Direct grant + automatic user creation + postponed authorization

Hi all, I have auth flow with x509 certificate and ldap user federation. When client access kc for the first time ticket creation is refused, but the user (taken from cert) is created in kc database with roles from ldap. Then the same client access kc a second time (the same cert and parameters) and ticket is issued as expected. Is it right? Why is user authorization postponed for a second time?
Thank you for the explanation.

That is not the expected behaviour.

Maybe you should take a look at authentication flow to check if the user creation is working as expected.

But I tried lots of combination without success. So my question is: Is it possible to create a user outside of “First login flow”?