[master] Split Identity and Assignment in keystone

For AD/LDAP deployments user information comes from the external source, and roles/tenants/domains come from mysql controlled by openstack

References https://github.com/rcbops/chef-cookbooks/issues/801