add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
as @smarterclayton pointed out, we should try to avoid using named return parameters... In this case, I would prefer non-named as the types describe the return value for godoc...