OpenStack Keystone (clone keystone.openstack.org, with AD changes)