diff --git a/install/ui/src/freeipa/host.js b/install/ui/src/freeipa/host.js
index 492cf3d95..a4d18e17d 100644
--- a/install/ui/src/freeipa/host.js
+++ b/install/ui/src/freeipa/host.js
@@ -117,19 +117,25 @@ return {
                             flags: ['w_if_no_aci']
                         },
                         {
-                            $type: 'custom_checkboxes',
+                            $type: 'checkboxes',
                             label: '@i18n:authtype.auth_indicators',
                             name: 'krbprincipalauthind',
-                            add_dialog_title: '@i18n:authtype.custom_auth_ind_title',
-                            add_field_label: '@i18n:authtype.auth_indicator',
                             options: [
                                 {
-                                    label: 'otp',
+                                    label: '@i18n:authtype.type_otp',
                                     value: 'otp'
                                 },
                                 {
-                                    label: 'radius',
+                                    label: '@i18n:authtype.type_radius',
                                     value: 'radius'
+                                },
+                                {
+                                    label: '@i18n:authtype.type_pkinit',
+                                    value: 'pkinit'
+                                },
+                                {
+                                    label: '@i18n:authtype.type_hardened',
+                                    value: 'hardened'
                                 }
                             ],
                             tooltip: {
diff --git a/install/ui/src/freeipa/serverconfig.js b/install/ui/src/freeipa/serverconfig.js
index 6c82b40d1..bdf279cf6 100644
--- a/install/ui/src/freeipa/serverconfig.js
+++ b/install/ui/src/freeipa/serverconfig.js
@@ -103,7 +103,9 @@ return {
                                 { label: '@i18n:authtype.type_disabled', value: 'disabled' },
                                 { label: '@i18n:authtype.type_password', value: 'password' },
                                 { label: '@i18n:authtype.type_radius', value: 'radius' },
-                                { label: '@i18n:authtype.type_otp', value: 'otp' }
+                                { label: '@i18n:authtype.type_otp', value: 'otp' },
+                                { label: '@i18n:authtype.type_pkinit', value: 'pkinit' },
+                                { label: '@i18n:authtype.type_hardened', value: 'hardened' }
                             ],
                             tooltip: {
                                 title: '@i18n:authtype.config_tooltip',
diff --git a/install/ui/src/freeipa/service.js b/install/ui/src/freeipa/service.js
index 780ae1b25..47881a0a8 100644
--- a/install/ui/src/freeipa/service.js
+++ b/install/ui/src/freeipa/service.js
@@ -127,19 +127,25 @@ return {
                             ]
                         },
                         {
-                            $type: 'custom_checkboxes',
+                            $type: 'checkboxes',
                             label: '@i18n:authtype.auth_indicators',
                             name: 'krbprincipalauthind',
-                            add_dialog_title: '@i18n:authtype.custom_auth_ind_title',
-                            add_field_label: '@i18n:authtype.auth_indicator',
                             options: [
                                 {
-                                    label: 'otp',
+                                    label: '@i18n:authtype.type_otp',
                                     value: 'otp'
                                 },
                                 {
-                                    label: 'radius',
+                                    label: '@i18n:authtype.type_radius',
                                     value: 'radius'
+                                },
+                                {
+                                    label: '@i18n:authtype.type_pkinit',
+                                    value: 'pkinit'
+                                },
+                                {
+                                    label: '@i18n:authtype.type_hardened',
+                                    value: 'hardened'
                                 }
                             ],
                             tooltip: {
diff --git a/install/ui/src/freeipa/stageuser.js b/install/ui/src/freeipa/stageuser.js
index 2f3e3c1e5..851a4a9e5 100644
--- a/install/ui/src/freeipa/stageuser.js
+++ b/install/ui/src/freeipa/stageuser.js
@@ -169,7 +169,9 @@ return {
                             options: [
                                 { label: '@i18n:authtype.type_password', value: 'password' },
                                 { label: '@i18n:authtype.type_radius', value: 'radius' },
-                                { label: '@i18n:authtype.type_otp', value: 'otp' }
+                                { label: '@i18n:authtype.type_otp', value: 'otp' },
+                                { label: '@i18n:authtype.type_pkinit', value: 'pkinit' },
+                                { label: '@i18n:authtype.type_hardened', value: 'hardened' }
                             ],
                             tooltip: '@i18n:authtype.user_tooltip'
                         },
diff --git a/install/ui/src/freeipa/user.js b/install/ui/src/freeipa/user.js
index 021167253..714e55d4e 100644
--- a/install/ui/src/freeipa/user.js
+++ b/install/ui/src/freeipa/user.js
@@ -237,7 +237,9 @@ return {
                             options: [
                                 { label: '@i18n:authtype.type_password', value: 'password' },
                                 { label: '@i18n:authtype.type_radius', value: 'radius' },
-                                { label: '@i18n:authtype.type_otp', value: 'otp' }
+                                { label: '@i18n:authtype.type_otp', value: 'otp' },
+                                { label: '@i18n:authtype.type_pkinit', value: 'pkinit' },
+                                { label: '@i18n:authtype.type_hardened', value: 'hardened' }
                             ],
                             tooltip: {
                                 title: '@i18n:authtype.user_tooltip',
diff --git a/install/ui/test/data/i18n_messages.json b/install/ui/test/data/i18n_messages.json
index 34974b2e6..1f7ae4a35 100644
--- a/install/ui/test/data/i18n_messages.json
+++ b/install/ui/test/data/i18n_messages.json
@@ -58,6 +58,8 @@
                 "type_otp": "Two factor authentication (password + OTP)", 
                 "type_password": "Password", 
                 "type_radius": "RADIUS", 
+                "type_pkinit": "PKINIT", 
+                "type_hardened": "Hardened Password (by SPAKE or FAST)", 
                 "user_tooltip": "<p>Per-user setting, overwrites the global setting if any option is checked.</p><p><strong>Password + Two-factor:</strong> LDAP and Kerberos allow authentication with either one of the authentication types but Kerberos uses pre-authentication method which requires to use armor ccache.</p><p><strong>RADIUS with another type:</strong> Kerberos always use RADIUS, but LDAP never does. LDAP only recognize the password and two-factor authentication options.</p>"
             }, 
             "buttons": {
@@ -842,4 +844,4 @@
         }
     }, 
     "version": "4.6.90.pre2"
-}
\ No newline at end of file
+}
diff --git a/ipaserver/plugins/internal.py b/ipaserver/plugins/internal.py
index 19957d7f7..8b7356e36 100644
--- a/ipaserver/plugins/internal.py
+++ b/ipaserver/plugins/internal.py
@@ -189,6 +189,8 @@ class i18n_messages(Command):
             "type_otp": _("Two factor authentication (password + OTP)"),
             "type_password": _("Password"),
             "type_radius": _("RADIUS"),
+            "type_pkinit": _("PKINIT"),
+            "type_hardened": _("Hardened Password (by SPAKE or FAST)"),
             "type_disabled": _("Disable per-user override"),
             "user_tooltip": _("<p>Per-user setting, overwrites the global setting if any option is checked.</p><p><strong>Password + Two-factor:</strong> LDAP and Kerberos allow authentication with either one of the authentication types but Kerberos uses pre-authentication method which requires to use armor ccache.</p><p><strong>RADIUS with another type:</strong> Kerberos always use RADIUS, but LDAP never does. LDAP only recognize the password and two-factor authentication options.</p>"),
         },