Version set to 1.0-alpha11

Credential prompt sometimes displayed in background issue fixed now
Variable renamed from Slovenian to English
2016-08-24 18:48:10 +02:00 · 2016-08-24 18:39:15 +02:00 · 2016-08-24 18:36:51 +02:00 · 2016-08-24 17:45:31 +02:00 · 2016-08-24 17:43:02 +02:00 · 2016-08-24 15:30:27 +02:00
47 changed files with 4069 additions and 433 deletions
--- a/EventMonitor/App.cpp
+++ b/EventMonitor/App.cpp
@@ -66,12 +66,12 @@ bool wxEventMonitorApp::OnInit()

 #ifdef __WXMSW__
    // Find EventMonitor window if already running.
-    HWND okno = ::FindWindow(_T("wxWindowNR"), _("Event Monitor"));
-    if (okno) {
-        if (::IsIconic(okno))
-            ::SendMessage(okno, WM_SYSCOMMAND, SC_RESTORE, 0);
-        ::SetActiveWindow(okno);
-        ::SetForegroundWindow(okno);
+    HWND hWnd = ::FindWindow(_T("wxWindowNR"), _("Event Monitor"));
+    if (hWnd) {
+        if (::IsIconic(hWnd))
+            ::SendMessage(hWnd, WM_SYSCOMMAND, SC_RESTORE, 0);
+        ::SetActiveWindow(hWnd);
+        ::SetForegroundWindow(hWnd);

        // Not an error condition actually; Just nothing else to do...
        return false;
--- a/BIN
+++ b/BIN
--- a/include/Common.props
+++ b/include/Common.props
@@ -32,7 +32,7 @@
  <ItemDefinitionGroup>
    <ClCompile>
      <WarningLevel>Level4</WarningLevel>
-      <PreprocessorDefinitions>_WIN32_WINNT=0x0600;ISOLATION_AWARE_ENABLED=1;CERT_CHAIN_PARA_HAS_EXTRA_FIELDS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>_WIN32_WINNT=0x0600;ISOLATION_AWARE_ENABLED=1;SECURITY_WIN32;CERT_CHAIN_PARA_HAS_EXTRA_FIELDS;EAP_TLS=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <PrecompiledHeader>Use</PrecompiledHeader>
      <PrecompiledHeaderFile>StdAfx.h</PrecompiledHeaderFile>
      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
--- a/include/Version.h
+++ b/include/Version.h
@@ -29,7 +29,7 @@
 // Product version as a single DWORD
 // Note: Used for version comparison within C/C++ code.
 //
-#define PRODUCT_VERSION          0x00ff0800
+#define PRODUCT_VERSION          0x00ff0b00

 //
 // Product version by components
@@ -39,26 +39,26 @@
 //
 #define PRODUCT_VERSION_MAJ      0
 #define PRODUCT_VERSION_MIN      255
-#define PRODUCT_VERSION_REV      8
+#define PRODUCT_VERSION_REV      11
 #define PRODUCT_VERSION_BUILD    0

 //
 // Human readable product version and build year for UI
 //
-#define PRODUCT_VERSION_STR      "1.0-alpha8"
+#define PRODUCT_VERSION_STR      "1.0-alpha11"
 #define PRODUCT_BUILD_YEAR_STR   "2016"

 //
 // Numerical version presentation for ProductVersion propery in
 // MSI packages (syntax: N.N[.N[.N]])
 //
-#define PRODUCT_VERSION_INST     "0.255.8"
+#define PRODUCT_VERSION_INST     "0.255.11"

 //
 // The product code for ProductCode property in MSI packages
 // Replace with new on every version change, regardless how minor it is.
 //
-#define PRODUCT_VERSION_GUID     "{82B292B6-F561-4DE1-8963-262A20B4E085}"
+#define PRODUCT_VERSION_GUID     "{C6CA6AA8-33A4-4867-BB0A-B5F82655D611}"

 //
 // Since the product name is not finally confirmed at the time of
--- a/lib/EAPBase/include/Config.h
+++ b/lib/EAPBase/include/Config.h
@@ -40,14 +40,14 @@ namespace eap
    class config_method_with_cred;

    ///
-    /// Base class for single provider configuration storage
+    /// Provider configuration storage
    ///
    class config_provider;

    ///
-    /// Base class for the list of providers configuration storage
+    /// Connection configuration storage
    ///
-    class config_provider_list;
+    class config_connection;
 }

 ///
@@ -89,7 +89,6 @@ inline void operator>>(_Inout_ eap::cursor_in &cursor, _Out_ eap::config &val);
 #include <eaptypes.h> // Must include after <Windows.h>
 #include <tchar.h>

-#include <list>
 #include <string>
 #include <memory>

@@ -451,11 +450,11 @@ namespace eap
        winstd::tstring m_lbl_alt_credential;                   ///< Alternative label for credential prompt
        winstd::tstring m_lbl_alt_identity;                     ///< Alternative label for identity prompt
        winstd::tstring m_lbl_alt_password;                     ///< Alternative label for password prompt
-        std::list<std::unique_ptr<config_method> > m_methods;   ///< List of method configurations
+        std::vector<std::unique_ptr<config_method> > m_methods; ///< Array of method configurations
    };


-    class config_provider_list : public config
+    class config_connection : public config
    {
    public:
        ///
@@ -463,21 +462,21 @@ namespace eap
        ///
        /// \param[in] mod  EAP module to use for global services
        ///
-        config_provider_list(_In_ module &mod);
+        config_connection(_In_ module &mod);

        ///
        /// Copies configuration
        ///
        /// \param[in] other  Configuration to copy from
        ///
-        config_provider_list(_In_ const config_provider_list &other);
+        config_connection(_In_ const config_connection &other);

        ///
        /// Moves configuration
        ///
        /// \param[in] other  Configuration to move from
        ///
-        config_provider_list(_Inout_ config_provider_list &&other);
+        config_connection(_Inout_ config_connection &&other);

        ///
        /// Copies configuration
@@ -486,7 +485,7 @@ namespace eap
        ///
        /// \returns Reference to this object
        ///
-        config_provider_list& operator=(_In_ const config_provider_list &other);
+        config_connection& operator=(_In_ const config_connection &other);

        ///
        /// Moves configuration
@@ -495,7 +494,7 @@ namespace eap
        ///
        /// \returns Reference to this object
        ///
-        config_provider_list& operator=(_Inout_ config_provider_list &&other);
+        config_connection& operator=(_Inout_ config_connection &&other);

        ///
        /// Clones configuration
@@ -551,7 +550,8 @@ namespace eap
        /// @}

    public:
-        std::list<eap::config_provider> m_providers;    ///< List of provider configurations
+        GUID m_connection_id;                           ///< Unique connection ID
+        std::vector<eap::config_provider> m_providers;  ///< Array of provider configurations
    };
 }

--- a/lib/EAPBase/include/Credentials.h
+++ b/lib/EAPBase/include/Credentials.h
@@ -120,6 +120,52 @@ namespace eap
        ///
        virtual bool empty() const;

+        /// \name XML configuration management
+        /// @{
+
+        ///
+        /// Save to XML document
+        ///
+        /// \param[in]  pDoc         XML document
+        /// \param[in]  pConfigRoot  Suggested root element for saving
+        ///
+        virtual void save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const;
+
+        ///
+        /// Load from XML document
+        ///
+        /// \param[in]  pConfigRoot  Root element for loading
+        ///
+        virtual void load(_In_ IXMLDOMNode *pConfigRoot);
+
+        /// @}
+
+        /// \name BLOB management
+        /// @{
+
+        ///
+        /// Packs a configuration
+        ///
+        /// \param[inout] cursor  Memory cursor
+        ///
+        virtual void operator<<(_Inout_ cursor_out &cursor) const;
+
+        ///
+        /// Returns packed size of a configuration
+        ///
+        /// \returns Size of data when packed (in bytes)
+        ///
+        virtual size_t get_pk_size() const;
+
+        ///
+        /// Unpacks a configuration
+        ///
+        /// \param[inout] cursor  Memory cursor
+        ///
+        virtual void operator>>(_Inout_ cursor_in &cursor);
+
+        /// @}
+
        /// \name Storage
        /// @{

@@ -164,12 +210,15 @@ namespace eap
        ///
        /// Returns credential identity.
        ///
-        virtual std::wstring get_identity() const = 0;
+        virtual std::wstring get_identity() const;

        ///
        /// Returns credential name (for GUI display).
        ///
        virtual winstd::tstring get_name() const;
+
+    public:
+        std::wstring m_identity;    ///< Identity (username\@domain, certificate name etc.)
    };


@@ -294,13 +343,7 @@ namespace eap

        /// @}

-        ///
-        /// Returns credential identity.
-        ///
-        virtual std::wstring get_identity() const;
-
    public:
-        std::wstring               m_identity;  ///< Identity (username\@domain, certificate name etc.)
        winstd::sanitizing_wstring m_password;  ///< Password

    private:
--- a/lib/EAPBase/include/EAP.h
+++ b/lib/EAPBase/include/EAP.h
@@ -391,6 +391,31 @@ template<size_t N> inline size_t pksizeof(_In_ const eap::sanitizing_blob_f<N> &
 ///
 template<size_t N> inline void operator>>(_Inout_ eap::cursor_in &cursor, _Out_ eap::sanitizing_blob_f<N> &val);

+///
+/// Packs a GUID
+///
+/// \param[inout] cursor  Memory cursor
+/// \param[in]    val     Variable with data to pack
+///
+inline void operator<<(_Inout_ eap::cursor_out &cursor, _In_ const GUID &val);
+
+///
+/// Returns packed size of a GUID
+///
+/// \param[in] val  Data to pack
+///
+/// \returns Size of data when packed (in bytes)
+///
+inline size_t pksizeof(_In_ const GUID &val);
+
+///
+/// Unpacks a GUID
+///
+/// \param[inout] cursor  Memory cursor
+/// \param[out]   val     Variable to receive unpacked value
+///
+inline void operator>>(_Inout_ eap::cursor_in &cursor, _Out_ GUID &val);
+
 #ifndef htonll
 ///
 /// Convert host converts an unsigned __int64 from host to TCP/IP network byte order.
@@ -975,6 +1000,31 @@ inline void operator>>(_Inout_ eap::cursor_in &cursor, _Out_ eap::sanitizing_blo
 }


+inline void operator<<(_Inout_ eap::cursor_out &cursor, _In_ const GUID &val)
+{
+    eap::cursor_out::ptr_type ptr_end = cursor.ptr + sizeof(GUID);
+    assert(ptr_end <= cursor.ptr_end);
+    memcpy(cursor.ptr, &val, sizeof(GUID));
+    cursor.ptr = ptr_end;
+}
+
+
+inline size_t pksizeof(_In_ const GUID &val)
+{
+    UNREFERENCED_PARAMETER(val);
+    return sizeof(GUID);
+}
+
+
+inline void operator>>(_Inout_ eap::cursor_in &cursor, _Out_ GUID &val)
+{
+    eap::cursor_in::ptr_type ptr_end = cursor.ptr + sizeof(GUID);
+    assert(ptr_end <= cursor.ptr_end);
+    memcpy(&val, cursor.ptr, sizeof(GUID));
+    cursor.ptr = ptr_end;
+}
+
+
 #ifndef htonll

 inline unsigned __int64 htonll(unsigned __int64 val)
--- a/lib/EAPBase/include/Method.h
+++ b/lib/EAPBase/include/Method.h
@@ -51,10 +51,10 @@ namespace eap
        /// Constructs an EAP method
        ///
        /// \param[in] mod   EAP module to use for global services
-        /// \param[in] cfg   Providers configuration
+        /// \param[in] cfg   Connection configuration
        /// \param[in] cred  User credentials
        ///
-        method(_In_ module &module, _In_ config_provider_list &cfg, _In_ credentials &cred);
+        method(_In_ module &module, _In_ config_connection &cfg, _In_ credentials &cred);


        ///
@@ -131,7 +131,7 @@ namespace eap

    public:
        module &m_module;           ///< EAP module
-        config_provider_list &m_cfg;    ///< Providers configuration
+        config_connection &m_cfg;   ///< Connection configuration
        credentials &m_cred;        ///< User credentials
    };
 }
--- a/lib/EAPBase/src/Config.cpp
+++ b/lib/EAPBase/src/Config.cpp
@@ -296,7 +296,8 @@ eap::config_provider::config_provider(_In_ const config_provider &other) :
    m_lbl_alt_password(other.m_lbl_alt_password),
    config(other)
 {
-    for (list<unique_ptr<config_method> >::const_iterator method = other.m_methods.cbegin(), method_end = other.m_methods.cend(); method != method_end; ++method)
+    m_methods.reserve(other.m_methods.size());
+    for (vector<unique_ptr<config_method> >::const_iterator method = other.m_methods.cbegin(), method_end = other.m_methods.cend(); method != method_end; ++method)
        m_methods.push_back(std::move(unique_ptr<config_method>(*method ? (config_method*)method->get()->clone() : nullptr)));
 }

@@ -332,7 +333,8 @@ eap::config_provider& eap::config_provider::operator=(_In_ const config_provider
        m_lbl_alt_password   = other.m_lbl_alt_password;

        m_methods.clear();
-        for (list<unique_ptr<config_method> >::const_iterator method = other.m_methods.cbegin(), method_end = other.m_methods.cend(); method != method_end; ++method)
+        m_methods.reserve(other.m_methods.size());
+        for (vector<unique_ptr<config_method> >::const_iterator method = other.m_methods.cbegin(), method_end = other.m_methods.cend(); method != method_end; ++method)
            m_methods.push_back(std::move(unique_ptr<config_method>(*method ? (config_method*)method->get()->clone() : nullptr)));
    }

@@ -432,7 +434,7 @@ void eap::config_provider::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pC
    if (FAILED(hr = eapxml::create_element(pDoc, pConfigRoot, bstr(L"eap-metadata:AuthenticationMethods"), bstr(L"AuthenticationMethods"), bstrNamespace, &pXmlElAuthenticationMethods)))
        throw com_runtime_error(hr, __FUNCTION__ " Error creating <AuthenticationMethods> element.");

-    for (list<unique_ptr<config_method> >::const_iterator method = m_methods.cbegin(), method_end = m_methods.cend(); method != method_end; ++method) {
+    for (vector<unique_ptr<config_method> >::const_iterator method = m_methods.cbegin(), method_end = m_methods.cend(); method != method_end; ++method) {
        // <AuthenticationMethod>
        com_obj<IXMLDOMElement> pXmlElAuthenticationMethod;
        if (FAILED(hr = eapxml::create_element(pDoc, bstr(L"AuthenticationMethod"), bstrNamespace, &pXmlElAuthenticationMethod)))
@@ -607,32 +609,36 @@ void eap::config_provider::operator>>(_Inout_ cursor_in &cursor)


 //////////////////////////////////////////////////////////////////////
-// eap::config_provider_list
+// eap::config_connection
 //////////////////////////////////////////////////////////////////////

-eap::config_provider_list::config_provider_list(_In_ module &mod) : config(mod)
+eap::config_connection::config_connection(_In_ module &mod) : config(mod)
 {
+    memset(&m_connection_id, 0, sizeof(m_connection_id));
 }


-eap::config_provider_list::config_provider_list(_In_ const config_provider_list &other) :
+eap::config_connection::config_connection(_In_ const config_connection &other) :
+    m_connection_id(other.m_connection_id),
    m_providers(other.m_providers),
    config(other)
 {
 }


-eap::config_provider_list::config_provider_list(_Inout_ config_provider_list &&other) :
+eap::config_connection::config_connection(_Inout_ config_connection &&other) :
+    m_connection_id(std::move(other.m_connection_id)),
    m_providers(std::move(other.m_providers)),
    config(std::move(other))
 {
 }


-eap::config_provider_list& eap::config_provider_list::operator=(_In_ const config_provider_list &other)
+eap::config_connection& eap::config_connection::operator=(_In_ const config_connection &other)
 {
    if (this != &other) {
        (config&)*this  = other;
+        m_connection_id = other.m_connection_id;
        m_providers     = other.m_providers;
    }

@@ -640,10 +646,11 @@ eap::config_provider_list& eap::config_provider_list::operator=(_In_ const confi
 }


-eap::config_provider_list& eap::config_provider_list::operator=(_Inout_ config_provider_list &&other)
+eap::config_connection& eap::config_connection::operator=(_Inout_ config_connection &&other)
 {
    if (this != &other) {
        (config&&)*this = std::move(other);
+        m_connection_id = std::move(other.m_connection_id);
        m_providers     = std::move(other.m_providers);
    }

@@ -651,13 +658,13 @@ eap::config_provider_list& eap::config_provider_list::operator=(_Inout_ config_p
 }


-eap::config* eap::config_provider_list::clone() const
+eap::config* eap::config_connection::clone() const
 {
-    return new config_provider_list(*this);
+    return new config_connection(*this);
 }


-void eap::config_provider_list::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const
+void eap::config_connection::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const
 {
    config::save(pDoc, pConfigRoot);

@@ -669,7 +676,7 @@ void eap::config_provider_list::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNod
    if (FAILED(hr = eapxml::select_node(pConfigRoot, bstr(L"eap-metadata:EAPIdentityProviderList"), &pXmlElIdentityProviderList)))
        throw com_runtime_error(hr, __FUNCTION__ " Error selecting <EAPIdentityProviderList> element.");

-    for (list<config_provider>::const_iterator provider = m_providers.cbegin(), provider_end = m_providers.cend(); provider != provider_end; ++provider) {
+    for (vector<config_provider>::const_iterator provider = m_providers.cbegin(), provider_end = m_providers.cend(); provider != provider_end; ++provider) {
        // <EAPIdentityProvider>
        com_obj<IXMLDOMElement> pXmlElIdentityProvider;
        if (FAILED(hr = eapxml::create_element(pDoc, bstr(L"EAPIdentityProvider"), bstrNamespace, &pXmlElIdentityProvider)))
@@ -684,13 +691,16 @@ void eap::config_provider_list::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNod
 }


-void eap::config_provider_list::load(_In_ IXMLDOMNode *pConfigRoot)
+void eap::config_connection::load(_In_ IXMLDOMNode *pConfigRoot)
 {
    assert(pConfigRoot);
    HRESULT hr;

    config::load(pConfigRoot);

+    // On each configuration import reset ID.
+    CoCreateGuid(&m_connection_id);
+
    // Iterate authentication providers (<EAPIdentityProvider>).
    com_obj<IXMLDOMNodeList> pXmlListProviders;
    if (FAILED(hr = eapxml::select_nodes(pConfigRoot, bstr(L"eap-metadata:EAPIdentityProviderList/eap-metadata:EAPIdentityProvider"), &pXmlListProviders)))
@@ -712,25 +722,29 @@ void eap::config_provider_list::load(_In_ IXMLDOMNode *pConfigRoot)
 }


-void eap::config_provider_list::operator<<(_Inout_ cursor_out &cursor) const
+void eap::config_connection::operator<<(_Inout_ cursor_out &cursor) const
 {
    config::operator<<(cursor);
+    cursor << m_connection_id;
    cursor << m_providers;
 }


-size_t eap::config_provider_list::get_pk_size() const
+size_t eap::config_connection::get_pk_size() const
 {
    return
        config::get_pk_size() +
+        pksizeof(m_connection_id) +
        pksizeof(m_providers    );
 }


-void eap::config_provider_list::operator>>(_Inout_ cursor_in &cursor)
+void eap::config_connection::operator>>(_Inout_ cursor_in &cursor)
 {
    config::operator>>(cursor);

+    cursor >> m_connection_id;
+
    list<config_provider>::size_type count;
    cursor >> count;
    m_providers.clear();
--- a/lib/EAPBase/src/Credentials.cpp
+++ b/lib/EAPBase/src/Credentials.cpp
@@ -36,12 +36,14 @@ eap::credentials::credentials(_In_ module &mod) : config(mod)


 eap::credentials::credentials(_In_ const credentials &other) :
+    m_identity(other.m_identity),
    config(other)
 {
 }


 eap::credentials::credentials(_Inout_ credentials &&other) :
+    m_identity(std::move(other.m_identity)),
    config(std::move(other))
 {
 }
@@ -49,8 +51,10 @@ eap::credentials::credentials(_Inout_ credentials &&other) :

 eap::credentials& eap::credentials::operator=(_In_ const credentials &other)
 {
-    if (this != &other)
+    if (this != &other) {
        (config&)*this = other;
+        m_identity     = other.m_identity;
+    }

    return *this;
 }
@@ -58,8 +62,10 @@ eap::credentials& eap::credentials::operator=(_In_ const credentials &other)

 eap::credentials& eap::credentials::operator=(_Inout_ credentials &&other)
 {
-    if (this != &other)
+    if (this != &other) {
        (config&)*this = std::move(other);
+        m_identity     = std::move(other.m_identity);
+    }

    return *this;
 }
@@ -67,13 +73,73 @@ eap::credentials& eap::credentials::operator=(_Inout_ credentials &&other)

 void eap::credentials::clear()
 {
+    m_identity.clear();
 }


 bool eap::credentials::empty() const
 {
-    // Base class always report empty credentials.
-    return true;
+    return m_identity.empty();
+}
+
+
+void eap::credentials::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const
+{
+    assert(pDoc);
+    assert(pConfigRoot);
+
+    config::save(pDoc, pConfigRoot);
+
+    const bstr bstrNamespace(L"urn:ietf:params:xml:ns:yang:ietf-eap-metadata");
+    HRESULT hr;
+
+    // <UserName>
+    if (FAILED(hr = eapxml::put_element_value(pDoc, pConfigRoot, bstr(L"UserName"), bstrNamespace, bstr(m_identity))))
+        throw com_runtime_error(hr, __FUNCTION__ " Error creating <UserName> element.");
+}
+
+
+void eap::credentials::load(_In_ IXMLDOMNode *pConfigRoot)
+{
+    assert(pConfigRoot);
+    HRESULT hr;
+
+    config::load(pConfigRoot);
+
+    std::wstring xpath(eapxml::get_xpath(pConfigRoot));
+
+    if (FAILED(hr = eapxml::get_element_value(pConfigRoot, bstr(L"eap-metadata:UserName"), m_identity)))
+        throw com_runtime_error(hr, __FUNCTION__ " Error reading <UserName> element.");
+
+    m_module.log_config((xpath + L"/UserName").c_str(), m_identity.c_str());
+}
+
+
+void eap::credentials::operator<<(_Inout_ cursor_out &cursor) const
+{
+    config::operator<<(cursor);
+    cursor << m_identity;
+}
+
+
+size_t eap::credentials::get_pk_size() const
+{
+    return
+        config::get_pk_size() +
+        pksizeof(m_identity);
+}
+
+
+void eap::credentials::operator>>(_Inout_ cursor_in &cursor)
+{
+    config::operator>>(cursor);
+    cursor >> m_identity;
+}
+
+
+wstring eap::credentials::get_identity() const
+{
+    return m_identity;
 }


@@ -93,7 +159,6 @@ eap::credentials_pass::credentials_pass(_In_ module &mod) : credentials(mod)


 eap::credentials_pass::credentials_pass(_In_ const credentials_pass &other) :
-    m_identity(other.m_identity),
    m_password(other.m_password),
    credentials(other)
 {
@@ -101,7 +166,6 @@ eap::credentials_pass::credentials_pass(_In_ const credentials_pass &other) :


 eap::credentials_pass::credentials_pass(_Inout_ credentials_pass &&other) :
-    m_identity(std::move(other.m_identity)),
    m_password(std::move(other.m_password)),
    credentials(std::move(other))
 {
@@ -112,7 +176,6 @@ eap::credentials_pass& eap::credentials_pass::operator=(_In_ const credentials_p
 {
    if (this != &other) {
        (credentials&)*this = other;
-        m_identity          = other.m_identity;
        m_password          = other.m_password;
    }

@@ -124,7 +187,6 @@ eap::credentials_pass& eap::credentials_pass::operator=(_Inout_ credentials_pass
 {
    if (this != &other) {
        (credentials&)*this = std::move(other);
-        m_identity          = std::move(other.m_identity);
        m_password          = std::move(other.m_password);
    }

@@ -135,14 +197,13 @@ eap::credentials_pass& eap::credentials_pass::operator=(_Inout_ credentials_pass
 void eap::credentials_pass::clear()
 {
    credentials::clear();
-    m_identity.clear();
    m_password.clear();
 }


 bool eap::credentials_pass::empty() const
 {
-    return credentials::empty() && m_identity.empty() && m_password.empty();
+    return credentials::empty() && m_password.empty();
 }


@@ -156,10 +217,6 @@ void eap::credentials_pass::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *p
    const bstr bstrNamespace(L"urn:ietf:params:xml:ns:yang:ietf-eap-metadata");
    HRESULT hr;

-    // <UserName>
-    if (FAILED(hr = eapxml::put_element_value(pDoc, pConfigRoot, bstr(L"UserName"), bstrNamespace, bstr(m_identity))))
-        throw com_runtime_error(hr, __FUNCTION__ " Error creating <UserName> element.");
-
    // <Password>
    bstr pass(m_password);
    hr = eapxml::put_element_value(pDoc, pConfigRoot, bstr(L"Password"), bstrNamespace, pass);
@@ -178,11 +235,6 @@ void eap::credentials_pass::load(_In_ IXMLDOMNode *pConfigRoot)

    std::wstring xpath(eapxml::get_xpath(pConfigRoot));

-    if (FAILED(hr = eapxml::get_element_value(pConfigRoot, bstr(L"eap-metadata:UserName"), m_identity)))
-        throw com_runtime_error(hr, __FUNCTION__ " Error reading <UserName> element.");
-
-    m_module.log_config((xpath + L"/UserName").c_str(), m_identity.c_str());
-
    bstr pass;
    if (FAILED(hr = eapxml::get_element_value(pConfigRoot, bstr(L"eap-metadata:Password"), &pass)))
        throw com_runtime_error(hr, __FUNCTION__ " Error reading <Password> element.");
@@ -202,7 +254,6 @@ void eap::credentials_pass::load(_In_ IXMLDOMNode *pConfigRoot)
 void eap::credentials_pass::operator<<(_Inout_ cursor_out &cursor) const
 {
    credentials::operator<<(cursor);
-    cursor << m_identity;
    cursor << m_password;
 }

@@ -211,7 +262,6 @@ size_t eap::credentials_pass::get_pk_size() const
 {
    return
        credentials::get_pk_size() +
-        pksizeof(m_identity) +
        pksizeof(m_password);
 }

@@ -219,7 +269,6 @@ size_t eap::credentials_pass::get_pk_size() const
 void eap::credentials_pass::operator>>(_Inout_ cursor_in &cursor)
 {
    credentials::operator>>(cursor);
-    cursor >> m_identity;
    cursor >> m_password;
 }

@@ -289,7 +338,7 @@ void eap::credentials_pass::retrieve(_In_z_ LPCTSTR pszTargetName)
        m_identity.clear();

    wstring xpath(pszTargetName);
-    m_module.log_config((xpath + L"/Username").c_str(), m_identity.c_str());
+    m_module.log_config((xpath + L"/Identity").c_str(), m_identity.c_str());
    m_module.log_config((xpath + L"/Password").c_str(),
 #ifdef _DEBUG
        m_password.c_str()
@@ -300,12 +349,6 @@ void eap::credentials_pass::retrieve(_In_z_ LPCTSTR pszTargetName)
 }


-std::wstring eap::credentials_pass::get_identity() const
-{
-    return m_identity;
-}
-
-
 const unsigned char eap::credentials_pass::s_entropy[1024] = {
    0x40, 0x88, 0xd3, 0x13, 0x81, 0x8a, 0xf6, 0x74, 0x55, 0x8e, 0xcc, 0x73, 0x2c, 0xf8, 0x93, 0x37,
    0x4f, 0xeb, 0x1d, 0x66, 0xb7, 0xfb, 0x47, 0x75, 0xb4, 0xfd, 0x07, 0xbb, 0xf6, 0xb3, 0x05, 0x30,
--- a/lib/EAPBase/src/Method.cpp
+++ b/lib/EAPBase/src/Method.cpp
@@ -28,7 +28,7 @@ using namespace winstd;
 // eap::method
 //////////////////////////////////////////////////////////////////////

-eap::method::method(_In_ module &module, _In_ config_provider_list &cfg, _In_ credentials &cred) :
+eap::method::method(_In_ module &module, _In_ config_connection &cfg, _In_ credentials &cred) :
    m_module(module),
    m_cfg(cfg),
    m_cred(cred)
--- a/lib/EAPBase/src/Module.cpp
+++ b/lib/EAPBase/src/Module.cpp
@@ -91,20 +91,26 @@ EAP_ERROR* eap::module::make_error(_In_ std::exception &err) const
    MultiByteToWideChar(CP_ACP, 0, err.what(), -1, what);

    {
-        win_runtime_error &e(dynamic_cast<win_runtime_error&>(err));
-        if (&e)
-            return make_error(e.number(), what.c_str());
+        win_runtime_error *e = dynamic_cast<win_runtime_error*>(&err);
+        if (e)
+            return make_error(e->number(), what.c_str());
    }

    {
-        com_runtime_error &e(dynamic_cast<com_runtime_error&>(err));
-        if (&e)
-            return make_error(HRESULT_CODE(e.number()), what.c_str());
+        com_runtime_error *e = dynamic_cast<com_runtime_error*>(&err);
+        if (e)
+            return make_error(HRESULT_CODE(e->number()), what.c_str());
    }

    {
-        invalid_argument &e(dynamic_cast<invalid_argument&>(err));
-        if (&e)
+        sec_runtime_error *e = dynamic_cast<sec_runtime_error*>(&err);
+        if (e)
+            return make_error(SCODE_CODE(e->number()), what.c_str());
+    }
+
+    {
+        invalid_argument *e = dynamic_cast<invalid_argument*>(&err);
+        if (e)
            return make_error(ERROR_INVALID_PARAMETER, what.c_str());
    }

--- a/lib/EAPBase/src/StdAfx.h
+++ b/lib/EAPBase/src/StdAfx.h
@@ -30,5 +30,6 @@

 #include <WinStd/Cred.h>
 #include <WinStd/ETW.h>
+#include <WinStd/Sec.h>

 #include <EventsETW.h>
--- a/lib/EAPBase_UI/include/EAP_UI.h
+++ b/lib/EAPBase_UI/include/EAP_UI.h
@@ -20,6 +20,7 @@

 #include <wx/hyperlink.h>
 #include <wx/icon.h>
+#include <wx/scrolwin.h>
 #include <wx/statbmp.h>
 #include <Windows.h>

@@ -34,18 +35,21 @@ class wxEAPBannerPanel;
 ///
 template <class _wxT> class wxEAPConfigDialog;

+///
+/// EAP general-use dialog
+///
+class wxEAPGeneralDialog;
+
 ///
 /// EAP top-most credential dialog
 ///
 class wxEAPCredentialsDialog;

-
 ///
 /// EAP general note
 ///
 class wxEAPNotePanel;

-
 ///
 /// EAP provider-locked congifuration note
 ///
@@ -56,6 +60,21 @@ class wxEAPProviderLockedPanel;
 ///
 class wxEAPCredentialWarningPanel;

+///
+/// EAP Configuration window
+///
+class wxEAPConfigWindow;
+
+///
+/// EAP provider identity config panel
+///
+class wxEAPProviderIdentityPanel;
+
+///
+/// EAP provider configuration dialog
+///
+class wxEAPConfigProvider;
+
 ///
 /// Base template for credential configuration panel
 ///
@@ -76,6 +95,19 @@ template <class _Tcred, class _Tbase> class wxPasswordCredentialsPanel;
 ///
 inline bool wxSetIconFromResource(wxStaticBitmap *bmp, wxIcon &icon, HINSTANCE hinst, PCWSTR pszName);

+///
+/// Returns GUI displayable provider name
+///
+inline wxString wxEAPGetProviderName(const std::wstring &id);
+
+namespace eap
+{
+    ///
+    /// Base class to prevent multiple instances of the same dialog
+    ///
+    class monitor_ui;
+}
+
 #pragma once

 #include <wx/msw/winundef.h> // Fixes `CreateDialog` name collision
@@ -118,20 +150,20 @@ public:
    ///
    /// Constructs a configuration dialog
    ///
-    /// \param[inout] cfg     Providers configuration data
+    /// \param[inout] cfg     Connection configuration
    /// \param[in]    parent  Parent window
    ///
-    wxEAPConfigDialog(eap::config_provider_list &cfg, wxWindow* parent) :
+    wxEAPConfigDialog(eap::config_connection &cfg, wxWindow* parent) :
        m_cfg(cfg),
        wxEAPConfigDialogBase(parent)
    {
        // Set extra style here, as wxFormBuilder overrides all default flags.
        this->SetExtraStyle(this->GetExtraStyle() | wxWS_EX_VALIDATE_RECURSIVELY);

-        for (std::list<eap::config_provider>::iterator provider = m_cfg.m_providers.begin(), provider_end = m_cfg.m_providers.end(); provider != provider_end; ++provider) {
+        for (std::vector<eap::config_provider>::iterator provider = m_cfg.m_providers.begin(), provider_end = m_cfg.m_providers.end(); provider != provider_end; ++provider) {
            bool is_single = provider->m_methods.size() == 1;
-            std::list<std::unique_ptr<eap::config_method> >::size_type count = 0;
-            std::list<std::unique_ptr<eap::config_method> >::iterator method = provider->m_methods.begin(), method_end = provider->m_methods.end();
+            std::vector<std::unique_ptr<eap::config_method> >::size_type count = 0;
+            std::vector<std::unique_ptr<eap::config_method> >::iterator method = provider->m_methods.begin(), method_end = provider->m_methods.end();
            for (; method != method_end; ++method, count++)
                m_providers->AddPage(
                    new _wxT(
@@ -139,7 +171,9 @@ public:
                        *method->get(),
                        provider->m_id.c_str(),
                        m_providers),
-                    is_single ? provider->m_id : winstd::tstring_printf(_T("%s (%u)"), provider->m_id.c_str(), count));
+                    is_single ?
+                        wxEAPGetProviderName(provider->m_id) :
+                        winstd::tstring_printf(_T("%s (%u)"), wxEAPGetProviderName(provider->m_id), count));
        }

        this->Layout();
@@ -151,6 +185,7 @@ public:

 protected:
    /// \cond internal
+
    virtual void OnInitDialog(wxInitDialogEvent& event)
    {
        // Forward the event to child panels.
@@ -160,26 +195,47 @@ protected:
                prov->GetEventHandler()->ProcessEvent(event);
        }
    }
+
+    virtual void OnUpdateUI(wxUpdateUIEvent& event)
+    {
+        UNREFERENCED_PARAMETER(event);
+
+        m_advanced->Enable(!m_cfg.m_providers.at(m_providers->GetSelection()).m_read_only);
+    }
+
+    virtual void OnAdvanced(wxCommandEvent& event)
+    {
+        UNREFERENCED_PARAMETER(event);
+
+        wxEAPConfigProvider dlg(m_cfg.m_providers.at(m_providers->GetSelection()), this);
+        dlg.ShowModal();
+    }
+
    /// \endcond


 protected:
-    eap::config_provider_list &m_cfg;  ///< EAP providers configuration
+    eap::config_connection &m_cfg;  ///< Connection configuration
 };


-class wxEAPCredentialsDialog : public wxEAPCredentialsDialogBase
+class wxEAPGeneralDialog : public wxEAPGeneralDialogBase
 {
 public:
    ///
-    /// Constructs a credential dialog
+    /// Constructs a dialog
    ///
-    wxEAPCredentialsDialog(const eap::config_provider &prov, wxWindow* parent);
+    wxEAPGeneralDialog(wxWindow *parent, wxWindowID id = wxID_ANY, const wxString &title = wxEmptyString, const wxPoint &pos = wxDefaultPosition, const wxSize &size = wxDefaultSize, long style = wxDEFAULT_DIALOG_STYLE);

    ///
    /// Adds panels to the dialog
    ///
-    void AddContents(wxPanel **contents, size_t content_count);
+    void AddContent(wxPanel **contents, size_t content_count);
+
+    ///
+    /// Adds single panel to the dialog
+    ///
+    void AddContent(wxPanel *content);

 protected:
    /// \cond internal
@@ -188,6 +244,16 @@ protected:
 };


+class wxEAPCredentialsDialog : public wxEAPGeneralDialog
+{
+public:
+    ///
+    /// Constructs a credential dialog
+    ///
+    wxEAPCredentialsDialog(const eap::config_provider &prov, wxWindow *parent, wxWindowID id = wxID_ANY, const wxString &title = _("EAP Credentials"), const wxPoint &pos = wxDefaultPosition, const wxSize &size = wxDefaultSize, long style = wxDEFAULT_DIALOG_STYLE);
+};
+
+
 class wxEAPNotePanel : public wxEAPNotePanelBase
 {
 public:
@@ -265,6 +331,103 @@ protected:
 };


+class wxEAPConfigWindow : public wxScrolledWindow
+{
+public:
+    ///
+    /// Constructs a configuration window
+    ///
+    /// \param[in]    prov    Provider configuration data
+    /// \param[inout] cfg     Configuration data
+    /// \param[in]    parent  Parent window
+    ///
+    wxEAPConfigWindow(const eap::config_provider &prov, eap::config_method &cfg, wxWindow* parent);
+
+    ///
+    /// Destructs the configuration window
+    ///
+    virtual ~wxEAPConfigWindow();
+
+protected:
+    /// \cond internal
+    virtual void OnInitDialog(wxInitDialogEvent& event);
+    virtual void OnUpdateUI(wxUpdateUIEvent& event);
+    /// \endcond
+
+protected:
+    const eap::config_provider &m_prov;     ///< EAP provider
+    eap::config_method &m_cfg;              ///< Method configuration
+};
+
+
+class wxEAPProviderIdentityPanel : public wxEAPProviderIdentityPanelBase
+{
+public:
+    ///
+    /// Constructs a provider identity pannel
+    ///
+    /// \param[inout] prov    Provider configuration data
+    /// \param[in]    parent  Parent window
+    ///
+    wxEAPProviderIdentityPanel(eap::config_provider &prov, wxWindow* parent);
+
+    friend class wxEAPConfigProvider; // Allows direct setting of keyboard focus
+
+protected:
+    /// \cond internal
+    virtual bool TransferDataToWindow();
+    virtual bool TransferDataFromWindow();
+    /// \endcond
+
+protected:
+    eap::config_provider &m_prov;   ///< EAP method configuration
+    winstd::library m_shell32;      ///< shell32.dll resource library reference
+    wxIcon m_icon;                  ///< Panel icon
+};
+
+
+class wxEAPProviderLockPanel : public wxEAPProviderLockPanelBase
+{
+public:
+    ///
+    /// Constructs a provider lock pannel
+    ///
+    /// \param[inout] prov    Provider configuration data
+    /// \param[in]    parent  Parent window
+    ///
+    wxEAPProviderLockPanel(eap::config_provider &prov, wxWindow* parent);
+
+protected:
+    /// \cond internal
+    virtual bool TransferDataToWindow();
+    virtual bool TransferDataFromWindow();
+    /// \endcond
+
+protected:
+    eap::config_provider &m_prov;   ///< EAP method configuration
+    winstd::library m_shell32;      ///< shell32.dll resource library reference
+    wxIcon m_icon;                  ///< Panel icon
+};
+
+
+class wxEAPConfigProvider : public wxEAPGeneralDialog
+{
+public:
+    ///
+    /// Constructs a provider config dialog
+    ///
+    /// \param[inout] prov    Provider configuration data
+    /// \param[in]    parent  Parent window
+    ///
+    wxEAPConfigProvider(eap::config_provider &prov, wxWindow *parent, wxWindowID id = wxID_ANY, const wxString &title = _("Provider Settings"), const wxPoint &pos = wxDefaultPosition, const wxSize &size = wxDefaultSize, long style = wxDEFAULT_DIALOG_STYLE);
+
+protected:
+    eap::config_provider &m_prov;           ///< EAP method configuration
+    wxEAPProviderIdentityPanel *m_identity; ///< Provider identity panel
+    wxEAPProviderLockPanel *m_lock;         ///< Provider lock panel
+};
+
+
 template <class _Tcred, class _wxT>
 class wxEAPCredentialsConfigPanel : public wxEAPCredentialsConfigPanelBase
 {
@@ -289,6 +452,14 @@ public:
            wxSetIconFromResource(m_credentials_icon, m_icon, m_shell32, MAKEINTRESOURCE(/*16770*/269));
    }

+    ///
+    /// Sets keyboard focus to the first control that do not capture mouse wheel
+    ///
+    inline void SetFocusFromKbd()
+    {
+        m_own->SetFocusFromKbd();
+    }
+
 protected:
    /// \cond internal

@@ -402,7 +573,7 @@ protected:
        // Display credential prompt.
        wxEAPCredentialsDialog dlg(m_prov, this);
        _wxT *panel = new _wxT(m_prov, m_cfg, cred, m_target.c_str(), &dlg, true);
-        dlg.AddContents((wxPanel**)&panel, 1);
+        dlg.AddContent(panel);
        if (dlg.ShowModal() == wxID_OK && panel->GetRememberValue()) {
            // Write credentials to credential manager.
            try {
@@ -433,7 +604,7 @@ protected:

        _wxT *panel = new _wxT(m_prov, m_cfg, m_cred, _T(""), &dlg, true);

-        dlg.AddContents((wxPanel**)&panel, 1);
+        dlg.AddContent(panel);
        dlg.ShowModal();
    }

@@ -581,12 +752,12 @@ protected:
        m_identity->SetSelection(0, -1);
        m_password->SetValue(m_cred.m_password.empty() ? wxEmptyString : s_dummy_password);

-        return wxEAPCredentialsPanelBase<_Tcred, wxEAPCredentialsPanelPassBase>::TransferDataToWindow();
+        return wxEAPCredentialsPanelBase<_Tcred, wxEAPCredentialsPassPanelBase>::TransferDataToWindow();
    }

    virtual bool TransferDataFromWindow()
    {
-        if (!wxEAPCredentialsPanelBase<_Tcred, wxEAPCredentialsPanelPassBase>::TransferDataFromWindow())
+        if (!wxEAPCredentialsPanelBase<_Tcred, wxEAPCredentialsPassPanelBase>::TransferDataFromWindow())
            return false;

        m_cred.m_identity = m_identity->GetValue();
@@ -609,7 +780,7 @@ protected:
            m_password      ->Enable(false);
        }

-        wxEAPCredentialsPanelBase<_Tcred, wxEAPCredentialsPanelPassBase>::OnUpdateUI(event);
+        wxEAPCredentialsPanelBase<_Tcred, wxEAPCredentialsPassPanelBase>::OnUpdateUI(event);
    }

    /// \endcond
@@ -638,3 +809,62 @@ inline bool wxSetIconFromResource(wxStaticBitmap *bmp, wxIcon &icon, HINSTANCE h
    } else
        return false;
 }
+
+
+inline wxString wxEAPGetProviderName(const std::wstring &id)
+{
+    return
+        !id.empty() ? id : _("<Your Organization>");
+}
+
+
+namespace eap
+{
+    class monitor_ui
+    {
+    public:
+        monitor_ui(_In_ HINSTANCE module, _In_ const GUID &guid);
+        virtual ~monitor_ui();
+
+        void set_popup(_In_ HWND hwnd);
+        void release_slaves(_In_bytecount_(size) const void *data, _In_ size_t size) const;
+
+        inline bool is_master() const
+        {
+            return m_is_master;
+        }
+
+        inline bool is_slave() const
+        {
+            return !is_master();
+        }
+
+        inline const std::vector<unsigned char>& master_data() const
+        {
+            return m_data;
+        }
+
+    protected:
+        virtual LRESULT winproc(
+            _In_ UINT   msg,
+            _In_ WPARAM wparam,
+            _In_ LPARAM lparam);
+
+        static LRESULT CALLBACK winproc(
+            _In_ HWND   hwnd,
+            _In_ UINT   msg,
+            _In_ WPARAM wparam,
+            _In_ LPARAM lparam);
+
+    protected:
+        bool m_is_master;                   ///< Is this monitor master?
+        HWND m_hwnd;                        ///< Message window handle
+        std::list<HWND> m_slaves;           ///< List of slaves to notify on finish
+        HWND m_hwnd_popup;                  ///< Pop-up window handle
+        std::vector<unsigned char> m_data;  ///< Data master sent
+
+        // Custom window messages
+        static const UINT s_msg_attach;     ///< Slave sends this message to attach to master
+        static const UINT s_msg_finish;     ///< Master sends this message to slaves to notify them it has finished (wparam has size, lparam has data)
+    };
+}
--- a/lib/EAPBase_UI/res/wxEAP_UI.cpp
+++ b/lib/EAPBase_UI/res/wxEAP_UI.cpp
@@ -28,6 +28,20 @@ wxEAPConfigDialogBase::wxEAPConfigDialogBase( wxWindow* parent, wxWindowID id, c
 	
 	sb_content->Add( m_providers, 1, wxEXPAND|wxALL, 10 );
 	
+	wxBoxSizer* sb_bottom_horiz;
+	sb_bottom_horiz = new wxBoxSizer( wxHORIZONTAL );
+	
+	wxBoxSizer* sb_bottom_horiz_inner;
+	sb_bottom_horiz_inner = new wxBoxSizer( wxHORIZONTAL );
+	
+	m_advanced = new wxButton( this, wxID_ANY, _("Advanced..."), wxDefaultPosition, wxDefaultSize, 0 );
+	m_advanced->SetToolTip( _("Opens dialog with provider settings") );
+	
+	sb_bottom_horiz_inner->Add( m_advanced, 0, wxALL, 5 );
+	
+	
+	sb_bottom_horiz->Add( sb_bottom_horiz_inner, 1, wxEXPAND, 5 );
+	
 	m_buttons = new wxStdDialogButtonSizer();
 	m_buttonsOK = new wxButton( this, wxID_OK );
 	m_buttons->AddButton( m_buttonsOK );
@@ -35,7 +49,10 @@ wxEAPConfigDialogBase::wxEAPConfigDialogBase( wxWindow* parent, wxWindowID id, c
 	m_buttons->AddButton( m_buttonsCancel );
 	m_buttons->Realize();
 	
-	sb_content->Add( m_buttons, 0, wxEXPAND|wxALL, 5 );
+	sb_bottom_horiz->Add( m_buttons, 0, wxEXPAND|wxALL, 5 );
+	
+	
+	sb_content->Add( sb_bottom_horiz, 0, wxEXPAND, 5 );
 	
 	
 	this->SetSizer( sb_content );
@@ -44,16 +61,20 @@ wxEAPConfigDialogBase::wxEAPConfigDialogBase( wxWindow* parent, wxWindowID id, c
 	
 	// Connect Events
 	this->Connect( wxEVT_INIT_DIALOG, wxInitDialogEventHandler( wxEAPConfigDialogBase::OnInitDialog ) );
+	this->Connect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPConfigDialogBase::OnUpdateUI ) );
+	m_advanced->Connect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPConfigDialogBase::OnAdvanced ), NULL, this );
 }

 wxEAPConfigDialogBase::~wxEAPConfigDialogBase()
 {
 	// Disconnect Events
 	this->Disconnect( wxEVT_INIT_DIALOG, wxInitDialogEventHandler( wxEAPConfigDialogBase::OnInitDialog ) );
+	this->Disconnect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPConfigDialogBase::OnUpdateUI ) );
+	m_advanced->Disconnect( wxEVT_COMMAND_BUTTON_CLICKED, wxCommandEventHandler( wxEAPConfigDialogBase::OnAdvanced ), NULL, this );
 	
 }

-wxEAPCredentialsDialogBase::wxEAPCredentialsDialogBase( wxWindow* parent, wxWindowID id, const wxString& title, const wxPoint& pos, const wxSize& size, long style ) : wxDialog( parent, id, title, pos, size, style )
+wxEAPGeneralDialogBase::wxEAPGeneralDialogBase( wxWindow* parent, wxWindowID id, const wxString& title, const wxPoint& pos, const wxSize& size, long style ) : wxDialog( parent, id, title, pos, size, style )
 {
 	this->SetSizeHints( wxDefaultSize, wxDefaultSize );
 	
@@ -84,13 +105,13 @@ wxEAPCredentialsDialogBase::wxEAPCredentialsDialogBase( wxWindow* parent, wxWind
 	sb_content->Fit( this );
 	
 	// Connect Events
-	this->Connect( wxEVT_INIT_DIALOG, wxInitDialogEventHandler( wxEAPCredentialsDialogBase::OnInitDialog ) );
+	this->Connect( wxEVT_INIT_DIALOG, wxInitDialogEventHandler( wxEAPGeneralDialogBase::OnInitDialog ) );
 }

-wxEAPCredentialsDialogBase::~wxEAPCredentialsDialogBase()
+wxEAPGeneralDialogBase::~wxEAPGeneralDialogBase()
 {
 	// Disconnect Events
-	this->Disconnect( wxEVT_INIT_DIALOG, wxInitDialogEventHandler( wxEAPCredentialsDialogBase::OnInitDialog ) );
+	this->Disconnect( wxEVT_INIT_DIALOG, wxInitDialogEventHandler( wxEAPGeneralDialogBase::OnInitDialog ) );
 	
 }

@@ -99,20 +120,20 @@ wxEAPBannerPanelBase::wxEAPBannerPanelBase( wxWindow* parent, wxWindowID id, con
 	this->SetBackgroundColour( wxSystemSettings::GetColour( wxSYS_COLOUR_HIGHLIGHT ) );
 	this->SetMinSize( wxSize( -1,48 ) );
 	
-	wxBoxSizer* sc_content;
-	sc_content = new wxBoxSizer( wxVERTICAL );
+	wxBoxSizer* sb_content;
+	sb_content = new wxBoxSizer( wxVERTICAL );
 	
 	m_title = new wxStaticText( this, wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, wxALIGN_RIGHT );
 	m_title->Wrap( -1 );
 	m_title->SetFont( wxFont( 18, 70, 90, 90, false, wxEmptyString ) );
 	m_title->SetForegroundColour( wxSystemSettings::GetColour( wxSYS_COLOUR_HIGHLIGHTTEXT ) );
 	
-	sc_content->Add( m_title, 0, wxALL|wxEXPAND, 5 );
+	sb_content->Add( m_title, 0, wxALL|wxEXPAND, 5 );
 	
 	
-	this->SetSizer( sc_content );
+	this->SetSizer( sb_content );
 	this->Layout();
-	sc_content->Fit( this );
+	sb_content->Fit( this );
 }

 wxEAPBannerPanelBase::~wxEAPBannerPanelBase()
@@ -269,7 +290,7 @@ wxEAPCredentialsConfigPanelBase::~wxEAPCredentialsConfigPanelBase()
 	
 }

-wxEAPCredentialsPanelPassBase::wxEAPCredentialsPanelPassBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
+wxEAPCredentialsPassPanelBase::wxEAPCredentialsPassPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
 {
 	wxStaticBoxSizer* sb_credentials;
 	sb_credentials = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("Client Credentials") ), wxVERTICAL );
@@ -330,6 +351,168 @@ wxEAPCredentialsPanelPassBase::wxEAPCredentialsPanelPassBase( wxWindow* parent,
 	this->Layout();
 }

-wxEAPCredentialsPanelPassBase::~wxEAPCredentialsPanelPassBase()
+wxEAPCredentialsPassPanelBase::~wxEAPCredentialsPassPanelBase()
 {
 }
+
+wxEAPProviderIdentityPanelBase::wxEAPProviderIdentityPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
+{
+	wxStaticBoxSizer* sb_provider_id;
+	sb_provider_id = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("Your Organization") ), wxVERTICAL );
+	
+	wxBoxSizer* sb_provider_id_horiz;
+	sb_provider_id_horiz = new wxBoxSizer( wxHORIZONTAL );
+	
+	m_provider_id_icon = new wxStaticBitmap( sb_provider_id->GetStaticBox(), wxID_ANY, wxNullBitmap, wxDefaultPosition, wxDefaultSize, 0 );
+	sb_provider_id_horiz->Add( m_provider_id_icon, 0, wxALL, 5 );
+	
+	wxBoxSizer* sb_provider_id_vert;
+	sb_provider_id_vert = new wxBoxSizer( wxVERTICAL );
+	
+	m_provider_id_label = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _("Describe your organization to customize user prompts.  When organization is introduced, end-users find program messages easier to understand and act."), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_id_label->Wrap( 446 );
+	sb_provider_id_vert->Add( m_provider_id_label, 0, wxALL|wxEXPAND, 5 );
+	
+	wxBoxSizer* sb_provider_name;
+	sb_provider_name = new wxBoxSizer( wxVERTICAL );
+	
+	m_provider_name_label = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _("Your organization &name:"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_name_label->Wrap( -1 );
+	sb_provider_name->Add( m_provider_name_label, 0, wxBOTTOM, 5 );
+	
+	m_provider_name = new wxTextCtrl( sb_provider_id->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_name->SetToolTip( _("Your organization name as it will appear on helpdesk contact notifications") );
+	
+	sb_provider_name->Add( m_provider_name, 0, wxEXPAND|wxBOTTOM, 5 );
+	
+	m_provider_name_note = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _("(Keep it short, please)"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_name_note->Wrap( -1 );
+	sb_provider_name->Add( m_provider_name_note, 0, wxALIGN_RIGHT, 5 );
+	
+	
+	sb_provider_id_vert->Add( sb_provider_name, 0, wxEXPAND|wxALL, 5 );
+	
+	wxBoxSizer* sb_provider_helpdesk;
+	sb_provider_helpdesk = new wxBoxSizer( wxVERTICAL );
+	
+	m_provider_helpdesk_label = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _("Helpdesk contact &information:"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_helpdesk_label->Wrap( -1 );
+	sb_provider_helpdesk->Add( m_provider_helpdesk_label, 0, wxBOTTOM, 5 );
+	
+	wxFlexGridSizer* sb_provider_helpdesk_inner;
+	sb_provider_helpdesk_inner = new wxFlexGridSizer( 0, 2, 0, 0 );
+	sb_provider_helpdesk_inner->AddGrowableCol( 1 );
+	sb_provider_helpdesk_inner->SetFlexibleDirection( wxBOTH );
+	sb_provider_helpdesk_inner->SetNonFlexibleGrowMode( wxFLEX_GROWMODE_SPECIFIED );
+	
+	m_provider_web_icon = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _("¶"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_web_icon->Wrap( -1 );
+	m_provider_web_icon->SetFont( wxFont( wxNORMAL_FONT->GetPointSize(), 70, 90, 90, false, wxT("Wingdings") ) );
+	
+	sb_provider_helpdesk_inner->Add( m_provider_web_icon, 0, wxALIGN_CENTER_VERTICAL|wxBOTTOM|wxRIGHT, 5 );
+	
+	m_provider_web = new wxTextCtrl( sb_provider_id->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_web->SetToolTip( _("Your helpdesk website") );
+	
+	sb_provider_helpdesk_inner->Add( m_provider_web, 1, wxEXPAND|wxALIGN_CENTER_VERTICAL|wxBOTTOM, 5 );
+	
+	m_provider_email_icon = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _("*"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_email_icon->Wrap( -1 );
+	m_provider_email_icon->SetFont( wxFont( wxNORMAL_FONT->GetPointSize(), 70, 90, 90, false, wxT("Wingdings") ) );
+	
+	sb_provider_helpdesk_inner->Add( m_provider_email_icon, 0, wxALIGN_CENTER_VERTICAL|wxBOTTOM|wxRIGHT, 5 );
+	
+	m_provider_email = new wxTextCtrl( sb_provider_id->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_email->SetToolTip( _("Your helpdesk e-mail address") );
+	
+	sb_provider_helpdesk_inner->Add( m_provider_email, 1, wxEXPAND|wxALIGN_CENTER_VERTICAL|wxBOTTOM, 5 );
+	
+	m_provider_phone_icon = new wxStaticText( sb_provider_id->GetStaticBox(), wxID_ANY, _(")"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_phone_icon->Wrap( -1 );
+	m_provider_phone_icon->SetFont( wxFont( wxNORMAL_FONT->GetPointSize(), 70, 90, 90, false, wxT("Wingdings") ) );
+	
+	sb_provider_helpdesk_inner->Add( m_provider_phone_icon, 0, wxALIGN_CENTER_VERTICAL|wxRIGHT, 5 );
+	
+	m_provider_phone = new wxTextCtrl( sb_provider_id->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_phone->SetToolTip( _("Your helpdesk phone number") );
+	
+	sb_provider_helpdesk_inner->Add( m_provider_phone, 1, wxEXPAND|wxALIGN_CENTER_VERTICAL, 5 );
+	
+	
+	sb_provider_helpdesk->Add( sb_provider_helpdesk_inner, 1, wxEXPAND, 5 );
+	
+	
+	sb_provider_id_vert->Add( sb_provider_helpdesk, 1, wxEXPAND, 5 );
+	
+	
+	sb_provider_id_horiz->Add( sb_provider_id_vert, 1, wxEXPAND, 5 );
+	
+	
+	sb_provider_id->Add( sb_provider_id_horiz, 1, wxEXPAND, 5 );
+	
+	
+	this->SetSizer( sb_provider_id );
+	this->Layout();
+	
+	// Connect Events
+	this->Connect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPProviderIdentityPanelBase::OnUpdateUI ) );
+}
+
+wxEAPProviderIdentityPanelBase::~wxEAPProviderIdentityPanelBase()
+{
+	// Disconnect Events
+	this->Disconnect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPProviderIdentityPanelBase::OnUpdateUI ) );
+	
+}
+
+wxEAPProviderLockPanelBase::wxEAPProviderLockPanelBase( wxWindow* parent, wxWindowID id, const wxPoint& pos, const wxSize& size, long style ) : wxPanel( parent, id, pos, size, style )
+{
+	wxStaticBoxSizer* sb_provider_lock;
+	sb_provider_lock = new wxStaticBoxSizer( new wxStaticBox( this, wxID_ANY, _("Configuration Lock") ), wxVERTICAL );
+	
+	wxBoxSizer* sb_provider_lock_horiz;
+	sb_provider_lock_horiz = new wxBoxSizer( wxHORIZONTAL );
+	
+	m_provider_lock_icon = new wxStaticBitmap( sb_provider_lock->GetStaticBox(), wxID_ANY, wxNullBitmap, wxDefaultPosition, wxDefaultSize, 0 );
+	sb_provider_lock_horiz->Add( m_provider_lock_icon, 0, wxALL, 5 );
+	
+	wxBoxSizer* sb_provider_lock_vert;
+	sb_provider_lock_vert = new wxBoxSizer( wxVERTICAL );
+	
+	m_provider_lock_label = new wxStaticText( sb_provider_lock->GetStaticBox(), wxID_ANY, _("Your configuration can be locked to prevent accidental modification by end-users. Users will only be allowed to enter credentials."), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_lock_label->Wrap( 446 );
+	sb_provider_lock_vert->Add( m_provider_lock_label, 0, wxALL|wxEXPAND, 5 );
+	
+	wxBoxSizer* sb_provider_name;
+	sb_provider_name = new wxBoxSizer( wxVERTICAL );
+	
+	m_provider_lock = new wxCheckBox( sb_provider_lock->GetStaticBox(), wxID_ANY, _("&Lock this configuration and prevent any further modification via user interface."), wxDefaultPosition, wxDefaultSize, 0 );
+	sb_provider_name->Add( m_provider_lock, 0, wxEXPAND|wxBOTTOM, 5 );
+	
+	m_provider_lock_note = new wxStaticText( sb_provider_lock->GetStaticBox(), wxID_ANY, _("(Warning: Once locked, you can not revert using this dialog!)"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_provider_lock_note->Wrap( -1 );
+	sb_provider_name->Add( m_provider_lock_note, 0, wxALIGN_RIGHT, 5 );
+	
+	
+	sb_provider_lock_vert->Add( sb_provider_name, 0, wxEXPAND|wxALL, 5 );
+	
+	
+	sb_provider_lock_horiz->Add( sb_provider_lock_vert, 1, wxEXPAND, 5 );
+	
+	
+	sb_provider_lock->Add( sb_provider_lock_horiz, 1, wxEXPAND, 5 );
+	
+	
+	this->SetSizer( sb_provider_lock );
+	this->Layout();
+	
+	// Connect Events
+	this->Connect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPProviderLockPanelBase::OnUpdateUI ) );
+}
+
+wxEAPProviderLockPanelBase::~wxEAPProviderLockPanelBase()
+{
+	// Disconnect Events
+	this->Disconnect( wxEVT_UPDATE_UI, wxUpdateUIEventHandler( wxEAPProviderLockPanelBase::OnUpdateUI ) );
+	
+}
--- a/lib/EAPBase_UI/res/wxEAP_UI.fbp
+++ b/lib/EAPBase_UI/res/wxEAP_UI.fbp
--- a/lib/EAPBase_UI/res/wxEAP_UI.h
+++ b/lib/EAPBase_UI/res/wxEAP_UI.h
@@ -18,8 +18,8 @@ class wxEAPBannerPanel;
 #include <wx/settings.h>
 #include <wx/string.h>
 #include <wx/notebook.h>
-#include <wx/sizer.h>
 #include <wx/button.h>
+#include <wx/sizer.h>
 #include <wx/dialog.h>
 #include <wx/stattext.h>
 #include <wx/panel.h>
@@ -44,12 +44,15 @@ class wxEAPConfigDialogBase : public wxDialog
 	protected:
 		wxEAPBannerPanel *m_banner;
 		wxNotebook* m_providers;
+		wxButton* m_advanced;
 		wxStdDialogButtonSizer* m_buttons;
 		wxButton* m_buttonsOK;
 		wxButton* m_buttonsCancel;
 		
 		// Virtual event handlers, overide them in your derived class
 		virtual void OnInitDialog( wxInitDialogEvent& event ) { event.Skip(); }
+		virtual void OnUpdateUI( wxUpdateUIEvent& event ) { event.Skip(); }
+		virtual void OnAdvanced( wxCommandEvent& event ) { event.Skip(); }
 		
 	
 	public:
@@ -60,9 +63,9 @@ class wxEAPConfigDialogBase : public wxDialog
 };

 ///////////////////////////////////////////////////////////////////////////////
-/// Class wxEAPCredentialsDialogBase
+/// Class wxEAPGeneralDialogBase
 ///////////////////////////////////////////////////////////////////////////////
-class wxEAPCredentialsDialogBase : public wxDialog 
+class wxEAPGeneralDialogBase : public wxDialog 
 {
 	private:
 	
@@ -79,8 +82,8 @@ class wxEAPCredentialsDialogBase : public wxDialog
 	
 	public:
 		
-		wxEAPCredentialsDialogBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxString& title = _("EAP Credentials"), const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxDefaultSize, long style = wxDEFAULT_DIALOG_STYLE ); 
-		~wxEAPCredentialsDialogBase();
+		wxEAPGeneralDialogBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxString& title = wxEmptyString, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxDefaultSize, long style = wxDEFAULT_DIALOG_STYLE ); 
+		~wxEAPGeneralDialogBase();
 	
 };

@@ -153,9 +156,9 @@ class wxEAPCredentialsConfigPanelBase : public wxPanel
 };

 ///////////////////////////////////////////////////////////////////////////////
-/// Class wxEAPCredentialsPanelPassBase
+/// Class wxEAPCredentialsPassPanelBase
 ///////////////////////////////////////////////////////////////////////////////
-class wxEAPCredentialsPanelPassBase : public wxPanel 
+class wxEAPCredentialsPassPanelBase : public wxPanel 
 {
 	private:
 	
@@ -170,8 +173,64 @@ class wxEAPCredentialsPanelPassBase : public wxPanel
 	
 	public:
 		
-		wxEAPCredentialsPanelPassBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( 500,-1 ), long style = wxTAB_TRAVERSAL ); 
-		~wxEAPCredentialsPanelPassBase();
+		wxEAPCredentialsPassPanelBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( 500,-1 ), long style = wxTAB_TRAVERSAL ); 
+		~wxEAPCredentialsPassPanelBase();
+	
+};
+
+///////////////////////////////////////////////////////////////////////////////
+/// Class wxEAPProviderIdentityPanelBase
+///////////////////////////////////////////////////////////////////////////////
+class wxEAPProviderIdentityPanelBase : public wxPanel 
+{
+	private:
+	
+	protected:
+		wxStaticBitmap* m_provider_id_icon;
+		wxStaticText* m_provider_id_label;
+		wxStaticText* m_provider_name_label;
+		wxTextCtrl* m_provider_name;
+		wxStaticText* m_provider_name_note;
+		wxStaticText* m_provider_helpdesk_label;
+		wxStaticText* m_provider_web_icon;
+		wxTextCtrl* m_provider_web;
+		wxStaticText* m_provider_email_icon;
+		wxTextCtrl* m_provider_email;
+		wxStaticText* m_provider_phone_icon;
+		wxTextCtrl* m_provider_phone;
+		
+		// Virtual event handlers, overide them in your derived class
+		virtual void OnUpdateUI( wxUpdateUIEvent& event ) { event.Skip(); }
+		
+	
+	public:
+		
+		wxEAPProviderIdentityPanelBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( 500,-1 ), long style = wxTAB_TRAVERSAL ); 
+		~wxEAPProviderIdentityPanelBase();
+	
+};
+
+///////////////////////////////////////////////////////////////////////////////
+/// Class wxEAPProviderLockPanelBase
+///////////////////////////////////////////////////////////////////////////////
+class wxEAPProviderLockPanelBase : public wxPanel 
+{
+	private:
+	
+	protected:
+		wxStaticBitmap* m_provider_lock_icon;
+		wxStaticText* m_provider_lock_label;
+		wxCheckBox* m_provider_lock;
+		wxStaticText* m_provider_lock_note;
+		
+		// Virtual event handlers, overide them in your derived class
+		virtual void OnUpdateUI( wxUpdateUIEvent& event ) { event.Skip(); }
+		
+	
+	public:
+		
+		wxEAPProviderLockPanelBase( wxWindow* parent, wxWindowID id = wxID_ANY, const wxPoint& pos = wxDefaultPosition, const wxSize& size = wxSize( 500,-1 ), long style = wxTAB_TRAVERSAL ); 
+		~wxEAPProviderLockPanelBase();
 	
 };

--- a/lib/EAPBase_UI/src/EAP_UI.cpp
+++ b/lib/EAPBase_UI/src/EAP_UI.cpp
@@ -38,22 +38,20 @@ bool wxEAPBannerPanel::AcceptsFocusFromKeyboard() const


 //////////////////////////////////////////////////////////////////////
-// wxEAPCredentialsDialog
+// wxEAPGeneralDialog
 //////////////////////////////////////////////////////////////////////

-wxEAPCredentialsDialog::wxEAPCredentialsDialog(const eap::config_provider &prov, wxWindow* parent) : wxEAPCredentialsDialogBase(parent)
+wxEAPGeneralDialog::wxEAPGeneralDialog(wxWindow *parent, wxWindowID id, const wxString &title, const wxPoint &pos, const wxSize &size, long style) :
+    wxEAPGeneralDialogBase(parent, id, title, pos, size, style)
 {
    // Set extra style here, as wxFormBuilder overrides all default flags.
    this->SetExtraStyle(this->GetExtraStyle() | wxWS_EX_VALIDATE_RECURSIVELY);

-    // Set banner title.
-    m_banner->m_title->SetLabel(wxString::Format(_("%s Credentials"), prov.m_id.c_str()));
-
    m_buttonsOK->SetDefault();
 }


-void wxEAPCredentialsDialog::AddContents(wxPanel **contents, size_t content_count)
+void wxEAPGeneralDialog::AddContent(wxPanel **contents, size_t content_count)
 {
    if (content_count) {
        for (size_t i = 0; i < content_count; i++)
@@ -66,13 +64,31 @@ void wxEAPCredentialsDialog::AddContents(wxPanel **contents, size_t content_coun
 }


-void wxEAPCredentialsDialog::OnInitDialog(wxInitDialogEvent& event)
+void wxEAPGeneralDialog::AddContent(wxPanel *content)
+{
+    AddContent(&content, 1);
+}
+
+
+void wxEAPGeneralDialog::OnInitDialog(wxInitDialogEvent& event)
 {
    for (wxSizerItemList::compatibility_iterator panel = m_panels->GetChildren().GetFirst(); panel; panel = panel->GetNext())
        panel->GetData()->GetWindow()->GetEventHandler()->ProcessEvent(event);
 }


+//////////////////////////////////////////////////////////////////////
+// wxEAPCredentialsDialog
+//////////////////////////////////////////////////////////////////////
+
+wxEAPCredentialsDialog::wxEAPCredentialsDialog(const eap::config_provider &prov, wxWindow *parent, wxWindowID id, const wxString &title, const wxPoint &pos, const wxSize &size, long style) :
+    wxEAPGeneralDialog(parent, id, title, pos, size, style)
+{
+    // Set banner title.
+    m_banner->m_title->SetLabel(wxString::Format(_("%s Credentials"), wxEAPGetProviderName(prov.m_id).c_str()));
+}
+
+
 //////////////////////////////////////////////////////////////////////
 // wxEAPNotePanel
 //////////////////////////////////////////////////////////////////////
@@ -189,3 +205,336 @@ wxEAPCredentialWarningPanel::wxEAPCredentialWarningPanel(const eap::config_provi

    this->Layout();
 }
+
+
+//////////////////////////////////////////////////////////////////////
+// wxEAPConfigWindow
+//////////////////////////////////////////////////////////////////////
+
+wxEAPConfigWindow::wxEAPConfigWindow(const eap::config_provider &prov, eap::config_method &cfg, wxWindow* parent) :
+    m_prov(prov),
+    m_cfg(cfg),
+    wxScrolledWindow(parent, wxID_ANY, wxDefaultPosition, wxDefaultSize, wxVSCROLL)
+{
+    this->SetScrollRate(5, 5);
+
+    // Connect Events
+    this->Connect(wxEVT_INIT_DIALOG, wxInitDialogEventHandler(wxEAPConfigWindow::OnInitDialog));
+    this->Connect(wxEVT_UPDATE_UI, wxUpdateUIEventHandler(wxEAPConfigWindow::OnUpdateUI));
+}
+
+
+wxEAPConfigWindow::~wxEAPConfigWindow()
+{
+    // Disconnect Events
+    this->Disconnect(wxEVT_UPDATE_UI, wxUpdateUIEventHandler(wxEAPConfigWindow::OnUpdateUI));
+    this->Disconnect(wxEVT_INIT_DIALOG, wxInitDialogEventHandler(wxEAPConfigWindow::OnInitDialog));
+}
+
+
+void wxEAPConfigWindow::OnInitDialog(wxInitDialogEvent& event)
+{
+    UNREFERENCED_PARAMETER(event);
+
+    // Call TransferDataToWindow() manually, as wxScrolledWindow somehow skips that.
+    TransferDataToWindow();
+}
+
+
+void wxEAPConfigWindow::OnUpdateUI(wxUpdateUIEvent& event)
+{
+    UNREFERENCED_PARAMETER(event);
+
+    if (m_parent && m_parent->IsKindOf(wxCLASSINFO(wxNotebook))) {
+        // We're a notebook page. Set the ID of our provider as our page label.
+        wxNotebook *notebook = (wxNotebook*)m_parent;
+        int idx = notebook->FindPage(this);
+        if (idx != wxNOT_FOUND)
+            notebook->SetPageText(idx, wxEAPGetProviderName(m_prov.m_id));
+    } else
+        this->SetLabel(wxEAPGetProviderName(m_prov.m_id));
+}
+
+
+//////////////////////////////////////////////////////////////////////
+// wxEAPProviderIdentityPanel
+//////////////////////////////////////////////////////////////////////
+
+wxEAPProviderIdentityPanel::wxEAPProviderIdentityPanel(eap::config_provider &prov, wxWindow* parent) :
+    m_prov(prov),
+    wxEAPProviderIdentityPanelBase(parent)
+{
+    // Load and set icon.
+    if (m_shell32.load(_T("shell32.dll"), NULL, LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE))
+        wxSetIconFromResource(m_provider_id_icon, m_icon, m_shell32, MAKEINTRESOURCE(259));
+}
+
+
+bool wxEAPProviderIdentityPanel::TransferDataToWindow()
+{
+    m_provider_name ->SetValue(m_prov.m_id        );
+    m_provider_web  ->SetValue(m_prov.m_help_web  );
+    m_provider_email->SetValue(m_prov.m_help_email);
+    m_provider_phone->SetValue(m_prov.m_help_phone);
+
+    return wxEAPProviderIdentityPanelBase::TransferDataToWindow();
+}
+
+
+bool wxEAPProviderIdentityPanel::TransferDataFromWindow()
+{
+    wxCHECK(wxEAPProviderIdentityPanelBase::TransferDataFromWindow(), false);
+
+    m_prov.m_id         = m_provider_name ->GetValue();
+    m_prov.m_help_web   = m_provider_web  ->GetValue();
+    m_prov.m_help_email = m_provider_email->GetValue();
+    m_prov.m_help_phone = m_provider_phone->GetValue();
+
+    return true;
+}
+
+
+//////////////////////////////////////////////////////////////////////
+// wxEAPProviderLockPanel
+//////////////////////////////////////////////////////////////////////
+
+wxEAPProviderLockPanel::wxEAPProviderLockPanel(eap::config_provider &prov, wxWindow* parent) :
+    m_prov(prov),
+    wxEAPProviderLockPanelBase(parent)
+{
+    // Load and set icon.
+    if (m_shell32.load(_T("shell32.dll"), NULL, LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE))
+        wxSetIconFromResource(m_provider_lock_icon, m_icon, m_shell32, MAKEINTRESOURCE(1003));
+}
+
+
+bool wxEAPProviderLockPanel::TransferDataToWindow()
+{
+    m_provider_lock->SetValue(m_prov.m_read_only);
+
+    return wxEAPProviderLockPanelBase::TransferDataToWindow();
+}
+
+
+bool wxEAPProviderLockPanel::TransferDataFromWindow()
+{
+    wxCHECK(wxEAPProviderLockPanelBase::TransferDataFromWindow(), false);
+
+    m_prov.m_read_only = m_provider_lock->GetValue();
+
+    return true;
+}
+
+
+//////////////////////////////////////////////////////////////////////
+// wxEAPConfigProvider
+//////////////////////////////////////////////////////////////////////
+
+wxEAPConfigProvider::wxEAPConfigProvider(eap::config_provider &prov, wxWindow *parent, wxWindowID id, const wxString &title, const wxPoint &pos, const wxSize &size, long style) :
+    m_prov(prov),
+    wxEAPGeneralDialog(parent, id, title, pos, size, style)
+{
+    // Set banner title.
+    m_banner->m_title->SetLabel(title);
+
+    m_identity = new wxEAPProviderIdentityPanel(prov, this);
+    AddContent(m_identity);
+
+    m_lock = new wxEAPProviderLockPanel(prov, this);
+    AddContent(m_lock);
+
+    m_identity->m_provider_name->SetFocusFromKbd();
+}
+
+
+using namespace std;
+using namespace winstd;
+
+//////////////////////////////////////////////////////////////////////
+// eap::monitor_ui
+//////////////////////////////////////////////////////////////////////
+
+eap::monitor_ui::monitor_ui(_In_ HINSTANCE module, _In_ const GUID &guid) :
+    m_hwnd_popup(NULL)
+{
+    // Verify if the monitor is already running.
+    const WNDCLASSEX wnd_class_desc = {
+        sizeof(WNDCLASSEX), // cbSize
+        0,                  // style
+        winproc,            // lpfnWndProc
+        0,                  // cbClsExtra
+        0,                  // cbWndExtra
+        module,             // hInstance
+        NULL,               // hIcon
+        NULL,               // hCursor
+        NULL,               // hbrBackground
+        NULL,               // lpszMenuName
+        _T(__FUNCTION__),   // lpszClassName
+        NULL                // hIconSm
+    };
+    ATOM wnd_class = RegisterClassEx(&wnd_class_desc);
+    if (!wnd_class)
+        throw win_runtime_error(__FUNCTION__ " Error registering master monitor window class.");
+    tstring_guid guid_str(guid);
+    HWND hwnd_master = FindWindowEx(HWND_MESSAGE, NULL, (LPCTSTR)wnd_class, guid_str.c_str());
+    if (hwnd_master) {
+        // Another monitor is already running.
+        m_is_master = false;
+
+        // Register slave windows class slightly different, not to include slaves in FindWindowEx().
+        const WNDCLASSEX wnd_class_desc = {
+            sizeof(WNDCLASSEX),             // cbSize
+            0,                              // style
+            winproc,                        // lpfnWndProc
+            0,                              // cbClsExtra
+            0,                              // cbWndExtra
+            module,                         // hInstance
+            NULL,                           // hIcon
+            NULL,                           // hCursor
+            NULL,                           // hbrBackground
+            NULL,                           // lpszMenuName
+            _T(__FUNCTION__) _T("-Slave"),  // lpszClassName
+            NULL                            // hIconSm
+        };
+        wnd_class = RegisterClassEx(&wnd_class_desc);
+        if (!wnd_class)
+            throw win_runtime_error(__FUNCTION__ " Error registering slave monitor window class.");
+    } else {
+        // This is a fresh monitor.
+        m_is_master = true;
+    }
+
+    m_hwnd = CreateWindowEx(
+        0,                  // dwExStyle
+        (LPCTSTR)wnd_class, // lpClassName
+        guid_str.c_str(),   // lpWindowName
+        0,                  // dwStyle
+        0,                  // x
+        0,                  // y
+        0,                  // nWidth
+        0,                  // nHeight
+        HWND_MESSAGE,       // hWndParent
+        NULL,               // hMenu
+        module,             // hInstance
+        this);              // lpParam
+
+    if (!m_is_master) {
+        // Notify master we are waiting him.
+        SendMessage(hwnd_master, s_msg_attach, 0, (LPARAM)m_hwnd);
+
+        // Slaves must pump message queue until finished.
+        MSG msg;
+        while (GetMessage(&msg, NULL, 0, 0) > 0) {
+            TranslateMessage(&msg);
+            DispatchMessage(&msg);
+        }
+    }
+}
+
+
+eap::monitor_ui::~monitor_ui()
+{
+    if (m_hwnd)
+        DestroyWindow(m_hwnd);
+}
+
+
+void eap::monitor_ui::set_popup(_In_ HWND hwnd)
+{
+    m_hwnd_popup = hwnd;
+}
+
+
+void eap::monitor_ui::release_slaves(_In_bytecount_(size) const void *data, _In_ size_t size) const
+{
+    assert(!size || data);
+
+    for (list<HWND>::const_iterator slave = m_slaves.begin(), slave_end = m_slaves.end(); slave != slave_end; ++slave) {
+        // Get slave's PID.
+        DWORD pid_slave;
+        GetWindowThreadProcessId(*slave, &pid_slave);
+
+        // Get slave's process handle.
+        process proc_slave;
+        if (!proc_slave.open(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, 0, pid_slave))
+            continue;
+
+        // Allocate memory in slave's virtual memory space and save data to it.
+        vmemory mem_slave;
+        if (!mem_slave.alloc(proc_slave, NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE))
+            continue;
+        if (!WriteProcessMemory(proc_slave, mem_slave, data, size, NULL))
+            continue;
+
+        // Notify slave. Use SendMessage(), not PostMessage(), as memory will get cleaned up.
+        SendMessage(*slave, s_msg_finish, (WPARAM)size, (LPARAM)(LPVOID)mem_slave);
+    }
+}
+
+
+LRESULT eap::monitor_ui::winproc(
+    _In_ UINT   msg,
+    _In_ WPARAM wparam,
+    _In_ LPARAM lparam)
+{
+    UNREFERENCED_PARAMETER(wparam);
+
+    if (msg == s_msg_attach) {
+        // Attach a new slave.
+        assert(m_is_master);
+        m_slaves.push_back((HWND)lparam);
+
+        if (m_hwnd_popup) {
+            // Bring pop-up window up.
+            if (::IsIconic(m_hwnd_popup))
+                ::SendMessage(m_hwnd_popup, WM_SYSCOMMAND, SC_RESTORE, 0);
+            ::SetActiveWindow(m_hwnd_popup);
+            ::SetForegroundWindow(m_hwnd_popup);
+        }
+
+        return TRUE;
+    } else if (msg == s_msg_finish) {
+        // Master finished.
+        assert(!m_is_master);
+        m_data.assign((const unsigned char*)lparam, (const unsigned char*)lparam + wparam);
+
+        // Finish slave too.
+        DestroyWindow(m_hwnd);
+        return TRUE;
+    } else if (msg == WM_DESTROY) {
+        // Stop the message pump.
+        PostQuitMessage(0);
+        return 0;
+    }
+
+    return DefWindowProc(m_hwnd, msg, wparam, lparam);
+}
+
+
+LRESULT CALLBACK eap::monitor_ui::winproc(
+    _In_ HWND   hwnd,
+    _In_ UINT   msg,
+    _In_ WPARAM wparam,
+    _In_ LPARAM lparam)
+{
+    if (msg == WM_CREATE) {
+        // Set window's user data to "this" pointer.
+        const CREATESTRUCT *cs = (CREATESTRUCT*)lparam;
+        SetWindowLongPtr(hwnd, GWLP_USERDATA, (LONG_PTR)cs->lpCreateParams);
+
+        // Forward to our handler.
+        return ((eap::monitor_ui*)cs->lpCreateParams)->winproc(msg, wparam, lparam);
+    } else {
+        // Get "this" pointer from window's user data.
+        eap::monitor_ui *_this = (eap::monitor_ui*)GetWindowLongPtr(hwnd, GWLP_USERDATA);
+        if (_this) {
+            // Forward to our handler.
+            return _this->winproc(msg, wparam, lparam);
+        } else
+            return DefWindowProc(hwnd, msg, wparam, lparam);
+    }
+}
+
+
+const UINT eap::monitor_ui::s_msg_attach  = RegisterWindowMessage(_T(PRODUCT_NAME_STR) _T("-Attach"));
+const UINT eap::monitor_ui::s_msg_finish  = RegisterWindowMessage(_T(PRODUCT_NAME_STR) _T("-Finish"));
--- a/lib/Events/res/EventsETW.man
+++ b/lib/Events/res/EventsETW.man
--- a/lib/PAP_UI/include/PAP_UI.h
+++ b/lib/PAP_UI/include/PAP_UI.h
@@ -25,7 +25,7 @@
 ///
 /// PAP credential configuration panel
 ///
-typedef wxEAPCredentialsConfigPanel<eap::credentials_pap, wxPasswordCredentialsPanel<eap::credentials_pap, wxEAPCredentialsPanelPassBase> > wxPAPCredentialsConfigPanel;
+typedef wxEAPCredentialsConfigPanel<eap::credentials_pap, wxPasswordCredentialsPanel<eap::credentials_pap, wxEAPCredentialsPassPanelBase> > wxPAPCredentialsConfigPanel;

 ///
 /// PAP configuration panel
@@ -35,7 +35,7 @@ class wxPAPConfigPanel;
 ///
 /// PAP credential entry panel
 ///
-typedef wxPasswordCredentialsPanel<eap::credentials_pap, wxEAPCredentialsPanelPassBase> wxPAPCredentialsPanel;
+typedef wxPasswordCredentialsPanel<eap::credentials_pap, wxEAPCredentialsPassPanelBase> wxPAPCredentialsPanel;

 #pragma once

--- a/lib/TLS/include/Config.h
+++ b/lib/TLS/include/Config.h
@@ -25,6 +25,10 @@

 #include <sal.h>

+#define EAP_TLS_OWN             0   ///< We do the TLS ourself
+#define EAP_TLS_SCHANNEL        1   ///< TLS is done by Schannel, but server certificate check is done ourself
+#define EAP_TLS_SCHANNEL_FULL   2   ///< TLS is fully done by Schannel
+
 namespace eap
 {
    ///
@@ -167,10 +171,12 @@ namespace eap

    public:
        std::list<winstd::cert_context> m_trusted_root_ca;  ///< Trusted root CAs
-        std::list<std::string> m_server_names;              ///< Acceptable authenticating server names
+        std::list<std::wstring> m_server_names;             ///< Acceptable authenticating server names

+#if EAP_TLS < EAP_TLS_SCHANNEL
        // Following members are used for session resumptions. They are not exported/imported to XML.
        sanitizing_blob m_session_id;                       ///< TLS session ID
        tls_master_secret m_master_secret;                  ///< TLS master secret
+#endif
    };
 }
--- a/lib/TLS/include/Credentials.h
+++ b/lib/TLS/include/Credentials.h
@@ -180,11 +180,6 @@ namespace eap
        ///
        virtual std::wstring get_identity() const;

-        ///
-        /// Returns credential name (for GUI display).
-        ///
-        virtual winstd::tstring get_name() const;
-
        ///
        /// Combine credentials in the following order:
        ///
--- a/lib/TLS/include/Method.h
+++ b/lib/TLS/include/Method.h
@@ -36,6 +36,7 @@ namespace eap
 #include "../../EAPBase/include/Method.h"

 #include <WinStd/Crypt.h>
+#include <WinStd/Sec.h>

 #include <list>
 #include <vector>
@@ -145,10 +146,10 @@ namespace eap
        /// Constructs an EAP method
        ///
        /// \param[in] mod   EAP module to use for global services
-        /// \param[in] cfg   Providers configuration
+        /// \param[in] cfg   Connection configuration
        /// \param[in] cred  User credentials
        ///
-        method_tls(_In_ module &module, _In_ config_provider_list &cfg, _In_ credentials_tls &cred);
+        method_tls(_In_ module &module, _In_ config_connection &cfg, _In_ credentials_tls &cred);

        ///
        /// Moves an EAP method
@@ -216,6 +217,7 @@ namespace eap
        /// @}

    protected:
+#if EAP_TLS < EAP_TLS_SCHANNEL
        /// \name Client handshake message generation
        /// @{

@@ -360,6 +362,18 @@ namespace eap
        ///
        virtual void process_handshake(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);

+#else
+        ///
+        /// Process handshake
+        ///
+        void process_handshake();
+
+        ///
+        /// Process application data
+        ///
+        void process_application_data();
+#endif
+
        ///
        /// Processes a TLS application_data message
        ///
@@ -370,24 +384,16 @@ namespace eap
        ///
        virtual void process_application_data(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);

-        /////
-        ///// Processes a vendor-specific TLS message
-        /////
-        ///// \note Please see `m_cipher_spec` member if the message data came encrypted.
-        /////
-        ///// \param[in] type      TLS message type
-        ///// \param[in] msg       TLS message data
-        ///// \param[in] msg_size  TLS message data size
-        /////
-        //virtual void process_vendor_data(_In_ tls_message_type_t type, _In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size);
-
        /// @}

+#if EAP_TLS < EAP_TLS_SCHANNEL_FULL
        ///
        /// Verifies server's certificate if trusted by configuration
        ///
        void verify_server_trust() const;
+#endif

+#if EAP_TLS < EAP_TLS_SCHANNEL
        /// \name Encryption
        /// @{

@@ -481,13 +487,16 @@ namespace eap
            _In_                              HCRYPTKEY  key,
            _In_bytecount_(size_secret) const void       *secret,
            _In_                              size_t     size_secret);
+#endif

    protected:
        credentials_tls &m_cred;                                ///< EAP-TLS user credentials
+        HANDLE m_user_ctx;                                      ///< Handle to user context

        packet m_packet_req;                                    ///< Request packet
        packet m_packet_res;                                    ///< Response packet

+#if EAP_TLS < EAP_TLS_SCHANNEL
        winstd::crypt_prov m_cp;                                ///< Cryptography provider for general services
        winstd::crypt_prov m_cp_enc_client;                     ///< Cryptography provider for encryption
        winstd::crypt_prov m_cp_enc_server;                     ///< Cryptography provider for encryption
@@ -528,6 +537,20 @@ namespace eap

        unsigned __int64 m_seq_num_client;                      ///< Sequence number for encrypting
        unsigned __int64 m_seq_num_server;                      ///< Sequence number for decrypting
+#else
+        winstd::tstring m_sc_target_name;                       ///< Schannel target name
+        winstd::sec_credentials m_sc_cred;                      ///< Schannel client credentials
+        std::vector<unsigned char> m_sc_queue;                  ///< TLS data queue
+        winstd::sec_context m_sc_ctx;                           ///< Schannel context
+
+        enum {
+            phase_unknown = -1,                                 ///< Unknown phase
+            phase_handshake_init = 0,                           ///< Handshake initialize
+            phase_handshake_cont,                               ///< Handshake continue
+            phase_application_data,                             ///< Exchange application data
+            phase_shutdown,                                     ///< Connection shut down
+        } m_phase;                                              ///< What phase is our communication at?
+#endif

        // The following members are required to avoid memory leakage in get_result()
        EAP_ATTRIBUTES m_eap_attr_desc;                         ///< EAP Radius attributes descriptor
--- a/lib/TLS/include/TLS.h
+++ b/lib/TLS/include/TLS.h
@@ -503,7 +503,16 @@ namespace eap
        ///
        tls_conn_state& operator=(_Inout_ tls_conn_state &&other);

+        ///
+        /// Configures state according to given cipher
+        ///
+        /// \param[in] cipher  Cipher ID
+        ///
+        void set_cipher(_In_ const unsigned char cipher[2]);
+
    public:
+        LPCTSTR m_prov_name;            ///< Cryptography provider name
+        DWORD m_prov_type;              ///< Cryptography provider type
        ALG_ID m_alg_encrypt;           ///< Bulk encryption algorithm
        size_t m_size_enc_key;          ///< Encryption key size in bytes (has to comply with `m_alg_encrypt`)
        size_t m_size_enc_iv;           ///< Encryption initialization vector size in bytes (has to comply with `m_alg_encrypt`)
--- a/lib/TLS/src/Config.cpp
+++ b/lib/TLS/src/Config.cpp
@@ -75,8 +75,10 @@ eap::config_method_tls::config_method_tls(_In_ module &mod) : config_method_with
 eap::config_method_tls::config_method_tls(_In_ const config_method_tls &other) :
    m_trusted_root_ca(other.m_trusted_root_ca),
    m_server_names(other.m_server_names),
+#if EAP_TLS < EAP_TLS_SCHANNEL
    m_session_id(other.m_session_id),
    m_master_secret(other.m_master_secret),
+#endif
    config_method_with_cred(other)
 {
 }
@@ -85,8 +87,10 @@ eap::config_method_tls::config_method_tls(_In_ const config_method_tls &other) :
 eap::config_method_tls::config_method_tls(_Inout_ config_method_tls &&other) :
    m_trusted_root_ca(std::move(other.m_trusted_root_ca)),
    m_server_names(std::move(other.m_server_names)),
+#if EAP_TLS < EAP_TLS_SCHANNEL
    m_session_id(std::move(other.m_session_id)),
    m_master_secret(std::move(other.m_master_secret)),
+#endif
    config_method_with_cred(std::move(other))
 {
 }
@@ -98,8 +102,10 @@ eap::config_method_tls& eap::config_method_tls::operator=(_In_ const config_meth
        (config_method_with_cred&)*this = other;
        m_trusted_root_ca = other.m_trusted_root_ca;
        m_server_names    = other.m_server_names;
+#if EAP_TLS < EAP_TLS_SCHANNEL
        m_session_id      = other.m_session_id;
        m_master_secret   = other.m_master_secret;
+#endif
    }

    return *this;
@@ -112,8 +118,10 @@ eap::config_method_tls& eap::config_method_tls::operator=(_Inout_ config_method_
        (config_method_with_cred&&)*this = std::move(other);
        m_trusted_root_ca = std::move(other.m_trusted_root_ca);
        m_server_names    = std::move(other.m_server_names);
+#if EAP_TLS < EAP_TLS_SCHANNEL
        m_session_id      = std::move(other.m_session_id);
        m_master_secret   = std::move(other.m_master_secret);
+#endif
    }

    return *this;
@@ -161,10 +169,8 @@ void eap::config_method_tls::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *
    }

    // <ServerName>
-    for (list<string>::const_iterator i = m_server_names.begin(), i_end = m_server_names.end(); i != i_end; ++i) {
-        wstring str;
-        MultiByteToWideChar(CP_UTF8, 0, i->c_str(), (int)i->length(), str);
-        if (FAILED(hr = eapxml::put_element_value(pDoc, pXmlElServerSideCredential, bstr(L"ServerName"), bstrNamespace, bstr(str))))
+    for (list<wstring>::const_iterator i = m_server_names.begin(), i_end = m_server_names.end(); i != i_end; ++i) {
+        if (FAILED(hr = eapxml::put_element_value(pDoc, pXmlElServerSideCredential, bstr(L"ServerName"), bstrNamespace, bstr(*i))))
            throw com_runtime_error(hr, __FUNCTION__ " Error creating <ServerName> element.");
    }
 }
@@ -231,12 +237,7 @@ void eap::config_method_tls::load(_In_ IXMLDOMNode *pConfigRoot)
                pXmlListServerIDs->get_item(j, &pXmlElServerID);
                bstr bstrServerID;
                pXmlElServerID->get_text(&bstrServerID);
-
-                // Server names (FQDNs) are always ASCII. Hopefully. Convert them to UTF-8 anyway for consistent comparison. CP_ANSI varies.
-                string str;
-                WideCharToMultiByte(CP_UTF8, 0, bstrServerID, bstrServerID.length(), str, NULL, NULL);
-
-                m_server_names.push_back(str);
+                m_server_names.push_back(wstring(bstrServerID));
            }

            m_module.log_config((xpathServerSideCredential + L"/ServerName").c_str(), m_server_names);
@@ -250,8 +251,10 @@ void eap::config_method_tls::operator<<(_Inout_ cursor_out &cursor) const
    config_method_with_cred::operator<<(cursor);
    cursor << m_trusted_root_ca;
    cursor << m_server_names   ;
+#if EAP_TLS < EAP_TLS_SCHANNEL
    cursor << m_session_id     ;
    cursor << m_master_secret  ;
+#endif
 }


@@ -260,9 +263,14 @@ size_t eap::config_method_tls::get_pk_size() const
    return
        config_method_with_cred::get_pk_size() +
        pksizeof(m_trusted_root_ca) +
-        pksizeof(m_server_names   ) +
+        pksizeof(m_server_names   )
+#if EAP_TLS < EAP_TLS_SCHANNEL
+        +
        pksizeof(m_session_id     ) +
        pksizeof(m_master_secret  );
+#else
+        ;
+#endif
 }


@@ -271,8 +279,10 @@ void eap::config_method_tls::operator>>(_Inout_ cursor_in &cursor)
    config_method_with_cred::operator>>(cursor);
    cursor >> m_trusted_root_ca;
    cursor >> m_server_names   ;
+#if EAP_TLS < EAP_TLS_SCHANNEL
    cursor >> m_session_id     ;
    cursor >> m_master_secret  ;
+#endif
 }


--- a/lib/TLS/src/Credentials.cpp
+++ b/lib/TLS/src/Credentials.cpp
@@ -182,11 +182,10 @@ void eap::credentials_tls::store(_In_z_ LPCTSTR pszTargetName) const
        throw win_runtime_error(__FUNCTION__ " CryptProtectData failed.");

    tstring target(target_name(pszTargetName));
-    wstring name(std::move(get_name()));

    // Write credentials.
    assert(cred_enc.cbData     < CRED_MAX_CREDENTIAL_BLOB_SIZE);
-    assert(name.length()   < CRED_MAX_USERNAME_LENGTH     );
+    assert(m_identity.length() < CRED_MAX_USERNAME_LENGTH     );
    CREDENTIAL cred = {
        0,                          // Flags
        CRED_TYPE_GENERIC,          // Type
@@ -199,7 +198,7 @@ void eap::credentials_tls::store(_In_z_ LPCTSTR pszTargetName) const
        0,                          // AttributeCount
        NULL,                       // Attributes
        NULL,                       // TargetAlias
-        (LPTSTR)name.c_str()        // UserName
+        (LPTSTR)m_identity.c_str()  // UserName
    };
    if (!CredWrite(&cred, 0))
        throw win_runtime_error(__FUNCTION__ " CredWrite failed.");
@@ -227,7 +226,14 @@ void eap::credentials_tls::retrieve(_In_z_ LPCTSTR pszTargetName)
    if (!bResult)
        throw win_runtime_error(__FUNCTION__ " Error loading certificate.");

-    m_module.log_config((wstring(pszTargetName) + L"/Certificate").c_str(), get_name().c_str());
+    if (cred->UserName)
+        m_identity = cred->UserName;
+    else
+        m_identity.clear();
+
+    wstring xpath(pszTargetName);
+    m_module.log_config((xpath + L"/Identity").c_str(), m_identity.c_str());
+    m_module.log_config((xpath + L"/Certificate").c_str(), get_name().c_str());
 }


@@ -239,7 +245,9 @@ LPCTSTR eap::credentials_tls::target_suffix() const

 std::wstring eap::credentials_tls::get_identity() const
 {
-    if (m_cert) {
+    if (!m_identity.empty()) {
+        return m_identity;
+    } else if (m_cert) {
        wstring identity;
        CertGetNameString(m_cert, CERT_NAME_EMAIL_TYPE, 0, NULL, identity);
        return identity;
@@ -248,12 +256,6 @@ std::wstring eap::credentials_tls::get_identity() const
 }


-tstring eap::credentials_tls::get_name() const
-{
-    return m_cert ? std::move(get_cert_title(m_cert)) : _T("<blank>");
-}
-
-
 eap::credentials::source_t eap::credentials_tls::combine(
    _In_       const credentials_tls   *cred_cached,
    _In_       const config_method_tls &cfg,
--- a/lib/TLS/src/Method.cpp
+++ b/lib/TLS/src/Method.cpp
@@ -20,9 +20,41 @@

 #include "StdAfx.h"

+#if EAP_TLS >= EAP_TLS_SCHANNEL
+#pragma comment(lib, "Secur32.lib")
+#endif
+
 using namespace std;
 using namespace winstd;

+//////////////////////////////////////////////////////////////////////
+// Data
+//////////////////////////////////////////////////////////////////////
+
+#if EAP_TLS < EAP_TLS_SCHANNEL
+
+static const unsigned char s_cipher_suite[] = {
+    //0xc0, 0x28, // ECDHE-RSA-AES256-SHA384       Kx=ECDH     Au=RSA   Enc=AES(256)    Mac=SHA384
+    //0xc0, 0x24, // ECDHE-ECDSA-AES256-SHA384     Kx=ECDH     Au=ECDSA Enc=AES(256)    Mac=SHA384
+    0x00, 0x3d, // AES256-SHA256                 Kx=RSA      Au=RSA   Enc=AES(256)    Mac=SHA256
+    //0x00, 0x6b, // DHE-RSA-AES256-SHA256         Kx=DH       Au=RSA   Enc=AES(256)    Mac=SHA256
+    //0x00, 0x6a, // DHE-DSS-AES256-SHA256         Kx=DH       Au=DSS   Enc=AES(256)    Mac=SHA256
+    //0xc0, 0x27, // ECDHE-RSA-AES128-SHA256       Kx=ECDH     Au=RSA   Enc=AES(128)    Mac=SHA256
+    //0xc0, 0x23, // ECDHE-ECDSA-AES128-SHA256     Kx=ECDH     Au=ECDSA Enc=AES(128)    Mac=SHA256
+    0x00, 0x3c, // AES128-SHA256                 Kx=RSA      Au=RSA   Enc=AES(128)    Mac=SHA256
+    //0x00, 0x67, // DHE-RSA-AES128-SHA256         Kx=DH       Au=RSA   Enc=AES(128)    Mac=SHA256
+    //0x00, 0x40, // DHE-DSS-AES128-SHA256         Kx=DH       Au=DSS   Enc=AES(128)    Mac=SHA256
+
+    // Backward compatibility ciphers
+    0x00, 0x2f, // TLS_RSA_WITH_AES_128_CBC_SHA (required by TLS 1.2)
+    0x00, 0x0a, // TLS_RSA_WITH_3DES_EDE_CBC_SHA (required by EAP-TLS)
+};
+static const unsigned char s_compression_suite[] = {
+    0x00, // No compression
+};
+
+#endif
+

 //////////////////////////////////////////////////////////////////////
 // eap::method_tls::packet
@@ -93,26 +125,37 @@ void eap::method_tls::packet::clear()
 // eap::method_tls
 //////////////////////////////////////////////////////////////////////

-eap::method_tls::method_tls(_In_ module &module, _In_ config_provider_list &cfg, _In_ credentials_tls &cred) :
+eap::method_tls::method_tls(_In_ module &module, _In_ config_connection &cfg, _In_ credentials_tls &cred) :
    m_cred(cred),
+    m_user_ctx(NULL),
+#if EAP_TLS < EAP_TLS_SCHANNEL
    m_phase(phase_unknown),
    m_seq_num_client(0),
    m_seq_num_server(0),
+#else
+    m_phase(phase_unknown),
+#endif
    m_blob_cfg(NULL),
 #ifdef EAP_USE_NATIVE_CREDENTIAL_CACHE
    m_blob_cred(NULL),
 #endif
    method(module, cfg, cred)
 {
+#if EAP_TLS < EAP_TLS_SCHANNEL
    m_tls_version = tls_version_1_2;
+#ifdef _DEBUG
    memset(m_handshake, 0, sizeof(m_handshake));
+#endif
+#endif
 }


 eap::method_tls::method_tls(_Inout_ method_tls &&other) :
    m_cred                      (          other.m_cred                       ),
+    m_user_ctx                  (std::move(other.m_user_ctx                  )),
    m_packet_req                (std::move(other.m_packet_req                )),
    m_packet_res                (std::move(other.m_packet_res                )),
+#if EAP_TLS < EAP_TLS_SCHANNEL
    m_cp                        (std::move(other.m_cp                        )),
    m_cp_enc_client             (std::move(other.m_cp_enc_client             )),
    m_cp_enc_server             (std::move(other.m_cp_enc_server             )),
@@ -136,12 +179,21 @@ eap::method_tls::method_tls(_Inout_ method_tls &&other) :
    m_phase                     (std::move(other.m_phase                     )),
    m_seq_num_client            (std::move(other.m_seq_num_client            )),
    m_seq_num_server            (std::move(other.m_seq_num_server            )),
+#else
+    m_sc_target_name            (std::move(other.m_sc_target_name            )),
+    m_sc_cred                   (std::move(other.m_sc_cred                   )),
+    m_sc_queue                  (std::move(other.m_sc_queue                  )),
+    m_sc_ctx                    (std::move(other.m_sc_ctx                    )),
+    m_phase                     (std::move(other.m_phase                     )),
+#endif
    method                      (std::move(other                             ))
 {
+#if EAP_TLS < EAP_TLS_SCHANNEL
    memcpy(m_handshake, other.m_handshake, sizeof(m_handshake));
 #ifdef _DEBUG
    memset(other.m_handshake, 0, sizeof(m_handshake));
 #endif
+#endif
 }


@@ -162,8 +214,10 @@ eap::method_tls& eap::method_tls::operator=(_Inout_ method_tls &&other)
    if (this != std::addressof(other)) {
        assert(std::addressof(m_cred) == std::addressof(other.m_cred)); // Move method with same credentials only!
        (method&)*this               = std::move(other                             );
+        m_user_ctx                   = std::move(other.m_user_ctx                  );
        m_packet_req                 = std::move(other.m_packet_req                );
        m_packet_res                 = std::move(other.m_packet_res                );
+#if EAP_TLS < EAP_TLS_SCHANNEL
        m_cp                         = std::move(other.m_cp                        );
        m_cp_enc_client              = std::move(other.m_cp_enc_client             );
        m_cp_enc_server              = std::move(other.m_cp_enc_server             );
@@ -191,6 +245,13 @@ eap::method_tls& eap::method_tls::operator=(_Inout_ method_tls &&other)
        memcpy(m_handshake, other.m_handshake, sizeof(m_handshake));
 #ifdef _DEBUG
        memset(other.m_handshake, 0, sizeof(m_handshake));
+#endif
+#else
+        m_sc_target_name             = std::move(other.m_sc_target_name            );
+        m_sc_cred                    = std::move(other.m_sc_cred                   );
+        m_sc_queue                   = std::move(other.m_sc_queue                  );
+        m_sc_ctx                     = std::move(other.m_sc_ctx                    );
+        m_phase                      = std::move(other.m_phase                     );
 #endif
    }

@@ -206,8 +267,19 @@ void eap::method_tls::begin_session(
 {
    method::begin_session(dwFlags, pAttributeArray, hTokenImpersonateUser, dwMaxSendPacketSize);

+    m_user_ctx = hTokenImpersonateUser;
+    user_impersonator impersonating(m_user_ctx);
+
+    // Get method configuration.
+    if (m_cfg.m_providers.empty() || m_cfg.m_providers.front().m_methods.empty())
+        throw invalid_argument(__FUNCTION__ " Configuration has no providers and/or methods.");
+    const config_provider &cfg_prov(m_cfg.m_providers.front());
+    const config_method_tls *cfg_method = dynamic_cast<const config_method_tls*>(cfg_prov.m_methods.front().get());
+    assert(cfg_method);
+
+#if EAP_TLS < EAP_TLS_SCHANNEL
    // Create cryptographics provider for support needs (handshake hashing, client random, temporary keys...).
-    if (!m_cp.create(NULL, NULL, PROV_RSA_AES))
+    if (!m_cp.create(NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT))
        throw win_runtime_error(__FUNCTION__ " Error creating cryptographics provider.");

    // Microsoft CryptoAPI does not support importing clear text session keys.
@@ -215,16 +287,56 @@ void eap::method_tls::begin_session(
    if (!m_key_exp1.create_exp1(m_cp, AT_KEYEXCHANGE))
        throw win_runtime_error(__FUNCTION__ " Error creating exponent-of-one key.");

-    if (m_cfg.m_providers.empty() || m_cfg.m_providers.front().m_methods.empty())
-        throw invalid_argument(__FUNCTION__ " Configuration has no providers and/or methods.");
-
-    const config_provider &cfg_prov(m_cfg.m_providers.front());
-    const config_method_tls *cfg_method = dynamic_cast<const config_method_tls*>(cfg_prov.m_methods.front().get());
-    assert(cfg_method);
-
    // Restore previous session ID and master secret. We might get lucky.
    m_session_id = cfg_method->m_session_id;
    m_master_secret = cfg_method->m_master_secret;
+#else
+    // Build (expected) server name(s) for Schannel.
+    m_sc_target_name.clear();
+    for (list<wstring>::const_iterator name = cfg_method->m_server_names.cbegin(), name_end = cfg_method->m_server_names.cend(); name != name_end; ++name) {
+        if (name != cfg_method->m_server_names.cbegin())
+            m_sc_target_name += _T(';');
+#ifdef _UNICODE
+        m_sc_target_name.insert(m_sc_target_name.end(), name->begin(), name->end());
+#else
+        string buf;
+        WideCharToMultiByte(CP_ACP, 0, name->c_str(), -1, buf, NULL, NULL);
+        m_sc_target_name.insert(m_sc_target_name.end(), buf.begin(), buf.end());
+#endif
+    }
+
+    // Prepare client credentials for Schannel.
+    PCCERT_CONTEXT certs[] = { m_cred.m_cert ? m_cred.m_cert : NULL };
+    SCHANNEL_CRED cred = {
+        SCHANNEL_CRED_VERSION,                                                      // dwVersion
+        m_cred.m_cert ? 1 : 0,                                                      // cCreds
+        certs,                                                                      // paCred
+        NULL,                                                                       // hRootStore: Not valid for client credentials
+        0,                                                                          // cMappers
+        NULL,                                                                       // aphMappers
+        0,                                                                          // cSupportedAlgs: Use system configured default
+        NULL,                                                                       // palgSupportedAlgs: Use system configured default
+        0,                                                                          // grbitEnabledProtocols: Use default
+        0,                                                                          // dwMinimumCipherStrength: Use system configured default
+        0,                                                                          // dwMaximumCipherStrength: Use system configured default
+        0,                                                                          // dwSessionLifespan: Use system configured default = 10hr
+#if EAP_TLS >= EAP_TLS_SCHANNEL_FULL
+        SCH_CRED_AUTO_CRED_VALIDATION                                           |   // dwFlags: Let Schannel verify server certificate
+#else
+        SCH_CRED_MANUAL_CRED_VALIDATION                                         |   // dwFlags: Prevent Schannel verify server certificate (we want to use custom root CA store and multiple name checking)
+#endif
+        SCH_CRED_CACHE_ONLY_URL_RETRIEVAL_ON_CREATE                             |   // dwFlags: Do not attempt online revocation check - we do not expect to have network connection yet
+        SCH_CRED_IGNORE_NO_REVOCATION_CHECK                                     |   // dwFlags: Ignore no-revocation-check errors (TODO: Test if this flag is required.)
+        SCH_CRED_IGNORE_REVOCATION_OFFLINE                                      |   // dwFlags: Ignore offline-revocation errors - we do not expect to have network connection yet
+        SCH_CRED_NO_DEFAULT_CREDS                                               |   // dwFlags: If client certificate we provided is not acceptable, do not try to select one on your own
+        (cfg_method->m_server_names.empty() ? SCH_CRED_NO_SERVERNAME_CHECK : 0) |   // dwFlags: When no expected server name is given, do not do the server name check.
+        0x00400000 /*SCH_USE_STRONG_CRYPTO*/,                                       // dwFlags: Do not use broken ciphers
+        0                                                                           // dwCredFormat
+    };
+    SECURITY_STATUS stat = m_sc_cred.acquire(NULL, UNISP_NAME, SECPKG_CRED_OUTBOUND, NULL, &cred);
+    if (FAILED(stat))
+        throw sec_runtime_error(stat, __FUNCTION__ " Error acquiring Schannel credentials handle.");
+#endif
 }


@@ -316,6 +428,9 @@ void eap::method_tls::process_request_packet(
    m_packet_res.m_id    = m_packet_req.m_id;
    m_packet_res.m_flags = 0;

+    user_impersonator impersonating(m_user_ctx);
+
+#if EAP_TLS < EAP_TLS_SCHANNEL
    if (pReceivedPacket->Code == EapCodeRequest && (m_packet_req.m_flags & flags_req_start)) {
        // This is the EAP-TLS start message: (re)initialize method.
        m_module.log_event(&EAPMETHOD_TLS_HANDSHAKE_START2, event_data((unsigned int)eap_type_tls), event_data::blank);
@@ -359,8 +474,12 @@ void eap::method_tls::process_request_packet(
        if (!m_handshake[tls_handshake_type_server_hello])
            throw win_runtime_error(__FUNCTION__ " Server did not hello back. No server random! What cipher to use?");

-        // Create cryptographics provider (based on server selected cipher?).
-        if (!m_cp_enc_client.create(NULL, NULL, PROV_RSA_AES))
+        // Adopt server state as client pending.
+        // If server already send the change cipher spec, use active server state. Otherwise pending.
+        m_state_client_pending = m_state_server.m_alg_encrypt ? m_state_server : m_state_server_pending;
+
+        // Create cryptographics provider.
+        if (!m_cp_enc_client.create(NULL, m_state_client_pending.m_prov_name, m_state_client_pending.m_prov_type, CRYPT_VERIFYCONTEXT))
            throw win_runtime_error(__FUNCTION__ " Error creating cryptographics provider.");

        if (m_handshake[tls_handshake_type_certificate]) {
@@ -382,14 +501,14 @@ void eap::method_tls::process_request_packet(

            // Generate pre-master secret. PMS will get sanitized in its destructor when going out-of-scope.
            // Always use latest supported version by client (not negotiated one, to detect version rollback attacks).
-            tls_master_secret pms(m_cp_enc_client, tls_version_1_2);
+            tls_master_secret pms(m_cp, tls_version_1_2);

            // Derive master secret.
            static const unsigned char s_label[] = "master secret";
            sanitizing_blob seed(s_label, s_label + _countof(s_label) - 1);
            seed.insert(seed.end(), (const unsigned char*)&m_random_client, (const unsigned char*)(&m_random_client + 1));
            seed.insert(seed.end(), (const unsigned char*)&m_random_server, (const unsigned char*)(&m_random_server + 1));
-            memcpy(&m_master_secret, prf(m_cp_enc_client, m_alg_prf, pms, seed, sizeof(tls_master_secret)).data(), sizeof(tls_master_secret));
+            memcpy(&m_master_secret, prf(m_cp, m_alg_prf, pms, seed, sizeof(tls_master_secret)).data(), sizeof(tls_master_secret));

            // Create client key exchange message, and append to packet.
            sanitizing_blob msg_client_key_exchange(make_message(tls_message_type_handshake, make_client_key_exchange(pms)));
@@ -404,23 +523,19 @@ void eap::method_tls::process_request_packet(
        sanitizing_blob ccs(make_message(tls_message_type_change_cipher_spec, sanitizing_blob(1, 1)));
        m_packet_res.m_data.insert(m_packet_res.m_data.end(), ccs.begin(), ccs.end());

-        // Adopt server state as client pending.
-        // If server already send the change cipher spec, use active server state. Otherwise pending.
-        m_state_client_pending = m_state_server.m_alg_encrypt ? m_state_server : m_state_server_pending;
-
        // Derive client side keys.
        static const unsigned char s_label[] = "key expansion";
        sanitizing_blob seed(s_label, s_label + _countof(s_label) - 1);
        seed.insert(seed.end(), (const unsigned char*)&m_random_server, (const unsigned char*)(&m_random_server + 1));
        seed.insert(seed.end(), (const unsigned char*)&m_random_client, (const unsigned char*)(&m_random_client + 1));
-        sanitizing_blob key_block(prf(m_cp_enc_client, m_alg_prf, m_master_secret, seed,
+        sanitizing_blob key_block(prf(m_cp, m_alg_prf, m_master_secret, seed,
            2*m_state_client_pending.m_size_mac_key +  // client_write_MAC_secret & server_write_MAC_secret (SHA1)
            2*m_state_client_pending.m_size_enc_key +  // client_write_key        & server_write_key
            2*m_state_client_pending.m_size_enc_iv )); // client_write_IV         & server_write_IV
        const unsigned char *_key_block = key_block.data();

        // client_write_MAC_secret
-        m_state_client_pending.m_padding_hmac = hmac_padding(m_cp_enc_client, m_state_client_pending.m_alg_mac, _key_block, m_state_client_pending.m_size_mac_key);
+        m_state_client_pending.m_padding_hmac = hmac_padding(m_cp, m_state_client_pending.m_alg_mac, _key_block, m_state_client_pending.m_size_mac_key);
        _key_block += m_state_client_pending.m_size_mac_key;

        // server_write_MAC_secret
@@ -461,12 +576,32 @@ void eap::method_tls::process_request_packet(
        if (m_handshake[tls_handshake_type_hello_request])
            m_phase = phase_client_hello;
    }
+#else
+    if (pReceivedPacket->Code == EapCodeRequest && (m_packet_req.m_flags & flags_req_start)) {
+        // This is the EAP-TLS start message: (re)initialize method.
+        m_module.log_event(&EAPMETHOD_TLS_HANDSHAKE_START2, event_data((unsigned int)eap_type_tls), event_data::blank);
+        m_phase = phase_handshake_init;
+        m_sc_queue.assign(m_packet_req.m_data.begin(), m_packet_req.m_data.end());
+    } else
+        m_sc_queue.insert(m_sc_queue.end(), m_packet_req.m_data.begin(), m_packet_req.m_data.end());
+
+    switch (m_phase) {
+    case phase_handshake_init:
+    case phase_handshake_cont:
+        process_handshake();
+        break;
+
+    case phase_application_data:
+        process_application_data();
+        break;
+    }
+#endif
+
+    pEapOutput->fAllowNotifications = TRUE;
+    pEapOutput->action = EapPeerMethodResponseActionSend;

    // EAP-Request packet was processed. Clear its data since we use the absence of data to detect first of fragmented message packages.
    m_packet_req.m_data.clear();
-
-    pEapOutput->fAllowNotifications = FALSE;
-    pEapOutput->action = EapPeerMethodResponseActionSend;
 }


@@ -538,11 +673,9 @@ void eap::method_tls::get_result(

    switch (reason) {
    case EapPeerMethodResultSuccess: {
-        if (!m_handshake[tls_handshake_type_finished])
-            throw invalid_argument(__FUNCTION__ " Premature success.");
-
        m_module.log_event(&EAPMETHOD_TLS_SUCCESS, event_data((unsigned int)eap_type_tls), event_data::blank);

+#if EAP_TLS < EAP_TLS_SCHANNEL
        // Derive MSK/EMSK for line encryption.
        derive_msk();

@@ -555,6 +688,26 @@ void eap::method_tls::get_result(
        a.create_ms_mppe_key(17, (LPCBYTE)&m_key_mppe_server, sizeof(tls_random));
        m_eap_attr.push_back(std::move(a));
        m_eap_attr.push_back(eap_attr::blank);
+#else
+        // Derive MSK/EMSK for line encryption.
+        SecPkgContext_EapKeyBlock key_block;
+        SECURITY_STATUS status = QueryContextAttributes(m_sc_ctx, SECPKG_ATTR_EAP_KEY_BLOCK, &key_block);
+        if (FAILED(status))
+            throw sec_runtime_error(status, __FUNCTION__ "Error generating MSK in Schannel.");
+        const unsigned char *_key_block = key_block.rgbKeys;
+
+        // Fill array with RADIUS attributes.
+        eap_attr a;
+        m_eap_attr.clear();
+        m_eap_attr.reserve(3);
+        a.create_ms_mppe_key(16, _key_block, sizeof(tls_random));
+        m_eap_attr.push_back(std::move(a));
+        _key_block += sizeof(tls_random);
+        a.create_ms_mppe_key(17, _key_block, sizeof(tls_random));
+        m_eap_attr.push_back(std::move(a));
+        _key_block += sizeof(tls_random);
+        m_eap_attr.push_back(eap_attr::blank);
+#endif

        m_eap_attr_desc.dwNumberOfAttributes = (DWORD)m_eap_attr.size();
        m_eap_attr_desc.pAttribs = m_eap_attr.data();
@@ -566,9 +719,11 @@ void eap::method_tls::get_result(
        ppResult->fIsSuccess = TRUE;
        ppResult->dwFailureReasonCode = ERROR_SUCCESS;

+#if EAP_TLS < EAP_TLS_SCHANNEL
        // Update configuration with session resumption data and prepare BLOB.
        cfg_method->m_session_id    = m_session_id;
        cfg_method->m_master_secret = m_master_secret;
+#endif

        break;
    }
@@ -576,9 +731,11 @@ void eap::method_tls::get_result(
    case EapPeerMethodResultFailure:
        m_module.log_event(&EAPMETHOD_TLS_FAILURE, event_data((unsigned int)eap_type_tls), event_data::blank);

+#if EAP_TLS < EAP_TLS_SCHANNEL
        // Clear session resumption data.
        cfg_method->m_session_id.clear();
        cfg_method->m_master_secret.clear();
+#endif

        // Mark credentials as failed, so GUI can re-prompt user.
        cfg_method->m_auth_failed = true;
@@ -611,16 +768,10 @@ void eap::method_tls::get_result(
 }


+#if EAP_TLS < EAP_TLS_SCHANNEL
+
 eap::sanitizing_blob eap::method_tls::make_client_hello()
 {
-    static const unsigned char s_cipher_suite[] = {
-        0x00, 0x2f, // TLS_RSA_WITH_AES_128_CBC_SHA (required by TLS 1.2)
-        0x00, 0x0a, // TLS_RSA_WITH_3DES_EDE_CBC_SHA (required by EAP-TLS)
-    };
-    static const unsigned char s_compression_suite[] = {
-        0x00, // No compression
-    };
-
    size_t size_data;
    sanitizing_blob msg;
    msg.reserve(
@@ -772,7 +923,7 @@ eap::sanitizing_blob eap::method_tls::make_finished() const
            throw win_runtime_error(__FUNCTION__ " Error finishing SHA-256 hash calculation.");
        seed.insert(seed.end(), hash_data.begin(), hash_data.end());
    }
-    sanitizing_blob verify(prf(m_cp_enc_client, m_alg_prf, m_master_secret, seed, 12));
+    sanitizing_blob verify(prf(m_cp, m_alg_prf, m_master_secret, seed, 12));
    msg.insert(msg.end(), verify.begin(), verify.end());

    return msg;
@@ -816,7 +967,7 @@ void eap::method_tls::derive_msk()
    sanitizing_blob seed(s_label, s_label + _countof(s_label) - 1);
    seed.insert(seed.end(), (const unsigned char*)&m_random_client, (const unsigned char*)(&m_random_client + 1));
    seed.insert(seed.end(), (const unsigned char*)&m_random_server, (const unsigned char*)(&m_random_server + 1));
-    sanitizing_blob key_block(prf(m_cp_enc_client, m_alg_prf, m_master_secret, seed, 2*sizeof(tls_random)));
+    sanitizing_blob key_block(prf(m_cp, m_alg_prf, m_master_secret, seed, 2*sizeof(tls_random)));
    const unsigned char *_key_block = key_block.data();

    // MS-MPPE-Recv-Key
@@ -882,14 +1033,6 @@ void eap::method_tls::process_packet(_In_bytecount_(size_pck) const void *_pck,
                process_application_data(msg_dec.data(), msg_dec.size());
                break;
            }
-
-            //default:
-            //    if (m_state_server.m_alg_encrypt) {
-            //        sanitizing_blob msg_dec(msg, msg_end);
-            //        decrypt_message(hdr->type, msg_dec);
-            //        process_vendor_data(hdr->type, msg_dec.data(), msg_dec.size());
-            //    } else
-            //        process_vendor_data(hdr->type, msg, msg_end - msg);
            }
        }

@@ -913,14 +1056,14 @@ void eap::method_tls::process_change_cipher_spec(_In_bytecount_(msg_size) const
        throw win_runtime_error(EAP_E_EAPHOST_METHOD_INVALID_PACKET, __FUNCTION__ " Change cipher spec received without cipher being negotiated first.");

    // Create cryptographics provider (based on server selected cipher?).
-    if (!m_cp_enc_server.create(NULL, NULL, PROV_RSA_AES))
+    if (!m_cp_enc_server.create(NULL, m_state_server_pending.m_prov_name, m_state_server_pending.m_prov_type))
        throw win_runtime_error(__FUNCTION__ " Error creating cryptographics provider.");

    static const unsigned char s_label[] = "key expansion";
    sanitizing_blob seed(s_label, s_label + _countof(s_label) - 1);
    seed.insert(seed.end(), (const unsigned char*)&m_random_server, (const unsigned char*)(&m_random_server + 1));
    seed.insert(seed.end(), (const unsigned char*)&m_random_client, (const unsigned char*)(&m_random_client + 1));
-    sanitizing_blob key_block(prf(m_cp_enc_server, m_alg_prf, m_master_secret, seed,
+    sanitizing_blob key_block(prf(m_cp, m_alg_prf, m_master_secret, seed,
        2*m_state_server_pending.m_size_mac_key +  // client_write_MAC_secret & server_write_MAC_secret (SHA1)
        2*m_state_server_pending.m_size_enc_key +  // client_write_key        & server_write_key
        2*m_state_server_pending.m_size_enc_iv )); // client_write_IV         & server_write_IV
@@ -930,7 +1073,7 @@ void eap::method_tls::process_change_cipher_spec(_In_bytecount_(msg_size) const
    _key_block += m_state_server_pending.m_size_mac_key;

    // server_write_MAC_secret
-    m_state_server_pending.m_padding_hmac = hmac_padding(m_cp_enc_server, m_state_server_pending.m_alg_mac, _key_block, m_state_server_pending.m_size_mac_key);
+    m_state_server_pending.m_padding_hmac = hmac_padding(m_cp, m_state_server_pending.m_alg_mac, _key_block, m_state_server_pending.m_size_mac_key);
    _key_block += m_state_server_pending.m_size_mac_key;

    // client_write_key
@@ -1017,27 +1160,32 @@ void eap::method_tls::process_handshake(_In_bytecount_(msg_size) const void *_ms

                // Cipher
                if (rec + 2 > rec_end)
-                    throw win_runtime_error(EAP_E_EAPHOST_METHOD_INVALID_PACKET, __FUNCTION__ " Cipher or incomplete.");
-                if (rec[0] == 0x00 || rec[1] == 0x2f) {
-                    // TLS_RSA_WITH_AES_128_CBC_SHA
-                    m_state_server_pending.m_alg_encrypt    = CALG_AES_128;
-                    m_state_server_pending.m_size_enc_key   = 128/8; // AES-128
-                    m_state_server_pending.m_size_enc_iv    = 128/8; // AES-128
-                    m_state_server_pending.m_size_enc_block = 128/8; // AES-128
-                    m_state_server_pending.m_alg_mac        = CALG_SHA1;
-                    m_state_server_pending.m_size_mac_key   = 160/8; // SHA-1
-                    m_state_server_pending.m_size_mac_hash  = 160/8; // SHA-1
-                } else if (rec[0] == 0x00 || rec[1] == 0x0a) {
-                    // TLS_RSA_WITH_3DES_EDE_CBC_SHA
-                    m_state_server_pending.m_alg_encrypt    = CALG_3DES;
-                    m_state_server_pending.m_size_enc_key   = 192/8; // 3DES 192bits
-                    m_state_server_pending.m_size_enc_iv    = 64/8;  // 3DES 64bits
-                    m_state_server_pending.m_size_enc_block = 64/8;  // 3DES 64bits
-                    m_state_server_pending.m_alg_mac        = CALG_SHA1;
-                    m_state_server_pending.m_size_mac_key   = 160/8; // SHA-1
-                    m_state_server_pending.m_size_mac_hash  = 160/8; // SHA-1
+                    throw win_runtime_error(EAP_E_EAPHOST_METHOD_INVALID_PACKET, __FUNCTION__ " Cipher missing or incomplete.");
+
+                // Verify the server selected one of our ciphers.
+                for (size_t i = 0; ; i += 2) {
+                    if (i < _countof(s_cipher_suite)) {
+                        if (s_cipher_suite[i] == rec[0] && s_cipher_suite[i + 1] == rec[1])
+                            break;
                    } else
                        throw win_runtime_error(ERROR_NOT_SUPPORTED, string_printf(__FUNCTION__ " Other than requested cipher selected (received 0x%02x%02x).", rec[0], rec[1]));
+                }
+                m_state_server_pending.set_cipher(rec);
+                rec += 2;
+
+                // Compression
+                if (rec + 1 > rec_end)
+                    throw win_runtime_error(EAP_E_EAPHOST_METHOD_INVALID_PACKET, __FUNCTION__ " Compression missing or incomplete.");
+
+                // Verify the server selected one of our compression schemes.
+                for (size_t i = 0; ; i++) {
+                    if (i < _countof(s_compression_suite)) {
+                        if (s_compression_suite[i] == rec[0])
+                            break;
+                    } else
+                        throw win_runtime_error(ERROR_NOT_SUPPORTED, string_printf(__FUNCTION__ " Other than requested compression selected (received 0x%02).", rec[0]));
+                }
+                rec++;

                m_module.log_event(&EAPMETHOD_TLS_SERVER_HELLO1,
                    event_data((unsigned int)eap_type_tls),
@@ -1118,7 +1266,7 @@ void eap::method_tls::process_handshake(_In_bytecount_(msg_size) const void *_ms
                    seed.insert(seed.end(), hash_data.begin(), hash_data.end());
                }

-                if (memcmp(prf(m_cp_enc_server, m_alg_prf, m_master_secret, seed, 12).data(), rec, 12))
+                if (memcmp(prf(m_cp, m_alg_prf, m_master_secret, seed, 12).data(), rec, 12))
                    throw win_runtime_error(ERROR_ENCRYPTION_FAILED, __FUNCTION__ " Integrity check failed.");

                m_module.log_event(&EAPMETHOD_TLS_FINISHED, event_data((unsigned int)eap_type_tls), event_data::blank);
@@ -1143,71 +1291,276 @@ void eap::method_tls::process_handshake(_In_bytecount_(msg_size) const void *_ms
    }
 }

+#else

-void eap::method_tls::process_application_data(_In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size)
+void eap::method_tls::process_handshake()
+{
+    // Prepare input buffer(s).
+    SecBuffer buf_in[] = {
+        {
+            (unsigned long)m_sc_queue.size(),
+            SECBUFFER_TOKEN,
+            m_sc_queue.data()
+        },
+        { 0, SECBUFFER_EMPTY, NULL },
+    };
+    SecBufferDesc buf_in_desc = {
+        SECBUFFER_VERSION,
+        _countof(buf_in),
+        buf_in
+    };
+
+    // Prepare output buffer(s).
+    SecBuffer buf_out[] = {
+        { 0, SECBUFFER_TOKEN, NULL },
+        { 0, SECBUFFER_ALERT, NULL },
+    };
+    sec_buffer_desc buf_out_desc(buf_out, _countof(buf_out));
+
+    SECURITY_STATUS status;
+    if (m_phase == phase_handshake_init) {
+        m_module.log_event(&EAPMETHOD_TLS_HANDSHAKE_START2, event_data((unsigned int)eap_type_tls), event_data::blank);
+        status = m_sc_ctx.initialize(
+            m_sc_cred,
+            !m_sc_target_name.empty() ? m_sc_target_name.c_str() : NULL,
+            ISC_REQ_REPLAY_DETECT | ISC_REQ_SEQUENCE_DETECT | ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_STREAM | /*ISC_REQ_USE_SUPPLIED_CREDS |*/ ISC_REQ_EXTENDED_ERROR | ISC_REQ_ALLOCATE_MEMORY,
+            0,
+            &buf_in_desc,
+            &buf_out_desc);
+    } else {
+        status = m_sc_ctx.process(
+            m_sc_cred,
+            !m_sc_target_name.empty() ? m_sc_target_name.c_str() : NULL,
+            ISC_REQ_REPLAY_DETECT | ISC_REQ_SEQUENCE_DETECT | ISC_REQ_CONFIDENTIALITY | ISC_REQ_INTEGRITY | ISC_REQ_STREAM | /*ISC_REQ_USE_SUPPLIED_CREDS |*/ ISC_REQ_EXTENDED_ERROR | ISC_REQ_ALLOCATE_MEMORY,
+            0,
+            &buf_in_desc,
+            &buf_out_desc);
+    }
+
+#if EAP_TLS < EAP_TLS_SCHANNEL_FULL
+    if (status == SEC_E_OK)
+        verify_server_trust();
+#endif
+
+    if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) {
+        // Send Schannel's token via EAP.
+        assert(buf_out[0].BufferType == SECBUFFER_TOKEN);
+        assert(m_sc_ctx.m_attrib & ISC_RET_ALLOCATED_MEMORY);
+        m_packet_res.m_data.assign((const unsigned char*)buf_out[0].pvBuffer, (const unsigned char*)buf_out[0].pvBuffer + buf_out[0].cbBuffer);
+        if (buf_in[1].BufferType == SECBUFFER_EXTRA) {
+            // Server appended extra data. Process it.
+            process_application_data(&*(m_sc_queue.end() - buf_in[1].cbBuffer), buf_in[1].cbBuffer);
+        }
+        m_sc_queue.clear();
+
+        if (status == SEC_E_OK) {
+            SecPkgContext_Authority auth;
+            if (FAILED(status = QueryContextAttributes(m_sc_ctx, SECPKG_ATTR_AUTHORITY, &auth))) {
+                m_module.log_event(&EAPMETHOD_TLS_QUERY_FAILED, event_data((unsigned int)SECPKG_ATTR_AUTHORITY), event_data(status), event_data::blank);
+                auth.sAuthorityName = _T("");
+            }
+
+            SecPkgContext_ConnectionInfo info;
+            if (SUCCEEDED(status = QueryContextAttributes(m_sc_ctx, SECPKG_ATTR_CONNECTION_INFO, &info)))
+                m_module.log_event(&EAPMETHOD_TLS_HANDSHAKE_FINISHED,
+                    event_data((unsigned int)eap_type_tls),
+                    event_data(auth.sAuthorityName),
+                    event_data(info.dwProtocol),
+                    event_data(info.aiCipher),
+                    event_data(info.dwCipherStrength),
+                    event_data(info.aiHash),
+                    event_data(info.dwHashStrength),
+                    event_data(info.aiExch),
+                    event_data(info.dwExchStrength),
+                    event_data::blank);
+            else
+                m_module.log_event(&EAPMETHOD_TLS_QUERY_FAILED, event_data((unsigned int)SECPKG_ATTR_CONNECTION_INFO), event_data(status), event_data::blank);
+
+            m_phase = phase_application_data;
+        } else
+            m_phase = phase_handshake_cont;
+    } else if (status == SEC_E_INCOMPLETE_MESSAGE) {
+        // Schannel neeeds more data. Send ACK packet to server to send more.
+    } else if (FAILED(status)) {
+        if (m_sc_ctx.m_attrib & ISC_RET_EXTENDED_ERROR) {
+            // Send alert via EAP. Not that EAP will transmit it once we throw this is an error...
+            assert(buf_out[1].BufferType == SECBUFFER_ALERT);
+            assert(m_sc_ctx.m_attrib & ISC_RET_ALLOCATED_MEMORY);
+            m_packet_res.m_data.assign((const unsigned char*)buf_out[1].pvBuffer, (const unsigned char*)buf_out[1].pvBuffer + buf_out[1].cbBuffer);
+        }
+
+        throw sec_runtime_error(status, __FUNCTION__ " Schannel error.");
+    }
+}
+
+
+void eap::method_tls::process_application_data()
+{
+    if (m_sc_queue.empty()) {
+        // An ACK packet received. Nothing to unencrypt.
+        process_application_data(NULL, 0);
+        return;
+    }
+
+    if (!(m_sc_ctx.m_attrib & ISC_RET_CONFIDENTIALITY))
+        throw runtime_error(__FUNCTION__ " Connection is not encrypted.");
+
+    // Prepare input/output buffer(s).
+    SecBuffer buf[] = {
+        { 0, SECBUFFER_TOKEN, NULL },
+        { 0, SECBUFFER_ALERT, NULL },
+        {
+            (unsigned long)m_sc_queue.size(),
+            SECBUFFER_DATA,
+            m_sc_queue.data()
+        },
+    };
+    SecBufferDesc buf_desc = {
+        SECBUFFER_VERSION,
+        _countof(buf),
+        buf
+    };
+
+    // Decrypt the message.
+    SECURITY_STATUS status = DecryptMessage(m_sc_ctx, &buf_desc, 0, NULL);
+    if (status == SEC_E_OK) {
+        assert(buf[2].BufferType == SECBUFFER_DATA);
+        process_application_data(buf[2].pvBuffer, buf[2].cbBuffer);
+    } else if (status == SEC_E_INCOMPLETE_MESSAGE) {
+        // Schannel neeeds more data. Send ACK packet to server to send more.
+    } else if (status == SEC_I_CONTEXT_EXPIRED) {
+        // Server initiated connection shutdown.
+        m_sc_queue.clear();
+        m_phase = phase_shutdown;
+    } else if (status == SEC_I_RENEGOTIATE) {
+        // Re-negotiation required.
+        m_sc_queue.clear();
+        m_phase = phase_handshake_init;
+        process_handshake();
+    } else if (FAILED(status)) {
+        if (m_sc_ctx.m_attrib & ISC_RET_EXTENDED_ERROR) {
+            // Send alert via EAP. Not that EAP will transmit it once we throw this is an error...
+            assert(buf[1].BufferType == SECBUFFER_ALERT);
+            assert(m_sc_ctx.m_attrib & ISC_RET_ALLOCATED_MEMORY);
+            m_packet_res.m_data.assign((const unsigned char*)buf[1].pvBuffer, (const unsigned char*)buf[1].pvBuffer + buf[1].cbBuffer);
+        }
+
+        throw sec_runtime_error(status, __FUNCTION__ " Schannel error.");
+    }
+}
+
+#endif
+
+
+void eap::method_tls::process_application_data(_In_bytecount_(size_msg) const void *msg, _In_ size_t size_msg)
 {
    UNREFERENCED_PARAMETER(msg);
-    UNREFERENCED_PARAMETER(msg_size);
+    UNREFERENCED_PARAMETER(size_msg);

    // TODO: Parse application data (Diameter AVP)
 }


-//void eap::method_tls::process_vendor_data(_In_ tls_message_type_t type, _In_bytecount_(msg_size) const void *msg, _In_ size_t msg_size)
-//{
-//    UNREFERENCED_PARAMETER(type);
-//    UNREFERENCED_PARAMETER(msg);
-//    UNREFERENCED_PARAMETER(msg_size);
-//}
-
+#if EAP_TLS < EAP_TLS_SCHANNEL_FULL

 void eap::method_tls::verify_server_trust() const
 {
+#if EAP_TLS < EAP_TLS_SCHANNEL
    assert(!m_server_cert_chain.empty());
    const cert_context &cert = m_server_cert_chain.front();
-
-    string subj;
-    if (!CertGetNameStringA(cert, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, NULL, subj))
-        throw win_runtime_error(__FUNCTION__ " Error retrieving server's certificate subject name.");
+#else
+    cert_context cert;
+    SECURITY_STATUS status = QueryContextAttributes(m_sc_ctx, SECPKG_ATTR_REMOTE_CERT_CONTEXT, (PVOID)&cert);
+    if (FAILED(status))
+        throw sec_runtime_error(status, __FUNCTION__ " Error retrieving server certificate from Schannel.");
+#endif

    const config_provider &cfg_prov(m_cfg.m_providers.front());
    const config_method_tls *cfg_method = dynamic_cast<const config_method_tls*>(cfg_prov.m_methods.front().get());
    assert(cfg_method);

-    if (!cfg_method->m_server_names.empty()) {
    // Check server name.
-        for (list<string>::const_iterator s = cfg_method->m_server_names.cbegin(), s_end = cfg_method->m_server_names.cend();; ++s) {
-            if (s != s_end) {
-                const char
-                    *a = s->c_str(),
-                    *b = subj.c_str();
-                size_t
-                    len_a = s->length(),
-                    len_b = subj.length();
+    if (!cfg_method->m_server_names.empty()) {
+        bool
+            has_san = false,
+            found   = false;

-                if (_stricmp(a, b) == 0 || // Direct match
-                    a[0] == '*' && len_b + 1 >= len_a && _stricmp(a + 1, b + len_b - (len_a - 1)) == 0) // "*..." wildchar match
+        // Search subjectAltName2 and subjectAltName.
+        for (DWORD i = 0; !found && i < cert->pCertInfo->cExtension; i++) {
+            unique_ptr<CERT_ALT_NAME_INFO, LocalFree_delete<CERT_ALT_NAME_INFO> > san_info;
+            if (strcmp(cert->pCertInfo->rgExtension[i].pszObjId, szOID_SUBJECT_ALT_NAME2) == 0) {
+                unsigned char *output = NULL;
+                DWORD size_output;
+                if (!CryptDecodeObjectEx(
+                        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+                        szOID_SUBJECT_ALT_NAME2,
+                        cert->pCertInfo->rgExtension[i].Value.pbData, cert->pCertInfo->rgExtension[i].Value.cbData,
+                        CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_ENABLE_PUNYCODE_FLAG,
+                        NULL,
+                        &output, &size_output))
+                    throw win_runtime_error(__FUNCTION__ " Error decoding subjectAltName2 certificate extension.");
+                san_info.reset((CERT_ALT_NAME_INFO*)output);
+            } else if (strcmp(cert->pCertInfo->rgExtension[i].pszObjId, szOID_SUBJECT_ALT_NAME) == 0) {
+                unsigned char *output = NULL;
+                DWORD size_output;
+                if (!CryptDecodeObjectEx(
+                        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+                        szOID_SUBJECT_ALT_NAME,
+                        cert->pCertInfo->rgExtension[i].Value.pbData, cert->pCertInfo->rgExtension[i].Value.cbData,
+                        CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_ENABLE_PUNYCODE_FLAG,
+                        NULL,
+                        &output, &size_output))
+                    throw win_runtime_error(__FUNCTION__ " Error decoding subjectAltName certificate extension.");
+                san_info.reset((CERT_ALT_NAME_INFO*)output);
+            } else {
+                // Skip this extension.
+                continue;
+            }
+            has_san = true;
+
+            for (list<wstring>::const_iterator s = cfg_method->m_server_names.cbegin(), s_end = cfg_method->m_server_names.cend(); !found && s != s_end; ++s) {
+                for (DWORD i = 0; !found && i < san_info->cAltEntry; i++) {
+                    if (san_info->rgAltEntry[i].dwAltNameChoice == CERT_ALT_NAME_DNS_NAME &&
+                        _wcsicmp(s->c_str(), san_info->rgAltEntry[i].pwszDNSName) == 0)
                    {
-                    m_module.log_event(&EAPMETHOD_TLS_SERVER_NAME_TRUSTED, event_data(subj), event_data::blank);
-                    break;
+                        m_module.log_event(&EAPMETHOD_TLS_SERVER_NAME_TRUSTED1, event_data(san_info->rgAltEntry[i].pwszDNSName), event_data::blank);
+                        found = true;
                    }
-            } else
-                throw win_runtime_error(ERROR_INVALID_DOMAINNAME, string_printf(__FUNCTION__ " Server name %s is not on the list of trusted server names.", subj.c_str()).c_str());
                }
            }
+        }
+
+        if (!has_san) {
+            // Certificate has no subjectAltName. Compare against Common Name.
+            wstring subj;
+            if (!CertGetNameStringW(cert, CERT_NAME_DNS_TYPE, CERT_NAME_STR_ENABLE_PUNYCODE_FLAG, NULL, subj))
+                throw win_runtime_error(__FUNCTION__ " Error retrieving server's certificate subject name.");
+
+            for (list<wstring>::const_iterator s = cfg_method->m_server_names.cbegin(), s_end = cfg_method->m_server_names.cend(); !found && s != s_end; ++s) {
+                if (_wcsicmp(s->c_str(), subj.c_str()) == 0) {
+                    m_module.log_event(&EAPMETHOD_TLS_SERVER_NAME_TRUSTED1, event_data(subj), event_data::blank);
+                    found = true;
+                }
+            }
+        }
+
+        if (!found)
+            throw sec_runtime_error(SEC_E_WRONG_PRINCIPAL, __FUNCTION__ " Name provided in server certificate is not on the list of trusted server names.");
+    }

    if (cert->pCertInfo->Issuer.cbData == cert->pCertInfo->Subject.cbData &&
        memcmp(cert->pCertInfo->Issuer.pbData, cert->pCertInfo->Subject.pbData, cert->pCertInfo->Issuer.cbData) == 0)
-        throw com_runtime_error(CRYPT_E_SELF_SIGNED, string_printf(__FUNCTION__ " Server is using a self-signed certificate %s. Cannot trust it.", subj.c_str()).c_str());
+        throw sec_runtime_error(SEC_E_CERT_UNKNOWN, __FUNCTION__ " Server is using a self-signed certificate. Cannot trust it.");

    // Create temporary certificate store of our trusted root CAs.
    cert_store store;
    if (!store.create(CERT_STORE_PROV_MEMORY, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, NULL, 0, NULL))
-        throw win_runtime_error(ERROR_INVALID_DOMAINNAME, __FUNCTION__ " Error creating temporary certificate store.");
+        throw win_runtime_error(__FUNCTION__ " Error creating temporary certificate store.");
    for (list<cert_context>::const_iterator c = cfg_method->m_trusted_root_ca.cbegin(), c_end = cfg_method->m_trusted_root_ca.cend(); c != c_end; ++c)
        CertAddCertificateContextToStore(store, *c, CERT_STORE_ADD_REPLACE_EXISTING, NULL);

-    // Add all certificates from the server's certificate chain, except the first one.
+    // Add all intermediate certificates from the server's certificate chain.
+#if EAP_TLS < EAP_TLS_SCHANNEL
    for (list<cert_context>::const_iterator c = m_server_cert_chain.cbegin(), c_end = m_server_cert_chain.cend(); ++c != c_end;) {
        const cert_context &_c = *c;
        if (_c->pCertInfo->Issuer.cbData == _c->pCertInfo->Subject.cbData &&
@@ -1219,6 +1572,22 @@ void eap::method_tls::verify_server_trust() const

        CertAddCertificateContextToStore(store, *c, CERT_STORE_ADD_REPLACE_EXISTING, NULL);
    }
+#else
+    for (cert_context c(cert); c;) {
+        DWORD flags = 0;
+        c.attach(CertGetIssuerCertificateFromStore(cert->hCertStore, c, NULL, &flags));
+        if (!c) break;
+
+        if (c->pCertInfo->Issuer.cbData == c->pCertInfo->Subject.cbData &&
+            memcmp(c->pCertInfo->Issuer.pbData, c->pCertInfo->Subject.pbData, c->pCertInfo->Issuer.cbData) == 0)
+        {
+            // Skip the root CA certificates (self-signed). We define in whom we trust!
+            continue;
+        }
+
+        CertAddCertificateContextToStore(store, c, CERT_STORE_ADD_REPLACE_EXISTING, NULL);
+    }
+#endif

    // Prepare the certificate chain validation, and check.
    CERT_CHAIN_PARA chain_params = {
@@ -1240,17 +1609,23 @@ void eap::method_tls::verify_server_trust() const
    if (!context.create(NULL, cert, NULL, store, &chain_params, 0))
        throw win_runtime_error(__FUNCTION__ " Error creating certificate chain context.");

-    // Check chain validation error flags. Ignore CERT_TRUST_IS_UNTRUSTED_ROOT flag when we check root CA explicitly.
+    // Check chain validation error flags. Ignore CERT_TRUST_IS_UNTRUSTED_ROOT flag since we check root CA explicitly.
    if (context->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR &&
-        (cfg_method->m_trusted_root_ca.empty() || (context->TrustStatus.dwErrorStatus & ~CERT_TRUST_IS_UNTRUSTED_ROOT) != CERT_TRUST_NO_ERROR))
-        throw win_runtime_error(context->TrustStatus.dwErrorStatus, "Error validating certificate chain.");
+        (context->TrustStatus.dwErrorStatus & ~CERT_TRUST_IS_UNTRUSTED_ROOT) != CERT_TRUST_NO_ERROR)
+    {
+        if (context->TrustStatus.dwErrorStatus & (CERT_TRUST_IS_NOT_TIME_VALID | CERT_TRUST_IS_NOT_TIME_NESTED))
+            throw sec_runtime_error(SEC_E_CERT_EXPIRED, __FUNCTION__ " Server certificate has expired (or is not valid yet).");
+        else if (context->TrustStatus.dwErrorStatus & (CERT_TRUST_IS_UNTRUSTED_ROOT | CERT_TRUST_IS_PARTIAL_CHAIN))
+            throw sec_runtime_error(SEC_E_UNTRUSTED_ROOT, __FUNCTION__ " Server's certificate not issued by one of configured trusted root CAs.");
+        else
+            throw sec_runtime_error(SEC_E_CERT_UNKNOWN, __FUNCTION__ " Error validating server certificate.");
+    }

-    if (!cfg_method->m_trusted_root_ca.empty()) {
    // Verify Root CA against our trusted root CA list
    if (context->cChain != 1)
-            throw win_runtime_error(ERROR_NOT_SUPPORTED, __FUNCTION__ " Multiple chain verification not supported.");
+        throw sec_runtime_error(SEC_E_CERT_UNKNOWN, __FUNCTION__ " Multiple chain verification not supported.");
    if (context->rgpChain[0]->cElement == 0)
-            throw win_runtime_error(ERROR_NOT_SUPPORTED, __FUNCTION__ " Can not verify empty certificate chain.");
+        throw sec_runtime_error(SEC_E_CERT_UNKNOWN, __FUNCTION__ " Can not verify empty certificate chain.");

    PCCERT_CONTEXT cert_root = context->rgpChain[0]->rgpElement[context->rgpChain[0]->cElement-1]->pCertContext;
    for (list<cert_context>::const_iterator c = cfg_method->m_trusted_root_ca.cbegin(), c_end = cfg_method->m_trusted_root_ca.cend();; ++c) {
@@ -1263,20 +1638,22 @@ void eap::method_tls::verify_server_trust() const
            }
        } else {
            // Not found.
-                throw win_runtime_error(ERROR_FILE_NOT_FOUND, __FUNCTION__ " Server's certificate not issued by one of configured trusted root CAs.");
-            }
+            throw sec_runtime_error(SEC_E_UNTRUSTED_ROOT, __FUNCTION__ " Server's certificate not issued by one of configured trusted root CAs.");
        }
    }

    m_module.log_event(&EAPMETHOD_TLS_SERVER_CERT_TRUSTED, event_data::blank);
 }

+#endif
+
+#if EAP_TLS < EAP_TLS_SCHANNEL

 void eap::method_tls::encrypt_message(_In_ tls_message_type_t type, _Inout_ sanitizing_blob &data)
 {
    // Hash sequence number, TLS header, and message.
    size_t size_data = data.size();
-    hmac_hash hash(m_cp_enc_client, m_state_client.m_alg_mac, m_state_client.m_padding_hmac);
+    hmac_hash hash(m_cp, m_state_client.m_alg_mac, m_state_client.m_padding_hmac);
    unsigned __int64 seq_num2 = htonll(m_seq_num_client);
    unsigned short size_data2 = htons((unsigned short)size_data);
    if (!CryptHashData(hash, (const BYTE*)&seq_num2     , sizeof(seq_num2     ), 0) ||
@@ -1298,7 +1675,7 @@ void eap::method_tls::encrypt_message(_In_ tls_message_type_t type, _Inout_ sani
        if (m_tls_version >= tls_version_1_1) {
            // TLS 1.1+: Set random IV.
            data.insert(data.begin(), m_state_client.m_size_enc_iv, 0);
-            if (!CryptGenRandom(m_cp_enc_client, (DWORD)m_state_client.m_size_enc_iv, data.data()))
+            if (!CryptGenRandom(m_cp, (DWORD)m_state_client.m_size_enc_iv, data.data()))
                throw win_runtime_error(__FUNCTION__ " Error generating IV.");
            size_data_enc += m_state_client.m_size_enc_iv;
        }
@@ -1363,7 +1740,7 @@ void eap::method_tls::decrypt_message(_In_ tls_message_type_t type, _Inout_ sani
        size_data -= m_state_server.m_size_mac_hash;

        // Hash sequence number, TLS header (without length), original message length, and message.
-        hmac_hash hash(m_cp_enc_server, m_state_server.m_alg_mac, m_state_server.m_padding_hmac);
+        hmac_hash hash(m_cp, m_state_server.m_alg_mac, m_state_server.m_padding_hmac);
        unsigned __int64 seq_num2 = htonll(m_seq_num_server);
        unsigned short size_data2 = htons((unsigned short)size_data);
        if (!CryptHashData(hash, (const BYTE*)&seq_num2     , sizeof(seq_num2     ), 0) ||
@@ -1594,3 +1971,5 @@ HCRYPTKEY eap::method_tls::create_key(
    return key_out.detach();
 #endif
 }
+
+#endif
--- a/lib/TLS/src/StdAfx.h
+++ b/lib/TLS/src/StdAfx.h
@@ -31,6 +31,7 @@
 #include <WinStd/EAP.h>

 #include <EapHostError.h>
+#include <schnlsp.h>
 #include <time.h>

 #include <algorithm>
--- a/lib/TLS/src/TLS.cpp
+++ b/lib/TLS/src/TLS.cpp
@@ -182,6 +182,8 @@ eap::tls_conn_state::tls_conn_state()
 #ifdef _DEBUG
    // Initialize state primitive members for diagnostic purposes.
    :
+    m_prov_name     (NULL),
+    m_prov_type     (0),
    m_alg_encrypt   (0),
    m_size_enc_key  (0),
    m_size_enc_iv   (0),
@@ -195,6 +197,8 @@ eap::tls_conn_state::tls_conn_state()


 eap::tls_conn_state::tls_conn_state(_In_ const tls_conn_state &other) :
+    m_prov_name     (other.m_prov_name     ),
+    m_prov_type     (other.m_prov_type     ),
    m_alg_encrypt   (other.m_alg_encrypt   ),
    m_size_enc_key  (other.m_size_enc_key  ),
    m_size_enc_iv   (other.m_size_enc_iv   ),
@@ -209,6 +213,8 @@ eap::tls_conn_state::tls_conn_state(_In_ const tls_conn_state &other) :


 eap::tls_conn_state::tls_conn_state(_Inout_ tls_conn_state &&other) :
+    m_prov_name     (std::move(other.m_prov_name     )),
+    m_prov_type     (std::move(other.m_prov_type     )),
    m_alg_encrypt   (std::move(other.m_alg_encrypt   )),
    m_size_enc_key  (std::move(other.m_size_enc_key  )),
    m_size_enc_iv   (std::move(other.m_size_enc_iv   )),
@@ -221,6 +227,8 @@ eap::tls_conn_state::tls_conn_state(_Inout_ tls_conn_state &&other) :
 {
 #ifdef _DEBUG
    // Reinitialize other state primitive members for diagnostic purposes.
+    other.m_prov_name      = NULL;
+    other.m_prov_type      = 0;
    other.m_alg_encrypt    = 0;
    other.m_size_enc_key   = 0;
    other.m_size_enc_iv    = 0;
@@ -235,6 +243,8 @@ eap::tls_conn_state::tls_conn_state(_Inout_ tls_conn_state &&other) :
 eap::tls_conn_state& eap::tls_conn_state::operator=(_In_ const tls_conn_state &other)
 {
    if (this != std::addressof(other)) {
+        m_prov_name      = other.m_prov_name     ;
+        m_prov_type      = other.m_prov_type     ;
        m_alg_encrypt    = other.m_alg_encrypt   ;
        m_size_enc_key   = other.m_size_enc_key  ;
        m_size_enc_iv    = other.m_size_enc_iv   ;
@@ -253,6 +263,8 @@ eap::tls_conn_state& eap::tls_conn_state::operator=(_In_ const tls_conn_state &o
 eap::tls_conn_state& eap::tls_conn_state::operator=(_Inout_ tls_conn_state &&other)
 {
    if (this != std::addressof(other)) {
+        m_prov_name      = std::move(other.m_prov_name     );
+        m_prov_type      = std::move(other.m_prov_type     );
        m_alg_encrypt    = std::move(other.m_alg_encrypt   );
        m_size_enc_key   = std::move(other.m_size_enc_key  );
        m_size_enc_iv    = std::move(other.m_size_enc_iv   );
@@ -265,6 +277,8 @@ eap::tls_conn_state& eap::tls_conn_state::operator=(_Inout_ tls_conn_state &&oth

 #ifdef _DEBUG
        // Reinitialize other state primitive members for diagnostic purposes.
+        other.m_prov_name      = NULL;
+        other.m_prov_type      = 0;
        other.m_alg_encrypt    = 0;
        other.m_size_enc_key   = 0;
        other.m_size_enc_iv    = 0;
@@ -277,3 +291,142 @@ eap::tls_conn_state& eap::tls_conn_state::operator=(_Inout_ tls_conn_state &&oth

    return *this;
 }
+
+
+void eap::tls_conn_state::set_cipher(_In_ const unsigned char cipher[2])
+{
+    if (cipher[0] == 0x00 && cipher[1] == 0x0a) {
+        // TLS_RSA_WITH_3DES_EDE_CBC_SHA
+        m_prov_name      = NULL;
+        m_prov_type      = PROV_RSA_AES;
+        m_alg_encrypt    = CALG_3DES;
+        m_size_enc_key   = 192/8; // 3DES 192bits
+        m_size_enc_iv    = 64/8;  // 3DES 64bits
+        m_size_enc_block = 64/8;  // 3DES 64bits
+        m_alg_mac        = CALG_SHA1;
+        m_size_mac_key   = 160/8; // SHA-1
+        m_size_mac_hash  = 160/8; // SHA-1
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x2f) {
+        // TLS_RSA_WITH_AES_128_CBC_SHA
+        m_prov_name      = NULL;
+        m_prov_type      = PROV_RSA_AES;
+        m_alg_encrypt    = CALG_AES_128;
+        m_size_enc_key   = 128/8; // AES-128
+        m_size_enc_iv    = 128/8; // AES-128
+        m_size_enc_block = 128/8; // AES-128
+        m_alg_mac        = CALG_SHA1;
+        m_size_mac_key   = 160/8; // SHA-1
+        m_size_mac_hash  = 160/8; // SHA-1
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x3c) {
+        // AES128-SHA256
+        m_prov_name      = NULL;
+        m_prov_type      = PROV_RSA_AES;
+        m_alg_encrypt    = CALG_AES_128;
+        m_size_enc_key   = 128/8; // AES-128
+        m_size_enc_iv    = 128/8; // AES-128
+        m_size_enc_block = 128/8; // AES-128
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x3d) {
+        // AES256-SHA256
+        m_prov_name      = MS_ENH_RSA_AES_PROV;
+        m_prov_type      = PROV_RSA_AES;
+        m_alg_encrypt    = CALG_AES_256;
+        m_size_enc_key   = 256/8; // AES-256
+        m_size_enc_iv    = 128/8; // AES-256
+        m_size_enc_block = 128/8; // AES-256
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x40) {
+        // DHE-DSS-AES128-SHA256
+        m_prov_name      = MS_ENH_DSS_DH_PROV;
+        m_prov_type      = PROV_DSS_DH;
+        m_alg_encrypt    = CALG_AES_128;
+        m_size_enc_key   = 128/8; // AES-128
+        m_size_enc_iv    = 128/8; // AES-128
+        m_size_enc_block = 128/8; // AES-128
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x67) {
+        // DHE-RSA-AES128-SHA256
+        m_prov_name      = MS_DEF_DH_SCHANNEL_PROV;
+        m_prov_type      = PROV_DH_SCHANNEL;
+        m_alg_encrypt    = CALG_AES_128;
+        m_size_enc_key   = 128/8; // AES-128
+        m_size_enc_iv    = 128/8; // AES-128
+        m_size_enc_block = 128/8; // AES-128
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x6a) {
+        // DHE-DSS-AES256-SHA256
+        m_prov_name      = MS_ENH_DSS_DH_PROV;
+        m_prov_type      = PROV_DSS_DH;
+        m_alg_encrypt    = CALG_AES_256;
+        m_size_enc_key   = 256/8; // AES-256
+        m_size_enc_iv    = 128/8; // AES-256
+        m_size_enc_block = 128/8; // AES-256
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0x00 && cipher[1] == 0x6b) {
+        // DHE-RSA-AES256-SHA256
+        m_prov_name      = MS_DEF_DH_SCHANNEL_PROV;
+        m_prov_type      = PROV_DH_SCHANNEL;
+        m_alg_encrypt    = CALG_AES_256;
+        m_size_enc_key   = 256/8; // AES-256
+        m_size_enc_iv    = 128/8; // AES-256
+        m_size_enc_block = 128/8; // AES-256
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0xc0 && cipher[1] == 0x23) {
+        // ECDHE-ECDSA-AES128-SHA256
+        m_prov_name      = MS_ENH_DSS_DH_PROV;
+        m_prov_type      = PROV_DSS_DH;
+        m_alg_encrypt    = CALG_AES_128;
+        m_size_enc_key   = 128/8; // AES-128
+        m_size_enc_iv    = 128/8; // AES-128
+        m_size_enc_block = 128/8; // AES-128
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0xc0 && cipher[1] == 0x24) {
+        // ECDHE-ECDSA-AES256-SHA384
+        m_prov_name      = MS_ENH_DSS_DH_PROV;
+        m_prov_type      = PROV_DSS_DH;
+        m_alg_encrypt    = CALG_AES_256;
+        m_size_enc_key   = 256/8; // AES-256
+        m_size_enc_iv    = 128/8; // AES-256
+        m_size_enc_block = 128/8; // AES-256
+        m_alg_mac        = CALG_SHA_384;
+        m_size_mac_key   = 384/8; // SHA-384
+        m_size_mac_hash  = 384/8; // SHA-384
+    } else if (cipher[0] == 0xc0 && cipher[1] == 0x27) {
+        // ECDHE-RSA-AES128-SHA256
+        m_prov_name      = MS_ENH_DSS_DH_PROV;
+        m_prov_type      = PROV_DSS_DH;
+        m_alg_encrypt    = CALG_AES_128;
+        m_size_enc_key   = 128/8; // AES-128
+        m_size_enc_iv    = 128/8; // AES-128
+        m_size_enc_block = 128/8; // AES-128
+        m_alg_mac        = CALG_SHA_256;
+        m_size_mac_key   = 256/8; // SHA-256
+        m_size_mac_hash  = 256/8; // SHA-256
+    } else if (cipher[0] == 0xc0 && cipher[1] == 0x28) {
+        // ECDHE-RSA-AES256-SHA384
+        m_prov_name      = MS_ENH_DSS_DH_PROV;
+        m_prov_type      = PROV_DSS_DH;
+        m_alg_encrypt    = CALG_AES_256;
+        m_size_enc_key   = 256/8; // AES-256
+        m_size_enc_iv    = 128/8; // AES-256
+        m_size_enc_block = 128/8; // AES-256
+        m_alg_mac        = CALG_SHA_384;
+        m_size_mac_key   = 384/8; // SHA-384
+        m_size_mac_hash  = 384/8; // SHA-384
+    } else
+        throw win_runtime_error(ERROR_NOT_SUPPORTED, string_printf(__FUNCTION__ " Unknown cipher (received 0x%02x%02x).", cipher[0], cipher[1]));
+}
--- a/lib/TLS_UI/include/TLS_UI.h
+++ b/lib/TLS_UI/include/TLS_UI.h
@@ -119,7 +119,7 @@ public:
    ///
    /// Construct the validator with a value to store data
    ///
-    wxHostNameValidator(std::string *val = NULL);
+    wxHostNameValidator(std::wstring *val = NULL);

    ///
    /// Copy constructor
@@ -149,10 +149,10 @@ public:
    ///
    /// Parses FQDN value
    ///
-    static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::string *val_out = NULL);
+    static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out = NULL);

 protected:
-    std::string *m_val; ///< Pointer to variable to receive control's parsed value
+    std::wstring *m_val; ///< Pointer to variable to receive control's parsed value
 };


@@ -165,7 +165,7 @@ public:
    ///
    /// Construct the validator with a value to store data
    ///
-    wxFQDNValidator(std::string *val = NULL);
+    wxFQDNValidator(std::wstring *val = NULL);

    ///
    /// Copy constructor
@@ -195,10 +195,10 @@ public:
    ///
    /// Parses FQDN value
    ///
-    static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::string *val_out = NULL);
+    static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out = NULL);

 protected:
-    std::string *m_val; ///< Pointer to variable to receive control's parsed value
+    std::wstring *m_val; ///< Pointer to variable to receive control's parsed value
 };


@@ -211,7 +211,7 @@ public:
    ///
    /// Construct the validator with a value to store data
    ///
-    wxFQDNListValidator(std::list<std::string> *val = NULL);
+    wxFQDNListValidator(std::list<std::wstring> *val = NULL);

    ///
    /// Copy constructor
@@ -241,10 +241,10 @@ public:
    ///
    /// Parses FQDN list value
    ///
-    static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::list<std::string> *val_out = NULL);
+    static bool Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::list<std::wstring> *val_out = NULL);

 protected:
-    std::list<std::string> *m_val;  ///< Pointer to variable to receive control's parsed value
+    std::list<std::wstring> *m_val;  ///< Pointer to variable to receive control's parsed value
 };


@@ -311,7 +311,7 @@ protected:
    eap::config_method_tls &m_cfg;              ///< TLS configuration
    winstd::library m_certmgr;                  ///< certmgr.dll resource library reference
    wxIcon m_icon;                              ///< Panel icon
-    std::list<std::string> m_server_names_val;  ///< Acceptable authenticating server names
+    std::list<std::wstring> m_server_names_val; ///< Acceptable authenticating server names
 };


@@ -331,7 +331,9 @@ public:
 protected:
    /// \cond internal
    virtual void OnInitDialog(wxInitDialogEvent& event);
+#if EAP_TLS < EAP_TLS_SCHANNEL
    virtual bool TransferDataFromWindow();
+#endif
    /// \endcond

 protected:
--- a/lib/TLS_UI/res/wxTLS_UI.cpp
+++ b/lib/TLS_UI/res/wxTLS_UI.cpp
@@ -74,11 +74,11 @@ wxEAPTLSServerTrustConfigPanelBase::wxEAPTLSServerTrustConfigPanelBase( wxWindow
 	sb_server_names->Add( m_server_names_label, 0, wxBOTTOM, 5 );
 	
 	m_server_names = new wxTextCtrl( sb_server_trust->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
-	m_server_names->SetToolTip( _("A semicolon delimited list of acceptable server FQDN names; blank to skip name check; \"*\" wildchar allowed") );
+	m_server_names->SetToolTip( _("A semicolon delimited list of acceptable server FQDN names; blank to skip name check; Unicode characters allowed") );
 	
 	sb_server_names->Add( m_server_names, 0, wxEXPAND|wxBOTTOM, 5 );
 	
-	m_server_names_note = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("(Example: foo.bar.com;*.domain.org)"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_server_names_note = new wxStaticText( sb_server_trust->GetStaticBox(), wxID_ANY, _("(Example: foo.bar.com;server2.bar.com)"), wxDefaultPosition, wxDefaultSize, 0 );
 	m_server_names_note->Wrap( -1 );
 	sb_server_names->Add( m_server_names_note, 0, wxALIGN_RIGHT, 5 );
 	
@@ -161,6 +161,25 @@ wxTLSCredentialsPanelBase::wxTLSCredentialsPanelBase( wxWindow* parent, wxWindow
 	
 	sb_credentials_vert->Add( sb_cert_radio, 0, wxEXPAND|wxALL, 5 );
 	
+	wxBoxSizer* sb_identity;
+	sb_identity = new wxBoxSizer( wxVERTICAL );
+	
+	m_identity_label = new wxStaticText( sb_credentials->GetStaticBox(), wxID_ANY, _("Custom &identity:"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_identity_label->Wrap( -1 );
+	sb_identity->Add( m_identity_label, 0, wxBOTTOM, 5 );
+	
+	m_identity = new wxTextCtrl( sb_credentials->GetStaticBox(), wxID_ANY, wxEmptyString, wxDefaultPosition, wxDefaultSize, 0 );
+	m_identity->SetToolTip( _("Your identity (username@domain) to override one from certificate; or blank to use one provided in certificate") );
+	
+	sb_identity->Add( m_identity, 0, wxEXPAND|wxBOTTOM, 5 );
+	
+	m_identity_note = new wxStaticText( sb_credentials->GetStaticBox(), wxID_ANY, _("(Example: user@contoso.com)"), wxDefaultPosition, wxDefaultSize, 0 );
+	m_identity_note->Wrap( -1 );
+	sb_identity->Add( m_identity_note, 0, wxALIGN_RIGHT, 5 );
+	
+	
+	sb_credentials_vert->Add( sb_identity, 1, wxEXPAND|wxALL, 5 );
+	
 	m_remember = new wxCheckBox( sb_credentials->GetStaticBox(), wxID_ANY, _("&Remember"), wxDefaultPosition, wxDefaultSize, 0 );
 	m_remember->SetHelpText( _("Check if you would like to save certificate selection") );
 	
--- a/lib/TLS_UI/res/wxTLS_UI.fbp
+++ b/lib/TLS_UI/res/wxTLS_UI.fbp
@@ -870,7 +870,7 @@
                                                <property name="style"></property>
                                                <property name="subclass"></property>
                                                <property name="toolbar_pane">0</property>
-                                                <property name="tooltip">A semicolon delimited list of acceptable server FQDN names; blank to skip name check; &quot;*&quot; wildchar allowed</property>
+                                                <property name="tooltip">A semicolon delimited list of acceptable server FQDN names; blank to skip name check; Unicode characters allowed</property>
                                                <property name="validator_data_type"></property>
                                                <property name="validator_style">wxFILTER_NONE</property>
                                                <property name="validator_type">wxDefaultValidator</property>
@@ -940,7 +940,7 @@
                                                <property name="gripper">0</property>
                                                <property name="hidden">0</property>
                                                <property name="id">wxID_ANY</property>
-                                                <property name="label">(Example: foo.bar.com;*.domain.org)</property>
+                                                <property name="label">(Example: foo.bar.com;server2.bar.com)</property>
                                                <property name="max_size"></property>
                                                <property name="maximize_button">0</property>
                                                <property name="maximum_size"></property>
@@ -1527,6 +1527,274 @@
                                        </object>
                                    </object>
                                </object>
+                                <object class="sizeritem" expanded="1">
+                                    <property name="border">5</property>
+                                    <property name="flag">wxEXPAND|wxALL</property>
+                                    <property name="proportion">1</property>
+                                    <object class="wxBoxSizer" expanded="1">
+                                        <property name="minimum_size"></property>
+                                        <property name="name">sb_identity</property>
+                                        <property name="orient">wxVERTICAL</property>
+                                        <property name="permission">none</property>
+                                        <object class="sizeritem" expanded="1">
+                                            <property name="border">5</property>
+                                            <property name="flag">wxBOTTOM</property>
+                                            <property name="proportion">0</property>
+                                            <object class="wxStaticText" expanded="1">
+                                                <property name="BottomDockable">1</property>
+                                                <property name="LeftDockable">1</property>
+                                                <property name="RightDockable">1</property>
+                                                <property name="TopDockable">1</property>
+                                                <property name="aui_layer"></property>
+                                                <property name="aui_name"></property>
+                                                <property name="aui_position"></property>
+                                                <property name="aui_row"></property>
+                                                <property name="best_size"></property>
+                                                <property name="bg"></property>
+                                                <property name="caption"></property>
+                                                <property name="caption_visible">1</property>
+                                                <property name="center_pane">0</property>
+                                                <property name="close_button">1</property>
+                                                <property name="context_help"></property>
+                                                <property name="context_menu">1</property>
+                                                <property name="default_pane">0</property>
+                                                <property name="dock">Dock</property>
+                                                <property name="dock_fixed">0</property>
+                                                <property name="docking">Left</property>
+                                                <property name="enabled">1</property>
+                                                <property name="fg"></property>
+                                                <property name="floatable">1</property>
+                                                <property name="font"></property>
+                                                <property name="gripper">0</property>
+                                                <property name="hidden">0</property>
+                                                <property name="id">wxID_ANY</property>
+                                                <property name="label">Custom &amp;identity:</property>
+                                                <property name="max_size"></property>
+                                                <property name="maximize_button">0</property>
+                                                <property name="maximum_size"></property>
+                                                <property name="min_size"></property>
+                                                <property name="minimize_button">0</property>
+                                                <property name="minimum_size"></property>
+                                                <property name="moveable">1</property>
+                                                <property name="name">m_identity_label</property>
+                                                <property name="pane_border">1</property>
+                                                <property name="pane_position"></property>
+                                                <property name="pane_size"></property>
+                                                <property name="permission">protected</property>
+                                                <property name="pin_button">1</property>
+                                                <property name="pos"></property>
+                                                <property name="resize">Resizable</property>
+                                                <property name="show">1</property>
+                                                <property name="size"></property>
+                                                <property name="style"></property>
+                                                <property name="subclass"></property>
+                                                <property name="toolbar_pane">0</property>
+                                                <property name="tooltip"></property>
+                                                <property name="window_extra_style"></property>
+                                                <property name="window_name"></property>
+                                                <property name="window_style"></property>
+                                                <property name="wrap">-1</property>
+                                                <event name="OnChar"></event>
+                                                <event name="OnEnterWindow"></event>
+                                                <event name="OnEraseBackground"></event>
+                                                <event name="OnKeyDown"></event>
+                                                <event name="OnKeyUp"></event>
+                                                <event name="OnKillFocus"></event>
+                                                <event name="OnLeaveWindow"></event>
+                                                <event name="OnLeftDClick"></event>
+                                                <event name="OnLeftDown"></event>
+                                                <event name="OnLeftUp"></event>
+                                                <event name="OnMiddleDClick"></event>
+                                                <event name="OnMiddleDown"></event>
+                                                <event name="OnMiddleUp"></event>
+                                                <event name="OnMotion"></event>
+                                                <event name="OnMouseEvents"></event>
+                                                <event name="OnMouseWheel"></event>
+                                                <event name="OnPaint"></event>
+                                                <event name="OnRightDClick"></event>
+                                                <event name="OnRightDown"></event>
+                                                <event name="OnRightUp"></event>
+                                                <event name="OnSetFocus"></event>
+                                                <event name="OnSize"></event>
+                                                <event name="OnUpdateUI"></event>
+                                            </object>
+                                        </object>
+                                        <object class="sizeritem" expanded="1">
+                                            <property name="border">5</property>
+                                            <property name="flag">wxEXPAND|wxBOTTOM</property>
+                                            <property name="proportion">0</property>
+                                            <object class="wxTextCtrl" expanded="1">
+                                                <property name="BottomDockable">1</property>
+                                                <property name="LeftDockable">1</property>
+                                                <property name="RightDockable">1</property>
+                                                <property name="TopDockable">1</property>
+                                                <property name="aui_layer"></property>
+                                                <property name="aui_name"></property>
+                                                <property name="aui_position"></property>
+                                                <property name="aui_row"></property>
+                                                <property name="best_size"></property>
+                                                <property name="bg"></property>
+                                                <property name="caption"></property>
+                                                <property name="caption_visible">1</property>
+                                                <property name="center_pane">0</property>
+                                                <property name="close_button">1</property>
+                                                <property name="context_help"></property>
+                                                <property name="context_menu">1</property>
+                                                <property name="default_pane">0</property>
+                                                <property name="dock">Dock</property>
+                                                <property name="dock_fixed">0</property>
+                                                <property name="docking">Left</property>
+                                                <property name="enabled">1</property>
+                                                <property name="fg"></property>
+                                                <property name="floatable">1</property>
+                                                <property name="font"></property>
+                                                <property name="gripper">0</property>
+                                                <property name="hidden">0</property>
+                                                <property name="id">wxID_ANY</property>
+                                                <property name="max_size"></property>
+                                                <property name="maximize_button">0</property>
+                                                <property name="maximum_size"></property>
+                                                <property name="maxlength"></property>
+                                                <property name="min_size"></property>
+                                                <property name="minimize_button">0</property>
+                                                <property name="minimum_size"></property>
+                                                <property name="moveable">1</property>
+                                                <property name="name">m_identity</property>
+                                                <property name="pane_border">1</property>
+                                                <property name="pane_position"></property>
+                                                <property name="pane_size"></property>
+                                                <property name="permission">protected</property>
+                                                <property name="pin_button">1</property>
+                                                <property name="pos"></property>
+                                                <property name="resize">Resizable</property>
+                                                <property name="show">1</property>
+                                                <property name="size"></property>
+                                                <property name="style"></property>
+                                                <property name="subclass"></property>
+                                                <property name="toolbar_pane">0</property>
+                                                <property name="tooltip">Your identity (username@domain) to override one from certificate; or blank to use one provided in certificate</property>
+                                                <property name="validator_data_type"></property>
+                                                <property name="validator_style">wxFILTER_NONE</property>
+                                                <property name="validator_type">wxDefaultValidator</property>
+                                                <property name="validator_variable"></property>
+                                                <property name="value"></property>
+                                                <property name="window_extra_style"></property>
+                                                <property name="window_name"></property>
+                                                <property name="window_style"></property>
+                                                <event name="OnChar"></event>
+                                                <event name="OnEnterWindow"></event>
+                                                <event name="OnEraseBackground"></event>
+                                                <event name="OnKeyDown"></event>
+                                                <event name="OnKeyUp"></event>
+                                                <event name="OnKillFocus"></event>
+                                                <event name="OnLeaveWindow"></event>
+                                                <event name="OnLeftDClick"></event>
+                                                <event name="OnLeftDown"></event>
+                                                <event name="OnLeftUp"></event>
+                                                <event name="OnMiddleDClick"></event>
+                                                <event name="OnMiddleDown"></event>
+                                                <event name="OnMiddleUp"></event>
+                                                <event name="OnMotion"></event>
+                                                <event name="OnMouseEvents"></event>
+                                                <event name="OnMouseWheel"></event>
+                                                <event name="OnPaint"></event>
+                                                <event name="OnRightDClick"></event>
+                                                <event name="OnRightDown"></event>
+                                                <event name="OnRightUp"></event>
+                                                <event name="OnSetFocus"></event>
+                                                <event name="OnSize"></event>
+                                                <event name="OnText"></event>
+                                                <event name="OnTextEnter"></event>
+                                                <event name="OnTextMaxLen"></event>
+                                                <event name="OnTextURL"></event>
+                                                <event name="OnUpdateUI"></event>
+                                            </object>
+                                        </object>
+                                        <object class="sizeritem" expanded="1">
+                                            <property name="border">5</property>
+                                            <property name="flag">wxALIGN_RIGHT</property>
+                                            <property name="proportion">0</property>
+                                            <object class="wxStaticText" expanded="1">
+                                                <property name="BottomDockable">1</property>
+                                                <property name="LeftDockable">1</property>
+                                                <property name="RightDockable">1</property>
+                                                <property name="TopDockable">1</property>
+                                                <property name="aui_layer"></property>
+                                                <property name="aui_name"></property>
+                                                <property name="aui_position"></property>
+                                                <property name="aui_row"></property>
+                                                <property name="best_size"></property>
+                                                <property name="bg"></property>
+                                                <property name="caption"></property>
+                                                <property name="caption_visible">1</property>
+                                                <property name="center_pane">0</property>
+                                                <property name="close_button">1</property>
+                                                <property name="context_help"></property>
+                                                <property name="context_menu">1</property>
+                                                <property name="default_pane">0</property>
+                                                <property name="dock">Dock</property>
+                                                <property name="dock_fixed">0</property>
+                                                <property name="docking">Left</property>
+                                                <property name="enabled">1</property>
+                                                <property name="fg"></property>
+                                                <property name="floatable">1</property>
+                                                <property name="font"></property>
+                                                <property name="gripper">0</property>
+                                                <property name="hidden">0</property>
+                                                <property name="id">wxID_ANY</property>
+                                                <property name="label">(Example: user@contoso.com)</property>
+                                                <property name="max_size"></property>
+                                                <property name="maximize_button">0</property>
+                                                <property name="maximum_size"></property>
+                                                <property name="min_size"></property>
+                                                <property name="minimize_button">0</property>
+                                                <property name="minimum_size"></property>
+                                                <property name="moveable">1</property>
+                                                <property name="name">m_identity_note</property>
+                                                <property name="pane_border">1</property>
+                                                <property name="pane_position"></property>
+                                                <property name="pane_size"></property>
+                                                <property name="permission">protected</property>
+                                                <property name="pin_button">1</property>
+                                                <property name="pos"></property>
+                                                <property name="resize">Resizable</property>
+                                                <property name="show">1</property>
+                                                <property name="size"></property>
+                                                <property name="style"></property>
+                                                <property name="subclass"></property>
+                                                <property name="toolbar_pane">0</property>
+                                                <property name="tooltip"></property>
+                                                <property name="window_extra_style"></property>
+                                                <property name="window_name"></property>
+                                                <property name="window_style"></property>
+                                                <property name="wrap">-1</property>
+                                                <event name="OnChar"></event>
+                                                <event name="OnEnterWindow"></event>
+                                                <event name="OnEraseBackground"></event>
+                                                <event name="OnKeyDown"></event>
+                                                <event name="OnKeyUp"></event>
+                                                <event name="OnKillFocus"></event>
+                                                <event name="OnLeaveWindow"></event>
+                                                <event name="OnLeftDClick"></event>
+                                                <event name="OnLeftDown"></event>
+                                                <event name="OnLeftUp"></event>
+                                                <event name="OnMiddleDClick"></event>
+                                                <event name="OnMiddleDown"></event>
+                                                <event name="OnMiddleUp"></event>
+                                                <event name="OnMotion"></event>
+                                                <event name="OnMouseEvents"></event>
+                                                <event name="OnMouseWheel"></event>
+                                                <event name="OnPaint"></event>
+                                                <event name="OnRightDClick"></event>
+                                                <event name="OnRightDown"></event>
+                                                <event name="OnRightUp"></event>
+                                                <event name="OnSetFocus"></event>
+                                                <event name="OnSize"></event>
+                                                <event name="OnUpdateUI"></event>
+                                            </object>
+                                        </object>
+                                    </object>
+                                </object>
                                <object class="sizeritem" expanded="1">
                                    <property name="border">5</property>
                                    <property name="flag">wxALL|wxEXPAND</property>
--- a/lib/TLS_UI/res/wxTLS_UI.h
+++ b/lib/TLS_UI/res/wxTLS_UI.h
@@ -80,6 +80,9 @@ class wxTLSCredentialsPanelBase : public wxPanel
 		wxRadioButton* m_cert_none;
 		wxRadioButton* m_cert_select;
 		wxChoice* m_cert_select_val;
+		wxStaticText* m_identity_label;
+		wxTextCtrl* m_identity;
+		wxStaticText* m_identity_note;
 		wxCheckBox* m_remember;
 	
 	public:
--- a/lib/TLS_UI/src/TLS_UI.cpp
+++ b/lib/TLS_UI/src/TLS_UI.cpp
@@ -46,7 +46,7 @@ wxCertificateClientData::~wxCertificateClientData()
 wxIMPLEMENT_DYNAMIC_CLASS(wxHostNameValidator, wxValidator);


-wxHostNameValidator::wxHostNameValidator(std::string *val) :
+wxHostNameValidator::wxHostNameValidator(std::wstring *val) :
    m_val(val),
    wxValidator()
 {
@@ -98,7 +98,7 @@ bool wxHostNameValidator::TransferFromWindow()
 }


-bool wxHostNameValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::string *val_out)
+bool wxHostNameValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out)
 {
    const wxStringCharType *buf = val_in;

@@ -108,7 +108,7 @@ bool wxHostNameValidator::Parse(const wxString &val_in, size_t i_start, size_t i
            // End of host name found.
            if (val_out) val_out->assign(val_in.c_str() + i_start, i - i_start);
            return true;
-        } else if (_tcschr(wxT("abcdefghijklmnopqrstuvwxyz0123456789-*"), buf[i])) {
+        } else if (buf[i] == _T('-') || buf[i] == _T('_') || _istalnum(buf[i])) {
            // Valid character found.
            i++;
        } else {
@@ -129,7 +129,7 @@ bool wxHostNameValidator::Parse(const wxString &val_in, size_t i_start, size_t i
 wxIMPLEMENT_DYNAMIC_CLASS(wxFQDNValidator, wxValidator);


-wxFQDNValidator::wxFQDNValidator(std::string *val) :
+wxFQDNValidator::wxFQDNValidator(std::wstring *val) :
    m_val(val),
    wxValidator()
 {
@@ -181,7 +181,7 @@ bool wxFQDNValidator::TransferFromWindow()
 }


-bool wxFQDNValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::string *val_out)
+bool wxFQDNValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::wstring *val_out)
 {
    const wxStringCharType *buf = val_in;

@@ -210,7 +210,7 @@ bool wxFQDNValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end
 wxIMPLEMENT_DYNAMIC_CLASS(wxFQDNListValidator, wxValidator);


-wxFQDNListValidator::wxFQDNListValidator(std::list<std::string> *val) :
+wxFQDNListValidator::wxFQDNListValidator(std::list<std::wstring> *val) :
    m_val(val),
    wxValidator()
 {
@@ -246,7 +246,7 @@ bool wxFQDNListValidator::TransferToWindow()

    if (m_val) {
        wxString str;
-        for (std::list<std::string>::const_iterator name = m_val->cbegin(), name_end = m_val->cend(); name != name_end; ++name) {
+        for (std::list<std::wstring>::const_iterator name = m_val->cbegin(), name_end = m_val->cend(); name != name_end; ++name) {
            if (!str.IsEmpty()) str += wxT("; ");
            str += *name;
        }
@@ -267,11 +267,11 @@ bool wxFQDNListValidator::TransferFromWindow()
 }


-bool wxFQDNListValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::list<std::string> *val_out)
+bool wxFQDNListValidator::Parse(const wxString &val_in, size_t i_start, size_t i_end, wxTextCtrl *ctrl, wxWindow *parent, std::list<std::wstring> *val_out)
 {
    const wxStringCharType *buf = val_in;
-    std::string _fqdn, *fqdn = val_out ? &_fqdn : NULL;
-    std::list<std::string> _val_out;
+    std::wstring _fqdn, *fqdn = val_out ? &_fqdn : NULL;
+    std::list<std::wstring> _val_out;

    size_t i = i_start;
    for (;;) {
@@ -358,6 +358,8 @@ bool wxTLSCredentialsPanel::TransferDataToWindow()
            m_cert_select_val->SetSelection(0);
    }

+    m_identity->SetValue(m_cred.m_identity);
+
    return wxEAPCredentialsPanelBase<eap::credentials_tls, wxTLSCredentialsPanelBase>::TransferDataToWindow();
 }

@@ -374,6 +376,8 @@ bool wxTLSCredentialsPanel::TransferDataFromWindow()
            m_cred.m_cert.free();
    }

+    m_cred.m_identity = m_identity->GetValue();
+
    // Inherited TransferDataFromWindow() calls m_cred.store().
    // Therefore, call it only now, that m_cred is set.
    return wxEAPCredentialsPanelBase<eap::credentials_tls, wxTLSCredentialsPanelBase>::TransferDataFromWindow();
@@ -393,9 +397,11 @@ void wxTLSCredentialsPanel::OnUpdateUI(wxUpdateUIEvent& event)
            m_cert_select->Enable(false);
        }
        m_cert_select_val->Enable(false);
+        m_identity->Enable(false);
    } else {
        // Configuration mode or using own credentials. Selectively enable/disable controls.
        m_cert_select_val->Enable(m_cert_select->GetValue());
+        m_identity->Enable(true);
    }

    wxEAPCredentialsPanelBase<eap::credentials_tls, wxTLSCredentialsPanelBase>::OnUpdateUI(event);
@@ -423,14 +429,6 @@ wxTLSServerTrustPanel::wxTLSServerTrustPanel(const eap::config_provider &prov, e

 bool wxTLSServerTrustPanel::TransferDataToWindow()
 {
-    if (m_prov.m_read_only) {
-        // This is provider-locked configuration. Disable controls.
-        m_root_ca_add_store->Enable(false);
-        m_root_ca_add_file ->Enable(false);
-        m_root_ca_remove   ->Enable(false);
-        m_server_names     ->Enable(false);
-    }
-
    // Populate trusted CA list.
    for (std::list<winstd::cert_context>::const_iterator cert = m_cfg.m_trusted_root_ca.cbegin(), cert_end = m_cfg.m_trusted_root_ca.cend(); cert != cert_end; ++cert)
        m_root_ca->Append(wxString(eap::get_cert_title(*cert)), new wxCertificateClientData(cert->duplicate()));
@@ -469,10 +467,19 @@ void wxTLSServerTrustPanel::OnUpdateUI(wxUpdateUIEvent& event)
 {
    UNREFERENCED_PARAMETER(event);

-    if (!m_prov.m_read_only) {
+    if (m_prov.m_read_only) {
+        // This is provider-locked configuration. Disable controls.
+        m_root_ca_add_store->Enable(false);
+        m_root_ca_add_file ->Enable(false);
+        m_root_ca_remove   ->Enable(false);
+        m_server_names     ->Enable(false);
+    } else {
        // This is not a provider-locked configuration. Selectively enable/disable controls.
+        m_root_ca_add_store->Enable(true);
+        m_root_ca_add_file ->Enable(true);
        wxArrayInt selections;
        m_root_ca_remove->Enable(m_root_ca->GetSelections(selections) ? true : false);
+        m_server_names     ->Enable(true);
    }
 }

@@ -604,6 +611,8 @@ void wxTLSConfigPanel::OnInitDialog(wxInitDialogEvent& event)
 }


+#if EAP_TLS < EAP_TLS_SCHANNEL
+
 bool wxTLSConfigPanel::TransferDataFromWindow()
 {
    wxCHECK(wxPanel::TransferDataFromWindow(), false);
@@ -619,4 +628,4 @@ bool wxTLSConfigPanel::TransferDataFromWindow()
    return true;
 }

-
+#endif
--- a/lib/TTLS/include/Method.h
+++ b/lib/TTLS/include/Method.h
@@ -58,10 +58,10 @@ namespace eap
        /// Constructs an EAP method
        ///
        /// \param[in] mod   EAP module to use for global services
-        /// \param[in] cfg   Providers configuration
+        /// \param[in] cfg   Connection configuration
        /// \param[in] cred  User credentials
        ///
-        method_ttls(_In_ module &module, _In_ config_provider_list &cfg, _In_ credentials_ttls &cred);
+        method_ttls(_In_ module &module, _In_ config_connection &cfg, _In_ credentials_ttls &cred);

        ///
        /// Moves an EAP method
@@ -112,6 +112,9 @@ namespace eap

        /// @}

+    protected:
+#if EAP_TLS < EAP_TLS_SCHANNEL
+
        ///
        /// Generates master session key
        ///
@@ -119,7 +122,18 @@ namespace eap
        ///
        virtual void derive_msk();

-    protected:
+#else
+
+        ///
+        /// Processes an application message
+        ///
+        /// \param[in] msg       Application message data
+        /// \param[in] size_msg  Application message data size
+        ///
+        virtual void process_application_data(_In_bytecount_(size_msg) const void *msg, _In_ size_t size_msg);
+
+#endif
+
        ///
        /// Makes a PAP client message
        ///
--- a/lib/TTLS/include/Module.h
+++ b/lib/TTLS/include/Module.h
@@ -221,7 +221,7 @@ namespace eap
            {}

        public:
-            config_provider_list m_cfg; ///< Providers configuration
+            config_connection m_cfg;    ///< Connection configuration
            credentials_ttls m_cred;    ///< User credentials
            method_ttls m_method;       ///< EAP-TTLS method
        };
--- a/lib/TTLS/src/Credentials.cpp
+++ b/lib/TTLS/src/Credentials.cpp
@@ -189,6 +189,8 @@ void eap::credentials_ttls::operator>>(_Inout_ cursor_in &cursor)

 void eap::credentials_ttls::store(_In_z_ LPCTSTR pszTargetName) const
 {
+    assert(0); // Not that we would ever store inner&outer credentials to Windows Credential Manager joined, but for completness sake... Here we go:
+
    credentials_tls::store(pszTargetName);

    if (m_inner)
@@ -198,6 +200,8 @@ void eap::credentials_ttls::store(_In_z_ LPCTSTR pszTargetName) const

 void eap::credentials_ttls::retrieve(_In_z_ LPCTSTR pszTargetName)
 {
+    assert(0); // Not that we would ever retrieve inner&outer credentials to Windows Credential Manager joined, but for completness sake... Here we go:
+
    credentials_tls::retrieve(pszTargetName);

    if (m_inner)
--- a/lib/TTLS/src/Method.cpp
+++ b/lib/TTLS/src/Method.cpp
@@ -28,7 +28,7 @@ using namespace winstd;
 // eap::method_ttls
 //////////////////////////////////////////////////////////////////////

-eap::method_ttls::method_ttls(_In_ module &module, _In_ config_provider_list &cfg, _In_ credentials_ttls &cred) :
+eap::method_ttls::method_ttls(_In_ module &module, _In_ config_connection &cfg, _In_ credentials_ttls &cred) :
    m_cred(cred),
    m_version(version_0),
    method_tls(module, cfg, cred)
@@ -72,6 +72,7 @@ void eap::method_ttls::process_request_packet(
    // Do the TLS.
    method_tls::process_request_packet(pReceivedPacket, dwReceivedPacketSize, pEapOutput);

+#if EAP_TLS < EAP_TLS_SCHANNEL
    if (m_phase == phase_application_data) {
        // Send inner authentication.
        if (!m_state_client.m_alg_encrypt)
@@ -84,10 +85,8 @@ void eap::method_ttls::process_request_packet(
        m_packet_res.m_flags = 0;
        sanitizing_blob msg_application(make_message(tls_message_type_application_data, make_pap_client()));
        m_packet_res.m_data.insert(m_packet_res.m_data.end(), msg_application.begin(), msg_application.end());
-
-        pEapOutput->fAllowNotifications = FALSE;
-        pEapOutput->action = EapPeerMethodResponseActionSend;
    }
+#endif
 }


@@ -133,6 +132,15 @@ void eap::method_ttls::get_result(
            throw win_runtime_error(ERROR_NOT_SUPPORTED, __FUNCTION__ " Not supported.");
        }

+#if EAP_TLS >= EAP_TLS_SCHANNEL
+        // EAP-TTLS uses different label in PRF for MSK derivation than EAP-TLS.
+        static const DWORD s_key_id = 0x01; // EAP-TTLSv0 Keying Material
+        static const SecPkgContext_EapPrfInfo s_prf_info = { 0, sizeof(s_key_id), (PBYTE)&s_key_id };
+        SECURITY_STATUS status = SetContextAttributes(m_sc_ctx, SECPKG_ATTR_EAP_PRF_INFO, (void*)&s_prf_info, sizeof(s_prf_info));
+        if (FAILED(status))
+            throw sec_runtime_error(status, __FUNCTION__ "Error setting EAP-TTLS PRF in Schannel.");
+#endif
+
        // The TLS was OK.
        method_tls::get_result(EapPeerMethodResultSuccess, ppResult);

@@ -146,6 +154,8 @@ void eap::method_ttls::get_result(
 }


+#if EAP_TLS < EAP_TLS_SCHANNEL
+
 void eap::method_ttls::derive_msk()
 {
    //
@@ -179,6 +189,57 @@ void eap::method_ttls::derive_msk()
    _key_block += sizeof(tls_random);
 }

+#else
+
+void eap::method_ttls::process_application_data(_In_bytecount_(size_msg) const void *msg, _In_ size_t size_msg)
+{
+    UNREFERENCED_PARAMETER(msg);
+    UNREFERENCED_PARAMETER(size_msg);
+
+    // Prepare inner authentication.
+    if (!(m_sc_ctx.m_attrib & ISC_RET_CONFIDENTIALITY))
+        throw runtime_error(__FUNCTION__ " Refusing to send credentials unencrypted.");
+
+    m_module.log_event(&EAPMETHOD_TTLS_INNER_CRED, event_data((unsigned int)eap_type_ttls), event_data(m_cred.m_inner->get_name()), event_data::blank);
+
+    SECURITY_STATUS status;
+
+    // Get maximum message sizes.
+    SecPkgContext_StreamSizes sizes;
+    status = QueryContextAttributes(m_sc_ctx, SECPKG_ATTR_STREAM_SIZES, &sizes);
+    if (FAILED(status))
+        throw sec_runtime_error(status, __FUNCTION__ " Error getting Schannel required encryption sizes.");
+
+    // Make PAP message.
+    sanitizing_blob msg_pap(make_pap_client());
+    assert(msg_pap.size() < sizes.cbMaximumMessage);
+    unsigned long size_data = std::min<unsigned long>(sizes.cbMaximumMessage, (unsigned long)msg_pap.size()); // Truncate
+
+    sanitizing_blob data(sizes.cbHeader + size_data + sizes.cbTrailer, 0);
+    memcpy(data.data() + sizes.cbHeader, msg_pap.data(), size_data);
+
+    // Prepare input/output buffer(s).
+    SecBuffer buf[] = {
+        {  sizes.cbHeader, SECBUFFER_STREAM_HEADER , data.data()                              },
+        {       size_data, SECBUFFER_DATA          , data.data() + sizes.cbHeader             },
+        { sizes.cbTrailer, SECBUFFER_STREAM_TRAILER, data.data() + sizes.cbHeader + size_data },
+        {               0, SECBUFFER_EMPTY         , NULL                                     },
+    };
+    SecBufferDesc buf_desc = {
+        SECBUFFER_VERSION,
+        _countof(buf),
+        buf
+    };
+
+    // Encrypt the message.
+    status = EncryptMessage(m_sc_ctx, 0, &buf_desc, 0);
+    if (FAILED(status))
+        throw sec_runtime_error(status, __FUNCTION__ " Error encrypting message.");
+    m_packet_res.m_data.insert(m_packet_res.m_data.end(), (const unsigned char*)buf[0].pvBuffer, (const unsigned char*)buf[0].pvBuffer + buf[0].cbBuffer + buf[1].cbBuffer + buf[2].cbBuffer);
+}
+
+#endif
+

 eap::sanitizing_blob eap::method_ttls::make_pap_client() const
 {
--- a/lib/TTLS/src/Module.cpp
+++ b/lib/TTLS/src/Module.cpp
@@ -74,7 +74,7 @@ void eap::peer_ttls::get_identity(
    assert(ppwszIdentity);

    // Unpack configuration.
-    config_provider_list cfg(*this);
+    config_connection cfg(*this);
    unpack(cfg, pConnectionData, dwConnectionDataSize);
    if (cfg.m_providers.empty() || cfg.m_providers.front().m_methods.empty())
        throw invalid_argument(__FUNCTION__ " Configuration has no providers and/or methods.");
--- a/lib/TTLS/src/StdAfx.h
+++ b/lib/TTLS/src/StdAfx.h
@@ -30,3 +30,4 @@
 #include <WinStd/EAP.h>

 #include <EapHostError.h>
+#include <schannel.h>
--- a/lib/TTLS_UI/include/TTLS_UI.h
+++ b/lib/TTLS_UI/include/TTLS_UI.h
@@ -45,7 +45,6 @@ class wxTTLSCredentialsPanel;

 #include <wx/choicebk.h>
 #include <wx/icon.h>
-#include <wx/scrolwin.h>
 #include <wx/stattext.h>

 #include <Windows.h>
@@ -74,32 +73,28 @@ protected:
 };


-class wxTTLSConfigWindow : public wxScrolledWindow
+class wxTTLSConfigWindow : public wxEAPConfigWindow
 {
 public:
    ///
    /// Constructs a configuration panel
    ///
+    /// \param[in]    prov           Provider configuration data
    /// \param[inout] cfg            Configuration data
    /// \param[in]    pszCredTarget  Target name of credentials in Windows Credential Manager. Can be further decorated to create final target name.
    /// \param[in]    parent         Parent window
    ///
    wxTTLSConfigWindow(const eap::config_provider &prov, eap::config_method &cfg, LPCTSTR pszCredTarget, wxWindow* parent);

-    ///
-    /// Destructs the configuration panel
-    ///
-    virtual ~wxTTLSConfigWindow();
-
 protected:
    /// \cond internal
    virtual bool TransferDataToWindow();
    virtual bool TransferDataFromWindow();
    virtual void OnInitDialog(wxInitDialogEvent& event);
+    virtual void OnUpdateUI(wxUpdateUIEvent& event);
    /// \endcond

 protected:
-    const eap::config_provider &m_prov;     ///< EAP provider
    eap::config_method_ttls &m_cfg;         ///< TTLS configuration
    wxStaticText *m_outer_title;            ///< Outer authentication title
    wxTTLSConfigPanel *m_outer_identity;    ///< Outer identity configuration panel
--- a/lib/TTLS_UI/res/wxTTLS_UI.cpp
+++ b/lib/TTLS_UI/res/wxTTLS_UI.cpp
@@ -32,7 +32,7 @@ wxTTLSConfigPanelBase::wxTTLSConfigPanelBase( wxWindow* parent, wxWindowID id, c
 	wxBoxSizer* sb_outer_identity_radio;
 	sb_outer_identity_radio = new wxBoxSizer( wxVERTICAL );
 	
-	m_outer_identity_same = new wxRadioButton( sb_outer_identity->GetStaticBox(), wxID_ANY, _("&Same as inner identity"), wxDefaultPosition, wxDefaultSize, wxRB_GROUP );
+	m_outer_identity_same = new wxRadioButton( sb_outer_identity->GetStaticBox(), wxID_ANY, _("&True identity"), wxDefaultPosition, wxDefaultSize, wxRB_GROUP );
 	m_outer_identity_same->SetToolTip( _("Use my true user name") );
 	
 	sb_outer_identity_radio->Add( m_outer_identity_same, 1, wxEXPAND, 5 );
--- a/lib/TTLS_UI/res/wxTTLS_UI.fbp
+++ b/lib/TTLS_UI/res/wxTTLS_UI.fbp
@@ -309,7 +309,7 @@
                                                <property name="gripper">0</property>
                                                <property name="hidden">0</property>
                                                <property name="id">wxID_ANY</property>
-                                                <property name="label">&amp;Same as inner identity</property>
+                                                <property name="label">&amp;True identity</property>
                                                <property name="max_size"></property>
                                                <property name="maximize_button">0</property>
                                                <property name="maximum_size"></property>
--- a/lib/TTLS_UI/src/Module.cpp
+++ b/lib/TTLS_UI/src/Module.cpp
@@ -48,7 +48,7 @@ void eap::peer_ttls_ui::config_xml2blob(
    UNREFERENCED_PARAMETER(dwFlags);

    // Load configuration from XML.
-    config_provider_list cfg(*this);
+    config_connection cfg(*this);
    cfg.load(pConfigRoot);

    // Pack configuration.
@@ -66,7 +66,7 @@ void eap::peer_ttls_ui::config_blob2xml(
    UNREFERENCED_PARAMETER(dwFlags);

    // Unpack configuration.
-    config_provider_list cfg(*this);
+    config_connection cfg(*this);
    unpack(cfg, pConnectionData, dwConnectionDataSize);

    // Save configuration to XML.
@@ -82,9 +82,28 @@ void eap::peer_ttls_ui::invoke_config_ui(
    _Inout_                                  DWORD *pdwConnectionDataOutSize)
 {
    // Unpack configuration.
-    config_provider_list cfg(*this);
-    if (dwConnectionDataInSize)
+    config_connection cfg(*this);
+    if (dwConnectionDataInSize) {
+        // Load existing configuration.
        unpack(cfg, pConnectionDataIn, dwConnectionDataInSize);
+    } else {
+        // This is a blank network profile. Create default configuraton.
+        CoCreateGuid(&(cfg.m_connection_id));
+
+        // Start with PAP inner configuration.
+        unique_ptr<config_method_ttls> cfg_method(new config_method_ttls(*this));
+        cfg_method->m_inner.reset(new config_method_pap(*this));
+        cfg_method->m_anonymous_identity = L"@";
+        cfg_method->m_use_preshared = true;
+        cfg_method->m_preshared.reset(new credentials_tls(*this));
+
+        // Start with one method.
+        config_provider cfg_provider(*this);
+        cfg_provider.m_methods.push_back(std::move(cfg_method));
+
+        // Start with one provider.
+        cfg.m_providers.push_back(std::move(cfg_provider));
+    }

    // Initialize application.
    new wxApp();
@@ -94,7 +113,7 @@ void eap::peer_ttls_ui::invoke_config_ui(
    {
        // Create wxWidget-approved parent window.
        wxWindow parent;
-        parent.SetHWND((WXHWND)hwndParent);
+        parent.SetHWND((WXHWND)(hwndParent ? hwndParent : GetForegroundWindow()));
        parent.AdoptAttributesFromHWND();
        wxTopLevelWindows.Append(&parent);

@@ -130,7 +149,7 @@ void eap::peer_ttls_ui::invoke_identity_ui(
    assert(ppwszIdentity);

    // Unpack configuration.
-    config_provider_list cfg(*this);
+    config_connection cfg(*this);
    unpack(cfg, pConnectionData, dwConnectionDataSize);
    if (cfg.m_providers.empty() || cfg.m_providers.front().m_methods.empty())
        throw invalid_argument(__FUNCTION__ " Configuration has no providers and/or methods.");
@@ -186,14 +205,14 @@ void eap::peer_ttls_ui::invoke_identity_ui(
    {
        // Create wxWidget-approved parent window.
        wxWindow parent;
-        parent.SetHWND((WXHWND)hwndParent);
+        parent.SetHWND((WXHWND)(hwndParent ? hwndParent : GetForegroundWindow()));
        parent.AdoptAttributesFromHWND();
        wxTopLevelWindows.Append(&parent);

        // Create credentials dialog.
        wxEAPCredentialsDialog dlg(cfg_prov, &parent);
        wxTTLSCredentialsPanel *panel = new wxTTLSCredentialsPanel(cfg_prov, *cfg_method, cred_out, cfg_prov.m_id.c_str(), &dlg);
-        dlg.AddContents((wxPanel**)&panel, 1);
+        dlg.AddContent(panel);

        // Set "Remember" checkboxes according to credential source,
        panel->m_outer_cred->SetRememberValue(cred_source.first == eap::credentials::source_storage);
--- a/lib/TTLS_UI/src/TTLS_UI.cpp
+++ b/lib/TTLS_UI/src/TTLS_UI.cpp
@@ -38,14 +38,6 @@ wxTTLSConfigPanel::wxTTLSConfigPanel(const eap::config_provider &prov, eap::conf

 bool wxTTLSConfigPanel::TransferDataToWindow()
 {
-    if (m_prov.m_read_only) {
-        // This is provider-locked configuration. Disable controls.
-        m_outer_identity_same      ->Enable(false);
-        m_outer_identity_empty     ->Enable(false);
-        m_outer_identity_custom    ->Enable(false);
-        m_outer_identity_custom_val->Enable(false);
-    }
-
    // Populate identity controls.
    if (m_cfg.m_anonymous_identity.empty()) {
        m_outer_identity_same->SetValue(true);
@@ -82,8 +74,17 @@ void wxTTLSConfigPanel::OnUpdateUI(wxUpdateUIEvent& event)
 {
    UNREFERENCED_PARAMETER(event);

-    if (!m_prov.m_read_only) {
+    if (m_prov.m_read_only) {
+        // This is provider-locked configuration. Disable controls.
+        m_outer_identity_same      ->Enable(false);
+        m_outer_identity_empty     ->Enable(false);
+        m_outer_identity_custom    ->Enable(false);
+        m_outer_identity_custom_val->Enable(false);
+    } else {
        // This is not a provider-locked configuration. Selectively enable/disable controls.
+        m_outer_identity_same      ->Enable(true);
+        m_outer_identity_empty     ->Enable(true);
+        m_outer_identity_custom    ->Enable(true);
        m_outer_identity_custom_val->Enable(m_outer_identity_custom->GetValue());
    }
 }
@@ -94,10 +95,9 @@ void wxTTLSConfigPanel::OnUpdateUI(wxUpdateUIEvent& event)
 //////////////////////////////////////////////////////////////////////

 wxTTLSConfigWindow::wxTTLSConfigWindow(const eap::config_provider &prov, eap::config_method &cfg, LPCTSTR pszCredTarget, wxWindow* parent) :
-    m_prov(prov),
    m_cfg((eap::config_method_ttls&)cfg),
    m_cfg_pap(cfg.m_module),
-    wxScrolledWindow(parent, wxID_ANY, wxDefaultPosition, wxDefaultSize, wxVSCROLL)
+    wxEAPConfigWindow(prov, cfg, parent)
 {
    wxBoxSizer* sb_content;
    sb_content = new wxBoxSizer( wxVERTICAL );
@@ -112,7 +112,8 @@ wxTTLSConfigWindow::wxTTLSConfigWindow(const eap::config_provider &prov, eap::co

    m_inner_type = new wxChoicebook(this, wxID_ANY, wxDefaultPosition, wxDefaultSize, wxCHB_DEFAULT);
    m_inner_type->SetToolTip( _("Select inner authentication method from the list") );
-    m_inner_type->AddPage(new wxPAPConfigPanel(m_prov, m_cfg_pap, pszCredTarget, m_inner_type), _("PAP"));
+    wxPAPConfigPanel *panel_pap = new wxPAPConfigPanel(m_prov, m_cfg_pap, pszCredTarget, m_inner_type);
+    m_inner_type->AddPage(panel_pap, _("PAP"));
    sb_content->Add(m_inner_type, 0, wxALL|wxEXPAND, 5);

    sb_content->Add(20, 20, 1, wxALL|wxEXPAND, 5);
@@ -135,32 +136,17 @@ wxTTLSConfigWindow::wxTTLSConfigWindow(const eap::config_provider &prov, eap::co
        size.y  = 500;
    }
    this->SetMinSize(size);
-    this->SetScrollRate(5, 5);

    this->SetSizer(sb_content);
    this->Layout();

-    m_inner_type->SetFocusFromKbd();
-
-    // Connect Events
-    this->Connect(wxEVT_INIT_DIALOG, wxInitDialogEventHandler(wxTTLSConfigWindow::OnInitDialog));
-}
-
-
-wxTTLSConfigWindow::~wxTTLSConfigWindow()
-{
-    // Disconnect Events
-    this->Disconnect(wxEVT_INIT_DIALOG, wxInitDialogEventHandler(wxTTLSConfigWindow::OnInitDialog));
+    // m_inner_type->SetFocusFromKbd(); // This control steals mouse-wheel scrolling for itself
+    panel_pap->SetFocusFromKbd();
 }


 bool wxTTLSConfigWindow::TransferDataToWindow()
 {
-    if (m_prov.m_read_only) {
-        // This is provider-locked configuration. Disable controls.
-        m_inner_type->GetChoiceCtrl()->Enable(false);
-    }
-
    eap::config_method_pap *cfg_pap = dynamic_cast<eap::config_method_pap*>(m_cfg.m_inner.get());
    if (cfg_pap) {
        m_cfg_pap = *cfg_pap;
@@ -196,8 +182,7 @@ bool wxTTLSConfigWindow::TransferDataFromWindow()

 void wxTTLSConfigWindow::OnInitDialog(wxInitDialogEvent& event)
 {
-    // Call TransferDataToWindow() manually, as wxScrolledWindow somehow skips that.
-    TransferDataToWindow();
+    wxEAPConfigWindow::OnInitDialog(event);

    // Forward the event to child panels.
    m_outer_identity->GetEventHandler()->ProcessEvent(event);
@@ -207,6 +192,14 @@ void wxTTLSConfigWindow::OnInitDialog(wxInitDialogEvent& event)
 }


+void wxTTLSConfigWindow::OnUpdateUI(wxUpdateUIEvent& event)
+{
+    wxEAPConfigWindow::OnUpdateUI(event);
+
+    m_inner_type->GetChoiceCtrl()->Enable(!m_prov.m_read_only);
+}
+
+
 //////////////////////////////////////////////////////////////////////
 // wxTTLSCredentialsPanel
 //////////////////////////////////////////////////////////////////////
--- a/lib/WinStd
+++ b/lib/WinStd
--- a/output/Setup/.gitignore
+++ b/output/Setup/.gitignore
@@ -1 +1,3 @@
 /GEANTLink*.msi
+/CredWrite.exe
+/MsiUseFeature.exe
Author	SHA1	Message	Date
Simon Rozman	352d546da1	Version set to 1.0-alpha11	2016-08-24 18:48:10 +02:00
Simon Rozman	d2ff78a613	Credential prompt sometimes displayed in background issue fixed now	2016-08-24 18:39:15 +02:00
Simon Rozman	10807fad18	Variable renamed from Slovenian to English	2016-08-24 18:36:51 +02:00
Simon Rozman	c6d53cd13c	eap::monitor_ui class to prevent multiple launches introduced	2016-08-24 17:45:31 +02:00
Simon Rozman	6f25e4c0ad	wxEAPGeneralDialog constructor parameters extended	2016-08-24 17:43:02 +02:00
Simon Rozman	edac93e115	Custom TLS identity is correctly enabled/disabled now.	2016-08-24 15:30:27 +02:00
Simon Rozman	d1c24efcf0	config_method_with_cred renamed to config_connection to describe it better	2016-08-24 11:39:37 +02:00
Simon Rozman	1cb6ca5adb	Connection configuration is equipped with GUID now for multiple credential prompt disambiguation later	2016-08-24 11:34:30 +02:00
Simon Rozman	38e1443276	Logging of handshake progress introduced	2016-08-24 11:04:04 +02:00
Simon Rozman	6835f5279c	Certificate (TLS) credentials support custom identity now	2016-08-24 11:03:18 +02:00
Simon Rozman	eb9c8a5f7c	If configured trusted root CA certificate list is empty, that really means "Trust no one!" now	2016-08-23 23:40:07 +02:00
Simon Rozman	5332b538aa	Our own TLS merged back to master and compiles conditionally	2016-08-23 22:46:00 +02:00
Simon Rozman	a9baa07227	Error type detection fixed	2016-08-23 22:41:12 +02:00
Simon Rozman	387a12ab5e	Additional cases of invalid certificate caught	2016-08-23 17:41:20 +02:00
Simon Rozman	7b3251a758	Error throwing clean-up	2016-08-23 17:20:04 +02:00
Simon Rozman	894f19a81e	Binary publishing updated	2016-08-23 16:45:16 +02:00
Simon Rozman	318ad7f355	Version set to 1.0-alpha10	2016-08-23 14:53:27 +02:00
Simon Rozman	ef2042253c	When server certificate has no subjectAltName(2), compare host name against Common Name	2016-08-23 14:29:47 +02:00
Simon Rozman	9b997408a1	Switched to Schannel to do the TLS	2016-08-23 13:53:23 +02:00
Simon Rozman	5720524abe	Version set to 1.0-alpha9	2016-08-18 06:33:02 +02:00
Simon Rozman	1f1b9b1084	GUI boots with a predefined configuration on new profiles now (closes #10)	2016-08-18 06:31:16 +02:00
Simon Rozman	076c6b77d7	GUI updated to show "<Your Provider>" when provider ID is blank	2016-08-18 06:30:02 +02:00
Simon Rozman	92460c571f	Initial focus changed to the first non-mouse-wheel-capturing control to allow initial scrolling of the configuration dialog using mouse wheel	2016-08-17 16:42:19 +02:00
Simon Rozman	b79a2f26f6	Support for read-only lock added to GUI	2016-08-17 16:27:43 +02:00
Simon Rozman	373c83dbbe	Provider identity and help-desk is configurable via GUI now	2016-08-17 15:56:11 +02:00
Simon Rozman	543dada025	Provider and method lists are arrays now, to allow random access for configuration dialog coming-up	2016-08-17 14:47:15 +02:00
Simon Rozman	ce22ec3bfa	wxEAPCredentialsPanelPassBase >> wxEAPCredentialsPassPanelBase	2016-08-17 13:48:14 +02:00