From 307bfc17385c14aefcb623ccc3e7144e4f01e2a3 Mon Sep 17 00:00:00 2001
From: Jesse Glick <jglick@cloudbees.com>
Date: Fri, 26 Feb 2016 15:52:58 -0500
Subject: [PATCH 01/25] [JENKINS-27152] Introduce common API
 WorkspaceList.tempDir.

---
 .../hudson/model/WorkspaceCleanupThread.java  |  2 ++
 .../java/hudson/slaves/WorkspaceList.java     | 20 +++++++++++++++++++
 .../model/WorkspaceCleanupThreadTest.java     | 14 +++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/core/src/main/java/hudson/model/WorkspaceCleanupThread.java b/core/src/main/java/hudson/model/WorkspaceCleanupThread.java
index 9e83e143e5..a7a606b476 100644
--- a/core/src/main/java/hudson/model/WorkspaceCleanupThread.java
+++ b/core/src/main/java/hudson/model/WorkspaceCleanupThread.java
@@ -27,6 +27,7 @@ import hudson.Extension;
 import hudson.ExtensionList;
 import hudson.FilePath;
 import hudson.Util;
+import hudson.slaves.WorkspaceList;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Date;
@@ -89,6 +90,7 @@ public class WorkspaceCleanupThread extends AsyncPeriodicWork {
                     listener.getLogger().println("Deleting " + ws + " on " + node.getDisplayName());
                     try {
                         ws.deleteRecursive();
+                        WorkspaceList.tempDir(ws).deleteRecursive();
                     } catch (IOException x) {
                         x.printStackTrace(listener.error("Failed to delete " + ws + " on " + node.getDisplayName()));
                     } catch (InterruptedException x) {
diff --git a/core/src/main/java/hudson/slaves/WorkspaceList.java b/core/src/main/java/hudson/slaves/WorkspaceList.java
index a344b45aac..98347b2ab4 100644
--- a/core/src/main/java/hudson/slaves/WorkspaceList.java
+++ b/core/src/main/java/hudson/slaves/WorkspaceList.java
@@ -26,6 +26,7 @@ package hudson.slaves;
 import hudson.FilePath;
 import hudson.Functions;
 import hudson.model.Computer;
+import hudson.model.DirectoryBrowserSupport;
 import java.io.Closeable;
 
 import java.util.Date;
@@ -283,6 +284,25 @@ public final class WorkspaceList {
         };
     }
 
+    /**
+     * Locates a conventional temporary directory to be associated with a workspace.
+     * <p>This directory is suitable for temporary files to be deleted later in the course of a build,
+     * or caches and local repositories which should persist across builds done in the same workspace.
+     * (If multiple workspaces are present for a single job built concurrently, via {@link #allocate(FilePath)}, each will get its own temporary directory.)
+     * <p>It may also be used for security-sensitive files which {@link DirectoryBrowserSupport} ought not serve,
+     * acknowledging that these will be readable by builds of other jobs done on the same node.
+     * <p>Each plugin using this directory is responsible for specifying sufficiently unique subdirectory/file names.
+     * {@link FilePath#createTempFile} may be used for this purpose if desired.
+     * <p>The resulting directory may not exist; you may call {@link FilePath#mkdirs} on it if you need it to.
+     * It may be deleted alongside the workspace itself during cleanup actions.
+     * @param ws a directory such as a build workspace
+     * @return a sibling directory, for example {@code …/something@tmp} for {@code …/something}
+     * @since TODO
+     */
+    public static FilePath tempDir(FilePath ws) {
+        return ws.sibling(ws.getName() + COMBINATOR + "tmp");
+    }
+
     private static final Logger LOGGER = Logger.getLogger(WorkspaceList.class.getName());
 
     /**
diff --git a/test/src/test/java/hudson/model/WorkspaceCleanupThreadTest.java b/test/src/test/java/hudson/model/WorkspaceCleanupThreadTest.java
index 28d7dd04e1..0971276179 100644
--- a/test/src/test/java/hudson/model/WorkspaceCleanupThreadTest.java
+++ b/test/src/test/java/hudson/model/WorkspaceCleanupThreadTest.java
@@ -28,6 +28,7 @@ import hudson.FilePath;
 import hudson.remoting.VirtualChannel;
 import hudson.scm.NullSCM;
 import hudson.slaves.DumbSlave;
+import hudson.slaves.WorkspaceList;
 import hudson.util.StreamTaskListener;
 
 import java.io.File;
@@ -180,6 +181,19 @@ public class WorkspaceCleanupThreadTest {
         assertFalse(ws.exists());
     }
 
+    @Issue("JENKINS-27152")
+    @Test
+    public void deleteTemporaryDirectory() throws Exception {
+        FreeStyleProject p = r.createFreeStyleProject();
+        FilePath ws = createOldWorkspaceOn(r.jenkins, p);
+        FilePath tmp = WorkspaceList.tempDir(ws);
+        tmp.child("stuff").write("content", null);
+        createOldWorkspaceOn(r.createOnlineSlave(), p);
+        performCleanup();
+        assertFalse(ws.exists());
+        assertFalse("temporary directory should be cleaned up as well", tmp.exists());
+    }
+
     private FilePath createOldWorkspaceOn(Node slave, FreeStyleProject p) throws Exception {
         p.setAssignedNode(slave);
         FreeStyleBuild b1 = r.assertBuildStatusSuccess(p.scheduleBuild2(0));

From 2d83d39ce59b27787b8879b9270493adbf586f00 Mon Sep 17 00:00:00 2001
From: Kohsuke Kawaguchi <kk@kohsuke.org>
Date: Sun, 28 Feb 2016 21:51:14 -0800
Subject: [PATCH 02/25] [maven-release-plugin] prepare release jenkins-1.651

---
 cli/pom.xml  | 2 +-
 core/pom.xml | 2 +-
 pom.xml      | 4 ++--
 test/pom.xml | 2 +-
 war/pom.xml  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cli/pom.xml b/cli/pom.xml
index 057ede78e7..0a4446727d 100644
--- a/cli/pom.xml
+++ b/cli/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651-SNAPSHOT</version>
+    <version>1.651</version>
   </parent>
 
   <artifactId>cli</artifactId>
diff --git a/core/pom.xml b/core/pom.xml
index 5cebd6c25a..4852592cab 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -29,7 +29,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651-SNAPSHOT</version>
+    <version>1.651</version>
   </parent>
 
   <artifactId>jenkins-core</artifactId>
diff --git a/pom.xml b/pom.xml
index fa197c2030..c9af50a84a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -33,7 +33,7 @@ THE SOFTWARE.
 
   <groupId>org.jenkins-ci.main</groupId>
   <artifactId>pom</artifactId>
-  <version>1.651-SNAPSHOT</version>
+  <version>1.651</version>
   <packaging>pom</packaging>
 
   <name>Jenkins main module</name>
@@ -58,7 +58,7 @@ THE SOFTWARE.
     <connection>scm:git:git://github.com/jenkinsci/jenkins.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/jenkinsci/jenkins.git</developerConnection>
     <url>https://github.com/jenkinsci/jenkins</url>
-    <tag>HEAD</tag>
+    <tag>jenkins-1.651</tag>
   </scm>
 
   <distributionManagement>
diff --git a/test/pom.xml b/test/pom.xml
index dd1f50cc5b..0430e344e5 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -28,7 +28,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651-SNAPSHOT</version>
+    <version>1.651</version>
   </parent>
 
   <artifactId>test</artifactId>
diff --git a/war/pom.xml b/war/pom.xml
index c54bcf7d00..acaf96d382 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -28,7 +28,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651-SNAPSHOT</version>
+    <version>1.651</version>
   </parent>
 
   <artifactId>jenkins-war</artifactId>

From 0a866f5727f5eb25bf895a7a60ce9c199cda0645 Mon Sep 17 00:00:00 2001
From: Kohsuke Kawaguchi <kk@kohsuke.org>
Date: Sun, 28 Feb 2016 21:51:15 -0800
Subject: [PATCH 03/25] [maven-release-plugin] prepare for next development
 iteration

---
 cli/pom.xml  | 2 +-
 core/pom.xml | 2 +-
 pom.xml      | 4 ++--
 test/pom.xml | 2 +-
 war/pom.xml  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cli/pom.xml b/cli/pom.xml
index 0a4446727d..60ff50f0c5 100644
--- a/cli/pom.xml
+++ b/cli/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651</version>
+    <version>1.652-SNAPSHOT</version>
   </parent>
 
   <artifactId>cli</artifactId>
diff --git a/core/pom.xml b/core/pom.xml
index 4852592cab..381c485acc 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -29,7 +29,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651</version>
+    <version>1.652-SNAPSHOT</version>
   </parent>
 
   <artifactId>jenkins-core</artifactId>
diff --git a/pom.xml b/pom.xml
index c9af50a84a..47537cd874 100644
--- a/pom.xml
+++ b/pom.xml
@@ -33,7 +33,7 @@ THE SOFTWARE.
 
   <groupId>org.jenkins-ci.main</groupId>
   <artifactId>pom</artifactId>
-  <version>1.651</version>
+  <version>1.652-SNAPSHOT</version>
   <packaging>pom</packaging>
 
   <name>Jenkins main module</name>
@@ -58,7 +58,7 @@ THE SOFTWARE.
     <connection>scm:git:git://github.com/jenkinsci/jenkins.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/jenkinsci/jenkins.git</developerConnection>
     <url>https://github.com/jenkinsci/jenkins</url>
-    <tag>jenkins-1.651</tag>
+    <tag>HEAD</tag>
   </scm>
 
   <distributionManagement>
diff --git a/test/pom.xml b/test/pom.xml
index 0430e344e5..7767a50fa6 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -28,7 +28,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651</version>
+    <version>1.652-SNAPSHOT</version>
   </parent>
 
   <artifactId>test</artifactId>
diff --git a/war/pom.xml b/war/pom.xml
index acaf96d382..0486d6baec 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -28,7 +28,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.651</version>
+    <version>1.652-SNAPSHOT</version>
   </parent>
 
   <artifactId>jenkins-war</artifactId>

From 40c1f29dd2d8c6ef0fe1bf149dc60a7655ffbad3 Mon Sep 17 00:00:00 2001
From: Kohsuke Kawaguchi <kk@kohsuke.org>
Date: Sun, 28 Feb 2016 21:58:46 -0800
Subject: [PATCH 04/25] updated changelog for release

---
 changelog.html | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/changelog.html b/changelog.html
index 7317e898ad..1a859089d1 100644
--- a/changelog.html
+++ b/changelog.html
@@ -54,12 +54,16 @@ Upcoming changes</a>
 
 <!-- Record your changes in the trunk here. -->
 <div id="trunk" style="display:none"><!--=TRUNK-BEGIN=-->
+<ul class=image>
+  <li class=>
+</ul>
+</div><!--=TRUNK-END=-->
+<h3><a name=v1.651>What's new in 1.651</a> (2016/02/28)</h3>
 <ul class=image>
   <li class="rfe">
     Move periodic task log files from <code>JENKINS_HOME/*.log</code> to <code>JENKINS_HOME/logs/tasks/*.log</code> and rotate them periodically rather than overwrite every execution
     (<a href-"https://issues.jenkins-ci.org/browse/JENKINS-33068">issue 33068</a>)
 </ul>
-</div><!--=TRUNK-END=-->
 <h3><a name=v1.650>What's new in 1.650</a> (2016/02/24)</h3>
 <ul class=image>
    <li class="major bug">

From 48e42ae94a693a7d83c61ad0bb60f0ec397b5e8c Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Mon, 29 Feb 2016 08:21:33 +0100
Subject: [PATCH 05/25] Noting #2060

---
 changelog.html | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/changelog.html b/changelog.html
index 1a859089d1..c8a28a6f25 100644
--- a/changelog.html
+++ b/changelog.html
@@ -61,8 +61,11 @@ Upcoming changes</a>
 <h3><a name=v1.651>What's new in 1.651</a> (2016/02/28)</h3>
 <ul class=image>
   <li class="rfe">
-    Move periodic task log files from <code>JENKINS_HOME/*.log</code> to <code>JENKINS_HOME/logs/tasks/*.log</code> and rotate them periodically rather than overwrite every execution
+    Move periodic task log files from <code>JENKINS_HOME/*.log</code> to <code>JENKINS_HOME/logs/tasks/*.log</code> and rotate them periodically rather than overwrite every execution.
     (<a href-"https://issues.jenkins-ci.org/browse/JENKINS-33068">issue 33068</a>)
+  <li class="bug">
+    Fix documentation of proxy configuration.
+    (<a href="https://github.com/jenkinsci/jenkins/pull/2060">pull 2060</a>)
 </ul>
 <h3><a name=v1.650>What's new in 1.650</a> (2016/02/24)</h3>
 <ul class=image>

From 1a2d82275c078ca3f651d9924a53acd2b6210a93 Mon Sep 17 00:00:00 2001
From: Jesse Glick <jglick@cloudbees.com>
Date: Mon, 29 Feb 2016 15:15:28 -0500
Subject: [PATCH 06/25] =?UTF-8?q?[FIXED=20JENKINS-25440]=20Recursively=20r?=
 =?UTF-8?q?esolve=20@Inject=E2=80=99ed=20extensions,=20too,=20looking=20fo?=
 =?UTF-8?q?r=20LinkageError=E2=80=99s.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 core/src/main/java/hudson/ExtensionFinder.java | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/hudson/ExtensionFinder.java b/core/src/main/java/hudson/ExtensionFinder.java
index a2af086102..1647abce6f 100644
--- a/core/src/main/java/hudson/ExtensionFinder.java
+++ b/core/src/main/java/hudson/ExtensionFinder.java
@@ -282,7 +282,6 @@ public abstract class ExtensionFinder implements ExtensionPoint {
                 LOGGER.log(Level.SEVERE, "Failed to create Guice container from all the plugins",e);
                 // failing to load all bindings are disastrous, so recover by creating minimum that works
                 // by just including the core
-                // TODO this recovery is pretty much useless; startup crashes anyway
                 container = Guice.createInjector(new SezpozModule(loadSezpozIndices(Jenkins.class.getClassLoader())));
             }
 
@@ -479,7 +478,11 @@ public abstract class ExtensionFinder implements ExtensionPoint {
                     m.invoke(ecl, c);
                     c.getConstructors();
                     c.getMethods();
-                    c.getFields();
+                    for (Field f : c.getFields()) {
+                        if (f.getAnnotation(javax.inject.Inject.class) != null || f.getAnnotation(com.google.inject.Inject.class) != null) {
+                            resolve(f.getType());
+                        }
+                    }
                     LOGGER.log(Level.FINER, "{0} looks OK", c);
                     while (c != Object.class) {
                         c.getGenericSuperclass();

From 58afb04f9df8849789c6146026c7f670dde2930c Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Wed, 2 Mar 2016 00:12:10 +0100
Subject: [PATCH 07/25] [FIX JENKINS-32303] Fix readonly behavior for
 f:checkbox

---
 core/src/main/resources/lib/form/checkbox.jelly | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/src/main/resources/lib/form/checkbox.jelly b/core/src/main/resources/lib/form/checkbox.jelly
index eda309a14e..17a3fe6d93 100644
--- a/core/src/main/resources/lib/form/checkbox.jelly
+++ b/core/src/main/resources/lib/form/checkbox.jelly
@@ -44,6 +44,9 @@ THE SOFTWARE.
     <st:attribute name="onclick" />
     <st:attribute name="class" />
     <st:attribute name="negative" />
+    <st:attribute name="readonly">
+      If set to true, this will take precedence over the onclick attribute and prevent the state of the checkbox from being changed.
+    </st:attribute>
     <st:attribute name="field">
       Used for databinding. TBD.
     </st:attribute>
@@ -63,7 +66,7 @@ THE SOFTWARE.
          name="${name}"
          value="${attrs.value}"
          title="${attrs.tooltip}"
-         onclick="${attrs.onclick}" id="${attrs.id}" class="${attrs.negative!=null ? 'negative' : null} ${attrs.checkUrl!=null?'validated':''}"
+         onclick="${attrs.readonly=='true' ? 'return false;' : attrs.onclick}" id="${attrs.id}" class="${attrs.negative!=null ? 'negative' : null} ${attrs.checkUrl!=null?'validated':''}"
          checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}" json="${attrs.json}"
          checked="${value ? 'true' : null}"/>
   <j:if test="${attrs.title!=null}">

From 0d0d2a9c133abee1cfd81397c84767638c5a3432 Mon Sep 17 00:00:00 2001
From: Kohsuke Kawaguchi <kk@kohsuke.org>
Date: Wed, 2 Mar 2016 13:24:35 -0800
Subject: [PATCH 08/25] Latest & greatest

---
 core/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/pom.xml b/core/pom.xml
index 381c485acc..609a6528a5 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -39,7 +39,7 @@ THE SOFTWARE.
 
   <properties>
     <staplerFork>true</staplerFork>
-    <stapler.version>1.239</stapler.version>
+    <stapler.version>1.240</stapler.version>
     <spring.version>2.5.6.SEC03</spring.version>
     <groovy.version>1.8.9</groovy.version>
   </properties>

From 06d936f695598576d58865ab2a355d982d1a38e5 Mon Sep 17 00:00:00 2001
From: James Nord <jnord+github@cloudbees.com>
Date: Fri, 4 Mar 2016 16:16:35 +0000
Subject: [PATCH 09/25] Excluded war from test from the test harness.

Whilst this is not used in the dependencies, the enforcer plugin downloads
the i1.580.1 jar so it can scan it.  Most likely a bug in the
extra-enforcer-rules but we obviously don;t need it as we have an explicit
dependency on the latest version!
---
 test/pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/pom.xml b/test/pom.xml
index 7767a50fa6..e494f99052 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -65,6 +65,12 @@ THE SOFTWARE.
       <artifactId>jenkins-test-harness</artifactId>
       <version>2.5</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>${project.groupId}</groupId>
+          <artifactId>jenkins-war</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>

From 920f20fd060f0d6fed9296ad391b724c8abf6b12 Mon Sep 17 00:00:00 2001
From: Kohsuke Kawaguchi <kk@kohsuke.org>
Date: Fri, 4 Mar 2016 13:11:53 -0800
Subject: [PATCH 10/25] Fixing a test

Previously, when the 2nd `e.click()` is called, the page has already transitioned to another page, so the anchor objects have become invalid.

HtmlUnit somehow still manages to follow a link, except when there's some JavaScript attached to the onclick() handler it's going to execute in a strange environment. Some management link requires a POST, and that was done via JavaScript. So that broke the test.
---
 .../java/hudson/model/ManagementLinkTest.java     | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/test/src/test/java/hudson/model/ManagementLinkTest.java b/test/src/test/java/hudson/model/ManagementLinkTest.java
index 4b19f2c8bb..5de5dd3d51 100644
--- a/test/src/test/java/hudson/model/ManagementLinkTest.java
+++ b/test/src/test/java/hudson/model/ManagementLinkTest.java
@@ -31,6 +31,7 @@ import com.gargoylesoftware.htmlunit.html.HtmlPage;
 import org.junit.Rule;
 import org.junit.Test;
 import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.JenkinsRule.WebClient;
 
 import java.util.List;
 
@@ -47,11 +48,15 @@ public class ManagementLinkTest {
      */
     @Test
     public void links() throws Exception {
-        HtmlPage page = j.createWebClient().goTo("manage");
-        List<?> anchors = DomNodeUtil.selectNodes(page, "id('management-links')//*[@class='link']/a[not(@onclick)]");
-        assertTrue(anchors.size()>=8);
-        for(HtmlAnchor e : (List<HtmlAnchor>) anchors) {
-            e.click();
+        WebClient wc = j.createWebClient();
+
+        for (int i=0; ; i++) {
+            HtmlPage page = wc.goTo("manage");
+            List<?> anchors = DomNodeUtil.selectNodes(page, "id('management-links')//*[@class='link']/a[not(@onclick)]");
+            assertTrue(anchors.size()>=8);
+            if (i==anchors.size())  return; // done
+
+            ((HtmlAnchor)anchors.get(i)).click();
         }
     }
 }

From 5368c96404d415451bb657aea8073834c8bd815b Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Sat, 5 Mar 2016 18:51:02 -0500
Subject: [PATCH 11/25] JENKINS-30749 - make Jenkins secure out of the box: *
 create initial admin user with difficult password (based on UUID) * force
 login with password as security token * force initial admin user creation

---
 core/src/main/java/hudson/PluginManager.java  |    2 +-
 .../main/java/hudson/model/UpdateCenter.java  |   90 +-
 ...trolOnceLoggedInAuthorizationStrategy.java |   36 +-
 .../security/HudsonPrivateSecurityRealm.java  |   27 +-
 .../java/jenkins/install/InstallState.java    |   49 +-
 .../java/jenkins/install/InstallUtil.java     |   11 +-
 .../java/jenkins/install/SetupWizard.java     |  180 +++
 core/src/main/java/jenkins/model/Jenkins.java |   57 +-
 .../config.jelly                              |    7 +
 .../_entryForm.jelly                          |   97 +-
 .../_entryFormPage.jelly                      |   50 +
 .../HudsonPrivateSecurityRealm/addUser.jelly  |    2 +-
 .../firstUser.jelly                           |    2 +-
 .../setupWizardFirstUser.jelly                |   53 +
 .../HudsonPrivateSecurityRealm/signup.jelly   |    2 +-
 .../signupWithFederatedIdentity.jelly         |    2 +-
 .../authenticate-security-token.jelly         |   44 +
 .../jenkins/install/SetupWizard/index.jelly   |    8 +
 .../SetupWizard/proxy-configuration.jelly     |   13 +
 .../install/pluginSetupWizard.properties      |    8 +-
 .../jenkins/model/Jenkins/login.jelly         |    5 +
 .../jenkins/model/Jenkins/loginError.jelly    |    4 +
 core/src/main/resources/lib/layout/html.jelly |  177 +++
 .../main/resources/lib/layout/layout.jelly    |    4 -
 .../model/UpdateCenterPluginInstallTest.java  |    3 +-
 war/src/main/js/api/securityConfig.js         |   33 +
 war/src/main/js/pluginSetupWizard.js          |    7 +-
 war/src/main/js/pluginSetupWizardGui.js       |  213 ++-
 war/src/main/js/templates/firstUserPanel.hbs  |   13 +
 .../templates/incompleteInstallationPanel.hbs |    1 -
 war/src/main/js/templates/offlinePanel.hbs    |   15 +-
 .../js/templates/pluginSelectionPanel.hbs     |    1 -
 .../main/js/templates/proxyConfigPanel.hbs    |   16 +
 .../main/js/templates/setupCompletePanel.hbs  |   20 +
 war/src/main/js/templates/successPanel.hbs    |    5 +-
 war/src/main/js/templates/welcomePanel.hbs    |    1 -
 war/src/main/js/util/jenkins.js               |  136 +-
 war/src/main/less/pluginSetupWizard.less      | 1137 +++++++++--------
 war/src/test/js/pluginSetupWizard-spec.js     |  225 ++--
 39 files changed, 1823 insertions(+), 933 deletions(-)
 create mode 100644 core/src/main/java/jenkins/install/SetupWizard.java
 create mode 100644 core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/config.jelly
 create mode 100644 core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryFormPage.jelly
 create mode 100644 core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/setupWizardFirstUser.jelly
 create mode 100644 core/src/main/resources/jenkins/install/SetupWizard/authenticate-security-token.jelly
 create mode 100644 core/src/main/resources/jenkins/install/SetupWizard/index.jelly
 create mode 100644 core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly
 create mode 100644 core/src/main/resources/lib/layout/html.jelly
 create mode 100644 war/src/main/js/api/securityConfig.js
 create mode 100644 war/src/main/js/templates/firstUserPanel.hbs
 create mode 100644 war/src/main/js/templates/proxyConfigPanel.hbs
 create mode 100644 war/src/main/js/templates/setupCompletePanel.hbs

diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java
index 798a51f9ab..1c104ae410 100644
--- a/core/src/main/java/hudson/PluginManager.java
+++ b/core/src/main/java/hudson/PluginManager.java
@@ -1189,7 +1189,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
                         break;
                     }
 			updateCenter.persistInstallStatus();
-                    jenkins.setInstallState(InstallState.INITIAL_PLUGINS_INSTALLED);
+                    jenkins.setInstallState(InstallState.INITIAL_PLUGINS_INSTALLING.getNextState());
                     InstallUtil.saveLastExecVersion();
                 }
             }.start();
diff --git a/core/src/main/java/hudson/model/UpdateCenter.java b/core/src/main/java/hudson/model/UpdateCenter.java
index a8e9122e7c..e595f0a93d 100644
--- a/core/src/main/java/hudson/model/UpdateCenter.java
+++ b/core/src/main/java/hudson/model/UpdateCenter.java
@@ -57,7 +57,8 @@ import jenkins.install.InstallState;
 import jenkins.install.InstallUtil;
 import jenkins.model.Jenkins;
 import jenkins.util.io.OnMaster;
-import net.sf.json.JSONArray;
+import net.sf.json.JSONObject;
+
 import org.acegisecurity.Authentication;
 import org.acegisecurity.context.SecurityContext;
 import org.apache.commons.codec.binary.Base64;
@@ -73,7 +74,6 @@ import javax.annotation.Nonnull;
 import javax.net.ssl.SSLHandshakeException;
 import javax.servlet.ServletException;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
@@ -81,12 +81,12 @@ import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLConnection;
 import java.net.UnknownHostException;
-import java.security.DigestInputStream;
 import java.security.DigestOutputStream;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -131,7 +131,7 @@ import org.kohsuke.stapler.interceptor.RequirePOST;
  */
 @ExportedBean
 public class UpdateCenter extends AbstractModelObject implements Saveable, OnMaster {
-	
+
     private static final String UPDATE_CENTER_URL = System.getProperty(UpdateCenter.class.getName()+".updateCenterUrl","http://updates.jenkins-ci.org/");
 
     /**
@@ -142,7 +142,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
 
     @Restricted(NoExternalUse.class)
     public static final String ID_UPLOAD = "_upload";
-	
+
     /**
      * {@link ExecutorService} that performs installation.
      * @since 1.501
@@ -155,7 +155,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
      */
     protected final ExecutorService updateService = Executors.newCachedThreadPool(
         new NamingThreadFactory(new DaemonThreadFactory(), "Update site data downloader"));
-        
+
     /**
      * List of created {@link UpdateCenterJob}s. Access needs to be synchronized.
      */
@@ -311,29 +311,16 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
         }
     }
 
-    /**
-     * Called to bypass install wizard
-     */
-    @Restricted(DoNotUse.class) // WebOnly
-    public HttpResponse doCompleteInstall() {
-	if(isRestartRequiredForCompletion()) {
-		Jenkins.getActiveInstance().setInstallState(InstallState.RESTART);
-	}
-        InstallUtil.saveLastExecVersion();
-        Jenkins.getActiveInstance().setInstallState(InstallState.INITIAL_PLUGINS_INSTALLED);
-        return HttpResponses.okJSON();
-    }
-
     /**
      * Called to determine if there was an incomplete installation, what the statuses of the plugins are
      */
     @Restricted(DoNotUse.class) // WebOnly
     public HttpResponse doIncompleteInstallStatus() {
         try {
-		Map<String,String> jobs = InstallUtil.getPersistedInstallStatus();
-		if(jobs == null) {
-			jobs = Collections.emptyMap();
-		}
+        Map<String,String> jobs = InstallUtil.getPersistedInstallStatus();
+        if(jobs == null) {
+            jobs = Collections.emptyMap();
+        }
             return HttpResponses.okJSON(jobs);
         } catch (Exception e) {
             return HttpResponses.errorJSON(String.format("ERROR: %s", e.getMessage()));
@@ -353,16 +340,16 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
             if (job instanceof InstallationJob) {
                 InstallationJob installationJob = (InstallationJob) job;
                 if(!installationJob.status.isSuccess()) {
-			activeInstalls = true;
+            activeInstalls = true;
                 }
             }
         }
 
         if(activeInstalls) {
-		InstallUtil.persistInstallStatus(jobs); // save this info
+        InstallUtil.persistInstallStatus(jobs); // save this info
         }
         else {
-		InstallUtil.clearInstallStatus(); // clear this info
+        InstallUtil.clearInstallStatus(); // clear this info
         }
     }
 
@@ -379,7 +366,10 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
     public HttpResponse doInstallStatus(StaplerRequest request) {
         try {
             String correlationId = request.getParameter("correlationId");
+            Map<String,Object> response = new HashMap<>();
+            response.put("state", Jenkins.getInstance().getInstallState().name());
             List<Map<String, String>> installStates = new ArrayList<>();
+            response.put("jobs", installStates);
             List<UpdateCenterJob> jobCopy = getJobs();
 
             for (UpdateCenterJob job : jobCopy) {
@@ -400,7 +390,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
                     }
                 }
             }
-            return HttpResponses.okJSON(JSONArray.fromObject(installStates));
+            return HttpResponses.okJSON(JSONObject.fromObject(response));
         } catch (Exception e) {
             return HttpResponses.errorJSON(String.format("ERROR: %s", e.getMessage()));
         }
@@ -558,7 +548,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
         }
         response.sendRedirect2(".");
     }
-    
+
     /**
      * Cancel all scheduled jenkins restarts
      */
@@ -845,16 +835,16 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
 
         return new ArrayList<Plugin>(pluginMap.values());
     }
-    
+
     /**
      * Ensure that all UpdateSites are up to date, without requiring a user to
      * browse to the instance.
-     * 
+     *
      * @return a list of {@link FormValidation} for each updated Update Site
-     * @throws ExecutionException 
-     * @throws InterruptedException 
+     * @throws ExecutionException
+     * @throws InterruptedException
      * @since 1.501
-     * 
+     *
      */
     public List<FormValidation> updateAllSites() throws InterruptedException, ExecutionException {
         List <Future<FormValidation>> futures = new ArrayList<Future<FormValidation>>();
@@ -864,8 +854,8 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
                 futures.add(future);
             }
         }
-        
-        List<FormValidation> results = new ArrayList<FormValidation>(); 
+
+        List<FormValidation> results = new ArrayList<FormValidation>();
         for (Future<FormValidation> f : futures) {
             results.add(f.get());
         }
@@ -1211,7 +1201,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
         public String getErrorMessage() {
             return error != null ? error.getMessage() : null;
         }
-        
+
         public Throwable getError() {
             return error;
         }
@@ -1226,10 +1216,10 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
          */
          @Exported(inline=true)
         public volatile RestartJenkinsJobStatus status = new Pending();
-        
+
         /**
          * Cancel job
-         */     
+         */
         public synchronized boolean cancel() {
             if (status instanceof Pending) {
                 status = new Canceled();
@@ -1237,7 +1227,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
             }
             return false;
         }
-        
+
         public RestartJenkinsJob(UpdateSite site) {
             super(site);
         }
@@ -1260,26 +1250,26 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
         public abstract class RestartJenkinsJobStatus {
             @Exported
             public final int id = iota.incrementAndGet();
-   
+
         }
-        
+
         public class Pending extends RestartJenkinsJobStatus {
             @Exported
             public String getType() {
                 return getClass().getSimpleName();
             }
         }
-        
+
         public class Running extends RestartJenkinsJobStatus {
-            
+
         }
-        
+
         public class Failure extends RestartJenkinsJobStatus {
-            
+
         }
-        
+
         public class Canceled extends RestartJenkinsJobStatus {
-            
+
         }
     }
 
@@ -1603,7 +1593,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
             File baseDir = pm.rootDir;
             return new File(baseDir, plugin.name + ".jpi");
         }
-        
+
         private File getLegacyDestination() {
             File baseDir = pm.rootDir;
             return new File(baseDir, plugin.name + ".hpi");
@@ -1649,7 +1639,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
         public String toString() {
             return super.toString()+"[plugin="+plugin.title+"]";
         }
-        
+
         /**
          * Called when the download is completed to overwrite
          * the old file with the new file.
@@ -1704,7 +1694,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
             File baseDir = pm.rootDir;
             final File legacy = new File(baseDir, plugin.name + ".hpi");
             if(legacy.exists()){
-            	return legacy;
+                return legacy;
             }
             return new File(baseDir, plugin.name + ".jpi");
         }
diff --git a/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java b/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
index 8b2239f2f4..d34bb3059f 100644
--- a/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
+++ b/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
@@ -29,6 +29,7 @@ import jenkins.model.Jenkins;
 import org.kohsuke.accmod.Restricted;
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.DataBoundSetter;
 
 import javax.inject.Inject;
 import java.util.Collections;
@@ -36,30 +37,53 @@ import java.util.List;
 
 /**
  * {@link AuthorizationStrategy} that grants full-control to authenticated user
- * (other than anonymous users.)
+ * and optionally read access to anonymous users
  *
  * @author Kohsuke Kawaguchi
  */
 public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationStrategy {
+    /**
+     * Whether to allow read access, default behavior
+     * previously was true
+     */
+    private boolean allowAnonymousRead = true;
+    
     @DataBoundConstructor
     public FullControlOnceLoggedInAuthorizationStrategy() {
     }
 
     @Override
     public ACL getRootACL() {
-        return THE_ACL;
+        return allowAnonymousRead ? ANONYMOUS_READ : AUTHENTICATED_READ;
     }
 
     public List<String> getGroups() {
         return Collections.emptyList();
     }
+    
+    /**
+     * If true, anonymous read access will be allowed
+     */
+    public boolean isAllowAnonymousRead() {
+        return allowAnonymousRead;
+    }
+    
+    @DataBoundSetter
+    public void setAllowAnonymousRead(boolean allowAnonymousRead) {
+        this.allowAnonymousRead = allowAnonymousRead;
+    }
 
-    private static final SparseACL THE_ACL = new SparseACL(null);
+    private static final SparseACL AUTHENTICATED_READ = new SparseACL(null);
+    private static final SparseACL ANONYMOUS_READ = new SparseACL(null);
 
     static {
-        THE_ACL.add(ACL.EVERYONE, Jenkins.ADMINISTER,true);
-        THE_ACL.add(ACL.ANONYMOUS, Jenkins.ADMINISTER,false);
-        THE_ACL.add(ACL.ANONYMOUS,Permission.READ,true);
+        ANONYMOUS_READ.add(ACL.EVERYONE, Jenkins.ADMINISTER,true);
+        ANONYMOUS_READ.add(ACL.ANONYMOUS, Jenkins.ADMINISTER,false);
+        ANONYMOUS_READ.add(ACL.ANONYMOUS, Permission.READ,true);
+        
+        AUTHENTICATED_READ.add(ACL.EVERYONE, Jenkins.ADMINISTER, true);
+        AUTHENTICATED_READ.add(ACL.ANONYMOUS, Jenkins.ADMINISTER, false);
+        AUTHENTICATED_READ.add(ACL.ANONYMOUS, Permission.READ, false);
     }
 
     /**
diff --git a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
index ffaf8311d7..63404b636e 100644
--- a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
+++ b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
@@ -1,18 +1,18 @@
 /*
  * The MIT License
- * 
+ *
  * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi, David Calavera, Seiji Sogabe
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  * copies of the Software, and to permit persons to whom the Software is
  * furnished to do so, subject to the following conditions:
- * 
+ *
  * The above copyright notice and this permission notice shall be included in
  * all copies or substantial portions of the Software.
- * 
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
@@ -29,6 +29,8 @@ import hudson.ExtensionList;
 import hudson.Util;
 import hudson.diagnosis.OldDataMonitor;
 import hudson.model.Descriptor;
+import jenkins.install.InstallState;
+import jenkins.install.SetupWizard;
 import jenkins.model.Jenkins;
 import hudson.model.ManagementLink;
 import hudson.model.ModelObject;
@@ -97,7 +99,7 @@ public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRea
     /**
      * If true, sign up is not allowed.
      * <p>
-     * This is a negative switch so that the default value 'false' remains compatible with older installations. 
+     * This is a negative switch so that the default value 'false' remains compatible with older installations.
      */
     private final boolean disableSignup;
 
@@ -279,13 +281,24 @@ public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRea
      * This can be run by anyone, but only to create the very first user account.
      */
     public void doCreateFirstAccount(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
-        if(hasSomeUser()) {
+        boolean inSetup = !Jenkins.getInstance().getInstallState().isSetupComplete();
+        if(!inSetup && hasSomeUser()) {
             rsp.sendError(SC_UNAUTHORIZED,"First user was already created");
             return;
         }
-        User u = createAccount(req, rsp, false, "firstUser.jelly");
+        String view = "firstUser.jelly";
+        User admin = null;
+        if(inSetup) {
+            admin = getUser(SetupWizard.initialSetupAdminUserName);
+            view = "setupWizardFirstUser.jelly";
+        }
+        User u = createAccount(req, rsp, false, view);
         if (u!=null) {
             tryToMakeAdmin(u);
+            if(admin != null) {
+                admin.delete();
+            }
+            Jenkins.getInstance().setInstallState(InstallState.CREATE_ADMIN_USER.getNextState());
             loginAndTakeBack(req, rsp, u);
         }
     }
diff --git a/core/src/main/java/jenkins/install/InstallState.java b/core/src/main/java/jenkins/install/InstallState.java
index 510feb6c78..c634180bc8 100644
--- a/core/src/main/java/jenkins/install/InstallState.java
+++ b/core/src/main/java/jenkins/install/InstallState.java
@@ -34,32 +34,63 @@ import org.kohsuke.accmod.restrictions.NoExternalUse;
 @Restricted(NoExternalUse.class)
 public enum InstallState {
     /**
-     * New Jenkins install.
+     * The initial set up has been completed
      */
-    NEW,
+    INITIAL_SETUP_COMPLETED(true, null),
+    /**
+     * Creating an admin user for an initial Jenkins install.
+     */
+    CREATE_ADMIN_USER(false, INITIAL_SETUP_COMPLETED),
     /**
      * New Jenkins install. The user has kicked off the process of installing an
      * initial set of plugins (via the install wizard).
      */
-    INITIAL_PLUGINS_INSTALLING,
+    INITIAL_PLUGINS_INSTALLING(false, CREATE_ADMIN_USER),
     /**
-     * New Jenkins install. The initial set of plugins are now installed.
+     * New Jenkins install.
      */
-    INITIAL_PLUGINS_INSTALLED,
+    NEW(false, INITIAL_PLUGINS_INSTALLING),
     /**
      * Restart of an existing Jenkins install.
      */
-    RESTART,
+    RESTART(true, INITIAL_SETUP_COMPLETED),
     /**
      * Upgrade of an existing Jenkins install.
      */
-    UPGRADE,
+    UPGRADE(true, INITIAL_SETUP_COMPLETED),
     /**
      * Downgrade of an existing Jenkins install.
      */
-    DOWNGRADE,
+    DOWNGRADE(true, INITIAL_SETUP_COMPLETED),
     /**
      * Jenkins started in test mode (JenkinsRule).
      */
-    TEST
+    TEST(true, INITIAL_SETUP_COMPLETED),
+    /**
+     * Jenkins started in development mode: Bolean.getBoolean("hudson.Main.development").
+     * Can be run normally with the -Djenkins.install.runSetupWizard=true
+     */
+    DEVELOPMENT(true, INITIAL_SETUP_COMPLETED);
+
+    private final boolean isSetupComplete;
+    private final InstallState nextState;
+
+    private InstallState(boolean isSetupComplete, InstallState nextState) {
+        this.isSetupComplete = isSetupComplete;
+        this.nextState = nextState;
+    }
+
+    /**
+     * Indicates the initial setup is complete
+     */
+    public boolean isSetupComplete() {
+        return isSetupComplete;
+    }
+    
+    /**
+     * Gets the next state
+     */
+    public InstallState getNextState() {
+        return nextState;
+    }
 }
diff --git a/core/src/main/java/jenkins/install/InstallUtil.java b/core/src/main/java/jenkins/install/InstallUtil.java
index e9622b1a9a..6fff100057 100644
--- a/core/src/main/java/jenkins/install/InstallUtil.java
+++ b/core/src/main/java/jenkins/install/InstallUtil.java
@@ -68,8 +68,15 @@ public class InstallUtil {
      * @return The type of "startup" currently under way in Jenkins.
      */
     public static InstallState getInstallState() {
-        if (Functions.getIsUnitTest()) {
-            return InstallState.TEST;
+        // install wizard will always run if environment specified
+        if (!Boolean.getBoolean("jenkins.install.runSetupWizard")) {
+            if (Functions.getIsUnitTest()) {
+                return InstallState.TEST;
+            }
+            
+            if (Boolean.getBoolean("hudson.Main.development")) {
+                return InstallState.DEVELOPMENT;
+            }
         }
 
         VersionNumber lastRunVersion = new VersionNumber(getLastExecVersion());
diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java
new file mode 100644
index 0000000000..a6bde8d883
--- /dev/null
+++ b/core/src/main/java/jenkins/install/SetupWizard.java
@@ -0,0 +1,180 @@
+package jenkins.install;
+
+import java.io.IOException;
+import java.util.Locale;
+import java.util.UUID;
+import java.util.logging.Logger;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+
+import hudson.BulkChange;
+import hudson.ExtensionList;
+import hudson.model.User;
+import hudson.model.UserProperty;
+import hudson.security.AuthorizationStrategy;
+import hudson.security.FullControlOnceLoggedInAuthorizationStrategy;
+import hudson.security.HudsonPrivateSecurityRealm;
+import hudson.security.PermissionAdder;
+import hudson.security.SecurityRealm;
+import hudson.security.csrf.DefaultCrumbIssuer;
+import hudson.util.PluginServletFilter;
+import jenkins.model.Jenkins;
+import jenkins.security.s2m.AdminWhitelistRule;
+
+/**
+ * A Jenkins instance used during first-run to provide a limited set of services while
+ * initial installation is in progress
+ */
+public class SetupWizard {
+    /**
+     * The security token parameter name
+     */
+    public static String initialSetupAdminUserName = "initial-setup-admin-user";
+
+    private final Logger LOGGER = Logger.getLogger(SetupWizard.class.getName());
+
+    public SetupWizard(Jenkins j) throws IOException {
+        User admin;
+        // Create an admin user by default with a 
+        // difficult password
+        if(j.getSecurityRealm() == null || j.getSecurityRealm() == SecurityRealm.NO_AUTHENTICATION) { // this seems very fragile
+            BulkChange bc = new BulkChange(j);
+            
+            HudsonPrivateSecurityRealm securityRealm = new HudsonPrivateSecurityRealm(false, false, null);
+            j.setSecurityRealm(securityRealm);
+            String randomUUID = UUID.randomUUID().toString().replace("-", "").toLowerCase(Locale.ENGLISH);
+            admin = securityRealm.createAccount(SetupWizard.initialSetupAdminUserName, randomUUID);
+            admin.addProperty(new SetupWizard.AuthenticationKey(randomUUID));
+
+            AuthorizationStrategy as = Jenkins.getInstance().getAuthorizationStrategy();
+            for (PermissionAdder adder : ExtensionList.lookup(PermissionAdder.class)) {
+                if (adder.add(as, admin, Jenkins.ADMINISTER)) {
+                    return;
+                }
+            }
+            
+            // Lock Jenkins down:
+            FullControlOnceLoggedInAuthorizationStrategy authStrategy = new FullControlOnceLoggedInAuthorizationStrategy();
+            authStrategy.setAllowAnonymousRead(false);
+            j.setAuthorizationStrategy(authStrategy);
+            
+            // Shut down all the ports we can by default:
+            j.setSlaveAgentPort(-1); // -1 to disable
+            
+            // require a crumb issuer
+            j.setCrumbIssuer(new DefaultCrumbIssuer(false));
+            
+            // set master -> slave security:
+            j.getInjector().getInstance(AdminWhitelistRule.class)
+                .setMasterKillSwitch(false);
+            
+            try{
+                j.save(); // !!
+            } finally {
+                bc.commit();
+            }
+        }
+        else {
+            admin = j.getUser(SetupWizard.initialSetupAdminUserName);
+        }
+        
+        String setupKey = null;
+        if(admin != null && admin.getProperty(SetupWizard.AuthenticationKey.class) != null) {
+            setupKey = admin.getProperty(SetupWizard.AuthenticationKey.class).getKey();
+        }
+        if(setupKey != null) {
+            LOGGER.info("\n\n*************************************************************\n"
+                    + "*************************************************************\n"
+                    + "*************************************************************\n"
+                    + "\n"
+                    + "Jenkins initial setup is required. A security token is required to proceed. \n"
+                    + "Please use the following security token to proceed to installation: \n"
+                    + "\n"
+                    + "" + setupKey + "\n"
+                    + "\n"
+                    + "*************************************************************\n"
+                    + "*************************************************************\n"
+                    + "*************************************************************\n");
+        }
+        
+        try {
+            PluginServletFilter.addFilter(FORCE_SETUP_WIZARD_FILTER);
+        } catch (ServletException e) {
+            throw new AssertionError(e);
+        }
+    }
+
+    /**
+     * Remove the setupWizard filter, ensure all updates are written to disk, etc
+     */
+    public void doCompleteSetupWizard() {
+        InstallUtil.saveLastExecVersion();
+        try {
+            PluginServletFilter.removeFilter(FORCE_SETUP_WIZARD_FILTER);
+        } catch (ServletException e) {
+            throw new AssertionError(e); // never happen because our Filter.init is no-op
+        }
+    }
+
+    // Stores a user property for the authentication key, which is really the auto-generated user's password
+    public static class AuthenticationKey extends UserProperty {
+        String key;
+        
+        public AuthenticationKey() {
+        }
+        
+        public AuthenticationKey(String key) {
+            this.key = key;
+        }
+        
+        public String getKey() {
+            return key;
+        }
+        
+        public void setKey(String key) {
+            this.key = key;
+        }
+    }
+    
+    /**
+     * This filter will validate that the security token is provided
+     */
+    private final Filter FORCE_SETUP_WIZARD_FILTER = new Filter() {
+        @Override
+        public void init(FilterConfig cfg) throws ServletException {
+        }
+
+        @Override
+        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+            // As an extra measure of security, the install wizard generates a security token, and
+            // requires the user to enter it before proceeding through the installation. Once set
+            // we'll set a cookie so the subsequent operations succeed
+            if (request instanceof HttpServletRequest) {
+                HttpServletRequest req = (HttpServletRequest)request;
+                //if (!Pattern.compile(".*[.](css|ttf|gif|woff|eot|png|js)").matcher(req.getRequestURI()).matches()) {
+                    // Allow js & css requests through
+                if((req.getContextPath() + "/").equals(req.getRequestURI())) {
+                    chain.doFilter(new HttpServletRequestWrapper(req) {
+                        public String getRequestURI() {
+                            return getContextPath() + "/setupWizard/";
+                        }
+                    }, response);
+                    return;
+                }
+                // fall through to handling the request normally
+            }
+            chain.doFilter(request, response);
+        }
+
+        @Override
+        public void destroy() {
+        }
+    };
+}
diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java
index 60154b64fe..e6a96e9d23 100644
--- a/core/src/main/java/jenkins/model/Jenkins.java
+++ b/core/src/main/java/jenkins/model/Jenkins.java
@@ -194,6 +194,7 @@ import jenkins.ExtensionRefreshException;
 import jenkins.InitReactorRunner;
 import jenkins.install.InstallState;
 import jenkins.install.InstallUtil;
+import jenkins.install.SetupWizard;
 import jenkins.model.ProjectNamingStrategy.DefaultProjectNamingStrategy;
 import jenkins.security.ConfidentialKey;
 import jenkins.security.ConfidentialStore;
@@ -333,7 +334,13 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
     /**
      * The Jenkins instance startup type i.e. NEW, UPGRADE etc
      */
-    private InstallState installState;
+    private transient InstallState installState = InstallState.NEW;
+    
+    /**
+     * If we're in the process of an initial setup, 
+     * this will be set
+     */
+    private transient SetupWizard setupWizard;
 
     /**
      * Number of executors of the master node.
@@ -759,7 +766,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
     protected Jenkins(File root, ServletContext context, PluginManager pluginManager) throws IOException, InterruptedException, ReactorException {
         long start = System.currentTimeMillis();
 
-    	// As Jenkins is starting, grant this process full control
+        // As Jenkins is starting, grant this process full control
         ACL.impersonate(ACL.SYSTEM);
         try {
             this.root = root;
@@ -773,7 +780,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
             if (installState == InstallState.RESTART || installState == InstallState.DOWNGRADE) {
                 InstallUtil.saveLastExecVersion();
             }
-
+            
             if (!new File(root,"jobs").exists()) {
                 // if this is a fresh install, use more modern default layout that's consistent with agents
                 workspaceDir = "${JENKINS_HOME}/workspace/${ITEM_FULLNAME}";
@@ -834,6 +841,11 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
             if(KILL_AFTER_LOAD)
                 System.exit(0);
 
+            if(!installState.isSetupComplete()) {
+                // Start immediately with the setup wizard for new installs
+                setupWizard = new SetupWizard(this);
+            }
+
             launchTcpSlaveAgentListener();
 
             if (UDPBroadcastThread.PORT != -1) {
@@ -913,6 +925,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
      * Get the Jenkins {@link jenkins.install.InstallState install state}.
      * @return The Jenkins {@link jenkins.install.InstallState install state}.
      */
+    @Nonnull
     @Restricted(NoExternalUse.class)
     public InstallState getInstallState() {
         return installState;
@@ -923,7 +936,12 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
      */
     @Restricted(NoExternalUse.class)
     public void setInstallState(@Nonnull InstallState newState) {
+        InstallState prior = installState;
         installState = newState;
+        if(setupWizard != null && !newState.equals(prior) && newState.isSetupComplete()) {
+            setupWizard.doCompleteSetupWizard();
+            setupWizard = null;
+        }
     }
 
     /**
@@ -1437,10 +1455,10 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
      */
     @Exported(name="jobs")
     public List<TopLevelItem> getItems() {
-		if (authorizationStrategy instanceof AuthorizationStrategy.Unsecured ||
-			authorizationStrategy instanceof FullControlOnceLoggedInAuthorizationStrategy) {
-			return new ArrayList(items.values());
-		}
+        if (authorizationStrategy instanceof AuthorizationStrategy.Unsecured ||
+            authorizationStrategy instanceof FullControlOnceLoggedInAuthorizationStrategy) {
+            return new ArrayList(items.values());
+        }
 
         List<TopLevelItem> viewableItems = new ArrayList<TopLevelItem>();
         for (TopLevelItem item : items.values()) {
@@ -1815,11 +1833,11 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
     }
 
     public DescribableList<NodeProperty<?>, NodePropertyDescriptor> getNodeProperties() {
-    	return nodeProperties;
+        return nodeProperties;
     }
 
     public DescribableList<NodeProperty<?>, NodePropertyDescriptor> getGlobalNodeProperties() {
-    	return globalNodeProperties;
+        return globalNodeProperties;
     }
 
     /**
@@ -2428,7 +2446,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
      */
     @Override public TopLevelItem getItem(String name) throws AccessDeniedException {
         if (name==null)    return null;
-    	TopLevelItem item = items.get(name);
+        TopLevelItem item = items.get(name);
         if (item==null)
             return null;
         if (!item.hasPermission(Item.READ)) {
@@ -3079,10 +3097,10 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
     }
 
     public HttpResponse doToggleCollapse() throws ServletException, IOException {
-    	final StaplerRequest request = Stapler.getCurrentRequest();
-    	final String paneId = request.getParameter("paneId");
+        final StaplerRequest request = Stapler.getCurrentRequest();
+        final String paneId = request.getParameter("paneId");
 
-    	PaneStatusProperties.forCurrentUser().toggleCollapsed(paneId);
+        PaneStatusProperties.forCurrentUser().toggleCollapsed(paneId);
 
         return HttpResponses.forwardToPreviousPage();
     }
@@ -3113,9 +3131,9 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
                 LOGGER.info("Failed to get thread dump for node " + c.getName() + ": " + e.getMessage());
             }
         }
-		if (toComputer() == null) {
-			future.put("master", RemotingDiagnostics.getThreadDumpAsync(FilePath.localChannel));
-		}
+        if (toComputer() == null) {
+            future.put("master", RemotingDiagnostics.getThreadDumpAsync(FilePath.localChannel));
+        }
 
         // if the result isn't available in 5 sec, ignore that.
         // this is a precaution against hang nodes
@@ -3891,6 +3909,13 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
     public List<ManagementLink> getManagementLinks() {
         return ManagementLink.all();
     }
+    
+    /**
+     * If set, a currently active setup wizard - e.g. installation
+     */
+    public SetupWizard getSetupWizard() {
+        return setupWizard;
+    }
 
     /**
      * Exposes the current user to <tt>/me</tt> URL.
diff --git a/core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/config.jelly b/core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/config.jelly
new file mode 100644
index 0000000000..0e627effbc
--- /dev/null
+++ b/core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/config.jelly
@@ -0,0 +1,7 @@
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson"
+  xmlns:f="/lib/form">
+  <f:entry field="allowAnonymousRead">
+    <f:checkbox default="true" title="${%Allow anonymous read access}"/>
+  </f:entry>
+</j:jelly>
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryForm.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryForm.jelly
index bb12a30aa9..346d8c4d53 100644
--- a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryForm.jelly
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryForm.jelly
@@ -25,64 +25,43 @@ THE SOFTWARE.
 <!-- tag file sed by both signup.jelly and addUser.jelly -->
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <l:layout norefresh="true" title="${%Sign up}">
-    <l:header>
-      <style>
-        <!-- match width with captcha image -->
-        INPUT {
-          width:200px;
-        }
-      </style>
-    </l:header>
-    <l:hasPermission permission="${app.READ}" it="${host}">
-      <st:include page="sidepanel.jelly" it="${host}" />
-    </l:hasPermission>
-    <l:main-panel>
-      <h1>${title}</h1>
-      <div style="margin: 2em;">
-        <j:if test="${data.errorMessage!=null}">
-          <div class="error" style="margin-bottom:1em">
-            ${data.errorMessage}
-          </div>
-        </j:if>
-        <form action="${rootURL}/securityRealm/${action}" method="post" style="text-size:smaller">
-          <table>
-            <tr>
-              <td>${%Username}:</td>
-              <td><input type="text" name="username" id="username" value="${data.username}" /></td>
-            </tr>
-            <tr>
-              <td>${%Password}:</td>
-              <td><input type="password" name="password1" value="${data.password1}" /></td>
-            </tr>
-            <tr>
-              <td>${%Confirm password}:</td>
-              <td><input type="password" name="password2" value="${data.password2}" /></td>
-            </tr>
-            <tr>
-              <td>${%Full name}:</td>
-              <td><input type="text" name="fullname" value="${data.fullname}" /></td>
-            </tr>
-            <tr>
-              <td>${%E-mail address}:</td>
-              <td><input type="text" name="email" value="${data.email}" /></td>
-            </tr>
-            <j:if test="${captcha}">
-              <tr>
-                <td>${%Enter text as shown}:</td>
-                <td>
-                  <input type="text" name="captcha" autocomplete="off" /><br />
-                  <img src="${rootURL}/securityRealm/captcha" alt="[captcha]"/>
-                </td>
-              </tr>
-            </j:if>
-          </table>
-          <f:submit value="${title}" />
-          <script>
-            $('username').focus();
-          </script>
-        </form>
+  <h1>${title}</h1>
+  <div style="margin: 2em;">
+    <j:if test="${data.errorMessage!=null}">
+      <div class="error" style="margin-bottom:1em">
+        ${data.errorMessage}
       </div>
-    </l:main-panel>
-  </l:layout>
+    </j:if>
+      <table>
+        <tr>
+          <td>${%Username}:</td>
+          <td><input type="text" name="username" id="username" value="${data.username}" /></td>
+        </tr>
+        <tr>
+          <td>${%Password}:</td>
+          <td><input type="password" name="password1" value="${data.password1}" /></td>
+        </tr>
+        <tr>
+          <td>${%Confirm password}:</td>
+          <td><input type="password" name="password2" value="${data.password2}" /></td>
+        </tr>
+        <tr>
+          <td>${%Full name}:</td>
+          <td><input type="text" name="fullname" value="${data.fullname}" /></td>
+        </tr>
+        <tr>
+          <td>${%E-mail address}:</td>
+          <td><input type="text" name="email" value="${data.email}" /></td>
+        </tr>
+        <j:if test="${captcha}">
+          <tr>
+            <td>${%Enter text as shown}:</td>
+            <td>
+              <input type="text" name="captcha" autocomplete="off" /><br />
+              <img src="${rootURL}/securityRealm/captcha" alt="[captcha]"/>
+            </td>
+          </tr>
+        </j:if>
+      </table>
+  </div>
 </j:jelly>
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryFormPage.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryFormPage.jelly
new file mode 100644
index 0000000000..8009ad6518
--- /dev/null
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/_entryFormPage.jelly
@@ -0,0 +1,50 @@
+<!--
+The MIT License
+
+Copyright (c) 2004-2016, Sun Microsystems, Inc., CloudBees, Inc., Kohsuke Kawaguchi, Seiji Sogabe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+
+<!-- tag file used by both signup.jelly and addUser.jelly -->
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+  <l:layout norefresh="true" title="${title}">
+    <l:header>
+      <style>
+        <!-- match width with captcha image -->
+        INPUT {
+          width:200px;
+        }
+      </style>
+    </l:header>
+    <l:hasPermission permission="${app.READ}" it="${host}">
+      <st:include page="sidepanel.jelly" it="${host}" />
+    </l:hasPermission>
+    <l:main-panel>
+      <form action="${rootURL}/securityRealm/${action}" method="post" style="text-size:smaller">
+        <local:_entryForm title="${title}" action="${action}" captcha="${captcha}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
+        <f:submit value="${title}" />
+        <script>
+          $('username').focus();
+        </script>
+      </form>
+    </l:main-panel>
+  </l:layout>
+</j:jelly>
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/addUser.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/addUser.jelly
index aed3d5c5c8..daacc17bfc 100644
--- a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/addUser.jelly
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/addUser.jelly
@@ -27,5 +27,5 @@ THE SOFTWARE.
 -->
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <local:_entryForm host="${it}" title="${%Create User}" action="createAccountByAdmin" captcha="${false}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
+  <local:_entryFormPage host="${it}" title="${%Create User}" action="createAccountByAdmin" captcha="${false}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
 </j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/firstUser.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/firstUser.jelly
index bc44b42acc..6ebd369ae0 100644
--- a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/firstUser.jelly
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/firstUser.jelly
@@ -27,5 +27,5 @@ THE SOFTWARE.
 -->
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <local:_entryForm host="${it}" title="${%Create First Admin User}" action="createFirstAccount" captcha="${false}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
+  <local:_entryFormPage host="${it}" title="${%Create First Admin User}" action="createFirstAccount" captcha="${false}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
 </j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/setupWizardFirstUser.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/setupWizardFirstUser.jelly
new file mode 100644
index 0000000000..4f7475462f
--- /dev/null
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/setupWizardFirstUser.jelly
@@ -0,0 +1,53 @@
+<!--
+  This is used to create the first user.
+-->
+<?jelly escape-by-default='true'?>
+<l:html norefresh="true" title="${it.displayName}" xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+  <l:main-panel>
+    <style type="text/css">
+      @import url(https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css);
+      @import url(https://fonts.googleapis.com/css?family=Roboto:400,300,500,900,700);
+      
+      #main-panel {
+          margin: 0;
+          padding: 0;
+      }
+      tr td {
+          padding-bottom: 2px;
+      }
+      body {
+          padding: 20px 20px 20px 100px;
+          font-family: 'roboto';
+      }
+      form > div {
+          margin: 0 !important;
+      }
+      h1 {
+          font-family: 'roboto', sans-serif;
+          font-size: 48px;
+          margin-top: 30px;
+          font-weight: 500;
+      }
+      h1 img {
+          position: absolute;
+          right: -80px;
+          top: 38px;
+      }
+      tr td, input {
+          line-height: 25px;
+          margin-bottom: 6px;
+      }
+      input[type=text], input[type=password] {
+          border: 1px solid #ddd;
+          border-radius: 2px;
+          padding: 1px 8px;
+      }
+    </style>
+    <form action="${rootURL}/securityRealm/${action}" method="post">
+      <local:_entryForm host="${app.securityRealm}" title="${%Create First Admin User}" action="createFirstAccount" captcha="${false}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
+      <script>
+        $('username').focus();
+      </script>
+    </form>
+  </l:main-panel>
+</l:html>
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signup.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signup.jelly
index 656e96c3c9..f2477da1df 100644
--- a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signup.jelly
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signup.jelly
@@ -27,5 +27,5 @@ THE SOFTWARE.
 -->
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <local:_entryForm host="${app}" title="${%Sign up}" action="createAccount" captcha="${it.isEnableCaptcha()}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
+  <local:_entryFormPage host="${app}" title="${%Sign up}" action="createAccount" captcha="${it.isEnableCaptcha()}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
 </j:jelly>
diff --git a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signupWithFederatedIdentity.jelly b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signupWithFederatedIdentity.jelly
index 01c0197a62..8daec8d381 100644
--- a/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signupWithFederatedIdentity.jelly
+++ b/core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/signupWithFederatedIdentity.jelly
@@ -27,5 +27,5 @@ THE SOFTWARE.
 -->
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <local:_entryForm host="${app}" title="${%Sign up}" action="createAccountWithFederatedIdentity" captcha="${true}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
+  <local:_entryFormPage host="${app}" title="${%Sign up}" action="createAccountWithFederatedIdentity" captcha="${true}" xmlns:local="/hudson/security/HudsonPrivateSecurityRealm" />
 </j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/jenkins/install/SetupWizard/authenticate-security-token.jelly b/core/src/main/resources/jenkins/install/SetupWizard/authenticate-security-token.jelly
new file mode 100644
index 0000000000..b22936d9ad
--- /dev/null
+++ b/core/src/main/resources/jenkins/install/SetupWizard/authenticate-security-token.jelly
@@ -0,0 +1,44 @@
+<?jelly escape-by-default='true'?>
+<l:html norefresh="true" title="${app.instance.displayName}" xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+  <l:main-panel>
+    <form action="${app.instance.securityRealm.authenticationGatewayUrl}" method="POST">
+        <div class="plugin-setup-wizard bootstrap-3">
+          <div class="modal fade in" style="display: block;">
+            <div class="modal-dialog">
+              <div class="modal-content">
+                
+                <div class="modal-header">
+                  <h4 class="modal-title">${%Security Token}</h4>
+                </div>
+                <div class="modal-body">
+                  <i class="water-mark icon-service"></i>
+                  <div class="jumbotron welcome-panel offline">
+                  
+                    <h1>${%Security Token}</h1>
+                    <p>${%As an extra measure of security, please enter the setup security token to proceed.}</p>
+                    <p>${%It can be found in the logs for this Jenkins instance.}</p>
+                    <j:if test="${error}">
+                        <div class="alert alert-danger">
+                          <strong>${%ERROR:} </strong>
+                          ${%There is a problem with your security token, please check the server logs for the correct token}
+                        </div>
+                    </j:if>
+                    <div class="form-group ${error ? 'has-error' : ''}">
+                    <label class="control-label" for="security-token">${%Security token}</label>
+                    <input name="j_username" value="${j.setupWizard.initialSetupAdminUserName}" type="hidden"/>
+                    <input id="security-token" class="form-control" name="j_password"/>
+                    <link rel="stylesheet" href="${j.installWizardPath}.css" type="text/css" />
+                    </div>
+                    
+                  </div>
+                </div>
+                <div class="modal-footer">
+                  <input type="submit" class="btn btn-primary set-security-key" value="${%Continue}"/>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+    </form>
+  </l:main-panel>
+</l:html>
diff --git a/core/src/main/resources/jenkins/install/SetupWizard/index.jelly b/core/src/main/resources/jenkins/install/SetupWizard/index.jelly
new file mode 100644
index 0000000000..d001d433d5
--- /dev/null
+++ b/core/src/main/resources/jenkins/install/SetupWizard/index.jelly
@@ -0,0 +1,8 @@
+<?jelly escape-by-default='true'?>
+<l:html norefresh="true" title="${it.displayName}" xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+  <l:main-panel>
+    <div class="plugin-setup-wizard-container"></div>
+    <script src="${resURL}/${j.installWizardPath}.js" type="text/javascript"/>
+    <link rel="stylesheet" href="${resURL}/${j.installWizardPath}.css" type="text/css" />
+  </l:main-panel>
+</l:html>
diff --git a/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly b/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly
new file mode 100644
index 0000000000..132609baab
--- /dev/null
+++ b/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly
@@ -0,0 +1,13 @@
+<?jelly escape-by-default='true'?>
+<l:html norefresh="true" title="${it.displayName}" xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+  <l:main-panel>
+      <h1>${%HTTP Proxy Configuration}</h1>
+      <f:form method="post" action="proxyConfigure" name="proxyConfigure">
+        <j:scope>
+          <j:set var="instance" value="${app.proxy}"/>
+          <j:set var="descriptor" value="${it.pluginManager.proxyDescriptor}"/>
+          <st:include from="${descriptor}" page="${descriptor.configPage}" />
+        </j:scope>
+      </f:form>
+  </l:main-panel>
+</l:html>
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
index f86316fc83..ece2cf0c6a 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
@@ -28,7 +28,8 @@ installWizard_installing_title=Installing...
 installWizard_installing_detailsLink=Details...
 installWizard_installComplete_title=Installed
 installWizard_installComplete_banner=Jenkins is ready!
-installWizard_installComplete_message=Your plugin installations are complete.
+installWizard_pluginsInstalled_message=Your plugin installations are complete.
+installWizard_installComplete_message=Your Jenkins installation is complete.
 installWizard_installComplete_finishButtonLabel=Get Started
 installWizard_installComplete_restartRequiredMessage=Some plugins require Jenkins to be restarted.
 installWizard_installComplete_restartLabel=Restart
@@ -36,3 +37,8 @@ installWizard_installIncomplete_title=Resume Installation
 installWizard_installIncomplete_banner=Resume Installation
 installWizard_installIncomplete_message=Jenknins was restarted during installation and some plugins didn't seem to get installed.
 installWizard_installIncomplete_resumeInstallationButtonLabel=Resume
+installWizard_saveFirstUser=Save and Finish
+installWizard_addFirstUser_title=Create an Admin User
+installWizard_configureProxy_label=Configure Proxy
+installWizard_configureProxy_save=Save and Continue
+installWizard_skipPluginInstallations=Skip Plugin Installations
diff --git a/core/src/main/resources/jenkins/model/Jenkins/login.jelly b/core/src/main/resources/jenkins/model/Jenkins/login.jelly
index f7e02a5f50..b3c91c7b5b 100644
--- a/core/src/main/resources/jenkins/model/Jenkins/login.jelly
+++ b/core/src/main/resources/jenkins/model/Jenkins/login.jelly
@@ -24,6 +24,10 @@ THE SOFTWARE.
 
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+  <j:if test="${it.setupWizard != null}">
+    <st:include it="${it.setupWizard}" page="authenticate-security-token"/>
+  </j:if>
+  <j:if test="${it.setupWizard == null}">
   <l:layout norefresh="true">
     <l:hasPermission permission="${app.READ}">
       <st:include page="sidepanel.jelly" />
@@ -70,4 +74,5 @@ THE SOFTWARE.
       </div>
     </l:main-panel>
   </l:layout>
+  </j:if>
 </j:jelly>
diff --git a/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly b/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly
index 6f7c2bfb22..61f227dfb3 100644
--- a/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly
+++ b/core/src/main/resources/jenkins/model/Jenkins/loginError.jelly
@@ -27,6 +27,10 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:choose>
     <j:new var="h" className="hudson.Functions" />
+    <j:when test="${app.setupWizard != null}">
+      <j:set var="error" value="true"/>
+      <st:include it="${app.setupWizard}" page="authenticate-security-token"/>
+    </j:when>
     <j:when test="${app.isUseSecurity() and h.isAnonymous()}">
       <!--
         The only time the error message makes sense is when Jenkins is protected and the user failed to authenticate.
diff --git a/core/src/main/resources/lib/layout/html.jelly b/core/src/main/resources/lib/layout/html.jelly
new file mode 100644
index 0000000000..098f4d0d98
--- /dev/null
+++ b/core/src/main/resources/lib/layout/html.jelly
@@ -0,0 +1,177 @@
+<!--
+The MIT License
+
+Copyright (c) 2004-2016, Sun Microsystems, Inc., Kohsuke Kawaguchi,
+Daniel Dyer, Seiji Sogabe, Tom Huybrechts, Manufacture Francaise des Pneumatiques
+Michelin, Romain Seguy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:i="jelly:fmt" xmlns:x="jelly:xml">
+  <st:documentation>
+    Outer-most tag for a normal (non-AJAX) HTML rendering.
+    This is used with nested &lt;header>, &lt;side-panel>, and &lt;main-panel>
+    to form Jenkins's basic HTML layout.
+
+    <st:attribute name="title" use="required">
+      Title of the HTML page. Rendered into &lt;title> tag.
+    </st:attribute>
+    <st:attribute name="norefresh">
+      If non-null and not "false", auto refresh is disabled on this page.
+      This is necessary for pages that include forms.
+    </st:attribute>
+    <st:attribute name="css" deprecated="true">
+      specify path that starts from "/" for loading additional CSS stylesheet.
+      path is interprted as relative to the context root. e.g.,
+
+      {noformat}&lt;l:layout css="/plugin/mysuperplugin/css/myneatstyle.css">{noformat}
+
+      This was originally added to allow plugins to load their stylesheets, but
+      *the use of thie attribute is discouraged now.*
+      plugins should now do so by inserting &lt;style> elements and/or &lt;script> elements
+      in &lt;l:header/> tag.
+    </st:attribute>
+    <st:attribute name="permission">
+      If given, this page is only made available to users that has the specified permission.
+      (The permission will be checked against the "it" object.)
+    </st:attribute>
+  </st:documentation>
+<st:setHeader name="Expires" value="0" />
+<st:setHeader name="Cache-Control" value="no-cache,no-store,must-revalidate" />
+<st:setHeader name="X-Hudson-Theme" value="default" />
+<st:contentType value="text/html;charset=UTF-8" />
+
+  <j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->
+${h.initPageVariables(context)}
+<!--
+  depending on what tags are used, we can later end up discovering that we needed a session,
+  but it's too late because the headers are already committed. so ensure we always have a session.
+  this also allows us to configure HttpSessionContextIntegrationFilter not to create sessions,
+  which I suspect can end up creating sessions for wrong resource types (such as static resources.)
+-->
+<j:set var="isMSIE" value="${userAgent.contains('MSIE')}"/>
+<j:set var="_" value="${request.getSession()}"/>
+<j:set var="_" value="${h.configureAutoRefresh(request, response, attrs.norefresh!=null and !attrs.norefresh.equals(false))}"/>
+  <j:set var="extensionsAvailable" value="${h.extensionsAvailable}"/>
+  <j:if test="${request.servletPath=='/' || request.servletPath==''}">
+    ${h.advertiseHeaders(response)}
+    <j:if test="${extensionsAvailable}">
+      <j:forEach var="pd" items="${h.pageDecorators}">
+        <st:include it="${pd}" page="httpHeaders.jelly" optional="true"/>
+      </j:forEach>
+    </j:if>
+  </j:if>
+<x:doctype name="html" />
+<html>
+  <head data-rooturl="${rootURL}" data-resurl="${resURL}" resURL="${resURL}">
+    ${h.checkPermission(it,permission)}
+
+    <j:if test="${isMSIE}">
+      <meta http-equiv="X-UA-Compatible" content="IE=Edge"/>
+    </j:if>
+
+    <title>${h.appendIfNotNull(title, ' [Jenkins]', 'Jenkins')}</title>
+    <link rel="stylesheet" href="${resURL}/css/style.css" type="text/css" />
+    <link rel="stylesheet" href="${resURL}/css/color.css" type="text/css" />
+    <link rel="stylesheet" href="${resURL}/css/responsive-grid.css" type="text/css" />
+    <j:if test="${attrs.css!=null}">
+      <link rel="stylesheet" href="${resURL}${attrs.css}" type="text/css" />
+    </j:if>
+    <link rel="shortcut icon" href="${resURL}/favicon.ico" type="image/vnd.microsoft.icon" />
+    <link rel="mask-icon" href="${rootURL}/images/mask-icon.svg" color="black" />
+
+    <!-- are we running as an unit test? -->
+    <script>var isRunAsTest=${h.isUnitTest}; var rootURL="${rootURL}"; var resURL="${resURL}";</script>
+
+    <script src="${resURL}/scripts/prototype.js" type="text/javascript"/>
+    <script src="${resURL}/scripts/behavior.js" type="text/javascript"/>
+
+    <!-- we include our own prototype.js, so don't let stapler pull in another. -->
+    <st:adjunct assumes="org.kohsuke.stapler.framework.prototype.prototype"
+                includes="org.kohsuke.stapler.bind"/>
+
+    <!-- To use the debug version of YUI, set the system property 'debug.YUI' to true -->
+    <j:set var="yuiSuffix" value="${h.yuiSuffix}" />
+    <l:yui module="yahoo" />
+    <l:yui module="dom" />
+    <l:yui module="event" />
+    <j:if test="${h.yuiSuffix=='debug'}">
+      <l:yui module="logger" />
+    </j:if>
+    <l:yui module="animation" />
+    <l:yui module="dragdrop" />
+    <l:yui module="container" />
+    <l:yui module="connection" />
+    <l:yui module="datasource" />
+    <l:yui module="autocomplete" />
+    <l:yui module="menu" />
+    <l:yui module="element" />
+    <l:yui module="button" />
+    <l:yui module="storage" />
+    <!--l:yui module="editor" suffix="-beta" /-->
+
+    <script src="${resURL}/scripts/hudson-behavior.js" type="text/javascript"></script>
+    <script src="${resURL}/scripts/sortable.js" type="text/javascript"/>
+
+    <j:if test="${extensionsAvailable}">
+      <script>
+          crumb.init("${h.getCrumbRequestField()}", "${h.getCrumb(request)}");
+      </script>
+    </j:if>
+
+    <link rel="stylesheet" href="${resURL}/scripts/yui/container/assets/container.css" type="text/css"/>
+    <link rel="stylesheet" href="${resURL}/scripts/yui/assets/skins/sam/skin.css" type="text/css" />
+    <link rel="stylesheet" href="${resURL}/scripts/yui/container/assets/skins/sam/container.css" type="text/css"/>
+    <link rel="stylesheet" href="${resURL}/scripts/yui/button/assets/skins/sam/button.css" type="text/css" />
+    <link rel="stylesheet" href="${resURL}/scripts/yui/menu/assets/skins/sam/menu.css" type="text/css" />
+    <!--link rel="stylesheet" href="${resURL}/scripts/yui/editor/assets/skins/sam/editor.css" type="text/css" /-->
+
+    <l:hasPermission permission="${app.READ}">
+      <link rel="search" type="application/opensearchdescription+xml" href="${rootURL}/opensearch.xml" title="Jenkins" />
+    </l:hasPermission>
+    <meta name="ROBOTS" content="INDEX,NOFOLLOW" />
+    <j:set var="mode" value="header" />
+    <d:invokeBody />
+    <j:if test="${extensionsAvailable}">
+      <j:forEach var="pd" items="${h.pageDecorators}">
+        <st:include it="${pd}" page="header.jelly" optional="true" />
+      </j:forEach>
+    </j:if>
+
+  <j:invokeStatic var="j" className="jenkins.model.Jenkins" method="getActiveInstance" />
+    <j:set var="installState" value="${j.installState.name()}" />
+    <j:if test="${installState == 'NEW' || installState == 'INITIAL_PLUGINS_INSTALLING'}">
+      <script src="${resURL}/${j.installWizardPath}.js" type="text/javascript"/>
+      <link rel="stylesheet" href="${resURL}/${j.installWizardPath}.css" type="text/css" />
+    </j:if>
+
+    <j:if test="${isMSIE}">
+      <script src="${resURL}/scripts/msie.js" type="text/javascript"/>
+    </j:if>
+
+  </head>
+  <body id="jenkins" class="yui-skin-sam jenkins-${h.version}" data-version="jenkins-${h.version}" data-model-type="${it.class.name}">
+      <div id="main-panel" style="margin-left: 0;">
+         <j:set var="mode" value="main-panel" />
+         <d:invokeBody />
+      </div>
+  </body>
+</html>
+</j:jelly>
diff --git a/core/src/main/resources/lib/layout/layout.jelly b/core/src/main/resources/lib/layout/layout.jelly
index 632f576388..e0bdb005c5 100644
--- a/core/src/main/resources/lib/layout/layout.jelly
+++ b/core/src/main/resources/lib/layout/layout.jelly
@@ -157,10 +157,6 @@ ${h.initPageVariables(context)}
 
 	<j:invokeStatic var="j" className="jenkins.model.Jenkins" method="getActiveInstance" />
     <j:set var="installState" value="${j.installState.name()}" />
-    <j:if test="${installState == 'NEW' || installState == 'INITIAL_PLUGINS_INSTALLING'}">
-      <script src="${resURL}/${j.installWizardPath}.js" type="text/javascript"/>
-      <link rel="stylesheet" href="${resURL}/${j.installWizardPath}.css" type="text/css" />
-    </j:if>
 
     <j:if test="${isMSIE}">
       <script src="${resURL}/scripts/msie.js" type="text/javascript"/>
diff --git a/test/src/test/java/hudson/model/UpdateCenterPluginInstallTest.java b/test/src/test/java/hudson/model/UpdateCenterPluginInstallTest.java
index a9b9901304..fe651a8263 100644
--- a/test/src/test/java/hudson/model/UpdateCenterPluginInstallTest.java
+++ b/test/src/test/java/hudson/model/UpdateCenterPluginInstallTest.java
@@ -75,7 +75,8 @@ public class UpdateCenterPluginInstallTest {
         String correlationId = data.getString("correlationId");
         JSONObject installStatus = jenkinsRule.getJSON("updateCenter/installStatus?correlationId=" + correlationId).getJSONObject();
         Assert.assertEquals("ok", json.get("status"));
-        JSONArray states = installStatus.getJSONArray("data");
+        JSONObject status = installStatus.getJSONObject("data");
+        JSONArray states = status.getJSONArray("jobs");
         Assert.assertEquals(2, states.size());
 
         JSONObject pluginInstallState = states.getJSONObject(0);
diff --git a/war/src/main/js/api/securityConfig.js b/war/src/main/js/api/securityConfig.js
new file mode 100644
index 0000000000..2f5b0cf7fb
--- /dev/null
+++ b/war/src/main/js/api/securityConfig.js
@@ -0,0 +1,33 @@
+/**
+ * Provides a wrapper to interact with the security configuration
+ */
+
+var jenkins = require('../util/jenkins');
+var jquery = require('jquery-detached');
+var wh = require('window-handle');
+
+/**
+ * Calls a stapler post method to save the first user settings
+ */
+exports.saveFirstUser = function($form, success, error) {
+	jenkins.staplerPost(
+			'/securityRealm/createFirstAccount',
+		$form,
+		success, {
+			dataType: 'html',
+			error: error
+		});
+};
+
+/**
+ * Calls a stapler post method to save the first user settings
+ */
+exports.saveProxy = function($form, success, error) {
+	jenkins.staplerPost(
+			'/proxyConfigure',
+		$form,
+		success, {
+			dataType: 'html',
+			error: error
+		});
+};
diff --git a/war/src/main/js/pluginSetupWizard.js b/war/src/main/js/pluginSetupWizard.js
index 38e577c3c8..a5d3af7222 100644
--- a/war/src/main/js/pluginSetupWizard.js
+++ b/war/src/main/js/pluginSetupWizard.js
@@ -6,5 +6,10 @@ var pluginSetupWizard = require('./pluginSetupWizardGui');
 
 // This entry point for the bundle only bootstraps the main module in a browser
 $(function() {
-	pluginSetupWizard.init();
+	$('.plugin-setup-wizard-container').each(function() {
+		var $container = $(this);
+		if($container.children().length === 0) { // this may get double-initialized
+			pluginSetupWizard.init($container);
+		}
+	});
 });
diff --git a/war/src/main/js/pluginSetupWizardGui.js b/war/src/main/js/pluginSetupWizardGui.js
index a8b304146b..3728e52aac 100644
--- a/war/src/main/js/pluginSetupWizardGui.js
+++ b/war/src/main/js/pluginSetupWizardGui.js
@@ -7,9 +7,13 @@ var jquery = require('jquery-detached');
 var bootstrap = require('bootstrap-detached');
 var jenkins = require('./util/jenkins');
 var pluginManager = require('./api/pluginManager');
+var securityConfig = require('./api/securityConfig');
+var wh = require('window-handle');
+
+window.zq = jquery.getJQuery();
 
 // Setup the dialog, exported
-var createPluginSetupWizard = function() {
+var createPluginSetupWizard = function(appendTarget) {
 	// call getJQuery / getBootstrap within the main function so it will work with tests -- if getJQuery etc is called in the main
 	var $ = jquery.getJQuery();
 	var $bs = bootstrap.getBootstrap();
@@ -96,6 +100,9 @@ var createPluginSetupWizard = function() {
 	var progressPanel = require('./templates/progressPanel.hbs');
 	var pluginSelectionPanel = require('./templates/pluginSelectionPanel.hbs');
 	var successPanel = require('./templates/successPanel.hbs');
+	var setupCompletePanel = require('./templates/setupCompletePanel.hbs');
+	var proxyConfigPanel = require('./templates/proxyConfigPanel.hbs');
+	var firstUserPanel = require('./templates/firstUserPanel.hbs');
 	var offlinePanel = require('./templates/offlinePanel.hbs');
 	var pluginSetupWizard = require('./templates/pluginSetupWizard.hbs');
 	var incompleteInstallationPanel = require('./templates/incompleteInstallationPanel.hbs');
@@ -120,15 +127,15 @@ var createPluginSetupWizard = function() {
 
 	// state variables for plugin data, selected plugins, etc.:
 	var pluginList = pluginManager.plugins();
-    var allPluginNames = pluginManager.pluginNames();
-    var selectedPluginNames = pluginManager.recommendedPluginNames();
-    var categories = [];
-    var availablePlugins = {};
-    var categorizedPlugins = {};
+	var allPluginNames = pluginManager.pluginNames();
+	var selectedPluginNames = pluginManager.recommendedPluginNames();
+	var categories = [];
+	var availablePlugins = {};
+	var categorizedPlugins = {};
 
 	// Instantiate the wizard panel
 	var $wizard = $(pluginSetupWizard());
-	$wizard.appendTo('body');
+	$wizard.appendTo(appendTarget);
 	var $container = $wizard.find('.modal-content');
 	var currentPanel;
 
@@ -151,10 +158,10 @@ var createPluginSetupWizard = function() {
 	var translations = {};
 
 	var decorations = [
-        function() {
+		function() {
 		// any decorations after DOM replacement go here
-        }
-    ];
+		}
+	];
 
 	// call this to set the panel in the app, this performs some additional things & adds common transitions
 	var setPanel = function(panel, data, oncomplete) {
@@ -163,7 +170,7 @@ var createPluginSetupWizard = function() {
 				decorations[i]($base);
 			}
 		};
-		var html = panel($.extend({translations: translations}, data));
+		var html = panel($.extend({translations: translations, baseUrl: jenkins.baseUrl}, data));
 		if(panel === currentPanel) { // just replace id-marked elements
 			var $upd = $(html);
 			$upd.find('*[id]').each(function() {
@@ -241,25 +248,25 @@ var createPluginSetupWizard = function() {
 	// Initializes the set of installing plugins with pending statuses
 	var initInstallingPluginList = function() {
 		installingPlugins = [];
-        installingPlugins.names = [];
+		installingPlugins.names = [];
 		for (var i = 0; i < selectedPluginNames.length; i++) {
-            var pluginName = selectedPluginNames[i];
-            var p = availablePlugins[ pluginName];
+			var pluginName = selectedPluginNames[i];
+			var p = availablePlugins[ pluginName];
 			if (p) {
 				var plug = $.extend({
 					installStatus : 'pending'
 				}, p);
 				installingPlugins.push(plug);
 				installingPlugins[plug.name] = plug;
-                installingPlugins.names.push(pluginName);
+				installingPlugins.names.push(pluginName);
 			}
 		}
 	};
 
 	// call this to go install the selected set of plugins
-    var installPlugins = function(plugins) {
+	var installPlugins = function(plugins) {
 		pluginManager.installPlugins(plugins, handleGenericError(function() {
-            showInstallProgress();
+			showInstallProgress();
 		}));
 
 		setPanel(progressPanel, { installingPlugins : installingPlugins });
@@ -273,13 +280,22 @@ var createPluginSetupWizard = function() {
 	};
 
 	// Define actions
-	var showInstallProgress = function() {
-        initInstallingPluginList();
+	var showInstallProgress = function(state) {
+		if(state) {
+			if(/CREATE_ADMIN_USER/.test(state)) {
+				setupFirstUser();
+				return;
+			}
+		}
+
+		initInstallingPluginList();
 		setPanel(progressPanel, { installingPlugins : installingPlugins });
 
 		// call to the installStatus, update progress bar & plugin details; transition on complete
 		var updateStatus = function() {
-			pluginManager.installStatus(handleGenericError(function(jobs) {
+			pluginManager.installStatus(handleGenericError(function(data) {
+				var jobs = data.jobs;
+				
 				var i, j;
 				var complete = 0;
 				var total = 0;
@@ -369,10 +385,7 @@ var createPluginSetupWizard = function() {
 				else {
 					// mark complete
 					$('.progress-bar').css({width: '100%'});
-					setPanel(successPanel, {
-						installingPlugins : installingPlugins,
-						restartRequired: restartRequired
-					});
+					setupFirstUser();
 				}
 			}));
 		};
@@ -481,28 +494,28 @@ var createPluginSetupWizard = function() {
 	});
 
 	// walk the elements and search for the text
-    var walk = function(elements, element, text, xform) {
-        var i, child, n= element.childNodes.length;
-        for (i = 0; i<n; i++) {
-            child = element.childNodes[i];
-            if (child.nodeType===3 && xform(child.data).indexOf(text)!==-1) {
-                elements.push(element);
-                break;
-            }
-        }
-        for (i = 0; i<n; i++) {
-            child = element.childNodes[i];
-            if (child.nodeType === 1) {
-                walk(elements, child, text, xform);
-            }
-        }
-    };
+	var walk = function(elements, element, text, xform) {
+		var i, child, n= element.childNodes.length;
+		for (i = 0; i<n; i++) {
+			child = element.childNodes[i];
+			if (child.nodeType===3 && xform(child.data).indexOf(text)!==-1) {
+				elements.push(element);
+				break;
+			}
+		}
+		for (i = 0; i<n; i++) {
+			child = element.childNodes[i];
+			if (child.nodeType === 1) {
+				walk(elements, child, text, xform);
+			}
+		}
+	};
 
-    // find elements matching the given text, optionally transforming the text before match (e.g. you can .toLowerCase() it)
+	// find elements matching the given text, optionally transforming the text before match (e.g. you can .toLowerCase() it)
 	var findElementsWithText = function(ancestor, text, xform) {
-	    var elements= [];
-	    walk(elements, ancestor, text, xform ? xform : function(d){ return d; });
-	    return elements;
+		var elements= [];
+		walk(elements, ancestor, text, xform ? xform : function(d){ return d; });
+		return elements;
 	};
 
 	// search UI vars
@@ -613,7 +626,59 @@ var createPluginSetupWizard = function() {
 			$c.slideDown();
 		}
 	};
-
+	
+	var enableButtonsAfterFrameLoad = function() {
+		$('iframe[src]').load(function() {
+			var location = $(this).contents().get(0).location.href;
+			$('button').prop({disabled:false});
+		});
+	};
+	
+	var setupFirstUser = function() {
+		setPanel(firstUserPanel, {}, enableButtonsAfterFrameLoad);
+	};
+	
+	// call to submit the firstuser
+	var saveFirstUser = function() {
+		$('button').prop({disabled:true});
+		var handleSubmit = function(data) {
+			if(data.status && data.status > 200) {
+				// Nothing we can really do here
+				setPanel(errorPanel, { errorMessage: data.statusText });
+				return;
+			}
+			// we get 200 OK
+			var $page = $(data);
+			var $errors = $page.find('.error');
+			if($errors.length > 0) {
+				var $main = $page.find('#main-panel').detach();
+				if($main.length > 0) {
+					data = data.replace(/body([^>]*)[>](.|[\r\n])+[<][/]body/,'body$1>'+$main.html()+'</body');
+				}
+				var doc = $('iframe[src]').contents()[0];
+				doc.open();
+				doc.write(data);
+				doc.close();
+			}
+			else {
+				setPanel(setupCompletePanel);
+			}
+		};
+		securityConfig.saveFirstUser($('iframe[src]').contents().find('form:not(.no-json)'), handleSubmit, handleSubmit);
+	};
+	
+	// call to setup the proxy
+	var setupProxy = function() {
+		setPanel(proxyConfigPanel, {}, enableButtonsAfterFrameLoad);
+	};
+	
+	// Save the proxy config
+	var saveProxyConfig = function() {
+		securityConfig.saveProxy($('iframe[src]').contents().find('form:not(.no-json)'), function() {
+			setPanel(welcomePanel);
+		});
+	};
+	
 	// Call this to resume an installation after restart
 	var resumeInstallation = function() {
 		// don't re-initialize installing plugins
@@ -682,7 +747,11 @@ var createPluginSetupWizard = function() {
 		'.select-category': selectCategory,
 		'.close': closeInstaller,
 		'.resume-installation': resumeInstallation,
-		'.install-done-restart': restartJenkins
+		'.install-done-restart': restartJenkins,
+		'.save-first-user:not([disabled])': saveFirstUser,
+		'.show-proxy-config': setupProxy,
+		'.save-proxy-config': saveProxyConfig,
+		'.skip-plugin-installs': function() { installPlugins([]); }
 	};
 	for(var cls in actions) {
 		bindClickHandler(cls, actions[cls]);
@@ -703,26 +772,28 @@ var createPluginSetupWizard = function() {
 			}
 
 			// check for updates when first loaded...
-			pluginManager.installStatus(handleGenericError(function(jobs) {
+			pluginManager.installStatus(handleGenericError(function(data) {
+				var jobs = data.jobs;
+				
 				if(jobs.length > 0) {
-                    if (installingPlugins.length === 0) {
-                        // This can happen on a page reload if we are in the middle of
-                        // an install. So, lets get a list of plugins being installed at the
-                        // moment and use that as the "selectedPlugins" list.
-                        selectedPluginNames = [];
-                        loadPluginData(handleGenericError(function() {
-                            for (var i = 0; i < jobs.length; i++) {
-                                // If the job does not have a 'correlationId', then it was not selected
-                                // by the user for install i.e. it's probably a dependency plugin.
-                                if (jobs[i].correlationId) {
-                                    selectedPluginNames.push(jobs[i].name);
-                                }
-                            }
-						showInstallProgress();
-                        }));
-                    } else {
-                        showInstallProgress();
-                    }
+					if (installingPlugins.length === 0) {
+						// This can happen on a page reload if we are in the middle of
+						// an install. So, lets get a list of plugins being installed at the
+						// moment and use that as the "selectedPlugins" list.
+						selectedPluginNames = [];
+						loadPluginData(handleGenericError(function() {
+							for (var i = 0; i < jobs.length; i++) {
+								// If the job does not have a 'correlationId', then it was not selected
+								// by the user for install i.e. it's probably a dependency plugin.
+								if (jobs[i].correlationId) {
+									selectedPluginNames.push(jobs[i].name);
+								}
+							}
+						showInstallProgress(data.state);
+						}));
+					} else {
+						showInstallProgress(data.state);
+					}
 					return;
 				}
 
@@ -740,12 +811,12 @@ var createPluginSetupWizard = function() {
 
 							for(var plugName in incompleteStatus) {
 								var j = installingPlugins[plugName];
-                                
-                                if (!j) {
-                                    console.warn('Plugin "' + plugName + '" not found in the list of installing plugins.');
-                                    console.warn('\tInstalling plugins: ' + installingPlugins.names);                                    
-                                    continue;
-                                }
+								
+								if (!j) {
+									console.warn('Plugin "' + plugName + '" not found in the list of installing plugins.');
+									console.warn('\tInstalling plugins: ' + installingPlugins.names);									
+									continue;
+								}
 
 								var txt = false;
 								var state = false;
diff --git a/war/src/main/js/templates/firstUserPanel.hbs b/war/src/main/js/templates/firstUserPanel.hbs
new file mode 100644
index 0000000000..d222f2efaf
--- /dev/null
+++ b/war/src/main/js/templates/firstUserPanel.hbs
@@ -0,0 +1,13 @@
+<div class="modal-header">
+	<h4 class="modal-title">{{translations.installWizard_addFirstUser_title}}</h4>
+</div>
+<div class="modal-body">
+	<div class="jumbotron welcome-panel security-panel">
+		<iframe src="{{baseUrl}}/securityRealm/setupWizardFirstUser"></iframe>
+	</div>
+</div>
+<div class="modal-footer">
+	<button type="button" class="btn btn-primary save-first-user" disabled>
+		{{translations.installWizard_saveFirstUser}}
+	</button>
+</div>
diff --git a/war/src/main/js/templates/incompleteInstallationPanel.hbs b/war/src/main/js/templates/incompleteInstallationPanel.hbs
index 36d7daadd1..10268a1037 100644
--- a/war/src/main/js/templates/incompleteInstallationPanel.hbs
+++ b/war/src/main/js/templates/incompleteInstallationPanel.hbs
@@ -1,5 +1,4 @@
 <div class="modal-header">
-	<button type="button" class="close" aria-label="Close"><span aria-hidden="true">&times;</span></button>
 	<h4 class="modal-title">{{translations.installWizard_installIncomplete_title}}</h4>
 </div>
 <div class="modal-body">
diff --git a/war/src/main/js/templates/offlinePanel.hbs b/war/src/main/js/templates/offlinePanel.hbs
index 1a38c81117..a0b0ad82af 100644
--- a/war/src/main/js/templates/offlinePanel.hbs
+++ b/war/src/main/js/templates/offlinePanel.hbs
@@ -1,10 +1,13 @@
 <div class="modal-header">
-	<button type="button" class="close" aria-label="Close"><span aria-hidden="true">&times;</span></button>
-	<h4 class="modal-title">{{translations.installWizard_offline_title}}</h4>
+    <h4 class="modal-title">{{translations.installWizard_offline_title}}</h4>
 </div>
 <div class="modal-body">
-	<div class="jumbotron welcome-panel offline">
-		<h1>{{translations.installWizard_offline_title}}</h1>
-		<p>{{{translations.installWizard_offline_message}}}</p>
-	</div>
+    <div class="jumbotron welcome-panel offline">
+        <h1>{{translations.installWizard_offline_title}}</h1>
+        <p>{{{translations.installWizard_offline_message}}}</p>
+        <p>
+            <button type="button" class="btn btn-primary configure-proxy">{{translations.installWizard_configureProxy_label}}</button>
+            <button type="button" class="btn btn-primary skip-plugin-installs">{{translations.installWizard_skipPluginInstallations}}</button>
+        </p>
+    </div>
 </div>
diff --git a/war/src/main/js/templates/pluginSelectionPanel.hbs b/war/src/main/js/templates/pluginSelectionPanel.hbs
index ef511786cc..236b13a476 100644
--- a/war/src/main/js/templates/pluginSelectionPanel.hbs
+++ b/war/src/main/js/templates/pluginSelectionPanel.hbs
@@ -1,5 +1,4 @@
 <div class="modal-header">
-	<button type="button" class="close" aria-label="Close"><span aria-hidden="true">&times;</span></button>
 	<h4 class="modal-title">{{translations.installWizard_installCustom_title}}</h4>
 </div>
 <div class="modal-body plugin-selector">
diff --git a/war/src/main/js/templates/proxyConfigPanel.hbs b/war/src/main/js/templates/proxyConfigPanel.hbs
new file mode 100644
index 0000000000..698814e400
--- /dev/null
+++ b/war/src/main/js/templates/proxyConfigPanel.hbs
@@ -0,0 +1,16 @@
+<div class="modal-header">
+    <h4 class="modal-title">{{translations.installWizard_configureProxy_label}} PROXY</h4>
+</div>
+<div class="modal-body">
+    <div class="jumbotron welcome-panel security-panel">
+        <iframe src="{{baseUrl}}/proxy-configuration"></iframe>
+    </div>
+</div>
+<div class="modal-footer">
+    <button type="button" class="btn btn-link install-home">
+        {{translations.installWizard_goBack}}
+    </button>
+    <button type="button" class="btn btn-primary save-proxy-config" disabled>
+        {{translations.installWizard_configureProxy_save}}
+    </button>
+</div>
diff --git a/war/src/main/js/templates/setupCompletePanel.hbs b/war/src/main/js/templates/setupCompletePanel.hbs
new file mode 100644
index 0000000000..bff9393e06
--- /dev/null
+++ b/war/src/main/js/templates/setupCompletePanel.hbs
@@ -0,0 +1,20 @@
+<div class="modal-header">
+	<h4 class="modal-title">{{translations.installWizard_installComplete_title}}</h4>
+</div>
+<div class="modal-body">
+	<div class="jumbotron welcome-panel success-panel">
+		<h1>{{translations.installWizard_installComplete_banner}}</h1>
+
+		{{#if restartRequired}}
+		<p>{{translations.installWizard_installComplete_message}} {{translations.installWizard_installComplete_restartRequiredMessage}}</p>
+		<button type="button" class="btn btn-primary install-done-restart">
+			{{translations.installWizard_installComplete_restartLabel}}
+		</button>
+		{{else}}
+		<p>{{translations.installWizard_installComplete_message}}</p>
+		<button type="button" class="btn btn-primary install-done">
+			{{translations.installWizard_installComplete_finishButtonLabel}}
+		</button>
+		{{/if}}
+	</div>
+</div>
diff --git a/war/src/main/js/templates/successPanel.hbs b/war/src/main/js/templates/successPanel.hbs
index 1889ffc2b4..6efbe9d369 100644
--- a/war/src/main/js/templates/successPanel.hbs
+++ b/war/src/main/js/templates/successPanel.hbs
@@ -1,10 +1,9 @@
 <div class="modal-header">
-	<button type="button" class="close" aria-label="Close"><span aria-hidden="true">&times;</span></button>
-	<h4 class="modal-title">{{translations.installWizard_installComplete_title}}</h4>
+	<h4 class="modal-title">{{translations.installWizard_pluginsInstalled_title}}</h4>
 </div>
 <div class="modal-body">
 	<div class="jumbotron welcome-panel success-panel">
-		<h1>{{translations.installWizard_installComplete_banner}}</h1>
+		<h1>{{translations.installWizard_pluginsInstalled_banner}}</h1>
 
 		{{#if restartRequired}}
 		<p>{{translations.installWizard_installComplete_message}} {{translations.installWizard_installComplete_restartRequiredMessage}}</p>
diff --git a/war/src/main/js/templates/welcomePanel.hbs b/war/src/main/js/templates/welcomePanel.hbs
index 91e1995224..5aa5742756 100644
--- a/war/src/main/js/templates/welcomePanel.hbs
+++ b/war/src/main/js/templates/welcomePanel.hbs
@@ -1,5 +1,4 @@
 <div class="modal-header">
-	<button type="button" class="close" aria-label="Close"><span aria-hidden="true">&times;</span></button>
 	<h4 class="modal-title">{{translations.installWizard_welcomePanel_title}}</h4>
 </div>
 <div class="modal-body">
diff --git a/war/src/main/js/util/jenkins.js b/war/src/main/js/util/jenkins.js
index ffc5ab8be9..0423f1d6a4 100644
--- a/war/src/main/js/util/jenkins.js
+++ b/war/src/main/js/util/jenkins.js
@@ -28,15 +28,15 @@ exports.stringify = function(o) {
 			h: Hash.prototype.toJSON,
 			s: String.prototype.toJSON
 		};
-	    try {
-	        delete Array.prototype.toJSON;
+		try {
+			delete Array.prototype.toJSON;
 		delete Object.prototype.toJSON;
-	        delete Hash.prototype.toJSON;
-	        delete String.prototype.toJSON;
+			delete Hash.prototype.toJSON;
+			delete String.prototype.toJSON;
 
 		return JSON.stringify(o);
-	    }
-	    finally {
+		}
+		finally {
 		if(protoJSON.a) {
 			Array.prototype.toJSON = protoJSON.a;
 		}
@@ -49,7 +49,7 @@ exports.stringify = function(o) {
 		if(protoJSON.s) {
 			String.prototype.toJSON = protoJSON.s;
 		}
-	    }
+		}
 	}
 	else {
 		return JSON.stringify(o);
@@ -67,7 +67,7 @@ exports.idIfy = function(str) {
  * redirect
  */
 exports.goTo = function(url) {
-    wh.getWindow().location.replace(exports.baseUrl() + url);
+	wh.getWindow().location.replace(exports.baseUrl() + url);
 };
 
 /**
@@ -76,13 +76,13 @@ exports.goTo = function(url) {
  */
 exports.get = function(url, success, options) {
 	if(debug) {
-        console.log('get: ' + url);
-    }
+		console.log('get: ' + url);
+	}
 	var $ = jquery.getJQuery();
 	var args = {
 		url: exports.baseUrl() + url,
 		type: 'GET',
-	    cache: false,
+		cache: false,
 		dataType: 'json',
 		success: success
 	};
@@ -98,22 +98,49 @@ exports.get = function(url, success, options) {
  */
 exports.post = function(url, data, success, options) {
 	if(debug) {
-        console.log('post: ' + url);
-    }
+		console.log('post: ' + url);
+	}
+	
 	var $ = jquery.getJQuery();
+	
+	// handle crumbs
+	var headers = {};
+	var wnd = wh.getWindow();
+	var crumb;
+	if('crumb' in options) {
+		crumb = options.crumb;
+	}
+	else if('crumb' in wnd) {
+		crumb = wnd.crumb;
+	}
+	
+	if(crumb) {
+		headers[crumb.fieldName] = crumb.value;
+	}
+	
+	var formBody = data;
+	if(formBody instanceof Object) {
+		if(crumb) {
+			formBody = $.extend({}, formBody);
+			formBody[crumb.fieldName] = crumb.value;
+		}
+		formBody = exports.stringify(formBody);
+	}
+	
 	var args = {
 		url: exports.baseUrl() + url,
 		type: 'POST',
-	    cache: false,
+		cache: false,
 		dataType: 'json',
-	    data: exports.stringify(data),
-	    contentType: "application/json",
-		success: success
+		data: formBody,
+		contentType: "application/json",
+		success: success,
+		headers: headers
 	};
 	if(options instanceof Object) {
 		$.extend(args, options);
 	}
-    $.ajax(args);
+	$.ajax(args);
 };
 
 /**
@@ -124,20 +151,20 @@ exports.initHandlebars = function() {
 
 	Handlebars.registerHelper('ifeq', function(o1, o2, options) {
 		if(o1 === o2) {
-            return options.fn();
-        }
+			return options.fn();
+		}
 	});
 
 	Handlebars.registerHelper('ifneq', function(o1, o2, options) {
 		if(o1 !== o2) {
-            return options.fn();
-        }
+			return options.fn();
+		}
 	});
 
 	Handlebars.registerHelper('in-array', function(arr, val, options) {
 		if(arr.indexOf(val) >= 0) {
-            return options.fn();
-        }
+			return options.fn();
+		}
 	});
 
 	Handlebars.registerHelper('id', exports.idIfy);
@@ -186,3 +213,64 @@ exports.testConnectivity = function(handler) {
 	};
 	testConnectivity();
 };
+
+/**
+ * gets the window containing a form, taking in to account top-level iframes
+ */
+exports.getWindow = function($form) {
+	var $ = jquery.getJQuery();
+	$form = $($form);
+	var wnd = wh.getWindow();
+	$(top.document).find('iframe').each(function() {
+		var windowFrame = this.contentWindow;
+		var $f = $(this).contents().find('form');
+		if($f.length > 0 && $form[0] === $f[0]) {
+			wnd = windowFrame;
+		}
+	});
+	return wnd;
+};
+
+/**
+ * Builds a stapler form post
+ */
+exports.buildFormPost = function($form) {
+	var $ = jquery.getJQuery();
+	$form = $($form);
+	var wnd = exports.getWindow($form);
+	var form = $form[0];
+	if(wnd.buildFormTree(form)) {
+		return $form.serialize() +
+			'&core:apply=&Submit=Save&json=' + $form.find('input[name=json]').val();
+	}
+	return '';
+};
+
+/**
+ * Gets the crumb, if crumbs are enabled
+ */
+exports.getFormCrumb = function($form) {
+	var $ = jquery.getJQuery();
+	$form = $($form);
+	var wnd = exports.getWindow($form);
+	return wnd.crumb;
+};
+
+/**
+ * Jenkins Stapler JSON POST callback
+ * If last parameter is an object, will be extended to jQuery options (e.g. pass { error: function() ... } to handle errors)
+ */
+exports.staplerPost = function(url, $form, success, options) {
+	var $ = jquery.getJQuery();
+	$form = $($form);
+	var postBody = exports.buildFormPost($form);
+	var crumb = exports.getFormCrumb($form);
+	exports.post(
+		url,
+		postBody,
+		success, $.extend({
+			processData: false,
+			contentType: 'application/x-www-form-urlencoded',
+			crumb: crumb
+		}, options));
+};
diff --git a/war/src/main/less/pluginSetupWizard.less b/war/src/main/less/pluginSetupWizard.less
index 46ba9919ad..c259b47114 100644
--- a/war/src/main/less/pluginSetupWizard.less
+++ b/war/src/main/less/pluginSetupWizard.less
@@ -4,257 +4,261 @@
 
 
 .plugin-setup-wizard() {
-	position: fixed;
-	top: 0;
-	right: 0;
-	bottom: 0;
-	left: 0;
-	z-index: 1000;
-	background: rgba(0,0,0,.2);
-	text-align: initial;
-	font-family: sans-serif;
+    position: fixed;
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 0;
+    z-index: 1000;
+    background: rgba(0,0,0,.2);
+    text-align: initial;
+    font-family: sans-serif;
 
 
-	table, form, input, td, th, p, textarea, select,h1,h2,h3,h4,h5{
-	  font-family:'roboto',sans-serif;
-	}
+    table, form, input, td, th, p, textarea, select,h1,h2,h3,h4,h5{
+      font-family:'roboto',sans-serif;
+    }
 
 
-	input,password { // get rid of the ms X (it doesn't fire a change event!), we provide our own
-		&::-ms-clear { width : 0; height: 0; }
-		&::-ms-reveal { width : 0; height: 0; }
-	}
+    input,password { // get rid of the ms X (it doesn't fire a change event!), we provide our own
+        &::-ms-clear { width : 0; height: 0; }
+        &::-ms-reveal { width : 0; height: 0; }
+    }
 
-	a, button {
-		&:focus, &:active { outline: 0; }
-	}
+    a, button {
+        &:focus, &:active { outline: 0; }
+    }
 
-	.spin(@duration: 2s) {
-		-webkit-animation-name: spin;
-		-webkit-animation-duration: @duration;
-		-webkit-animation-iteration-count: infinite;
-		-webkit-animation-timing-function: linear;
-		-moz-animation-name: spin;
-		-moz-animation-duration: @duration;
-		-moz-animation-iteration-count: infinite;
-		-moz-animation-timing-function: linear;
-		-ms-animation-name: spin;
-		-ms-animation-duration: @duration;
-		-ms-animation-iteration-count: infinite;
-		-ms-animation-timing-function: linear;
-		animation-name: spin;
-		animation-duration: @duration;
-		animation-iteration-count: infinite;
-		animation-timing-function: linear;
-	}
+    .spin(@duration: 2s) {
+        -webkit-animation-name: spin;
+        -webkit-animation-duration: @duration;
+        -webkit-animation-iteration-count: infinite;
+        -webkit-animation-timing-function: linear;
+        -moz-animation-name: spin;
+        -moz-animation-duration: @duration;
+        -moz-animation-iteration-count: infinite;
+        -moz-animation-timing-function: linear;
+        -ms-animation-name: spin;
+        -ms-animation-duration: @duration;
+        -ms-animation-iteration-count: infinite;
+        -ms-animation-timing-function: linear;
+        animation-name: spin;
+        animation-duration: @duration;
+        animation-iteration-count: infinite;
+        animation-timing-function: linear;
+    }
 
-	.no-spin() {
-		-webkit-animation-name: none;
-		-moz-animation-name: none;
-		-ms-animation-name: none;
-		animation-name: none;
-	}
+    .no-spin() {
+        -webkit-animation-name: none;
+        -moz-animation-name: none;
+        -ms-animation-name: none;
+        animation-name: none;
+    }
+    
+    .modal {
+        padding: 20px 0;
+    }
 
-	.modal-dialog {
-		width: 90%;
-		height: 90%;
-		padding: 0;
-		position: relative;
-		margin: 3% auto;
-		max-width:992px;
-		font-family:'roboto',sans-serif;
-	}
+    .modal-dialog {
+        width: 90%;
+        height: 100%;
+        padding: 0;
+        position: relative;
+        margin: 0 auto;
+        max-width:992px;
+        font-family:'roboto',sans-serif;
+    }
 
-	.modal-content {
-		height: 100%;
-		position: relative;
-		box-sizing: border-box;
-		padding: 4.2em 0 4.8em 0;
-	}
+    .modal-content {
+        height: 100%;
+        position: relative;
+        box-sizing: border-box;
+        padding: 4.2em 0 4.8em 0;
+    }
 
-	.container.error-container {
-	    padding: 4em 3em;
+    .container.error-container {
+        padding: 4em 3em;
 
-	    h1 {
-		color: #a94442;
-	}
-	}
+        h1 {
+        color: #a94442;
+    }
+    }
 
-	.modal-body {
-		background: linear-gradient(175deg, #f8f8f8 0%, rgba(255, 255, 255, 1) 22%, rgba(255, 255, 255, 0) 100%);
-		overflow-y: auto;
-		height: 100%;
-		padding:0;
-		border-bottom:1px solid #ccc;
+    .modal-body {
+        background: linear-gradient(175deg, #f8f8f8 0%, rgba(255, 255, 255, 1) 22%, rgba(255, 255, 255, 0) 100%);
+        overflow-y: auto;
+        height: 100%;
+        padding:0;
+        border-bottom:1px solid #ccc;
 
-		.water-mark{
-		  font-size: 392px;
-	      position: absolute;
-	      display: block;
-	      bottom: 0px;
-	      right: 50px;
-	      color: rgba(0,0,0,.05);
-		}
+        .water-mark{
+          font-size: 392px;
+          position: absolute;
+          display: block;
+          bottom: 0px;
+          right: 50px;
+          color: rgba(0,0,0,.05);
+        }
 
-		.installing-panel{
-		  border-bottom:1px solid #ccc;
-		  margin:0;
-		  padding:7.5% 10%;
-		  height:33.3%;
-		  position:relative;
-		  z-index:9;
-		  box-shadow:rgba(0,0,0,.5) 0 1px 5px;
+        .installing-panel{
+          border-bottom:1px solid #ccc;
+          margin:0;
+          padding:7.5% 10%;
+          height:33.3%;
+          position:relative;
+          z-index:9;
+          box-shadow:rgba(0,0,0,.5) 0 1px 5px;
 
-		  @media screen and (max-width: 992px) {
-		    padding:5%;
+          @media screen and (max-width: 992px) {
+            padding:5%;
         h1{
           font-size:24px;
         }
-		  }
+          }
 
-		  @media screen and (max-width: 768px) {
-		    padding:5%;
-		    height:auto;
-		    h1{
-		      display:none;
-		    }
-		  }
+          @media screen and (max-width: 768px) {
+            padding:5%;
+            height:auto;
+            h1{
+              display:none;
+            }
+          }
 
-		  .progress{
-		    margin:0;
-		  }
+          .progress{
+            margin:0;
+          }
 
-		  .selected-plugin-progress{
-		    width:75%;
-		  }
-		}
+          .selected-plugin-progress{
+            width:75%;
+          }
+        }
 
-	}
+    }
 
-	.modal-header {
-		position: absolute;
-		top: 0;
-		right: 0;
-		left: 0;
-		height: 4.2em;
-		z-index: 2;
-		background: #fff;
-		border-radius: 5px 5px 0 0;
+    .modal-header {
+        position: absolute;
+        top: 0;
+        right: 0;
+        left: 0;
+        height: 4.2em;
+        z-index: 2;
+        background: #fff;
+        border-radius: 5px 5px 0 0;
 
-		.close {
-			line-height: 1.42857143;
-		    margin-right: 5px;
-		}
-	}
+        .close {
+            line-height: 1.42857143;
+            margin-right: 5px;
+        }
+    }
 
-	.modal-footer {
-		position: absolute;
-		right: 0;
-		bottom: 0;
-		left: 0;
-		height: 4.8em;
-		padding: 1em;
-		z-index: 2;
-		background: #fff;
-		border-radius: 0 0 5px 5px;
-	}
+    .modal-footer {
+        position: absolute;
+        right: 0;
+        bottom: 0;
+        left: 0;
+        height: 4.8em;
+        padding: 1em;
+        z-index: 2;
+        background: #fff;
+        border-radius: 0 0 5px 5px;
+    }
 
-	.plugin-selector {
+    .plugin-selector {
         overflow-y: hidden;
 
-		@media screen and (min-width: 768px) {
-			height: 100%;
-		}
+        @media screen and (min-width: 768px) {
+            height: 100%;
+        }
 
-		.plugins {
-			padding-top: 2.75em;
-			position: relative;
-			border-left:1px solid rgba(0,0,0,.2);
+        .plugins {
+            padding-top: 2.75em;
+            position: relative;
+            border-left:1px solid rgba(0,0,0,.2);
 
-			@media screen and (min-width: 768px) {
-				height: 100%;
-			}
+            @media screen and (min-width: 768px) {
+                height: 100%;
+            }
 
-			h2 {padding-top:10px; margin-top:0}
+            h2 {padding-top:10px; margin-top:0}
 
-			.plugin-select-actions, .plugin-selected-info {
-				position: absolute;
-			    top: 0;
-			    left: 10px;
-			    line-height: 34px;
+            .plugin-select-actions, .plugin-selected-info {
+                position: absolute;
+                top: 0;
+                left: 10px;
+                line-height: 34px;
 
-			    &.plugin-selected-info {
-				    right: 10px;
-				    left: auto;
-				}
+                &.plugin-selected-info {
+                    right: 10px;
+                    left: auto;
+                }
 
-				a + a:before {
-					content: '|';
-					font-size: 11px;
-					text-decoration: none !important;
-					display: inline-block;
-					margin: 0 5px 0 2px;
-				}
-			}
+                a + a:before {
+                    content: '|';
+                    font-size: 11px;
+                    text-decoration: none !important;
+                    display: inline-block;
+                    margin: 0 5px 0 2px;
+                }
+            }
 
-			.plugin-search-controls {
-				position: relative;
-				display: block;
-				margin: 0 -17px;
+            .plugin-search-controls {
+                position: relative;
+                display: block;
+                margin: 0 -17px;
 
-				@media screen and (min-width: 768px) {
-					width: 100%;
-					max-width: 32em;
-					margin: 0;
+                @media screen and (min-width: 768px) {
+                    width: 100%;
+                    max-width: 32em;
+                    margin: 0;
 
-					input[name=searchbox] {
-						display: inline-block;
-					}
-				}
+                    input[name=searchbox] {
+                        display: inline-block;
+                    }
+                }
 
-				.clear-search {
-					display: inline-block;
-					position: absolute;
-					top: 50%;
-					right: 8px;
-					margin-top: -12px;
-					font-size: 23px;
-					line-height: 30px;
-					background: transparent;
-					color: #ddd;
-					text-decoration: none;
-					font-weight: bold;
+                .clear-search {
+                    display: inline-block;
+                    position: absolute;
+                    top: 50%;
+                    right: 8px;
+                    margin-top: -12px;
+                    font-size: 23px;
+                    line-height: 30px;
+                    background: transparent;
+                    color: #ddd;
+                    text-decoration: none;
+                    font-weight: bold;
 
-					&:hover, &:focus {
-						color: #444;
-					}
-				}
-			}
+                    &:hover, &:focus {
+                        color: #444;
+                    }
+                }
+            }
 
-			.plugin-select-controls {
-				@media screen and (min-width: 768px) {
-					position: absolute;
-					padding: 0 9em 0 14em;
-				}
+            .plugin-select-controls {
+                @media screen and (min-width: 768px) {
+                    position: absolute;
+                    padding: 0 9em 0 14em;
+                }
 
-				top: 0;
-				right: 0;
-				left: 0;
-				padding: 0 10px;
-				height: 2.75em;
-				z-index: 100;
-				background:rgba(0,0,0,.03);
-				border-bottom:1px solid rgba(0,0,0,.2);
+                top: 0;
+                right: 0;
+                left: 0;
+                padding: 0 10px;
+                height: 2.75em;
+                z-index: 100;
+                background:rgba(0,0,0,.03);
+                border-bottom:1px solid rgba(0,0,0,.2);
 
 
-				.form-control{
-				  font-size:13px;
-				  padding:2px 5px;
-				  height:30px;
-				  top:2px;
-				  position:relative;
-				}
-			}
+                .form-control{
+                  font-size:13px;
+                  padding:2px 5px;
+                  height:30px;
+                  top:2px;
+                  position:relative;
+                }
+            }
 
             .plugin-list-description {
                 margin: -10px -10px 0px -10px;
@@ -263,198 +267,198 @@
                 border-bottom: 1px solid rgba(0, 0, 0, 0.2);
             }
 
-			.plugin-list {
-				position: relative;
-				padding: 10px;
-				margin: 0 -15px;
-				clear: both;
-				@media screen and (min-width: 768px) {
-					max-height: 100%;
-				}
-				overflow-y: auto;
+            .plugin-list {
+                position: relative;
+                padding: 10px;
+                margin: 0 -15px;
+                clear: both;
+                @media screen and (min-width: 768px) {
+                    max-height: 100%;
+                }
+                overflow-y: auto;
 
-				h2 {
-				  font-size:28px;
-					transition: all .15s;
-					&:first-child {
-						margin-top: 0;
-					}
-				}
+                h2 {
+                  font-size:28px;
+                    transition: all .15s;
+                    &:first-child {
+                        margin-top: 0;
+                    }
+                }
 
-				&.searching-with-transition {
-					label {
-						display: none;
-						transition: all .25s;
+                &.searching-with-transition {
+                    label {
+                        display: none;
+                        transition: all .25s;
 
 
-						&.match {
-							display: block;
-							background: #d9edf7;
-							margin: 4px -7px;
-							padding: 6px 0 6px 26px;
-							border-radius: 2px;
-							border: 1px solid #bce8f1;
-							color: #31708f;
+                        &.match {
+                            display: block;
+                            background: #d9edf7;
+                            margin: 4px -7px;
+                            padding: 6px 0 6px 26px;
+                            border-radius: 2px;
+                            border: 1px solid #bce8f1;
+                            color: #31708f;
 
-							&.selected {
-								background: #dff0d8;
-								border: 1px solid #c2e0a9;
-								color: #3c763d;
-							}
-						}
-					}
-					h2 {
-						color: #ddd;
-						transition: all .5s;
-						font-size: 22px;
-						margin: 6px 0 6px -5px;
-					}
-				}
+                            &.selected {
+                                background: #dff0d8;
+                                border: 1px solid #c2e0a9;
+                                color: #3c763d;
+                            }
+                        }
+                    }
+                    h2 {
+                        color: #ddd;
+                        transition: all .5s;
+                        font-size: 22px;
+                        margin: 6px 0 6px -5px;
+                    }
+                }
 
-				&.searching {
-					label {
-						display: none;
-						transition: all .25s;
+                &.searching {
+                    label {
+                        display: none;
+                        transition: all .25s;
 
-						&.match {
-							display: block;
-						}
-					}
-					h2 {
-						display: none;
-						&.match {
-							color: #ddd;
-							transition: all .5s;
-							font-size: 22px;
-							margin: 6px 0 6px -5px;
-							display: block;
-						}
-					}
-				}
+                        &.match {
+                            display: block;
+                        }
+                    }
+                    h2 {
+                        display: none;
+                        &.match {
+                            color: #ddd;
+                            transition: all .5s;
+                            font-size: 22px;
+                            margin: 6px 0 6px -5px;
+                            display: block;
+                        }
+                    }
+                }
 
-				label {
-					font-weight: normal;
-					padding: 7px 2px 7px 27px;
-					position: relative;
-					display: block;
-					cursor: pointer;
-					margin: 4px -7px;
+                label {
+                    font-weight: normal;
+                    padding: 7px 2px 7px 27px;
+                    position: relative;
+                    display: block;
+                    cursor: pointer;
+                    margin: 4px -7px;
 
-		            &:hover{
-		              background: rgba(100, 200, 255, 0.1);
-		              box-shadow:inset 0 200px 200px -200px rgba(100, 200, 255, 0.33),inset 0 0 0 1px rgba(100, 200, 255, 0.33);
-		            }
+                    &:hover{
+                      background: rgba(100, 200, 255, 0.1);
+                      box-shadow:inset 0 200px 200px -200px rgba(100, 200, 255, 0.33),inset 0 0 0 1px rgba(100, 200, 255, 0.33);
+                    }
 
-					&.selected {
-						background: #dff0d8;
-						margin: 4px -7px;
-						padding: 6px 0 6px 26px;
-						border-radius: 2px;
-						border: 1px solid #C2E0A9;
-						color: #3c763d;
-					}
+                    &.selected {
+                        background: #dff0d8;
+                        margin: 4px -7px;
+                        padding: 6px 0 6px 26px;
+                        border-radius: 2px;
+                        border: 1px solid #C2E0A9;
+                        color: #3c763d;
+                    }
 
-					.title {
-						display: block;
-						font-weight: bold;
-						white-space: nowrap;
-						position: relative;
-					}
+                    .title {
+                        display: block;
+                        font-weight: bold;
+                        white-space: nowrap;
+                        position: relative;
+                    }
 
-					.description {
-						display: block;
-						margin-top: .5em;
-					}
+                    .description {
+                        display: block;
+                        margin-top: .5em;
+                    }
 
-					&.selected .dependencies {
-						color: #777;
-					}
+                    &.selected .dependencies {
+                        color: #777;
+                    }
 
-					input[type=checkbox] {
-						float: left;
-						margin: 2px -18px;
-						vertical-align: middle;
-					}
+                    input[type=checkbox] {
+                        float: left;
+                        margin: 2px -18px;
+                        vertical-align: middle;
+                    }
 
-					+ .tooltip {
-				        left: 2px !important;
-						margin-right: 16px;
+                    + .tooltip {
+                        left: 2px !important;
+                        margin-right: 16px;
 
-					    .tooltip-arrow {
-						left: 4em !important;
-					    }
+                        .tooltip-arrow {
+                        left: 4em !important;
+                        }
 
-					    .tooltip-inner {
-						max-width: none;
-						padding: .5em 1em;
-						text-align: left;
-					    }
-				    }
-				}
-			}
-		}
+                        .tooltip-inner {
+                        max-width: none;
+                        padding: .5em 1em;
+                        text-align: left;
+                        }
+                    }
+                }
+            }
+        }
 
-		.categories {
-			position: relative;
-			display: none;
-			overflow-y: auto;
+        .categories {
+            position: relative;
+            display: none;
+            overflow-y: auto;
 
-			@media screen and (min-width: 768px) {
-				display: block;
-				max-height: 100%;
-			}
+            @media screen and (min-width: 768px) {
+                display: block;
+                max-height: 100%;
+            }
 
-			.nav{
-			  margin:5px -5px;
-			}
+            .nav{
+              margin:5px -5px;
+            }
 
-			li {
-				a {
-					position: relative;
-					padding: .5em;
-					display: block;
-					color: #444;
-					text-decoration: none;
-					background: transparent;
-					border: none;
-					font-weight:500;
-					border-radius:none;
+            li {
+                a {
+                    position: relative;
+                    padding: .5em;
+                    display: block;
+                    color: #444;
+                    text-decoration: none;
+                    background: transparent;
+                    border: none;
+                    font-weight:500;
+                    border-radius:none;
 
-					&:after {
-						content: '';
-						display: none;
-						position: absolute;
-						top: 0;
-						right: 0;
-						bottom: 0;
-						width: 2px;
-						background: #337ab7;
-					}
+                    &:after {
+                        content: '';
+                        display: none;
+                        position: absolute;
+                        top: 0;
+                        right: 0;
+                        bottom: 0;
+                        width: 2px;
+                        background: #337ab7;
+                    }
 
-					&:hover {
-					  background:rgba(100,200,255,.1);
-					  box-shadow:inset -200px 0 200px -200px rgba(100,200,255,.33);
-						color: #337ab7;
+                    &:hover {
+                      background:rgba(100,200,255,.1);
+                      box-shadow:inset -200px 0 200px -200px rgba(100,200,255,.33);
+                        color: #337ab7;
 
-						&:after {
-							display: block;
-						}
-					}
-				}
+                        &:after {
+                            display: block;
+                        }
+                    }
+                }
 
-				&.active a {
-					color: #337ab7;
+                &.active a {
+                    color: #337ab7;
 
-					&:after {
-						display: block;
-						width: 4px;
-					}
-				}
-			}
-		}
-	}
+                    &:after {
+                        display: block;
+                        width: 4px;
+                    }
+                }
+            }
+        }
+    }
 
-	.install-console {
+    .install-console {
     border-left: 1px solid #ccc;
     background: #f8f8f8;
     position: absolute;
@@ -467,35 +471,35 @@
     padding: 6px 0;
     overflow:auto;
 
-	 @media screen and (max-width: 992px) {
+     @media screen and (max-width: 992px) {
        width: 100%;
        position:static;
        max-height:33%;
     }
 
-		.selected {
-			font: 12px monospace;
-			overflow: auto;
-			height: 100%;
-			display:block;
-			padding:1px 10px;
+        .selected {
+            font: 12px monospace;
+            overflow: auto;
+            height: 100%;
+            display:block;
+            padding:1px 10px;
 
-		  &:nth-child(odd){
-		    background:rgba(0,0,0,.05);
-		  }
-		}
+          &:nth-child(odd){
+            background:rgba(0,0,0,.05);
+          }
+        }
 
-		.dependent {
-			color: #aaa;
-			padding-left: .4em;
+        .dependent {
+            color: #aaa;
+            padding-left: .4em;
 
-			&:before {
-				content: ' ** ';
-			}
-		}
-	}
+            &:before {
+                content: ' ** ';
+            }
+        }
+    }
 
-	.selected-plugin-progress {
+    .selected-plugin-progress {
     position: absolute;
     bottom: 0;
     overflow: hidden;
@@ -509,17 +513,17 @@
     border-bottom:1px solid #ccc;
     border-top:1px solid rgba(0,0,0,.1);
 
-		@media screen and (max-width: 992px) {
-		   width: 100%;
-		   position:static;
-		   max-height:33%;
-		}
-		&.success-panel {
-			bottom: 0;
-			width:100%;
-		}
+        @media screen and (max-width: 992px) {
+           width: 100%;
+           position:static;
+           max-height:33%;
+        }
+        &.success-panel {
+            bottom: 0;
+            width:100%;
+        }
 
-		.selected-plugin {
+        .selected-plugin {
       display: inline-block;
       vertical-align: top;
       padding: 5px 5px 5px 30px;
@@ -533,156 +537,171 @@
       box-shadow:0 1px 3px rgba(0,0,0,.2);
       background:rgba(255,255,255,.75);
 
-			&:nth-child(odd){
-			  box-shadow:0 1px 3px rgba(0,0,0,.2),inset 0 0 0 999px rgba(0,0,0,.05);
-			}
-			&:before { // pending
-				font-family: FontAwesome;
-				font-size: 17px;
-				content: '\f10c';
-				color: rgba(0,0,0,.1);
-				position: absolute;
-				left:5px;
-			}
+            &:nth-child(odd){
+              box-shadow:0 1px 3px rgba(0,0,0,.2),inset 0 0 0 999px rgba(0,0,0,.05);
+            }
+            &:before { // pending
+                font-family: FontAwesome;
+                font-size: 17px;
+                content: '\f10c';
+                color: rgba(0,0,0,.1);
+                position: absolute;
+                left:5px;
+            }
 
-			&.installing {
-				&:before {
-					content: '\f021';
-					color: rgba(0,60,100,.33);
-					.spin();
-				}
-			}
-			&.success {
-			  background:#e5f9e5;
-				&:before {
-					content: '\f00c';
-					color: #3c763d;
+            &.installing {
+                &:before {
+                    content: '\f021';
+                    color: rgba(0,60,100,.33);
+                    .spin();
+                }
+            }
+            &.success {
+              background:#e5f9e5;
+                &:before {
+                    content: '\f00c';
+                    color: #3c763d;
 
-					.no-spin();
-				}
-			}
-			&.fail {
-			  background:#fdd;
-				&:before {
-					content: '\f00d';
-					color: #a94442;
-					.no-spin();
-				}
-			}
-		}
-	}
+                    .no-spin();
+                }
+            }
+            &.fail {
+              background:#fdd;
+                &:before {
+                    content: '\f00d';
+                    color: #a94442;
+                    .no-spin();
+                }
+            }
+        }
+    }
 
-	.welcome-panel {
-		position: relative;
-		background: transparent;
-		padding: 0 10%;
+    .welcome-panel {
+        position: relative;
+        background: transparent;
+        padding: 0 10%;
 
-		h1{font-size:48px; margin-top:5px;}
+        h1{font-size:48px; margin-top:5px;}
 
-		@media screen and (min-width: 768px) {
-			padding-top: 5%;
-		}
+        @media screen and (min-width: 768px) {
+            padding-top: 5%;
+        }
 
-		.button-set {
-			margin-top: 40px;
+        .button-set {
+            margin-top: 40px;
 
-			.btn {
-				text-align: left;
-			}
-		}
+            .btn {
+                text-align: left;
+            }
+        }
 
-		.btn-huge {
-		  font-weight:200;
-			display: inline-block;
-			text-align: initial;
-			width: 22em;
-			white-space: normal;
-			vertical-align: top;
-			min-height: 12.5em;
-			margin-right: 1.3%;
-			margin-top: 1em;
-			padding:20px 25px;
-			box-shadow:inset 0 -200px 200px -100px rgba(0,0,0,.1), 0 1px 3px rgba(0,0,0,.2);
-			border:1px solid rgba(0,60,100,.5);
-			text-shadow:#fff 0 1px 3px;
-			position:relative;
-			background:rgba(255,255,255,.75);
+        .btn-huge {
+          font-weight:200;
+            display: inline-block;
+            text-align: initial;
+            width: 22em;
+            white-space: normal;
+            vertical-align: top;
+            min-height: 12.5em;
+            margin-right: 1.3%;
+            margin-top: 1em;
+            padding:20px 25px;
+            box-shadow:inset 0 -200px 200px -100px rgba(0,0,0,.1), 0 1px 3px rgba(0,0,0,.2);
+            border:1px solid rgba(0,60,100,.5);
+            text-shadow:#fff 0 1px 3px;
+            position:relative;
+            background:rgba(255,255,255,.75);
 
-			@media screen and (min-width: 768px) {
-				max-width: 41%;
-				min-width: 14em;
-				margin-top: 0;
-			}
+            @media screen and (min-width: 768px) {
+                max-width: 41%;
+                min-width: 14em;
+                margin-top: 0;
+            }
 
-			&:hover{
-			  box-shadow:inset 0 1px 3px -1px rgba(0,0,0,.2);
+            &:hover{
+              box-shadow:inset 0 1px 3px -1px rgba(0,0,0,.2);
         background:rgba(100,200,255,.1);
-			}
-			&:focus{
-			  background:#fff;
+            }
+            &:focus{
+              background:#fff;
         box-shadow:inset 0 -200px 200px -100px rgba(0,0,0,.1),0 0 5px 3px rgba(00,180,250,.2);
       }
       &:hover:focus{
         background:rgba(100,200,255,.1);
       }
-			&.btn-primary{
-			  background:rgba(200,240,255,.2);
+            &.btn-primary{
+              background:rgba(200,240,255,.2);
 
-			  box-shadow:inset 0 -200px 200px -100px rgba(0,120,160,.2), 0 1px 3px rgba(0,0,0,.2);
-			  color:rgba(0,80,120,1);
+              box-shadow:inset 0 -200px 200px -100px rgba(0,120,160,.2), 0 1px 3px rgba(0,0,0,.2);
+              color:rgba(0,80,120,1);
 
-			  &:hover{
-			    box-shadow:inset 0 1px 3px -1px rgba(0,0,0,.2);
+              &:hover{
+                box-shadow:inset 0 1px 3px -1px rgba(0,0,0,.2);
           background:rgba(70,200,255,.2);
-			  }
-			  &:focus{
+              }
+              &:focus{
           box-shadow:inset 0 -200px 200px -100px rgba(0,120,160,.2),0 0 5px 3px rgba(00,180,250,.2);        }
-			}
-			.icon {
-			  position: absolute;
+            }
+            .icon {
+              position: absolute;
         bottom: 20px;
         right: 10px;
         font-size: 144px;
         opacity: .0;
-			}
-			b {
-				display: block;
-				font-size: 24px;
-				line-height:100%;
-				margin-bottom:5px;
-				min-height:81px;
-				font-weight:600;
-				width:80%;
-			}
-			sub{
-			  font-size:21px;
-			}
-			span {
-				display: block;
-			}
-		}
-	}
+            }
+            b {
+                display: block;
+                font-size: 24px;
+                line-height:100%;
+                margin-bottom:5px;
+                min-height:81px;
+                font-weight:600;
+                width:80%;
+            }
+            sub{
+              font-size:21px;
+            }
+            span {
+                display: block;
+            }
+        }
+    }
+    
+    .security-panel {
+        &.security-panel, > iframe {
+            position: absolute;
+            top: 0;
+            left: 0;
+            bottom: 0;
+            right: 0;
+            border: 0;
+            width: 100%;
+            height: 100%;
+            padding: 0;
+            margin: 0;
+        }
+    }
 }
 
 @-ms-keyframes spin {
-	from { -ms-transform: rotate(0deg); }
-	to { -ms-transform: rotate(360deg); }
+    from { -ms-transform: rotate(0deg); }
+    to { -ms-transform: rotate(360deg); }
 }
 @-moz-keyframes spin {
-	from { -moz-transform: rotate(0deg); }
-	to { -moz-transform: rotate(360deg); }
+    from { -moz-transform: rotate(0deg); }
+    to { -moz-transform: rotate(360deg); }
 }
 @-webkit-keyframes spin {
-	from { -webkit-transform: rotate(0deg); }
-	to { -webkit-transform: rotate(360deg); }
+    from { -webkit-transform: rotate(0deg); }
+    to { -webkit-transform: rotate(360deg); }
 }
 @keyframes spin {
-	from { transform:rotate(0deg); }
-	to { transform:rotate(360deg); }
+    from { transform:rotate(0deg); }
+    to { transform:rotate(360deg); }
 }
 
 body .plugin-setup-wizard { // need specificity, revisit the CSS inclusion order
-	.plugin-setup-wizard();
+    .plugin-setup-wizard();
 }
 
 @fb-loader-color: #E6E6E6;
@@ -690,59 +709,59 @@ body .plugin-setup-wizard { // need specificity, revisit the CSS inclusion order
 .loader,
 .loader:before,
 .loader:after {
-	background: @fb-loader-color;
-	-webkit-animation: fb-loader 1s infinite ease-in-out;
-	animation: fb-loader 1s infinite ease-in-out;
-	width: 7px;
-	height: 8px;
+    background: @fb-loader-color;
+    -webkit-animation: fb-loader 1s infinite ease-in-out;
+    animation: fb-loader 1s infinite ease-in-out;
+    width: 7px;
+    height: 8px;
 }
 .loader:before,
 .loader:after {
-	position: absolute;
-	top: 0;
-	content: '';
+    position: absolute;
+    top: 0;
+    content: '';
 }
 .loader:before {
-	left: -10px;
-	-webkit-animation-delay: -0.32s;
-	animation-delay: -0.32s;
+    left: -10px;
+    -webkit-animation-delay: -0.32s;
+    animation-delay: -0.32s;
 }
 .loader {
-	text-indent: -9999em;
-	top: 50%;
-	margin: -4px auto 0 auto;
-	position: relative;
-	font-size: 6px;
-	-webkit-transform: translateZ(0);
-	-ms-transform: translateZ(0);
-	transform: translateZ(0);
-	-webkit-animation-delay: -0.16s;
-	animation-delay: -0.16s;
+    text-indent: -9999em;
+    top: 50%;
+    margin: -4px auto 0 auto;
+    position: relative;
+    font-size: 6px;
+    -webkit-transform: translateZ(0);
+    -ms-transform: translateZ(0);
+    transform: translateZ(0);
+    -webkit-animation-delay: -0.16s;
+    animation-delay: -0.16s;
 }
 .loader:after {
-	left: 10px;
+    left: 10px;
 }
 @-webkit-keyframes fb-loader {
-	0%,
-	80%,
-	100% {
-		box-shadow: 0 0 @fb-loader-color;
-		height: 4em;
-	}
-	40% {
-		box-shadow: 0 -2em @fb-loader-color;
-		height: 5em;
-	}
+    0%,
+    80%,
+    100% {
+        box-shadow: 0 0 @fb-loader-color;
+        height: 4em;
+    }
+    40% {
+        box-shadow: 0 -2em @fb-loader-color;
+        height: 5em;
+    }
 }
 @keyframes fb-loader {
-	0%,
-	80%,
-	100% {
-		box-shadow: 0 0 @fb-loader-color;
-		height: 4em;
-	}
-	40% {
-		box-shadow: 0 -2em @fb-loader-color;
-		height: 5em;
-	}
+    0%,
+    80%,
+    100% {
+        box-shadow: 0 0 @fb-loader-color;
+        height: 4em;
+    }
+    40% {
+        box-shadow: 0 -2em @fb-loader-color;
+        height: 5em;
+    }
 }
diff --git a/war/src/test/js/pluginSetupWizard-spec.js b/war/src/test/js/pluginSetupWizard-spec.js
index 5b1376aa1c..636a40e262 100644
--- a/war/src/test/js/pluginSetupWizard-spec.js
+++ b/war/src/test/js/pluginSetupWizard-spec.js
@@ -15,20 +15,20 @@ pluginList.recommendedPlugins = ['subversion'];
 
 // Iterates through all responses until the end and returns the last response repeatedly
 var LastResponse = function(responses) {
-	var counter = 0;
-	this.next = function() {
-		if(counter < responses.length) {
-			try {
-				return responses[counter];
-			} finally {
-				counter++;
-			}
-		}
-		if(responses.length > 0) {
-			return responses[counter-1];
-		}
-		return { status: 'fail' };
-	};
+    var counter = 0;
+    this.next = function() {
+        if(counter < responses.length) {
+            try {
+                return responses[counter];
+            } finally {
+                counter++;
+            }
+        }
+        if(responses.length > 0) {
+            return responses[counter-1];
+        }
+        return { status: 'fail' };
+    };
 };
 
 // common mocks for jQuery $.ajax
@@ -48,17 +48,23 @@ var ajaxMocks = function(responseMappings) {
         },
         '/jenkins/updateCenter/installStatus': new LastResponse([{
             status: 'ok',
-            data: [] // first, return nothing by default, no ongoing install
+            data: { // first, return nothing by default, no ongoing install
+            	state: 'NEW',
+            	jobs: []
+        	}
         },
         {
             status: 'ok',
-            data: [
-              {
-                  name: 'subversion',
-                  type: 'InstallJob',
-                  installStatus: 'Success'
-              }
-            ]
+            data: {
+            	state: 'INSTALLING_PLUGINS',
+            	jobs: [
+	              {
+	                  name: 'subversion',
+	                  type: 'InstallJob',
+	                  installStatus: 'Success'
+	              }
+	            ]
+            }
         }]),
         '/jenkins/pluginManager/plugins': {
             status: 'ok',
@@ -92,8 +98,8 @@ var ajaxMocks = function(responseMappings) {
             }
         },
         '/jenkins/pluginManager/installPlugins': {
-		status: 'ok',
-		data: 'RANDOM_UUID_1234'
+        status: 'ok',
+        data: 'RANDOM_UUID_1234'
         }
     };
 
@@ -114,7 +120,7 @@ var ajaxMocks = function(responseMappings) {
             throw 'No data mapping provided for AJAX call: ' + call.url;
         }
         if(response instanceof LastResponse) {
-		response = response.next();
+        response = response.next();
         }
         call.success(response);
     };
@@ -122,7 +128,7 @@ var ajaxMocks = function(responseMappings) {
 
 // call this for each test, it will provide a new wizard, jquery to the caller
 var test = function(test, ajaxMappings) {
-	jsTest.onPage(function() {
+    jsTest.onPage(function() {
         // deps
         var $ = getJQuery();
 
@@ -133,41 +139,41 @@ var test = function(test, ajaxMappings) {
         var pluginSetupWizard = jsTest.requireSrcModule('pluginSetupWizardGui');
 
         // exported init
-        pluginSetupWizard.init();
+        pluginSetupWizard.init('body');
 
         test($, pluginSetupWizard);
-	});
+    });
 };
 
 // helper to validate the appropriate plugins were installed
 var validatePlugins = function(plugins, complete) {
     var jenkins = jsTest.requireSrcModule('util/jenkins');
     if(!jenkins.originalPost) {
-	jenkins.originalPost = jenkins.post;
+    jenkins.originalPost = jenkins.post;
     }
     jenkins.post = function(url, data, cb) {
         expect(url).toBe('/pluginManager/installPlugins');
         var allMatch = true;
         for(var i = 0; i < plugins.length; i++) {
-		if(data.plugins.indexOf(plugins[i]) < 0) {
-			allMatch = false;
-			break;
-		}
+        if(data.plugins.indexOf(plugins[i]) < 0) {
+            allMatch = false;
+            break;
+        }
         }
         if(!allMatch) {
             expect(JSON.stringify(plugins)).toBe('In: ' + JSON.stringify(data.plugins));
         }
         // return status
         cb({status:'ok',data:{correlationId:1}});
-	    if(complete) {
-		complete();
-	    }
+        if(complete) {
+        complete();
+        }
     };
 };
 
 describe("pluginSetupWizard.js", function () {
-	it("wizard shows", function (done) {
-		test(function($) {
+    it("wizard shows", function (done) {
+        test(function($) {
             // Make sure the dialog was shown
             var $wizard = $('.plugin-setup-wizard');
             expect($wizard.size()).toBe(1);
@@ -176,49 +182,49 @@ describe("pluginSetupWizard.js", function () {
         });
     });
 
-	it("offline shows", function (done) {
-		jsTest.onPage(function() {
-			// deps
-		    var jenkins = jsTest.requireSrcModule('./util/jenkins');
+    it("offline shows", function (done) {
+        jsTest.onPage(function() {
+            // deps
+            var jenkins = jsTest.requireSrcModule('./util/jenkins');
 
-		    var $ = getJQuery();
-		    $.ajax = ajaxMocks();
+            var $ = getJQuery();
+            $.ajax = ajaxMocks();
 
-		    var get = jenkins.get;
-		    try {
-			    // Respond with failure
-			jenkins.get = function(url, cb) {
-				if (debug) {
+            var get = jenkins.get;
+            try {
+                // Respond with failure
+            jenkins.get = function(url, cb) {
+                if (debug) {
                         console.log('Jenkins.GET: ' + url);
                     }
 
-				if(url === '/updateCenter/connectionStatus?siteId=default') {
-					cb({
-						status: 'ok',
-						data: {
-							updatesite: 'ERROR',
-							internet: 'ERROR'
-						}
-					});
-				}
-				else {
-					get(url, cb);
-				}
-			    };
+                if(url === '/updateCenter/connectionStatus?siteId=default') {
+                    cb({
+                        status: 'ok',
+                        data: {
+                            updatesite: 'ERROR',
+                            internet: 'ERROR'
+                        }
+                    });
+                }
+                else {
+                    get(url, cb);
+                }
+                };
 
-			    // load the module
-			    var pluginSetupWizard = jsTest.requireSrcModule('pluginSetupWizardGui');
+                // load the module
+                var pluginSetupWizard = jsTest.requireSrcModule('pluginSetupWizardGui');
 
-		        // exported init
-		        pluginSetupWizard.init();
+                // exported init
+                pluginSetupWizard.init('body');
 
-			    expect($('.welcome-panel h1').text()).toBe('Offline');
+                expect($('.welcome-panel h1').text()).toBe('Offline');
 
-			done();
-		    } finally {
-			jenkins.get = get;
-		    }
-		});
+            done();
+            } finally {
+            jenkins.get = get;
+            }
+        });
     });
 
     it("install defaults", function (done) {
@@ -240,16 +246,16 @@ describe("pluginSetupWizard.js", function () {
     });
 
     var doit = function($, sel, trigger) {
-	var $el = $(sel);
-	if($el.length !== 1) {
-		console.log('Not found! ' + sel);
+    var $el = $(sel);
+    if($el.length !== 1) {
+        console.log('Not found! ' + sel);
             console.log(new Error().stack);
-	}
-	if(trigger === 'check') {
-		$el.prop('checked', true);
-		trigger = 'change';
-	}
-	$el.trigger(trigger);
+    }
+    if(trigger === 'check') {
+        $el.prop('checked', true);
+        trigger = 'change';
+    }
+    $el.trigger(trigger);
     };
 
     it("install custom", function (done) {
@@ -258,8 +264,8 @@ describe("pluginSetupWizard.js", function () {
 
             // validate a call to installPlugins with our defaults
             validatePlugins(['junit','mailer'], function() {
-	            // install a specific, other 'set' of plugins
-	            $('input[name=searchbox]').val('junit');
+                // install a specific, other 'set' of plugins
+                $('input[name=searchbox]').val('junit');
 
                 done();
             });
@@ -277,7 +283,7 @@ describe("pluginSetupWizard.js", function () {
 
     it("resume install", function (done) {
         var ajaxMappings = {
-		'/jenkins/updateCenter/incompleteInstallStatus': {
+        '/jenkins/updateCenter/incompleteInstallStatus': {
                 status: 'ok',
                 data: {
                     'junit': 'Success',
@@ -288,27 +294,27 @@ describe("pluginSetupWizard.js", function () {
             }
         };
         test(function($) {
-		expect($('.modal-title').text()).toBe('Resume Installation');
-		expect($('*[data-name="junit"]').is('.success')).toBe(true);
-		done();
+        expect($('.modal-title').text()).toBe('Resume Installation');
+        expect($('*[data-name="junit"]').is('.success')).toBe(true);
+        done();
         }, ajaxMappings);
     });
 
     it("error conditions", function (done) {
         var ajaxMappings = {
-		'/jenkins/updateCenter/incompleteInstallStatus': {
+        '/jenkins/updateCenter/incompleteInstallStatus': {
                 status: 'error',
                 data: {
-			'junit': 'Success',
-			'subversion': 'Pending',
-			'other': 'Failed',
-			'mailer': 'Success'
+            'junit': 'Success',
+            'subversion': 'Pending',
+            'other': 'Failed',
+            'mailer': 'Success'
                 }
             }
         };
         test(function($) {
-		expect($('.error-container h1').html()).toBe('Error');
-		done();
+        expect($('.error-container h1').html()).toBe('Error');
+        done();
         }, ajaxMappings);
     });
 
@@ -321,18 +327,24 @@ describe("pluginSetupWizard.js", function () {
         var ajaxMappings = {
             '/jenkins/updateCenter/installStatus': new LastResponse([{
                 status: 'ok',
-                data: [] // first, return nothing by default, no ongoing install
+                data: { // first, return nothing by default, no ongoing install
+                    state: 'NEW',
+                    jobs: []
+                }
             },
             {
                 status: 'ok',
-                data: [
-                  {
-                      name: 'subversion',
-                      type: 'InstallJob',
-                      installStatus: 'Success',
-                      requiresRestart: 'true' // a string...
-                  }
-                ]
+                data: {
+                    state: 'INSTALLING_PLUGINS',
+                    jobs: [
+                      {
+                          name: 'subversion',
+                          type: 'InstallJob',
+                          installStatus: 'Success',
+                          requiresRestart: 'true' // a string...
+                      }
+                  ]
+                }
             }])
         };
         test(function($) {
@@ -340,12 +352,13 @@ describe("pluginSetupWizard.js", function () {
             expect(goButton.size()).toBe(1);
 
             // validate a call to installPlugins with our defaults
-		setTimeout(function() {
+        setTimeout(function() {
                 expect($('.install-done').is(':visible')).toBe(false);
-                expect($('.install-done-restart').is(':visible')).toBe(true);
+
+                expect($('.save-security').is(':visible')).toBe(true);
 
                 done();
-		}, 500);
+        }, 500);
 
             goButton.click();
         }, ajaxMappings);

From 08b6ff33687883d90b22ec83c385713afe3c6adf Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Sat, 5 Mar 2016 19:22:03 -0500
Subject: [PATCH 12/25] Fix test

---
 war/src/test/js/pluginSetupWizard-spec.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/war/src/test/js/pluginSetupWizard-spec.js b/war/src/test/js/pluginSetupWizard-spec.js
index 636a40e262..2674db2593 100644
--- a/war/src/test/js/pluginSetupWizard-spec.js
+++ b/war/src/test/js/pluginSetupWizard-spec.js
@@ -355,7 +355,7 @@ describe("pluginSetupWizard.js", function () {
         setTimeout(function() {
                 expect($('.install-done').is(':visible')).toBe(false);
 
-                expect($('.save-security').is(':visible')).toBe(true);
+                expect($('.save-first-user').is(':visible')).toBe(true);
 
                 done();
         }, 500);

From 12a290c44a6f69257d7aab912ea06a992bf3a4bf Mon Sep 17 00:00:00 2001
From: Kohsuke Kawaguchi <kk@kohsuke.org>
Date: Sun, 6 Mar 2016 19:28:51 -0800
Subject: [PATCH 13/25] [maven-release-plugin] prepare release jenkins-1.652

---
 cli/pom.xml  | 2 +-
 core/pom.xml | 2 +-
 pom.xml      | 4 ++--
 test/pom.xml | 2 +-
 war/pom.xml  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cli/pom.xml b/cli/pom.xml
index 60ff50f0c5..2139c424cf 100644
--- a/cli/pom.xml
+++ b/cli/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.652-SNAPSHOT</version>
+    <version>1.652</version>
   </parent>
 
   <artifactId>cli</artifactId>
diff --git a/core/pom.xml b/core/pom.xml
index 609a6528a5..f7fd9698db 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -29,7 +29,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.652-SNAPSHOT</version>
+    <version>1.652</version>
   </parent>
 
   <artifactId>jenkins-core</artifactId>
diff --git a/pom.xml b/pom.xml
index 47537cd874..d55dca854b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -33,7 +33,7 @@ THE SOFTWARE.
 
   <groupId>org.jenkins-ci.main</groupId>
   <artifactId>pom</artifactId>
-  <version>1.652-SNAPSHOT</version>
+  <version>1.652</version>
   <packaging>pom</packaging>
 
   <name>Jenkins main module</name>
@@ -58,7 +58,7 @@ THE SOFTWARE.
     <connection>scm:git:git://github.com/jenkinsci/jenkins.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/jenkinsci/jenkins.git</developerConnection>
     <url>https://github.com/jenkinsci/jenkins</url>
-    <tag>HEAD</tag>
+    <tag>jenkins-1.652</tag>
   </scm>
 
   <distributionManagement>
diff --git a/test/pom.xml b/test/pom.xml
index e494f99052..1064aba5e7 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -28,7 +28,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.652-SNAPSHOT</version>
+    <version>1.652</version>
   </parent>
 
   <artifactId>test</artifactId>
diff --git a/war/pom.xml b/war/pom.xml
index 0486d6baec..e79f82aa65 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -28,7 +28,7 @@ THE SOFTWARE.
   <parent>
     <groupId>org.jenkins-ci.main</groupId>
     <artifactId>pom</artifactId>
-    <version>1.652-SNAPSHOT</version>
+    <version>1.652</version>
   </parent>
 
   <artifactId>jenkins-war</artifactId>

From 8a84cb8e2c0dc08418e2396eb1ad4bc0225fe6ae Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Tue, 8 Mar 2016 02:33:03 -0500
Subject: [PATCH 14/25] Address outstanding issues: XStream deserialzation from
 existing installs would have had altered behavior with the FullControl auth
 strategy, erroneous return while creating the default user, added help file,
 added ability to skip first user or cancel the wizard altogether.

---
 ...trolOnceLoggedInAuthorizationStrategy.java | 13 ++++---
 .../security/HudsonPrivateSecurityRealm.java  | 35 ++++++++++++-------
 .../java/jenkins/install/SetupWizard.java     | 33 +++++++++--------
 core/src/main/java/jenkins/model/Jenkins.java | 12 ++++---
 .../help-allowAnonymousRead.html              |  3 ++
 .../install/pluginSetupWizard.properties      |  5 +++
 war/src/main/js/api/pluginManager.js          |  2 +-
 war/src/main/js/pluginSetupWizardGui.js       | 14 +++++++-
 war/src/main/js/templates/firstUserPanel.hbs  |  3 ++
 .../main/js/templates/setupCompletePanel.hbs  |  2 ++
 10 files changed, 81 insertions(+), 41 deletions(-)
 create mode 100644 core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/help-allowAnonymousRead.html

diff --git a/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java b/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
index d34bb3059f..21fb3023f7 100644
--- a/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
+++ b/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
@@ -43,10 +43,10 @@ import java.util.List;
  */
 public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationStrategy {
     /**
-     * Whether to allow read access, default behavior
-     * previously was true
+     * Whether to allow anonymouos read access, default behavior
+     * previously was to do so
      */
-    private boolean allowAnonymousRead = true;
+    private boolean authenticatedReadOnly = false;
     
     @DataBoundConstructor
     public FullControlOnceLoggedInAuthorizationStrategy() {
@@ -54,7 +54,7 @@ public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationS
 
     @Override
     public ACL getRootACL() {
-        return allowAnonymousRead ? ANONYMOUS_READ : AUTHENTICATED_READ;
+        return !authenticatedReadOnly ? ANONYMOUS_READ : AUTHENTICATED_READ;
     }
 
     public List<String> getGroups() {
@@ -65,12 +65,12 @@ public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationS
      * If true, anonymous read access will be allowed
      */
     public boolean isAllowAnonymousRead() {
-        return allowAnonymousRead;
+        return !authenticatedReadOnly;
     }
     
     @DataBoundSetter
     public void setAllowAnonymousRead(boolean allowAnonymousRead) {
-        this.allowAnonymousRead = allowAnonymousRead;
+        this.authenticatedReadOnly = !allowAnonymousRead;
     }
 
     private static final SparseACL AUTHENTICATED_READ = new SparseACL(null);
@@ -83,7 +83,6 @@ public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationS
         
         AUTHENTICATED_READ.add(ACL.EVERYONE, Jenkins.ADMINISTER, true);
         AUTHENTICATED_READ.add(ACL.ANONYMOUS, Jenkins.ADMINISTER, false);
-        AUTHENTICATED_READ.add(ACL.ANONYMOUS, Permission.READ, false);
     }
 
     /**
diff --git a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
index 63404b636e..2f45492c35 100644
--- a/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
+++ b/core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java
@@ -286,20 +286,31 @@ public class HudsonPrivateSecurityRealm extends AbstractPasswordBasedSecurityRea
             rsp.sendError(SC_UNAUTHORIZED,"First user was already created");
             return;
         }
-        String view = "firstUser.jelly";
+        
         User admin = null;
-        if(inSetup) {
-            admin = getUser(SetupWizard.initialSetupAdminUserName);
-            view = "setupWizardFirstUser.jelly";
-        }
-        User u = createAccount(req, rsp, false, view);
-        if (u!=null) {
-            tryToMakeAdmin(u);
-            if(admin != null) {
-                admin.delete();
+        try {
+            String view = "firstUser.jelly";
+            if(inSetup) {
+                admin = getUser(SetupWizard.initialSetupAdminUserName);
+                if(admin != null) {
+                    admin.delete(); // assume the new user may well be 'admin'
+                }
+                view = "setupWizardFirstUser.jelly";
+            }
+            
+            User u = createAccount(req, rsp, false, view);
+            if (u!=null) {
+                tryToMakeAdmin(u);
+                if(admin != null) {
+                    admin = null;
+                }
+                Jenkins.getInstance().setInstallState(InstallState.CREATE_ADMIN_USER.getNextState());
+                loginAndTakeBack(req, rsp, u);
+            }
+        } finally {
+            if(admin != null) {
+                admin.save(); // recreate this initial user if something failed
             }
-            Jenkins.getInstance().setInstallState(InstallState.CREATE_ADMIN_USER.getNextState());
-            loginAndTakeBack(req, rsp, u);
         }
     }
 
diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java
index a6bde8d883..055ef26ab3 100644
--- a/core/src/main/java/jenkins/install/SetupWizard.java
+++ b/core/src/main/java/jenkins/install/SetupWizard.java
@@ -14,16 +14,20 @@ import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;
 
+import org.kohsuke.stapler.HttpResponse;
+import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerResponse;
+
 import hudson.BulkChange;
 import hudson.ExtensionList;
 import hudson.model.User;
 import hudson.model.UserProperty;
-import hudson.security.AuthorizationStrategy;
 import hudson.security.FullControlOnceLoggedInAuthorizationStrategy;
 import hudson.security.HudsonPrivateSecurityRealm;
 import hudson.security.PermissionAdder;
 import hudson.security.SecurityRealm;
 import hudson.security.csrf.DefaultCrumbIssuer;
+import hudson.util.HttpResponses;
 import hudson.util.PluginServletFilter;
 import jenkins.model.Jenkins;
 import jenkins.security.s2m.AdminWhitelistRule;
@@ -36,7 +40,7 @@ public class SetupWizard {
     /**
      * The security token parameter name
      */
-    public static String initialSetupAdminUserName = "initial-setup-admin-user";
+    public static String initialSetupAdminUserName = "admin";
 
     private final Logger LOGGER = Logger.getLogger(SetupWizard.class.getName());
 
@@ -52,18 +56,16 @@ public class SetupWizard {
             String randomUUID = UUID.randomUUID().toString().replace("-", "").toLowerCase(Locale.ENGLISH);
             admin = securityRealm.createAccount(SetupWizard.initialSetupAdminUserName, randomUUID);
             admin.addProperty(new SetupWizard.AuthenticationKey(randomUUID));
-
-            AuthorizationStrategy as = Jenkins.getInstance().getAuthorizationStrategy();
-            for (PermissionAdder adder : ExtensionList.lookup(PermissionAdder.class)) {
-                if (adder.add(as, admin, Jenkins.ADMINISTER)) {
-                    return;
-                }
-            }
             
             // Lock Jenkins down:
             FullControlOnceLoggedInAuthorizationStrategy authStrategy = new FullControlOnceLoggedInAuthorizationStrategy();
             authStrategy.setAllowAnonymousRead(false);
             j.setAuthorizationStrategy(authStrategy);
+
+            // there probably aren't any implementors yet, but just in case
+            for (PermissionAdder adder : ExtensionList.lookup(PermissionAdder.class)) {
+                adder.add(authStrategy, admin, Jenkins.ADMINISTER);
+            }
             
             // Shut down all the ports we can by default:
             j.setSlaveAgentPort(-1); // -1 to disable
@@ -114,13 +116,14 @@ public class SetupWizard {
     /**
      * Remove the setupWizard filter, ensure all updates are written to disk, etc
      */
-    public void doCompleteSetupWizard() {
+    public HttpResponse doCompleteInstall(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
+        Jenkins j = Jenkins.getActiveInstance();
+        j.setInstallState(InstallState.INITIAL_SETUP_COMPLETED);
         InstallUtil.saveLastExecVersion();
-        try {
-            PluginServletFilter.removeFilter(FORCE_SETUP_WIZARD_FILTER);
-        } catch (ServletException e) {
-            throw new AssertionError(e); // never happen because our Filter.init is no-op
-        }
+        PluginServletFilter.removeFilter(FORCE_SETUP_WIZARD_FILTER);
+        // Also, clean up the setup wizard if it's completed
+        j.setSetupWizard(null);
+        return HttpResponses.okJSON();
     }
 
     // Stores a user property for the authentication key, which is really the auto-generated user's password
diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java
index e6a96e9d23..d34fa105a4 100644
--- a/core/src/main/java/jenkins/model/Jenkins.java
+++ b/core/src/main/java/jenkins/model/Jenkins.java
@@ -936,12 +936,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
      */
     @Restricted(NoExternalUse.class)
     public void setInstallState(@Nonnull InstallState newState) {
-        InstallState prior = installState;
         installState = newState;
-        if(setupWizard != null && !newState.equals(prior) && newState.isSetupComplete()) {
-            setupWizard.doCompleteSetupWizard();
-            setupWizard = null;
-        }
     }
 
     /**
@@ -3916,6 +3911,13 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
     public SetupWizard getSetupWizard() {
         return setupWizard;
     }
+    
+    /**
+     * Sets the setup wizard
+     */
+    public void setSetupWizard(SetupWizard setupWizard) {
+        this.setupWizard = setupWizard;
+    }
 
     /**
      * Exposes the current user to <tt>/me</tt> URL.
diff --git a/core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/help-allowAnonymousRead.html b/core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/help-allowAnonymousRead.html
new file mode 100644
index 0000000000..0f357d28e1
--- /dev/null
+++ b/core/src/main/resources/hudson/security/FullControlOnceLoggedInAuthorizationStrategy/help-allowAnonymousRead.html
@@ -0,0 +1,3 @@
+<div>
+  If checked, this will allow users who are not authenticated to access Jenkins in a read-only mode.
+</div>
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
index ece2cf0c6a..35624ac8cd 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
@@ -38,6 +38,11 @@ installWizard_installIncomplete_banner=Resume Installation
 installWizard_installIncomplete_message=Jenknins was restarted during installation and some plugins didn't seem to get installed.
 installWizard_installIncomplete_resumeInstallationButtonLabel=Resume
 installWizard_saveFirstUser=Save and Finish
+installWizard_skipFirstUser=Skip
+installWizard_firstUserSkippedMessage=<div class="alert alert-warning fade in">\
+You've skipped creating an admin user. To log in, use the username: 'admin' and \
+the security token you used to access the setup wizard.\
+</div>
 installWizard_addFirstUser_title=Create an Admin User
 installWizard_configureProxy_label=Configure Proxy
 installWizard_configureProxy_save=Save and Continue
diff --git a/war/src/main/js/api/pluginManager.js b/war/src/main/js/api/pluginManager.js
index 6ef1c281c5..bbe2fccb77 100644
--- a/war/src/main/js/api/pluginManager.js
+++ b/war/src/main/js/api/pluginManager.js
@@ -149,7 +149,7 @@ exports.incompleteInstallStatus = function(handler, correlationId) {
  * Call this to complete the installation without installing anything
  */
 exports.completeInstall = function(handler) {
-	jenkins.get('/updateCenter/completeInstall', function() {
+	jenkins.get('/setupWizard/completeInstall', function() {
 		handler.call({ isError: false });
 	}, {
 		timeout: pluginManagerErrorTimeoutMillis,
diff --git a/war/src/main/js/pluginSetupWizardGui.js b/war/src/main/js/pluginSetupWizardGui.js
index 3728e52aac..f85870b371 100644
--- a/war/src/main/js/pluginSetupWizardGui.js
+++ b/war/src/main/js/pluginSetupWizardGui.js
@@ -193,6 +193,12 @@ var createPluginSetupWizard = function(appendTarget) {
 				currentPanel = panel;
 				$container.append(html);
 				decorate($container);
+				
+				var $modalHeader = $container.find('.modal-header');
+				if($modalHeader.length > 0) {
+					$modalHeader.prepend(
+						'<button type="button" class="close" aria-label="Close"><span aria-hidden="true">&times;</span></button>');
+				}
 
 				if(oncomplete) {
 					oncomplete();
@@ -396,7 +402,7 @@ var createPluginSetupWizard = function(appendTarget) {
 
 	// Called to complete the installation
 	var finishInstallation = function() {
-		jenkins.goTo('/');
+		closeInstaller();
 	};
 
 	// load the plugin data, callback
@@ -667,6 +673,11 @@ var createPluginSetupWizard = function(appendTarget) {
 		securityConfig.saveFirstUser($('iframe[src]').contents().find('form:not(.no-json)'), handleSubmit, handleSubmit);
 	};
 	
+	var skipFirstUser = function() {
+		$('button').prop({disabled:true});
+		setPanel(setupCompletePanel, {message: translations.installWizard_firstUserSkippedMessage});
+	};
+	
 	// call to setup the proxy
 	var setupProxy = function() {
 		setPanel(proxyConfigPanel, {}, enableButtonsAfterFrameLoad);
@@ -749,6 +760,7 @@ var createPluginSetupWizard = function(appendTarget) {
 		'.resume-installation': resumeInstallation,
 		'.install-done-restart': restartJenkins,
 		'.save-first-user:not([disabled])': saveFirstUser,
+		'.skip-first-user': skipFirstUser,
 		'.show-proxy-config': setupProxy,
 		'.save-proxy-config': saveProxyConfig,
 		'.skip-plugin-installs': function() { installPlugins([]); }
diff --git a/war/src/main/js/templates/firstUserPanel.hbs b/war/src/main/js/templates/firstUserPanel.hbs
index d222f2efaf..7892aab108 100644
--- a/war/src/main/js/templates/firstUserPanel.hbs
+++ b/war/src/main/js/templates/firstUserPanel.hbs
@@ -7,6 +7,9 @@
 	</div>
 </div>
 <div class="modal-footer">
+    <button type="button" class="btn btn-link skip-first-user" disabled>
+        {{translations.installWizard_skipFirstUser}}
+    </button>
 	<button type="button" class="btn btn-primary save-first-user" disabled>
 		{{translations.installWizard_saveFirstUser}}
 	</button>
diff --git a/war/src/main/js/templates/setupCompletePanel.hbs b/war/src/main/js/templates/setupCompletePanel.hbs
index bff9393e06..7527af4eaa 100644
--- a/war/src/main/js/templates/setupCompletePanel.hbs
+++ b/war/src/main/js/templates/setupCompletePanel.hbs
@@ -4,6 +4,8 @@
 <div class="modal-body">
 	<div class="jumbotron welcome-panel success-panel">
 		<h1>{{translations.installWizard_installComplete_banner}}</h1>
+		
+		{{{message}}}
 
 		{{#if restartRequired}}
 		<p>{{translations.installWizard_installComplete_message}} {{translations.installWizard_installComplete_restartRequiredMessage}}</p>

From bb8492db65a57fc2b3a5ea460b46d74e0633b616 Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Tue, 8 Mar 2016 13:20:04 -0500
Subject: [PATCH 15/25] Setup wizard may run erroneously if system config page
 was never saved while running the prior version of Jenkins

---
 core/src/main/java/jenkins/install/InstallUtil.java | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/jenkins/install/InstallUtil.java b/core/src/main/java/jenkins/install/InstallUtil.java
index 6fff100057..5305f89923 100644
--- a/core/src/main/java/jenkins/install/InstallUtil.java
+++ b/core/src/main/java/jenkins/install/InstallUtil.java
@@ -61,7 +61,10 @@ public class InstallUtil {
 
     private static final Logger LOGGER = Logger.getLogger(InstallUtil.class.getName());
 
-    private static final VersionNumber NEW_INSTALL_VERSION = new VersionNumber("1.0");
+    // must use something less than 1.0, as Jenkins may
+    // report back 1.0 if the system config page has never been saved,
+    // which erroneously leads to installer running
+    private static final VersionNumber NEW_INSTALL_VERSION = new VersionNumber("0.0.0");
 
     /**
      * Get the current installation state.

From d062392108b2cd54eb445da603a83beac7f39b25 Mon Sep 17 00:00:00 2001
From: gusreiber <greiber@cloudbees.com>
Date: Tue, 8 Mar 2016 18:28:18 -0800
Subject: [PATCH 16/25] [FIX JENKINS-33418] exit if elem not defined

---
 core/src/main/resources/lib/form/select/select.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/src/main/resources/lib/form/select/select.js b/core/src/main/resources/lib/form/select/select.js
index 0b7ce9b2c6..dba4e19589 100644
--- a/core/src/main/resources/lib/form/select/select.js
+++ b/core/src/main/resources/lib/form/select/select.js
@@ -43,6 +43,9 @@ function updateListBox(listBox,url,config) {
 Behaviour.specify("SELECT.select", 'select', 1000, function(e) {
 
         function hasChanged(selectEl, originalValue) {
+            // seems like a race condition allows this to fire before the 'selectEl' is defined. If that happens, exit..
+            if(!selectEl || !selectEl.options || !selectEl[0]) 
+              return false;
             var firstValue = selectEl.options[0].value;
             var selectedValue = selectEl.value;
             if (originalValue == "" && selectedValue == firstValue) {

From ff4294ca85769418974785420a9f85df5bf64f03 Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Tue, 8 Mar 2016 23:34:03 -0500
Subject: [PATCH 17/25] Fix failing tests

---
 core/src/main/java/jenkins/install/InstallUtil.java | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/core/src/main/java/jenkins/install/InstallUtil.java b/core/src/main/java/jenkins/install/InstallUtil.java
index 5305f89923..7b71bc72e3 100644
--- a/core/src/main/java/jenkins/install/InstallUtil.java
+++ b/core/src/main/java/jenkins/install/InstallUtil.java
@@ -61,10 +61,8 @@ public class InstallUtil {
 
     private static final Logger LOGGER = Logger.getLogger(InstallUtil.class.getName());
 
-    // must use something less than 1.0, as Jenkins may
-    // report back 1.0 if the system config page has never been saved,
-    // which erroneously leads to installer running
-    private static final VersionNumber NEW_INSTALL_VERSION = new VersionNumber("0.0.0");
+    // tests need this to be 1.0
+    private static final VersionNumber NEW_INSTALL_VERSION = new VersionNumber("1.0");
 
     /**
      * Get the current installation state.
@@ -87,6 +85,10 @@ public class InstallUtil {
         // Neither the top level config or the lastExecVersionFile have a version
         // stored in them, which means it's a new install.
         if (lastRunVersion.compareTo(NEW_INSTALL_VERSION) == 0) {
+            // Edge case: used jenkins 1 but not saved the system config page, the version is not persisted, returns 1.0
+            if(!Jenkins.getInstance().getJobNames().isEmpty()) { // some jobs configured
+                return InstallState.UPGRADE;
+            }
             return InstallState.NEW;
         }
 

From 8208d1da44d4f734270461fd7e94102c8768e6a3 Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Wed, 9 Mar 2016 08:23:43 -0500
Subject: [PATCH 18/25] Re-run offline check & metadata download if needed,
 proxy configuration didn't survive refactoring, fix misc. comments by
 @jglick, updated some text based on changes to the process

---
 .../main/java/hudson/model/UpdateCenter.java  | 21 +++++++++++++++++++
 ...trolOnceLoggedInAuthorizationStrategy.java | 12 +++++------
 .../java/jenkins/install/SetupWizard.java     |  5 -----
 .../SetupWizard/proxy-configuration.jelly     |  4 ++--
 .../install/pluginSetupWizard.properties      |  2 +-
 war/src/main/js/api/securityConfig.js         |  2 +-
 war/src/main/js/pluginSetupWizardGui.js       |  2 +-
 war/src/main/js/templates/offlinePanel.hbs    |  2 +-
 .../main/js/templates/proxyConfigPanel.hbs    |  4 ++--
 9 files changed, 35 insertions(+), 19 deletions(-)

diff --git a/core/src/main/java/hudson/model/UpdateCenter.java b/core/src/main/java/hudson/model/UpdateCenter.java
index e595f0a93d..729298a5d1 100644
--- a/core/src/main/java/hudson/model/UpdateCenter.java
+++ b/core/src/main/java/hudson/model/UpdateCenter.java
@@ -302,6 +302,27 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
                 }
             }
             if (checkJob != null) {
+                boolean isOffline = false;
+                for (ConnectionStatus status : checkJob.connectionStates.values()) {
+                    if(ConnectionStatus.FAILED.equals(status)) {
+                        isOffline = true;
+                        break;
+                    }
+                }
+                if (isOffline) {
+                    // retry connection states if determined to be offline
+                    checkJob.run();
+                    isOffline = false;
+                    for (ConnectionStatus status : checkJob.connectionStates.values()) {
+                        if(ConnectionStatus.FAILED.equals(status)) {
+                            isOffline = true;
+                            break;
+                        }
+                    }
+                    if(!isOffline) { // also need to download the metadata
+                        updateAllSites();
+                    }
+                }
                 return HttpResponses.okJSON(checkJob.connectionStates);
             } else {
                 return HttpResponses.errorJSON(String.format("Unknown site '%s'.", siteId));
diff --git a/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java b/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
index 21fb3023f7..bdebc0fca4 100644
--- a/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
+++ b/core/src/main/java/hudson/security/FullControlOnceLoggedInAuthorizationStrategy.java
@@ -43,10 +43,10 @@ import java.util.List;
  */
 public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationStrategy {
     /**
-     * Whether to allow anonymouos read access, default behavior
-     * previously was to do so
+     * Whether to allow anonymous read access, for backward compatibility
+     * default is to allow it
      */
-    private boolean authenticatedReadOnly = false;
+    private boolean denyAnonymousReadAccess = false;
     
     @DataBoundConstructor
     public FullControlOnceLoggedInAuthorizationStrategy() {
@@ -54,7 +54,7 @@ public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationS
 
     @Override
     public ACL getRootACL() {
-        return !authenticatedReadOnly ? ANONYMOUS_READ : AUTHENTICATED_READ;
+        return denyAnonymousReadAccess ? AUTHENTICATED_READ : ANONYMOUS_READ;
     }
 
     public List<String> getGroups() {
@@ -65,12 +65,12 @@ public class FullControlOnceLoggedInAuthorizationStrategy extends AuthorizationS
      * If true, anonymous read access will be allowed
      */
     public boolean isAllowAnonymousRead() {
-        return !authenticatedReadOnly;
+        return !denyAnonymousReadAccess;
     }
     
     @DataBoundSetter
     public void setAllowAnonymousRead(boolean allowAnonymousRead) {
-        this.authenticatedReadOnly = !allowAnonymousRead;
+        this.denyAnonymousReadAccess = !allowAnonymousRead;
     }
 
     private static final SparseACL AUTHENTICATED_READ = new SparseACL(null);
diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java
index 055ef26ab3..b7e3f13a95 100644
--- a/core/src/main/java/jenkins/install/SetupWizard.java
+++ b/core/src/main/java/jenkins/install/SetupWizard.java
@@ -62,11 +62,6 @@ public class SetupWizard {
             authStrategy.setAllowAnonymousRead(false);
             j.setAuthorizationStrategy(authStrategy);
 
-            // there probably aren't any implementors yet, but just in case
-            for (PermissionAdder adder : ExtensionList.lookup(PermissionAdder.class)) {
-                adder.add(authStrategy, admin, Jenkins.ADMINISTER);
-            }
-            
             // Shut down all the ports we can by default:
             j.setSlaveAgentPort(-1); // -1 to disable
             
diff --git a/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly b/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly
index 132609baab..7653509dca 100644
--- a/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly
+++ b/core/src/main/resources/jenkins/install/SetupWizard/proxy-configuration.jelly
@@ -2,10 +2,10 @@
 <l:html norefresh="true" title="${it.displayName}" xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:main-panel>
       <h1>${%HTTP Proxy Configuration}</h1>
-      <f:form method="post" action="proxyConfigure" name="proxyConfigure">
+      <f:form method="post" action="/pluginManager/proxyConfigure" name="proxyConfigure">
         <j:scope>
           <j:set var="instance" value="${app.proxy}"/>
-          <j:set var="descriptor" value="${it.pluginManager.proxyDescriptor}"/>
+          <j:set var="descriptor" value="${app.pluginManager.proxyDescriptor}"/>
           <st:include from="${descriptor}" page="${descriptor.configPage}" />
         </j:scope>
       </f:form>
diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
index e48733cf2f..005dc45339 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
@@ -10,7 +10,7 @@ installWizard_offline_message=This Jenkins instance appears to be offline. \
 <p style="font-size:18px; margin-top: 6%"> \
 For information about installing Jenkins without an internet connection, see the \
 <a href="https://wiki.jenkins-ci.org/display/JENKINS/Offline+Jenkins+Installation" target="_blank">Offline Jenkins Installation Documentation</a>. <br/><br/> \
-If you need to configure a proxy, you may close this wizard and use the Plugin Manager. \
+You may choose to continue by configuring a proxy or skipping plugin installation. \
 </p>
 installWizard_error_header=An error occurred
 installWizard_error_message=An error occurred during installation:
diff --git a/war/src/main/js/api/securityConfig.js b/war/src/main/js/api/securityConfig.js
index 2f5b0cf7fb..5b7793e78a 100644
--- a/war/src/main/js/api/securityConfig.js
+++ b/war/src/main/js/api/securityConfig.js
@@ -24,7 +24,7 @@ exports.saveFirstUser = function($form, success, error) {
  */
 exports.saveProxy = function($form, success, error) {
 	jenkins.staplerPost(
-			'/proxyConfigure',
+			'/pluginManager/proxyConfigure',
 		$form,
 		success, {
 			dataType: 'html',
diff --git a/war/src/main/js/pluginSetupWizardGui.js b/war/src/main/js/pluginSetupWizardGui.js
index d1dad09a20..c50ad3467d 100644
--- a/war/src/main/js/pluginSetupWizardGui.js
+++ b/war/src/main/js/pluginSetupWizardGui.js
@@ -719,7 +719,7 @@ var createPluginSetupWizard = function(appendTarget) {
 	// Save the proxy config
 	var saveProxyConfig = function() {
 		securityConfig.saveProxy($('iframe[src]').contents().find('form:not(.no-json)'), function() {
-			setPanel(welcomePanel);
+			jenkins.goTo('/'); // this will re-run connectivity test
 		});
 	};
 	
diff --git a/war/src/main/js/templates/offlinePanel.hbs b/war/src/main/js/templates/offlinePanel.hbs
index a0b0ad82af..d10d78a444 100644
--- a/war/src/main/js/templates/offlinePanel.hbs
+++ b/war/src/main/js/templates/offlinePanel.hbs
@@ -6,7 +6,7 @@
         <h1>{{translations.installWizard_offline_title}}</h1>
         <p>{{{translations.installWizard_offline_message}}}</p>
         <p>
-            <button type="button" class="btn btn-primary configure-proxy">{{translations.installWizard_configureProxy_label}}</button>
+            <button type="button" class="btn btn-primary show-proxy-config">{{translations.installWizard_configureProxy_label}}</button>
             <button type="button" class="btn btn-primary skip-plugin-installs">{{translations.installWizard_skipPluginInstallations}}</button>
         </p>
     </div>
diff --git a/war/src/main/js/templates/proxyConfigPanel.hbs b/war/src/main/js/templates/proxyConfigPanel.hbs
index 698814e400..ac4b259bb0 100644
--- a/war/src/main/js/templates/proxyConfigPanel.hbs
+++ b/war/src/main/js/templates/proxyConfigPanel.hbs
@@ -1,9 +1,9 @@
 <div class="modal-header">
-    <h4 class="modal-title">{{translations.installWizard_configureProxy_label}} PROXY</h4>
+    <h4 class="modal-title">{{translations.installWizard_configureProxy_label}}</h4>
 </div>
 <div class="modal-body">
     <div class="jumbotron welcome-panel security-panel">
-        <iframe src="{{baseUrl}}/proxy-configuration"></iframe>
+        <iframe src="{{baseUrl}}/setupWizard/proxy-configuration"></iframe>
     </div>
 </div>
 <div class="modal-footer">

From 1561bcafb3ee17b3499642b4dc4eaa37e960695e Mon Sep 17 00:00:00 2001
From: kzantow <kzantow@gmail.com>
Date: Wed, 9 Mar 2016 09:40:45 -0500
Subject: [PATCH 19/25] Better test to determine if the Jenkins instance was
 actually used

---
 core/src/main/java/jenkins/install/InstallUtil.java | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/jenkins/install/InstallUtil.java b/core/src/main/java/jenkins/install/InstallUtil.java
index 7b71bc72e3..475d1a3e01 100644
--- a/core/src/main/java/jenkins/install/InstallUtil.java
+++ b/core/src/main/java/jenkins/install/InstallUtil.java
@@ -85,8 +85,10 @@ public class InstallUtil {
         // Neither the top level config or the lastExecVersionFile have a version
         // stored in them, which means it's a new install.
         if (lastRunVersion.compareTo(NEW_INSTALL_VERSION) == 0) {
-            // Edge case: used jenkins 1 but not saved the system config page, the version is not persisted, returns 1.0
-            if(!Jenkins.getInstance().getJobNames().isEmpty()) { // some jobs configured
+            // Edge case: used Jenkins 1 but did not save the system config page,
+            // the version is not persisted and returns 1.0, so try to check if
+            // they actually did anything
+            if (!Jenkins.getInstance().getItemMap().isEmpty()) {
                 return InstallState.UPGRADE;
             }
             return InstallState.NEW;

From 785e0ef819797602f7efa67d514c109282a1017f Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Thu, 10 Mar 2016 00:44:10 +0100
Subject: [PATCH 20/25] First attempt at a plugins list based on dev list
 feedback

---
 war/src/main/js/api/plugins.js | 87 +++++++++++++++++++++++++---------
 1 file changed, 65 insertions(+), 22 deletions(-)

diff --git a/war/src/main/js/api/plugins.js b/war/src/main/js/api/plugins.js
index 4f3bcb967e..bd27164296 100644
--- a/war/src/main/js/api/plugins.js
+++ b/war/src/main/js/api/plugins.js
@@ -8,17 +8,27 @@
 // away from these.
 //
 exports.recommendedPlugins = [
+    "ant",
     "antisamy-markup-formatter",
-    "credentials",
+    "build-monitor-plugin",
+    "build-timeout",
+    "cloudbees-folder",
+    "credentials-binding",
+    "email-ext",
+    "git",
     "github-branch-source",
-    "junit",
+    "gradle",
+    "ldap",
     "mailer",
     "matrix-auth",
-    "script-security",
+    "pam-auth",
+    "pipeline-stage-view",
+    "ssh-slaves",
     "subversion",
-    "translation",
+    "timestamper",
     "workflow-aggregator",
-    "workflow-multibranch"
+    "workflow-multibranch",
+    "ws-cleanup"
 ];
 
 //
@@ -27,50 +37,79 @@ exports.recommendedPlugins = [
 //
 exports.availablePlugins = [
     {
-        "category": "General",
-        "description": "(a collection of things I cannot think of a better name for)",
+        "category":"Organization and Administration",
         "plugins": [
-            { "name": "external-monitor-job" },
-            { "name": "translation" }
+            { "name": "dashboard-view" },
+            { "name": "build-monitor-plugin" },
+            { "name": "cloudbees-folder" },
+            { "name": "antisamy-markup-formatter" }
         ]
     },
     {
-        "category":"Organization and Administration",
+        "category":"Build Features",
+        "description":"Add general purpose features to your jobs",
         "plugins": [
-            { "name": "antisamy-markup-formatter" }
+            { "name": "ansicolor" },
+            { "name": "build-name-setter" },
+            { "name": "build-timeout" },
+            { "name": "config-file-provider" },
+            { "name": "credentials-binding" },
+            { "name": "rebuild" },
+            { "name": "ssh-agent" },
+            { "name": "throttle-concurrents" },
+            { "name": "timestamper" },
+            { "name": "ws-cleanup" }
         ]
     },
     {
         "category":"Build Tools",
         "plugins": [
             { "name": "ant" },
-            { "name": "maven-plugin" }
+            { "name": "gradle" },
+            { "name": "msbuild" },
+            { "name": "nodejs" }
         ]
     },
     {
         "category":"Build Analysis and Reporting",
         "plugins": [
-            { "name": "javadoc" },
-            { "name": "junit" }
+            { "name": "checkstyle" },
+            { "name": "cobertura" },
+            { "name": "htmlpublisher" },
+            { "name": "junit" },
+            { "name": "sonar" },
+            { "name": "warnings" },
+            { "name": "xunit" }
         ]
     },
     {
         "category":"Pipelines and Continuous Delivery",
         "plugins": [
             { "name": "workflow-aggregator" },
+            { "name": "workflow-multibranch" },
             { "name": "github-branch-source" },
-            { "name": "workflow-multibranch" }
+            { "name": "pipeline-stage-view" },
+            { "name": "build-pipeline-plugin" },
+            { "name": "conditional-buildstep" },
+            { "name": "jenkins-multijob-plugin" },
+            { "name": "parameterized-trigger" },
+            { "name": "copyartifact" }
         ]
     },
     {
-        "category":"SCM",
+        "category":"Source Code Management",
         "plugins": [
+            { "name": "bitbucket" },
             { "name": "cvs" },
+            { "name": "git" },
+            { "name": "git-parameter" },
+            { "name": "github" },
+            { "name": "gitlab-plugin" },
             { "name": "subversion" }
         ]
     },
     {
-        "category":"Distributed Builds and Containers",
+        "category":"Distributed Builds",
         "plugins": [
             { "name": "matrix-project" },
             { "name": "ssh-slaves" },
@@ -80,18 +119,22 @@ exports.availablePlugins = [
     {
         "category":"User Management and Security",
         "plugins": [            
-            { "name": "credentials" },
-            { "name": "ldap" },
             { "name": "matrix-auth" },
             { "name": "pam-auth" },
-            { "name": "script-security" },
-            { "name": "ssh-credentials" }
+            { "name": "ldap" },
+            { "name": "role-strategy" },
+            { "name": "active-directory" }
         ]
     },
     {
         "category":"Notifications and Publishing",
         "plugins": [
-            { "name": "mailer" }
+            { "name": "email-ext" },
+            { "name": "emailext-template" },
+            { "name": "mailer" },
+            { "name": "publish-over-ssh" },
+            { "name": "slack" },
+            { "name": "ssh" }
         ]
     }
 ];
\ No newline at end of file

From 28d0bad1d02d8257d17729fdd642c584072c7c95 Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Thu, 10 Mar 2016 01:07:58 +0100
Subject: [PATCH 21/25] Add actual SCM plugins with significant installation
 count

---
 war/src/main/js/api/plugins.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/war/src/main/js/api/plugins.js b/war/src/main/js/api/plugins.js
index bd27164296..db5e09f43e 100644
--- a/war/src/main/js/api/plugins.js
+++ b/war/src/main/js/api/plugins.js
@@ -100,12 +100,17 @@ exports.availablePlugins = [
         "category":"Source Code Management",
         "plugins": [
             { "name": "bitbucket" },
+            { "name": "clearcase" },
             { "name": "cvs" },
             { "name": "git" },
             { "name": "git-parameter" },
             { "name": "github" },
             { "name": "gitlab-plugin" },
-            { "name": "subversion" }
+            { "name": "p4" },
+            { "name": "repo" },
+            { "name": "subversion" },
+            { "name": "teamconcert" },
+            { "name": "tfs" }
         ]
     },
     {

From 7f87486c73b1c63cc595c0fc380d42ada45f6116 Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Thu, 10 Mar 2016 19:22:19 +0100
Subject: [PATCH 22/25] Temporarily remove plugins affected by JENKINS-33296

---
 war/src/main/js/api/plugins.js | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/war/src/main/js/api/plugins.js b/war/src/main/js/api/plugins.js
index db5e09f43e..0cb9a5c5d4 100644
--- a/war/src/main/js/api/plugins.js
+++ b/war/src/main/js/api/plugins.js
@@ -20,7 +20,7 @@ exports.recommendedPlugins = [
     "gradle",
     "ldap",
     "mailer",
-    "matrix-auth",
+    // "matrix-auth",
     "pam-auth",
     "pipeline-stage-view",
     "ssh-slaves",
@@ -39,7 +39,7 @@ exports.availablePlugins = [
     {
         "category":"Organization and Administration",
         "plugins": [
-            { "name": "dashboard-view" },
+            // { "name": "dashboard-view" },
             { "name": "build-monitor-plugin" },
             { "name": "cloudbees-folder" },
             { "name": "antisamy-markup-formatter" }
@@ -73,12 +73,12 @@ exports.availablePlugins = [
     {
         "category":"Build Analysis and Reporting",
         "plugins": [
-            { "name": "checkstyle" },
-            { "name": "cobertura" },
+            // { "name": "checkstyle" },
+            // { "name": "cobertura" },
             { "name": "htmlpublisher" },
             { "name": "junit" },
-            { "name": "sonar" },
-            { "name": "warnings" },
+            // { "name": "sonar" },
+            // { "name": "warnings" },
             { "name": "xunit" }
         ]
     },
@@ -90,8 +90,8 @@ exports.availablePlugins = [
             { "name": "github-branch-source" },
             { "name": "pipeline-stage-view" },
             { "name": "build-pipeline-plugin" },
-            { "name": "conditional-buildstep" },
-            { "name": "jenkins-multijob-plugin" },
+            // { "name": "conditional-buildstep" },
+            // { "name": "jenkins-multijob-plugin" },
             { "name": "parameterized-trigger" },
             { "name": "copyartifact" }
         ]
@@ -124,7 +124,7 @@ exports.availablePlugins = [
     {
         "category":"User Management and Security",
         "plugins": [            
-            { "name": "matrix-auth" },
+            // { "name": "matrix-auth" },
             { "name": "pam-auth" },
             { "name": "ldap" },
             { "name": "role-strategy" },

From f7a335fa572938f9ba2851df9ae52498e3832498 Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Thu, 10 Mar 2016 19:34:39 +0100
Subject: [PATCH 23/25] Remove more plugins temporarily, these need Matrix
 Project

---
 war/src/main/js/api/plugins.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/war/src/main/js/api/plugins.js b/war/src/main/js/api/plugins.js
index 0cb9a5c5d4..c8ecec960f 100644
--- a/war/src/main/js/api/plugins.js
+++ b/war/src/main/js/api/plugins.js
@@ -50,15 +50,15 @@ exports.availablePlugins = [
         "description":"Add general purpose features to your jobs",
         "plugins": [
             { "name": "ansicolor" },
-            { "name": "build-name-setter" },
+            // { "name": "build-name-setter" },
             { "name": "build-timeout" },
             { "name": "config-file-provider" },
             { "name": "credentials-binding" },
             { "name": "rebuild" },
             { "name": "ssh-agent" },
-            { "name": "throttle-concurrents" },
-            { "name": "timestamper" },
-            { "name": "ws-cleanup" }
+            // { "name": "throttle-concurrents" },
+            { "name": "timestamper" }
+            // { "name": "ws-cleanup" }
         ]
     },
     {

From 88e32df69d226b30a9367ead2c46f750b49b6612 Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Thu, 10 Mar 2016 21:02:11 +0100
Subject: [PATCH 24/25] Remove Role Strategy due to its implied Matrix Auth
 dependency

---
 war/src/main/js/api/plugins.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/war/src/main/js/api/plugins.js b/war/src/main/js/api/plugins.js
index c8ecec960f..9d7286af5b 100644
--- a/war/src/main/js/api/plugins.js
+++ b/war/src/main/js/api/plugins.js
@@ -127,7 +127,7 @@ exports.availablePlugins = [
             // { "name": "matrix-auth" },
             { "name": "pam-auth" },
             { "name": "ldap" },
-            { "name": "role-strategy" },
+            // { "name": "role-strategy" },
             { "name": "active-directory" }
         ]
     },

From 29371d38594ce0a3bcd66f4d950d2fe1aeec51f3 Mon Sep 17 00:00:00 2001
From: "R. Tyler Croy" <tyler@monkeypox.org>
Date: Thu, 10 Mar 2016 12:56:50 -0800
Subject: [PATCH 25/25] Clean-up the verbiage in the new-user plugin setup
 dialog

I worked much of this out with @orrc and @omehegan in #jenkins-community, but
feel these string changes will make the dialog more clear and understandable to
a new Jenkins user.

[FIX JENKINS-33464]
---
 .../install/pluginSetupWizard.properties       | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
index 005dc45339..71130d75f3 100644
--- a/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
+++ b/core/src/main/resources/jenkins/install/pluginSetupWizard.properties
@@ -1,10 +1,10 @@
 installWizard_welcomePanel_title=Getting Started
-installWizard_welcomePanel_banner=Initial Jenkins Setup
-installWizard_welcomePanel_message=Choose plugins. This will add features to your Jenkins environment.
-installWizard_welcomePanel_recommendedActionTitle=Start with recommended plugins
-installWizard_welcomePanel_recommendedActionDetails=Install the set of plugins the community finds most useful
-installWizard_welcomePanel_customizeActionTitle=Customize your plugins
-installWizard_welcomePanel_customizeActionDetails=Select from a community approved list of plugins
+installWizard_welcomePanel_banner=Customize Jenkins
+installWizard_welcomePanel_message=Plugins extend Jenkins with additional features to support many different needs.
+installWizard_welcomePanel_recommendedActionTitle=Install suggested plugins
+installWizard_welcomePanel_recommendedActionDetails=Install plugins the Jenkins community finds most useful.
+installWizard_welcomePanel_customizeActionTitle=Select plugins to install
+installWizard_welcomePanel_customizeActionDetails=Select and install plugins most suitable for your needs.
 installWizard_offline_title=Offline
 installWizard_offline_message=This Jenkins instance appears to be offline. \
 <p style="font-size:18px; margin-top: 6%"> \
@@ -29,13 +29,13 @@ installWizard_installing_detailsLink=Details...
 installWizard_installComplete_title=Installed
 installWizard_installComplete_banner=Jenkins is ready!
 installWizard_pluginsInstalled_message=Your plugin installations are complete.
-installWizard_installComplete_message=Your Jenkins installation is complete.
-installWizard_installComplete_finishButtonLabel=Get Started
+installWizard_installComplete_message=Your Jenkins setup is complete.
+installWizard_installComplete_finishButtonLabel=Start using Jenkins
 installWizard_installComplete_restartRequiredMessage=Some plugins require Jenkins to be restarted.
 installWizard_installComplete_restartLabel=Restart
 installWizard_installIncomplete_title=Resume Installation
 installWizard_installIncomplete_banner=Resume Installation
-installWizard_installIncomplete_message=Jenknins was restarted during installation and some plugins didn't seem to get installed.
+installWizard_installIncomplete_message=Jenkins was restarted during installation and some plugins didn't seem to get installed.
 installWizard_installIncomplete_resumeInstallationButtonLabel=Resume
 installWizard_saveFirstUser=Save and Finish
 installWizard_skipFirstUser=Skip