diff --git a/core/cron.php b/core/cron.php
new file mode 100644
index 0000000..126d991
--- /dev/null
+++ b/core/cron.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @file
+ * Handles incoming requests to fire off regularly-scheduled tasks (cron jobs).
+ */
+
+// Change the directory to the Drupal root.
+chdir('..');
+
+/**
+ * Root directory of Drupal installation.
+ */
+define('DRUPAL_ROOT', getcwd());
+
+include_once DRUPAL_ROOT . '/core/includes/bootstrap.inc';
+drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
+
+if (!isset($_GET['cron_key']) || variable_get('cron_key', 'drupal') != $_GET['cron_key']) {
+  watchdog('cron', 'Cron could not run because an invalid key was used.', array(), WATCHDOG_NOTICE);
+  drupal_access_denied();
+}
+elseif (config('system.maintenance')->get('maintenance_mode')) {
+  watchdog('cron', 'Cron could not run because the site is in maintenance mode.', array(), WATCHDOG_NOTICE);
+  drupal_access_denied();
+}
+else {
+  drupal_cron_run();
+}
diff --git a/core/includes/ajax.inc b/core/includes/ajax.inc
index a20acd8..83d6f3b 100644
--- a/core/includes/ajax.inc
+++ b/core/includes/ajax.inc
@@ -515,8 +515,7 @@ function ajax_prepare_response($page_callback_result) {
         break;
 
       case MENU_SITE_OFFLINE:
-        $commands[] = ajax_command_alert(filter_xss_admin(variable_get('maintenance_mode_message',
-          t('@site is currently under maintenance. We should be back shortly. Thank you for your patience.', array('@site' => variable_get('site_name', 'Drupal'))))));
+        $commands[] = ajax_command_alert(filter_xss_admin(t(config('system.maintenance')->get('maintenance_mode_message'), array('@site' => variable_get('site_name', 'Drupal')))));
         break;
     }
   }
diff --git a/core/includes/common.inc b/core/includes/common.inc
index 4a8b1f0..3e03d01 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -2531,8 +2531,7 @@ function drupal_deliver_html_page($page_callback_result) {
         drupal_maintenance_theme();
         drupal_add_http_header('Status', '503 Service unavailable');
         drupal_set_title(t('Site under maintenance'));
-        print theme('maintenance_page', array('content' => filter_xss_admin(variable_get('maintenance_mode_message',
-          t('@site is currently under maintenance. We should be back shortly. Thank you for your patience.', array('@site' => variable_get('site_name', 'Drupal')))))));
+        print theme('maintenance_page', array('content' => filter_xss_admin(t(config('system.maintenance')->get('maintenance_mode_message'), array('@site' => variable_get('site_name', 'Drupal'))))));
         break;
     }
   }
diff --git a/core/includes/menu.inc b/core/includes/menu.inc
index 0c18a60..48d6c76 100644
--- a/core/includes/menu.inc
+++ b/core/includes/menu.inc
@@ -3809,7 +3809,7 @@ function _menu_router_save($menu, $masks) {
  */
 function _menu_site_is_offline($check_only = FALSE) {
   // Check if site is in maintenance mode.
-  if (variable_get('maintenance_mode', 0)) {
+  if (config('system.maintenance')->get('maintenance_mode')) {
     if (user_access('access site in maintenance mode')) {
       // Ensure that the maintenance mode message is displayed only once
       // (allowing for page redirects) and specifically suppress its display on
diff --git a/core/includes/update.inc b/core/includes/update.inc
index b0d09a7..8684a70 100644
--- a/core/includes/update.inc
+++ b/core/includes/update.inc
@@ -108,6 +108,8 @@ function update_prepare_d8_bootstrap() {
       // Update the dynamic include paths that might be used before running the
       // proper update functions.
       update_prepare_stored_includes();
+      // Update the environment for the new configuration system.
+      update_prepare_d8_configuration();
       // Update the environment for the language bootstrap if needed.
       update_prepare_d8_language();
 
@@ -151,6 +153,18 @@ function update_prepare_stored_includes() {
 }
 
 /**
+ * Prepare Drupal 8 for configuration system.
+ */
+function update_prepare_d8_configuration() {
+  if (!db_table_exists('config')) {
+    module_load_include('install', 'system');
+    $system_schema = system_schema();
+    db_create_table('config', $system_schema['config']);
+    update_variables_to_config('system.maintenance');
+  }
+}
+
+/**
  * Prepare Drupal 8 language changes for the bootstrap if needed.
  */
 function update_prepare_d8_language() {
@@ -429,9 +443,9 @@ function update_do_one($module, $number, $dependency_map, &$context) {
 function update_batch($start, $redirect = NULL, $url = NULL, $batch = array(), $redirect_callback = 'drupal_goto') {
   // During the update, bring the site offline so that schema changes do not
   // affect visiting users.
-  $_SESSION['maintenance_mode'] = variable_get('maintenance_mode', FALSE);
+  $_SESSION['maintenance_mode'] = config('system.maintenance')->get('maintenance_mode');
   if ($_SESSION['maintenance_mode'] == FALSE) {
-    variable_set('maintenance_mode', TRUE);
+    config('system.maintenance')->set('maintenance_mode', TRUE)->save();
   }
 
   // Resolve any update dependencies to determine the actual updates that will
@@ -502,7 +516,7 @@ function update_finished($success, $results, $operations) {
   // Now that the update is done, we can put the site back online if it was
   // previously in maintenance mode.
   if (isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) {
-    variable_set('maintenance_mode', FALSE);
+    config('system.maintenance')->set('maintenance_mode', FALSE)->save();
     unset($_SESSION['maintenance_mode']);
   }
 }
diff --git a/core/modules/openid/lib/Drupal/openid/Tests/OpenIDFunctionalTest.php b/core/modules/openid/lib/Drupal/openid/Tests/OpenIDFunctionalTest.php
index edf7fd8..417487e 100644
--- a/core/modules/openid/lib/Drupal/openid/Tests/OpenIDFunctionalTest.php
+++ b/core/modules/openid/lib/Drupal/openid/Tests/OpenIDFunctionalTest.php
@@ -189,7 +189,7 @@ class OpenIDFunctionalTest extends OpenIDTestBase {
     $this->drupalLogout();
 
     // Enable maintenance mode.
-    variable_set('maintenance_mode', 1);
+    config('system.maintenance')->set('maintenance_mode', TRUE)->save();
 
     // Test logging in via the user/login page while the site is offline.
     $edit = array('openid_identifier' => $identity);
diff --git a/core/modules/openid/openid.test b/core/modules/openid/openid.test
new file mode 100644
index 0000000..06411a4
--- /dev/null
+++ b/core/modules/openid/openid.test
@@ -0,0 +1,842 @@
+<?php
+
+/**
+ * @file
+ * Tests for openid.module.
+ */
+
+/**
+ * Base class for OpenID tests.
+ */
+abstract class OpenIDWebTestCase extends DrupalWebTestCase {
+  function setUp() {
+    $modules = func_get_args();
+    if (isset($modules[0]) && is_array($modules[0])) {
+      $modules = $modules[0];
+    }
+    $modules[] = 'block';
+    $modules[] = 'openid';
+    parent::setUp($modules);
+
+    // Enable user login block.
+    db_merge('block')
+      ->key(array(
+        'module' => 'user',
+        'delta' => 'login',
+        'theme' => variable_get('theme_default', 'stark'),
+      ))
+      ->fields(array(
+        'status' => 1,
+        'weight' => 0,
+        'region' => 'sidebar_first',
+        'pages' => '',
+        'cache' => -1,
+      ))
+      ->execute();
+
+    // Create Basic page and Article node types.
+    if ($this->profile != 'standard') {
+      $this->drupalCreateContentType(array('type' => 'page', 'name' => 'Basic page'));
+      $this->drupalCreateContentType(array('type' => 'article', 'name' => 'Article'));
+    }
+  }
+
+  /**
+   * Initiates the login procedure using the specified User-supplied Identity.
+   */
+  function submitLoginForm($identity) {
+    // Fill out and submit the login form.
+    $edit = array('openid_identifier' => $identity);
+    $this->drupalPost('', $edit, t('Log in'));
+
+    // Check we are on the OpenID redirect form.
+    $this->assertTitle(t('OpenID redirect'), t('OpenID redirect page was displayed.'));
+
+    // Submit form to the OpenID Provider Endpoint.
+    $this->drupalPost(NULL, array(), t('Send'));
+  }
+
+  /**
+   * Parses the last sent e-mail and returns the one-time login link URL.
+   */
+  function getPasswordResetURLFromMail() {
+    $mails = $this->drupalGetMails();
+    $mail = end($mails);
+    preg_match('@.+user/reset/.+@', $mail['body'], $matches);
+    return $matches[0];
+  }
+}
+
+/**
+ * Test discovery and login using OpenID
+ */
+class OpenIDFunctionalTestCase extends OpenIDWebTestCase {
+  protected $web_user;
+
+  public static function getInfo() {
+    return array(
+      'name' => 'OpenID discovery and login',
+      'description' => "Adds an identity to a user's profile and uses it to log in.",
+      'group' => 'OpenID'
+    );
+  }
+
+  function setUp() {
+    parent::setUp('openid', 'openid_test');
+
+    // User doesn't need special permissions; only the ability to log in.
+    $this->web_user = $this->drupalCreateUser(array());
+  }
+
+  /**
+   * Test discovery of OpenID Provider Endpoint via Yadis and HTML.
+   */
+  function testDiscovery() {
+    $this->drupalLogin($this->web_user);
+
+    // The User-supplied Identifier entered by the user may indicate the URL of
+    // the OpenID Provider Endpoint in various ways, as described in OpenID
+    // Authentication 2.0 and Yadis Specification 1.0.
+    // Note that all of the tested identifiers refer to the same endpoint, so
+    // only the first will trigger an associate request in openid_association()
+    // (association is only done the first time Drupal encounters a given
+    // endpoint).
+
+
+    // Yadis discovery (see Yadis Specification 1.0, section 6.2.5):
+    // If the User-supplied Identifier is a URL, it may be a direct or indirect
+    // reference to an XRDS document (a Yadis Resource Descriptor) that contains
+    // the URL of the OpenID Provider Endpoint.
+
+    // Identifier is the URL of an XRDS document.
+    // On HTTP test environments, the URL scheme is stripped in order to test
+    // that the supplied identifier is normalized in openid_begin().
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->addIdentity(preg_replace('@^http://@', '', $identity), 2, 'http://example.com/xrds', $identity);
+
+    $identity = url('openid-test/yadis/xrds/delegate', array('absolute' => TRUE));
+    $this->addIdentity(preg_replace('@^http://@', '', $identity), 2, 'http://example.com/xrds-delegate', $identity);
+
+    // Identifier is the URL of an XRDS document containing an OP Identifier
+    // Element. The Relying Party sends the special value
+    // "http://specs.openid.net/auth/2.0/identifier_select" as Claimed
+    // Identifier. The OpenID Provider responds with the actual identifier
+    // including the fragment.
+    $identity = url('openid-test/yadis/xrds/dummy-user', array('absolute' => TRUE, 'fragment' => $this->randomName()));
+    // Tell openid_test.module to respond with this identifier. If the fragment
+    // part is present in the identifier, it should be retained.
+    variable_set('openid_test_response', array('openid.claimed_id' => $identity));
+    $this->addIdentity(url('openid-test/yadis/xrds/server', array('absolute' => TRUE)), 2, 'http://specs.openid.net/auth/2.0/identifier_select', $identity);
+    variable_set('openid_test_response', array());
+
+    // Identifier is the URL of an HTML page that is sent with an HTTP header
+    // that contains the URL of an XRDS document.
+    $this->addIdentity(url('openid-test/yadis/x-xrds-location', array('absolute' => TRUE)), 2);
+
+    // Identifier is the URL of an HTML page containing a <meta http-equiv=...>
+    // element that contains the URL of an XRDS document.
+    $this->addIdentity(url('openid-test/yadis/http-equiv', array('absolute' => TRUE)), 2);
+
+    // Identifier is an XRI. Resolve using our own dummy proxy resolver.
+    variable_set('xri_proxy_resolver', url('openid-test/yadis/xrds/xri', array('absolute' => TRUE)) . '/');
+    $this->addIdentity('@example*résumé;%25', 2, 'http://example.com/xrds', 'http://example.com/user');
+
+    // Make sure that unverified CanonicalID are not trusted.
+    variable_set('openid_test_canonical_id_status', 'bad value');
+    $this->addIdentity('@example*résumé;%25', 2, FALSE, FALSE);
+
+    // HTML-based discovery:
+    // If the User-supplied Identifier is a URL of an HTML page, the page may
+    // contain a <link rel=...> element containing the URL of the OpenID
+    // Provider Endpoint. OpenID 1 and 2 describe slightly different formats.
+
+    // OpenID Authentication 1.1, section 3.1:
+    $this->addIdentity(url('openid-test/html/openid1', array('absolute' => TRUE)), 1, 'http://example.com/html-openid1');
+
+    // OpenID Authentication 2.0, section 7.3.3:
+    $this->addIdentity(url('openid-test/html/openid2', array('absolute' => TRUE)), 2, 'http://example.com/html-openid2');
+
+    // OpenID Authentication 2.0, section 7.2.4:
+    // URL Identifiers MUST then be further normalized by both (1) following
+    // redirects when retrieving their content and finally (2) applying the
+    // rules in Section 6 of RFC3986 to the final destination URL. This final
+    // URL MUST be noted by the Relying Party as the Claimed Identifier and be
+    // used when requesting authentication.
+
+    // Single redirect.
+    $identity = $expected_claimed_id = url('openid-test/redirected/yadis/xrds/1', array('absolute' => TRUE));
+    $this->addRedirectedIdentity($identity, 2, 'http://example.com/xrds', $expected_claimed_id, 0);
+
+    // Exact 3 redirects (default value for the 'max_redirects' option in
+    // drupal_http_request()).
+    $identity = $expected_claimed_id = url('openid-test/redirected/yadis/xrds/2', array('absolute' => TRUE));
+    $this->addRedirectedIdentity($identity, 2, 'http://example.com/xrds', $expected_claimed_id, 2);
+
+    // Fails because there are more than 3 redirects (default value for the
+    // 'max_redirects' option in drupal_http_request()).
+    $identity = url('openid-test/redirected/yadis/xrds/3', array('absolute' => TRUE));
+    $expected_claimed_id = FALSE;
+    $this->addRedirectedIdentity($identity, 2, 'http://example.com/xrds', $expected_claimed_id, 3);
+  }
+
+  /**
+   * Test login using OpenID.
+   */
+  function testLogin() {
+    $this->drupalLogin($this->web_user);
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->addIdentity($identity);
+    $response = variable_get('openid_test_hook_openid_response_response');
+    $account = variable_get('openid_test_hook_openid_response_account');
+    $this->assertEqual($response['openid.claimed_id'], $identity, t('hook_openid_response() was invoked.'));
+    $this->assertEqual($account->uid, $this->web_user->uid, t('Proper user object passed to hook_openid_response().'));
+
+    $this->drupalLogout();
+
+    // Test logging in via the login block on the front page.
+    variable_del('openid_test_hook_openid_response_response');
+    variable_del('openid_test_hook_openid_response_account');
+    $this->submitLoginForm($identity);
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+    $response = variable_get('openid_test_hook_openid_response_response');
+    $account = variable_get('openid_test_hook_openid_response_account');
+    $this->assertEqual($response['openid.claimed_id'], $identity, t('hook_openid_response() was invoked.'));
+    $this->assertEqual($account->uid, $this->web_user->uid, t('Proper user object passed to hook_openid_response().'));
+
+    $this->drupalLogout();
+
+    // Test logging in via the user/login page.
+    $edit = array('openid_identifier' => $identity);
+    $this->drupalPost('user/login', $edit, t('Log in'));
+
+    // Check we are on the OpenID redirect form.
+    $this->assertTitle(t('OpenID redirect'), t('OpenID redirect page was displayed.'));
+
+    // Submit form to the OpenID Provider Endpoint.
+    $this->drupalPost(NULL, array(), t('Send'));
+
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+
+    // Verify user was redirected away from user/login to an accessible page.
+    $this->assertResponse(200);
+
+    $this->drupalLogout();
+
+    // Tell openid_test.module to alter the checkid_setup request.
+    $new_identity = 'http://example.com/' . $this->randomName();
+    variable_set('openid_test_identity', $new_identity);
+    variable_set('openid_test_request_alter', array('checkid_setup' => array('openid.identity' => $new_identity)));
+    $this->submitLoginForm($identity);
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+    $response = variable_get('openid_test_hook_openid_response_response');
+    $this->assertEqual($response['openid.identity'], $new_identity, t('hook_openid_request_alter() were invoked.'));
+  }
+
+  /**
+   * Test login using OpenID during maintenance mode.
+   */
+  function testLoginMaintenanceMode() {
+    $this->web_user = $this->drupalCreateUser(array('access site in maintenance mode'));
+    $this->drupalLogin($this->web_user);
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->addIdentity($identity);
+    $this->drupalLogout();
+
+    // Enable maintenance mode.
+    config('system.maintenance')->set('maintenance_mode', TRUE)->save();
+
+    // Test logging in via the user/login page while the site is offline.
+    $edit = array('openid_identifier' => $identity);
+    $this->drupalPost('user/login', $edit, t('Log in'));
+
+    // Check we are on the OpenID redirect form.
+    $this->assertTitle(t('OpenID redirect'), t('OpenID redirect page was displayed.'));
+
+    // Submit form to the OpenID Provider Endpoint.
+    $this->drupalPost(NULL, array(), t('Send'));
+
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+
+    // Verify user was redirected away from user/login to an accessible page.
+    $this->assertText(t('Operating in maintenance mode.'));
+    $this->assertResponse(200);
+  }
+
+  /**
+   * Test deleting an OpenID identity from a user's profile.
+   */
+  function testDelete() {
+    $this->drupalLogin($this->web_user);
+
+    // Add identity to user's profile.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->addIdentity($identity);
+    $this->assertText($identity, t('Identity appears in list.'));
+
+    // Delete the newly added identity.
+    $this->clickLink(t('Delete'));
+    $this->drupalPost(NULL, array(), t('Confirm'));
+
+    $this->assertText(t('OpenID deleted.'), t('Identity deleted'));
+    $this->assertNoText($identity, t('Identity no longer appears in list.'));
+  }
+
+  /**
+   * Test that a blocked user cannot log in.
+   */
+  function testBlockedUserLogin() {
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+
+    // Log in and add an OpenID Identity to the account.
+    $this->drupalLogin($this->web_user);
+    $this->addIdentity($identity);
+    $this->drupalLogout();
+
+    // Log in as an admin user and block the account.
+    $admin_user = $this->drupalCreateUser(array('administer users'));
+    $this->drupalLogin($admin_user);
+    $this->drupalGet('admin/people');
+    $edit = array(
+      'operation' => 'block',
+      'accounts[' . $this->web_user->uid . ']' => TRUE,
+    );
+    $this->drupalPost('admin/people', $edit, t('Update'));
+    $this->assertRaw('The update has been performed.', t('Account was blocked.'));
+    $this->drupalLogout();
+
+    $this->submitLoginForm($identity);
+    $this->assertRaw(t('The username %name has not been activated or is blocked.', array('%name' => $this->web_user->name)), t('User login was blocked.'));
+  }
+
+  /**
+   * Add OpenID identity to user's profile.
+   *
+   * @param $identity
+   *   The User-supplied Identifier.
+   * @param $version
+   *   The protocol version used by the service.
+   * @param $local_id
+   *   The expected OP-Local Identifier found during discovery.
+   * @param $claimed_id
+   *   The expected Claimed Identifier returned by the OpenID Provider, or FALSE
+   *   if the discovery is expected to fail.
+   */
+  function addIdentity($identity, $version = 2, $local_id = 'http://example.com/xrds', $claimed_id = NULL) {
+    // Tell openid_test.module to only accept this OP-Local Identifier.
+    variable_set('openid_test_identity', $local_id);
+
+    $edit = array('openid_identifier' => $identity);
+    $this->drupalPost('user/' . $this->web_user->uid . '/openid', $edit, t('Add an OpenID'));
+
+    if ($claimed_id === FALSE) {
+      $this->assertRaw(t('Sorry, that is not a valid OpenID. Ensure you have spelled your ID correctly.'), t('Invalid identity was rejected.'));
+      return;
+    }
+
+    // OpenID 1 used a HTTP redirect, OpenID 2 uses a HTML form that is submitted automatically using JavaScript.
+    if ($version == 2) {
+      // Check we are on the OpenID redirect form.
+      $this->assertTitle(t('OpenID redirect'), t('OpenID redirect page was displayed.'));
+
+      // Submit form to the OpenID Provider Endpoint.
+      $this->drupalPost(NULL, array(), t('Send'));
+    }
+
+    if (!isset($claimed_id)) {
+      $claimed_id = $identity;
+    }
+    $this->assertRaw(t('Successfully added %identity', array('%identity' => $claimed_id)), t('Identity %identity was added.', array('%identity' => $identity)));
+  }
+
+  /**
+   * Add OpenID identity, changed by the following redirects, to user's profile.
+   *
+   * According to OpenID Authentication 2.0, section 7.2.4, URL Identifiers MUST
+   * be further normalized by following redirects when retrieving their content
+   * and this final URL MUST be noted by the Relying Party as the Claimed
+   * Identifier and be used when requesting authentication.
+   *
+   * @param $identity
+   *   The User-supplied Identifier.
+   * @param $version
+   *   The protocol version used by the service.
+   * @param $local_id
+   *   The expected OP-Local Identifier found during discovery.
+   * @param $claimed_id
+   *   The expected Claimed Identifier returned by the OpenID Provider, or FALSE
+   *   if the discovery is expected to fail.
+   * @param $redirects
+   *   The number of redirects.
+   */
+  function addRedirectedIdentity($identity, $version = 2, $local_id = 'http://example.com/xrds', $claimed_id = NULL, $redirects = 0) {
+    // Set the final destination URL which is the same as the Claimed
+    // Identifier, we insert the same identifier also to the provider response,
+    // but provider could further change the Claimed ID actually (e.g. it could
+    // add unique fragment).
+    variable_set('openid_test_redirect_url', $identity);
+    variable_set('openid_test_response', array('openid.claimed_id' => $identity));
+
+    $this->addIdentity(url('openid-test/redirect/' . $redirects, array('absolute' => TRUE)), $version, $local_id, $claimed_id);
+
+    // Clean up.
+    variable_del('openid_test_redirect_url');
+    variable_del('openid_test_response');
+  }
+
+  /**
+   * Tests that openid.signed is verified.
+   */
+  function testSignatureValidation() {
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+
+    // Respond with an invalid signature.
+    variable_set('openid_test_response', array('openid.sig' => 'this-is-an-invalid-signature'));
+    $this->submitLoginForm($identity);
+    $this->assertRaw('OpenID login failed.');
+
+    // Do not sign the mandatory field openid.assoc_handle.
+    variable_set('openid_test_response', array('openid.signed' => 'op_endpoint,claimed_id,identity,return_to,response_nonce'));
+    $this->submitLoginForm($identity);
+    $this->assertRaw('OpenID login failed.');
+
+    // Sign all mandatory fields and a custom field.
+    $keys_to_sign = array('op_endpoint', 'claimed_id', 'identity', 'return_to', 'response_nonce', 'assoc_handle', 'foo');
+    $association = new stdClass();
+    $association->mac_key = variable_get('mac_key');
+    $response = array(
+      'openid.op_endpoint' => url('openid-test/endpoint', array('absolute' => TRUE)),
+      'openid.claimed_id' => $identity,
+      'openid.identity' => $identity,
+      'openid.return_to' => url('openid/authenticate', array('absolute' => TRUE)),
+      'openid.response_nonce' => _openid_nonce(),
+      'openid.assoc_handle' => 'openid-test',
+      'openid.foo' => 123,
+      'openid.signed' => implode(',', $keys_to_sign),
+    );
+    $response['openid.sig'] = _openid_signature($association, $response, $keys_to_sign);
+    variable_set('openid_test_response', $response);
+    $this->submitLoginForm($identity);
+    $this->assertNoRaw('OpenID login failed.');
+    $this->assertFieldByName('name', '', t('No username was supplied by provider.'));
+    $this->assertFieldByName('mail', '', t('No e-mail address was supplied by provider.'));
+
+    // Check that unsigned SREG fields are ignored.
+    $response = array(
+      'openid.signed' => 'op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle,sreg.nickname',
+      'openid.sreg.nickname' => 'john',
+      'openid.sreg.email' => 'john@example.com',
+    );
+    variable_set('openid_test_response', $response);
+    $this->submitLoginForm($identity);
+    $this->assertNoRaw('OpenID login failed.');
+    $this->assertFieldByName('name', 'john', t('Username was supplied by provider.'));
+    $this->assertFieldByName('mail', '', t('E-mail address supplied by provider was ignored.'));
+  }
+}
+
+/**
+ * Test account registration using Simple Registration and Attribute Exchange.
+ */
+class OpenIDRegistrationTestCase extends OpenIDWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'OpenID account registration',
+      'description' => 'Creates a user account using auto-registration.',
+      'group' => 'OpenID'
+    );
+  }
+
+  function setUp() {
+    // Add language module too to test with some non-built-in languages.
+    parent::setUp('openid', 'openid_test', 'language');
+    variable_set('user_register', USER_REGISTER_VISITORS);
+  }
+
+  /**
+   * Test OpenID auto-registration with e-mail verification enabled.
+   */
+  function testRegisterUserWithEmailVerification() {
+    variable_set('user_email_verification', TRUE);
+    variable_get('configurable_timezones', 1);
+    variable_set('date_default_timezone', 'Europe/Brussels');
+
+    // Tell openid_test.module to respond with these SREG fields.
+    variable_set('openid_test_response', array(
+      'openid.sreg.nickname' => 'john',
+      'openid.sreg.email' => 'john@example.com',
+      'openid.sreg.language' => 'pt-BR',
+      'openid.sreg.timezone' => 'Europe/London',
+    ));
+
+    // Save Portuguese and Portuguese, Portugal as optional languages. The
+    // process should pick 'pt' based on the sreg.language being 'pt-BR'
+    // (and falling back on least specific language given no pt-br available
+    // locally).
+    $language = (object) array(
+      'langcode' => 'pt',
+    );
+    language_save($language);
+    $language = (object) array(
+      'langcode' => 'pt-pt',
+    );
+    language_save($language);
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->submitLoginForm($identity);
+    $this->assertRaw(t('Once you have verified your e-mail address, you may log in via OpenID.'), t('User was asked to verify e-mail address.'));
+    $this->assertRaw(t('A welcome message with further instructions has been sent to your e-mail address.'), t('A welcome message was sent to the user.'));
+    $reset_url = $this->getPasswordResetURLFromMail();
+
+    $user = user_load_by_name('john');
+    $this->assertTrue($user, t('User was registered with right username.'));
+    $this->assertEqual($user->mail, 'john@example.com', t('User was registered with right email address.'));
+    $this->assertEqual($user->timezone, 'Europe/London', t('User was registered with right timezone.'));
+    $this->assertEqual($user->preferred_langcode, 'pt', t('User was registered with right language.'));
+    $this->assertFalse($user->data, t('No additional user info was saved.'));
+
+    $this->submitLoginForm($identity);
+    $this->assertRaw(t('You must validate your email address for this account before logging in via OpenID.'));
+
+    // Follow the one-time login that was sent in the welcome e-mail.
+    $this->drupalGet($reset_url);
+    $this->drupalPost(NULL, array(), t('Log in'));
+
+    $this->drupalLogout();
+
+    // Verify that the account was activated.
+    $this->submitLoginForm($identity);
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+  }
+
+  /**
+   * Test OpenID auto-registration with e-mail verification disabled.
+   */
+  function testRegisterUserWithoutEmailVerification() {
+    variable_set('user_email_verification', FALSE);
+    variable_get('configurable_timezones', 1);
+    variable_set('date_default_timezone', 'Europe/Brussels');
+
+    // Tell openid_test.module to respond with these SREG fields.
+    variable_set('openid_test_response', array(
+      'openid.sreg.nickname' => 'john',
+      'openid.sreg.email' => 'john@example.com',
+      'openid.sreg.language' => 'pt-BR',
+      'openid.sreg.timezone' => 'Europe/London',
+    ));
+
+    // Save Portuguese, Brazil as an optional language. The process should pick
+    // 'pt-br' based on the sreg.language later.
+    $language = (object) array(
+      'langcode' => 'pt-br',
+    );
+    language_save($language);
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->submitLoginForm($identity);
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+
+    $user = user_load_by_name('john');
+    $this->assertTrue($user, t('User was registered with right username.'));
+    $this->assertEqual($user->mail, 'john@example.com', t('User was registered with right email address.'));
+    $this->assertEqual($user->timezone, 'Europe/London', t('User was registered with right timezone.'));
+    $this->assertEqual($user->preferred_langcode, 'pt-br', t('User was registered with right language.'));
+    $this->assertFalse($user->data, t('No additional user info was saved.'));
+
+    $this->drupalLogout();
+
+    $this->submitLoginForm($identity);
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+  }
+
+  /**
+   * Test OpenID auto-registration with a provider that supplies invalid SREG
+   * information (a username that is already taken, and no e-mail address).
+   */
+  function testRegisterUserWithInvalidSreg() {
+    variable_get('configurable_timezones', 1);
+    variable_set('date_default_timezone', 'Europe/Brussels');
+
+    // Tell openid_test.module to respond with these SREG fields.
+    $web_user = $this->drupalCreateUser(array());
+    variable_set('openid_test_response', array(
+      'openid.sreg.nickname' => $web_user->name,
+      'openid.sreg.email' => 'mail@invalid#',
+      'openid.sreg.timezone' => 'Foo/Bar',
+      'openid.sreg.language' => 'foobar',
+    ));
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->submitLoginForm($identity);
+
+    $this->assertRaw(t('Account registration using the information provided by your OpenID provider failed due to the reasons listed below. Complete the registration by filling out the form below. If you already have an account, you can <a href="@login">log in</a> now and add your OpenID under "My account".', array('@login' => url('user/login'))), t('User was asked to complete the registration process manually.'));
+    $this->assertRaw(t('The name %name is already taken.', array('%name' => $web_user->name)), t('Form validation error for username was displayed.'));
+    $this->assertRaw(t('The e-mail address %mail is not valid.', array('%mail' => 'mail@invalid#')), t('Form validation error for e-mail address was displayed.'));
+    $this->assertTrue(variable_get('openid_test_hook_openid_response_response'), t('hook_openid_response() was invoked.'));
+    $this->assertFalse(variable_get('openid_test_hook_openid_response_account', TRUE), t('No user object passed to hook_openid_response().'));
+
+    // Enter username and e-mail address manually.
+    variable_del('openid_test_hook_openid_response_response');
+    $edit = array('name' => 'john', 'mail' => 'john@example.com');
+    $this->drupalPost(NULL, $edit, t('Create new account'));
+    $this->assertRaw(t('Once you have verified your e-mail address, you may log in via OpenID.'), t('User was asked to verify e-mail address.'));
+    $reset_url = $this->getPasswordResetURLFromMail();
+
+    $user = user_load_by_name('john');
+    $this->assertTrue($user, t('User was registered with right username.'));
+    $this->assertEqual($user->preferred_langcode, language_default()->langcode, t('User language is site default.'));
+    $this->assertFalse($user->data, t('No additional user info was saved.'));
+
+    // Follow the one-time login that was sent in the welcome e-mail.
+    $this->drupalGet($reset_url);
+    $this->drupalPost(NULL, array(), t('Log in'));
+    $this->assertFalse(variable_get('openid_test_hook_openid_response_response'), t('hook_openid_response() was not invoked.'));
+
+    // The user is taken to user/%uid/edit.
+    $this->assertFieldByName('mail', 'john@example.com', t('User was registered with right e-mail address.'));
+
+    $this->clickLink(t('OpenID identities'));
+    $this->assertRaw($identity, t('OpenID identity was registered.'));
+  }
+
+  /**
+   * Test OpenID auto-registration with a provider that does not supply SREG
+   * information (i.e. no username or e-mail address).
+   */
+  function testRegisterUserWithoutSreg() {
+    variable_get('configurable_timezones', 1);
+
+    // Load the front page to get the user login block.
+    $this->drupalGet('');
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->submitLoginForm($identity);
+    $this->assertRaw(t('Complete the registration by filling out the form below. If you already have an account, you can <a href="@login">log in</a> now and add your OpenID under "My account".', array('@login' => url('user/login'))), t('User was asked to complete the registration process manually.'));
+    $this->assertNoRaw(t('You must enter a username.'), t('Form validation error for username was not displayed.'));
+    $this->assertNoRaw(t('You must enter an e-mail address.'), t('Form validation error for e-mail address was not displayed.'));
+
+    // Enter username and e-mail address manually.
+    $edit = array('name' => 'john', 'mail' => 'john@example.com');
+    $this->drupalPost(NULL, $edit, t('Create new account'));
+    $this->assertRaw(t('Once you have verified your e-mail address, you may log in via OpenID.'), t('User was asked to verify e-mail address.'));
+    $reset_url = $this->getPasswordResetURLFromMail();
+
+    $user = user_load_by_name('john');
+    $this->assertTrue($user, t('User was registered with right username.'));
+    $this->assertEqual($user->preferred_langcode, language_default()->langcode, t('User language is site default.'));
+    $this->assertFalse($user->data, t('No additional user info was saved.'));
+
+    // Follow the one-time login that was sent in the welcome e-mail.
+    $this->drupalGet($reset_url);
+    $this->drupalPost(NULL, array(), t('Log in'));
+
+    // The user is taken to user/%uid/edit.
+    $this->assertFieldByName('mail', 'john@example.com', t('User was registered with right e-mail address.'));
+
+    $this->clickLink(t('OpenID identities'));
+    $this->assertRaw($identity, t('OpenID identity was registered.'));
+  }
+
+  /**
+   * Test OpenID auto-registration with a provider that supplies AX information,
+   * but no SREG.
+   */
+  function testRegisterUserWithAXButNoSREG() {
+    variable_set('user_email_verification', FALSE);
+    variable_set('date_default_timezone', 'Europe/Brussels');
+
+    // Tell openid_test.module to respond with these AX fields.
+    variable_set('openid_test_response', array(
+      'openid.ns.ext123' => 'http://openid.net/srv/ax/1.0',
+      'openid.ext123.type.mail456' => 'http://axschema.org/contact/email',
+      'openid.ext123.value.mail456' => 'john@example.com',
+      'openid.ext123.type.name789' => 'http://schema.openid.net/namePerson/friendly',
+      'openid.ext123.count.name789' => '1',
+      'openid.ext123.value.name789.1' => 'john',
+      'openid.ext123.type.timezone' => 'http://axschema.org/pref/timezone',
+      'openid.ext123.value.timezone' => 'Europe/London',
+      'openid.ext123.type.language' => 'http://axschema.org/pref/language',
+      'openid.ext123.value.language' => 'pt-PT',
+    ));
+
+    // Save Portuguese and Portuguese, Portugal as optional languages. The
+    // process should pick 'pt-pt' as the more specific language.
+    $language = (object) array(
+      'langcode' => 'pt',
+    );
+    language_save($language);
+    $language = (object) array(
+      'langcode' => 'pt-pt',
+    );
+    language_save($language);
+
+    // Use a User-supplied Identity that is the URL of an XRDS document.
+    $identity = url('openid-test/yadis/xrds', array('absolute' => TRUE));
+    $this->submitLoginForm($identity);
+    $this->assertLink(t('Log out'), 0, t('User was logged in.'));
+
+    $user = user_load_by_name('john');
+    $this->assertTrue($user, t('User was registered with right username.'));
+    $this->assertEqual($user->mail, 'john@example.com', t('User was registered with right email address.'));
+    $this->assertEqual($user->timezone, 'Europe/London', t('User was registered with right timezone.'));
+    $this->assertEqual($user->preferred_langcode, 'pt-pt', t('User was registered with right language.'));
+  }
+}
+
+/**
+ * Test internal helper functions.
+ */
+class OpenIDUnitTest extends DrupalWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'OpenID helper functions',
+      'description' => 'Test OpenID helper functions.',
+      'group' => 'OpenID'
+    );
+  }
+
+  function setUp() {
+    parent::setUp('openid');
+    module_load_include('inc', 'openid');
+  }
+
+  /**
+   * Test _openid_dh_XXX_to_XXX() functions.
+   */
+  function testConversion() {
+    $this->assertEqual(_openid_dh_long_to_base64('12345678901234567890123456789012345678901234567890'), 'CHJ/Y2mq+DyhUCZ0evjH8ZbOPwrS', t('_openid_dh_long_to_base64() returned expected result.'));
+    $this->assertEqual(_openid_dh_base64_to_long('BsH/g8Nrpn2dtBSdu/sr1y8hxwyx'), '09876543210987654321098765432109876543210987654321', t('_openid_dh_base64_to_long() returned expected result.'));
+
+    $this->assertEqual(_openid_dh_long_to_binary('12345678901234567890123456789012345678901234567890'), "\x08r\x7fci\xaa\xf8<\xa1P&tz\xf8\xc7\xf1\x96\xce?\x0a\xd2", t('_openid_dh_long_to_binary() returned expected result.'));
+    $this->assertEqual(_openid_dh_binary_to_long("\x06\xc1\xff\x83\xc3k\xa6}\x9d\xb4\x14\x9d\xbb\xfb+\xd7/!\xc7\x0c\xb1"), '09876543210987654321098765432109876543210987654321', t('_openid_dh_binary_to_long() returned expected result.'));
+  }
+
+  /**
+   * Test _openid_dh_xorsecret().
+   */
+  function testOpenidDhXorsecret() {
+    $this->assertEqual(_openid_dh_xorsecret('123456790123456790123456790', "abc123ABC\x00\xFF"), "\xa4'\x06\xbe\xf1.\x00y\xff\xc2\xc1", t('_openid_dh_xorsecret() returned expected result.'));
+  }
+
+  /**
+   * Test _openid_get_bytes().
+   */
+  function testOpenidGetBytes() {
+    $this->assertEqual(strlen(_openid_get_bytes(20)), 20, t('_openid_get_bytes() returned expected result.'));
+  }
+
+  /**
+   * Test _openid_signature().
+   */
+  function testOpenidSignature() {
+    // Test that signature is calculated according to OpenID Authentication 2.0,
+    // section 6.1. In the following array, only the two first entries should be
+    // included in the calculation, because the substring following the period
+    // is mentioned in the third argument for _openid_signature(). The last
+    // entry should not be included, because it does not start with "openid.".
+    $response = array(
+      'openid.foo' => 'abc1',
+      'openid.bar' => 'abc2',
+      'openid.baz' => 'abc3',
+      'foobar.foo' => 'abc4',
+    );
+    $association = new stdClass();
+    $association->mac_key = "1234567890abcdefghij\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9";
+    $this->assertEqual(_openid_signature($association, $response, array('foo', 'bar')), 'QnKZQzSFstT+GNiJDFOptdcZjrc=', t('Expected signature calculated.'));
+  }
+
+  /**
+   * Test _openid_is_xri().
+   */
+  function testOpenidXRITest() {
+    // Test that the XRI test is according to OpenID Authentication 2.0,
+    // section 7.2. If the user-supplied string starts with xri:// it should be
+    // stripped and the resulting string should be treated as an XRI when it
+    // starts with "=", "@", "+", "$", "!" or "(".
+    $this->assertTrue(_openid_is_xri('xri://=foo'), t('_openid_is_xri() returned expected result for an xri identifier with xri scheme.'));
+    $this->assertTrue(_openid_is_xri('xri://@foo'), t('_openid_is_xri() returned expected result for an xri identifier with xri scheme.'));
+    $this->assertTrue(_openid_is_xri('xri://+foo'), t('_openid_is_xri() returned expected result for an xri identifier with xri scheme.'));
+    $this->assertTrue(_openid_is_xri('xri://$foo'), t('_openid_is_xri() returned expected result for an xri identifier with xri scheme.'));
+    $this->assertTrue(_openid_is_xri('xri://!foo'), t('_openid_is_xri() returned expected result for an xri identifier with xri scheme..'));
+    $this->assertTrue(_openid_is_xri('xri://(foo'), t('_openid_is_xri() returned expected result for an xri identifier with xri scheme..'));
+
+    $this->assertTrue(_openid_is_xri('=foo'), t('_openid_is_xri() returned expected result for an xri identifier.'));
+    $this->assertTrue(_openid_is_xri('@foo'), t('_openid_is_xri() returned expected result for an xri identifier.'));
+    $this->assertTrue(_openid_is_xri('+foo'), t('_openid_is_xri() returned expected result for an xri identifier.'));
+    $this->assertTrue(_openid_is_xri('$foo'), t('_openid_is_xri() returned expected result for an xri identifier.'));
+    $this->assertTrue(_openid_is_xri('!foo'), t('_openid_is_xri() returned expected result for an xri identifier.'));
+    $this->assertTrue(_openid_is_xri('(foo'), t('_openid_is_xri() returned expected result for an xri identifier.'));
+
+    $this->assertFalse(_openid_is_xri('foo'), t('_openid_is_xri() returned expected result for an http URL.'));
+    $this->assertFalse(_openid_is_xri('xri://foo'), t('_openid_is_xri() returned expected result for an http URL.'));
+    $this->assertFalse(_openid_is_xri('http://foo/'), t('_openid_is_xri() returned expected result for an http URL.'));
+    $this->assertFalse(_openid_is_xri('http://example.com/'), t('_openid_is_xri() returned expected result for an http URL.'));
+    $this->assertFalse(_openid_is_xri('user@example.com/'), t('_openid_is_xri() returned expected result for an http URL.'));
+    $this->assertFalse(_openid_is_xri('http://user@example.com/'), t('_openid_is_xri() returned expected result for an http URL.'));
+  }
+
+  /**
+   * Test openid_normalize().
+   */
+  function testOpenidNormalize() {
+    // Test that the normalization is according to OpenID Authentication 2.0,
+    // section 7.2 and 11.5.2.
+
+    $this->assertEqual(openid_normalize('$foo'), '$foo', t('openid_normalize() correctly normalized an XRI.'));
+    $this->assertEqual(openid_normalize('xri://$foo'), '$foo', t('openid_normalize() correctly normalized an XRI with an xri:// scheme.'));
+
+    $this->assertEqual(openid_normalize('example.com/'), 'http://example.com/', t('openid_normalize() correctly normalized a URL with a missing scheme.'));
+    $this->assertEqual(openid_normalize('example.com'), 'http://example.com/', t('openid_normalize() correctly normalized a URL with a missing scheme and empty path.'));
+    $this->assertEqual(openid_normalize('http://example.com'), 'http://example.com/', t('openid_normalize() correctly normalized a URL with an empty path.'));
+
+    $this->assertEqual(openid_normalize('http://example.com/path'), 'http://example.com/path', t('openid_normalize() correctly normalized a URL with a path.'));
+
+    $this->assertEqual(openid_normalize('http://example.com/path#fragment'), 'http://example.com/path', t('openid_normalize() correctly normalized a URL with a fragment.'));
+  }
+
+  /**
+   * Test openid_extract_namespace().
+   */
+  function testOpenidExtractNamespace() {
+    $response = array(
+      'openid.sreg.nickname' => 'john',
+      'openid.ns.ext1' => OPENID_NS_SREG,
+      'openid.ext1.nickname' => 'george',
+      'openid.ext1.email' => 'george@example.com',
+      'openid.ns.ext2' => 'http://example.com/ns/ext2',
+      'openid.ext2.foo' => '123',
+      'openid.ext2.bar' => '456',
+      'openid.signed' => 'sreg.nickname,ns.ext1,ext1.email,ext2.foo',
+    );
+
+    $values = openid_extract_namespace($response, 'http://example.com/ns/dummy', NULL, FALSE);
+    $this->assertEqual($values, array(), t('Nothing found for unused namespace.'));
+
+    $values = openid_extract_namespace($response, 'http://example.com/ns/dummy', 'sreg', FALSE);
+    $this->assertEqual($values, array('nickname' => 'john'), t('Value found for fallback prefix.'));
+
+    $values = openid_extract_namespace($response, OPENID_NS_SREG, 'sreg', FALSE);
+    $this->assertEqual($values, array('nickname' => 'george', 'email' => 'george@example.com'), t('Namespace takes precedence over fallback prefix.'));
+
+    // ext1.email is signed, but ext1.nickname is not.
+    $values = openid_extract_namespace($response, OPENID_NS_SREG, 'sreg', TRUE);
+    $this->assertEqual($values, array('email' => 'george@example.com'), t('Unsigned namespaced fields ignored.'));
+
+    $values = openid_extract_namespace($response, 'http://example.com/ns/ext2', 'sreg', FALSE);
+    $this->assertEqual($values, array('foo' => '123', 'bar' => '456'), t('Unsigned fields found.'));
+
+    // ext2.foo and ext2.bar are ignored, because ns.ext2 is not signed. The
+    // fallback prefix is not used, because the namespace is specified.
+    $values = openid_extract_namespace($response, 'http://example.com/ns/ext2', 'sreg', TRUE);
+    $this->assertEqual($values, array(), t('Unsigned fields ignored.'));
+  }
+}
diff --git a/core/modules/system/system.admin.inc b/core/modules/system/system.admin.inc
index fc0e8bb..e589f01 100644
--- a/core/modules/system/system.admin.inc
+++ b/core/modules/system/system.admin.inc
@@ -2226,19 +2226,36 @@ function system_date_time_lookup() {
  * @see system_settings_form()
  */
 function system_site_maintenance_mode() {
+  $config = config('system.maintenance');
+
   $form['maintenance_mode'] = array(
     '#type' => 'checkbox',
     '#title' => t('Put site into maintenance mode'),
-    '#default_value' => variable_get('maintenance_mode', 0),
+    '#default_value' => $config->get('maintenance_mode'),
     '#description' => t('Visitors will only see the maintenance mode message. Only users with the "Access site in maintenance mode" <a href="@permissions-url">permission</a> will be able to access the site. Authorized users can log in directly via the <a href="@user-login">user login</a> page.', array('@permissions-url' => url('admin/config/people/permissions'), '@user-login' => url('user'))),
   );
-  $form['maintenance_mode_message'] = array(
+    $form['maintenance_mode_message'] = array(
     '#type' => 'textarea',
     '#title' => t('Message to display when in maintenance mode'),
-    '#default_value' => variable_get('maintenance_mode_message', t('@site is currently under maintenance. We should be back shortly. Thank you for your patience.', array('@site' => variable_get('site_name', 'Drupal')))),
+    '#default_value' => t($config->get('maintenance_mode_message'), array('@site' => variable_get('site_name', 'Drupal'))),
   );
 
-  return system_settings_form($form);
+  $form['submit'] = array('#type' => 'submit', '#value' => t('Save configuration'));
+  return $form;
+}
+
+/**
+ * Form builder submit handler. Handle submission for site maintenance settings.
+ *
+ * @ingroup forms
+ * @see system_settings_form()
+ */
+function system_site_maintenance_mode_submit($form, &$form_state) {
+  $config = config('system.maintenance');
+  $config->set('maintenance_mode', $form_state['values']['maintenance_mode']);
+  $config->set('maintenance_mode_message', $form_state['values']['maintenance_mode_message']);
+  $config->save();
+  drupal_set_message(t('The configuration has been saved.'));
 }
 
 /**
diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index 5581d01..4d015ba 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -1732,41 +1732,11 @@ function system_update_8002() {
 }
 
 /**
- * Adds {config} table for new Configuration system.
- */
-function system_update_8003() {
-  // @todo Temporary.
-  if (db_table_exists('config')) {
-    db_drop_table('config');
-  }
-  db_create_table('config', array(
-    'description' => 'Default active store for the configuration system.',
-    'fields' => array(
-      'name' => array(
-        'description' => 'The identifier for the configuration entry, such as module.example (the name of the file, minus the file extension).',
-        'type' => 'varchar',
-        'length' => 255,
-        'not null' => TRUE,
-        'default' => '',
-      ),
-      'data' => array(
-        'description' => 'The raw data for this configuration entry.',
-        'type' => 'blob',
-        'not null' => TRUE,
-        'size' => 'big',
-        'translatable' => TRUE,
-      ),
-    ),
-    'primary key' => array('name'),
-  ));
-}
-
-/**
  * Adds {file_managed}.langcode field.
  *
  * @see http://drupal.org/node/1454538
  */
-function system_update_8004() {
+function system_update_8003() {
   $langcode_field = array(
     'description' => 'The {language}.langcode of this file.',
     'type' => 'varchar',
@@ -1798,7 +1768,7 @@ function system_update_8004() {
  /**
  * Remove the obsolete {session}.cache column.
  */
-function system_update_8005() {
+function system_update_8004() {
   db_drop_field('session', 'cache');
 }
 
diff --git a/core/modules/system/system.module b/core/modules/system/system.module
index 6e60da8..c1e66f9 100644
--- a/core/modules/system/system.module
+++ b/core/modules/system/system.module
@@ -1134,7 +1134,7 @@ function system_cron_access($key) {
     watchdog('cron', 'Cron could not run because an invalid key was used.', array(), WATCHDOG_NOTICE);
     return FALSE;
   }
-  elseif (variable_get('maintenance_mode', 0)) {
+  elseif (config('system.maintenance')->get('maintenance_mode')) {  
     watchdog('cron', 'Cron could not run because the site is in maintenance mode.', array(), WATCHDOG_NOTICE);
     return FALSE;
   }
diff --git a/core/modules/system/tests/menu.test b/core/modules/system/tests/menu.test
index dbd94a1..1410e12 100644
--- a/core/modules/system/tests/menu.test
+++ b/core/modules/system/tests/menu.test
@@ -225,7 +225,7 @@ class MenuRouterTestCase extends WebTestBase {
    * Test the theme callback when the site is in maintenance mode.
    */
   function testThemeCallbackMaintenanceMode() {
-    variable_set('maintenance_mode', TRUE);
+    config('system.maintenance')->set('maintenance_mode', TRUE)->save();
 
     // For a regular user, the fact that the site is in maintenance mode means
     // we expect the theme callback system to be bypassed entirely.
@@ -246,7 +246,7 @@ class MenuRouterTestCase extends WebTestBase {
    * @see hook_menu_site_status_alter().
    */
   function testMaintenanceModeLoginPaths() {
-    variable_set('maintenance_mode', TRUE);
+    config('system.maintenance')->set('maintenance_mode', TRUE)->save();
 
     $offline_message = t('@site is currently under maintenance. We should be back shortly. Thank you for your patience.', array('@site' => variable_get('site_name', 'Drupal')));
     $this->drupalGet('node');
diff --git a/core/modules/update/update.authorize.inc b/core/modules/update/update.authorize.inc
index 48dfd35..939f415 100644
--- a/core/modules/update/update.authorize.inc
+++ b/core/modules/update/update.authorize.inc
@@ -180,7 +180,7 @@ function update_authorize_update_batch_finished($success, $results) {
       $success = FALSE;
     }
   }
-  $offline = variable_get('maintenance_mode', FALSE);
+  $offline = config('system.maintenance')->get('maintenance_mode');
   if ($success) {
     // Now that the update completed, we need to clear the cache of available
     // update data and recompute our status, so prevent show bogus results.
@@ -188,7 +188,7 @@ function update_authorize_update_batch_finished($success, $results) {
 
     // Take the site out of maintenance mode if it was previously that way.
     if ($offline && isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) {
-      variable_set('maintenance_mode', FALSE);
+      config('system.maintenance')->set('maintenance_mode', FALSE)->save();
       $page_message = array(
         'message' => t('Update was completed successfully. Your site has been taken out of maintenance mode.'),
         'type' => 'status',
@@ -242,11 +242,11 @@ function update_authorize_install_batch_finished($success, $results) {
       $success = FALSE;
     }
   }
-  $offline = variable_get('maintenance_mode', FALSE);
+  $offline = config('system.maintenance')->get('maintenance_mode');
   if ($success) {
     // Take the site out of maintenance mode if it was previously that way.
     if ($offline && isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) {
-      variable_set('maintenance_mode', FALSE);
+      config('system.maintenance')->set('maintenance_mode', FALSE)->save();
       $page_message = array(
         'message' => t('Installation was completed successfully. Your site has been taken out of maintenance mode.'),
         'type' => 'status',
diff --git a/core/modules/update/update.manager.inc b/core/modules/update/update.manager.inc
index f7881d4..f85577e 100644
--- a/core/modules/update/update.manager.inc
+++ b/core/modules/update/update.manager.inc
@@ -407,9 +407,9 @@ function update_manager_update_ready_form($form, &$form_state) {
  */
 function update_manager_update_ready_form_submit($form, &$form_state) {
   // Store maintenance_mode setting so we can restore it when done.
-  $_SESSION['maintenance_mode'] = variable_get('maintenance_mode', FALSE);
+  $_SESSION['maintenance_mode'] = config('system.maintenance')->get('maintenance_mode');
   if ($form_state['values']['maintenance_mode'] == TRUE) {
-    variable_set('maintenance_mode', TRUE);
+    config('system.maintenance')->set('maintenance_mode', TRUE)->save();
   }
 
   if (!empty($_SESSION['update_manager_update_projects'])) {