Index: network-manager-0.8/introspection/nm-settings.xml
===================================================================
--- network-manager-0.8.orig/introspection/nm-settings.xml	2010-04-29 11:22:10.000000000 -0400
+++ network-manager-0.8/introspection/nm-settings.xml	2010-04-29 11:22:18.000000000 -0400
@@ -43,5 +43,42 @@
     </signal>
 
   </interface>
+
+  <interface name="org.freedesktop.NetworkManagerSettings.Secrets">
+    <tp:docstring>
+        Secrets have a separate interface so that they can be locked down.
+    </tp:docstring>
+
+    <method name="GetSecretsForConnection">
+      <tp:docstring>
+        Get the secrets for the requested connection.
+      </tp:docstring>
+      <annotation name="org.freedesktop.DBus.GLib.CSymbol" value="impl_settings_get_secrets_for_connection"/>
+      <annotation name="org.freedesktop.DBus.GLib.Async" value=""/>
+      <arg name="connection" type="o" direction="in">
+        <tp:docstring>
+          Object path of the connection.
+        </tp:docstring>
+      </arg>
+      <arg name="setting_name" type="s" direction="in">
+        <tp:docstring>
+          Name of the setting to return.
+        </tp:docstring>
+      </arg>
+      <arg name="hints" type="as" direction="in">
+        <tp:docstring>
+          Array of strings of key names in the Setting for which NM thinks
+          a secrets may be required.
+        </tp:docstring>
+      </arg>
+
+      <arg name="secrets" type="a{sa{sv}}" direction="out" tp:type="String_String_Variant_Map_Map">
+        <tp:docstring>
+          Nested settings maps containing secrets.  Each setting MUST contain at least the 'name' field, containing the name of the setting, and one or more secrets.
+        </tp:docstring>
+      </arg>
+    </method>
+
+  </interface>
 </node>
 
Index: network-manager-0.8/libnm-glib/nm-settings-service.c
===================================================================
--- network-manager-0.8.orig/libnm-glib/nm-settings-service.c	2010-04-29 11:22:10.000000000 -0400
+++ network-manager-0.8/libnm-glib/nm-settings-service.c	2010-04-29 11:22:18.000000000 -0400
@@ -36,6 +36,12 @@
                                           GHashTable *settings,
                                           DBusGMethodInvocation *context);
 
+static void impl_settings_get_secrets_for_connection (NMSettingsService *self,
+                                                      const gchar *connection_path,
+                                                      const gchar *setting_name,
+                                                      const gchar **hints,
+                                                      DBusGMethodInvocation *context);
+
 #include "nm-settings-glue.h"
 
 static void settings_interface_init (NMSettingsInterface *class);
@@ -219,6 +225,80 @@
 	g_object_unref (tmp);
 }
 
+static gboolean
+get_secrets_for_connection (NMSettingsInterface *settings,
+                            const gchar *connection_path,
+                            const gchar *setting_name,
+                            const gchar **hints,
+                            NMSettingsGetSecretsForConnectionFunc callback,
+                            gpointer user_data)
+{
+	NMSettingsService *self = NM_SETTINGS_SERVICE (settings);
+	GError *error = NULL;
+	gboolean success = FALSE;
+
+	if (NM_SETTINGS_SERVICE_GET_CLASS (self)->get_secrets_for_connection) {
+		NM_SETTINGS_SERVICE_GET_CLASS (self)->get_secrets_for_connection (self,
+		                                                                  connection_path,
+		                                                                  setting_name,
+		                                                                  hints,
+		                                                                  NULL,
+		                                                                  callback,
+		                                                                  user_data);
+		success = TRUE;
+	} else {
+		error = g_error_new (NM_SETTINGS_INTERFACE_ERROR,
+		                     NM_SETTINGS_INTERFACE_ERROR_INTERNAL_ERROR,
+		                     "%s: %s:%d get_secrets_for_connection() not implemented",
+		                     __func__, __FILE__, __LINE__);
+		callback (settings, NULL, error, user_data);
+		g_error_free (error);
+	}
+
+	return success;
+}
+
+static void
+dbus_get_secrets_cb (NMSettingsInterface *settings,
+                     GHashTable *secrets,
+                     GError *error,
+                     gpointer user_data)
+{
+	DBusGMethodInvocation *context = user_data;
+
+	if (error)
+		dbus_g_method_return_error (context, error);
+	else
+		dbus_g_method_return (context, secrets);
+}
+
+static void
+impl_settings_get_secrets_for_connection (NMSettingsService *self,
+                                          const gchar *connection_path,
+                                          const gchar *setting_name,
+                                          const gchar **hints,
+                                          DBusGMethodInvocation *context)
+{
+	GError *error = NULL;
+
+	if (NM_SETTINGS_SERVICE_GET_CLASS (self)->get_secrets_for_connection)
+		NM_SETTINGS_SERVICE_GET_CLASS (self)->get_secrets_for_connection (self,
+		                                                                  connection_path,
+		                                                                  setting_name,
+		                                                                  hints,
+		                                                                  context,
+		                                                                  dbus_get_secrets_cb,
+		                                                                  context);
+	else {
+		error = g_error_new (NM_SETTINGS_INTERFACE_ERROR,
+		                     NM_SETTINGS_INTERFACE_ERROR_INTERNAL_ERROR,
+		                     "%s: %s:%d get_secrets_for_connection() not implemented",
+		                     __func__, __FILE__, __LINE__);
+		dbus_g_method_return_error (context, error);
+		g_error_free (error);
+	}
+}
+
 void
 nm_settings_service_export_connection (NMSettingsService *self,
                                        NMSettingsConnectionInterface *connection)
@@ -251,6 +331,7 @@
 	iface->list_connections = list_connections;
 	iface->get_connection_by_path = get_connection_by_path;
 	iface->add_connection = add_connection;
+	iface->get_secrets_for_connection = get_secrets_for_connection;
 
 	dbus_g_object_type_install_info (G_TYPE_FROM_INTERFACE (iface),
 	                                 &dbus_glib_nm_settings_object_info);
Index: network-manager-0.8/libnm-glib/nm-settings-service.h
===================================================================
--- network-manager-0.8.orig/libnm-glib/nm-settings-service.h	2010-04-29 11:22:10.000000000 -0400
+++ network-manager-0.8/libnm-glib/nm-settings-service.h	2010-04-29 11:22:18.000000000 -0400
@@ -58,13 +58,20 @@
 	                        NMSettingsAddConnectionFunc callback,
 	                        gpointer user_data);
 
+	void (*get_secrets_for_connection) (NMSettingsService *self,
+	                                    const gchar *connection_path,
+	                                    const gchar *setting_name,
+	                                    const gchar **hints,
+	                                    DBusGMethodInvocation *context,
+	                                    NMSettingsGetSecretsForConnectionFunc callback,
+	                                    gpointer user_data);
+
 	/* Padding for future expansion */
 	void (*_reserved1) (void);
 	void (*_reserved2) (void);
 	void (*_reserved3) (void);
 	void (*_reserved4) (void);
 	void (*_reserved5) (void);
-	void (*_reserved6) (void);
 } NMSettingsServiceClass;
 
 GType nm_settings_service_get_type (void);
Index: network-manager-0.8/libnm-glib/nm-settings-interface.c
===================================================================
--- network-manager-0.8.orig/libnm-glib/nm-settings-interface.c	2010-04-29 11:22:10.000000000 -0400
+++ network-manager-0.8/libnm-glib/nm-settings-interface.c	2010-04-29 11:22:18.000000000 -0400
@@ -143,6 +143,42 @@
 	return FALSE;
 }
 
+/**
+ * nm_settings_interface_get_secrets_for_connection:
+ * @settings: a object implementing %NMSettingsInterface
+ * @setting_name: the name of the setting for which to get secrets
+ * @hints: a list of hints
+ *
+ * Requests that the settings service get the secrets for the requested connection.
+ *
+ * Returns: TRUE if the request was successful, FALSE if it failed
+ **/
+gboolean
+nm_settings_interface_get_secrets_for_connection (NMSettingsInterface *settings,
+	                                              const gchar *connection_path,
+	                                              const gchar *setting_name,
+	                                              const gchar **hints,
+                                                  NMSettingsGetSecretsForConnectionFunc callback,
+                                                  gpointer user_data)
+{
+	g_return_val_if_fail (settings != NULL, FALSE);
+	g_return_val_if_fail (NM_IS_SETTINGS_INTERFACE (settings), FALSE);
+	g_return_val_if_fail (connection_path != NULL, FALSE);
+	g_return_val_if_fail (setting_name != NULL, FALSE);
+	g_return_val_if_fail (hints != NULL, FALSE);
+	g_return_val_if_fail (callback != NULL, FALSE);
+
+	if (NM_SETTINGS_INTERFACE_GET_INTERFACE (settings)->get_secrets_for_connection) {
+		return NM_SETTINGS_INTERFACE_GET_INTERFACE (settings)->get_secrets_for_connection (settings,
+		                                                                                   connection_path,
+		                                                                                   setting_name,
+		                                                                                   hints,
+		                                                                                   callback,
+		                                                                                   user_data);
+	}
+	return FALSE;
+}
+
 /*****************************************************************/
 
 static void
Index: network-manager-0.8/libnm-glib/nm-settings-interface.h
===================================================================
--- network-manager-0.8.orig/libnm-glib/nm-settings-interface.h	2010-04-29 11:22:10.000000000 -0400
+++ network-manager-0.8/libnm-glib/nm-settings-interface.h	2010-04-29 11:22:18.000000000 -0400
@@ -58,6 +58,11 @@
                                              GError *error,
                                              gpointer user_data);
 
+typedef void (*NMSettingsGetSecretsForConnectionFunc) (NMSettingsInterface *settings,
+                                                       GHashTable *secrets,
+                                                       GError *error,
+                                                       gpointer user_data);
+
 struct _NMSettingsInterface {
 	GTypeInterface g_iface;
 
@@ -73,6 +78,13 @@
 	                            NMSettingsAddConnectionFunc callback,
 	                            gpointer user_data);
 
+	gboolean (*get_secrets_for_connection) (NMSettingsInterface *self,
+	                                        const gchar *connection_path,
+	                                        const gchar *setting_name,
+	                                        const gchar **hints,
+                                            NMSettingsGetSecretsForConnectionFunc callback,
+                                            gpointer user_data);
+
 	/* Signals */
 	void (*new_connection) (NMSettingsInterface *settings,
 	                        NMSettingsConnectionInterface *connection);
@@ -85,7 +97,6 @@
 	void (*_reserved3) (void);
 	void (*_reserved4) (void);
 	void (*_reserved5) (void);
-	void (*_reserved6) (void);
 };
 
 GType nm_settings_interface_get_type (void);
@@ -101,5 +112,12 @@
                                                NMSettingsAddConnectionFunc callback,
                                                gpointer user_data);
 
+gboolean nm_settings_interface_get_secrets_for_connection (NMSettingsInterface *settings,
+                                                           const gchar *connection_path,
+                                                           const gchar *setting_name,
+                                                           const gchar **hints,
+                                                           NMSettingsGetSecretsForConnectionFunc callback,
+                                                           gpointer user_data);
+
 
 #endif /* NM_SETTINGS_INTERFACE_H */
Index: network-manager-0.8/src/nm-manager.c
===================================================================
--- network-manager-0.8.orig/src/nm-manager.c	2010-04-29 11:22:18.000000000 -0400
+++ network-manager-0.8/src/nm-manager.c	2010-04-30 15:07:24.000000000 -0400
@@ -1885,7 +1885,7 @@
 	guint32 idle_id;
 	char *hint1;
 	char *hint2;
-	char *connection_path;
+	NMConnection *connection;
 } GetSecretsInfo;
 
 static void
@@ -1910,7 +1910,7 @@
 	g_free (info->hint1);
 	g_free (info->hint2);
 	g_free (info->setting_name);
-	g_free (info->connection_path);
+	g_object_unref (info->connection);
 	memset (info, 0, sizeof (GetSecretsInfo));
 	g_free (info);
 }
@@ -1932,6 +1932,15 @@
 }
 
 static void
+system_connection_update_cb (NMSettingsConnectionInterface *connection,
+                             GError *error,
+                             gpointer user_data)
+{
+	if (error != NULL)
+		nm_warning ("%s: could not update system connection: %s", __func__, error->message);
+}
+
+static void
 user_get_secrets_cb (DBusGProxy *proxy,
                      DBusGProxyCall *call,
                      gpointer user_data)
@@ -1955,6 +1964,13 @@
 		                                                  info->caller,
 		                                                  settings,
 		                                                  NULL);
+
+		/* If this connection is a system one, we need to update it on our end */
+		if (nm_connection_get_scope (info->connection) == NM_CONNECTION_SCOPE_SYSTEM)
+			nm_settings_connection_interface_update (NM_SETTINGS_CONNECTION_INTERFACE (info->connection),
+			                                         system_connection_update_cb,
+			                                         NULL);
+
 		g_hash_table_destroy (settings);
 	} else {
 		nm_secrets_provider_interface_get_secrets_result (info->provider,
@@ -2025,6 +2041,7 @@
 	return info;
 }
 
+
 static void
 system_get_secrets_reply_cb (NMSettingsConnectionInterface *connection,
                              GHashTable *secrets,
@@ -2045,6 +2062,42 @@
 	g_object_unref (provider);
 }
 
+static void
+system_get_secrets_from_user (GetSecretsInfo *info)
+{
+	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (info->manager);
+	DBusGConnection *g_connection;
+	GPtrArray *hints = NULL;
+
+	g_connection = nm_dbus_manager_get_connection (priv->dbus_mgr);
+	info->proxy = dbus_g_proxy_new_for_name (g_connection,
+	                                         NM_DBUS_SERVICE_USER_SETTINGS,
+	                                         NM_DBUS_PATH_SETTINGS,
+	                                         NM_DBUS_IFACE_SETTINGS_SECRETS);
+	if (!info->proxy) {
+		nm_warning ("%s: could not create user settings secrets proxy", __func__);
+		system_get_secrets_reply_cb (NULL, NULL, NULL, info); // FIXME pass error
+		return;
+	}
+
+	hints = g_ptr_array_sized_new (2);
+	if (info->hint1)
+		g_ptr_array_add (hints, (char *) info->hint1);
+	if (info->hint2)
+		g_ptr_array_add (hints, (char *) info->hint2);
+
+	info->call = dbus_g_proxy_begin_call_with_timeout (info->proxy, "GetSecretsForConnection",
+	                                                   user_get_secrets_cb,
+	                                                   info,
+	                                                   NULL,
+	                                                   G_MAXINT32,
+	                                                   DBUS_TYPE_G_OBJECT_PATH, nm_connection_get_path(info->connection),
+	                                                   G_TYPE_STRING, info->setting_name,
+	                                                   DBUS_TYPE_G_ARRAY_OF_STRING, hints,
+	                                                   G_TYPE_INVALID);
+	g_ptr_array_free (hints, TRUE);
+}
+
 static gboolean
 system_get_secrets_idle_cb (gpointer user_data)
 {
@@ -2057,7 +2110,7 @@
 	info->idle_id = 0;
 
 	connection = nm_settings_interface_get_connection_by_path (NM_SETTINGS_INTERFACE (priv->sys_settings), 
-	                                                           info->connection_path);
+	                                                           nm_connection_get_path(info->connection));
 	if (!connection) {
 		error = g_error_new_literal (0, 0, "unknown connection (not exported by system settings)");
 		nm_secrets_provider_interface_get_secrets_result (info->provider,
@@ -2072,12 +2125,16 @@
 
 	hints[0] = info->hint1;
 	hints[1] = info->hint2;
-	nm_settings_connection_interface_get_secrets (connection,
-	                                              info->setting_name,
-	                                              hints,
-	                                              info->request_new,
-	                                              system_get_secrets_reply_cb,
-	                                              info);
+
+	if (info->request_new)
+		system_get_secrets_from_user (info);
+	else
+		nm_settings_connection_interface_get_secrets (connection,
+		                                              info->setting_name,
+		                                              hints,
+		                                              info->request_new,
+		                                              system_get_secrets_reply_cb,
+		                                              info);
 	return FALSE;
 }
 
@@ -2100,7 +2157,7 @@
 	info->setting_name = g_strdup (setting_name);
 	info->hint1 = hint1 ? g_strdup (hint1) : NULL;
 	info->hint2 = hint2 ? g_strdup (hint2) : NULL;
-	info->connection_path = g_strdup (nm_connection_get_path (connection));
+	info->connection = g_object_ref (connection);
 	info->request_new = request_new;
 
 	g_object_weak_ref (G_OBJECT (provider), (GWeakNotify) free_get_secrets_info, info);
Index: network-manager-0.8/include/NetworkManager.h
===================================================================
--- network-manager-0.8.orig/include/NetworkManager.h	2010-04-29 13:19:43.000000000 -0400
+++ network-manager-0.8/include/NetworkManager.h	2010-04-29 13:20:16.000000000 -0400
@@ -47,6 +47,7 @@
 #define NM_DBUS_SERVICE_USER_SETTINGS     "org.freedesktop.NetworkManagerUserSettings"
 #define NM_DBUS_SERVICE_SYSTEM_SETTINGS   "org.freedesktop.NetworkManagerSystemSettings"
 #define NM_DBUS_IFACE_SETTINGS            "org.freedesktop.NetworkManagerSettings"
+#define NM_DBUS_IFACE_SETTINGS_SECRETS    "org.freedesktop.NetworkManagerSettings.Secrets"
 #define NM_DBUS_IFACE_SETTINGS_SYSTEM     "org.freedesktop.NetworkManagerSettings.System"
 #define NM_DBUS_PATH_SETTINGS             "/org/freedesktop/NetworkManagerSettings"
 
