add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
I don't care for the proliferation of multiple representations for the same thing in a single project.  I think it makes a mess as people try to write adapters to go from component to the next and in really bad cases it can introduce bad dependencies as people try to reuse multiple adapters to move from object A to object B to object C to make their calls.