IdM & Repositories out of sync

Hey guys,

We're suffering from an issue where some users exist in IdM but don't in the ABAP backend.

The reason why this has happend was solved (what a severe beating isn't good for 😉) but the impact of it still exists.

Now I have been thinking about this for a while but havent found a good solution to it yet.

Can someone help me with finding a way to make sure that our IdM is the only truth. Meaning, can I have IdM check if a user actually exists in a certain system and if that user doesn't exist have IdM create that user and add the right roles to him?

The problem we're facing with the regular reconsile job is that it checks a certain user, thinks that the user exists in a system and directly goes to the provisioning of roles and other data meaning I just get an error that the user doesn't exist.

Thanks in advance!