add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
Also, this interface shouldn't be defined here - it should be defined in a different package.   You're just implementing that API.  Someone shouldn't have to require this package to get this interface.