Q:

How to obtain Access controls or permissions for the user?, If the user is authenticated in the third party services

If Users are not available in AEM instance and authenticated in third party services via SAML, How to obtain Access controls or permissions for the user? Will AEM allows to set or apply permissions on the users who are not available in AEM?

A:

As per SAML Integration Documentation

Limitations
  User Must Exist in AEM Users logging in via the
  handler must exist, or if missing must be created in, AEM (“Autocreate
  CRX Users” must be checked). This is because the Sling authentication
  framework, which the  SamlAuthenticationHandler is a part of, extracts
  user credentials from the SAMLResponse and logs into the JCR
  repository using those credentials.

Also refer this link on Adobe AEM forum

