This patch allows a federated user to obtain an unscoped token by
providing login credentials for a keystone identity provider.
The current implementation should work with any properly configured
openid connect provider.
partially implements bp openid-connect
Change-Id: Iade52b5c1432d64582cbaa8bac41ac6366c210f9