Description:

For some setups that don't allow user registration it may be worthwhile to allow OIDC or OAuth2.0 sign-in for user convenience. However, I haven't found a way to disable creation of new users via OIDC. Sign-in works, but it also enables new users to sign-in to the server freely.

It would be great to change allow_existing_users (or have a new setting) with an enum:

• no = don't allow sign-in for an existing user
• yes = allow sign-in for a pre-existing user w/o OIDC mapping
• only = implies yes, but additionaly restricts the sign-in to match only pre-existing users