Configure networks requiring a certificate.

The current flow does not guarantee that a configured network will have
its tpm / pkcs11 credentials configured. We need to set these 
properties in order to reliably connect to networks requiring 
certificates. The patch also includes some minor changes to improve
error reporting and configuration triggering for failure cases.

BUG=247104
For /wifi_data_provider_chromeos_unittest.cc:
TBR=joth@chromium.org

Review URL: https://chromiumcodereview.appspot.com/16512003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@204994 0039d316-1c4b-4281-b951-d872f2087c98

22 files changed, 357 insertions, 170 deletions

diff --git a/ash/ash_chromeos_strings.grdp b/ash/ash_chromeos_strings.grdp
index 95e34fa..1e99643 100644
--- a/ash/ash_chromeos_strings.grdp
+++ b/ash/ash_chromeos_strings.grdp
@@ -176,61 +176,67 @@ Server message: <ph name="server_msg">$3<ex>Incorrect password</ex></ph>
   </message>
 
   <!-- Network error strings -->
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_UNKNOWN" desc="Network error in about:network: UNKNOWN">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_UNKNOWN" desc="Network error details in notifications: UNKNOWN">
     Unknown network error
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_OUT_OF_RANGE" desc="Network error in about:network: OUT_OF_RANGE">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_OUT_OF_RANGE" desc="Network error details in notifications: OUT_OF_RANGE">
     Out of range
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_PIN_MISSING" desc="Network error in about:network: PIN_MISSING">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_PIN_MISSING" desc="Network error details in notifications: PIN_MISSING">
     PIN missing
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_DHCP_FAILED" desc="Network error in about:network: DHCP_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_DHCP_FAILED" desc="Network error details in notifications: DHCP_FAILED">
     DHCP lookup failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_CONNECT_FAILED" desc="Network error in about:network: CONNECT_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_CONNECT_FAILED" desc="Network error details in notifications: CONNECT_FAILED">
     Connect failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_BAD_PASSPHRASE" desc="Network error in about:network: BAD_PASSPHRASE">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_BAD_PASSPHRASE" desc="Network error details in notifications: BAD_PASSPHRASE">
     Bad passphrase
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_BAD_WEPKEY" desc="Network error in about:network: BAD_WEPKEY">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_BAD_WEPKEY" desc="Network error details in notifications: BAD_WEPKEY">
     Bad WEP key
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_ACTIVATION_FAILED" desc="Network error in about:network: ACTIVATION_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_ACTIVATION_FAILED" desc="Network error details in notifications: ACTIVATION_FAILED">
     Activation failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_NEED_EVDO" desc="Network error in about:network: NEED_EVDO">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_NEED_EVDO" desc="Network error details in notifications: NEED_EVDO">
     Need EVDO
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_NEED_HOME_NETWORK" desc="Network error in about:network: NEED_HOME_NETWORK">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_NEED_HOME_NETWORK" desc="Network error details in notifications: NEED_HOME_NETWORK">
     Need home network
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_OTASP_FAILED" desc="Network error in about:network: OTASP_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_OTASP_FAILED" desc="Network error details in notifications: OTASP_FAILED">
     OTASP failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_AAA_FAILED" desc="Network error in about:network: AAA_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_AAA_FAILED" desc="Network error details in notifications: AAA_FAILED">
     AAA check failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_INTERNAL" desc="Network error in about:network: INTERNAL">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_INTERNAL" desc="Network error details in notifications: INTERNAL">
     Internal error
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_DNS_LOOKUP_FAILED" desc="Network error in about:network: DNS_LOOKUP_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_DNS_LOOKUP_FAILED" desc="Network error details in notifications: DNS_LOOKUP_FAILED">
     DNS lookup failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_HTTP_GET_FAILED" desc="Network error in about:network: HTTP_GET_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_HTTP_GET_FAILED" desc="Network error details in notifications: HTTP_GET_FAILED">
     HTTP get failed
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_IPSEC_PSK_AUTH_FAILED" desc="Network error in about:network: IPSEC_PSK_AUTH_FAILED">
-    Failed to authenticate with provided pre-shared key
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_IPSEC_PSK_AUTH_FAILED" desc="Network error details in notifications: IPSEC_PSK_AUTH_FAILED">
+    Incorrect password
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_IPSEC_CERT_AUTH_FAILED" desc="Network error in about:network: IPSEC_CERT_AUTH_FAILED">
-    Failed to authenticate with provided certificate
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_CERT_AUTH_FAILED" desc="Network error details in notifications: IPSEC_CERT_AUTH_FAILED">
+    Authentication certificate rejected by network
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_PPP_AUTH_FAILED" desc="Network error in about:network: PPP_AUTH_FAILED">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_EAP_LOCAL_TLS_FAILED" desc="Network error details in notifications: EAP_LOCAL_TLS_FAILED">
+    Authentication certificate rejected locally
+  </message>
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_EAP_REMOTE_TLS_FAILED" desc="Network error details in notifications: EAP_REMOTE_TLS_FAILED">
+    Authentication certificate rejected remotely
+  </message>
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_PPP_AUTH_FAILED" desc="Network error details in notifications: PPP_AUTH_FAILED">
     Failed to authenticate with provided username or password
   </message>
-  <message name="IDS_CHROMEOS_NETWORK_ERROR_UNRECOGNIZED" desc="Network error in about:network: Unrecognized">
+  <message name="IDS_CHROMEOS_NETWORK_ERROR_UNRECOGNIZED" desc="Network error details in notifications: Unrecognized">
     Unrecognized error
   </message>
 
diff --git a/ash/system/chromeos/network/network_connect.cc b/ash/system/chromeos/network/network_connect.cc
index 03c30be..3ac7419 100644
--- a/ash/system/chromeos/network/network_connect.cc
+++ b/ash/system/chromeos/network/network_connect.cc
@@ -47,12 +47,20 @@ void OnConnectFailed(const std::string& service_path,
         service_path);
     return;
   }
+  // Shill does not always provide a helpful error. In this case, show the
+  // configuration UI and a notification. See crbug.com/217033 for an example.
+  if (error_name == NetworkConnectionHandler::kErrorConnectFailed) {
+    ash::Shell::GetInstance()->system_tray_delegate()->ConfigureNetwork(
+        service_path);
+  }
   ash::Shell::GetInstance()->system_tray_notifier()->network_state_notifier()->
       ShowNetworkConnectError(error_name, service_path);
 }
 
 void OnConnectSucceeded(const std::string& service_path) {
   VLOG(1) << "Connect Succeeded for " << service_path;
+  ash::Shell::GetInstance()->system_tray_notifier()->NotifyClearNetworkMessage(
+      NetworkObserver::ERROR_CONNECT_FAILED);
 }
 
 }  // namespace
diff --git a/ash/system/chromeos/network/network_state_notifier.cc b/ash/system/chromeos/network/network_state_notifier.cc
index 654eb45..398aceb 100644
--- a/ash/system/chromeos/network/network_state_notifier.cc
+++ b/ash/system/chromeos/network/network_state_notifier.cc
@@ -80,14 +80,24 @@ string16 GetErrorString(const NetworkState* network_state) {
     return l10n_util::GetStringUTF16(
         IDS_CHROMEOS_NETWORK_ERROR_IPSEC_PSK_AUTH_FAILED);
   }
-  if (error == flimflam::kErrorIpsecCertAuthFailed) {
+  if (error == flimflam::kErrorIpsecCertAuthFailed ||
+      error == shill::kErrorEapAuthenticationFailed) {
     return l10n_util::GetStringUTF16(
-        IDS_CHROMEOS_NETWORK_ERROR_IPSEC_CERT_AUTH_FAILED);
+        IDS_CHROMEOS_NETWORK_ERROR_CERT_AUTH_FAILED);
+  }
+  if (error == shill::kErrorEapLocalTlsFailed) {
+    return l10n_util::GetStringUTF16(
+        IDS_CHROMEOS_NETWORK_ERROR_EAP_LOCAL_TLS_FAILED);
+  }
+  if (error == shill::kErrorEapRemoteTlsFailed) {
+    return l10n_util::GetStringUTF16(
+        IDS_CHROMEOS_NETWORK_ERROR_EAP_REMOTE_TLS_FAILED);
   }
   if (error == flimflam::kErrorPppAuthFailed) {
     return l10n_util::GetStringUTF16(
         IDS_CHROMEOS_NETWORK_ERROR_PPP_AUTH_FAILED);
   }
+
   if (StringToLowerASCII(error) ==
       StringToLowerASCII(std::string(flimflam::kUnknownString))) {
     return l10n_util::GetStringUTF16(IDS_CHROMEOS_NETWORK_ERROR_UNKNOWN);
diff --git a/ash/system/chromeos/network/network_state_notifier_unittest.cc b/ash/system/chromeos/network/network_state_notifier_unittest.cc
index 009274c..8cca85d 100644
--- a/ash/system/chromeos/network/network_state_notifier_unittest.cc
+++ b/ash/system/chromeos/network/network_state_notifier_unittest.cc
@@ -42,7 +42,7 @@ class NetworkStateNotifierTest : public AshTestBase {
   virtual void SetUp() OVERRIDE {
     DBusThreadManager::InitializeWithStub();
     SetupDefaultShillState();
-    NetworkHandler::Initialize();
+    NetworkHandler::InitializeForTest();
     RunAllPendingInMessageLoop();
     AshTestBase::SetUp();
   }
diff --git a/chrome/browser/chromeos/cros/network_library.cc b/chrome/browser/chromeos/cros/network_library.cc
index 5dbe83e..0109998 100644
--- a/chrome/browser/chromeos/cros/network_library.cc
+++ b/chrome/browser/chromeos/cros/network_library.cc
@@ -520,7 +520,7 @@ std::string Network::GetErrorString() const {
           IDS_CHROMEOS_NETWORK_ERROR_IPSEC_PSK_AUTH_FAILED);
     case ERROR_IPSEC_CERT_AUTH_FAILED:
       return l10n_util::GetStringUTF8(
-          IDS_CHROMEOS_NETWORK_ERROR_IPSEC_CERT_AUTH_FAILED);
+          IDS_CHROMEOS_NETWORK_ERROR_CERT_AUTH_FAILED);
     case ERROR_PPP_AUTH_FAILED:
     case ERROR_EAP_AUTHENTICATION_FAILED:
     case ERROR_EAP_LOCAL_TLS_FAILED:
diff --git a/chrome/browser/chromeos/net/network_portal_detector_impl_unittest.cc b/chrome/browser/chromeos/net/network_portal_detector_impl_unittest.cc
index 6b497dd..de8456f 100644
--- a/chrome/browser/chromeos/net/network_portal_detector_impl_unittest.cc
+++ b/chrome/browser/chromeos/net/network_portal_detector_impl_unittest.cc
@@ -211,7 +211,7 @@ class NetworkPortalDetectorImplTest
 
   void SetupNetworkHandler() {
     SetupDefaultShillState();
-    NetworkHandler::Initialize();
+    NetworkHandler::InitializeForTest();
   }
 
   base::MessageLoop message_loop_;
diff --git a/chrome/browser/chromeos/network_login_observer.cc b/chrome/browser/chromeos/network_login_observer.cc
index d7e9662..b4d4310 100644
--- a/chrome/browser/chromeos/network_login_observer.cc
+++ b/chrome/browser/chromeos/network_login_observer.cc
@@ -13,16 +13,9 @@
 namespace chromeos {
 
 NetworkLoginObserver::NetworkLoginObserver() {
-  // NetworkHandler does not get initialized in many unit tests even though
-  // NetworkLibrary which owns this class does. TODO(stevenjb): Eliminate
-  // this class along with NetworkLibrary, crbug.com/154852.
-  if (NetworkHandler::IsInitialized())
-    NetworkHandler::Get()->cert_loader()->AddObserver(this);
 }
 
 NetworkLoginObserver::~NetworkLoginObserver() {
-  if (NetworkHandler::IsInitialized())
-    NetworkHandler::Get()->cert_loader()->RemoveObserver(this);
 }
 
 void NetworkLoginObserver::OnNetworkManagerChanged(NetworkLibrary* cros) {
@@ -88,13 +81,4 @@ void NetworkLoginObserver::OnNetworkManagerChanged(NetworkLibrary* cros) {
   }
 }
 
-void NetworkLoginObserver::OnCertificatesLoaded(
-    const net::CertificateList& cert_list,
-    bool initial_load) {
-  if (initial_load) {
-    // Once certificates have loaded, connect to the "best" available network.
-    NetworkHandler::Get()->network_state_handler()->ConnectToBestWifiNetwork();
-  }
-}
-
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/network_login_observer.h b/chrome/browser/chromeos/network_login_observer.h
index 1609acf..85c1ee1 100644
--- a/chrome/browser/chromeos/network_login_observer.h
+++ b/chrome/browser/chromeos/network_login_observer.h
@@ -11,7 +11,6 @@
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "chrome/browser/chromeos/cros/network_library.h"
-#include "chromeos/network/cert_loader.h"
 
 namespace views {
 class WidgetDelegate;
@@ -21,8 +20,7 @@ namespace chromeos {
 
 // The network login observer reshows a login dialog if there was an error.
 // It is also responsible for signaling Shill to when certificates are loaded.
-class NetworkLoginObserver : public NetworkLibrary::NetworkManagerObserver,
-                             public CertLoader::Observer {
+class NetworkLoginObserver : public NetworkLibrary::NetworkManagerObserver {
  public:
   NetworkLoginObserver();
   virtual ~NetworkLoginObserver();
@@ -34,10 +32,6 @@ class NetworkLoginObserver : public NetworkLibrary::NetworkManagerObserver,
   // NetworkLibrary::NetworkManagerObserver
   virtual void OnNetworkManagerChanged(NetworkLibrary* obj) OVERRIDE;
 
-  // CertLibrary::Observer
-  virtual void OnCertificatesLoaded(const net::CertificateList& cert_list,
-                                    bool initial_load) OVERRIDE;
-
   DISALLOW_COPY_AND_ASSIGN(NetworkLoginObserver);
 };
 
diff --git a/chrome/browser/chromeos/options/network_config_view.cc b/chrome/browser/chromeos/options/network_config_view.cc
index 50446a6..034d83a 100644
--- a/chrome/browser/chromeos/options/network_config_view.cc
+++ b/chrome/browser/chromeos/options/network_config_view.cc
@@ -117,22 +117,20 @@ NetworkConfigView::~NetworkConfigView() {
 }
 
 // static
-bool NetworkConfigView::Show(Network* network, gfx::NativeWindow parent) {
+void NetworkConfigView::Show(Network* network, gfx::NativeWindow parent) {
   if (GetActiveDialog() != NULL)
-    return false;
+    return;
   NetworkConfigView* view = new NetworkConfigView(network);
   view->ShowDialog(parent);
-  return true;
 }
 
 // static
-bool NetworkConfigView::ShowForType(ConnectionType type,
+void NetworkConfigView::ShowForType(ConnectionType type,
                                     gfx::NativeWindow parent) {
   if (GetActiveDialog() != NULL)
-    return false;
+    return;
   NetworkConfigView* view = new NetworkConfigView(type);
   view->ShowDialog(parent);
-  return true;
 }
 
 gfx::NativeWindow NetworkConfigView::GetNativeWindow() const {
diff --git a/chrome/browser/chromeos/options/network_config_view.h b/chrome/browser/chromeos/options/network_config_view.h
index 9bfd97e..ca9500b 100644
--- a/chrome/browser/chromeos/options/network_config_view.h
+++ b/chrome/browser/chromeos/options/network_config_view.h
@@ -45,9 +45,8 @@ class NetworkConfigView : public views::DialogDelegateView,
   };
 
   // Shows a network connection dialog if none is currently visible.
-  // Returns false if a dialog is already visible.
-  static bool Show(Network* network, gfx::NativeWindow parent);
-  static bool ShowForType(ConnectionType type, gfx::NativeWindow parent);
+  static void Show(Network* network, gfx::NativeWindow parent);
+  static void ShowForType(ConnectionType type, gfx::NativeWindow parent);
 
   // Returns corresponding native window.
   gfx::NativeWindow GetNativeWindow() const;
diff --git a/chrome/browser/chromeos/options/network_connect.cc b/chrome/browser/chromeos/options/network_connect.cc
index 63c7206..9ce1d66 100644
--- a/chrome/browser/chromeos/options/network_connect.cc
+++ b/chrome/browser/chromeos/options/network_connect.cc
@@ -10,15 +10,21 @@
 #include "ash/system/chromeos/network/network_observer.h"
 #include "ash/system/tray/system_tray_notifier.h"
 #include "base/command_line.h"
+#include "base/stringprintf.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/chromeos/cros/cros_library.h"
 #include "chrome/browser/chromeos/cros/network_library.h"
 #include "chrome/browser/chromeos/enrollment_dialog_view.h"
 #include "chrome/browser/chromeos/options/network_config_view.h"
 #include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/ui/browser_finder.h"
+#include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/webui/chromeos/mobile_setup_dialog.h"
+#include "chrome/common/url_constants.h"
 #include "chromeos/chromeos_switches.h"
+#include "content/public/browser/user_metrics.h"
 #include "grit/generated_resources.h"
+#include "net/base/escape.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 #include "ui/base/l10n/l10n_util.h"
 
@@ -135,14 +141,10 @@ ConnectResult ConnectToNetwork(const std::string& service_path,
   if (network->type() == TYPE_ETHERNET)
     return CONNECT_NOT_STARTED;  // Normally this shouldn't happen
 
-  if (network->type() == TYPE_WIFI) {
-    WifiNetwork* wifi = static_cast<WifiNetwork*>(network);
-    wifi->SetEnrollmentDelegate(
-        chromeos::CreateEnrollmentDelegate(
-            parent_window,
-            wifi->name(),
-            ProfileManager::GetLastUsedProfile()));
-    wifi->AttemptConnection(base::Bind(&DoConnect, wifi, parent_window));
+  if (network->type() == TYPE_WIFI || network->type() == TYPE_VPN) {
+    network->SetEnrollmentDelegate(chromeos::CreateEnrollmentDelegate(
+        parent_window, network->name(), ProfileManager::GetLastUsedProfile()));
+    network->AttemptConnection(base::Bind(&DoConnect, network, parent_window));
     return CONNECT_STARTED;
   }
 
@@ -164,20 +166,63 @@ ConnectResult ConnectToNetwork(const std::string& service_path,
     return CONNECT_STARTED;
   }
 
-  if (network->type() == TYPE_VPN) {
-    VirtualNetwork* vpn = static_cast<VirtualNetwork*>(network);
-    vpn->SetEnrollmentDelegate(
-        chromeos::CreateEnrollmentDelegate(
-            parent_window,
-            vpn->name(),
-            ProfileManager::GetLastUsedProfile()));
-    vpn->AttemptConnection(base::Bind(&DoConnect, vpn, parent_window));
-    return CONNECT_STARTED;
-  }
-
   NOTREACHED();
   return CONNECT_NOT_STARTED;
 }
 
+void HandleUnconfiguredNetwork(const std::string& service_path,
+                               gfx::NativeWindow parent_window) {
+  NetworkLibrary* cros = CrosLibrary::Get()->GetNetworkLibrary();
+  Network* network = cros->FindNetworkByPath(service_path);
+  if (!network) {
+    LOG(WARNING) << "Unknown network: " << service_path;
+    return;
+  }
+
+  if (network->type() == TYPE_WIFI || network->type() == TYPE_VPN) {
+    network->SetEnrollmentDelegate(chromeos::CreateEnrollmentDelegate(
+        parent_window, network->name(), ProfileManager::GetLastUsedProfile()));
+    // This will connect to the network only if the network just needs to have
+    // its certificate configured. Otherwise it will show an enrollment dialog
+    // if available, or call NetworkConfigView::Show().
+    network->AttemptConnection(
+        base::Bind(&NetworkConfigView::Show, network, parent_window));
+    return;
+  }
+
+  if (network->type() == TYPE_WIMAX) {
+    NetworkConfigView::Show(network, parent_window);
+    return;
+  }
+
+  if (network->type() == TYPE_CELLULAR) {
+    CellularNetwork* cellular = static_cast<CellularNetwork*>(network);
+    if (cellular->NeedsActivation()) {
+      ActivateCellular(service_path);
+      return;
+    } else if (cellular->out_of_credits()) {
+      ShowMobileSetup(service_path);
+      return;
+    }
+  }
+
+  // No special configure or setup for |service_path|, show the settings UI.
+  std::string page = chrome::kInternetOptionsSubPage;
+  std::string name = network->name();
+  if (name.empty() && network->type() == TYPE_ETHERNET)
+    name = l10n_util::GetStringUTF8(IDS_STATUSBAR_NETWORK_DEVICE_ETHERNET);
+  page += base::StringPrintf(
+      "?servicePath=%s&networkType=%d&networkName=%s",
+      net::EscapeUrlEncodedData(service_path, true).c_str(),
+      network->type(),
+      net::EscapeUrlEncodedData(name, false).c_str());
+  content::RecordAction(
+      content::UserMetricsAction("OpenInternetOptionsDialog"));
+  Browser* browser = chrome::FindOrCreateTabbedBrowser(
+      ProfileManager::GetDefaultProfileOrOffTheRecord(),
+      chrome::HOST_DESKTOP_TYPE_ASH);
+  chrome::ShowSettingsSubPage(browser, page);
+}
+
 }  // namespace network_connect
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/options/network_connect.h b/chrome/browser/chromeos/options/network_connect.h
index 6e5792a..9872cbc 100644
--- a/chrome/browser/chromeos/options/network_connect.h
+++ b/chrome/browser/chromeos/options/network_connect.h
@@ -36,6 +36,16 @@ void ShowMobileSetup(const std::string& service_path);
 ConnectResult ConnectToNetwork(const std::string& service_path,
                                gfx::NativeWindow parent_window);
 
+// Handle an unconfigured network which might do any of the following:
+// * Configure and connect to the network with a matching cert but without
+//   pcks11id and tpm pin / slot configured.
+// * Show the enrollment dialog for the network.
+// * Show the configuration dialog for the network.
+// * Show the activation dialog for the network.
+// * Show the settings UI for the network.
+void HandleUnconfiguredNetwork(const std::string& service_path,
+                               gfx::NativeWindow parent_window);
+
 }  // namespace network_connect
 }  // namespace chromeos
 
diff --git a/chrome/browser/chromeos/proxy_config_service_impl_unittest.cc b/chrome/browser/chromeos/proxy_config_service_impl_unittest.cc
index 055d2b6..af5b7b1 100644
--- a/chrome/browser/chromeos/proxy_config_service_impl_unittest.cc
+++ b/chrome/browser/chromeos/proxy_config_service_impl_unittest.cc
@@ -216,7 +216,7 @@ class ProxyConfigServiceImplTest : public testing::Test {
 
   virtual void SetUp() {
     DBusThreadManager::InitializeWithStub();
-    NetworkHandler::Initialize();
+    NetworkHandler::InitializeForTest();
 
     SetUpNetwork();
 
diff --git a/chrome/browser/chromeos/system/ash_system_tray_delegate.cc b/chrome/browser/chromeos/system/ash_system_tray_delegate.cc
index 722d007..f3bafb1 100644
--- a/chrome/browser/chromeos/system/ash_system_tray_delegate.cc
+++ b/chrome/browser/chromeos/system/ash_system_tray_delegate.cc
@@ -742,31 +742,7 @@ class SystemTrayDelegate : public ash::SystemTrayDelegate,
   }
 
   virtual void ConfigureNetwork(const std::string& network_id) OVERRIDE {
-    const chromeos::NetworkState* network = network_id.empty() ? NULL :
-        NetworkHandler::Get()->network_state_handler()->GetNetworkState(
-            network_id);
-    if (!network) {
-      LOG(ERROR) << "ConfigureNetwork: Network not found: " << network_id;
-      return;
-    }
-    if (network->type() == flimflam::kTypeWifi ||
-        network->type() == flimflam::kTypeWimax ||
-        network->type() == flimflam::kTypeVPN) {
-      // TODO(stevenjb): Replace with non-NetworkLibrary UI.
-      Network* cros_network = CrosLibrary::Get()->GetNetworkLibrary()->
-          FindNetworkByPath(network_id);
-      NetworkConfigView::Show(cros_network, GetNativeWindow());
-      return;
-    }
-    if (network->type() == flimflam::kTypeCellular) {
-      if (network->activation_state() != flimflam::kActivationStateActivated)
-        network_connect::ActivateCellular(network_id);
-      else if (network->cellular_out_of_credits())
-        network_connect::ShowMobileSetup(network_id);
-      return;
-    }
-    // No special configure or setup for |network_id|, show the settings UI.
-    ShowNetworkSettings(network_id);
+    network_connect::HandleUnconfiguredNetwork(network_id, GetNativeWindow());
   }
 
   virtual void ConnectToNetwork(const std::string& network_id) OVERRIDE {
diff --git a/chromeos/network/network_connection_handler.cc b/chromeos/network/network_connection_handler.cc
index 97cc9f8..16b90af 100644
--- a/chromeos/network/network_connection_handler.cc
+++ b/chromeos/network/network_connection_handler.cc
@@ -100,13 +100,6 @@ bool VPNIsConfigured(const std::string& service_path,
       NET_LOG_EVENT("OpenVPN: No passphrase", service_path);
       return false;
     }
-    std::string client_cert_id;
-    properties->GetStringWithoutPathExpansion(
-        flimflam::kOpenVPNClientCertIdProperty, &client_cert_id);
-    if (client_cert_id.empty()) {
-      NET_LOG_EVENT("OpenVPN: No cert id", service_path);
-      return false;
-    }
     NET_LOG_EVENT("OpenVPN Is Configured", service_path);
   } else {
     bool passphrase_required = false;
@@ -122,27 +115,6 @@ bool VPNIsConfigured(const std::string& service_path,
   return true;
 }
 
-bool CertificateIsConfigured(NetworkUIData* ui_data) {
-  if (ui_data->certificate_type() != CLIENT_CERT_TYPE_PATTERN)
-    return true;  // No certificate or a reference.
-  if (ui_data->onc_source() == onc::ONC_SOURCE_DEVICE_POLICY) {
-    // We skip checking certificate patterns for device policy ONC so that an
-    // unmanaged user can't get to the place where a cert is presented for them
-    // involuntarily.
-    return true;
-  }
-  if (ui_data->certificate_pattern().Empty())
-    return false;
-
-  // Find the matching certificate.
-  scoped_refptr<net::X509Certificate> matching_cert =
-      certificate_pattern::GetCertificateMatch(
-          ui_data->certificate_pattern());
-  if (!matching_cert.get())
-    return false;
-  return true;
-}
-
 }  // namespace
 
 const char NetworkConnectionHandler::kErrorNotFound[] = "not-found";
@@ -162,9 +134,11 @@ const char NetworkConnectionHandler::kErrorConnectFailed[] = "connect-failed";
 const char NetworkConnectionHandler::kErrorUnknown[] = "unknown-error";
 
 struct NetworkConnectionHandler::ConnectRequest {
-  ConnectRequest(const base::Closure& success,
+  ConnectRequest(const std::string& service_path,
+                 const base::Closure& success,
                  const network_handler::ErrorCallback& error)
-      : connect_state(CONNECT_REQUESTED),
+      : service_path(service_path),
+        connect_state(CONNECT_REQUESTED),
         success_callback(success),
         error_callback(error) {
   }
@@ -173,29 +147,44 @@ struct NetworkConnectionHandler::ConnectRequest {
     CONNECT_STARTED = 1,
     CONNECT_CONNECTING = 2
   };
+  std::string service_path;
   ConnectState connect_state;
   base::Closure success_callback;
   network_handler::ErrorCallback error_callback;
 };
 
 NetworkConnectionHandler::NetworkConnectionHandler()
-    : network_state_handler_(NULL),
-      network_configuration_handler_(NULL) {
-  const char* new_handler_enabled =
-      CommandLine::ForCurrentProcess()->HasSwitch(
-          chromeos::switches::kUseNewNetworkConnectionHandler) ?
-      "enabled" : "disabled";
-  NET_LOG_EVENT("NewNetworkConnectionHandler", new_handler_enabled);
+    : cert_loader_(NULL),
+      network_state_handler_(NULL),
+      network_configuration_handler_(NULL),
+      logged_in_(false),
+      certificates_loaded_(false) {
 }
 
 NetworkConnectionHandler::~NetworkConnectionHandler() {
   if (network_state_handler_)
     network_state_handler_->RemoveObserver(this);
+  if (cert_loader_)
+    cert_loader_->RemoveObserver(this);
+  if (LoginState::IsInitialized())
+    LoginState::Get()->RemoveObserver(this);
 }
 
 void NetworkConnectionHandler::Init(
+    CertLoader* cert_loader,
     NetworkStateHandler* network_state_handler,
     NetworkConfigurationHandler* network_configuration_handler) {
+  LoginState::Get()->AddObserver(this);
+  logged_in_ =
+      LoginState::Get()->GetLoggedInState() == LoginState::LOGGED_IN_ACTIVE;
+  if (cert_loader) {
+    cert_loader_ = cert_loader;
+    cert_loader_->AddObserver(this);
+    certificates_loaded_ = cert_loader->certificates_loaded();
+  } else {
+    // TODO(stevenjb): Require a mock or stub cert_loader in tests.
+    certificates_loaded_ = true;
+  }
   if (network_state_handler) {
     network_state_handler_ = network_state_handler;
     network_state_handler_->AddObserver(this);
@@ -203,12 +192,44 @@ void NetworkConnectionHandler::Init(
   network_configuration_handler_ = network_configuration_handler;
 }
 
+void NetworkConnectionHandler::LoggedInStateChanged(
+    LoginState::LoggedInState state) {
+  NET_LOG_EVENT("NewNetworkConnectionHandler",
+                CommandLine::ForCurrentProcess()->HasSwitch(
+                    chromeos::switches::kUseNewNetworkConnectionHandler) ?
+                "enabled" : "disabled");
+  if (state == LoginState::LOGGED_IN_ACTIVE) {
+    logged_in_ = true;
+    NET_LOG_EVENT("Logged In", "");
+  }
+}
+
+void NetworkConnectionHandler::OnCertificatesLoaded(
+    const net::CertificateList& cert_list,
+    bool initial_load) {
+  certificates_loaded_ = true;
+  NET_LOG_EVENT("Certificates Loaded", "");
+  if (queued_connect_) {
+    NET_LOG_EVENT("Connecting to Queued Network",
+                  queued_connect_->service_path);
+    ConnectToNetwork(queued_connect_->service_path,
+                     queued_connect_->success_callback,
+                     queued_connect_->error_callback,
+                     true /* ignore_error_state */);
+  } else if (initial_load) {
+    // Once certificates have loaded, connect to the "best" available network.
+    NetworkHandler::Get()->network_state_handler()->ConnectToBestWifiNetwork();
+  }
+}
+
 void NetworkConnectionHandler::ConnectToNetwork(
     const std::string& service_path,
     const base::Closure& success_callback,
     const network_handler::ErrorCallback& error_callback,
     bool ignore_error_state) {
   NET_LOG_USER("ConnectToNetwork", service_path);
+  // Clear any existing queued connect request.
+  queued_connect_.reset();
   const NetworkState* network =
       network_state_handler_->GetNetworkState(service_path);
   if (!network) {
@@ -257,9 +278,11 @@ void NetworkConnectionHandler::ConnectToNetwork(
 
   // All synchronous checks passed, add |service_path| to connecting list.
   pending_requests_.insert(std::make_pair(
-      service_path, ConnectRequest(success_callback, error_callback)));
+      service_path,
+      ConnectRequest(service_path, success_callback, error_callback)));
 
-  if (!NetworkConnectable(network) && NetworkMayNeedCredentials(network)) {
+  if (!NetworkConnectable(network) &&
+      NetworkMayNeedCredentials(network)) {
     // Request additional properties to check.
     network_configuration_handler_->GetProperties(
         network->path(),
@@ -320,43 +343,101 @@ void NetworkConnectionHandler::VerifyConfiguredAndConnect(
     const std::string& service_path,
     const base::DictionaryValue& properties) {
   NET_LOG_EVENT("VerifyConfiguredAndConnect", service_path);
-  ConnectRequest* request = pending_request(service_path);
-  DCHECK(request);
-  network_handler::ErrorCallback error_callback = request->error_callback;
 
   const NetworkState* network =
       network_state_handler_->GetNetworkState(service_path);
   if (!network) {
-    pending_requests_.erase(service_path);
-    InvokeErrorCallback(service_path, error_callback, kErrorNotFound);
+    ErrorCallbackForPendingRequest(service_path, kErrorNotFound);
     return;
   }
 
   // VPN requires a host and username to be set.
   if (network->type() == flimflam::kTypeVPN &&
       !VPNIsConfigured(service_path, properties)) {
-    pending_requests_.erase(service_path);
-    InvokeErrorCallback(service_path, error_callback,
-                        kErrorConfigurationRequired);
+    ErrorCallbackForPendingRequest(service_path, kErrorConfigurationRequired);
     return;
   }
 
   // Check certificate properties in kUIDataProperty.
   scoped_ptr<NetworkUIData> ui_data =
       ManagedNetworkConfigurationHandler::GetUIData(properties);
-  if (ui_data && !CertificateIsConfigured(ui_data.get())) {
-    pending_requests_.erase(service_path);
-    InvokeErrorCallback(service_path, error_callback,
-                        kErrorCertificateRequired);
-    return;
+  if (ui_data && ui_data->certificate_type() == CLIENT_CERT_TYPE_PATTERN) {
+    // User must be logged in to connect to a network requiring a certificate.
+    if (!logged_in_ || !cert_loader_) {
+      ErrorCallbackForPendingRequest(service_path, kErrorCertificateRequired);
+      return;
+    }
+    // If certificates have not been loaded yet, queue the connect request.
+    if (!certificates_loaded_) {
+      ConnectRequest* request = pending_request(service_path);
+      DCHECK(request);
+      NET_LOG_EVENT("Connect Request Queued", service_path);
+      queued_connect_.reset(new ConnectRequest(
+          service_path, request->success_callback, request->error_callback));
+      pending_requests_.erase(service_path);
+      return;
+    }
+
+    // Ensure the certificate is available.
+    std::string pkcs11_id;
+    if (!CertificateIsConfigured(ui_data.get(), &pkcs11_id)) {
+      ErrorCallbackForPendingRequest(service_path, kErrorCertificateRequired);
+      return;
+    }
+
+    // The network may not be 'Connectable' because the certificate data is
+    // not set up, so configure tpm slot/pin and pkcs11_id before connecting.
+    // TODO(stevenjb): Remove this code once NetworkConfigurationHandler
+    // handles this.
+    NET_LOG_EVENT("Configuring Network", service_path);
+    const std::string& tpm_slot = cert_loader_->tpm_token_slot();
+    const std::string& tpm_pin = cert_loader_->tpm_user_pin();
+    base::DictionaryValue config_properties;
+    network->GetConfigProperties(&config_properties);
+
+    if (network->type() == flimflam::kTypeVPN) {
+      std::string provider_type;
+      properties.GetString(flimflam::kTypeProperty, &provider_type);
+      if (provider_type == flimflam::kProviderOpenVpn) {
+        config_properties.SetStringWithoutPathExpansion(
+            flimflam::kOpenVPNClientCertSlotProperty, tpm_slot);
+        config_properties.SetStringWithoutPathExpansion(
+            flimflam::kOpenVPNPinProperty, tpm_pin);
+        config_properties.SetStringWithoutPathExpansion(
+            flimflam::kOpenVPNClientCertIdProperty, pkcs11_id);
+      } else {
+        config_properties.SetStringWithoutPathExpansion(
+            flimflam::kL2tpIpsecClientCertSlotProperty, tpm_slot);
+        config_properties.SetStringWithoutPathExpansion(
+            flimflam::kL2tpIpsecPinProperty, tpm_pin);
+        config_properties.SetStringWithoutPathExpansion(
+            flimflam::kL2tpIpsecClientCertIdProperty, pkcs11_id);
+      }
+    } else if (network->type() == flimflam::kTypeWifi) {
+      config_properties.SetStringWithoutPathExpansion(
+          flimflam::kEapPinProperty, cert_loader_->tpm_user_pin());
+      config_properties.SetStringWithoutPathExpansion(
+          flimflam::kEapCertIdProperty, pkcs11_id);
+      config_properties.SetStringWithoutPathExpansion(
+          flimflam::kEapKeyIdProperty, pkcs11_id);
+    }
+    network_configuration_handler_->SetProperties(
+        service_path,
+        config_properties,
+        base::Bind(&NetworkConnectionHandler::CallShillConnect,
+                   AsWeakPtr(), service_path),
+        base::Bind(&NetworkConnectionHandler::HandleConfigurationFailure,
+                   AsWeakPtr(), service_path));
+   return;
   }
 
-  CallShillConnect(service_path);
+  // Otherwise, we need to configure the network.
+  ErrorCallbackForPendingRequest(service_path, kErrorConfigurationRequired);
 }
 
 void NetworkConnectionHandler::CallShillConnect(
     const std::string& service_path) {
-  NET_LOG_EVENT("Connect Request", service_path);
+  NET_LOG_EVENT("Sending Connect Request to Shill", service_path);
   DBusThreadManager::Get()->GetShillServiceClient()->Connect(
       dbus::ObjectPath(service_path),
       base::Bind(&NetworkConnectionHandler::HandleShillConnectSuccess,
@@ -382,7 +463,7 @@ void NetworkConnectionHandler::HandleShillConnectSuccess(
   ConnectRequest* request = pending_request(service_path);
   DCHECK(request);
   request->connect_state = ConnectRequest::CONNECT_STARTED;
-  NET_LOG_EVENT("Connect Request Sent", service_path);
+  NET_LOG_EVENT("Connect Request Acknowledged", service_path);
   // Do not call success_callback here, wait for one of the following
   // conditions:
   // * State transitions to a non connecting state indicating succes or failure
@@ -412,9 +493,7 @@ void NetworkConnectionHandler::CheckPendingRequest(
   const NetworkState* network =
       network_state_handler_->GetNetworkState(service_path);
   if (!network) {
-    network_handler::ErrorCallback error_callback = request->error_callback;
-    pending_requests_.erase(service_path);
-    InvokeErrorCallback(service_path, error_callback, kErrorNotFound);
+    ErrorCallbackForPendingRequest(service_path, kErrorNotFound);
     return;
   }
   if (network->IsConnectingState()) {
@@ -462,6 +541,31 @@ void NetworkConnectionHandler::CheckAllPendingRequests() {
   }
 }
 
+bool NetworkConnectionHandler::CertificateIsConfigured(NetworkUIData* ui_data,
+                                                       std::string* pkcs11_id) {
+  if (ui_data->certificate_pattern().Empty())
+    return false;
+
+  // Find the matching certificate.
+  scoped_refptr<net::X509Certificate> matching_cert =
+      certificate_pattern::GetCertificateMatch(ui_data->certificate_pattern());
+  if (!matching_cert.get())
+    return false;
+  *pkcs11_id = cert_loader_->GetPkcs11IdForCert(*matching_cert.get());
+  return true;
+}
+
+void NetworkConnectionHandler::ErrorCallbackForPendingRequest(
+    const std::string& service_path,
+    const std::string& error_name) {
+  ConnectRequest* request = pending_request(service_path);
+  DCHECK(request);
+  // Remove the entry before invoking the callback in case it triggers a retry.
+  network_handler::ErrorCallback error_callback = request->error_callback;
+  pending_requests_.erase(service_path);
+  InvokeErrorCallback(service_path, error_callback, error_name);
+}
+
 // Disconnect
 
 void NetworkConnectionHandler::CallShillDisconnect(
diff --git a/chromeos/network/network_connection_handler.h b/chromeos/network/network_connection_handler.h
index 42c2bdf..ec6ea4f 100644
--- a/chromeos/network/network_connection_handler.h
+++ b/chromeos/network/network_connection_handler.h
@@ -14,6 +14,8 @@
 #include "base/values.h"
 #include "chromeos/chromeos_export.h"
 #include "chromeos/dbus/dbus_method_call_status.h"
+#include "chromeos/login/login_state.h"
+#include "chromeos/network/cert_loader.h"
 #include "chromeos/network/network_handler.h"
 #include "chromeos/network/network_handler_callbacks.h"
 #include "chromeos/network/network_state_handler_observer.h"
@@ -21,6 +23,7 @@
 namespace chromeos {
 
 class NetworkState;
+class NetworkUIData;
 
 // The NetworkConnectionHandler class is used to manage network connection
 // requests. This is the only class that should make Shill Connect calls.
@@ -29,16 +32,19 @@ class NetworkState;
 //    known to be available to connect to the network.
 // 2. Request additional information (e.g. user data which contains certificate
 //    information) and determine whether sufficient information is available.
-// 3. Send the connect request.
-// 4. Wait for the network state to change to a non connecting state.
-// 5. Invoke the appropriate callback (always) on success or failure.
+// 3. Possibly configure the network certificate info (tpm slot and pkcs11 id).
+// 4. Send the connect request.
+// 5. Wait for the network state to change to a non connecting state.
+// 6. Invoke the appropriate callback (always) on success or failure.
 //
 // NetworkConnectionHandler depends on NetworkStateHandler for immediately
 // available State information, and NetworkConfigurationHandler for any
 // configuration calls.
 
 class CHROMEOS_EXPORT NetworkConnectionHandler
-    : public NetworkStateHandlerObserver,
+    : public LoginState::Observer,
+      public CertLoader::Observer,
+      public NetworkStateHandlerObserver,
       public base::SupportsWeakPtr<NetworkConnectionHandler> {
  public:
   // Constants for |error_name| from |error_callback| for Connect.
@@ -96,6 +102,13 @@ class CHROMEOS_EXPORT NetworkConnectionHandler
   virtual void NetworkListChanged() OVERRIDE;
   virtual void NetworkPropertiesUpdated(const NetworkState* network) OVERRIDE;
 
+  // LoginState::Observer
+  virtual void LoggedInStateChanged(LoginState::LoggedInState state) OVERRIDE;
+
+  // CertLoader::Observer
+  virtual void OnCertificatesLoaded(const net::CertificateList& cert_list,
+                                    bool initial_load) OVERRIDE;
+
  private:
   friend class NetworkHandler;
   friend class NetworkConnectionHandlerTest;
@@ -104,7 +117,8 @@ class CHROMEOS_EXPORT NetworkConnectionHandler
 
   NetworkConnectionHandler();
 
-  void Init(NetworkStateHandler* network_state_handler,
+  void Init(CertLoader* cert_loader,
+            NetworkStateHandler* network_state_handler,
             NetworkConfigurationHandler* network_configuration_handler);
 
   ConnectRequest* pending_request(const std::string& service_path);
@@ -133,6 +147,9 @@ class CHROMEOS_EXPORT NetworkConnectionHandler
 
   void CheckPendingRequest(const std::string service_path);
   void CheckAllPendingRequests();
+  bool CertificateIsConfigured(NetworkUIData* ui_data, std::string* pkcs11_id);
+  void ErrorCallbackForPendingRequest(const std::string& service_path,
+                                      const std::string& error_name);
 
   // Calls Shill.Manager.Disconnect asynchronously.
   void CallShillDisconnect(
@@ -150,13 +167,19 @@ class CHROMEOS_EXPORT NetworkConnectionHandler
       const std::string& error_message);
 
   // Local references to the associated handler instances.
+  CertLoader* cert_loader_;
   NetworkStateHandler* network_state_handler_;
   NetworkProfileHandler* network_profile_handler_;
   NetworkConfigurationHandler* network_configuration_handler_;
 
-  // Map of pending connect requests, used to prevent repeat attempts while
+  // Map of pending connect requests, used to prevent repeated attempts while
   // waiting for Shill and to trigger callbacks on eventual success or failure.
   std::map<std::string, ConnectRequest> pending_requests_;
+  scoped_ptr<ConnectRequest> queued_connect_;
+
+  // Track certificate loading state.
+  bool logged_in_;
+  bool certificates_loaded_;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkConnectionHandler);
 };
diff --git a/chromeos/network/network_connection_handler_unittest.cc b/chromeos/network/network_connection_handler_unittest.cc
index 5c09b9b..8d8fd7a 100644
--- a/chromeos/network/network_connection_handler_unittest.cc
+++ b/chromeos/network/network_connection_handler_unittest.cc
@@ -38,12 +38,15 @@ class NetworkConnectionHandlerTest : public testing::Test {
     DBusThreadManager::Get()->GetShillServiceClient()->GetTestInterface()
         ->ClearServices();
     message_loop_.RunUntilIdle();
+    LoginState::Initialize();
     network_state_handler_.reset(NetworkStateHandler::InitializeForTest());
     network_configuration_handler_.reset(
         NetworkConfigurationHandler::InitializeForTest(
             network_state_handler_.get()));
     network_connection_handler_.reset(new NetworkConnectionHandler);
-    network_connection_handler_->Init(network_state_handler_.get(),
+    // TODO(stevenjb): Test integration with CertLoader using a stub or mock.
+    network_connection_handler_->Init(NULL /* cert_loader */,
+                                      network_state_handler_.get(),
                                       network_configuration_handler_.get());
   }
 
@@ -51,6 +54,7 @@ class NetworkConnectionHandlerTest : public testing::Test {
     network_connection_handler_.reset();
     network_configuration_handler_.reset();
     network_state_handler_.reset();
+    LoginState::Shutdown();
     DBusThreadManager::Shutdown();
   }
 
diff --git a/chromeos/network/network_handler.cc b/chromeos/network/network_handler.cc
index 5eb2a87..cbe0595 100644
--- a/chromeos/network/network_handler.cc
+++ b/chromeos/network/network_handler.cc
@@ -46,7 +46,8 @@ void NetworkHandler::Init() {
       network_state_handler_.get(),
       network_profile_handler_.get(),
       network_configuration_handler_.get());
-  network_connection_handler_->Init(network_state_handler_.get(),
+  network_connection_handler_->Init(cert_loader_.get(),
+                                    network_state_handler_.get(),
                                     network_configuration_handler_.get());
   geolocation_handler_->Init();
 }
@@ -59,6 +60,15 @@ void NetworkHandler::Initialize() {
 }
 
 // static
+void NetworkHandler::InitializeForTest() {
+  CHECK(!g_network_handler);
+  if (!LoginState::IsInitialized())
+    LoginState::Initialize();  // OK not to shutdown LoginState for tests.
+  g_network_handler = new NetworkHandler();
+  g_network_handler->Init();
+}
+
+// static
 void NetworkHandler::Shutdown() {
   CHECK(g_network_handler);
   delete g_network_handler;
diff --git a/chromeos/network/network_handler.h b/chromeos/network/network_handler.h
index e3df697..5499589 100644
--- a/chromeos/network/network_handler.h
+++ b/chromeos/network/network_handler.h
@@ -27,6 +27,9 @@ class CHROMEOS_EXPORT NetworkHandler {
   // Sets the global instance. Must be called before any calls to Get().
   static void Initialize();
 
+  // Sets the global instance for testing.
+  static void InitializeForTest();
+
   // Destroys the global instance.
   static void Shutdown();
 
diff --git a/chromeos/network/network_state.cc b/chromeos/network/network_state.cc
index e0ac196..427ab84 100644
--- a/chromeos/network/network_state.cc
+++ b/chromeos/network/network_state.cc
@@ -232,6 +232,15 @@ void NetworkState::GetProperties(base::DictionaryValue* dictionary) const {
                                              cellular_out_of_credits_);
 }
 
+void NetworkState::GetConfigProperties(
+    base::DictionaryValue* dictionary) const {
+  dictionary->SetStringWithoutPathExpansion(flimflam::kNameProperty, name());
+  dictionary->SetStringWithoutPathExpansion(flimflam::kTypeProperty, type());
+  dictionary->SetStringWithoutPathExpansion(flimflam::kSecurityProperty,
+                                            security());
+  dictionary->SetStringWithoutPathExpansion(flimflam::kGuidProperty, guid());
+}
+
 bool NetworkState::IsConnectedState() const {
   return StateIsConnected(connection_state_);
 }
diff --git a/chromeos/network/network_state.h b/chromeos/network/network_state.h
index 31ea5f9..e87cba6 100644
--- a/chromeos/network/network_state.h
+++ b/chromeos/network/network_state.h
@@ -35,6 +35,10 @@ class CHROMEOS_EXPORT NetworkState : public ManagedState {
   // stored.
   void GetProperties(base::DictionaryValue* dictionary) const;
 
+  // Fills |dictionary| with the state properties required to configure a
+  // network.
+  void GetConfigProperties(base::DictionaryValue* dictionary) const;
+
   // Accessors
   const std::string& security() const { return security_; }
   const std::string& ip_address() const { return ip_address_; }
diff --git a/content/browser/geolocation/wifi_data_provider_chromeos_unittest.cc b/content/browser/geolocation/wifi_data_provider_chromeos_unittest.cc
index 1cf6e5d..d19e3eb 100644
--- a/content/browser/geolocation/wifi_data_provider_chromeos_unittest.cc
+++ b/content/browser/geolocation/wifi_data_provider_chromeos_unittest.cc
@@ -21,7 +21,7 @@ class GeolocationChromeOsWifiDataProviderTest : public testing::Test {
 
   virtual void SetUp() OVERRIDE {
     chromeos::DBusThreadManager::InitializeWithStub();
-    chromeos::NetworkHandler::Initialize();
+    chromeos::NetworkHandler::InitializeForTest();
     manager_client_ =
         chromeos::DBusThreadManager::Get()->GetShillManagerClient();
     manager_test_ = manager_client_->GetTestInterface();