migrate local NextCloud user to OIDC

It is a common use cases that self-hosted environments grow: in features but also from simple to complex. Hence it is likely that a NextCloud instance is first set up with local user management (by NextCloud natively). Maybe later, an authentication server gets mixed in, and here we are: let's use user_oidc for that.

Question: how can one migrate the local users to the OIDC provider?

With vanilla settings, user_oidc always creates a new user, even if the email of a NextCloud user and user_oidc-provided user match.

What I tried:
Example: my NextCloud user has the username foo. user_oidc is configured like this:

I.e. it knows which username the authentication server (Keycloak in my case) uses: username.
Logging in now, doesn't create a new user, but directly fails:

"Failed to provision user"

Would it be possible to merge accounts then?

Start by tracing the user_oidc provisioning flow described in the issue, including the username mapping and the “Failed to provision user” path. Define how an existing local account should be matched or merged with the OIDC identity, then verify that login no longer creates a duplicate user and that existing account data remains intact.