We are in the similar position using CAS. The solution, working for us is:
1. user authenticating with authenticating with authority system to get the ticket
2. Client get redirected to the server application to do SSO with that ticket
a. server checking with Authority system the validity of the ticket
b. if user
doesn’t exist in the DB, then server pulls the principal info and saves it in the local DB
This is how user get created in the server’s DB at the first login. Also, at that time server can validate that user’s info didn’t change (whatever info was coped from the principal).