A sales employee records a new business customer, anna@firm.ch of Firm Ltd, in the CRM. Anna registered herself in the shop's self-service a year ago as a private customer. What should the provisioning to the IdP do, and why?
Look the user up in the IdP by e-mail, find Anna's existing account and only add the company to it; it must not create a second user and must not touch her password.
Walk through it the way the create flow does:
- Capture: the new Customer (e-mail, company) is saved in the CRM.
- Search: the provisioning searches the IdP for a user with e-mail anna@firm.ch.
- Decide: a user exists (created by self-registration, no company yet).
- Act: add the company to that user. Done.
In state-table terms this is the case "new in the CRM, the rest already known": before, the CRM has a new customer and the IdP and self-service hold a user without a company; after, the same user has the company and everything else is unchanged.
What goes wrong if you skip the search and just create a user? You get two IdP users with the same e-mail: one with her own password and no company, one with an initial password and the company. Logins become ambiguous, password resets go to the wrong account, and deleting the business customer later would leave the private one behind. Searching before creating is the single most important rule when two sources can create the same object.
Go deeper:
Record linkage (Wikipedia) — the general problem of recognising that two records describe the same person.