wireless-security: prepare text entries according to 'hints'

Use the hints passed down from the secret agent request, if any, to
select the EAPMethodSimple UI and show or hide GtkEntry widgets
according to which secrets are being requested.  This unfortunately
touches all the places that use EAPMethodSimple.  I used this specific
class because it is already kind of handling a bunch of different
actual EAP methods but I could also have created a new UI separate
EAPMethodSimple.

Since I'm abusing EAPMethodSimple for this, I also needed to add a new
eap method type "unknown", first because where this code is useful NM
does not know what specific EAP method is used and secondly the UI
doesn't really need to know that.

Note that hints being non-NULL implies secrets_only.  Since with
secrets_only the password storage flags can't be changed, I didn't
bother adding the storage flags to the GtkEntry for the private key
passphrase so it doesn't get the secondary icon thing even though the
plain password field does still have the icon.  Only the three hint
strings are supported which are actually in use in the NM tree in the
IWD wifi backend.

[lkundrak@v3.sk: fix up error handling in
eap-method-simple.c:validate()]

10 files changed, 280 insertions, 83 deletions

diff --git a/src/wireless-security/eap-method-fast.c b/src/wireless-security/eap-method-fast.c
index 5835ce98..55dfab4a 100644
--- a/src/wireless-security/eap-method-fast.c
+++ b/src/wireless-security/eap-method-fast.c
@@ -261,7 +261,8 @@ inner_auth_combo_init (EAPMethodFAST *method,
 	em_gtc = eap_method_simple_new (method->sec_parent,
 	                                connection,
 	                                EAP_METHOD_SIMPLE_TYPE_GTC,
-	                                simple_flags);
+	                                simple_flags,
+	                                NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("GTC"),
@@ -276,7 +277,8 @@ inner_auth_combo_init (EAPMethodFAST *method,
 	em_mschap_v2 = eap_method_simple_new (method->sec_parent,
 	                                      connection,
 	                                      EAP_METHOD_SIMPLE_TYPE_MSCHAP_V2,
-	                                      simple_flags);
+	                                      simple_flags,
+	                                      NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MSCHAPv2"),
diff --git a/src/wireless-security/eap-method-peap.c b/src/wireless-security/eap-method-peap.c
index 37fd39d9..63cdea71 100644
--- a/src/wireless-security/eap-method-peap.c
+++ b/src/wireless-security/eap-method-peap.c
@@ -293,7 +293,8 @@ inner_auth_combo_init (EAPMethodPEAP *method,
 	em_mschap_v2 = eap_method_simple_new (method->sec_parent,
 	                                      connection,
 	                                      EAP_METHOD_SIMPLE_TYPE_MSCHAP_V2,
-	                                      simple_flags);
+	                                      simple_flags,
+	                                      NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MSCHAPv2"),
@@ -308,7 +309,8 @@ inner_auth_combo_init (EAPMethodPEAP *method,
 	em_md5 = eap_method_simple_new (method->sec_parent,
 	                                connection,
 	                                EAP_METHOD_SIMPLE_TYPE_MD5,
-	                                simple_flags);
+	                                simple_flags,
+	                                NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MD5"),
@@ -323,7 +325,8 @@ inner_auth_combo_init (EAPMethodPEAP *method,
 	em_gtc = eap_method_simple_new (method->sec_parent,
 	                                connection,
 	                                EAP_METHOD_SIMPLE_TYPE_GTC,
-	                                simple_flags);
+	                                simple_flags,
+	                                NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("GTC"),
diff --git a/src/wireless-security/eap-method-simple.c b/src/wireless-security/eap-method-simple.c
index 66dc4216..0f4de339 100644
--- a/src/wireless-security/eap-method-simple.c
+++ b/src/wireless-security/eap-method-simple.c
@@ -40,14 +40,19 @@ struct _EAPMethodSimple {
 	EAPMethodSimpleType type;
 	EAPMethodSimpleFlags flags;
 
+	gboolean username_requested;
+	gboolean password_requested;
+	gboolean pkey_passphrase_requested;
 	GtkEntry *username_entry;
 	GtkEntry *password_entry;
 	GtkToggleButton *show_password;
+	GtkEntry *pkey_passphrase_entry;
+	GtkToggleButton *show_pkey_passphrase;
 	guint idle_func_id;
 };
 
 static void
-show_toggled_cb (GtkToggleButton *button, EAPMethodSimple *method)
+show_password_toggled_cb (GtkToggleButton *button, EAPMethodSimple *method)
 {
 	gboolean visible;
 
@@ -55,6 +60,15 @@ show_toggled_cb (GtkToggleButton *button, EAPMethodSimple *method)
 	gtk_entry_set_visibility (method->password_entry, visible);
 }
 
+static void
+show_pkey_passphrase_toggled_cb (GtkToggleButton *button, EAPMethodSimple *method)
+{
+	gboolean visible;
+
+	visible = gtk_toggle_button_get_active (button);
+	gtk_entry_set_visibility (method->pkey_passphrase_entry, visible);
+}
+
 static gboolean
 always_ask_selected (GtkEntry *passwd_entry)
 {
@@ -69,27 +83,45 @@ validate (EAPMethod *parent, GError **error)
 	const char *text;
 	gboolean ret = TRUE;
 
-	text = gtk_entry_get_text (method->username_entry);
-	if (!text || !strlen (text)) {
-		widget_set_error (GTK_WIDGET (method->username_entry));
-		g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP username"));
-		ret = FALSE;
-	} else
-		widget_unset_error (GTK_WIDGET (method->username_entry));
+	if (method->username_requested) {
+		text = gtk_entry_get_text (method->username_entry);
+		if (!text || !strlen (text)) {
+			widget_set_error (GTK_WIDGET (method->username_entry));
+			g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP username"));
+			ret = FALSE;
+		} else
+			widget_unset_error (GTK_WIDGET (method->username_entry));
+	}
 
 	/* Check if the password should always be requested */
-	if (always_ask_selected (method->password_entry))
-		widget_unset_error (GTK_WIDGET (method->password_entry));
-	else {
-		text = gtk_entry_get_text (method->password_entry);
+	if (method->password_requested) {
+		if (always_ask_selected (method->password_entry))
+			widget_unset_error (GTK_WIDGET (method->password_entry));
+		else {
+			text = gtk_entry_get_text (method->password_entry);
+			if (!text || !strlen (text)) {
+				widget_set_error (GTK_WIDGET (method->password_entry));
+				if (ret) {
+					g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC,
+					                     _("missing EAP password"));
+					ret = FALSE;
+				}
+			} else
+				widget_unset_error (GTK_WIDGET (method->password_entry));
+		}
+	}
+
+	if (method->pkey_passphrase_requested) {
+		text = gtk_entry_get_text (method->pkey_passphrase_entry);
 		if (!text || !strlen (text)) {
-			widget_set_error (GTK_WIDGET (method->password_entry));
+			widget_set_error (GTK_WIDGET (method->pkey_passphrase_entry));
 			if (ret) {
-				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP password"));
+				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC,
+				                     _("missing EAP client Private Key passphrase"));
 				ret = FALSE;
 			}
 		} else
-			widget_unset_error (GTK_WIDGET (method->password_entry));
+			widget_unset_error (GTK_WIDGET (method->pkey_passphrase_entry));
 	}
 
 	return ret;
@@ -98,15 +130,26 @@ validate (EAPMethod *parent, GError **error)
 static void
 add_to_size_group (EAPMethod *parent, GtkSizeGroup *group)
 {
+	EAPMethodSimple *method = (EAPMethodSimple *) parent;
 	GtkWidget *widget;
 
-	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_label"));
-	g_assert (widget);
-	gtk_size_group_add_widget (group, widget);
+	if (method->username_requested) {
+		widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_label"));
+		g_assert (widget);
+		gtk_size_group_add_widget (group, widget);
+	}
 
-	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_label"));
-	g_assert (widget);
-	gtk_size_group_add_widget (group, widget);
+	if (method->password_requested) {
+		widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_label"));
+		g_assert (widget);
+		gtk_size_group_add_widget (group, widget);
+	}
+
+	if (method->pkey_passphrase_requested) {
+		widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_label"));
+		g_assert (widget);
+		gtk_size_group_add_widget (group, widget);
+	}
 }
 
 typedef struct {
@@ -124,6 +167,7 @@ static const EapType eap_table[EAP_METHOD_SIMPLE_TYPE_LAST] = {
 	[EAP_METHOD_SIMPLE_TYPE_PWD]             = { "pwd",      TRUE  },
 	[EAP_METHOD_SIMPLE_TYPE_CHAP]            = { "chap",     FALSE },
 	[EAP_METHOD_SIMPLE_TYPE_GTC]             = { "gtc",      TRUE  },
+	[EAP_METHOD_SIMPLE_TYPE_UNKNOWN]         = { "unknown",  TRUE  },
 };
 
 static void
@@ -138,51 +182,64 @@ fill_connection (EAPMethod *parent, NMConnection *connection)
 	s_8021x = nm_connection_get_setting_802_1x (connection);
 	g_assert (s_8021x);
 
-	/* If this is the main EAP method, clear any existing methods because the
-	 * user-selected on will replace it.
-	 */
-	if (parent->phase2 == FALSE)
-		nm_setting_802_1x_clear_eap_methods (s_8021x);
-
-	eap_type = &eap_table[method->type];
-	if (parent->phase2) {
-		/* If the outer EAP method (TLS, TTLS, PEAP, etc) allows inner/phase2
-		 * EAP methods (which only TTLS allows) *and* the inner/phase2 method
-		 * supports being an inner EAP method, then set PHASE2_AUTHEAP.
-		 * Otherwise the inner/phase2 method goes into PHASE2_AUTH.
+	if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)) {
+		/* If this is the main EAP method, clear any existing methods because the
+		 * user-selected one will replace it.
 		 */
-		if ((method->flags & EAP_METHOD_SIMPLE_FLAG_AUTHEAP_ALLOWED) && eap_type->autheap_allowed) {
-			g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTHEAP, eap_type->name, NULL);
-			g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, NULL, NULL);
-		} else {
-			g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, eap_type->name, NULL);
-			g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTHEAP, NULL, NULL);
-		}
-	} else
-		nm_setting_802_1x_add_eap_method (s_8021x, eap_type->name);
+		if (parent->phase2 == FALSE)
+			nm_setting_802_1x_clear_eap_methods (s_8021x);
+
+		eap_type = &eap_table[method->type];
+		if (parent->phase2) {
+			/* If the outer EAP method (TLS, TTLS, PEAP, etc) allows inner/phase2
+			 * EAP methods (which only TTLS allows) *and* the inner/phase2 method
+			 * supports being an inner EAP method, then set PHASE2_AUTHEAP.
+			 * Otherwise the inner/phase2 method goes into PHASE2_AUTH.
+			 */
+			if ((method->flags & EAP_METHOD_SIMPLE_FLAG_AUTHEAP_ALLOWED) && eap_type->autheap_allowed) {
+				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTHEAP, eap_type->name, NULL);
+				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, NULL, NULL);
+			} else {
+				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, eap_type->name, NULL);
+				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTHEAP, NULL, NULL);
+			}
+		} else
+			nm_setting_802_1x_add_eap_method (s_8021x, eap_type->name);
+	}
 
-	g_object_set (s_8021x, NM_SETTING_802_1X_IDENTITY, gtk_entry_get_text (method->username_entry), NULL);
+	if (method->username_requested)
+		g_object_set (s_8021x, NM_SETTING_802_1X_IDENTITY, gtk_entry_get_text (method->username_entry), NULL);
 
-	/* Save the password always ask setting */
-	not_saved = always_ask_selected (method->password_entry);
-	flags = nma_utils_menu_to_secret_flags (GTK_WIDGET (method->password_entry));
-	nm_setting_set_secret_flags (NM_SETTING (s_8021x), NM_SETTING_802_1X_PASSWORD, flags, NULL);
+	if (method->password_requested) {
+		/* Save the password always ask setting */
+		not_saved = always_ask_selected (method->password_entry);
+		flags = nma_utils_menu_to_secret_flags (GTK_WIDGET (method->password_entry));
+		nm_setting_set_secret_flags (NM_SETTING (s_8021x), method->password_flags_name, flags, NULL);
 
-	/* Fill the connection's password if we're in the applet so that it'll get
-	 * back to NM.  From the editor though, since the connection isn't going
-	 * back to NM in response to a GetSecrets() call, we don't save it if the
-	 * user checked "Always Ask".
-	 */
-	if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_IS_EDITOR) || not_saved == FALSE)
-		g_object_set (s_8021x, NM_SETTING_802_1X_PASSWORD, gtk_entry_get_text (method->password_entry), NULL);
+		/* Fill the connection's password if we're in the applet so that it'll get
+		 * back to NM.  From the editor though, since the connection isn't going
+		 * back to NM in response to a GetSecrets() call, we don't save it if the
+		 * user checked "Always Ask".
+		 */
+		if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_IS_EDITOR) || not_saved == FALSE) {
+			g_object_set (s_8021x, NM_SETTING_802_1X_PASSWORD,
+			              gtk_entry_get_text (method->password_entry), NULL);
+		}
 
-	/* Update secret flags and popup when editing the connection */
-	if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)) {
-		GtkWidget *passwd_entry = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_entry"));
-		g_assert (passwd_entry);
+		/* Update secret flags and popup when editing the connection */
+		if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)) {
+			GtkWidget *passwd_entry = GTK_WIDGET (gtk_builder_get_object (parent->builder,
+			                                                              "eap_simple_password_entry"));
+			g_assert (passwd_entry);
 
-		nma_utils_update_password_storage (passwd_entry, flags,
-		                                   NM_SETTING (s_8021x), method->password_flags_name);
+			nma_utils_update_password_storage (passwd_entry, flags,
+			                                   NM_SETTING (s_8021x), method->password_flags_name);
+		}
+	}
+
+	if (method->pkey_passphrase_requested) {
+		g_object_set (s_8021x, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
+		              gtk_entry_get_text (method->pkey_passphrase_entry), NULL);
 	}
 }
 
@@ -194,6 +251,11 @@ update_secrets (EAPMethod *parent, NMConnection *connection)
 	                          "eap_simple_password_entry",
 	                          NM_TYPE_SETTING_802_1X,
 	                          (HelperSecretFunc) nm_setting_802_1x_get_password);
+	helper_fill_secret_entry (connection,
+	                          parent->builder,
+	                          "eap_simple_pkey_passphrase_entry",
+	                          NM_TYPE_SETTING_802_1X,
+	                          (HelperSecretFunc) nm_setting_802_1x_get_private_key_password);
 }
 
 static gboolean
@@ -276,20 +338,31 @@ destroy (EAPMethod *parent)
 	g_signal_handlers_disconnect_by_data (method->password_entry, method->ws_parent);
 	g_signal_handlers_disconnect_by_data (method->password_entry, method);
 	g_signal_handlers_disconnect_by_data (method->show_password, method);
+	g_signal_handlers_disconnect_by_data (method->pkey_passphrase_entry, method->ws_parent);
+	g_signal_handlers_disconnect_by_data (method->show_pkey_passphrase, method);
 
 	nm_clear_g_source (&method->idle_func_id);
 }
 
+static void
+hide_row (GtkWidget **widgets, size_t num)
+{
+	while (num--)
+		gtk_widget_hide (*widgets++);
+}
+
 EAPMethodSimple *
 eap_method_simple_new (WirelessSecurity *ws_parent,
                        NMConnection *connection,
                        EAPMethodSimpleType type,
-                       EAPMethodSimpleFlags flags)
+                       EAPMethodSimpleFlags flags,
+                       const char *const*hints)
 {
 	EAPMethod *parent;
 	EAPMethodSimple *method;
 	GtkWidget *widget;
 	NMSetting8021x *s_8021x = NULL;
+	GtkWidget *widget_row[10];
 
 	parent = eap_method_init (sizeof (EAPMethodSimple),
 	                          validate,
@@ -310,6 +383,23 @@ eap_method_simple_new (WirelessSecurity *ws_parent,
 	method->flags = flags;
 	method->type = type;
 	g_assert (type < EAP_METHOD_SIMPLE_TYPE_LAST);
+	g_assert (   (flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)
+	          || type != EAP_METHOD_SIMPLE_TYPE_UNKNOWN);
+
+	if (hints) {
+		for (; *hints; hints++) {
+			if (!strcmp (*hints, NM_SETTING_802_1X_IDENTITY))
+				method->username_requested = TRUE;
+			else if (!strcmp (*hints, NM_SETTING_802_1X_PASSWORD)) {
+				method->password_requested = TRUE;
+				method->password_flags_name = NM_SETTING_802_1X_PASSWORD;
+			} else if (!strcmp (*hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD))
+				method->pkey_passphrase_requested = TRUE;
+		}
+	} else {
+		method->username_requested = TRUE;
+		method->password_requested = TRUE;
+	}
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_notebook"));
 	g_assert (widget);
@@ -327,7 +417,8 @@ eap_method_simple_new (WirelessSecurity *ws_parent,
 	                  (GCallback) wireless_security_changed_cb,
 	                  ws_parent);
 
-	if (method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)
+	if (   (method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)
+	    && !method->username_requested)
 		gtk_widget_set_sensitive (widget, FALSE);
 
 	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_entry"));
@@ -351,9 +442,40 @@ eap_method_simple_new (WirelessSecurity *ws_parent,
 	g_assert (widget);
 	method->show_password = GTK_TOGGLE_BUTTON (widget);
 	g_signal_connect (G_OBJECT (widget), "toggled",
-	                  (GCallback) show_toggled_cb,
+	                  (GCallback) show_password_toggled_cb,
 	                  method);
 
+	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_entry"));
+	g_assert (widget);
+	method->pkey_passphrase_entry = GTK_ENTRY (widget);
+	g_signal_connect (G_OBJECT (widget), "changed",
+	                  (GCallback) wireless_security_changed_cb,
+	                  ws_parent);
+
+	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_show_pkey_passphrase_checkbutton"));
+	g_assert (widget);
+	method->show_pkey_passphrase = GTK_TOGGLE_BUTTON (widget);
+	g_signal_connect (G_OBJECT (widget), "toggled",
+	                  (GCallback) show_pkey_passphrase_toggled_cb,
+	                  method);
+
+	widget_row[0] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_label"));
+	widget_row[1] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_entry"));
+	if (!method->username_requested)
+		hide_row (widget_row, 2);
+
+	widget_row[0] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_label"));
+	widget_row[1] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_entry"));
+	widget_row[2] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "show_checkbutton_eapsimple"));
+	if (!method->password_requested)
+		hide_row (widget_row, 3);
+
+	widget_row[0] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_label"));
+	widget_row[1] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_entry"));
+	widget_row[2] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_show_pkey_passphrase_checkbutton"));
+	if (!method->pkey_passphrase_requested)
+		hide_row (widget_row, 3);
+
 	/* Initialize the UI fields with the security settings from method->ws_parent.
 	 * This will be done again when the widget gets realized. It must be done here as well,
 	 * because the outer dialog will ask to 'validate' the connection before the security tab
@@ -364,4 +486,3 @@ eap_method_simple_new (WirelessSecurity *ws_parent,
 
 	return method;
 }
-
diff --git a/src/wireless-security/eap-method-simple.h b/src/wireless-security/eap-method-simple.h
index ecad120d..257c961b 100644
--- a/src/wireless-security/eap-method-simple.h
+++ b/src/wireless-security/eap-method-simple.h
@@ -35,6 +35,7 @@ typedef enum {
 	EAP_METHOD_SIMPLE_TYPE_PWD,
 	EAP_METHOD_SIMPLE_TYPE_CHAP,
 	EAP_METHOD_SIMPLE_TYPE_GTC,
+	EAP_METHOD_SIMPLE_TYPE_UNKNOWN,
 
 	/* Boundary value, do not use */
 	EAP_METHOD_SIMPLE_TYPE_LAST
@@ -57,7 +58,8 @@ typedef struct _EAPMethodSimple EAPMethodSimple;
 EAPMethodSimple *eap_method_simple_new (WirelessSecurity *ws_parent,
                                         NMConnection *connection,
                                         EAPMethodSimpleType type,
-                                        EAPMethodSimpleFlags flags);
+                                        EAPMethodSimpleFlags flags,
+                                        const char *const*hints);
 
 #endif /* EAP_METHOD_SIMPLE_H */
 
diff --git a/src/wireless-security/eap-method-simple.ui b/src/wireless-security/eap-method-simple.ui
index c9786de5..a0da485c 100644
--- a/src/wireless-security/eap-method-simple.ui
+++ b/src/wireless-security/eap-method-simple.ui
@@ -97,6 +97,50 @@
           </packing>
         </child>
         <child>
+          <object class="GtkLabel" id="eap_simple_pkey_passphrase_label">
+            <property name="visible">True</property>
+            <property name="can_focus">False</property>
+            <property name="label" translatable="yes">P_rivate Key Passphrase</property>
+            <property name="use_underline">True</property>
+            <property name="mnemonic_widget">eap_simple_password_entry</property>
+            <property name="xalign">1</property>
+          </object>
+          <packing>
+            <property name="left_attach">0</property>
+            <property name="top_attach">3</property>
+          </packing>
+        </child>
+        <child>
+          <object class="GtkEntry" id="eap_simple_pkey_passphrase_entry">
+            <property name="visible">True</property>
+            <property name="can_focus">True</property>
+            <property name="hexpand">True</property>
+            <property name="visibility">False</property>
+            <property name="activates_default">True</property>
+          </object>
+          <packing>
+            <property name="left_attach">1</property>
+            <property name="top_attach">3</property>
+          </packing>
+        </child>
+        <child>
+          <object class="GtkCheckButton" id="eap_simple_show_pkey_passphrase_checkbutton">
+            <property name="label" translatable="yes">Sh_ow passphrase</property>
+            <property name="visible">True</property>
+            <property name="can_focus">True</property>
+            <property name="receives_default">False</property>
+            <property name="use_underline">True</property>
+            <property name="draw_indicator">True</property>
+          </object>
+          <packing>
+            <property name="left_attach">1</property>
+            <property name="top_attach">4</property>
+          </packing>
+        </child>
+        <child>
+          <placeholder/>
+        </child>
+        <child>
           <placeholder/>
         </child>
       </object>
diff --git a/src/wireless-security/eap-method-ttls.c b/src/wireless-security/eap-method-ttls.c
index 6140029d..a93a1f43 100644
--- a/src/wireless-security/eap-method-ttls.c
+++ b/src/wireless-security/eap-method-ttls.c
@@ -281,7 +281,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_pap = eap_method_simple_new (method->sec_parent,
 	                                connection,
 	                                EAP_METHOD_SIMPLE_TYPE_PAP,
-	                                simple_flags);
+	                                simple_flags,
+	                                NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("PAP"),
@@ -296,7 +297,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_mschap = eap_method_simple_new (method->sec_parent,
 	                                   connection,
 	                                   EAP_METHOD_SIMPLE_TYPE_MSCHAP,
-	                                   simple_flags);
+	                                   simple_flags,
+	                                   NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MSCHAP"),
@@ -311,7 +313,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_mschap_v2 = eap_method_simple_new (method->sec_parent,
 	                                      connection,
 	                                      EAP_METHOD_SIMPLE_TYPE_MSCHAP_V2,
-	                                      simple_flags);
+	                                      simple_flags,
+	                                      NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MSCHAPv2"),
@@ -327,7 +330,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_plain_mschap_v2 = eap_method_simple_new (method->sec_parent,
 	                                            connection,
 	                                            EAP_METHOD_SIMPLE_TYPE_PLAIN_MSCHAP_V2,
-	                                            simple_flags);
+	                                            simple_flags,
+	                                            NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MSCHAPv2 (no EAP)"),
@@ -343,7 +347,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_chap = eap_method_simple_new (method->sec_parent,
 	                                 connection,
 	                                 EAP_METHOD_SIMPLE_TYPE_CHAP,
-	                                 simple_flags);
+	                                 simple_flags,
+	                                 NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("CHAP"),
@@ -358,7 +363,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_md5 = eap_method_simple_new (method->sec_parent,
 	                                connection,
 	                                EAP_METHOD_SIMPLE_TYPE_MD5,
-	                                simple_flags);
+	                                simple_flags,
+	                                NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("MD5"),
@@ -373,7 +379,8 @@ inner_auth_combo_init (EAPMethodTTLS *method,
 	em_gtc = eap_method_simple_new (method->sec_parent,
 	                                connection,
 	                                EAP_METHOD_SIMPLE_TYPE_GTC,
-	                                simple_flags);
+	                                simple_flags,
+	                                NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    I_NAME_COLUMN, _("GTC"),
diff --git a/src/wireless-security/wireless-security.c b/src/wireless-security/wireless-security.c
index bdaa8256..d5447e0a 100644
--- a/src/wireless-security/wireless-security.c
+++ b/src/wireless-security/wireless-security.c
@@ -373,7 +373,8 @@ ws_802_1x_auth_combo_init (WirelessSecurity *sec,
                            GCallback auth_combo_changed_cb,
                            NMConnection *connection,
                            gboolean is_editor,
-                           gboolean secrets_only)
+                           gboolean secrets_only,
+                           const char *const*secrets_hints)
 {
 	GtkWidget *combo, *widget;
 	GtkListStore *auth_model;
@@ -385,6 +386,7 @@ ws_802_1x_auth_combo_init (WirelessSecurity *sec,
 	EAPMethodFAST *em_fast;
 	EAPMethodTTLS *em_ttls;
 	EAPMethodPEAP *em_peap;
+	EAPMethodSimple *em_hints;
 	const char *default_method = NULL, *ctype = NULL;
 	int active = -1, item = 0;
 	gboolean wired = FALSE;
@@ -418,7 +420,7 @@ ws_802_1x_auth_combo_init (WirelessSecurity *sec,
 		simple_flags |= EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY;
 
 	if (wired) {
-		em_md5 = eap_method_simple_new (sec, connection, EAP_METHOD_SIMPLE_TYPE_MD5, simple_flags);
+		em_md5 = eap_method_simple_new (sec, connection, EAP_METHOD_SIMPLE_TYPE_MD5, simple_flags, NULL);
 		gtk_list_store_append (auth_model, &iter);
 		gtk_list_store_set (auth_model, &iter,
 			                AUTH_NAME_COLUMN, _("MD5"),
@@ -454,7 +456,7 @@ ws_802_1x_auth_combo_init (WirelessSecurity *sec,
 		item++;
 	}
 
-	em_pwd = eap_method_simple_new (sec, connection, EAP_METHOD_SIMPLE_TYPE_PWD, simple_flags);
+	em_pwd = eap_method_simple_new (sec, connection, EAP_METHOD_SIMPLE_TYPE_PWD, simple_flags, NULL);
 	gtk_list_store_append (auth_model, &iter);
 	gtk_list_store_set (auth_model, &iter,
 	                    AUTH_NAME_COLUMN, _("PWD"),
@@ -498,6 +500,19 @@ ws_802_1x_auth_combo_init (WirelessSecurity *sec,
 		active = item;
 	item++;
 
+	if (secrets_hints) {
+		em_hints = eap_method_simple_new (sec, connection, EAP_METHOD_SIMPLE_TYPE_UNKNOWN,
+		                                  simple_flags, secrets_hints);
+		gtk_list_store_append (auth_model, &iter);
+		gtk_list_store_set (auth_model, &iter,
+		                    AUTH_NAME_COLUMN, "Unknown",
+		                    AUTH_METHOD_COLUMN, em_hints,
+		                    -1);
+		eap_method_unref (EAP_METHOD (em_hints));
+		active = item;
+		item++;
+	}
+
 	combo = GTK_WIDGET (gtk_builder_get_object (sec->builder, combo_name));
 	g_assert (combo);
 
diff --git a/src/wireless-security/wireless-security.h b/src/wireless-security/wireless-security.h
index caba4a8d..64c99042 100644
--- a/src/wireless-security/wireless-security.h
+++ b/src/wireless-security/wireless-security.h
@@ -123,7 +123,8 @@ GtkWidget *ws_802_1x_auth_combo_init (WirelessSecurity *sec,
                                       GCallback auth_combo_changed_cb,
                                       NMConnection *connection,
                                       gboolean is_editor,
-                                      gboolean secrets_only);
+                                      gboolean secrets_only,
+                                      const char *const*secrets_hints);
 
 void ws_802_1x_auth_combo_changed (GtkWidget *combo,
                                    WirelessSecurity *sec,
diff --git a/src/wireless-security/ws-dynamic-wep.c b/src/wireless-security/ws-dynamic-wep.c
index 810a1056..27ce4326 100644
--- a/src/wireless-security/ws-dynamic-wep.c
+++ b/src/wireless-security/ws-dynamic-wep.c
@@ -124,7 +124,8 @@ ws_dynamic_wep_new (NMConnection *connection,
 	                                    (GCallback) auth_combo_changed_cb,
 	                                    connection,
 	                                    is_editor,
-	                                    secrets_only);
+	                                    secrets_only,
+	                                    NULL);
 	auth_combo_changed_cb (widget, (gpointer) parent);
 
 	return (WirelessSecurityDynamicWEP *) parent;
diff --git a/src/wireless-security/ws-wpa-eap.c b/src/wireless-security/ws-wpa-eap.c
index c58dd7f5..10af2129 100644
--- a/src/wireless-security/ws-wpa-eap.c
+++ b/src/wireless-security/ws-wpa-eap.c
@@ -126,7 +126,8 @@ ws_wpa_eap_new (NMConnection *connection,
 	                                    (GCallback) auth_combo_changed_cb,
 	                                    connection,
 	                                    is_editor,
-	                                    secrets_only);
+	                                    secrets_only,
+	                                    secrets_hints);
 	auth_combo_changed_cb (widget, parent);
 
 	return (WirelessSecurityWPAEAP *) parent;