IdStory Identity Manager

I tested many scenarios, but I am not able simulated this on the product version. I will continue with this (note: maybe immediately priority is using in the project somewhere).

Conclusion:

I was not able to simulate it on the default product because all provisioning operations are performed asynchronously by default. The event queue determines that the order of provisioning operations is correct (according to the creation date).
I was only able to simulate this problem if I use synchronous provisioning (an event with imidiately priority). In this case, the synchronous event does not persist in the event queue and causes the execution in different order.

For prevent this we need to ensure some async queue. The simplest solution is enable async provisioning on the system. Problem here is this mechanism is not use anymore on projects (replaced by event queue) and maybe will cause perfomance problem, because executing of provisioning queue is processed in one thread.

You can try enable async privisioning on your system a tested performance. Async provisioning can be improved in the product, but this is big change (maybe to the version 10.6.0).

I think I met the same behaviour in our project which has minimum project specific implementation. It was probably caused by ProcessSkippedAutomaticRoleByTreeForContractTaskExecutor which run just after the synchronization of contracts and so they operated on the same identity.
All details are in #2418 (the second part of the ticket description).

A different situation would be probably solved by the previous change: Adding 2 automatic roles to the same organization collided and one of the roles wasn't assigned to the user sitting on the organization.

Please consider putting this fix in 10.4.4, is it possible?

In my project, we create the automatic roles programatically and the collision happened in cca 10 % of the automatic roles. We didn't notice it at first, because the error is visible only in the result of the LRT ProcessAutomaticRoleByTreeTaskExecutor. The LRT has the result Executed, only one of the item has Failed state:
AUTOMATIC_ROLE_ASSIGN_TASK_NOT_COMPLETE
org.springframework.dao.DataIntegrityViolationException: could not execute statement; SQL [n/a]; constraint [null];
Cannot insert duplicate key row in object 'bcv_idm_storage.acc_account' with unique index 'ux_account_uid'. The duplicate key value is (1237554366, 0xe19d97e4d4fe4079b43f517393a59280).

The inconsistent state could be repaired by running ProcessAllAutomaticRoleByTreeTaskExecutor - it processed 1031 automatic roles in 7 minutes and assigned 111 roles, which were missing due to the previous collisions.
If the fix wasn't present in 10.4.4, we would have to run this task periodically. It seems to be quick, but we will have 10k automatic roles in the end, so it isn't ideal.