On-demand creation of newly registered users in Curam not supported

To date customers have used ad hoc solutions to this issue. This enhancement works as an alternative to GUM-4475 in cases where the customer does not want to do a batch import of users and cannot make a web service call from the Enterprise Authentication system into C�ram to create new users on demand.

The scenario is as follows:
The customer has an enterprise authentication system which is used for logins to all services. Clients can start their screening anonymously. 1) When they choose to register for an account, they are re-directed to the system where they can pick a username and password.
2) This done they are re-directed back to IBM C�ram Universal Access. This is where things get a little tricky - most UA functions require you to have a user already created in order to work correctly.
3) The Web Proxy intercepts the re-direct back to UA and requests the creation of a new user.

The difficulty with implementing step 3 is that, at this point the user Principal is set to "X" where X is the new user's username however the user "X" does not yet exist in C�ram and so it is not straightforward to invoke a facade to create a new user.

We need to perform a proper analysis to recommend the best design to address this issue. One possible avenue is as follows:
- Provide an API that allows the customer to override the standard behaviour of PublicUserSecurity.getSecurityRole().
- The standard OOTB behaviour here is to return null if the user is not found. If the standard behaviour returns null the customer needs to query to see if that user exists. If so then then the custom code can choose to return them a role that will allow them only to create an account for the new user. Once the account is created the remainder of the flow can proceed normally.