add user identity provisioning

@liggitt This builds on top of https://github.com/openshift/origin/pull/334, so I'll rebase it again once yours goes in, but I'm still looking for feedback.
> we avoid making our DTOs have methods specifically to force decoupling of concerns

Ok.  Are you ok with a thin adapter in another package, something like:
type FooAdapter struct{
    delegate userapi.UserIdentityMapping
}

or should I bite the bullet and simply copy the data to a different type?