<html>
  <head>
    <script type="text/javascript">
      var initialized = false;
      var sendAndSumitRequested = false;

      function initialize() {
        window.addEventListener('message', function(event) {
          if (!event.data || event.data.type != 'gaia_saml_api_reply')
            return;
          var response = event.data.response;
          if (response.result != 'initialized' ||
              response.version != 1 ||
              response.keyTypes.indexOf('KEY_TYPE_PASSWORD_PLAIN') == -1) {
            return;
          }
          initialized = true;
          if (sendAndSumitRequested)
            send_and_submit();
        });

        window.setTimeout(function() {
          window.postMessage({
              type: 'gaia_saml_api',
              call: {method: 'initialize', requestedVersion: 1}}, '/');
        }, 0);
      }

      function send_and_submit() {
        if (!initialized) {
          sendAndSumitRequested = true;
          return;
        }
        var form = document.forms[0];
        var token = form.elements['RelayState'].value;
        var user = form.elements['Email'].value;
        var password = form.elements['Password'].value;
        window.setTimeout(function() {
          window.postMessage({
              type: 'gaia_saml_api',
              call: {method: 'add',
                     token: token,
                     user: user,
                     passwordBytes: password,
                     keyType: 'KEY_TYPE_PASSWORD_PLAIN'}}, '/');
           form.submit();
         }, 0);
      }
    </script>
  </head>
  <body onload="initialize();">
    <form method=post action="$Post">
      <input type=hidden name=RelayState value="$RelayState">
      User: <input type=text id=Email name=Email>
      <!-- The dummy input is part of a regression test: The password scraper
           picks up the contents of the first type=password input field. The
           credentials passing API should overrule the password scraper and
           ensure that the user's actual password is used instead.
           See http://crbug.com/490737 -->
      Dummy: <input type=password id=Dummy name=Dummy>
      Password: <input type=password id=Password name=Password>
      <input id=Submit type=button value="Login" onclick="send_and_submit();"/>
    </form>
  </body>
</html>