add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
Why does any of this code need to know the specifics of the struct for the object identity?  Passing the interface through would accomplish the same thing.