Role lookup fails for Active Directory

When using Keystone against an Active Directory server, assigned roles aren't found for users.

To recreate, set up Keystone to go against Active Directory, create users and roles, then try to get a token scoped to a project as a user. It will fail with

 User admin is unauthorized for tenant 3c1299e1042a40009691dfb3ad474180 (HTTP 401)

I looked into this a bit, and it looks like the problem is that DNs aren't being compared correctly.

With Active Directory, when you add a roleOccupant, the DN gets normalized. For exmample, here I add a "cn=..." dn to an entry, but when I search to get it back, it's now "CN=..." (the attribute name has been capitalized).

$ ldapmodify <<EOF
dn: CN=8bd9f13ac6cf43f7ac85fd95c66d0a4b,CN=3c1299e1042a40009691dfb3ad474180,ou=groups
add: roleOccupant
roleOccupant: cn=8bd9f13ac6cf43f7ac85fd95c66d0a4b,CN=3c1299e1042a40009691dfb3ad474180,ou=groups
EOF

modifying entry "CN=8bd9f13ac6cf43f7ac85fd95c66d0a4b,CN=3c1299e1042a40009691dfb3ad474180,ou=groups"

$ ldapsearch -LL -s base \
    -b "CN=8bd9f13ac6cf43f7ac85fd95c66d0a4b,CN=3c1299e1042a40009691dfb3ad474180,ou=groups" \
    "(objectclass=organizationalRole)" roleOccupant
version: 1

dn: CN=8bd9f13ac6cf43f7ac85fd95c66d0a4b,CN=3c1299e1042a40009691dfb3ad474180,ou=groups
roleOccupant: CN=8bd9f13ac6cf43f7ac85fd95c66d0a4b,CN=3c1299e1042a40009691dfb3a
 d474180,ou=groups

There's suspect code in keystone/assignment/backends/ldap.py:

            return [self.role._dn_to_id(a.role_dn)
                    for a in role_assignments
                    if a.user_dn == user_dn]

here, user_dn is like 'cn=xxx' and the result user_dn is like 'CN=xxx'
so they don't match.

Keystone needs to do DN comparisons properly, for example by normalizing.