Fix role lookup for Active Directory

When using Keystone against an Active Directory server, assigned
roles weren't found for users.

When roles are added as DNs in the roleOccupant attribute, an LDAP
server can normalize the value so that when the entry is read later
the roleOccupant isn't exactly the same as it was when added.
Keystone should compare users by ID rather than by DN.
(Note that this is how the comparison is done in Grizzly.)

Keystone's fake LDAP is changed to muck with roleOccupant and
member DNs by uppercasing attribute names (like Active Directory).
The code is fixed to compare users by ID rather than DN.

Change-Id: Iaa41c3ef9febcabef0662f38b13d319a5b5583bc
Resolves-Bug: #1210675
Add 'cn' to attribute_list for enabled_users/tenants query

Fixes Bug: 1217447

Change-Id: I712b2fccc08d48487515491684ef8e6c9a91ee0a
Merge "Add 'cn' to attribute_list for enabled_users/tenants query"
Merge "Fix role lookup for Active Directory"