Best approach for Provisioning user ids externally and use SSO

Summary

Approach to create userid outside but assign roles in fusion based on role mapping rules

Content

Please comment if Option 1 is actually the best approach or not feasible. If there is another appraoch please suggest.

Here are the details

SSO Requirement:  System should have SSO enabled with central system identity provider (AD Shibboleth)

Authentication and Single Sign On (SSO)

Scenario: As per the requirement federated identity management will be used.  The Active directory component Shibboleth, which is already certified by Oracle for SSO, will be integrated for single sign on. It has been agreed that account must will be provisioned in IDM (Identity management system) outside of Oracle and then brought back into Oracle Fusion.