I am making use of an account template to create account before application role(s) can be added i.e. Entitlements Require Account = Yes and an account template is associated with the application.
The target application, while provisioning the account, generates a unique internal ID for each account. This internal ID is required to add/ remove application role(s).
The account collector collects this internal ID as I have created a custom attribute for this.
However, there is an issue. When the create account AFX triggers, it gets completed without any verification (i.e. IMG does not verify account creation via collection i.e. there is no Pending verification for create account. This is because, a placeholder account (local user mapping) is automatically created by IMG in the backend! Refer to How to get rid of Local User Account? discussion for this behaviour.
As such, since account collection has not occurred yet, the add application role(s) AFX calls fail as they expect the internal ID for the account to be provided!
How can this requirement be addressed?
Also, why does IMG NOT wait for account collection to actually verify that the account has been created successfully, just like other AFX actions? The design seems to be weird.