anchor.diff:  
   === Environment Variables
   
  -The Jenkins password can be configured with the following environment variable:
  +The Jenkins server can be configured with the following environment variables:
   
   .Jenkins Environment Variables
   [cols="4a,6a",options="header"]
  
positive.code: 
  See the https://github.com/openshift/jenkins-plugin/[the plug-in's README] for a detailed description of what is available.
  
  endif::openshift-origin[]
  
negative.code: 
  === Initializing Jenkins
  
  There are two methods for managing authentication with the {product-title} Jenkins images when they are initially started.
  
  * {product-title} OAuth authentication provided by the OpenShift Login plugin.
  
  * Standard authentication provided by Jenkins
  
  ==== {product-title} OAuth authentication
  
  {product-title} OAuth authentication will be used when it is explicitly configured in the `*Configure Global Security*` panel in the Jenkins UI, or it will be used automatically when the OpenShift Login plugin
  determines that it is running in a pod and the `*OPENSHIFT_ENABLE_OAUTH*` environment variable on the Jenkins `*Deployment Config*` is set to anything other than `false`.  The plugin will retrieve the
  configuration information needed either from data seeded into the pod, or by interacting with the {product-title} API server via REST invocations.  There are configuration fields available for the plugin, but
  they should only be required for development testing or atypical configurations accessing a different {product-title} installation for OAuth than the installation hosting Jenkins.
  
  The login process is comprised of a series of HTTP redirects.  Rather than the traditional Jenkins login page, you will first be directed to an {product-title} login page, similar to what you see when you log into the web console.  If login
  is successful, you will be redirected to the page within the Jenkins UI you are trying to access.
  
  Valid user / password combinations are controlled by the identity provider in use with {product-title}.  So, for example,  if the default identity provider `Allow All` is used, you can provide any non-empty string for both the user name
  and password.  If you supply the user name used to create the `*Project*` Jenkins is running in, you will have administrative privileges within Jenkins.
  
  If one of the other identity providers is running, valid user/password combinations stored with your identity provider must be used to login.
  
  Valid users are automatically added to the Jenkins authorization matrix as part of login.
  
  The {product-title} `*Role*` of the user then dictates which permissions within the Jenkins authorization matrix are associated with the user.  The `admin` `*Role*` maps to the set of
  permissions traditionally associated with the `admin` user in the {product-title} Jenkins image:
  
  * hudson.model.Computer.Configure
  * hudson.model.Computer.Delete
  * hudson.model.Hudson.Administer
  * hudson.model.Hudson.Read
  * hudson.model.Item.Build
  * hudson.model.Item.Configure
  * hudson.model.Item.Create
  * hudson.model.Item.Delete
  * hudson.model.Item.Read
  * hudson.model.Item.Workspace
  * hudson.model.Run.Delete
  * hudson.model.Run.Update
  * hudson.model.View.Configure
  * hudson.model.View.Create
  * hudson.model.View.Delete
  * hudson.scm.SCM.Tag
  
  Users with the `edit` or `view``*Roles*` for the {product-title} project have progressively reduced permissions within Jenkins.
  
  For the `view` `*Role*`:
  
  * hudson.model.Hudson.Read
  * hudson.model.Item.Read
  
  For the `edit` `*Role*`, in addition to the permissions available to `*view*`:
  
  * hudson.model.Item.Build
  * hudson.model.Item.Configure
  * hudson.model.Item.Create
  * hudson.model.Item.Delete
  * hudson.model.Item.Workspace
  * hudson.scm.SCM.Tag
  
  Users authenticated against {product-title} OAuth will be added to the Jenkins authorization matrix upon their first successful login.
  
  [NOTE]
  ====
  The user name used to create the project Jenkins is running in will have the `admin` `*Role*` assigned to it.  So consider that the default
  administrative user for Jenkins when using {product-title} OAuth to manage authentication.
  
  The `admin` user that is pre-populated in the {product-title} Jenkins image with administrative privileges will not be honored with those
  privileges when {product-title} OAuth is used unless the {product-title} cluster administrator explicitly defines that user in the {product-title}
  identity provider and assigns the `admin` `*Role*` to the `admin` user.
  ====
  
  Permissions for users in Jenkins can be changed in {product-title} after those users are initially established in Jenkins.  The OpenShift Login plugin polls the {product-title} API server for permissions and will update the permissions stored in
  Jenkins for each Jenkins user with the permissions retrieved from {product-title}.  If the Jenkins UI is used to update permissions for a Jenkins user, the permission changes will be overwritten the next time the plugin polls {product-title}.
  
  You can control how often the polling occurs with the `OPENSHIFT_PERMISSIONS_POLL_INTERVAL` environment variable.  The default polling interval when no environment variable is set is 5 minutes.
  
  The following commands creates a new Jenkins xref:../../architecture/core_concepts/pods_and_services.adoc#pods[pod] using {product-title} OAuth authentication,
  assuming you have installed xref:../../install_config/imagestreams_templates.adoc[the default imagestreams and templates].
  
  Run this command to use persistent volumes:
  ----
  $ oc new-app jenkins-persistent
  ----
  
  Run this command to use an EmptyDir type volume (configuration will not persist across pod restarts):
  ----
  $ oc new-app jenkins-ephemeral
  ----
  
  [NOTE]
  ====
  If you instantiate the template against releases prior to v3.4 of {product-title}, standard Jenkins authentication will be used.  The default 'admin' account will exist with password 'password'.
  See Jenkins standard authentication for details about changing this password.
  ====
  
  ==== Jenkins standard authentication
  
  Jenkins authentication will be used by default with the {product-title} Jenkins images if the image is run outside of {product-title}.
  
  The first time you start Jenkins, the configuration is created along with the administrator user and password.
  The default user login is `*admin/password*`.
  The default password can be configured by setting the `*JENKINS_PASSWORD*` environment variable when using (and only when using) standard Jenkins authentication.
  
  The following command creates a new Jenkins xref:../../architecture/core_concepts/pods_and_services.adoc#pods[pod] using standard Jenkins authentication:
  
  ----
  $ oc new-app -e \
  