I am familiar with and have successfully created a Communities user in Salesforce (acting as a SAML service provider (SP)) using Just-In-Time (JIT) provisioning when using a non Salesforce identity provider. When using JIT the attributes are being added to the SAML Assertion which requires an Identity Provider (IdP) to have generated an Assertion. This implies that a User must already exist in the Idenity Provider for it to generate an Assertion against that User. In my use case, I would like to have the user be generated in the IdP during the Web registration flow and then provisioned in the SP using JIT. In addition, I would like to have the forms all be in the web flow, not redirected to the IdP registration/login screen. With the given being that I am using Salesforce as the IdP and the SP. Is there a way to create the IdP user from the web flow. To clarify, by web flow, I mean a user coming in from a website (external to salesforce) but controlled by me. See below sequence diagram for reference
In SAML terms Salesforce can function as both identity provider and a service provider.
Your web registration flow could act as a SAML identity provider and generate a SAML response targeting Salesforce. You will then be able to use JIT features of SF's SAML SP implementation. Historically JIT via SAML in SFDC hasn't been very flexible and therefore not a good choice for complex user account provisioning use cases. They're rolling out an improvement to this in Spring '15 with an ability to intercept the JIT call and inject logic in your own, custom ApEx class.
A more important question in your case is that of web registration flow. If (as your sequence diagram shows) this flow is going to reside outside of Salesforce, then you have two choices of how to provision the user account in Salesforce: call Salesforce APIs remotely (via SOAP/REST/etc) or use JIT via SAML. If your registration flow is going to be implemented as a set of screens residing at Salesforce, i.e. a standard scenario with registration pages in Visualforce with backing ApEx code, then your implementation is a simple set of calls to the APIs via ApEx.