wireless - Use Network-Manager to connect to a WiFi Access Point on the command-line

I'd like to connect to a wireless access point from the command-line.
Ideally, I'd only need the name of the AP. But the hardware-address would work as well.

I know I can use nmcli to connect to a managed network connection, but in my case, the access point may not be configured for Network-Manager yet (See the difference between the output of nm-tool and nmcli con).

Example output of nmcli:

Auto pwln       3a3d62b1-bbdf-4f76-b4d2-c211fd5cfb03   802-11-wireless [...]  
Wired Network   aa586921-accf-4932-98c4-c873c310f08e   802-3-ethernet [...]  
Cisco-UDP Uni   7f94847b-04dc-40b7-9955-5246fb77cc65   vpn [...]  
T-mobile (D1)   867f345a-cbbf-4bd4-b883-a5e5ae0932f0   gsm  [...]

Example output of nm-tool:

State: connected
- Device: eth1  [Auto pwln] ----------------------------------------------------

[...]
  Wireless Access Points (* = current AP)
    *pwln: Infra, [...], Freq 2472 MHz, Rate 54 Mb/s, Strength 80 WPA WPA2
    WLAN:  Infra, [...], Freq 2422 MHz, Rate 54 Mb/s, Strength 20 WPA WPA2

[...]

How do I connect to an access point that may or may not be known to NM?

Extra:
Finding out if the connection needs a pass-phrase, and submitting it on the command-line as well would be great too (that is to say It'd be nice if network-manager wouldn't pop open any keyring dialogues or errors on the gui)

You can use cnetworkmanager for this.

Edit:

After some investigation it becomes clear that it is impossible to run two "user configuration providers" (an application listening at a certain dbus address) at the same time, and cnetworkmanager needs to act as such a "configuration provider" (at least until the connection is set up).

Now, what you can do is add the information for the connection to gconf under the /system/networking/connections key (you can do that from the commandline or a script), and then use dbus or a command-line tool like cnetworkmanager or nmcli to connect to it. Maybe you'll also have to add the key to the user's keyring first (to avoid password popups).

But of course that won't work on a desktop that uses another NM-client than nm-applet (e.g. KDE). You would have to figure out how to provide a config for them too...

Edit 2:

It seems like it might be possible via org.freedesktop.NetworkManagerUserSettings on the system DBus, but this is all poorly documented IMO...

You might want to read about configuration settings and the DBus interface spec.

And here is a relevant example (maybe you want to set up a user connection instead of a system connection though)