diff --git a/roles/ci/templates/config.xml b/roles/ci/templates/config.xml
index 6b2615d..f704d10 100644
--- a/roles/ci/templates/config.xml
+++ b/roles/ci/templates/config.xml
@@ -1,148 +1,173 @@
 <?xml version='1.0' encoding='UTF-8'?>
 <hudson>
   <disabledAdministrativeMonitors/>
   <version>1.648</version>
   <numExecutors>2</numExecutors>
   <mode>EXCLUSIVE</mode>
   <useSecurity>true</useSecurity>
-  <authorizationStrategy class="hudson.security.GlobalMatrixAuthorizationStrategy">
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Create:admin</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Create:phabricator</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Delete:admin</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Delete:phabricator</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains:admin</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Update:admin</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Update:phabricator</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.View:admin</permission>
-    <permission>com.cloudbees.plugins.credentials.CredentialsProvider.View:phabricator</permission>
-    <permission>hudson.model.Computer.Build:admin</permission>
-    <permission>hudson.model.Computer.Configure:admin</permission>
-    <permission>hudson.model.Computer.Connect:admin</permission>
-    <permission>hudson.model.Computer.Create:admin</permission>
-    <permission>hudson.model.Computer.Delete:admin</permission>
-    <permission>hudson.model.Computer.Disconnect:admin</permission>
-    <permission>hudson.model.Hudson.Administer:admin</permission>
-    <permission>hudson.model.Hudson.ConfigureUpdateCenter:admin</permission>
-    <permission>hudson.model.Hudson.Read:admin</permission>
-    <permission>hudson.model.Hudson.Read:anonymous</permission>
-    <permission>hudson.model.Hudson.Read:phabricator</permission>
-    <permission>hudson.model.Hudson.RunScripts:admin</permission>
-    <permission>hudson.model.Hudson.RunScripts:phabricator</permission>
-    <permission>hudson.model.Hudson.UploadPlugins:admin</permission>
-    <permission>hudson.model.Item.Build:admin</permission>
-    <permission>hudson.model.Item.Build:phabricator</permission>
-    <permission>hudson.model.Item.Cancel:admin</permission>
-    <permission>hudson.model.Item.Cancel:phabricator</permission>
-    <permission>hudson.model.Item.Configure:admin</permission>
-    <permission>hudson.model.Item.Configure:phabricator</permission>
-    <permission>hudson.model.Item.Create:admin</permission>
-    <permission>hudson.model.Item.Create:phabricator</permission>
-    <permission>hudson.model.Item.Delete:admin</permission>
-    <permission>hudson.model.Item.Delete:phabricator</permission>
-    <permission>hudson.model.Item.Discover:admin</permission>
-    <permission>hudson.model.Item.Discover:phabricator</permission>
-    <permission>hudson.model.Item.Read:admin</permission>
-    <permission>hudson.model.Item.Read:anonymous</permission>
-    <permission>hudson.model.Item.Read:phabricator</permission>
-    <permission>hudson.model.Item.Workspace:admin</permission>
-    <permission>hudson.model.Item.Workspace:phabricator</permission>
-    <permission>hudson.model.Run.Delete:admin</permission>
-    <permission>hudson.model.Run.Delete:phabricator</permission>
-    <permission>hudson.model.Run.Update:admin</permission>
-    <permission>hudson.model.Run.Update:phabricator</permission>
-    <permission>hudson.model.View.Configure:admin</permission>
-    <permission>hudson.model.View.Create:admin</permission>
-    <permission>hudson.model.View.Delete:admin</permission>
-    <permission>hudson.model.View.Read:admin</permission>
-    <permission>hudson.model.View.Read:anonymous</permission>
-    <permission>hudson.scm.SCM.Tag:admin</permission>
+  <authorizationStrategy class="com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy">
+    <roleMap type="projectRoles">
+      <role name="@CoOwnerNoSid" pattern=".*">
+        <permissions>
+          <permission>hudson.model.Item.Cancel</permission>
+          <permission>hudson.model.Item.Delete</permission>
+          <permission>hudson.model.Item.Read</permission>
+          <permission>hudson.model.Item.Workspace</permission>
+          <permission>hudson.model.Item.Build</permission>
+          <permission>hudson.model.Item.Configure</permission>
+          <permission>hudson.model.Item.Discover</permission>
+        </permissions>
+        <assignedSIDs>
+          <sid>authenticated</sid>
+        </assignedSIDs>
+      </role>
+    </roleMap>
+    <roleMap type="globalRoles">
+      <role name="Read" pattern=".*">
+        <permissions>
+          <permission>hudson.model.Hudson.Read</permission>
+        </permissions>
+        <assignedSIDs>
+          <sid>authenticated</sid>
+          <sid>admin</sid>
+          <sid>anonymous</sid>
+        </assignedSIDs>
+      </role>
+      <role name="admin" pattern=".*">
+        <permissions>
+          <permission>hudson.model.View.Delete</permission>
+          <permission>hudson.model.Computer.Connect</permission>
+          <permission>hudson.model.Run.Delete</permission>
+          <permission>hudson.model.Hudson.UploadPlugins</permission>
+          <permission>com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains</permission>
+          <permission>hudson.model.Computer.Create</permission>
+          <permission>hudson.model.View.Configure</permission>
+          <permission>com.synopsys.arc.jenkins.plugins.ownership.OwnershipPlugin.Jobs</permission>
+          <permission>hudson.model.Hudson.ConfigureUpdateCenter</permission>
+          <permission>hudson.model.Computer.Build</permission>
+          <permission>hudson.model.Item.Configure</permission>
+          <permission>hudson.model.Hudson.Administer</permission>
+          <permission>hudson.model.Item.Cancel</permission>
+          <permission>hudson.model.Item.Read</permission>
+          <permission>com.cloudbees.plugins.credentials.CredentialsProvider.View</permission>
+          <permission>hudson.model.Computer.Delete</permission>
+          <permission>hudson.model.Item.Build</permission>
+          <permission>hudson.scm.SCM.Tag</permission>
+          <permission>hudson.model.Item.Discover</permission>
+          <permission>hudson.model.Hudson.Read</permission>
+          <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Update</permission>
+          <permission>hudson.model.Item.Create</permission>
+          <permission>hudson.model.Item.Workspace</permission>
+          <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Delete</permission>
+          <permission>hudson.model.View.Read</permission>
+          <permission>hudson.model.Hudson.RunScripts</permission>
+          <permission>hudson.model.View.Create</permission>
+          <permission>hudson.model.Item.Delete</permission>
+          <permission>hudson.model.Computer.Configure</permission>
+          <permission>com.cloudbees.plugins.credentials.CredentialsProvider.Create</permission>
+          <permission>com.synopsys.arc.jenkins.plugins.ownership.OwnershipPlugin.Nodes</permission>
+          <permission>hudson.model.Computer.Disconnect</permission>
+          <permission>hudson.model.Run.Update</permission>
+        </permissions>
+        <assignedSIDs>
+          <sid>admin</sid>
+        </assignedSIDs>
+      </role>
+      <role name="job-creator" pattern=".*">
+        <permissions>
+          <permission>hudson.model.Item.Create</permission>
+        </permissions>
+        <assignedSIDs>
+          <sid>authenticated</sid>
+        </assignedSIDs>
+      </role>
+    </roleMap>
   </authorizationStrategy>
-  <securityRealm class="org.jenkinsci.plugins.PhabricatorSecurityRealm" plugin="phab-oauth@0.29">
+  <securityRealm class="org.jenkinsci.plugins.PhabricatorSecurityRealm" plugin="phab-oauth@0.31">
     <clientID>{{ jenkins_phab_id }}</clientID>
     <clientSecret>{{ jenkins_phab_secret }}</clientSecret>
     <serverURL>{{ jenkins_phab_url }}</serverURL>
-    <trustAllCert>false</trustAllCert>
   </securityRealm>
   <disableRememberMe>false</disableRememberMe>
   <projectNamingStrategy class="jenkins.model.ProjectNamingStrategy$DefaultProjectNamingStrategy"/>
   <workspaceDir>${ITEM_ROOTDIR}/workspace</workspaceDir>
   <buildsDir>${ITEM_ROOTDIR}/builds</buildsDir>
   <markupFormatter class="hudson.markup.EscapedMarkupFormatter"/>
   <jdks/>
   <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
   <myViewsTabBar class="hudson.views.DefaultMyViewsTabBar"/>
   <clouds>
     <com.nirima.jenkins.plugins.docker.DockerCloud plugin="docker-plugin@0.16.0">
       <name>docker-coreos</name>
       <templates>
         <com.nirima.jenkins.plugins.docker.DockerTemplate>
           <configVersion>2</configVersion>
           <labelString></labelString>
           <launcher class="com.nirima.jenkins.plugins.docker.launcher.DockerComputerSSHLauncher">
             <sshConnector plugin="ssh-slaves@1.10">
               <port>22</port>
               <credentialsId>59c90edd-cfc6-4ae8-83d3-87cb8ae9880f</credentialsId>
               <jvmOptions></jvmOptions>
               <javaPath></javaPath>
               <maxNumRetries>0</maxNumRetries>
               <retryWaitTime>0</retryWaitTime>
             </sshConnector>
           </launcher>
           <remoteFsMapping></remoteFsMapping>
           <remoteFs>/home/jenkins</remoteFs>
           <instanceCap>2147483647</instanceCap>
           <mode>NORMAL</mode>
           <retentionStrategy class="com.nirima.jenkins.plugins.docker.strategy.DockerOnceRetentionStrategy">
-            <idleMinutes>10</idleMinutes>
+            <idleMinutes>0</idleMinutes>
             <idleMinutes defined-in="com.nirima.jenkins.plugins.docker.strategy.DockerOnceRetentionStrategy">10</idleMinutes>
           </retentionStrategy>
           <numExecutors>1</numExecutors>
           <dockerTemplateBase>
             <image>jenkins-1</image>
             <dockerCommand></dockerCommand>
             <lxcConfString></lxcConfString>
             <hostname></hostname>
             <dnsHosts/>
             <volumes/>
             <volumesFrom2/>
             <environment/>
             <bindPorts></bindPorts>
             <bindAllPorts>false</bindAllPorts>
             <memoryLimit>2048</memoryLimit>
             <cpuShares>256</cpuShares>
             <privileged>false</privileged>
             <tty>false</tty>
             <extraHosts class="java.util.Collections$UnmodifiableRandomAccessList" resolves-to="java.util.Collections$UnmodifiableList">
               <c class="list"/>
               <list reference="../c"/>
             </extraHosts>
           </dockerTemplateBase>
           <removeVolumes>false</removeVolumes>
           <pullStrategy>PULL_LATEST</pullStrategy>
         </com.nirima.jenkins.plugins.docker.DockerTemplate>
       </templates>
       <serverUrl>http://{{ hostvars['127.0.0.1']['openstackcislave'].results[0]['openstack']['private_v4'] }}:4243</serverUrl>
       <connectTimeout>5</connectTimeout>
       <readTimeout>15</readTimeout>
       <credentialsId></credentialsId>
       <containerCap>10</containerCap>
     </com.nirima.jenkins.plugins.docker.DockerCloud>
   </clouds>
   <quietPeriod>5</quietPeriod>
   <scmCheckoutRetryCount>0</scmCheckoutRetryCount>
   <views>
     <hudson.model.AllView>
       <owner class="hudson" reference="../../.."/>
       <name>All</name>
       <filterExecutors>false</filterExecutors>
       <filterQueue>false</filterQueue>
       <properties class="hudson.model.View$PropertyList"/>
     </hudson.model.AllView>
   </views>
   <primaryView>All</primaryView>
   <slaveAgentPort>0</slaveAgentPort>
   <label>master</label>
   <nodeProperties/>
   <globalNodeProperties/>
   <noUsageStatistics>true</noUsageStatistics>
 </hudson>