[v4.2.2rc] Cherry-pick authn/authz changes by jcannava from master to v4.2.2rc

Split Identity and Assignment in keystone so that for AD/LDAP deployments user
information comes from the external source, and roles/tenants/domains come
from mysql controlled by openstack

References: https://github.com/rcbops/chef-cookbooks/issues/801