anchor.diff:  link:../infrastructure_components/image_registry.html[Image Registry] for more
   details.
   
  -An ImageStream can also be configured so that 1 tag "tracks" another one. For
  -example, you could make it so the "latest" tag always refers to whatever is the
  -current image for the tag "2.0":
  +An ImageStream can also be configured so that a tag "tracks" another one. For
  +example, you can configure the "latest" tag to always refer to the current image
  +for the tag "2.0":
   
   ====
   
  
positive.code: }
  ----
  
  <1> The user name, used when adding roles to a user
  <2> Names of Identity objects that map to this user. May be `null` or empty for users that cannot log in.
  <3> Optional display name of user
  <4> Groups the user belongs to
  
negative.code: == User objects
  
  === Identity
  When a user logs into OpenShift, they do so using a configured
  link:../../admin_guide/configuring_authentication.html#identity-providers[identity
  provider]. This determines the user's identity, and provides that information to
  OpenShift.
  
  OpenShift then looks for a UserIdentityMapping for that Identity:
  
  * If the Identity already exists, but is not mapped to a User, login fails.
  * If the Identity already exists, and is mapped to a User, the user is given an OAuthAccessToken for the mapped User.
  * If the Identity does not exist, an Identity, User, and UserIdentityMapping are created, and the user is given an OAuthAccessToken for the mapped User.
  
  Sample Identity:
  
  