OAuth login - Users are occasionally forced to change their password

Description:

Description:
Users logging in for the 2nd time via OAuth2 receive “email has already been used” error.
We use keycloak for oauth services.

Steps to reproduce:

1. Configure KeyCloak for OAuth Service
2. Try log in via keycloak (for example kerberos)
3. Log out
4. Try again
5. Pop up about force change password

(allow change password - disabled for all users)
6.4.* the same issue

Expected behavior:

Merge LDAP / OAuth users without confirmation email, etc

Actual behavior:

Server Setup Information:

Version of Rocket.Chat Server: 6.3.10
Operating System: Linux
Deployment Method: Docker
Number of Running Instances: 30
DB Replicaset Oplog: False
NodeJS Version: v14.21.3
MongoDB Version: 5.0.9
Proxy: Haproxy
Firewalls involved: No

Client Setup Information

• Desktop App or Browser Version: Electron latest
• Operating System: Chrome latest

Additional context

Relevant logs:

The same issues:

https://github.com/RocketChat/Rocket.Chat/issues/18391

https://github.com/RocketChat/Rocket.Chat/issues/18255

https://github.com/RocketChat/Rocket.Chat/issues/17307

No files or tests are named. Start by reproducing the second Keycloak OAuth login and compare the behavior with issues 18391, 18255, and 17307; trace the user merge and password-change flow. Done means a returning OAuth user logs in without an “email has already been used” error, confirmation email, or forced password change.