Sep 13, 2024

Choose a reason for hiding this comment

bsclifton commented Sep 13, 2024 • edited Loading

github-actions bot commented Sep 13, 2024

goodov Sep 13, 2024

Choose a reason for hiding this comment

bsclifton Sep 13, 2024

Choose a reason for hiding this comment

AlexeyBarabash Sep 13, 2024

Choose a reason for hiding this comment

bsclifton Sep 13, 2024

Choose a reason for hiding this comment

AlexeyBarabash left a comment

Choose a reason for hiding this comment

bsclifton commented Sep 13, 2024

bsclifton commented Sep 9, 2024 •

edited

Loading

Adding using a `.reg` file (also on Windows)

bsclifton commented Sep 13, 2024 •

edited

Loading