diff --git a/libs/internals/connectionpersistence.cpp b/libs/internals/connectionpersistence.cpp
index 0c31aae..df26574 100644
--- a/libs/internals/connectionpersistence.cpp
+++ b/libs/internals/connectionpersistence.cpp
@@ -217,8 +217,8 @@ void ConnectionPersistence::loadSecrets()
 
         if (m_storageMode != ConnectionPersistence::Secure) {
 
-            foreach (Setting * setting, m_connection->settings()) {
-                setting->setSecretsAvailable(true);
+            if (!m_connection->secretsAvailable()){
+                errorCode = EnumError::MissingContents;
             }
 
         } else if (!m_connection->hasSecrets() ||
diff --git a/libs/internals/setting.h b/libs/internals/setting.h
index 7cd9c32..ec16bf1 100644
--- a/libs/internals/setting.h
+++ b/libs/internals/setting.h
@@ -41,7 +41,7 @@ public:
     Setting::Type type() const;
     virtual QString name() const = 0;
     virtual bool hasSecrets() const = 0;
-    bool secretsAvailable() const;
+    virtual bool secretsAvailable() const;
     void setSecretsAvailable(bool secretsAvailable);
 protected:
     bool m_initialized;
diff --git a/libs/internals/settings/802-11-wireless-securitypersistence.cpp b/libs/internals/settings/802-11-wireless-securitypersistence.cpp
index 3565a2c..ddfa78c 100644
--- a/libs/internals/settings/802-11-wireless-securitypersistence.cpp
+++ b/libs/internals/settings/802-11-wireless-securitypersistence.cpp
@@ -69,33 +69,16 @@ void WirelessSecurityPersistence::load()
   setting->setPairwise(m_config->readEntry("pairwise", QStringList()));
   setting->setGroup(m_config->readEntry("group", QStringList()));
   setting->setLeapusername(m_config->readEntry("leapusername", ""));
-  // SECRET
+  // SECRETS
   if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setWepkey0(m_config->readEntry("wepkey0", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setWepkey1(m_config->readEntry("wepkey1", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setWepkey2(m_config->readEntry("wepkey2", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setWepkey3(m_config->readEntry("wepkey3", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setPsk(m_config->readEntry("psk", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setLeappassword(m_config->readEntry("leappassword", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setWeppassphrase(m_config->readEntry("weppassphrase", ""));
+    setting->setSecretsAvailable(true);
   }
   } else {
       setting->setSecurityType(WirelessSecuritySetting::EnumSecurityType::None);
diff --git a/libs/internals/settings/802-1xpersistence.cpp b/libs/internals/settings/802-1xpersistence.cpp
index d334a9e..740da06 100644
--- a/libs/internals/settings/802-1xpersistence.cpp
+++ b/libs/internals/settings/802-1xpersistence.cpp
@@ -94,6 +94,7 @@ void Security8021xPersistence::load()
   // SECRET
   if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setPhase2privatekeypassword(m_config->readEntry("phase2privatekeypassword", ""));
+    setting->setSecretsAvailable(true);
   }
   setting->setPin(m_config->readEntry("pin", ""));
   setting->setPsk(m_config->readEntry("psk", ""));
diff --git a/libs/internals/settings/cdmapersistence.cpp b/libs/internals/settings/cdmapersistence.cpp
index 2cc23f3..78a38b8 100644
--- a/libs/internals/settings/cdmapersistence.cpp
+++ b/libs/internals/settings/cdmapersistence.cpp
@@ -23,6 +23,7 @@ void CdmaPersistence::load()
   // SECRET
   if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setPassword(m_config->readEntry("password", ""));
+    setting->setSecretsAvailable(true);
   }
   setting->setInitialized();
 }
diff --git a/libs/internals/settings/gsmpersistence.cpp b/libs/internals/settings/gsmpersistence.cpp
index 01d4d29..1ddf3ca 100644
--- a/libs/internals/settings/gsmpersistence.cpp
+++ b/libs/internals/settings/gsmpersistence.cpp
@@ -20,21 +20,16 @@ void GsmPersistence::load()
   GsmSetting * setting = static_cast<GsmSetting *>(m_setting);
   setting->setNumber(m_config->readEntry("number", "*99#"));
   setting->setUsername(m_config->readEntry("username", ""));
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
-    setting->setPassword(m_config->readEntry("password", ""));
-  }
   setting->setApn(m_config->readEntry("apn", ""));
   setting->setNetworkid(m_config->readEntry("networkid", ""));
   setting->setNetworktype(m_config->readEntry("networktype", 0));
   setting->setBand(m_config->readEntry("band", 0));
-  // SECRET
+  // SECRETS
   if (m_storageMode != ConnectionPersistence::Secure) {
+    setting->setPassword(m_config->readEntry("password", ""));
     setting->setPin(m_config->readEntry("pin", ""));
-  }
-  // SECRET
-  if (m_storageMode != ConnectionPersistence::Secure) {
     setting->setPuk(m_config->readEntry("puk", ""));
+    setting->setSecretsAvailable(true);
   }
   setting->setInitialized();
 }
diff --git a/libs/internals/settings/vpn.cpp b/libs/internals/settings/vpn.cpp
index 1fb1901..4186655 100644
--- a/libs/internals/settings/vpn.cpp
+++ b/libs/internals/settings/vpn.cpp
@@ -7,6 +7,7 @@ using namespace Knm;
 
 VpnSetting::VpnSetting() : Setting(Setting::Vpn)
 {
+  mSecretsStorageType = QStringMap();
 }
 
 VpnSetting::~VpnSetting()
@@ -21,3 +22,22 @@ bool VpnSetting::hasSecrets() const
 {
   return true;
 }
+
+bool VpnSetting::secretsAvailable() const
+{
+  /*
+   * secrets were loaded from persistente storage
+   * Now verify that all secrets of type "save" are actually present
+   * and no secret of type "ask" exists
+   */
+
+  foreach(const QString & s, mSecretsStorageType.keys()) {
+    if (mSecretsStorageType.value(s) == NM_VPN_PW_TYPE_ASK)
+      return false;
+    if (mSecretsStorageType.value(s) == NM_VPN_PW_TYPE_SAVE && !mVpnSecrets.contains(s))
+      return false;
+  }
+
+  return true;
+}
+
diff --git a/libs/internals/settings/vpn.h b/libs/internals/settings/vpn.h
index 332b4b6..d809c79 100644
--- a/libs/internals/settings/vpn.h
+++ b/libs/internals/settings/vpn.h
@@ -9,6 +9,11 @@
 #include "setting.h"
 #include "knminternals_export.h"
 #include "../types.h"
+
+#define NM_VPN_PW_TYPE_SAVE   "save"
+#define NM_VPN_PW_TYPE_ASK    "ask"
+#define NM_VPN_PW_TYPE_UNUSED "unused"
+
 namespace Knm {
 
 class KNMINTERNALS_EXPORT VpnSetting : public Setting
@@ -102,6 +107,24 @@ class KNMINTERNALS_EXPORT VpnSetting : public Setting
       return mPluginName;
     }
 
+    /**
+      Set secret storage type
+    */
+    void setSecretsStorageType( const QStringMap & v )
+    {
+      mSecretsStorageType = v;
+    }
+
+    /**
+      Get secret storage type
+    */
+    QStringMap secretsStorageType() const
+    {
+      return mSecretsStorageType;
+    }
+
+    bool secretsAvailable() const;
+
   protected:
 
     // vpn
@@ -110,6 +133,7 @@ class KNMINTERNALS_EXPORT VpnSetting : public Setting
     QString mUserName;
     QVariantMap mVpnSecrets;
     QString mPluginName;
+    QStringMap mSecretsStorageType;
 
   private:
 };
diff --git a/libs/internals/settings/vpnpersistence.cpp b/libs/internals/settings/vpnpersistence.cpp
index c9ed029..cffbe53 100644
--- a/libs/internals/settings/vpnpersistence.cpp
+++ b/libs/internals/settings/vpnpersistence.cpp
@@ -22,11 +22,13 @@ void VpnPersistence::load()
   VpnSetting * setting = static_cast<VpnSetting *>(m_setting);
   setting->setServiceType(m_config->readEntry("ServiceType", ""));
   setting->setData(stringMapFromStringList(m_config->readEntry("Data", QStringList())));
+  setting->setSecretsStorageType(stringMapFromStringList(m_config->readEntry("SecretsStorageType", QStringList())));
   setting->setUserName(KUser().loginName());
   // SECRET
   if (m_storageMode != ConnectionPersistence::Secure) {
       // the map is flattened to a list of key,value,key,value
       setting->setVpnSecrets(variantMapFromStringList(m_config->readEntry("VpnSecrets", QStringList())));
+    setting->setSecretsAvailable(true);
   }
   setting->setPluginName(m_config->readEntry("PluginName", ""));
   setting->setInitialized();
@@ -37,9 +39,14 @@ void VpnPersistence::save()
   VpnSetting * setting = static_cast<VpnSetting *>(m_setting);
   m_config->writeEntry("ServiceType", setting->serviceType());
   m_config->writeEntry("Data", stringMapToStringList(setting->data()));
+  m_config->writeEntry("SecretsStorageType", stringMapToStringList(setting->secretsStorageType()));
   // SECRET
   if (m_storageMode != ConnectionPersistence::Secure) {
-    m_config->writeEntry("VpnSecrets", variantMapToStringList(setting->vpnSecrets()));
+    /*
+     * Save only secrets with storage type == "save"
+     * For compatibility treat empty storage type as "save"
+     */
+    m_config->writeEntry("VpnSecrets", variantMapToStringList(secretsToSave(setting->secretsStorageType(), setting->vpnSecrets())));
   }
   m_config->writeEntry("PluginName", setting->pluginName());
 }
@@ -61,7 +68,7 @@ QStringList VpnPersistence::variantMapToStringList(const QVariantMap & map)
     QMapIterator<QString,QVariant> i(map);
     while (i.hasNext()) {
         i.next();
-        rawSecrets << i.key() << i.value().toString();
+	  rawSecrets << i.key() << i.value().toString();
     }
     return rawSecrets;
 }
@@ -83,7 +90,7 @@ QStringList VpnPersistence::stringMapToStringList(const QStringMap & map)
     QStringMapIterator i(map);
     while (i.hasNext()) {
         i.next();
-        rawSecrets << i.key() << i.value();
+	  rawSecrets << i.key() << i.value();
     }
     return rawSecrets;
 }
@@ -92,7 +99,7 @@ QMap<QString,QString> VpnPersistence::secrets() const
 {
   VpnSetting * setting = static_cast<VpnSetting *>(m_setting);
   QMap<QString,QString> map;
-  map.insert(QLatin1String("VpnSecrets"), variantMapToStringList(setting->vpnSecrets()).join(QLatin1String("%SEP%")));
+  map.insert(QLatin1String("VpnSecrets"), variantMapToStringList(secretsToSave(setting->secretsStorageType(), setting->vpnSecrets())).join(QLatin1String("%SEP%")));
   return map;
 }
 
@@ -104,3 +111,15 @@ void VpnPersistence::restoreSecrets(QMap<QString,QString> secrets) const
     setting->setSecretsAvailable(true);
   }
 }
+
+QVariantMap VpnPersistence::secretsToSave(const QStringMap & type, const QVariantMap & secrets)
+{
+  QVariantMap toSave;
+  QMapIterator<QString,QVariant> i(secrets);
+  while (i.hasNext()) {
+      i.next();
+      if (type[i.key()].isNull() || type[i.key()] == NM_VPN_PW_TYPE_SAVE)
+	  toSave.insert( i.key(), i.value() );
+  }
+  return toSave;
+}
diff --git a/libs/internals/settings/vpnpersistence.h b/libs/internals/settings/vpnpersistence.h
index 10890b6..39dc451 100644
--- a/libs/internals/settings/vpnpersistence.h
+++ b/libs/internals/settings/vpnpersistence.h
@@ -26,6 +26,7 @@ class KNMINTERNALS_EXPORT VpnPersistence : public SettingPersistence
     static QVariantMap variantMapFromStringList(const QStringList &);
     static QStringList stringMapToStringList(const QStringMap &);
     static QStringMap stringMapFromStringList(const QStringList &);
+    static QVariantMap secretsToSave(const QStringMap &, const QVariantMap &);
 };
 }
 
diff --git a/libs/ui/connectionsecretsjob.cpp b/libs/ui/connectionsecretsjob.cpp
index bd7f253..5a90b99 100644
--- a/libs/ui/connectionsecretsjob.cpp
+++ b/libs/ui/connectionsecretsjob.cpp
@@ -105,7 +105,8 @@ void ConnectionSecretsJob::gotPersistedSecrets(uint result)
     m_connectionPersistence->deleteLater();
     m_connectionPersistence = 0;
     setError(result);
-    if (result == Knm::ConnectionPersistence::EnumError::NoError) {
+    if (result == Knm::ConnectionPersistence::EnumError::NoError &&
+        m_connection->secretsAvailable()) {
         emitResult();
     } else {
         doAskUser();
@@ -149,7 +150,7 @@ void ConnectionSecretsJob::doAskUser()
         QString error;
         VpnUiPlugin * uiPlugin = KServiceTypeTrader::createInstanceFromQuery<VpnUiPlugin>( QString::fromLatin1( "NetworkManagement/VpnUiPlugin" ), QString::fromLatin1( "[X-KDE-PluginInfo-Name]=='%1'" ).arg(vpnSetting->pluginName() ), this, QVariantList(), &error );
         if (uiPlugin && error.isEmpty()) {
-            m_settingWidget= uiPlugin->widget(m_connection, 0);
+            m_settingWidget= uiPlugin->askUser(m_connection, 0);
         }
     } else if ( mSettingName == QLatin1String(NM_SETTING_WIRED_SETTING_NAME)) {
         m_settingWidget = new WiredWidget(m_connection, 0);
diff --git a/libs/ui/vpnuiplugin.h b/libs/ui/vpnuiplugin.h
index c06608b..7a13027 100644
--- a/libs/ui/vpnuiplugin.h
+++ b/libs/ui/vpnuiplugin.h
@@ -45,6 +45,7 @@ public:
     virtual ~VpnUiPlugin();
 
     virtual SettingWidget * widget(Knm::Connection * connection, QWidget * parent = 0) = 0;
+    virtual SettingWidget * askUser(Knm::Connection * connection, QWidget * parent = 0){ return widget(connection, parent); };
 private:
     class Private;
     Private * d;
diff --git a/vpnplugins/vpnc/CMakeLists.txt b/vpnplugins/vpnc/CMakeLists.txt
index 5e47c38..5af39b9 100644
--- a/vpnplugins/vpnc/CMakeLists.txt
+++ b/vpnplugins/vpnc/CMakeLists.txt
@@ -4,10 +4,11 @@ include_directories(${CMAKE_CURRENT_SOURCE_DIR}/../../libs/internals)
 
 set(vpnc_SRCS
    vpnc.cpp
+   vpncauth.cpp
    vpncwidget.cpp
    )
 
-kde4_add_ui_files(vpnc_SRCS vpncprop.ui)
+kde4_add_ui_files(vpnc_SRCS vpncprop.ui vpncauth.ui)
 
 kde4_add_plugin(networkmanagement_vpncui ${vpnc_SRCS})
 
diff --git a/vpnplugins/vpnc/nm-vpnc-service.h b/vpnplugins/vpnc/nm-vpnc-service.h
index 3ec2412..e3f859a 100644
--- a/vpnplugins/vpnc/nm-vpnc-service.h
+++ b/vpnplugins/vpnc/nm-vpnc-service.h
@@ -47,8 +47,4 @@
 #define NM_VPNC_NATT_MODE_NONE "none"
 #define NM_VPNC_NATT_MODE_CISCO "cisco-udp"
 
-#define NM_VPNC_PW_TYPE_SAVE   "save"
-#define NM_VPNC_PW_TYPE_ASK    "ask"
-#define NM_VPNC_PW_TYPE_UNUSED "unused"
-
 #endif /* NM_VPNC_PLUGIN_H */
diff --git a/vpnplugins/vpnc/vpnc.cpp b/vpnplugins/vpnc/vpnc.cpp
index b5f1890..deb9108 100644
--- a/vpnplugins/vpnc/vpnc.cpp
+++ b/vpnplugins/vpnc/vpnc.cpp
@@ -23,6 +23,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #include <KPluginFactory>
 
 #include "vpncwidget.h"
+#include "vpncauth.h"
 #include "connection.h"
 
 K_PLUGIN_FACTORY( VpncUiPluginFactory, registerPlugin<VpncUiPlugin>(); )
@@ -43,4 +44,9 @@ SettingWidget * VpncUiPlugin::widget(Knm::Connection * connection, QWidget * par
     return new VpncSettingWidget(connection, parent);
 }
 
+SettingWidget * VpncUiPlugin::askUser(Knm::Connection * connection, QWidget * parent)
+{
+    return new VpncAuthWidget(connection, parent);
+}
+
 // vim: sw=4 sts=4 et tw=100
diff --git a/vpnplugins/vpnc/vpnc.h b/vpnplugins/vpnc/vpnc.h
index bb0683b..aec2136 100644
--- a/vpnplugins/vpnc/vpnc.h
+++ b/vpnplugins/vpnc/vpnc.h
@@ -37,6 +37,7 @@ public:
     VpncUiPlugin(QObject * parent = 0, const QVariantList& = QVariantList());
     virtual ~VpncUiPlugin();
     SettingWidget * widget(Knm::Connection *, QWidget * parent = 0);
+    SettingWidget * askUser(Knm::Connection *, QWidget * parent = 0);
 };
 
 #endif //  KNM4_VPNC_H
diff --git a/vpnplugins/vpnc/vpncauth.cpp b/vpnplugins/vpnc/vpncauth.cpp
new file mode 100644
index 0000000..4251ca9
--- /dev/null
+++ b/vpnplugins/vpnc/vpncauth.cpp
@@ -0,0 +1,106 @@
+/*
+Copyright 2008 Will Stephenson <wstephenson@kde.org>
+
+This program is free software; you can redistribute it and/or
+modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation; either version 2 of
+the License or (at your option) version 3 or any later version
+accepted by the membership of KDE e.V. (or its successor approved
+by the membership of KDE e.V.), which shall act as a proxy
+defined in Section 14 of version 3 of the license.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "vpncauth.h"
+
+#include <nm-setting-vpn.h>
+
+#include <QString>
+#include "nm-vpnc-service.h"
+
+#include "connection.h"
+
+class VpncAuthWidgetPrivate
+{
+public:
+    Ui_VpncAuth ui;
+    Knm::VpnSetting * setting;
+};
+
+VpncAuthWidget::VpncAuthWidget(Knm::Connection * connection, QWidget * parent)
+: SettingWidget(connection, parent), d_ptr(new VpncAuthWidgetPrivate)
+{
+    Q_D(VpncAuthWidget);
+    d->ui.setupUi(this);
+    d->setting = static_cast<Knm::VpnSetting *>(connection->setting(Knm::Setting::Vpn));
+}
+
+VpncAuthWidget::~VpncAuthWidget()
+{
+
+}
+
+#if 0
+void VpncAuthWidget::readConfig()
+{
+    Q_D(VpncAuthWidget);
+}
+#endif
+
+void VpncAuthWidget::readSecrets()
+{
+    Q_D(VpncAuthWidget);
+    QVariantMap secrets = d->setting->vpnSecrets();
+    QStringMap secretsType = d->setting->secretsStorageType();
+    QString userType;
+    QString groupType;
+
+    /*
+     * First time "old" settings are loaded secretsType map is empty, so
+     * try to read from data as fallback
+     */
+    userType = secretsType.value(NM_VPNC_KEY_XAUTH_PASSWORD_TYPE);
+    if (userType.isNull()) {
+        userType = d->setting->data().value(NM_VPNC_KEY_XAUTH_PASSWORD_TYPE);
+    }
+    if (userType == QLatin1String(NM_VPN_PW_TYPE_SAVE)) {
+        d->ui.leUserPassword->setText(secrets.value(QLatin1String(NM_VPNC_KEY_XAUTH_PASSWORD)).toString());
+        d->ui.leUserPassword->setEnabled(false);
+    }
+
+    groupType = secretsType.value(NM_VPNC_KEY_SECRET_TYPE);
+    if (userType.isNull()) {
+        groupType = d->setting->data().value(NM_VPNC_KEY_SECRET_TYPE);
+    }
+    if (groupType == QLatin1String(NM_VPN_PW_TYPE_SAVE)) {
+        d->ui.leGroupPassword->setText(secrets.value(QLatin1String(NM_VPNC_KEY_SECRET)).toString());
+        d->ui.leGroupPassword->setEnabled(false);
+    }
+}
+
+void VpncAuthWidget::writeConfig()
+{
+    Q_D(VpncAuthWidget);
+
+    QVariantMap secretData;
+
+    //   user password
+    if (!d->ui.leUserPassword->text().isEmpty()) {
+        secretData.insert(NM_VPNC_KEY_XAUTH_PASSWORD, d->ui.leUserPassword->text());
+    }
+    //   group password
+    if (!d->ui.leGroupPassword->text().isEmpty()) {
+        secretData.insert(NM_VPNC_KEY_SECRET, d->ui.leGroupPassword->text());
+    }
+
+    d->setting->setVpnSecrets(secretData);
+}
+
+// vim: sw=4 sts=4 et tw=100
diff --git a/vpnplugins/vpnc/vpncauth.h b/vpnplugins/vpnc/vpncauth.h
new file mode 100644
index 0000000..389b9c3
--- /dev/null
+++ b/vpnplugins/vpnc/vpncauth.h
@@ -0,0 +1,53 @@
+/*
+Copyright 2008 Will Stephenson <wstephenson@kde.org>
+
+This program is free software; you can redistribute it and/or
+modify it under the terms of the GNU General Public License as
+published by the Free Software Foundation; either version 2 of
+the License or (at your option) version 3 or any later version
+accepted by the membership of KDE e.V. (or its successor approved
+by the membership of KDE e.V.), which shall act as a proxy
+defined in Section 14 of version 3 of the license.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef VPNCAUTH_H
+#define VPNCAUTH_H
+
+#include "settingwidget.h"
+
+#include "ui_vpncauth.h"
+#include "settings/vpn.h"
+
+namespace Knm
+{
+    class Connection;
+} // namespace Knm
+
+class VpncAuthWidgetPrivate;
+
+class VpncAuthWidget : public SettingWidget
+{
+Q_OBJECT
+Q_DECLARE_PRIVATE(VpncAuthWidget)
+public:
+    VpncAuthWidget(Knm::Connection *, QWidget * parent = 0);
+    ~VpncAuthWidget();
+    void readConfig() {};
+    void readSecrets();
+    void writeConfig();
+protected Q_SLOTS:
+    void validate() {};
+
+private:
+    VpncAuthWidgetPrivate * d_ptr;
+};
+
+#endif // VPNCAUTH_H
diff --git a/vpnplugins/vpnc/vpncauth.ui b/vpnplugins/vpnc/vpncauth.ui
index 2e89b20..bee07cb 100644
--- a/vpnplugins/vpnc/vpncauth.ui
+++ b/vpnplugins/vpnc/vpncauth.ui
@@ -1,94 +1,89 @@
-<!DOCTYPE UI><UI version="3.2" stdsetdef="1">
-<class>VPNCAuthenticationWidget</class>
-<widget class="QWidget">
-    <property name="name">
-        <cstring>VPNCAuthenticationWidget</cstring>
-    </property>
-    <property name="geometry">
-        <rect>
-            <x>0</x>
-            <y>0</y>
-            <width>372</width>
-            <height>171</height>
-        </rect>
-    </property>
-    <property name="caption">
-        <string>VPNCAuthentication</string>
-    </property>
-    <grid>
-        <property name="name">
-            <cstring>unnamed</cstring>
-        </property>
-        <property name="margin">
-            <number>0</number>
-        </property>
-        <widget class="QLabel" row="0" column="0">
-            <property name="name">
-                <cstring>textLabel1</cstring>
-            </property>
-            <property name="text">
-                <string>Password</string>
-            </property>
-        </widget>
-        <widget class="QLabel" row="1" column="0">
-            <property name="name">
-                <cstring>textLabel2</cstring>
-            </property>
-            <property name="text">
-                <string>Group Password</string>
-            </property>
-        </widget>
-        <spacer row="0" column="2">
-            <property name="name">
-                <cstring>spacer2</cstring>
-            </property>
-            <property name="orientation">
-                <enum>Horizontal</enum>
-            </property>
-            <property name="sizeType">
-                <enum>Expanding</enum>
-            </property>
-            <property name="sizeHint">
-                <size>
-                    <width>40</width>
-                    <height>20</height>
-                </size>
-            </property>
-        </spacer>
-        <spacer row="2" column="1">
-            <property name="name">
-                <cstring>spacer1</cstring>
-            </property>
-            <property name="orientation">
-                <enum>Vertical</enum>
-            </property>
-            <property name="sizeType">
-                <enum>Expanding</enum>
-            </property>
-            <property name="sizeHint">
-                <size>
-                    <width>20</width>
-                    <height>40</height>
-                </size>
-            </property>
-        </spacer>
-        <widget class="KPasswordEdit" row="0" column="1">
-            <property name="name">
-                <cstring>editUserPassword</cstring>
-            </property>
-        </widget>
-        <widget class="KPasswordEdit" row="1" column="1">
-            <property name="name">
-                <cstring>editGroupPassword</cstring>
-            </property>
-        </widget>
-    </grid>
-</widget>
-<customwidgets>
-</customwidgets>
-<layoutdefaults spacing="6" margin="11"/>
-<includehints>
-    
-    
-</includehints>
-</UI>
+<?xml version="1.0" encoding="UTF-8"?>
+<ui version="4.0">
+ <class>VpncAuth</class>
+ <widget class="QWidget" name="VpncAuth">
+  <property name="geometry">
+   <rect>
+    <x>0</x>
+    <y>0</y>
+    <width>372</width>
+    <height>171</height>
+   </rect>
+  </property>
+  <property name="windowTitle">
+   <string>VPNCAuthentication</string>
+  </property>
+  <layout class="QGridLayout">
+   <property name="margin">
+    <number>0</number>
+   </property>
+   <item row="0" column="0">
+    <widget class="QLabel" name="textLabel1">
+     <property name="text">
+      <string>User Password</string>
+     </property>
+     <property name="wordWrap">
+      <bool>false</bool>
+     </property>
+     <property name="buddy">
+      <cstring>leUserPassword</cstring>
+     </property>
+    </widget>
+   </item>
+   <item row="1" column="0">
+    <widget class="QLabel" name="textLabel2">
+     <property name="text">
+      <string>Group Password</string>
+     </property>
+     <property name="wordWrap">
+      <bool>false</bool>
+     </property>
+     <property name="buddy">
+      <cstring>leGroupPassword</cstring>
+     </property>
+    </widget>
+   </item>
+   <item row="0" column="2">
+    <widget class="KLineEdit" name="leUserPassword">
+     <property name="passwordMode">
+      <bool>true</bool>
+     </property>
+    </widget>
+   </item>
+   <item row="2" column="1">
+    <spacer name="spacer1">
+     <property name="orientation">
+      <enum>Qt::Vertical</enum>
+     </property>
+     <property name="sizeType">
+      <enum>QSizePolicy::Expanding</enum>
+     </property>
+     <property name="sizeHint" stdset="0">
+      <size>
+       <width>20</width>
+       <height>40</height>
+      </size>
+     </property>
+    </spacer>
+   </item>
+   <item row="1" column="2">
+    <widget class="KLineEdit" name="leGroupPassword">
+     <property name="passwordMode">
+      <bool>true</bool>
+     </property>
+    </widget>
+   </item>
+  </layout>
+ </widget>
+ <layoutdefault spacing="6" margin="11"/>
+ <pixmapfunction>qPixmapFromMimeSource</pixmapfunction>
+ <customwidgets>
+  <customwidget>
+   <class>KLineEdit</class>
+   <extends>QLineEdit</extends>
+   <header>klineedit.h</header>
+  </customwidget>
+ </customwidgets>
+ <resources/>
+ <connections/>
+</ui>
diff --git a/vpnplugins/vpnc/vpncwidget.cpp b/vpnplugins/vpnc/vpncwidget.cpp
index bc9c48d..71c828b 100644
--- a/vpnplugins/vpnc/vpncwidget.cpp
+++ b/vpnplugins/vpnc/vpncwidget.cpp
@@ -116,12 +116,12 @@ void VpncSettingWidget::readConfig()
     }
 }
 
-void VpncSettingWidget::fillOnePasswordCombo(QComboBox * combo, const QString & key, const QStringMap & data, bool hasPassword)
+void VpncSettingWidget::fillOnePasswordCombo(QComboBox * combo, const QString & type, bool hasPassword)
 {
-    if (data.contains(key)) {
-        if (data.value(key) == NM_VPNC_PW_TYPE_SAVE) {
+    if (!type.isNull()) {
+        if (type == QLatin1String(NM_VPN_PW_TYPE_SAVE)) {
             combo->setCurrentIndex(1);
-        } else if (data.value(key) == NM_VPNC_PW_TYPE_UNUSED) {
+        } else if (type == QLatin1String(NM_VPN_PW_TYPE_UNUSED)) {
             combo->setCurrentIndex(2);
         }
     } else if (!hasPassword) {
@@ -138,6 +138,7 @@ void VpncSettingWidget::writeConfig()
 
     QStringMap data;
     QVariantMap secretData;
+    QStringMap secretsType;
 
     // General settings
     //   gateway
@@ -158,8 +159,8 @@ void VpncSettingWidget::writeConfig()
     if (!d->ui.leGroupPassword->text().isEmpty() && d->ui.cboGroupPassOptions->currentIndex() == 1) {
         secretData.insert(NM_VPNC_KEY_SECRET, d->ui.leGroupPassword->text());
     }
-    handleOnePasswordType(d->ui.cboUserPassOptions, NM_VPNC_KEY_XAUTH_PASSWORD_TYPE, data);
-    handleOnePasswordType(d->ui.cboGroupPassOptions, NM_VPNC_KEY_SECRET_TYPE, data);
+    handleOnePasswordType(d->ui.cboUserPassOptions, NM_VPNC_KEY_XAUTH_PASSWORD_TYPE, secretsType);
+    handleOnePasswordType(d->ui.cboGroupPassOptions, NM_VPNC_KEY_SECRET_TYPE, secretsType);
 
     // Optional settings
     //   username
@@ -207,6 +208,7 @@ void VpncSettingWidget::writeConfig()
 
     d->setting->setData(data);
     d->setting->setVpnSecrets(secretData);
+    d->setting->setSecretsStorageType(secretsType);
 }
 
 uint VpncSettingWidget::handleOnePasswordType(const QComboBox * combo, const QString & key, QStringMap & data)
@@ -214,13 +216,13 @@ uint VpncSettingWidget::handleOnePasswordType(const QComboBox * combo, const QSt
     uint type = combo->currentIndex();
     switch (type) {
         case 0:
-            data.insert(key, NM_VPNC_PW_TYPE_ASK);
+            data.insert(key, NM_VPN_PW_TYPE_ASK);
             break;
         case 1:
-            data.insert(key, NM_VPNC_PW_TYPE_SAVE);
+            data.insert(key, NM_VPN_PW_TYPE_SAVE);
             break;
         case 2:
-            data.insert(key, NM_VPNC_PW_TYPE_UNUSED);
+            data.insert(key, NM_VPN_PW_TYPE_UNUSED);
             break;
     }
     return type;
@@ -230,15 +232,31 @@ void VpncSettingWidget::readSecrets()
 {
     Q_D(VpncSettingWidget);
     QVariantMap secrets = d->setting->vpnSecrets();
-    if (d->setting->data().value(NM_VPNC_KEY_XAUTH_PASSWORD_TYPE) == QLatin1String(NM_VPNC_PW_TYPE_SAVE)) {
+    QStringMap secretsType = d->setting->secretsStorageType();
+    QString userType;
+    QString groupType;
+
+    /*
+     * First time "old" settings are loaded secretsType map is empty, so
+     * try to read from data as fallback
+     */
+    userType = secretsType.value(NM_VPNC_KEY_XAUTH_PASSWORD_TYPE);
+    if (userType.isNull()) {
+        userType = d->setting->data().value(NM_VPNC_KEY_XAUTH_PASSWORD_TYPE);
+    }
+    if (userType == QLatin1String(NM_VPN_PW_TYPE_SAVE)) {
         d->ui.leUserPassword->setText(secrets.value(QLatin1String(NM_VPNC_KEY_XAUTH_PASSWORD)).toString());
     }
-    fillOnePasswordCombo(d->ui.cboUserPassOptions, NM_VPNC_KEY_XAUTH_PASSWORD_TYPE, d->setting->data(), !d->ui.leUserName->text().isEmpty());
+    fillOnePasswordCombo(d->ui.cboUserPassOptions, userType, !d->ui.leUserName->text().isEmpty());
 
-    if (d->setting->data().value(NM_VPNC_KEY_SECRET_TYPE) == QLatin1String(NM_VPNC_PW_TYPE_SAVE)) {
+    groupType = secretsType.value(NM_VPNC_KEY_SECRET_TYPE);
+    if (userType.isNull()) {
+        groupType = d->setting->data().value(NM_VPNC_KEY_SECRET_TYPE);
+    }
+    if (groupType == QLatin1String(NM_VPN_PW_TYPE_SAVE)) {
         d->ui.leGroupPassword->setText(secrets.value(QLatin1String(NM_VPNC_KEY_SECRET)).toString());
     }
-    fillOnePasswordCombo(d->ui.cboGroupPassOptions, NM_VPNC_KEY_SECRET_TYPE, d->setting->data(), !d->ui.leGroupPassword->text().isEmpty());
+    fillOnePasswordCombo(d->ui.cboGroupPassOptions, groupType, !d->ui.leGroupPassword->text().isEmpty());
 }
 
 void VpncSettingWidget::validate()
diff --git a/vpnplugins/vpnc/vpncwidget.h b/vpnplugins/vpnc/vpncwidget.h
index 49ca38e..568ccf5 100644
--- a/vpnplugins/vpnc/vpncwidget.h
+++ b/vpnplugins/vpnc/vpncwidget.h
@@ -24,6 +24,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #include "settingwidget.h"
 
 #include "ui_vpncprop.h"
+#include "ui_vpncauth.h"
 #include "settings/vpn.h"
 
 namespace Knm
@@ -48,7 +49,7 @@ protected Q_SLOTS:
     void groupPasswordTypeChanged(int);
     void validate();
 private:
-    void fillOnePasswordCombo(QComboBox * combo, const QString & key, const QStringMap & data, bool hasPassword);
+    void fillOnePasswordCombo(QComboBox * combo, const QString & type, bool hasPassword);
     uint handleOnePasswordType(const QComboBox * combo, const QString & key, QStringMap & data);
     VpncSettingWidgetPrivate * d_ptr;
 };