Keycloak - how to allow linking accounts without registration

I am managing a Keycloak realm with only a single, fully-trusted external IdP added that is intended to be the default authentication mechanism for users.

I do not want to allow user to register, i.e. I want to manually create a local Keycloak user, and that user should then be allowed to link his external IdP account to the pre-existing Keycloak account, having the email address as common identifier. Users with access to the external IdP but without an existing Keycloak account should not be allowed to connect.

I tried the following First Broker Login settings, but whenever a user tries to login, he gets an error message (code: invalid_user_credentials).

Do you have any idea what my mistake might be?

Looks like they integrated this feature in version 4.5.0.

See automatic account link docs.

Basically you need to create a new flow and add 2 alternative executions:

1. Create User If Unique

2. Automatically Link Brokered Account