Split Identity and Assignment in keystone

For AD/LDAP deployments user information comes from the external source, and roles/tenants/domains come from mysql controlled by openstack