[Bug]: SAML (Keycloak) authentication not working w/ CalDAV / WebDAV

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

This is a reopen of #20646. Quote
We are using Keycloak as authentication backend. Authentication works in the browser if people are using /login. If Android/Thunderbird wants to subscribe a calendar, it gets a 401. If we reset the "local nextcloud" password with occ user:resetpassword, the Cal/CardDav login works. Username can be found with occ user:list | grep.
Why does Card/CaldDav authentication not work with third party authentication?

I used this for testing. ~~Also interesting: the 401 takes ~30 seconds (it's always the same).~~ So it seems like there is a timeout involved.~~

Installed version: 25.0.1.1

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

List of activated Apps

Enabled:
  - activity: 2.17.0
  - calendar: 4.2.2
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contacts: 5.0.2
  - contactsinteraction: 1.6.0
  - dav: 1.24.0
  - deck: 1.8.3
  - external: 5.0.0
  - federatedfilesharing: 1.15.0
  - files: 1.20.1
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - group_everyone: 0.1.11
  - lookup_server_connector: 1.13.0
  - notifications: 2.13.1
  - oauth2: 1.13.0
  - onlyoffice: 7.6.8
  - provisioning_api: 1.15.0
  - related_resources: 1.0.3
  - serverinfo: 1.15.0
  - settings: 1.7.0
  - sociallogin: 5.2.0
  - text: 3.6.0
  - theming: 2.0.1
  - theming_customcss: 1.12.0
  - twofactor_backupcodes: 1.14.0
  - viewer: 1.9.0
  - workflowengine: 2.7.0
Disabled:
  - admin_audit
  - bruteforcesettings
  - dashboard: 7.5.0
  - encryption
  - federation: 1.15.0
  - files_external
  - files_pdfviewer: 2.6.0
  - files_rightclick: 1.4.0
  - files_versions: 1.18.0
  - firstrunwizard: 2.14.0
  - groupfolders: 13.1.0
  - logreader: 2.10.0
  - nextcloud_announcements: 1.14.0
  - password_policy: 1.15.0
  - photos: 2.0.0
  - privacy: 1.9.0
  - recommendations: 1.4.0
  - richdocumentscode: 22.5.802
  - sharebymail: 1.15.0
  - support: 1.8.0
  - survey_client: 1.13.0
  - suspicious_login
  - systemtags: 1.15.0
  - timemanager: 0.3.4
  - timetracker: 0.0.77
  - twofactor_totp
  - updatenotification: 1.15.0
  - user_ldapThere
  - user_status: 1.5.0
  - weather_status: 1.5.0

Start by reproducing the 401 with an Android or Thunderbird CalDAV/CardDAV client against the listed Nextcloud 25.0.1.1 setup, comparing SAML login with a password set through occ user:resetpassword. The payload names no target files or tests, so trace the DAV authentication path and SSO-SAML integration before defining the affected entry point. Done means third-party-authenticated users can authenticate through CalDAV/WebDAV without resetting a local password.