https://www.pivotaltracker.com/story/show/72187802
Finishes [#72187802]
Add origin (user origin column, values like 'uaa', 'ldap', 'keystone') to track where a user originated from during the authentication process
Add external_id to track the users external username, for cases like LDAP, it will be the DN or UID
Implement origin validation during authentication. Meaning, a user can only be authenticated by the UAA authentication manager if the user was originated in the UAA (not LDAP or Keystone or SAML). This is to prevent authentication or non UAA users by the UAA authentication manager.
The default value for a user origin is now UAA. As a result, systems with ldap or saml integration may have to reauthorize approvals as those user will be recreated.

Refactor the authz_approval table to use USER_ID rather than non unique username
The origin/external_id changes are related to refactoring the approvals table relationship.