Keystone doesn't have any concept that corresponds to our 'user' class. We need to write a Horizon panel that manages users directly in ldap.

In our world, a user:

• Has an ldap identity
• Has project membership declared in ldap
• Has logins on instances but cannot create or destroy them or otherwise manipulate project states