Allow users to clean up role assignments

This change allows users the ability to remove role assignments in the
event the user has been removed from the backend.

Closes-Bug: #1321378
Change-Id: I895e6e9718bc48344a53f192d5d56e6990da888e
Merge "Allow users to clean up role assignments"
Ensure identity sql driver supports domain-specific configuration.

For an identity driver to be used with a domain-specific config file,
it must accept a ConfigOpts as an optional parameter. The ldap driver
already supported this - so this patch adds this to the sql driver.

The above change is trivial, but the rest of the patch is enhancing
our testing to validate this operation, as well as enforcing the
limitation listed below.

Limitation:

Currently Keystone only supports one SQL driver - this patch
does not change that.  What it does enable is for that one SQL
driver to be assigned to a specific domain, as opposed to being just
a catch-all for domains without a specific configuration file.
This at least enables the (often requested) scenario of service users
to be stored in SQL in a predominantly LDAP installation.

Closes-Bug: 1217017
Change-Id: Ic531ebae28680fc518d8e036db516f5982241c40