OIDC: Giving a user admin rights wipes their OIDC binding

[Pingumania]

Can the issue be reproduced with the latest available release? (y/n)
y

Which one is the environment gotify server is running in?

• Docker

docker-compose.yml

networks:
  proxy:
    external: true

services:
  gotify:
    image: ghcr.io/gotify/server
    container_name: gotify
    restart: unless-stopped
    networks:
      - proxy
    environment:
      - TZ=${TZ}
      - GOTIFY_SERVER_TRUSTEDPROXIES=127.0.0.1/32,::1
      - GOTIFY_SERVER_SECURECOOKIE=true
      - GOTIFY_OIDC_ENABLED=true
      - GOTIFY_OIDC_ISSUER=https://authelia-vps.${DOMAIN_1_NAME}.${DOMAIN_1_TLD_1}
      - GOTIFY_OIDC_CLIENTID=gotify
      - GOTIFY_OIDC_CLIENTSECRET=${GOTIFY_OIDC_CLIENTSECRET}
      - GOTIFY_OIDC_REDIRECTURL=https://gotify.${DOMAIN_1_NAME}.${DOMAIN_1_TLD_1}/auth/oidc/callback
      - GOTIFY_OIDC_AUTOREGISTER=true
      - GOTIFY_OIDC_LINK_BY_USERNAME=false
      - GOTIFY_OIDC_USERNAMECLAIM=preferred_username
      - GOTIFY_OIDC_SCOPES=openid,profile,email
    volumes:
      - ./data:/app/data
    labels:
      - traefik.enable=true
      - traefik.http.routers.gotify.entrypoints=internal-secure
      - traefik.http.routers.gotify.middlewares=secure-headers@file
      - traefik.http.routers.gotify.rule=Host(`gotify.${DOMAIN_1_NAME}.${DOMAIN_1_TLD_1}`)
      - traefik.http.services.gotify.loadbalancer.server.port=80
      - traefik.http.services.gotify.loadbalancer.server.scheme=http

Do you have an reverse proxy installed in front of gotify server?

• Traefik

On which client do you experience problems? (Select as many as you can see)

• WebUI

What did you do?

1. Setup OIDC with Authelia
2. Login with OIDC user xyz
3. Logout user xyz
4. Login with local admin account
5. Promote OIDC user xyz to Admin
6. Logout local admin
7. Login with OIDC user xyz
8. Error

What did you expect to see?
OIDC login still works without error.

What did you see instead? (Include screenshots, android logcat/request dumps if possible)
a local user with the username xyz already exists and linking by username is disabled

[jmattheis]

Thanks for the report 👍.